From 26809dbbff41ba476ebab84055fd997a25bfecc5 Mon Sep 17 00:00:00 2001 From: Alon Karmona Date: Tue, 20 Oct 2026 14:56:01 +0300 Subject: [PATCH] Migrate CrowdStrike Falcon Endpoint Protection (3.4.4) to Defender XDR Custom Detections (V3.1) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9f05623b-293a-427c-a28f-23d9b3fcc32c --- ...riticalOrHighSeverityDetectionsByUser.yaml | 60 ++ .../CriticalSeverityDetection.yaml | 60 ++ .../Data/Solution_CrowdStrike.json | 9 +- .../Package/3.4.4.zip | Bin 0 -> 113456 bytes .../Package/createUiDefinition.json | 58 +- .../Package/mainTemplate.json | 667 ++++++++++++++++-- .../Package/testParameters.json | 42 ++ .../ReleaseNotes.md | 1 + .../SolutionMetadata.json | 37 +- ...riticalOrHighSeverityDetectionsByUser.yaml | 258 +++++++ .../CriticalSeverityDetection.yaml | 272 +++++++ 11 files changed, 1375 insertions(+), 89 deletions(-) create mode 100644 Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.4.4.zip create mode 100644 Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml create mode 100644 Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalSeverityDetection.yaml diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml index 433f063bd93..f47d8febea9 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml @@ -19,6 +19,66 @@ relevantTechniques: - T1489 - T1562 query: | + let CrowdStrikeFalconEventStream = () { + CommonSecurityLog + | where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost" + | extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1), + DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2), + DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3) + // Additional Extensions + | extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions), + Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions), + Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions), + PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions), + SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))), + SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))) + | extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType), + Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome), + Technique = coalesce(column_ifexists("Reason",""),Technique) + // Device Custom Number Values + | extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")), + ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")), + Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint("")) + | project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3 + // Device Custom Date Values + | extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")), + DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")), + NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")), + HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime("")) + | project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2 + // Device Custom String Values + | extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""), + WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""), + QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""), + ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""), + AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""), + WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""), + AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""), + QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""), + ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""), + CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""), + FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "") + | project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6 + // Data Field Normalization + | project-rename DstHostName = DestinationHostName, + DstNtDomain = DestinationNTDomain, + DstUserName = DestinationUserName, + DstIpAddr = DestinationTranslatedAddress, + SrcMacAddr = SourceMACAddress, + SrcIpAddr = SourceIP + | extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType), + ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)), + SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink), + Severity = case(LogSeverity == 1, "Informational", + LogSeverity == 2, "Low", + LogSeverity == 3, "Medium", + LogSeverity == 4, "High", + LogSeverity == 5, "Critical", + LogSeverity) + }; let timeframe = 1h; let threshold = 15; // update threshold value based on organization's preference let NotableEvents = CrowdStrikeFalconEventStream diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml index 8a7958d6ef3..c231fdfad5a 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml @@ -19,6 +19,66 @@ relevantTechniques: - T1204.002 - T1499 query: | + let CrowdStrikeFalconEventStream = () { + CommonSecurityLog + | where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost" + | extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1), + DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2), + DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3) + // Additional Extensions + | extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions), + Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions), + Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions), + PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions), + SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))), + SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))) + | extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType), + Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome), + Technique = coalesce(column_ifexists("Reason",""),Technique) + // Device Custom Number Values + | extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")), + ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")), + Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint("")) + | project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3 + // Device Custom Date Values + | extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")), + DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")), + NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")), + HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime("")) + | project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2 + // Device Custom String Values + | extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""), + WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""), + QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""), + ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""), + AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""), + WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""), + AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""), + QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""), + ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""), + CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""), + FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "") + | project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6 + // Data Field Normalization + | project-rename DstHostName = DestinationHostName, + DstNtDomain = DestinationNTDomain, + DstUserName = DestinationUserName, + DstIpAddr = DestinationTranslatedAddress, + SrcMacAddr = SourceMACAddress, + SrcIpAddr = SourceIP + | extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType), + ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)), + SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink), + Severity = case(LogSeverity == 1, "Informational", + LogSeverity == 2, "Low", + LogSeverity == 3, "Medium", + LogSeverity == 4, "High", + LogSeverity == 5, "Critical", + LogSeverity) + }; let timeframe = 1h; CrowdStrikeFalconEventStream | where TimeGenerated > ago(timeframe) diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json index 2d4992526d2..41f6f4dae46 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json @@ -31,8 +31,13 @@ "azuresentinel.azure-sentinel-solution-commoneventformat" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CrowdStrike Falcon Endpoint Protection", - "Version": "3.4.3", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, - "Is1Pconnector": false + "Is1Pconnector": false, + "XDR Workbooks": [], + "XDR Detections": [ + "XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml", + "XDR Detections/CriticalSeverityDetection.yaml" + ], + "Version": "3.4.4" } diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.4.4.zip b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.4.4.zip new file mode 100644 index 0000000000000000000000000000000000000000..3d8128d567dd0a9c2fde7a46040f130e0d64d26c GIT binary patch literal 113456 zcmZ5`V~i-Uy6xDuZ5w-R+qP}nw)fb!ZQHhO&%AxkOKx&+vYIxl?Vt85R@Nsk1q^}$ z00001@MW#6^VU#wyaEFNFvA4^fc}p)ax^h;Hc_zYd@9@rFSxTce8ktD?GyY4A7!BU_vXi zs7~Wvm?$fU9gTGj5@d9b-LNOMu(zr|a2jEenlE7MCVorM1$-hRE%jFI1vqnfjO;b~ zbA#KT3>hTwY%%~7ht;?}i6K+uVH%b4JF$p~fy>iVF*k3GIMXKcAYm&nCaEbHUgyAd z{|h&(ph>3?t!PSfG2f2FiO5=LRE>7uzWjxSkAuf;LZtZ6zu%9HX%;EF%<{Od0*}VsGJaUOlgl@|qx(!Cz$<0_{571? zmH7FoM;#^h`DsrTj|mc^w4{%^24YYVEDud*#?W8B0HKXF8Jx%dw2gwz0aWn3>-P&j z^Or*tfByl7$3}Ca>n1JFqmQl7nDu}spGwsgI?RHbfGyyyOI)6~$Qlwkc+#pI4XKUM zBZ<#-dSEG9x?ipx|4{U^A9ze&You5xnEwz=QWtn^g;8cTA10zQ3S_^bp8bw1$Wc%J zw&KLTUOiZ*9yvKf)d5d~8EXkipF|W`Dg_yR3UR>uJ=21fT>ZqHCYSM)VJ{FM z`<~PDW)X-}(Rgox%Cl1795d-FJFC$Q0QyBHsew4JUq9K(HZ6~7$rebM#t50N?buwf zbli3siigQ;q&OgXON|U+3@E>auMV;?K5xu_5)(`7;A|w@fXscUYJp&B3WOncJchA5 z_;jHF!8?>m@C}(FEAPdN1yj^}f;jG4xw46}6d^Wa#DZ=J$=SwXI>tW}sDXm;h9?US z<`!mrO}-(5pPgQ1Bv3TKiOj}mAUFXcrK)}YjqG&e-S2S8)z1$U+L1IDw6520qN#u6 zk-E5+TvDf#9sYb;ovFTwJFrnZ&&x-=wwI4H2$^Q7#@B~xts(O_e5J=bKw2seJ*#ZX zmEtUuwX;km^9kSw^ir8h&*|}K0)L1K>kUA82s%kF6R;3b62KEHX2K=7RCC(nN@&@{ z34{fBpS?IWGfm|PSB08gZJQ+_;&exM$~^z6d0ag>v@2N8=O}tkVh_xc7D*P09mY4` zl-rTG^vKn7I-vG4>{VtgI8vQln^IGht?na$2^??qjOc+GFA10~0;G;VJs;Gz`#e4o zniW{p{BHnMB$}H{D#hkrs2oVD#sJugRDf@>N>26tt@dqF>y|nlC1m{{J0z-KnjZ?t zRS)rEtm$CkhUB)3>A4<^-inrmqX{}@_98T?;+1{%(!*$cYKvy1YYoW=XxYv)PJE8z zzy`{68ml2Fx3DJiy@dcTRebAqT24sWD}p- zcpp2w@9q}BE7$=}Sok~)cK=a5<^4{(W$0#p9dBq4ZiqbZ)pEZe0RSIcMi*x$DD!W@ zs2AU^hjhK?*cwkSz&QqXYX9y^UHfIHzs`O>z3doGtetZGSeRdRARiKG6k$!*m zoxjbW+MFQx1da4N zWeP>};uUHx`F;Ufl$Kwpau^vG#7UuyvPalKsIwLAmdx5qpyiccC)}TDLC7r=ZsgJmkN8J$!%Kp z;<}{FaC@2vQ*3yxgZne09JtGK!k+Z2zZaF{=7O*tObFV6*>QLrxEXxn2y0?{Ef+e) zG?Ad7DRVlCc0v0RMAg!&%SH8cVwkZlhO`4wiM)4X;;;!syp1;9STXikMStRGL+ ziZ(Jpr8)Epj%@YZqe>%R8LniLw^)NGjKQA?o2*R^v4A}E{p zLbM&RCz)N!YEGmcjlR_}^fZ#-CWEp0mj_4F+p0C~5VWV+51C36-en^DcSROA2d7#g z$7e#xNu!n(*B8A+(oRDZb|0V0jZN%1f>x?Fgr4yB3hiWJm5DuA#|;h2fV;VjUF9mM z1L>@(x&kb5znPs~gY5>;lrwJpEdpFGq2iEbnQ$|6ZDH6(riJ!la989<3;DfJFLg{U z>g(GM_5!FJW2AN_>@*H+F4xI1k`ao94w5dMw-{RrX@5_3wXQP6*GtxzqOHsKsh%|w z?fhddy1*(87BmSYDyT{vNe$gq*>O5c?V&zWI$gDE@i@0LugsQ44D_B*0WURK4YGHa zaV_^-aLUd5!~2-%R#)^x;K;YI5#c=BYFWO{7&~}1e#pmV_(-*cYDw?nItTXG) z(y5Zg%rKp5ym~>%@sMuAH<&_e;N9MfWR_jI?P4>#8ZOW3kv&5n{Bv9DjAa;pDRPsg z&?NPA7!*)FhX_HBj@}-XZg7?7A#-mNsYVm2BimV}bu%LAM*Av9wj*n>^Urx? zV{TBAZ7XjJ-FqKeh^mv9;K}C>*819n%l_zN7i(s(=jqk)M$7lY!MwgeI&Oon{-1SI*66f+@E>$)Y^!FjT95{bi^!+3w%)YwQ zBr#dp-cR%_5=SYQl%;Fc=Q+i9X-EHzw`cQu?o_Flf#NbwTXb9Jn>qH=l((boRL86|R_?p17(k2*!r?Po@WJJREyT>}~7hcAf45n05F#DRq({+wm z7XZ0-{@=tO&k^bVX(^V_Et#%dHv{^sH z%B_Kwjgk}P?!fA%_0Wj!@p&E1U2_Ai^yE(!eo{2s3K3uiTOhwMXXf>%k_aX?iVN4f zFBbb50su4(-cwgh|6z)RFWBc|nRfonnKlMMk`#%e9g?pg)2%81v8qnno8)zhd~Kn^ z@nJZc;~7Y+<;=zGI#rtuE(vum^iH#Zjeqfpyz+0$r3N%@D`(^@fq>-`~6J6Sfs%W{bfyp{!)1-Hew_n}3tCVYNR*GtyXq&9| z>-yU{DN@bSRk3C2(HYTZTZzZ!t3B8G*U`rM7uYKzBl`38j2!MxW+s@@tSxlU@jX(< z63&(tuk&Qz5x#n4|74cTGwoQYm$k_DzJw9Ck`>&Ib#8%WReoz%%La1?I~bRF1yU8Z zU~`TNyf&#E3%!-_u>zw@wq!f16}EaM+9j|O)?_nYJ7X~*o}k><~7&% z;b&3q2VDMtNg?Dxsc7wLK!9>&Bml&JQpm=@!dBVD#@_m$Ao{Ney6XOR#O6$-|M-n* zyY;{1W&D6pXfSr0jV&E@FjsJOqSe4sXfRvd-UqGZN2(^0hs`6YbbA@$9ciy^m2)Hp zTq3W0BZL$gt6pEjtW*az28s|SN_e0A{p$Ut56=0f$CMsJ;qwZ~kx7m`uI%P{Gg<)A>G5hQohjylTli`pL)J1$k69Y6m3lCu|mCk4GM}^$WGMn4+ z!(1?=xl5)XG7e}92UqV+=Mg;1=!k)QqDjfK{)+^EO~^!e!e`gk z9>)MLN=kgkKQk2!f-FD^5uUR`DoEH<`u=c0H^D!f5BdE{dk@1j56+opYu|cP1$R8& z|G=?F({FBfkR8!9=3oMfF{TnZ-x6OsCy?N$;xF>=O;#t7Fg`LfB2UYlj(K{Gsjk*T zd(<`bfHRw3XhE6GUHCy5RBB|4eaCRYjI~9DCF#gO5RmVA0Sl&_5C>VLj*vVMRh2aS z0+buyHgz!N1jw(X4{1VW2{najbvuK}%9; zr)dc`cZY`)KnVM*ckQNMb~AFAsOg#?s;#(Q3J8rm8xJ`s4=allt!484Z)PKKr%JAU--karYq@G*4=wMN31_KfWU90oVP>@7G9bssU6;WK)9484u!SoM- zv`A}soTM@~6ba(0@jOBhmhLRVYPf!fYdq^JQ$Pbzn6G5038SX0q!O8n*E#;VHBIsW zo+?LH;>#$cZYUt*H#_tZoT9h%QZR(G&@xC*F;MZg#R_nh{m^JQ11Uwqu>e(ld(g~v zi;8EJRscDA>-|9h^THN!d54bAnJ7o%D`uzP(+n33wWo}HUW9;wq)dNa19e8EC}$;% zN(kdN|FH(0PFXI!ih3FA$1f_DBddT~atK2&3~WU6anrK3sS7%;PqCr`+l;acxN>t# zG~;5lf94)ki1LAfu;36VlJP{XL|YV`S9sl(!%L*HIw?|%iMn&3*hhXdec|R(;0l|I z=aAq-XoY@*ypIv#IF_n()hF$Yl?Ppx>KqMUh|wA=8j5I@I~1{!G_le56c?)R_|E6w z=7#oseA}avl}36>+!bS;`N;8J`oE5PS3O%k8QlpzbMX7@J~^qXubGQ3)5?&~gVQnALR&mB5eX_d&lyFB5s6;w z@6xtcc?aiop9V%&R^X_bnDGRN%G;(g$z_42P|~c7dfYI|qUQ5+Q`kw$JaC3c{%yDD za{aJd*Vb3l2DV0K^Q+kmXVzCF(LbpOPJwIMwg8br@}84)P2WqoO}h+=D}OnWxupZ8 zi)gx`^b(K=hl?8@zn${Djm(H)*q->}4FHyau@I`&x+k)k$vl}IAb((C+}s^5Z6Q2pxMhj+^#Ib~>70j7nEWw=E_?HSYn zr|>g9j1*M>zO1Wx326#;R$fk5r+ih#=C%n>UQ^4({$~{49F(gXGzpzt$s)R-VC}7Mr{)@dItTP!2<0 z)9`|-97?+`btky9UWqR;bQDQy-?CN&Nk{FUuQ6{Me@M{2GDC&O z0--9;j;UgnLobW{FbrIa>HqRVBZ+YkWML1+;2Qr_miaAeaAuBNyg0v6Lni;g+>Eoa z|2+0enk5vAT$zX%c9?x{X*i~#J~S+&J~%F;GR5t7(!spaT0a1f}2Bzbi1!D$Bk`^0I= z>eiP@-e`AljW{VMu0{u3KqNZjj^NWsVew{)!wI2M!DLU}yuRNLsEdtouengb$yJ zn20V_mRMn+y*SFv=&?>hMt@6023v67U^1^RilbYjhm(pJkR}z*zx-g8{_=#>=#V?H zquwN^;Y9BCY?ju%oO-f}RSdb>x^b-ZO~XSfMD^`Kn>sjcpEIo`ZpN`^_AiRUxk$O4%(RJUR9!s{PGNrN)ntZprVl z$eX?lQ5Oz6b@*NXhlo364qBvrKhWC)*rX+lzelQ#w2K}3YxBkJunsLOO6A!@#x6E( zG8FCeEqZx|Pho7%d!}yKxCOB(%6(QOqSC5>4E&{opYUUJy5@wGsPxB(5XCJ=N8?ec zLv$mXI4(3Zo4Cpul{Q-OWjG|3G{Mr@Bv*mwQ6^Z?tf+Q6|6~ONooBb}G|jx&qNC=W zMd4yMHAoNb+ZNw1lbHe@jdn7)8(!E)$w|#>(8sgqo&M#se)+TK-o7V~x@$L{d#COt zomb@phgr8ES9(Kk+mf234Bv9i;6$s8Rn6VTUy(<{{Q{4Alz`{lX&nOk3-qxla4iD* zR80bUZtZ{dKd$RvL8Fhyq+5im)ZPh@@NgqrGuxpZ239GMpmhofU!(E=Sf_qk zzvIR}>udsN>IH8aOu_YuJk3Z)E8v35!S7-?&&^hkx01Als@*usKRGMHl&bS~rZNWL z{nYM6Y9Q%<2qRn5%4zUce|mfl^DA}?52EH?xn_|NB9yyJ3*=M2ONS7NVw`iyUz;4J zRYStIUJ%Tr0derWQ=|+Ob7LE3iK?MroEIc=SedsLbSTU_ez6shRs?q3-rXzNe@S{JRI_;*=UEct9IG$6?yR}00vucPkK08Q z1%ajeWW8mnPALGuM54D*xBB*i;3;J8e;#go(?puaP%Ku0zFZ*|1}XT0gSJ82<(!uy z72cK$n%Nsh+mI$P&OR$*O*X9_uMV|6G{#WioR7dCPX7#Dh3+^6iK>j>J&S1fABxuI zOrJu{)(oS-MlNTCz|U{(b}AI7Q0k&9tx9zjuWRANCJU33Br2A**(XMEiZ_cSCb?$f z51gQGH$t)_Nx4()D};b=mk}NeC|E@~@d8&6f6gby(3CRCGo!A*Ris3AhksCNlU+M# zw-@>omwK~}f4Iswfx%3&Y$N>Bf_N7mr4|_MCqg`Y#4RU66;_1kg(F?c>aUy1*^ z7qrTEGhFKjbMEqSj1t9Yk{uqsR2g)7zuIft^~31f-K!-^e3o4p4i+pCSQ4Qe9~@lE z7^8nQpSy6Bue0s`^}&BihE_t65FZe{lce=T&O#7C00mo5LTD^5t1o=zepbXAVJw(p z+W{37AGyl_SpyLrbbdEX=UGX*p9wX?G6kfFT;%|UAX-QgC_IL33W5%+y9VY8rAQbq zU=C570-gSaUySrOMvuNxT6$88?`GZ3@dq};i?G{wo8X)S#$^mMc4piT64jI0GYFGe zYS`HG-vgSR2_BTJvwA*MBZ!14v_{6cj(7so9rnc>Z}kRc5HYr@P9EQ1CxX~J-z6zx zNc#;Y8X)<(O`(O!QJ`LMeZ66wacv{40UVQS!>)mDRAAZZ{yk~h!G1{H#g*cvv7$h@ zE`Fqd5xQKx9qND!jU)GCYo56czxca!q5A!uOd-$=SymcAjf0s&B+d^YQqZIKZ6iD~ zWDN#e59rhrQV!f;cj}}2+dM5t{Y&1uB)Kil9YgFGcVAAnp|TuYB(MYQklEYJebYnS(Z3KQ&HqqfL&`@&sjg?%h8=%PQOl> zA@EeSJTf)7D=&~^qp5o-uBob zrcVni!3&NczrS+~c;ttmUyy6cC}d2&wfIFEk?*ZXoC52x~Y!U<#w4q*o+ZT zsp5JQ%+6r^+{;ua`;n~3;UmV1>D$-h*Rs(*dHhxZvegj%sIq4Y)qkyQ8-$>~?2f37 zMzM_r7#M;V&H#tlU{IlV!2g#r})e|gR)`Q+_aK`4YvBwz8qZ$ zDWPimgx!i%@3(F-wdiUb5{<-L&i0m+MMMG6tlAbuCqYX?aHA3t_sN4FM%a8T2&9Gg z&{Y{n1Oz&?L>nPEj9VduEbn-W9`%9$CbiG|<*7K~{dOjqxuR_?=#ntJW_{2I2u@={ z(3iOPPzZwJ>}VB|y>eEf@=DYXi_(4YKMtUzc{!xAea0tx|%A${8E=w3A)+zVAKg=?(l@u6IdUdpU?Ktt`HQTm>MuoM>VLQQtDdlQg0l7= zqksdEVGX?_Ne7_<$Zr(l)NM)8o*3AvAJCa|$9A=KO+HU0+P*Gnx_(=6P=3h$%ttnH z0PKeWC^MA*op3>j4?r3M{N9yscXu`YN=vK4v8bY++cK@^qv%AtE|MR99uEdEK%Z;@ zgormy79GvLW{f0Dhz}|QRFZgqwv?|&vaVZ6S{`7UgHxvsb`*juzpu-OY8m)Jt6=$1dxdQ zYgMh?Z(Ck(RwpctOqCW{~>q2ES z)%Tw^(9&qM*Pv~1E@m}h^cuJ8=EnA|;;JIrKWDq{hPIwcq(#N0qR50IcP#i+pC~{0 zV$2`%aRKc#H9Pb{TL9rdl+dQWz$!Mi>2C6|o4VfAd(sc#R|KK8=NM192j=<`SI)Xt z4qVY?Jy>7{0G$@->#_k_00m)ja4{doMyGk)vy zlb^Sm)VewNW}kTij$u3St_eR*AhD6&vd>`Z34Q~ABC1%u1p=43V4t-|d{#%=aYa9LjK!z!li!fKC+n1~83o%b;DYA z0sBn$84we|7>B0rn2-E^@sb7(ajrU_e(np%+m|Mv60$(@L&%S+&ABd=WHLCn>a9}+ zRD)EWs>V7LYm1r!2b*pKin^K0Hy=Y%leY{&u|A{&^_1>P{^8B&2#{8+~ZF-;_w zwP6{}y}qF>4Cf5Nbzpa%T`T4?8%hs=O5!St1(UU#Jx(4jj@C{a8cy+k{0fcgb3^o|*-%Qv`W-8~AL05i#-6#x#Ok;p+5@|^pVzmUj5hjmG3ywK? z;t6&zF(cO^kG6cJOpp4^a5a#vzpq&=V?B_4EfTgp_8J=g@D#sS`0 z#s!q6O12S+MXF$O`~nvzJq$2C78?UWV)`qe=GY+b=tVO0^dJOlFU_6N!rB-K5%J0l6-Zl+`g8SX~vyaodsP+8x5S?;oRU zto>5DI3zs#B7_?=g$XEA#iQOm=oG=$?