From 444a30f1e8e532a22d25814d76823ec6d51c49dc Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Mon, 31 Jan 2022 16:18:59 -0800 Subject: [PATCH 01/20] Added info about ability to overwrite (#29944) (#30116) * Added info about ability to overwrite Co-authored-by: Brandon Morelli Co-authored-by: DeDe Morton Co-authored-by: mr1716 --- libbeat/processors/actions/docs/add_fields.asciidoc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libbeat/processors/actions/docs/add_fields.asciidoc b/libbeat/processors/actions/docs/add_fields.asciidoc index b133d2115c89..574c4a684c24 100644 --- a/libbeat/processors/actions/docs/add_fields.asciidoc +++ b/libbeat/processors/actions/docs/add_fields.asciidoc @@ -6,8 +6,9 @@ ++++ The `add_fields` processor adds additional fields to the event. Fields can be -scalar values, arrays, dictionaries, or any nested combination of these. By -default the fields that you specify will be grouped under the `fields` +scalar values, arrays, dictionaries, or any nested combination of these. +The `add_fields` processor will overwrite the target field if it already exists. +By default the fields that you specify will be grouped under the `fields` sub-dictionary in the event. To group the fields under a different sub-dictionary, use the `target` setting. To store the fields as top-level fields, set `target: ''`. From 56b227d00945ae97d7e8663df048c29f311b8894 Mon Sep 17 00:00:00 2001 From: Alex Resnick Date: Mon, 31 Jan 2022 20:45:39 -0600 Subject: [PATCH 02/20] #29747: Fix Add Network Direction processor (#29751) Fix Add Network Direction processor field with dot in name. Co-authored-by: Andrew Kroh --- CHANGELOG.next.asciidoc | 1 + libbeat/processors/actions/add_network_direction.go | 4 +--- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 0eab8d3a4648..cfc742c0d892 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -94,6 +94,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Affecting all Beats* +- Fix field names with `add_network_direction` processor. {issue}29747[29747] {pull}29751[29751] *Auditbeat* diff --git a/libbeat/processors/actions/add_network_direction.go b/libbeat/processors/actions/add_network_direction.go index a5ecb3c35d85..b0f457b9b30d 100644 --- a/libbeat/processors/actions/add_network_direction.go +++ b/libbeat/processors/actions/add_network_direction.go @@ -100,9 +100,7 @@ func (m *networkDirectionProcessor) Run(event *beat.Event) (*beat.Event, error) return event, err } - event.Fields.DeepUpdate(common.MapStr{ - m.Target: networkDirection(internalSource, internalDestination), - }) + event.PutValue(m.Target, networkDirection(internalSource, internalDestination)) return event, nil } From 267f8cb34853f3fa2c0c6c3cdd33242ca88494a9 Mon Sep 17 00:00:00 2001 From: Vignesh Shanmugam Date: Mon, 31 Jan 2022 20:56:58 -0800 Subject: [PATCH 03/20] [Heartbeat]: catch all error handler for browser jobs (#30013) * [Heartbeat]: catch all error handler for browser jobs * fix wrapper tests * add tests and consume all events * address review and improve test --- heartbeat/monitors/wrappers/wrappers.go | 99 +++++----- heartbeat/monitors/wrappers/wrappers_test.go | 57 +++--- x-pack/heartbeat/monitors/browser/suite.go | 14 +- .../monitors/browser/synthexec/enrich.go | 42 ++++- .../monitors/browser/synthexec/enrich_test.go | 176 +++++++++++++++--- .../browser/synthexec/execmultiplexer.go | 25 +-- .../browser/synthexec/execmultiplexer_test.go | 24 +-- .../monitors/browser/synthexec/synthexec.go | 55 +++--- 8 files changed, 328 insertions(+), 164 deletions(-) diff --git a/heartbeat/monitors/wrappers/wrappers.go b/heartbeat/monitors/wrappers/wrappers.go index c9e0c79c105f..2790de08ffde 100644 --- a/heartbeat/monitors/wrappers/wrappers.go +++ b/heartbeat/monitors/wrappers/wrappers.go @@ -50,8 +50,10 @@ func WrapLightweight(js []jobs.Job, stdMonFields stdfields.StdMonitorFields) []j return jobs.WrapAllSeparately( jobs.WrapAll( js, + addMonitorTimespan(stdMonFields), + addServiceName(stdMonFields), addMonitorMeta(stdMonFields, len(js) > 1), - addMonitorStatus(stdMonFields.Type, false), + addMonitorStatus(false), addMonitorDuration, ), func() jobs.JobWrapper { @@ -65,64 +67,75 @@ func WrapLightweight(js []jobs.Job, stdMonFields stdfields.StdMonitorFields) []j func WrapBrowser(js []jobs.Job, stdMonFields stdfields.StdMonitorFields) []jobs.Job { return jobs.WrapAll( js, - addMonitorMeta(stdMonFields, len(js) > 1), - addMonitorStatus(stdMonFields.Type, true), + addMonitorTimespan(stdMonFields), + addServiceName(stdMonFields), + addMonitorStatus(true), ) } // addMonitorMeta adds the id, name, and type fields to the monitor. -func addMonitorMeta(stdMonFields stdfields.StdMonitorFields, isMulti bool) jobs.JobWrapper { +func addMonitorMeta(sf stdfields.StdMonitorFields, isMulti bool) jobs.JobWrapper { return func(job jobs.Job) jobs.Job { return func(event *beat.Event) ([]jobs.Job, error) { - cont, e := job(event) - addMonitorMetaFields(event, time.Now(), stdMonFields, isMulti) - return cont, e + cont, err := job(event) + + id := sf.ID + name := sf.Name + // If multiple jobs are listed for this monitor, we can't have a single ID, so we hash the + // unique URLs to create unique suffixes for the monitor. + if isMulti { + url, err := event.GetValue("url.full") + if err != nil { + logp.Error(errors.Wrap(err, "Mandatory url.full key missing!")) + url = "n/a" + } + urlHash, _ := hashstructure.Hash(url, nil) + id = fmt.Sprintf("%s-%x", sf.ID, urlHash) + } + + eventext.MergeEventFields(event, common.MapStr{ + "monitor": common.MapStr{ + "id": id, + "name": name, + "type": sf.Type, + }, + }) + return cont, err } } } -func addMonitorMetaFields(event *beat.Event, started time.Time, sf stdfields.StdMonitorFields, isMulti bool) { - id := sf.ID - name := sf.Name +func addMonitorTimespan(sf stdfields.StdMonitorFields) jobs.JobWrapper { + return func(origJob jobs.Job) jobs.Job { + return func(event *beat.Event) ([]jobs.Job, error) { + cont, err := origJob(event) - // If multiple jobs are listed for this monitor, we can't have a single ID, so we hash the - // unique URLs to create unique suffixes for the monitor. - if isMulti { - url, err := event.GetValue("url.full") - if err != nil { - logp.Error(errors.Wrap(err, "Mandatory url.full key missing!")) - url = "n/a" + eventext.MergeEventFields(event, common.MapStr{ + "monitor": common.MapStr{ + "timespan": timespan(time.Now(), sf.Schedule, sf.Timeout), + }, + }) + return cont, err } - urlHash, _ := hashstructure.Hash(url, nil) - id = fmt.Sprintf("%s-%x", sf.ID, urlHash) - } - - // Allow jobs to override the ID, useful for browser suites - // which do this logic on their own - if v, _ := event.GetValue("monitor.id"); v != nil { - id = fmt.Sprintf("%s-%s", sf.ID, v.(string)) - } - if v, _ := event.GetValue("monitor.name"); v != nil { - name = fmt.Sprintf("%s - %s", sf.Name, v.(string)) } +} - fieldsToMerge := common.MapStr{ - "monitor": common.MapStr{ - "id": id, - "name": name, - "type": sf.Type, - "timespan": timespan(started, sf.Schedule, sf.Timeout), - }, - } +// Add service.name to monitors for APM interop +func addServiceName(sf stdfields.StdMonitorFields) jobs.JobWrapper { + return func(origJob jobs.Job) jobs.Job { + return func(event *beat.Event) ([]jobs.Job, error) { + cont, err := origJob(event) - // Add service.name for APM interop - if sf.Service.Name != "" { - fieldsToMerge["service"] = common.MapStr{ - "name": sf.Service.Name, + if sf.Service.Name != "" { + eventext.MergeEventFields(event, common.MapStr{ + "service": common.MapStr{ + "name": sf.Service.Name, + }, + }) + } + return cont, err } } - - eventext.MergeEventFields(event, fieldsToMerge) } func timespan(started time.Time, sched *schedule.Schedule, timeout time.Duration) common.MapStr { @@ -142,7 +155,7 @@ func timespan(started time.Time, sched *schedule.Schedule, timeout time.Duration // by the original Job will be set as a field. The original error will not be // passed through as a return value. Errors may still be present but only if there // is an actual error wrapping the error. -func addMonitorStatus(monitorType string, summaryOnly bool) jobs.JobWrapper { +func addMonitorStatus(summaryOnly bool) jobs.JobWrapper { return func(origJob jobs.Job) jobs.Job { return func(event *beat.Event) ([]jobs.Job, error) { cont, err := origJob(event) diff --git a/heartbeat/monitors/wrappers/wrappers_test.go b/heartbeat/monitors/wrappers/wrappers_test.go index b84b18f65a92..049b6ebd8fba 100644 --- a/heartbeat/monitors/wrappers/wrappers_test.go +++ b/heartbeat/monitors/wrappers/wrappers_test.go @@ -57,8 +57,6 @@ var testMonFields = stdfields.StdMonitorFields{ } var testBrowserMonFields = stdfields.StdMonitorFields{ - ID: "myid", - Name: "myname", Type: "browser", Schedule: schedule.MustParse("@every 1s"), Timeout: 1, @@ -396,6 +394,18 @@ func TestTimespan(t *testing.T) { } } +type BrowserMonitor struct { + id string + name string + checkGroup string +} + +var inlineMonitorValues = BrowserMonitor{ + id: "inline", + name: "inline", + checkGroup: "inline-check-group", +} + func makeInlineBrowserJob(t *testing.T, u string) jobs.Job { parsed, err := url.Parse(u) require.NoError(t, err) @@ -403,16 +413,18 @@ func makeInlineBrowserJob(t *testing.T, u string) jobs.Job { eventext.MergeEventFields(event, common.MapStr{ "url": URLFields(parsed), "monitor": common.MapStr{ - "check_group": "inline-check-group", + "type": "browser", + "id": inlineMonitorValues.id, + "name": inlineMonitorValues.name, + "check_group": inlineMonitorValues.checkGroup, }, }) return nil, nil } } -// Inline browser jobs function very similarly to lightweight jobs -// in that they don't override the ID. -// They do not, however, get a summary field added, nor duration. +// Browser inline jobs monitor information should not be altered +// by the wrappers as they are handled separately in synth enricher func TestInlineBrowserJob(t *testing.T) { fields := testBrowserMonFields testCommonWrap(t, testDef{ @@ -425,10 +437,10 @@ func TestInlineBrowserJob(t *testing.T) { urlValidator(t, "http://foo.com"), lookslike.MustCompile(map[string]interface{}{ "monitor": map[string]interface{}{ - "id": testMonFields.ID, - "name": testMonFields.Name, - "type": fields.Type, - "check_group": "inline-check-group", + "type": "browser", + "id": inlineMonitorValues.id, + "name": inlineMonitorValues.name, + "check_group": inlineMonitorValues.checkGroup, }, }), hbtestllext.MonitorTimespanValidator, @@ -439,13 +451,9 @@ func TestInlineBrowserJob(t *testing.T) { }) } -var suiteBrowserJobValues = struct { - id string - name string - checkGroup string -}{ - id: "journey_1", - name: "Journey 1", +var suiteMonitorValues = BrowserMonitor{ + id: "suite-journey_1", + name: "suite-Journey 1", checkGroup: "journey-1-check-group", } @@ -456,9 +464,10 @@ func makeSuiteBrowserJob(t *testing.T, u string, summary bool, suiteErr error) j eventext.MergeEventFields(event, common.MapStr{ "url": URLFields(parsed), "monitor": common.MapStr{ - "id": suiteBrowserJobValues.id, - "name": suiteBrowserJobValues.name, - "check_group": suiteBrowserJobValues.checkGroup, + "type": "browser", + "id": suiteMonitorValues.id, + "name": suiteMonitorValues.name, + "check_group": suiteMonitorValues.checkGroup, }, }) if summary { @@ -482,10 +491,10 @@ func TestSuiteBrowserJob(t *testing.T) { urlU, _ := url.Parse(urlStr) expectedMonFields := lookslike.MustCompile(map[string]interface{}{ "monitor": map[string]interface{}{ - "id": fmt.Sprintf("%s-%s", testMonFields.ID, suiteBrowserJobValues.id), - "name": fmt.Sprintf("%s - %s", testMonFields.Name, suiteBrowserJobValues.name), - "type": fields.Type, - "check_group": suiteBrowserJobValues.checkGroup, + "type": "browser", + "id": suiteMonitorValues.id, + "name": suiteMonitorValues.name, + "check_group": suiteMonitorValues.checkGroup, "timespan": common.MapStr{ "gte": hbtestllext.IsTime, "lt": hbtestllext.IsTime, diff --git a/x-pack/heartbeat/monitors/browser/suite.go b/x-pack/heartbeat/monitors/browser/suite.go index aff137baeca8..c4f52921b41d 100644 --- a/x-pack/heartbeat/monitors/browser/suite.go +++ b/x-pack/heartbeat/monitors/browser/suite.go @@ -66,6 +66,16 @@ func (s *Suite) FilterJourneys() synthexec.FilterJourneyConfig { return s.suiteCfg.FilterJourneys } +func (s *Suite) Fields() synthexec.StdSuiteFields { + _, isInline := s.InlineSource() + return synthexec.StdSuiteFields{ + Name: s.suiteCfg.Name, + Id: s.suiteCfg.Id, + IsInline: isInline, + Type: "browser", + } +} + func (s *Suite) Close() error { if s.suiteCfg.Source.ActiveMemo != nil { s.suiteCfg.Source.ActiveMemo.Close() @@ -102,14 +112,14 @@ func (s *Suite) extraArgs() []string { func (s *Suite) jobs() []jobs.Job { var j jobs.Job if src, ok := s.InlineSource(); ok { - j = synthexec.InlineJourneyJob(context.TODO(), src, s.Params(), s.extraArgs()...) + j = synthexec.InlineJourneyJob(context.TODO(), src, s.Params(), s.Fields(), s.extraArgs()...) } else { j = func(event *beat.Event) ([]jobs.Job, error) { err := s.Fetch() if err != nil { return nil, fmt.Errorf("could not fetch for suite job: %w", err) } - sj, err := synthexec.SuiteJob(context.TODO(), s.Workdir(), s.Params(), s.FilterJourneys(), s.extraArgs()...) + sj, err := synthexec.SuiteJob(context.TODO(), s.Workdir(), s.Params(), s.FilterJourneys(), s.Fields(), s.extraArgs()...) if err != nil { return nil, err } diff --git a/x-pack/heartbeat/monitors/browser/synthexec/enrich.go b/x-pack/heartbeat/monitors/browser/synthexec/enrich.go index bec551a7947e..3e01c387cb70 100644 --- a/x-pack/heartbeat/monitors/browser/synthexec/enrich.go +++ b/x-pack/heartbeat/monitors/browser/synthexec/enrich.go @@ -18,18 +18,18 @@ import ( "github.com/elastic/beats/v7/libbeat/common" ) -type enricher func(event *beat.Event, se *SynthEvent) error +type enricher func(event *beat.Event, se *SynthEvent, fields StdSuiteFields) error type streamEnricher struct { je *journeyEnricher } -func (e *streamEnricher) enrich(event *beat.Event, se *SynthEvent) error { +func (e *streamEnricher) enrich(event *beat.Event, se *SynthEvent, fields StdSuiteFields) error { if e.je == nil || (se != nil && se.Type == "journey/start") { e.je = newJourneyEnricher() } - return e.je.enrich(event, se) + return e.je.enrich(event, se, fields) } // journeyEnricher holds state across received SynthEvents retaining fields @@ -62,7 +62,7 @@ func makeUuid() string { return u.String() } -func (je *journeyEnricher) enrich(event *beat.Event, se *SynthEvent) error { +func (je *journeyEnricher) enrich(event *beat.Event, se *SynthEvent, fields StdSuiteFields) error { if se == nil { return nil } @@ -84,20 +84,41 @@ func (je *journeyEnricher) enrich(event *beat.Event, se *SynthEvent) error { } eventext.MergeEventFields(event, common.MapStr{ + "event": common.MapStr{ + "type": se.Type, + }, "monitor": common.MapStr{ "check_group": je.checkGroup, }, }) - // Inline jobs have no journey - if je.journey != nil { + + // Id and name differs for inline and suite monitors + // - We use the monitor id and name for inline journeys ignoring the + // autogenerated `inline`journey id and name. + // - Monitor id/name is concatenated with the journey id/name for + // suite monitors + id := fields.Id + name := fields.Name + if !fields.IsInline && je.journey != nil { + id = fmt.Sprintf("%s-%s", id, je.journey.Id) + name = fmt.Sprintf("%s - %s", name, je.journey.Name) + } + eventext.MergeEventFields(event, common.MapStr{ + "monitor": common.MapStr{ + "id": id, + "name": name, + }, + }) + + // Write suite level fields for suite monitors + if !fields.IsInline { eventext.MergeEventFields(event, common.MapStr{ - "monitor": common.MapStr{ - "id": je.journey.Id, - "name": je.journey.Name, + "suite": common.MapStr{ + "id": fields.Id, + "name": fields.Name, }, }) } - return je.enrichSynthEvent(event, se) } @@ -141,6 +162,7 @@ func (je *journeyEnricher) enrichSynthEvent(event *beat.Event, se *SynthEvent) e // In that case we always want to issue an update op event.Meta.Put(events.FieldMetaOpType, events.OpTypeCreate) } + eventext.MergeEventFields(event, se.ToMap()) if je.urlFields == nil { diff --git a/x-pack/heartbeat/monitors/browser/synthexec/enrich_test.go b/x-pack/heartbeat/monitors/browser/synthexec/enrich_test.go index f2c8ba25dca9..da2f8980dc81 100644 --- a/x-pack/heartbeat/monitors/browser/synthexec/enrich_test.go +++ b/x-pack/heartbeat/monitors/browser/synthexec/enrich_test.go @@ -19,6 +19,7 @@ import ( "github.com/elastic/beats/v7/libbeat/processors/add_data_stream" "github.com/elastic/go-lookslike" "github.com/elastic/go-lookslike/testslike" + "github.com/elastic/go-lookslike/validator" ) func makeStepEvent(typ string, ts float64, name string, index int, status string, urlstr string, err *SynthError) *SynthEvent { @@ -34,6 +35,12 @@ func makeStepEvent(typ string, ts float64, name string, index int, status string } func TestJourneyEnricher(t *testing.T) { + var stdFields = StdSuiteFields{ + Id: "mysuite", + Name: "mysuite", + Type: "browser", + IsInline: false, + } journey := &Journey{ Name: "A Journey Name", Id: "my-journey-id", @@ -77,39 +84,149 @@ func TestJourneyEnricher(t *testing.T) { journeyEnd, } - je := &journeyEnricher{} + suiteValidator := func() validator.Validator { + return lookslike.MustCompile(common.MapStr{ + "suite.id": stdFields.Id, + "suite.name": stdFields.Name, + "monitor.id": fmt.Sprintf("%s-%s", stdFields.Id, journey.Id), + "monitor.name": fmt.Sprintf("%s - %s", stdFields.Name, journey.Name), + }) + } + inlineValidator := func() validator.Validator { + return lookslike.MustCompile(common.MapStr{ + "monitor.id": stdFields.Id, + "monitor.name": stdFields.Name, + }) + } + commonValidator := func(se *SynthEvent) validator.Validator { + var v []validator.Validator - // We need an expectation for each input - // plus a final expectation for the summary which comes - // on the nil data. - for idx, se := range synthEvents { + // We need an expectation for each input plus a final + // expectation for the summary which comes on the nil data. + if se.Type != "journey/end" { + // Test that the created event includes the mapped + // version of the event + v = append(v, lookslike.MustCompile(se.ToMap())) + } else { + u, _ := url.Parse(url1) + // journey end gets a summary + v = append(v, lookslike.MustCompile(common.MapStr{ + "synthetics.type": "heartbeat/summary", + "url": wrappers.URLFields(u), + "monitor.duration.us": int64(journeyEnd.Timestamp().Sub(journeyStart.Timestamp()) / time.Microsecond), + })) + } + return lookslike.Compose(v...) + } + + je := &journeyEnricher{} + check := func(t *testing.T, se *SynthEvent, ssf StdSuiteFields) { e := &beat.Event{} - t.Run(fmt.Sprintf("event %d", idx), func(t *testing.T) { - enrichErr := je.enrich(e, se) + t.Run(fmt.Sprintf("event: %s", se.Type), func(t *testing.T) { + enrichErr := je.enrich(e, se, ssf) + if se.Error != nil { + require.Equal(t, stepError(se.Error), enrichErr) + } + if ssf.IsInline { + sv, _ := e.Fields.GetValue("suite") + require.Nil(t, sv) + testslike.Test(t, inlineValidator(), e.Fields) + } else { + testslike.Test(t, suiteValidator(), e.Fields) + } + testslike.Test(t, commonValidator(se), e.Fields) - if se != nil && se.Type != "journey/end" { - // Test that the created event includes the mapped - // version of the event - testslike.Test(t, lookslike.MustCompile(se.ToMap()), e.Fields) - require.Equal(t, se.Timestamp().Unix(), e.Timestamp.Unix()) + require.Equal(t, se.Timestamp().Unix(), e.Timestamp.Unix()) + }) + } - if se.Error != nil { - require.Equal(t, stepError(se.Error), enrichErr) - } - } else { // journey end gets a summary - require.Equal(t, stepError(syntherr), enrichErr) + tests := []struct { + name string + isInline bool + se []*SynthEvent + }{ + { + name: "suite monitor", + isInline: false, + }, + { + name: "inline monitor", + isInline: true, + }, + } - u, _ := url.Parse(url1) - t.Run("summary", func(t *testing.T) { - v := lookslike.MustCompile(common.MapStr{ - "synthetics.type": "heartbeat/summary", - "url": wrappers.URLFields(u), - "monitor.duration.us": int64(journeyEnd.Timestamp().Sub(journeyStart.Timestamp()) / time.Microsecond), - }) + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + stdFields.IsInline = tt.isInline + for _, se := range synthEvents { + check(t, se, stdFields) + } + }) + } +} - testslike.Test(t, v, e.Fields) +func TestEnrichConsoleSynthEvents(t *testing.T) { + tests := []struct { + name string + je *journeyEnricher + se *SynthEvent + check func(t *testing.T, e *beat.Event, je *journeyEnricher) + }{ + { + "stderr", + &journeyEnricher{}, + &SynthEvent{ + Type: "stderr", + Payload: common.MapStr{ + "message": "Error from synthetics", + }, + PackageVersion: "1.0.0", + }, + func(t *testing.T, e *beat.Event, je *journeyEnricher) { + v := lookslike.MustCompile(common.MapStr{ + "synthetics": common.MapStr{ + "payload": common.MapStr{ + "message": "Error from synthetics", + }, + "type": "stderr", + "package_version": "1.0.0", + "index": 0, + }, }) - } + testslike.Test(t, v, e.Fields) + }, + }, + { + "stdout", + &journeyEnricher{}, + &SynthEvent{ + Type: "stdout", + Payload: common.MapStr{ + "message": "debug output", + }, + PackageVersion: "1.0.0", + }, + func(t *testing.T, e *beat.Event, je *journeyEnricher) { + v := lookslike.MustCompile(common.MapStr{ + "synthetics": common.MapStr{ + "payload": common.MapStr{ + "message": "debug output", + }, + "type": "stdout", + "package_version": "1.0.0", + "index": 0, + }, + }) + testslike.Test(t, lookslike.Strict(v), e.Fields) + }, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + e := &beat.Event{} + tt.je.enrichSynthEvent(e, tt.se) + tt.check(t, e, tt.je) }) } } @@ -131,7 +248,7 @@ func TestEnrichSynthEvent(t *testing.T) { }, true, func(t *testing.T, e *beat.Event, je *journeyEnricher) { - v := lookslike.MustCompile(map[string]interface{}{ + v := lookslike.MustCompile(common.MapStr{ "summary": map[string]int{ "up": 0, "down": 1, @@ -146,7 +263,7 @@ func TestEnrichSynthEvent(t *testing.T) { &SynthEvent{Type: "journey/end"}, false, func(t *testing.T, e *beat.Event, je *journeyEnricher) { - v := lookslike.MustCompile(map[string]interface{}{ + v := lookslike.MustCompile(common.MapStr{ "summary": map[string]int{ "up": 1, "down": 0, @@ -258,8 +375,9 @@ func TestNoSummaryOnAfterHook(t *testing.T) { for idx, se := range synthEvents { e := &beat.Event{} + stdFields := StdSuiteFields{IsInline: false} t.Run(fmt.Sprintf("event %d", idx), func(t *testing.T) { - enrichErr := je.enrich(e, se) + enrichErr := je.enrich(e, se, stdFields) if se != nil && se.Type == "cmd/status" { t.Run("no summary in cmd/status", func(t *testing.T) { diff --git a/x-pack/heartbeat/monitors/browser/synthexec/execmultiplexer.go b/x-pack/heartbeat/monitors/browser/synthexec/execmultiplexer.go index 07de0143c38b..568916140f14 100644 --- a/x-pack/heartbeat/monitors/browser/synthexec/execmultiplexer.go +++ b/x-pack/heartbeat/monitors/browser/synthexec/execmultiplexer.go @@ -9,10 +9,9 @@ import ( ) type ExecMultiplexer struct { - currentJourney *atomic.Bool - eventCounter *atomic.Int - synthEvents chan *SynthEvent - done chan struct{} + eventCounter *atomic.Int + synthEvents chan *SynthEvent + done chan struct{} } func (e ExecMultiplexer) Close() { @@ -25,18 +24,11 @@ func (e ExecMultiplexer) writeSynthEvent(se *SynthEvent) { } if se.Type == "journey/start" { - e.currentJourney.Store(true) e.eventCounter.Store(-1) } - hasCurrentJourney := e.currentJourney.Load() - if se.Type == "journey/end" || se.Type == "cmd/status" { - e.currentJourney.Store(false) - } - se.index = e.eventCounter.Inc() - if hasCurrentJourney { - e.synthEvents <- se - } + + e.synthEvents <- se } // SynthEvents returns a read only channel for synth events @@ -56,9 +48,8 @@ func (e ExecMultiplexer) Wait() { func NewExecMultiplexer() *ExecMultiplexer { return &ExecMultiplexer{ - currentJourney: atomic.NewBool(false), - eventCounter: atomic.NewInt(-1), // Start from -1 so first call to Inc returns 0 - synthEvents: make(chan *SynthEvent), - done: make(chan struct{}), + eventCounter: atomic.NewInt(-1), // Start from -1 so first call to Inc returns 0 + synthEvents: make(chan *SynthEvent), + done: make(chan struct{}), } } diff --git a/x-pack/heartbeat/monitors/browser/synthexec/execmultiplexer_test.go b/x-pack/heartbeat/monitors/browser/synthexec/execmultiplexer_test.go index ec85a6b52229..310da4967a3f 100644 --- a/x-pack/heartbeat/monitors/browser/synthexec/execmultiplexer_test.go +++ b/x-pack/heartbeat/monitors/browser/synthexec/execmultiplexer_test.go @@ -18,7 +18,7 @@ func TestExecMultiplexer(t *testing.T) { var testJourneys []*Journey var testEvents []*SynthEvent time := float64(0) - for jIdx := 0; jIdx < 4; jIdx++ { + for jIdx := 0; jIdx < 3; jIdx++ { time++ // fake time to make events seem spaced out journey := &Journey{ Name: fmt.Sprintf("J%d", jIdx), @@ -44,21 +44,11 @@ func TestExecMultiplexer(t *testing.T) { TimestampEpochMicros: time, }) } - - // We want one of the test journeys to end with a cmd/status indicating it failed - if jIdx != 4 { - testEvents = append(testEvents, &SynthEvent{ - Journey: journey, - Type: "journey/end", - TimestampEpochMicros: time, - }) - } else { - testEvents = append(testEvents, &SynthEvent{ - Journey: journey, - Type: "cmd/status", - TimestampEpochMicros: time, - }) - } + testEvents = append(testEvents, &SynthEvent{ + Journey: journey, + Type: "journey/end", + TimestampEpochMicros: time, + }) } // Write the test events in another go routine since writes block @@ -86,7 +76,7 @@ Loop: i := 0 // counter for index, resets on journey change for _, se := range results { require.Equal(t, i, se.index) - if se.Type == "journey/end" || se.Type == "cmd/status" { + if se.Type == "journey/end" { i = 0 } else { i++ diff --git a/x-pack/heartbeat/monitors/browser/synthexec/synthexec.go b/x-pack/heartbeat/monitors/browser/synthexec/synthexec.go index 039a3480c800..b2b8d9c612de 100644 --- a/x-pack/heartbeat/monitors/browser/synthexec/synthexec.go +++ b/x-pack/heartbeat/monitors/browser/synthexec/synthexec.go @@ -26,13 +26,20 @@ import ( const debugSelector = "synthexec" +type StdSuiteFields struct { + Name string + Id string + Type string + IsInline bool +} + type FilterJourneyConfig struct { Tags []string `config:"tags"` Match string `config:"match"` } // SuiteJob will run a single journey by name from the given suite. -func SuiteJob(ctx context.Context, suitePath string, params common.MapStr, filterJourneys FilterJourneyConfig, extraArgs ...string) (jobs.Job, error) { +func SuiteJob(ctx context.Context, suitePath string, params common.MapStr, filterJourneys FilterJourneyConfig, fields StdSuiteFields, extraArgs ...string) (jobs.Job, error) { // Run the command in the given suitePath, use '.' as the first arg since the command runs // in the correct dir cmdFactory, err := suiteCommandFactory(suitePath, extraArgs...) @@ -40,7 +47,7 @@ func SuiteJob(ctx context.Context, suitePath string, params common.MapStr, filte return nil, err } - return startCmdJob(ctx, cmdFactory, nil, params, filterJourneys), nil + return startCmdJob(ctx, cmdFactory, nil, params, filterJourneys, fields), nil } func suiteCommandFactory(suitePath string, args ...string) (func() *exec.Cmd, error) { @@ -64,40 +71,38 @@ func suiteCommandFactory(suitePath string, args ...string) (func() *exec.Cmd, er } // InlineJourneyJob returns a job that runs the given source as a single journey. -func InlineJourneyJob(ctx context.Context, script string, params common.MapStr, extraArgs ...string) jobs.Job { +func InlineJourneyJob(ctx context.Context, script string, params common.MapStr, fields StdSuiteFields, extraArgs ...string) jobs.Job { newCmd := func() *exec.Cmd { return exec.Command("elastic-synthetics", append(extraArgs, "--inline")...) } - return startCmdJob(ctx, newCmd, &script, params, FilterJourneyConfig{}) + return startCmdJob(ctx, newCmd, &script, params, FilterJourneyConfig{}, fields) } // startCmdJob adapts commands into a heartbeat job. This is a little awkward given that the command's output is // available via a sequence of events in the multiplexer, while heartbeat jobs are tail recursive continuations. // Here, we adapt one to the other, where each recursive job pulls another item off the chan until none are left. -func startCmdJob(ctx context.Context, newCmd func() *exec.Cmd, stdinStr *string, params common.MapStr, filterJourneys FilterJourneyConfig) jobs.Job { +func startCmdJob(ctx context.Context, newCmd func() *exec.Cmd, stdinStr *string, params common.MapStr, filterJourneys FilterJourneyConfig, fields StdSuiteFields) jobs.Job { return func(event *beat.Event) ([]jobs.Job, error) { mpx, err := runCmd(ctx, newCmd(), stdinStr, params, filterJourneys) if err != nil { return nil, err } senr := streamEnricher{} - return []jobs.Job{readResultsJob(ctx, mpx.SynthEvents(), senr.enrich)}, nil + return []jobs.Job{readResultsJob(ctx, mpx.SynthEvents(), senr.enrich, fields)}, nil } } // readResultsJob adapts the output of an ExecMultiplexer into a Job, that uses continuations // to read all output. -func readResultsJob(ctx context.Context, synthEvents <-chan *SynthEvent, enrich enricher) jobs.Job { +func readResultsJob(ctx context.Context, synthEvents <-chan *SynthEvent, enrich enricher, fields StdSuiteFields) jobs.Job { return func(event *beat.Event) (conts []jobs.Job, err error) { - select { - case se := <-synthEvents: - err = enrich(event, se) - if se != nil { - return []jobs.Job{readResultsJob(ctx, synthEvents, enrich)}, err - } else { - return nil, err - } + se := <-synthEvents + err = enrich(event, se, fields) + if se != nil { + return []jobs.Job{readResultsJob(ctx, synthEvents, enrich, fields)}, err + } else { + return nil, err } } } @@ -156,6 +161,9 @@ func runCmd( // Send stdout into the output stdoutPipe, err := cmd.StdoutPipe() + if err != nil { + return nil, fmt.Errorf("could not open stdout pipe: %w", err) + } wg.Add(1) go func() { scanToSynthEvents(stdoutPipe, stdoutToSynthEvent, mpx.writeSynthEvent) @@ -163,6 +171,9 @@ func runCmd( }() stderrPipe, err := cmd.StderrPipe() + if err != nil { + return nil, fmt.Errorf("could not open stderr pipe: %w", err) + } wg.Add(1) go func() { scanToSynthEvents(stderrPipe, stderrToSynthEvent, mpx.writeSynthEvent) @@ -217,11 +228,6 @@ func scanToSynthEvents(rdr io.ReadCloser, transform func(bytes []byte, text stri scanner.Buffer(buf, 1024*1024*40) // Max 50MiB Buffer for scanner.Scan() { - if scanner.Err() != nil { - logp.Warn("Error scanning results %s", scanner.Err()) - return scanner.Err() - } - se, err := transform(scanner.Bytes(), scanner.Text()) if err != nil { logp.Warn("error parsing line: %s for line: %s", err, scanner.Text()) @@ -232,6 +238,11 @@ func scanToSynthEvents(rdr io.ReadCloser, transform func(bytes []byte, text stri } } + if scanner.Err() != nil { + logp.Warn("error scanning synthetics runner results %s", scanner.Err()) + return scanner.Err() + } + return nil } @@ -245,7 +256,7 @@ func lineToSynthEventFactory(typ string) func(bytes []byte, text string) (res *S return &SynthEvent{ Type: typ, TimestampEpochMicros: float64(time.Now().UnixMicro()), - Payload: map[string]interface{}{ + Payload: common.MapStr{ "message": text, }, }, nil @@ -270,7 +281,7 @@ func jsonToSynthEvent(bytes []byte, text string) (res *SynthEvent, err error) { } if res.Type == "" { - return nil, fmt.Errorf("Unmarshal succeeded, but no type found for: %s", text) + return nil, fmt.Errorf("unmarshal succeeded, but no type found for: %s", text) } return } From debc22d70beb3fde25efeca32413000cbb6f06d1 Mon Sep 17 00:00:00 2001 From: Michael Katsoulis Date: Tue, 1 Feb 2022 09:23:15 +0200 Subject: [PATCH 04/20] Add integration tests to containerd module (#30088) * Add i testdata to containerd module --- metricbeat/docs/fields.asciidoc | 10 +++ metricbeat/docs/modules/containerd.asciidoc | 1 + x-pack/metricbeat/metricbeat.reference.yml | 1 + .../module/containerd/_meta/config.yml | 1 + .../module/containerd/blkio/_meta/data.json | 46 ++++++------ .../module/containerd/blkio/_meta/fields.yml | 4 + .../blkio/_meta/testdata/config.yml | 3 + .../blkio/_meta/testdata/docs.plain | 15 ++++ .../_meta/testdata/docs.plain-expected.json | 38 ++++++++++ .../module/containerd/blkio/blkio.go | 1 + .../module/containerd/blkio/blkio_test.go | 6 ++ .../module/containerd/cpu/_meta/data.json | 22 ++---- .../containerd/cpu/_meta/testdata/docs.plain | 74 ------------------- .../metricbeat/module/containerd/cpu/cpu.go | 1 + x-pack/metricbeat/module/containerd/fields.go | 2 +- .../module/containerd/memory/_meta/data.json | 73 +++++++++--------- .../memory/_meta/testdata/config.yml | 3 + .../memory/_meta/testdata/docs.plain | 61 +++++++++++++++ .../_meta/testdata/docs.plain-expected.json | 57 ++++++++++++++ .../module/containerd/memory/memory.go | 1 + .../module/containerd/memory/memory_test.go | 6 ++ .../modules.d/containerd.yml.disabled | 1 + 22 files changed, 282 insertions(+), 145 deletions(-) create mode 100644 x-pack/metricbeat/module/containerd/blkio/_meta/testdata/config.yml create mode 100644 x-pack/metricbeat/module/containerd/blkio/_meta/testdata/docs.plain create mode 100644 x-pack/metricbeat/module/containerd/blkio/_meta/testdata/docs.plain-expected.json create mode 100644 x-pack/metricbeat/module/containerd/memory/_meta/testdata/config.yml create mode 100644 x-pack/metricbeat/module/containerd/memory/_meta/testdata/docs.plain create mode 100644 x-pack/metricbeat/module/containerd/memory/_meta/testdata/docs.plain-expected.json diff --git a/metricbeat/docs/fields.asciidoc b/metricbeat/docs/fields.asciidoc index f525089ad93e..1519dfc20878 100644 --- a/metricbeat/docs/fields.asciidoc +++ b/metricbeat/docs/fields.asciidoc @@ -10299,6 +10299,16 @@ Block I/O metrics. +*`containerd.blkio.device`*:: ++ +-- +Name of block device + + +type: keyword + +-- + [float] === read diff --git a/metricbeat/docs/modules/containerd.asciidoc b/metricbeat/docs/modules/containerd.asciidoc index 41c600b202bf..ed1ccc30d00b 100644 --- a/metricbeat/docs/modules/containerd.asciidoc +++ b/metricbeat/docs/modules/containerd.asciidoc @@ -69,6 +69,7 @@ metricbeat.modules: # if set to true, cpu and memory usage percentages will be calculated. Default is true calcpct.cpu: true calcpct.memory: true + #metrics_path: "v1/metrics" ---- diff --git a/x-pack/metricbeat/metricbeat.reference.yml b/x-pack/metricbeat/metricbeat.reference.yml index cb59390723f2..e34bef34c383 100644 --- a/x-pack/metricbeat/metricbeat.reference.yml +++ b/x-pack/metricbeat/metricbeat.reference.yml @@ -438,6 +438,7 @@ metricbeat.modules: # if set to true, cpu and memory usage percentages will be calculated. Default is true calcpct.cpu: true calcpct.memory: true + #metrics_path: "v1/metrics" #------------------------------- Coredns Module ------------------------------- diff --git a/x-pack/metricbeat/module/containerd/_meta/config.yml b/x-pack/metricbeat/module/containerd/_meta/config.yml index 6197801bfcb9..7401ac8ed74d 100644 --- a/x-pack/metricbeat/module/containerd/_meta/config.yml +++ b/x-pack/metricbeat/module/containerd/_meta/config.yml @@ -8,4 +8,5 @@ # if set to true, cpu and memory usage percentages will be calculated. Default is true calcpct.cpu: true calcpct.memory: true + #metrics_path: "v1/metrics" diff --git a/x-pack/metricbeat/module/containerd/blkio/_meta/data.json b/x-pack/metricbeat/module/containerd/blkio/_meta/data.json index d1f4774a7062..b3d80ce0114a 100644 --- a/x-pack/metricbeat/module/containerd/blkio/_meta/data.json +++ b/x-pack/metricbeat/module/containerd/blkio/_meta/data.json @@ -1,35 +1,37 @@ { - "@timestamp":"2016-05-23T08:05:34.853Z", - "beat":{ - "hostname":"beathost", - "name":"beathost" - }, - "metricset":{ - "host":"localhost", - "module":"containerd", - "name":"blkio", - "rtt":44269 + "@timestamp": "2019-03-01T08:05:34.853Z", + "container": { + "id": "7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d" }, "containerd": { "blkio": { + "device": "/dev/vda", "read": { - "ops": 168, - "bytes": 4952064 + "bytes": 69246976, + "ops": 830 }, "summary": { - "ops": 168, - "bytes": 4952064 + "bytes": 69271552, + "ops": 832 }, "write": { - "ops": 20, - "bytes": 123134 - }, - "device": "/dev/vda" + "bytes": 24576, + "ops": 2 + } }, "namespace": "k8s.io" }, - "container": { - "id": "b4d9e874a2de96e4512a32a49df09641fa792a99bebcc6d353723850a50db831" + "event": { + "dataset": "containerd.blkio", + "duration": 115000, + "module": "containerd" + }, + "metricset": { + "name": "blkio", + "period": 10000 }, - "type":"metricsets" -} + "service": { + "address": "127.0.0.1:55555", + "type": "containerd" + } +} \ No newline at end of file diff --git a/x-pack/metricbeat/module/containerd/blkio/_meta/fields.yml b/x-pack/metricbeat/module/containerd/blkio/_meta/fields.yml index adcd42288881..3efa0754bfb5 100644 --- a/x-pack/metricbeat/module/containerd/blkio/_meta/fields.yml +++ b/x-pack/metricbeat/module/containerd/blkio/_meta/fields.yml @@ -4,6 +4,10 @@ description: > Block I/O metrics. fields: + - name: device + type: keyword + description: > + Name of block device - name: read type: group description: > diff --git a/x-pack/metricbeat/module/containerd/blkio/_meta/testdata/config.yml b/x-pack/metricbeat/module/containerd/blkio/_meta/testdata/config.yml new file mode 100644 index 000000000000..e19c22ddc903 --- /dev/null +++ b/x-pack/metricbeat/module/containerd/blkio/_meta/testdata/config.yml @@ -0,0 +1,3 @@ +type: http +url: "/v1/metrics" +suffix: plain diff --git a/x-pack/metricbeat/module/containerd/blkio/_meta/testdata/docs.plain b/x-pack/metricbeat/module/containerd/blkio/_meta/testdata/docs.plain new file mode 100644 index 000000000000..cbd236fb9901 --- /dev/null +++ b/x-pack/metricbeat/module/containerd/blkio/_meta/testdata/docs.plain @@ -0,0 +1,15 @@ +# TYPE container_blkio_io_service_bytes_recursive_bytes gauge +container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Async"} 0 +container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Discard"} 0 +container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Read"} 6.9246976e+07 +container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Sync"} 6.9271552e+07 +container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Total"} 6.9271552e+07 +container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Write"} 24576 +# TYPE container_blkio_io_serviced_recursive_total gauge +container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Async"} 0 +container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Discard"} 0 +container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Read"} 830 +container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Sync"} 832 +container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Total"} 832 +container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Write"} 2 + diff --git a/x-pack/metricbeat/module/containerd/blkio/_meta/testdata/docs.plain-expected.json b/x-pack/metricbeat/module/containerd/blkio/_meta/testdata/docs.plain-expected.json new file mode 100644 index 000000000000..56abfe6343c6 --- /dev/null +++ b/x-pack/metricbeat/module/containerd/blkio/_meta/testdata/docs.plain-expected.json @@ -0,0 +1,38 @@ +[ + { + "container": { + "id": "7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d" + }, + "containerd": { + "blkio": { + "device": "/dev/vda", + "read": { + "bytes": 69246976, + "ops": 830 + }, + "summary": { + "bytes": 69271552, + "ops": 832 + }, + "write": { + "bytes": 24576, + "ops": 2 + } + }, + "namespace": "k8s.io" + }, + "event": { + "dataset": "containerd.blkio", + "duration": 115000, + "module": "containerd" + }, + "metricset": { + "name": "blkio", + "period": 10000 + }, + "service": { + "address": "127.0.0.1:55555", + "type": "containerd" + } + } +] \ No newline at end of file diff --git a/x-pack/metricbeat/module/containerd/blkio/blkio.go b/x-pack/metricbeat/module/containerd/blkio/blkio.go index 7ffb30e4aecd..72c19300f083 100644 --- a/x-pack/metricbeat/module/containerd/blkio/blkio.go +++ b/x-pack/metricbeat/module/containerd/blkio/blkio.go @@ -30,6 +30,7 @@ var ( hostParser = parse.URLHostParserBuilder{ DefaultScheme: defaultScheme, DefaultPath: defaultPath, + PathConfigKey: "metrics_path", }.Build() // Mapping of state metrics diff --git a/x-pack/metricbeat/module/containerd/blkio/blkio_test.go b/x-pack/metricbeat/module/containerd/blkio/blkio_test.go index 25eed0d28873..8794e259b086 100644 --- a/x-pack/metricbeat/module/containerd/blkio/blkio_test.go +++ b/x-pack/metricbeat/module/containerd/blkio/blkio_test.go @@ -26,6 +26,8 @@ package blkio import ( "testing" + mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" + "github.com/elastic/beats/v7/metricbeat/helper/prometheus/ptest" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/containerd" ) @@ -40,3 +42,7 @@ func TestEventMapping(t *testing.T) { }, ) } + +func TestData(t *testing.T) { + mbtest.TestDataFiles(t, "containerd", "blkio") +} diff --git a/x-pack/metricbeat/module/containerd/cpu/_meta/data.json b/x-pack/metricbeat/module/containerd/cpu/_meta/data.json index 1dc40fe4cb72..73210e76e26a 100644 --- a/x-pack/metricbeat/module/containerd/cpu/_meta/data.json +++ b/x-pack/metricbeat/module/containerd/cpu/_meta/data.json @@ -4,23 +4,17 @@ "id": "7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d" }, "containerd": { - "namespace": "k8s.io", "cpu": { "usage": { - "user": { - "ns": 22526620000000, - "pct": 0.2496932948025663 + "cpu": { + "4": { + "ns": 105731762224 + } }, - "total": { - "pct": 0.24969398913655017, - "ns": 22554111128186 - }, - "kernel": { - "ns": 16740000000, - "pct": 0 - } + "percpu": {} } - } + }, + "namespace": "k8s.io" }, "event": { "dataset": "containerd.cpu", @@ -35,4 +29,4 @@ "address": "127.0.0.1:55555", "type": "containerd" } -} +} \ No newline at end of file diff --git a/x-pack/metricbeat/module/containerd/cpu/_meta/testdata/docs.plain b/x-pack/metricbeat/module/containerd/cpu/_meta/testdata/docs.plain index f82e4d3c1d91..3a354ba38247 100644 --- a/x-pack/metricbeat/module/containerd/cpu/_meta/testdata/docs.plain +++ b/x-pack/metricbeat/module/containerd/cpu/_meta/testdata/docs.plain @@ -1,17 +1,3 @@ -# TYPE container_blkio_io_service_bytes_recursive_bytes gauge -container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Discard"} 0 -container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Read"} 6.9246976e+07 -container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Sync"} 6.9271552e+07 -container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Total"} 6.9271552e+07 -container_blkio_io_service_bytes_recursive_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Write"} 24576 -# TYPE container_blkio_io_serviced_recursive_total gauge -container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Async"} 0 -container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Discard"} 0 -container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Read"} 830 -container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Sync"} 832 -container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Total"} 832 -container_blkio_io_serviced_recursive_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",device="/dev/vda",major="254",minor="0",namespace="k8s.io",op="Write"} 2 # TYPE container_cpu_kernel_nanoseconds gauge container_cpu_kernel_nanoseconds{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 5.3218e+11 # TYPE container_cpu_throttle_periods_total gauge @@ -24,66 +10,6 @@ container_cpu_throttled_time_nanoseconds{container_id="7434687dbe3684407afa89958 container_cpu_total_nanoseconds{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.236339003984e+12 # TYPE container_cpu_user_nanoseconds gauge container_cpu_user_nanoseconds{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 5.2547e+11 -# TYPE container_memory_active_anon_bytes gauge -container_memory_active_anon_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_active_file_bytes gauge -container_memory_active_file_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.216512e+06 -# TYPE container_memory_cache_bytes gauge -container_memory_cache_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.40980224e+08 -# TYPE container_memory_dirty_bytes gauge -container_memory_dirty_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_inactive_anon_bytes gauge -container_memory_inactive_anon_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 4.4048384e+07 -# TYPE container_memory_inactive_file_bytes gauge -container_memory_inactive_file_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.3928448e+08 -# TYPE container_memory_kernel_failcnt_total gauge -container_memory_kernel_failcnt_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_kernel_limit_bytes gauge -container_memory_kernel_limit_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 9.223372036854772e+18 -# TYPE container_memory_kernel_max_bytes gauge -container_memory_kernel_max_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 6.496256e+06 -# TYPE container_memory_kernel_usage_bytes gauge -container_memory_kernel_usage_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 6.459392e+06 -# TYPE container_memory_kerneltcp_failcnt_total gauge -container_memory_kerneltcp_failcnt_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_kerneltcp_limit_bytes gauge -container_memory_kerneltcp_limit_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 9.223372036854772e+18 -# TYPE container_memory_kerneltcp_max_bytes gauge -container_memory_kerneltcp_max_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_kerneltcp_usage_bytes gauge -container_memory_kerneltcp_usage_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_rss_bytes gauge -container_memory_rss_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 4.3794432e+07 -# TYPE container_memory_rss_huge_bytes gauge -container_memory_rss_huge_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_swap_failcnt_total gauge -container_memory_swap_failcnt_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_swap_limit_bytes gauge -container_memory_swap_limit_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 9.223372036854772e+18 -# TYPE container_memory_swap_max_bytes gauge -container_memory_swap_max_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 2.09727488e+08 -# TYPE container_memory_swap_usage_bytes gauge -container_memory_swap_usage_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.9195904e+08 -# TYPE container_memory_total_active_anon_bytes gauge -container_memory_total_active_anon_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_total_active_file_bytes gauge -container_memory_total_active_file_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.216512e+06 -# TYPE container_memory_total_cache_bytes gauge -container_memory_total_cache_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.40980224e+08 -# TYPE container_memory_total_inactive_anon_bytes gauge -container_memory_total_inactive_anon_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 4.4048384e+07 -# TYPE container_memory_total_inactive_file_bytes gauge -container_memory_total_inactive_file_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.3928448e+08 -# TYPE container_memory_total_rss_bytes gauge -container_memory_total_rss_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 4.3794432e+07 -# TYPE container_memory_usage_failcnt_total gauge -container_memory_usage_failcnt_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 -# TYPE container_memory_usage_limit_bytes gauge -container_memory_usage_limit_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 2.097152e+08 -# TYPE container_memory_usage_max_bytes gauge -container_memory_usage_max_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 2.09608704e+08 -# TYPE container_memory_usage_usage_bytes gauge -container_memory_usage_usage_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.91848448e+08 # TYPE container_per_cpu_nanoseconds gauge container_per_cpu_nanoseconds{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",cpu="0",namespace="k8s.io"} 9.913781757e+10 container_per_cpu_nanoseconds{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",cpu="1",namespace="k8s.io"} 1.16475261138e+11 diff --git a/x-pack/metricbeat/module/containerd/cpu/cpu.go b/x-pack/metricbeat/module/containerd/cpu/cpu.go index 135092f8184b..299005134603 100644 --- a/x-pack/metricbeat/module/containerd/cpu/cpu.go +++ b/x-pack/metricbeat/module/containerd/cpu/cpu.go @@ -30,6 +30,7 @@ var ( hostParser = parse.URLHostParserBuilder{ DefaultScheme: defaultScheme, DefaultPath: defaultPath, + PathConfigKey: "metrics_path", }.Build() // Mapping of state metrics diff --git a/x-pack/metricbeat/module/containerd/fields.go b/x-pack/metricbeat/module/containerd/fields.go index 134bc54e6d0a..9cc2c58832fb 100644 --- a/x-pack/metricbeat/module/containerd/fields.go +++ b/x-pack/metricbeat/module/containerd/fields.go @@ -19,5 +19,5 @@ func init() { // AssetContainerd returns asset data. // This is the base64 encoded zlib format compressed contents of module/containerd. func AssetContainerd() string { - return "eJzUmM1u2zAMx+95CqKXAQOa3XMYsBYoUAzdim09F4pMp1pkydDH0vTpB8p26tjyR4IGcXQYBjsmf6T+JKVewxq3C+BaOSYUmmQG4ISTuICr293DqxmAQYnM4gKW6NgMIEHLjcid0GoBX2cAAO8fgHXMWeBaSuQOE0iNzva9pAJlYhfhw2tQLMMGBi23zXEBK6N9Xj6JuKV1r1JtMkaPganCv7BOcAtsqb2rmf5kwXilhFq9P7Tz0lKdqk5G/9qccdy9qeDWuN3oHXAPYiNDbYuVr6VcC93yU08CreZ+jPB+IzVfw/2Xn5ChM4Lvoo5FXicyyJK9F11QAwC0vnHuMy8ZqYLsWki8oc1wLwhSpAg6Df/fbU7DRAy0Dqtz23pX8UqtVpGXA8i0fvhsiYbYjoKu7e7W4cGAhbi7Px4RwA19GuAPY6+4N0Y4PIUIguGLU8Fx1FORAdE7VMcpwfosY2Z7uoZADfwyVUG9VedowiC6WHWEJlFtwkEyac0ynvvBSTZuXv7yyokM4fbxKTa+usZh31izW+swmzvtmIyqOdF+KZtNbyCNf8gaeIumOIgEH4E64NsclQOhwCLXKtmL4Z3MW7Ya32yHVL9Go7AZYb/JPrN10yomNOhPYLVG6JEWpe57iKBICyimdJm9zpAp/5cc8BPpZ3y4MQlfVLyurJqDAp7n3HUGbTmTmDynUrPYj6pmmaPhqGK/GEH/WHxM0NQSQwy7SlfkQYo3TGC5Df1S7eYE/YhrE2nT+zU7tQgpLqFKOAjXl3FxznsrdaJhhib+IUHy3M8/z6O1VASpl38xmoPixfNAtY0IkShb9UVRuhdhA2BreGeY6b1z3ofdRFuW+8b0Rpu1UCuLLqKTQY3062MgcQ+BsyIAi66yw1YYH93GNne589DWd2Abdcoo0ggGrUjoWEF8Vrx1kDHuxD+8E7Ll7HSEhU9IhcTCSByNM/4SP++cAip468MR6hy5qrwOZuuw0+GA76fQE0olhT/bNdvY0PEyY69nuKo8sNeKOuSju/mee7iUlSCl5uGSW1J3NRIYfa47XXL32stAelMm5JxrH03PqCyPALpjQkJwgqYbRYpMdFOcUIu1RBUQ8cKNXsSOrtzyUnR5pVuBj67gc5VBCeqmVg0lVzrpotiXZ09V2A1rKv/omvi9YfkFVkSBPfl6CJiTq4ZANe1aqMuyUQmz/wEAAP//Ep8/EQ==" + return "eJzUmE1v8zYMx+/5FEQvAwY0u+cwYC1QoBi6Fdt6LmSZTrXoxdBL0/TTP5Bsp44t20qeBnF0KAq/kD/Sf5JSbmGDuxVQJS1hEnW+ALDMclzBzf3+4s0CQCNHYnAFGVqyAMjRUM1Ky5Rcwe8LAICvF8BYYg1QxTlSizkUWolDLwVDnptVePEWJBHYwfDL7kpcwVorV9ZXIm79epSF0oL4y0Bk5Z8Zy6gBkilnW6Z/MaCdlEyuvy6aZW2pTdUm839NSSju7zRwG9xt1R54BLGTob7FxlfGN0z1/LST4Ff3eyR4v+OKbuDxt79BoNWM7qOORd4myvGdHYQ+Fv4EhF9/EYGgCsgCUMR641gj6ZqOZyPB6R+UOuE48XL0dg3kTnsV2DcEzopA5P/fq6JjIpahNqwqTe9ew8uVXEduTiCHXDmRofZsJ0G3ZLWzeDRgVVXDLycEcOdfDfDHsTfcW81sXHs/KYJg+OpUcBr1XGTg6S3K05RgnBBE787XEPzkuE5V+KauStRhAl6tOkKTaD7CUTLpDVFauskRmjao/3HSMoFw//wSm5tDc3hsnpqdsSiWVlnCo2rOlct4t+lNpPE/bw2cQV3tgIKPQB3wTYnSApNgkCqZH8TwReYMWac32ynVb1BL7EY4bnLMbNu0jAkNxhPYrAQ9+uVT92eIoEoLSCJVnb3BkH3+rzngF6+f9HBjEr6qeG1dNUcFvCypHQzaUMIxfy24IrGHmmZZoqYoY08k0D9XL3to3xJDDPtKl94DZ5+YQ7YL/VLu54R/iCodadOHNTu3CH1cTNZwEM5NaXEuRyt1pmGGJv4tQdLSLX9dRmupClJl/2M0B9WN14lqSwjRU/bqy0dp35gJgL3hLVCog33etx2Be5bHxvRW6Q2Ta4M2opNJjYzrYyJxT4GzIQCDtrFD1hgf3dp0v/Lgpm1sw5a0y6jSCBoNy/22wvMZ9jlARqhl7/jAeM/Z+Qgrn1AwjpWROBol9C2+3zkHVPA2hsPkJXLVeJ3M1nG7wwnfL6En1EoKvxd229jU9lKQjwscVZ7IR0Md8jHcfC89XOpK4FzRcMitqYcaCSTv686X3IP2MpHegjC+pMpF05OU5QSgB8I4BCeoh1E4E2yY4oxabCWqgogXbvQgdnLl1oei6yvdBjy5gi9VBjWonVs11FzFrIviUJ4jVWG2pKv8k2vi3y0pr7AiKuzZ10PAnF01BKp510Jblp1KWPwIAAD//wv4XH8=" } diff --git a/x-pack/metricbeat/module/containerd/memory/_meta/data.json b/x-pack/metricbeat/module/containerd/memory/_meta/data.json index 67eceb1ad104..4012d947fcc9 100644 --- a/x-pack/metricbeat/module/containerd/memory/_meta/data.json +++ b/x-pack/metricbeat/module/containerd/memory/_meta/data.json @@ -1,51 +1,56 @@ { - "@timestamp":"2016-05-23T08:05:34.853Z", - "beat":{ - "hostname":"beathost", - "name":"beathost" - }, - "metricset":{ - "host":"localhost", - "module":"containerd", - "name":"memory", - "rtt":44269 + "@timestamp": "2019-03-01T08:05:34.853Z", + "container": { + "id": "7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d" }, "containerd": { - "namespace": "k8s.io", "memory": { - "activeFiles": 0, - "workingset": { - "pct": 0.07224264705882352 - }, - "swap": { - "limit": 9223372036854772000, - "total": 49373184, - "max": 49848320, + "activeFiles": 1216512, + "cache": 140980224, + "inactiveFiles": 139284480, + "kernel": { "fail": { "count": 0 - } - }, - "kernel": { + }, "limit": 9223372036854772000, + "max": 6496256, + "total": 6459392 + }, + "rss": 43794432, + "swap": { "fail": { "count": 0 }, - "max": 843776, - "total": 827392 + "limit": 9223372036854772000, + "max": 209727488, + "total": 191959040 }, - "rss": 13651968, - "cache": 33792000, "usage": { "fail": { "count": 0 }, - "limit": 178257920, - "total": 49373184, - "pct": 0.27697610294117647, - "max": 49848320 + "limit": 209715200, + "max": 209608704, + "pct": 0.9148046875, + "total": 191848448 }, - "inactiveFiles": 36495360 - } + "workingset": { + "pct": 0.25064453125 + } + }, + "namespace": "k8s.io" + }, + "event": { + "dataset": "containerd.memory", + "duration": 115000, + "module": "containerd" + }, + "metricset": { + "name": "memory", + "period": 10000 }, - "type":"metricsets" -} + "service": { + "address": "127.0.0.1:55555", + "type": "containerd" + } +} \ No newline at end of file diff --git a/x-pack/metricbeat/module/containerd/memory/_meta/testdata/config.yml b/x-pack/metricbeat/module/containerd/memory/_meta/testdata/config.yml new file mode 100644 index 000000000000..e19c22ddc903 --- /dev/null +++ b/x-pack/metricbeat/module/containerd/memory/_meta/testdata/config.yml @@ -0,0 +1,3 @@ +type: http +url: "/v1/metrics" +suffix: plain diff --git a/x-pack/metricbeat/module/containerd/memory/_meta/testdata/docs.plain b/x-pack/metricbeat/module/containerd/memory/_meta/testdata/docs.plain new file mode 100644 index 000000000000..ac6b0adc0e46 --- /dev/null +++ b/x-pack/metricbeat/module/containerd/memory/_meta/testdata/docs.plain @@ -0,0 +1,61 @@ +# TYPE container_memory_active_anon_bytes gauge +container_memory_active_anon_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_active_file_bytes gauge +container_memory_active_file_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.216512e+06 +# TYPE container_memory_cache_bytes gauge +container_memory_cache_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.40980224e+08 +# TYPE container_memory_dirty_bytes gauge +container_memory_dirty_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_inactive_anon_bytes gauge +container_memory_inactive_anon_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 4.4048384e+07 +# TYPE container_memory_inactive_file_bytes gauge +container_memory_inactive_file_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.3928448e+08 +# TYPE container_memory_kernel_failcnt_total gauge +container_memory_kernel_failcnt_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_kernel_limit_bytes gauge +container_memory_kernel_limit_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 9.223372036854772e+18 +# TYPE container_memory_kernel_max_bytes gauge +container_memory_kernel_max_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 6.496256e+06 +# TYPE container_memory_kernel_usage_bytes gauge +container_memory_kernel_usage_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 6.459392e+06 +# TYPE container_memory_kerneltcp_failcnt_total gauge +container_memory_kerneltcp_failcnt_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_kerneltcp_limit_bytes gauge +container_memory_kerneltcp_limit_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 9.223372036854772e+18 +# TYPE container_memory_kerneltcp_max_bytes gauge +container_memory_kerneltcp_max_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_kerneltcp_usage_bytes gauge +container_memory_kerneltcp_usage_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_rss_bytes gauge +container_memory_rss_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 4.3794432e+07 +# TYPE container_memory_rss_huge_bytes gauge +container_memory_rss_huge_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_swap_failcnt_total gauge +container_memory_swap_failcnt_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_swap_limit_bytes gauge +container_memory_swap_limit_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 9.223372036854772e+18 +# TYPE container_memory_swap_max_bytes gauge +container_memory_swap_max_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 2.09727488e+08 +# TYPE container_memory_swap_usage_bytes gauge +container_memory_swap_usage_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.9195904e+08 +# TYPE container_memory_total_active_anon_bytes gauge +container_memory_total_active_anon_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_total_active_file_bytes gauge +container_memory_total_active_file_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.216512e+06 +# TYPE container_memory_total_cache_bytes gauge +container_memory_total_cache_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.40980224e+08 +# TYPE container_memory_total_inactive_anon_bytes gauge +container_memory_total_inactive_anon_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 4.4048384e+07 +# TYPE container_memory_total_inactive_file_bytes gauge +container_memory_total_inactive_file_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.3928448e+08 +# TYPE container_memory_total_rss_bytes gauge +container_memory_total_rss_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 4.3794432e+07 +# TYPE container_memory_usage_failcnt_total gauge +container_memory_usage_failcnt_total{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 0 +# TYPE container_memory_usage_limit_bytes gauge +container_memory_usage_limit_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 2.097152e+08 +# TYPE container_memory_usage_max_bytes gauge +container_memory_usage_max_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 2.09608704e+08 +# TYPE container_memory_usage_usage_bytes gauge +container_memory_usage_usage_bytes{container_id="7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d",namespace="k8s.io"} 1.91848448e+08 + diff --git a/x-pack/metricbeat/module/containerd/memory/_meta/testdata/docs.plain-expected.json b/x-pack/metricbeat/module/containerd/memory/_meta/testdata/docs.plain-expected.json new file mode 100644 index 000000000000..1b22b452c6cd --- /dev/null +++ b/x-pack/metricbeat/module/containerd/memory/_meta/testdata/docs.plain-expected.json @@ -0,0 +1,57 @@ +[ + { + "container": { + "id": "7434687dbe3684407afa899582f2909203b9dc5537632b512f76798db5c0787d" + }, + "containerd": { + "memory": { + "activeFiles": 1216512, + "cache": 140980224, + "inactiveFiles": 139284480, + "kernel": { + "fail": { + "count": 0 + }, + "limit": 9223372036854772000, + "max": 6496256, + "total": 6459392 + }, + "rss": 43794432, + "swap": { + "fail": { + "count": 0 + }, + "limit": 9223372036854772000, + "max": 209727488, + "total": 191959040 + }, + "usage": { + "fail": { + "count": 0 + }, + "limit": 209715200, + "max": 209608704, + "pct": 0.9148046875, + "total": 191848448 + }, + "workingset": { + "pct": 0.25064453125 + } + }, + "namespace": "k8s.io" + }, + "event": { + "dataset": "containerd.memory", + "duration": 115000, + "module": "containerd" + }, + "metricset": { + "name": "memory", + "period": 10000 + }, + "service": { + "address": "127.0.0.1:55555", + "type": "containerd" + } + } +] \ No newline at end of file diff --git a/x-pack/metricbeat/module/containerd/memory/memory.go b/x-pack/metricbeat/module/containerd/memory/memory.go index 0bdc961a0e43..2e02559dcf03 100644 --- a/x-pack/metricbeat/module/containerd/memory/memory.go +++ b/x-pack/metricbeat/module/containerd/memory/memory.go @@ -29,6 +29,7 @@ var ( hostParser = parse.URLHostParserBuilder{ DefaultScheme: defaultScheme, DefaultPath: defaultPath, + PathConfigKey: "metrics_path", }.Build() // Mapping of state metrics diff --git a/x-pack/metricbeat/module/containerd/memory/memory_test.go b/x-pack/metricbeat/module/containerd/memory/memory_test.go index 027ea9b598ff..1108e7718d38 100644 --- a/x-pack/metricbeat/module/containerd/memory/memory_test.go +++ b/x-pack/metricbeat/module/containerd/memory/memory_test.go @@ -10,6 +10,8 @@ package memory import ( "testing" + mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing" + "github.com/elastic/beats/v7/metricbeat/helper/prometheus/ptest" _ "github.com/elastic/beats/v7/x-pack/metricbeat/module/containerd" ) @@ -24,3 +26,7 @@ func TestEventMapping(t *testing.T) { }, ) } + +func TestData(t *testing.T) { + mbtest.TestDataFiles(t, "containerd", "memory") +} diff --git a/x-pack/metricbeat/modules.d/containerd.yml.disabled b/x-pack/metricbeat/modules.d/containerd.yml.disabled index cc735a455c72..f21b32139eb1 100644 --- a/x-pack/metricbeat/modules.d/containerd.yml.disabled +++ b/x-pack/metricbeat/modules.d/containerd.yml.disabled @@ -11,4 +11,5 @@ # if set to true, cpu and memory usage percentages will be calculated. Default is true calcpct.cpu: true calcpct.memory: true + #metrics_path: "v1/metrics" From 395ee91758c3717f2fa92f2ae2d923c82261dee3 Mon Sep 17 00:00:00 2001 From: stuart nelson Date: Tue, 1 Feb 2022 10:00:10 +0100 Subject: [PATCH 05/20] [elastic-agent] initial apm instrumentation (#29031) --- NOTICE.txt | 1180 +++++++++++++++-- go.mod | 8 +- go.sum | 19 +- .../pkg/agent/application/application.go | 20 +- .../application/fleet_server_bootstrap.go | 15 +- .../gateway/fleet/fleet_gateway.go | 2 +- .../gateway/fleet/fleet_gateway_test.go | 2 +- .../fleetserver/fleet_gateway_local.go | 2 +- .../pkg/agent/application/local_mode.go | 5 +- .../pkg/agent/application/managed_mode.go | 8 +- .../agent/application/managed_mode_test.go | 4 +- .../pkg/agent/application/once.go | 8 +- .../pkg/agent/application/periodic.go | 3 +- .../handlers/handler_action_policy_change.go | 2 +- .../handler_action_policy_change_test.go | 2 +- .../handlers/handler_action_unenroll.go | 2 +- .../pipeline/dispatcher/dispatcher.go | 19 +- .../pipeline/dispatcher/dispatcher_test.go | 10 +- .../pipeline/emitter/controller.go | 69 +- .../application/pipeline/emitter/emitter.go | 16 +- .../agent/application/pipeline/pipeline.go | 12 +- .../application/pipeline/router/router.go | 5 +- .../pipeline/router/router_test.go | 20 +- .../pipeline/stream/operator_stream.go | 16 +- .../application/upgrade/step_download.go | 11 +- .../pkg/agent/application/upgrade/upgrade.go | 4 + .../elastic-agent/pkg/agent/cmd/enroll_cmd.go | 29 +- x-pack/elastic-agent/pkg/agent/cmd/inspect.go | 4 +- x-pack/elastic-agent/pkg/agent/cmd/run.go | 93 +- .../pkg/agent/control/control_test.go | 8 +- .../pkg/agent/control/server/server.go | 13 +- .../pkg/agent/operation/common_test.go | 5 +- .../pkg/agent/operation/monitoring_test.go | 4 +- .../pkg/agent/operation/operator.go | 13 +- .../pkg/agent/storage/store/state_store.go | 5 +- .../artifact/download/composed/downloader.go | 3 + .../pkg/artifact/download/fs/downloader.go | 7 +- .../pkg/basecmd/version/cmd_test.go | 7 +- .../pkg/core/monitoring/config/config.go | 25 + .../pkg/core/monitoring/config/config_test.go | 66 + .../pkg/core/monitoring/server/server.go | 17 +- .../elastic-agent/pkg/core/server/config.go | 6 +- .../pkg/core/server/config_test.go | 2 +- .../elastic-agent/pkg/core/server/server.go | 16 +- .../pkg/core/server/server_test.go | 4 +- x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go | 38 +- .../pkg/fleetapi/acker/fleet/fleet_acker.go | 24 +- .../pkg/fleetapi/acker/lazy/lazy_acker.go | 25 +- .../pkg/fleetapi/client/client.go | 4 +- x-pack/elastic-agent/pkg/remote/client.go | 3 + 50 files changed, 1669 insertions(+), 216 deletions(-) create mode 100644 x-pack/elastic-agent/pkg/core/monitoring/config/config_test.go diff --git a/NOTICE.txt b/NOTICE.txt index 75163cd38c41..1adcddab37dd 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -15483,11 +15483,433 @@ Contents of probable licence file $GOMODCACHE/github.com/xdg/scram@v1.0.3/LICENS -------------------------------------------------------------------------------- Dependency : go.elastic.co/apm -Version: v1.11.0 +Version: v1.14.0 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/go.elastic.co/apm@v1.14.0/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2018 Elasticsearch BV + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : go.elastic.co/apm/module/apmelasticsearch +Version: v1.7.2 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/go.elastic.co/apm/module/apmelasticsearch@v1.7.2/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2018 Elasticsearch BV + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : go.elastic.co/apm/module/apmgorilla +Version: v1.14.0 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/go.elastic.co/apm@v1.11.0/LICENSE: +Contents of probable licence file $GOMODCACHE/go.elastic.co/apm/module/apmgorilla@v1.14.0/LICENSE: Apache License Version 2.0, January 2004 @@ -15693,12 +16115,12 @@ Contents of probable licence file $GOMODCACHE/go.elastic.co/apm@v1.11.0/LICENSE: -------------------------------------------------------------------------------- -Dependency : go.elastic.co/apm/module/apmelasticsearch -Version: v1.7.2 +Dependency : go.elastic.co/apm/module/apmgrpc +Version: v1.14.0 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/go.elastic.co/apm/module/apmelasticsearch@v1.7.2/LICENSE: +Contents of probable licence file $GOMODCACHE/go.elastic.co/apm/module/apmgrpc@v1.14.0/LICENSE: Apache License Version 2.0, January 2004 @@ -15905,11 +16327,11 @@ Contents of probable licence file $GOMODCACHE/go.elastic.co/apm/module/apmelasti -------------------------------------------------------------------------------- Dependency : go.elastic.co/apm/module/apmhttp -Version: v1.7.2 +Version: v1.14.0 Licence type (autodetected): Apache-2.0 -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/go.elastic.co/apm/module/apmhttp@v1.7.2/LICENSE: +Contents of probable licence file $GOMODCACHE/go.elastic.co/apm/module/apmhttp@v1.14.0/LICENSE: Apache License Version 2.0, January 2004 @@ -23215,37 +23637,6 @@ OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --------------------------------------------------------------------------------- -Dependency : github.com/cucumber/godog -Version: v0.8.1 -Licence type (autodetected): MIT --------------------------------------------------------------------------------- - -Contents of probable licence file $GOMODCACHE/github.com/cucumber/godog@v0.8.1/LICENSE: - -The MIT License (MIT) - -Copyright (c) SmartBear - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - - -------------------------------------------------------------------------------- Dependency : github.com/cyphar/filepath-securejoin Version: v0.2.3 @@ -27061,37 +27452,247 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --------------------------------------------------------------------------------- -Dependency : github.com/gorilla/websocket -Version: v1.4.2 -Licence type (autodetected): BSD-2-Clause --------------------------------------------------------------------------------- +-------------------------------------------------------------------------------- +Dependency : github.com/gorilla/websocket +Version: v1.4.2 +Licence type (autodetected): BSD-2-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/gorilla/websocket@v1.4.2/LICENSE: + +Copyright (c) 2013 The Gorilla WebSocket Authors. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + + Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + + Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/grpc-ecosystem/go-grpc-middleware +Version: v1.0.1-0.20190118093823-f849b5445de4 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/grpc-ecosystem/go-grpc-middleware@v1.0.1-0.20190118093823-f849b5445de4/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. -Contents of probable licence file $GOMODCACHE/github.com/gorilla/websocket@v1.4.2/LICENSE: + END OF TERMS AND CONDITIONS -Copyright (c) 2013 The Gorilla WebSocket Authors. All rights reserved. + APPENDIX: How to apply the Apache License to your work. -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are met: + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. - Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. + Copyright [yyyy] [name of copyright owner] - Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND -ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE -FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER -CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, -OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + http://www.apache.org/licenses/LICENSE-2.0 + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. -------------------------------------------------------------------------------- Dependency : github.com/hashicorp/cronexpr @@ -29221,27 +29822,238 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --------------------------------------------------------------------------------- -Dependency : github.com/inconshreveable/mousetrap -Version: v1.0.0 -Licence type (autodetected): Apache-2.0 --------------------------------------------------------------------------------- +-------------------------------------------------------------------------------- +Dependency : github.com/inconshreveable/mousetrap +Version: v1.0.0 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/inconshreveable/mousetrap@v1.0.0/LICENSE: + +Copyright 2014 Alan Shreve + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + + +-------------------------------------------------------------------------------- +Dependency : github.com/jcchavezs/porto +Version: v0.1.0 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/jcchavezs/porto@v0.1.0/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS -Contents of probable licence file $GOMODCACHE/github.com/inconshreveable/mousetrap@v1.0.0/LICENSE: + APPENDIX: How to apply the Apache License to your work. -Copyright 2014 Alan Shreve + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at + Copyright [yyyy] [name of copyright owner] - http://www.apache.org/licenses/LICENSE-2.0 + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. -------------------------------------------------------------------------------- @@ -34842,6 +35654,218 @@ Contents of probable licence file $GOMODCACHE/google.golang.org/appengine@v1.6.7 limitations under the License. +-------------------------------------------------------------------------------- +Dependency : google.golang.org/grpc/examples +Version: v0.0.0-20211115174500-b2317c762757 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/google.golang.org/grpc/examples@v0.0.0-20211115174500-b2317c762757/LICENSE: + + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + -------------------------------------------------------------------------------- Dependency : gopkg.in/check.v1 Version: v1.0.0-20201130134442-10cb98267c6c diff --git a/go.mod b/go.mod index 1603cbf798f4..31d84ac9fa0d 100644 --- a/go.mod +++ b/go.mod @@ -153,9 +153,11 @@ require ( github.com/vmware/govmomi v0.0.0-20170802214208-2cad15190b41 github.com/xdg/scram v1.0.3 github.com/yuin/gopher-lua v0.0.0-20170403160031-b402f3114ec7 // indirect - go.elastic.co/apm v1.11.0 + go.elastic.co/apm v1.14.0 go.elastic.co/apm/module/apmelasticsearch v1.7.2 - go.elastic.co/apm/module/apmhttp v1.7.2 + go.elastic.co/apm/module/apmgorilla v1.14.0 + go.elastic.co/apm/module/apmgrpc v1.14.0 + go.elastic.co/apm/module/apmhttp v1.14.0 go.elastic.co/ecszap v0.3.0 go.elastic.co/go-licence-detector v0.4.0 go.etcd.io/bbolt v1.3.6 @@ -240,6 +242,7 @@ require ( github.com/hashicorp/go-version v1.2.0 // indirect github.com/imdario/mergo v0.3.12 // indirect github.com/inconshreveable/mousetrap v1.0.0 // indirect + github.com/jcchavezs/porto v0.1.0 // indirect github.com/jcmturner/aescts/v2 v2.0.0 // indirect github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect github.com/jcmturner/gofork v1.0.0 // indirect @@ -272,6 +275,7 @@ require ( golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b // indirect golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect google.golang.org/appengine v1.6.7 // indirect + google.golang.org/grpc/examples v0.0.0-20211115174500-b2317c762757 // indirect gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect k8s.io/klog/v2 v2.30.0 // indirect k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect diff --git a/go.sum b/go.sum index ad1e540577f4..72cd2a70666d 100644 --- a/go.sum +++ b/go.sum @@ -429,7 +429,6 @@ github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7Do github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/creack/pty v1.1.11 h1:07n33Z8lZxZ2qwegKbObQohDhXDQxiMMz1NOUGYlesw= github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= -github.com/cucumber/godog v0.8.1 h1:lVb+X41I4YDreE+ibZ50bdXmySxgRviYFgKY6Aw4XE8= github.com/cucumber/godog v0.8.1/go.mod h1:vSh3r/lM+psC1BPXvdkSEuNjmXfpVqrMGYAElF6hxnA= github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4= github.com/cyphar/filepath-securejoin v0.2.3 h1:YX6ebbZCZP7VkM3scTTokDgBL2TY741X51MTk3ycuNI= @@ -521,6 +520,7 @@ github.com/elastic/go-concert v0.2.0 h1:GAQrhRVXprnNjtvTP9pWJ1d4ToEA4cU5ci7TwTa2 github.com/elastic/go-concert v0.2.0/go.mod h1:HWjpO3IAEJUxOeaJOWXWEp7imKd27foxz9V5vegC/38= github.com/elastic/go-libaudit/v2 v2.2.0 h1:TY3FDpG4Zr9Qnv6KYW6olYr/U+nfu0rD2QAbv75VxMQ= github.com/elastic/go-libaudit/v2 v2.2.0/go.mod h1:MM/l/4xV7ilcl+cIblL8Zn448J7RZaDwgNLE4gNKYPg= +github.com/elastic/go-licenser v0.3.1/go.mod h1:D8eNQk70FOCVBl3smCGQt/lv7meBeQno2eI1S5apiHQ= github.com/elastic/go-licenser v0.4.0 h1:jLq6A5SilDS/Iz1ABRkO6BHy91B9jBora8FwGRsDqUI= github.com/elastic/go-licenser v0.4.0/go.mod h1:V56wHMpmdURfibNBggaSBfqgPxyT1Tldns1i87iTEvU= github.com/elastic/go-lookslike v0.3.0 h1:HDI/DQ65V85ZqM7D/sbxcK2wFFnh3+7iFvBk2v2FTHs= @@ -914,6 +914,7 @@ github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0U github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA= github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs= +github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4 h1:z53tR0945TRRQO/fLEVPI6SMv7ZflF0TEaTAoU7tOzg= github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs= github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk= github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY= @@ -1019,6 +1020,8 @@ github.com/influxdata/usage-client v0.0.0-20160829180054-6d3895376368/go.mod h1: github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA= github.com/jarcoal/httpmock v1.0.4 h1:jp+dy/+nonJE4g4xbVtl9QdrUNbn6/3hDT5R4nDIZnA= github.com/jarcoal/httpmock v1.0.4/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik= +github.com/jcchavezs/porto v0.1.0 h1:Xmxxn25zQMmgE7/yHYmh19KcItG81hIwfbEEFnd6w/Q= +github.com/jcchavezs/porto v0.1.0/go.mod h1:fESH0gzDHiutHRdX2hv27ojnOVFco37hg1W6E9EZF4A= github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8= github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs= github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo= @@ -1591,12 +1594,17 @@ github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA= github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg= go.elastic.co/apm v1.7.2/go.mod h1:tCw6CkOJgkWnzEthFN9HUP1uL3Gjc/Ur6m7gRPLaoH0= -go.elastic.co/apm v1.11.0 h1:uJyt6nCW9880sZhfl1tB//Jy/5TadNoAd8edRUtgb3w= -go.elastic.co/apm v1.11.0/go.mod h1:qoOSi09pnzJDh5fKnfY7bPmQgl8yl2tULdOu03xhui0= +go.elastic.co/apm v1.14.0 h1:9yilcTbWpqhfyunUj6/SDpZbR4FOVB50xQgODe0TW/0= +go.elastic.co/apm v1.14.0/go.mod h1:dylGv2HKR0tiCV+wliJz1KHtDyuD8SPe69oV7VyK6WY= go.elastic.co/apm/module/apmelasticsearch v1.7.2 h1:5STGHLZLSeAzxordMc+dFVKiyVtMmxADOV+TgRaXXJg= go.elastic.co/apm/module/apmelasticsearch v1.7.2/go.mod h1:ZyNFuyWdt42GBZkz0SogoLzDBrBGj4orxpiUuxYeYq8= -go.elastic.co/apm/module/apmhttp v1.7.2 h1:2mRh7SwBuEVLmJlX+hsMdcSg9xaielCLElaPn/+i34w= +go.elastic.co/apm/module/apmgorilla v1.14.0 h1:espCHSZ3ibkrffR6KLua+0jMeBSgO/087U9BZ46Cyv8= +go.elastic.co/apm/module/apmgorilla v1.14.0/go.mod h1:+cDGiyPXN3EvTxoh7zcWOL1/Yw6zKhNkUU0a0OGyXsg= +go.elastic.co/apm/module/apmgrpc v1.14.0 h1:sQA5XnxdKpjzKlMOJD1AKuMEsQh1CSdzJ21iJhZVNgw= +go.elastic.co/apm/module/apmgrpc v1.14.0/go.mod h1:rfw0Kw9yhui/O+rap4gDme0Pj2jGpTdN4iSWK2HM6+0= go.elastic.co/apm/module/apmhttp v1.7.2/go.mod h1:sTFWiWejnhSdZv6+dMgxGec2Nxe/ZKfHfz/xtRM+cRY= +go.elastic.co/apm/module/apmhttp v1.14.0 h1:uDSIPr1BJOt1A/T5J9Beq9VtMtQHqOdqQUXCPRQF4C4= +go.elastic.co/apm/module/apmhttp v1.14.0/go.mod h1:PY8hyV0X3eKqXYYoN0pyu1pWcvFCwGmh5eUFuS39Zmo= go.elastic.co/ecszap v0.3.0 h1:Zo/Y4sJLqbWDlqCHI4F4Lzeg0Fs4+n5ldVis4h9xV8w= go.elastic.co/ecszap v0.3.0/go.mod h1:HTUi+QRmr3EuZMqxPX+5fyOdMNfUu5iPebgfhgsTJYQ= go.elastic.co/fastjson v1.0.0/go.mod h1:PmeUOMMtLHQr9ZS9J9owrAVg0FkaZDRZJEFTTGHtchs= @@ -2163,6 +2171,7 @@ google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEY google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA= google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= +google.golang.org/genproto v0.0.0-20200806141610-86f49bd18e98/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= @@ -2234,6 +2243,8 @@ google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9K google.golang.org/grpc v1.41.0 h1:f+PlOh7QV4iIJkPrx5NQ7qaNGFQ3OTse67yaDHfju4E= google.golang.org/grpc v1.41.0/go.mod h1:U3l9uK9J0sini8mHphKoXyaqDA/8VyGnDee1zzIUK6k= google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw= +google.golang.org/grpc/examples v0.0.0-20211115174500-b2317c762757 h1:d0UA5meuQRj/XhiC4CagMU1V3oZxYV+V9Nw2855gOqA= +google.golang.org/grpc/examples v0.0.0-20211115174500-b2317c762757/go.mod h1:gID3PKrg7pWKntu9Ss6zTLJ0ttC0X9IHgREOCZwbCVU= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= diff --git a/x-pack/elastic-agent/pkg/agent/application/application.go b/x-pack/elastic-agent/pkg/agent/application/application.go index d0de160340de..862fed5aa915 100644 --- a/x-pack/elastic-agent/pkg/agent/application/application.go +++ b/x-pack/elastic-agent/pkg/agent/application/application.go @@ -8,6 +8,8 @@ import ( "context" "fmt" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/storage" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/status" @@ -39,7 +41,14 @@ type upgraderControl interface { } // New creates a new Agent and bootstrap the required subsystem. -func New(log *logger.Logger, reexec reexecManager, statusCtrl status.Controller, uc upgraderControl, agentInfo *info.AgentInfo) (Application, error) { +func New( + log *logger.Logger, + reexec reexecManager, + statusCtrl status.Controller, + uc upgraderControl, + agentInfo *info.AgentInfo, + tracer *apm.Tracer, +) (Application, error) { // Load configuration from disk to understand in which mode of operation // we must start the elastic-agent, the mode of operation cannot be changed without restarting the // elastic-agent. @@ -53,7 +62,7 @@ func New(log *logger.Logger, reexec reexecManager, statusCtrl status.Controller, return nil, err } - return createApplication(log, pathConfigFile, rawConfig, reexec, statusCtrl, uc, agentInfo) + return createApplication(log, pathConfigFile, rawConfig, reexec, statusCtrl, uc, agentInfo, tracer) } func createApplication( @@ -64,6 +73,7 @@ func createApplication( statusCtrl status.Controller, uc upgraderControl, agentInfo *info.AgentInfo, + tracer *apm.Tracer, ) (Application, error) { log.Info("Detecting execution mode") ctx := context.Background() @@ -74,7 +84,7 @@ func createApplication( if configuration.IsStandalone(cfg.Fleet) { log.Info("Agent is managed locally") - return newLocal(ctx, log, paths.ConfigFile(), rawConfig, reexec, statusCtrl, uc, agentInfo) + return newLocal(ctx, log, paths.ConfigFile(), rawConfig, reexec, statusCtrl, uc, agentInfo, tracer) } // not in standalone; both modes require reading the fleet.yml configuration file @@ -86,11 +96,11 @@ func createApplication( if configuration.IsFleetServerBootstrap(cfg.Fleet) { log.Info("Agent is in Fleet Server bootstrap mode") - return newFleetServerBootstrap(ctx, log, pathConfigFile, rawConfig, statusCtrl, agentInfo) + return newFleetServerBootstrap(ctx, log, pathConfigFile, rawConfig, statusCtrl, agentInfo, tracer) } log.Info("Agent is managed by Fleet") - return newManaged(ctx, log, store, cfg, rawConfig, reexec, statusCtrl, agentInfo) + return newManaged(ctx, log, store, cfg, rawConfig, reexec, statusCtrl, agentInfo, tracer) } func mergeFleetConfig(rawConfig *config.Config) (storage.Store, *configuration.Configuration, error) { diff --git a/x-pack/elastic-agent/pkg/agent/application/fleet_server_bootstrap.go b/x-pack/elastic-agent/pkg/agent/application/fleet_server_bootstrap.go index df4d93c3c43f..89cb816fec93 100644 --- a/x-pack/elastic-agent/pkg/agent/application/fleet_server_bootstrap.go +++ b/x-pack/elastic-agent/pkg/agent/application/fleet_server_bootstrap.go @@ -7,6 +7,8 @@ package application import ( "context" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/transpiler" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/sorted" @@ -51,6 +53,7 @@ func newFleetServerBootstrap( rawConfig *config.Config, statusCtrl status.Controller, agentInfo *info.AgentInfo, + tracer *apm.Tracer, ) (*FleetServerBootstrap, error) { cfg, err := configuration.NewFromConfig(rawConfig) if err != nil { @@ -79,7 +82,7 @@ func newFleetServerBootstrap( } bootstrapApp.bgContext, bootstrapApp.cancelCtxFn = context.WithCancel(ctx) - bootstrapApp.srv, err = server.NewFromConfig(log, cfg.Settings.GRPC, &operation.ApplicationStatusHandler{}) + bootstrapApp.srv, err = server.NewFromConfig(log, cfg.Settings.GRPC, &operation.ApplicationStatusHandler{}, tracer) if err != nil { return nil, errors.New(err, "initialize GRPC listener") } @@ -166,20 +169,22 @@ func bootstrapEmitter(ctx context.Context, log *logger.Logger, agentInfo transpi case c = <-ch: } - err := emit(log, agentInfo, router, modifiers, c) + err := emit(ctx, log, agentInfo, router, modifiers, c) if err != nil { log.Error(err) } } }() - return func(c *config.Config) error { + return func(ctx context.Context, c *config.Config) error { + span, _ := apm.StartSpan(ctx, "emit", "app.internal") + defer span.End() ch <- c return nil }, nil } -func emit(log *logger.Logger, agentInfo transpiler.AgentInfo, router pipeline.Router, modifiers *pipeline.ConfigModifiers, c *config.Config) error { +func emit(ctx context.Context, log *logger.Logger, agentInfo transpiler.AgentInfo, router pipeline.Router, modifiers *pipeline.ConfigModifiers, c *config.Config) error { if err := info.InjectAgentConfig(c); err != nil { return err } @@ -218,7 +223,7 @@ func emit(log *logger.Logger, agentInfo transpiler.AgentInfo, router pipeline.Ro return errors.New("bootstrap configuration is incorrect causing fleet-server to not be started") } - return router.Route(ast.HashStr(), map[pipeline.RoutingKey][]program.Program{ + return router.Route(ctx, ast.HashStr(), map[pipeline.RoutingKey][]program.Program{ pipeline.DefaultRK: { { Spec: spec, diff --git a/x-pack/elastic-agent/pkg/agent/application/gateway/fleet/fleet_gateway.go b/x-pack/elastic-agent/pkg/agent/application/gateway/fleet/fleet_gateway.go index fd835ee95f48..754c5315a4d9 100644 --- a/x-pack/elastic-agent/pkg/agent/application/gateway/fleet/fleet_gateway.go +++ b/x-pack/elastic-agent/pkg/agent/application/gateway/fleet/fleet_gateway.go @@ -176,7 +176,7 @@ func (f *fleetGateway) worker() { } var errMsg string - if err := f.dispatcher.Dispatch(f.acker, actions...); err != nil { + if err := f.dispatcher.Dispatch(context.Background(), f.acker, actions...); err != nil { errMsg = fmt.Sprintf("failed to dispatch actions, error: %s", err) f.log.Error(errMsg) f.statusReporter.Update(state.Failed, errMsg, nil) diff --git a/x-pack/elastic-agent/pkg/agent/application/gateway/fleet/fleet_gateway_test.go b/x-pack/elastic-agent/pkg/agent/application/gateway/fleet/fleet_gateway_test.go index eba95ad778c7..14ee33053aa5 100644 --- a/x-pack/elastic-agent/pkg/agent/application/gateway/fleet/fleet_gateway_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/gateway/fleet/fleet_gateway_test.go @@ -78,7 +78,7 @@ type testingDispatcher struct { received chan struct{} } -func (t *testingDispatcher) Dispatch(acker store.FleetAcker, actions ...fleetapi.Action) error { +func (t *testingDispatcher) Dispatch(_ context.Context, acker store.FleetAcker, actions ...fleetapi.Action) error { t.Lock() defer t.Unlock() defer func() { t.received <- struct{}{} }() diff --git a/x-pack/elastic-agent/pkg/agent/application/gateway/fleetserver/fleet_gateway_local.go b/x-pack/elastic-agent/pkg/agent/application/gateway/fleetserver/fleet_gateway_local.go index 47998116bb69..2b6f2e131d2b 100644 --- a/x-pack/elastic-agent/pkg/agent/application/gateway/fleetserver/fleet_gateway_local.go +++ b/x-pack/elastic-agent/pkg/agent/application/gateway/fleetserver/fleet_gateway_local.go @@ -76,7 +76,7 @@ func New( // Start starts the gateway. func (w *fleetServerWrapper) Start() error { - err := w.emitter(w.injectedCfg) + err := w.emitter(context.Background(), w.injectedCfg) if err != nil { return err } diff --git a/x-pack/elastic-agent/pkg/agent/application/local_mode.go b/x-pack/elastic-agent/pkg/agent/application/local_mode.go index 4da6304e1ccf..a29977f2e8d0 100644 --- a/x-pack/elastic-agent/pkg/agent/application/local_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/local_mode.go @@ -7,6 +7,8 @@ package application import ( "context" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/filters" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" @@ -65,6 +67,7 @@ func newLocal( statusCtrl status.Controller, uc upgraderControl, agentInfo *info.AgentInfo, + tracer *apm.Tracer, ) (*Local, error) { caps, err := capabilities.Load(paths.AgentCapabilitiesPath(), log, statusCtrl) if err != nil { @@ -91,7 +94,7 @@ func newLocal( } localApplication.bgContext, localApplication.cancelCtxFn = context.WithCancel(ctx) - localApplication.srv, err = server.NewFromConfig(log, cfg.Settings.GRPC, &operation.ApplicationStatusHandler{}) + localApplication.srv, err = server.NewFromConfig(log, cfg.Settings.GRPC, &operation.ApplicationStatusHandler{}, tracer) if err != nil { return nil, errors.New(err, "initialize GRPC listener") } diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go index 9ac281bb5d44..5f528735c1e0 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode.go @@ -8,6 +8,8 @@ import ( "context" "fmt" + "go.elastic.co/apm" + "github.com/elastic/go-sysinfo" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/filters" @@ -78,6 +80,7 @@ func newManaged( reexec reexecManager, statusCtrl status.Controller, agentInfo *info.AgentInfo, + tracer *apm.Tracer, ) (*Managed, error) { caps, err := capabilities.Load(paths.AgentCapabilitiesPath(), log, statusCtrl) if err != nil { @@ -105,7 +108,7 @@ func newManaged( } managedApplication.bgContext, managedApplication.cancelCtxFn = context.WithCancel(ctx) - managedApplication.srv, err = server.NewFromConfig(log, cfg.Settings.GRPC, &operation.ApplicationStatusHandler{}) + managedApplication.srv, err = server.NewFromConfig(log, cfg.Settings.GRPC, &operation.ApplicationStatusHandler{}, tracer) if err != nil { return nil, errors.New(err, "initialize GRPC listener", errors.TypeNetwork) } @@ -155,6 +158,7 @@ func newManaged( if err != nil { return nil, err } + // Client has been instrumented with apm acker, err := fleet.NewAcker(log, agentInfo, client) if err != nil { return nil, err @@ -244,7 +248,7 @@ func newManaged( // TODO(ph) We will need an improvement on fleet, if there is an error while dispatching a // persisted action on disk we should be able to ask Fleet to get the latest configuration. // But at the moment this is not possible because the policy change was acked. - if err := store.ReplayActions(log, actionDispatcher, actionAcker, actions...); err != nil { + if err := store.ReplayActions(ctx, log, actionDispatcher, actionAcker, actions...); err != nil { log.Errorf("could not recover state, error %+v, skipping...", err) } stateRestored = true diff --git a/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go b/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go index 7d52d69d4b85..26a8251f07be 100644 --- a/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/managed_mode_test.go @@ -67,7 +67,7 @@ func TestManagedModeRouting(t *testing.T) { actions, err := testActions() require.NoError(t, err) - err = actionDispatcher.Dispatch(noopacker.NewAcker(), actions...) + err = actionDispatcher.Dispatch(context.Background(), noopacker.NewAcker(), actions...) require.NoError(t, err) // has 1 config request for fb, mb and monitoring? @@ -101,7 +101,7 @@ func newMockStreamStore() *mockStreamStore { } } -func (m *mockStreamStore) Execute(cr configrequest.Request) error { +func (m *mockStreamStore) Execute(_ context.Context, cr configrequest.Request) error { m.store = append(m.store, cr) return nil } diff --git a/x-pack/elastic-agent/pkg/agent/application/once.go b/x-pack/elastic-agent/pkg/agent/application/once.go index 39d53512a243..64ee34e25902 100644 --- a/x-pack/elastic-agent/pkg/agent/application/once.go +++ b/x-pack/elastic-agent/pkg/agent/application/once.go @@ -5,6 +5,8 @@ package application import ( + "context" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/pipeline" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" @@ -31,18 +33,18 @@ func (o *once) Start() error { return ErrNoConfiguration } - return readfiles(files, o.emitter) + return readfiles(context.Background(), files, o.emitter) } func (o *once) Stop() error { return nil } -func readfiles(files []string, emitter pipeline.EmitterFunc) error { +func readfiles(ctx context.Context, files []string, emitter pipeline.EmitterFunc) error { c, err := config.LoadFiles(files...) if err != nil { return errors.New(err, "could not load or merge configuration", errors.TypeConfig) } - return emitter(c) + return emitter(ctx, c) } diff --git a/x-pack/elastic-agent/pkg/agent/application/periodic.go b/x-pack/elastic-agent/pkg/agent/application/periodic.go index 272169c6de48..f79c09b6e681 100644 --- a/x-pack/elastic-agent/pkg/agent/application/periodic.go +++ b/x-pack/elastic-agent/pkg/agent/application/periodic.go @@ -5,6 +5,7 @@ package application import ( + "context" "strings" "time" @@ -89,7 +90,7 @@ func (p *periodic) work() error { p.log.Debugf("Unchanged %d files: %s", len(s.Unchanged), strings.Join(s.Updated, ", ")) } - err := readfiles(files, p.emitter) + err := readfiles(context.Background(), files, p.emitter) if err != nil { // assume something when really wrong and invalidate any cache // so we get a full new config on next tick. diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_policy_change.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_policy_change.go index e00ccfc844ba..6e72a45d45f5 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_policy_change.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_policy_change.go @@ -89,7 +89,7 @@ func (h *PolicyChange) Handle(ctx context.Context, a fleetapi.Action, acker stor if err != nil { return err } - if err := h.emitter(c); err != nil { + if err := h.emitter(ctx, c); err != nil { return err } diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_policy_change_test.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_policy_change_test.go index 1c4c37509398..98b7e21fc653 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_policy_change_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_policy_change_test.go @@ -28,7 +28,7 @@ type mockEmitter struct { policy *config.Config } -func (m *mockEmitter) Emitter(policy *config.Config) error { +func (m *mockEmitter) Emitter(_ context.Context, policy *config.Config) error { m.policy = policy return m.err } diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_unenroll.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_unenroll.go index aeecf865b0fe..a2649bdf41a9 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_unenroll.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/actions/handlers/handler_action_unenroll.go @@ -60,7 +60,7 @@ func (h *Unenroll) Handle(ctx context.Context, a fleetapi.Action, acker store.Fl // Providing empty map will close all pipelines noPrograms := make(map[pipeline.RoutingKey][]program.Program) - h.dispatcher.Route(a.ID(), noPrograms) + h.dispatcher.Route(ctx, a.ID(), noPrograms) if !action.IsDetected { // ACK only events comming from fleet diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/dispatcher/dispatcher.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/dispatcher/dispatcher.go index 7a1ea23a42dc..e4e98523b27a 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/dispatcher/dispatcher.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/dispatcher/dispatcher.go @@ -10,6 +10,8 @@ import ( "reflect" "strings" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/pipeline/actions" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/storage/store" @@ -74,7 +76,15 @@ func (ad *ActionDispatcher) key(a fleetapi.Action) string { } // Dispatch dispatches an action using pre-registered set of handlers. -func (ad *ActionDispatcher) Dispatch(acker store.FleetAcker, actions ...fleetapi.Action) error { +func (ad *ActionDispatcher) Dispatch(ctx context.Context, acker store.FleetAcker, actions ...fleetapi.Action) (err error) { + span, ctx := apm.StartSpan(ctx, "dispatch", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() + if len(actions) == 0 { ad.log.Debug("No action to dispatch") return nil @@ -87,18 +97,19 @@ func (ad *ActionDispatcher) Dispatch(acker store.FleetAcker, actions ...fleetapi ) for _, action := range actions { - if err := ad.ctx.Err(); err != nil { + if err = ad.ctx.Err(); err != nil { return err } - if err := ad.dispatchAction(action, acker); err != nil { + if err = ad.dispatchAction(action, acker); err != nil { ad.log.Debugf("Failed to dispatch action '%+v', error: %+v", action, err) return err } ad.log.Debugf("Successfully dispatched action: '%+v'", action) } - return acker.Commit(ad.ctx) + err = acker.Commit(ctx) + return err } func (ad *ActionDispatcher) dispatchAction(a fleetapi.Action, acker store.FleetAcker) error { diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/dispatcher/dispatcher_test.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/dispatcher/dispatcher_test.go index 504778ad804a..7bba53feb59b 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/dispatcher/dispatcher_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/dispatcher/dispatcher_test.go @@ -49,8 +49,9 @@ func TestActionDispatcher(t *testing.T) { ack := noopacker.NewAcker() t.Run("Success to dispatch multiples events", func(t *testing.T) { + ctx := context.Background() def := &mockHandler{} - d, err := New(context.Background(), nil, def) + d, err := New(ctx, nil, def) require.NoError(t, err) success1 := &mockHandler{} @@ -62,7 +63,7 @@ func TestActionDispatcher(t *testing.T) { action1 := &mockAction{} action2 := &mockActionOther{} - err = d.Dispatch(ack, action1, action2) + err = d.Dispatch(ctx, ack, action1, action2) require.NoError(t, err) @@ -78,11 +79,12 @@ func TestActionDispatcher(t *testing.T) { t.Run("Unknown action are caught by the unknown handler", func(t *testing.T) { def := &mockHandler{} - d, err := New(context.Background(), nil, def) + ctx := context.Background() + d, err := New(ctx, nil, def) require.NoError(t, err) action := &mockActionUnknown{} - err = d.Dispatch(ack, action) + err = d.Dispatch(ctx, ack, action) require.NoError(t, err) require.True(t, def.called) diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/emitter/controller.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/emitter/controller.go index 5ece0a1b1deb..d7ddaffedf53 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/emitter/controller.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/emitter/controller.go @@ -5,8 +5,11 @@ package emitter import ( + "context" "sync" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/pipeline" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" @@ -65,38 +68,51 @@ func NewController( } // Update applies config change and performes all steps necessary to apply it. -func (e *Controller) Update(c *config.Config) error { - if err := info.InjectAgentConfig(c); err != nil { - return err +func (e *Controller) Update(ctx context.Context, c *config.Config) (rErr error) { + span, ctx := apm.StartSpan(ctx, "update", "app.internal") + defer func() { + if rErr != nil { + apm.CaptureError(ctx, rErr).Send() + } + span.End() + }() + + if rErr = info.InjectAgentConfig(c); rErr != nil { + return } // perform and verify ast translation m, err := c.ToMapStr() if err != nil { - return errors.New(err, "could not create the AST from the configuration", errors.TypeConfig) + rErr = errors.New(err, "could not create the AST from the configuration", errors.TypeConfig) + return } rawAst, err := transpiler.NewAST(m) if err != nil { - return errors.New(err, "could not create the AST from the configuration", errors.TypeConfig) + rErr = errors.New(err, "could not create the AST from the configuration", errors.TypeConfig) + return } if e.caps != nil { var ok bool updatedAst, err := e.caps.Apply(rawAst) if err != nil { - return errors.New(err, "failed to apply capabilities") + rErr = errors.New(err, "failed to apply capabilities") + return } rawAst, ok = updatedAst.(*transpiler.AST) if !ok { - return errors.New("failed to transform object returned from capabilities to AST", errors.TypeConfig) + rErr = errors.New("failed to transform object returned from capabilities to AST", errors.TypeConfig) + return } } for _, filter := range e.modifiers.Filters { if err := filter(e.logger, rawAst); err != nil { - return errors.New(err, "failed to filter configuration", errors.TypeConfig) + rErr = errors.New(err, "failed to filter configuration", errors.TypeConfig) + return } } @@ -105,25 +121,41 @@ func (e *Controller) Update(c *config.Config) error { e.ast = rawAst e.lock.Unlock() - return e.update() + rErr = e.update(ctx) + return } // Set sets the transpiler vars for dynamic inputs resolution. -func (e *Controller) Set(vars []*transpiler.Vars) { +func (e *Controller) Set(ctx context.Context, vars []*transpiler.Vars) { + var err error + span, ctx := apm.StartSpan(ctx, "Set", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() e.lock.Lock() ast := e.ast e.vars = vars e.lock.Unlock() if ast != nil { - err := e.update() + err = e.update(ctx) if err != nil { e.logger.Errorf("Failed to render configuration with latest context from composable controller: %s", err) } } } -func (e *Controller) update() error { +func (e *Controller) update(ctx context.Context) (err error) { + span, ctx := apm.StartSpan(ctx, "update", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() // locking whole update because it can be called concurrently via Set and Update method e.updateLock.Lock() defer e.updateLock.Unlock() @@ -137,19 +169,21 @@ func (e *Controller) update() error { ast := rawAst.Clone() inputs, ok := transpiler.Lookup(ast, "inputs") if ok { - renderedInputs, err := transpiler.RenderInputs(inputs, varsArray) + var renderedInputs transpiler.Node + renderedInputs, err = transpiler.RenderInputs(inputs, varsArray) if err != nil { return err } err = transpiler.Insert(ast, renderedInputs, "inputs") if err != nil { - return errors.New(err, "inserting rendered inputs failed") + return err } } e.logger.Debug("Converting single configuration into specific programs configuration") - programsToRun, err := program.Programs(e.agentInfo, ast) + programsToRun := make(map[string][]program.Program) + programsToRun, err = program.Programs(e.agentInfo, ast) if err != nil { return err } @@ -164,10 +198,11 @@ func (e *Controller) update() error { } for _, r := range e.reloadables { - if err := r.Reload(cfg); err != nil { + if err = r.Reload(cfg); err != nil { return err } } - return e.router.Route(ast.HashStr(), programsToRun) + err = e.router.Route(ctx, ast.HashStr(), programsToRun) + return err } diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/emitter/emitter.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/emitter/emitter.go index 8b49bffea44f..f9e7453ce7c0 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/emitter/emitter.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/emitter/emitter.go @@ -8,6 +8,8 @@ import ( "context" "strings" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/pipeline" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" @@ -25,12 +27,20 @@ func New(ctx context.Context, log *logger.Logger, agentInfo *info.AgentInfo, con ctrl := NewController(log, agentInfo, controller, router, modifiers, caps, reloadables...) err := controller.Run(ctx, func(vars []*transpiler.Vars) { - ctrl.Set(vars) + ctrl.Set(ctx, vars) }) if err != nil { return nil, errors.New(err, "failed to start composable controller") } - return func(c *config.Config) error { - return ctrl.Update(c) + return func(ctx context.Context, c *config.Config) (err error) { + span, ctx := apm.StartSpan(ctx, "update", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() + err = ctrl.Update(ctx, c) + return err }, nil } diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/pipeline.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/pipeline.go index f2f02efb2585..1cc73dca5d8e 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/pipeline.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/pipeline.go @@ -5,6 +5,8 @@ package pipeline import ( + "context" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configrequest" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" @@ -18,7 +20,7 @@ import ( // ConfigHandler is capable of handling configrequest. type ConfigHandler interface { - HandleConfig(configrequest.Request) error + HandleConfig(context.Context, configrequest.Request) error Close() error Shutdown() } @@ -32,7 +34,7 @@ type RoutingKey = string // Router is an interface routing programs to the corresponding stream. type Router interface { Routes() *sorted.Set - Route(id string, grpProg map[RoutingKey][]program.Program) error + Route(ctx context.Context, id string, grpProg map[RoutingKey][]program.Program) error Shutdown() } @@ -41,13 +43,13 @@ type StreamFunc func(*logger.Logger, RoutingKey) (Stream, error) // Stream is capable of executing configrequest change. type Stream interface { - Execute(configrequest.Request) error + Execute(context.Context, configrequest.Request) error Close() error Shutdown() } // EmitterFunc emits configuration for processing. -type EmitterFunc func(*config.Config) error +type EmitterFunc func(context.Context, *config.Config) error // DecoratorFunc is a func for decorating a retrieved configuration before processing. type DecoratorFunc = func(*info.AgentInfo, string, *transpiler.AST, []program.Program) ([]program.Program, error) @@ -63,5 +65,5 @@ type ConfigModifiers struct { // Dispatcher processes actions coming from fleet api. type Dispatcher interface { - Dispatch(acker store.FleetAcker, actions ...fleetapi.Action) error + Dispatch(context.Context, store.FleetAcker, ...fleetapi.Action) error } diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/router/router.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/router/router.go index bda4a7b7cde7..f8bd0f6e832a 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/router/router.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/router/router.go @@ -5,6 +5,7 @@ package router import ( + "context" "fmt" "strings" "time" @@ -38,7 +39,7 @@ func (r *router) Routes() *sorted.Set { return r.routes } -func (r *router) Route(id string, grpProg map[pipeline.RoutingKey][]program.Program) error { +func (r *router) Route(ctx context.Context, id string, grpProg map[pipeline.RoutingKey][]program.Program) error { s := sorted.NewSet() // Make sure that starting and updating is always done in the same order. @@ -77,7 +78,7 @@ func (r *router) Route(id string, grpProg map[pipeline.RoutingKey][]program.Prog strings.Join(req.ProgramNames(), ", "), ) - err = p.(pipeline.Stream).Execute(req) + err = p.(pipeline.Stream).Execute(ctx, req) if err != nil { return err } diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/router/router_test.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/router/router_test.go index 421a0f4cc919..77e3be645743 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/router/router_test.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/router/router_test.go @@ -5,6 +5,7 @@ package router import ( + "context" "testing" "github.com/stretchr/testify/require" @@ -45,12 +46,13 @@ type notifyFunc func(pipeline.RoutingKey, rOp, ...interface{}) func TestRouter(t *testing.T) { programs := []program.Program{program.Program{Spec: program.Supported[1]}} + ctx := context.Background() t.Run("create new and destroy unused stream", func(t *testing.T) { recorder := &recorder{} r, err := New(nil, recorder.factory) require.NoError(t, err) - r.Route("hello", map[pipeline.RoutingKey][]program.Program{ + r.Route(ctx, "hello", map[pipeline.RoutingKey][]program.Program{ pipeline.DefaultRK: programs, }) @@ -62,7 +64,7 @@ func TestRouter(t *testing.T) { recorder.reset() nk := "NEW_KEY" - r.Route("hello-2", map[pipeline.RoutingKey][]program.Program{ + r.Route(ctx, "hello-2", map[pipeline.RoutingKey][]program.Program{ nk: programs, }) @@ -80,7 +82,7 @@ func TestRouter(t *testing.T) { recorder := &recorder{} r, err := New(nil, recorder.factory) require.NoError(t, err) - r.Route("hello", map[pipeline.RoutingKey][]program.Program{ + r.Route(ctx, "hello", map[pipeline.RoutingKey][]program.Program{ pipeline.DefaultRK: programs, k1: programs, k2: programs, @@ -100,7 +102,7 @@ func TestRouter(t *testing.T) { recorder.reset() nk := "SECOND_DISPATCH" - r.Route("hello-2", map[pipeline.RoutingKey][]program.Program{ + r.Route(ctx, "hello-2", map[pipeline.RoutingKey][]program.Program{ nk: programs, }) @@ -118,7 +120,7 @@ func TestRouter(t *testing.T) { recorder := &recorder{} r, err := New(nil, recorder.factory) require.NoError(t, err) - r.Route("hello", map[pipeline.RoutingKey][]program.Program{ + r.Route(ctx, "hello", map[pipeline.RoutingKey][]program.Program{ pipeline.DefaultRK: programs, }) @@ -129,7 +131,7 @@ func TestRouter(t *testing.T) { recorder.reset() - r.Route("hello-2", map[pipeline.RoutingKey][]program.Program{ + r.Route(ctx, "hello-2", map[pipeline.RoutingKey][]program.Program{ pipeline.DefaultRK: programs, }) @@ -145,7 +147,7 @@ func TestRouter(t *testing.T) { recorder := &recorder{} r, err := New(nil, recorder.factory) require.NoError(t, err) - r.Route("hello", map[pipeline.RoutingKey][]program.Program{ + r.Route(ctx, "hello", map[pipeline.RoutingKey][]program.Program{ pipeline.DefaultRK: programs, k1: programs, k2: programs, @@ -162,7 +164,7 @@ func TestRouter(t *testing.T) { recorder.reset() - r.Route("hello-2", map[pipeline.RoutingKey][]program.Program{}) + r.Route(ctx, "hello-2", map[pipeline.RoutingKey][]program.Program{}) assertOps(t, []event{ e(k1, closeOp), @@ -201,7 +203,7 @@ func newMockStream(rk pipeline.RoutingKey, notify notifyFunc) *mockStream { } } -func (m *mockStream) Execute(req configrequest.Request) error { +func (m *mockStream) Execute(_ context.Context, req configrequest.Request) error { m.event(executeOp, req) return nil } diff --git a/x-pack/elastic-agent/pkg/agent/application/pipeline/stream/operator_stream.go b/x-pack/elastic-agent/pkg/agent/application/pipeline/stream/operator_stream.go index f56b1cfb3e9a..34ad4a6c0dc2 100644 --- a/x-pack/elastic-agent/pkg/agent/application/pipeline/stream/operator_stream.go +++ b/x-pack/elastic-agent/pkg/agent/application/pipeline/stream/operator_stream.go @@ -5,6 +5,10 @@ package stream import ( + "context" + + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/pipeline" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configrequest" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" @@ -44,8 +48,16 @@ func (b *operatorStream) Specs() map[string]program.Spec { return nil } -func (b *operatorStream) Execute(cfg configrequest.Request) error { - return b.configHandler.HandleConfig(cfg) +func (b *operatorStream) Execute(ctx context.Context, cfg configrequest.Request) (err error) { + span, ctx := apm.StartSpan(ctx, "route", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() + err = b.configHandler.HandleConfig(ctx, cfg) + return } func (b *operatorStream) Shutdown() { diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go index 2a88b8bfb2ba..603a544cd01a 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/step_download.go @@ -8,6 +8,8 @@ import ( "context" "strings" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/download" @@ -20,7 +22,14 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" ) -func (u *Upgrader) downloadArtifact(ctx context.Context, version, sourceURI string) (string, error) { +func (u *Upgrader) downloadArtifact(ctx context.Context, version, sourceURI string) (_ string, err error) { + span, ctx := apm.StartSpan(ctx, "downloadArtifact", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() // do not update source config settings := *u.settings if sourceURI != "" { diff --git a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go index 915106ad0e35..b3ef19ad9123 100644 --- a/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go +++ b/x-pack/elastic-agent/pkg/agent/application/upgrade/upgrade.go @@ -13,6 +13,7 @@ import ( "strings" "github.com/otiai10/copy" + "go.elastic.co/apm" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" @@ -107,12 +108,15 @@ func (u *Upgrader) Upgradeable() bool { // Upgrade upgrades running agent, function returns shutdown callback if some needs to be executed for cases when // reexec is called by caller. func (u *Upgrader) Upgrade(ctx context.Context, a Action, reexecNow bool) (_ reexec.ShutdownCallbackFn, err error) { + span, ctx := apm.StartSpan(ctx, "upgrade", "app.internal") + defer span.End() // report failed defer func() { if err != nil { if action := a.FleetAction(); action != nil { u.reportFailure(ctx, action, err) } + apm.CaptureError(ctx, err).Send() } }() diff --git a/x-pack/elastic-agent/pkg/agent/cmd/enroll_cmd.go b/x-pack/elastic-agent/pkg/agent/cmd/enroll_cmd.go index da6c2be9e5e3..0d749111467c 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/enroll_cmd.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/enroll_cmd.go @@ -15,6 +15,7 @@ import ( "os/exec" "time" + "go.elastic.co/apm" "gopkg.in/yaml.v2" "github.com/elastic/beats/v7/libbeat/common/transport/httpcommon" @@ -184,8 +185,16 @@ func newEnrollCmdWithStore( func (c *enrollCmd) Execute(ctx context.Context, streams *cli.IOStreams) error { var err error defer c.stopAgent() // ensure its stopped no matter what + span, ctx := apm.StartSpan(ctx, "enroll", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() - persistentConfig, err := getPersistentConfig(c.configPath) + var persistentConfig map[string]interface{} + persistentConfig, err = getPersistentConfig(c.configPath) if err != nil { return err } @@ -195,7 +204,8 @@ func (c *enrollCmd) Execute(ctx context.Context, streams *cli.IOStreams) error { // Connection setup should disable proxies in that case. localFleetServer := c.options.FleetServer.ConnStr != "" if localFleetServer && !c.options.DelayEnroll { - token, err := c.fleetServerBootstrap(ctx, persistentConfig) + var token string + token, err = c.fleetServerBootstrap(ctx, persistentConfig) if err != nil { return err } @@ -206,10 +216,11 @@ func (c *enrollCmd) Execute(ctx context.Context, streams *cli.IOStreams) error { c.remoteConfig, err = c.options.remoteConfig() if err != nil { - return errors.New( + err = errors.New( err, "Error", errors.TypeConfig, errors.M(errors.MetaKeyURI, c.options.URL)) + return err } if localFleetServer { // Ensure that the agent does not use a proxy configuration @@ -219,28 +230,32 @@ func (c *enrollCmd) Execute(ctx context.Context, streams *cli.IOStreams) error { c.client, err = fleetclient.NewWithConfig(c.log, c.remoteConfig) if err != nil { - return errors.New( + err = errors.New( err, "Error", errors.TypeNetwork, errors.M(errors.MetaKeyURI, c.options.URL)) + return err } if c.options.DelayEnroll { if c.options.FleetServer.Host != "" { - return errors.New("--delay-enroll cannot be used with --fleet-server-es", errors.TypeConfig) + err = errors.New("--delay-enroll cannot be used with --fleet-server-es", errors.TypeConfig) + return err } return c.writeDelayEnroll(streams) } err = c.enrollWithBackoff(ctx, persistentConfig) if err != nil { - return errors.New(err, "fail to enroll") + err = errors.New(err, "fail to enroll") + return err } if c.options.FixPermissions { err = install.FixPermissions() if err != nil { - return errors.New(err, "failed to fix permissions") + err = errors.New(err, "failed to fix permissions") + return err } } diff --git a/x-pack/elastic-agent/pkg/agent/cmd/inspect.go b/x-pack/elastic-agent/pkg/agent/cmd/inspect.go index 56a8f97c131d..03db5837a1fa 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/inspect.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/inspect.go @@ -295,7 +295,7 @@ func getProgramsFromConfig(log *logger.Logger, agentInfo *info.AgentInfo, cfg *c return nil, err } - if err := emit(cfg); err != nil { + if err := emit(ctx, cfg); err != nil { return nil, err } composableWaiter.Wait() @@ -310,7 +310,7 @@ func (r *inmemRouter) Routes() *sorted.Set { return nil } -func (r *inmemRouter) Route(id string, grpProg map[pipeline.RoutingKey][]program.Program) error { +func (r *inmemRouter) Route(_ context.Context, _ string, grpProg map[pipeline.RoutingKey][]program.Program) error { r.programs = grpProg return nil } diff --git a/x-pack/elastic-agent/pkg/agent/cmd/run.go b/x-pack/elastic-agent/pkg/agent/cmd/run.go index 7f10f9faa31d..4c199bd34a4a 100644 --- a/x-pack/elastic-agent/pkg/agent/cmd/run.go +++ b/x-pack/elastic-agent/pkg/agent/cmd/run.go @@ -8,12 +8,15 @@ import ( "context" "fmt" "io/ioutil" + "net/url" "os" "os/signal" "path/filepath" "syscall" "github.com/spf13/cobra" + "go.elastic.co/apm" + apmtransport "go.elastic.co/apm/transport" "gopkg.in/yaml.v2" "github.com/elastic/beats/v7/libbeat/api" @@ -44,6 +47,10 @@ const ( agentName = "elastic-agent" ) +func init() { + apm.DefaultTracer.Close() +} + type cfgOverrider func(cfg *configuration.Configuration) func newRunCommandWithArgs(_ []string, streams *cli.IOStreams) *cobra.Command { @@ -135,14 +142,25 @@ func run(streams *cli.IOStreams, override cfgOverrider) error { statusCtrl := status.NewController(logger) + tracer, err := initTracer(agentName, release.Version(), cfg.Settings.MonitoringConfig) + if err != nil { + return err + } + if tracer != nil { + defer func() { + tracer.Flush(nil) + tracer.Close() + }() + } + + control := server.New(logger.Named("control"), rex, statusCtrl, nil, tracer) // start the control listener - control := server.New(logger.Named("control"), rex, statusCtrl, nil) if err := control.Start(); err != nil { return err } defer control.Stop() - app, err := application.New(logger, rex, statusCtrl, control, agentInfo) + app, err := application.New(logger, rex, statusCtrl, control, agentInfo, tracer) if err != nil { return err } @@ -150,7 +168,7 @@ func run(streams *cli.IOStreams, override cfgOverrider) error { control.SetRouteFn(app.Routes) control.SetMonitoringCfg(cfg.Settings.MonitoringConfig) - serverStopFn, err := setupMetrics(agentInfo, logger, cfg.Settings.DownloadConfig.OS(), cfg.Settings.MonitoringConfig, app) + serverStopFn, err := setupMetrics(agentInfo, logger, cfg.Settings.DownloadConfig.OS(), cfg.Settings.MonitoringConfig, app, tracer) if err != nil { return err } @@ -296,7 +314,14 @@ func defaultLogLevel(cfg *configuration.Configuration) string { return defaultLogLevel } -func setupMetrics(agentInfo *info.AgentInfo, logger *logger.Logger, operatingSystem string, cfg *monitoringCfg.MonitoringConfig, app application.Application) (func() error, error) { +func setupMetrics( + agentInfo *info.AgentInfo, + logger *logger.Logger, + operatingSystem string, + cfg *monitoringCfg.MonitoringConfig, + app application.Application, + tracer *apm.Tracer, +) (func() error, error) { // use libbeat to setup metrics if err := metrics.SetupMetrics(agentName); err != nil { return nil, err @@ -308,7 +333,7 @@ func setupMetrics(agentInfo *info.AgentInfo, logger *logger.Logger, operatingSys Host: beats.AgentMonitoringEndpoint(operatingSystem, cfg.HTTP), } - s, err := monitoringServer.New(logger, endpointConfig, monitoring.GetNamespace, app.Routes, isProcessStatsEnabled(cfg.HTTP)) + s, err := monitoringServer.New(logger, endpointConfig, monitoring.GetNamespace, app.Routes, isProcessStatsEnabled(cfg.HTTP), tracer) if err != nil { return nil, errors.New(err, "could not start the HTTP server for the API") } @@ -374,3 +399,61 @@ func tryDelayEnroll(ctx context.Context, logger *logger.Logger, cfg *configurati logger.Info("Successfully performed delayed enrollment of this Elastic Agent.") return loadConfig(override) } + +func initTracer(agentName, version string, mcfg *monitoringCfg.MonitoringConfig) (*apm.Tracer, error) { + if !mcfg.Enabled || !mcfg.MonitorTraces { + return nil, nil + } + + cfg := mcfg.APM + + // TODO(stn): Ideally, we'd use apmtransport.NewHTTPTransportOptions() + // but it doesn't exist today. Update this code once we have something + // available via the APM Go agent. + const ( + envVerifyServerCert = "ELASTIC_APM_VERIFY_SERVER_CERT" + envServerCert = "ELASTIC_APM_SERVER_CERT" + envCACert = "ELASTIC_APM_SERVER_CA_CERT_FILE" + ) + if cfg.TLS.SkipVerify { + os.Setenv(envVerifyServerCert, "false") + defer os.Unsetenv(envVerifyServerCert) + } + if cfg.TLS.ServerCertificate != "" { + os.Setenv(envServerCert, cfg.TLS.ServerCertificate) + defer os.Unsetenv(envServerCert) + } + if cfg.TLS.ServerCA != "" { + os.Setenv(envCACert, cfg.TLS.ServerCA) + defer os.Unsetenv(envCACert) + } + + ts, err := apmtransport.NewHTTPTransport() + if err != nil { + return nil, err + } + + if len(cfg.Hosts) > 0 { + hosts := make([]*url.URL, 0, len(cfg.Hosts)) + for _, host := range cfg.Hosts { + u, err := url.Parse(host) + if err != nil { + return nil, fmt.Errorf("failed parsing %s: %w", host, err) + } + hosts = append(hosts, u) + } + ts.SetServerURL(hosts...) + } + if cfg.APIKey != "" { + ts.SetAPIKey(cfg.APIKey) + } else { + ts.SetSecretToken(cfg.SecretToken) + } + + return apm.NewTracerOptions(apm.TracerOptions{ + ServiceName: agentName, + ServiceVersion: version, + ServiceEnvironment: cfg.Environment, + Transport: ts, + }) +} diff --git a/x-pack/elastic-agent/pkg/agent/control/control_test.go b/x-pack/elastic-agent/pkg/agent/control/control_test.go index b37a161047f5..cdec30e4d4cc 100644 --- a/x-pack/elastic-agent/pkg/agent/control/control_test.go +++ b/x-pack/elastic-agent/pkg/agent/control/control_test.go @@ -8,6 +8,8 @@ import ( "context" "testing" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/status" "github.com/stretchr/testify/assert" @@ -22,7 +24,8 @@ import ( ) func TestServerClient_Version(t *testing.T) { - srv := server.New(newErrorLogger(t), nil, nil, nil) + tracer := apm.DefaultTracer + srv := server.New(newErrorLogger(t), nil, nil, nil, tracer) err := srv.Start() require.NoError(t, err) defer srv.Stop() @@ -46,7 +49,8 @@ func TestServerClient_Version(t *testing.T) { func TestServerClient_Status(t *testing.T) { l := newErrorLogger(t) statusCtrl := status.NewController(l) - srv := server.New(l, nil, statusCtrl, nil) + tracer := apm.DefaultTracer + srv := server.New(l, nil, statusCtrl, nil, tracer) err := srv.Start() require.NoError(t, err) defer srv.Stop() diff --git a/x-pack/elastic-agent/pkg/agent/control/server/server.go b/x-pack/elastic-agent/pkg/agent/control/server/server.go index 12ed4650eedf..34c9802e14e4 100644 --- a/x-pack/elastic-agent/pkg/agent/control/server/server.go +++ b/x-pack/elastic-agent/pkg/agent/control/server/server.go @@ -16,6 +16,8 @@ import ( "sync" "time" + "go.elastic.co/apm" + "go.elastic.co/apm/module/apmgrpc" "google.golang.org/grpc" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/reexec" @@ -45,6 +47,7 @@ type Server struct { monitoringCfg *monitoringCfg.MonitoringConfig listener net.Listener server *grpc.Server + tracer *apm.Tracer lock sync.RWMutex } @@ -59,11 +62,12 @@ type specInfo struct { } // New creates a new control protocol server. -func New(log *logger.Logger, rex reexec.ExecManager, statusCtrl status.Controller, up *upgrade.Upgrader) *Server { +func New(log *logger.Logger, rex reexec.ExecManager, statusCtrl status.Controller, up *upgrade.Upgrader, tracer *apm.Tracer) *Server { return &Server{ logger: log, rex: rex, statusCtrl: statusCtrl, + tracer: tracer, up: up, } } @@ -103,7 +107,12 @@ func (s *Server) Start() error { return err } s.listener = lis - s.server = grpc.NewServer() + if s.tracer != nil { + apmInterceptor := apmgrpc.NewUnaryServerInterceptor(apmgrpc.WithRecovery(), apmgrpc.WithTracer(s.tracer)) + s.server = grpc.NewServer(grpc.UnaryInterceptor(apmInterceptor)) + } else { + s.server = grpc.NewServer() + } proto.RegisterElasticAgentControlServer(s.server, s) // start serving GRPC connections diff --git a/x-pack/elastic-agent/pkg/agent/operation/common_test.go b/x-pack/elastic-agent/pkg/agent/operation/common_test.go index 7ebcb085555d..860239b2f7cb 100644 --- a/x-pack/elastic-agent/pkg/agent/operation/common_test.go +++ b/x-pack/elastic-agent/pkg/agent/operation/common_test.go @@ -12,6 +12,8 @@ import ( "testing" "time" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/libbeat/logp" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" @@ -63,7 +65,8 @@ func getTestOperator(t *testing.T, downloadPath string, installPath string, p *a if err != nil { t.Fatal(err) } - srv, err := server.New(l, "localhost:0", &ApplicationStatusHandler{}) + tracer := apm.DefaultTracer + srv, err := server.New(l, "localhost:0", &ApplicationStatusHandler{}, tracer) if err != nil { t.Fatal(err) } diff --git a/x-pack/elastic-agent/pkg/agent/operation/monitoring_test.go b/x-pack/elastic-agent/pkg/agent/operation/monitoring_test.go index b01f296e01d7..07c3e169523f 100644 --- a/x-pack/elastic-agent/pkg/agent/operation/monitoring_test.go +++ b/x-pack/elastic-agent/pkg/agent/operation/monitoring_test.go @@ -11,6 +11,7 @@ import ( "time" "github.com/stretchr/testify/require" + "go.elastic.co/apm" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" @@ -164,7 +165,8 @@ func getMonitorableTestOperator(t *testing.T, installPath string, m monitoring.M if err != nil { t.Fatal(err) } - srv, err := server.New(l, "localhost:0", &ApplicationStatusHandler{}) + tracer := apm.DefaultTracer + srv, err := server.New(l, "localhost:0", &ApplicationStatusHandler{}, tracer) if err != nil { t.Fatal(err) } diff --git a/x-pack/elastic-agent/pkg/agent/operation/operator.go b/x-pack/elastic-agent/pkg/agent/operation/operator.go index 8e83efbd94ba..9b0cab9fc714 100644 --- a/x-pack/elastic-agent/pkg/agent/operation/operator.go +++ b/x-pack/elastic-agent/pkg/agent/operation/operator.go @@ -12,6 +12,8 @@ import ( "sync" "time" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/info" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configrequest" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/configuration" @@ -155,13 +157,18 @@ func (o *Operator) Close() error { o.monitor.Close() o.statusReporter.Unregister() - return o.HandleConfig(configrequest.New("", time.Now(), nil)) + return o.HandleConfig(context.Background(), configrequest.New("", time.Now(), nil)) } // HandleConfig handles configuration for a pipeline and performs actions to achieve this configuration. -func (o *Operator) HandleConfig(cfg configrequest.Request) (err error) { +func (o *Operator) HandleConfig(ctx context.Context, cfg configrequest.Request) (err error) { + // TODO: double check `route` as name + span, ctx := apm.StartSpan(ctx, "route", "app.internal") defer func() { - err = filterContextCancelled(err) + if err = filterContextCancelled(err); err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() }() _, stateID, steps, ack, err := o.stateResolver.Resolve(cfg) diff --git a/x-pack/elastic-agent/pkg/agent/storage/store/state_store.go b/x-pack/elastic-agent/pkg/agent/storage/store/state_store.go index 902e5f9f746c..b1002871acbd 100644 --- a/x-pack/elastic-agent/pkg/agent/storage/store/state_store.go +++ b/x-pack/elastic-agent/pkg/agent/storage/store/state_store.go @@ -20,7 +20,7 @@ import ( ) type dispatcher interface { - Dispatch(acker FleetAcker, actions ...action) error + Dispatch(context.Context, FleetAcker, ...action) error } type store interface { @@ -319,6 +319,7 @@ func (a *StateStoreActionAcker) Commit(ctx context.Context) error { // ReplayActions replays list of actions. func ReplayActions( + ctx context.Context, log *logger.Logger, dispatcher dispatcher, acker FleetAcker, @@ -326,7 +327,7 @@ func ReplayActions( ) error { log.Info("restoring current policy from disk") - if err := dispatcher.Dispatch(acker, actions...); err != nil { + if err := dispatcher.Dispatch(ctx, acker, actions...); err != nil { return err } diff --git a/x-pack/elastic-agent/pkg/artifact/download/composed/downloader.go b/x-pack/elastic-agent/pkg/artifact/download/composed/downloader.go index d500a1f8cc1f..de166e6f7195 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/composed/downloader.go +++ b/x-pack/elastic-agent/pkg/artifact/download/composed/downloader.go @@ -8,6 +8,7 @@ import ( "context" "github.com/hashicorp/go-multierror" + "go.elastic.co/apm" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact/download" @@ -35,6 +36,8 @@ func NewDownloader(downloaders ...download.Downloader) *Downloader { // Returns absolute path to downloaded package and an error. func (e *Downloader) Download(ctx context.Context, spec program.Spec, version string) (string, error) { var err error + span, ctx := apm.StartSpan(ctx, "download", "app.internal") + defer span.End() for _, d := range e.dd { s, e := d.Download(ctx, spec, version) diff --git a/x-pack/elastic-agent/pkg/artifact/download/fs/downloader.go b/x-pack/elastic-agent/pkg/artifact/download/fs/downloader.go index 3d055e69e65b..74092176d0f3 100644 --- a/x-pack/elastic-agent/pkg/artifact/download/fs/downloader.go +++ b/x-pack/elastic-agent/pkg/artifact/download/fs/downloader.go @@ -11,6 +11,8 @@ import ( "os" "path/filepath" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/program" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/paths" @@ -38,13 +40,16 @@ func NewDownloader(config *artifact.Config) *Downloader { // Download fetches the package from configured source. // Returns absolute path to downloaded package and an error. -func (e *Downloader) Download(_ context.Context, spec program.Spec, version string) (_ string, err error) { +func (e *Downloader) Download(ctx context.Context, spec program.Spec, version string) (_ string, err error) { + span, ctx := apm.StartSpan(ctx, "download", "app.internal") + defer span.End() downloadedFiles := make([]string, 0, 2) defer func() { if err != nil { for _, path := range downloadedFiles { os.Remove(path) } + apm.CaptureError(ctx, err).Send() } }() diff --git a/x-pack/elastic-agent/pkg/basecmd/version/cmd_test.go b/x-pack/elastic-agent/pkg/basecmd/version/cmd_test.go index 81fb5a56d8f9..0d33823cc888 100644 --- a/x-pack/elastic-agent/pkg/basecmd/version/cmd_test.go +++ b/x-pack/elastic-agent/pkg/basecmd/version/cmd_test.go @@ -11,6 +11,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + "go.elastic.co/apm" "gopkg.in/yaml.v2" "github.com/elastic/beats/v7/libbeat/logp" @@ -54,7 +55,8 @@ func TestCmdBinaryOnlyYAML(t *testing.T) { } func TestCmdDaemon(t *testing.T) { - srv := server.New(newErrorLogger(t), nil, nil, nil) + tracer := apm.DefaultTracer + srv := server.New(newErrorLogger(t), nil, nil, nil, tracer) require.NoError(t, srv.Start()) defer srv.Stop() @@ -70,7 +72,8 @@ func TestCmdDaemon(t *testing.T) { } func TestCmdDaemonYAML(t *testing.T) { - srv := server.New(newErrorLogger(t), nil, nil, nil) + tracer := apm.DefaultTracer + srv := server.New(newErrorLogger(t), nil, nil, nil, tracer) require.NoError(t, srv.Start()) defer srv.Stop() diff --git a/x-pack/elastic-agent/pkg/core/monitoring/config/config.go b/x-pack/elastic-agent/pkg/core/monitoring/config/config.go index 3004561bd862..ea98053d0d99 100644 --- a/x-pack/elastic-agent/pkg/core/monitoring/config/config.go +++ b/x-pack/elastic-agent/pkg/core/monitoring/config/config.go @@ -16,6 +16,8 @@ type MonitoringConfig struct { HTTP *MonitoringHTTPConfig `yaml:"http" config:"http"` Namespace string `yaml:"namespace" config:"namespace"` Pprof *PprofConfig `yaml:"pprof" config:"pprof"` + MonitorTraces bool `yaml:"traces" config:"traces"` + APM APMConfig `yaml:"apm,omitempty" config:"apm,omitempty" json:"apm,omitempty"` } // MonitoringHTTPConfig is a config defining HTTP endpoint published by agent @@ -41,10 +43,33 @@ func DefaultConfig() *MonitoringConfig { MonitorLogs: true, MonitorMetrics: true, LogMetrics: true, + MonitorTraces: false, HTTP: &MonitoringHTTPConfig{ Enabled: false, Port: defaultPort, }, Namespace: defaultNamespace, + APM: defaultAPMConfig(), } } + +// APMConfig configures APM Tracing. +type APMConfig struct { + Environment string `config:"environment"` + APIKey string `config:"api_key"` + SecretToken string `config:"secret_token"` + Hosts []string `config:"hosts"` + TLS APMTLS `config:"tls"` +} + +// APMTLS contains the configuration options necessary for configuring TLS in +// apm-agent-go. +type APMTLS struct { + SkipVerify bool `config:"skip_verify"` + ServerCertificate string `config:"server_certificate"` + ServerCA string `config:"server_ca"` +} + +func defaultAPMConfig() APMConfig { + return APMConfig{} +} diff --git a/x-pack/elastic-agent/pkg/core/monitoring/config/config_test.go b/x-pack/elastic-agent/pkg/core/monitoring/config/config_test.go new file mode 100644 index 000000000000..0f37fea591c2 --- /dev/null +++ b/x-pack/elastic-agent/pkg/core/monitoring/config/config_test.go @@ -0,0 +1,66 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package config + +import ( + "testing" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" + + "github.com/stretchr/testify/require" + "gotest.tools/assert" +) + +func TestAPMConfig(t *testing.T) { + tcs := map[string]struct { + in map[string]interface{} + out APMConfig + }{ + "default": { + in: map[string]interface{}{}, + out: defaultAPMConfig(), + }, + "custom": { + in: map[string]interface{}{ + "traces": true, + "apm": map[string]interface{}{ + "api_key": "abc123", + "environment": "production", + "hosts": []string{"https://abc.123.com"}, + "tls": map[string]interface{}{ + "skip_verify": true, + "server_certificate": "server_cert", + "server_ca": "server_ca", + }, + }, + }, + out: APMConfig{ + APIKey: "abc123", + Environment: "production", + Hosts: []string{"https://abc.123.com"}, + TLS: APMTLS{ + SkipVerify: true, + ServerCertificate: "server_cert", + ServerCA: "server_ca", + }, + }, + }, + } + + for name, tc := range tcs { + t.Run(name, func(t *testing.T) { + in, err := config.NewConfigFrom(tc.in) + require.NoError(t, err) + + cfg := DefaultConfig() + require.NoError(t, in.Unpack(cfg)) + + require.NoError(t, err) + require.NotNil(t, cfg) + instCfg := cfg.APM + assert.DeepEqual(t, tc.out, instCfg) + }) + } +} diff --git a/x-pack/elastic-agent/pkg/core/monitoring/server/server.go b/x-pack/elastic-agent/pkg/core/monitoring/server/server.go index 5d74221236f5..6cbd7692ede1 100644 --- a/x-pack/elastic-agent/pkg/core/monitoring/server/server.go +++ b/x-pack/elastic-agent/pkg/core/monitoring/server/server.go @@ -13,6 +13,8 @@ import ( "strings" "github.com/gorilla/mux" + "go.elastic.co/apm" + "go.elastic.co/apm/module/apmgorilla" "github.com/elastic/beats/v7/libbeat/api" "github.com/elastic/beats/v7/libbeat/common" @@ -28,6 +30,7 @@ func New( ns func(string) *monitoring.Namespace, routesFetchFn func() *sorted.Set, enableProcessStats bool, + tracer *apm.Tracer, ) (*api.Server, error) { if err := createAgentMonitoringDrop(endpointConfig.Host); err != nil { // log but ignore @@ -39,11 +42,21 @@ func New( return nil, err } - return exposeMetricsEndpoint(log, cfg, ns, routesFetchFn, enableProcessStats) + return exposeMetricsEndpoint(log, cfg, ns, routesFetchFn, enableProcessStats, tracer) } -func exposeMetricsEndpoint(log *logger.Logger, config *common.Config, ns func(string) *monitoring.Namespace, routesFetchFn func() *sorted.Set, enableProcessStats bool) (*api.Server, error) { +func exposeMetricsEndpoint( + log *logger.Logger, + config *common.Config, + ns func(string) *monitoring.Namespace, + routesFetchFn func() *sorted.Set, + enableProcessStats bool, + tracer *apm.Tracer, +) (*api.Server, error) { r := mux.NewRouter() + if tracer != nil { + r.Use(apmgorilla.Middleware(apmgorilla.WithTracer(tracer))) + } statsHandler := statsHandler(ns("stats")) r.Handle("/stats", createHandler(statsHandler)) diff --git a/x-pack/elastic-agent/pkg/core/server/config.go b/x-pack/elastic-agent/pkg/core/server/config.go index 283bd58a4634..74d68b4ef5a2 100644 --- a/x-pack/elastic-agent/pkg/core/server/config.go +++ b/x-pack/elastic-agent/pkg/core/server/config.go @@ -7,6 +7,8 @@ package server import ( "fmt" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" ) @@ -25,6 +27,6 @@ func DefaultGRPCConfig() *Config { } // NewFromConfig creates a new GRPC server for clients to connect to. -func NewFromConfig(logger *logger.Logger, cfg *Config, handler Handler) (*Server, error) { - return New(logger, fmt.Sprintf("%s:%d", cfg.Address, cfg.Port), handler) +func NewFromConfig(logger *logger.Logger, cfg *Config, handler Handler, tracer *apm.Tracer) (*Server, error) { + return New(logger, fmt.Sprintf("%s:%d", cfg.Address, cfg.Port), handler, tracer) } diff --git a/x-pack/elastic-agent/pkg/core/server/config_test.go b/x-pack/elastic-agent/pkg/core/server/config_test.go index 444b73dffd23..2c846d77892c 100644 --- a/x-pack/elastic-agent/pkg/core/server/config_test.go +++ b/x-pack/elastic-agent/pkg/core/server/config_test.go @@ -17,7 +17,7 @@ func TestNewFromConfig(t *testing.T) { Address: "0.0.0.0", Port: 9876, } - srv, err := NewFromConfig(l, cfg, &StubHandler{}) + srv, err := NewFromConfig(l, cfg, &StubHandler{}, nil) require.NoError(t, err) assert.Equal(t, "0.0.0.0:9876", srv.getListenAddr()) } diff --git a/x-pack/elastic-agent/pkg/core/server/server.go b/x-pack/elastic-agent/pkg/core/server/server.go index f584e70bad25..dec1241a1a3c 100644 --- a/x-pack/elastic-agent/pkg/core/server/server.go +++ b/x-pack/elastic-agent/pkg/core/server/server.go @@ -15,6 +15,8 @@ import ( "sync" "time" + "go.elastic.co/apm" + "go.elastic.co/apm/module/apmgrpc" "google.golang.org/grpc/codes" "google.golang.org/grpc/status" @@ -101,6 +103,7 @@ type Server struct { ca *authority.CertificateAuthority listenAddr string handler Handler + tracer *apm.Tracer listener net.Listener server *grpc.Server @@ -115,7 +118,7 @@ type Server struct { } // New creates a new GRPC server for clients to connect to. -func New(logger *logger.Logger, listenAddr string, handler Handler) (*Server, error) { +func New(logger *logger.Logger, listenAddr string, handler Handler, tracer *apm.Tracer) (*Server, error) { ca, err := authority.NewCA() if err != nil { return nil, err @@ -127,6 +130,7 @@ func New(logger *logger.Logger, listenAddr string, handler Handler) (*Server, er handler: handler, watchdogCheckInterval: WatchdogCheckLoop, checkInMinTimeout: client.CheckinMinimumTimeout + CheckinMinimumTimeoutGracePeriod, + tracer: tracer, }, nil } @@ -151,7 +155,15 @@ func (s *Server) Start() error { ClientCAs: certPool, GetCertificate: s.getCertificate, }) - s.server = grpc.NewServer(grpc.Creds(creds)) + if s.tracer != nil { + apmInterceptor := apmgrpc.NewUnaryServerInterceptor(apmgrpc.WithRecovery(), apmgrpc.WithTracer(s.tracer)) + s.server = grpc.NewServer( + grpc.UnaryInterceptor(apmInterceptor), + grpc.Creds(creds), + ) + } else { + s.server = grpc.NewServer() + } proto.RegisterElasticAgentServer(s.server, s) // start serving GRPC connections diff --git a/x-pack/elastic-agent/pkg/core/server/server_test.go b/x-pack/elastic-agent/pkg/core/server/server_test.go index b879d53728da..a883fb76a8d0 100644 --- a/x-pack/elastic-agent/pkg/core/server/server_test.go +++ b/x-pack/elastic-agent/pkg/core/server/server_test.go @@ -13,6 +13,7 @@ import ( "testing" "time" + "go.elastic.co/apm" "google.golang.org/grpc/codes" "google.golang.org/grpc/status" @@ -634,7 +635,8 @@ func newErrorLogger(t *testing.T) *logger.Logger { func createAndStartServer(t *testing.T, handler Handler, extraConfigs ...func(*Server)) *Server { t.Helper() - srv, err := New(newErrorLogger(t), "localhost:0", handler) + tracer := apm.DefaultTracer + srv, err := New(newErrorLogger(t), "localhost:0", handler, tracer) require.NoError(t, err) for _, extra := range extraConfigs { extra(srv) diff --git a/x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go b/x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go index 5002fc36ffe7..189446130360 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go +++ b/x-pack/elastic-agent/pkg/fleetapi/ack_cmd.go @@ -11,6 +11,8 @@ import ( "fmt" "net/http" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi/client" ) @@ -79,24 +81,29 @@ func NewAckCmd(info agentInfo, client client.Sender) *AckCmd { // Execute ACK of actions to the Fleet. func (e *AckCmd) Execute(ctx context.Context, r *AckRequest) (*AckResponse, error) { - if err := r.Validate(); err != nil { + var err error + span, ctx := apm.StartSpan(ctx, "execute", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() + if err = r.Validate(); err != nil { return nil, err } - b, err := json.Marshal(r) - if err != nil { - return nil, errors.New(err, - "fail to encode the ack request", - errors.TypeUnexpected) + b, mErr := json.Marshal(r) + if mErr != nil { + err = errors.New(mErr, "fail to encode the ack request", errors.TypeUnexpected) + return nil, err } ap := fmt.Sprintf(ackPath, e.info.AgentID()) - resp, err := e.client.Send(ctx, "POST", ap, nil, nil, bytes.NewBuffer(b)) - if err != nil { - return nil, errors.New(err, - "fail to ack to fleet", - errors.TypeNetwork, - errors.M(errors.MetaKeyURI, ap)) + resp, mErr := e.client.Send(ctx, "POST", ap, nil, nil, bytes.NewBuffer(b)) + if mErr != nil { + err = errors.New(mErr, "fail to ack to fleet", errors.TypeNetwork, errors.M(errors.MetaKeyURI, ap)) + return nil, err } defer resp.Body.Close() @@ -106,14 +113,15 @@ func (e *AckCmd) Execute(ctx context.Context, r *AckRequest) (*AckResponse, erro ackResponse := &AckResponse{} decoder := json.NewDecoder(resp.Body) - if err := decoder.Decode(ackResponse); err != nil { - return nil, errors.New(err, + if err = decoder.Decode(ackResponse); err != nil { + err = errors.New(err, "fail to decode ack response", errors.TypeNetwork, errors.M(errors.MetaKeyURI, ap)) + return nil, err } - if err := ackResponse.Validate(); err != nil { + if err = ackResponse.Validate(); err != nil { return nil, err } diff --git a/x-pack/elastic-agent/pkg/fleetapi/acker/fleet/fleet_acker.go b/x-pack/elastic-agent/pkg/fleetapi/acker/fleet/fleet_acker.go index fcc74f17205e..34c7402c592f 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/acker/fleet/fleet_acker.go +++ b/x-pack/elastic-agent/pkg/fleetapi/acker/fleet/fleet_acker.go @@ -10,6 +10,8 @@ import ( "strings" "time" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" @@ -48,7 +50,14 @@ func (f *Acker) SetClient(c client.Sender) { } // Ack acknowledges action. -func (f *Acker) Ack(ctx context.Context, action fleetapi.Action) error { +func (f *Acker) Ack(ctx context.Context, action fleetapi.Action) (err error) { + span, ctx := apm.StartSpan(ctx, "ack", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() // checkin agentID := f.agentInfo.AgentID() cmd := fleetapi.NewAckCmd(f.agentInfo, f.client) @@ -58,7 +67,7 @@ func (f *Acker) Ack(ctx context.Context, action fleetapi.Action) error { }, } - _, err := cmd.Execute(ctx, req) + _, err = cmd.Execute(ctx, req) if err != nil { return errors.New(err, fmt.Sprintf("acknowledge action '%s' for elastic-agent '%s' failed", action.ID(), agentID), errors.TypeNetwork) } @@ -69,7 +78,14 @@ func (f *Acker) Ack(ctx context.Context, action fleetapi.Action) error { } // AckBatch acknowledges multiple actions at once. -func (f *Acker) AckBatch(ctx context.Context, actions []fleetapi.Action) error { +func (f *Acker) AckBatch(ctx context.Context, actions []fleetapi.Action) (err error) { + span, ctx := apm.StartSpan(ctx, "ackBatch", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() // checkin agentID := f.agentInfo.AgentID() events := make([]fleetapi.AckEvent, 0, len(actions)) @@ -91,7 +107,7 @@ func (f *Acker) AckBatch(ctx context.Context, actions []fleetapi.Action) error { f.log.Debugf("%d actions with ids '%s' acknowledging", len(ids), strings.Join(ids, ",")) - _, err := cmd.Execute(ctx, req) + _, err = cmd.Execute(ctx, req) if err != nil { return errors.New(err, fmt.Sprintf("acknowledge %d actions '%v' for elastic-agent '%s' failed", len(actions), actions, agentID), errors.TypeNetwork) } diff --git a/x-pack/elastic-agent/pkg/fleetapi/acker/lazy/lazy_acker.go b/x-pack/elastic-agent/pkg/fleetapi/acker/lazy/lazy_acker.go index c48ac0042334..e1fb9c2e8f84 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/acker/lazy/lazy_acker.go +++ b/x-pack/elastic-agent/pkg/fleetapi/acker/lazy/lazy_acker.go @@ -7,6 +7,8 @@ package lazy import ( "context" + "go.elastic.co/apm" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/fleetapi" ) @@ -36,19 +38,34 @@ func NewAcker(baseAcker batchAcker, log *logger.Logger) *Acker { } // Ack acknowledges action. -func (f *Acker) Ack(ctx context.Context, action fleetapi.Action) error { +func (f *Acker) Ack(ctx context.Context, action fleetapi.Action) (err error) { + span, ctx := apm.StartSpan(ctx, "ack", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() f.enqueue(action) if _, isAckForced := action.(ackForcer); isAckForced { - return f.Commit(ctx) + err = f.Commit(ctx) + return } return nil } // Commit commits ack actions. -func (f *Acker) Commit(ctx context.Context) error { - err := f.acker.AckBatch(ctx, f.queue) +func (f *Acker) Commit(ctx context.Context) (err error) { + span, ctx := apm.StartSpan(ctx, "commit", "app.internal") + defer func() { + if err != nil { + apm.CaptureError(ctx, err).Send() + } + span.End() + }() + err = f.acker.AckBatch(ctx, f.queue) if err != nil { // do not cleanup on error return err diff --git a/x-pack/elastic-agent/pkg/fleetapi/client/client.go b/x-pack/elastic-agent/pkg/fleetapi/client/client.go index 172600cfede5..96a575858528 100644 --- a/x-pack/elastic-agent/pkg/fleetapi/client/client.go +++ b/x-pack/elastic-agent/pkg/fleetapi/client/client.go @@ -14,6 +14,8 @@ import ( "net/url" "os" + "go.elastic.co/apm/module/apmhttp" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/release" @@ -36,7 +38,7 @@ type Sender interface { var baseRoundTrippers = func(rt http.RoundTripper) (http.RoundTripper, error) { rt = NewFleetUserAgentRoundTripper(rt, release.Version()) - return rt, nil + return apmhttp.WrapRoundTripper(rt), nil } func init() { diff --git a/x-pack/elastic-agent/pkg/remote/client.go b/x-pack/elastic-agent/pkg/remote/client.go index 23f6162c08e3..fe4608372313 100644 --- a/x-pack/elastic-agent/pkg/remote/client.go +++ b/x-pack/elastic-agent/pkg/remote/client.go @@ -15,6 +15,7 @@ import ( "time" "github.com/pkg/errors" + "go.elastic.co/apm/module/apmhttp" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/common/transport/httpcommon" @@ -124,6 +125,8 @@ func NewWithConfig(log *logger.Logger, cfg Config, wrapper wrapperFunc) (*Client } } + transport = apmhttp.WrapRoundTripper(transport) + httpClient := http.Client{ Transport: transport, Timeout: cfg.Transport.Timeout, From fbcece627a175043be22e659f58957cb77520b8a Mon Sep 17 00:00:00 2001 From: Adrian Serrano Date: Tue, 1 Feb 2022 10:19:02 +0100 Subject: [PATCH 06/20] New version of threatintel/recordedfuture dataset (#30030) This is a new implementation of the Recorded Future integration in the threatintel module. Uses the `risklist` API endpoints to fetch threat indicators in CSV format, while also supports ingesting from a custom URL (for Fusion Files) and from CSV files. The previous implementation was unsupported as it used the wrong API to download indicators from Recorded Future. --- CHANGELOG.next.asciidoc | 1 + filebeat/docs/fields.asciidoc | 135 +- filebeat/docs/modules/threatintel.asciidoc | 92 +- x-pack/filebeat/filebeat.reference.yml | 34 +- .../module/threatintel/_meta/config.yml | 34 +- .../module/threatintel/_meta/docs.asciidoc | 92 +- x-pack/filebeat/module/threatintel/fields.go | 2 +- .../recordedfuture/_meta/fields.yml | 73 +- .../recordedfuture/config/config.yml | 18 +- .../recordedfuture/ingest/decode_csv.yml | 42 + .../recordedfuture/ingest/pipeline.yml | 346 +- .../threatintel/recordedfuture/manifest.yml | 10 +- .../recordedfuture/test/domain.ndjson.log | 10 - .../test/domain.ndjson.log-expected.json | 332 -- .../recordedfuture/test/hash.ndjson.log | 10 - .../test/hash.ndjson.log-expected.json | 514 -- .../recordedfuture/test/ip.ndjson.log | 10 - .../test/ip.ndjson.log-expected.json | 428 -- .../recordedfuture/test/rf_assorted.json.log | 40 + .../test/rf_assorted.json.log-expected.json | 4125 +++++++++++++++++ .../test/rf_domain_default.csv.log | 10 + .../rf_domain_default.csv.log-expected.json | 777 ++++ .../test/rf_hash_default.csv.log | 10 + .../rf_hash_default.csv.log-expected.json | 1441 ++++++ .../recordedfuture/test/rf_ip_default.csv.log | 10 + .../test/rf_ip_default.csv.log-expected.json | 881 ++++ .../test/rf_url_default.csv.log | 10 + .../test/rf_url_default.csv.log-expected.json | 651 +++ .../recordedfuture/test/url.ndjson.log | 10 - .../test/url.ndjson.log-expected.json | 462 -- .../modules.d/threatintel.yml.disabled | 34 +- 31 files changed, 8330 insertions(+), 2314 deletions(-) create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/ingest/decode_csv.yml delete mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/domain.ndjson.log delete mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/domain.ndjson.log-expected.json delete mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/hash.ndjson.log delete mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/hash.ndjson.log-expected.json delete mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/ip.ndjson.log delete mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/ip.ndjson.log-expected.json create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_assorted.json.log create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_assorted.json.log-expected.json create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_domain_default.csv.log create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_domain_default.csv.log-expected.json create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_hash_default.csv.log create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_hash_default.csv.log-expected.json create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_ip_default.csv.log create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_ip_default.csv.log-expected.json create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_url_default.csv.log create mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/rf_url_default.csv.log-expected.json delete mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/url.ndjson.log delete mode 100644 x-pack/filebeat/module/threatintel/recordedfuture/test/url.ndjson.log-expected.json diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index cfc742c0d892..8bf04636d81b 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -181,6 +181,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add support in httpjson input for oAuth2ProviderDefault of password grant_type. {pull}29087[29087] - Add support for filtering in journald input with `unit`, `kernel`, `identifiers` and `include_matches`. {pull}29294[29294] - Add new `userAgent` and `beatInfo` template functions for httpjson input {pull}29528[29528] +- threatintel module: Add new Recorded Future integration. {pull}30030[30030] *Heartbeat* diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index 9030022bc67f..85c3c1fc6aa9 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -151920,157 +151920,34 @@ Fields for Recorded Future Threat Intel -[float] -=== entity - -Entity that represents a threat. - - - -*`recordedfuture.entity.id`*:: -+ --- -Entity ID. - - -type: keyword - -example: ip:192.0.2.13 - --- - -*`recordedfuture.entity.name`*:: -+ --- -Entity name. Value for the entity. - - -type: keyword - -example: 192.0.2.13 - --- - -*`recordedfuture.entity.type`*:: -+ --- -Entity type. - - -type: keyword - -example: IpAddress - --- - -*`recordedfuture.intelCard`*:: -+ --- -Link to the Recorded Future Intelligence Card for to this indicator. - - -type: keyword - --- - -*`recordedfuture.ip_range`*:: -+ --- -Range of IPs for this indicator. - - -type: ip_range - -example: 192.0.2.0/16 - --- - -[float] -=== risk - -Risk fields. - - - -*`recordedfuture.risk.criticality`*:: +*`recordedfuture.evidence_details`*:: + -- -Risk criticality (0-4). - - -type: byte - --- - -*`recordedfuture.risk.criticalityLabel`*:: -+ --- -Risk criticality label. One of None, Unusual, Suspicious, Malicious, Very Malicious. - - -type: keyword - --- - -*`recordedfuture.risk.evidenceDetails`*:: -+ --- -Risk's evidence details. +List of sightings used as evidence for this indicator. type: flattened -- -*`recordedfuture.risk.score`*:: -+ --- -Risk score (0-99). - - -type: short - --- - -*`recordedfuture.risk.riskString`*:: +*`recordedfuture.name`*:: + -- -Number of Risk Rules observed as a factor of total number of rules. +Indicator value. type: keyword -example: 1/54 - -- -*`recordedfuture.risk.riskSummary`*:: +*`recordedfuture.risk_string`*:: + -- -Risk summary. +Details of risk rules observed. type: keyword -example: 1 of 54 Risk Rules currently observed. - --- - -*`recordedfuture.risk.riskSummary.text`*:: -+ --- -type: text - --- - -*`recordedfuture.risk.rules`*:: -+ --- -Number of rules observed. - - -type: long - -- [float] diff --git a/filebeat/docs/modules/threatintel.asciidoc b/filebeat/docs/modules/threatintel.asciidoc index b8b5b6f950db..bbab60c90e5e 100644 --- a/filebeat/docs/modules/threatintel.asciidoc +++ b/filebeat/docs/modules/threatintel.asciidoc @@ -519,14 +519,12 @@ Anomali ThreatStream fields are mapped to the following ECS fields: [float] ==== `recordedfuture` fileset settings -The `recordedfuture` fileset fetches intelligence from the Recorded Future Connect API. -It supports `domain`, `hash`, `ip` and `url` data types. +The `recordedfuture` fileset fetches risklists from the Recorded Future Connect API. +It supports `domain`, `hash`, `ip` and `url` entities. -To enable it you need to define the URL to fetch data from. You can construct this URL -using the https://api.recordedfuture.com/index.html[Recorded Future API Explorer.] The URL -must point to the `/search` endpoint and contain a suitable `limit` -(how many records to return from a single request) and `fields` parameters. -The `entity` and `timestamps` fields are required. +In order to use it you need to define the `entity` and `list` to fetch. Check the +https://api.recordedfuture.com/index.html[Recorded Future API Explorer] for the +available lists for each entity. Sample configuration: [source,yaml] @@ -535,56 +533,92 @@ Sample configuration: recordedfuture: enabled: true var.input: httpjson - var.interval: 5m - var.first_interval: 168h - var.url: "https://api.recordedfuture.com/v2/ip/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + var.interval: 1h var.api_token: "" + var.list: default + var.entity: domain ---- -To fetch threat intelligence from multiple data types, you must define more than -one instance of the module: +To fetch threat intelligence from multiple entities and/or lists, you must define more +than one instance of the module. The following configuration fetches the default list +for domains every hour and the rfTrending list for hashes every 12 hours: + [source,yaml] ---- - module: threatintel recordedfuture: enabled: true var.input: httpjson - var.interval: 5m - var.first_interval: 168h - var.url: "https://api.recordedfuture.com/v2/ip/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + var.interval: 1h var.api_token: "" + var.list: default + var.entity: domain - module: threatintel recordedfuture: enabled: true var.input: httpjson - var.interval: 1m - var.first_interval: 168h - var.url: "https://api.recordedfuture.com/v2/hash/search?limit=200&fields=entity,fileHashes,timestamps,risk,intelCard,location&metadata=false" + var.interval: 12h var.api_token: "" + var.entity: hash + var.list: rfTrending ---- -*`var.url`*:: +Alternatively, you can use the module to fetch custom Fusion files by setting +`var.custom_url` to the URL of the Fusion File: -The URL of the API endpoint to connect with. +[source,yaml] +---- +- module: threatintel + recordedfuture: + enabled: true + var.input: httpjson + var.interval: 1h + var.api_token: "" + var.custom_url: 'https://api.recordedfuture.com/v2/fusion/files/?path=%2Fpublic%2Frisklists%2Fdefault_domain_risklist.csv' +---- + +It's also possible to load CSV risklists from a file: + +[source,yaml] +---- +- module: threatintel + recordedfuture: + enabled: true + var.input: file + var.paths: + - /path/to/risklist.csv +---- + +*`var.input`*:: + +The input to use to fetch indicators. Use `httpjson` to query +Recorded Future API or `file` to load the indicators from a file. *`var.api_token`*:: -The API token used to access Recorded Future API. +The API token used to access Recorded Future API (RF-Token). *`var.interval`*:: -How often the API is polled for updated information. +How often the API is polled for updated information. It is recommended to set this +to `1h`. For `hash` entities, it's recommended to set this to `12h`. -*`var.first_interval`*:: +*`var.entity`*:: -How far back to search when retrieving events the first time {beatname_uc} starts up. -After the first interval has passed the module itself will use the timestamp -from the last response as the filter when retrieving new events. +The type of entity to fetch. One of `domain`, `hash`, `ip` or `url`. + +*`var.list`*:: + +The indicator list to fetch. *`var.proxy_url`*:: Optional URL to use as HTTP proxy. +*`var.custom_url`*:: + +An alternative URL pointing to a CSV risklist. Use this option +to fetch custom Fusion Files. Recorded Future fields are mapped to the following ECS fields: @@ -594,13 +628,7 @@ Recorded Future fields are mapped to the following ECS fields: | entity.name | threat.indicator.{url,ip,domain,file.hash} | entity.type | threat.indicator.type | fileHashes | threat.indicator.file.hash -| intelCard | event.reference -| location.asn | threat.indicator.as.number -| location.location | threat.indicator.geo -| location.organization | threat.indicator.as.organization.name | risk.score | event.risk_score -| timestamps.firstSeen | threat.indicator.first_seen -| timestamps.lastSeen | threat.indicator.last_seen |============================================================= :has-dashboards!: diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index 71872a5c4b2e..becffd39a6b1 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -2231,31 +2231,25 @@ filebeat.modules: # Input used for ingesting threat intel data var.input: httpjson - # The interval to poll the API for updates - var.interval: 5m - - # How far back in time to start fetching intelligence when run for the - # first time. Value must be in hours. Default: 168h (1 week). - var.first_interval: 168h + # Set your API Token. + var.api_token: "" - # The URL used for Threat Intel API calls. - # Must include the `limit` parameter and at least `entity` and `timestamps` fields. - # See the Connect API Explorer for a list of possible parameters. - # - # For `ip` entities: - var.url: "https://api.recordedfuture.com/v2/ip/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + # The interval to poll the API for updates + var.interval: 1h - # For `domain` entities: - # var.url: "https://api.recordedfuture.com/v2/domain/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + # The kind of entity to fetch. One of domain, hash, ip or url. + var.entity: domain - # For `hash` entities: - # var.url: "https://api.recordedfuture.com/v2/hash/search?limit=200&fields=entity,fileHashes,timestamps,risk,intelCard,location&metadata=false" + # The list to fetch. See the Recorded Future API Explorer for + # valid lists for each kind of entity. + var.list: default - # For `url` entities: - # var.url: "https://api.recordedfuture.com/v2/url/search?limit=200&fields=entity,timestamps,risk&metadata=false" + # Uncomment to use a different API endpoint. + # The API endpoint used for Recorded Future API calls. + # var.endpoint: "https://api.recordedfuture.com/v2" - # Set your API Token. - var.api_token: "" + # Uncomment to fetch a custom CSV file via URL. Useful for custom Fusion Files. + # var.custom_url: "https://api.recordedfuture.com/v2/fusion/files/?path=%2Fhome" threatq: enabled: false diff --git a/x-pack/filebeat/module/threatintel/_meta/config.yml b/x-pack/filebeat/module/threatintel/_meta/config.yml index bf0e7c236ed3..8029d3e2d563 100644 --- a/x-pack/filebeat/module/threatintel/_meta/config.yml +++ b/x-pack/filebeat/module/threatintel/_meta/config.yml @@ -144,31 +144,25 @@ # Input used for ingesting threat intel data var.input: httpjson - # The interval to poll the API for updates - var.interval: 5m - - # How far back in time to start fetching intelligence when run for the - # first time. Value must be in hours. Default: 168h (1 week). - var.first_interval: 168h + # Set your API Token. + var.api_token: "" - # The URL used for Threat Intel API calls. - # Must include the `limit` parameter and at least `entity` and `timestamps` fields. - # See the Connect API Explorer for a list of possible parameters. - # - # For `ip` entities: - var.url: "https://api.recordedfuture.com/v2/ip/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + # The interval to poll the API for updates + var.interval: 1h - # For `domain` entities: - # var.url: "https://api.recordedfuture.com/v2/domain/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + # The kind of entity to fetch. One of domain, hash, ip or url. + var.entity: domain - # For `hash` entities: - # var.url: "https://api.recordedfuture.com/v2/hash/search?limit=200&fields=entity,fileHashes,timestamps,risk,intelCard,location&metadata=false" + # The list to fetch. See the Recorded Future API Explorer for + # valid lists for each kind of entity. + var.list: default - # For `url` entities: - # var.url: "https://api.recordedfuture.com/v2/url/search?limit=200&fields=entity,timestamps,risk&metadata=false" + # Uncomment to use a different API endpoint. + # The API endpoint used for Recorded Future API calls. + # var.endpoint: "https://api.recordedfuture.com/v2" - # Set your API Token. - var.api_token: "" + # Uncomment to fetch a custom CSV file via URL. Useful for custom Fusion Files. + # var.custom_url: "https://api.recordedfuture.com/v2/fusion/files/?path=%2Fhome" threatq: enabled: false diff --git a/x-pack/filebeat/module/threatintel/_meta/docs.asciidoc b/x-pack/filebeat/module/threatintel/_meta/docs.asciidoc index 18c8d57e169d..cb4961935225 100644 --- a/x-pack/filebeat/module/threatintel/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/threatintel/_meta/docs.asciidoc @@ -514,14 +514,12 @@ Anomali ThreatStream fields are mapped to the following ECS fields: [float] ==== `recordedfuture` fileset settings -The `recordedfuture` fileset fetches intelligence from the Recorded Future Connect API. -It supports `domain`, `hash`, `ip` and `url` data types. +The `recordedfuture` fileset fetches risklists from the Recorded Future Connect API. +It supports `domain`, `hash`, `ip` and `url` entities. -To enable it you need to define the URL to fetch data from. You can construct this URL -using the https://api.recordedfuture.com/index.html[Recorded Future API Explorer.] The URL -must point to the `/search` endpoint and contain a suitable `limit` -(how many records to return from a single request) and `fields` parameters. -The `entity` and `timestamps` fields are required. +In order to use it you need to define the `entity` and `list` to fetch. Check the +https://api.recordedfuture.com/index.html[Recorded Future API Explorer] for the +available lists for each entity. Sample configuration: [source,yaml] @@ -530,56 +528,92 @@ Sample configuration: recordedfuture: enabled: true var.input: httpjson - var.interval: 5m - var.first_interval: 168h - var.url: "https://api.recordedfuture.com/v2/ip/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + var.interval: 1h var.api_token: "" + var.list: default + var.entity: domain ---- -To fetch threat intelligence from multiple data types, you must define more than -one instance of the module: +To fetch threat intelligence from multiple entities and/or lists, you must define more +than one instance of the module. The following configuration fetches the default list +for domains every hour and the rfTrending list for hashes every 12 hours: + [source,yaml] ---- - module: threatintel recordedfuture: enabled: true var.input: httpjson - var.interval: 5m - var.first_interval: 168h - var.url: "https://api.recordedfuture.com/v2/ip/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + var.interval: 1h var.api_token: "" + var.list: default + var.entity: domain - module: threatintel recordedfuture: enabled: true var.input: httpjson - var.interval: 1m - var.first_interval: 168h - var.url: "https://api.recordedfuture.com/v2/hash/search?limit=200&fields=entity,fileHashes,timestamps,risk,intelCard,location&metadata=false" + var.interval: 12h var.api_token: "" + var.entity: hash + var.list: rfTrending ---- -*`var.url`*:: +Alternatively, you can use the module to fetch custom Fusion files by setting +`var.custom_url` to the URL of the Fusion File: -The URL of the API endpoint to connect with. +[source,yaml] +---- +- module: threatintel + recordedfuture: + enabled: true + var.input: httpjson + var.interval: 1h + var.api_token: "" + var.custom_url: 'https://api.recordedfuture.com/v2/fusion/files/?path=%2Fpublic%2Frisklists%2Fdefault_domain_risklist.csv' +---- + +It's also possible to load CSV risklists from a file: + +[source,yaml] +---- +- module: threatintel + recordedfuture: + enabled: true + var.input: file + var.paths: + - /path/to/risklist.csv +---- + +*`var.input`*:: + +The input to use to fetch indicators. Use `httpjson` to query +Recorded Future API or `file` to load the indicators from a file. *`var.api_token`*:: -The API token used to access Recorded Future API. +The API token used to access Recorded Future API (RF-Token). *`var.interval`*:: -How often the API is polled for updated information. +How often the API is polled for updated information. It is recommended to set this +to `1h`. For `hash` entities, it's recommended to set this to `12h`. -*`var.first_interval`*:: +*`var.entity`*:: -How far back to search when retrieving events the first time {beatname_uc} starts up. -After the first interval has passed the module itself will use the timestamp -from the last response as the filter when retrieving new events. +The type of entity to fetch. One of `domain`, `hash`, `ip` or `url`. + +*`var.list`*:: + +The indicator list to fetch. *`var.proxy_url`*:: Optional URL to use as HTTP proxy. +*`var.custom_url`*:: + +An alternative URL pointing to a CSV risklist. Use this option +to fetch custom Fusion Files. Recorded Future fields are mapped to the following ECS fields: @@ -589,13 +623,7 @@ Recorded Future fields are mapped to the following ECS fields: | entity.name | threat.indicator.{url,ip,domain,file.hash} | entity.type | threat.indicator.type | fileHashes | threat.indicator.file.hash -| intelCard | event.reference -| location.asn | threat.indicator.as.number -| location.location | threat.indicator.geo -| location.organization | threat.indicator.as.organization.name | risk.score | event.risk_score -| timestamps.firstSeen | threat.indicator.first_seen -| timestamps.lastSeen | threat.indicator.last_seen |============================================================= :has-dashboards!: diff --git a/x-pack/filebeat/module/threatintel/fields.go b/x-pack/filebeat/module/threatintel/fields.go index d0fa140db906..76dd9666ce76 100644 --- a/x-pack/filebeat/module/threatintel/fields.go +++ b/x-pack/filebeat/module/threatintel/fields.go @@ -19,5 +19,5 @@ func init() { // AssetThreatintel returns asset data. // This is the base64 encoded zlib format compressed contents of module/threatintel. func AssetThreatintel() string { - return "eJzsXNtz2zaXf89fccYvSWYUNXGTztYPO+PmsvGM23R9yfZNAwFHIlYgwAKgFPWv/wYASVEUSEk25Ob7pn6yeDnnh4NzB8BXsMD1BdhMI7FcWhTPACy3ArsXNQokBi9gipY8A2BoqOaF5UpewH8/AwC48y+Af0PwOUqK8IkLnLqrvypWChw/A5hxFMxc+FdegSQ5XsDZmf8JYNcFXsBcq7KorrQfb78S4I25ZJwSq/R4xgWOM2KysRUma56vaS5wvVKata5HhlD/3WUIjt5zAzwvlLbgaI6Az4AsCRdk6sZyDCaTkR//620yVIEcONKHopohsrG70gti8E1GTDZVRLMJZ3uHURMg09IgzcY5ESuidzm3J3rP4D95PYCZ0nDpqL7/DL8GqrXiXVWqWv91NWcDywlx4hBsceibkUFY4FXcvwvzEo1BBtM13N9cZ6Q04+bZCArD55LYUidBUctiRnIu+HqQcamFAzdhaiWFIiwF/2tFibsDL+5vrl/CKkONsFYlUCKhZgQEqCrWoGZgM278PAwiXXJdGqssEWONphQ2BdTLr8DQIvVwtUd9KIgCNUUZQzETitgHYuASKsKH4hBcLpLMGpcLsApshvC1IQ8anc8b95pzqcX3Yso8ifY6z3r1IeglOvs4yH40zlC7MJdyKirPASit3mvGE2OJLU0qEdBSa5QWAtVaHPc312P4XRnDpwJhSUSJBojGC1BScIkjULOZ+weIZFDKhVSrYYsKcSUV6kANqNIaTaEk43IelJobqCKPH8QQpKkgdCG4sWZsSj0VKcDd3t/8cr2hXIm1R5buCWRehFLZSfh5KOKC5MGjJwJe0YMPMfxDoILnQJ1qbu9W3FrUkBHJBNYaWXMBmxHrkqD6CtuZdHihNBCp5DpXpXk5CF4Q3Zb5BvpUKYFEHg79KmSAaFwgtJlHiluwHOgpomwhD244U8Y6BS60WnKGGl5YXSIoDTMiDL4ctCsyT+ILLr02emmTuQFijKKcOJArbjMP888SNUfWHtNuuJAqJ4KPBc9VqngRSH4fcWKT50cYdjLtR7F0tA5iWhBnLTIV34rcoUNeEsHZZKZVHgHAiMXDuf9fhnKbIayISxi1sTBTpWTOIrgBqqRxZoIssI/hyhXjMx617CSoBDE2xmTjV6YokgXpQM0V5KTlNhpEMd2P3HsUBB+3dlRi5C0Uv5G8EOiKUnfXF0bcAFM54XIU/PNKlYLBFP0Tnlhs2low0ji11u2D9Nk3QpLIzBGqHpn67GQfa6qkjRcaRzP/+M1qAha/WWcyzaNLrJn0qlJUJomq5rstK3JERr5UbKvQFOGs1hvMCRcjX2x/JiZ7dfv58vzdT2cxiGr6/0jtJCd6weXcZenJbO/27uoPaNL+ilOkTqoCX8hMjdVI8pMEwNsu6W4AjKmWIMbwGQ/1egrJ7GY7RLYmlxsoNF8SG7IYrXIgUJRTwSnMsMp5mwZWdUesxx0unaz5oiY6qt7Yfr7SoeapQYkoOeOsp5AzmdJHFPZOS3IkptSNgySUlprQNbzwY3/t7OzN69cvXV7F5zI0jNrz+dwJDBmn3kqJJGJtOTVgkWZSCTVfOxKNgIczcoaWcHEeGZlzCYcP7IOnE/yIU8Sol2jJ/Sqv8trpGkqDGt6eD+J8ogQtxtkjnRg0his5SQOkBSI0kCvyoWShbrJ9tdL2gkpuqcEw6FSO+GrLCe81ujNS2Elwymej8Mu75voHL+r/Si3ORh1yZ1NVP0LPW2To+eaqfw/O+HlRXcuJaB7t0nP3Gv7ux+aVnL2r/61IFkQvkFWPFBk3Wf1ul2y42X6wImEokdV1V3S3hmCqF7qkTGkKTrny/db6Yau0e9h7PvdDo7QTqwldoPasBuc+J6Jn9ldcMEqOm/6Z0nlo3WqcE+27J6Sp63w/eT0CAu+/foSrDyMI9XRw89YSunBXQqQbRUvFw6wwZ+9SqLNLDrx/OpyzRqNKTXFSap4Cwo1Lp5znvr+52oVSOeQ9SwO4RM3tOgWc95pbTongdh2dnqp95iOxd06mLArBu95pr2cQajWCHBkv8xFkfJ6NYIl6/cr9OzxYL/0UQ731lIamH9oh6tJFVmP3Y5s44aQLDBt8FufaK0XgMywm261VHyolR6gCwc1eKRGfhgwhs7o0FtmEck0FTjhLkm9vImhFHwL9oKQ8bxp+h9p5WbhqP9E03nticPVhX4s+CbOb6yN9mjfKZEucH4gloZIfKpsh5hV4MWpq/1KLppDL2bv+9aUq+EzJX4ToRIVTvcL0iyf6Pa4ZbyOMVbZPs2L8XfSTjfc+MVDt/SURcF3tiM1pqzqqVqZNB3GgJZScd24MjhPgtzKfonYjbSiHireS9u7ctv3TaZBUdA/G4Qw0CmJXtHHhbkj9D0rUnO6A69ejA0a2UV2D6FfP54ENuJQcrCazWbcdsIF0dXdqNFd3vUBaDaKwIBVR4J2pHo6SDKXlM46m7rgGy/GNaVNOc27DsmLFUEQNnSqGE+ddkiSciqF3Va6S4K36og5hXdtuFI+bIpW3v7r9/e9aJLq0VvNp2ckOWv1JPaeJspAvek4k/yuI973K81K6NH+TOuFya1fJFohTYDiAc6g3JgKXKOIQjrOAapY9veDj3vkO26jahPQGuAnLr8pYoFU1FI8sM5VEARjj7g4RTdudb5XZW+32XkH5tqbJ0qxIN0tXnp33Dg39GPOyTNeQu7/vqMVO47wVkONFznHrdI6pT8/VzCmB3OHsx1814aL+uTbhCVVldBnmOB39rFaQE7neEPa7PoBLKkqGzIUNAobLudgvIstzNJbkRRI5NdQeLCzGTRhUouWEDy16IUluWYxz7FFj0apQpu4GToSisQ1yR5vNLVrL5dyENYJ5qZGBkiG8+KUqxw0cN/C9XW72Tp97ONEuk2BS9a4tD2pr4ripuDkXJNWQl5mk06pLCytXojuKcWWKebamxsmI5nI+8XE/UYjaXhXwlJEFWAaa7ovZG7oYN2QqnFPQXiXjCv+QeWxR9KvlgRELSoW7UxtDh98sSmYmT+G6gVvI+TyzFdeeFGOcDonqpBmxKDogHAcm5ZacLTh+f84DAJ1qprbAPQCXUJTEGlcP9VARp0REazFYY64s7jRBt1PmhLrUnzZzCauM0yzut5q9eg53L86UataD1CtcCqwpNbAHq1fMFFhTa2UPXr+jq1ZQs5a0wnWInjbpXUJl3Zh1Q/1Ym97ASrl9p90QPgwafGrt7qkawbxYvh25qP/Gr4aakmbDQ6DE4lzpJGtjftN7Re8RQzn7De1K6QVcUsuX3K6j+5Jas6B6FkkeqsobzCar99aR0ipXcVIixLpWZN9vJS6A3g5DPFVoGpbuMCb/SMKUMFh5mNY0CPeUQscXjduAmk3jDR9kI+c9NRqU1WYbv6qIGqRvAJs9mniiWnLL328G4Hyr3zSQPcR5UZXniTZFvg+kDOSEYY1kg5Nbg2I2jOZUhYqn19LHik91vaOTpkDKZ5y2cA0rKApMdcahay6tIw25WtZR87gpfpoKq0GKcqvMShBgq82npwj/X6r8OW5afGNZByEcEO+jsoFGyLvK0Sz2dSrJ/bbmV5NTId3avd7wGAHDAsPhsQq9H5LgC4Qzv3TtkpRqAfuV0TQa5P2e6m92fNpM0CBVkhG9frjK7gI9VW54LNhHZIm7gzp1tviowR2WN0ZmKnX+GBvF4zLJXdCnyigPnYHDUD5NjpkW80myzhjEVPlnRKOfIg+NDekhGWnEy5w4M40h74+bu/i+r1w1MpoDFT159jqo5UfnsVHT/Bvz2ZOkCU+c4UZVfzjX7cX8JDlvn0odm/3ujuJ7z4Kbbq399qyL8WHbeL7c/fFvcNT7n/O18M/52v/087Wb0zJUaYZsVnY2Ij/Gzm8qovDJUz3c5lur39J2D8wM7Vvds6vzo6cWjho0+a0BUn8SrfNCfBdsr0tqg+vbdnrAxtMG5vY+w/qvOcFxxouLNz+fj1+Pz8dvfjzrRbmzcJkap2Mwhq/eu9WbQcO8DeM/BPyO4aQGHzseuQ3zqrhkTKMxZ1EN9RvX33dP5w1D3AOv/f2urg1dtb/D6NgGkavBUz8N1mKiiZx3JRqg9tzcg/XGveLiwtXvZu/po5ZYn9ez//qHNz89j6LV3CxSWf4NN4vKno+1cro5aderidO1janpAWrogbVYwIvXr96+3NXICJprMsXuln5IYxw7qPznScbwRfq5/k1JHMG9LE1JxAhum8OwI/iViPrfr6jXm9/9Q8JlOKYfzqJ3T0pA62N8xFqU+IgxPTcNt90Tm11chird73x2vyBwnHQ9dTfbP/88MN3OBm6tq75PM9Gb8yQe1E0p0ICaGtSuRCYuNs4I9cfYZxA+IyibV7R7eo+P/+Hd237v7kdX5jnR/abVPzw+l0rjhEzVEi/gzevzt4+ZjgBjz2jcqN+9bcuq2qYp1o3UxrvjBchLYfmkz9W0ZbLz/YauQAYekErn5iJ8Uqxf6A53r7gjR5LgWFXSW1q0m2yGbOvPRFlmyCr/t84ur/lUb+tTf00Zzo6ySfSrhcc1KK83X4uqPplq+VbetXHgmIpn1VjxFAc44reCazQpOH50pA5iRomgpUg10hbfmvAAhmYjckIhh6/RDLJN99XOimf1wc4VtxkPXZteHd9pWkyStZW+aD7nkohW4dml3SztsiVqQzTHNAdMN+RCzUY0guBysam6Q78tBqU5khFBEs8k9lXeBuvPNwLZnAWqGnpApqq0QGQN6V8BAAD///eBqM4=" + return "eJzsXF2P2zbWvs+vOJibJoBjtHmbF4u5WGCaNJsBpk13Prq9M2jy2OKaIlWSssf99Qt+SJZlWrZn6Gl20bkay9I5D8nz8RzyyG9hgetLsIVGYrm0KF4BWG4F9i9qFEgMXsIULXkFwNBQzSvLlbyEv78CALj3D4B/QvA5SorwiQucuqs/KVYLHL8CmHEUzFz6R96CJCVewsWF/whg1xVewlyruopXurd3HwnwxlwyTolVejzjAscFMcXYClO09zcyF7heKc061xNDaP7uCwQn7xsDvKyUtuBkjoDPgCwJF2TqxnIKJlOQ//vb99lQBXHgRB+LaobIxu7KXhCDTzJiiqkimk04OziMRgCZ1gZpMS6JWBG9q7m70AcG/8nbAcyUhisn9cNn+ClIbQzvOppq89e3nA0sN4kTh2BLw74VGYQF3sT9szCv0RhkMF3Dw+1NQWozbu9NoDB8LomtdRYUzVzMSMkFXw8qrrVw4CZMraRQhOXQf6Mocd/A64fbmzewKlAjrFUNlEhoFAEBqqo1qBnYghu/DoNIl1zXxipLxFijqYXNAfXqV2BokXq42qM+FkSFmqJMoZgJRewTMXAJUfCxOASXiyyrxuUCrAJbIPzaigeNLuaN97pzrcXX4so8i/W6yHr9MdglOv84yn80zlC7NJdzKWLkAJRWH3TjibHE1ibXFNBaa5QWgtRmOh5ub8bwizKGTwXCkogaDRCNl6Ck4BJHoGYz9w8QyaCWC6lWwx4V8kou1EEaUKU1mkpJxuU8GDU3EDOPH8QQpKkgdCG4sWZsaj0VOcDdPdz+cLORHKd1z1y6O5D5KZTKTsLHYxFXpAwRPRPwKA8+pvAPgQqRA3Wutb1fcWtRQ0EkE9hYZKMFbEGsI0HNFbaz6PBaaSBSyXWpavNmELwgujvnG+hTpQQSeTz068AA0bhEaAuPFLdgOdBTRNlBHsJwoYx1BlxpteQMNby2ukZQGmZEGHwz6FdkniUWXHlr9LNN5gaIMYpy4kCuuC08zN9r1BxZd0y76UKqkgg+FrxUufJFEPl15IkNz08o7DHtZ6l0so5SWhHnLTKX3iju2CEvieBsMtOqTABgxOLx2v9VoNxWCCviCKM2Fmaqlsx5BDdAlTTOTZAF9SlcpWJ8xpOenQWVIMamlGziyhRFtiQdpLmCnHTCRosoZfuJ754FweetHZMYeQ/FR1JWAl1R6r71hRE3wFRJuByF+LxStWAwRX+HF5Zatg6MPEGt8/VR9uw3QrLMmRMUb5l6dnJINVXSpguNk5X/+Gg1AYuP1rlMe+sSGyV7TSk5J5mq5vstL3JCRr5U7JrQFOGisRssCRcjX2x/JqZ4e/f56t37/79IQVTTfyO1k5LoBZdzx9Kz+d7d/fVv0NL+qClRJ8XEF5ipsRpJeZYEeNcX3U+AKdMSxBg+46FezzEzu2yHyM7icgOV5ktiA4vRqgQCVT0VnMIMI+dtN7DiN2I97mnpsebLRugoPrF9f7Sh9q7BGVFyxtmeQs4USp9Q2DsrKZGYWrcBklBaa0LX8NqP/VvnZ999++0bx6v4XIYNo+56fuMmDBmn3kuJJGJtOTVgkRZSCTVfOxHtBA8zcoaWcPEuMTIXEo4f2EcvJ8QRZ4jJKNGZ9+sy8trpGmqDGr5/N4jzhQhaSrNHOjFoDFdykgdIB0TYQI7iQ8lC3WL7aqUbBZXcMoNh0LkC8fVWED7odBekspMQlC9G4ZMPzc0HXjX/1VpcjHriLqaquYW+64ih7zZX/XNwwd9V8VpJRHtrX577rtXvPmweKdn75t8osiJ6gSzeUhXcFM2zfbHhy+6NUYShRMbrrujuDMHEB/qiTG0qTrny+63NzVZpd7OPfO6DRmknVhO6QO1VDa59ScSe1V9xwSg5bflnSpdh61bjnGi/e0Laus7vJ69HQODDrz/C9ccRhHo6hHlrCV24KyHTjZKl4nFeWLL3OczZkQMfn47XrNGoWlOc1JrngHDr6JSL3A+317tQYkA+cDSAS9TcrnPA+aC55ZQIbtfJ5YnbZz4T++Bk6qoSvB+dDkYGoVYjKJHxuhxBwefFCJao12/dv8OD9bOfY6h3XtLQ8kM3RV25zGrsYWwTNzn5EsMGn8W59kYR9AxPk+3Xqk+dJScoguDm4CwRT0OGkFldG4tsQrmmAiecZeHbmwwa5UOQH4yUl+2G37F+Xleu2s+0jA9eGFx/PLRFn0XZ7c2JMc07ZbYjzo/EklDJD5XNkIoKvBq1tX+tRVvIlez9/vOlmHym5A9CdKbCqTlh+sEL/RrPjLcRpirblzkx/ir2k42PPilQ3f6SBLi+daTWtFMdxZNp00McZAkl570vBscJ8HNdTlG7kbaSQ8UbZ3t3bbvx6TxIotyjcTgHTYLYndr05G5E/QMlak53wO23oyNGtjFdg+hPz+dBDThKDlaT2ay/HbCBdH1/bjTX93uBdDaIwoFUwoB3lno4SzKUls84mmbHNXiO35g29bTkNhwrRoUi6ehUMZy46JKFcCqGPlS5SoJ36osmhfV9uzU8bqpc0f767pc/65DoylrNp3WPHXT2J/WcZmIhX/ScSP5HmN4Pqixr6Wj+hjrhcqurZAvEOTAcoTnUGxOBSxRpCKd5QFxlLy/EuPd+h20Um5C+A27C8asyFmishtKZZaayGABj3H1DRLvtzrfK7K3t9r0T5bc1TZHnRLo9uvLqfHRo5aeU13W+DbmHh55Z7GycdxJyusg57ZzOKfX0XM2cEcgdzX78cRMuGZ8bF55QVSePYU6z0c9qBSWR641g3/UBXFJRM2QubRAwXM7F4SmyvERjSVllmadW2pMni3ETBpXpOOFjR14gyR2PcYE96SxaVco0u4EToWiqQe5kt7lDa7mcm3BGMK81MlAypBd/VOW0gdMGfm+Xm4PL527O1GUSXKrp2vKgthaOm6jNhSCphqLMJJ9VXVlYuRLdSUwbUyqytTVOQTSX84nP+5lS1PapgJeMLMAy0O6+mIOpi3FDpsIFBe1NMm3wT1nHjkR/Wh4UsWBUuLu0KXT4aFEyM3mJ0A3cQsnnhY1a91CMcT4kqkczUll0YHIcmJwtOVtwfH/OEwCda6W2wD0Bl1CUpDaunhqhEkGJiM5hsMZSWdzZBN2mzBltaT9t5hJWBadFOm61vXoO916cOc1sD1JvcDmw5rTAPVi9YebAmtsq9+D1HV2NgZq1pBHXMXba0ruMxrpx61b6qT69gZWzfae7IXwcNPjU6e6JG8G8Wn4/cln/O38aampaDA+BEotzpbOcjfmm9yjvGUO5+BntSukFXFHLl9yuk31JnVVQew5JnmrKG8ymaHrrSG2VqzgpEWLdGLLfbyUugd4NQzxXahqe3WFM/paMlDB4eVjWPAgPlEKnF43bgNqm8VYPspGLnhoNyths408VUYP0G8DmgCWeqZbcivebAbjY6psGiqcEL6rKMlNT5IcgykBJGDZINji5NShmw2jOVah4eR17jHri9Z5Nmgopn3HawTVsoCgw1zsOfXfpvNJQqmWTNU9b4pepsFqkKLfKrAwJNjafniP9f4n8Oe1afONZRyEcmN5nsYF2kneNoz3s61WSh33NnybnQrrVvd7qGAHDCsPLYxG9H5LgC4QLf3TtSEo8wH5rNE0med9T/WjH52WCBqmSjOj10012F+i5uOGpYJ/BEncHdW62+KzBHccbEyuVmz+mRvE8JrkL+lyM8tgVOA7ly3DMvJjPwjpTEHPxz4RFvwQPTQ3pKYw0EWXOzExTyPfnzV18XxdXTYzmSEPPzl4HrfxkHpt0zT+Rz56FJrwww02a/jDX3Yv5RTjvPpM6lf3ujuJrZ8Htbq19fNXH+LQ2ni/3v/0XvOr91/u18Nf7tf/r79du3pahSjNks7rXiPwcP7+NQuGTl3q8z3dOv5fhFc5JfL+mNx82/koTsRYl9rs8D/R43sTuZcPnRWgHqQ0yIKbVevB1ir0/CzHcfnoA2OblvR0v76wYN4uJ4+s7LcTP0BxeB/UtE04+6FqgATU1qJfdrLzd9fd7JnsJ9vHPxk5u+FSTrRp/f3YIb4GwSfL3h04rNW42v/sQf/zMFR6paBOap3LojBTJSxzQiI8V12hyaPzRiTpKGSWC1iLXSDt6G8EDGNqWooyTHN4rH1Sb7/e3os7401uOLPLAv/ba+A79mGQjiF80n3NJRCeF9GW3m7RsidoQzTHPqyIbceFFL6Id+5SLTf4MzDkFpW2uTCBJh/5DOdRg80NMQDZdvZGaA5mq2gKRDaT/BAAA//9TWLkK" } diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/_meta/fields.yml b/x-pack/filebeat/module/threatintel/recordedfuture/_meta/fields.yml index 7673ebf7e481..55023015e72b 100644 --- a/x-pack/filebeat/module/threatintel/recordedfuture/_meta/fields.yml +++ b/x-pack/filebeat/module/threatintel/recordedfuture/_meta/fields.yml @@ -3,72 +3,15 @@ description: > Fields for Recorded Future Threat Intel fields: - - name: entity - type: group + - name: evidence_details + type: flattened description: > - Entity that represents a threat. - fields: - - name: id - type: keyword - description: > - Entity ID. - example: "ip:192.0.2.13" - - name: name - type: keyword - description: > - Entity name. Value for the entity. - example: "192.0.2.13" - - name: type - type: keyword - description: > - Entity type. - example: "IpAddress" - - name: intelCard + List of sightings used as evidence for this indicator. + - name: name type: keyword description: > - Link to the Recorded Future Intelligence Card for to this indicator. - - name: ip_range - type: ip_range - description: > - Range of IPs for this indicator. - example: '192.0.2.0/16' - - name: risk - type: group + Indicator value. + - name: risk_string + type: keyword description: > - Risk fields. - fields: - - name: criticality - type: byte - description: > - Risk criticality (0-4). - - name: criticalityLabel - type: keyword - description: > - Risk criticality label. One of None, Unusual, Suspicious, Malicious, Very Malicious. - - name: evidenceDetails - type: flattened - description: > - Risk's evidence details. - - name: score - type: short - description: > - Risk score (0-99). - - name: riskString - type: keyword - description: > - Number of Risk Rules observed as a factor of total number of rules. - example: "1/54" - - name: riskSummary - type: keyword - ignore_above: 1024 - description: > - Risk summary. - example: "1 of 54 Risk Rules currently observed." - multi_fields: - - name: text - type: text - norms: false - - name: rules - type: long - description: > - Number of rules observed. + Details of risk rules observed. diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/config/config.yml b/x-pack/filebeat/module/threatintel/recordedfuture/config/config.yml index 2c610e5379dd..f11179414aa4 100644 --- a/x-pack/filebeat/module/threatintel/recordedfuture/config/config.yml +++ b/x-pack/filebeat/module/threatintel/recordedfuture/config/config.yml @@ -10,22 +10,18 @@ request.ssl: {{ .ssl | tojson }} {{ if .proxy_url }} request.proxy_url: {{ .proxy_url }} {{ end }} -request.url: "{{ .url }}&orderby=lastseen&direction=asc" +{{ if .custom_url }} +request.url: "{{ .custom_url }}" +{{ else }} +request.url: "{{ .endpoint }}/{{ .entity }}/risklist?format=csv/splunk&gzip=false&list={{ .list }}" +{{ end }} request.transforms: {{ if .api_token }} - set: target: header.X-RFToken value: {{ .api_token }} -- set: - target: url.params.lastSeen - value: '[[ .cursor.timestamp ]]' - default: '([[ formatDate (now (parseDuration "-{{ .first_interval }}")) "2006-01-02T15:04:05.000Z" ]],]' - {{ end }} -response.split: - target: body.data.results -cursor: - timestamp: - value: '([[ .first_event.timestamps.lastSeen ]],]' +{{ end }} +response.decode_as: text/csv {{ else if eq .input "file" }} diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/ingest/decode_csv.yml b/x-pack/filebeat/module/threatintel/recordedfuture/ingest/decode_csv.yml new file mode 100644 index 000000000000..718172f4f3cd --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/ingest/decode_csv.yml @@ -0,0 +1,42 @@ +description: Pipeline to decode CSV risklists from Recorded Future threat intel. +processors: + - csv: + field: event.original + target_fields: + - _tmp_.col0 + - _tmp_.col1 + - _tmp_.col2 + - _tmp_.col3 + - _tmp_.col4 + - drop: + description: 'Drops the CSV header line.' + if: 'ctx._tmp_.col0 == "Name"' + +# This supports the default CSV risklists: +# 4-column for url, domain and IPs. +# 5-column for hash. + - script: + description: Maps the CSV entries to fields. + lang: painless + params: + default: + col0: Name + col1: Risk + col2: RiskString + col3: EvidenceDetails + hash: + col0: Name + col1: Algorithm + col2: Risk + col3: RiskString + col4: EvidenceDetails + source: > + def cols = params[ ctx._tmp_.col4 == null? "default" : "hash" ]; + def src = ctx._tmp_; + def dst = new HashMap(); + for (entry in cols.entrySet()) { + dst[entry.getValue()] = src[entry.getKey()]; + } + ctx['json'] = dst; + - remove: + field: _tmp_ diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/ingest/pipeline.yml b/x-pack/filebeat/module/threatintel/recordedfuture/ingest/pipeline.yml index 6247c0cd8829..f6d2bbd39a48 100644 --- a/x-pack/filebeat/module/threatintel/recordedfuture/ingest/pipeline.yml +++ b/x-pack/filebeat/module/threatintel/recordedfuture/ingest/pipeline.yml @@ -1,11 +1,11 @@ description: Pipeline for parsing Recorded Future threat intel. processors: - # - # Set basic ECS fields. - # +# +# Set basic ECS fields. +# - set: field: event.ingested - value: "{{_ingest.timestamp}}" + value: "{{{ _ingest.timestamp }}}" - set: field: ecs.version value: "1.12" @@ -18,15 +18,6 @@ processors: - set: field: event.type value: indicator - - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - set: field: threat.feed.name value: "[Filebeat] RecordedFuture" @@ -34,238 +25,185 @@ processors: field: threat.feed.dashboard_id value: "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f" - # - # Map itype field to STIX 2.0 Cyber Observable values (threat.indicator.type). - # - - script: - lang: painless - if: "ctx.json.entity?.type != null" - description: > - Map entity.type field to STIX 2.0 Cyber Observable values (threat.indicator.type). - params: - IpAddress: ipv4-addr - InternetDomainName: domain-name - Hash: file - URL: url - source: > - String mapping = params[ctx.json.entity.type]; - if (mapping != null) { - ctx["threat_indicator_type"] = mapping; - } - on_failure: - - append: - field: error.message - value: 'Unable to determine indicator type from "{{{ json.entity.type }}}": {{{ _ingest.on_failure_message }}}' - - rename: - field: threat_indicator_type - target_field: threat.indicator.type + field: message + target_field: event.original ignore_missing: true - # - # Detect ipv6 for ipv4-addr types. - # - - set: - field: threat.indicator.type - value: ipv6-addr - if: 'ctx.threat?.indicator?.type == "ipv4-addr" && ctx.json.entity.name != null && ctx.json.entity.name.contains(":")' - - # - # Map first and last seen dates. - # - - date: - field: json.timestamps.firstSeen - target_field: threat.indicator.first_seen - formats: - - ISO8601 - if: "ctx.json.timestamps?.firstSeen != null" - on_failure: - - append: - field: error.message - value: 'Error parsing firstSeen field value "{{{ json.timestamps.firstSeen }}}": {{{ _ingest.on_failure_message }}}' - - date: - field: json.timestamps.lastSeen - target_field: threat.indicator.last_seen - formats: - - ISO8601 - if: "ctx.json.timestamps?.lastSeen != null" +# +# Decode event.original as JSON if it starts with the "{" character. +# This is the common case when events are ingested from the API, as httpjson +# transforms the CSV to a JSON message. +# + - json: + field: event.original + target_field: json + if: 'ctx.event?.original != null && ctx.event.original.startsWith("{")' on_failure: - - append: - field: error.message - value: 'Error parsing lastSeen field value "{{{ json.timestamps.lastSeen }}}": {{{ _ingest.on_failure_message }}}' + - fail: + message: "Failed decoding message field as JSON: {{{ _ingest.on_failure_message }}}" - # - # Map location fields. - # - - rename: - field: json.location.location.city - target_field: threat.indicator.geo.city_name - ignore_missing: true - - rename: - field: json.location.location.continent - target_field: threat.indicator.geo.continent_name - ignore_missing: true - - rename: - field: json.location.location.country - target_field: threat.indicator.geo.country_name - ignore_missing: true - - grok: - field: json.location.asn - patterns: - - "^(?:[Aa][Ss])?%{NUMBER:threat.indicator.as.number:long}$" - ignore_missing: true +# +# Decode event.original as CSV when the above processor didn't execute. +# This is used when ingesting CSV lines from a file. +# + - pipeline: + name: '{< IngestPipeline "decode_csv" >}' + if: 'ctx.json == null' on_failure: - - append: - field: error.message - value: "Cannot parse asn field `{{{ json.location.asn }}}`: {{{ _ingest.on_failure_message }}}" - - rename: - field: json.location.organization - target_field: threat.indicator.as.organization.name - ignore_missing: true - - set: - field: threat.indicator.reference - value: "{{{ json.intelCard }}}" - ignore_empty_value: true - - set: - field: json.ip_range - value: "{{{json.entity.name}}}" - if: 'ctx.json.entity?.type == "IpAddress" && ctx.json.entity.name != null && ctx.json.entity.name.contains("/")' - - set: - field: json.ip_range - value: "{{{ json.entity.name }}}/32" - if: 'ctx.threat?.indicator?.type == "ipv4-addr" && ctx.json.entity.name != null && !ctx.json.entity.name.contains("/")' - - set: - field: json.ip_range - value: "{{{ json.entity.name }}}/128" - if: 'ctx.threat?.indicator?.type == "ipv6-addr" && ctx.json.entity.name != null && !ctx.json.entity.name.contains("/")' - - set: - field: json.ip_range - value: "{{{json.entity.name}}}" - if: 'ctx.json.entity?.type == "IpAddress" && ctx.json.entity.name != null && ctx.json.entity.name.contains("/")' - - rename: - field: json.entity.name - target_field: threat.indicator.ip - if: 'ctx.json.entity?.type == "IpAddress" && ctx.json.entity.name != null && !ctx.json.entity.name.contains("/")' + - fail: + message: "Failed decoding message field as CSV: {{{ _ingest.on_failure_message }}}" + +# +# Decode EvidenceDetails column as JSON. +# + - json: + field: json.EvidenceDetails + target_field: _temp_.EvidenceDetails + ignore_failure: true + - rename: - field: json.entity.name - target_field: threat.indicator.url.domain + field: _temp_.EvidenceDetails.EvidenceDetails + target_field: json.evidence_details ignore_missing: true - if: 'ctx.threat?.indicator?.type == "domain-name" && ctx.threat?.indicator?.url?.domain == null' - - uri_parts: - field: json.entity.name - target_field: threat.indicator.url - keep_original: true - remove_if_successful: true - if: 'ctx.threat?.indicator?.type == "url"' - on_failure: - - append: - field: error.message - value: "Cannot parse url field `{{{ json.entity.name }}}`: {{{ _ingest.on_failure_message }}}" - # At this point fileHashes may exist if "fileHashes" field is requested. - - append: - field: json.fileHashes - value: "{{{ json.entity.name }}}" - allow_duplicates: false - if: 'ctx.threat?.indicator?.type == "file"' - - remove: - field: json.entity.name - if: 'ctx.threat?.indicator?.type == "file"' +# +# Hash indicators (threat.indicator.type=file) +# As risklist indicators don't have a "type" field, it's necessary +# to detect the kind of indicator in the Name field. +# +# An indicator is of type `hash` when the Algorithm field is present. +# + - set: + field: threat.indicator.type + value: file + if: 'ctx.json.Algorithm != null' - script: lang: painless description: > Map file hashes. - if: "ctx.json.fileHashes != null" + if: "ctx.json.Algorithm != null" params: - "4": crc32 - "32": md5 - "40": sha1 - "64": sha256 - "128": sha512 - source: > - def hashes = new HashMap(); - for (def hash : ctx.json.fileHashes) { - def algo = params[String.valueOf(hash.length())]; - if (algo != null) { - hashes[algo] = hash; - } + MD5: md5 + SHA-1: sha1 + SHA-256: sha256 + SHA-384: sha384 + SHA-512: sha512 + source: >- + def key = params[ctx.json.Algorithm]; + if (key == null) { + throw new Exception("Unsupported hash algorithm '" + ctx.json.Algorithm + "'"); } + def hashes = [key:ctx.json.Name]; ctx["_hashes"] = hashes; on_failure: - append: field: error.message - value: "Failed to map fileHashes field: {{ _ingest.on_failure_message }}" + value: "Failed to map fileHashes field: {{{ _ingest.on_failure_message }}}" - rename: field: _hashes target_field: threat.indicator.file.hash ignore_missing: true - # - # Map risk.score to event.risk_score. - # +# +# IP indicators (threat.indicator.type=ipvN-addr) +# +# An indicator is of type `ip` if Name is a valid IP address. +# - convert: - field: json.risk.score + field: json.Name + target_field: threat.indicator.ip + type: ip + ignore_failure: true + if: 'ctx.threat?.indicator?.type == null' + - set: + field: threat.indicator.type + value: ipv4-addr + if: 'ctx.threat?.indicator?.ip != null && !ctx.threat.indicator.ip.contains(":")' + - set: + field: threat.indicator.type + value: ipv6-addr + if: 'ctx.threat?.indicator?.ip != null && ctx.threat.indicator.ip.contains(":")' + +# +# URL indicators (threat.indicator.type=url) +# An indicator is of type `url` if Name contains a slash character. +# + - set: + field: threat.indicator.type + value: url + if: 'ctx.threat?.indicator?.type == null && ctx.json.Name.contains("/")' + - uri_parts: + field: json.Name + target_field: threat.indicator.url + keep_original: true + if: 'ctx.threat?.indicator?.type == "url"' +# +# Domain indicators (threat.indicator.type=domain) +# This is a catch-all type. +# + - set: + field: threat.indicator.type + value: domain-name + if: 'ctx.threat?.indicator?.type == null' + - set: + field: threat.indicator.url.domain + value: '{{{ json.Name }}}' + ignore_empty_value: true + if: 'ctx.threat?.indicator?.type == "domain-name" && ctx.threat?.indicator?.url?.domain == null' + +# +# Normalize Risk +# + - convert: + field: json.Risk target_field: event.risk_score ignore_missing: true type: float on_failure: - append: field: error.message - value: "Risk score `{{{ json.risk.score }}}` cannot be converted to float: {{ _ingest.on_failure_message }}" - # - # Remove fields converted to an ECS field. - # - - remove: - field: - - json.timestamps - - json.location - - json.fileHashes - - message + value: "Risk score `{{{ json.Risk }}}` cannot be converted to float: {{{ _ingest.on_failure_message }}}" + +# +# Fingerprint event: _id = hash(dataset + indicator type + indicator value) +# + - fingerprint: + fields: + - event.dataset + - threat.indicator.type + - json.Name + target_field: "_id" + ignore_missing: true + +# +# Save fields without an ECS mapping under `recordedfuture`. +# + - rename: + field: json.RiskString + target_field: json.risk_string ignore_missing: true - # - # Save fields without an ECS mapping under `recordedfuture`. - # - rename: field: json target_field: recordedfuture - ###################### - # Cleanup processors # - ###################### +# +# Cleanup +# - remove: field: event.original if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true - - set: - field: threat.indicator.type - value: unknown - if: ctx.threat?.indicator?.type == null - - script: - lang: painless - if: ctx.recordedfuture != null - source: | - void handleMap(Map map) { - for (def x : map.values()) { - if (x instanceof Map) { - handleMap(x); - } else if (x instanceof List) { - handleList(x); - } - } - map.values().removeIf(v -> v == null); - } - void handleList(List list) { - for (def x : list) { - if (x instanceof Map) { - handleMap(x); - } else if (x instanceof List) { - handleList(x); - } - } - } - handleMap(ctx); + - remove: + field: + - recordedfuture.Algorithm + - recordedfuture.EvidenceDetails + - recordedfuture.Name + - recordedfuture.Risk + - _temp_ + ignore_missing: true on_failure: - append: field: error.message - value: "{{ _ingest.on_failure_message }}" + value: "{{{ _ingest.on_failure_message }}}" diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/manifest.yml b/x-pack/filebeat/module/threatintel/recordedfuture/manifest.yml index da8a88e19dab..a5544178969f 100644 --- a/x-pack/filebeat/module/threatintel/recordedfuture/manifest.yml +++ b/x-pack/filebeat/module/threatintel/recordedfuture/manifest.yml @@ -3,12 +3,13 @@ module_version: 1.0 var: - name: input default: httpjson - - name: first_interval - default: 168h - name: interval default: 1m - - name: url - default: "https://api.recordedfuture.com/v2/ip/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + - name: endpoint + default: "https://api.recordedfuture.com/v2" + - name: entity + - name: list + - name: custom_url - name: ssl - name: tags default: [threatintel-recordedfuture, forwarded] @@ -18,4 +19,5 @@ var: default: false ingest_pipeline: - ingest/pipeline.yml + - ingest/decode_csv.yml input: config/config.yml diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/domain.ndjson.log b/x-pack/filebeat/module/threatintel/recordedfuture/test/domain.ndjson.log deleted file mode 100644 index 54f047c3ab6a..000000000000 --- a/x-pack/filebeat/module/threatintel/recordedfuture/test/domain.ndjson.log +++ /dev/null @@ -1,10 +0,0 @@ -{"entity": {"id": "idn:16url-gy.example.net", "name": "16url-gy.example.net", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A16url-gy.example.net", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2016-07-25T20:29:32.750Z", "lastSeen": "2021-06-20T18:23:47.901Z"}} -{"entity": {"id": "idn:b999f.example.org", "name": "b999f.example.org", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Ab999f.example.org", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2012-11-21T01:54:04.292Z", "lastSeen": "2021-06-20T18:23:47.812Z"}} -{"entity": {"id": "idn:c422.example.net", "name": "c422.example.net", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Ac422.example.net", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2018-02-21T13:53:46.470Z", "lastSeen": "2021-06-20T18:23:47.778Z"}} -{"entity": {"id": "idn:8rwcvgjsp.example.net", "name": "8rwcvgjsp.example.net", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A8rwcvgjsp.example.net", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2016-08-15T11:56:24.964Z", "lastSeen": "2021-06-20T18:23:47.747Z"}} -{"entity": {"id": "idn:c9px.example.net", "name": "c9px.example.net", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Ac9px.example.net", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2016-06-29T21:06:06.066Z", "lastSeen": "2021-06-20T18:23:47.460Z"}} -{"entity": {"id": "idn:ttj1i9z7.example.com", "name": "ttj1i9z7.example.com", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Attj1i9z7.example.com", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2018-09-20T03:26:08.564Z", "lastSeen": "2021-06-20T18:23:47.373Z"}} -{"entity": {"id": "idn:7pgc.example.org", "name": "7pgc.example.org", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A7pgc.example.org", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2017-02-23T17:44:16.104Z", "lastSeen": "2021-06-20T18:23:47.373Z"}} -{"entity": {"id": "idn:xm5u434.example.net", "name": "xm5u434.example.net", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Axm5u434.example.net", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2017-04-10T06:55:27.658Z", "lastSeen": "2021-06-20T18:23:47.373Z"}} -{"entity": {"id": "idn:gpgju.example.com", "name": "gpgju.example.com", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Agpgju.example.com", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2018-07-27T15:22:39.390Z", "lastSeen": "2021-06-20T18:23:47.373Z"}} -{"entity": {"id": "idn:55g.example.com", "name": "55g.example.com", "type": "InternetDomainName"}, "intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A55g.example.com", "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/44", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2021-01-10T21:24:38.353Z", "lastSeen": "2021-06-20T18:23:45.025Z"}} diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/domain.ndjson.log-expected.json b/x-pack/filebeat/module/threatintel/recordedfuture/test/domain.ndjson.log-expected.json deleted file mode 100644 index 7da98ffcc296..000000000000 --- a/x-pack/filebeat/module/threatintel/recordedfuture/test/domain.ndjson.log-expected.json +++ /dev/null @@ -1,332 +0,0 @@ -[ - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 0, - "recordedfuture.entity.id": "idn:16url-gy.example.net", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A16url-gy.example.net", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2016-07-25T20:29:32.750Z", - "threat.indicator.last_seen": "2021-06-20T18:23:47.901Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A16url-gy.example.net", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "16url-gy.example.net" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 482, - "recordedfuture.entity.id": "idn:b999f.example.org", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Ab999f.example.org", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2012-11-21T01:54:04.292Z", - "threat.indicator.last_seen": "2021-06-20T18:23:47.812Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Ab999f.example.org", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "b999f.example.org" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 955, - "recordedfuture.entity.id": "idn:c422.example.net", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Ac422.example.net", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2018-02-21T13:53:46.470Z", - "threat.indicator.last_seen": "2021-06-20T18:23:47.778Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Ac422.example.net", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "c422.example.net" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 1425, - "recordedfuture.entity.id": "idn:8rwcvgjsp.example.net", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A8rwcvgjsp.example.net", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2016-08-15T11:56:24.964Z", - "threat.indicator.last_seen": "2021-06-20T18:23:47.747Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A8rwcvgjsp.example.net", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "8rwcvgjsp.example.net" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 1910, - "recordedfuture.entity.id": "idn:c9px.example.net", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Ac9px.example.net", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2016-06-29T21:06:06.066Z", - "threat.indicator.last_seen": "2021-06-20T18:23:47.460Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Ac9px.example.net", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "c9px.example.net" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 2380, - "recordedfuture.entity.id": "idn:ttj1i9z7.example.com", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Attj1i9z7.example.com", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2018-09-20T03:26:08.564Z", - "threat.indicator.last_seen": "2021-06-20T18:23:47.373Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Attj1i9z7.example.com", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "ttj1i9z7.example.com" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 2862, - "recordedfuture.entity.id": "idn:7pgc.example.org", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A7pgc.example.org", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2017-02-23T17:44:16.104Z", - "threat.indicator.last_seen": "2021-06-20T18:23:47.373Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A7pgc.example.org", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "7pgc.example.org" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 3332, - "recordedfuture.entity.id": "idn:xm5u434.example.net", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Axm5u434.example.net", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2017-04-10T06:55:27.658Z", - "threat.indicator.last_seen": "2021-06-20T18:23:47.373Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Axm5u434.example.net", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "xm5u434.example.net" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 3811, - "recordedfuture.entity.id": "idn:gpgju.example.com", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Agpgju.example.com", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2018-07-27T15:22:39.390Z", - "threat.indicator.last_seen": "2021-06-20T18:23:47.373Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3Agpgju.example.com", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "gpgju.example.com" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 4284, - "recordedfuture.entity.id": "idn:55g.example.com", - "recordedfuture.entity.type": "InternetDomainName", - "recordedfuture.intelCard": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A55g.example.com", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/44", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-01-10T21:24:38.353Z", - "threat.indicator.last_seen": "2021-06-20T18:23:45.025Z", - "threat.indicator.reference": "https://app.recordedfuture.com.local/live/sc/entity/idn%3A55g.example.com", - "threat.indicator.type": "domain-name", - "threat.indicator.url.domain": "55g.example.com" - } -] \ No newline at end of file diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/hash.ndjson.log b/x-pack/filebeat/module/threatintel/recordedfuture/test/hash.ndjson.log deleted file mode 100644 index 284429cc3e32..000000000000 --- a/x-pack/filebeat/module/threatintel/recordedfuture/test/hash.ndjson.log +++ /dev/null @@ -1,10 +0,0 @@ -{"entity": {"id": "hash:dec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", "name": "dec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", "type": "Hash"}, "fileHashes": ["25328d1a481903f2d900479570842247", "d73c663e2ac0c7a14ca0e2681dd599b2e7a24f65", "dec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Adec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 2, "criticalityLabel": "Suspicious", "evidenceString": "6 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://23l04ha7h.network.local/scan/results/file/dec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", "mitigationString": "", "rule": "Linked to Malware", "timestamp": "2021-06-20T18:40:18.503Z"}, {"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://frj972mua.network.local/scan/results/file/dec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:26.000Z"}], "riskString": "2/14", "riskSummary": "2 of 14 Risk Rules currently observed.", "rules": 2, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:18.503Z", "lastSeen": "2021-06-20T18:40:18.503Z"}} -{"entity": {"id": "hash:4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", "name": "4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", "type": "Hash"}, "fileHashes": ["7b8d9afd032f0c253b7dd68aca6fb50b", "f9ece49c249aabab29fd9c2193d897b7d131ed17", "4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 2, "criticalityLabel": "Suspicious", "evidenceString": "8 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://poapoq2z.network.local/scan/results/file/4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", "mitigationString": "", "rule": "Linked to Malware", "timestamp": "2021-06-20T18:40:18.452Z"}, {"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://mezsa92p.network.local/scan/results/file/4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:27.000Z"}], "riskString": "2/14", "riskSummary": "2 of 14 Risk Rules currently observed.", "rules": 2, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:18.452Z", "lastSeen": "2021-06-20T18:40:18.452Z"}} -{"entity": {"id": "hash:299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", "name": "299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", "type": "Hash"}, "fileHashes": ["7b65b50ed4554c86cb777e35e7750209", "e10942ba3fbb937c90c7cb3e39c06a13324981a8", "299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 2, "criticalityLabel": "Suspicious", "evidenceString": "9 sightings on 1 source: PolySwarm. 