From aa1c56eeb6cdb3e313cb3ecde0cfd5d447b6808f Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Thu, 13 Jun 2024 11:26:29 +0200 Subject: [PATCH] att&ck and dett&ct x-assessment of sysmon config --- .../Sysmon_Observations (1).svg | 2 ++ .../sysmon_observations.xlsx | Bin 0 -> 16596 bytes 2 files changed, 2 insertions(+) create mode 100644 2-2-adversary-emulation-and-training-data-generation/Sysmon_Observations (1).svg create mode 100644 2-2-adversary-emulation-and-training-data-generation/sysmon_observations.xlsx diff --git a/2-2-adversary-emulation-and-training-data-generation/Sysmon_Observations (1).svg b/2-2-adversary-emulation-and-training-data-generation/Sysmon_Observations (1).svg new file mode 100644 index 0000000..870a97a --- /dev/null +++ b/2-2-adversary-emulation-and-training-data-generation/Sysmon_Observations (1).svg @@ -0,0 +1,2 @@ + +domain & platformsWindowsaggregateshowing aggregate scores using the sum aggregate functionContent InjectionDrive-by CompromiseExploit Public-Facing ApplicationExternal Remote ServicesHardware AdditionsPhishingReplication Through Removable MediaSupply Chain CompromiseTrusted RelationshipValid AccountsSpearphishing AttachmentSpearphishing LinkSpearphishing via ServiceSpearphishing VoiceCompromise Hardware Supply ChainCompromise Software Dependencies and Development ToolsCompromise Software Supply ChainDefault AccountsDomain AccountsLocal AccountsInitial AccessCommand and Scripting InterpreterExploitation for Client ExecutionInter-Process CommunicationNative APIScheduled Task/JobShared ModulesSoftware Deployment ToolsSystem ServicesUser ExecutionWindows Management InstrumentationAutoHotKey & AutoITJavaScriptPowerShellPythonVisual BasicWindows Command ShellComponent Object ModelDynamic Data ExchangeAtScheduled TaskService ExecutionMalicious FileMalicious LinkExecutionAccount ManipulationBITS JobsBoot or Logon Autostart ExecutionBoot or Logon Initialization ScriptsBrowser ExtensionsCompromise Host Software BinaryCreate AccountCreate or Modify System ProcessEvent Triggered ExecutionExternal Remote ServicesHijack Execution FlowModify Authentication ProcessOffice Application StartupPower SettingsPre-OS BootScheduled Task/JobServer Software ComponentTraffic SignalingValid AccountsAdditional Email Delegate PermissionsDevice RegistrationActive SetupAuthentication PackageLSASS DriverPort MonitorsPrint ProcessorsRegistry Run Keys / Startup FolderSecurity Support ProviderShortcut ModificationTime ProvidersWinlogon Helper DLLLogon Script (Windows)Network Logon ScriptDomain AccountLocal AccountWindows ServiceAccessibility FeaturesAppCert DLLsAppInit DLLsApplication ShimmingChange Default File AssociationComponent Object Model HijackingImage File Execution Options InjectionInstaller PackagesNetsh Helper DLLPowerShell ProfileScreensaverWindows Management Instrumentation Event SubscriptionAppDomainManagerCOR_PROFILERDLL Search Order HijackingDLL Side-LoadingExecutable Installer File Permissions WeaknessKernelCallbackTablePath Interception by PATH Environment VariablePath Interception by Search Order HijackingPath Interception by Unquoted