_|W5Wgy&=iVwQzW8umKUE}6{D7$+n>Cs0WK2)Obn&_Xg9yXoEkfQ{yWv%;yhH@uvt(J{Esu_H)~g;@5S z2ZA#Wm;gDUMq#TR5T5}sd6g;5y>dyjx5%L&e071Uk$yB=9J6SCd;nDa8WdfgNg~9P zk;(eFo4s@Z=yqyv7rD>SsWyO`dNOStfK~mM`gq&oO-B+D2aGGUKvq_vRD5351iC`& zM-wNB zf&^Z-=l3QhT7Ubwg}l7Xf8QUK>r9wfOOU0XeqK-BGYFJ2r5{(o!cM;%qv*wcIsSY( z&hv48I4=C!dpNN8kJy_#=i=$5w|t*&WEqRy?9$K1^=RYxocXrBE!?8wRRX^U8(s$p8v_9RP5jS}| zd>j{ip1hq+O1xfG{hOM0_!IWp2R@`UpgvLp0~Ji7eq9=psOb^hYOR2GNJk_eqF4#m zc55K4fiwm3($jT~kNXOy2NuSMo9(=~gV)w5z(7c-{JXvxG&`-VAHkMWc-`&OWb9XG=X%@_vX9GVallexkTFy*#ov2<1bSb4j^WuKPw7c1uqSc zaH_0#UHTL`4J$LB^LTc(wn}ENbzWg=EnN2z2WI-Gzd?y$) zHqs>*^#Jrtbot1Oe!@SZem0~qJzhv3r({Sg1eZ0wt*y;l#-$>@iw?nf`=nyDOh>cAM+Jb$Whe~MSZVmd$#|`I9tMqeugI=r0EQaji z=mt7gjT{o)!Qua_ z@;Zw$8;^LGMMEvzYnw+G6EIrR=ioyC71EwXaS7mjv2iI)!qLKb*`ZS+?8wODJSVlG;_#d=FW-!q284e5f z$$^U9>ex3GI~REseXNmmKY3H#X1uK@2dB00g-6H&b5N9mZ*$g`F_t@BQzl!C)Jfde zoXDdg|6C|ZV>cF5=&lqaAu1_%Jo($%$6XZ>WQj)T{>OsQkWBn*IKi|l!uomPCy^bj zJ29~+=Q{mdCwe_$5Ib$>c)R!hqZdu0;jZdVe{KA#HooqLDq=kPaQLvEWAe@foGC-h zpxAypomu%#>%?E32ztQHe3ys!$2bJ0{|XsABT!@0O=n#L*og@|4LnjKU7~FZkCR$O z%7n;ONL}B*XW1-L7!h|chF+8I++Ow}|GaqrIWQ9-&0@^%2}fI*;Nx_aY+X|0ta0wj z28-q)Ue2h$R2j|Ad|?6-47U3|=!%NMN+V$m#Z#Y9(vV+tNk)496szwj3X&srT5VED zqU7^gcYxm-Rar@~qZp1>dfbQt(N?ET=CISc+nzbr6XUVu;;;i;^Apy#m`LfVwKqSe zSj2m9@ZnGdP!QL7mhszW-krCPfH$$=gmbgBuy~|~QO5vs-5cTjugycb{^Kh7#}K}%>vlJW-e41FDhKOS?VZ0 zpU? zQ8l;mAOORAP;$>PCBpO+G9c}>ECJ9<*an-5$r`iOQ9m_%X>#Tq z1*Ou~BwCt4b;X{pQx15VnrRMS=$z^ZuV{bq^!@a6UO z&-nWJyU6Px=n}P;kZ2uZ2APs`W#*z$3sBZp5|`-cz^R5HLKkZe%dLz82zrylox8g88McK{HTp@*voPBx^Gg2hOz{YmE`DpDwCr^FMI3!$#l2# zt^L@cmVFEUCEShu*xPWaV6@cx&tr%}6~wilhUnnmeOjaHF^zJ`Lurd4ZJ#5g-wF=v z5#!4+u15G6Otp`F*wiCMVXpVYPE}uF^1R0yZW-pC`yJ5$=&aaXR!_n>b@X5ieO?6-Yp^q2uNig z+UD0f6k9v^zOsTuJ7tqb-5MNlzjR{geN$sVRGj2%#_ zsiBPWz-7}@kTg@dNkzDbK~O9xUtr)t7YCu3$_nUZC9>(wVZv4FLo-$yXAbeu3_%L# zN~v8m-v*D(mH-0ert53Ll(z=r5j=#J)_K#o!6vj*hOQABg8b&PR_R8u+FIz#Pw1*|U#(gsjg z0y!CUlD~**?&H?bBg|zy9v+u1br4;}gOaR}emz!%{H4uIX%u>Id#n)fcuipYQLHNj zRnJOnKgv}JYNw?vy~>ie&wNiGVcSuQj{)yojm^7BT3TVXn^~08X?#rCnx1iTa=U&W zi#*=H#jD?~0X}c%Pha1ARnQ`zo?|4&Et=xCFZ)Wxt>87|j(1|UPb&yD9$`$B;MJ<0 zR#(^M3!DG?G;}_c&#xJkJ-O`F&#&?NXI^P8TD?H}@^;h$ux_D7tocJiTPE>eOU9@;Bw0adQ(q;%gC;xc{C|A0qKx}cu ziUX%qfY=4DjjBp1d8TBL(q$=2DlnjI zA)t1oYTB9&+w7z&5jB?OpPB}DC(-}Xpl``dChcNN0sS8H6$?+upPy7nJXZ%ywu;(b z9hc)tRrR2(eoP2mxy4+3f-PQb(JCD-R?bKrMEOS|pdGlVu(zC!n)xw#!BLOXT~a3_ zt)oGBLXwAJfr*kzsUGn`O>~kI*%m}^|-S_ap+P-}m<;)RpxQ1Me;k}H7Gw^!R zv9+dm@$hmq*r@Im<;?FV3x{j5YBl&IdaE!%bgOAvJt!mUPBnEJyP4hV|7p@Q@UZT1 zamda<9&S71*@J&FEie0QIZP55!3!as;`7=5&RW z0@4{3LZK`=BypV)RQ~0227@895Gqt0pS z@DqsKp*Vh#0+wPW{|pM*rY^!kQQ|RkfTkr52aFg9TW_mCq^*53`hFKiGuF9aC-mBY za336`5bW#ChYOtn2bjEDjuqb3V%M@3O~iTK^7I2BTVSr%p|JX(b zhA(XcglufT$OrTIWSLvD+mmfhDO7xldeFX1=xdEXhOZtArjmi)0z`0?0cGE_1ycp| zmjEHTMbEhK7gC|8Tr80u_cPFkOSLLdvM>f8M(huvWI=i_R1R#szcfkps(&7+5DP;8 zkN@QQ(9f!T8}jt=jFf^#r=M(D6-~cAm%hvK;aDW{JGt)=m4bccsMYN%YAFrA^ zTKC2-x3dN0Kilw(9XSYCeFU6;2;max9R8D|?~@zz6N&;a!C%U;u@xMdV}D!JdPbl4 zBg@v>+R`$Ix8dh|x9~HIBZy(PjRJcgh;&~fzE(VBq!=C!5;2cKl43pvwTul9#tXt8^0)ey&*eXi%YT{0 zyVTblcJt$V8O@A~Q6{5plA;Sjn56iMQFb%b2K>pQ^Yab>vmKw4s#k-%H`6NNrnnHS zUBnQu4w>wnbq>EtWi#zPT7~%0y5B9-nPO^Lthl_mc26jTfDER zp`LsT>{RfLj3K-J;>tMFud8s4zL$2&I2Etsm#Cqr-kEHR{H117fRc$&l^|a^pEB}d z$~o&SrE2EE#1g9foE3vCJyCJ2GNm7olZq|b-u?kp{?0R)r7RKCM8Dx4eTq&OC1wN} zl_X)T(B2teITB%A1Ym(rIC-Fi$A`$#-jLBv!K{CJJ)~-FxMKXq`XWwzs}f#P{r>A! zVUG9oBdF#J3!boa!_e8hkdcJZzEiE#@jjxB1P0#2@_jW7U}?d8x4HY!ju>jKiE>^u zPJ3qYc~A1Ut1PPLzu)$J-f%hF7KxZ)37|@r6^(-?@3Xqt%gAc^w9JL;r;uTyN*bf7 zhS)mjsRdUn?=H{2x+w^4%D>=U-{M`B^lpO2{LFK$_Tusvo^lf{w73FPo7k%=P4tzQ zXIakKLK|1Co8MUhz2ZqcW;A*j?Q$~faab7==3sOFlcG;Tc-!>RZy0cOJtJzCyR#9+>t>Js0 z-cWh_QsnD3`_z;osh98l^!xSti#bG+SGXBn_xpbPJFDv5V$$(@+WR|eQf1Y2ctxs{ zjg34sS)v2QZDm6ADoYAsIW+h}FLcH&|H*eE06 zk$%NOi^t(t51rTFkGk>3-%|nmy&hT}T@7w|xT#~u$y*~kzC@ID@|*cFtAS{ym7;^5 z2L{OUT#VRKJW-wV=jxRzV~`jKe=`Nli`^L33c0nd!N%&BhV5JKTeI{d_aMpdB9sn1 z+viCxd29wYp`sC9+q4%4#W%q3@>DGC13J+h#W0|7hF5c!B(0to-@b&IWdQ{o=(<<1 zl+oZ@H}e4sBNth`xy7B0({;#O@Ck5_Bm#w}#G10uT;gf@>R1U&)k>1a1kT4w$@NZ> zKJvk`ehd>&My*~mrM7V;^x3ie(%T|?%&tk|ZiHe9ORDKDRi(3)TL92h{GZhXa~Cvu zGRXnxy*``Ptatj^8=$x=V|=O)7TB%KX-Gd})WANl`}?lnhQD_E2jOiAG2{AU`|bE_ z){oQueh>|aSOeLpFAy+eS$!SrsLwi60!JtXqYNS!FalNGzwv;&soO@>lD|M9z|SAY zeUnR$R$r&B=Zn+C->W9VFC}B#Kc1lxG$W?m7oJJ)U$nNh4-qN&mz_Csv4!HF9EMIn zN@tApj#a^T6Dmevw2%L(FIj?SpYGWb;i(b8;&*501T{7=k=J)!ZS&*QRjt#rLP0*8 z{rZxNPgjpe{O;(=uqQi1c{qq!g!@)1EVw#9dAjvD@qQVhKv@O%+P#^xj4=U#Z)OA# z1gD@Hi7><$Jx$PDK~{O%4l+E(y|FEbAAGZN2>HPpXy5O&w34HD6K|= zP@za&?g#&cT;}y-(2vIFSA`!4`kvK=lJNEQmBwX%{~AmJqLYJPn;pXda8!?ody6Gb zDzkq91N$^8u6IvkY!TqnGDh_mDfJ08gU%jeqt$D}B6D!>-4e_4tF`t5hWTNyV}->_ zp;9RIrWL{|)k?ht#9X8PPAdcEaW;l*mOl>7_b;xbsq*K6(&&Qj*>bA#j5NX>2*FJF z086G9xuV#TA_%QSGU1dg^HvMY`>M&AhDOyz3EAS5l&d-cDu{i^>_XHLsw?8>F>9=O z8T)5SI*m5qdeUWs9^IS^b$5$9wL6SqqMc9m__*ENadEin+mnR6DOfMLd)FJuoquA% zZLRZdwZw!an|!yW`p+Q80AR-5*iHxhlnNl5NVl5t)>br4cSibeRUQCfQp(mzd{s7( zZW-fGD!FQFiJ5qs6E$8WI#yg|#UQxh(i>_c@CU9(HQt@tzU#W$sb(E@OY4wS@7C%@ zZ)N}X(<1#Vd{@53{Eg%IBXU*XxWARmJc26Y;$&6)4k}h}xrmwg^2=om5>GZ$;U2m;5J0(8yHKU^LJ*AeFj!jjRh{iHeI*vZ zOt`_m9vwBi`dHjHuH%A)?BoKGx;^7a3l^ac-#?Z9SP}KBbdyR!aP8r=nlD5X)`!2H z${8()F+Q9uPvH%fiYdU0V(lN-4O?L(WHcl+=E?+h$v23W9|X{QzEW6ElTq)qrHOwl zh8@+fBo*o>t!v%3v4b@J{_gC*CvGmnXPky|dwlA?~>XCq&$BBrwS||Dov)QurWx=CQ z$`_p_i-(lne@OH%K@$x;BLgDf`G$uft~L38e4N*-0mSby-U(Sg|JGzf;TN%W=P;fD z`uI_Fr1OUc!Gque1{xb5T(8Q>>;*0T1(Uylki0?IA4JiC5cJL~9L;~o!0!Yoia;oT zs=nHYIM40oCI>{%2d5T46@-)i*xiWmkP1;=KdZ{k!AnxLhudHA_y&2N^}Q2y{E&Zh z4hCK@BYeN;Hzwt1XgrQM8cS!kAQD)Sjqd^GM0J+VfZxCf1!Jo4l!gm$%fVk*NGyNO z_i{X%zG$eJqkDZ`Oe(zXE+%;}2zFjsOF-D;gyvB<81mU}-8Bnr@E_rL2>RQz zBvIWXjr`nCv0Q{f?eRVIH;GbhXk_)BkQo?X){TE`6Jj=q%2q|!d!3Gzkr#&rc-$U%U z8-WicZZiLki?A;YF{s!X=j6<|&&piq;=_{|7rwW0ue)z}J_F8xxs2yUr-0#f3O|tT zv@F2u)A@K;EAr#TA zBn%{6@6*vW|HcroA_%W`*Gz6lkF4zp;$x@&+Hmqe_NCle1hHO%tvooO9>ud4YRGN{D)ToIk( zUng?S#2=;zA7%B?Msk!+mRV9&bLrT6eg7W-c|eB0nvTAbAW@J@;|W2BIEpmb@(B+U zBT*hu^_~buB0pjnN@8S;1Aq2m&;ovBHw*$n2$K`;NeJ=zTR$mh$uOe9dvfc+u$+_e8JEfojUUVEoQ&TSPdrxVWPHxK zSHp7zh!PCL{oR8>fjA+|JlVKFTv9-a zwG(qDc$frgaFuvNiyyP3Q=3k(2PtT07G=N(U-X-VMxh^y&Pt0P#B`M|vH2mH4t)rt zKOI;F1G>f!zkEg#K=!b)M+Euf)rH&LF+ju}lk52Oj#PkxIuAc?oE){pJq(A1YlED*P`BB6)VC#VE-G32yW33c200)B;6;;vT~)*{(fXjSXc_LN}t=gQb5)#1u0~S(w~P zn$Mg^Bjv{t>V$+8`$0-K@F#XU$IoHH&}wD7EEBT_apx0 zB4H5x>&1-O?aQ-Nw{)F>T1=*Xj8xh3_+kA7^~eY(k$Q&}xxu$ykd(&QD|+pT+qTCQ zBg)X_$=%3XDyBDB5I>@Iw2QsVaC9qa3YC1}Pd$!wu>8;g)?exgl=P9hF#%|P!AG1> z#>Lx&X}e_oY4Y7lB7$Ev}!6H&8m;qf;1wJYU8k zR;16Q!cjy*KU`^m9pfE>l_tm^NSkgP*cx>H1Yc+K=Fc!0z(W!mieNWeKTSP;!y=AD zUn&Nq^!Vc2v($JIGY?gYPe5;b;vF*KASXb~8K?eGq@#frR_rp&_8>HHm!0@5s51Gt)E z0lDDHhXSAJV0i&bZ;3f#KF%8?fch&=zJOv_viz`qvZ)JC6Xg>*M?!d)dg4j+MTIIq z1S!vv^X!h%9H4!Jhc{FeFtg9Fz*C}#kbYdtayFvo4%Cln%xLoDD4o%xFR(qL$DbgG z_vH3)g4x&;3GxO~6T+{=)RTAz(A((|#RuzXFu?$n0q$Wx2B)i(pu@xq#D48`^~l0L z`Wi$DxX%1o;dVRyiAuPESwB5*sgUU&@6kEdi|aCTspyf1@lBKv#krdJgs4^_%H~-4 zOq+Lf`Efilw0tBiVbDwSb;;GNw|Qv!f?RZR6BFVqpw%A~qw`kL71b z>jnYnb0|4|CMXMN?1Re`fX=Q-77J0ny*?po!b8sn(2qH_m;Ht$lY!tzA@Sl+c|=!t zJQifErRo!9A;0k`#-%i7JwC;hc_v_f$ovNtO}p2gcy$T_b&Qo?`M%aJ_2=|wq62?Q zhCYP`md+I(jgcQwH`(ZTf??eY&Ui$FTThmMYNdM;4&-0pt)U34O)vKUoE-lGBnLdW zBA)EAC0k^Gr}kfd9F5--F(iWL2pceNA8|xOs&3DSpgtTHdL#n7fD8YO;3{dp&2NuL zDxeshndTgY6V`?gN_+0x;4*-6I%4KaMv|#3j?rYWH9WdjV+RQvn%(egvL%$Al@J zkm!ecgW9}_BECq~1YnUoiS#hIA3D9`&8-(20TPe>5SxqG6AQA5>!&5l;Phk{0Vf#z`z4E5+VE`LrJt|`^sYggP z{v@{QBWnN5k0J2`1LX*|EI;b2p7g%=MfDBHHGz9SKg2er#sf-p>a{PkWMlYEhM^Cx zjFax6HHN(2o&aoV4g@f*spxb=meI5>^{gK{rb*Y%(X7(^-_ z^D!Td{E%x)ix+nBnV{D+B4Z-oP&LIqR308ALvI3$zzVg&GwY}3h(XE7(8DQ%74}Z> zB=(1-W6G{b=wE;`oF_gBsuc0%(03S7!n{ZZhcf8aQd~bV7i1c9fyJ#qhvJjL>1ad) zGDwDg>}2nJIE-F0`t`(%bn4522e%R+u7_BWu@_(*N5^lyk=DMv5SU2_IMont>!;`h z2a{88#^(dM@eP;g!iyd9Bjcebv6L`D+7ajnIiy zT(@TvcY@`W7bo@N7ugKjcUVF8o+xMgwJm&Fd%Vr{U-Z%8U8nG_VeXGr>n**z^Wk!6zd+ zoh?uNO+bn-rkMc>fw*RWygatg*QUU~RVa2%8Ht>9C* zMD)Xtf6Ot|Ikod<;*W6z8cM&hcKWo!%y2$^3ji@n3dZn+1QX1toO%;-+YkLXW)1>D z2$K`85@sEikO=Qz7Qsf@FNhj8$|#TK|WHU5*!({B~M1lDgk}(>Kb%8m9Uu=1JhnU^>(_d;Pcz_K1|r7=+#jYby;yhj=HysPSoZOnvb6(_^5-{X*S4 zV%Jn~21eCKEGTG4KNgv9#ZJn?ChyUdt{mTf#0P`@k4Uv`5C>kzu)30;LP4Xc~YIaf0|y3!^z4c zdi)UcoE%f%i~0cfl@aBKR`RSqajClAyTpg`dj1vsv+kz1cuJ#Nf6Pj6@}6K%Irm|r zbo93ul$iDXP|{of!!LD@>&bq0m`KH^okPKILO6(AkpT%f3$eI;_Ns}aX916rDU;7$ zq0jdcSRRGG)cNR!p@!Xspl%X{(wn+0IP}Cp>sy@|O%ITAIvPo$JR!)Nn$>S8mnWDd zBOE}@4dDkx-VBddb$t%Kzz6oM@RIheyh*4J1qTc<{hmMMD9VTr$8qfy@BvoL_yx43 z2XMt+Y?*JVkZM4P2l@^Ij((zHNSH53s(^Gx8S&-BdwRKk8qT10CJ_Vry9WyR%#`Ty zV}~^5*Zo@EnU5{FI>Enk4=k(!Ri3!B2Deg?sbBV|p~;H1AHxL4m*2S$I0D`n=GX@} z4W=H%F9$x1gsF-Kunr?GrhXh!F!Q9gi$4e@`rh7`CG3@owZwQcIHn2@6d3j6;x{A^ zZ0S#8=){&9Tt6km7W4F><`@M?ohZ@)yB^hr9Pp94!NL8r$=NUs3&o!MR-^*pkcj`os;h2nII$jb^W9qCIS!!Jt{~kr0P)_ z@M|JS*z+PL>KGSkdgFmo4pVA`C#FtL&=)UGy#;zg9s90(T{~G2ju_F{lSz}wkUh|C z^D5yRvk&Xocot%XOm<59xRLt}Lti`azpOCA zZzF!w$a7QBj8uZ)>D-{1QaBDs&lMTyuNoNnrC}th6WHA0{DEq0UqRIza0tEsEz**% zXXj_}Gy5k(HxnWVGL9ojr?K&oAj;6@#yP$LK(hYX4;wou|LZ0EmBWJ(dQA*Mn0>MS zr{Y%z7Owny`mFe#&2%rnm_01L36N5i_sk>xmf8K&;`18ig`|8n{HDJvWnG>9aDr7Z zA>r&VFKd1=xyts-rXNbZ42Y_EJ$w3cV+;Kg!9kaWX2!sHP;^Sr-%x1(`2~mJ=Ee!s zft5NqY-0y09&t9_ROwN43m&B(Y;NrT<JMLF@Cd|HW&*II;J@t6~dpc)|cl^q5WoSTSKL?{xOJ`Zi2F{uvjA zZ}VqminS<~U(Fts-^>m}eHN0h`RnE9otJE>K4>WCF@8F3^vd7 zZ9(n5wH2OT$}SPrcolu!uO1V&P#@5I=lEtYsDNYLx(1t;xK22U8S{; zek02(5z6S^fp!eQ;ubs_1ejfrh)jtRn)Lyw=p-WH1qSfXG3+=Z{jl)U2@e5XdG-ej zKLO9*6TwI{O96y#kQ8=tpg5o-*F4YO?+JPh<&Cla%Lrrtv|9k-=%qeimTEPh9=Y@LT_e0b=~l@HBx&5{{s zaeErWHbS}OCl#s`2<{_9DU%b>Kz87#Lui+XkNe#ur0PiBnC2`(+X)FNp84vnG>zNL|Z12L13A`8|SW#jbcQEYy`z|)w( zS;qWXklChJx?xDdC*#7UaZ$1=uq5zX@sspfwG&;u;4tDz*w9nW3z;2qA5*6IZ4ull z|El=3!eL5Q`GexqatG!RY;%U*;P4DfdBa7ufw`|$Evd1&dnt}q_OSe}QEkIDOL^3azf`nLI>R#*mVc?29~dwekPEJGq`#$1ZPxu*t2?tEirrR!t3N>6 zx2%NMd~bhQ*TF4s?CI?Gz-PA{Bd~lRDm?$@Ttc3>gC5Fus=z$vA69<2zk8>>72o?X zcv|WYywv}l#)UIKEcbt4QF&tQUnuZW`JpfQ5iAYx)>MC*j+=hEWb|w0(b=t<%)IxB z42@r<@;p7+|3t5=1a*5yU*m`iQf1*#RJ-hv>XVPt@T&SKq?IQZbTq0ynjNrAW1f-5 zpN{0rZ&6r%0+Tj7MdzwY!+AWdKAEBF95czS_W@KN{9Jwxi1@Ql;R)QPNNKAfm47xq zm-MqUeYh{pZI#WluuAt%)F7G{-D9)Dc{If|s(aQI!DMzN9v#1}F1W8%VtO}K{(I9Z3%%*gJ6QoU zEqG=v4`9vx0FGtSDc__g|u zD9yk(XG?v9_7tSs6+A-p_qCmSKyseUAP2Wq+D!-dNhCbbc1rnK=~3~I(MT&~J|GgT zont;8lkgOl_0ziceqFEPur-ri_p*6fe)~w>oZ}mFi={Q7rKtRTZQheaO`f#K18b2_ zQ(7uZVNN^M8fN;;K*SVo?Tc>?Zkd`8mEEeI^C(JUt%_2Q9f?MTd$q>*3gTelE8#TPrsIeD=3W?~OHG3nVnYQ%grygLQ_A?3dc_DwR@azOMXUZKI)( zXt9}wS1Q}xOx@4ImN)ZTEhl+>&KV~1pJwNwR7SHr{H32NtFBV*vT$Eq`K5B(R9}-a z|GeRaN-MU2WZ^UWq+$>>mUqm*Y<{OQR@HKhg|VvsRQa;5YGUE*x}U2zvU3U?mID+U zU#q&R%QXp$&g$|nvm-yRa$tEz=Dk@j!*%ukX2rSgt%q>n*Vgqb&U4Mr_1b)iQhar) zuJPqrtzRsvls8rVrD^sWD&5shU&E{Q^H(lVH#>9X-=ysG+b}fue>tmev>r(DSAA zM&bSC<$6IUb3d5bqiYJ9mGFoTl zXJ>t_XTX;Xj$$R`^_-0D-9_<-r-P>d9=3BbE>_mbVwft=*R`J0+vKMO{lLz!a#U%- zRaE|=5VD_z-s_SlaFQUQjWW;5!z}tq9~9G{bW}U|Dq@JSTTy{12GM!yO6$3yeSSvp1hQ`mP_h(24v1O9X-7upgB2`^q$0Kg)&}m{* zhn%^-F1qM||Ki__Ki0Q3!~Z>Ams!o zHaDPQO-^C)QDJDZL`5oRpJmC5#iynVQz9#6U00^c6Cm`N_Lz?kBZ6(JMK8FNLlfxv zX+jl=fcxq%8kV3iTD{;+ln}+ank@N3X|U6a=bAcIg>fp>iYg>`RPvfk9Qq~89lG^z zq+#ldS~^V@y#b4Q(L2Wrs42{I{R_oeZ+L^mSST2}MZ}~^<;gzq-#(bFCa1q0avp8Y z{#G#)Oj4dHyjbvv6(2uP=y!`Zb0Jkv*2qI2FW|tO>5D&#f=a~tB#@mC@f$FmcNCN&IUx+#U-&!UK%et=T$0uWCTW7kIFd0Q1eTPgfze=?c9~}dDX?MXj#oKRtEl((ccn+ zsJ@dLQ6kWY3#29lVVJ|+XAjMVP6TY3m7;WE=pU&GR%o0lR;T=$bW!4j=YE-4oOTu( zb|e}JKGp0=u=LChq z0!#f~%3;PFuB7~I^beJe2UGT|9Ktr&MvY_)2D`$C3TShYABGVd%r_JY`{pZiO955vC z4S*3XMipPhvZ(Nu=g8ko2rIA!CKI~B5=B@l6c}1uFsVHNYhn`k8v#f!f@^N&fc61a^lDC+O3?8bpbTA3+u6dhQg@y;>#$;D zBz5Ew;vzGC?QKGNe>UUbVr#Y)h+J63Ma$mw(xQK05D*z3osLexIi;5!w-6!yuLmn>##pAWHsC4fx*t;emJ`c@S z+AfO7HHjSWX=!JUcI6B5RUtuOJ0nb)DX|R65}OVg+cJ6>L=l;^Ft5k=0Asz&v z6&)PL^!@()a+UY;6u`G|)(mVd%5=s`7rAbP&_vF*;Nz}yZ)^8`VkmGiYY`a}4WXyp z&7Cx9<=}FoQ96}o`ldKCX^G~i7FCNaYD#}MaWoF>k5UJY?T^C=jlvYlBy?&k2GAAQ z#LyS&_au@rzJdGP;cdb5MY4Asa0?*%_C&%(i^m~wfrmbnrBU+bLtShUZ?CLPqW$f-2WZ3%|ww2u`AL;WXk(Ly2f%YM&6 zkU?7Bs@=HG{MN12hziJpa$$2pHmaDKdBsDXD9a@D*Ya(fMIv*$M_0~2y4D@|%L!y0 zyI@IBs2O(z755<6-N6i|eIQfT57FX`wkM(%rYh4Cj)DnuE!6LUWqAemmVO2!p!0s# zuA1~vEO$m)+4j&*7B~{MIJIwa6mSL^Tc0c^!sO&qZGHi;sLSec|V-ZpRVB0j{?nIP9VS~41VRUSPNSC@>3S43|?TTGCBqsa>PF*)Y!g&D=M31*d;1K^!pr6P6bu zVQ?s2Wv_iGr;XluDUoP`uL&9wurX3{9-i6EE!9SL4=|azpR{w1Ph-KSRJM8K>+`_6 za-3YOSszWwa>|6dfqMr`N`sTrqTo)jG~ycQo*$m4V~wZYj+jOShi&d7z?-Z4sKNzC z>uf>6#BLZ0aP-G7UCiCt^-J)PLJt|2&?_9nbgK0#R$c$h@eusrW(a=pe+Zn~NVdh*fJ*Os*d!LZ4ai3mm zCo|2|0j;A5!^{~=II6hwWqL}{U^x#R?VNUsG+L6eTPxQ!>5;`9$JsHZWma>0-5rl- z?VqjJajZ6My4)gd+l570=F?e*7Nm4STKaO4IV*{z1<=J&Ey9VpJ5o^oq#VvtNaSjR zYqv?dI!B=N`2I$)>MZQ14+5&Va<7#uVo^bQ&EILZT}-KNx#*or{cWvrdRY0s(ohQ>n2hueG4lZ+y<*w3)=jtD!upzk)82U%=+@?OayOz4)H4zevTgSPy|RA&rIu? zAOsCkPGLlJEiotA;Lt}}%fN+l(JiMeW{k8lh1tr0*lDLr65KScF2y&L%M;9!5e`%$ zh;R{TQE0v*qHp@A12;UiCW%ftfjsNwpj_`_RCP>RGYKK~75Yh|n4D#I>R#Le4A?$e zMT5}!(Eaeua!J{%P8Bqpb8QjNtZ9P*dY$c3Gy+x3D&huEiS)46@TW`>pEk-O7% zO%S)nzT=VgFSMRw+j=sw&a-W`+(VDaa{`flZgp($!vG1}51QhTv~f2MNh9!`tH0bCHh6 z6StQJW8Fi};E+IBMu`-6l53aw9$HLQ0u0p3Zh+Ah<2NjKQMh3iHdh*0SMxfcpfEE# zJh;nTEknre2G^`pF$LL#4qG+6)5_-#^vegLpc-PvSF>-$ae{}_Yb}k1W}GQ-x#iMR z+vkDn;xRKJsqN)=^1$36y9nknx5jH=sf7&4Hre@zBPU3=y4}_pI>u|Ut#p8nHm&r{ zz6-{{pY6oHH=gpgjQbND*q|CG!LoD;7dI!}!`8T&P)1y58tSdqV7u!6z&8AqQ&XAK z1y{dv;m%d8n@3>5!luNM=`iL`k3P(7%FXtDjI7~kbsLY*N0O} zjDzZ5#tiKSa5Qjh!82>|2AnYy*wnUj=d^`e8}nUza(bG$n6uMD_B@WzC8K4Clhg_6 zW-mxx*)4livr1vmv^%a^D7fd&0}QYZFmRlm@rVYuEkVY{S+^+G{URL4krRzr<*<$E zYLh#YxOVh4jxgk}FQp7u2bRp6&zZC-bEd*JT%x*TZ`q^R9g}l2UapHrGk5uZP~ge& zVL7cN$c3}5s=x^NQrdCR%<$z%yZ=4G0y70CiI#$RbR6*wxCwvD`$kwo8oYkZY4I;2 z;QH~*1b7H%u0v`1u>ko*Xp18axN{|_73R8u28eL7)!DX7<_MHc)c4u7Bj74)34Gmc zWT&jfkw4Iqvc5R92^QfE7A^`6>JF@Gb!4m9){XOo3pkGEg)m($!fM*h@<+FoHuXxh zT}{$WdVAp_8HG5nxsV-h3TQ9wCfpEm&bf;aLufV!wW&EXxWu0A#@8< z<|uWjt{jN%uT>`Vpbcj(=VDA2?0S2l@j(~L+nCj9O5Rwf*kAQ#(Fr)j&2k0_BH}jn z2uiM7k|@B;)U_Rr2!I~xQEMEgy2roFKAd^4@}N50Gs9dryiiF1l6&A`lrav7+*5d1YllAr zu*`IhKF3(#DN#ho&5i8iPWsBm)-N>;Tu~N2dxcmMMYBJ~0-SytMfz2pAU>19giLY$ zkE;*iBEf^)=7z5V9wk!-WPZN0cBfPFE-gF%Fr^2n?2!>pA_d?}5x#x)3IMUmLn{C$ z$_?rXCdR*5sPE*aY!!9PK#+nSVtYjC_iXB_<;iKJn5+8dwoXweBqM!X){H=>E~0{+ zqNJsqWH}Z!kZEp2&skAy;3=prjIF0>laZSp3pc)lDEkr%K8Bm=9V7^k2_xZ_3unMJ z0bk!kA3Tc8mM2o$9xH_(%oyx<_Mbm@$R-qZa$(YT^SXxhFn1Z(Zq=qPCg{3cE*vCv z%|d{~g~Z8h{@_a26f_JUYc1gU%sB?wSrr-S!TECrGqNI-)q^wU2+_)s+oq^JH48RQ z#DN22xeW5v6(WiXr~J$yiSUpBo}{?|OzRxEQHEW86Gy@e-VP42Mt8rNa9!ioOkR}U z2fF6fD*iXOEwgHsy+h6*P}6Gu*10QcdzX{PnWRz?7C2$>4Gyj#4Tfd0M__g}LAx4u zZS0a$nLPq~aJdQ^tKZPuw(BdlYEx6Y-sFxgjp)GU>@pnPN-EEZOd>azPq0r2)4WC` zfgXQP?+-PbBpry1Uw!ZP1xrbC?sv?k>yB~1?HG6+2SajBv_H>LI!4xdUHFqLz5C>7 zZO74?RW*L{w%*Izx^NuzhfgloM+`fa-SRrXh9MJtO&tL!rW_8_PV%5>?V8mH2y~d} z2Vj{{*$S^V!F9PSfcrD8dClu(TAK}mpIB(Oco#?6c6>)oaPHtO%ahNY`H*^85qp|& z5ugYDhZ@GJ2@lR3NSShP9j(LJD%217C^c6u z>VBDW1w4r}h=wkLE7ObQZ!JFRhAU8Ki-)yPQ8o^n@m5uV_$bec>}xP>|5 zNmE$@0tg^7HY)5XtuX8AE-7U-yF-b{HHkc6)ZXE{y3K`3QG&#RNWxSp+hAHdA`a58 zu8Fw8DwurWYN=STmGeZPT}Z(tVFhdkWqli)M=A#?a~i>95Mb6;oT7mel@Q;g&Aftv zOTqF3yXUdqoGmi#+?qZ|Q%s}5a%hkD!=b?p5$Fst4zp`Qsm$#eOl}tR=1>O>NWfVr zFZel;fP@o1_yrVPpiwY&bVnv?Kc7x*pX)GU4*o|TC64*L5EPHs%BIp3xTs>pZ~E+# zIv3lD4LjjU6q+DQy@}}pefjkVWr~Oq4jxm0&0%eDP0sTs*&XlhART8@iLWuM$i*c< z6p^t>n$m2!2`iEbz+%Eaq6<|)Q@N=S(SY&n0(;KzBt?bd_uvp~DWoophxbW+<* zX&0Hb6Y?Z^%(8D>Fl|kbw!9||=zwUme|or8S9#3gBJT6Rq2X{i*IH-~B@rP1oGK~< zD!81U(#qK`XI_ACa>lp2YTYT@dChKCkB{5Rg$y5a<{Fw%8~L!1wR<6gF5BLBPr~mV z@ORStzEmpO@z(kWgS2yWw{luRt~1~d?Jm2s_U)r}m_~+8m&(+(T`Wdg;?o6Bx;7)+ z|8c2L`0miSYQil5I~X<$d{wPSp+VLRacywzI0+OipqjkTv@&Lx6Jm#?9iAO8SZ(Lm znSC{UJApBSHDmL&T+C|IJz>6)xXRXQR|&b_9&Mj3S0IqFv0t77};-=jVi|4Qi8XV zm6oa&lJ)%;zi>>9CrDG#h#Q+!3zZp};rMS~D8}fizEV2n;=s4Q{cfvV=o* zzr1hxf#=GRTlt77su6J=`0vuT+djDIeodhnCw!TfQ(+@(;_}-`lRlwJkgifVxNJQY4sYep{crHhn@4k&v9MuDtcOXT?-oIRaFv6R4x% z!i{Vyt!U&bTdbpPua;Q=E@sX)y&jGnSWAY!N zaEoj5kKTE~NSy1qbL0Mi^!GDCuPNjTI+@74b(?G-Cc2PoC347_Cu=+w1UyM@s*I(r zuVL;^hrdG8*G_^I)3)1Y>WoKjN}oc*YnUX6V22dgmDboDYRaceEVlhcw`f9imh}kS zA}uX8r(C8v)^S0hv}|DpgkeFs3(L|r-8xH-fO7_Az#R9dnzX|f&Sq6GpmiK`Y`g7Ai6CFfOD7V&AfbQVERb`GaSmB<;X3hq3xsXwWLG##{KXOmM)Y%G@BKIH)+iM zUh}^0kiUdRE{qo4t`{7h+2B|gHyXC-4uFdS(($?(21uk;LOt)E>}=Exm}Gbs!m)*L zE?`#h$X!-ZO`e!8ufrn%QHv*SE2JJ)*!a=iAS;-rTjxq+VYVJ+r~x=z4WxHl3E`(? zidjbx9O7YQ3fi}^2zyMPL#Y?()&}T(7$9N$X&GNh$LSq%AxNZEx}!9RtbN!rBFe6e z%K|(Yp{+oz!_Liuwe>EUW@%8}V zE~Xw-R)|eP1-f!!78hu-Jc*sESSWuS%bdX>i8vceq_~3`URY+OAX`=@bk@MZ=!)?h zmRF5*!!VfqG_bkw>w?9{%$z-F;BGkr#5hs ziz^|*tZeT zVZ@g!^!t!I*aS;c>o?H7J3x5GYq249O0+g1Ar|A>1wc8$VO##Oh~Tj84H@`rL1V0i zHMkIVas)M3&261OPjJvR{kTagm_n)dlkQ<_+)OAVuF>GN1qfVBO@DB7`IT!lN*8Cc z6Z|U|?(SK2^9T-Dpv_q_9p=}^yn;0DBK4a&We%EOA9FkeExZ!K$Ae+q*41vGT7n#; zl4)0OEuALCLo2GBfV3jzd$j%~O)4 z7Nx2_&ueYCM#{!U7CaEMP5Ri-YquXL4k!#_)uHQP_ zLU4nLfZN)NJWFk;{%56nCMXWBD5(~I$%GI)r@lcsw}2qJ0t6$+Gv6+fp+$%JLRAUI zbDvwIg+m!ySxRkSoty7&+4-2W3tijeY6}Tw_MD}VjtT?E=sAl?XeZUSwDWS{(Co88 zqP`oTB#EtDWpxg>F`uoTCNsK^9Xmy3Jk8V|TU(BQ7 zTq7Dnbeui*+FGwREZvgxa$B}$S)Dc(rJ;==%t{!E{>ql4@eOa5tsxn2j9U{RON@Yd zeLGhB1->j@&_e)#eCi#gI^BL!K8HA}a~*ihtvQN>{*DPb#9WE^Su%*NHCSWLKm zXEC{;WnmE_T~x?n;|N$_mrN*%4esO?