1 related malware: Trojan. Most recent link (Jun 20, 2021): https://kyvhpghg.network.local/scan/results/file/299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", "mitigationString": "", "rule": "Linked to Malware", "timestamp": "2021-06-20T18:40:18.343Z"}, {"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://fdxeziea.network.local/scan/results/file/299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:25.000Z"}], "riskString": "2/14", "riskSummary": "2 of 14 Risk Rules currently observed.", "rules": 2, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:18.343Z", "lastSeen": "2021-06-20T18:40:18.343Z"}} -{"entity": {"id": "hash:e5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", "name": "e5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", "type": "Hash"}, "fileHashes": ["c6353df35499ca6934da2169b7bd1635", "3e208c649da0a9efbde7bbde6eece2142fdac3f9", "e5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Ae5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 2, "criticalityLabel": "Suspicious", "evidenceString": "3 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://k40z19-by.network.local/scan/results/file/e5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", "mitigationString": "", "rule": "Linked to Malware", "timestamp": "2021-06-20T18:40:18.257Z"}, {"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://4e-6k-.network.local/scan/results/file/e5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:29.000Z"}], "riskString": "2/14", "riskSummary": "2 of 14 Risk Rules currently observed.", "rules": 2, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:18.258Z", "lastSeen": "2021-06-20T18:40:18.258Z"}} -{"entity": {"id": "hash:184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1", "name": "184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1", "type": "Hash"}, "fileHashes": ["3d568bd03766a8d47c8fabb7d392c32e", "3ea8b08bc9ed3009a4d6a0ab5851b8e3fc10ead2", "184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://ksmt6j.network.local/scan/results/file/184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:24.000Z"}], "riskString": "1/14", "riskSummary": "1 of 14 Risk Rules currently observed.", "rules": 1, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:18.131Z", "lastSeen": "2021-06-20T18:40:18.131Z"}} -{"entity": {"id": "hash:1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", "name": "1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", "type": "Hash"}, "fileHashes": ["a40e91f2d29616076114eea0f2a693af", "e38ccd47629c1b75385a83fbfbba0ea7f3b3a705", "1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 2, "criticalityLabel": "Suspicious", "evidenceString": "8 sightings on 1 source: PolySwarm. 1 related malware: Trojan. Most recent link (Jun 20, 2021): https://m-1z.network.local/scan/results/file/1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", "mitigationString": "", "rule": "Linked to Malware", "timestamp": "2021-06-20T18:40:18.093Z"}, {"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://llt6m.network.local/scan/results/file/1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:29.000Z"}], "riskString": "2/14", "riskSummary": "2 of 14 Risk Rules currently observed.", "rules": 2, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:18.093Z", "lastSeen": "2021-06-20T18:40:18.093Z"}} -{"entity": {"id": "hash:bf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", "name": "bf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", "type": "Hash"}, "fileHashes": ["02062782c7eeaff185ea6966460f7c9a", "64355796dc38992ca5e434682ddbf63bdfabeb4e", "bf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Abf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 2, "criticalityLabel": "Suspicious", "evidenceString": "4 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://46h0mn.network.local/scan/results/file/bf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", "mitigationString": "", "rule": "Linked to Malware", "timestamp": "2021-06-20T18:40:18.070Z"}, {"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://j94d.network.local/scan/results/file/bf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:28.000Z"}], "riskString": "2/14", "riskSummary": "2 of 14 Risk Rules currently observed.", "rules": 2, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:18.070Z", "lastSeen": "2021-06-20T18:40:18.070Z"}} -{"entity": {"id": "hash:c06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", "name": "c06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", "type": "Hash"}, "fileHashes": ["bdd205ffc81c54e7cc1a9080cfa093e4", "a6b928fd6fee43495b96941ef80b25d074f6e0e2", "c06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Ac06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 2, "criticalityLabel": "Suspicious", "evidenceString": "3 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://5twber.network.local/scan/results/file/c06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", "mitigationString": "", "rule": "Linked to Malware", "timestamp": "2021-06-20T18:40:18.010Z"}, {"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://b5qxg4.network.local/scan/results/file/c06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:28.000Z"}], "riskString": "2/14", "riskSummary": "2 of 14 Risk Rules currently observed.", "rules": 2, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:18.011Z", "lastSeen": "2021-06-20T18:40:18.011Z"}} -{"entity": {"id": "hash:c878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", "name": "c878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", "type": "Hash"}, "fileHashes": ["af45390e39574cdb037d684074e6a542", "f6a14c7424604cd51ba6a6d3f7594ec762f48645", "c878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Ac878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 2, "criticalityLabel": "Suspicious", "evidenceString": "6 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://wor2ca.network.local/scan/results/file/c878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", "mitigationString": "", "rule": "Linked to Malware", "timestamp": "2021-06-20T18:40:17.964Z"}, {"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://l4tlgg.network.local/scan/results/file/c878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:31.000Z"}], "riskString": "2/14", "riskSummary": "2 of 14 Risk Rules currently observed.", "rules": 2, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:17.964Z", "lastSeen": "2021-06-20T18:40:17.964Z"}} -{"entity": {"id": "hash:0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", "name": "0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", "type": "Hash"}, "fileHashes": ["5b8bcd367f802cd104210bb47abb3ab1", "b40d1796bd6974860ce6be691152ad963300c711", "0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c"], "intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", "risk": {"criticality": 3, "criticalityLabel": "Malicious", "evidenceDetails": [{"criticality": 2, "criticalityLabel": "Suspicious", "evidenceString": "6 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://79073cr.network.local/scan/results/file/0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", "mitigationString": "", "rule": "Linked to Malware", "timestamp": "2021-06-20T18:40:17.919Z"}, {"criticality": 3, "criticalityLabel": "Malicious", "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://c2ilj.network.local/scan/results/file/0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", "mitigationString": "", "rule": "Positive Malware Verdict", "timestamp": "2021-06-19T17:39:26.000Z"}], "riskString": "2/14", "riskSummary": "2 of 14 Risk Rules currently observed.", "rules": 2, "score": 65}, "timestamps": {"firstSeen": "2021-06-20T18:40:17.919Z", "lastSeen": "2021-06-20T18:40:17.919Z"}} diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/hash.ndjson.log-expected.json b/x-pack/filebeat/module/threatintel/recordedfuture/test/hash.ndjson.log-expected.json deleted file mode 100644 index cf8b9c1b23e2..000000000000 --- a/x-pack/filebeat/module/threatintel/recordedfuture/test/hash.ndjson.log-expected.json +++ /dev/null @@ -1,514 +0,0 @@ -[ - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 0, - "recordedfuture.entity.id": "hash:dec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Adec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://frj972mua.network.local/scan/results/file/dec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:26.000Z" - }, - { - "criticality": 2, - "criticalityLabel": "Suspicious", - "evidenceString": "6 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://23l04ha7h.network.local/scan/results/file/dec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", - "mitigationString": "", - "rule": "Linked to Malware", - "timestamp": "2021-06-20T18:40:18.503Z" - } - ], - "recordedfuture.risk.riskString": "2/14", - "recordedfuture.risk.riskSummary": "2 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 2, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "25328d1a481903f2d900479570842247", - "threat.indicator.file.hash.sha1": "d73c663e2ac0c7a14ca0e2681dd599b2e7a24f65", - "threat.indicator.file.hash.sha256": "dec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", - "threat.indicator.first_seen": "2021-06-20T18:40:18.503Z", - "threat.indicator.last_seen": "2021-06-20T18:40:18.503Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3Adec3a20fa1493c8e669b26d3f8b6084b34fda9906c978f9f12fb43f76504b5d6", - "threat.indicator.type": "file" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 1478, - "recordedfuture.entity.id": "hash:4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://mezsa92p.network.local/scan/results/file/4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:27.000Z" - }, - { - "criticality": 2, - "criticalityLabel": "Suspicious", - "evidenceString": "8 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://poapoq2z.network.local/scan/results/file/4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", - "mitigationString": "", - "rule": "Linked to Malware", - "timestamp": "2021-06-20T18:40:18.452Z" - } - ], - "recordedfuture.risk.riskString": "2/14", - "recordedfuture.risk.riskSummary": "2 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 2, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "7b8d9afd032f0c253b7dd68aca6fb50b", - "threat.indicator.file.hash.sha1": "f9ece49c249aabab29fd9c2193d897b7d131ed17", - "threat.indicator.file.hash.sha256": "4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", - "threat.indicator.first_seen": "2021-06-20T18:40:18.452Z", - "threat.indicator.last_seen": "2021-06-20T18:40:18.452Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3A4014355fdfee5fe9e01f3a84356d743c022cd75510f6c96ffe16fb332855d6f2", - "threat.indicator.type": "file" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 2954, - "recordedfuture.entity.id": "hash:299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://fdxeziea.network.local/scan/results/file/299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:25.000Z" - }, - { - "criticality": 2, - "criticalityLabel": "Suspicious", - "evidenceString": "9 sightings on 1 source: PolySwarm. 1 related malware: Trojan. Most recent link (Jun 20, 2021): https://kyvhpghg.network.local/scan/results/file/299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", - "mitigationString": "", - "rule": "Linked to Malware", - "timestamp": "2021-06-20T18:40:18.343Z" - } - ], - "recordedfuture.risk.riskString": "2/14", - "recordedfuture.risk.riskSummary": "2 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 2, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "7b65b50ed4554c86cb777e35e7750209", - "threat.indicator.file.hash.sha1": "e10942ba3fbb937c90c7cb3e39c06a13324981a8", - "threat.indicator.file.hash.sha256": "299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", - "threat.indicator.first_seen": "2021-06-20T18:40:18.343Z", - "threat.indicator.last_seen": "2021-06-20T18:40:18.343Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3A299e7a30217e2137854308e7be79227635f409b0e00897cfff11806ad8449cc5", - "threat.indicator.type": "file" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 4457, - "recordedfuture.entity.id": "hash:e5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Ae5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://4e-6k-.network.local/scan/results/file/e5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:29.000Z" - }, - { - "criticality": 2, - "criticalityLabel": "Suspicious", - "evidenceString": "3 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://k40z19-by.network.local/scan/results/file/e5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", - "mitigationString": "", - "rule": "Linked to Malware", - "timestamp": "2021-06-20T18:40:18.257Z" - } - ], - "recordedfuture.risk.riskString": "2/14", - "recordedfuture.risk.riskSummary": "2 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 2, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "c6353df35499ca6934da2169b7bd1635", - "threat.indicator.file.hash.sha1": "3e208c649da0a9efbde7bbde6eece2142fdac3f9", - "threat.indicator.file.hash.sha256": "e5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", - "threat.indicator.first_seen": "2021-06-20T18:40:18.258Z", - "threat.indicator.last_seen": "2021-06-20T18:40:18.258Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3Ae5c73c63ba71659fbb9e0670cc203532aa61e3b8fa51f70ee5ce37b66784cd61", - "threat.indicator.type": "file" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 5932, - "recordedfuture.entity.id": "hash:184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://ksmt6j.network.local/scan/results/file/184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:24.000Z" - } - ], - "recordedfuture.risk.riskString": "1/14", - "recordedfuture.risk.riskSummary": "1 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "3d568bd03766a8d47c8fabb7d392c32e", - "threat.indicator.file.hash.sha1": "3ea8b08bc9ed3009a4d6a0ab5851b8e3fc10ead2", - "threat.indicator.file.hash.sha256": "184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1", - "threat.indicator.first_seen": "2021-06-20T18:40:18.131Z", - "threat.indicator.last_seen": "2021-06-20T18:40:18.131Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3A184527a5436086cff0c06197330089f7964a9b6b8fc86327e6778363b7297ef1", - "threat.indicator.type": "file" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 7054, - "recordedfuture.entity.id": "hash:1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://llt6m.network.local/scan/results/file/1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:29.000Z" - }, - { - "criticality": 2, - "criticalityLabel": "Suspicious", - "evidenceString": "8 sightings on 1 source: PolySwarm. 1 related malware: Trojan. Most recent link (Jun 20, 2021): https://m-1z.network.local/scan/results/file/1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", - "mitigationString": "", - "rule": "Linked to Malware", - "timestamp": "2021-06-20T18:40:18.093Z" - } - ], - "recordedfuture.risk.riskString": "2/14", - "recordedfuture.risk.riskSummary": "2 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 2, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "a40e91f2d29616076114eea0f2a693af", - "threat.indicator.file.hash.sha1": "e38ccd47629c1b75385a83fbfbba0ea7f3b3a705", - "threat.indicator.file.hash.sha256": "1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", - "threat.indicator.first_seen": "2021-06-20T18:40:18.093Z", - "threat.indicator.last_seen": "2021-06-20T18:40:18.093Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3A1136b8991c6f180a6c67eaff7c2a998d67dbcadc2d9cf5a3f816de03503817a8", - "threat.indicator.type": "file" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 8550, - "recordedfuture.entity.id": "hash:bf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Abf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://j94d.network.local/scan/results/file/bf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:28.000Z" - }, - { - "criticality": 2, - "criticalityLabel": "Suspicious", - "evidenceString": "4 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://46h0mn.network.local/scan/results/file/bf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", - "mitigationString": "", - "rule": "Linked to Malware", - "timestamp": "2021-06-20T18:40:18.070Z" - } - ], - "recordedfuture.risk.riskString": "2/14", - "recordedfuture.risk.riskSummary": "2 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 2, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "02062782c7eeaff185ea6966460f7c9a", - "threat.indicator.file.hash.sha1": "64355796dc38992ca5e434682ddbf63bdfabeb4e", - "threat.indicator.file.hash.sha256": "bf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", - "threat.indicator.first_seen": "2021-06-20T18:40:18.070Z", - "threat.indicator.last_seen": "2021-06-20T18:40:18.070Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3Abf325093d87f746c297b2752c38a41a8f41b32aca01146b3632e24e90cdd14a1", - "threat.indicator.type": "file" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 10020, - "recordedfuture.entity.id": "hash:c06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Ac06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://b5qxg4.network.local/scan/results/file/c06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:28.000Z" - }, - { - "criticality": 2, - "criticalityLabel": "Suspicious", - "evidenceString": "3 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://5twber.network.local/scan/results/file/c06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", - "mitigationString": "", - "rule": "Linked to Malware", - "timestamp": "2021-06-20T18:40:18.010Z" - } - ], - "recordedfuture.risk.riskString": "2/14", - "recordedfuture.risk.riskSummary": "2 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 2, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "bdd205ffc81c54e7cc1a9080cfa093e4", - "threat.indicator.file.hash.sha1": "a6b928fd6fee43495b96941ef80b25d074f6e0e2", - "threat.indicator.file.hash.sha256": "c06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", - "threat.indicator.first_seen": "2021-06-20T18:40:18.011Z", - "threat.indicator.last_seen": "2021-06-20T18:40:18.011Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3Ac06f58340d8e7b1f466942db18f67b5eb048c9adc45d843db370c836e125e3f9", - "threat.indicator.type": "file" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 11492, - "recordedfuture.entity.id": "hash:c878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3Ac878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://l4tlgg.network.local/scan/results/file/c878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:31.000Z" - }, - { - "criticality": 2, - "criticalityLabel": "Suspicious", - "evidenceString": "6 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://wor2ca.network.local/scan/results/file/c878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", - "mitigationString": "", - "rule": "Linked to Malware", - "timestamp": "2021-06-20T18:40:17.964Z" - } - ], - "recordedfuture.risk.riskString": "2/14", - "recordedfuture.risk.riskSummary": "2 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 2, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "af45390e39574cdb037d684074e6a542", - "threat.indicator.file.hash.sha1": "f6a14c7424604cd51ba6a6d3f7594ec762f48645", - "threat.indicator.file.hash.sha256": "c878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", - "threat.indicator.first_seen": "2021-06-20T18:40:17.964Z", - "threat.indicator.last_seen": "2021-06-20T18:40:17.964Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3Ac878bdb6c62ace8f001f979f7c7b2c6b38d135ac1c69bfa63785bf86721619fc", - "threat.indicator.type": "file" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 65.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 12964, - "recordedfuture.entity.id": "hash:0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", - "recordedfuture.entity.type": "Hash", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/hash%3A0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", - "recordedfuture.risk.criticality": 3, - "recordedfuture.risk.criticalityLabel": "Malicious", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 3, - "criticalityLabel": "Malicious", - "evidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Jun 19, 2021): https://c2ilj.network.local/scan/results/file/0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", - "mitigationString": "", - "rule": "Positive Malware Verdict", - "timestamp": "2021-06-19T17:39:26.000Z" - }, - { - "criticality": 2, - "criticalityLabel": "Suspicious", - "evidenceString": "6 sightings on 1 source: PolySwarm. Most recent link (Jun 20, 2021): https://79073cr.network.local/scan/results/file/0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", - "mitigationString": "", - "rule": "Linked to Malware", - "timestamp": "2021-06-20T18:40:17.919Z" - } - ], - "recordedfuture.risk.riskString": "2/14", - "recordedfuture.risk.riskSummary": "2 of 14 Risk Rules currently observed.", - "recordedfuture.risk.rules": 2, - "recordedfuture.risk.score": 65, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.file.hash.md5": "5b8bcd367f802cd104210bb47abb3ab1", - "threat.indicator.file.hash.sha1": "b40d1796bd6974860ce6be691152ad963300c711", - "threat.indicator.file.hash.sha256": "0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", - "threat.indicator.first_seen": "2021-06-20T18:40:17.919Z", - "threat.indicator.last_seen": "2021-06-20T18:40:17.919Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/hash%3A0996575c7d2f07513d0dafe67ddde9805bbea35cf9d98edf8faf12c0e7f4334c", - "threat.indicator.type": "file" - } -] \ No newline at end of file diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/ip.ndjson.log b/x-pack/filebeat/module/threatintel/recordedfuture/test/ip.ndjson.log deleted file mode 100644 index bb05454a584e..000000000000 --- a/x-pack/filebeat/module/threatintel/recordedfuture/test/ip.ndjson.log +++ /dev/null @@ -1,10 +0,0 @@ -{"entity": {"id": "ip:2001:db8:cdb4:ff33:c406:fcdc:6961:c8af/21", "name": "2001:db8:cdb4:ff33:c406:fcdc:6961:c8af/21", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A2001:db8:cdb4:ff33:c406:fcdc:6961:c8af/21", "location": {"asn": "AS31287", "cidr": {"id": "ip:151.237.36.0/23", "name": "151.237.36.0/23", "type": "IpAddress"}, "location": {"city": "Radnevo", "continent": "Europe", "country": "Bulgaria"}, "organization": "IPACCT CABLE Ltd"}, "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/54", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2021-04-18T00:11:48.512Z", "lastSeen": "2021-06-19T19:40:32.897Z"}} -{"entity": {"id": "ip:2001:db8:f800:5c3f:c9f8:fbf8:d537:9071", "name": "2001:db8:f800:5c3f:c9f8:fbf8:d537:9071", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A2001:db8:f800:5c3f:c9f8:fbf8:d537:9071", "location": {"asn": "AS197207", "cidr": {"id": "ip:93.110.128.0/17", "name": "93.110.128.0/17", "type": "IpAddress"}, "location": {"city": null, "continent": "Asia", "country": "Iran"}, "organization": "Mobile Communication Company of Iran PLC"}, "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/54", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2021-06-19T17:55:58.019Z", "lastSeen": "2021-06-19T19:40:32.839Z"}} -{"entity": {"id": "ip:203.0.113.55", "name": "203.0.113.55", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.55", "location": {"asn": null, "cidr": {"id": "ip:0.0.0.0/8", "name": "0.0.0.0/8", "type": "IpAddress"}, "location": {"city": null, "continent": null, "country": null}, "organization": null}, "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/54", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2021-06-19T19:40:30.596Z", "lastSeen": "2021-06-19T19:40:30.596Z"}} -{"entity": {"id": "ip:203.0.113.108", "name": "203.0.113.108", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.108", "location": {"asn": "AS17622", "cidr": {"id": "ip:58.248.128.0/19", "name": "58.248.128.0/19", "type": "IpAddress"}, "location": {"city": "Guangzhou", "continent": "Asia", "country": "China"}, "organization": "China Unicom Guangzhou network"}, "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/54", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2021-06-19T19:40:20.534Z", "lastSeen": "2021-06-19T19:40:20.534Z"}} -{"entity": {"id": "ip:203.0.113.139", "name": "203.0.113.139", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.139", "location": {"asn": "AS7713", "cidr": {"id": "ip:125.162.0.0/16", "name": "125.162.0.0/16", "type": "IpAddress"}, "location": {"city": null, "continent": "Asia", "country": "Indonesia"}, "organization": "PT Telekomunikasi Indonesia"}, "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/54", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2016-06-23T07:39:06.418Z", "lastSeen": "2021-06-19T19:40:03.882Z"}} -{"entity": {"id": "ip:2001:db8:bf58:c5c3:7a06:5267:82e0:621a", "name": "2001:db8:bf58:c5c3:7a06:5267:82e0:621a", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A2001:db8:bf58:c5c3:7a06:5267:82e0:621a", "location": {"asn": "AS17622", "cidr": {"id": "ip:58.249.64.0/19", "name": "58.249.64.0/19", "type": "IpAddress"}, "location": {"city": "Guangzhou", "continent": "Asia", "country": "China"}, "organization": "China Unicom Guangzhou network"}, "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/54", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2021-06-19T19:40:02.557Z", "lastSeen": "2021-06-19T19:40:02.557Z"}} -{"entity": {"id": "ip:192.0.2.147", "name": "192.0.2.147", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A192.0.2.147", "location": {"asn": "AS4837", "cidr": {"id": "ip:61.53.0.0/17", "name": "61.53.0.0/17", "type": "IpAddress"}, "location": {"city": "Zhengzhou", "continent": "Asia", "country": "China"}, "organization": "CHINA UNICOM China169 Backbone"}, "risk": {"criticality": 0, "criticalityLabel": "None", "evidenceDetails": [], "riskString": "0/54", "riskSummary": "No Risk Rules are currently observed.", "rules": 0, "score": 0}, "timestamps": {"firstSeen": "2017-12-20T02:21:07.734Z", "lastSeen": "2021-06-19T19:39:43.160Z"}} -{"entity": {"id": "ip:203.0.113.198", "name": "203.0.113.198", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.198", "location": {"asn": "AS9829", "cidr": {"id": "ip:59.93.20.0/22", "name": "59.93.20.0/22", "type": "IpAddress"}, "location": {"city": "Palakkad", "continent": "Asia", "country": "India"}, "organization": "National Internet Backbone"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "4 sightings on 1 source: AbuseIP Database. Most recent link (Dec 24, 2019): https://6900dkn8.network.local/pg6pd9jx/ip=203.0.113.198", "mitigationString": "", "rule": "Historical Multicategory Blocklist", "timestamp": "2019-12-24T09:53:13.546Z"}], "riskString": "1/54", "riskSummary": "1 of 54 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2019-12-24T09:54:02.935Z", "lastSeen": "2021-06-19T19:39:25.532Z"}} -{"entity": {"id": "ip:192.0.2.179", "name": "192.0.2.179", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A192.0.2.179", "location": {"asn": "AS9829", "cidr": {"id": "ip:59.99.200.0/21", "name": "59.99.200.0/21", "type": "IpAddress"}, "location": {"city": "Bangalore", "continent": "Asia", "country": "India"}, "organization": "National Internet Backbone"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "4 sightings on 1 source: AbuseIP Database. Most recent link (Mar 3, 2020): https://f0go.network.local/c1c3m9rsl/ip=192.0.2.179", "mitigationString": "", "rule": "Historical Multicategory Blocklist", "timestamp": "2020-03-03T08:08:07.521Z"}, {"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between Apr 7, 2020, and Apr 8, 2020.", "mitigationString": "", "rule": "Historically Reported in Threat List", "timestamp": "2021-06-21T19:53:19.897Z"}, {"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "High Risk activity in CIDR Block.", "mitigationString": "", "rule": "Recorded Future Predictive Risk Model", "timestamp": "2021-06-21T19:53:19.906Z"}], "riskString": "3/54", "riskSummary": "3 of 54 Risk Rules currently observed.", "rules": 3, "score": 15}, "timestamps": {"firstSeen": "2020-03-03T08:10:28.489Z", "lastSeen": "2021-06-19T19:39:11.694Z"}} -{"entity": {"id": "ip:192.0.2.245", "name": "192.0.2.245", "type": "IpAddress"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A192.0.2.245", "location": {"asn": "AS45899", "cidr": {"id": "ip:113.170.96.0/20", "name": "113.170.96.0/20", "type": "IpAddress"}, "location": {"city": "Long Phu", "continent": "Asia", "country": "Vietnam"}, "organization": "VNPT Corp"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between May 25, 2021, and May 25, 2021.", "mitigationString": "", "rule": "Historically Reported in Threat List", "timestamp": "2021-06-19T19:50:20.162Z"}], "riskString": "1/54", "riskSummary": "1 of 54 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-19T19:38:57.372Z", "lastSeen": "2021-06-19T19:38:57.372Z"}} diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/ip.ndjson.log-expected.json b/x-pack/filebeat/module/threatintel/recordedfuture/test/ip.ndjson.log-expected.json deleted file mode 100644 index c46c3e2a51f1..000000000000 --- a/x-pack/filebeat/module/threatintel/recordedfuture/test/ip.ndjson.log-expected.json +++ /dev/null @@ -1,428 +0,0 @@ -[ - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 0, - "recordedfuture.entity.id": "ip:2001:db8:cdb4:ff33:c406:fcdc:6961:c8af/21", - "recordedfuture.entity.name": "2001:db8:cdb4:ff33:c406:fcdc:6961:c8af/21", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A2001:db8:cdb4:ff33:c406:fcdc:6961:c8af/21", - "recordedfuture.ip_range": "2001:db8:cdb4:ff33:c406:fcdc:6961:c8af/21", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/54", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.as.number": 31287, - "threat.indicator.as.organization.name": "IPACCT CABLE Ltd", - "threat.indicator.first_seen": "2021-04-18T00:11:48.512Z", - "threat.indicator.geo.city_name": "Radnevo", - "threat.indicator.geo.continent_name": "Europe", - "threat.indicator.geo.country_name": "Bulgaria", - "threat.indicator.last_seen": "2021-06-19T19:40:32.897Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A2001:db8:cdb4:ff33:c406:fcdc:6961:c8af/21", - "threat.indicator.type": "ipv6-addr" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 763, - "recordedfuture.entity.id": "ip:2001:db8:f800:5c3f:c9f8:fbf8:d537:9071", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A2001:db8:f800:5c3f:c9f8:fbf8:d537:9071", - "recordedfuture.ip_range": "2001:db8:f800:5c3f:c9f8:fbf8:d537:9071/128", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/54", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.as.number": 197207, - "threat.indicator.as.organization.name": "Mobile Communication Company of Iran PLC", - "threat.indicator.first_seen": "2021-06-19T17:55:58.019Z", - "threat.indicator.geo.continent_name": "Asia", - "threat.indicator.geo.country_name": "Iran", - "threat.indicator.ip": "2001:db8:f800:5c3f:c9f8:fbf8:d537:9071", - "threat.indicator.last_seen": "2021-06-19T19:40:32.839Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A2001:db8:f800:5c3f:c9f8:fbf8:d537:9071", - "threat.indicator.type": "ipv6-addr" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 1531, - "recordedfuture.entity.id": "ip:203.0.113.55", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.55", - "recordedfuture.ip_range": "203.0.113.55/32", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/54", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-19T19:40:30.596Z", - "threat.indicator.ip": "203.0.113.55", - "threat.indicator.last_seen": "2021-06-19T19:40:30.596Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.55", - "threat.indicator.type": "ipv4-addr" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 2161, - "recordedfuture.entity.id": "ip:203.0.113.108", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.108", - "recordedfuture.ip_range": "203.0.113.108/32", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/54", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.as.number": 17622, - "threat.indicator.as.organization.name": "China Unicom Guangzhou network", - "threat.indicator.first_seen": "2021-06-19T19:40:20.534Z", - "threat.indicator.geo.city_name": "Guangzhou", - "threat.indicator.geo.continent_name": "Asia", - "threat.indicator.geo.country_name": "China", - "threat.indicator.ip": "203.0.113.108", - "threat.indicator.last_seen": "2021-06-19T19:40:20.534Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.108", - "threat.indicator.type": "ipv4-addr" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 2851, - "recordedfuture.entity.id": "ip:203.0.113.139", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.139", - "recordedfuture.ip_range": "203.0.113.139/32", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/54", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.as.number": 7713, - "threat.indicator.as.organization.name": "PT Telekomunikasi Indonesia", - "threat.indicator.first_seen": "2016-06-23T07:39:06.418Z", - "threat.indicator.geo.continent_name": "Asia", - "threat.indicator.geo.country_name": "Indonesia", - "threat.indicator.ip": "203.0.113.139", - "threat.indicator.last_seen": "2021-06-19T19:40:03.882Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.139", - "threat.indicator.type": "ipv4-addr" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 3532, - "recordedfuture.entity.id": "ip:2001:db8:bf58:c5c3:7a06:5267:82e0:621a", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A2001:db8:bf58:c5c3:7a06:5267:82e0:621a", - "recordedfuture.ip_range": "2001:db8:bf58:c5c3:7a06:5267:82e0:621a/128", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/54", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.as.number": 17622, - "threat.indicator.as.organization.name": "China Unicom Guangzhou network", - "threat.indicator.first_seen": "2021-06-19T19:40:02.557Z", - "threat.indicator.geo.city_name": "Guangzhou", - "threat.indicator.geo.continent_name": "Asia", - "threat.indicator.geo.country_name": "China", - "threat.indicator.ip": "2001:db8:bf58:c5c3:7a06:5267:82e0:621a", - "threat.indicator.last_seen": "2021-06-19T19:40:02.557Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A2001:db8:bf58:c5c3:7a06:5267:82e0:621a", - "threat.indicator.type": "ipv6-addr" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 0.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 4295, - "recordedfuture.entity.id": "ip:192.0.2.147", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A192.0.2.147", - "recordedfuture.ip_range": "192.0.2.147/32", - "recordedfuture.risk.criticality": 0, - "recordedfuture.risk.criticalityLabel": "None", - "recordedfuture.risk.evidenceDetails": [], - "recordedfuture.risk.riskString": "0/54", - "recordedfuture.risk.riskSummary": "No Risk Rules are currently observed.", - "recordedfuture.risk.rules": 0, - "recordedfuture.risk.score": 0, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.as.number": 4837, - "threat.indicator.as.organization.name": "CHINA UNICOM China169 Backbone", - "threat.indicator.first_seen": "2017-12-20T02:21:07.734Z", - "threat.indicator.geo.city_name": "Zhengzhou", - "threat.indicator.geo.continent_name": "Asia", - "threat.indicator.geo.country_name": "China", - "threat.indicator.ip": "192.0.2.147", - "threat.indicator.last_seen": "2021-06-19T19:39:43.160Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A192.0.2.147", - "threat.indicator.type": "ipv4-addr" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 4972, - "recordedfuture.entity.id": "ip:203.0.113.198", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.198", - "recordedfuture.ip_range": "203.0.113.198/32", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "4 sightings on 1 source: AbuseIP Database. Most recent link (Dec 24, 2019): https://6900dkn8.network.local/pg6pd9jx/ip=203.0.113.198", - "mitigationString": "", - "rule": "Historical Multicategory Blocklist", - "timestamp": "2019-12-24T09:53:13.546Z" - } - ], - "recordedfuture.risk.riskString": "1/54", - "recordedfuture.risk.riskSummary": "1 of 54 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.as.number": 9829, - "threat.indicator.as.organization.name": "National Internet Backbone", - "threat.indicator.first_seen": "2019-12-24T09:54:02.935Z", - "threat.indicator.geo.city_name": "Palakkad", - "threat.indicator.geo.continent_name": "Asia", - "threat.indicator.geo.country_name": "India", - "threat.indicator.ip": "203.0.113.198", - "threat.indicator.last_seen": "2021-06-19T19:39:25.532Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A203.0.113.198", - "threat.indicator.type": "ipv4-addr" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 15.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 5970, - "recordedfuture.entity.id": "ip:192.0.2.179", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A192.0.2.179", - "recordedfuture.ip_range": "192.0.2.179/32", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "4 sightings on 1 source: AbuseIP Database. Most recent link (Mar 3, 2020): https://f0go.network.local/c1c3m9rsl/ip=192.0.2.179", - "mitigationString": "", - "rule": "Historical Multicategory Blocklist", - "timestamp": "2020-03-03T08:08:07.521Z" - }, - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "High Risk activity in CIDR Block.", - "mitigationString": "", - "rule": "Recorded Future Predictive Risk Model", - "timestamp": "2021-06-21T19:53:19.906Z" - }, - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between Apr 7, 2020, and Apr 8, 2020.", - "mitigationString": "", - "rule": "Historically Reported in Threat List", - "timestamp": "2021-06-21T19:53:19.897Z" - } - ], - "recordedfuture.risk.riskString": "3/54", - "recordedfuture.risk.riskSummary": "3 of 54 Risk Rules currently observed.", - "recordedfuture.risk.rules": 3, - "recordedfuture.risk.score": 15, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.as.number": 9829, - "threat.indicator.as.organization.name": "National Internet Backbone", - "threat.indicator.first_seen": "2020-03-03T08:10:28.489Z", - "threat.indicator.geo.city_name": "Bangalore", - "threat.indicator.geo.continent_name": "Asia", - "threat.indicator.geo.country_name": "India", - "threat.indicator.ip": "192.0.2.179", - "threat.indicator.last_seen": "2021-06-19T19:39:11.694Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A192.0.2.179", - "threat.indicator.type": "ipv4-addr" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 7483, - "recordedfuture.entity.id": "ip:192.0.2.245", - "recordedfuture.entity.type": "IpAddress", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/ip%3A192.0.2.245", - "recordedfuture.ip_range": "192.0.2.245/32", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between May 25, 2021, and May 25, 2021.", - "mitigationString": "", - "rule": "Historically Reported in Threat List", - "timestamp": "2021-06-19T19:50:20.162Z" - } - ], - "recordedfuture.risk.riskString": "1/54", - "recordedfuture.risk.riskSummary": "1 of 54 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.as.number": 45899, - "threat.indicator.as.organization.name": "VNPT Corp", - "threat.indicator.first_seen": "2021-06-19T19:38:57.372Z", - "threat.indicator.geo.city_name": "Long Phu", - "threat.indicator.geo.continent_name": "Asia", - "threat.indicator.geo.country_name": "Vietnam", - "threat.indicator.ip": "192.0.2.245", - "threat.indicator.last_seen": "2021-06-19T19:38:57.372Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/ip%3A192.0.2.245", - "threat.indicator.type": "ipv4-addr" - } -] \ No newline at end of file diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_assorted.json.log b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_assorted.json.log new file mode 100644 index 000000000000..68da98bb6d3c --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_assorted.json.log @@ -0,0 +1,40 @@ +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"21 sightings on 4 sources: Proofpoint, PasteBin, The Daily Advance, @DGAFeedAlerts. Most recent tweet: New ramnit Dom: xohrikvjhiu[.]eu IP: 13[.]90[.]196[.]81 NS: https://t.co/nTqEOuAW2E https://t.co/QdrtFSplyz. Most recent link (Nov 16, 2019): https://twitter.com/DGAFeedAlerts/statuses/1195824847915491329\", \"Sources\": [\"QQA438\", \"Jv_xrR\", \"SlNfa3\", \"KvPSaU\"], \"Timestamp\": \"2019-11-16T22:03:55.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"18 sightings on 2 sources: Proofpoint, The Daily Advance. Most recent link (Nov 12, 2018): https://www.proofpoint.com/us/threat-insight/post/sload-and-ramnit-pairing-sustained-campaigns-against-uk-and-italy#.W-nmxyGcuiY.twitter\", \"Sources\": [\"QQA438\", \"KvPSaU\"], \"Timestamp\": \"2018-11-12T20:48:08.675Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Referenced by Insikt Group\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Insikt Group. 1 report: Proofpoint Researchers Observe sLoad and Ramnit in Campaigns Against The U.K. and Italy. Most recent link (Oct 23, 2018): https://app.recordedfuture.com/live/sc/4KSWum2M6Lx7\", \"Sources\": [\"VKz42X\"], \"Timestamp\": \"2018-10-23T00:00:00.000Z\", \"Name\": \"relatedNote\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Mar 23, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-03-23T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T07:12:02.455Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "xohrikvjhiu.eu", "Risk": "96", "RiskString": "5/45"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported by DHS AIS\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-216d34d4-67bd-4add-ae6e-4ddec27dcb0e (Jul 25, 2019).\", \"Sources\": [\"UZNze8\"], \"Timestamp\": \"2019-07-25T00:46:19.000Z\", \"Name\": \"dhsAis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/\", \"Sources\": [\"ST7rfx\"], \"Timestamp\": \"2017-05-17T19:31:06.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 19, 2021, and Jul 21, 2021.\", \"Sources\": [\"report:Tluf00\"], \"Timestamp\": \"2021-12-29T07:21:52.311Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 9, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-07-09T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Malware Analysis DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/\", \"Sources\": [\"NKaUXl\"], \"Timestamp\": \"2017-07-06T00:00:00.000Z\", \"Name\": \"malwareAnalysis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T07:21:52.303Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "wgwuhauaqcrx.com", "Risk": "95", "RiskString": "6/45"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: wbmpvebw[.]com IP: 209[.]99[.]40[.]220 NS: https://t.co/bH4I7LoMNf https://t.co/KTCPYU87bT. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551578264821760\", \"Sources\": [\"SlNfa3\"], \"Timestamp\": \"2020-01-04T20:03:37.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\", \"Sources\": [\"KVQ2PB\"], \"Timestamp\": \"2017-03-08T01:18:17.569Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Feb 18, 2021, and Feb 24, 2021.\", \"Sources\": [\"report:Tluf00\"], \"Timestamp\": \"2021-12-29T07:16:05.008Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-06-30T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Malware Analysis DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/\", \"Sources\": [\"NKaUXl\"], \"Timestamp\": \"2017-05-08T00:00:00.000Z\", \"Name\": \"malwareAnalysis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T07:16:05.007Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "wbmpvebw.com", "Risk": "95", "RiskString": "6/45"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: ckgryagcibbcf[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333576053207040\", \"Sources\": [\"SlNfa3\"], \"Timestamp\": \"2021-02-01T20:08:18.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\", \"Sources\": [\"KVQ2PB\"], \"Timestamp\": \"2017-03-08T01:18:17.569Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-06-15T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Malware Analysis DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/\", \"Sources\": [\"NKaUXl\"], \"Timestamp\": \"2016-04-11T00:00:00.000Z\", \"Name\": \"malwareAnalysis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T06:40:44.358Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "ckgryagcibbcf.com", "Risk": "94", "RiskString": "5/45"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jpuityvakjgg[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333600627683330\", \"Sources\": [\"SlNfa3\"], \"Timestamp\": \"2021-02-01T20:08:24.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\", \"Sources\": [\"KVQ2PB\"], \"Timestamp\": \"2017-03-08T01:18:17.569Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 17, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-06-17T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Malware Analysis DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/\", \"Sources\": [\"NKaUXl\"], \"Timestamp\": \"2017-05-08T00:00:00.000Z\", \"Name\": \"malwareAnalysis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T06:46:28.155Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "jpuityvakjgg.com", "Risk": "94", "RiskString": "5/45"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jexgpprgph[.]com IP: 209[.]99[.]40[.]222 NS: https://t.co/IGcQwMvzjy https://t.co/J2gdsVMl8U. Most recent link (Dec 13, 2018): https://twitter.com/DGAFeedAlerts/statuses/1073277207919947778\", \"Sources\": [\"SlNfa3\"], \"Timestamp\": \"2018-12-13T18:03:21.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\", \"Sources\": [\"KVQ2PB\"], \"Timestamp\": \"2017-03-08T01:18:17.569Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-06-30T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Malware Analysis DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/\", \"Sources\": [\"NKaUXl\"], \"Timestamp\": \"2017-05-08T00:00:00.000Z\", \"Name\": \"malwareAnalysis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T06:40:30.778Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "jexgpprgph.com", "Risk": "94", "RiskString": "5/45"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: cascotqhij[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/czXUwYeuxf https://t.co/nKWfZguQSF. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333566758682629\", \"Sources\": [\"SlNfa3\"], \"Timestamp\": \"2021-02-01T20:08:16.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\", \"Sources\": [\"KVQ2PB\"], \"Timestamp\": \"2017-03-08T01:18:17.569Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 27, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-07-27T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Malware Analysis DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/\", \"Sources\": [\"NKaUXl\"], \"Timestamp\": \"2016-04-11T00:00:00.000Z\", \"Name\": \"malwareAnalysis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T06:34:06.062Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "cascotqhij.com", "Risk": "94", "RiskString": "5/45"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported by DHS AIS\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-e26bfe3a-8f67-4f57-9449-3f183fe94c07 (Jul 25, 2019).\", \"Sources\": [\"UZNze8\"], \"Timestamp\": \"2019-07-25T01:51:04.000Z\", \"Name\": \"dhsAis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/\", \"Sources\": [\"ST7rfx\"], \"Timestamp\": \"2017-05-17T19:31:06.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Apr 1, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-04-01T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Malware Analysis DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/\", \"Sources\": [\"NKaUXl\"], \"Timestamp\": \"2017-07-06T00:00:00.000Z\", \"Name\": \"malwareAnalysis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T06:45:21.381Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "npcvnorvyhelagx.com", "Risk": "94", "RiskString": "5/45"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: uxlyihgvfnqcrfcf[.]com IP: 209[.]99[.]40[.]224 NS: https://t.co/03Dbt4N72t https://t.co/l29AcRDSvE. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551575332982790\", \"Sources\": [\"SlNfa3\"], \"Timestamp\": \"2020-01-04T20:03:36.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\", \"Sources\": [\"KVQ2PB\"], \"Timestamp\": \"2017-03-08T01:18:17.569Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 6, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-05-06T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Malware Analysis DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/\", \"Sources\": [\"NKaUXl\"], \"Timestamp\": \"2017-05-08T00:00:00.000Z\", \"Name\": \"malwareAnalysis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T06:35:26.677Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "uxlyihgvfnqcrfcf.com", "Risk": "94", "RiskString": "5/45"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported by DHS AIS\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-fd72a0d2-bcbd-43b4-910b-9898e979a562 (Jul 24, 2019).\", \"Sources\": [\"UZNze8\"], \"Timestamp\": \"2019-07-24T23:40:35.000Z\", \"Name\": \"dhsAis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported as a Defanged DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: bjfwfqviu[.]com IP: 23[.]96[.]57[.]36 NS: https://t.co/nTqEOuAW2E https://t.co/NnqzXB3b3P. Most recent link (Jul 3, 2019): https://twitter.com/DGAFeedAlerts/statuses/1146524855602429953\", \"Sources\": [\"SlNfa3\"], \"Timestamp\": \"2019-07-03T21:03:21.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Operation\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 6, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-05-06T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Malware Analysis DNS Name\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"3 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZDQ0ODcwOTZiN2FmNDExNmExYzA3YjUwOTcxYmRlMjE/\", \"Sources\": [\"NKaUXl\"], \"Timestamp\": \"2017-07-06T00:00:00.000Z\", \"Name\": \"malwareAnalysis\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C DNS Name\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bambenek Consulting C&C Blocklist.\", \"Sources\": [\"report:QhR8Qs\"], \"Timestamp\": \"2021-12-29T06:48:58.905Z\", \"Name\": \"recentCncSite\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "bjfwfqviu.com", "Risk": "94", "RiskString": "5/45"} +{"Algorithm": "SHA-256", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"50 sightings on 10 sources including: Security Bloggers Network, TechTarget Search Security, Bleeping Computer, Guided Collection, Bleepingcomputer Forums. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\", \"Sources\": [\"NSAcUx\", \"KCdHcb\", \"J6UzbO\", \"Rlso4a\", \"hkE5DK\", \"cJMUDF\", \"TZRwk8\", \"QMTzEI\", \"LUhTGd\", \"J5NRun\"], \"Timestamp\": \"2021-12-21T08:40:00.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Attack Vector\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"32 sightings on 27 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @neonprimetime, @rpsanch. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\", \"Sources\": [\"T1bwMv\", \"LC-zVm\", \"QFvaUy\", \"P_upBR\", \"T2OA5Q\", \"K20lXV\", \"TGgDPZ\", \"hkIDTa\", \"LqRZCN\", \"Vd51cf\", \"ha2FFj\", \"UmsU31\", \"K7wUX2\", \"P_ivKa\", \"Qj3TQr\", \"idn:wordpress.com\", \"J-mrOR\", \"QPbAan\", \"VeioBt\", \"WlbRkJ\", \"K7sErA\", \"TvfQzk\", \"TP1vbk\", \"SrKvJ0\", \"SqCj4s\", \"VXaDYo\", \"bk2VX4\"], \"Timestamp\": \"2021-12-25T03:23:47.000Z\", \"Name\": \"linkedToVector\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Cyber Attack\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"6 sightings on 6 sources including: Messaging Platforms - Uncategorized, @_mr_touch. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289\", \"Sources\": [\"XV7DoD\", \"Ym7dzt\", \"LKKAV1\", \"VeioBt\", \"Y7TWfI\", \"KGS-xC\"], \"Timestamp\": \"2019-05-28T14:17:41.000Z\", \"Name\": \"linkedToCyberAttack\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"119 sightings on 42 sources including: Malware-Traffic-Analysis.net - Blog Entries, Doc Player, GhostBin, Data Breach Today.eu | Updates, Codex - Recent changes en. 43 related malware families including Dardesh, AZORult, Emotet, Ryuk Ransomware, GandCrab. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\", \"Sources\": [\"TvGJYk\", \"LErKlJ\", \"QWOrKl\", \"LKKAV1\", \"W4ygGi\", \"PATKM7\", \"T1bwMv\", \"TY6igj\", \"LjkJhE\", \"kuKt0c\", \"QAy9GA\", \"LbYmLr\", \"K20lXV\", \"QZe7TG\", \"idn:droppdf.com\", \"QAmbRP\", \"V_o1DL\", \"TbciDE\", \"XV7DoD\", \"P_j5Dw\", \"QNmgPm\", \"TGXqeD\", \"KGS-xC\", \"L3kVdM\", \"QMfGAr\", \"h6VVAH\", \"doLlw5\", \"UrsUKT\", \"JOU\", \"MIKjae\", \"P_oIyV\", \"QJ6TQK\", \"RfVd0T\", \"J6UzbO\", \"Ql9O5c\", \"USKpXp\", \"TP1vbk\", \"SrKvJ0\", \"Tq2nAb\", \"P_ov9o\", \"VXaDYo\", \"idn:index-of.es\"], \"Timestamp\": \"2021-11-27T23:07:37.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Reported by DHS AIS\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-12195723-7c56-4c63-b828-fc340dd4050a (Dec 20, 2018).\", \"Sources\": [\"UZNze8\"], \"Timestamp\": \"2018-12-20T21:13:36.000Z\", \"Name\": \"dhsAis\", \"MitigationString\": \"\", \"Criticality\": 3.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"5 sightings on 3 sources: Malware-Traffic-Analysis.net - Blog Entries, ReversingLabs, PolySwarm. Most recent link (Dec 15, 2018): https://www.malware-traffic-analysis.net/2018/12/14/index.html\", \"Sources\": [\"LErKlJ\", \"TbciDE\", \"doLlw5\"], \"Timestamp\": \"2020-07-11T09:55:23.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "38e992eb852ab0c4ac03955fb0dc9bb38e64010fdf9c05331d2b02b6e05689c2", "Risk": "89", "RiskString": "6/14"} +{"Algorithm": "SHA-256", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"28 sightings on 8 sources including: Dancho Danchev's Blog, SecureWorks, Talos Intel, Unit 42 Palo Alto Networks, Cisco Japan Blog. Most recent link (Mar 12, 2021): https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group?es_p=13420131\", \"Sources\": [\"JfqIbv\", \"Z2mQh2\", \"PA-rR4\", \"jjf3_B\", \"clDYM8\", \"T5\", \"rN\", \"J5NRun\"], \"Timestamp\": \"2021-03-12T20:30:37.672Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Attack Vector\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"69 sightings on 18 sources including: Stock market news Company News MarketScreenercom, HackDig Posts, Sesin at, US CERT CISA Alerts, citizensudo.com. 6 related attack vectors including Powershell Attack, Supply Chain Attack, Target Destination Manipulation, Reconnaissance, C&C Server. Most recent link (Apr 15, 2021): https://www.cisa.gov/uscert/ncas/alerts/aa20-352a\", \"Sources\": [\"XBl0xf\", \"POs2u-\", \"Z3TZAQ\", \"hhY_oz\", \"idn:citizensudo.com\", \"VKz42X\", \"PA-rR4\", \"POs2tz\", \"idn:firsthackersnews.com\", \"KcjdRW\", \"dCotni\", \"idn:comodo.com\", \"gI8s5W\", \"hibUwt\", \"rN\", \"idn:reportcybercrime.com\", \"idn:eshielder.com\", \"idn:edsitrend.com\"], \"Timestamp\": \"2021-04-15T00:00:00.000Z\", \"Name\": \"linkedToVector\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Vulnerability\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"11 sightings on 2 sources: GitHub, Insikt Group. 5 related cyber vulnerabilities: CWE-20, CWE-287, CVE-2020-10148, CVE-2020-1938, CWE-269. Most recent link (Dec 27, 2021): https://github.com/teamt5-it/official-website-v2/blob/master/_site/_next/data/64e2c6f134e73517d6ff737822e83cd75cf633c6/tw/posts/ithome-ghostcat-apache-tomcat-ajp-vulnerability.json\", \"Sources\": [\"MIKjae\", \"VKz42X\"], \"Timestamp\": \"2021-12-27T07:36:54.000Z\", \"Name\": \"linkedToVuln\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"175 sightings on 31 sources including: 4-traders.com, SentinelLabs, Sesin at, Cisco Japan Blog, McAfee. 8 related malware families including WebShell, Ransomware, Backdoor, Backdoor Shell, SUNBURST. Most recent tweet: Malcode highlighted in 'App_Web_logoimagehandler.ashx.b6031896.dll' (c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71) #SolarWinds #SUNBURST https://t.co/lyvnVHuTb2. Most recent link (Dec 16, 2020): https://twitter.com/_mynameisgeff/statuses/1339070792705830913\", \"Sources\": [\"TuWseX\", \"KBTQ2e\", \"eP3CYX\", \"Z3TZAQ\", \"clDYM8\", \"rN\", \"VKz42X\", \"idn:elemendar.com\", \"idn:securitysummitperu.com\", \"PA-rR4\", \"idn:terabitweb.com\", \"eTNyK6\", \"gBQB48\", \"bMZlEg\", \"idn:edsitrend.com\", \"idn:infoblox.com\", \"UZNze8\", \"Z2mQh2\", \"XBl0xf\", \"dCpZqs\", \"jmpFm1\", \"T5\", \"doLlw5\", \"gBDK5G\", \"MIKjae\", \"idn:firsthackersnews.com\", \"jjf3_B\", \"Jv_xrR\", \"dCotni\", \"idn:comodo.com\", \"hibUwt\"], \"Timestamp\": \"2020-12-16T04:52:10.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Reported by DHS AIS\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"3 sightings on 1 source: DHS Automated Indicator Sharing. 3 reports including AA20-352A APT Compromise of Govt Agencies, Critical Infrastructure, and Private Sector Organizations, from CISA, Government Facilities Sector, CISA, Government Facilities Sector, NCCIC:STIX_Package-673aacd1-1852-4d44-bd93-0c44940a6358 (Feb 3, 2021).\", \"Sources\": [\"UZNze8\"], \"Timestamp\": \"2021-02-03T21:32:08.000Z\", \"Name\": \"dhsAis\", \"MitigationString\": \"\", \"Criticality\": 3.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"6 sightings on 2 sources: Sophos Virus and Spyware Threats, PolySwarm. Most recent link (Dec 17, 2020): https://news.sophos.com/fr-fr/2020/12/15/cyberattaque-contre-solarwinds-comment-savoir-si-vous-etes-concerne/\", \"Sources\": [\"K16tAG\", \"doLlw5\"], \"Timestamp\": \"2020-12-20T15:18:53.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}, {\"Rule\": \"Reported by Insikt Group\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"13 sightings on 1 source: Insikt Group. 4 reports including Researchers Linked Supernova Malware to Spiral Group. Most recent link (Mar 08, 2021): https://app.recordedfuture.com/live/sc/5DIp4RIUiJz6\", \"Sources\": [\"VKz42X\"], \"Timestamp\": \"2021-03-08T00:00:00.000Z\", \"Name\": \"analystNote\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71", "Risk": "89", "RiskString": "7/14"} +{"Algorithm": "MD5", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"10 sightings on 7 sources including: ISC Sans Diary Archive, SecureWorks, InfoCON: green, ISC | Latest Headlines, SANS Internet Storm Center. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html\", \"Sources\": [\"TCw6v6\", \"Z2mQh2\", \"2d\", \"cJuZvt\", \"JYxY8X\", \"J2_htN\", \"jXNbON\"], \"Timestamp\": \"2021-12-20T04:54:00.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Attack Vector\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"6 sightings on 5 sources: GitHub, SANS Internet Storm Center, Messaging Platforms - Uncategorized, @decalage2, @simonwargniez. 3 related attack vectors: Remote Code Execution, Zero Day Exploit, Cyberattack. Most recent tweet: Great lists of software affected by #Log4Shell / CVE-2021-44228 / Log4J RCE: https://t.co/TpEQXKgMGW by @ncsc_nl https://t.co/FA5i8zR5Z1 by @CISAgov https://t.co/0xVZJvMcpU by @SwitHak https://t.co/788knvztWV https://t.co/WMkXslhgWS #log4j #log4j2. Most recent link (Dec 15, 2021): https://twitter.com/decalage2/statuses/1471121875816353800\", \"Sources\": [\"LUf99I\", \"MIKjae\", \"JYxY8X\", \"Y7TWfI\", \"KIRe_w\"], \"Timestamp\": \"2021-12-15T14:16:01.000Z\", \"Name\": \"linkedToVector\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Vulnerability\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"108 sightings on 78 sources including: bund.de, tistory.com, PasteBin, Sesin at, Messaging Platforms - Uncategorized. 24 related cyber vulnerabilities including CWE-22, CWE-611, CVE-2019-19781, CVE-2020-16898, CWE-20. Most recent tweet: Security advisories, bulletins, and vendor responses related to Log4Shell #Log4Shell #Log4j #cybersecurity #infosec #vendorsecurity https://t.co/Vpwrhdppm7. Most recent link (Dec 22, 2021): https://twitter.com/arrgibbs/statuses/1473733864459841538\", \"Sources\": [\"VQpQDR\", \"KFu3Rc\", \"LUf99I\", \"SGCsBG\", \"U94lUG\", \"KFcv42\", \"QT0CFv\", \"UHvtcg\", \"KFUbjU\", \"KHwUI5\", \"KKSt8d\", \"idn:bund.de\", \"VmIbAC\", \"QGT0Vy\", \"ejfM20\", \"KGlTEd\", \"QCoXJo\", \"RXSwU8\", \"idn:tistory.com\", \"LpdVul\", \"K-eKsL\", \"TKYCSz\", \"SkABVK\", \"SdGk_x\", \"LI6d7O\", \"LQIfBf\", \"U6B2hC\", \"f7_CfD\", \"LKt0HB\", \"RHS4v8\", \"KKmN5m\", \"YfJqp2\", \"Jv_xrR\", \"RJ2_NX\", \"VZXzSv\", \"k0QC11\", \"KFWBRs\", \"LRk_pt\", \"Qn2VRQ\", \"kGHFKP\", \"ShBO5M\", \"T-GSBp\", \"KNdyHF\", \"QLCTXP\", \"Z3TZAQ\", \"Khf99v\", \"KHZhjO\", \"SHH61D\", \"Knx_su\", \"LL8-pr\", \"QpmWTf\", \"KIRe_w\", \"QIea7F\", \"SlhG3F\", \"KIdj8R\", \"SQqKS8\", \"Lq6DNq\", \"QpYsBa\", \"d-ZMP2\", \"LOoye8\", \"QEUmiJ\", \"ewfPjC\", \"LBNFpV\", \"QTpbKE\", \"Y7TWfI\", \"KGS-xC\", \"eifkGz\", \"au2SGr\", \"SKw4tT\", \"KGW5kn\", \"Q9y5Ki\", \"KGxw1d\", \"MIKjae\", \"LO5p1C\", \"JYxY8X\", \"KJsMEF\", \"QBLBHH\", \"k7WJ2k\"], \"Timestamp\": \"2021-12-22T19:15:08.000Z\", \"Name\": \"linkedToVuln\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"11 sightings on 3 sources: bund.de, SANS Internet Storm Center, Sesin at. 2 related malware families: Ransomware, Botnet. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html\", \"Sources\": [\"idn:bund.de\", \"JYxY8X\", \"Z3TZAQ\"], \"Timestamp\": \"2021-12-20T04:54:00.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Naked Security. Most recent link (Dec 18, 2021): https://news.sophos.com/en-us/2021/12/17/log4shell-response-and-mitigation-recommendations/\", \"Sources\": [\"J2_htN\"], \"Timestamp\": \"2021-12-18T00:20:04.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "b66db3a06c2955a9cb71a8718970c592", "Risk": "89", "RiskString": "5/14"} +{"Algorithm": "SHA-256", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"91 sightings on 19 sources including: Security News Concentrator, Fortinet, Trend Micro, CrowdStrike, FireEye Threat Research Blog. Most recent link (Dec 20, 2019): https://threatvector.cylance.com/en_us/home/threat-spotlight-petya-like-ransomware-is-nasty-wiper.html\", \"Sources\": [\"QS89Bd\", \"KVP0jz\", \"T5\", \"JYxY5G\", \"WR_Ohh\", \"Jt4ExJ\", \"Kzw0Pm\", \"JQH96m\", \"2d\", \"JYxY8X\", \"rN\", \"PA-rR4\", \"VyWQM7\", \"Lp_esG\", \"ONMgMx\", \"4n\", \"QMTzEI\", \"83\", \"K0TN7r\"], \"Timestamp\": \"2019-12-20T01:04:11.602Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 6, 2017, and Jul 17, 2017.\", \"Sources\": [\"report:Tluf00\"], \"Timestamp\": \"2021-12-24T20:03:09.087Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Attack Vector\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"14 sightings on 5 sources including: Assiste.Forum, @arturodicorinto. 2 related attack vectors: ShellCode, Cyberattack. Most recent tweet: They're getting quicker at updating.. #petya #cyberattack https://t.co/px0g9BSpod. Most recent link (Jun 27, 2017): https://twitter.com/SupersizedSam/statuses/879764638845587461\", \"Sources\": [\"LP7dc7\", \"LRlngp\", \"Sl8XTb\", \"QMfGAr\", \"J-y3tn\"], \"Timestamp\": \"2017-06-27T18:13:29.000Z\", \"Name\": \"linkedToVector\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Vulnerability\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: GitHub. 2 related cyber vulnerabilities: CWE-20, CVE-2017-0143. Most recent link (Oct 10, 2021): https://github.com/demisto/content/blob/master/Packs/RecordedFuture/Integrations/RecordedFuture/example_commands.txt\", \"Sources\": [\"MIKjae\"], \"Timestamp\": \"2021-10-10T08:21:25.825Z\", \"Name\": \"linkedToVuln\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Cyber Attack\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"10 sightings on 9 sources including: BitcoinTalk.org, @Noemi_hcke. Most recent tweet: #petya related hashes in #virustotal https://t.co/Cv7Pltjhia https://t.co/P3otYPoxBj #ransomware #malware #sha256. Most recent link (Jun 28, 2017): https://twitter.com/Menardconnect/statuses/879885997831368705\", \"Sources\": [\"ThowaF\", \"KUtKjP\", \"K84j7t\", \"MghdWI\", \"K8rrfe\", \"QlWPRW\", \"KFsPRz\", \"S-Anbb\", \"KE9dMF\"], \"Timestamp\": \"2017-06-28T02:15:44.000Z\", \"Name\": \"linkedToCyberAttack\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"834 sightings on 201 sources including: New Jersey Cybersecurity & Communications Integration Cell, lnkd.in, avtech24h.com, Malwr.com, Talos Intel. 21 related malware families including ICS Malware, PetrWrap, Emotet, Trojan, NotPetya. Most recent tweet: #ransomware 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 f65a7dadff844f2dc44a3bd43e1c0d600b1a6c66f6d02734d8f385872ccab0bc b6e8dc95ec939a1f3b184da559c8010ab3dc773e426e63e5aa7ffc44174d8a9d 9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08. Most recent link (Apr 9, 2021): https://twitter.com/RedBeardIOCs/statuses/1380600677249003521\", \"Sources\": [\"jbVMcB\", \"idn:lnkd.in\", \"idn:avtech24h.com\", \"K84j7t\", \"Sl8XTb\", \"KGRhOC\", \"NKaUXl\", \"KIoGAG\", \"PA-rR4\", \"LRlngp\", \"rN\", \"Jxh46H\", \"KFL44X\", \"TbciDE\", \"KFNVB9\", \"OJpx5g\", \"K-CGye\", \"KK6oqV\", \"WR_Ohh\", \"idn:twitter.com\", \"fgwEcq\", \"QYsx0D\", \"KIFtR_\", \"Lp_esG\", \"TSFWTw\", \"KGHzAY\", \"P_oEH3\", \"KBTQ2e\", \"QCGHCy\", \"JYxY5G\", \"UQsrUj\", \"idn:cert.ro\", \"idn:bluvector.io\", \"KFUJTL\", \"TFUkSW\", \"P0Gs9I\", \"K8ofB1\", \"KVnnHP\", \"TpaXxw\", \"U5qdTI\", \"idn:zscaler.com\", \"L3kVdM\", \"QMfGAr\", \"KIk8aS\", \"Kzw0Pm\", \"hcELIE\", \"POs2tz\", \"KD6Na4\", \"idn:globalsecuritymag.com\", \"LDd0sl\", \"KVP0jz\", \"Lj8CsQ\", \"K8rrfe\", \"LDejRI\", \"J-y3tn\", \"WXutod\", \"idn:infosecurityfactory.nl\", \"LBlc7C\", \"idn:bg.org.tr\", \"QS89Bd\", \"K9SiDc\", \"Qe89bv\", \"TiY1wu\", \"idn:undernews.fr\", \"idn:iteefactory.nl\", \"KFRGd_\", \"KFVuR_\", \"4n\", \"S-Anbb\", \"KFNZEC\", \"TSazOG\", \"K9Skh1\", \"MghdWI\", \"idn:securityiscoming.com\", \"QS89BG\", \"LVg9nH\", \"KFiGli\", \"K9Vq9B\", \"KLbNtt\", \"VyWQM7\", \"NTakwX\", \"KGoarP\", \"idn:gelsene.net\", \"LwURWv\", \"KGX8VB\", \"ThoB0I\", \"TAIz7D\", \"QBHQ61\", \"TiY1w7\", \"idn:kompasiana.com\", \"idn:t.co\", \"KfDTG0\", \"idn:ictsecuritymagazine.com\", \"Liz5-u\", \"MIKjae\", \"JYxY8X\", \"KUtKjP\", \"idn:cert.pl\", \"Lpm4nc\", \"idn:boozallen.com\", \"RVFHk_\", \"KGmazP\", \"M_7iBk\", \"TStw1W\", \"LFcJLk\", \"K0TN7r\", \"KVRURg\", \"UNe62M\", \"iL8bPu\", \"K76BjK\", \"VRixQe\", \"idn:dfir.pro\", \"KF-l77\", \"idn:gixtools.net\", \"P_oIyV\", \"KGzicb\", \"LGryD9\", \"idn:fb.me\", \"K5nCn5\", \"ThKuX0\", \"SYrUYn\", \"KFKbZE\", \"MAe5tQ\", \"KGm6gS\", \"W4ygGi\", \"g9rk5F\", \"idn:menshaway.blogspot.com\", \"KFsPRz\", \"LDm9iS\", \"RV8KWp\", \"KTuH6e\", \"P_uJi3\", \"KG_Bgt\", \"QAmbRP\", \"idn:csirt.cz\", \"LZYvHh\", \"L0HtmN\", \"KWLqO-\", \"LtUj1D\", \"QMTzDr\", \"idn:dy.si\", \"Lo8Box\", \"K-4reD\", \"KFTeBZ\", \"KKzFno\", \"QMTzEI\", \"KFYLd8\", \"KGABt4\", \"LIizBt\", \"idn:herjavecgroup.com\", \"QAAZRn\", \"K66Zgw\", \"KWz-My\", \"Lb0b3F\", \"idn:emsisoft.vn\", \"LodOTm\", \"KE9dMF\", \"O-Wf5x\", \"LG2dQX\", \"P_-RZy\", \"LK7o9D\", \"K60PUk\", \"KKUqfz\", \"idn:logrhythm.com\", \"Jv_xrR\", \"LP7dc7\", \"MFNOaz\", \"TefIES\", \"KGdGg3\", \"KHNdvY\", \"QBTxvB\", \"idn:swordshield.com\", \"ThowaF\", \"idn:binarydefense.com\", \"idn:indusface.com\", \"QBtnC2\", \"QlWPRW\", \"KHZhjO\", \"idn:idcloudhost.com\", \"LRFVsB\", \"KG2JTH\", \"KIm1im\", \"LAfpKN\", \"BaV\", \"KGW3VP\", \"KFcp5q\", \"LCN_6T\", \"idn:avastvn.com\", \"KFTnbG\", \"TiCWjw\", \"Lmhpq3\", \"KGS-xC\", \"KFVthB\", \"idn:finyear.com\", \"KFji4N\", \"P_7M19\", \"K-b0DI\", \"LV1UMS\", \"idn:safe-cyberdefense.com\", \"Kjk3fx\", \"Q1wlJN\"], \"Timestamp\": \"2021-04-09T19:17:06.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Reported by DHS AIS\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-21cebba6-46ed-464e-ad5a-32a8063e1400 (Jun 27, 2017).\", \"Sources\": [\"UZNze8\"], \"Timestamp\": \"2017-06-27T17:18:01.000Z\", \"Name\": \"dhsAis\", \"MitigationString\": \"\", \"Criticality\": 3.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Jun 27, 2017): ReversingLabs malware file analysis.\", \"Sources\": [\"TAIz7D\", \"TbciDE\", \"doLlw5\"], \"Timestamp\": \"2020-12-17T22:59:03.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745", "Risk": "89", "RiskString": "8/14"} +{"Algorithm": "SHA-256", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\", \"Sources\": [\"Rlso4a\", \"hkE5DK\", \"TZRwk8\", \"J5NRun\"], \"Timestamp\": \"2021-12-21T08:40:00.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Attack Vector\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\", \"Sources\": [\"WlbRkJ\", \"ha2FFj\", \"K7wUX2\", \"P_ivKa\", \"J-mrOR\", \"P_upBR\"], \"Timestamp\": \"2021-12-25T03:23:47.000Z\", \"Name\": \"linkedToVector\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Cyber Attack\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429\", \"Sources\": [\"Y7TWfI\"], \"Timestamp\": \"2021-10-18T12:09:43.000Z\", \"Name\": \"linkedToCyberAttack\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"47 sightings on 16 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 18 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\", \"Sources\": [\"TGXqeD\", \"W4ygGi\", \"L3kVdM\", \"QMfGAr\", \"kuKt0c\", \"QAy9GA\", \"JOU\", \"MIKjae\", \"P_oIyV\", \"QJ6TQK\", \"idn:droppdf.com\", \"Ql9O5c\", \"QAmbRP\", \"Tq2nAb\", \"TbciDE\", \"idn:index-of.es\"], \"Timestamp\": \"2021-11-27T23:07:37.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: ReversingLabs. Most recent link (Jul 1, 2019): ReversingLabs malware file analysis.\", \"Sources\": [\"TbciDE\"], \"Timestamp\": \"2019-07-01T00:00:00.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "ad2ad0249fafe85877bc79a01e1afd1a44d983c064ad8cb5bc694d29d166217b", "Risk": "89", "RiskString": "5/14"} +{"Algorithm": "SHA-256", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Trend Micro. Most recent link (Mar 11, 2021): https://documents.trendmicro.com/assets/pdf/Technical_Brief_Uncleanable_and_Unkillable_The_Evolution_of_IoT_Botnets_Through_P2P_Networking.pdf\", \"Sources\": [\"T5\"], \"Timestamp\": \"2021-03-11T00:00:00.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Attack Vector\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"31 sightings on 4 sources: @m0rb, @bad_packets, @InfoSex11, @luc4m. 2 related attack vectors: DDOS, Command Injection. Most recent tweet: 2021-06-17T23:29:30 - Commented: https://t.co/j2a05iXOiI #malware #commandinjection. Most recent link (Jun 17, 2021): https://twitter.com/m0rb/statuses/1405668962462011401\", \"Sources\": [\"KFwzec\", \"TGgDPZ\", \"cgGiXI\", \"LMcjZ7\"], \"Timestamp\": \"2021-06-17T23:29:31.000Z\", \"Name\": \"linkedToVector\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Cyber Attack\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"3 sightings on 2 sources: @bad_packets, @swarmdotmarket. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155\", \"Sources\": [\"TGgDPZ\", \"UBjcy3\"], \"Timestamp\": \"2020-04-20T21:22:47.000Z\", \"Name\": \"linkedToCyberAttack\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"87 sightings on 15 sources including: lumen.com, HackDig Posts, Anquanke News, Daily Dot, centurylink.com. 7 related malware families including Mozi Botnet, Trojan, Qbot, Mirai, DDOS Toolkit. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec. Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155\", \"Sources\": [\"idn:lumen.com\", \"POs2u-\", \"U13S_U\", \"Jzl3yj\", \"idn:centurylink.com\", \"doLlw5\", \"POs2t2\", \"idn:cyberswachhtakendra.gov.in\", \"idn:hackxsecurity.com\", \"TGgDPZ\", \"Jv_xrR\", \"TSFWTv\", \"LMcjZ7\", \"UBjcy3\", \"TbciDE\"], \"Timestamp\": \"2020-04-20T21:22:47.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Nov 28, 2019): ReversingLabs malware file analysis.\", \"Sources\": [\"TAIz7D\", \"TbciDE\", \"doLlw5\"], \"Timestamp\": \"2021-04-04T07:46:20.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "01ba1fb41632594997a41d0c3a911ae5b3034d566ebb991ef76ad76e6f9e283a", "Risk": "89", "RiskString": "5/14"} +{"Algorithm": "SHA-256", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"45 sightings on 9 sources including: Security Bloggers Network, Bleeping Computer, Guided Collection, Bleepingcomputer Forums, TheServerSide.com | Updates. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\", \"Sources\": [\"NSAcUx\", \"J6UzbO\", \"Rlso4a\", \"hkE5DK\", \"cJMUDF\", \"TZRwk8\", \"QMTzEI\", \"LUhTGd\", \"J5NRun\"], \"Timestamp\": \"2021-12-21T08:40:00.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Attack Vector\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"29 sightings on 24 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @rpsanch, @rce_coder. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\", \"Sources\": [\"T1bwMv\", \"LC-zVm\", \"P_upBR\", \"T2OA5Q\", \"K20lXV\", \"TGgDPZ\", \"hkIDTa\", \"LqRZCN\", \"Vd51cf\", \"ha2FFj\", \"UmsU31\", \"ddafo3\", \"K7wUX2\", \"P_ivKa\", \"idn:wordpress.com\", \"J-mrOR\", \"QPbAan\", \"VeioBt\", \"WlbRkJ\", \"TvfQzk\", \"TP1vbk\", \"SrKvJ0\", \"SqCj4s\", \"VXaDYo\"], \"Timestamp\": \"2021-12-25T03:23:47.000Z\", \"Name\": \"linkedToVector\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Vulnerability\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: Messaging Platforms - Uncategorized. 2 related cyber vulnerabilities: CVE-2016-6663, CWE-362.\", \"Sources\": [\"Y7TWfI\"], \"Timestamp\": \"2021-12-29T07:27:12.565Z\", \"Name\": \"linkedToVuln\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Cyber Attack\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"10 sightings on 7 sources including: SANS Institute Course Selector Results, Messaging Platforms - Uncategorized, @ecstatic_nobel, @Artilllerie. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289\", \"Sources\": [\"Ym7dzt\", \"LKKAV1\", \"OuKV3V\", \"VeioBt\", \"Y7TWfI\", \"KGS-xC\", \"KFSXln\"], \"Timestamp\": \"2019-05-28T14:17:41.000Z\", \"Name\": \"linkedToCyberAttack\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"114 sightings on 42 sources including: Doc Player, GhostBin, Codex - Recent changes en, droppdf.com, ReversingLabs. 41 related malware families including Dardesh, AZORult, Emotet, GandCrab, Offensive Security Tools (OST). Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\", \"Sources\": [\"QWOrKl\", \"LKKAV1\", \"W4ygGi\", \"PATKM7\", \"T1bwMv\", \"LjkJhE\", \"kuKt0c\", \"QAy9GA\", \"LbYmLr\", \"K20lXV\", \"QZe7TG\", \"idn:droppdf.com\", \"QAmbRP\", \"TbciDE\", \"P_j5Dw\", \"QNmgPm\", \"TGXqeD\", \"POs2u-\", \"KGS-xC\", \"L3kVdM\", \"QMfGAr\", \"h6VVAH\", \"doLlw5\", \"UrsUKT\", \"JOU\", \"MIKjae\", \"P_oIyV\", \"QJ6TQK\", \"RfVd0T\", \"J6UzbO\", \"POs2tz\", \"VfsacJ\", \"Jv_xrR\", \"Ql9O5c\", \"USKpXp\", \"TP1vbk\", \"SrKvJ0\", \"Tq2nAb\", \"KFSXln\", \"P_ov9o\", \"VXaDYo\", \"idn:index-of.es\"], \"Timestamp\": \"2021-11-27T23:07:37.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"2 sightings on 2 sources: ReversingLabs, PolySwarm. Most recent link (Apr 19, 2018): ReversingLabs malware file analysis.\", \"Sources\": [\"TbciDE\", \"doLlw5\"], \"Timestamp\": \"2021-02-10T09:10:10.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "fecddb7f3fa478be4687ca542c0ecf232ec35a0c2418c8bfe4875686ec373c1e", "Risk": "89", "RiskString": "6/14"} +{"Algorithm": "SHA-256", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"58 sightings on 5 sources: SecureWorks, InfoCON: green, McAfee, Talos Intel, Kaspersky Securelist and Lab. Most recent link (Jun 28, 2018): https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27077/en_US/McAfee_Labs_WannaCry_June24_2018.pdf\", \"Sources\": [\"Z2mQh2\", \"2d\", \"rN\", \"PA-rR4\", \"4n\"], \"Timestamp\": \"2018-06-28T08:11:36.570Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1688 sightings on 26 sources including: lnkd.in, Doc Player, Cyber4Sight, voicebox.pt, VKontakte. 2 related malware families: Wcry, Ransomware. Most recent link (Sep 13, 2017): https://malwr.com/analysis/ZmIzN2E3MzQyM2I0NDYwODllOWRhMmQxODg3YzMxZDA/\", \"Sources\": [\"idn:lnkd.in\", \"W4ygGi\", \"S2tpaX\", \"idn:voicebox.pt\", \"SIjHV9\", \"PJHGaq\", \"PA-rR4\", \"Z2mQh2\", \"e_\", \"idn:gofastbuy.com\", \"idn:ziftsolutions.com\", \"POs2u-\", \"KHpcuE\", \"QccsRc\", \"idn:dfir.pro\", \"idn:nksc.lt\", \"idn:dy.si\", \"KZFCph\", \"rN\", \"QYsx0D\", \"idn:logrhythm.com\", \"Jv_xrR\", \"idn:safe-cyberdefense.com\", \"4n\", \"QS89Bx\", \"NKaUXl\"], \"Timestamp\": \"2017-09-13T00:00:00.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"2 sightings on 1 source: Recorded Future Malware Detonation.\", \"Sources\": [\"TAIz7D\"], \"Timestamp\": \"2020-10-13T10:46:31.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b", "Risk": "89", "RiskString": "3/14"} +{"Algorithm": "SHA-256", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\", \"Sources\": [\"Rlso4a\", \"hkE5DK\", \"TZRwk8\", \"J5NRun\"], \"Timestamp\": \"2021-12-21T08:40:00.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Attack Vector\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\", \"Sources\": [\"WlbRkJ\", \"ha2FFj\", \"K7wUX2\", \"P_ivKa\", \"J-mrOR\", \"P_upBR\"], \"Timestamp\": \"2021-12-25T03:23:47.000Z\", \"Name\": \"linkedToVector\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Cyber Attack\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429\", \"Sources\": [\"Y7TWfI\"], \"Timestamp\": \"2021-10-18T12:09:43.000Z\", \"Name\": \"linkedToCyberAttack\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"43 sightings on 14 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 19 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: RT @demonslay335: #STOP #Djvu #Ransomware extension \\\".mogera\\\" (v090): https://t.co/wlMcSE2EHj | https://t.co/XAYkOoOReU. Most recent link (May 27, 2019): https://twitter.com/DrolSecurity/statuses/1133117241388621825\", \"Sources\": [\"TGXqeD\", \"W4ygGi\", \"L3kVdM\", \"QMfGAr\", \"QAy9GA\", \"JOU\", \"MIKjae\", \"P_oIyV\", \"QJ6TQK\", \"idn:droppdf.com\", \"Ql9O5c\", \"QAmbRP\", \"Tq2nAb\", \"idn:index-of.es\"], \"Timestamp\": \"2019-05-27T21:06:17.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: PolySwarm. Most recent link (Mar 8, 2021): https://polyswarm.network/scan/results/file/85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce\", \"Sources\": [\"doLlw5\"], \"Timestamp\": \"2021-03-08T13:00:15.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce", "Risk": "89", "RiskString": "5/14"} +{"Algorithm": "SHA-256", "EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\", \"Sources\": [\"Rlso4a\", \"hkE5DK\", \"TZRwk8\", \"J5NRun\"], \"Timestamp\": \"2021-12-21T08:40:00.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Linked to Attack Vector\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"7 sightings on 7 sources including: malwareresearch, Malwr.com, AAPKS.com, @Shouvik95232310, @santGM, @aa419. 4 related attack vectors: Phishing, Click Fraud, Typosquatting, Keylogger. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\", \"Sources\": [\"WlbRkJ\", \"ha2FFj\", \"K7wUX2\", \"NKaUXl\", \"P_ivKa\", \"J-mrOR\", \"P_upBR\"], \"Timestamp\": \"2021-12-25T03:23:47.000Z\", \"Name\": \"linkedToVector\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Cyber Attack\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429\", \"Sources\": [\"Y7TWfI\"], \"Timestamp\": \"2021-10-18T12:09:43.000Z\", \"Name\": \"linkedToCyberAttack\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Linked to Malware\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"54 sightings on 17 sources including: Ichunqiu Forum, Doc Player, Malwr.com, ArXiv, GitHub. 19 related malware families including Fakespy, Dardesh, Djvu Ransomware, SAVEfiles, Trojan. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\", \"Sources\": [\"TGXqeD\", \"W4ygGi\", \"L3kVdM\", \"QMfGAr\", \"NKaUXl\", \"kuKt0c\", \"QAy9GA\", \"JOU\", \"MIKjae\", \"P_oIyV\", \"QJ6TQK\", \"idn:droppdf.com\", \"Ql9O5c\", \"QAmbRP\", \"Tq2nAb\", \"TbciDE\", \"idn:index-of.es\"], \"Timestamp\": \"2021-11-27T23:07:37.000Z\", \"Name\": \"linkedToMalware\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Positive Malware Verdict\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: ReversingLabs. Most recent link (Aug 13, 2017): ReversingLabs malware file analysis.\", \"Sources\": [\"TbciDE\"], \"Timestamp\": \"2017-08-13T00:33:27.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "7531fcea7002c8b52a8d023d0f3bb938efb2cbfec91d2433694930b426d84865", "Risk": "89", "RiskString": "5/14"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Linked to Intrusion Method\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"7 sightings on 1 source: PasteBin. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Nov 8, 2021): https://pastebin.com/G1Jvm5T0\", \"Sources\": [\"Jv_xrR\"], \"Timestamp\": \"2021-11-08T16:27:15.000Z\", \"Name\": \"linkedIntrusion\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported as a Defanged IP\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 1 source: GitHub. Most recent link (Nov 16, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-15-IOCs-for-Matanbuchus-Qakbot-CobaltStrike-and-spambot-activity.txt\", \"Sources\": [\"MIKjae\"], \"Timestamp\": \"2021-11-16T00:00:00.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"164 sightings on 4 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions, Abuse.ch: Feodo IP Blocklist, Polyswarm Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 103.143.8.71:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651\", \"Sources\": [\"b5tNVA\", \"h_iZX8\", \"report:OtiCOp\", \"hyihHO\"], \"Timestamp\": \"2021-12-29T02:11:16.658Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}, {\"Rule\": \"Actively Communicating C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Qakbot. Communication observed on TCP:443, TCP:6881, TCP:995. Exfiltration behavior observed. Last observed on Dec 27, 2021.\", \"Sources\": [\"report:aEft3k\"], \"Timestamp\": \"2021-12-29T02:11:16.663Z\", \"Name\": \"recentActiveCnc\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "103.143.8.71", "Risk": "99", "RiskString": "4/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Linked to Intrusion Method\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: GitHub. 2 related intrusion methods: Nanocore, Remote Access Trojan. Most recent link (Jan 1, 2021): https://github.com/GlacierSheep/DomainBlockList/blob/master/trail/static_nanocore_(malware).domainset\", \"Sources\": [\"MIKjae\"], \"Timestamp\": \"2021-01-01T16:56:57.000Z\", \"Name\": \"linkedIntrusion\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Multicategory Blocklist\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 2 sources: Bitdefender IP Reputation, hpHosts Latest Additions. Bitdefender detected suspicious traffic involving 185.19.85.136 associated with Bitdefender threat name Trojan.GenericKD.34300483 on Apr 30, 2021\", \"Sources\": [\"iFMVSl\", \"Ol_aRZ\"], \"Timestamp\": \"2021-04-30T04:50:06.000Z\", \"Name\": \"multiBlacklist\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between Feb 13, 2021, and Feb 13, 2021.\", \"Sources\": [\"report:SW8xpk\"], \"Timestamp\": \"2021-12-28T19:20:46.641Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C Server\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"9 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command & Control host identified on Oct 29, 2021.\", \"Sources\": [\"b5tNVA\", \"h_iZX8\"], \"Timestamp\": \"2021-10-29T08:07:54.495Z\", \"Name\": \"intermediateCncServer\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Recently Active C&C Server\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Asyncrat. Communication observed on TCP:6060. Last observed on Dec 21, 2021.\", \"Sources\": [\"report:aEft3k\"], \"Timestamp\": \"2021-12-28T19:20:46.639Z\", \"Name\": \"intermediateActiveCnc\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"12 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command & Control host identified on Dec 24, 2021.\", \"Sources\": [\"b5tNVA\", \"h_iZX8\"], \"Timestamp\": \"2021-12-24T08:07:09.925Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "185.19.85.136", "Risk": "99", "RiskString": "6/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Linked to Intrusion Method\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"12 sightings on 2 sources: C2IntelFeeds IPC2s, @drb_ra. 2 related intrusion methods: Cobalt Strike, Offensive Security Tools (OST). Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978\", \"Sources\": [\"k_7zaW\", \"jqWX2B\"], \"Timestamp\": \"2021-11-26T15:01:53.000Z\", \"Name\": \"linkedIntrusion\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Linked to Cyber Attack\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 1 source: C2IntelFeeds IPC2s. Most recent link (Aug 15, 2021): https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/IPC2s-30day.csv?q=45.112.206.18_20210815\", \"Sources\": [\"k_7zaW\"], \"Timestamp\": \"2021-08-15T00:00:00.000Z\", \"Name\": \"linkedToCyberAttack\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported as a Defanged IP\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"10 sightings on 1 source: @drb_ra. Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978\", \"Sources\": [\"jqWX2B\"], \"Timestamp\": \"2021-11-26T15:01:53.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 2 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, Recorded Future Analyst Community Trending Indicators. Observed between Jul 8, 2021, and Dec 9, 2021.\", \"Sources\": [\"report:aD1qtM\", \"report:Tluf00\"], \"Timestamp\": \"2021-12-28T18:45:41.877Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"2 sightings on 1 source: Recorded Future Command & Control List. Command & Control host identified on Jul 5, 2021.\", \"Sources\": [\"b5tNVA\"], \"Timestamp\": \"2021-07-05T08:04:23.139Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}, {\"Rule\": \"Actively Communicating C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Cobalt Strike Team Servers. Communication observed on TCP:443, TCP:8443. Last observed on Dec 26, 2021.\", \"Sources\": [\"report:aEft3k\"], \"Timestamp\": \"2021-12-28T18:45:41.875Z\", \"Name\": \"recentActiveCnc\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "45.112.206.18", "Risk": "99", "RiskString": "6/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Linked to Intrusion Method\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"239 sightings on 5 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks, PasteBin, Cryptolaemus Pastedump. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Mar 14, 2021): https://unit42.paloaltonetworks.jp/attack-chain-overview-emotet-in-december-2020-and-january-2021/\", \"Sources\": [\"idn:paloaltonetworks.jp\", \"JwO7jp\", \"jjf3_B\", \"Jv_xrR\", \"Z7kln2\"], \"Timestamp\": \"2021-03-14T00:00:00.000Z\", \"Name\": \"linkedIntrusion\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 1 source: Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/\", \"Sources\": [\"jjf3_B\"], \"Timestamp\": \"2021-04-09T12:00:00.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Multicategory Blocklist\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"5 sightings on 1 source: AbuseIP Database. Most recent link (Aug 25, 2020): https://www.abuseipdb.com/check/190.55.186.229\", \"Sources\": [\"UneVVu\"], \"Timestamp\": \"2020-08-25T20:01:29.075Z\", \"Name\": \"multiBlacklist\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported as a Defanged IP\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"6 sightings on 3 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/\", \"Sources\": [\"idn:paloaltonetworks.jp\", \"JwO7jp\", \"jjf3_B\"], \"Timestamp\": \"2021-04-09T12:00:00.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Positive Malware Verdict\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"87 sightings on 1 source: Cryptolaemus Pastedump. Most recent link (Jan 25, 2021): https://paste.cryptolaemus.com/emotet/2021/01/25/emotet-malware-IoCs_01-25-21.html\", \"Sources\": [\"Z7kln2\"], \"Timestamp\": \"2021-01-25T23:59:00.000Z\", \"Name\": \"positiveMalwareVerdict\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Spam Source\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: External Sensor Spam. 190.55.186.229 was historically observed as spam. No longer observed as of Nov 16, 2021.\", \"Sources\": [\"kBCI-b\"], \"Timestamp\": \"2021-11-16T01:06:21.965Z\", \"Name\": \"spam\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 2 sources: University of Science and Technology of China Black IP List, Abuse.ch: Feodo IP Blocklist. Observed between Feb 26, 2021, and Dec 27, 2021.\", \"Sources\": [\"report:Q1ghC0\", \"report:OtiCOp\"], \"Timestamp\": \"2021-12-28T19:33:55.849Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C Server\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"31 sightings on 3 sources: Palo Alto Networks, Polyswarm Sandbox Analysis - Malware C2 Extractions, Unit 42 Palo Alto Networks. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample a88734cd5c38211a4168bc7701516a50e6aef5ef20d2b1a915edae23c1b345db\", \"Sources\": [\"JwO7jp\", \"hyihHO\", \"jjf3_B\"], \"Timestamp\": \"2021-10-19T12:21:34.268Z\", \"Name\": \"intermediateCncServer\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Recent Multicategory Blocklist\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: Talos IP Blacklist.\", \"Sources\": [\"report:VW6jeN\"], \"Timestamp\": \"2021-12-28T19:33:55.846Z\", \"Name\": \"recentMultiBlacklist\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"5 sightings on 2 sources: Polyswarm Sandbox Analysis - Malware C2 Extractions, Joe Security Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample c9709d56b92047cd55fb097feb6cb7a8de6f3edc5ea79a429363938a69aae580\", \"Sources\": [\"hyihHO\", \"h_iZX8\"], \"Timestamp\": \"2021-12-27T19:00:49.975Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "190.55.186.229", "Risk": "99", "RiskString": "10/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Linked to Intrusion Method\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 1 source: PasteBin. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 2, 2021): https://pastebin.com/SusxCK2b\", \"Sources\": [\"Jv_xrR\"], \"Timestamp\": \"2021-12-02T15:58:10.000Z\", \"Name\": \"linkedIntrusion\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"2 sightings on 2 sources: Recorded Future Command & Control List, Abuse.ch: Feodo IP Blocklist. Command & Control host identified on Dec 1, 2021.\", \"Sources\": [\"b5tNVA\", \"report:OtiCOp\"], \"Timestamp\": \"2021-12-01T08:06:11.827Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}, {\"Rule\": \"Actively Communicating C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Emotet. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 26, 2021.\", \"Sources\": [\"report:aEft3k\"], \"Timestamp\": \"2021-12-28T22:05:35.688Z\", \"Name\": \"recentActiveCnc\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "62.210.82.223", "Risk": "99", "RiskString": "3/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historical Honeypot Sighting\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 2 sources: Project Honey Pot, @HoneyFog. Most recent tweet: Fog44: 87.120.254.96->22. Most recent link (Dec 14, 2016): https://twitter.com/HoneyFog/statuses/809032869792378880\", \"Sources\": [\"P_izv4\", \"OSz1F0\"], \"Timestamp\": \"2016-12-14T13:50:41.000Z\", \"Name\": \"honeypot\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported as a Defanged IP\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: GitHub. Most recent link (Nov 8, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-05-TA551-IOCs.txt\", \"Sources\": [\"MIKjae\"], \"Timestamp\": \"2021-11-08T00:00:00.000Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Spam Source\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: External Sensor Spam. 87.120.254.96 was historically observed as spam. No longer observed as of Nov 16, 2021.\", \"Sources\": [\"kBCI-b\"], \"Timestamp\": \"2021-11-16T03:19:58.721Z\", \"Name\": \"spam\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Linked to Intrusion Method\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: CloudSEK. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 22, 2021): https://cloudsek.com/emotet-2-0-everything-you-need-to-know-about-the-new-variant-of-thbanking-trojan/\", \"Sources\": [\"k837l0\"], \"Timestamp\": \"2021-12-22T09:45:33.000Z\", \"Name\": \"recentLinkedIntrusion\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Recent Multicategory Blocklist\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: University of Science and Technology of China Black IP List.\", \"Sources\": [\"report:Q1ghC0\"], \"Timestamp\": \"2021-12-29T06:21:27.693Z\", \"Name\": \"recentMultiBlacklist\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"2 sightings on 2 sources: Recorded Future Command & Control List, Abuse.ch: Feodo IP Blocklist. Command & Control host identified on Nov 25, 2021.\", \"Sources\": [\"b5tNVA\", \"report:OtiCOp\"], \"Timestamp\": \"2021-11-25T08:06:42.384Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}, {\"Rule\": \"Actively Communicating C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Bazarloader. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 25, 2021.\", \"Sources\": [\"report:aEft3k\"], \"Timestamp\": \"2021-12-29T06:21:27.731Z\", \"Name\": \"recentActiveCnc\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "87.120.254.96", "Risk": "99", "RiskString": "7/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 3 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, CINS: CI Army List, Recorded Future Analyst Community Trending Indicators. Observed between Jan 22, 2021, and Sep 25, 2021.\", \"Sources\": [\"report:aD1qtM\", \"report:OchJ-t\", \"report:Tluf00\"], \"Timestamp\": \"2021-12-28T18:42:08.925Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent Multicategory Blocklist\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: DShield: Recommended Block List.\", \"Sources\": [\"report:OchJ-o\"], \"Timestamp\": \"2021-12-28T18:42:08.917Z\", \"Name\": \"recentMultiBlacklist\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"19 sightings on 2 sources: Recorded Future Command & Control List, @TheDFIRReport. Most recent tweet: Here's some newer C2 servers we're tracking: #BazarLoader 64.227.73.80 64.225.71.198 #Covenant 167.71.67.196 45.146.165.76 #PoshC2 193.36.15.192 #Empire 64.227.21.255 #Metasploit 91.221.70.143 Full list available @ https://t.co/QT6o626hsR #ThreatFeed. Most recent link (Sep 1, 2021): https://twitter.com/TheDFIRReport/statuses/1433055791964049412\", \"Sources\": [\"b5tNVA\", \"dZgcRz\"], \"Timestamp\": \"2021-09-01T13:15:00.000Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}, {\"Rule\": \"Actively Communicating C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Covenant. Communication observed on TCP:7443. Exfiltration behavior observed. Last observed on Dec 27, 2021.\", \"Sources\": [\"report:aEft3k\"], \"Timestamp\": \"2021-12-28T18:42:08.923Z\", \"Name\": \"recentActiveCnc\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "45.146.165.76", "Risk": "99", "RiskString": "4/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historical Open Proxies\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2339 sightings on 9 sources including: TBN, BlackHatWorld Forum, Carding Mafia Forum, Inforge Forum Hacker Trucchi Giochi Informatica, ProxyFire - The Best Proxy Software and Forum. Most recent link (Jun 29, 2019): https://Black%20Hat%20World%20Forum%20(Obfuscated)/seo/ssl-proxies-occasional-update.927669/page-44#post-12210196\", \"Sources\": [\"RqhhJr\", \"KjGS3i\", \"VU4Qnc\", \"P7sZbk\", \"OQ_oQH\", \"Qk8WdX\", \"Qk8Wdg\", \"QqgtXJ\", \"KhvyCV\"], \"Timestamp\": \"2019-06-29T01:18:00.000Z\", \"Name\": \"openProxies\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Honeypot Sighting\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: @HoneyFog. Most recent tweet: Fog44: 181.112.52.26->22. I've never seen this IP before. Most recent link (Oct 6, 2017): https://twitter.com/HoneyFog/statuses/916371734928019456\", \"Sources\": [\"P_izv4\"], \"Timestamp\": \"2017-10-06T18:37:01.000Z\", \"Name\": \"honeypot\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Linked to Intrusion Method\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"10 sightings on 3 sources: Manato Kumagai Hatena Blog, sentinelone.com, PasteBin. 6 related intrusion methods including TrickLoader, Trojan, Emotet, Banking Trojan, Trickbot. Most recent link (Feb 26, 2020): https://labs.sentinelone.com/revealing-the-trick-a-deep-dive-into-trickloader-obfuscation/\", \"Sources\": [\"TiY1wa\", \"idn:sentinelone.com\", \"Jv_xrR\"], \"Timestamp\": \"2020-02-26T15:00:17.035Z\", \"Name\": \"linkedIntrusion\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Multicategory Blocklist\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26\", \"Sources\": [\"UneVVu\"], \"Timestamp\": \"2018-08-17T00:30:42.194Z\", \"Name\": \"multiBlacklist\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical SSH/Dictionary Attacker\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26\", \"Sources\": [\"UneVVu\"], \"Timestamp\": \"2018-08-17T00:30:42.194Z\", \"Name\": \"sshDictAttacker\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 3 sources: BlockList.de: Fail2ban Reporting Service, Abuse.ch: Feodo IP Blocklist, Proxies: SOCKS Open Proxies. Observed between Jun 15, 2019, and Oct 3, 2020.\", \"Sources\": [\"report:OhgwUx\", \"report:OtiCOp\", \"report:SYQe08\"], \"Timestamp\": \"2021-12-28T22:05:41.272Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C Server\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"3 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample dcc42c0bd075f283c71ac327c845498454dcd9528386df5b296fdf89ba105bfa\", \"Sources\": [\"hyihHO\"], \"Timestamp\": \"2021-07-15T12:42:04.656Z\", \"Name\": \"intermediateCncServer\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"5 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample b827a4587bc6162715693c71e432769ec6272c130bb87e14bc683f5bd7caf834\", \"Sources\": [\"hyihHO\"], \"Timestamp\": \"2021-12-22T04:10:08.558Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "181.112.52.26", "Risk": "99", "RiskString": "8/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Linked to Intrusion Method\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"4 sightings on 1 source: PasteBin. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Nov 7, 2021): https://pastebin.com/u8neEVnz\", \"Sources\": [\"Jv_xrR\"], \"Timestamp\": \"2021-11-07T09:05:40.000Z\", \"Name\": \"linkedIntrusion\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 1 source: Abuse.ch: Feodo IP Blocklist. Observed between Nov 29, 2021, and Dec 10, 2021.\", \"Sources\": [\"report:OtiCOp\"], \"Timestamp\": \"2021-12-29T02:11:39.014Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent Honeypot Sighting\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: Project Honey Pot. Most recent link (Dec 19, 2021): https://www.projecthoneypot.org/ip_77.79.56.210\", \"Sources\": [\"OSz1F0\"], \"Timestamp\": \"2021-12-19T11:30:02.000Z\", \"Name\": \"recentHoneypot\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Recent C&C Server\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"12 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 77.79.56.210:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651\", \"Sources\": [\"b5tNVA\", \"h_iZX8\"], \"Timestamp\": \"2021-11-03T16:57:54.000Z\", \"Name\": \"intermediateCncServer\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Recently Active C&C Server\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Qakbot. Communication observed on TCP:443. Last observed on Dec 23, 2021.\", \"Sources\": [\"report:aEft3k\"], \"Timestamp\": \"2021-12-29T02:11:39.012Z\", \"Name\": \"intermediateActiveCnc\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"10 sightings on 2 sources: Recorded Future Command & Control List, Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 77.79.56.210:443 as TA0011 (Command and Control) for QakBot using configuration extraction on sample 77b34084de82afac57fbe2c6442dbe7d07c53da5ec87eaf2210b852f0d943cd5\", \"Sources\": [\"b5tNVA\", \"hyihHO\"], \"Timestamp\": \"2021-12-29T02:00:05.439Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "77.79.56.210", "Risk": "99", "RiskString": "6/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Linked to Intrusion Method\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"34 sightings on 5 sources: Malware News - Malware Analysis, News and Indicators, PasteBin, Segurana Informtica, The Cyber Feed, Kaspersky Securelist and Lab. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Dec 3, 2021): https://pastebin.com/xJ0kmeYQ\", \"Sources\": [\"gBDK5G\", \"Jv_xrR\", \"VW7VQs\", \"g162EU\", \"4n\"], \"Timestamp\": \"2021-12-03T16:51:53.000Z\", \"Name\": \"linkedIntrusion\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historical Threat Researcher\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"4 sightings on 1 source: Kaspersky Securelist and Lab. Most recent link (Sep 2, 2021): https://securelist.com/qakbot-technical-analysis/103931/\", \"Sources\": [\"4n\"], \"Timestamp\": \"2021-09-02T10:00:32.000Z\", \"Name\": \"threatResearcher\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported as a Defanged IP\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"6 sightings on 3 sources: Malware News - Malware Analysis, News and Indicators, urlscan.io, Kaspersky Securelist and Lab. Most recent link (Dec 1, 2021): https://urlscan.io/result/c5b4e2d5-acf0-4fc5-b7bd-e8afac3e5f5a/\", \"Sources\": [\"gBDK5G\", \"WNRa7q\", \"4n\"], \"Timestamp\": \"2021-12-01T10:54:33.863Z\", \"Name\": \"defanged\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Reported in Threat List\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"Previous sightings on 1 source: Abuse.ch: Feodo IP Blocklist. Observed between Nov 19, 2021, and Nov 21, 2021.\", \"Sources\": [\"report:OtiCOp\"], \"Timestamp\": \"2021-12-29T07:17:33.217Z\", \"Name\": \"historicalThreatListMembership\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recent C&C Server\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"234 sightings on 4 sources: Recorded Future Command & Control List, Polyswarm Sandbox Analysis - Malware C2 Extractions, PasteBin, Joe Security Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 24.139.72.117:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651\", \"Sources\": [\"b5tNVA\", \"hyihHO\", \"Jv_xrR\", \"h_iZX8\"], \"Timestamp\": \"2021-11-03T16:57:54.000Z\", \"Name\": \"intermediateCncServer\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Recently Active C&C Server\", \"CriticalityLabel\": \"Suspicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Qakbot. Communication observed on TCP:443. Last observed on Dec 23, 2021.\", \"Sources\": [\"report:aEft3k\"], \"Timestamp\": \"2021-12-29T07:17:33.215Z\", \"Name\": \"intermediateActiveCnc\", \"MitigationString\": \"\", \"Criticality\": 2.0}, {\"Rule\": \"Current C&C Server\", \"CriticalityLabel\": \"Very Malicious\", \"EvidenceString\": \"87 sightings on 2 sources: Polyswarm Sandbox Analysis - Malware C2 Extractions, Joe Security Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 24.139.72.117:443 as TA0011 (Command and Control) for QakBot using configuration extraction on sample 7ea5720ac7efeb49873f95870d546632d6c8c187ee6e2fc515acfe974483ee0e\", \"Sources\": [\"hyihHO\", \"h_iZX8\"], \"Timestamp\": \"2021-12-29T07:00:21.416Z\", \"Name\": \"recentCncServer\", \"MitigationString\": \"\", \"Criticality\": 4.0}]}", "Name": "24.139.72.117", "Risk": "99", "RiskString": "7/64"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged URL\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"66 sightings on 22 sources including: Ars Technica, fook.news, urdupresss.com, HackDig Posts, apple.news. Most recent link (Jul 20, 2021): https://techsecuritenews.com/solarwinds-pirates-utilisent-nouvelle-faille-zero-day-attaques/\", \"Sources\": [\"Ctq\", \"idn:fook.news\", \"idn:urdupresss.com\", \"POs2u-\", \"idn:apple.news\", \"idn:cryptoinfoos.com.ng\", \"g9rk5F\", \"idn:thewindowsupdate.com\", \"idn:nationalcybersecuritynews.today\", \"gBDK5G\", \"idn:microsoft.com\", \"idn:techsecuritenews.com\", \"idn:mblogs.info\", \"J6UzbO\", \"idn:viralamo.com\", \"idn:sellorbuyhomefast.com\", \"idn:crazyboy.tech\", \"idn:times24h.com\", \"idn:buzzfeeg.com\", \"idn:dsmenders.com\", \"WroSbs\", \"idn:vzonetvgh.com\"], \"Timestamp\": \"2021-07-20T00:00:00.000Z\", \"Name\": \"defangedURL\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Reported by Insikt Group\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Insikt Group. 1 report: SolarWinds Fixes Critical Vulnerability in Serv-U Managed File Transfer and Secure FTP Products. Most recent link (Jul 10, 2021): https://app.recordedfuture.com/live/sc/1GnDrn8zigTd\", \"Sources\": [\"VKz42X\"], \"Timestamp\": \"2021-07-10T00:00:00.000Z\", \"Name\": \"recentAnalystNote\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "http://144.34.179.162/a", "Risk": "87", "RiskString": "2/24"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged URL\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"41 sightings on 19 sources including: Stock market news Company News MarketScreenercom, GlobeNewswire | Software, Yahoo!, globenewswirecom, otcdynamics.com. Most recent link (Oct 3, 2021): https://telecomkh.info/?p=4004\", \"Sources\": [\"XBl0xf\", \"c2unu0\", \"DVW\", \"NPgRlV\", \"idn:otcdynamics.com\", \"idn:norteenlinea.com\", \"N4OmGX\", \"idn:snewsonline.com\", \"idn:nationalcybersecuritynews.today\", \"dCod5e\", \"hZ14Az\", \"idn:securityopenlab.it\", \"idn:clevertechmx.blogspot.com\", \"cJzvLR\", \"eNeV39\", \"dCotni\", \"dCo6X1\", \"jB6Hnn\", \"idn:telecomkh.info\"], \"Timestamp\": \"2021-10-03T12:53:49.605Z\", \"Name\": \"defangedURL\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Phishing Techniques\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-11-14T00:00:00.000Z\", \"Name\": \"phishingSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Distribution\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-11-14T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Active URL on Weaponized Domain\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: No-IP. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 20, 2021.\", \"Sources\": [\"report:aRJ1CU\"], \"Timestamp\": \"2021-12-29T07:08:29.105Z\", \"Name\": \"recentWeaponizedURL\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "http://adminsys.serveftp.com/nensa/fabio/ex/478632215/zer7855/nuns566623", "Risk": "85", "RiskString": "4/24"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged URL\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"17 sightings on 14 sources including: Security Affairs, sensorstechforum.com, Heimdal Security Blog, securitynewspaper, BBS Kafan Card Forum. Most recent link (Dec 22, 2021): https://d335luupugsy2.cloudfront.net/cms%2Ffiles%2F183750%2F1640120040Log4j_-_Explorao_por_grupos_APT.pdf\", \"Sources\": [\"JNe6Hu\", \"TQnwKJ\", \"OfMf0W\", \"TefIEN\", \"VyuDZP\", \"Z7kln5\", \"bd-Dtt\", \"kKLjNc\", \"Y7TWfI\", \"idn:redpacketsecurity.com\", \"idn:eccouncil.org\", \"idn:comparaland.com\", \"idn:d335luupugsy2.cloudfront.net\", \"KVRURg\"], \"Timestamp\": \"2021-12-22T16:01:42.134Z\", \"Name\": \"defangedURL\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Reported by Insikt Group\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Insikt Group. 1 report: Khonsari Ransomware and Orcus RAT Exploit Log4Shell (CVE-2021-44228), Samples Uploaded on MalwareBazaar. Most recent link (Dec 17, 2021): https://app.recordedfuture.com/live/sc/4SWiMAS816Gj\", \"Sources\": [\"VKz42X\"], \"Timestamp\": \"2021-12-17T00:00:00.000Z\", \"Name\": \"recentAnalystNote\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "http://3.145.115.94/zambo/groenhuyzen.exe", "Risk": "79", "RiskString": "2/24"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged URL\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"53 sightings on 14 sources including: HackDig Posts, Anquanke News, mrhacker.co, Sesin at, Check Point Research. Most recent link (Feb 6, 2021): https://cdn.www.gob.pe/uploads/document/file/1580907/Alerta%20integrada%20de%20seguridad%20digital%20N%C2%B0%xxx-xx-xxxx-PECERT%20.pdf\", \"Sources\": [\"POs2u-\", \"U13S_U\", \"idn:mrhacker.co\", \"Z3TZAQ\", \"N4OmGX\", \"UqKvRr\", \"gBDK5G\", \"JExgHv\", \"QxXv_c\", \"J6UzbO\", \"eTNyK6\", \"idn:privacy.com.sg\", \"e6Ewt_\", \"idn:reportcybercrime.com\"], \"Timestamp\": \"2021-02-06T12:52:09.042Z\", \"Name\": \"defangedURL\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Detected Malware Distribution\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-12-28T00:00:00.000Z\", \"Name\": \"recentMalwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "http://gxbrowser.net", "Risk": "79", "RiskString": "2/24"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged URL\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"33 sightings on 12 sources including: Palo Alto Networks, tistory.com, HackDig Posts, Anquanke News, airmagnet.technology. Most recent tweet: Continued MR.Dropper's attack. (Targething korean cryptocurrency exchange) #hcapital #ioc MD5 : eb459b47be479b61375d7b3c7c568425 URL : hxxps://881[.]000webhostapp[.]com/1.txt PDB : D:\\\\Attack\\\\DropperBuild\\\\x64\\\\Release\\\\Dropper.pdb https://t.co/FpsinliQqx [Beyond The Binary]. Most recent link (Sep 3, 2018): https://twitter.com/wugeej/statuses/1036413512732426240\", \"Sources\": [\"JwO7jp\", \"idn:tistory.com\", \"POs2u-\", \"U13S_U\", \"ThoB0I\", \"idn:airmagnet.technology\", \"LErKlN\", \"WuLz1r\", \"KdwTwF\", \"VfsacJ\", \"jjf3_B\", \"idn:brica.de\"], \"Timestamp\": \"2018-09-03T00:40:11.000Z\", \"Name\": \"defangedURL\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Referenced by Insikt Group\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"2 sightings on 1 source: Insikt Group. 2 reports including \\\"Fractured Block\u201d Campaign Targets Korean Users. Most recent link (Dec 09, 2018): https://app.recordedfuture.com/live/sc/1RuTxKrDf8Qt\", \"Sources\": [\"VKz42X\"], \"Timestamp\": \"2018-12-09T00:00:00.000Z\", \"Name\": \"relatedNote\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Active URL on Weaponized Domain\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: 000Webhost. Behavior observed: Malware Distribution. Last observed on Oct 16, 2021.\", \"Sources\": [\"report:aRJ1CU\"], \"Timestamp\": \"2021-12-29T07:07:42.477Z\", \"Name\": \"recentWeaponizedURL\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "https://881.000webhostapp.com/1.txt", "Risk": "78", "RiskString": "3/24"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged URL\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"38 sightings on 7 sources including: cybersecdn.com, WeLiveSecurity Spain, deepcheck.one, hackeridiot.com, PasteBin. Most recent link (May 27, 2021): https://cybersecdn.com/index.php/2021/05/27/janeleiro-the-time-traveler-a-new-old-banking-trojan-in-brazil/\", \"Sources\": [\"idn:cybersecdn.com\", \"fWD1r9\", \"idn:deepcheck.one\", \"idn:hackeridiot.com\", \"Jv_xrR\", \"ONMgMx\", \"idn:nationalcybersecuritynews.today\"], \"Timestamp\": \"2021-05-27T22:48:00.256Z\", \"Name\": \"defangedURL\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Distribution\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-06-15T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Reported by Insikt Group\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Insikt Group. 1 report: New Janeleiro Banking Trojan Targets Corporate Users in Brazil. Most recent link (Apr 06, 2021): https://app.recordedfuture.com/live/sc/4wolQHrxLiwd\", \"Sources\": [\"VKz42X\"], \"Timestamp\": \"2021-04-06T00:00:00.000Z\", \"Name\": \"recentAnalystNote\", \"MitigationString\": \"\", \"Criticality\": 3.0}, {\"Rule\": \"Recently Active URL on Weaponized Domain\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: DuckDNS. Behavior observed: Malware Distribution. Last observed on Oct 15, 2021.\", \"Sources\": [\"report:aRJ1CU\"], \"Timestamp\": \"2021-12-29T06:34:00.698Z\", \"Name\": \"recentWeaponizedURL\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "http://comunicador.duckdns.org/catalista/lixo/index.php", "Risk": "78", "RiskString": "4/24"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Recently Active URL on Weaponized Domain\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: Afraid.org. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 28, 2021.\", \"Sources\": [\"report:aRJ1CU\"], \"Timestamp\": \"2021-12-28T22:15:49.631Z\", \"Name\": \"recentWeaponizedURL\", \"MitigationString\": \"\", \"Criticality\": 3.0}, {\"Rule\": \"Recently Detected Phishing Techniques\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"2 sightings on 2 sources: Bitdefender, Urlscan.io. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.\", \"Sources\": [\"d3Awkm\", \"eKv4Jm\"], \"Timestamp\": \"2021-12-28T00:00:00.000Z\", \"Name\": \"recentPhishingSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 3.0}, {\"Rule\": \"Recently Detected Malware Distribution\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-12-28T00:00:00.000Z\", \"Name\": \"recentMalwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "https://www.jeanninecatddns.chickenkiller.com/signin-authflow", "Risk": "75", "RiskString": "3/24"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged URL\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"24 sightings on 9 sources including: Malware News - Malware Analysis, News and Indicators, microsoft.com, sociabble.com, 4-traders.com, MarketScreener.com | Stock Market News. Most recent link (Aug 13, 2021): https://www.marketscreener.com/quote/stock/MICROSOFT-CORPORATION-4835/news/Microsoft-Attackers-use-Morse-code-other-encryption-methods-in-evasive-phishing-campaign-36161110/?utm_medium=RSS&utm_content=20210813\", \"Sources\": [\"gBDK5G\", \"idn:microsoft.com\", \"idn:sociabble.com\", \"KBTQ2e\", \"dCotni\", \"g9rk5F\", \"Z7kln5\", \"idn:cda.ms\", \"idn:thewindowsupdate.com\"], \"Timestamp\": \"2021-08-13T17:03:19.000Z\", \"Name\": \"defangedURL\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Malware Distribution\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Aug 13, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-08-13T00:00:00.000Z\", \"Name\": \"malwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Reported by Insikt Group\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Insikt Group. 1 report: Microsoft Warns of Attacks Targeting Microsoft Office 365 Users. Most recent link (Aug 12, 2021): https://app.recordedfuture.com/live/sc/4BBhpn1ApBQR\", \"Sources\": [\"VKz42X\"], \"Timestamp\": \"2021-08-12T00:00:00.000Z\", \"Name\": \"recentAnalystNote\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "http://coollab.jp/dir/root/p/09908.js", "Risk": "75", "RiskString": "3/24"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged URL\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"23 sightings on 9 sources including: The Official Google Blog, eccouncil.org, frsecure.com, SoyaCincau, PasteBin. Most recent tweet: Actor controlled sites and accounts Research Blog https://blog.br0vvnn[.]io. Most recent link (Jan 27, 2021): https://twitter.com/techn0m4nc3r/statuses/1354296736357953539\", \"Sources\": [\"Gzt\", \"idn:eccouncil.org\", \"idn:frsecure.com\", \"J-8-Nr\", \"Jv_xrR\", \"g9rk5F\", \"cUg0pv\", \"K5LKj8\", \"fVAueu\"], \"Timestamp\": \"2021-01-27T05:14:38.000Z\", \"Name\": \"defangedURL\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Historically Detected Phishing Techniques\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 30, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-05-30T00:00:00.000Z\", \"Name\": \"phishingSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Reported by Insikt Group\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Insikt Group. 1 report: Google Warns of Ongoing Attacks Targeting Security Researchers. Most recent link (Jan 25, 2021): https://app.recordedfuture.com/live/sc/5QCqZ2ZH4lwc\", \"Sources\": [\"VKz42X\"], \"Timestamp\": \"2021-01-25T00:00:00.000Z\", \"Name\": \"recentAnalystNote\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "https://blog.br0vvnn.io", "Risk": "75", "RiskString": "3/24"} +{"EvidenceDetails": "{\"EvidenceDetails\": [{\"Rule\": \"Historically Reported as a Defanged URL\", \"CriticalityLabel\": \"Unusual\", \"EvidenceString\": \"24 sightings on 10 sources including: lnkd.in, digitalforensicsmagazineblog PH, mediosdemexico.com, Palo Alto Networks, Security Art Work. Most recent link (Mar 4, 2016): https://lnkd.in/egi-nMa\", \"Sources\": [\"idn:lnkd.in\", \"JNe6Gc\", \"idn:mediosdemexico.com\", \"JwO7jp\", \"LCN_6T\", \"KA0p6S\", \"LErKlN\", \"jjf3_B\", \"KE9Xit\", \"J4bouj\"], \"Timestamp\": \"2016-03-04T14:33:36.543Z\", \"Name\": \"defangedURL\", \"MitigationString\": \"\", \"Criticality\": 1.0}, {\"Rule\": \"Recently Detected Malware Distribution\", \"CriticalityLabel\": \"Malicious\", \"EvidenceString\": \"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 27, 2021.\", \"Sources\": [\"d3Awkm\"], \"Timestamp\": \"2021-12-27T00:00:00.000Z\", \"Name\": \"recentMalwareSiteDetected\", \"MitigationString\": \"\", \"Criticality\": 3.0}]}", "Name": "http://init.icloud-analysis.com", "Risk": "75", "RiskString": "2/24"} diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_assorted.json.log-expected.json b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_assorted.json.log-expected.json new file mode 100644 index 000000000000..bf98453990f9 --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_assorted.json.log-expected.json @@ -0,0 +1,4125 @@ +[ + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 96.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 0, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "18 sightings on 2 sources: Proofpoint, The Daily Advance. Most recent link (Nov 12, 2018): https://www.proofpoint.com/us/threat-insight/post/sload-and-ramnit-pairing-sustained-campaigns-against-uk-and-italy#.W-nmxyGcuiY.twitter", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "QQA438", + "KvPSaU" + ], + "Timestamp": "2018-11-12T20:48:08.675Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Mar 23, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-03-23T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: Proofpoint Researchers Observe sLoad and Ramnit in Campaigns Against The U.K. and Italy. Most recent link (Oct 23, 2018): https://app.recordedfuture.com/live/sc/4KSWum2M6Lx7", + "MitigationString": "", + "Name": "relatedNote", + "Rule": "Historically Referenced by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2018-10-23T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "21 sightings on 4 sources: Proofpoint, PasteBin, The Daily Advance, @DGAFeedAlerts. Most recent tweet: New ramnit Dom: xohrikvjhiu[.]eu IP: 13[.]90[.]196[.]81 NS: https://t.co/nTqEOuAW2E https://t.co/QdrtFSplyz. Most recent link (Nov 16, 2019): https://twitter.com/DGAFeedAlerts/statuses/1195824847915491329", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "QQA438", + "Jv_xrR", + "SlNfa3", + "KvPSaU" + ], + "Timestamp": "2019-11-16T22:03:55.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T07:12:02.455Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "xohrikvjhiu.eu" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 95.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 2445, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-07-06T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "ST7rfx" + ], + "Timestamp": "2017-05-17T19:31:06.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 9, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-07-09T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-216d34d4-67bd-4add-ae6e-4ddec27dcb0e (Jul 25, 2019).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Historically Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2019-07-25T00:46:19.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 19, 2021, and Jul 21, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:Tluf00" + ], + "Timestamp": "2021-12-29T07:21:52.311Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T07:21:52.303Z" + } + ], + "recordedfuture.risk_string": "6/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "wgwuhauaqcrx.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 95.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 5039, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-05-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-30T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: wbmpvebw[.]com IP: 209[.]99[.]40[.]220 NS: https://t.co/bH4I7LoMNf https://t.co/KTCPYU87bT. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551578264821760", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2020-01-04T20:03:37.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Feb 18, 2021, and Feb 24, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:Tluf00" + ], + "Timestamp": "2021-12-29T07:16:05.008Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T07:16:05.007Z" + } + ], + "recordedfuture.risk_string": "6/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "wbmpvebw.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 7641, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2016-04-11T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-15T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: ckgryagcibbcf[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333576053207040", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2021-02-01T20:08:18.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:40:44.358Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "ckgryagcibbcf.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 9829, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-05-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 17, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-17T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jpuityvakjgg[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333600627683330", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2021-02-01T20:08:24.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:46:28.155Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "jpuityvakjgg.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 12014, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-05-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-30T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jexgpprgph[.]com IP: 209[.]99[.]40[.]222 NS: https://t.co/IGcQwMvzjy https://t.co/J2gdsVMl8U. Most recent link (Dec 13, 2018): https://twitter.com/DGAFeedAlerts/statuses/1073277207919947778", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2018-12-13T18:03:21.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:40:30.778Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "jexgpprgph.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 14197, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2016-04-11T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 27, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-07-27T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: cascotqhij[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/czXUwYeuxf https://t.co/nKWfZguQSF. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333566758682629", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2021-02-01T20:08:16.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:34:06.062Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "cascotqhij.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 16379, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-07-06T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "ST7rfx" + ], + "Timestamp": "2017-05-17T19:31:06.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Apr 1, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-04-01T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-e26bfe3a-8f67-4f57-9449-3f183fe94c07 (Jul 25, 2019).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Historically Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2019-07-25T01:51:04.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:45:21.381Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "npcvnorvyhelagx.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 18551, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-05-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 6, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-05-06T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: uxlyihgvfnqcrfcf[.]com IP: 209[.]99[.]40[.]224 NS: https://t.co/03Dbt4N72t https://t.co/l29AcRDSvE. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551575332982790", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2020-01-04T20:03:36.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:35:26.677Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "uxlyihgvfnqcrfcf.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 20744, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "3 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZDQ0ODcwOTZiN2FmNDExNmExYzA3YjUwOTcxYmRlMjE/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-07-06T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 6, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-05-06T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: bjfwfqviu[.]com IP: 23[.]96[.]57[.]36 NS: https://t.co/nTqEOuAW2E https://t.co/NnqzXB3b3P. Most recent link (Jul 3, 2019): https://twitter.com/DGAFeedAlerts/statuses/1146524855602429953", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2019-07-03T21:03:21.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-fd72a0d2-bcbd-43b4-910b-9898e979a562 (Jul 24, 2019).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Historically Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2019-07-24T23:40:35.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:48:58.905Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "bjfwfqviu.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 22981, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "32 sightings on 27 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @neonprimetime, @rpsanch. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "T1bwMv", + "LC-zVm", + "QFvaUy", + "P_upBR", + "T2OA5Q", + "K20lXV", + "TGgDPZ", + "hkIDTa", + "LqRZCN", + "Vd51cf", + "ha2FFj", + "UmsU31", + "K7wUX2", + "P_ivKa", + "Qj3TQr", + "idn:wordpress.com", + "J-mrOR", + "QPbAan", + "VeioBt", + "WlbRkJ", + "K7sErA", + "TvfQzk", + "TP1vbk", + "SrKvJ0", + "SqCj4s", + "VXaDYo", + "bk2VX4" + ], + "Timestamp": "2021-12-25T03:23:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "6 sightings on 6 sources including: Messaging Platforms - Uncategorized, @_mr_touch. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "XV7DoD", + "Ym7dzt", + "LKKAV1", + "VeioBt", + "Y7TWfI", + "KGS-xC" + ], + "Timestamp": "2019-05-28T14:17:41.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "119 sightings on 42 sources including: Malware-Traffic-Analysis.net - Blog Entries, Doc Player, GhostBin, Data Breach Today.eu | Updates, Codex - Recent changes en. 43 related malware families including Dardesh, AZORult, Emotet, Ryuk Ransomware, GandCrab. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "TvGJYk", + "LErKlJ", + "QWOrKl", + "LKKAV1", + "W4ygGi", + "PATKM7", + "T1bwMv", + "TY6igj", + "LjkJhE", + "kuKt0c", + "QAy9GA", + "LbYmLr", + "K20lXV", + "QZe7TG", + "idn:droppdf.com", + "QAmbRP", + "V_o1DL", + "TbciDE", + "XV7DoD", + "P_j5Dw", + "QNmgPm", + "TGXqeD", + "KGS-xC", + "L3kVdM", + "QMfGAr", + "h6VVAH", + "doLlw5", + "UrsUKT", + "JOU", + "MIKjae", + "P_oIyV", + "QJ6TQK", + "RfVd0T", + "J6UzbO", + "Ql9O5c", + "USKpXp", + "TP1vbk", + "SrKvJ0", + "Tq2nAb", + "P_ov9o", + "VXaDYo", + "idn:index-of.es" + ], + "Timestamp": "2021-11-27T23:07:37.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "5 sightings on 3 sources: Malware-Traffic-Analysis.net - Blog Entries, ReversingLabs, PolySwarm. Most recent link (Dec 15, 2018): https://www.malware-traffic-analysis.net/2018/12/14/index.html", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "LErKlJ", + "TbciDE", + "doLlw5" + ], + "Timestamp": "2020-07-11T09:55:23.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-12195723-7c56-4c63-b828-fc340dd4050a (Dec 20, 2018).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2018-12-20T21:13:36.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "50 sightings on 10 sources including: Security Bloggers Network, TechTarget Search Security, Bleeping Computer, Guided Collection, Bleepingcomputer Forums. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "NSAcUx", + "KCdHcb", + "J6UzbO", + "Rlso4a", + "hkE5DK", + "cJMUDF", + "TZRwk8", + "QMTzEI", + "LUhTGd", + "J5NRun" + ], + "Timestamp": "2021-12-21T08:40:00.000Z" + } + ], + "recordedfuture.risk_string": "6/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "38e992eb852ab0c4ac03955fb0dc9bb38e64010fdf9c05331d2b02b6e05689c2", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 28220, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "69 sightings on 18 sources including: Stock market news Company News MarketScreenercom, HackDig Posts, Sesin at, US CERT CISA Alerts, citizensudo.com. 6 related attack vectors including Powershell Attack, Supply Chain Attack, Target Destination Manipulation, Reconnaissance, C&C Server. Most recent link (Apr 15, 2021): https://www.cisa.gov/uscert/ncas/alerts/aa20-352a", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "XBl0xf", + "POs2u-", + "Z3TZAQ", + "hhY_oz", + "idn:citizensudo.com", + "VKz42X", + "PA-rR4", + "POs2tz", + "idn:firsthackersnews.com", + "KcjdRW", + "dCotni", + "idn:comodo.com", + "gI8s5W", + "hibUwt", + "rN", + "idn:reportcybercrime.com", + "idn:eshielder.com", + "idn:edsitrend.com" + ], + "Timestamp": "2021-04-15T00:00:00.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "175 sightings on 31 sources including: 4-traders.com, SentinelLabs, Sesin at, Cisco Japan Blog, McAfee. 8 related malware families including WebShell, Ransomware, Backdoor, Backdoor Shell, SUNBURST. Most recent tweet: Malcode highlighted in 'App_Web_logoimagehandler.ashx.b6031896.dll' (c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71) #SolarWinds #SUNBURST https://t.co/lyvnVHuTb2. Most recent link (Dec 16, 2020): https://twitter.com/_mynameisgeff/statuses/1339070792705830913", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "TuWseX", + "KBTQ2e", + "eP3CYX", + "Z3TZAQ", + "clDYM8", + "rN", + "VKz42X", + "idn:elemendar.com", + "idn:securitysummitperu.com", + "PA-rR4", + "idn:terabitweb.com", + "eTNyK6", + "gBQB48", + "bMZlEg", + "idn:edsitrend.com", + "idn:infoblox.com", + "UZNze8", + "Z2mQh2", + "XBl0xf", + "dCpZqs", + "jmpFm1", + "T5", + "doLlw5", + "gBDK5G", + "MIKjae", + "idn:firsthackersnews.com", + "jjf3_B", + "Jv_xrR", + "dCotni", + "idn:comodo.com", + "hibUwt" + ], + "Timestamp": "2020-12-16T04:52:10.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "11 sightings on 2 sources: GitHub, Insikt Group. 5 related cyber vulnerabilities: CWE-20, CWE-287, CVE-2020-10148, CVE-2020-1938, CWE-269. Most recent link (Dec 27, 2021): https://github.com/teamt5-it/official-website-v2/blob/master/_site/_next/data/64e2c6f134e73517d6ff737822e83cd75cf633c6/tw/posts/ithome-ghostcat-apache-tomcat-ajp-vulnerability.json", + "MitigationString": "", + "Name": "linkedToVuln", + "Rule": "Linked to Vulnerability", + "Sources": [ + "MIKjae", + "VKz42X" + ], + "Timestamp": "2021-12-27T07:36:54.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "6 sightings on 2 sources: Sophos Virus and Spyware Threats, PolySwarm. Most recent link (Dec 17, 2020): https://news.sophos.com/fr-fr/2020/12/15/cyberattaque-contre-solarwinds-comment-savoir-si-vous-etes-concerne/", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "K16tAG", + "doLlw5" + ], + "Timestamp": "2020-12-20T15:18:53.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "3 sightings on 1 source: DHS Automated Indicator Sharing. 3 reports including AA20-352A APT Compromise of Govt Agencies, Critical Infrastructure, and Private Sector Organizations, from CISA, Government Facilities Sector, CISA, Government Facilities Sector, NCCIC:STIX_Package-673aacd1-1852-4d44-bd93-0c44940a6358 (Feb 3, 2021).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2021-02-03T21:32:08.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "13 sightings on 1 source: Insikt Group. 4 reports including Researchers Linked Supernova Malware to Spiral Group. Most recent link (Mar 08, 2021): https://app.recordedfuture.com/live/sc/5DIp4RIUiJz6", + "MitigationString": "", + "Name": "analystNote", + "Rule": "Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-03-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "28 sightings on 8 sources including: Dancho Danchev's Blog, SecureWorks, Talos Intel, Unit 42 Palo Alto Networks, Cisco Japan Blog. Most recent link (Mar 12, 2021): https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group?es_p=13420131", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "JfqIbv", + "Z2mQh2", + "PA-rR4", + "jjf3_B", + "clDYM8", + "T5", + "rN", + "J5NRun" + ], + "Timestamp": "2021-03-12T20:30:37.672Z" + } + ], + "recordedfuture.risk_string": "7/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 33228, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "6 sightings on 5 sources: GitHub, SANS Internet Storm Center, Messaging Platforms - Uncategorized, @decalage2, @simonwargniez. 3 related attack vectors: Remote Code Execution, Zero Day Exploit, Cyberattack. Most recent tweet: Great lists of software affected by #Log4Shell / CVE-2021-44228 / Log4J RCE: https://t.co/TpEQXKgMGW by @ncsc_nl https://t.co/FA5i8zR5Z1 by @CISAgov https://t.co/0xVZJvMcpU by @SwitHak https://t.co/788knvztWV https://t.co/WMkXslhgWS #log4j #log4j2. Most recent link (Dec 15, 2021): https://twitter.com/decalage2/statuses/1471121875816353800", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "LUf99I", + "MIKjae", + "JYxY8X", + "Y7TWfI", + "KIRe_w" + ], + "Timestamp": "2021-12-15T14:16:01.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "11 sightings on 3 sources: bund.de, SANS Internet Storm Center, Sesin at. 2 related malware families: Ransomware, Botnet. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "idn:bund.de", + "JYxY8X", + "Z3TZAQ" + ], + "Timestamp": "2021-12-20T04:54:00.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "108 sightings on 78 sources including: bund.de, tistory.com, PasteBin, Sesin at, Messaging Platforms - Uncategorized. 24 related cyber vulnerabilities including CWE-22, CWE-611, CVE-2019-19781, CVE-2020-16898, CWE-20. Most recent tweet: Security advisories, bulletins, and vendor responses related to Log4Shell #Log4Shell #Log4j #cybersecurity #infosec #vendorsecurity https://t.co/Vpwrhdppm7. Most recent link (Dec 22, 2021): https://twitter.com/arrgibbs/statuses/1473733864459841538", + "MitigationString": "", + "Name": "linkedToVuln", + "Rule": "Linked to Vulnerability", + "Sources": [ + "VQpQDR", + "KFu3Rc", + "LUf99I", + "SGCsBG", + "U94lUG", + "KFcv42", + "QT0CFv", + "UHvtcg", + "KFUbjU", + "KHwUI5", + "KKSt8d", + "idn:bund.de", + "VmIbAC", + "QGT0Vy", + "ejfM20", + "KGlTEd", + "QCoXJo", + "RXSwU8", + "idn:tistory.com", + "LpdVul", + "K-eKsL", + "TKYCSz", + "SkABVK", + "SdGk_x", + "LI6d7O", + "LQIfBf", + "U6B2hC", + "f7_CfD", + "LKt0HB", + "RHS4v8", + "KKmN5m", + "YfJqp2", + "Jv_xrR", + "RJ2_NX", + "VZXzSv", + "k0QC11", + "KFWBRs", + "LRk_pt", + "Qn2VRQ", + "kGHFKP", + "ShBO5M", + "T-GSBp", + "KNdyHF", + "QLCTXP", + "Z3TZAQ", + "Khf99v", + "KHZhjO", + "SHH61D", + "Knx_su", + "LL8-pr", + "QpmWTf", + "KIRe_w", + "QIea7F", + "SlhG3F", + "KIdj8R", + "SQqKS8", + "Lq6DNq", + "QpYsBa", + "d-ZMP2", + "LOoye8", + "QEUmiJ", + "ewfPjC", + "LBNFpV", + "QTpbKE", + "Y7TWfI", + "KGS-xC", + "eifkGz", + "au2SGr", + "SKw4tT", + "KGW5kn", + "Q9y5Ki", + "KGxw1d", + "MIKjae", + "LO5p1C", + "JYxY8X", + "KJsMEF", + "QBLBHH", + "k7WJ2k" + ], + "Timestamp": "2021-12-22T19:15:08.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Naked Security. Most recent link (Dec 18, 2021): https://news.sophos.com/en-us/2021/12/17/log4shell-response-and-mitigation-recommendations/", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "J2_htN" + ], + "Timestamp": "2021-12-18T00:20:04.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "10 sightings on 7 sources including: ISC Sans Diary Archive, SecureWorks, InfoCON: green, ISC | Latest Headlines, SANS Internet Storm Center. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "TCw6v6", + "Z2mQh2", + "2d", + "cJuZvt", + "JYxY8X", + "J2_htN", + "jXNbON" + ], + "Timestamp": "2021-12-20T04:54:00.000Z" + } + ], + "recordedfuture.risk_string": "5/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.md5": "b66db3a06c2955a9cb71a8718970c592", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 37390, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 6, 2017, and Jul 17, 2017.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:Tluf00" + ], + "Timestamp": "2021-12-24T20:03:09.087Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "14 sightings on 5 sources including: Assiste.Forum, @arturodicorinto. 2 related attack vectors: ShellCode, Cyberattack. Most recent tweet: They're getting quicker at updating.. #petya #cyberattack https://t.co/px0g9BSpod. Most recent link (Jun 27, 2017): https://twitter.com/SupersizedSam/statuses/879764638845587461", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "LP7dc7", + "LRlngp", + "Sl8XTb", + "QMfGAr", + "J-y3tn" + ], + "Timestamp": "2017-06-27T18:13:29.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "10 sightings on 9 sources including: BitcoinTalk.org, @Noemi_hcke. Most recent tweet: #petya related hashes in #virustotal https://t.co/Cv7Pltjhia https://t.co/P3otYPoxBj #ransomware #malware #sha256. Most recent link (Jun 28, 2017): https://twitter.com/Menardconnect/statuses/879885997831368705", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "ThowaF", + "KUtKjP", + "K84j7t", + "MghdWI", + "K8rrfe", + "QlWPRW", + "KFsPRz", + "S-Anbb", + "KE9dMF" + ], + "Timestamp": "2017-06-28T02:15:44.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "834 sightings on 201 sources including: New Jersey Cybersecurity & Communications Integration Cell, lnkd.in, avtech24h.com, Malwr.com, Talos Intel. 21 related malware families including ICS Malware, PetrWrap, Emotet, Trojan, NotPetya. Most recent tweet: #ransomware 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 f65a7dadff844f2dc44a3bd43e1c0d600b1a6c66f6d02734d8f385872ccab0bc b6e8dc95ec939a1f3b184da559c8010ab3dc773e426e63e5aa7ffc44174d8a9d 9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08. Most recent link (Apr 9, 2021): https://twitter.com/RedBeardIOCs/statuses/1380600677249003521", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "jbVMcB", + "idn:lnkd.in", + "idn:avtech24h.com", + "K84j7t", + "Sl8XTb", + "KGRhOC", + "NKaUXl", + "KIoGAG", + "PA-rR4", + "LRlngp", + "rN", + "Jxh46H", + "KFL44X", + "TbciDE", + "KFNVB9", + "OJpx5g", + "K-CGye", + "KK6oqV", + "WR_Ohh", + "idn:twitter.com", + "fgwEcq", + "QYsx0D", + "KIFtR_", + "Lp_esG", + "TSFWTw", + "KGHzAY", + "P_oEH3", + "KBTQ2e", + "QCGHCy", + "JYxY5G", + "UQsrUj", + "idn:cert.ro", + "idn:bluvector.io", + "KFUJTL", + "TFUkSW", + "P0Gs9I", + "K8ofB1", + "KVnnHP", + "TpaXxw", + "U5qdTI", + "idn:zscaler.com", + "L3kVdM", + "QMfGAr", + "KIk8aS", + "Kzw0Pm", + "hcELIE", + "POs2tz", + "KD6Na4", + "idn:globalsecuritymag.com", + "LDd0sl", + "KVP0jz", + "Lj8CsQ", + "K8rrfe", + "LDejRI", + "J-y3tn", + "WXutod", + "idn:infosecurityfactory.nl", + "LBlc7C", + "idn:bg.org.tr", + "QS89Bd", + "K9SiDc", + "Qe89bv", + "TiY1wu", + "idn:undernews.fr", + "idn:iteefactory.nl", + "KFRGd_", + "KFVuR_", + "4n", + "S-Anbb", + "KFNZEC", + "TSazOG", + "K9Skh1", + "MghdWI", + "idn:securityiscoming.com", + "QS89BG", + "LVg9nH", + "KFiGli", + "K9Vq9B", + "KLbNtt", + "VyWQM7", + "NTakwX", + "KGoarP", + "idn:gelsene.net", + "LwURWv", + "KGX8VB", + "ThoB0I", + "TAIz7D", + "QBHQ61", + "TiY1w7", + "idn:kompasiana.com", + "idn:t.co", + "KfDTG0", + "idn:ictsecuritymagazine.com", + "Liz5-u", + "MIKjae", + "JYxY8X", + "KUtKjP", + "idn:cert.pl", + "Lpm4nc", + "idn:boozallen.com", + "RVFHk_", + "KGmazP", + "M_7iBk", + "TStw1W", + "LFcJLk", + "K0TN7r", + "KVRURg", + "UNe62M", + "iL8bPu", + "K76BjK", + "VRixQe", + "idn:dfir.pro", + "KF-l77", + "idn:gixtools.net", + "P_oIyV", + "KGzicb", + "LGryD9", + "idn:fb.me", + "K5nCn5", + "ThKuX0", + "SYrUYn", + "KFKbZE", + "MAe5tQ", + "KGm6gS", + "W4ygGi", + "g9rk5F", + "idn:menshaway.blogspot.com", + "KFsPRz", + "LDm9iS", + "RV8KWp", + "KTuH6e", + "P_uJi3", + "KG_Bgt", + "QAmbRP", + "idn:csirt.cz", + "LZYvHh", + "L0HtmN", + "KWLqO-", + "LtUj1D", + "QMTzDr", + "idn:dy.si", + "Lo8Box", + "K-4reD", + "KFTeBZ", + "KKzFno", + "QMTzEI", + "KFYLd8", + "KGABt4", + "LIizBt", + "idn:herjavecgroup.com", + "QAAZRn", + "K66Zgw", + "KWz-My", + "Lb0b3F", + "idn:emsisoft.vn", + "LodOTm", + "KE9dMF", + "O-Wf5x", + "LG2dQX", + "P_-RZy", + "LK7o9D", + "K60PUk", + "KKUqfz", + "idn:logrhythm.com", + "Jv_xrR", + "LP7dc7", + "MFNOaz", + "TefIES", + "KGdGg3", + "KHNdvY", + "QBTxvB", + "idn:swordshield.com", + "ThowaF", + "idn:binarydefense.com", + "idn:indusface.com", + "QBtnC2", + "QlWPRW", + "KHZhjO", + "idn:idcloudhost.com", + "LRFVsB", + "KG2JTH", + "KIm1im", + "LAfpKN", + "BaV", + "KGW3VP", + "KFcp5q", + "LCN_6T", + "idn:avastvn.com", + "KFTnbG", + "TiCWjw", + "Lmhpq3", + "KGS-xC", + "KFVthB", + "idn:finyear.com", + "KFji4N", + "P_7M19", + "K-b0DI", + "LV1UMS", + "idn:safe-cyberdefense.com", + "Kjk3fx", + "Q1wlJN" + ], + "Timestamp": "2021-04-09T19:17:06.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: GitHub. 2 related cyber vulnerabilities: CWE-20, CVE-2017-0143. Most recent link (Oct 10, 2021): https://github.com/demisto/content/blob/master/Packs/RecordedFuture/Integrations/RecordedFuture/example_commands.txt", + "MitigationString": "", + "Name": "linkedToVuln", + "Rule": "Linked to Vulnerability", + "Sources": [ + "MIKjae" + ], + "Timestamp": "2021-10-10T08:21:25.825Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Jun 27, 2017): ReversingLabs malware file analysis.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TAIz7D", + "TbciDE", + "doLlw5" + ], + "Timestamp": "2020-12-17T22:59:03.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-21cebba6-46ed-464e-ad5a-32a8063e1400 (Jun 27, 2017).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2017-06-27T17:18:01.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "91 sightings on 19 sources including: Security News Concentrator, Fortinet, Trend Micro, CrowdStrike, FireEye Threat Research Blog. Most recent link (Dec 20, 2019): https://threatvector.cylance.com/en_us/home/threat-spotlight-petya-like-ransomware-is-nasty-wiper.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "QS89Bd", + "KVP0jz", + "T5", + "JYxY5G", + "WR_Ohh", + "Jt4ExJ", + "Kzw0Pm", + "JQH96m", + "2d", + "JYxY8X", + "rN", + "PA-rR4", + "VyWQM7", + "Lp_esG", + "ONMgMx", + "4n", + "QMTzEI", + "83", + "K0TN7r" + ], + "Timestamp": "2019-12-20T01:04:11.602Z" + } + ], + "recordedfuture.risk_string": "8/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 45000, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "WlbRkJ", + "ha2FFj", + "K7wUX2", + "P_ivKa", + "J-mrOR", + "P_upBR" + ], + "Timestamp": "2021-12-25T03:23:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "Y7TWfI" + ], + "Timestamp": "2021-10-18T12:09:43.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "47 sightings on 16 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 18 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "TGXqeD", + "W4ygGi", + "L3kVdM", + "QMfGAr", + "kuKt0c", + "QAy9GA", + "JOU", + "MIKjae", + "P_oIyV", + "QJ6TQK", + "idn:droppdf.com", + "Ql9O5c", + "QAmbRP", + "Tq2nAb", + "TbciDE", + "idn:index-of.es" + ], + "Timestamp": "2021-11-27T23:07:37.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: ReversingLabs. Most recent link (Jul 1, 2019): ReversingLabs malware file analysis.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TbciDE" + ], + "Timestamp": "2019-07-01T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "Rlso4a", + "hkE5DK", + "TZRwk8", + "J5NRun" + ], + "Timestamp": "2021-12-21T08:40:00.000Z" + } + ], + "recordedfuture.risk_string": "5/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "ad2ad0249fafe85877bc79a01e1afd1a44d983c064ad8cb5bc694d29d166217b", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 48393, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "31 sightings on 4 sources: @m0rb, @bad_packets, @InfoSex11, @luc4m. 2 related attack vectors: DDOS, Command Injection. Most recent tweet: 2021-06-17T23:29:30 - Commented: https://t.co/j2a05iXOiI #malware #commandinjection. Most recent link (Jun 17, 2021): https://twitter.com/m0rb/statuses/1405668962462011401", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "KFwzec", + "TGgDPZ", + "cgGiXI", + "LMcjZ7" + ], + "Timestamp": "2021-06-17T23:29:31.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "3 sightings on 2 sources: @bad_packets, @swarmdotmarket. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "TGgDPZ", + "UBjcy3" + ], + "Timestamp": "2020-04-20T21:22:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "87 sightings on 15 sources including: lumen.com, HackDig Posts, Anquanke News, Daily Dot, centurylink.com. 7 related malware families including Mozi Botnet, Trojan, Qbot, Mirai, DDOS Toolkit. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec. Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "idn:lumen.com", + "POs2u-", + "U13S_U", + "Jzl3yj", + "idn:centurylink.com", + "doLlw5", + "POs2t2", + "idn:cyberswachhtakendra.gov.in", + "idn:hackxsecurity.com", + "TGgDPZ", + "Jv_xrR", + "TSFWTv", + "LMcjZ7", + "UBjcy3", + "TbciDE" + ], + "Timestamp": "2020-04-20T21:22:47.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Nov 28, 2019): ReversingLabs malware file analysis.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TAIz7D", + "TbciDE", + "doLlw5" + ], + "Timestamp": "2021-04-04T07:46:20.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Trend Micro. Most recent link (Mar 11, 2021): https://documents.trendmicro.com/assets/pdf/Technical_Brief_Uncleanable_and_Unkillable_The_Evolution_of_IoT_Botnets_Through_P2P_Networking.pdf", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "T5" + ], + "Timestamp": "2021-03-11T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "5/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "01ba1fb41632594997a41d0c3a911ae5b3034d566ebb991ef76ad76e6f9e283a", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 51700, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "29 sightings on 24 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @rpsanch, @rce_coder. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "T1bwMv", + "LC-zVm", + "P_upBR", + "T2OA5Q", + "K20lXV", + "TGgDPZ", + "hkIDTa", + "LqRZCN", + "Vd51cf", + "ha2FFj", + "UmsU31", + "ddafo3", + "K7wUX2", + "P_ivKa", + "idn:wordpress.com", + "J-mrOR", + "QPbAan", + "VeioBt", + "WlbRkJ", + "TvfQzk", + "TP1vbk", + "SrKvJ0", + "SqCj4s", + "VXaDYo" + ], + "Timestamp": "2021-12-25T03:23:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "10 sightings on 7 sources including: SANS Institute Course Selector Results, Messaging Platforms - Uncategorized, @ecstatic_nobel, @Artilllerie. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "Ym7dzt", + "LKKAV1", + "OuKV3V", + "VeioBt", + "Y7TWfI", + "KGS-xC", + "KFSXln" + ], + "Timestamp": "2019-05-28T14:17:41.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "114 sightings on 42 sources including: Doc Player, GhostBin, Codex - Recent changes en, droppdf.com, ReversingLabs. 41 related malware families including Dardesh, AZORult, Emotet, GandCrab, Offensive Security Tools (OST). Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "QWOrKl", + "LKKAV1", + "W4ygGi", + "PATKM7", + "T1bwMv", + "LjkJhE", + "kuKt0c", + "QAy9GA", + "LbYmLr", + "K20lXV", + "QZe7TG", + "idn:droppdf.com", + "QAmbRP", + "TbciDE", + "P_j5Dw", + "QNmgPm", + "TGXqeD", + "POs2u-", + "KGS-xC", + "L3kVdM", + "QMfGAr", + "h6VVAH", + "doLlw5", + "UrsUKT", + "JOU", + "MIKjae", + "P_oIyV", + "QJ6TQK", + "RfVd0T", + "J6UzbO", + "POs2tz", + "VfsacJ", + "Jv_xrR", + "Ql9O5c", + "USKpXp", + "TP1vbk", + "SrKvJ0", + "Tq2nAb", + "KFSXln", + "P_ov9o", + "VXaDYo", + "idn:index-of.es" + ], + "Timestamp": "2021-11-27T23:07:37.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Messaging Platforms - Uncategorized. 2 related cyber vulnerabilities: CVE-2016-6663, CWE-362.", + "MitigationString": "", + "Name": "linkedToVuln", + "Rule": "Linked to Vulnerability", + "Sources": [ + "Y7TWfI" + ], + "Timestamp": "2021-12-29T07:27:12.565Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "2 sightings on 2 sources: ReversingLabs, PolySwarm. Most recent link (Apr 19, 2018): ReversingLabs malware file analysis.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TbciDE", + "doLlw5" + ], + "Timestamp": "2021-02-10T09:10:10.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "45 sightings on 9 sources including: Security Bloggers Network, Bleeping Computer, Guided Collection, Bleepingcomputer Forums, TheServerSide.com | Updates. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "NSAcUx", + "J6UzbO", + "Rlso4a", + "hkE5DK", + "cJMUDF", + "TZRwk8", + "QMTzEI", + "LUhTGd", + "J5NRun" + ], + "Timestamp": "2021-12-21T08:40:00.000Z" + } + ], + "recordedfuture.risk_string": "6/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "fecddb7f3fa478be4687ca542c0ecf232ec35a0c2418c8bfe4875686ec373c1e", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 56767, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1688 sightings on 26 sources including: lnkd.in, Doc Player, Cyber4Sight, voicebox.pt, VKontakte. 2 related malware families: Wcry, Ransomware. Most recent link (Sep 13, 2017): https://malwr.com/analysis/ZmIzN2E3MzQyM2I0NDYwODllOWRhMmQxODg3YzMxZDA/", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "idn:lnkd.in", + "W4ygGi", + "S2tpaX", + "idn:voicebox.pt", + "SIjHV9", + "PJHGaq", + "PA-rR4", + "Z2mQh2", + "e_", + "idn:gofastbuy.com", + "idn:ziftsolutions.com", + "POs2u-", + "KHpcuE", + "QccsRc", + "idn:dfir.pro", + "idn:nksc.lt", + "idn:dy.si", + "KZFCph", + "rN", + "QYsx0D", + "idn:logrhythm.com", + "Jv_xrR", + "idn:safe-cyberdefense.com", + "4n", + "QS89Bx", + "NKaUXl" + ], + "Timestamp": "2017-09-13T00:00:00.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "2 sightings on 1 source: Recorded Future Malware Detonation.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TAIz7D" + ], + "Timestamp": "2020-10-13T10:46:31.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "58 sightings on 5 sources: SecureWorks, InfoCON: green, McAfee, Talos Intel, Kaspersky Securelist and Lab. Most recent link (Jun 28, 2018): https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27077/en_US/McAfee_Labs_WannaCry_June24_2018.pdf", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "Z2mQh2", + "2d", + "rN", + "PA-rR4", + "4n" + ], + "Timestamp": "2018-06-28T08:11:36.570Z" + } + ], + "recordedfuture.risk_string": "3/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 58710, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "WlbRkJ", + "ha2FFj", + "K7wUX2", + "P_ivKa", + "J-mrOR", + "P_upBR" + ], + "Timestamp": "2021-12-25T03:23:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "Y7TWfI" + ], + "Timestamp": "2021-10-18T12:09:43.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "43 sightings on 14 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 19 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: RT @demonslay335: #STOP #Djvu #Ransomware extension \".mogera\" (v090): https://t.co/wlMcSE2EHj | https://t.co/XAYkOoOReU. Most recent link (May 27, 2019): https://twitter.com/DrolSecurity/statuses/1133117241388621825", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "TGXqeD", + "W4ygGi", + "L3kVdM", + "QMfGAr", + "QAy9GA", + "JOU", + "MIKjae", + "P_oIyV", + "QJ6TQK", + "idn:droppdf.com", + "Ql9O5c", + "QAmbRP", + "Tq2nAb", + "idn:index-of.es" + ], + "Timestamp": "2019-05-27T21:06:17.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Mar 8, 2021): https://polyswarm.network/scan/results/file/85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "doLlw5" + ], + "Timestamp": "2021-03-08T13:00:15.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "Rlso4a", + "hkE5DK", + "TZRwk8", + "J5NRun" + ], + "Timestamp": "2021-12-21T08:40:00.000Z" + } + ], + "recordedfuture.risk_string": "5/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 62010, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "7 sightings on 7 sources including: malwareresearch, Malwr.com, AAPKS.com, @Shouvik95232310, @santGM, @aa419. 4 related attack vectors: Phishing, Click Fraud, Typosquatting, Keylogger. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "WlbRkJ", + "ha2FFj", + "K7wUX2", + "NKaUXl", + "P_ivKa", + "J-mrOR", + "P_upBR" + ], + "Timestamp": "2021-12-25T03:23:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "Y7TWfI" + ], + "Timestamp": "2021-10-18T12:09:43.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "54 sightings on 17 sources including: Ichunqiu Forum, Doc Player, Malwr.com, ArXiv, GitHub. 19 related malware families including Fakespy, Dardesh, Djvu Ransomware, SAVEfiles, Trojan. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "TGXqeD", + "W4ygGi", + "L3kVdM", + "QMfGAr", + "NKaUXl", + "kuKt0c", + "QAy9GA", + "JOU", + "MIKjae", + "P_oIyV", + "QJ6TQK", + "idn:droppdf.com", + "Ql9O5c", + "QAmbRP", + "Tq2nAb", + "TbciDE", + "idn:index-of.es" + ], + "Timestamp": "2021-11-27T23:07:37.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: ReversingLabs. Most recent link (Aug 13, 2017): ReversingLabs malware file analysis.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TbciDE" + ], + "Timestamp": "2017-08-13T00:33:27.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "Rlso4a", + "hkE5DK", + "TZRwk8", + "J5NRun" + ], + "Timestamp": "2021-12-21T08:40:00.000Z" + } + ], + "recordedfuture.risk_string": "5/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "7531fcea7002c8b52a8d023d0f3bb938efb2cbfec91d2433694930b426d84865", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 65443, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Qakbot. Communication observed on TCP:443, TCP:6881, TCP:995. Exfiltration behavior observed. Last observed on Dec 27, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-29T02:11:16.663Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "164 sightings on 4 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions, Abuse.ch: Feodo IP Blocklist, Polyswarm Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 103.143.8.71:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "h_iZX8", + "report:OtiCOp", + "hyihHO" + ], + "Timestamp": "2021-12-29T02:11:16.658Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "7 sightings on 1 source: PasteBin. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Nov 8, 2021): https://pastebin.com/G1Jvm5T0", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "Jv_xrR" + ], + "Timestamp": "2021-11-08T16:27:15.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: GitHub. Most recent link (Nov 16, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-15-IOCs-for-Matanbuchus-Qakbot-CobaltStrike-and-spambot-activity.txt", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged IP", + "Sources": [ + "MIKjae" + ], + "Timestamp": "2021-11-16T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "4/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "103.143.8.71", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 67656, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "12 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command & Control host identified on Dec 24, 2021.", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "h_iZX8" + ], + "Timestamp": "2021-12-24T08:07:09.925Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 2 sources: Bitdefender IP Reputation, hpHosts Latest Additions. Bitdefender detected suspicious traffic involving 185.19.85.136 associated with Bitdefender threat name Trojan.GenericKD.34300483 on Apr 30, 2021", + "MitigationString": "", + "Name": "multiBlacklist", + "Rule": "Historical Multicategory Blocklist", + "Sources": [ + "iFMVSl", + "Ol_aRZ" + ], + "Timestamp": "2021-04-30T04:50:06.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: GitHub. 2 related intrusion methods: Nanocore, Remote Access Trojan. Most recent link (Jan 1, 2021): https://github.com/GlacierSheep/DomainBlockList/blob/master/trail/static_nanocore_(malware).domainset", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "MIKjae" + ], + "Timestamp": "2021-01-01T16:56:57.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between Feb 13, 2021, and Feb 13, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:SW8xpk" + ], + "Timestamp": "2021-12-28T19:20:46.641Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "9 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command & Control host identified on Oct 29, 2021.", + "MitigationString": "", + "Name": "intermediateCncServer", + "Rule": "Recent C&C Server", + "Sources": [ + "b5tNVA", + "h_iZX8" + ], + "Timestamp": "2021-10-29T08:07:54.495Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Asyncrat. Communication observed on TCP:6060. Last observed on Dec 21, 2021.", + "MitigationString": "", + "Name": "intermediateActiveCnc", + "Rule": "Recently Active C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-28T19:20:46.639Z" + } + ], + "recordedfuture.risk_string": "6/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "185.19.85.136", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 70518, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Cobalt Strike Team Servers. Communication observed on TCP:443, TCP:8443. Last observed on Dec 26, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-28T18:45:41.875Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "2 sightings on 1 source: Recorded Future Command & Control List. Command & Control host identified on Jul 5, 2021.", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA" + ], + "Timestamp": "2021-07-05T08:04:23.139Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: C2IntelFeeds IPC2s. Most recent link (Aug 15, 2021): https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/IPC2s-30day.csv?q=45.112.206.18_20210815", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Historically Linked to Cyber Attack", + "Sources": [ + "k_7zaW" + ], + "Timestamp": "2021-08-15T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "12 sightings on 2 sources: C2IntelFeeds IPC2s, @drb_ra. 2 related intrusion methods: Cobalt Strike, Offensive Security Tools (OST). Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "k_7zaW", + "jqWX2B" + ], + "Timestamp": "2021-11-26T15:01:53.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "10 sightings on 1 source: @drb_ra. Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged IP", + "Sources": [ + "jqWX2B" + ], + "Timestamp": "2021-11-26T15:01:53.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 2 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, Recorded Future Analyst Community Trending Indicators. Observed between Jul 8, 2021, and Dec 9, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:aD1qtM", + "report:Tluf00" + ], + "Timestamp": "2021-12-28T18:45:41.877Z" + } + ], + "recordedfuture.risk_string": "6/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "45.112.206.18", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 73755, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "5 sightings on 2 sources: Polyswarm Sandbox Analysis - Malware C2 Extractions, Joe Security Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample c9709d56b92047cd55fb097feb6cb7a8de6f3edc5ea79a429363938a69aae580", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "hyihHO", + "h_iZX8" + ], + "Timestamp": "2021-12-27T19:00:49.975Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "5 sightings on 1 source: AbuseIP Database. Most recent link (Aug 25, 2020): https://www.abuseipdb.com/check/190.55.186.229", + "MitigationString": "", + "Name": "multiBlacklist", + "Rule": "Historical Multicategory Blocklist", + "Sources": [ + "UneVVu" + ], + "Timestamp": "2020-08-25T20:01:29.075Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "87 sightings on 1 source: Cryptolaemus Pastedump. Most recent link (Jan 25, 2021): https://paste.cryptolaemus.com/emotet/2021/01/25/emotet-malware-IoCs_01-25-21.html", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Historical Positive Malware Verdict", + "Sources": [ + "Z7kln2" + ], + "Timestamp": "2021-01-25T23:59:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: External Sensor Spam. 190.55.186.229 was historically observed as spam. No longer observed as of Nov 16, 2021.", + "MitigationString": "", + "Name": "spam", + "Rule": "Historical Spam Source", + "Sources": [ + "kBCI-b" + ], + "Timestamp": "2021-11-16T01:06:21.965Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "jjf3_B" + ], + "Timestamp": "2021-04-09T12:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "239 sightings on 5 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks, PasteBin, Cryptolaemus Pastedump. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Mar 14, 2021): https://unit42.paloaltonetworks.jp/attack-chain-overview-emotet-in-december-2020-and-january-2021/", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "idn:paloaltonetworks.jp", + "JwO7jp", + "jjf3_B", + "Jv_xrR", + "Z7kln2" + ], + "Timestamp": "2021-03-14T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "6 sightings on 3 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged IP", + "Sources": [ + "idn:paloaltonetworks.jp", + "JwO7jp", + "jjf3_B" + ], + "Timestamp": "2021-04-09T12:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 2 sources: University of Science and Technology of China Black IP List, Abuse.ch: Feodo IP Blocklist. Observed between Feb 26, 2021, and Dec 27, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:Q1ghC0", + "report:OtiCOp" + ], + "Timestamp": "2021-12-28T19:33:55.849Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "31 sightings on 3 sources: Palo Alto Networks, Polyswarm Sandbox Analysis - Malware C2 Extractions, Unit 42 Palo Alto Networks. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample a88734cd5c38211a4168bc7701516a50e6aef5ef20d2b1a915edae23c1b345db", + "MitigationString": "", + "Name": "intermediateCncServer", + "Rule": "Recent C&C Server", + "Sources": [ + "JwO7jp", + "hyihHO", + "jjf3_B" + ], + "Timestamp": "2021-10-19T12:21:34.268Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Talos IP Blacklist.", + "MitigationString": "", + "Name": "recentMultiBlacklist", + "Rule": "Recent Multicategory Blocklist", + "Sources": [ + "report:VW6jeN" + ], + "Timestamp": "2021-12-28T19:33:55.846Z" + } + ], + "recordedfuture.risk_string": "10/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "190.55.186.229", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 78659, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Emotet. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 26, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-28T22:05:35.688Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "2 sightings on 2 sources: Recorded Future Command & Control List, Abuse.ch: Feodo IP Blocklist. Command & Control host identified on Dec 1, 2021.", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "report:OtiCOp" + ], + "Timestamp": "2021-12-01T08:06:11.827Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: PasteBin. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 2, 2021): https://pastebin.com/SusxCK2b", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "Jv_xrR" + ], + "Timestamp": "2021-12-02T15:58:10.000Z" + } + ], + "recordedfuture.risk_string": "3/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "62.210.82.223", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 80121, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Bazarloader. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 25, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-29T06:21:27.731Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "2 sightings on 2 sources: Recorded Future Command & Control List, Abuse.ch: Feodo IP Blocklist. Command & Control host identified on Nov 25, 2021.", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "report:OtiCOp" + ], + "Timestamp": "2021-11-25T08:06:42.384Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 2 sources: Project Honey Pot, @HoneyFog. Most recent tweet: Fog44: 87.120.254.96->22. Most recent link (Dec 14, 2016): https://twitter.com/HoneyFog/statuses/809032869792378880", + "MitigationString": "", + "Name": "honeypot", + "Rule": "Historical Honeypot Sighting", + "Sources": [ + "P_izv4", + "OSz1F0" + ], + "Timestamp": "2016-12-14T13:50:41.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: External Sensor Spam. 87.120.254.96 was historically observed as spam. No longer observed as of Nov 16, 2021.", + "MitigationString": "", + "Name": "spam", + "Rule": "Historical Spam Source", + "Sources": [ + "kBCI-b" + ], + "Timestamp": "2021-11-16T03:19:58.721Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: GitHub. Most recent link (Nov 8, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-05-TA551-IOCs.txt", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged IP", + "Sources": [ + "MIKjae" + ], + "Timestamp": "2021-11-08T00:00:00.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: University of Science and Technology of China Black IP List.", + "MitigationString": "", + "Name": "recentMultiBlacklist", + "Rule": "Recent Multicategory Blocklist", + "Sources": [ + "report:Q1ghC0" + ], + "Timestamp": "2021-12-29T06:21:27.693Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: CloudSEK. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 22, 2021): https://cloudsek.com/emotet-2-0-everything-you-need-to-know-about-the-new-variant-of-thbanking-trojan/", + "MitigationString": "", + "Name": "recentLinkedIntrusion", + "Rule": "Recently Linked to Intrusion Method", + "Sources": [ + "k837l0" + ], + "Timestamp": "2021-12-22T09:45:33.000Z" + } + ], + "recordedfuture.risk_string": "7/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "87.120.254.96", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 83263, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Covenant. Communication observed on TCP:7443. Exfiltration behavior observed. Last observed on Dec 27, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-28T18:42:08.923Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "19 sightings on 2 sources: Recorded Future Command & Control List, @TheDFIRReport. Most recent tweet: Here's some newer C2 servers we're tracking: #BazarLoader 64.227.73.80 64.225.71.198 #Covenant 167.71.67.196 45.146.165.76 #PoshC2 193.36.15.192 #Empire 64.227.21.255 #Metasploit 91.221.70.143 Full list available @ https://t.co/QT6o626hsR #ThreatFeed. Most recent link (Sep 1, 2021): https://twitter.com/TheDFIRReport/statuses/1433055791964049412", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "dZgcRz" + ], + "Timestamp": "2021-09-01T13:15:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 3 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, CINS: CI Army List, Recorded Future Analyst Community Trending Indicators. Observed between Jan 22, 2021, and Sep 25, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:aD1qtM", + "report:OchJ-t", + "report:Tluf00" + ], + "Timestamp": "2021-12-28T18:42:08.925Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: DShield: Recommended Block List.", + "MitigationString": "", + "Name": "recentMultiBlacklist", + "Rule": "Recent Multicategory Blocklist", + "Sources": [ + "report:OchJ-o" + ], + "Timestamp": "2021-12-28T18:42:08.917Z" + } + ], + "recordedfuture.risk_string": "4/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "45.146.165.76", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 85476, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "5 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample b827a4587bc6162715693c71e432769ec6272c130bb87e14bc683f5bd7caf834", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "hyihHO" + ], + "Timestamp": "2021-12-22T04:10:08.558Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @HoneyFog. Most recent tweet: Fog44: 181.112.52.26->22. I've never seen this IP before. Most recent link (Oct 6, 2017): https://twitter.com/HoneyFog/statuses/916371734928019456", + "MitigationString": "", + "Name": "honeypot", + "Rule": "Historical Honeypot Sighting", + "Sources": [ + "P_izv4" + ], + "Timestamp": "2017-10-06T18:37:01.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26", + "MitigationString": "", + "Name": "multiBlacklist", + "Rule": "Historical Multicategory Blocklist", + "Sources": [ + "UneVVu" + ], + "Timestamp": "2018-08-17T00:30:42.194Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2339 sightings on 9 sources including: TBN, BlackHatWorld Forum, Carding Mafia Forum, Inforge Forum Hacker Trucchi Giochi Informatica, ProxyFire - The Best Proxy Software and Forum. Most recent link (Jun 29, 2019): https://Black%20Hat%20World%20Forum%20(Obfuscated)/seo/ssl-proxies-occasional-update.927669/page-44#post-12210196", + "MitigationString": "", + "Name": "openProxies", + "Rule": "Historical Open Proxies", + "Sources": [ + "RqhhJr", + "KjGS3i", + "VU4Qnc", + "P7sZbk", + "OQ_oQH", + "Qk8WdX", + "Qk8Wdg", + "QqgtXJ", + "KhvyCV" + ], + "Timestamp": "2019-06-29T01:18:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26", + "MitigationString": "", + "Name": "sshDictAttacker", + "Rule": "Historical SSH/Dictionary Attacker", + "Sources": [ + "UneVVu" + ], + "Timestamp": "2018-08-17T00:30:42.194Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "10 sightings on 3 sources: Manato Kumagai Hatena Blog, sentinelone.com, PasteBin. 6 related intrusion methods including TrickLoader, Trojan, Emotet, Banking Trojan, Trickbot. Most recent link (Feb 26, 2020): https://labs.sentinelone.com/revealing-the-trick-a-deep-dive-into-trickloader-obfuscation/", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "TiY1wa", + "idn:sentinelone.com", + "Jv_xrR" + ], + "Timestamp": "2020-02-26T15:00:17.035Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 3 sources: BlockList.de: Fail2ban Reporting Service, Abuse.ch: Feodo IP Blocklist, Proxies: SOCKS Open Proxies. Observed between Jun 15, 2019, and Oct 3, 2020.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:OhgwUx", + "report:OtiCOp", + "report:SYQe08" + ], + "Timestamp": "2021-12-28T22:05:41.272Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "3 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample dcc42c0bd075f283c71ac327c845498454dcd9528386df5b296fdf89ba105bfa", + "MitigationString": "", + "Name": "intermediateCncServer", + "Rule": "Recent C&C Server", + "Sources": [ + "hyihHO" + ], + "Timestamp": "2021-07-15T12:42:04.656Z" + } + ], + "recordedfuture.risk_string": "8/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "181.112.52.26", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 89684, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "10 sightings on 2 sources: Recorded Future Command & Control List, Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 77.79.56.210:443 as TA0011 (Command and Control) for QakBot using configuration extraction on sample 77b34084de82afac57fbe2c6442dbe7d07c53da5ec87eaf2210b852f0d943cd5", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "hyihHO" + ], + "Timestamp": "2021-12-29T02:00:05.439Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "4 sightings on 1 source: PasteBin. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Nov 7, 2021): https://pastebin.com/u8neEVnz", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "Jv_xrR" + ], + "Timestamp": "2021-11-07T09:05:40.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Abuse.ch: Feodo IP Blocklist. Observed between Nov 29, 2021, and Dec 10, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:OtiCOp" + ], + "Timestamp": "2021-12-29T02:11:39.014Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "12 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 77.79.56.210:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651", + "MitigationString": "", + "Name": "intermediateCncServer", + "Rule": "Recent C&C Server", + "Sources": [ + "b5tNVA", + "h_iZX8" + ], + "Timestamp": "2021-11-03T16:57:54.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Project Honey Pot. Most recent link (Dec 19, 2021): https://www.projecthoneypot.org/ip_77.79.56.210", + "MitigationString": "", + "Name": "recentHoneypot", + "Rule": "Recent Honeypot Sighting", + "Sources": [ + "OSz1F0" + ], + "Timestamp": "2021-12-19T11:30:02.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Qakbot. Communication observed on TCP:443. Last observed on Dec 23, 2021.", + "MitigationString": "", + "Name": "intermediateActiveCnc", + "Rule": "Recently Active C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-29T02:11:39.012Z" + } + ], + "recordedfuture.risk_string": "6/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "77.79.56.210", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 92645, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "87 sightings on 2 sources: Polyswarm Sandbox Analysis - Malware C2 Extractions, Joe Security Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 24.139.72.117:443 as TA0011 (Command and Control) for QakBot using configuration extraction on sample 7ea5720ac7efeb49873f95870d546632d6c8c187ee6e2fc515acfe974483ee0e", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "hyihHO", + "h_iZX8" + ], + "Timestamp": "2021-12-29T07:00:21.416Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "4 sightings on 1 source: Kaspersky Securelist and Lab. Most recent link (Sep 2, 2021): https://securelist.com/qakbot-technical-analysis/103931/", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "4n" + ], + "Timestamp": "2021-09-02T10:00:32.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "34 sightings on 5 sources: Malware News - Malware Analysis, News and Indicators, PasteBin, Segurana Informtica, The Cyber Feed, Kaspersky Securelist and Lab. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Dec 3, 2021): https://pastebin.com/xJ0kmeYQ", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "gBDK5G", + "Jv_xrR", + "VW7VQs", + "g162EU", + "4n" + ], + "Timestamp": "2021-12-03T16:51:53.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "6 sightings on 3 sources: Malware News - Malware Analysis, News and Indicators, urlscan.io, Kaspersky Securelist and Lab. Most recent link (Dec 1, 2021): https://urlscan.io/result/c5b4e2d5-acf0-4fc5-b7bd-e8afac3e5f5a/", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged IP", + "Sources": [ + "gBDK5G", + "WNRa7q", + "4n" + ], + "Timestamp": "2021-12-01T10:54:33.863Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Abuse.ch: Feodo IP Blocklist. Observed between Nov 19, 2021, and Nov 21, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:OtiCOp" + ], + "Timestamp": "2021-12-29T07:17:33.217Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "234 sightings on 4 sources: Recorded Future Command & Control List, Polyswarm Sandbox Analysis - Malware C2 Extractions, PasteBin, Joe Security Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 24.139.72.117:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651", + "MitigationString": "", + "Name": "intermediateCncServer", + "Rule": "Recent C&C Server", + "Sources": [ + "b5tNVA", + "hyihHO", + "Jv_xrR", + "h_iZX8" + ], + "Timestamp": "2021-11-03T16:57:54.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Qakbot. Communication observed on TCP:443. Last observed on Dec 23, 2021.", + "MitigationString": "", + "Name": "intermediateActiveCnc", + "Rule": "Recently Active C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-29T07:17:33.215Z" + } + ], + "recordedfuture.risk_string": "7/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "24.139.72.117", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 87.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 96399, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "66 sightings on 22 sources including: Ars Technica, fook.news, urdupresss.com, HackDig Posts, apple.news. Most recent link (Jul 20, 2021): https://techsecuritenews.com/solarwinds-pirates-utilisent-nouvelle-faille-zero-day-attaques/", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "Ctq", + "idn:fook.news", + "idn:urdupresss.com", + "POs2u-", + "idn:apple.news", + "idn:cryptoinfoos.com.ng", + "g9rk5F", + "idn:thewindowsupdate.com", + "idn:nationalcybersecuritynews.today", + "gBDK5G", + "idn:microsoft.com", + "idn:techsecuritenews.com", + "idn:mblogs.info", + "J6UzbO", + "idn:viralamo.com", + "idn:sellorbuyhomefast.com", + "idn:crazyboy.tech", + "idn:times24h.com", + "idn:buzzfeeg.com", + "idn:dsmenders.com", + "WroSbs", + "idn:vzonetvgh.com" + ], + "Timestamp": "2021-07-20T00:00:00.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: SolarWinds Fixes Critical Vulnerability in Serv-U Managed File Transfer and Secure FTP Products. Most recent link (Jul 10, 2021): https://app.recordedfuture.com/live/sc/1GnDrn8zigTd", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-07-10T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "2/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "144.34.179.162", + "threat.indicator.url.original": "http://144.34.179.162/a", + "threat.indicator.url.path": "/a", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 85.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 97973, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-11-14T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.", + "MitigationString": "", + "Name": "phishingSiteDetected", + "Rule": "Historically Detected Phishing Techniques", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-11-14T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "41 sightings on 19 sources including: Stock market news Company News MarketScreenercom, GlobeNewswire | Software, Yahoo!, globenewswirecom, otcdynamics.com. Most recent link (Oct 3, 2021): https://telecomkh.info/?p=4004", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "XBl0xf", + "c2unu0", + "DVW", + "NPgRlV", + "idn:otcdynamics.com", + "idn:norteenlinea.com", + "N4OmGX", + "idn:snewsonline.com", + "idn:nationalcybersecuritynews.today", + "dCod5e", + "hZ14Az", + "idn:securityopenlab.it", + "idn:clevertechmx.blogspot.com", + "cJzvLR", + "eNeV39", + "dCotni", + "dCo6X1", + "jB6Hnn", + "idn:telecomkh.info" + ], + "Timestamp": "2021-10-03T12:53:49.605Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: No-IP. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 20, 2021.", + "MitigationString": "", + "Name": "recentWeaponizedURL", + "Rule": "Recently Active URL on Weaponized Domain", + "Sources": [ + "report:aRJ1CU" + ], + "Timestamp": "2021-12-29T07:08:29.105Z" + } + ], + "recordedfuture.risk_string": "4/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "adminsys.serveftp.com", + "threat.indicator.url.original": "http://adminsys.serveftp.com/nensa/fabio/ex/478632215/zer7855/nuns566623", + "threat.indicator.url.path": "/nensa/fabio/ex/478632215/zer7855/nuns566623", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 79.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 100260, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "17 sightings on 14 sources including: Security Affairs, sensorstechforum.com, Heimdal Security Blog, securitynewspaper, BBS Kafan Card Forum. Most recent link (Dec 22, 2021): https://d335luupugsy2.cloudfront.net/cms%2Ffiles%2F183750%2F1640120040Log4j_-_Explorao_por_grupos_APT.pdf", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "JNe6Hu", + "TQnwKJ", + "OfMf0W", + "TefIEN", + "VyuDZP", + "Z7kln5", + "bd-Dtt", + "kKLjNc", + "Y7TWfI", + "idn:redpacketsecurity.com", + "idn:eccouncil.org", + "idn:comparaland.com", + "idn:d335luupugsy2.cloudfront.net", + "KVRURg" + ], + "Timestamp": "2021-12-22T16:01:42.134Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: Khonsari Ransomware and Orcus RAT Exploit Log4Shell (CVE-2021-44228), Samples Uploaded on MalwareBazaar. Most recent link (Dec 17, 2021): https://app.recordedfuture.com/live/sc/4SWiMAS816Gj", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-12-17T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "2/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "3.145.115.94", + "threat.indicator.url.extension": "exe", + "threat.indicator.url.original": "http://3.145.115.94/zambo/groenhuyzen.exe", + "threat.indicator.url.path": "/zambo/groenhuyzen.exe", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 79.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 101674, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "53 sightings on 14 sources including: HackDig Posts, Anquanke News, mrhacker.co, Sesin at, Check Point Research. Most recent link (Feb 6, 2021): https://cdn.www.gob.pe/uploads/document/file/1580907/Alerta%20integrada%20de%20seguridad%20digital%20N%C2%B0%xxx-xx-xxxx-PECERT%20.pdf", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "POs2u-", + "U13S_U", + "idn:mrhacker.co", + "Z3TZAQ", + "N4OmGX", + "UqKvRr", + "gBDK5G", + "JExgHv", + "QxXv_c", + "J6UzbO", + "eTNyK6", + "idn:privacy.com.sg", + "e6Ewt_", + "idn:reportcybercrime.com" + ], + "Timestamp": "2021-02-06T12:52:09.042Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.", + "MitigationString": "", + "Name": "recentMalwareSiteDetected", + "Rule": "Recently Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-12-28T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "2/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "gxbrowser.net", + "threat.indicator.url.original": "http://gxbrowser.net", + "threat.indicator.url.path": "", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 78.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 102952, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Insikt Group. 2 reports including \"Fractured Block\u201d Campaign Targets Korean Users. Most recent link (Dec 09, 2018): https://app.recordedfuture.com/live/sc/1RuTxKrDf8Qt", + "MitigationString": "", + "Name": "relatedNote", + "Rule": "Historically Referenced by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2018-12-09T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "33 sightings on 12 sources including: Palo Alto Networks, tistory.com, HackDig Posts, Anquanke News, airmagnet.technology. Most recent tweet: Continued MR.Dropper's attack. (Targething korean cryptocurrency exchange) #hcapital #ioc MD5 : eb459b47be479b61375d7b3c7c568425 URL : hxxps://881[.]000webhostapp[.]com/1.txt PDB : D:\\Attack\\DropperBuild\\x64\\Release\\Dropper.pdb https://t.co/FpsinliQqx [Beyond The Binary]. Most recent link (Sep 3, 2018): https://twitter.com/wugeej/statuses/1036413512732426240", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "JwO7jp", + "idn:tistory.com", + "POs2u-", + "U13S_U", + "ThoB0I", + "idn:airmagnet.technology", + "LErKlN", + "WuLz1r", + "KdwTwF", + "VfsacJ", + "jjf3_B", + "idn:brica.de" + ], + "Timestamp": "2018-09-03T00:40:11.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: 000Webhost. Behavior observed: Malware Distribution. Last observed on Oct 16, 2021.", + "MitigationString": "", + "Name": "recentWeaponizedURL", + "Rule": "Recently Active URL on Weaponized Domain", + "Sources": [ + "report:aRJ1CU" + ], + "Timestamp": "2021-12-29T07:07:42.477Z" + } + ], + "recordedfuture.risk_string": "3/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "881.000webhostapp.com", + "threat.indicator.url.extension": "txt", + "threat.indicator.url.original": "https://881.000webhostapp.com/1.txt", + "threat.indicator.url.path": "/1.txt", + "threat.indicator.url.scheme": "https" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 78.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 104946, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-15T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "38 sightings on 7 sources including: cybersecdn.com, WeLiveSecurity Spain, deepcheck.one, hackeridiot.com, PasteBin. Most recent link (May 27, 2021): https://cybersecdn.com/index.php/2021/05/27/janeleiro-the-time-traveler-a-new-old-banking-trojan-in-brazil/", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "idn:cybersecdn.com", + "fWD1r9", + "idn:deepcheck.one", + "idn:hackeridiot.com", + "Jv_xrR", + "ONMgMx", + "idn:nationalcybersecuritynews.today" + ], + "Timestamp": "2021-05-27T22:48:00.256Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: DuckDNS. Behavior observed: Malware Distribution. Last observed on Oct 15, 2021.", + "MitigationString": "", + "Name": "recentWeaponizedURL", + "Rule": "Recently Active URL on Weaponized Domain", + "Sources": [ + "report:aRJ1CU" + ], + "Timestamp": "2021-12-29T06:34:00.698Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: New Janeleiro Banking Trojan Targets Corporate Users in Brazil. Most recent link (Apr 06, 2021): https://app.recordedfuture.com/live/sc/4wolQHrxLiwd", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-04-06T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "4/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "comunicador.duckdns.org", + "threat.indicator.url.extension": "php", + "threat.indicator.url.original": "http://comunicador.duckdns.org/catalista/lixo/index.php", + "threat.indicator.url.path": "/catalista/lixo/index.php", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 75.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 107085, + "recordedfuture.evidence_details": [ + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: Afraid.org. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 28, 2021.", + "MitigationString": "", + "Name": "recentWeaponizedURL", + "Rule": "Recently Active URL on Weaponized Domain", + "Sources": [ + "report:aRJ1CU" + ], + "Timestamp": "2021-12-28T22:15:49.631Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.", + "MitigationString": "", + "Name": "recentMalwareSiteDetected", + "Rule": "Recently Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-12-28T00:00:00.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "2 sightings on 2 sources: Bitdefender, Urlscan.io. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.", + "MitigationString": "", + "Name": "recentPhishingSiteDetected", + "Rule": "Recently Detected Phishing Techniques", + "Sources": [ + "d3Awkm", + "eKv4Jm" + ], + "Timestamp": "2021-12-28T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "3/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "www.jeanninecatddns.chickenkiller.com", + "threat.indicator.url.original": "https://www.jeanninecatddns.chickenkiller.com/signin-authflow", + "threat.indicator.url.path": "/signin-authflow", + "threat.indicator.url.scheme": "https" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 75.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 108580, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Aug 13, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-08-13T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "24 sightings on 9 sources including: Malware News - Malware Analysis, News and Indicators, microsoft.com, sociabble.com, 4-traders.com, MarketScreener.com | Stock Market News. Most recent link (Aug 13, 2021): https://www.marketscreener.com/quote/stock/MICROSOFT-CORPORATION-4835/news/Microsoft-Attackers-use-Morse-code-other-encryption-methods-in-evasive-phishing-campaign-36161110/?utm_medium=RSS&utm_content=20210813", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "gBDK5G", + "idn:microsoft.com", + "idn:sociabble.com", + "KBTQ2e", + "dCotni", + "g9rk5F", + "Z7kln5", + "idn:cda.ms", + "idn:thewindowsupdate.com" + ], + "Timestamp": "2021-08-13T17:03:19.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: Microsoft Warns of Attacks Targeting Microsoft Office 365 Users. Most recent link (Aug 12, 2021): https://app.recordedfuture.com/live/sc/4BBhpn1ApBQR", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-08-12T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "3/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "coollab.jp", + "threat.indicator.url.extension": "js", + "threat.indicator.url.original": "http://coollab.jp/dir/root/p/09908.js", + "threat.indicator.url.path": "/dir/root/p/09908.js", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 75.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 110421, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 30, 2021.", + "MitigationString": "", + "Name": "phishingSiteDetected", + "Rule": "Historically Detected Phishing Techniques", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-05-30T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "23 sightings on 9 sources including: The Official Google Blog, eccouncil.org, frsecure.com, SoyaCincau, PasteBin. Most recent tweet: Actor controlled sites and accounts Research Blog https://blog.br0vvnn[.]io. Most recent link (Jan 27, 2021): https://twitter.com/techn0m4nc3r/statuses/1354296736357953539", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "Gzt", + "idn:eccouncil.org", + "idn:frsecure.com", + "J-8-Nr", + "Jv_xrR", + "g9rk5F", + "cUg0pv", + "K5LKj8", + "fVAueu" + ], + "Timestamp": "2021-01-27T05:14:38.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: Google Warns of Ongoing Attacks Targeting Security Researchers. Most recent link (Jan 25, 2021): https://app.recordedfuture.com/live/sc/5QCqZ2ZH4lwc", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-01-25T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "3/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "blog.br0vvnn.io", + "threat.indicator.url.original": "https://blog.br0vvnn.io", + "threat.indicator.url.path": "", + "threat.indicator.url.scheme": "https" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 75.