PathServices File Permissions WeaknessServices Registry Permissions WeaknessDomain Controller AuthenticationHybrid IdentityMulti-Factor AuthenticationNetwork Provider DLLPassword Filter DLLReversible EncryptionAdd-insOffice Template MacrosOffice TestOutlook FormsOutlook Home PageOutlook RulesBootkitComponent FirmwareSystem FirmwareAtScheduled TaskIIS ComponentsSQL Stored ProceduresTerminal Services DLLTransport AgentWeb ShellPort KnockingSocket FiltersDefault AccountsDomain AccountsLocal AccountsPersistenceAbuse Elevation Control MechanismAccess Token ManipulationAccount ManipulationBoot or Logon Autostart ExecutionBoot or Logon Initialization ScriptsCreate or Modify System ProcessDomain or Tenant Policy ModificationEscape to HostEvent Triggered ExecutionExploitation for Privilege EscalationHijack Execution FlowProcess InjectionScheduled Task/JobValid AccountsBypass User Account ControlCreate Process with TokenMake and Impersonate TokenParent PID SpoofingSID-History InjectionToken Impersonation/TheftAdditional Email Delegate PermissionsDevice RegistrationActive SetupAuthentication PackageLSASS DriverPort MonitorsPrint ProcessorsRegistry Run Keys / Startup FolderSecurity Support ProviderShortcut ModificationTime ProvidersWinlogon Helper DLLLogon Script (Windows)Network Logon ScriptWindows ServiceGroup Policy ModificationTrust ModificationAccessibility FeaturesAppCert DLLsAppInit DLLsApplication ShimmingChange Default File AssociationComponent Object Model HijackingImage File Execution Options InjectionInstaller PackagesNetsh Helper DLLPowerShell ProfileScreensaverWindows Management Instrumentation Event SubscriptionAppDomainManagerCOR_PROFILERDLL Search Order HijackingDLL Side-LoadingExecutable Installer File Permissions WeaknessKernelCallbackTablePath Interception by PATH Environment VariablePath Interception by Search Order HijackingPath Interception by Unquoted PathServices File Permissions WeaknessServices Registry Permissions WeaknessAsynchronous Procedure CallDynamic-link Library InjectionExtra Window Memory InjectionListPlantingPortable Executable InjectionProcess DoppelgängingProcess HollowingThread Execution HijackingThread Local StorageAtScheduled TaskDefault AccountsDomain AccountsLocal AccountsPrivilege EscalationAbuse Elevation Control MechanismAccess Token ManipulationBITS JobsDebugger EvasionDeobfuscate/Decode Files or InformationDirect Volume AccessDomain or Tenant Policy ModificationExecution GuardrailsExploitation for Defense EvasionFile and Directory Permissions ModificationHide ArtifactsHijack Execution FlowImpair DefensesImpersonationIndicator RemovalIndirect Command ExecutionMasqueradingModify Authentication ProcessModify RegistryObfuscated Files or InformationPre-OS BootProcess InjectionReflective Code LoadingRogue Domain ControllerRootkitSubvert Trust ControlsSystem Binary Proxy ExecutionSystem Script Proxy ExecutionTemplate InjectionTraffic SignalingTrusted Developer Utilities Proxy ExecutionUse Alternate Authentication MaterialValid AccountsVirtualization/Sandbox EvasionXSL Script ProcessingBypass User Account ControlCreate Process with