%?NOVq1YDgq~YLh^)#A^w-D$vR5!1?e6uOy(H-J8L^SmQvrsK*=B9V;=V9EybXGXD zpPJs@_PmxfTFa_yEF7c>u)v}!UZyfM^6Kk$FfG-GOfE7TGn3p zSyrOO>iG!;J)B(lkh_EkwNzYZ(XJV0-)m$P#hBa3Ml0+g)_mn*9|K?P@>N zhkId|n}$~j$Uhy9`X`Gcw}%pvo$~L3y~8($hx>2e?7wNKUYO6qDG50fY%C9qy9OL? z11iX5D#dGvQ56Xav3M;Z*{ETQ?!^q?8uTZ>B#5IKmY9o|FY=f7vnDS(zczGmLuj=3 zE}&@~FFs5-_%KyHfp<*{aZiL(JVVV7*B`=%79J$uEO{$raXO%EUN@Hnq()Qj3lBf8o4}cvw$cky&frI!44gwkZgBhCOt)Wd^0|r1n93vn=!wwtd zkA)4Q&=NkY$gyoiU0f@01|6wpLGqh|XHr=9Lm5^={juOB&7F#c9lc|fx$XI;YP{NU zOj(MnBhgmN)$LGQ9y41z)D{=0Ek-Z366#+H@>fWZCM{cKph%W!#qiHEugdLclUJ)b z0S&nT)FfBt70dN#z&uy@&Iz=@e3B}!9oVwB8gbY^zX}i!rvwaIDZ~lTC>Uc!h>bFu zNvfS6TXF~V&#!FY(kKo2Ba-+I&28_@+)%DQnlDzU*m8#~B%~kVBxZAn9J4H>EdrEA z`KL30Iy(W|c|oLMngH@Ei1I^)8EPY0HU}du`Q3`|20T@0kUHE_`ylP{?G#XHOJGXs zdn$6)QdQC1ZH~iK1t_YJS+Y2bnso~hG&4kO)CN@j<_AxcKR}5F5SMQ<>%dL2gV<>S zv7?kUt{qN9d&dir6ZK5)<+hi6U%Is9AtxP)rdKOx1UF zj4FlvyEwQdf?SiBNE_%$Ovo!4o{h%>TR~60>}RO!@P+ykg-5?LioYT(p|1rlD0oT6 zS{@6*6K%oTtBOoeERXLKChX|#Ct2k=WtyN^2H1Se^7Z}We~Nyb3W@ngViEBFBawM- zyjg`mrq_y7EP_x|P*MwRGP-58Xpv8w%x%pRwiUME3-Q)iTJXZ&sPEgs8QQ+cJcFB? z;}CR%LU6Xo-IWzz5<~@-@ELUS0sJNza1_{ONm%jCLbv4`dizXSDrlHV#pUaII5_HT zozV+?&6wQAHq&Tc`T*hTt6wcpnRTV~gwXVUh^b)wltosGhv#QL#NIbmk`n6kU|&$w zn5h-d4(aQ)7GrmiUmH%(4)W{yL4F~MCOGOPc5OdK`GlXLGJ*PL?P#=Xo;=0Nf{!1^ zV6Q0ZGQ$!I7Y5JFt_wXBRwe0U>ltT&M(a3#^pLr`cyp zpu%u^E94*WG+RMEWsyORGl*{6ow5uh4jDMPa=M45=~N*LL-M-~E>H1{afrKB9|;8c zyCJf(_X0);LVIl;J0k8&Q`U_Hi2 zU=_V;BPdJ7-PQzYfP4W!H7Gm`A2$vSJ3(0&lEZ?vQo0WMg_U`MQ5+};s|zd=Mg^|U zofXtrf?{il{2G`JZhC^^%%G~`Z~>O!wM9fcgNBR38|Bxt?k`mFkQw?%4u6Zn8@s$g zB_Hb*f*kO+gJ}L5AetrKf<_^TENe~KJ*e=ytbqL57F&!@MmYhtA+_vqQJ)_!Dw^1I z=SnnLG#S~>$=g!AYAG8pkK?o(@-mFsU4M$`gwV-$!wr;>9J9Oq(0ty67-RuJrI|Is z2v5)be=}-LD}cUDO5S!>>kcDyTNt6EBA{z@4B)+D2N$|ITxiSDbcF$Wge1P)2m`eJ zp*Y1VGg2RnFRw29oq*$U4B!{0GK1TY4ib3#Lspx7-L1JR3S>lB%=Gac;`R;(;dMZmhH zHlCV@3p`^oi+^#uBHRl9KtUf-Mj^bxx!k9U6|EJNX=6Or$~3n@fDb1&xa8Kc%vvGB z5lOHIYGk%Hh9g2$zB2>}QUn@S`!r7|)!A|`eKhH=O@aguZ z@#C7gnk5Mu(0}T>436(!SfZ}?>m`#YcDh0W4R(C346>?b zAD!AkE|O3y{vOOqJ|t_yC0QF4_fD9LBs@z#rw#+6E|Tyw77!z-aPJ-8`KRdK^@Z=j zR?!9__p4J6hvx?q8zwXo?tqWuHy%(^u_ctRI$j0D97f*5X{R^dTYJ<5>HJB zfIOMQ#H}!*?Ur7+Av7tT*qJ|aM5Dx0ioBSvVJZ?FLfyRZ#<8wdK40F?+o8SMx}NWG zm`W&cg(>&)3!HLpqsxaO$C!#K zTNB{u=?xa*#_f3z6u@a>4tuwR{CyU?B>+6D>!5wunvEWxq>j@+e#G;$YjBV_6xGt} zn1ny#xx-<&z>{+(q#g>lTlE4@e#DNAycc+K!I&4raeOZ^jd1iMo?i(xaVd9P;7Olj zB$Xka36%!yjvBaLhhzc}WiCabBPAdmVW4i$QB8^4 zwOJkwt;9Muwt#!~Y&;e&^QOy#(w`!ZLWwyMl7zxFQ9~R`=2|?~HXtudw|Z2R4M^cE zx!uvO1I#Wtb_)JwqU(Kdc4UG6CB#kFvA8^>%+P+t7d~bj+P)iwJ&~f z{;fMo2I7nYHMbD_eniBLJ5v6ZB95peRC`^sc(gT37(TspM`nmaP0TcQNQT};F0aTF z768ORJHMjXhb8+Hib-@r#uzZOUAp}4FEA1U&#vRSTa(*oEbkb=Yk01Ggzl6v6Wje8yeTD z3=%0<7494#uVjW<>e6SQCJ7v?jzxFv5_aloJeGGl<;xF^|{8F_Gk16Cc8DFYx3i6sL}(050&vwFPma zY8`912$f~+)J3&GkK?@ytJRNq!G)1=N{Y^wQ#;6^vJXlhkS-Qv(xsqtfkaxy#^qZ%#c zcrTZ+c~_KZ!u(lHfR^q}DGo)5d+_#N5}Lx>?o+t)`EfrinLRqQlPik`_?ujt-5SVp zji1{{6vXto94TEz4M%z@xrONNC81-D;E3H($d++k(LJNXwP(^$;S{9d0?#0FPAO@e zOeUB+k44e({ik5?Q4mqCGYwQS$O(o-c$Z;Y;zn0zFu~&>)=;-W5NDy?H`wCtdx>=<{9dZ+Ilm3i&B7Q!jIzY;jQKo0GvK)^cDLbfjATg=e}J0A{1 zM?XmwM6^pn5Q(#tCC8I8jvWw;ISPo-sZzf%mu$(@YY_ zMU<1oIpU_ale#uoB%q-?C&B}pF${%SW{M zwC128;+Xm~HDDd`ZJjuWveM+ZR$0shMQ1LvFbXn`Irj!p#&IZfjT+a*O)}srPa^I< zh@23wViL7&#FwJ%nwnB2>2t)<3`@)%mxN<lQ+80-re#$cb^L3b~Y;hEoW@aa_|92BRk>C)cS{kEg1eh;?~Qf2{Ee zj4w>y6FEaJ@d1_j0BoFuPL5J7Dmc{LCz#3;_dveK@-DNh=m0iPNTJ}Jjr<_Swe!(~ zWujba&Q8g!tX2Y!?H zaf&5la_U1Rsv0o{xX4GEyrIXfaYxhe6Q&X4PQ8CKL3Fr{TMIhSae*g9NG&zGMtD%J zxMLb65UXsk+Po+Z9)@uG>Wp!>m~ncH3_(`{0=NhbNz%#{w3T_Q4A#))SV2*sTb#!a zS2f2|ET_zuiFE7*pG-KOs8KmaJSINihc#?Gr)#M)T^`U=nzNq?jo6*@8LN!Y5t||6 z&2u( zN#aM$uQ6u@ZZC|Js^mlD{2X)QQb#$$G2GFN`y=-@ljK&Gsng`k+B(95a2#bztSIva z`_SdZ5uS6FU@qr_$dj5kN8u1t!MHEvDD}y4?#xUKL!{P780aiQNmicS@!c*_cymH##G!hiuOb+SV|nLrD0H!24Ufu+l7Nj|bUtU6$#{=d%6Rw%4be8MB{tX!%73>c4BaR$O*7*QchRtbm zWdljQSYl3*#6v8lQz^4~yt2d1heFG~Y|5h$q`or`0BMIL0*wtyb)FJQw1?KUXslBT zLKL?Yt8ArJC#l4)kMAkufI1E`y-a2qMzC}DAHZR`To#v!s?GZ4n$K&W%V=FVnT3!8oDvW#SrmS3^ZPi!h~Gn2$?{cLeDB z^oWRr3F3iv=N|J%sg{Ftw?p6-4)Pc-ldG%2kwc&4(RZ$ot0BI{5X<0pIc8Kiy*duR z``-0zm;^u#g5tE`La*=qHuoT$<2{LELfw~&{hZD)C!u4%(*>TqClv9yYdVtfEb*l# zYcGnFNP%J{i?`V?(VU_g373)5^z*NaKQ6SZ{ZMCVftA9*%Gq56N8b$|_0ovQk-8hj zsDHA^%^pffW&wQ{>>a*2Jluc#X8+CGhNcp4 zUQ0lVX&A!2IP(&`3--PwIndq97x~NkS(6u?UmH5OAvD^17tl107at}%HkV+r_pWKm z_e40wGt~TW(}7fPhEOAl!e_s1x&T4E|A;A!Yb!GW;9ozW5)g5O$0&^@h|DpX@4X8o zPx0~>q5^+kku=4D%v9vy<<(`s6L3?NgiZo!9tVU5cT*Bh)h|l95AKi%CK)#emMjQ@ z%o5iUcs@R^;&>2A+;NXwCNDsqklV@E%P@(N1pGgzu?J8#)p-V}`hUj}81GZ!(v()Z zJ6uYoFw;0Qs4h>H3I{C!Ct4iYt4 zNi`vUgfRJr0eVbt31<`}(w`6~VAgbe<9Y(nP(9uJ@M~0Q(mp`vB*pkAu)q%1fKR_> zEXIg#V=;S?0i~=Ij?4B{@ix!WBkBz?M>s)T!mPP=tGh3jR4S9?S`T!4{%RUjErJsa zVNnhRJ9dK|qj}_6QEt(cE|Rbx6HI-ucIHFkJk2E^75A1`e^BLA@ecROkP5;0oH}$} zT_oXWEWn?9f^V_IEPuU5{jj9?0HSq)XG~@q*x>woZz%cJsnu046UX>wo)oI`t9+Mh ztTmOoc!}>_7U_j*-#!4|fM39EShynL6y3YU*a0Fg@CMfMaCZq+srM&rw)OXnrz zKA<>cbcne!dAh9`b24VydF2|TKuSDIWNXu}ot@$oNa@n)1gKNnq*uArNmMeC@n$+a zE6&XJbR2S#)8Y0WE66B@MMXm+-txcvh$OF5!8X@Vw$u-z7ZPhh&%V z+^|k|3D30w*(E$@4&jOOI*p11hsdV@GBXgpXy(#$p+>>Ach7`jYRB3xPB&W|=bX@x zBrXe-U7$M;G7g+qk5{_{0u)^O0jenmP$dpcyeW$4dU>cBavbjFPc*qd5%$^KjK}V8 z`|;T2b?*U~2TX?Zz*KXR5P?nyZz^ae+MiG+Pb86}}h_34B`@f-IS ze|2K6QWEuq>q-VrLnIal#1~oy(J69RKx4;c#W< zrJbE7sSnP-cfKxi%*+9e@V%>%I7(4$X2kKT5DBBgae}%RZdW}NP$}t%3fB=v{m;GA zW9NIt9A9SB?(D8lWOoHf*q!0^@rKuj#!(FkD>e&$3<>^gW}PX%!v#P3Tz8efX*c~KWfYv~XG z6Jy7>ngZ!}TB}x_pLq=@$2C%22JyMJvwBi#WgyNdB>db$eDV=-83uexDB~Ye8oI65 z03-4l%RA;093K|OAcDZoG5LcR(Sk*JjyR^$A2d!S{wWM!hwGFlt`YjZiP(qvI1Ur% znGC1spFSL6mw1*ij`-aD{bGvK>nw&Vr#JpNf`Wuj*Qpm?qtoHpcnoz$(rdRT`^P^v z&gIqcv)dE1k0hQj?htc)2RU0h8%{nr-;o1x$q^MOlsJMF;_@a9r)SQ`<0r}@e99s+ zHbRbDaz5ibUlapf%-m^E%$V_+QH=W> zBZ>XeP8_Rh>L7D_c=;B-@4oEwE@*zq!0dwNmyOIWXx@XM`L8Ue+8Dcc;eC$}?`tuX z>fK$0-!8&$7vcAZi(cBr7*@w)7h~v4WS?)!nGZ3SJ2kOBB)c*N4eMlArl2+;yD|m& z0Yb5g1kmwzPA#Jv)cKroXPLALh|>pDX@Bso)sVQH6ZaMCE0f_GRWd8Z+H<^FKjR6K zxV&LJnV?f7Zrtw}Ux?AuR2d+L{?Kri^qt1D00pjb`pZ|0KP41=p+xVPZ++Un4v9IR z&IKSmJKws6py=33JfKGD{ewqH`T@A|8OxKDM2=}7lj$|%C&VS{%Vn6DJ#x%B3V#3kwRFd z%gwAD$LE}lorc|>vzUZ)9|BCXS#d2A`H`mSMItp!hilUa&~S=mICY8&Sfye}Xo#T@ z*ac1;8uPxguq5LG+=V4QJ}jxlP^x!#VM)8Nq+M82eOK(llD0GwyOIw@D9*0r!!9go zuk6B-Rvo6hu%z06?81_YFleWcg&NG~JrW++ReS;LJ3ac&JrToCy|?bE@WRwJ zpaAZKu_xv~O%CJUkR$Pg6FEP@w>Wlvl6Vj+u3;5DAf(UeCnkKL1b|@)op?Zr21E6L z5MRKHJvl{cE5t{lyts?}!LK!=qWrZ`nA25FPD95rja*W3%A(Zua`gw~!~>+zizL(t z%O0HdS~T(E`~Wn_ScM9?2Ts+);>lU>0U)GX;3l(AK5~{OE=S=4-FdKOhjS{YSd#Gk z;?RevlVN%-=0f6`Yth-gtvSEuScE;WlV~(s_vffTxBrk#C?N7V-Zy;|$3uz2n?g1d z&Ozz=0-4hdmTjNKu@3h4;XZB}Fo)DA;65{0Ze_{;X4DIuO|a%%@z}M|!u=HhCk&D) z$0`LtAyqgu*Q?#qpCS%Wxts_|LYHz}dL5JSM?7~(!|}buG{Vu3czz|&#N{!PFBR9T z1SJWMK5#YzpPO5-anQD4TnL@Gw3+lVhZ8k)IxoIpC?DVBFqKev=l$F%eDDcFP(<2X zy#Cl5^)U-Na?d$7fKtiw!dd+o36Z0MyVe8D#O3x3x7m7n)?iJY;&6&65e_w2PsU^z za*U~%GAS<64W>@B7mn|VbeltI(w$&V9FN5?6$uFmOT`7cgHlr$7)4GgGGp_eP%r4X zz~OB#3~?fzQe(m%-5P#ABmf9=NlS_QW-VeuGo`- zvS$$Hc8y$7K_(PO#kK5~9D#XD4a82CTpTk{KYk)yrYJteGZ5#Tu2{W&RdSYFLMTc= zL@~v!-7ecoQPNVSX{SV)u)ydjj-Ars(O%XY2!P}Oo+G~CQS-MHr?{7dp6sm;j7sPG$;3%}0Qpj0B(6r|J)wxt{ZeiF^DxFP z6@_z7Zb^(MI5Or{Q(Vre+=uS7>(U_=A2G$8gx<&yAt#AErV~Q(fZoEb~d4*V!|;^XMls|SW?Jz6X$yD7gMu zjaKO18eY#^J;4L=3SxXvsxI*4M?4?mFom4TBOG#!gkzdAOP2@Yh7puK(ZuzDs1zvY zz|oo(y_l7hK_zFg+rY_lG>>79ya|wKAjff(vOXA(uuy`ldwPDxar`4?chn@Prqnga zqc`yRUm2$21)dNg`Fsbe_;^soHe;z?-k~b)P!$~sD~KfS&Q9bKWN26HwH7%AR+phf zv&2>Cx7$$S9jan|EOy0S7sCtPr#V$hth#jyl_@z&UDu2_rjp1QgH6z7meY6)$(y(M zk|Qc+L?r?%<nA4@7m9wym`G)nhqb;K^rjkCL$M8X;8Lph5?xI9{kKRK^)Dn#9X|5k-xm3HF?qbwV{I>LZiKR0Zrq0@nOPQ0?Ef% zJe>)!#ZanucNW0yS^z(=IKtd9GT)P*8k>_c!8+v9u^49P2vOS*Ae(dm31{Q6z|t`x z&hd%f6DCd(O~)t%&Ou>?$x{PN*;gnE(#Ae84 z)%LS1hhavHKq2lS`Q0r%ca(dClHbWv^SGrM9vVO>U znijKM-3|+=0lzbs@Z8P?UZ-&yP9s#Ddd`$3WCY0UW5#E0g?&WlZnvR(FnFNA`BwDe zNHjz^9}Hh=vqc!vYu3o(vqZ;~3F$V73f}{k9*PI&?r0!@njOd5mrG_?w2W!9hLAs& zcZg%h<{~8Vgt=7CKO%|m(A?$9FeIGz`fe-Z@i7W0(C-roj3Z@bh7k)^{TFQtgx*a*S(Zqh{}(Z@Jr<&%6~b+V?x!k_{MY?l-{ns+&|Ap zuG48AJj4AmiW>)RsH}0NN&DvD&B2>W%iHD|T}s}s`HC&p5PVK=fQ7ubBb>x+ULDB1 zkF1A$gXJ44o8-n6IvCB@MXp{3I+-WxZ9YroQEW;eeDh!XZ{F@F9N!XrS8BR;0%5}0 zEr~D}uPfvg#FUPZjgtzqWWv3EDkPhc-(g5fkC&wr!gOkSu83B1>-O9|64g|39oRnn zrr$p=n5Z6udkXxb_FkZ03}A%>7dVL_b(rzsCCGxoDWYhCqoDWmaDVtsCwO^FPyl8B zVk|_E4_oj7#so&AQ~P8BRfWYA^UCbh8byVF`4sV+h~257zMSGfQ7Tqb3WVh&7MPh8 zDpN3o>MbNDavn$)5IVs^1|N-NbAnf+@Pi!8OJ-5Rzjw!_h$iv^UUHB4&c6rb6gX8SYd%mk6}Ad5Ysi zKx2H5W`yD(VX%7$iUVObUBHRB5#0b$6wiOh!JMT$kQmKgh#(a>VB;WUag45+-VWU$ zB4|RHQ1p$-#DKB@jn^@ri2%_km@$qI{*wIlFCsy});z{Pya-v$_&biHKL=w*<^COp zZT0S&#nGQ%{PpwMB8(>qF%>wNr9uYRI6$|E#IS3Ee-AK)e?$kW^W?9G^+D$Nx0G-gWEu>5rvYa% zhOxUYIK@!_L;Uj)en)Z4?gA8o90z|d&b1l|G!H0K#E6uryyIZZc!23G;fyLMnLtjF z3}SqXIhx=KQ~SZpY$4sJ$jJZZAo$R_oBdiR-5`kp-nU>(QU4bqIir)mw%Ok0-b=eY z7=F|F%WKn5F}RxQ*Acn>Yi;jNI7+5}OED){T*BylZtyS_;@L7kQ>CB1cfps39D*|} zISI3mT{4N{Y&&rrVseWc#L+z{#bA!)#W5Ow6R1P)1UB`{Q&ms7)6mH^5*R3*uXd#U zLW6$=5bZ{z;BP4c=%IP=Lm*j%Lo!40%ag4}oRD4?hGimQ(v;Z(WzHof*i};WwX#g^YUN zXJUb1UnZm2x0}yK)86-eLYipyW=>K$eZ*{}a{7$sp+c=MGmwGyZaxc(u)n^~#3IGM z%!aYVZ9W;MgXc3B3k3Tz6{g6-=2Kxhcs^6HK(H@U0hvgf&jY;ud?ukvtuHgsOCus5 zb5Tb`KA$8AUMP-@NrK*jm^ez!QJ*Bo;F7uSwX351(3Z%JLy zS3RY)L1yxl(q{XZr^GJa!Al5Tal=LC&TMtNZIo#eL;4qz=)#C9ZOy~_PKOlaj~S9> z@YeuM*vq$v(@yZOK%}!7;^cSTDEJ|mq5GGW_MKm7nUt(gA}Eu1mdLqk-f1CsoGfEv zQ6#G^`edO8BO(qFuv(jH%s+j*;FsuFrU#>SEcSv=ea?4|H>x0W+Qz@ zGh9&sHl5%_E#fPi->UWR8BK3h!QWWqUNjSYWfNR;g+HSiZc{6y)g(9DExxjOUW^5L zMpIogEN;G=7wwZ@*)-SvWo{;Uh0V-F-l}lrMKqB;q2a>c1#fGkwMWFc3D18Qj8QCb z`FV9&WpVE0mdJUZ6Nx!NZESQ|xc?_4Dwz#p4F(g;P3gskVm^Bu3zqT_pPM{^MXDOp zk|3l%Yu`Ees_89Rc0@C~MQX~jaW68Hpu0c)=}&(OF7&La2=sTsFEkj? zfbj@(h>3>`0+s8~97R6H2vERPlQDyMdO|0aRj7J=dl0;OHB7H_N5Q*Suk`P44}v9q zALs^$2ibG8ae}`eU8rY=(CGz>u`s&{+=MeEy2bk#{VBDZpKI41&LcR8)uO~qb)Qjh{e@?+QDD;Vhq+Wtq z-WDugNCi@yMX<79R0Nvo<<9X0h8hX|mN`fIgQHr;*BHagX6L{i2iaaq{eFC<-oWX8h^gc#-hUg| zo3uVl=5Pp{pzCF6=j~=LRvkdNSGK_4z6;J0Ob16<>QR6y1x{^g*9n^7*JJeEe;i)F4b6M|5HPXNb6M<9lW)iW@n47EeBTK` z=u^Z55<~(4l5ciBXO~8rB#g@-gapMqBBwPLK<9WDyn3ZaYKY@;iGN6~{BU%UNpz5b zRC}FJD0QKTf0v7WkO{hQWb1>x`OMaD9v%b(8Ud5oWZc5i5D>XyVozZ{?ueMel&L)5 z{PtBB2oV9rclk$*DDjP*ZofSUj+jbDg~fyDJV+3iI$Qm~;(7nX+XU__m3&O3s z6_6-g>-N{=IVUs76VyhO;9n}6`?cy$Jufl|^A_WX-yXhxK0~EW6cA0#WeAG`vbnXf z!wCOIA~&hauz?n{*}FzcRKk4}RXYlaW*AU{3fn=EWW(?bqy;2mf{o#R~IK+BQpvCF=R|82O3&oby1rIf`{s* zK$)tSlDtIfSSHoXFii&%&z2Z)OsgYhoXXd#0|8R)(sQ(|D%l!mk?!WQaSuNDoigl5 zaq>{f;q+NrJ`V87i`VqYmV*&2eJK}q7mm2)((Hp)ymm{tAT|sE**%D`L?m7TMAgb1 z*y`h&05d&cCB9}W%0sL%{Y^ugpHvTgphOZZkQU7|hf<5v)4XwuViKv#sTC6?6SdJ? z9(rTR+0g3o@}tnF=`4{Y7-_>;(c4jw59gJLskFRVx0k&7oHbTUi&3nDlKF@OqA+HjkKzd zS5{t@3MXw>-y<2(_Lp2?T9cQ$qSc0*hnh4>MlIi8@$lDmrNFiVTK%VA+dHBO2vG}e zaB+%cI2|&z<7)29|M?6M0L|M~2*(-(<9g754`KtpeR6ET8I}lWY=haCAgGFEKq6J1 zFi>}4Osj+FWoBg^L@!^orR7C8STg>dZt!Bo1S~@}e9QziB3w40Vy@F^wa*MMv9f3$ ziI!P@TTj3Om|`|B?eRU!`=lk7YKgrZ;I*`+%VdJjgYgA2^BQnVU=;BTk$8b5^=lb6 zwDvJ$u6_7xL7(x&pa?Gevgz#qndK`pWVNetPmx1s$JM*I{01PaXDe>uJo_JcvA5!|RKFZ(yigUpgMLrBcKqpQ;`QO1 zxBsQL&+Ee9n|)Bm8?T+l0|$8YPTqkD)S>7_&Dx?eb^c z2fMjQV?3D6QiXA>PuY5JJdJTcN^R<${?FwD#IFB|L;29qWX9h%)3nr3Y-0uGR?Ie( zEjM{S1!*gSlJir!;ec&%O>TIzt{^B6Em{Y9!@23fa8^@!*ET&YO!||UAo5<9NlMSb zBq27Ljz(Yg(`#7|>sd{&Jb}Wv)I#wnOT{BB7HupSs|?gjEEx+FEinbGZ`oK$%o0n- zCKiv4EFWzxARAjka_$$d<<*zlij%nMD6R_1EmY}p=G*WaEkK^LI3{#bJ56#Wpn119 z+5rx&oxRl)t0|jtL-l=OU-f3_cSe84*F(&qM7lC&LxLd&QPwt2AhcGgjI%iPMf&N3~a`HEU_E$%AE)hoyGN0g3hmfY5? zA(t6;ceUeorvGNsfBCBYcIN`{(*;nQq}Hy0-uXb=ISa$(;|%_PNIU;36O{+nqD@y( zYuiwB$;$i{tEDTSUQ=l>*0XF=*YZo5z$$S? z7T?|7-9q+WN7pSBrkG_l2Osit>YOjBZ)tM+*QuLX?)ghE#$1YpjKkH*hX48P>j+CN zSnVSksciuSF}k0ym_XFVK1zuA(*(m1}iHS`ZoH8NRr_?_t zP|)6#Z-i#W$KbL0P9F)p!FM3NvP8T3vjcTNqu|R=X$)vUY6i(Bor{FY7*3wz1Gm*a zJFOQM5y5pzVhJf?u(ld%tv2k$^B76UJyQ&&!mP{s;+8BJV;N4>9ykaFGRr;{!BPKW zA1Zr9*-nAa17?!sh>AR|O#}i;ef z@_6dyCEA+`yQr_~b8C5Vmj{Zx=sudE~mSZO6HGbx7yc+eAn)_l_Svfb8}+nLsgI- z9=wJ+7^1NbMsfJ9;QqJOht`Th7@JRjYYxT$Iu6SX78EhqUIv?de9 z;o+A4#nWX?Mw(88HY}}iGOVZ`^YBQ}4MeWiK&h1j;US1rXweEiv?X}x=BuM&OiFUf zsgOYN%VQ#u#}I%XFVc~Leb;Kruk%bHcD$8*zHh-A0Fqn zD8rl3xEfx0IhgX2IW6HaH%3@2F=jpt)Y}pYxeY|dQ$ZtJhDd%CRPvgT$(ukYw?{~B z4Ys@nq;hL$}wQChC~OG#_`-%3o;|17R%{kOW4^goB06}BQL6L_<-j+IsL z;&^xotTe-Kts3z)PK@?&IV+CU+(%29Y9U#?4t+2(6eia2sM4{&kv5u#0+uB0gf^AD#5E^L16xoyps}vNJAhkUx*KY zG^~QU@M0DLwOZplDepqD0>Q<>^%Q5Y&gFsc7GvFA9PDn8#28vD?9XgQzZ5Q!%TzK> zP+a&ICPYrtYvohuf%{+o?|!y#USG%T`t=M6iTUd+bX&YG&DFmhzR}U3|91E$i(CA+ z!#C%gnM3I{NIw5|_@)qk%CGm%2cs}dUSAydj!uscW>LrGq+Qy#?fr<1FzB%~z;EkF`2&mxAUaFrC0~Mbs4uW$%y#U^sCXo`H6T~5H4$g1D^ThW= zyL62&>OcXc*Zn=+>IzAd2}cnIU{EZAFCbNKb%o@U|0hGqzM`b_>eYi7N7>ZfAx;-pW{}na(3wUF|VJRw^$ToFUCg zpBC_0H^M?)XP2)7bGk;ql?6ATV`c=vcIb6$BP=#ZgrAwjP<-eZD%j-kgqd0{0wN&} zigPRyfY+fDt)GE?0cQLf8|?1rAUFl951r_Trqm9j@jO7|aaO^FV~{hW;!E9t$tmW= z59UQ!6@;ecWko@FjN|!AlUI#Vz{=O@L9Kur^Y;jii{cRN-g*!ZP&Mk>SUK%<#m6t3 zC3UwVwI;O9=@&X^P^S&xMyS>PZZJ_*kf5NJuCoC0V^P85uUc?ailtD`Ztz^$lT0lj z)ql}O%bx~AzFKJ^UyE`IrM57N!0x09Ouc(*d)7hlWr#HamFPHNHO7dWa6EL)QVG;= zTo&hbiyN=KaNP{)dd^v-?*phOGDI|5gO9agYZpww6)}E| z<8WPY;!Qz{*IHXnm!N}N_n3mI1(}S%0KrOB_nb0KLcunOJ}#f1g%S-F0|zrWG!d1r zUcC#Tj7~(xV+=SMx-Tr0HAWSsix{Nk96*r`ZLonNce#zG=(nh|r^<Y zL)XU1%i$CaRrgS92a5fmO0VX9XwTv(V6@T~QV{p>qv}=vsk_`=@*ARVKX#Rtan<=8 zLgX>OMRD+w&|pR=sH00VOCEwy=kuQljo959Z?6S{o&C4QxmI9Ff7hO>%4YtqA-R`?c6;+w>u0*n`ys zih~&+Ob)ui+c)bR%Nxmae;`ev?DO1QOUP^aCZtij+dyGR+f*T0xP6UDe5WZqM@<2Q zXVB|av;`Y4npeO&iD;;$Xs|9wjtD?g1tLabnw=02t;TiEk3WWCZR;|3?mt?`G?CY| zQ5OS_pp$j`*q)%>5d6R4#jIZs_Ji|0BRbFt*FMP|i;?{sva1s@_k#fqm8AeIrU|10 zQr!jimFIHU{)UVfT?G3%8ZbmJWpM?5a&98?H)LA99qi|D)DZ?yy?{_y>5SL0vVCEC zA>@8T_G|qF`$1uOFQ@U(gE3KlDdDA%UUF-xSVo0=cW|(db*srK-u`U^>)eZD-9h^z zX4_B|9&YsOcA_|P=eCKbE(Nl-isYz;MioAH(_cC66l}AgS!g#@tM0eqe%`t-CW|B8 zT)q1LDzU%Y^S)@e;~-k&)t%?Xmj$OIm7iwOt=(6~dxC_xV?5e;@vZ&k=e+=*;-XmH z;8*_xca=j1wEB`j{1T19L?BXinT*r873Vu=u;fHxMATN0%x)_NkqfG{43KtWvLD7c;n|3H%o$B>XRBGEsTXA@$a)zU9? zj{O+l;yAd*Q*=uhFTAHk=*f?NJ5e$43Vtl_)F`O%B{{`JC1IF|1VzNVuQuc4AOHBr zFSK!@Dhap0P&X?t#Y)hFXuMb>!x>OS#auKG?`T!ft$bIfAh8#U~}!5F4yO%j+1? z8`0eUK~U!A0w#+KW?8$XC%&#Aa)iSe8DxZ|yF~*_?=Jz$S`JU5^S~aB3$Z%Mu_)Wu zRN%3VBGHBhG{IDk{Gg=J<2;~72r{8K8c8-%zj;Mb>e~>dUQiTzK?Iv6Ob}1jaR{Cb zkQ&;pV5mD~i4czNVpuGhLf?uWh=7MTtP!P*41N&>H{M9+0f=_=%qg0Y&=xr*SDEwW zY$~UCawMxtj3WUCvo^F`GZte+Z4q-XF{dc@fD}JwM^}F)w;qs^APJMx_C~OG3PT+p z0Cn+TNOVG;dqPBrDdL2AKnVuZtpIrnl569Yc;{PLE+vX2ClJ@U&*JhcK+21}$FovRAOryq{y4xp6Bd0oFHxdvvLtp6dLSK?-;=>A&IGn0% zV-H3oBgK#T@kvutpK(4U2H4LpB^Jd{k0lz7NsRp%rVvRyVVwM~4dL$TnUXkyYZ3y1 zMkMm#*a>5nMk5Hj3DMGuhg+2D|{xx=!mB=9%*yd2+~V@ zn7TT7_#TG}?bC~!WPv;{iAn|L9#iIr-9L}X^J1iQ=8p%bIi^}Da6crNauQB)G=iK8 z5DH`Q$1Vv* zqNUy0?mWd9MP5viBE%1+8iK~+5sD(Nl-T53|491Y7m|EBqBDvzDBZ&`Jnoox{lpTkPI-?8%)Qf9PPQh_J;V79Fii!_YCpno+FmRr01cpiv zM$H@7tRln@zX*`x!@|+Ao})G6?yU~ZeZ)tZch5aFD1vlv#6c1AVZwACYRphH8pmy8 zFt?Bys|}@oTppUDEKT1%IYO|ID4`A9p+2mlYr@26hG;rQp-egE?ng2 zydlJgMWa$=CnFM#0JPnQp~>kcQZQ0UmE8a7$t=2kx*m@g-I#mry+j{ZRCP^hLr<5%qy8h|GgO zyqGd3q#rt{SEdyRr}D}*2Lx&JoFBCK5yu3S+@jcre7hKVb028s*N0nshQiFk?FBJY zLa{%=O6Z@A`=evd2=$5_7LhUW%d%9c!eSEo5>8X6%9qhHVLtdii4kp|e{4I{$B@-t@Ua-urr|<75eLiEDDmArNx!9t zBPt2?$lNY4S2nMNvs(h?R-BJgog%nlA3TP9!X0l0Tj5+WergN=h^N4KUoM@ai81 zh1-jq8b8ijuZ*R>0JZrBdr0V*`Eb1Y2;b}_9M>jM-FKn(`XyKR=c=aS#vF!crxL8C z5)|bpx1<;N79pM0F7=9*EE=XIK+7Lc9E9$(+rqsf;TKY#j(y7(lMl0{LaIE`Zj_wi z)8Nd|{m7eoLO_fsYH^tq1$hvoxgW+9c8mEPR23dkCRGKG7_d`MV?kL{jZ?+nw9scHH*4PeXvc>551Y1@LKKH=J;bkbiFD6ZI zKrp?41l<^K&tia2L6XFLj69{u5BX>p;r`4(5&f|B?w}c$j7h@5){>yu{T!7d3_Uq) z$`pA~*RVp67ZiDss1UN5sw&_~2%Rqx5g|u+v2V_7uhKczDr#Uo{N0~Qm_Uk21NVU* zA9l58wU_+3AoJK|A67{QfUh8xXDq@V$TSj#l7v2tj;6$u&}E6kDJ6hM=@T)Y3=ZIe z`xTapq6kNzD%=tX;_+dS&}72#L|G_27$A22PnfP-4~}GyYFXi1!cwvBy0MMC;|(n$ z#1wJTF0%X&l}+r2aAV|&3^2wQaK9Q^UXGPM4@VO(Occ$u2@gpVXy*64rilj|KufY7 z(2>cF9*~j=_a2Z^lBRu0FY$+xT|JwJ$H*Jh(Oo^8R;j>!DZV&;QU%BPAyI_uaIHNv<0L&`-EGR|?Vz?Z$4vaBkS2LYA40!=Fh zXIG%9VNiAjnp&fYz#l%Gg1Z7ujl;4l(6nOB>0rF>4EXW%uUxsaO<7kr#rM zBE*k43A4|)toZ4N9!>^#k z;U~D{wpGex7mWJcf>E!Lz#}q46YLR95c=s?xnRGdQLj@HMV#!V_0m znHo<@s(ax*C`HF2fxV&!RKoc233_hK1EIEmSO26B)ecSZq=Akrj(HLd>bNr@Am!oM{s35!YS z38oMfF>*gJ{zW#=g~T&e(*zN!_L?v2SqD1D3<4`WG75Vae?6KaG4+HNAGW%Ra-NbX z!v37iil$VCBQ_oj?19^L7k%A0EDCR!VmZS12@_sOi8ucV@x7^#n2#pJBa={>Fdu}D zGClqb5-g|KA9_@Pws&`Gi7GEJTgvnZA8cneg8YDwQABZk&6o!lnopSrgr-n|mkP!e z5~K$tvCtEx!z+W(F7W?>;h_kMrlQ0P!G4A%@_`I8;W}*_fWKp$1uc27oC#$f$v!g{ zkumWrq^o`1aqAV|Jn?5Rkp*#ig4W=Z2bHBBtd(7|#)`3F(Fjq>q&ks(*x5jlGWU?= zTlWjNM9ug9P~*oz1JwASM=3gdSuEbHlNeoNKhlX<OZ*_M8ol{k(u1coZ#p9kbfuBOd{ zkr9{^6nhhUnJ4g}@Mbha|770L1f~m*Xo6!P!X8qT-?TnRuBzyrA6LFF$Mr7htL;ch zH1RG<~W zPP|<*XpKYmYum9w5`Bo--BO;HiNiv2jAkpv;Rczz7h|5`8Z4RVCBspl#pPdJJz7iq zXQ@n5IaF-Hpsyx=Suc_!Dj*B>$KPVL+|@(}!M}opGbl9}T#_07h+$Jp9Q{Dq-OEmQ z5d9#T-We}R)amvBZJ_*PR=ErwnNqja$3^|yPPZo@s}e_->@%9-QY-WONHS$5D!05M zQFFtz+T&Haw4rL*FFy{|FKm`DuuPQ+4znK>!TtPN{y~DP=w)$Fce;I!?qVEWW+LAY zl4Szj%TPZnKW$KY*sX`fJ`q|5-e!4osz3Y^OV%vbzDjBH4I~DZ3k~ zX!cHbsCJ~`wmj)I2(7H;Pa42#v7te>>U4)nWh)V*{_b=yRUO9ScU_k;`@Os!