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 112107, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "24 sightings on 10 sources including: lnkd.in, digitalforensicsmagazineblog PH, mediosdemexico.com, Palo Alto Networks, Security Art Work. Most recent link (Mar 4, 2016): https://lnkd.in/egi-nMa", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "idn:lnkd.in", + "JNe6Gc", + "idn:mediosdemexico.com", + "JwO7jp", + "LCN_6T", + "KA0p6S", + "LErKlN", + "jjf3_B", + "KE9Xit", + "J4bouj" + ], + "Timestamp": "2016-03-04T14:33:36.543Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 27, 2021.", + "MitigationString": "", + "Name": "recentMalwareSiteDetected", + "Rule": "Recently Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-12-27T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "2/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "init.icloud-analysis.com", + "threat.indicator.url.original": "http://init.icloud-analysis.com", + "threat.indicator.url.path": "", + "threat.indicator.url.scheme": "http" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_domain_default.csv.log b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_domain_default.csv.log new file mode 100644 index 000000000000..f904e04374b0 --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_domain_default.csv.log @@ -0,0 +1,10 @@ +"Name","Risk","RiskString","EvidenceDetails" +"xohrikvjhiu.eu","96","5/45","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""21 sightings on 4 sources: Proofpoint, PasteBin, The Daily Advance, @DGAFeedAlerts. Most recent tweet: New ramnit Dom: xohrikvjhiu[.]eu IP: 13[.]90[.]196[.]81 NS: https://t.co/nTqEOuAW2E https://t.co/QdrtFSplyz. Most recent link (Nov 16, 2019): https://twitter.com/DGAFeedAlerts/statuses/1195824847915491329"", ""Sources"": [""QQA438"", ""Jv_xrR"", ""SlNfa3"", ""KvPSaU""], ""Timestamp"": ""2019-11-16T22:03:55.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""18 sightings on 2 sources: Proofpoint, The Daily Advance. Most recent link (Nov 12, 2018): https://www.proofpoint.com/us/threat-insight/post/sload-and-ramnit-pairing-sustained-campaigns-against-uk-and-italy#.W-nmxyGcuiY.twitter"", ""Sources"": [""QQA438"", ""KvPSaU""], ""Timestamp"": ""2018-11-12T20:48:08.675Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Referenced by Insikt Group"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Insikt Group. 1 report: Proofpoint Researchers Observe sLoad and Ramnit in Campaigns Against The U.K. and Italy. Most recent link (Oct 23, 2018): https://app.recordedfuture.com/live/sc/4KSWum2M6Lx7"", ""Sources"": [""VKz42X""], ""Timestamp"": ""2018-10-23T00:00:00.000Z"", ""Name"": ""relatedNote"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Operation"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Mar 23, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-03-23T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C DNS Name"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bambenek Consulting C&C Blocklist."", ""Sources"": [""report:QhR8Qs""], ""Timestamp"": ""2021-12-29T07:12:02.455Z"", ""Name"": ""recentCncSite"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"wgwuhauaqcrx.com","95","6/45","{""EvidenceDetails"": [{""Rule"": ""Historically Reported by DHS AIS"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-216d34d4-67bd-4add-ae6e-4ddec27dcb0e (Jul 25, 2019)."", ""Sources"": [""UZNze8""], ""Timestamp"": ""2019-07-25T00:46:19.000Z"", ""Name"": ""dhsAis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/"", ""Sources"": [""ST7rfx""], ""Timestamp"": ""2017-05-17T19:31:06.000Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported in Threat List"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 19, 2021, and Jul 21, 2021."", ""Sources"": [""report:Tluf00""], ""Timestamp"": ""2021-12-29T07:21:52.311Z"", ""Name"": ""historicalThreatListMembership"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Operation"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 9, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-07-09T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Malware Analysis DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/"", ""Sources"": [""NKaUXl""], ""Timestamp"": ""2017-07-06T00:00:00.000Z"", ""Name"": ""malwareAnalysis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C DNS Name"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bambenek Consulting C&C Blocklist."", ""Sources"": [""report:QhR8Qs""], ""Timestamp"": ""2021-12-29T07:21:52.303Z"", ""Name"": ""recentCncSite"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"wbmpvebw.com","95","6/45","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: wbmpvebw[.]com IP: 209[.]99[.]40[.]220 NS: https://t.co/bH4I7LoMNf https://t.co/KTCPYU87bT. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551578264821760"", ""Sources"": [""SlNfa3""], ""Timestamp"": ""2020-01-04T20:03:37.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html"", ""Sources"": [""KVQ2PB""], ""Timestamp"": ""2017-03-08T01:18:17.569Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported in Threat List"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Feb 18, 2021, and Feb 24, 2021."", ""Sources"": [""report:Tluf00""], ""Timestamp"": ""2021-12-29T07:16:05.008Z"", ""Name"": ""historicalThreatListMembership"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Operation"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-06-30T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Malware Analysis DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/"", ""Sources"": [""NKaUXl""], ""Timestamp"": ""2017-05-08T00:00:00.000Z"", ""Name"": ""malwareAnalysis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C DNS Name"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bambenek Consulting C&C Blocklist."", ""Sources"": [""report:QhR8Qs""], ""Timestamp"": ""2021-12-29T07:16:05.007Z"", ""Name"": ""recentCncSite"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"ckgryagcibbcf.com","94","5/45","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: ckgryagcibbcf[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333576053207040"", ""Sources"": [""SlNfa3""], ""Timestamp"": ""2021-02-01T20:08:18.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html"", ""Sources"": [""KVQ2PB""], ""Timestamp"": ""2017-03-08T01:18:17.569Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Operation"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-06-15T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Malware Analysis DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/"", ""Sources"": [""NKaUXl""], ""Timestamp"": ""2016-04-11T00:00:00.000Z"", ""Name"": ""malwareAnalysis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C DNS Name"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bambenek Consulting C&C Blocklist."", ""Sources"": [""report:QhR8Qs""], ""Timestamp"": ""2021-12-29T06:40:44.358Z"", ""Name"": ""recentCncSite"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"jpuityvakjgg.com","94","5/45","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jpuityvakjgg[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333600627683330"", ""Sources"": [""SlNfa3""], ""Timestamp"": ""2021-02-01T20:08:24.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html"", ""Sources"": [""KVQ2PB""], ""Timestamp"": ""2017-03-08T01:18:17.569Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Operation"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 17, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-06-17T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Malware Analysis DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/"", ""Sources"": [""NKaUXl""], ""Timestamp"": ""2017-05-08T00:00:00.000Z"", ""Name"": ""malwareAnalysis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C DNS Name"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bambenek Consulting C&C Blocklist."", ""Sources"": [""report:QhR8Qs""], ""Timestamp"": ""2021-12-29T06:46:28.155Z"", ""Name"": ""recentCncSite"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"jexgpprgph.com","94","5/45","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jexgpprgph[.]com IP: 209[.]99[.]40[.]222 NS: https://t.co/IGcQwMvzjy https://t.co/J2gdsVMl8U. Most recent link (Dec 13, 2018): https://twitter.com/DGAFeedAlerts/statuses/1073277207919947778"", ""Sources"": [""SlNfa3""], ""Timestamp"": ""2018-12-13T18:03:21.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html"", ""Sources"": [""KVQ2PB""], ""Timestamp"": ""2017-03-08T01:18:17.569Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Operation"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-06-30T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Malware Analysis DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/"", ""Sources"": [""NKaUXl""], ""Timestamp"": ""2017-05-08T00:00:00.000Z"", ""Name"": ""malwareAnalysis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C DNS Name"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bambenek Consulting C&C Blocklist."", ""Sources"": [""report:QhR8Qs""], ""Timestamp"": ""2021-12-29T06:40:30.778Z"", ""Name"": ""recentCncSite"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"cascotqhij.com","94","5/45","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: cascotqhij[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/czXUwYeuxf https://t.co/nKWfZguQSF. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333566758682629"", ""Sources"": [""SlNfa3""], ""Timestamp"": ""2021-02-01T20:08:16.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html"", ""Sources"": [""KVQ2PB""], ""Timestamp"": ""2017-03-08T01:18:17.569Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Operation"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 27, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-07-27T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Malware Analysis DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/"", ""Sources"": [""NKaUXl""], ""Timestamp"": ""2016-04-11T00:00:00.000Z"", ""Name"": ""malwareAnalysis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C DNS Name"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bambenek Consulting C&C Blocklist."", ""Sources"": [""report:QhR8Qs""], ""Timestamp"": ""2021-12-29T06:34:06.062Z"", ""Name"": ""recentCncSite"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"npcvnorvyhelagx.com","94","5/45","{""EvidenceDetails"": [{""Rule"": ""Historically Reported by DHS AIS"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-e26bfe3a-8f67-4f57-9449-3f183fe94c07 (Jul 25, 2019)."", ""Sources"": [""UZNze8""], ""Timestamp"": ""2019-07-25T01:51:04.000Z"", ""Name"": ""dhsAis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/"", ""Sources"": [""ST7rfx""], ""Timestamp"": ""2017-05-17T19:31:06.000Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Operation"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Apr 1, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-04-01T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Malware Analysis DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/"", ""Sources"": [""NKaUXl""], ""Timestamp"": ""2017-07-06T00:00:00.000Z"", ""Name"": ""malwareAnalysis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C DNS Name"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bambenek Consulting C&C Blocklist."", ""Sources"": [""report:QhR8Qs""], ""Timestamp"": ""2021-12-29T06:45:21.381Z"", ""Name"": ""recentCncSite"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"uxlyihgvfnqcrfcf.com","94","5/45","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: uxlyihgvfnqcrfcf[.]com IP: 209[.]99[.]40[.]224 NS: https://t.co/03Dbt4N72t https://t.co/l29AcRDSvE. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551575332982790"", ""Sources"": [""SlNfa3""], ""Timestamp"": ""2020-01-04T20:03:36.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html"", ""Sources"": [""KVQ2PB""], ""Timestamp"": ""2017-03-08T01:18:17.569Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Operation"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 6, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-05-06T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Malware Analysis DNS Name"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/"", ""Sources"": [""NKaUXl""], ""Timestamp"": ""2017-05-08T00:00:00.000Z"", ""Name"": ""malwareAnalysis"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C DNS Name"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bambenek Consulting C&C Blocklist."", ""Sources"": [""report:QhR8Qs""], ""Timestamp"": ""2021-12-29T06:35:26.677Z"", ""Name"": ""recentCncSite"", ""MitigationString"": """", ""Criticality"": 4.0}]}" diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_domain_default.csv.log-expected.json b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_domain_default.csv.log-expected.json new file mode 100644 index 000000000000..a07a14a023c6 --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_domain_default.csv.log-expected.json @@ -0,0 +1,777 @@ +[ + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 96.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 45, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "18 sightings on 2 sources: Proofpoint, The Daily Advance. Most recent link (Nov 12, 2018): https://www.proofpoint.com/us/threat-insight/post/sload-and-ramnit-pairing-sustained-campaigns-against-uk-and-italy#.W-nmxyGcuiY.twitter", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "QQA438", + "KvPSaU" + ], + "Timestamp": "2018-11-12T20:48:08.675Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Mar 23, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-03-23T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: Proofpoint Researchers Observe sLoad and Ramnit in Campaigns Against The U.K. and Italy. Most recent link (Oct 23, 2018): https://app.recordedfuture.com/live/sc/4KSWum2M6Lx7", + "MitigationString": "", + "Name": "relatedNote", + "Rule": "Historically Referenced by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2018-10-23T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "21 sightings on 4 sources: Proofpoint, PasteBin, The Daily Advance, @DGAFeedAlerts. Most recent tweet: New ramnit Dom: xohrikvjhiu[.]eu IP: 13[.]90[.]196[.]81 NS: https://t.co/nTqEOuAW2E https://t.co/QdrtFSplyz. Most recent link (Nov 16, 2019): https://twitter.com/DGAFeedAlerts/statuses/1195824847915491329", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "QQA438", + "Jv_xrR", + "SlNfa3", + "KvPSaU" + ], + "Timestamp": "2019-11-16T22:03:55.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T07:12:02.455Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "xohrikvjhiu.eu" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 95.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 2436, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-07-06T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "ST7rfx" + ], + "Timestamp": "2017-05-17T19:31:06.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 9, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-07-09T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-216d34d4-67bd-4add-ae6e-4ddec27dcb0e (Jul 25, 2019).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Historically Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2019-07-25T00:46:19.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 19, 2021, and Jul 21, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:Tluf00" + ], + "Timestamp": "2021-12-29T07:21:52.311Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T07:21:52.303Z" + } + ], + "recordedfuture.risk_string": "6/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "wgwuhauaqcrx.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 95.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 4976, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-05-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-30T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: wbmpvebw[.]com IP: 209[.]99[.]40[.]220 NS: https://t.co/bH4I7LoMNf https://t.co/KTCPYU87bT. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551578264821760", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2020-01-04T20:03:37.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Feb 18, 2021, and Feb 24, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:Tluf00" + ], + "Timestamp": "2021-12-29T07:16:05.008Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T07:16:05.007Z" + } + ], + "recordedfuture.risk_string": "6/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "wbmpvebw.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 7524, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2016-04-11T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-15T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: ckgryagcibbcf[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333576053207040", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2021-02-01T20:08:18.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:40:44.358Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "ckgryagcibbcf.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 9658, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-05-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 17, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-17T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jpuityvakjgg[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333600627683330", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2021-02-01T20:08:24.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:46:28.155Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "jpuityvakjgg.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 11789, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-05-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-30T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jexgpprgph[.]com IP: 209[.]99[.]40[.]222 NS: https://t.co/IGcQwMvzjy https://t.co/J2gdsVMl8U. Most recent link (Dec 13, 2018): https://twitter.com/DGAFeedAlerts/statuses/1073277207919947778", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2018-12-13T18:03:21.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:40:30.778Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "jexgpprgph.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 13918, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2016-04-11T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 27, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-07-27T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: cascotqhij[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/czXUwYeuxf https://t.co/nKWfZguQSF. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333566758682629", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2021-02-01T20:08:16.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:34:06.062Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "cascotqhij.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 16046, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-07-06T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "ST7rfx" + ], + "Timestamp": "2017-05-17T19:31:06.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Apr 1, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-04-01T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-e26bfe3a-8f67-4f57-9449-3f183fe94c07 (Jul 25, 2019).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Historically Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2019-07-25T01:51:04.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:45:21.381Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "npcvnorvyhelagx.com" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 94.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 18164, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/", + "MitigationString": "", + "Name": "malwareAnalysis", + "Rule": "Historical Malware Analysis DNS Name", + "Sources": [ + "NKaUXl" + ], + "Timestamp": "2017-05-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "KVQ2PB" + ], + "Timestamp": "2017-03-08T01:18:17.569Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 6, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Operation", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-05-06T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: uxlyihgvfnqcrfcf[.]com IP: 209[.]99[.]40[.]224 NS: https://t.co/03Dbt4N72t https://t.co/l29AcRDSvE. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551575332982790", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged DNS Name", + "Sources": [ + "SlNfa3" + ], + "Timestamp": "2020-01-04T20:03:36.000Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Bambenek Consulting C&C Blocklist.", + "MitigationString": "", + "Name": "recentCncSite", + "Rule": "Recent C&C DNS Name", + "Sources": [ + "report:QhR8Qs" + ], + "Timestamp": "2021-12-29T06:35:26.677Z" + } + ], + "recordedfuture.risk_string": "5/45", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "domain-name", + "threat.indicator.url.domain": "uxlyihgvfnqcrfcf.com" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_hash_default.csv.log b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_hash_default.csv.log new file mode 100644 index 000000000000..58d47795d102 --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_hash_default.csv.log @@ -0,0 +1,10 @@ +"Name","Algorithm","Risk","RiskString","EvidenceDetails" +"38e992eb852ab0c4ac03955fb0dc9bb38e64010fdf9c05331d2b02b6e05689c2","SHA-256","89","6/14","{""EvidenceDetails"": [{""Rule"": ""Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""50 sightings on 10 sources including: Security Bloggers Network, TechTarget Search Security, Bleeping Computer, Guided Collection, Bleepingcomputer Forums. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561"", ""Sources"": [""NSAcUx"", ""KCdHcb"", ""J6UzbO"", ""Rlso4a"", ""hkE5DK"", ""cJMUDF"", ""TZRwk8"", ""QMTzEI"", ""LUhTGd"", ""J5NRun""], ""Timestamp"": ""2021-12-21T08:40:00.000Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Linked to Attack Vector"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""32 sightings on 27 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @neonprimetime, @rpsanch. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752"", ""Sources"": [""T1bwMv"", ""LC-zVm"", ""QFvaUy"", ""P_upBR"", ""T2OA5Q"", ""K20lXV"", ""TGgDPZ"", ""hkIDTa"", ""LqRZCN"", ""Vd51cf"", ""ha2FFj"", ""UmsU31"", ""K7wUX2"", ""P_ivKa"", ""Qj3TQr"", ""idn:wordpress.com"", ""J-mrOR"", ""QPbAan"", ""VeioBt"", ""WlbRkJ"", ""K7sErA"", ""TvfQzk"", ""TP1vbk"", ""SrKvJ0"", ""SqCj4s"", ""VXaDYo"", ""bk2VX4""], ""Timestamp"": ""2021-12-25T03:23:47.000Z"", ""Name"": ""linkedToVector"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Cyber Attack"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""6 sightings on 6 sources including: Messaging Platforms - Uncategorized, @_mr_touch. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289"", ""Sources"": [""XV7DoD"", ""Ym7dzt"", ""LKKAV1"", ""VeioBt"", ""Y7TWfI"", ""KGS-xC""], ""Timestamp"": ""2019-05-28T14:17:41.000Z"", ""Name"": ""linkedToCyberAttack"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Malware"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""119 sightings on 42 sources including: Malware-Traffic-Analysis.net - Blog Entries, Doc Player, GhostBin, Data Breach Today.eu | Updates, Codex - Recent changes en. 43 related malware families including Dardesh, AZORult, Emotet, Ryuk Ransomware, GandCrab. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se você jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. Tô rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321"", ""Sources"": [""TvGJYk"", ""LErKlJ"", ""QWOrKl"", ""LKKAV1"", ""W4ygGi"", ""PATKM7"", ""T1bwMv"", ""TY6igj"", ""LjkJhE"", ""kuKt0c"", ""QAy9GA"", ""LbYmLr"", ""K20lXV"", ""QZe7TG"", ""idn:droppdf.com"", ""QAmbRP"", ""V_o1DL"", ""TbciDE"", ""XV7DoD"", ""P_j5Dw"", ""QNmgPm"", ""TGXqeD"", ""KGS-xC"", ""L3kVdM"", ""QMfGAr"", ""h6VVAH"", ""doLlw5"", ""UrsUKT"", ""JOU"", ""MIKjae"", ""P_oIyV"", ""QJ6TQK"", ""RfVd0T"", ""J6UzbO"", ""Ql9O5c"", ""USKpXp"", ""TP1vbk"", ""SrKvJ0"", ""Tq2nAb"", ""P_ov9o"", ""VXaDYo"", ""idn:index-of.es""], ""Timestamp"": ""2021-11-27T23:07:37.000Z"", ""Name"": ""linkedToMalware"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Reported by DHS AIS"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-12195723-7c56-4c63-b828-fc340dd4050a (Dec 20, 2018)."", ""Sources"": [""UZNze8""], ""Timestamp"": ""2018-12-20T21:13:36.000Z"", ""Name"": ""dhsAis"", ""MitigationString"": """", ""Criticality"": 3.0}, {""Rule"": ""Positive Malware Verdict"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""5 sightings on 3 sources: Malware-Traffic-Analysis.net - Blog Entries, ReversingLabs, PolySwarm. Most recent link (Dec 15, 2018): https://www.malware-traffic-analysis.net/2018/12/14/index.html"", ""Sources"": [""LErKlJ"", ""TbciDE"", ""doLlw5""], ""Timestamp"": ""2020-07-11T09:55:23.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71","SHA-256","89","7/14","{""EvidenceDetails"": [{""Rule"": ""Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""28 sightings on 8 sources including: Dancho Danchev's Blog, SecureWorks, Talos Intel, Unit 42 Palo Alto Networks, Cisco Japan Blog. Most recent link (Mar 12, 2021): https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group?es_p=13420131"", ""Sources"": [""JfqIbv"", ""Z2mQh2"", ""PA-rR4"", ""jjf3_B"", ""clDYM8"", ""T5"", ""rN"", ""J5NRun""], ""Timestamp"": ""2021-03-12T20:30:37.672Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Linked to Attack Vector"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""69 sightings on 18 sources including: Stock market news Company News MarketScreenercom, HackDig Posts, Sesin at, US CERT CISA Alerts, citizensudo.com. 6 related attack vectors including Powershell Attack, Supply Chain Attack, Target Destination Manipulation, Reconnaissance, C&C Server. Most recent link (Apr 15, 2021): https://www.cisa.gov/uscert/ncas/alerts/aa20-352a"", ""Sources"": [""XBl0xf"", ""POs2u-"", ""Z3TZAQ"", ""hhY_oz"", ""idn:citizensudo.com"", ""VKz42X"", ""PA-rR4"", ""POs2tz"", ""idn:firsthackersnews.com"", ""KcjdRW"", ""dCotni"", ""idn:comodo.com"", ""gI8s5W"", ""hibUwt"", ""rN"", ""idn:reportcybercrime.com"", ""idn:eshielder.com"", ""idn:edsitrend.com""], ""Timestamp"": ""2021-04-15T00:00:00.000Z"", ""Name"": ""linkedToVector"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Vulnerability"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""11 sightings on 2 sources: GitHub, Insikt Group. 5 related cyber vulnerabilities: CWE-20, CWE-287, CVE-2020-10148, CVE-2020-1938, CWE-269. Most recent link (Dec 27, 2021): https://github.com/teamt5-it/official-website-v2/blob/master/_site/_next/data/64e2c6f134e73517d6ff737822e83cd75cf633c6/tw/posts/ithome-ghostcat-apache-tomcat-ajp-vulnerability.json"", ""Sources"": [""MIKjae"", ""VKz42X""], ""Timestamp"": ""2021-12-27T07:36:54.000Z"", ""Name"": ""linkedToVuln"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Malware"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""175 sightings on 31 sources including: 4-traders.com, SentinelLabs, Sesin at, Cisco Japan Blog, McAfee. 8 related malware families including WebShell, Ransomware, Backdoor, Backdoor Shell, SUNBURST. Most recent tweet: Malcode highlighted in 'App_Web_logoimagehandler.ashx.b6031896.dll' (c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71) #SolarWinds #SUNBURST https://t.co/lyvnVHuTb2. Most recent link (Dec 16, 2020): https://twitter.com/_mynameisgeff/statuses/1339070792705830913"", ""Sources"": [""TuWseX"", ""KBTQ2e"", ""eP3CYX"", ""Z3TZAQ"", ""clDYM8"", ""rN"", ""VKz42X"", ""idn:elemendar.com"", ""idn:securitysummitperu.com"", ""PA-rR4"", ""idn:terabitweb.com"", ""eTNyK6"", ""gBQB48"", ""bMZlEg"", ""idn:edsitrend.com"", ""idn:infoblox.com"", ""UZNze8"", ""Z2mQh2"", ""XBl0xf"", ""dCpZqs"", ""jmpFm1"", ""T5"", ""doLlw5"", ""gBDK5G"", ""MIKjae"", ""idn:firsthackersnews.com"", ""jjf3_B"", ""Jv_xrR"", ""dCotni"", ""idn:comodo.com"", ""hibUwt""], ""Timestamp"": ""2020-12-16T04:52:10.000Z"", ""Name"": ""linkedToMalware"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Reported by DHS AIS"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""3 sightings on 1 source: DHS Automated Indicator Sharing. 3 reports including AA20-352A APT Compromise of Govt Agencies, Critical Infrastructure, and Private Sector Organizations, from CISA, Government Facilities Sector, CISA, Government Facilities Sector, NCCIC:STIX_Package-673aacd1-1852-4d44-bd93-0c44940a6358 (Feb 3, 2021)."", ""Sources"": [""UZNze8""], ""Timestamp"": ""2021-02-03T21:32:08.000Z"", ""Name"": ""dhsAis"", ""MitigationString"": """", ""Criticality"": 3.0}, {""Rule"": ""Positive Malware Verdict"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""6 sightings on 2 sources: Sophos Virus and Spyware Threats, PolySwarm. Most recent link (Dec 17, 2020): https://news.sophos.com/fr-fr/2020/12/15/cyberattaque-contre-solarwinds-comment-savoir-si-vous-etes-concerne/"", ""Sources"": [""K16tAG"", ""doLlw5""], ""Timestamp"": ""2020-12-20T15:18:53.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 3.0}, {""Rule"": ""Reported by Insikt Group"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""13 sightings on 1 source: Insikt Group. 4 reports including Researchers Linked Supernova Malware to Spiral Group. Most recent link (Mar 08, 2021): https://app.recordedfuture.com/live/sc/5DIp4RIUiJz6"", ""Sources"": [""VKz42X""], ""Timestamp"": ""2021-03-08T00:00:00.000Z"", ""Name"": ""analystNote"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"b66db3a06c2955a9cb71a8718970c592","MD5","89","5/14","{""EvidenceDetails"": [{""Rule"": ""Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""10 sightings on 7 sources including: ISC Sans Diary Archive, SecureWorks, InfoCON: green, ISC | Latest Headlines, SANS Internet Storm Center. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html"", ""Sources"": [""TCw6v6"", ""Z2mQh2"", ""2d"", ""cJuZvt"", ""JYxY8X"", ""J2_htN"", ""jXNbON""], ""Timestamp"": ""2021-12-20T04:54:00.000Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Linked to Attack Vector"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""6 sightings on 5 sources: GitHub, SANS Internet Storm Center, Messaging Platforms - Uncategorized, @decalage2, @simonwargniez. 3 related attack vectors: Remote Code Execution, Zero Day Exploit, Cyberattack. Most recent tweet: Great lists of software affected by #Log4Shell / CVE-2021-44228 / Log4J RCE: https://t.co/TpEQXKgMGW by @ncsc_nl https://t.co/FA5i8zR5Z1 by @CISAgov https://t.co/0xVZJvMcpU by @SwitHak https://t.co/788knvztWV https://t.co/WMkXslhgWS #log4j #log4j2. Most recent link (Dec 15, 2021): https://twitter.com/decalage2/statuses/1471121875816353800"", ""Sources"": [""LUf99I"", ""MIKjae"", ""JYxY8X"", ""Y7TWfI"", ""KIRe_w""], ""Timestamp"": ""2021-12-15T14:16:01.000Z"", ""Name"": ""linkedToVector"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Vulnerability"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""108 sightings on 78 sources including: bund.de, tistory.com, PasteBin, Sesin at, Messaging Platforms - Uncategorized. 24 related cyber vulnerabilities including CWE-22, CWE-611, CVE-2019-19781, CVE-2020-16898, CWE-20. Most recent tweet: Security advisories, bulletins, and vendor responses related to Log4Shell #Log4Shell #Log4j #cybersecurity #infosec #vendorsecurity https://t.co/Vpwrhdppm7. Most recent link (Dec 22, 2021): https://twitter.com/arrgibbs/statuses/1473733864459841538"", ""Sources"": [""VQpQDR"", ""KFu3Rc"", ""LUf99I"", ""SGCsBG"", ""U94lUG"", ""KFcv42"", ""QT0CFv"", ""UHvtcg"", ""KFUbjU"", ""KHwUI5"", ""KKSt8d"", ""idn:bund.de"", ""VmIbAC"", ""QGT0Vy"", ""ejfM20"", ""KGlTEd"", ""QCoXJo"", ""RXSwU8"", ""idn:tistory.com"", ""LpdVul"", ""K-eKsL"", ""TKYCSz"", ""SkABVK"", ""SdGk_x"", ""LI6d7O"", ""LQIfBf"", ""U6B2hC"", ""f7_CfD"", ""LKt0HB"", ""RHS4v8"", ""KKmN5m"", ""YfJqp2"", ""Jv_xrR"", ""RJ2_NX"", ""VZXzSv"", ""k0QC11"", ""KFWBRs"", ""LRk_pt"", ""Qn2VRQ"", ""kGHFKP"", ""ShBO5M"", ""T-GSBp"", ""KNdyHF"", ""QLCTXP"", ""Z3TZAQ"", ""Khf99v"", ""KHZhjO"", ""SHH61D"", ""Knx_su"", ""LL8-pr"", ""QpmWTf"", ""KIRe_w"", ""QIea7F"", ""SlhG3F"", ""KIdj8R"", ""SQqKS8"", ""Lq6DNq"", ""QpYsBa"", ""d-ZMP2"", ""LOoye8"", ""QEUmiJ"", ""ewfPjC"", ""LBNFpV"", ""QTpbKE"", ""Y7TWfI"", ""KGS-xC"", ""eifkGz"", ""au2SGr"", ""SKw4tT"", ""KGW5kn"", ""Q9y5Ki"", ""KGxw1d"", ""MIKjae"", ""LO5p1C"", ""JYxY8X"", ""KJsMEF"", ""QBLBHH"", ""k7WJ2k""], ""Timestamp"": ""2021-12-22T19:15:08.000Z"", ""Name"": ""linkedToVuln"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Malware"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""11 sightings on 3 sources: bund.de, SANS Internet Storm Center, Sesin at. 2 related malware families: Ransomware, Botnet. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html"", ""Sources"": [""idn:bund.de"", ""JYxY8X"", ""Z3TZAQ""], ""Timestamp"": ""2021-12-20T04:54:00.000Z"", ""Name"": ""linkedToMalware"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Positive Malware Verdict"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Naked Security. Most recent link (Dec 18, 2021): https://news.sophos.com/en-us/2021/12/17/log4shell-response-and-mitigation-recommendations/"", ""Sources"": [""J2_htN""], ""Timestamp"": ""2021-12-18T00:20:04.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745","SHA-256","89","8/14","{""EvidenceDetails"": [{""Rule"": ""Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""91 sightings on 19 sources including: Security News Concentrator, Fortinet, Trend Micro, CrowdStrike, FireEye Threat Research Blog. Most recent link (Dec 20, 2019): https://threatvector.cylance.com/en_us/home/threat-spotlight-petya-like-ransomware-is-nasty-wiper.html"", ""Sources"": [""QS89Bd"", ""KVP0jz"", ""T5"", ""JYxY5G"", ""WR_Ohh"", ""Jt4ExJ"", ""Kzw0Pm"", ""JQH96m"", ""2d"", ""JYxY8X"", ""rN"", ""PA-rR4"", ""VyWQM7"", ""Lp_esG"", ""ONMgMx"", ""4n"", ""QMTzEI"", ""83"", ""K0TN7r""], ""Timestamp"": ""2019-12-20T01:04:11.602Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported in Threat List"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 6, 2017, and Jul 17, 2017."", ""Sources"": [""report:Tluf00""], ""Timestamp"": ""2021-12-24T20:03:09.087Z"", ""Name"": ""historicalThreatListMembership"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Linked to Attack Vector"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""14 sightings on 5 sources including: Assiste.Forum, @arturodicorinto. 2 related attack vectors: ShellCode, Cyberattack. Most recent tweet: They're getting quicker at updating.. #petya #cyberattack https://t.co/px0g9BSpod. Most recent link (Jun 27, 2017): https://twitter.com/SupersizedSam/statuses/879764638845587461"", ""Sources"": [""LP7dc7"", ""LRlngp"", ""Sl8XTb"", ""QMfGAr"", ""J-y3tn""], ""Timestamp"": ""2017-06-27T18:13:29.000Z"", ""Name"": ""linkedToVector"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Vulnerability"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: GitHub. 2 related cyber vulnerabilities: CWE-20, CVE-2017-0143. Most recent link (Oct 10, 2021): https://github.com/demisto/content/blob/master/Packs/RecordedFuture/Integrations/RecordedFuture/example_commands.txt"", ""Sources"": [""MIKjae""], ""Timestamp"": ""2021-10-10T08:21:25.825Z"", ""Name"": ""linkedToVuln"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Cyber Attack"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""10 sightings on 9 sources including: BitcoinTalk.org, @Noemi_hcke. Most recent tweet: #petya related hashes in #virustotal https://t.co/Cv7Pltjhia https://t.co/P3otYPoxBj #ransomware #malware #sha256. Most recent link (Jun 28, 2017): https://twitter.com/Menardconnect/statuses/879885997831368705"", ""Sources"": [""ThowaF"", ""KUtKjP"", ""K84j7t"", ""MghdWI"", ""K8rrfe"", ""QlWPRW"", ""KFsPRz"", ""S-Anbb"", ""KE9dMF""], ""Timestamp"": ""2017-06-28T02:15:44.000Z"", ""Name"": ""linkedToCyberAttack"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Malware"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""834 sightings on 201 sources including: New Jersey Cybersecurity & Communications Integration Cell, lnkd.in, avtech24h.com, Malwr.com, Talos Intel. 21 related malware families including ICS Malware, PetrWrap, Emotet, Trojan, NotPetya. Most recent tweet: #ransomware 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 f65a7dadff844f2dc44a3bd43e1c0d600b1a6c66f6d02734d8f385872ccab0bc b6e8dc95ec939a1f3b184da559c8010ab3dc773e426e63e5aa7ffc44174d8a9d 9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08. Most recent link (Apr 9, 2021): https://twitter.com/RedBeardIOCs/statuses/1380600677249003521"", ""Sources"": [""jbVMcB"", ""idn:lnkd.in"", ""idn:avtech24h.com"", ""K84j7t"", ""Sl8XTb"", ""KGRhOC"", ""NKaUXl"", ""KIoGAG"", ""PA-rR4"", ""LRlngp"", ""rN"", ""Jxh46H"", ""KFL44X"", ""TbciDE"", ""KFNVB9"", ""OJpx5g"", ""K-CGye"", ""KK6oqV"", ""WR_Ohh"", ""idn:twitter.com"", ""fgwEcq"", ""QYsx0D"", ""KIFtR_"", ""Lp_esG"", ""TSFWTw"", ""KGHzAY"", ""P_oEH3"", ""KBTQ2e"", ""QCGHCy"", ""JYxY5G"", ""UQsrUj"", ""idn:cert.ro"", ""idn:bluvector.io"", ""KFUJTL"", ""TFUkSW"", ""P0Gs9I"", ""K8ofB1"", ""KVnnHP"", ""TpaXxw"", ""U5qdTI"", ""idn:zscaler.com"", ""L3kVdM"", ""QMfGAr"", ""KIk8aS"", ""Kzw0Pm"", ""hcELIE"", ""POs2tz"", ""KD6Na4"", ""idn:globalsecuritymag.com"", ""LDd0sl"", ""KVP0jz"", ""Lj8CsQ"", ""K8rrfe"", ""LDejRI"", ""J-y3tn"", ""WXutod"", ""idn:infosecurityfactory.nl"", ""LBlc7C"", ""idn:bg.org.tr"", ""QS89Bd"", ""K9SiDc"", ""Qe89bv"", ""TiY1wu"", ""idn:undernews.fr"", ""idn:iteefactory.nl"", ""KFRGd_"", ""KFVuR_"", ""4n"", ""S-Anbb"", ""KFNZEC"", ""TSazOG"", ""K9Skh1"", ""MghdWI"", ""idn:securityiscoming.com"", ""QS89BG"", ""LVg9nH"", ""KFiGli"", ""K9Vq9B"", ""KLbNtt"", ""VyWQM7"", ""NTakwX"", ""KGoarP"", ""idn:gelsene.net"", ""LwURWv"", ""KGX8VB"", ""ThoB0I"", ""TAIz7D"", ""QBHQ61"", ""TiY1w7"", ""idn:kompasiana.com"", ""idn:t.co"", ""KfDTG0"", ""idn:ictsecuritymagazine.com"", ""Liz5-u"", ""MIKjae"", ""JYxY8X"", ""KUtKjP"", ""idn:cert.pl"", ""Lpm4nc"", ""idn:boozallen.com"", ""RVFHk_"", ""KGmazP"", ""M_7iBk"", ""TStw1W"", ""LFcJLk"", ""K0TN7r"", ""KVRURg"", ""UNe62M"", ""iL8bPu"", ""K76BjK"", ""VRixQe"", ""idn:dfir.pro"", ""KF-l77"", ""idn:gixtools.net"", ""P_oIyV"", ""KGzicb"", ""LGryD9"", ""idn:fb.me"", ""K5nCn5"", ""ThKuX0"", ""SYrUYn"", ""KFKbZE"", ""MAe5tQ"", ""KGm6gS"", ""W4ygGi"", ""g9rk5F"", ""idn:menshaway.blogspot.com"", ""KFsPRz"", ""LDm9iS"", ""RV8KWp"", ""KTuH6e"", ""P_uJi3"", ""KG_Bgt"", ""QAmbRP"", ""idn:csirt.cz"", ""LZYvHh"", ""L0HtmN"", ""KWLqO-"", ""LtUj1D"", ""QMTzDr"", ""idn:dy.si"", ""Lo8Box"", ""K-4reD"", ""KFTeBZ"", ""KKzFno"", ""QMTzEI"", ""KFYLd8"", ""KGABt4"", ""LIizBt"", ""idn:herjavecgroup.com"", ""QAAZRn"", ""K66Zgw"", ""KWz-My"", ""Lb0b3F"", ""idn:emsisoft.vn"", ""LodOTm"", ""KE9dMF"", ""O-Wf5x"", ""LG2dQX"", ""P_-RZy"", ""LK7o9D"", ""K60PUk"", ""KKUqfz"", ""idn:logrhythm.com"", ""Jv_xrR"", ""LP7dc7"", ""MFNOaz"", ""TefIES"", ""KGdGg3"", ""KHNdvY"", ""QBTxvB"", ""idn:swordshield.com"", ""ThowaF"", ""idn:binarydefense.com"", ""idn:indusface.com"", ""QBtnC2"", ""QlWPRW"", ""KHZhjO"", ""idn:idcloudhost.com"", ""LRFVsB"", ""KG2JTH"", ""KIm1im"", ""LAfpKN"", ""BaV"", ""KGW3VP"", ""KFcp5q"", ""LCN_6T"", ""idn:avastvn.com"", ""KFTnbG"", ""TiCWjw"", ""Lmhpq3"", ""KGS-xC"", ""KFVthB"", ""idn:finyear.com"", ""KFji4N"", ""P_7M19"", ""K-b0DI"", ""LV1UMS"", ""idn:safe-cyberdefense.com"", ""Kjk3fx"", ""Q1wlJN""], ""Timestamp"": ""2021-04-09T19:17:06.000Z"", ""Name"": ""linkedToMalware"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Reported by DHS AIS"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-21cebba6-46ed-464e-ad5a-32a8063e1400 (Jun 27, 2017)."", ""Sources"": [""UZNze8""], ""Timestamp"": ""2017-06-27T17:18:01.000Z"", ""Name"": ""dhsAis"", ""MitigationString"": """", ""Criticality"": 3.0}, {""Rule"": ""Positive Malware Verdict"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Jun 27, 2017): ReversingLabs malware file analysis."", ""Sources"": [""TAIz7D"", ""TbciDE"", ""doLlw5""], ""Timestamp"": ""2020-12-17T22:59:03.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"ad2ad0249fafe85877bc79a01e1afd1a44d983c064ad8cb5bc694d29d166217b","SHA-256","89","5/14","{""EvidenceDetails"": [{""Rule"": ""Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561"", ""Sources"": [""Rlso4a"", ""hkE5DK"", ""TZRwk8"", ""J5NRun""], ""Timestamp"": ""2021-12-21T08:40:00.000Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Linked to Attack Vector"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752"", ""Sources"": [""WlbRkJ"", ""ha2FFj"", ""K7wUX2"", ""P_ivKa"", ""J-mrOR"", ""P_upBR""], ""Timestamp"": ""2021-12-25T03:23:47.000Z"", ""Name"": ""linkedToVector"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Cyber Attack"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429"", ""Sources"": [""Y7TWfI""], ""Timestamp"": ""2021-10-18T12:09:43.000Z"", ""Name"": ""linkedToCyberAttack"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Malware"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""47 sightings on 16 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 18 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se você jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. Tô rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321"", ""Sources"": [""TGXqeD"", ""W4ygGi"", ""L3kVdM"", ""QMfGAr"", ""kuKt0c"", ""QAy9GA"", ""JOU"", ""MIKjae"", ""P_oIyV"", ""QJ6TQK"", ""idn:droppdf.com"", ""Ql9O5c"", ""QAmbRP"", ""Tq2nAb"", ""TbciDE"", ""idn:index-of.es""], ""Timestamp"": ""2021-11-27T23:07:37.000Z"", ""Name"": ""linkedToMalware"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Positive Malware Verdict"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: ReversingLabs. Most recent link (Jul 1, 2019): ReversingLabs malware file analysis."", ""Sources"": [""TbciDE""], ""Timestamp"": ""2019-07-01T00:00:00.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"01ba1fb41632594997a41d0c3a911ae5b3034d566ebb991ef76ad76e6f9e283a","SHA-256","89","5/14","{""EvidenceDetails"": [{""Rule"": ""Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Trend Micro. Most recent link (Mar 11, 2021): https://documents.trendmicro.com/assets/pdf/Technical_Brief_Uncleanable_and_Unkillable_The_Evolution_of_IoT_Botnets_Through_P2P_Networking.pdf"", ""Sources"": [""T5""], ""Timestamp"": ""2021-03-11T00:00:00.000Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Linked to Attack Vector"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""31 sightings on 4 sources: @m0rb, @bad_packets, @InfoSex11, @luc4m. 2 related attack vectors: DDOS, Command Injection. Most recent tweet: 2021-06-17T23:29:30 - Commented: https://t.co/j2a05iXOiI #malware #commandinjection. Most recent link (Jun 17, 2021): https://twitter.com/m0rb/statuses/1405668962462011401"", ""Sources"": [""KFwzec"", ""TGgDPZ"", ""cgGiXI"", ""LMcjZ7""], ""Timestamp"": ""2021-06-17T23:29:31.000Z"", ""Name"": ""linkedToVector"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Cyber Attack"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""3 sightings on 2 sources: @bad_packets, @swarmdotmarket. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155"", ""Sources"": [""TGgDPZ"", ""UBjcy3""], ""Timestamp"": ""2020-04-20T21:22:47.000Z"", ""Name"": ""linkedToCyberAttack"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Malware"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""87 sightings on 15 sources including: lumen.com, HackDig Posts, Anquanke News, Daily Dot, centurylink.com. 7 related malware families including Mozi Botnet, Trojan, Qbot, Mirai, DDOS Toolkit. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec. Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155"", ""Sources"": [""idn:lumen.com"", ""POs2u-"", ""U13S_U"", ""Jzl3yj"", ""idn:centurylink.com"", ""doLlw5"", ""POs2t2"", ""idn:cyberswachhtakendra.gov.in"", ""idn:hackxsecurity.com"", ""TGgDPZ"", ""Jv_xrR"", ""TSFWTv"", ""LMcjZ7"", ""UBjcy3"", ""TbciDE""], ""Timestamp"": ""2020-04-20T21:22:47.000Z"", ""Name"": ""linkedToMalware"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Positive Malware Verdict"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Nov 28, 2019): ReversingLabs malware file analysis."", ""Sources"": [""TAIz7D"", ""TbciDE"", ""doLlw5""], ""Timestamp"": ""2021-04-04T07:46:20.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"fecddb7f3fa478be4687ca542c0ecf232ec35a0c2418c8bfe4875686ec373c1e","SHA-256","89","6/14","{""EvidenceDetails"": [{""Rule"": ""Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""45 sightings on 9 sources including: Security Bloggers Network, Bleeping Computer, Guided Collection, Bleepingcomputer Forums, TheServerSide.com | Updates. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561"", ""Sources"": [""NSAcUx"", ""J6UzbO"", ""Rlso4a"", ""hkE5DK"", ""cJMUDF"", ""TZRwk8"", ""QMTzEI"", ""LUhTGd"", ""J5NRun""], ""Timestamp"": ""2021-12-21T08:40:00.000Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Linked to Attack Vector"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""29 sightings on 24 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @rpsanch, @rce_coder. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752"", ""Sources"": [""T1bwMv"", ""LC-zVm"", ""P_upBR"", ""T2OA5Q"", ""K20lXV"", ""TGgDPZ"", ""hkIDTa"", ""LqRZCN"", ""Vd51cf"", ""ha2FFj"", ""UmsU31"", ""ddafo3"", ""K7wUX2"", ""P_ivKa"", ""idn:wordpress.com"", ""J-mrOR"", ""QPbAan"", ""VeioBt"", ""WlbRkJ"", ""TvfQzk"", ""TP1vbk"", ""SrKvJ0"", ""SqCj4s"", ""VXaDYo""], ""Timestamp"": ""2021-12-25T03:23:47.000Z"", ""Name"": ""linkedToVector"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Vulnerability"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: Messaging Platforms - Uncategorized. 2 related cyber vulnerabilities: CVE-2016-6663, CWE-362."", ""Sources"": [""Y7TWfI""], ""Timestamp"": ""2021-12-29T07:27:12.565Z"", ""Name"": ""linkedToVuln"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Cyber Attack"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""10 sightings on 7 sources including: SANS Institute Course Selector Results, Messaging Platforms - Uncategorized, @ecstatic_nobel, @Artilllerie. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289"", ""Sources"": [""Ym7dzt"", ""LKKAV1"", ""OuKV3V"", ""VeioBt"", ""Y7TWfI"", ""KGS-xC"", ""KFSXln""], ""Timestamp"": ""2019-05-28T14:17:41.000Z"", ""Name"": ""linkedToCyberAttack"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Malware"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""114 sightings on 42 sources including: Doc Player, GhostBin, Codex - Recent changes en, droppdf.com, ReversingLabs. 41 related malware families including Dardesh, AZORult, Emotet, GandCrab, Offensive Security Tools (OST). Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se você jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. Tô rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321"", ""Sources"": [""QWOrKl"", ""LKKAV1"", ""W4ygGi"", ""PATKM7"", ""T1bwMv"", ""LjkJhE"", ""kuKt0c"", ""QAy9GA"", ""LbYmLr"", ""K20lXV"", ""QZe7TG"", ""idn:droppdf.com"", ""QAmbRP"", ""TbciDE"", ""P_j5Dw"", ""QNmgPm"", ""TGXqeD"", ""POs2u-"", ""KGS-xC"", ""L3kVdM"", ""QMfGAr"", ""h6VVAH"", ""doLlw5"", ""UrsUKT"", ""JOU"", ""MIKjae"", ""P_oIyV"", ""QJ6TQK"", ""RfVd0T"", ""J6UzbO"", ""POs2tz"", ""VfsacJ"", ""Jv_xrR"", ""Ql9O5c"", ""USKpXp"", ""TP1vbk"", ""SrKvJ0"", ""Tq2nAb"", ""KFSXln"", ""P_ov9o"", ""VXaDYo"", ""idn:index-of.es""], ""Timestamp"": ""2021-11-27T23:07:37.000Z"", ""Name"": ""linkedToMalware"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Positive Malware Verdict"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""2 sightings on 2 sources: ReversingLabs, PolySwarm. Most recent link (Apr 19, 2018): ReversingLabs malware file analysis."", ""Sources"": [""TbciDE"", ""doLlw5""], ""Timestamp"": ""2021-02-10T09:10:10.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b","SHA-256","89","3/14","{""EvidenceDetails"": [{""Rule"": ""Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""58 sightings on 5 sources: SecureWorks, InfoCON: green, McAfee, Talos Intel, Kaspersky Securelist and Lab. Most recent link (Jun 28, 2018): https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27077/en_US/McAfee_Labs_WannaCry_June24_2018.pdf"", ""Sources"": [""Z2mQh2"", ""2d"", ""rN"", ""PA-rR4"", ""4n""], ""Timestamp"": ""2018-06-28T08:11:36.570Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Linked to Malware"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1688 sightings on 26 sources including: lnkd.in, Doc Player, Cyber4Sight, voicebox.pt, VKontakte. 2 related malware families: Wcry, Ransomware. Most recent link (Sep 13, 2017): https://malwr.com/analysis/ZmIzN2E3MzQyM2I0NDYwODllOWRhMmQxODg3YzMxZDA/"", ""Sources"": [""idn:lnkd.in"", ""W4ygGi"", ""S2tpaX"", ""idn:voicebox.pt"", ""SIjHV9"", ""PJHGaq"", ""PA-rR4"", ""Z2mQh2"", ""e_"", ""idn:gofastbuy.com"", ""idn:ziftsolutions.com"", ""POs2u-"", ""KHpcuE"", ""QccsRc"", ""idn:dfir.pro"", ""idn:nksc.lt"", ""idn:dy.si"", ""KZFCph"", ""rN"", ""QYsx0D"", ""idn:logrhythm.com"", ""Jv_xrR"", ""idn:safe-cyberdefense.com"", ""4n"", ""QS89Bx"", ""NKaUXl""], ""Timestamp"": ""2017-09-13T00:00:00.000Z"", ""Name"": ""linkedToMalware"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Positive Malware Verdict"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""2 sightings on 1 source: Recorded Future Malware Detonation."", ""Sources"": [""TAIz7D""], ""Timestamp"": ""2020-10-13T10:46:31.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce","SHA-256","89","5/14","{""EvidenceDetails"": [{""Rule"": ""Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561"", ""Sources"": [""Rlso4a"", ""hkE5DK"", ""TZRwk8"", ""J5NRun""], ""Timestamp"": ""2021-12-21T08:40:00.000Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Linked to Attack Vector"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752"", ""Sources"": [""WlbRkJ"", ""ha2FFj"", ""K7wUX2"", ""P_ivKa"", ""J-mrOR"", ""P_upBR""], ""Timestamp"": ""2021-12-25T03:23:47.000Z"", ""Name"": ""linkedToVector"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Cyber Attack"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429"", ""Sources"": [""Y7TWfI""], ""Timestamp"": ""2021-10-18T12:09:43.000Z"", ""Name"": ""linkedToCyberAttack"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Linked to Malware"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""43 sightings on 14 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 19 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: RT @demonslay335: #STOP #Djvu #Ransomware extension \"".mogera\"" (v090): https://t.co/wlMcSE2EHj | https://t.co/XAYkOoOReU. Most recent link (May 27, 2019): https://twitter.com/DrolSecurity/statuses/1133117241388621825"", ""Sources"": [""TGXqeD"", ""W4ygGi"", ""L3kVdM"", ""QMfGAr"", ""QAy9GA"", ""JOU"", ""MIKjae"", ""P_oIyV"", ""QJ6TQK"", ""idn:droppdf.com"", ""Ql9O5c"", ""QAmbRP"", ""Tq2nAb"", ""idn:index-of.es""], ""Timestamp"": ""2019-05-27T21:06:17.000Z"", ""Name"": ""linkedToMalware"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Positive Malware Verdict"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: PolySwarm. Most recent link (Mar 8, 2021): https://polyswarm.network/scan/results/file/85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce"", ""Sources"": [""doLlw5""], ""Timestamp"": ""2021-03-08T13:00:15.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 3.0}]}" diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_hash_default.csv.log-expected.json b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_hash_default.csv.log-expected.json new file mode 100644 index 000000000000..29d9aea5210e --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_hash_default.csv.log-expected.json @@ -0,0 +1,1441 @@ +[ + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 57, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "32 sightings on 27 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @neonprimetime, @rpsanch. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "T1bwMv", + "LC-zVm", + "QFvaUy", + "P_upBR", + "T2OA5Q", + "K20lXV", + "TGgDPZ", + "hkIDTa", + "LqRZCN", + "Vd51cf", + "ha2FFj", + "UmsU31", + "K7wUX2", + "P_ivKa", + "Qj3TQr", + "idn:wordpress.com", + "J-mrOR", + "QPbAan", + "VeioBt", + "WlbRkJ", + "K7sErA", + "TvfQzk", + "TP1vbk", + "SrKvJ0", + "SqCj4s", + "VXaDYo", + "bk2VX4" + ], + "Timestamp": "2021-12-25T03:23:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "6 sightings on 6 sources including: Messaging Platforms - Uncategorized, @_mr_touch. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "XV7DoD", + "Ym7dzt", + "LKKAV1", + "VeioBt", + "Y7TWfI", + "KGS-xC" + ], + "Timestamp": "2019-05-28T14:17:41.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "119 sightings on 42 sources including: Malware-Traffic-Analysis.net - Blog Entries, Doc Player, GhostBin, Data Breach Today.eu | Updates, Codex - Recent changes en. 43 related malware families including Dardesh, AZORult, Emotet, Ryuk Ransomware, GandCrab. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "TvGJYk", + "LErKlJ", + "QWOrKl", + "LKKAV1", + "W4ygGi", + "PATKM7", + "T1bwMv", + "TY6igj", + "LjkJhE", + "kuKt0c", + "QAy9GA", + "LbYmLr", + "K20lXV", + "QZe7TG", + "idn:droppdf.com", + "QAmbRP", + "V_o1DL", + "TbciDE", + "XV7DoD", + "P_j5Dw", + "QNmgPm", + "TGXqeD", + "KGS-xC", + "L3kVdM", + "QMfGAr", + "h6VVAH", + "doLlw5", + "UrsUKT", + "JOU", + "MIKjae", + "P_oIyV", + "QJ6TQK", + "RfVd0T", + "J6UzbO", + "Ql9O5c", + "USKpXp", + "TP1vbk", + "SrKvJ0", + "Tq2nAb", + "P_ov9o", + "VXaDYo", + "idn:index-of.es" + ], + "Timestamp": "2021-11-27T23:07:37.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "5 sightings on 3 sources: Malware-Traffic-Analysis.net - Blog Entries, ReversingLabs, PolySwarm. Most recent link (Dec 15, 2018): https://www.malware-traffic-analysis.net/2018/12/14/index.html", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "LErKlJ", + "TbciDE", + "doLlw5" + ], + "Timestamp": "2020-07-11T09:55:23.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-12195723-7c56-4c63-b828-fc340dd4050a (Dec 20, 2018).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2018-12-20T21:13:36.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "50 sightings on 10 sources including: Security Bloggers Network, TechTarget Search Security, Bleeping Computer, Guided Collection, Bleepingcomputer Forums. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "NSAcUx", + "KCdHcb", + "J6UzbO", + "Rlso4a", + "hkE5DK", + "cJMUDF", + "TZRwk8", + "QMTzEI", + "LUhTGd", + "J5NRun" + ], + "Timestamp": "2021-12-21T08:40:00.000Z" + } + ], + "recordedfuture.risk_string": "6/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "38e992eb852ab0c4ac03955fb0dc9bb38e64010fdf9c05331d2b02b6e05689c2", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 5220, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "69 sightings on 18 sources including: Stock market news Company News MarketScreenercom, HackDig Posts, Sesin at, US CERT CISA Alerts, citizensudo.com. 6 related attack vectors including Powershell Attack, Supply Chain Attack, Target Destination Manipulation, Reconnaissance, C&C Server. Most recent link (Apr 15, 2021): https://www.cisa.gov/uscert/ncas/alerts/aa20-352a", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "XBl0xf", + "POs2u-", + "Z3TZAQ", + "hhY_oz", + "idn:citizensudo.com", + "VKz42X", + "PA-rR4", + "POs2tz", + "idn:firsthackersnews.com", + "KcjdRW", + "dCotni", + "idn:comodo.com", + "gI8s5W", + "hibUwt", + "rN", + "idn:reportcybercrime.com", + "idn:eshielder.com", + "idn:edsitrend.com" + ], + "Timestamp": "2021-04-15T00:00:00.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "175 sightings on 31 sources including: 4-traders.com, SentinelLabs, Sesin at, Cisco Japan Blog, McAfee. 8 related malware families including WebShell, Ransomware, Backdoor, Backdoor Shell, SUNBURST. Most recent tweet: Malcode highlighted in 'App_Web_logoimagehandler.ashx.b6031896.dll' (c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71) #SolarWinds #SUNBURST https://t.co/lyvnVHuTb2. Most recent link (Dec 16, 2020): https://twitter.com/_mynameisgeff/statuses/1339070792705830913", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "TuWseX", + "KBTQ2e", + "eP3CYX", + "Z3TZAQ", + "clDYM8", + "rN", + "VKz42X", + "idn:elemendar.com", + "idn:securitysummitperu.com", + "PA-rR4", + "idn:terabitweb.com", + "eTNyK6", + "gBQB48", + "bMZlEg", + "idn:edsitrend.com", + "idn:infoblox.com", + "UZNze8", + "Z2mQh2", + "XBl0xf", + "dCpZqs", + "jmpFm1", + "T5", + "doLlw5", + "gBDK5G", + "MIKjae", + "idn:firsthackersnews.com", + "jjf3_B", + "Jv_xrR", + "dCotni", + "idn:comodo.com", + "hibUwt" + ], + "Timestamp": "2020-12-16T04:52:10.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "11 sightings on 2 sources: GitHub, Insikt Group. 5 related cyber vulnerabilities: CWE-20, CWE-287, CVE-2020-10148, CVE-2020-1938, CWE-269. Most recent link (Dec 27, 2021): https://github.com/teamt5-it/official-website-v2/blob/master/_site/_next/data/64e2c6f134e73517d6ff737822e83cd75cf633c6/tw/posts/ithome-ghostcat-apache-tomcat-ajp-vulnerability.json", + "MitigationString": "", + "Name": "linkedToVuln", + "Rule": "Linked to Vulnerability", + "Sources": [ + "MIKjae", + "VKz42X" + ], + "Timestamp": "2021-12-27T07:36:54.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "6 sightings on 2 sources: Sophos Virus and Spyware Threats, PolySwarm. Most recent link (Dec 17, 2020): https://news.sophos.com/fr-fr/2020/12/15/cyberattaque-contre-solarwinds-comment-savoir-si-vous-etes-concerne/", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "K16tAG", + "doLlw5" + ], + "Timestamp": "2020-12-20T15:18:53.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "3 sightings on 1 source: DHS Automated Indicator Sharing. 3 reports including AA20-352A APT Compromise of Govt Agencies, Critical Infrastructure, and Private Sector Organizations, from CISA, Government Facilities Sector, CISA, Government Facilities Sector, NCCIC:STIX_Package-673aacd1-1852-4d44-bd93-0c44940a6358 (Feb 3, 2021).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2021-02-03T21:32:08.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "13 sightings on 1 source: Insikt Group. 4 reports including Researchers Linked Supernova Malware to Spiral Group. Most recent link (Mar 08, 2021): https://app.recordedfuture.com/live/sc/5DIp4RIUiJz6", + "MitigationString": "", + "Name": "analystNote", + "Rule": "Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-03-08T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "28 sightings on 8 sources including: Dancho Danchev's Blog, SecureWorks, Talos Intel, Unit 42 Palo Alto Networks, Cisco Japan Blog. Most recent link (Mar 12, 2021): https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group?es_p=13420131", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "JfqIbv", + "Z2mQh2", + "PA-rR4", + "jjf3_B", + "clDYM8", + "T5", + "rN", + "J5NRun" + ], + "Timestamp": "2021-03-12T20:30:37.672Z" + } + ], + "recordedfuture.risk_string": "7/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 10160, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "6 sightings on 5 sources: GitHub, SANS Internet Storm Center, Messaging Platforms - Uncategorized, @decalage2, @simonwargniez. 3 related attack vectors: Remote Code Execution, Zero Day Exploit, Cyberattack. Most recent tweet: Great lists of software affected by #Log4Shell / CVE-2021-44228 / Log4J RCE: https://t.co/TpEQXKgMGW by @ncsc_nl https://t.co/FA5i8zR5Z1 by @CISAgov https://t.co/0xVZJvMcpU by @SwitHak https://t.co/788knvztWV https://t.co/WMkXslhgWS #log4j #log4j2. Most recent link (Dec 15, 2021): https://twitter.com/decalage2/statuses/1471121875816353800", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "LUf99I", + "MIKjae", + "JYxY8X", + "Y7TWfI", + "KIRe_w" + ], + "Timestamp": "2021-12-15T14:16:01.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "11 sightings on 3 sources: bund.de, SANS Internet Storm Center, Sesin at. 2 related malware families: Ransomware, Botnet. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "idn:bund.de", + "JYxY8X", + "Z3TZAQ" + ], + "Timestamp": "2021-12-20T04:54:00.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "108 sightings on 78 sources including: bund.de, tistory.com, PasteBin, Sesin at, Messaging Platforms - Uncategorized. 24 related cyber vulnerabilities including CWE-22, CWE-611, CVE-2019-19781, CVE-2020-16898, CWE-20. Most recent tweet: Security advisories, bulletins, and vendor responses related to Log4Shell #Log4Shell #Log4j #cybersecurity #infosec #vendorsecurity https://t.co/Vpwrhdppm7. Most recent link (Dec 22, 2021): https://twitter.com/arrgibbs/statuses/1473733864459841538", + "MitigationString": "", + "Name": "linkedToVuln", + "Rule": "Linked to Vulnerability", + "Sources": [ + "VQpQDR", + "KFu3Rc", + "LUf99I", + "SGCsBG", + "U94lUG", + "KFcv42", + "QT0CFv", + "UHvtcg", + "KFUbjU", + "KHwUI5", + "KKSt8d", + "idn:bund.de", + "VmIbAC", + "QGT0Vy", + "ejfM20", + "KGlTEd", + "QCoXJo", + "RXSwU8", + "idn:tistory.com", + "LpdVul", + "K-eKsL", + "TKYCSz", + "SkABVK", + "SdGk_x", + "LI6d7O", + "LQIfBf", + "U6B2hC", + "f7_CfD", + "LKt0HB", + "RHS4v8", + "KKmN5m", + "YfJqp2", + "Jv_xrR", + "RJ2_NX", + "VZXzSv", + "k0QC11", + "KFWBRs", + "LRk_pt", + "Qn2VRQ", + "kGHFKP", + "ShBO5M", + "T-GSBp", + "KNdyHF", + "QLCTXP", + "Z3TZAQ", + "Khf99v", + "KHZhjO", + "SHH61D", + "Knx_su", + "LL8-pr", + "QpmWTf", + "KIRe_w", + "QIea7F", + "SlhG3F", + "KIdj8R", + "SQqKS8", + "Lq6DNq", + "QpYsBa", + "d-ZMP2", + "LOoye8", + "QEUmiJ", + "ewfPjC", + "LBNFpV", + "QTpbKE", + "Y7TWfI", + "KGS-xC", + "eifkGz", + "au2SGr", + "SKw4tT", + "KGW5kn", + "Q9y5Ki", + "KGxw1d", + "MIKjae", + "LO5p1C", + "JYxY8X", + "KJsMEF", + "QBLBHH", + "k7WJ2k" + ], + "Timestamp": "2021-12-22T19:15:08.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Naked Security. Most recent link (Dec 18, 2021): https://news.sophos.com/en-us/2021/12/17/log4shell-response-and-mitigation-recommendations/", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "J2_htN" + ], + "Timestamp": "2021-12-18T00:20:04.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "10 sightings on 7 sources including: ISC Sans Diary Archive, SecureWorks, InfoCON: green, ISC | Latest Headlines, SANS Internet Storm Center. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "TCw6v6", + "Z2mQh2", + "2d", + "cJuZvt", + "JYxY8X", + "J2_htN", + "jXNbON" + ], + "Timestamp": "2021-12-20T04:54:00.000Z" + } + ], + "recordedfuture.risk_string": "5/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.md5": "b66db3a06c2955a9cb71a8718970c592", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 14254, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 6, 2017, and Jul 17, 2017.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:Tluf00" + ], + "Timestamp": "2021-12-24T20:03:09.087Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "14 sightings on 5 sources including: Assiste.Forum, @arturodicorinto. 2 related attack vectors: ShellCode, Cyberattack. Most recent tweet: They're getting quicker at updating.. #petya #cyberattack https://t.co/px0g9BSpod. Most recent link (Jun 27, 2017): https://twitter.com/SupersizedSam/statuses/879764638845587461", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "LP7dc7", + "LRlngp", + "Sl8XTb", + "QMfGAr", + "J-y3tn" + ], + "Timestamp": "2017-06-27T18:13:29.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "10 sightings on 9 sources including: BitcoinTalk.org, @Noemi_hcke. Most recent tweet: #petya related hashes in #virustotal https://t.co/Cv7Pltjhia https://t.co/P3otYPoxBj #ransomware #malware #sha256. Most recent link (Jun 28, 2017): https://twitter.com/Menardconnect/statuses/879885997831368705", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "ThowaF", + "KUtKjP", + "K84j7t", + "MghdWI", + "K8rrfe", + "QlWPRW", + "KFsPRz", + "S-Anbb", + "KE9dMF" + ], + "Timestamp": "2017-06-28T02:15:44.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "834 sightings on 201 sources including: New Jersey Cybersecurity & Communications Integration Cell, lnkd.in, avtech24h.com, Malwr.com, Talos Intel. 21 related malware families including ICS Malware, PetrWrap, Emotet, Trojan, NotPetya. Most recent tweet: #ransomware 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 f65a7dadff844f2dc44a3bd43e1c0d600b1a6c66f6d02734d8f385872ccab0bc b6e8dc95ec939a1f3b184da559c8010ab3dc773e426e63e5aa7ffc44174d8a9d 9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08. Most recent link (Apr 9, 2021): https://twitter.com/RedBeardIOCs/statuses/1380600677249003521", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "jbVMcB", + "idn:lnkd.in", + "idn:avtech24h.com", + "K84j7t", + "Sl8XTb", + "KGRhOC", + "NKaUXl", + "KIoGAG", + "PA-rR4", + "LRlngp", + "rN", + "Jxh46H", + "KFL44X", + "TbciDE", + "KFNVB9", + "OJpx5g", + "K-CGye", + "KK6oqV", + "WR_Ohh", + "idn:twitter.com", + "fgwEcq", + "QYsx0D", + "KIFtR_", + "Lp_esG", + "TSFWTw", + "KGHzAY", + "P_oEH3", + "KBTQ2e", + "QCGHCy", + "JYxY5G", + "UQsrUj", + "idn:cert.ro", + "idn:bluvector.io", + "KFUJTL", + "TFUkSW", + "P0Gs9I", + "K8ofB1", + "KVnnHP", + "TpaXxw", + "U5qdTI", + "idn:zscaler.com", + "L3kVdM", + "QMfGAr", + "KIk8aS", + "Kzw0Pm", + "hcELIE", + "POs2tz", + "KD6Na4", + "idn:globalsecuritymag.com", + "LDd0sl", + "KVP0jz", + "Lj8CsQ", + "K8rrfe", + "LDejRI", + "J-y3tn", + "WXutod", + "idn:infosecurityfactory.nl", + "LBlc7C", + "idn:bg.org.tr", + "QS89Bd", + "K9SiDc", + "Qe89bv", + "TiY1wu", + "idn:undernews.fr", + "idn:iteefactory.nl", + "KFRGd_", + "KFVuR_", + "4n", + "S-Anbb", + "KFNZEC", + "TSazOG", + "K9Skh1", + "MghdWI", + "idn:securityiscoming.com", + "QS89BG", + "LVg9nH", + "KFiGli", + "K9Vq9B", + "KLbNtt", + "VyWQM7", + "NTakwX", + "KGoarP", + "idn:gelsene.net", + "LwURWv", + "KGX8VB", + "ThoB0I", + "TAIz7D", + "QBHQ61", + "TiY1w7", + "idn:kompasiana.com", + "idn:t.co", + "KfDTG0", + "idn:ictsecuritymagazine.com", + "Liz5-u", + "MIKjae", + "JYxY8X", + "KUtKjP", + "idn:cert.pl", + "Lpm4nc", + "idn:boozallen.com", + "RVFHk_", + "KGmazP", + "M_7iBk", + "TStw1W", + "LFcJLk", + "K0TN7r", + "KVRURg", + "UNe62M", + "iL8bPu", + "K76BjK", + "VRixQe", + "idn:dfir.pro", + "KF-l77", + "idn:gixtools.net", + "P_oIyV", + "KGzicb", + "LGryD9", + "idn:fb.me", + "K5nCn5", + "ThKuX0", + "SYrUYn", + "KFKbZE", + "MAe5tQ", + "KGm6gS", + "W4ygGi", + "g9rk5F", + "idn:menshaway.blogspot.com", + "KFsPRz", + "LDm9iS", + "RV8KWp", + "KTuH6e", + "P_uJi3", + "KG_Bgt", + "QAmbRP", + "idn:csirt.cz", + "LZYvHh", + "L0HtmN", + "KWLqO-", + "LtUj1D", + "QMTzDr", + "idn:dy.si", + "Lo8Box", + "K-4reD", + "KFTeBZ", + "KKzFno", + "QMTzEI", + "KFYLd8", + "KGABt4", + "LIizBt", + "idn:herjavecgroup.com", + "QAAZRn", + "K66Zgw", + "KWz-My", + "Lb0b3F", + "idn:emsisoft.vn", + "LodOTm", + "KE9dMF", + "O-Wf5x", + "LG2dQX", + "P_-RZy", + "LK7o9D", + "K60PUk", + "KKUqfz", + "idn:logrhythm.com", + "Jv_xrR", + "LP7dc7", + "MFNOaz", + "TefIES", + "KGdGg3", + "KHNdvY", + "QBTxvB", + "idn:swordshield.com", + "ThowaF", + "idn:binarydefense.com", + "idn:indusface.com", + "QBtnC2", + "QlWPRW", + "KHZhjO", + "idn:idcloudhost.com", + "LRFVsB", + "KG2JTH", + "KIm1im", + "LAfpKN", + "BaV", + "KGW3VP", + "KFcp5q", + "LCN_6T", + "idn:avastvn.com", + "KFTnbG", + "TiCWjw", + "Lmhpq3", + "KGS-xC", + "KFVthB", + "idn:finyear.com", + "KFji4N", + "P_7M19", + "K-b0DI", + "LV1UMS", + "idn:safe-cyberdefense.com", + "Kjk3fx", + "Q1wlJN" + ], + "Timestamp": "2021-04-09T19:17:06.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: GitHub. 2 related cyber vulnerabilities: CWE-20, CVE-2017-0143. Most recent link (Oct 10, 2021): https://github.com/demisto/content/blob/master/Packs/RecordedFuture/Integrations/RecordedFuture/example_commands.txt", + "MitigationString": "", + "Name": "linkedToVuln", + "Rule": "Linked to Vulnerability", + "Sources": [ + "MIKjae" + ], + "Timestamp": "2021-10-10T08:21:25.825Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Jun 27, 2017): ReversingLabs malware file analysis.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TAIz7D", + "TbciDE", + "doLlw5" + ], + "Timestamp": "2020-12-17T22:59:03.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-21cebba6-46ed-464e-ad5a-32a8063e1400 (Jun 27, 2017).", + "MitigationString": "", + "Name": "dhsAis", + "Rule": "Reported by DHS AIS", + "Sources": [ + "UZNze8" + ], + "Timestamp": "2017-06-27T17:18:01.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "91 sightings on 19 sources including: Security News Concentrator, Fortinet, Trend Micro, CrowdStrike, FireEye Threat Research Blog. Most recent link (Dec 20, 2019): https://threatvector.cylance.com/en_us/home/threat-spotlight-petya-like-ransomware-is-nasty-wiper.html", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "QS89Bd", + "KVP0jz", + "T5", + "JYxY5G", + "WR_Ohh", + "Jt4ExJ", + "Kzw0Pm", + "JQH96m", + "2d", + "JYxY8X", + "rN", + "PA-rR4", + "VyWQM7", + "Lp_esG", + "ONMgMx", + "4n", + "QMTzEI", + "83", + "K0TN7r" + ], + "Timestamp": "2019-12-20T01:04:11.602Z" + } + ], + "recordedfuture.risk_string": "8/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 21796, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "WlbRkJ", + "ha2FFj", + "K7wUX2", + "P_ivKa", + "J-mrOR", + "P_upBR" + ], + "Timestamp": "2021-12-25T03:23:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "Y7TWfI" + ], + "Timestamp": "2021-10-18T12:09:43.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "47 sightings on 16 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 18 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "TGXqeD", + "W4ygGi", + "L3kVdM", + "QMfGAr", + "kuKt0c", + "QAy9GA", + "JOU", + "MIKjae", + "P_oIyV", + "QJ6TQK", + "idn:droppdf.com", + "Ql9O5c", + "QAmbRP", + "Tq2nAb", + "TbciDE", + "idn:index-of.es" + ], + "Timestamp": "2021-11-27T23:07:37.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: ReversingLabs. Most recent link (Jul 1, 2019): ReversingLabs malware file analysis.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TbciDE" + ], + "Timestamp": "2019-07-01T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "Rlso4a", + "hkE5DK", + "TZRwk8", + "J5NRun" + ], + "Timestamp": "2021-12-21T08:40:00.000Z" + } + ], + "recordedfuture.risk_string": "5/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "ad2ad0249fafe85877bc79a01e1afd1a44d983c064ad8cb5bc694d29d166217b", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 25113, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "31 sightings on 4 sources: @m0rb, @bad_packets, @InfoSex11, @luc4m. 2 related attack vectors: DDOS, Command Injection. Most recent tweet: 2021-06-17T23:29:30 - Commented: https://t.co/j2a05iXOiI #malware #commandinjection. Most recent link (Jun 17, 2021): https://twitter.com/m0rb/statuses/1405668962462011401", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "KFwzec", + "TGgDPZ", + "cgGiXI", + "LMcjZ7" + ], + "Timestamp": "2021-06-17T23:29:31.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "3 sightings on 2 sources: @bad_packets, @swarmdotmarket. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "TGgDPZ", + "UBjcy3" + ], + "Timestamp": "2020-04-20T21:22:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "87 sightings on 15 sources including: lumen.com, HackDig Posts, Anquanke News, Daily Dot, centurylink.com. 7 related malware families including Mozi Botnet, Trojan, Qbot, Mirai, DDOS Toolkit. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec. Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "idn:lumen.com", + "POs2u-", + "U13S_U", + "Jzl3yj", + "idn:centurylink.com", + "doLlw5", + "POs2t2", + "idn:cyberswachhtakendra.gov.in", + "idn:hackxsecurity.com", + "TGgDPZ", + "Jv_xrR", + "TSFWTv", + "LMcjZ7", + "UBjcy3", + "TbciDE" + ], + "Timestamp": "2020-04-20T21:22:47.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Nov 28, 2019): ReversingLabs malware file analysis.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TAIz7D", + "TbciDE", + "doLlw5" + ], + "Timestamp": "2021-04-04T07:46:20.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Trend Micro. Most recent link (Mar 11, 2021): https://documents.trendmicro.com/assets/pdf/Technical_Brief_Uncleanable_and_Unkillable_The_Evolution_of_IoT_Botnets_Through_P2P_Networking.pdf", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "T5" + ], + "Timestamp": "2021-03-11T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "5/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "01ba1fb41632594997a41d0c3a911ae5b3034d566ebb991ef76ad76e6f9e283a", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 28352, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "29 sightings on 24 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @rpsanch, @rce_coder. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "T1bwMv", + "LC-zVm", + "P_upBR", + "T2OA5Q", + "K20lXV", + "TGgDPZ", + "hkIDTa", + "LqRZCN", + "Vd51cf", + "ha2FFj", + "UmsU31", + "ddafo3", + "K7wUX2", + "P_ivKa", + "idn:wordpress.com", + "J-mrOR", + "QPbAan", + "VeioBt", + "WlbRkJ", + "TvfQzk", + "TP1vbk", + "SrKvJ0", + "SqCj4s", + "VXaDYo" + ], + "Timestamp": "2021-12-25T03:23:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "10 sightings on 7 sources including: SANS Institute Course Selector Results, Messaging Platforms - Uncategorized, @ecstatic_nobel, @Artilllerie. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "Ym7dzt", + "LKKAV1", + "OuKV3V", + "VeioBt", + "Y7TWfI", + "KGS-xC", + "KFSXln" + ], + "Timestamp": "2019-05-28T14:17:41.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "114 sightings on 42 sources including: Doc Player, GhostBin, Codex - Recent changes en, droppdf.com, ReversingLabs. 41 related malware families including Dardesh, AZORult, Emotet, GandCrab, Offensive Security Tools (OST). Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "QWOrKl", + "LKKAV1", + "W4ygGi", + "PATKM7", + "T1bwMv", + "LjkJhE", + "kuKt0c", + "QAy9GA", + "LbYmLr", + "K20lXV", + "QZe7TG", + "idn:droppdf.com", + "QAmbRP", + "TbciDE", + "P_j5Dw", + "QNmgPm", + "TGXqeD", + "POs2u-", + "KGS-xC", + "L3kVdM", + "QMfGAr", + "h6VVAH", + "doLlw5", + "UrsUKT", + "JOU", + "MIKjae", + "P_oIyV", + "QJ6TQK", + "RfVd0T", + "J6UzbO", + "POs2tz", + "VfsacJ", + "Jv_xrR", + "Ql9O5c", + "USKpXp", + "TP1vbk", + "SrKvJ0", + "Tq2nAb", + "KFSXln", + "P_ov9o", + "VXaDYo", + "idn:index-of.es" + ], + "Timestamp": "2021-11-27T23:07:37.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Messaging Platforms - Uncategorized. 2 related cyber vulnerabilities: CVE-2016-6663, CWE-362.", + "MitigationString": "", + "Name": "linkedToVuln", + "Rule": "Linked to Vulnerability", + "Sources": [ + "Y7TWfI" + ], + "Timestamp": "2021-12-29T07:27:12.565Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "2 sightings on 2 sources: ReversingLabs, PolySwarm. Most recent link (Apr 19, 2018): ReversingLabs malware file analysis.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TbciDE", + "doLlw5" + ], + "Timestamp": "2021-02-10T09:10:10.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "45 sightings on 9 sources including: Security Bloggers Network, Bleeping Computer, Guided Collection, Bleepingcomputer Forums, TheServerSide.com | Updates. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "NSAcUx", + "J6UzbO", + "Rlso4a", + "hkE5DK", + "cJMUDF", + "TZRwk8", + "QMTzEI", + "LUhTGd", + "J5NRun" + ], + "Timestamp": "2021-12-21T08:40:00.000Z" + } + ], + "recordedfuture.risk_string": "6/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "fecddb7f3fa478be4687ca542c0ecf232ec35a0c2418c8bfe4875686ec373c1e", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 33343, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1688 sightings on 26 sources including: lnkd.in, Doc Player, Cyber4Sight, voicebox.pt, VKontakte. 2 related malware families: Wcry, Ransomware. Most recent link (Sep 13, 2017): https://malwr.com/analysis/ZmIzN2E3MzQyM2I0NDYwODllOWRhMmQxODg3YzMxZDA/", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "idn:lnkd.in", + "W4ygGi", + "S2tpaX", + "idn:voicebox.pt", + "SIjHV9", + "PJHGaq", + "PA-rR4", + "Z2mQh2", + "e_", + "idn:gofastbuy.com", + "idn:ziftsolutions.com", + "POs2u-", + "KHpcuE", + "QccsRc", + "idn:dfir.pro", + "idn:nksc.lt", + "idn:dy.si", + "KZFCph", + "rN", + "QYsx0D", + "idn:logrhythm.com", + "Jv_xrR", + "idn:safe-cyberdefense.com", + "4n", + "QS89Bx", + "NKaUXl" + ], + "Timestamp": "2017-09-13T00:00:00.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "2 sightings on 1 source: Recorded Future Malware Detonation.", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "TAIz7D" + ], + "Timestamp": "2020-10-13T10:46:31.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "58 sightings on 5 sources: SecureWorks, InfoCON: green, McAfee, Talos Intel, Kaspersky Securelist and Lab. Most recent link (Jun 28, 2018): https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27077/en_US/McAfee_Labs_WannaCry_June24_2018.pdf", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "Z2mQh2", + "2d", + "rN", + "PA-rR4", + "4n" + ], + "Timestamp": "2018-06-28T08:11:36.570Z" + } + ], + "recordedfuture.risk_string": "3/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b", + "threat.indicator.type": "file" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 89.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 35218, + "recordedfuture.evidence_details": [ + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752", + "MitigationString": "", + "Name": "linkedToVector", + "Rule": "Linked to Attack Vector", + "Sources": [ + "WlbRkJ", + "ha2FFj", + "K7wUX2", + "P_ivKa", + "J-mrOR", + "P_upBR" + ], + "Timestamp": "2021-12-25T03:23:47.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Linked to Cyber Attack", + "Sources": [ + "Y7TWfI" + ], + "Timestamp": "2021-10-18T12:09:43.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "43 sightings on 14 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 19 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: RT @demonslay335: #STOP #Djvu #Ransomware extension \".mogera\" (v090): https://t.co/wlMcSE2EHj | https://t.co/XAYkOoOReU. Most recent link (May 27, 2019): https://twitter.com/DrolSecurity/statuses/1133117241388621825", + "MitigationString": "", + "Name": "linkedToMalware", + "Rule": "Linked to Malware", + "Sources": [ + "TGXqeD", + "W4ygGi", + "L3kVdM", + "QMfGAr", + "QAy9GA", + "JOU", + "MIKjae", + "P_oIyV", + "QJ6TQK", + "idn:droppdf.com", + "Ql9O5c", + "QAmbRP", + "Tq2nAb", + "idn:index-of.es" + ], + "Timestamp": "2019-05-27T21:06:17.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: PolySwarm. Most recent link (Mar 8, 2021): https://polyswarm.network/scan/results/file/85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Positive Malware Verdict", + "Sources": [ + "doLlw5" + ], + "Timestamp": "2021-03-08T13:00:15.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Threat Researcher", + "Sources": [ + "Rlso4a", + "hkE5DK", + "TZRwk8", + "J5NRun" + ], + "Timestamp": "2021-12-21T08:40:00.000Z" + } + ], + "recordedfuture.risk_string": "5/14", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.file.hash.sha256": "85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce", + "threat.indicator.type": "file" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_ip_default.csv.log b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_ip_default.csv.log new file mode 100644 index 000000000000..1704f899a28a --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_ip_default.csv.log @@ -0,0 +1,10 @@ +"Name","Risk","RiskString","EvidenceDetails" +"103.143.8.71","99","4/64","{""EvidenceDetails"": [{""Rule"": ""Historically Linked to Intrusion Method"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""7 sightings on 1 source: PasteBin. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Nov 8, 2021): https://pastebin.com/G1Jvm5T0"", ""Sources"": [""Jv_xrR""], ""Timestamp"": ""2021-11-08T16:27:15.000Z"", ""Name"": ""linkedIntrusion"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported as a Defanged IP"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 1 source: GitHub. Most recent link (Nov 16, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-15-IOCs-for-Matanbuchus-Qakbot-CobaltStrike-and-spambot-activity.txt"", ""Sources"": [""MIKjae""], ""Timestamp"": ""2021-11-16T00:00:00.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Current C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""164 sightings on 4 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions, Abuse.ch: Feodo IP Blocklist, Polyswarm Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 103.143.8.71:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651"", ""Sources"": [""b5tNVA"", ""h_iZX8"", ""report:OtiCOp"", ""hyihHO""], ""Timestamp"": ""2021-12-29T02:11:16.658Z"", ""Name"": ""recentCncServer"", ""MitigationString"": """", ""Criticality"": 4.0}, {""Rule"": ""Actively Communicating C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Qakbot. Communication observed on TCP:443, TCP:6881, TCP:995. Exfiltration behavior observed. Last observed on Dec 27, 2021."", ""Sources"": [""report:aEft3k""], ""Timestamp"": ""2021-12-29T02:11:16.663Z"", ""Name"": ""recentActiveCnc"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"2001:470:1:c84:0:0:0:17","68","5/64","{""EvidenceDetails"": [{""Rule"": ""Historical Brute Force"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: AbuseIPDB Community Submissions. 2001:470:1:c84::17 was identified as Brute-Force by multiple unique community member submissions. Reported to Recorded Future on Nov 23, 2021."", ""Sources"": [""kAh9jV""], ""Timestamp"": ""2021-11-24T10:21:58.872Z"", ""Name"": ""bruteForce"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent Spam Source"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: AbuseIPDB Spam. 2001:470:1:c84::17 was identified as Web Spam by multiple unique community member submissions. Reported to Recorded Future on Dec 21, 2021."", ""Sources"": [""kAiRKZ""], ""Timestamp"": ""2021-12-23T10:18:14.025Z"", ""Name"": ""recentSpam"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Recent SSH/Dictionary Attacker"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: DataPlane SSH Client Connection List."", ""Sources"": [""report:U8nmOf""], ""Timestamp"": ""2021-12-29T07:19:53.133Z"", ""Name"": ""recentSshDictAttacker"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Recent Multicategory Blocklist"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: BlockList.de: Fail2ban Reporting Service."", ""Sources"": [""report:OhgwUx""], ""Timestamp"": ""2021-12-29T07:19:53.133Z"", ""Name"": ""recentMultiBlacklist"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Recent DDoS"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: AbuseIPDB Community Submissions. 2001:470:1:c84::17 was identified as DDoS Attack by multiple unique community member submissions. Reported to Recorded Future on Dec 21, 2021."", ""Sources"": [""kAh9jV""], ""Timestamp"": ""2021-12-23T10:18:13.994Z"", ""Name"": ""recentDdos"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"185.19.85.136","99","6/64","{""EvidenceDetails"": [{""Rule"": ""Historically Linked to Intrusion Method"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: GitHub. 2 related intrusion methods: Nanocore, Remote Access Trojan. Most recent link (Jan 1, 2021): https://github.com/GlacierSheep/DomainBlockList/blob/master/trail/static_nanocore_(malware).domainset"", ""Sources"": [""MIKjae""], ""Timestamp"": ""2021-01-01T16:56:57.000Z"", ""Name"": ""linkedIntrusion"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Multicategory Blocklist"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 2 sources: Bitdefender IP Reputation, hpHosts Latest Additions. Bitdefender detected suspicious traffic involving 185.19.85.136 associated with Bitdefender threat name Trojan.GenericKD.34300483 on Apr 30, 2021"", ""Sources"": [""iFMVSl"", ""Ol_aRZ""], ""Timestamp"": ""2021-04-30T04:50:06.000Z"", ""Name"": ""multiBlacklist"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported in Threat List"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between Feb 13, 2021, and Feb 13, 2021."", ""Sources"": [""report:SW8xpk""], ""Timestamp"": ""2021-12-28T19:20:46.641Z"", ""Name"": ""historicalThreatListMembership"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C Server"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""9 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command & Control host identified on Oct 29, 2021."", ""Sources"": [""b5tNVA"", ""h_iZX8""], ""Timestamp"": ""2021-10-29T08:07:54.495Z"", ""Name"": ""intermediateCncServer"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Recently Active C&C Server"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Asyncrat. Communication observed on TCP:6060. Last observed on Dec 21, 2021."", ""Sources"": [""report:aEft3k""], ""Timestamp"": ""2021-12-28T19:20:46.639Z"", ""Name"": ""intermediateActiveCnc"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Current C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""12 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command & Control host identified on Dec 24, 2021."", ""Sources"": [""b5tNVA"", ""h_iZX8""], ""Timestamp"": ""2021-12-24T08:07:09.925Z"", ""Name"": ""recentCncServer"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"45.112.206.18","99","6/64","{""EvidenceDetails"": [{""Rule"": ""Historically Linked to Intrusion Method"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""12 sightings on 2 sources: C2IntelFeeds IPC2s, @drb_ra. 2 related intrusion methods: Cobalt Strike, Offensive Security Tools (OST). Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978"", ""Sources"": [""k_7zaW"", ""jqWX2B""], ""Timestamp"": ""2021-11-26T15:01:53.000Z"", ""Name"": ""linkedIntrusion"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Linked to Cyber Attack"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 1 source: C2IntelFeeds IPC2s. Most recent link (Aug 15, 2021): https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/IPC2s-30day.csv?q=45.112.206.18_20210815"", ""Sources"": [""k_7zaW""], ""Timestamp"": ""2021-08-15T00:00:00.000Z"", ""Name"": ""linkedToCyberAttack"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported as a Defanged IP"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""10 sightings on 1 source: @drb_ra. Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978"", ""Sources"": [""jqWX2B""], ""Timestamp"": ""2021-11-26T15:01:53.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported in Threat List"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""Previous sightings on 2 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, Recorded Future Analyst Community Trending Indicators. Observed between Jul 8, 2021, and Dec 9, 2021."", ""Sources"": [""report:aD1qtM"", ""report:Tluf00""], ""Timestamp"": ""2021-12-28T18:45:41.877Z"", ""Name"": ""historicalThreatListMembership"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Current C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""2 sightings on 1 source: Recorded Future Command & Control List. Command & Control host identified on Jul 5, 2021."", ""Sources"": [""b5tNVA""], ""Timestamp"": ""2021-07-05T08:04:23.139Z"", ""Name"": ""recentCncServer"", ""MitigationString"": """", ""Criticality"": 4.0}, {""Rule"": ""Actively Communicating C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Cobalt Strike Team Servers. Communication observed on TCP:443, TCP:8443. Last observed on Dec 26, 2021."", ""Sources"": [""report:aEft3k""], ""Timestamp"": ""2021-12-28T18:45:41.875Z"", ""Name"": ""recentActiveCnc"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"190.55.186.229","99","10/64","{""EvidenceDetails"": [{""Rule"": ""Historically Linked to Intrusion Method"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""239 sightings on 5 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks, PasteBin, Cryptolaemus Pastedump. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Mar 14, 2021): https://unit42.paloaltonetworks.jp/attack-chain-overview-emotet-in-december-2020-and-january-2021/"", ""Sources"": [""idn:paloaltonetworks.jp"", ""JwO7jp"", ""jjf3_B"", ""Jv_xrR"", ""Z7kln2""], ""Timestamp"": ""2021-03-14T00:00:00.000Z"", ""Name"": ""linkedIntrusion"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Threat Researcher"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 1 source: Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/"", ""Sources"": [""jjf3_B""], ""Timestamp"": ""2021-04-09T12:00:00.000Z"", ""Name"": ""threatResearcher"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Multicategory Blocklist"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""5 sightings on 1 source: AbuseIP Database. Most recent link (Aug 25, 2020): https://www.abuseipdb.com/check/190.55.186.229"", ""Sources"": [""UneVVu""], ""Timestamp"": ""2020-08-25T20:01:29.075Z"", ""Name"": ""multiBlacklist"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported as a Defanged IP"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""6 sightings on 3 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/"", ""Sources"": [""idn:paloaltonetworks.jp"", ""JwO7jp"", ""jjf3_B""], ""Timestamp"": ""2021-04-09T12:00:00.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Positive Malware Verdict"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""87 sightings on 1 source: Cryptolaemus Pastedump. Most recent link (Jan 25, 2021): https://paste.cryptolaemus.com/emotet/2021/01/25/emotet-malware-IoCs_01-25-21.html"", ""Sources"": [""Z7kln2""], ""Timestamp"": ""2021-01-25T23:59:00.000Z"", ""Name"": ""positiveMalwareVerdict"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Spam Source"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: External Sensor Spam. 190.55.186.229 was historically observed as spam. No longer observed as of Nov 16, 2021."", ""Sources"": [""kBCI-b""], ""Timestamp"": ""2021-11-16T01:06:21.965Z"", ""Name"": ""spam"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported in Threat List"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""Previous sightings on 2 sources: University of Science and Technology of China Black IP List, Abuse.ch: Feodo IP Blocklist. Observed between Feb 26, 2021, and Dec 27, 2021."", ""Sources"": [""report:Q1ghC0"", ""report:OtiCOp""], ""Timestamp"": ""2021-12-28T19:33:55.849Z"", ""Name"": ""historicalThreatListMembership"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C Server"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""31 sightings on 3 sources: Palo Alto Networks, Polyswarm Sandbox Analysis - Malware C2 Extractions, Unit 42 Palo Alto Networks. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample a88734cd5c38211a4168bc7701516a50e6aef5ef20d2b1a915edae23c1b345db"", ""Sources"": [""JwO7jp"", ""hyihHO"", ""jjf3_B""], ""Timestamp"": ""2021-10-19T12:21:34.268Z"", ""Name"": ""intermediateCncServer"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Recent Multicategory Blocklist"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: Talos IP Blacklist."", ""Sources"": [""report:VW6jeN""], ""Timestamp"": ""2021-12-28T19:33:55.846Z"", ""Name"": ""recentMultiBlacklist"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Current C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""5 sightings on 2 sources: Polyswarm Sandbox Analysis - Malware C2 Extractions, Joe Security Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample c9709d56b92047cd55fb097feb6cb7a8de6f3edc5ea79a429363938a69aae580"", ""Sources"": [""hyihHO"", ""h_iZX8""], ""Timestamp"": ""2021-12-27T19:00:49.975Z"", ""Name"": ""recentCncServer"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"62.210.82.223","99","3/64","{""EvidenceDetails"": [{""Rule"": ""Historically Linked to Intrusion Method"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 1 source: PasteBin. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 2, 2021): https://pastebin.com/SusxCK2b"", ""Sources"": [""Jv_xrR""], ""Timestamp"": ""2021-12-02T15:58:10.000Z"", ""Name"": ""linkedIntrusion"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Current C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""2 sightings on 2 sources: Recorded Future Command & Control List, Abuse.ch: Feodo IP Blocklist. Command & Control host identified on Dec 1, 2021."", ""Sources"": [""b5tNVA"", ""report:OtiCOp""], ""Timestamp"": ""2021-12-01T08:06:11.827Z"", ""Name"": ""recentCncServer"", ""MitigationString"": """", ""Criticality"": 4.0}, {""Rule"": ""Actively Communicating C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Emotet. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 26, 2021."", ""Sources"": [""report:aEft3k""], ""Timestamp"": ""2021-12-28T22:05:35.688Z"", ""Name"": ""recentActiveCnc"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"87.120.254.96","99","7/64","{""EvidenceDetails"": [{""Rule"": ""Historical Honeypot Sighting"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 2 sources: Project Honey Pot, @HoneyFog. Most recent tweet: Fog44: 87.120.254.96->22. Most recent link (Dec 14, 2016): https://twitter.com/HoneyFog/statuses/809032869792378880"", ""Sources"": [""P_izv4"", ""OSz1F0""], ""Timestamp"": ""2016-12-14T13:50:41.000Z"", ""Name"": ""honeypot"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported as a Defanged IP"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: GitHub. Most recent link (Nov 8, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-05-TA551-IOCs.txt"", ""Sources"": [""MIKjae""], ""Timestamp"": ""2021-11-08T00:00:00.000Z"", ""Name"": ""defanged"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Spam Source"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: External Sensor Spam. 87.120.254.96 was historically observed as spam. No longer observed as of Nov 16, 2021."", ""Sources"": [""kBCI-b""], ""Timestamp"": ""2021-11-16T03:19:58.721Z"", ""Name"": ""spam"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recently Linked to Intrusion Method"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: CloudSEK. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 22, 2021): https://cloudsek.com/emotet-2-0-everything-you-need-to-know-about-the-new-variant-of-thbanking-trojan/"", ""Sources"": [""k837l0""], ""Timestamp"": ""2021-12-22T09:45:33.000Z"", ""Name"": ""recentLinkedIntrusion"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Recent Multicategory Blocklist"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: University of Science and Technology of China Black IP List."", ""Sources"": [""report:Q1ghC0""], ""Timestamp"": ""2021-12-29T06:21:27.693Z"", ""Name"": ""recentMultiBlacklist"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Current C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""2 sightings on 2 sources: Recorded Future Command & Control List, Abuse.ch: Feodo IP Blocklist. Command & Control host identified on Nov 25, 2021."", ""Sources"": [""b5tNVA"", ""report:OtiCOp""], ""Timestamp"": ""2021-11-25T08:06:42.384Z"", ""Name"": ""recentCncServer"", ""MitigationString"": """", ""Criticality"": 4.0}, {""Rule"": ""Actively Communicating C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Bazarloader. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 25, 2021."", ""Sources"": [""report:aEft3k""], ""Timestamp"": ""2021-12-29T06:21:27.731Z"", ""Name"": ""recentActiveCnc"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"45.146.165.76","99","4/64","{""EvidenceDetails"": [{""Rule"": ""Historically Reported in Threat List"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""Previous sightings on 3 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, CINS: CI Army List, Recorded Future Analyst Community Trending Indicators. Observed between Jan 22, 2021, and Sep 25, 2021."", ""Sources"": [""report:aD1qtM"", ""report:OchJ-t"", ""report:Tluf00""], ""Timestamp"": ""2021-12-28T18:42:08.925Z"", ""Name"": ""historicalThreatListMembership"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent Multicategory Blocklist"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""1 sighting on 1 source: DShield: Recommended Block List."", ""Sources"": [""report:OchJ-o""], ""Timestamp"": ""2021-12-28T18:42:08.917Z"", ""Name"": ""recentMultiBlacklist"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Current C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""19 sightings on 2 sources: Recorded Future Command & Control List, @TheDFIRReport. Most recent tweet: Here's some newer C2 servers we're tracking: #BazarLoader 64.227.73.80 64.225.71.198 #Covenant 167.71.67.196 45.146.165.76 #PoshC2 193.36.15.192 #Empire 64.227.21.255 #Metasploit 91.221.70.143 Full list available @ https://t.co/QT6o626hsR #ThreatFeed. Most recent link (Sep 1, 2021): https://twitter.com/TheDFIRReport/statuses/1433055791964049412"", ""Sources"": [""b5tNVA"", ""dZgcRz""], ""Timestamp"": ""2021-09-01T13:15:00.000Z"", ""Name"": ""recentCncServer"", ""MitigationString"": """", ""Criticality"": 4.0}, {""Rule"": ""Actively Communicating C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Covenant. Communication observed on TCP:7443. Exfiltration behavior observed. Last observed on Dec 27, 2021."", ""Sources"": [""report:aEft3k""], ""Timestamp"": ""2021-12-28T18:42:08.923Z"", ""Name"": ""recentActiveCnc"", ""MitigationString"": """", ""Criticality"": 4.0}]}" +"181.112.52.26","99","8/64","{""EvidenceDetails"": [{""Rule"": ""Historical Open Proxies"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2339 sightings on 9 sources including: TBN, BlackHatWorld Forum, Carding Mafia Forum, Inforge Forum Hacker Trucchi Giochi Informatica, ProxyFire - The Best Proxy Software and Forum. Most recent link (Jun 29, 2019): https://Black%20Hat%20World%20Forum%20(Obfuscated)/seo/ssl-proxies-occasional-update.927669/page-44#post-12210196"", ""Sources"": [""RqhhJr"", ""KjGS3i"", ""VU4Qnc"", ""P7sZbk"", ""OQ_oQH"", ""Qk8WdX"", ""Qk8Wdg"", ""QqgtXJ"", ""KhvyCV""], ""Timestamp"": ""2019-06-29T01:18:00.000Z"", ""Name"": ""openProxies"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Honeypot Sighting"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: @HoneyFog. Most recent tweet: Fog44: 181.112.52.26->22. I've never seen this IP before. Most recent link (Oct 6, 2017): https://twitter.com/HoneyFog/statuses/916371734928019456"", ""Sources"": [""P_izv4""], ""Timestamp"": ""2017-10-06T18:37:01.000Z"", ""Name"": ""honeypot"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Linked to Intrusion Method"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""10 sightings on 3 sources: Manato Kumagai Hatena Blog, sentinelone.com, PasteBin. 6 related intrusion methods including TrickLoader, Trojan, Emotet, Banking Trojan, Trickbot. Most recent link (Feb 26, 2020): https://labs.sentinelone.com/revealing-the-trick-a-deep-dive-into-trickloader-obfuscation/"", ""Sources"": [""TiY1wa"", ""idn:sentinelone.com"", ""Jv_xrR""], ""Timestamp"": ""2020-02-26T15:00:17.035Z"", ""Name"": ""linkedIntrusion"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical Multicategory Blocklist"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26"", ""Sources"": [""UneVVu""], ""Timestamp"": ""2018-08-17T00:30:42.194Z"", ""Name"": ""multiBlacklist"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historical SSH/Dictionary Attacker"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26"", ""Sources"": [""UneVVu""], ""Timestamp"": ""2018-08-17T00:30:42.194Z"", ""Name"": ""sshDictAttacker"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Reported in Threat List"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""Previous sightings on 3 sources: BlockList.de: Fail2ban Reporting Service, Abuse.ch: Feodo IP Blocklist, Proxies: SOCKS Open Proxies. Observed between Jun 15, 2019, and Oct 3, 2020."", ""Sources"": [""report:OhgwUx"", ""report:OtiCOp"", ""report:SYQe08""], ""Timestamp"": ""2021-12-28T22:05:41.272Z"", ""Name"": ""historicalThreatListMembership"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recent C&C Server"", ""CriticalityLabel"": ""Suspicious"", ""EvidenceString"": ""3 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample dcc42c0bd075f283c71ac327c845498454dcd9528386df5b296fdf89ba105bfa"", ""Sources"": [""hyihHO""], ""Timestamp"": ""2021-07-15T12:42:04.656Z"", ""Name"": ""intermediateCncServer"", ""MitigationString"": """", ""Criticality"": 2.0}, {""Rule"": ""Current C&C Server"", ""CriticalityLabel"": ""Very Malicious"", ""EvidenceString"": ""5 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample b827a4587bc6162715693c71e432769ec6272c130bb87e14bc683f5bd7caf834"", ""Sources"": [""hyihHO""], ""Timestamp"": ""2021-12-22T04:10:08.558Z"", ""Name"": ""recentCncServer"", ""MitigationString"": """", ""Criticality"": 4.0}]}" diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_ip_default.csv.log-expected.json b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_ip_default.csv.log-expected.json new file mode 100644 index 000000000000..b2d3e7f3f8fc --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_ip_default.csv.log-expected.json @@ -0,0 +1,881 @@ +[ + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 45, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Qakbot. Communication observed on TCP:443, TCP:6881, TCP:995. Exfiltration behavior observed. Last observed on Dec 27, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-29T02:11:16.663Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "164 sightings on 4 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions, Abuse.ch: Feodo IP Blocklist, Polyswarm Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 103.143.8.71:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "h_iZX8", + "report:OtiCOp", + "hyihHO" + ], + "Timestamp": "2021-12-29T02:11:16.658Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "7 sightings on 1 source: PasteBin. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Nov 8, 2021): https://pastebin.com/G1Jvm5T0", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "Jv_xrR" + ], + "Timestamp": "2021-11-08T16:27:15.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: GitHub. Most recent link (Nov 16, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-15-IOCs-for-Matanbuchus-Qakbot-CobaltStrike-and-spambot-activity.txt", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged IP", + "Sources": [ + "MIKjae" + ], + "Timestamp": "2021-11-16T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "4/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "103.143.8.71", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 68.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 2204, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: AbuseIPDB Community Submissions. 2001:470:1:c84::17 was identified as Brute-Force by multiple unique community member submissions. Reported to Recorded Future on Nov 23, 2021.", + "MitigationString": "", + "Name": "bruteForce", + "Rule": "Historical Brute Force", + "Sources": [ + "kAh9jV" + ], + "Timestamp": "2021-11-24T10:21:58.872Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: AbuseIPDB Community Submissions. 2001:470:1:c84::17 was identified as DDoS Attack by multiple unique community member submissions. Reported to Recorded Future on Dec 21, 2021.", + "MitigationString": "", + "Name": "recentDdos", + "Rule": "Recent DDoS", + "Sources": [ + "kAh9jV" + ], + "Timestamp": "2021-12-23T10:18:13.994Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: BlockList.de: Fail2ban Reporting Service.", + "MitigationString": "", + "Name": "recentMultiBlacklist", + "Rule": "Recent Multicategory Blocklist", + "Sources": [ + "report:OhgwUx" + ], + "Timestamp": "2021-12-29T07:19:53.133Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: DataPlane SSH Client Connection List.", + "MitigationString": "", + "Name": "recentSshDictAttacker", + "Rule": "Recent SSH/Dictionary Attacker", + "Sources": [ + "report:U8nmOf" + ], + "Timestamp": "2021-12-29T07:19:53.133Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: AbuseIPDB Spam. 2001:470:1:c84::17 was identified as Web Spam by multiple unique community member submissions. Reported to Recorded Future on Dec 21, 2021.", + "MitigationString": "", + "Name": "recentSpam", + "Rule": "Recent Spam Source", + "Sources": [ + "kAiRKZ" + ], + "Timestamp": "2021-12-23T10:18:14.025Z" + } + ], + "recordedfuture.risk_string": "5/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "2001:470:1:c84:0:0:0:17", + "threat.indicator.type": "ipv6-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 4263, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "12 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command & Control host identified on Dec 24, 2021.", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "h_iZX8" + ], + "Timestamp": "2021-12-24T08:07:09.925Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 2 sources: Bitdefender IP Reputation, hpHosts Latest Additions. Bitdefender detected suspicious traffic involving 185.19.85.136 associated with Bitdefender threat name Trojan.GenericKD.34300483 on Apr 30, 2021", + "MitigationString": "", + "Name": "multiBlacklist", + "Rule": "Historical Multicategory Blocklist", + "Sources": [ + "iFMVSl", + "Ol_aRZ" + ], + "Timestamp": "2021-04-30T04:50:06.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: GitHub. 2 related intrusion methods: Nanocore, Remote Access Trojan. Most recent link (Jan 1, 2021): https://github.com/GlacierSheep/DomainBlockList/blob/master/trail/static_nanocore_(malware).domainset", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "MIKjae" + ], + "Timestamp": "2021-01-01T16:56:57.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between Feb 13, 2021, and Feb 13, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:SW8xpk" + ], + "Timestamp": "2021-12-28T19:20:46.641Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "9 sightings on 2 sources: Recorded Future Command & Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command & Control host identified on Oct 29, 2021.", + "MitigationString": "", + "Name": "intermediateCncServer", + "Rule": "Recent C&C Server", + "Sources": [ + "b5tNVA", + "h_iZX8" + ], + "Timestamp": "2021-10-29T08:07:54.495Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Asyncrat. Communication observed on TCP:6060. Last observed on Dec 21, 2021.", + "MitigationString": "", + "Name": "intermediateActiveCnc", + "Rule": "Recently Active C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-28T19:20:46.639Z" + } + ], + "recordedfuture.risk_string": "6/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "185.19.85.136", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 7071, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Cobalt Strike Team Servers. Communication observed on TCP:443, TCP:8443. Last observed on Dec 26, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-28T18:45:41.875Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "2 sightings on 1 source: Recorded Future Command & Control List. Command & Control host identified on Jul 5, 2021.", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA" + ], + "Timestamp": "2021-07-05T08:04:23.139Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: C2IntelFeeds IPC2s. Most recent link (Aug 15, 2021): https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/IPC2s-30day.csv?q=45.112.206.18_20210815", + "MitigationString": "", + "Name": "linkedToCyberAttack", + "Rule": "Historically Linked to Cyber Attack", + "Sources": [ + "k_7zaW" + ], + "Timestamp": "2021-08-15T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "12 sightings on 2 sources: C2IntelFeeds IPC2s, @drb_ra. 2 related intrusion methods: Cobalt Strike, Offensive Security Tools (OST). Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "k_7zaW", + "jqWX2B" + ], + "Timestamp": "2021-11-26T15:01:53.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "10 sightings on 1 source: @drb_ra. Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged IP", + "Sources": [ + "jqWX2B" + ], + "Timestamp": "2021-11-26T15:01:53.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 2 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, Recorded Future Analyst Community Trending Indicators. Observed between Jul 8, 2021, and Dec 9, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:aD1qtM", + "report:Tluf00" + ], + "Timestamp": "2021-12-28T18:45:41.877Z" + } + ], + "recordedfuture.risk_string": "6/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "45.112.206.18", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 10254, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "5 sightings on 2 sources: Polyswarm Sandbox Analysis - Malware C2 Extractions, Joe Security Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample c9709d56b92047cd55fb097feb6cb7a8de6f3edc5ea79a429363938a69aae580", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "hyihHO", + "h_iZX8" + ], + "Timestamp": "2021-12-27T19:00:49.975Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "5 sightings on 1 source: AbuseIP Database. Most recent link (Aug 25, 2020): https://www.abuseipdb.com/check/190.55.186.229", + "MitigationString": "", + "Name": "multiBlacklist", + "Rule": "Historical Multicategory Blocklist", + "Sources": [ + "UneVVu" + ], + "Timestamp": "2020-08-25T20:01:29.075Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "87 sightings on 1 source: Cryptolaemus Pastedump. Most recent link (Jan 25, 2021): https://paste.cryptolaemus.com/emotet/2021/01/25/emotet-malware-IoCs_01-25-21.html", + "MitigationString": "", + "Name": "positiveMalwareVerdict", + "Rule": "Historical Positive Malware Verdict", + "Sources": [ + "Z7kln2" + ], + "Timestamp": "2021-01-25T23:59:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: External Sensor Spam. 190.55.186.229 was historically observed as spam. No longer observed as of Nov 16, 2021.", + "MitigationString": "", + "Name": "spam", + "Rule": "Historical Spam Source", + "Sources": [ + "kBCI-b" + ], + "Timestamp": "2021-11-16T01:06:21.965Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/", + "MitigationString": "", + "Name": "threatResearcher", + "Rule": "Historical Threat Researcher", + "Sources": [ + "jjf3_B" + ], + "Timestamp": "2021-04-09T12:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "239 sightings on 5 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks, PasteBin, Cryptolaemus Pastedump. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Mar 14, 2021): https://unit42.paloaltonetworks.jp/attack-chain-overview-emotet-in-december-2020-and-january-2021/", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "idn:paloaltonetworks.jp", + "JwO7jp", + "jjf3_B", + "Jv_xrR", + "Z7kln2" + ], + "Timestamp": "2021-03-14T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "6 sightings on 3 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged IP", + "Sources": [ + "idn:paloaltonetworks.jp", + "JwO7jp", + "jjf3_B" + ], + "Timestamp": "2021-04-09T12:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 2 sources: University of Science and Technology of China Black IP List, Abuse.ch: Feodo IP Blocklist. Observed between Feb 26, 2021, and Dec 27, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:Q1ghC0", + "report:OtiCOp" + ], + "Timestamp": "2021-12-28T19:33:55.849Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "31 sightings on 3 sources: Palo Alto Networks, Polyswarm Sandbox Analysis - Malware C2 Extractions, Unit 42 Palo Alto Networks. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample a88734cd5c38211a4168bc7701516a50e6aef5ef20d2b1a915edae23c1b345db", + "MitigationString": "", + "Name": "intermediateCncServer", + "Rule": "Recent C&C Server", + "Sources": [ + "JwO7jp", + "hyihHO", + "jjf3_B" + ], + "Timestamp": "2021-10-19T12:21:34.268Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: Talos IP Blacklist.", + "MitigationString": "", + "Name": "recentMultiBlacklist", + "Rule": "Recent Multicategory Blocklist", + "Sources": [ + "report:VW6jeN" + ], + "Timestamp": "2021-12-28T19:33:55.846Z" + } + ], + "recordedfuture.risk_string": "10/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "190.55.186.229", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 15104, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Emotet. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 26, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-28T22:05:35.688Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "2 sightings on 2 sources: Recorded Future Command & Control List, Abuse.ch: Feodo IP Blocklist. Command & Control host identified on Dec 1, 2021.", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "report:OtiCOp" + ], + "Timestamp": "2021-12-01T08:06:11.827Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: PasteBin. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 2, 2021): https://pastebin.com/SusxCK2b", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "Jv_xrR" + ], + "Timestamp": "2021-12-02T15:58:10.000Z" + } + ], + "recordedfuture.risk_string": "3/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "62.210.82.223", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 16512, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Bazarloader. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 25, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-29T06:21:27.731Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "2 sightings on 2 sources: Recorded Future Command & Control List, Abuse.ch: Feodo IP Blocklist. Command & Control host identified on Nov 25, 2021.", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "report:OtiCOp" + ], + "Timestamp": "2021-11-25T08:06:42.384Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 2 sources: Project Honey Pot, @HoneyFog. Most recent tweet: Fog44: 87.120.254.96->22. Most recent link (Dec 14, 2016): https://twitter.com/HoneyFog/statuses/809032869792378880", + "MitigationString": "", + "Name": "honeypot", + "Rule": "Historical Honeypot Sighting", + "Sources": [ + "P_izv4", + "OSz1F0" + ], + "Timestamp": "2016-12-14T13:50:41.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: External Sensor Spam. 87.120.254.96 was historically observed as spam. No longer observed as of Nov 16, 2021.", + "MitigationString": "", + "Name": "spam", + "Rule": "Historical Spam Source", + "Sources": [ + "kBCI-b" + ], + "Timestamp": "2021-11-16T03:19:58.721Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: GitHub. Most recent link (Nov 8, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-05-TA551-IOCs.txt", + "MitigationString": "", + "Name": "defanged", + "Rule": "Historically Reported as a Defanged IP", + "Sources": [ + "MIKjae" + ], + "Timestamp": "2021-11-08T00:00:00.000Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: University of Science and Technology of China Black IP List.", + "MitigationString": "", + "Name": "recentMultiBlacklist", + "Rule": "Recent Multicategory Blocklist", + "Sources": [ + "report:Q1ghC0" + ], + "Timestamp": "2021-12-29T06:21:27.693Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: CloudSEK. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 22, 2021): https://cloudsek.com/emotet-2-0-everything-you-need-to-know-about-the-new-variant-of-thbanking-trojan/", + "MitigationString": "", + "Name": "recentLinkedIntrusion", + "Rule": "Recently Linked to Intrusion Method", + "Sources": [ + "k837l0" + ], + "Timestamp": "2021-12-22T09:45:33.000Z" + } + ], + "recordedfuture.risk_string": "7/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "87.120.254.96", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 19600, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C&C server for 1 malware family: Covenant. Communication observed on TCP:7443. Exfiltration behavior observed. Last observed on Dec 27, 2021.", + "MitigationString": "", + "Name": "recentActiveCnc", + "Rule": "Actively Communicating C&C Server", + "Sources": [ + "report:aEft3k" + ], + "Timestamp": "2021-12-28T18:42:08.923Z" + }, + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "19 sightings on 2 sources: Recorded Future Command & Control List, @TheDFIRReport. Most recent tweet: Here's some newer C2 servers we're tracking: #BazarLoader 64.227.73.80 64.225.71.198 #Covenant 167.71.67.196 45.146.165.76 #PoshC2 193.36.15.192 #Empire 64.227.21.255 #Metasploit 91.221.70.143 Full list available @ https://t.co/QT6o626hsR #ThreatFeed. Most recent link (Sep 1, 2021): https://twitter.com/TheDFIRReport/statuses/1433055791964049412", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "b5tNVA", + "dZgcRz" + ], + "Timestamp": "2021-09-01T13:15:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 3 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, CINS: CI Army List, Recorded Future Analyst Community Trending Indicators. Observed between Jan 22, 2021, and Sep 25, 2021.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:aD1qtM", + "report:OchJ-t", + "report:Tluf00" + ], + "Timestamp": "2021-12-28T18:42:08.925Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "1 sighting on 1 source: DShield: Recommended Block List.", + "MitigationString": "", + "Name": "recentMultiBlacklist", + "Rule": "Recent Multicategory Blocklist", + "Sources": [ + "report:OchJ-o" + ], + "Timestamp": "2021-12-28T18:42:08.917Z" + } + ], + "recordedfuture.risk_string": "4/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "45.146.165.76", + "threat.indicator.type": "ipv4-addr" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 99.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 21759, + "recordedfuture.evidence_details": [ + { + "Criticality": 4.0, + "CriticalityLabel": "Very Malicious", + "EvidenceString": "5 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample b827a4587bc6162715693c71e432769ec6272c130bb87e14bc683f5bd7caf834", + "MitigationString": "", + "Name": "recentCncServer", + "Rule": "Current C&C Server", + "Sources": [ + "hyihHO" + ], + "Timestamp": "2021-12-22T04:10:08.558Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: @HoneyFog. Most recent tweet: Fog44: 181.112.52.26->22. I've never seen this IP before. Most recent link (Oct 6, 2017): https://twitter.com/HoneyFog/statuses/916371734928019456", + "MitigationString": "", + "Name": "honeypot", + "Rule": "Historical Honeypot Sighting", + "Sources": [ + "P_izv4" + ], + "Timestamp": "2017-10-06T18:37:01.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26", + "MitigationString": "", + "Name": "multiBlacklist", + "Rule": "Historical Multicategory Blocklist", + "Sources": [ + "UneVVu" + ], + "Timestamp": "2018-08-17T00:30:42.194Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2339 sightings on 9 sources including: TBN, BlackHatWorld Forum, Carding Mafia Forum, Inforge Forum Hacker Trucchi Giochi Informatica, ProxyFire - The Best Proxy Software and Forum. Most recent link (Jun 29, 2019): https://Black%20Hat%20World%20Forum%20(Obfuscated)/seo/ssl-proxies-occasional-update.927669/page-44#post-12210196", + "MitigationString": "", + "Name": "openProxies", + "Rule": "Historical Open Proxies", + "Sources": [ + "RqhhJr", + "KjGS3i", + "VU4Qnc", + "P7sZbk", + "OQ_oQH", + "Qk8WdX", + "Qk8Wdg", + "QqgtXJ", + "KhvyCV" + ], + "Timestamp": "2019-06-29T01:18:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26", + "MitigationString": "", + "Name": "sshDictAttacker", + "Rule": "Historical SSH/Dictionary Attacker", + "Sources": [ + "UneVVu" + ], + "Timestamp": "2018-08-17T00:30:42.194Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "10 sightings on 3 sources: Manato Kumagai Hatena Blog, sentinelone.com, PasteBin. 6 related intrusion methods including TrickLoader, Trojan, Emotet, Banking Trojan, Trickbot. Most recent link (Feb 26, 2020): https://labs.sentinelone.com/revealing-the-trick-a-deep-dive-into-trickloader-obfuscation/", + "MitigationString": "", + "Name": "linkedIntrusion", + "Rule": "Historically Linked to Intrusion Method", + "Sources": [ + "TiY1wa", + "idn:sentinelone.com", + "Jv_xrR" + ], + "Timestamp": "2020-02-26T15:00:17.035Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "Previous sightings on 3 sources: BlockList.de: Fail2ban Reporting Service, Abuse.ch: Feodo IP Blocklist, Proxies: SOCKS Open Proxies. Observed between Jun 15, 2019, and Oct 3, 2020.", + "MitigationString": "", + "Name": "historicalThreatListMembership", + "Rule": "Historically Reported in Threat List", + "Sources": [ + "report:OhgwUx", + "report:OtiCOp", + "report:SYQe08" + ], + "Timestamp": "2021-12-28T22:05:41.272Z" + }, + { + "Criticality": 2.0, + "CriticalityLabel": "Suspicious", + "EvidenceString": "3 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample dcc42c0bd075f283c71ac327c845498454dcd9528386df5b296fdf89ba105bfa", + "MitigationString": "", + "Name": "intermediateCncServer", + "Rule": "Recent C&C Server", + "Sources": [ + "hyihHO" + ], + "Timestamp": "2021-07-15T12:42:04.656Z" + } + ], + "recordedfuture.risk_string": "8/64", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.ip": "181.112.52.26", + "threat.indicator.type": "ipv4-addr" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_url_default.csv.log b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_url_default.csv.log new file mode 100644 index 000000000000..1327a0d94f1e --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_url_default.csv.log @@ -0,0 +1,10 @@ +"Name","Risk","RiskString","EvidenceDetails" +"http://144.34.179.162/a","87","2/24","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged URL"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""66 sightings on 22 sources including: Ars Technica, fook.news, urdupresss.com, HackDig Posts, apple.news. Most recent link (Jul 20, 2021): https://techsecuritenews.com/solarwinds-pirates-utilisent-nouvelle-faille-zero-day-attaques/"", ""Sources"": [""Ctq"", ""idn:fook.news"", ""idn:urdupresss.com"", ""POs2u-"", ""idn:apple.news"", ""idn:cryptoinfoos.com.ng"", ""g9rk5F"", ""idn:thewindowsupdate.com"", ""idn:nationalcybersecuritynews.today"", ""gBDK5G"", ""idn:microsoft.com"", ""idn:techsecuritenews.com"", ""idn:mblogs.info"", ""J6UzbO"", ""idn:viralamo.com"", ""idn:sellorbuyhomefast.com"", ""idn:crazyboy.tech"", ""idn:times24h.com"", ""idn:buzzfeeg.com"", ""idn:dsmenders.com"", ""WroSbs"", ""idn:vzonetvgh.com""], ""Timestamp"": ""2021-07-20T00:00:00.000Z"", ""Name"": ""defangedURL"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recently Reported by Insikt Group"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Insikt Group. 1 report: SolarWinds Fixes Critical Vulnerability in Serv-U Managed File Transfer and Secure FTP Products. Most recent link (Jul 10, 2021): https://app.recordedfuture.com/live/sc/1GnDrn8zigTd"", ""Sources"": [""VKz42X""], ""Timestamp"": ""2021-07-10T00:00:00.000Z"", ""Name"": ""recentAnalystNote"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"http://adminsys.serveftp.com/nensa/fabio/ex/478632215/zer7855/nuns566623","85","4/24","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged URL"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""41 sightings on 19 sources including: Stock market news Company News MarketScreenercom, GlobeNewswire | Software, Yahoo!, globenewswirecom, otcdynamics.com. Most recent link (Oct 3, 2021): https://telecomkh.info/?p=4004"", ""Sources"": [""XBl0xf"", ""c2unu0"", ""DVW"", ""NPgRlV"", ""idn:otcdynamics.com"", ""idn:norteenlinea.com"", ""N4OmGX"", ""idn:snewsonline.com"", ""idn:nationalcybersecuritynews.today"", ""dCod5e"", ""hZ14Az"", ""idn:securityopenlab.it"", ""idn:clevertechmx.blogspot.com"", ""cJzvLR"", ""eNeV39"", ""dCotni"", ""dCo6X1"", ""jB6Hnn"", ""idn:telecomkh.info""], ""Timestamp"": ""2021-10-03T12:53:49.605Z"", ""Name"": ""defangedURL"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Phishing Techniques"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-11-14T00:00:00.000Z"", ""Name"": ""phishingSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Distribution"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-11-14T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recently Active URL on Weaponized Domain"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: No-IP. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 20, 2021."", ""Sources"": [""report:aRJ1CU""], ""Timestamp"": ""2021-12-29T07:08:29.105Z"", ""Name"": ""recentWeaponizedURL"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"http://3.145.115.94/zambo/groenhuyzen.exe","79","2/24","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged URL"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""17 sightings on 14 sources including: Security Affairs, sensorstechforum.com, Heimdal Security Blog, securitynewspaper, BBS Kafan Card Forum. Most recent link (Dec 22, 2021): https://d335luupugsy2.cloudfront.net/cms%2Ffiles%2F183750%2F1640120040Log4j_-_Explorao_por_grupos_APT.pdf"", ""Sources"": [""JNe6Hu"", ""TQnwKJ"", ""OfMf0W"", ""TefIEN"", ""VyuDZP"", ""Z7kln5"", ""bd-Dtt"", ""kKLjNc"", ""Y7TWfI"", ""idn:redpacketsecurity.com"", ""idn:eccouncil.org"", ""idn:comparaland.com"", ""idn:d335luupugsy2.cloudfront.net"", ""KVRURg""], ""Timestamp"": ""2021-12-22T16:01:42.134Z"", ""Name"": ""defangedURL"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recently Reported by Insikt Group"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Insikt Group. 1 report: Khonsari Ransomware and Orcus RAT Exploit Log4Shell (CVE-2021-44228), Samples Uploaded on MalwareBazaar. Most recent link (Dec 17, 2021): https://app.recordedfuture.com/live/sc/4SWiMAS816Gj"", ""Sources"": [""VKz42X""], ""Timestamp"": ""2021-12-17T00:00:00.000Z"", ""Name"": ""recentAnalystNote"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"http://gxbrowser.net","79","2/24","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged URL"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""53 sightings on 14 sources including: HackDig Posts, Anquanke News, mrhacker.co, Sesin at, Check Point Research. Most recent link (Feb 6, 2021): https://cdn.www.gob.pe/uploads/document/file/1580907/Alerta%20integrada%20de%20seguridad%20digital%20N%C2%B0%xxx-xx-xxxx-PECERT%20.pdf"", ""Sources"": [""POs2u-"", ""U13S_U"", ""idn:mrhacker.co"", ""Z3TZAQ"", ""N4OmGX"", ""UqKvRr"", ""gBDK5G"", ""JExgHv"", ""QxXv_c"", ""J6UzbO"", ""eTNyK6"", ""idn:privacy.com.sg"", ""e6Ewt_"", ""idn:reportcybercrime.com""], ""Timestamp"": ""2021-02-06T12:52:09.042Z"", ""Name"": ""defangedURL"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recently Detected Malware Distribution"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-12-28T00:00:00.000Z"", ""Name"": ""recentMalwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"https://881.000webhostapp.com/1.txt","78","3/24","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged URL"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""33 sightings on 12 sources including: Palo Alto Networks, tistory.com, HackDig Posts, Anquanke News, airmagnet.technology. Most recent tweet: Continued MR.Dropper's attack. (Targething korean cryptocurrency exchange) #hcapital #ioc MD5 : eb459b47be479b61375d7b3c7c568425 URL : hxxps://881[.]000webhostapp[.]com/1.txt PDB : D:\\Attack\\DropperBuild\\x64\\Release\\Dropper.pdb https://t.co/FpsinliQqx [Beyond The Binary]. Most recent link (Sep 3, 2018): https://twitter.com/wugeej/statuses/1036413512732426240"", ""Sources"": [""JwO7jp"", ""idn:tistory.com"", ""POs2u-"", ""U13S_U"", ""ThoB0I"", ""idn:airmagnet.technology"", ""LErKlN"", ""WuLz1r"", ""KdwTwF"", ""VfsacJ"", ""jjf3_B"", ""idn:brica.de""], ""Timestamp"": ""2018-09-03T00:40:11.000Z"", ""Name"": ""defangedURL"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Referenced by Insikt Group"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""2 sightings on 1 source: Insikt Group. 2 reports including \""Fractured Block” Campaign Targets Korean Users. Most recent link (Dec 09, 2018): https://app.recordedfuture.com/live/sc/1RuTxKrDf8Qt"", ""Sources"": [""VKz42X""], ""Timestamp"": ""2018-12-09T00:00:00.000Z"", ""Name"": ""relatedNote"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recently Active URL on Weaponized Domain"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: 000Webhost. Behavior observed: Malware Distribution. Last observed on Oct 16, 2021."", ""Sources"": [""report:aRJ1CU""], ""Timestamp"": ""2021-12-29T07:07:42.477Z"", ""Name"": ""recentWeaponizedURL"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"http://comunicador.duckdns.org/catalista/lixo/index.php","78","4/24","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged URL"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""38 sightings on 7 sources including: cybersecdn.com, WeLiveSecurity Spain, deepcheck.one, hackeridiot.com, PasteBin. Most recent link (May 27, 2021): https://cybersecdn.com/index.php/2021/05/27/janeleiro-the-time-traveler-a-new-old-banking-trojan-in-brazil/"", ""Sources"": [""idn:cybersecdn.com"", ""fWD1r9"", ""idn:deepcheck.one"", ""idn:hackeridiot.com"", ""Jv_xrR"", ""ONMgMx"", ""idn:nationalcybersecuritynews.today""], ""Timestamp"": ""2021-05-27T22:48:00.256Z"", ""Name"": ""defangedURL"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Distribution"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-06-15T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recently Reported by Insikt Group"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Insikt Group. 1 report: New Janeleiro Banking Trojan Targets Corporate Users in Brazil. Most recent link (Apr 06, 2021): https://app.recordedfuture.com/live/sc/4wolQHrxLiwd"", ""Sources"": [""VKz42X""], ""Timestamp"": ""2021-04-06T00:00:00.000Z"", ""Name"": ""recentAnalystNote"", ""MitigationString"": """", ""Criticality"": 3.0}, {""Rule"": ""Recently Active URL on Weaponized Domain"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: DuckDNS. Behavior observed: Malware Distribution. Last observed on Oct 15, 2021."", ""Sources"": [""report:aRJ1CU""], ""Timestamp"": ""2021-12-29T06:34:00.698Z"", ""Name"": ""recentWeaponizedURL"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"https://www.jeanninecatddns.chickenkiller.com/signin-authflow","75","3/24","{""EvidenceDetails"": [{""Rule"": ""Recently Active URL on Weaponized Domain"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: Afraid.org. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 28, 2021."", ""Sources"": [""report:aRJ1CU""], ""Timestamp"": ""2021-12-28T22:15:49.631Z"", ""Name"": ""recentWeaponizedURL"", ""MitigationString"": """", ""Criticality"": 3.0}, {""Rule"": ""Recently Detected Phishing Techniques"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""2 sightings on 2 sources: Bitdefender, Urlscan.io. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021."", ""Sources"": [""d3Awkm"", ""eKv4Jm""], ""Timestamp"": ""2021-12-28T00:00:00.000Z"", ""Name"": ""recentPhishingSiteDetected"", ""MitigationString"": """", ""Criticality"": 3.0}, {""Rule"": ""Recently Detected Malware Distribution"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-12-28T00:00:00.000Z"", ""Name"": ""recentMalwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"http://coollab.jp/dir/root/p/09908.js","75","3/24","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged URL"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""24 sightings on 9 sources including: Malware News - Malware Analysis, News and Indicators, microsoft.com, sociabble.com, 4-traders.com, MarketScreener.com | Stock Market News. Most recent link (Aug 13, 2021): https://www.marketscreener.com/quote/stock/MICROSOFT-CORPORATION-4835/news/Microsoft-Attackers-use-Morse-code-other-encryption-methods-in-evasive-phishing-campaign-36161110/?utm_medium=RSS&utm_content=20210813"", ""Sources"": [""gBDK5G"", ""idn:microsoft.com"", ""idn:sociabble.com"", ""KBTQ2e"", ""dCotni"", ""g9rk5F"", ""Z7kln5"", ""idn:cda.ms"", ""idn:thewindowsupdate.com""], ""Timestamp"": ""2021-08-13T17:03:19.000Z"", ""Name"": ""defangedURL"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Malware Distribution"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Aug 13, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-08-13T00:00:00.000Z"", ""Name"": ""malwareSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recently Reported by Insikt Group"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Insikt Group. 1 report: Microsoft Warns of Attacks Targeting Microsoft Office 365 Users. Most recent link (Aug 12, 2021): https://app.recordedfuture.com/live/sc/4BBhpn1ApBQR"", ""Sources"": [""VKz42X""], ""Timestamp"": ""2021-08-12T00:00:00.000Z"", ""Name"": ""recentAnalystNote"", ""MitigationString"": """", ""Criticality"": 3.0}]}" +"https://blog.br0vvnn.io","75","3/24","{""EvidenceDetails"": [{""Rule"": ""Historically Reported as a Defanged URL"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""23 sightings on 9 sources including: The Official Google Blog, eccouncil.org, frsecure.com, SoyaCincau, PasteBin. Most recent tweet: Actor controlled sites and accounts Research Blog https://blog.br0vvnn[.]io. Most recent link (Jan 27, 2021): https://twitter.com/techn0m4nc3r/statuses/1354296736357953539"", ""Sources"": [""Gzt"", ""idn:eccouncil.org"", ""idn:frsecure.com"", ""J-8-Nr"", ""Jv_xrR"", ""g9rk5F"", ""cUg0pv"", ""K5LKj8"", ""fVAueu""], ""Timestamp"": ""2021-01-27T05:14:38.000Z"", ""Name"": ""defangedURL"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Historically Detected Phishing Techniques"", ""CriticalityLabel"": ""Unusual"", ""EvidenceString"": ""1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 30, 2021."", ""Sources"": [""d3Awkm""], ""Timestamp"": ""2021-05-30T00:00:00.000Z"", ""Name"": ""phishingSiteDetected"", ""MitigationString"": """", ""Criticality"": 1.0}, {""Rule"": ""Recently Reported by Insikt Group"", ""CriticalityLabel"": ""Malicious"", ""EvidenceString"": ""1 sighting on 1 source: Insikt Group. 1 report: Google Warns of Ongoing Attacks Targeting Security Researchers. Most recent link (Jan 25, 2021): https://app.recordedfuture.com/live/sc/5QCqZ2ZH4lwc"", ""Sources"": [""VKz42X""], ""Timestamp"": ""2021-01-25T00:00:00.000Z"", ""Name"": ""recentAnalystNote"", ""MitigationString"": """", ""Criticality"": 3.0}]}" diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_url_default.csv.log-expected.json b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_url_default.csv.log-expected.json new file mode 100644 index 000000000000..df135ded0e3a --- /dev/null +++ b/x-pack/filebeat/module/threatintel/recordedfuture/test/rf_url_default.csv.log-expected.json @@ -0,0 +1,651 @@ +[ + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 87.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 45, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "66 sightings on 22 sources including: Ars Technica, fook.news, urdupresss.com, HackDig Posts, apple.news. Most recent link (Jul 20, 2021): https://techsecuritenews.com/solarwinds-pirates-utilisent-nouvelle-faille-zero-day-attaques/", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "Ctq", + "idn:fook.news", + "idn:urdupresss.com", + "POs2u-", + "idn:apple.news", + "idn:cryptoinfoos.com.ng", + "g9rk5F", + "idn:thewindowsupdate.com", + "idn:nationalcybersecuritynews.today", + "gBDK5G", + "idn:microsoft.com", + "idn:techsecuritenews.com", + "idn:mblogs.info", + "J6UzbO", + "idn:viralamo.com", + "idn:sellorbuyhomefast.com", + "idn:crazyboy.tech", + "idn:times24h.com", + "idn:buzzfeeg.com", + "idn:dsmenders.com", + "WroSbs", + "idn:vzonetvgh.com" + ], + "Timestamp": "2021-07-20T00:00:00.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: SolarWinds Fixes Critical Vulnerability in Serv-U Managed File Transfer and Secure FTP Products. Most recent link (Jul 10, 2021): https://app.recordedfuture.com/live/sc/1GnDrn8zigTd", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-07-10T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "2/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "144.34.179.162", + "threat.indicator.url.original": "http://144.34.179.162/a", + "threat.indicator.url.path": "/a", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 85.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 1565, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-11-14T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.", + "MitigationString": "", + "Name": "phishingSiteDetected", + "Rule": "Historically Detected Phishing Techniques", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-11-14T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "41 sightings on 19 sources including: Stock market news Company News MarketScreenercom, GlobeNewswire | Software, Yahoo!, globenewswirecom, otcdynamics.com. Most recent link (Oct 3, 2021): https://telecomkh.info/?p=4004", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "XBl0xf", + "c2unu0", + "DVW", + "NPgRlV", + "idn:otcdynamics.com", + "idn:norteenlinea.com", + "N4OmGX", + "idn:snewsonline.com", + "idn:nationalcybersecuritynews.today", + "dCod5e", + "hZ14Az", + "idn:securityopenlab.it", + "idn:clevertechmx.blogspot.com", + "cJzvLR", + "eNeV39", + "dCotni", + "dCo6X1", + "jB6Hnn", + "idn:telecomkh.info" + ], + "Timestamp": "2021-10-03T12:53:49.605Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: No-IP. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 20, 2021.", + "MitigationString": "", + "Name": "recentWeaponizedURL", + "Rule": "Recently Active URL on Weaponized Domain", + "Sources": [ + "report:aRJ1CU" + ], + "Timestamp": "2021-12-29T07:08:29.105Z" + } + ], + "recordedfuture.risk_string": "4/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "adminsys.serveftp.com", + "threat.indicator.url.original": "http://adminsys.serveftp.com/nensa/fabio/ex/478632215/zer7855/nuns566623", + "threat.indicator.url.path": "/nensa/fabio/ex/478632215/zer7855/nuns566623", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 79.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 3798, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "17 sightings on 14 sources including: Security Affairs, sensorstechforum.com, Heimdal Security Blog, securitynewspaper, BBS Kafan Card Forum. Most recent link (Dec 22, 2021): https://d335luupugsy2.cloudfront.net/cms%2Ffiles%2F183750%2F1640120040Log4j_-_Explorao_por_grupos_APT.pdf", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "JNe6Hu", + "TQnwKJ", + "OfMf0W", + "TefIEN", + "VyuDZP", + "Z7kln5", + "bd-Dtt", + "kKLjNc", + "Y7TWfI", + "idn:redpacketsecurity.com", + "idn:eccouncil.org", + "idn:comparaland.com", + "idn:d335luupugsy2.cloudfront.net", + "KVRURg" + ], + "Timestamp": "2021-12-22T16:01:42.134Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: Khonsari Ransomware and Orcus RAT Exploit Log4Shell (CVE-2021-44228), Samples Uploaded on MalwareBazaar. Most recent link (Dec 17, 2021): https://app.recordedfuture.com/live/sc/4SWiMAS816Gj", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-12-17T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "2/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "3.145.115.94", + "threat.indicator.url.extension": "exe", + "threat.indicator.url.original": "http://3.145.115.94/zambo/groenhuyzen.exe", + "threat.indicator.url.path": "/zambo/groenhuyzen.exe", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 79.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 5158, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "53 sightings on 14 sources including: HackDig Posts, Anquanke News, mrhacker.co, Sesin at, Check Point Research. Most recent link (Feb 6, 2021): https://cdn.www.gob.pe/uploads/document/file/1580907/Alerta%20integrada%20de%20seguridad%20digital%20N%C2%B0%xxx-xx-xxxx-PECERT%20.pdf", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "POs2u-", + "U13S_U", + "idn:mrhacker.co", + "Z3TZAQ", + "N4OmGX", + "UqKvRr", + "gBDK5G", + "JExgHv", + "QxXv_c", + "J6UzbO", + "eTNyK6", + "idn:privacy.com.sg", + "e6Ewt_", + "idn:reportcybercrime.com" + ], + "Timestamp": "2021-02-06T12:52:09.042Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.", + "MitigationString": "", + "Name": "recentMalwareSiteDetected", + "Rule": "Recently Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-12-28T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "2/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "gxbrowser.net", + "threat.indicator.url.original": "http://gxbrowser.net", + "threat.indicator.url.path": "", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 78.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 6382, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "2 sightings on 1 source: Insikt Group. 2 reports including \"Fractured Block\u201d Campaign Targets Korean Users. Most recent link (Dec 09, 2018): https://app.recordedfuture.com/live/sc/1RuTxKrDf8Qt", + "MitigationString": "", + "Name": "relatedNote", + "Rule": "Historically Referenced by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2018-12-09T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "33 sightings on 12 sources including: Palo Alto Networks, tistory.com, HackDig Posts, Anquanke News, airmagnet.technology. Most recent tweet: Continued MR.Dropper's attack. (Targething korean cryptocurrency exchange) #hcapital #ioc MD5 : eb459b47be479b61375d7b3c7c568425 URL : hxxps://881[.]000webhostapp[.]com/1.txt PDB : D:\\Attack\\DropperBuild\\x64\\Release\\Dropper.pdb https://t.co/FpsinliQqx [Beyond The Binary]. Most recent link (Sep 3, 2018): https://twitter.com/wugeej/statuses/1036413512732426240", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "JwO7jp", + "idn:tistory.com", + "POs2u-", + "U13S_U", + "ThoB0I", + "idn:airmagnet.technology", + "LErKlN", + "WuLz1r", + "KdwTwF", + "VfsacJ", + "jjf3_B", + "idn:brica.de" + ], + "Timestamp": "2018-09-03T00:40:11.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: 000Webhost. Behavior observed: Malware Distribution. Last observed on Oct 16, 2021.", + "MitigationString": "", + "Name": "recentWeaponizedURL", + "Rule": "Recently Active URL on Weaponized Domain", + "Sources": [ + "report:aRJ1CU" + ], + "Timestamp": "2021-12-29T07:07:42.477Z" + } + ], + "recordedfuture.risk_string": "3/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "881.000webhostapp.com", + "threat.indicator.url.extension": "txt", + "threat.indicator.url.original": "https://881.000webhostapp.com/1.txt", + "threat.indicator.url.path": "/1.txt", + "threat.indicator.url.scheme": "https" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 78.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 8308, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-06-15T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "38 sightings on 7 sources including: cybersecdn.com, WeLiveSecurity Spain, deepcheck.one, hackeridiot.com, PasteBin. Most recent link (May 27, 2021): https://cybersecdn.com/index.php/2021/05/27/janeleiro-the-time-traveler-a-new-old-banking-trojan-in-brazil/", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "idn:cybersecdn.com", + "fWD1r9", + "idn:deepcheck.one", + "idn:hackeridiot.com", + "Jv_xrR", + "ONMgMx", + "idn:nationalcybersecuritynews.today" + ], + "Timestamp": "2021-05-27T22:48:00.256Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: DuckDNS. Behavior observed: Malware Distribution. Last observed on Oct 15, 2021.", + "MitigationString": "", + "Name": "recentWeaponizedURL", + "Rule": "Recently Active URL on Weaponized Domain", + "Sources": [ + "report:aRJ1CU" + ], + "Timestamp": "2021-12-29T06:34:00.698Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: New Janeleiro Banking Trojan Targets Corporate Users in Brazil. Most recent link (Apr 06, 2021): https://app.recordedfuture.com/live/sc/4wolQHrxLiwd", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-04-06T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "4/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "comunicador.duckdns.org", + "threat.indicator.url.extension": "php", + "threat.indicator.url.original": "http://comunicador.duckdns.org/catalista/lixo/index.php", + "threat.indicator.url.path": "/catalista/lixo/index.php", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 75.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 10393, + "recordedfuture.evidence_details": [ + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: Afraid.org. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 28, 2021.", + "MitigationString": "", + "Name": "recentWeaponizedURL", + "Rule": "Recently Active URL on Weaponized Domain", + "Sources": [ + "report:aRJ1CU" + ], + "Timestamp": "2021-12-28T22:15:49.631Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.", + "MitigationString": "", + "Name": "recentMalwareSiteDetected", + "Rule": "Recently Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-12-28T00:00:00.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "2 sightings on 2 sources: Bitdefender, Urlscan.io. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.", + "MitigationString": "", + "Name": "recentPhishingSiteDetected", + "Rule": "Recently Detected Phishing Techniques", + "Sources": [ + "d3Awkm", + "eKv4Jm" + ], + "Timestamp": "2021-12-28T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "3/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "www.jeanninecatddns.chickenkiller.com", + "threat.indicator.url.original": "https://www.jeanninecatddns.chickenkiller.com/signin-authflow", + "threat.indicator.url.path": "/signin-authflow", + "threat.indicator.url.scheme": "https" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 75.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 11834, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Aug 13, 2021.", + "MitigationString": "", + "Name": "malwareSiteDetected", + "Rule": "Historically Detected Malware Distribution", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-08-13T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "24 sightings on 9 sources including: Malware News - Malware Analysis, News and Indicators, microsoft.com, sociabble.com, 4-traders.com, MarketScreener.com | Stock Market News. Most recent link (Aug 13, 2021): https://www.marketscreener.com/quote/stock/MICROSOFT-CORPORATION-4835/news/Microsoft-Attackers-use-Morse-code-other-encryption-methods-in-evasive-phishing-campaign-36161110/?utm_medium=RSS&utm_content=20210813", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "gBDK5G", + "idn:microsoft.com", + "idn:sociabble.com", + "KBTQ2e", + "dCotni", + "g9rk5F", + "Z7kln5", + "idn:cda.ms", + "idn:thewindowsupdate.com" + ], + "Timestamp": "2021-08-13T17:03:19.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: Microsoft Warns of Attacks Targeting Microsoft Office 365 Users. Most recent link (Aug 12, 2021): https://app.recordedfuture.com/live/sc/4BBhpn1ApBQR", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-08-12T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "3/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "coollab.jp", + "threat.indicator.url.extension": "js", + "threat.indicator.url.original": "http://coollab.jp/dir/root/p/09908.js", + "threat.indicator.url.path": "/dir/root/p/09908.js", + "threat.indicator.url.scheme": "http" + }, + { + "event.category": "threat", + "event.dataset": "threatintel.recordedfuture", + "event.kind": "enrichment", + "event.module": "threatintel", + "event.risk_score": 75.0, + "event.type": "indicator", + "fileset.name": "recordedfuture", + "input.type": "log", + "log.offset": 13621, + "recordedfuture.evidence_details": [ + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 30, 2021.", + "MitigationString": "", + "Name": "phishingSiteDetected", + "Rule": "Historically Detected Phishing Techniques", + "Sources": [ + "d3Awkm" + ], + "Timestamp": "2021-05-30T00:00:00.000Z" + }, + { + "Criticality": 1.0, + "CriticalityLabel": "Unusual", + "EvidenceString": "23 sightings on 9 sources including: The Official Google Blog, eccouncil.org, frsecure.com, SoyaCincau, PasteBin. Most recent tweet: Actor controlled sites and accounts Research Blog https://blog.br0vvnn[.]io. Most recent link (Jan 27, 2021): https://twitter.com/techn0m4nc3r/statuses/1354296736357953539", + "MitigationString": "", + "Name": "defangedURL", + "Rule": "Historically Reported as a Defanged URL", + "Sources": [ + "Gzt", + "idn:eccouncil.org", + "idn:frsecure.com", + "J-8-Nr", + "Jv_xrR", + "g9rk5F", + "cUg0pv", + "K5LKj8", + "fVAueu" + ], + "Timestamp": "2021-01-27T05:14:38.000Z" + }, + { + "Criticality": 3.0, + "CriticalityLabel": "Malicious", + "EvidenceString": "1 sighting on 1 source: Insikt Group. 1 report: Google Warns of Ongoing Attacks Targeting Security Researchers. Most recent link (Jan 25, 2021): https://app.recordedfuture.com/live/sc/5QCqZ2ZH4lwc", + "MitigationString": "", + "Name": "recentAnalystNote", + "Rule": "Recently Reported by Insikt Group", + "Sources": [ + "VKz42X" + ], + "Timestamp": "2021-01-25T00:00:00.000Z" + } + ], + "recordedfuture.risk_string": "3/24", + "service.type": "threatintel", + "tags": [ + "forwarded", + "threatintel-recordedfuture" + ], + "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", + "threat.feed.name": "[Filebeat] RecordedFuture", + "threat.indicator.type": "url", + "threat.indicator.url.domain": "blog.br0vvnn.io", + "threat.indicator.url.original": "https://blog.br0vvnn.io", + "threat.indicator.url.path": "", + "threat.indicator.url.scheme": "https" + } +] \ No newline at end of file diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/url.ndjson.log b/x-pack/filebeat/module/threatintel/recordedfuture/test/url.ndjson.log deleted file mode 100644 index 2016b319f60a..000000000000 --- a/x-pack/filebeat/module/threatintel/recordedfuture/test/url.ndjson.log +++ /dev/null @@ -1,10 +0,0 @@ -{"entity": {"id": "url:https://d6s.example.net/nzy/vvc68ke?p5uxwn=1bj", "name": "https://d6s.example.net/nzy/vvc68ke?p5uxwn=1bj", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: URLHaus. Malware: Qakbot, qbot, zip. Most recent link (Apr 15, 2021): https://jc6.network.local/hnwdzm1k3?url=cdb14", "mitigationString": "", "rule": "Historically Detected Malware Distribution", "timestamp": "2021-04-15T00:00:00.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://d6s.example.net/nzy/vvc68ke?p5uxwn=1bj"} -{"entity": {"id": "url:https://ga7v9u.example.org/bnqv8e2v8/qb49?7kq=iw61", "name": "https://ga7v9u.example.org/bnqv8e2v8/qb49?7kq=iw61", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Feb 14, 2021.", "mitigationString": "", "rule": "Historically Detected Phishing Techniques", "timestamp": "2021-02-14T00:00:00.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://ga7v9u.example.org/bnqv8e2v8/qb49?7kq=iw61"} -{"entity": {"id": "url:https://cdmw.example.net/c20fwa/wwn?dlz53=z6ovc", "name": "https://cdmw.example.net/c20fwa/wwn?dlz53=z6ovc", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: URLHaus. Malware: gafgyt, elf. Most recent link (May 15, 2021): https://bm1.network.local/82p3t?url=12b56", "mitigationString": "", "rule": "Historically Detected Malware Distribution", "timestamp": "2021-05-15T00:00:00.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://cdmw.example.net/c20fwa/wwn?dlz53=z6ovc"} -{"entity": {"id": "url:https://4mne.example.local/ns2rk8f/wngtk2xz?vceuk7wl6=3p0", "name": "https://4mne.example.local/ns2rk8f/wngtk2xz?vceuk7wl6=3p0", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, Mozi. Most recent link (Feb 14, 2021): https://ois8bq4.network.local/4lf?url=3f7c2", "mitigationString": "", "rule": "Historically Detected Malware Distribution", "timestamp": "2021-02-14T00:00:00.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://4mne.example.local/ns2rk8f/wngtk2xz?vceuk7wl6=3p0"} -{"entity": {"id": "url:http://z198hloc8.example.com/f8ih39/f6kou?f6-u3=uwhii", "name": "http://z198hloc8.example.com/f8ih39/f6kou?f6-u3=uwhii", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: @Sh1ttyKids. Most recent tweet: https://8g7zl.network.local/v5hcdo?url=efed5", "mitigationString": "", "rule": "Historically Reported as a Defanged URL", "timestamp": "2020-06-24T12:01:33.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://z198hloc8.example.com/f8ih39/f6kou?f6-u3=uwhii"} -{"entity": {"id": "url:http://y484j-fb6.example.local/b97s24xf/prz?sg-x1do=4myont", "name": "http://y484j-fb6.example.local/b97s24xf/prz?sg-x1do=4myont", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: URLHaus. Malware: . Most recent link (Feb 14, 2021): https://w6l3t5s.network.local/dr2rg5o?url=7b29d", "mitigationString": "", "rule": "Historically Detected Malware Distribution", "timestamp": "2021-02-14T00:00:00.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://y484j-fb6.example.local/b97s24xf/prz?sg-x1do=4myont"} -{"entity": {"id": "url:http://sp2xyqq82.example.local/zxvm093/kat1rcz?vaev0aeod=rc0513", "name": "http://sp2xyqq82.example.local/zxvm093/kat1rcz?vaev0aeod=rc0513", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, mips. Most recent link (Nov 16, 2020): https://0c39b.network.local/tcxah?url=0d1b9", "mitigationString": "", "rule": "Historically Detected Malware Distribution", "timestamp": "2020-11-16T00:00:00.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://sp2xyqq82.example.local/zxvm093/kat1rcz?vaev0aeod=rc0513"} -{"entity": {"id": "url:https://zh4o7xc.example.com/-yiq/vg2whtxif?cb0-knk=s6poib5r", "name": "https://zh4o7xc.example.com/-yiq/vg2whtxif?cb0-knk=s6poib5r", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, Mozi. Most recent link (May 15, 2021): https://i1-yo.network.local/8-w8hhq2p?url=f7769", "mitigationString": "", "rule": "Historically Detected Malware Distribution", "timestamp": "2021-05-15T00:00:00.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://zh4o7xc.example.com/-yiq/vg2whtxif?cb0-knk=s6poib5r"} -{"entity": {"id": "url:http://fiivf4s.example.org/8u2qi/86vfcfq7m?pfb2ensc0=h7imk8io2", "name": "http://fiivf4s.example.org/8u2qi/86vfcfq7m?pfb2ensc0=h7imk8io2", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, mips. Most recent link (Feb 14, 2021): https://ysn.network.local/5p-09h7b?url=ff1c3", "mitigationString": "", "rule": "Historically Detected Malware Distribution", "timestamp": "2021-02-14T00:00:00.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://fiivf4s.example.org/8u2qi/86vfcfq7m?pfb2ensc0=h7imk8io2"} -{"entity": {"id": "url:http://abav9v.example.org/gj93q/7fs7?kcq7=pjaj1", "name": "http://abav9v.example.org/gj93q/7fs7?kcq7=pjaj1", "type": "URL"}, "risk": {"criticality": 1, "criticalityLabel": "Unusual", "evidenceDetails": [{"criticality": 1, "criticalityLabel": "Unusual", "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, Mozi. Most recent link (Feb 14, 2021): https://j-8uc.network.local/2odpjhia?url=1a2ba", "mitigationString": "", "rule": "Historically Detected Malware Distribution", "timestamp": "2021-02-14T00:00:00.000Z"}], "riskString": "1/25", "riskSummary": "1 of 25 Risk Rules currently observed.", "rules": 1, "score": 5}, "timestamps": {"firstSeen": "2021-06-20T00:00:00.000Z", "lastSeen": "2021-06-20T23:59:59.000Z"}, "intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://abav9v.example.org/gj93q/7fs7?kcq7=pjaj1"} diff --git a/x-pack/filebeat/module/threatintel/recordedfuture/test/url.ndjson.log-expected.json b/x-pack/filebeat/module/threatintel/recordedfuture/test/url.ndjson.log-expected.json deleted file mode 100644 index f840643fef3b..000000000000 --- a/x-pack/filebeat/module/threatintel/recordedfuture/test/url.ndjson.log-expected.json +++ /dev/null @@ -1,462 +0,0 @@ -[ - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 0, - "recordedfuture.entity.id": "url:https://d6s.example.net/nzy/vvc68ke?p5uxwn=1bj", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://d6s.example.net/nzy/vvc68ke?p5uxwn=1bj", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: URLHaus. Malware: Qakbot, qbot, zip. Most recent link (Apr 15, 2021): https://jc6.network.local/hnwdzm1k3?url=cdb14", - "mitigationString": "", - "rule": "Historically Detected Malware Distribution", - "timestamp": "2021-04-15T00:00:00.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://d6s.example.net/nzy/vvc68ke?p5uxwn=1bj", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "d6s.example.net", - "threat.indicator.url.original": "https://d6s.example.net/nzy/vvc68ke?p5uxwn=1bj", - "threat.indicator.url.path": "/nzy/vvc68ke", - "threat.indicator.url.query": "p5uxwn=1bj", - "threat.indicator.url.scheme": "https" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 874, - "recordedfuture.entity.id": "url:https://ga7v9u.example.org/bnqv8e2v8/qb49?7kq=iw61", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://ga7v9u.example.org/bnqv8e2v8/qb49?7kq=iw61", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Feb 14, 2021.", - "mitigationString": "", - "rule": "Historically Detected Phishing Techniques", - "timestamp": "2021-02-14T00:00:00.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://ga7v9u.example.org/bnqv8e2v8/qb49?7kq=iw61", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "ga7v9u.example.org", - "threat.indicator.url.original": "https://ga7v9u.example.org/bnqv8e2v8/qb49?7kq=iw61", - "threat.indicator.url.path": "/bnqv8e2v8/qb49", - "threat.indicator.url.query": "7kq=iw61", - "threat.indicator.url.scheme": "https" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 1760, - "recordedfuture.entity.id": "url:https://cdmw.example.net/c20fwa/wwn?dlz53=z6ovc", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://cdmw.example.net/c20fwa/wwn?dlz53=z6ovc", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: URLHaus. Malware: gafgyt, elf. Most recent link (May 15, 2021): https://bm1.network.local/82p3t?url=12b56", - "mitigationString": "", - "rule": "Historically Detected Malware Distribution", - "timestamp": "2021-05-15T00:00:00.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://cdmw.example.net/c20fwa/wwn?dlz53=z6ovc", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "cdmw.example.net", - "threat.indicator.url.original": "https://cdmw.example.net/c20fwa/wwn?dlz53=z6ovc", - "threat.indicator.url.path": "/c20fwa/wwn", - "threat.indicator.url.query": "dlz53=z6ovc", - "threat.indicator.url.scheme": "https" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 2627, - "recordedfuture.entity.id": "url:https://4mne.example.local/ns2rk8f/wngtk2xz?vceuk7wl6=3p0", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://4mne.example.local/ns2rk8f/wngtk2xz?vceuk7wl6=3p0", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, Mozi. Most recent link (Feb 14, 2021): https://ois8bq4.network.local/4lf?url=3f7c2", - "mitigationString": "", - "rule": "Historically Detected Malware Distribution", - "timestamp": "2021-02-14T00:00:00.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://4mne.example.local/ns2rk8f/wngtk2xz?vceuk7wl6=3p0", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "4mne.example.local", - "threat.indicator.url.original": "https://4mne.example.local/ns2rk8f/wngtk2xz?vceuk7wl6=3p0", - "threat.indicator.url.path": "/ns2rk8f/wngtk2xz", - "threat.indicator.url.query": "vceuk7wl6=3p0", - "threat.indicator.url.scheme": "https" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 3524, - "recordedfuture.entity.id": "url:http://z198hloc8.example.com/f8ih39/f6kou?f6-u3=uwhii", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://z198hloc8.example.com/f8ih39/f6kou?f6-u3=uwhii", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: @Sh1ttyKids. Most recent tweet: https://8g7zl.network.local/v5hcdo?url=efed5", - "mitigationString": "", - "rule": "Historically Reported as a Defanged URL", - "timestamp": "2020-06-24T12:01:33.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://z198hloc8.example.com/f8ih39/f6kou?f6-u3=uwhii", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "z198hloc8.example.com", - "threat.indicator.url.original": "http://z198hloc8.example.com/f8ih39/f6kou?f6-u3=uwhii", - "threat.indicator.url.path": "/f8ih39/f6kou", - "threat.indicator.url.query": "f6-u3=uwhii", - "threat.indicator.url.scheme": "http" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 4377, - "recordedfuture.entity.id": "url:http://y484j-fb6.example.local/b97s24xf/prz?sg-x1do=4myont", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://y484j-fb6.example.local/b97s24xf/prz?sg-x1do=4myont", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: URLHaus. Malware: . Most recent link (Feb 14, 2021): https://w6l3t5s.network.local/dr2rg5o?url=7b29d", - "mitigationString": "", - "rule": "Historically Detected Malware Distribution", - "timestamp": "2021-02-14T00:00:00.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://y484j-fb6.example.local/b97s24xf/prz?sg-x1do=4myont", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "y484j-fb6.example.local", - "threat.indicator.url.original": "http://y484j-fb6.example.local/b97s24xf/prz?sg-x1do=4myont", - "threat.indicator.url.path": "/b97s24xf/prz", - "threat.indicator.url.query": "sg-x1do=4myont", - "threat.indicator.url.scheme": "http" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 5272, - "recordedfuture.entity.id": "url:http://sp2xyqq82.example.local/zxvm093/kat1rcz?vaev0aeod=rc0513", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://sp2xyqq82.example.local/zxvm093/kat1rcz?vaev0aeod=rc0513", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, mips. Most recent link (Nov 16, 2020): https://0c39b.network.local/tcxah?url=0d1b9", - "mitigationString": "", - "rule": "Historically Detected Malware Distribution", - "timestamp": "2020-11-16T00:00:00.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://sp2xyqq82.example.local/zxvm093/kat1rcz?vaev0aeod=rc0513", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "sp2xyqq82.example.local", - "threat.indicator.url.original": "http://sp2xyqq82.example.local/zxvm093/kat1rcz?vaev0aeod=rc0513", - "threat.indicator.url.path": "/zxvm093/kat1rcz", - "threat.indicator.url.query": "vaev0aeod=rc0513", - "threat.indicator.url.scheme": "http" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 6187, - "recordedfuture.entity.id": "url:https://zh4o7xc.example.com/-yiq/vg2whtxif?cb0-knk=s6poib5r", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://zh4o7xc.example.com/-yiq/vg2whtxif?cb0-knk=s6poib5r", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, Mozi. Most recent link (May 15, 2021): https://i1-yo.network.local/8-w8hhq2p?url=f7769", - "mitigationString": "", - "rule": "Historically Detected Malware Distribution", - "timestamp": "2021-05-15T00:00:00.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttps://zh4o7xc.example.com/-yiq/vg2whtxif?cb0-knk=s6poib5r", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "zh4o7xc.example.com", - "threat.indicator.url.original": "https://zh4o7xc.example.com/-yiq/vg2whtxif?cb0-knk=s6poib5r", - "threat.indicator.url.path": "/-yiq/vg2whtxif", - "threat.indicator.url.query": "cb0-knk=s6poib5r", - "threat.indicator.url.scheme": "https" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 7094, - "recordedfuture.entity.id": "url:http://fiivf4s.example.org/8u2qi/86vfcfq7m?pfb2ensc0=h7imk8io2", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://fiivf4s.example.org/8u2qi/86vfcfq7m?pfb2ensc0=h7imk8io2", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, mips. Most recent link (Feb 14, 2021): https://ysn.network.local/5p-09h7b?url=ff1c3", - "mitigationString": "", - "rule": "Historically Detected Malware Distribution", - "timestamp": "2021-02-14T00:00:00.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://fiivf4s.example.org/8u2qi/86vfcfq7m?pfb2ensc0=h7imk8io2", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "fiivf4s.example.org", - "threat.indicator.url.original": "http://fiivf4s.example.org/8u2qi/86vfcfq7m?pfb2ensc0=h7imk8io2", - "threat.indicator.url.path": "/8u2qi/86vfcfq7m", - "threat.indicator.url.query": "pfb2ensc0=h7imk8io2", - "threat.indicator.url.scheme": "http" - }, - { - "event.category": "threat", - "event.dataset": "threatintel.recordedfuture", - "event.kind": "enrichment", - "event.module": "threatintel", - "event.risk_score": 5.0, - "event.type": "indicator", - "fileset.name": "recordedfuture", - "input.type": "log", - "log.offset": 8007, - "recordedfuture.entity.id": "url:http://abav9v.example.org/gj93q/7fs7?kcq7=pjaj1", - "recordedfuture.entity.type": "URL", - "recordedfuture.intelCard": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://abav9v.example.org/gj93q/7fs7?kcq7=pjaj1", - "recordedfuture.risk.criticality": 1, - "recordedfuture.risk.criticalityLabel": "Unusual", - "recordedfuture.risk.evidenceDetails": [ - { - "criticality": 1, - "criticalityLabel": "Unusual", - "evidenceString": "1 sighting on 1 source: URLHaus. Malware: elf, Mozi. Most recent link (Feb 14, 2021): https://j-8uc.network.local/2odpjhia?url=1a2ba", - "mitigationString": "", - "rule": "Historically Detected Malware Distribution", - "timestamp": "2021-02-14T00:00:00.000Z" - } - ], - "recordedfuture.risk.riskString": "1/25", - "recordedfuture.risk.riskSummary": "1 of 25 Risk Rules currently observed.", - "recordedfuture.risk.rules": 1, - "recordedfuture.risk.score": 5, - "service.type": "threatintel", - "tags": [ - "forwarded", - "threatintel-recordedfuture" - ], - "threat.feed.dashboard_id": "ad9c7430-72de-11eb-a3e3-b3cc7c78a70f", - "threat.feed.name": "[Filebeat] RecordedFuture", - "threat.indicator.first_seen": "2021-06-20T00:00:00.000Z", - "threat.indicator.last_seen": "2021-06-20T23:59:59.000Z", - "threat.indicator.reference": "https://app.recordedfuture.local/live/sc/entity/url%3Ahttp://abav9v.example.org/gj93q/7fs7?kcq7=pjaj1", - "threat.indicator.type": "url", - "threat.indicator.url.domain": "abav9v.example.org", - "threat.indicator.url.original": "http://abav9v.example.org/gj93q/7fs7?kcq7=pjaj1", - "threat.indicator.url.path": "/gj93q/7fs7", - "threat.indicator.url.query": "kcq7=pjaj1", - "threat.indicator.url.scheme": "http" - } -] \ No newline at end of file diff --git a/x-pack/filebeat/modules.d/threatintel.yml.disabled b/x-pack/filebeat/modules.d/threatintel.yml.disabled index 76691ab5f3f4..dbb88d5d1f6b 100644 --- a/x-pack/filebeat/modules.d/threatintel.yml.disabled +++ b/x-pack/filebeat/modules.d/threatintel.yml.disabled @@ -147,31 +147,25 @@ # Input used for ingesting threat intel data var.input: httpjson - # The interval to poll the API for updates - var.interval: 5m - - # How far back in time to start fetching intelligence when run for the - # first time. Value must be in hours. Default: 168h (1 week). - var.first_interval: 168h + # Set your API Token. + var.api_token: "" - # The URL used for Threat Intel API calls. - # Must include the `limit` parameter and at least `entity` and `timestamps` fields. - # See the Connect API Explorer for a list of possible parameters. - # - # For `ip` entities: - var.url: "https://api.recordedfuture.com/v2/ip/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + # The interval to poll the API for updates + var.interval: 1h - # For `domain` entities: - # var.url: "https://api.recordedfuture.com/v2/domain/search?limit=200&fields=entity,timestamps,risk,intelCard,location&metadata=false" + # The kind of entity to fetch. One of domain, hash, ip or url. + var.entity: domain - # For `hash` entities: - # var.url: "https://api.recordedfuture.com/v2/hash/search?limit=200&fields=entity,fileHashes,timestamps,risk,intelCard,location&metadata=false" + # The list to fetch. See the Recorded Future API Explorer for + # valid lists for each kind of entity. + var.list: default - # For `url` entities: - # var.url: "https://api.recordedfuture.com/v2/url/search?limit=200&fields=entity,timestamps,risk&metadata=false" + # Uncomment to use a different API endpoint. + # The API endpoint used for Recorded Future API calls. + # var.endpoint: "https://api.recordedfuture.com/v2" - # Set your API Token. - var.api_token: "" + # Uncomment to fetch a custom CSV file via URL. Useful for custom Fusion Files. + # var.custom_url: "https://api.recordedfuture.com/v2/fusion/files/?path=%2Fhome" threatq: enabled: false From 65c91a9804e9682c0e98aa882acddf32037b3fc5 Mon Sep 17 00:00:00 2001 From: Peter Dyson Date: Tue, 1 Feb 2022 21:08:50 +1000 Subject: [PATCH 07/20] minor typo in word (#30101) --- heartbeat/docs/monitors/monitor-browser.asciidoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/heartbeat/docs/monitors/monitor-browser.asciidoc b/heartbeat/docs/monitors/monitor-browser.asciidoc index 7c35bb7b6d71..478d152dc8fc 100644 --- a/heartbeat/docs/monitors/monitor-browser.asciidoc +++ b/heartbeat/docs/monitors/monitor-browser.asciidoc @@ -6,10 +6,10 @@ See the {observability-guide}/synthetics-quickstart.html[quick start guide]. beta[] The options described here configure {beatname_uc} to run the synthetic monitoring test suites via Synthetic Agent on the Chromium browser. -Additional shared options are defined in <>. +Additional shared options are defined in <>. Browser based monitors can only be run in our {beatname_uc} docker image, -or via the `elastic-agent-complete` docker image. +or via the `elastic-agent-complete` docker image. For more information, see {observability-guide}/synthetics-quickstart.html[Synthetic monitoring using Docker]. Example configuration: @@ -186,7 +186,7 @@ Defaults to false. Set this option to control the network throttling. By default, all journeys are run with 5Mbps download, 3Mbps upload and 20ms latency which emulates a standard -Cabel connection. +Cable connection. Users can control the throttling parameters, Below is an example of emulating a 3G connection with 1.6Mbps download, 750Kbps upload and 150ms round trip time. From 64dc77a7636f7036bf2d7cebb0f71285adf12275 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 1 Feb 2022 12:58:19 +0100 Subject: [PATCH 08/20] Copy `@timestamp` to make sure we always have a timestamp in the event (#30026) --- .../module/apache/access/ingest/pipeline.yml | 6 ++-- .../module/iis/access/ingest/pipeline.yml | 6 ++-- filebeat/module/iis/error/ingest/pipeline.yml | 6 ++-- filebeat/module/kafka/log/ingest/pipeline.yml | 6 ++-- .../module/kibana/audit/ingest/pipeline.yml | 6 ++-- .../module/kibana/log/ingest/pipeline.yml | 6 ++-- .../module/logstash/log/ingest/pipeline.yml | 6 ++-- .../logstash/slowlog/ingest/pipeline.yml | 6 ++-- .../module/mongodb/log/ingest/pipeline.yml | 6 ++-- .../module/mysql/error/ingest/pipeline.yml | 6 ++-- filebeat/module/nats/log/ingest/pipeline.yml | 6 ++-- .../module/nginx/access/ingest/pipeline.yml | 6 ++-- .../module/nginx/error/ingest/pipeline.yml | 6 ++-- .../osquery/result/ingest/pipeline.json | 6 ++-- filebeat/module/redis/log/ingest/pipeline.yml | 6 ++-- .../santa/log/test/santa.log-expected.json | 36 +++++++++---------- .../module/traefik/access/ingest/pipeline.yml | 6 ++-- .../zookeeper/audit/ingest/pipeline.yml | 6 ++-- .../module/zookeeper/log/ingest/pipeline.yml | 6 ++-- 19 files changed, 72 insertions(+), 72 deletions(-) diff --git a/filebeat/module/apache/access/ingest/pipeline.yml b/filebeat/module/apache/access/ingest/pipeline.yml index 37543d119e33..a6f44e2571a7 100644 --- a/filebeat/module/apache/access/ingest/pipeline.yml +++ b/filebeat/module/apache/access/ingest/pipeline.yml @@ -54,9 +54,9 @@ processors: ignore_missing: true patterns: - ^(%{IP:source.ip}|%{HOSTNAME:source.domain})$ -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: field: apache.access.time target_field: '@timestamp' diff --git a/filebeat/module/iis/access/ingest/pipeline.yml b/filebeat/module/iis/access/ingest/pipeline.yml index afbd20c78baf..ead99c82f673 100644 --- a/filebeat/module/iis/access/ingest/pipeline.yml +++ b/filebeat/module/iis/access/ingest/pipeline.yml @@ -63,9 +63,9 @@ processors: field: - _tmp ignore_missing: true -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: field: iis.access.time target_field: '@timestamp' diff --git a/filebeat/module/iis/error/ingest/pipeline.yml b/filebeat/module/iis/error/ingest/pipeline.yml index 6a09d937fed0..f8631d235306 100644 --- a/filebeat/module/iis/error/ingest/pipeline.yml +++ b/filebeat/module/iis/error/ingest/pipeline.yml @@ -31,9 +31,9 @@ processors: field: - _tmp ignore_missing: true -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: field: iis.error.time target_field: '@timestamp' diff --git a/filebeat/module/kafka/log/ingest/pipeline.yml b/filebeat/module/kafka/log/ingest/pipeline.yml index aa72addb6420..afd633af140e 100644 --- a/filebeat/module/kafka/log/ingest/pipeline.yml +++ b/filebeat/module/kafka/log/ingest/pipeline.yml @@ -31,9 +31,9 @@ processors: - remove: field: kafka.log.trace.full ignore_missing: true -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: if: ctx.event.timezone == null field: kafka.log.timestamp diff --git a/filebeat/module/kibana/audit/ingest/pipeline.yml b/filebeat/module/kibana/audit/ingest/pipeline.yml index d4d2d9b03b81..82d3baab1b55 100644 --- a/filebeat/module/kibana/audit/ingest/pipeline.yml +++ b/filebeat/module/kibana/audit/ingest/pipeline.yml @@ -3,9 +3,9 @@ processors: - set: field: event.ingested value: '{{_ingest.timestamp}}' -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - pipeline: name: '{< IngestPipeline "pipeline-json" >}' - set: diff --git a/filebeat/module/kibana/log/ingest/pipeline.yml b/filebeat/module/kibana/log/ingest/pipeline.yml index 8ba6808977a3..5ad24a1a60ea 100644 --- a/filebeat/module/kibana/log/ingest/pipeline.yml +++ b/filebeat/module/kibana/log/ingest/pipeline.yml @@ -7,9 +7,9 @@ processors: - set: field: event.ingested value: '{{_ingest.timestamp}}' -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - rename: field: json target_field: kibana.log.meta diff --git a/filebeat/module/logstash/log/ingest/pipeline.yml b/filebeat/module/logstash/log/ingest/pipeline.yml index e7dc228a76dc..3737600b6631 100644 --- a/filebeat/module/logstash/log/ingest/pipeline.yml +++ b/filebeat/module/logstash/log/ingest/pipeline.yml @@ -3,9 +3,9 @@ processors: - set: field: event.ingested value: '{{_ingest.timestamp}}' -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - grok: field: message patterns: diff --git a/filebeat/module/logstash/slowlog/ingest/pipeline.yml b/filebeat/module/logstash/slowlog/ingest/pipeline.yml index 949ffdcb91ef..bb6e139fe4dc 100644 --- a/filebeat/module/logstash/slowlog/ingest/pipeline.yml +++ b/filebeat/module/logstash/slowlog/ingest/pipeline.yml @@ -3,9 +3,9 @@ processors: - set: field: event.ingested value: '{{_ingest.timestamp}}' -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - grok: field: message patterns: diff --git a/filebeat/module/mongodb/log/ingest/pipeline.yml b/filebeat/module/mongodb/log/ingest/pipeline.yml index 4db78f7d73ef..a003b160002a 100644 --- a/filebeat/module/mongodb/log/ingest/pipeline.yml +++ b/filebeat/module/mongodb/log/ingest/pipeline.yml @@ -3,9 +3,9 @@ processors: - set: field: event.ingested value: '{{_ingest.timestamp}}' -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - grok: field: message patterns: diff --git a/filebeat/module/mysql/error/ingest/pipeline.yml b/filebeat/module/mysql/error/ingest/pipeline.yml index baf4c11aa402..ef3726e793d9 100644 --- a/filebeat/module/mysql/error/ingest/pipeline.yml +++ b/filebeat/module/mysql/error/ingest/pipeline.yml @@ -26,9 +26,9 @@ processors: GREEDYMULTILINE: |- (.| )+ -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: if: ctx._tmp?.local_timestamp != null && ctx.event?.timezone == null field: _tmp.local_timestamp diff --git a/filebeat/module/nats/log/ingest/pipeline.yml b/filebeat/module/nats/log/ingest/pipeline.yml index bece77c1b8ea..f64a70cd9785 100644 --- a/filebeat/module/nats/log/ingest/pipeline.yml +++ b/filebeat/module/nats/log/ingest/pipeline.yml @@ -154,9 +154,9 @@ processors: out: ->> outbound: outbound if: ctx.network?.direction != null -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: field: nats.log.timestamp target_field: '@timestamp' diff --git a/filebeat/module/nginx/access/ingest/pipeline.yml b/filebeat/module/nginx/access/ingest/pipeline.yml index 4a597e30d391..f81eeeaf7808 100644 --- a/filebeat/module/nginx/access/ingest/pipeline.yml +++ b/filebeat/module/nginx/access/ingest/pipeline.yml @@ -106,9 +106,9 @@ processors: patterns: - ^%{IP:source.ip}$ ignore_failure: true -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: field: nginx.access.time target_field: '@timestamp' diff --git a/filebeat/module/nginx/error/ingest/pipeline.yml b/filebeat/module/nginx/error/ingest/pipeline.yml index 51170f6cbbbf..d73879cfec65 100644 --- a/filebeat/module/nginx/error/ingest/pipeline.yml +++ b/filebeat/module/nginx/error/ingest/pipeline.yml @@ -16,9 +16,9 @@ processors: (.