TokenMake and Impersonate TokenParent PID SpoofingSID-History InjectionToken Impersonation/TheftGroup Policy ModificationTrust ModificationEnvironmental KeyingWindows File and Directory Permissions ModificationEmail Hiding RulesFile/Path ExclusionsHidden File SystemHidden Files and DirectoriesHidden UsersHidden WindowIgnore Process InterruptsNTFS File AttributesProcess Argument SpoofingRun Virtual InstanceVBA StompingAppDomainManagerCOR_PROFILERDLL Search Order HijackingDLL Side-LoadingExecutable Installer File Permissions WeaknessKernelCallbackTablePath Interception by PATH Environment VariablePath Interception by Search Order HijackingPath Interception by Unquoted PathServices File Permissions WeaknessServices Registry Permissions WeaknessDisable or Modify System FirewallDisable or Modify ToolsDisable Windows Event LoggingDowngrade AttackImpair Command History LoggingIndicator BlockingSafe Mode BootSpoof Security AlertingClear Command HistoryClear Mailbox DataClear Network Connection History and ConfigurationsClear PersistenceClear Windows Event LogsFile DeletionNetwork Share Connection RemovalTimestompDouble File ExtensionInvalid Code SignatureMasquerade File TypeMasquerade Task or ServiceMatch Legitimate Name or LocationRename System UtilitiesRight-to-Left OverrideDomain Controller AuthenticationHybrid IdentityMulti-Factor AuthenticationNetwork Provider DLLPassword Filter DLLReversible EncryptionBinary PaddingCommand ObfuscationCompile After DeliveryDynamic API ResolutionEmbedded PayloadsEncrypted/Encoded FileFileless StorageHTML SmugglingIndicator Removal from ToolsLNK Icon SmugglingSoftware PackingSteganographyStripped PayloadsBootkitComponent FirmwareSystem FirmwareAsynchronous Procedure CallDynamic-link Library InjectionExtra Window Memory InjectionListPlantingPortable Executable InjectionProcess DoppelgängingProcess HollowingThread Execution HijackingThread Local StorageCode SigningCode Signing Policy ModificationInstall Root CertificateMark-of-the-Web BypassSIP and Trust Provider HijackingCMSTPCompiled HTML FileControl PanelElectron ApplicationsInstallUtilMavinjectMMCMshtaMsiexecOdbcconfRegsvcs/RegasmRegsvr32Rundll32VerclsidPubPrnSyncAppvPublishingServerPort KnockingSocket FiltersMSBuildPass the HashPass the TicketDefault AccountsDomain AccountsLocal AccountsSystem ChecksTime Based EvasionUser Activity Based ChecksDefense EvasionAdversary-in-the-MiddleBrute ForceCredentials from Password StoresExploitation for Credential AccessForced AuthenticationForge Web CredentialsInput CaptureModify Authentication ProcessMulti-Factor Authentication InterceptionMulti-Factor Authentication Request GenerationNetwork SniffingOS Credential DumpingSteal or Forge Authentication CertificatesSteal or Forge Kerberos TicketsSteal Web Session CookieUnsecured CredentialsARP Cache PoisoningDHCP SpoofingLLMNR/NBT-NS Poisoning and SMB RelayCredential StuffingPassword CrackingPassword GuessingPassword SprayingCredentials from Web BrowsersPassword ManagersWindows Credential ManagerSAML TokensWeb CookiesCredential API HookingGUI Input CaptureKeyloggingWeb Portal CaptureDomain Controller