@`{b{ za8mvjSmiq1%dCuI>6PrK($h+prOJz)ZsT?+Z3A_*UCxv82j&Uxbg#6=)%gB`HU|Ab zIpydBi7~uiIw|yn5hOY4p8H7R3FG8&N#vOyQ5}L0RhoXRXZ1S?OZsn+@%+1m-K> zQP~YkUaVdP&9CZ9;V4VgE`O_B)E=6ETcvyis~bw2#+`kr#L#MQd#gy zZ)5Xlgw3-~_ZZ4NmDniL(o_PU2MHM56?8Oy!YA{w8iK=etFyP zP1~mN*KNzgZg9LbWe%oxF;nFZ%U&& zgI`BT{oLuEDa`wd{8hlRYBP5=F(6rq+#eU&FhjiY(aF&mvb%on$Ps zcwXU*#bBBS2~A^rH}qFS{Z`T(jKjj|nT=0ziZ+d9c@Xu#hX7OC+*N^K3!)<9nGmm# zl0gJv*h*f+q@3rqs<0MgEUGKEs54=sXRNE2G?_7U_GnyVjc5S z$&Cf#X1>EK;%OryXQz9~$z+0|W3zrfsxHdk%Uk4oHmfAs>DJ|vTnvE+Rmnd`yVMWM z#K9xc>1qMKtQMJ9wE#aVD@cEjxViO>vWfy;^+lwF@0`YlO7Dd_5S~^e){0T$R zhgi$=6+OPF`<=H8QCyw3tR>tZdiGSypL8lly`9O>P?|am39MQWEh-e|Pm~ZYI^Fk# ziPI8ZU(x9Tl%HnBituiJGTQ%S5WUxeb0Kb*fX_;;AWf&S z89XT3EvmYUNMTys=PX`Wo%Q0jnSfdqU=6@er+Y-jg(+xS7GXP&#Ky_%m7- z6hCt!C8nib)MSnB^zYD$3pvE9NiH&G5GWuA0_;ac_JbdkxR)>8vY3}IT-^j#6A8_x zt+dlmvd!A*g6IodvHY>3qM?3X6??N(1CS#Z51`7qGhkuk?OQ9yryA-*vD!u-it2Gy zY|Kj5sYgGdIITUqg`Yaz6I37MJfYbLd*x}&(s?`GQxuv*y(GaEDYmM?lu%CSIlCmRk&E>2yD131;eE2$NiyTdJQxz?*v1 z>7Fef2<7A8EG@mw(!%;w5jD(j74uZ}gwLDkwF3e7tuQ~RLP{acDSqLR?X z6aTm3QFi1Hb@<}B@m7}&Xw|sJg{D0n=U5)?6|s<+sG?wu7ljoC;os>F71~wv71R*8 zm%U(yr)B}v?aR57ivmxvUSVdI!kmNrf~(RI$3`IH7+)|ZYmYc%vXD;dLP&Nb!fk^H zt=nA8kJ`>scdC^d)*p2mT^!9$y{C2KfQ{?9dT~m$+jZhBx61pvcxrHv8;GJc_9pHV@C#5AmQRs0He#N4@++b7LWovv~^3nDJCNaM;`iOdsl zpunR}_X3YGhu6wWjb}eTqw^y-2tU_Dq|U(8o+Ryb%=dVTZb?-izs`OuJvPF;GPo|Z z%j9{mzOL^&#b%3?PA<4l&HiX*_*eQ&Mr-+tTC2$j)%ry3M9ag5^nPvXMeWz3lT&oR z;B20u`%&59e2VUCM=P`_j@Q!jM!#>lwX*QVXl@+0x0v4{8BRX~>_tgx&VC;$JPf1i z4?|QLH?8T55b1$i^FUtdf41huUFC;ea;>f7LfoorFkj4z{*7Wu=U$Gb4y|YJI2zCp zwo1jnV}5!f50O8Pm-W=)>N&tfrb+I68;;!)B_%oA_$B3dZ6&&PFy}||QnyBf3#8E& z->j7?y)$nvF(0Gm_U2LZ3)RKh@Rm`TH`06`Y46XE*2WN&jhzAK91f;L#Z{GCB-!tO z@L0KrbE~sVjup#au54V7SX+zjT17iyli#l@~M|YDJoohzrZ{?a%9?PYCJEttd z@uI^`d3Yd?Kh7ews(PjRr3l_ye5l2YJQ%CeApfxvt<~5>ck}m%Hww?-jH(LIy(q%b zIVZOS#G|Ud5MdC4vPZ3gM;{0-T<)93w}hplLP*KN3ePH}G&d}suMRqVRB)i0aAVJ` z3j}60WR}cKGN`;$>%IC$!#DJheyp4ZwYT&Tk0$C|Xn1+}@VjE+)ghX-p;(~VD(bJ2 z<-?OEbVZos>Y&AyL69vX8W--*OD$2Z_Gd3%qf1{a-=-@AvUjfD=i=&JBeJu#U$|8O z`6}P>!?EM7+{^2SH!cl2-?^%vk*j)DIOR$&_U5scU#ai=p$N)#-QAleVmwPXdAp!Q zt1k5gKlzh8+nd50x93rRCc%*p`1~IVVSM`Z9Dkz>HjS=)Ae-k86NgZ$lKt#lh$Y&e z*n8+oApxm=05z!><3tzARX=_7snQlcD}cXJlTyiL@E55f!`0iMTzRNZqrzs!r%b%9;A7l835>&RR)L<6kYQT<~XGO-fxV z=1>OS>I|%`3~5~GCxDpNa9cN)ZEP1t{0WJYf3YZTxGKt+3HeFY`m6J>SO!qHzLMdY zD#BN5T2$wIY$&m*A$M#_$d#Mbs>^k{KmMoa>zZXB$>Mppr1o3+wK5siifrXpD|;?_ zRmI8{+g56rX)SNr>^IdHE4@+iWK^qum0OAOky@*LRcluJ-wu|Wy;ljI^9z&QTZX32$Wn?+NPgXwyECJ%Szu^ z3Jo_wE4c?;$Euu(+C7%lQh`T}LUgUfiL*d*7WIl!6=g-VTEs%NRMAJ}G_P`9iBgM_ z_qSZ@A#YJV#>xd4RFkT2McZTG=lYkkk1l*L`__qq>#s4TG5po@+Q=9r`}~oDsabrk zepZc)F5Bo|SO!E7FRC+lNPe$0FVNwYhpB$o7MJW3tMf_|Z;}}5u;buhRIuM4%BbJf z186xgIJ~WZxz)8Z10jI02 z;b2(S8lG*}&LL~T3OTOviePB#N`6zEaUpqC@5nlcZKpeo*@@gBF1DRh(5u9lz%OO8DrVn0*y-}!WH&beTxQwfu;4Vyfiyea zn!uz5rIMak&u^&VP1a&%%Bph~d!HoL{yW{i3Vg^tmk{%?I`H_SfD5dIp5(vQCIkdM zV08J!ltBKTWIr$dxBw1UYg0c07B+v5Ot?AX8y8!KM4s2AK# zF|W_l9TI`I9AXQzRlB6Ox*kP>Loy~|mEou7QA-zA7A1$2gg}cc*<4!YrY;jb&52jz zEbkqbq~30et5Rtf7T0E7oO8peJ|`8!VE+q@Ao=v{R>aXZyc)pg)~ucoAz_iibqvzJ z{!$>PNCq4yj7uB^a!Q2lB@6+%l=Qtoig`N&t9e!Z)fvWrVW&DBe*?1UnO;%%2NBYdJ}{g02FoI7VU}>H8fBIb8^T-bS_PXQrzO1z*63^PBn))0M#^zy z*d`(~=4_^ICTNBO?X$7KWF-mN0-w-rCf$QSGRTsV1IdCZqEU>kPGUKA+Q!la zmI|X@&K$66m7CNKJ6BudiXefJ$)5*P-I+<(vJtZ{Bol$mdnyf^C@`HCxIsmm3-lP{P+^LDozbmSf|= zw_`~)xv*C3I=btiK(Y?*h@9HIxk{Ox77mo$P*wW9vf(T+RAd`lVCYjiLv){G6oDr` zfREZ1h;v-C7VJQNEJk!4OO#5w!a^B&X`rI|1Ipm+*M>v2tpG%=(Cuw8YSIR*^I04j zrfvspG$jbb2pB4?$--NZfGtf>j+|nF{7WEP;oo5XLImJ@NM~R$%D(yZ?BwaoPc359 zlrET&+{X}@Bx$W-8q6rW8fF$NZei9;xDuUYaR!X%!mo)rsNT=^e7Yvk)w0>sgv@Ty zK9Io#Szv64!xXa2gA90Ri;Hprkn^cGA&7~fn;FzjbH1yEsKi6qi;@Kj^;4Cbv&f^t z5p~3(1}n9}o<^N|YPPa|t3F$6>#zXSvT?29dldq~F^EulO0vkT3Y!)6RuE-sv?(7~;2>;rXn-Y_tD#0V z7SBGS&eBY2=r;>ooDME8j)UIi<-hlT3^bhFHjM=tq@7(yg_)ZMUTttRv9gu4fjEF9 zs;y2?h9GEt?PVWw!kv>9n0?#=U)JrVbyKNAx(Zkr!l`IM8Oy6}Te1|uyP#{DQrh!u z#ww0nJBx5@vBOQ~ZM$*8wZa6J=1!y#p07-9B+jN%Pu~nd9yCkAjvsIJXsOm}w;_L2 zK44k?sFjVdDJ!Zv6d)7Bw}Qcu2t>& zz&-+fCxbDwz^Sg(VaM}3gAiNj9&|OO%;0+*rV?*!8f);iHjba%b*PgRz;KD8NR_8X zvC`#0U$^YgsTC;KPE#n_ww0w@0?7@a;(4HhHM0Ot$&B|jKtYHEw$A>sT4V~(*TRhF zy_ceA7DixuR?iymTash_VOUqXuoxiKBr??5-wKyoh@8se+*&ZaqJJb22#!+Wtz?Swt1^pdbGf!{scrEnQsIpq{U2UuK5D*7C2lePiZBx)a=nhY$#Q} z%*{7u2WNjm`8x}VwMbm@l!8*a&RzRdMw_gFTQEhpIJm|jV`St!J+q~1q4u+TfXUqa zq>OWHmT)#BVw);oQT^14W6juTnls;*aBqQ0Q*Z``nL@#x zZQdhU$sZdEOUZ$;b+!QS+2A}6l5cIy-TCdeU?YVu2^uqq>|FEofqu)dAZ!1x4F>RgLg%9$Tl;cQyi4j=qCSa_UMCE0y-OA^9}KLupu?qW11Kxy@_ISx&Dt zlbL1ez^NlKMbsKgD6X0FMW&_n0m1vJqn)#l1_~cs%dItcO{TKg<2YASw#;fFuiNAC zeEYh!3$=@LR1ji@WIH@t-mpvI^BVZJz_6+_Z)2CTc)rXNZY#mCS|QcO zlx3gDoef)MPaSVtb$Qmqt!z0xw|igM4!;pZryAgJiVnZCVS*Zd>K%Ufy<6TEiZgF#Z|P#pw$8t%0@7RM%ic-RSmb)E zyxGrK&?%9}#tgf4L%1n%*;s7X1h-`=rxu21?c}Og zo44bWG@UO4iST1rgWYR;w(IUsamMDve|Z5van zdM;b1GJD(BLLZ!jw_D`J5-0|At&r2U%#PK&06b}1-B}t4VjU2xb>~TcVLz{?lo`ef zQ|Z%l_4kOIkX#E4{r%{|q&{zVFZCiQ^^Ex3axx~$zO(J9V+GoM!cg=fZU?Bab|5PB zn_Xeb2dIKDP*el-SU~c&#%qXTOQM$!MSz6y#v*QN8Wl)6fe{fB#a6&v6`xrpOB;ua z>N#UEXJji=nC}dTowm9q!A!H&t@xfWQLYkgBhaGMeQk-pADj*C@U*p+Xq6Mlvu+3F zx`|M=Z)&ea5c>+>$)cF7Wp}Et*aa9c-`FY|gvy5=MDN=rWv@F`&~2V`ohL{wEk6^JsatGEVb)2n5Zul3|`}y(TNBovyy9<+a9)< zsstFQwc7v%HXzy0sJ*nl`3@bIYcscECd0#bXviQn#1i$wKWxwh_#uy~Yk$ z+Cm28Hre?J#a57RRli$j=ma^DtyF-H60MYH-v(n~&$c4pYfJgIg!@wznxGmh!Lnoq zj+@h7e{0-K3B|TE4b@evv0c^oKsNj*Bf2uD4X*ylxII&`>OKGo7A_^4&aMj!IIGpd zv5{a%tuhDQyJL<;AgF9RR8dQNrW$#E9?lFg7OH<~F|-$gYG7A_r$*u}O0jR-xO27z zuZ@0hd+YQpwJ~RBrR;eW2UnC-Ax<(Qq@BAUGi7htqMBCi`4C z=sAl?INuUvY?6OANYr-&lq9j06S2IuOA$v@ zf+n%0ARZM*dSsNI)9AYG$?g7v|u8Jl6pp+?wf7=Nc)~cSqeUT1Tbr<+cGF&UTkBGqy(6 zOXY3!?$jl3j8W{*>ay4m8N|&p3JD^7o>>G1Q$2|wL{!(c9gi`99;s1VI!sMJ|GN0& zLc7`z_2FI^=BD9=N%Gr`94 zz*Kt&3)O%MGMP&88Z3+=K_M2eCAw~u!}kCzGn=C?3F2smCFbJgi~QyNtjUYcuMHjC z5E|{h3uqe0iw_eHMn8oj{jO;t?ul@UXQ=t%`a}58!h_uAC2xf+PG=Oz{Ic=sPGt(izX%6?}}O)1d>IV zC;$dfq}X=<_xD6zBddAm<8l3CFK_)?MFt~>)kY;xZl zz$lv=Z3q-P zhF9>YC~2Z4GRDFInKsVU8!ag|v?+Ba#-_uxR+5`_4mZ9Y<>gu3R12l#BNpltg94-V-%JG9IU6#-=`(ASahZ{FCz|OqLNcY~p(O^dAgtEH#hK+=1HImr| z@1C>?+)rc#1IDlj^7%K!s6e-TsgM-OIRQLL_5djI9F4OX?$VbylD)4MgF{Tw-ES@{ zn&XuXULoEC$8Ia%_+Q*ExT$=zAF*ZNsL6N!g|`mx_G1oSRknHCkun{nfiIHu3c_GY z>3alfmk-*NHJAG?jXGyvf<8DbgU0+X^jx+(V=GlPsp+j<=cy4#&^dR@q_}PK_L#J@ zVw}e(I42q=o+6S!iNA>VL)uItIzqOWzPp_zZA(<^*V&`%Iy1kmGkBd5y5yKpd)`Rl z7*e{+{b{UycWG!{jG$FJVW;FP?+Dm1h3Ej$;6 zD5q&^nxzN``T2}~0L>(C7t&T9;5zIH;OiSr+p6+qa-9vFpUR9M@nc+N7h^l}!MTIA zOa-5hW<%OfI>K)gV>sx6{lU>NGvHw~1Crd_7mn63+A5?d2x2LYJSQdCJIq0`AO!}A z8qOBLJ4SJt0WY<&OwGeMhL&UCe2OKrI$Zf-5_7Ex#L7YE`;Ec%mAB-WZ6vTX}b|Z<|u;6 zNt%?4@>66`qAmD0Q8f=KxH)Kkp!a;QFK2zK-MFgH%W0AqC&SPlzYd2cDI)@fMP&t} z%Ur40>lqBLbb1?c4>}=fRc7t`>X@{Egp=L-0~9=<<)G@&f|%F78cwR8Q#axY?2lD3 z8@ZkDn>?93Xfr!ngE6ugRW}FahkW#DYv{0-)vU;vlO;XGXo5cV{E?R(X)coVdvdVZ zb2`_kHm{M*$>w@Q{cH^X8n%kYcmya4GGReev{~c06}2;f#e{Q&CaMBaN>wQGG_PiG zwJyf6fM4cCCKKC@3r-6~p{(I;)Yi!jysa)Q#-4_4$uuGhUb7PRj6UIPoF`xuQi(=J zXzesB@^Xwx3s}Zr&I0i)KYCY19a+#&N?Qp;1duP?$Zla^yaa{b?H)FwuE5}1 z7iUr6$gPXDDZEOGv?{@T@-{E8#sELc%Pa95t{NmB(H$_gtVS^GZ8gTe3nxlBe(=6G z@!_Z@zk<|BcR51SUd@UEGOJvQv3!X3y)LTrqyQv_q!?%#nmaoaErLQXurds9Te-cC zqZGVuk}|6op9+4W%3W+e_=7T~X7N!D5j8t=UW|5%*m{Brl21y>Ge)Di>ai&6i3c4p zT03~R7rQc#jkt&ps&qufVK1mHEDj|RApb_)s2Hf=uziYd&U`sn2*PQ!c8`~>TQpnc z>@MB-xC?oZsU}r9HZ&ns@?jxU^FjedF8bU(%$|yM25W}LYmG6gzIQ@( zkc<_rwb)H){Ns_Ax!}y?)@Y3uG>A~=7HDdhw~eI5*mM6npn79ITrbeq!s%r}Msu<_ zxlDGR{y0L@PTuV9JpFNzcZ`$E6q=Cf;0HnviVm`WnOgN>I8luE{TThXwEn!Dv| z`KUn6O$7Sbq-rEi%7{$@jKgu_B*4OXupd}!V_pgbbmK@3qlU7FYuQl)?^$(Hj5Thx zD1ey+*FGHm96wNd6@bM8&Od6F$6ytCc}?0bpTJ2t@=8<<{g98jAO(`WXr*dm)r{Jz z**MMmu<$mGgUh!k!1xaK7n|{UubNUz+DPdkg>IxKL+wiL2&XHiGeOWNLrkKH0|LL(v}jk3Cw^hJ*f%eL|oP^AtbkH#2gWR_`# zB3JQb9gDVVu>~;3$Z^pR)1r~$cOX)Suc+>UnkRRuQO4}S_CQ(k0!Hq^8u^#385h^& zFZ;(xNemk9#xZ|D`1?_lU*`}jILbgO={(pzo6$tBhUd^|maNI7Az(=wC(D?S{s3e5 z?)+~c`g#;6MIn39jXJ7|aZ;ax;0G8a@L-1!*tyo&9dgQxC06tDireUt&?xH*FpDf` zv5neF5o2AW4Q0U^W=hJW$*VCmOD=lhO&SR}=R^n08UI!z3S7Y5%mf2^h-(f{Z#i1% z1i$Hs6g51-)6umEh~Brk2w$D=92|B`Q(9He3DET zI;~H355Ju${-IvLj`iW_=ZCRmjNzd|1wYsgf0XzNF8iUZO=I}K?dztd2einH+qwrE zJIkpS!gR)H>tNs7XpPA>z!Kwy_}q@x`XR2ji)%SWN?h=B8TJ8Tz=_o7aUwEuj&7HO zGT&B7_No|`C24Ln5|AsR`Gq;IsFKWpFta*hw6>;6F;XBAi+HDrx%A}mD(IGtaSlDw zc1bac9|dja@T^_)w$jMAE*r9tA(RKff})8QoqHg!+QX!rT_kBYYe+LjEI$%&Ow$(! z?@q>P)52!ss4W3Rw_yM{ck$j-=|fXijsVOUalY{ujSFeW%UJYUqAq)rgX~4pjKstWt1_LD0Jg%O14|ZnT z4X9*^4dJ)|cP?mbQx)Sy6*=O>XnLKh01&nMa?u;oe$pk(jy?{u0u#OPR#7a>g?kxN z0M3Ov(vO=7;mvHClp766vgEvA3GElL2=~kO7*f5oUGW95RR+bC-6y7V z)#Q`Bq#Z%Q=OMWOuSwKWWBLfA&I>pg;|vwTqk|(jI{{!_+&>`K&^TzZ?Vp>x>qt5N zo%ebiCyV5aXcbj5=Lm zjzWP8*H@u+V}XiuFiFuiuN8O^(2H{+!pyDjKz0UZ`qgt$j{-ux@W8-@fe#;4DRUlk!s$q$K@ACw^Oj?%fH>IVIfbg6=hz?0ZqNxfA zz8KeI0F;v?TaQ<4$&%{HmGLXi{ z2>mWcZ5)VyxW-i(?80*)eB2wxtt)r?lvikkP%>%?93Npvj2*W;QokcoCS$zWy<32D z1NVSi*o=HP8{_K#4&^gRis(a`>&ah)5;D%N&r!}tKoAXpU`Rak#UdGw_+V~jm8cr| z=H|3;P(y1qE62b(=jAT=@liGxM32|11q7Il_gD(ysL*j$c~lj7I!>r9T6q#UR1_Q4 zwA?7E>td9n%xvKzhHH_n%PR;y95EAwC_-kKTzJGZEC1z}x=27t7<7csk8Y*Jt8wHl zXNZR29XDR{hFY)gn7T!_WDcWH={iiwX7WOa!4Ag;)`IAvF4!BI35!^ z4mt~u1;xrDc)C!RLuU_+(A<1dCI!cxT%Z{NPOzjH3wM&WN@o9Ae7iwUyVbi10A-fgi!q=Y*cT4;OECnKao=(u|>^(E|8H9qDGyrL%XQ zs^Ku5S_{VyO&@N1o=Y1wqUxN9gIEPdXd+EsMk6$2_VsZvEonhK7DW1AEFR!;bYOQU zPB?{@9nbwtq-Ys+|Ad4d4|3o`>{61KBPG|d?V715&)LwVAk7%jXv!Wk+FLocxq$k% z#R0%X6dq5gPEUN5qx%o^=-5arh?ZrOxw#e3m~BNRwGre-JSS0>Ur?mzj`o_jn_Qni z+aE1D+dDfOkGD6r9oY-zC>-W#Q?=Da zx5=Mt;KA*nZ1c%w*KUE2YFj5MX}3BEHgYV{m7)T;23F*!I%$$A=}6PAtxDz%L9!Zu zb_lr2%WUOYRL+XR{;_W04U^^*c;=djD{Xp7riuH<`Ma=h;z96@hbyg$*|daee)^jI z{k5 z(;Xwqp$)YGxZ!>gxAG61!rKMY9nZVm+&&#j{FYAo077^qP0>!Dk?jA zJZj?>_cmp;b)1K(k^JiNY@zAumZ&XXGg?d3mWM!X;rG%}T>X)gKShG%Vc9eSrK`lP z82*XdN}nCaZ0o2o0ghOJk_T7HjODC1V4Ssf%L;jCqYqKiq?b7u zv}WKZP-f8up%ob;jb=S#j~@$q4%j>TFa|CSy&=C&I&zcTj=eIap_~>fCo5!Zxk*L{ zNZ%)QQQd;)*vLwn4N#iNq6I+RI1bw~A=1gL2IN;zgB-8j4+^NXATT9b9`&3ZDXXY_HYe$fIw(??+1wsQ*7Ok|Xr@U%Ms7eVS8hD6 z_W-IIfL}h3tb=EgCB)7Eh#h)K<8M2#!7X6Bp^!WLa;ORxhx^DeF%)>`Z8gcu#W*1G zQpC%@ovST_9g3y|3{mZ6UVo3!N%DwTD27ti zc5m`5BjYJG790a@RNh9Hv|Q$+T0;C?5nbnPex4V3HwJoA)pj4c^xefpOGZIYe!nMB z*P#S+io#F7R3-ThVF~?K;DVyH{DSFYDZE6FVC|(zCQ8!1{8Cr#IQRCqBJ&(IO_ZdI z2rq2p2$wj<5!d_=(i*Lf#n)h%L~F*Gl>fi$$#-z-qs=$F#B zc{%%XLdv#k4y$aGFCaIPd5B3FG8$Pt{cZc+~#njj(u zWilbzZauE;hhIM7Gh`;9Wg1)KxaP@2;&VR!x(4p5q%Kp^CE(*6CFj+w8?!C>gn66q zRnxj4Jg{~AgN{8+PDSbTyh}wDmS}X}0~#IGQx*qA_jA>a^X$k_=%Nzj!y8;umKDob z+K#^b-nHZA0$cPE@UC5C1n1&fwFC_OE&v0U=yKmIx?Gj*s(p2gZ5&xh>nhWCagWEv zD9wZyri1#)D9&rwPfYhUqtzp~>c??f_2WafYNXddA==%fQCjnGFD;|BX#91=0R5D2 z*+N=1`Z{`mR=rKm$vCi+O!7mtX#ohK3u*-o03V?#sQRTS27wC0?oE+@;H7yK)YB^C zsBs+8ZLvcpK;jY(Cx^p5MjB4)vT&0BGDa&8$+T*~@0J!4wfQe*Ml3C+VeN;VtskF6 z=Xp1R8^|I&jgzA2_ck6$`*;}O(1pcp{-*InDMIC_(G7b5@>6yUeG*Ed_6_NSJl?!K zCfO_{*{fMeLn;#RFC6JH(Ch5j%u3qc91>m7>O>c~KJ@W$jHVYPX$kdS9m6S$`rR6e zG(f%ppc*6|hQj%S#yCz{$6W&xc9hh0AQxulF-eMuLRcM>wyw&S=wmkuYHXeqqXqIa zU^+PI^P~_4RqBTeumoEpBI0p0+$6oC?|P%Z7gB#nf&L-kZI{;DV%Px^6=>+*6^R5yEA_*mgblMmvQN!jsz{(x5RQ(Bd2(yevL6=Vz_2}t#yuP}z zy1tsFtMnhyjJ^ngqg^>!<3harlyyJp5)MOCHB1U-$neh)%S|BZhy1cnF7lE(#y#Nz zBgCyU?;XjWi(_}^@z(ol?CiJ`3T}!9?T5|n&25d6Uo=eF-s*jp3tP=0D2}-RS|F|r zJw)$FDMLt*i(f8wG009lSm@0y1w1RF2PEq3-A4)cq6-ao`#(3fA8$Z%w4B@^(z(%a zh34OGY1LDeK`O?b5po4GE>|t`U!Y6S&pvEi7*1B74>fZTZc(= zl~p$!k)1@JaE0{Bd|tcky1IR~wRLlIvzY=N9FSLJGp(juF&N;hn>NbJ31R7lifYoT zYo6KCyzHt-)-XDOiy?%JMeh;XG=@$pcs=?gL2|||P?FL@ zDc17*<$(r5i=zLaTFQnpP^!WxdN-7_m$c*#<)px-#L++Fb&8qw>Eo;bBxX8-`CWv! zb=4KHbEpEYb(!(tiIuk$$5Y}c*(|P=C;ZZAgJzHg#x=RSD!L$DdPW^~X|IHRiR z+Gv08cmt4YGqF;jc(Ac{O;Wbfy{-i$b(((V?=#ZCQx*WKH?uODLaH)yaRHO0?26mX z=$Krv>%%9r9$E*^+1+(AAzR5#@*fxJHrYb78&xvvE_YZf=s?6&wWk$B9)g?3wnI}r z{E4;ZJ?y(e_rZH6U0V($agEys1h;|Sr=)B0R21>P>XIU&(%HTQ(VY3U3le;#AQQq5 z3EZ8O_ig36>8?OmK;3Qw%`vpl^}95HuE{$#0C?xEKP~V6sxSA;J2pY_&)E*OQQu!< zU?09?J1Fa%O+XO)_fdPi72n>m8M=%)+hd#s&X#F6HGMm169_PwV?Quo@JJUi879u2 z+9VvU`FnVgpO(=-Be;b{kGJO@rolC&D|wCzs#Uz0`svGjU?q(ux|o{EH9WAAY7s7` ze)cLISW(yN3RO9<(%?1*t{;O|Svkj%P8lH52<{ojeDmo!MNi9r^2Ze|u}AdBD4A4i zk9RI(plD~)Y0`kl6MemY9!--kYZ^nW1m!J+3r*|pmXgGCkEWx|=-j+plkt-ME?R7! zuy<>=wF!I|Z4V|88q#dMt$Y_Pb{^h$YrA`=T6ix6Hb4PteVuo=drjVf_sEdFP*}j; zB&}xbYv(9CxlZze@Bel}rj@)s;)b_p(M3|U#2AAW_F%j6EP9N8(8qkGCe1XbNV|@V zP%8~#DKMoIgd-c1D~pt{=gngTbiK9U>hX+A@5z^rd3hxe9h60XhGB^iVZ{8f{yxiT ze!cZT{kTk_9{*WX#>v#CRXu=AlzbHGSx$Qcb>}&xoG(Eu4N0;f0az(|WB}|4)i&rf zng7*9pO>&Ir~$PdIvcc2gxL|Ice`LmpoWUQ0*o1SEKi_|-7~?^n;ty^RsiSVq37+R zN9)m}N4s@RZzKFKsy(oO(_@wWQyn$zZ@LGwf1U^{lcs;=z^TnEYV|mNdGa2bV88B} zJs4Pl;Lp^|7~XbA>OrcOvLW*v1Xyu&n!p@8G%DDWX3afmrFCD}kKMCQS>}DyUp>sQ z1>H3{xn{8;C z5Zj7ms*t^*zGVU+dzC13^R#?-4p_ikHY@&MA6MptqzzzQ3hOqormBLn5Ge!$xie=d z_j9l#6Qb*Vc%h^6ssez)F3G{+4$l}coi=R9z~B!Zfje?t_1(JNdFxTl++-VJz6AbH z%GCOP)>YuBsqB`Myt|y8Q(NWkFSCZQ|GOdP_ttq)oo`JOfYjR(PqytA>id7&*?vWB zpZ~VA{j$txaKyjuY#%ih-wd|kr2e;^ZFN{<_T8g{vox)@j$iKXAHLk2X7QMVNZK}; zkQYhwHN)8Pqw>)s(IL{0@`ueQo7;3;Ag6HSwq}3aiCCJ-&FF{?*9`ubrL2$Yqyf(r z*awsHHX>hg_VmMT)|=5Qhh2DGAMsf|X_Aa^(1uT-tu1uKeom)Dyk+(}Z706IRe|ln}B(Z*b@7&dT zJ9d!rKWr8C@5h7WXcOb0yr{S$5?YOer-)NC0XV2D zG&Be)1O0;P@o-Os5j!UlDM3fcHlsthZ9{k+y+lSgc~L}FS=>g+#RVPjOB$XW zL)?AX(Y@k#zx&^GQ5hSRp8fH5XwyHMz zBU51Lg`=gvU6EUQzi;V|%H%5=rU$Wk#2m9L@MqHIQg<0WdIUBnumhwiY1?P_ZC}`o zKAjL&0nHnOI){^_;qD&{%WU`P!1C#swHrJ4=-A=&Szh2o1Y_TM_2s_jp*(}s$$7&kTG01v3Xe;WO z0}GiV3pk}-QWS-RdrU_O%oKVqu!uH*iO5@DF3jlBqk}1IQc2l8dh{&%(2^+2FD?iT zu%fa^OK;JH9)Z;~$;-{?eZ?=@QBtbAwUWC|@8UGD2O>&Xov5t_G*7yrr40do36-S? zsrZJ_sT?JmRL)NU`HC!ps0Jh}iAr)qKT@gePbTs=e<CK&advoVOdh>^QtNFu&RP)DqtNG)gYW9)%j1qnoh?yzS z#zi(Ko9ofz?IGLNT>8duK;y)3B=c*VLg7#9+^Ox)p?J=kVvbXVoBoy>=OQ&uP{QCo zMqfj#3;S9u^SXgHMiH)?BroW_wSeT2d?ohHnj!0Ssk;T2wX|Eeb1W)mjUX8?59J+C zVRJZL&UpYawrC?dk`YZ23z&L{^V9aIoU=JB;9?^>C{udV0}B&FLZX3958Ni~E;(nz z6l=5*iHA{@e*K|a#yukEY!u~+HX@$AMCDb7nOHTq58Nor)p5?|8T`>kq%4Uz4DL3% z$f=#YeNbf(nbWDSO#xpwH-}gWT#sM?4bvT?e9_`GYgQcmS=yZFB9OKMyH(8NjD0b>ie8rCf9k@sMinmRQuDP z-csK~3J)QL@(TzD^UkR=D}V8$m3a2uc;f!`uYWx)ogJ?Q#GIDENUvgh6nF7?L|u;8 z;&t{Dg*k&Xs1P-imuq|UX-C0;2|AH2l?T`O$PSY)C*+z?e;Gz8{)|t{^V?`wjKo29 zTK@H~f4w({$w1^x4!$>5+)jI#bm`?uMYm5Q6yn$K0L6!M>o80PjM9AYKE3!pkMAAd zM`T1Cg1b{E@J7mkp2(Mulu)~4?&ooktqGTpgKTYeXkAv(Odp0DQ1gEc!jyy09b%XVqAt}bm4U}5DyJCPlB|eC5@{I&Mj4ARa2$U zbfYDaX_6OKmFQOt{bdx!@m~5%i}tFfuGnPtmCS|x_f*bI%g(>jjO3rBJlHlpu@3w-o7jKx%>^BJOcKS0Uw$N z4&G7Gp7ePbu-$#Frj<+&rM*{hJ5kY}!fO?CfESgRSJtle`<4PhYFi@xvWe0*BoJ*x zT`1Xa?bgor{NDYHN zhO&Z5(8tEbUtxC|Vt)!f9C++eR*gIco%!uk!OD2-Rd=yl-N}A6 z)Q)v$dzNgyrQC%Nxxh{=w&GRKnqOUydUoSghr``!WaMSQ(y?B+8pqMFP56h6?VZs! zVSVdzp}^hI8spk|30y&YfDak z_N!mU>n15#qFJd;ogsf657+zZifH#KIdyRjm~Kr~2o?ys)d8QsGMd;oB+0_>n7e68 zYFa$a%F9N43rr^7(0G0>ZHN|Q#xEN;H#ZxADzhB zc{-83I&X0-9P#J%j=w`;FFPdNWku)L>zD66bO3JnHlOC*pN>vI2kxQr-^w{9xlW3i zSfl>5L+K?+uV?~U>K#zr{`r!WPj>!u&b&q|8I>Zd~`njxJ_RT>` zRY0Hg`M=0r{x2KHq8~Tt{|)=utT31(79-G+3Go4c^!Y@sG;n-Uc%i#g^;mK*th%lH z5;&l$U30q&t}=t``k~CffEU6EfftsLo2%EW=+`+XE#REpo^-INCJrc0L^*58F?7be zMzu`sj(#^PXN}zT!Pb|9@-Sy->!-ZbHzP!~8h_gU?A>@MA#~^~*~PcFx3?RIhZ|Y; z{>__b)9JIe{lC8L2%1S9O;(;oPkn0LlvK0spcF&)Ec(xF&o0<|l7x9X?dbpj_ z(N00fc3@@e1dBbMD>61#Eck@+V_&>(U=wnZ{{n^K{G&Fe@Fv1|TIbVq8@#GgqEKJ=aoGx^f>z!e3KcBlqba;R2x#?U20M>}vFDQDaE zC}{xb=cm833no<+qJKiRD6q#vm`?PZ!4sar6j*~>N~{xbq?qUM?@z1p!|LbgpV9Q1 ze5rLr8O8gdDb8qJ-q5-*3EYzRmAMOjW5(YzsHNs2pZL*)_5SqlHtl6KE3*IWy<==H zaTm8++qP})+PuqM@7lKQ?sC_*?%K9(+ugO@U7tQLa?Y2Nyg6UblT7BrWHQNQCjZH- z>sr61a!849TD#{V3=BIP(a$Fzcr3y%rr^UkEOe(PlJ{(F=Fc7G4_o%Zo@&!r!z&iq zk&hy(1|Y8#_ed7zXv-6#4Rh*rd}<+jSDqoyHuq@#?QU3>-#~eNS>fAZgRu-rFX9w5L-IpQ8SmxX^~RfAf#-ONH)p)^$6LA*!g2e?XkNnTtL@%yKhO;g&B}A}qbT zCD)$4HxXo`#)qUkm-j$V4R_FG=G+hg#r1*@44XI^#ib(x5-kVg?Ulosc0@azoh#0! z79vpRyBZ|myek{&p+Zqg%pdXnE5A-34ISVwSr!4#3dm=`${;hEPOVY{DSJc**!gT< zp$Hfn`NyVCvEH7g7dR8OzkNi-+)n*>y5kquhaE{5k%t|N&-Y9c@v;XE7;opVw|8n* zFLZ~w!4^zR`b7^!-{Hn%)xWxB81;)%YLq85%C0}v;F1as3m3ZtWGuH{rg{LZ(Z2)% zj*y-&WKBNt{fSmDWTs4mhf#}n660-OO!~kh?|7|lG2e;npP(dr-X5X*^QkpIcaG^* zQA}SuJVVf!1$UmyrQlp|XqvMShuk%4lsqFTAeyH7ahoe)o#16ScJNLQDh250*_n zK(^HVyLhV?>BG&y)L2#ZREB|KKX5}8UmmjSy(u{CI-k~8LE`FHl?Xqs8jW@Bxt9Bo zA(ad!{hE{-jfs_to!)ayStf*Zp5kLq0NaZpu56R|KX`d@4${;*Rj*hE<1!PC@15U3 zovOsVn>iz?=}DOk>K5Ug;`qOmxcAopIU=ORYxDp7zEOpc;X~^=QAArXv3&WV-=W$l zN4Tupf|W@{(wyQC!Vs(w_0@=wr<1il6k+baHHtz|jkucxpm2TIk38KtswV*f)AvEc zjf_<&6BOXzTMsO~xVDBasI1-^Y4zh!ccT=;C2AjSMDfu)QU3GjJP~P!k!9>Z#0~Nk zrpB*%x5z!@vQl`9NYh4VP}LirZBKh$S)cEshwkB<>02X4pf^y`*N+PlkBn!iyYS$ zR4*eHw^VQ17%s|*7-rYT9ANI#Wo-%Z8A+ON)r&jk-GLaRMx6C)7DvLvDyUPaMM0ho z{?#Tx`OHqNt>4Y98i089Ls^ej-uw|42z1(@O;KQk-Q5-2**_X_A0jCs8^JZ7f+>g9 z0n~sfH-oD8?jl+7302u18-+x+^f+4Dj;VuGO)(OE#;>Za^)CGijN6wKFJU$weY@7Ud+En`ZJ|M3jFy05U z;Xdl-Z)PAWmV*u98uZPcy5eBsb$p2KFoh-$KP zKKF8aVih%(iEHRBWzv>=-5Z#yibHE7eLE9-pDDV4aM?