| | )* ignore_missing: true -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: if: ctx.event.timezone == null field: nginx.error.time diff --git a/filebeat/module/osquery/result/ingest/pipeline.json b/filebeat/module/osquery/result/ingest/pipeline.json index 2a0329133fa3..8ef3c72598f9 100644 --- a/filebeat/module/osquery/result/ingest/pipeline.json +++ b/filebeat/module/osquery/result/ingest/pipeline.json @@ -7,9 +7,9 @@ "value": "{{_ingest.timestamp}}" } }, { - "rename": { - "field": "@timestamp", - "target_field": "event.created" + "set": { + "copy_from": "@timestamp", + "field": "event.created" } }, { "date": { diff --git a/filebeat/module/redis/log/ingest/pipeline.yml b/filebeat/module/redis/log/ingest/pipeline.yml index 472c3398e36f..b1ecc74c0cf4 100644 --- a/filebeat/module/redis/log/ingest/pipeline.yml +++ b/filebeat/module/redis/log/ingest/pipeline.yml @@ -57,9 +57,9 @@ processors: child: child sentinel_abbrev: X sentinel: sentinel -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: field: redis.log.timestamp target_field: '@timestamp' diff --git a/filebeat/module/santa/log/test/santa.log-expected.json b/filebeat/module/santa/log/test/santa.log-expected.json index 3f8eb24bd96a..2fb72d95b03d 100644 --- a/filebeat/module/santa/log/test/santa.log-expected.json +++ b/filebeat/module/santa/log/test/santa.log-expected.json @@ -69,8 +69,8 @@ "log.offset": 360, "process.args": [ "/usr/libexec/xpcproxy", - "com.apple.systemstats.daily", - "xpcproxy" + "xpcproxy", + "com.apple.systemstats.daily" ], "process.executable": "/usr/libexec/xpcproxy", "process.hash.sha256": "c4bc09fd2f248534552f517acf3edb9a635aba2b02e46f49df683ea9b778e5b4", @@ -163,9 +163,9 @@ "log.level": "I", "log.offset": 1095, "process.args": [ - "--daily", "/usr/sbin/systemstats", - "/usr/sbin/systemstats" + "/usr/sbin/systemstats", + "--daily" ], "process.executable": "/usr/sbin/systemstats", "process.hash.sha256": "d6be9bfbd777ac5dcd30488014acc787a2df5ce840f1fe4d5742d323ee00392f", @@ -259,8 +259,8 @@ "log.offset": 1825, "process.args": [ "/usr/libexec/xpcproxy", - "com.adobe.AAM.Scheduler-1.0", - "xpcproxy" + "xpcproxy", + "com.adobe.AAM.Scheduler-1.0" ], "process.executable": "/usr/libexec/xpcproxy", "process.hash.sha256": "c4bc09fd2f248534552f517acf3edb9a635aba2b02e46f49df683ea9b778e5b4", @@ -305,10 +305,10 @@ "log.level": "I", "log.offset": 2202, "process.args": [ - "--flagfile=/private/var/osquery/osquery.flags", - "--logger_min_stderr=1", "/usr/local/Cellar/osquery/3.3.0_1/bin/osqueryd", - "/usr/local/bin/osqueryd" + "/usr/local/bin/osqueryd", + "--flagfile=/private/var/osquery/osquery.flags", + "--logger_min_stderr=1" ], "process.executable": "/usr/local/Cellar/osquery/3.3.0_1/bin/osqueryd", "process.hash.sha256": "08bd61582657cd6d78c9e071d34d79a32bb59e7210077a44919d2c5477e988a1", @@ -397,19 +397,19 @@ "log.level": "I", "log.offset": 2899, "process.args": [ - "--field-trial-handle=120122713615061869,9401617251746517350,131072", - "--lang=en-US", - "--seatbelt-client=262", - "--service-request-channel-token=10458143409865682077", - "--service-sandbox-type=utility", - "--type=utility", - "/Applications/Google", "/Applications/Google Chrome.app/Contents/Versions/70.0.3538.110/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper", + "/Applications/Google", + "Chrome.app/Contents/Versions/70.0.3538.110/Google", "Chrome", + "Helper.app/Contents/MacOS/Google", "Chrome", - "Chrome.app/Contents/Versions/70.0.3538.110/Google", "Helper", - "Helper.app/Contents/MacOS/Google" + "--type=utility", + "--field-trial-handle=120122713615061869,9401617251746517350,131072", + "--lang=en-US", + "--service-sandbox-type=utility", + "--service-request-channel-token=10458143409865682077", + "--seatbelt-client=262" ], "process.executable": "/Applications/Google Chrome.app/Contents/Versions/70.0.3538.110/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper", "process.hash.sha256": "a8defc1b24c45f6dabeb8298af5f8e1daf39e1504e16f878345f15ac94ae96d7", diff --git a/filebeat/module/traefik/access/ingest/pipeline.yml b/filebeat/module/traefik/access/ingest/pipeline.yml index 3b63a05fe8d1..d74b13a58bcd 100644 --- a/filebeat/module/traefik/access/ingest/pipeline.yml +++ b/filebeat/module/traefik/access/ingest/pipeline.yml @@ -23,9 +23,9 @@ processors: - uri_parts: field: temp.url_orig ignore_failure: true -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: field: traefik.access.time target_field: '@timestamp' diff --git a/x-pack/filebeat/module/zookeeper/audit/ingest/pipeline.yml b/x-pack/filebeat/module/zookeeper/audit/ingest/pipeline.yml index 49a619453696..55f960a143ad 100644 --- a/x-pack/filebeat/module/zookeeper/audit/ingest/pipeline.yml +++ b/x-pack/filebeat/module/zookeeper/audit/ingest/pipeline.yml @@ -13,9 +13,9 @@ processors: - '%{TIMESTAMP_ISO8601:zookeeper.audit.timestamp}%{SPACE}%{LOGLEVEL:log.level}%{SPACE}%{CALLER_CLASS:log.logger}:%{SPACE}%{GREEDYDATA:message}' pattern_definitions: CALLER_CLASS: (%{JAVACLASS}|%{NOTSPACE}) -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created if: ctx?.zookeeper?.audit?.timestamp != null - date: if: ctx?.zookeeper?.audit?.timestamp != null && ctx.event.timezone == null diff --git a/x-pack/filebeat/module/zookeeper/log/ingest/pipeline.yml b/x-pack/filebeat/module/zookeeper/log/ingest/pipeline.yml index 96c90bf80070..9f41a66d8408 100644 --- a/x-pack/filebeat/module/zookeeper/log/ingest/pipeline.yml +++ b/x-pack/filebeat/module/zookeeper/log/ingest/pipeline.yml @@ -22,9 +22,9 @@ processors: - remove: field: zookeeper.log.process ignore_missing: true -- rename: - field: '@timestamp' - target_field: event.created +- set: + copy_from: '@timestamp' + field: event.created - date: if: ctx.event.timezone == null field: zookeeper.log.timestamp From d4bd46b5d1f567dbcdd2932c7931dc23bb42ecc6 Mon Sep 17 00:00:00 2001 From: Dan Kortschak <90160302+efd6@users.noreply.github.com> Date: Tue, 1 Feb 2022 23:52:01 +1030 Subject: [PATCH 09/20] packetbeat/protos/tls: capture tls random data and ocsp status (#30102) --- CHANGELOG.next.asciidoc | 1 + packetbeat/docs/fields.asciidoc | 78 +++ packetbeat/protos/tls/_meta/fields.yml | 39 ++ packetbeat/protos/tls/extensions.go | 22 +- packetbeat/protos/tls/fields.go | 2 +- packetbeat/protos/tls/ja3.go | 2 + packetbeat/protos/tls/parse.go | 71 ++- packetbeat/protos/tls/parse_test.go | 139 ++++++ packetbeat/protos/tls/tls.go | 3 + packetbeat/protos/tls/tls_test.go | 222 ++++++++- .../golden/established_tls-expected.json | 438 ++++++++--------- .../golden/non_established_tls-expected.json | 5 +- .../tests/system/golden/tls_1_3-expected.json | 6 +- .../golden/tls_all_options-expected.json | 452 +++++++++--------- .../system/golden/tls_no_certs-expected.json | 2 + 15 files changed, 1024 insertions(+), 458 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 8bf04636d81b..b0a6d02bb0a4 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -206,6 +206,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Packetbeat* - Add automated OEM Npcap installation handling. {pull}29112[29112] +- Add support for capturing TLS random number and OCSP status request details. {issue}29962[29962] {pull}30102[30102] *Functionbeat* diff --git a/packetbeat/docs/fields.asciidoc b/packetbeat/docs/fields.asciidoc index 6a7f7c7b7702..619c6407382f 100644 --- a/packetbeat/docs/fields.asciidoc +++ b/packetbeat/docs/fields.asciidoc @@ -19402,6 +19402,16 @@ type: boolean -- +*`tls.detailed.ocsp_response`*:: ++ +-- +The result of an OCSP request. + + +type: keyword + +-- + *`tls.detailed.client_hello.version`*:: + @@ -19409,6 +19419,16 @@ type: boolean The version of the TLS protocol by which the client wishes to communicate during this session. +type: keyword + +-- + +*`tls.detailed.client_hello.random`*:: ++ +-- +Random data used by the TLS protocol to generate the encryption key. + + type: keyword -- @@ -19508,6 +19528,39 @@ type: keyword -- +[float] +=== status_request + +Status request made to the server. + + +*`tls.detailed.client_hello.extensions.status_request.type`*:: ++ +-- +The type of the status request. Always "ocsp" if present. + +type: keyword + +-- + +*`tls.detailed.client_hello.extensions.status_request.responder_id_list_length`*:: ++ +-- +The length of the list of trusted responders. + +type: short + +-- + +*`tls.detailed.client_hello.extensions.status_request.request_extensions`*:: ++ +-- +The number of certificate extensions for the request. + +type: short + +-- + *`tls.detailed.client_hello.extensions._unparsed_`*:: + -- @@ -19525,6 +19578,16 @@ type: keyword The version of the TLS protocol that is used for this session. It is the highest version supported by the server not exceeding the version requested in the client hello. +type: keyword + +-- + +*`tls.detailed.server_hello.random`*:: ++ +-- +Random data used by the TLS protocol to generate the encryption key. + + type: keyword -- @@ -19594,6 +19657,21 @@ type: keyword -- +[float] +=== status_request + +Status request made to the server. + + +*`tls.detailed.server_hello.extensions.status_request.response`*:: ++ +-- +Whether a certificate status request response was made. + +type: boolean + +-- + *`tls.detailed.server_hello.extensions._unparsed_`*:: + -- diff --git a/packetbeat/protos/tls/_meta/fields.yml b/packetbeat/protos/tls/_meta/fields.yml index a7d414980949..3e4567fb69a7 100644 --- a/packetbeat/protos/tls/_meta/fields.yml +++ b/packetbeat/protos/tls/_meta/fields.yml @@ -70,6 +70,11 @@ Whether the server has requested the client to authenticate itself using a client certificate. + - name: ocsp_response + type: keyword + description: > + The result of an OCSP request. + - name: client_hello type: group fields: @@ -79,6 +84,11 @@ The version of the TLS protocol by which the client wishes to communicate during this session. + - name: random + type: keyword + description: > + Random data used by the TLS protocol to generate the encryption key. + - name: session_id type: keyword description: > @@ -133,6 +143,22 @@ List of Elliptic Curve (EC) point formats. Indicates the set of point formats that the client can parse. + - name: status_request + type: group + description: Status request made to the server. + fields: + - name: type + type: keyword + description: The type of the status request. Always "ocsp" if present. + + - name: responder_id_list_length + type: short + description: The length of the list of trusted responders. + + - name: request_extensions + type: short + description: The number of certificate extensions for the request. + - name: _unparsed_ type: keyword description: > @@ -148,6 +174,11 @@ It is the highest version supported by the server not exceeding the version requested in the client hello. + - name: random + type: keyword + description: > + Random data used by the TLS protocol to generate the encryption key. + - name: selected_compression_method type: keyword description: > @@ -185,6 +216,14 @@ List of Elliptic Curve (EC) point formats. Indicates the set of point formats that the server can parse. + - name: status_request + type: group + description: Status request made to the server. + fields: + - name: response + type: boolean + description: Whether a certificate status request response was made. + - name: _unparsed_ type: keyword description: > diff --git a/packetbeat/protos/tls/extensions.go b/packetbeat/protos/tls/extensions.go index 1ffceb3c2350..1d6ab71e0dc7 100644 --- a/packetbeat/protos/tls/extensions.go +++ b/packetbeat/protos/tls/extensions.go @@ -57,7 +57,7 @@ var extensionMap = map[uint16]extension{ 2: {"client_certificate_url", expectEmpty, false}, 3: {"trusted_ca_keys", ignoreContent, false}, 4: {"truncated_hmac", expectEmpty, false}, - 5: {"status_request", ignoreContent, false}, + 5: {"status_request", parseStatusReq, false}, 6: {"user_mapping", ignoreContent, false}, 7: {"client_authz", ignoreContent, false}, 8: {"server_authz", ignoreContent, false}, @@ -165,6 +165,26 @@ func ignoreContent(_ bufferView) interface{} { return nil } +func parseStatusReq(buffer bufferView) interface{} { + if buffer.length() == 0 { + // Initial server response. + return common.MapStr{"response": true} + } + // Client query. + var ( + code uint8 + list, exts uint16 + ) + if !buffer.read8(0, &code) || !buffer.read16Net(1, &list) || !buffer.read16Net(1, &exts) { + return nil + } + typ := "ocsp" + if code != 1 { + typ = fmt.Sprint(code) + } + return common.MapStr{"type": typ, "responder_id_list_length": list, "request_extensions": exts} +} + func expectEmpty(buffer bufferView) interface{} { if buffer.length() != 0 { return fmt.Sprintf("(expected empty: found %d bytes)", buffer.length()) diff --git a/packetbeat/protos/tls/fields.go b/packetbeat/protos/tls/fields.go index ced22c3122b7..7a91cec9b783 100644 --- a/packetbeat/protos/tls/fields.go +++ b/packetbeat/protos/tls/fields.go @@ -32,5 +32,5 @@ func init() { // AssetTls returns asset data. // This is the base64 encoded zlib format compressed contents of protos/tls. func AssetTls() string { - return "eJzsWM2O2zYQvvspBulhEyD2NghaoD4UCJw9LBC0AZK0R4EWxxIbilTIkb16+2JISSvrx7vpbpygiU6WRc588/fNkEv4iPUaSPtEIgmlUS4ASJHGNVy8bv6C92/eXSwAJPrUqZKUNWv4fQEA0F+y9CWmaqdSwD0agp1CLf1qAc2vddixBCMKDDrDOwDVJa4hc7Yqm3/66/n5CTIkcEqC3QHlysMhRwMHhKrMnJAIZOFq8w5erH7tNrWKUq3QUPf3lL4pnX0RN7/8/NvRhzkh/EjciUpT0giEndAeB2umlPUV7tF5Zc3oe6v3I9YH6+TE96MY/RXFsNfYBNhZVwhaTWzDG1GUHPSXi1lQyvsK3ap0dq9MOjTps8G9beSAdeAwY5wHRbkykNrKkKtX81B8tf0HU/oqWB6UjB7dHt2PZPyRjI+DpcXQY+9jncOkuCshTmXedCKcsm2iY/Sf9zm2QmMxIfcRKJ0lm1oNlUc5TJAuOS546YvVy4vFJFiHviqC5qRAyu0Q2gNgX0eoHn1AngsPW0QTVaJ8Hr5WRqLTtTIZRP3RGvjTINjdSOYTJZ9wSQQHtJKvX3MOPCGVfkS6/RzfAW8IDa9bTXsgNr4kRUfclQVh4vBThZ5w2hlbazWKYXzvcMbfOVKOrvEIs1twSKcpfIhQmBhFRTkaCnBAkUc99kXl2Wui3dUz4LSlOWpt702NZ6K9scfgHpm/reGQqzTve++gfI4eaGhifFJbFJWJfpWVYw+G5tTk0in+iisSNWXLI9j6wahPFYKpii3niQUlOQN29VEVcXIHY61z6EtrpDLZjKXGYEotL/ZcdJKky9I6QpmktihdY3KsTP/lYqyVJw5wT2lDB74f2gadn+qGAO8QIScq/fry8nA4rJQwYmVddim8V5kp0JC/ZA1LFr1UcvC2usmp0PO+6Yhk3hFTBTRyAxscarAnEUJXlCg5pfuRGsuaK0gYzU8JvyTKSE736RqFe8RwZMCbJlq59cQq/NhnfTCiLHWDINGiRpe09ZsYzCypRwU3nWT8tLB7eJYBT8cnR8nGE6vSOjCE5a40UTYwwQ+x7ZzBHDQZ5S0ttvwQtT8HtetS6jl3R2EAi5Jq8OTmGCMAtCDknluJx7beIukEwf4uJ3T80dD2VK08tiOauHJnaLUC5YIeFM3OkFDTZzTjSmtenMKmcnuEjatLspkTZV7D06vN5hmk4cNJXHBrwJBRTputMiOocpgInVmnKC/OaHqnHW61x0gWooYtctxAGZAqUyT0vO2tnLvSFdOktMqQT+Ix6+uF+enV5hkELM2Jz6/gOjI3BlqaNxaDvKO9o/RPhYFSuDvTPqlMWCaT83mi1wUD7AM6BI07ghYMp/BbwfyzRTFM4UHP+x9Nt8EbyocTUTP49SfVKZHXYQNLylWWo6dOwYgPmlOIsXxEShFnB0nqwbw9ryjTz6/g9ZPDs8Z0eqz8cr4dT5MdjoETds4W4Z0H0Ul53Xz2uXZ/B4eGsw7GMWL/dTA+7yz6RyMSZV8xHA+d39ZU+YG5hodAY2xlUowkJAbzZZiluCG30ZmVdxw1eKUPovbDafQbHCp7oevNleyZOIbI736yaKjz+5ks+jeEaS7U9A2vcE7Up+4GN7w19HtXeeq4uXXnfW/xviyae98pCo2OElY2zPAH3By/MhE4tyMSysRbujgdBYVBeACLe3R186fDFNWeS/PfAAAA//+9jOoY" + return "eJzsWc1u20YQvuspBu7BCRDLDYIWqA8FAsUHA0ET1El7JFbkiNxmucvsDiXz7YvZJSn+Sg7sKIETniSRnPnm75sZ7QV8wuoKSLkoQRJSYbIAIEkKr+D8Tf0TfHh7e74ASNDFVhYkjb6CPxcAAN1HLlyBsdzIGHCLmmAjUSVuuYD605V/4wK0yNHr9N8BqCrwClJryqL+pfs8X79AigRWJmA2QJl0sMtQww6hLFIrEgQycL26hZfL39uXGkWxkqip/XlK35TOroi73379o3djTghfCW5EqSiqBcJGKIeDZ6aUdRVu0Tpp9Oh+o/cTVjtjk4n7vRj9E8Sw19gE2BibC1pOvIZ3Ii846K8Ws6CkcyXaZWHNVup4aNIXg3tfywFjwWLKOHeSMqkhNqUmWy3nobhy/R/G9E2wPCgZHdot2p/J+DMZHwdLg6HD3n2dw6Q4lhCHMm86EQ7ZNtExuteHDBuhoZiQ+wgU1pCJjYLSYTJMkDY5zvnRl8tX54tJsBZdmXvNUY6UmSG0B8C+CVAdOo88Ew7WiDqoxOSFv1vqBK2qpE4h6A/WwDuNYDYjmWcyOeOS8A5oJN+84Rw4Ixl/QtrfDt8B7wg1P7ec9kBofFGMlrgrC8LI4ucSHeG0M9bGKBTD+B5xxr8ZUoa29gizm3dIq8nfCFCYGEVJGWrycECSQzX2RenYa6J5q2PAjKUmdkVk0RVGj9jtgenJMVXE2Sk0vFvdvm8sO+z0DJUy92bpEzHw2EK4RxGuK9hlMs66gdxJl6EDGpoYrtjkealDiJPScjB9n6zT+gCVWqETk38dO//2siERJHwpsmEjY8lAihotQ+ebqGNbebGs/FATCLZFcgrdI6D/qOXnEkGX+ZqLzYBMuIw2VY+KmCF8mIwN5ZBInc7ESGuMqWkuneAe7HRFYSxhEsUmL2xtcqA39/WyU0nnK7CjtOZU103KGp2bGikAbhEhIyrc1eXlbrdbSqHF0tj0UjgnU52jJnfJGi5Y9IVMBt+Wdxnlat43LRvPO2Kq9EduYIM9e3Qkgh8tkn3ONpEay5qjEhgNoRF/iaROuFCn2QXuEcORAW/raGXGEatwY591wYiiUDWCSIkKbdQUY6QxNSQfFdx0kvHVwO7gufB4WnLoJRuP/VIpz22G+WSibGCCH0LvPoE5qFPKGkJv+CFofwFy06bUCx4xhAbMC6rAkZ1jDA/QgEi23I8dNvUWSMcLdsec0PJH3XCmauWxHVHHlWm+0QqUCXpQNFtDfE2f0IxrpfjhGFal3SKsuDuZ1Ioiq+DZ9Wr1HGJ/4yAu2BswZJTDZstUCyotRkKlxkrK8hOa3mqHvfYQyVxUsEaOG0gNiUwlCTVveyPnWLpiHBVGanJR2FW/XZifXa+eg8dSr81uCTeBudHT0ryx6OX13h2lfyw0FMIeT3sSVLpmizjojbleN/LFrZfZTNWQ13+g7NeJ6XZ+uNN1QTOe2YfuF7wRaG7S/GLLrz0jlvBa7UTl4IwXk7PAtujm6wv6eyvPbWgjmUQ8+UTKU/lRE1xm7FxMJg1QvRbRDFlkS7+2tTjmqqQP2hseHRyCHgi3Hn15DtwvhN0hqRl+pxe0IeSo1D7lk+h0Vd0B60twh5bDsCFowDAdvxfcS9co5nbMen57Qjum94Z0YS8Lcezui1Mib/wLLCmTacbU0SgY9bb6bwltCPAuRpxdiqgDc/8HhtRdrvRef6IrrMJ4ern7elkx3ulaHIPwbazJW6aalNduSV8WsR9idT/pejrfuO+znp52I/yrFolJVzH0V7/va7f7yKXPq5jWptQxBvoUgy3PbzQ8FjfRmZXXj1ozvAx2wu9wteuErrPdsWfCMpD88PN9TZ1Per6f+d9/DHn6eGMWeHOwIXrzZn/Sb5XDTjhv25OfOrvHSXEm5PRxoLBWVIsDsFf8artvtN2vSdijRz4Th1uPj+beB1BCoaWIlQ055AHHT691AM4Nn4TU4RwlTHteYVhBGSxu0Vb1jxZjlFsmv/8DAAD//6l0gvo=" } diff --git a/packetbeat/protos/tls/ja3.go b/packetbeat/protos/tls/ja3.go index 09a0aec5ea48..2e9e57326f32 100644 --- a/packetbeat/protos/tls/ja3.go +++ b/packetbeat/protos/tls/ja3.go @@ -24,6 +24,7 @@ import ( "strings" ) +// See https://engineering.salesforce.com/open-sourcing-ja3-92c9e53c3c41. func getJa3Fingerprint(hello *helloMessage) (hash string, ja3str string) { // build the array of arrays of numbers @@ -93,6 +94,7 @@ func extractJa3Array(raw []byte, size int) []uint16 { return array } +// See https://tools.ietf.org/id/draft-ietf-tls-grease-01.html#rfc.section.2 func isGreaseValue(num uint16) bool { hi, lo := byte(num>>8), byte(num) return hi == lo && lo&0xf == 0xa diff --git a/packetbeat/protos/tls/parse.go b/packetbeat/protos/tls/parse.go index fa4515e2248f..c241d58f9071 100644 --- a/packetbeat/protos/tls/parse.go +++ b/packetbeat/protos/tls/parse.go @@ -63,12 +63,13 @@ type handshakeType uint8 const ( helloRequest handshakeType = 0 - clientHello = 1 - serverHello = 2 - certificate = 11 - serverKeyExchange = 12 - certificateRequest = 13 - clientKeyExchange = 16 + clientHello handshakeType = 1 + serverHello handshakeType = 2 + certificate handshakeType = 11 + serverKeyExchange handshakeType = 12 + certificateRequest handshakeType = 13 + clientKeyExchange handshakeType = 16 + certificateStatus handshakeType = 22 ) type parserResult int8 @@ -99,10 +100,36 @@ type parser struct { // for a certificate certRequested bool + // ocspResponse is the top level OCSP response status. + ocspResponse ocspResponseStatus + ocspResponseIsValid bool + // If a key-exchange message has been sent. Used to detect session resumption keyExchanged bool } +// https://www.rfc-editor.org/rfc/rfc6960#section-4.2.1 +type ocspResponseStatus byte + +func (s ocspResponseStatus) String() string { + switch s { + case 0: // Response has valid confirmations + return "successful" + case 1: // Illegal confirmation request + return "malformedRequest" + case 2: // Internal error in issuer + return "internalError" + case 3: // Try again later + return "tryLater" + case 5: // Must sign the request + return "sigRequired" + case 6: // Request unauthorized + return "unauthorized" + default: + return fmt.Sprint(byte(s)) + } +} + type tlsVersion struct { major, minor uint8 } @@ -120,6 +147,7 @@ type handshakeHeader struct { type helloMessage struct { version tlsVersion + random []byte timestamp uint32 sessionID string ticket tlsTicket @@ -191,6 +219,9 @@ func (hello *helloMessage) toMap() common.MapStr { if len(hello.sessionID) != 0 { m["session_id"] = hello.sessionID } + if len(hello.random) != 0 { + m["random"] = hex.EncodeToString(hello.random) + } if len(hello.supported.compression) > 0 { comp := make([]string, len(hello.supported.compression)) @@ -361,6 +392,9 @@ func (parser *parser) parseHandshake(handshakeType handshakeType, buffer bufferV case serverKeyExchange: parser.setDirection(dirServer) parser.keyExchanged = true + + case certificateStatus: + parser.ocspResponse, parser.ocspResponseIsValid = parseOCSPStatus(buffer) } return true } @@ -394,12 +428,14 @@ func parseCommonHello(buffer bufferView, dest *helloMessage) (int, bool) { return 0, false } - if bytes := buffer.readBytes(7+randomDataLength, int(sessionIDLength)); len(bytes) == int(sessionIDLength) { - dest.sessionID = hex.EncodeToString(bytes) - } else { + bytes := buffer.readBytes(7+randomDataLength, int(sessionIDLength)) + if len(bytes) != int(sessionIDLength) { logp.Warn("Not a TLS hello (failed reading session ID)") return 0, false } + dest.sessionID = hex.EncodeToString(bytes) + dest.random = buffer.readBytes(2, 4+randomDataLength) + return helloHeaderLength + randomDataLength + int(sessionIDLength), true } @@ -503,6 +539,23 @@ func parseCertificates(buffer bufferView) (certs []*x509.Certificate) { return certs } +func parseOCSPStatus(buffer bufferView) (status ocspResponseStatus, ok bool) { + const ( + statusTypeLen = 1 + respLengthLen = 3 + ocspRespHeaderLen = 6 + + ocspStatusType = 1 + ) + var b byte + ok = buffer.read8(0, &b) + if !ok || b != ocspStatusType { + return 0, false + } + ok = buffer.read8(statusTypeLen+respLengthLen+ocspRespHeaderLen, &b) + return ocspResponseStatus(b), ok +} + func (version tlsVersion) String() string { if version.major == 3 { if version.minor > 0 { diff --git a/packetbeat/protos/tls/parse_test.go b/packetbeat/protos/tls/parse_test.go index f599b30c44c9..00d3c0d27dac 100644 --- a/packetbeat/protos/tls/parse_test.go +++ b/packetbeat/protos/tls/parse_test.go @@ -27,6 +27,7 @@ import ( "testing" "time" + "github.com/google/go-cmp/cmp" "github.com/stretchr/testify/assert" "github.com/elastic/beats/v7/libbeat/common" @@ -364,6 +365,144 @@ func TestCertificates(t *testing.T) { } } +func TestRandom(t *testing.T) { + parser := &parser{} + + for i, test := range []struct { + msg string + want common.MapStr + }{ + { + msg: "16030100ba010000b603032338f219562c78ca216984f33434bfe952354edf50" + + "7588bddb96b35bd1a7639b000026c030c02cc028c024c014c00ac02fc02bc027" + + "c023c013c009c012c008c011c007c010c00600ff010000670000001700150000" + + "12746573742e6974762e6f72616e67652e6672000b000403000102000a000a00" + + "08001700190018001600230000000d0020001e06010602060305010502050304" + + "0104020403030103020303020102020203000500050100000000000f000101", + want: common.MapStr{ + "extensions": common.MapStr{ + "_unparsed_": []string{ + "15", + }, + "ec_points_formats": []string{ + "uncompressed", + "ansiX962_compressed_prime", + "ansiX962_compressed_char2", + }, + "server_name_indication": []string{ + "test.itv.orange.fr", + }, + "session_ticket": "", + "signature_algorithms": []string{ + "rsa_pkcs1_sha512", + "(unknown:0x0602)", + "ecdsa_secp521r1_sha512", + "rsa_pkcs1_sha384", + "(unknown:0x0502)", + "ecdsa_secp384r1_sha384", + "rsa_pkcs1_sha256", + "(unknown:0x0402)", + "ecdsa_secp256r1_sha256", + "(unknown:0x0301)", + "(unknown:0x0302)", + "(unknown:0x0303)", + "rsa_pkcs1_sha1", + "(unknown:0x0202)", + "ecdsa_sha1", + }, + "status_request": common.MapStr{ + "type": "ocsp", + "responder_id_list_length": uint16(0), + "request_extensions": uint16(0), + }, + "supported_groups": []string{ + "secp256r1", + "secp521r1", + "secp384r1", + "secp256k1", + }, + }, + "random": "2338f219562c78ca216984f33434bfe952354edf507588bddb96b35bd1a7639b", + "supported_compression_methods": []string{ + "NULL", + }, + "version": "3.3", + }, + }, + { + msg: "160303005b0200005703032c468bdbb2af2e7bd8e09c90e7992c61a8f468a03b" + + "be74ec311fa33a14a35bfd20fc2b8e95f18fa299253278dd98178a61f75cdddd" + + "69f8f1d1e0592e0ce8275af1c02b00000fff0100010000050000000b00020100" + + "16030311400b00113c0011390005433082053f30820327a0030201020214213e" + + "825a875eb349390d11117c6c14f894135fe3300d06092a864886f70d01010b05" + + "003060310b3009060355040613024652310f300d060355040a0c064f72616e67" + + "6531193017060355040b0c10464f52204c414220555345204f4e4c5931253023" + + "06035504030c1c4f72616e6765204465766963657320504b49205456204c4142" + + "204341301e170d3231303630333133333831365a170d32323036303331333338" + + "31365a3040310b3009060355040613024652310f300d060355040b0c064f7261" + + "6e67653120301e06035504030c1773657276657232207465737420504b492054" + + "56204c41423059301306072a8648ce3d020106082a8648ce3d03010703420004" + + "fc7a2bae61a536e74d4d3138b83e09ef618de444fff8dc8874863e3e1f557f90" + + "08e2f777693ba6d7b8fe59f360006d55561e24edfc0608436b0bbf329df1463c" + + "a38201da308201d6301d0603551d0e04160414dfd5c4bdbea6b4c89a57fd4a83" + + "5573d53f51cbff301f0603551d230418301680143ae35027fb6f7337d4eaa8c8" + + "2139f9627d116bf4300e0603551d0f0101ff0404030205a030130603551d2504" + + "0c300a06082b06010505070301305c0603551d1f045530533051a04fa04d864b" + + "687474703a2f2f706b692d63726c2d6c622e73656375726974792e696e747261" + + "6f72616e67652f63726c2f6f72616e67655f646576696365735f706b695f7476" + + "5f6c61625f63612e63726c3082010f0603551d11048201063082010282102a2e" + + "656e61312e6f72616e67652e6672820f2a2e6974762e6f72616e67652e667282" + + "192a2e6a6575787476697074762d70702e6f72616e67652e667282162a2e6a65" + + "75787476697074762e6f72616e67652e667282102a2e6e7476312e6f72616e67" + + "652e667282102a2e6e7476332e6f72616e67652e667282102a2e6e7476342e6f" + + "72616e67652e667282102a2e6e7476352e6f72616e67652e6672820f2a2e7067" + + "772e6f72616e67652e667282132a2e70702d656e61312e6f72616e67652e6672" + + "82122a2e70702d6974762e6f72616e67652e667282132a2e70702d6e7476312e" + + "6f72616e67652e667282132a2e70702d6e7476322e6f72616e67652e6672300d" + + "06092a864886f70d01010b05000382020100b8d7a4819a31204d58fd9ca0364c" + + "544f845b4c9e48dde8aadecad7149256e209df85b8b76f86ec62382932f9b037" + + "0ef9d257d5112ae3b72bf8d0809fd437a20419a46f82851701f32e0897a659cf" + + "5e19079615cb62205f2abf37a24d51ca9ca954d5b5c4485bbb9441109f71a3e6" + + "b5fccccfe1e19d97d8403a60615bf1e4ef20c5bb069a2d26e78c5ad18a431934" + + "276b9556153a0b7f3c992684a202ea8403c1f59b362389111e5fcb0fa89e40b8" + + "6300be3949f0e5690abc3314ee7b53f0adb9019ea8e804e48a197f9d77b3c2fb" + + "37dbe732a8aed100fb8624fecece4119e1ea045cdc7156765a89aa3d1228f062" + + "eb5f109ac25afc63fa8948be9087eeb6c8ebe807b944230cba453aec493054c4" + + "df4d5c34fc21d8739a6d40ddc36c95861f207b4dfcdd97224473a57841202378" + + "31b86f398f62205945a7befca9f60c2c63578b2e9870723b4c5933c70317edb1" + + "071d38ccdd2f91c3c50dc90906ccf14ecbb9b394cd471f33a92d6f210b994b7c" + + "085abdc1dd789a46eac33503725f25376a5b438cf8d6dbb2b07ee128f3be21d5" + + "0bdfb052271d079f4ccae174509a31ac1dfe2a483dce8eb624c181c616a49741" + + "4f6616c21b8fd24e08aadd2c9c43944df5088e2bdbf121649ca1e405e1e95695" + + "d52afa1c265b123344a9f5594b661e7d3406b0f6d60c7f776a9723bcec995f4b" + + "4da3e6d42dc446b6a33904b7a56f74ba53010006", + want: common.MapStr{ + "extensions": common.MapStr{ + "_unparsed_": []string{ + "renegotiation_info", + }, + "ec_points_formats": []string{ + "uncompressed", + }, + "status_request": common.MapStr{ + "response": true, + }, + }, + "random": "2c468bdbb2af2e7bd8e09c90e7992c61a8f468a03bbe74ec311fa33a14a35bfd", + "selected_compression_method": "NULL", + "session_id": "fc2b8e95f18fa299253278dd98178a61f75cdddd69f8f1d1e0592e0ce8275af1", + "version": "3.3", + }, + }, + } { + parser.parse(sBuf(t, test.msg)) + got := parser.hello.toMap() + if !cmp.Equal(got, test.want) { + t.Errorf("unexpected result for msg %d: %s", i, cmp.Diff(got, test.want)) + } + } +} + func TestBadCertMessage(t *testing.T) { parser := &parser{} diff --git a/packetbeat/protos/tls/tls.go b/packetbeat/protos/tls/tls.go index a785d101021f..03e464126c3a 100644 --- a/packetbeat/protos/tls/tls.go +++ b/packetbeat/protos/tls/tls.go @@ -295,6 +295,9 @@ func (plugin *tlsPlugin) createEvent(conn *tlsConnectionData) beat.Event { } else { serverHello = emptyHello } + if server.parser.ocspResponseIsValid { + detailed["ocsp_response"] = server.parser.ocspResponse.String() + } if plugin.sendCertificates { if cert, chain := plugin.getCerts(client.parser.certificates); cert != nil { detailed["client_certificate"] = cert diff --git a/packetbeat/protos/tls/tls_test.go b/packetbeat/protos/tls/tls_test.go index 5ad963860f8a..b36534289d6b 100644 --- a/packetbeat/protos/tls/tls_test.go +++ b/packetbeat/protos/tls/tls_test.go @@ -25,7 +25,9 @@ import ( "encoding/json" "net" "testing" + "time" + "github.com/google/go-cmp/cmp" "github.com/stretchr/testify/assert" "github.com/elastic/beats/v7/libbeat/beat" @@ -41,8 +43,8 @@ type eventStore struct { } const ( - expectedClientHello = `{"client":{"ip":"192.168.0.1","port":6512},"destination":{"domain":"example.org","ip":"192.168.0.2","port":27017},"event":{"category":["network"],"dataset":"tls","kind":"event","type":["connection","protocol"]},"network":{"community_id":"1:jKfewJN/czjTuEpVvsKdYXXiMzs=","direction":"unknown","protocol":"tls","transport":"tcp","type":"ipv4"},"related":{"ip":["192.168.0.1","192.168.0.2"]},"server":{"domain":"example.org","ip":"192.168.0.2","port":27017},"source":{"ip":"192.168.0.1","port":6512},"status":"Error","tls":{"client":{"ja3":"94c485bca29d5392be53f2b8cf7f4304","server_name":"example.org","supported_ciphers":["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_AES_128_GCM_SHA256","TLS_RSA_WITH_AES_256_GCM_SHA384","TLS_RSA_WITH_AES_128_CBC_SHA","TLS_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_3DES_EDE_CBC_SHA"]},"detailed":{"client_certificate_requested":false,"client_hello":{"extensions":{"_unparsed_":["renegotiation_info","23","status_request","18","30032"],"application_layer_protocol_negotiation":["h2","http/1.1"],"ec_points_formats":["uncompressed"],"server_name_indication":["example.org"],"session_ticket":"","signature_algorithms":["ecdsa_secp256r1_sha256","rsa_pss_sha256","rsa_pkcs1_sha256","ecdsa_secp384r1_sha384","rsa_pss_sha384","rsa_pkcs1_sha384","rsa_pss_sha512","rsa_pkcs1_sha512","rsa_pkcs1_sha1"],"supported_groups":["x25519","secp256r1","secp384r1"]},"supported_compression_methods":["NULL"],"version":"3.3"},"version":"TLS 1.2"},"established":false,"resumed":false,"version":"1.2","version_protocol":"tls"},"type":"tls"}` - expectedServerHello = `{"extensions":{"_unparsed_":["renegotiation_info","status_request"],"application_layer_protocol_negotiation":["h2"],"ec_points_formats":["uncompressed","ansiX962_compressed_prime","ansiX962_compressed_char2"],"session_ticket":""},"selected_compression_method":"NULL","version":"3.3"}` + expectedClientHello = `{"client":{"ip":"192.168.0.1","port":6512},"destination":{"domain":"example.org","ip":"192.168.0.2","port":27017},"event":{"category":["network"],"dataset":"tls","kind":"event","type":["connection","protocol"]},"network":{"community_id":"1:jKfewJN/czjTuEpVvsKdYXXiMzs=","direction":"unknown","protocol":"tls","transport":"tcp","type":"ipv4"},"related":{"ip":["192.168.0.1","192.168.0.2"]},"server":{"domain":"example.org","ip":"192.168.0.2","port":27017},"source":{"ip":"192.168.0.1","port":6512},"status":"Error","tls":{"client":{"ja3":"94c485bca29d5392be53f2b8cf7f4304","server_name":"example.org","supported_ciphers":["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_AES_128_GCM_SHA256","TLS_RSA_WITH_AES_256_GCM_SHA384","TLS_RSA_WITH_AES_128_CBC_SHA","TLS_RSA_WITH_AES_256_CBC_SHA","TLS_RSA_WITH_3DES_EDE_CBC_SHA"]},"detailed":{"client_certificate_requested":false,"client_hello":{"extensions":{"_unparsed_":["renegotiation_info","23","18","30032"],"application_layer_protocol_negotiation":["h2","http/1.1"],"ec_points_formats":["uncompressed"],"server_name_indication":["example.org"],"session_ticket":"","signature_algorithms":["ecdsa_secp256r1_sha256","rsa_pss_sha256","rsa_pkcs1_sha256","ecdsa_secp384r1_sha384","rsa_pss_sha384","rsa_pkcs1_sha384","rsa_pss_sha512","rsa_pkcs1_sha512","rsa_pkcs1_sha1"],"status_request":{"request_extensions":0,"responder_id_list_length":0,"type":"ocsp"},"supported_groups":["x25519","secp256r1","secp384r1"]},"random":"3367dfae0d46ec0651e49cca2ae47317e8989df710ee7570a88b9a7d5d56b3af","supported_compression_methods":["NULL"],"version":"3.3"},"version":"TLS 1.2"},"established":false,"resumed":false,"version":"1.2","version_protocol":"tls"},"type":"tls"}` + expectedServerHello = `{"extensions":{"_unparsed_":["renegotiation_info"],"application_layer_protocol_negotiation":["h2"],"ec_points_formats":["uncompressed","ansiX962_compressed_prime","ansiX962_compressed_char2"],"session_ticket":"","status_request":{"response":true}},"random":"7806e1be0c363bcc1fe14a906d1ff1b11dc5369d91c631ed660d6c0f156f4207","selected_compression_method":"NULL","version":"3.3"}` rawClientHello = "16030100c2010000be03033367dfae0d46ec0651e49cca2ae47317e8989df710" + "ee7570a88b9a7d5d56b3af00001c3a3ac02bc02fc02cc030cca9cca8c013c014" + "009c009d002f0035000a01000079dada0000ff0100010000000010000e00000b" + @@ -208,6 +210,222 @@ func TestServerHello(t *testing.T) { assert.Equal(t, expectedServerHello, string(b)) } +func TestOCSPStatus(t *testing.T) { + results, tls := testInit() + tcpTuple := testTCPTuple() + var private protos.ProtocolData + + for i, test := range []struct { + msg string + want interface{} + }{ + // Packets from https://github.com/elastic/beats/issues/29962#issue-1112502582 + // + // 6 0.017079 TLSv1.2 1516 Server Hello + { // TLSv1.2 Record Layer: Handshake Protocol: Server Hello + msg: "160303005b0200005703032c468bdbb2af2e7bd8e09c90e7992c61a8f468a03bbe74ec311fa33a14a35bfd20fc2b8e95f18fa299253278dd98178a61f75cdddd69f8f1d1e0592e0ce8275af1c02b00000fff0100010000050000000b00020100", + }, + // 12 0.017170 TLSv1.2 2145 Certificate, Certificate Status, Server Key Exchange, Server Hello Done + { // TLSv1.2 Record Layer: Handshake Protocol: Certificate + msg: "16030311400b00113c0011390005433082053f30820327a0030201020214213e825a875eb349390d11117c6c14f894135fe3300d06092a864886f70d01010b05003060310b3009060355040613024652310f300d060355040a0c064f72616e676531193017060355040b0c10464f52204c414220555345204f4e4c593125302306035504030c1c4f72616e6765204465766963657320504b49205456204c4142204341301e170d3231303630333133333831365a170d3232303630333133333831365a3040310b3009060355040613024652310f300d060355040b0c064f72616e67653120301e06035504030c1773657276657232207465737420504b49205456204c41423059301306072a8648ce3d020106082a8648ce3d03010703420004fc7a2bae61a536e74d4d3138b83e09ef618de444fff8dc8874863e3e1f557f9008e2f777693ba6d7b8fe59f360006d55561e24edfc0608436b0bbf329df1463ca38201da308201d6301d0603551d0e04160414dfd5c4bdbea6b4c89a57fd4a835573d53f51cbff301f0603551d230418301680143ae35027fb6f7337d4eaa8c82139f9627d116bf4300e0603551d0f0101ff0404030205a030130603551d25040c300a06082b06010505070301305c0603551d1f045530533051a04fa04d864b687474703a2f2f706b692d63726c2d6c622e73656375726974792e696e7472616f72616e67652f63726c2f6f72616e67655f646576696365735f706b695f74765f6c61625f63612e63726c3082010f0603551d11048201063082010282102a2e656e61312e6f72616e67652e6672820f2a2e6974762e6f72616e67652e667282192a2e6a6575787476697074762d70702e6f72616e67652e667282162a2e6a6575787476697074762e6f72616e67652e667282102a2e6e7476312e6f72616e67652e667282102a2e6e7476332e6f72616e67652e667282102a2e6e7476342e6f72616e67652e667282102a2e6e7476352e6f72616e67652e6672820f2a2e7067772e6f72616e67652e667282132a2e70702d656e61312e6f72616e67652e667282122a2e70702d6974762e6f72616e67652e667282132a2e70702d6e7476312e6f72616e67652e667282132a2e70702d6e7476322e6f72616e67652e6672300d06092a864886f70d01010b05000382020100b8d7a4819a31204d58fd9ca0364c544f845b4c9e48dde8aadecad7149256e209df85b8b76f86ec62382932f9b0370ef9d257d5112ae3b72bf8d0809fd437a20419a46f82851701f32e0897a659cf5e19079615cb62205f2abf37a24d51ca9ca954d5b5c4485bbb9441109f71a3e6b5fccccfe1e19d97d8403a60615bf1e4ef20c5bb069a2d26e78c5ad18a431934276b9556153a0b7f3c992684a202ea8403c1f59b362389111e5fcb0fa89e40b86300be3949f0e5690abc3314ee7b53f0adb9019ea8e804e48a197f9d77b3c2fb37dbe732a8aed100fb8624fecece4119e1ea045cdc7156765a89aa3d1228f062eb5f109ac25afc63fa8948be9087eeb6c8ebe807b944230cba453aec493054c4df4d5c34fc21d8739a6d40ddc36c95861f207b4dfcdd97224473a5784120237831b86f398f62205945a7befca9f60c2c63578b2e9870723b4c5933c70317edb1071d38ccdd2f91c3c50dc90906ccf14ecbb9b394cd471f33a92d6f210b994b7c085abdc1dd789a46eac33503725f25376a5b438cf8d6dbb2b07ee128f3be21d50bdfb052271d079f4ccae174509a31ac1dfe2a483dce8eb624c181c616a497414f6616c21b8fd24e08aadd2c9c43944df5088e2bdbf121649ca1e405e1e95695d52afa1c265b123344a9f5594b661e7d3406b0f6d60c7f776a9723bcec995f4b4da3e6d42dc446b6a33904b7a56f74ba5301000626308206223082040aa00302010202121121e97d5d37348c572c555a3a59b7b65d2b300d06092a864886f70d01010b0500305e310b3009060355040613024652310f300d060355040a0c064f72616e676531193017060355040b0c10464f52204c414220555345204f4e4c593123302106035504030c1a4f72616e6765204465766963657320526f6f74204c4142204341301e170d3230303330343039303030305a170d3335303330343039303030305a3060310b3009060355040613024652310f300d060355040a0c064f72616e676531193017060355040b0c10464f52204c414220555345204f4e4c593125302306035504030c1c4f72616e6765204465766963657320504b49205456204c414220434130820222300d06092a864886f70d01010105000382020f003082020a0282020100e68a8c1fa89076aa12abae68b498f64d8eda23ce72669459578dacc564c20f34980b638bce470e70d9d93eadeea76242cbe56aacd6119f979dbedcd6226848770cf434d454ff04e122c9cdb3c15d973b79d24a368c241b9708bd16494ade0277ad8bcedc28ed54948a5c0a002f21e19e79a81597816a89acc47d7e3d77a81022ca212ca714febe385154d198121dfcad5ba0c1e52629193453f94bdf8e1e014558b73541044ff4693c1aca2164c56f0903fca333bfb226ae26bbb31ad36aacaedb2c7f47516d4e9a254c1fd383f4f2f9183851b97cc2d234a753cc96f9ebbb444d0c5a861150c19a8d065e6d6969973dcda3ab75ccfa3dacfdfe8a7052a50c5b44cb934af9ecc1ee7040af662bc4706ecee22de1af540ea7afd1c10dd75fa0bfbcfc92713402d6feebec629d55b3fa798adf01f5784d649d3f33aff0d70d7280f6ec46953cc5e7b54187959eb01d5a3e93650816d5a838282196cc5b11c866528dd7e4292b7cd19552e0d8840edf2006757ba84e6f8e77128ba4e176600ffbbd8aa27296b9e19854da4280e94a33c5e8ae5e26e60e4e2f078ba8bdacf785245db0b5874536069fae15edf0cd64d6979cd0610631dfad56f942aa08d4ea68f836417468ecb1b3a51483263c99c06111c26e4a6fcddfaa2115632034a8b38ba3d21a32bf7a297e589447a9566ae47bcaf2c94f6298dd11c64e016d492d9b6a3a630203010001a381d73081d4300f0603551d130101ff040530030101ff300e0603551d0f0101ff04040302010630590603551d1f04523050304ea04ca04a8648687474703a2f2f706b692d63726c2d6c622e73656375726974792e696e7472616f72616e67652f63726c2f6f72616e6765646576696365735f726f6f745f6c61625f63612e63726c30160603551d20040f300d300b06092a817a01100c070501301d0603551d0e041604143ae35027fb6f7337d4eaa8c82139f9627d116bf4301f0603551d23041830168014e3caae493099e865158a46bfd0da511e834e8d9d300d06092a864886f70d01010b0500038202010087ea4587cba724f8463933bca424e98ac5a3bf70180b4c938b02c22bbce9050d6fdd563afc1841029f296d5f1df1ebd3f2dfa9a4014b3226aa38d4939a3d48c7a6a28740bac23ade3b35b8709cf6d42404431c96d36d30646aa54d251515fd602692621e974bbfcac96c50d7dc31a9466a28383916ddcef16eb1686ca0885c5ff3c0984312e6f5cfb406cbda14219040334b69c77a153505889a12bf79102b9c858947b8e7f7d7812d437c5127fc14ea34f83e45957148d38da502c1c40a22d10412eba6bd2003cd5939c996dad45713c55694388a081dcc69a3204ff6a093c6116c233227faa9912a9887d54ec5955cc2a1c96490a75995dd9c38cc2d931b231254244455a1a65d8d991c3181021f96ebd5fd8cf6f0ea5da3f87564316e65a31ae563af5e309040f944e2e84582766f63bd3271ac8171ba7c9a78a809f99f0b39f74e1adc199ff4d69e275968073564ed5eaed451581d2f8ba0726eb6a9d542c677b0dce9d92e436eb7cdc9de546f7caf144d780a11ecddd5ccbe620c5755b1fc96d8b9143038030e1b73479b8e4a103811bf3df222f9d31355cdc34cf597ca0c7dcbc09d289b8d71e01ee60fb6884a521beca0de9223a2a794b5d2b0759d5ee91564bb5c1533d9c154fc0524cac37a7d7a6e76943f8a8a341594db5a17d193a954cbcc7a062a9a62fc12198d58fb82ad37bebf9d557ecf3853faa3c5eab8330005c7308205c3308203aba0030201020212112151567790fb40c755010ca9169cf4b498300d06092a864886f70d01010b0500305e310b3009060355040613024652310f300d060355040a0c064f72616e676531193017060355040b0c10464f52204c414220555345204f4e4c593123302106035504030c1a4f72616e6765204465766963657320526f6f74204c4142204341301e170d3230303330323137303030305a170d3430303330323137303030305a305e310b3009060355040613024652310f300d060355040a0c064f72616e676531193017060355040b0c10464f52204c414220555345204f4e4c593123302106035504030c1a4f72616e6765204465766963657320526f6f74204c414220434130820222300d06092a864886f70d01010105000382020f003082020a0282020100be7808368bf6af22d8ccd84a6d45044b0d4401c803eb569610cbaa34f0b5ff65889a9e84bf9b7c820445cb31c09a39304dd00fbfb0b93bf4fb85ec5642e5356198d2841774527ef9d9e87a22767b33972f05daef46524b316aafba8df1fd29889cb5e97b136588cee7de4cebc960c576713953dbeb0a373fd4dcd438b650281c0df79705433898905ddae751a07c867da602189d111b734df3cffa2300c4fcc6419579d3b412959e0730664f5c5f8d143e9c8a049ec9c596e7373fc7128edf179db220bad9622c34cfa8358b95435b9a365a35a8c0906b4f7145b4c9999f9ed6ebabe244f145b7864742ed641c8225781a1b8e55629e21c71bdf7f3700e462499cf604d1ab5532da3c4892f3fbd3339993afba93900cffac22aa824c1ba5c2228a67f33a915450a9c93eff40aaf27aa41a0b71158d11363045087a1f44dc971baae25119527f04fef4aae620b43795959735298ceee53c3a269f0fec3dfeed4170a3876af85bcb493d783b55767df7613b30e6e1186fc9e7ba6892feb99d9eeef29f0f15900b233cd734f0768dfbf7820f465ed969f81777c5e475f060f27169d9ef77b977f4de3e37ad9f707e19477b38554e60bbbbea33a87f655758bfddaeb05c73c4908218ff59d4d941087f7dbbd980de52b56d83aa7e966a5e0f810512e2f546d451166bc0e22722323443711037d6e97d4ecb24b934b14faa4a898b8f0203010001a37b3079300f0603551d130101ff040530030101ff300e0603551d0f0101ff04040302010630160603551d20040f300d300b06092a817a01100c070101301d0603551d0e04160414e3caae493099e865158a46bfd0da511e834e8d9d301f0603551d23041830168014e3caae493099e865158a46bfd0da511e834e8d9d300d06092a864886f70d01010b0500038202010085bb2664c92a2d258710c94a529bc2c351971556e01b02a75af91c59de0925c549b52ed7cfaeffd6a6dc96e98f957618c6558f3a7a92b6e7cdf4e8198e1df544021ab9b94b942917fc50e403c4ae8a0b7b75ac150f1e453a3124e4d6e4e6a7fe92d8cb2f6fa248f7d2d64eaf9b2a5dd18179d21d603a06bdbb0e590f51f336a4d80070c6aee65a9fbd74980933f5c6122dbe9a98203e750c4664527dd83404fd5a50ab068c6ff7b9071bee24d5213f73d26cc3709a3c7e34c250e3323ab62707dc7141a7f248322221bee9c393fb97c566b712967c410b2280dd83dd71d048b5a80eee07baa224a004de032791df639eda4d37a3cd9a004df83c0c32af57ffcb1cd5d4ab44b1c2166945668d75a53eacd3913356e857895047a85b998ec71578fd6c01b50863e40b094f47ae72418ad7f3215993b7c081e1912cf61c22698cc110d19d86fba4e075ef831c0f027c576718481558cd2dfe519e40fd8e4751e1b670c727dbfca048dc8de8d3f6351c4467f459440c442e3b99d6153bfa89bc720108f4e10679954bd15d50ef66b44bac370cedc7c6a72a0cb566bf42d96e4933db6e83982a9df9dcf7b1e0951469a5c41d17fe05d5ce908219abe275dafe6aadd421b45b555511e8af78764811afe834f4067cdb2495eba06a2b597ce6bc642afc3a288fd5e7f7d68666afefaae74245d4e435b8e9b15fbcd51dbc129130bb7dbe", + }, + { // TLSv1.2 Record Layer: Handshake Protocol: Certificate Status + msg: "16030306fa160006f6010006f2308206ee0a0100a08206e7308206e306092b0601050507300101048206d4308206d03081efa15930573120301e06035504030c174c4142204465766963657320504b49205456204f43535031153013060355040b0c0c464f52204c4142204f4e4c59310f300d060355040a0c064f72616e6765310b3009060355040613024652180f32303232303131393132343134365a308180307e3069300d060960864801650304020105000420ea0ffda3ea4e2090c00df6b507f9d626c5fa196dbf0bc34f005728e35ba8dcef0420150104f4cf727e5515390fccf0a79b7de0fa5c91da131914776cf9007ba848d80214213e825a875eb349390d11117c6c14f894135fe38000180f32303232303131393132343134365a300d06092a864886f70d01010b0500038201010055d4e44634ea7d88f76d89d212b54c70c4c816f0229708e3b57668b0feea67dd368383c285a26d27b092f737b8168f52a3fe839842ca7d6a98491ad072b554440a01797f89b36f77241d7cd24691e4ba8c8e43db6c0851e8fa8a7aebc1c9b5e0892c072c93d3bae0fc793510dc0fc9522742c9bcb845679c88d64e8f98f54c90ce24078739d36c57ccd5cb3d1f6b3af53b8c5b8fab338e57615a0f3a2d744cc10d1a607c3364291c68a02c5b498699af56add7d4ef6ff647d8933a494688099d2ef1c88fc99e1c3e614336f8ec93aa4b6c3e249be1d241e3fbdf0655ffc6454358aebdd85375a2e582e47bd0d398775ebc0553f8f84d64827efbfbb0be479ca8a08204c6308204c2308204be308202a6a003020102021500982eedb5d4d6a889df086bde709c259700dc5d0b300d06092a864886f70d01010b05003060310b3009060355040613024652310f300d060355040a0c064f72616e676531193017060355040b0c10464f52204c414220555345204f4e4c593125302306035504030c1c4f72616e6765204465766963657320504b49205456204c4142204341301e170d3231303331313135303631355a170d3233303331313135303631355a30573120301e06035504030c174c4142204465766963657320504b49205456204f43535031153013060355040b0c0c464f52204c4142204f4e4c59310f300d060355040a0c064f72616e6765310b300906035504061302465230820122300d06092a864886f70d01010105000382010f003082010a0282010100db897620e1931205f84d3dccb18596575261eeb3e08a2751bf11bb2f8d50bd45daba8de5e409834a3f7db86f3bbdd466db3f26c8a23349f7068f8c4e5c1359ab658627f2cf13698a27a164789dcef0564ce8e38b118b377b21accc56c6f2c436c937162eb6517ee7769a544395efed849e879bbeee4db037afb638efdb982bafb17226ded7551a832bc32d6890fc6405897ff4ba594663c72882b3ee6d4529effd421d172c2cf472899bc2ef411bb99338a2b7d0848b17651d64a45356c7afaf710108a80daf9ffa1875c0ade37fc2610ada1f4ba22b8baa3ed7cb49f15a330ca3af87e45a7d3a6bbca0cf89c953f889ea2d457c18e8a9c0621c05422668ec370203010001a3783076301d0603551d0e04160414d6d0ee3577e004c093c5b86f2606e711391aa02f301f0603551d230418301680143ae35027fb6f7337d4eaa8c82139f9627d116bf4300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070309300f06092b060105050730010504020500300d06092a864886f70d01010b050003820201008c2d84f26d2868aff7af411065c2fb2c1fce32bb4e8dfc8cb1aa421e85c807619146345c63d5786f50fbe1a3a40cf28c444c591fd73b0f29dee46a5e3d2aae64c425b86bdbba47ea561e25f3040357d589ae21081a0bcff524855b4c221740c67980f3fb9527a5488d4c5a94384e3423833c63c414fd4a927ad9e0ad94a561239b0c5cf173ba823a7b23bc5985343309c55613e11a2e0a7a206fbaf81269a05ce5558534a86d54eecf0fa2596bc12e0b75cc1e385d192a69b900ea42c75deee78cc77121c552dd222e4f0a544f70c42ee9068e036d07a5b43b722479e2be4ac8e3b5248db27c0407b9dc07fee2d035cfdfada1b62c4c89ccfb46144d9a1ff598d7f966cee970e7e2b25c93529bb8f9e3af35a5ae3a873bb25bc4853ac026105f9a9544b1eb797c26574e0789c45af53778685ec83261afd82a227a3eac31acea592822268f6909523b2745eb317703b0acd496caba478300dd855b9e399cf2c24ea71bc69f52009273004e8b486ea6033f5bd843a3c0e0daf7887ee39907453b31cc4c2c62b1ef39263518bafe3319d886dfe9ed86c99508f139786e21209181cd4b205a5676cb261bd7ae3132e07d0ff9a7e18d1507555f2d34393f0992985cd9491f1db501e0f176f55e05ad06690844a0323b586c9c85da4f23b644a032d90a0b279d2ce250e056dfc545070e81c624f1c286d3bf539f60c206999199b583", + }, + { // TLSv1.2 Record Layer: Handshake Protocol: Server Key Exchange + msg: "16030300930c00008f030017410496569a8aa5e214e7451b9bb7ba10c4af011cf3de8daf19f4e3a09f81d697696bfa9ebf4e1bb441f5c2adffeda15a92b9f9b588d4731af7cc5d15d7035fe5203304030046304402203e1e19b17b31b843f6be75643108c7e684a449b437432944a80739c2ab3035e302206a680f72e531b5eef08d3d0a078d65d4dbfce153e83f4f62f261bacc36eb7ae6", + }, + { // TLSv1.2 Record Layer: Handshake Protocol: Server Hello Done + msg: "16030300040e000000", + }, + } { + reqData, err := hex.DecodeString(test.msg) + if err != nil { + t.Fatalf("unexected error decoding input %d: %v", i, err) + } + + private = tls.Parse(&protos.Packet{Payload: reqData}, tcpTuple, 0, private) + } + tls.ReceivedFin(tcpTuple, 0, private) + + if len(results.events) != 1 { + t.Fatalf("unexected number of results: got:%d want:1", len(results.events)) + } + + want := common.MapStr{ + "client": common.MapStr{ + "ip": "192.168.0.1", + "port": int64(6512), + }, + "event": common.MapStr{ + "dataset": "tls", + "kind": "event", + "category": []string{ + "network", + }, + "type": []string{ + "connection", + "protocol", + }, + }, + "destination": common.MapStr{ + "ip": "192.168.0.2", + "port": int64(27017), + }, + "network": common.MapStr{ + "type": "ipv4", + "transport": "tcp", + "protocol": "tls", + "direction": "unknown", + "community_id": "1:jKfewJN/czjTuEpVvsKdYXXiMzs=", + }, + "related": common.MapStr{ + "ip": []string{ + "192.168.0.1", + "192.168.0.2", + }, + }, + "server": common.MapStr{ + "ip": "192.168.0.2", + "port": int64(27017), + }, + "source": common.MapStr{ + "port": int64(6512), + "ip": "192.168.0.1", + }, + "status": "Error", + "tls": common.MapStr{ + "cipher": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", + "detailed": common.MapStr{ + "client_certificate_requested": false, + "ocsp_response": "successful", + "server_certificate_chain": []common.MapStr{ + { + "issuer": common.MapStr{ + "common_name": "Orange Devices Root LAB CA", + "country": "FR", + "distinguished_name": "CN=Orange Devices Root LAB CA,OU=FOR LAB USE ONLY,O=Orange,C=FR", + "organization": "Orange", + "organizational_unit": "FOR LAB USE ONLY", + }, + "not_before": time.Date(2020, 3, 4, 9, 0, 0, 0, time.UTC), + "not_after": time.Date(2035, 3, 4, 9, 0, 0, 0, time.UTC), + "public_key_algorithm": "RSA", + "public_key_size": 4096, + "serial_number": "1492448539999078269498416841973088004758827", + "signature_algorithm": "SHA256-RSA", + "subject": common.MapStr{ + "common_name": "Orange Devices PKI TV LAB CA", + "country": "FR", + "distinguished_name": "CN=Orange Devices PKI TV LAB CA,OU=FOR LAB USE ONLY,O=Orange,C=FR", + "organization": "Orange", + "organizational_unit": "FOR LAB USE ONLY", + }, + "version_number": 3, + }, + { + "issuer": common.MapStr{ + "common_name": "Orange Devices Root LAB CA", + "country": "FR", + "distinguished_name": "CN=Orange Devices Root LAB CA,OU=FOR LAB USE ONLY,O=Orange,C=FR", + "organization": "Orange", + "organizational_unit": "FOR LAB USE ONLY", + }, + "not_after": time.Date(2040, 3, 2, 17, 0, 0, 0, time.UTC), + "not_before": time.Date(2020, 3, 2, 17, 0, 0, 0, time.UTC), + "public_key_algorithm": "RSA", + "public_key_size": 4096, + "serial_number": "1492246295378596931754418352553114016724120", + "signature_algorithm": "SHA256-RSA", + "subject": common.MapStr{ + "common_name": "Orange Devices Root LAB CA", + "country": "FR", + "distinguished_name": "CN=Orange Devices Root LAB CA,OU=FOR LAB USE ONLY,O=Orange,C=FR", + "organization": "Orange", + "organizational_unit": "FOR LAB USE ONLY", + }, + "version_number": 3, + }, + }, + "server_hello": common.MapStr{ + "extensions": common.MapStr{ + "_unparsed_": []string{ + "renegotiation_info", + }, + "ec_points_formats": []string{ + "uncompressed", + }, + "status_request": common.MapStr{ + "response": true, + }, + }, + "random": "2c468bdbb2af2e7bd8e09c90e7992c61a8f468a03bbe74ec311fa33a14a35bfd", + "selected_compression_method": "NULL", + "session_id": "fc2b8e95f18fa299253278dd98178a61f75cdddd69f8f1d1e0592e0ce8275af1", + "version": "3.3", + }, + "version": "TLS 1.2", + }, + "established": false, + "resumed": false, + "server": common.MapStr{ + "issuer": "CN=Orange Devices PKI TV LAB CA,OU=FOR LAB USE ONLY,O=Orange,C=FR", + "hash": common.MapStr{ + "sha1": "D8A11028DAD7E34F5D7F6D41DE01743D8B3CE553", + }, + "not_after": time.Date(2022, 6, 3, 13, 38, 16, 0, time.UTC), + "not_before": time.Date(2021, 6, 3, 13, 38, 16, 0, time.UTC), + "x509": common.MapStr{ + "alternative_names": []string{ + "*.ena1.orange.fr", + "*.itv.orange.fr", + "*.jeuxtviptv-pp.orange.fr", + "*.jeuxtviptv.orange.fr", + "*.ntv1.orange.fr", + "*.ntv3.orange.fr", + "*.ntv4.orange.fr", + "*.ntv5.orange.fr", + "*.pgw.orange.fr", + "*.pp-ena1.orange.fr", + "*.pp-itv.orange.fr", + "*.pp-ntv1.orange.fr", + "*.pp-ntv2.orange.fr", + }, + "issuer": common.MapStr{ + "common_name": "Orange Devices PKI TV LAB CA", + "country": "FR", + "distinguished_name": "CN=Orange Devices PKI TV LAB CA,OU=FOR LAB USE ONLY,O=Orange,C=FR", + "organization": "Orange", + "organizational_unit": "FOR LAB USE ONLY", + }, + "not_after": time.Date(2022, 6, 3, 13, 38, 16, 0, time.UTC), + "not_before": time.Date(2021, 6, 3, 13, 38, 16, 0, time.UTC), + "public_key_algorithm": "ECDSA", + "public_key_size": 256, + "serial_number": "189790697042017246339292011338547986350262673379", + "signature_algorithm": "SHA256-RSA", + "subject": common.MapStr{ + "common_name": "server2 test PKI TV LAB", + "country": "FR", + "distinguished_name": "CN=server2 test PKI TV LAB,OU=Orange,C=FR", + "organizational_unit": "Orange", + }, + "version_number": 3, + }, + "subject": "CN=server2 test PKI TV LAB,OU=Orange,C=FR", + }, + "version": "1.2", + "version_protocol": "tls", + }, + "type": "tls", + } + + got := results.events[0].Fields + if !cmp.Equal(got, want) { + t.Errorf("unexpected result: %s", cmp.Diff(got, want)) + } +} + func TestFragmentedHandshake(t *testing.T) { results, tls := testInit() diff --git a/packetbeat/tests/system/golden/established_tls-expected.json b/packetbeat/tests/system/golden/established_tls-expected.json index 5863039d89fa..ddd584bbfed9 100644 --- a/packetbeat/tests/system/golden/established_tls-expected.json +++ b/packetbeat/tests/system/golden/established_tls-expected.json @@ -1,219 +1,221 @@ [ - { - "@metadata.beat": "packetbeat", - "@metadata.type": "_doc", - "client.ip": "192.168.1.35", - "client.port": 59455, - "destination.domain": "example.net", - "destination.ip": "93.184.216.34", - "destination.port": 443, - "event.category": [ - "network" - ], - "event.dataset": "tls", - "event.duration": 364625000, - "event.kind": "event", - "event.type": [ - "connection", - "protocol" - ], - "network.community_id": "1:fx1jENdlg6r3LIvBRG3wEboWbPY=", - "network.protocol": "tls", - "network.transport": "tcp", - "network.type": "ipv4", - "related.ip": [ - "192.168.1.35", - "93.184.216.34" - ], - "server.domain": "example.net", - "server.ip": "93.184.216.34", - "server.port": 443, - "source.ip": "192.168.1.35", - "source.port": 59455, - "status": "OK", - "tls.cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", - "tls.client.ja3": "e6573e91e6eb777c0933c5b8f97f10cd", - "tls.client.server_name": "example.net", - "tls.client.supported_ciphers": [ - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", - "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", - "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", - "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", - "(unknown:0xff85)", - "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", - "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", - "TLS_GOSTR341001_WITH_28147_CNT_IMIT", - "TLS_RSA_WITH_AES_256_GCM_SHA384", - "TLS_RSA_WITH_AES_256_CBC_SHA256", - "TLS_RSA_WITH_AES_256_CBC_SHA", - "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", - "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", - "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", - "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", - "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", - "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", - "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", - "TLS_RSA_WITH_AES_128_GCM_SHA256", - "TLS_RSA_WITH_AES_128_CBC_SHA256", - "TLS_RSA_WITH_AES_128_CBC_SHA", - "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", - "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", - "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", - "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" - ], - "tls.detailed.client_certificate_requested": false, - "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation": [ - "h2", - "http/1.1" - ], - "tls.detailed.client_hello.extensions.ec_points_formats": [ - "uncompressed" - ], - "tls.detailed.client_hello.extensions.server_name_indication": [ - "example.net" - ], - "tls.detailed.client_hello.extensions.signature_algorithms": [ - "rsa_pkcs1_sha512", - "ecdsa_secp521r1_sha512", - "(unknown:0xefef)", - "rsa_pkcs1_sha384", - "ecdsa_secp384r1_sha384", - "rsa_pkcs1_sha256", - "ecdsa_secp256r1_sha256", - "(unknown:0xeeee)", - "(unknown:0xeded)", - "(unknown:0x0301)", - "(unknown:0x0303)", - "rsa_pkcs1_sha1", - "ecdsa_sha1" - ], - "tls.detailed.client_hello.extensions.supported_groups": [ - "x25519", - "secp256r1", - "secp384r1" - ], - "tls.detailed.client_hello.supported_compression_methods": [ - "NULL" - ], - "tls.detailed.client_hello.version": "3.3", - "tls.detailed.server_certificate_chain": [ - { - "issuer": { - "common_name": "DigiCert Global Root CA", - "country": "US", - "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", - "organization": "DigiCert Inc", - "organizational_unit": "www.digicert.com" - }, - "not_after": "2023-03-08T12:00:00.000Z", - "not_before": "2013-03-08T12:00:00.000Z", - "public_key_algorithm": "RSA", - "public_key_size": 2048, - "serial_number": "2646203786665923649276728595390119057", - "signature_algorithm": "SHA256-RSA", - "subject": { - "common_name": "DigiCert SHA2 Secure Server CA", - "country": "US", - "distinguished_name": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", - "organization": "DigiCert Inc" - }, - "version_number": 3 - }, - { - "issuer": { - "common_name": "DigiCert Global Root CA", - "country": "US", - "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", - "organization": "DigiCert Inc", - "organizational_unit": "www.digicert.com" - }, - "not_after": "2031-11-10T00:00:00.000Z", - "not_before": "2006-11-10T00:00:00.000Z", - "public_key_algorithm": "RSA", - "public_key_size": 2048, - "serial_number": "10944719598952040374951832963794454346", - "signature_algorithm": "SHA1-RSA", - "subject": { - "common_name": "DigiCert Global Root CA", - "country": "US", - "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", - "organization": "DigiCert Inc", - "organizational_unit": "www.digicert.com" - }, - "version_number": 3 - } - ], - "tls.detailed.server_hello.extensions._unparsed_": [ - "renegotiation_info", - "server_name_indication" - ], - "tls.detailed.server_hello.extensions.application_layer_protocol_negotiation": [ - "h2" - ], - "tls.detailed.server_hello.extensions.ec_points_formats": [ - "uncompressed", - "ansiX962_compressed_prime", - "ansiX962_compressed_char2" - ], - "tls.detailed.server_hello.selected_compression_method": "NULL", - "tls.detailed.server_hello.session_id": "23bb2aed5d215e1228220b0a51d7aa220785e9e4b83b4f430229117971e9913f", - "tls.detailed.server_hello.version": "3.3", - "tls.detailed.version": "TLS 1.2", - "tls.established": true, - "tls.next_protocol": "h2", - "tls.resumed": false, - "tls.server.hash.sha1": "7BB698386970363D2919CC5772846984FFD4A889", - "tls.server.issuer": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", - "tls.server.not_after": "2020-12-02T12:00:00.000Z", - "tls.server.not_before": "2018-11-28T00:00:00.000Z", - "tls.server.subject": "CN=www.example.org,OU=Technology,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US", - "tls.server.x509.alternative_names": [ - "www.example.org", - "example.com", - "example.edu", - "example.net", - "example.org", - "www.example.com", - "www.example.edu", - "www.example.net" - ], - "tls.server.x509.issuer.common_name": "DigiCert SHA2 Secure Server CA", - "tls.server.x509.issuer.country": "US", - "tls.server.x509.issuer.distinguished_name": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", - "tls.server.x509.issuer.organization": "DigiCert Inc", - "tls.server.x509.not_after": "2020-12-02T12:00:00.000Z", - "tls.server.x509.not_before": "2018-11-28T00:00:00.000Z", - "tls.server.x509.public_key_algorithm": "RSA", - "tls.server.x509.public_key_size": 2048, - "tls.server.x509.serial_number": "21020869104500376438182461249190639870", - "tls.server.x509.signature_algorithm": "SHA256-RSA", - "tls.server.x509.subject.common_name": "www.example.org", - "tls.server.x509.subject.country": "US", - "tls.server.x509.subject.distinguished_name": "CN=www.example.org,OU=Technology,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US", - "tls.server.x509.subject.locality": "Los Angeles", - "tls.server.x509.subject.organization": "Internet Corporation for Assigned Names and Numbers", - "tls.server.x509.subject.organizational_unit": "Technology", - "tls.server.x509.subject.state_or_province": "California", - "tls.server.x509.version_number": 3, - "tls.version": "1.2", - "tls.version_protocol": "tls", - "type": "tls" - } -] + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "192.168.1.35", + "client.port": 59455, + "destination.domain": "example.net", + "destination.ip": "93.184.216.34", + "destination.port": 443, + "event.category": [ + "network" + ], + "event.dataset": "tls", + "event.duration": 364625000, + "event.kind": "event", + "event.type": [ + "connection", + "protocol" + ], + "network.community_id": "1:fx1jENdlg6r3LIvBRG3wEboWbPY=", + "network.protocol": "tls", + "network.transport": "tcp", + "network.type": "ipv4", + "related.ip": [ + "192.168.1.35", + "93.184.216.34" + ], + "server.domain": "example.net", + "server.ip": "93.184.216.34", + "server.port": 443, + "source.ip": "192.168.1.35", + "source.port": 59455, + "status": "OK", + "tls.cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "tls.client.ja3": "e6573e91e6eb777c0933c5b8f97f10cd", + "tls.client.server_name": "example.net", + "tls.client.supported_ciphers": [ + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", + "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", + "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", + "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", + "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", + "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", + "(unknown:0xff85)", + "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", + "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", + "TLS_GOSTR341001_WITH_28147_CNT_IMIT", + "TLS_RSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_256_CBC_SHA256", + "TLS_RSA_WITH_AES_256_CBC_SHA", + "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", + "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", + "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", + "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", + "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", + "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", + "TLS_RSA_WITH_AES_128_GCM_SHA256", + "TLS_RSA_WITH_AES_128_CBC_SHA256", + "TLS_RSA_WITH_AES_128_CBC_SHA", + "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", + "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", + "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", + "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" + ], + "tls.detailed.client_certificate_requested": false, + "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation": [ + "h2", + "http/1.1" + ], + "tls.detailed.client_hello.extensions.ec_points_formats": [ + "uncompressed" + ], + "tls.detailed.client_hello.extensions.server_name_indication": [ + "example.net" + ], + "tls.detailed.client_hello.extensions.signature_algorithms": [ + "rsa_pkcs1_sha512", + "ecdsa_secp521r1_sha512", + "(unknown:0xefef)", + "rsa_pkcs1_sha384", + "ecdsa_secp384r1_sha384", + "rsa_pkcs1_sha256", + "ecdsa_secp256r1_sha256", + "(unknown:0xeeee)", + "(unknown:0xeded)", + "(unknown:0x0301)", + "(unknown:0x0303)", + "rsa_pkcs1_sha1", + "ecdsa_sha1" + ], + "tls.detailed.client_hello.extensions.supported_groups": [ + "x25519", + "secp256r1", + "secp384r1" + ], + "tls.detailed.client_hello.random": "d7c809b4ac3a60b62f53c9d9366ca89a703d25491ff2a246a89f32f945f7b42b", + "tls.detailed.client_hello.supported_compression_methods": [ + "NULL" + ], + "tls.detailed.client_hello.version": "3.3", + "tls.detailed.server_certificate_chain": [ + { + "issuer": { + "common_name": "DigiCert Global Root CA", + "country": "US", + "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", + "organization": "DigiCert Inc", + "organizational_unit": "www.digicert.com" + }, + "not_after": "2023-03-08T12:00:00.000Z", + "not_before": "2013-03-08T12:00:00.000Z", + "public_key_algorithm": "RSA", + "public_key_size": 2048, + "serial_number": "2646203786665923649276728595390119057", + "signature_algorithm": "SHA256-RSA", + "subject": { + "common_name": "DigiCert SHA2 Secure Server CA", + "country": "US", + "distinguished_name": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", + "organization": "DigiCert Inc" + }, + "version_number": 3 + }, + { + "issuer": { + "common_name": "DigiCert Global Root CA", + "country": "US", + "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", + "organization": "DigiCert Inc", + "organizational_unit": "www.digicert.com" + }, + "not_after": "2031-11-10T00:00:00.000Z", + "not_before": "2006-11-10T00:00:00.000Z", + "public_key_algorithm": "RSA", + "public_key_size": 2048, + "serial_number": "10944719598952040374951832963794454346", + "signature_algorithm": "SHA1-RSA", + "subject": { + "common_name": "DigiCert Global Root CA", + "country": "US", + "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", + "organization": "DigiCert Inc", + "organizational_unit": "www.digicert.com" + }, + "version_number": 3 + } + ], + "tls.detailed.server_hello.extensions._unparsed_": [ + "renegotiation_info", + "server_name_indication" + ], + "tls.detailed.server_hello.extensions.application_layer_protocol_negotiation": [ + "h2" + ], + "tls.detailed.server_hello.extensions.ec_points_formats": [ + "uncompressed", + "ansiX962_compressed_prime", + "ansiX962_compressed_char2" + ], + "tls.detailed.server_hello.random": "d1fd553a5a270f08e09eda6690fb3c8f9884e9a9fe7949e9444f574e47524401", + "tls.detailed.server_hello.selected_compression_method": "NULL", + "tls.detailed.server_hello.session_id": "23bb2aed5d215e1228220b0a51d7aa220785e9e4b83b4f430229117971e9913f", + "tls.detailed.server_hello.version": "3.3", + "tls.detailed.version": "TLS 1.2", + "tls.established": true, + "tls.next_protocol": "h2", + "tls.resumed": false, + "tls.server.hash.sha1": "7BB698386970363D2919CC5772846984FFD4A889", + "tls.server.issuer": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", + "tls.server.not_after": "2020-12-02T12:00:00.000Z", + "tls.server.not_before": "2018-11-28T00:00:00.000Z", + "tls.server.subject": "CN=www.example.org,OU=Technology,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US", + "tls.server.x509.alternative_names": [ + "www.example.org", + "example.com", + "example.edu", + "example.net", + "example.org", + "www.example.com", + "www.example.edu", + "www.example.net" + ], + "tls.server.x509.issuer.common_name": "DigiCert SHA2 Secure Server CA", + "tls.server.x509.issuer.country": "US", + "tls.server.x509.issuer.distinguished_name": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", + "tls.server.x509.issuer.organization": "DigiCert Inc", + "tls.server.x509.not_after": "2020-12-02T12:00:00.000Z", + "tls.server.x509.not_before": "2018-11-28T00:00:00.000Z", + "tls.server.x509.public_key_algorithm": "RSA", + "tls.server.x509.public_key_size": 2048, + "tls.server.x509.serial_number": "21020869104500376438182461249190639870", + "tls.server.x509.signature_algorithm": "SHA256-RSA", + "tls.server.x509.subject.common_name": "www.example.org", + "tls.server.x509.subject.country": "US", + "tls.server.x509.subject.distinguished_name": "CN=www.example.org,OU=Technology,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US", + "tls.server.x509.subject.locality": "Los Angeles", + "tls.server.x509.subject.organization": "Internet Corporation for Assigned Names and Numbers", + "tls.server.x509.subject.organizational_unit": "Technology", + "tls.server.x509.subject.state_or_province": "California", + "tls.server.x509.version_number": 3, + "tls.version": "1.2", + "tls.version_protocol": "tls", + "type": "tls" + } +] \ No newline at end of file diff --git a/packetbeat/tests/system/golden/non_established_tls-expected.json b/packetbeat/tests/system/golden/non_established_tls-expected.json index 846c2d9d0817..7bee904542c4 100644 --- a/packetbeat/tests/system/golden/non_established_tls-expected.json +++ b/packetbeat/tests/system/golden/non_established_tls-expected.json @@ -56,7 +56,6 @@ "tls.detailed.client_hello.extensions._unparsed_": [ "23", "renegotiation_info", - "status_request", "51", "45", "28", @@ -86,6 +85,9 @@ "ecdsa_sha1", "rsa_pkcs1_sha1" ], + "tls.detailed.client_hello.extensions.status_request.request_extensions": 0, + "tls.detailed.client_hello.extensions.status_request.responder_id_list_length": 0, + "tls.detailed.client_hello.extensions.status_request.type": "ocsp", "tls.detailed.client_hello.extensions.supported_groups": [ "x25519", "secp256r1", @@ -100,6 +102,7 @@ "TLS 1.1", "TLS 1.0" ], + "tls.detailed.client_hello.random": "86380030181f1268bb724c6c922e330e5b479b5f16ae54b592471581a178540b", "tls.detailed.client_hello.session_id": "e0181848607f91f9b42672de709ed1df3a811c7b913f9348da2136b758d0242f", "tls.detailed.client_hello.supported_compression_methods": [ "NULL" diff --git a/packetbeat/tests/system/golden/tls_1_3-expected.json b/packetbeat/tests/system/golden/tls_1_3-expected.json index ba826d5408c9..672826d8dc2b 100644 --- a/packetbeat/tests/system/golden/tls_1_3-expected.json +++ b/packetbeat/tests/system/golden/tls_1_3-expected.json @@ -58,7 +58,6 @@ "tls.detailed.client_hello.extensions._unparsed_": [ "23", "renegotiation_info", - "status_request", "51", "45", "28", @@ -87,6 +86,9 @@ "ecdsa_sha1", "rsa_pkcs1_sha1" ], + "tls.detailed.client_hello.extensions.status_request.request_extensions": 0, + "tls.detailed.client_hello.extensions.status_request.responder_id_list_length": 0, + "tls.detailed.client_hello.extensions.status_request.type": "ocsp", "tls.detailed.client_hello.extensions.supported_groups": [ "x25519", "secp256r1", @@ -101,6 +103,7 @@ "TLS 1.1", "TLS 1.0" ], + "tls.detailed.client_hello.random": "03ce74e1536e0272c1d55b0c8cdf324e82f80a276e478645572324ce25910c00", "tls.detailed.client_hello.session_id": "5d2b9f80d34143b5764ba6b23e1d4f9d1f172148b6fd83c81f42663459eaf6f6", "tls.detailed.client_hello.supported_compression_methods": [ "NULL" @@ -112,6 +115,7 @@ "51" ], "tls.detailed.server_hello.extensions.supported_versions": "TLS 1.3", + "tls.detailed.server_hello.random": "ebd86864767a7782922db6712f487c22c6cb65e54a895fefd3f60bc851591f19", "tls.detailed.server_hello.selected_compression_method": "NULL", "tls.detailed.server_hello.session_id": "5d2b9f80d34143b5764ba6b23e1d4f9d1f172148b6fd83c81f42663459eaf6f6", "tls.detailed.server_hello.version": "3.3", diff --git a/packetbeat/tests/system/golden/tls_all_options-expected.json b/packetbeat/tests/system/golden/tls_all_options-expected.json index 6409f22390d0..e8dcf374b1d9 100644 --- a/packetbeat/tests/system/golden/tls_all_options-expected.json +++ b/packetbeat/tests/system/golden/tls_all_options-expected.json @@ -1,226 +1,228 @@ [ - { - "@metadata.beat": "packetbeat", - "@metadata.type": "_doc", - "client.ip": "192.168.1.35", - "client.port": 59455, - "destination.domain": "example.net", - "destination.ip": "93.184.216.34", - "destination.port": 443, - "event.category": [ - "network" - ], - "event.dataset": "tls", - "event.duration": 364625000, - "event.kind": "event", - "event.type": [ - "connection", - "protocol" - ], - "network.community_id": "1:fx1jENdlg6r3LIvBRG3wEboWbPY=", - "network.protocol": "tls", - "network.transport": "tcp", - "network.type": "ipv4", - "related.ip": [ - "192.168.1.35", - "93.184.216.34" - ], - "server.domain": "example.net", - "server.ip": "93.184.216.34", - "server.port": 443, - "source.ip": "192.168.1.35", - "source.port": 59455, - "status": "OK", - "tls.cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", - "tls.client.ja3": "e6573e91e6eb777c0933c5b8f97f10cd", - "tls.client.server_name": "example.net", - "tls.client.supported_ciphers": [ - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", - "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", - "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", - "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", - "(unknown:0xff85)", - "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", - "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", - "TLS_GOSTR341001_WITH_28147_CNT_IMIT", - "TLS_RSA_WITH_AES_256_GCM_SHA384", - "TLS_RSA_WITH_AES_256_CBC_SHA256", - "TLS_RSA_WITH_AES_256_CBC_SHA", - "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", - "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", - "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", - "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", - "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", - "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", - "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", - "TLS_RSA_WITH_AES_128_GCM_SHA256", - "TLS_RSA_WITH_AES_128_CBC_SHA256", - "TLS_RSA_WITH_AES_128_CBC_SHA", - "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", - "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", - "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", - "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_RSA_WITH_3DES_EDE_CBC_SHA", - "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" - ], - "tls.detailed.client_certificate_requested": false, - "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation": [ - "h2", - "http/1.1" - ], - "tls.detailed.client_hello.extensions.ec_points_formats": [ - "uncompressed" - ], - "tls.detailed.client_hello.extensions.server_name_indication": [ - "example.net" - ], - "tls.detailed.client_hello.extensions.signature_algorithms": [ - "rsa_pkcs1_sha512", - "ecdsa_secp521r1_sha512", - "(unknown:0xefef)", - "rsa_pkcs1_sha384", - "ecdsa_secp384r1_sha384", - "rsa_pkcs1_sha256", - "ecdsa_secp256r1_sha256", - "(unknown:0xeeee)", - "(unknown:0xeded)", - "(unknown:0x0301)", - "(unknown:0x0303)", - "rsa_pkcs1_sha1", - "ecdsa_sha1" - ], - "tls.detailed.client_hello.extensions.supported_groups": [ - "x25519", - "secp256r1", - "secp384r1" - ], - "tls.detailed.client_hello.supported_compression_methods": [ - "NULL" - ], - "tls.detailed.client_hello.version": "3.3", - "tls.detailed.server_certificate_chain": [ - { - "issuer": { - "common_name": "DigiCert Global Root CA", - "country": "US", - "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", - "organization": "DigiCert Inc", - "organizational_unit": "www.digicert.com" - }, - "not_after": "2023-03-08T12:00:00.000Z", - "not_before": "2013-03-08T12:00:00.000Z", - "public_key_algorithm": "RSA", - "public_key_size": 2048, - "serial_number": "2646203786665923649276728595390119057", - "signature_algorithm": "SHA256-RSA", - "subject": { - "common_name": "DigiCert SHA2 Secure Server CA", - "country": "US", - "distinguished_name": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", - "organization": "DigiCert Inc" - }, - "version_number": 3 - }, - { - "issuer": { - "common_name": "DigiCert Global Root CA", - "country": "US", - "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", - "organization": "DigiCert Inc", - "organizational_unit": "www.digicert.com" - }, - "not_after": "2031-11-10T00:00:00.000Z", - "not_before": "2006-11-10T00:00:00.000Z", - "public_key_algorithm": "RSA", - "public_key_size": 2048, - "serial_number": "10944719598952040374951832963794454346", - "signature_algorithm": "SHA1-RSA", - "subject": { - "common_name": "DigiCert Global Root CA", - "country": "US", - "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", - "organization": "DigiCert Inc", - "organizational_unit": "www.digicert.com" - }, - "version_number": 3 - } - ], - "tls.detailed.server_hello.extensions._unparsed_": [ - "renegotiation_info", - "server_name_indication" - ], - "tls.detailed.server_hello.extensions.application_layer_protocol_negotiation": [ - "h2" - ], - "tls.detailed.server_hello.extensions.ec_points_formats": [ - "uncompressed", - "ansiX962_compressed_prime", - "ansiX962_compressed_char2" - ], - "tls.detailed.server_hello.selected_compression_method": "NULL", - "tls.detailed.server_hello.session_id": "23bb2aed5d215e1228220b0a51d7aa220785e9e4b83b4f430229117971e9913f", - "tls.detailed.server_hello.version": "3.3", - "tls.detailed.version": "TLS 1.2", - "tls.established": true, - "tls.next_protocol": "h2", - "tls.resumed": false, - "tls.server.certificate_chain": [ - "-----BEGIN CERTIFICATE-----\nMIIHQDCCBiigAwIBAgIQD9B43Ujxor1NDyupa2A4/jANBgkqhkiG9w0BAQsFADBN\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E\naWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTgxMTI4MDAwMDAwWhcN\nMjAxMjAyMTIwMDAwWjCBpTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju\naWExFDASBgNVBAcTC0xvcyBBbmdlbGVzMTwwOgYDVQQKEzNJbnRlcm5ldCBDb3Jw\nb3JhdGlvbiBmb3IgQXNzaWduZWQgTmFtZXMgYW5kIE51bWJlcnMxEzARBgNVBAsT\nClRlY2hub2xvZ3kxGDAWBgNVBAMTD3d3dy5leGFtcGxlLm9yZzCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBANDwEnSgliByCGUZElpdStA6jGaPoCkrp9vV\nrAzPpXGSFUIVsAeSdjF11yeOTVBqddF7U14nqu3rpGA68o5FGGtFM1yFEaogEv5g\nrJ1MRY/d0w4+dw8JwoVlNMci+3QTuUKf9yH28JxEdG3J37Mfj2C3cREGkGNBnY80\neyRJRqzy8I0LSPTTkhr3okXuzOXXg38ugr1x3SgZWDNuEaE6oGpyYJIBWZ9jF3pJ\nQnucP9vTBejMh374qvyd0QVQq3WxHrogy4nUbWw3gihMxT98wRD1oKVma1NTydvt\nhcNtBfhkp8kO64/hxLHrLWgOFT/l4tz8IWQt7mkrBHjbd2XLVPkCAwEAAaOCA8Ew\nggO9MB8GA1UdIwQYMBaAFA+AYRyCMWHVLyjnjUY4tCzhxtniMB0GA1UdDgQWBBRm\nmGIC4AmRp9njNvt2xrC/oW2nvjCBgQYDVR0RBHoweIIPd3d3LmV4YW1wbGUub3Jn\nggtleGFtcGxlLmNvbYILZXhhbXBsZS5lZHWCC2V4YW1wbGUubmV0ggtleGFtcGxl\nLm9yZ4IPd3d3LmV4YW1wbGUuY29tgg93d3cuZXhhbXBsZS5lZHWCD3d3dy5leGFt\ncGxlLm5ldDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG\nAQUFBwMCMGsGA1UdHwRkMGIwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNv\nbS9zc2NhLXNoYTItZzYuY3JsMC+gLaArhilodHRwOi8vY3JsNC5kaWdpY2VydC5j\nb20vc3NjYS1zaGEyLWc2LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG/WwBATAqMCgG\nCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAEC\nAjB8BggrBgEFBQcBAQRwMG4wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2lj\nZXJ0LmNvbTBGBggrBgEFBQcwAoY6aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29t\nL0RpZ2lDZXJ0U0hBMlNlY3VyZVNlcnZlckNBLmNydDAMBgNVHRMBAf8EAjAAMIIB\nfwYKKwYBBAHWeQIEAgSCAW8EggFrAWkAdwCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb\n37jjd80OyA3cEAAAAWdcMZVGAAAEAwBIMEYCIQCEZIG3IR36Gkj1dq5L6EaGVycX\nsHvpO7dKV0JsooTEbAIhALuTtf4wxGTkFkx8blhTV+7sf6pFT78ORo7+cP39jkJC\nAHYAh3W/51l8+IxDmV+9827/Vo1HVjb/SrVgwbTq/16ggw8AAAFnXDGWFQAABAMA\nRzBFAiBvqnfSHKeUwGMtLrOG3UGLQIoaL3+uZsGTX3MfSJNQEQIhANL5nUiGBR6g\nl0QlCzzqzvorGXyB/yd7nttYttzo8EpOAHYAb1N2rDHwMRnYmQCkURX/dxUcEdkC\nwQApBo2yCJo32RMAAAFnXDGWnAAABAMARzBFAiEA5Hn7Q4SOyqHkT+kDsHq7ku7z\nRDuM7P4UDX2ft2Mpny0CIE13WtxJAUr0aASFYZ/XjSAMMfrB0/RxClvWVss9LHKM\nMA0GCSqGSIb3DQEBCwUAA4IBAQBzcIXvQEGnakPVeJx7VUjmvGuZhrr7DQOLeP4R\n8CmgDM1pFAvGBHiyzvCH1QGdxFl6cf7wbp7BoLCRLR/qPVXFMwUMzcE1GLBqaGZM\nv1Yh2lvZSLmMNSGRXdx113pGLCInpm/TOhfrvr0TxRImc8BdozWJavsn1N2qdHQu\nN+UBO6bQMLCD0KHEdSGFsuX6ZwAworxTg02/1qiDu7zW7RyzHvFYA4IAjpzvkPIa\nX6KjBtpdvp/aXabmL95YgBjT8WJ7pqOfrqhpcmOBZa6Cg6O1l4qbIFH/Gj9hQB5I\n0Gs4+eH6F9h3SojmPTYkT+8KuZ9w84Mn+M8qBXUQoYoKgIjN\n-----END CERTIFICATE-----\n", - "-----BEGIN CERTIFICATE-----\nMIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\nd3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD\nQTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT\nMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg\nU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\nANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83\nnf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd\nKpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f\n/ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX\nkujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0\n/RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C\nAQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY\naHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6\nLy9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1\noDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD\nQS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v\nd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh\nxtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB\nCwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl\n5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA\n8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC\n2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit\nc+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0\nj6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz\n-----END CERTIFICATE-----\n", - "-----BEGIN CERTIFICATE-----\nMIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\nd3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD\nQTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT\nMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j\nb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB\nCSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97\nnh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt\n43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P\nT19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4\ngdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO\nBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR\nTLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw\nDQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr\nhMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg\n06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF\nPnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls\nYSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk\nCAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=\n-----END CERTIFICATE-----\n" - ], - "tls.server.hash.md5": "3510C21C66BD62010FC547D3CD3F0CE6", - "tls.server.hash.sha1": "7BB698386970363D2919CC5772846984FFD4A889", - "tls.server.hash.sha256": "9250711C54DE546F4370E0C3D3A3EC45BC96092A25A4A71A1AFA396AF7047EB8", - "tls.server.issuer": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", - "tls.server.not_after": "2020-12-02T12:00:00.000Z", - "tls.server.not_before": "2018-11-28T00:00:00.000Z", - "tls.server.subject": "CN=www.example.org,OU=Technology,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US", - "tls.server.x509.alternative_names": [ - "www.example.org", - "example.com", - "example.edu", - "example.net", - "example.org", - "www.example.com", - "www.example.edu", - "www.example.net" - ], - "tls.server.x509.issuer.common_name": "DigiCert SHA2 Secure Server CA", - "tls.server.x509.issuer.country": "US", - "tls.server.x509.issuer.distinguished_name": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", - "tls.server.x509.issuer.organization": "DigiCert Inc", - "tls.server.x509.not_after": "2020-12-02T12:00:00.000Z", - "tls.server.x509.not_before": "2018-11-28T00:00:00.000Z", - "tls.server.x509.public_key_algorithm": "RSA", - "tls.server.x509.public_key_size": 2048, - "tls.server.x509.serial_number": "21020869104500376438182461249190639870", - "tls.server.x509.signature_algorithm": "SHA256-RSA", - "tls.server.x509.subject.common_name": "www.example.org", - "tls.server.x509.subject.country": "US", - "tls.server.x509.subject.distinguished_name": "CN=www.example.org,OU=Technology,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US", - "tls.server.x509.subject.locality": "Los Angeles", - "tls.server.x509.subject.organization": "Internet Corporation for Assigned Names and Numbers", - "tls.server.x509.subject.organizational_unit": "Technology", - "tls.server.x509.subject.state_or_province": "California", - "tls.server.x509.version_number": 3, - "tls.version": "1.2", - "tls.version_protocol": "tls", - "type": "tls" - } -] + { + "@metadata.beat": "packetbeat", + "@metadata.type": "_doc", + "client.ip": "192.168.1.35", + "client.port": 59455, + "destination.domain": "example.net", + "destination.ip": "93.184.216.34", + "destination.port": 443, + "event.category": [ + "network" + ], + "event.dataset": "tls", + "event.duration": 364625000, + "event.kind": "event", + "event.type": [ + "connection", + "protocol" + ], + "network.community_id": "1:fx1jENdlg6r3LIvBRG3wEboWbPY=", + "network.protocol": "tls", + "network.transport": "tcp", + "network.type": "ipv4", + "related.ip": [ + "192.168.1.35", + "93.184.216.34" + ], + "server.domain": "example.net", + "server.ip": "93.184.216.34", + "server.port": 443, + "source.ip": "192.168.1.35", + "source.port": 59455, + "status": "OK", + "tls.cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "tls.client.ja3": "e6573e91e6eb777c0933c5b8f97f10cd", + "tls.client.server_name": "example.net", + "tls.client.supported_ciphers": [ + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", + "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", + "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", + "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", + "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", + "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", + "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", + "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", + "(unknown:0xff85)", + "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", + "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", + "TLS_GOSTR341001_WITH_28147_CNT_IMIT", + "TLS_RSA_WITH_AES_256_GCM_SHA384", + "TLS_RSA_WITH_AES_256_CBC_SHA256", + "TLS_RSA_WITH_AES_256_CBC_SHA", + "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", + "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", + "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", + "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", + "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", + "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", + "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", + "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", + "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", + "TLS_RSA_WITH_AES_128_GCM_SHA256", + "TLS_RSA_WITH_AES_128_CBC_SHA256", + "TLS_RSA_WITH_AES_128_CBC_SHA", + "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", + "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", + "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", + "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_RSA_WITH_3DES_EDE_CBC_SHA", + "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" + ], + "tls.detailed.client_certificate_requested": false, + "tls.detailed.client_hello.extensions.application_layer_protocol_negotiation": [ + "h2", + "http/1.1" + ], + "tls.detailed.client_hello.extensions.ec_points_formats": [ + "uncompressed" + ], + "tls.detailed.client_hello.extensions.server_name_indication": [ + "example.net" + ], + "tls.detailed.client_hello.extensions.signature_algorithms": [ + "rsa_pkcs1_sha512", + "ecdsa_secp521r1_sha512", + "(unknown:0xefef)", + "rsa_pkcs1_sha384", + "ecdsa_secp384r1_sha384", + "rsa_pkcs1_sha256", + "ecdsa_secp256r1_sha256", + "(unknown:0xeeee)", + "(unknown:0xeded)", + "(unknown:0x0301)", + "(unknown:0x0303)", + "rsa_pkcs1_sha1", + "ecdsa_sha1" + ], + "tls.detailed.client_hello.extensions.supported_groups": [ + "x25519", + "secp256r1", + "secp384r1" + ], + "tls.detailed.client_hello.random": "d7c809b4ac3a60b62f53c9d9366ca89a703d25491ff2a246a89f32f945f7b42b", + "tls.detailed.client_hello.supported_compression_methods": [ + "NULL" + ], + "tls.detailed.client_hello.version": "3.3", + "tls.detailed.server_certificate_chain": [ + { + "issuer": { + "common_name": "DigiCert Global Root CA", + "country": "US", + "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", + "organization": "DigiCert Inc", + "organizational_unit": "www.digicert.com" + }, + "not_after": "2023-03-08T12:00:00.000Z", + "not_before": "2013-03-08T12:00:00.000Z", + "public_key_algorithm": "RSA", + "public_key_size": 2048, + "serial_number": "2646203786665923649276728595390119057", + "signature_algorithm": "SHA256-RSA", + "subject": { + "common_name": "DigiCert SHA2 Secure Server CA", + "country": "US", + "distinguished_name": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", + "organization": "DigiCert Inc" + }, + "version_number": 3 + }, + { + "issuer": { + "common_name": "DigiCert Global Root CA", + "country": "US", + "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", + "organization": "DigiCert Inc", + "organizational_unit": "www.digicert.com" + }, + "not_after": "2031-11-10T00:00:00.000Z", + "not_before": "2006-11-10T00:00:00.000Z", + "public_key_algorithm": "RSA", + "public_key_size": 2048, + "serial_number": "10944719598952040374951832963794454346", + "signature_algorithm": "SHA1-RSA", + "subject": { + "common_name": "DigiCert Global Root CA", + "country": "US", + "distinguished_name": "CN=DigiCert Global Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US", + "organization": "DigiCert Inc", + "organizational_unit": "www.digicert.com" + }, + "version_number": 3 + } + ], + "tls.detailed.server_hello.extensions._unparsed_": [ + "renegotiation_info", + "server_name_indication" + ], + "tls.detailed.server_hello.extensions.application_layer_protocol_negotiation": [ + "h2" + ], + "tls.detailed.server_hello.extensions.ec_points_formats": [ + "uncompressed", + "ansiX962_compressed_prime", + "ansiX962_compressed_char2" + ], + "tls.detailed.server_hello.random": "d1fd553a5a270f08e09eda6690fb3c8f9884e9a9fe7949e9444f574e47524401", + "tls.detailed.server_hello.selected_compression_method": "NULL", + "tls.detailed.server_hello.session_id": "23bb2aed5d215e1228220b0a51d7aa220785e9e4b83b4f430229117971e9913f", + "tls.detailed.server_hello.version": "3.3", + "tls.detailed.version": "TLS 1.2", + "tls.established": true, + "tls.next_protocol": "h2", + "tls.resumed": false, + "tls.server.certificate_chain": [ + "-----BEGIN CERTIFICATE-----\nMIIHQDCCBiigAwIBAgIQD9B43Ujxor1NDyupa2A4/jANBgkqhkiG9w0BAQsFADBN\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E\naWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTgxMTI4MDAwMDAwWhcN\nMjAxMjAyMTIwMDAwWjCBpTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju\naWExFDASBgNVBAcTC0xvcyBBbmdlbGVzMTwwOgYDVQQKEzNJbnRlcm5ldCBDb3Jw\nb3JhdGlvbiBmb3IgQXNzaWduZWQgTmFtZXMgYW5kIE51bWJlcnMxEzARBgNVBAsT\nClRlY2hub2xvZ3kxGDAWBgNVBAMTD3d3dy5leGFtcGxlLm9yZzCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBANDwEnSgliByCGUZElpdStA6jGaPoCkrp9vV\nrAzPpXGSFUIVsAeSdjF11yeOTVBqddF7U14nqu3rpGA68o5FGGtFM1yFEaogEv5g\nrJ1MRY/d0w4+dw8JwoVlNMci+3QTuUKf9yH28JxEdG3J37Mfj2C3cREGkGNBnY80\neyRJRqzy8I0LSPTTkhr3okXuzOXXg38ugr1x3SgZWDNuEaE6oGpyYJIBWZ9jF3pJ\nQnucP9vTBejMh374qvyd0QVQq3WxHrogy4nUbWw3gihMxT98wRD1oKVma1NTydvt\nhcNtBfhkp8kO64/hxLHrLWgOFT/l4tz8IWQt7mkrBHjbd2XLVPkCAwEAAaOCA8Ew\nggO9MB8GA1UdIwQYMBaAFA+AYRyCMWHVLyjnjUY4tCzhxtniMB0GA1UdDgQWBBRm\nmGIC4AmRp9njNvt2xrC/oW2nvjCBgQYDVR0RBHoweIIPd3d3LmV4YW1wbGUub3Jn\nggtleGFtcGxlLmNvbYILZXhhbXBsZS5lZHWCC2V4YW1wbGUubmV0ggtleGFtcGxl\nLm9yZ4IPd3d3LmV4YW1wbGUuY29tgg93d3cuZXhhbXBsZS5lZHWCD3d3dy5leGFt\ncGxlLm5ldDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsG\nAQUFBwMCMGsGA1UdHwRkMGIwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNv\nbS9zc2NhLXNoYTItZzYuY3JsMC+gLaArhilodHRwOi8vY3JsNC5kaWdpY2VydC5j\nb20vc3NjYS1zaGEyLWc2LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG/WwBATAqMCgG\nCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAEC\nAjB8BggrBgEFBQcBAQRwMG4wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2lj\nZXJ0LmNvbTBGBggrBgEFBQcwAoY6aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29t\nL0RpZ2lDZXJ0U0hBMlNlY3VyZVNlcnZlckNBLmNydDAMBgNVHRMBAf8EAjAAMIIB\nfwYKKwYBBAHWeQIEAgSCAW8EggFrAWkAdwCkuQmQtBhYFIe7E6LMZ3AKPDWYBPkb\n37jjd80OyA3cEAAAAWdcMZVGAAAEAwBIMEYCIQCEZIG3IR36Gkj1dq5L6EaGVycX\nsHvpO7dKV0JsooTEbAIhALuTtf4wxGTkFkx8blhTV+7sf6pFT78ORo7+cP39jkJC\nAHYAh3W/51l8+IxDmV+9827/Vo1HVjb/SrVgwbTq/16ggw8AAAFnXDGWFQAABAMA\nRzBFAiBvqnfSHKeUwGMtLrOG3UGLQIoaL3+uZsGTX3MfSJNQEQIhANL5nUiGBR6g\nl0QlCzzqzvorGXyB/yd7nttYttzo8EpOAHYAb1N2rDHwMRnYmQCkURX/dxUcEdkC\nwQApBo2yCJo32RMAAAFnXDGWnAAABAMARzBFAiEA5Hn7Q4SOyqHkT+kDsHq7ku7z\nRDuM7P4UDX2ft2Mpny0CIE13WtxJAUr0aASFYZ/XjSAMMfrB0/RxClvWVss9LHKM\nMA0GCSqGSIb3DQEBCwUAA4IBAQBzcIXvQEGnakPVeJx7VUjmvGuZhrr7DQOLeP4R\n8CmgDM1pFAvGBHiyzvCH1QGdxFl6cf7wbp7BoLCRLR/qPVXFMwUMzcE1GLBqaGZM\nv1Yh2lvZSLmMNSGRXdx113pGLCInpm/TOhfrvr0TxRImc8BdozWJavsn1N2qdHQu\nN+UBO6bQMLCD0KHEdSGFsuX6ZwAworxTg02/1qiDu7zW7RyzHvFYA4IAjpzvkPIa\nX6KjBtpdvp/aXabmL95YgBjT8WJ7pqOfrqhpcmOBZa6Cg6O1l4qbIFH/Gj9hQB5I\n0Gs4+eH6F9h3SojmPTYkT+8KuZ9w84Mn+M8qBXUQoYoKgIjN\n-----END CERTIFICATE-----\n", + "-----BEGIN CERTIFICATE-----\nMIIElDCCA3ygAwIBAgIQAf2j627KdciIQ4tyS8+8kTANBgkqhkiG9w0BAQsFADBh\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\nd3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD\nQTAeFw0xMzAzMDgxMjAwMDBaFw0yMzAzMDgxMjAwMDBaME0xCzAJBgNVBAYTAlVT\nMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg\nU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\nANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83\nnf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd\nKpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f\n/ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX\nkujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0\n/RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAVowggFWMBIGA1UdEwEB/wQIMAYBAf8C\nAQAwDgYDVR0PAQH/BAQDAgGGMDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYY\naHR0cDovL29jc3AuZGlnaWNlcnQuY29tMHsGA1UdHwR0MHIwN6A1oDOGMWh0dHA6\nLy9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcmwwN6A1\noDOGMWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RD\nQS5jcmwwPQYDVR0gBDYwNDAyBgRVHSAAMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8v\nd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwHQYDVR0OBBYEFA+AYRyCMWHVLyjnjUY4tCzh\nxtniMB8GA1UdIwQYMBaAFAPeUDVW0Uy7ZvCj4hsbw5eyPdFVMA0GCSqGSIb3DQEB\nCwUAA4IBAQAjPt9L0jFCpbZ+QlwaRMxp0Wi0XUvgBCFsS+JtzLHgl4+mUwnNqipl\n5TlPHoOlblyYoiQm5vuh7ZPHLgLGTUq/sELfeNqzqPlt/yGFUzZgTHbO7Djc1lGA\n8MXW5dRNJ2Srm8c+cftIl7gzbckTB+6WohsYFfZcTEDts8Ls/3HB40f/1LkAtDdC\n2iDJ6m6K7hQGrn2iWZiIqBtvLfTyyRRfJs8sjX7tN8Cp1Tm5gr8ZDOo0rwAhaPit\nc+LJMto4JQtV05od8GiG7S5BNO98pVAdvzr508EIDObtHopYJeS4d60tbvVS3bR0\nj6tJLp07kzQoH3jOlOrHvdPJbRzeXDLz\n-----END CERTIFICATE-----\n", + "-----BEGIN CERTIFICATE-----\nMIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\nd3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD\nQTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT\nMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j\nb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB\nCSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97\nnh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt\n43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P\nT19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4\ngdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO\nBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR\nTLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw\nDQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr\nhMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg\n06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF\nPnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls\nYSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk\nCAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=\n-----END CERTIFICATE-----\n" + ], + "tls.server.hash.md5": "3510C21C66BD62010FC547D3CD3F0CE6", + "tls.server.hash.sha1": "7BB698386970363D2919CC5772846984FFD4A889", + "tls.server.hash.sha256": "9250711C54DE546F4370E0C3D3A3EC45BC96092A25A4A71A1AFA396AF7047EB8", + "tls.server.issuer": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", + "tls.server.not_after": "2020-12-02T12:00:00.000Z", + "tls.server.not_before": "2018-11-28T00:00:00.000Z", + "tls.server.subject": "CN=www.example.org,OU=Technology,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US", + "tls.server.x509.alternative_names": [ + "www.example.org", + "example.com", + "example.edu", + "example.net", + "example.org", + "www.example.com", + "www.example.edu", + "www.example.net" + ], + "tls.server.x509.issuer.common_name": "DigiCert SHA2 Secure Server CA", + "tls.server.x509.issuer.country": "US", + "tls.server.x509.issuer.distinguished_name": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", + "tls.server.x509.issuer.organization": "DigiCert Inc", + "tls.server.x509.not_after": "2020-12-02T12:00:00.000Z", + "tls.server.x509.not_before": "2018-11-28T00:00:00.000Z", + "tls.server.x509.public_key_algorithm": "RSA", + "tls.server.x509.public_key_size": 2048, + "tls.server.x509.serial_number": "21020869104500376438182461249190639870", + "tls.server.x509.signature_algorithm": "SHA256-RSA", + "tls.server.x509.subject.common_name": "www.example.org", + "tls.server.x509.subject.country": "US", + "tls.server.x509.subject.distinguished_name": "CN=www.example.org,OU=Technology,O=Internet Corporation for Assigned Names and Numbers,L=Los Angeles,ST=California,C=US", + "tls.server.x509.subject.locality": "Los Angeles", + "tls.server.x509.subject.organization": "Internet Corporation for Assigned Names and Numbers", + "tls.server.x509.subject.organizational_unit": "Technology", + "tls.server.x509.subject.state_or_province": "California", + "tls.server.x509.version_number": 3, + "tls.version": "1.2", + "tls.version_protocol": "tls", + "type": "tls" + } +] \ No newline at end of file diff --git a/packetbeat/tests/system/golden/tls_no_certs-expected.json b/packetbeat/tests/system/golden/tls_no_certs-expected.json index d1907c51cbc0..545bdefc128e 100644 --- a/packetbeat/tests/system/golden/tls_no_certs-expected.json +++ b/packetbeat/tests/system/golden/tls_no_certs-expected.json @@ -109,6 +109,7 @@ "secp256r1", "secp384r1" ], + "tls.detailed.client_hello.random": "d7c809b4ac3a60b62f53c9d9366ca89a703d25491ff2a246a89f32f945f7b42b", "tls.detailed.client_hello.supported_compression_methods": [ "NULL" ], @@ -125,6 +126,7 @@ "ansiX962_compressed_prime", "ansiX962_compressed_char2" ], + "tls.detailed.server_hello.random": "d1fd553a5a270f08e09eda6690fb3c8f9884e9a9fe7949e9444f574e47524401", "tls.detailed.server_hello.selected_compression_method": "NULL", "tls.detailed.server_hello.session_id": "23bb2aed5d215e1228220b0a51d7aa220785e9e4b83b4f430229117971e9913f", "tls.detailed.server_hello.version": "3.3", From 3ed5763ace7255fee011ae1c64c80f9fe678453c Mon Sep 17 00:00:00 2001 From: Mat Schaffer Date: Tue, 1 Feb 2022 22:35:46 +0900 Subject: [PATCH 10/20] Updated dev guide instructions to work with master (#30014) filebeat fails (hangs) on 8.0 due to `Elasticsearch is too old.` so updating to 8.1 as well as fixing up expectations around authentication, ssl, and information about options and where to find logs. --- docs/devguide/contributing.asciidoc | 2 +- docs/devguide/index.asciidoc | 4 +-- docs/devguide/modules-dev-guide.asciidoc | 44 ++++++++++++++++++++++-- docs/devguide/new_protocol.asciidoc | 6 ++-- docs/devguide/testing.asciidoc | 2 ++ 5 files changed, 49 insertions(+), 9 deletions(-) diff --git a/docs/devguide/contributing.asciidoc b/docs/devguide/contributing.asciidoc index 435eb10416b2..ae9e4a1ee8e4 100644 --- a/docs/devguide/contributing.asciidoc +++ b/docs/devguide/contributing.asciidoc @@ -83,7 +83,7 @@ and documentation. The primary command used for this is: -------------------------------------------------------------------------------- make update -------------------------------------------------------------------------------- -Each Beat has its own `update` target, as well as a master `update` in the repository root. +Each Beat has its own `update` target, as well as a master `update` in the repository root. If a PR adds or removes a dependency, run `make update` in the root `beats` directory. Another command properly formats go source files and adds a copyright header: diff --git a/docs/devguide/index.asciidoc b/docs/devguide/index.asciidoc index 6810240121c2..2f9af959ce1d 100644 --- a/docs/devguide/index.asciidoc +++ b/docs/devguide/index.asciidoc @@ -19,6 +19,8 @@ include::./pull-request-guidelines.asciidoc[] include::./contributing.asciidoc[] +include::./testing.asciidoc[] + include::{libbeat-dir}/communitybeats.asciidoc[] include::./fields-yml.asciidoc[] @@ -36,5 +38,3 @@ include::./metricbeat-devguide.asciidoc[] include::./modules-dev-guide.asciidoc[] include::./migrate-dashboards.asciidoc[] - - diff --git a/docs/devguide/modules-dev-guide.asciidoc b/docs/devguide/modules-dev-guide.asciidoc index 03b3179c596e..ee264b157412 100644 --- a/docs/devguide/modules-dev-guide.asciidoc +++ b/docs/devguide/modules-dev-guide.asciidoc @@ -485,8 +485,46 @@ run. In order to test the filesets with the sample logs and/or generate the expected output one should run the tests locally for a specific module, using the following procedure under Filebeat directory: -. Run an Elasticsearch instance locally using docker: `docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:8.0.0-SNAPSHOT` +. Start an Elasticsearch instance locally. For example, using Docker: ++ +[source,bash] +---- +docker run \ + --name elasticsearch \ + -p 9200:9200 -p 9300:9300 \ + -e "xpack.security.http.ssl.enabled=false" -e "ELASTIC_PASSWORD=changeme" \ + -e "discovery.type=single-node" \ + --pull allways --rm --detach \ + docker.elastic.co/elasticsearch/elasticsearch:master-SNAPSHOT +---- +. Create an "admin" user on that Elasticsearch instance: ++ +[source,bash] +---- +curl -u elastic:changeme \ + http://localhost:9200/_security/user/admin \ + -X POST -H 'Content-Type: application/json' \ + -d '{"password": "changeme", "roles": ["superuser"]}' +---- +. Create the testing binary: `make filebeat.test` +. Update fields yaml: `make update` . Create python env: `make python-env` . Source python env: `source ./build/python-env/bin/activate` -. Create the testing binary: `make filebeat.test` -. Run the test, ie: `GENERATE=1 INTEGRATION_TESTS=1 BEAT_STRICT_PERMS=false TESTING_FILEBEAT_MODULES=nginx pytest tests/system/test_modules.py` +. Run a test, for example to check nginx access log parsing: ++ +[source,bash] +---- +INTEGRATION_TESTS=1 BEAT_STRICT_PERMS=false ES_PASS=changeme \ +TESTING_FILEBEAT_MODULES=nginx \ +pytest tests/system/test_modules.py -v --full-trace +---- +. Add and remove option env vars as required. Here are some useful ones: +* `TESTING_FILEBEAT_ALLOW_OLDER`: if set to 1, allow connecting older versions of Elasticsearch +* `TESTING_FILEBEAT_MODULES`: comma separated list of modules to test. +* `TESTING_FILEBEAT_FILESETS`: comma separated list of filesets to test. +* `TESTING_FILEBEAT_FILEPATTERN`: glob pattern for log files within the fileset to test. +* `GENERATE`: if set to 1, the expected documents will be generated. + +The filebeat logs are writen to the `build` directory. It may be useful to tail them in another terminal using `tail -F build/system-tests/run/test_modules.Test.*/output.log`. + +For example if there's a syntax error in an ingest pipeline, the test will probably just hang. The filebeat log output will contain the error message from elasticsearch. diff --git a/docs/devguide/new_protocol.asciidoc b/docs/devguide/new_protocol.asciidoc index c653ff863160..defd50c0bc3f 100644 --- a/docs/devguide/new_protocol.asciidoc +++ b/docs/devguide/new_protocol.asciidoc @@ -5,7 +5,7 @@ The following topics describe how to add a new protocol to Packetbeat: * <> * <> -* <> +* <> [[getting-ready-new-protocol]] === Getting Ready @@ -95,7 +95,7 @@ We are working on updating this section. While you're waiting for updates, you might want to try out the TCP protocol generator at https://github.com/elastic/beats/tree/master/packetbeat/scripts/tcp-protocol. -[[testing]] +[[protocol-testing]] === Testing -We are working on updating this section. +We are working on updating this section. diff --git a/docs/devguide/testing.asciidoc b/docs/devguide/testing.asciidoc index 75a476d5c5a2..4f8a138beb31 100644 --- a/docs/devguide/testing.asciidoc +++ b/docs/devguide/testing.asciidoc @@ -34,6 +34,8 @@ To run the tests without the services running locally, the command `make system- All Python tests are under `tests/system` directory. +Filebeat's module python tests have additional documentation found in the <> guide. + ==== Test commands This is a quick summary of the available test commands: From 174ada30dff2ea45cf5066a3d8f93d8f6fade336 Mon Sep 17 00:00:00 2001 From: Manoj Shetty <97392538+ManojS-shetty@users.noreply.github.com> Date: Tue, 1 Feb 2022 19:28:19 +0530 Subject: [PATCH 11/20] mssql-doc updated with the list of tables which should have permission (#30137) --- metricbeat/docs/modules/mssql.asciidoc | 15 +++++++++++++++ .../metricbeat/module/mssql/_meta/docs.asciidoc | 15 +++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/metricbeat/docs/modules/mssql.asciidoc b/metricbeat/docs/modules/mssql.asciidoc index bd060e343845..313cb43f4338 100644 --- a/metricbeat/docs/modules/mssql.asciidoc +++ b/metricbeat/docs/modules/mssql.asciidoc @@ -15,6 +15,21 @@ This is the https://www.microsoft.com/en-us/sql-server/sql-server-2017[Microsoft The module is being tested with https://hub.docker.com/r/microsoft/mssql-server-linux/[2017 GA] version under Linux +[float] +=== Permission/Access required for tables + +1.`transaction_log` : + +* sys.databases +* sys.dm_db_log_space_usage +* sys.dm_db_log_stats(DB_ID) + +2.`performance` : + +* sys.dm_os_performance_counters + +If you browse MSDN for above tables, you will find "Permissions" section which defines the permission needed, e.g https://docs.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-space-usage-transact-sql?view=sql-server-ver15[Permissions] + [float] === Metricsets diff --git a/x-pack/metricbeat/module/mssql/_meta/docs.asciidoc b/x-pack/metricbeat/module/mssql/_meta/docs.asciidoc index ad32544a465a..43c22236c79a 100644 --- a/x-pack/metricbeat/module/mssql/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/mssql/_meta/docs.asciidoc @@ -5,6 +5,21 @@ This is the https://www.microsoft.com/en-us/sql-server/sql-server-2017[Microsoft The module is being tested with https://hub.docker.com/r/microsoft/mssql-server-linux/[2017 GA] version under Linux +[float] +=== Permission/Access required for tables + +1.`transaction_log` : + +* sys.databases +* sys.dm_db_log_space_usage +* sys.dm_db_log_stats(DB_ID) + +2.`performance` : + +* sys.dm_os_performance_counters + +If you browse MSDN for above tables, you will find "Permissions" section which defines the permission needed, e.g https://docs.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-space-usage-transact-sql?view=sql-server-ver15[Permissions] + [float] === Metricsets From 6f3f09d524ea9622df4c9f655ee4cc54e86139fc Mon Sep 17 00:00:00 2001 From: Andres Rodriguez Date: Tue, 1 Feb 2022 15:54:13 +0100 Subject: [PATCH 12/20] Forward port 7.17.0 and 8.0.0-rc2 changelogs to master (#30136) * 8.0.0-rc2 Changelog (#30112) (cherry picked from commit 9040ee1a377b69e4e9b71dc238f8dc142044c85a) * Forward port 7.17.0 changelog to 8.0 (#30133) * docs: Prepare Changelog for 7.17.0 (#30111) * docs: Close changelog for 7.17.0 * Fix entries that did not make the BC * Missing base docker image change * Clean up breaking changes * More clean up breaking changes * Remove empty sections Co-authored-by: Andres Rodriguez (cherry picked from commit 3026dfd2b540e73440e3cdadc5dd55ace19b64ec) * Addiional cleanup * Addiional cleanup * Additional cleanup * Unsaved file Co-authored-by: Elastic Machine (cherry picked from commit 3b14388a72c14ed35fc900ff227fae0fce7374b0) * Additional cleanup --- CHANGELOG.asciidoc | 88 +++++++++++++++++++++++++++++++++-- CHANGELOG.next.asciidoc | 39 ++-------------- libbeat/docs/release.asciidoc | 2 + 3 files changed, 91 insertions(+), 38 deletions(-) diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index c61cdbccb99b..84873fa1c3ab 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -3,25 +3,105 @@ :issue: https://github.com/elastic/beats/issues/ :pull: https://github.com/elastic/beats/pull/ +[[release-notes-8.0.0-rc2]] +=== Beats version 8.0.0-rc2 + +Changes will be described in the GA release. + [[release-notes-8.0.0-rc1]] === Beats version 8.0.0-rc1 -Changes will be described in a later RC / GA. +Changes will be described in the GA release. [[release-notes-8.0.0-beta1]] === Beats version 8.0.0-beta1 -Changes will be described in a later RC / GA. +Changes will be described in the GA release. [[release-notes-8.0.0-alpha2]] === Beats version 8.0.0-alpha2 -Changes will be described in a later alpha / beta. +Changes will be described in the GA release. [[release-notes-8.0.0-alpha1]] === Beats version 8.0.0-alpha1 -Changes will be described in a later alpha / beta. +Changes will be described in the GA release. + +[[release-notes-7.17.0]] +=== Beats version 7.17.0 +https://github.com/elastic/beats/compare/v7.16.3...v7.17.0[View commits] + +==== Breaking changes + +*Affecting all Beats* + +- Change Docker base image from CentOS 7 to Ubuntu 20.04 {pull}29681[29681] + +==== Bugfixes + +*Affecting all Beats* + +- Enrich kubernetes metadata with node annotations. {pull}29605[29605] + +*Auditbeat* + +- system/socket: Fix startup errors on newer 5.x kernels due to missing _do_fork function. {issue}29607[29607] {pull}29744[29744] +- system/package: Fix parsing of Installed-Size field of DEB packages. {issue}16661[16661] {pull}17188[17188] +- system module: Fix panic during initialisation when /proc/stat can't be read. {pull}17569[17569] +- system/package: Fix an error that can occur while trying to persist package metadata. {issue}18536[18536] {pull}18887[18887] +- system/socket: Fix bugs leading to wrong process being attributed to flows. {pull}29166[29166] {issue}17165[17165] +- system/socket: Fix process name and arg truncation for long names, paths and args lists. {issue}24667[24667] {pull}29410[29410] + +*Filebeat* + +- aws-s3: Stop trying to increase SQS message visibility after ReceiptHandleIsInvalid errors. {pull}29480[29480] +- Fix handling of IPv6 addresses in netflow flow events. {issue}19210[19210] {pull}29383[29383] +- Fix `sophos` KV splitting and syslog header handling {issue}24237[24237] {pull}29331[29331] +- Undo deletion of endpoint config from cloudtrail fileset in {pull}29415[29415]. {pull}29450[29450] +- Make Cisco ASA and FTD modules conform to the ECS definition for event.outcome and event.type. {issue}29581[29581] {pull}29698[29698] +- ibmmq: Fixed `@timestamp` not being populated with correct values. {pull}29773[29773] +- aws-s3: Improve gzip detection to avoid false negatives. {issue}29968[29968] +- decode_cef: Fix panic when recovering from invalid CEF extensions that contain escape characters. {issue}30010[30010] + +*Heartbeat* + +- Fix race condition in http monitors using `mode:all` that can cause crashes. {pull}29697[pull] +- Fix broken ICMP availability check that prevented heartbeat from starting in rare cases. {pull}29413[pull] +- Fix broken macOS ICMP python e2e test. {pull}29900[29900] +- Only add monitor.status to browser events when summary. {pull}29460[29460] +- Also add summary to journeys for which the synthetics runner crashes. {pull}29606[29606] +- Update size of ICMP packets to adhere to standard min size. {pull}29948[29948] + +*Metricbeat* + +- Use xpack.enabled on SM modules to write into .monitoring indices when using Metricbeat standalone {pull}28365[28365] +- Fix in rename processor to ingest metrics for `write.iops` to proper field instead of `write_iops` in rds metricset. {pull}28960[28960] +- Enhance filter check in kubernetes event metricset. {pull}29470[29470] +- Fix gcp metrics metricset apply aligner to all metric_types {pull}29514[29513] +- Fixed GCP GKE Overview dashboard {pull}29913[29913] +- Remove overriding of index pattern on the Kubernetes overview dashboard. {pull}29676[29676] + +==== Added + +*Affecting all Beats* + +- SASL/SCRAM in the Kafka output is no longer beta. {pull}29126[29126] +- Add job.name in pods controlled by Jobs {pull}28954[28954] + +*Heartbeat* + +- More errors are now visible in ES with new logic failing monitors later to ease debugging. {pull}29413[pull] + +*Winlogbeat* + +- Add support for custom XML queries {issue}1054[1054] {pull}29330[29330] + +==== Deprecated + +==== Known Issue + + [[release-notes-7.16.3]] === Beats version 7.16.3 https://github.com/elastic/beats/compare/v7.16.2...v7.16.3[View commits] diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index b0a6d02bb0a4..507ef05a9785 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -26,11 +26,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Index template's default_fields setting is only populated with ECS fields. {pull}28596[28596] {issue}28215[28215] - Remove deprecated `--template` and `--ilm-policy` flags. Use `--index-management` instead. {pull}28870[28870] - Remove options `logging.files.suffix` and default to datetime endings. {pull}28927[28927] -- Remove Journalbeat. Use `journald` input of Filebeat instead. {pull}29131[29131] - `include_matches` option of `journald` input no longer accepts a list of string. {pull}29294[29294] -- Add job.name in pods controlled by Jobs {pull}28954[28954] -- Change Docker base image from CentOS 7 to Ubuntu 20.04 {pull}29681[29681] -- Enrich kubernetes metadata with node annotations. {pull}29605[29605] - Allign kubernetes configuration settings. {pull}29908[29908] - Remove legacy support for SSLv3. {pull}30071[30071] - `add_fields` processor is now able to set metadata in events {pull}30092[30092] @@ -50,10 +46,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Remove deprecated old awscloudwatch input name. {pull}29844[29844] *Heartbeat* -- Fix broken macOS ICMP python e2e test. {pull}29900[29900] -- Only add monitor.status to browser events when summary. {pull}29460[29460] -- Also add summary to journeys for which the synthetics runner crashes. {pull}29606[29606] -- Update size of ICMP packets to adhere to standard min size. {pull}29948[29948] + - Add fonts to support more different types of characters for multiple languages. {pull}29606[29861] *Metricbeat* @@ -67,9 +60,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Remove deprecated config option perfmon.counters from windows/perfmon metricset. {pull}28282[28282] - Remove deprecated fields in Redis module. {issue}11835[11835] {pull}28246[28246] - system/process metricset: Replace usage of deprecated `process.ppid` field with `process.parent.pid`. {pull}28620[28620] -- Remove overriding of index pattern on the Kubernetes overview dashboard. {pull}29676[29676] -*Packetbeat* + *Packetbeat* - Redis: fix incorrectly handle with two-words redis command. {issue}14872[14872] {pull}14873[14873] - `event.category` no longer contains the value `network_traffic` because this is not a valid ECS event category value. {pull}20556[20556] @@ -98,41 +90,21 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Auditbeat* -- system/package: Fix parsing of Installed-Size field of DEB packages. {issue}16661[16661] {pull}17188[17188] -- system module: Fix panic during initialisation when /proc/stat can't be read. {pull}17569[17569] -- system/package: Fix an error that can occur while trying to persist package metadata. {issue}18536[18536] {pull}18887[18887] -- system/socket: Fix bugs leading to wrong process being attributed to flows. {pull}29166[29166] {issue}17165[17165] -- system/socket: Fix process name and arg truncation for long names, paths and args lists. {issue}24667[24667] {pull}29410[29410] -- system/socket: Fix startup errors on newer 5.x kernels due to missing _do_fork function. {issue}29607[29607] {pull}29744[29744] - libbeat/processors/add_process_metadata: Fix memory leak in process cache. {issue}24890[24890] {pull}29717[29717] - auditd: Add error.message to events when processing fails. {pull}30009[30009] *Filebeat* -- aws-s3: Stop trying to increase SQS message visibility after ReceiptHandleIsInvalid errors. {pull}29480[29480] -- Fix handling of IPv6 addresses in netflow flow events. {issue}19210[19210] {pull}29383[29383] -- Fix `sophos` KV splitting and syslog header handling {issue}24237[24237] {pull}29331[29331] -- Undo deletion of endpoint config from cloudtrail fileset in {pull}29415[29415]. {pull}29450[29450] -- Make Cisco ASA and FTD modules conform to the ECS definition for event.outcome and event.type. {issue}29581[29581] {pull}29698[29698] -- ibmmq: Fixed `@timestamp` not being populated with correct values. {pull}29773[29773] - Fix using log_group_name_prefix in aws-cloudwatch input. {pull}29695[29695] -- aws-s3: Improve gzip detection to avoid false negatives. {issue}29968[29968] -- decode_cef: Fix panic when recovering from invalid CEF extensions that contain escape characters. {issue}30010[30010] *Heartbeat* -- Fix race condition in http monitors using `mode:all` that can cause crashes. {pull}29697[pull] -- Fix broken ICMP availability check that prevented heartbeat from starting in rare cases. {pull}29413[pull] +- Add fonts to support more different types of characters for multiple languages. {pull}29861[29861] *Metricbeat* -- Use xpack.enabled on SM modules to write into .monitoring indices when using Metricbeat standalone {pull}28365[28365] -- Fix in rename processor to ingest metrics for `write.iops` to proper field instead of `write_iops` in rds metricset. {pull}28960[28960] -- Enhance filter check in kubernetes event metricset. {pull}29470[29470] -- Fix gcp metrics metricset apply aligner to all metric_types {pull}29514[29513] - Extract correct index property in kibana.stats metricset {pull}29622[29622] - Fixed bug with `elasticsearch/cluster_stats` metricset not recording license expiration date correctly. {pull}29711[29711] -- Fixed GCP GKE Overview dashboard {pull}29913[29913] *Packetbeat* @@ -161,11 +133,12 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Support self signed certificates on outputs {pull}29229[29229] - Update k8s library {pull}29394[29394] - Add FIPS configuration option for all AWS API calls. {pull}28899[28899] -- Add `default_region` config to AWS common module. {pull}29415[29415] - Add support for latest k8s versions v1.23 and v1.22 {pull}29575[29575] - Add `script` processor to all beats {issue}29269[29269] {pull}29752[29752] - Only connect to Elasticsearch instances with the same version or newer. {pull}29683[29683] - Move umask from code to service files. {pull}29708[29708] +- Add FIPS configuration option for all AWS API calls. {pull}[28899] +- Warn users when connecting to older versions of Elasticsearch instances. {pull}29723[29723] *Auditbeat* @@ -185,7 +158,6 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Heartbeat* -- More errors are now visible in ES with new logic failing monitors later to ease debugging. {pull}29413[pull] *Metricbeat* @@ -213,7 +185,6 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Winlogbeat* -- Add support for custom XML queries {issue}1054[1054] {pull}29330[29330] - Add support for sysmon event ID 26; FileDeleteDetected. {issue}26280[26280] {pull}29957[29957] *Elastic Log Driver* diff --git a/libbeat/docs/release.asciidoc b/libbeat/docs/release.asciidoc index 0255a23c6988..313fb5432bdf 100644 --- a/libbeat/docs/release.asciidoc +++ b/libbeat/docs/release.asciidoc @@ -8,10 +8,12 @@ This section summarizes the changes in each release. Also read <> for more detail about changes that affect upgrade. +* <> * <> * <> * <> * <> +* <> * <> * <> * <> From 3c2072d8d2fc52d842aa301ab3a4cd1de1eb3710 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 1 Feb 2022 17:49:28 +0100 Subject: [PATCH 13/20] Load inputs from external configuration files in Elastic Agent in standalone mode (#30087) ## What does this PR do? This PR adds support for loading external configuration files to load inputs when running Agent in standalone mode. Users have to put their configuration files into `{path.config}/inputs.d` with the extension `yml`. When it is configured, Agent takes the `inputs` configuration from the last standalone configuration and appends the inputs from the external configuration files to it. When the standalone configurations are reloaded, external input configurations are reloaded as well. The external configuration file must include `inputs`, otherwise the file is invalid. Example for correct file: ```yaml inputs: - data_stream: dataset: system.auth type: logs id: logfile-system.auth-my-id paths: - /var/log/auth.log* use_output: default ``` ## Why is it important? Users can configure external configuration files, similar to Filebeat. So managing configuration can be done by Git or Chef instead of Fleet. --- .../_meta/config/common.reference.p2.yml.tmpl | 2 +- .../elastic-agent/elastic-agent.reference.yml | 2 +- .../application/fleet_server_bootstrap.go | 3 +- .../pkg/agent/application/local_mode.go | 13 +- .../pkg/agent/application/once.go | 11 +- .../pkg/agent/application/periodic.go | 6 +- .../pkg/agent/configuration/settings.go | 5 + x-pack/elastic-agent/pkg/config/loader.go | 104 +++++++++ .../elastic-agent/pkg/config/loader_test.go | 212 ++++++++++++++++++ .../config/testdata/inputs/invalid-inputs.yml | 5 + .../pkg/config/testdata/inputs/log-inputs.yml | 20 ++ .../config/testdata/inputs/metrics-inputs.yml | 16 ++ .../testdata/standalone-with-inputs.yml | 13 ++ .../pkg/config/testdata/standalone1.yml | 6 + .../pkg/config/testdata/standalone2.yml | 3 + 15 files changed, 409 insertions(+), 12 deletions(-) create mode 100644 x-pack/elastic-agent/pkg/config/loader.go create mode 100644 x-pack/elastic-agent/pkg/config/loader_test.go create mode 100644 x-pack/elastic-agent/pkg/config/testdata/inputs/invalid-inputs.yml create mode 100644 x-pack/elastic-agent/pkg/config/testdata/inputs/log-inputs.yml create mode 100644 x-pack/elastic-agent/pkg/config/testdata/inputs/metrics-inputs.yml create mode 100644 x-pack/elastic-agent/pkg/config/testdata/standalone-with-inputs.yml create mode 100644 x-pack/elastic-agent/pkg/config/testdata/standalone1.yml create mode 100644 x-pack/elastic-agent/pkg/config/testdata/standalone2.yml diff --git a/x-pack/elastic-agent/_meta/config/common.reference.p2.yml.tmpl b/x-pack/elastic-agent/_meta/config/common.reference.p2.yml.tmpl index bfb84102e3ca..5daf9d81432b 100644 --- a/x-pack/elastic-agent/_meta/config/common.reference.p2.yml.tmpl +++ b/x-pack/elastic-agent/_meta/config/common.reference.p2.yml.tmpl @@ -121,7 +121,7 @@ inputs: # port: 6791 # # Allow fleet to reload its configuration locally on disk. -# # Notes: Only specific process configuration will be reloaded. +# # Notes: Only specific process configuration and external input configurations will be reloaded. # agent.reload: # # enabled configure the Elastic Agent to reload or not the local configuration. # # diff --git a/x-pack/elastic-agent/elastic-agent.reference.yml b/x-pack/elastic-agent/elastic-agent.reference.yml index 7770b036dbaa..7b2d5ea586c3 100644 --- a/x-pack/elastic-agent/elastic-agent.reference.yml +++ b/x-pack/elastic-agent/elastic-agent.reference.yml @@ -127,7 +127,7 @@ inputs: # port: 6791 # # Allow fleet to reload its configuration locally on disk. -# # Notes: Only specific process configuration will be reloaded. +# # Notes: Only specific process configuration and external input configurations will be reloaded. # agent.reload: # # enabled configure the Elastic Agent to reload or not the local configuration. # # diff --git a/x-pack/elastic-agent/pkg/agent/application/fleet_server_bootstrap.go b/x-pack/elastic-agent/pkg/agent/application/fleet_server_bootstrap.go index 89cb816fec93..76ff369ef6aa 100644 --- a/x-pack/elastic-agent/pkg/agent/application/fleet_server_bootstrap.go +++ b/x-pack/elastic-agent/pkg/agent/application/fleet_server_bootstrap.go @@ -118,8 +118,9 @@ func newFleetServerBootstrap( return nil, err } + loader := config.NewLoader(log, "") discover := discoverer(pathConfigFile, cfg.Settings.Path) - bootstrapApp.source = newOnce(log, discover, emit) + bootstrapApp.source = newOnce(log, discover, loader, emit) return bootstrapApp, nil } diff --git a/x-pack/elastic-agent/pkg/agent/application/local_mode.go b/x-pack/elastic-agent/pkg/agent/application/local_mode.go index a29977f2e8d0..ca8284cdf8e8 100644 --- a/x-pack/elastic-agent/pkg/agent/application/local_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/local_mode.go @@ -6,6 +6,7 @@ package application import ( "context" + "path/filepath" "go.elastic.co/apm" @@ -117,7 +118,7 @@ func newLocal( return nil, errors.New(err, "failed to initialize composable controller") } - discover := discoverer(pathConfigFile, cfg.Settings.Path) + discover := discoverer(pathConfigFile, cfg.Settings.Path, configuration.ExternalInputsPattern) emit, err := emitter.New( localApplication.bgContext, log, @@ -135,13 +136,15 @@ func newLocal( return nil, err } + loader := config.NewLoader(log, externalConfigsGlob()) + var cfgSource source if !cfg.Settings.Reload.Enabled { log.Debug("Reloading of configuration is off") - cfgSource = newOnce(log, discover, emit) + cfgSource = newOnce(log, discover, loader, emit) } else { log.Debugf("Reloading of configuration is on, frequency is set to %s", cfg.Settings.Reload.Period) - cfgSource = newPeriodic(log, cfg.Settings.Reload.Period, discover, emit) + cfgSource = newPeriodic(log, cfg.Settings.Reload.Period, discover, loader, emit) } localApplication.source = cfgSource @@ -161,6 +164,10 @@ func newLocal( return localApplication, nil } +func externalConfigsGlob() string { + return filepath.Join(paths.Config(), configuration.ExternalInputsPattern) +} + // Routes returns a list of routes handled by agent. func (l *Local) Routes() *sorted.Set { return l.router.Routes() diff --git a/x-pack/elastic-agent/pkg/agent/application/once.go b/x-pack/elastic-agent/pkg/agent/application/once.go index 64ee34e25902..db4af015608d 100644 --- a/x-pack/elastic-agent/pkg/agent/application/once.go +++ b/x-pack/elastic-agent/pkg/agent/application/once.go @@ -16,11 +16,12 @@ import ( type once struct { log *logger.Logger discover discoverFunc + loader *config.Loader emitter pipeline.EmitterFunc } -func newOnce(log *logger.Logger, discover discoverFunc, emitter pipeline.EmitterFunc) *once { - return &once{log: log, discover: discover, emitter: emitter} +func newOnce(log *logger.Logger, discover discoverFunc, loader *config.Loader, emitter pipeline.EmitterFunc) *once { + return &once{log: log, discover: discover, loader: loader, emitter: emitter} } func (o *once) Start() error { @@ -33,15 +34,15 @@ func (o *once) Start() error { return ErrNoConfiguration } - return readfiles(context.Background(), files, o.emitter) + return readfiles(context.Background(), files, o.loader, o.emitter) } func (o *once) Stop() error { return nil } -func readfiles(ctx context.Context, files []string, emitter pipeline.EmitterFunc) error { - c, err := config.LoadFiles(files...) +func readfiles(ctx context.Context, files []string, loader *config.Loader, emitter pipeline.EmitterFunc) error { + c, err := loader.Load(files) if err != nil { return errors.New(err, "could not load or merge configuration", errors.TypeConfig) } diff --git a/x-pack/elastic-agent/pkg/agent/application/periodic.go b/x-pack/elastic-agent/pkg/agent/application/periodic.go index f79c09b6e681..119e616bf28e 100644 --- a/x-pack/elastic-agent/pkg/agent/application/periodic.go +++ b/x-pack/elastic-agent/pkg/agent/application/periodic.go @@ -11,6 +11,7 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/application/pipeline" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/agent/errors" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/config" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/filewatcher" ) @@ -20,6 +21,7 @@ type periodic struct { period time.Duration done chan struct{} watcher *filewatcher.Watch + loader *config.Loader emitter pipeline.EmitterFunc discover discoverFunc } @@ -90,7 +92,7 @@ func (p *periodic) work() error { p.log.Debugf("Unchanged %d files: %s", len(s.Unchanged), strings.Join(s.Updated, ", ")) } - err := readfiles(context.Background(), files, p.emitter) + err := readfiles(context.Background(), files, p.loader, p.emitter) if err != nil { // assume something when really wrong and invalidate any cache // so we get a full new config on next tick. @@ -112,6 +114,7 @@ func newPeriodic( log *logger.Logger, period time.Duration, discover discoverFunc, + loader *config.Loader, emitter pipeline.EmitterFunc, ) *periodic { w, err := filewatcher.New(log, filewatcher.DefaultComparer) @@ -127,6 +130,7 @@ func newPeriodic( done: make(chan struct{}), watcher: w, discover: discover, + loader: loader, emitter: emitter, } } diff --git a/x-pack/elastic-agent/pkg/agent/configuration/settings.go b/x-pack/elastic-agent/pkg/agent/configuration/settings.go index 3081614d9959..4f2a17dbede2 100644 --- a/x-pack/elastic-agent/pkg/agent/configuration/settings.go +++ b/x-pack/elastic-agent/pkg/agent/configuration/settings.go @@ -5,6 +5,8 @@ package configuration import ( + "path/filepath" + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/artifact" "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" monitoringCfg "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/monitoring/config" @@ -13,6 +15,9 @@ import ( "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/server" ) +// ExternalInputsPattern is a glob that matches the paths of external configuration files. +var ExternalInputsPattern = filepath.Join("inputs.d", "*.yml") + // SettingsConfig is an collection of agent settings configuration. type SettingsConfig struct { DownloadConfig *artifact.Config `yaml:"download" config:"download" json:"download"` diff --git a/x-pack/elastic-agent/pkg/config/loader.go b/x-pack/elastic-agent/pkg/config/loader.go new file mode 100644 index 000000000000..8827edd6c3ce --- /dev/null +++ b/x-pack/elastic-agent/pkg/config/loader.go @@ -0,0 +1,104 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package config + +import ( + "fmt" + "path/filepath" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" + "github.com/elastic/go-ucfg" + "github.com/elastic/go-ucfg/cfgutil" +) + +// Loader is used to load configuration from the paths +// including appending multiple input configurations. +type Loader struct { + logger *logger.Logger + inputsFolder string +} + +// NewLoader creates a new Loader instance to load configuration +// files from different paths. +func NewLoader(logger *logger.Logger, inputsFolder string) *Loader { + return &Loader{logger: logger, inputsFolder: inputsFolder} +} + +// Load iterates over the list of files and loads the confguration from them. +// If a configuration file is under the folder set in `agent.config.inputs.path` +// it is appended to a list. If it is a regular config file, it is merged into +// the result config. The list of input configurations is merged into the result +// last. +func (l *Loader) Load(files []string) (*Config, error) { + inputsList := make([]*ucfg.Config, 0) + merger := cfgutil.NewCollector(nil) + for _, f := range files { + cfg, err := LoadFile(f) + if err != nil { + if l.isFileUnderInputsFolder(f) { + return nil, fmt.Errorf("failed to load external configuration file '%s': %w. Are you sure it contains an inputs section?", f, err) + } + return nil, fmt.Errorf("failed to load configuration file '%s': %w", f, err) + } + l.logger.Debugf("Loaded configuration from %s", f) + if l.isFileUnderInputsFolder(f) { + inp, err := getInput(cfg) + if err != nil { + return nil, fmt.Errorf("cannot get configuration from '%s': %w", f, err) + } + inputsList = append(inputsList, inp...) + l.logger.Debugf("Loaded %s input(s) from configuration from %s", len(inp), f) + } else { + if err := merger.Add(cfg.access(), err); err != nil { + return nil, fmt.Errorf("failed to merge configuration file '%s' to existing one: %w", f, err) + } + l.logger.Debugf("Merged configuration from %s into result", f) + } + } + config := merger.Config() + + // if there is no input configuration, return what we have collected. + if len(inputsList) == 0 { + l.logger.Debugf("Merged all configuration files from %v, no external input files", files) + return newConfigFrom(config), nil + } + + // merge inputs sections from the last standalone configuration + // file and all files from the inputs folder + start := 0 + if config.HasField("inputs") { + var err error + start, err = config.CountField("inputs") + if err != nil { + return nil, fmt.Errorf("failed to count the number of inputs in the configuration: %w", err) + } + } + for i, ll := range inputsList { + if err := config.SetChild("inputs", start+i, ll); err != nil { + return nil, fmt.Errorf("failed to add inputs to result configuration: %w", err) + } + } + + l.logger.Debugf("Merged all configuration files from %v, with external input files", files) + return newConfigFrom(config), nil +} + +func getInput(c *Config) ([]*ucfg.Config, error) { + tmpConfig := struct { + Inputs []*ucfg.Config `config:"inputs"` + }{make([]*ucfg.Config, 0)} + + if err := c.Unpack(&tmpConfig); err != nil { + return nil, fmt.Errorf("failed to parse inputs section from configuration: %w", err) + } + return tmpConfig.Inputs, nil +} + +func (l *Loader) isFileUnderInputsFolder(f string) bool { + if matches, err := filepath.Match(l.inputsFolder, f); !matches || err != nil { + return false + } + return true +} diff --git a/x-pack/elastic-agent/pkg/config/loader_test.go b/x-pack/elastic-agent/pkg/config/loader_test.go new file mode 100644 index 000000000000..d17666226630 --- /dev/null +++ b/x-pack/elastic-agent/pkg/config/loader_test.go @@ -0,0 +1,212 @@ +// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one +// or more contributor license agreements. Licensed under the Elastic License; +// you may not use this file except in compliance with the Elastic License. + +package config + +import ( + "path/filepath" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/elastic/beats/v7/x-pack/elastic-agent/pkg/core/logger" +) + +func TestExternalConfigLoading(t *testing.T) { + cases := map[string]struct { + configs []string + inputsFolder string + expectedConfig map[string]interface{} + err bool + }{ + "non-existent config files lead to error": { + configs: []string{"no-such-configuration-file.yml"}, + err: true, + }, + "invalid configuration file in inputs folder lead to error": { + configs: []string{ + filepath.Join("testdata", "inputs", "invalid-inputs.yml"), + }, + inputsFolder: filepath.Join("testdata", "inputs", "*.yml"), + err: true, + }, + "two standalone configs can be merged without inputs": { + configs: []string{ + filepath.Join("testdata", "standalone1.yml"), + filepath.Join("testdata", "standalone2.yml"), + }, + inputsFolder: "", + expectedConfig: map[string]interface{}{ + "outputs": map[string]interface{}{ + "default": map[string]interface{}{ + "type": "elasticsearch", + "hosts": []interface{}{"127.0.0.1:9201"}, + "api-key": "my-secret-key", + }, + }, + "agent": map[string]interface{}{ + "logging": map[string]interface{}{ + "level": "debug", + "metrics": map[string]interface{}{ + "enabled": false, + }, + }, + }, + }, + }, + "one external config, standalone config without inputs section": { + configs: []string{ + filepath.Join("testdata", "standalone1.yml"), + filepath.Join("testdata", "inputs", "log-inputs.yml"), + filepath.Join("testdata", "inputs", "metrics-inputs.yml"), + }, + inputsFolder: filepath.Join("testdata", "inputs", "*.yml"), + expectedConfig: map[string]interface{}{ + "outputs": map[string]interface{}{ + "default": map[string]interface{}{ + "type": "elasticsearch", + "hosts": []interface{}{"127.0.0.1:9201"}, + "api-key": "my-secret-key", + }, + }, + "inputs": []interface{}{ + map[string]interface{}{ + "data_stream": map[string]interface{}{ + "dataset": "system.auth", + "type": "logs", + }, + "exclude_files": []interface{}{".gz$"}, + "id": "logfile-system.auth-my-id", + "paths": []interface{}{"/var/log/auth.log*", "/var/log/secure*"}, + "use_output": "default", + }, + map[string]interface{}{ + "data_stream": map[string]interface{}{ + "dataset": "system.syslog", + "type": "logs", + }, + "type": "logfile", + "id": "logfile-system.syslog-my-id", + "exclude_files": []interface{}{".gz$"}, + "paths": []interface{}{"/var/log/messages*", "/var/log/syslog*"}, + "use_output": "default", + }, + map[string]interface{}{ + "data_stream": map[string]interface{}{ + "dataset": "system.diskio", + "type": "metrics", + }, + "id": "system/metrics-system.diskio-my-id", + "metricsets": []interface{}{"diskio"}, + "period": "10s", + }, + map[string]interface{}{ + "data_stream": map[string]interface{}{ + "dataset": "system.filesystem", + "type": "metrics", + }, + "id": "system/metrics-system.filesystem-my-id", + "metricsets": []interface{}{"filesystem"}, + "period": "30s", + }, + }, + }, + }, + "inputs sections of all external and standalone configuration are merged to the result": { + configs: []string{ + filepath.Join("testdata", "standalone-with-inputs.yml"), + filepath.Join("testdata", "inputs", "log-inputs.yml"), + filepath.Join("testdata", "inputs", "metrics-inputs.yml"), + }, + inputsFolder: filepath.Join("testdata", "inputs", "*.yml"), + expectedConfig: map[string]interface{}{ + "outputs": map[string]interface{}{ + "default": map[string]interface{}{ + "type": "elasticsearch", + "hosts": []interface{}{"127.0.0.1:9201"}, + "api-key": "my-secret-key", + }, + }, + "inputs": []interface{}{ + map[string]interface{}{ + "type": "system/metrics", + "data_stream.namespace": "default", + "use_output": "default", + "streams": []interface{}{ + map[string]interface{}{ + "metricset": "cpu", + "data_stream.dataset": "system.cpu", + }, + }, + }, + map[string]interface{}{ + "data_stream": map[string]interface{}{ + "dataset": "system.auth", + "type": "logs", + }, + "exclude_files": []interface{}{".gz$"}, + "id": "logfile-system.auth-my-id", + "paths": []interface{}{"/var/log/auth.log*", "/var/log/secure*"}, + "use_output": "default", + }, + map[string]interface{}{ + "data_stream": map[string]interface{}{ + "dataset": "system.syslog", + "type": "logs", + }, + "type": "logfile", + "id": "logfile-system.syslog-my-id", + "exclude_files": []interface{}{".gz$"}, + "paths": []interface{}{"/var/log/messages*", "/var/log/syslog*"}, + "use_output": "default", + }, + map[string]interface{}{ + "data_stream": map[string]interface{}{ + "dataset": "system.diskio", + "type": "metrics", + }, + "id": "system/metrics-system.diskio-my-id", + "metricsets": []interface{}{"diskio"}, + "period": "10s", + }, + map[string]interface{}{ + "data_stream": map[string]interface{}{ + "dataset": "system.filesystem", + "type": "metrics", + }, + "id": "system/metrics-system.filesystem-my-id", + "metricsets": []interface{}{"filesystem"}, + "period": "30s", + }, + }, + }, + }, + } + + for name, test := range cases { + t.Run(name, func(t *testing.T) { + test := test + + l := mustNewLoader(test.inputsFolder) + c, err := l.Load(test.configs) + if test.err { + require.NotNil(t, err) + return + } + + require.Nil(t, err) + raw, err := c.ToMapStr() + require.Nil(t, err) + require.Equal(t, test.expectedConfig, raw) + }) + } +} + +func mustNewLoader(inputsFolder string) *Loader { + log, err := logger.New("loader_test", true) + if err != nil { + panic(err) + } + return NewLoader(log, inputsFolder) +} diff --git a/x-pack/elastic-agent/pkg/config/testdata/inputs/invalid-inputs.yml b/x-pack/elastic-agent/pkg/config/testdata/inputs/invalid-inputs.yml new file mode 100644 index 000000000000..b6da68a339e3 --- /dev/null +++ b/x-pack/elastic-agent/pkg/config/testdata/inputs/invalid-inputs.yml @@ -0,0 +1,5 @@ +# this file is invalid because the inputs section is missing +- data_stream: + dataset: system.auth + type: logs + diff --git a/x-pack/elastic-agent/pkg/config/testdata/inputs/log-inputs.yml b/x-pack/elastic-agent/pkg/config/testdata/inputs/log-inputs.yml new file mode 100644 index 000000000000..cead269b0a3c --- /dev/null +++ b/x-pack/elastic-agent/pkg/config/testdata/inputs/log-inputs.yml @@ -0,0 +1,20 @@ +inputs: +- data_stream: + dataset: system.auth + type: logs + exclude_files: [".gz$"] + id: logfile-system.auth-my-id + paths: + - /var/log/auth.log* + - /var/log/secure* + use_output: default +- data_stream: + dataset: system.syslog + type: logs + type: logfile + id: logfile-system.syslog-my-id + exclude_files: [".gz$"] + paths: + - /var/log/messages* + - /var/log/syslog* + use_output: default diff --git a/x-pack/elastic-agent/pkg/config/testdata/inputs/metrics-inputs.yml b/x-pack/elastic-agent/pkg/config/testdata/inputs/metrics-inputs.yml new file mode 100644 index 000000000000..b44faf5097d8 --- /dev/null +++ b/x-pack/elastic-agent/pkg/config/testdata/inputs/metrics-inputs.yml @@ -0,0 +1,16 @@ +inputs: +- data_stream: + dataset: system.diskio + type: metrics + id: system/metrics-system.diskio-my-id + metricsets: + - diskio + period: 10s +- data_stream: + dataset: system.filesystem + type: metrics + id: system/metrics-system.filesystem-my-id + metricsets: + - filesystem + period: 30s + diff --git a/x-pack/elastic-agent/pkg/config/testdata/standalone-with-inputs.yml b/x-pack/elastic-agent/pkg/config/testdata/standalone-with-inputs.yml new file mode 100644 index 000000000000..1be5ac9daeca --- /dev/null +++ b/x-pack/elastic-agent/pkg/config/testdata/standalone-with-inputs.yml @@ -0,0 +1,13 @@ +outputs: + default: + type: elasticsearch + hosts: [127.0.0.1:9201] + api-key: "my-secret-key" + +inputs: + - type: system/metrics + data_stream.namespace: default + use_output: default + streams: + - metricset: cpu + data_stream.dataset: system.cpu diff --git a/x-pack/elastic-agent/pkg/config/testdata/standalone1.yml b/x-pack/elastic-agent/pkg/config/testdata/standalone1.yml new file mode 100644 index 000000000000..f0ddddf1a2a2 --- /dev/null +++ b/x-pack/elastic-agent/pkg/config/testdata/standalone1.yml @@ -0,0 +1,6 @@ +outputs: + default: + type: elasticsearch + hosts: [127.0.0.1:9201] + api-key: "my-secret-key" + diff --git a/x-pack/elastic-agent/pkg/config/testdata/standalone2.yml b/x-pack/elastic-agent/pkg/config/testdata/standalone2.yml new file mode 100644 index 000000000000..7183b32b79f1 --- /dev/null +++ b/x-pack/elastic-agent/pkg/config/testdata/standalone2.yml @@ -0,0 +1,3 @@ +agent.logging.level: debug +agent.logging.metrics.enabled: false + From ccb8d914c2cd50c553b57203452c8a150fa2224f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 1 Feb 2022 19:00:41 +0100 Subject: [PATCH 14/20] Add missing changelog entry for #30087 (#30144) --- x-pack/elastic-agent/CHANGELOG.next.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/x-pack/elastic-agent/CHANGELOG.next.asciidoc b/x-pack/elastic-agent/CHANGELOG.next.asciidoc index 37f09cec0cc1..f219bc122478 100644 --- a/x-pack/elastic-agent/CHANGELOG.next.asciidoc +++ b/x-pack/elastic-agent/CHANGELOG.next.asciidoc @@ -158,3 +158,4 @@ - Add --fleet-server-es-ca-trusted-fingerprint flag to allow agent/fleet-server to work with elasticsearch clusters using self signed certs. {pull}29128[29128] - Discover changes in Kubernetes nodes metadata as soon as they happen. {pull}23139[23139] - Add results of inspect output command into archive produced by diagnostics collect. {pull}29902[29902] +- Add support for loading input configuration from external configuration files in standalone mode. You can load inputs from YAML configuration files under the folder `{path.config}/inputs.d`. {pull}30087[30087] From b8d1fd791d04b306cc094942820f10bf08e45540 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Tue, 1 Feb 2022 19:03:53 +0100 Subject: [PATCH 15/20] Add more details to changelog entry about changes in Beats and Agent logging (#30021) --- CHANGELOG.next.asciidoc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 507ef05a9785..5c59f2d47d8a 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -25,9 +25,11 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Remove several ILM options (`rollover_alias` and `pattern`) as data streams does not require index aliases. {pull}28450[28450] - Index template's default_fields setting is only populated with ECS fields. {pull}28596[28596] {issue}28215[28215] - Remove deprecated `--template` and `--ilm-policy` flags. Use `--index-management` instead. {pull}28870[28870] -- Remove options `logging.files.suffix` and default to datetime endings. {pull}28927[28927] +- Remove options `logging.files.suffix` and default to datetime endings in log file names. The format of the new name is `{beatname}-{date}(-n)?.ndjson`. Exmaple log files names from oldest to newest: `filebeat-20200101.ndjson`, `filebeat-20200101-1.ndjson`, `filebeat-20200101-2.ndjson`. {pull}28927[28927] +- Remove Journalbeat. Use `journald` input of Filebeat instead. {pull}29131[29131] - `include_matches` option of `journald` input no longer accepts a list of string. {pull}29294[29294] - Allign kubernetes configuration settings. {pull}29908[29908] +- The extension of the log files of Beats and Elastic Agent is changed to `.ndjson`. If you are collecting the logs, you must change the path configuration to `/path/to/logs/{beatname}*.ndjson` to avoid any issues. {pull}28927[28927] - Remove legacy support for SSLv3. {pull}30071[30071] - `add_fields` processor is now able to set metadata in events {pull}30092[30092] From dd24764c4a9ff57b52d0289f9647fee8a5c9358e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Wed, 2 Feb 2022 11:33:40 +0100 Subject: [PATCH 16/20] Use absolute path in external config glob (#30149) --- x-pack/elastic-agent/pkg/agent/application/local_mode.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x-pack/elastic-agent/pkg/agent/application/local_mode.go b/x-pack/elastic-agent/pkg/agent/application/local_mode.go index ca8284cdf8e8..b85979e61b98 100644 --- a/x-pack/elastic-agent/pkg/agent/application/local_mode.go +++ b/x-pack/elastic-agent/pkg/agent/application/local_mode.go @@ -118,7 +118,7 @@ func newLocal( return nil, errors.New(err, "failed to initialize composable controller") } - discover := discoverer(pathConfigFile, cfg.Settings.Path, configuration.ExternalInputsPattern) + discover := discoverer(pathConfigFile, cfg.Settings.Path, externalConfigsGlob()) emit, err := emitter.New( localApplication.bgContext, log, From b6e347f3ef78a061fb3d2dd863c2d585352cdc60 Mon Sep 17 00:00:00 2001 From: Elastic Machine Date: Wed, 2 Feb 2022 08:49:33 -0700 Subject: [PATCH 17/20] [Release] add-backport-next (#30159) --- .mergify.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.mergify.yml b/.mergify.yml index 7815f7579d3a..85640db1a3f7 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -224,3 +224,16 @@ pull_request_rules: labels: - "backport" title: "[{{ destination_branch }}](backport #{{ number }}) {{ title }}" + - name: backport patches to 8.1 branch + conditions: + - merged + - label=backport-v8.1.0 + actions: + backport: + assignees: + - "{{ author }}" + branches: + - "8.1" + labels: + - "backport" + title: "[{{ destination_branch }}](backport #{{ number }}) {{ title }}" From c87406b0882e9397b67a09ef3a50d7415c307a15 Mon Sep 17 00:00:00 2001 From: Pier-Hugues Pellerin Date: Wed, 2 Feb 2022 16:15:13 -0500 Subject: [PATCH 18/20] Remove macOS preference panels and code related to DMG (#30097) This commit removes the build of the macOS preference panels for Filebeat, Auditbeat, Metricbeat, heartbeat. This artifact was never released officially and was unsupported. We do not have any tests in place to assert that the new version of macOS doesn't break the preference panel. Remove the code related to building DMG images, this was only required to package the preference panel. Fixes: #30003 --- auditbeat/scripts/mage/package.go | 2 +- dev-tools/mage/dmgbuilder.go | 295 ---------- dev-tools/mage/kibana.go | 2 - dev-tools/mage/pkg.go | 5 - dev-tools/mage/pkgtypes.go | 26 - dev-tools/packaging/packages.yml | 34 -- .../packaging/preference-pane/.gitignore | 1 - .../project.pbxproj | 523 ------------------ .../contents.xcworkspacedata | 7 - .../xcshareddata/IDETemplateMacros.plist | 24 - .../xcschemes/xcschememanagement.plist | 32 -- .../beats-preference-pane/Authorization.h | 23 - .../Base.lproj/BeatView.xib | 129 ----- .../Base.lproj/BeatsPrefPane.xib | 66 --- .../Base.lproj/EditorWindow.xib | 147 ----- .../beats-preference-pane/Base.lproj/pane.xib | 122 ---- .../beats-preference-pane/BeatManager.m | 22 - .../BeatViewController.h | 48 -- .../BeatViewController.m | 151 ----- .../beats-preference-pane/Beats.icns | Bin 77351 -> 0 bytes .../beats-preference-pane/BeatsPrefPane.h | 46 -- .../beats-preference-pane/BeatsPrefPane.m | 164 ------ .../beats-preference-pane/EditorWindow.h | 34 -- .../beats-preference-pane/EditorWindow.m | 89 --- .../beats-preference-pane/Info.plist | 32 -- .../beats-preference-pane/TabViewDelegate.h | 43 -- .../beats-preference-pane/TabViewDelegate.m | 99 ---- .../beats-preference-pane/beats/Beats.h | 39 -- .../beats/BeatsService.h | 29 - .../beats/BeatsService.m | 294 ---------- .../beats-preference-pane/common/common.h | 29 - .../beats-preference-pane/common/common.m | 75 --- .../beats-preference-pane/config.h | 31 -- .../en.lproj/beats_preference_pane.strings | 3 - .../packaging/preference-pane/helper/main.m | 72 --- .../preference-pane/helper/setboot.m | 91 --- .../packaging/preference-pane/magefile.go | 159 ------ .../templates/darwin/README.html.tmpl | 36 -- .../templates/darwin/component.plist.tmpl | 5 - .../templates/darwin/distribution.plist.tmpl | 25 - .../Uninstall.app/Contents/Info.plist.tmpl | 26 - .../Contents/MacOS/uninstall.sh.tmpl | 65 --- .../Contents/Resources/uninstaller.icns | Bin 115364 -> 0 bytes .../templates/darwin/icons/auditbeat.icns | Bin 58490 -> 0 bytes .../templates/darwin/icons/filebeat.icns | Bin 67255 -> 0 bytes .../templates/darwin/icons/heartbeat.icns | Bin 98924 -> 0 bytes .../templates/darwin/icons/metricbeat.icns | Bin 110850 -> 0 bytes .../templates/darwin/icons/packetbeat.icns | Bin 176510 -> 0 bytes .../templates/darwin/icons/winlogbeat.icns | Bin 72010 -> 0 bytes .../darwin/launchd-daemon.plist.tmpl | 30 - .../templates/darwin/requirements.plist.tmpl | 14 - .../scripts/postinstall.elastic-agent.tmpl | 32 -- .../templates/darwin/scripts/postinstall.tmpl | 26 - .../templates/darwin/scripts/preinstall.tmpl | 2 - filebeat/scripts/mage/package.go | 3 - heartbeat/scripts/mage/package.go | 2 +- metricbeat/scripts/mage/package.go | 4 +- packetbeat/scripts/mage/package.go | 2 +- winlogbeat/scripts/mage/package.go | 2 +- 59 files changed, 5 insertions(+), 3257 deletions(-) delete mode 100644 dev-tools/mage/dmgbuilder.go delete mode 100644 dev-tools/packaging/preference-pane/.gitignore delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/project.pbxproj delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/project.xcworkspace/contents.xcworkspacedata delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/xcshareddata/IDETemplateMacros.plist delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/xcuserdata/adrian.xcuserdatad/xcschemes/xcschememanagement.plist delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/Authorization.h delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/BeatView.xib delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/BeatsPrefPane.xib delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/EditorWindow.xib delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/pane.xib delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/BeatManager.m delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/BeatViewController.h delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/BeatViewController.m delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/Beats.icns delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/BeatsPrefPane.h delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/BeatsPrefPane.m delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/EditorWindow.h delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/EditorWindow.m delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/Info.plist delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/TabViewDelegate.h delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/TabViewDelegate.m delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/beats/Beats.h delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/beats/BeatsService.h delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/beats/BeatsService.m delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/common/common.h delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/common/common.m delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/config.h delete mode 100644 dev-tools/packaging/preference-pane/beats-preference-pane/en.lproj/beats_preference_pane.strings delete mode 100644 dev-tools/packaging/preference-pane/helper/main.m delete mode 100644 dev-tools/packaging/preference-pane/helper/setboot.m delete mode 100644 dev-tools/packaging/preference-pane/magefile.go delete mode 100644 dev-tools/packaging/templates/darwin/README.html.tmpl delete mode 100644 dev-tools/packaging/templates/darwin/component.plist.tmpl delete mode 100644 dev-tools/packaging/templates/darwin/distribution.plist.tmpl delete mode 100644 dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/Info.plist.tmpl delete mode 100644 dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/MacOS/uninstall.sh.tmpl delete mode 100644 dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/Resources/uninstaller.icns delete mode 100644 dev-tools/packaging/templates/darwin/icons/auditbeat.icns delete mode 100644 dev-tools/packaging/templates/darwin/icons/filebeat.icns delete mode 100644 dev-tools/packaging/templates/darwin/icons/heartbeat.icns delete mode 100644 dev-tools/packaging/templates/darwin/icons/metricbeat.icns delete mode 100644 dev-tools/packaging/templates/darwin/icons/packetbeat.icns delete mode 100644 dev-tools/packaging/templates/darwin/icons/winlogbeat.icns delete mode 100644 dev-tools/packaging/templates/darwin/launchd-daemon.plist.tmpl delete mode 100644 dev-tools/packaging/templates/darwin/requirements.plist.tmpl delete mode 100644 dev-tools/packaging/templates/darwin/scripts/postinstall.elastic-agent.tmpl delete mode 100644 dev-tools/packaging/templates/darwin/scripts/postinstall.tmpl delete mode 100644 dev-tools/packaging/templates/darwin/scripts/preinstall.tmpl diff --git a/auditbeat/scripts/mage/package.go b/auditbeat/scripts/mage/package.go index 095917051214..94b2a7cde6d5 100644 --- a/auditbeat/scripts/mage/package.go +++ b/auditbeat/scripts/mage/package.go @@ -90,7 +90,7 @@ func CustomizePackaging(pkgFlavor PackagingFlavor) { case devtools.TarGz, devtools.Zip: args.Spec.ReplaceFile("{{.BeatName}}.yml", shortConfig) args.Spec.ReplaceFile("{{.BeatName}}.reference.yml", referenceConfig) - case devtools.Deb, devtools.RPM, devtools.DMG: + case devtools.Deb, devtools.RPM: args.Spec.ReplaceFile("/etc/{{.BeatName}}/{{.BeatName}}.yml", shortConfig) args.Spec.ReplaceFile("/etc/{{.BeatName}}/{{.BeatName}}.reference.yml", referenceConfig) sampleRulesTarget = "/etc/{{.BeatName}}/" + defaultSampleRulesTarget diff --git a/dev-tools/mage/dmgbuilder.go b/dev-tools/mage/dmgbuilder.go deleted file mode 100644 index 47a1125a5a68..000000000000 --- a/dev-tools/mage/dmgbuilder.go +++ /dev/null @@ -1,295 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -package mage - -import ( - "os" - "os/exec" - "path/filepath" - "strings" - - "github.com/magefile/mage/mg" - "github.com/magefile/mage/sh" - "github.com/pkg/errors" -) - -type dmgBuilder struct { - PackageSpec - - SigningInfo *AppleSigningInfo - Identifier string - PreferencePaneDir string - PreferencePanePkgFile string - InternalBeatPkg string - BeatPkg string - - beatsDir string - dmgDir string - - // Build tools. - pkgbuild func(args ...string) error - productbuild func(args ...string) error - spctl func(args ...string) error - codesign func(args ...string) error - hdiutil func(args ...string) error -} - -func newDMGBuilder(spec PackageSpec) (*dmgBuilder, error) { - for _, cmd := range []string{"pkgbuild", "productbuild", "spctl", "codesign", "hdiutil"} { - if _, err := exec.LookPath(cmd); err != nil { - return nil, errors.Wrapf(err, "required tool '%v' for DMG packaging not found on PATH", cmd) - } - } - - beatsDir, err := ElasticBeatsDir() - if err != nil { - return nil, err - } - - preferencePaneDir := filepath.Join(beatsDir, "dev-tools/packaging/preference-pane") - preferencePanePkgFile := filepath.Join(preferencePaneDir, "build/BeatsPrefPane.pkg") - beatIdentifier, ok := spec.evalContext["identifier"].(string) - if !ok { - return nil, errors.Errorf("identifier not specified for DMG packaging") - } - - spec.OutputFile, err = spec.Expand(defaultBinaryName) - if err != nil { - return nil, err - } - - info, err := GetAppleSigningInfo() - if err != nil { - return nil, err - } - - return &dmgBuilder{ - PackageSpec: spec, - SigningInfo: info, - Identifier: beatIdentifier, - PreferencePaneDir: preferencePaneDir, - PreferencePanePkgFile: preferencePanePkgFile, - - beatsDir: beatsDir, - dmgDir: filepath.Join(spec.packageDir, "dmg"), - - pkgbuild: sh.RunCmd("pkgbuild"), - productbuild: sh.RunCmd("productbuild"), - spctl: sh.RunCmd("spctl", "-a", "-t"), - codesign: sh.RunCmd("codesign"), - hdiutil: sh.RunCmd("hdiutil"), - }, nil -} - -// Create .pkg for preference pane. -func (b *dmgBuilder) buildPreferencePane() error { - return errors.Wrap(Mage(b.PreferencePaneDir), "failed to build Beats preference pane") -} - -func (b *dmgBuilder) buildBeatPkg() error { - beatPkgRoot := filepath.Join(b.packageDir, "beat-pkg-root") - if err := os.RemoveAll(beatPkgRoot); err != nil { - return errors.Wrap(err, "failed to clean beat-pkg-root") - } - - // Copy files into the packaging root and set their mode. - for _, f := range b.Files { - if f.Symlink { - // not supported, handling symlink in post/pre install scripts - continue - } - - target := filepath.Join(beatPkgRoot, f.Target) - if err := Copy(f.Source, target); err != nil { - if f.SkipOnMissing && errors.Is(err, os.ErrNotExist) { - continue - } - return err - } - - info, err := os.Stat(target) - if err != nil { - return err - } - - if info.Mode().IsRegular() && info.Mode().Perm() != f.Mode { - if err = os.Chmod(target, f.Mode); err != nil { - return err - } - } - } - - b.InternalBeatPkg = filepath.Join(b.packageDir, "pkgs", "internal-"+b.OutputFile+".pkg") - - args := []string{ - "--root", beatPkgRoot, - "--scripts", filepath.Join(b.packageDir, "scripts"), - "--identifier", b.Identifier, - "--version", b.MustExpand("{{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}"), - } - if b.SigningInfo.Sign { - args = append(args, "--sign", b.SigningInfo.Installer.ID, "--timestamp") - } - args = append(args, createDir(b.InternalBeatPkg)) - if err := b.pkgbuild(args...); err != nil { - return err - } - - return nil -} - -func (b *dmgBuilder) buildProductPkg() error { - var ( - distributionPlist = filepath.Join(b.packageDir, "distributions.plist") - resourcesDir = filepath.Join(b.packageDir, "resources") - ) - - b.MustExpandFile( - filepath.Join(b.beatsDir, "dev-tools/packaging/templates/darwin/distribution.plist.tmpl"), - distributionPlist) - b.MustExpandFile( - filepath.Join(b.beatsDir, "dev-tools/packaging/templates/darwin/README.html.tmpl"), - filepath.Join(resourcesDir, "README.html")) - for t, pf := range b.Files { - if strings.HasSuffix(t, "LICENSE.txt") { - Copy(pf.Source, filepath.Join(resourcesDir, "LICENSE.txt")) - break - } - } - b.MustExpandFile( - filepath.Join(b.beatsDir, "dev-tools/packaging/templates/darwin/README.html.tmpl"), - filepath.Join(resourcesDir, "README.html")) - - if err := os.RemoveAll(b.dmgDir); err != nil { - return err - } - b.BeatPkg = filepath.Join(b.dmgDir, b.OutputFile+".pkg") - - // Create .pkg containing the previous two .pkg files. - args := []string{ - "--distribution", distributionPlist, - "--resources", resourcesDir, - "--package-path", filepath.Dir(b.InternalBeatPkg), - "--package-path", filepath.Dir(b.PreferencePanePkgFile), - "--component-compression", "auto", - } - if b.SigningInfo.Sign { - args = append(args, "--sign", b.SigningInfo.Installer.ID, "--timestamp") - } - args = append(args, createDir(b.BeatPkg)) - if err := b.productbuild(args...); err != nil { - return err - } - - if b.SigningInfo.Sign { - if err := b.spctl("install", b.BeatPkg); err != nil { - return err - } - } - - return nil -} - -func (b *dmgBuilder) buildUninstallApp() error { - const ( - uninstallerIcons = "Uninstall.app/Contents/Resources/uninstaller.icns" - uninstallScript = "Uninstall.app/Contents/MacOS/uninstall.sh" - infoPlist = "Uninstall.app/Contents/Info.plist" - ) - - inputDir := filepath.Join(b.beatsDir, "dev-tools/packaging/templates/darwin/dmg") - - Copy( - filepath.Join(inputDir, uninstallerIcons), - filepath.Join(b.dmgDir, uninstallerIcons), - ) - b.MustExpandFile( - filepath.Join(inputDir, infoPlist+".tmpl"), - filepath.Join(b.dmgDir, infoPlist), - ) - b.MustExpandFile( - filepath.Join(inputDir, uninstallScript+".tmpl"), - filepath.Join(b.dmgDir, uninstallScript), - ) - if err := os.Chmod(filepath.Join(b.dmgDir, uninstallScript), 0755); err != nil { - return err - } - - if b.SigningInfo.Sign { - uninstallApp := filepath.Join(b.dmgDir, "Uninstall.app") - if err := b.codesign("-s", b.SigningInfo.App.ID, "--timestamp", uninstallApp); err != nil { - return err - } - - if err := b.spctl("exec", uninstallApp); err != nil { - return err - } - } - - return nil -} - -// Create a .dmg file containing both the Uninstall.app and .pkg file. -func (b *dmgBuilder) buildDMG() error { - dmgFile := filepath.Join(distributionsDir, DMG.AddFileExtension(b.OutputFile)) - - args := []string{ - "create", - "-volname", b.MustExpand("{{.BeatName | title}} {{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}"), - "-srcfolder", b.dmgDir, - "-size", "500m", // allowing extra space - "-ov", - createDir(dmgFile), - } - if err := b.hdiutil(args...); err != nil { - return err - } - - // Sign the .dmg. - if b.SigningInfo.Sign { - if err := b.codesign("-s", b.SigningInfo.App.ID, "--timestamp", dmgFile); err != nil { - return err - } - - if err := b.spctl("install", dmgFile); err != nil { - return err - } - } - - return errors.Wrap(CreateSHA512File(dmgFile), "failed to create .sha512 file") -} - -func (b *dmgBuilder) Build() error { - // Mark this function as a dep so that is is only invoked once. - mg.Deps(b.buildPreferencePane) - - var err error - if err = b.buildBeatPkg(); err != nil { - return errors.Wrap(err, "failed to build internal beat pkg") - } - if err = b.buildProductPkg(); err != nil { - return errors.Wrap(err, "failed to build beat product pkg (pref pane + beat)") - } - if err = b.buildUninstallApp(); err != nil { - return errors.Wrap(err, "failed to build Uninstall.app") - } - if err = b.buildDMG(); err != nil { - return errors.Wrap(err, "failed to build beat dmg") - } - return nil -} diff --git a/dev-tools/mage/kibana.go b/dev-tools/mage/kibana.go index 4f58b9ffbb54..dbb0a0ddbfdf 100644 --- a/dev-tools/mage/kibana.go +++ b/dev-tools/mage/kibana.go @@ -79,8 +79,6 @@ func PackageKibanaDashboardsFromBuildDir() { pkgArgs.Spec.ReplaceFile("kibana", kibanaDashboards) case Deb, RPM: pkgArgs.Spec.ReplaceFile("/usr/share/{{.BeatName}}/kibana", kibanaDashboards) - case DMG: - pkgArgs.Spec.ReplaceFile("/Library/Application Support/{{.BeatVendor}}/{{.BeatName}}/kibana", kibanaDashboards) default: panic(errors.Errorf("unhandled package type: %v", pkgType)) } diff --git a/dev-tools/mage/pkg.go b/dev-tools/mage/pkg.go index f4381291cfee..77f964a39b9a 100644 --- a/dev-tools/mage/pkg.go +++ b/dev-tools/mage/pkg.go @@ -56,11 +56,6 @@ func Package() error { continue } - if pkgType == DMG && runtime.GOOS != "darwin" { - log.Printf("Skipping DMG package type because build host isn't darwin") - continue - } - if target.Name == "linux/arm64" && pkgType == Docker && runtime.GOARCH != "arm64" { log.Printf("Skipping Docker package type because build host isn't arm") continue diff --git a/dev-tools/mage/pkgtypes.go b/dev-tools/mage/pkgtypes.go index 1fc5fe79e50c..fb87255221d1 100644 --- a/dev-tools/mage/pkgtypes.go +++ b/dev-tools/mage/pkgtypes.go @@ -60,7 +60,6 @@ const ( Deb Zip TarGz - DMG Docker ) @@ -125,10 +124,6 @@ var OSArchNames = map[string]map[PackageType]map[string]string{ "386": "x86", "amd64": "x86_64", }, - DMG: map[string]string{ - "386": "x86", - "amd64": "x86_64", - }, }, "linux": map[PackageType]map[string]string{ RPM: map[string]string{ @@ -217,8 +212,6 @@ func (typ PackageType) String() string { return "zip" case TarGz: return "tar.gz" - case DMG: - return "dmg" case Docker: return "docker" default: @@ -242,8 +235,6 @@ func (typ *PackageType) UnmarshalText(text []byte) error { *typ = TarGz case "zip": *typ = Zip - case "dmg": - *typ = DMG case "docker": *typ = Docker default: @@ -289,8 +280,6 @@ func (typ PackageType) Build(spec PackageSpec) error { return PackageZip(spec) case TarGz: return PackageTarGz(spec) - case DMG: - return PackageDMG(spec) case Docker: return PackageDocker(spec) default: @@ -973,21 +962,6 @@ func addSymlinkToTar(tmpdir string, ar *tar.Writer, baseDir string, pkgFile Pack }) } -// PackageDMG packages the Beat into a .dmg file containing an installer pkg -// and uninstaller app. -func PackageDMG(spec PackageSpec) error { - if runtime.GOOS != "darwin" { - return errors.New("packaging a dmg requires darwin") - } - - b, err := newDMGBuilder(spec) - if err != nil { - return err - } - - return b.Build() -} - // PackageDocker packages the Beat into a docker image. func PackageDocker(spec PackageSpec) error { if err := HaveDocker(); err != nil { diff --git a/dev-tools/packaging/packages.yml b/dev-tools/packaging/packages.yml index 9221f1ac0c08..e062db1e1bbc 100644 --- a/dev-tools/packaging/packages.yml +++ b/dev-tools/packaging/packages.yml @@ -782,13 +782,6 @@ specs: <<: *apache_license_for_binaries name: '{{.BeatName}}-oss' - - os: darwin - types: [dmg] - spec: - <<: *macos_beat_pkg_spec - <<: *apache_license_for_macos_pkg - name: '{{.BeatName}}-oss' - - os: linux types: [tgz] spec: @@ -835,12 +828,6 @@ specs: <<: *binary_spec <<: *elastic_license_for_binaries - - os: darwin - types: [dmg] - spec: - <<: *macos_beat_pkg_spec - <<: *elastic_license_for_macos_pkg - - os: linux types: [tgz] spec: @@ -945,16 +932,6 @@ specs: '{{.BeatName}}{{.BinaryExt}}': source: ./{{.XPackDir}}/{{.BeatName}}/build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}} - - os: darwin - types: [dmg] - spec: - <<: *macos_beat_pkg_spec - <<: *elastic_license_for_macos_pkg - files: - /Library/Application Support/{{.BeatVendor}}/{{.BeatName}}/bin/{{.BeatName}}{{.BinaryExt}}: - mode: 0755 - source: ../x-pack/{{.BeatName}}/build/golang-crossbuild/{{.BeatName}}-{{.GOOS}}-{{.Platform.Arch}}{{.BinaryExt}} - - os: linux types: [tgz] spec: @@ -1053,17 +1030,6 @@ specs: symlink: true mode: 0755 - - os: darwin - types: [dmg] - spec: - <<: *macos_agent_pkg_spec - <<: *elastic_license_for_macos_pkg - files: - /Library/Application Support/{{.BeatVendor}}/{{.BeatName}}/bin/{{.BeatName}}{{.BinaryExt}}: - mode: 0755 - source: /etc/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/{{.BeatName}}{{.BinaryExt}} - symlink: true - - os: linux types: [tgz] spec: diff --git a/dev-tools/packaging/preference-pane/.gitignore b/dev-tools/packaging/preference-pane/.gitignore deleted file mode 100644 index 567609b1234a..000000000000 --- a/dev-tools/packaging/preference-pane/.gitignore +++ /dev/null @@ -1 +0,0 @@ -build/ diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/project.pbxproj b/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/project.pbxproj deleted file mode 100644 index 0f46547b7286..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/project.pbxproj +++ /dev/null @@ -1,523 +0,0 @@ -// !$*UTF8*$! -{ - archiveVersion = 1; - classes = { - }; - objectVersion = 48; - objects = { - -/* Begin PBXBuildFile section */ - 3A0F656C205D5AE9009DBAE7 /* setboot.m in Sources */ = {isa = PBXBuildFile; fileRef = 3A0F656B205D5AE9009DBAE7 /* setboot.m */; }; - 3A34B24E203B1F480079E62C /* Beats.h in Headers */ = {isa = PBXBuildFile; fileRef = 3A34B24C203B1F480079E62C /* Beats.h */; }; - 3A34B251203B239F0079E62C /* Beats.icns in Resources */ = {isa = PBXBuildFile; fileRef = 3A34B250203B239F0079E62C /* Beats.icns */; }; - 3A6BA0642062CEAA00A05921 /* config.h in Headers */ = {isa = PBXBuildFile; fileRef = 3A6BA0632062CEAA00A05921 /* config.h */; }; - 3A6F9AB6202C939D0046F40E /* BeatsPrefPane.h in Headers */ = {isa = PBXBuildFile; fileRef = 3A6F9AB5202C939D0046F40E /* BeatsPrefPane.h */; }; - 3A6F9AB8202C939D0046F40E /* BeatsPrefPane.m in Sources */ = {isa = PBXBuildFile; fileRef = 3A6F9AB7202C939D0046F40E /* BeatsPrefPane.m */; }; - 3A6F9ABD202C939D0046F40E /* BeatsPrefPane.xib in Resources */ = {isa = PBXBuildFile; fileRef = 3A6F9ABB202C939D0046F40E /* BeatsPrefPane.xib */; }; - 3A8FA06D20626DEF0091102D /* common.m in Sources */ = {isa = PBXBuildFile; fileRef = 3AC0A94420626C7B00741C93 /* common.m */; }; - 3A915924205EB4F4007DE746 /* EditorWindow.h in Headers */ = {isa = PBXBuildFile; fileRef = 3A915921205EB4F4007DE746 /* EditorWindow.h */; }; - 3A915925205EB4F4007DE746 /* EditorWindow.m in Sources */ = {isa = PBXBuildFile; fileRef = 3A915922205EB4F4007DE746 /* EditorWindow.m */; }; - 3A915926205EB4F4007DE746 /* Base.lproj/EditorWindow.xib in Resources */ = {isa = PBXBuildFile; fileRef = 3A915923205EB4F4007DE746 /* Base.lproj/EditorWindow.xib */; }; - 3AA415CE2051B206008915AA /* BeatsService.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AA415CC2051B206008915AA /* BeatsService.h */; }; - 3AA415CF2051B206008915AA /* BeatsService.m in Sources */ = {isa = PBXBuildFile; fileRef = 3AA415CD2051B206008915AA /* BeatsService.m */; }; - 3AA415DD20582B34008915AA /* main.m in Sources */ = {isa = PBXBuildFile; fileRef = 3AA415DC20582B34008915AA /* main.m */; }; - 3AA415E4205833A3008915AA /* helper in CopyFiles */ = {isa = PBXBuildFile; fileRef = 3AA415DA20582B34008915AA /* helper */; }; - 3AC0A94620626C7C00741C93 /* common.m in Sources */ = {isa = PBXBuildFile; fileRef = 3AC0A94420626C7B00741C93 /* common.m */; }; - 3AD0D414203CE40800338653 /* BeatViewController.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AD0D411203CE40800338653 /* BeatViewController.h */; }; - 3AD0D415203CE40800338653 /* BeatViewController.m in Sources */ = {isa = PBXBuildFile; fileRef = 3AD0D412203CE40800338653 /* BeatViewController.m */; }; - 3AD0D419203CECDA00338653 /* TabViewDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AD0D417203CECDA00338653 /* TabViewDelegate.h */; }; - 3AD0D41A203CECDA00338653 /* TabViewDelegate.m in Sources */ = {isa = PBXBuildFile; fileRef = 3AD0D418203CECDA00338653 /* TabViewDelegate.m */; }; - 3AD0D420203D791100338653 /* Base.lproj/BeatView.xib in Resources */ = {isa = PBXBuildFile; fileRef = 3AD0D41F203D791100338653 /* Base.lproj/BeatView.xib */; }; -/* End PBXBuildFile section */ - -/* Begin PBXContainerItemProxy section */ - 3A0F6569205BE29D009DBAE7 /* PBXContainerItemProxy */ = { - isa = PBXContainerItemProxy; - containerPortal = 3A6F9AA9202C939D0046F40E /* Project object */; - proxyType = 1; - remoteGlobalIDString = 3AA415D920582B34008915AA; - remoteInfo = helper; - }; -/* End PBXContainerItemProxy section */ - -/* Begin PBXCopyFilesBuildPhase section */ - 3AA415D820582B34008915AA /* CopyFiles */ = { - isa = PBXCopyFilesBuildPhase; - buildActionMask = 12; - dstPath = ""; - dstSubfolderSpec = 6; - files = ( - ); - runOnlyForDeploymentPostprocessing = 0; - }; - 3AA415E32058339A008915AA /* CopyFiles */ = { - isa = PBXCopyFilesBuildPhase; - buildActionMask = 2147483647; - dstPath = ""; - dstSubfolderSpec = 6; - files = ( - 3AA415E4205833A3008915AA /* helper in CopyFiles */, - ); - runOnlyForDeploymentPostprocessing = 0; - }; -/* End PBXCopyFilesBuildPhase section */ - -/* Begin PBXFileReference section */ - 3A0F656B205D5AE9009DBAE7 /* setboot.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = setboot.m; sourceTree = ""; }; - 3A34B24C203B1F480079E62C /* Beats.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = Beats.h; sourceTree = ""; }; - 3A34B250203B239F0079E62C /* Beats.icns */ = {isa = PBXFileReference; lastKnownFileType = image.icns; path = Beats.icns; sourceTree = ""; }; - 3A6BA0632062CEAA00A05921 /* config.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = config.h; sourceTree = ""; }; - 3A6F9AB2202C939D0046F40E /* Beats.prefPane */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = Beats.prefPane; sourceTree = BUILT_PRODUCTS_DIR; }; - 3A6F9AB5202C939D0046F40E /* BeatsPrefPane.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = BeatsPrefPane.h; sourceTree = ""; }; - 3A6F9AB7202C939D0046F40E /* BeatsPrefPane.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = BeatsPrefPane.m; sourceTree = ""; }; - 3A6F9ABC202C939D0046F40E /* Base */ = {isa = PBXFileReference; lastKnownFileType = file.xib; name = Base; path = Base.lproj/BeatsPrefPane.xib; sourceTree = ""; }; - 3A6F9ABE202C939D0046F40E /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = ""; }; - 3A915921205EB4F4007DE746 /* EditorWindow.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = EditorWindow.h; sourceTree = ""; }; - 3A915922205EB4F4007DE746 /* EditorWindow.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = EditorWindow.m; sourceTree = ""; }; - 3A915923205EB4F4007DE746 /* Base.lproj/EditorWindow.xib */ = {isa = PBXFileReference; lastKnownFileType = file.xib; path = Base.lproj/EditorWindow.xib; sourceTree = ""; }; - 3AA415CC2051B206008915AA /* BeatsService.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = BeatsService.h; sourceTree = ""; }; - 3AA415CD2051B206008915AA /* BeatsService.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = BeatsService.m; sourceTree = ""; }; - 3AA415D520572B5A008915AA /* Authorization.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = Authorization.h; sourceTree = ""; }; - 3AA415DA20582B34008915AA /* helper */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = helper; sourceTree = BUILT_PRODUCTS_DIR; }; - 3AA415DC20582B34008915AA /* main.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = main.m; sourceTree = ""; }; - 3AC0A94420626C7B00741C93 /* common.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = common.m; sourceTree = ""; }; - 3AC0A94520626C7C00741C93 /* common.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = common.h; sourceTree = ""; }; - 3AD0D411203CE40800338653 /* BeatViewController.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = BeatViewController.h; sourceTree = ""; }; - 3AD0D412203CE40800338653 /* BeatViewController.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = BeatViewController.m; sourceTree = ""; }; - 3AD0D417203CECDA00338653 /* TabViewDelegate.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TabViewDelegate.h; sourceTree = ""; }; - 3AD0D418203CECDA00338653 /* TabViewDelegate.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = TabViewDelegate.m; sourceTree = ""; }; - 3AD0D41F203D791100338653 /* Base.lproj/BeatView.xib */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = file.xib; path = Base.lproj/BeatView.xib; sourceTree = ""; }; -/* End PBXFileReference section */ - -/* Begin PBXFrameworksBuildPhase section */ - 3A6F9AAE202C939D0046F40E /* Frameworks */ = { - isa = PBXFrameworksBuildPhase; - buildActionMask = 2147483647; - files = ( - ); - runOnlyForDeploymentPostprocessing = 0; - }; - 3AA415D720582B34008915AA /* Frameworks */ = { - isa = PBXFrameworksBuildPhase; - buildActionMask = 2147483647; - files = ( - ); - runOnlyForDeploymentPostprocessing = 0; - }; -/* End PBXFrameworksBuildPhase section */ - -/* Begin PBXGroup section */ - 3A6F9AA8202C939D0046F40E = { - isa = PBXGroup; - children = ( - 3A6F9AB4202C939D0046F40E /* beats-preference-pane */, - 3AA415DB20582B34008915AA /* helper */, - 3A6F9AB3202C939D0046F40E /* Products */, - ); - sourceTree = ""; - }; - 3A6F9AB3202C939D0046F40E /* Products */ = { - isa = PBXGroup; - children = ( - 3A6F9AB2202C939D0046F40E /* Beats.prefPane */, - 3AA415DA20582B34008915AA /* helper */, - ); - name = Products; - sourceTree = ""; - }; - 3A6F9AB4202C939D0046F40E /* beats-preference-pane */ = { - isa = PBXGroup; - children = ( - 3AC0A94320626C6B00741C93 /* common */, - 3AA415C9205159E1008915AA /* beats */, - 3AD0D41F203D791100338653 /* Base.lproj/BeatView.xib */, - 3A34B250203B239F0079E62C /* Beats.icns */, - 3A6F9AB5202C939D0046F40E /* BeatsPrefPane.h */, - 3A6F9AB7202C939D0046F40E /* BeatsPrefPane.m */, - 3A6F9ABB202C939D0046F40E /* BeatsPrefPane.xib */, - 3A6F9ABE202C939D0046F40E /* Info.plist */, - 3AD0D411203CE40800338653 /* BeatViewController.h */, - 3AD0D412203CE40800338653 /* BeatViewController.m */, - 3AD0D417203CECDA00338653 /* TabViewDelegate.h */, - 3AD0D418203CECDA00338653 /* TabViewDelegate.m */, - 3AA415D520572B5A008915AA /* Authorization.h */, - 3A915921205EB4F4007DE746 /* EditorWindow.h */, - 3A915922205EB4F4007DE746 /* EditorWindow.m */, - 3A915923205EB4F4007DE746 /* Base.lproj/EditorWindow.xib */, - 3A6BA0632062CEAA00A05921 /* config.h */, - ); - path = "beats-preference-pane"; - sourceTree = ""; - }; - 3AA415C9205159E1008915AA /* beats */ = { - isa = PBXGroup; - children = ( - 3A34B24C203B1F480079E62C /* Beats.h */, - 3AA415CC2051B206008915AA /* BeatsService.h */, - 3AA415CD2051B206008915AA /* BeatsService.m */, - ); - path = beats; - sourceTree = ""; - }; - 3AA415DB20582B34008915AA /* helper */ = { - isa = PBXGroup; - children = ( - 3AA415DC20582B34008915AA /* main.m */, - 3A0F656B205D5AE9009DBAE7 /* setboot.m */, - ); - path = helper; - sourceTree = ""; - }; - 3AC0A94320626C6B00741C93 /* common */ = { - isa = PBXGroup; - children = ( - 3AC0A94520626C7C00741C93 /* common.h */, - 3AC0A94420626C7B00741C93 /* common.m */, - ); - path = common; - sourceTree = ""; - }; -/* End PBXGroup section */ - -/* Begin PBXHeadersBuildPhase section */ - 3A6F9AAF202C939D0046F40E /* Headers */ = { - isa = PBXHeadersBuildPhase; - buildActionMask = 2147483647; - files = ( - 3AD0D414203CE40800338653 /* BeatViewController.h in Headers */, - 3A34B24E203B1F480079E62C /* Beats.h in Headers */, - 3AA415CE2051B206008915AA /* BeatsService.h in Headers */, - 3A6BA0642062CEAA00A05921 /* config.h in Headers */, - 3A915924205EB4F4007DE746 /* EditorWindow.h in Headers */, - 3A6F9AB6202C939D0046F40E /* BeatsPrefPane.h in Headers */, - 3AD0D419203CECDA00338653 /* TabViewDelegate.h in Headers */, - ); - runOnlyForDeploymentPostprocessing = 0; - }; -/* End PBXHeadersBuildPhase section */ - -/* Begin PBXNativeTarget section */ - 3A6F9AB1202C939D0046F40E /* Beats */ = { - isa = PBXNativeTarget; - buildConfigurationList = 3A6F9AC1202C939D0046F40E /* Build configuration list for PBXNativeTarget "Beats" */; - buildPhases = ( - 3A6F9AAD202C939D0046F40E /* Sources */, - 3A6F9AAE202C939D0046F40E /* Frameworks */, - 3A6F9AAF202C939D0046F40E /* Headers */, - 3A6F9AB0202C939D0046F40E /* Resources */, - 3AA415E32058339A008915AA /* CopyFiles */, - ); - buildRules = ( - ); - dependencies = ( - 3A0F656A205BE29D009DBAE7 /* PBXTargetDependency */, - ); - name = Beats; - productName = "beats-preference-pane"; - productReference = 3A6F9AB2202C939D0046F40E /* Beats.prefPane */; - productType = "com.apple.product-type.bundle"; - }; - 3AA415D920582B34008915AA /* helper */ = { - isa = PBXNativeTarget; - buildConfigurationList = 3AA415DE20582B34008915AA /* Build configuration list for PBXNativeTarget "helper" */; - buildPhases = ( - 3AA415D620582B34008915AA /* Sources */, - 3AA415D720582B34008915AA /* Frameworks */, - 3AA415D820582B34008915AA /* CopyFiles */, - ); - buildRules = ( - ); - dependencies = ( - ); - name = helper; - productName = "launchctl-helper"; - productReference = 3AA415DA20582B34008915AA /* helper */; - productType = "com.apple.product-type.tool"; - }; -/* End PBXNativeTarget section */ - -/* Begin PBXProject section */ - 3A6F9AA9202C939D0046F40E /* Project object */ = { - isa = PBXProject; - attributes = { - LastUpgradeCheck = 0920; - ORGANIZATIONNAME = Elastic; - TargetAttributes = { - 3A6F9AB1202C939D0046F40E = { - CreatedOnToolsVersion = 9.2; - ProvisioningStyle = Automatic; - }; - 3AA415D920582B34008915AA = { - CreatedOnToolsVersion = 9.2; - ProvisioningStyle = Automatic; - }; - }; - }; - buildConfigurationList = 3A6F9AAC202C939D0046F40E /* Build configuration list for PBXProject "beats-preference-pane" */; - compatibilityVersion = "Xcode 8.0"; - developmentRegion = en; - hasScannedForEncodings = 0; - knownRegions = ( - en, - Base, - ); - mainGroup = 3A6F9AA8202C939D0046F40E; - productRefGroup = 3A6F9AB3202C939D0046F40E /* Products */; - projectDirPath = ""; - projectRoot = ""; - targets = ( - 3AA415D920582B34008915AA /* helper */, - 3A6F9AB1202C939D0046F40E /* Beats */, - ); - }; -/* End PBXProject section */ - -/* Begin PBXResourcesBuildPhase section */ - 3A6F9AB0202C939D0046F40E /* Resources */ = { - isa = PBXResourcesBuildPhase; - buildActionMask = 2147483647; - files = ( - 3A915926205EB4F4007DE746 /* Base.lproj/EditorWindow.xib in Resources */, - 3A34B251203B239F0079E62C /* Beats.icns in Resources */, - 3AD0D420203D791100338653 /* Base.lproj/BeatView.xib in Resources */, - 3A6F9ABD202C939D0046F40E /* BeatsPrefPane.xib in Resources */, - ); - runOnlyForDeploymentPostprocessing = 0; - }; -/* End PBXResourcesBuildPhase section */ - -/* Begin PBXSourcesBuildPhase section */ - 3A6F9AAD202C939D0046F40E /* Sources */ = { - isa = PBXSourcesBuildPhase; - buildActionMask = 2147483647; - files = ( - 3A8FA06D20626DEF0091102D /* common.m in Sources */, - 3A915925205EB4F4007DE746 /* EditorWindow.m in Sources */, - 3AD0D41A203CECDA00338653 /* TabViewDelegate.m in Sources */, - 3A6F9AB8202C939D0046F40E /* BeatsPrefPane.m in Sources */, - 3AA415CF2051B206008915AA /* BeatsService.m in Sources */, - 3AD0D415203CE40800338653 /* BeatViewController.m in Sources */, - ); - runOnlyForDeploymentPostprocessing = 0; - }; - 3AA415D620582B34008915AA /* Sources */ = { - isa = PBXSourcesBuildPhase; - buildActionMask = 2147483647; - files = ( - 3A0F656C205D5AE9009DBAE7 /* setboot.m in Sources */, - 3AA415DD20582B34008915AA /* main.m in Sources */, - 3AC0A94620626C7C00741C93 /* common.m in Sources */, - ); - runOnlyForDeploymentPostprocessing = 0; - }; -/* End PBXSourcesBuildPhase section */ - -/* Begin PBXTargetDependency section */ - 3A0F656A205BE29D009DBAE7 /* PBXTargetDependency */ = { - isa = PBXTargetDependency; - target = 3AA415D920582B34008915AA /* helper */; - targetProxy = 3A0F6569205BE29D009DBAE7 /* PBXContainerItemProxy */; - }; -/* End PBXTargetDependency section */ - -/* Begin PBXVariantGroup section */ - 3A6F9ABB202C939D0046F40E /* BeatsPrefPane.xib */ = { - isa = PBXVariantGroup; - children = ( - 3A6F9ABC202C939D0046F40E /* Base */, - ); - name = BeatsPrefPane.xib; - sourceTree = ""; - }; -/* End PBXVariantGroup section */ - -/* Begin XCBuildConfiguration section */ - 3A6F9ABF202C939D0046F40E /* Debug */ = { - isa = XCBuildConfiguration; - buildSettings = { - ALWAYS_SEARCH_USER_PATHS = NO; - CLANG_ANALYZER_NONNULL = YES; - CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE; - CLANG_CXX_LANGUAGE_STANDARD = "gnu++14"; - CLANG_CXX_LIBRARY = "libc++"; - CLANG_ENABLE_MODULES = YES; - CLANG_ENABLE_OBJC_ARC = YES; - CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES; - CLANG_WARN_BOOL_CONVERSION = YES; - CLANG_WARN_COMMA = YES; - CLANG_WARN_CONSTANT_CONVERSION = YES; - CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; - CLANG_WARN_DOCUMENTATION_COMMENTS = YES; - CLANG_WARN_EMPTY_BODY = YES; - CLANG_WARN_ENUM_CONVERSION = YES; - CLANG_WARN_INFINITE_RECURSION = YES; - CLANG_WARN_INT_CONVERSION = YES; - CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES; - CLANG_WARN_OBJC_LITERAL_CONVERSION = YES; - CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; - CLANG_WARN_RANGE_LOOP_ANALYSIS = YES; - CLANG_WARN_STRICT_PROTOTYPES = YES; - CLANG_WARN_SUSPICIOUS_MOVE = YES; - CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE; - CLANG_WARN_UNREACHABLE_CODE = YES; - CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; - CODE_SIGN_IDENTITY = "Mac Developer"; - COPY_PHASE_STRIP = NO; - DEBUG_INFORMATION_FORMAT = dwarf; - ENABLE_STRICT_OBJC_MSGSEND = YES; - ENABLE_TESTABILITY = YES; - GCC_C_LANGUAGE_STANDARD = gnu11; - GCC_DYNAMIC_NO_PIC = NO; - GCC_NO_COMMON_BLOCKS = YES; - GCC_OPTIMIZATION_LEVEL = 0; - GCC_PREPROCESSOR_DEFINITIONS = ( - "DEBUG=1", - "$(inherited)", - ); - GCC_WARN_64_TO_32_BIT_CONVERSION = YES; - GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR; - GCC_WARN_UNDECLARED_SELECTOR = YES; - GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; - GCC_WARN_UNUSED_FUNCTION = YES; - GCC_WARN_UNUSED_VARIABLE = YES; - MACOSX_DEPLOYMENT_TARGET = 10.12; - MTL_ENABLE_DEBUG_INFO = YES; - ONLY_ACTIVE_ARCH = YES; - SDKROOT = macosx; - }; - name = Debug; - }; - 3A6F9AC0202C939D0046F40E /* Release */ = { - isa = XCBuildConfiguration; - buildSettings = { - ALWAYS_SEARCH_USER_PATHS = NO; - CLANG_ANALYZER_NONNULL = YES; - CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE; - CLANG_CXX_LANGUAGE_STANDARD = "gnu++14"; - CLANG_CXX_LIBRARY = "libc++"; - CLANG_ENABLE_MODULES = YES; - CLANG_ENABLE_OBJC_ARC = YES; - CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES; - CLANG_WARN_BOOL_CONVERSION = YES; - CLANG_WARN_COMMA = YES; - CLANG_WARN_CONSTANT_CONVERSION = YES; - CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; - CLANG_WARN_DOCUMENTATION_COMMENTS = YES; - CLANG_WARN_EMPTY_BODY = YES; - CLANG_WARN_ENUM_CONVERSION = YES; - CLANG_WARN_INFINITE_RECURSION = YES; - CLANG_WARN_INT_CONVERSION = YES; - CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES; - CLANG_WARN_OBJC_LITERAL_CONVERSION = YES; - CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; - CLANG_WARN_RANGE_LOOP_ANALYSIS = YES; - CLANG_WARN_STRICT_PROTOTYPES = YES; - CLANG_WARN_SUSPICIOUS_MOVE = YES; - CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE; - CLANG_WARN_UNREACHABLE_CODE = YES; - CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; - CODE_SIGN_IDENTITY = "Mac Developer"; - COPY_PHASE_STRIP = NO; - DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym"; - ENABLE_NS_ASSERTIONS = NO; - ENABLE_STRICT_OBJC_MSGSEND = YES; - GCC_C_LANGUAGE_STANDARD = gnu11; - GCC_NO_COMMON_BLOCKS = YES; - GCC_WARN_64_TO_32_BIT_CONVERSION = YES; - GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR; - GCC_WARN_UNDECLARED_SELECTOR = YES; - GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; - GCC_WARN_UNUSED_FUNCTION = YES; - GCC_WARN_UNUSED_VARIABLE = YES; - MACOSX_DEPLOYMENT_TARGET = 10.12; - MTL_ENABLE_DEBUG_INFO = NO; - SDKROOT = macosx; - }; - name = Release; - }; - 3A6F9AC2202C939D0046F40E /* Debug */ = { - isa = XCBuildConfiguration; - buildSettings = { - CODE_SIGN_STYLE = Automatic; - COMBINE_HIDPI_IMAGES = YES; - DEVELOPMENT_TEAM = UZ3M9EEN74; - INFOPLIST_FILE = "beats-preference-pane/Info.plist"; - INSTALL_PATH = "$(HOME)/Library/PreferencePanes"; - PRODUCT_BUNDLE_IDENTIFIER = "co.elastic.beats-preference-pane"; - PRODUCT_NAME = "$(TARGET_NAME)"; - WRAPPER_EXTENSION = prefPane; - }; - name = Debug; - }; - 3A6F9AC3202C939D0046F40E /* Release */ = { - isa = XCBuildConfiguration; - buildSettings = { - CODE_SIGN_STYLE = Automatic; - COMBINE_HIDPI_IMAGES = YES; - DEVELOPMENT_TEAM = UZ3M9EEN74; - INFOPLIST_FILE = "beats-preference-pane/Info.plist"; - INSTALL_PATH = "$(HOME)/Library/PreferencePanes"; - PRODUCT_BUNDLE_IDENTIFIER = "co.elastic.beats-preference-pane"; - PRODUCT_NAME = "$(TARGET_NAME)"; - WRAPPER_EXTENSION = prefPane; - }; - name = Release; - }; - 3AA415DF20582B34008915AA /* Debug */ = { - isa = XCBuildConfiguration; - buildSettings = { - CODE_SIGN_IDENTITY = "Mac Developer"; - CODE_SIGN_STYLE = Automatic; - DEVELOPMENT_TEAM = UZ3M9EEN74; - INSTALL_PATH = ""; - PRODUCT_NAME = "$(TARGET_NAME)"; - PROVISIONING_PROFILE_SPECIFIER = ""; - }; - name = Debug; - }; - 3AA415E020582B34008915AA /* Release */ = { - isa = XCBuildConfiguration; - buildSettings = { - CODE_SIGN_IDENTITY = "Mac Developer"; - CODE_SIGN_STYLE = Automatic; - DEVELOPMENT_TEAM = UZ3M9EEN74; - INSTALL_PATH = ""; - PRODUCT_NAME = "$(TARGET_NAME)"; - PROVISIONING_PROFILE_SPECIFIER = ""; - }; - name = Release; - }; -/* End XCBuildConfiguration section */ - -/* Begin XCConfigurationList section */ - 3A6F9AAC202C939D0046F40E /* Build configuration list for PBXProject "beats-preference-pane" */ = { - isa = XCConfigurationList; - buildConfigurations = ( - 3A6F9ABF202C939D0046F40E /* Debug */, - 3A6F9AC0202C939D0046F40E /* Release */, - ); - defaultConfigurationIsVisible = 0; - defaultConfigurationName = Release; - }; - 3A6F9AC1202C939D0046F40E /* Build configuration list for PBXNativeTarget "Beats" */ = { - isa = XCConfigurationList; - buildConfigurations = ( - 3A6F9AC2202C939D0046F40E /* Debug */, - 3A6F9AC3202C939D0046F40E /* Release */, - ); - defaultConfigurationIsVisible = 0; - defaultConfigurationName = Release; - }; - 3AA415DE20582B34008915AA /* Build configuration list for PBXNativeTarget "helper" */ = { - isa = XCConfigurationList; - buildConfigurations = ( - 3AA415DF20582B34008915AA /* Debug */, - 3AA415E020582B34008915AA /* Release */, - ); - defaultConfigurationIsVisible = 0; - defaultConfigurationName = Release; - }; -/* End XCConfigurationList section */ - }; - rootObject = 3A6F9AA9202C939D0046F40E /* Project object */; -} diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/project.xcworkspace/contents.xcworkspacedata b/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/project.xcworkspace/contents.xcworkspacedata deleted file mode 100644 index b7675b8ff508..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/project.xcworkspace/contents.xcworkspacedata +++ /dev/null @@ -1,7 +0,0 @@ - - - - - diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/xcshareddata/IDETemplateMacros.plist b/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/xcshareddata/IDETemplateMacros.plist deleted file mode 100644 index ae4bfae62633..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/xcshareddata/IDETemplateMacros.plist +++ /dev/null @@ -1,24 +0,0 @@ - - - - - FILEHEADER - - - diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/xcuserdata/adrian.xcuserdatad/xcschemes/xcschememanagement.plist b/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/xcuserdata/adrian.xcuserdatad/xcschemes/xcschememanagement.plist deleted file mode 100644 index 58581c18ad79..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane.xcodeproj/xcuserdata/adrian.xcuserdatad/xcschemes/xcschememanagement.plist +++ /dev/null @@ -1,32 +0,0 @@ - - - - - SchemeUserState - - beats-preference-pane.xcscheme - - orderHint - 0 - - helper.xcscheme - - orderHint - 1 - - launchctl-helper.xcscheme - - orderHint - 1 - - - SuppressBuildableAutocreation - - 3A6F9AB1202C939D0046F40E - - primary - - - - - diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/Authorization.h b/dev-tools/packaging/preference-pane/beats-preference-pane/Authorization.h deleted file mode 100644 index fd25568f4e0c..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/Authorization.h +++ /dev/null @@ -1,23 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -@protocol AuthorizationProvider -- (BOOL) isUnlocked; -- (BOOL) forceUnlock; -- (int) runAsRoot:(NSString*) program args:(NSArray*)args; -- (int) runHelperAsRootWithArgs:(NSArray*)args; -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/BeatView.xib b/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/BeatView.xib deleted file mode 100644 index b097b91ba511..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/BeatView.xib +++ /dev/null @@ -1,129 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/BeatsPrefPane.xib b/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/BeatsPrefPane.xib deleted file mode 100644 index ede949b14a03..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/BeatsPrefPane.xib +++ /dev/null @@ -1,66 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/EditorWindow.xib b/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/EditorWindow.xib deleted file mode 100644 index e95b5c215ae5..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/EditorWindow.xib +++ /dev/null @@ -1,147 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/pane.xib b/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/pane.xib deleted file mode 100644 index 4f80f209bb98..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/Base.lproj/pane.xib +++ /dev/null @@ -1,122 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatManager.m b/dev-tools/packaging/preference-pane/beats-preference-pane/BeatManager.m deleted file mode 100644 index 650c745ddd6e..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatManager.m +++ /dev/null @@ -1,22 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import "BeatManager.h" - -@implementation BeatManager - -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatViewController.h b/dev-tools/packaging/preference-pane/beats-preference-pane/BeatViewController.h deleted file mode 100644 index bc15c8300499..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatViewController.h +++ /dev/null @@ -1,48 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import - -#import "beats/Beats.h" -#import "Authorization.h" - -// BeatViewController handles the individual UI view for a beat -@interface BeatViewController : NSViewController -{ - IBOutlet NSTextField *statusLabel; - IBOutlet NSTextField *bootLabel; - IBOutlet NSTextField *configField; - IBOutlet NSTextField *logsField; - IBOutlet NSButton *startStopButton; - IBOutlet NSButton *bootButton; - IBOutlet NSButton *editButton; - IBOutlet NSButton *logsButton; - - // The Beat being displayed by this view - id beat; - id beatsInterface; - id auth; -} - -- (id)initWithBeat:(id)_ auth:(id)_ bundle:(NSBundle*)_ beatsInterface:(id)_; -- (IBAction)startStopTapped:(id)sender; -- (IBAction)startAtBootTapped:(id)sender; -- (IBAction)editConfigTapped:(id)sender; -- (IBAction)viewLogsTapped:(id)sender; -- (void)update; - -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatViewController.m b/dev-tools/packaging/preference-pane/beats-preference-pane/BeatViewController.m deleted file mode 100644 index 2edfd6bbba85..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatViewController.m +++ /dev/null @@ -1,151 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import "BeatViewController.h" -#import "EditorWindow.h" -#import "common/common.h" - -@implementation BeatViewController - -- (id) initWithBeat:(id)beat - auth:(id)auth - bundle:(NSBundle*)bundle - beatsInterface:(id)beatsInterface; -{ - if (self = [self initWithNibName:@"BeatView" bundle:bundle]) { - self->beat = beat; - self->auth = auth; - self->beatsInterface = beatsInterface; - } - return self; -} - -- (void)viewDidLoad { - [super viewDidLoad]; - [self updateUI]; -} - -- (void)updateUI { - id beat = self->beat; - - if ([beat isRunning]) { - [statusLabel setStringValue:[NSString stringWithFormat:@"%@ is running with PID %d", [beat displayName], [beat pid]]]; - [startStopButton setTitle:@"Stop"]; - } else { - [statusLabel setStringValue:[NSString stringWithFormat:@"%@ is stopped", [beat displayName]]]; - [startStopButton setTitle:@"Start"]; - } - - if ([beat isBoot]) { - [bootLabel setStringValue:@"Automatic start at boot is enabled"]; - [bootButton setTitle:@"Disable"]; - } else { - [bootLabel setStringValue:@"Automatic start at boot is disabled"]; - [bootButton setTitle:@"Enable"]; - } - [configField setStringValue:strOrNil([beat configFile])]; - [logsField setStringValue:strOrNil([beat logsPath])]; - - BOOL unlocked = [auth isUnlocked]; - [startStopButton setEnabled:unlocked]; - [bootButton setEnabled:unlocked]; - [editButton setEnabled:unlocked]; - [logsButton setEnabled:unlocked]; -} - -- (void) update { - beat = [beatsInterface getBeat:[beat name]]; - [self updateUI]; -} - -- (IBAction)startStopTapped:(id)sender { - if (![auth isUnlocked]) { - return; - } - uint64_t took = getTimeMicroseconds(); - id beat = self->beat; - - if ([beat isRunning]) { - [beat stopWithAuth:auth]; - } else { - [beat startWithAuth:auth]; - } - took = getTimeMicroseconds() - took; - NSLog(@"start/stop took %lld us", took); - [self update]; -} - -- (IBAction)startAtBootTapped:(id)sender { - if (![auth isUnlocked]) { - return; - } - [beat toggleRunAtBootWithAuth:auth]; - [self update]; -} - -- (IBAction)editConfigTapped:(id)sender { - if (![auth isUnlocked]) { - return; - } - id beat = self->beat; - NSString *conf = [beat configFile]; - - // Create a temporal file with current user permissions - NSString *tmpFile = [NSString stringWithFormat:@"%@/beatconf-%@.yml",NSTemporaryDirectory(), [[NSUUID UUID] UUIDString]]; - [@"" writeToFile:tmpFile atomically:NO encoding:NSUTF8StringEncoding error:nil]; - - // Cat the config file contents into the temporal file - [auth runAsRoot:@"/bin/sh" args:@[@"-c", [NSString stringWithFormat:@"cat '%@' > '%@'", conf, tmpFile]]]; - - // Display editor on temp file - EditorWindow *editor = [[EditorWindow alloc] initWithBeat:[beat displayName] config:tmpFile]; - NSWindow *window = [editor window]; - [window setFrameOrigin:[[[self view] window] frame].origin]; - NSModalResponse resp = [NSApp runModalForWindow: window]; - - if (resp == NSModalResponseOK) { - // Cat temporal file contents into config file. - while ([auth runAsRoot:@"/bin/sh" args:@[@"-c", [NSString stringWithFormat:@"cat '%@' > '%@'", tmpFile, conf]]] != errAuthorizationSuccess) { - // Authorization expired because the user took a while to edit the config - // Ask to reauthorize - NSAlert *alert = [[NSAlert alloc] init]; - [alert addButtonWithTitle:@"Retry"]; - [alert addButtonWithTitle:@"Cancel"]; - [alert setMessageText:@"Retry authentication?"]; - [alert setInformativeText:@"Authentication expired. Configuration changes will be lost unless valid credentials are provided."]; - [alert setAlertStyle:NSAlertStyleWarning]; - if ([alert runModal] != NSAlertFirstButtonReturn) { - break; - } - [auth forceUnlock]; - } - } - - [[NSFileManager defaultManager] removeItemAtPath:tmpFile error:nil]; -} - -- (IBAction)viewLogsTapped:(id)sender -{ - NSAlert *alert = [[NSAlert alloc] init]; - [alert addButtonWithTitle:@"OK"]; - [alert setMessageText:@"Can't display logs"]; - [alert setInformativeText:@"Due to strict permissions in Beats logs, they are only accessible using the command line as root."]; - [alert setAlertStyle:NSAlertStyleWarning]; - [alert runModal]; -} - -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/Beats.icns b/dev-tools/packaging/preference-pane/beats-preference-pane/Beats.icns deleted file mode 100644 index 87108ae8ff720eae139e4ff7e2a94c1628c583f3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 77351 zcmeFZbyU>f_cuBW0}de4polVbNr)f~qf*i!-3Ta1mvoGZ5)y)RN{5tmj{*Wxg3{d~ z-OW9tAMf|Oe$QR&x$8dv-St_EwT5}msa>zV&p!KoEKO~lAXr>1mZm&H5D2ebpo)?V zAwD%e1Og#^C@ZN3fk45(PzW3seC)dYJO&?FPHHmuA%)#E%b*9{L&Ra8;oadmK(vRCn6wL1CXbRN8Hq z=CnJxbW7i1dq3_eCFwA zWbC@{ZsgjBcqe-jD36EWEERzfc#181v8KVLw=PJHCEK__p zC_O)aUagP#?N|)orIZ5AS!E)PeV?s$4kgi{?SNade#miXW=&-=7GSv{Vsljwe(^ya zKV?{B&D;6#xR>bGxafAxoZCy<#_Y`(B|Zowf)jfFA}f=WEr{VLWZgA#a)|~On-*`z z_dd50SNuJVwcB_hM_9E$x)3}8X^X=Lspec;CHn#Coam0e18<&AXxG6VjH+c9Sgo?2 zH@)-LQ2-0dNxn&mBq-sON-c)ci8HuAnCfAThctpT`OJla^@;J}_ z{D?1 z2}{@nf1T56w|PQEQc~?Iqhx9b`1$UPUOWU9kE8VQYbG~~CwAfW2HRgMU3%AK{m^g0 z@7F9vk$%V#SVTRRmP}HVXGG8SDt4Qaz&FSN7#~C@Kh_P8cu842?vOSzjLGNXTNhDh z(>*`*D)_O~sgwc>x<+-FxwX#llrrjOX88=pL$hA?d!d~$FN9FulJBN7Vz8nirZZ#Bq9px z?Ep`?F~aBJ&Yn(2j(QKbfT*d#O^6ZSRZxY*G6`>NuO7|6?taD#6#^Wd%ZXK^Lr&p9 zGl~5hsYm$sFL75562ai29I05Fl0Z`jp>&}|*J@05y?gmfd^a2oEZh4zrnn{RAAco7 zgbSgFr5f*goemMQ*f!MOar#UUi;M)zRD8kDi3QCibL&X&pHP+@oEUgl(*~1FCB%p% zRWAa9+J`fGLMM3Y?As@091_QNrBa8$Z;uC!_F+M+_Whe#y$9sC9fZgP)sfitIj=`y zaB@k+>DSGycat2lpZXYi3INHvl&++Ra8HzAohh(0--HuUCRt-#EJE~Uo^@tqDg;Vb z^W5S`8xu~OdJxQzF%`>=Bv1rS%o>gqYMwsEXo^8`Q?j&=P?-LO5|-Ju;x@>blX4o8K5!%@E!*NRWZ=Fd2d; z5=nD5ut{iY7r$(BK-N~{hl}_{K`wy>RU`{|a2oS6fi`Zk3`arXzpTKS;FX~6wLH&@ zr#0#1H&DZP7LX^4PdK13e0t)vC4m?px7Fqs85~_u@B_ZObuKA_hXWNlSKxQh^-TUc ziEIg&qosv}8Vkxs0`L9xx{$V3n5h^368Qj-M`(gET6Zcq-TCZ!SlI5OnDP;Y3?L&> zx8pqoRgHJq_2%UZPuoXB@kkHQemU1)7EUZ%jdavR7hN%wIR5tj4Vx&GAI$yiF>e5f z;d=1j%Vi!?Q^K|psaS0fDCPl|e!*snO_rKQm2AgfXwrYD0qk?q?~?OF`rzDWjq;Uf zTyFo!3Z#>!uA2;l^Qj0$q>?KjpXneK;US39o z^8!l0;nULqAIlP+Na}X9oj|+NZa7EJ^$D!Mtv^Nt3mQVI%~P^Cl^GJ>DGJl21B>_n z#Q#Ty>IlP6=ofF@BSd!Nv)_QiMwp0GD(8;ZI!4QDT=0GZLUXh_-9Y@Tz^zjFYDF*G zx2+!52QXUJNKsPK4=Ih4r|N7j{ebE@79a-aR?T}rOeoTkKUIrs;uIaU&}pj)4FT%U zH}Jz6n5rH^JulLZ^)70)lpY9AF0=WeACeiMEQIO_y~;gGL!cOk*HU>% z_4uOVE@{8MBFQGB4SxPZJYv>jG@t^H_7LJbQ>J08h&_rS*Yiv=E`u z1&7~Xa+D_cwFLv+V!a+@Tv$kxtyZ5O23{wJ=uk}e|K_cp*ESUm)???jZ3H_d8LVX`hAaj~FBWI2-arrR-5Z?`dg zlV_U0=Z9Q@<*C*&yWGPIKsVxBKtw4(Z2O%NMI5CmVEOC^X>2J#!tPhhVCMs1iY`b? z;Ud5jugnNcc1|7O2SFv`H>+OlwtUw24Fx8;B=sI3oh3!Un?CBeD&QSNFJZ>xLlsw9 zK1zs1(*OZG!ODaH0Z%9cPM-R7GW@qCRH9E=LmxCedT*c!8tN1zRsr*PfxLR!mR_#| zSAW|AydQbd0x!Toe`r$FO9M{*ZZ+65z^0!H<_Iw83YB2-)3nm_0_%IJM?fkI*Y!{k z6qLZ(U#=RxEHBmqo{>|@SO7^GA=X8wCWlvJZpU16d%W=JV+1`WbecBS;^!<0c!~Z1 znm*tkV+O$R66dS@rPk}BnalA1VzaRa>gCQC)H1CDH)Z%F3(ufKLfU(mbbN(TRJa2;!&mpuiXiY8C#<;_34j6qda}bENXC zynxZfA!($D%B^n`kmNi9O2!g9{YS}O9e&nrrItzU2Q+C0>xDs3GjR1LZHI^`%l||o zZK243N^=(Nca&ffm9n4?FiA9?y0FN))$n6VdX;RjL?xak%o5Ylvm#u2N7^B#gbd#u z0eW<_a{?v52lG)07tM@Q1y7_2SgfJ2K2GA9&2eWL)|&r9Hbs)0*DFbiaYGp}YT!04 zh%+pKlGx`UbIE;AzNd^chu;MQjIh(+gaUZx5%)cxGjNxcymAB}V6L))mjRjT4Ry7y zU#h}h)0_AP3%vzU?bACF46Vut$qW5STxl|kda&HR1x-dIViD@Ve=LWQ$Q8gUA=Wf< z;2WZlW4#(j+3He^SD`ijacJb8vs3HPJ zIKP)WIU9)zIc$*3%67Zv&F7QL@o$h8xEpg4D2L$j<6i3*Ec|+uN0-MCr8{VA-Dv3K zS3XcAosj$KXW~QNr~KDwV>sq>`i6DZR@Z|#40a-Gvl^^k$xBx({7O%^GpcRmm)G$} zk74XnpmY3k6YX)5`$IMEc7w;H--6NV%A4vma>`Qkq1m&A?#hb$`y1Ddcm#!RSJgP% zFON)Mzmy?T+9$jj_4d~@jXn_6S@r7<(0zvkIWmxU0hr;y$$F01eN#0;t4I@Yf7@VW z$L!};n+5s!MZtsFp`=yLDp$wpDTYg$G!hLPOFt-A_0G0UBRh5pX@zs{Rm#vdICjOP zr`UbB&Z7Gc1)~y#bAnOzV3dqqpF23h#I7oOANVW|S1z(dR+9PH+i&IFI0^N1DO-G1 zs>$MsztB+05h^~nbW!nhD9wrZJERkC7d^Yx|S`K z`j)tUa_!Z6p7P1|V*L@fFw=UXfLq2;#7j1blO>A$ikp^+t#}z23$6$XcmqK_$KQQ_ zAnK!eF=#8he`T!L_3`v(jBAR+!@ao3ZZQU~D9>zyTZLbJg~!j<8N#2V%95lbpBLS4 zc0FFszOap05+Qi^krD4FJ@FUQlQ&`2v$;DL<5Q^VbY*wj$hpc3&zncp>4pnu7mJdo zaZFgAkWcEIC8UV&H&KFyV`rNK1T_-7M(I`g2Nl_dI}6#*QyhD(?pN&}TzdujlH6?#pBZWz2% z$M__!h&n$y&zDlHzmebL!qZ2Cf#<0jS(!F)8ISEdND$%PsP^tqmYX6TU6vQ|?Rj%~ z&AuN<+I$Rxqfxl278EhuSWqX*t70eol`JWen?D8#+!{y@e@Ptid%_kvtzR&M7%Bd; zwFdwPCZ6H(@?Tr!9Lf?3n)wk6Q{L@2QMA&&XDoKYoq|Lp7WqI{1*eq2fm%UF4G&gC zA{j2I28a(vGDxa~gv6)FddoKq44T{?z{|i^;Jcb_Fj${CYRla~Bt^e|`|YtK{Cc|D z>C2_FjkEEk5i60E(E$r+7cgMHo`Fsnd`@AiA-KC%Ui!gB`=s=S=j5qSx49G432d1< z1ABmDAis}z73evb^do9+B**v8G)sPP~YaKJD^>;}nG9iW)=D}hN6R2IS5&exqri7qK$>RQ`?$*WQ9u2Qsa8`U96 zL)O4?gJoLJl7P^jtN7QUX~QQwRo{HW_c1d4Zt{+PQ+8B|2FIL$mNNJVFR(Fr zJdQskB(V>OGZXgMQ=Q`>v_|p2s(RNIdP=ZZDaTlAa%l7qlJt&KSiR~jwec8Tq)1Vc#&dfTCvn(k-bKm`Un7`adOjfU z3Y*=`O|Kkt_MkQ;f3y$W(QtlT0Px(!Xj5*nh2Yvy11FQ0**0y?nT|)H6UoVog_2dN z)Gd`C&sMvNEZXLn*~)-Qf1i&L#e$wt9{9SB4of)c(!cw1=wLNOiYkIpyjJgIq$elhnKz|*6^L*bAR|A*!`u@;w96#b`U*PQ66*;R%-wscRI`vxNx_UKu_RmOOP~Q8ftycBSctgY7LVH_#VJVaVd!!vc4XM z=6~&#>8aiukPDe5WZ3-Zhl?fy;oS`UmHnotmf>mn+)E!dZ`Gs^A3oG)68E3JNKT}8 zTUeU=vB9N8XFl>DZ$t@WUT@eXG#YC(K0mU&QjwlNdwpkNFHzm~t;6nhtBNr<^YPJP zkn5uM`x0$90}Eo{DIdM4wR8Vb;2Co{V_W|sMV($!`3e!2*gA{EpeIA<`IEh9$Je0b!lsUyQBJKaWAs|{t1ixL_Max$%J-rfX8{eHsryHgE^8`L~uY>og| z+T2l@GO0Px_TclS8(KyUR%xXS1cTkaj>DhK32SqdY5Y3|ea^p5ay?s{H%I_lbC)F@ z@HZUYAcgHZ?$V#xFX*4LDsW>KohCK~ddO!O5BkzhPYo}5JQ?RfQ z2R;JKw%l#kyw!W%)2?ADr;0pO>7nc!!u0gg*$RJef|Qful%~*vozIT?LFZ4p3M!uu zRwqs4kbrPK<9io=afq^oCX7(>HA^9EXn6~ zT|tv||F!8M$$74DW7TzeFj@3je@lCq&XKE)mxbFQGFN@w@(D>~FzhV!5q1Jw;&^rG zHWgFt7kU-=!1+zBcHW1`WALpo2#-q%fD^v#`}FN^aEln*m59#59IZOue`Q-1!L`C`zv zdO1dofWG)Yk=+8lz5VA?TAvdeyYm4CZV}sOF}@r63(xi{K9E1ZWz_I^U+W~n9NoTg z;XC&T`)OdzkFICu#es<7#pg zIj+Q8;cuQMA5F$KrWToRobo7I0&7t1>%C~jr zPqmm8(LX)U;?7oboX1McEQ;5-&oA)ZzKrxt?k>DzJ(hiP4`+fH#A^?(D&F@)GT>a< z?P@%^be(HRXkygKhhfpCRUe4!;FeLzOvdw%Vn5>Bu}~Kb!vveEo>)&v*}tBFwB1jg zXc#YDxR+ngzzMhDujKKjmy66;DY1d6L}X_0%uAYu+SQ`fGe(OhughmY#L$+{XUVsw zEt#%qkHs&8ST7^}N*Y4N0(kXty$uNo_i3ZM&Pq@RYbBoNoJI|Gwd!1z=K&YgkVq?R zg*BYRs(J{&@w{^YE+X4MiV}4TuE5y1Whb`LNz2H6`lxYhao%4d=zbYX_1BAu(9qE5 zH@AE+gVO`nzEAx`E+s> z4BA-2jAmcTM~_X8j-GtF#Yok#Wqg8x?3O-W3Ft3@q8hPzU^8Iyn!~Q zAgj}6*d?ie2!U>WZoqLBcUyTlN-N>9_iawfcLm3H#lI156d6qQbid_d__*0&c`))i zP%BYAqIOkmd-&@FkoM$KSzE7h9W1e`5cgOeahr@lmA8AIW;5zh%}ZSfS)jT!fLp4!K6c7FfYqt;Fbl#fCg`=-r0_5&hePUmCC!^R~^V3 z#oDE?!((0ygulT}#mz_~e5gd|!CdXU+?_U`)Z~@lt}(H%sQK+uUQ*IYqy&-D^XJTy zH)h*YW=}31?{EAvy1KEk!9lCw6QXE1cQPyI&g!5Y?N#*cgUkapxpUi7i=$8TH-Ovb zpyoC4U=}jj7>G_x<;g0(!y7|iE4ib+J4PYb)@j# zg_rZSIt})yO6Hh@8-?oZxpj3L`VS*dC*nIlV8wEnNmmR)%raCs3GakvB~ux28vJ++ zEdKlOu>0UA^A2UXeaQPqH&;G3$?u=nGg+Qrl=fVTZ*VHyP~F$?S(CJ+$6MSn&~1vdx?@+BS+ToW@27i`!) zq8icOW;LUP{V~{(??LHA?~3x(dAH9n64^jluW^) znW)YcW5BoUKHQLgQX91YS*ho#QMewp-wSfxco-a*Yjyl&J%?uD+Y?Hz&ZajqBykbGt&ERH{x;3J^m(mrKn4aJ|b2X zo$2>9V+(9g-N}|#mrl>WZ*Ine?I789v|jqo!$N#F>GVZDqZ;4~WVOU3ANV23U=hkv zBm7ln_RdE^6fBI~=VFT5^kI(*#TTN(6upHriV`tVwXU`$31agjT5|hg>!g9pPt{b@16OxGF-%?dD2^0&~kj|=Po|JN8cz;-n@QoWQfmnG0>0i+EzvE zA4zo7+m(nXh>LiN6LkfZMgS7=y`MjPSa%=asq2wwWqCj&)pAVpO31_9#)%L)z|L$4 zg=JC5`n3DH^?o^jN_k6vNqGMUe!uV2K8Quy%F~WcN^qq5UM>|Rm|4PU3L2bJeW#Xj zyw6&hD!utt5Yt`{v9s@Je1p|-M}K+&2OIAZSeD`82^D9J>)uLvlQ%*A;b4~LL5?`c z#M(s15dtTvkPDOZL%&CEvw0Kk9vrM0eXrcCnnRSEuy;}9Xnu(|^OuRQ4H_QBcxd(4mk>VT=Ft&mA3jVdO+iOng4|U`IqwX}F$Ucqn(Xf{ zciBSE@V8rf7Y4@VSYTmzS4s>Q&kIsu~z12|omD8+&eGNOAcFWypo_Jw1p#b^nA7$%Z?whVlT{Tn6tP@b z_phW%r_ZMiQ9CuYR7{kQCL7e)!xK5g!~4F!;+FvjVKi7aN`B~fI1vY1w26a1cFZPU z;Iyxwt$#KP&b2eTMl5>;y4rz^y`KnnP{x!NcfncUCba#{hUm}n{yj70jni{?v7P9c zj`^r|%;=xML8~WSa1|w3GpF2FVsH+HM$J*5_ApY-4W}e#9hlkK*%|fJB}cUrod3)< zRiaIJ$f)-Fnmtpukv)KIUuCZ?G7zeb3{)dw_h~!RSPO>ec{~` z+bf@G^*!`0gndz7Nysl_B$J|s^gy94l!CGP)=ym>cfGf7tZ~PDJK>1>W+o#eQ=ML# z&f;ET^!~I?@F=8#!Nl>IAxR2{gF4sa5vevEY?W8+gK@KcAEuu&&#tVw*gkPvfz7ZE ziy7fL=;LL|3E?})1Vp6Bt7hu6cPU@#{3RdSwxRGPS-7hs*DyEV=oz#Rl95FoLMVy- zUAsrWb71^O63s4|Qil|81OjPX2#s_~Lhmn=Z#tltKL+Q3JZbn96tN|wPc`th%!hw+ z3y5$Al%Q~Ix^;#lILnwKzAONew3uT6PebQ05l5h;ZBo~m?twiSGu|r;*T^S#Z4v-3 z+Hm>JgNETxP=W)HjB0VGKt*gGDzQ-j;)n~V@`6Om<0m;-tWUFFI>rm$CUPpKt&UI%o4(jFfJ zpzIn|K>AYL$)M2!0{wQ-A#0N#a;Lp21^j|T#p-Xb{29+NsR0);I3Gm=23|lAw@M^7 z4ct|%2EJq-hx8_R2u`JBwhl(hD_jylGQpyu1as06{tz|i1ZjwDN8=bo0>8=3{1Q9` zl?1UaCTar^@~oevOkiCGP?4`(bz>TkU-TUV#)Qa<6((Jfjwq8xNKRUJ-Pg2? z0sRfO2QY1eaPHH1i?vMS6<`4xa1rq@e#3D<`esz!JYxzKfK$VzX%^6(+|YOh-_MGj zz?MT)vKtGer@4!FF-s^y27Hn5ULJE|SsCv>v<5u?q`}>b@vjun6uTDs0SnBLLH)TV z3z+X1mN#9xOduy20vO4s`_l`g!rLm)ZA-_5;@F5${*P=Pgh)jNTug$R2P#0x{Nn{n z9v15%8R!Wo7F18wE$~?anfGomCZe%C>KfqJ3RysUZDmp8?*8#zUg3N|$45=2G0@zi z3VCSUl+9=I49Gl}GXxEm`&|vSA}It?*=pPSTv`7dY$C$(QFAN4MqZnBgd%DrZxOm6 zsItH-mBKLI7Ntg0DDV0z&8iHU*-I851~>$^Lp&~P7v2tot)D2$Ef(30iO~8uHp)Qz z-V!jaa~6@n4rtr(TIL-}4aaNUa8 zNlIJI0@*r+>={rO0#5l;$-i8%$>#N)vH|>3MjgHb)B1x0XM@r1#=}VecC9pS;OFc7 znn0NX=GY~mNhBz;K*3iRiM{!Q-Uo9UbQ|U)xLqzHuKQNqTqp@3n=r)zU@T$-N_X6} z6mOO1uKdX74oFfysn~)8qPE$H(|Y;m8+<#TI)2Lgi&H>A!AP3=U-FB|BJX0H=WdID z1+9)*W0HCw@yA9_no&e%{B8~cpkn5`p!^-o411uE;^KH*OW%QK4~1X63>Ckev)oJx z&gPK1urFCQi*{oX(H70Uh9KGd=QIi&F&Q72(OhI}az07g1#9XvVj#gN5f*fdRTtw;Y!~V$2I+F(=KzHFAvV#?bLSTkuaV8+;$TgE zT4W@E4&!d91G%E)hg~NkL${V$r{qppHF@zRM2vY9zz-=Z*>i`BvyvSFull7c+bJL| z$x|94gVC9XpdciLTIgcN^(n90y-EeZ8Qy0E7^P-{646|avC56uumz>Na^byNCx2eObtmC=7<3;pSCZ!l z0zrFdyWK?!O|5ZLEq+YZtEZem7e6jr%L4KIgnOC#mY>LNoMdO+jDt&JhX?ZFMF39R z!9TSZRcLTnJl^wsLNkp84wl>qjH$_8F~VbjipZ&2o`voR2rqFn;K)CU1zSFi2e*Kp zfn#7vWp#Ozv!!1G)O)# zQh)dsq~`SzUTn#Ug63vPR2PXY=pq>F3p!R-zab!wmc%J@Zo@@Lr zfg3?;7fvzAtNK$6>4eDJjr)9l%}uU}oUx%OzVzo5AvF~$AQknEZFJCmi`(Mt(Yp#U zNG|J31b~VFv@F}Ji>kHLUL=F2v-qr1L z^l<>F&1$?}fRl+c=+>f~!_lOjUgdPdZY%p2dI0u8>NeHjtVRxXgD%v^%50p8)^a{= zfLK!TREPnkjpb8yLt2$!>_v@TSZ-+Id?I-jq5BA3YX+jGU=@6jZs_O zjYA&2Qp$_G4<63Tfz5Hgqugr<>MndWU}hWso}c40KHZVJAb+!TW*SCYMOQNu)czdT)CTGVkfc+p zrvm7h)YQaWw{@1Omm(73%hz(7AOy*PNn5J$T>|JtlEa+6dWOL79lTG|pc|BLRO5TbL}bR~ z=0IwZ0r2fz`~nEd6``K@;Sz7tS6m~h&NdjSmXDqf*7dC&Bvw1P#=jsZKs^US8DX+B z0MP|~cwIni*c+7*iq_ulx&5Ygv(d=$BcfM1H3j;F2a}DqvoG73+_RNNcclE#e8B1~ zRq%ban9lRJQJcMAL?E*MXi0cvRE{tSv&ccr$=8F)()m%(G^@hgEPBCv{}!18?E04p z|1tp+Tl{Y|0hy0;E@2qmuXYGky$jwPfjpE_k}SM$`~tjgA^?HlG5)Wwn?U?PGr!-j zn>2}=bbv4a{kjQ!;Gfq`lJxA!HK<#AmXnj?^xr&Wj-zwETv%KDDR;8@HBIow2V^o2vP`TYIrgLDyI|wDv`@c` za0vd|wH%N*9-;O$unsf*;2kQp{Ty*jAE5iyowJ}UE}E13Kbp}=^Ih5QPNglenb~uyO*}|fQcNP7- zq51KXI9knyB)8`0Q4dv!aoe~a-s5VXWFMWi8hUno<2Ft-TQ6Sr4ifv-)AUlZ1P);( zDv=v{&qc2yw9;Oj-6wl+o%!S)1h=gpvh4AqQqpee%s`yfcF-Sdy9+|qBO~yY_M6t% zf@2=P%iD=(E*_p<6_?qv`Hdk$%`Yjbe8U;$KjL3T1Pg>*VizWLZI5u0yM!Aqt9z$~ zI?ypx_A`X{w$ojSnvzPXtc+)zSCMy3Y{i-N)G}{gMkH|=>F#M7N!EO%zjqZWuH7`( z-m-1p&-w-OtV${V2%E^2f@U zp&^skIUO5{b{#Z^@K@jF2>JYq+Oj&2$4@_5>*vzkq<8V!*9@rTas-c`a|WN*`z>sI zvnbgw5cXonk_Y}D@fE>(HELj~Hj&)<(!FG1Zw5bldijOu3o;f2-=$s5YHhTU*tc;= zek{(wcIw}5rqiEk)_-gEaZ}>Z{I}P?TFVnk$Bo3b2L)_X-Ux`AK*Wb6LY&r@E&H|B zSM}2rt`PD}4vT9JoslH$e@@u7hD*c+{iMB?c#)s>Ay_O!FFy4F>Nq@G!Ai}L3 zzsH`RJkT<5W*H}GX|BfO$5=+i{*8#p{{cb6yA!;6%_kgs7u%Zq$0;0){wnm?*lp-< z)h^D%-c%2ti7J1NzWw7kpuS@N`85-Di??>gL2wC3*SZve@T1RYPBQ26P%gr=Hw8u~ zzwpFeT?8(Nvz*_#^Xwp{y3of2H_q5Wbvo}jDdA?fO7~WniJxdVk=A?ffpO=9%MoqO zTaxbX^P)8?n;uP}T?Y#!Y99RxgfTbm^Wc4{8$Vta$TRQ_bsQ4Qy6emdDiYzTO`a)` zZQQk<~G4`Y3y)7s<;*#U?uv2N9(AU`Rp=Enrz6q?0;^)T#myO1aK%tjB=>Ezoz6f`lM>)PI48^JY(iyVl>#qAt5Sewa}9r zG$~y^yVpeD=cMDg(pvEC}19}3rn<$~R24E_3UF0k3+zI75Kpz;z`F-r0o$^Mp= zND(M`1?R=*i-VI%9+!QYzLQKvMWz;GKfGeY%Q4SsQ#`F6rxqSR5gyBK+^dM`Q?W2| zaA;4u%ltj9kN6Y?yrj|a_c+k=XCv%sRZj0)l9Adx95)8HTF7t%q}fe( ziLP%r)Ey+_=Y&-C(wySkzdYuD+($Ka%Kw~W5(k@A#+uu&dx*`GX+HV|*4%cdLD$S1 zr=mnp#j6O{=e$;-yO;G>-?3R}5#Scf%b5#x?-y6xePkXGSZ3lE*d|z&k`=u1oM)^` zg$FH2vu+)$e>$Gj=FB}(fDSm3fbMFaw$>|hh`R(|3WeCdqYbetDNoP0J@v;LOBJV% zEG;zkJg+rz{t*HI@%m30Q~WI&z54idg{n$4gsWsxVKqpg($W&%us5248IH3 zVC=A8=0w60`icSFY_0Bn|G@i@pMV~Ad? z8O4kp6J_P8VRZcE8&{FIQrD?p1UB*=%H1qi{n<-@6_(fP9ap$7Mq#I0!u3I1bAZIy z@8dgjjSndkOr94d3(>yj8Xcd%2;$_R#O`lgHf-`52%8D6PdIfRbby6hL4pmD=dW!) zQPswj`Oswqz<$?)E>PIsasTU~4oso1O0FdtqLgWmBC(SN4Ax44`Xa4Y*h5z91H=@w-8| z^ItL2ZC(fjX8->XBOyUE3LLPUmF$xI}m4 z8P1-{6Iw2FQX8H3WlSWJM5;tDzCYR}6_XK%_v#Vh+}jJ6e&2TqCQTewf0g=P+=5n_ z2}*h(FJGkc&WBHTLO&5th^$)4H1y)%O4=VL~3H9h7$tAXG+)VXX8 zj_eO4Y1!ksUYPyB`LR+hH1?XQ&3O`P=T3<8>F5oJ0!%k$Qcyej%GNWbQEZh~*>`=# zu~<1Hu8aJHs|uH3ES-M7HF%jaRQwQPUkg=iKamzvNw%G&{F`Z}N?2E`<{Hn0w7C7s z*BBumbqQyaV2HcUj$K3#C@xF0U>&~T(M+LvbnHOt$HJx|o}^%=NL}S2tdwpVpBorB z{f<}IL;9{{AaSPJ*Pbel#e=2S;fGIWll!U?9b#NQN^f<>L>cpFKVUQ0A-+u=^L0O; z=fXy7Z-NTWL8ZD@ZKB9x+O(eyp^*J}f@~uc?)ma_NqVr5#_Z=uyh<^@o)6y!@#(Cx zW!7HaKWy{dSYQjmfBm`u%ZroS`}U`r99~sgl2=Mat)A%_sO*E)SAx;((>-BZt=)$*P*LD9jJ2Ug0I}d75tl~z` z-!OKJX0Kh7OmhED!TsX0kAoXA5|$3_Z;enw2I ztpZLYe;HO(QSR!bMjnxCBPxdrO&&&gj&W5^Io4JnH}lNM-iEdGKU#Y5={(S<6XNKk z*-RW%$-=DoEI|!6xO-WZye^G(9_@T^PoF1OJBds>P3EawP5Wiz;cbN+tZxGu2eG&^ zd8u^ymNq)r3PB&#^xww5jdO7ohXjpyNo#_9Y-Ri$>{=GrrUq$-Y3jVc%f34tOEBMz6{9lP_}2>l|7Qg*WN?>Y zMq(^zHRY0C<6aGGP_2_e#tf!*`mI0l;EW)3$bCN2mTBYd!)mpF111TH>n&Rix-`jn zbRO)lHl6i@pAV)T20nAQc4d3!x%z=4dc8-zIsz2eVR-d~(-^{Ibsq~({vg%vEIK*x&Ygkh-s=(qV|wrixKs&G6hQ1=6hcwWG- zf_Ia8zcKRYVPX3X;|r%CnQ^{e@+Fd1bwfy&8#U9_RB93&bh~q%A4L-tdT~WkJdFP> zCvt5xBo*DIC5&1IV<^aUl)xOhRpci~ca6!v7_@6(ODIkRZbmxhK5q@>2px_-`9=Y% zhQO+MZy7_vrxzY3A@AT^hQ#OEaDq!+0@BCZHJ}pU$_Jt}wZnVWx<}_tcGoA8dY@&0 zs!Pzzkp=Xsjb;x(n!+wasAt*PQFR22jTU1uV~Lw7ktdhEYAL@>PV9A?x9j11fl4Dx zuL5Eoh=o5WOg2+NLl7?&BY9EI_@ap!E>^t6htg~}N2_KH@+-6NDC+#~fI7vy3Yja) zW~cv747l;S7$4kvLOz~=uvQQ++{{wb8Z8jvx-oXi|2G4OE#CTJAx-tAn8HOs>#=h6 zd$2xMp7VC-1Pl;JGKrgz{LJM&J#G$IAJ9^QIp|?D&(XNHTQc=zDH_9Mv zptumrUjbh540W)S%#e4KsK*3v{aLNw&K}=S^FN#8O z09RPGo1(z=Nk1ImTK&TNMtg_mR>_}1nKKaFHbUjw1CnQdo$F7XRF>wgsQI%SMEeDk z$J0ykqxmkO+?ZlvP=Qthxb_2cg9WB1+)OrAAZR9RuS?I%Zt}Qm*gb52q4Y zUv2Ce)XvjV8r9nHCJ_2}h~A*<&Ly6!{^s0Z*v|IQV`u1EE5LB5r9EQoCNuQvGmB zB_s!;iliC7ImQ}M+L;epp z`J@o~!n)V$voA(CFXYKvKd{N`zWU8)1z;~cc;VxJ>Ar^Fsc3k7p*TrZ;p4e=d?_r! zayomfq3tmBsZpqBkvb^*oQmh)3{{8qnBVY~lJw43bJfInC89H&U z07AQA)Hok3&X)SU2fGDRv7QOY;GC}%{D)XZ)Eoo$WVDwWIthr+Kr5rBUkiXrBKbGm$RvMBi7gXk$vzF|(#217??qo)0dJ z-90?&vI>HyKEXV2NY)4 zAhpQTdiK0cc4X46Y>RH5sQ@GbB13m#%)oY0;deJ6!ZX;+X5;?Bt@DK$-yvR=##H)0 zj57j8dph!k;cq*6oEhRItwL#u_3`4px@hLd4wzrsGQsM&M)O$zG($8&&oXsSyBhZN zd?lLrWs@+psbS3YOO|ZlKZMpH9l8AuS3nza0k_%E!Y@`3jHaP#fKUACuS)!P#s{zo zvHew)UW}K|Bclgt1i!iKkI@nJT8e*k#7r5Hcug*I^jN@J?6zlhM=WNJKHxOMvuxY` z@i_>d5_C`%rEm7ej-KJ2EnB@mjFte-Rs3j7=z+QnfYPkkQVrCB|DLf~b+=)>eEs@s0qc#7Kf02IQELjOR*al5ZPZx7 zdj~C-tjdeH8qO!G*%XxJey@}l$of6Mq%h_SX6R-3D^~Hwx+169PdzpUJV`q=zq!+b z!8yYo4TV1w&M6|ApWa|?t=#usKry*y4^us1Is3tJhy%zo{QxQkVIA;e_PCZ6ON3 zV>)2yqr|^;JwK|kWig8<~K{k)v}msu;fifi;k8pIEeZUq0L(GtY0 zpe+?>CvF0>`ELmW<>!M9ghpSPs55SQxs&A(`T(N|h&MnHgsk%-{>+92eS^=Ka>ZVE zRQo7vg0QxRXng%Ph8}WxfQ#B^n&4(M%)(UEQN&4ld26*ME!hIDsN z&>wTf;UB4yD^E3f|EfIq+4`o5Sw;{*4VBgN{N#Ul{1NG;0bETCMTM6?2BiD|F*w#W z5x;dDvhLy#*by#lplFu zX6GRUnrmq+^c%Y|@@GT|HeYB>mg@~t39!er|&y+_1L z)CE!Ev<6O|{Iv5q7|i=0=s+C%4%qaM=uW-em^;G54>2Qy`?;|FqAQXAEERKc7^5A| z;mdPw>uMg6YvBGwFqI)NRyWlzzJI5JWznnTN%cOZ^w~d8&ZSwsis>yI2B`M%pdcJ8v#~cThPj9;mVGJMua8GKrCjRew_DHmMI+IsY23X#+{wC^wc*?d? zWWafj-C0GKfzkeEWk!R2|sg@hP|ZW&$i-v2OdJ&5oG&*m^8`Q(|# zjei=X>OjXC`g_CptZx6pAOm_AIO;6Bh0A~X16#lYJgcwY7%BM0JY-JxdlDoV14l6& zT%7l35&KP1@cfwv{H0<7BzC~rV02>v_^q^$ybpIF;>xUR=NUxOgU|**;CrF*@%k7b6n^MY ziAafDK=6%+@wb0sS$D9J33ZyCN1Gh?An(GN?5z~(<9K@Vz<{q-DZz|YQ zk1mJs=QR^1Be02uPSTK{wxTqz~2Tn z!kpG!Mb=eu3Rtg(*W26f)rSOIBG^*~GW3{JS0`^Yjrv)taV%$*d^VzoaL)k{*}tR^ zvLH=nkHy@pw>hWz#Y_16Y2grfqmXJvHhgTY0y$oT45C7TcNu(oJY1L`_evfaLIH-* zsj?wi%_P>d!}r|qDLY59KRE0-1zY%b|2s)A zlNRB~Y9^x+;1yea#24XBye!~i$NLE~LE>T@QFd3{ZH6`S5EVCt&?|9YD*15`4Ibk= zy_DHrd|*QY?*c(yVb~Byrl^W!oSZcMguX=jC2iP|Spmp_ue#Xv?I9By(0uBSEOQ$n zN#h^tK=Bz7xBpU;YFE$u?co8@*Xa{UY>WnWVv6}mHZ-wd57g-_?oHQiuY%z#5HaKB zo_chHlpv&bhPmu`@B;;ev-uE@*!51_hDVIyjUgn1N|a3SaTGul-gYoh&3H4rHqZy> z>6nuAPrRLufHRSls0%=X;!huuWen1j{C;QshtGn@;bc7|fRUZl+zbHVJe^HO50ELmzbq#zt?(E69(Bcrm{hwmZ`EASaq>0qh$c zWl7YFGpD-BroU_1^LWna6LvUb#5BQR-gNSi0eRbYXx9167B4ruDs?{i{y&6qV?U-m zr@8v~twa(7?gyaWGjt(4htQB0kI{dY{U{CuGX5Lla^yPhB->ZepF8A^*w_I7*?511 zB<}!8a?l?p3n?E$8oKq%+~Z;+4aRletpOj<Z=6o&pPJ2v&D zSvrpQv#^cTR?>OvTtt$z%RsAa5)-3o4`RxnP~xr?rh|Ut00*j;TKx!lV)&!Bx#*gM z_d(P{fHVF85_x|0)tqdm_MDA5rlAuatojW00=@UxDUL<{y1lVyU;?(J$Wzk}k;tb; z@Q}HPm_nun69p_<6YO_mu-~!gV8eXoepfaH>>E_-#-%jE0tE&lMy0 z3U|LLPDFqY(V|T7?F+MDuFW-H#c0*ezu5M?mL%l{VP3_~Z@V@Z1-zFU(kQ6c0o|xE z6={Hq8@fDXsR)Ptp||!=BaIAmfbBOW0Hu>x_2$H8xwt*)=5tS*0Jyk)z?M_B=Z=%f zla>o}p*su}l8WfhAD2KJSwBN0Ov=a>JBuz=Vj*id*}V43=w46FiHUSa=zLp6@R{>ZZah9cLu zj5DU_Z@; z^6#h%d`SE0VR%tgBkV886WC~EUWIA{d-xADcX@TR@?WzcN>v-g%eS4igPW-R4y_i< zyrwmC4#4iR!37B#U8~%1RIw_Gc<~{=8{H{@&3^}>D4=cB-J~LQ1zn_LgEk2B3iJLR zQs@B&=gq~r-}*k+>6j}I zB@=AJWD$gSLHvS38IF*yV;`?b`z%&R_YhMk5(3o$kGJ-K%U47)lZ3-Jr5M(bs<#ij z5V!4L@dF%I3}tuh21QV~HUC`-{0(63W3nwAo4|BryMIT3Vkm$gi)6w8B987XWc62( ziQDr!sB`EFc;(2UKIEHny|kFP9)$U0!^K6kRVi z)(Nk}0r}6yFBJ6Tr;;M(udg51XMfyMUZ7s!*PV~=)>V8DETfi&WI#dHAq&$6bH|s5;NVeQDzpg*m3q%+JWsd22A`NfQWyL2dobM8KpGuFaPzELH@Fc?LI~jHc#WAH?Zn0Kq3muc zt2MnrVmJ1@0IZJ*{2Os`Y>+0{NY4E^Cma!8sDn=*v$Aev2jCAcRL;cPB`PN5_5T=8 z`GlX5yMzIRz`ZYEJ6{J7zh`|#BA4(NoJ-srt8YgAu|?KMPDpMn7*x0&bNiDAXSoqY z@(iSU+`A+7WP2DRu7^cK;_4idxcYZI4ovBtkhQoVsMDGa16TOM)IzOENDm1Fy|^_h z{>cG`X@huLAfH-sAlol3{+kO^k%5I3Tg=Wa`L6Hke*@NF5)!Pm6?Oi9=HMCX&T!j% zkCCZFt|OeNCPDUYa53tr9Ns0R)TUe^*yR)i)`LQoQb-0nLh}arEm95)9Z{WABoW$& z2;cG+{`FM@*hHD(5~7dWge2w&^vcd02%w6=P3=nlD=^IgS)KBZx1S<>a~`<)Xg%*u zvgD@~z}(ZN)h+tJZDD8pmPY%*BF8{Pwxel*3{(gSBtHgOK+t~txHP0LS9euurobO^ z=>Sx7-GfIqfJ%Yq{bZ0xTF5MZ})4=@82vLMljnk2sFkV$#_kEO#Mw2 zdvBLbcTH&}Cp@lT%?Q+ufQgcK9n7ij_j9NZyla%~DH&&g`+;@m5|4rdpYvLjGf!H0-+XRN` z1Y?jpSB^meNDMyz3{yogq1d~0?ps{cq=BI)Vi^%;&~x1PWS-D(pF0~e)RF%yH?OIs z#5>KQDY8tGOw&lzr#f&(e&cRWhkL&Qj8? zZ+l)m>F71ycCY!}-T@h>?urli>z8>08K~_SL-dNKU+A$WASuazM`63D@V>83(}?~m5o~hAI%80FaOF`ldnk^zghSGvp~S5j?%22&v%Y4 zc8a&Q>w3+7Ejs$581Br$25ralmF^eX{kZ~o?F&tWYu^iH?z$4H7`smgK=vDcfz~x8 zIrhE%vD4c)U9EfhVr%xfH~qe|TAp!n%F536h~ZQ^dS~oDni`Z z9b_{uP8S>SXRIfk%2b21ljE^>&1(1dKQuB-nyqE-G2>zSH5snw76~sk)Ao#pxf^AB z4moeNGHQueaai%*8Qn4;aG0ZGX5{6x zc}8i$R6N`l6Ru%x$E%$)#P?enP9YrHf!3o8$_q##Yjlw}IKGrdr8Mc>(NBwk zp3*Ogqc!D~-?xsR{F!Io&=D-0GNwD768br0DEoo3)kG6!dD#2T17Bb=LcWgx#VLsI zhdqTK37>k9IHrlVq4%%4*^j20(QlUrMTPe6(Ld&)qpFxgL$&wOjsT(d#kIyUVl&!O z0fGvaz;8zL2D9jd!(g#p=idf00?UT7qju(Gzv|xEU~14b{cB3C=A!@0hWj7RFnjma zIcKck4jLiOGh%zV&=I=#d2MPoIS8m{j{fv&UT~h0{pn;_S!FZk+UQ;wrRz22S~)i7 zwm; zh%v4x*-w{E;%^JXCNXBWVaG2?y&2c#m^Iow=g-L##D#qPcbNe5-l4#`NZXDksZ5XN zp&lkGr6}vi`|k!`n%`577^UDY0rDIqO?UD>gMnxptv@5uu@Dt&JQ~^A;y%Q!JR;Gb z-hVb^4qu6ayM@e}pY{rn%&ziQlG(MXDE=9?p55s(($zKD*|J*LIl5c>*sU?fJAMnD zqaNi|WhZ}o!G&aCb&Mev3=c~XP8vk@REwrMVw>PmIXcS`-fmOH&QjAOe3|Z!_6Ofb z$u_kb+)O>}xnT9Nh@qvAR7`RVjH8(Mgbz#=4?$L6J(;`%;PDQJeRg78axP6Ws(3)Q zJkW72?b6W&695=P4weZz5aD8KQPwD}fjI%P_gIU@=jUb*m$rQ=i{3ptSaP%cdf9aH zp)_-7cL@f~1A?V=ZZG$%mCZmHt}6+(cUx=uRwpOx!sAPy8ok+8+slBeWlVpf*LXq?ZP*gDW zNVM2|M}OaJ@lepmr^}apzrIeIE9vp~d0Z*dbz64Mm9!p5Fi(?2lWf;#g728DfDgVZK$mK7o*0h!8B6){)FI`hodQhB6A{HwjaFcXuh zWxG6AVl%@&OzuGH+3#CKg!)OJnI#dnWEL5&ln@)W53Bm0aWOciQ7T-((Is;(dda)5`oMEF*p!MEFz<)l ztH`xN$fx)(bR!1Gh^EV|--@!71RS~S)z+8 zi~QXp%6;pSwWNq?HPv=qiMwh~o!_mgP38L3Txj+%iMcjRjf6BJz!2<-ds0Q-T%2M| z?%;3Ddt8Z=*i2L2akN!K zs^})4UlPyaPeN*}l%yBNb0|ghWp0KqKp<#8fP?)x?p#L{jy!yGCHI^v`I`~iQ?_-frEK@I(tKICICrzJwhiEB zP3w4M3Nw6NwUEGhGLoNDm*gV5iqP88fv&H!#I(h*M0(C9mt7!Myd%uRq^mr(#w*P< z_k9FuOJEwAl-!vjn?`XLuxpFqO`{j<2j!IIFCMa+d1dDPy^$i>+}{MG8)Eef{75GW zSy)@eD?)Wnxy_!@5tnoF3cAnrwol9gA1!L#YE+Np`+ivm-Z4vpZ)9Dm$TL7Su7;4z zo7E80J<(IWg>7X_@{0 z7J1xa)GK#-QhZE!yATKX-^C7QVT3i`=`jyC7ZD5RHXDVjD@4bc2dQN*J?4+oUoZr^ ziGy4d_T2X%+KpMTcThR*!k(iYT;p@}eNn{+vBg4_%ZZgGlvjf*SGbW3!c8C=#Vuc7 zZJ-5FG^gC^UuHhe%}bp9;(d?Dy(jvq0L6!e?WoL02x*sJaLR^W!jI?{wh8^&{!E&@ zA@EtuXD3HZ%RH=7n=+>hE5|=~cV4(NZS9}2SOY~Zx=2w=91u2^#flW2AaSERYF^*I zd;YcR&6{&aW#qs7v7zBr2gm`j1=v5+M-UPR!2W0K!-6VG=gr9OnwiiOI6t@?@&c+b9SOWkSNi@ z-oQux`7*aNEUuV0sNegYL0aA4a)2Qom7@MBg)ybEsIoM#{c3yo&JquCy!3XMsZ3=} z5LZYBg<>cVT1L&te!YelrX=JO0vfK)^=@$}DwjE#DQA%R;CKCetg^nR#}j`I=n%OG zc4LKsvN}1NWOg4n^?^8cuSUGL*blAjUE6qBuuyQR=R$M5jQTFvg`p8J&jWo+at07u zmtya(IvaRZc9=BWmK9?gnS=}EZ0sEfw;lBh(Dq2&C-w&aX7LIy{?c%Dk!xDIn^Wv> zQ(o&?-|#JK=ltxS^8>X0m3tIVA&9P)bheb3x9kpZQ>kop5^qx_x^V{D0IwS+S zQfCXm`0X8)5gRhT))uc*P`u1$Q)qTMTV?8vOX&_K>Pee(%2M{82;1DVn%@Ew{X4h= zMQhPzy^fua72=QItl$ojxV!MU?pOVnfd1*RIFD|%On(|zYEZ^E)$s3? z?NZayxl7N5cO;&Wg$!Efu)nkm5KJ3b7dh>qQ0fn`a|RiC0>ktyt}(w zU!;3Qb%@<5w_*SA(s#duto8w6#Pq_)f;RX~?j6Lq%=}==Y!m(A?0Pc0Qi-+XA*)oV ziTgsy&fjL|uF&{VwA_qUgv)OKSHW}*pxl?;%1Tz#LJgknaa^EliH+7+D1pm(%Jm%z zl_S{?91i4sdv{D@YLG(B#~vb2kCAL?TIK*5yT|ArwXe=8lpfbej|lGLQhV8k z=PoG`NO-9`bp-#hGI5KCmDwK|p_fAv0f-zfK};t>exwS5B!CX0+NvdoA1M9hHA3h;HphpSV@LKMo1r#~5YK21+k zdum0kJU=%ZdF-QQ_1Iyl`OghDWeF!gPDes$52_C!#v4}sfV^%?+Eb#(vg{hp^_THi zmI{WmygM;m;LzWpO&h=Xw&M5icI6!_p3LRac6Ah|P|%cw)C=Gm>wP6|oZ%8+y+O=j zvpnZ5szykAX4JiN;iXzI!}4&YC8MC?sb}&GhxM{1ezhcG%G^JH*`4vya}OhITEr1( zJy}}aWVORc+(0B5 z0*e1|@=Of6x_*sCcQ`KYUV4p5aQ{;{!e)?2+nQpP=jh}VrIlz~M$dGCIPafnF#o>r z3-cp@+yzL!ilZKVCqtr``jL}khkL(d$1g_T`l;d{KW0uo-A$aGozJ}at+4xL$nMPD zWjuEfXXF^vp2WN=zDj;RncH}PdjC*~R)1xiVI}vP|*&*uO(cWwCdO~bXk^^_V zfU}ED({uI9^$U^}NH64X8UzZ%+}qV;iGL&8X%1`Ca<=pSay;Hju)3f