AuthenticationHybrid IdentityMulti-Factor AuthenticationNetwork Provider DLLPassword Filter DLLReversible EncryptionCached Domain CredentialsDCSyncLSA SecretsLSASS MemoryNTDSSecurity Account ManagerAS-REP RoastingGolden TicketKerberoastingSilver TicketCredentials In FilesCredentials in RegistryGroup Policy PreferencesPrivate KeysCredential AccessAccount DiscoveryApplication Window DiscoveryBrowser Information DiscoveryDebugger EvasionDevice Driver DiscoveryDomain Trust DiscoveryFile and Directory DiscoveryGroup Policy DiscoveryLog EnumerationNetwork Service DiscoveryNetwork Share DiscoveryNetwork SniffingPassword Policy DiscoveryPeripheral Device DiscoveryPermission Groups DiscoveryProcess DiscoveryQuery RegistryRemote System DiscoverySoftware DiscoverySystem Information DiscoverySystem Location DiscoverySystem Network Configuration DiscoverySystem Network Connections DiscoverySystem Owner/User DiscoverySystem Service DiscoverySystem Time DiscoveryVirtualization/Sandbox EvasionDomain AccountEmail AccountLocal AccountDomain GroupsLocal GroupsSecurity Software DiscoverySystem Language DiscoveryInternet Connection DiscoveryWi-Fi DiscoverySystem ChecksTime Based EvasionUser Activity Based ChecksDiscoveryExploitation of Remote ServicesInternal SpearphishingLateral Tool TransferRemote Service Session HijackingRemote ServicesReplication Through Removable MediaSoftware Deployment ToolsTaint Shared ContentUse Alternate Authentication MaterialRDP HijackingDistributed Component Object ModelRemote Desktop ProtocolSMB/Windows Admin SharesVNCWindows Remote ManagementPass the HashPass the TicketLateral MovementAdversary-in-the-MiddleArchive Collected DataAudio CaptureAutomated CollectionBrowser Session HijackingClipboard DataData from Information RepositoriesData from Local SystemData from Network Shared DriveData from Removable MediaData StagedEmail CollectionInput CaptureScreen CaptureVideo CaptureARP Cache PoisoningDHCP SpoofingLLMNR/NBT-NS Poisoning and SMB RelayArchive via Custom MethodArchive via LibraryArchive via UtilitySharepointLocal Data StagingRemote Data StagingEmail Forwarding RuleLocal Email CollectionRemote Email CollectionCredential API HookingGUI Input CaptureKeyloggingWeb Portal CaptureCollectionApplication Layer ProtocolCommunication Through Removable MediaContent InjectionData EncodingData ObfuscationDynamic ResolutionEncrypted ChannelFallback ChannelsHide InfrastructureIngress Tool TransferMulti-Stage ChannelsNon-Application Layer ProtocolNon-Standard PortProtocol TunnelingProxyRemote Access SoftwareTraffic SignalingWeb ServiceDNSFile Transfer ProtocolsMail ProtocolsWeb ProtocolsNon-Standard EncodingStandard EncodingJunk DataProtocol ImpersonationSteganographyDNS CalculationDomain Generation AlgorithmsFast Flux DNSAsymmetric CryptographySymmetric CryptographyDomain FrontingExternal ProxyInternal ProxyMulti-hop ProxyPort KnockingSocket FiltersBidirectional CommunicationDead Drop ResolverOne-Way CommunicationCommand and ControlAutomated ExfiltrationData Transfer Size LimitsExfiltration Over Alternative ProtocolExfiltration Over C2 ChannelExfiltration Over Other