`tqyX(?_XLk57edSNkIte~ zvt5Qc@#}1YZlUIgE7fIK%e}$}s)(FmuUAMi;EYy^#7SiZi4C4$mFvxVZRpuN-aAL7 zmxH{KhHmT3IH7fa+i_Kxc|RnTVCHO+N34Bh3H^BqeF^<-I|gcv)N~tmoUA8L5yt3O z=oRm!0-xAsrl{~JXtdpc{5F6EP$2V?Cu@w$+g0=)AY%xuZR0t4 zK+8k+BpZ!BplWk{1WCTQ!q>Onvb|qg*Hj!ixeh+EiWbNmG2-Fjg;~AnmDM^SZPa4S z`SrF&l#r@F`ajg1vFD)f1lLgSvH`y}q6V(jK-bl;7m9rX)LI`~NIxnJefy=3aO54Epv)SI*TT~zJN8nwK%gx*%){3Ecm zmR`Y24Ya8^VtO>p(pRh4Wh#QQ*!r~dce4HY&|y4ac*N{I!2>{NVVI0Ws-}-YGW_GQ zZozQ0JUO;P?gml7y1Own!F-^m7iVDU0b=vRJ)SRy?2AJ-BSbGb;Q3(cYI=bf8uQGE zK(F#FFZGauIjm{H1WzyPSJ#^wuf`1TzfkOQWcW@4&xyg~wy7hgyRc6;B&LNvuFjvn zR0vE9X83x*4A{+}ea71e=T8SF_drDg$o>yO+J=_=vR4eu-zQtY`CTyzs^9JJ@5Z&K zV@nCLhjbTXJ4<)FBcEAj+zz$ravpc_eP?jqLZ{h9yRV)fnrg7Kdukg%E6Wy>P(Bc1 z_a#2zIm7n!Y+zPF3qP8JQFlAW1ugkLxf#2yv}89vHtR;%v;Q4GUsQ-75Mef(+%Ay_ zmby1o&H;9~0Bb>~oWVQN8&>dT0OZ6Z_UxZ;$9q>fnLpvoU7)3M@XIrrF6gui>sOxzwFQNdqzr1v>%#lYJQ1LbAsNJZssMXRCZNSoh{slTOkCT zKr-Pi>Vd3S4B35}*DjEs*}Af0qi^{j15##+op0v^9^?hvvZA8wBEKvDho=P5QHm3J zo*MVmT8;_jVcmo)GrDZI!w@e7NrUj9etox|^18v}0D7)jKI|?HKFina$DVywRDOqD zSeMbnVWduqb|UmDKc^SCLg?1VoN!Q7r{2krn;e8aV{2R8gLReWY6nhJL=GWgeojOhM?+Vhz&=KEna)3d#X~1)`r~uLiy)qR z(o1W%_*9K`c5ZrO6=vh`fd%_>cse_iDl7VYh@c*AY+@K4nz zd1v@N250@eYvZg38lS9&25!5~@5~_S`A1mP!zyR^L6fU8#>wA4X=+%7aT6|J$@iv5lu0D77HfSd@$+mac7gXE$0jnCUh zEQJVohFbt*n>;0#lNo~s?Rysvvu!@lCjWObOW1wIn(2gs zUjrtUIgNjj(s52IBOf0!NKF<9+Sp;`MVhvlIsW|(k;-vb6HDk%n2P|}YfxahK5{Kx zq^MC7dHWtJuoizr1{gcnL=vGyEQ_L`G|v(sq2|jBSXLC+SN|p+}`&_czZ0@C>j7f`eb{Z@~08B#A~Z$kU`(oDu-(`6~tgJRWU|(`+|= z{@P0I^~Ld}nskhW9Az1)kcE2#En+M@5;wKjqzzqtX?4zv46BZdByJM6nW;&5I%Nhkk#^K2_Ng5(k9tWYwd>^1(1^a+M z`~u4%Uc$*+WB&w?H&{$+_dC-dPV1xBXa^KB@Jy>KJAZ-PaRAa&g5XL>;@uB494Q82 zlc0G)6>*8y05%OiG>I$ic`6@N{yoQ) z`i-oB9i=6N_ZCaJ63Ef&Qm9jBihWQ!9+dTOx|tT|VC%QrDXirkaCg^MI%(J{5sno4 zv~io=D!&d6Y|;R!ZKzimq_sKqJ5w5u=^5I_En+#}~vF%V3i)E_mL{W(~`2AO?#$~9C8D8QxaCn%|1f|#|{+S6)$XF47QrAHG zGO$GP!iJ6!!}&R8cvEH8@b0j*opj1CadT1|=_px+)fR?!W1`%8hgt);$n7^32&zyBs>iodeA={BkJQ3s#Ah~K_GT*yY1%t*bG=wwmIjYs?hY#+U)ImOQX1 zR8dn+gv1#=YM1W#$ipx}#mVbXQ@T!si$$4(OL3{tPSJIii-K2l@zMhAjhJ7-!q7*7 z0Vdd+DF>(@pv%NOuwCNf6nIc3;4cnUa1|kmZiMvhCMCWv&ZHb7O;?|?ZH4p0G8W`z z2B`+n!XA#+f|}P#@5Qsy7KO8w8RCQ6Ug~ajT(*@amj_q63A0+@LbN5pfu%|%Tw+W7 z$^g(nAY^j|zVt)I@dcG8Z?GeK<4l=mEZ!{G$y%L+2GTDNQN&`w!r`Zw&W?HR08?K$ zarrZdyxNNT+SF#l?0TF6B22zQ8Zj$Vvf{2jD0`#tI2T$N2o|3rT31lK4ycA^Jvjn2 zuE0DE_KuyZ#8R&kgIs_m7KyVt14iZ<{%GFZhbHJpg6(0?YKs6{CYYyT5&ze?r7l?! zYV7_`4s!N-?UKD$3)Q0qqHM|!?Z&)@}MB&G{pw)`b6SH2&lEU#AyZ9eIQ3`gS zyy`5%9Pd$uNgVN3`b%uE3nf=u`>dQFSqs^uK`tlz}bBw|O*etE)?_whAY#eV5QuE{nNtO5p?Mrznw1>$1 z%UITA9(Q4pPddMpqOlq{nr0K3-s4Ek=1l{l1 zpfC;Dnwt&ytNNB`t zbbH&SC#X1wM`1|~AGE1tHw2fL1Qnk}3I>^Oe2X(iv=)r~##k|Q3OH5bnXJlcj(>X) z8BNkMNHF+J-J2=A+e$BfPOy4}VOf@_3g}$kvP^7Q@5RCx#62G#>R)1|&yLRiBh#hM z{qB!Xe1_uwj)ed&g>1PgGFWHgG|>b}JBCyMI8sXJPD*zb4W5qLQ71+v6?vbW6mU;t zgQSow5fib7{yPrG)uRLhV*KW&g|slVY*E`4K2t}L*hh@oTgQ+W9n>?k22yt@S z6M#tEjCvf%09yO|LgRbzt2e){iYko+nLeGQV^3Sc~^2UW-luaxK8Be}5J0B+J z*Cy$b#0!p}WVhEFLBh;68bz~X2WW5#7`A@3PT-l1BypMN0a`reA@^Ax%f)%ZD`r(stE^h|Q1v(Y>ZK zn{bjwFT()JFqM2ur|kQOwm`$#u_Udps9Z?DB=jO*jmXNl?Xm)kB;Cd?BQCNd98LrD z=Y~-}=5$dKALkA4%zBzSsvEW{{evxzIdXjldExlenPu-(*aJi|`E57PvmLRl#XAtY zI{=bph{TfwX4w&cc=mxzSgCbFmsL4!)68$5Y#ZgZHbmHHq&M8I0pUBU<-ys3r~_AZNVz^9b*4MwouiT z)EsrSGrM_nd)51dIP)?tY>92h9*bjfeId9gZlaQC3P!AuHoggiMz8s~r_em4qGlvE z|2)??E*4=dKEfsK7y%jBr2Zlz0nY`yNEF{c5X^TE)K2)dd(voqgTy>*#@(rkh012$ zM}+U_Z66?pt$}tdw2m9SG)bw6yUJWA2T!9QWQWx3+7#2~3KyG45VAHdICHp9>T2)D8Cr4Xp8oZbSx^TrfoevBV_W zd9m<*oN@^@nO5pym8E#;KIF(rcUsAgcdX*l{>k{d0Vqqa+!QE&Ng9|yNf!U?;HBt@;n<^wSIGbI*_hTRgKS5MmpnACNAa4Dn{A_=s2{8lZ?Y#p zn>WzFNL$77%R0vqPX#^wTD>wP@Y$u<~pM(|u_cOaJ8DSrVFg zcf%41kOgf?*fJB$2gvliK3wcZ4%4ABNUcS!4MAFlVpPRjyTU-*z{0t*1@)EMUsYUfQWv`wDFZk%Yb1D8zpoqB0NqOL(mVx6jPhi>&k@Qa-mx9RciRXiVuVw^SWJ$)tj8QHQAPj)Y0~eXjYQ zW&^Vg?!sn*XbuWxyVDUQL5tjlwyD>!m*9io;S9t#tD%TeK2v!4hI#>3lYU%B_BG_q zhaUcH71p!C!2{6|jk3H?AWU?}hno-202L3!{rJ0@u#4Xc$hc3g^6rEhk&|aCQkI)ZW-lVv7|N%&+e|TL(ynz9lL0XDFhV zY=CWa%nM@&n9Yu~3*CfnVRzzSF%sX}fau&EQm9DRTAmQ%q!mCsawIv7Q`<1!HsIF| zGOH|VN+3lY@pRE#SZt-sE`mLbJIu;J76}F0n;QHTOnLNCcMov?s<=xrV zk=6(n=7)&nle)@G%@4B&lbdqdAxvcID>LxfRaa#(-RsY5o00b?J5htR8r9m(bwhVP0aS(d~#xEiRk4LEc`%yOA>iW%9HUH0_{VxryPPPGwqsbfTqacGN;#~+;G5=!o!^2U z5WF3ClweCPcyBbS91dc?tu(vKSz3#Y2SLv>>p;Qqy21#{qpDtd%h>{iAT72}v!d{z z{mH#W{;U*JwgYxK`-Sd!-?@sH?Ut_}$Hnf68hkCcb?t)+EqHqB>KU8uWbPqR?!egLu5rYIN?<7T(;{K^M``ZTffx$e&TH*2ZU}AnWv; zU^`~wCFn4vtmTa$)NILXf6Sig(h4?CxsYJr<@U;Qz3tmt7ylj*$$oLS?_QrqkMu;67^xuZn3z!t>q zSCO!yKJq~#h5N`SVJ(4e_`awUm#ggz`<*$QI2qoqz}a#(TDuJbjLuJ5R3kQgFSaRt zsDgABwH-6=lCy(-7lxv3zP#3&W z_$)r&HVKymQtR_B5$^Sh#kA%!pU4cZmq*{xPx(2Z?Cy3=t-9%xv~hC~I@h~$Mx(Ox z7bin^G|kVZBe^n3TWSi29iMsOAcQScKgZlt|8jQLe7`s*ytNv*mmrtc(+#~7m(6IV z!Byhv^=Ovnid+@PJ==V%qW#Bcr*;;4P2Q&1;S8=yZ-_#D@=NkeuB=Y%D6YK)Nm>ki zpn}T$oIUH2WxyOQQy{mMbjtJK*11c904>gbdalw>oMhjZqF{$!P{R^IDB2rl1~)2{ zkuqtMp`CfG$K+$<7qE@01qq#T3X02ki}AHR!kK`bq|Sz9Ci`6==ti;fXGZW zB;#iivX{|e_I@M>q(;DDq%qR#u7z3?M@_wdlP2)4)nHo-#Z=mm;+;BFB%FY+SMmD5 z3d`wymm&cc&6OQlQ7E;5bsWx(s{qxe13lSbWg;v>CmVc}CYTo*CYeikJ3jA-iZ%`$ z6!G8+&{2>$hO`fQkY9@gAR{ytR=DxhS1x6|vQHirC0ISgh-VGzn@5ReK;~^~;TNY+ z!}GX;X5Kdd5g?oAEiy+S0C#vlW4VB$gYg+oNww@_W(@9n3X6ilUhkLP*GM@_B7JKt zxA15WC8o^_npZN@LG$FHcTvccg$*C zKo+x_E$g1YOMiWl7d=Stbtv#AL`O-l%Y^%Sm_4WmAd-SLG$;n;v9HpuI1n+3RGLVY+X;}^76$gkG!=Or82l^m1Zd( zc!pe_OrBd-)J=9jG_->mBf>FXb7q)Jq-`W%C&6=rGvjlX+Of5a=G4I);7u4hYDA*w_M1b377FVh042(zVD#89BG^uQ=%3*dIJ^O} zNHyT0@=?moT{NNnAZx(8`TnOQujSyy>iDq~6%4zxl2iNkf_OMBJ&b@R)J}LByfVhI z$IjH1)Ic?3G(50=Vb926rWSX^RbX?Rpt!HNnL2+On%G?H1pjG9?a-h+Q?ln(n*fP< zxcnJ@KhGJEeHBdK55S!0BzlBmS^w|%G^w1f$QY;m6T86$L1XzwR8pT<-9yO=&_zCxS8> z(1^`=5o-whp2nqXsV!}4g((GfdhDLhC$Ct_V zvInNeXr`zmC5J+V?PVk&fwEI22b@48usr7YU@eN@%N)E}Cz=*={L$>M=n9sG^$y26 zDNvAEvYH50@uZqC&Gkeb{<90%vJK_Q@xP`3_I7(L5ngEv?W4IzTntF+ddQH|ZTM6} zmd;C|2FHDv%#r*PRm~*;appOGfubs(3igG?ai-^@tR)^(GR=>McpR*25{Ban9A6~? z`vmnhN%q@vy}a?_NW8ovX-roZwA{Oy9RA{cjhrG?)zAWhL@bBfK`mjHX)kNa#*kKg zkA>tjpJHzMhSGmmGMJGzq1#!xPM~M${7rAE7389pKcYn(DJLg4$r#g)Yg8y5FoR0KAm+1^7I8jz@lZ;*)~FyhO8v=uPfaJEKa*4}kRshlZkszX z7CmsKZy_h`=XRxMhTD-`05w()ePOmmUUEsySDw>s`hdMj(t-kVI*kHC zY5eCDp6)Z=y{VbX#AvpeyuKNoyVh4|V11+|Vga)=I9BA;^)wsRv#5VJi!ptpc|2bc z_7|$@`Mfu{>23n$?xdEH#Y2eZG?6buvwZx4Ov(Of#UO?Q1#mtIytXBRK5P@k6OXP< zXhP;37Wl_E`S>@R>=7WLk*Gh!&55cih=|85y9ooZ+y#BekA}dV9-ro--Sb$6?7PY(39(t@1-ytBAMds>}gevg^ z%$#?w5!sj*k}Vx3a@&RiRH^!sI65F6UR;F}ofZ87fvDj8=YTjEQc()tAe&?8y0fDo z!dyJr8sw3vKfD+Nl{=iNRN9$Hx_7@ad7~=YdSGvY_^9vr=zCuLSsMWYZNK+0M$9z6 zKvB>pr(b-O)}dIOc_VX6V49U#KN!cJ8W|XczRLQLiMuHQ3i@Wch;TI;JAFVYmc)m~ zcyiFal+?9IN2dItiSq8piJ0Z5t&PYcHmN+~A@&R>#8ORhqVV2|jB?ZvY(wk;F{fwx zkt-QhX<%tA4W@GUt&%n}+}8Fx36j}w8RqiJX$}ZlW~f~7;lehO1L;=xPmuw~)W{gn z>6inONmo`8jI8!g$R@nNyr}$!fTY#p&Ynsf?yDVmD+9V#t9r-oyf@ooD>DpU|= za}Edhe@;7Hph`BpL|clB#>ABVSs&_4h(;6_CMg^P+5;Ew&Q?fVrH$)me&w~^QLyBP z&4HN^Hx1y4LGt}$Nc8TZ8-kU5k#F}z&nA1o2i{&f)K?!0zSA!>0 zb(>u=9*HY9zaK5hO}J}6X+6DJ4nnNHQE+qNDAs1=Wa7MNAe3zM$56A${)qLEhfg4{ zG}HrYpv-qrfv}ox9Cpel*%$UvVxv^&VFBK|mPn|moEnpMhILa|?G_*i)=bfO`=WrF)+S|pMMJ-1Cq zX)I=&ggCECIUjI~O0+OAl}fa%yaokn6-4|J94C0v1vu=Xfu-&Nc1lXEzdZ)HY~axB zf7(^xNd3$rBB1>FQD*p6hU9GU^5Vx4s{5ssbIAKA=U-*t-?1mB3%)r=CKkRoE(itl zuhJPdVxO#!1}G@=uL}^@h6o#%A5w>id7P|V6yX^iNBKsaKI~E&8PcXP!^WGeBOkia zJj1DI-l4Gg#l9my4c3uQf}vh1S7?SF66ivqmP}RS$sKU@)2sSk=H}r3_!nK)y?zf( zS>xx{5X}hHr))+<#!FsBkqf6?dH&Ga4(}rQsZI#8IaVDE7vzpfF_)?%q%2NpUQsFa z6aRkn$XNuNhc`iPP<|8y&&dz-I2IKC;Jv--%;c#6I%R|thRA?WLrOZ2!2DYI0>7dF zV}4kT-kJ)xm%SVIZz&KQLvq>!do;@1DLnlg+(_xH0XB0ltw_>?sf1-#F$+?w5L1+r z^+35bK1bw-Cm{<76D-W)KvM{q?5;E(yvt8S=zP_Rfjn#^1=gX>6O3w5^8oam;%?|J9O@`f9Jlr> zVAhv;s!(ih8xU%+-nCX6^Vov&=ge^r|8!gCPo%&EeOg2(jV{o@P`TgM|Fo3p8#Hos|f+=1UBx!R1$=ptZ~Y+&qM5yp)Wz`OHORx>zYFK5bF5d!-=q~rm&L# zt8gI<>Id{~TD5<&p*s|7+UA2|M$szjd+}H3-?c$z$)t?G>>XG)#QcFK>owaREIkM& ztc^y^2U<=2wH!$7mE#y;mo!=gNe$|x_o>V*W59*&=YB^qGt);(gWvxwcA`f(8L6a3 zoAzx6w}C@5Fm-esl9eKuk7Ub9s37_NZfJM{1!1l@?`Nk&gde1C==22xDgwbX#MXP1 zaeQT%Xr$-+@b(UPd7PS5&!he`(f?vX;TKY^hDH*?|)MEjg?V zneFWCO8dBjk1nz^gJ|en7wYzt+o@i6Z7GfAvu6CGJfgFH*t0^eZ1zt6h3(2m{je7A zou)E&aRjlXnNJy@_>Re=t0~1nXS#YCN%swErW=0}y?ZVn-TW)&Q?s6KoZa@3(YpAR zIj|!B%APTu{xE{jHe*l0HOAIWbsYxv_o6)qO{Pfp(v9N^l zdhGc9D>voVvaSA8=u67vy~U|7*6Rgqp_)HR9aw3;3#LdJ;a{2DP!PV-X0UTTU0=PX z-gU>Y?)b4uiB9vL_@RRFG4RM5soqP0j5)msx<{9RiM$SlQqv0K*CgckLkO3n2ai%S zS?AQwT5I1h=ZBiMu1lsetzsm&19;EHI^)ev-qEvL1ypX_ACAlABo{!6OT<=IGI08( z47%RE+1>3&Gx5OJV(no9K6KPciK3-iF`z|#Voy&yd8lUiyh6LYT=Z|kqmJ(JW`&f? zt8Hbq)VBlrABSaYowFym$-2VEt9~Rmd&%Sek1zMA+pqJe80VOR^mo1pP**qBN0+FI zcjdLbBC5cG(lk@BMl(-pb?5z0-p4+gdvdBO8vb04DPJDHAge%8ot=w2PexIx*gs36 zE`|m?ySRRy)s9)yD1~w(EE05bs~_i;hd$7_2!T`9)n0Ur`S#ach>3|KDzt3!cm3t4 zAG}hgT4n*bdYKkAR=xHNv%2;F(}CfYt|$vDn*gu_*Ch1xK(|a+mM$Br81;sW^+F3D zeepRy(Jzl$SJbVJW*=1y)?x4(&v{D_zP5g~2jRzfGSk1G?44&9riIxfQ=d|%Qr#mr%L?Wvuo4CwLEQte@#A7fO$px4EaD06TC{3|^Hx1iW z&dYzh!1bByrs~9Vew!*nTQMsdTN{g7_oJ$6oKsQC_^2yU<85TJNcFBn!yKSg>4|_mZa@Nli%6PzG@4y@ z!H;ANCW~l49tRb`4r|mmiLkAl*r^W5BZu<;bWD2XL+lPK&;&AgU+{nNQPofcWrTau z>7IyXCBQi2h1R0{M=`Omdm+WeBTeZgV3X%SNYqtg)%y@SCYP4Z5{W$j8}0-PaEddw z^paMVj#DU$W%axBL?g0{#*nQG`YGzfU_>_tM|z6ypb(m7>Hzrinet>Nk^BMgrHPAc zv<#*WH3=_i(advhYZv;fmo66rC>JcRrW&3sgmg!Vo#l&1iDn3~|E$OlDCZQ3tw-ki zzikmSk6dVX=(mHgD*Lv4dwK^*^+bU3l==<&W~*yur63e6w-Ea!TCo z0~dqrU80giEm5fD0kUR@J?=_BKpI}e-Jt951J7TTiHi^}uEd4HzkjvG@x9wY2Gt zdU5>418N2%8UYu?ji7WSrQyCXq9E4*BF#$`C9rDlN5L1&@>BqPdFvyK4kIZ?OfGRA z@+0{n#F8(Mk1T8p4+`g%?gfE7y0tigiyRVhu1VoHobv-hgan-bmY~$dd17Sp)#_ytXe$Cy(-wI>F99VO;@&I_v@#mVCMSRcQ0o757NCCsJZ4>JUj> zZ(+2LEqjz`V(m5=X#v`IZsdrc^LrC8wtS&xv}yvX`@sR z4z?>l1OZ##3q-3CaV}3=m5P_iMgQPsO z4=Ffkegy*KhZIn>zAQ`QhYV}A{Ov%wd^e-)&Uf~@7#xMj>=ci{s1*r<<{m4kn9f$C z+AH)v9@9-xhp_}}THqonuKI2+cgzq&SEFAyoKsU=>Y#~MYw&PFp0IdSHEx{-1y%<> z1@Bk}eJzFp8G8p%-#}u-3S7oPwP^dPRA%Q?wIW{6M0k#h65P2_?11yY~*<5${C4qJ5L%g$?X$)?Kx^M1?+0$J} z#K=0oV~x>;HYR9jji?8kj~8bn_CZiu{0Cf7MyPn*cdZ6#lfZ=yZ1$w2Vu{QY!(2`b zpE%qG0-hb=c`Jgsr``RJ9YlR`Lnb6Sj@WQ=Tu0-rMiJGnun#Cko`)Rhyx1j@p!~KQ z{!Dtupi^|!z`LBS{w}+!fhvy7raAvKmLYd$f9_sw8$&eAhY!mO-zvQ}l#MQkV)XF% z`lJOIL5Fnq6o=C^2Ofz%TZ*9b&7B0}cacTeE_(SN(`2l|+7kalN@Mszdh-DnnHT;+ z^8#wxR}gJ0{Q=SejL2?%%U>p||21;_>~y8NTu&;^mF3<;Sq>&RGum!3#RP6#27-lJs z$=5&yVTMB$^@dLS&z(_7k)Qi5NZ*Uuy7bCfZQarV#(ad6*4SMJ=Ih%Oh>G4s^%GRc zOI@i@J~45Eg`|%BAtas|1^1Rc$|H|RXF2LTN?65;Ttoy$4UzzGfWuP8piRDozFGa zkWBv%)sL*=VAm6r2)az!Bh*$NblXlh5XpkNEUIR~bmqe3aHKJw5_X0ziP;*n0fT~$ zW^yy@f_+LQV^8;vk;-Ohu0IL+LyZaM-|_g+ zMIP74c>Xt!7ij=MmIq6VJxVr(%Bg;eNZgSqCg-961~n_e${WZcv)ih{>`T%nO@5Gf zWK{~AutG5lgws47uE5c>K$%_uhA?M^T>Dp(8!L`K0#t^!H}&-VGC7crLC-VaseCJ` zk>EAGcAr-#8L+s?c_c1m1hG~hQ2#ex*S%0MJF+iSz~0cD3A+EYFqpGw(e>IwGB~2M z^MN`yc%@?n`c@)It>#KUmacExB5iCR)Eq$DOEL6H_J+5Ji3_-p|A*x<$^p<76cXQwq55YRKAIk~P&7GfUl zlQtqR(<^mLB6%v>g2yUW8otu;$uD5dcFRNw*xY*y$(#R$8|0G~KQ~wn5%7UckvIP> zXYsWbL%o>Ri{GK2>q)H{cG-GAQ`LaW$dbSWMY%Pu1i#D(l59d zB2%t9W{`;W7CDq!DYGP*z(~R|ad35g2@F1!m{5kEa0JbP$IU|0s8$8sXA{=P+(4qx z)zoK>R(Y$Wx*W2l8rHg<=$DQ2a9f`3zj76y0???IsV*0wI;ztXZKv1t&dsk&CIB?P z`*tWM@9&lDuIKd|aFaZlgd?(Ag*dXL+E`@sjdu0-ca&ys(%ZCVttKx2FkoAPH8uy+ z5$ce{%8YOVcTQFr%-8v@)t!ES`O4hGMn(S@#m0LEJ`$427>9eKfg+=pvJM6-LnEV} z8$^Wx35duxjw0XKF_G~cf~lM5@!wk90Qe_Q-f{Lb4a5ahF12C`y~D41723`+MQpFHIj!bEEq?{F{D5 zD+4HRZ0>KaN{REdMm7qWuT;Q4nG6MX-SWH)fNjbsFSPIXJ zDHB0C6iU~bd{74i!O+!AYTsW~G?x4fC9iSgZU1yCV&vXqSfH{qKgNWgsO{W(A_nuE z8{R&CBk*#)JqbVAaULyxq-2JLT#&RPi_sW!4y3-^K6 zDf8>b|LWuyNR6dWv&2|;>H<%ak?fXkUJh2OaOP9vXYl(RHn9a!;hd*w(S-+}p=3Z8L zV$?!ik{5ME@UrH@K=WGFJqN+iuA##j^L;rp>C`UGZe)ehS|u|Rm{*O$5uN)ek{6J` zD;w_EM__N?dC6uJ;Ji5Me3U1#F%;*!AaS+HwWHIhi|;|vV(E*1gPEU+q?jYG&DFWa^Fs?wtY z*XfPdiom_5P#7dc@-WxOokwrrZGEf}Pz>&!Jcl&feZ&vnxoJnQ^kY>fiIzUz?a8IV z>+`%Tn32MVDgG+-NUcM|EpSvByJ_bJeN%PoKpC5y3tS1BL8fe|9(|X5NaenwDoy6B zOiePfFx13TakEQ-dMz=CH0K2u^0(4jsy;6aGy#g+nQ<{^t4GFd{bjR_pA zRVX*~I?!o|724OKv0N)7a;ayXLD^G>#hx*o4akD_i9SFg9z(cW;_k!=-{$IoHU?2P zkRDc&D?5i{3fX}_2h+R-OWV<{8U6o-5lbWg|A`S-{+AK|ml6M$5&xGF|CbT}ml6M$ z5&xGF|CbT}ml6M$5&yq1;=wQNwq2=CA5Tk-90_{mVRi@K60|{~<#A1=!E>FwYxk-@ z*3FzX{84T<$4u$MhPjI+G_TN~~W^ zK}L16!QxPbQM;$PUGc1-U7&!l1JD0R6tbdnSH@j?K^ghJv26XUU?VBgO_?CT`uRU2 zF;<{B%UZNK|9P4KEnA9#vh_e&RTcFF-eYQ<(ap8(wY610gfEqWCx9Ia?IXZtNhhU= zR66f7Qpx40q>*j`sO@}L{XZbGyy#W}qSk*Pa%I#H^_4<0%Z{dIraQaK4E^c#Cbb`2 zYZEimR-K;1f&?af-_*Ink-$26LRx;j(pTe5#prN>B*G}I;N<>mW;@fO#gQQ*s3#%V zdx>OgwQZuf+CsVhrSi8T@REnI)DcY$mV_Bz&B0UzqiUJ&p7GxDp3<2twY<_791s`u z`rS!!fR>Jnii>MKLF`0o0xbhF#W86m-EDI>=+8lsSB>5sW1I8lUbMe@{u*~>oH&Ufv_`rMRt23F-*Gan!YJzJf~xIF zoNhv|Dne1GzR?q|8Dw$5Z7_}KJx=h-y|m+u>VgOdnGH&CEoPD`5`iR4!d<$!@pX_A zL2RR*Wf=jVzPp-73BuxX{1?)V@fAHA6`;SmTwwFM-=kfjyFTNEbF0Vd@Yc%!ykBN9 zAF(i&W7!KoS%^DKj0wvIna+Y%G_s2v<|Jb>ZZi9m(-1Hd3*eLkJLL;YuVYck+q>MZ z^R~{ZIT+<1^WQiOd&>{7ZJgoiUlB(!bNWw&2Km5cpzT;^PuxEd5?c8jbwU{7DK{Mm zhQNW?^M3uWASJa@#WCLa`Dy>uh|sqb86q{I@+sXu;rWH~&^uoS`wER4DfL)i_IrF{ z4?DqB*@=h-zyo?!KHEI4|MGCg9DeP*{$Gq;Q;aClwjA5GZQHhW#yn%&wr$(CZJx1h z+jHmMkN5qOol2)V{ny#ud#$Qfuap>ZAILj&4O$PTQ|j}?k3_s7FJ-T~bfDka+6!;# z({0CKDCsjvp#0zP9qEXvLAfd48%meQb^dkMV!A1FWN&Gq(XY3w&UaU1`xe2~w?0;b z8oY;XW~&^YuAEi`7C-nX)+qQ6kxZ*cyPVyyMnOc4dLXre)&NiN%R{YFa78&=^#(pl zH=|cs!Nali8aO+=#eetGwO*N!JHjMY06Y%~+M&50{f%(4d;Y8>f^e{lWAaHo(O*cg zpS+n#Di4F!d?-qBurK~OXIV*Gv4LxXa1S|1UCxmL+=LBR&!D3|OO@3WRYx0YjiAmNXrG|BP&z`&>uaCR&T&dIAU+{(Hr^oh710`6Jx zoi<1H+nO^EfAE6I*qqM)i&XAHR*0;OkzUV=RAW^5kG-se!ECj#4KK>Y{*Ft)MKtb zV=nZXp~$+tQbXs`L6(kLJE16An&HUWE@eY921>aI)htwMPFgf)-Kxu>(^|e*(F=V3 z;x;F`Ak$4-OtZrEqPBoH3S!^b_pgcViE4^^>d&+VdUSDQuPFNVl}xZ3xzd%h7++jIZV(J91rj!KnE4 zY}aI)`cL8TE98HyA9e(Gm?5o+e8HkBU5v|vtenG=^?pXixIdHUHKXNl9pODOu9DHB z-q_S{EH+-4E6TtvcP5*!Onf?lf$yz%CSF)4?Y}6s_+K=fn0+_&r(f5~@#V7zepgM)j6%|o`|HRWtf zlfA((ZGWeD$QH#(Q8STSrt30@BR(YSGWfg5)3)r`Sv&Wx$vXEc8nJU|PF>>{83d@- zG)9YAr7YU8T`D4l(q$|&i$cobe96&IUQ+uR_$~A0+!Z$CqWw4vjD~)8me~?8fsC$( zR(vep+^Vr99x}f%6~F0{w)=Sqg%)y%MXXpTc*{cx3ggTyNNNS|ZkIDB3dJxiL#FA2mbQeinF1C6trA_HL} zDa=f7bwc>V%-)s>6IcfGUXL_Gce-Ler%@A4=Cc{ZX4Z{TC|M2Qt#Dj2rp9jyt{UBU zT7DVfBtDg#$Fl`Yp%Dchz6pH zjusypAtq9dqTM_BK>c(f)<;Vjx==70|x7cW_5IeP2clUX) zLO2>`aNyp{szSkI#q+~u1rYPF{qqV=l_G@L{Uf9O4S=!U%N)>!X(B-j=njV@gR!Tu z$~M5n>M>O;ncwR2DW zKn}--!YH1TJsRh4{kW2VwX#f`!7-9RI4Wi(2*Z^RmeHSC7Mv2*Ru#3myV&_d2q>2=cE9B{=OVN>hF*ZXDi7F*~TJN4xVC6F2_D!Xl9+aOQI z9U5xQG!lBX)$QFF4gWIz+$R1!^*z(S9bnNRPyU{00u+-@R4g z@cymNe{{ywUqL$-k`ZNakLGRC|Wuk(P5FIH`>D>;BpirM~>RI z%p12L9>5AdHa!pCLQniO0q4>nz!iQ&oQ%`z1`n&vyN&y_Io5?N#C*T-ZhoHc#u8z2 zUxV%xI@bT|qfpntRjTV2=@WnF)wukP-yR{=sM_dJ9Nz~+*d{ojqt&<0H*ES@ady-E z1}{C3ZN$^_ijnQv)4R~usm`~Ft87q`8;L;P0wMTY`84ZIGLMa`O*)60WAh9aED+CX zQqZ$?<)(G?uk9ut{`J+(6+9dqJiG*G&IP}x(=wNYLG?rN(Y*8wc_96dCRYwd<@hK= zxadie?YHB1Z~?5iUsMcv^Y}0HhT?wDp zK39n^^^_s=$uUTd$}Jz%Ylt{+c#@%^Vj=k7C-tbTS&<=XXr^hBhOv!3!7^Bdlm^nS zCej?B>2?ro=1Y$NM($f6Uuld%27X@;Vg>fR@Wv+D8Xmvaa<_AYFWT|k6l4p)0@peG zpM&(Ux$)@&roZp%C$eanD;lN@3*5_Wb82Wbgx}dvF5Odr+o5y&*HTI&VWC zI~%d?&_ee>ewyzhGL<`TJ}aC{(V9-8HYZo4-5U2*Zmi4a^%7(# zJo%B%E5_}OT%2e|Lh(SUG&fR|vU+qVuaBg+Q6W+A@e9NJ8>9AkJyQ+JS6&8vzVQtcW+Ny8y<%Q zTpee>=T#wbVw3BgekpGb&Q%LIcVK@Sf`c8)nfg%wEQrM(FRgZ>WyD^_t52Y1dYhQb z?H(Q{Mk~4Jkk!p~+J|+Qqtj{*hBwb?^k`?`c>h1em(!AP7*+Wp-9(ez@1=IYk9#Hy zCp@?-X$c@Q9m(AzS_Vw_MIxCrM;(a56I-{s$C)tL5aUUq#b+FY&l5QK&pVqol$LLGt6?)Tx6(^U9%pY_ltw0X556K{gj14GceP4rn0j zvafW8Sh+V$7rfUlKlVXMT%IN+x>UtCDb}Cx@u$Dv|F{d}|Mko&PQJ-kjX|ux{P7T^ zL?2yrzu&M^|Jgr|UM!W^*}X6`9S=95zN1|J7WvcIo z2w|FozAlU$6nvw;y~1j>F7<)YUhmDZrc%qQWYfZdul_FMUMppp|WBW}{(bX^&Y2*v88K3XH z_jU1uI(vrXOjBX=g0s&e$3Xoz=yAQ5luT!am=|YeIDxy%-iD}pGz*rbnKv0KghPP8 zvyQRn<^Wm0x%)}Kxf4+>Q;2dnNwIL=Oecw{ELtvG6y!eI=J-q-C4NQ;{n!yf_AA-F zScIo{(T!F|XL*5Dk9OMmG6I7+N2oLyg*hS(KxmK{qAtQS;VE)c-@>3jBA9$mN7oQw zk$PsLCQDrp#)j^(n!&Y79B6scH?w0AX2<&5Qc%Zy7!NJl>APpU)Fs;1r0aZn#Wp#Rwuk&sD<4x93xubm18>o|ovl}q@f@_2JB8@r_~o}0C$ zEwv0rHa{CSwo4ulGZF7!@M!YGg#Iz?=%(Ei>?qAFqchaHMr@Dpg`xzq-A;-fot`bt zp1e|a8`Osj3O^gpIrpK0Mf^DY-O@&#K}a;uo5tbzrrBon*~tveMuHNX_8a%%L~Xff z&>V!Xj=t@(5Ri)#PUC!SoaCU@RW2j(F)yj|>gy;!Kr7mUt=%{F;1?9>6$;XN-Q7(_ z^v=-+KjJ~o=^#I0(pfn}BhKoItkm>y2khtv9Ot(8G6;la;~^ZcVo&RG)-*_6lJh-W2PD1C}2nlEK!!E?*rf}!g%YhfcZIg!y+d_|W@ z?}CKcK#cg2yM|f4xP(yk%W(|J*mIFgty2KdnlGNlbDF!dV@3IVI>ku$c%A-dllKn| z&6(4NT5;Y+1qk~^46W&Aw$U-7`tr#0g~$Wd>flIgK6exH1=3_wuR>hg&KYSc-Lc_H zd%B8NhO`FN_-A{%+Sh6yUOLw`Z7l+AE2VB4=cj0soMSxKTJXic57H87lnOin`}d;v z$GeG*5F_l>4Jn$utxX%&K;|oLBqPX|a(L55Qcw1!@s>Y#@0t{m6O zHESDNTk@2nnOZAcx{|N^O00Kw2TyH)c+@I>qRDhFDNIKz0r?S6m(`QASc%LNj#9&y z*eqMWwAq=lfK{@3SgF;!Bie_tt_Pn_TSGT|{_wx05if^L$)T=%qsjv)X^>YWyf`o1 z-EueLL$z@ShQ-akB00to_+i1k@9EgTzFVTw1$;!Um|-t~n!ZINe1jh6$3iKh22dCG z@Rug6Tl3)^e?C?BU$c>7KhV73R>un${D_|rFf^K^F^&-Q0hqO4(_XMn}Q;2iMI9k_O4^agTVzN zA-{9>R_^y!i-k#0#@)w{^&U1F@h&qY#Q^%k>Wm;b5hkT@x z>bv&#C7KS;X*8+$-Bzu#bix5@8Kgz1gQEC~5USjO(M2_K%x;7wY&NHlds{9?s{_h( z~9#zUdk!MyN&KKW!4ZLax{D1Yzr2pr%_6|P~tDk+(Gfw+zD{7HF{mW1-8FK+L}W$ zX3EKZ)cm^gIzSsCb!