PclKvnoyMx;9OZ)g>8=DkIkYNPFI`6uuU4d)T_+b&Bp$*+SX0eyFGOySIOi zyJozV$ocHPw7k@G!Zcl0gQmNx*Pv)D{hs9{5?pjdB5riCSTf+7=zdi7>dUx}_vUeq zL{0lOnFg=Y_X%s+8YJsQwcVCKGd0T~Aa>Q;o~|huOi>9Wkz?l&0@RFf5Ay|V!7uM& zW$B5zZ5JflnpqNuzNqWK6-5y;Ht%0N*1c9=;qY6$(E78Wf%y*}2E~^?TR@vf1Mt?| zQVy)MUyLCtRzFgv?2o67H-Et}v4BdTZVVKu6`!#;uhoWa+5aLBJgX@ zb_<)9+Q<*T;^3lRKP15V<1pO)yl#(tq1q?87AD+2zeIO6D!waUF`KWwZ_$0^-kH=<~L6&^@-jm zZ8}y$n~#{Z%leADjr(V|PlP)%9L7RZU%)x9Vk!${OOX*w^b9ShsrtRfx*L=W4h0uyy{YeBX(6i<34V8a{pR5i&$s=jo*>Euw2j!TPZHgzd@Lc=5aK&iZR# zhWE)>H@ZJHSy|KQ4>+us4_Dv~dMihMJi-4fB1uozdug=!%I+MWd`-plDxE<7jv(%W@M)kS@pM)O`CxRIu%@T1qB$n520yv(J&33ma>B|tDk zx=4No=EuRkU+#WOHcOT69j&4od}XhbwmwdiyqhIjFhk5gpHY|f({6=FpmZ)?Z8xg{ zn8fyw9t--K%kRIwfeJ`98LwuW;=#g5o@kLZFJg7mjo{A4{_4@ii>4R) zQyyu$42|(Dt#SQ1E*A|q4}gPpjInLg?TMv9gq>^ow#*n0tmE9a>;B!00R)%R_ami-dPBeOCk?Lm6uY{ z!^E<*ZEI+r`Qp|z-N%0h8rXi>E5uX2@#Vr{O#z1z7D@I9{6GD*6@{Y`2i&P1DVmc%;Z#& z$aQ>T=#CECAj!}<%eoWxXT>37aqHY*3$QX0e?Ux~8aXA>T4SI@ZOeq-MONz*TO3&MBA zI(~*kKDrJE14XHR3BG&L+O!dZ^XJ2Sh`Ka<)%D|;`qy&d`T5^z4{C0Y6|~EYMv3(kDo7#VKR^n@`6x=$%Jr^V{~lFqIDJkrqx}{EB2!(|3y3 zHmue-m#sd|>G`u-ZKJ;9oPJ(<`e^n0_pgHKw1{{e-st?%*J4)uhNJR_a9z9*$P=dx zK%68JVzsG9I=!lI5?AYjmGh51cw@+F7jbe6UX|BsA3M92Va!AEjYJF7kd8kSjS>FfuzY zBW5$!_LO_oF8<;elVC$j%Va}oDPHYRt7ex~;P>P`T8{I+nj?Z)_V|+5 z((ydQ1o#z}95GD_Df|o;@LMatlj%Nt#E!YT;+p3R0lu@>`X?qPitXd;pA__j2TwE{ zyk^<>k*&na+2Q$H@ZfJkJRPSad5{!@g}{{~>Y#pPXHkE8=qYhUF3Ub@kUvC;KL&S0-r8n7-`&vA(CWrcC4<*FJ^Vg@^r(VLzf|1EiNf^%s1zAw zX7}#)K5w5)$sNli-$sVZ4rg+L9h$qfeiUY$XPr)u8LHxeZwg?AWW ziv8LiEC~_~p!?wGbD*C|)V;Eac{bvghc#}#ss+V2UCajkRrwYcK5JW?uL-d*{>oXr zU{!R3QyvnN*<29RKkTTGu`U6i0@6IBDzdFwVl<$rmU&dvi~!iO!)9oDDoj(16o@@TKM`@qBT z;A_ZuKu>%~-Bg!W_~V9&sSHQjrW;y)EyVL0qQ z3yUJFwt~dY=>Q$0;*=j2q*^!c{7FE&HX>Ou7nRr=KKY>~aJ z>)y6hAaDfx5FL_mpLlM-AsA z=z_D#v@>ge$DPBD?Ao*Eep_oRYaDm%>z>OGKQ3HAaZoVFcMlzYha_j(y*@LA6~eCs z>s~p?8XpW=i6=(2mvcHS2dFh`FwETw?5wp(l74dT;wysamMvQjj*jl7Qw!5&R88?! zz24a8X!A?wu2G{Ll%awkw4ZMzRr90kxkZjPX_SoC1vj0_w-~i^xFC7*YGmB}+O2rr z@Itz~6W?$|0)B38?z3Z{VAmBY`OBxKGK23B1Cyh=Aa0n=2ZU}pcc}^e63JsF1nUOj zE~EFg7Maw|?~@pfGo7PnI2@=DuX)JVnK^#pb+d$59&rtiukC0W%O*C->~a#)nHZ?& zjGSycn67+oD>#z!Kn{vg!$cPo$;GrXiN%a#qK&gsYbM0_i@C(G7mv8%%CvV7R!F$iw^1!%$bn+u3~P2+ zHnz}^DqRi>(XZUTa+USmBzNUvSuyRAsPkO+`p(BN%QI}>zFm+{li#XUQA@cF|jKj*V-*f6zZ??z|3wet7y2=MaAOfU~p`WeN zx;ak8=5i}dwP1Mg`j)^`Irc61#BEDO3{Fmaf>-p3k3L;r@mwjTUZKOA=ZpeC-y17% zd*4}N6CeDklJY5Ma<|Qz`pNnyR6uq}nkX;Hg(QlwGN^6As<{Cbc*m0;c*3P}{{Tp*flQsOi27^r^6O-23+t6{@`p}ti! zSn6$OlgUPW+-)WILuJRf0%|wKv9p>gsB}c#TdbxlVI@(~`EC~W4P&k?7qt@55F;r6 zqj@>dz|BCuwEW)UpUyQIsnZi7{P;JE)2x=^aF=t{mFwIulBrMSzOEN_8TMrhQ0g^= zgSbI^DWOU_QS&Hwtr32bjrax%BZ~}OQ8jcf$>R@#obZ?^{rVyk8%@nnHsa0k#!rj0 z*1Ou@3bi;+e=4$q(&|*yA8(0?%{q9bBGuDyW!+XpB5Ks1q^8|Y z%rektC`rFC+L|cIosN3NS|*iVPzn0=1-$?5+jr#n$NHM~pUQKw8$U?Lc36k%pf{9_ zl}NN^y=U3GXp!zu3rTsEu08?MnQ!<&L=E2)xT;J)GtW6PHnuO~CVhWATy+>_Jefij z*`FY(&;mED?}d28pqT{e;43l-mS2-!_ujqd)fP761Mi>M;NO^yWP4~Po%~P9TUZEg zij8>bqwL48!TWs_KALjBcpNOtEcE?+LN*u9kRKc#wafPO>$(aTGl9AWR{)M@^hgm? ze~o0SDEs{hTpXHBrBi=nMAL(m@Rfg8Clz|ZDq{Ab;#C*ByI;M^m2fBw{c$jgy=5nR z>Zec>0ppgPSX-oD07y!t~Tb*1r$=T@J^$8 z>wj7tHMonS#@wf;I7LIoB>FYxwdqsI6`7_^nXHs6Qv$COKXt<)wWhtLpOwMVyi6z? z(;j&lK_)CmX0ud{JbDJf$cFazcHQ!5YQa29DV<%n{ z@KkhcBkX%Pu3pZ#vT}9dwLejbOJ(0pPS4)6lF;Y^cy#SmjZ&t`Mpy-t6b{7hYG&q= ze=O5<&9MD8?K2C!%ERg!N4)<*I8G%`X?_JMEGO-NkV*B$t*_c$eDN#sDChXR1#{pb zHtNeODV2ftP`7)N6(qsSqJv@^ujBSo$@kV*!!eI7bZmlPEd^wpqhYyFx8O<9`cO6V zBu&p{pnyPqb9w;5aVOfBFlg;jMk?}RlWM*U038JPlTR#5x4&tma%S}D( zSyMdlOcCg|ept{~XHAKyq(PBr(bYsdkv9T5$>!Xc*E@O7+<)NQ^l5IyZSOl(0j?l< zg=BQnD*~tB4;2hQZ@L-d%|`yyR_MFWcIG{Z_dC(?E`W*SkN790z1ba++HJ#W#_lDR zZq81p91N=SGlng1IQReYikL1fd-BC$e9@(|e^E-TDyl!ieFr5WjHWkGeH@=p!jq}&r#!;&a zJ~#)&1B%eOPc9G6O2#>-EsuN`>-4a#S@<*>Zf&?9zn}IKrf|4%Y5s?rm)-q_m;MxZ zX}IZihO!Q`&I%Ox)6}2%OK&yc?=*h<_AUJmduJHhiNAI@&D)?Pb1OlKa`b}XS+G$L z-WJ>FU4ZLqMNQWK8W|CI>)bgxm4(N$$New4lgtO*tQn3h4{@PQqzsk z!ck6rERgGxVK2Q1#TS<`8Kzc?l;qvE5YQqzv6E8$vuj#ynb9Lnun{GKO#Z(@Zt zFAwU$w_{)fIL5mqYaRl?2QUpo-)1`4=Eh~ZREcNgqa0pFRxd=SPB&0g6ja!Mg^Log zMNj27>iErG;yfc~dIw(&PS4_rk{;z{Hyasil&DnYJGIA`CzR&%I4Myd*=i}+OAB^w zWD(AwQ}|1ZZJdNg+w#T}_%(uk;{?B}qKyjEpIzy_h-Cv1>GAV1tc#sX>*nAE#KdG#5wRVTG~ZWo?|^#~($j4qZ}Iii!+x^Zxqj(sYd0^G*o+#4X>o71h}KIj=E1qTu}v4G2A909t;` zXV^Dpe2X?>xf&T2vG}F5phfpf`IoX-?YakkI9aq&>q4jBR-A0retMMH&RUB6Cqc6t zA6-NxOaJut>KrLuZDC;dF{3vbOyqlPfGiMuc?MaxYt|gq*F#+VCA7LqK za?)Y8chx~nO;l~Rcg@B_z}h+6^QIIJJ)} zMwH-`w_uk!6hs7I<7riVyGS@yiNg&!6$vXUDLEyW-mq>Jl|I5~9LB49rXKAli22xY zP5CAy{hWkiD63P%M$jH;)ZK$i~lS!g<*Zj!jwZZUvgjuSD%(7Ov7xyI> zh=(}y`x~VfF8VRjUEX#^_C{9b_CtM3Hi>El#$|z9A>ITX$w8b*!zsfXKQ=)k71 z!Hkr2KTIcuf0U(WDl-|kik2qMFYQ{BV%k?HX6XKrX&@SBU-o$I8pi_y0d5W4s$_{; zheIwdEk*N7VdTTvKMN<_=SEr#h>`5Ochk+jCt9`~&E~1~!Y?K7{xe#0W-Gdiv6g~2 zvFYf#F5JSB#DEt1;rz$@x<^fv3g5w6b6%bIy{pMM`3y_^l)A zoHfddYy2K5u*$tsvtP33sXYPE%~e+{CLumX1~pq!^x-pm>XKO6kG#gRosx}i>W->; zLmH9RId+fA@+76b8nir<3}l>a{&dpY4A=ZPzaQ=v#q-DN#ht;r!(bx{hfkwc8Nx~(pgY#~ z=Ba{*e+F21@;E=2=V{w8YnyWCX^9mU^phj=S!lIGkuq!V!KL*s|(^a|F@ zEg+Kq6h;nC+0XiSAissa z8(bUu2HZwpoF{{if;QIy8k8^aC$p;A=GhQx%s>&2Hgs7!fszKp9_F)^Krq|Bc_s#j zwZShP@#*{~DcizWp#X|0)2-_7dI_~?qY$ATR!5l_u~`;?GkqowviT2@!dIx0q20bW zgsf2iQVNJuLy1y%iKo0w4V?%D;Tma6#;O~C;Y+P2SnEDG#N7e%R}aSRYdUZ8_bG=U zCRl)iLm&H|F&{1h?c&GSkR1bf>E}yaW=d&kj-VBkoHGGszf_?*LPi`2)>k-Fshbq< zvaHVtY2voT{A&G5E_;GXuQ9aI?1!C`4%wZqkB6ed@clY8Lm z?I7>R*Z)@d8d9Jpd*c@uLn!GjK|O5+xgmnp`bf6HAZwtF_3dbhm=4~J-vgX(pO&)T z3Xo*g(Q9G--~&TrkO+Bz-m-I#$(As{iUJ?@Ta+q}?;J`Sw55r1qBm0Q@PZ*1N`QyBsNmxEH9|?G(yjGref}`V#I!KSt52EBS<6=0S~Ne}MDEOolvBv{VIg4qTWeAT9a# zG4JIVx0Fw5y^1lTz$8|gF$;e&Os|XO-tKcPJUkG`3Fuw&F{A#+vT4#1J2*q0W$MxN z8~_|CaQB|xBuPVYR7p-_##VxD+V?XtnJ}_v@3GCIYv?FM6(wDi@4~lym|G4j3wxq} z$j|+E>^nQ<_&n@XjCY4p;NJty(l<4etCj$!**lY7Z^da)g(zNzfzO5LB4^MxtE-h@c8&UQFA$pAByr~VTRp9#8(;4sYUpsAan+4+Z;Rv5s8Iely zHy~rfBA1*Xk$TE{xp)04dy6Qo;>T^N-DFEA4T58%RI;m$aV!iq*7yqy=9}9yjD)v_( zH>oEtkcxF!?p$$SX2-|*8dHydsR59P*@A3NEx9gX%GC*Z3=KSQwhQOSw zJH;KAYU_w?neQLT`Vh=u^7F$sPJdVanC1SF6({36OhCD9z?wf#yx9A9Y0vftomp_% z^`h!2ZWqwu^&i^L|4y7MF!6nC=%;L3d*vKb@dpqs$YBH@W#bh*BkiYc${mi)A&grM zq3OZWVIVbAm5&?dBD_^`8k;a9V_zY=15Le>4BL*@arqlh^dWH4=@r_?Pc6tqZ$-U8 zgq4QMAejq5HmBp{yWhWk_%PH-GGG<7+;hOo+oAm&#uc=arj3O5@3Vj*;;>vaEun7Sa3|HOx1F3Cr{8D82roU5ON$1 zm}!*u%8}J2r};OaJ4X?>>_X((zuMW59c8L4wX%@tcjSo#V6_ysH}U=ZKZbvS+HFc4 zFDq;Q)`hT|HQ>fczznVwC&T{*IKN)J!B?P%BH<9Sx)`mqo7^084A1_-RHqZCz8N+rvp7~>@o^i-$2znvn>*D_Se~2$O6q|;yCTIKSH75vVQ^ELx zyiYOzkc_I>FB9Dec(+R2djtBs1a>fBfn7H#Nwj^CMJx07w(}f5mGBshdxA>XrOm^{ zxR^JnXzA&(gUTmPoWwI?YsCNorI$JWA!(M;s`tx&mL{E3^!Z=2kukQ|6O1YKjx!1eR*JJKdHUkf(CvpuXJ{^!31DvCt8)7twFwDQ@%ny z07&c&gz-IglEDk!GhdMOt-dJtYPJ`JaWu^QF_bE1-SL}@r;>s5obwjUh>sS~#Py-8 zK!@|b9n0P{=6JPYq^TDw>fHkbSrj1ye-160Zu_l}|6; zY}1GKN7(lFj}IjV{6}3cGVy|)A2Y$=GqbtBs-1HC*M_r?K8MJLH=u8VXXn~qaa3^? z>uGU(|K)yv_T>g9<<+(XI^}Dk%{*%#pTvx8`#EM`6bCmBnHbdFaUkANU+;O0ye>ZcW z3J^CQa8F%(=^xa8A6251IjtreQF8?;%!JLo@?~WGD;r9wKh0Puce>UvdG7iOHHYtX z;FZQ+rp=B$6!>Ao1Hr4q%Lzl7pSwXCM3BJqYdSIIy)=IQlc2k{e`i zAcVGfo*P_UZIs?|lNVCF7>K`aJ@<^6oKso3K(T2X z;clRao{P10_l|zOcoKBaY1k^meZRl6)MD_OMeRA>zk;;xLRjJ>C_WAiO!q%TT{4b- zaxHjz+|wy>xed~E#fTOm-5I|zN)@Ba$jo9$v@nnU3$UT|0b`^7E#xz1U_XBZUa;6d z>s9fX$f3dBjWG-JDW^D*hW&t?uv*7UmOh@nVL6mFK&rHT)l%69r;Vg(Q#-OZfnK2) zBfac>^wy2>n!|#FkO-kbC?kf0Tr3PmZxC9QzJ&AY%V>jL^&SaOl=>NwEJ9JWo3vHM zdY{iDt8|8VwuKhDP#LDe3%ViMd;b#04H^%@$Fp9qwf8@Ob5e)ka{FTiCyoA6uk9uL zLaf4c`PG6xa{)xsg#i7jV>|w`hgmVszpVJ3Z4drSIUhu{Ik-XhK#|)&+>PyUQlw;O zr}M{jOMn1A6@Z?Bn*1k?Q)$Q!trA*3e^%HYaM|qtB;!;nqx&)iw-$c>(G;FXpsmX| zV14~y+h5dSMRf4YAI63D>Ua>%Vnrk=QC3I=c?Nrj9Z9hxBoi_F?2>zQTW#ys29C02yp_iEFweo3YrIotx1RPD< z1zcmIbp>gNv`#1Qt{NV{yC4=_I$g@96OB}?n>_;EXe_@UdZdtLs||JBMBsDQ0FMCV z0NxTGKwtTi@#Ywa?p7qa4o=h=w2q3*LA5oZ5vV}(q02wqf?KFS-|CT0&h{DbpRuN} zn}}2aa@vCee}X3Bq56C&;w7D+5`;qstp{P2D4hqJ-HosYcm;LZ`H0d#W4#_~&%iQ? zWgQ4ONin@CpfS99F`Au|#BIuZrKilgchmzp5&*L7B3V$&P2RDdCf0Yp(RszYtFTQA zWE@1P!Q=lQ4$eA=XZF4}IPrv-73(>A7T&Q!B81_FC&-oLV1e-9J9XT8-f)gLX!!xx z0Xp<3ZDkMa-kb`u6W@NZ@EeW>-=B=eG}? z4bFhd#b2Xcpe2apeBU&mR0;_%l#<4@UY0Fe#LHGd>be{Fh`#gJqfI1Tr#;oF&EOoN zqjgH{#uDf?!yl+pl*kZm*k)@EtUG=wo5-fdBlIJ1S@MNv_D(KDuX9j57JN(~BO85` zF&~pMR4qDw)#GTe2be3+5)hmN9r0_MkUnM*BR%bX@6edqJyuSy;WL?lOA&J*pv#(smCfz%qWKh>`fTi!qswI7qo+@y zsO|;ugNdr#%}q!@((BS=aidGz(YYM|@Z;w;*!F@%Le-+ogiF|s! zt}C>|^M{3h&0p9OU5SQ8u*dj>Q|!PrlRII9SY*4;Fqd(wwDY}p+c2*e3Vi}{NL>zO z`38y0HY(MU0RzFkIxC_3n>ttK;p8Wt9w2>`_cik-EiUn5J}&-H@U~c-C}EhhyCMrh z$FK(|_MkAHV)HEyt_c_6TOICw6Hl>?O0}u_+#h%`L32p_+$r%(FKj~2M-g|2f zqVmIm^9`ApA8x+mzf+5bZ)KsrJGSh~m8Pd)Ns9w~e#;A8+r+&XmC=Hca2)5Ux3=S< zoqByx4}(6+0wk+QCm^`_)-df4=eahUrl#NER@Wb*^u_BDE$NszAopPg)kozn~cXVL>2t`+2E^y)T@60%+eAm z;OF{OLFqX9el=Q|Hy#56+unY^Yy|WF^aEvlBFmDT{KnSq#Is9t$S!PCpu13$!({{( zCC;!5FtUZ`1o_N_4*^3J^^kAn=b&$F+3`;jmyqLq8q_YdIDslIa)O2eznePFZFO5= z=3~$C!H+xEYz(i1T<}E-Bx^q?kQ+_~Jt6$z(~!yaFq?e4tCx!ffHI>G1znyz$FZ9b z3PN8^;T)ZhRft~vU|>HX!)4b1651R}V%`;c+$Ia{XFMtf!)2^zmT-mjtAnERzZ^ZF4|s^bk~}m0z7zemVUBJHM~tF>N4t2>cTMk~SsR@C@P_HL z$>Gb$+WsAi7)T{(4wo;j_6+(SEMqiUtwNLl^@tV}Fgq)nUVz^u`GlvWjd;MfIx*Vr zxjS%nIq43OQhxVKI93j9qoSD1O@_ajFTsH?-di&F1RSv+FC4BK)VO;X0qHwg;P$txbOMHLMMb9y&k~)#(p`|rom^d8nkgft1=zEIM11huHN!{2!ADhUbqvAaBPHTNs&cAkhLPrH-gFXn3nZ^x5tPtL;P%quuw_=Pu2H3RS|J3 z2V{A^%4V}!P7^9Ho}JjR^rOn#bxyxr*fcV^2Nqb1f(5cNU%bD*5$KacQ>;_I^n~A+ zA>yRR%>QHWt;4GN)_>8(qCrYZ5Mcq*DIp*r3k5+*=?-Z{Qlv{d1O(}n4(aYt5R?#* z?hfhhb;k1hb?<%lKIeDtbMGJb+;d&e!(405G3Vf&W4z-XV|?D~Cu`?G23Ryk!m;i_ z48OPPH{QT;!ZTStY_iMu-Z8C&>r=IbW+TNmnB&3viMV_D@A^=n);LM>EN(T*g`Our z+T0P_Jz09c#3(%=kW!OO{PzNglFf$GZ>L`|3$ZSL^|tUGaw;uB0wCG!WdB&iHb~Cu zT%HLib6s`p`9&)PEPN55UReo14m~YKAoR=LVE^{K;lAx%oE7L=`LJt0^yyv%dCZyJ35};B?J4+Gs+iI#O`ccWz#9Py;FOwON?usMeecT9tu>&Ay2}?vZbq?V}I1r>4%#%#_g4sYa2v+&+njN9!e~W?ao5Ue{iHgEJ814ZkLc?6@v8nxxAgB&BfK2F=<|)# z)vN;z(uIt?>Z^e2@E%dyXC5AfV}>EWcKQBbS;;N?(*Ad=zNS^wZ)#Rc9rCOLh7YmI zI0_wcDY@1?h%8>NVvnVDseO*kXVmq`28O2qu67<){hcyK27TSz*N<;~{y$E~T`I3EhaQ{7u7o$*al9QI(J}<4P=H}Z-+=BWi?9UY|1K4N zs5DmRyBGm~9x!U~yx%Lin|ip5em)x&{WxN+Cg8E4RYOugwA35zWMQ&3-)=VJaKXci ztmSu4{rT~yHGXg7|G8rNbLG#t_%km4e=`bJe+k zHU2chADQrH6#Q>L3V`kFm014>O{*bxxGV&G9!ttg6g@C_V_|fM4+7z_4pNkt!o#7& z0Y!L^r6rUg5D)+d{9$2$uLGwaXW$FPUPAA>NfeU5`(^i`_!o$4v;t zwrAvi>bBdAV|wR5fTBOb_|Km8&usjEa};=2VEI;{(S;pgv0v_t1`XLAd_9o39a)Rz zTXT=-%N(5Q%lU)a3gLvLN!`593Nh)uQZxzr#N2-a*UUG$HFYEk4rOS+Q zpZE6mxYNa!n$!zX0K);zocY^wRjf?aGy&&bF;48Q8o{$&{8sLv+qZijIO{tOz(PeM z_^=!q#5{z@d~95G-XfOX6@*R44;z057Nx)*(QCXg^tK}0+etO@AU~7INqK-&;sZ(c z5oPG@!Z!5XFCp7Mr}t=w2W@P_s=zv+Al#kWjlGY-d9o3-Lh(Cv{A9)BV-SSw8{$ zl*nG)qLU9zbI#72QV-yC#R0u~lbv;)C7Ay7?UrNI%qkUHTzY~r-}}63jQj7YES;u` z*urZCGK8=a;Yh2cT8_;P;z3CFbZ-nV*5|pzE=`P)=z3OxjT*}(Bi>LuVE@WNvO@;P zE#;6*D}mD9r+0oh+sA}2e_?JuxGEL%l3KX1gbdhNT}Q!#KfwVW59mazAWHr6qF3ug zj1}c&_v~^hFK%QtA9g12XNjl-=8Et;XpzdeT|&s^<`;L0DKq#k(vc@PS}L23isnrXrjUyJP==d2)aK3Td@sLSZ-fV3e3{TPqKE` zKMTZoIxU_Y1<*mEW55B*xY(2qM2KO6&Mie{*-U&tG*U+_atdG(=01j_DiTMDgSXO1 z6YxE$TjcO=*7ewbD9RG1Y>uYHkcJ|yDuf0M38~Pg@7J!(R>xRT3mf9wkG_W+f`97A zQYitV2hRG|Pj`6s}52 zScU+bSM)9-lu8V+x^cSX-}{^gDg;`1F*i;Ln6{%svk3i~DaZMaFu7_*2+*)ZfQcnC zk1T8iN*h*8QD=DI-p^m^xoxLw(KW<2%O%nHtOKNu7xE^QY`*JuF^b1z)l|=G--;Ut zj{;=Mz2OHoRe8it-!g`#6(mNchu_t8qDiFTA-g0^8^k<6!n*AWo#t+^>6($UO`1HA zOdADd&qnl*(1Mw5hIX?1k4f&>3K0te!zPixAKo%xaA$AZYgi^zteH z^x^~Y!G#)uR6wcQFJ$`%2ci6oYBEB~!P*oRN6;%6$*Wo7?m6uiRq71W~0cSV@hWsuzR9s}l{rYoi((*X`0Vfv~-tcTOa z=Qo*bJy1}9qhbldrE#-)hb@#8Q?L@#nlZ6PY|EGTuP5nKFek>ob zp5y~LuaJY*nH-DuYT+t8{9r{?;gnPgyhf51&{KHVVqbHlzJ_qMQU><^F5v#PJU?k< z2syZ&T1zp$p4i#f_W>*-P=4^gpFiV4S}^wEya(yLD9O=1^NFQL_Z&$VxPs>wVW6;LI7%(qx z9s>D)ir^+?I%mln{#<+MpqAjPYZ0KS%gLngGq29DpU$q9X(|{zguVp!ixosO13<&2 zmsUSXbm_8O9s#EX0^EPFNFOle`-hu6U{StHhHe6>F+w1z7q zfrbxMV}cFgQox?VM#B3!mB((N&oz*l54`DD96Bm6$1+7EU3WU&OQc!v(p#kCECcj+ z4#fhir?=NNxJy@Nv)(3ji=b)I0^n&i?z(AN5G=&HS=BXjdGx1?0k~-8HAK! z1X314Zc3*pPNoMK<0J>{DbOfcK%(BC884n8s_tGN(vc(Dx&0ES;4w1HV@u24!WVfK zn=7ThK+st9e%Bd6=0Kvj(E0Lm;zH>VV35iDd}&F}3wWPK7C=+RD!Sxk)5JmdV~8jC zBRL2ggtOnYufBW?D+E_7)E?=8o>7N|#T1@=_hBnf^y&-&yv6(=dI`+o-_RLZ7ji1y zp5k851$tXW%ot=)=3G@6K7$$bN3e;GHelPAhSk6_-kF@aeYeZG@2STaFz7a}_ef`g z!y2JXSpt0Thyv;Gyv&eGfdp8D4$;o)>iERH1nx=}Y(5D%>UY9NNL}l!Bs7`<7jw92 zRnL)7ItaWSgC8M?l6Xp-E3ss>7aJYAhitcB-Vh)FPyW*eMh9{1z?Np94izBa zD81%~bUJ_r{|PKC#cD`tm{zeE3^ctv3t(U>7Qh2(iXC!o(X=?gD66bF1anFloa!|x zlV-fB99Tb91_uGBlMO6ibFO7XpCk@-kXp4WYL^{LZfz>8V8t=%!KT)g*{s#U@47SQW z;jI^A&&cQ$a{!6*+`mHQX0$8_b84Szyfwn32dTL6;NQA90F#TOc_>DRWW_%PS03Rq zfz)yX9E9^bQ?I0$>;6Tu$r0uHuP4jJk7lA#f@#y7Fw+7siA^p%kHqu*d+HQp1n?h( zkF(NIgZxM^?)#osi@MIz68NV;1T0op@qn<(?oda|#?>0sP3`HgXkoxHL9px{5%OIX zU=j$O8H`87=D^%N?QmJ`HXNBkk^k%ovPbYiQwjaDHj<8pPxh;x=BP;Cz5yKsjG8TO zi`?UzvVqx3ULBHDn6jw_^wZ{9Rh7S_994SX;{C_i%fNFg;+N-?_YW+Ug+wLd5I7dq zBe0CPK}7%**=h3L0gk|~HPOM!NYJ|qR6O2h1UrDTcgbklmw8jT&7_W`!b0C{BKILG%&`&arRLblsP3(~!g`AY>P zPx!a57djho;3~Yu=EtBI5-jRC&8N+$kJcKovTW9~_o^H&ew3J3_9N*rj~PD&O)T3| z?!cJl=Ehbqo9=#8eRk6eUztZ$%Re(Rto7@g`DHZyS|*X>Q=oh5+9#T`War09TwS`) zu73?_QBl}Yp?abqxfGVOP~@y2cXYIUQ=eN<=uS=DE1R|PX;dF60{J66>gdp)&s7J& zqVC0z)-dgNEYOeiBt5{OkPSWiHS8duW}HTjDiCDP8Q(YlvD;}*GKDC7xGAIrn3am9gp-rl@LS4;!1^{9ET?t_~F|zU696t~kq0)ofw+7grHgKStB- zfwM<9N?$e*0`h58j7)mNhn<~29Dg7xe?~3fe$^(pMpOQByKBX9(|N5gg-ZP%=6W}4 zQOq}l;>ulrV)J^ySep!lU<%kI!HSCd@>=ZG_7BI3)pE~L$1=x$_1CFoR){TSu6qny zNdiupqme!=V&|)*1y$4*Nnfxtkt4V&I1qRvzs5Oue=Opmh8VGuKEj_YaeOwn6YH32 z`}iUHsh&yHtnIS8xBRbkwBA8%v-K*ljV z4+yVa$lFIu&3eyeC^%b1Emk93sZVP&^p-CXD-sv+3@EOUG8K-}>#*%8?fPFls6ANGyO>bEUeK$Xw*1q!+nt3M%qXyP=v+&R`l06< zO|SM*Y;(=RyPQZigjG{E@403dNNi8(MW?0DGOrqJ;_9en)zK2t{$rN z+-6F|6&hg5cxLmB2&C@x?&=L=q84`Pu|Onr7g4EYiO@(t3SJmH$93lI(r++$OfKX)tH6vSlJ3L=+h z-Mgs0X&!lAGFjj279=1tF93a2ctHjx&==4Nz2kM^D0&3>FyZldCQ*%$(EVBB{>p7# z-A_&ru`0k;;JcDl2%yizd)HZ4I8~={FZ9d~>t=@1h0p5c_T|*-_zU6niD7eS4;a9F zeZ$=#{H^S4Q%G;U@M&R_HJQbs#M6u3+=}fY0^Y>~=r zkCr>lCJ8Mcl`V#PYiArIx@I12yUtt)^_tj2?ZK9*JE#v#3?vU=zCo@d$%E00@mXNYvqQ8<1(a08AQjI7@z>7&Vny zKlLoodmk$`1mXmH&03Qu>7H?bcd5V{=K*6(#-PD$I_zD!zPnpUM#`DMsqSOqo!I{6 zo+Yy4mmt_R*bk`LtX+pGM!^razHw5@Ji;I5tK0SQU~oD6keJLm>ZHMYA1qv*rrVI_ zmLhB=m;5%oT#T0T#W5ibr|kWf{EBpTMGpJ=f3HE8G^YreYzK$ zER^^%v80FPsl(pQE^R22fT5K#8F1K9++jjG>^SMAX>p3VA2a;S*^=g*N=zt@etcU$ zxp{57PhL&}+T{lpHsrs|Gw}#>J+}8ktYi|rI`npOP`v$=EWXT3qNZxqFA8JqkfbMkVJ9!6dh(SEr4fnp5txp~3gQF7 z%w5uA#3i~MQXi&kZ|IZrvhx*)&L1|NlCn}HQIkg5Uj6ZMqo>%sbCHpy0?D4}qZ9b9!Or>LgJokm zN!-S|+sW3qX>KkY!#VaG^L5i($;tZL>l-d>d?D8!Wv!E|xz880$NB+g=iHz! z7#L}ciiIlF&HMQ>o+JSSrFq>PVMq7`_{E~KmfyY&?f4m4oqo>$6uL|3O#x;Q-T^1@ z{tY-FZug+0u0vPjP}om?8KJ;a*8AR}nX?l=i6=;)W~t34ck@^%4_e&?eXMhh`m z-pynA+U&Th>s?eX`gkb0KTZDd;X`8<;n2mKlq5Q*<<-T(ZBBVwlktDfMr3G=TTKUe z`ja5M+NlM8RYt+W&Hd%WBo)U{+k=}gswSOGrY6P!)ep;E zRWz@NsU|*=`m*Wnj;lZ9b+7SYw&`S>k~^Hm4#<^GXYVX25HhTA`44$q%in*!mUiHb+zFgM`5cbxV5BQU_5IG%~d~x4$wQgF?tsx1M ze=Hq2n|fZ7`YEh%ztv7B_{y}Wu=@2#ZSovCaQY(2{626SpeTeL+uEK- zav5gHcN`M*A9^NQ#pv3#reel&=ni*h9EFE4rCeF}1kW`5%ch4Y_qFV;4ac>S6p`mc z?OoxTr;ab(%$-i)AP&8SDN$4i+GUtBY9dS0RBiblIYWIL9TPk)588Ep={UJtRV^ZP z-+Ed|PB*tTic90W<9WlDGoJ9yHus!^zo5>|cH05m6S|!SFN|4d+-lG;F)b&fnr4&l z8)gs#i=$8N8j&6GOr&d0cuwf@L@Gh$V{7OR9ySMtx5-7=kxP3r}X$N5X^ zt6_RBVXNn{p4&Rh&kw6Uki2HsZ+dp5ex7L3(zT87TvSFi3yK}=d45$Al(ftRq*)n* zqWkKPsQZlzs>Mz(uOID>;arZHA9LQ)yQ|3>t>u~3BuFVOkLRXvy>@4W<7 z{`O;hED;tQ+A-SMf==Wtudcs^ro_23+Fwu|+Hhs2&M4RN!}T)$ay|FeWT~-v$tKqo z0>`Osyl>`U`5p6_w5d4yGzgjle|Q6Umcr@L@eg{M&oOUujtWgr*n7~gy!@gAy6c!- zzjQwH^+(acgf0|s1pOH9&Qn(u)9b7qmjJdydM)$NM!0$P4WDxf{!E$rzvk{TD3 zMnG(gm4&HRq){tUJFmZD=wG?;A(p0cDO=`C`l`{U#$>`8SnFkG;HSeB&B3fbrM)dC z<~*l=_mw=<)>5APHHUsvL%j-T^;IB(5)$Zoy@Vu?y$>yt{*(sM-^FyX|0yR$kWVvDR=1NWTz|nwCT4PGV&c4v{WkfRT?;Aq zs}6xM-I85p%|P|gf5IdUim>UK>e-1d{&N~Pm-YeP$bf9l`KXcNpmv!U%gy9w7%|sX zA1SR6*(^ci1f|ys9OobhBMsgj!wPbqQ%UO`I5w;=ZiW|Y*4`^p(To4+`n+J+YVaPg zXFlePYo7JJTPPN5qM(nQ`Q9dZcBwD(1idT=s7|L|kAy4?M1yQ?LU+9HwElR4M$F~# z>!PIRI=bh&Uo)0|R0z4*Q9EMn?6d9KNYqWhRwCL2T~ASMu>2E2+;UFE&8<4ekkpl>!7`x9U9x}STMWlkY|?u5U9KCpB+a5-lBf}}Z-yfRFw!tG)A1h5qb>#+h3SU8xJ_m}f`ZKlN{HZ*Q~F$a=h$(_1`W zc;d`#s}bW?{Ply>L!~EIRu|@{WlOifw9Q7zW9Y&tWO&FyBlhzAOvYM4L7L7Y8;JV& zI*R1;D*f6z;aUlE&qtrgkM^Nm6nam`i^LIbuP7Q+S);2NV~=kYsj%iXG;HfUj=Gpm z=>C8b$7cMfY6N1OsmOuH8N7b`yat|AH?LF+)KZ2C0EwBS z)-iwuacD~`h&b6KAjp?=j7uS^A0gOua7r`z6(CNqzM*K4PrIB9>%)P~UXVvP=Z3b^ zz(=O8d4Jlv+aZP_wH`pGT$)yat;q`XR`l1Y0<}V_)%C63iFa3(Dq9R++>SboUQn3J zR)OWnSW)UK5SSm~4j|aPW1&Xv`sc;KlQwEBZH@o|zL+6P3xKR_xGX{nj0{u`xvgtMW^SF)Ny%BGg2!WpZ}x8^+7lyP1keAFu6XQm&aP3iT9 zL@NR0CsTygCd@RlsTGBulW}%`3OH@xuEn@e!Q0iui|Zg^0gLX;8o>tu`@n|Mjt|bv zATFcX)EhH12JSRtvn@XRDu`d)BS{w-_p~L;%PeyjY)_quS2tEKuDHrJJ?oCaOEa?$3_<+@7<-;GIBzIQq<0OI>wKYZA7 zp4xBd6Z^vSkV>-sjLKKY#pI}Plc4bD!uCsdYXb@+}(`*1@ zp1yAOt(y#}RNp^I0{}Bq1XW>^eVXU&8oK-C7lvwgenr@v+hf!mUe&K?4O}s0Z?M3| zdmJqrL~$qQsB=7Aul(eW+jugPt#+JyA0V+WW8(3^Bq^JR2I4-yhwrht6C4~LZ|Z-q z-lF;cyYAtgWq4 zYuDKHKh@PuF2L=3N9OfhBOyldbH4@{Cq|+@z=!M>wCmkPI1~AXGqX^dwS}YOaU@|| zkb|X_IWF2fA%|5fPmK9*&8niYH{p};-k-_U_N^C9(ff7vPj0@Lk4K(c+vqplA>C?7b!3L zZj&#Lr6y$`8-qBx`h5*4(OtM#Kk|&^X%ZiEXdm}|Q>#fY1R)X>3*OtJ;cyUk$k1No zf+c-kZ&;C%UCT6l?@cpbt)PN>8_%KWVdeZ6&lArgv^ItH#Da?3#FCVdJ}9)EOfXKz z(#+BBzU}UPy(=3pFN&#drl?m(I zmTgP9*Yhn;FRwuVIdlM$nN9K*PXhJ3MxRdi@YG;3)d8{mH%XpI;Jj4?jj~T}Ia(vx zv29uV7?KNc(g=KSLJP>i(;$DT4}W6|un2l@!FzETmYH@ymjM!=3jiD$sRnS>dlfEh z2bi=|l7a!m4)JEh_BD5mGQImU5y-`toL)=d#t2hy!C^>d?S1RWDb;1@&=!t|9>t zDi2eH8-~R4Gcp@Fz@iCp*XRI*eh1iTh^lmV@26H`z!3Z~v`DO#gHXM|sC;_VKMyJ0 z>O|gv5CI@O)YqpDnT>i z9GI~a-LP~!l^lpuz12A;@HmN{!8(rD3szh!HW7(l6aY_il^h^RC?U~l6 zdQU7to0q9_^&{t3QfR7mJKeB3Qf1J1r3M`6;Ad$0bLDHePbA)ghUC-w;Rc{^kWaO9 z^$hPmDr|!PBZ~_jTuv4P2~cxG1;`i&-!SE)FrN^EC$T`j$uzA(k5z!Y_kucM&6Ux} zAVBMY-1_R`=7XcNyFB+mkO!}iYVwodcJmteiNU8FKEvmr&-4EBBmb`Cy)GdHplqeR zBhKu<6`LSgqxa&vr@q@x1D>!FQ7B9cEUL`0%O#NwZ{@8-RV3r+oBpB#p4CsB@GGuQ z83VV&Cc@oz29=%5fdRpU>Yl@#H3v9A{I2m^vPCM}Vm-bb9tiSy6i1jhVMwgSLn=DVN_ zFY-Se0z(SK*_67DE%%`}PRSbd{LT4-(AFIPZfpBVGc{dxfG{Yx7KR7?iP z##D$LH4f9{13=S&K0OhViBO=sG$JKd3lH()I!T1UK7H{oU-lM5v?kuO&#hvj-3!#L zX@JGNBx6AoF2C!61-1t-`bpJg$yi@>Q9o@F_maBJgY?bNB*XG-cAsk3|7M5r%sR|V z6w+hM4-%n*Oc*;YpBJwXk^b<{5%&R21M0*?;5`g_L3nmKi4O<%1bR;G3-&49Xtg9I zn6OxrXdpi%$)&Gs5tpU=0&b0~_yQW1)95>r2Bs)q{)Q;QVr_Qp_)=y!TDZ4O;6!kmV>kwo! z>_Tbr5$+oeGFP>`yoq(HnVl!(bH+`DcL%e2(AHpVE{C{$yeSb*6xB>`|a7yD?~ zx@+pPW}3r2{c9%K^&M6Uh&NcVIiUqq3KX=m2?s zzP(Kxkd*{(*`9jCtdn~pjB(zZ(vTkb$kb2EUu zWoJ_hJuRoMs9mdnpNSYLg|T=GwHLd}<4^$2>%iPtQj!EsjFZU`N#yrb*DN4Ps`#xy zwsLzv2V#KI{Tbrah+OX~m~j;=IdceyRMfN)(dE>;nU$BCti8#TQYtc@ZL}8R3={{|pGI;1GH~ zp!%cdJ`}(2DKh3ddyAmyDA>KW>j_;v5Y)!MJk?>B(A||Mwx=`J+SPMS2VYp*=zy>f zR(V+qbTv=BZ_$Q%yfB_(ps`p=AEr|*@bZDYh~^0c+*XM#BINK~-+HNKm;UEnm)+u? z?%cab-o`*CM~;y3mdaqhYL4FRZ60;$msD8cdH8q3<-dipEu zQCwq-5pA$Q`_O7#|6#0~(b3>&BuEPcOm}{*a?Hb9u8hYNq&^(9wqFvsuOF#j?m4-( zm9Tm*Beg%)mLSft5_?2LUUMZ$x^}+pLHzDzmUgOeq$gkd9o)BYdL(SA$Oi&!XcFZz z=4@QTaQa6cP&H`<7wFe{UNR6EGdS5^H_rs}?Onn$Sd_~_T_0eHg=VZfMv-4`-zHx> zeLd1Juz8$RYwMWsh6L9e1jK}lGg#|_)dgKdL*SS20L5|AFa5oXN1wWkC!(fK34C+w z3U%;~XPT`Re7YE%bL1!XL0C9GFzPH6aXi%-t_t?Nclz6eA<}*=5?E2ux%Y?|g^y#; zJC0|{mnK}(UliqK(+P_Iad`x?>rW&6X$0ij;(y5r@B;KJF};`}r4#7WyTEhgAMPfW zf-he{AZS>~YyV&P;F0|L5Tg7~h|NX(^*O2L`XAo$yBvWybNV0M@XvAt;_3h3hJP(z zC-~1B{nzuWeuNKW_M!@@B;4p!mPv@VorD zyBmRMMa<*<+YL#Jzdoy%2*lxM&=tD>R{r~W#CqF0vZuoStvmr}XTfLT=&x=>#Qa$|M>g>eKBwTk5dTp9Dz{&$A!Pni~jBW<3G-OPrzp_^~UcD$on_j##(5|{>y=3I>yAN-9Ikskg1l?=9WMuOcXYk4L0_zL=57sY6%5r4 zyfxA8zr#)N*vt6_$|GoI^y}?4O}aO>2O68x^~Z-Z-b5Q9uIuq-)0Bdv{xMD~Itm&g z9P)qup$|v8?~#@5tlUjuv$zKy?eiA8caxPK1l^}qEhZ^bXLjg%UnZqLV(7crI!NA2 zeLZ}df3++P`^zH~$`(Q^UDpw}Pbyp!=9_+bgAa1?X+zzg=s%jcG2Dl1{RfzNJ( zcai4N(U0?bU+_M-VW{TALQ@;#vlqgE$k*!_?p6#5@85F`Td$wpEPZ6FZ$EeGonBMI zd>^+f;z^-JTz_Tdvg@re@@us<(f~M3e|B<@gn{gl^4`)o-j~Rx-a(_Teu#(~cX)uS zt8{{J)TUI9s|dl2uLA0h9E)g_v`hz|Uf#s_(>r|<8w+p?$bHVD5aj~?Yr6||M+?fj zR7S7|87OG!-JG&YK`x)VFEWc7A9`lSg(yS$AUTVg0&F(rhF@2R`>6BZe4;?1^y1z6 z=%PEDafU02_#h_QDWF`ONV2KV=av4n{5v!B8>N7Q=>4yolg3dHycR}{>|3c`SNN^O zhnvaAq1J4V$XVg2%qkI^h1aoUl&um*JwyzLe7kw8Ab19r^p8m7;Bu6Fy!ssDcI=-~ z#A^s@NSXEIMp2nl_}P{iVOcC!auo%NR-Y(T13`ZfidI$1%!Xm?j~cy}>uneT zZ92kn5?g@wL;vnaG2N~F2)7&8@LB>S4Cao~Bc@m?40ed@p2 zNb?=CacFY%0PTRb{otuT4T~{O)h%5w4DLFD>U->I3T78y@B?OlE?GdDIE!f_qpJBV zH)$_y8%dpasgZ_KNX__ow6l+(E@U}m8Y;0noWpXnEY<64AirQnL_ye z3vOcXW66(Pq_s-F-DR-A!9~tz@qGFj&iN;q(1}g_^ z>IhMKwWrCN6@V^yruX-6c-avqChJRGT7#%T2vp6cIOpc$Xt{kCe5>G8jM?nxgx}(z z6ejYN_JpW*WN9divh8qnEM}j5EG-QzN-w`SS(9cjS`xgL2d2NzJlG=0Q8%WhdXEF9imQD$m#-107UNz*IWW|x5UbXw$e6Lti`5Grw;n8MhHNW6%2j#18>&Iy)4*t!aR&@Qqw9Bo zx$WHdEL=w>Jsqa&6RB%ksjtr2q|`)CGU$qEYO)@=Z;=Y(U4I?!rBrE_*!GSs?;(P1 zSoE}bel3Twj!6(9@c?y4fx|ueG2`_uQPCG2FYo1DzkJY2gJVcdHsi9F+Fs}RXmg=1yu-ABbd~; zjHm>{>ENh0&;t^Kxoq;9UhC_po9czJ#jcHDHqoZ&ohP02jy$)U^f#m-Oha*l_;}u9 zGw^>9OTey8(*HDc-y`on)4-m?ZlPz=vL(i}wtLd|X_<(?M*5O%?=0(Fo0Aw3`V=~2 z^VpN+@l$6jn$8|`kTJ0SJo5e>*I|XjA_NmoC_C-7N{)jAr5BUKdZLIEc@M>Qv5Myf9}HJIRKK);!bla? zKpCPsnJ31$WBIeHhs}PRxy8pEg2LG}n8(I~d33+RvKWU#K$}D+|3m5SdNuZ8j&Iw8 z_(ZL0kLI5AT6ZBlyp~uK2T!H5*3|KGm-ZKV!5T%@r*Gp`G}({Jr3I5jS34_Zf(Z9q z3$;B32LghN-r{a3P{Ivlwsq#ea-YpywFL_(kuIq@-&LEbX6VjSYOvtqJfP zT_cLY3|4z4*{kdKKz&-Paj(#OZ&Xx`^HxyI#>bEO)Q7rg?i#z2h5Y@^<#xJa-IAy~ z4@pHMKBZl~>D!udnQbxn*gdeaaMs>L{1#8naZv)+o;r2VwydzkcNd0i8kUMEiZ^L1)XIe)w|K>} zJ%3h@zH5A6X7tQ{pX8FaSpBe^=DHFsuWJ#CjDC0ty?XshMFa1|E$;n#HFz>GaQt#p z|IBS9FMPU5LhPhmYO8d?j&p2MCtqP+Npp75Uc2gQmKVKu?zCqNb;k`mSs~5r*6wCs=9*3F(YI=-efbROs!kbCi5Yb^%A)HC_Uh}iD7VHO(;g?e?d6e#cO^sC zKi_6PAO7)Kzc{}rg?GTqt$2hovtqNte5yq+MJyvekH`2%UMMT(!u=2p?>e+Dx zi*-thL&0is(J+CFs;)%9D>@?2g8Y2bD%}_B+l<{?S``;^^~;X?4I3ymwfFGbvuOyo z^`Czf8+HHret%oRGQXc@wpKTwY&Ldo@%1CykOwrm$=rt4k|xnF39brk6XItE#Zbo} zqo_CPa(d%=SEw%wOA8+&4wncntKtXD#$@B?Y&;pMo|vTfvt914hq&+Nv$^jk97K;x z@TpS2P@4Nrf|u6(*s;2< zSj-_uH_O|Yp=X6754()_h>-v~A zB}O*N4rL4Tv9=YfMw(c*!tkBiEQWN)tw>qP;wn z5PBcW${ud7&yeB!i8%bYm1hoVX1$Go8;C$3b&ir3Kh6yf4vs&oY&_ew{FzdkKO|Z@ zN`vhRn&8|8{Sq#ws-^Xsjyk-0wR+!b-=nPT>$%Wk3JM;~k?j#awzS2owUr~Yd{#E? z^sFqov-J&qPo4M72O2&pcEFZAUk4wJt=;P?M#YhjQj|0#Iy&adS8IH~Ph%OE<946* zF?kwnA3sK|A@W6>YQjAcx`%6+C#3EqGt)MLKZt|gXJ+(ADqS*t=&K#c?5m3s<%HX< z7N>If+ePV})K!=`7!Vi)mO1ZbhH~?MVUKcHk~sTRM4O=^X3aHX-PL~3x8WmvF5nu- zh1lpIHz@Y~>VmfX0QCl|10NN3JRP49cQjMKA^L%KT&#a%YmWM!I4qScrecryyOc;K z%A(X45IR{OzKwF=A{H{qYe0Z}Wejon0OXCLshxy@6AD9JKyz#ANEzmAUtOf?G;}Yy zLEv!KpASMn_BP@riQ;_P+wyv==agPQpFDuexXREny3-rFoRyB{&`5QiNuDp0H)maRsRA^@pOwV2jh3;<>QhHg-$UHN` zUZsZ=3lAKP9d}T!tV~!yJc>AL-!gtDzuP_&eiw#S-4EK&#O{J0#eJubDXgMUkM1?eyhZhUrs7rj|&C+SrdLA|3YrI+iAhsML$AGbBi=Jh`&_KNZLLoSqMcqr81Ru*{bqC6XN zI$aZ9lb9FmX|M4Pz6E&H8HkVfX_7_WbcOh>mKG+WA7$~Pev{|a_h|1Czjx~Jkl4!x;N8>Q8Q3#$~h&X>)`>kOP{1-ClULT0)~tH zC@D~#sM(wqv`j?=N856;6#4#aU$xT)$|BpB*S*-%{Vcre;rGVXtX^|sd47~d-I2QG z6WQ+dew_xx2vz^S?RI`s+U=KSDSQxNhxiFrZ*khi@(-ad^PL0H0fhnr~>qDc!bfz$=d10FAy$%=M2hVMdo%q2k`Ju55b4c%5`I&?F z;DcZ}(~gU+(kjg98V`O%8CcpIr1;h5@osS$91pQ`blSt z`C=|4>m1{mkJrU_y=1211pvC{UjO_jk zXz>mROveQ>vba`0Ut7f85$P< zreJH2*hokkZ|D|;Px<{OP1Fkf9wd(CMkU4%l+RlDN>U-r1}A+xh=cQsk4w>UxaB+KXz78=68a?{uAQsc@auTNv9ze(JRQlSauAe+jH4qRf72B7=fVi_hjdyt~s5| z%zPJYy20$ohh|O#g_PX%eR8oz|I5(#ADFh4sWmW!#eHUDX<`40oBIa}6cr5}gMw1y z_G=S6dkbqTjoa4Go|_oGve&$AXlG<@0WPcDer0WQ9fIPYmW7E$be&lBwv~gWx*LER0?O0u1e()5&gV$SW)SqC=mMKweqK#M#7H{BLslZ&In)SzEvI zLct=Ur03uf5PkSWN!Qra{JEu-y_0+3yOa<44b7jy&_Rx#-$vcH{yP81vBScWmj{eN zCIln{p!`0R5W;APKRL<`vPeh}`8)6jA&YpACcz}zCeByR*Y~+ z5I+WktHfe?AYAhaNjJ2urD7`RC3 zdlN$A2Y$VUL1=y-L&5L2kWg3{BpBQb{s+B39SRJFfaE}aQCaGfjZ%zw5An}M$;$;~ z<^nQvAvu7|Tu443GZzq;3(5QMj}QTWe$=}{T4}#X^-E0qMXFpugkqJ82a30{dP2_L=cA$6gUfJBtcsyFqZq{^ofrK-*k{CryvY4~-lMIHgU^^p9x zkdS&nZmoXqci=l{HsaS2G6fz3XOJ1> zckt{#kAGkLMf^RpkH3g_i-`P1ymdrGZYh#@bV237h=^3LQb1vdPZ%WJI|A~-s}xcO zNRI$-;r;6;ss8pn+ltGX;fH49fKH%sN@g?_1{<;B<{16=Ae#no?jf+C<2OjW-pkm&F z!F(YQDlckp(6PP{e{kjtgV2HETi^;+2IK?8D<4u0>IA(8>I6qn)32j%u0I5F*P9>O~XvPpZxLMaC;gOs}c0^M#<+*3{H`*Fze?zo_%Ahcy574Jxnmu7=bgD@R>e zUtbP_{I@keV0?JLouTCc(7{j)Hrk?VD%fb7+DRLLMsxH}n9x6A`r3`_TNoPFF>C+^ Z-i8*2){P*OTYzk!$r~HjGpt(7003)kXl4Ka diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatsPrefPane.h b/dev-tools/packaging/preference-pane/beats-preference-pane/BeatsPrefPane.h deleted file mode 100644 index bf592a205466..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatsPrefPane.h +++ /dev/null @@ -1,46 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import -#import - -#import "TabViewDelegate.h" -#import "Authorization.h" - -/* BeatsPrefPane is the main class for handling the preference pane. - Implements so that it can provide authorization - obtained via the SFAuthorizationView to other components. - */ -@interface BeatsPrefPane : NSPreferencePane { - IBOutlet NSTabView *beatsTab; - IBOutlet TabViewDelegate *tabDelegate; - IBOutlet SFAuthorizationView *authView; - IBOutlet NSTextField *messageLabel; - NSTimer *updateTimer; - NSBundle *bundle; - NSArray *knownBeats; - NSString *helperPath; - id beatsInterface; -} - -- (id)initWithBundle:(NSBundle *)bundle; -- (void)mainViewDidLoad; -- (void)didSelect; -- (void)willSelect; -- (void)didUnselect; -- (BOOL)isUnlocked; -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatsPrefPane.m b/dev-tools/packaging/preference-pane/beats-preference-pane/BeatsPrefPane.m deleted file mode 100644 index 29fafed1244c..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/BeatsPrefPane.m +++ /dev/null @@ -1,164 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import "config.h" -#import "BeatsPrefPane.h" -#import "beats/BeatsService.h" - -@implementation BeatsPrefPane - -// Constructor -- (id)initWithBundle:(NSBundle *)bundle -{ - if ( ( self = [super initWithBundle:bundle] ) != nil ) { - self->beatsInterface = [[BeatsService alloc] initWithPrefix:BEATS_PREFIX]; - self->updateTimer = nil; - self->knownBeats = [beatsInterface listBeats]; - self->bundle = bundle; - self->helperPath = [bundle pathForAuxiliaryExecutable:HELPER_BINARY]; - NSLog(@"Using helper: `%@`", helperPath); - } - return self; -} - -// Called when UI file is loaded -- (void)mainViewDidLoad -{ - // Setup SFAuthorizationView - AuthorizationItem items = {kAuthorizationRightExecute, 0, NULL, 0}; - AuthorizationRights rights = {1, &items}; - [authView setAuthorizationRights:&rights]; - authView.delegate = self; - [authView updateStatus:nil]; - // Allocate tabview delegate - tabDelegate = [[TabViewDelegate alloc] initWithTabView:beatsTab bundle:bundle beats:beatsInterface]; -} - -// Called before the preference pane is shown -- (void)willSelect -{ - [self updateUI]; -} - -// Called when the preference pane is shown -- (void)didSelect -{ - updateTimer = [NSTimer scheduledTimerWithTimeInterval:UPDATE_INTERVAL_SECS target:self selector:@selector(onTimer) userInfo:nil repeats:YES]; -} - -// Called when the preference pane is closed -- (void)didUnselect -{ - [updateTimer invalidate]; - updateTimer = nil; -} - -// Custom code to update the UI elements -- (void)updateUI { - [tabDelegate populateTabs:knownBeats withAuth:self]; - [messageLabel setHidden:knownBeats.count > 0]; -} - -static BOOL beatArrayEquals(NSArray *a, NSArray *b) -{ - size_t n = a.count; - if (b.count != n) return NO; - for (size_t i = 0; i < n; i++) { - if (![(NSString*)a[i] isEqualToString:b[i]]) - return NO; - } - return YES; -} - -- (void)onTimer -{ - [authView updateStatus:nil]; - NSArray *beats = [beatsInterface listBeats]; - if (!beatArrayEquals(beats, knownBeats)) { - knownBeats = beats; - [self updateUI]; - } else { - [tabDelegate update]; - } -} - -// -// SFAuthorization delegates -// - -- (void)authorizationViewDidAuthorize:(SFAuthorizationView *)view { - // Update the tab delegate so that it can enable UI elements - [tabDelegate update]; -} - -- (void)authorizationViewDidDeauthorize:(SFAuthorizationView *)view { - // Update the tab delegate so that it can disable UI elements - [tabDelegate update]; -} - -// -// AuthorizationProvider protocol -// - -- (BOOL)isUnlocked { - return [authView authorizationState] == SFAuthorizationViewUnlockedState; -} - -- (int)runAsRoot:(NSString*)program args:(NSArray*)args { - size_t numArgs = args.count; - char **cArgs = alloca(sizeof(char*) * (1 + numArgs)); - for (int i=0; i - -/* EditorWindow manages the window to edit configuration files - */ -@interface EditorWindow : NSWindowController { - NSString *filePath, - *beatName; - IBOutlet NSView *verticalStackView; - IBOutlet NSScrollView *textEditor; - NSString *sourceText; -} - -- (id) initWithBeat:(NSString*) name config:(NSString*) path; -- (IBAction)saveAndCloseTapped:(id)sender; -- (IBAction)closeTapped:(id)sender; -- (BOOL)windowShouldClose:(id)sender; -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/EditorWindow.m b/dev-tools/packaging/preference-pane/beats-preference-pane/EditorWindow.m deleted file mode 100644 index 915092d70a20..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/EditorWindow.m +++ /dev/null @@ -1,89 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import "EditorWindow.h" - -@implementation EditorWindow - -- (id) initWithBeat:(NSString*)name config:(NSString*)path { - if (self = [super initWithWindowNibName:@"EditorWindow"]) { - self->beatName = name; - self->filePath = path; - } - return self; -} - -- (void)windowDidLoad { - [super windowDidLoad]; - verticalStackView.translatesAutoresizingMaskIntoConstraints = YES; - [[self window] setTitle:[NSString stringWithFormat:@"%@ configuration", beatName]]; - - NSError *err = nil; - sourceText = [NSString stringWithContentsOfFile:filePath encoding:NSUTF8StringEncoding error:&err]; - if (sourceText == nil) { - sourceText = [err localizedDescription]; - } - NSTextStorage *storage = [(NSTextView*)[textEditor documentView] textStorage]; - [[storage mutableString] setString:sourceText]; - // Yaml needs a monospace font - [storage setFont:[NSFont userFixedPitchFontOfSize:-1]]; -} - -- (BOOL)onClose -{ - NSTextStorage *storage = [(NSTextView*)[textEditor documentView] textStorage]; - if (![[storage string] isEqualToString:sourceText]) { - NSAlert *alert = [[NSAlert alloc] init]; - [alert addButtonWithTitle:@"Discard"]; - [alert addButtonWithTitle:@"Continue editing"]; - [alert setMessageText:@"Discard changes?"]; - [alert setInformativeText:@"Changes will be lost if the dialog is closed without saving."]; - [alert setAlertStyle:NSAlertStyleWarning]; - if ([alert runModal] != NSAlertFirstButtonReturn) { - return NO; - } - } - [NSApp stopModalWithCode:NSModalResponseStop]; - return YES; -} - -- (IBAction)saveAndCloseTapped:(id)sender -{ - NSError *err = nil; - NSTextStorage *storage = [(NSTextView*)[textEditor documentView] textStorage]; - if (![[storage string] writeToFile:filePath atomically:YES encoding:NSUTF8StringEncoding error:&err]) { - NSAlert *alert = [NSAlert alertWithError:err]; - [alert runModal]; - return; - } - [NSApp stopModalWithCode:NSModalResponseOK]; - [self close]; -} - -- (IBAction)closeTapped:(id)sender -{ - if ([self onClose]) { - [NSApp stopModalWithCode:NSModalResponseStop]; - [self close]; - } -} - -- (BOOL)windowShouldClose:(id)sender { - return [self onClose]; -} - -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/Info.plist b/dev-tools/packaging/preference-pane/beats-preference-pane/Info.plist deleted file mode 100644 index f145834a69bf..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/Info.plist +++ /dev/null @@ -1,32 +0,0 @@ - - - - - CFBundleDevelopmentRegion - $(DEVELOPMENT_LANGUAGE) - CFBundleExecutable - $(EXECUTABLE_NAME) - CFBundleIdentifier - $(PRODUCT_BUNDLE_IDENTIFIER) - CFBundleInfoDictionaryVersion - 6.0 - CFBundleName - $(PRODUCT_NAME) - CFBundlePackageType - BNDL - CFBundleShortVersionString - 1.0 - CFBundleVersion - 1 - NSHumanReadableCopyright - Copyright © 2018 Elastic. All rights reserved. - NSMainNibFile - BeatsPrefPane - NSPrefPaneIconFile - Beats.icns - NSPrefPaneIconLabel - Beats - NSPrincipalClass - BeatsPrefPane - - diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/TabViewDelegate.h b/dev-tools/packaging/preference-pane/beats-preference-pane/TabViewDelegate.h deleted file mode 100644 index 6cc20a3c2cac..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/TabViewDelegate.h +++ /dev/null @@ -1,43 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import -#import - -#import "beats/Beats.h" -#import "Authorization.h" - -@class BeatViewController; - -/* TabViewDelegate takes care of the NSTabView that displays all the installed beats - */ -@interface TabViewDelegate : NSObject { - NSTabView *tabView; - NSBundle *bundle; - BeatViewController *selectedTab; - id beatsInterface; -} -- (id) initWithTabView:(NSTabView*)_ bundle:(NSBundle*)_ beats:(id)_; -- (void) update; -- (void) populateTabs:(NSArray*)_ withAuth:(id)_; - -// NSTabViewDelegate -- (void) tabViewDidChangeNumberOfTabViewItems:(NSTabView*)_; -- (BOOL) tabView:(NSTabView*)_ shouldSelectTabViewItem:(NSTabViewItem*)_; -- (void) tabView:(NSTabView*)_ willSelectTabViewItem:(NSTabViewItem*)_; -- (void) tabView:(NSTabView*)_ didSelectTabViewItem:(NSTabViewItem*)_; -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/TabViewDelegate.m b/dev-tools/packaging/preference-pane/beats-preference-pane/TabViewDelegate.m deleted file mode 100644 index fb517f03fcda..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/TabViewDelegate.m +++ /dev/null @@ -1,99 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import "TabViewDelegate.h" -#import "BeatViewController.h" -#import "common/common.h" - -@implementation TabViewDelegate -- (id) initWithTabView:(NSTabView *)tabView - bundle:(NSBundle*)bundle - beats:(id)beats -{ - if (self = [super init]) { - self->selectedTab = nil; - self->tabView = tabView; - self->bundle = bundle; - self->beatsInterface = beats; - tabView.delegate = self; - } - return self; -} - -- (void) update -{ - [selectedTab update]; -} - -- (void) populateTabs:(NSArray*)beats withAuth:(id)auth -{ - // cache self->selectedTab, as it is going to change in this method - // (add|remove|select)TabViewItem methods call the NSTabViewDelegate callbacks - BeatViewController *selectedTab = self->selectedTab; - uint i; - NSArray *items; - NSString *selectedName = nil; - for (i=0, items = tabView.tabViewItems; items != nil && i < items.count; i++) { - NSTabViewItem *item = [items objectAtIndex:i]; - if (selectedTab != nil && item.viewController == selectedTab) { - selectedName = item.identifier; - } - [tabView removeTabViewItem:item]; - } - for (uint i=0; i < beats.count; i++) { - NSString *beatName = [beats objectAtIndex:i]; - id beat = [beatsInterface getBeat:beatName]; - if (beat == nil) { - // TODO: Investigate and repair. Why some beats seem to break. Seemingly after some time disabled - // they are unloaded from launchctl. - NSLog(@"Ignoring broken beat %@", beatName); - continue; - } - NSTabViewItem *item = [[NSTabViewItem alloc] initWithIdentifier:beatName]; - [item setLabel:[beat displayName]]; - BeatViewController *vc = [[BeatViewController alloc] - initWithBeat:[beatsInterface getBeat:beatName] auth:auth bundle:bundle beatsInterface:beatsInterface]; - [item setViewController:vc]; - [tabView addTabViewItem:item]; - if ([beatName isEqualToString:selectedName]) { - selectedTab = vc; - [tabView selectTabViewItem:item]; - } - } -} - -- (void) tabViewDidChangeNumberOfTabViewItems:(NSTabView*) tabView -{ - // ignore -} - -- (BOOL) tabView:(NSTabView*)tabView shouldSelectTabViewItem:(NSTabViewItem*)item -{ - return YES; -} - -- (void) tabView:(NSTabView*)tabView willSelectTabViewItem:(NSTabViewItem*)item -{ - [(BeatViewController*)[item viewController] update]; -} - -- (void) tabView:(NSTabView*)tabView didSelectTabViewItem:(NSTabViewItem*)item -{ - selectedTab = (BeatViewController*)[item viewController]; -} - -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/beats/Beats.h b/dev-tools/packaging/preference-pane/beats-preference-pane/beats/Beats.h deleted file mode 100644 index f98cec1943ae..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/beats/Beats.h +++ /dev/null @@ -1,39 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import -#import "../Authorization.h" - -@protocol Beat -- (bool) isRunning; -- (bool) isBoot; -- (int) pid; -- (NSString*) name; -- (NSString*) displayName; -- (NSString*) plistPath; -- (NSString*) configFile; -- (NSString*) logsPath; -- (BOOL) startWithAuth:(id)auth; -- (BOOL) stopWithAuth:(id)auth; -- (BOOL) toggleRunAtBootWithAuth:(id)auth; -- (BOOL) uninstall; -@end - -@protocol Beats -- (NSArray*) listBeats; -- (id )getBeat:(NSString*)name; -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/beats/BeatsService.h b/dev-tools/packaging/preference-pane/beats-preference-pane/beats/BeatsService.h deleted file mode 100644 index 5acd142ec7bd..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/beats/BeatsService.h +++ /dev/null @@ -1,29 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import -#import "Beats.h" - -// BeatsService is the macOS implementation for the Beats protocol -@interface BeatsService : NSObject { - NSString *prefix; -} - -- (id)initWithPrefix:(NSString*)prefix; -- (NSArray*) listBeats; -- (id )getBeat:(NSString*)name; -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/beats/BeatsService.m b/dev-tools/packaging/preference-pane/beats-preference-pane/beats/BeatsService.m deleted file mode 100644 index 2191f106f766..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/beats/BeatsService.m +++ /dev/null @@ -1,294 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import "BeatsService.h" -#import "../common/common.h" -#import "config.h" - -static NSString *plistExtension = @"plist"; -static NSString *empty = @""; - -@interface ConcreteBeat : NSObject { - @public NSString *config; - @public NSString *logs; - @public NSString *name; - @public NSString *displayName; - @public bool running; - @public bool startAtBoot; - @public pid_t pid; - @public NSString *plistPath; - NSString *prefix; -} -- (id) initWithPrefix:(NSString*)prefix andName:(NSString*)name; -@end - -@implementation ConcreteBeat - -- (id) initWithPrefix:(NSString*)prefix andName:(NSString *)name { - if (self = [self init]) { - self->name = name; - self->displayName = [name capitalizedString]; - self->prefix = prefix; - self->config = nil; - self->logs = nil; - self->running = false; - self->startAtBoot = false; - self->pid = 0; - self->plistPath = nil; - } - return self; -} - -- (NSString *)configFile { - return self->config; -} - -- (bool)isRunning { - return self->running; -} - -- (NSString *)name { - return self->name; -} - -- (int)pid { - return self->pid; -} - -- (BOOL)uninstall { - // TODO - return NO; -} - -- (NSString *)logsPath { - return self->logs; -} - -- (bool)isBoot { - return self->startAtBoot; -} - -- (NSString*) serviceName { - return [NSString stringWithFormat:@"%@.%@", prefix, name]; -} - -- (NSString*) serviceNameWithDomain { - return [NSString stringWithFormat:@"system/%@", [self serviceName]]; -} - -// Executes a batch of commands using the helper app. -BOOL runHelperTaskList(id auth, NSArray *argList) { - BOOL __block failed = YES; - [argList enumerateObjectsUsingBlock:^(id obj, NSUInteger _, BOOL *stop) { - NSArray *args = (NSArray*)obj; - int res = [auth runHelperAsRootWithArgs:args]; - if (res != 0) { - NSLog(@"Error: running helper with args `%@` failed with code %d", - [args componentsJoinedByString:@" "], res); - *stop = failed = YES; - } - }]; - return !failed; -} - -- (BOOL)startWithAuth:(id)auth { - return runHelperTaskList(auth,@[ - @[ @"run", LAUNCHCTL_PATH, @"enable", [self serviceNameWithDomain] ], - @[ @"run", LAUNCHCTL_PATH, @"start", [self serviceName] ] - ]); -} - -- (BOOL)stopWithAuth:(id)auth { - return runHelperTaskList(auth,@[ - @[ @"run", LAUNCHCTL_PATH, @"disable", [self serviceNameWithDomain] ], - @[ @"run", LAUNCHCTL_PATH, @"stop", [self serviceName] ] - ]); -} - -- (BOOL)toggleRunAtBootWithAuth:(id)auth { - return runHelperTaskList(auth,@[ - @[ @"setboot", [self plistPath], self->startAtBoot? @"no" : @"yes"] - ]); -} - -- (NSString *)plistPath { - return self->plistPath; -} - -- (NSString *)displayName { - return self->displayName; -} - - -@end - -@implementation BeatsService - -- (id)initWithPrefix:(NSString*)prefix { - if (self = [self init]) { - self->prefix = prefix; - } - return self; -} - -- (NSArray *)listBeats { - uint64_t elapsed = getTimeMicroseconds(); - NSArray *result = [self doListBeats]; - if (result != nil) { - elapsed = getTimeMicroseconds() - elapsed; - NSLog(@"ListBeats took %llu us", elapsed); - } - return result; -} - -- (NSArray *)doListBeats { - NSError *error = nil; - NSArray* contents = [[NSFileManager defaultManager] contentsOfDirectoryAtPath:LAUNCHDAEMONS_PATH - error:&error]; - if (error != nil) { - NSLog(@"Error: Unable to list installed beats: %@", [error localizedDescription]); - return nil; - } - NSMutableArray *beats = [[NSMutableArray alloc] init]; - NSUInteger prefixLength = [prefix length]; - NSUInteger extensionLength = [plistExtension length]; - - [contents enumerateObjectsUsingBlock:^(id obj, NSUInteger idx, BOOL *stop) { - NSString *filename = (NSString *)obj; - NSUInteger nameLength =[filename length]; - - // Make sure the file is .something.plist - if ([filename hasPrefix:self->prefix] - && nameLength > prefixLength + extensionLength + 2 - && [filename characterAtIndex:prefixLength] == '.' - && [[[filename pathExtension] lowercaseString] isEqualToString:plistExtension]) { - NSString *beatName = [filename substringWithRange:NSMakeRange(prefixLength+1, nameLength - prefixLength - extensionLength - 2)]; - [beats addObject:beatName]; - } - }]; - return beats; -} - -NSString *parseLine(NSString *line, NSString **data) { - NSRange range = [line rangeOfString:@" = "]; - if (range.location != NSNotFound) { - unsigned int i = 0; - for(char c; i < range.location && ((c = [line characterAtIndex:i])==' ' || c == '\t'); i++) - ; - *data = [line substringFromIndex:range.location + range.length]; - return [line substringWithRange:NSMakeRange(i, range.location - i)]; - } - return nil; -} - -NSDictionary* parseLaunchctlPrint(NSString *label, NSSet *keys) { - NSMutableDictionary *dict = [NSMutableDictionary dictionaryWithCapacity:[keys count]]; - executeAndGetOutput(LAUNCHCTL_PATH, @[@"print", label], ^(NSString *line) { - NSString *value; - NSString *key = parseLine(line, &value); - if (key != nil && [keys containsObject:key]) { - dict[key] = value; - } - return YES; - }); - return dict; -} - -- (id)getBeat:(NSString *)name { - uint64_t elapsed = getTimeMicroseconds(); - id result = [self doGetBeat:name]; - if (result != nil) { - elapsed = getTimeMicroseconds() - elapsed; - NSLog(@"GetBeat took %llu us", elapsed); - } - return result; -} - -- (id)doGetBeat:(NSString *)name { - // Get launch daemon runtime info (only if running) - NSString *label = [NSString stringWithFormat:@"system/%@.%@", self->prefix, name]; - NSSet *wantedKeys = [NSSet setWithObjects:@"pid", @"state", @"path", nil]; - NSDictionary * dict = parseLaunchctlPrint(label, wantedKeys); - - if (!dict[@"path"]) { - NSLog(@"Error: launch daemon %@ not installed", name); - return nil; - } - ConcreteBeat *beat = [[ConcreteBeat alloc] initWithPrefix:prefix andName:name]; - beat->plistPath = dict[@"path"]; - if (dict[@"pid"]) { - beat->pid = [ (NSString*)dict[@"pid"] intValue]; - } - // pid may be present after stopped - if (beat->pid > 0 && [@"running" isEqualToString:dict[@"state"]]) { - beat->running = true; - } - - // Get configuration paths - NSError *err; - NSInputStream *plistFile = [[NSInputStream alloc] initWithFileAtPath:dict[@"path"]]; - if (plistFile == nil) { - NSLog(@"Error: unable to open plist at path '%@'", dict[@"path"]); - return nil; - } - [plistFile open]; - if ( (err = [plistFile streamError]) != nil) { - NSLog(@"Error: unable to read plist at path '%@': %@", dict[@"path"], [err localizedDescription]); - return nil; - } - - NSDictionary *plist = [NSPropertyListSerialization propertyListWithStream:plistFile - options:NSPropertyListImmutable - format:nil - error:&err]; - if (plist == nil) { - NSLog(@"Error: unable to parse plist at path '%@'", dict[@"path"]); - return nil; - } - if (err != nil) { - NSLog(@"Error: failed parsing plist at path '%@': %@", dict[@"path"], [err localizedDescription]); - return nil; - } - [plistFile close]; - - NSNumber *runAtLoad = plist[@"RunAtLoad"]; - beat->startAtBoot = runAtLoad != nil && [runAtLoad boolValue] == YES; - NSArray *args = plist[@"ProgramArguments"]; - NSMutableDictionary *argsDict = [NSMutableDictionary new]; - NSString *key = nil; - for (unsigned long i = 0, count = [args count]; i < count; i++) { - NSString *arg = [args objectAtIndex:i]; - if (key != nil) { - argsDict[key] = arg; - key = nil; - } else if ([arg characterAtIndex:0] == '-') { - key = arg; - } - } - - beat->config = argsDict[@"-c"]; - if (beat->config == nil) { - beat->config = [NSString stringWithFormat:@"/etc/%@/%@.yml", name, name]; - } - beat->logs = argsDict[@"--path.logs"]; - if (beat->logs == nil) { - beat->logs = [NSString stringWithFormat:@"/var/log/%@", name]; - } - return beat; -} - -@end diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/common/common.h b/dev-tools/packaging/preference-pane/beats-preference-pane/common/common.h deleted file mode 100644 index f14cb842cc58..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/common/common.h +++ /dev/null @@ -1,29 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import - -// executes the given `path` executable, passing `args` array. -// Callback is called for every line in the program's output. -// Returns the program exit status. -int executeAndGetOutput(NSString *path, NSArray *args, BOOL (^callback)(NSString*)); - -// Returns the current time in microseconds -uint64_t getTimeMicroseconds(void); - -// Returns the given string, or @"nil" if its nil. -NSString *strOrNil(NSString *str); diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/common/common.m b/dev-tools/packaging/preference-pane/beats-preference-pane/common/common.m deleted file mode 100644 index f6ecbb12f0e1..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/common/common.m +++ /dev/null @@ -1,75 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import "common.h" -#import -#import - -static void readLines(NSFileHandle *handle, BOOL (^callback)(NSString*)) { - const int readLength = 4096; - NSMutableData *buffer = [NSMutableData dataWithCapacity:readLength]; - - unsigned int length = 0; - for (NSData *readData; (readData = [handle readDataOfLength:readLength])!= nil && [readData length] > 0;) { - [buffer appendData:readData]; - unsigned int start = 0, // where the first line starts - base = length; // where it begins scan for newlines - length += [readData length]; - char *bytes = [buffer mutableBytes]; - for (unsigned int i=base; i < length; i++) { - if (bytes[i] == '\n') { - NSString *line = [[NSString alloc] initWithBytesNoCopy:&bytes[start] - length:(i - start) encoding:NSUTF8StringEncoding - freeWhenDone:NO]; - callback(line); - start = i + 1; - } - } - // discard full lines - if (start != 0) { - [buffer replaceBytesInRange:NSMakeRange(0, start) withBytes:NULL length:0]; - length -= start; - } - } -} - -int executeAndGetOutput(NSString *path, NSArray* args, BOOL (^callback)(NSString*)) { - NSPipe *pipe = [NSPipe pipe]; - NSFileHandle *fHandle = pipe.fileHandleForReading; - NSTask *task = [[NSTask alloc] init]; - task.launchPath = path; - task.arguments = args; - task.standardOutput = pipe; - - [task launch]; - - readLines(fHandle, callback); - - [fHandle closeFile]; - [task waitUntilExit]; - return [task terminationStatus]; -} - -uint64_t getTimeMicroseconds(void) { - struct timeval tv; - gettimeofday(&tv, NULL); - return tv.tv_sec*1000000 + tv.tv_usec; -} - -NSString *strOrNil(NSString *str) { - return str != nil? str : @"(nil)"; -} diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/config.h b/dev-tools/packaging/preference-pane/beats-preference-pane/config.h deleted file mode 100644 index 4119154075fa..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/config.h +++ /dev/null @@ -1,31 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -// Service prefix used by Beats launch daemons. Used for detection -#define BEATS_PREFIX @"co.elastic.beats" - -// How often daemons info is updated -#define UPDATE_INTERVAL_SECS 2.0 - -// Helper binary name -#define HELPER_BINARY @"helper" - -// Path where to look for launch services -#define LAUNCHDAEMONS_PATH @"/Library/LaunchDaemons" - -// Path to launchctl executable -#define LAUNCHCTL_PATH @"/bin/launchctl" diff --git a/dev-tools/packaging/preference-pane/beats-preference-pane/en.lproj/beats_preference_pane.strings b/dev-tools/packaging/preference-pane/beats-preference-pane/en.lproj/beats_preference_pane.strings deleted file mode 100644 index e66b8e363887..000000000000 --- a/dev-tools/packaging/preference-pane/beats-preference-pane/en.lproj/beats_preference_pane.strings +++ /dev/null @@ -1,3 +0,0 @@ - -/* Class = "NSWindow"; title = "≪ do not localize ≫"; ObjectID = "F0z-JX-Cv5"; */ -"F0z-JX-Cv5.title" = "≪ do not localize ≫"; diff --git a/dev-tools/packaging/preference-pane/helper/main.m b/dev-tools/packaging/preference-pane/helper/main.m deleted file mode 100644 index 95b9513371b5..000000000000 --- a/dev-tools/packaging/preference-pane/helper/main.m +++ /dev/null @@ -1,72 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import -#import -#import -#include - -BOOL setRunAtBoot(NSString*,BOOL); - -/* This helper tool is used to launch actions with elevated privileges. - # helper run - # helper setboot [true|false] - */ -int main(int argc, const char * argv[]) { - if (argc < 2) { - fprintf(stderr, "Usage: %s [arguments...]\n", argv[0]); - return 1; - } - /* This is required for launchctl to connect to the right launchd - when executed via AuthorizationExecuteWithPrivileges */ - if (setuid(0) != 0) { - perror("setuid"); - return 2; - } - if (!strcmp(argv[1], "run")) { - if (argc < 3) { - fprintf(stderr, "Usage: %s run [arguments...]\n", argv[0]); - return 1; - } - fprintf(stderr, "Running `%s`", argv[2]); - for (int i=3; i \n", argv[0]); - return 1; - } - BOOL value; - if (!strcmp(argv[3], "yes")) { - value = YES; - } else if (!strcmp(argv[3], "no")) { - value = NO; - } else { - fprintf(stderr, "Unknown boot value: `%s`. Use `yes` or `no`\n", argv[3]); - return 1; - } - return setRunAtBoot([NSString stringWithUTF8String:argv[2]], value)? 0 : 4; - } else { - fprintf(stderr, "Unknown action: %s\n", argv[1]); - return 1; - } -} diff --git a/dev-tools/packaging/preference-pane/helper/setboot.m b/dev-tools/packaging/preference-pane/helper/setboot.m deleted file mode 100644 index 7147c24ac7d9..000000000000 --- a/dev-tools/packaging/preference-pane/helper/setboot.m +++ /dev/null @@ -1,91 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -#import - -static void fail(NSString *msg) { - fprintf(stderr, "%s\n", [msg cStringUsingEncoding:NSUTF8StringEncoding]); -} - -// setRunAtBoot loads a property list for a launch daemon, -// changes the value of the RunAtLoad property, and writes it -// down to disk again. -BOOL setRunAtBoot(NSString* plistPath, BOOL runAtBoot) { - // Mutable property list so it can be changed in-place - NSPropertyListMutabilityOptions opts = NSPropertyListMutableContainersAndLeaves; - NSPropertyListFormat format = 0; - NSError *err = nil; - NSInputStream *input = [[NSInputStream alloc] initWithFileAtPath:plistPath]; - if (input == nil) { - fail(@"Unable to open input file"); - return NO; - } - [input open]; - err = [input streamError]; - if (err != nil) { - fail([NSString stringWithFormat:@"Unable to open input stream. Code=%u `%@`", (unsigned int)[err code], [err localizedDescription]]); - return NO; - } - - NSMutableDictionary *dict = [NSPropertyListSerialization - propertyListWithStream:input - options:opts - format:&format - error:&err]; - if (err != nil) { - fail([NSString stringWithFormat:@"Error reading property list. Code=%u `%@`", (unsigned int)[err code], [err localizedDescription]]); - return NO; - } - [input close]; - NSNumber *curValue = dict[@"RunAtLoad"]; - if (curValue != nil && [curValue boolValue] == runAtBoot) { - fail(@"RunAtLoad setting already has required value"); - return YES; - } - NSNumber *newValue = [NSNumber numberWithBool:runAtBoot]; - [dict setValue:newValue forKey:@"RunAtLoad"]; - - NSOutputStream *output = [NSOutputStream outputStreamToMemory]; - [output open]; - err = [output streamError]; - if (err != nil) { - fail([NSString stringWithFormat:@"Error creating stream. Code=%u `%@`", (unsigned int)[err code], [err localizedDescription]]); - return NO; - } - - [NSPropertyListSerialization writePropertyList:dict - toStream:output - format:format - options:0 - error:&err]; - if (err == nil) { - err = [output streamError]; - } - if (err != nil) { - fail([NSString stringWithFormat:@"Error writing property-list. Code=%u `%@`", (unsigned int)[err code], [err localizedDescription]]); - return NO; - } - [output close]; - - NSData *data = [output propertyForKey:NSStreamDataWrittenToMemoryStreamKey]; - BOOL success = [data writeToFile:plistPath atomically:YES]; - if (!success) { - fail(@"Error overwriting plist file"); - return NO; - } - return YES; -} diff --git a/dev-tools/packaging/preference-pane/magefile.go b/dev-tools/packaging/preference-pane/magefile.go deleted file mode 100644 index 4369fc92da61..000000000000 --- a/dev-tools/packaging/preference-pane/magefile.go +++ /dev/null @@ -1,159 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build mage -// +build mage - -package main - -import ( - "fmt" - "os" - "path/filepath" - - "github.com/magefile/mage/mg" - "github.com/magefile/mage/sh" - "github.com/pkg/errors" - - devtools "github.com/elastic/beats/v7/dev-tools/mage" -) - -var builder = preferencePaneBuilder{ - Project: "beats-preference-pane.xcodeproj", - Configuration: devtools.EnvOr("XCODE_CONFIGURATION", "Release"), - PackageName: "BeatsPrefPane.pkg", - InstallDir: "/Library/PreferencePanes", - Identifier: "co.elastic.beats.preference-pane", - Version: "1.0.0", -} - -// Default specifies the default build target for devtools. -var Default = All - -// All build, sign, and package the Beats Preference Pane. -func All() { mg.SerialDeps(Build, Package) } - -// Build builds the preference pane source using xcodebuild. -func Build() error { return builder.Build() } - -// Package packages the pref pane into BeatsPrefPane.pkg. -func Package() error { return builder.Package() } - -// Clean cleans the build artifacts. -func Clean() error { return sh.Rm("build") } - -// --- preferencePaneBuilder - -type preferencePaneBuilder struct { - Project string - Configuration string - PackageName string - InstallDir string - Identifier string - Version string -} - -func (b preferencePaneBuilder) SigningInfo() *devtools.AppleSigningInfo { - info, err := devtools.GetAppleSigningInfo() - if err != nil { - panic(err) - } - - return info -} - -func (b preferencePaneBuilder) Build() error { - if devtools.IsUpToDate("build/Release/Beats.prefPane/Contents/MacOS/Beats", - "helper", "beats-preference-pane", "beats-preference-pane.xcodeproj") { - fmt.Println(">> Building MacOS Preference Pane (UP-TO-DATE)") - return nil - } - - fmt.Println(">> Building MacOS Preference Pane") - err := sh.Run("xcodebuild", "build", - "-project", b.Project, - "-alltargets", - "-configuration", b.Configuration, - // This disables xcodebuild from attempting to codesign. - // We do that in its own build step. - "CODE_SIGN_IDENTITY=", - "CODE_SIGNING_REQUIRED=NO") - if err != nil { - return err - } - - return b.Sign() -} - -func (b preferencePaneBuilder) Sign() error { - if !b.SigningInfo().Sign { - fmt.Println("Skipping signing of MacOS Preference Pane " + - "(APPLE_SIGNING_ENABLED not set to true)") - return nil - } - - codesign := sh.RunCmd("codesign", "-s", b.SigningInfo().App.ID, "--timestamp") - targets := []string{ - filepath.Join("build", b.Configuration, "Beats.prefPane/Contents/MacOS/helper"), - filepath.Join("build", b.Configuration, "Beats.prefPane"), - } - - fmt.Println(">> Signing MacOS Preference Pane") - for _, target := range targets { - if err := codesign(target); err != nil { - return errors.Wrapf(err, "failed to codesign %v", target) - } - } - return nil -} - -func (b preferencePaneBuilder) Package() error { - output := filepath.Join("build", b.PackageName) - input := filepath.Join("build", b.Configuration, "Beats.prefPane") - - if devtools.IsUpToDate(output, input) { - fmt.Println(">> Packaging MacOS Preference Pane (UP-TO-DATE)") - return nil - } - - fmt.Println(">> Packaging MacOS Preference Pane") - const pkgroot = "build/pkgroot" - installDir := filepath.Join(pkgroot, b.InstallDir, filepath.Base(input)) - if err := os.MkdirAll(installDir, 0755); err != nil { - return err - } - - if err := devtools.Copy(input, installDir); err != nil { - return err - } - - pkgbuild := sh.RunCmd("pkgbuild") - args := []string{ - "--root", pkgroot, - "--identifier", b.Identifier, - "--version", b.Version, - } - if b.SigningInfo().Sign { - args = append(args, "--sign", b.SigningInfo().Installer.ID, "--timestamp") - } else { - fmt.Println("Skipping signing of MacOS " + b.PackageName + - " (APPLE_SIGNING_ENABLED not set to true)") - } - args = append(args, output) - - return pkgbuild(args...) -} diff --git a/dev-tools/packaging/templates/darwin/README.html.tmpl b/dev-tools/packaging/templates/darwin/README.html.tmpl deleted file mode 100644 index 5ba3970f55ce..000000000000 --- a/dev-tools/packaging/templates/darwin/README.html.tmpl +++ /dev/null @@ -1,36 +0,0 @@ - - - {{.BeatName | title}} {{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}} README - - -