Network MediumExfiltration Over Physical MediumExfiltration Over Web ServiceScheduled TransferExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExfiltration Over Symmetric Encrypted Non-C2 ProtocolExfiltration Over Unencrypted Non-C2 ProtocolExfiltration Over BluetoothExfiltration over USBExfiltration Over WebhookExfiltration to Cloud StorageExfiltration to Code RepositoryExfiltration to Text Storage SitesExfiltrationAccount Access RemovalData DestructionData Encrypted for ImpactData ManipulationDefacementDisk WipeEndpoint Denial of ServiceFinancial TheftFirmware CorruptionInhibit System RecoveryNetwork Denial of ServiceResource HijackingService StopSystem Shutdown/RebootRuntime Data ManipulationStored Data ManipulationTransmitted Data ManipulationExternal DefacementInternal DefacementDisk Content WipeDisk Structure WipeApplication Exhaustion FloodApplication or System ExploitationOS Exhaustion FloodService Exhaustion FloodDirect Network FloodReflection AmplificationImpact \ No newline at end of file diff --git a/2-2-adversary-emulation-and-training-data-generation/sysmon_observations.xlsx b/2-2-adversary-emulation-and-training-data-generation/sysmon_observations.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..4a84fff92594481681d1e8e146a1c050d1bc1c2f GIT binary patch literal 16596 zcmajG19)ZIvNjyswr$(CZQJVD?AS@iwrzIUvF)T|cbxp`z3)Ez+?8sR;-Ga0LPYfc*KZwy?dOi>aN9zKVx~sk1Jf zyRA)ClB``n1476HujoFl6pXHls%U?H<2YK`9l)Hs5Dm`SO|7bJ>uDuQwYWa@PG zORwxfO!?+$$wdqa?u z{FoVjNlDXaScO9#t!foI7KA4@n!+$ANa&=8ft?_ltY`~kENytjs1l97vB7=Q@z@7J zAS|TOTfOCaC%{c?U7`JU9qs$D1Uv}LFK$@nO(lTP!90={)JK3}-Cwe0rlArsgCD_Q zEA|&hqM^s>k5X1l6Ok!(RgaO9snuayO!k2T^RXD&$W9k40d2wGUgc!!wZ+)sobE11 z5ubea-aUPSCyT))9L?kGcz;bc#_9+Q+#>?xM`eINp8M=1>gr1#yj%LiDo@%b6*X-0 zTqD9he(1hu_BC_g+XNGyj2G}CtvsL98F5pGoPcP%@mKC*EBsF+0RD)?r}O_+z&=0e zJDJ)z)Bh#&XS8l|Bv+3=?@0pz06_mshVHjyRYITK00WG`rMKw*%Qrg-h`gc>g2D|l z7QS8*JM5zvZ;Z37Hg?+f$MNTe`2^-#uVWM@GPn@|9`l!(q3VZuR0`8a zx@t=uue>GM64QCP&6yU6%4Kr9<61qgIBU9)M^jPKLMk`GAW$ncrVQ^KO7bF&njAVKK%PBh!%Mq@V4@tZ%52eG8Yf&jC zIB{9g@SnG`*t4aamA=GK8vpylftpk^o42) z1O|P=^HIVZ%zc(;(TU+QOpoim6a4?%(Qtn{=(lT}Elf>a{@F|^zY_AhV*mhzCjtO` zzWol$zsddqVf^jSWL<4#?2cKV4`0ylFDn{LZ7K=M5q-{euz6}fgeGyEplW82#4W95Zq_5Riq7CC%s*3Wmr-EzF^>GAS-ce%MSA$C4- zs`qxZ*WLW$^|9`)|MA>vk9Byu6?=NH;k}m2<_)erRDy`7S5?F3qe1(zqRlJm?%le& z95BYNgqQQJ8K}ADW}YCF`BAvTjH#NPiLWB1#^Y+a@%_#6YG?aWwubvFJ?;0tYC{T5 zm7D_v%@~r%i-xGUqBxr3DJ3FlQcatjBC(V@6GxvE$a)#l$jb&C;_(O*$!8k<_yd*t zLZ1|7lXS_H$|eRkP5645W*KoyvFk}|0v zmHQ6TMja#usN&j4OQe9*7`Bq$sUVGdHj)W+kQQwu#(-67_R?irDNLIQg}O+!Araoh zu;n>pbr#ci*C`~Y3H~v1%_LUSMS!GP-MpI(EyLVv_w&xoxu?!VU@ks{;01z9&cEd7 ztxi@tBkDbfZS;cd!pzKX&%r$`3gHZHVt!2aYiGwJ&KVf6K@&IH3%nE|rdSBPEUYP= zv=l{6$dR5ulAF95D9<$?r5vT*0WUfl73#sJ4O7M(oSoPGkg-muo#QkFBJNmbbdB!w zr%$`IXvdo_Tt~1?BGh6+Hc%CgOldVfk*fo3;98w=>8b*aq@XFSZWMAwgN5}tY4I3B zo3LVUt=6JhMRjwr`Tk%&Q(dW2B-+v6m)T{^z)TG@4mD73p(WH(_E177y=awafV+{8varIv@mvg1p4xh>G( z`cv$S$QDj=U@%gxF0(}*!_n*Fm~E+Wi$NEmc+u<7>U)Bz;@zw_M@^g1%D1^2{RNU< zOkTMcQ0XUM7@~Pah>+=BG7NA|L=}?!Co6et1{Aytm~X@&HAbQ+nEK*o z3tT;q*N|bD99dHLVSxnAkxaivXuu;e#L+`y(uV>=YFQHvWf-xaDneJk z{u(TBl4T4*`BA33(5ZjsMCl0(Q%jSok_NRQH7~iyNKr&3H)%jvC0A+-?