|}!M%6QkY?1&ipgO-*S{jtgT&4O-X8Na{xD#sL2!r1_JwiSpHH3K zIvjWsJ(ihWJT6^WKc*Wx-9Ljk(1^!w?9{Y%`s`;ZRj#?k1UYc#L;g<06F|FbkblLn zwl1s{))J_}=*Kp#SgIq+Ef@SIXgO=+sZjI<)=WYrygBFrlZl^z2NYGwx(<`jQR* z;VWagBkL_a{<%jWqE~4deov1&BNr~et+HJ z_j#Yas@}UD{dqfiuA4t^4VVw;7lM8y)_v;7xicvS{34m(Bh(2>UETC}mhmO9Gc5jIOzJ7Nz<3I}6x*CTk7stg$;+MgTw}(?mQ|lm+xVWsZ&q_;PQ+ zS)j@402`+D?|lyGjqJKb;z|mbGf@^~sV`V<`sy0AiW*9Co#31-zgsWuWt>=DJ>N!t z?t%FIIrQ7V;v8|Sak%@xaIPAVFs5v^S~6+s2qBHGsS?i$F}lqFZsI&~@A5DLmjMi8 zd=gGVl^Zal6rkc|-9Z2#<5_&tZVOVo;q6?vf<8UkZ6KM8IqzoK4RG1jB(76{rV3Cv zdj=|?c=L^DD(Tu(9C>P=AFt|?FcH4FeRcvAt)=!Uj^_GvBDA!MQ*1qi1%)we`E-iQ zG?}e&Z9vV;ahLl`=mj~N<&9_H2sbG_M+62FKixxg$01&)o^Kc9`nJ7uMUuFY^4L~$ z)SgmTh8IyTRD9V5+svaB&5e*>5%O4kXmy08GvzxccQ)h7*N3%@w^{$=M}h_%M>6&B*%5t>YY!n^k;#I{`C6vg|CDu<$`&`v=NQu)B_e!`IfoV|d7NY&V{FIqc4j(>XWu#dI zT?|cIm$?ZumS-f@_c|}D2B<>F_9g(!k4*D1kfV(x4HM1ohY z?0mZG?acjl^yIj_fALAvCq5|KHyrDWvg)=k@#toxW60VVAWXJ|*+s>5iv5msI$=+$ ziqU98KIs;O9U1uIfL3kBgMQiPQKX;HC_8zc`+h!{1GA>ZSpm63KE-%4J(t#-^p1M> zw$nj9?Zd6cZ|66$fD=b!zjr+?t)nQns^2@2`K=D-R%JP&C(O~im3tJ zife*QD*0w>D1-Ma_V8{XgOlIH0z9jMJnDaFEw!rV?(7)5JA`*4@5G+Mk<@Yxlcr-U z>2~IM*TLE-wzr-CWNbeMv@J3+Z%|&~u>dW~*)(a>?7jo-xMTLG@S4qitM<4{tV8cu z#u)Y5c@}%J4vu3Jc4|{v{r)d>iwN*s()Nq3bG${BgXWRMfNM#)uW4`DvQ2Z+4u4ec zai5fUHWQj8|FhDfgwyqZ5jFSoiUr;WrmSJnZ1V+<_OTXR58lZM(ZY6JUAkhF?_4Td?D6s1r-+UlqX=Ow-Y z_OI$BXS`KBoEG}`px0#Z8}87dv%F|u&YqdN%Ams_u~Vbwz1v3B45a^Jmt#?($sP~E z!+ikX?S$_r>vwRyus(WtF_3!EW}5Otcw_@;4~G@OuVm9LV3kDhil4~+x>0DW>Y@Av z@U|m5NZJ=GdA;*7JLFuRj)zKw{ZV5$AP!M-w8q)%v*hx;!Orruqp8<>-~ILsi+OLq znC<@%cg=ak<;W69l;VZa%)Qe?+Clf$2ZAR9$k1`{=iKW+>)P;{2gE`aTkqtf zKfu!1BTlDB{;YjX&*WC8-mRz%+qPGQK_g!@83w8H!mr{jF(jr$2IP+kxIX74S%Vew zpO%TS2A<#X zrf`LI5en=74}EqfMo}$!87CuKjOL!lkbd_-G8H^Ox zgOEOS&bCurJTs3Z>D3lFsR>eQ9fUOa$2uS(M@b>U1B+r_etP!D#^fcwfbiup!T0zv zj#3y+lqf?eZy=sP*me;y0&64+!k|?gi>~#O& zs1mHjh!QDHg$s=;r|nW_crn!}Eludwkdn1wIg-XBS&Bur1-Ggx%L}q}^3}68p%az0 z`!_=1eZI2Es5ao>*R@b7Kwuu9T2-1#8`WY-mP#}NrJfqrR}`ioy2E6y3QW>K;UZRH zyhdrA{=YV|*4(>=d$EMfVsJ)5N)gWtg24=9AmXq~vb}-ul|#1tz+BP%xUorZ-z>=5 zWk*>XMDSLtQrjE$KKB7SQkQv!{m%?i-`tUs@de7|JTS8KG>QSA& z2u%F?>k9gC=yWCVbKIo1`_qKm0GCI@nebuFuP>xe(G9i$21alq+FR&`7-_PU=$Mwpo;{bK{2dsuvSm z2wz5OX{K0ONsyp~b!y|D=dEH;WbdGYs=BEq9r#437=>w*MgfI^QkMA6m(K(&R9Z1# z(d+Bi3XQ=T8HY#^+`b9+>fwla2XmF|BY{jCi!Eia6-bMh5t&mwe-yUs%Tsa?+Sf3K z375zgd}YqFp~7+qO5YTNcfR+zCWn_@#M!`BFXh(`-i0)zGP0w31ovd?>AK&Kd6dgO zm1}#_+inW@tcoI>v-1wLlaUUW4!QFeJjp^_5+IwCAG50{Xej|m^U27~bXeAHU!Db7 z0>08UW@G`x63mhaiSC46_QZ_@<0&-s{2DQ*S@5W~IZUMZ$W4=#F_jwqGL1aPk+Y8i zNujq`kY)|}X~rQ&RDY<(~8n@&)f1V%))Cw}vQ3aBcQ9OMU;dc3Ad zppe$bt{1?38cPh z1A<|2hU-u3`}h&c4nOm^ElWe$36q=b2-pNFZ^Ta>>Hhe<+KiN2eO;MbyGw7At&PpPLPklq6Ky{UQtqF1 zw^fF*fyfw;*c>tI8JD~7dn(6y=~RcFPt^lmLGzsB=hm9Q)NQM|CytETut3b!1`z0f z&U!fqCsfD1{UZz^LsQt2=1)^JU*ky+B+8cr7`yOmy>yOqs*dSZHK&ebItF@5_*lRy z=e+zOi&FiK1r2leXV(*q8n6csk3Pa^-?HXX^~TUqB}c!79e zjRUxclw`r?X{cNS3Xcv^B~Z@@bP3@>kk5P}JN*H;rHMX4T`)1fYA0WA#IEM34IlmM zf{hwg(2tm2bH0__HH=RxfAk2pmWS-i-%s`{-9U?I+S{`!fj&l}kf<7Y8W0OEB*JRi zrw>FDxA>%APYUDdq0f=n3XaH1Tf|F-s=2xKo+RKp&WlYQ0xm;SGRDRmmW}0lSA7dgqo!D5rD$FS1QgK7e-Ib zl3{8emw~ED^mpd9Z=f$OP|mPhnjEA$iRdc3rXZAcU=m#eB7w=a{teQX zcBGWLf0s<>y``aIv6(lZhni%8odXhzE6F|Jl?S=^t{q;M_W#aW8J>i|nQlBy>K2Mv zkbA7;U<94n%s*+mHcQP~;kyo|>(WcAlvdjRiFt8nZE zDFAzce1=BW!n3!&oSz+M%v`@g&j(xpMT1-F6tTgHu#i{_#SmK&|5vIguB2mfW-v>2 ze7Je}U{D##UOG$=`j-OJl1C}KIGoK0=1KQ{Yg{@A`2=ix>^ie~`_j&4R#WIy(Otn_sJN%41Ii|Aepq-R9rp(Gu`u{eivzT{=z(x zmVqfCY8oVK28D10MX{@j!m1=nP{TMZ&=!P4uslnY&8@cMU$YTL{{`{gT!EtAl7s0m zY|WI6h+zj;zjb)ByeOeDvw*R!Q`b32w~@jfl}%)sNp8TlJYwS<;0%Sm{o?7$%L*KQ zgAPO5_6UL~sCmc+T=;nUBzG9^CI}b7VY>%&X#<=*>=qXIFW)f1CM}`xiLGMk&aR!t z>_pSRm07S_9j|}sO13RH!kAR!Q3h$hq?h?G{Wf>io3hyUH?Fn*3V)@s|AO-`o_#K? zE_m-l?brAc>9^JGd&XwV+m5wCrzNz+5(-gVf;a>T#T#}Y92etskgSLU`Vo13x}SM} zxr847_EaA<{ESS;3S;GdzLTJ1PPo;uXx1E^vsC?a7wjQb|}p1`PQIYT|&^{^&;{_Zz7z`_HjN% z=8vF7#R~4*K69`iWu<0ClX`E!gCD8*oqS%gY2ChUvXM5L|~#{2X8vq=)#qoAd|KM zM=O*XeEd8gLoDJU%;0HaIm}8+`Qlo>msYg{Ya!y3j7$ZNJfsZ3Y}1I%;@eTLiM-VU zS3)x^7H8zw+F_IQ#XuLPwkYIjOsKeaURJb#wf;GC7x$-M2C)_)k9MgD}~co8h+1j(|T(dnu@J-FwszTGa_ z?J(BlX;PvcdeGhZIUkjzakeSm-6^?%QA&j`jw#kz3+=*on`2GQQQ zt-1xCL>d5ZDg4XCg~#R&GytB4=(;~FMPHN48OA8{N{!L~iNa*85qDx@;%tvD<8%mb zb+TqlKzY`mVqv_L$H6w+2EIZP2b&uh_Y|kx@d~1dHZFE86Uf^jIXE3l4VF&xLNmd| zJBCW}xWka6yFg<2l`5zK#_DdrnoOA^Yo9*h{_|q{N)oZdd~&cMV)gHCs=}GQmYLo2 zTDe&=w5=%`(#odkYloVXd94Azla>m};Hc@1?bk{3d;>{6r9-UK+|v?fo06ss@v{F@$_JhXU1KXWnN6_Md{s_h!Ro>(FVVo&@r7< z(GGBfqA?hcwCI>-LcLT-i308%ZYpV7twMAfgM7;7Gixsglavv4HKP2`ObGAk(S_2? zNJ~HbL&=$daEVUuX?A|IfZW#f>pi|-1%f@-_a@BA9CZDfrX94gY}{0`YK6LpZqQS` z+T)1_)yF0%AXt4A_+VU~lv2 zVFJL5?r1&6d#yKLGQ6V51J*O~n(wqU9G~G~tc#UPjRd6q*Eod#UxHU2S6MS)3b3E_ zeNtK>WV6KlCRF9{D3vkt#uF6EV_zJ$qjE{1uZn_j3q<1TcujY32t_KIadMnzjZt(7 zo$eGKe#fiD!zftm?JbVv(vT4luEstwsFtPDZ;k2iN04))qz-xj^g^z6LRW2G<(Viu%ze})7=t{tmE2fChD|_Yz z=TJcxjYMpNf!$xM8sf<|OK5ts4+^fjw-$kqNW^hAxG8^@Ep&E-A*D6o|8lzE*tTOZ z@(}(bb(uztHyKv*Uojf3hoCd;*P!&rYS3<+b&{FD`zi?1{AR4x9}x4a8^B>|!8v%h z&mDu=C=qR9O`nP8b*_JFOBJ>LN3v}ev-U)+2d1Hz9dHeM(H>@L@rRhumgn09;_v6_ zN`J}$d0i6uaJcAxFuDCSb^H-z)`Xt)r6C^W;FXTNF{Pu`lv=TxTi#Neu~hoWHXp71 zlrs*z?tH8pWYp@Ey?Bgu^7Cz5qzRAvFc5QCw9YvXlL<9(E~K%qmz7kU2Ua8ax)r?k zdbBv?<3XdI=TO?(W39NU+5MhRke1v@kh@!to0VPUu16TopJeMje>EUX41CH(_{%!Q z7U{QOHWiDpeMKY67?CHl#+p`L+Sn{jAI56cHpylCw@Ols<;K00IQH|c_owUab#{I0 zm1a#Pds+EOO&{K;E=!Adq3Qv|s%=$;lXtD~%(Dv8aID#^3OH$MyWT&^@!m@**A0Wi zlQWyuMEO--3Y2wa6DopTfkN|C9UWNl@Xf}}Pg`n*5vw|;%o79T4I8l*JPX%|nzRmf z-L0w;N2mf-Cl3Gmly?{6iY-{`l`c%To(9VYs3id5w`-J-^pdo~X=qaY|G5U3tE*Ndtjh8~~Ud4eurZHN;{nEVl zR1d2Vb$GDS$QMnv!{QA|_g8=p%YOwTswS}$@?oJYs46~kDwzr7rPVc9z5q#n1ER6e z;lVWTVHm?W*l|?o35UF7Y5gna##{=$`-uL(fy>@bN~c-tv4|F8snWot*U^6)v6difEtYA56&$vyLCO^LN!Iq&vTV0SAzn%F`b~R1 zJj96|L$^3DF2+y?Ey2`W`nFCKqHJe^J6ZA}$o9iCg#@>p-%J&WH#KSs!k`+J;08P> zMG=;&oqIQks2Khe-7prw0!&I5j-;lko|`7H`m@Cf;ttb$*_`YOjh2!tT72d2P-VfD zu1Owk6~vsaaw|_*6?>z~9fua1T+|(4R1eWoLE4IkwbM}- zdi+n_tdZ~vBNxpT6n_Xe+{zE%L^DtW^FN__w|uR$HlgTa3%F(mNOvV>5Rz~O8@_2W zIBXnnqdQ2M9iX64YZC~;G@Zj?%8(MYfk`|2#H-+>09kAq>Vpb`nTc{*qEmNM`YmBD zdQmdD_o+~@pnHy=BEHauM^$cItp$eXhvT{g_wHB%eVM{4`ny$gD94E>RKna*E``(r zsz-3HOD&A^2ShEEnG!TadAK51R;g9ClH|l%5|yYM2>!0ncB&^Zt5bKEqVIHOAf^&r zA{lc7zB7@ePS^6lLrFqDFZ@x3tbqV@_h99U^}1`?cZ8Xj1mW^i$CaUD-NAh$MGFpr zn#MUab~}ne8j6fjqqWiO0E;m(0Ac8g4(|l;^qf>+7pC|o(Fpe0DX&VOf6LV&JS>! zG3Y9~8;FPp@Y(mTmFV#s03NW*16U=v`xSW)PD0JKxLU4xodUiNX4G>jOj$_Z;15l2oxQyx4Tag~ zWaXyE2&)CAaJw{xeifhZ^^c_xZEV}90r21h`tKytrNKyR*4iYUlJ>9aH~b!w$F6ey zIRrThRFlXl!-t)WpMIQ`$f>QpmWm3jZTWT^+9S^eDQzTrx6ltUE;&x< zHXT#?`u@PE$zE;_+vMRb#OMQ3iz9^e$2b#C|#s-)YKJB;ssIy~F`1C8{T~B=a zsdM#CboVM##83DHv}wen4c$n&6+=%=cfeXB>6ec5#V=3eP{9XZx?{j75wt_ki!L+bbl6qCKQ<@AU zEvFJD8Wmm5;}MCs2kXDd2gOQLm`75=QY#deZHc#e!93Q&Tz4Yf)Crkk@A3-Bv8Nd_ zt=r72VL{pRX7#0N60U3prSO5`}xoN+nh*=%C6&@92keUq2vTr`Z%_-$Ahh+MYZ#MBPN@uQ5 z4W@vOCmA>Oi(#T{t#D6hy1twhQ=xlzfUl%f3};^hvV5o13XHvgYX0HRlX5Pua4eJ( zQK<1z3CFEeqd&)sX)x3&`|zt$`YQDVsB*|I{qV1L;4Sq8taaEb`S7a|fspe)8JS29 zUuJx{+LA_OjWFE;KVPItaE2$Sv9A(ZD^TBQrBQ4TTjI?!jy6<%0n7$2U)e$|^sObf zOWwSwj2FV~l*Da)&5*k*cCK~qmcK9;o(R-hLH*9zt1e#h#L%dG7vExTVx4|-rb6KL z1FMt!I$qGy(vs9fM!lW`P-zAc4dSV2^pE&#SG<9_s9)1`mBQ_y``0Wp?#IP8%8Kkv zt&Z3Y?_aIkJon*$%N&fpQzn(2?FlePdb~hzY}U}!z67qN&|`d^cHz1n)rO*Vfu%4T zMs4U+Z_m50*}@8r*u;4OZrDuK@dB8Bv>6qJ*-{#}|AlClxtz4ONO$1r%b-TT;t9{- zv4nh`go37)wO$?(q)mtJkz8PNXDr6L0HZ1kphC_nKU~C#`fp7|?p%p?OR8FgLRC3Q z<)Oap?|7B|WX<7U#bFkmelzVQvOh}%s^f6VvL||~*m{Df-AIx>9tG(Oc$CRqmQ;M= z7d$AIJbM*A8W!E87LsqMSIosG(;iCtyl+)ShbohGT?6XEk~?9B)sYny6%^%CB?B~B z`Ocut|D>vqbME6#$d+^`KM(e(k}Io?6`FK6Gf3s+Xu9jhGraKsB;F;h2UDjkXGFR- zoo1oYA$J5U+!v#K&lnGktqYxS;)1|Nwb zRS`gzsM>ju80N*THYKpA7WWN2xkrTirw&o8LASOMl%4OqCl@(D8-paT_Q-|1`lo|? zx4LMSxrf;P9yhUG9*)Q8C9*UZooVOe5aG*73Gmf9_<(Bia6#IDg1tp0ivmv5pOv}n zK;iS_wdg2pOQEmsOQE30=zVpX9-YBb${kj^l9bvtS6DB!Q_JjidU~8KtSx(H0!#`Y z=%$AP#OB|Z41e=*6-=r?2}CV5e6?t;50|RY-UIUhIGX2!&=2-OE8`D{HY9;Ltk=bw zM%0(b(TleoGd)nW9&M3~vf#y9BWS*zHZQ`DHj9ib36XZuiasZoivLmC???&(n$Wg5 z)U05G>hqO5<{piV#{N(8X5q5ta9N0O!KNkgV`$k~=*z>dRko(;a7VxS3ZNsjV`c5? zH=$U$cBJW5*1PI04ZC76Gj!2qU$S^g73Tf|>T;JQ@Tc4Dt8G3w*mg9=kv9O>{I?YD zVRm2exxid!a_3;GuP=&51H}RM$wG?v1NuM|I~GV43$gJx?B3_+wuEM_JK^cR=r8ib znTcW6$nsga(FW6?fGi2v6ApSSNx?VFIhXEF3jbCxO3xzVRc=2*Rr^V3Wo}{%QE5ElDSa0shlEdskM^!OcG8%f_X;lgIrT;${ z;3y|;5gz8YeEq#~LkiWl-QQgxQBYE=ce#khyz=s0FnOIs=s-BK*DYJ} zEu6VnekWrML#GPD`Ut4WRl}=AZf}h{=?R%6E))?lfeu2INR2+kyx@-3^fL=RnPkRl zjUrbp@cWI(n=#_alJCUYOL1BImRCW{=-IlNTt_%&X-jnlT-G!Ov^EnHGKU4JTp%pJ z#ei0}j`yByk*zHKyM;2iBe=^IANd|lU9Fn;y<{xS(!Uvy%Ub4PUqjM~ zwm^77d=2RM&M-~0ET=Br8lGN5kb?qj^Ys*YOzk0Jsy{QPD}%mk1KEz++{QHGCio#d zsfpnOY~QCgwU*@`w&e>5j%LAYy|!E!3KO$fUJskzj7}M13Fz9{qq}?C#<#RLby5aM zO9%KM@NVzgxVBpu?&E5!a8MUJQ#`R{eh2p^GZbu_o1?54V#UgU^ZY!-081Pk{8ir% zK6~bEG=SV#Do|a#!VRFnayb1+=zKlIB`Y>z=$6BZD zk@ZYbS z+5BrlMb=AP6GN}L0HL@Vp}5JT7=&rE^9!DzU9oWItpA5pCWA!;(2!Q5q9>dbcS(3O zfxhXLoXlzZ{GNloHN&6iRi5ekymaT@gtKMokfe%&BacoGJj*$!KTj(B`_5=SzfoM* z|DH#Z6pkAZ5$Br%t0|Ad6xu4T#bUmsMbvs>Gi2|0bwt@Phlb)J#Ju#DOb5kf&2qPx zJ@5{cfD|Uu7Bnq&K>8aeEXt#`a^*0Ua1w+m(g(G)Q(x2^Ec&&E{WieDnD6une!V-; zr8aj?g>gI<-%7Ag2`AMR;-f$FtUa5d%A@}IFJ3J+OX z*kmTq&^tA!?~pd{{JRBe8L!B5OoPDhj!cMs|CnVN6wuSb(31+2>YBhM!?K3(FAnBD zK<(e`^)EL6I&nQ{tngEp=%nVUGSr7c>#yn0T|e#lDqzJVWYSnAs<+Qrf1PD+RF}BO z>LD4ODcvlGHm)fJ_!-V!{e>3%JVw*fSln1>aV6Bs$^_=Ka`fa@j2RcFbAwsWF_tiA zCLvBp;ymycuV`d>F^oZwTqr2n}$A zEoKMM1x$U62U76iY%r3M%OAf}GI2vFoIwhBg?VR514c|SHX9<`*-8TprbGrGcns$Y zmd142fwUhBl7ahjzKoCBDG?1|;~ha|Y?^2-_Jp`F&uZ13Y}I5HBIgtW?JV$z48CIV zZG>Mb4Ho90CMY1>iJ~luVG2p93M52 zNi7sD2oAYNYb+)7Yg0$XV&u_hnL$D^=II74s+ZIO?RA;AJw)>!k&e76o(L!Os^Sgp zd;ttv-#lF`=!2hq&Cx{~B*n8FHxgLsx7&p|CA<%2ip`Hj>!;&*-}G8n8iPuUsD|?` z0?cvwAq1PJ!yqknNu|5G_nCE(%YoJ9$L?~ulQosYAp`=c>q4Zaw^ zF<$Czm;sp?c1SlNZ^+!=hmjSL7JK&>OjjU`i9i1L*|}*L1qdA4uSDk5@BH%N-*R9B zYkU1aLB$<^zX&U#KBDuydaU3yvppq+b}po!rPZ-?5i>jUOp(*Sm~Fjh^1eMeV>ePm z;yfh1i2xTiiW>FiNXmaKidWLdWGV7c+gQxXjL8c>Kg&Z6V;vv;UQe(9H4;)dw!&Z`9I?T_B=Nr z4A`|;SIFZP-tp#0k@e(*AFoM$-g@4V$ zn!PAkC(~a~eX#~@a+32c4n#e1H|u>Rp}LU;>06?)f=VmHLWG1Av^dHtQpyn|e` zGD|P5QR;tHx(oJ%xNB%+u)c&28O8w^))~Oae>)~a|7q+TgCmU=bsgKz#GJ{*6Weyj zHacd+`_vNiB>{L8W#0-`kmHL&Fu)n* z7xBfm(z%Pl;Ele&7R3wWJET7*Gz}>?&99!Hg)rd}N1vn>2rKR7_KYfB0S>pEgPIY_ z0G_bnTNh%ql7<4iY*^zQ6;xTpTTAAYUg*FA6^KB2vZ{&jCrzn znBjNa*X^*Ie1$Hy>1d{}DOj*BJ?}SWhvN|Deoqr4wL}a1EgvkZUd16G9yn;SXNJgj z{x>nwDvF>zbwp5i(}p_0o0$8|-U~;95{TVcE;hqDXn0}eo-I)1kvPXBn3#ryUKST% zkZGIFIFT{G_rO|0FXzz%%?m~m4#bUhv&~8?A>p~?@+VkcBH_U%Y`mayyX{1jq5V}_ zBLATpKy;jpAS$Y>;Dt3Fxk|d+P>953?B$k0MX|4RKbgcup`hR%RfgaUlyee2kLL(X zLWBtW2qomMK&*$kx8iUSvs1^MHkh-3LvAfAxOb{KW%|YX)dB{7sboA->Ein+cz}X8t(9E7pZOXF=p?)8IW2jC{tWD*bfZ&gR zReO93uWE3u7`hY(LVaNB@3{s?sR!k3(S1~h_2n@}4HddCxi8gTMxzDc#4k;D=HL3Y zCPic^Di5!Q)bJJhRDpM=i|ZT|v33eKEkE^*#tP7?t;i+)aV-v}=&zD8jW3>)wp-Po z(i352(yM7h_S7pyfqlaCtonNv@M5rYD_RU>VPpoxDeP1*iz5>D5&`|6AzAZK;3Vm>5#VmW()`65AM(|1#g=Zn4)9V_7$GKbq>JXPRA2z!c|{o&pw`kPxUIA zr6nz8*5@3 z2aaR}w}jZ?7Jc{O@33iAsD0?M?ZaQ?+981{u`hmRgF%%CMeit!%`c-44Ld>!jpD70 zuL-G_X$^=7AE+lY!s;&y*YpovW!PuW1xr~?O?BR;Qqs7S)(7JA#E98%vNY)(FERB| zC{8W}bx?9If@@Lxdg>@fMnM;k-|vv6U2T&7j!BBoyyW-&1WGlXr5iGT<$Wny$mKj6+Xuw;{M^ z_XiUif}lnu`2OsrZ+AW1pFm4kA;u`F2oTx!;rvq-<=Sp2*6b;_N-- zA=ShuT_j$EU1OTCvIU?&-3j!!)vO9?mIOD@5^ z=5AK2lEg4e6>mxpNH%g#K19ZEkQ#8OY1cA#Ha4Y=8D;jRFfK~dO&Ty$DmP`*Fkf#D z#k*OmM$N1?Xk3muWS1?vhdLX$YEsv%$-Zu>8mv8#)dBmWNiiq6g&)%gBJF;ap6D@x z=^8O08^ut|WNLfYiFL2f{$yUhY{GY-X<1^+%RyHkIx^bx7;3h*LLs+sT0#{)iNE)1 z|2EN%kI!PQKxTMLF~eR>GidlXqjWD%OKzyLJfXE)SQYeke-RvvT?(ooCrh2ss4C_J zsw$YNP)sQT_KO%6=c^Z_g8*z|QfwrVmMN16EoaiUII6Pq*ij?N zawV$K>8kXai+69TY&X~ov$XLCm7g`tx$s|JE`m z4y_uJOgRqzxd*SATuH6e)0LmYjQG`Fs9d#OWLU3O=-8bfAb;~qvAf!%SdX;#p_iW> zI;mYO26-|f&7Gh$EnX?pTzhbV!E9?kaL^+_?~e+gOjb4AQPr9Jd!dpV%Hx_?rS#{K z8m*zPdRYF;#9hDO{BkHXn%AT|-R9L%)dEK~_`{yVUwWiTlk` zd={jES3+LspxpG{Q8qeXyIE1KinF1~`r>1}So*S?kzK%{-EZXETpm=u3vO9nv1C%^ zELe;{IBc3tI9sfG!mwiwZ4SRShR`Zq_CC157$5^2Qv>NL91cjW_(}NQTUZI7D3YAq zXhH|r)MR(|fNt;x4v4i9J;w?#Yk!+2agTBTlyp&hbgn7ppy{kjaZRKPJ>~MRJ5=w^ z7G?a*xz*f}uNGpTX?5~eQywL<{!`V;QGGQ=T?y7aaCb)QkITmaBGmg&lKQIB-tdcu z*fEH4sU>f>QvH=wMf~*A6e|qHA0?S-;lKaWiY{l0t*O&2>)xLUKJ z)F?p~=!%hIQ{ai#yP-Enu*Dq716i@AN(_SD!;t9Sy5pQK{AI%&Ajw)8{y`d1{vN$1 z#iP9=qPg03cFT15o%Ti^|T96lH3V#yaJzA6W@>nCqk zN2dDkMKbihxhYhkaWh)?YPvh!TJf`so!awu%dRo+ZlBE_h*IYx^_wtd>Dx4k*u?+H zw3ryEGta9G&|94%R@={~>}s{Q(lgT4Y_!zHFUq{DcG#U#7@hN|OH3>~!d}4HRcv%s zny{M=>Q(;iqq^8uoz*S(Y&#>vjjnIwQ7y|?LCPBUj{r}L*afYaGg{uqOr#sti{Z@q zmV`s@H{thsZ0^>m>^tpF5h|LqGHmMWVJ{^y>VAKn>Olx?R2IZ`68GN;p>&@-N} zw{C05$nA02r(X!xB99{z^`1=uh(6qI>+dRDJb2K>mNSX61jy~CV2L9I(rxpK-Zl5X z?sdGI6%!sQq-;()9B&O+G1(~_NRQNHSs8H%c+)Z?Z==Si>AlMa60U5$7=8BUqqo*C3H#Rgl|AUYc~Cdr@<1&n3=+y`4A+ z(Nc@LT)MEh&6WZnPhhO3Dx@3#U=d!c8pO0CKeuTvAD6x*<7B4&Si9->`U8x zv`)wP`n0h2pYj2So2?nKt*PN5^>wAn&-xbVI|T<;Z9!p5Z;J%HG&N>JRJ-S;SIBg1 zFNPL{^8;BF%ls+juT+zms3z}HpZo#^j4d5L6fd+B`Q5^HKQJV8b{#bLb!hp?Cn~I* ze$-7u)_+ySZrhOIedgZ)Un=qZV_Dk<=DTwtglP^m7kRd6e&O2#XZ5nN~ zF4z+t$aYN=m`g|31f;p55+huf&K(J#=!w@+Or4)AJcJiQo5uZ%$OFR61)?}H@>`Xy zHM1lHcOgvr%kvV4AsE_euF-H_1_BRh23o?02#6iJZ!bwUO=bc*o5-GSlMZP#I;2ac z)&#|)ie;wleSFUB&1MPJs>Z&>hDzs#%T7M2KsQP|mZ}3N$OmZ*YgybQsQYG>M_WvR ziO&Yg;!L{y^GbjLne4fDe5C$9dg%9VtgM{1Axod96(k=4j?Bezep*qM8FzYvS0KYw(tU_e4PGpVW3f&uXe1QJw;W94ai})? zgPx}=;;L||sj+P4Th_;LU!&A6KndB<*T^xH$R~SM7k#J$`8j&TAYRM(pk2aq7fUEN zsK;?`+yP-;9~k|Eh748pjdlA)>LEfWLzvFRcx%&RV2Q3JJ$rhirG9HN8CdwiJ9;m7 zR^{AePUBTw(Ca1(rz7=T|8|r$<*|fOX&ytRBf6KO!&fYkrMm~6ti)YKH-bAWcv#3q z0^Jb5Fl<{_6NU+p5=;>7Jph#m4o2ap9}0|wopS4(0ln_REi2u{4&tz*{>joMW9NTP z%a8-A*a61=r3(yK1xZu%+@*DxuX>F7xW}^8QCCaQ7}uP{EqOq>^NoRaG6vUg{&HBQ z^CO5E6TE_J-PnKdatrlJm)B3vf4e?;w#$wVOW)ZUcro$+%sy*&9W(6h_Hr+r?*Y1JBw;cb} zRdL@$&m1ZpjZ`CFK0*J`ODc)22<>g zjkM+D2OPj1d(H4pKTDv+2+1aOGBJ%3^2=_O3k)M3UYEs=-?;zZF|`yX-8BCN?F_ezeKK}1dx(P48Z}!8OpIc4Kb%Ovoov)>BB+GW zVUE!~sb*aSU>D;L?sjhWAy&ly$y*k%ctBa}_7PUT|MdE(q~1vTtob$OCTm367S7NU z=8ZC1WO0@<$7VacPdPJZ41+5g;@J%2BIufbnB~N_P1HH34bwn8;c4U_@pntFdvbv6 zeiqk@zey%9k&X6)5fGb%!3!MggSc}8hV>I;o&$R`?PuyC5q#14YHOiq_#K(VW_)@# z)_;gRe~R)j6}6Xhmvr0v3)w5k*=4_zE*XfqD%elGgSR#Tu5$g7hF19S(+3r=Rx!Cg;(lc~v2Ab2O4gDY1(7|^c z;kX|I?C!CrRZF=&?HiVsu6I-#t>vz#gR9mwG=dI?pvGWQlGlF`cJ<+$tV|xSm4n}) z0<^?foh#BNKB>ol5OyriJ@3~UJfPTjJQ1Z3Ek~omya0Rhu$v~pA(|I0wkP&KbQG;g zu%PfhnBt!#Sfk>&HG8J%>r`Lhc}9MH7*E*53}BCGy7S^u>tmg01mn3%)R4&EY~T%6 z9P90MYX4=WxPuz^mqmGVyhx1QDN<>(a7&^EI;Pqv5g4_8`o9P}bWq3-kWuHtRhjv* z5g0i_JH}Q-*X_U2NU_iDSZjfE?PCNXzob)8ljiBzus5b&j3BcH%F&ElF zNNRc}O=CKGE=(ZSAEKC!fo~u(bVRg4yf;t}^G8~IT{3Hh?~f#pPk}MgpU4KGsKcI^ z^R8KYuE9avM}PNPa2m|>2~MUW{DMN@+twa?`K7I>$n~$h4C58F5h_a-GU-SCq;-AN zBj2A2)LpH)_AUrnV%v0w{Wa8$zx{yW>o?0m_K29}CAfo7n^)~(S&)NH_HVD3IduDo zqUs!1Q#NG>^S!1<+Qsm>O0^`WwyX=4rVL8Dbp~*@-~A#`TE$z4?Lx!A;*}9Y@8LV* zaE#>ND;|zjQ&rflkgihBE!3sz!_5$xYIX`9TWa9!f!Aq zXK&C4S+}@jr|)C^juvR4-kQ+VDU%9v?=|Q7{80h;Nc(p_mQciajfc_NN#Y%>ZnNpH zHTGNaJ3rS_vDKu9>eil*U$1h?WbyUlIydK9BZS^5i& zY(rhvI*Ns7YogTg5Gy7-`nYaV?vPmkG$$uEGs)f*QkS1F&WmWxIK2o53n`-_>+@%G zhF1~gNHK^m69R!a;KC|}ff75}w)f?Kfc+U0o`m+Y`u=jR$?cRDsi5zf{t^{6N;{|F zFEx7cVYs%(MRAg3{{Z{xbH$9sWk$6B2KH+|=NBA5h0SDRWVWrGL>M*NFiUC6&f%1G zXG@flI=)R$y{Qi*PzG-Y{x-O*SoWNLf6!;XsO4S2pdnaM-0Zs9C%k;|pA45u{E(3` z&zW}jHROCfOisRT*rNUEc||99Q(7eFvd zLGOG@Cq_p^O0-S*8dwh zeD;i!HAr=~EG)9$8p-*zgYlV9*D!Ka#{%vp#(gNTw`R!u!gZ#-`aEDRfZW>n6bCB> z2ci&F#QK1a9&=24!2oh(Vl@seAFYJ~5F)dBU!BATpdw_BGr*Gh5kD7}rbNIyw0dJP zNQKiM)#U`J*{WStV6>H!^fFMz(skG8LH@L{3Pr=T8_mBjxtG7yyya|ZBRKVim#Wva z3rdwhjxFxdFR@o*v!J52c2MdhBd6al9Z-o` zR!9TbtEkQf*>NZ}W2<>npEP2C}vOzLHR9 zxCi|nG$fG*euvv<^_bJ&0ti{~(6T_^x_9?# z0FT;oAT@?##%(v*VX5x?vlo0I3|PIN=%1ecw2 zT~$XCx<=UGch8vg%=F#G{{ds@;%ILm1h+$Pi1WvFlcj(AHKPDauDggLO$06SR~H#9 zh9;Wm?*)xfz864^;AtUV1zqqPYoL8!?*>E?2Ipa~0~c&e?`#BtIe0K5|IY|2qJ|f`SgeIuxFz`g~k?Z^;0zSc}tw-5D{SB2a1PWT@)zr z5SXh_bQHz!hgaE*4`uUq*@$`+C3z+X+&k@T%5@FcFLH>E;~1>F-bMB`xV;@PHb169 zLns}67a9(^YmYz1lNx-cW8L=9giu|QOJg9SAuT{ggp&yF{IvV~HGH}>tUaWKzI?6r z7h=ig2E^l&^$a3Y%kxM&w{A9KUMlue)aoEBbEfpP< z`V}Kah%J?PuEow(bX1s<0C0Q@1)#miwd%IAjiUlkC8IPSoOC^cB2%zR?Eb~)MQ?2N zM2~tVxB4W_pau-VUcU;7r)6<${&?P+HyiJq`T;Ri0IqIGEait0_=uaAYVn;8Qh5)E z^L<7~BUJ}c!AgWt$H)!Ts2}D!VxxTMPavBej7;oon30}8O%6JtBj2cJ>I#cv7vjuo zS{!ZhC~hWOTB{#7H}c%|`a0Pw3g8&aTN7)~%M0*tl?m1(jMt!n1pPb2|@W z>}gbihOrmkCEb+_3Bi12UWcYY?-Y5<1JfJsM4SZ~W}|JL>92l0^R9=L$o{(wQyqKK zJF{hBCH@yrmM-=Ckns|9PnD(^JG|1 z&=VFY#qry&`1NzPs?rCqT-$PyV7A7_#P1kHG6h=W|8-bWaHFFPYY&cCNz<|9FW1cq zrx+`=o)w$g*tKG0Sht3>^vYas!6s7^|5D%`OLr@s8{+wcd1;M$Zj0L$$2DMp*bQ(c zoS*ii02?aLH-7v+9MXF42nYCay)^p%c0KQFYlj>v@b*KXH8fhS7dr|E2}f)Dx!9cZ zcFZ8=v0=_n{U1dUQxnNlgM*c1@vc5%(LH~}h(XctjG39zRJ&UKAp+HmQ^3!v)NLTj zThBkuPYGjDc)Tle>^Fp0Fd?-qym6NQz4<8^%7@3gDJ0s^xN{#hKEMNi@TR7rSRm&m zE5a3j&wJbLDE8L_#?WURe<)3Iq0}&mkP}L`ez`2%8pw-Zht%BSN%AciZYu=5)G6C# z@%)1@mQ?lgI2f?w`H0n*&f@eezSI8v=F`@JcdMJXq6+1WXBLfNC4E~MYr*Dzd^&9? zU#iz0VYaBx!AQ8=?dH@nyINSwFn44*z1<2&e(2>j6qE%a2iQLKKie3FvIa!oucEvX z3M8oOkL5Dl^BT#3;y9ez2Bi%+8&_e`LjTkKBsf#d0CpJ$tH7Gx-HeCSfQpelbHYBz zEZvW8$w=n+%ahAHg||uQj`HB7?;X2wbsxeAs+{kBmfMtwTU+WP4RSgUi!