{{.BeatName | title}} {{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}

- -

{{.Description}}

- -

Getting Started

- -

To get started with {{.BeatName | title}}, you need to set up Elasticsearch on -your localhost first. After that, start {{.BeatName | title}} with:

- -
 ./{{.BeatName}} -c {{.BeatName}}.yml -e
-
- -

This will start {{.BeatName | title }} and send the data to your Elasticsearch -instance. To load the dashboards for {{.BeatName | title}} into Kibana, run:

- -
./{{.BeatName}} setup -e
-
- -

For further steps visit the -Quick start guide.

- -

Documentation

- -

Visit Elastic.co Docs -for the full {{.BeatName | title}} documentation.

- -

Release notes

- -

https://www.elastic.co/guide/en/beats/libbeat/{{ beat_doc_branch }}/release-notes-{{.Version}}.html

- - diff --git a/dev-tools/packaging/templates/darwin/component.plist.tmpl b/dev-tools/packaging/templates/darwin/component.plist.tmpl deleted file mode 100644 index 5dd5da85fdbd..000000000000 --- a/dev-tools/packaging/templates/darwin/component.plist.tmpl +++ /dev/null @@ -1,5 +0,0 @@ - - - - - diff --git a/dev-tools/packaging/templates/darwin/distribution.plist.tmpl b/dev-tools/packaging/templates/darwin/distribution.plist.tmpl deleted file mode 100644 index 2224a2fee7d4..000000000000 --- a/dev-tools/packaging/templates/darwin/distribution.plist.tmpl +++ /dev/null @@ -1,25 +0,0 @@ - - - - - - - - - - - - - - - - - - - - internal-{{.Name}}-{{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}{{if .OS}}-{{.OS}}{{end}}{{if .Arch}}-{{.Arch}}{{end}}.pkg - - - {{.BeatName | title}} {{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}} - BeatsPrefPane.pkg - diff --git a/dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/Info.plist.tmpl b/dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/Info.plist.tmpl deleted file mode 100644 index 3378695b502d..000000000000 --- a/dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/Info.plist.tmpl +++ /dev/null @@ -1,26 +0,0 @@ - - - - - CFBundleDevelopmentRegion - English - CFBundleExecutable - uninstall.sh - CFBundleIdentifier - {{.identifier}}.uninstaller - CFBundleInfoDictionaryVersion - 6.0 - CFBundleName - Uninstaller - CFBundlePackageType - APPL - CFBundleShortVersionString - {{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}} - CFBundleVersion - {{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}} - LSMinimumSystemVersion - {{.min_supported_osx_version}} - CFBundleIconFile - uninstaller.icns - - diff --git a/dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/MacOS/uninstall.sh.tmpl b/dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/MacOS/uninstall.sh.tmpl deleted file mode 100644 index 1b95a66eace6..000000000000 --- a/dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/MacOS/uninstall.sh.tmpl +++ /dev/null @@ -1,65 +0,0 @@ -#!/bin/bash - -GUI_APP=Finder -IDENTIFIER="{{.identifier}}" - -dialog() { - ICON="$1" - shift - osascript -e "tell app \"$GUI_APP\" to activate" \ - -e "tell app \"$GUI_APP\" to display dialog \"$@\" \ - buttons \"Close\" default button 1 \ - with icon $ICON" -} - -die() { - echo "error: $@" >&2 - dialog stop "$@" - exit 1 -} - -if [ "$(id -u)" -ne 0 ]; then - cmd=$(printf "%q" "$0") - osascript -- - "$cmd" < /dev/null || die "{{.BeatName}} not installed" - -for key in volume location -do - EXP="^$key: " - VAL=$(pkgutil --pkg-info "$IDENTIFIER" | grep "$EXP" | sed "s/$EXP//") - eval $key=\$VAL -done - -BASE="$volume$location" - -test -d "$BASE" || die "Resolved base directory '$BASE' doesn't exist" - -pushd "$BASE" -pkgutil --only-files --files "$IDENTIFIER" | tr '\n' '\0' | xargs -0 -n 1 rm -pkgutil --only-dirs --files "$IDENTIFIER" | sort -r | tr '\n' '\0' | xargs -0 -n 1 rmdir -popd - -pkgutil --forget "$IDENTIFIER" || die "Failed to remove the package from the database" - -# Cleanup runtime files like 'data/' and 'logs/' -BEAT_DIR="{{.install_path}}/{{.Vendor}}/{{.BeatName}}" -if [ -d "$BEAT_DIR" -a -n "{{.BeatName}}" -a -n "{{.Vendor}}" ]; then - rm -rf "$BEAT_DIR" -fi - -dialog note '{{.BeatName | title}} successfully uninstalled' diff --git a/dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/Resources/uninstaller.icns b/dev-tools/packaging/templates/darwin/dmg/Uninstall.app/Contents/Resources/uninstaller.icns deleted file mode 100644 index 5d941bf603c5f6e8764cdf7b38e44350f882aa73..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 115364 zcmY&=bzIZm_y0BrY?Pxh87-2M3L+Dckd$taMnI76ZGei>jUb_bNQZQ7C=y}-B3&xd z-8p`j_ou$UKX?Fp#Xa}L^E~gl=g!gkkp~3&A=lAbZx`nw5DY{`;kK?Xba@>4%3SZ|)X8kqs!4#J zc2aJ@fL8ahLtL|B(#h}?<4HdW-9Sq}w ztS>ScGrHo1Tqe?9V+V@kzD%7TuCQ$m+zBK3N~I65;~+2!%2>$7xmJGoJ-Rj8YsGZ@ zF>`-7@rr)v4KF9jwD`EdW`i(g3d=u8wnQoCLXa4a#wbNzQ=&}o+T(Gt zHJvW|;Hw7JvY#gKVY^qpDxvW}V&sx|+R`hcVl(5qMn!1R^uln=4VFv55Eub6Wr)?V zp!n5KF#oRCV|?e{YbV#rC0S9(D?#wF;G#VFTVMD+77^ja2O-#`ra+U@l{Jm4Hm4JS zF`%J{$oLQxLLFU}KzD4)%hOu+I*g?Nlpa@MTb~@kj`K=cT!krWrwpLEi(HuT&RM z;g#WEgw)|JSC6YL;+)>DMCabSdK-do19EYdb~}i`$f%Zj=AV_ZBpfyfWVO^zl^D`N z;o9sNSnP{OJe`SD&Oi4E0z4-)%@ntNJ_{n)pzsOiPBb0@`$kpuFzf^k{G)j3h{4Fk z;F_@S{JT_UXAu~>pT)+9|jrCp>1cqSb#=x`~S@=1p zUSX=uMfdJjR1*e2!q~ioq+#+9{57&VN=vo#w=n1@uy&HJtMt~5W~OyEZB|)!&e*Ha zoqsIBj7P$Y_p=QTUtMP2Ybq{33QEOA#Ly{MLQe3!^}7x-uwMvqT6Mmr^2G=H6Ek;z z>E12?f;j?x-rI$2bD}KpI$Y^k<6ZKjvpeK%wFwUAV0pmR6R&o7BXaK$WmMK&Z5|9h zH2NvQdx@Qa8#a$ZLzR`}z+ZnUUlq)f-{dTkE)%Fl*8uPGMZ`kda@ZWmU@9mFW`3VJ zcKqnHl1X}ekL5@>1ZGVY3yF03$P2Vuh-=nw2*C2z`ecYKbTmDOz@DGJS3#;*8E(a6 z`32TB^vu(h=ylEM+*e><7;sz4Fe?c->bi2aq9&?IWmUxY{n+7~TlU~8*QxajY907t z>x_FvE z*23R9UYGl!N_Ns;QXWnYl>)`iO^WAfYxY}J9<#pGk{WAiMdI{cX)2|zbS%3>Mr8jE^?;ULQ-_;-@xG*5@p&1Gc zbjqbTS(O6{wgj05W*#YW<7iwu2Wym&vWrO-5Z6R$?p8$m>_8F*-U67pLK zeI8$6H9hDaFk8^8t0V|i7zZ3vK|U}V0)rxly5i$3It$fj;kxKgXdLDoc%ki71t0J+ z!5;L$kwOBFDq!vbH(F2#bz@=DAK4vJqouOQ> zfp^Ng8B5IjQ}W3kOe_;j%(o^n5(4`}HN8cG`gC4Om%C1S82ADLdjRYn_WIsS;8^c4 z)u~5kr+1?4SsI{=Ku01#l-BFolrTi1kQVRDFS70(Z*}eohX~SPvJJt2R-X((5Pm>8 zFj@x}Zo&nSIc}d7Aox&V0$Rymmw=ffF`GR%p{G%0TbQp8?*ma2TT0?FhW{24Q70GM z{d`tRJu2XiBO6SG1^AHv*}h=-7{hhlgRe2u6D&?+R8irm@E9O|;6X?-8b@q|<#(+d zjBbhE-dr)cc?W_=gRw&Ta|Pfiga)xQsj_m>HH1Gl9)+>213Gr2$pq-t1dj|2CR(8)mHiY4arPfi87$Svt{3}0Nk217)0VqhY)v~0jo#bhKyeU}E2 z0m0nI|I1Q92{5Qri=bR!&;i_O{qzwI@CYTPD|o~T{#F%BvY`KAeEtO{62zKS|2c6o zAQxRZ%bad2R{L|Zb0{VasJCzIuq_%V1H%f-&801BTvrIe>;aK}UC=oLLxc(UpwH~2 z|1!8k1Ez|BO=(!rBVmp#*RzaZKS)eyk`;LMi(V@;I4Zmz*L=HWP(pAfD%TIu1{98F z9>;J3=SAZk6b3Z3s$tY7hJhi#T;>fdm=JOQdi7ndn$iAYr1{^xKY z1lr9l{)l9O!k<#5I-Ta4r-Y9l@IK(9vB{Y{8mD7s-);zy6CI&wdWKsB0+#NItOEh} zVC|+-B+9@S|3hCK<`=A^yHLG@sYTj}W9lgciMw#D%m`2|8fPnvxe@4`t_H-g*||`n z2*G2>z9{|8EIq(P{hBuT>9r|raju8TW`kL!}WE?n*Jehku!y|@QJ>PPMKY_%_ z=-SSVKu;Cp%vPKo;7^GN@M1c26M#xaD#IHlr+J2v3g!ReRDb=$VW)^gX=7_S^^u|U z6D8t08Uvfc@Y2J89rMQGwTr{=Mb0w4y$=CCC{9&56uxGLzX7QreB#x45CJ!U(YxmPjg3$9eVk=6$e0E6J)00`Nj*9S z=ZB{X`|%SF6vmAZf9@$H^gu@PHhKpsr?rbvz)cLN>Ov=fUxLRA1NS?+#RX6TVKC)Zzxyf8tti{`{|aRU zGaA;z>Q<(yInkv8cd)eL8~{F2MP;*e&5;)!ybHt{Th!qIflVY6HKk;&<0I2I2I1Q$ zi#Z0Gf&l)p8&V++L*#1XWFZAh-nF4TP`5_xb6O}ogf5lOr+MU}+Wo{3 z%uVph-@Rw6U{H`bdvs*wR@8HY5R3qDwIZ1pfy?=mRoa>Rhw{3!fH|2i=~;onQSgl= zDB^Y!2R|>k??%8w;Q3rgLos2MuX!a1H7<|~;!s(fV1eX{{Bi~cO#y?LE~r}pBtel0 zJcG#h=grN5*S(R-R|Lk)#l1}FwEN)zZwGXb^~}>+IxuNESky+w;048|4plfkKTzFJ zY0fVYNcEUI!N${G+UziP5a(fV)d~;**%*SFm&jH5dj-In_hd550fce^Wt_6`$G{Q7 zt;>3NfFtDNDwd$(_TPI7>48Z1FxIDOu>i*eXmiz~8Ff0G_{p3b+=x&jy3t~;mnRw{ zfpzb_)8U07xO9l|5U%%s9JU>Rc5@2WE(7ltNyEh*^iIsk!s9`B#I~8|d#Gp^KdH5XocV9S^ghF7yD9b6(rWW^Nv;b4}3a_x%_QypL%vMJOnIG5%=QVL9Qf&CBxBV&99PC zD*r*?zf`R3&?^>k^i}{mQ3=u6fQ&(DN zJ|{iWz(`5B@$*G9J*@E0z#XofiBSjPY75gpO#y#}o~gp7+*j!@0LT)E<%S{*6MtX* zpA+UHZI&*mIEgOb{qNfGpAZCkrbu7YkO$_VA9*Z(0Sdp$E}{(6LV7Py-vtU})Tg`) zfl`p|eBKxyr)|Hh%*O=K!?A-w5|Cv+%Nrz%T-Krvkh9P;mlQUEvUp(a&fzMm4&*TW zDNp;L%nrP;30EzAgN+mV_8z!VZ(O|`xI!iFns7>!-~|rU9pFi<-jwRVQmmAQA1{M{ zsMN0lE}!iwQv=0r3`7?KmGB1CS5%Gst?rB zk7PXz6L6Z$YN$hAX95vdFlQG6K97fQ*mNzbkg2CMMrke@^(8_Y=d^VX^ViJZiuX^@(E!OU%VF zn0OG1@%<)M0M6eqbk43ul!`u-NBe`9&V4NaRfFHc<(mEnY|&UTM|M~q$Y_a=I+B6y zONqkM44VOCG%=kh6gzav1Q-Mn$ymNKsnqhx32q8%C~hT6&q0KLW@1f@JbqmNq+AyE z_%tB}ob9~@)T&QRrLf&!TJF`q=YmiG$pY1ULjnMB6WP!)+bZd`7ZjKf4p+GbMhhoq z@5gb*p~zu>KoCZDe|!c4QxtDMy--8L7xB_f=PCf1zGzYzHtDVyq7By4ia`c-WPB$fIcawgFe-Z7tX=Jz-4CvkjSa5?BOU$}EQ%TM`7<__m9&48rFd6xvkX8UEAiic;TZli4g z%7;;_fw~IXN^Dp?NWCQEaD;YwSi)81ICD6{ep@4Rf|)Zts4qQ(eel~DOO9kOBU~PM zGa@PF11K@6L9J`f_Di@9$U;)qC5wln-U z50U*}gcvOd8_?)lp1fxJ`GDfnVZLfvrggd9_ocfs;_RtSPOa-obI2E7ac+hWcClPN zy7at2$hHD02T%~BW|6)aq^&AUzOZ~-)6OVFvbO{J% z$7R3Yia?F+OCw@F>tYv@&82GX7nbT*!(9H-*B6GGoV1+zkWh8X1a$n*-V*e4$v4C=BiyZ*?7(*TW|(# z3928VfZ?KJdGIYNQDy-%RT*WwH%RtkBKs2c`}|lwDbo0~_&F3m3{*29lV<=TB@w%4 zU+q+qn;v`j{D?|Du~z%aCMq?)w!0y0k@@l}b%=U3fV9HKtSLI>6pW_MpSM9j@-yAF z`W1PMI8VM(>o&)OH(Ml|w21!A_VPUg?Et89aZ&37AV3vl=0TI^E^Pf+e~T)8Z$;qCM}1lF7%&3tK`sgaNh48p_En3@sNs@ekBOHn(LimSC_T>UW;AB~ z|5G~-vW9$d!icP``)dM8>3Q#$L0Oobh}7g7fBj!4rI<>XD|_s9;8<;5=V$=Kvm!J1 zo19PgN_VapjjANwXrIBR)bBsV&M36r_w?nz56t>}LFhbKqsjxga&?2g8`Xe7Z)$BP#4nx0PBVB1)} zz??WBT_d0E4tsEGix0rhvPBOzu zZG@1Vn{BL{7wYGW2AP`3_&HE-fZD_B7^5JtUgT2xaD%z#QGlzbM6z~5iA4KEt`2gN zM{2^*;vN!IXtcnfw^g)(5_Q$kSzot`36_pYlG%MgM4N0Kq=l2{AzMQFiDU5X3+41M zc7P~hxO;Jcp_dR0{6`b%$K{KMquG53#h zq5+m60oU;AyijG!{9YS4%2(C$n48VF^}N_eva?Qq38_0>KHWZ~*R4-{!`Vq-GV80H z#vt$HAUrSC&i%?%iOP@MxbHqG>i&AZ`}p3Y!`Xr^nvi7PQ$ENidsl`IGj$1{`L|)c-xG7kYA6U>!hXxJ6bE2XISGV(QUB_qR!*cJZiM;}3E& zABL7V-TxRc^WLOQW3vWxX7!;}2aGI~%v}0piGt!`;rP)u*0OGy$NF;YXiIP(-gT1_ zZwaC}RocLf#O@QudhVnpE!RVE|HtW7hc!uS7(~ z$VPx{@A~)!az7P}qB2Z-lLjHDMUPvHDgd1RGs^eZ2an6W=T4#pbHb-x9)98P6W#8= ze||zV5q@;g(Gjz8&Xrv&5qRQ#(_&CLzEA0yS-$tWd08x8`a8Bu*ZbjOdc$MyNSJZk z-0_)}6J!b^8rnAc1OyA?Oq(%qunJ=4&dcvE!QX!~aF*6={InHy%Ju70cr2xQ>%_w- zXt3$CR4Ox<9p$AGM`$XB=zvBiim^u6Ko1#UPz~F(S_&WG`7U{#x^1{SIWxNm#dd+TxM>`&axYLpRn#z?QhEt zCY#Zc<(^hhna0&(5p4#R$9ZhNx%ma_iF-97)5&^+HwCt7TGc&mrg`dDGk2ekJ$&H< zHZh2J4K6r5{_5Iqij)b0>qw$l{0Ip$(%kJ`#YTs@@iF2Z9luZ4@k!yXLUlgBZW(r*-^5 z7J3K_$soc*AjO}(S?-~6IE-}iEC2d6)l1ZNVZN2wALFQ+d;gKl)FpGYh#FXcu##(n zg_J2Yy=$w?EcjPWK)$B>_z{WI=Fr(hNh5M%gm>((yV3C_~XhkpIwDr=5Q(25~}~MBJsaq zp+EHk1_HO@CwHa#uc2&3zjsHTyPvsd$URV;XhCw{SiAM>wEPrE0Z5fDo-~rS>{MD` z<&j;(Q>QvE@A5eHN&4lCm0Eo#)#`Z7Z6 z$KswlxOGNVC8S?Y7)c{zHxTn*A28)9THXKAD>pqZ4p>=k#o+UEcm#awfRvKiyzsk8 zW7Fg%R5*k+qL3rqPyelYjQik;!`DXhQv^^v#O?N-mML0p@mj&FptaYb4+0Q_zrzbk8>&>)6(ES`QAV7lhF9s zXuq%fr}K2*Ur3GK@SyE|`-z|Zd>XEE>}rugfB{!|t}bxuyi1xx2sn4Sb?d9i(&pc9 z+5?3G9JFkuwZGxaH){1n?e3}lxgq~$;)LNxO>Z#*pfLyLEhXHP$#=Pmfz5Zn=|@cO zWUXLnyWvAq|E|e9+7>=)1*1xpX67Wd;NzSh90d{gtbpcFjY6+)Bibx1%WLcgNBD*P zZ5H2rY_cA`ulbMxn{B$o=a}&;gNknTlMG{QSD=Z0Nny0l9Y-@(;1v(vY4gBnsg_Yn)t@@r%fi4af{WU-pM&Eiw4{SD*1Ai*?YK!xdoLy3tyNrkFP!cBK*$Eskv-y%|xn?q=>xGJ}zU%FQNh zqBxjfvD0#7sV7NltmYrOP*X8~+tK-YV~F~dl85};@f8+7qJ;TMAT{^iKms7~Lrzua z@bBQBR&1*Z1h14Jw`5wUq{vRB0z+{UnKribhRO;{rLud!X{wbZz|uCQpT z3kT~0TdFO|enJcBBimA6T{pA60(EG?d-qz`jHrJ?FGCxHbPhK5?B}|__@u& zBhOdmVHosvd{BvwdEoj7j|PguqCY{${%-6kCfZppuGrfPi!3Q7TFy06l@`u3C?o%0 zixrLxG|0QS1jwBSd0OyzZV^MX>e;`$S^HZnJLe{HMUKp_lpikj^TjMqVg2z%yw(z{ zVVLw2ewQUS-kjE|O5M|fnrw18RU~7Z-*@n*O z#h*KxJQ(;%(ejl)1wM3UO52s53Py&QF7h}uzqPx?>+|)|E;*?XCix)g7wqMi2=9rp z`S>o4%cPpn?Pdkh;B*eVQG?Dq|DwlSTEz2WJzht@l`JeO z9WrlaB@t1-2d0B%JlfAYI!oVrL=#ag+n&i~Z*inxvwi&{CshS^z!3NN6q_meT{~ja^id4eNYGr`70FBL*%iNTT{?Ok)ZHFlZPAy{b|LD;Zag3H@;`e< z8U?tob_eDbO>13)F(%jj${VDEcysUmT&1De9j>W)pHnErzD+%6i+}dHo~0!@cBk(P z5?EgZielpgd&a8+O&R%F<-v!qqI0&jZ`rL-z1KPK`ND$yq&LjNik$F{Eikz1te>zS zP>Hg6R`2gbgs;@xu>aOCry8M~O%1iLA3cAn{^7FsWTPwri}DXpXc)Df-)O$gsCX`k zY3l4f+v9>u_%ra0`Y}=o)!Cq#sGPIkwEW(jv770c((&r}jIdXHAW-I=*X_&fLUu+hYrd9ipg!8BTGpyKDigsc76-`WH# zX+Bqt1P@{V+*EZ#so+zCpE7X@vZnXDK3-KNqrubcGTybCS<+f&%~~ICcC~6HFlpZj z_4&XSimhl)?g|Kig6(6kh~We9sL`{Yi%RgwuGRG3gToRffuTw#Zxd^5P=?ghpbUKm z)dRzf=~*bxK3_e5fLFIsrRQ)>ysG8L7gXgG*}u&&XG~G7?+S+NYn#13u0+?EHQHDI z+!B|#SemkUsi4B|#PBz_h-JQppPKR8wQf+eDCqsDpVjmAsl39) zWz>`e<@65SLGB4Ff4NQV?Hf%x~OpHY`^aEPd?9Gn*M>M zRTt->NwI?0wPlWdmKHkA=N#S@U4B>asONTY1MS8Si7hhM6Axwf>etS_V#mA6>Vl!z zSPQ)AOpftIBqsJPU9zqF$!_;|B||nnc2p+rnj*!Dv$>jnjOIdBUi|wBk855BO}F_6 zW(5iuI#Ugnif{bXHk07@s(5y(JWg)z5^Q!J>!W5&SL22FJ4+7AmG2Xb!2Skw7w$fs zzqEAYnTllhO{xc5rAas3Pc$_K->^~V_Nl{S_(sGCsd*^pkmSPT>gIhCSl?H>Ohyk z1Ip>5y9ej*l6$&$LxVEQPNIt!#smi%^Pd#3q?a)ztOr{zJg*;^JDkDI_^uAUW}w)< zRyMnA=fCwW<} zc(csK*U)*#y#C?Li1O$!Lt8FLwAYnir^VzZ7w15X-Itp>9bB}I$v^fdRu?Duqz@~wdon-Zfp!jXURUm-k^3I0ozFG&FaO7I_`4ynB9}x=PykD z(Kn=1{85%*yy6<<2Y9Ve|WPsI2e1Yc99u`+Wy*slAu8Q&dbvLV*O*R5`W`qZFJ zj>PfHs$4v6QoDEO_>6QuL292mWsj+EcHqKR{sO_V!Gxe+8@{&}#O@Mlb;)TP{mh78 z(j%csWK+@T0r{JElHa_*MoGPo1K44rW)P8CiX2GU(g^0I4M@nhM*8xuEHC>y?UD=^ zbGL)|C+g3f1?gJ2>zVznG<|YSCDNDk|reME+2o& z@|j8{4dKc6yY#z8O}IuYI9#3~z=Hqi{C#GypC#Di#H${xYi#m;O5kMO!E0(#Y_`Pu z&~f~e++|JnEThpf51OO&)Qqf@zY#mkl`4IM?Eh|TGG*#aW$~1rES~tVt7ULUKt^cQ zphaqJS3UUf;HXkH7b2@8|DCB$wTxr0SRku;+!jR-NeM_9LMgu`X7@|ow2`rEG2jjC zb(}GzrC+oAy-7|oZ;p(yIHFjGZ#+$Evib7e>tWZT&3@H4%;!iWb}q=ZMO0cSrjSf+ zMq*UbBc^|lE#u*{ijePv;Y+WIQr70hn*{D7=R808H~ujt{czu3V#z5Kf8oDHr2D5S z^f8p*tNQE^*=GK=y_f-(gM9x%c8*bI@J~C#N`SxInHxIf+Y|62Y3!Av5+A`l1}Y?u zVO$x7;4&gMEseK+_x{p19~foc*zS(Q`5co5ti5~)muKw@a&bONA*z3)N|!f|OBb&W z$7V0gpfFnTiD1k06Q$?kO;QZ_$zKpI=2E+9;T-t4L@rxS+(*ziU?X$mh1H@K+&tDf z*eL!ifOd4^D%lgzT2cqAU()ejdF3MNF=Iqc;>>M&dFcI}VK|sE^aPQX+I-V$uAKN; zz4r49n+at+9BnswB`p*;3Y(#kaT($Co;doGSLk0eT9J%0EBn?Z!PQ|CIYA`qBB%2j4(Md;SM*0G zf|)z^JLX%0#5_|@=$1Cvo^{s8L{=%=P1S;iNNkjeGZ*CXBHc(R#vML!dC%Up++*g| z)t`Fr<9}>XR(ZylZ`YOG;UD1dFzn;DhzM`RP{_h!HN>G|vu z3?81_qgoJM6~NA{3x{9j<`+yzGK+a$aujy%|8gT2FCOYjSq>U!0TD(sq;Y zYcxoHb*huua$jp*@cg7+MTQtku+bZ&^0#mORN249SbqCT5%9{>y=o#Ev{Cb+)9T=j zLz!p6>x2DsUQPl}kaMm@%l^NmLa`4_=S>&2{H!<0>+@AzcMV@Y`B#eEcXX*JKiz5@3`In?6OF?a+Cq<*@DlN>DSDkxqWan7?yG!FYU#!IU zVaF0e1r_Z}p^_ind$We}g~%*_~V788q257TS!km~3mgTdl2gEF*i-EgWq1GV3`FpFt&w zZ=+GXP}fY->+z#apW%9cMY&L{U-O@gwOT!jlbcxW?ohSOfd*bnLUGcCto{Oy9HXH# zs3@^&&_szpKH&f3D3j+^Dc(Q7JZp3N;`zS{7nWn8%p9}9kstk_1>$wlXfx8uvechiN<76(ToXD7{E7jk^It=D4YrN_N|cWLXI zH}BRr{5cRo17$qDYRiGjBxX-M@`-YB9^n-Hs-!HG&q=463p-QoU!Rp?|G3^FcV)gr zKsdCXdn4|gQwWdcSxnEH#Alc_nCn9I0iia5helcF2gjwY6u1Q$H#1Lm%Kq|Ac>~)u z;V%)@FjS8T^6VII(UO|cqXXEL)eMe*cYIaQ4GGm3vbfy2QzkB1Gp`c(>|u8uQuAVi z{j$ooBy`&v=AHro++7>YwF7yMa`mbpDxOoh)&Qnnh%w^ykj5 zJf=_juaQfxO!KakCBBr3mVwasx-GTy-={g>w@8!xpI|@VfIKm&;DNOwSceOFmztd~ zTsX+BD7eEryUsKHAj@5(;a8%lR({9vwm-Ik@1n&$K{et%^M_&)f8%RrsYWf2s=;Ea z}}=e`kolZqb;}VPNF|n zI&g6Y?Niu1$vj*BfjaR5KN3?P;v7Sa#my%cI_Iyntk!IA|CH|e9=otme-P)>p1K>u zT>xwJqM-S4#8bUH=2V+hP+7icPP26Ums|;^Rf-Gn^EHQn2i$ImgaBs=C8t3Fco^%DvN}lHFL!v zxv6BRnVi;t@#CA@ZE`$ENS2p77`7BmreA!Q4Zs-9qc0DE+LLWa-?wp1 zc>jyea0I@zU-|G)qWl{k=oN+MUZA1I4FB5VWL{?TBz5L$2Gi*HqirjhhuT+HeNyNW zj_ufGRbg7;^oyW|mjgTCEw3H!9crgtY&s{gF<1X%dX!gE<|W)Wl)y4-JzM?RsKh^5 zX(YL+SxsM7>X(Wj*n&T_LJ7kVP5iMRtWPGUu)Fg*xk66U)|(3%s<5Nh$%v9`_R}5q zYU%*9)KhpUZ=aB8-r<2~(kxM4t4 zapj*C5*oTj;JyiVcpKn5{syWy0#ShquF;ZvhedUlR{5Od zg4Q|{%k0~2jYq;{s_dbJ@3C!M*|Dd02C3jOglb)H4#!}p0kJwoUmWfb79cYgbDvYd zZf*B=d?K7tZ0~SAPY5Y8vwAe7bSoYb$@mL&lGX`YZhtqQ3^P#Xp2!B{o|Q(bVE94_ zY!-#_5bJNTOy2$DW?T@GREQGj7kGxLJ?tQLpF27hzWpiz=T455YhmPu8X5I(pOahp z6~hJjDB%khp(|9LnjX^aXmTvum1q?V>hygN<8e)~kiCp=oS=n44};yL9+18e7#m86 zVa(@3cb-m!Nd=emDd#Jaco}kHLIn5K3HOW_UTg4M#^v*gLd%agPW3fR+>-_>C88bvBIw?AojbT?V!c!sDf9 zt+rMcX1_19dAlVk!``qS1xd*v-L`~6l=dJ0?`1U@Y(o3&#L7u^Ui9?S)vLi zF_dt2FI0WJGWa|0q%T9s_2HC^g^Z6c=D+i%T-uF3X{?Ez8C;;VHTVl#5P&jn3l zJ(9iiy-&=`y~`lzk+13h?!SI>Uo$Tr=Q{t@rwK1T_oP+Mp|`eMY^V4acLIcZaOwt7 z0$=Q4xndUe*O$J>TvIZ1E6BaNi9p^tE?lczTbYfyv2AtGth6CL4pqW;9tyYO=#k;( zp+VN3GpAoejz7uhKfQ5mwWEhm#MQZFtn3M#m@)-AyvCU3Tpvr-(8X~}AT8I}dgC56 zi|?x*zfpk%B2Tqth9~*^SYP0-%;knslX5(*3|);p-dKnual);qw&52s{QJn+S|K?R z41kTKrCxUVvBIJbn^Ii^yU&j(uV3HSe0_;&7hEOuWKz4!rYB)1Z;JDwK$)a8@d*UB z&M=qGNRYfc^rnsnj6fHRRMh{OK_CW1z%99`!MQl1ARbR%`7-5oO^$&9#e3ZR(uOip{*_|RyKMJ43`q!jdeeGFc;VfExyj?@_$)Q{bDCJ6Q z8S}7rRYY9UB^_>!5B!b2cNvL~PLSpPhb(TiM7UxgSo9;A-S)^ae|KIGc+sC7L%Ur( zUXP0Hv7nQRqyc0?c=bX1Oc*7#f={v^{S#9)80!($5s#e>5{bd<7lW>HBqM9j9f-gm z%DP0j$X?9oPl{lNX=Sj@s^SaODunc%g_NsZnUbe>E1DqRPw>yfvrwtB!|ceB7(VeuM$TN zDC$`>p7 zP|*A_^$PMHl01?ZOutrE=9OZs;4pe^kK(pdC8#=G*CszTPc|+E9(c5Vi9Y|-Y2OK_ zNq}ocr@a|%S~#Z|8nA|>1*em6POytG#2ckQu|OFVy$K(?Ezkbz z+|p@hBKs6C^h6);0c$!(s{4kGjOP2}LJLjAcf19=-=Mvi$}oC5EJO{4qT~l_VBoh% z-`cY++qum3b}Kz4)0{Lbe>NBYCNrdcayp~x1`1@YM%wg191UDn^li`Qa(gHD$;h#U z<193CjSuE8u9mFttP7Csbs0XYZF{h`YYnb(hxk@WvM5|j1RLRCqM1PNllrg6 zN!E`3D!AIf1C>W4vE=&?R^L-(i|`JB-q|opH$--Sbi^M3cpow$7H?iD$#mX;{N1Y% z1jCyUK}Tla?Z=moj(wG3fzRpLqPF58i4GlhAQT|b1WgR*pPy}9)T94>=Nt zpby;bpFZ$#jGYKOO_Y*Yg81H{6&JKcAugtU1yF##$e(~hsDMd6+0mz`z{*L+gK@)^ zoV-Cx!mm$-;MF2{HH#1DO<&IN_^s`JIvrV_ZJC)KCtqTC77CB&jpc-CiFOD6Dt0?!L@gcES}elP z4SowqD!_G2{c-_*sz6Mq?sV6L5Ty98?VWTN9X@-zvOS9Wd5KJJf2XQ-@S01x=E+XZ z@=hk$xq(v&1Hie4S0h+MlP+s;Q=Bx-JeVNF$hL6y$wJNPiJ3UM$#a|;6Ea*7PE%jd zN*s;Ur8ypYEb#94$1eS;_FE)jtn1V+%c;uZWA76GQN?)AT z$WKf-0XcF2>05z*N>z96vB+kuffy3=M z835Kzwp2h5?qKZ9+eKkaDX@gyQw3jP`G8bf5M3Ndz`beVA zipg88ldG@paYJig4GDl;d~W!vs(Os;e=`Kt^+0R1>l#5&ad1E7@Gb}Pih*0?a!EaQ zkN1BGvftH9R1&*(GB?)H`TK%vd{*}P+w`c!>2i0``+txwONTx5PXlG93) zo-h!n6_cjRo#NTA$gIu?m`5all$*Z;C`_+4YD7D@uif$+*y(2S!2TWek6D7UmbQAF zQY&Js3O;lEr*QY>5uro!51NnOTm&rVw`D?^^;htP0W7EA1rVk}ye!c)g_p8DzRdfb zkXa70@GsgVRW7D1Z({<}XjB}Z(D!EVGsa(9-+5C2DH6V_Pa#Xw1hiR zi6Vj5Em{GaN8aXv762wv7dbY4NQ342&)hAtSJY>%sX3700Bd|qQ7V{+pHoGUsC!@n-t`5+G>>}cbz%x3a8jwj;;#cz%M=gKbzL*a z2qa}Yodk)k#=$M?$iD+1lZ8d4OAN4@jxxvX`Kn;zDX>|tO{&qnS=>|ai&m}>m^53adJnN=wj@jX=iQj+e?L581K`809 z+IMqEna49;s1OZ_#Ny*iA3M@I*|_z6>8Qz7bRZ}0=Wg!es9Z996|e|tGH*fDyo-j} zQUuRmn~aGq9$K-ZC-~KIp5ex#$<4+ek1J=PPtSSeoA$OG;dT}MS})`7Yx#nZ*5;a8 zCR6UMhXjAWm47Cu2rP7RYI#p*k$J%Dz2*@t7qhDj6Un5_Vn1d56Mu0M0b?-<2ptZ~ zV4iM!S79zd4doLJK}Y@=GwTS|ly|s73JjXlSjl4$)X<}>0-;Q@I$d2DpmU_|buW8K z-QrMvhO0i?xnDA|T|x#{P-NFCK+3x=+;fz+$xfgB1E%jx()pwS&XxRgbPCr9dubjw zVz$z*Wb=rMH6X=QV)n092p9B{<`I=z@TcXy@NY~|{^6ra?NE@#^rDylSyR4RfxZ)T5MuJ72^WCEc4SVA^Qtc3 z*hhi8GqCt0D(dko%HNTex54>fyO`p|E53bMz4D+7T>S|^SO_#H^n`1Md@2H^1GO$o zV0v3Db14qeR^{pl_AuHo*>=w+crAUX&&xBQu4ATBDx0kTLRS;lLg3kOaY;bn7?Emy z46yFQ*GU`#@-$||&h*OC;}G-$I}{-wCweL&bX5xz;ggv(VUbLRzej1<{L|HI=8L<} z@gX}{DA9uzCHU3=@!hJn|y(1M^*ziq9KKq@K5)Z_~;b>|-a7Z0m zOLo2{ynp@%Q~(in)$&ndkxc2?B1-yyig~BL=Fm4vZm{Ypqxh!i6|TakJ83zK>OB-R z{w!#N(?)fIJ;e!dzh`hm6hfPr+F`R_e3r~;+QBvs68ZK+z-epZYnaYJgv}W_xuTvC zqwli#l<5~WIys04IGWOS0T`&3%y{61&F2Q;h|yaL2HCh_jvu2e5$kWWsIfrFld0#y z1ihfE!t>%8*-p)dA-qCS z|31VBzFB}}Egq+@4ioij4n{W((5|HCcH=!dBJoU%X0dhD*yhr2TZmbG=sT^R3Xs3*FoXDF~GK`1CHsBACM}~ z-1>7@nha3kWS_8GU7GB57h(UZ!9ei6WKB9G0=wS+T?!h~$3a5nAFFXHw;yY@zL|>9 zj8VCeb0o?nZs--=7u%=j?SB0~w!S(bimvT@S(fe)0YO%z6e&eXWdV^6r5i;A1qqeT zRRKi>q>;8jTDn9^M3j<{ZbiDgzB9ACzR&x--#_;)GiT1Z@^{5KGmC7L74f`ZamIWj z{oYRS2KAv`*OXz)PWI$)k+nh$7ukqu(g?W4VE zUmfK{O2&+&HeV};)GaN{U5GQ~HgIDu<`m>NteLgXYg4Ssviu-<#bBg9`^dYQkDQ=s zplYS_X#f41!G3h2zn`bAV_rdb#Nu8#AERwLg{bex{_Y#nt+Bta~q`;eHqVd zsH9UCyYC(9ehre|^8RRk{(erjeaeSeh680Ag?Bv&55qNTk@TV7F%E18NFNAp{4{MAg&?VQ~;j4{+IGL1xB zp4Geyc+Cy+y#YC_x>h=qchJ^E zsoS^M(s1{p9Svi^BNgzn1_&)n1EpGZ_GbFaSbv@!PE)$0ol`AnkA|i&4^Cnt!CBte z&ql&2`!}dfbgwai`r(H4Nzet#57^9_w~Z+M^}YP)q4b7}&*xcbwj#?;x1KN6In#Dl zr2xh!SKKb@Ma~7H(0%*Lv*0B=9io%IUblPP*SB`$Nd2TN)9wnme(EkUC~@=E-ZU_K ztprXl>wR4*DfCJ_6uv#bm2u|$#otGcgypCbUfZo>GRh;KYLRyEQ%;{BVzD^S5asig ziR<>m#p;JGa^SWA6tO=WaTP%0+(DPl;JIl?c{VvQg(H%E*>02Jt%; zxuLrM#y6{}#@%N6oeZ&%bZB5szoe4JMuOL+dYk?#2abfenhP{)je9zCqf>@;X(@Z-8zS|m&(1tG+;luE z-dnD4HeP%BTWBZ$aKQNoVI9XJ+WgfEI0eVOI+OFgo}$oajGMuSAJ8Nf#reByaR+S= zlsC26)~HfH`A&S>dA6~*Ho{hMA()Jo=U5kNMSg#ix7=&Pn#?aM*^mb@J#Ejega&V~ z%uqPW9ZA^!&^1?Ssb#*vOLXQ7rN=oc;hCN17RYTj&LtLmh49u$(i}=wPXq1vD%E8B z&!?WA+dML`&Xl8#e^navQ@pMw7^m|WUd#@o`<^Nr*FUj+{f>7q`HFc;cRjJ!6HMqe z`_i_fOQEyR{+e(9DCOz&v+j3W)?U-+CW=#e0%dm8M2kFG=?`v12lM6;`$ccRNOb84 z6+Qj>hYM=KXWk4n*|c`Y&g}aRW_}Kj{N!<8_SVg;VV!BeZ)^U#xpBK$H_4bCXH^k( z>+c?*ehMx1IQ}wx5YQ31@q?Yys;9}y?M33Myl>`lRY2)*x@$4IZJU-??J4F({8n3;hNHNF?dx%Azm636sd+}8^6RGXm-AO zJfc0GH#7QCo-88PCd^YSMrdHsZHrcUb1@+-VquRYq9r9)E+_0~q^L}h(|R)M!niMq zMS|G}F> zpVI15P5O($XhxSF?7uD(BbXAvY|9*Z+QQsbr`)H?qVqiqRP}_2$Lw{W-eCV}J_OE)z z&(W`jl_%?|s!)-GZhc-XyTYNojS{h zJ%E}hO%anu+%_QUNRsJGt#~nbboUoZcd=kFPfYbHvZ0`hoKk$kl1XQsrq^ue>Y2a? zEh#yuCu>t=z1ONxOv7?@L%bJX#!ves3!~b7WwCNhB9D~4QPmcndfFOOl0)RFyC(II zNOg)W-^(!kj7CT^ATi&VQXd}=(u{uNbwm1#nzVU#ZShXN(-Ku`^YuCEymL({>#EaQ zh@sl^9_{2Z6~}`}GiRPo)2kyBH_!Gz+~cs@bnHFw+}@t-^W~wSpC6Id>GExNzTxtq zXHNYkN_6A)kxRlC>IL~@*=*aA^;8k}Em@Eq!&t+L+;c}&_c>G%_FSz*3c~?Gk+DY4 z-Z|#-U>rt%PoQ*9ia#*?!lHSRLKWeCDS<5N;E3DtmVEwX>1z>)4PV#u)HZUrEoIO1 z@DhzLGhw;vLKkGlud2Eks|J)^yzEa#leF!U#rxqQ4`wg)R0G9Z<#9uGEgDsX@aOQw z));wi@GoQlGGv1}<<7m^s>r3CM|Em*^tt2u+AJ4U5&X$k_7vA-RgjV{=)m>-{RVw4 zG-Hk+#b_7tW54gGE_1K*5+$0Xgjc3M^-8ScQL|*MDgXU!Oz)T1l;~6Wa1{Lw_uuvk zR*VR43UtHY$tx#BDG)Eg)dwaCnX@E3M33na@);#pn4=OvQ=~3C$4r>ISqZI*xZ21k z&Kvtu9r=VC5vcS!b+7?EWjjw&<{19u(S0&iMoePT#U+zP4j1PI&^3Efv>Jc)vx=ld zJ`d4l6Jvc|qRai~*7NNQGP{jS5DFKs1P9iYBlsxLKbwv(h7-nlI_oiF-d@zDw&z&L zyDk&=UN2lIK-9e>YS3MW5yMK<^tCS43>AT*w{buQE6JBXJxPIX?vGMIJ}I!F9M>6C zyX8dLb8N&VQvNXsZSDI4k;{nk7bgIt<3(4=HINuU3u}_VAu~}VIrY8ubwS;gWu>@} zdaeq(zSwY)ld0SH6ebQHK7Cp6Wq8c<=u{Zk;YFfA*T>h0-BPqYQ`nc1sN}rPXr`WufY0I+laRCK-j}!Vy zZNd>}OiRx2#%Fmq{g$L}67oB22$4x!EI6-z>gsv&578g?*w|GO7Nn=t+H3`#Zp-Q? ztRnVCvAR{FPkSPhFj{n0h4CYm?Vn$H$bOB^`RvE&w|iNPUr(W%he)#Ja69DPZpQ2U zdF#Sc?I~!6(Ave6Z83+wh--Nv>PTmLbX2_9))!u?lOw1VCZzVukgCnm!1TP|0h&)j zco4yTa^|L+m+0f{UspWVS#j#!S$p(hDLH^A;OWtph~Q_G{iK3wH+&Uq6a!?{N)Eh^ zmXNA`%F5sgh)<{a$zPQ`*7HJQTlD*I?ii}a+CHBy**~`jA$%%=hiKfn{^fwvL3pN` zE5~V#2MkvgcCQbt8h-sS6;j3%pn1++=<~|Z$Ev~EyCK>~Pd1b5MJ+roJ*>Xzb!EJb zhsa@T^nvHMu|sp0Q=4RO?XF*^qko6e`+c`})$1C~Cv{{4x<==A2Y*iKuq0hN$yw_s z?6%&r!Dtaf|1)QhFAk_S_Huq2_3i`Trb?iTW%2)6a@|}?Yh%**iLp(fo$+nQ#~3!d z8B41vEpN_m9aE%MR{43 zbuU+muKcZ1+h~!W^(0bA32ZcEl77lV;T(gg&Hgb=xA19y|A0ha!YblqW&6YO;F{S4 zu2!LXYs&4>)l2qqQ`cU

q8Ydd@;)Byg3^&$;bxn$@kK)!J9t*`Gv9t!y}=hp8(q zD|u->(_Z&zMzz0=pmTUDaQOG*PPbz1+z?(Mhen)-Fwt#mgYCchI@^fV`>(X)&XrSi>IJ1HF_VjONAn3@>$ueOdm-%ah`Mqi%xY4qNr8(Ly3-^kG%I zUGm7YuSd$X^7^Aq1ZEga^o^;HYggy5kfQ<=NV5Cd1*y-GhNs`1&>TH*rxsx=ukSYJW>;f>`u;FZHHAS1Hx0Tg*QkZ+|#>^x==^?$ZxVzI9bbDRKHRnVd*Yf6wHTt5)RfgqFO#TG_`0>mkzE4f1-m*u8A!vPuiA~@^z-ysE z&FKAG-72e>5ZjCeg>r8LNzRY1y5#L7-7@>LcZtL2t?Ye;&hW$(`iw>|j^LnH_H&GH zPZBAlW^#2@RdtHGFI?mJQC?gAuAaU(DTTUK&XD&N)vJ}`2OM4F#doG6+K#^^BU)lR z9_%n+m+Q}QZ&kSVtCZQwd1CDTAO4CyiHb8ljN%UpRo}0_>??eUcqAz_5U6!L)wqvo zG)0$^&A99-(_j15lXua764y7ro-_=2hGlttuXD1qR-*Yh_1BX(2b?y7_<8olYSXS= zuniTN&^_XBdqhdzRJxmsW1pLuxp!bc2!u)FP@$8B#_l)ps@2hS&cccoTE3^7(M>zvQy zGqe2rs9$Q?y`E+JqO&>nkr=6d-+Mz7MocM6`^T+SNq)DP_U%f8Bbd&ahh-`?iHEc^ z;;$DdEg195AIZ7?`lud*8g;44t$+VO3VHuP>p?1)M8t<526rPd?tV%!l;sv@Rnd-& z0{tuouBr%HvSi)(#5OtiTeAV@cPmz1No07)-K%rcBdw&g)iF(znRbA(SIdnKjw#k+ z%58C^#MlfXsqZm0P1|0sWDnUB*{P<}mm4niutlMse7!kV;J|iN*^VnY;C$t7>Z(Rj z=W`RJ;FNzTYgU5S*p`ZTOim`l%3W22Y0O#r8}?h0kIWf=WUQvoR3~CO<$7N$vW*vG zM6~$rT5s+3oR0!J?Yf=U9c{MFCk3e*EbOnpyBKfV z%@}oE+dn9&twPi@0wFeZlN*z6a5rJHU#o;$p65x8j6db8@oJlwflc=}g;FB{tGCjQ zt#Y_-J;y%f3HW&3Ok4k>{PoYQUrc9y9@#vyyw zqyg!5mgR4uw0gU8-GiyZu_2>cyF_$MsLiF?&5$!BH{X|&ypH`9|NYgZkyOh5pJVG3 zk0S!=Qb8oWe}gY;>rV0`tKU9719{%*M-49YafwZ4Qob{fK$yiS^0tZQ@ipA59v=9W zLOVx$?7m)x5@SI9oygP1?-xysxcgnJY0tjlNnKL{`uMrrn9R`i#Gm=%NcyOBfL);} z&5F^>ny^{qitnGWFqYUOR!&UHzZw)2Zz&noxJz@N*qA=3MhsS!(gi)7`eyyxhqL1e z%HedGpSIjyx?IMyzOYliu@vgaUJ2u(n{L_XjNcF+Ck!Fq5J{rZ_Mb6KKH4MwjRYpzfQj8^$}!KMKB0A?dzdJ zjR(5iz87_ik?KSR#|(fzmSoSJ7L~Wl+f&S0U3)DEeMG$+B5JeyI|QjfqJDLJ1^?R z=MmkpfTq@F4EUbOqSoAinB>}K2xW9PQYnuLbU(1Ox-@8c&dLC2FW$!E=PB@g1ZS~q z)59}^#um@$otA6JJJOc;Xg9h{q*9_mD%#MWPnOWD?>rH-n|iRJ8yW7P_+Cb^XM&b5 zY+`#G>o4}(I8Eowyx81Qcf$GIvF3XMl7sBaToSLF^PK$;Z>e|3O5fpg|6`SK?#E55 zN3wHLa-lglKo#NMWZV1Qn@wSo*T~)8)NIDVmbOHS*jvuh!LEKtevyi6tdL5Cf_~td zV@+{q{$$K^$C7jTGzrft5|MM})^>~&G z5AU;2UFk#lAGLdX?HDtU8-BR_OxC@!gJh2jG+w64Tm*|i5&IvNuh>}xg3Rv!Q~6@RFbrJzX5Mxg z27ml#gw}v--8o&)==gImWqbB{WOT{97H#bMhuy?MIgt<`Q>D+8+H0 zvAv~~2m#8cdsic`kJC9{VdQ2)MxZI4Mo5kqoZ_PB$WTnW`rW{QZ^C-0Cwk-fNT-YK zz|erV_wL8eNQaADi=J(s$@g2mhj)i#YM%O0ZmV9^JBCUnLh~Tbt|0;ommcnVpP91% z@%&}DEMw~Vc%sxbLBtq3qT>y(UdGNe8dJ+s|AQgida>@=aKJU=zuIZ-#C*?fYxlCy zMqVyQ7ql`&?A)X&bONMBSH(CMWvGMmjG~(rd{;0vC<6tz+ULeoV?R<0bw>Ln_vq=B zHID~7PqNOvAxSW-C2h9S|5d+NgQcDXSfk1kXUbeC}Xrgxe6B+RIo4*nHntCpXkOLqMcMw_7-1)F zv1gZGyQNEB>eOY)j5p-EA7#Kp6NKG;doPq~Jo{NX*Y}UD*9a=G8^4S#yGqNQVpGw)iq_@-BVK50$#km@MB_7#lX zS`r$+x-wlW*xs}An9tr=+*utn(rh!-#XZXKB>gvP)HE%}m1}|Y#~^=`_Pol%wlceZ6`qtfR96R%=mWS=H&+kx4d+8-avgsfBrfKuGh{q$ncJ^#cz1NW46R(G! zvuNWX`7m&ioR{~Rs|>@F8eeZ3afy-cXiWz6+ni__W%BHC-kJD$;;Y#j@lFa1^PA+! z$u7)K(@v$%Ww|#=zdP&qe8O<$fQXxm%(m=EPfKNNyV$AkY(ySyhI(cXXEM*L7HXVE zFI^X@VZBdA?eT^AbDG_Wc^&;yrk)7rh|_0MF9=_w=J}A|WlQ$+VOR_i_3H%D#tT72 zOVsT0&(Hc&IFbg9-poIBWc~q@DD4GP{&lb2my_x?C&FJxSTk&1U|OatNu0JP<>uDUg{h9j^idOwPSUw(UY%`f;;J)yF6{w zA8nFz9)C(d?NkXwVU`;Cd&`E_u-ASi&YC1z4EATu`j*!c&CbkazL*_yvy)#mmg%_b zyb!iBoln$%U+wPo&8nbc+tILW=UU(Rx|oFl=Y_^Y2@Ycaf^UJPBMq7z3tZ~mvMw@% zLf%P>oHdCYFCGXgOpMO6AT7C#Z1@F6?;^cktF-1k$xb86dOBDqLG+`(Q^ny+UvscE zGc)6c$h}6xWUTG_vC5#)S*!~Ujge45tP}FVc*+N!sz)eR(l)!7wXG6F>{D_ss%#XC zmg=El$Ny5iv-DIV@_L%clzN!h*t(ZM)qYh?#p$~7M+%B=-NLQJ8VMrl&pB%19&wjxUt7A#?&W%c z@w+vX;!H>SDS~3w>0Z4L@{t(b88pk3B41tWy_o0L{W02hRNKtZUAc*gpoC{zrsBG*dZ$4d~~LT z`G&M7^-JSqy*g_p4B`euN5`r4&57EU9*b{V>fK5CHa&EdieE4ot}8z7HGkJh>9eys zq&W2XQabo&`ArPQ+8)TM&wb5ecuT%^Hh0SHPcGivN%88eW9-@lFL1Rw)BsY7G zw~uy@#v4ARTy>@iqIW>#y+h<`$UU5Ss4_<_yUrnK&rf{|ajC6P*fsptRB&@S`(L$STMEqy7>J0&U4PC`o~Sa z(1`d+kBHtnt#Jx+8EgMu4Be;|)0~I(IaVhz8CHiv@?y*!h`bBAo0Z5%^w&i6&A*%b zNh>Rx>u**suI?pYQSl$Dh<^Ot@arfU5fVjyQ!|xa;Vh$qhJTR6o<@*Db~S56^G^6< zniKEk6n9pO^CniOC(?g@)qa=vPA(GqM^NtC?90~lx`OiApI`mx(U<@PG*OfWngJ2z zFy7CL3BZsi{B$0hW*+}$sPJ$`P+mUb((s-cd6wdwhp1ki;`P3V{NQ`Z_y?I4F$kUK zQZo<1G%buqu@*{8&g`VJteLmbI!~wbqJtF%_hy$A$M$99ImhJ=r#9AKvu^){-U9X57n%Bkq0V1>gq7% z<->!By2UwE@>nt+48I(XTl#pf@NY8yk#-+I*XoOTn7s+AY|T8DGNDf+H9~3Z{`Arn z{*#@Qjmq~?kj$X@S-@x^lTaWv1lEAU!7rg^e!4B8)0=7!&9nR`-{ISg!Cgl#+~5EV z0|^SDl$eMu>lSqg%6ZFyw zKmFh}BcrC}&I`OaL~{cW zR%YB}(6bmKl!c1-*6?>jvgdEpYP^r;oW^LI5Y*GfgGOXL{ay>nMTZ{it)Mb;I)8g6 zVEdV)^J2h54gF)V#GntrBLl=dt5hJGdFegQ&M(`iv5U}gKFg*19?`-j{};AwNVv{m zWZerrMd(3M3T*KSKEoi%v-Ex+x2|xVlcZ2hXT&WY&qR;7>BvLL4RP*3&SS6e+%QP( zo~K9K!-URVvId8)ca#Jb_<}ii1{0N_)qgX3i0@y<3Mx>?2Cp6+G0E+5#oH${05Y8@ z)fw23Oit3*gKaT{;p3MtMS?el%HNz%=no_a$dibuW|AfcR>8X?Dt?I;NAl0=NsCZ@ z|C1{y^r#Vha1|oUjGP>CPmE6qA{o<2Vxclyd8VPc+4G#X)ds*iZGM94f_c79gGLQM`CpeMV6$8n2k8hlW=PsriWK}Rb-fHS&KA$d4K#e7UGd1o= z+;T545u}J^?Rw8=j;)&CC?Q7&H_o2a`KG~3iKnoU;fa$P-Ijcr&w6Q{jeRJ`l$8j9 z%MwOsk{Sb!<9I8e@Hxq|9C^KOeBhpb@eRCfl#rJpQ-$U(;3lVGkQ8i~9I5*qX2DQh zaqBQB+l~Q`Hu=b0gutBLc>tQgcbGEX?^_(d;Z;}zjMuVYxEOD|8W;>hl!zx7wV3yoqR!9 z1ZeQZ=uJe^Pw_4Vn0IzQ`pTbzLd>l7z9zk{TU*0>;@NS$tiJ%~VRkQ(#*KSJvG!JE&!uTW+vAskvk`O;h0Q53DXP7_$M1*vuOynAG|1?%m3tj@R?!=oX zH5Je8ey($7DL?TSO2~PB1>T%=uPfmF?C^a9uYDA|@F*qNGBv@8iCG?9eX60Eb6Sph z&!tS*jV0~mMI6lqKzq#xoT>gePpiOK?)*%zW17}PiX4-5SgWtXX^VVP9)k!EKK0=x z%u$gpI!IBG(Ld3GW=Z0@RrepA8l0y7sUj%1aItjoAE{G`O6=;h36G;C##)8KA>eh<2Zi(!?AkOg7&j4*_w3IaA zMbVZ>E}Dxc4_SmcWw|YFvSMJ)qSOIo=X%cK{t{QW%G04Jed|QAm3Q59ZR**rQ>L-- zI1PoG!&H9klpb#C(RJiUL0|P6%Rpa4e>t-XuWz%K%ja?Awfh11+_gudbmrn?e&-f#8Yzp^0cVYrW0<%)$V){-Wft?kl2EwC2M}Dyy z>_a9Z^m5D=gAYv0<~rV(elF$2yW}sRRExYZdmL@4%ShD%QpJ7ycg`)H_?4Pkm z@FSlBwBvg{$%-3kRe(&IMt)Z`S{-ukw!Y6_8Ha;a1hyZf9K{Jzcx=lsL^np(w>P!b zy~~Q}seHVOx5XV43b9@;^$eB}eTJo#ONO4Kh8*vx`>bVMJS_D9Ob$?j$rlc7m;-Wg zg;bgSsDQ(y;iIF^#!`;Y-EDZ-gAWvqKqk-UC-m`blq0!l_lM-j4QUq!2k&NU;U*wQ z_|U9+fc4V);IAh-9d@WQ$CHbbvi!%~j(_Grpu*2ul6oNMsp z;apfA-$nBu+U2M5(5!}DYP+7XSz1Tt=2MOObO&$u8Z}1{LT^eKaGDjB#}+F7YUB#W zp5N76@(9Kw4HG@EZN#?|c!s}|Y|wt(dE>mDSz7F4dkl5}>_bX&1f{gmUHB0!`1uT) zw3T(yrN3XP+Mlt&;=~L9ncw9C_i&ynhLTp$xRf$n_}6KW!o>5$M-NxlbYgwf(X@?-#%ZsapWdBLb)_CcyKS#uVz5*) zEP)4oPCAFTunmeIYEG0}Lu-Em7Vlb8xIsAy5ptUmn7h42CSKYljRj^@?iyskR zA6;0uB78>(R<8~Z@W7YvKODvV<%qqnkm%{kYSeA$NIC?g26i5}Ov&Q7G0xV|DaiET zIG=N7`wc}tF?o03tKc`UKu+(FgG+P_I~92k?02RSWVilj z3_&HTeC{=u|1Uk!HC3Y5wk^u;IZv7C=NQ4$>!btB*OE-f zi#d?qh%u;sv+iBknKPFqUf}@58h~44%`ziCN|0j9yfYs7NcgxqyRlVtpM)+)83JP+ z?wiF2>R#@Ar@v1|C@j65|HP#G!0A0Igco3LkF2XAPRd;(&MF=sb`!2!&3Em@I`hG^ zH-Q2NU0HaQ4YyXi7xs-J>%o;B2JjWck^WE|TjfB^e|AigaPZiafO*az9B#%&y0Fk{ zIz5AP1#2Lm#-GdVc$&4aafu9d&(-Te-l6t;kG36(DU_!`$1{*4>pdPBRH+&!2lE$4 zLsavuanFS_0Qx(%GYUGCb+_&$OwaIzu`Q9S3x=RU%F@yO;}3?d3Ny1 z;lLt%j^W`M#m6TqLjBdgz9#RM#+s5+;xlo^ zHvpz7IloMeV-EZ_B~~Ihp2{%PHQ*NxDp>%v#)%=X@YFu1Y8as;&XS8?=8jf|wN?Vm z*Wt?;5n+ahNU=T7GM^=4CfWY$IPJ^>?UaOp>J&GnAIbR9x|&y!E2f{DAt|M5fcs}P zP4n>g-;h)&W*>|=1I4|t==H+Q(E-L>d1eCj3BUz`gqlR1r-niHTz^lQPV7Jm#`*wu zSI&!c!(c&#jAvE}r50H`H0M*tYi8>OC>u&~Wdm4M49TS_$2K}5aqCnT4$2z=Qn5ST zQNpPQzo0ui+xtNwW(cj^z{&;LuZhg(@?u_iO+wg$YTRz@m`P`k94`h8XEf;Tee+|z*QmG_YjCT+q>ZT1z+I$8eF#X zIn+Cf7$;U9;A@en2h#XStX7cUQr>M6OZu$L8ew7TpMxZUb*NF0AQ1zK2SKc#>2seY z<@C2-g0AXZ0<>=5%C*L=f=&SOuh{-TAmQByI0%KH0p!*(ufuT=Mb3N~?RVDf-Sq<|!U zCsyX-LD-DEfn@C6!sl;FA3~rE0Q&=Y`dK+{61;ix9^Kj;`>D?#JBZnZgxHP%LL{aa z!o_)Vdb`&c#)xJmIEfxV9s?y>SVj;6)kJR!;ir%~s#2Gn_IWn!-f-XwjA|{wsxHvg zY!Gzyl!C{fgVaFiRqw}8Tpjvf;0uZIs~AtH^6~V#gNGWBQ%?L8&HuCi+urOe zM3ty9fTEiuN&oz~9J8kf6?P`oIW!Ot=wE;bvoP&t91j>(5|+T^8UIta7jX?RX&`3T zIw?XgvfTo^_0;+IXzP4V?E>^jI6shM^80rN1e0gM4vTUedVN>4#D%DjU;^u1k7&GW zhTC9m#(vf^6_};=L#js0fc58oDDVdk|b=rcrxsuOFQJC5ks! zQEYu(^`p<``N>7F@n}L2Lew2Wn1F@q4Bf9w?VaNn@513r3V`jTgHz z09mH^wN4WP2X0giTgqb*>F-M`sdr(2+yL&-m+&-%Fhe9m+>r{2gW8)c&Tw0VSr>TQ zkMbG3w+R$tG!E`VsdZF5W)Ye;KL?Zprc8wXGblyqZ6Al`%Kh+UYKCkFO9}->>N`>d zQ{zKLZ0(L^Jt{nR^%*y;C?+5TjpyDSzH;iR|s3I>r+^OT>!qY|Ua zC6-*j8zwKMe^NoZ@8SpD?Y0(U0s)ESZ&S$gT{@NTUCTZT>**<^r*V^41Y4uP#_jom zj?JytEJ~2 z!vS>)q58T6`sXPcN&~->ZVn9#Cd2cO1096OS#uKRw>Scdwgr-<%pgm^p3YeyzHg+t z=6LZ<0!YMc%}lJS<)-?AYf%v5Hh;9ob1(1_qy3k4+h1+)a}V^i33&RpavnZ3rB)%A zC&rFF+W$RoIRyw3fGUE-`@isA7ad0|XZ^G8k<${`1?b`b9dQCMr^EMzNg+A}V!?A} zt35*aNHKZ@%SsEf$Iv<$!F~e(i?Z#J{^xr_^nzSNI}~BCK$?I+xU~(P2m<*?(n?2c zpC0P_#1K}e0J#5J;~E#?em}|kAj!Sqe(n3D&~lR?4G;hN;X^!L-R+XtFmcCIf^c|< z0oG`o913F$3$U~ageQSE z9a`*G$Gx==>X4%TciDu_S3(Cd)g5`X>)=^u2=S@|Z5ed%W&Yc<`h+}LtBmZipOS^x z238jS=)@^pQw2macI=kvSVeE&t50(&w}}y zo`baJ+#4NoyeXn}k+y+Yec$*@6)|Wz(NiE4zTHa1cOd8mvTLH~BhFC`BsGG&ItoDM z6v4SRc+P7cqi%djC(e z#FbO!9)u-!C%(&paAf-HIAe#wuxnOBuj&{wFVTP+1Ej8EoXeg;n+MElIZ*ZF9kUPubQE2!`ASs6Fwz6)jH?3CY$eEm zAnhnca4*KXwSotenh!{>3pKC?!(aoxLd8S&Sdhzn@UMOj9Ex)QCKWaI!I2xX@EhdR zhCUotVtgN{z{Z;Z$eqX9iwQ=OVT%5cY_VCc1?Q9{AnEOIcDhessugwP-W{Xk`)p@z zt>OKN3shSz1Dk|GIRGPs?5w|(MVI{>1(!*f3s4-7dvu!MJW`A*q2I55RD-MA5g-vC zL4qF1yFihbq5lI)%$fp#`4KDX5VCEwEnqT{Mxz|u>pg=;EcwDBgILx{z%aVe5@)e= zyG6W#bvOjZx@p%O5CkGid3lqlX`;7F1FAeh5}o`R!gzQFSHR%Rjw$C-LX$E z2)D{voVoCcVieT>X#6ls05?%j?4x>+?VR1V$%d!N0lF(v>xZiqZ~=P*)G*0oZ$i2w z93c`NfNgx7%90_7@f=ANO=^5a4ONxJ1)Nbh!d`4=Rt~Aq&qT95MmV-k31rLlPxm^ zf&B@U3Fq#-AcXB#+|E|I2Dsu$+zfc9^EEg_f}BW=H(#-ArQ^%H8KXilSJMZe*z`xb zuqOi|(dUr$3&i2^#sW~}`QI%#KqL5}B3j^Lh)6{s#&$;_#!7xG+~yPDZeMtAfl3Nn2XsJrPVEKWj#2$*+PjNQ69n@wLKHtg0cvVu z@O#VzzdKLfkgraoEE5Ik#02nTCssC3xcTMClS-CSi6mea=tCfjy*3>(f-JJh=OUsN zx?s%zui7pEV~%_(h?u!|AL^N!fFNu4qR^Z$DKGeW!>CkMsFp;Rf=LHMwZ;gO{-BtP zC=X$VE5baGV_LjfBAf~csNo^msn-u{Nt$HW;)i^R4-EL99&iBW6v+jeayrZ@vOJJQ zuYl6OsXnR;x8DHl>lsGbCblXnQwvBTN)xzk$-0B}k-{+Dix_J?e5Qzt8&1c;0D! zU^4Vg(ZE9tC$51nzQE!_lOZog_eo`3dkX#(NCMCPPicrr{f4an7OFX1y8?~X0YN*J zRy>_x6XefNfo)yfu@~$HFqr-cM?>7K0T>sO2yk;;%h2}!W2aY%3=uaUh&FR$QU?J$ z_u4EsVPb$fZb9b;*fM)Sd;qHYU(Fo|Qy2{qRWBQ$PR&gyZNr`rAQT5W0$833WU3Bv zH|WeNftbW>6S0FsVMyNS3M5+a4SdeZ0yu`pr=Yxlj=?8F?@L)T$p9UA!T#@#CIsm| z)K=wFdEVfJ1UTK%G-t1F3qyhdqh^l$J+^T*V7*@o>d^l0Ee!8z=Rv0dOAW%vSxIJI zxB~zbcTa@AK5B3?71ANI2C%|>>>WZ*5l(^SS+jjj3m0fL_CUP91bkrsf<)Yo!B&&z z+Q5bSf2Z8^9*;2HM-Wc*%TTBAE`$)iC`y6|nRRMR5tNd8LJa6|cYu^QV1&8BTp+0; zK_}e53iir)K|&hkv1J1J7DS%7CfKCZd{Yc{8)m>BQkNi{bi+0TKB;nJj&olr5Bduu z1H#F?PANb16u6MOgj7`?Gwniyzwd$A+0<7PrA`ohFh(B{9wz@G0yLF?|Eh^Q$Rs*SOX8GQ29puSaSpXa>qP*t``di`Cp#kx-MdK5&ZBV@E zY%$p5I@iE@NwI3Z?Lp>u;W+%?;T)5M?4~tDbg9Doi{k1aaGo)qCCuA=X7o71Cb@c; zg1#vOVBniaS6T4%fS%n`Z*btjFNFX9b`>sA=?xL5wlKkwuLP*ZL2;Y{FFFJk>~@to z{MEhw=etTM5$A{hOB^vR%Y$UT~q^4*235C0r^F8Rh8y zA>0`Ymj^dUgJ1Iy)Z7ZtREjGVbXo=81FVX>-;Lke#-zSLK1HOy*eL;;{qKzmv`!uv zY#}uTuqXAu`awEc*ewsK-5#jPQ6L0dbi+pvE(sv|(=a|~f|UfJ1St?e3A0}VJE1FE zWP~>8De_Q;H|szWhC(o5?h(q&01OQ>nt=#IV@3rtO zg`koTmj79iaO%L#AO2@oZB9cb!wZtkDCfT>1cMdVM(?8nc%HVHj=)<*|G^s0q8$Xo zQL%?kS>w=F_)P_%v8Q4J&?#U@usW>R?!f8GC&9l3;($!7h`ax_({qqwvV%SQcj03o zZ-5W|M=L)7Gml(O>u+;`n=D0O)^sDH$u-$oxI=d)9(bb5ae^K88?I~R4KV_@d zhJYSm1JH|$xVXnBwa`y55ux1`bpaOIfbt^hcE1+{Q_$SvhNHEAgq>WWiQ}FF+dJz8 zLm0enFSicOrjzHWAau70w0hC@Ojik>jm|?xFFmV@$#n#GqvV122A!Jy*H~f1UPiPt z+9p8g4t2nM9b5mE=>O5J3_k(x1qG!sLn}a$A(SMU_B)I0%ZZ(6AYg1AXzNkR-Jl_; z-GqB|=-gic@Xw~1n_WtH5jI6)zU&^ZiVFh^ z($NBoN=@b36Be~5xlvX5k;(+_)UyNO+ZAQ3!}I_d*)adrSP-xt@B*fVNrtrcD#nDM zHL#7EOtomT z5{LmxHCpY0JE@S+){##)4@-{^L1}vi2vRzg@#hF6p)5pnaw>>MXD|9_0wMj^$q&>$ zZu)xlqy?hz$m^#f5!ib`PR$qnapz5dX!rz|Fk9_=>yhRS+Yp)m>&Q4nNAFWtc3IuMAaea-sU zt?xwj1ldq6-0q)Y0UAbNgMhf$weH9hjDrFdF&V`8-~+Vp&8!9#k>PTOfb8w3u`{kY z{omkfy`2@zY|W7axAGu4#$t-^`IfW84c`CLiYl&|7~2cnEb-Fag~c%m#1XlApHR)F z`XI&3EUVwULdnJ+AZbNTk&_?@6T$F?S<}k2A&9?J29P*h5it2zU+`gR7Y{``%RtD* zK&{j-@$a;7f&h}CSLu1|E>e|8a;y&qJ9emm6V3Qd81M!BvMqC^+z=E3%D}|qtp*^g z$BD6#>hj{DlWZn*hOeC+Fl(PU|Bu-q3~zZg>x;k8tiPH5p0WJ?FL|KP&_??n9u@?C z&R8^qtp!s_Vn)=yK+&55MnltwA0vuAoVuk)36(u=kY&g(;|`2Krs9TT1W>K~1#15{ zy#O#I@#fmU{nZvEC+EoB`y?fBiKhx|hVS3$$N-EdYTSIxeAUl9+0PY9LBNYEh!6=~ zPJ+#{i_i-iO88wBgb)TJ2;yc=SIJQvQ5XPmVte;3)D0z|3ss;ou#|+yO^|mb*Sr}6 z?=c)(MCU;%6s80`+?O0SLlC7g{g#(XL|mXk7yQhB!Br{;QVdw^Jq?psU{|2kp|eC} zPsl<=rLdFbOM|1Xk*4*1uzW~>xLMw(!W#$BVz)@fi^r^$sclMR17Z7l3|41)e-Di( zJ@qkC)p^^W;w#jZ4LJqk$saRU0`Ay7u2D}*-|fG0<|e$WZTA^C^8Ps;Lh}ush5Qxh z-s*WG>&pjtH|Gv;sIEW1ac675>Q7PQa=Wzv8tZ zz{hGp^^6n??xYqVu3sp8kEhB#z1Gd}I^2G-gAP)=#26651G8$)(BU(2%}>DS&>)m; zT>$*z%%s-<&BoTdp$c!sVUhvIp2^Am1T1c0D3dy4y7K+cnY-}GO*?3R#e4;-q~XVJ z8lbnY-BQOjV!DLd%O~H9jOcCl!Tm`<*}YTrotf6khKzzqB8S;-Z$G;|Fv#TOoIZxC zJpHjS>+H|&U*~^z{<=7L@m+fV(7?H$-2({+{f6^@7id%?CJS7Yw86W%Di#m64==yv z0J$C5^Lo&F*rCrqnSG0}?=^pp_iU>>67!<|jq06lgD!7vXNopr?ru_0G&s9TI&DtzJ;;W4#?Xeyr1DII zk2vXLSWp)ZXZ`(m*p~OBXVh2gmekX%C#ceP16|Yy=mj~o-x)H<$_&cf^<}55Dst)3 zx?UgptkN>Ea`pL(b4Od)URBi3xfr@&B1ujQA37D}|AstW7(3Z?GHft$e3wvKHa)Cq zT$?8k)AxRV@zd?b#Pwr;77WZK{M$~=9-Wi2oyb;t_7hPnXCdyY_U%>p86(CR-jkX` zjpGoJ?a(VnroDH8GeV}?bwV^Th&U^F*EZMJB{)zd*R;y%cc3|Ke4*pQ@yhp`Xa43| zUrcv68SW#USh~bCAUh8y~|1T<9x7}-5{?F2*whzh|Njnno)?^`UQt9?hm zOu1hwTioU)6Yejof2iboMn6Uwilet#cN#UgIiS0yCI5z$KJ`i$Z~P-NAlN(^bKjpsTYN@XN2VkM#!gxyp$<+ zx}ak?YEX)~z6G@$pmm=M>P&mcesZtLOBwQ=ZqnUND)XqHOLAx1OdRA4uafz+dl+3V zXbPVQ(uoAJ=MyHw*NyLvs+`uon<%!3P2cd>HS=CF-Bgu}aSl#QkY$RnoeH+u{T#J= zDGFX_0-$pv(aKpIt6=j6JLB9I<()D#k&(_Nw>JMw;>U>ZFR{>;Kk8z8zLNeOi#COl z`VhWhP6BU#(N%=6;1pH?}k)IEIwyFdNLCZzKYbN&Jg=IB9FPMddb5)sNdDwb-nH8kl14258{N? zUq-TV&g~DD^UYiOY)dUU#+DBz5v9WM_^9F;u&b(l9Tq1ORQ1v5G$oPg;fkp@j-i~C zZtGV8kY)OB!k9v`WuEm9IV%lSb>gKc_!`j4+S5t@w9D)XuD4|+6b|aWtcw#n>>m!4 zWcH4`{+PYCEzK2+d+D2Peht6pdQeSbUT1y8e9Tc*Q&iOB9?8P_Pn2J8Z+RcFv+%U$ zV`+wd-nh!HoXg)L@PRCxSr!-#hO-Kv@$UxPE++b-C$*g;HPQSdGsvgy+3)xYY{~Ty zJ0(rd=c7*A32hLh&98Eww32Wo;~6Qt7muo8@JQS9+Qw z1Mr-HX5x#BhVNodY)B)I&=Bl!>vvsT;i~^j6&Q>9ty{JBMVxVk&vEvFt4D%){xJ}k z_Ma9feGI^j^T^ZAu7Bik_ybpm{c?f&iI6#vK9(p& z6mJC=W@&jh=We8-4sjCY2e_a{_Cy^#z1_;;lbe)yum6PL45-Ex1&T1N28#3Jt@z&toL~{uPwDMavlNj7AK^#4PfR9>^v~!Q87#;B zNYp(NLnIL3|EkU#KVd$sM}MfJ=*Rs=>@L5(>T~mRt!GF8%uz;jx4$Y+yRZb$L@?|D zMb^e@|BV1afufFbV7o{2^TL7e3!bYS%kp7D@zuul}*SeALk!_#-st>o8 zKo|0p5NkFUeN>i=hI zv4>RB;a6w;)FQ2lis7VLcsQ>BC7pK(w(#Qh95^o?PSE&l`P*p7`99C>}00qt(Q5I^Z|XAXXX`uTEu|Jjd6{mExHH*45- zjUV;f>1(?GbhqxqMBr&9L;&pAf5u6u>Pz4Y8D;rX^)Fp)96u_APzfriXBS=5%^wdI z?KK1$dY}w|cB5yR8UH2+*0@&cANmc&V0jP5-*x-k4SCffMph=IyHl7a@+edoyhPOl zz}##l5d@DqKnUFFGF)795aY=5?Ium8@QwSZ%FxHR7)f|F4(@1Hl!+K^a^rLDsrYQD z&BWznV^8>&W2Jpn7R$yar;bbYHa++2t#QXYiC;2waq8DS5Ai~v0*EcCq>%Mj2*gOv zY;H*&ZY)V$!TP4>?bu=1{4w$ZPwkzHR`MiFzQb?eh*;Vd=NnEmOwPVPK4-!>1ysZqA5EZ;ef!rk&dHEZ|i6cw(JRQB)pXXC- zGqUh!Kuel_D?YM9a5Sb-h8KHH*XU{r*Z+BNE z1R6!1mI2b*;4gd&NtcMYBINtWGLXe+01}uofq@L*5ed*Rmv?2w zU%{4fcBYTF^n&S^T$$NAqNfSIkc9fjPu}9s;R}TA(q-RA_&wnt$sx0fx$V3e>bdMP zkr{M&>nf`CI^j<2kr0r>ZW!G)yNRE$X2)kopZ95>gp6yfb~r8DONyC`Z7MZdU#`c8 zKKAedtZ^!aiC$A+eF$1Bqk(^6YZgY@#a?|Ud^fes!0(4A~iUO zFT!VmtU-Rypv_-^$|79yoYwLA_;e3unaL^j{1ZGbp}O&`Imt=|t&Igfxt%WqGWE1B z$CGq`EqC1(Mh|U9u3OJNqFtnYQ!b}i@kq=4r+$gJL8%!&Z4tvA%-}xpVb)vqKlgh) zPlfN%;eJZA!7SzXa&RKr#X04*G!H6hJ$-LqyuBeiUnkKykLP$Sk{7ZjdTsN>ZWYtL zkrQ@UE>4F{3gWaFOe8t```jIO#?vE>zu&?e1_NPm{)QRxzs(1#e(0C!jJTI$@k^)X zZ~o@aqI&S_XTyU@zp?Q)#`d?13m{Ghw|Rhz4A`yz>4W51Sx^qJL3s4CbE50Z&`E6S zwq$fZTRY7fU*LcOimISweTT~rA8X+SlY>`iXmGtbM_Iz&rX&#dQi(S2#&nw^&#J_; zNwbmum_>ZQBx;ImCqc#0JL{+x0*>aUG&4*>ohl?G4dG)+F=m$5D zfX+`hdyKB0+Lp4A5On8}h02j29%>bjFITNiV$Xa`F6Iu$cVGIf4;YRe)h_UGT}1?v zIf5guJ)dV2iVbb6=n4&*hzv<^pK_nqnv6Ln%$x5{i2^t5->nE>=*zQB{19VkHoatY z<h|P;GE?!YDUI6VMA7qA4L6xEfJioP_mb z4B?82R!|+EKRi0qdwK`j99F;|2<`~-%@=`>3*@rAbwjmPA~ZKZdO$j{Ufk>4*Z`P1AEV;D5ddWSeJ>rnkp-eyL+xhY(@YFds9p@4X=i`AyMY(#U0(QVDPHgXr>06hrIg)fmQz7y2un4M_e#qwJ(t2sTNQ2@gKim8( z2u-yE=9GKwI@=);=J;{tu4XP&|aduKND)d*X$`RD?ItTjs|z5g57Fv z-UONQ5>|e8IpvzuA!Q>%10@@Db0;m`b#OMN7dAcrg4}8QKxkuQp`%(Llqyv4^|HRBHqG`oymJ0~ z=F<|zx!wP#F6heCA8dg-_f9gK`)vW;Z?5De3uJO-!d^K2hynva9iSu3po^8}L{|v! zQ@i=B{*qw2wVH9ND^lXVcy$-i`8Qo=L$tRfrt>p?a9{n5Rq!xEdu!(>SOd0y2k=l` z)q64@Cscy=1@5RbZcte}gt0?x@8MJKIC$!x3L&#Cd;TTMI;Toozxiyvp>c0(S>R#; z(z4SRxtutDt3*#@Zke={Pshb$Yhcmh*p5K1VEDWBX=`j>rHk(B2VW&t3H0AJ$+bJYfrxQc z+oWL*mI4Z}WtzltB*5^*8tC^&mrCZ#3NhEZdtEgH3JdgT33;x#zV6S{_Wo1(T_R|; zt!g_*+;!n4@Jhkm6o6(w+{OP6jYI)I_Csl#=YE^0(kv|3Aj{m$5Xx#l_M&y8-Pq8t za3O<@ZMA8v1R0iiaKf)Z5bB`79N}r5Yh+w?BKnSDEWr5hctk2vU@dmBE-0)+->lc6<=ElhBz%9G%iES{qIsLF@JVq>LM z+8B#1c}QmyhC`cvo$XzSEgiT3I<+|fsiH5wJQ~FUY)d0c5j!YdUg)y%@)?uFtzjO| zF!05*1=YBd2iD(79TdFgJNxN!C1b^AmewE)jqf%7--bTWO`XED>AGBOHdJP_6gaZ3 z|H@rC*YBohtMn(<2FxT*XS-Z>=F(-7rpW!ggB}4!YG$E8BBXjPF!cu>E=J!$EoJNc+AvoT(bQs<*QP2d6|{#T@2hIRgs%e6 zs3ze%#nJoW=7hc;p79ljr_5kCyD^?_<}p1p0EX*o0=Ai!6TK=KF(D(Aqbh5|FXu?9 zp1%ficA;_W#3hXp_-4M>{oAz+7iT70Qc8}EEKgITwRm~cb>xfcY}CVyv;s`?+DbWM zRgP}3a20gDR)RFy&fiG~2f=SXtzU_kZY_Up1!jhSyXASJJ+xd(EHx6#)KNqvQvOJG zCgbU4n=%*Ww9Ln#FTolgM}%Xh@a7FDj4@ICuzAPgcD(n%&;~1RO38(Pn(hHJ=}Y^L zBx$nlj-9OPZ$j_h9Ux}k6NIi(x`5i03BD`Ie$L}q-ifH)3^7tZ8$jm4mviMV39Jg# zcWZavf44pbV+?7`k64JvQc_lcU0w;wdlCYA1poWSK)i_!MJFpz7SE2+1j-982bSOX zI5Rp^K+d(uJ7mm$6%NC55T;S zu%VvVk0s?I$nKeWY*v|!m1->Zu^Ba;V-8jW$f!)5Zgp(h@1r(25Q4*pOCmNt9)%y3 z1&nYWjNmGs*W~fam~+A=L#zP^^mu#6X6kt1XVCL(0qEYHG?YEQG1y6jp2sXgU$n8|@rACtse43BXQMtxbNT*j z%n=m%zZg+guKrXDlwdmy(7Oa{wU%VespJt##ig}l5a>+G!;<%C?y(YEFRxfLsXO?Y zTS7=GeX;Mcz;6*5hP)fv4lEqn*&*;uh*F6LVbHbW+Mi@L@?U*#CCvCi%PSn~(?mm%Z6a2GnW%U=7{3s<0HslT^R~_ z?K-qN;>uAaHB20l^h`y{ZDO;98e=}mtc_E>73L3STm2LoR53Jzqt(*}p`hantthLz<99U2fQ)4^PI4^JC1 z5wjADl;Y84ieCN0h$)+AppP&YyuJR{`QxS+LNczE?j;G_!q#@e$1|IoSJcs4`Q2nF z`AJmK^Hu7szAqb|)s2``F~W_Gx2d@M5LGAe_72Xku%oxP8=^EnpOLbg;ue#1Yqa-E zUG9$`9$&Q9U_fo!uO)H=9*WH^2JLMYWwwJCPx-*Df!G$+EgPP~m zYuFVccA5~D{e}HmtVLHxMY-acRnHLE5^&WrI3H`GHqT0DH+K+bzqRn|<(ST8;l+qX zI`_OH5R2qqb8_*Z^eC-ksCxR$1;^PbjQuj43c9mUwV*p8@q0Wz`~u?qnoiTP9$PrH zTH(5pg4o3z_#j~5CN<{TV#j4N?{ZI3!)un;;fd#PIyE2 zjCU@dP9WSg z41@g1=Ww_9^p}>;4A!i&p$+vhLO zk+E6+3HfN|%QnmVY<<^U-1j9wr7}VOosfg`_)FjJ(>w^2T&ur15D?FKte}mYD+>Yv zw)?-i>)PI33D;}vEf3UT`^GJxy8{Pll|-5Se$z+L2I(>Xvz~q?O;2OGg_SwriHrCV zfPaRtbFT_@53X+rVtg8<=FM6pZ_{7+oRk5z@A;aLhS-H=XB=M0$thBZ8s087*H7Sm zYI}=CRRD}SgjtT19A|b0fm^&wFS&t?C8mTKRBkvdXbm!sUV@%IKeJqU^{^Kgdbubm zRhxC?-prRJ#z4e0c~*a`01oEq%E;O9kkJe4|8=g^vm||bX4a@=y3-qaF655bFA_N; zck0V62K$sbhuY)?1oT#;HOm!cIo}Beg-;KzKu!Dg2A^LKS=qaAx__$O1Vwf6={pLi zcTsuM75mwZef1w6&CSjx2THOCBQ|%hKhX=nv?__opuVDV-;@OjXMlc%ypawUrG`TY zz*oEPjrO76CX}sA@s>MCpOQVia!Dk;%8JWJe|syMTz<_?)gU^IY+1}6r$KDQX-o*F zDv%c-UKgm2p059dzNa%EKW$rLGq2g3lpr#j$#5>%p%WTE@WoG^Km6{qhn;#|`o>UB zV+V_@vPtWG7RwL5RB+~p1nLmBMkO=wnPv$1GB58aUD;}a-nwHDleUDDzdu{iFBm1^ zIGw7)y=_VlMeLvSz+yiabE_S}v>;4iF;k2z1QkW7NkB!z*TRBdf!QDyU9sM_w-nf< zU;4=N3#Op&4QCgWrlfG&+}yJCW|!6!XE8T-X5QppY~d8AiLeZ~2;?iIzEv}X6g&-< z$Rmr>teEJZwk4CN+H|dL5j*apobK&7*1lG!*lVkl?&$%(%c@PJNuZj^uz&TK6w&a{pWF=he@Eg* z+hf9~polLmxho``D$o|Cpcz#7(30T1QFgbpLrV*$)gxxY4;}$X8Jya|Mh8v-t}P~; zc_CJOxYq0K3f#w58WsEM8<7}jK!|{-qzwmd=-IENtNw!L4NYqB8+&3{<$jW5rHEI<>&&8D#G{!FksNr({&z-gZ(pw8!pkmRQCA2srP?D- zT~+;ZZxq2jSP))Fu2h9FpehM7n9ay~?7l2B?c>^O*|z+<1}cjYzFDiBmeRfMG5O^V z2TnQg>Ea#FNy_Mt+>ma8`gjsH9yA&9Uh(W1JSXs1VCGLNE&43F2Q3%xl!Z@isxI<> z=Y&#|bN$evq~JE^+PXg^+#-H;wA@z$dh?npp+E8)6bY^+JUT%HIpOrqvez&XX4rMC z*s|pjj+c)za>ao&kzyW;vKQIa4=wGM+c6=)y_~AKe-p6Y2N0kScK_a+qwT8^RF1x1 zb~~)WNZ4Vu%%V(i3|cL-+vv4?S!aEWy1BI!X6+`a;8RrY8$^MwXVdzsi}XAR7$pHj zn7d$%z#oBtkcD=Io?f;<-=$-lGVaF`gX0riCW}q{6xAE~#FR)uM5iKF@coxN1NQ2P z2HA%zo*a7;aVVAGbTX@ZX}X4ZuXcyVY6zGgmQ9ls4ZaS|cfo)NnR-fE^N6OG z=u{gqh^+xm7d;nyh0ottf4wtP@X$K<+}gW7ZX4ko@rWg|o-k11;n{|8F{Z$;GMDc{ zP!E7$Q*m>?KNf7EN+d>;q2IYd2G-}gbSbkr>p&nDVR>5yElj|Hi#YqndCcj794^g& zF1bhMKAeQv?hziVsE@Jg0o=ezuD9o-ZIQ8`)>7N3L9{Zhx zvYzx($mYDPNCe$1b1*4jsgD74d3Hh=u@q|a2TtAf z3%?4GiYR}6Wiq~S(Ou{Dxh^+mB+?sT%r{%bHzY?Z*rPgX0(=VQ&qmrv3=|$f9dF=l z>bkBTl#%C0H6U=1!sO=t?ZlXaaI46z5od=6cD3INwFTfi-Iai$<6>#VN21L@f>+Pw zArZv4=^N99iZ{fbT0MFi{xV-*gSrHUXRe!{F?reR{HQ#X7BDPu`Ot=OhOTK=`ZC^Vtv z2eg6J-~)sR5^(yZ>d_jV)Lde;vRetoTQG_^M8rGSeEsLG9zO1!3CfZiZ{g!mC8eO; z1(^M&ms5tb-DL<7((9e5)-7fih57B0?IC9s##@$pf9`qC6Q%j3 z&3Jy2A!ML>ZgD*n_fstDSL8H2|J6(qaw{iz-ey;fPMXt{FqZ=m_3L}C-6Lgf<`yc+ z-#6QDds_OZKIUiO=c%;y7GK*aN2A+tW=iOL&Y%O4-L@*t^yuViB06XaBzWp#yBJgu zSTke}6c2%*RsKclpb2CiMVQ&*O2<#EKwdMBfu=Q; z+wa~sNgrqX2sZKQ_wmd7P}U?xvghVuxwy*Mq1zuC4jzyZ_yMyt+HOG2gWnQ*7WyYZ zqL4{fqUf;x3&D+oBFm3lza96~%U(jj)^|$s<{xSmZ1CKpdZ0Nf<32+?Kf%hhO0yKX zLD=c}WGiB4CPHTDnNy;82yYT4lJSYk z;3@UyA(~;BXiU=HtHT%=A3y)}J!@%b9)F)Y zLkS6mTiYzWhOjGh!wtGRZ#f-_p-n9X+KMd$(1d5?ofVSZjkFYZ-;$V%aXmlIvLOj zGjn`Vyvv0VG4zp9)-NXaes*{T&ZJA|ZUmx-pl8owIx{5BGi`~IE_iSd&Yb$tEY@zV`Pl0JSR zHcFq(_Z-!-ixi+}d&fY&`oI55E2SzfN8QAnf1 z8k~f@?Jfo(gK$$2=uNA^KMQ(=q>Ak_c;?mBpetP$GMI`e+Yk42VVwX0YLa<^MW^bjD~4^+WVU-UV>##;yc!eDSk z^`PQuUWx4Gx4iQ<0jH@RsKJ}~*V=GH5vC*?@4;Xx7i7Y^x`7U_(_rUA7oMBD_c81u z-gD(t4YR#rKxq&Tq&!=T(D3;~1SP2!08Df-ymjpNgWu25Ms?~1Fm)UrYD7nnITzkP zMbgKTs628O9r66lDR4KWDy05^DwO$TKSlhB6tOx7QrrrWy0b2f_kw`m4->@fG=^xw z#*~0~>w*JJq+CDpCh-Tj$2R&o%j5avHGC|SL~DMUV36=~O5cj;;0qQ;Ft-V|lgX;^ z^!T*QqXqEqE2kVQaF5KNGdM_4C&?PzLB-Myy*LX1>m16EEvud6WG6spouEH!uzUNM z=a(nEa5In18`Mz_Rk0IHF1oC0uWvu}NDWKXC$o4Rc4(5+ZP?MtEw%^FkYFs`IzU0rsYkI1$%Y?E<4 z$0pL;!f)3*bJr>JK)wwXy02mz(@S!bC$XFEwmJ6M%0EP<`UX!-p%e5`jNl^`*s41P zT#K+6nX~~Jc_o%f+V!sIQOktKAP*f8VBA6J0$_c&o9apA>-k zFc^7T1%>WGv1UgD@5l7*ip1ZO2m2z$$v%6kmvJpF=Ex;`?%e}Jw~nT(uZkrmAFp&- zaO|4qE)$b$uG!VDHvIWa!_ixnbeP34$=N*q5fN^}TfyD?Wpz)tpC0ub0Oh@TIm;9B zBjKCSMo)E0itF|jh)t)34=<3mf#X4f!m=BK&BmCrE&68aLrKLA%Wvw!7Rn-h{Edjt zi&7j)BN~%*o(W$*vAf)1J_ms4gHY!`Y*I~ztNls#FqoWgK4&NrI*vk`Kr8&sl5~t6 zRuyEoUN+ngx<&N3|GJP>w%p3Au-~xy@59>-S0dl_^mCQ6ssdjH`8KNW$PGO*HM$0m zU0rdiC8aL|4p-r53e;%X!K#VrFD8aDvFW7*-CA4O=h5$3ZoY(nt}?w;6FOA`3xMt6 z>eHMhgkuH$Q}Gh_1bn6HSj$1k=w^|*#I%z7*<4RxozvWt&@0agVO1Qx;u=j_sr5>D z{qEk@y_muWwJl_*^cM3|+l@2TW)m73Obzsq-C9<#8l#5xkrl+V-<0mTm6zgnPFelX zRC64>Pa!Epw1b+{=7g ztbEV*6+6kRzf}GOA;lN^J`tb3pHjTLFhmyY_6s_ti=~k=?X(pbt$T=lwHUgjym-E? zQYWT7NbSsnfst}77or0~ZsQYAtR>TXg2 z_&UNwV>$TeVUQjP&M$~hNX@UWVL{nD{>D-}=EH8LClEu|N#poV*CV3B2@qVdr!OTV-;Un( zN#?yL-_l?2$Ja^cX8r`NA`?wcY@_*1nMT!T?+*2yb3mO#RMP<5AF;c>0Qm^kb?80C zgX5nzk$9M^pokWuTlJiL4%#1Q-u+A@J>W0DW2qKTpYWL(xg0^Tadb7Ce{?Ud&hV_MJA zBtn8O-neocoq|t15&CYvy-?LTf*p7_DRax5gm8M3SoWYv$$UdOfh3M6aZ`Q0me}ME zS}NTKZJP~@f}J;^Khs}f1w!wpNO>lX^XVs%-PYM_YS82M&>YFK%{0Q}1bb9fMt{Wk8s8I(?R?}#Nojojj zDxu+OtHGl`Qya+2$f~O42nm5pEe1Zta{f@bjc?4o6CxxEpzc=Dczi=VAd_({iXevm zAc@l1zM^l=fmLX(u8cVBCr0HHb%*(n;?Divx9Lyh=nC}3X3~wGPWm1D9XQWNES->t z2hC(J$!^YlQiwj7wir!T5WU%mFoYXpWLS(8vB@t}QzwX=UVeT$d=;Dh$6>owrBT-D z+U~`f?~Fh+HfO#I{*_T3^t#ViKXs;%)L{){z|;UG=Av&H0+Ch9)^#z<40n8tp4#lq z^V@SWZn(~5Jv+#MN|#onHe3y&dx?Ae-U&Rh5pirJwJta2nrOs`(-SL(gtf`*v+_2l zU=D-?8ynw*)Ez*R$32-M-}7SM1b|yX!?)7ULpm7=_D%qfpoy@|%o&jo5-}yhNB+)E zmnuq#Zi~EiefkSl;2rHX;MI3O?3ySwmc~RT+r(@oQ71yE-m_-?74dy2ySXjm@%C2P z9j9+);l$7-82TwW%{7k}dCX&`xp~os&ttOJJ=`>;@l@6>WTP#*k^pBpRTFbQ~}| zo#uX`9N)A@GoB7@zImFrC&__R4+{PG^L-Tg0g=X**_!S24%L$ZXrnH}N|wXdN#u~o zfxW=_s4cs)ZWu3Q;UaO;37n!*h%VDtB=7I_%6%{5o6VkWvq!B8IOZa8aiPqE{_DRNfZfH0um%H-8nvThzQS$IbwE8B9ViTX<+4?I2oun%m7ILnSw`R?w*m=c210sU>R@zWt&UFQBo8cN0jbIClP!K#Qj4Y^W>SKb@4YZ`Z zvrjb{@)kk=m6IKOrH%^T+FG88k8hIsY-*XrLM28hKc$OfHH-1Dbe{sb6mIg2#YYU4 z@-}*T{F89uUMXIPuviM)t0N-@ryzPUiG3-(-|_)x8FesicQCKyZdEKkXWP1Iwx*xM zw$DoS0m&HVu)dz_-fJt{&D>JP2l6ZxWG50ZnvI-3tXABU(bj2m6(eO)Q9_GJG2M_o zOdn7qM+H*D4G0MMaU8OKh^I?M#!e{y-6AN+^E^gYbDXST5RDAE;?bYGJafac6^L$s zU(vbN$A0xc1ELN}g`ZYO>l3ishP94(JG2#uP10R0Y37F9Gm}#|d7P>c`KZomI>~P% z=0{U%-um?TQs9;dkDXUL->#S|Q`hTv91pZfj1}Q>u{*DA>m&3Kq2HU&sracu&T*zo zpXgG?okX^lmZ0cK?6ku7KD{dJ!V9E$9fo25mRCWPV?YPc7FQx4p5)NTrkw2C<2Gco zGOc9DjfL4uCv4!Me$M5iLP@dIe(IFQwcQ-Tch;sCxPC;l zac?gc4}H$yCyjt2*-zcMcybCMX*927vZtp{il2J<)64W4Z98H5)ET-4`LYx3TBZ#! z#GZO!Z3KxXUt$Y40Xq&ek*&8}cvGHN`cLHxbqex3$L1>75>;MOx{ukI`)ww#Q&&?Q z!MwXi6qrpT-l30>$OlnJ1ZmXUcuoY5jtfHR`tNdiVn0jBW1bq9f2fImvozy&H$o6m z&h`7Ut66@6JwfGaYBJVGx|W7rijYdE$@;=m%`&1-Zkp2873~Dsxg{!hus^Ec%hk|rt6k@HBZ@)u7)N{LxKCl@0 zht1YioPUoHfPUwX_~4J=Yj(HV*h#FnZ{2SD(+*UQlPLf5L3mR_NJ}Z~W&Hv^bZ{Nh zI}w35x})L#xQ}E8-4fI z!wHbu<2r8+@ZreQF{Kuw!O=R}S3Z#*qegJx^0-#juRwo>W48emR#Mz`kzwwFYPSa0 zluJxhWJyQ2=DnTZf;>jmq@5gE)gPVjkEkpzVv;@Ny<-$>K_tI8C6AkqvGlp{WjJ&Z zlyg*|+9j#oJ8H#d%k*nuTe`)MAW;gw+kd?Tc>)gXlNaCJv!Fk%u@oQ8x29D3wMqLa z!S_-!I98h|o603@nl(n!&6*H5{_F4=$_Dqeb(n4ycPFr7e>Z%0-h|TV31X&l_VoI} z>DKrRBFMwb_b0PI+P39EiI9>(w~LSS0;)mCN1jgmKyl}8sFma_TSV;jzHF$tK>E%( zfI&~KBh3mAQOzu)a(AphviB;X>*su;3|;^NMV&$0v;A(s(w z(dE6S>V2ip(&~^DLY2bfhc&qq$yDap_3Bdc<{v%$($;v9l!pllvca+ISa-auVo%Ps z%b$17fQ^!ufD2L$B7W~G3MuC?`3?Nn~vsqW<^Lhe|ZA0s#L zd^uW-ahT1{)c2h|KHqmkeWf$agGdhBfFb90aB5jdSQP-G5?qGlhGw)lEC*7%?>FYK zW4yhjcs5_F%cLZZxq;1Cp&G4V1^PUsImUt!;I*m+ow!q44Z*p~P?8A^ zcz6x3E_>moWW_321~H?U3q;`v<>V?N6L9GMe4r70 z_Ag~Kz@CwE3nYz#$?9FcVJO3lfPRr9uqxzQspSdd=63QokVREt7$)?`13${A0q&~2P*KUOAg!Fh-(D82~Vju zw-pKgQ*UQxBuMq)u+AEE>K*qnw-FWL7!#gdeb8kQ0P_OcTIYF`Fyhi8Km{h1=JC^7^}k@D9o*gzm%3}JWyEI;!ug$Hgoyr z7}xhWy?zzTa4Pr~l*ITxS`hczs{in-)r=?lM;u5Gh#FQ0;61D0vnT_1ghGJU2TOfJNXLqy6CiRP(qbUBsU+Gl8JPcHpe71B( zXr}WcUR!Z3Ebt?_bS3I8I$w@!{}@o4n!IksO$*#KIu_Z)`>5pk<_owMG6*AHQKkqV zS6W@Fz@#{b@_v2@u`@||b5zVjUqDGu&0y6^@{;e+I>*}vlIhOLk5>D`C!nlTNeCL< zRhWauWw40=!j1P1z1iDMX;@euSBALs!#VPVZbzR+;$xg*{)R*{e(?28cUBmDmVu=|)o|e6TsQf$zLv<4Ba^4zIkb?_m%3 zao+q;U6S>Ql?-wt@jE$QUg6nt`qtm@i+u2D!YT=QF>qMBrBVo?;2<1Q^}mFIYUdZ zO&Cb|HY{d1AodMj)I5m7;`nu34&PhN;5I#C-&!KF38*6Z7LP=&h((olbL|xfK0*Tv zemvsJc3^iKzlY{QeWr-O>fB%^1hudR@+gG`_sRLmf={*_nC)Luk06?TZ}^X#2Vr)D z)-gdh6$QtxJHy{IfCjb-DeOg>@W_PRVLnTMaq?JU$=j$5zQ4SIZyxAlO*FX|NFf*r z(gi;_Ga^~W&O-+8zj8ZTi-lHozd78!a5h5SF&rCM(`k|2DHvD9bWOPBDziiNL6_lL zn-~F5Vj+a-gIK3cY~H7$PEiUnNWpuO)gvhC=1~=%o~z`l`E^^QUod)bl|Q6s>P}u9 zqS#z$XAGdaJ?Xn>gyBzX9H=dU?Yx3&)azAMa>sh$Zh2Mtnkf@}dv^W}{uLn4grd%S z2f{m1M$u63wxPGS{@2BFt|{!sezAT7T$)5>g31oQLs%Qbp@y?)^%9<`wS-|ja?iXz z4wab3@<)G%q9Z;qQ{WW=)lcZ=k!QRlA*o5S zt1E{Yeq(r*luVN_Lk59!g5kAkSJx3y(o^e4CBr@rJFnCSpcZ?SP(kZLU*?+Zh)h-C zjIz&$cqOPoLb}rg!9JNW(5Z@>7JYH)U~lw+^J%rYS_K%Zh*j5E{|fP>9PPCh=`E6* z96~0oyD%$(gSsR8VQ`gzzh=$EVSbc`-1_47G-w9XiQ2+To+K%kxS@?tsS4R##`Wv( zW^3|ly- zoDW_)3W;8<_fSM9Z~L|2?5~Jv^e~0`8p?@@d33f9@zjhPIzIIYir#UJUVOm>6erjO zMRUq@7KXTQ>i(wTENFe9oB7aEifzu{EB#QYEAuiAs!Bu~i&ue5=Pur$*)^KF>%j?< zjz7c%z6hDveA4KYS(o+hI8aFzchKLs)$DLsGk&2|Y3cQuNfjPYvdsj}3XZ_>H)5TM z3a_XTkbrr9jreh+S!3-_x-Wgaok{^yl$GhM)*ot*gnN#L#3pspd>uhGW$}G)B1lxt zcD+<|y4`c?%g&S*ulJhPg~svdwy^Y;4tK{at#zyH6f>Xg=80hu+VJOw03FBZ^up3jAfTy=QuH7QY5)3VMsVFb`IEMjg)I(oUx@6p^s6jLqylv61+s2%NuI}$3?e7jMfvymqakp+j!OS(3i)C->91f>cr|n{ zE7!ekms;$Wr6Y*}T27)NE`jdR@@dg1CETOF4Q!|ytG#8Fvolg`q8K;N1 zEK7ABGOn8X5Ao341nZn*Gs5XC9GYN1AUc&VS1XvQ&2UVCQ2pQnjY%h`2E3!R*{|zB z^!mPc15s!dR6FJ#C4y(}49MdA(_9GNtN^Vbb@B37pr+vk^a`dV;IHIJ*!QsvYj^~C z^C-07FJ%aN3Gbh7DaK_JDV5~a6+ThZt9{r?^h zk2>!Ce!pI?=iYBeCKl&V%!?taX}jp%KI8X$snfw1gHh54GfGV*7pka@7q5(dl3B>$ zIuVSrzpe7pm*dw`%D1~1fST4vuKaBeQ>Ue-e6>6AbHrCb)dccVa%rq?M=4a5$t zGD+v<>S$~PRnjsT^*~8GF>0o(Txi`j_U%n1hEQ>B9EyYf>>bf@2o$0)^jfRcBSIK|=Gh|> z2Nt&T!HaS=hWbx)P;+`kp}13|eszQ7PGI~}>kZ-o@s3fLDDBm18)4+W!>11Zx$peS z=`#Y`$A9Drf`R_8L;@b59^}`~E6}?an{$6TKntd#?rA0Fdra}DXfoj=>!+R=xn7=< z_|^cNc;xE%Uv7Xhw_yY{4+wb?)W=s4cwB8RhNT0MrDOfhN|>}CzVqlxon}P%&UGAz zDU%D*c}GypcgAVk4lQg~Mvm8@&<-Ehj(2{xR9R*_RWGko7hbt@d*xpQTYK+0`@Ww> zc*YMy3gf}N1fjd#ZU*a^P)Ukf)ya$fpPQnw%bV}&Jwc#CgV8;?S}l%j?Wcn3k@e*! zJ0qS9^UTe*g>%u6OxijSk+Oz;7cJ5)YN?DReJyu8tQQ08G4;8bt*=*`SS-Yqw5TL@ z8kSTJ_5IgApUo#Z^2s=tUxM}CBI~_VsM}a?{PdNQkKs)JvzEF=x7k9~>@Ah&k@n)2 zS`Je@mU@7O6mM<#_!|u^Pd-k#Hs3BWjE9>YUak3ne>Q57)?OSKR z{gZHd>(>zzAI={~C+`q@x{-o5W8obB2wJ4m>1PI<%PIw^(tw&UJERbTK`Y`9xvp8HFtgGu%h<5S&D4P_9J9n@zv4ZR;h!pvpJlf~~!hl&y^ zU|8oR;9Rc~N2bxEXHN-I2PnE&7tbl4+q;p4Uf2#h=kh!J&-LLX=X=y8265$tCF3(m z%K@8WMtMmORadJE=#vmay?w-yD{JTg6fNBj6&XNO^_qO4rwciCdGD8NZyq0$!kmV4 znOqUYoVQ+It6=oql(RVNJ{r;u|M{JN`NtyRA@#Y``O|=??^pI>&R{B{vde_)U%Rs{bFoWl@xnI z^XukP+phSL*S9bfpMySYF6f$a7mzG#Dh_np^+Qel^_x5Yq~Q8HO7Id9)R{Xw!{14< zDVJ0xGI%y|NYIcLF37|qq59gn(|$Hp8-UdR5=0{oN- zs@aY_eam#53td2QmE=N+haGO*kZe7b&hh;0%1qlSR+RQkKUA3i=2FTT^1h4I(eM31 zI@rhFzhaiVjvQ5z)k@C(djGxOq2WC=Bz?L0^&}dji?N04+v`WS2}V6?5yo`L_iCj$Z$1Xm}Q55195BCf!JKqN7<&2 zyJ<+B2436$QdV-?_?qHDE`GrKDWrj@6m}ruDP`daSa<*32J@uWW4{-$@nQ|wxZ$-A z&*UShI|e%597U&dye^rsk2*((nq^>P+Th|3w3?Ssl^iiWBn+lO?>Va}o<|aSf?^ip zbkCjVi@MNyD7C9QzijL#(8R*^Qkz(7VmgKuJ;=o=Kn3&Mp%J2D7i_TqEvo{4HF$_< z_FZu4H%h$qDacVIPZ}9v#qY=BXh^ZV%fEYFfFYg<^vga20rU}ek*rOL_OzYifvmal z-ekicP4$qfVIAVF+2Jr&#gW`WuC<2{T!c6KSgCoI&?&j4)tEzEA+2@ zAz4}vqDEE`08)HTYT?nF(2AX`oYT$;|47r2zV0YrFHi&|3Kf^aCR9XW69;t!s2{Er z6o1ChP=mjMz>LX%;kdB{X|k|3+T}w1U|=*a!8%8CRm9Emp(w3a0wyed;CJ^7;IFFJ-igavmFz)L-S{i|k*|9U`2VQjMGo4d=?_-M^sl;d-B|kc-Qx`?-&-C`H=D z4SCUy%|L>T=ha`GVCvsvFF;lI{rsiQfn0dijgyClq;t*oU+2m;LX0CU&D2?}#Z*#% zbZGuKd&{?0NeJ3Lz#`%C4e=#_TUwx-Ey!K<--Mtd{#(63WV^w@ zRI(r)iuTI;4Hd+gO%Q&5B7x66rQkhQ2$P^M=1Zka3-L z<<2B`yDoZ{UnkrEQr+ucXt7^_%Dz>RU9qLN^VkknRH0)|Ai=iQ~oQzFos{u?@v`1F_fQ zey%)^2G6TL!e-sH04I5Qq^2w-)rVFGtL9uDyPRnYbH4;D+*whs`#abPD%*sHZ>Osuu-GRAH2XeeK9PtO?&Re!FJ?^h892@wf?4 zXSiDxk6>~l!0GV&>vW{;PF`RUXYg2LeSp(hDj_uxCp^Zv?vlbiR{QvPPsANtj}C>i z=rp)1pTspWCgUVGrCl=z(t&CTTHKe-K*5sl*K7UojM=0N6l1nvsG%4LIaetGYLsb# zbrYshLEMCYlu63Cp zM4%Hz%6D*-QNeov0X|~hzd(eNp?kDK(BC7&>%UHX06|hb08I&adZFiyR+|Ycw7C6? zkl+GBIp&HuMsnfK+;inICY%r*ib<#yyN*hPMEo&e(n&6CS52~g4b=!13n(U}f#5Io z_$!lCXHUv;co(A;o)PsvD!8htyf#ZnH97S3Uq^4zVDiO38fFUVg;kx0jKJw3!Fg zygj|c_;W)ygIEkB$SrIasJ(KfyflE9aJKf-&%@F*s5;fK$$w!A-s5~Hg4&V@#`B9O z#TXML-5~cn-S9_TAIDq)52;!S4D|j^4YV?v(s*gN(E151&Z4!Y6QcvRM{rn7QFG*# zNvFiTtYb+=Aa#so1pWeFRFpDN%PwPiD-9d7oFuNr)PI?!w}3!cU`2^?ZdP3Pwy-&@ z$tayYobh%1lp*3p<6x9q*QB}$w7{vINc8*H#$8NEKwZ_UOcv+(o~r2(vZXRn{9m-z zE5%6AEE3Fyx+~YJ_6BTCk<3(_PAQvdt!T0@gfLm&A6~~9<8^>Gr;dH0BDDXpDQb0v z@KO$JJ)0qvoB`CxtMDg<48V}46{^bU>7a$|O3ZS*xEfQk$D!E}HNtCJppw(ATi2f$ z7DGCvohx!s5zlHd#iP--s`>j$MFI~J{^0u?{s^LrWS$6p%LteCc!CtUe6PqLofLkY z6_s7~io#{BfDd=cl6(C+iU3;LTK_;z_&GSq zPw-ukwDXm1==1<#RMWZYu5}_M6(bFW9(IMSoDtM{)d*g~a_uikEyBYdR#e87-~CO9 zaBxwi#9u}P+$j(qu2!l{c=@sJIfHwSk0Q0wv|fkj9U<#MrUCmk5BQ`ft)P3Hf;2n4l^z4A7 zHvMc0O6U5n=Nk;1P0w1Zx1EgYhNu33AxKyk+uYpS1`EyDpSq~WS0i!T*7bhO@no;5 ztJ-cp^8e>Q~Ma!AjD>W_=TBu6;ma z7Ax6S&bX|B#w!i{H5auhp5m4mZB_jC2&(f$d>A*+Q6XpFp|HbtXKiPWF+tY|x7Aq_ z0j2B+YQQlxUd1+U!!EXDn|#J*kz2`Se;9EPZ3Y!gK1%7ex=yFEqNS#0_Jpco+wMN* z`dve2N~Z;A$a z#V#l1XfpL1Z1;QpfD%r2zHwR~h1=t`al8Z;Ne*|vuP@)eRo15b#7QnB^+fSf#>LCy z>B+jKMis7o#$a4R z{jAf(GeW2L<*S>4qa7#L4InW5lNVwTx5^(l#<4mLrxVZZEicrPTzT*aL_q%Q`}AL; zBRL*tH!Rm&9gBcVe|t)eQ?r$}8LArp-2w;AGsfgwsYa)o;Nn4VYgg_Q0Sm5@9jCjPb&f$q4hdG|$ zM^1wlYre+(*_0J+S(E;ipT<5W@z9@dzb+Q%eX_L(+(7 zpc9&*IPHRRIISCV8v?2w8#jj>RUGh5L?_26KnQ!kd zzJqsZL7aMQshIDnz74vv*je$nt=9Qm+4^iS zis(9!(&VSGKRU)p-?ghncJ%*?g9+*M!(+B~5my@aU0F14h;n%ty#I9sm63N$nZ&az zHk>+}CcJmbMTwwLp##*%&OErG)PXogs`Hf-y1eE>mRx(TZ;?8Mtp^8dxz(l^$Edmb zh&Y+NGvNRS$MC>S(o|L9|8@T+xPQ#+i4nH`J={2GlZT@~1om`YqA5MGLZ{|`7eqIU z3Xgh_v_nmdf>BozmIKU-a#_(a%K?1fI-Z2zFRXNa@l65@#M&sNTxm^XfIA$w-LQy@ zyOXc~Digjrf;wqBbd?FXMJ{~XQAcODJ-Yg+zy17hS3CC8Tp5t@4)m#8;Io^rES4co zKJ^=C*<53{b*dpTCHxt9G$}PQ8}^7BX5;|rWty8V%VTe4lmIo8=y*m1Y-|PJt@p30 zKD-bmO5N_7g6eOpXBJ&IvUF|`SUfjnDZb9pI&+#92=)7;P!Z&2w>uB^C)uqGYgncK zH|CsATeK}c@J*}EKiYI1NQ9zlvb}MZ7nJ6Wx|T(;$b~yTqaAf3p%EBDx}MY82ob~r zhVWAClBe4al4GieM)^~A09cZg=JcwiBY=TgUOncY?Va_lB!;k-7KF>^%=1UK!&2IV?#ZIfOby;0sTW1^Atf% zvlQH7eF6dajZGsjZC*?f-N)ZLD8kV~*}FFUq_?!#Omv7mhcr4#Jj?^x*HH z-GNwM)E#)UvLOJTr|*;~^FA8^lpKo7bj&j~nBgez6 zD2FI3g$?XVlkaUBu_S#e&I&5Qkh72ol?dgweZ<-)s~vdnxLpyU6-0AKx&OIQ87;o~ z%V3rvt6K#EIJSLtWx8vh3bx%53+ixo-9igINHF0kMhGxd z=6t5R*%|@bM{@a8iw=Bq@^L;A1Q7+*JHG483%ppae)lF*d&*kIQVdA&5k~fb)xU7X&kud&Ca``*76mF`48AU)b;VA7@yf2Or@(Y zuDiOlp4`84QClxL_j^drp*?+-NyHUh`~PI$S8pjFsPi}DmKlT@2i>@k*EcI=boYh_ zZ>JVFznQza-V28!p9TT?W=g<$%`xxT-A_FOiC8=j9m*qQukMC_@D*2dfkXG}WvxeR zLU9^rC%s1%46Q`5oYg=K;lugy_4oqryc&Mq@$rJiO=ey;I2xW0qfsg3X=eGoYe&y@ z4B|rm?zBNfmvBo#b=2i-dlr>G!rgcOQp{J{P79hCwtdjeHr{2R^f27DIzVjs$? z;&%NOMtE&>o`MK>+xfOL5Zp0|oZYZfIA}h3#52*NB)&g|Flxk7EHC-$chNTZ_j`8n#alWo7ug7-5>#Gtud7fPUP3$1dtr&Prg;KS z5XKG-*Y0OFy$CqTC#RiR=K(xD=ECzP>(o*)3-+7gJ7EZp6k04`c(!u8AQu}AiNE+O z{ko^Xb95h2~AVun=@4U_+ zd#BpxP8mVZ$i-Lp)~_b`(Uc|0mbx9IEc>DBA^({I?$fH{-S||;M^pFy=i1ve8c=oh z+$}*N8&M-nv|g(L=Y9LgfhG@gz+W`HRIpac1{lPLS&^Ssj2MuDepgB3bxJ5tT)Qau z-AnYWAY|a+Z?%yq#7AS!G{+Xnv*DwyPPQV`vPcqTK2{Z>ZBGa4U*}yvsr2c5XebDJrrSO11V!$qzdSCPiHTX?K+Fk?=T2XI+s$|c zR*phF<*Tn7Nx1rO!rT)9?(cMA>AUxEz?29zLUwqm`!_=w(UtA{Q&5Z=lN(79yiNrH z+83=(%`C0;<%YRK-scfg>8fQ9=?eP;fqzq~y2;i_YL{wW)vu9$;E8_S&bFoYOVVc@ zpZ{0=p~$Cb%KY}GG(K8=iv)z>Rlg=GL-muUPMS#=QfR88<~q4Rp8JJ))P2)4zxf0v zBt(`9X*{@mtNT(=sbR41c1TBt(*8|HUZgwlk8H{2!~HhnN=Ob*X?OC9MB|0yeIY5? za-X1n?%zV^3fq^Ci}_n56WhldxRJi0b?pL9Sr?!K_f6D>GIMB_Ss~if^(M}Ce%~imSMI(X5_bNH)SZVhpes(u{L1$f z=Ac7~hqABL6|Oy4oKDp5qf*|Pkc1czL*!1HqQuCz87GuW-Cya`p`L6P{INmcIHf)P zv23VYB`P0wOdy;3N++cM?pL|#&`s;=ubcIJe?Z7m)@rSWZ%u%Z9cXsk4!#T`(4iA4 zz!7Dg96kaP6HU)&D#=fWqGvAnGbRrKDL+PRB!wilh1Wh<1&Eq#fGt|gbsDF>Hdwr! z40~b1|0@O$39(&W$~#K;6Kl>h94-3eY$oo@ow9_~VC`(tK*lM&&Jy zt|pvBAd-bGT8`@exbz|`?n&t`I+V~^vxy*7IYiB;&K+k|Dzi@Vg& zm8xAtRgYhgz`cD5Pxtr9omdzLXU1Y7!v!T7zRtaNGV*~qU!CRqc$ zeuOJFWkbtO&Z1tLa`O z2v`~Pbl=vKJ^V0$BQ%eG%MK$b5I?OlOd&Awt`i)*oAkO(G4)5ibk$_ZlM&zMURk8| zOCM(!H{;fem^^2hfWW2A1fi8|w$W7H_XQm(VcTK*4G4XNO%$@yjW)?IY{zV04U^DL z-1Fiq8mR#%m(pwtQt;axL5(IsImU|e0Lx$S14BB=s;)RkI)0>vo4J2prFmZI{zm35 z-*KDgqa5A$kZD6ij7DMvU$uxebfGPr@S6>hr?K$h=-n_18PzoK&m^M-iF>Y&SG!K! zWHI!7SS;xIW06Dmo0j2^*V{k}>Y`T|I$Nmh(|t7JI}Tp(KaG}TxE}q7-vBj1^vgBf zG2a+QvZ&q;am!l$@eB((f5{d|$uMR(i%cZYi%b;~?EKQ^jcTK@$bza@Y1%?#Bf`&fHc` zG=2sZAAbjbz(dMKC$p}so^+j9w6$dFEL__BbA@<7mAb>qK1qd%Ksk!e6MQv&@h*e! z_70AOBTSGvuoVr&Zt&Ang3BvEF`j#l7grNv6Y9Jp{a%y(-hJ-d4`U6ixueDz2?V7d z;UM9ML1^1GNk9RRAJ5UhP|Pw<<~Jc432-a$%65l!Us$?!Yg6z3WyAM#rei0`>>v=e z(KFJWFwK5?MTC1-K3XT1#dL$|U^II2ka?O}rCR>d4NpNRrnO`c-}dam4;8mNaot`fX+r+(S{93JU-T+CI4yFuT#OJ zQaXZ4*b^fZqPZ>RltM8&h!b?J3Rt3f@A<(*Hp^bLy(Mhiq;$9^BzSWwyI0gyW|0p%+ zvCvQu{nYKf^eNu&zz+`@UoV&^pk8Wsk*!`BEyF-xfR}toy2m6OdGT)7%}V*P(el#; zs7#cB=Bt~3ce5Y+G?vemdnnHQ*{AFVVwjTTUAcqh-DWKPeKtci;4NB2Q&I(~c~T2^ z&Ktm()Aiwa2xXQs^~jr+&j}Xn5`h2NyB=-`3AUT!6dys!Vl*f zGkUAuYG}v|9Ya%Y>f$%Ab0>v?yfPBFP?vsX{K?c!2CIwyX6GX3F6;`|o37@)`uOFM z4k+#$Wa$up74&fEqjcBc7;lo8KB|87S%mbuWYH;we5TDHHB+i{J{sT|Vo;fCW$G}| zaBrYFhL_?TQ(vl>Y*nrLES3?M|7-3_XUmef+f`kcbGrX9LH0k8GjimwprhR>{d$mU zR(p$h?%pELYn`*xnXc`(U)M~pzH@5ZPrc~_B_T|7<58AZD!LEOEBRk&ZQBZX*-w~X z9{>V8pdFLyk`$iOEqtoiM=tswL3jygnSRmLlGF5*8&BL8_TaxNfoKnOSP=#f)bI9U zorE?T?`L)Ok1B$>Zj3ro4y&wG$Nd8f&28@gJtf= z*}Ya%hEL2E3Y`Qs;GHu<$!(uod1YTO9yQ{6Re$)@dkBVy53C2+3HXN?jU#(tYAct> z>iyDZeM&~}L&P3ITTV|dcD`KR(DIU#Z;K@6G)s$X2Wzw6aT$j0_~JIR#sCcIM5;2< z^0KDz2r&1t()#VsD*gP5g)tk9HZ`!ybl_+Ar-MyV$C zJhg>Ti)#|L2oCu+*1E4y{o-Lhg%YOw5!JW13!yspZByEC?v+H6hhj=^^o+g|@ioa` zeYNYIjJ9JYtf*<8(C9%Pro5>uSj6}Y{l|I)AEpI1W zAZG?l+ro}7W_f+{YSGX4JsXtz; z8a&1X1@OU0i=A9TFW0l13G_lUk%3fMy}c_{t}9*JM$D?;{3`jP@~%2b>IF5f)YsyA zygH+MK21?+dQ!MV@HgK(PC5~#PhAdNfkNtSJJ0}4``|(K8cL~eowYa{#lO99Z@=LJFY{@Nt`u{*q&Cxe@i$#Vj8n0J@hZ!${fU9x8KsdhEF|qP>hgNiN-0~*h#J+isf~J3I98q7+*f$0gqeRe zhvM5M5#{<*;tkCvbLU|6w-4LBZV)i?c535&)$gg zpE*!dISbPDF)?JL;;@@zo-Cj8{MF9WUA*n9&I)b{yQI`K`-j{yv&+G!Z?7EtIV3uL z#L|#pInVW7E!H_)qB%xcfCmY2!x(I?f5y0=jXMVY@^=IiVHzyv1yk{sH%T4a1I3pk z%D>if@Y+QPOo>n4@%BFN(`Xj*=DA_f#pXj>7TRGT1+Bhj*~vKWqxh0vE_ru%;Lh~j zz>voH)RzAct3?1Q-1dz>b!_D0#qEJbM}^wYzRoKg=Ztkyxzzr)3qMG4j-AR=f^b(&` zba_*Z8S+}_AEkNqtKpHg%1uM|C3vAkg95y}qx=Jpz=c+^>12Pj;04@{svB;HuDsa%oyT76#e%NkqkDd8wmvGYM-J|h zcrl_q5HH>Qu)WfRnOuS$LV3MbROQ8Ee*gUB?LXB&df3=`Ji70aFNgBIuGx^<6AbDi z7$yOiS7I+a>iyozk1nD+G>;d@esthG7i5Kx6TUl&lkXiW+d5iMxFA|788Yw4LcSr0 z-$Hr0-)Q^Bv%xXDZvE@0MDI~bVbV=Mg*!Yh;!YA^xVOCjtiMzoM8dU&Q*PYVE`QpC zn=rzE8Jcrtd+wZ@j@$Q5SDi1ZPUeg1`$pT2qHMeg?1M?Le?Lv(ar2b(Pp1!+$7YW|QV_~*=ysEi_dwNq6$B(d=S8IAruGY9ARQa|Nc4I z&qf_>mXeAY-e;~mY#b*ViuqW2Nrhp{Je|n*ujn^#1b1KH)p>+Xpm(`wCrvlN?qeY< zHSD{q?uN&0+9a0{?DzJu z1iNkMvWxmXl?rFmc!aK(Wy!ayU+-hdJyzNFqJ*jF{S7}f3Wc&!S2|{}?^>@^$wvy^ z?L$0nA@+luks0stG%Ws?d0iPW2ieUSCr$1h9wT}UR2_6XJlZ@Z%W&DsK5Z%7ZSwwb zhb`UV{jZ*uS5NJs{$uOSSMCv$I^cG8QLuGDfBfQrT&5QG+jR=J#9R5j5k^&Eup&xb zSz9Sz(c+rD)xHBLl-8vn9c@(xx*c@z6@$8(k{$|$fsYszZZrJ%%d2e>{zJRzsVbuK z-|qa1LJ?5Np1sf$J+ujD4P*PMqvbzLy$$uE(!vc4Jw7sGl#DtzWr1D0o7DO&Mcea^ z$DQ~4wTU*15htm(R}1WQpWm+%{bW(1cuj*o*wnGZ`jjI6*i#EVHbuqRwAr~PH+pe{ zy~X9PE9NTZy8C8W`X+ka-cBEpa8H~QAKh`f)BXkxS{7UW!!>Dj%y;yiiSNb5nynQj zr}~I)Uy`COEcV7PI>#GNe@s1pFx|aY<+Q`*%e&aYoPx^46=C=q#|V z@R{{r^^%SMh`7XC=)zDtzq}B^YA{W1+n38Ea_7ruzVPDhuLEo^>`li%MN-x&%y@L5 zM%>j_fycU={ES(y1Xjj^VDWM!!V@$&0YwsU_pTOLaBFMLDmb;RD zeyXb943oKd&w^1c4Mj`feIBYJXhu2oZt_yk{z?4?Tfe=hijTbNCHv0_y-~%JVaK%N z2ja#PC@K}KKeY?4KOFkjc}JdO7a)QlN~4Cd>=Zk&_Z8-9!-H;Nt|xl;N))0jwCVpO@0Y5w;~?Y-xb17KM2Xk1A6HAb8k{!s+eikYB5*=dum z@8>dJwj>C1k_~9XP-!{OX+NUL?K6xo@_4V8)El~8-i}7%(mHXlb^D7>Hwfu8x!>95 zV`T=fo<2I(9(8f+47m7HST$65yKNCC`7Y+95JfYS3eJ1+ zkcVi$1YMhT)H8L9@X2yNITd&E7Bqcpz}G^>+4N*JY?HVawsP-EvH4xcjPJM8H1-~Y z=6l!|fBtJbNem7Bc+1y-M;sALWui%yCH;BE5T4ZAO~8Z&Ulgd1q<8u-UnMF)WvJM4 z%(GDp2UAvi+3WFO627G`a`30(fj)A_msw62Tsb z*|NmDhst_?Xc}N4yt@Y$j;yIw!STZ^%?GhGr#yPa`ue<#Q}`bI1c(#@L>ewT1ri2n z?loB0biNP+Zksjp1<@KZt?1ob01{ zMrWb9176N>15>+d;C%3xdd<}M@~FD3lLK3|^uc-c3G zbn6b2S|N%`7A&2!JA@g)9oVKNT>g0M+(Pe&@_@myY}lARz*A!mHN(efPS)p-Cz{M{ zUfw>txuzt-jti3xq#n7q&I6ZroN`Eg()s+kc8Aj+qy=~FX4!-J%7{m+sVcyyVY-Cu z(aneX9v*xoT7rj)60#RA3{{iLV@HEgXS8D%@%*xz+%=?X8Xw+b0WayrSkZ@}Le|FY zN#>9$jLN);f+e2!CBM~`!&I3dn}Xvf0N|jA(d>5ys$xKxcY!dK6n!Az zkEZQt2)}DypQAO3HNd|DL!ApAXx$IfOL44XE%=YiN)aUbTfN~(=v4xWO8V!#SGI7lL^zn&(@4k{e5N1z zwTkwv-xaSQx9WgIXwCuN{U2z=0%2tlier|y56y1nls972J#dlLpx3EG-i&2eAF2INdV5EtvsRK}MfnM%ShMtX~Cmp0HAViMASJ($? zT=3NmihXPM>>XVLrCqqRV}N{y3e6DQGrq~BnKX)HH*J6#V^#tjWq3Rr3KBG!AImn( z$^4_=x;EN`eYlL~&(g3&qCTPHsXu)rqjUPC5oB@tX!1QaIGt*-1IpmT~W8SZ_;a4r;(ZTO5 zq39v7lvHu7vRztiBsA>`t_A>(XYV2K0rBF=_Tk0m3|XSV$3XovqcWdI_cN-cQ&g=D z+ZVD!5|WvO5cJ?gjiA2AA7{LDvhZ8!H~*r0HoQ7aK!?GP^?_adMP0Jgra2VzuMaY* z6#<}Ap5Lj3>76kcqgBE8*gM(PTW~m9lsN{9K@2Uze=)3vK77H%0kRN8rbzuPpwJx6 zmlW1@D7vPET(p(k2(roGZDJhgFduTr`C-SkQ}UmLjbHIq0o9hwi59V~-*qOM?FsD| zZ`fwo%7I@}`*_2yqLQv#U zk-fUo?lAEeR(&>un*d=ti48f8H|60#iadG;rk90|}(%dMt`8jqXwF^-6?xmi{1hHV8J4ZD{pppC4V ze5}k{LF&_%@&K4o#gEFLll%!AoX6Cf$*$7*1pk%3B*Flu4$4pK*eVY?^7h|E(UQ1V z)L22P-6mN}5afNF;x%C#=V!U|p!SMD)1*3_n7>H4l_rU`6enO9r?;hCL3o&SUvz2u zl#(usJD!mPf$T5r1SHKG={T!DprR(w4tEe6(9$IbWKRs8vAilm&>4BDr*T;1F>=B* z@IFRG8rN`^i!2E(Z&N#8f#PI!u4RW7uw2ra?@o5un-m;8mLxUYwIBYI%=72gYP(@KYd{jiPQGKRq7yx79<*Od}XV(E8rkzhvYZ2l*nmqbd%eDrB~SC6A7 zd%}Xf5Bh1r0GxbEx;y>K_>ZIjX??NBD*9i>1mL&)jj(Qh}Y>Daz&(}SmK=vqN1l-hNQaN)Pm+5=dPkgu#D z-)*Z{AQz!28phT|Y^-@$uo=^U{Mn}Jodd`RmHr~ToCoaK6i@|$y$L&j1LOhe4PQk} zOb~s4*CH1*W;S!nG|EZFkcq{~0Rh8TUWC-Z!`l8!iFlw|tZz zqy+9%zf0-dt2md3$(R4VsneL#orXk%!Z=MwrWhax3roI_KqE!;=g0Ti3*!CeU|Zc| z`nw>Nva3-^HLrYkk5j!=G#vO~|6%mB%n$^7(0v_e-e1NzcP+@`En8%b0|O z;GAijHet}wu!z|=ElZFjj5MMFD8;t)FJItsDYBU=fXp;fY;?WNdpm3`n0uU?Zk8Z5 z1x%RGsr&8RD&=)2u*@O=x{mzR0brz3!f`*7A$PsqnBBnV{@4=*zyQgFDouCEy^0#y zfK81776BlHOj5x(I?%ScC5IWdq(QJk)M7S?4b0}Eu`^ra zv6NS5_rQfXRf@|tg52Xs6I#HoMwY%H%zf0SgroSMe72jh1L&q^Pa^%Gl5wQFi|=|z zj$p%qJ;G|vroI8mup4c9=0R{aJ77r-g%M1Lk(n+=l=BV=p`jE#09ja>xS$1=QRocd zCcUe`x*I{lN4_GMwKFJUapMT;=fo}(qkmB*d;d<7foGNJiwM-S4@pYbQJ4X`$6N4b z<{Ec&Kx!yDqMoFtyvLE&u zIHx#`a97ZkG?;r>JWWNyJx29)2|P^Cxf?BHewW!2L?>g!?PRbC%Ebs6 z$|+W)$q${W7p8VdrPx5Q6sD*`&0KV3Qim0){! zOR8aXXg$7dRR#dE8qq<5d<)HN<5XwQwpwL1VK$H+_H`_fg<}=AkY6=V<9t{LItxFt zOKBQ_C4i}Q3RFK~w;4l5?6j9^yMYSJNyQTKJbdU34Y<&-N9!?=LLq6NM0B|rH!tIH zpd?NYIxWByC!KNiKky5^)?TpXlP@273bN0DcBpexSk9`4f-y5{ZYc%_$HtK>cY33) zxuk`3z%n%%B6jeWpBm$S_fn6MO3soy8M}25d*t1DC*U<SCN4Fwg-qI=0AD%Rau44f7M=5$N34A_e%lK{_qSvGXJMt&A2N76aUcV~j|F_=-B( zgLe!c5_Ka4J4LC0Qi_JCodpLH=#$COufC)njBJ@yV-; zJhzGa?RR6+L8C=ptb@we{(OqW5X-c8H^ZHJM#kOfep5gQE`;^*Y@cf7D@Ul3#-m;G zRD*!S8`(G`Lsl-8-gpcHyb*=uz5U%$0ILxtW{dU0_{2LSjSDy>P!^08^3ouH%V|1R zcz&!ta7P0Qu~_weuv#D`dEqYKUB=Cr&%lHsudAVQB}|HJJM`@-gYd0b7yZ2;WLj?v zI<1*kxjQD#^d5&k6|?slqwS@focqAkslmuZGz_^(m-^(FHQGGPDX;U%&-pZx^Kd%W zER@qqK>Ss#^i+5W^_%7a>@^A&Gg8BHvWO+O8hn+ov*dpqr4BjeJG5K4_f(QUWh9bo zN65W5g`X1j9G}{@hQuX)oi?2I!QkTL$$WLz$2PO1tPFyH(*dBTee;%Z~|5iFkKmNHK~O0;@x(>$(x z=)mrna>o}xRlm>%yWe#&J~v0?Z!usNgiY3D%i2LeY%9l?c7KbWx7FI6rPd8JPv%Z0 zDG=ua&`0}(#y*WU&_!&2tQoBMZ%ZSQl&Jdn(vRHKvpufeTLdQ#{~A(WEZfV;H6870 zz0|i^pFJHPh8Q73zu3e;ikVYljvR@wJz6q6f2--KRWH%(sOePcrXD?O+t=1ldVk#- zVImiSG)YU(3}Qi_q6z7&Al6>9ect=L{8HVuh}*)hQz@puK2gWa(szr4(+?{7WB}+A zye{Udak683x0U&~!!tRzS1ttbNS*t9!K1)T+HJyrtN?@A2E-`Wk?jw{o_8VV6USMF zfx*1^ldF?IQ_Zz3jK&J6ZjTl5dBDu}6ITXR0F1TcpZ0tH+|PaQtZa$xxAD>+{uhRs zOLMN9QY$yTj3`1Z`MkOy4)QO$j@6s@GG*`kz3G3N8m)bI=E?2;)~a8AT!Ci(SdueT znWky?-t?<_FlHe~HGo1=zJCeN#ZvoMd>&OU+FadI3G>9* zy<4wo6@y62d7jkIq!vv$ssA~{_kCuft4^DWz-d0}o2>>F;qYYhd#06A!^!Smo1ltN z4YhMj=Oq|G1vF=U`?$D&z5kiPnE%9b^`-H2aJNr2HQd=J_0o9jJeGVOqzeCYsvXoy zunM&tvYv8W$|&BsJVyLAAvh+FAzsK?I{U5yO%yk$UbVicfB0&b7YCUDD`3v0F@hj@ zPB}4}P^sQ!JTBH^>h4TArP)I{*u&>?y4&i%rX4R$S>}PNPe-g>A5^WX2EA))KY~$^ zlrYe$IDr3*KSBT6rH zFMEmT0$PK?G@d4lFab%_lAhZ`5B^4=xLED!K-%ta|Z(`g4-4&Wg!%SsDy*T zHXz^ZF%pTyS?wOFkSce5_ibe7`1qXzDNAW6 zDM+U@lG4orDk$9uQi9ScT??WDBHfLEbVQ`X6}Y|$I_P?I=n-jj2B{(IHb+^sZK3OBTYLi2=h)9G#1)0OEc zP2S-_9!ZgTCzXz+^Cb-OsqxE6>1sS>zzW`AA?F1;w?VjZ({7VUbq|_2kY@xXq^zAW z(2XsnU4Wx52wMc`9g)`#6lpPcgG8<{qIFNW(A1spMd${*v7JWnUu-WWwPUAN=v#pP z#6H#}2dW7E8*U48Yg|7_8Z#)qBd0B%Wh}tkD3-?AZ(r_vHr%ve-@4LIiOC2}*|h>DKAvYh)*o&bpNLDEh~N7vBO~xqsWc zJkMGcwRL8(9^G>$vB+JnMYcyu|CH208m|13iQnt>dG0ngoNYg~)^2~E`#$Z`E_KV- zG}!lMkO~)6!8C8c0#4?oWO~8D1L7!RIo^=vcujr1)t&`n?;}$~S(ssFo!_z1C zd?g2d&s@dvR+N6I0Mpnf#*6?s<=u1Oh_uucSmJr zHtv1N_&fxRFxFkKARvuVbn2`el{B9%sDw;xK23b~fMcUNo=b{bOLV5hWU%tdIu4ST zS9@2anZ3o$@k=sC`i1H+-j_$xfxnL>8&L~~SR-0rH_=gAM3%zeQj#t7H*75vS@xca z?w=reKM~zg14aSqH)3h(Amob?XohJt?I2Bhvj>cD=a!57}`_9(?iLz zBqI{++)E8A^^9^1-WMIyiw{g*xp@V@6HaPwEG21;N$?#Kx2d>UEOFNFWE{Vme)h%_ z7%^IdRN3M1IG)`F+~irL(`15B+$0(@+1%|>#Y8SG+8&-y&g&FUu z|N4*QnD@!O)=-~zrV>jH&KZ|%KyIyA`_Z%==2gpAOP|1iZF?UZ!(_&!ybEz9+_wktl;wo18=9mVGvjG1pJ0|A5}wn6&d93xG{*SJRBRRdgAl%}*5;6BWSu2>zb@#`qNr&Ip4>(_1 z+ZulRF#i1whtA;(<+Llc-lQ$pi*{6ZE@-~5t9#x7x~x3G*YKb>_y@PuCQlme1ZJkE zhP_5do!(N{I1R(VX2DNcKI7hj8+q=2a=7sm) z`~-Y$)Gfs{dJ)EZwOY5V9w{%1-v2R+p&Y6iD8>WSm{s~C0o;(^_KY$x%kYTXHvMNhA^FZ%ajKXuKLhQO!YI!Nwnnr7E1u?SaKcCkH{XeD zcp}epNO#OtF*n7%!_y^wGXm(#7SZOyW8Z%c>Yvk?`~Nrx0e+CWsan}r(pfOEY_+*? zCPN>L(vH+VtzE8U|K}NQ`~F^gU!%(Ug4YCHDaZtq3k%2hlgj4ZS2`1oVAw!&vk#js z4nUe5wV+J3?w}j1dB?BTRIJI^+TU#qR=HmCjQ23E!el5?kh=s@^XNUq7ZNvaS49UR zbKK0Bc4U$6$^OnsB!2X}^%E$DWp&B4ago1Q4yRJ#4(bfjqwt)|pKVFh}+lh^DjP1oQD$qGlVNJ3el zx(T|Wfd?bOUoAtI9$&lY|HM?E`>G9@6)hL&@8@fi-E5D92PYwlOzS#Cpb& zX>@(Xc-Q52%CH7L^wz~6>cyL6<5CXayOBuKwTz(2R88~#cNW4dY5w}SfwcjrOygKu zadfD;v(XXUmLA?@_&C$B$$o1U#-thsKXOH7C4!RI_=V{_k*xMiB9<$SH zab2p6=$eqe5{tc#Zat>6l8_4WIG{O1ltE$Kq~MKXp!@mA~E4@&^J8D7R#H7+D z<6dTBE7`*6Qh>PYH+oxpv3rih;l+~QGT5z6P_h<>j~}yxriQ(E`-lwBL>l+JjbACs zr)pm^+p26e`ILOHQFmYJ_DT03;k?z-Ce-s{U;=FgQYH?l)ad^}N8^C_oLfaQ>A)iNmbdp%7{Qq0ld4}38D zH=txpY`|u`Guo7%msuWg{w^x#P~)D}HsL2tdbc+wIGBMKu4XvMd?vquDpGGjZ!jbZ z#+d^P33y&2s}nv4KkaG+B$^s(vmIZ*Qu)m2G1n-G3?%dMm2H@^T-$4wp?XM{NIg&b z$nv6qAqWe;S3iv|Atd!*j?5wLJGdjvP_$zF;e2x+%k6$Z+q?;$bG*WgaKnNKq262f z1)$y~yHr?llkHlqPkD?tS=aF0b1BdB9=u7v=Q~F*^^y53sanG=eCeNN z6-Mz7AQfBm^vjj4(pru?y$_b}A%Cs5pEnxlU)d<$h&PN98Lb!@oprMAS$phfkb=NA*JcugSwBx^~hA&dy8Z`Nk{lJPgbO{nJI}$HXbp37_hw zFReg1Pr2)PecikDD%~b(;*?C=-w>ALW-S;=V;Pds<`+!V*EYMiZ%5S_HCk7X9NZSZ zR+_xQP*CBG(OuxUVVbAvt*rlXw;Sjz3I^J>Gy8im*$1rSm4krhCvHR6)shf5Yph*{ zKF&A{H6Hao+n5*=t8OXFu4zwIZp3jhtPEDPv}@doShM?JOQEBaFm>T!qb*H=aADxB zlMIFMgsF}EroLR!%{}oAN42+|=A^1E1CJwYD+9kTEe91Ao}P6Z3%)c{e20iluPO1* z86Fccb~j2lNJkE2IA&J+--YfW$kFS^{NkXpJrWex}P=4@Q$wV6;O7j z=xi2?j%XMO^SW1rGL*+ktunw?)&f11^~r18@qVq~0CnZ3c)iPrp<}qqMBe76XsF_y zZVAGt2c?OkE*Le{vG+_wIbPq1beJg}ea z4u3!R12}6WKcyAnVC&uL;r6b8f4*GpWXAcW#HoeW$%y)celSHc;Tpi+^F*~(d?;}F zhqdMU6Q^D4*AGn#Hz%8JrxxaOC_qbLcpCAQAn?ou7zfHf9ZDeA>32rE_?{9h70I2^ z%i*}WbVL0!$}myI>(l(Bjd?E%Xwu54<9`R3uD`AyT|Hk$EPL&YXH()H-Yi?$vhq3T zO+I($=WpK}UMUN=Fz$B<Q1Z7 z8rNlk82gX)@3)*w_JYJ1R^64E`onF`4!wr8EBR66N9^i+#*`*t$Qc09KcZ9nscXp&iE_XG^HQ1Ina{FLJP4crw2W} z32TVYHNZtVUL@{p%|`p^1l&|1HZ!t2JFNSzHtgiYpT!}3b?SE%*9RBapzMAebRbG8`vpll=br;m?H_2q9TRbU^Cp=a;JGG2Vm^qfyYj|btL zc4>D_8L&@PusVd|0f8Sy|M&{9XYu#jaj6760Vf{M^I?A5xX;fCt(2Ib+s=HIVpL>s@|Rr&Ybu-y`%`*daGJ$WlY33$c}#g{SVgMh}lM zr9TU;2<{sT+k97)yt{V0iSIG~s@qqe#zjN)kjv>NO-|wMH$DfgO+f!B*lJo!IR65=B$XB5cr*!5bQ zHfP%UJbnzW`9&Hxese(}JTK6r=I)+I#ue*=T!g25u+p!{(yhIV(hZ)8n5=aWSg0PC z08FM|3EVa$(9z&u-nw8hyRw9dz2C1AsVu46p8Q_Edl`Fg%r?~F#xeE*dU2$Hv@<8{ zV7~;eC3Ud+O-+yOcMi8)m-UFyY`INu&prAmCjzKKFnFmc%@Ss-<*naUYQMj+m{kaZ zGh5AFPYpp#!Ip`|9VXd4W>JeD3Vmv(Dw4>I%6bQoTeRt&@;l!<;^5G9oe4kXD~_|J zE4YSlU*M2BvHk5?rVH~fDDrLX&D7!T>B)PgrRdTvpbYZp z)JoY0&YK%99UHIfA`;=uOJ!JJ*<$pABD}w$tdkOiyrnq zudn#&rHp^B?DXZvZp1e6$$njJS`lPn_CXaX@G-Kl<>$Av{7xm=IOi;%`uJQe(06Ot z2<@-DD#R1b>!k0SX(4uxY%Gna0=G3$kp4Ndx_6Lq`j?de@xTDpkE(~IYu39=C2Bb9 zbCbXN=A}}j40h;TYnBdUT90d1-=_aI0Os*At}48sT>PaE4QJ%y*4x@svjJB+PCM3G z{Ds_-G31+jOrf3i(GgV&R`a#MAu=%1z@8oQe1m*4MA`*D%Xnh#RPMU`j%P&cQ{2!2 zL6uvy@nK!r1Kv^I4&6ZxQ}!IpIc~lAP~>xhcW`FaW*GxAg;xj?loqn$6DkO4C37p) zs7>2v|HQLayBzw2fe>nbkBwJ+CrZwsiX41r4SzC78ihSef3ot!Tg&qpsq>8PgmC@V z4qxE%Z^1Ag4qpEFM5E}}C8!sq?{eegoUT1(ReyyL*_E=g{$Zb(ntGh{She9!k6oSk zfy-{&y4zQkDr~&*cnhsDLLck4ua(0GROK?)ivU($+NxWzp^a+K>~_XP&&5Lnevb{W zy4&%+#9wtP+VWWt2?=~^xMsMa?rpx0Q=g~gbgcXK<)1EI(tg+xZWCSc2QDqxAs(Z} zpHe;{J4@;NO;83jYj4q;ru-TLFN>z=Dou=&cI^8_vvN%S^3qt~juGyguq{DW5R$wV zC>g4MSC(M>ePbT^05`DvN5F^O53X0m6`vJml*v*^ze(+Ny7riDp720PYb3s=x>}Lz zx8fJnuYmT&oG61X z&UhDX#Xq=L-X31tTCtG1M*mCpYSX6+{y^3A)$TVq*(>ndwURl>c#PSaw!XHO`Gj-h z>fYSff@twleux2M%N<)sQB~#T1KO(25>BtNQ`Z`#fxrHQ4N0Q7h}3(PyBwQVK-0~y zduCSNAn+~-+8usYdy+-?t+j)9G4NZdA`Ph_CM)!Xc>tYg?! zAU9@0#* z<}@Xh?th;UD!mJHTCYAs*2Z%ZD`*a}G8`nsO|UtxaAqZ+Zb{tNvD_8>5nc@=>o>qB zo#raqRMvAmgI(WAXZ_3LtAc!7puUjC;lYEl+jnZ#6#YVASt`8XS=ZXI4=8ejm6ShM#!a6ddu_}b=HPX2LULm9fTYoxpn0LJyo-NvtYM8FZlL5R zrKUhWylZ^r)+8aAHl8NRtI#QSLUE^oWxu9jPC7mRXnuF|n#<%x@2F@~w|1^`Jz%?@ z2QMC9XZuw+I+sjAeO~jYXP>iy=@_hbkxfho9+A@0s6_kLqdGBJnK`vVav5vvJ+a3YPVt|9lIu>wH%}{{ zEhgN5&k4OQ``R5i)EEV2n_$+&_c1BUJn7U^GmeL5;?FdAc07~G<1egOB$Z(5VH6uc zhnE98<0`M67#ROXve85*yti6Ev^2$aNBk|^D+Eb1Wxi7VU9ZF^Kz=f*saaWDQsk#1 zKQO_cn~{N(XHC2@pUp9|^MS`}nz;gYOXmCQ=}ItE+gy0bP3xr&Yh@L43gA_VI`l-Y z=18$YX=h$~f&uY{UhI#}Echj~V_myjB z@HW7Yd~}pV{mA@eouclXoEO!_fQDg^tB!$!NwG>i@sONaDW*-sn}cR2b`*%8^b)|z zdVqJJtfEr9NQ}OBKQ0~;xQp~iXq$@`OjMNS+~<};4=^f19{!Pr8K6v-%$G)#Ahr@q z2(mBc3wu_~WleuYM7lt&lf*=H;1Xc0E~zg9aSrnppN@Xa#%HyAEEAUirxH3j|NTJ# z|HkqTYFz$a93+D3C-5W%NxKgFjOSkHC~(YXf$x%v;VVjWhaj0u3gaN=y)o1t;0$nf z2wEf<9P*$LDqVZtf$pY5T?op&i$}QN1WL6~aX|I-h7akawtq&mL)wMCfDpP(=%(f> z_Kg`Qkm-7qqBPm%`<}%inqnX)>Ah^gg+WU?aGz*Y?5bZ(2r`-~kDa;mvLn=rh{Ufs zJ@~DR5R5@9s8=W0KT~+K!Fwx^HUx=z8TNpJ?A!cK$BG|?DLdO~Y2VrJGw{t8cr-xI z7DSE^=B4P#xyhSHoY1Ev=m5W7E~pu4DkZSm?D#W+x%3YT5?e7l*j``h+hX!?PE>%s zr$zaTNZ~sl2n5TYKL6*-YNP|>zpcz}W2zg^4v%(bVh@cH6r~eFkfbLeDl?SoCrw=lqx*nn;V1e9$*2w9x9(Z_7Q?EKb7pWnSazW}rR>P-K4wk&9$nV&I&_ZEiB4CMivL34#5lTuq}w-jN%BU&jf) zKpueqPk*rmQoTkYrh z76I}U@(qxu7>S^O<7JHC2g-#w_(=$csVB13gccRl~!XNqpp&$Q>^9hdhucJ3eF6QsHA>9tH*;7I%G|Y)bVt`~q zxU_-$%nJe{Sv2lj}Q_3B}K@awF>sjiTQf4Tkc+B%L=7kZqo!FzRIn8 zT&3fTDjF26^CtE?BnETiIOvVPfe1y!qxF7vcJLsF`&Q#sy#f}fS8@n&{s0GCeS#!S zeh8r0Eh}?R)|a)Jx_N>tV^;~ZPIonME~h68kqq}k{br!ZyF}W2!Bk-Y)4TM|_@a)m z`}}|j9a?&Ok|nof?~9T zTwzUg=(^s(h$!ww2NGyPP{+qV5;6QF)Qwtt5v&X&Bj5!xFu+@UuUgWU!`v(NR@?n0 zOKim3i~AeDk|a<0|i-|o(2VIjw&KEO2+NA)CuM>HclY&B9j?^mmB7DTREOO zhW#rrtn*=?bm=3D07E$FXa*SfIqmEjw7IR1BBIvsOwkc7 zl=S%N&L`Zg8(gEnclHH=GhWtkRQMtwc%L&MChyZ_vB6JI_B0})-=N#d4;0NyfhaY&DwABq3 z;z)U+_}eGvX6(=w+1TiB+kgcaj2Hndgd*tV%Ohb9=3lyi_f^fXF!3#k2nGDJQRHD%_41)q_t}TB!4#hX78djCWjre zc(Myzg4hjBSFb^qVYCzBfSx*y7@R%y=6x!NU-$MZUgYLkt;q(QZmicgu>jFA|I-2B zscdT+QKyR<1S!IM^90jfbRPO~`*4bEgaKRX^r)(B?50Dx8s;cx>nHQ? z-laYN?H*b%&}sgd=5om5qEAI2Z#qz#Q3t?OT>& zUg^o|^BemyIzsr;FHr>`@{pAxf0p5~-0xye#}FhCFhPy^3IW$L9l&*CZx&F18dRMh zz#$8UxPi#y%K^U5)RSd6_>Bc|y{iD^y5+eZqcZmz@f>g{PFP^#$wzXw_Uz0^|0db$ ziKTSV_*-C;ybIdN8Z2*~xogJ)-R1BCId43%3q9(tPK9;G0p6vD3*hYifU38RD0+o| z>Do#HaH=w&F#5|+wcZe7e>J9^^{d1ZbXe{$_g{$x%Yaa#Onta^0n6OLrJ z;fGgLr~u~?0Z59(f-kP&%|_KI8<*XC-lIp|)UJWQrhK9|p|quKt^ijITH6$ZGG;~u zyBQ}1&T&4gIljLJxSR#k_%ibzkT8JeG8e!L#a2e)ruiTd%L_)XJ{r1IREOswV9)-H zfSJCM@4D~OI^uNjDg*w+Z1)%$0k(ehJf^?q9#X%9v8VPSjx6kk#)~nq{!69PJsG7> zkO{m{S}O|muC}>aA|ZU|fZf`-Waab7mJb+(zcx~Cvd)b|mmNdwUxrOj*`ad*?nuA0 zuJi?l=&}QfhZOUu`5pJvSZm9AQJXP9;6ES-hCyw0-$o_ZVO|rICR?LZ5@xuVE@iZh;lzxU27%SslnhtNp>|Ji=+*fY+ z(6;_m3_@k_bK!^WU-DpF&^iB-lPSqOo82)@6q1t4x`Qbl#P{Ej~ybiharqT1P7G6$#g~9n9TzzGV zn1(i!A6H!tH#_`_VgaAWCU<$3E&YcwZz_c?(BE zTHj`wn2>sPL5sDPi5`*@>)t z_lb>KJJTvlFM^rZS)h3LV{cuy5W1r-9qyTtIBSxG9rTDmw|T_Leffur=fyb-5R@o@ zLa27wPql z_v$}c)~^vZ1pRFTtmBWF5*+ORp zP(HjDJf@BbMdGETMFbRoDDy6H&1P^4M`y=P{NekecZdql?!>K3!cS1(__MA7qK)eK z`-|h@-l1?^GCYmeln#s2Vp43qB^%3FNW{m_zL&0v*)Yw~a0@IcsiOW#y*|mHwO6+RCkF}}?C_km!Q5s~Dc3U}^9XkcqL8ATr) zF>rNH*2>ue8~=wp?qF?A!9*o#vVMsk!Ruza+a6k5)*c)&aR81(cs!U(Ao8yuMvz&6 zW;YI@tpdB{-5f$j2m)8^2X?wpkBHF5MIax;*42BL>E+%~-KaFOm?xNMu}sy?5g|2| zF?|x0eDDJ4UFla7V8ZihiAR&a`Vs?F38u3fU6IU8b(@jdtHqLr+ta8pUEj+10g5NK zuvvHX?1upI^eriEHpRcPJxFIcL({MHqbvBDPdaez_ePmcG(njD%o(~8>)xWA7&c&q zlRRJC>r!K>y9WDH2LlNjz;4n+BU!Xg<#377?PJKwMY9<~=b_zNuZ)M#^eL%eIy6Bd z2lV=rH;0$;c0Xa?Bm})(8~BWl@?6eBkBBff!z(&HXT?ju1P?wbaC*~K6F2E`Lz_R8 z9r<^Vi;oA|7m4oz1H7#r%PL3Wc2M=46xMn8H~cFm zN6f@}lYc!dBaWQA4MlrfbYlhvtpXVU94P+j}bnx+vi zswrSQl=k3@FUv;6p88M#8Qo#detm$>eBx%ljWjA=m+; z!^!xxsOA))|2OT^qyk*6@x0{>2WG6YA)TE`>N}`zWd`~LTZ8?LR)rnlD zN2@AXr9&I%I!QXJRR-}8*$ov3&^NW9u_`@`LGEvDy@n@F8#-;4FMGN^_Zl1=PgGA5 zXtpJ(AAW(&Djw9Xm!bPQ2{b2mdcHVF+7MG9LKHx-2H0A5r)pI{+Zk&84hm#HV=y44 z8CvOK_WIHp?Ztov<=x;&M(PS=UYHT-Yidve`N7Pb4QPSN5ywSa)^W9C-SspWv7_gH z$PF>NDw83P(XTBfYc{5}fQ&Egc}PBq-+T#Yp16?T06})@P&R)b+fmO$kO34YK-47L z;ktYCNR4)lhrimfw&8m@;Jy5$W3T3u&pV8O?bb;?pRnXFYU=0`#lORLKU3tG@wk3UW7z3Tk&n=C6Cw4TSHIl3K7jPy(1QlY5o%sVKZl;=e^lMfoqka?@J{P&H`$xRXh&o-eV1&(sL!dhGLZ-+ux9i@6yUl+BXmh z)s(YT;(+ECOI3sYI}3KCc#-2@)YjB}J7Lg<#MF+`~Jfe1b zW`gZJx7J_l96R2+JzjtR)?2l;uBaidS%k1#^uX1)zCfi)2Hpjqp^S2$*KlS&z3(9L z12c9*b@};03cAlt{#cFffH14sf3fQ<{AlN3j;`TOC@u;6)nWLa%*8QBz0Z+3Za_kY z4m)IR&5l)$8APwF<2y=Gr=1oIZ#J5!8f|kx`Mwf(2@wjcpG6qMPU#qSuh`v>>5a!J zA)xivR(so|m|=(Hel2uNJ#|P~qV`v)G|;E`JWkWg462Zz$fL zQRYZHmQR>;l!jexAI)ymM)<1H>5p3Wp#bwqkKbwsTCC6%g|JJ`jtIKLUX@mXjXkKpz9z|voz(r z$O4zjaYGUE`S61qe2{;4)NxG54KWaZ^n;$kbhOjdBl6w8jDMe3V5!~$tMg*~;ox+@ z+Z5D?Ngb~BvSp7MO|pGg+=$tV0gtug4SdNbZpq3{=PkUS4&;7UgHVb4Z^eK>k)?xs zG2Jx|rNvU$^NpOF{QEZ*tYzwttca2q%4%Xf6)2_RcGsF(!sfF zZUBwds%Ng;elVxMegBSTWJ{heX_IW*Dl!(oy&q8;a@M~%H7D~)&18E(>rg#r=DlU{ zSUUwWF?CjcshzM19?xMKgu&&DLW5%;8!091ek~jQ8x#Wh4>$&sg!OMV{tJ$Y_#beL(!W;t@8>Zimnq@?zWy(8%)P&X;P3wp z9{xYz<^Kcz^?$%C{|7w&U*Mzvam^iIFpvHP{@?ANs=xaGgk!$$IsUW4e?R{n+zP!+ z_xH#3U-0js0Y8sk{eQsET2UCxX+H)n{C{~Kwa~f@-iPW0|26#u|CjE~oc{5#t;+^r z(5)plIH1lSxBm6Nu9bh34ge!Z^FOclo*B@%f4eT&{;l}mg`WSu z^>261{;l-?zkvQ9k8J)Ac*y@7KK&o#^JneBcNc&Dn5O$L`2OU3br^)L=M0113<2Zs z`Uf3={z(VU2P299V_xSO{=D&zcGUex8N>R=jeo!~+W%30{73okX+nOd`FA+7m;Lg_ zU(cgkFFN{hLHUpRZLKqyp?yrM1nh74a{C`6y2XYd6dK_Ex8+RcP7OMYFKzX@TpnoQyG<3qg8E}^%ZoNs?9$928^(REAI`aN@$>U)b@ zT$}>@H^Wn3Kh*m&595J9P9l@Fp||m9xY}^u?74y@##TA@ozdFSnwe}7%WGWMnmHGo zGdV6YsNH5=?Yg2k?#3Kr$}z)*iP}dq<4?-R9Z_~kqI?ONoZg2`E8Ko|Rrob~W;+i2 znw&HOa_y^#!Ou6>Yxd^8#pmvFasl&e-h zecZxhiiPLT3hnlzf0hrcfVVon--+0UBY99kCe(}{dNbw*xH<}PZ>nfmO%$2L4=O;mpkCG8ksd)8Tk}EMs{)|#2A)ZhhpP%X2@1dV_|vx>-nb? zd-B7>{R@R0>f89Bb_QOE2U}fckYAV&0VZ<0aA6W!Q_f0;U$n?_EZ*ynzn$Gw8aYkA z*&Aa{{_OZM7M}ZwnkX{i{ldQ6l*0C_2!3U}EF7|rHr7Xn&mMhuKalMX>=$Z$bBn7z zF^dHl1oUM;9dq?w;G$oOX>1gDk5z4cWzNeagFsKX^~LO|&8~T}>dUEZpT&{5_x}`t z*x4#+Z{E2-9~^us-Kn?3shWxeli(;D!l%~h^t>ZmK40%) z$fi|_A9w@zNf%p=s!9t4fE)OB_ z7@-$r&IC{vHuk{!MFU^&TT-M)~BQLN|Udk&+>}+9@D8Pvo72Xl27#{1$(#`G@7Liic#TXrb8 z<#nC5O;~RBTl{N7CPNHrgAT71S+W22*B)~9*kI4!%5A;}WQ@D_h4Hz1KU_>d%s7}4 zKlCXMUaK_Bml!Y1X|U`lVkirbN0}7@yMa#?HxVoi<%qK(tHOTd`vL*kY$MlDW@BE- zazfaaUsJ<_IbSooPK!X~1~NF4a2d*gNg~+H*74zprfrfqxb6jkkRfn`$sSR%m)%74 zxPxIR4P~yvnGUn;oQamiYrUX-F$Nok8D9QABzrN5Fj%b^-M=4+=6S!YPDkbNbF_r;aH z5C|XQWiCCL0y&;E){j>NWQZX6k+IDD1LK?QL>>spXEIBv)9YVo&n9YMQg1h{4P+nz zQN}kMqSc@N)N6C=@ih*DG|^D%vTIml!6iW-4(5sYN6Aub_(e6W!y$Og21_x0ig0x- zXNsA7l`;_j*4AttvKVHFN;U*)1EYV&2Nq8`T<7Su3}nJQ^j$BDx=i0DkBh1V`&IBZ zBKGp*E3mD~?*=&7LqM^0W04+SRv0q>V$2_4ndJSa)q?l)p*CTXp!J>VvBa?V>}iIb z=EPt<2sg#()4=X8Z)i|kNirjD$j^1R5gFu zVT4;~L}xhLL7^|i(X)rfZv=MeX|8okL)u*p%*;ML$CNs=s{h?N$6{0y61UC#V{1S4T~sS~>@4`iKg5jN+hjN7QEK)n0TOo*CVXHWn$jh0#TveM7=HmkzUbh=bp} zLKddtvze)*uMnLJeIWgiRpa5}ExPXbTS;6LzbV!kwHY=9ie7srYty(Vj%d3jk}$26 zPx-FS3y>k&ne!-_cxS8E-nap813a)|+}QUC?yd3^iT3M>vplatzk44QyFw&otT)Fj z_a#by2{UN@@%Y_nD4P*p7@d%ng3V8ViQY;Ng5GbqA$Oyt6M(o>hkR3{?9ZfYgX;^++5sL-{Z z5?$mX&Uj?ZV`1UG^z)oCD-%_2zgtz8N(eC2u>XN^H(pajQ;2Y*2?!`a#kr*(#r)KStX8;=`y*x4z8YYzFjTS=vgsai5cq`)=!%9aB-Oc0YFE2;@I; zSc=6Cw;6bE|C(K%GB^?Boh|nA8BCKkF81&EHFS0JR+KN1|6?jnlblR}&2#Pnf#2D2 zSTH=Tx|!!5-P0SRd#%ikT-5dIxl8l`9CZ^6Wx?6tFyDx~KBM7xO3yr>=ooIt1aY7q z?OydcY3UPXm)bQ078245UlI=*>dl#e(+GSL12XFS60~|v^Tr3vRZ+L`TE(n7pHc)J zJ2u;j2kw{Mek+k@p)siQRgFeM?s!HgB|a<05(oN%Z@yuA#$)6MwdB{ALT+mtBWz!r z6tqxWRfTlyrW9Ue2*s?J9}=*0t|+7Cz|XoOoM~IiBO@kCMlX>cmzV3j!`st98n@YT z@rBch?|TkYRy|KLSE}X=Dsz{JzlV=hY+ud)nEy73KU{Rd0`cM*sRp7vg!h6>;oE*x zi|X$QX*ey(`20Cs*{VWB z?{;Oz_ijNY-Y5NBwx^#+bDLkqpUn*+ym!gQy*7x8qDXlw?tbsPb1k>HgkjwXvtPA2 z;cGuc%Pf-*gae`N@kax!Bx71HZ35?nkUAOK2mTpXLaz>-es@u;;Aghp0 zlf&VWpy3IrNW?qKB6X$D7NOVltZVX~Mz9uG`TVT)h*m7Os2HONfiztqml|i2U2isU z)b;Kh`K-oX#54C^mv3e|_^tXi8Shw*RW@gOMzU60K4%LU)L6A?C4Fk8Y4&E*_vUBF zN+Cfsy_SV#yKLr@`}R$T7}{?obc{hzFx@u#3*QI43WGbt)>1Tx ztUi~V`5C=uq)+aEsI$*&?}R$KA9)s^pEMasew7znw2{0W>|!(rl#+WZqs9_|YB9)y`A6>6s~5gWsU z$9!_Lx2t_CS;g0T<4{L=RJhnv-JH!VzPPM<|8S90AKfU9J3_Y`4qQ=j?;0G(VV{Q9 z+wBzA?DuKU^@gt7#FxMpWLf4f$S++0u(O_Nv|IyZiJ;abCIU+;Up!q+4;reXV2f z=fhy>E>yOxM$-4nL^CnwQbI~_e4ZrAWeI%{um|nT%n7+eXPHH zFuYHqWGy+1)Mlpwe|UJfL@}r68DOZW16C4?+QfbP(&~K1A_#fnD{L}F_uq}BN8;!i zx5N=*itYC%v}I^#8Y%+w6|AJeH-SXK2`DQvpS(PG4pZSS0RewX}{2KcZ%)a-a9?{y?3kndZ@3O zMtFYb;2`yFzZ3iLiFc1?rAOpED|Ru@9|h?w1w)$tPkU$n57iex{yPiVjU{W@muNv* ziZDoIiR_g%$&y|6Fk>CUSR%VZ%uogsvW_HMBvF*?#*#IA*6&sC@A7zj{)6ws59glq zdYw7vzRv5s?lO0tb1rkV^WvEA?t6Og`MX6qA-EvFuR_5;>MlvyS8cA<^Hju^?8|%| z5jd;zONMU+jxt3pxS0=l7678HG#i4lKwn5!gJvuxs8|Srn9?tHcxGA2Cd&qGs4}&X0 zS-~bew8)j8lg~R96o^YW-OrP9GFUBl;?-P9=Q()p|I~_G={aT)NnMjM;VCx!tt^5N z=)*FRNYP2{jBJ9y{m3~P85>3>OT$}1#-FhsYudil>~=CkX}79eLe(&EmiN2owuEDZ zgSFPK6RK`hoWBP?aA>09hanJ&i=IY7jO3YInX!x^(b|vEKcc+Q64Rpf-4wwNqqXUX z5do%M$ndS*uFoCWx)7*4+o-!%&yxmzZmv($HM4C z2o+NFhsw7U_CVclSgxLAKimP`lAGes1mFA8rfW5~daQ;XFh@)18&2|ir_qDo6g(5W zshlPw8(-(leSJ0&Ssym}cFb!sCs$5vz@T94fm5-o#~1pZdb%rfLiZKIk>F)!&qaAU zy*cC&Yj5M)zSXwz+wivu1{S>fYo8*1I?S3~QKxTuQNiS1{u(@?i2BYLdojEv;kWkG zCZi4HMHqcP48vHXyS?**nxr0hP>7uIW`pp@w^!JFByaz=%Msf<{j(wjrNB;Ey;729 zlB83ws<*UPIt;l^fAkPTY?N$=0EOL4?L1}I=lexK>;ClH=+~r>l9X zniyEaMAcSj>IbG~BeOmGac9q@n$B~w8$TNkoAFFh?yq*G_Wo@eD(Y*Q^3Ys0?q2B_ zg=7fhhe^U}!f>2tSDLn1j&iG^5)WajwUOE>OG!4#3BS%hSDvci1%c&5yi_DE```7~ zTI#+kHB-YH*S%hFH~S|EmmRonqY#JUvfzAa^(ARo=F#27ygv3WUNq2Ud-BcG;*7(p zSGd_16%}&}S-zrd#(Kf52Rd81&+mKk55RxS+HPR&wVuvhrQ&0`_)ak-jfQrhBjZ=E z`G>6o)`?%)hnlwT`8HVl(1%dc^P(Z2UX6#~ADN?jP$r*O-G2CVVh_{VM=|aM#Y(QS z0gcuym%dpa;uJmWn$*D z4VP4VSmS>x1z|{Q`74>K^VbAiIaoVP@&0Pr--Drk6lDOREqPO4x*~DrrvhIT{n?ij z6CLKW5?gP()4L6`A2;vgB`(Q^S&jP^#@J=G7|FRHn#QaH{y61At>j~4o`7#_O>S^5 za~v|-vh2Z*$}Pqngd5ykUX*>@hI3+F_5mkJilm`! zUGcT%+2tzJrC+!ev|CP&M2$Twa#+8ZVY>UnI#eIVL3etF@Y3u9f3PR72$N%xW2#~j1ome`$mZNyNr4Yf4=-p&t)StJ?(q(Se&s`S7wyCsc!hu;roJsy8I&Tfzfm??W>{F%n8Z6dcq(9Zr8Df>2rFm)O~lf*$wBD0gr8V zn>7?#*?XlW?v*d{Is2;Z0~-X2>EyzO;O7so54oxzMU3h%vr?~1>_s*{IXh|2;vNQX zp^v0@Vua2{Z9oOQMj4TAZ^ooEBoiy~CKlPsS?}MHICI{Y9 z-Q4tMHx65NYC7X>`k)wi4#~hv7b!xrn>_*H(6lD7qwklq1^pss_Kw+`*pv!cSFLbw znj3hB!ejDkm9%3VBVGS?wu8`I>1;6Q=^jZ;SogeJZ8usW3@M2im301k;QC9)i9400 zXnL_h2z;a`fND^J$Ny#><*FvUQq-Z9^ELbCkOHqbzeg)u-Df($Q|@ealk@&ak#R5r zdGm~bmkAXvJy-@@5(Gt{AvIgJkCa3BfNnW~ekte;Uy+NRG4RKx+h29hIKKLU23TnZ z*ZC7V?JWXE4*Ray$x&}ttmFbB*R_3g07yZdw)>|maB1Iz8#5RSp|Q#45a!fb=Pv5B zC5CrbW)S*Tz|}G_X8j>Wme)b?M)YA$PpEr`s!3Z>5h110+jbQa>Gd4&1nN^+zLe-3 zsQuIfei>8dvf?j>5u^b>4<1X%tLsd2UTVnNJ|L}Q*4gUB#g31UMgqawFV_*sLdwP7a_$-7wff2ey9M~pOy`Tp~{q$ zbCV;%du{q5MJ?zMs166!$Po|403C;ps+G|?d^Ve1ughSd5TBf%+x^JsCjMwF6UIBB zdE1=kP`Ok=5k2$FuR-~2rU0bUF&8eKo!C3eje``xC}*R?F|wTpOe8bdfsGY=rneO1`Nt*Fevkuq~Sk6qnaMyfQD9y z?Sgi(mJdWB>n(CilQXi!_aX%w1tDUV2327|EY&>%Bf42OsMajGFJjca)l`TtfbDD@ z*k-+KAPTj^{2Z_G{LZO$1Ix#KzcvLA`Uk2jN1YFxZ&-^A;oLm*e-#$C%BAS>0mMXg z`9LPj59NImdDz#9=L3X6y%NUtg1W3taFqBLoi* z{qJ|TQ)u~6D$rpD&3AXa3Af$+fG;SWk>`quAs{fv?rmySgv4#Bm z%(eL6r`toKRbL0tGyB-Y@%FfUwmO@|0V2!|k5pu)&tARYPd1 z;$)<7kV}(C8k6SASQ?DQLIoM*Gq3ZjVW0N)j8wP09-8~frvm>6j1uy&ux{lnqs7@h1J@<1?G!~mAOb4u%XDVH$ztE;GmmcYh3w4#eJxn^!?^cz zufb=%&68#MM+=9z19uO$2B@I3SgPQp(LZxtViw?~anJ@&|&#raZw|W}EzhP>B6%zcD38*AmW0$vhay z2vG_A>1*g13aTxDSE2mL*VWtYWexjH@BoczE0pF9UG&X8zP z6JoJvJhP{@w)ewV^HlMq^usKfmas1=J)OSXG^AAq8Gy0%@{~w}mcir1(#Aji6DPwa zdh6!{_tIA~f65{jcwohDq+cTsE22i9r)|`LApxUguu!+YGCDCjDSDut`r6N_$L^`t z)%SnI&(CaVM8X;e;FJy0uVxlcxp&}m6E^Yo&sUgb{>u~J10 zO2>O(S6qmFgJJIUJtM2CK{QaI&hW=m1?jyQm@&E@f*j}yI?JvCTa{fd5tTonBVE@y z?cS{?+AnSCB$BHlvR3x~Gy-+{jB4a_W!aM&u#9*7;#-zDe$kPWQew7xgx*z9Ucr_2w zw7=c&^EbcI{=}z6AjItf9VvSn4J=$^si1@Vc!rH!JZOItuJ!N`Td3ztn*8K;NA#BO zYMpZ*z4P628(c}?J6dmM!q=kI`HDGWj&TSQFkw>LK~v!v6ogWfbIC!)7T9S^J@<1 z3qunF1rW$3jvWitq|;+XUpkak>a|Y%4pdm2Aq73&QyOi`+@>7S{5|!cc2DqEfP1yD zg2;-vFi|YMKJ6jZOnH9XRT(DVE2$o>{H9&+-_qmQS z1-R*hKktLrl7Ne^MSTw$O%HY=y16a&LA>GrFk;|KIWHYE5ywo#F%xmjL>w~_$4taA z6LHK$95WHeOvEu0am+*w~_$4taA6LHK$95WHe zOvEu0am+*&D)SPQpbauX21yn}x{y77&*bN_xKMfH1^+buOZ5aRdf(J=7f zo7lB%@oVpp=}sJT-E2))ZbvZPJ89bpG+&pgNgR0$L4BkukCCzh!t``q3l4dqjU4^)nn-poRP~C(-h)klNCCf8^XFgzcjS)2SJ-Z zBj-X}Fo(>M7)VlGy?^4@h1}1AeQW6=*6o=?@^gp~mc_U-zj>%3%(PLBU9%U~oG~iVi64w4{nWpIX z#4Sg*JwaDZP;eQ>Teajod~b+jjFMGx$3O zE(G`cO>ppc+_Pm9%T!}MJt&cy{ypN&o0=FkAM2kVR(#248wHdk=dQE|aT~MhPl7L` z7xol2ntan>9Q?kb;+tw!X-@i>f%I^DAN^bBJm00$u{mA0J-ls$;OQqZ!_;(>s7!>TSrlFje*2vkvDK7V?>FToO~=nS zo06DQZvUySD{*iQXGa)Gi|uuc+{vLXILlm`dRc#1HZ(W*lkU9@a$$IG=v(HtN~?P+ z!CsjxVi(6XZ!#BNc0(Ns#6`q(okYA*_k4oJnI~9%pFl4AA%uG!w zOJW=@5zj1)F0>B_-PTWUP`%U>*Wy~Xmd`%enbs=2Y0i31TzS)nW1w1oO!w=#9SPNs zlVs8ffj5s;PRMEe>U?u!T+#HIMS^d$#U-Y)6?#KUsX1}S0u6MbbopB zdYawDL{Pj9GJsk+gc*)(zVaA(g8+}n|BE)cK5zpMP}+O$&W>J>BqjSHP#Bzol9S6! z$j8pp%hAo%Ovvq?lb!7&uiHX4p0*B-pxQ|2k()a+0EvA5@&pwVGmEj1tGBarA2kgv z9RtGjrs0K$cK%*>!2G|KCPKE(HeOyY=uyxYj3^iiZscm?VrS%N>*o4}^&}hnoqzR5 zO0$1OJ1_H_hSwZzAAttgc>3qDahTmS)cb3P6@u}mp|+jB-F=n+%<1JmW#sAR_6P-` zV&W1!e^E|RP0PUI{sRXmXIC%3AWUM;i{g4x%h9mGp+f%Uz<=xc{3iiGtE2O!i{KfJ z^AI=${s3|G5NhZX04oEzbSfH1kbzJ`FrWnRqaaa0ybK_K2J=`Mh%`GItcaF@NuNIn zMMI(i3><)lLt+3dA>xg4lLm?KwKOowEzW*SQ+RQ$7dLD1kfj$nNdeWxQoh!6dXnzjRGt}vl<&Cjz%Kq zfzE_gl1NSAN5hd-_sl?N0%d4YIDkn7(!w)=aukW8p#oowFGd0JnULpoC=yT>hKCjd zz!R{W7u9GIP!fp;0L&|BDX}IDtc?V1$0d+}1{9v+QzxD!s+UO7J6a!t(k-=U=G`Y&pJI+PM!F5=keD@%S>ZQ56~#fSRN3fg}=y zfCJ6Iy#=r&%0?0jz~OOdJPL><1JiNf7BW2zdJ)VH!C3)ypdZP=6zE4Xa0vPf)PSBN z|IZXx2X7l8lPCW=Q6cD`6H(ZNzfLqoVIk@NoM?i^LMn*=eCUM6!f-@l#XldaImM%~ zKt7rX`Y;BF3&#R4QACRR-pQ%yL(qpd9) z`l9Gn7!eqVA_Ef%M4%o;rdnAh&uq?+$wXfkZ&aBl`p28FLE zGJIxd?{N9A)Q%!kZ0^h~AIzb^N~+39GI<7U1xmnFA`y5Wd9=eMA}}0IhEC4|i9|RG zn3$eAszw2hUPlK8#9|nT5QhkYf2xj@fv`YAfe0BWI|R%_IpG`#Cy;W8Am?wQX?RVX0TnZ`BvS!Q+viCB0DL}Wr=lis56km9`1w~*>uFf{QM zivvK~v13UiiMhrg$V|{WHZ8n?gJ?#g4|_I~JQ*R@prbnu3Mp5#JyAYAm#v vri1{_=+x}YuW525k+Ow6^JkNMRB9ss+T5BZM-eH;r^(Y~umH58!2tYUcd`23 diff --git a/dev-tools/packaging/templates/darwin/icons/auditbeat.icns b/dev-tools/packaging/templates/darwin/icons/auditbeat.icns deleted file mode 100644 index 02ffab5c86853effef1da4bf89f6455508dc60ff..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 58490 zcmeFacT`hb*EhNeLAszISP-zmL8_t@DT$(@Ac7P@x}qSxcSy)lL`6VFdOZi}T|hdC zBBE505@`ua@0}1rl5ZzD&w0=Dy!ZZbzwwQG$GC6)VrR4VTyxE}=5Nk5=PHhNZr%Ve z5#(s6pb7vd2A&z*)aKZ{>fW95@4~w^<_9dXCOJo-O z;_3Cv7mWj07Dq#0SUUK!j}f|p8YwqLAje+97fu$0UDDlWqAUJ`h4P!L@x>3PIK?i_ z*$A5ac_pvF_^U~_(2(KDw>sH|CMGWpGEe5`K`(Jhgo|Iy6f4-iQO0`gvQ%e8xxn&} zns;z@pUJg_AHgBhU8%ttuVjWRf^md~?xa!T;zE~;i6saBHK{V<34g1z`B&X#OsaDG zCc`_Ar4Q~7s%JO%b=Jiwkwz@y=J2{En)Q~YI7?i}WK3>l#sg0N#CP!Xlbf>oVeocH z3YCI$z#h5TP+F^vFsj(N)ZSj|P@B~$`I1jYUXJ28=s#P&DHvn}f!fQ9109Gx7sNdV zAiBy3LRGf0vJ%^LhHp{Au+2kkOLhoTfNl4*rLFaNuFo_e;_;MOtF{ zvTZzMliR+Q6htT~+;PBKjFUO}XRN_*aU;>tF6%K#mvZUI*mj=78YC0sZ4Gs309DJ?jV7^6D#JDn|`)8c^7|4!44)0W~rDhivn^@p`vCDCR&n|~G*_$woA z`gR9z&zT44sC2u?VzbS+SKHp3QfJ0aOm1gM=6pv~DV*+q!kg_fVtHG6>9^MS^xG2s zpI5AXtwi$+)+SdVT%1J~nTJiYH4PKi;6_2F=cTCS4d$bFa81sEqq@9#VE?z2*-*lf zxI0J1@ZUoA2Wv@fnsnBm%Q$Mq(Q$Lk!e3NYTkOta5vo&7DZYoO)^0bPZgE>X<-#!b zD%4!iOv+c)AZji~-rbCHd64jXmTbvrWHvOcHEK0^SaWls-)Wb<)5P7K;({1S*^R~A zV5{2;Nb(Io9(zZe?aYGc*EbZ&xxfOe(46-LR7TVn zJaH~Us9LmkMnlisvVI+ZR@P;H|5L7x(?IHizbuDK-~ij?m%wi6&4)iH`Y94G^~OB% z3(3;{Hd`Owp@~;NVB{b10oW10_Q~;r9kcbutOTCj_hZ}MG79s6$7}oXc-{wVsnZE@ zywe#CZFuNeu8}i`u~@O-`AK~Dj}QwDz8&_#Es>fB-A*Q>vt8)olvv*#Igj1)enb3b z#)IKUTps_(YPet?GAP&!)WA6mB&VjP-X zOd({UfQ_bzcEixO_z0gm9QQdJamvqul)Xyw1kD%iwh+v(@4xDkUj?nLDY#*84whr? z8z#u|g;tMSxoT(nqKZ2OtdQtUlWCt17oniI_PRJ(lV^{5Uto3JHxrKOVUK>(vSTLS z^^2cXD6bHITCCQ&l^?oiA0V;$6RX_pg80%L4xk)4i!`{(HhY%!odf6h&*<0==Q#b0 zvT{{w4+V=J9>b@ede_LwbH#S|WiE8@gMm;@hjmsIX(yy9)?q#rFe6=ob>6k{UBgf$ z;I=`K)@Tv=BTnewLxVovUb;3GH@UoblTvjrNDO$d;kDYWtejYUbo8N%mhCr)v;5vl z;x>|R2=g=eSXpIY@3wG|=j&XR%gd~o`*+v8^*s^p$Kja|P~i{s*D zd*rG%`i{VoNsQ_?^*QaN2w@e@)87`tVB8@Zs))vVNp{u6Gdp5{&Y_OT3#oo>I5=oN zcD9`&>Ia`=e4uj$RKn3lKA=<2ZrI07^!6$Em@#B?NS?#v*h|aIg0}bxZ52C`76wYjA+0TBN-0WX6Qb&~XA$5>dzKjl27)0`0E2fVuV35;SV z#ev5^1R2I)1jO+r;%qv-*kdR(j6dZ#9jaeiz=1Csuu%azr!PU1dC%xF9h<$lIe^;f z++cb!{{8&GC70(6F5SQ?3A;Y}^kSDl%1`z7(YgF0D-KMgXDo5jZ3nY4%${KmGp5ck z(F}x8CNwkc4AW>b-5I8D#&k46UzzDOGv_nR$r*E|$(%Mb0~!E|8J+o`5o$t#!M=i$ zxsem!HBgoi%`vY|-RfL{ykMl!QYesDIJZ6fc|M39Z}T{fnu=`2;r%x>fpd>Eyb6BS zMbqM~#=Yi0>Yx_{^0X&C98x+TW`Pu^jC%MS?mJsR9tq}Yb3anA)*|R;mK2h9eE*cp z$RV)U8tOHzPuSHz0Z{pzGIDyZj@$w>24llVm(Ir)gR#!JaAeA}B0WwXW7~$Z2bq%o z3!0q9+_A{T-oTr_@n8jNTh^qgsWHCvxs{R=@XS!uxUSl;P2Y29-GLh9q+SAn(lZVg zGc4BFSGMC*U468E-@zPs|L!-v#=uquzU98q{oBSFd%f!_HekT+@>faaw7r;3C`YAa zS=j^Ud|{=^>dZKf4tQok!Nm~=p5uV}_y>UuSL>di!HP9U2VY|{p*I%-rZT(c%Nhl@ z2iANO$hz|STaUGPj{_n1@J*iih3J5fgX9DNCB#;6%S2)tmeq1V_DW_js=#>Jf;8Ys zQ1eHRi$gGn=e77scJ-wCKP)|4yk>h4ve`9NNDXhfD>5JzeA)nM7r6S4kFepPe_;R& zp<@Y)YS#U+{+ib@2cR6O74UV9-m^_Bs?!b8Y#bd1nI#fgcsWwRDo^l?&pa5SKi@xW zvspJa2=wFqPP>4yW&VS(#@clP1kRf1QyQ~v+U`EMNwm&b;fy$944A2r@`hHsrjm4Q zf`5NR-7n66;78x?1l1e>gUQC3#73lz^`I)k|NB<6E1w(?f>_2)etoi9g%A}FNx5}x zjLKHflXpWd(0cu6-zO(wh$`EXwMd+ed}*WCDF@PO3A->bkk{m~={^EG6tks7T_8(q zw74HW&6#@9c9BF$&_ws8G;Ay%dfO0)U|SN6lEA75k(bz~s#|7#mA(LFpNTD4OA@)| z>%@ajZw*bDhPAZ7Og`Lu+Qw#0F&l@tsLwZJ#>!t~=jplo&JJtkxeRm#wVl|j1Qa=r zY|UX|H3n&fWJ4^nZ`XhG&83o)@UdLB0nsh@rnQXJX;mtWcN}>gDv@14b(x&e3XWN- zU(>!Gl&+J~G5Op~={e*cGRIeehr9kyAc|o0 zUW*dTE$@gJqSkh5hx0`q!U?(@6{u-6o+L|SmqkCx6ICsavy7cH#Exv`JCsICxIb*t zC=-H~I8j{GI_v9_F@0?ILcl;17T?gYe19<-Ii8cB(Yps~zTeDkfT*)xXbZE7nnzj& zwjc1Xu5>Gn-v@Nrr;-RUB{AngC{?|YVC3?u8?=rlyw=jo?Dl5Y3fGak~%U#Tx;_6%^RG5bg~+E zN;itSBJxP+xt^J&abdi-|6slU7G6=U)lRS85=eYsw#k_qiD^YQxz2u?I?+#N*R5Kc zsV(wJ9-1=33~B8|cBbwAnwpXdwLp4J!!G37%m%l%@z&cQl6kH4!Z4{EslD37)YOYd zph5BmHVyUXY({H9!<~7ah0m_~s^c+6DnT0z@hD2C?WfQ12EZi4z;CjQT*4Zd0uHp# zHlmmNmJDWx4`+unk_n<33$|(9GR|B*&rxQv?2?dOb1E1!PcVJ_j}27zE|iTM%=Rw!L` z?b%V@obn*wki&)Mu>i^sO!xR{6kpA>LNx}Prm*o<*U$Kv7V414eEiEUus~cv5xV|n z{s<$;R$$nq(K0z~QzwUaMBb9#FaGU4DAD(Mn;exg-$Jy=k+Slt{gZPAl<&sMWhyL? zV(`;q1@p(44d~UZuadddLG#jL)~cF2mh*+?F9Fm5SoOel*=u0cpdPPgPYnY$uKxW} z#kc##PP^l))U*3#b;ID1ppYUHG5S8O%F8kbOULCwLr_O^E+P;+oSh52OV zLDVdVj178zt3VEUHm%>{j&Bulma3d^B%S0TU3lj)XoR@W#mLn0i@&^LJNsD+IjGLR zQldIfFtakjilGtMV()7ZSH!qi5vi%)g)uRjmY~BBTRSysb77L@V>S@-z z+YbKt=c*ny)L*N561ts@O+{MJ1iiBY=LHP@c$@!+-WxZ|nSr^Fd+L6Z^Eqbtr_Y_b zyr%}r6joWE@vAK`@q28Z+2;+OReq1Fd;R;<^4mN*!uP~)O2DSJhTKGAuUjv*2Xv+Q z+sFAM)4aQhH|#&(xn(W9_WIZ>L9Em#&^)cL9Lt)j=N@sU!(1_icA4)tE@sdtu2PjgT7@9vPq&TGS(_JusL zdB0kE16atY8NjcsoBqD*uquS>?h-~~7iS-t>z1GNe1CUEE2U)VVeJ!-Uw#P{&5Bvg z^7k6AAfXElA+;iH)KeV22^kWpSDS}BVx{JT$ts;*@#jfG9iJC>nsti)cnG|ADGm|1 z?BB{&u~Y~PwSN|Fw!XIZzHsf`{IFSl5AZl9z4YFdB!X;*vWuO@4(#-V6K?pG+0Tc- z?_*nLx3)sFYY+KF>QO$XoT-bH0eqBeXENE{lbX!Xgp+qf2hd@K^`s{~V2j$yp0%!0mI7wW3cYHhY z$Ey$KxB1>Yc+lAAMUu9Qt#01NO-{wX2=sr4aGB|Ny}DQA%f`NMs6fFb9Z04}oU)A> zaBlimjU?7F2mPIxJ(imD)bJ(5bnwC?W5@-_LI!kxTd?as)w^_J8i&CIl1)eDUf_0Zp~xn+$i$wq^pK(&>r&ad9iU4 zX|@Tqk-VpK27SYOV%e`mKCP!(vh+Bj;OK|B?u+?_D>+#sRJqqIQDd3EYvqpO!fHLM z54|fMe1gWoUgG*<4j@Z*k^7hU z(=u3isSntZ?tYwZ%_NbLymxVeCocp2ju%8G(}So_&sv7coQU9OnHyh8jRe%^bsSFZ z&2(-NklH(T$Mk}gDIG0RwSeIwElFb4f!HOht*$?O#CM zZS_~bfOOyNiv8^0s(w8aWM3(gPK#3sD>IVA1#N z`D`3|!7H*km}R&s+knOC3x{M< zv={kxo%>Y;0#ulJ8Rh~+G$-@Fuk8EU}Qb@=P)$GxAcRB$jB zwtLo5KN1f#f&=fLqg4R_oTC5xXoZ5Mpo}HO$fMGa{$sSl0mf)u7MGi;gS!H|yho?2?VAUa zh%kaLRnE{~-ripL5sdDe1E}VG+gLQBy(>QrEBkp;IXbdM`iW;l@Ij&Ol#e4yX{*YPm=&HH1j1*SsJjG_FXwA3=A!!!YS=LzK_= zy5$#G>2+ZK;8I_aR?cYfnUmL}Vvx%UFG@4siNN~Q=YzMWa|xjy&LcrsB58R?em=NJ zlJ2gvKw`KL0-^~k8FZRs0GnIjvik_aQDv*KmwKGCHG8I7bSz7Wl9h`lZkLX$P{vwF zHfzhunnhvsFKn+u_JkdZn>C@aV9Uz(*|U5dSAq1_+0yFG=pMp6jyN>?^KLM~-Lip@ z9V24T(JeurPH11j03OE4Tj?|^Wqzm>QI+7E(nD&kH4EeX2z)M=4<2Jk zdbWg1XpqZF(uZDg3$TnwJJ@LdJ;elb##e;GSmLX$h>BfSBmJ7q?GL3Y*8BN3 zVzyrkB*>E*ffDUiQ%3J}gT136u)`prz|-y-(mLVsx`o1V!>)~R6UL2k|FZ^`s>xVK zXDOfnY|BIFGr=EOn0$Zo6t~d02VNBRnYan5z5(MNTf`z`(Ts^BbnCb+@FOzag3g=* z=YnYcu4xWcWv?BQEhmF*1sma+N@*6O^AUzYa2y1-w0a!CQ4)rEC1l1E860yC^PzDU zo4T{AZ5`|(wj4{Jonm_SD*z(JO^vcNJ{Br4U;UA5C3g?nly{5Gk5k~bmNHET_Rx70 zFN1;2BYSR0(JJvUW{Y0Lc^lh=YAiPftOuo!(_h1FDPSR@{{k-*P);-9Lb7wMgCFAsKh zXp8kr+9Y?cneC1SuK%hN$F(;%v75N@nt-jk^hs5^0ByTKYO2-qqqH$S z24{0SRGO;(jeUE?8Pba{O1<=dLvXvcLzE2?_B#_yWYthBJt;-{$ zO>6zb?JcfG$tkVH#RB7AvuN)KvnXu=@iH`|zI|LdbZW$u{Hne}te~6mC+N zf7O^FJkPkn>MUQNeTm!U`h57+kJ`$xhR3cD%H5*ka=ms^w7*N^Pdyvz++Ecszk{tX zRWk2TVGi0oWKeK@Bj-w71c)i@QY%T?ay;nGXWZ<>r&S?a_jc4Cjps)5w(2kQH0N79 z(Uo*RB9~edIt1O7Z8qmx;Rk^<h0z+ zYgs)H8iWDqmEqoT#63$M>fHBGf22=i%vR-X(9Ll6c5Wlf@@Z6hFZE?FTfS(7F>4Lie^~=Q{TA5qsUD4l_K+TWgMjQ?TO4TW>`hML>>=_#5hD`P+o~!Y! z$V7IqD{QAg^DZeLFg-QioUMj-+d0Le3?uTbY0wN$*M)|R{))sNIi4^PaYOkKZ*AR5$U)CMj9(3Q1frVn@T7C)V*pSYU)slA^ zKFNS&St^2UE>0T}suDWLQKspu5BiT7Ubdyf)d}c;wN{uffftQc?z)Wu6o#ELw(o(> zN>Y0=x(d62_nsC&W2Pb=3q^~d86Hf`12<~y?@abQeax^vAbLU9B;TnR@bMW40pi{ldWCA7aiKRmOOa$I!?dgfu{R}p4&+f z175Y=Xj;@K=d$0F6^ax~v7Y{M!}_Z;y?!3HuF$!P=C6~&4%_zD&%hR#KqBvoP&!w# z95Srp%zs?N0Q{c5d!ECXz#lLTP^yUUkN+* zw04^%VD6cPOn)V$hmO~!Ppi%!PymXs!LIri(H2yfpu~(Fw2~(uZR&w)WgLx` z-L+uZnwz2R#0frdFk&^0QVax}jC2IEV(hoxr7va`dweV#7jefw&> z992iWy3j%^Px}_nbMpUiLDlPrY+XTmR-DjD;5rBxmPb)nBbNuapF(Kh0S;;Yn(bQc zh~kzdqg@U>1MK({5n32@ee`s|=N%A)=PNW}L#Tp{FqLMr)lF42x$1_5o(#q0XYzn1Q87xu=aDFH|tqX5bcwc69|iw@fW zTb%d|<8=msyz_6utYcRcCJwhsknee*~tJzsmV~b!tWrrY0 zM8J%lTFSmF&l|yJZJn+;MsN?={!j=zKYiuMer+B`7f7N!Re5r|i4TC_OFlQiipl!| z2D-8=+y^sa)}$h2Z2^^qJzKNH@q6>bgxRbR9@>cE|G|NpTqdKVz8r&szd@KA_%$5e z@ZkmkPVS|=cH*e`vk9iFqV(PxE5H!(jVdmD6jy*UOlzB#@Ims`@d(@pO*RE!L15x8 zqGKMpiYiS`r}{=DeV}6=I7j7PSc-1WZ@2le9J3inBlVKIVP=BV)uaORE_Vb4q31l2 zG*RodR@Iw?CsUJt)E=Wzj}lTr;N)3<%>4fN1bplZhfG2{_GnT<+G^xs!2Z_K+WCqA zUU>!@QeI-#bf+obs<(A%ty1AZwcOhlh*-7k9-%2ZB}lX_SC86DE##a0AgV*3Z0&_$y2{cl)d|q`~lw znK4*Nhp}yW$lwk9!nMYDmdu7FnmeG>_%X80Mk|EgBP(wql72|)b#%8sy=#-9pIg== z#597v^z_#gS!vU8{)IYCKWE|$caDQ=>3m>1Bjzz6>#@)l?hE_APScUGXOPG=BhwN} zMFi|Qs6{Q4R#6DY@=$G}^i#(Ewsb>VXY4ZT${To7EU2^2`+t~=BA1dyC(p2hK&2x7 z!#8xHyye$>UyXKe8pSZoAD|fu`7LJCfW~NzwXN#Xjzi4+^*Kr#U|>49iSmzFotj6t z*wE*)s3cAqUO>^g57az^(+YbdQ*^Q-$?Raatx-?QJZZW4HzQ5IW3~@8;r;1xq#)>L zf%(AbT#+|nEMuAXu^YAHWtK&=w?r9@+bc;QtOS^?Pb zl{iBmoHYHRKRgB7eI|*OF4lj&6aOY@3(U;lxcBdG`N6o`y|e7}0sGh2;3@!p4Dbz` z^y%NHc22NEr2i6~Z&ZSTai$pV2%0zutmg-_x%mG~xaI4nS#wI&b5!pB~%# zn_-k02=1|}|5lO(5($)-Z z@9#J^I1d6l7h)6ttt7`Mu&%@omVbT?ZlMQ*P)xxx1C3Ybs;Y5@}pm{7ok0wxsv4}b#G=h=z? zaQYnWECA+OS>_^S<|1U~>Tc$;dFFlu=6(d`Mi1r=8s^p{aMwB$3Ybv9gaRfMFrfep z3^JjB2?b0jU_t>C3jSZ%Vn0T$_NSKn4fr3$pz+?w%Ir!j3kd~i5VvCFa9_>k3SM^E zPq26y>6_B7$DC3l567OW`|X*;;m-Kk*RpN#j(^_0+M4<~?770%8OwRw&*DaZ9`O^m zQ&6;hA@&Ft9JIW?8C*xcRW}?zy%pG{+Pxl{_Vy>vyNl2|y%|_TNGE_V|K8vaKIDNn z4(I9F)3QUf<|9UHK0N!IJWW(HX#Zp!FKLK6_AnomPP)r*Z$-*VvLZ*H%!?jynJN zI-I6uUe{VZPzwH*|5M7S`&&9_wymaV?3QL@Rxx@jh zUg@}8ZM*sz91BsmZX*6PYe|trbE`4L-^uY-b~q*JiwuoJ@H{QSJz^H?wye1~!IA4L zdx!KS9vhBs%gV4J@mytyNowCgjdk>OaA1#?@j{?&2LfDFs+;Gj!F@;;cuX>}RvJeM z(KK1>4l;giNYjl>15~A>#Wh9m@Y|)dW6f?vz`0hN@48ziMUVctA^<|ZgkY{?^u--p zTvxf{(CbDz{G;k1j`QKZ5j8NHu+B-ZjChpnjN9j)8-5E8)7T|=^SoG{SGVc9nna*{ z*b^%~x^CGCCgSQud%z{5^c$ z)zj{e0SlU?z^lk6ftmhPo0Rlh;ERWs$MRchSN^zafA*^}Xnt}Ej&{0CjrF?+tB0?k z?Clk~>E9j9!YqV%>`)Ij%7W*5q57fsc3itDrF(kG^PqiO{#kH9rc|s61`A$WDNwF^ zO&^>$^5L6pky;10*YE2L+gU(41jYHa8r&WIrZWT$oL-&U;T`UMk0<3cY8&O@`g_;j z&`%5t6+GCug&dyQKnl|sP6Q90Y7?jY?oY{hNjVsQ0C>R?Xs9cK3tb!yT#UKl6gto7 ztP7BSHg4j?`BHMJ-Bc5;VTR&48%=g3zY+XI>Qu5E3k$|)Gi!B}=T|&oqBnq&wfao& z8Xct$3tmfkA5lqc*yC{S0Ijus`>sjhDgt`4(54PANPY}!*gv!iTOO)PwBG}ZW7jZp z&QxO@xqXK7ZPK7Y<6OU;dFNTMUh%T$m{>(cX>7PveY|OHr-{aXeqbXnDfjf`w>WpT z*RTU)bs?m-{H1ZmHE&?gam(}Fbwk{1x1d?)aBiOU$Wp}GOjA4Byhdx^BscKr<5Z%h;A{Irq2J4TfcGJa*)B`yxA zuo~dqC<{x@R5-`C>XHK58G%Oy6D@=bbZw4&#AF;lx{xj_ApVUNCHN~!mn2WJ<ukF@S<dbA+N+YdL) zYB$&~sW_|)E_@aO=^7-$Z^ZEJSuOav$(vv;lXX{!_&B)b)Ape6u9lNI#4c*5Xl? zTeR5rczOoCh0pe3aRA;Rps5DbKSqPyu2(c;AHSri+bptw;#6v)AJ1LI`Bt`+r@u>V zZ4Bueausapm<;rL+L?|9gd?>pMSUB_{W+c2cMrV#@Q|@8%#TnE+i$lEPhXbR>vR+a zhx*1H%ppM1R~d~%*V#H;8wg>cFb4;s{Krj28a8*DHF#yUf5g!}*{EyQ~DGW5!}%b9eBw##B+C%E|q^L2id?+Bq-|{B?f~Clv@%?d>0I zjcX&PezjUybxt(W^tK>vTz0CHy5^sN`6g$8qUPLqQj>rF6H$`iH6I=}3R|6w|;QYR&1BG>g=e z>(0B5?va0$yDs2tqhB5*lk-7~*ty$OdC*>zgI$hn|A$hWn^`6qKg8?)!-s}oa9eYz z(&*Y)VDmY`#6#HXGwqLK&$M$NICn0c$Qa02J3`9V8%C2ek$xqE#BK!(%ETN&&KkX5 z-Q}UI{MSUsf&YvAkT>m^K^mflXxnb^Q0sP=$n#21%I+HFbq$8>qQ?VrZ1`yPfx-gs zJ_8nalGA9#x%OR~cH{1!>0G(seJBm8@@0ACHI>(1>##;4ta@o%jTl^Y+adX37M<73 zcz6QEFyAEcFFY>ins8|Aof-6^n-7pS<_*`x4@Orr>Y_2kKT{8y$mOHA#pu6iEYKgm zKp;TGf1K?08yuW7!eiqY*5Yp(P$2r>zZEwK18IgyNWWsx`WI0SK!laf>R)w$SO9=d z6N}#M8A5huzH+lL4oCVZ5NOI9-8q5Ep#}A^E2hTr#(&PsLogTJxcb@%QIgs(O zga7pzy^(C7AIbIb-Tr@{y@mmpGyjsoUmtMs^8)|Lf-{HdgsFt#q`@Nj1J|VG$vA(;hz9W+ z3OL_VWE{l%0_vx}CdiLXmN{c*c)}dalSeD@`<_av^FCsX zMwMU?eFu*u)8{p9LIITvYs00QEtr~6dubX&|E6*e^~Im8*alam1fJx#Q@_Nxz=Z$b zNN@?|8P=i4)>?1vR77GIx7$>N-Z5q<{{}IYrxl*AdKb$X>`X|Fr0BC;%T~-|%zw`v z69*n%>Jg!})1V0RYow=p`d5auQ0C%CySl=~Qyq+{tPXf}<(u!0zI5ZP1_`!NdvOeh z>zc5Sdi0@Kkbw>;dr(N7D#>)a#wB#^OlZ;A+OV|7ljca0kf@_Oiz35keFqkMuxU|6 ztMc3LnD0&D`VoRnKR)(d(N8k0$$tp6Fv>jvL7Deaax_hHT!LTR4HLQ{0q&@{YBR5$ z<)5#@(XO5>MvS7rK$0z0mLKROpI}zLbm@QMrxZukMy4w6Mab^nEP7sKMLTgG?5I;9 z`stSC&`)Ik2wi*BAIFc6E7ZJgHW`(Wf;V1`&n9zcIECC3V7T@lK`z3@fHp}Q&P_q1 zkD6^?dOG`g%3j7R=R~96{TD&9!OE9h@Y|V4H^(Y?^TeA7X-6@G=F1 zbOB?Yfp9EvK17eM$I1LZj+hF?$Sm+3Bi|M1J)qE<@UA~4dbDgD&z)z&Kw{f_5Nn9S znILYOl;E6@btDlD(|9_YMcmjbKGkPY{aNr=XLC!oe?$hdbKSSKjy?$l2Lk9$8FaTd z(oq`jii)aM522L5!DZlu$DXJMejfA^mqfVu#Z0k+?HgsR$1Y2CMwAOI52<+vSNEA*Tlf(iGToILobgI#xFQ%w zXy{HFB`z*>xtLgT@L!WEBcAZLI-7shUB;v;w{J4M^H}=e?x1>hb6;m&j1pxCs~-k$hon#`I0x*Jn+>J4+6beHjZ5wAr4F@O zosuv4WaQ;2j)VTQ<(q;*HV~-2yg1N-*mFVLV*sM7j388H8!IcZO=tM_^x?~Qg3g~t zzYiHL3C?MX;{|7$dT`)j)b~r!9O*Kj-Ve?x5o7LdeuE05X_pGAwv~0;x~(|B+0Z|n zu7GZ`oWfj)_L2SKWo{@vF%6$P-qYx)>hS7kA6&uw4#MmQW zr6s>p;Gyk7hB&;Si;d|m!g5G|j`VV%Ghuk>6@Ypg2Jqi9(#q6AO_3<3@rLMxIephftf`ec9$DN2&;{)F^IR7O{~oTuOa&8uWwA;lPaf2m(4F z^-X;l(S1SJerG9bbs{-Q$<`YJ?b3k*D$)|mmu=%Ao80!bq#!~`;f@2=Vw}v$KVuDk ziyMiCc3F=}!c34ogTfsYjTCK}^z$S+AJFqkfvS<&_|iF+gk@J7l=`5TpU1}*YFEE(04?H0SaQ?-`MCb$&4|`>YHJE zhR$n(d=V2L$>BVCO4g} zZ~0-sH>v7QhTesMUe)>;b}PC`1Nn!B-K=%JN~bZU1qTviRA(5*!{@X(;Pb!JG~=|T zc#n$0rfvOU?N&*&na<{)1qJ@fNSnUh!P|4@0Xiz(F0$Bc^X=8P_omdDu@jTqS&}*5 z5mgGO`=9V;yNp=gR$lt8H9q~eME~a%YhNqT{DQT~6$lq+kwxZV(`-${gf+NPkm-3T zYI%eC=p9^>bKs~hZywnHEoC;8a3t=|Q8E0tkp010Qky27_2)8sdnZqvix8?7t)0=(GqPhj(b=)eji?M|=Qw#IJpFykN&{y)i3+ zXZQWswzrJJJmB%#emtJ{!CLBcLLBdOMnfAOdX{VC%wa56EO>qr-~A)RLW6IIeQ-;p z=0UfU$>?ksx;Q1)cSp`+x4hpFznSr1xLj<5oY#eQM-@tN_hXepx5uP+LOXIbM{QX# z{TcO}Rk3wDH<~Nf^Pe@u0jO5)7p=Z`Gy}>ORQzUEO-afq7l^P@_vFsPcWpGOaPY8u zA^swGJsP_kB9L|a>r}U)#mj+X3MWxh`H0E#M}+vrc2UlQ-$#N22J||;tzosZIa;L) zKL@)4-hN;UD|AP1e!s3!m;GvWBu5da-oT3Lji_>CnpIU9sMM}CKQ=me0JLl_0 z8fHH)FQ!v(4=;L{vDi{6w=_!JoH*oN5_+7VPoxw?6VBEVQXUv5BWw7to&I)zkXz>v zRZG>w)}WMlHV;^NZrZSYwA1?{R+Qp@3^e#gT}&Zlp@5C1h<3x!xA+L3Ivn>o8*$3dft0;U@&wHn z?Y0oiukXL=lV1g`ttq%+Zw{7Y?i(h^@`YB9Te)gy`l50yt4)3ReG-}Q^1RVc3ze_E{8xs@NfXCEN3`4g+$?1K2x91fry zIg2#7$~JqJ^_>If_s{6q4(B-ijIwf7Y7YgA9v;J|o_g2F$#cba_hl}0?}LF*O^0<> z6lo`Y1623}eRh|mJ}*W7#23QW=N`GLjlLtWWD=vgO?^%~DMDC<^YpicFc^1;hAN`5 zUXopP@yw1GpmV4r@sAAMY@@R zJeku8IQFpg?(S6v++KqN9OY893o%$AwIEQAtoLfr@s$G%KOa*9jU))7;?>|C?!kyU zn$O1qImW^w{we3LE8M{xf>*abfl=(FIPmy~Aj24pfH=NHoTcA3!0{Lg4dYKaPKWB3 zVAA)C25gk!slEhF<~^g!bZqtllclxOxxw^e{9wT6lFM@jmu_H{gk2wo?|liR{8Vor zoy#w>;Fa|08A}Y$jM*4w&oGA>Q)ifH214ir6PlTJhG{gJ?hMm61MLBd>1Z;&X6Af` zIXPp_G(mg7oHjE98qDa-|A0^v3JmrYl+2Bs_^yGnglLX=b?R2<3giVNjg~@zyu!Kd z+0XNgm5&~$QB#qvIK2OcCUEYNhF8JQx@cOw)wtLEM;-KnK%VxbheJx|!z_^Elu-|# z!+mE9$Roi#ZSF_v)mjAI%#uRVj_;q6894+NTSL93^$ENBCjcs+Q$|kD)sb6Z#$ast z=+gPvVldV@7miGMR;0(tV{F?{_8?Qze?gPem^&7^*c*7$Hy*4&ZOfVzH8sYUKDSZ= zu0IY%jq9on+w?t$)*YxpPU(%=zwPy6kHr};5iPckAD!z zaJBCF8LU`ybnrDM6MAzYU@Eg~zN}Gjdtl8sfvhX9zx7y)_c#!858vdOUx*I)I7kMU zYYMRy+%l1vhGn%JkiC)_j4Ci*wjd3764diLsD*C8>6xn^yJ-;3$$MU+4spw7^2FyWGxbBBVXF+ zb;^OXTEZ?24CFO=Y`TxY4#jLKQ5VS48ZGXJPjjYTv|S`o5;W0$DGeLThu$^>BG{Hh zqa?8ELF6U&sp^(lU!^ZV*=J%4){;bS`8x5S(_2FmreQ5DFq04Wp0=@BQ_RL8F6#5m zn6dKL*m-*HzO%zxc`gH8L2W1YDgi}~BU^J=SdBp%A=wa%?A!IPfBz!EFZ9sI( zy=g5Yby}4Q;~hs{he~7@P+cZxw1Q)n>esZd2c_$zGCdNG5T)Fz2}I zEy%R^O0il@d{#_{X4ZhNg$_A&>MnK4T^KS59YFjjEooa$t+`7ueYdF@gBEZ<*@ zMvmv?XY}rYn(sGr8zAbe7uv$CqUMp7f$azUt1I0~u zkMQ~HUZl4rp@)2w{BYB$(9h%H*(A~WnZ}rq@!-i%uUfkti!0>aG-X`|t>@O|T$;L( zx1^2?5Z9V~ee(wAA32~i2q!(FA)Tzoozjh>u82Gmdah??X$VdW@?Lkl82^@Fhg29k)3I~zow?7LM@P9)36J< zHnYL4ZM^k1h-6+Xy)aBFM{2J&F*Wt#5onOSflWjGIh)ZM+G>^aEPQs=R~?TrQVH5% zDnU^?jj=Li08BCr{3grDC9Hud;6VFqBYL@S$zXQ)aCSH&nIH-#6S|9hbm*R-Ik-;Q zJgbtQkxe)OW)qU)ZZfh7&S0Lw`Hc`GHxdXESFiXkMKAaF8UuQABnI>)9ByBrEudk6 z6oYA#;#=l_WkdPE&0o_=Tc4K1(DQ7It~Zf5yE(WncT zQIom-oH1$T(~mpMB|O}~Y<(>;UqZnOrHigTJIb3=9^@NxxX?V7zQ{AoPowy1rWL9& z*ffQWueyH5$Fxv~Jm%w1+o0eIiqQ2p^G6s#wgST@jh4w_n>snXBl4E?e(`VMX1s6j z^ENpuWxj=Ikt1d0Rr@FB3Mk)=mCIB>DS)3AE0{mVY(TGOeU;3u4w{!1vsTsIv79di zH_M;~z)aJ?b=hlR)u0})W={ zpbLuEMWjW6wXhV0#b{`Ph*5fwA|;^(6fr0Q(gcKng1{oUbci5`1yH1_gsKpVG*OU} zJCSwudG_v)y}$O}&HOm?erL|f^UXW+&6#iJJ0~?`?{iehYANl6qi63fu-NMHQr8#V zw&WfS1rH(qf6=y?v$+w?93x|#Cu_ceXuYM(n4KQ z7rCY$6f5Pm>|&KOmRS8ZHHP{2X703M&qB+?e--bsl|itP^?Whu`eV|(AVBB$s2-KI8HF^{bb9u>T~vua^7&Nio}> zTh3vC%g>*5kpGkZ;ru7nV>_?*|26qtpVKs(J@OfM<%_MBe|7wi_W4!0Et~z*S0aF< zPvZdmc^t^T{<&D5^$sLp&mfJ;Ly*?jT5A38$+82SfoWxhbL^M>T+7@WzagUiwp|b; znDoaeM;KfIuSPjqdfYt8kw}O4?S=B2rCHz(qu-(&U-d>>I?6nl9@bdg(Y=Xi6ls+6 z>ruj%w%~{(^g@NI)}*e($W2PcKJwTVSh?zOD3cYYe$cGAaKD_SX$ar>gNI{pY%az& z)MwV5LJ~J`lJY)TMB0!lhDeV|PDx3b)ky93MIUTU*wONVWZgTiSdrA!z@Xh#ay#L2 zdbDb~pdtEwmhgrr>SZn{^%oC2s}tCo5_Mfgc~#!2NAH~}^Nipb5O(0cia$6lI=35WsV5`q-5NHXjb#kX50H@O25WYo+?4rlHX+1u z@^<1wQk@bG78qu_B%Yh8FG_u4^0u6XTGlSSRfG@BtBIdcc7(AEU(J9Mk?F6xA3Tl= zIB;S5nS<&;aJpz3M0Ig!53;{-wko&!?m4xVZ!#d%wu^+^N6CAwH1oz@SC8F@B zn;6nGN)d$WtCYDTZwi3vj%^P%_HD(%yIjMaFl_*|2|Ss`?BX|tnqSIGA$9_=6G_rS zG$X_)vtEr$>JlrpNAKt}Y}MRa)MEH`o!UZjI6O+A8>_YsG}PBsg(-FuWw*z()tY;KMGtx20h1 zNC}jmvRy-4;sULi`q+$+uYJEIWbH1i`va^n?GH=7Q~N#y+GV67yH*x$bYd?|X)@>i zY_1JFs<%)qe)FcbVL_w5^iYaBIpI;vb6w3v^B5>foUu{y8{IfIYjnkb)<3y-Xp(ZF zJKlz@=w!Kz;EpoMJ8Y{JR!p8@Bq&<=8uzNYW=u3~6W}MW#g3Ab+ntYj}o0FHBAj!pvh#A)N|2K7H-bL#bBLJa8F= zl2de)L+F4jTU7Q3Q!FWn=$IYCuq?11$F&N3a4I;s@!|Ri3JsV+5&soAxwUD~(2#&W zR}C&3+`hrJ6z;h3PaQ?Uqbuy``?7#5a<&S>dWI=k=Mg@HfS4yz6b4?JAuoMMDf-Hi zvz|3%u%BF@-*><;$nNwbwa#N$alNJ7kAXudQ|f^FXwnJhDC*H%N&bqk@lCM^gR3>* zN!r)eY(;*8W#7EocR({JY|gve;TR#PwO69La>8Lw`yqeds9;>-Qr5>G6FO@c;Qi#( zm6+$tvWzY9YxfskE;;`rwvR4DWA6@~e>J0Q`K%asS$Cncd{ETr0e)% zDHFSV!h5EwdaRS80Rp~{nI_ts?i$vL9hgJQzj|bWo-g32BT^YRpg$N-a*i_Q6E zW<2FQn<*-5HsEYM0eIHE)B6H09zs1es6}EfUIO#)-4$<)MMl=7LFN0Yi$Q7~@0~jr zyx!I=69%a)C5qG?fw>TN&UXP=(%t08=}}lyC~8J1aNcfIx+%L^=;IJRQ!hj(W;PK_ zPZE3Y*@})=Oxo?APS~>{k$rE<<`{wLb3EG7BQ6|FV+zBAvQACDe7}6PwPYqeWZuGT zpJLo5U0JVj{DSwo^&?j9c(7E3o~+)j9~(R3$nnY!7#Qp4@3jpk+HVJcXux&NxUL!3 zHRHNwT-S{2A#(j??&<+|Erq+X^tW1P$ zoqGqeuXoL01J14)o^Rqvp>Z8fV9qc}`YGjpM=cc0_k+cK1ivoDoM%*bN^wcwwEJkk zI_@W#Xk4r?;!qB*F~RWAi)8b=ta~Gb@mX!%m#T&W9$I_ah=^A|umlF`<~?U$gyoE0 zx%!%NbNb9h{x&va$3gAVvSUVRs!jTYj1iy7vLvdIw>Diud~Q@z_QmYrbmQKu?lun6 zbA&My-?qbYVJ?XSehY&NV?-ljZ5#Q#l4aoSs+NNGP5o%sJ}a}quK8h&j>joa)SmC1 zw(dZW-7&QbZok=%BgT<=4kB+*Hp^in5MMG|C8*U^h5Sk~wv`AS-FdrdWXk~+fAR4U zqMxMwqf_Sou1Xm3xnYZPUiR+q!x<%TK#49tuE@SzM*M8EK)-Fhn%Uifn5f3EhaY*0 zgsQUx)o?2|Dk)V+^$=I-7ns<%Sl&2Hou*l6OrV(ZCe|RK=Pn?*Gu9R zyc|48L{}HQf~(zW2YXM_QHA3k_NR#8w7G((tJ@j~rl!%+7?CxiKP$MLb#i*nhvgUe zM)-)anaUXlU(zv<|8}Q^g1ysm5-DAff=CylASpcNF2|i6%!&4{F0EqX5^ImGmUB+x zSD^#R(%4L&XzvLWIPT$lLt-7?*v#aU9yY>4#%6{Nz78k${HD$`DQR;LS65F8j1iIC z_`RCCw%)mavcv0@SE5Gdjk6c0y3yjAt?n5p>WloFX73afSbigXC~Jlm!~2w1!%Z%nZDc2`J72lz(C#7y}*3 zx+ez+w{P5f0XXjI1~vew2L{1uhe(J>;tX1dZ$lv%!y5*L=)h7E!Du81(7^@kz>?ws z^Zh;WUZ9VZcn~j)#(-~jpm{?fpfjBw20{0NtKsOY!E_{uuBic-b`jvLzXz@Y`dq#m y0@Q@F=$};X0blrp?gak=XWa>ABKsgHA7J_|fP4NPI1lKPT@=CuDl?g((7yp~`9oCz diff --git a/dev-tools/packaging/templates/darwin/icons/filebeat.icns b/dev-tools/packaging/templates/darwin/icons/filebeat.icns deleted file mode 100644 index ef9b181fa2aa4236c3e1c6a8b1bc6844f35fb52c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 67255 zcmeGFc|6o>*awb(W*RlNOoXz82$fK_WSdCJ9);|sEFolHXQqWyic0n@)hV)O&pvHb zcCs&{WZ$z42J^i?BkK1&&%eL#AK%wG|D02Ef3Evl-q&(p_i`L;uDe5s?L`hYlJXFA zh;mn7SA&^>ivfZl=Cfx`89)#c{3jAZZwLRH_xZL0{)KQi&`^c4>Ul=N7nx^IojmV@ znCzv0((CQXHzU_&Y~x#0c1AG!z3e4s**4pFgX4q_jH{N`GksRoXa73bNAPr2UF3Qk z{7UFH1}#AU{h`sv#|2&6&)OV`>gCYwc8}Z6rpY9fQPpL8y3Hw@O17=);5QSj^Y@;j zQmIQkd=L6oNz;9lVs}NWO7f77-izndvLEXdPL?|V%abNH6GNx-+|*t)xvL)?`}C>O zj-6VcInq(JU;i*cO(be3k9^M0B-~_JbWpC*E$%4n4wT;s*VA!=mh;Qu^%foz@4G{v z^_d5>;MAKsR;BA4ZbO7HMn$iHivvwIHSxno0wyx8O4nYgO!^>pu%^Dj9zYV)y{4Y3 zym4Jh;jSC<54Er`{T{gY0Ypea=Oc;H;pS~IQjYn)Q_rjW78m#`NA(haIq1YeG$9(XPl4`;gGgvi=R;c>K&3l#n`2CmMx-aIRYX? zFh2RU3-9S)WFgb`l&lgkr?PC&tC^gI%+x?u_^81goIqR`(ol6jHa8`eJbIkS|PD;vf?A&xRWIRs^Nmk!e9aVeGFJKCVI zcCPmpL?}Vuzh5`DyhvQ;JFH67YrAUe&U)N}(2T;Hd6UYYAMGkD+A}lJ!rQz6$m&_| zM+M}2kH1SwBh3p7yIvz0pzv+s%Ma#jyUyQt|NdIz1|0&4s-o)>u%5Z8Vp1^pEXh_C zPi&#n+y!mtWGb)p5vk-yGtD9(beWV$o`oZimOY^8R`gO=<5lL@}`~;(dQ<3p+{7x zAB?XnEM;{uIqM@E_CH+V9`CB~w=|w#|6w;uNQKG8wb-WBcb(_q>^$0^Iv= zk}eiZCUfph+Lw@ict0SvyQ0YWW5*s8T8Q2L4&H_NDfQh2GxC~KGe?1XvLo`~HeyM6 zyb&iGrM1Gstn?N=CT2H0T_}$7HFL*p{Mp^OHdX$skbPKPNioMtun?C24)!oAz-Hz> zsp2x_mP+(<0UZn)b7n8ZRaZ5Kv^Bm7A&`0u`BrR=xOY3UI)eJk_4-D(A=x=TgCP&n z4>?_zMxq`w+z-Js;>Oc>cdUETSg`@DVD(>RBf>|4c8h0Y9#aCL>i>4{$29F2b^iR%WA<>q?c}+a={)T>LC9KMAs1kMd zg7?@)@OY>ZaY_Tjug?cicHFDULLL1!9XM6~JtPv#UUW?ui7GiHxeFOI3Rn$#nSO^y zH#rpi#OcPXgU5Q((NwWSvdD9v&c5KS8FAqv7E1l)Rd*VXH3pv2Kk|#5*;j0Z9!bmp zP%6L=d8oC<0%to7^jzUL|D0@5YD3Cyx3#}zqzXR#$i;jTPt<0}S0%QGS*(Vp7m?Sh zv=^Vr5?Xd)AYF}`0u&nKvz@Rgh**nWUmZ)J1kLRgcatKV2P~y|+6O~~V~qDzcwJ{J zi@hj)q(gH&e%T>-NIzUD{xL-0CoHxg)@n%pllA3%=tHlW2vV#VsQ#b21mHh2wa7_~ ztH*MKMd<*6I$vwN%tVM~$3V7iR-Q=Ip+hv)E*qzNPpvhu^ER0r;KV?h71&8O{)fia zt1^fh>fjh}AYX0w%lffH{LnYgxglXJ|0xix!Yo##KD8h!*$nh|Aq{t9pjYU@V@MSG z>1*Q07R0pgRDA_Y!sy;9jpP;}Mv8iZ1|CF8G*H3|4T(VVm_K>F@2v8qF!DS2`FQb7 zpuY>rYaYZ$gVQC~hqqN)8EFcqeR)4%2RAjSj>ohjqV z+{Lf21FN7~+`rnBtUS|nP1io{7#aYt=`^p{}Y`^(pl(C1^*wI7o8Iabq2U}j_^bOT80n7p;;X0PD28>#!Oava}GUo zp@|-WNM^fN&yU4}iI*G!vug|Fg|#~v3}iXWio|~6bW#L5KOngthp(~pURx`bqerxM zInPTYvH5TPfQ&J(VEtISRWp+poH>xM?p_=yWrSobE1KvrqS?fy7DRM!&|08>q4ZQq z4X&o9^y}X79?rV^O^3CCFr)Oamn=Ibl3zI9!H=G6`_+fU9%;XB4<_B;$bhg?_FGPO zdFxhZ6plK7HT|eN8ai5^hT+G8=slUTZD;mU&W}grC2kxkp`?oKw&7(y;Be%1Xd!^JV5bVAg!t!>)Wf%qKry2EOf*dFh}HoylW(00>*J zz&|eK8V5Oy7ApXr{Ee1Th~%%`GTaDc!ERvfO642Nhxc9ds}JN}SsD7q`mQkr_>%6~ zpGW|gCwkUDM)A=qL6_$(1(E|Op(7^HKl(JW+CepvqT&^-Dd%=1?DkH(YO}^Bsz zNUQ|v$u;)`XCr7NBc%nPNuPl*+m131njHfM4!Q#baduk{7&WvenQE&De<~BNTSDlPc-_!z=Jf_|Us$%V&^Ad!i zE8YJD!A|l4IUr#DDfIM^cn|d+W!g&d!=xzb0B{toH(>{Wqr}3==6KnUJEZINeU;B# z1|A=4cutN0N)z#RI}DU|O#&n;OV^Q)#{`mZS}`NBbkWy@0AC)OG@jSLv)S>zT_#4o zOgPalFD1bb)voUJzyc6_Lk@t9zV>LHpw3d^F9CJB!{tg} zt444Xk9i)BlH0t~V4#W)&m}<`f&D)W*irF@{ookko$n5p5|;t_7WtaM0Wi0ZJ39=% zy@XjzqyOY=6;Q_&Gj>R`P;wHKZT#`XkB-Q!gQ`TeqRB3g>xJv{?l*vs{uI9svr6nH0z#sPBG>!riU0{px(IH;Y(5=PUPgXn_Hg>K^s}qFI zJHHr$gD4XNs87E49j5GvrbkG<4SD^91A6uRCl@dSCMK8YgEsN~lrvzbvYJbgvydEA zD3Lr5N}E9=7`F=;`%2+{{pqxKRgXhlx(f#1`)ONb9i+qGnA9qQq5FV%3O%ycH}d?) z9fE@RA)Nskhx1VCm*)@80={E0dsq;M{llNekY~CAy{#14lu~{F7HlWIcA2oXI(7CX z3u(3UNR5I=hRv&k{E#+VV=vGbw*MO(fl|r8-sRA-kV^c!52RFt94-N2+{3J68O+b$ z$gu|}WZil->gr;$=ha~D&ht3HDNyFvabz}O*1 z?O^-|H7!2VB64C)nxf-SCkkKN-2~zqTvmW!d*Yk_XpRVnO8$_0w|MqQ%xjdro|L zh{Qftw}%6tCp)ktC*NMv0N38W%yLi9e-h20e>jZ8!EdObGuEr4_`Xm|QVhCr!SOd-y!23O$BTn-6gvnP zoMmIHKV%RrS)B!=W17s-SN0(IzwFOHi3c3&aqhwCV5gUF32O0``8Gs3Cazz^#b@Cm zNsE(Y5g4gia25SMa+sITa;ZPK!nxfmQ=gfI1G@IsLy!%mDs3cNIO?gthy6Oi(_b!A z+;BS9pB*~pqT#Y(%orxbr|F%?-*~kvHGDc2h(K7c1nUCHAp!)JQa(Q$)7)38IVLN8 z8`{Q^nnoqJA^p(>t}wtGZFN-b->{d*@(oUn^lCg^#$p1b=8U3iFlk90xU%t!=G|+W zi<`_k(hxu7R#09F>36qs!%<-nHjEuPT)d~$w&4}u!D%6>_F_oVeen=r8&8x*349Djx3!u}i-bNS?!N3Q6>YJW@@^7E){dM!2HoMdv2s4nuK(ohLxUTj| zC1XjlxdO;BI=0}mno_`!*uG_7=O(YZRR zkgJE_H!wQ_#|AVTutxQ1j%m{(N@DaKcJZ?Uh-9JAW?@*YrxmnXryv#Q^L@B&s`JL& zXp(-fKN@Q7&HMs0my7{lZ~MTgVz!EWCZk_P2MR%Y*b@4_gxQpBew@6#rZ=c1y=H9} zg8C0Ki9*_lF9&G92NAwt^ub3IKsLW(l}*P5iLmwyngZnt0(k&l1XufW?hF$vc3I0h zQuHKsA*=|b(x=}D@YfG7!lm}uY#-g44WoBfclknFZMj#T93nZsq+S>X(i5a!F#gf9 zLiW+TPD2dhKp?zTA(cQjVM3>p&DCqh*=OOE)(rdHJvqiMqt!#-jfI`_ z2At_3UJ*}z1o9lx-S)w$NQ0Cgz`V&z7v7t-P4}&)-3#yDrw65eh^jl2{2V!F$71Yp z%%<)(yd;?mdmvVl;?v#F7k_u(en$rAQP;Iy{Eg=bzInmifSA|3c1WukV2mkDtf%ai zOG|osh5&Tlx71cpe;eVGdsw@*rr>F?io?z-BizGTBs%kh$V%CFGk7m*LH~R+3Z*r& z?ACL_l18yGQ#g;NUPrQ1dHKElzgL|ytjGNmA^jJgAz>%>BDaTdu72vOsPn$f!6GUQ zq4*D<#AC@Qj=I3-IrjBzy@&gMn!*d?XMOUw)IwGAt~W%rU!YfmQk!M#RFhvJImP_S zUPW*#sKPumNp!p|oK9@l_;x>406Ha_4rm$E)mtt3*kqAWBWZ5EEPO18bX%64M^+`q zyhtjOq^c9i1^8U+kF+FS(G?Jrmo*ch*JMx9_haHO@1vw}BW z4!sD5^s6#QVwji_?AWp&jIMRyy5}6QcjLPR$r|?C(!x^6`zY&5FZd^G+NN-rywCTJlcu9smEt_}+eOxwo zX5f>;_KHjMRe#3X$R@+BuG7ld+_FqOIVHvSwB1`a!fOVQE7!l%@ksz3 zOd6Jxv@JxS+9zctDD-W5F{{;tD(2y!Vjl~93hI5MqpAIV)I1Z@kyVq~FoH^K>`CZz z8E-j2>QREadzf67geo!84p+y$-BY{uq{#0G6Oa$g;Qe$Wj;V+q+FO{s1BrT%syB0e zJG(l!?_eUAPrlpYs?CGMH(wcA&%zdFIkI{N(4Ve7?*BD=t-ycEH{ae#{j{VKSo$6z zJQ{jh^_@+NOCuyodL@KICM>*GBIu#yAdV}Y&MLyeRN}Pr+NrOPeXB|3(@_e_PaP(n zSPdevuOxPrV^X8BAyPhzgqdf^}>HEqyJV$ z|KD2~fio+9TuLuuAI^i#Yf$vRl8}@=wkCDLTeTT#Jl$`Xp>emR5-kc-93v&|vD6-J(IcM+V7x`G|f3v-gCvG&jyu^CIWQ)MZGu z2l6(24IP$UP~*s`gRJess_kiM(8hr$evRHu`l4Kn>(vWzKh%EODnbt0&B_@>{+M!4 zW!**k9=zuc8qM2~)$#6JmCXeAk{hSSphmxz+dqmU$R1a3glq^P&aj(Q*;nbZ#%ncw z`K|+R!U-r}xEnX_=q<;k#24T8WD4x<0lg#XOkGyzmTW$}PO8%7gG?!0dtw&yKJkqP z-QGXrc=jM{0MT$P&V6x&oBFF>A>>$*`8{anPJ5ZHtCQ3GBG`ACwypXGZz7?;Sz2c- zSuR8cj$1{qr*wexXr@-WJ1p1PtoAzIFHc*VahhwJInk@nME#|ojokl z7viACF$ys=drdV@o>KVZ!}KbVXI*mx8V1QerPQj@#lFR^@Y*YEDTbvZMFCWBNA6M*lPU27cqc=tRFe37&>X7{WJ zJh1j5ks8-3MLBSlGDONfG$;t^S^NT>c^7Bts-WzcD+`7$WEw@x$a5k#uW62Nd&5fG zj*6Kd-b~&(y6s`&fsp-|vP%P1og`(Kbu+HI94pa2)ups72l*ISv18(rCaZ;AD%WcF z2IAU^mJ-Hp9@+&Z@)UMXbj}dlDy_-_`{Vt&>e_b~N%;P9SB9;RK-vlGuQmkD&DG^p zrDz0)s4O=go(@>84g2DmeT@#E(qUQTHc&QKAB%H$_nN!<$%Q@OPcS^HVRK-@*ev{h2P`)SJ8bsQ!0d(cc0m1SQ+ z)T0Foy(a|zIjgRFDofS+COG;k2SGa+{`b*W2oHwgX-8i_C|{}pfB5_8>-MtWM_-@n zY4cp&Q)S1|p-JYesXW3+w^K(kx!~TJQ2W-tvKY&^K65`l<;k)Ac;?L}A#-%rT#r3e zKbg&0X5ZM!$wL!J=TEP692QyLOw{L2Ea|W{8*nWJFAoj!2FP}LcrQ}=hGU19kBY_H zde(iP;Q)SsRNX4OOozeEKcX3vn zG85(uLQ+wt&Do)guIL@_t2JM#<~(y_t)x8-JhOA)90vw{UWHX;@2|PLe&3Z`g8huz zv?_wJ43I^O)$D%a2T3U_dT&n6@mR|bKJUVZ1?liF9UlZK${%W=le$qB<9wE~3waPq zy*Zy3=3^tuZ@<_Z2|=R&>YCG+e2nC8@f_tOnIA>qRiTMp zLBzA6;_dh3f~%d-mSq8gKW;q9orJI#pWL|RguW5KOBMq`#eGk*SaG~UzglNj`C{X13S^<2 zWl_t3)gY*BvbAac z2)bTdTUw!OhC~*e)4o$J*<#U;{ULAM@5!0`**VRS6n57K< z>}mXYrS$ou?kWiH>^2i{S?!I9cC8-*0VY`9X)KFk{Ipp7Zglix7^ejf1c|?Y(HD2P zI&LZ>zkcT)R50pV!l=s}1Z^WNJ-BPYW#7md&HVPiu)8YEIhBDY` zAYF1^``_S{S0xFl2uQ@?Zo$IJE3fAcXIpruUYLmYv7H(+?!L}kXFmFR;fUo z%e=+%+86t0!OeymzKZz*CSpP^39>;Wk#6TD^3aZ6!q(9)YWx-Kr_8#Kr(JOTVRzQf z-2xq5+uyJzC$YG`xKdrZUV(%ZN+XpoxA%HnS(vr(W9xl?#aiY%F64U_)Nc$~2#5jr z*O-oIBcPIui-!~U!x$CHdQ+Yu$5V7Ko7mixKqCy zO0J1}$qHFtWK1{+VWVZV4nV|QjuVCuUfeNC6T)9T;_(WCEZY8?;QwtE$-KH58B@?M zbQa3^WqE7nL@DZ8j_Rd`zMoKIfl6n>KBmb;{L7aWyn8!)0w29Pi_o`fsn~T()1Udn z_i=#Z(l+#%_NEe`vgSC$esUbMVH9gwx&ajkl}^?@`kBajE`5n4kE*n3&f7{y2gT z;=Ji|V#NPod4*|a+EhRzVLSft+t#)rN81WnCe(Sz4C)9Oc9IpSK^;Nj_R;KNo~6ZK`jO z#YJ&x4gNCGe-HjTLFsC7&RlX_h^3U6bDRDG7Okcv6{0NvetV?Vn@?ZZy!wjkPgoqh zT7RW^Ktla&c2?AZ19Ppnb5%%Z%zhc1SdT6f^k@8R$ZWSClH^-GcLQ4A_krOH;{V_O zZK-@DM`76`A=rqJNfV|j*f*92C^UZBE3I-!j*Be z9_KW8+Q2Y8P6zT}Bcx@BI!s#6=mHCLc5x z*Edx=82x_Gz*Ll3zblvhl$b-trzmNu>SMmmN6LG$goMHpq!|TrIBLS2&${b2?5*3Y zC${$TVtwpfMI~9P;f2Txl5aF=dM;i>Z@$jI{%34Fp7hojs53>e^-V zoYWGpwij+U>t1ocINtEJE$LYspA~Icg~y&mDZAh3jYzq+jU2SjJ+*q{q-pbZc)ft) zv|m$bGVVlqee*8Al>12K;qbDVX*mfH@$9s1lz_)zQcH+Q`?{YbI56!qEBL95Cev3Mdh2BWlhgQ^ttq783xgto3gUh9+oMx3Hj3w}L0j%m8jR{_m>yMXOd97+z z@)foVuem`T>K*Vpo4FXA^94r_z)}C*KA*_plcp_x(lddX)hi^@wYe%}QJM^m0@gYa znE)jRc8y(?;Hmu8JRqmETwq4MoEYtPoHj>H9v-r;KdY|!A3Ax=QaN^uzej++nEz>*XRu7oh;KUoY}mJ!KIx^`r+)XbTgBUL7oww^^G zEjWCxLX8!xW6wBs&6mfdSWx@^1M=bL5=l5=t1)iAILn% zT|4g$rUVto+D%UyGG5oBeTSYu$G?EWro7Y&w)FAp?HYDj;d3dbG$_bW!C6i)J%?aF zJ^s_kk(r)JoA923fKQ_;v*A=awqCvD4WK~;V{k$hFA?N+2h$%ZxvmS(#>hIufv3x5&1$Ie5sDyn$%;Q2KClh6@rf=`p?s`aLaB7ZMs8~DvnP9sBskK8LW`*a zcF|?UPrKIHaShqW3sf9!r{ij7!#4UX;Ov`Tf3ab@_}VY6XzFWBf53^26Na1!1kwBn zhfi%(_=I`!wS}MSZKGs~8CKnmP6$|MqZPfc4ZgGrn#~O_AH}Y%#6EYS@j~PQr{mmj z$4y^~S6O-Y>{)b_O3%u}JG^sB?X#OYdV(FFgrWl$m($nhnRkTuJUnq4zSRVCgN0m` zBgMZNsrWCrT&WwnW%2fj)^8=DDm1}umw@%o0_t4bhmdw$E93e`^GO_>iGK^#t6Fs_ z=L}cpiBS{pBu;}14jT-8LYY?XpLs07VGdn_^qT`Q-Vvd$Z1kjZEn(N zeXBWq@dN(mA&0#Z{hJbAWKS+GKy5`do5lbk4~fK!uM0UTlz9gx%HUEwzqFZA18MCY z@SUFoxP(!$6zRBL9nY8PGO^a%LxAah72}6S+7|curADzx2W5K}8+(pF&I0~Nn=2+1 z96emBbvIrk%ke7aI*3;*(Dskhz`@~>=01(W%4H2x>NK@b+@k&}O&svu95^=!B`FjS zRaUw=O~}lhXnF^;t-lw6z;YUuJ3F;MxG3eH${2lvep3fG>2woK3&!TEv)5c)j!Uk0 z(OG@G3x9+$!a|LAT89d{vJ1uYp8x&Lb5xfAk+b4P9gZC-cCYCR7>)*Pnfx@>5I$X5 zyl@xCBKGT;E__xNmc>ISnGM-9YqI8PQJTs~bJ9@&g;104VSa&FcqHXl?g8H5lksF#CNg#e{NjF~4 zW*c9xakjCMTbvTlqV>A2g1bp#u7)(Y*+x-6BK5qveote47M8&-Jexu#&5wN4(Ym1~ z2P2>G9>hM5w{cp!=4+FghV2qF9x0oKjMDD^`8x8j3VBrqm%H5mES6LUB)F!N7j+dmcBB)VZsJl z!99g|SQevzm8BBu^kPm<<+mc?9$I&4MHna;3e1bD#354THv!q`4GuHU#M-p44|nhL zpJ=O)dqES>!~nRdVzF7}ii>*G;B@S;!_G}>>^=?q%Hq!jzVf;LcXGR59fWVe;IR$B zBy&R7Wpx!hP7F5tCJwp&h6wf@Cb0~au4*Yd32q=<#*|uJ!fSul3yl5jE z5-iInzSy;`hbV;eRFrE6j?-W^1k@iB-!gx0*<$WQ56!D!v^=H>Qw4<#dFUQW_QJ&OR!JDpESd1ASK*lZh9&vro+5TK$?~chQV#P zdI5RdGx^T4!PV?kT2mMB|ARhXna#R0C8>Cf)N7&QVOKV)4KPQz25>r5LRQ4}nzMNF z{MIG^O&C5QiL1X#!h7VEgS>D1*1~h9fur+7OKgo9gX6>S8-Set(yFeg~aV3o(KEnH2`G!>xwS6jzfQu z{f+`5MQQ$vT~^?asp{&&+uZe7nD9SM@enru7YVDij}`+1C%W_45OKX#yT!&Og%lGFEe(3Xg@&ic>ok1xo)Q+wZG{$!gOE1 z7~e+(=%)gWmHg&BIfR~(z#%5$fo5R;V1BN=sclOB?P7^|T#;(G1joiXR$t)w+ zH%c2c<{$Vnsj_FlnoT?luaDWcy>;pU9k~EXUrXcz;ltsuP8i@(i9w4i+q`-D$OUxH z=geU9{R?P4c9fI;jkV+=q@l}><2je87B=DK|YCg!CW zu_$`3mIQi-@ddbAikzTDG{5~IlhLP#ZXz9>PYahCR^`+6cQq=*(C|d_#vlt>;k-Aa z*KJOp#rd(WmIm`m^3>hxzFk2k+W>)NA}|9|Lc%e;^kCsPKRl{(FY!;I`|aa zTilSf@d7;WYnygzUoRV_GB2Ie>nO}p3^?z*bn-Whz&6r-;(4^I$J%sZ-_99}I}VzH zUx-Xzfbge(x!H&=-DDdu1n}v->0#(!YIVgjOcOs_jpQoi9S9of=Bfs+wYwf{P))HfTVOS^0WdR{)^;jWJATb6>U6QJ2l;(WfJEiF+I=)W=*{ZjCCkp zmbMiH54;T<3#QnnG!VWP$y%5Vd(3W4Fmoz=pL;`4Y=0y??#n>?TFns~%KF%0t2u9) zq@@7nQ$}Gz8%71L76I35AMY|(x=k;wlgY2?ir~A0aG~?k>KOuN4%S{PCdN;JIJ;08 z)bO#Q((=Jw9pIaUDd2%6I{oH#{tdnfiP|h)5dw?ra_hJ{ADP1lq5O!VCa% z!1}L65MjMDj+r8eb=#hUI;UY;0B4r;bJCtdU3qX2tMA z>pjRg?=za=m``(=Yv5KBUXQ2pyYUn+iCmN}Qw(1ed?N{L|Gwub2oxJC(T8B$f3X>- zj+Wa{aLLf5J#42t9AK&Hrxds4_itlhnO1K>$UyVhCZG^? z(!=#l?V^Un-~i|5^g*IWp^!{{I(K#_JWd_NU-panM>h+I3%ia}gostRo|Q>R#WXUu z4mLtD(8tj8pL>3@1`!PCweLXHva3B&E9=zs^A8;1YluqV>hC0TwGj{AL3Dao#&PJ1plivxEeG=m%BnnlN$ zH)Ail7Jg-9wNq-G`aLRV8xE&DEDulH1SDvZy|!AIN(oBT27i|0&01p0bDoHV)O~n77fzL8Z^O{ zyo>HnQ*izsjM1<|l7MJ|R)p{>-&STBdC(w4rP8MIaC zXKs;oCe{X@mTPL=yRN#zs5Qc307;sk~u#tlFOM+;(Q@!0UX2H4LHW9 zW%>9`5&7Q`J3)?Es>o!ctgH7QeQ^4JV;#jI?7Das&rIqDo^$JBUaZ8#p?bJ%q5=`u zNQ9kRnqUx@ToWQ%kye%}tT>Uo11^Ho4g6qTcc$5AD-z?0HAq7}q+;Ie8o8BBeTC`2 z%1HwEQT749_Vs#cxTP;;Mp$1JnFAD@7P@ix>RTnSJOweLHolg2L5`-73mh?ksik1@ zbr5l~^FsFhs!T~={b22dJis<%WpcnQ#%mLTs1*rNSamE#PjmN)p+=}Dzy<2x9fccv zHUS0^I%!2o;cV%2cj0o861}8Z6==Zh24>LzRyVR$@+Hq84F!m^4@d=9m+DFE$lXB} zTtfQ3K!`ycigsXureZPLTIoke@HANW&rqg2i`}h{w%-s3^Z5bAjJ(Wp+;ZIWs@5xK z@h+5!xC^RyO{boRsIOp%=y0D0?MfdENqtGes0gBBAm6wq3XF8-1P>lj}fkyw6*ib$j`a7xVdyB$*lAji}$zjTiWmh zyMYAfWS_BYnL!ekv+2RKa<9+z6byf@DYI(wJU~%%b|dsV@FS4w;1L{%Po;3yA|*~l zC4cz^AJ3u7;ePwE$);fFwaM=Mt)W_?Fqm{mZ&y2w84*#9y_smtaZm{LuZpK_4MLUd zmt6D0dyA{&T#pt(l&FsF2Ms5E&~U;Y-&#$>r6P=Rrr773jJjZr$p8ytl7F;-dj9vs!WhF)~@U2h7|nIDDE<(bamn zCVL6KHd_w*sPlatyjxHQT`HQdmal!h_eJA2BqdfMfVHLv4y}cs;P^w*mJu#aoJFFN zI!j+zS{zBq?+-{{%Wg2{D;ryy3oDjJf=*p2jHYbyYH z1`*D6=Uw=jhTpTkWIs;v!as2NVr4QrGF0wwd}Ok>7d*R_28Y#L2luV8y4%!xMG8?U zVb!`Dx!cb$PEg+xc3AHe_bpo1$QA+O=X)2HZCn(5Ts_~+-dDq8li+A+iSOP*IVR=^ zoMD5UKFrLirQC+{E(Pe}iO<2XP+^ZP#=tWv>@f_8u66Pkaa;9O>T_DC>v^1zMvq8a z+GcGF+RzxtWA8Uw&w0avJPfTtMkm{*Y~M+8?rQGvrg&NpzeX9RP?LxJjhAEh3H4ZgNij1hsN_={*NzsIPf` zW@~J+53(hR-nE@^+u>^OZ{Akt%6595!ebu+t*G~f_5DFz8Gx}ALN@6d69dBX(g3*T zXbxV;alOQsy=5tk=u_f+H)85|@1B^B#cGP>g}2*f05Q1syJH^u>JKq<6I!b5?Ne+` zb@6o?j^tGCg3I;K#}N1=_-PVaSqCl?v&Za2Tu*1tOeLulI_jLQhSxY+LZF?r-@a%o z;qW&y5=JroIue6ws(4GNRG5GTAjj57)9!b}q_8sZ`m8$4Iba~P;2jW@oR#_N=4*P) z+Zf>gmsKrAw!)Y`l2(~s_xmtGDgHe(RP)iR!~AdF4kO|#ZqsBh2}jX-L_OMBA@zz28^qS4Tj zbBh*#qY7cP0rhrN+veBZ?;`sw+beZ@K-}36eCysDI;G#*1!^971Y69K^wiwz%J{P; zWAccsI1mAjCI?I&bNmrO?6mbEl#lJec;36!&t}zR%c2-Z`Dlpn3jpeCsY1e*Q($89 zi1T*HvZMvT--HQkux^GE-e8yXA6;9|!ucoX z0k^K)_B&AMum>Gz-homlNS$lTv-ukp0P?KYVuy%qf*Siezm+N!gOYI#c=x>jwyDiU zI0(B9NJHRe9xcodzD#_E_p@4ty?PQM!afja{ZQk%fB5?<1b~nmaB=(=!n?9iyBsv} z2*qI3(9qA#)e~^^?{Lj(!<~&g=!g?0j*P!&al#_mf$q*beXrW=A7c1j1!zE+@(@%3 zI-VYv@W^Nf6@E0RZp|spN4BCKA(8PZGeWj}Wx@_QQIaz(=dlfJ3!MUKPpJ0#W``Gu zVUDy@VY4165#u|N>v?(p)eX;VGjKCmgdaMdbZ@hH3njnYlJVuY509N(=&> zJn_es`~^}&!f4SpbN7-aCjgWzGe18m0O8~m;Jb;xO8&|xzZkVcAY(b+uLZrtsl~y0*Rm5t8CtfR{UzlqE2~&RnX)7`EPzJ{lRz^e$TIAYA+Q_i zXP{cvqOI1^MqwCq$B0QRHdi2S>rWjO$ z=D;Of73}`lj9*fNpo?z&Jh$xwTWMj#taJ#tORo-K!gCKg-ELy*Xy zU`0^&KRYYF-|Z!*gc$DuZ+1I^v$AgY@v$FfZ9OWYHv@vggdAHe`5 z6U|~-oj;EFj|d-3I==A~YUMCkPh?k?{u#qBsRfgYlG(x6r(7}2ZCm~m z#3T+7&`pGrTmH<58OZ`li>Y3 z9`a#9iPRh!T7o9r15zF;@v-?MfoLe4g}2AobyfB%E3YKx&S&Z&)!}tD?McARpoHz` z0Z@~S9j;U{Ak8@s^CW}v`~SeLItEDaz;=>c7(TrowtxQL9muPoyZOYy%SJ(PO3SDaj5cC=7Kih?mZ_RP8 z@}?B}BS=^u`?5zjqb@kzp$TYd4=wM|81t_vGWft9MTEO^oQPjrZ6ctMLDmiJx5L`6 zpe4w1V9NRWw#dJ+7(v70j&)z4u<2<-?(15~`hYRjOf{*$81sOk{n=CxxvB{(wl{OU zWat0d^Z*>Xo`ZuBh^0wk-!yPD&qa>ovDN_E{exT^hd*fHg&;N#17lq;xZ0bFVMAVk zi%{B|o12!@7l7&1?g(q+vNV?=4eJ!YZ$)d*Fzd`+Ji3nT%OlZ-RU5T1P?f3k*7EAyKL|i1CNOvR3WXf6I8g|H4S$i z2b(6YS$DT8cc9RBbSDI`cB20 zi-Tacmu=1_e>tNqBMg}cNJUC9hazHEIpqJpnv(#~LvS{X>m=%hf7778E7SFoB(Q?{ zH1owW{|ft!-0+O{LoCdC6U(prdOlsC|DPK^fWKsZnuM+E>x*}rlElxLb@4aK0LI!y zE&kbZ9vwzKYJj*ow)62T9NIam9Ab)wnA+ z5l{?ptoi)=d9w}2z|PXys^T*iw+SxvQZtr##~*^m9ugmYBmi`!Hv4U zTY*;?=h;eCj-1`euMYv`BchV&{*vV(Cv#a zPyVHfkr0|H3Myp{a6jd4Lu(y3{p;1it|;e$>c1cj*HLij9mIM5TQMvLcNkqV8GU?T zt003!DFahke}xGYn~ywdj}K|)bNn6X-6HoT9t8IGk+?stPl%w3{v9sAe*WxSId~SY znxW1H-p++o82%yzE)dZq*hXprYO`WQl>9Sp5DJoq*u4h$tjtz0KW+?{42h_vsYj3G zsEhtyQ#{AXqU=a5ke*FUUA+I4WmpiqfgB)xRE~!_f)@@C<&yV@AB04IdCh}OpG|{d zU(?y%fk?}oj!|n_A_&d$`er!^NOX;X`A;%}`w}p`Eh&oo5!L{21F>2dsFIBYu!}9Z)%m{3&>~+h(48O7;7+%_O+Cf@xl^}vx$qm*d zormA6_luar{b0)XDuzRJx+h=T^ttGb{?n-)-9w6&)Zn$q5<<`i-CL|1>Kh!WhioX(RvYxx;$X9LV!_ zWG(sEkoCcW-oHj6ko2?+t+KRw&+r8>1N&XINP01_+3|*7R%B~yA4r@`K}rc=jVN8G z=fG(f%E!ox=TLI!Y1bk|F-KvnzWhQQsPwc2G?^`bQqzP z|KHevF?mDG!1PxTTIz1mPL|%382b1XNN_0c+O5AP#hkSkM%lL&idnghHNri^eGbZb z9#){W6liGtr{e)i&c|pFSuai|8g8q(4QV~M?2G@OJs|kSRCZ)f;5FBgnXr|q!*4Lh z!8)-&;Lx?dRVMm~sEuyqd7Iu@TV1#|TVWiT8ki{#YHjPg$-P_K*sw9mcLQ&ZxajOY zIX{|nBz&?gH=67|`3t0(uSHV4e+p@^-Cjlun#?^%rSr8xtL^0&2OW6wu>8wkj*1oq zO8Z&R9TIhfyAtQr9*4K#azKC>LYKUCI*k@|)H!IbAK&n8`)x?wvW<077&1|HD%#o- z1L2TpKu^ovm6INsvNA9tE)a5d(O#GTU^G^(e0FiTt8-C{ax8(@e7-`lYvYneB_@Jj)mesYtHP#Z+Pq2vpYk`VD z8q%VEEF?E*w|yVU&wjqu{s(BG{+RB#{Wl1XYru&_nXSKyK&TpU;U)R^%I`RM8>F1u zrYV;;Bqijcf7aPvG;IY(AZSq_pnt*c*B8*o<*QJhc^k>61L-gGA%5=)fi3r6WqjVA zdVuAphiU%Nt|Pl+AD?{gaIky0!Ci2$_MbQEQop0mOSV0qxnGW7{D4A#gqMDG8H-&` z$8Z5~uW>-vtoI8D^jr8LC^Im%2~&K$i@+L*SiF&-vtKi77Xk^sGY{{3XmBdK3w*){s6_udfqh%bS0(%u_&*;U0g>G_iT=&ArrPlP zJib>9M+k?HJ%y6@hsyqLEa;07*l&TJkMk)x6uQg+=vz9sYsD$o?MnCm)82PLHPti? z-&_KQq98~W1O)*>0R=^=v0?$iMsJUFsYc=U;$xGlFrUTcjV& z98g}BBaF#DYsQ9=l#xUiKGEKK@JI7>SLQ}VJ9-8V=%VST6YFvzNW88}dt<5Y`-)lQ zmLZcJ2y{c7Xl>Y7au{(Ub<IoIRu{PFPhO*k*?YL@>I^vlM?$$dm~Y6Mr&iH7MpLYIc!vQ`LtmR6yZZ?7yHR@pZ8>W z4F%Zs_nztBb_87ZUepGY?lgyOe$;xdXYS_b%MqqdC@kZ{=f~G4CZBXkGPHbKoeOxu zg6ok0EEi1&6wmV|duK^Iw}H*Zw|<-T%?8jVHl;k%i`#F;V#WlVChr1^UAV~u4NH!9 zX3rc`M2@`)#J@@AGdP6$ET6yz!0^I$bEY zXI)rKqnp#0ua!Ij7M<9BG}yY?UeQYjGg#jt8K~7upoi#(cw8d>d-}?SCMKsH6D!^`>DV|;{uQVnSdl8wJ)GK-_`Oj3mtiI?~?u&#H zcE>cV8&7F566PX(w{QKp^}(a2aKMt>2&L9r=l5*NB2O${;C4TP!d`WMCcDm%{&3}$ zq?}QyrOWhUh%v}HWRn^>=;>$O@jlM`X^sBu>)*|I2%j0#3@9(sC{OT2Fm|@%rf!(J zWwoIv0&{8;A^QxX2L4dPNNf);Nc0)+r%I+;RG+T0JqaQSY)4ovt=^8m6H$lm7nQDw zfbrkfqExI2ECMg#(sgOeQEAHCsvci(DkoqNGPg{3b29g-_1!!mQOWYV_7qG`h7qNI z>~p`EgnR*kk?qzVqzAdm9B{W;oL?SSc(9QX3d&)QU6+UGn$6Z_oTe6|HV|SDd`ko= z{=7a-xyaY9*6I0Dkis1(Avva=dwoer*eRoBYc6jx?Q-Cv;=Ai$rFeq241}un=Z8Kn z4xLO!F&_+u67Xm0+1D$W=97NBxzMJeqw-+m_mDP=wQK2FgeIEwx|On?5xv!h10|-Q zKdmA|NjtAgo6DDu45x{rhr$%5gVx6E51mXvJBN+_GUA8Lu8P-lLwfJ+FOzYKuQBoKaoof@Y6)DgWA3 zp4qKc$=9}DGCs=7mXvO*5@nP#!t2PY`%R!w02mZ(MkMu&-5}7AxVsO2p3d9>-6}KV z__g^ap6+dUl4%|zMK*N%&_tCj?*E*W_!iGe7ss+FA%X)J1$78_yiuy8nidiV4Vb!| z4o6oqH>iE>-~oz~uiEzwn0t~LegVV0ZS$n9*O^PA zk$0==ynm8vC(}Ly%|o#^zEUK2<>_Yk@iB@~rS}G4k?t-AJra&sH?}8e!S?|-H+;|5 zW|N7CjpP4VBex;jGPT)S**#{-naYNO#5U7iI_(G8p+SO!HR&* z$#eVYUoVcV?^XZBgzcwrVf%Ll6>@&~H_anb`WV<_9&1n3`$a+Py&b_q;rMgE*k)ZQ z-bJIKyZJU;KbM7H=fiMtxkLk(hTS!)pb^6wW71d+ks~x>_SWLeRk##23I% zWeAOqX>|N^M?l*@AcrZMQ2Vt{q)7%EG0-H#-x#0~!{4Z&Nd_7*(1_u04A6+-Z&c7E z1C1DH#PBx;XvFY0Drk~{MhrA!_!|Q>V)z>sG|50C1{yK^jR6`l{EdqLrzOKwSx0dU zPw~VLmfk@_#j_{%_3vsYrv$Y4E?;G~C0(Lc27If7x99tU@?~ zMQM?Ee%VT_|0sf@$DWUN`|X_@#Qq=v4=3RF{)?HyDVPcWTyFfg7lIJgJrigEWv2ei zYT>8-#69#D=#)+SzZg|)0S&+v>sb0_6)eIi4&7_WW&U{!@UuEFZ2}F@2mcH^^Q$Bc zu`rs3SOSe=X`+B83TUDLSohIH0ZkOpL;+0{&_n^)>eEC4O%%{X0ZkOpL;<2>p($Z# zx&qn(fwn97Un&Y@WU4c4iV120zd58q6rqu^c-YiQr0ew?HG$uqTL531%(-3Gz7won zCs;2+EG((^9kO&`3cq=(0kxUgtXsDB6d1iVLOB6Pa3&+sf)0zFVt=TEo%9&fLW%?p zwWWvldGBSyKOy9HEd*|J{mr2sP^b<_XQhswt)af`7`zS2=%u?;WoMI}|7b}DM~FN- z>GRjBW|xX4fT=n~z}I`|+~6O2X445cDRi>S+iOB|9dg?*891}vb07XJwhB{~scH_H zViFL;KwiEXMRmhA*I-0V{CBwlsXAZ#iLg$~H3W!*3dBbPMhD_0dBGbN!F!HgPuxOimFFZGAF$38@FxkD}44(U!YSNK|)iL ztqvy?qbms=Kow0@+II-No^r8i!en+tTHU;(p* zsn*ECKT4o2chv2#E{N+Y?UA+CQpU$(Mz>iB3N0f`3XQNA3DeEsWf;-5