#nRcYI;&e zz;1Ebv@KY%dqRFzk&-#{INhVAnEylWdxcU!1G%v*^)(_aU4rR{&sAmW{ew-2>jpJ-C& zXMKm(cVALNl5DlDaAWbgCw6Ej_JlMdyF2J@EIudjLi2yzk4S5)k>N0^EV0=Rub*5+ zymRmv)SOBWL?r53M!eqwt=!gL)7M7{t(~%8Ck2AlpOu6dM21S#vrlU!+TzJC7)U99 z82Skmt5seNNNw2*VULzjL*m^^`f0E$9$Lpme4bUElw4V$z(orL{i{hv28s?u-s?svR~m8Z3uHE)yc5z9Tq3QH7)z(My@J zq3oszlO||Lnbn~frT@04I9?ee8tkAZHE^daiAz10=0!n9jtSkHCjZ zm5`&<%7NdcqAQ&AL>BVXobX9%C``NgB&0?-gu`+|giwjgPV~MLH?Sx%rJP+eJXP-4 zgiye<-z!-Cb*wQc?x!Vnx%shVU`k9`qcatcXhU&7q8&m%y>_>r$gCjOiyBTUlyb-G zKrXp<-c0+KN@wx%iF8-d2rioRG$jZpG+RGiW-{;A)QX=RpmDh(KoyxET&Jh+TZD8mfl z*jMndR0$Wsqe^d43g^M&mG*Qj>oEKk1vN90Uvz?1@FOYQN3&>EMMb?;JXMNG04n~+ z^*BPi3gxp36O{;ai4<7}OMiNaRB^{0z~*I?OuHC~(-4gyF`9?m=M{s~UiAKJK3ITG z+1GJ}G7$b%dMPqvmfdLKWC&bq5FGeqnIa1joY>DsEE;jIyWb#1qX_c8aSg zpBF9?a{xh>1b+*8_lA(oqe=uT8e;rarTj9p3_fqjV|8sc9bjwQ9{FK*anc|Ng(NP%QsZ$+X!x(C1F*EOrVA1R`8=sS0zS+!Q>of z+?H6;5-Y;=d($JKC>}#SiK9N=ReiAT|oM97m`NJt`$OLWN!>% z*fLD#B`{3SkeKEpBJiRP@K`^23JXNJEGpe+0tOa36TT%#vjZkqa3oXb@kC?cSwbpX z2TMRl*ZQ?td+@4Mv*aJMo=+CcBFf}g0QFl3>z8O1Gc*e5-#dHmCoezAB+5V!O)|?O zpJK5Cu9znS z7B1pK^r||Bs6A8KvkZqc7QXX%{;^1kWbQu#h$50B-{ikNwG6>9pV{Qin-wXvnNnWj zj4$D6fnDOvbI34@WWEsYhK}XfU(Z|cWOb7}8?L=XtKY-FQ+Tb@9}K7bXaTfiHP|7q zU0(ew+$HMGj8^}HL3KOM-_6mpj~IZMmQf;_z@v`%#DfB4l=?gvDa}S^*qY`x$0Bgo zGN7PErAr>d@oo=SHAmu64JgoRaK^kn1iM4T0P9GrKc5TI|3bJq?wmSefEm$Y#=OWW zf>zC3>yzAfZ{#?!d3xyPgu0z})njv+Qfi#2mSSQAMv^`)5h1g&QWi6CGc4m^@J3$0AQkY`>Q zPFmVHH1JuH-jm}P9*+j&29nrnMe7~4NvP$gHR~<=N^^ftnaFSz^=bLl znqO{|a1%UP^H9p8*YY$xz{V4R`vD(YwXC6$4#vW^?QWw3Vt=rLC~c(U=q>+S zA+DM!@jW4`f9#u*bfDbp5H+92ifAiRCp|g_oKB8?naKBkF@q*))%2M(04y43ib#@RC1p;KVmS_E8cFaWgiPAi%b@T8t37b2yQ3^%=!~cCaMb zWePCXCSyTaB&ONc+@T07OmQQuO3u$ddpzR77Gz41j10<>Nng9==qMPCd_W>6#sCJb z1J$R-g%q*PIWrdj4JHxf28NDK&oRHbe-xMvY+UJ&yH(-Z*gDv_t`Q6imlC}uvvI0J zAuKU~+8Ucm9Ezjc5&%I*g4AKxO6L&O$)Pd~bQ+FK==QY~ruz^a!K{=a#ORiWK3>No zA?mwQCSiao=MeKLU^Gj^pe%TM5%K0_R-G9&S42UVqdo!{?rM7e%AFkokGp&Q=&{#> zBjan6p1#{X=)|!90{Y*38VdnZAn7VTiR3giuu1o_K!iEgx97kkS4}PT6$xfx`=wI zkVdG3;GAin9ir~%ZX$-n1-)ksiZb8{e~nKCEeAWzp`xEgl_!d)1DeJ+(IMHbt9IF! zlnA(2PexA*Cl{|4P79BXWaLp(iQ&=QrA_fu)mzUym8>g-AKc}mW4dzBcikVQRER9u zq^3vnnJUK0F5})t6 z@k0>MO>8A)^O(}&l-g`iBfH7X`aUlwOR^%k4J^HzG9^OeS+LI=sTa8R!9_?a%jQxd zgw%3EYV?Ffda2osq(gfuQk~+408x>cdO+>v6{i~Lb;=b_9R<6@+n!n5aH6V25NLm5_t*}S$!&E z*I-j>#EdKAnzCzGBsbbTQ0|{0r>bKg?z>2Nt(AA`uZ+8te#Lius*e7Po7pi7k~~3b z%UHE{uECvHgZSIx|l(cqF%4KTv1BJ)o;@{W{P^P**Mn3F+Nm zU_xQ<^&B+`qh6ynKgo(|Cc{if%!}LQIKIS5<}U6=%ejgfA>y`w zw?{Z4YQE!zw#e`dNP%0mKvJ7jGGwbt~gquJfGUTV;h~~THyeQd9NDm;?V~_nBkNK~!5Miu@ z>bXR^v9G8h?Y5_1Fq}ZCW*j8UY$ zba^vTQyGWu@Wf#X z?D|A`YH)GGY0ZEAbO`>mA2cQTp3X-x+c~nVQuq|rG&Scvxf-U)SBM+c;9c2z4R<3n z)15({p`T?G$}+;88>CgpOZYvKc|V$CLgMzwP$ckH61(2&TrEvW_yF_!=%QB zKSxeJk%;`fFJWsFf;nS;a62J-S&5$$dmNR`CeQY;-k|v6EtUhLngDOfuX=0Z9D?ag zV#x;^MKHmRj^DsOaYOuUvdNP^M;>BlBd(0T#IvHKIl||eY=7ZxVrROip4JS#;r*0k zUaZ^Q))RUC==up7!DcUBJyTZT ze2#T`FS90IT_+;%^I2czdFgETWOSWx_F@R`Mz^xG7?|3hzp{RJ|5itO_adp%UFJnN z`;9!Kki{c`?X6ITUv>3|+|XhB7*>{Dobe$7STv95#)uhr4!><_S%$4x>k7oIId=M; z^5z-SO-X46-&&OOiy=FTbB zZ2QHzO^^O^wa1sXx|?1tqvsp!UhIL>#=B!}GPic6AO9JxI=d{2M^pFj48Na7^t3q@5Al+7V>m!!