=3O*GBvQ zV}B9_rgKiTvocw5rQj$uW!3$^ z`r)R|=Kj&cuFxiPqw?%nA=^`NTZaWo7XM0f7YBNxG0y@y(|k^9d8P5pZix)<4eJCa zjB95H4>wwzOTGH`&3sZB_&CeV4Y}nM52of#kf4?JFwL_U5@)~Xs=m7}xwn;G z)`V$W)f3Iium6z{Ah7k=H_E*Jih4z0NGB>;bB#mLFi*7{+{4EuXM2Rou$HY~#0!9| z!md?9WC8h5@6!|?cj-(Yu5|CyJAbI4h9A#mN*m_2H>HHe)b%m&ajz9E8)JO=2 zmk>69b|~zU5cTeuupN(^p@tddZop5h_v*+k4CL;AwXk}VzlE{}bWRrH7xMJwDUWUu z&O9c8BgwvgLyJ7G{OYW(O#|QlnTLXrlz#O?o%G2pk1~**H&G~8$C#QQlR9!219_;#7MNjq9%NzAXqRh|i zM;}pFQujr%DVCn8Q_4nB_BnmtqT6m@|!Z4G0n{k-KY?Skrg_1e~1^N88;bxdMd zh9igzqPz${+W>o#KBJY>Cf-71^k~q?su!rj;(VcPui-bdsr{9sBJB5W&G2l#hPx~K!!`=97h981L|MVM1a4JfE1s8~D(n&v1_knIQfu|U`Wv1GU z9is}_%TQchpZ`L1cbbE#od-vSZCLzQZrDfohT*)E<>jCBhuje$)3t+$Hw|_F!2K1g z18EP&g0k~qJ~TkPJxI34Eqh^2pB#PqT)Rs{k%u0)%338HpBeoJ+mVtpCU3-aGdOUT-#Koa`h5UvK`1y)G9?l&h)e#A))S}ea$Z&sjP(m9P?IDn^@F356_7H z8OTnac^gpIeOL^zv~k$&$tv zDws!=(i&Z8kqTTe8UkDc&$m|{zHJeEyts0X(?zA*u0 z#oGo-o3N3rCmRmIdN!4*cWK~YZFOfXT8T3fi9n`d|DS$YrXKc*={VtJGcu~=Pb$y? z27KpA3C@1>HyH(1d|Sn)GCRfyyvMgFpU_>X=kfS4WnnhF!sbzN>mopJLks~%J5o5n0D%pO7^0d$&(3+H<8*nF zl%AO{G}9K|EUsE~$0h|99o`kw=LT#&vzz$IZO3cbdY$w2wEI67QEZbh)-UdUS3SSo zh4Ksmi6}$`2luj<-4eeu6GdVK+lz0}1HS%nQ?$8UnsJfArw_OjnY!O49s5c?>WiGO z#~vN_=^MWl%dxnU}{8`qL@|#&1GvaHbaWnq~``t>X16kzQ;Axd# zQQ82t4=s4>8C0FU03%}SX2-7V7jGg#*tzrDB-_(|%~IM8HH@k_TjM`YZTqOAD+rv) zBZ|80zlDA~szbYtGs9lv0kYEluON1+d(N!9n6&Joe79bNe~vv3*d$fmraWH|!ZD)h zk#-5X{hb6ofEa}PKOOj^-7V-=2m%|(>{dYic+Ae4B$K{l>QU+(X(Eer(j}D_PW<*c zS>jHTpU~_xIvbiEv{@q1>F;k96GP2{h!*biMb{UPo*VBiPw{CK1}k6hI7eMHz4i zEHErEFfcf<7i$&W$A+T)B_uGgX&x{z+>g\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities. \n\nThis solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.\n\n**Data Connectors:** 4, **Parsers:** 4, **Workbooks:** 1, **Analytic Rules:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities. \n\nThis solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.\n\n**Data Connectors:** 4, **Parsers:** 4, **Workbooks:** 1, **Analytic Rules:** 2, **XDR Detections:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,6 +51,54 @@ } ], "steps": [ + { + "name": "contentSelection", + "label": "Content selection", + "elements": [ + { + "name": "DeployAnalyticsRule", + "type": "Microsoft.Common.CheckBox", + "label": "DeployAnalyticsRule", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + }, + { + "name": "DeployPlaybook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployPlaybook", + "defaultValue": true, + "toolTip": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve." + }, + { + "name": "DeployWorkbook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWorkbook", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + }, + { + "name": "DeployDataConnector", + "type": "Microsoft.Common.CheckBox", + "label": "DeployDataConnector", + "defaultValue": true, + "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + }, + { + "name": "DeployCustomDetection", + "type": "Microsoft.Common.CheckBox", + "label": "DeployCustomDetection", + "defaultValue": false, + "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + }, + { + "name": "DeployParser", + "type": "Microsoft.Common.CheckBox", + "label": "DeployParser", + "defaultValue": true, + "toolTip": "Deploy the parsers and their registrations carried by this solution." + } + ] + }, { "name": "dataconnectors", "label": "Data Connectors", @@ -236,7 +284,13 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]" + "workspace": "[basics('workspace')]", + "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", + "DeployPlaybook": "[steps('contentSelection').DeployPlaybook]", + "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", + "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]", + "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]", + "DeployParser": "[steps('contentSelection').DeployParser]" } } } diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json index d2732d1803f..2e756044beb 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json @@ -49,13 +49,55 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployPlaybook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployParser": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the parsers and their registrations carried by this solution." + } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "CrowdStrike Falcon Endpoint Protection", - "_solutionVersion": "3.4.3", + "_solutionVersion": "3.4.4", "solutionId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "CrowdstrikeReplicatorv2", @@ -77,7 +119,7 @@ "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.4.3", + "dataConnectorCCPVersion": "3.4.4", "_dataConnectorContentIdConnectorDefinition3": "CrowdStrikeFalconS3CCPDefinition", "dataConnectorTemplateNameConnectorDefinition3": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition3')))]", "_dataConnectorContentIdConnections3": "CrowdStrikeFalconS3CCPDefinitionConnections", @@ -175,7 +217,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.4.3", + "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -371,7 +413,8 @@ "contentProductId": "[variables('_dataConnectorcontentProductId1')]", "id": "[variables('_dataConnectorcontentProductId1')]", "version": "[variables('dataConnectorVersion1')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -401,7 +444,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", @@ -548,7 +592,8 @@ "id": "[variables('_uiConfigId1')]", "additionalRequirementBanner": "These queries and workbooks are dependent on a parser based on Kusto to work as expected. Follow the steps to use this Kusto functions alias **CrowdstrikeReplicator** in queries and workbooks [Follow steps to get this Kusto functions>](https://aka.ms/sentinel-crowdstrikereplicator-parser)." } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -559,7 +604,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.4.3", + "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -727,7 +772,8 @@ "contentProductId": "[variables('_dataConnectorcontentProductId2')]", "id": "[variables('_dataConnectorcontentProductId2')]", "version": "[variables('dataConnectorVersion2')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -757,7 +803,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", @@ -879,7 +926,8 @@ ], "id": "[variables('_uiConfigId2')]" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -1237,7 +1285,8 @@ ], "isConnectivityCriteriasMatchSome": false } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition3')))]", @@ -10480,7 +10529,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition3'))]", @@ -10820,7 +10870,8 @@ ], "isConnectivityCriteriasMatchSome": false } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition3')))]", @@ -10855,7 +10906,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -10980,7 +11032,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -11357,7 +11410,8 @@ ], "isConnectivityCriteriasMatchSome": false } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition4')))]", @@ -15870,7 +15924,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition4'))]", @@ -16229,7 +16284,8 @@ ], "isConnectivityCriteriasMatchSome": false } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition4')))]", @@ -16264,7 +16320,8 @@ } ] } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17001,7 +17058,8 @@ "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", "version": "[variables('dataConnectorCCPVersion')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17012,7 +17070,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeFalconEventStream Data Parser with template version 3.4.3", + "description": "CrowdStrikeFalconEventStream Data Parser with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -17082,7 +17140,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", "version": "[variables('parserObject1').parserVersion1]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -17103,7 +17162,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -17133,7 +17193,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17144,7 +17205,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdstrikeReplicator Data Parser with template version 3.4.3", + "description": "CrowdstrikeReplicator Data Parser with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -17214,7 +17275,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '2.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '2.0.0')))]", "version": "[variables('parserObject2').parserVersion2]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -17235,7 +17297,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -17265,7 +17328,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17276,7 +17340,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeReplicatorV2 Data Parser with template version 3.4.3", + "description": "CrowdStrikeReplicatorV2 Data Parser with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -17346,7 +17410,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '1.0.0')))]", "version": "[variables('parserObject3').parserVersion3]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -17367,7 +17432,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -17397,7 +17463,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17408,7 +17475,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeApi Data Parser with template version 3.4.3", + "description": "CrowdStrikeApi Data Parser with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject4').parserVersion4]", @@ -17478,7 +17545,8 @@ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", "version": "[variables('parserObject4').parserVersion4]" - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", @@ -17499,7 +17567,8 @@ "value": "" } ] - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -17529,7 +17598,8 @@ "tier": "Microsoft", "link": "https://support.microsoft.com" } - } + }, + "condition": "[parameters('DeployParser')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17540,7 +17610,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeFalconEndpointProtection Workbook with template version 3.4.3", + "description": "CrowdStrikeFalconEndpointProtection Workbook with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -17617,7 +17687,8 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - } + }, + "condition": "[parameters('DeployWorkbook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17628,7 +17699,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CriticalOrHighSeverityDetectionsByUser_AnalyticalRules Analytics Rule with template version 3.4.3", + "description": "CriticalOrHighSeverityDetectionsByUser_AnalyticalRules Analytics Rule with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -17645,7 +17716,7 @@ "description": "Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.", "displayName": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", "enabled": false, - "query": "let timeframe = 1h;\nlet threshold = 15; // update threshold value based on organization's preference\nlet NotableEvents = CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity in (\"Critical\", \"High\")\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message\n| where Total > threshold;\nNotableEvents\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity\n", + "query": "let CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\nlet threshold = 15; // update threshold value based on organization's preference\nlet NotableEvents = CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity in (\"Critical\", \"High\")\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message\n| where Total > threshold;\nNotableEvents\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -17656,10 +17727,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -17713,16 +17784,16 @@ } ], "customDetails": { - "FileName": "FileName", - "DstHostName": "DstHostName", "DstUserName": "DstUserName", - "FileHash": "FileHash", + "SrcIpAddr": "SrcIpAddr", "Total": "Total", - "SrcIpAddr": "SrcIpAddr" + "DstHostName": "DstHostName", + "FileHash": "FileHash", + "FileName": "FileName" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "CrowdStrike critical/high detections by user: {{DstUserName}}", - "alertDescriptionFormat": "User {{DstUserName}} generated {{Total}} critical/high detections from host {{DstHostName}}." + "alertDescriptionFormat": "User {{DstUserName}} generated {{Total}} critical/high detections from host {{DstHostName}}.", + "alertDisplayNameFormat": "CrowdStrike critical/high detections by user: {{DstUserName}}" } } }, @@ -17766,7 +17837,8 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17777,7 +17849,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CriticalSeverityDetection_AnalyticalRules Analytics Rule with template version 3.4.3", + "description": "CriticalSeverityDetection_AnalyticalRules Analytics Rule with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -17794,7 +17866,7 @@ "description": "Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident for each matching result.", "displayName": "Common Event Format (CEF) via AMA - Critical Severity Detection", "enabled": false, - "query": "let timeframe = 1h;\nCrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity == \"Critical\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo\n", + "query": "let CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\nCrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity == \"Critical\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -17805,10 +17877,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CefAma", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CefAma" } ], "tactics": [ @@ -17865,19 +17937,19 @@ } ], "customDetails": { - "DetectionSourceIp": "SrcIpAddr", - "DetectionTechnique": "Technique", - "DetectionCount": "Total", - "DetectionUser": "DstUserName", - "DetectionActivity": "Activity", "DetectionFilePath": "FilePath", "DetectionMessage": "Message", + "DetectionSourceIp": "SrcIpAddr", "DetectionFileName": "FileName", - "DetectionHost": "DstHostName" + "DetectionCount": "Total", + "DetectionUser": "DstUserName", + "DetectionTechnique": "Technique", + "DetectionHost": "DstHostName", + "DetectionActivity": "Activity" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "CrowdStrike critical detection on {{DstHostName}}", - "alertDescriptionFormat": "CrowdStrike reported {{Total}} critical detection(s) on {{DstHostName}} for {{DstUserName}}." + "alertDescriptionFormat": "CrowdStrike reported {{Total}} critical detection(s) on {{DstHostName}} for {{DstUserName}}.", + "alertDisplayNameFormat": "CrowdStrike critical detection on {{DstHostName}}" } } }, @@ -17921,7 +17993,8 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -17932,7 +18005,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike_Base Playbook with template version 3.4.3", + "description": "CrowdStrike_Base Playbook with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -18298,7 +18371,8 @@ "contentProductId": "[variables('_playbookcontentProductId1')]", "id": "[variables('_playbookcontentProductId1')]", "version": "[variables('playbookVersion1')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -18309,7 +18383,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Crowdstrike-EndpointEnrichment Playbook with template version 3.4.3", + "description": "Crowdstrike-EndpointEnrichment Playbook with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -19753,7 +19827,8 @@ "contentProductId": "[variables('_playbookcontentProductId2')]", "id": "[variables('_playbookcontentProductId2')]", "version": "[variables('playbookVersion2')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -19764,7 +19839,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Crowdstrike-ContainHost Playbook with template version 3.4.3", + "description": "Crowdstrike-ContainHost Playbook with template version 3.4.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -20872,19 +20947,20 @@ "contentProductId": "[variables('_playbookcontentProductId3')]", "id": "[variables('_playbookcontentProductId3')]", "version": "[variables('playbookVersion3')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.4.3", + "version": "3.4.4", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "CrowdStrike Falcon Endpoint Protection", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The CrowdStrike Falcon Endpoint Protection solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.