9jaK#^!pK$Tn+MrJ>3=ke?oFB!Jb-IyUI%N8jqUK6TW|y-oazp zxvWio7q!(SNsE`e*7J9yuy74+Q_A+H8eI=lEIdq-PuqG>l>EJ|iyXQ?)&z4fDlYYR z;AKwslApP?OtLBr*Bz(d0&!dL;yk)OU&1xGRF{R}UP%647;EZGn7AGo=|Jrs7<`-z zE=(R&J(`j3cI!CZvVU?|dL~BvL$34V-wLdqIPk_65PgA->6tzt~Z#c zsCBqb3ih$9{ehg`2AJwKAN@eJaCWnaz>Wln=c!ypl-2xLStj)yJ}l&4xdQkJoPS^A zVBh2HXrkg=FTFK%XRis0=Z{xkg;yqh$n_22G&aC{SIws!D|M$V8y$ExweZFdLlVn@IMx>KrFNea8=~8dact6h% zeTo5O?}WI0M6=^~r3c=SC9RBgCUolZT9``y70L@@3xKc`qUGu0qqlDJn9 zMNb;DllB^n+2lLXMN#Eg{Iq(f#b_44{dW{Y6X zU)PA*vOAqmA&yazYj&R!5?kf(%3wv(%r#mdfT{PkMzNM%7JLcmI?a|*z6h7q2N#u% zL{FqM`|aBHk4tKB42xoR(eO6OaqcJ8$2`=mTKQ{R)?q9vi(s}lzGSrbjX+QF>IiGT zy}LV=DZ`{Hb?V|j{eeJU7kifyw+bB09t=&gTHYcr4Y*-v^-7sj<^2t~E3UbtVbS@A z>QpIW15_rZzoQ%>qV)pzqFZAwZn@&VWW1lLr>FghyZgI0fY#q!oKalNFH>E-X;kdy zn~bxq3XD!9w=F5R-TwzkV8Pf4kgHGatHI6x&?GKK^_8s>axN65cGw}%)0gO(Eccmg z@u(gtChzE_*f(~`j1Im=0^9!GNWQpJK2B|BP));o@@vebN69d*#`DgC^U@YDhzsu@ z_outzhM$-mYzgk}$Q>n<3u;$JcE|U3|I-47jpt~uAytD~ziL1!GwON0j5nE(zuEaX zOadBUQ3?4#Y35)pvl$GXXr9a08=)(CRW?|w*+-oC$4x(&02Dlk3#Fz~KI9m6@VD2y zXbKp&Q_JWwoXrt*&~K0l`7r4@@@7;=Z9H?+Tnq8FO>z7vbw$>fq}rw0 z*S^}9Vxv^4{P*yH*AA|O)Q6M@t9@#e4@-_CCSz1LYB8l}0+&N&{zz@F500aL4Qt0K zf)L%qtG25hmN0dL1Rr!SJjzBM0-saI&mPM-V(M>WwpR{IXFa|w zgQwp^ic6%ghZOH(jOcQA6`Yc9*D>=fC^;#d`S!qH8xJ&F#+*M$Xk~LcbLNQ_`;jNl zZLII}w^!)#-Mg76a)S-Co$+h9_WOHz?F^^P_B`z3I@{qK&A@S*MI^1F-SR}UT_$zG zvZ7VUK)Bl5eS%7*F7gY8bg%SGc9UN_E18rn3}|RRdrB?&wo2w^t@ge=u4^_na3bd_ zh^_2=eD6qkd6^X_wI+S2wPJ^sB;lyo!%h5$UVV?pjfY11WouvG`Vjbq@KSI(5iM*y zyA)PqY%E$VmUIFE0oqk%Y;GNs(cO&5vYlb3G@Xe(0W`6D%9n zjQe3D$SyRs8_tRAcYd+>C7P&_xlLDQw)|TRb;F&TzBAJ0&2py_a$sSz9B-n$N4J=E z_so=mqIY&9=AuqQZWv@Y)KU2S&;hD&b=*KqO7XV)n}w$A;QL{ax^bhINbgEOk2hJz zv22>-e!TvZt9OCX{^rLEsy;KSOXs^zCuG3sYB14zr86wEb-8C%&uC+n zhG`1?f*G=%xAQw^<}z!#w>R&CK!Yn9^970c#869l*KN;QTB>p(CW17~93cUvbrkp0 z=kO^P2kos@q@3%z4iSnl!NJudOY@{9LCGT|&1MTrXZC|ega$O;z`dvR>E8B|0-mX{ zMuCPo(5$BE4zy3M`{u>Kh_)trw>_C^ye9a!I=lm!DMOVkY8fXn<>hAP?=uTA- z)7lCGhz+Sy-|09gE@rf|*lWSHJHnT@jR^nf;cT&vo$r)Ml@{}7_LJMg4?t-> zd2>4h!l`7eMh3;#flGG~QV0L$4vzdeeZvj>sV%tXBSIFCb!c_bYp&&+B3PjS ztR&jUZ0c?f)$&_otQHOi8A*0o=w^Xxxhz{oD z`Ur}Iq)OO1$N?oNQ*a=j88@0Duwm784HPo~3Rd&k)pH+2UD&|no;{kt39nAH22iIz zkCSn$auWmR;TIgBpCFSJXYFB;{pxtE1-d6m$2IWh%qcVL}8dq0PEx z_00(i;tcC9oX$2?K*vp_jtFe<+nb%CkA8|i&wx+<+64B{q#O`Cj`WHdM~NOM_bk}8 zEb$Ze0av&dozZc?yBY_;S>}SttZj>32ifsmki;<|EEd9Gwf!N&HD*wg^uwgo@`K;@ zgwE72lnZDyKFM@39Q0Z%0)owakXmj^Etn)P)VhRpFh&69B;t+vv#0T-;Gg)JmNqFh zqe@p>3kPuw;qg!%>X;gE?zqsQ8|5<6%5WohkPSsU_5CcGCBZy6WR;@A*tcD&8gn3~UC31CTB$n(q!z*=FmT(b(l!C+|B}p?(UJ8;rGf6#6wzP$}#sKf)HW85k;x&@gA=!6~suqWFg1`e=Ie(s$&8FOjUsh zHcl=}wMNB#1nO*+&JqhD3b;PCY&HQgJtUAIpC6=_bW+_XD7Bmd^}0wXg`a^c!*xto z_Mj+aYDOf4pf77au7!|5qoGF2vgM7aGLG|Fo8b$R?Vv~-?s)1$tJ_aD+nVPik!ie|6YWFFXaZ&gy$UgYmAK>p& z0>y=Nw|}z8VUVuOM2F6K5a8#>n#Zm$ScHZLhIUT+OoS@qw60$bc?6>7oLuuMr=@|Q z;DeO+2iFCasroBttyA^^FL@TN_qKrmbdRy*yLjQql`pP}%d1(}-ti`H0X^<&etrr# z2@_vKfUo!TNj#fYIlWl?Dd;3oXdJ`~vM1bDgS%HdW4%|C+wVt9#o(dvH7D{3Zt!>u zn!j|+zNM>}9A+zDLaPo6d~6z+sLF z;#}#ZsLVE4%J;(bNmA0iyu?^0;IxxdKk*!JNf}CdFN~rt-t=DZDN?u)C2}9YYO~b~ zVaf|=AhM|fug5~bWZ_mLVth{~2!rvf@dyCpHo^o(T}fby)v?fV0XKe@KB@Ts})v(90rF4Y5T z$^?#}8gO(09WUAfU@3D8bCdw!+{bvD9mbY(+kvp_DLZ9Wqw$r-?i5O~JR_>9-F{XM z#^x4!fiXTxMDSyL^~1)6IeRWR@wQ%HF*CH^m{`vU9AA?b8&Q#6eiUEte7T9DN?c`S z@n_!APVVa9dP!iE2afItmn_-FEj+Ugzz?5m{?QF%_p~@zgHCtUF`-OUyp~cO3$Ipd zhoLW8r0#XbKznOaz)=fG@9`wMO___YzTL%-AHlXfl6234v|c~py9E&xnADZnr&0z> zU8+On?K%$@hcZ~ID1%9xEinW^ZV0&uhnbg43LY9Q0d?E=zpznsflH2sWYJ9gYFAscSe^ZwPcL&CI4K6 z&4w|-s_afn>E*(xc;EU#RRwnitJjWsK&D<9Z+qKa22=vE zSpEq6`uR~x{_;wt4}4m;21#RTKkc@&DAQS{M!?*R4QNh zMB`<#&WH(U#3iuZNQ-rDK2&Uy=RCNQUGrpe7`T3Hly^Y_mVxLfehR%)LHm1#qNLFg zSDa(*wV|Q3B*c}L787B*1#Rdz(=%5!F6np7>F}=TW^*-qG(Pm20-{yx-)s#g*SudN zP&0U9GyFNH;H;|zB;f`*=4>TQa+&Q!9I$b+Ayuu* zLjrG}*j6~)TM@v?^9geSkYytNJEGUQXk@B{PV*U_7OtFULS5>aU-W^o%JX)o5tco_ zCY2sYAM$f)>*lua$RCPucRKtMKz2S;a|U!il!g$yHqqQ=;;ruytd)IEtSDsOamx>3 zl6P?5cGL1ZCkCWCsX^pP6Qy_K;ypV7qnybK1rCj|QOII*u;g1nk3&s&*%QaUd;4mi zF5Cx56LY^R36OS08Z1=CPDAhaZBOtw*$89le+GwkIlTt+>Q@dc!NMid!xym%Er(>K zg`ldHO)gkK1Yh7ju%c7$t`d&35?uysa?Z=AzTO2IzL0ngIbx4U*7=F_)_vX@_egmG zNWYLwI#dFmw;Zw`ERvGph0j*Sk$Wpu3#JblNhgDa4~@_Gp@8UEz%~lOXa8JSh?HXC z6UUjhrsxdgMhrC9USI<#M8+PO%QT;fuN-#*@HVzJohX=8)s~9zXallc>26ZH`Hq4Eu69I23{_3prHNd0ar5q5q(S$~}M;Mfj zs!Gx9la0O|HHsm{MJ_i1Kk)kNAgBLJ9FIISNSD;kR^hD2i6MhJ_QaHGVd$d$vjIei zvVhphq_5qQWRH&NnHPWJqLV4E1#OGHhNQ>S0B_N=t+ zsZ?}HGfUhh1gUe>fsj35Kl=rdK*>b+{K`EExtz`7Y|Ov zw89C7E0*r`P^dwFbQV$oA`G} z&j{)lEW}l&DA^9Qq48Beoj-zY1rW9hU%ZE3iE*js4mfv6Wez=h`GFlepQ(muLXeQ#ynM`pIJh+vazrm8=^J{OB z1fMG>m`QFyUVR^@uI}_wSJzu{2GA`ooiLDx_B(01GK}xOLymuhbE?iL)}hqVI}8Ce zbluhSAa)v<$|z(9!p)jqWNqp){KmlDk@!u$#wq?K!WRYCc7irAE_$Y58DM4&*{uSI zyYhjNl+I`$JzhVvX9~dnQ4H{-)WK_)4^Kzq?REM`v-kuUp{CYnyAUb13)yg%jI4ay zk7CVe%Nrg!y)n|92PO1rJ@A4iHxEt&JGpdS_>5qQXYE7VxK%w|Oa>m3F*>|}sI>_h z$S(TpgFyj7aMEe%Ebghl7T+o$57hw*tRH?%pVd%%+F4n6AS8w@rsSA@)-ki|B zbx)XeT#r~#<&&EZX1TQ}*Ou?|MWIZWZ=OZ8i6BsxHpb(7U5fMa2d?ol&)Viu__TJ> z4a84BA99znb~^gtUCYaFoP|5ulQ^2X-)Iah&1nT|&c1opSo9Cp2_aF zDi@m4Zv=3f(N%}g!%e^g9yRq(%Dr30yMFjzQRkEmfY|!d)}oiVoI>{19?1)7t72R# zS#AsY+-@(``$IV)iGuTVz|&`fAAEnisj0c2$+Q95#88#c7_SQ*^p#x;C_%UZGJA*W z{FO)D?R`(Z<+_k30zKCcv;@-y;^86UxvAmVGv@iUuF@s7BxmiWNlECU@4EqT;Kf!W zyQjNHOV2Qz;2LkME10W@4pHsDN{`=l;WctL0TFxvhmgK~YodhC z8|*=31BL_4#)lJJllleZxX1ubsZ-lg2_knI*4#-yCa&#u@{(~LUk95f+OEwE$7^+Y zV}O(F^iK$I32dM?-8*JggBAG6eys|6un}Afo2%tXm`W4jM+V-qjavhs?;q<9+ePNRD;|k5h7sCoA|p+iY*gu zJ_esfi#sErIt$Ye$TVZmu8IC=RhbfNwP_bpPi33MLJ|A={VZuL05F!&-JK@8Bj z9YNdOk7T!;KXZ4PNr@M}$>mq%@qr}&Q11vNJ~Kai7Eihl=K%FZO3v#1r!q1UMh9@v zoj~nsiSE5q7e?nhXTpjuC3Orkfyml!Dk%6b*s6MT;Ue~tTPd@~O*~*Eir%!azoW#n zn~+vT`Y;H#X|<)$Zn%K2n}3Mc)92~+HD0%_kLLo4|JT>m0{M4BH)JG_;IR={&FPDz zrrM<|W}gflH}hK<4=R9Z@DS+@Ynik6JQKAWjo)W~1_WGHKV>?f_NpSUlGvcD;OKO^ zrT7-f1s%tNI?AkaZe;>raCR{5BYB-d*hK4=_YhKRmrk3t`3wKGpED(sWR5v_AbYB> zT#b^sz*s z6j173!g1$N`3&hJqz6{G>a7f}>P?5m)+LNjE|>=Q$79hf1&k1He!>PA{T5wg;8Zxh zGP7-09G^$-)%g{(khrYROiibd8D`zHauT#ZS#{9+b0#Ivd%`o<+V1!X8D%6?F5&LL zF#3f-K!40sn+Rxk5Kgire+Sf9sBZb8s^h#9xrc=^^h5#9sqh-GimtGQ_SqkmMkEtf2*gFf_-p@+ zXkiYt9JCx74rp|M#?Wv;!vS)1q0s>i2Q)gM?GI>sB-%cawpXT|7iecD+PU%nr?WG# zS@Ggieijuz`_nT^qO{C`eH2**_ahBZ-NEM9n`6P<1lRys8k<^M&kj|&Pg6FXXTV!N zTN4EWK+tNJ8O;y_Kw;KZ;y5?FU() za#5=VIn^kiC+m^;lD3HZW$)=<$jL?Z5;nSz*~@Lkxt`YJ{@Ha2d^F^cnP6?JaXVBu zG;DLga&E=)gd9-gARWKNZ0Y%=@*3Br>EkTXa>C@kJhX+K+i&50QjqGZqg)Vj=MEIj zbnu55XTGuqf^*TeVMIIRGi9Ej?x3WsVd9lgZ1sZ3JQ!pj^=o z+^DU)JfE^)OmoBpxZ4AGhw1elS7sK?-o1>kI4cP0llgca&E=E}4*T8MF=cyd7cv3j zVOX5={LohFj~d0meFcU=&{RN6iKUaB-RwNLcbT-T_yR7+fjNk=Y1*Rk+(X|{lgQPi zR$z~&Z*q2n@hXQ2uWfK?%HovMcv%UAU;%rY@Xfug#JeZG!0~ijC#&40XsB+4OiItB z9LYIE&j0pqa)rdd`tyAS%kv2y#ng)8`R@7luqtzoqzlDE1wK?@@>g=rF3rmJS<=;` zOGPbf?szV$CzLIEQspO0$3v?vqEjyd3&6K3PL;NT0z8j>pT%!_v}JlN9$r;Ai5lG` zOWtWg9_Y!I=of}GjeY>lyraEbgZ3WOP^Z+f}br@%rML3l?KX z{3SL+as2shV{KEU<}#BK-`*H+zUr1O1=5~BoK=w7N5NL2S}V1FGc(n%Dw5Q02C6RA zNlyB#RE2(W&AdX7Pii$TxY}1TQxk=Ac6OVwD0k%aIXs=AuEX`x-t$?#p|;_H!CjHd zYxf+OTy#+USI1dys$bHg-?a6#urE$eDP^T6#`y&K^D2&<{?%_Pp31r{@8R7!GNUU5 zKEF&~?GD=8LLj6l1RZDx7N);{%8_#ae4hTEx0bH_CljQy{w<$c^?QN;AfH*5 zpIY-zf&Va{T8sKs;y=#+r@()bPpw;T;Xli#*8eQ+Zt5c-n+SN{H$OYJ=hLC$M(0EK~4*MA;YMJhp1>#t%f*gv1CD@Xpw zr&3pr{azl_TRHw)eWabve|hfxKmYt|ylcbEgKW%X4nh!H&%eJ4fG|1g=c@pQ*OEaT zr9WN;V7t5iDnP8alc5D~U~QX-#{IgdA9rdv_iJa(-aAlzT-^Tk?WaP$G71u*k((9RKRIvyxFptFUfPkFpZ?xGR&)7*b3pG^D!Yfn^X_P+ z5^=X5HfE9x1#)HIdhUD8m>=T6cJvfHe4xI&sPfIVXY%#o?P!z^^p4|9deFV2(=X0! zN^kYGXsi^Sw_ue;!uJS1q`k)c?Q23(nAL`o0|2^8$70DM(@Aw zzI}>|uvZPv)F6TvAUd8^_IQQ6|2RQPh7Qa-DpxO^3F!FY#>e38j~6D~H;zyC;bQz= zCiM)?N;*ya&Tn&SHS9P%j%%n@{trvAPI76j+Ri|Lf|39JC=LKaVOUDrdF* zf|;9@TV(`(FUpX;%k81X&YCJ0nNgu$0G*7I9;NE@ywjdz-x+y0NSiB-_Xx({_7jqE zD@^;=fAo^3Fly;Q2&2&Eti>dOrBxrYgPWHIw6-0*bqJ*{c3R2Fc!z{& zZwY^LD=zCt*&zM(xgfJ;iRitk#UQ4@Pg_wsaAs(e5b6m78=lR&!u+hMT}nyk15%KH z^2Vs1^3Qe{A-rAkRm~d4LUxbw>Je(%$gRgwGk?)5L8vWGOYLD3CH&&J;kxW3si7bR z>ia4KDNw^u%ROFAiKEtA>*0vOXE+Rt0s+G z6?fp@PV~qox$n%vU0&j_RS+KZ63yM|eZsxfyMA&V69MbdeJ0O6*$Ig@C!_R2m zvH|`Wy48Kx4z_p+X#u{MK0X?b($u9YCGW$~47%c4Ec)C1{ukb?kEdHl;^LTHM88Ba zp@zl+F6yz}(tP-UxFyri#rI%|#GMZ2A6#gy@I3NDT?U##Ep?k7_w6a+k$uU$D0Arc z&h8!I5hSO6;gHf&+mZ){Dtq8?tD0jdxTcmvHI~@tsk`;Z25ooOJj>!hlZm5{ zpUpkzsyo>8aNmB`G^YH5>d_PNdrm+qk`aAtME2C9$KxoqJuY;?!Y{H+dk2J@`(!h4 zinJv4_M7tbGP&huk<{bCbfRu3-YuRVMWSU$@;H$P`r`yAo% zCiYH#6y~jE!~&y;$tM2facd@e)gelwE*Cs?^v>hM5%?M0W(I~6w(Tu}#hL5^kFWoQ z5!#^D)<6XSvV>lo)a4#t36Ipg1C?}cYnwR@=4aw-(RfWIA$5k&9QAH93GTfriC(2% zGc~wSIKwC1fQ5|hLaI_QB0FWyFGLP#P3d2Hvk!9}+J}G7j(IK&&}@}9pt;pwpyh=@ z>aYS__k}@ENduWKQpWVMcg)+a7Vmx`3`tVsZX*W*M6gs@!LEk6bJFM&kg@gc;5fiR zX;~XiT*-I9xOXQgAB5|=*_M<}0njq)i@c+E2naU%KGU`;|&`=|HQ|>GqBoD zEo#Sr6FDS$(=A9Y?=Y7M$4MeTkNu*C^Ygw&{Y^nouH4~Je<8qiCn=c*Z^z^7olMaQ zPw4k;*#d;3bm)PVl%1W^Z9anhsPDz70d5h(GxlVvg>x=tW(kdlew->3vJ_+b7SYDv z005wyE3>}s;M@JCL) zc@1`PMt;IEK0pj^8(X@Y_{K{PRiE#R+>F2a-0oluR&V<*Q# zc_kvoDvW<@YSG9GpWzOvEvcNe!2k*=Ik(W5@6;06xO=}FFN){rrxRj3dR6GerBz&> zo>6jxkw$o4E?u=P?2{BLv|HJZHs#;7b(>~F%D1^b!Eb$A(D$S_oEVv~V|4Y~U%pQ` zk`2E(*zR5s>7~WH=6meMOwTX7tmJ*KB-FPH=G{~*b6eSeUr-pjFV|*!7Pcz0&AenM z7&oK9-F-@EN!>Jee#4$8p_yefDN$-{c;3*ldpEH*^)bys7Z}o?l3b!67{+M`9T@hB z#imV!=1+w>R{3>)A!A5ePR*Y>V|wb-VcY&)is|LY@7uIw_u8+)ZolYf`<&8TAh>^K z8!YqguF*b`-qky#lne0%DH6u6t5*7P8_jQ3U)wqL?IdM9{fR)&=h-;*=IwZO@mCe% zgdN`PDMmknnmm?sv?&d~56OA(gjvZ8(eMat+E;J;yYrLJjiZ(>DbBojspAmrP+Xor zE|_RsehC9!)w@#kaj6D1SiFI~VpX?Bx$2!x5M5yU@XOl^N-q5yH*k3ce+zIRQP^aT z_YN&=oGPV@n%ccXgp@c99u4`euEhKaTLfv{|$%dZYjD?mJwr@ti z#|S}tzp(h@Re(e?5fkyp^Ptc|H=_@;)u}e(0eUe47?1=`o@N1;LB(> zJkJ$|!&pHSIw6yT{V+Bdg4vE%3t@&p*;&^kJ21CE2bYt1(I{U~mU#9g8nqX6z_R~3 z4Hz0`Xf#9PrvI0Mv7~2S7JX*ibn^r3hw){WT_4@R<=)SetFCUk6`$N4gKCF z-@Z72b~0Z+#X)GLgV|1=A+-*IlaP`}n`^D&tH6d6RzUV<3Bffv<8}TA9=Yc1MHPCt zYk!;2^PZ7H3z^1Y-%3d=m%g;GW+EB8Byo%-ymT6)Lt*&Okk0DjCVFPSa)|{h?o(svuiErwR{!XJ`ybG~)sV;ARr4Kf7Oixn#A4{?*!GeSx`q*-)tk82l4J#)rx zReh6RApSfY7;Bh$s4Omh7Jx-|91|CQ>Ey}&Nx z&c9o4KtezZB7|W8|DC>68_!0;)-X3r}Z#@V#DBTg1%nFK6c`8}aZHRy-XZebM1Bdy9)UW{wUG zTR6G6^?&9gKkEKWS~we?y>QIN%mo1O*EP?lTs*pGFKDj8VZz3G_QDwpPYd(I>)_OH z<-d5%(a{Bu!ffUf-m_0$`RM8MM&_2*SL_^|J$!H7jeC+(QnqHj2Zs97Ob~(u5H$Su zsj#t=-3Q!=-iIMbIYb5GyR-Ih$nC@MPPuq zZ?2{MK`LM^b)5m?y|I?M0m@xRQtSaBQRq7!Cd76$NvBwCn(fq4ghEe(m{8PLqz*U~5@Df}Kf8IZmWNaKIt zD@X-E0+rq%qVlq@LjgoMCppI-eADG5CT9~s0-ckX_%aI*Qcx~Fk?!Ry2)aomFdAz4}$(1PCtkJ diff --git a/dev-tools/packaging/templates/darwin/icons/heartbeat.icns b/dev-tools/packaging/templates/darwin/icons/heartbeat.icns deleted file mode 100644 index 24bfa9b7e73873618ddcb4aa355ea4744265e4de..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 98924 zcmeFZXIzs_6E}J#1PM(7NN+)uB25uNKp=wB1*Ay_MFgcu?+_5hTcju*L_m6xqDXIw zQl*r${)9uwGvL>@N8bVX1#{L?l!FR7SQjA(11aCSspA1#9Vd@t zwM<(7v-k1++IvpYd`_|uc!lHD8c6#duhwZ z<;w={y87X5PUMoToYa(S_HqR&=$8fOt(%iVUK+zWul8OwS;q}tpq0Gpo3m8VW~4jm z_x?t&N$lRHr_>fcGq=)^j~$7|Lh%3p$NwuCl+bs56u(c7c!GG{y_9JeyhoACl^Z7c zA?2O2LdB-WPIJQBo=R0FZI=>uUx$iDM$3298RPd2MDs(Ly26I!e4P&WN^I+Qzo_ko zL-9NK8YMj4oLL;zy@{8dN-sU+9`8u;?K_fEhbtY2Gu~UjbS}4QM`>`^*C^coT?&d@ z%90a{c~6XlJXwzMhpHJWd&(+O&aAWVKSaqGaPQMTpGM%sTb#mRq)4OayLBRHDfy&OR85zsbC0HkqQ)#QA@~Dp%jkw zH{l$Na&gqn_*wX+XRihK!h3$9=Gl*cCIbG7_Ujj+tcZf&c_l*8dFO&k%m zM_TGx$KT3L_UPWV)EQ2Wwk?(ntiM#Vy$LDxUKSEp{}Z&D#SkT-!F?p&Y_{)zzTJvq zl%pY;bmEDGkJl(>@Fz!(j9?ax2Rfzi+qJx~+;d}tt&8b{%?QsIN8(#ynVt;wkB+Yh zuvMG+l^xyk`#dI?Mdk0()R-)j5+l5zEy={{$xSs%;<^*#gv*(M;~2-aa3QlkI1SH| z)jR4IhjR=Qkq-`iakuL}Z5rcb`{|liR4rt!oxS1Y1Acq^)LAyQZtXrerB-9ykL!6g zZ$&C%-37lUIi)*3v*|lXOJ=Rz%dD08=5*#o0%SgmZjC;ef3jDxNnI|(l#k5u4oC`S{oFS(xYE%MDGiy@<_0~$ zI1N{?1KIqvoj>UEp?5R)|EV9l#&5QE z{op(&g6!T}mCJ!ei)eu1LSdC_Lf)8VYk914kqjmEC}Nw| zX=Gl(f^5*%uzWwO^ovm8Dkt>)@@B@ed#$ll|6ZH!kwf&7*Msc0mu48Un+Mrb*_D7fIoxV_(YNXYMqcwQ%A?(o38cE@}ndhPx{p)gBy8hflh! zFW!54=Z+eYJcJ}4N!)iB!g+lh*Jw%hnP5BcKo^-|^2}O^pSAJV#e0(9L{BBk;mz8s zeESpU=sQkS<#wvE-k&`W5OX&5{j#wNm+lovlsRY|BqSHm(?W8Lg=;Ks+pT6^$#g#l zUud%4eyEGdOXeT+@v$EM$?^0_3J%?AR#wn<&0FZri8jYujC2-mAiq5Y>l27EGw3og zGnhPVoP1Q|ujld))b;i9IfpUF+}TRAi1XD||NOz!7uK_dIm+JH7#McnALkSvZC_j$ zX2Z?&%sbtjSDcTfUD(?a*$6#c99Nt=X^rLbcbu)xm?&f3MBc?hU1uJ3elZHaN_;GV zYkO$GQuUb}PJ;NU;<=fcYWcZzF6sNB;do1D?VJ^m-sQZ zLZcbq5YBKEaNIXhg~zMu_6sS?2wWK)9sa3r@^`y`eGeiQNjjfR15w`178 ztW)sUuV|@HtKKKbbF*f$)hv*uI8>z#I1NMhXZ`byXiNbO5^J>{wB&L0g_kwpT@c+ z?b+$O;59@>8<3I;Q1-JC--c4>hchRc`I5yQPv|*OvGqc@rI9^~8rK6mM_oo`>9hr0 z-JUv5b=6r5U!t^>qKSyw4BYAubCda0>;7jQ_E-=DWnWvW^LO$rU)cKeTiAwSi#6Z^ z@mx&VppM!!(UajnIaLk^!)234DvA>KUQH%*KUNyApz%<_clvnr9$lQA@ndOkN`ju& zXB}4BIftgwsPHVV>n;EPSZbW~&f&yl#uH;;##cJDLP~IHsZMi*vM3_xIZrvhYQQt~}Ms z&C&%S3BEUZ?`w?q)xFlTHQMeNR99I@F7Bn1NTAB)>E5Y|cS!krpFJ2U38^51ek_;P z^f>mN(7qYIqpSZ9CIM06`Mo>SVQOaBy>WO2x2)Ih7JA4gG2(CdZbyp&&Pj-Ds>jKm zbpe|8aI8=1i3ra2Bzm)PI>H}$;?4U_GJsm58uv9d#Og?umBUxkYCPAnHO}GXw{y!E ztWj_o;yIzhlUjGPY2h`KYLDbj6Ok_lyF~T6d*|9BGx5)koP5kO6~a2unu-{?HP`3| zf5`gXS1?KaY{FivNypMZzHZ94(c#yBmtQ8s)SnG7lNdSXSoWSgQk6=eHRBgygEI5? zcS>IIwQ#De&2mf{y-IjXA92#R_xsIEPe2*lp;DZkLD6oE0hi&VfF<5BZeEKXPLEuP z)P~=iTaCgzBEmfW5hF2ju9n9^KqkcY>xobTs;b_?DSoSG+Vbl9*|cAtHur>Ls`5;D zEZL|PJfi}z8E`Xy{6^EHKXBd@MkBSFiP0^PX6^kdpSHLP<@D>aOiQEBziDw_=FLI~ zo5M;*Wg0*(tm&^)PE_{rn|avnuPB+4$AjfH2E7S(m+? z(TR)xIUWo=bf08Awy9vU@Xa@a;W|R`_>2?=60fqYB+;BD-_jE~*_|RvI1|lK2AS7l zqo=CK;g_)qeM=t5LwwJm__%j7wzcW%Hg`HdGKkB(Z!lQpDqdx0F*g~$P?+SALvb#aOX23QCFC z>^3V3G5+OulzHm9x?8@(zv3Q^7M~4ZMKZ2)-(z7AI(DKzOu%zN$5q~~4Gm5ib%yVL zz&>aog9M5kv#mSs`F`H*<9DAJF`6(h*)3p-({Ye)Lp7&i-zgk6cGq!uP2TbKtqn`b z_`y34n=+zO=W}PMX^5(M49iMFUJy3-GZd&SoE&xkM*GF?4gaxl?6MVJH|Eby&6mqJ z6fuZ7m-JCu({e_T9-JM{kj+56Hrm|@RbjTTZFsWT%tS5go zNiXeKOsw+Da-YP?BreHxdmuhAls5>v2~OPDyQ86Krn`MDT?AUG`>OG$E-1M0Pbgkm zj&hi8Xy*Fbx2s_X^CS;9PcUv(%AF|W-TG{^>*{}80Xp|bQL1;+v-^m#ErT-KZ>NQ< zJ{rgUQT*rST|S^MUV4T1iOzHK+O5x3UU=QUhk9u|l`5od;&S+n++D#`JBTj*67(8B zU-)V{?ug4rQPX7&(P~2H+S+IL3Kdb6n$?g*y5dw~T3+kkBA-MTIX1CK3ORMu<>!`> z(*++#de><>D-a`LOl#bLSdr){vnj?woxyf9_vIG6d$E=3ArW>@!XKB-aqn<+D>L=t@HsT% zp|kO#?i^gvn{#UAns_p!=N-;_=I&60)X{2P3sv$KmFF1W*?>xT5Vlf4;8sd>eRtSw zzO+@t-lLL{uFRd?Gf+iYox8W$*O{~aVl@`ls=olk@f;5%8AI#abox!I%vV1Ohi2|? zsD2THJj_-aYK|K?o~qoc4~IDG!)Zp*mv5RkzAPwsV*}5;qi-<{=a(gZI>ql>Q-}9N zV=;knA4&90pIr6N_0s)sO`kRmtG@qSK|8<(|Rlf^P_~DQue8w>|<~1qf&Kux> zYT6o24XB}3g3Dw*Ff->u*~vix3xN7pzn6eh(PCd1ZM!Fh2`eTr$&)$FrpccQH~Q+pyV0_&M+OfxBCC)a2ZF&2^8^3%Y^BjGOVe=?L}JW1B*rH7>)upz zuC~XI4kjLdqmO37Bz2L#7n~`vJ^~+%r0yvXTJenfK2d}M)Dh*}DYVkN?K$-@c03d(R;zkd7P zxOYbHyFCr3xg3^&2ml<;XIjPs#Jes`TT7!1rbX9s!WzBF%y(iwsp0w4Kda%DL$B|g zN4)_=&j)4<<&&{q`Jj994v*K;VtaiJiXx;6F59}wt}$NJ7_=cw4pUMa_5K>ncckxe zhA>Zm-Vk8Wtjw;!vG2^HwXG}nbCnw8oC&rU=IKw;b%KUFrKOOI?U)vcG|Sw#W$Ao4 z=6^D``Lwe$gA9EZF z%^=*8l0TJ1Ps36UL`l_LL!CnnYj4Czcv5h0w$AC*Eht&~OXzXR0v=@n5RYD8lU~)q z2uBpRD~NR3^4i;L^~F=s~9p^ez&t$%~P5hm$tFQ1an=GuPbx?DLjB)%c^hF}M)JZ&Gt zWN6B7uYhu3Ji-2*^cQvZ;aM!77v!fIq>8^=!?9z_W-L3`atf{&tHb~sGzE(BWb-^= zyM@7f;O8V*>}4)C%dFb6C_}vCMQIv*pHq^~6jK2njj*VQ)jt{TsmLgueq82T*-Ux9 zk2g7|Nw7BlQp)%vjg<}s%7c~%psb{XMVWV-cbzjL?nrPyY~8yxT;4^5Dch=cUz@SK zE0*vH2nWa-yB*Fc{ZbF3p6Tz0ujF85(-llTgMDvP#?C_-Hb3(`8^g;0L(I^k5#O!u z+{rn2{oA#MH*9yQu0e5u_;)DxthezB0Nm#RrCUQeqSElTUlV>?)w~HTBgAKZu(-cl zDqqt`v%X+?9*fx}E;rEJZHi+rMei9e2@J6*2o&ZME?eWk`}ARdcAZUmX($~V2aMOOZkAG| zDsMD9(FBEo0$#vbNv)L{ULBE9wA{r;&hyrXT}Dbu!KcPI?^Pv}rEx|9n@9GMJ-v{k z_iO?Ank>pBO_nz1wxS}`%3oS%YOm{Iq#v5fia=q^tASf;4B3!efH#&O=mIR^*45bn ztrUg2wX$BZB3V$K?9v46Q$E&zqXGL!&K;Eo*>S*r8x-%@N}Ma^OU7?A1G&>rDPhKD z`m8=pvH*21SF91z&2SoKs_8@;)=k4qJb4%lpiM+I}RQ%^7gSd@qvdqNmdGD zrnn&O0?++sm3x+DF2y{x_FA-n*{9iHM`w4YbU~g<3oEqUqlE>8Llmx*b=q<9M_V}4 zv_YgkSN$8v=0)I(3%n_8ThnfNRBnir$#bm@qh%_VO=U)$hn&DD?gIg$)$X*aq}IPQ z68t&hvo>RLbCmrz665JHnygH$hQAp-%nn1Grv-a|SaR;&*#IFEM%=Pn0y8hfn<0N9 z`OS^FT?UleF&`mLf+{>|yHx6y^V{<>5vyhEP?z&@Osw*>1BD@MlnX5Ah(y6>G&9et z5@)*T{+z!#`b!GZah+b(DqmlHCKj|x4Ro&#OfZS;lfNPH+XZN)BgH+JnQ0!0~6HRzvdjOrET%#Mn9q1kV=Mv%gv`>ZX+(a z8+&N?pbad;w6WuZ%N0%mRL z(TJfNk|ly_u=q0JEp5|YNYgL39785Crg78u8Q^zF2!ky04YD@74*%7;u)P;+7~L-l z@vd$T`t#o$0JfhC!e9=w5cBB!`jAXEgU#Biti?1(C?fHMH?6~=Qkl58Be?f|AW+&u@Bk#X#ezB4yyTdab)+kO-iL<;uk9(aX@eD2c-1 zuzY#IY!6^X=@8k2=Z0(N{;J5#f-#?ga7&ZoqI_|>1VC^DR^k~IB=0I>@|K8Q={bxq zB-3Ya{hpNma^uF4w}H05Z<2|A5ZG0^LCTo!-7K~7Opse9RNWk<&ZhI&%$~d#R+&>+ zXjt`h#S;`7Gp47Xe}YAx#L*C9$rdn`<|EWX@iRr4KQje`VoM(5P)f8xmo-TY0cZwv zz}>q(+!`&+)JFJ9Z@cZj_B}8om2?&s*;Gb?(;+7M|GN*TZXwPnOxQ&O&=1Z=n z;VeEh0ru<3;l{KZfyA9Xf>XbjikH2GeLQ@GxmjV1eC5tf4&Q;x!=N1qOpLy?Dyu74 z^fIZLxPyc?bpvZ_Z)cm{7a$1f(*+E&xySlfh44<{av~!X^~B?c`Fq@NDL8UY8^n)J z$4>pi8jamM9<0pJf%{&wJ881yeSUfZq$B_u<~%k&ckiTinmTX&Gh5}P1pUrA>lx`k zxF6~f3IqqDIVxh$9aDK&NZuha>-|&-dK$X5^oL~w_$%P~>L5<6yBx5igIZFCeGVFE zZbKG^{+Om(1tdrhG6sR4Iy9fKKi6r6He@eAN^(<2{>{J71w-&*5M&-YsC}N`s#xsI z$1U3@>5X)*7ziH)_T(@I@Qh%h-lzHjrV;Pr-V z?+I$S13+-+slH_r_T3qeJ9cSj&p;VT5?}Z|!T|f|E<-G;YviTi3hL==nUAFxNrbMSk-Vi8;x-XE01HY-8?WqQWWxUtYjXEV5OxemTnc!T@Kd zfE4mb-AP-i$xLno-XwwaT-20c)Z}rwhp&n+?UF!Ty>(hVuLb9Lz{*&RH;9tEV?+Gx zz%h`>u8K25+-7AvKeTqzJ#w??3ECy(&9>nVx!zWNUzd*+h%jID~}7UL0L zQm<;}ZRH<6`0|(m_T;!H-RRaafh9e#BLlW!on2M;RsPWTyRuIa^(aV7B1{yhv*$dp zw>G8ul%y~}PN+E;3U9p`yLcWf8j%eaz3X>L7L9htvq`Vkot(p-hc-G0{%;2OzwfDP zZ0(5GX;h?8u#e)?&uj)j!9e)&z++#P-Ca|wXT0V$GI{rK9lrme-cTGbS$&E#Kz@GODo0SgHSnC)cHil#k>y_g&~GLk#ao&;Zl4Fc1PKEg zv5$EW`INZC>z{im+O9}wx>bvrARaX=3iUJOqZEDIQuNfhsD@a`)m9ls*t->2uH$G( zDgyI|5In9cR3NYzd)wE5-YqT+@?~SR77tleutKH^q?xvdcwe4y5j+M03b5oE`c5m~ zhRkK8;u>7P)oO3?8d%Fb3!taNu|+G7RX1sl_hZ$kKE8uMKD}2Qa1OY>gP@@qgX^k=;5hZu$i-n1vd=Xp* zP6URap+O@qAd;t_fNZG6G1Ny8q9TY6mIw5xN2PJVY^8Ry0QOX&XVA%zu#q_puyWm% z@Z2T^7DXB2sk4f@u=!Jw1@U8$$ib_f8J>d>4YYZ5Hf0^?RT5a}(u<$1XQW2rVEjf3 zX{YQk1Mkh;Q}ituJDZ!E#`d|hsnnLRFSI#OX#FRc@?GaSp?Z1s{_Eb_eUB1Oo3ENc zgxO!GavWfG+eKWHXG)s(*lh{P9ojqzJXFb9Tzhk*o2bM5HZ7FTafzAmkthQiA-Z>e z)gxfZ^t72P;MP<)Ll7+%Qwfl~$Xxi)DDNU9Fj(NjRDZQaENJ9ZD&K(mgHq#;MHF(^ zKBr9*qxax`=MTp-f(Z}GfCq7m3+i45dS0D)VWOTT_oQ>*Yfn|_Mv8*3FjKV|T4c&x z+x$6H29vQjn6*B8x?(WE$646ts>4X}ogLjh63BwR#a?!i349n~2IS<|RC~X(9p8&5 zQHNQ>G4gzR1avF{FOcqiBHx6vIXoc~5AzzbS+Rz?xJ*X1d!3k1CE8UAtjDgBVl~?g2_2TQ zultf=3yC|rHhSm)@su~<(>H1|F)Z_I+g_4hi25p)l%6LxGL`DWr$Pc!@TFq3PzXO* zr-I%;yIa>GOd?J2shd0?Vob()OS7}D$cRGLY3x6Fh-(xGp8$+Bj}M)!6>N2E)gm_P z`LM^GNT|Y_qw79c62m8lDVQKOYV`8nIET@d+6({J)775J+yS>)XBN7%Z4NQAi&8az zTN)zsJH_6dDnMn(pWR;v-A!Mi6rtoRy!YTvoKtZWAkIPotN?DGq<<5C^t&?9zyQYz zbgN8?mj))EstiXsRJo6l>zc?yjFxNd_GPCU!D4|*ux2?rc6*~=LSj6`@hrZtW#Jfz zF>;#VeIuNK#!4q3C)iZy6K@wKh*99|k&a&F7nZ-CA6*Buz4E$d;Me<+304}2&>{G= zS!W|YC2CI9LDYP$oIbnoQV$QuI*or> z{7v)m76D93DuAshpD8bn8jG)QNy`ojy%8yM3D*KbtVm8-8w23ix-#dwuw4l=U$^}1 z&toDv7j`q}_xaFM0xv$rlRws4cW5Kh!LQHY6jVN{Ya{~Nh7Y) z>!S@TR8sMA;_PV(0>JnlfbqRbPuox5FJ_R=Xu=Dad5X=i@VOA8_xa;-3#XbyiUQt6 zdzH+|9TGM-e znj3?q^uSVja%=_S2h6e;_sO7%I{_tk2M_on?Eb?q0E+d+zFn``%CJJ*h#3^&7FV#; zZzmqi_8+VOLuVwRX;ifvu$6KDBP4qpcNUUoNGj4L%Rfx|=6C4<3t>+%L?eiBjUg_( zhE*Nn$1zhFDt zGKXPQ+|;I3aCb?yNJmdC06nFMMNKK@tcmdt?wRgC9lu6Nf95Q7D3pYcyW$jb^FNob zZlS^ciTbnsDJt(xK~uWsueYL8=!&KPD!>mIuwRBkS(VM~w+#0)Bl2SQ{1AniY1 z@U6C#sJ`pR)dA~_b-M}Czb5-P(J4;OYiEdxN!%&>V+}+|SJ`@O%;Nfq{4YNNz(vwl zJRF#;aA;k(k1KDSe7j48jWQb+an9&jipA$X;Qyss{Q(|5d4OI zv(swp50W;j+Fzu9sZj%$d3MHrQheUg%`m0`2x&T$6G1{2uIAN(uzfx9}k4 zJQ&m3_)8t$zU?4O6@7IYuQ2ton2Nj)>hYC#qRDX;@-;_0{$DdE$bI~m&A6I7!Xb}~ zZ9H(+S-L>n) zG!)wGhXtNH{|$v8#A@9YJhz~vADTv}uK*ApA?Ge2#>zdv_Ea5t><@GIL6=Kx2k3LQ z^ZYJ7`VWl1oon_$dQ5cpYifK6W`?Q*ST7}Lw1xA0W7YYaQ34=i9?4_xCL0jSjD8eH z_OxEW4Sn8iRwS2MDudacX02FE96X*J)@bXw+0rWe;_+NGogWk-M^g5)+^|3gxq9RF zP*Ua%0$TyL6$^Oq4<9H z+mlz{t|vffLAF|t17D|SSpQcax}*LfWJy>oM?h3CHY=n6pOWlX`uWa7SiQ|pLi2jA zslbi7kx&5v^MW`d22g1Cqr<6@+p6qT4JoEfZ_Ysd;#P$s9o|d2KSlnEYlcS22zgoM zSaWTEZ~gAUEfy$!UfvRFXZU-fMZJ@657*I!sL}b8fimk{!Zj27NCTM)92aG1>>8HEyy9$=kh2cr-ql@1KMkP>#s`47W?Mt(2P&4^-FQct9J_r5`hNhJ5S2up56jQzVD}fZ9l3 z){D(wUmZPG{=ip*p)Chc;D6%dsa#ho z1bLvNRWtpSnRa&49kU4~OduA+fD}#)%kgoVpX|}vh={GH5W}R=!Ef>Bo6V((bAkVm z3)peCpB@yObN=U*qF=zBM7_6^_PUn+Tpmqg8bWD|@6S_X?}p2murWIcy;)$P-A;W% zSOJFMM($sy+4$__`uk3)I^HyRMH+s&alCHlqU-*!ruxQo{dvE?C^3JIb-yq*mow@Xt>e1(%b8*Q(}%l)%x@B)shzZi z#^5kl6RT%8lDa>b<)3C@7_?Y`R;q~8!$0vAQbI?)98G$UgXxC-$x0o07RG1b7X#|iE5RKsqxN!&n{wBEKF=!x%&8jCN zK-0V$Gr{d&cmi&Xm@>1Aui5E1-Y+oQFpsD6IovS+7NnJ!}t_sKL@ zNaxRS$LVBzIW8uDRR>%p%t;A9u0c)dwEGN4p{5!_?f^9;!%4VLoa2sWnf%pZ-)C}zvMhdwa%$O)4Uk)aY0QMvRO6FFY2Gt-&;kR8j|I#f6NN!SC%{vdr z3TJwVokx71RTBioJ|JQLqhBANT!2bwUU^D$q8~lYm4^bFfd;vF?DODojFD~k+AZYE zf!H2kIWmCye*Uw8TM+UReeZ4%HZCOxWG3fn%{Rkei$w*JLaCP(w2_=>=6foj)%F{Z zNfTcyIYZC~^|}V~C1czSAmakabSZQ3ML;N0oAT#0@NYZmqM(`s)Fdl8TBOPi1qm|W z^$fzkH0J|IlLO?bLPcT%kx=pFU~N)PG^?V@O(Zo&qLn@*|mIwun}lJ!2Jll`KCi+$165c zNRL9^I~1HO7aC1Z?+QfvFT7BW#Xz9{B$=O#>f%IKfd-B_pkMz`Zw&(#Iq3&pdv#hb zrN*TAg7Mu|+tEnKeDr0>FuNQk@#zXkeQF8zpq=qR9*(*6qQ#7h^z;@43=s(6N+SN* zmkN$uAqeHSD2=v!n*XGe405#X@SWU7H|-k9pShA;${PzJSreFDdv zJyT)80EFP8AB+(LynL1@xaoZxKrrU(Dk+SKRi`otLj)E*b6LVz4QifF8C(_t)f6&t z{VN8rSlalxcLD`T(*5kh2Vp5FxlL}GzXNdrIP^-!E80FUy zFtkh0HiHsU>4dR|2+;`S)pTKB!W0W#HVqm~167s@Br+YiKiOjoMoTIrbayGU+ExzJ zN)qvF!LUB@DC>^b(#mQ`XSLKI%B40H+xwJ~-%0rL)8Tv*_5Pm>FYPLtAkgCjMww+@ zL}PnN5u*97q1sOphRBcH?NC!qe9QxC-R7H}%grR~;xKf%fzTePd^-&-y0ijjw8hLx z#bY7h3et1DK)FmIr1aMvz>Ndfgr`3#l*IBY7Xd1bFA_U4K@^g`NMvbnl@yAhRANq$ zM=CY&b~jdotu9!mH>~r(&_2D!QA)_>AD4TT+kkWhInZs1icpac*4Cb#v;J3is+|FF z+?@wV#Ys>f+-{672tY+FPG>mB0Nfc#Ugoo*hoLQr9$7e(!o{@ey(Df9>@P5?L zjCkk6&>*bZS^lI?gg^&M-=5A$h>ru4n4p0ydMs+KIsi8GS?oj0UN97K#P~3m7)+<+ zNh$`MPreOk*1w8`m{>GfD&>(y_s?0&>k+1lyxrY-2ANOBJ^XMROsC*VQUak>b{f{~ zv4gr_n-p5)XwcaK&N+AbL-7@YuSMLs77SjzIXgXdn-v~}y&jdrB?#R8W2T&yFOg70 z&6PX1!$BLEk(-&R7>Mh8{kcg(#EA-yz6&Z7ANn$EM*%Z-9H}d1;ZVf!mD0-KASf?5 zxbgM{;P|Npew?8}Lx`CNv%CPkceAxJKLYBdVQTo1+YqQt8x32?VWS)5(&T`1qXKSG z5=?jb-qdj)Q2*AKE-(tjXvac5A`eYTn@5AnWbSmz6;8l;FhcnX=#)dCQ(kl#(7w;B z^@6~8>1)I)qcA8B3xBiW2jhAaM4`VmK?Wd?aSI2mqxgiMyMzAM?_1%%kzi2`(6XeO|Q%2fkUkvC!n9uy=2I#D27i(w%`pPZZ4w^7HM)OLk#w{R8 zq*U~o)5N3k*FRu7&3xA8zwNFvATV&rV=xC$*S@(Mt_#Yp{Nm9#Fny2o$0I#b6qL_= zmU;HH2=GUEv>yF>%Ux#BRomJ+ELPK-+qnt++r#2S6A$q6(9PP{^>xc6 z11*cCK8WPgUo&hz0#SVo{ZvjI=})g1EkjHPOn}bf@F%Fti-@P+k@`M22@FUAKz+`- zXz_^!XeC%A3Vgi3+1X>=6ASLFK!iIhkAR-znOZB^?r#>hef!2rj)I(S?7R4WfH=)R zDAUJ)AaMWOqWlne$D-&qpYRSa-#)5oPB!yR*`Q|(NLHXB*7PY-xG+$(X_3;_Rqhkf zaCW@tX-=Cb&r}H z!RLUw3nep{+88px%>z=6j`s=L;7Wp0lR21b@yd*~~;QE8cy z4jC96>uVtwB0#v1B5_>}?-oY>@skmN$=-gKBsq|j8zos}oyqJ?n;tGewo|`bD+KJ^ zjp9sX9osC1zlRTuE|hmaAqS%^XW^0lpYVO}{eWf;nj+XQ@B$Xj0Pr!nKWUEvP&JxW zcAz12szW;FI10tTSl$Cl886PTx&m-L^YzhYcvHOLCMO1JZo1yv#t3M3pTCMzTvlDg z(E@!q{9JSl0(-T78h@1Ln9=70q`oPQ-u zqo_@kHSlKH;SFYQ=t{&gPnW4$UsLD=f|~<#&vq=RO&ulwd2p1q9!M z>3Z!$>H&%_JCV7LVXgN%sa6FePg2>d<3~;iM8vpWMnbS zpK9Zlbu_KebZm;TJm!h?A5e_LXWRx_iFxxODW1+_>W=f^&;4hL6Q*mqaX;NQF-;(H z%6!`vz60bb8cJ{1o?qW-R<}{fr0sU%T5&mQSVjbAgoyqrO#`1v#6MlMHz z?@6hZ=|Obr6FzOW?E>dGvBjLvWx_IBYih2qJJ1miz}8-oglAf5Plf9h`mT3ag&!Mc zj70x)l05!=I-q4<+DgXhE0b*7ub18Yh#tO(f6Oi~rf2mdMd`2OyxooWn`<9W=IDex zZ!{XN%dE=Vtl|q^>}5Cg>EYTfi=jUsAq*C%ZA_fVR5EY;m}rXIu6>+HqR<+t-M8}W zj&%O@r%k<`9HmMoG8P+Ca_>PQ_!_Vn!o525<-6u1W$f=})E&iTWyg-2Xa`3sZrRN4 zx={MhEXv9*I;)rt4XYS}GaCY$AOcsn%wNABImy#FtJCJcz}&Q?u@*(fH5&YGGx3sd z(@CqF-bgTJ0=SXW+qr$nsJa?Uy_Ps#x-y$EyHK|hBgYcl_pRr{W_rGrPmB(&!4*_B z;4Rcd?~}rJ$(p;d?;RYf^jWqvHgC)IzO~Oj0#_p{y+YZ$IflK5S0*oxvoC>8+zDXj zM9=mgtTa5YEUL|$Y~96pkG8w5@((42y?N|@Fuvq_q2KzBrwf@(}y#DdRZ)$$E)}icqtc@-DG@{ZRqMsd?=}ff# z@Wm?z2~rpR>uwMuwB=sj?(VTT+O&SA#=C`@1(F8*S50JM7LtUr_f94b%O_|*J;*vb z3eDRVW}Th5s?S`ly3;;9YRWZ4PPkQc8f`v2`82-^JzY+q%f@#>(uY_ojx!(r<^Z)!x2y*ZLd?iGZzb)$zx+be#9~mjP2U2hPFLY`0 z44sox)&0)Fn_A2!j#P{oy8H1$$?fN_vgxw#7#*lyde!5P)HTXBBqcjXmk$NkV*+Mq zq{5Okqtj8=|9rS!DxX#gBk%p*xQknJJD3=Dml&<8t*JV`@_A3;le>evU-h1E@@Ufd zXwv=HG<+Dc2zWa5fBic53O+`w_kxT)-d26vjh?ks7FkJD+BaO##8W*uQeko{~vaHDu zZQ9BfUie@}8cf6?B#1j-e{>PMmUE-r*C$~E;@^^gy<`YXddBtrs^sipnv_l0w{9Y0H-UbRmFzyI(KBCd z0u=1Abr;31?Q+)la+Q0C)n77Qdu$z7l4IKYgcX)jQgfn}MB*l&S2b1mv&5Ce4J)rW z&Fg%k<9H|dqayKjyN~OOL#$n2q!3o(0gId@KQ#(B;XWP#%Lnqo35F*LwGADvMlk*D zzB;|eTSp7VFAD?S+?1khPc7)38k=ZIy0(gAr7n=(eOhGef>YmEWWS!D-~KhMIt1BB zMb19yUS2yN?c;MrsSh80RnlGI$*&N5o71>M z^1iTFbX7cJy;03mdWeeT{GVHzgMNMeCG*dGMmyQC(sJY`G9@ftpY{T%Z{wI}v~Xnx z7~61LGw0U)8cGv3cloRxhN8(u=jwP;y|Qp*=J>>*M_Y&&ay66eX1w1R4IVMCnhYNIj6l6+&--SCLaSm6dU!=72$%=ctbYJbw|Y^@>MeVI?N@?j5)y+-T1ymcCZgUm))1ADKp-{^9JHQg}->G3Kt+wl@Q-z}Ne^xGf-QA|l)@hM{$bAKZ zpFv^7%rF~o8i|&@neAobTO7ucaRUM_``hN**P55xrqYlNv#P^WI92oZo;_Gd^ShYE z^AiUC8xpE@Uj!&1)1~_kX1KFvzdUdhfx4AQ2*DN|f5Qxg)f}I4r>p5}n=704OTPIu zx(he^A}rHRRQgx@*t8Vfv!*sH`B8yXp5GEJlGAO^&epSDO~L}&nD8svX5+oEwQ6!T z*>-r13;Dr#aDeSe<$U&=%P+F9->IaCS$)p6DrP-H_kQQvpL%r>+IUMP>AS~lDO6(T z7XYyrSN$6MG&Qd9C(#}8lElKBGtE|Zk$HHnRjdwEFEQyYzwXTc>y;QeQ0J188%+AjM6ysjx(JmYv86* zw}(wn76RJuIb&6FqJxe%8WVLCW+G9Uoo#O*D0gi(1jbTtq&&QA7`6zcTR-=VC9R z>Q%EKDD3CW7B^xYEQa>O*#h|War_tQqh7k!vjJU0B9u*Yj?MnL^yea&;EZ3gRa7aO zZ>2ivzzjICTmE!MU#*R!SnruL!>h+19I+P6o?#S)%<#}Q%$!$DrGWSH4O3zVv@-G6 z3-HUoUhVZM$-&~$*tUA*--vJM*HOm07<%NCc*@=1L>CmMTy&u)6oqH2W!dU=>zR%u z%9G(Up>R`qNCQjt5zwK|0ekw1n9;$EY`x`W5d5tChSxpqWyPT`QK%>|Qt*Od zrhgA_1a``Q_rwjN)w&VwB0>yxl)wg`H@%gz<_m^5&^~SIGDYI0L|7?#YE)rZTIzc8 z^M`~F!{McJ^~28=Y4rfMj_#;^{x+_kRKKT|&M+tK1odt$q>MfqoO!_b>;wGyFlxF_amrH{ydUd8*LMCfh?tb`jn zO-B5xZ;X6^F?gM=cGOzy9~^`Y|3B>gWn5H2`v;64R*)8ultxrQKtMpGS5QEaP-!G2 zMHEz!hTT;{Q9?;+B$e)lRVk%gL6(k{?q;7ksP}#UKmX_b^XB);Jve9Pnk&9n%$%85 zkxlVZpW;fTv(SuW=FmRoo7&0+ zarK)-YOT2>^g>sz?3aYTOQoEW}fpCcQW92x{G-Uv+4aT_XIH9eSTusL)7ePSezpSJ7uuBWG<`3D;N zZ(w~A#ocZ8qUKvuwys9SFFo_?_lr^6iM;v+^3-BkkBk*aQqR}B`#uQpp-KGc6n(N` zFXHa=5ItKODDpI!Hi_Ns+|R0{Pme+BCy6tk&j=)rrmR#PL#L4=bUqh_J1%!E??YHt zGVruvrMlcTyHA8Qf}cvP^q0HLJt1ri{Ip_ayWC~42Vn={rvfY2-lz~5wOZ~vJp+0Gt$1c8otL{rZHcf< zpg*3uNtNX;{uv^y9^CuWr-Iw}LuDazbz-7Vp<)%Myd)asp?t~bkglkP11T5v6K3e) zTW%!d^jVSTAu8oGQ0WcYB#Mudy31XVBZQ3v17O@wc|9DFh4MEL0ob`wPZ}hVGPm;b z6qE$8xevV>;xRBhQ%TuJtdt^FfwX6_78RqEed)}hfpLL zF@wq>%*gX4MTp%O8}fOJ4-%&h@24)Ed%lDX**RBtoa@=!xwrXVyb-3H2|}N$S0^#A z3^IAVol56?PAEJWGlM#1(Mh|%UA0VK3gtG0{5)4j%C(WNVBlQ(`&%fAW}rnyRl)2O zt9)3FG-GlB{m&ECagW$8PHt_{aesVlK&*FvsaocwVYNWd6|EOykIpNlEX)|?RZy#{ zY3Yp(Sl@$0>1%#3uWUSF@-jcIw@Nb0eZ2bxYv=geYoA{!jParP_0(%nQ|Cc}>37R2~0{KsNPjKMje*<}vOMe6TSmTE}*I1ftZ8}UV87P?E zvi@Qqzs_cn{nmiKr1Y#!*!jVCNVkux{iNKiJ$zFh7TXcx3i61T!50K9fldx_7Rl7ux6?d9$btbp-KZiMo z33v~cobfqb`B~X56tTn?t`HpL4DrMkg7u0@iImDPA z*P%s2{eH7L5HhN(E*D5Epx9Sk=*DU!tSF93(P@a*|=G zz7uUM@wQ^++Z}X|f%eDkH@tHbEpw&WTf?UvA}_3KjLR=*R&{Hsmbq~7jV;T|W2TJh zEERed7HA!#HJ=3CEnhifcw=wXOs0^hn_#4+z4 z=IFM#hb7sLcXN96dB-Q(x!$FEvA9WQ*A=N7Q~NE`-q_82>$zxQ_p!%s!`wTvBpwcy zYRKQ?;KOefwX;C=6g2d|O(v~|vgbgRG0D=~*5}6sc1g%8vh11kg`z@g+Fwa?0s7Er z0JTc}U~TgA2V~_CE7S9jw&SZlH%1MVKXy2&Ox3GNdj_9MEOtN6Cj6<84^8PGy`A7F z(dBoT`5c0VSc3h6m0kq7X(BYRi-kwT< zrGat84X1r2a*5L4Ke>l4Ynx6c`n z<6bpuu~6D9#e3z9AN$Sj5V1uOq(VbW_r!uXmqtl+j@->4v?u0RsC2FexBqjums8y4 z0|X13$CCr|FWQM{$s3?|Eh#Qzc*YS$<$`gMoU2PW^N`6;mDa6m{27=a4 zt|`y?PWCKViDyw1X=Oim-99y)ms_)vcMp+UpaFZc_x$M+d(|D(SdrEMEcy+!ym$?+xOU@ zd-J=?cZwbvRd?i_4Gf+zF21_oRod|Rw(-D++)vt1^bI1qg!ycZZ$E6S+Lle$Umnqk zyn9uV?L~rCvw~5nYvyX&Plqt@AB#4FjI@;J$euUo>GW!yp*R1iL-it+LT~7) zu|tVVWm#zrheNT;p^S;K493U-_jne$TyRdLWcK{qyneiDNu1-F5l}wS>_EI*Wca@0+Q46NWD>gIF31jeaBq z|2$QgFaG+TC+}-5D<03&uYXzwWv>|YH*;q7JqXe0{eq&t#5&?_VZO(EukTyR-qr%& zf7vm0QXAqQ@cQnLbR@>1W}YXzf9?1v$=Y$9Z(22jeuuaF+vY7XU*7KP+eL-ivZwvG z-!Qa};n(tU#F8_&64d0qq^4Geb>!Um4<@#?TgS^Rv*ooZ$3BM-9XzoZk4@qIIzqvG zfaMifS`Vf9@2CxQVAS@zufoBo7Of{LrfY4b8k-WMaE4~RWcP0E28>tOEl>IopJrwKW3ktAFQ}) zUcH*Mhrpj9bY_)tiqRE@bzh$+$8+q{_sEWP&;&hJ+O51yBHDexeMA0>!FgIQ`Fc0~ z=5hU=DRS2|i|+#uCRVbB%GkGp@?}g)M_>HMoghO<7$6TShs%f>rf5{du#y31_pE>n1)20m5#KK9nDAxMC^aJYJcY(x&w|%T;*Y`N~hc>0;me?)` zE>rOQ^Ha0wXarK~*@i|^6k^W8`@Yu@Igf;C+@&hd>#Vy0Ju?FMwU?&;_p(b#YNLYp zpAMo%TkN>}L^P~QM1tiHmpR4?@AN!CaKRo=ln>LFWuKAg{=3It#g(%^)0%SpszGOF z-wAcLdd`@@!nK~?W$p!ZGiiyc-H}DgcJK8D!!NO^kqmw==DIl;ddc2F&9if)4WF#y zbZoGAsm*P7cxZpiL#|}_t#wdw!NXGC9B3#Z7i`Wj6%JKs2Ljh2*34(hncH`}2`2)-nh`e@N4tf|g3cCSH#5<8-i zIC4FaCL;nIhSuO4aGP!{dEN6cSx3k%pU!@SN?CTP&idQ6kpd$jfgNsS(j$!Aq4E!x zizm)#8({=FFFT(ZIxKXitkO@f8mqZDwG+6Gk3ZqeuGXub*>#6Tc*;N;=gc(X@#Z#Pm_Gkv@6Nr6IlE(nj;UWB?+*TmbV&4ctQ1=;OUiZDc?2Po>Ja%8$+U;6q>?|H4V{4?d*AYKC1RC1JE;;0AQ4Log z2sfq5GHinY30X@L!?%-CvU}Z*@qpY8fAGrAvv;CLcB?5PGekY{T7}<3&bM4QuMCGN zENS|MRrPS~ndMlI*@wt0EK4?k&FWFnWb1lJqNFmM3a@AdcFLIf1htH?TU}ig3+17i;l`jWpl^TY^E!Hs(D|*K@#|VLF3C_u-;1+oLoCN|Bd7 zJo549x>>i>ZF2vMc$N4E(+pZQ{cyj$48;qJH$CaS&YE0UNwn+3)^)HcP6l_xdAkgz zU`dG(y0nj<-|{nzv^*qsD7SZ;eEYelJ9j@%vn)_n@IXmHk_1m^+Hcdjemaow*3?ug zePB>=;g__FQ~COtSj`A4o3tz3S_tMGV|~=H+i7E_c`ZgHO?rQzt);zcX*8Xa2bnaB(7YU|@M2u#4R$%gm5b|l z$$+oQW!d=Od1@H0+tH&WM&~dE>$`go2N!n5?L@w@HR6i5M;`L)rsE?hF`VS7CL2+4 zKHsn7udYntL%v0&yN1X5%};-;9eE@l^PH2a=U4dhYdhWXx_YDP8Zo`SnU2He?~WVh zca>?mJFgLupf8O7t{g{H;imG0uj_6Mq`R7-gzO~p?ANb=Q$V&d+ENtWKi}P+#fC}w z>+&fkltB&3Xe5Co(y`j%9!- z4srUpt#8We<=iNfTfc%v-Xdmz0x#Yf7xKr(cqS^GJl9Q*x-1pHO}M}NyVR>8TKd)^ z6N|>u`a?C;C@R~O?Ji-GEo4J8ME^J@kRt9-i%YT8l+BE(Xb^8_x1H6!1i**k&>?$v z?p{o>Yx<0XR-LSaM#H4BKc5TEVvm${Kb-0ElAaW z6gJy@7o}C-Xx}Z8S9B+^O=Iu3^-W#P3a0xwhvn&F@&!Ip<%ux1cDa$?g?F{0M!)lq z5~sf@I-k)_o?T^m*!-h%XPWw2XKB?4j=v&(-ez-rZ_IU{AE%F% zRoUZ4a`PcQ`{KQxW)6y({ z_Bb!nJPM1KGTqxZl9!bdzHR(Iax*cKQ>T1$kUtQ)c0nRhGm(q!p@hPd9z$liyW!Y| z>q%+|3g}vlaDj`i`Sy2VzVy9Q1n0_{uGns*s_Qe+czXUa>{hpI@PI_&{4q;rk;ACa zv{)4w^X(Dp4!hgxg`!$vQ@%IOe?iYI z4!59KFm+7wjJ6NP*>&)-)2?@6I_J3RrJT!zy6=gFROGEDNFwt^e~;!0>~f5!rW#MJ z@S~UOk?YUywSQ&g#GEIee`yGZk7hwNEAD0b0#7PVMr)eyG=?ZTeduyi9#lxF;A<01 zx1W~@z-~Su~k_$Fi_C3f|Z(q)DH$l2JtQ{ zG|HrstH3+ukjceekgAfobo@fyRI5|nkMBf-w3+Wfq!wXQMNyHiap2#iii>jzI!Ft5 zSc^x2@QdL(w?An&d8cQNJB%s{ zMn1D7A{7CXc0W4KOH)#rJX@mif4HyT+;Kgx*7!VS3NC59sx$5)zC%#7E?%IJhv zu0{!!OqU!4ZO_gr-ItI`kx#M0Uk^aOC2>jBB^vNG@LX!Mtywe+jC=WmycKAx`6Z*l zO?~dhhi(g{T-OJ#AEuuTJBX)9p`Xn|x~NhGDYD4#&T&x)>b=>LVoITpzB}5=mgn8* zmecQ5Mwq$%nk%|GLY17h`4v_%1F=SMxA=T)uJ-Y7YfI@@*I9@wPbWd0jC%1dI!W&1 zsEz)C^z#dj8H%Z<{av-sRM3E|Ma{D7dj}jL@=tZk=XFr|jPB>u8TPtk^9aeJZx1ZU zR>s5ot52q#V+66uwjR}r;}`6Ykza+*ePvmp`RrMIfIl_TBAShOJs)MhhteV@BZMJ= z**k&s=_5?aD2|YMDeopi~@L5*pIp^|_9!;qGZ8bC2C5=_xw+YOfQY9j#!H!3YrF=HUJnO5usB z-f4}9&A2~t58(%AjJ?hgazCbT6YNXl=vl{1>{3#r!sU$dbljctm>k1aT*ZX+Q2!6! zB+q8uMfaV?XKR-1hd+yTw)NkAb^7#>#}&bNa@))3(Wa_YV!`UJ&O-;L<6gA@3@6M52-FHny`< zBwaB9mvGzD<6C#w3D|DymlN?9bWjE@38gM!LHCX6dd}GbmmnP*`pHk+ZK^b?_W}Kq z=F)au`h$uV5KQC1=Pb@;O`!+qpHOQ0dQaJE;Z53?W>iDd+UGG5p4ZWGF1to<6$)aWBFxxce6EwM&q1S&g8MF_mfFF|`exC14M z-PO_7v)|Z|IA&>^hN=(s^%cs{Mu(HwT7DmUaR_cIlbtaW6358ynU!q( z(xybclkxJgmFc4d#aWqi%jS`OBZFf3+pGEKV`mNWWX^|Uvm8w7k}k0lY&d;`Xs$1|IK4Iu*xjD&mI+d-1C{%aS1Ze z^&s>1fKZE%dsD+}M~6B}RVED><9WptcKeID+8k4VBpMcPH>jhLJj92>!xGD74hn14 zAKfO582dKx13dNceHsII(1( zb&Qlz*?i;o;5%y(4=1J~*EDp9fJ*0wGsvW71l~cStiNbpUn<9KcqT9|;KyqbVE6md zty;&kEFVqo7~|gQ9T09&{5ISnzj+3(5=CIc#2Q^gfP?DE|7}&~62oY6$R<*QujKkx zILMXZdSDh#xPMIzjr>X6{QwCIN&Z>v7d_$4;2mEHoIVtPJ2u zHoiZ#;TJ>@pXXmLq5V4KT8l65&=KA0PTT)P%_UpG$%=|ODO=_I?K-fq59Dvss@_zW ziAij?8%I@dzWqQVg0ldfGI$>DavkWpa$LHbRU=+M&wN`H-)^J;N)6fhVQ$Q89k+`oboLovP#e&yrORjYhJ}-Cr=3`5 z)5_``A0MWu*2oKQIO2RZ?VNtMeg>?Y&Bex-6w^Jb6dJuV%%QSG+-)XK3j#269OD-I zP^K*^B3Rb7wCRBs5aMadRI?a@To;+5>?VDacSW;%xcuf6+W_G{Z=<4?dxFm9-6>Tx z@)dF6@`_QjPs1T}Hl~L?{R0&G_4>C*YH;}KHD}y&@w=j$7-!7TWfB$8=_19=)IKd# z;l!)45$Y(811r~n?!AY^aCUWz*S}6}$uT>w?aAOt5I(CSQt*xoitgjzc9&2fr9TM% z)>R*VmVpFa*lHEE#!_iBMET|F!~vefGOX@`@mvCg`9k(9Lh?(Rtj~D4F$MjT>&Lv? zsHLbB6$;ll44Zv;(=O+w+TC~!VIGis$q$Q-M!^a__bHsBCA@DR@Tn%JG@Y0;eB_|eD< zAdH6Cfox;2!_joJGDn`Jg_aS(T_*NSS?qWxqibEhULHYt5Q$G)*c`hII@P&qZp`#R zv1a1kH8#O_jw3yHYgg!1HR@LsTa>&kM_$l@;EK3XFke2txMpwVE9ZWgNSwz{1HduQ zpCCZ_uJCnXvh2wOwo@wPpiig;_x=Re!wkwM80|hFP&H1E_woWj3TxW6UzO-mN!j*J zV@^avu;=g$b!qtT-TOF((}bFlrzQdr}8>du`V?>_$xzJBHXq29Ib_N`o1Fdqh`q_-dT>ttQ24)Qt@ zo!V3UUK)f}07ux|=e#Z!-B)mFe?P}jy(;+dNuWh)$Xk{eK!G*wOP<%LLZ^EZu3x12 z=7p4%4qETI8@*?m*uuRH>}fl=@4t8IbpbgocPKr^G1W|ha1bf3=X08Gg)D^|I4hF( znGXK$%@IQh^0(~oCNy5Iik+B^1szAwH-CwmaGTIbaa1@IjA*G*CeJY5i|>AExaQg` z!14RG6g;IcY|Lks31&x`x#s~b;o)~HLCn!9KcuuSSG<`(X)m@nw4VEY%#X|<6mFe> zG$IN;7;LX%s^QDlWG3Cde|_|ysU5fszASaOufs&1=za;t?_+QiU3k6fNASXS)3L;5 zaSU8sjW8v}_h0{NUsfaU`=k0ak&9EVMX zk=TMNG0%Fe$@T8jUp2bTu9fUj4%MJ?$Q+}n{^-Q}-1r%IT{7tzrnqT9zD?H_uSt~n z=zw3i-^BEeggpDCbpX0VV|@_x01gyePIwNaGYU3tc{b8SFo1Y%tyn5*->hb1rl;yW zDyG|6*!um9kpoa{V{S@RNM!Xu`?QI=CT{9%v z9~T~LJ&{v0H!0Mw7;{^;z!!i06>LvTZv2!bQuF0jU5yvdx$g!IDAeg?dGk-X+&Hxs zMi0oOIQ_T*lrhSDrssZrpkJP}=r}9&B;h*v-&}GDp)VhkKN<7_2S8X;J$^cFz21Tn0_RtLb;&^=Cw7 zc<5j|+CvZ$Gn@kTk`MR`>YkEvR`6!~q&pmGkZBVh2v-3dba;Buvd zI@qfu#sN+H&I5F6*?s?TDPd-w0SwKfEXhBYCR&HJ zBZ~(;65BATp`!fEa663+D8@qPC&*yM?so*tt8Ft>_@eBAp!A75_d$=`kMpsXhOHNB zKt{o(uq_Z0ehq|NFU8+q@@F-wTHr8zi3u$1S&SZ7i9DumM7sRok)0X3YxBg? z;;jtt-9g^t$LHp{WeF{nvhQ%fMB%!P*j^7W7jDO%%e3Ud2Ybueaz}(F=bp;QG*;@D zq};mNf@8O=pyE#(niIfC;TXW`UQg$b&N(j678<#@3<=GV#|MJlIesx^N#2?X<0s(| zm8_U2)Gw$&VRxcT$Yf*TQm~6!Fz`=L<)lgdOU)Pb6Qx;?=TVCZNiRz)0%Fm~G~&e@ zONE3V?dl0pwVMP>eB;~&4cBCM$3Ux0Lf6ZqrD&NmkIi`N*Bs?1_C=gC6^AF0NFr|1 zu+AG~%JyXm;SFxe530%|HV0vYMplq?i!7@uWtx=3zH~1FukMH%8BGr1+?lc4FWV42 zJ^=y>G*X|WGy_K%nig+29_qX0j1vdt;DlRcik;1aIV~1%1~NFAN=IJv9s${PU56lfvIL9@ z<~A6un^e}0`}24~uGor?Ozw=pfzGu`xbD_@wB)53KLNkCt{m~m=H&KXdT)F!KU|dUYV%wpN-zP4ZNMm!=^JIixVL`o1`o240Uo`@maBgljhcX~wqUqPP zh*sEXCb-@0(cJ9FgXUnV3%E-Iv%tWm>gWO#!guX19Q0Q-W2A<$EsC!LO=JrY;7$!v{EUL zoBeX&3O=%dLdtrY-a@~qM@9t})${Koc@#;|?5*R?j6+OK9{U;2ZFR%pPNG~&@N5l1 z;99!@8dW>BrHq$IG$HK(`!`YQWQog>?j7u>~nYOW0bp>-iOfS z{H!dD;E!}LKmqvH%Ic2WFB?w-l@emIdAerPi+YrVk=3BNkdd{Qc{}tVVeg4+HTLYl zm#Dbhp&DCO@H01nnU@)i)n*!34d}zZ8%+xLR7nAZDZPSh*;o#DsEPvaJ2Hp6o<#KwH>I4IKI5e#Nti zSxw3x#Q8lRde#T34=)OTet02=Judxy25c2@WIvu)y*is$$9IXdM$TqML!PA*T>p0z zZ@r=|OdR%V{7$1Ivf*Wu4RxltpE7dlATexK2=`~3?F#k(Ghhz|`?FcsMYqL!BQoxT zDhX$fmbIPeU-Ez?9OUdM=`siQVR8UUn*8mZO`W>Nris>LF}>Le%6GJ2;Dj&<6zonv z4#sAc>xO&8sE@ePN3X`0K-dGI=BdANu|vO+0y0SmS*lyByFfiLS=Z8E$p^o=Nz6br z=;XuzOSx5(TbN{f!noaF$G%AR#+)VvKjeIS4P9G{Y9pw2e~mogGM|7WdfMhF^l4=6 zw6X;F&7XxFe6uNE7WV`v5-wR+J(C7?rk#4QxS8ludpEJNY|Jd`%`@QIi4gIO+QhTj z8911A<`fvA{kG{T!I7BF<7yiaR}BE4+2@C0v?p`jDA(6?4L!vAY?}65*X0Nno8{l0nvd$|=>>i& zpMRTw<_Pn{5nJ-R^UFDW3A*2ZodF+76CvDBHv4$syO|G6UUq$7=hS$OKn5fQFyv) zcyjQ)$_zxSa3=&mwp~E`_4VMwmnX0o z;JhOcy7pe+2@p}zC_-$1_Z{`Xfy?Kj=11VH+=ZKMl?Gg#6!zWU2=81@xKhEi(ei%) zN<(L>(F*@gKr$7&rUen93f$h#C|Z!9f41MMywctA%7k!-wAfikWxC>{Fk78qFWVq;ZEbV=PZpDYARdmaUx(zI@b8 z970w(JHBYAb>I=dtw&AU4WguLOK(ezqZ(Kg!(wPk++KpiAmH)V;qekJ$N?|7X%Hcj zN_U^koti=M(0pc)K2CyWvT?k>&>vRF;;62{T-te;{%AyP0itW@8yaO+V49sGm;j|3 zpWSKe8C+i;^j$Pp9(7AvUQ{+$vnAsn|qWb;HihuyyeMId zgxw@_O2iW?67)wK$>BxE*|&ouzATY9`|80}24HGv>>V&SEyL|#SiLHFX_ejZSJ`)$ zSA*C{E5(&6JawUH3!i{~2T#?(6#`#|+u+x~@0|hfg(bPc885NS`Or&+dtEAC>y9#m zcGqNz$Vbo6%X>{l4)__BE66w4p5&r|eHMgyPyCSTa#-jLEPC@?gjoGZ#nhWMlxyyR z4&IHgoV0bbbFfOY-QvIre{Udy{Vy7Ei?RV;{=9E@gfa_c^+JdB!h-E}pW-dE+}p-<6+idiNI0!7^(iEj2fGsK*kADxv8clN*x~(Y_0}DY4b`R+25h65PAsb0e!eG zlUa%MaNWyR*~gjb4BxBV&oY7Fd=re)=6blWtvH+oPE9{jU}Zob$MfDJSAX;Daw#ye zEvGy3h8s;;#?VVKwo|9}ht?673x10rz}LYlUz~Xek7v$>!3g#C3y*Afas8MP8##x$;efcj z^gAc-zQnk&0O1PQjsJ%*6ynnH`NW#HKw#P~80W%0zpl4kXUpPCA9((BdL&u*I|qU> z4cLeV;_2$h@2sn`M{jnXB@!g6B+df&=91Bp;d3Doj$dNyQv3-gGxdnLO|}%}ddua~ z>ShHHBS(rygg9UT^kvk-1to0{jFd=)-9bl`LJJdpcJEo}t9|LA64{D~adFq1Bb=q3 zO-8p6dAxkY4+hXtHy2tUl#avor&1$3uDD0m6wnL%(uCWTD{HUJXU&g?{AGeWtu}G< zSD}}1i7kzx9F_mJW;?w|Pr=~(ywS~1tWnV26>KuVvfozYlXVTu{(td>3vq#THlR`r zri~n98`3{632(Q_yIOkZjNvN;_VK~DI<=id2|rB0U(IF*E_3q!MPDT#s*~iYQ%fye zUX7iy>fznlcLWa3Ldy0_6{4?ys@e!ofYU3EbRZ8NM6m9tR-}iC-aK|$YJqh5RpGhI zCZ=f@AoizIrM6NJg7Q*_6xkIxo*z|VK<{2a5hk5XuL7@#c~0pi)%#W8Xnp_lTJ*E+ zsTyMQXW1IPtWmN%i5vD`h>nKhmI6aHx9O1i0ybEmyexOq*FMtm*JbVWRHJWc#U$vl z8Aoqp#N{eRVsH-2k-F`}qqsU;g-gW<%D8^Ak-cF=(}><|S~c;}9tD4+?b|0$*{L^N zIT`|uTqM4GBD6|?juzNl;Dyl5V=wb+0hBnN_c)!?XjaPz*_~3=qtrhK@ey)rDT?8U z9&9$F%|8jwr8{#K@Pt8~yG5yV`UqMJzBnijb~8f$weItI>2rr>{R*#+(m_B@HB8zw zn|hc5Untn6MGf|l_fitAN7E{a&Ht{hnB6@7qR6@PkB_DWSxgHNg@mEfS%Agh-j`P^ zA~;aMA!I|y3=qzBZ?t*e_E%)?m>WLsD*H{CHb9XQk}iq1=ZqTs`yPX#Y zc^0UcC)=0SaK9dNl{x+4k5@t_i2^L}dw(7SJ2L{pa66fAI;d8bfGOp=w?YZcS;*g% zz$KFT586IHbA*T7+ByJyKeWe{1KkT%#<2KU<2B}@rbP>beZf_H*yZj1vh*M-)1P$I z@qf+057-+2WHC8h=XGbu^bfMhiZl_^Z(4l>7(= z)Cp@Cd*aB1azp$TJFW|HP^XlWpjnDk}Rw;2UMaq{ZGQ2XK(Yh1ilhPO4e^?3+Co zzG-xrr6^hu%B`Hs2RUMb19~>>NF22Mwde?_AyN4hm=-rFq9ZpXm|%EfeAa->PY9wK zc(8O6(Xkl)Jov8;cLSRYceru(Dwsk7Wxde;BuJ)E#WTlT?XX`=5Tb4yrOX4YK|^7x zJg=EeVpNBZqF*A!9kOzEa|#xkqY_CLVoQU{nh&+P9uZRFfixXroIB(3EZaJ$(TuOv zq9K0ZCo}VrSTey0p%7!Vl>i)|RUw*sRVTPyTwmhWO*857Z)Y6c)r|_5zvDVt{Qgen zH3$$4ZEkY{`ZZ5N@hg-BLjk4F!pGI_E^S>&;xF0kW~LA3rSiYL?20zvKXwu(1E7dm+`UD}Ru zh3-E|2tSh#Jq9%n^`ZLcv@pVS4Ried)_U5#qskk%wkhxc-(|}#!eMO`iU0W3g&Gsi z6#L)}~=x44} z)FEwqTa&B%3O`ujjj4c7fX9FVqTg7y8(sno!qJc%UpekDkP{{ zIBjvV&T}o#7Jh|W+a1t#o^TR^HQ9wYI5Q}yt}6c6p8HK7eJHzXX?d)m!1HAL7azna zc(no^#UDtrFWS}+mgEaWkjhJux{Wt$b)BCTss?o(^r6%+!pP0{vO7z^*XRC1%nx4k zvsg}YGkA7M*DyxHRw%~q#tq@pCC{R}$7SH8qX1Vfj;Go%QG;Nzzy#8OWHNi5)xmjP z2q)&|!o*+I7E`1%xLaGE%`+5ekB6q}W0Q4zYmRXB7rZeFftj3uR(N45Z;H@PaMh0c zvz>^oy`_-QWP?5Sees2+yP%pRB&vVF2euun<0h_WxpT8)2{z N!-sZlE zS()L@pZ2C_8#5t2KJ!PwfRm;mr(V5CKMr%%hoswoQ^crn{+eUEy)Ry4>kvg{QnIiw zWPf*vpmz07{~)R~9gY6FNTbTNyMSkNhebgANocvP;B6PZgY2We&1#-?6bbgXLCXW` zrNfzp2p-NqLNLD#gmBJ!g&P)v+}Y*0&+*E2tGyvRJGn~$-swx@m@VAy`KVn5kpSET z41}aJ_u%S)m1z|rRy_gl>`}q7?;1mD1BbRedkfXcF9ZIx7QnN%G$uZoQ}ajleD&VyJ9mN} zBr$RjGUmF9;Q1R9qmi;8QY}uIW&u>`D4Ac@^mUyU=&8+tSWJsH=4r<>R(*Nk(%zA7 z!clFp;0(Mv8g69%A+pb`+^(U*b(*K;Fb8V3Sj-J*{_1-aR>9hm4&!p16xdpUOlm=F zs63psVMLngK}Xf9py=Ul>-)q1RKeqd`B`MgH)=Itj@6X)#mv~(-KG!$w}jj)L?m@J z`_zoQVoUtXk4|d9?aJg&aJiGgh?_FVYo4TYjS&u~WTanjK~EQ0o+0 z4n~v*tA^-b=auOYD#xIXX60=49VtEsyP8Rk9zwpd3f=^rNlfU?u zKxshU>Gbp%5Ic7nV#8oB$LIJ!6(cma7_BIGX^BnXXU2y3Jle~MCBA#r^A!L0Ih{^Pzpm?Ej+-M04>a^Rqjx~SA&k5f}yx< z$biHCE8oK!@w4tqbtfe+94X;Zo~(zMyvJ03^e)9s30C@!x{YkgvUQojglvdK;Sg7J z$3pYaQ@#pbL5F*N$_Hp#Ouvc*%$+Sk)__&>2YIBAf(OD7$mVl6T*%~`qmm)`Z*Xz@ zX(XrZwVQC$WF(cM`!uLq&X2vU^8f8YWbW1`kB=wJOV((%x`7r)^vi(&W76HF9*!_` zDc`*5w^+O2E`KoV0Zyk~D^0Mm`r}rBAzT60O>yzo7Z~)JiM##19KHK;=9rz6=LD+e z9f(E)Nl$1j9oAWY?~?yhjt3B44(MqxgSz>UN#7BabCzQnp5&c<2&~$|x7T+rQhL4* z1?P(X0m*ChAUGO)^C}9=nd9Wkm8c6wWx2RyoXvcC7704kI;xEYbNnyWM2IVN*w-+3 zA{Y$TN5x4+=5?n{z(qUoURSaDsLk_q6Mwq}K`_9u^-~OrfR%%^&4p$UCNfJ;;Ejlq zF3}wt8`DW2rRuQl-UIO*g;s4ZIc;V-k}B`6%S4lD|Le)BJCK2E(|++j;hpIj^P@UB z3~)aIJHB5^0f#rDu~Y~{M+fpB5eRHE*vu55YxmcNA+R5gfhZll0vEz=@Y5ER zKiFy1V((k%t-K9#%&Ouc%-laa({=$Q6n5mp)#-eF^UN-mgC$SY?`|o>j6IIpr!B9N znHJ}r>vsQY2APiTXfz3pZ_13KPT%?zY;m8+iRtqk*B!&C+%|Fr2798Nr&2BaW$iMu6tTcU7Y z3zU@+j;fT9m~Y~&UeYcInqaL4=_!z57X14x^Zi~_sqrZn2YT!?*H$jh*e!F4^-u?r zEVKXca2O=S>o;J&+mX~7w1^{^Xl-D4 zBfFqr_do#aA@#hM?}%nV0JaxoanXZ~;$RB=nMn4RE56jW2`DYTiKS)=bU}fUllyZ( zO8cAIf0`{!0U+XZIGoh-2O}?W7AF37F6R({d_!xJdocKrKkNXQ{R~LIKc^TrFmQ^< z@-$dP3uyo8YAZL>e)J(hYHlP0LL1(B0h4}j=E}J&_`^SEUGB!$vRx?9 zQewLzo(yc8|0lE>I#3r0D!K)pJ4rB6A~idfuV)4wJxS1Pi>$#s)i${=WRI4l;1`n0 zz|3kkF0q0^WX{s^jnB;t>KlXMRUfE#V>zmr$L@wbmirF{bD(vOu^sGWs>!UtYI;Ru zHz?24?2S|(j{KL*;OLMJb%KKvlvPw=+}9#jw`k$DfmCOG+PH4K$t-i z1Nx(bki5Q>wmpZ~(xMCC?lJeRm5*W58DMk&U%hz_=agOuKP@z}fw&OI1S!?ntknh9 z)TjQ%h;U;NRQ_5M1U01_XK23?);@J)D^?D_v8h3DOMLmcaAFz`Nd73{|JFf{5f@@G zZaAWllKqK!3JAZ6;-M5YS~OAqPwOvaU}&39#5d4LKN5@n6abjKFEY-~D4%~Q{OqXJ zy$$uJ;Gh-=K92?1!AHP@8}c>pc#%m|2r=WsKsJZV+3`9yWeD!qc@DO;@b0cZO2D8B zh`#J}_BL2<5D>k5QLeu~ZKp^Os&~^n>kj8PN9+f=8}LZy?t*(h88k+pEfD|mAQ}bB zs+MFKrQ$Cw|4a(B4CDh|qgt9?3@pXbs_jAh_YG<)H`aERii*9ko!SPG!QVc87J#Gf zKWs=xpGFT5fft_&EVoXzn69q=ROx?8#7(*K=BG=p{C`Bh0_GE_7;q8jj29wEbj7l$ z?b8$j>9JH-fq=hB`_mti1T;H;8Grj6l6whJgd@u@IeRb%zSeVlI4>)(*FQKDf8Fcv z&>*ECXD=GXJYL@q7?kNhssnZ2!myC4gj8GOKRK2S+N%pf{*6sh=_lg%%RYVL_&Z8c zDhMvaoh`uWw@5mY!oeS-*^9jcw?UbZfbyV|tp8hm0s8L_aH&1^_glci1#&CJi?I_% zfUli*iT>vUSL_9%Ymf+>BCVTo+a!M_L4%!L68_8MhZ*PoRyBdT%fa6eVOBDF79J`uMLE*Z~*_F~+;u(Q}8AVy1Y~ zhascw=vpYhDonq)GvwTV24!RhgKkqIcfmx|M^9xqRxbt^pYj?6nmU-%l&%?kKaKZq zbq?kuKf;X~kejrH*oZE1o~gA1=qu#5Rk!723m4PinIMy4JC^r;4uT*w0*^pX<@m}! z0&Kpzys9SyZt?slb!;u5aqq!43@gJ-&8B_d$$EfsQneXF|AjhkQF|Z_!!T)Bp%*CF zE7qq&5=DDH-(iOO8$4vT8^oWDy8j&+w73Hpe)H_a6Yv*j1M?3BR_UA>phy$sXs<`Z z)Y^+VT57@0B~Q< zw?WIW7~n;dej}co_QdNP4`YJ5pBE|6{%EO5S2Exmo!5Wkx+_Oqu{?*t2zY5#!vU2?j8}G-x!TP7CRxn$HVxqJhkd^Q^ydETP80lpWDV1 zmd_vq;(hh^f)EOgW0%6%$FIla-y@~?ZI}R+Zx@+Ab49%^SJoj8f_M^%{{oy;4%b5> z_z*9ypvY1tot4GGD1SWew+i%wcjCj>eNEQvRFSIs@t$9%#_#S3Eri8D88x8H%`QkZ zDYrQG&latz5_U2wn&w0P`}3znE{PJ#Tod1Vl(dp4wG++Hhqg(dvd(U%3XV%4?z(4f zjo9e(S@YB`gqi>;}o zyR$|EA2uj@H#ihUaw6Idc4wV0&~nwLn2`+qfG!3-pbKXaw6Uqj{y0s0r=}y)XV%C% zH;LU?$nrs$O#!x}f!haH5lc@}1pi!{9?MHde73MXo9mbORp-QR8aihjoJbxl5ZPp6qRh6uM`{JY)*biE+Wy(@{*!6g1G zOA`^LrE3p1912;KU-cz`!H%L=Yw-kA%`kp3@5XZbaZWOHpMSF5?R6^EULY?z;0hWx z-1F@rLUCpPPbY1TlgvIYoO88l2`fbw6H8N0;~EWznYvW0QOX{p$-Js1Oa$5hfh{s^ zt3=h0QZ|fl%!x%x0}A7i>J5w*FzU?SpugGO@MIGVRtt_vA-@jW&bo~nECKJ!px8t% z#6td9==AY<4(hmEuY;(uQlQ6)$^taAA_})$y|b9Zk|fQ=kuye(Z=f7C4~}#WxP*~| zAwWzYtXdWf$vN*Ff)xM4GET%JNbwL;yjiSt3AQFZba#K}4?%lAP{4AK}TJl^W&Qk zoy+W`Hp5j2(@?H}qOPoZehCDU8pLfDUvi*YE_lc5xqH;2ZL!q`Tbh;Y3}QWveW?2< z>92Se7b3F4&P{0p)6JlDyY-~)?I(Z1ycvJg=bmURG?tx=m^*=g1W#miWlae*nrtW* zo#%H)@l@JqbApm`?EqJ;I{a4j`R5$$P-Y+6XB1&-7>ZxQ&aFPr*staOZ_s8$Hgt9*(o> zCE)H$`e-3N8c5;0xav+%7CX`pD(!4-1yN8f!SfoFqdiCWWL{;OHiYsG(vUN>O$hWX z*)K#b-+jB@m4npxiI2E|5kgsPf0FPz{E9DDz_$;VFPejWMDUWBBl@7ie3ZDi)5UHu z>(x@RsFBRVg^wF0;PZ#ezD-g{{xRBNe(=DIWhgKYiEVZBKB5$M3(NK+$Uy+P5P_(F z&?fsb`Ixx@_F1Q$1C}m?wCsG(tbSyvw0+W5b7r2;+N@_ z?ujDho z&z?Eqvml>ghQOfNCo)h`1he}tWjQs34@phRnY_)+@L;b+kfoDJ{Pz9R=`K7}LHptx zp8Shj;fuic8EtchJQA)g+1i&0B7-GGAfZ~kYlArLv{ zkJu_{q9;ZeB5@hCA>gqR8|1&63Ca4?wBAOXw3nLgJ8Rd)FptQh)K9Tl{WIw1a`WpliV}ps|Mz@T}-X5wz8dbcuCk`&*~| zkzKsV<>eiWu0HzXU^J$9@Y(>>=Umw1&%HlP>+2$F0a^iUz} zK31nXXK*e7ON!S@#)jQb#O`GpnN|pjh}z{Mg4ni|6Ex62K1B3NOWwDq&sCTt!1JQo z{@zCHIyQqZ>XI6?Hmgl<$fQ#^8M70p`TUHUPqcMdYDf9<=Z6R=vLkxOlD=>WqaQ`* za|$@R(j9(x070V9=cMj;bNcM$q^{PoU$lFxy$5$O#TSD;0F>_#NqY$gq{ALp2w6s? zXCX;)r~EO#jvt{k#1I>G6%ft~#eq>At;dO8gD_6a&x;K0I(&gyb0H46q8S`J7Wa2O zTrahh7rEeQx^3M)dQWB^NlG8YHnt^NCAe?f;AWuQs-kQCU>QL`r^CN5ma(cqKtG4b zm+^G?Q>l)wRrlv|*vSE(t;Zz<>2v1{kV;vC3nS*Wq2%!0cNR-$(q z5Y>-Sj#WCEsu`$3RJhfW%_n1-(W3{6ix_i?g8nCQ@N9!hma$HCRxJu+0_Bg4vvjTq zlP=)HP!sHLWOpJg37fif%sm(4M@h_khZ3ILMd>Ck^4<1u82^7R+Ee}7NYv-|@oU(+ z80~yi6)24mrHxe9nc{}FltwLAF+h|sdKjN79iI8FI{h~~@SCDlDmK_nyn<`$bH`85 z&B7J^FZhs6LDrj@T7Kp%Xu-#)Qg&F8{Wt2&V$=F5)p>{yT)O4-ktG7a!5I_0y0?=r zJ7{zMz^Ln^nnWb&b#6!QNNaWOa+W}oOkx&Iq|GT?RrL{k>^qn-p8c=L8Ckj@C_ovX z6CmT~RK3FRwra#XmecmRO`K$XwS32_|FNDEh|0H}{yRjZpOTjC1U^huJl{9Stj~eG zFw+)l9PZszrE8tqJ1j97Yh)@J=W?$*heUZK_SR8ZVphDb z1`s4@c#8zKNx)Msq%Z8bL7>cwBdVJspAF|i0VQV-NF^l7w4M!kgTB}wAcI1zN2GGj9*f; zz?;}5x}Hb!$7!x#pFTKD1g0SBT!T%@ zk|Og1@bgAD0&>EDX9Z6o-x_GWqnDfAB#8uK)O3+*+MV{@{kVagY?F-#7q$i%GNCe2 zdO+_0Pe%la|D)TTirDfcbJK1rx(Ht9S)U*wH``4^o+*G(@ZSxB5cA{xjqgOC;u*1q zD(fLEY3H9PME%Y^f3`)WGEjlmEFDDkcXrx%gQ^Zvs4(->cqzR^y?}Zb7`-#r#h1<* zQ@)Om2EIe2A6Mj_ZMFRj=iL|9f-w-NgLg;EVD)(f0|IO>&Ow>u;v@MRikz2Cs<1zy zjL4+92ioYW_vLu+jOA{4H}Y{>?1alVED1eHmtqt45E0WDW=XR-(J0Ar=#2r6;ugH6 zFdC{So`RoxHP&^YHJt_NkC6aAH)Qxb6|=u9HNX(Re{8o2c`?9z4(0+)UqhRhpD_B5 zBKT1t!r8f&4@yAUv6SBsv41ovLu zN1R?Pe|zR!b5@{#j#c-WCFKdAm&wQW4H!o3t7a)>Kn4S3c3em3$Rp{}hefT-fXP-QpCGSozj2aK>&V~EeS>RRX~T^9GsS%NAVJqgZ=L`zvnJhM zO634ERsi|af)(Et$7K(R`gmA;86JDaiHzQR894kbh&eO>u!`RSe7FBS?)#bFbeHJm ztw?y*OzPP7?91QvquU1KQ!82A8wNYgwNT|9b1PMYnv+8F%O55|4y`KdQd6+a)4>)m zqIZ_CKtVFv0^N1ENYrRZ?%zw!Nf;`F$dw`m3xTa$afXzi<5EO~+g?F98I+Suv@ai8(|!-emv6~0Sn zK~Ze(mvSWiG~0rbh4BGZwR}@Vq*F=!7r$HoDv3doY}%`Tm{q@xzB@KQ`Nt5Z%V;fA zPAZZ|Z&s*O|Z1`+%9A!_lL{F;6|2+r*bnV{r z+eEkb9BVX!PXW0qjq$a|jd9*^?st&9v2z;2d@IwJh9_ABnOUO^`-x4KlMl7S81w13|Po4@{b zU7~0r7clk@S0VhRTBM}JKOspj8;JlX5svFb{2uD6Y$gRxG9S?xiUB?ZlvykA^YmLROL)PL4wj|qco+zfS9?y+dGj~qaV z9@v=Ls2=OlUAH>37fXF=y?;z^`<;^Xol%RO7@%t@8feK~@!tHLx~mY(T@?6p>-(DNhus#GpOgi}@BOwnfr@?f=uyvvO4cBBE=$+$>SZgn zAAQ*nwvI86HSf+Lp(j@zO2xffLmy(Yw+XSq5Y64W)8*d(`A1H)feIO%`*LNm5BKWd zk#EORi$i7mVmZ1`e8%uF^H|V;OQ_SRd+^O<6-7+(%ZkbTjgQi2N}<>L(1T2#u^mi{(|&NYac3TS8sN?+p{+Fe8M%maHMqEdam=m|MR!| z&LS&3H40m!L}cfBsbHr3zwE+AvK{*E^v^5R3dE0WN2M4hEq z0tr_ny6~px(3|-1tiE`TSZ$eo+wEZ*;q~j90uA-1?juJ3^Y<@~lBYu*wIVaixhWwW zzmo5H=ae;;VM!CwpXC&6Pf$a0RxN{B)&&|u!@|&Qq~<;%X>Jz4O_}(75-t!>j=a!m zfgv8%jIG+%f9C39XB!lnB!)X`m0wAtM;Aed>w3U7+n&}i4CarzG}ynd(IisNVr+aOh9@_;5_7KVVeaCX z1eztNqWPclY58Ej!ZZur+@Xl#vFBqw-L`jKrn?nVFIYD*juOrzK)Q?49v2sHk^x~}`0gCZ31deAH9%sjK?)+YA-!`f@WTJNV_Nv@Q)lw)JGG49Z*!UR6#V^`eD zcLV7f+`X$=T~{l#e2MZlr#hA1U7bB?5`QCU&5{NQB;54w$LhAu@7`9p1U1&*FO&)c z<4JoS&o@>U1U+rC(F*rtNG z@4Gyhn8}xY^B;{{4vf^kgJnxR1^WVPz z(er4caRVeB&F+wKA3(~WfvP0wut z!>9jRHQ6`XG`2a!o*vI?awwk8E$N?(X`UR{zqJ%8SkbgAkLMlUoW(DZi0)(p(LH9j z46kX|++<&*{OpJ2hTR=s4WN4&>}4JMqRZR6*y0~%jEE9pU?Q{i;jxM_`0OdhnFEPA zAh0bxZ`pw6ORu*F7xV>H90fccqY$M#>`odUn^kkEj2FvYF&q_&gdLbJe*L;CCG^=x z-}9QRtaIlhVBJS0okpF{$Ivf^$bi&V1KPo~;_xThTK;AUv+=l!&1!pW?DB*UKyuc;(6>%;IV!yt+Y2R>J#r zg@y(>t(#saR5e)SG_t`UP0)1Xp0F{=JvHbu>N*t&tUbC#qGNx(vdw-*iVUyo- z9wbF`Tj=QXCTsawnFy9Z6V8Mq1ITi{yMuT1*XZ}A@dpRSRjw)eocM!BYJc(zyVV8Osm<|*D|@k^ zN+M!`QMi*Gb9h79%-7CNb9D(#+g~7IwK>yD8k%`YG|v#0#Enck2vT#ydGGN}cAB$8 zE_uU4(_$HWMs^S45X(2;tNNVvyoM>INA(sa66u0}m=lk=^Q+&kzb<#cqfL7}^ACUE zQ9dNaZF!hk%v5{2Y@$Dl;KL9s7!R*K-V(pt52l%v488Z7a?Y7uI$n72Ma02Q$@JW; z0~MPd2NzvqeW^5q%2WJ4$GJY*!67$+{Vt#B-Cpj#I@ihc_?g4wNn(57x}0mmBwbJ7 zH%Unv2vu8KwqcQO(2|vCmc#7m?Tw;!2HctBYn#B5$JFm8?rlG8d1UB|O4E{WER}jP zbpr_NqvpaEFNdD2)}iryEhS$JmGiVql3yM^iFZxFFiU>OFos=3b0M9m^x4Qm_Cm>K zDH!T+yY`!zF@ba2|IQdNn_sAZ-vcDxsyq22CrfJj$OFG4Ymhi2$%n`Ce%{R7c}&)X z6%dB8YOKt5C@>u{bgr}f_VCpTB&J(x!ap-%Mu)mNuu>VID2ZOt210 zR!#rM>hA?vQjj#~H+b&=n!7zzmWG5?=w;hiF##7 zG_x0T&#*B&StUEn9H6Os)extx{X?p^!F6=5`*Lbh>_#3WPI_zqxtSkh8Zj`d?_ zX120t{o`gbz&YOOG9DJDTYzP$({a`~c+M2-DYeB>R|p1MR)?rIW_#meBGfHNJb%v{Rf^>;F-w{q}U=MqFR zzeRZe_y#+Tyts=z-~W*zR4TY7V`ByS8(iBg5A^UFdxf)+`5u2>sy5X&R{rCV?N*jt z5uvz)a$y2BwU>@T%$Lad{_wz?ryz6fp>|0^nkCD(U4kyr0>g0ljQ~9UXZYcYk7?~% zcGCrOt7uB{i0Pn!+dw^=rpBh={Eah0*KJu|Sr0bVw$8`CYc69}Eo-$> zbP7!HU#o)Kugl7WRcH0)gtZFA5K{@=?7pD!lu(1otJe;)s!W(IMufVypPV@r9k?xH zO2a0OP!X@gj!3*aA-5uaMw}XdYO~xwY3CAN0=CF~u6Q;p(ea0h!!c(KdkiVH{o~Tw zJkEij%Bfo`=g z`hLH=YnC7tZv?jPRyjB-Ca`2Oc&rLTa}u3B z%^X8Oxv>ve9QP`&TcE+VOjBo0&?zUT-ar)*+Emv~D{GH_K^Q;>MoNDGU zsW&*#_bbaJTh6PFW;=IO`&`J;O?teKXC08ZUo`6S_NEG&IQ3iTk`Y!B!C=jCoO7z= z5+MTvTFdT@IyZHW0DKv5y6tC=PIu;+)Eqs^su4!26otd&4Wp(bFrNP<#N}`6iQi)v zzy?@t?Ufy|IjJ#gxhnV?dR&$1Mn<-(pTn!mNHscq)$H$n?v&Jfe_|aHYo~T|I5MRA zOvT;0_S_4j!$PdGMW*_*D^CO?U~62PK5L)TIbGs4wSw&TWt)LRUu0nBw%_e?%FY{N zSsPq^xa)w(n6QU+&30Yd%f9@dXQSVPMV3T;yNjlF-t%K#L5yR3^HK9Gm+@Nc+FC7{ zrg8tKoc3Ir=G}(3g&;CFI%zI9BW6b$&rkNUl)4d$Bm28$n69aU@xI*aZ3Q2_rp5b! zynO?k6X$yVDAsY$HH~E?8q8+XFD{`65GWz8Di8ykIMikGvfRe~r1qcE(Rp-#7O>eP z>|9(E8rxmAyZ6&69ZPLV7G=bV3KX`;VP3@Kc77=DpZfYWwz&V>D>ky9{Wb#^nqhjV zfv=&tCQC977i!{Gabpgq$2Zb?xDQTF-p%4UZvEz!8?Mhv3GtDINkom+<#OzBts_+5Os#8PW-Wo{pl)TIQeCi z&v)_xVx-w5U@hBT86$Kc%eAW`Ch`Ex|1Vl3%5E%&JK~l(N4@K2|KqI}?Poty9X2bL z)21O6_o6FZ#__8Li=4r^5oO{RptJUPS+VUfAp#GQ3+^ zl_oXYaZJjEe!m4%OjYqm__6h;EMsXuXp#DZH9TS?rbnrd5Q~w6rf!>?e|jI5KUGoD z_|RbNpRzbUh~U{#fLXEa*XX4?b38dZvr0&k?#0nRkpK1X&mNwxjkGeDP5Dm8{KIU?WTups=5S7L$?^KE&zB5XBPN8RWmHHA3$C-O zcNpZG)7!8|fPh$7+4T6m=`J?UV>4>$8uR*eaogw)Ryn#aASjNT=yes)ZxP6N&CJj&L9|d}IzEp1NF z$!e(sGpR87!&Gk|dj@GDZ-siloZYp8@+P~^Hzxu^KT2?O;Sr%{0jGZ9!LHlOs#AP9i&CQBPTC2|R?{A??Z#0Jpq~r+>=$ji1(r;5_Ze~Fw z{4M~cm>L|@EJoND%eXrlgOHFoQsijE<0(=&&~O?U`M z(O>(XgwN*o4VAwX^CD;W-gjv~`z4K<@+sq;aM(nY72?h$m)y4mpdfBc&^cevY>1X1SX5nfc4rmOXj)PwrHS{i8sR zh&D`e8*fW2`R`@HZyd7jf|Ox;x7v%$$q)8l$4XBBQ%yuD*RX*e$jS10$L8PP4G;9) zOjO%OL;~usypr%wJkTHCE5$zZ_TDyobeMWkIO3+e5knzb;tlo}R_r*W!C6Spaxl}z zu8V~~5Z z$~r|pZz!3P{`Q~3@Do1inep;{^4QWxHmSoW(`QultMY2g?bH4t-zr#%R=W}DDAC22 zzD|u_M3~@dNF8XheuP72ow+d1V`&Rx`=|(B;}oP#_j@5>ZZ;xRz)|nN_0>6hfH1xg5)Lf&q0vxY6;&Ivi4NI(jvp5Vq7*LnVbsYx;m>=k=o&T@o_mr(1^We<6NAWOqta6EF#*#AxO(g zUY79$A%Jc`pe@HxEm&&__Cp+~Q`RCDPA}EQ^*e zXjCBY9jIr?L8wK5!1K-}d8ZI*N3P5A5aQa)Ik4yf45GETIVT775s>^}4_6nj#|2=1 zNU}hnf^ub&#M19iDq~1R4bOjDD3CWNonr+dA3(Sl z{VGo#A-H;p%7+n*u1jdMf&elg-zfe@0*7q2GryJ0i4i4ThoLtn5Et2(&0W0rB#VUj zocsPo_$*$!v5=4X6o}=N{Ek*gLZ`|?yN`4;$$TTTL2goY<}lPL<)01i*fQ|gOUaoPTQikD`v-x|L8UX z;#<+Lj8{MV$&Y!mfn>x3nk_25T3!+{cB0~YJaidY& zqJlaqQ3v|tiO7J^fEOlb>7t=B2AY>-f8cp0h6E6{jDNo&M(SIqh2CXK{|zY`);%qk zmurQgIzPP-x)RG<=j_3>JjPq#?Uc7WpKU?{R&J}Rb4N1lwe*=ReFIu^qI+V(nH~A_ z@P3v8Uj5v6KBn6GJSVrvC*QF@P>lh)n+81F)l#P z9r>K1`;xi#b70j@GvlxwID}$kqoalQIU!cT%z=DBpXA3^lo*C0MmIn8XcMr;O&8di z!nzT#R?DUwSO=es=dtao!(&eOhYd5)YDLjXO>U^#gmg6Ss^jxOYSOe8Q?q*@hCG(_ zqym0q87{OdO@VwyuDzZKSq5Nj(``E8j6+%;Cf6OpgRJo}LwcV8fb8v^qu0-2NE;t2 z^$IGGf9?C5z4$iZWz%UqXNO0oWJ)e8ijelipJ5Ielhy-2j{L{hxt$$(yhqgUA_wMl zr>_kYv2YZzoZFv5!A;!Yej-mH5GVP!FykKLb<8KX*5%5rj#x6RGQHgcdFxO($rOjv z;PxVGGbV~95zj=iuOUi!AB*m_%;P@9)9`xu!{Z}o;q^5F-EZM_`!5-buY(njtb99B zB7u13DSi!B$AhA;4Oob}h&$kQjNp3=#7rDj(03Y(NV03d%Iaah?gARxp`f znhfsKf{F0lTabyOjAl9uVhVW-)mWheLR_ zXNadjF*_w`lnMKtRnjxuo2;8su~>5I`dlICHAoBQJY+t{f;_W*(6txEV5lk2|O4KN$dfCr!EO!ni@6A zl$t5ne|(c=s2MoN^7|RNGJu}-uRY8hsRL|R)5`EmxA1u6R+4Ut1U%P%QpvRYc<^l8 zk`}X0@cuAoru=)rPxkF{=K6nmrDsYwI>rnD{~YN$V*@B~W#8&!avr}4-rr>2kO1%N zd+ACA!25#n9!&f%qwnL}(+wQe}cjy9qfRF;DMhaYdc{TuFdpJKc zstY&`?Aa9X{WXDr94T9JH$V#r93Rll+#nMO;IPRoI2Ql_LMHBn1x$STnFI(x`77f4 z{S_}PP{V)s#Ti&2+P8ZVLr~iii4NLJSm3Y&m1YA~>A#{W3wlSU3WDMAA&&JRKL;zLEov^^=2pjr^K&U~cih}f?G}<2=PDY4d)Ao*B zhLYJ22c>b>v~%{30;Cp_;|6Z-JB-`hA9fY$f6Xo)Rf&d-d4T5%MolRpj#EBYDGtfKw(4VLWffBxdCZLmqgcYXwYo`#xvO{7Q ztdn#!#15x7SG|FBMk(iZvHV+zu`X;8Sg;@WS4z(alwa{k!(tKZ+plo$$k9~2w+mZK z!q$32j@u8z)^|>7{;UN0#JgrM*e>xy)B!^U|BCloBqT{Izv?Jd#P6FXuU`;>HE3XC zJZOvo`eR?j^Ose~U`H*k#i?L*=STZzCj2jF-FZg#M5u*t=++8V75D?yK z+fDMPN%#RJZo`G=*Fl2Yt2K9@lz>!Ct7udQnhNhMVqYx?PyvKRjd)z{RtOMOi32`l z0#$E;YCfT`cV0-0sXeHFk9}W}ItlM{Uc--J+jt=!JsHVvvZ@!e##G^b#Rl!8qsIgI2 z2Mbu>UbK2Lu-F4wSm;LkPyh?I4|RKl0gHnZDx;E-zX4uHv3~@whZ@9eTo1q<`EiwZ-ZK#QVm`TD zm$Yd<0jK#lgJ_bgx@R^J$V0|6t3bSz}*ufX0a*8R8i`xyYu?4loEB7g>T zM$d7BPL+bnu(KD^4f2q;VgpoHN)p>^2Su4SjB6LSO0&b#Xb-n#O^Wcmz1%0R6h_1lN>T#?g@joio)45&ARq|6|NS#=2_UfSo3#zL8~}(I zzK-713`8Jkf$&sTb>TAk0YS+t2e1?nE(%4GK>(GF@V@8QqqtYAK(8uR+!cY35fY4c zh-otbI1l#r{JD5#VhU&m8j9go5wN&hsf;nkq&Gl-6GBp}Jaxf`+PSRtrvB?sY{BUE zSC(JFO#uKSl2-EAb)eY$mZUO@*hw#8fy4Z2tCW;MK+j~YeMbEP7(UeB&&Wq@K{flo zlx@M?fd!T|V5WIGlz_(&WHETG2qY5z(87g14xadlRp=)k$8a*C`LR$gBP#g|0dGlr zyA}2=nAZ#4p2LIy4Uht{u)2AlM!AT+;|3QDPQv4%?&$k)GaO>gxHiKGEpqL5?%M?R ziEhDI+YDyR&yFnk6e$u3Q71k111%(=S~#DF6oGh!9{q6u_Y!$LHao@GM{`0v*KH2!$6f<~QZkq9ol!=-|a1Xc$puNiH zwhMIDs)KCi1!zh5k~Sd&qC|Bt++kstCFUDaDn!^B`ML?W1NdtEOXUqA;0WNnPzEQ_ zK<;K-;uNsv;LgmC-Z&WsW`l$|sWo3|s#c&5B#K9=3Umf;SHA;ouQ}4_-F^IyT^{D4qRElHh z?k}R}&2=e6C^-;QpOqvcXX9JIL;De^f%E#(3gJh|>qjxf(l=l(Pnp*a$O!N^$4C>3UKF?lIZ=EtbO;3{i(~`32k% zhL;4Q@-!;|hi@N~gkpFABiHMIU?EU!IUQu*!V^GqPv{cRw1n?3B->ToZ zA(kkCR1a^zpZ;Tuy8tSfU%$>|10e(69$K=OegN7SjCe`H8_xBmu|QL8tH70otdYSr z&LF36{*89inoZ7TL6J6Fu(;EZUWAu!GTHdgIvXK?P|Nk;BoaJ8*Y59;#ZgAUSapu8 z(>oi4NbsV?xw3o|UXa<%_CKC;9N9v|d8TalrjO=*1>QZi48G0d2^1n+(p!5U6h~oR zaZpPLrdmGXrtEUcT5x51ZBH%7p|cD}DhUN>dPZplZTp&9MB&)T$UKe{4}eNIAF!dT zo9AILq>92pw@BW=+_hOTqS(jaD%P91UqoX((hi`Jv2I%!?g@l=8*BF574`838U-8d zrB9O63*wbceK=)6-M948?p6PIqB3CLYqSDTr~p>*=o-F5#GA1B%z^6)s6q)IgRJU7 zmOh8CIJnWb-B(1VLEDXpj&*eIroi5&dVh>??_h7^8m*%%J+;BjT3ZLv55G>K4T5e< z8Mxh38EMuBVEchCjqq7SR3{#TU~Mq>{6i3juvlH`wcl~#9@yGq-8K4cpB*P4WAsmf z;mWh1t7j#Co5L3XfNmqlEH|K_c^(0}9N)0^HZ+Q`WQ8?}7TC8ymkXWlHgvj}g07mL z?}jgEtAgCp6FD46CQd93gGwHw(vc=cY7QVH)HM`@A`bTTRLTeXaZ4f@n1;k`g1aP+ z!|ObOfpB%52qg6{ubiY42F+JdWnh60JRz3u2?4qeNJpDQBHqAXfL$ra>!a`&WE`b$ zB2rQJVT1?sPUsrjNHSvND;xwt)KKEHPNL2sj19nF>iG-;Ay1G=eC$#9)UN`(@9}Ck z`aY=gCpT1;Nk(Xdk#ZpcZW~~!c~JI(RM|9V_`#JeAa#(^gY$I)1cy5^=tGcGP)Z$t zX#uCl|AGTAlIXYzLMRAcg~h!V^*f zEO5Z{wF-zuaP(LN2oL~!i*YX-%J}(LYs=R9b59L4yaG;4!%?>>PApQL; z{2L_wrJEx^(<#ga3-HTA8=1%f3#_ud4x<@q;KwZ9{Mk)k03d9llT#2dkhWdg12^S} zfq<$CN-CfNx&|PWq1VQbgVlXv5qOw~nDiLLe*+)=79;9@5PzqUdiXZ%LQMdg7*P2M z@GAKM5JFQPoEhgQsPeo6WSQ8}tbMD1+LyI2+?NW*5Qw}=^+Le)`y%(N}!c(;^ZTr9?f@KY_KVTw8GP(es zGXKmrC_*gcoJQEsu=9P?FZqfQapH;XTSTGIAq$k16-k7xpTgFWRx$8J^|wH{w@0?2 z7HK<><$`X!Iu<7cM&A)yIN+cNVeg+wpml`#_QL){WD+Bhhr1#w0q)8`NA!f)8zB0L z&Xj$uigh2@&I@G)usO}|$t`oT9!tS(p%y8rQ(2VM><&?vyN4o>rBI(b5bAQbLJDvaEvwr(r}gbwkufN4zz?& zf9}mnqIw*;C9k?t0xmRK4(hZf%<(>aybpZDd}*Z>bwr7gTR#sM?p5-Z?Ky1jAJzg0^H+4!H1$ z>7acQK#3t~1(BEqMo*2V!ACndfElZ-Lg4e?3mNH^K7SKb0Ahtz z50gm>AVuyk+TdagV~9#hBK$Z-NJa>dl%7{Y{I!s|4}#zN)Bl)f6_Jn*X!p@%p?S;! z_J5V>lMV0<=xjiYUeu@HfoLmteOQSnEN1ScY}nk<<&QBA9}b%<#Tu%D66eF_o`HW% zVLB1Q616nD6{=*CJ0L!v&WAHIchU`beZu+o5qKR!J*6x+RWKckiT_3r2epJtD}c9H zczwPU5e^EZlxU&~|A^WRN9UG}Fu)AE7siIhfR$TJ{GUJ-O{{#&(oH1dA+TJxPTCk_ z(Lf$c59CQkj-Y-62cYPJ8v^BRZ7{4@NhB;L{!Eun^q~N0Zi{XK-!=iVIyhd)0bWKG zj80HaFkHHI0xW}8p5_TM6-|CIgO+ex6Vs*RjX}W*lcJT^lZa3aCS~Vb1Lc^4ym;K& z3O7Ulrp;b3M z2>;W54x(3YIzz>4glxfu#W9n1Sd^Zcz<+VDIQ~U59*4(4Hn#M2DtaL=q%#O3opFbd z!aX?^YF3P5$WD09Xd<9>5H=_SF3C@atTq^SmlI1R!t=lIe$nUl%V5N9r68?t{B<90 z*#b@MpPv|DChZVsz@Y2=oPn(eP*p;1~gsQcw~8#t)Z0^FG&8K5xA{OC~+v?hePCV3LQ0{6~b^w)ZH|3mQp z?V&m}*(^tW4!uj>zyP8H9zQ;X?R=J*lS=(49dKbJF z^)I0M!!jGLnREb9`?khIfspbN^#AbJIuw9)z{~lW1*Q{1C>sHl<7q!$Le!OH0KT~~ ze?5VXNYQ+gdq3(q_<EUJ9WyRyNuP+OWFfAae1OUp5wZ+8`(*Hd zCZ}xB+jf5fa^YoSktlL1fE>MG1H^NC8?Oz=_dQS@GfUY4stjSbx>diXsu9`(-=&*? zUTgdU0NXYF7cQ701Smt~#^>+F!3(BIDxr-NZkJVuonJoGh8(aBDmUM{GwyS!pk;$2 zUw5OP^f2TDio%+QfQ0uTB!Q-wCyQstuLUpZh+bzECJp*|e!2EG%1Mx)K&m6EHLIZ_ zvcoFjCmIByWu2X?OL)W~kuf|LstJQk6h<2j)qWAcOX0tG6`00dHfK({fj+(kJY(Oj z7Y%Sg@QS^tMT%9)tuA zZkljZmvS6<{Zu&v9e;cdV!OjSX^0so0e6DQh|#)xVz7fcqnffG4YL{Sxs1liTiVeX zd}9c73sc^H+XA-KaK2p+0T6Z}0CED9hMW_AX9Gq~qZ%kVJCs4={le{FZD{Eeh{<=h zL<+*%+vBywfzc6QOjS<)T>@+SZh$~5vTDl@AXg}Z0qU@}`nyV$siLs9%74)hdO*Nx z($7**=0f}{E%TBcT{{ofo)e0dwuH57XKkEe!4dE=9VcoJ!Y`FjYB{p4lh=dCY4Mt9 z=XM`VQrfCsIRw9K1zH!Tr*Am{z0}alO+hFp4}<>Rd6F&#zgz|R&Bj{Uf?~irbiQ3r zX$Hue^XU=PO@M61Ip$RgU~M+~-3%0p-~|ronW`*0LbD1C?Z!&!f*+7lhMtt*gAkk2 zh?=3Nb!cQZ392;&O^~0EmqgBsJSh$qKP&eKy=4);9f9{zdcAh16F@#Bc?RA9a}Ra7 z`6e!D3N{~ciMsV3$Z~DGpcAFVec0SjbuU;p9M~G{kw#*{38+ejGP?C;fY~eadu*VW zM17Fq%p98`S@iX>&(Y}XG4Ogt@m{o`x*jk;QY%=XjAG8{)|Y{ZGkWI>`TFnofcmx3 zPiE-rDC+*IF{s&i4EnVmGTn_3)2PjN>mlpMA@r;te#*$#&DMg|lAUTsKZIDQ3F>EV zQUL`9iV~>b<6R%OzXIQ@*tC8r8lVpWXtWn$$CgV55bE-2$X>PP)$?m9c18{Ip!66)e7N zBe*YoV_F#mbFUf1a)HIiB(;dJ_-|lpeie^cmp0^5iRlf1IH~zNbpQHs@G>)_-2hBg zEX66J=8~DM1LWWvJzsJamqLLhPtDQ=t-&!1=ICz|fvW}?mV3egGtv$EFdub021Ayi z>-n;609!Wu3c^{a1PE3S!G=WX$DqUOMFr5MNT$G5C;@OosajaMF&BNF#Aq(ke+x}) zBWdR~OQE&Alu=kN+6Z;Qdp}O1&k0~O3Cfk3u3&kl`P1q1J`cd`J>VJI2e{)$VE>Nb z`aA2;z<^O#wp|a(hSv4r{ZgnMhMAx09)JPcP^}34R;d*eu?nD!J%=qP)oWB_+7oQrU>eLp**F% z^gTiB!UQe{qH9sJ;e99e24P4;g#ix+Ob7}Soj$1Lme%De5r_9z7F*KShiZcn!9EZz z?@;65eVw-Ys#Jh);T= zK>6oBIsg!^hgn~nrUPJtE+8(s3oXSfi2Kw3%@yaG5b3^YkIdguqCAu_H7WQR|F!TNh0wCM~{ z=fGrhET-#V2~o>%r9FuLH5E|+UqwZ;#{)8My~L{^l)PZ=#bX-oqk5bH40*34*y7JaML;o!(zILSKe#Mm%%&z8L&+-ihVve7-ZcFvPG}h5*WH z0NxS1K4&wE$0*#ISgu$h7lcKf~BaK^hJ)V}?Lit?7+WuM#ztuY8H z!AZwp3}8vVKl-fT*6DEYPfvNDY>?yT&q7TDh8Ep?s^||c0vH#`*(&JYZ5%ytaIdi-_-6Y~ z52SOnaUj&7B#1uAF$G3!#Kckz2ux5?YKDP(T7^zzgX`BnYI)_4*f#!5F9@2Enrk16 z4H+pq;@us9LP`pA0DAPd?g96MP|o1S3~x-*l1tuCZ#H!45}3I_EesqB2p-RC@s6Dv zOwMpDsNwqgD|hyYw~5=Z&9^wi z3i^IV*D20JC-fm61WEYD=lG50aI?a4{6^c|KIZ`mVZ#K4bAD21esrWfCpR2%x|PklEJxTm`{k2)N1{JZ?*^EPgSQEyAdgElET6UA_zf3D^O z_a8b-NkkD$9vgjp0TtVPk%8wDAu~Y*2fI#4Rck#ub}c9>NTcVR?2z};KDpjC%jeog z&e3NuApPq{I*NZP(}f{`s!b~^$g?wZs&jd!C|4{VH`4gsa*q3ZnX}%o#@*bx`lf`g zS{cKUM$8&|0e%HY$J)#&G;V~%zWF44@BNGSYqwlm<93H-4xZT#24@9b|0<=<-v3k; zH2gAKLUVq`9xp*e@ZIKi=zHRa!pyofnw*E#ge}wNbf?wIZ)PWa3Q3<+Y)kdx4!Uu1 zbS8O){rfnmWdm(Vk73L8bqS{Et9X&5Vad>`h~Ck%bm4WDb$l0QpHy1peV?<@)R--W zqtdgNj@vO#s=4zHB=U;b#h*lpe3WCWp-W$r@D1D1hnAVN*xrFI0bFtAY-Kzx{&TNa z6PWwurSmhg(BOv?;Ljh--&s#xiaOk(L84AtIbx8%6L1wu+_We-`<#Ynp4+m ziJ9l(EO2oO+Se#Ie8mTzTyAOQvYKrDWiK)1;A)$$dPpaDHOvpfIp zRE#XMXru#zz{f_us9P_n3%S_quG2FnZ(0jwnSAI)+3iFanJD8?5I*rdrU= zp|5g@rfw3nBeUzg9gD#9VC%A5XFne@92HRTjV&59eZqPxed zG>08}^G2FdX1?kR#~YkZFPTP71*~uy&9c#^ApL)?;mH2WCTAZ)>qtzDu@r#At;>7K zH?5}Sd(hX2gl<>`a(oF;zT&Tuo>5Oc5f;C&FOCZq#V*vs=AR%B=S zPW}GLs*ODRcDhD)C4AS@Y`Ph;zg*vce8@>|m=+O}sk>PSPb4GQ|NVdeS2RfBFO8Qu z&xN~!dr;ODVR?6aSyrZ{dx}8da(qbJcs~78FJhmAfQDCWWx$5vMh?wCNLXl*f-N%h{~`6Y|RUppNJS zk4Fn`Qs(P*Zwv=s&+k;;GxAW_^mk6e0_wM4x;0Q@DQe;$d)xAD| z)^OlJ#Y+wSKiRsp%$unyFCvwfOZmI$i&XjAUekP2l$iQ+{OjZ$m$vqt+n*_+F}ZtP zo>~cxw(B)7kJa`M4c&G9!JnAd54v;D?uz*OI9}lE^S9BfF3*t~)1Pi~S9^Bp?$=?f zy#(!F-+WsIhCjTvIJRc*fe1z4GQOJ2O0?yL=KVQ2+G#G8np0-+KQwA9)XWN8KiU=j z@s1VNYjXLpbFwmWJRXNf;@wZD(2~0CXIhj#1WWMD>g-5L^gG@ZIFP)jW_sPq{uj6A zp1o#w_$E~<$EBHS*8ENxTuV0qS z@XSp1?AiU<({9jLr$~F>jk~~8)%xw_qUqh{FEaAu9!+idre@jIG9#UEzkSWj+_4@k zyR$%t`#V$dhX$TDMLnB~)g6+nLm4azHSS0hw8Rv$W!zoobN`;FXWGHnA`JfY&low4 z`-Q2aOYhrlYRo^Z48OD;SgNrD_fW&A5ys@rDL>}yKDt%qCFtIH7!a)Xc3m?pYrb38 z`X1#_xJna8MD2l&M)u+7O0#YH*DZC%6C-W&Wdo~E)azr^7x(oZ!3=)m$dwVuru9Up_I(z~56e3_I@mg&G1!dodVC67u1$?8GO4jbbGj1DY+l^dBP4E{vCg}>)9_uU zF`eD#Grqf;US-Sb8dm!_#__0I`+mFE>q^#5cV+wOo0e3qWNlo0;N%1T+dDMbwzcl< zzPn1Trn_ISKNlvbr^GNUbNrit*Pr*E>(D;QO(|(&UV)aWAVZ$e}R|e zi+Atl2GDHJit`2}`Cju3b$>lFur26yZhG&W3|O>?xmFbTJf>k^n#V!1S7c9zIl7|R zB14xb?h}f_LbAA6sszq!5Ue)8~2^2N?7zkX%nNsh9&(QO=AD-+!#DVXv1SjX&^ zk90_C%9J-Z7y!g+xq2PRW~b}}xaSflxccj~@#4ytA4y2k8ggy3?I_$??XAe;)7Tb# zJ$>_O{iq0^#mbev)4R`qpWgMY@p!~{ss$;HPQcT!3CwdJbe2(0_8@6urDt;Hc{?TL`vx*vW%Q4B*2G%J$TU3UFNvCDgdat*0( zxzdPdT%78W#7%$OZWa;_%LvY6wY^ESUN-|y3$TdNq#dQRZPyb$kAaZ;q3G^%-x(_L zI!77qfM1=I)t;@Y;n?jYgtOtEON_v!8|wm(lfp+v-&Z7OZ8lr9aN?h5lsV6x)p>Xw z?xAc_yLT`ZKH<7Lf8&9=x*Cx@gd`tM+;RNA>-}y_vn9oMoPEy|U1WjDw`e7P)W%o$ z%8UFedNNTCZ_!@u*Pn=E=r~f9+x&?2DfQYz;B4#rW#bgi-zX5TaMavONGV{TgXEYB zS6JPDw_13o(0?0zti^Wywmv35g>TT;*JkJ&$AkN+yXa1fih?!~AHm2YU5=L+>FnKs zx9zD|--j3rqb@TGqlx{-iMvGs2Ch$`u1~@z9Y>w=W~wYAPJgU^`U_KESkE5jBrCNx zFyyf_#wj$?KEEo&zB}DB>wI-qaW;-_ZhPb6TIl}#nBwG7YaCaA)6B=r@d}o8q&61n zI&ru2y-D~b;zRM>w%bOm)urTc62vzZul2OFJEi5gq%Zr%V=bMvIOko5{qPIF<_^cS zDvs!l_SzSo;78dDO{V>xbB2TDGjtVIc(|P5Ft?hRE;9H=OY-*`5W!hKI^>;tW*3cl0V zv-jZa#I!$ads7nhpgw!Q%HAb39dBmdVW-h(jG(3Q)boE;WA*bTv#eUi7B;4KZ@`3F z((dKH^6rl|>ed3b73!Z&KRA&#?_0EkJ=(glB=YA3qOPML14rJtl=BBQrcV#VE`IjB zy>6eJsqu<0;@KYG$X-XUC_MkhszOpx-(Xb2F-!Yzbo2WcwUysZ$e5S5R$6>%}nUCEb{H7RE z{%uE*b%j;fv0Y{Lv%x`Cqh@&dy>0hggbw~#I zQ0)zuJ^w%keO)ZC>2c~iqKh0-*Ef8MNkEi&ed*3}oSYu=XdGJFT{LKS58Y=M9}X~n zy{W?p=OlPG)x#98x{es&@6<)lODubpn%{bH@O)f;N1+AZt-= z(=zjFc_uLI&Wfz-_U6d=*??S6MjrYS8PDI;Fj@F|8C@Iano+eXEQz3XwUO_zRiXYe6|xGehyLsTx| zRW|4IQs8ri`zviY_uBlOCn+2Phvt#aRBWfVMgX4p@_ zb3upIKCKN6&Y5+_ufM|HXd;97i=1+7I&S!tZuRkbj1QZPTb6AVFvsgTO1BX%wtua# z-`HKp;XR@5=T{q+n)&tI7;MsnT7%bvv8Exq<{m6N2?>_(`y2CD6;6zJe5QMEAIWzp z6t`%N*N^?RS@T|4N)dy=xz@L;XwJUmNE%{nkrsW4(Qt$+Z_Yih(%%em?l^jJW-^B^ zP>-Bx6O-2U-e%%!lk~!-)%Y@>Eca2IOyYt}w0vve7+R6H%oGR{Rrb;t=x%1YS-sjT+#UD2BdRm1f{B; zk<&+vZ5fpL{c=js`kiU~FU6-%w0Qx)&M_z?C%WL|bz6f~9(!NEfqG&(nI@=f=DPox z+(W@!H;6t1+^~(GEqt~Zf57FdsO7qXXf>mEYwfdthKi_8%Wg;_U2-lnudMZGkx!zJ z8Xcb}g`7L;-sV-1(}x^J`P6B-C=erI%8_`x#qr+Q z_hCFx{-B0Wo6$kTRVYKF`-n8#_2m0$*^uZ-i%F(Iy}@=1kHr?eN3pf)J`r|XJYYA6 ziThjVgCL@b5LOP%wEr3Vxtd9Ym9LY=Zf?KR3v6<7ri z!dCI~UrUXt?+%-JD{bAdeYb45D{FJ>1oWYz&cnyz(==6pXpNPP>JNbMD~?+dOriB{ zdi`eAmdo#iLbG<(RNsq2o)$|DHHQrx4^*y!)5hNA@EaoBHR|0+2H&3IqUb_FK`Gck*)#TC-bOY?La}z~}oj8BoL=kgn zIcEeTEDV9WlQD1I49{kKJhoc9mz@8MGmiDXlL0Zd=b3;@^u=+pNP4;Dv%%oacm#~6 zeE$1|PPjsfq*rJ6Q5Mcy)P(u%E1R0?gAZA4)!m)l<+r*8!8J=-ZsZH|X$}3)t5WpM zG_q=GL<;3q>Sj<~3*q4tyNl}`wzV~)VG9ojZZ^?i^H+Ec)aE67c3xeTtlt7}_~DQu zeA+21_5~@^W+X5`HEoUNMl?_>!DO=SSy*zR?B$?9Mg$TjWVl8FtAi^f7IxMg#s>RW zgxgks=~Q=}C|bVwp>0CM$t~U+g-LaR$*^~Q;5>`dm}DMwvnciIP7JV8?WCjp%Oiv% z(wi7i!(ja{9zeyv{!SLi5;zf^7jtRg^+-kbU87r?QPs$`J%JF$*@34$8|k!*()3&e zl9)1m7iE|HabvPMPuKHn2QyEA$vX=nlDa6rGcJ@^U;Z~Hk~fqGt$9ZL?kj>b<`I?L zsdUm??YZ@=ov*fAHHW&kuW7(s3%_q^SoMk7L#dQVbk_$cn@B<|BgmAr+2RNoH)7S= zxZ8zR)KI45>Xqv^#(Xk+UvFzV<8oO8BY@y=KGHEAAl`Ci-dGr6G%pg#4Quovv)qg= zQN#0Pl&ayCL$7R}MnwXkrypj1e@n)8;f?;$Ydl^@hy8^J6io;fTz~5;yTy9bV9>@e zIZRn?bg~G{Z@BMXrVvkm{&#?&MTLEVQ{Rbs8#_1dV3isq&J5cN^9ms8Izq#p(^JVs zH_eMKHp|?!W9_^>8gPVLf6&>P`RP)F&E-32EcOr{1noCHVKC-ei%!okG@bC7YH%t) z7pn_h+zl|7_=@A0YXC7NdJ2}hcbQbpEz~8{xK=7w+>3&Hy%lFrH>Y$bK-_>+ z7T_og1o7a7i1e}^Mkr#R$TziD=iw5^GA}m2!Xr+#QSx`dtq6r;0XXuuD!_7xMbn$^ zRegk0|Gh*8fkXY=4r4iFL&enzTzy1I&=~1=jtP|QehH)4)UpQ+1=U?+!m{b zzl*I2MiTU3nWybtm<(;@^(BxFd_~ZIXTy2D9e6ft>74u&qh#?H8#s1!(SmhTB)8y7 zu}Un^L36+uFLtjz_G=itCmtux>L7ErS!UUeRT(-rR+O&ETbi15qL>=sXo5vWEdR>% z0GHh9_3viAl+BXoeRq{}iUeyLAgPQ$&|K$9xKy#v_%t20C51VvA@GPrJopJG_nHx@l_mb?D_&}C$P!36{mP8!)B+0 zb1>%^VPH`c8u7(iT|M{YmCqs#k?h*kB2fH8{A-j)_RCiaK)6o>NY}pSUY3Tp{TTP( z_;@aXb(r|XS5}YL3zaLH={9HXoCYiJi7Sn?wwmHkmGfHm359u=I4=Mn)-S4>Q*C0S z2muEnH^yT41Z3`ZP?Jhn>NBD(*;s=@&x5a-T|!8TStMqgQqnur*|Br3xyu%TLh53< zU^nmU7(7NKyOzDGsoj2P{dqxmP7%VnJS%XPWi@zojs%8S7XS?N4VSHPJon&se@>lk zWqBw)I|uBXMcoXgN_GB7PNEqK0|h>Yvys{;H9R{YqiE5_M$Mk94--a8NWv$_)^Aj& zkfn1*1D!|qkv%w*YVc?d`GPFkEM1l^_PU}X)XG<0XYQcyX<`_f#)d#)EI$IX)cAZ& zVh-L|xu*|gX?InF9l%Oes9UM%6)lnl*~u;~fIj6t!$?ioJ96&mbjY3q_S2|%(@y+k zF>ea~Hw&OU!=w^sbh^*F6no)^NFsyz0}md1yL}{94L`bGLFct~9SXz%w2@!FHZn7I zg_VBn6)bl{q`Dq<#MzqF)b+Lwaey2n@;snG>Mgqz{XmUyc$pgl1Cj>T^wIvDSnL@1 zd6AE=jhQbz%vqvJ2s6nA=@xkHG^^aWQ{h_7Q|q8Z2atV`14cx(IjIlgR61Cp-8LO8 zFdU+AqpZ`7e|502Yo0!cG~}v}glr!_e0=6yD*MKidp@;0B6Z?qYr{x|%AKYP6V823 zpcFR&0nuvettx5tPfP^94g0Q4n_V3_^%IHl@*GJ~CRW2=jTt%x13Lo2*l(Aed`%T7 zXvVa==$^oG4my`9eAWi}+yy&`A>K5O&=Vu|7D^{T{m&4dNL-H;c`jX* zgt3y#q8JE<;75V=xx&cHobE7P;Z;hV+(HPweOPx{Db4OV5TG*x7^IRnB1hI8md?;= zvHd9ha9~6N`aNOsvf;?_mkD}=K&5ifnH@9fFijLDF8{G#N`WIY)Y`w|5~`zXbziEV zFxikshJwq@W(cdEJl?TZ7092Irkv({BxNhE$4_VnTmJ`tK!i3mm-gte2KyU+8 zUNI?1Xe(m!7l_>$I84u^Fyw6foREGmC3WCqq#NLuWM&uyMwMZdI;yXotu~egV#|c; zt0Ocy^q%WE6F0)DatjNMs~;?Rfkb2G)KqW@Eb1tpmf%Y^fT}bfpyrAnDa!nsE*KPD z@En6uV~o0NNMZ?sW<(Fnz1!`Lk-|J)euuvODi{X8vua;P)JC8HKRF6sB2~4!m?)Yx zwdqSowZY*&7AE^vVkLdo>P-_szn&a!O1JiqxU)xK^5;VFqK}ZTr>_t<8;ps!(xu7q z3ov;Yv?BqDktfy_bp`X@W;NsLV57YL!`j;GIp#O{2}CM6gF!a;*!=h)v{|^A$OJ{- z_xx&^y!%rUj>PE#|Iz8xX;@gJxux#O#sckmY&Uz5rbyi6V<3o>IFJUM=UQp^W_qW& z%f{20YG)*qg&p=9YlLrCKKTn20 z@FC!2Zab=#j&psO?|i$v=#XSE(#Z(N937rD`n5hBBc%vNhsqJcAahnf>-Z3x>Pn}V zyO9uKa(nzdN?oh0n*6Q1h!=~O46%p~#me4b$deRP*G7S%QU zL|_T^;DyY)^0OpFSgTRp`#09u2mvJJN`yuN8#}h z>M+{_b{Vj<=QPl_Hl^9rq%eO@s5t}*Z@n5fe;RZekpnu__CGI+Mtk7drI+iD zPGV0(YaImpHx2CHmozo@cEpQxYEme~SMfn9yAfb8ApR?0u`kJPt*F&AiFglBXz#DW zciwb7vvLIEg96cD^k`!{)-3G651T?M#j&#G2fIed(g&?_1lHRC%V}f(g@FcH=^X(5 zWY$x>rX_X#G#Dia7|@6v%&n*g#AV)3Z=~wFA)%>O9Toz4)UYVjx99I98R8dWCQn8; z#6fO$$}qy%twDDk2j3+lFuw@SzAUqW^mI72=;X8MC*jV$t1ju|-FpbY z-M$KxCRn@d19foAcqsOns90n4neOyh|^9#sUZdLk!cP5oPI( zGVc&&+Ox$%MEBndECM3}L(tNq5oZu7Q};nM)Z!HCD*#awNC(RYd^Die++(p;yIKHy zpwKhuY)lvkP80N8cOg8lNr6>ShIo=nQ6DyYOtK(83=%nbsWa1S5Tb?F52#XC0beD6 zhAuq*)_Ov6I3C7lqL6-!4hyi}EImb^L$EV>dFkw>olWI-gmIxQ0YmFcV9MGqIKg^( zjs7b>x_x&OjwfHW010zGP3Ahn?0*+=O`Ire+CF7R2=369N#I9SoW-?Qhr5Y7EU$x$ zEI7`y5UMUSq7j$3Z!UWVE|?!r=JLBY6;2aKi^YJ&+OT<+!rLbKXCeN<0$=9(OD&>7 z!^c$l4A>u(7JqnAA#bHLeS#Rh4fj92Kb9Fn_#xQl0o!Go)9^Mj@b1J55%ny1B%Sel`%z+>oBG=%kkzRc2ibXM zP#IwX=;Ys2d$Y40--{>FfZ4z?^1KEF>6iyrAj9WC&aq}7J^N6R2Z@5(d+yuH zRA~qu6A4hkkDAF!A$)I@8cKeoUDqK*B2BQV>pZ|?OvL+0pE|W9a~ZNpKlP1=xJH3c z17xIm?EBG5!A8eMEn=;n7kda!N&Vo%(RCAaiQ$#Q6pRy_GA=nc zKy%04^*W2t&EJ*~)2YkU&7T*(lldRZ9!?cV)Silmj zMXsLx_Q?C^v7TahR=*dra16v0HAS$#5iWpZ<>L^zt+VsKkE;^I#7}jgXHfN?^^fI8 z*8y%Xy{H-Zkvu%kMhg*U2ujxLY{e$UkA=ZjLAMDLNbiv>m%ZeiCI7N_30&P#a^KgA{Cb)68PMj zNo@e!k7$%Fb za{o^Hz-1~Z-RI|HNzwBWvwwaKZpQGWmip-RiFjM|zA}hgy$Y7ht`rq^ckmxa3V&&Y zTHE`3dy2ljP-?-IyD7dblLPSyDk8@)m;nN3#8RskMn~Un{Q!G-Tw~@P4WPwiqldEL z2L2|CZm6nB%&yi^zO={W1XiUO=f}48;cjpd6#+#k@GcOWyAo4{QJTLt^Jm+}?w+ln zfbv$q!_xJ88<6eiE!hd;1Hl17(6!rFuS)V6_YX)wN~B>I1}n}#+59t>GGNxrXvyvz z$}jqK9y#T|^d-g;CdhTVRt$oVV`I>j0qDv=j=ex^k45(E4jDAA9$2P5xW^k|{||hD zpxB)4+wz{N3M|{KC3CdpIrGn%clZy1o z-tH%T_CJ4%l`tk4q7itw#^8Shq05AkS8(Ao!Y4i%W^`52||(M zUmO$14-3nqF|gEQ*zkUa`eWG#5fSijuIJC~+itY`Xx82O?x-9H$5u`MzG?qr zwSnB9^^^Ob;iKRZ-qd>Rv*z>}L6$I#io4pB%C0u44(Z6T2B0Su!FdLXxhtZ4gWKji z55`0&8BS0^`+`aM_zTX@ul{54)ipF2KT&^907cb}NoZ2v^2J6>Dt)o^9|rgX1@_NW zsHnD``JCx-Vpv|(fe)gvkT}dP5#k`F$ZH4bM8GG4p5t?HblyiJ6R{x<{RR*?`yyY6 z-S}kTA1WhnfBTHJGO4B=Cd6i)EG+hY9)vq- zN=U#bWAu01znS39)ps_UL-l>~nvLkka5&XXyssH7A?4%JHjE)vu!+Zwi*9Q?X&+-N;FyEM|M(S6-O$o_3g&fuOT!s z8k;`yk;my8(vW-}(OM@BTxKKc8&&M0$>Q_iJgs4`G2m2C|(`&}<9m z`OK#GC!z#`jJYe1)lM-Yq#6Aw4jkybff*{@YE~qdS*U>79Y?KLOgz{e3v0CVT5oBU zeS8lWL+=ko$dOcht28dqLoQ2Q|DKd3ML;Xij{G(+qIqr!KaH=g?UJ2iQij$XsBV*W z_{=WP-rW~aSUpDGj=mYpG!)X|90~3% z604p3+Xt5w42&lTw z8Sw^Hl%1Nt`pjGJG&N*Saz1Mfw)@MbFDcFU52OUr3{HfN)i~ppHGc8c7h0&VWF{q6 zh{9X3=0p+2AES7M_$?L8c&y~+6ft{1e<4RFI5@iOHeq@?T8O-=M>GBVi9Zd`5%W{R z!Wr@%a3T06Q!8@FJXrqgr@9!9I_CV>fBZf2%vnn#r0{URqeb=4cFo3F8e3>hhJI4w z?km?YM~WA=LAfBw2V71XRs_hb&~>+l6osU4F-VE;u~4#G_`zf~oFx=Vcn60eZqXN^ z5u@{06n&)zG*s^tlR$-!iPaXQc>x(`fz;KUaW&}03_yvv~`~ zqn*S0M+$zymqVZpN08vZ@9U*pS1t&7qGMFE0+g9IH#3}a2q{cJ7URHFP7LeeVY}@;27ye_=!!|)1NJ04P4GW__38U$NjuMVU`Oc79FdJv=; zNJ5Zk3|F9(IzIU-Sl}^eB!|teCnAWZZA2sOy z*_&6=K}}@m9cWEL1G#q6lfd;|`es1fP;Un!?4Z|QP@7XQ<2(V5UtHKBDd?Yt;ZW2O zzPQ5=T4Mq)Si9kxnjot-0awEdy^w`XVu?8?gT;tD3EIL>CcMibk%z#tP|IN`Pk?q% zAO)%Lt|prry#5NET>TZ4IlopaAT;LkO3@G!?sLJU{R3o6&koN zx|k53SO!8-bw^jx&`#ND#7@wyOMqx#dm#6bP0&N=O@JR2O~t>P}!6M2<}3UXKIiLP^NemD!ZqMw4n~PXXEjKGA=lRdG6dwOn$SWIpY4t&qbBK|wG(hZ0T@VW zDQBz(AxTTjF9cz|&mX@>8Iud|R){XRlEX3C4+XY(5M|IULNY{H1KSe7rgTjx=}Bwm zcOv+sw!16Q(fxcv6_1XyGF_$^?xQKL=bhiioTgInmAkQTm-WC>!ravG!y442Uc2v5 zG-|TpxjJA&3Y>)d$R++@hB-h3_GL!OSe3Bc(1qN)=3_jK)qA~QKrurhz?UNw4RlMC z2l0hM!ws;s28s%}D1Qx7s!u{iKoa_=vDg?ej223A7@E^Z4kNdw2WC44kixq>k|z;Z z#33n+bXpf+f98BWF6G>j%`5^N)CAs8*B~trp??tsT}XP3k&!}fM$=|W$R~q|!vH;T zASJk^ra?7`N$6#l?O$+7q_s>9Ow9mYx zInj3?R^6edq0?fol-*JVWnR5H>zF7epqf z=`7d7Ux-FOB!$w16?BoDXqFo)V5;pW0Fy4ZQg(vC51Lg?Yi-jVPKGrd`aET2(sr43_JTi5<__Ng)FYd7n`5W;xere!Ny7Dq!xhavTN%^G_0Q zQ&3%;=xQ*5V+r8b-!@nQd$64iABsFX&X>|)QvE>r*0LSAfZB58N!idTIZWb%B@p`5 z67)eg^OigubN+FQ1sCb@DhL?jArMy*u~I*3ICh!qB$zY8VlC}}#tDG-CbXH(M4)}h zJFj$7Si7Gg5Dq*jKQzg-SA}DS6~0;fkiulrzJmyo1(+_ejFvBCa18h3Vt*baY}3pT z*oSunIINj|Kpln^i>~jJ!UV8}U`~P#s5wu>ZD$w^9o67%lZ}Lhc&`Eb!~*aUD{mQQ zfnx>~%B}|dWy?qa9BLihG${0X5g7Pt3zP(N7pg zPDfA!GWfpO*fA&A1>B?vCz|Au8Y9gbZ#{06?);-f8tCGc9RI3o$hGt@qJ%m67TJ-R zkvtCscv)vQ*F-k2P4iAL?fVA)0rJ{b1Wom z9yFK^vMl3BWCk#QvWHeocc_t&_CnT2J2^}%NyLvigXzk7`LbP8rRr^W85O1TlI@DAX@9}_K zx8-{0Vl&CA7z|x$B)APS-_GCXU0VS%x}uh(VsQ{K1sS>CAYG>Ly!?kcz{Zhl+$(?- zN@D$yhX9$z$B7+TzzfNqCAwpDi4=;ZRANbxM=CX(>u&rAhB|jAqhXZ?hW70>jaEW7 ze--XkZUfX6;6S$}DndoRSUZPP;OeLDG>F*J?7k{_fb$p%?0)A;b0n=iJOJF7?A5r{mBV}$B7P! z(FU1`H+`9QBLEqDjk!CIn+#dWVPhKP(&d10qXuSC0yKC1($sMiK>ysA!9N1XXwOPBEDude zTgHIQWZqQj1x|o@2txS+m??+AOnH$ofPM3v&SL`Roo4{}F9I5VkpTSZo0(ls06bwP@je(-UPyT3AfWtx z5zkZQ0Q~ni(Q)A381y_%DqagD(9)cBzQbVL0pnywC(+PtCq0*O9yv_M1jOl)(jt3X z>shG+*!9+~)fFL3?Cs$D({RvjK=sw72L8B`^|M;ek3+K6{n!5(91H2}3NI8I!rhE^ z8CI0TXpqQcI9xhr>j0qRTXq%}hQ|;mn&Rt0%qLt*-Gxr8a8k&NZS(c!D^x@&Y_+Ib z4bKiQ@wpGSK;$x?XBmD9Qqy!b2TN_Zl$7GEY!w>FlM$x?Sd^INke{xGw=XW%eFk>+ z@t%@OIAscmHOf!z1I)|K==m8>7`)z-#@yN*G~eZ<>buH)gfX>y%?W7o_(W8}4oKDQ zRJ5+gs^N`Jne7dLy?tFOPc~lxdAaRwy$da=B#sJT zP>hiwrUxoOZ?*po}7FxtFGY2y<2(dF<{_Tk1r3Em6OW*dO94yUo&Ux^B+ zY6>4v1WNN{Jf1~|A50F#a$n^h zOn{hd?{rC!14_A5l10^-&0MwZ;R0Yg4ZC%ogOR&aoQSGppTY3;@Pg90%I^E*ptOYw z9u-i6?@RUvoY`xNICbV6K;Z-sK4y>m?clU!w8@OJBQ0U3`gsSAqfqSqog08DW5t=) z7l2$(f4aLK-t@|Nof88!H(lv%V*)U{PhZ+qTvVOkr33tM{5J0t1jcIf;MGC8Q)Ztp zp!&Kr{6;D7d38ir#?0NAZH@P^}JC4>NH#X=8lzyd{kz@3L_7j{WDZrLJ+fuxl2HTi=B zAc4R&+*;qB`(gl6fnd9peB?#c8Yf7EhXLss4SA0Y5&)$p(d#H1V9j#E8*mmA!I{Ww zfLc#<;!0?8xF&<4nT2+R`I&{c9b>1tk47oQ*~_m1!na_$UigxFf~3o4RGw2<>y1w8 zWr3)pv{N7D&>DcQuZR1BF`-ySIN5MbK;^JV=3OU;kgwsFfknSao7YKpyc$P*PX zpcs$Oybib$8~G;b6}{)Ay363Vokxn}<|}#e-`v+RO~7-?eEuy2jvvQf4rQ=!e_P*a zQMXpbtm}T{_CYv$Nao_MwY$x{p$c&&QaF=Hv9y$TEsvwX@2K3`d@m;LKCdqO?*f;2 z(fQoc3L%+|6*adP9q5Q#U}(=s!n3S(C&LX2{Z>1y!w-!!hhv@|rHlnn1-8seTgy0q zVwP?D@uZs%(Zd_@)IxYZ1Ke|Rnc>Q=kB8|_bM3u}T)pSPjV42NS=IUL)x06|y{F85 zd$_hLVi`_HfRh6;wT+46SxT0T?-I>-f7jkiBvELM((PM%q%QsT%7dofPL6UVGa0M3 zNx5W@2nMGgAFr!J3u{{rSDbo1t>GjlD?57FL^nA6;hOEtmMdkz^t`O>yo-wY_aPNy z@Xm&S#)-hvEz1|l!$W6%<>PhVjhW*_QaX5v(~`(-0|$il#{>b}Xo4OoJz2CRkJ<(s7NEwbirY_g+c zwIS<<=K6KH-j@zJ2ViMLm3Qc=ZjK?Jp{0qlW2Y9tOxzJb=E%VADOMVuUlHBrL$>N_ zx=mN$Y)> z$HOCTmoB}Zxly}Nt3bkt?~<8J>|Byy&i2vxe&sk_$*t^zgV6lnLToeRmke1xs&2Lq zjhJ(NCnv0`%h`Tj|6{916ah}VxBT!WaK?jee8yG%VrJxs{i%J%kcKocQ-19?+yN~`oA^!TlN2J@E_Ix+2DUv|GmL~ss8r{|Fs%4`1*%7|4TJ! za4Zb}Yc&K>|2#UH`$N=Y%Knf4;Kup{mi&MCxE$L7*nhDD2K6fg(KO^iU%ux`0f6zx z$j{FZz7BmMgFj>W$NzY_`oBFNmH&s>Ee!mn( zmitHbM-?I|F0zoWe|MQ3(0zqMaj>s`} z&bdo?`nMx;Si%Wz5gd_|OBLct5^_BC>?r>=A4emkW+k;UtC zKj^zz;=7UV(rFw~;CmwaM;Lm<^jS!y<-+o+rbw_?V8pE~;eLv}WQ~t^QBSP$Ck;gT zhW4T_E=`8>;;1;=moMgWPPm^m1DRT_FrUB+);W&kga#bdMY;-#^k-jqP&JxC!rOfXH^fEUXAIseDU2QE@J9 zXCF7!NV0awxm=W_!fX;PEYaJh;m7z;>pQu%yX%>-BtuE{JGRz6NZS*{J8G?8Pq$A* zk*OM*N2R?s`#p5EyqrAKJzmEyPQ=+~?safoxRu2}nT3nDVs(D7NqoD{8Qzht`PsVDv#&gc zYO}oSrsdo(j_mO#4K|!C@U`Yex0YY(aZ0_0Do5+jbGVxJK5kTMo5`}Xy%o!}(-fn$ zLy_Oj7!}S-r^JUi$_Vc2bAJ19@&SL(Tu(@rR+&mlFGn+9ACC!zyuD|x+pk1pueq0( zrsyG-@xhAaj}h>@;)k}T>Xc5)Oyg(EHNN>O1gFGi*)3Yg+)+LAIBR>0c*bR!;SECSFAIuH!*F2dQ|`3;cXx8g10Om>!wIfQWMygLl40vCat{ zJlYzMbrP0>cNJ&LygFrgwR9^$ASl5gOI>@cPn~k#D9__t`t%Rw5H|;$SD~!V;M(pN z+u%2~FQ@sF{M>$;#12=C>rLbBT^MT?x(v`?HyI%b*_4POlb?o5qNiQu(9ys1TxHDy z)+{gTZiiQyIX-CF=oI_if2#Ir!Sl+bh@>}+qMbGK87wQSud9EGciK7^!~KY{kM~+! z#g^3;nl3ZJF3W;_O{>~ z{CIJ%cUV1}Zgs)V?6+-_893*JMWRaM+wHzXT%VhSd~df{!fo3)qW2zK@2<=e$sQz@ zdM%5%zBtm&<7+0*Kd{LwmB{%1TEFp~P-o3FyY=IbyzfGwwFk1L&%=Jr*7SXI8ow;U zU_jkH)V<#mRUNR>fAiB@^~KJ&kv|@tJa|`(UeMqo`T6#fd~R)3wS`&Hq>G1ImDSk? zFsACgLuI2&rOzI6NJdNgshs<2AfM2-SCCZOBoMW6^v+6dIHx+!{kBX;pPVJKplZJ&4g-v?7WqXEkKwAa z_`>l-myYdwa*H8)aSm|{#&)&kLt8yYQL`p%pTK5hUUyfX3dU}GY{ro5Ao04N~CF%n?nMnfA zO%qFt7h-RUr1$zh-AcNly(X*ajylk|Im|bqv>{NZT()d#P;wtBX=nER$BlR6C(g)5X4mY8WIWj3=|}fjMPl{%bO)31>@w_b zzkY-%=$=hZds%x#Wb|89W9X!MmA}v8=yfmnGCep{-SX%3sjAmE{2Tb@ZVocTs)UYy zl_pdKRB#SeXq?+^>Uf)0mWZ%1x11gLK)&kSd-sCLI1(a0idVbA%F8@K6qa!zko4)e z{H4Td7K*AdT4f=4-`Q|wtIz7@<9ay!88qeoe93qS>cD$hE%T#zyo25MU-KuuF(qP0 z#F-0U_gWD-ss&>GpWeqwZ=04lJNSs3GD0#xnu;dOtr7YQrF~amG{|TEU%iihYx#L^ z_Or7mn?9M%gVyY1xev~}=fpCj;l}Q55xOe;;~sX?H-)5J)uA1!qexvp^BvMe859<| z0}b7!cfGPUCy+RB@a68WmtRfA*Cd^TIV^Bd=Zxq?gC5skXgPHuJ=etYmR6l$`e2Wr z?c&F;0jsgrVZ_+NY!s^j*t8bTUVZ>b5fdW1+LK8+;lLZx@V?Dt;WBc#oU;(J#M z_5F{GgX*peY0J9gkEl0L4+~cnp9u%z?R3~WUeLE&QT6CI&^XxaBn&7CiAsBH_gyl0 z8fRYOM;|8un{4vze$M9AQ^@H%I_dNtfrj_fZU`LB>uN}Lj~?zsnJf($9&$ovKO}!s z$VxS~3H}z2ZJ5F)*C+%WdPu&a&M}6;=zLM?=@pS_hfuWiQz0G^yD0SJa+|O~$!LT#%}$W9w$JdxZQs*m7CcXa2Ri zZLHoRb4+RM!i^fSw&+Gt+Yga^REP(~5$-hyH$^!+J$K&(OB+a+io#Q$%98o}-{7D{ zvYo|7)@z@v;#bRSd9t79)c6uwGx2WuDc;YdFzyNXXEV^LGUnZ#WnFi>Kfe{;RbKtn zqT9Y7z5X>Ex`xS@DZG&JOVt}*mf5iX3?4!70H#(SCw2?;j~3=Bu3^&swWs+?EsQBC#|uQes_-RAC9f2>h-i^2;7(LEYoBJ!bH($oyFZh7e{9^M)Ty_^rE*JJu*5r!_G zrKwj!Q!7TuYKX6VKhxwmr00zg-Z5NVIZ7A%qQ++nW4)S+guOsK!~6=+kK^R|#=osM z^^yyFEo)H)QFkQG5W{kTw(AW~c8_jw+yB$vw}(U3z5TDf4YM6$W>Ahb&ZkNa5gv>~ zNJ!C{6iHGDDJk|a7?Lxc6bWgF(MgIi>glK)N>mOF^+>4Rx#s??wb#1Wec$WeGxq-MwHNQ*h3lYQszj~yt)W&sN-Y$o14q8em4Z1>DbukD zTRv~$FgoUZ-D71~y8l?wdJd&45nqc^kjm1A2hKr4-jbXD^yVDH=E(!EuDrO!D)YEo zyIA53Qo=`{3y-W^V?39MyR>~@X=)blsGPBAEjD7umqy&AUY;HDPz-!%xaV|}@M1@o zgcBhC&7e;@2iyuX$F^z;#FodJNjdoXRc&X&ceUwSg=~0)bus@Py7#ejB+|0Dzo9<* z%Cker0sk-&_uq?@PK!6$@!g?u=E0k;?MpD0*G*G^w3azBfdvz5VF~k_8 zhT=_6cBp%KMaF#UI)^f9CeEx-4u8FBvFgGf_CQ@AIn?Z0syFnuE7}{Bs*Q~ntrTnF z(crnBcfQ}g|!JkOE;eCDzfl-ngxVoO{Qw#wzp7K0owO%IHc6_ zpu!Se5b*LqVtiQJ3Z*ki}pS4z=9~@G*-GUow>P7L>=Xlb1@wMPM~q_)uJ1Q+lGdwGo}a6+hWGou~mec3&Go zmBbp}p9$W8B4Of!2lmy%$L$)o?>+Isj}N9Jz=4tbq8 z%*-7+E|*jLL9zolHRTRxRW45hK(49l(^mg(c49s?eL7=Fs!dNwUg#KvEhE&LOR6~ zYIgP2{_)P2PQhJ|bFCYo;=n176NjTz@l+~9(doHd9Be~7ywimS(t&Gx^Lt$?j>(O< zTauQztDtfYiTgS<0QLT;m(s6qic9T3wE7+Oqf>lgr)*x?4}3!D>Wdqy8kJlU+Mxre z3hx6PPTm|2-fEv7-19Y+R-!lMn>jauk1?;?Zq&7+>&V#3$(_Tqf1xXl)F_{`8LwLW z8V5BnhFf&B>E&h2=V>^tFN#XHRxQlY({uuNzR6S_MVK4XaJie;LsFc;livA>aZa*! z#hOfoG`>f&kuHFjI0h@klo@nwlD{_E^g2{k4(}Wft`b{tx3s9kjiS4PzF2+h$rpR1 z2JWkYK81zeK`Zp11Jp>JB0`-E@A+97F$5|i^Np|lU6I-04YyjOKT)UOX}NuLffCYg zs3nySk}n99No+>ca>iT<#=#dCM%SGBcJ8emyiVlaNi(bV4)^ zXKGOtG$}^ZVT<7Sp~nN&s#LJaL6$j^Yz`GMwz3%Bj(GWxZtJVtS43YAj6vJswT*-F zREqiFpTlyF{Jg;j*>nGyj|yKZw+){aVScSwcR&DW3he;!H;($#f!@G zKK?nBwTfP)&d5E~_Vd%vQzrEnA6StDbKaFR=Y09PF;shDBEa6rV&|~-9(?`Vx{~`C zW8v}a61P>Et?XBH_^cnvUK?Go=f#9m^PMyl8n`*mYfO^FC{|#$vvIjSgJ)tN zb?njA2ftd*bJsL1wKR!?O66!66WczVRz#MtHjKvj^}{7}tpzm+J&?u%C_$b~IE#_1u^$FPsu2($j>bLWY+5yB#@QqnW&2q+y&o#gI zHKV+(+x!PhTt`QB5KU$9|gKHwhx^5#>~)9#M* zX$9OP&!D4$*a14)m&*L&9>`gEW5rzG&D#Qhz5nL1x_nGqHOzGV{j|q3tyFS9P)$zW zNNSe(=US0*RMF@M;!1GS#Z-Wab~*N5LEby2Ople^>eVw-%Zp!!DqyLXi=?^oB}in+pjKyPTedZ=q(&x;$w*}V-O z1*)e-b=U2UcvhVs70NVJbV3nIxC?#s11=}yC7e!j$c?$fJjrn|PVv)SzyD4ld_oVZdnw4f|pN$^=bEopoCJI~}OS-EiJ*r$Y z74&IS1aD;3(6|%09@z9=Dc6l1#PXD^GL!qx0Hks81ByR=a`&VBE;ZB*5hv}Y3N0sJ z=!J>mAvm@~RFhJXhA(Jtla4V2K9Y{O9-WD6p>d+NRa_p&xoBq$tU_yH&>k*O{v(@NY1)dwQffpkULwpm9 z#@_3J4~oR_NriZ8bKB0Z@?b)m7~bBM@l6m^bx;z-&N!f^K}i+_l}^F3IAM;O8l^xG zR5(BZ6LLg*QyogVASiEu3MS^xl(i_=1VQNoG%%qsQ`Vr|6$G&cWWj{eOj(W6B?vk+ zAO|K?h%%~884?6V!8<<_^JmKHlnFu5?t!@=6d~;U?nakrZo7ZW5cEnA_K&AByc3G{ zE_VRewFv*-7%_E4ZO^4;fbbB){|6fAYUsZlyyTcmOi4})sYKyty6!=ge=&iW)?=9C z(n-ZtrlR;}F~T8faYu_uMfWIJCKF{daYyS(#g$iJc_sjBX>1t(oMA~&M@C^mub;6Fs(HdGA zM{2TuL;+U4bTqmmW}R4b*n&kQ{$eXO?i*2E;2^ZREsliWl2I41&b+>a#ofck{sQ+f zH8g|z(g+vSIb7sQIe{cMj-Lp%;>?Le8Wu+uI>{%2bkzTcjw9df#x4o<$;z{9EeuJ; z#u_6QbhK;Zi~Fg9I^?1~6=R4p)`lfx-bWv~BBUmH*Jp2;z`Ly~LY&PAbXxm{AzY7C zKCGhP`pk{3(o}9b$H$2jZ(-S5X9o&R7VbgRJx?A@T7<<(W~uC8f@P!)waXlf)l2*p zDL?O2TyK&_1vXFZk5HKQ+JRm4$rk?J7+DfOuvqJ{9m%!iK_4z?D;xM_OybAh)mX|P zIc<>JXfK?{930cf@O!xABL|X1mQaEezk1=B8WuQ^aot6f!u(4Y`~8;+?>7!6)2z-L zv-xx>Qhciom9I{MyQw)>rq^Ti$;?mUO!#mI>JVQ#csvax*bb|PRm5Sq^e>7Dl_4DA zKD7g1-ic0VYOCXd?vT3M7~}kJ_I22E-^&-thnQfvONS~CV-jkmL}Ikf-&Uipjbd?! z_b*KcQ6EpS*&xBMTXpw+Lkw^IB^yDgY>0#^M^z`5ltPs<_dX?2846Q++lj($kEL%k zNc4q=E1`jNzbYPKoc>;wHEw*`$5}YisoZs#2{r_k zt@5BTr%JyYmghw73zulFaWH)T89}#ZZWflgknVP$_gfJ-(mLmfA}K!W%jxbpNO>=f6ob0!9 z8w@x1IedAlX?@&x{)K>vGuAdQdPdfly?%etcK*M=4WqYSuUCG(Mn)P@fATcQ_S>jV ze0asc$Ns3>MqA8+50%ucRH+;NkhyvDVObT!9@+gp3W(!&nFArsML&5L2HJyP)8IO` zN^N(SFICf%rwu)vg|W+@$KO;yCfj;@l=5?Ai{eI{txqK1y!5bQ@3~8??C%X*N^4&2 z|F|)vmrGWjqTpco>AdQLPuh7Q{w3F@J9v+dugs@hb2_-x>DsY`>3KyfzG~FId32>x z`quHeFc&sOCGPhywHfOdck&mQDJd*m6%?}SoB`IdZih=gr}9BVfnr5Wam_curoErP zpSUE-HR>ci9G!DERH@LA4sTssSY%mbb``BQxa3v3E#rK%-42H04^|Fb4Lwg`&WdwkT*#En73(z44M#se9XXL?yU!eHES8k!#iIrO$#Q!O13z1z-x%alw z-K?*Ck*TiJ>h_Yk*1=y(Jge>`p5fR#eD$Op{5oj&*NWx^WSNq9d-+mt@hdca`_wOn z!^`)K)RbVht0`4JLgW+ zfMJk2B~mA}wf9)Z)iYVw#0t07sw#*?YxZ%Xcng$^%ELW$^kYQ^P33uSUT)nRsH5=2 zEzst&)wUOg6L)n|bTh8@`@P&1J|;FA!i&7gdNb@U4@_4}kKbBzPDR^8Au2KjnyrE>4GqMHszDP<` zHqmL-ey5Co@b6abl{*(Np>BBC>+)fdI+r$5aly%@SGEDgZ%Sya)B8OUJ=nD!mt*C7 zYV{5oQl)f9GHaFYH3IP|6FvEezEqdCAcJ@dVEq*fS@%BUS&fAZlGp#bM8#Ha2GOl{$V|n**iAL7R zmLZYA=~5-?`75?{gKLnRKL&(1Zgt+?vuh|<{^h6Xf{NaOg++bO4vSW$pUVleU1F}8 zbTg(b(=rM4^4^4Dmf}_yL`qMCiH*Sa|eg+2!r`8=^ws3I5KLB_A&H79 zDs9k=4vdHl4h!9&8Row$Fd!;&qvp1VfStjx+FLU!ESv_AmC36)vczCUvvBQrd_X5GRz%jCj zyp@d&4gn%>nE+rTngV=Ih!9BtDx@jES6dMx6~Iwx3P%96gQjp4q!A($unCb3k_nLu zfOsMS@&S-$5}*KxQf0|xIfWAdQBke}w*bN^Pbfo5i{NvCO^r>wrp87dCkfV;rj(&L zXiVZEjl4vFl$WQLfreBb;NV1;v@)c!F_j0yP?}CaHVq@+BNKzR^d zU=j$%hf`Tr#^D?XA~?5tx{`>{tG;opi!NzX#|3HcDAMy2-@G-nn9ox0%Z{>i9j$;!@Y?Ff^iz|W)cX- zsjsuY|5+=H({$S-7^mP!;)FtSGl8TS86%T{lZ}n74Fd--0kI{CHV6=7kr7GbL>riz zlEw)(0Gk0!8Q=Rzw=FB4Y4oEfOc;j~r5-b4oV-GI|s3t&up>Jzx&QZfOUFneIU zdtggY%l-pW`$;|ZTC(c1!T=2^2}$XWfq{AM z_COCk-SOHs(-o?Ry+j}wWjVx^UnvJr@X|6=+blp|-QiQSEqeAc?#=#35*M6|_< zA1gO@Ncn!0r>q7Mk@S5R={`Xbo5j){)DDL9$Dtwr3!{aD#w->!o5jZFZM`hN_>#uv z7DcxESVU3)#(zKm$>2Xd_|FXfFSr6T?7GT)jYkmNUv%cmDA=_jg&2h4E*80n16>-yIVi3GT|hZf5dTs&nRKc zh;i6)PQ`UB_7ifqy}@DnH`VczI}lub&Q73nrH8I=fT+l5LR6Qj)FEMYQgPF8^^q3G z(x_wJ`RaP~Og{}bEa#X-UQY9E;`6u2F`ICW5gWOtG~;sNXZCH9Ia(B=Gm_`6hIM`S zH1j`^2J_BFQUq&!wv{Yz}_xoqG1>~NKUTNs!m|kU* ztQ?jNnLF_+y8fIq;i-K>F+R6IG*x_7Y9qME9f+F%ms-Ee3l#lsDBNHo`rLHB_#>xy z?Wn>%O1OuT$78Rze-iPA%|Rb84BtPgQXU({iJ1>&lap8}SdiP#67bF-c=SF269elm zsX3rtM7yb1(3vAU5^?pQP&UE8HNaoO^p=i_hiEY?m*YWKqoIE-1eOGa#VO%OKN7y` zYbck1`L-6b{V~FN_+CmL>k;rikFNNoJ@%6pL%EbUXZ97AHV)<6Yerkenk#+dNs9Xh zcYQ7>#My+ICFzCbZnKOP^=nJq_E(1C=Ln_4Xz0`(yl}eY>={ zan*Mk$M?+og#+>nlA!GLtT~0*^M;R?lf_7g5?3Oa0lz35l;L$TVoZQZ;O$oO%MOF*~0z;Xx|clU{Q&$%eGf9AbF zWbca~EQQuMZ4csIDM)2y9eLXN6A88UJu_B&E0uuzSc>$AdQI9tpNw6d>(q|G3K*GU z*dUVNkVCvwi!e@FZg~Zbn|8tzXXqp6mkE!tjS(eh9P6nE6)Az=0*CHeoze%ZK?s0= zw*{ZSfSQ~%^wdSBeJ_nrUa?_>DmC02lbsgzN0R9atfNubYv*7@vPCR=igq^!7nHKX z3!LgF2L|oPsMw#J7tnZB=|K(Ik^v3`n< zKOz2nG=GjaR@Af+8HHL7I9{g2l4i)(NfsZtT5zlEo}bNTeOmtHQyBOL8G#QBeOFUT zw>^0oYJ(vz?USFY+Ih6Z;9P30K+GIWm&ksQ%~9rEdfe zxyU#@Z;@0q|Aw3f>CMH6$Y%R9JN8BJDd2oW-o^%)W4OM^)H6M}tc-sce@C^u6qi;V z4sYx_ERPZruBuYU2up8PgJX0`-VN$gk}9~O5IsP^#XC@y?zb(+1MlL&36TdUa0&;6 zguZMaIqzz!iap;0w``I7`+))eq&K&Ok<0FN>hEc9i)ofvA`GlBrkEsu2UnHC$z+;m zC&=WmL^cGLlzFV%N1E&JJ~Mk%WJ~cuIwnUICJ32ffR?8IF0`;cx6O2Vv%{1_p!Pdk zkt9S2cQ>&R$7NhJXtl&ZrNtTd(<4O&^?IKl#pBa7dUNRvOq4ZdY|#U#UTAdT%f%dS z5%!Gx8hd8T1ms;J`AS>fsz8`BH=US(ZRbOf2Ju zwXg5}nsX&Ui7cYosgEGiZ$!{V$>H1NosY^FJ!u3$jYi4gQvtn2lbvU=6d(TN+%3$$ z!qw-YMHNHW9Zs6+Yd5&-CG{agtUoWx%}QGsUpe=5RkC~<)Y9MV-JB`wOUT5KV*YYB z2sK2?@v^7%{5D)X9I5cCsKWeiNtDzfR-NI_le4XBTeHKKWo)&sk|`OB;(J-K*W#@d zWw|0@Z^R5~mgbFX?Tbzx0R;J4-wvj{>qnDqqdVxZwI-A%-{JlY&_X=>pz? zha6gu1s^S5AvKD%SG<}Qp{4LAjm(A)D7T`M$LI$HA53|2iYe@zHs)^&uvcAaKMtVEy*wej{+kd;-hIFY z`z@qSSF@AGi(OBVYO=6!p5;*E(*9I4&;8BnGqo+^0b4lG31aJz+Bx}AI#HY!!KX*Y z@yK#AzaLTGcrVGUVuloFFk}Xk9rP)ro;nvg?ABxor1$UH3F1;DZJQJxI-fB{|**E9q<@ zUo0+a69(U4aVu_}#=BRJ_O@BKUifFw+&qj))Gj4=y|i8byHrZ=eH%E%YtzSrFoqn~ zR&%jA_T22z?5pfL&T@g2u=yJUX7sby(VGSD&& zb15E3V9JG(Wtm+sd^_HRqP|&4U-`X|n>XOc_6gT^wU95BuLn)X8$(YO@w`>|{KHa4 zpqKZ4p~p*Z$Pcng=#Qzn79pr)@`<~OBc-RbyXjum9kFPPPIG=b|C_p{I%?|3ZkHq+ zvqv>08dO+BteKsI{G@@ysk0tN;mJ%Qdk^da#mSWJU6&}g1{s=ic%rW5bDB1+@~x@O zV{#`k2sAl)uGxP691E)6o!(Tzr21pql<)z7JSY8G-Y?!If2A(fHq!TYN>L^p+)&69L4sBhU_Oh zkq`*>Xla##QRWBKn{&`~|9w;Z?|8bnYE ztn^Ydt}#10zU;PG8PTzn3}M5hlKzmfS#MT)au*3#ZQzNn{;`_$Ds zh5Yz?XZEc+9tK*-RSMMPt@_mD0nd;+duBgMx+&CRJiYeg^p>VjRA#Ui$uZ6A?f}I# z5-CXsYw^N%%dM>=`5~jZ*pZHiJ*hEV+A1~k8polVnjxRDhU$gn+H$B*+U4)2qbFNP z7zNNHkT>6)V`Y^-4rZ?m}llk2hyAK*qW_3)-M+~QdJO1-vL@P5t>oQT?Z=b-@iuJ zywV6S^*Lqf-~glv|It}qSTp&DBevk}Zi=NHhZB#jXT9t9wblgcGFiNDP&F~ekAa6d zn?IV)N|RM4w%(-uHs@amSz(2MX({W+PHN|&5Z%#~9TOVD+v)%l =snfxEfJgUSo zs7l?Wv4$Nd0dSX;^AF-4mC|UU>rJB)aY#bdqZ%*{VJR{l-jr7|NgnxVY2|2RCx|X> z&kMIs$Rr5Ih*VEnTc@BVLMK1PPcq4o1*CkykV;x(-WE$XWtsWh&bdDRvVBDh zOyVBuNTn?e#(gEPNc9}UmmO}LOzB7c(D8O|l@^+~Nka07=S+56r@+43Z63rA$J6xl z-^BF)HU7AEgi<*m?#R;$yyJ+tc2x@n0Rew-vWfLb8|?fyG@<K38fTqlP$ zu5y>130)Mo7AlKPb`TW92M03W%qENOKA*Y^^5473*klTzw@-kKV@TxJ2X*W+97Y_F zIt2!3a|%ieX$d4>n|hsNOQwH1A5vGDP&$6ZgbClJ$gyMFEOVksb|0!-YaZ#B9ZZM- zMHy^<*J-LEwdE=TfBK3vXllh)b$ae7bFUHcac4nvFY}SvvwEv{3@(t@N!7*`qj1Ktg_v!eoSMl^z9ZQV~z~e3(chAj1DYJwkKz7mB~ zbpBac$=q*N)KL&8ts>j%=ZW}}0_0+}&sL0LnekHfDbCjUp7CW)mnVxq$e3mW!Sg+B zNteqoVZr>9eg?1J+Fo{+8+?(AgJY2n@y)-Z1Kcp-D;=R^K#_@yLSfRA`$i}ORt)ba z$H0>2e%)W1Yl-rhK3<;^nL0UB36NyZ=x98UG8cuVoav|d_#MO6v}Yg>1TfWUm*Isx zhHH~ES*#QapWj|MQuD%0Wk9=Tm&^V!7K*Ps>@b&6JphHhdQ--JYvx{m_BO(vOOcl9 zC`o=!BUTumSguRU1HE=4h+Dyn4*ivP1plFqcJx6&TiWY0W1sqqICXz_8pp zPPm#BQfhIBrd|Ga>87=n`m5wHtA|I8^#IG&RDYovBxF5aX{0;-+_e<({5bs)!?r$7&4%-?B(T3Q(pQ5?rQHhmU}V z&)cd?JrhbTF8Xla=n~g3;G^m5;BQzF2Aj{SukM)n%~1L(AKr=E&Hff=c+;%mZ;iJW zzk=_W#jck==1xkPt4FuKhQ>Eli%vU-O1)dislTn^&u_s43o`N4|K#c=Hr9A z**okIkIs~Q7dx7kKSbRn0998UL(R0oNro}yHZfgwGpmrU5FHj~aUUTnu8uSLwh<<) z)-{5My|tn5Z|$1IU}~`#Qq);Y2QH{sh6(3mg|flbH>%IkEOnnI?H}D@+chJYw}p0+ zt$qgQo=KubQ-V6B*fZlFWZsLZDYmAqu@wG4DFh7vD`?WyqB#;Hl_& znw0o%zY`%!cxrE_tyFSqvr+TiY>6Ifi0zPAEc|2B6DHW_tZW6 zM%jha?^f|6j+VKaI#FO;sW~&*TS|}(l1#96k3&lUca62mp#2CsFY&zTmA};RU&3?F z&*#!nluT+P04@H?RYgOk;wDUmOhMu8zm?=ljYpQ8Ey$Hpxer5~Lc|?WHaM7F7A*FloMQv8nRe>GkWl(&~(m2hT8VdN`h(rcp;-`AW#YP?%J{j)GgM)8w zU2Fg7p|`{=I3ctsa{S13Pvq$m=Uewh{7}2yET;pcgfb3r9hf&_Ty0_H>Tu9@JkEFB zHWdBOxUg||6{B{IMuan?NMn>}RXt5|H%bda=id@>VZwzCw^pX7`%1?a&H8j=YtOH zD>TJM*uRJ~FSMLIYCCbvx~Cb)9)y!!;kb3j%4NHUR`5wRJ*Xr?cYVCip)5)Wmwl1n zJ%@_q@ftLD4L1*7X`d2w4vjR#Q{^9!hp6v~YBZ~fh%kU7F!6U|ZLhMn=DQ00ma*sp zbwtN#dW{^QlwI38y983`WKuLgSw43Rapx#rX$V|HWG9Dz?*Ox;oNixa(9JK@6Sc@o znGQY3sgmq{pjGTvxUgg`3Pyc_|I;>6omi@qKe$~bz^jj0GV~CH?%1Bv6+S~+$&^hj z;dQ#q#eEo^8`aemRz;%o17vip=*t5e1%vZV5N(-vULtWW>3m|ia zEO$Ir3xWKR0ABzE2V?tbO*v%z{=2zwsQ0aRFjW5P-SY!v+j;3{j7~JnrYCor%Nt3o zW|zfA?c{BP&Oabn?}C~;?NV92;_eBv@*tM+@gxVB0DcW95I`df#o*(DuxI~YMIlL@?okkHJys4REQKxaj1gW z2#Z~@)2Qbng{rqmrnw|%TSDF%#Z&FLlYGaQCx$2FmbtTeMm9`g6%uhY7!Ge$YXi0ekT*HPjFtsPZ2i z3LVYXIli5v_rCHteW0KGS0SKmiG%KnDM4%X9!GMz4W(^lotE95XLMHtnxx=9=E5(O zQOz0g+OF)nJ*;J%qV^H~hVHkMQ2oay#BcAK+(Bfn4-yKge)nJFdE?0;?H`W~n$+P( zxGv8DRc_`yQ`+Tc^&oQ2qI}u4lTae>TWZz6qW!vmX*OEg>+HTaD4(-1 z)fTEpL&pd z22&i-(Rw4qmr6j*$w@yVFYJ2L zA7%-!Z}Dm~&x>OD;bd2rI(`NLJpIz`7P8jaZJZ7+^%uK&egD?hOIaH)StX#x-YNG~ zC)Br|bPD0m9lUt|m!~&(+z2XT_9?GDdRkTZKBFhlj%)d|t_Bb_I8n_16$2BTHVI4i zecavu@k06a73E*aa=)W>3xFKGsW)U#1kEY-h&U_i+3)FP!Vy5tVEySFXDF1)j;Rj7s>p zYk<`L6{?kBCaQKap$eQCh8fnC&{6Edb;Bw3hLZ0e_O1Z7S>x-L*Hdhbb673_Z|+Iv z*2^YToROdcIwHPT>P*|dC_uIq!=ip;t);3Qwu-4ZZA2dEP8kN4WdgUJLC6I@IGavi}aH2Nyj0{*& zyBAoh{v7m1<^aY)wdBE(+*}X0x8_egR1Cyw-FYMp_(SiLJR_n0;bpLeQ zqKzaaHr^>~Z%QF|)^8(qZaT5qD~!$*4&8`dK?xKwzjw(yP)-DFRlWxlX_r;wh#1w` zRyKUbAaN1b?BRA0e2VsZ`V# z!r@uGq-?572q=r*IQuFG+ujP)(;qOvrLwVGZLhQDJ@dquph7>-syKaS1YN=n)ms*7 zzLw$j&S6NIY)Wi8uD6dqVS}Jwp-B5PEv(qqOEpdQ<(Is6?US%-`|KVbiZDC#h9v4|Lg`$=j*=E~)Gp1tML?V*WzOYQ>po7)tV@-&Rk3vL&A2~j@Lj=VHU zO*ir&$i{f^E0J=xG2K;scu$4NUeuCXaVV=MkI^@TQ)|Zt&{SPZtNBZq0qc{r)4mg| zNPg&Y>TiERyp4@my&2L7z;GTSTzzwE@WW6LC_1pK)aw}<7WE@RyEF`=Y-4`dk(&Ci*`*sdoUfDLvj1M2esd`6sT^j)aW!-z1fQ-|}|bRov28NTn7s-Uj8J$ecaJ5tw!vvH22emb%#bSzg=hn`Q^%Rq~DQWNi{p<)Q@VQ34h} zTL=4VG(J@i!f<_%btcAALUr_RfJWI`#+kF<2jn(-tF>1?CZc}UdB86M1B=UqF+}k^$|sXxBJDyV zA3!I}hXo>*?W1z7Eo69biV^h!|Jjm-(dH7GLRRh0Od44-8VJfBSt?z(YZ6)W2$kO* z>#1mX;9lx=q?PQ9vwTXb6!l40WG7!SH_VL79i0*@vK($N{;+`hP^-shmgZ^KUtHK7)Th9!oCm{Zhn&eC#S$g+OJpW7$pOkG4X^hF8 zR~EQAa_M~iUcT;N4tCZ~jsUq#qALCW4+0IWu)d(0(?XMNQ%rLE)%i&RGmHM8*|m3vZZZAN@Ee6!3tL#OI!G&FDxD6*4=&W$*oSP0*R1sPvMBYSW;Yv&AAIx0~$&Sn41< zY}h?(KRZy2>bs&OAv2SrCPm4#=5K7QY^KAa&P<&3SaVSvD9T0Ai7}h$5(5vtwzDuO z6d{Qj6YZO=uk8Np{M9Jp~w-aTE|L8L2_>z3#`-!L7F*%=9lR*U}F~U zk+nsKMed{DW-#CvzdN#TJoaC?x`&=fTeUCx$_L-SCI<1`i zn)WW@I{r)}hrrHzXZZCxuDCJ@8rMkwNPziVu<12y+^F*5W}*8Kc&Nsz1A+FVv)}s+iDfH>Wy<}9v=|6i_lXY3f~^clrjNJ}q;~66~a4^6gK?kTTrUr+vZfh2&6p z5XS~;FZ=RS9QQx30#*1vzO*s+M$N4k> zry*mqV4cp48}fTTC8)D%*(`#}H`en{g^sE#?OQ+X%hydVzS6Su3>%{@l#ng(I1b7_=9uOX&fxp330*Ase)d~nP#Nk_!7 z!yfBFY{#EFtp?x8k*V0M2%vLndz(Zw7NkLGV>D>DUQTJ%gpT%P$n{6+GPQ(oSW+@R z(x$bhY})TIH@wJZ8#wIA+`bgf`?ZSXnaeVO$K3}58JG$owH!}rqDeqs6+8oiI~=I1 zY{y<(h?GS+{5E;5m93+ZO}uFzmc%Kg-M~}T!-vvzhz7^5#p3ARaCqX!LBXKUx-2n% z(JDTJ>Jpmm>b1Vpff38;qoI3k^pB6zCmLucQZ=hy!v&vH+NwUXl_Me`dXUo2Q$&JP zufc$GI{q!cY|O^ui)R8C!<#21Zcsf%WmM@6N3UI&Epk1#2JT zwH_8rS#?IKsJVb*`40~*5}HKN{9am#QDe=`vn^yB1LlzrvN~oL3o6b1j zN+LtEOFK?^{TeEaO3bP610By5-Xp})QND!b)T&V-`$02Q4#0|-E1hu26!ka!U0|2n zHYMDDFO;cmi+l7+wZie)ZL9bw)p1=8AzUf+>P!>PQx-T-;5XylkX4x2G+yxeJX)6GtojDVGd(Ix1LW1WE57B}%ze;Z zLq`KDxVE|f!ME)(u8D+;2&fz!E8@x;tcQ*|g?)7yURX`!UwjEAqw(`%qsHUh2A0v) z^a1(bE!SCKFBK7MGrWw8KJAi{sq{)km+b+U->sFtX0Qs#-4$_GSdPArY}A)wcTb!2 zQ&w;^eLtjhByX;92RO1*i=UkEzx|(Ql)xKU*4RH{~tDD!pxq`*oUbkf+pF!AOo0M1| zzYvl&ovGesY|;;GQ{l7zl>avxi_96IdeBE8Lw3vLIv_U z<^U-&_j4S85+(0##N}c|vX_pV*8|=qN-kPgTbde8I_1vz54%dXS@%Coo zwi0`HGv};c7SY2!e>;-U;xU6m5c~Qc1+%EFTs|+Nu%~dpk(2*>zfR|)v$i#)VJX=M z$KB>@yBQhk#AYnt{=Tod!?C3{!(5ji2XcmhM>BsmI*d`CG1O?abei@5`gflLm#cpJ#_K=W|ZU7 z%&4qz8`2-s^5$G`-4={tiss2+4Erp;*jOL3{-OqgFGb%JvYIM0Sl8=(x4t5GPrGUB zfJ3NTTb{GV=_ulA>SFR?T!^>JH%uV&hNlki8BOrO12kH8yLfiiHO*ENs#cZRRnj^= z@TJF)M?pyKR^z^Hg1Eh<-VUol;7^ciP*#$2h*#xdeOQ@|(YYICEvEpW)a{7Uqd`>4 z@DmI|(}riQAQlb=W`(c!a`2RzQs#*iA=q6mJN zAXjAgegI5;V<7W>gc{N9=l7>FC`GJ97YWkgJ5L17Dz05?*^Zkl&V5PL#;DV3i(UAC zrV7=1Z28{}EzTY>qF6AN|C1gLz8`FJ``zfaIkpY*ObOl-G;+VNhGsNR9A|!Mm(Ego ztBv;{e-?ZWqY8hsj6DollK?(1j0ttKdIVH+$OM51oEzgHCCHTuH7pSV)+8ni)TA8G zq%4pgX7!<~Al)giC`YEG9P;a-9-c*t_wkR$wKhZDMND{}7dPi~>pl{&I>V4{z1hw; zj!;Wf2`G7?#lb$VW**{Yy$zc#)9%n4L=J9LPnjhU*(8V%K*MMxa{Q6A2(p9=K#KYW z*fLcqx=BamjwT2j)O6FDSzhOweV#WgB|ICc44f`tpZ4aIFnN5!lxD$h&1u-=YlhRe zL-zY|hjSKDXexQ0rf-IsBEj)XAo%$1?kAeO%vlkQinEZd;?m>PIsInjCTi73X)nY% zY%k*4kWfL!0v7j~dH$hZsAXu2&e+k#OdHIABcE0jWn8ZiE%gZ-gzs&x zNZ5kui%pspub^B9wI0GJUXjjI5ppFkT0WHqt_qS~tvyDq%?+)WrkFsA>8mR!jq}KJ z+C0dj;BD`^VTbo{7Q-n7&$lSoAVcg`rHWwrfw5nxacV^$%Y>B*ycO*Jf`w<*y7&Lh zTXjnMxM@J0CVA8KRw@O{6cl8u>urssZwh_3J`_7|;;Ui7ZO5u@O3J`-rlOMl&8Ivu zR;{_1_72A#$56g#VL>MMVzUvHMZD@-02_P+N^U()Pb7_T;2U(%bbGHR6igFwDSWco z?LA#vn>Jc7+jJ^sz=Spj>`zd-(RJ877^8XW_eLl8;sv+d2qw_IfNHvoBMVl)>%)PN zU^lw(V7hY`xA5)v_SDHgHIpP3YJm+ zki}3Cl?mY~H{8`CLh*?5_jLSX3W@pLxwL-YmPwZBefayV%pdByD zT+NUEuy>1@zFi$4$x3z>s}<*)Zd9YS-7;4ZGsMGgfbo1-KP{ab(+V^)0~j*Yf?u?V zy9*?en(%hP6q-7o;-;a`GKeyf-CS~93^tCF<^c6rkMm~D?XcETChI=l@2N1ON^ur9 zAOzM72UBKk6h*SjPW)V34SmcstnR_OE9G?v(=X~$J!3e`WYrd5{-rfR!0cy=4g z&W4YCtz9QI{^+7^4OtAUQutC)>l~#ELLj!%puvJ)fl>J^BAk3zUnbK0_!HBn2&B|> zTyw2tHnSAsFNkro;T%h+*C0L2mofr{@9FKvp1ZqlYK zddmt?rL~4tJgJG1vAw8A-qy0R^jL4{563eZCQn*=*nU9wv!5C$tS0DCnPd>kN@5(_fByCB!HKVNlXSD$~u zd;N|{dI_s;>>zx!(%_F#u)#y^M)$4iISoRk@jnKPEd5513eE*_zp1h&u|>bF&Mf{# z%;i+p3DlkDqq~schcT|24htief03B8e);%@lH|g((+G6yb^V*$MF!ZL+a}?*cugCd zf(icnfDe-A0o?%u5oNH-f?V}Gv)8GEh4N=KabuZ0m)iQ%-Mht6uoomW$!BEMtwB5*VCtS(f=^CYXgRi$n=-pl>w_2|f7_z`lta$U>-w zgFn*z8k0#Hg;h8AnYWn3I(4CiXEHT6Xi7qF@X4gD!2|V9Ot;CO$r$_uz*7ML0|gLC zLU?vJ1|Md<4TAi?1o4G`{ZPkbxf4`X6n4-9jiSes7n>nWoXW<8qw@mgiq2NYqIh3I zaI?vNr9CNVeGJ^kS|s5$Qxuv(?w2nOq9*JK8}55kdKAiNn%vq+lYVQFnE&SR^e;f0 zs@Nf?y22dsZOw-&7{G0v^Y8(37-c%J)+k=tu58Uw+_3Y^yXT-WeEp}b*#Z`mX-IWR z=BsxjYlNZzuQ6)W@bi1H#9mdtNo4ebfg6S0pu5#4Z9S{mah9>S*&igJcQvZP##C^p zjez$r(5WMiq0UA_xcyia!}SXKNB2Xm`y{(9#$M{+xe(2X<_JsD;rnJm@95<2jn>GZ zXNrup(c1T$sXIF{;j-bBDc2X=7_UK?DTVFD^b+T(`*-dJxN;?orQLj>t$U;~8`=6{ zLo;@sk#IVd4cGl|d_E7XF-|ftTN|@oAG(8eU^w&~Go#ZHgc1b768*&Aa1&USxDM_3 zE1+82((c1%1-DS93@zRH>5Ww3t!umpC#Po!svA?^)ntr2z`!~J6z zH2;$h^DH#;voNAxb1lO)6YaS)cj_7kX&5F0h&?3Kb|`TGMUNY(p7}U~d5Y9rq&^w( zpG(d|Xuq!@YTYB{ad^0#ze|z~rmBLicnX#;-d9CyVZg_740yuAW1}kFNsZyVF`sGv zsmlxl9oX z3iHl)>#BG5bL+>U4QvH>!>r%jZ0A2%GF`$H^;=Et@b{+=Lf8L@aKqrYis%OCvM^oh z7fNY;dn6ODbh~vFzU2|N5-xXQz;mNZ86Rwe{1)zeSt&4qW6X&!Z)s`&a{GQ%!71{U z+kGpE)8J%``;UM=7v&)UtHu*uBxE=K$2FHI6gs;X?bwOwkkMa-sqpDoarQ_oOTsbl z0AY{eVaV6&_TU^E;9eDf?K7`hRTAyM?mQ-8`b9QAS?91)e#`#Xc;+Jm=WaFJC%*=| zzD%RD6JG2(KB)3jHJ4g0znQLf7A=&PQ+TQLs>lY|BzrzjUAIIarN~x+()-Ku&H*Im z)v-@kk4k>AIES}alm=#Yy$N-8({UFc)7R-31a3f*=a6Ow#etZ3zCbKRYX@;#Zyx@a z9|Vu?fAx47hZ6t^l0mSLAWR_lUNUe#^9Rf!q&jsm%ID&T>!DR#t;3e39jtuARb1RFv0})& zt;T_ab_}?%L;TUVYTAE&7r(g8O_dof^nNu=x(4=+PpoSk^UPN0eLGTF=-9u;0n&Q! zRVE65+(R)#(G^BqeHL@dJx=vx>b9wZz7ep0hA74Iyx?|ykTE155+dwXPjzME1dfZ^ zIWFo+V@INEO~2U9C(qi31xuaqd8muex#g4_zzO-bz-wK}%$I=9N2|jCXr|~pIS$n= zzSmBdm*{~7WRh~_+BPSd^8z^M1CdTZsx(#j!J#n7sKDW#kcFseE{ADOgPQJ4OE0-J zVSl8FKRtci7pyul@K%@K<~Zi8f{QOe-5X%bJ_`XcyOzicAOBhKIL_GQj?xYF>G{Rw zf+|Kz@vL_fY>5f*m4rVA#OA|`Kn`yO`&8}0uwX}BB%QODUowMgJviaV#+_4Fol1cF z1v4i6+py0aGzE~{39`6{rGq+`=Ihg*-1a{e16`^ve9;fa_zMO8oz!BS42;J4^;k#) zEpbwo7?7;h1zQAq3sU_9KkAN9kxUrX_6cFjbH2c%^xX&}WoW|+j4XWc(G~T=?T8v& zuR0EfLGxK{|3-gw!k52v;cw!KX_VgPhA4NXP2WA0@w?u~^a(uO$a5@@O!!x<2z&T* zaCJDo!`f(Sr#b01zUxh_vm3G6Ib_cFMgcx^2lx$qZlh#Fb7bTAtt3kMJdMu9ODP=5 ztuH7%J+?~K@bVx29N23iTs~6*Qsn@pP?bfrMQ}shJrCNYkMk=u^m&{~g`B>t>SpY>jm687$w9x}*DuGSuf8^%)EG^99@2#pH=W-6P zmct2nqmLAQ0&(DHX-cIkVA%vNB?NhSBT2kh?;;E$=?0OP#g4Vb5PJw6??`x!D?ocs zOp=K10V60CBGcdn(Kr`fm5B#JI@Q&VvyXhA{1FOOXn*GZUS=7$k~+%UMDAAd8DnD3 z6ZC`Cu`41*(;5~VmQCVsL%W`SYxw%9kT#gX3IW@TprY8KzsMmF1EkD5UUvUJ7 zJjV6bsAPO3-yzoPj@mj(>>tK4zUa_V+=zvu5P@7{J_5i?H@r?g&%0hgYs3XuP6G9CM9o&4;I86eZvk zW`f!;iIIE0U6)!ol1av6Msz1BVD4S{531hZYzNvjm)w=__05g7*?S43J{f&30l^d% zq=%12X(;PBfoiOkRJN}1in)oC@1|VuvRE2xjRe4#(3UsSQUQ%O4X)9lJW_gNFgrk# zw+wc%pVaZ|-9HxM2{AJFS#p8@sbHx8=Rw%3*kXUuB--w*kHP$-K*TY~UDY%HHzZdY zJm#lu_e0AWEV0Sb?y(ojnwZx9NFJ}@lA%Uu756#E1t>QZ#&8FKr#}k;A`lX6~D#z3GB!%(ezdt zV?%`(%AoHIfb}nKf4*3y9zf=+Iha1Km?wl1>gP(0#ne{ z32d(7d`1yWf-j$SaCTD(#a=F|RCLpIRx()Gj+a0?GpAs%m+nM+qASzFRyhdwp@vkZ z^4`wLI*$l=dg1W%?!5pdVtiT-@YUHlSZk=CjwDDK#{h z(XK;1n4Bc`Z-|r8ws3aRdlS)M6H}U{nVAla9xy&$_%GGL-MC|DF4~VIVgJG;0rztA z%i-jm+j$%{i!m`n2@8#6()3i{oWb>}Ta@$vQ(Jsnsi392qC_oJR7cdDJ z&D)bw&01`-y`2JvLtnNg;x+x5@9AMPQ8sFmT-cdkGVQ{^1bDuc7?3Yk(vP&P_oDo- z@sR%-HnXjI%p_tSq0%p~bj+hFnmtgQ(Sa}#UW^BJUm&Q>v-QBhD?sGlGvIK%-2R#C z>em^PLJsGOM6;GV&yth>nHcG>FD5BhS%Ms|!;8vOJinds<5syuzg4`UO)OemFkRX^ z`(tV*ssFf!S9`;9WPmC6L6k>5<84)*B>&0dJkUtp@sU9%OC@!W-$a=0AHFqd*Cl63 zbwsiBB^K=%UST*-dgt9oW>K$w+@-nZsKJ|xwy3z?ixS`-@_7s`#pp~!2zzW zDw$+*eMsl7q~Uiek!z z{Ok`TXI9N!vct?de`(Re)jKiqmlb%n!|WWAwHVHTbI<`vRXXuew4pvQ)2S97T32lJ}+D zQ5Pbe{R~nqCcK-J4mKBuOblAPSs-hZv5%TzN4R}#%8&pLLiBNNtSkK1Nt9mDpq>=B z?`>hgNyqyUsM+(8S`Dd+EwIia^$5Fenj?~L;=8^u&CaA_0s_{b#0EX7Rt}TyB*(A; z0$vpmVIj$Rna?EHblO|p*I2Sqv@O>e(wkXX)V8xc;Q8iTA$n=7W0FI!f|G)Z6Vav` zwYe{mySu_c6HB!%X4WvG@239T81LIY6r0K7GkQB;2kd5#!5AK3*y=r%@k(4`#$OBI z`SY^9ctdS2bAc^Sn)WM19GmEO1A{ww%1yt$qS?WJjoDZAvSe4as7SjeIogn+v|u5V zQV>bL{Tt8ey{^Wv*=(XUpgy~&w#Ol#y&V+^tE4(%E3Rpr)nnpbUSA+Q3PTn)s`}kP z&&t=cB0P(fqDQ`37-9!17dfEMyB1~l6qMke;&H~E1xE+|QBRyR61f1nE!hNpCtRpk zSC_zG@elL;_w%11(AfV!J@`)s|A+M;L1h_*xm3W9%=C3ef!|vK6l7IpDx}Tdf*)xT z27vog|NBRp062IX92W=t{UP~k5WM{VKhkvX`2YDxQwIKP?WxCbl*c)-^cov3Ur%nQ^gIcj*fT4L>&q}MJ;X1NI7`#3OSe-k>bt*q7778 z+8At4VnT2k*Pi$7xA`Az!KN7(RJ;xr1Ah-QUuQk;+ZREJpqiFYOCF;;nb_GIzpMv6%XGEceDrP@QZTvx_FB=jnp8ehgaTO^C4LVA1YtI zLG}t3z$Z4&u1T4UezonbM%T5${_Hu3`-LcF#;yV!dhU(>i-^t}kCc%O;DN`ZDiH`R zP2`_X6SSfm^U)|T$U76|kc=nqGQ5QLS2xBrUDK@#bQ)gm0kTGpBVMi_KK~A;f3^XXf8@Bea^Z6x!r5^pkNgh5GNPbmx7 zM09YzQgD_3w)*285Y#w;q@T0O7-t&X4Ia_&X5ylT;<8X&-hAma!O&YaJ#4h}R`8933Big%9KtIiuWz%7zJz?RQgRhVO*0`RQ zhF0(3HMeLN>#UMRdU+ngh& z{O;^;h5KA*-oSaFvbg|PoYn&Wl)J8t8 zhY_SCq!lTVZs{BZK^g@C0ck1eZiW#71q4O98)-zkkra@W?q=v_$T@p3&VQZvyx-n0 z?^?gba;;%xp8ec)U3WaQw;FG`lbzR=(#k4V`Z|W$67Q2ho8?=!mYnsDcIl&uM}w;& zUyHxq{QwbG(vI&R_jZZfNO{PSg+FJTr}u8?+s4zKJ4URs&p_frXVq3-aE<)MH+xdu z%uk}P&>yy^Ic3sPtFhuP(bEyC0Xl8ra!fhVJ?sj4w((Ki)w5W53ptl`UiRTbEzK(a zg&Et1x5w=GuJV(eIynz}{dD>ARgO0gMj?oZpyH ze$yL$S+j(g`;|(uDJnFwRU5^##}xV#U*Qho>u~R;ld49K*u6x<+#Bp;YPxgg*1W9F z7;IU6D_E(-o0U9Y%c>9a!oRP4k>DQ4JxyuBUm7+V^1naOuZ3Ve5JZ>3kkA>q7vuiA z@5y4LzfLFOMsC7In5?KG`DRi&M|sFivpeMtS*>s_*I1qg@65Nn4eUcinD&ChBqnW@ z#;58xH4_^;lnnWflhzf*j$$wzCC-yus<%U)xX{Iy5J09MTZ%rX@#2oSC!+1>UzWeRV;7Ym zlNoFyHM|Uc4c3>Y2t*U7|JsKVrW!eeFnx( z(4}ASd5oU6BlU2^ zqE>%5?g!Hoqg{He+T&r8r+pI(`oZnus@F1=sfsmx5`MLiA3BX7a_EtLZgYXL8Q-3XSm6 zamUbf-w%7_P%ppmG5yuFwOO8^j`lOE)YiqX8|jP1FP^@XZnq$%$c6hF`TI}}Jt|sY z5T5H6uglx{nf$mrY#k)EQ-!9CEPPCAs&>W6kJ)itJs09~yW`dawD8mXm%2aS#ed>) z_Osi*Qt_7O4P(IOop=%(y17QRoqP+kHk+15@otY>l;t@M&v)0PFBMc)uF(rq-<=cs zCH5Z+*L^P`{vv(u$miSeNlM{7(CTK)GB&AnprUVb5+$xts0 zEvqI7``)h}!O~}sF=J0=zTr=GeQ<*WSfEeTnHW9U*sLOVNROhCBe&15{9fKCSMeoR zg*x>a>4O&gqStT*k|?iJAG&F`trq=pHjk-<884QqmIvX%IU9x zlRGS*eE6r{G~%1Kzx`}-)mi(dMMP45&yCFJQIUPXvwL%;Td(-8*w^+j!|s$3y?-;w z*)`vuJ1wigH$W#ENG=o6oKWq3wSvdnk`?3vqC!_bdz+TE?m9Ld9YieZm`{dF|7nU@ z%wzLWc^BzbVXD5yKGm&)A6yw06;9g(wT66atO{awO2YxH1nk`R?#n(CT8I$!HZd%I z+4_h{?wR`yw|btvD!&nnxv*HwJ}lU7^BdqxT)Ak91^*4jhkAG zRFLlSvrD}p!%=K4)(_CfU#-|eL%Fom_Lh^OyzMay!tQFE_#4vFUvA9Zz)X0nD<$*r zB!N6-&++yu+f-V@cUmFhs`C8Z*iR~zIVuzIyYz7|ON*(En{60R4jZPvatLv%LukbL zZ>JnNR;sLt8w(RKCO>Dzxs?JxptLe`>V-7bwAQ##Bq=70zx4ds+^~UFFQSqlzU1z! zdak`Ivl{w~l4fpJVHMlsoouVUtxNf5Cq~ta;9*3mQZ}}(92?;RNJ>(6XMd|z=ALlI z=n5720EmpynWsqO`xbegtO%pBqeQT4U6Wipv(21IDwKq~aj)FF*CvJ1lsebaF?WM- zdqkLGtZ*p&L3vE~V^V=j$A?VDYvLxByf_ckethhZgyI^STs*nWA3ld({i>E&)Dv?6 zjc75RFtdCh)L>zp8=C;ClkisIq4)gZM8m|fDCii;TXY&z>*#hb1y2t_wDJ){?3*h5 z+4lQv1M-Oj=FgFfdv{hHvjqvk_g$->^7mN@mhVc~iHGPK0oxK`Ct1{u53GJDAFK^J!V_X2KBvhTOus)j)2{QZ<0`d+Hu8J^!4ob55b zxAc(ydl3zpZX_Q1 zg=iz)K-O4XN;QFeoP?{QfqeFc-L>5>pMh<9jk$j7P9rzN&DC$?WrRyrS z`JO~5alh+i$F1TA9$zlOnwM&B)F}al<<(4kJntqxr`GAx*sr`fttTud)%`U~u4$n> z4H|sPQEaW4>+V~0(%PGG6G;`r%qCfTrlgw!#f$f9=RDIcWSbqq(>*syORD6K-XQZe9@F>K1XeYFy7E^S=v2=Cn zxjtWo0IvhJpAHB&?ffge*st^rK0Vd`J3XbwZn^gKvX{cQABTfN))uT>2=Ymbpm#{Q zpwigpnMkt-CPq3WM#->S}1Mmu$)MO5wa`FH=qgTsY-LAK~YAF>g3~{ zdsXiZQYC~*mFTe1OUy6J?6jLV%!0p5Coka%Jx^1dNVY>Z4<;F!v>}Ryf}}M*-_9J} zUDdv+&s0Iu*dlZoM}lc-RaRZ*(;4^)yL9M_hntemZR#6?wupq=gqO` zt#s{2#s(fnN|aWsHtw#6u|wHe)~fO94#(CthlASpqqX1S4AuR&LajDu*)Mj^B6VUT zZ~uQ<4gK%hiaxjr2^u`4ze*Zki~&l)|4~2kJOqJmcKl!JM@it%B(LkoJWGce;Fted zKi>5CQ$K23SwEK{k#IU0=NuW?50s*bG`t_IoppE2^%Gc!^p>%7h&(Yj400jKEt@g+ z_&vo9M#d{Y+E2`HKT7K2a`2Vlrae=lef*10jU#|UGOc2A@L1xw*WIjpddl`>{QI`R zjJ&J)ikMmN>57XPr{AYr=>PYhD=5~-S5+5Fx$0r^cZ@$}=6%EBU%s7M4Qd6xhC(D+*)Jmn4Mq_9s6^n_j*CEG%^OUsiPmfgN3CITvQpQ~(LJ7Pih`cozj zh-~Y&+emKgu%I&$Kfj$W5)RRLHrC9iW@92It&UYr^hTSwOZlab8N=>^M&oJ%-hM3p zn#T0qHJbgtzrgpkK&Rz=Xz0W;tkJQM%#y~oq1Zv#xlSXGm6`1r&RP$BN zh=(l=tRs%LEIQc|0kVJF5@!t=t42>kYCBPzdZP2{b_foa;LP8hFI$BQMHt=Ym^G5l zr~i=|>-($d)vvOG7XvgUCVes?{2O0&40owVTpCLG9bE>Vac0ope189`y540x^3x)7 z33K|>yWIV0ig|5yn+qRKg(JTN^=A^*Yrk#M&&{*Xkma=susFS3{ONE1Gn_F7U+fl1 zqMLWPe)gOA5PAq*Yqo&p8=sJ5GGf1FinjOGyRGi_`lev#GqWZt9?bCS+wW6ItmcQ| zV(YiEzX0mi|JLd4UC4gxb*ANfas>94xCd=+MG2Ylt!iZ*Eq8{|i|^I^3et90 zylLu_>GgO_-4G5BWC?DXD2YonQqFporQ7oc;=|kAcR!4-lFSW5hf}j}@9{(N0s)am zO47kWk6_N}wS=3Mn7gu6yq}T=5?9yhLH1r7-7Nm=u{Jr9hLT^UYwZMXowe9G(=lE? zIC1eIk)nJ?)qrix{Js||A;pS^1zmiHoY1&eeBcA-)o5uqC;90tHn17eM?=GtAA~k1 zqT7f=N@k$||H$?Wz0qy8rF`a&Pze^AuTGzm zMqJ94;90hmt{WY59>Zsk|nS{dCR^Zr3YR=A+4|1DVy9Bvfv?&3 zceZ3V1w1kwsqK6?28Y2{J)}x&V&SIWh5JlPZ(2JVYNLaie(pr2nnmFH1mEzj*1hG{ zw)yNRbaWQVPNsIF{OxPJsydg8aklk{cEJZ0U1f%kG;t$ia}EbT_1yD1I@Ev0^ZABk5of6H6OXF zG{GZ?K)XIX@it%GFCQCPrKJlY#0|gZ^uFI~VfsoEw0Flxv&phGrm0H7y}~YfgiLQZ zbfwR=iu~SpPbqaA!A2>x#-g5Ickj{&ixxa5_06c%D7)qT{-_l*LXx@{B#;bRi~Lz4 zkE~hTA1Q8jY1Ai>t22H1@SFQR?uB3qyBqS+>US74o@y@*opDt6M+Sr^d6j!E2zM`o z_?U`f!FV?(qXcm|*Sso1aAuo29{T+>gE<#JqdS*@;S3#qfNYj-R_=W}TdX>xTZ*;r zMY2EFtWY3lPq(?z3)W@k(oDiRjK=m<34^l-56eHlx@}gPM|Eyb%o+9|i0PMJ;<2)V z*Oi3N7fSh=R7xz0|CgWEpe88CF#cV;7HejJk^U!*af3j0y8llaLkIo}9du1&P%1Y6 z|AWT<-m89d8aq)>!$)Y>Y1SG$!BA4*hCC=H5Bhj-N9y4N*y}7~kd*>a9`qzj^L3%3 zO`&CZ;nr-P3*5kpgX|TYS=&!7>H#s)uZcW4(r4J%A@{MsL+tqYJScJ5aejqe3`hPF}Q^J3q@Lv@C7X|-C!GBTk zUljZo1^-3Ce^KyX6#N$j|3$%nQSkq-D0r#^D=7PfoA|q~M+8WQY9qcuy7jND8lwYZ zg6#XwT1vMtub3|($W87t4=1u@vhT&0>4#jGhnEAhwzrHX5`}rZH+1Kln8aDaB%H^@ zPg=R^F3#brCv6{12_yv0s{DVi&79+h?dN!$@C6&_Bcx`6xo9ZXYF10&K}%8gatwVm zWaD^a9hjz5bqRcQW%(Xq)1NAKP4800oi5iDaswIjJnoP3M z&Bk{@K5Eo#7mps;=;?`{1eDC)*dS-8DC~apySq^)*@P~M`;q_p*Dbc)h5X{}NpT-U zCt*$4mw<^h%Uxgh&?u(2A8F!mHU^n$yIQ>4D|x_8??V;QFqjI#i=!gI4OMwCmBNVa zOU*hz!%hGRhkJ$2n@3UX{A7#rs*&>5s!zTw5L|LA7T?-DFOYSQ?RC3ut8h!8*-5sq zX7Qnb#5q_}M-5`P7))+*RsTP}~StMzZuO_;;BMfgnBseEoLggJ;pp(~t17x(U8- zY4_NE(5~aKF}Bx@Z>{FfoUN6%IhYvgJN3ZSmW#SJxEQk`xCs}AdOe|O=J-~@*G;NM^RmjB<1&%26T-+aGhOjR(b@nkss{TBHxAX6O14oc4pD~lJ35U- zU0O&Z(`jmZ3=O=KnE-%+J;aFxF`E>>k3%i)D{nXx*d4x^=O$j5Y_9r)_4M=5XH^x& zmXye=&k1q9MHgyDjf7*BO>6CMEv0Cu659~|u^PUyIXgq^!!!k_M{OAicSNqER+0rn z2^3j6iLMM>q?d$(YR#NJ%KVk~GThRnJ|{bAKjqVd@`-?OzSg%$qOKL3lWZ zRsAm&?ylwR5Nu`61{0P&GOPn<#Nc@gPS?-XM#VyNqFpYvR9)u?hHUVy77OJ(uAQWx z9gP_DGeUz4wPvXN+^NA`cW*nl*>BPe5Eh^KvmS+aeF`Zh$sbiJoS{l@a7bSm3e^vs z>DRQ)AHf~pY#e-?=Jt6t;nuL9PQJx%-y=nj(y0I$H(Gyt5*t6TD2cM+c6&ZP{BBXo zJ=Q&8%h5~o9IBI)DC0zpGNCr<)c0VIctV5`@Xs}LFTql}3rP{DUw^g1^`fr!y-i;H z|7rjD`@3Z@*i1*?nui%fcXEux0Mxd|3@L2+{%|js2YJFL^D>KpjG|tNc8iVhihep` zA7Y|)e1zveTg}66kQ^h#ltv6Vtt1*o9X6X`4%U0%0;VMH_WlhzCkG~-s`4qX8)%p9 z)y~%0OgN1hpMqdimU)|yAv1quGUtcW*M%Y%N5#nYg>xLj7($e#Q(FPEC`@@s0q)ck ziJj@Sne@ggIdrMfKfMV{$%ckd z4w>GdG!~z%+N;@UTrGt?bWWfER^oO67Rv6`?*^QPxu|J>IjZ`SDLFEr>$}3OOP-Je zwUTf)+ot>UlC;=UDVkW;SlXuC;YUZK975-fgAJ6HxcHbTXCQQ!YeM(a0;67wG515a zf^*EuHxFY2h6ZzjFX7G7{e-knU&B&z=8=X4Z~4;(%WYe7&1YV&TcfL@u<9lh-9AR z9Exine-EI%09?)zSi{f&oKd+fdbsD4lev7srBEBv$Q%XX@i~PW8rUZ@^(TWZIcfD% zu0YzsbtPtS4uAWwqXR03e zc9!l&9NwNCqCTxlL1~{6M$wRPOi;&45CxsCnm;S9t!;|^MRFf-xp@E)NE$-W<$w^W z$4&J8*|Zo~d#<0@=5EG%x^QTE&`|%`BN_zT!_NGP{tc>_^YYmSuEE**l+0v@Tg@N} z1fG%r@hStyc0j4*9vF92-@{ovpG%?ptPh7LAw^~DP6s@g2>8Er@UZiOVZ8mzY0{eF z7j6@AkT?sO-s|Wb!Hor3)K`u&-FLAc~NPhrmh}rA-&jq^jXx ztsFv6t8ZQ^w`+={fjLO!MzN19m*hw2iy5&Q9jxDzz{qaBXl7JtTTdr zXyCPsO;^l?&y$#-%8P6Chjt4(q1Y!uaU;+j5vUGNOTOff^AK8 z7+mH9KL{3JcgL&-glXCX>SB%q!YRTf)*c(U<8IRwKU;F725Yer^d*!@M&#SrKyVna z(Eze4-mOoL&$0%Os;{k{Mo)SVP>aHSK!68S3`$`1U^e?MmwbYP(AL>rV|R_AU5-2cGaJEl3v{uaf5EaU(fEbGyNz`*_TKiWe=K}7|Qk0yk6XTCpSlLYi%_5#TGLYn!X_(|?z zsOUMhIY~t~3hPZGCs`)oZQ(E80xQz)GQ(cSV^xWT>=9F{h;CSgd-fIs@2|Z8gr%B1 zB4U!9`vmSoPBb0POxLewKSCx9Eiys&g(26}<$+Q9ar&bG-o-hUXe|U;$lEuiF{AWY z1=!OMK;+oEw7Y;YzBWx+6^Ui5cGyuj`It!2*-k&>Ri}Vlv8l(`QKVUW1T1uUr1&|34MIK^INPQl`&$h zJcp|$+h;HW8~Erk;NFI_vI>AL7{RKP6l+Ni7CY5&<=LGa)eF_vpUX0@6JTO;gns-j z#0yQ~we%xgvRle^cg<0ebq_$-t^w8b2a<+F-~-HJu`+5aJB1Vk(l&2pSN{3(b3m_z z7K*UV!+sw8RJ?N(ccgJX*ovVtl`Ai^t zBlny{A6QueLitG^U^K)XVEg(8E~RLX;E4+@EE0$WNyFFZ+r3g3yZujRa~d4l?@VShq8Fn0z!?y3*10`~mizBmrsKC>7I|@W0wy6hA@?l;@-zINbx@V)h3>6UEj^zt5dBFqBAcG-+};g8`qX9Ma}*G=?fuKimjO^79bi-QXpKWI;5e-BjrA|6A1&_HJ%oA5x zQE?jxu$l!{h5{BLMKM5XQJAA9$6<$0EDl|LU5{wEQuk5f0$@c24-=p%J~_OYy{-*P z8R=|+{jdPooOsFj8k|KM3lXxHOg_2v)xkeKj%;ntQhq#lttvxDFu_}PZ;REiqHynx z9$q))B35%^+NTyU7^Roj!DV>cN_^+-pWl))#t}eRB zi#f|1H|oPv22Re{Lw1yJsjeB~wfUngDfWSsfRq)o-oVjWbs$(is3$@t@auW&U#{Hn`1w{n1}jZa&e7r~OD z<8?>*(WX3JP*2;DVzHfTivd3T+)%M+A;mTkI?_h>Gn$?bl~~rNG%nvs%P$pcb$9JD z6kFVKUi@fn`mP*O$SFSGZe|Ke_KPR=_XH?F9pwvTOA`xLVd)8CzJ*IwLsPt5#Yvd^?q zg01^NQN2p_wPEM%=K8j<)yYB}#L_TnQ759m({)(JPm&TRGwITN*kqY&XuEwi`%sCy z!iYu@Ri~iquzt)LkudnN4z2TT?)IG;j0O^$rUs1Y4u#pz6?Ghi6Q}vl-Bm{sJGEi; zQSauD3-TN65mUsr#8&an+{+>vBn`vCIR?DDRr5s+Cz&whX|CifHLl0UYi$t5 zerej~YeLAmd^ss@L?H;H&iexZeG{9mZs>+l+ecuteC;2xL@;F6{w6^&zzqEAgEg|)&UsB3y4gpE%QQVw0yXR9 zd6IeIHFwpUd)K$uKh5*2j!O)zD}j`r_j;g< zNE*)6kmi_u-QPR>@ts$MR*wb6S|FG!Awrg+dnSSt7hxv)fF2X9&cMAj$Z>EG3ze82 zKU>QUHVWS|bI^AA;SjUASIr}40XDoP7fiUu2UBk-J^QjxFq(`nljEz;wJ z!a*>3+|Zd3uD;4E-!pZ=vnM-#@>*ZOD7gVNV8z((Grm}~5}et!ti(&~vh8=(M$guB z-`K2UYJAYTTL)TFrB!dZFf8<0QW*V= zbNXUXr{GfSJti{agyCZQRheStl+nWHmb+B!h=+ItKpE9ovW+0}hGVwI9S(4@n6pUftH^3HLE}7S&zSnU> z6BK$w@fkRa=pB!!%hvj6Rx?tW#nvCG=8|l99psYT7^MTs;PY&aMu^=sX^75D%}s1R z`P7qAW!0U+4;N43*H|y-ppne3ZETFvrUZUJ)`Vju9|7HjB8dj-Me{+(?kNV|vloAW zG7X~?HX(O;(r}#ag`N7Rh7MNEqKB{ zE4+-Z0BXc0e8VD9n_IqdLk}Wawz>tEXoNl4fqJ=i{Z1P76-$7#BkVg7 z&hOZH>Ih>u({c&uq8v?fT~Sp?4&D`&G@M{aAX`a$C}QdIJR!?V-R0beDNry`ELRlR zpT#$=0A~?Z!>c(%w@}^L&m(A;@?8x%2k5W<7^qCr&`QTSQS(M3f37NxE@2L%h{oK| z>?T}%?c+&~u5JVG?Xqd1N+LGgpy;1>6Rl4wsCr&KN>oi%0y~Ws3h`X>RMB3(7tK|2 z2>IPUMpdTKm%48H9!bL>hOI^cyxN^~<&F-8<%q*%gs@GV@hzG>&V++7*(Eb@>h0il z+J0lSl(R~TmrlQp0rY$-vXwh~XG;tRAdvk>5MqmJ$%(b%)d-Hp&$dQ;KYksfao9C7 z;F-J))*A=ko6B)-|?wV{N#HYXS zM$vb#yd3MC0x~W&bv^X>2PO7fU5l@yHq#HEY@aH>mMZ@(Gzf-`n<!=^EClv5tt`}t)vDJ zAsd+~oiF2C_pt~0jv~Ju8()N$2lcrYFB5F;+b<`bA8k>b$<>fu9oa+- zPz=6${)w=<)Qs-?^Y3$Z7FfNW_&nn2RS@z8gC`8Re2vW%Yx{O`w?63&c01IgQ@V2ry0-bcS~}&UMKhDw5`9&BXEt zB?y_Ln)-mpC{L8^7UV0EmK*A_+BXFxBtPBSuA$Yt=_RX3$th`~P2G1-Vy7xUo+_9W z^pi{z0;>ngpWo1%{(Pydp5%b!k496e(5(r_@axAi@11c@UVIlLAkRiypI3gJUNW4W zg`}a>7FfN|L)FAbpyM$8p~I0U zVw+EXClh{>OxT-pl_I`F?HK0a+t8)8r?7?)0f?~X0)yq}PIDLL=Iy7sVzr*z1qnJ) zjo5yg@>W5TL~D)5UBpuLuG$m68S2PR52|bW2ZX(PLK|q`T$H3|cRCVhzI~R0dD(vj zw#;ZO>qY{#ilW;)tn+f{cduUV`YQv$Qs-XC_UZVF*lTdAaM5dqT{iILh9-wHfv<=U z)h?T==Woyk+5)*?o~h@#OCh6NLaSa$3jNPK3`&;gW*UUflHDDiEMKm@`nDUeUi}SP zJ6zexhqk*Gwkry|i7SS*x-sPCcH+yfw}YIxsZ}WQSL|A>O_iOfnHq;?ZH`O6GQHid zh$klul|6;6n+u1zNFLMo)hrI}_Fm=jNwG!e&{USAoh&tCkXQ2_3G4?>4^7=Zi-$gq z9CRs}XS^oyy73Q$CaZ1sxTU8YW8O*?AL`k zCMj&DZi^W8fQL9|ysZn~h71*MtK2z|-+IX%2vmLv2UocY1L#f9e^^!8VCZ`v4f}}Z zXhH58yPHfhvhe&B-U(w+4_rEG^Rk55CV7)NUvh^b;YslUGU)KAs&u8lvubG0tHu6g zGr-6})9zLMVs1Bj6RLnJAwYE#&9ju18)ID$y^ke=J%5j>0P`Epf>SO|>xUs#4toph z4I!-0C}6ld6OEN#Cmldjic?8Rou>0rPuq84o1tTtCn^o#YXu*h$|#`WmJj8{-Aj-B zMQ0Ng`|3AI0F@Ej?oL#})&3E#{_$cip7e&v?X~L75pz=yUrW~W%&(CXf?Rc8H+@-E9~@ljnV6}`%{zM(l}S7cZ-RP-?S-XG$*k1fU(K0Pbp@^c+S21kKC zoahBLn@^0juh-oRq?c#=9P+l9c4!Lg_c!ppR#Z8k@3VMv72 z1N#p-qG!LL#WS|;Dcvjp7PX0Acq&qPid&(y0q=&y25esR%8Yrf@U+fSX?sr1?$kfG zO5sQA*Rd;%dU>6vh}&M;p9LLwF{sKQ{&G$!?o^6|i+-uYytVQ5Ht-m{b$kA&=+_Z2QAcq4?JX)HJJf1=-!ueE|SB_E+wcwCQH`gzI zWxsO(VB|_%l^>zetKT@6m2r~prlk2h!Q0*2Q5>#g^0_0rJ$bM(OmDYAfJ^r4SkL*j z!dh#t!|3bg-xbJo%X~y^TMUWV^ZDDTk_$yJ7o|=1o&+ZoA8>oGF1R4T*K)9wYIjG* zJyd<=-_3h03K#o#+bSy}Q{p5p8_PRy>dD}%SfghH3XJbwbzU8xhz+P#A7~KxyG3+H zhW;d5Ww+k1#X@dpHcrWRc zsB`$Z0L1J`@V+<;Xk}~l_L&^F{aOo+7AW|OJ0KV%koiSfFV&&k+d^u23wU-2)ZTFC za7Hz=Re!+u2R~N^J8lY<{=?PspH^uO{FCS<4$-e!tDEYYHHww}k;R#Ox2_atVo>AA zYth9XeB|gd*=fJB(i-papy7I-+->WjvUAw5q0Zxv^m!q^4yVBn-*mgmpk~`F2CQ6R zg+B5SRyJ;ctRsdbZVze4L#sHx4G{h%YH{@K9%*m53vM5EJ+yxD)Bh|E5A9FrQ}z!e zF!Ffv#q3`FC>VJES?wM$A01GBV;v3Ty09C@Gj6#*ui_aB^#4Y*5xQ&EiFfzlieEks z@c;>C>A#w=R-Yqr;ilD0Z5;mR3xUr@W5L%RFU9WsuUB zZ%NNxVIEe+-kQ6vB?jgUigc?aHCxBuJ6Fzsb_cz)O-(k6e${S!t3KM+&3pQ9v z3UliUnwMKDHPS%SC?T18zbi|A3;sD`WAn2KLpwP>hp4UcojX$)siF0ZE7-U_y0vE< z@Fljvm}cZ#(j;I2dTj{{To~_uom$SHws@boU zwSoFKR~xOQ82{MY3o8@idAXs5RDL&4FiB6R4M_NVIX)>`j(|pvjV^<_`Cm@9uOIsa z8?yn)!avM#4$^t~pu*(fy^pKBb# z?T!zrojcE^duHOKxL2$mLt5SSUB(^A1=I6#3tB>qSdYr5pTmFv_<8GSH|tktF@HH- z)IWQag-F&Y8@gV#50Uw#7hoUhmBA4&a$iOSUiPtA;Rl3>{_Z`c+dC-J(k6gZKtEa9 z$bpH_0^D*JSx%DM4Be|$ydK@5((QDt=YuxWkeNo;Va#Bn{@6u1UUG4AJ71a2yq9*n z5VLY0@}BS6>rao|PV`FdF#ve*1oGbT9vJ9doCL8KspQ-f3mYQ&-5on;{-^IOoY z=tUqGyZ%dPtAE>t!(4R7QP}e4s#oup&0{1 zImw8di|FOvBpfc~li)v;(HB}BNu`M#`yANiErjss{KLbZ0A&3D5+w<<-C0jhj_Zac5GW#Yb8$yPj(W&)Eu~YYt$OlVM-_2R zTW*9MaNbVM!&DUi>PcGx$YNnbcK9c7Jix@I!+R3L(j@F4ellX>->!gjF81bYU8=J{ ziYZt=wb&(kvN6eX_=%!rLwCj%lRs9%;G(m$bR61W!~ztLqscZ0b;-zb7+hSsK4bJ8 zX_k<~D*n%hjj^W^wn<|-F<<;DO`7-Oob)!14(cXqQ4f|Ga2Axf9zUOpW3(QIMUqWgpGfNy-o z-BcN!PpJno7kItpV)zZtsl&Ig-9|CsoLc654X*qWI<$d^^-ozH3_HgXK=I^;tk7`H z@iskrrl;qi9ADx28n}V2DiRx zySbICjO^x<^E%JmP-}jHVO!|hVIJ7lVMDcnZOUm5PVK25rTdy=id6k!;-jo^vW73O z9skdDmx($}$Yx4_0tYEHP;$;Wak2E`eN5&L^q3kI5{HY`;e)4fTDl?|8;g+gMDsE9 zlEljqo@aeDFZT}l5RC#1*1NMj^_s1<-=sW?0;0!~xo7XPHmKM>84C_`crJ_yY&*#zsJeQ^R|23ASMN7_|7K*Q>yX9L9LG5TZpAnejt ze$h^DY#J|Dh5?*8d$vQrMdX$^?S5P$i1IlRFox4t=d3 z>uoYy04~-u#AqUEBowVb1$xZM(E*!XONP6%aITxDf6YH3ON$Gc_OPh(>9|cND_z90 zGs3R>Ox$h6E`VLp4Y{$|g5%e_jb!=hdl--8L(u3Q1H_Ugo(7E9{#0?Y*r7|)MngAv zTSnGlAM(`1KNDAFOblO&_#=Y|ft+W%ZD|u5N33cR>TX|&ykvY4F!Zl9z#>tYgU#P) z;m|b?9FPY+p+ny<+gm6tabNKXc$W=&1UN;sJQqpNRq8WZvfITP!re`y>cMM{%>p`i7ItJ0Xh3+Be& zkMgoZ`-xy9d7*w*UJga&i^TpcGm*t6$IAM ziU#g=147->1|MH{@aW2g@=`oL`)Q*&&xO&^l&~NP>lg6NMNSaLW@KrQ^BMn*@O;;! z0$e&T&2gvOkiVfIX^!*jK%vUzd|*C#I>?z(vbwaPwC2@u`o}CwP=`K70ceaZoT-Ct zcayDn%C3s7krj7f4qE5l^*0!>NTdv(*m#aPBflDbnbCdcj{a2(mZI6xnU8mM^7;@0 z+`0ong98DI#PQh+=f11S1Fk@dRh0_P)qg7xTGUIDZBIG8s50re-TdT7;b@9v2>g5K zMP13^j}w)-sW7pu!B5(XHG5!7-CviLR9Dq}2&ls%o7P{S04%eD6Ph`B=7Veyo_F;} zu1E=%9dG(eD~7AaP>Z&+0x|s}D{?Yl5;?aXo()z!(dqnsF#8%fahUCqyN`^VCf4j8 z2#T>9o``A6&3>^(o}N>0$cOJ}H!=Eox$dnAp%2a>ec+#w%ZoxXe^~_pUUkloIT%Zo zc94ftn8wT+Pju z0ZFfNyhp+$i*PsUc<1%yQ|rJdn-UMEYPQy%s#cykMQQ=fUN<`|rft+oh<&qXiJgTY zW)%Yx!HDHB=`eGIfbxiJB>Nz^t>zcyZY-g{=fyoQu30XsP zvc=z%DVv9^a`%CzLMDAMS^GuvFw-heu7%8^B>c>l5`H4Kd-bAeK=KbB`cae zIxgI{8L>X7y$W!pAjqCirwPYTHYB>PVO8Jf=uvrrr-nkyT;q}ti}zoL6UEug1GpMu zuQaB&VbyUcBAUZ)ox4&lc;`ZJ#}qg|QeB9hXbQqt1Rpma-1r*wDCd=~}Y-}fia!@c*! zj`YFz7)HkL#VHub(fv0DZMGvQek+VAjma zod(y0&=dyG8$|z^apR3o$Rq4&Qw4a*^3-TZ+~S#>+Z*-VTnn&9E;2gQv@Zx%AJQV= zI#Iu_oSAmxk<8Uz1L3`dQh2=X+;^)#;giS-aA$T1l;X?ebpfdCrRGPurbn8ut221v z`+C*0-&{m=BQ<%Btnn+=uC48WmMfg^=D6J;&vyzVIb`m^WL&5fFQA)dLr z&$5443-auL>llR~27W8N?Krg*n%(T1h9Sc-|3gM-;OF{Ujwm303Dce%!FEIl zN*A7fo0<}|1BySR4=dj@E$F>!5X$;BlTh_$uto#hT)8$w{cd26==IpSaq))TerDvg zd{`emZ*~uQZ%OmzBd1DF!uc3&$FoHkB|B*$IJs$B`SjH{s}I zGX<7I1!Bn&snz!kR=V^|g=$|3=;m6nIdJtxeOq-T0x6qJ^+hIKkk5#e(e{#(_COUa z)`I^e#!nb4Z&_9>0ec0wBo!6Ymql(p3SGxDbgC#9_-#Hk#pG_&H_Q`HJ(A>-&ct$J zEVJUSJlzXn_`k?jM2#@GycmktVZKO(8hj`J9j_9A7f(6m9yTKzBCHkSknAx=yz*C4 zB#@5K;1A9m7E@*be3(|ARtD%P`pXK>YwKQDm>lRuiiYq>BkB=+OO3VZz4ZrvA89-4 zL)$A5X4Z;{7v~fH+K*`kLV7a6YLlPGBJbYFR+Xv-1^l$S=&W(#MNs|MM}+0J$$$i6 zyLg~iZT2Rsr9;UN6JDAiWpwgeb_QxPs53ZqQLDV47@qlq^>tn zUaWg=P_;3Y0Sjza1zP|9nIFOsXZ~#rYF#J@&nev)71T}IYH&8N)%WTxy`9v{i`LY1 zCJM@y{JIq;r3h4Y!(jGB@BH<%Yx#1x{F#iX>OLP>5J1eVC^wdmz2()JHIabv4bkKK zGFhG+#*+UuzpEI*dhKo(2e3ADcz#%p1>?C?4JLh^!|)ML_q5Uwc5`ZZL5v6VrZxx~ z70q<&l<)keeUlV#A=3Rn%T5Z{T)P=pF3LU5@6fB^$JUPq=58zxj(0md6r>sKOJCvu zrLPvX+&ubw$V9=lirm39dhNJB{@di! z1OEkujPr+uqM14;k0w-j@sXUe%bjLX;q#X#9f9^#S@_-%&-nK_->vi0KM-$}!NIQq z2@;r6-a%dSG|X(Tr7!yhs5w>T{X?L*rxkeGYKiHCvcJB}5wPRjH4T5MnH!rUeAX*^byVpzI=V<^=M#2 z;*pne_xL7Y762g(+Qw@Vl+`z9?1%(f7|p06oml#L(G=UQ+?bb=s74R#2KhsV1Nu=U;()u{=*mFs&wSAy0Go|?f+E{1}x0sR)XHLD4(-b0 zp?}bf(NlEL=7_=Uf9bFuAhZDBckI{9r^B9yM<~WS^=nU(V|^GGebgzx+u!PO$wGiL z_Ho7^yW!-)CRUt2K8UZ&Tok^NxBwlV?jMdVnTPFFdjlQVMbWjzRTc+M2ddq>O+)}h z**=-)re6X2kTBkE!7N$zXa8_V2wxi@*S$+xD8xFy9GKyaAcr7J0Ui=V+p&iK7&AAO zg!{__&0yhY!hra6Pdj)fbkF2fl88^pr)wK*=HLo-N;f|TXt6nx3ewDMqh4B#Wc5aI zn~@YoHyEJ_87t5>37^W28t;yXh%8CwDtdsmL>iO#XNq?Jtqsm{w6tC+Px773dIx#rcfk#kn8X#`M&i?hTK-lp{ z2w;?%=K@cRQ@)F>ON&jae(=4aF-CBYxAyG)7@2P>Yh`^yY}*l3Ubyull=zV(E^dIrphiKZPRqRic27Vb7=BwiGq>x%GgTvu%{2O2q;-KpmP|r#)FLZkvUR@8}a6xkq`_%Q5G}>tFmSn>qE(Y|q{hiGD?m z4l;dorJUHGYV7#mawaGI*Xmh$S|HNwdrs}`FgZeujn$QnW4&s!p0nqK-bBi~7qhk01k&@aDKo7wP zn&ZEFc;|0;O;@UO0jy;~N#=%;lxUDZ+)>ck4Y`LT2(y)~22$ zFMwZ_r2=hiQ#h|8H;{`o)9)PQJn#ot_k%wHa6rZAx@3yO`d6bpLv$9hSspE3h)hl@ z)m3_c8jrDqVbw>GcHgnPrXj)v=!5<(m#ur%G>QhsAiaoZHwyN9`ty*KkPIkIPjTS` zokQ3ZaY_0wpUYwa>5=vBT z+-e+n1-|9r*h1vQDY|jcEu&RtNKy#a&s8#HKHP!B^Q#SyV6;3()aX%kmooq^&PgC6>#&&dcxD8!sL*4 z{Ywz#=+o(p6?nh=O_O`2IU;=_lEoJYFx=uEl0(&aYl>N6|JtjV3%~M-SX7}#xKuXT z^&P}l6yY-tamF|0Ct5DU)3D=K%f$5jaJpT$aYNaE^ zUK9Pxv^uYJ9=g43?R(^P0pW5%q>TUvyKBmjTqJ*W!(EhR7NRNv*y#Hqfl2wCDZe8oCBHAaT&3| zvlJ2yK>xya=EwXIcJbGM}s#~lf85_s;|Td-Tpz9SaJ1pa>8pcNw;O>qT7v$BtSc7i4s zODmgv;rgqJ*z=Y$iNATJ%5GATWLIEe!oNfIa9b6s9gr<_vl@4RD}=*+2fr_+bu`6_ zF@G0mx_S}~BF<1amH@b9Pgt(}xye%+aj;mM=&zGognm(qPdO0mAV%%vZrL8A9zM}@ zNs~y$c)I_tTcjl{6m;8d65*NWcYEW9ip7U#VQGZ03u-&|O>PXazx*5{@RJjm^6mVW z4Sb%@P}Rx1dhbajuRabh#Hu*asL$Nn_Cy*Yfhos&8Fm@FMV0p+2akTlb*aJgCar`f z#0+*N@&=oI$CmW7Bfr?8f7`?W9{ZHhT5!53Gx_2p1Kkg3G9DV6o?}$Gu5$AoV##C% z;J#Gi*E@~c1(Hi=WVW+hS9c^5V4^8dx|E^zi;VR($$!vdLRbm74l9@8J!&>|nKX(j zz-8`+1dbM(_8F6`2gTfeHo(=(|9utxn0~%3Vb_Rjia6943msmBaX?|N(8giyRnz5FH?96D+KCG*`qHlYa?T3;Um0`gB@yyX=WU2Kiy9w5+N z@ZiPMSoutQdrL(8o$Aj78ab}U3xa>aTC)ot=tgO`Ez<&rS>lVY$X1p00^se>khyYfv&aaZKce?x@h$?vP$#FdS=spJ#%RjdbsZ z(%lFeE+0@ii1K~$Rz9_Yqup_)bal3Z@!`%`BRv%p zmYt$OElqeHq@5sv`P+|=&q}NOyHT_pHIi4KUSZ!F1AL(~|M9HY3h0}g&Q781 zB$&$NY4Ux*fdzbz*W}9UXswlkS2+@??7!f00$0-i{W9DYXTCPvVk3!u%qJ+@guEmW znhYK#9E*L3&xG&L<;LCX_YDuu4Q!JQfqZvbet*3$5EvfLFkTsmq5|C0DU@T6UqPEw zr-#e*E_@n8*zFjBBZzAFsWhhneBN0#b1sP2I`aLQ%+$k7i(Cb~mTRk~z&h%A;`X{n z_P8t2aF3+EXvi!6z8P~eaMyDyyY;yAA`SQam8nICB&%WimZ+ykVW9$t@inaYZ4qjadl+gX0gw{Jbe9A$8&=OLi3Ar9-qoTew63fM| zMfeVDA*nqcCnw7~8Q0F{Mp5LUA2;$gnT0V{e3jKi<8z{2-2I?+F=E51w9I?vjWykx zRF55uf;CP9zd}l_JG^hlfTeO$xt`Cj^5;g*)-9v0?K&kqLw53~zV~w3i>4i5=_24xa8OeR5jr z!Df6DJ>1}xgRLkPgjdiqi6|_A5IQFjAN@F zr_Y%n-ltczMpGycI`cag%WLvaGhdUhas!ci!g*2DWhUdV&Z@Mr_=3Fx4td8Si`6(MP$t>5->6uiIR1paw8x9R( ze3098h4jWXVVKo_#FD#K{urK|GVp4y-tbzb{pGVyf9R!Y zE`v3J6yW|v!dvZNL6mJx#k`6HLO5QI-?KNYhYGeXzYT}nF8j|~4 z&po*T5Y*&8PXop7awEzT{l5W*dJTR=CQk9Zxc7UKH9sm}iA}{HYKr00$nqd8-TubY zyRW6eaeQ)_vv(h-i_S!gnfBz0l#5ypmk&zdgEXo;PzSJg9&K-_u41ZhCbX=VA$ZL+ zjO>7ts0Y%91E&KIjVe@i{1H=0)0n+=%7$Dm-`Y=P3~A-`Au7i7Lao=E06!`R8zTov zpNTyN(forP&|a|Cr=ZZT^A?$g7Xybcp71E?rD3d5l;`ZzaU+!%N1hRx))$-jwDF53 zx0nQ~WvHFzMLSJ79vqhsX4i6+ghj(rjt|7}sQC@9;%)`@5fw7isVgG$UH8{r>T>@V zqQ+PwWaHZXH-HSx#PhK^u0&-*2<4epr7;&}ywKjb_xU`YC}ge94JC>Ep%9IKHA^TB zIb7tJ9smX{ZEW7k-rv4x68L6#?Ki&Sh@z@ykDVFjSPANk4PL?l+UW9|=-BVL*q^3` zRr!be4bDj5fwtCRxuV4k-j{Ce2n43o$wk!G5XM6l(_FVl5HF|>My@-{)P$Xsj-fAf z&SXDNyr0dUj=wJNbs91a%eJL@$9CW^|d> zXfOX!`4p`AUtGXiYn2bVv8RRdbW*Yly{`;;MmDlQ-p}q&wkXBaAIC%Cdy$ByH<0Y)9J5?JdF(UTx($x1Zmp>I&VZ z2n~F4fK_wfW)xK3(Ko z>ec2IVZ8<-1{_>pl4x#O#&L4qlJ$4VNc#j`1~<3LSvi?2ESoSC&xZ!q@;K(5$9?@$ zJK49l41mUY=0?Fp@;M=pe%{O&YTNyh0NLdZhjJ833Z36t4u`=Aynt=Li6xxaC3kiN zcd8+O1wA!<+~O(K*iBvu9XS}igE2;Y5Q8)K%zqsOb$in#>6+9Q*UT<~aRsiRKOlCx zW>XHRF2VJwe!VOp+DvQXR*?6EQd^lzQwZyhL6+6zQ5gnY|!cBrz${rWz5piUW3*rNmD$^y5sh; zKOQpaKx9ZOy4KAeE1cdDMzhCz2;)89)1UJoObo207aABj^SAF=r>5^}z2~=x2WlzY zffV`esw4^TaX-lV)zsUC&b7#Tz~wuV~j7zIXvM8 zWb||>(YjH~USG;VukjrzbPbvA)M&Q}b3mmMKE6UK(lpk}I|JP=JA3(+;*0gqmL3tw zp&1rr?&_WOCG6|f7MJeAl($1en7JK)Kn}l#_?C3i81jO8V_rGch??w(7*i-xUawL( z!pbQX$O~`_DnZtlE@2PA#<&{C*5$C4#dcB7w@gc436<~GWU$_Ir<^B?)SB8dg#uyjZ zOzc}m{^cvsWC)tMdPT>Wr=ob91lg;R@)H#g$f=0mmmu24$Z<&dLLyJp&1S~(kxo$I z(0R0O(vH1(w#)xy4ozdfZ$rsJvcQ?^H zEyyjZQY$1JWEu@X$vpi$uQE$?sHoo2T?3MMgV&IZF{)G63)Qh;hW$>Jt0i0AG2gtEQKmTj&{_$V z`$C-R^_>PuPtf#iVq!RNcT!{skL2|$HE?TcoT}a-7d!M5tLY6rQl4|zpy|k+jcTip z)xy;&i*bZDG|4&nwqEW2!5k*nr@9GX@2Ts4AB*AAO zFT&k60c|Y1YXIC#U)Uj{v@zuxzvhq`kV(-kNfQDV)IN|g^sZDky88b}$@@y~F ztoa(CZ18g6`_8fe!|mmineNWfa@V0<>c1|f8+0P*P$AU#DK-4o9okD> z0O|yJuBS2rfHjh+ul${Qb@fvdz~TKcJY(WwQL;@YOiPVExo1S?1#M$O z8%rXL?NK5{=pdKOt(PAaHkOpb#T*;2Vh;%}z^sHT?Gw*jhqbp;>l5vpZpQlp2V`^c zqTf5TRpJ)S<+J@EaoEdS9#TcAHwt%!_VKuU-lK2`(MF#ha9q7FAFJZ5ThRN9QHK%d zGF5@V+yqNbOl``e$4<2lctx}rkQFxlraH0Vi398XK)SO$r}6J)k~otEkCfEN&nFhz zpUaGHXgk2Cr~}7I+wOqEm|QzlW4mGVqE?WA%Z-S@TAFLSkR{sb$F!Eu)WNNfu_*8B z!@^h1YL5#i*2wSM*eWQ<2=~-)CUv9CAHGfS+-EAN4IIjmz6n~|3u}EZwL15tB(w>Eq8k)gQ-z^#O9w|5N|0=WGccE3ch3Gs-8 zeT{aX#{>!Tj74;M$63i z=qR@_fX7HzzRa2YB7dn5AT*eMBR%cZok}#&YE1Bl@$jwdWMzv@oLg)iA_n_jUn3Wo z!y*3+1owvIx{FRtxC1=Y`SE)%&t=ze6Drt>7zz|PJ-7L=`RsG9_MJ+kLmGIabKEtT z*RFwi*lXe{%t7Zd&RR~6r%q0Tk1uk=G{m6}wQg0lVC|j5UB~M(d6r-j) z=_k`-W!xB}JULUD7?VP8Xm29r5hG%O6p}`2p^pKWZ9BU64D}MXMFKy@`8tk#2U5Ma z=%jT%plVR&kOQncSscx9{>(ysbreTIq4RA*%;a%mY5l+l`bvb32uC>6K}mH_-Bz7z ziO%!5kQg*B56zQc-Y0^n2yNr;CzpyrFU|!qyJaB~)D1H&Ab?BiAT*CL0al{EeZh*{ zW+ze^m(R!+1r^1G2B?L$?t?k$ctF#47Jm|MF-TkmB|vhjZBa}7EuwXA>=zvp55xzM zYd?f{rNc>V_5fwE4AXkzvARK*mO-Q%ejm4viIoOP3}-eyH^@e9YLqBom&G8 zC{fYT=MsB8Rg2`@OwipgGX=pRxOje1n)hEU-n>7OoHhWEI-LhlF-%fKs<6$Bs;m=JBa)ZteGoVt&?e-#M(K{mA&!nA0E#> z`x3{s!$)z_d-y-ItQxh~r^E@HM{WkP?2#Q`B-*#VQIr${o7elm3@DD?!rzNu@g4RM zdeprO7iUs~q%!GuW^1eOmZy?AuhYx(XP_jt5|mFP4F_k}o}ag9lYa~lN7eV}&*?{r z%L84A+}H9a{XfK|PTG1v>zRJ1?UM%<Z!fCJ7iG+*w*@FHclTJr5-z@$;73NZ8#X-K^8Xl=CE(F|G=g z0uHu?59jpq?w1juP(eRfbZE1|5@26Xl?k7K;F`GP$J5h&Ws7DL76YT^7sQYw=!hy% zi%GUn^(lhF-jR0&Kf4fd`5HANkVd831B5Jq|hjlwGwZ%COOU zjq?8Vd@NGcsgt5CjQ^5i9$|hhDlQ=&Tasl`M_J8=YgYwx5zwJa~vZ#UoUQ`35MLy#^Nl zC;lp#0lJ#L)H^@nagt5n-TP0h%E4{Rq3dBemDJr+ms_re;v~yd?&|dKnC$( zy)#!dTP-i5Uw-K#uE$_fJ*iKNXSfL8|5gt8r~Z2_|FJH!!3XO!UITaWa%WV z)oSt{UGjMjHp}X{qLYHaJb`r%lg$SX$ldlP&{KXOidIjh55rHDvJYRUy}8`qEJb}9 zu_yON`Sf(}MXSBWj|UtZ4Li5vUAa4ba+QIOT*F3{ZWO={bHngn+cl5e^5J@bJplln z;APb7vor#tf1|@D8%a$-esXB97sEmTuW%%BZi^T{b>wx6oMg7UBX}|tpVM&;%a!K7 zsV)U2L)SiyTv5?+$xERC3E2P4HhdIe&!+H+=Q;%FWBkXu=GtC0%qralFW>@f`6PaS zgWrlBHDHwRE2dJ;L^UohEW)v(XrGePp%^623;H4>)Uh9G%cD~vS}yUAq(cobPA1v_ zpO|aZ1EgX!$PXI*x`zWI^_+Mi9|SSY15NDt{YUPk1o8Z7SYGot1}fJ4+_G z|0>$X7vnPJgtF-G$9bZDc_QhNb{`!c61Gynx3JHCOw_L9&fv1S6PB8|qEx=Rx*gHI z(3X&rkB`@*$jE)l11c=E9(=C0_Wbn^TGGpfmrg_|*1fzp^bx5$J~tK93M?8e;gZvi z`~`d9VA%e^hv#uN-geTpt1f<5{|A_7$VD$&>1G!QDnnU!eyg9!TjO7vmQKE)TMJJT zcIug&B*4W?#*iNm^b77)0e4YE)8jq0FgdGP#OmQGH+>NJ+V>N=J6d%XPrs1Z1JV?7 zP_KzHpGL?=VKTvuOEY75@jt{%sh6=CV7xRE;O5D-cjd=D-%Z%)zT7iAtD0=s%b;r# z&^AOY7Y;sz04oU*W@YBvG7@2< z10-k8UIXGe(Q+Z=*{j@b1?S<;a?YGS7k)QGgOI$5;f` zWO_nMt`OXFA{$3zlvH_n>uyzFy%@oT$<7dQ8Hgol4V{V2_&+crT;}iihPmlRFgJ5Sw63-TOjAMZ8}Hn!D7N&Rq{0wmq|Vv+k!fl?$(kx?0jQB+W46uR-?=` z6F?VGv}$)$Sz>}Dne^xly7QIxRqnnPaUand@ z!B%5P7a*^EPUs3fR5Ff#{t`&`>0Sr7%F-nF65q}Z7ELe%o&6n28U4}u{swE<0WPUw zyU2=3mtjYM#sLH~!J)-ewN?zHB=~RmfOcYF?nt$IYmv1^qP=NtK2r+Q#e-0qbBv8m zR542@zrQeb(ssxZga|uxBT3HZ9ykT}ie4Itiu&|I zZGY*mm>%Y?+@PiJC?Qn;46Ifct20^j`i!Kh-lt)2TFj3dcQ)y5?n7<&gA7Oem6(?a zLQ|7FuJ;wjE^`3^K>UVjf-S8hP2TmqNvS{5ee=*i!mF|e_>mw!H5OpqB;#B;hhhez z)W5lA=OucDMTx8LXLIV>Phf(&Crhg2a$R0*6R=#vnsBBk0@dRa=-%UERU;Q!%d`XOFV8 z&ep2%L8h$}5udtZu3#_122NYsf_hy$jAE=^ys%(82K_Gf$_-M~;{yvxh~TI~rP}6O zGft&|pR{C!Lj!r7+EHjASmRUbOs3V_u9#g=QvzBv`Z%39 z)EAC7nG@(`-ywoL=2NWAp09HsQu_ONkre0Zh71{lpqY!@=k>bk@$dcxS>F)o`82lz_^ zv}sj%pe0l<9%x|3pr7HNP1xQBc-C?`vZbwz*6L$mzawK51NKPILY1axNLm0}m!r7y z#$8vd7wL=kx@uawrkqAJV2lSl|q3!@6qlDSg}cla8a$QHYZg? z;b$U1#k<`riQ=nNDA9%Wa_9!p^@c3#khxOo>uptF6k@~KS8F#Gb11fLhi>D#Gf9+vbQ6^54n8m9`SmJvf{ z3|lANl1z>RS$XJP1MVP%U+ocewdR`9%Mfp6o`_}Pp0B@Sigd;Vs@*i<;KW+@Wb;Y? zlmK>#Cys9(;?KH>^?u3t!2CcQTQONbAstOkT}hRf3go=+@~I_?_|C^GOG6{+)%$Y5 zzO%@A5LM113%u+HSa2WZv*uSuEhX?V_M??0YH>dVW-^fbgd)4ri}19C>~L>jPpmBV zCdgS9RdD>t5A$+Ei@Z=8Vkj*biW_!e7B28p`}|}7R+E?B5K>F+{(PRyg1jfnk6!A* z4a;QX3bP_<2OL1qO}%5iQrV!gtM$qTKLbj#PcIOG502bRx%U->&}m-y6We%>${ORP zQk@!#=gB<9C(H>)dmbWc{nkEGejhz}3AoBK6k2nBgAlJgYOPi3h|HnVL|1P98mN2G z1X}@a?o_W^FQlJRkEJIgE(HjwqP24hSJrnj-)MH!Jfa<5q?|KTznFyzN?` zu#&4M3?fj_ek$@O;?DAcCZl>W8c1i_3(ZSYM|JccIioQEp9Dq;7rT`SmwlByy92sd zHzG8)p30|xWVoL(p%n%)0@)*>07X2>rFJK%Ng0Z|mHRtyhxZNuoxuH4L}S5Y6{#Ecj-*(j~^j3I07g7Q}H(+v7Eg%hJ@h@wV7mhpJ72ZzX@aS zb&M)CLG}s=vG+BO^lj|;wECH*GWc&+hmT+r3ri(VK2}d0eXMZycN@&%w6-`MM$6+3 z8YXw3cF3r-MD{bq90M5@P@--255Kb~CVz$ub7GWLQT#&~?A--#wg!M1{oUCa;*qbx z`))R4wma>;12&k_D!{&Gd6gc7Z4@2f!q9vx%O>RNdeRX)+QuyxT++;>pSu{(U&q=k zTAhs!8g)?hrWWE2x{?CdF#>8T7RgIfY^m=@aGaY}9Pw+j@j(yPv>ZcqBV4}MK4btO)ZdZ)gxFOT)z|+(*#po@-p~jT zc_c0?b&X3C9TtW-B~!n7o+i|N{n#0e@i^KP?cB!U-5b~Y>bNOp=pYu`N!7gMZ&$^f zAB=_cLX!7-t~>q*D9cTA3N&?Wiiby6ve)QLk*v=Srbj zE?3Pt00y^2K!Xk%tTG$;N1>q7kpHb(WuqKszNE>KW6?|lr2wV6>V=zJez+ypE9Y5} zsW6pzzuT<(xw{)?PgE9QD~xy5TL%9cOSjW5s%`(^QsCoCqJCmpEyaVt@Dz0fGgGGXt` zJ@z(xq#Ge$m9Kr&Z3cOfaOv=hdhqzDQT_>7vHafXq^_#<58 zcUmv#LyUlsxbcmlM58x)xax93{!$sZ!mYzUm3Kvv9a0jd7k(x|gS;oRag;0iTa;^1rz)l(X)msf z+qWJU&I5sj_Ah=5fE$~~Ao9-gfEvQZ(Xtk*g%9L*@?9zTGil?ir6Yr@V`jE{3ogJE zHhil}6utsJbq~$3E7Pt+%abJ0_s89~)Xq@_QwMhzipdwmF|FC(%XE{`K^Fx-$)p>u z&x|Cni7!F?O`_JZfx4Dcky`V7VvFQ@R>~n#At1ls2A3OG$65PIq&eO!0`jO4+d+rp zP47R3bjdwv?k#mKXqeFo$*3F!Q@bcr3w*R@Db=gtJ%#_rrm}tV`iQ|;A2g#iVw0vlCzU@&S{SL$t%H-O7>} z)e|CdwM<|8FJ3lSdIqv>NtJzMSD*dn5AEjO_*KrSTgBu%gdT^ckAsncx?wAsh5j%8 zQee&3lw73w#PP?$-7x%`w_vz0_C>jlECF>pf3!W~B&+PqsgwcutAbf61X`sZN2==Z z2a5@V4@47rijvwgCi^$W6rvICJ;6%Ys%;UEo6(X1Jq^HY;a;WG?HpQL4p?;99#~ZV z@^#M|3{5o2spEVH#f&%gfNILUe=PT%Am)vN?o zLMRO>K%^EqtWTdju={3r8_=Blh0P0c?08gyy*M~uqu&K#83BdYpfLGgt9FluF|Rg( zMX@kQxNaBU0r}I##TN%|gGKJrPGu){J4pWrm840ANztN9xoP;ajg*W7H=)3HfF|bB z*kJ>R!S`o5>WMb~%0G;oi~~l3VZd%iBs^8lRuodD^McAkcGN7Qv~ABeqUV(dAK{d3 zV{*TFqIx&Q4#4HizIR(6czI!h)^+~Q~(z0m56E#lNf{vf0WZR9}2+ZQ4#)=z&^mPYD1^>vscwgk-645a!Zc(~e zX!);oQ4v;-U<18FW=#5$p0OUO3!CP{1`b-9NBxew4!`Q}evLy5ky3@;NB|%Ad5oij z=&BWz8=t@Y$YAyFRkO^=^}QWLu05zk;RKX`uAZGZ4Kv!hN=@I0K1W1EGj4Ww#gIKv zyJ>&R?5?*f#G3y&R6Psh5Bs>Y`KmKLOR4$EG%lUJ#8#$ovwKrZl(V7VHLse!?M(BImqnlugD2 z7vRZ9u%q{z_1>1F@q&h9Y3Db;q)$73 z^XH>^UDR6h`hB_|WIk!X%H{hIpB=fPSM@-{Ex=~|u+ARx^P*ztj0JMR7jdddu>00t zdi}wjy8vu1Y#wp~=^LPO#Rk@1sa04}qfz|p$(ZIvJLgkK9OYFI7Rui~A7-5gFm9tV zqTP!HP%x`$?)E^uyRzTDKUL5)d{I~msBF;<$3#o)>Z z;QDK4?ZDv%|NEB=CmqT+#a#bege|f%1PFc*mVY(3$E_4|n(8f7=2`)~Q@-Y&^CWWc z?MY08B_XEh=^c>zB^ zVG#@4RvEt?%YS;X`woJp@XqszQ@!Iw*K6`5xC<9nWu=?`L`4{sJm({fUaaKU{jY#Z z1BFlR@$8F1<+H_U62WSsNt;%6Oo?q6af7LW=A%uq=H7V`qXby;i034vYMNRL=pY|7 zFPUGD0hkP=X?QXO&^Bj#Kz}>eo)PsPBg?CoBkQTw1y1#dmH<&%hB|G>V?x35ua+KYckeRlLg=?@E22m%{-^JIHKW;ELraEMzyxoOtW!v8Q z21o@L%W@kdS9HgEi~t?PX!jBi&VVBv{UWpAxxwthANLCmmae!(eav4uZqE`7C`6Ro ztX25Qsc0bjvef34k58-rrQAk2MAAvpu9EEwe|I2tlf$2EEB(dm`q}|yV^YUFu@ z*(YCx>Wo8j1xjPkY=$OkkzGDa&G=t{2QI`U-%!Ls%CIDhwt*xFPJy$8m!eR?Hn}B@ z9~WSuOcghjm`9Wy%|iH_EqWfYuEnvj%yJs%Rb&E6vp;Y!<~Xfk(4(-E`m0LONTYeA zMXiw=Y}eDseZz&1V38NI4iBys81<-0=(jbi_BT3D4I1oO`f1n-goBCn65lmGUwEc= z@Tpdx{SXzEBkS@n3WAA8!s3`+#t8HSRXzd*azf`xIbL_gfbACS-+oy0fxDLM4>JLw zo}NGxZH~BoBQ8n=q~Cb-R|NYzl4N=Cx$sGW{LUkPXcmTWPpe(+Cd@7CE8cS(su*7N z`Y6SGsC_ky{pX@akECq)(KxsI@ z_f#n>wC#VyP$~T5sHlDicw!#hg{PcbkeWUtRHq zQ6vSlLeK~eYm4gAIITelZlIlzA_3j@F;FxEO^`O19gW`X6A~zwxNR(Vr0EJA{!iHj@(s%7X$lC^B(-$UGV)&qK9BC z72pbjwR!BMEb-d!xqb6@QF26aBpvh8tiQoSYUY@TZX(r4)lZ@4+jMS!eMS)1h#ei| zSO<9&3?+vY4TW$#wmyK8zsGjN^XJP$MmHbj7q&ci$5LVDs+|ieWlvAk+Q9=U%nvBB zrBhzT04W+h(=7R>0Y4Bpgpf-ODO{erk8Fi#w?Kg=oZUC(o%@b>@C?GNDzE*T(9;#h zTOeOvV>$LL*T_egMOHAzP9&Na(0QixY+4`g_zeDy^|=721$>)AE5od z7OU|o!r4yqTTHkph-P6zOVJDz{%jp@EY5DB{2G4N^(Pl9I@4p#KLL3l@q_ywAm!NS*t6iVcqMfiF zr*I$K&ar*{X0Vz!C%BQ5=b^a11YC^Vb`wkJMJyVZqw7hRYyM4e;bqSIr@F6WbgKJQ zEglZmO)Qm;TreC%WfVni>t}MHMJ9s-Ko#aJCQ*+-`T>vA!`qp!T1x*0A2{y6x)OYt zq6H_9H?hkDXj=3&be;czFa_U_V0}vpeU1*Q0_i`G2qeWjy#yrx{F4su$+YRvrkc6H zDk$`tiM>7d{6mJj{Exo-IuM7>7cwV(b!k9$HJLY({eRC5fe%(vUc~VaR}C_k0osN~ z5y|NSbF+LWR)Bi)z^l`y8z8lO2Zu)udgy;K{%Y0BfeC)B~MAhd+ z-a3-iNXcXI+inZsAxs|h>D(Y?Qd8nEw%`xfb-oLWO_qiKJ;c;5%=Ep9Np7buzl}Oc z19V#oYBY4w_UZqGI00=sx^IJ#d5ECp|BaUc9`6`$T(tK=gfT+iIYlyVNIQ!ksuyE} z*(U|X`8MluIExM%I`w$)|DNIlKU>SZIQx{zmnT^ranaIb80aoE`iejV+<@h5puno8 z{0j}l2BcX7Kgxf>_g@4ihbI{&nVx^r&-Qa+uTpz8$>Oe1EG+mZCiEUS9Xq`6ogVO< zsAdWC{BW{^Qm5V$^#?I>f{E?I&m+6o6;6cWO(t;y! zmkcG?F8VX{4HLCpG~%xhjsW2K2S#os@Lc$;Vu)8rSAG{v+M(T2a*=5*ZA#wyEZ4KRlI!)` zFb;48R;Q53PoL*s69iU3Uj5U7m9EpKBt_K!EfpH1nYdMpTc^n22`V~Wph7|aSF@_g z5_8+)46u%UkfLvEn}KR}dw_j?O?;$jy!Jo#1zdp(KClOLY&~MOCfkty;esRssulo& z`~Wzt3{fGAkeOcH>k`&nLr;a_e}L~F$N=8#1px?yy?<~>9s?8B^tu3JI?CMgQuzwctm}%D13gn%VmMCKQ z3`KyAdq5gRwu6rXU%Mh~6{-HmqCXS&>a|+8=9`|{(uHyI{2zO7{TAigg$)k_D5Zo7 zNJ~hApmYo>N_RKXozgL20ZMm+bazOjbcb|{gyhgLz%cJU=ziSqU+^Bs_w8RW@3^jO z<+;waZh+67^VL!L$_J^^D;%?oMUxH|oXvx$Y)$foyyIHN15HX%LX=;f{C#QQpr^s7 z>$-;|rfD(5cZ8?mm~x0>Y`L^5Lab*r|qSF(~b|P0V5erdf`)S)-Kx1U%37ngNVVfJ(Rx?+TNmDZ?*JBd?TFgUkiT_$DMNPZSjF$;xqD|3{lbso@k@U42cXA2~hs zo_`ZJ*%KCG+2!b)&dK=T4G8RyBYO?@Q)~Zx1$ZLqjleKm{v+{)KV+%vS7>!W^8tE+ zQ2f3Ru+@1B@SO{DL^YL=ZPiae^8I@;$;cm8QF@*LH<&O+YkeN!{<|)4eX$reScu|h zad>u);?5=)p)leh*;%R`j;P-H;kRO7dy^lQ5bY8SAHPM6+SWdCQ;fMo6y{;42@ zDLfnRGeL#N!SOIFTtUk>06JCh!0_d-S!w{-3AHVL`E%^w21FM#m%2OI@?fY~+ zhHtR8dT{#bqzoWKdx-$RUd9PDXoJd}G(S%kEd5jYxi%pHl^@?+_&4O<%Eo9VNCk&p`kYXf&DnN@#8Prx0{4UqK{goL}m4@B;_U6@*`4gLZtZ7dR$- z8{cKz1&CcB%mdnin;LvJAThR6Bz16`_3s4a+GxEbC`;wr5qACC6@VccnL#_~#Q#v${OicsKz7AT7 z>vwO5Pk=7m7IAlYs{bz`4tMa^3+0-xa4%m_?^BmeM>S{Gbm|%uQ2^0MdI5Og=A>l)Sr&Ah4(wM73Al# zJ;zcjbNuhUm20h@V2hG5-wDxPIu5Kw4C)xbrhE#oCNn)|#DQiG44fK=B}*vq)T8`l zJW#M-$GRR-ZxhQfbjx0!(b6t=$+DAAa^{_ zw#1Kr%My!&PE7;+2EFv1UtfF%7=dPTmf|PbKzyhU7UXp^e9(%H4tlwrtc@uq^sm=_ zr+W>6*ZtBke-QTg?hlu_5wDM~SICEVzY+jiLc!u-ScCKjn9W$|paAauzw$s61g;m3 zZ4!^=aAyeWiA$<%`Syib6Bz*wSxuDzGUdExzlh26^IJC)E9bxtt#3&FKD6iFqm%Q` zyEP#_m`t39K~Xr!^zZZwnhRRdz`2m&P*mLTTezDZGF0*k^yIH4_7gk9D7vhjZTac^ z1D7qC(BRu@($kMw$XoPUNv?lHvX#wd;pjPyTh`Ij zMJIZhuc_~-PC=Qgg;#;yu>-3NPM5ukTs&{)0SV{so!7sA*7o;ZvEDsxoxwMaV|N$C z`}|JyLkugWg7V@xf7orGB8)%~nET1sdA^@Ww@;uoAoufT`qyJw4OhK(4{E6CNzxnp zXNBb9xaAdJ8Y`KAIPI9I?ERcII_Mk&w2LgAi~+uL`Ok&^=QzJ{XXQnjjPK_FhP9Xx zMu0SWP5TfqC=Nv)wje_!x#mCr9f+JHx$^c98EgPRzUEa{(8cF92w@=d2N zp_oJYQtxT(|DK3A_HPVW+*CN!1gPW+s7y+qUGf(!sRDJ2fL6Sb5ruV^2D8Tq2nETz ze@Q?Av!QA0-7J|wz3^hQ$By|IN5@;aze3s|!`{k{Jwd_*l4W96JvrkNLM1(N3Xj0~ ze~l)+cq`e($TmZ97$g0>W9~F694*fBn7gNh2GjwbrH4xoIlSfq-2gpv6u|mjA-~QA zJ;5gubtMx?g&NRCD}cyx%#f($)>uJHjuFYeIpB8?o884bq}?UonLM zwr!WxdYKP*A}1HOcTzg)*$WsQFou zuI_}?UBHU{!X{1F#0NRxiXCxK68=5cV75I&j+ADzmFL?cs)j#0)w+UskQc*iF@c_SF&W`OFt$W)e({vfE&~)1Qy4MlazsiEN83f!i7LKg# za5}J_udEW?f8VYRvnXC+MZNJy#1AhIzQop*s|1757hmO3z&21Ma|K`6p-FaeuoL|q zDj^x`$5rU0H?SzJJ{n^_yHM*H1bBkR12TR96sBbw?lu;sbsxvN|G$?rjBh=(EBNu& z=!kg|0Ec32ba@5>;U&aRes8uBLn}zEh=Z}`f6-FVojqZ?zGI+cC8)3Q+dJpbIw^$| zy&oGW)-)lpA&BN1N!ai|#>u}OSJO+cx$wB8T__rBxHJR+hobWU_wMIl z+W6nSr3i=NTW$@NX%|~rD?$sx09gt7P&7Jf3f-9#-OD?- z9=0_}tTY>Sq~4Xa9RuQdrF(lfL7MD51sY)h=j(U+?~m~hnV!x+UnAPdJm-|sXs3%+ zFd+)KzdU$?8ssi2e?Q`%5&)2w6=6~h$fxcFX_}K7Ist7cF2UwI1KJE>m$<_*1q6Y4 zt%sqaoX0-`ZzxRtJ?$Q%?#)RJJ*S0jf0JxIkD6PS>x)O*2{Dtc0ELo(&Od;{cy)o4 zL7e69C0zH07j=-=@M3%piMuusdp2jqq>{ULr~-a10x+k$&h2+nlgR$9Ct?{G6Q&J1 z%@KLQT@f}CIj7tyhtQqhrZ6zc?*u^^mAH%#dKAK9M-ul3!UtsZ46AWPdKclj#qvob z&OvSnK3!l82m#2cQy9GGK2Rhx$fyXRG?hX3r!0J}JV$)vrFbqwu;&@C(Q*xk z*qWX&0Ahd*zPPx&xB;4@bFzN2ks>9TO!3cQ0YXl1`FOXKwm`yx;O;84O3p_Kx+mF+5WM_D ztOisyuNuV}|7Bcl7mXry0%iuUai$9rK2wI~*UYfqL^I(HZ&lL&yA~Qnq5t86)z*=* zsEgupEEatYsFCSMA8vupE^2N2^h+UBf_ZrVo9u#mQazAsY|K@xA@e<-U!&3O21}nc zE>7CGMQlJzKeA=?6t*v_?&5-PXD;9RpQ#tShv^&XlW|O4pb1e!nMx_bZn%$Ui#^oh z8<2>cVeX1ve7k7xtqvew6Zzj&An;S%U$kmEqqMLnpz>UAw}}F;i5Sy;;66U*ghbSi zpjJ+|^+?=imX}vP@0_RpItf29LvSch+|G{OJdx&mRa74ly_(p?-o^Pr<_ZJ|Jq&zd zsbd%IQ%I^+UDv)d+IO^D9dpk!{q$SQ{=fahT6S`Qv@(r1b%etWdH9r|; z#O@4>)-P(DUTkN-(;o%4VkDn(`3Hb$At^k2&YvfD%*r+M~8@_kYvbi%S! zw;1&&YpP3PWEn(&G~~A0`clus3ggJcfl`a_dx(zv)vgfia@;F8e(R|CHe1EN@F>L( ze}Kc_A8tL|Q@!k-r?VWM&)!3{cRiv3=O~G#*`ly}I)D)M6d>H%0msd!Hmf8RjX? zQY&anQ+h&Y1Jm(pCWOtBA&xA}#Ky4b<(Ej*VaF|7+lS~nfskP|KSW&S<4UVnUvor@ z-lCCgHe+9$9{#Qb1Ar`JE2tHScN;{(^$Uv)m3p@R2(V5X+w#a}0=YV6l%2zsx&}dm z>f?el*Clt0a7^&$yQHJ?$jxZx%kMj%IO~OeVHI+N${^i?{hOIZ=C27_bxlG8bGxxE1#Wk%Ai7IM&DD%q?HAFzKBZTdWWLdEK!RcH zk7g{F#!+0`%kO#&JYY_%_@qz}n6(7I9|D^^ zl{ufeG3^FSSM{7a_8aTz~$)6rF0`R%;u>qzMz6%XOS?eOuh`<)p zr}F_^61RDMH}G8xtTK**KhdZ^3$Esn&0XWtJQQzBEFb**{MQ#&XT9P@)?>M zqdMXN*8)7s)3oQhwTgxd9AyVT?oaNvk~<4-rW6Yp+=cu zF@BVobh*&r{NB1w#^FN;V`JZC5|@XqJlaZD-Z74@&oErK)>nDU2gBy_;c4B#cmnL6 zq$jAOYR7p53ZIfu_$@|`cP%bQR2V<5Uxuu?>QfxjaY6<8yOD%{K!*;@MBk$$#~MQpLOR&+DC1Vzhh=jmT7V&V<7fd9ceI8u zr`!_xTuRLxh%gm}Y{a34(v){c&|ixr3rd1%dF6l0BrtuEZy_o55&YM5Dwl*flhrf! z=dE{NGk53YeEs_QNL~Ncl4$Pyk82kQXm`X86X^nCl7fr|cj_d5K#%WH`V--I9_NR|bK=z;D4I ztQ){DNA6?iz%OXd$`a2&C4&?jK%{Z~IdONioq6ndsuw9|`vty>9*iXBM9;tv5~MOX zrdNqcA_XGLm}n%#%pOO*dp_|N!kV#M$KrU8WZJYt=d~IJSg^r_8zVEKU-ovW%L^p} zf@inwo^|sGm@O1;A-B+;edzD^I@Otn)uu5jm@U-SZ)&7@Mitc7H%K$z{x9SBFXQ+x zkrn`&^qTx$PdtVp z$3KT!cXp?ZFvpN(#!zMIiM-^#pILQj({GV^{7O3ERc~JWXo0rpkrn(VRn(Jl`%8~Q zbMx?T-w!-52Ov(qx`U^_3hq#^7MW(p9%yOwVIudSbuX7r^oS1qfc1=={YXUM<#uz8 z)x;d-0U0o>K$8t9-z|4OsOlxi)A=r_&QNF-{c}uuUHd1g3hUyKb=Jwx)v(DPY7S_| z0i&dZ@|&2aZ!Sm7J}C{FNz^6j7W462Hi>4akPA+Vo-}G#b>C9X4!r082&kuEsaPwM zuwru9*@oEM7xLDYX2^XROqbG7qBPp$mD1#$c_MhOq<%yHJe_EHuc+V9=8?4h@Qfa3 zB^mkX%sjz({&Arh&klzVRT-iY=AIM6#i0LzpE*mUHGMcGDiarQngiiw1f;aPAp`6!U1-HF8=rUJM4G z-^qOu?bYb*C8B@zfRdA7AuW^jPJ6AkS0xx43xP(;;D(X%op;w1i$FaZ^O=9>VBCEN zP(4UN@3J1`zqG_8YtWWRcztYHVr*tryt$&Yk*~bmJsK;$tA*o!N-oUI_fV9UPvR;~ zS6Z{Oz;X9y|6P-OiHeV?mnfH0=m;Q+udMLV{pM)iYvPXTo8n7^M`Hr80FzMxW_PYOcdfEsC& z&o{Zpn!W#c(m6_ZO>6Co=k)G#1Fho#718B+jaGl4YZcg}dJonHrw~0orO6#pJ-ge7 z%|FuE+vZyeZ3wN>vc+n>)z!OK-*_qSuN(v{Ojfb?9ZG%xrm~ZQFbe9hc%xc-@E4VN ztk%B(U0t3?Cd;M`#Pi1~Z5LR050>T`_xyyN+{2tQPKzx0-R21_J#hVjNf00`RcFF& zF>q;V6-m-6nTSI3jscUUiJbRs3~AaujXKp~vXS!>waP(g4n0FSGguV3WDh&h=p!4A zo87p}ymP(qp@;%+W}T)JwZ;lj_icY!Fp@P6XE#r}q2(9<&u_&EM2Di_8sM_B;unGD zlK%Cfri=oDA_}hImXY|dtOs`vAA+y2-1+dXw5c998jCk>rW&OA)YQJEy$PPc1ukn2 z!YZ?`ZB#ur4dvG8KH3r@eA;T{pHksI2JJf-t}RXQS6$^x#7}PMEHua;q70v*Ewy~ETd+aV2BGwEn(c6)PKYJ-{6;w$Osn~F=~Ww1 zTn`^2O!BhpM)~dbV6jwiL(>IDqn3ZQx$d5Ls)qv^7!%korogbML&Es|*%R!Myt=iJ zP~?*L!4d_=GrDxOIN{#&dB@U@+39qqC&greAAu)`KYmZweLgO8)tQx|&=+9WJQkRA z{%xdaEW;f<)JJu1F|5mYas5DSU$Mv10jNQ~o!yg{L)JAJRIEJKpx3Ct zE^fVDeB?$HbT+X4oM48xCd25`+~&pOcaN~_vzygqhT=MuMA@sOZg~JRd1xg3^_