>GmqwL+^=Qy=v18qM_G_zV4*e1P)>6;6(2bk} zBkr?v>-Pqow|kTj-)FzSb~gUpR1+L7&9+1U0ALaX06_V3x5C-N(8<(9*~Q7y&fNL; zPDPRSM#^q0V)vBt&pS~$r@s0Xn|E`vu+R%jx7-W^Pqr_d{b(9%LpNhg8~YwNWFB=Y zl1yo8qjCF2W^Q#h()YIu>iq9lOD(#6zl4^QlJV_*Zzo#VWs=IqOxoVuZ#&!ZU#~+K zLQ^s6RVev3aYTG>m*jgM6_!H#s!ZRm$=HjZZyhvB+Lo`Mu~j3Gs%?@s9f3b8S_ax@ z1I=COf>%%nF1z1;Jq+Nc9>7YgDu0V*?|GT~!d^*vFcpo_q2K-S4$q#$H-9q+eru^E zMeNZhW=VDOJTUG3%rHoOak7yifeqZ@=VurYRt}pf29nyiJ}zVf+EJmb=Wy~XVmZ7% z6xB-)IdxdeB>!w>No27Ms1I*bKh2StWt}aog4%0v}~sHmAmtpnF0a3`mZDq2mH zB08ETicFqmLzRbAPdzXSCL@Jk*Vj71N)xjdRs*gCps9cB(jJ3VjF;k86laaa6ORhZf^$rQ;C+;Jn|JBkgFfGvRl*y_e87AvxZZ=;=peaP~fd2_yz zbNt~|wdcco=$i2N({H>>LJe-}h)*$0cc|6yz?yI}bYRZurlJN01qXrAoE#w96q*%C zBxu~e^KxWRK7|_!r9aCRW?PZVVYRzxN=axcT4dpx>3@G@%P3-oqKQBNBZbmBi|a|=WJAi;yjZU!2Qe+jVH zFGE-S^$m@qwu!jv47O%=|Dt-k2!0P#nyQE`7%fXx%*Dh9#Fo7bWJ#6oG}C>MmjF@Q zQg1OMMoWliCp0I8^d={8VqXr+b4SGAA8R(J>!4P&0W1+?{TAh|&6ogCt6V)VQ3oY} z$-bl__$_y_5AX0*RHGN*2cRDyIGAGMY}UkK?D)>!xz$x#X6E;RiB~ig-75q^)v*F0 z`yJP!-UDrqkQd-8QPGVir(ccYDioDuu*-Jyj^Q0A19s$5DU==5%08vjA$Y2s7=Gwq z_~$n*Sw$4Z_I_<-uvbH8_i&`~%pX@Nh4wX=TS0e-f`<{*z($JADO$njK+LK1QMV33 z)Thbi`#M!%FYk5D8Zumn%nq_(pIp#+zEOfl_}z#^Rqz7Ni!@2-rG68Sn7 z&f&zK8#7UW+#_o@rDjHFVD%yy!AkIY^<0V9z1vsPJ>gH3!2e3wW^y85{vHCaV_uW1 zu{gACFraU`;Xi8^fL|msGNM?fX9{78n z{n>$!Imo-Oq;7LHupzuRa!VP70FOY&eYN&B{p(DLOh9lCruMaNud+sR{Wm-{E1jyo z*xAx>PhwgxI*Bkz{YX&! ze2{zuCUA3nMj&u8yyJ{1Rg=^tKJT>b8WfXZoF2p|HO15lgB3t1nqXb!NPU(`q3^1MHy&t>v&g+Bk+5vk9?4CD6BeePE1Z25 z7@IdLRn}cEAy9zVmc}sUCa98x8$nE%CQF2JcQnPqH4wypv^jZtC;H}P)S$3zYol12 zN)A9cffo{>+^xZG4RnLQ>8j1rFW~(nA}OxKWYP_0=$iCsO!W2!L!^F4a9nz-HV7bv z8Ud|^?N1D;P+NgA0M3I#29y>SN^m? zB7T9^{=1iYR*J~>QQM>?{fhINuhX~t3OBfeZsw2nX&Ir2vn5>MV2&ArV!9247NBWb z%77VE^$3dOLRIXtuwcZY$bd$GtDu--(Ka>6gasM^0HE<)DuuGj2z%s8L2L{r;tMN* z0mC{E5>hg@Kf6a}E90_X`@+vZrjzJN*r90ws#teD_jh&50K#_m>3c;g6w2K5Xv-9! zQ+7p6YfOM*=`Jy7ivyAYPprcgXe`U2;_))Q=_w0pxq!K8u(o|&`c5#$<-OO}`d^ZB z4A&3@QE>`~AqZGhtwS~?kBg#vj_P{U3BioS^RU3BK{6WauS1gf#>zMhYEw+* zL3dq3a4j7k7Pspx>FSFCDz&bkO(8HH{mlr4_H!8^R>N1EkOAFev$xx+6`e#J$?v+o zCL8Bk7)X#)t-i(40?h|P&NQWp*hVEUfJEuwPVd-a$)!@*{QT+U<^ZcotQc?jqb@jK zDM3JsxVckBd!nKT8)6bzMvfHQGfcZ8mtHc%%!Gmbwa8Yqd-w`E$ zL31(Ra2-sClbmy24CJ~MHbGhu*e#y!CJms7W)`Bv*B+4i+Dr?;FoNZ+NU7+pTVqMH zTG4@ChojG*Pap>c4!xP`mf$Ot<%10x-q@VaNGL!KOR5NG-nw*^6bnThodS6IT`7wM zAh1!`9B2pbgn6|ax(*kXh@CB$8Qc^>T5}-T<_g9jMk~R95F-*27&TzPXeLi&*H=%5#mwuPUlsA@_{cQ6e8+keQUs^&R3;s!5W51QAzpu}3!Rbf+s0od znCl~LH?CVPv0fgh(|sS>niS*C9jRm3qXlyhV1LaF~mzw(d}wv3vP&1#BN4jHY@ zJxYOal5MjGP4aUl(@zWbT@93u*1O6oe+pFM5D#Mk!UG4&MS-=50b)OL_>b0hc^tl& zs7som7lztNk(hHfC)LPX4J~a}iv{%OV@bL%+++2pN$Nn#W>HOy`X?x?1)+H)hG*EiN3Re)oG1s1Xtmhy~X4}4|;ZeyLgo;X1+8Wnu`QIa(Z%miCZK z%q`xjFhj`^;?0v=NMc2Gu!#?n_WM*c0Ghkh>A*BoYicS868Dfx7?|0DH&qLdrqBGf zA?TN}Nn8N}AOi3Q=OMJRny}~l=aYy#IidRU1ExpFpP);Yli4go z$?h4JnK)wxX$PGw)5^c*y@4ykNu8k0L=RAw3!apyZZ=97xm9*TN2ty@dl|u*zn9q^ z(E!RL`Fqctgwi4p3o08T4vQ1!Glj-!IU9W)NbjJ%%!HX}muq3WF4(3gT~MvPC3IF` z4G~5Y^3k+UUDlGW8Vj6+Hv+J|vW6z5C^%f+UQ6gd1F z(12EqmqNRcKxmHv5{h8W^NkxU4>DT+h;0pEP?TCwXCYNK{0lJjX1?0*7WchepvJ$F zttHP-Myj|5)=&bU6s?FKT9<9p7sr$-!T4{4d!|Qa^^ayE5YsL#53M#XjUb%VQb!aj zquh_3pPUP7nL^a*JE0pp(XA4fk8Bc~nX&1G}S%2i{%d@!Tbc&6!4sFvp_i29?Zou~u+^BUJD2 zo$S;NHxX>}_=us$W$(Ce(^@=TYb<9Kr9USKNyz9E@*kx;1i2e(R^GyBiXrRKKf0;Z zWOYQHy;nwdPUq4_>(3&Dl)!9=?