\n

This solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.

\n

Data Connectors: 4, Parsers: 4, Workbooks: 1, Analytic Rules: 2, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The CrowdStrike Falcon Endpoint Protection solution allows you to easily onboard CrowdStrike Falcon Endpoint Protection to Microsoft Sentinel. The data collected can be used to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.

\n

This solution contains multiple Data Connectors that help ingest Falcon Data Replicator logs, Adversary Intelligence & other more specific data from CrowdStrike. Carefully review the capabilities of each connector and configure/enable the most relevant connector based on specific requirements.

\n

Data Connectors: 4, Parsers: 4, Workbooks: 1, Analytic Rules: 2, XDR Detections: 2, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -20981,6 +21057,16 @@ { "kind": "Solution", "contentId": "azuresentinel.azure-sentinel-solution-commoneventformat" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "version": "3.4.3" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "version": "3.4.3" } ] }, @@ -20996,6 +21082,447 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "CrowdStrikeFalconEndpointProtection-CD-xdr-4465ebde-b38-885b1f00", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "id": "[if(true(), 'xdr-4465ebde-b381-45f7-ad08-7d818070a11c', 'xdr-4465ebde-b381-45f7-ad08-7d818070a11c')]", + "schedule": { + "frequency": "PT1H" + }, + "queryCondition": { + "queryText": "let __xdr_inline_CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\nlet threshold = 15; // update threshold value based on organization's preference\nlet NotableEvents = __xdr_inline_CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity in (\"Critical\", \"High\")\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message\n| where Total > threshold;\nNotableEvents\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity" + }, + "detectionAction": { + "alertTemplate": { + "title": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "customDetails": { + "DstUserName": "DstUserName", + "SrcIpAddr": "SrcIpAddr", + "Total": "Total", + "DstHostName": "DstHostName", + "FileHash": "FileHash", + "FileName": "FileName" + }, + "tactics": [ + { + "techniques": [ + { + "technique": "T1489" + } + ], + "tactic": "Impact" + } + ], + "description": "'Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.'", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "IPCustomEntity" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "nameColumn": "HostCustomEntity" + } + ] + }, + "severity": "high" + } + }, + "displayName": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "contentVersion": "3.4.3" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-4465ebde-b381-45f7-ad08-7d818070a11c')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'CrowdStrikeFalconEndpointProtection-CD-xdr-4465ebde-b38-885b1f00')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "id": "[if(true(), 'xdr-4465ebde-b381-45f7-ad08-7d818070a11c', 'xdr-4465ebde-b381-45f7-ad08-7d818070a11c')]", + "schedule": { + "frequency": "PT1H" + }, + "queryCondition": { + "queryText": "let __xdr_inline_CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\nlet threshold = 15; // update threshold value based on organization's preference\nlet NotableEvents = __xdr_inline_CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity in (\"Critical\", \"High\")\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message\n| where Total > threshold;\nNotableEvents\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity" + }, + "detectionAction": { + "alertTemplate": { + "title": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "customDetails": { + "DstUserName": "DstUserName", + "SrcIpAddr": "SrcIpAddr", + "Total": "Total", + "DstHostName": "DstHostName", + "FileHash": "FileHash", + "FileName": "FileName" + }, + "tactics": [ + { + "techniques": [ + { + "technique": "T1489" + } + ], + "tactic": "Impact" + } + ], + "description": "'Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.'", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "IPCustomEntity" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "nameColumn": "HostCustomEntity" + } + ] + }, + "severity": "high" + } + }, + "displayName": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "contentVersion": "3.4.3" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "contentKind": "CustomDetection", + "displayName": "Common Event Format (CEF) via AMA - Critical or High Severity Detections by User", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-4465ebde-b381-45f7-ad08-7d818070a11c','-','3.4.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-4465ebde-b381-45f7-ad08-7d818070a11c','-','3.4.3')))]", + "version": "3.4.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-4465ebde-b381-45f7-ad08-7d818070a11c", + "contentVersion": "3.4.3", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "CrowdStrikeFalconEndpointProtection-CD-xdr-f7d298b2-726-b76cade2", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "id": "[if(true(), 'xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527', 'xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527')]", + "schedule": { + "frequency": "PT1H" + }, + "queryCondition": { + "queryText": "let __xdr_inline_CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\n__xdr_inline_CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity == \"Critical\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo" + }, + "detectionAction": { + "alertTemplate": { + "title": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "customDetails": { + "DetectionFilePath": "FilePath", + "DetectionMessage": "Message", + "DetectionSourceIp": "SrcIpAddr", + "DetectionFileName": "FileName", + "DetectionCount": "Total", + "DetectionUser": "DstUserName", + "DetectionTechnique": "Technique", + "DetectionHost": "DstHostName", + "DetectionActivity": "Activity" + }, + "tactics": [ + { + "techniques": [ + { + "subTechniques": [ + "T1204.002" + ], + "technique": "T1204" + } + ], + "tactic": "Execution" + } + ], + "description": "'Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident for each matching result.'", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "IPCustomEntity" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "nameColumn": "HostCustomEntity" + } + ] + }, + "severity": "high" + } + }, + "displayName": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "contentVersion": "3.4.3" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'CrowdStrikeFalconEndpointProtection-CD-xdr-f7d298b2-726-b76cade2')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident for each matching result.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "status": "disabled", + "id": "[if(true(), 'xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527', 'xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527')]", + "schedule": { + "frequency": "PT1H" + }, + "queryCondition": { + "queryText": "let __xdr_inline_CrowdStrikeFalconEventStream = () {\nCommonSecurityLog\n| where DeviceVendor == \"CrowdStrike\" and DeviceProduct == \"FalconHost\"\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3)\n// Additional Extensions\n| extend EventType = extract(@\"cat=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Outcome = extract(@\"outcome=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n Technique = extract(@\"reason=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n PatternDisposition = extract(@\"CSMTRPatternDisposition=([^;]+)(\\;|$)\",1,AdditionalExtensions),\n SessionStartTime = unixtime_seconds_todatetime(toint(extract(@\"sessionStartTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions))),\n SessionEndTime = unixtime_seconds_todatetime(toint(extract(@\"sessionEndTimestamp=([^;]+)(\\;|$)\",1,AdditionalExtensions)))\n| extend EventType = coalesce(column_ifexists(\"DeviceEventCategory\",\"\"),EventType),\n Outcome = coalesce(column_ifexists(\"EventOutcome\",\"\"),Outcome),\n Technique = coalesce(column_ifexists(\"Reason\",\"\"),Technique)\n// Device Custom Number Values\n| extend ParentProcessId = iif(DeviceCustomNumber1Label == \"ParentProcessId\" , DeviceCustomNumber1, toint(\"\")),\n ChildProcessId = iif(DeviceCustomNumber2Label == \"ProcessId\" , DeviceCustomNumber2, toint(\"\")),\n Offset = iif(DeviceCustomNumber3Label == \"Offset\", DeviceCustomNumber3, toint(\"\"))\n| project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3\n// Device Custom Date Values\n| extend EventTimestamp = iif(DeviceCustomDate1Label == \"Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n ExeWrittenTime = iif(DeviceCustomDate1Label == \"ExeWrittenTimestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DnsRequestTime = iif(DeviceCustomDate1Label == \"DNS Request Time\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n NetworkAccessTime = iif(DeviceCustomDate1Label == \"Network Access Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n DocAccessTime = iif(DeviceCustomDate1Label == \"DocAccessTimestamp\" or DeviceCustomDate1Label == \"Document Accessed Timestamp\", todatetime(DeviceCustomDate1), todatetime(\"\")),\n HashSpreadingEventTime = iif(DeviceCustomDate2Label == \"HashSpreadingEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\")),\n HashSpreadingSensorTime = iif(DeviceCustomDate2Label == \"HashSpreadingSensorEventTime\", todatetime(DeviceCustomDate2), todatetime(\"\"))\n| project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2\n// Device Custom String Values\n| extend ScanResultName = iif(DeviceCustomString1Label == \"ScanResultNam\", DeviceCustomString1, \"\"),\n WrittenExeFileName = iif(DeviceCustomString2Label == \"WrittenExeFileName\", DeviceCustomString2, \"\"),\n QuarantineFileSHA256 = iif(DeviceCustomString2Label == \"QuarantineFileSHA256\", DeviceCustomString2, \"\"),\n ScanResultEngine = iif(DeviceCustomString2Label == \"ScanResultEngine\", DeviceCustomString2, \"\"),\n AccessedDocFileName = iif(DeviceCustomString2Label == \"AccessedDocFileName\", DeviceCustomString2, \"\"),\n WrittenExeFilePath = iif(DeviceCustomString3Label == \"WrittenExeFilePath\", DeviceCustomString3, \"\"),\n AccessedDocFilePath = iif(DeviceCustomString3Label == \"AccessedDocFilePath\", DeviceCustomString3, \"\"),\n QuarantineFilePath = iif(DeviceCustomString3Label == \"QuarantineFilePath\", DeviceCustomString3, \"\"),\n ScanResultVersion = iif(DeviceCustomString4Label == \"ScanResultVersion\", DeviceCustomString4, \"\"),\n CommandLine = iif(DeviceCustomString5Label == \"CommandLine\", DeviceCustomString5, \"\"),\n FalconHostLink = iif(DeviceCustomString6Label == \"FalconHostLink\", DeviceCustomString6, \"\")\n| project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6\n// Data Field Normalization\n| project-rename DstHostName = DestinationHostName,\n DstNtDomain = DestinationNTDomain,\n DstUserName = DestinationUserName,\n DstIpAddr = DestinationTranslatedAddress,\n SrcMacAddr = SourceMACAddress,\n SrcIpAddr = SourceIP\n| extend EventType = iif(DeviceEventClassID == \"DetectionSummaryEvent\" or DeviceEventClassID contains \"Detection Summary Event\", \"DetectionSummaryEvent\", EventType),\n ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)),\n SensorId = extract(@\"/detail/([^/]+)\\/\",1,FalconHostLink),\n Severity = case(LogSeverity == 1, \"Informational\",\n LogSeverity == 2, \"Low\",\n LogSeverity == 3, \"Medium\",\n LogSeverity == 4, \"High\",\n LogSeverity == 5, \"Critical\",\n LogSeverity)\n};\nlet timeframe = 1h;\n__xdr_inline_CrowdStrikeFalconEventStream\n| where TimeGenerated > ago(timeframe)\n| where EventType == \"DetectionSummaryEvent\"\n| where Severity == \"Critical\"\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message\n| extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = \"MD5\"\n| project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo" + }, + "detectionAction": { + "alertTemplate": { + "title": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "customDetails": { + "DetectionFilePath": "FilePath", + "DetectionMessage": "Message", + "DetectionSourceIp": "SrcIpAddr", + "DetectionFileName": "FileName", + "DetectionCount": "Total", + "DetectionUser": "DstUserName", + "DetectionTechnique": "Technique", + "DetectionHost": "DstHostName", + "DetectionActivity": "Activity" + }, + "tactics": [ + { + "techniques": [ + { + "subTechniques": [ + "T1204.002" + ], + "technique": "T1204" + } + ], + "tactic": "Execution" + } + ], + "description": "'Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident for each matching result.'", + "entityMappings": { + "ips": [ + { + "id": "[if(true(), 'ip1', 'ip1')]", + "addressColumn": "IPCustomEntity" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "nameColumn": "HostCustomEntity" + } + ] + }, + "severity": "high" + } + }, + "displayName": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "contentVersion": "3.4.3" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "contentKind": "CustomDetection", + "displayName": "Common Event Format (CEF) via AMA - Critical Severity Detection", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527','-','3.4.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527','-','3.4.3')))]", + "version": "3.4.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", + "packageVersion": "3.4.4", + "contentId": "xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527", + "contentVersion": "3.4.3", + "requiredWorkloads": [ + { + "workload": "sentinel", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "requiredDataConnectors": [ + { + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-e73b7985-462c-4cc7-922e-ffa9e9254759-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/testParameters.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/testParameters.json index 9af88146df7..154a0e63be1 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/testParameters.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/testParameters.json @@ -42,5 +42,47 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployPlaybook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + }, + "DeployParser": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the parsers and their registrations carried by this solution." + } } } diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md b/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md index ebc686a9f50..7a498b68a8a 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------------------| +| 3.4.4 | 20-10-2026 | Added two disabled Defender XDR Custom Detections alongside the existing Microsoft Sentinel content. Defender Workbook drafts remain excluded pending review. | | 3.4.3 | 06-10-2026 | Updated the CrowdStrike API connector DCR naming and configuration, and added upgrade guidance for V2 tables. | | 3.4.2 | 25-09-2026 | Added the CrowdStrike API parser to the solution package | | 3.4.1 | 25-08-2026 | Fixed the broken **Deploy to Azure Gov** badge image across **Data Connector** and **Playbook** docs | diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/SolutionMetadata.json b/Solutions/CrowdStrike Falcon Endpoint Protection/SolutionMetadata.json index 8bc1c36ed70..8d6b5c053d3 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/SolutionMetadata.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/SolutionMetadata.json @@ -1,16 +1,23 @@ { - "publisherId": "azuresentinel", - "offerId": "azure-sentinel-solution-crowdstrikefalconep", - "firstPublishDate": "2022-06-01", - "providers": ["Crowdstrike"], - "categories": { - "domains" : ["Security - Threat Protection","Security - Automation (SOAR)"], - "verticals": [] - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } -} \ No newline at end of file + "trackingId": "pid-e73b7985-462c-4cc7-922e-ffa9e9254759-partnercenter", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-crowdstrikefalconep", + "firstPublishDate": "2022-06-01", + "providers": [ + "Crowdstrike" + ], + "categories": { + "domains": [ + "Security - Threat Protection", + "Security - Automation (SOAR)" + ], + "verticals": [] + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "version": "3.4.4" +} diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml new file mode 100644 index 00000000000..b44761b0568 --- /dev/null +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalOrHighSeverityDetectionsByUser.yaml @@ -0,0 +1,258 @@ +schemaVersion: 1.0.0 +version: 3.4.3 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CefAma + dataTypes: + - CommonSecurityLog +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CefAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 4465ebde-b381-45f7-ad08-7d818070a11c + path: Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml + version: 1.0.6 + querySha256: 9f061790b0666ec4a90fcd70b7f58a388d595ce0a0228bd4f9e10dde1fee8259 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - Renamed local parser binding CrowdStrikeFalconEventStream to __xdr_inline_CrowdStrikeFalconEventStream to avoid a saved + parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Account mapping is incomplete and was removed + - 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally represented + by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The original value + is also retained in customDetails when the query output binding is available; this assumption does not prove entity + parity' + - 'converter cannot map FileHash.Algorithm/Value: requires a query-proven constant SHA1 or SHA256 algorithm and an available + hash value column; MD5, unknown algorithms and linked file/process references are not inferred' + - customDetails 'DstUserName' column `DstUserName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DstHostName' column `DstHostName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'SrcIpAddr' column `SrcIpAddr` has an unproven output binding after a destructive projection; the explicit + binding is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - customDetails 'FileName' column `FileName` has an unproven output binding after a destructive projection; the explicit + binding is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - customDetails 'FileHash' column `FileHash` has an unproven output binding after a destructive projection; the explicit + binding is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - customDetails 'Total' column `Total` has an unproven output binding after a destructive projection; the explicit binding + is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - Account.FullName output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental + customDetails binding was added and KQL was not rewritten. Runtime output-schema verification is required + - Host.FullName output column `HostCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + - FileHash.Algorithm output column `FileHashAlgo` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + - FileHash.Value output column `FileHashCustomEntity` cannot be proven after a destructive projection; no supplemental + customDetails binding was added and KQL was not rewritten. Runtime output-schema verification is required + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Impact + - DefenseEvasion + originalTechniques: + - T1489 + - T1562 + reviewScope: + sourceDocumentSha256: 1990e286c65398bc749a892d884adc3c0dd45f5be9aed222b1e880512a035fef + targetQuerySha256: 1d08b1e84675db413e5f94a1616c1c70d55b1467ba1ece2aef87659d3d06aa5d + reviewDecisions: + - reason: 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally + represented by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The + original value is also retained in customDetails when the query output binding is available; this assumption does + not prove entity parity' + decision: accepted + sourceDocumentSha256: 1990e286c65398bc749a892d884adc3c0dd45f5be9aed222b1e880512a035fef + targetQuerySha256: 1d08b1e84675db413e5f94a1616c1c70d55b1467ba1ece2aef87659d3d06aa5d + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: 1990e286c65398bc749a892d884adc3c0dd45f5be9aed222b1e880512a035fef + targetQuerySha256: 1d08b1e84675db413e5f94a1616c1c70d55b1467ba1ece2aef87659d3d06aa5d + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: FullName + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: Host + entityIndex: 2 + identifier: FullName + sourceColumn: HostCustomEntity + column: HostCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: FileHash + entityIndex: 4 + identifier: Algorithm + sourceColumn: FileHashAlgo + column: FileHashAlgo + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: FileHash + entityIndex: 4 + identifier: Value + sourceColumn: FileHashCustomEntity + column: FileHashCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally represented + by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The original value + is also retained in customDetails when the query output binding is available; this assumption does not prove entity + parity' +properties: + id: xdr-4465ebde-b381-45f7-ad08-7d818070a11c + displayName: Common Event Format (CEF) via AMA - Critical or High Severity Detections by User + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_CrowdStrikeFalconEventStream = () { + CommonSecurityLog + | where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost" + | extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1), + DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2), + DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3) + // Additional Extensions + | extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions), + Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions), + Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions), + PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions), + SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))), + SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))) + | extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType), + Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome), + Technique = coalesce(column_ifexists("Reason",""),Technique) + // Device Custom Number Values + | extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")), + ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")), + Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint("")) + | project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3 + // Device Custom Date Values + | extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")), + DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")), + NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")), + HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime("")) + | project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2 + // Device Custom String Values + | extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""), + WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""), + QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""), + ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""), + AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""), + WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""), + AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""), + QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""), + ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""), + CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""), + FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "") + | project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6 + // Data Field Normalization + | project-rename DstHostName = DestinationHostName, + DstNtDomain = DestinationNTDomain, + DstUserName = DestinationUserName, + DstIpAddr = DestinationTranslatedAddress, + SrcMacAddr = SourceMACAddress, + SrcIpAddr = SourceIP + | extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType), + ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)), + SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink), + Severity = case(LogSeverity == 1, "Informational", + LogSeverity == 2, "Low", + LogSeverity == 3, "Medium", + LogSeverity == 4, "High", + LogSeverity == 5, "Critical", + LogSeverity) + }; + let timeframe = 1h; + let threshold = 15; // update threshold value based on organization's preference + let NotableEvents = __xdr_inline_CrowdStrikeFalconEventStream + | where TimeGenerated > ago(timeframe) + | where EventType == "DetectionSummaryEvent" + | where Severity in ("Critical", "High") + | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, Message + | where Total > threshold; + NotableEvents + | extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = "MD5" + | project timestamp, StartTimeUtc, EndTimeUtc, DstUserName, DstHostName, SrcIpAddr, FileName, FileHash, FileHashAlgo, Message, Total, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Common Event Format (CEF) via AMA - Critical or High Severity Detections by User + description: '''Creates an incident when a large number of Critical or High severity CrowdStrike Falcon sensor detections + is triggered by a single user within 1 hour. The rule uses the CrowdStrikeFalconEventStream table, filters for DetectionSummaryEvent + records with Severity set to Critical or High, and alerts when detections for a single DstUserName exceed the configured + threshold of 15. Review DstHostName, SrcIpAddr, FileName, FileHash, and Message for investigation context.''' + severity: high + entityMappings: + hosts: + - id: host1 + nameColumn: HostCustomEntity + ips: + - id: ip1 + addressColumn: IPCustomEntity + tactics: + - tactic: Impact + techniques: + - technique: T1489 + - tactic: DefenseEvasion + techniques: + - technique: T1562 + customDetails: + DstUserName: DstUserName + DstHostName: DstHostName + SrcIpAddr: SrcIpAddr + FileName: FileName + FileHash: FileHash + Total: Total diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalSeverityDetection.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalSeverityDetection.yaml new file mode 100644 index 00000000000..1d2a1c0806a --- /dev/null +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/XDR Detections/CriticalSeverityDetection.yaml @@ -0,0 +1,272 @@ +schemaVersion: 1.0.0 +version: 3.4.3 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CefAma + dataTypes: + - CommonSecurityLog +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CefAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: f7d298b2-726c-42a5-bbac-0d7f9950f527 + path: Analytic Rules/CriticalSeverityDetection.yaml + version: 1.0.6 + querySha256: df60e1b6e01294f49a0e3bdde213f73c1e0ca67c31cef87f0526ca2d8cacc81b + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - Renamed local parser binding CrowdStrikeFalconEventStream to __xdr_inline_CrowdStrikeFalconEventStream to avoid a saved + parser collision + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - Account mapping is incomplete and was removed + - 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally represented + by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The original value + is also retained in customDetails when the query output binding is available; this assumption does not prove entity + parity' + - 'converter cannot map FileHash.Algorithm/Value: requires a query-proven constant SHA1 or SHA256 algorithm and an available + hash value column; MD5, unknown algorithms and linked file/process references are not inferred' + - customDetails 'DetectionCount' column `Total` has an unproven output binding after a destructive projection; the explicit + binding is retained, but static analysis cannot establish its output and runtime output-schema verification is required + - customDetails 'DetectionMessage' column `Message` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionTechnique' column `Technique` has an unproven output binding after a destructive projection; + the explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionActivity' column `Activity` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionFileName' column `FileName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionFilePath' column `FilePath` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionHost' column `DstHostName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionUser' column `DstUserName` has an unproven output binding after a destructive projection; the + explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - customDetails 'DetectionSourceIp' column `SrcIpAddr` has an unproven output binding after a destructive projection; + the explicit binding is retained, but static analysis cannot establish its output and runtime output-schema verification + is required + - Account.FullName output column `AccountCustomEntity` cannot be proven after a destructive projection; no supplemental + customDetails binding was added and KQL was not rewritten. Runtime output-schema verification is required + - Host.FullName output column `HostCustomEntity` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + - FileHash.Algorithm output column `FileHashAlgo` cannot be proven after a destructive projection; no supplemental customDetails + binding was added and KQL was not rewritten. Runtime output-schema verification is required + - FileHash.Value output column `FileHashCustomEntity` cannot be proven after a destructive projection; no supplemental + customDetails binding was added and KQL was not rewritten. Runtime output-schema verification is required + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Execution + - Impact + originalTechniques: + - T1204.002 + - T1499 + reviewScope: + sourceDocumentSha256: 235e775eca9f31958102b9d4bc46e169f10bafe753a0cc1b5d9fd99acfa2951b + targetQuerySha256: 9f6df47dcdf0931fa4803994a09c541143ae8a734b4abd1b8c0951d33607677b + reviewDecisions: + - reason: 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally + represented by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The + original value is also retained in customDetails when the query output binding is available; this assumption does + not prove entity parity' + decision: accepted + sourceDocumentSha256: 235e775eca9f31958102b9d4bc46e169f10bafe753a0cc1b5d9fd99acfa2951b + targetQuerySha256: 9f6df47dcdf0931fa4803994a09c541143ae8a734b4abd1b8c0951d33607677b + eventTimeWindow: + status: default-native-lookback + appliedDefault: hourly-1h-to-native-4h-lookback + queryFrequency: 1h + queryPeriod: 1h + targetFrequency: PT1H + effectiveLookback: PT4H + originalSentinelLookbackSeconds: 3600 + effectiveEventWindowSeconds: 14400 + xdrServiceWindowSeconds: 14400 + filterInjected: false + parityClaimed: false + hasAggregation: true + aggregationWindowDifference: true + timingDifference: Four hours (PT4H / 14400s) is the native XDR ingestion-based lookback window for PT1H execution frequency, + not the execution frequency; original Sentinel queryPeriod was 1h (3600s). + aggregationDifference: Query contains summarize/make-series aggregation; evaluating over the native 4-hour XDR lookback + window without an injected 1h event-time filter may aggregate up to 4 hours of events per hourly run instead of 1 + hour. + sourceDocumentSha256: 235e775eca9f31958102b9d4bc46e169f10bafe753a0cc1b5d9fd99acfa2951b + targetQuerySha256: 9f6df47dcdf0931fa4803994a09c541143ae8a734b4abd1b8c0951d33607677b + supplementalEntityDetails: + - entityType: Account + entityIndex: 1 + identifier: FullName + sourceColumn: AccountCustomEntity + column: AccountCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: Host + entityIndex: 2 + identifier: FullName + sourceColumn: HostCustomEntity + column: HostCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: FileHash + entityIndex: 4 + identifier: Algorithm + sourceColumn: FileHashAlgo + column: FileHashAlgo + status: unproven-destructive-projection + reason: unproven-destructive-projection + - entityType: FileHash + entityIndex: 4 + identifier: Value + sourceColumn: FileHashCustomEntity + column: FileHashCustomEntity + status: unproven-destructive-projection + reason: unproven-destructive-projection + acceptedReviewReasons: + - 'Best-effort entity mapping requires review: source Host.FullName column `HostCustomEntity` is provisionally represented + by hosts.nameColumn `HostCustomEntity`; confirm that this column is the intended host identifier. The original value + is also retained in customDetails when the query output binding is available; this assumption does not prove entity + parity' +properties: + id: xdr-f7d298b2-726c-42a5-bbac-0d7f9950f527 + displayName: Common Event Format (CEF) via AMA - Critical Severity Detection + status: disabled + queryCondition: + queryText: |- + let __xdr_inline_CrowdStrikeFalconEventStream = () { + CommonSecurityLog + | where DeviceVendor == "CrowdStrike" and DeviceProduct == "FalconHost" + | extend DeviceCustomNumber1 = coalesce(column_ifexists("FieldDeviceCustomNumber1", long(null)),DeviceCustomNumber1), + DeviceCustomNumber2 = coalesce(column_ifexists("FieldDeviceCustomNumber2", long(null)),DeviceCustomNumber2), + DeviceCustomNumber3 = coalesce(column_ifexists("FieldDeviceCustomNumber3", long(null)),DeviceCustomNumber3) + // Additional Extensions + | extend EventType = extract(@"cat=([^;]+)(\;|$)",1,AdditionalExtensions), + Outcome = extract(@"outcome=([^;]+)(\;|$)",1,AdditionalExtensions), + Technique = extract(@"reason=([^;]+)(\;|$)",1,AdditionalExtensions), + PatternDisposition = extract(@"CSMTRPatternDisposition=([^;]+)(\;|$)",1,AdditionalExtensions), + SessionStartTime = unixtime_seconds_todatetime(toint(extract(@"sessionStartTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))), + SessionEndTime = unixtime_seconds_todatetime(toint(extract(@"sessionEndTimestamp=([^;]+)(\;|$)",1,AdditionalExtensions))) + | extend EventType = coalesce(column_ifexists("DeviceEventCategory",""),EventType), + Outcome = coalesce(column_ifexists("EventOutcome",""),Outcome), + Technique = coalesce(column_ifexists("Reason",""),Technique) + // Device Custom Number Values + | extend ParentProcessId = iif(DeviceCustomNumber1Label == "ParentProcessId" , DeviceCustomNumber1, toint("")), + ChildProcessId = iif(DeviceCustomNumber2Label == "ProcessId" , DeviceCustomNumber2, toint("")), + Offset = iif(DeviceCustomNumber3Label == "Offset", DeviceCustomNumber3, toint("")) + | project-away DeviceCustomNumber1Label, DeviceCustomNumber1,DeviceCustomNumber2Label, DeviceCustomNumber2,DeviceCustomNumber3Label, DeviceCustomNumber3 + // Device Custom Date Values + | extend EventTimestamp = iif(DeviceCustomDate1Label == "Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + ExeWrittenTime = iif(DeviceCustomDate1Label == "ExeWrittenTimestamp", todatetime(DeviceCustomDate1), todatetime("")), + DnsRequestTime = iif(DeviceCustomDate1Label == "DNS Request Time", todatetime(DeviceCustomDate1), todatetime("")), + NetworkAccessTime = iif(DeviceCustomDate1Label == "Network Access Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + DocAccessTime = iif(DeviceCustomDate1Label == "DocAccessTimestamp" or DeviceCustomDate1Label == "Document Accessed Timestamp", todatetime(DeviceCustomDate1), todatetime("")), + HashSpreadingEventTime = iif(DeviceCustomDate2Label == "HashSpreadingEventTime", todatetime(DeviceCustomDate2), todatetime("")), + HashSpreadingSensorTime = iif(DeviceCustomDate2Label == "HashSpreadingSensorEventTime", todatetime(DeviceCustomDate2), todatetime("")) + | project-away DeviceCustomDate1Label, DeviceCustomDate1, DeviceCustomDate2Label, DeviceCustomDate2 + // Device Custom String Values + | extend ScanResultName = iif(DeviceCustomString1Label == "ScanResultNam", DeviceCustomString1, ""), + WrittenExeFileName = iif(DeviceCustomString2Label == "WrittenExeFileName", DeviceCustomString2, ""), + QuarantineFileSHA256 = iif(DeviceCustomString2Label == "QuarantineFileSHA256", DeviceCustomString2, ""), + ScanResultEngine = iif(DeviceCustomString2Label == "ScanResultEngine", DeviceCustomString2, ""), + AccessedDocFileName = iif(DeviceCustomString2Label == "AccessedDocFileName", DeviceCustomString2, ""), + WrittenExeFilePath = iif(DeviceCustomString3Label == "WrittenExeFilePath", DeviceCustomString3, ""), + AccessedDocFilePath = iif(DeviceCustomString3Label == "AccessedDocFilePath", DeviceCustomString3, ""), + QuarantineFilePath = iif(DeviceCustomString3Label == "QuarantineFilePath", DeviceCustomString3, ""), + ScanResultVersion = iif(DeviceCustomString4Label == "ScanResultVersion", DeviceCustomString4, ""), + CommandLine = iif(DeviceCustomString5Label == "CommandLine", DeviceCustomString5, ""), + FalconHostLink = iif(DeviceCustomString6Label == "FalconHostLink", DeviceCustomString6, "") + | project-away DeviceCustomString1Label, DeviceCustomString1, DeviceCustomString2Label, DeviceCustomString2, DeviceCustomString3Label, DeviceCustomString3, DeviceCustomString4Label, DeviceCustomString4, DeviceCustomString5Label, DeviceCustomString5, DeviceCustomString6Label, DeviceCustomString6 + // Data Field Normalization + | project-rename DstHostName = DestinationHostName, + DstNtDomain = DestinationNTDomain, + DstUserName = DestinationUserName, + DstIpAddr = DestinationTranslatedAddress, + SrcMacAddr = SourceMACAddress, + SrcIpAddr = SourceIP + | extend EventType = iif(DeviceEventClassID == "DetectionSummaryEvent" or DeviceEventClassID contains "Detection Summary Event", "DetectionSummaryEvent", EventType), + ReceiptTime = unixtime_milliseconds_todatetime(tolong(ReceiptTime)), + SensorId = extract(@"/detail/([^/]+)\/",1,FalconHostLink), + Severity = case(LogSeverity == 1, "Informational", + LogSeverity == 2, "Low", + LogSeverity == 3, "Medium", + LogSeverity == 4, "High", + LogSeverity == 5, "Critical", + LogSeverity) + }; + let timeframe = 1h; + __xdr_inline_CrowdStrikeFalconEventStream + | where TimeGenerated > ago(timeframe) + | where EventType == "DetectionSummaryEvent" + | where Severity == "Critical" + | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), Total = count() by DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message + | extend timestamp = StartTimeUtc, AccountCustomEntity = DstUserName, HostCustomEntity = DstHostName, IPCustomEntity = SrcIpAddr, FileHashCustomEntity = FileHash, FileHashAlgo = "MD5" + | project StartTimeUtc, EndTimeUtc, Total, DstHostName, SrcIpAddr, DstUserName, Activity, Technique, FileName, FilePath, FileHash, Message, timestamp, AccountCustomEntity, HostCustomEntity, IPCustomEntity, FileHashCustomEntity, FileHashAlgo + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Common Event Format (CEF) via AMA - Critical Severity Detection + description: '''Creates an incident when a CrowdStrike Falcon sensor detection is triggered with Critical severity. + The rule queries CrowdStrikeFalconEventStream for DetectionSummaryEvent records where Severity is Critical, summarizes + detections by host, source IP, user, activity, technique, file details, hash, and message, and raises an incident + for each matching result.''' + severity: high + entityMappings: + hosts: + - id: host1 + nameColumn: HostCustomEntity + ips: + - id: ip1 + addressColumn: IPCustomEntity + tactics: + - tactic: Execution + techniques: + - technique: T1204 + subTechniques: + - T1204.002 + - tactic: Impact + techniques: + - technique: T1499 + customDetails: + DetectionCount: Total + DetectionMessage: Message + DetectionTechnique: Technique + DetectionActivity: Activity + DetectionFileName: FileName + DetectionFilePath: FilePath + DetectionHost: DstHostName + DetectionUser: DstUserName + DetectionSourceIp: SrcIpAddr

• Review the solution Release Notes