<}j3R0m`k3Idd<1NGfT*S^MWAbBKDP%c9{L*1#( z=I zaNXhqWNG+WFjw1i0ifN?#uWYX-Zj==zU`YwzQO97yb)s$LBU}j2V+`?FNFEl(y&H1 zufHm{ZDM%l(4iHftLngQo&>ZGb_X=sNWqaluW9k!{%ff%4!(S0kH(A+zB2HXH_wsoJvssgXXu(rno_@9vuPbaN9w6 z!s$fOIVXFsNH_1ndaw3!0Z@4Sy;%`hZ_1W7Obphvi0C?JSFC!BuhzNQ ztK}Ql+W~CFqsK-VO7CpOzOQfL^?9@L-FSq>ItO zwJ1jsbyzXX-G653na2RN$j>mNMHE+z7KRqlLHnQHCYz}`w&ez z2ygIEg228pDPX@aR^o!R;Lm}*d%1SKs#))k_{v+Q})Yl-~8qrk;N zHVrxd(g!UUg|VI|$NH;XE;EdvM@OO^S78X}nz~8qP0DJ%E=cD0YY;A$*0=l3@uCi$J>(6OE3*&ySg@z7-p}xV zr6&H*!>cY9rnaX4I^+6h2E#3bVTLf%7ZZ*cDAboj@)+=(v5?mNT3OFyKB>U;4m1AupKbVwqb_a0cgubFRUwE zHn`J0wd#vulo?i;WE%aVi`)410*j8p=df*cte`!`M^=gn|OG`(PIu0ZP}Qw$kXub)93zNPQiQ=!9wv zDBb6f-XKQ8X6#l?tlWbv^$Nklah~=(#dLxLB85#6PRBlA`0)u1n5hvyUy7BF3N0>k z`CjNt>W4wN1}lvN=wk6P?h2p;5G_95R`9 zt(|k7no21bG^S9VuWDIWC>A%ed^Nr*>R33fN~Vkv)6_18sjjN|l&7RIVByjrBdOrk zZ{)Q2u|msS02}2NPlz?SsKk(nST+^~b4^SK<}Z_1Y;dJwej(m$2N z97g}~bisW0aC@oG|JEKz;M$MR@Av* z28ET-9^4SJZGiLC$?(^)TfW?bCDIe>^LG*O3qx-Ul`Uk3jeU~%!IT36aG3KV^S+$+6Aq>L`~GSXst zVhd$6o%F|LgB@4M`x$`f3GQ4i-0~zy-)m^ooFNtf_pX5_Fl5v?p1cC5SDkJG107g! zlI$lC!DU>xRpM(Pm$E-0f?*we9(S>WI5S&F$*ed(vr)Tw^uNsa z%dhmFL=*9$b5em$irE+))8)-9Yxf@;XkM0mqwX>~s;ouPw=LfJ;mh!y#4JY0bzyx$ zYTrEZl51^QZUX%8>`gT_>25py(R$>@sG%D;dNl@JOJYqUnAq0XMPdeO)Uq`AeFAKCEZysknw84}&sb76O@^6N*L z)D*JcFoN&V{Li(}Z_Q1SN?bbcjxn)#0ibIRkQuc$QbP6<}fsBX}iW5T4 z#>-VmbtFHZ_!BNNvN27vajJfJ*#ZY_;H=uX6_LXCF=sy=-bT^ar|QdrGG-&zFcc6v z;Mo`ue5*y7;{oyG`F;q4k?hYB60C?4$Xwo=x`V;`xu4rLSBJQxAmUdomx@nR?61&r1z6 zIZ~@eLUaRJfm(H1V^UCqmNcLRmi$@LoKjRrIXNQUBXF-BrGkv%GRUWQD@54 zqyw1i(fT#(bxV< zw{?iJ0|ev74XiV3a?RgVa?%QZ!HQONwKj1H#SQ@l!< zO=k3*q74}M8I!aLVpBq50x37fCIFdqJpCHYEs>A=f%fb|YKwct)2BI6u|CVi=I#2( z&0Hx8{+NjukiY84=Uo_nC+p=aj$1 z&U6WNQFcWUF)AhX5hKc{P9nIR>nnbZ4e_db#^q<8(QrMtKdC2leOrw(@xdizHvDDqa6&+rDAUgNEC&+taiE#pKpP6_cP zJqR5_A4*r@$NbV5k>oW$m|;_LZM*v9!oT|Re_uqJ*c&T2**pA`w1YT7NuK)21myVa z_Mf|90RIv*ba42+1(u~OXt&0I(D{H00x#+nPFZBD(25e&D~Xs3Yt<{|w5dcL87_jf zFIM~Vti)6~A}ilEF$otsaG<1j(VlXTk?+{N{Y10}Q{|Riw-&gSx;549ga&B?TGgO& z#Vh7pwmItRfCr2jMZ>wQaTPj39}?c)2e(VqWP37C=OR!BqrG#oYSHQT+$Jo&%QH>~ zasgo*vXGtw^VH|KGN&y|T@vPfowxq7U$US4P&FfPoNzMvb34BxV&jaZS?Nax6Q->K zKe(`0vLqw@ftYY)g-NBA1+mn%(1>=hp_w%UA=S!Uy|^r0t;Ks`S(fuJY$7;Es7+x8 zg9v<+Fr&e$Sd{sKPsWvCA;ou*7>DXC<6F&x0)hbLytF_PZ>&0&d81d=8p3Hmq@&wG zV=%sPcVoyPcrv06s_}>EC;JNgGvOS+r$?&0>qkF0owms!S!Gn@c3^02oJQnl%QNN9 zhoTO!{=H>+$u>&@gJeA`&y@!x}JZ0}_HM--LDf0H>oAE=48f{+Em#Rw&Azn4iQ zOD&YMFX{D?*3o)dj%+P?#QBevwPa`nxJsfJTTTLJBz27Ov8cteK%s zN^Zwd_BmA<2vRwiq;C|hljvx>*RA@CLegD{jghX?jNr|XByn|z1-8YjQ^?yj(PDU7 ze3@tPHQ>(Oqxd!h6bBg^wHTUrj4NqQ>27Zs!)6ZyQW7T&2!$Ih&WPIx(d@tujddub zDNzZto|HYR=i^k5o?^;LMIJr>fIk;|e{0QbMWNb71xF$cD&Gnkx@u;BlIv2Y5Ul`jZ6F};KCxn-{7~GXK zYCJ@i>=U^3^2iWyK>7XQx9Mu9p~W6eR%d)snDeYzXjBVoUkX3ZZFbBds02 zz4#n+^;?C7N2@SpTT_r~$)so-^KMa`Jr9P`VzzutYeCru(HfyEqQ`$cn_Bj3%-z^% zNq}xm%tL;;NIWh7nlEyVfZi4rXO3b`zNwy)kzR-o{pZ?K7YpN z-^zdCLI17bKgZSIgxx>O@1gVSXUzX1nf`C1|0MAKg#rMm{ukyCmg)bWvEMw`Kg(}p zy`PQi57z5nmj1JLzj?2JmfwJ#KLP)}g8$^f{ssKxi+`H^wDTwI-<$FOv%bISqJNg( z<|#j!=Kq@z`uBhRbMg64`siP1007nh!2V4p{il|H9_#p93oz~(bo_@ P*C<1uE%K4)xA^}Dd(Qfu literal 0 HcmV?d00001