qK^WXmxCL42bk%Us`xZq2B=L`CJ`HeYG6wHgY9g};*ZdB0s zXMvVngDqAdsWhEpwR>Cs=mfRKOfnqspE8xRL(f0@m#T_wrHQgN8mc3<&gX?X& z@j^TYdF*7YzK-4eAbZ-Gga@inD%gASSYttNi$8+={f`Ws-1KuSO->qQK4jJEu&%mt zjiXu=_>>pZ@M*C@VFUdu+s^h<#=t%m&GoMJ$)fJ)R5Y=NpK*MV{r6a3b{3voeG>k3 zDfKF^#1N+-RBR8UN_&g!c;mv{V6R~bQ=z?JT-+%CR$9b`a3gt9rohM7LfX`ev$~a* zd55GRylj=PuyMEQp*ZufmIoLTYLC#>BxugS+6cEXo-|nUV>h2YR+alaqzmVlO8KhG zu5}BLLO-(FhuT(1$GpS)s2ljh#$DKiq_&P~vo{~Jl%1>I_bWkv)qdkx){Hw z%*e=goI!;}Gpt~kImhHazA4}gorkIUGPj6r9kvyI&rb^G(jaCfH6F|EfmhewiZv*i zymzB7U=p1LuqpRk)K1k{Oo^rL-M(ePg9VV)D(>WQX>-Q$2=9g_c6VuM^9xle=YE_o zzk;cVqu7pT4;|K3jExF<8z!K3`MuE$nGoVMgNymE z2kQ{zSCePwp3fy_wYV|eKdIUqNft_01FGYOrXdf1+Q@hEelf+z)onM|`6UOqjkpxj zHa^q93lWVwbds~CaCzpWzms-TC=9LDko$obqH3{efuMO{omSGsn>Il-W2hn1_c) ze9N~d*5%MCf0)-r1Kh%=_lApm#4mfVeO(?;8T;;L$5w97_ErkfB(rb(!$P!X&hJ)! zc%Vy*AnurvspCRAy_m~p-K{j890DfbyL@k0_aciPx^)z2ts@_PQ7fZysv9ZYERl=r z7Q|bOvUqt;7!mCv(`ec&@i?XfL=&YbwphAl)gb%Q56S$4ns}In02uY8Nkb#!k2Hi) zt|6+zhSFm6>s4OWsl*T)<9FC{z;5PH*Y~}1>K%?o*03a3<}SbBWu&cqKdBa zW#KK0abRX(4#GE1!+ya!OWOw*I3|l@BSL&BYfO_#2WiO&EzI0t*2zYpa>HKZ>6La6 z4SBX-mZj$O6@DkzLQ1y84SJJrK$p`JR+eed40P6cxDa^`gbk5+@>8M`o3_hQb7z=! z9WX)W=}8{qDs?1y0CRA6GaFKRW| zx@}8?i$Zr1Ij=9NS)%-P;Vx@OgK2Xy)^I$K)4fU>#QoE1s>s0h#_`J!b6eAI6tU4z zn_MPEMbfBAMdHnWskUR#R?tDN5bol-8>z84j-)hzHi(WWUvzj&uMmleTA2#xHXCnj z>`V6R%tQ>f1n-EAV9@}>;47^A5f%OJBQ@poah1go_oTDAx_z>ZODN-m*vdmFQ@Qo5 z#(}BP4H|67~&4^Ow0t4iHsV?P(%1v+QG-u>dN>2wwVy;wNi#Wp)j$fWXE z|KKQP?E7$XcBnVGK8v~DbZzx)VJ%S(9{UYMV<131WW8-gX*xGGwBnkCf2PUy0!7KH z!zDe=`dCl$exKQYvx9tb%j(d1gTHI_w#v%ms#Hcd1hOJr_de)u#(G=babcX?_l?&{ zbB5gW0n1D%DihO(Rw~>60QI4SEj?=dt8#BWm+{c<$?UevEXtS>h+Nf}u95{C9th_i z+Yk6HN|~V;dqk}aVL)^lX$6WEC(W>jC@y6X-FH_}$xy|N7F^t%?Nmg##o1G0`!~3IxK1+in@mz5#IAl_ruCQQVvGg zlBMEv(;9wZuMh+T1l;~{dZvR-(33exbkRE_v&OUOHX}g3YT43$ioNiG8 zH;5_Lgzz9?#AE0vP^z|v4{7o_=X zuWiwoSPX$z3&WuDC54Dv_a1Kn?&#-FFP9Wsk{8hzEw8VD%ng{NaK`-T*{)@ML$mdU zIfCuURz-b%Mny7ABkRzBVO?_^-Y2(|WNhiI#U%tCdVe3J@VUQ>eCTwM=G8EjsU7Y| zfG7yTI8r#Fxa^Io*=FIl+5aHbsq`sC>G5TrPl>5ymxEbj_DQquP+xTFZN?}??8TNZ z)jS8i@tZIUQxx??O-K$PX=C>u&SDU=0vjZP(-8p?J0Epv&iZxtZ}zu2qUE<^{todrIUl%%*-(%_kG!D zq?v!le~&uMxm*Zy-w2m3(p@Y+y0LMxqkERo?!t(gYLgD~pY3dlJzIkE@nj$N(7AS1 zcCj!ba0O0b2Ldg^>%WG2IiP&!YP@kEX$E$3sWBH01aAs7->(NCKtAJe=qb!JMmkR% ztd0weA0Eqji?XD&)WXCJ1)&MYnhEZn2hbJON${P==!!H;ez~05D`S&sOypAWZ%(bL z9zpd{Z44|D>1`uHxatE|Gb!c05a_GdMJ!haPSwY6f-TvlX(;z&C1(VDVc&W`p%~3g2>D_AF@IO7)7DI zPAxypK#Jn~8^y)tBgV!piZ2J)jcQD;TLuirj6+pi)&RHMIEw!>HlWbxCUvvq)gq#? zk?M=+0F$$Gg=sJ2`FKyR0XSeaN@lPl`NVK*ufY9yz9Q#HOCYTu`9^5Gj5_fIHy>`)gvqw?34C1HZE=Fn>bkoJrW-GHhFdh^T1Wj;56x~=oJ+Y{cmku40nq*VA$zb)3kzTud6cX-IYb15L6)o zO^hmy0cMAcp!;rnAXU`&^R@gnL$zC(=7)N|`HBwI%}6!YTr-7j$Ex;)o~TQ}EhTPH zclo_WfDhVm7{`qx^0-Sy>iV-G;cr_{7T%7Zr$`h=W6No{=oNTuz7-&deqw2%DpPP| zwpQ`YV38K0jcFB=&)2q&YVf4N0+%?BIdjh=dlyEYV(}G{uFCu@FsWMmP(*YQ9f&4& zd)Vce@lr9e@|(eJGkO$x*okl|i6UoWNBHG&)`wN6#2w4p7xPEoOri#@jWd!c?Z!ybqZbd0O|%OKjj5{s~+B$+J)j28BTo4es)JNlmHr zI#iBWN(yMf0HDH5vC)u%<9UffN~ZycO@Od95^;8!=t{l?1b)v8pS-T|dFdK=Y4pLQ z@w&$~JfL;(jOkeRR6IsjW7VTkmaVqnh%hCGTqq+3jIU;t}RsA5mQEtG2IAW!dYG zs`D?HVqzr_-@M{$#GQ9u@D`o$MRPp{*?-U1aXxiVaf<8fdwpeJ`9lMBBnJM`L3tsg z`}R8mPZrtUI4$4?S!}1-z%E5(Z-6d*vIcd_jZEyVU`+?3To+CKVb{uqiM1^qx~((F zml}F6T!u#8MK5!$FehmC4FNm4AD{Nd^29`U;mCqPw^~Hhn_-7`pu-JoieqX1*Xigk z-5Bmc*M-1k09@PZDw^kMJ|pT9tHb!I+8AyazH}QQs?FZ8Qf%>|=xmtM{J~BO(e2`K z^nJRt3#;%=ZS3b2!8=NT<(0-Ydp5! zbZDJ+OWB9T_eOe&^~OyTyUk7-9junKWeN$~4 zPYjhz3TDSiW{$vb?nlY=18WFrW%cUneJCoS-W}qLm_m{%gq(@DXn>DoUI3pi61w8c zEm#SKQk~)so5v^;inVh4H_Lguc0Uvi+5@^5NR}l|Z*k=@&21rqFES%0z&{jk=LQ z)K_zv;`~@^Lq%Gw8$CUS;+@_rUO83Q^Kq4~HPQega##Jut$6^sx-7OnQV0P55CI+l z^7qH|R2jEQnftXqzo+rFt1n3M{OwcNWz$JvJX$L%%%&x=naLWADQ9_siQLNC1dPA8 zzs4yQN79+BVhPUSL(%*5!I=Zk#-G^AbVj2|D&A+e43-x+`jjn_b0b|23-xKxvX`wo z{p%Z)QRl=b`Fn!~Gvd(9S`X;}o)8s7ntNR6ii>qef(a!8xnivHs3r;)=~kW2(*(+{ zJn{O1j7GAuVpr||Jb~2VhL~qm03jmO#DSz(Pr?TT{>kWs{aB|jn-DMju*Zfxf@ls za*h%2{(aI6WFbW1i9%f^Qs&1QdlkChdHtOhniS}B{=^_{RHTx9XODM(y2|>^46WO_ z^U)p6xL;D%O!GN0-8y(y@n zy?Q;shuixA#28>T1td+r`FN)GxBP@2p!CUh6`ftE?(^oSb)srA_9MT98Ney>Yk~ zhyTLuDHk`6$U$Vv^pi)HsMjjPbssu}v|LCYx7PqsgAMuYFCieoX%aDJ*~QxaZH2O{ zONze`XMRJ;7BD90b+tC*;<;O8&=5%QZDZDW=ewkO<(f}%u*euU3@6ai{4wnHR+_Z) zK8^LNk6At!7^_ikshVoK-F$L{W#@*c@~Le#3%ry$;oM#wH^(KekzNKDYXu~>dyZ_x zn+&ZSi!KA+49x)JoOeHB{-WlHYE8!D2TQv*^R(_ogTpv;?F@z;=uzfj>c-1DWTXy{ z6v`vMlW9%bJk7am%7=!|VXP!U%?~yb$(@B*z4Os|Kwp65q(ZB1VGJ^>{vK8-83GtC zT(phGu|BWPymeExmXD1NDesj&(CZYwHhJX~;rciW7cuKk2C|{jaS8EWR=DL;sQ47H zMus3XSh*-{Ulhg#3BAOq0=@^-uoNG6AS9$~j=2Vh16XN(30D{na?gPWtr`{BaO2v* zL^OH#1+=qe)0=BeOX9tsGa zarL%~SlL@7q8t$k(uGHg$G6%+=|DaQ=^aBBeP;RQh4Ru<7>xs76Fn163udAenAk^5 zT?x4yX>&S?91n!1&(T^FSk;5Kc|?$e+-?P^zAQZEG7lJe(plLkJY0Udkr|iXS6IOQ zAZj|RIP1woDcK157Chrg_ejhb(-;s1vS_rqO86; zK1fy&Ve295Z+`W-nidAMQl?`znqQ>Nx?~A2LU@Od%h=o}dF(!ED>lqmd?~{2nn4rO zTNhckUTq#CV+NxhAx$%!^fBMuRX$SA+r2ygOXE3fKBfvalU?eM-ho~hz>L;^s54u? z^Gxp!hn*E_)r}0-QHfN^v6uC^^IZio!5W@@ivgSQtnVFtJl+CY0_cYQ@-QtqLFAs# zLLSilA1KxcvsJ`A#)z{^;LpiaS~emyyIzBbf|ln^&{%oI)o$;WTV}g zilLaUO|};v*pXwf6g1|L?oX@8qW1`3Q`s^DDa)@URs6zFfp&{psNVFKCfTz)^0GW7 z+{A?cMD#0pquKW3|9pL=)uzn@%7a;yYIODw2znBsOd1-&FTliHa24n@Bb=k9TZIWB z?q|8uF%iS5)rrk6)WdGCuy;1^6JHMh1ICA%kH}-;!ZPL z$q77AW7k!*qe7+n$5zw@6c~*{7in9m>Aa^Dscl;H0}`!FhdnEAn8Q|`?HJOGyDAw! z5etMmm6oo2NZ$n-!>Ig44rGxAHS(E2Xcsbx*Y4JnGvPkASc3W7I@TVhSq(5Cb#Ta;Pl)(tLe7$kr)yHxAe zQCh?xgyAjd_98~Jo$b1PaO%7V?A<$g$_-MzVmZMC-tqzS5XWGugv{CINfW}j2^&Uf;Br)DOeoI_5TN);wB)(YJc``Y1A zsFV-x#V~xGPV<+*d2Wr%l}m~Y84&-6j?5U6*V={e<$3JPo+XOP$}&yIaOx!@HaB`dl zHt3P!k!H{uWSW2$`0}Cz@f}Vw?2rt2I-t5*7}ZkdmF#I`&7RT%SwWA9d^BTOlYe;n zCVCLrb)a#T(h?WMYjASK()Hs4uQfSF<|QNLx>i10gHd#52Q$#NTtU27vwhrr43iG+ zKBpieHV~t_hZJwjURzsUPlkpb>)C2BWg=OT6bpjiN6aP)w461Xjz2;ma8dN|;9u5R zRq=sT7P`alrG7`@%MVhZBSuakm3e!4PD5WO z(fm&5TGA2DyRV#pdHpm?VScqiL!Q%3_9@f~e)@<7E= zAhcPAmSdSj>pM*tChzSc#d-}NN|1Qu8d6H_HoKlnH)`HWw}D};&GO;Ygj*i_K|Hkt z95d^!_Lqyu{L)xRWGyY}%`ozlDOxlaAyGgo{uV~xp2liPFjsy{!rz2HE( zhjNT6AkZc~p4+91DO%PplI_W*L31|FFzq$R?ak z=~f@&Jk31hJOH2u00nsDpCvqTx>7@Syv;HFHEgiuQU7uZ!hv??B750X!(Bc^udh>b z9h$VF8acT5X&9yjG62S_?HCXXE2nWZVt1otg((%aEt%Y_Eswt@nslhJ^XCHa8*gFG zM$j8)7NZ*_Qb_TNB*k{No87%no)p=n@wAdNc=W`fiD~a>(ma3YddVtvCz2VEUY4a^ zJ|BDL#TL6#B`K}>ur?Nd)}Oe!qQ)xX3(74-Lms~E^rz|i>krMcrgE|=*3{2S&Y3hVzsTEwBLh;QOBL%Q>M$ZypX?+M+}(iKzi8QM3J^0Y z_PdH(X=HAxWfrd6g~qapsn&3ob#ft8DKkcz~<%~*Onz4Y|hj68{(PCPa zP9k!~J74nsU8Cqa0TjNMRG?E^f#Bb`Y$8Y62)yJEimv@=Clwlb$!hsa_gpl{)k=!? zp$ZVvE!lz>Y7r8vFCnm5hy)GBRkZLJB3UjX6~Ocyy13k=Wyg6t7~CG{W}AqlD7ULd z%C25O_>eIf)!l&MImaf2FYafH7?1zd$z_4nLnJ^L!83*5tx^TOwC8dxGMmQvdTs?V zG;MGUoy(V4^ItUz4^bXeW#EI%+^Xavh}i3VxlQIhfLnptmgc8nw#$dfwLuDgTS}In z`+nL|f8s3i>CN$+bgN0rjj0>Wi9ZQ@L4I70fO1X@y`TnVRX0n&VO`I>(^2t&8W3<* zLoe9Z%@OwR(Wk)>2|tYBb5o!mI%M>J2 zk%s!_3sb#c5j$-WU3l z<=gainm$c(T&989zruje^MPnsk#ezHOvm?GT4zzFZUVgUP!t-oaTUV719P%gny}+# zh=yOO1z8N-;_Y~SP+>|(k#a%>|1^D9qf_(arKI7=4UiM_DiL;S5|X=y1{=r;$o*6H zm3&ywcf!f9_`$4Y>}18->4_^}A)i8(=tdVK{dHO$tV>7!s*s@C%)>Fn-1t=*`QD?^3v?IeAaomZ=X!PTR$y+VAyD#hGh z&p57r0q^9Py&8;eaGtz@7vXRX!7QlC7S9Su?MU6OW#j(Vqt;4#+_ZA3T}b@idb|F@ zVp5zcrXItir~6ChKt!S00Q=d8-i&?_>Ew^K7G0!EI56w&9NT8v>&x6K^0pw-m&G5k z%Gpy;prCWFi7hvYH)56{hX%;FEvxZL8X0$SL~*D)`1LkzK=8R!({ zZi0Kl8(yDiteOKpOxiFG@L}=73$@h&tIsRIxMH+*0Y4MP`>MKZajHu)cU0>(V640y zs*-FKHv7Tn3w2A^Hzw!IFR4|(%(#~3`#ESE13`KOHMq96h^3$D)a5QhZA`# zoj1I2g7VV`b;##+C4VFXUsQ_$Xl`@0j_V_v0L~Qc_MKW{3Zs8g`OtcDO0{sB(oJEs z^Kv*R{v+k5*GrfK;1v;2{QL-S2a~gRIjguY5P@@`!4iD!DUkyr0YFV+EJs1i`dG~9 z(%GOo=qCVoN=i!*%g6>y-POQ0N^m=9t6gc*R$oB(%W~yldurMZe0vJuW|^)xbB)3k zV&uFFo~y93j4BugxSDQ4CyG>CH2N<4*2>2Xq6y5R1@IsrsYNopE~nwd(Wf9Ws^(UFTtNqkD^Z z?tY7H8bMGZNtUulih(rV0Wd1>0B1XpIxBTrK&j+7U?acqAaO>s{&F4p(_LmK!1m)# z@P#(Ml(-QzGXCN0U5y~)pa!*({nN=Ns8`AA3J*F#KDTo=jUZCDS}IH|5EBUBo9r*4 z^ZL)%sh3@SGp!Ul@yT36Y{!Eo3ZOJxay9HFL|rO7^eXFXDlhfXK?(Y=&LPycgHLI) zzzaNAU8~wHZUbp_M__D^yiBbWp;x7HJjF0w&mi5zl5WQDCUSm_0Q(F2DXr3}=U3KG zo7fNQT2x7*i1s&P2^jjoMmE}CRfu{d(57obFtfgY(ayPQ`Dvbz(0h<7En|rY%o1W! znF()hvEH%{;tJ#AVQ|Vf7(^OH$**`b`wc=!Oh;)6o}s}!d|`E0w<>~wG!cv3J)OnU z#lEp_tpUABtz;5NXfptQf(%04Y8^I0{lxRNTIT6<4v9f@P{%y7?ktknUlGTh6)wV} zbLz=@;iwwi+J_z0I9HSH``v6^BMVc$I9{E!C_{cX4$X-Sl?Ba{ze?fKgf{|Zlpn<5 zl;dN#K)NAL!CvJfn)idcUa(i%0&d;2 z0>{R0O-Rn-Olh9v+nHWC)~V7n@^|qp97BPQjl4(x#Z3VPUHVBmt_%{YngjVISeG0C ztm;xD)tzY%iH#2h4%4ZVu8%t{P6j@W4hBsPrMDCa%VC+EB6N|CAj z!3+9!A=RV31prxzk0VqfJ(6`QR5lxCO2Yd&S+vle4rnGNbD*05N~Q(93^L*t%;RVW zfTTL?Z6JlFiXunUbQ}9p#IP8OjtW6XZzNekoL3{=m@->TRb+`f4t6_B3@8(9g|+ZO zE82Yt(`M3wK;g9l1#jLj1Y#q#;~b->C0OMo5BCnm`=T3g`ZB(l|DX2WI;yIu+Z*2J za410}6h%N91PKWRL_!3myOEOa?mDz|r=&DUcO5{Hl)4Mn#cP*UCDIdUfa_HxM5wkX z=QU*}R2qJ$Gihf#$pC-)N9#Rfs#3 z#oo)trE2Vzbw$P>m14@!p4V_yP|At;khfs=o!kU7G2&d=C{+uMJUFXfyDIc97tboK zvW!pxMIgpvufDt~&xl+GUS{@-tkI8d9PuB=afM`+t+Ne8eq@Npo)KVW!k;W2UxMmk z_T&LU_^#^Ds9fjkX3I2h{mDwOCt0L-%sm>MTlz}#YcutGPo;;K!gDp<3qexp5lZ~0 zko`BUtrlsW^a2p`I>NxFKk8e_ByVl?Ci-h4URz;p2Gu3;h~g@Za<-KC@aQh&17|}~ zQEHek^}$Fw&Dc>>C*xPay-Y53@zprxM>_GQ3z9^jj5*?K_q`c4=M84r*_q)rq8M1y z;5JaK2%C4)pPYZ&M1SbT@^BTET37 zK!5WJZQ3mtM?>H~_w>X$YUy>2!_5MXx5G^XcT22-kx||#2e{Sn6&n%NJ`FyZkM#W8 z3O^m2l)iki6N;GObhh70Y7^gn7Djl#CZtF_!KVGmu=JQ=)exSA36u$9rH;@0UrTJ< z2ZcEqUCBW`vmSD2PcIT#C$9%%EQ8ASkW8)X^t!i5ficHw zWcXbk`Z{5hMzj{&h40*T@rDK&8Cuf8CWomZ*!xt*SG^_k(>k;GI zhv5PhAoM&Y$BxH~mPxZwoh7pYLN8c>@Uzs`x{5oP&`Vetf^+)id97#b?1A6+7jN~W zHRAG=3eu? zb*#ifQ09gAey3mrHMSVvk4k}^^*FoO@J~*qV=uJ3Vm4nnhUuPfYm%> z?*e?H6={X7k?I+*Y|W5fGqKIueL~6bH6OO7^BA-ypcUXAi+%%ZcU}Nb-ysJzlKer4 zy}aZHzUFHhRwR0@%2v0q;j}{QN!sp@9xqPSi$Qrtx;)Gl+^3sBoAOJD93#b@Z4w!X z^@ZTFNL0NImMB}07Jrof8#Uf$i#0O&EZ}=610?&N_dTr+S<_IqM>BT zmuIXH8&J#?LU*EjgTZC@g|!wgRp!lr(CuycHc*#&)f}*)5IswKXCj3W%Wg9^m(9B_ zM!+*u2@RnpxC7hQ`2Gqlt<4-1C2)QCdkEUG;vP$~9GGyF3My_3+x6?@-3Zd9DXPp) zY@~2+U1En>Sn!;aUu(OrCPFZQ-t}{&Pr1u&A4=@w-feHPdu&75WX9=@&3Tjb!KhX9 zJuDlOvv(Df^x3VpJAAge4}dnCYi~+s?bnoI&|h4WNWU@d+z-n1(}L+q+~++CYiZW$ zsGdtf@aKvz@A@rhYSOdu)h{m)g7VHO%|F7S0g4^{>^+K*yH*Pxo)3K5*qr} z-6}x@O-9`KWireayI#VO8*tGd1|Bl78OaE@J%YGy%%AWO~dy3(p$ z>g4#}4BqUIrEeIztpGXlvQsO7?Dq%|0m|)QYr&~6wbdNE5}&oaRb8>Omt8X=Sj(7q zE5y*@dOMeBQF{^Xh1+UMtGhe3*Ps1IutMNB5~u~vpF>n0y_Wpgy-PT%r}9l%yglbm z^PQzO2s}Hon3iZ8)Nf(=iwc1gINDFKB~49;tQ-G9af@(0TRa2)W1mC_-UFc9O6ofR zt8_$xgiP=L=$ebf^DXTPc1-w`iK#C_q}i1Xm^=BG1mI|xKnMvu39=xbsilz^#UWisAWhohklO@w(dahscj|e(Nu3o)&y#H@)W(AT~LZk)~brd zZL$Nwpomno2rU*~<=p@m$)3(Ws$Rqul3*-Fs%|p)nSqLVIrQVzUqw?4mZ6B!V$bvr zhhR%vWxJQdYRavBz%{7kIiQ$CJ~-Ri38)!(B<6uzH;qXD)mLL=th!gPg4)Q_+ zvTr8>r<2Rz973o~1yV8-+g~GC&eGhkU)=hby}z7=btRhbs(P!gcOLG{?@& z$#$9L5+AjU=XDQ&>u2zj^-uF|*86CKa-l)oPBr8gMi$_85j%$kogbO5P*~FxlkV6_ zOaHTC3mmpbg{Q1D3O&ya3tL6i< zTFvQV=ste7fbuxk%b0l*1j_7+ysur{r$KX^;jtab>qp0@XTRrVAjyT(&JEs+bbzY> z=xB~_HnafL;jN$_%M$fJYpo8avUGAwq>-rsUzp@w+xSJBBw%+&j|Ok=cfmxd0213k zE$%^apYm_r^$AB-(;*2@tMW5f)QusVg1{e3E!r{9NQ^0x=kll$zsC>-Dr;51B?4V} zDej(uDg)$%qncIS&(X!0Ut^QGZiL*UX@Pl$=Mx25BVXJ8LhYX@hXGME>i9Tu>sZ9?au3bL^LQi2yd*sC4_Fa$cc^c*Kep9Sb9|>U;U>1j zA==WGK=u?m<9aO)pTq>_fTR{OMwE_h1gDu$GMBB+vT!l^Nn-PBQb+r(Vp;6myF6+M*FU(kf#J$)(o|s5l-E7K9MeKCtvPND>GAtEM zX24wZG2je<#9Qfse_XWD3C>hJ8&a3w&amsh*NMHoDs!04-21o$j{7w7mxPNa2K?ls zWU({|o4|#@&9klr2zG0%xIsy}miJAec~v3Q6iW4UAhgmNpuEi|fKNq43ziDLw$J>F z7%LU&QKIL{6&2>w4_qHEKMxj1@Ywl_EMb*Big4C?dn3R@8~^Dc>c(>DrD1~~YZq#l zv|?|9JGk0w>p$dE`p_7hd+&yklWvh>-;KNX2S>+RW78em4NlOo)*~;D2#lzGLYH~; z`BsQ-2o-+X=&)0Ltdl-25YjFV8Xv%gw4rXEpSW$6weu4WavI|$BcEw3Dt)2uZVZF= zFgf}Y*}lU73@uu{%XE}HQ%OKoCi9jJQ2J%-P=ix#tiQ9PIl6(U)aet%MD95u< z%IeJD_ipTLWOPF5H$MxR%^hR~kBsx~tW{ZJBU%u7?#VLj!U?>w#coq|yoG8*VGS0j<%62&RFMIqC}D=)D4@hF zX#_??^RfY!N&c{j3$cdkyU8dibsDWA1~V$J;M~1e!q-Lar3uDg2bt_2+})3b+crbs z?E0Qek?&EMn#BFziidJ%_O(=h0s>_fMlO;SEu9; zq!Y90;A19u%=ndjCGVPJ+*hLb&06NKru$BbsS8)=gJx0@C`^$B^;Xy&J6@>S6igxEwW zcbW1o~_bmHQW0e!}Dn zWZX+kuRySMMz%s101RgTaR9)UL~SR&MCTov!-X0GuAm%?txN2x?H5OqLThFl>jpWt*6(0EnkvH6R z&~fd}12<(50w?otyvy@VS3+yY2cB(-5{|OheiMCpgX7}anq8#eEIG`G49yoo<@A7d z7VOh)OjggTah6`rPB9qp{K6Rg^s&%b9sdeF$;H zGWJid%LLJv3d$sGRV*ddSGHqO&Z*@re89DIM@pj|>F#yjUhJw4luWmN)g40_Xwt;5(_Or_MAu7NKltRR|ojnj4GB1nohGA9 zXA6)1;5W_j*bU3Got=zYQkpFS^E6v`BCVja}o4SiXk`CopEPDDQb~xTD6uRb~Ff-l}D3iR3e}>91GJ8I`w) z57KAcgIN=Fa@a>reXkS0gWcZ)W*uM(R4U5zAQfjRVxQeeX&krzi9d% z2tNo#(EM`f2fMj<0M@dtt+}~D-&6(q84guWMX5x1v1-!@lK7Z6C#%F<1uC4$1FhiW z{+W;pE-nrl?K8A}e^r%;{;SdZ7gjf;6x7514$7Pxc7fA8hE(!71574V8o`kcHeo^D5*cmgAJNNEMU=%#6kO~oQyAS%d_R!12hh5!& zN`J!7sElZ~TVu#XQZ`+t3IE8*cw{`y2HH2@Jf{|h9TFZmK zYjm-yNypF||BJReE5yGgpioB?ht}Eh(&K05us016#8{O}#3_D}9%s#iZTStNa6@(` zeV#E#n6e)F5*>f8mc|aWa#KT;Hk!Gw(Ywn0F8V1`P@q(q7^y*1oHw6N_U!8Z_8hi_ zzlwan&UCyXAUC}$yZb~eb2}p3yNvvZv9PjkT9uAoy!r3wXUu@dKhoFd{vF)}z`p!P`YZ;?|8dwXEiKLZf#rJtAITVh zitzu(fA)X+0mwh=`TsXg(a4`XAxBlBKL>v3A*xUh!|?!IB>-Sr_-D~CN>9B4NH_i& zMIx{K0if0D zWB?d~{qv>%-=0nNpYi|zh30>CT8C<6kbgL>duLZ*go^!((>jXVsEI1*v@Q)h?wx2u zSFzQZgDi1nlx0lRQ_h~XLNP3QxWCk(6tU|YYKTs!y0CxdS`R(eV>==0PoG|%6du5o zJcNYPSM@nKhbi?EzQb+en)PX!B~JbEDf?)v&UO)X3#!ue$t9ESO_vL^$QSvt&WoBS z<7d}JJ3Eav9N?yClz)H!qa|QU*)|%*P{|eDHfI@WoHm|rUpl0gzDM|j$ya(T`9T*6 zh3vGywlDj|K;Wpebw;8){2}CGZ{Jfs#Y$qdmq(D=pQks8=L@>0%9K3)Z@s;d)5jN6 zEt--NZW!I|s-y&Pv~qF1e(x-|_X&NDK1(Z5rs^Y@@p+Ehqn5l8N%2^cHHIno;~8lR zC;I`XSo^6g^WM|ML}tDy`m`uZGT0KZ0*@~$sH|+NdWTb>p!Fp=>Gip`P?>mP?_!Qe zgkrHC-*kDJ?J0L@J#s{$+9F@PlB$yyY6H;wa8c*g7dqt)iBerRvFV15hW2w%4}LMd z6Klot?t_um!A2r6n|I%rMk9YS8^HAO#!6nEMOMb+tRGvsQjaCKG8CTw;Cy;OW8hB1 zix7le`}CLHm^0Qq#8(gp@F+#A4XYN`owWKJ>U}HUiIwRw_Rg?Qo8)X}klc5?rD#@{ z@UEecHDp#@mIqFoplv(a$=)beYV?jRdw^YiOH2Iwfc&SepmTbXT}5#) zbvZP7nYo)iN8*oDn_|*`2uiN-(;G*duB?fDmE_v~6~XAZ=l5$@Lq&_ue z-ZXdwG+AXn+TRgd6N&8*mhy($r3>GloX+kKO>7-Q5+mq@!S^LF%OCk%P-N%%bitj@ z(V!$tQgRbL9mAzFHje(qbsF}m$=k%r8)O2@P6z|bN;(ys;wK3)yLU>H>F7Z;O*Nb1 z?6H$X9I3sqh!lp8%C?T{NWX8Z$-Co#>z?km9*$*T&KJJ@d@VoA zH}odGKl8skZ-d~z+KB1@_|~=MrfgJ#=R8c%?8D=F0}AMi`#(+Z+t1I|n@m$(7NphZ zr8`~ed^va zrp(c!iz$r8xV0-LjVW(XecOJyeW)#v-bE)4w-iWId(%8OM`c*{gwDq$88l z(5syKYA&&&Uyd(VAs)|7~!{Z1Srmt?kFnHLk;l z;ZE$_?$^P{3bUpmK z?dFf|mhY9Q)J|4;In#y9UB@`Qe8S3)-l|#h{Zem{i)0n>=&!k7nduVpP~yiKI((4w zDZGv9!cT3!afEeR#}@t?t)0!0cn!@cz3B&8!hIe zveaKeS=4+Jkh{;un6tB57mH#XU_ z7yrajz<3lYBzjY_Ji<2s@!)Fy;rb!)%^t2XSE-*66qcU%*0(HgJG!mPYd^kP@Y59< zA0I@^J+`^@;+*bhV{>^>9ZxUBpLqXq?|%1%XbbEB51L1SZ-FUYe_ofv%3b<`=X)`_ zw^Tm6=XmDAJlC*ksYb%36D_Y@7MuoZ*~ZI|`FOVbfs)tTxB~R>Oaj^fFa5(`93(TY z6T1S7L`rqZa_5D!p`I)n>xs{KzJR=0Fz5TxYg4(~<;sJogb37Fe!Ym%?DKV_sq2tf zyz_PX$K)?M*#ijKB+4^yG(*?c2+@dL3W&#T(#esW510Dv#I{0h2GGbS9>@I-LQK1F z;&cmUc-ylZ(sKl!xN7_VqMU-nH*A#m+Uuu$H_*hyPZ^(lF7DQ#+*$YvEX+4>x9J_N zcb}&;?8bv#=nTphThxABnM!c;E>!ES?A-NekLN^^ZQNw`)j9y7I-ehwG*%WBHdNb0 ziPi(qLVC)nSuSC3-rbiDPxC$(FC4r0etncv@BHnq;D*?h7id)Fla#F}GRq4`XR}J# zvornJbCiBRGV22lRGi)h-taCoI}QF*tF=kUCcx-8xWQ=q^*zu*&wysPM8nJXEE~GT zGD12>dC+gUEn&SB_UF{^x3Q#*Q%)81Ja>OmRmC-(d|q@fSxP;ncv^R;=v8uSQngd_ zJU6}86!LCD%{e`E>mOZS?l(Y>WO&?KGABUuzaGXgcnX z^^zQmk$IPk;$)WVjpi2|a>u$BT>VO9SI9|dQ_FhHM*Q3gxBsoJ_0+S))qAtC%IBt4 zgI$Cr;C`^{ngAj&PN>sP{|w{jlgt zA&yQHNPISN6B-&!JYv1V=>7`>nn0h49k6Si@kQV#N2Lp!5z)@rVe>i{S^`E#7v#GG@*c(S-%y@+ejSu z+Ef0FTNYw!0D;P5*_?V!^3=9ka!9YsitB4U{^EH1a)h_*(_`Wz%RV0XVDrHjtk%th zS>pAs&-~QBLMd1<2ku!sj}P4dD8Cilo$M! z8M(iqPc(41)HMln z7({wUZZ3#ngt33c>INWH*xjbhO)^r(MG1zrn`-NY)z(5Jn(?C~=Ds2;x!)ki29ABP zu7b%QzKEegduS>1Ct7CNgUPp}j)q3g{H0>A_Eh@pP50qzfpL6*#yrEFpTFPR_4_*D zf5?FA91XSJa80DoiM|}ZN3`OK0(>bw8R0YFwL$@pX?qjPjXwu z9(&dgPu_gNG#?F03KzeNpApKOf>HsG7>hq-g}=PFuFk<^=$Z$mJS^viNUKgEA{c*) znGydI3CMkHpCR_Dq*Y*;jUk;7+=_=+J6)%>GTjMB-mApED!Imi4^VZxWQ4 zVhO?TQ2k4TO3m){wIm(O+B!ZowPljmhumT?i`OIpdsfN$tfg>*e#;Zc@4Pg$rhk4a z=D0=O`U(c+`dn9R`H*j`Zfvl^&-^0b#@uM{VUA4<8*LrBP^gDV<)EU0U#Q7>5(e#~tkH=J7|PfYQI_I}cEU0-f-;GX-!X@{hnj(@(iWo23EsiltMFDjjnlld02 z0Tdhxz9PpJpC^8nwiH!&g55puhBqYO>EO_OFaEYdmkY0^`cQ(*ddv#oAx&DAzc>DE ziwoD)m=$s!)*AHULc{%y`hDM}GYqDqn-nW_X=fmSMVUw~N-)*xYm~PUp^4&KxmfQP zj>ox{1hPs8V{9rEQ_1GRFWxtzExp>mvw85fLY|Qlij^b=A6PKJm7e|`L1hNLbzK+A<0`{iXt==LLNf%9d)j;#tD`)n0`Ex}bFOvA| zm!3abBCxZ_-4z@NBN;skCy^6y^e3%c12#C64ylP)-J-Zj$NIg4=)!^2lxG{ULAKR} zwVEmlqL{7;$&Lw&au#9lIOm{4qDuk_K>VT@Bc-JXwCmbo?X+i&qJdmKxWj5s_1Ys` zJ>EN@z>eHSo1EQtWpgRdwXcy-vCy08H48l8HmNa;*ZZT0hVz7|xBIXDH!z18cI`*a zro&((6Ek};>DhjmTqY9wU>A}4uFEeyL!nv0?PQ`x%Rys^MN_i$O0oJldXMxW#@GYz z@<`$6!*+iB525gvKE_?c$xbC#T=ye9yTW>P=BjORm2VQUwdq>ip0pY;4vrT*u`0T( zzKSssoBA`tJ(5Oz*+T@!ylpIpE$ly}D7rf2VdcXxQ>iOZcg_3kpL>LrL5WfI#ipB@ z;Xp3Qon1?23R0hR!_wP6L?a^gkXoS=KPrFsCi_|BZnl2?&#^wiOnAhTMwK3khUZIe zb2^^kHO1H+A>G)b@_PD?@@qWH`}Au7@t9zuEOkYfj!S7h5ra?cw))R~u58&yEtdOj zW&7Id2c`0)9{nG0ZSt=CsOXWO=p?qb`Rq>y|5U#oMn9=*TMvc)B8WmB+tsDlMgADR zCGgcx;g_M6oyEX8n`xzNxO|0u9e?^au3hyQqS4KV&%TCw-mXE29EQ(A-qq$h-Ez%i zql+OKfeYzC`KvVtNymnrlbkkdyqBymwD$PEm+QM|M*Mu2aX*n+^mF)=o5F5eKHyu4 zBuz`OK_D09kmSzkfj zO9iFv2zTE7SegB`jjxK0#lQ2gSJ$CAnNk2t3<|P5S(v@A7HO$+@J-I<6TMtCQVo|N z`wh0;`s7_xv#}4$G|Wt&%hJeiPM7$8@d5+ZkC>sVLX;d34O}9Pwxfw(9(fur#iiXU zxQ?o13TO*#AKAwzCzYxKH^!MMm=aw|Z3E^Xs$Qwl^cfSGrE_&Wr1&KyM2JP+;A!_F zR?>x>7$!Z!h^?~rjI^e2^4+y<9^m^O(1ovu7euiRwy$O zZn3?e86kkF;&mQ(lSvYftOA#W6(06c34+pqNJa@$DXCi@CFqd?uWj-jXLt%j-zV&^ zp7>F)H7owgSXt0RS^!ag=z;23>h+x@`5CQgCd*HK8%b2fsuaQBxcE?kXF&L~L`7t`<(qZf=o>Pv)OxoM zJASO+HUN=s2(CmJ4y8>Xa7TL6b#+Q=BAeGOrTfo7J}{Lwm4D8rB%4!#$bank{)VQ`BvGCL{m#4qxhT^mv1X~r+e*EM%6ZMKGIc=zlV-O#p z_!JYO6u+<<_9ycDTU)6v%ux<$(?IaIz>(|&i%_8PQQq`y>$S%_62*5V9_G0=|tGw*XK@h z>xr69hGM_7TdBD_9nYhKH&@oY<-%m&L>TUAl?Hz(ftTY^j)C5c3mdkDQnavP0UulJ zsS{;ZlY1Q={uqopKx|Kxa_SfD`{tQVryv-|=S-3+JVce1r>L&V>87K})ueh~AdDHt z(cgDnt!ZC@o1E%)xxbl~zZP*M4$1T$9PyAPqRjr9Hsn#b+sH1 zo_Ev96-}9{`>syVXMv_Jt?mOuVCC}4TmE>?ZT$}*QEY5=r}KeB;YO z`(4n}CP*>OG3Uqu5tQC=Eq27<8;kZ~KwzJy%uKjtkgRKtDLM1?oQIKA62`ysbk*BA zjKW(|ilyRgbRo*!UUGPAN-((7Mb`L%!L6ajK2c?0;yaE=P)Fq-+{W2X-?LI?w0S`TMppP@r7jSiZ@mA+%4 zNPf1W{k7{UTs*`V-o?xx1%#XibgwZ^c5mAO*C`jE)O^^zoYvD##!>QmDT6Dw?pc-5 z$!+WmudBCnRsu~`T(YOGB)62DH{|DC1N@KqzsyE`r==yn1dH7O$~ePkb}_S!CY1_hLv>5Hr&r9WRrO9Mel+ zF5q0NQfbXGeRwoh7X7e$|VFJJRPW$S>o25&A)_FVJ$lJ7mijgBJ*6s}~>Z!p^% z>pOd=N1(0pcsSZ~TxlBPk)-jlE5}vq%-RPt+89? zGeq6*vL0l>-_O58&ASS~_;&9pl;9sq68L<#y53h*o_UgC|L}sF zIApt+Etjr#@i{%6XQ8S45sth4{ths(-}1p3-{t{C+E@a;iFMy!zKM0Z*)>k??(}ip zJ~LD4nKOVIq(wbnPpCH-RL4aG3O|rTL z=ubb{$9%q0$>`7}aFhEg11o50Rd)QrZxA>TAWf;gjN((dpA+x;ECTMa`nLXzGH z9gNTCj^dHTGepj)+)eb@qcBuTFdV^Y5!xoS1Gsn%5)AM9QB&$dAyiY@W`^1&*q@RH zWaeb;1S|uYi@P)B!;%#eBSFK}zPgb2LufE5%7ZtQPj*;|*2+I!qzKdh<~QoDObQdg zgMWpneYVMzS%JAd80}Tts^04m^@xjcIw61E$1pKm7kTqI{8qKfMHHHi&P6^`gL{vO z`4)zy5V(`|F^{`u=BK6p4uvz>T+SPqR@V7V1TN8fD#o{+lTYXS-G}``**s-%-q*Bn@A`x{5IhDITP(~y?Zn(I5rV7KUaO~h z2&rg%ZJ(5@i<;<2;_xt0OTLShX*o>K81{t3<;wilCUvM1K2MLM*+pU;EZnHJ0O3Yv znS9RGBOlgVDe0y`E`tZK08MfCkIBS@%FB+GHufo8c%%1Um3EJM^y4={rktuQcj>`%H( zn~@CQcghNr!_iH;eJ`jtSyCu>VTYrZDSz~_?@>|FODV;*sKqTUyYSv>^^0Ya(Ph0V zU!O)jEV)sn%*@o$zMfT=qwAGR2BbmQwQzR&x7 zRJj-Q0@Bj1$IZ#AEh#?G4TG)F9H`b@Cv64U4BcHh{XJ$QXHm41^+J|DfUGT{k8S@L zh9e21NA(}Mh-lN2F*pR2*E?^)@PMFL;U5f{1>Kv&cB2fO#U{+QgB`_% zZ6-Bxz+i{z?0VF{zU|w&TGptakDss2s4LbhC*jF>Pc}AnC*8-RWQGTF7%MX*(1qLX zdpWz66ax0&QZfn-k+gE@&c=)0Oy*{0-X+4Gz$rHxafh(bq^l?MuaO7&icc$2ZqE0G z)@7v`+aNiCRdjaPN*k8>#PEA(jj?Z?`FB??y3p=%dYNOZk$m#!d;QZtIUft=v@ySz zR&xeCtJ=?$j2%S}Oy`f>471Gl&b)uuc>#y2qQDKkRL@T%7A{kD5<1xiafonY7 zrGO+g**#^@HyOmj%Rz_W1Al-2LnR=_?}Nl7zM(X~eay3lg5CdRKRC|6(E4AL9xQ>s z(E49!{V%ls7h3-dt^bAA|3d43q4mGe`d?`MFSPy_TK@~J|Ap57LhFB_^}o>iUugX= zwEh=b{|l}Eh1UN<>wls3ztH+$X#Fp={uf&RzZ|9ie}dN80RZjYf3;c%C_x0C5)0+O zz~0U67(D%})jAp;%4%H=dsjtLib(!$i?xvn)#DT)e0dllRtOFxJlG>-iGfv$i;6OX zo<5}j=k~+rodHhky$@C~=)8#EP<6nHNC`BQVAAh&uUMXjP$g9}$>Col*Y3OJ4=G46 zJ|&!YAWn1M=RHfESr{Tvfn?=!-x zPjbs8-o;f~EQ9XCQA_<3Ob zt{j{58qT*AdUd&Ej+We-H??Kg9_~s$H9yZ{TRs12I~(!o-i3|Zv$IR@HCoQj)94(u z`uf)s`Q9LoXQ49}@Gsr{}HPXl9FWYJV-m1>`vf^Mm0mDgl?lbO}DBKn7)&?jnP)@jB z*!DZK=5?=`tp6E}x_v){=dCu5~r-5Q}DX>@r%IaLdOHokuw!MRRJcu{pUdf?rO$X zP0|TnMq-Mr`Si*$bh~;&N``wIV}}(Ezjq_<7{83w@49!S5L-bAx!$-%Oi>*F1Sa%2 zOpcsDA&@18_j-?Xedhb=%0SmglgoqKy}Lrxd{JphC)XNRt`GV$5b2twkik|joZe=cG6(Z{~=s8ARvNYt24Z^GyCPX zt7^zMJ`Oe#X%RmB-L}@fHj3+5banL?Q=r$1e_6I-Wn>Mu8l3kw7N+(NPoIu~H-w>M zkUUhQbuzRAO<%0kXszFy8R|ROtJCV)>6@5>$x5^i);5FyBrr1<6N`Y5NSW5k(ZXUB z`xXu^9=@uKBCENftGxzz{@+)s(CS<0+1qE`hC{RNz|r6^B`ZBkLnTvvYpapF_lWOn z{DY24RQpHJ(Ego_qKK)!1NZ`ZcCMd@AE?PF%Kmu|9sD~oijsz|h6bYB)6aCM>PE!j` z4gi2IA%P75n@@mWP(VPCUq~n#2oV7I!vR1r96W=&+M#1$`T2MW5vP1KnD}~qXZx?ANio@d|>byz7K{Uc#lW{2m_W61{4M;!vQez;(;Fq zI`C3}9{?f*AWw09F`$^h8@K=j5D622@KgC?K(GNH0e~Bf@e&1KKmb87CKx6FQ2V2@ zzVroO3XDAhGXg;Dp8x;^fQg}C7`z)gzzfEdL-_$bUko?^y!PVGBQBlCCy<7NDBgFxF9bNeD#(n1O$M?^MDK=0BDUtz?yRN z@^V0)5wJQiM?T0XDoaa+Pac5u0iqF*#v*tgBsUjDh(tiD^L_H5IY1Hk4lNO2zEa;j z%v=C`IC!^k1f;&eFAt-rp#^~enotj}^v{Fj06qvvZEGk3(p(&n2LW1q5I{>90sv{y ze4r@?0aSpwir}$ez%LJ40JNY&z9?d600Jlq{Q?xj^U(8iL8nm7eqVs1fAWo1QBhXr zTMm>&0Z@2(Sx`B&tQ^Jn;v&d*MR++-0kXZcu;>RwmqP#~d;wVW0U)hq(dDq(`GtjL zkn3_t%M5%0?%h zFaRO&%nAoHfK^h+PZ^5<6B8SFqO2@b0)P)GYVSa_7X^Uj*6NSIs0E7h!LJa6fPK!( z1zNy!Rem0LYXnBq=e)dRpd|o-fvQKjh-UE9RlxIL`CwgW@k0RhV1;T8LI8DO-75lX zK&#(4R#jd;Se3@dTmSK-^2*9`@JT?Ke>p~3Eik?S03XU>!wXA5RbV-K#kWN;A+Q{y zW@KUEJ5Ui&j?pr^urO0m>5uw!@CC?XMPND5j0#i+l>;qcV7mfd4nC;}Hov$y3&4v2 H@Jas*M6C@9 diff --git a/dev-tools/packaging/templates/darwin/icons/packetbeat.icns b/dev-tools/packaging/templates/darwin/icons/packetbeat.icns deleted file mode 100644 index 6dcf2b538c195b7aa827815a1b79e1d7c10e089e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 176510 zcmXtA1yoeu^MAW6vXpd7cc+xZ(j_4s(%mRX$C8rLDJk7u(g+AhNTZ}QNJvWaU;O_5 z=j=JldGEfNxt}|C?!1}LVr%Z?3V>_E)Z`xHTRYDX=|1h!Nx zP&fdE!x2hU(FQb-aht$lF#%Inr^*?wTq_LY9mG|lM9Ln!c z>M|=l(BSGkP4!2kXYTjZEPXc$Q~FM=(-$%pG5eH-_%9~ESO?G@wldfoPs*c0U;qTx z?EyLTqfW6o@N8B$BTGJL-kI9)Cz<)J7=ARx^u?pzpv_<6j_S@$yrmk58z3N4cFf=N zk1X?PywT#wrkxO1u)J=QXS-;|TVgflq(GOGK*$6jLGrnI+k+>*{5L*|kpW8ND`u24 zzjQQRo%I&t_l1D z8|DI~b3d!pnY=WwL%E?!7T%gm(6IK+zz?jpqS>?m)Mh^z^H#VT@b#femoHJ(C{_iR z42O@$T&I4cRnz!NuE?O(W}onO68olh#DOt_MuBfUw&qn&7C1&+y) zJf=v8A5^Bdt^zYhE!7&L*Ex9(t{%cCfR95oLf8NZyCfOtI>(Z|4_Ur^K%zJG>C(2Z zb!b0)c2#$EH_|kQ;_z}xR!vlnbggyKI5DsP>poj9=al*$k*wIs{q*}ejLSM-Cj3W? zY$U0!vVya$=pOt?83J4{%h?{}7)b9tKKX2hkiTn`(NH`j)iq~1=OVC4Bo9TCC*3YE zbx>aE*pdS=b4H>*qLN1w=efGtmTY@ipcwk5uQjQ{8=eklVVUOM*RKdh#7P>yfI1S%X{6@0{R zS^>xkV1_r8#$B7RE5c^TFE`?(evNkR*()WBv3=EJjd9$0PHhzp$8(kihQF?Y5eDW~jaBy4wtBTeRAEj`|%J8&>-5DRQKRe3GjVY0CTL*#emLn8;q3P=Vv&)-z8E38+Iq&&y6 z9R-q6K-fT_Fsj=2!@~4cK-ZW>LrbRc*_8V5O3i2K?-^hi*>&IgmaDg*eobXoH0qbj zn2{xWqgr+uI>@71Qk-ycmsQ1h0e?c5oO>sw3IV(rL;HTcxI(X6>BU=Cw|lK`H414P zS$h-a63fw__7vB_j}BTB+TCpAh*NZowR2lu)M`7)>b&`zg#{3~{Zw$pfG4_2X_ZXc3$S_X0Kwp>awm?!;uxlZ-B$nV}llh(Zp63r{_}0-g-J}>&&Z+i? zAhg|8Hxlq9_L1UB$3@OJ=^o}sjX)qX_?X7*>k)a*lH3@lxd zV_h5|d=BlR79tJMxvMnV%ZEh}| zZ^o7vLn|U;i#h?)M@Iv|o2Ycrw>cBv&(==XD^cMq&=t}6kyHgm& z!TOH+gN`zl@(V#jyLVo)Go}Bb0u>CLuL^cf81{`Xd)4lY=6NT=a^Le(--yA#nfJNC z!zY9%q+C(vhwt2OPnI2d1U0?9SNBs`wR@Z(lo_~gyEoOJ&`#_& z9v|k(;RC1PWOWC9n2~|MWZBrNiA9|4$nTrXtsQv!M~+G} zolew3YK*F}h&_bL-*<-G4V?ABM{a#DdwR7mIz|_x`FNC2c|uA~9~}NDl2_oKCfv{4 z*e#5xkE;VoTw>2p={jFX!y;nQNgdxXy`w{aT!=vG?=BDb1e)^+N;6=McmQ9M<+wE6 zA2jy3AKuSSLe57)B~rwZEo^UmN7+qFpnLxeJjWg+i;w+&9`8Nb-I#*u#G zZ2~}J!x|IwrChhMHIylD)nbUGL7o6%78AsCHwT*%P4SJ?D;4JPQ?Y8``|vlckWX)W zO8b0}g-*k-2y(yQyI?{{kPqZ% zKKp64E9Z-ie;Z7UHh0=kj5YpAfBd(6vZoy}tinQIs+g6@+}X}@nx25vBeYQPV|oC$ zhio`jS%yZB;c+GDts1ETHeTJ8+vBTIQIKh64y&+=e`mZnee!EZwAPmyX4FeZr%AXmVVcOs_(cgq z%>6BDYtPc3WbuRu%YM+qvW%9_*)bBr@s}^jV}ulVwlQAOXfR+a$f`RRqQJe;Jw4@N zL*>jKOaMhB6`$VU_GhtMWXo1*C&G1yUaUg5E&3aESr&Uz_u@rHjYZ4NC0~l~{ZCK= zI3d^HaL~WnzSCYDVX3VTfXQF6nnvb)47;}F;5p`<@RPCHL%Rh9W}q?^`mg&glnW8O z)@21*ra4DU2CvzDUdL&t$(`ObvW)Q!R?RK7Hc?>UJS_Nd;~uZ^u~ZgQqoaj9*?h)? zof+3&L8s+g?zXhZ92d3w(|v}!)d^2&5s}#?uig*Qabf-t4CX4yx%I5YWag?!H2PAc zAmVo1;H0-%I$pFZaNJzeJ6*9G|IZ%c8HFl2#*2m(3P_@yPPC!xO%5u)qO!vP^Rs}Q zn7+=~T`*B0_F2UspcXOGo2x_neKU2fu0+!=t2{OqhUc35N3r4!l@=X|Bp9>pX~hWZ z`V?Qq18SL38y3C?X%GG1Uy6&*#x1)Pr;t~o!}_+ndt%0BOp-TR)pPx5SK$uEV0N-Ghn$b>|$8t7yFxCciKM#s083vu@%y}jS z@5lqr8R9Mv1K&kpBB?5r9@68IQ|C_fy!$2mW=T?wQnTj?SdqArpDvhgj}Ac2Re`&| zRx#lIdLWNt3rPbUqevHiJfK<EnaFL;JAk8H4KVtx<4vlJ*WC1BjM421Jc{MGH=aKnf8 z*!B`m3P?k;XV_fO%#(sb1Ke)C^p(1vN1wCmGnUzB?nNhqWp;PosP$Y$Q$jG2yHV7M zRX4x-sbS#vSb}TG@0{t)OL8=t$PCARV*PO3_{@tWj{n5cB^5YO3QVQ&h$kAwM1#Fz ztD?~SWIGyOE=0pSj!Nfowj^ofmR->L#<3&s%~Cq3{?BVFCU`kS{?K!)Rk7U@F_lQy zH>W$fJ1JfQywXO?xbpiuZKFvil%@D-D2z`=g3>)%2{sNHKy}C@ZoJ|fTA2VoeC_q3 zi1*0oNL*?&1oy>_vzEG;d|~%+Ec&N#UOX$;U)Y_Y>45Ts2_7>glo$=ZEgAP-loO1$ ziWWE|6mZOCnc_nK#l$i}O;H5nBisbFa&|IfQc(YQW6Kynn0fivDds|gl%y6OmGUKQ zhUiyNH;(+FV4uOB80ns+|G8plDhxLtT<$&9d)~=_9hHI9$&pJKs&UsqUoVZakyn#n zdrOT~FE{Iiz2nvTBk4-cX4y5K><6+CmQ`N`gd6>>sM^H|grV=}9P@zmm9F4#uE06E z(Y8DC7_e{eujn{mRItv7IF-KHx?DlR21w;RL2~w^&egJY&XOz4VZ|w>1>=3NB)olj z;?T2gXY|4&NZrCXNh9J2kr_JSY{<%qLs8s>YJW*{+OL9=z zN3}XfJj1?3$ndo;BZ#?^4)4YF1G&)Ft$vomuM<+}ccZhUR9-{xxR@(cLh)z5!+9)^H%1v#ltuou|37`4%$JTJa!V+;-xm82 zA+JyOi6nlkhhA2wRq%}p%Q>X@+g)h*(f*D3^>y(rc@H_*mp3{6!J`h_+Oq)ev~BdZ zb5dzayrWpfGT`p5hk&o^f=q|?L$4=C@9>;RTf($RmTS6=fAEe`fTHWuCas6CVjn`; zlVfED%$2F>JBHw}qf(!)OrG!`DG{L|PoHuUF%Fobn1GTiUkwtRlJBzH2XG06n3u?f zq9S)|_Y&aRN5v-b+?TspE*0-OB?=^(j*T{Owo$E1atBC=c&y`Lb*ZbN=?di%p#Jdf z{9AnV8C{IVt~+Z`rU}p3?f!WU>zg4Fs|><5EXB;Pzi=VTC%qlDDe%mFIuZ?gm1lm3nvV zL|F*=v)?f{XVjZ|WNjB?pIEpNC$d+IHhQ^MZQ)D#o36E?%$A1t{8cwR&8PmVsdWC9 z$Jr?5{=4ucJF~=5(NZi2m-4&hPgmEHa;i_f&qBI_KHa!SXMLtPj?zetsEAl74ADIh zA5n5>uI%`Tmt8Ps@91&x`f?{5ud0B4>gd*1t@wiXv0QckWJ zwd(;!O7HX-%*|bT@fq!va7+wiQZR^=vw>*wcN z>IWGOyKaA)(ZHvP+kMwwc?)2ekG1TOA(H)w!rT~9rB~G_FDg4*u$R>EyHfTn6eT&- zxpe!7(qdW)We0Vfy3S%1|F=-%69YdQw&&!d{NWwev+oOqJF8HX&oW0oWEwIbwubH7 z6({$X(j-nLFqQ-^?f)hX$#qHfIE$FQ)P>rq*P`u@gr_i~)v>0%{*qef7D9Zv1bhQTJn zC;~tmg8hskw=d`WpNFgX`%_vVlf9L#Bk>70<=YmhKI00ua)dJa*@eBNz6~XFMrblL z?~Rpo=kN8_Cl}7kW$%zYI#0f&@ASQ$@C$Xcx5?r>*?(3Qu=W0c=VR+IRdWkp$oQD+ zJlB!pwaxFSO+F!HVW1dRPZoLCRTpnl;rhvkUc4C1GzCn>kd;~k!W%Fz0)E_Cvy(iq zpL8APEX_0}80BV>Oz<~R78gEWX;6RFR~ifG)d$eDIUY3cDfM5KUsc}E2laj4NjiN- zN={=f9J#WmBb4J)^VY*~<(8~c7! z_5NAMAV1mOkIl~YugRW#30C6-84K~+?d%#Pj}J+mYopB>Fk(lP&EPE=9vVzKtvD^V zT(KJtk0cr_Du`beTpkw*lvk!wa7W?f?qVO8Po;MAns5ugqsX5aa*kimQ5{j*vBi{Q=g`w%$({rjN~3jy}_0WEB- zOzh+G?3LDydb?m@v*?Acy-50!JgvKitXJr-n;881-L-i^Gn7EyQZKUyp^>=xo)ceE z#b`ORT1?*U`{Ho|EnuEo&0((RYb}ilsm5J^*AGh02Pu~<`1)A1&Hclh$(og2?@_+7 zxP2g->IK}uK?3G{F0fKl$}9JA={rmC5T>(*DYR=Ua}}WWQXj{KS+DrwWX_CeE$tn+vSD|8ll*R$6ZWzgwV?FZQQ`Z$X+=oA zPXC&Z-CL`(o!Ws*dAm5Y=$k&<(oq%hL|cU>#9QyNy2iI(et!@TDI~iTlil`NKv(EIWV&spe+Kl({7Mkn1%_ia&Cp^$e{O<~O6rQ;y z!SkjoOC1ekiAF}vAU!~+4e@l`GSAnX@atbdHU~<15Vc|1uWNgV-z>hvqZS(>D&O_9h5RLB6(NvX}3`Ej%LcqNXKp`AVX26Zr|f0n^W_5iqx#RW&`+85Hzv#KTer4+Z zbQ5kTXy~#k;)|{<#i}N$Nob%)hT|zZ@7^k%%wEoEEM2l97mSgL$M$@E_k>PgRe8w-*yeo$e6;V;^O~Hrc!Utx zb5dM%RphJoMQ3IMe3j2JzPA&JSgdwnEV6;b%{g;cVt3)pI~${C<)LFa*Bkm9YB#JH zKOk{2H#rH--E%esV}41kDPtc~`Ll7$^<&NFyHaL}{@CNsGWu{x40gNXv>3s6x0PQ}TITNUF{7o4`;>F4g;v5%zc3mwpJ$`yu zK5_NlXtt2WM)H6)bf9rPF3`TjFBwN1kw0u#rzk;eJ;dLBJN4i5d8o)9%R$y}26snT zh_zhLrKj{6ysJgGp|+nc-#W@K^p|?=2l-di1f`<>*@MqCtVQZTZ7h5mRi#Io35?nu zR~@6kYD_2x!!k9a^@6>QXqH~B_B_q=J4)NMHE}fwsbB1c zS7Q28*9<^3FNc;6pmEp7e#cVHC~nll#Y=fSIXvCrXR zQBs@D*}i{rk`(<|>MMUs_{bZ|_md!-u-t8UJax~QxXnrM>s}(N!;9`^w6nb9_3?vd`7qFD~RXW=0;z5+15aE)jr?k z{T)?7xD0qnB-mM>)4a7oA557W%j%`FZTQ>x@Y0KQ#eL*-E|TkPE{oV0hLvHNS6!UL z+ER3$raK8WKK4(E*Rgz&n8EloF(G>l*%>=SmN%OYsY`ssN$*sN@v8MF2_wb)ie<(? zv90xCta{wVPN`YCN8J{u z*gHtgnQN(pmVD6{Yn~-<_%3|78GZZTP~A_J z9U5r^`lK{^612!s@=oMo`0R=ibcVQjr4S8LzW)5_lB9uL^(|)RXmhvw)y>oEfdx`o zy(vimw1C?Fwn+nH;tNubAK3BDae-3`%9f3d&ZO{1XPu`+PBs zdR@4)Y3OVVU4_o1isxZmw1O{qDQx$TU60k8R&i}2VkRYNvwuptBm%t75oV=TA4krI zl_r$TFM|oufOM!0^~fIqorjq?0qS3)dDx5e-6OQJ$_BY@25K9G^56||Sd^F)Ix>tj zjIbADBa1Ld@>C25dWZ|SdU*X#`N&73e@3Fu1Sp$x8?p9{5n{u--N6SD)C*J6L7S*> zFE24c1ERp%VvnwQ9UU}Kt1de7s$BC@O3~)i>L=0+Ojg}cI$Qf4E5r*B!*i?A5gb@I zHJCHvV4*S1cv2FyDl2KFuaB`S=q5$=0}VpRFIcCi6Z-mG1asDVc&T6CeoDtCABdZ& z;g@`OEGwa{0oh_4N0qWUo?I;*N$0MY1wh46`9f9WyjU>25U#SsDW3|Jj%nAO4}S#| zlOge1%|fYG@j-^#0GGHUKHQh?Jq}QONL*k*RfB&s`C=Kjd;U$|PwP0u+mBmdZVdR( z2&P9Cl{0)Fmly1>O(<{v`ip7?>}{MmAWggb1U3yn%DkHI%LQuZ|CTd zW8wbxfz+(ykwuBr93RylL2@ZBPf?@Tw98&?Y&QO)S5mRzR6ziuZUOuEt*?FtY_W)KlUE#ne8@ zoe`p-cFAh3&NsBI+70b_T3J~YZ1omJhrTuAG5cAEu2a2wyHoYA>gbxNBHgP6A<}Q zzkM-~rf$NVOXh)h!i23m>!vuOWK&-;&tJ;RYxN!gJK^NwFjj6oq?fy+!8MEACEb5N zkreBP{?Y8li4X4%ROS}$|G>>^r9IzUt_yjF1VVulXH)_vAwQV`?!q}9ER;h$Iz9Tp zw0OMK21;CAlE)*9TddEpsB7EGN*) zj8?NUya+jW8wy+QR`1>=gm-0QuRcARya3^FpFPKTEEK!lXY)x|2nWMBs*B&Wq@Z>G zsJC@T#n@isbpm|f<-o{BJ&Y&bz*C@Bi{p#y&sxV`dsx8%Fa@6A-D2gD=;0d@ks%`` zBlK6V6D%LrY*?V46aHqEd>;+NxR86BM&~j4L ztq9+hg?BCEu0B6Xoj7UMV*e`TnBF`4^tD_S>+F@!!dBc3GS~sn{a32dN`n^Q=5|w} zGxb#8QLE?tAQ}B4YC!jLw#PNA#VPU7uNH&HrjmDLbH*!xm|X|tV$N^FoZGpjW7?S& zY}m~3^WNS3tN$AZhdfU|hj=cnns;u&A~)>L-ud5;>-)vQ(90M&^VvJB>Pm22tcABF z$6<3*_z4_l8nJq^CD7M9Ao0f2vs5rEgGinQJz=}AY<8W-se73}4m_Rz{YTG~kYjWB zoHx!%jH=j3N{-T*&31{U8fvs9S>MD&zZusOX*f#*V^}|$!zLM2FE7q)d`e)YRYB+J z&kw*$)XW(1Twv$tHIn*K(Y$nz+`T71^9NNnZ0muAq3{{w&utQiG22t&{gYu+c@3se zc?}8fa=P4dly2LX`m8|YJ}`(h-Bx6}$_c$p2goMh^?!)e8vWXzuG!{k-YylrosdnK zo_fM=C!#dw`(&t2{K!@>P6(>01oJR=sU!fH`ziLnsUNThUmD@9esEV<-|e*y!iU%M zJ?9dfV32jitirEM#~@fB3zJ5{JQpz87SlqtI$0L`ZGe(!**hD}pCR z)D(-ME-3Ap;uf|!&-2ab7U*OrW6ap*m^_E6ifP_ik|$sF#`$Zwy>6h}!6W-ZdjC0m z%}gA}#N0(Z`RhTQO(hWBkm+4%>&bm%+W!`4HlR4E&jMb|?aKf8c=i3Nf%hs+eiM&I zIY3Wha3jB=fs5s&0X05D-Jf0$U)m-jo7$CzVu(QaQksr6A)fCp4Eez;?Gl$C{57Yw z_C|A_MN8SQK^rh?-^$*PQ5Cu6`JvHKN@^314wj(qCKnVw&Xq^sbW4OEK7o&ruCL&7 z1TMAj#u5D^2n7O|-nOE*<2>JuKszfCj~(&G&{+y`QV`|`%R>jDvgybqBMmL0<~ z|Mgb`ATL8x#SaL8FL6G%b9}F8{>#%*Pzz||oBW;@QHB>Z>Hyh4eQ#_NrfXsH=%Ek< zHvz%e`3PK1EZ$6SjkbQqL-PdxWCf6~6flsH+sX4UAKUaM>G0m$fItF#V8FzT9=`bk z1?OK^d=)|$-Gz=D0)`QrV3Pi6BkBJ~>0p7T^-lXE1M5Lx7`6$fet%YQ$-i#D3z&uQ z{jtChHX0z2R`*01rCs?y1pqi1^_f4SR*9kgf$*MK4Uiv5oXy?a{1Zj?{GW}ZsPdjb zrV~gFD3b4{U3E+BHh#1m$_qkVPT|0ZGvneafr=L(_dy7VU^b|$mPbK0dBDrsT*q-! z{I_|At7MPpg(SfFXmmkb^mlXaT@ZiGf=JgNb%L7K> z5)>d)6s};D&VRO~L7C_S2#T(!4TzWkUMNciBuxUz_#b|+AsESDq1_nqlAttXq}e=P zmsQq(Rz|=R;un=n%hWpF1%kPvOin@9=^5{!;*ZOWFawr*R64qpZ(0&=_zn){3f?GC zGO6_#p!P-nx1LZG5XQrJJS{$42xjAI!j}-0wu(RnLE`%e$8`aT=me<&TiEevH`3!0 zK{@|c#uKbg?AiK}R)z_1g{L8)+@|VL{fDqfV9BrqDDA&HCA!Z#fi158-4YCRRbBR- z`vsrtxmc3|r3Ih;AY0~@fB#)=%jJJVxB^8b6$w^PUZ}e<0Wvj;^xSA_A?QyZNdqu! zRJHNgUk@}v!C*BAT7^s$tcUuaN+yu^)qAj-v^%0D2#eQ6(+xrU?+GqcVqK7$rVHY_ z$&f-IGo0qN3-l2YuzdGR#z{_;n#B)9Bxo?4zHchUKj{BR$7=}wV=_=-(}5M+FK*v0 zd1e#EliI(j|r*8yP1BU+u%60R&xcqZjUlm~d&j}b|Tv#mg%gb1fFDS*2KGHo7`Gdj9 zNzMdVUJlCRhrul`SO0P9F4JJ{f7}iUC{xEzKS_X?XoDVeU%BG1!~aiJ0tMiDZX(Xt zXz{46Sark@#`gyc%EFkb-J8V!<1WSlB7im_8a_NSnyv`M!Xx>wAn=C>#QbZdGC?{Q z(4>M0BoF|<_#P3tjDu6tMYpgHBBQ~OVGN|NkR=5%A4xLzw20FWF&G;iAC3m+DJ6CQ zSh#v^A6?)NN#OeU;=JFmwdIN7o5wLj<4$dkX`e7O!^5T?0Rg~b)BqC9J_rsr2~5-k zODPZvQltIT7YJnkm@NR1yTOc?iA@0NtAB_vLQL8nm9f=;3YUZ@DPa9yA%g#aMFJP~ zq5-UCk8;#CO;rK(H0*x_lv@}Tc|^m(sg%U6(Gw2+!DTduLtaJ5Xof#|oKiLp7qUZBMelpCNqkb?2{EW<5N+b0^{j}<`L&Ea>JLH( zBw0!JLO(jv=06-Lu&J=%@3T98i3U?xkPosUM&K_zX84jZ<>O{<(n$Xt%OxE_ROps> zBpAs9G(qUgg=O&2e?fVb2Sf~LqdY@{J#SydsUg)zoK6VARk(1F$-5TB;2x!(&kbn$ z;b@PS4{^igku(4;D#ZRoX0w(4-cq*uKRGmk6UFzNsdpS(M3)taC8O>w_IOysmZ2(AxFiket(gEVaQ=>s#SHHk zg2ySYGJ!npD=9ef;VkK<%qGd**yN8J^EDOVTsb2Z23DizWu{F7mn4vUdL(SZzd(|r zH;mp2#(t;ALe5o;AK*oGve>}K20cCn>t=*pXa8Ij-Ak;46cJB!CrvXV-)(zz*zXT8 zQV3HOyw2gJrAdyB;`6J!N*gRISv6NA>BZkjN(f3S;*vKGC-uT%^{u19849=Hqy5CQ zov5EjY)T)O&!0Z5-1sW-CsX5it7FmvW3xuXL`@SoV2;&Z7JdACuWM50sk2l5Eykub z^LstVr0kEigVU}_*@cTv%-#G^%$g(&KBX+2lRVc5o^|3EytxU|#NQv+OMNDX?wOXIHhOvMez3~ub7^`NO(2FD`rcObWzm8S zUgL!JHQ(2-(jf>&6?RD|&^!_EP)|I>r*7bgZQlB1Z~wOsRt$-rI(Wnn@5d#FI#ITA zBmb@DVy8oU%E_)fCO(`8*BQ~4v9yZ$n=ZM;QP>jrY2cf5^$q@R+oxoT8uB6PiR@>D zZ|vrwRB9h!!a3O18tjPtQxR*%>g#sVWgw!oLU0gaYFA9lmyyh&Ba(>}*bALD`K*jl zR1%Y5rns)GqA|oopUoZOI~|^mrR?TG?k@Z#x9F&a4vbQ?y}6~^^veT-Sxge|ZgJO# zP=8mVt>oB2f_jyj3xaI|z9oF;{mC#>rIBd4puJ!cmy!rQA=pgf3zh7XcKnd>lP&67 zM5|^Ezj5l--dP96^pL1I%Nt{U{$tSzKjeLg6%+}r8$WuZD)70NrGJWh;r9S$98V)E{BAt3gY#Q62h(49!;0`6uqrwm9leRd6mxummmWkEwcsu4 z8(-f*!RN~=iRt%t`E>E7^wZ6@UGVCHCO3*{4as`@$`0^9IuMJQZ+wkIzN!U3MZlfe z4ZL63x{t?uuudJGixPPb4cWP$NqG-BkF!7XUEVtsUt@g~^qs%O5w2QCKf1W$qa2C@&sEhK&h_#Hb%sAN z%UK$+IeSU5<>7#u$Y4-LP*a$gaGi8!fvM($$E~YnZl4(`j_$-;@bKPiKI-c%YN;LC zX<4rlaX7Uc`KrL=#I5^8$Gs--&DbOUTm$gdq)YkT^*-$S0e#}5j(`Lf-l{;w*la%X z7YVGWzzRo(Zk8nlQdv=+&(a&pE13D(S_|Q(k;$WsXj3}Zq7G$}1SNxt3Z#3+@@RWB z;!n?YzMVW%#`L8oGxVw6DQaeo3DW*+u@=~gxxsmTq|iARrZ6CaTT^xpNx=?-m53~^ z2sA`u6q8D-eMHx?DcY56%^uurB>Jz$G!JlK0WsYa>1ved|Fan7Pg zE{YGR>zKDa^-l=<_7Eu_QZ-ZOM)rxh)^wR##Dqi^_661Zx41}q(sD_!m%)i*idN-U zbPXL4LHt&K${I0A9tE`zJ_QJBo0e-Cnez=%ip4znKyZCE^Ih@ScfG*U@7Upsz;62W zi|yFZGjuXk_eOGpQ?jwphOl21+A1<=&YHnJT)AZi&;tv)!Gk16J?tO}_`$2|Fzra! z-4ql2mSuI8dBT&y{ATayN*~*H{4E)a=X*1@WP0dDv8$ETP0 zyr%rnWjsMCXGEioGeIiIn5{Lob>}4Qf2!2loHyp?B6R+0Tp1x3qSKj?tRsAdU@HR6Ylh;fedWdIY|KKO`ys*_!5&1-U zan2=2gW8Bn1;rS2ITpd7QA+uptgjb_{kJ9#>B~1{pJPb`H?R71yU_o${*8{*M-l>E z9A3y@=pW&SpvHi1L)A8k=o`{QSID`j)5f+1MUOThuN5Q5&?y1u7e-}fv#o#M>bI?J z+g9+ERj6)3b7}T!?n{OqH!q|aI@p^TkkRx}w&taYdEOD~rHeu?0erqHFc!VENuQ8} zhA`9X*)#p8xEwepe>*>WUe@C=^P0Ou$M6LCn_w8bYrn=-GN=FIUsJu9aucfTW&t9O zD0JnN!n^i(s?{t!SY}kRaM`M|2pOFBzjWT=*wJ?Hr%?yFLI!N4a%gF7@*8ot#KLbr z=~w@~{%pbmEF@FY3_N^anot#uDbCpkxt$+sVF{Ga)oHyr+9R5c@vC@S!bpKA_l@B8 z_=82fNAK@?nx8i9JAAmIIZOl-gY|aiuY+@PWqqUoubZMlJzm)i@suaR^l^!NzT{2p zepzN(9EOiY$bH7{7dJ81i5H9&dXbAnZ*uVa>`+ueEk`@PCw6}~sd_IA(p5ij_9d{Q zg!B^5$jPP(#?@sj@F-bDnotH}bO7yQMVtK07ZREA>UpZ4I&BB?V7{1{VC<;EE_sXE z+@-LseyM=>a^GM5fWOtom5Z>Y_*QDgUAm3(SS-E3F}XqGP0OFXkf;$T{7~9Cw5&<4 z!mfq}yfBWF^dB~5(5D|K^Y0db`_WkEHzwj8T+oLnp+VA^F~A457`|OODx>v`+y!s5 zfxpTUuGsiY$laPjEBEHx5$jRx5H5Th^Z`klYNFR1@10`VZ-AN11pGt?dli641xFCA zc~zw`bY7EkQ}ep1n2Z=X*K`i_b3)c{-W@Ej_UF*ew#B%zjlN(oe%O}um4r(eP;WT^ zZNxLl@9N=80p?U{CX@HRB>HI;dfp3C5+lP?D*Q6ydT9M2{lqv} zM*6X2TB>HUaasjEnzjGSl{(~us)>vYGe19htjf6-KmE1?Pmdbl{hG?Q=nP`}Q^0mfVQ74Gj9oW=OmTG1!~AW9arsIS*ZL{jtJmI z*@5)xC8Ldlz?`O>3DZo_ubI6#0<(J1rhHLt80#Aac1YUuXzg-Zfq13JH`i1xQt%tL z!?wkt%8S>&)qusxno1ePtkw*N`8S=DKUD6>_0hk5`|1k>sauqQk@9sv!jy*@P`P+h z=3d*L>QE0p;-T+OO3g2H1L#EGcei2)*9*zB-1pU$MTR@X0$VfG{Qzc&aj8y&XKbk#EJq2vC(Ov%!%Wb4Obgd-GrJc03S zf?7oz^3h?XVk7Z=2lCT%XmHcv-}@zWlO-RzZ3v$@YDZuOCu?aoeMR!ImzSGt$*GL5 z6Hi&W;WB0gda<1wjp^iTaY0N#GSpB|{0Z_Z7$dbSu;clvxeyaDD=&ooZQC!civTFB za);5$*MUK7L}h@@fbD*PAX3;jo-Q3-&1*}Bb)EUa*n_Rj&Neuo*o} zCZXL7++zTalkmE)7@_r4>K^w?M~pjBY#uSF-OciOB2`X62Al2s(nv%1o)-3G6J#D) zCPFDNcHPQ(S_!67?)g|w>nTn3eyozlYuSk4f3ng=9O#De-riT_-0-Zh0DNeo<6aX~ z@6{nEMFAgWOL^M-L{N~s9XE(JQAl2gSj>X(Xuaw^Jx{)TMX1j?QAA}kIxlEcvC7b? z>8c1Zo>)GEF5|*6hEKoxz0Qs$v%XtQy}CfPk}s)p;u}-bzXS#_OT@R_)&#kYJ<3vN4z8<>4Z@Ey4Mm+s@?GBkQ4Z8L3EO& z_iV_A>n9rNXQ zN)(7CvDvdLNkRKX>I0RwT+R-W%v78PXsi1XVpHLPfzv1OMZxkuA%VJ5dMpGa8!?A& z>;%2fFR;U9xsWs>EHKbu^wJ-4-eU~Yepnadz#0s#Z_wRILjN(H6pC1pj36;1jTo1B zcF3CSY>HcNraVTp2oa}+nh}H>Dbm+Vax91bMY8$Wwz|PngfW`Z6s47lEoDaF1_znd z(K4QXX*vxdTr)vMfQKno04I>fI6LmtI$865=6GS#Gv9K+f>ATTQL9($95>Ckq!(I) z`_%#;VUn!Mqe*xwvXh&%s})la%>nr{p)7^U-5YHXcGrT}htIi*joKJ1+(f4ce^~YQjO?~0-TTwXewNv!h z@_Sf4yOl;p@=EmaXvmcKT>|Cnv zodYYz)hDM2VpJ~T;?`SjL1$6<;+(NA|JIC^FQ+x6jvm$?j^Ujbt)HED>HvN2P4XHq zvYrHc&CZNGG)XNOW~#DqMO#4b(RphL@KyQq8RB1jOIyTpEK+7-Tn& zmgMqvK2%z~8g)iR98S8hVZ7)`J9C{;t&uc6T1{0GG3L?+Zsl{LwMaWu3@h5&BORZ3 zqGO~yz~a#86pj7H>nA$w^G0jSaWse4yMpXRZg%Of8_9wXQ9b>m~+rVq_{jgPU;d$>uheA1nl^cm|5(sRitCoITn& zIvG0&+(=D7d?n*ihjebq1BjA}!cfj**r5%>y_ZXRJZy-ytm!=mk= ze-^}}gUhJ3#STxbmb-C>HN6xYGqubT9NFjAGDPg`c>v(~-^c$2kPgwt|G6_ld+CH1 zSV7&N>Y(^7*&-+(!2Ym5xQd_&ox@oz_=Z9#pKxK+sm^0gH0WX&05@=z!oHX3?2>no z`K7->bSby9s&C!V6icd$5%2$*e$y*m;6fnWr)nsHyL8kIOZj5~CXGiubjbgOT0rg=m@J?peEGE^(Oy zOw|x!r_b~;#j6+1PyLfQ3>Q81`KHuZCH)|2)b-LeIo&)w_m=rE#LrIupxe4XWH`^J zMhfU4l3Oa3^tQQ!LZUhG(c%`DN$%Bclq;LYU+b}uk)B87o^M>JlG6zB!s zYO=VYqg;10MT25=RQpw}LTuwX-NtBRpe8`9#lYWl%HFYTg6>px%Vj8sr6s8G#wg68 zVZgN#;iV?-T({*hSu^DsgHLTN(SMd`8M&@cd{dT{6Qj+n%cMU`rU%!FACf{V%`l$Kn~{t{akA z$P(U_G$i25vqLcrt^{go>I_~S<(sB;RY|(&%WgJy86uYlu$Ld%7UuK(A6ai17UdVV z{mu+S3(_etbf<)Xba#VvH;792&|T8f4U$Ut(1<80ozmT1d+`4}?|%2OKQec&WZl>K zyUxYV<|x9DzaB-F_ZDcSX(Ba@wLlFkXJO0Zjoc_tPM_f3Wt14YihMR^cs0Mw391Hg zEbV`m$SDvJx#Y7uk{|f;P;`J`5g+Q>X(UG}cQ@^ni(COr{YfhYb4bIk75|VUN_~LT zV!G6o+c_zK@qSqIuaKDYwFa6z10LX;r!(8@gd4yC{;^qEaJMENQ5(UimAI{Y z&iy0Ex%=* zGo6H?X{+1x9A?TJxPP_0V8x#zU`eyFfv4&s4VPhEIb_^fO6G4<;qk$GSq=R^Ec-l~ z>#>s!e;!OL-97LDDKl=Cz0+4u%NA3&Io(XK^ozfhzNvhjVrM^RR;=j=JN-w>!nffe zEF{}OtuUCfpGTGmdz>T+Qa}Z95pRonra~jQ0Cth09&wb=II9xh(>&&tczSlRstqU} zq<1@Cl$MA2PO`Ec*K*jglIq`9+Y5;=wTUlk+xOw7?I}mIV}*sKj+_1Zu#~btpR;(^ z-D7O>Wj!-c{+U*QV~%fz-GI3328YgYuCybs$7}F|ul&I2-1P>vMeTJL zlb5WJBfoO}IMZ}v6WTYeE4bYFqcWj71+$^E^q|Km_lva{-<5fhmB7NkaccAH*ySe% zO>+!d2cEX2am7c6bA&#Oy5#}9Xre&m^xA%MqU+qeUgJ?4n7DoTJu$P`Z*_sPwH#!M zrAItfvZBAJnTgyaA1qu@9k~e{)|f9@o&ii#1><&dURQ1?z+i|OAvTU3Pez7dEL^K* zo?%tEB=}aGx8>4kta7?7Df^115+{7)`+V7HTbw92;A;Mc>Xgmzr)^bEnA)n=;oB5d zzg5ra0&0cc9}#X}jYr>W(Gu{zh{R{5=Mcajn&Q_jizddEDUHcysvCo8am%>>`9C4i z6?rF#fS^mwZ+Sz6pJjcnU;_A@4HF5h=O^_fKgpiV<_4`9UGMi-ki{rKZ&{B8ezj(^ z5ux5bq-dD|iEqArj$HNgo!fp!Fk)E=_5~q;fJznj!M2+sh|`8WvUR73(tfFVANMPtO(%-0LBA}RBDp59)o+^Kh)KV@Z`f#bovp}aE985mRVrEW zW zAPNKqo@xG*KG_!dUEs?_L(KTu8Sxx!tHZ(JueYi3l#b(`#IkzeyZc9pRCMYmVZCM- zWTj3ciLqCfef{cf*fQQ`;le#L0u8|iA3S)0ZofbA{-Hves4RTJEqDkFbP7xn7bGJf z`++?tK`wapD+R^x7j67dUzu-1LJqoJLE(#0*}Vk@x2NC#Un!wMFsP<*tBFP&xZ6>1 zw)SlwgWJaiff&tzy68q*gZPKnZb~7m7pbi+UZ+_7D5j0ldPnN=J)Aq$2EFCt_+pFG za~@B|>_Y-3#hJpLSt^W}v(<3OG`Nh7+Po%OI^P3+y{T{eYDqI~K-5g~i#wcCPd=@@ zHO5K~`&V}E`C-x4S#8-=Xig;DUcf$fPW=Kd%yn}Mj>D;))0gKa?e>A278B<`HVV#j zV@5w$%9<|OtM_OjGW!OFO3kk6CXpASei>02-F(|77AMB}kD}wpr{(KOJm6L!m|sx# z^w3WD&T;S|oa{VaU7yG`GQt0ms8K^*wK+?g_Jwj*O2Xkz?dPEpwZ~)k#}A|%mp=}Y zdMbG39Y1H~;KOCA3C8(SUzKH_E!vjaiiSs3z*k!76DN<;RRnNVd8ooi)Mtqk3Vi@; za?OvPjvRSSr#;Ap@%71FFtuIOwp$%}TqY2>JT{n11wN~EsxN{3T!jC`kC0pT>ks|3qzGmY8zT*5l?*!*YTv}Yt=Kpwt>fJAOYv)LL?AY) zS|{Qb|K2DW0KZ}dUIs*#PwBD!S{UrT|71^hRF}oN){@ypmY@t$JV4a<*2^3(0ft?s zs4;Ae|1?Qo(0Z8=YATGNSpryt!juqh`u+zM^MBH9HA)%>xGtLfSu8H*;J9~6z|a3@ zx}XD23am`gx>NX<7j}ky{^nlL>Lt_H&awD*1w0e(blLbdO2P+ z-~k8W!ZRY}bMjwO3c$$p|JAbb_Qz>7;W>N4?kSzQ0f@KfFQj`m~fK z;rAI+lSg9#vPdBhJik2z1w6HInwZ@H!JCZY5(hGfJ#5nZH$^M|V*f}I_FoqVi9!ft z-oFs#6k?=;lPWXLTrUw||I4EUiUax=ifG|)4<-#+eZsN$U*JVljs=m0l8pgC3xj#p zfrTc0hhC@C!#&;9hNCItn zgN(19$tXCbMG(-xMmAPufiR}yC+eP9?GCZY-EOh&es2M<}`(Kf%qG4AtO zfr>D0Q{t0;unRi?#i7kg4i^pf;?*(W4Fb}Ch}j^D zNu+y&=<_}E3O`;%=Uo4TH6U12pwMo4X!_q^5Jw`CHefhEfa1A(V$p%*&1hkYo^b9g zpVN{IjTD+*iLm^y4h_KCMt3SgWUF7*59;CYS>K_DOj6|&sl7}D^M9S{UKx@QZn$y9 z)uJT~r|1f)aoC`Xb}oa+&vn>FC3@Em=fwhFBATFq-vYc`1*!g_dLQBd*%yTG;Fy>h zWk@fbDB&Dp$Mc{UWk6lg^%tvvlYQ@C0_WldFus3%h8alPi_dqkM22Di@U@H(50KAe ziQn>_L?}d*^!%bSviskJvxS_n~WAY_6K$qteY6MP} z|C_njcEIO}AO&SzQu59g{viep=itP%*l`o1`B%V~K#jk%)$O3%6(Gl3cW%3X^C$r- zk;i2Z3KkNS;E3Sg{2zdY4LPcwQvt%r^5Me{WlSmN>o8sXj{!-h94y=044wk2#5gn! zDJi3bUBRL!h0|c{1bNBmws2xy>=G5KFW5h1zxZug(}x>Fut-4PS8%S&eq}i4m8mD= zkLdxM4hLScQ5h+GwFupYtSEpMy5cM{dSzSGqBltT;LFlaOzJwi=F-Y=SYA@W!Jw{J zM#|YIa}w#aI2HivqK{AG0{Qb_Yn4?Z!QtR&=eI?j4m||8B63=P= z_xM=-qX5r{xP!k`gw%I4%QMt38#k34zgmG32O?;L}!SC_!J&$?GW=A`&byQt`YrTL7T&WAe00TvR zf503Qz+$-YVl-~~NY3!*K-PwW^>h?%CsAcCtOJQ|`)d{x->PB>Q9DazWvcALPT0zEKn3X3(c5 zBQUEB;Jx2z*w65DpJ`ia39K|R6NU*EBjMKA`||rJnt#dc1WnWSv zm!zB&f9p#{Drve**8JJZPJhM$sH?`HEFwY4l&g=>K^Bx+nmi?7!4k}Pk6WE-sDI^$ z$g?s)3*pFsGS+7zjh^mENW`fEtoZ!zKPA9yzaT98zfWcumTXR|rl=+P!L7^$Twj7G z+q6-^q*skL4lFzL-~vOffr6>`>}dQIO+fAWrayFQfY2u%C?5bIMeY!2N@-x2I{g@| zy@CL$qf-1SEH*8utYCV#B0SN8(!;$qg7g6n8N5d-CdsQc^fpjxT<@@7Sf@&8o*KlaAd*9ZB2efZ z=tMV5=3+4S;MqBdDdQ@Gyvy{mzd^wFcD@qKCg;}hRVKqe^$OTAJ{SOE!*1G-%qFi~ z_ykYpS-3tgurH;oZ<$PskLd@`{5g2z7!svQ5kO6?Ajwqn=XJBNNmC0s=v!=Tur^yj zJ>0Jil@NBZK-M%x67c*xyS~M9rHnuAwhV0c=aRQYHT1mg)Cfo-H zt0oyx2_Cg$%;iOc&69ga_hbFh)7MAGK?ooQt2YO){PM%fq&&X8rqb&T0)S$1-nmR1 z`WyVU!4#G^AVq{^55GUhcE_U)2FJ#k|M-$lg>10Qyx^zJ9{d%;2af{?ZH1F*@Bli>Jg)NZ008j{SKFeop36g=yWVtXe- zwH1m16@uR@T>>ifXSLD=6A#%xn^Hm{(SVg23Y7q}`NCJ%w%>e9;Gu|E?#+t?>L%WkN)R zuzXK>2gD*!yR9Opp0(Q7JqpnLWR>Kmujm#3`uk)6fIoBGjM0P}tGn%J`~DsG1TDrl zd8Tigj66BKjy60m67Yr!X&=u!vc0GN#6xjaDVuL zu*>I%uTdgn-~oyzn<5pe&zG$RsvS@)j|~U<7vpa~|G5u!HuIe~jr%0iU`icd{6H5f zmq$@FLZq}8vq|!<)uFULd$Kv3D|tpDva54kVfSfh-E8DmiSgJ7s4Cy@j^ThOzepS0 z79;RzkJ41IAustlUr3k=E}iA`@G{Y0FhiiCtY9OLwNG6=V{lGM_A{0LMfdc=2oZm1 zAi!0~EUox>Cfg!jJGrLZHVh#~D~fQC{+IdW&fB!v@te=nS#bqqj{IpDS4YMPd{h*9 zZz%FdXgB@}c(Pfo_uj9^zZ?Ca%{{=8xlOZIQTV&26JTo}%>*5fdhY$4Hof zmvo+9`9YV-Hn=`7y@}p=KfLc9UgkULx{zsS2x~;X}ORh)S9y#xFJn)EcA6OZj)V?@OK1R{_K}rD7-+wd29DYdYc|L zZGaEKsb+SVQeMaB`R|wfe1a72@I`9Q!t9f><=}yZ=m};{S7+%Pc%EZQV;d#GSSjEp zq+|OnCKQ0Xf;{x-Tn^}w0HqEKN@{pYkf#82@6rJWKxEh^Wnz!w`)!%pZ~iQT51p^QP?u z&0Ct$+1r+P3)|l2_AgO)GI*G`!(>vMI2)Y=Ez}LNX%JUl*6L5)k6-p$(`;vgYSvV} zy9b|$+fSbKhen!xtTg+}sw+=8zlD->6WO^$!ZV(Q#9yYuS00G9$CQj0r<;jpw7yuP zCSL$|VekiLvfO4AzeK#K&c_buRLDpeiE=DQ&MFP2&IYUr-X2E&xMzktynaR_+y0%C z=Pcp1bB^@U#f4J|1>7N^Tu041F`VAPWjdybluh!{_QyhX@}~7`k%AjtvcTUtoQV?R zCvt}h%_^>et?lizaPQWLXD?Pn%e_a{P&zKW_4M$+MuTCBzuqk-{o-<@O zKUC~n!$CL#BlQmmw(JIu+0!VKUgwb@f`}mJQfm63kDkx{ICd*ey(1X%2n%2?J1gOd zT|Kxb7T~K%{arz5O}9Bqi%^KG3W~f0iXNu`JOLLCfWbv)&^^nh^`}8W|IK^sL-Xe9 zdh`}nm743{9m@osYu1{j7;gB(BRj`P92Jh_B)XxDKoN8_OE`v)!U`lm-LmEoiMmOz zkeh+|I_8bk=XGDG6>Ruw#*a*B_Fc&l%<)T!2senfxxKGfju{E1Bh04pz(oT)p^73c zonA4yA0FS#{v0tm5YMYlUS>aU-(Sg%Rc!^;7!rRoeDIgbdP?0J6gf`Krsn$$U(Yaq zLhF|eAhb%xkH;b3{witZ?J@{+E9_8-&#Av3-mtD-67y>wMb z13E|5_X*Y4GfRN_)*=)&zolrQuiGW@`OO*z*KjKmp9_)}EJ{bSZlcWVZt2ICCfEs-X~KPl_$V6L^$L2P+mt{6Yw`EK_t%+b=iQCGP5%chQg}FpI1;28Knk( z80295G@?%XD9v;ur}yx5Y0;3kv6FGsX2G3xFFndkIC-jKvDPY!bW}3pC1IskXlo=B zI@+nC(eJO2vsGqfE>@XwxRITGH9gpq(@s?)+&b#6BU@iVn793ayktt$|2j!})&u`^ z^tMjyw;3<%482JOUbq#^>B9GXrwFNY;QzAkD+Ci7E+oMHfT9>TR6uI2@%ZDayHk@5 zRRapz_IGY;{lA=c)UEsy@$7Jg`gzCVUp?TL%NqsZc0gdQwMiCat3lVzvh0Q)a%E8;7f1pw*K3+Amc;B6uz#|G3X;aiy(YGcI@+gme;b8QE|u`Q zpMBh09W#$PNtlEfVm10K$5MkizHV&uNY(CW2L!Z07B`isGIvz^YazqZ17iPRIgM9~893W@Nf(QAs`=@ia>e?H%XQU*h?SvqFjBB;qQv#&80qAR$OU`ne&b%HpOtiS2Px-So{zFPuoOJh ze>S|(zb;RAF&wj4vQ0BjoY~0JlwU%>)B*9D9cBazj5HvkZwIMT19|TS-?kL?mw(ii z1D#VDZ%;%u9d+7(A>Rs|+CQJ-%d@C+iDi~X0HlF--TlsO>?g-U7;8tI!Ly{lHjKRP zr`{Xesz+o!s7z#TVDS9GBGi(ClIx8WHdeKN`x=!QtJs5Zbp7LHiZr#ADOy0u%TghS zeBl_!Ql_egPc0r|vQO*1KAaqNZ&9Q$%!tppnY?tp^rtIKx1*#1N!*WVOBJIxf)F!u zM0kTGvWmL8Sz+S!rOJ&XoMHVcI?B7$A?iq#E_6Tn5%KsmyLfQtc%?{tSnwV0hmdE< zX;1jQj1B!e4XwtWxeKyqg8-A^gXy7?W+zKFm$2-{cW3b$1noxeA-9WqM9I2$Bc z<`@=Iar9emhG-Y7Zf2)uz|HNl%_n>lKb1(m$&65DAzah}>qHeV9d6Q77$hgEk<45bi!n>MvDIZMZ z#GW1q*~jLZ+2ygl&Ym*6+O%z6{64XRAm&kC{gqfXtkCV!H{)unYF9wADiXjtf9IAf z=wHPeL-1Cv!0g7B)hT3>Jp*Zx0G0F7kEUdIQ`AJyVlQ--zp*;qr~yYC*3Z`5xy*KqucLY6;8|w zjXYUh&8q(Su4wtW6=^C>o-CIkO`N%>EEc{@`_Id8PnP;!s@=+Pc%#~~x0P?rI?m|$ zIQQO<{lVGfzuETR4MNV~xez)}-nNbh)WAxe+{i^Dg^2RaTGBHZ68Ua%tkGCT`!^Yq z8>1eF<)`PYYuMCaao~Xa<+6;N?@aM}{ICOP`GI%g6oGX1Zxx{GR_Cvv?>6Zh@K_z4O+i$sjoOx?pP4wKCi?`IaC0B6ljqQO zOyqqw+)H9FItOj1gm6i_5GNPp+7&HHvri>E2aFO^RLwdpSUg<3&|v{ zr5*0wLsMj^n`A`O19Mam;Z7l7lkuz_QWuVMXQe|^ww%P5CBWE;V^wy~HukpJEei`3 z#fG-f#@o|REN&?&;75#a_nP0F-)NHpy;Oa(QXU_~9Ch}5wNS04Q*rS}k|*;Nqu^gA zB}<@BotNh8(%#suV{F{eUYlJ4FO$48cQvdn^-7~zphfAI&dnk>b)s`Cr^`qiw~?eC zTtd`fzH%4tPND3mnv@vUx&!Ppek(f__1mJq*4ENN=dUC`WQpQl-EgsUzfkCegqI1GQR34b!;McnQO=cpuT@PsJLZ2!BiVuhT?n9sEfr?K zB!AmP5S2|9ZA??RnmTCiFSXl;70id^GD@G*Aa?KC8=oVUWmiI#J&1=W1fKHb^p@{f zZ0J_+<@c8wDI>3ca%c@Ux-zZ}Gr&cXaT@lp*9}@7k-KWs>%Q;=yPa3OW9RuoidQ$^ zpUuH}OJcp%P!`V&#(dO|OIjc*_$hO0^z63ROEf)gwbm2W%C_f!XhUXVab(|)Hj1U6 z>Lkep6%dE;ouJy5mQT35AD}zoBj~;UzSO!?7N)bMWr5qgMHeQW*vc?&W1jklB#UZG z#P`FaIezNFiJ4k6_m^K0jq}-DICYXH+&T@$E3~fF<0UHusr_4*k`@(LWxqQ6dTvpG z5Ez+`!xn67yK=_~LDgUxKY=&w#$fZXe*4~+o|p*>K9Fg9#cum^&VCLopX^h!Ce+Oh zQX?j3631AP?5KmQQ9dlQueIJjQOpTnv{^%{(F)8vPGq&)JSmS_X_P0z1iZM03tTVS zR+V}r|0Yu`x{=P>Lcm`D?TmfynEO<5q@B3iUQLD`v>mClbIl=wB#pJwe!RF0tHU-& zI~V0lZQxl0EE>KjD4ubCn8tEY;qP{*Db)K9F`_y@12C%Fwx$p~Mw>$y9-`^4P(8A_ zI>sM{5z^O;POtnOR}3GKaM~3@ma3w!L;dDP#8SwRT+6t>SQU`xJ2Gt)eVJM!{3FcK z)`6PU$u7BSKxvZ$fTv*P>gW<#YUd6|r{N1cq2+@7T2@b=I@@bw63Us@uKC@q+)^6Q zh)^-uXR{U?Y`Ep)@y6JxZh_)TK~}Yb^8|7dU%`@U5v374UEGnS$zau7P|>`Vl!TtT zFkmAnP*s5uk=t>W5JrXKqHogr+TH5#U@q3P>y#)>U*Mdtl$*UUF4zSW;CZDN^ zzXB+DkpyeXWNmF_Uj=D^HW$)wil)Q?^8wjf3PMw;A_3w~1Mg{km{(B;+=kmSJx!^j zt+LJJCQ;t?i@gNA%t5V_2f=z|Kt$*6p>exqEkD3DnFr=`Y0P;kaxm0OPg5!fWxNx^ zBvhM9LYdjln(KZrY>U}4+PP(fPSrONb=_OgU9aB&SYM!|O(yAD&@G+@9(yyljsc9m zSUJk(v)TJR1kPnMIMnHX+>BaCm5&gkkKa4+c_sM4j~KnA*DXT-#E=LjD%Y5OZi@|Q z;9dpXXB!VK^aclIUBBGjB5#ZBtxqTYb9oII3M_ugK?uOQ$E;1LAVmSk`qi$mk9_%}{#L@o727BCHvD7`3CN{PyZ@gawulVbOtBGHRWTZr=nEFl#oulV7W5j{YnXO1YF>n|&YT%|`akX&nnlgfG(^NCK$Ym< z(yB5va2$HbH_@#kv{?RJK}d6}YboBXSmzDMe|Stlv|9`@_37W^MIW+_KvgU_2lyX|yh=-JJ zuEJvzm3QqZwTsH#o&v*{6K*&VAdXEE)KKw(%<?_BAQnoXmOS?4e)Ug7v1-dnWv zmq+-&ePZGO;%;L$Y^d>21+Ya7N>7GLs?8LAG0xdfRA@nE)G8&rlv7;PcmQf|G@zj?bRb&jSKEG~*+UpA zfcJ0)o%E7tB6enX{JwkOa&F=y4kUmPjHA5chc~F{LcWAMqZ4sqsYF2scz1w4?^Z6@ zHcjD;F@P4O_k`mO=SV>CH-T_8*p)eiUvijwsN}v{8}K$98d9bKT!+Kz5ThpA*4l|r z{y>Gsk2IKn3y>Rw&NIRADk;YKkaV*+iR1Sv0}7uJPZBqj8c_v&HFx?~tY*MX^A2jNS-V!+fqA z$p}%l`IBHZFP$VGv`F@iwAdNp#q4xcfZh6;o)<8*L}zpB28&~U-(leKM%G0CUt6&N zi8G5YUasUQVyv%{2dv5~=1_i|0*e}E{a|!ld{e-SPC{#<-`5*Q>NxE7++Ul$q zi55wO(A!O!6&wCgl`mH!h6Wd40M9_nZ=s6l$IEl+djmn>&ouitN1bj)6>`sQ>E=}8 zfa4+}Hyi{obLS7uk?fVj1=w0&Sv4>g@nuOOsc2E=)_1&~p1<)(o?xK^KG#F3IE=iu zdY~*wOS$&C5PV*IGUGcgpS%cAF_M}6vF=)W+WqQ}hZh>~;gg@5o^;(Q{F>*>Qekr{ zZPhGWduh0^WcVlLl{l@{$gJIOa_INqD(3-~N}VC~KxcUiL`sgYugaqgpYFN-)yEom z|B#lQ(Q%5KjnasfR$8G#JAAg@!$=Cb-U{<5cL!MZYG<^daUNx0HGH z9~rT2Y$vNfZu#Q|`Gc!y4dFEl*9Xj96qZM;le9nPSSCvVj_lTd`~L-vFaxnDe{`%y z;SSBlO0KNoikqMB=FUHP-((LTnXkV#qbGkv0QRh5P#%;6pY_|V+~ zX52n0~VwJX?MKlT6^Qm zaa;!@+37H4AJpvhlD^Y<-IY8n_u^Y(S(JILSuUq{Wxgvg$iKcC|L1cP!Ms7Iq%56% zXq`Wn?9l^}Dvrb6?ZI>MoeXw>Y0*WNKUMh%-Z$Y|stpfv;7To8((`@UYp2gu-tm9fSO4|_Iq7G& zm>NIko7mchCc7URY9GV>{`IgV6dDSjji?mMMf9BCQSrv}mO7oyyqC7U#ws|_@048X z&hzEW$shfKMh;?#2*Y{5W7Ze(&XlCQ-!SxtRH4K?ckqB+a3SByyT4)Y$~LXe5m`!& zIFGGElN;XGwa$}Y+J&aOqr$-RA{h0>6PsScIPpcVRB{+FyX@ucU2~FUABLlbnZb_} zlFuUr9=X3stVX(c9vIM8@R0cg zT8IJm|#L@nbu6+*en^zlS-<&jT%9)B^S1RE6nbEY9=+klaTUz`U~6y?JMcxmJ8e zsc5`lFz9x8u}l19;CGV>P;78$|MvN(QTrg*?~NviabFqw$=09O84`18^hre&zu4`3 z+h&QUEgEmKpSz?iOa`=_pzI%i7x`(}QhHCp^oM#}MS`#MzV>uzGgGWaRpxm zH5sjidQi5M-5guo*OBHB1cjS;8wWA=YTp+PjeN0^7w%f(d~tH^p?^lI@%QITy*F46 zN4id5?&nL>GvN8nFP$^GZW7lVV`N@WsFW{=dLIeJml7t_2)zE7XKivDcHM0r_if%u z1y5ez?q)!~ z=PbrQpuQ>+Ur}G#BnN@)==R}cMcJjEbl>_*iu#A&o!E}{_kO!dUq?&=4%$hJm~(Oi zVWLzX*kWjEH*8(N-J?YO5qWK4Y*<-rS(V1*J7X^?nUQgeKzGXTbQj{6Y;WM3KUCUg zuw;Jn>-RYjGTsansg5Ts2sJ4mps*3Jst5cCKB0j!m-|rRIR}=^9v(u)^Q)Cr*)yxe zH$*C%j{neE>!TK9&y2p%Q!^ZcFhcw|Y6`4FD1+V6 zq2AmO(bPU$5?xH3S6GT~X%d8twIyh7f{Yk&4u@0aPZxhV==jslH!-lF${4zls6G^y z=n`dX1x7W4iInzr-_tF}yth3Jm>h3wrV+QiJCQ<7Xc8mk%v{`&I`c2!1>5NQ^o-$u z?8mg}HAO#P7rol6Xs=fCi0)&!Dr#oief4p8dCC2=GB<&u+W$^=GJ++XpHtrzEqYVr!6M0o7{8U(8$ zjGxhY3d(A%fL{`ZUtP!IUUcl<>WIQ{o9^Ko8P};?-=-dzLRTRjbu#O+YuC?AN;TnteL|O@qp0Hz;<|BM=V^ZGTQc8%kvb>4PZeRp z_v>zvyhrw)!kQ|{LfU4mc{?GezJbmVP@7XE;c@??BWqjas3C_@MgF%R{u#G;`>*WixjNc8KSTW$Bx;%BdTDVOJ{%YBZ_>eNFu9h z!~IV?m2V-*4c<`U7yS}Maba)P@(N``m-PINbJlEi2U`C;O7^LZz7`}^!ug26=~M`e zGAK|s8P#zl*{a4ZF6qN6zObbBN3XI!fbEcWq-3F%vkif*-q(zLAlbQ9Vf7|dW8TNI z;EPG6pOM)jGb2}Spswmc`Q-LDP*s(%TOxsTr0Z$1iL=D0tFirx`P$EKo5Vaj+D7Y< zyQ6uh*+6dUaiH4D6ZeFmltgtbA2Dzt@NId#a2m5p-n9)E3^P-|3s9@7Zhd6hgFV0C z5rz2Y$!x^;dfdnjiPC?!h^J&GpK0FM-_Jy2Ik2RHR7f7>Dn5d(mm_-g(KSazt`f1> ziF>!?y^PEZ?)*aCYMg+;+XrXRPoZH+L}#Db(hqFgx@$WN`SgL= z-$%Tr>O}jCT^lT~+!x~&#V~|@U$V|FtFHHQV;L*EcpQ%$w^_@}6TalOX|9T;Bao`} z$*&VO^>Uifx(S9^gtBL!ClG6oG36Yq^R=9QDHujy8ba<6JaqJ7LEQRGzEVyRHz194 zM7bl|?&4K_5;FT`c5(P9Lh#pD8sF~8Dn8RbSV9ajP~}CNP&X52?I+UF1rfrt&?BXs z-&SP0;5l#MFr(F0QI~cy3!1#iW%jSPqbIqGm_Dtx{fT~VD;2Dt4+1k&4ym1AeuFTX z7lT}p>7@y3UMI{dBZZc5NZ(lbXiUU$F*B3{-i3I}69pu81AC@~!VN1cabqKUB#zc*jSoI63-Y|#qvqjw=hCw> zn{7@RDP}aiEWt5-%uB)j$HXqnwYl~3Bn!?%)X}OUxQ4F-HKl+ubSd$LaW z+(MzP>);iVCltX-IRJ`V86t^;j(3k!-`p3YPZIM*V!1sFqKaq7pV6I}e%lww(K`_5 z%Q^4zcG?4BOgZ+2?<49HtLF$!U4a+IOkFfHMMScWhbe5+pp}!!F~8Tl81ih~ljlFb z=9VNySn-2vB_%voP4Wj=9jg#ca_S!xMoGkfgrL2cN}0}5l_u<>N~0yg9Ac?%B>aB!`e9Fzn~&tdl5V)XaFpg*wdyrF#0=@!bgrh~7YGffh?;M*4-9AogS|7m4E67o3GgkD*lKUa0J=or2{D5z`RT@npdUzwdKA=QgYWlAU#cv;{~;`=>M@CQ4e* zkNji;!22d0i6I>S`mL={>rF%$hqY?~)j~#@!9o3Y$9>P;wBy@d;X6s?9Rd?^+Tp== zMSi>lgwgKLILdmc)T{tp%TVc>SCKF2?eI_|ABATv`in$&i0yJ&|!4heQTa#r%+TL z48{7oo0y5^Utg?c8IijA!DKpJXAr3%T1#bn)j$CyOwR9I14dCPF}yS;l$)1r2oW z)J*fGcWY>i-zHz=o`?y9UQcW+ORo;zFpK}x7TSK76EupHOfdR8Rc3Ty_5JoBmGt@C z3xrZwrJB=P?T+`O<7WNmW?aChZX1sVgzl|ONI~7Ym_=WOc?FVj#v^R@$Czi+W~+F8 z)9nj=g9pmfT_+4A(~3D~Q`CZor&xp=PDMHjlNs0^ceOJRx~KWmo6fw7?=Pvz_K>a& zkH2Xq8L^%NPmyx^=j?3WV76-NRvlmQ4)eRC`-6<&D~y3)P>(6%2n zAShb8H&h~SMsDvomD?3lC2A~uQSd#$1dGLR738YY6Qv0?cKm~}JBZ3516rvr^T#0# zm=Y9=XJ(CQYh`EYao=de9zuMLui{%eZzY0A{h(a)>ip-9?%88Wz&7^29u@mnCeR;@ zKMA<+8W5rP2MEUn%1}ai^brCFh`J6#dchTqD))*88A`F8Y0;uQNpWtR@>DV_!3+W5 zdh|&E!sJw|61Fu%HTj{ti`hDUE$bS6>r1fc zS+j^-rdl->P4J|ZwLVR0cfwq{1A1AM!&-on=AFfG9upP|*_0S}sR5>O z@K+LT?vd&N0&?#mxn?p{z}H!S!6ppFiR*$9+qdbi?t`{%@uzS)LM8qLZNQmpT!0MCPq#R-Y6; zDt4>aU*6}zw=Q~OC8B&ASQ;qsjte2f*fW;3ioako(LFNL=jywf&HKY9JK%ViRvm@z zXYQCV4)GRblAgHL-r=Z4G%YWDpZyUuO!HpB()u4NC5-b=%mXY2FqX_zsICVA+wyHc z`?6wMhbv_CcE~oKn$=YIxHLRpt9`N?v&@|*x?d~a*0CyrwtecfqiBa4$LZ*4lJLD6 z=#?m&U*$N!ba7?X4CCUUaIUBpL81P%tfF@~m)_2>Nbg3H9{&GvU=mw}9{HF3_O_l^ z2^9k_)b-9^4vG5Is)pANmB?K3w9v-KhX9(b7Y-xGCX zf2{+o?W_#t!2r9dQvgS8D7OfDmDN;{BtUiQJHV#ucxUC0;{U_eTSrCRb$_5U!vF&) z-67oy2+}pu-O`=XT~aehgLH^=mw)!hhYq1vJbM`rV zpU?j6y$@%jZlSK0l|aI3Z3lh_r&_qVm^NUhe5wb0G-@jbg3A~9G79Rqc5Nvk*;xjz zOZB?pcoU#pjb}gOFDk@Z1`;QXs_OxzT8hT!ynFFLiGJ^n2@rrD*Ot{o_m|tLJT~-% z?z^8Y5Ox^;0&k1l^E=RXS<&{$X|AJ<4>#s<3sYA=*}yZ!?X~f*0PcDkiz$8G-D&hN z#c3fHinjHd*#ksp#Z-cQvxflcJHa0WHV@UMq+NJUiaZ61ztSm%H-*KJjjh7gP$CSw zDZg+uhrY6@9D0i=dIADcD}TOhDbg&zSS8VI#c)$>Uh>}z=X~)gIDoXOX^Ssh#52*L zd8{SHL931gr_HKAO{EdL5DX|7OC$!IcKh!7zh!UYcwSF_^!P>H*@ox!mH63F2y0PD z5nJu%~1v0M)pk0Sv8twjyJeZ}3zE^UhN z%}; ze%V^;#y``vrW6$Z5WduEs}8xkB_Y=pa5_4!P!cFT*vVh+pK+O(?cKhapuu&QNBC}#II-u%Cy3pz zcDu>w*QY~zXSWOyR%0HNZ&z>|N4(AB2^69%Un8k}xC$pyTLGxHM}uFE+pGk)w4#DbNV5$6=1j`rH~e2*cU>vElgL zS+|OL_@cAx6-K7%dE9ravxGW-K!f-ftJr=Z;4?I z#dKOLqmr(P(t!LciMCvmZrXksX2aZ&{BfU>m{&uDtp+;pP7gZ_XysON@HwvmADV=! z{Cgs&&BZMOu4HFaqVl2BS`ViF%H>!!;J4594J+#LSHqJe8gr%pY9bvPK@X}$Mn<7Xbg`*mt7@k6 zT~0rJ1^Gdgw0Vvxj!E@&S zAx3551b(w}2XfDRpFBwRu11)Vjqj>$QUK%aEzPkuoQf@@N}!RbFgkUz=1 z5%{56pB)EZ^=nDpDEdioFoVYb6$?-(z4v(^+m^1{4S*y|k*G|U5soq*nmj*&jkZuX zmYYC=pIbvOgHckSqg#|PLN^Cn-|a1bKqbu-kJKt?(P)hfpPMx?D0$a1U^wC)iSlWa z)*@CBPvPMmd9Zqx>Mj7;oGxyCH5~o;V<9^-RFbBCy<8bG$&D+MDpH!WLsSz?yvH9W zKIRd#YBY%=weaELox4i7gghp2g^HTY-w?0Hit8(oy!j1Xoawnrqhiq@B6@eb*od`n z-PaCMf4PiuI2RpJnSE1yOb~GG>bzmm>bV`t+9ILZZ5RE>Tg^6TD?g;5ze%v;6r=A2 zFt>j|GOux+Q#ppC5&t)bJ?;V37u>ic_{-_bEx97fPmg?Fi{{j2H~^TGC;0ZxG`|PF z$^Hn6SHPW}Zo{9JGl1=?d>z-YQm~MN`i*fOert=}y?T}#ys5;=u8zP#`$SGI3>a-k76ATLHF%DENDhnt|EFpI zMgAG|KUITrTi0deFaNF@VE+7X)nLiM-honwNDO%u%**jxoIvbGvx1>8j>N{tq$rxJ zms7dHSDJ)GQ&ISGk+|!sz6h4whnGKb;v=9^caZ9_c&QXD1$D*{sSK?x^iX0AafuIK zT@%BaeFb8v8@xr^c+!qyIxbeT(*3+Q%rn@(k1Y9(3SMUOT)O@e+`(jHV3l6qoZ`fy z?TX5;^Z{oB+q1nt4p6J@XqNz5pDqWrC)dkFSIWfg|5x>Eo9rN^vW(mui@BFA*f{+b8egV4%Cxea+s;*vU0M_vQyp z1VdWV=r^v>7mW!oRK|zirkH`#wB~9uUTvmxUI)bPlAcB31jhLC<8wZu>=wB403R6E z6u!IAy|{HpRpd$g#FYKz^-As@Rmd@G(BJ|ydMhwfn|63IPEgxk)Du&OK#crR!N8O6 zS5%&M>>NKfz9)@$f8dp^E<7ltMDqw`lF0#fdnucuRg~qz(G_5vXriu;MFFRS)rThs zqTEtA;+Z?#5=PI110%DB>!6AvASfSD<|0At2hJAH+oQIRYnR^8&HW6$Y&i?(-d1-zg{!pfdb&eAM zUI6=NP?H+|WtC#=+gcw|aU2U&Mx4it4jE4b?DG1VG&Kf__txNsNDuRfzziOUwW*xI}bS2`8?lu=TYi~XDSP`*iTn47(y@JXe@ zy9u>MCvx?3_MiO0ccEWy(MkPSu$Q?{>jTcEYo)}npXz>#)~CioMXB65I%=T)nl`>i z_MT#HZqjco*^S~@xSRg+85zTqlu=*e^GA+Mf$SP_7FJ&Q&y@OXd)K5bn?h(AyYKp1 zz00Np#XsunrCut%+2>%_A=GxPp#i-vC(We?0}CL z35h=ryD2jZl^-O?J340OH|on$rxFn#n%o%%`+dh=t&jDTbUzAX{pfVi;CjV4#W+kE z(ENb8H1e@fIH`hVL*>YUXq&LIPsjOVvktx}m1+7X3vu%+I?~)nj5}x#d&p{&=5?{C)aIvJIC%0_<;{&E)9>X7tnpmBCd4wHg_O^F|VYzk6ohc zP05E!p0M0|HI)Dhw4BLl?WH_kqOG6%4$|cQU3l}RqJmC6B&ClZ*VLH5|DdzjN5X3K z*qUIrGV+xN&kruY^{>x;z9y~fa_oyx*ce9>0w|b6X^~BJ4SK|o5QIiQaGn@LJm;Ut z5!*Os$w4HO$X5B((b)H$hT1z%%@M`1BENmxr#eKTZpv@WRezmTI)?y5uyXg`bYzXz zP&hb}YUF*aaeF^+H%nQna<_H+%PGpT6ABL!-hsZOfXKi;>xc4>+n6m+)ZaGmj_t6pm|=n|*wNT#5j#Vk8u9jTFK znFFsL#9KHY34A<=Ek;e`5DO9+b?957W%rLk~Ju+%1XroFd>|4+2UPO2?LFH5Ed5}VrQz30nttiKRERaC&2Z1465^X1jS7gui0%y4 z8BcxQRZ~1DtmU}x+n_hF_Dm&(G|bEsKV$4g7Vj+DJLmB6M?^4cAv!B&; z;pbCL`Q_1rdS5IU(MMAATP0q;#AB1DSk(11vU2Ril-_kW69P0*w5?VOOt0+f_R&6# zR_!L)3;(92Pxc025|I_ZRfr=&WX=yqG>GW=^U$%pMGGgi;p3hKeaVC zwD?+#W#xJ_#%n4D+VvdfG}uE3no5+!DF8+0rb54X`m|@MphTn7H@caImIo98&?piq zUKS>I)4$31^WuqwoyXW(H(^B&v71AbS&H9?R$@8>u~S;Z4Gm!eF8?GWmujH4&jFX|>E0GQgg*0NlqrpBtjtfJd@d>2?NtG? zbYcnIg*tbt*DDH#{dw`e9yjHNcLn%%?Wws` zpW1%L!H zq>IQP_MZcYoma#1tFK+-X{r4T?9h(vjZZNi*Sx8r$}(wjSI$Y*a}YCL6AvFWrm!z= zo6~oBK4gvdl0eq&y4=P#D2cjudqydI@RT>{ID_~{UhRxoKxFJO+Y8DIHEc5bY)w$s(u+eagTqXcp}%(xj`CMU>NptKpcRhHNYf3@#jgiUU0$HKa!U=;ftwy+vz3dlRoTxf@{(U|=(BbnV zkM*xm_NR&_Sd!T$eJbB)ybmAr@-kHmkERSLl+4ySU{a;+yYWBXJhXz8*1mtqzAaCf z@TyuT>*V^ZPUuJuahOd08HQzp7cjK}*OMe)>Ur_TWa0cO9-lhfx~=CIs$ppzFRVJi zESQLQ`jshAq0ZFB%p9FV=>Rf(4VW7{0AS@3zG4n1y(QW*&d)p%Ks+&uj1s1_M6ph0 z=1&fVuKl)Cbw-a$)|*CAzyoO2hYw;?S@rpIK8q}P%}?qb(k?LQxy3!2d8+;G2tRQX zultLJb6k%R$i`$rR`E3rxksd7MjclW_J&(e!frO2U5E(Lm3NTdBEeT1n>9|u9wUJ7 z=_%gR#Fa7H!FCG&1XA}^qQ@a;u_>a3z@}1~&P2&(`~tbv>(OChEi2kPe1vg@g#)Cq|`qR2y~9g#&i zduRKO%BlLshQ{T_<>kGGO7jFu7p?N%^*VV>F*~ev0Pys^ECiQ^_Goz6_s|ouuY}Ju zkU1b|Gh%Vn5qNu+KJ0tYF?|y>Ba~h@W9;{=a+Zyx+1rNAmB9->k`bLUO`;$%l=6IN z^TgbDkwd&;)-7>YQ|70bYKBqbidRwlw|1YqggkE!ADL6WhW_Licu)WkjQigo-7k@s z2hV1*KkV$drLk<8FzisU`xm6yS_w&6!0*1=7rH@5Jkc1sj1nJIeD9hgf6CT5UNcX6 z4*lRAzCE71n`q`wtRFhdeN%mtI#n)>Y2_EP;)m~{yELat!(&Sqbi5J^10P>^qIp!p2M4BX4L{)3abQs#7Yxs)LLrE`!cMCMC&;tZ_ z5~6Dm>2p&x%8p~F$%lp@4*(%SVs_Q0j<-o}fP3ZmHk<98&S2G#sKY0VGv|Civu<$; zI;gG9ufLbO|6E&5O-ZChKI{Xb`R@;?5o)Vn3By@UMZ-yTf_h)|tHF;S?H{HF4ss2_ z9jX)^Q$9C-=^4bLpZj-f%zgq$59uUtG-dI1D*PWRW%l`p46tOosNmmx%Z{lPDOa?! zueEQsi-hTL326UshX2e3B?FbUy&2W%49uWBC2na&*j-bxZya+Sw8~PPIkOSp&UhGj z@iaYZ*R}EhcsMH-pMH0K(b*|)>)tV@6qvxg7dLF7;J2iIYvh3@)ln6R^H*(FK)(s+ zm?mwqE=|^e1W97ql<~{gqyD^96gO3ShUu;>7j+VzbturVOXkk`OYTvhCNc{r{1koV zS#M$=n28Ux80T)sgRVy2lS2e|)lK8Y{|w@fX|PD=`le&&ZH)nBhUp$`pcpbf$}mJ~K!UGwYG;=Y8WrSxdUloP}rC)ujfh)Mb9Z z9uJO1V#6l;mbW^msgq5e33jH@^unJnJV^(fAS}Z>l=m7LznDFOant|R>uN~%;k|Ms zQ&5&t$fW`PksY&nl}h|K%O@cVq81Mv9f3bb_87<(wdj_B@wDtSPL|%I5c(w?S zj|~pyr*Iz?ZTu?-rYf;-Y@mi@CdYqm${^vVx~rW@=l(|z)QJSyb5>8j|Kh}in^1vo^fIkR4~mcGS0WZ7{_226(?`&=&o_#J2Qg99Hey*o_R`Bys zQLLKpH6rHHC+aUs06;tVyL>fTorswj^&r}|+L-H>cJh->?Uh(o1b^5x$HI?@1NQGc zB2)mkDe-aMuPX&r<9U@$u{+gFm>im&!=?FG+FT;FCrjI}|HzM!(Lx zL^ku9)$S~6y;hF~8Q=)q)Nw%GF5q>i`%Z9XY=BekSkSzvc9Sr&clVSSkM+a&x=5=_W}9 z5fcb7G?gLjtOLHyL>=OW%)DIyx{UHXD=YYtlalo95*--Dt)v7cpAX#fJyKX{zY-=; zj4b$v1pbHMl;g%wN!O%sw& z(QhMU(wXRT#Z%ISk6jzAm7VCyT%P{3bO0!ic(#@?d$H|Gb<;Sg?W3SUJ^0C#@A=SA z1K~#WXCJ#g0Sx@-T}EPHZ^-0ku9ieuvKG{#*smXUS@Awa@<;# z<&D55@q0_-x?OEy_CNN8ewC?uZ3h3fLg)rqBjctj&F{Xg5S&D=gX!i3gL*S%`^4=T z3QWS-uc4=y2D+>-llYyA+nCe3c!Yo- z1bMtKZ}n(tBzP5A{x=Y82o#$BKysgi+rD6hW-hM0s^{zFSg>D~# zSpA_=u!;fFU&%^OG$^Su$VNl?XP*J^G0ep_o)i(vmBN^o=k?Fkj`cAplT*f*-y5x* zm^2LL>b80w0V2E)TNin?4}r;KUFw(jY0p;%EZZr5f*}@L z>em0$f43RX?=~i2mrhvv)_AqbMr!&v2&lEf*w94VTv3=?74j4vkCEM z-#>T*W{Vz@OAZ|nN>|?GqN)n`V|&F~fvZQBr^&6$RT>&|vlxH(8puww@=CL%vnx$D z3r3>`hl%Pu7_Tk11iu{;ENr9#WHgQ*Z*+=Y=NPEu&62>!L4EH{RK3m-pLb_`kPpKB zPwP-MaAL-dxOMUaRBcdFP=b}K#O2pwhr9JNMU%FQa_(#C@_{?GRDK`NXDBp|C19tN zbMC`WY<&ML3kU|$#?Q_oo>YE6gtI&fg>=ER5$TbPRoYot;dXdRjxvCLT+;Nr^&Elg zYUvcgtZkAF?_c?n13#Id$Nxy-0{+l?Q=OQE2!g0YvdHhE#=LpOopxV4Z))dOWt=3H zWE4P6bakHhjTx4U!C;Yn$@zV$V+Xa;G#UM$E$My+FMii1>~GP@p#A!G#IPh)a#LHON7 zi%9+pcd$VhUOR?A#1&MK#~Z$I_;i@6tonClY4OW*A;7Pt^wW)Pdkulq+Y0N)3EFtT zv*oXSo!&&gNojxW4!1NCYNv^C9y}k(uul|-q;qNQwnXBw&ZWo?x0|69@d|x(=z9Dm zNiAU8DupDJ9*;#88kX+gIWKCyl>+PdJCY&3+#>I>M!^)qi`ClPvAMhVkEf{AW-aH| z5}%s7wI;(jJG3K;^1x*=f{MS7#4)ZC(y>+$4-@@61}=-H>1HPaeXI0rNF;Fy?|m~& zJuCg3%IoWWNMmFiV0T&Y2mg&C0UIhhy;=>dC({YO7Qa33B^ zjF0x7PTyQ;6K-ik_v9b{JRo=_#r;7I9eP>?R~fjYB47o4qfMe)lp- zQhP;?FRR^S<(q%b+E>&>`7^)4QY$>1q+<#8T!i)#k}JAJn|Pr^_vWOjm%||ZRWrR8B+bSW9QmO;*wX*g0iV7xI@AnJ>6}?Ti9Wj@ zOqlhZ%nF^^(f{6EX|4_RwP^2R_SK+24w2mtu_tHXCgn% z?Vc>W5TEG28zBGtr31)|+tvhOH5;YuOGP|pZIo}n%2kR; z8|yZdLz>`V&fKZ$ieI9`26%TL@%o{_hEi*yQ$(*=qRo!qVWbZG3BP%=p0gb zQ*@!Mj$}D1RN%y9fSl=YU4ZHRR@(UkCM3t^8X|wcN5k-uxp#V7%VYp9XEq&vT=uSG z=$oR;A~q~Jb|DXu^i2_Vi3@oPl-&e)(FGJu50uTJ>P{L%?6>rN*6XUB6dK%Lqbnc-N{4JAzBLJ&F0PUX3T zJL$%JDnJ?5O?84rAC;IIgR-#lGB+17W;V!{{qI!5%dr^DC6AJ&O0-1H@TGF$ zAa0Bs^r)o=5ij)a;zORoc4vFj^Z|1C9@gur#McTP1veN;bpPNYloYjIy9>Y1P171Y zLhB;GUJ+oyfgxax4pm@uP5^K0$R#)7LGoZVjv0^tS#7uLf1($5D-Q2W_%S`(D%q&Y zZqPKJH9G8h;J6>!hyt7h7m@(`eOi@1xg^dkC0$(lKhpw$cyYOWzYD59Hk9WkMY4ko zt;@#E^di9ul-x0b;&a8(#e^M*lvMZ7*5f9iR3SIUKSZxouA2j=@_arjc8dnwLpzo| z$ZO(ftv3rkHE~Ny2Pl#w=1hrl$H)-qPbT0ShLTZBj2k zVgp)mw$nxzBaw5-LtFi-wUD43t)cYwFYQ)qgGTH47AjkZ$is z-xAg7He-SJ>T?htVFY7J(6q~YNT2+_Vp|)`*)_!A7|^8{YqWrcOVE?S^?bKmWgoyb zAGE*A?;8WPM6LIAx3r)~HkALrL>N3DR3?0DbrED0G>aS22^9;P7ksd#0(7nyvfMm_ zK`LR3IA?EO?cVqPvm?-MRygU7h{{yc#%J=%6_K0vonCC1U$$*R4VRA4FUhM|h@3%A z)*Z5`muwHC(%-2FKyHsC3|`tk=D>KW6zF-0%8Vj51&kN^(8!FisU+}mlMSTD?k7q3a(Ppz$F(djoQ!4MweZR`Gn3wTFCZ3o#?br7am{AHUZc3%&cFVZqozef%*1&!XB$_xkSo&DzeM zI~&(qJ57#r%%6{=-z~rW25F{=zdRpe91-RCst^OAST z77%c+s6KpMxzjbyaFE&Y6e3o|9`w@c@a}zHWMxQ0fjl|5yl^LiA1x0$GS8l_zsw~B z+TLGWq{(6;RW;#{tDtU?1Hs%)lT-7S<>Hc%0KiMJ`bp-B*OqqD3%eHiTP4|pYEC;s z-F}Igj4ay>*fH}c>jbsgsk{+PN^*Kgco{S=m)7;@mSXN;<30BTmFcBCpW+Hsr>mO( zoGSjs#engsB6ZJ?!Lv)!t;as|zkkLwxi{O6CzWgNs510$B2`602$Ju*lqhPSRwGQ6 zpi{E~UK5*+UL$J8fHXJ|&N^wq zabRu>LY#(3^7-CV(@93pk%R-}ae%vH*85wTI&q|S4XTXU*EbTR&fi}Ad5JgW)}2Xx zpGqSUehBT*8uW-}?oAv=>GZ&K_|bQ#dxP~WddI>5-Px$UX&RL_;LpUCKnr8?OoWUg z2d^-l+B0~{-f|XerPEQ)2c`74Qwk{_xR4Ae)67KqGVhMh?4YtQ9+XA`w6u_@JXg$q zHrS?Oe~#8NV*I|8`3`T-(XDsw_W9O|a3*P|s%O=3h&U4+Qru6N41DKKsV7SIJ^F!z z@4BT>EvaCN8z)Te15$k$D)qROanJ%({F=Niy`sSJUAK5~5JZ6K59BA-eBNi+^DfP7 z9htFn`yE#NA!Q=3Mq``&#)W&vU(4~JO=taHhH1r(ld3wl!MjJA1^~*QNbAp1a)1c1 z=bmk^H(#9h-v^9v<2LVuPDA}#NXLMyZzO2~!F#lS@^$CKzRq0pZPI0*n-o*OpZD|8 z_$sC5HSx>qIVtp^hffwiI1h$|co*-8UI#Q-zZ=%*|KkrQ)sWfWwgIcdJ0=H6GkflN zsB8M7O=ufPDi%gGMkVkETpI}GmKxm4PBxH@JHPvFK3oYBe8{g(MXfZMpExm_9=t=d zPx2!XWzPbdOdJ2onc(LBzJ z+4`F@g;J3KkSEcsY5QbUC;tHV8|vhg%c`xyuF}p!-0RZek^Aw@;?AQ1?y#V=<>eEq zhL;Pxm~(#&rySxlXriAIA_s=6VZGm~#e^kb!@7srDD6}*sa1d$!@(}8nHuykC=Kc_ z-(p7Br}rF{H;9tVyB`C_#*9Yn)-y~xzmK?)PiYD-d}x(45_kU8&M-@X^n9d}-KC6~ zr!i|iicT1>J7$xT5NC@~A70}LNOr%!wrTIt{9|qY|2a%8WeEDnf-m>Agv&ct!A2?% zLpqd#5(gji8tRJ`9N3kkHvV8fI}N>9%c`U%6k6u>6QEWpN3&WF)2_>k%|TLbQ*)48 zuXsxh;xg&`0Fdm}r7f8zzr8tz+i!U|p5mFUz5Tls-5me86(syY1wq`c5!f)d?pgj? zP$LTLG4LDe??;S5M3k~L{>WUu&MFoT13rackf^UmvkuebJ(gg5$0EaQmnGcG-l4Lx z1^+fN&QkWz0%%OPLC9c5VH^l$M+%mFb77p8x}HCRlqeWk$v|69&RkqBXn4qEU`(2= znUXh+=2)dcL_$ z(z+bccyjN@Sb$~!fh;nP*(I+M#ek$yrEekO@{bbnfTC0wU|dr$z!3lshH~uld?s`R z0>M#Of3iG_vzM}+BhE=#%ZC24%Vl-l8ID=At?C-Go+BAZ@Su4LYP#f?S3ks|0F7XA zfx54m05GEC4$>sE2}0z<(MoVB9Rzz)xH(S$sd^Bd@G+{JQc+mvtmS^+bV6lCSZc^H z5&_~tl{F&tq9}Sigyne1O4AF8ERna&@%)B@n8uZAbYOCJ)9M@Nz5Dv7vX=y`{k`v= zJ!(m#ajB_fH?WC8V|f{EgzF+llNM1E93gqGT)KfZ2IT6*ITE5XH4h^zqAIiRkwUhy z+RW-m>nGYmB&HOI)7_pm)e_d59?*LhiJR|_Oq+2+)Iu%70)P0cMr90a=!Zn6s}79ckq6EuK~E;5Jr(UYI^%g{bC z7f@cMYIJg>%DG@uMRs_g0;<}32QzAb`$%$8O#P{sJ*A-RS*{FPJyHNT57=^|*}Js; zlE-SYmS=h0RtxN~q(DWoC&cy~4;=(a=E$`O{3%?=3>qiSMWLBLSM(^tykaxjt2zh= zfbj6*{k~ZFTrndDsUG5XQ^F-muzN->lNWnFgXKBW4v`Y=wks`v<9~=q**NuYQ-kQ_LrhHN%23wgf+4ujRYOox>+KGM`;A!T@YK$H+GW8r z(*>9#R->|%utvTl08aZo^oc$Y#EhI-fc3L;8tTMe7FL)M8jTm&5cl=`Y!gcc|E1!` z3d4vrQbl}StA!9p3dY0lDoDq!0{`kOTe!-U8Co(4(b9oo!}i`J>a(B@2Nv-L5lZNJ z6OzLxz#86%hI{s&;ym|h+gp>ywGuE#ipF;WMEsxWRuiEmjYFc;UaXep(z)-EcGGL= zvqS|f$aZJerIYR!1^SuW+|3e4`sewL6Szi#upBA!2y&&Kc}db_f^K{C92DL`J&}@^ zRxy`_szdiX%%1XD$spZ3)(d0|zP*W9R5?(`W$^&b^1VgsT1pkl&T%DGtsPm4kAx34 z^^Ny(82wUes?uyU!7u+n!H^Ex_KnQFTDHqp4xf5?x5R?A!vgC$-~zc*E|C6??9q^d z!eo5-Jmwfs&A>zh2M)V?NeX%SoD~`IB-6Y2Atnun5mm$2Ujvr5nro09?utSi=^Y{1 zNIk~F{8u)DRXxg+f*{52DLA${*J4cwh2`tzkh!)$Y z&prc^CktD~qZMq*!5g@rK#h;*8Vd`RX_27^9xhj)GdQ0H3}#|5P5yPZiDQTe(O5GD zOK`-$E6bwAfv?lUx-sCJ*8w^4w2St@m$^b9>qEJWauvHmY=JcH;xkJGs zj$XbKz265^p==@MFQiPX_Y4PHKRwQ4)&!Tc#~#QLTI??;+rd+8@RW< zM3Cu1Sbe1gMTPu21G0SPiRZH;tyg)sLHKYypnR(a@$tTfu1m{2f|ICv%o(PCL*4B=rgG$xrm%lR^ucECuJ= zpIcdyz1XXsVBFF=n15Z;+T2RA;fnrF=D>(DJm~vJqf;-T@THIb`PjLzyT{FT`%7nM zOr7(Z)(!qPbroH+N%v=4J0CGba>V!)4+Z&{VQ@7DupK82mD%kN`?TQ+Zp(>4-&$rN z$A-~VN?b^4_a528D|Znil|28J!Db^dD7QXT2+i^ZFIxGvz#P~bQd2$I*xM_$volOgQ#RJTSF#R9&3Z0 zqHE5ayg8ETeCJ=`y+yx90wGe0-K9r1)82;cJI@sc903MfmfH>EQSq;FNlj?BulKg< z8V6J+ZkRg{(->41C35{N`}IaY-?w~gLOvnQl>LI02G*?$`cssCy@60#R*X3ptEN?> zhkqPjX0Nj+5!WjCEl&(=LM_y}-21+gouL?+%*2P6`H@-&M=WSu zDsfd8-1GFYn%x6gt-H8S`G|JhW)>S(ORrYdoxJ(n)2uBEx6#@_TO+WYOC#3> z3;t{18@K4C$y`gdwO}F_s0!k7WUI1Wi=)s?(u&XRil(r7q9o#)zGv9~%nV*mj7h); z=U?)3-n%M1knX$Ok_y@!?EJWG9)7G^{pu;sp+VlnwN_;!vk@4?j=W70aFbfJ5=)}6 zTbA=`hwioMMv*BblaWi%_wM6N`CV`aTZ_V*Ic?Sg=ku+|5yq*Mj4oRns)K}|s8~(7 zS2CAh%{9FojOv(lw(jJykp&nAw{-C|RYGP&LgiXFx>ug#+lisuweGZJ5FIWU*is(U zd+$9OxwXN~n)7Hy+|>%vJZMORb=F&N7)eQ%px4Z&_XEF)5p7CL2w-QYwEme;&aVYg z&&cjS_@V7`cyy;$6}7Gu2|M!;Lk1nhf+Zmo+Guvo!buw+m<97J*tWqrjMurVk1wi!R#%ST6Y-C4@57C z2%?2AkY&%|zOL`aZXsILa6*0U!5be`05-n-;{1KYPR~x&uR^o{lljig%S_hhT@1IA z*5|$fZ(SLS2Xh4K#=&QUKVD>nSuD+X<|Ko!cAQ$pk2e$>wmZd-_m0*y9D#nnxk79p z_Az>MhVJLfpbDxd%!*#+?A7hR-_M_Zm)$&nva$bUbkon{>1F>kZx)8rgQ0ZOyXYH|HdZx-U1gA4eKahSWRicb+Eol%>v*(DkO1$TeCQUPNuT zZ&J>yGbT~$B3!Fau)UNV0(Lx~e{iu@#4Ndd?oijV@PlFPbJ6^G4};)c6egM-#G8gk zmHu?5TloSIEe4nC%U{_kN^dGQiAh>af-H#x<@=4N;)coUI#9cpF_F7X54u)bRMN>( z#98oB^#s%}*Vt<_{Sw`QfXswAKH2qQPvKL0z5F~vd+cI1@wrCT5_pqDFkU%IFkL$gn^?r%K9o4#h-HNleH+wA#F) zAt5P1*tSN)3++KronIh6JKu}akno%<5(gd(^Y?C54MTKYFnlY+2HZ-xX|4nfRi|b7 zC#^uF)M?0u%F{;tMWXUj$df$wDh^NA(#Apb?0B1}#-nj2i0KZ0-)AZD_j}Lc7iawn z>PMX?g-uQ+|HS>v33^?>em0P@vCjy-l#A`p`{RCW9Bnf6u?T*`uX5JMaQ@NulRlFw#sFk0Gw@JgO zNyMmUsTQURmIk)%mL2`DrqHF^#kCn561pv_d|NR^@jjO7v8ol0gK0?k*&m zDOa?PF5ql}iuqEk5{0Iw2BA^;U6OfalOLo`2$?+%ddZw>RW-E{ng9wlfOx2irT%O| z42}f63QTrlX52hxv!!Wc{8m3L==gieT3Tb^TuYbzv#eFrOBA zZE35O9=Xzw8`z|5lGY73Gn2hg!KER(tc^%0RN}J|MmVp)UjcJ&+Nt`l}mB zR2brqPxp%I8lSJ)ucx#&jj@`_IMK#81p1lRunIR;=_O_OOccVpS>VWfVvHTSUF|&% z$_2VUq`GhvGVv~{rP@0=Q$@MY63j?)a=ZL_t1oUq!!Ho&u)t>F$D=q#TtGIL>A12S z5+@XhS{@4~Xo`3Y*(2mIQT$2P!LAjc=!Y7y^vdKV@7&s@%+Xg1a6aAGvPVP`Voz(^ z@TX`d`+Mj5%TZh3^^7lHs+aD*JJ#Z=#kEgtuy-*RdyY=?^3O&>=5R~pXny)4G_f}~ zyXZu*?O@P0$2zx_NoMkRemxoJD(_{G--i)vZQsEp`RkZRD>D^aNBasXmme?{4^N&I z+ch|FVk*l&S>uD1M<%M_qSjxujXX{BcN7oU;Dh}T^&x%+k1oC}Z~S`l8kOkowI!UeG?r`Ll0l<-qn#B>T2E7gf`8vaO2LX7p1YzH^- zQ>i~6)$w`--~;C~(X6x`k+K)p$pB`v{@e?o)7cjjod&jtL3L4y>%~eAa12~fH}_Sm zAGtnVl%Ua(3dG}Y$^Ndh!a@(ZvL;;AuTUS5`E?(pp^>9eKq*HI*TtTTgLQArYEh@sO-wvqqn=dqSg-0CX?AU9p2!vH^!qf+xrbGAfW)^n9#M zExZ6q^OO7r#Se}9g}oypupMMcXqAyCTdl0wFv$!n1C}MZYW9JQ?n_zWv1$9Tb&a$7gf&1Apo5`;! z9d3UUj?B5W+q8aF#fCGwj(JSVQN9XUV_o9~B{?ei4VJ_3$Ngrjj}G4s0H1`J_|KQ0 zeMxj8-KQ~@q;UXgCdy8Q9^RX=^KCujSRHaiUDy)mY6&p4WDGW3-oHNCUui{RX79Mf z*$BxKIR@sY1tMGGkm6xNLU$M;D(7mOjj zW|(hlV>ypYJphzRv450BM`My)-Ct>NQ&6+cIu9JHuel^Q*{6>2#I2^q<%1JxqEEhP z8I68+3c6*K_(|yF${75A@MyU!8&NKXOlnydeb=j-4r2jFMRiBO#_f6b(-u)>1;EDl z1U!k*_iCqm1NLSe{uGTM$Y7-@ zfFol%ddg8TEV}o(6Tgm^+aCL$3m3^D*2Idi89YcW%xK=qnn&?DdP^+1Zez;?ijYoN zSi8D5WxTqE!u9s?u|0o~`@*gP#9aTRz!RyHpmTcTSxaS4|~i~ogcVR%vgsr z{Y+AaC$a99{iw~RW}xC#_R}V2MBETjK*u1zUD>G&8ju@*Y^qOPf3eQsqN3xQO?kVS zeD}oHS@sCfDPqxP%8^Q1^}#Xy8x_#hTh8k|KuJa=XhO{Tk40Y$c2NPl!@9w!NVN2O zHQ#>+YL)e?$-ZqAnXTY+IA(s&5gtdpyZj?_*y<47Yj8IWSyJmq#kN|H^euO%Wlz&8 zqgy%dI8r88dSpadce%&z7<5qU=k;67Af=XuOcoU_c35*1d&K3%o1R!$cY@MlW{FVR zlP8?1?p}b>h1(J)P3tCxo}ls#`BURnu!Cw>$K}chQX=SMaIE5oxPH|*K6)yY>*T=A zZ`HmF3Rz%C+@u(8vCh?K!ol?j;M|K z&S13SZ_IgQ(`Q>x22xBqdCz8Nu%#aWA4}KvPYpqf@#(^jMZ{1_xjR|Cq9Kw zMJWJS%a#S(W|1V*6Nkj8hD`>)aN-%Ekr~GA6?_5zqVWL%hiT(uN4_<0->O_m@lPz` z({W$=XCvuFP4rBXX}V}SIu)U_QUaNfO{isOx#unX%7cpwHYfd>o$3aJ=&Va!Lf*2? zjXw3!vLl3k@}!>~A_}qgM#qjWQsLNIxZ4SuX+v136zxLZrcz|RIpFC2@k1YoUMF^K zGh4(;&I34s87#B=@U2~(4|f}D^t~;UgF8>0c~T4(y0W}>WLuncd}oZ0A6RmJgb{ty zFzx9RUtIWEu^4|*pH;mMb$<@K*DEwow{e#{A0Rx^NKO0?mpl9FY+3aXmxRm8}@z!1p*-yRsuCsdE&yAi$+bhEwsL&~- zNX|?c&;<49qn1Ov5m%*Vbz5us$cnC%OPq^<6MsuI1y^74E`O%;c;(1XCEgqO0C2tUj)JVDvZ#v@h-&RNH|c2l<>yDn~wMyF|0#>bCsjdaQeAY~8rQ`wgfTB_JX43&7Rzj3{ zQ;$LXQ(P`*=~8LpBVX*T28ibRZX7r<`|MSU|TjFrD8`GcedGi3R4Uyp=Hx%WXmod{X#SilloxS$jU|d}uT^)s;8N2o{H0I6c4lQieu`7T z2=POeKI8PF(KfFO*^Jgf1WU`D{q5hD5&s~$)xPmcZ^(dZhD0g9!sO_EPMwm4>bDKo z#qH&fTBDSfKk*=h{7t$(H7Drz2j5`?rG{b9;Ifm}sABRpxx*N< zz0*mB=V6X5?O=&o)s5tCN2=TViN9T90k}wAb}2#x$DQEPx6*HapjgN6e$3+)@vYFa zT3;!TBJT{JN{#=r`><(oxxwzyz}MZ+1Ce2P-~5As8)Cn?kypS3l^#ylSamI_6{@Dr zbU9x4!rt7!L-TlG$HA)M%FPlCMw%#^)pS12;OkECsQa%*p-?kD1o(2YZ{$St-e%04 z;2Xz#`6bQ1Lh|@4#?^{f#Q2lp!~%u7J;QH)7~e>SsoMhRiqqXMNah>vq<(R`9zuNY z!%ns~zPx!!BVCtYqclj+;?DK}Al#>^dhZFH#ndZydi@EdC2kzTf2P$YIz~(N)!f>% z){A6r2PK>Z_;qqVO~QcOXdlRvO`XB-{&K>=LQ>pH-qn3#aAdgZ{z&9f1oy;73_fGtXXvYNG}$S)Pf1DWvwVo_gJ`516F#`cd~xa->T{0(Bd()CMAuWtccU+X z*Xt+vcwK(>&Qi>A9sga5i}3qYVpqp=QpGC8l;v`YD5=7eYJI}Lm(PUQK2PmMe4$=} z%5px1c>5x6-NIhJ+3ZgR_iOFNCS2Ds>PiX2<(*ypl7neI8$mdGoiKQ1f8TF&KG!*a z?76X1XCSHyf3E6=?_tKBp3ang;J6pYMEblPbq{9-b#wW2Y=_tO_|(?uCDj5V8p`mf zo#XPx8e3dz#p@-_jV>Kf>17CxlWf6GUK$dOO%}e+CMe@aI(9e^ZSkFhH_h~cI3o=4 zg=W~tE8!0xM@Rz?olwD*&bq;o%Z<}&t7_sOA4M$HjP2p!YG0gP&TlrVt zDQ6W-McJ7tq=>q=W}1BLdIrk2>E!TR`V!D0Mwu2ylfFz?rpZMG{P3$Egl+X1w1%T) zK9-y#>3HRdO$BWn>m+AcHp>=WA%%^Rs@E)$o+A_2tW+C=Q0EXoBuZn|yfqW)?dbLV zqApR`#G@vj@}$gH&j;v0^rG6BYVSjOoW!h=DBDRCEiFqv1aJjYWMPG9;WfJgiD~@- z?19Cgo7X)n-;?JTZiZLBhb!f-Xyo4=y$`#28+if#eqZ}49025bXr_eKSs4RaDZu#l zs5Eo#MQGr5+pEV$KirdWogq~}3p@zXeCaOmqZfmVECu)Oeswl9l_@;pOp^E^0`I#> zLFqSrnF*rIS8UBwNB5v!I57sG(h(B^}ii%nfx=I>-xT?mk6GaYX zSKa9uIZhH%Jv7XH`~wE3ridSOk>#_oj2}P{iPQL@h{=SHq}8`&?k@^ptkX~CW`aQS z(d_M|!&eXRc<8$Z+1$UnsH5zT#}*7@eHwJ%4CUZqVs%$^I>>$}&8jZ53>K_q{SH7W zc`0xhxNAO}ZT1zlP3F2s(XmHN*Lq1F@rq=Po=fpP1ChTfa=~)oMgM{JcvoP_5{;M* zd`RV!E!rff(mwfZ+6iRuNie+m;Uw&4BmH5=_ zugV^0Kxuw-d{6yRG>F8X530;;TQ)3YAqIdNJ*pU2#P*Sd@$Hw5x``x zgl7b@sNW63&QDrem_u@Rn4rNeZ#qVm_J9d4mKVh^)|~S&y0WgL5o2u*9pa~Q8j|3M zJLZ0#WBzoXNcI*upsR}!TohtjrnZZD627nQy-hshr-{GSl)zo*I$*p~dUs`e0V=C| zQX&}}!dVifcB`A?Di`gg(m*9l>QS2X_ML&)%0iPeRy1l0QQ3J={_BODEHDP)yj}!i za$L`Y?@2QL!z{Az3YdU8M>yv57VF*xt+}}|(i5+ z3k|g!EcJ<*7@}y-@cBhwche;%eb^1sh++fyEr9tDuqlq0z_g(&1IrQh!ne;hW=?Qo ztC8EQfE}Hm&jX~ruSKPMnxuK3vfYn8tJUq6yQ(LKKU|j~XQPxgN}FI*vy89D1!}%J zHgzL(&&@{+6Ea91xSJ{zOBAeVugghp{~6oW7FSe3_pva_%su~V4&Ib3eFgBgKMgIq z3Q@TDx__`*pFYLgU6yw-&qHn^CqEKjPCj}#eZu9r z3h?$swXB#sVGP^K(et!Z6;2KpcTj-P?sb>@mAt%0a@q1-p%?9fn^olB`MzaVIu6mR z4*>l!t!GN_35CCGFYPt(e$?2yVeA6*6zBUl2LnfUdX&_QVlJd4vQr_x@L@Pl#^sl$ z1JKj&r{v|R+2NdsB`-a$($1Wm^aJ(t~<$1p=h$Te`*r%yjG}Ctd%~&GF zI-)tT+{(EU<&s&Q_rK}3W1O{%ch49RqR)tV+qLf~ zd#!CyE8%bC=ehFc-8xWN53aZINHgGKf{a%4@Wk|y6s9nJA`VP;rVY_IH6RDaMW2ZM zkR-#FaDfMtZ{q2YK~=(Uge+$YzYq%BT_4PU(oHW!`kpC-3&|tZfu~%&SdPc!$3y)>CY=%v#3a9Zrd-}aB^6j~B+SGi zWX#(o)x*Kb1Fa~h!9z2AU((TjXYPY^>Dpc*3vCA_l$jZ82tVN!zV;-+NaQ4|F_r$9 zIqW%KFCz>8W%swW%k&>U`Ih~D^_5j!4OZeYsFl?C>@vohwWI15$PuTZIpbc(RZ11} z$4jLDFfQqtzm`6&CUuCTXw zZ2gubk41AvC0!1GbK=ao97pg`ebRJ*91IstODi}(27xpQhWLHHsGHzeGLP`Ml3 zCY>X*?(g1YUD7r6=x23JRkn?Mb>;4JT7bYZCncMYTBJMVKYyrVEQewBQ?kDCCUMVm zK|O?;2cAvZC@85T0iVlHb|EUmzl%x|us+&b&D(xWPEZ@2dydbGPqAKa=G#W$VygAZ z9cHGJGTF_;4dMODyr-H^{07_7B}(l}ZIuuXsjuq|!&%`(!2%dQnV*MiCD-9zwBz}9 zY;x&FFi#D8#l?7!jbDu0N2Z>2ffc^R_?4rx`*TBqLwv{giz^D;4yG9Zb{e(&CE;cA zZlJ+}NnA~&b#wRTD9P0iUtjQ^EDOEn#zAq_U!m_E9$EJoYj&0_Jx68X8;j3VI>fwo zIYZ3|AD|SAOwf+M)H`vrebC8|weJ1CRzmOzuj^RkbU<9rGq^wKD3I;N0f`Sj9_Ecd zI`MIT8Hy&ka7#RJ*z$O;%lkw)k-RgG4%c;-F6l>@)}k@6N!V;Y{qh%3r>m~}QSbg|s|nIV@6+yMwu7QuYI_f4pU!9}Vw_dy_lGTex- z&uc0@!V||elTg5}zghuV4hwCJO9F#beXh%yk|pfd)Pu||6(yf^wn_)PEyJ#VGRl)k zzmtHiiN@-8Aza!cW1n7HiLj_w7#gbs)tc9-dLO`JhT-0UbOrN)Irt6X(d2#?NIu)% z$dkzN_n>)j##I5d&M2PiI3V8MDo?PTRBw2ji8su_kDL#Yj(pwW8*ALK=cysFF3nAS zOpcC<=v^muA zohrb<6K=PIzX9ax07b{a72u?kZ5IU-nJ!>n$<7*-*S8NX3fEOJ?dnC}R3Lv`fH$R` z@^FMoZTX&8h=x^hqucW%v6f)d*W<5k;usS8ycDwUM(t^9O~Y_rziFD$@oJ0)(9N|x zW!fbtJ<+(ogW&8M{?ale&@nkYACOaMUUWg7Wcj{0XXAI_MdyWWr6;kEQNz2BD)3BQ zia{StwBp{-`JM(19&9&U$Zl&)!)Kg_`amVB@MuR-`qojVQGZ(iY7G>G48B$4bv@G) zRP;xsAatu&HKU@QyLN^=1YkQkSi{4q&Bu0_lj#RMtInR71$z{>?fiDwNVRrNy-%tZ zmL8ya>e*eA?y^a*2`wKwYNj^p=6HG4H8L?YDaEsJHa6Nu-8owF_vxRhx%Vsx*Y#oJ zk5Ucbxv_TC`A6F#ZcbTNROiXC{Gj_2&0Rn-X;ws+I@ye;~@FnHnX zmCcx~Zl#oa0iXiEo`_AkKBl?eRv6+~@~zW|ze!dgie1d`t92CfQPXxae3|M ziNVNaky&sp&Gv6E`tQO8vj%RLQw9a2oA{=j+}=t^O6oI3X1n+AThN#>#2SYjS`0L= z<~N?yY!x$&Wm0HgGY1IBj6`{>(O;uiq)N=^?PmD~;5?H18HJ(anu zar)#Z=1=b)=hoYQaw6*dUdHy3A=X)2D0YRN*s^6@rNzVtYw@{Eq$4BwHNj|N(ni$g z$4XEqyF_^HL(H8E%OT(VKBMwnZzOH%7_|SqWqiZ;YRPuQ&-FISfjTFf&n{|>=dtgk z+CO@x{Q>tPNh&*S*hLUVAV_Su`@1a|wT7Q)!CsaVizjsP!0+b$3Lhh;o~pc`2^^N3 zG?L*CQTiLMfsOk6FS>~ZJLCqAn}xzU^!qP9*4UaK?UIgPkG)YMagDkldYUKn;TyVe z4I({<{n+Cy)id6g5#X|aAtIZP1Qt)giNhE!Hgc73E_Co+`5GI)Tl-;J4 zfK8pYqnI3DnWLdNA8Tj$DUWDNHq}XY{gx(xJ>JGGA(-Mm9*iObG{9OAqldX?|uhW|Tt}k#R9SW`$d}zfS1l_c*l<^F!es4&K82r6~Ju z4&hH>o_rj+njFkZTv5Bx0(d*-#;WsX`T}!jKUVC&Gv6Pk1RsM`(SNPC0Oh@~#rqn~ zT*JIz1z^Ll9SeY^k0Gt(2rYcRP~AyArGU7}(aTe~@kbTjrw$*0%S%9t+F?{@d5*!pSXAKUV*)t98v=AF8#4iUbY~L937-> z0T3k|Z}upO0|kNNqV&77KHVw_h59SShmsB-V(pWxaoXi3htsdyLyeYd9i7ULUK0Ua zCxYXl0CsCbwIOvdv@9lRgAI-T4VSNC55si>g%SlM3lDj-in|c>#Y2C( z3e<_6G-(PJGs-|hUe2)ed>9@jD*X-IvIy$!eH`h|4FKZN88ngJM~`FYiS8)VP{R-z z0^w_qA2UG0nYUYVzK53aUE$iiH#07e^Z+2sY;>uYJbmEXxsUu;nIQ89|BZq8FYD7} zmfadQK-)S>z~S%+S{uilklXdoh{^qak<9$`C`fsj%*O^^C7Z=&f8MaPe*M9|tKdym zN-zdQjIB3SVn!j$f1v=fA0J2rPRUJyGVkAs*Djk-9oTwZfg~W~N+RsVgcPkgS}PjV zo?Rpng_9}(*F0uGJ6El!Vs>ch#yLn5m(g_vI)MG1E)Y_D z4S|3rNAwB_`Xhx3Y}D=Q@0dIaCmB?Uz+(r>@>e-{NV9VV3)!#lhES2iSBQqAE~%Bv z*I&Q3BA->Q(hr-GzXw7h4VpEvnjoX9uK-HU({1-&6C`-GT4gZj{A%O$mb-)DPT9@( zUiMc%7_0t6k08m6xv~)RM-PV5&n{4KE_Lg!>gTVYL_;VBndIalShm$Q7Bmd>2lwV& z)JZ`+N1MYvCXe;T_lnGAZr?DHfY@|Da9S;lGnbbUfv$Z<%Ce~JYwZaSha(n4z2d9+ z#zeYtJum(m7_K_32?vbGe1zNi5da{+8uQ;_+K+$CfU>a*dj@c~0Q-YNA*tY%vkKZ5 zWsp-vXpux>=;GZ&a42P(`XqwSViXmK#4ZU|>?3!TuWL_goEezdbsQ7=BaOPSVlN4( z)xiB{bP_rGkyGnIZ1sEBVVqJ3CuytfF@ji&ufICZK!Z|awI$ByL>9rD*Tr&)>}Er> z93-HR?}&dJUO6{Ui!Re;o&`ASXPEKWSTut%WU=+ATCAf z717G}qLk?p8O1ONu8U;V)0|fxB_sfOgEISpYW+VPS%P0-vPPhWdCL`WKY~;5#BnmI zNpf77dCyEZdmCt(xvJqPo|EgD> zlk7XOC%dK(2pEVyJGjeKwFUO#T1~3$M@2euA_$UH18o@^Vdl4G2r6UZ{B4dc2Vi9iCl zA7El%^_@RVya|7wDs6A=|ARGJ7_>5o;ayTxTW$FvpKwh{nEg>SPt08kCnF>)r_ngc z)YFSZ>U-6EqavUFY)fIPuh?#Ijm6NPXX~>%_^s9@#h$8Icc}Zl2Fc62xErvb5~$N~ zRL0t?02?E)H?+X9FoPXK0`(R2RAj!vn|c_f&}0@*B&fN4M-T@+FUwlyE@}LF{sM=f z5Y=pcz^vLwoTpZds9djmQL9@EyAwx_Mr+F!zj~AKp+dJZ3+S#hGzuLazm;+y!v`@u zP7=SfwRRK;wI?3nJ-ZG0*^r!{?SoNt7f78u#{}haW$a`0wtmP}SiK~HA#ymv^2GTL z{ZQ#8@ak?A6{cdlR14hRzA0fgy&PCd=-i%fyunMCS=;V(+i>cqj-;b@|3;eZ1^8J4 zpRZchDPDh5KX=D!g=DzeYK-yEIcWI#727$8(ew=y{q_f!hSHJbk8lYst_KC)c?$A8 zd1y}TJHE7f!&m|fvFc2fbcg$6B35IG_RfDU>s5TR_t;GR@?1GNLd*lkJ}+QD`-=23 zK+h?qpSEOXtcp7oIl`95bS&Q9?$0l@@yVP6<*IDeUcV+s_lsrhw++4WbkESQk_C+} zAXgYsQFYoC%fbBsMu-TtZ*Iw*^b<=t8v%Zjh-op|te(H5%x@y5KI9(+Zdz(}6r4Pd zV`adtiCbCBXDr~M;amGxIIZA>nz|2=#H*;}FM$e#XkHbRaA7X5j!H67Eq{3U$f!W_ zU@p*jziHY`-k|NTzYu9#q&i3P_&iYiDrjQpy{>so9FUjJ<(qC$HvF{pngef>`I4yN@>k%Pm#;V!5ENqU zy;Ll^bd_iG;@g8hYH>-P*TYnw!!@eh#|gC&)f$a+K%M5K3skGw?;e&7-OIQ80Xm_y zKz&yRmpp&x#cFF=_^;J7KB!ARM@|(CJs1m7$XP*b*yMJe5l3% z#)Nyk!c#(f#2++=n3D{D`p)k#nVo31aAk5{?g`={Lz%rFF?KxPnGJBg9RF(6i?B1) zeZZLwviT5tF1CFwwfyc=zy?NY1yE0#-MVKh6xAfIyD1Q0_j{rmHb(nLf`&k!TCgF+ zXp3-x#I#2ef_wP>r4#kY&;K*N>FQx>pG)39EnbH6)hqT4ppXQlM?KKTrQ2|4YAO`m z!j*4T2RQtL!1RsZ>K!p++BhUxE=7$pJ@eMWhfLPM+Bt8)h6>f*aOyr;?c!ghBeip|NQU^jVUok zST5rvnH-%rv_`*9-yL{FMwQA2#1h{xCtjJHtD?2X!5tP6L^NDq>1zA?kLg5BJ%pL; z2SZ{>>|aaUE;2E_OJSeN_X;chwJS~A=a&1PWgWX=OFh4)DV0GORxJLI>UOkGYc8_mm+OmR0CZB%uE z-naqt{84NB(d}Bu{hx0NB@L|$t(K-{q+PDv_5%(y3_eyB`~_YmY5O_xZZ zhhK=DNYTzZ4tUiS-it~pWGU%jM24RbzLf}*wpP^bft8D!-%h6UaYGxoDdPKF6!>gC z1E{ecrct=oGkKIQHWLpiRHg5M1m3*ExdbVD$Fw2>3{J@-)qzu%@o*?CEyi7Dn?*l8 z;Bh`xm_>~N$<_9LA?x>A1$^#}u_NIk;8BV@urNv}qG-q&A1LKIf42SRh-_#99%L~< zMFZ@GHYU}kB(eFH)OE3YQr-`%JLx%yi@2XgwEdJQovXQ#JJ)d;`xw8l!?^L!v@B3) zy%B4Uz&u4!dWV6iNq6b#{SPjU?V|hZZqrgY>GNZQ@Ax~fWF3QMCIF)$?EUhpFls5>!^^xf~iA3}O0Xs=Gcf}$XaVY2FyI-eH*a-r{oLc1=qH&%!6BAY0|8HA(!l@~Y~&5?$>d4xHU zj=K%zND?I|gmyfBA6}Y&wrjhE@oxUx0>gocC zsVrteF-EGNO+0fpJ#liQ(U!{k&us!dPB!mJpn(W76CM}Hzw}FirWw5)cazUzh|Zm0 z**`ajgfmac@@74LRH~k5SdaQ)z^KlIU~fre4rPC{(YmyH?Eu@kpKUEvw?c8__&!qi zcFvz**U@Z8%)rW)jIZB}D&&zedUHW7=ub|f6R|{G$duEJ;>fQ^f!ta#E;sb`%|e+h zmzUanc4nl%NS%ZZ+?ZxVqonY?e)hrC)z+X{IYJbgCo@%U-Euh0%HLM%6D~i?NL|KR z22%T4&K9kh_X(dC#p|w3^*S-s5GMDLF9~AvRc?QKNWUn}?ygOcdnK-wURF{LP*}hh zF6D$gmaU>@Z*l@LE=8zEfd{uaz|ea+i}4Xx#Jdi--k|`R>ZwM$)3YSWjGRuj!LY*P zTUrAk&$sxrdjCTTqt{jLD_K@onW6`1$UkNIh!f%yfs0CE6O7h9z(Fa-O$N@N1k5WE zqTUy#U%?-)w^CW@?8d%T;XeNQF&b@zn<%r3SbAA|7;RwZ^7WGjxWgbm9ZcPcxX~IIr^YK>LN~@ z#9*lcn~32w7yf*5tI-)+KV8>LV+Au4pB0GQg%V5*f5elmOXuW#A|h%qgX0_{G|C*` z0s-w}MXO0JBwlBN&dfSG&3%--{M%Qgmcjz~`9w%lwcz=--7dt_!`T^=Li3S3LXMbA zuG&7KmWDU`SxwdU45^>nKHjJu@9{NaX3l7azRcneT-=9)aZwTBgoBy)P57^vUNn z*-ys^&;8}&qo^OxH-s-AcP6j(N8>aOlC;ewnG%vINxu*mLXN(GM<~8u+bNx_(|6wL zf`#=TM_*YMld4|RNnCxb!8v!Pva8n0;=#K&UW#X|qipXo=N@M@#&R9a91Z*HF_cBo zjmD5gmOq^4oVC=By4*h$-H|tU*TA?-&>Snv6Kjrp=f{5{l|zQ8Yjp%NfcHQhKkr;y z9U9+jjY(?Rue6YEk�h{?QjCfPQyH)z;-O#ncq^GO{cMa-Y-^rxpmNU7IZzC>>*A z&meuY-2d}sN&M(NOdD_M2^1!${FjM_q&wjMJ`@CNf4`A zD>*C!4>=P9;ypl7A8;qWmxzUPk!_g$XzCM@1c5qYoK}zw`=kLTcrvzrP^0%`PYtsz ze>%Yhf~yh@>tK?JqLHsjobaA%To9dDtJ*DNh@fJ}i3RT5!5wheX_zwJbt=xk)(It%tat5BOwKH) z-XR9zKBFTE=Lz-GZ;uFCaUtO!MFV2+AGn;*Itf3wBuJB)y*f}0aECICKeU1N^M7dq zV;e+n>|(Efhs!_9#Y4*@d11W_3c@%O|KB2=aCvu-B&d6)6bxj7>P<#tQt7WV;PX^e ze+2&DrBdgG7vrojJWwSpTbb>XFTqvBe=C5s*mz8%N1I%`&jhkvV7?#2iXlP^m1Wfb z1`xz9nV0rz+CMMy|Mj>LZLi{$qsdtUK^`{=NdA89kvhX1%&G3=CDSQg_3+R8=f2nT zi3&+To#$TvI%&3I2S$eP{%L_&j31M15-N(;mmRbU(39OU+E@+ zB8ta_@IcN{xh!ub)mlG1PnYk}={mK1P7iA!KqlKeiDYG zt(+9W?a`u<>{XNs1})$J6FT4_V1C_QiRh5Mg`@_P2uxf3`|g0yPXfx&N|D9gh<_hN zt%A0}c2m?;7NDDxeXkf;*XeK#TTz<-p1?gzK@1DP-p;sCNQYp81}cJO6%CvjP?vZj zk^f2zIPYXSK`=pT%8OTw3D5-kh(7vKRi1JQ2n1_-%xyx{CEK?iG9WK1)uoVSahDiL zwXHz$*Sp$OLdl`TcMpJvmHhD?b(A$53JerDeSnfeta5*mAuSli=&vpZ?mV9_B=k@LYFvZXXYP5NGk#f(#+S=HsT$igDjOh69Sw9NW zjs)rV*jq-vRXh?*P*vm^*ZM>Nw!7y`!~DO;z}eO9^*r$yVt99c9Y`0!t4)Cin`N5> z&?(=M0GJ(i4!UXNS;dQ6sN#%$XX?fRADR8KhSUGv2SSZB)$E#S96|={le^XVT+eJg z9@_0cr2+PfdWxUAhwJQ~=DWdO8Uv08Q1z%@+RJji9X7nN4b<=>obQ>SK=rA z<-Ke2=w}5#DTU`h*-5eEFN4^pd1_Foc*yBYQ$U`-GKMRmO9`Yh^~<>(QgDMOs9k=& z9VvUKXHd>)`imzNeyT2OFQ=d3g=&qk^RH6CMv3c=nl;WgFy1IXeFRA%0&F}%3+6=;VrnHD6R_B&@5E&+L-(c*`;RAAcM%Ym{)5IY?iHhJUkjN|WFftDod5SP}ZUv6|MkH;2hmywmYiZn_)rqHg~lWobT^tTsUgxyvs_$i3zw|<=NOQt zeqvU=E9ib{^f<~j-$5oq~TU^?HgU{z4G@`R3FG7);THr&ot22PW;*w8t5q;iD~>3 z2L5{wo8U1)^w3gwsJB!mWNM;Xw5$=A4;6QxVfvFg`SU^|P1BVQ-@`+58F|&-d;}Mi zWk%|pS-$g2T46@0m+NmU3kLd7%Tqx*|RMAO1&5v0aZFANI}Od+{xAcKYarzbR+t8DFZUS&6B)Yyng5Mi@fbmc=8YP zP@mxA@x0fH zf7@tw5?P)cNIj#aP(=%Jy5`Kjlav4{w&gxJr5+)RF0T_K`wB!>A(M7b!P9DjcqsH(Or!j4U<1 zpA;ImD0yO?eO~E&66q6@;>n z^q-FUNA<$*RP6fo@R~)IXo7yhzEJhU!=Q z%l^(13F4u|SDGuqm$%}SW2p!;!(v-iGf!7~MuNE5g7ya&Q7}xJQ7qLRM%M)5bQ<>y zxJ1Xl@}NAG&v};lAwI3}wAE!43~Aom>-J>kWH&iBULcTGbRC!Z`rpQbSm^TtZP5$RKn%tf8B_M(&yCI4wRD7G-E*BXkbp%w~J{;8gu1 z&-*D{!9xjt`Xa6lmct8t>zTt&%--JyFdqN$s}hw_H=V3W+8 zH66Vt2V>2Lat~I`BJ97?{%=VLenPso*Mb%2=f6n;eb7Jr9!UmIkM?O@MZN@x_Wx9@ zpBX+|%379v`HXQ5Fu%XIXc>&!l%WsL`Y-%%DfBMfV7;Jt_YS`xiUh(pJDi9PeJc5B zmyw#~f6t)G;g6EnqW|AIMNcL3?>;g(HA-vxsEKkZ_Zdt>u6Jm}@T+s_ka|(gP;m&q zNNOZR|K{88%K#(#-~B~tz#}vpu_iQb$Yphi=u)4Y|Ni`{m$lZYdwo!~&FL^(2sVj- z-n?she}qGDA5z)H!o}Vx}KtLFa#UtFgGjYnjf10_+hkT!;HdBiJ)*yY78Ez|tyWK8)=c^<@9TcSstlFMI@rJ~(cR_`4q0hy zHx%H1In+pLzs%d@jLBV&yG!EQfc`gDH`;4Ujg}F{v}w^q3nUENa{Q2ZdPGD)sIL#Nrpdzn8gZnvclqeh z+?H%^dvvOS(Wn-Yjsfj8;ruryBtU5DK!81G-YjG_$H z2BBfrE%CkF5Y10U3tr#d*t69a!T6|-DdN)^`H&wBKOSa^64Yh63kbwmJQNIqenMm! zAL>sDWF?h-MGxKl;!9bs1##UJpAwlNhCmax81^rBytf6F%dk08=gU8+3=Rs3e<5j0 z0J#}|qYpb;bgCQCs4_Sm7N@~Jm}YXW-2^+PX=QY{_+9Zek5%mgCjhtndq@3F@S8Jc zR`juj6&&#AI3qkB%tt`6_rse|pkq;6h)~d6=k(z<#QE#IjmdG8SMbq7-`?9r4MDA4 z;*_TbgA9oo*2gm~x3vZ0oxd<#W&-O*p^r7oPp>8_9sW}BsjEouI32wRKANox&;Ip- zGF(OS{^>GXyuHnj%Qv-Kcq^FU55Os8#h5oVw8 zxSO|4{=*)3hTF0+Nb$5?SO5qS^|Qw4)_~@@hJ=oRjO5SS+@)x^u->2pgAHpg67*!=<6K z-_q!|mUz6b2dF__g^7pRiU%fc<|W^1cquOYv8m$cnfbm6aqZnNZ{~~)Lh7G=aKBo4 zF#rI1r#xVrcPchF#4FjX6~zNP=X+yrgnitg|K^oYSsKcATeKHw~t!dC1h>a>X8Z~K&f}QBT zzOG61E6*c4^TH#;YdpmhLkd;-pNBRA$6#(91%M%FOZc2*{nKU1QRT$~?)k4)*85(z zH_FJLFb@=1k-#=|MCW@K0fm$`-xP}T<$1e}%P~S!_0It}$u60GiFwVmsbAT5J+OL4 zvi@64PsSY`{-f^szWe+!u|1jB_AeVmZT<@KqP;e+wdw23%;etfe$}dX$?tJ{=K_9! zctL+nXRHiyu+L20nCcgkua7g0yPw?tX6BjoB(j_OU2<9XkeT(Y?qW>!g~H1PSHxjz z-)O(ddcS$1Y3y#_jLXAB^P2Ln%#UW;HcREuN?dFzjrCIKc6{kE-#g*1eNETvW#JR% zV*dOq`xiv#`$o-5dlOC4hJ}GBgd3aQA<3F!wEdDzdT&3nC-eQisnUTsy)T)HA$f(o zMGg+?A%ioF2Kt(GV+;=0(h}%cMzO6Vg&TYbA!-HR*Viie%Py88X6o`j-VU8iXgjdi z$XbbN*mI28bE~Jw%@6x2!6(F)NQ5BsuX%zf96!3P)p zXHg11+4P)O2miYDC3DVIQ-GG6NY*#sWy897^sDv2yN3D3pjSvmYT#^KX!>~uJ47ck zu-LsCQLcKDug#7vm(_YAnUUl+Nw#Qqqs@V_sX*kLwS^PiEARo#pMgZkvK;h&na6_% zP4$;eDvDpi0$v$759yYe-f&V@)NuXTp;L9IS@{tfXD!alV;V_Z>%`gT`&=LQN#FQf zVl-0Co=I^MLk8PyU)KGpvHiT}-s9|_Tm8&H>+H<5o}@C~xMr|gImvFm*<^Af-zV2a ztmDchod14DOz^B3VsjWmC9pDk}0bWHP$t3=NAq#RZrl&iy)wmkMhg? zBH*AMN1N-RwQ;7pYSJ$0HC83FzsWhDJ~{@s|GRfEMoUSXzbwVWIBtEWsruS1wKt)& zUvv_BJRUNeDtj28q4xDK^adeZ2g-bYE`F}^6 z<3D6+K!(+Bz^b9gi6{(EM6m4)FLf!=7JY)u3suc6A}&si^?45TEnI2@%1I;D_P?mS zL8wNB|5;0mZsujaGij2ARc-{8=MT;PzR8Y-O;H2qxD#3LH9q?|4^@-bAkCp3TyeeF zYo^XML~*v=Vx})GTy=6zwS9RZpBs9}($edxf_lZd;}V<-64k8mx$h^N8~3;6_JuYT zD#-ZNW7c8SVfP|)3;D0;Vy3(v`k^=B_U<*<4==i#uAj_B_{M6(1v-L_SRC9MT8f!R zrK4=mKAg#h@F9WzM7F&5xgvuN%f8%0h1i?bb62o5{-xjBlzm-)x9v}u>e0ZB3*S#t z;%?+#TEf`Z2CbNmW4qXC{Lf3gH42ob?QQrZu=mby2@yqfHtg5L!yIDR7Uh{Yd-x6Y zX8kHn9Cd74IDR6GzBtq@ebNE4R$|3p=+ni7^=YSfyC zlL&sttZr}uB_N0S%;#<8^Lyh(i)2Y>WD}a+t4fdPytKdzw8PGsGN328bkh0gPI6~k zvB`};OJ^qFZc?QoTg1=;oUSv*DZ=->^Bn6 z2@}$=sxlDG@R~BOiq5M$^Q+XZ_0S#0G?|359Xlrdj+)e79iQ}?9XsNt!8xlI2ian? zuT12(eQRF*z#?@p-U8l9SUS!!ot&moZZ(7;q1&UmN`F)}Jc3N|TDEGpgVx+5o!B4v zi;oPyWLgi<(q9hOD|)q?D~AX;CwTEvg5R-fkG<9$H&3h(A|q3gQ<|@W!0YB6x%6P> zUMq26%{w0nWDgv)hqf5=9y3I4)x>>;UGUaVzu-DxzcKBaq|DM0I25P9hX)@d{akZ< z;AH}nZMBqxx5=$vQx^8d%f?USLpCjRh!!~H)eu&O=8Joui*5ZzG>SU%jP`x`HTwb$ zR>w9g&oO0C*8$I`BW3s*0eRYm;wPh6d5;aP4V{|w+b+|I=!8v=)dRX{dQO}=S~@2f zc9?Yi#CkR~COE;&@%Hnjgjlo1>pLj4AR7@x2mN+m-b7mT)&A)9Ox%~A} z8h%bv)Z*~K*wgXJjY~;GaAg_S0@j~K<-mOFz~f>EcUKOCuNCM#(9aj{;ZVdn&3hj< zSAIRapUMJwchvDSM5E&#)*yF#bv7b3Eu1BCp5aB&VW|6ssnG47!iWOy*0*V;XcUt)opZE6{%@PsSE(|kG^-Ho7smF(448DMxS2kj zt)6T+Tn+qAIX1=)5-lZOWJ3(}(=F>A<-Xk5L-rBMTUuvx^%n;XXUGQ~R!n0O@h+Uz z!jL`p@>rqWe)jox_j|1p7Q79Qm_`FvyVY$Tf?7AJq^(INKUro;Zy&3M;Dom$DXRVb z1BlU$g2kSzEW?L(pJ~c2M0if-LQ}?HbXV4It2yM|{*GmnK3a*D2<(bYONW5c-Cb*+kuG*Nc5moH=vm%sJP&MmzpPf92>;Gf_mlN#1;xi=I#+p6G?NK`#7){I1+n ztuCS6r8nYFNHLCx#CLVc^4_^(atB=$RVR(7cFKAI3b$*Pl@3kbU-}G!6I8n0Pgfnn zY5bx>nD_BA`{@YkWGMy7_0vML?CX(t+YindRQjKM%5&Jb04G-9bG@InCm~QTdq49eD&F+x8Ba$D zmrY2FkyR@SEY^43$&dz--ILKONAK2gM>73rJ*ZT-?|O=KS*iO@t~69?b!Xmc!tkYs zar5@Ct~QB0Xq)-pdULEwLp)?C@2kj2#m!MTD4k{7#18&cxyb7dI@sgqM1CYL|;A zmM!)d-F-2aL#ZnRKW}sDCcE@GacKIo zPF2sHcrwW0O3sQP5@S>SzRAm{S`cR|lg3zH(C}ay&-$zj_$H@#+#Yf>zXOSavi4fY zKN+fN*Kd0BHU#bmGs2f;L&zXBKYoAz+~Un<=zpK?cw$~5ZqcR_maen?ahKh@*v-pk z{|w39`f{MyB$lWUkNNaCs(*?(_p6gw9Gzae;4UXfX^a}1-?vfmF?^FlYtnf5=HwTF+M)qW#i~~|KV`+zM3+MbJuySleQf7;va#v3^(>}gyX$M9wCVd| z%d5Wm6X{dv(`|Hte_G;bNKf(NEx(44eq@L|^(l?Tfzos;AqRX)+}XVN zXQX$c1C={Z)Rfea&I@4M1;4aA>b(pva`E1=jn?(HssgX*He&k+o{4+yimXrHK*5i$ z@@t(Y{5+%HD5mEb@To+L*~Es^UKI1IBnZ5smd2rVvTG`o@#>oC*2_@+q6fZ%f^Mop zD@DJg{J=>+lys%Kr6t9oPkgh*noVU_G}$V`$V`7Y%{1Qg=0XGHe_R0dEZ=|OUBkq| z+uw1zx4fyZ;d{M-lR>nXem3cn>DQlN!;IHZ+2l!cWR)>QXikog3x^tyWQ?YCxPiM% z1gT@*SnKx4?qch@oKiDS|DNMBG%_BB&CKNBCPr$al>53=*EP3Se=aho#(-&+ZBY-jD(Y&iw?P&dVhZ|{iV`H+? zAvwgW#rXw@qw*J+%Z&_5d+qpTihHrAkCi525hT=v8wR!RU(@|C^hnI}K<5Whf@a`L z4(y|tOxEKvlgXVET~E8nY@}0Hl>2FvL-KfKm^$dyZIEB)KK0;uZnMAF-AFPdB!c+yJ*?!S zMats`*V^?|4z#LZbH9G)<~gbkC7HmK-FhdN8~lwTmOOsg5am zocG_wz9Hr>zMKf|Y>t1oS46Q;`^JJCz60Ncw&|IZ-y}Zrun}NL51>;&4ln=#` z7zKZS-)upx^iqb&B&;2WYexm^6N2E!+~oW%!;7_rv3p^FX!-tRM#Jwy3K+cFC5V*e5eo|R#C3(K4S~3$hq5LJ*>?8 z&9O5w++V0AS!_?Actd7V$(=SR`zS)8#e#njHD~y})Y-4s1k5~Rt91SvXP6X|s?bM! z>N8B0Pr#!Kz3GTVKl;xiY8Cw7Gs6=+8MAV{S2nd{2x>osi<0tBXVXkK;*zdzmY=|5 zi=Vd(Usaw0v&CoA%afwTeYol8f~VSRH3@66ayFByxEMhEn54<)!&k|nPftNAsWCe* z-tz;Y?{K^NByjhv>deQFyCR}ZF0;D2oZ6od1UY>gHUR0)?{^-d{rl*o&O!xwMw;o& zNpAS&yjbA;%Kl(cHuI-lh;wxUC>sX0LF_S&!*pQ!bJgh zB<63i5S>c(xb7xHe?-Y2ewNzM+JQd%sxKsusquFDk`EChnW%9%>#zHHqk6rsSUbSb zD?rWpa)~7f@!ks9)y*nf0x{kdl3T*{s+A;JC*@pRQ+wZNg0ttUo)e&E?&BvX4>4+; z>AYK!c(Z-7IiF`oS$9sl<)A{U zF+NY9BcMsZLi`}J7qNcUG^&DaH-GfVZpkKpLkRwcGQuHayi#+M=h6@p0{yfnegC^TdQB25t3&p^Ni!eSsSH~s*0a>N!b~}^g z4T6?4n7_v=ka$ZwK4@-OAwi&FJ;RS@zDQ&wtaGMuB%;z>phDmk`Z@LWkzn#R@|u!c znKmQsji$~N5B-Iq?v9C;(O{&A&Q2H2U|JiKaxrf9EFLG%Yc*_TZu^NlzhhPdN=16W6Tjs3_q{ZBQ<}NYDB_p=d1ZQ%pxZ% zVwA9i$cJG%V1>!}DRB*Zww5*vy$he*GrN-)VjaW#szEC)1j!z@xAvd#8< zj_XJG4&HaWTzPcu#7ZBWF`x0rt&WdWwq>_0Q;Zs4UzO%GLn%|D^po-dQcW5qLqDPOdUJ=SrTyeVA8^zfp z{cdn=h!19fZ>-O+2JI^!WjVfM{t)A(sWTtH=kieAOT7Rbg&n1BPtliw{o7B4ayos7 z`%|f)a3O+&n%uSL+w8ec?$N{Pz&I0^cDwx*3XBSfen9wI(Ev*H>xQe1bFh*X1USLQ zB>XJ}VqONsB{GvcPkor4*W*NHo=OqkDA^pY>_c5Ibqj<&DO>8YE2*4mBrn`iyHa)4 z;ryA8!^6MG17Bah!Q{?kU6c#MtM2AM^oSAOXQY)MJ?%1#IVHd0s>@qO zC5K$$(r2Pku-!|}+VfGUQ5Yi_!H%+}) zXx$K=^55#My^&;0=5wVfriOY7MmL{g?O~LZ*)yJG7d4DJUar?Onuk4b=PqYZe}P5# z>@>G|YEkc0Bot!L#w&HIjtK)?fLkL4w*p~_U3vmoCw}sD7^b{-J9Bz|rW7dX6XHqz zJ;va*ujVN;LTWqUun2+->JHgP!cZ?j^?1q%Tm5kuq4$p>Vs>NmIvDo=rDUIJVm1T^b?(2iLF#(!A7u z56#oafB{QdxFcmv$(NjuRrB8m&)&`Bk(p^-cQhs}y5_i~OpwfWsFa>Pl?<=>)=Ciz zL+Pf3OY`y-EYY{xd#_vq^*HVILEK0(9`kX%#xD}R_sV-sJ7IJ2b0#avkwd3#FdKZG zZ(BYILDG+z83y$m9e7+|oWjKT5b90Q&e5~gvV14%)vz%J^*pR*^+(J6OdE#wZ+v`( z^LIGf`}}AtYY#+QLiPROlUfQqdM)kF?5``FW0@EIBJ~cGcC$B6;57rSonRgmv4O5$#&kFw zo59K(e+Khl>@2Hyf#Z*R$W#9CLQ|(7xxk1K0XNSn>=6Zgi%fqdB3IdO_LiK{%@1$o8g}U(b}k8t*P$WLN`Wd6Xr8 z)wd-;XMgg=j&Yh`-;*(oE0k+sZHyVQjLCC}zkZ6z~QL{z2op;b3caV5DR>IfQ%Y zYSp|1#Acj-(LlMtnm(f)H>wmAmGWG&ch{6Fw2{HOK;1)uxsi7T;r`+YB<_e$LH7BHIctO|s2%DN)<>Jy(9?o@NO*H7Y6bKy%Tnmbw zzFZ3;xFN17|>z-cJ0Cm$7^SxNqoM=Ra<9CjX4VW>^>ue}I&(j%^E_3=QEH_etq z2F*WP$HB0~0g<{k=N7YpGTv#E3=JR;99ZfUeh$SHn>Ld8sV9aMjn%82RV@vnp;!>^ zMmvdvf&isqb9DL55hdEh6=aO znwe`q0J9eV2-05K^%O+`+ZGJNU&q-p{*a;}tuf*;3lV;lCXQEgohN zPr^hHi9;DAi`5yU(H($~B8@AZfbUUDYi+~O_>>QwQRVG>JA7g_qE?|Xzln;YP__O{<%c4&5kW>AQe z&3|qc|JkI3b|}?*K)59j^ypz@#o7atNa^w29^o6S5fs3-eB?vLDXI%~?7+3*mPlZPe z3%+I2Uu_(pqI+S=v}*(6?@(>x&0pe4Vy&O8k?~;HQ9pm5RaW=eh%4gClnMHnkDxln}q+F<2H=v8`M?mWfi>pL%fwT=YqTUuM<>b5Exg)0WDH=-{5YM zPR4Mue0iD`{S^W*HC`V{Xv8NTO?%}x9lzkvdBiXoB)RK7Ep+2!f0$%*``#}X*eNOLUw`oerZKb9x}CUrKH*K``bwO~^ajwXVctce^%eCx5)4|w~Gs3?=| z>6K`1;@m4j`O(Q2ypz^7BfLd@b|i%`D97_JsiCT4WKMgeC|%Gcq?2yPDngC95QGVRKLaHh$?r^ z78d#6XLxD`K2dFg7ZzD13-z+3okp0k>rZdjx)!qG6^GZv3LYgzoqzXP6GGLkqUT|W zRn@13y1*ZIv?giCUVAmilc#xVH%bROTlw+a;kKd`1voN@)!#Uje+-A=LoOsP=IGM9 zlIqH1uR}YSUyjd|wWF-M>A-J@!8ZW33Oo!2t`@H*JXa@?$8sDHLdOB?ttCvyFDxZ= z9J0X@HT&&j)Q#Dr-n!ec6W(7@1oOV1q`!A&hFqCv!B!5Xl>rzox#jtL&;MZz&;OzU zSa5#V9?mh0=z|Mz$*Zp(oAyVk0DAQ=7;R_R!?FK~$B%YOa>=xF;n97VanfacWdKPj zRj4+);QVO``Iwpb-fPiPVg(-#Fx_L!y&I5NrGTD51iziq*JFp=isi3MN<#I8Cf2Tw_R?xW zsQ61C6*lqzZ!sRVU*{hOpQ1Pg*55{dSL>y~+o(6!5TsdFqR~?D{W46X{Xf}aIK7=4e^@7Av>(T0s00lE>C~b#JciR4 z@|@dnb#;9vg#V#E(Owa{=t>>+GV^2*Dh8wLuVA?-pzW8fv6S91aNu)FEl#XfL%0JyhPW{H<%<#7cq1){LfpRlqKG9IC@jpm=Tv2}0)6vg>2Gu8sc)=B1P{Ny zybP?M8tytd$je&=r9?A=uc(&-Du-T)g&)Oee4y4w|kHK(3-#2F70x3ITFUA9XjV!;POW@=(nbtm+B ztMEyItEA#)+45n<^_LB_V8%nzkN1-u_wFRB4qb%mA>{Ivi@e?i7_qCrCixa!!q4ZC zO9d55d2>i>E@MuGscV1{yVG2j{a)ovAX#`t&ZJtFJ$oM%Ce%6XR#qgH(SpcJhz7(} zz)5#M!LoH}r@NL0acj^0%jJiIkv;YWt-U_b%w+Xq%7d57xYmgy5U1=e?sFLEjXYX% zX!>e)b;HoSp=!bN30$uMLMih#srLgdjON&D=HpA#kWH6zBD)(e$Y7d~<72X<(%0a^ ztKdU*H!+Bpg*Hiy-TWeC=8?`NQd^(676*dZ{fITjh;S^tB|xeKy5?D+^hgR@L0X3N z@Z7Ox=s7>5=d-jkx1@WVTfLAqtk{=2gMxE%fowJIvvMC6tmj~o8ZlyaB@#0e^X6Lg zzLSc!xnD^k9OuT8W6Dr%-B(WJonoz6660hv*2-x-_pHZ26n;$*t;4fc^V7ihHA)U# znM7Np2w(=tkhTL!LU{c18^^9HlZv~ai&H%dx&}M|Hgi~;<_$?R|@R$*C6TVj10vVI8Um`IZ_tjqZ`j= zw0#tPMxRv2s2)SDOI6YuYFzuP%~R6kx5eJ?I`17e_GY_3o>ES=V<%ct*W z`_I)1SikeE!m!g&m;vO4_{G?|=|C=t$$L%j$%cM;VRkRm{j9nz&%56R-qO1T;kAuu zB4RQR^GwOPb~nWH_-cFvTQ1e5G>%1jZG#_!c&xS1>PbGD@%u3vL3$ko4X&@MX&7q!?!Lr1E zpucIP#|7LVZ0=n7)J)|@=@^EtgoWBGhiWGc?1hINGV=GQK_=x{Ut91%!*(m59rzex za{fqu@?hR5(Yfch?Cr+Fun}TEIS<<->doEZ1?0c5V}TCt(^@S9%1~5FmW2$~ z;m^hCU|*a_XV30Ec16=^k$_^aEtgjVLM3Rjy1#l%UluGRyY`~vYKf-#G%_4#lt9%b zt`k~s{}%I8vW;`9LHECV9CZ5&-L&!yW1CbVN%xX~=Z5n)v+IH!V0qx$f|O|?5ofs% zyg%D z2GcAZkQ%JK0N3FtfLm(a2^6vZvfjiU=xSZ3*j!HI=3)5g5rx}X@auO>S^}LFns3p% z1chr<;4Xm$QN0UaY@DVZ4Ryp2dVS?3E|EhMqy$XwGyFW0P;3oLW>Jn9kSXIKB zAodF-%~p;|zPPCoca2UWpe)C*`)dCnbVO9nc?yB-hC*>eFjLU+hJq4B?8;|+jBjS) zz#{>hd%Sm+zRZEsh;ddTLtm^)w$-b))R}Hd($M+h!`plq1vdI04ioQJ!Df-84*#%_ z{!d^)y$%~Y{+ue@GA`v6R@|J?-W>1`xDQuo7BYTCsOk~}ARA06&xKa7x^O2@wUXyLqj@Cu z=v(r&T>j5*?s4GdaT#$)A!62vpN@%paXjOH{gVk}bSvC2`f}ad=O{Ao0Jh-Ml5lHq zU#F(Si^)4O8KUh{wSCxH^oFv=ddFfjw1){c2xqk?uy1H((4`>`K*n48Je?j2w-P6N z&M_m(J|ht=P*?W?Ynw>4B3<`Q{NynNG^4!f<SKD!&hekB8e0 zCu`?~{Az0xOF0qf5E;Kqb{S16o6bYDuv&t6nLMf!K5v_A3$hHc^?D<!CbG6aZjn572z0kLhBMm3QWPeMQ#>Et_Nv8b0ecU z%rC-5xr<>X43i&F86V6v)`v?cEhe1Sg%D^-!JP{ub2?-K=J)8TR)i>_?%8>)7a->$ zWo+1M0!|U30-#wDf8w~+VejIcH^|VJYtx7>;2Asfh~U;SRpzrzAbP!{D*WqBp%RFo z+FTlWQ+bu$lp(C5&NG=P|7%^Gbg10s-qf(*TMuHTOAdMG(@S1Br zJIYHh&AL3b?=PlYgXyJ? z!Qa{7(E{^}r}Z)NI&I1jo?;I5C`*qPDz%&fys!AWKx_MH%Fjd4-4WRk=SWNdP#YQW zKt^!GajHue0RJr>Px4ax+{0<6sFt|EUtF#6{M{g^g(zh(FUN}b+{>gBl6&4E_Q563 zJ0#H(Knt%UoZsDI!;NbtmkEgOEQ({Yhu!r8=Ihos;@Zyx|Mz`QuNb}CG>cnLu05+i zxs2IDwEJP^HUmMvfHLQMn!N;D*YLRN5oHZpOs=D}^(i_OHur-}3vMohwZX851!@9Z zp!SLTeUK?h#>BKE(>!-vwwzy_GV|wP*Io+=c8RaUuK=ff78x&7!0NC)d-HxivH(Pi zRWBMEU3g6&$6KOmb3$DxqP%{I7G-`9Acw7?!sa4Tvk-*d0Wp#rvM zV**>f!TOrpTgfHxQNTy9cH8fZ14`6;T;6UJN@`*vvOg-8A0=WS`vraEs3&($yfPt(qRJeszT7)$j?^Ty*N719DBvw| z9~0}(sn9jUq%xS7qJ6p&p-`Ut>gFawEx$YQzGWl1S36(UD}#d(Vm{xypasEo4|ksu zNg=HKxIq@IUA^1{C!LAJ5`RP__V(?lAq1JMN?Zjt^3kF@Z_+S+V7_c zj)}+Mo^+Omm-hb-8?HRNM=#6Fx(_Fzy(j%)yf*bC2Yx&7T4AOAMB`qH7vU$A_e2zp zkPSD?FP@BudMYVieS?5zBLG&$emSSTto14CH4I=@x!k$ItUrKP?YZnPSVC*##hZ_4 z7R{WSy}JVUx!8}>-$T@0!vLc0RNf7-_wZv!4-IT-&y%lpp;=i0MBlMRp4mPzUxQWZ zsGs?S+EZHQ)+9*!o|a)vsfoK)h`v8XDZU_w}Cyum8u9d?M;?3$U-)85|{1R$m0BK8tcs=OeUS~S5 zyvzhG`NO=s(qGbXvsUK?K5N^T_LKV!152J|*$JYc+e9a{%Qfow{JY~X9p%cKoPIa# zKO#vp0mq+E3mpMW3hDT;J;x~CP0B~18)o#x(G+=6kp0;;l z9@vnd9N65p-~L`94ZZrB7N+5mv)kk!Xd!RA0Lr74!!Ub$^MOirThz*RvZ6HP3%9fC zrZTP-iqM9lotgQQv1^{$)cY2ykT-il_ z=XG``Ou+nX7x?-Vr2u;rog*PiqsL6{%=#>PU(%wV^XQ2~URzqA&*YU-HQ;4WS~ukq zzPT#D>HVW5eqL}wRAR?;a_as>QF?`ePDPjCL;fzSbtL;&M~@vN&36OC_rmnt>M58KU-Q5<`lVF}eM zmDkS70Ss#wHpjbmT_jOLe{4ArJ3*{}4@<)}7eBQase?Z7a)nv;v!uMh<6V}$^n~+% z-^e`C+5@H6?>V-Ipa}F6=F8ZSrkK&h(I*q`CgMF?- zY0hPB=PEjB0(q?DUh|Xr)L@)z+5L>q_}pG{eS^H~8mk#10DLvhjG6U53wNKNNKYnF z3V^w<3heI8j^(B29}0g;p(T42_AS!a&xKp)k{`Wc90%mq+s&iTY~wsZ7tSI*;?#=5 zX1I%;$HgDrUyTOmA2F42+K>}Kwf}<}H1|n2>4BIOmHQZa3NhW>7JD(Plc*a-yhyiByndGhTKqE1w#F#lYJzp&oaRF*Qwl zr`_KRK-f*U69d>B7aPC6%RTNQ<~ zSRQI@PP_7hmXl&0ez4zF8*Q?@(ULMWs$MA_NmR05dkuDKYGi(gPNUI%=~VE4nzS4M@paA=+vR_SHOfWm*0XhOT#KPyOruP}OHLTcOGzD>Gthok{uKM6U40KT z;I|+D=!ZTH`DAZc`s-!S-BPMd#91h&=0{y!j(WC~A}{eK_4=HA{Flz} zcBjHVJE^3(Y_*{BUy;f0!3n_i9=$qqI!xa7mwHaF#64nVp7$<_Pmt4-9gppPKB7Hm z06+(|ZSuG%_TkrJVu!2Gq7C&@y^FVZsGw@_b}s0gq&m_>UQt=46ZRaH^pTP+g<*&d-?IGiHVQQ_D=y^(! z;a(2kvMjWZzkM9xp56o3CE-GSD5e3?u8nE2jzzaAFK;`)Ikja=tL&k7)?1d&zp`e9 zpSNOMI7E6*KNIOBFGnZURG%L;5v=XOFmk)Rnj6uM3aoCs)DLjVZq+NGx*p)ky-UMP z8dWRb8lEGb4G8+CtA^`SEbIr0R){d%a9%~|WQ|Jw@RS{z`_}eoOZn>_=~17FCcfDr zo%r_am;uJT^>~S{cDcDpK=iv!0jSYq!SjgH zfA^N7sIxU16LMKylSJ1^H-DTx%$K&6P@Jf&##C~2aZOd89? z@vLs;-g?b)^V2Zf2>@3&xTA+}yD~NJ?cp)6H*0%I??`Nd>pnJQquKK0$$IeO=^OWK z7I+y+yi0f45HV=XYi;*QWeCBkU69Qf`PS=~U41tI4y)Y0K z@R<2Mku2L$d-JDp?97#>QLJ^s&-DqBLAK`H@!Dns^`x7Yk&tFP3YPTlqVpoHU8Pww zWyVP}#rk%Nhzm_VH$1Z&qFNWu#3sv>;oKzr-o*fkwK~?Jl);XD+lb<3KAK?C%1qSD zu_sJSyv^@-H_ZxDMOfzRd%rV1_OOYUL`T|I4_+uRsY z8p!WVJf(GBQ__!Qcuyn@R^Ivp;eUnMRK*BsBKdoZS+_n$vyfu)-KKC;x|L@Ss3+Im zSpBTn?h|Yz&3YUOuABgCY&_UcALoq@Fy6C&QENl3Ztm}|yBa~1ySyB-BF#XX&pa7} z=71;1c^jEU^JO(C#SP~fueiiXoEgmq6W}~vI6epKz3Qym`98_|8#>gD&N>7gUHgRb zP2bC;u{9U>7U|5i>?A-#akDh{^HE2UjRBDqM(t5|c4gJ5EdW_5_^;_XCnT@yoh ze_c>e=L&Bh%MTXRpR7IXuuu6}bgXpp*i&OnFhIj8_T#C=#r@^BkQm|(18hj8n@rZ_ zn-?zfddWSxBK-N+hvvxMd6x>W69$_P zjCTWmkaQ6f!!-P6UH`s);RK&UgLO=01J0|kM>px3o}c$gg8T5X2Pp%r78xIm1D0&| z2m10--jjHpk4@8gv!1y=wY`D&oM>uWU!B#`IIWODr4him#>Hm&nq{#QZ}db4-Z{Io zwugI=Z+INtFrkJJo(y^r0gCR=OXvZh_@~6|6gtSQ?9g=TAoU5GfV-+o^v9F-OMQxm zCD%3;^42-nq~Q3Z{FVsgw-#s)WP25BgLHj75lxh!+#9h}=eK<0t9&c!>5T9O@`pe4 zp>auCOIyFig?mLT4g3P_df(cSoGID=2pn}5rqhvrJi_7H^rU9Ia$Ay7=yZ+>(;BKbEYkT zOe#)D)c48358pxwx8k17B#Z zq@pT|fc6y51;FtAPyDnyelQnh-7;@#PcOFS^`xf!nyl6l=i}B&rgc3=H^Jn?IiZxf z4kj~9EIjOokB2so$87#>P2WfT$wD2ry_>CXpIC(jtdI7GN;e;LpHb>weoD^(NHG8! zjdz4GzPz*X(ii-04I$-FZzctpV#dmYqg(6u-9%hPGM)!I(bmI^jKZWaqq?8+&Y3UB2(o51}ZIr|~)J`~kd z&p6ql{K8rP(wH*sq9`@Q{dfN0$X3m1E6wZn2R*`UCWqz@QlqR}Ea5Ug9<#N5UQY-w zYg3c4v*tbE+PWJpR;xQx>c8y`E(<6IGU)clpDIb!M}0n#Ptd~iJ+r^2FJ z%kM`pkvA&tZ$1!=B}y+Ht>xSQIM6>m$#za!AOUMbXx5&1XSeN;fx_q#1#GmcpITg^ z)U4Dql*j&QxU}hQw@FkB6Rhs{dvt9h2wkng+&0y8guJb<{XtB)YN!2NHErzu+0^Uw z64(cF6VM`0~=4&O<&y=#X9kN&Vmpi$$ntsC5;?OSp-xGg3E0+<*9cbG^Acx*Fi zW~F`Y4~@+zdBji9SWS|Yt?zv(HbJ{~M1z{-c~nCEV*335I4A(u2m<;2;OP?^UaZ&- zD`3qDfRhmiX80uMLTvt`&2iO7v69vdPObHN%AXJLEqh%34+xsqHoWN%Ne0=ClIgP+ z>B`!)s)wxVKztb1rjioBsEjQstq0>bp8+NNKjw?c0+gQjuzpee_`dF-R z$8FEwnc#rbM6kR({_eqgg)O}3ud#7s^UD!Imj-DN=t)geN36C$@NSmyfBk^?;`qiK zA5OPp5xLON4?-*j_rodQO_M{;fmnY_tB=jLx}gZ|^^oa*Q+!p@yy$WzTuH*4;wOdE ze|$f{par2maE_w386#uAflASyF9+R)N1wjmCb`rSPxRx)#s50T+<`LzR+8taOT$P? zTOhSpB~eOucFT|thyN(ah8&9Pt2TPvs<#RC53`_)?-vMqJmW3uUs*xnZ%8Lu4Id4B zth@_lsEMYe=I@Os%T+b{GkjB|iZffnq4x0PZ{4cd>ntgyh(E5ztu+J!L|&JE_>5U8S}ljOWZLA4)Q!6FPCKDW5-->zu`YD zL$0Q2RgWyEcRS@}AOipzP{PZy=Dkp8=IbG-X`gx=N&GiU5DT6*2~f1xl_g+KgP1?ilw2U$j`fYWd*{zuv+I~IOP`IV zS4R(DxVC>E%+Q;IM=VYDC5YisL0GaebAJXkO8HP8Pjp~ZEnVj-m?J0cn)h7O1s9QY zTzEY_-qpYKQN0KqW`Pfx&BE3Xa6lf%^|)Q=QH+byuH{Gr!G?c(SA$y=#^ZNK84r_O zL_mxLrxc~*q1dRqB;b_!Ut_36SmIEnQWwUB7UbQHJcw{&%E=|A6T-r`R+ty&V9oueDOa+pA5&&xt#uPsXipV5*f{bf~KkXhYvU5He2!y zbNwXoU#tIVkGSMcT2G;1Z!CF&YcnYsWVGu&`PGWumE{cPb`AS`A`9?8qf>(!vJqCT zYTZ!|c@9IpK9CYN(ZJJDOeIkQk*}z_zValMa)GJxOzq(#?N=3V~7J zEj$yb=2m)HZt@;7>A1AA__$DWYOVS9V%qt^`M=et!~Y^~!3rVTHuO*cR7n*3CAVoe z&zfJ_vE2BhkHPSpmd*yzm%Z!nK(S+^2EE&_>=X-rAZY(kk#FcQ_(t^@vVuGxLnH93 zcDx*YRMGY~UjEsZ5O5WB^c|U(Ze-rqeF%^q_z=@459=%C>Kr?&o;D# zAp#JBqVR8u_!yw|Af{Q9M1RSMjHzVmjG4ZEbznh&!P_?O)9NnZJoS2Nh*5~pCD z&B+ub8k&kZ;uK7(%zyQ7%$F8p!HHc~JTOW?)s9Z)+K{kAe&i;A4;{PUu!oWsD zxQIuxL2~;by5o-JgQLhhwRV5eD`WKFYYif-gIp6+YRDZxh?YilL)Rx1o#1tM``1qg z?E|j=_7fnW!21$vGrjiVS~_hYP>qAAwogp8xbJM!2sY zNhTkdvA;lRPd=iq?vsRk@x`gGzh*+l%|JA}mC#`BP7m<0ld=>9VT@VB`X#qI82_w_ zYa=Ry$p%)F@~nCHe}k+wMG37h>@uAEp;3llJ|T9JqN$UD5g6#X?xMfuwE>REnyW2; zZ!8u975}z*smAgdsqO|#AUzso{h=}cT;SnVoFq_yd0W-~J^=nwaB~q<3>myRW`# z4g`WdH7cEZFFW`60U;#p?@33VR>(sA3P%H!<%+=}6y#(fM9sc;2K` z?YDbh;Ni2izu!DT{^CsYj2nbFs)pS=1q0O(bX--U0S8cF?R&Go21<2K8AyZl2Tshw z1&$q^TM6KnL@fQ^PDWpV5e~1S-nOoRdfqajNz}2pX0i&+cT$r-oRLVwNmI`S;z4g2 zdYHqdE@)Ym#)iXPkQU##1cm(RtBOEn+|^03;AP z9{Pe5u#Y=iy)pgM7@RNdA0Bvy8Zoe&l8)gxtwQF!S0CvSf4vA%!+>2e;kC*gl>+Sy zP8XpjZ0fVxwdx~X_g>PZbRp|=d?KerFe!WpR@ zSGQmDQ_I)j1?W?-kJirp^ITr-L9tkmN!{PvksB~Y?J4r{$?&KBPXRt+Ttaj6~&`!9{#uAlyC3K)*xP7_C2x8E}p<66N& z>3ZRv)w`UwNssX&lY(CUH8Kda1um}99xB=5rmO7@#>TR$FVU~`N%3=O@=ufhM|R>5 zXdqXflLM?%!S_$1!s|G9;=lF;c-X|!M=YW0jyND$Ahy}R76}Ec@z}UjnDrUk<&~6wuCRFujh#b~g)ZWcptB{iOiciuA%sOnr3 zdvFl~h*4VpGBEtGEhRoc8_qt;fP(&iRDE?^R9zSD%rM9RiiCg&$j}W+NXtk!NH>Ut zAPCaUjM5;TN_ThX2-2m5q=a-M-Q0ukz3=RDxR5o94`8vco5j6&SV!%S7f3Dx zx$%#a73T@Z#q@rF|36{=1!VDr()Hl^Njv<*KR3tMzqag%?)MlFcDmmeqyAq9|AFND zFCgZFdO>F%0!-=TiXX0(w6p-e|210V{C{8INe~F2U>-(Mi7zRD3&I}`&G^dY_+?L{ z6n_8r6#(lxcb&`kGb3hK91v?h^io8L5X_kR{eK=qG*1kg;}SFl@(+LLp^ZZ^kYm** z5#IlI>H)&k#<}bG0J1sOiNm>v{C|gZHF&$TOtT))`rYvW1TX*nYapZ9&Kpz%wa_~S zx&kLPYIQm%Hpe^D_9?-Cj|4%eao2FvJOh$$#yge3^VKxq8xfO;2xO)5+J7$SInJBn zhfC94-*Q5O0GR`RD!vhd-J6R9EfcYS7XhY)F#MAZ!hd&e8<+$^-=lls^D$cd`#PiR ze};G;bLXt3J%IIbr=$!sU}jl}1N&$ogDpot1Q{~Kr~PNK5R!);?_bBFS}>l23@HUM zky>w|m#Y_eO_NCvIx!gFj{iLr+Vmh#f;i>yh^z7=mL%BNj+?XgJCMVEh)<+v`uERJ z-!XYUdIfmHnkYmuk@3uJ*BIO&-(;VR|00Y%ZMZoLBD_*a1?ZK(^LyXT%p9~Q(D?1Y zXb-;($kOj5U2cl!g6x{5>wFfo@ZaqO{fAAVT~O1l%OR<=^Bxi3YX9jUXfj%y>X~=m z#h^$0I~p()LL8`PV19|ib5e@;1%fW*gVHq3{ z-wF2b-11-nGH9gbhyOW9G!W9BEBAR%O2hu|qqs*tK>t6wb(l0<&UJ$?$-49rGbU2Q zvhD0eRstBFWKG2UufYI91A+~}98;A*$%J0C0#xwxX2DNx>~0prwW?K5e91&!{!iWw z-11!WW6!+!7!-%l0;fnmpv;o&{(F=dabV2v6{EbKRuUK9 zz0;5Pjifge?P-kvCLntB)Jl(c>4tWUo>$c}zg$-h2bxTMJec!$ z7nxyK=@l#bTqI+0#*aPUj$=g=ftJtXr_O7=7xqZT7Jj#m(tW?(x@G>zxW=P{WCGst z$7;CAFRQ=Dl`4rRHlDk2Y3VMj3|G*5+*mNw zx81>#vU(Fr8U1%b?IJW*ue2Spfk_2!4o~J6vf5LNH1njJPZ4Pv?wx#WpnIQCdJsbH zUKrlPigDW<^J=L;n7)kZ=J%SnbGzW*X>!9^^GyWpA69$L0S$M`Dk;CByX43~Pn3<1 zZ#Tt^gz?MAo2^Y%h6Yikm}iyYAwhkf$%%6rR{QQ~24<*rOli-#a0iHrNJ#;JT741U z*o>8ym`j!HFZeihu#QjiO7I9kM}1F?OX-X4TXFDmbY?{ zFa`A89E;gi(b~F~kN+4k-v6rR!MBLj!~|5YfPsB@0O2@F!3(67%E8_m{|H!h8U;#< z&}foVQB*_eph`FAHsU#wxAyoa;)$KW{Hxm0M6$M4&`?(PBH3V~N;s-z{726HcQw2@ z{o@Cf(_j$jTeG^<0Z+2U{s6;r^ zZSkIZn%wf!SKz;4Bz6MG70G67qoYQwNE%J4_yGFA%?aXawG>#M#uT4HG}Yfow}@Ru zK5D?{==elm*F*8=o-C3P1k+kr3*Ng*vkrzXQwi^bQE{@9$ zsej^yF=?EPeVsHq)X-E9BDb~Vs)Tf3@0PNW-hpkS=wosbO_pFzAyB-{dF>O*XB+A755))0Nm zBvYlN9NQx%b=zIz!{Kc<9(uZROvbE%gdDOk2MR)%3Spi7*0*RnA!qBZk8E$Bj~Jd9 zNXIR{h#HC@)fmU#q@I3FRtrjv5Q{_g zM%P~P+o!O?x4|4Z{x!!rkL&o3#09vDAeR*Z)hmJIfO;#laq0Q)x{XS5bD!m<7LhlO z*|Movr&2xd>yvdUv&~QcybA^{{#i8Ll6=Dxl4fs7DhSdq7@)Ct>sZ`A;_?}*mfY&) zxHW21Or_k_JW9q=ja)Nq!J0kTVU7jqMlquZpYV&nN2iJq%Jk>q2uEJBkD^=-MjFFb zH7if7QgP&P{>hXEn4T7iKw^6843;+TvQ)1+e${5$?B`AsZ0U0sk3}4_R{2&!Fi2Gy2qr0a`$eI}D*c%bFUiloJuHdNPbxLg%Bf z@m@>0vLYI@;xCR9%86c@Uu>+qWTOOejPLN*lL5-Ti)DL&(6NMmnwJ0hu5i8XJ@ZXk zjs?y0n&+v4PM<1j9n1dtEu--}id~%)2Q4HX$Ys-crXNsoUTi@}-%f%AW(v7}hI5~( zk3f5b59u7lt^OW*cKFq1;@`QP7Xwe-A$6BnU4bu|4tJJLB&ZoekwBv~ijGv{lNTx>KT0s4T^Zkav2hLhu+*0DVxmkJ`aD(|Lv z=W*IXT*0bFOS<0i4shlr$YiFS#1sZ6)t?a-Az|qJ1-FfLHAR*#Rn(7sM=n6AybpJY zaORGk8@6=*oDm(=vaHj>dbJKgD6@l>6rx-MV7FA_qCaqlOUWFUlvr$*h1APgo_2Qf} z-t0)#QJKkib3qH*evXedGN##XZ?-vG*X(U3nhKoOqZxb*TldtaLw+4Z)g z2(}A;P$8IG1)$@rAMxcr47bYVC>b0&3p~U326Wuv#>1YEf@QM5 zcwTly6&T!!xLw!4P$cDXYi@01r;n+Xr&Z8-h1|~0$UR4h!l&>|VBDBsBL{LM?vb_x zo+Ic1YN?H*B@B=_^$VuM0*G>T(MqSajkzzDy{<=zKang@dXZ6ANDG3`D`)WV7iz)z zwD>w;n*`Vsme`@(jKI;VLNigDG+KHy45^$;Z8m(!=W>U z+WLfcgXmaZPAh>lKk?u9vn2phQ537;MRTdqf_v0buIYx}vsKKW%_}(!vQb|iC6`(f zN`O!$Ez4}{ozrP-kal}=^z3YGuT1V=VOe}kRMPJcuO4h9;vr$9_OqvV*Mkru(KL{k zr2JfE63G-Pq)vDCIWv(4kM+4axle&J2Q)&2 zKsa?rW(V0CIDT%q3H$)tJ@yZoYdJ5+T9vn*l_Pba1>TRCpKM_rLzFy*L0LGA<6~#W z8^uV*Ua6vkU#kIe$EX~<-1x;tgD$aB{n)MQq~IVgtE2_@OrILJ7Y?vsayW%=hi$HyoPu0gXxJj`Y<8(D(FSI$|JCW{fy` zT~K+l;UIc&4>Cr`FKp-c$oM(Z>b)8s1g5Toe&XgD+fisl0Vu-qm0ATUfV4H<;fRA! zEZB}G2E}z$jdBwY98kz+Otg|d@oQc8`fjE zoF&CLf^Q={clQ@A$8hYo6}X=%lY6`6T6Ql00RRQ+y8o_|r>nOegeIyRH*_g_!|o=k zTL=W0X9@P3cNliXazlLq|GZX{fh7Y2T`fmX1&AcWYq_5uie@-b9ae?oalC97xHFB} zoDz5+=u05|9vl+b@z&2)SrF8wWg#hTU6p~6_J-XV*h6q!Va^l1`^y_2DQLaA<09p()YW;B9u++eiR0fm!v623!Hp%I6Qr?i%{}h9j0R zx$KW_&K58uT|jVQNX;J~^>;e2ZsVdh4meR##RKCB*7qMy*Fgy&hAm}ou<^v(h*JW@ ze4zeS{Gb9H9~O%)|0>z9Ls0ODRvU_+fG}qF@nwv_J{xfa`8GkiaD5a#JXBLGeuw?B za|QIm#Hb?%7)Sq5ms|&ARKWHDZK6M;FYAf_#%!>9bcUAKi8sT8`)>4Mq|Yfqi}}8n z^=Bc!YyPCd+#dM?oazK5{4CM=XTgOx1m3v5f=8UAP=Cx2mW+oCvJtxo zeuatr{*w|#i$tn2`mZ`1#qf!(VTL^orayF&0m2>wq-@78Pb@&V*|^yXIFs=-S(&Nv z$-pH^QaJ_5N<5ogV?7IQN~<#VfTyfM=H6um^J{lFg6cH$Gu6yXo!HrLx6T{bp_zHX zg1!My6utZ^W=i}^(BDQKF6Mm0 ztUD3?Z42rert1G$h}yc_RY5}u9Ig=vw%z;sROz0ykt~!TfR0jl#o=hKT#%mfA9F4U zpdNXdztg?smed2HRU4-ZMn*#n!=^zLh1!5RdZ9}D)lJwK(>ffV5~W6apnc9MI7XSM zpo}-9;j96AcI&=FA)m)O+O%z=JNu2YWZl|MGKxMAz>s?yX^s zWMoap8r|ZLZa#?4FnC^tzV-K?WB2T_YP@U-7Qk%~pi+3WZfI4wvpyh9p%vaq3pbJZ+iMI{?KYqv#hzT!@Fj=> z*W-PhCMG}?oCAV=5N_{**X;1B1Ysf#&ww>vov3zCsghP*k>qU1$Aum9yYR+XW-xfFsVf*4xUy>BK; zjDT`?Hts*}Ugy`kG00cgN5I7(Uh6spy>aT991(me6%OFPA^j_&y%=ddTI<+nFPcJc zeSx(y`R&)l-hNFW!pNKf4<;d(#wnhwmBo@|N?<322DXWe0T-nWFYA8FPJ>SQWs*M4 zv-TkmZUx~~6}Lpfi4ooPgi?pIqOiiM_=5m{Cwmoo&BJ_>WKISN0dQ+f2cjH6mZ5US zaCt058jG(n3kM=st0RaR@J%czrLv-PYN6{aF2w`e__m3Wq2&l6nzq78yf5; zkQ`#xoFMvOXeHpze))4Jmqi)Lww0`S*mtlUcF%*_7RdiSVasPnI$3#K5BCXsJ2f^(7X)lbexI9XE^p($hg|kDwO{5j1Tf~MSz_Qf4e7HMZTBybu|GaSg;oJ;OvSuqy0QCA!i#l8J3Z4I`b$zt4 zl09OqV;c_syY=}YSQjPg(g7q`jBuJ4X>yQH4k>C{{SmkZe;q0ky45W#q%7OoKQzLa z89RKYj?DP-BnC{Tf2Fp)-esEh^}dwUsB&Ghu~=ant|Lf)i}sgpKBtpWrpe0q(llRp zS+t&6d_#x}?(~o>XW`1&QK4JDH!t50&f3|DSNwn9u?9ru)l+i>9ev^PwmGCrcQPusFvgnxbH0e&g|z&TVc2u`_S;5w{<6UhC^jk_#=mE z1Q8Izsm%8*j`vZ36eQK!S<==XVfRNZ-0*eV{BxvKV^(-8BtK3pbeCGm<4&9$X0dA# zsMA_`P&edy?KSDbBl5xm`9}Rhku+;x^~Blm_5OMCzSNsoe;H=X|&%V&GwBxr*OoPqYg{oy4bfgds9x^m&}aT=A&1Kyl?`2<`~tHKUWlqmf^ zFDk&J{OHPo=2A3#CkD6GM$o(^VRnLz6642A#yEJ-?=?43`9f`9^JOcmkE;>cfEAVK zTMs>SM#G3z&|SqUBAmaObS&Z8P`^r}yQap*VG=0{jXP8IrdIB$sPg<~5QqR)i8ih= zq@*%TQwr+)?DsPKk{RkcaJ z;PpGZLb`{M15tQL)(z!+zoT3;C$SP0Xr^W$1ndG;x;vzmY!TNOjh_hUAfugd@$%fb zAmO)h15+-Nll3S$sl!5V%}n5HHkaBTVs0faEkuy>7SOXvgiG3kUSASOyi$!Sbk0I*^n~cb1cL_Kf7$5 zxpH4DyrJg3=^H8WQnCv|Hd7i0g~IBrR^G3}x()UPm2Yw04w&$-5q0gibqQXRSYT4j zEf(SNL7_Dht0kaMTLZtWa7~!6PJ%L?_1bwtR8JCmt>&>YG_w2VvP7N|JlLd1c;eim zaCUA>m+nNI@2%vHLK?8o_a-uqRp@lZQd0iSRAOkpzu$kvn^efUjDIYNW(Et558lJ2 zecza`b|l3G8`VV{E{g)$FeRlvU213jZ=+A=5d_QOOhcYe8q3ct#+XWn0s3@|v=*D2 z{idL+>bocL*_RUq?8d7w?dO|rWW?WTiP)a#7*}60-$#|<2)kXno0S@tQR8c%OxX$z zD^3&ha+GI*CbSG>r1Df(07;%Wmk-{_X?&no%`YcCg;i0WnT8FONhO_+M1Hjx^T0u9 zI(*4@W^h_o_q4<8-mLH{sb%~&(WcyERR-+_C#(2ePhvYmxmJ}Av0fo;oGSp z`q-UX?K{-oF-U6yFVjS|^eZ@(`6O2KotKa48*7)ic?(DXNL6v+3mX;w%nZfv#X~j} zCzl?GTq%DTq8V1pJCu8DA`M|nbqYNLvjp|m6Ts?`&HJ{}K+`O~6Dr=IJbHR9I=!PX1;b#QtpyI5FH1i zft;$K(Uz?J>Z4)ml;`ust{ZI|LpQ;-^so-n&xy3EHp#7Vqh|&@*Ifl1b>YV?SzZ9@ z2jCwwi{vv_G+an)tsW9Ub8*qrZqpr6U zsyEdg)(+rcXb!7gd)t+jrpcRz+y$WeY$uWCVj4Cz=fZpMCgNu-d;1r=(#>-|DpIAbH+_#)27Ed{EBZtFpeB1zEE9THEXa5(4EYgqTv>h4=$=x%fK~MM~AV|#@{pCz(qa+)p%P68k z3)-l8Y#sHA$bKxfv$e1l%egI6gsZ#LM|r z2k}vrF*Z=#R-rS%+hn>fmj6P1h%5oHV>BbtIwoo9Tv{0dn7>x6@!a5iMP<^Hsh6y$0zgZ!qsHP`+G#c&GBn zYBgWOia)-9~?pj}DWtX5j5~ zOLYoGnKLD5n<36>^PI8%-sS5^Puz$@0U&95nQ&Dl%Dp(_;0dUb?%;f1dtdvmr-%pO zS(Q65v4yq)Pg|Tyyxz7jtO>-GnXdhQC$7e>n9gbhyqCyG*rR{)Ec4LADwcowjy!y| zYm__pOH49l5^ylgkOVSIf$9v}O|^V`E}TZgl9`;ZwBJ_~Y4i^tD&i*f#M{C`61I zJ|dRa%*Ab`{8eXj*x*8mg~#V&?`V$Zs|tN^aWTU)g)yn zm%AdBA3A-CS!vXlzufbysi;aUBye690@Xa^baPy`FuUxd9Fqy;njz@!yHW)zUWre~ zl3D19po7?SOj{Bh5JI`UGoH8wZ{IZrP#qWOh6$NV6g3ev2aeuFKlsiMMS*bduBz@Q zR!3srK=h@lVcWHXHOZ`xtR(d`@@sZP)#ZH3GRW-gS1|#bE>QDV?eXY2)0f3Z<-zEH zyfn6eVF(*wh)w|c=Muouk(sy@_3bqN0=QT{3a5`8=3O^}SuX2Y+C2SBB7FcHX- zxw)i8`0DuOn4?)CO1O4MBkLRV^)$CM(~uwod>9HznccAJh*4YQpH|XFm|-J6UE`Sj zyI2MbVXrs-iEGpB3v_^fT5e1qI^>b(lP^e1RCt?eonmefuJ19vxC2uV2Z&QG=if6y zPyi=ZYp7~bQzo*;#&SA`V^Lrzx!{r#G=0n#Rq12UqTRkt!95ovZ)~({@2=hF z*W-qtmyR$10P;usYK|aaU@!zdJ_IuIfPd7-Pmn!ReG)$piL{aTG5Azd+~9@U)1t9vdK;5;7gY%nAkw-REGuELg#l0+{z!}5Qv&0O!pPHHCgZt_W0zY9s*Uy5 zjn1Sr&^2M>yFG+H!m-)p;=Hf@6A!uc!#~`z*pU2=qRHJ-q=Cuu9-4ST5!nrtN8u`| z4_`olg3I1)xM_8Cl{kd9K5J^Ob|yVkhCUBcV`DQtu^d`zO$o~PxZfnpe6V1Dr>h=6 zL1w-iO*odi%n=>r>G~M;1lAu4posqNG@bjnd$XLa%oY-9x{#J1en0ZuTCE52to)P& z(uto?J+^rp&xopMa(f&CHc~L5_z=gP?LAgx!owZ+kqF`sy!HpD8n@I_CDK7F1(*gwfy<` zcvYC>UueR zLH$)iAXUA_Ioql;^#`n|q>t2P=3l*eg#;di8V5p9Z*WZMwsV(zy#qoA*CVBEPa)5fap zg~jKC#Y`EYy|fWWiv^2Iyey32))BmOmnKTqek|30PV9y4DDX^8*x@2!e zCf)#6Uycqu?w>mBTxnMO^m@ZUdz-=B9&0C(RfOj{w_xbK8NtKBvHZ-BA)^(EjJ@{H zm4NmIOaK&k;XM^!c&7UWPq}2vg6lf0YtF9gkNx?>%*U}|P@s4p)LRc>Hx9j-aKyO$ z!>Z@MOre}~^++W75IS?b=f!F-$dL)XJg}wK=KZzL{}`2roAfAAdQo)4_QU*=k%i~( z+X@vFzk-nVLE+n9J}y5w3cmPO+{G3ip8`>andJ3H#Bi7yuQ-!m&T;m}BfQ!}xVgXarkI-Mc!oGl%%Oqc)M8 zQ7}CEnU|!}K@F~Qhcax`aQ@sc*-8nJMMVL(7kNp)Gva6+Y~y=R&ue*iZACWxnwu$m zAsG6xn!eWQ=F5!I@s6>iBo9no4B?}+b91vTmsC%&>Us3~{^0mz|EJYb3AhL`Uw3`| zuSyDZ60PHHm&nF?%F6c+MRX*=>HS3Y_b&P zwi%;O8B7>JjJUKcy8mmR+RHIt#B!_9)w}C;?ace46)m!m2XgPWo5W47tRfpL$$_Zl z$qFC$moK}xYLLwu+wj!`i;_Q8%taE$RV+nPZ~=X?9N|D>KoiV#`Cj$GC<|{wG3SxW zv2>ahBxT=7sKQc1wl*&ICm2YCqNKI1#keY(zgokfs`H=Su*M*X_W`esg{d@|eJmBQ z*B9$Gw3#4~;3^oXbtGS5JIBkKSQtN}UXispL58x!Hs$)W;8$QafT(MGEIM^tBBJPH z9PgD#2WDlDW>VmXKX0Yx`J+Vrop*b?2Pmm<3f_=F1U@CZ+WmN-)I|*ℜ+H zAB7N&=O-zEy8RK~F-@y_cP;pMy>lk`Lu_e#h(Ak|c(+p6N&Yhu`tQQK5xV*=4VoQl z9FS~S5(m%zz*_88(=(yp?z1J*KTD~Ym+4;3@%{LD_RglN9~145`~s2sGB;TB%x7?5 zi=ju3;oNh~Ww({<@d0ive)p=3TZ|I8xFj~SNj7YW9!T))fV18Got^AJZ>}*^jv(Sj zEp@0fK#N$Yt!V9Cv1!XS1|jUzjjGj0ueS_)No=@vGJ>Gs-Gu_3yayDNU?bIEtVUeE zM%#PKhF1xLPQn#CVXOMh1x9jX=G^(Ej6`J99tMYV*{Xv>EwE8-xW(KeZ&>=Xj=o?l zQPqvW2k%;21W3NIKDI4Y&Q^PC`e7JwKV_MiD`DI1w2*52vc79dO4ILh>|4wZR*+*z zvrS>&)PRppKUwfwDjN}g(fk9fC0~bN0p<%hJ`|-JhA)T-l|Y?NVr| z(l+33!1fx|UW)hr@pOO{zWkeDg&HRjxO`-@01udm3DSY{=Eyjwdi~hMC49@9OLx8| zU{^14|7cN>XChTO~QQqQS)&J;OOdeKFrTifgv*VARRwK<`?o%llu zocS(h+~V&9E#r5eV>{_H+`JZt`$8P7zZgh?FFTe^S}%bde6YSJ$y-xN0t>y&<0fJU z;ru*TypnT{K}rhtQ=JdxIdpkozHlN!*0$?%_g;sKy+&)O)1-Ia^TfW#vD{qHy3nGe zf)z+}qN_=wmCkeh0~viBp!dS|*V}hiz2rXI6Imaf-+|AJ8;7%bda@fJSm#R{H~8&0 zg@sC%W)If-z761v4GXW^zlo;=NA%~P$f@vL_i1w{6}UsBO<|-!jsCzni;k?`_PCGO zGZ8hX)W7QVO|fKgVS2|kuJD|=%D5H0!ou5~VXMs0LmrbHQUWU)u(qnW87do-G5&SD{eDiU zdFs?2_eHumVuj?1Ul_`a7bnOBgUL>tA)>~}8s@8$Rz`!+<;!a%XVh1;8pZ>~nc+Ab z5nUvphshW<+9`z2p6JD3E{T2{6r(j_SUoVy7uoI*eB69=jG+&3t2WZq7wa+H<14*u zXe!~0$cLQ&>CfrZigkZ*p(Q;ZCp}Ht*Tl{j_Djr|kuoOIXk30hXhQT0+r{R@MfXL{Iisx{e)8k4({>|AQ4GgL!?N<*&xpRI%~u6B9IW zsPvXf16BNtbOxyZth?aLp9bG@ecukt-JuMIcC@sMSsr0p>@ZRjea2K!I? zm~w}d9V6ei5rF>KB$pn?c(X-W(QPLo4rauy-d~w%b=Yz2!stfXPeP`bk4<5%JApkF z9`{9m{wQ9W{SI5&c^91OMiZIToF-4$H1&(FhYbP=09?Jb`sVm5O+?`|bFXAMQ2f4T zU3@ytoMsb%6fUS9e(6?Bw^N_&$x|`yW>x*D`=>OmPDLotE7Q*o=(mbea86=NgIqf= zFz8c@CIN0_bQmNJ13t%K5tgJ+Jh^;Q206*P#KOUq6p5 zUym|&&Y>&_U@gd>8zVf|AB~hHC7Jq&dc9{&Ds2VoBDeEo>`_ef~kL z3)y5I&umH`{WJ?-7*DP}wbKX25{xfT7=e4%%83;^4SsS9v5Dgja&*M7<)esC66x$Ep#C81GWLPNfar$C7+#yM+Nvv znhc08n8_^YDtG&|47X(x`ongcTg-;5!A2H079%7~?k|&5hmrmy5>|y<7^S(Ui6=t`^=>@O}vQZ`zGcNssm*LSv$;Lyq&#>kj?OHROyXR`A^9$ZP|iwI~d(I-T}R zsEIZ$59G3Hz*n90;Pu4^nOs)KoHK(_TQh`DsQRp}t^@T1A{7B@M4Ou_;klD{qkv1^ z?qP@e5n%Ai+;tiYrNuGZ-mz3^P84`46H7tM0;dftQM9#gna5e9uLV6^tnT&UA)u$R z8OH>wSN7zHGnTW6B&&c+TWX?%L_Fm#7q;h5o5BmvmoZip)xI1<&f1Q%4~Mxg+P?L&89<;7*?7HxY9T{_+sRjPe< zV{l5t_`3|JX!;tR(bSXN=m+$CG5M5kubxV1I}~Wn+?Ekao@;(7j^kSfa=+bPYpW{S zz(E^QN6?eYn z`o@T5l01IU^0mbeb8&bYq=6f_%_L=`J>X>yE>6$$tPp}o=5u>Q$0 zSpV<5hYz9|+iyZ%noyBKIa=<`x9NdAuQW-cZc#iU{^XS6xY5)U>v*Q7xJV%{XW9G4 z0k(`QYUPwExh}#L*T>N>Wl|`_8H~x*^@K$8s;;fNX&7giupi!h zaNycCS;|R56Z=ZNR@ixNSo?X4=Jif#EY;AgTv|!&_-j8ennUH;6Vp@CgFdOe-pu5U zH{>@&uVJKNpoyPH81<hsAJ^*IETgTr z@-r?7-6L=CS=Hw^o7Z8NKimyYqp2~*p-VRtyJmXiJ{p4gOM1YuLkoAn9bHz~ebk8a zb*GONwB&l^an@=eZ{Uzo~tvEw$vmAN)1G1Z$f%(evS9+ z7PB$tN0qF~d8ZRb+;|-6)_2*viLQWoH;>)cWDKCkED*ND{k~GAnkTjVETs_>o*4csCq^Nl#~--}asD};t}izb z815@D@|qAZ6^(!&4dQO*UGx2`E)E)^{Tgyx@kC|!ik50PgnYM$IBGddX;maq%HK~* zGoDFm7$T%9E>)O?)Q7!Ao@mZDY;RYZ(zlT>LE6u1@n@Jy`wkYS+@&90QyhF>392wZ*?d_0Oi>r_{wIWwxjE2mwDsi5V#%da{7&4?cPSUsgR_6I zfbYgYv}^XD`x}u@Y`@tYM{ZM2XzsE)OhLoA)Js|E$T&-#Q z&7hWtoG1%*(gnF@yB(8Y14N2Jt&z7jUxy8*CO& zQz+!qs_Qwl?^CUk+dqZdR7Nqs7LaS>K|-(b;llT=5x0a2Jt`|+gHvZ;Ay%$2>tW-a z^k%K9c8+RBN?Rcl!5@FR&y6bE&jEY@Al>*@GuRqk&+%O4Tglc3gd{Yp{a9^Mall7C zGTK2EkVA{W##(G~aj*XK+CmEs{NqzUd)jD)RnGKeqki(kM56&3W?U2kW~%O7KIORG z)5Z>Bj&;RszrlFP34KWqz!$7vl=CEteiJQBn;m7Pb7~z|*S1HqUL3XOTeQ@_!q}A1 z$}eH=R76<|pXJ)KqRHtRN$V4-bujhk$u1t>bq)0mK%_w*>$J`qg37gww#J)Ze=YvU z#T8ex5=`j9vK+>r8*-LvnI?G~Id^LR5T?OrM#WJ1)bk)7vpIrf7H_m@Vnupr;1G;@ zcivV{N{}0wQsuOkdq98k2z7h3P=!wQ-xT*{oZs(le*`8}H}3wI8jLSy*Pl~+Ct3HY z%ONivk*icYT{cc?%1T~Hs<@F^S?3Q^wTtHp*yCdOTX78z8o#G z032Oz(r)dbn3DCy&sS=l~HZo$1;kcQc+n?}~e|>hUo9MH684CmaV2Eyy^^>l# zn-BCi5^Ct0Gc%yG^OI7w6BW=n7?Q#K;^#|ZZI$udl0+Bdio@mIkSSWNVl%wu=Y zK%4|d8arpj;Iz;s`4ti-;Q}{O>5CaOq0<}V^$z6&Zb&44#Iu1O$G3}w2LGU19{hwl z(R7ei?9qGLMxi#}7SQ7d5#$F5Qo6DbE_VMnt{MaK(kYd|f5rc@Vw(gUaq_ zjM?oaPxGh=<1rw*P8L8v(%4FDE@ij>1AIF@gkXTtRWnw6S5woBSQ>6L-qac9@$s{w z9oZo#A(skqV?va+@cU{dn@#V`OEFJ}s4G`&Fdybp)U|y4*7<;h@XfbOfY{)Pmg7v3 zc}1{4;`eMx^^}$<@b#IIPjxhPj3-<-h$lZO+F#tZ>-lN`F^og0{+bTu&(k1s)H+T# z-51;anEh?GFV-*#WkiE-s<8WFinP(eX26?E>C*F_33ilNyTWGUuijv52rYb<{m~67 z{~iQrc7kj-Mh&0ZexCYD;fG{}Tpw}i)YlMM0HtP4{BD~$Cdvep6*uQ1qPEU|05v#C zW9bDEy4~!2ivFiSL0uSZ^o96qNN^y2UITip1_N$*WWtOOpn4A-G*rZ>Z{hq*^si6N zf0|CD>M7GILoJroBk{i{`<;X}1<*ut$kG5^kUATQAt?m;Z-@2>Loh%}Bvpc(klwW77S82>yQxeec z{DHQNpFbTR8&XXK+&FMPj-kLuCDv~xA$`RFDm)cx@O0ThXoI9>b*q@9-BcM)w?|tG z-*Y4KHY%zz$(->M-(ELSc?3 zzf2H`aio*;zE7$|$w+As2nZYQ z*6=(A;E-ae^#Ix^E=wi2@f^l+v+*1e(N^2YZJP$7xu@Tej(GUCr0WP$_!2?nYk*#| z?+4=_%h7oQpxhhF=h4aW)9?Um_T?wXPIAU?7ewH@n7I`+WWa?GEp)gCcc&MMksvS) zA^brgnhQb->o!TqpTQj311^;CbC$hw5`5h+6n*k|A~$sMw`U98=?CObJuY(c=Q&kz zvR`j2OE?gQT-D&dl$Uu{_H1HEBR`smi4Gg^YZL5RZaSgc*B~At6MuGwvzX21gg$!Y zLY3kuou<;YV&f;6`)60FISTt$HJm^7DA?E}KJeB8B7+$QWT8CKZ3-Ff^1v`6CPyzd zh!1@Hh#?duR*mN$N8hKHP%1@_-eU9M=-dHr@I7T|Wu%e++L!>@-;3+|bP$u{VdJ5PU4LkhAKUeR|^~?~|dP zdKNW1)|7%@=z{G8F>aKeuK5kqhcS%>8Zn!?~+Prz|vo$T%U=?L^`DcD~c$mVX%cjO>|Gv zfkrWy0$qfS&1Js+%NCtDoJ-uv00MEM7h^kT1bTcmVb%s?9Czh_+c{}Ccb8s!{=~If z#@8CdbhOtatu)b0PKJD>i;&$s+t}%xg?C8Y_U|a58j7*LcyiuYS_18k2?SDXEX9ux zFDEXfpOtO}177ZysvSq>i-k5`KI@++&eCWBaAzC8RyLh_2EvfiI!&uig2!1JUI3{{ zPqegYFz}eY^VF5001w=KL8gaQ!|~=4EA1H!j8cImsHMZA;RJbQ!0Hg+SvmYl60yLU zJ4!MDHTqh@kRcAYgRFnLH`jl7QpDTYr1e3Fqz?4!-dX~0?Qsp>jAC>@5ZYZr&Rx%j zddLW1si0_(f9YUgT_~gi0`j@ryVjGB9~gu7csJPFpn8+_n16q_=lbv>hKnldl2oEM z&AsQCDf>o{Tj=Qi#<5xdih+oWoEVxK?4^F4+R~HmD}xCb;S-3loHfN#DDtIrQjZ_d z_mK7sG7JZR!OJiGb~!H|#;r_OdB!YE?)~Pyw5ffIdY9hD!@5u-#8>ac&IiM zzF6(?lZZe&lpnUs?W9#Fw!?l@IGJ%9Se=R7U%{ihS{th)OauxSGe z(e=|ia!8A{{ECFbphA2bvO18u-4EnEkWz4lfc!Hnd zL!>y9-|IpR+BfusLa5}n9ejP2rT_p+fU6*_BZn!@eCuI$z0-3`0pSYCdbH{q{Bw9Y zP4{H(aES`T?-I*>L0SzrZWi82=OhlGJZmE*4nV|V#-968olwQfX-G*?uQvHL`e zI|q0hv6;Nu*A7uV;~I209WRJIm7QK?d&!h&!mfw&;tnOxQMlqR=-fdF$=Qm)4^F;0 zLO4{LeAHs%>P_L5z~rvttxS0=M64Zh-u6yo5%1k%AXpwiWnyMO<(598{bI86-bSSK zTVw#2O25e#^;CB3OuDyY_2iICtaq&uV^%VG#{zV$VK5S-U*e^B%)JriYuN|N`!G4ZFDSGY!~H@=4U1MwZZQ~Td8sr;gcYtAN9^#m1=3#)gN{5`s4~bgkAtYMpOm7&{xPDWRD?&fgRBAO}$@+!1>p(iG38Fru12Iax^^ z!ee+$CoYcj`-lLK1Ck|03Q*RMi6U6?%Q^@~4NSmD0|Xjj%CU)U(Ul4AQq;Ty74}e6+ot0<%S>A8wxSp<>NEV8--X)e zZ5LhJ5Yc}swxIUm)@l+@QUza-!=zZ8&YmZsH+@hB<_w6$QV}f(9k(|Tf5Alyq~hnL29u7HQ} z-|}1SjC=x_n|#(aQP|YbNFvdOBEMpcM)$LcNFw^aeB8x>>do-X_lT>%`#>TVVcQP3 zBV&PTLelEsaMvFzRYyIq0Q2e6{^Auc_HiL|I&4UhZ|=6?6h)AsBJm&W=k{H(nC-`dkqs6&{QRr+vz` zy)AS`Wcd*nxHQ0VtM2C2YGlNVL0IUDkD#qsG|0^PO9IHoe8e@+U_a&ZnRKHMDrEcw z%q3>8nA4G?=0|W`(?alQNcfa!dRnMbo$he=|5t#M{YkphU9B0N&F#&%h&D2 zdM$UX)OAaZIBsz^LW+Xil9#l3oa^U!XjG91jlG?B`5W zsHapk8H!Q87U6eq!>8nAYK-JxIf7t5FKQ&e{i9_$4R|QdVfMn$_)qRH6tR%DdeMFQ zCjFX7MkoQ?TXpP<2^fL=1wI9Z$(wGr90Eqeje01lB;)a83O08eEac{#9Xd6{ZPDub zEb2FUpo98Pxcm3_(p5mO-c?47^sQCNTM)YDC}j#?ex(7jemCXkL1Q7`>G>X@%+|PW z@?H3O2HyU+1d}L>Y3P|w9x)gj%VDP8o5*cwGMgj-SbjHI7d>=tn-)hQ+%fC(hf8|i zhxbbOu6yo^#;grPkS)^L7^x`joUc z4cBb2DfD0aSC>T9#1XVVN2ZmSVkc9fY;p0D?K{E^wqMf#>)k^>avaN0%J?w0pUm_f zCKvSO1uxtZp0PdwZS!x0?mFCE?lLQeS(OgVk@Bir|5P^c%~WCC1|pcm&901TPb?A? z!dIjj=pAR#WWfmR|BO3*9lF-lb)Mae_0gCQlTqCl;#`R@F_*};1+ZTTSYLj@4qwKE z`SUt456t}Z57cRIR#hdkFi~#Veb-V~SS{APj zMa;rN`_P&Calc_ae9-@?SC)+U_GNB@c+l_0_3Pf2Zxy}ap-j6)h8rJSTRpC#@`Bfa&+=`K zKhum~3aQZ(sza*ZZj}FYD}H#pcNY%cZ}hj8=#kJhHz8l0ClQ{^$P6N4C<#tX{}bMC z81xh4ySQtZqry)MYLN&hm_X_=x?%RUH1mJ*${>t*43v?dVM!BlNiv#ZW``MD7g7{F zb^&Fbwo)Jw{njON#Zm-j%V-*Nnm0GB{nl1P^v!>j9YF^FHJL(btx}y$a`!QjLYjRR zMT(;$4Zu_shPBxFDN;{}_x>;zlo`%LQikgU|MCX&tz6MVb&f0zAjieKi3Y}r%gGkZdc zycN)8j5n1YL3{Dj5PD2=VPRiw-&?eIO7FPJryu}=+zZbU0iA%uX1OK%!!hzQO{t{CnhSthm5&p`s5BlOiRADs9qVp z+@B7@ne~8ia;3XjEHCRFmz4cVrujz$?&#R6N;K3#wXuY{yyzd zojbR214acvBv(D-gJ)?eQm4258wWAX?T0s)bJ59X*rNaKG60GZQ-2tbvd1pAPEeNi zy8}E%wz2YyeNxSBHZEl>BtG+ln(fQ|&*irzLFgzCZ+coMb0E5P>9^U_F2?p|eSEKm2p2T}RC%)KVoX37R$O7h{(>ZkXB#l<&?qhY=) zqDx>c9Sf3(G2WSuPiTvUMVbF;1EkwMPn_(WiIk?iGz_LbkK>`Y-*{Q&)jkd}6>NX* zaPdv!j48*el?ZNVjIcX$d^v-r;Avp<`gau9xuxrU-;?$DiP(7oPHdwM6K}eNz<4DO zugute;JJHZ9ljsO&8;Q;*m8#SG?i9jG#OZG<=-V@%gtBjVG*DAr4I9+!Gs5>t_RObDam_f%JhG0;~7A5IukgcE532GFx%7&GB6m6&P z(G}cd)B9&c^rX?Rp>d6{VLAgEBpOeFkG^7)bsh#;o%su^L~tO zj4&Y>*|+@rFOr<@`~Tt@M0!6oQ8mmDjP+G=I_54O;ojz|NXfxBYP-V)5;-EnCx?2u zZ&s4by0DPUO}@vWJc=J1UhWb5Kx1?L$n%$izS7hG2C^4a(Xtv(X@w}(%g@9{EBC3d zLG${a&7f!xL6q-(^R-Hm_Nq&=uE6LTmh`Tb9Ff>LEr%h_v42(MfK##Ro!hYTNO2n? zLc&~#gMBzrS!OS&vwA_1TnX~{D`oV)ZAtiSO*}$=$7P(w0x?6q>)%yo)@C&OlkQD- zT$h^o$7VpsH0|sx96ik4p5ST#cminmhx zjH@PZjF5;?ES%8-H!_)2DDaP<0n{$`HNWGUH(??Cn%AANI115Vf3c#k^T0S~AE#NX z4x=&d!|3=?hd$Q?HeUlFCYqj)HT}pZvAS9nT;hkLn&SUC2YSMLsJF*CQC9O4=0c4$ z86hc1E^eoBg7cE)Saj*@kFL0lx~Sv5=b0Oe22Zd)(?2(ZqEq!eXK6sa0#Nk|Y z_XG6fBES9XGH!oN`!?C=v)aYGMs)GHBUm(D5f#A{qgL@}g)Ps~ByY3^2#`|hTj%6# z2c_q+k9pJB6;j>w8?B2ZA{^{5(jHkUf`uLaF@s2Q@K^_(!N08OuYNA9n{AgV*JgJV zt#SuVK2&xl6UN9+N*yX>?vrO5Dfn#pPkV@1 zOpS?e4)H9-ye(czArc1dV+q3d^a7a_!W<#ZXlLJ4J*IStR3q2jFrllI0(Ij5 z)*rhzg6B2aLlQ3TXpAy3_Rj;AHUYyYRoy6Rh*R-Cou~lQki@=CwfwSM_k&iE46+E3 zam6JMw;T~+Z@~)1|0zccKrP4>ro3iV+kZFEZ>7pwJiMD%h(cC)Jxoe9`t1vD))`c! zeq)RQ6A&li!^Pp^DrJ%8hF{?aJW2TXVH$`l!E*=3oy+0g`_%7m2q66bi{udLfl$Hm zRHL}N)ji4!n@4x?0y6X1dbzkJE{!dn2Xu1XKD5))d^G@g9*sa-E-pg0d=@AgT6$0v zlzno3^fgs`;H)uBbYTB!SDgu!F-#`EX=QmnrYA*N@R*YHzAR+o$rt{Q@1=3;T?Qy-5j06|^AG$V(drzdCDkg6v ze~yA=9j2KZP+!T~aATweG+_F|8pWg_T@JPvDk|qA%2k*fEolMRlOh-bNo(fg8(Kzxf;l3uQ4I~#eVR!(3QQ#8!K4jsU!C-{D|ip z-=u$_W5j)qPI>oyR57oZ$kn_}uQBC!!~B2zxATM5Zqn;7d$msuhbuj%ml5}hvz>J1 zti0(5#$8MjsIJUT<~9M!kSp9)OV$Nxx;Q$tOudGg+JWvXR7&dpj6|8u&`)jNMCkvv zXqfIWaW&z+o|9nElp`~@mNEs{O_Nsa5n;MMS=a#SRr||1bu9R%b zZOY6&ifW-RqdN`+a2A-xxNcq~={G#onJ#y}re6NDHGoB&KKpoyzo?k2T3SDl&mnSa z2DOk2(p(%5#E-15V_8lUT?=KWObpXd_CD8HR{IOIj<4^+sI&MJnRGP=+EW=;;R}wT zvcU5wPN`1C{~0!=e7eubr)$J=+2W*Mw9ZOsIhIJ#bu^<-lwg^dp2DpDastzp{g{=s$!UlCe#|tG zo%nz?IJ=S4JX7e|`<+v|t}n%&-t#FxPJ^Rq05k1K>y27HuAQIl2{REZ$=$E+tSE_( zXIzzC%;yQdIBL*RK1fuG`7ZW9!$z3mK(|tyqs5Ml_1r79W4PDv8>h(x55#H)25r7ynfFDUozMJ~$P|gbEHd{U2E) zW-(EJFs=>S%JN9@>f<*QC))y0klTJh+mq0s=IAi(mgpmme#v|f=pO2iKkia&ezqed zS0|t9wFjzY*&A}dX36iQ{ldBU%bNUC!}0kG^Ap;C0#i^h3fRA**7hokbv%^N^^2FT zr%H01==o?LCA*_UmxpNCS1arF^EYvSr}lwTFXTGSQSh$buOoT7_Dt-h(Eo%F{^;#c! zUnI4!%si{Oy6a(cddho$*T^dNFV@x(_E=z$8!G4)pGBqgDTOje>@TBDzz!tKQYc0#S8!3$m!bs5b>Ts zl$(1({!3ptrJCRUgZHsDS)#QK3BL(wfM)hFACL%H{n0KgXf57L=`vV_`9#BGm>@-Q zG(O<7qD5-VS6?2-t2D*dX0?9fZ8qD1FKhvX)cpVBtdIyeta3{)W`BV6WbB*7Cdq(8f)7THXd~7QZ@6{4fB3KZ>%CWQwIs{cX(ng#f_yagh2W zd3+oy9PllCMFklR0Dyx3LIL;<@Xw+9;2HP_;;bPr1r&GRUIPFGa1B#&hiukiCmYH8 ztQfr79XsLrprr-%o~0C%GCATYQl!mmk-xT2T!6um6<3^? zm6fl_R5ACh`}d~TrUvgR#0jab^;#;kw}&mchx^wri}R+@el-T`4pU2$UOmPQ{VN}L z9^^gZp7Bf3L~91x*r0^LpWOoRjCxB-dlWA;| zDP1v=lcDWC)f~u>+0b*skpLWtWQBe3yb)*aJijINQ3N-qm{iJGNqZ+-tqcbiKw727 zz85UiL~BFEo4enZ7IKsKRv{z4PNtI1%Yv9TR|^@D+nz}oofG-x4Y8Rf(rF4g9k${P zCY(pF`4+?byV_ctw>nzvRIuVfYyj9BEU_`Gm5L;*z~FVkbWyf9o3=%r^iZ4TH{J-1 zT@p>I@TKFTtHe>1gGaSS3Z@pQMd+RfDXq*@dhue_~dKbxt39Z+Rq2)5`k;DXPShaosMn#_m_x z%X=k&w-te)df$JpiRw$3nFpv&~CKN)WTwxhVDN$}1V0c&aNb`1MTIojuKa z4!ivrz;WiT-W&;<_NrsGHoGcG%st(k#2R^EW%fY<=Py05Li^5d*8b!Rb$t9Xel#YV zF6va0nd&@-gsHER3)rKGRs{+oxrxmz|Z}SkF}kM1a1n;EGo1OGpM%GgFrzrs`mdt1$Dpo(|lfpY_c~+`Rw@k04*EFxb$Z9HW zQ|X#<9`TV`N7KB)QJ`AMe)?Q>rfyjt!oeGieJzy?#t8S>*_v3J?QEqtFPf@jK6&DE z?5NnUiR*Iu4=n@^y~~-Gb)&6)!f{mMVw~5V_M$T@@b}NAVw9grF#h|1Kc+7#jZCY% zz{?$cwSIAHnRVN_dZ#Gy=?Je{JHUVz(#>|SIQG_s~PgLFDE<}wAn|oN1r*p zxKS6Do+c{~e0O&YE7L{)Ohb|dao)l#j5n!FGt1_$kD1h=>V=no)1uOK>m$q52U27~ zH`=#dU3sgJ)S4ZV^J`Z0T7H9yK#Cs+vZ5g3%#>RRF+_8+7$H5^)v#`-9Q*K2s~%UF z{VG~n1?#nJW+r@^4Z1)F>Q-~hYM(?x}MxhN$R`{zkm=aijsDYq;$?7CYjqIVKbvr3U7zT{46R}RXbL`cGn z?3(o=ay%|%CNH>LuCzNoD<&+atoNBoPKRc$D=k2;4fOMy#wufbqTIcks~3g2)i(WH zj!PSyoPhX6X7)v0yCOqNGi-4wsP8b%#QV1V_3i|~+KJwYG&RVrh{S{hIOo9g!^w`9 zI9_?KyN_`omv?UK#)MJv4%DLkan@#CZbADAca&!8j?+41zH?mn2!dXqdo(_7efb9x zfPxXMyN}0TCvHOa^Cld@%GnUy-M|AO<$03(l|mD8%RAaJ^!9ucJz@dSBGY_LYa+P{ChPfs3L>ivt{^+Pxz` zKCX4dalaJjy!x)9Z_MgjC3sf^oe5e(+$mkwyVZ-8{*OCu{*@|M8a|4%w$~Gcb3mrm zRXKz|$gMb*yc=OAULRN&sIgQno+`;MQgKp+9 zt!r08?+(j9KtJDAqWMI85Ophp+z`;1S_3 z>d5fkqe##G#xHT$hBOmnzn9lWSI7X(MJs%K75PRJD>!?`ta;n53I#H7SnM$OwKPIH z9Hkf1j~{XL96T%mdfPj0zRrC4y`aepQ_K+O(Tm3#e~dmJ;XTqQr?f}xr73H>1dnJr z@+~zYJG=Vf7ewQ;u?8iF`Fp{}v$zjRoO$mr{#jrTnbHT19&$zAXpZd2q9&*d(`maRQltgORb@*cc25i(4vpQyk2pW^n~G- zC3)VK_p_Xt%oe}Hiiu{#`bfhpZaOd%RUm`dVDqI<7e0O>M6WAu{}Q@@xjWtzoMMSJ zw8yDd`S6TkYUdz^I4n>L(}XlPN{plVtNQ%y#2YCBukXpd*Sl#EDwDQqEJoz3ke|T@ z%XY6}J7v^lB~+BtaLmC%dg8jfD?Q*YQ zoEOyk$a??~FV<46=i&42akJ^2o&DQfY4NM-%I@2 z6q2@jQJ4Pkz8Xgh!LwV-&sjauj1p6&G#F{2tpexS5orvRl9PgrEfy>HoQ!gP!Z)~e z2Yo*PMF8@dDE`l%4eEgSYl)OsW&-`9mo$DytPv;Ms8>Pw7;1_I+bqO14C#H}U(MZn zF(su=r}g~?REe@km^pxXof*JPe}r^3d}P4ix}|_+14{txL#QUk(AXA~brq~^E~#SG zj|@eMnYg)JoQI^4)Uxg&4wQ_yrpGb!EY$&jCaxHvPq1GsR^BV$&kJ-e?hCZz?^qKK zg>C$LWg(LNl#FfN0)-Ul`>or!=t2trZu5h@Uql9$I&{Yg$1KMGji1YfhrV*d-OwX0 zeYTHw$?Ku9P}#NB7wX?nL+N1nn2lH(lxj<@KI(X+-z}h}G?$JnX8CEFmDEPv<2T3b z7rzN&NRZyJaEb@Elu_}tZjlsS_&A8icZzAXGHtrv6^bzm_Fyx+9ZpFZyQF4Uzp$^% zcrld-Dc?1uXGa#o6t>-$tCecq!Knm0zc^S;Uybt+5tK2WCRW&7t?7!{rz;>$z+$`6 z>7VG%MYg!j3Ms?9Pq5xNk~)dqT&7z z{i6CCU%qw=Lpi4B4)7Ar3En$@mjH-8OtlNimQ9WXLlP4_=kVL^Q-tjkkF*(t{P0IBG=14`!nj9)44N%%--VMPTxr5r12Q)7RXA>_%W* zNHod83T=zy2>jRYw$<){5vm^-1$G{cSqHEW&q$svTwJdB8Jshox7iu;)=^xxlgc^D zEPJJWTkDo~*DRCk>Cz3tIumBsyb9iLvU_Ad%a)x{{AgxMc7lQFB&d<>!GpawxMuN5 zN*eMd`C0Kvs}^sjH)Aat$n#joWoLSoB(#+a%bGG@7LbN-sWtV;c0cYa6$|K?H|clL z|725YK{iW>&%cwA6rM|DUJ@zdDHv8z*JCmgCMFzj;rXzJmMm!HMry{)NUB62?-xS% zha_9Ika_`INvoc_JKh(O&3ZNt8vUa(PZr(~q@{|)KVI+ie5tTPG9RDEQ^1C8XmB5O znOI~eBGYWYF<@&obCCVrzW4#Rp&l-(^2C}uo~$M}%#y?!OUwfUzZ%;jfiW&PN#x-v zUxOG~3^Y~l-A9F;Xpx2$N;%wMhKk?1cSihfwqd0BUFw!t#OX2A8~bS}WZZ`M7VfMn z7;-W$YezdC1}|?c<$h8(uT_#?WiVTL_&!KMpE>hZWcPO#Ik9Td7mqlPV0j&vZ{F=} zo|~PWUkdK}KvB5*{OPRp?|fmAB>)EfW2- zyQ_k?hJHbc-%nE9ZGq%wgN8beu2?!5_Lz75@4TIFxDOd^8&iJCR+5;wT;2W5^`cGO z@&oz&O{L`4IbzuK{*SuSxX3s035-%Sb?G8ro`q~b#Un|SSyjVNyHbs@SJNmm9*E&# zHu~(Ett~GuB-=lQA@4zN&D`C^xomkIs{CWs_5mlkaOx|Lst@H)-BMQa2=~ohD5JSc z9(?g|E?y>;_I)~EgEd_6?)z^Iqk}AlRxRbDmjaH)aaXM9yp7Es0L$=T${@NhGP+-FEhFN53P8Ph`)X zrGuTZDPi9phzb4vOy|d&A;q2Xwyox?6A=|J-;nxQ3mcthVi^9?AgL4&)rQY;;BQms zo6lrYBxa=DKfDMi6^X!BMs3M&stUUoOjUTf38m4En<`M%TWxp+-1E#4PULI|HCbbw zS?~7SdxcrOk*L-qrGoL5jn(E|%0RVhCE3~Cqh*b)4;5=JyHz;QgXoo}Gmnf3D8kE1 zuFVL;u2XTOo1)00IMajP)&}Y!-Ttb8I|WNw9(yFw4qcGPM63E-gQ%=N?~(6IxXHeO z596J?G+n~)>a2#}=G?0<#!@{@?tGtY#Iao+xM`ag+g!jHJrKo~kDA)tpn9F|6z_Hz zG<>29x78@c+3b85$A(kJm0*~ep!O^N$9g9_m~-M1$~sF7)*{TXgbL|g4s8w>_Y5Z^ z)p#!uYHEvvKLU?(e>rA)S?qTi!}WD|pPW?usw58~13+ZgZPxUrwBB9xY2?)b6OhbZ zeWxz^20z`)uW)^~8A8<{Roug4J1Ko@I*t!-V&NGtEM@997OHO?J5GOmh2d7e|1)v5 z>1ChK8+$wJ6yE*K+r@s%Z?^=Js@v(Sz6!nW>2@CF+fh2R-UwL|62rU)^lfo4&2a9Nea&VYIpzJhQGNmge>OrKwq?N$NK( z^G@B*IJEiw?T!OiRCGyti(@!IO3)VN3HvQeZ!b$`@2aR6m^`VaKi7z5aR+; zxRqQ*!SDd{5cQoQoXB-X#LXhBeuI%|T^&YY6YmZ+&+#$=-&l?|_V9ZioC}8rK3QFQ zZ-m9BDUiRh5KgZVskw1H%8nZ!ELPkiq4d9g2>E&+8FND8VB>e*b`Os<&&%!q3{dBV zn1~75uC5ux_OwYKJ;50b0`(!Uyq_8NS zmOq3jeT{Iha3H=>(3D^F6>U~un`7icnp&so@-s~2vnDqhZ#w(2liA5%Cr0-nt{&Ak z-|gJbOK6_va5)Qoo(~etYI=|A>FwRt;Uptm*~kYfg<(%(lKJeNc`9*N9+E)bMY zn(E~YXv23je+q9Hh&zl_(1!W?R4U_HrJHGE78#mz)F+IU9jgV)aufsVD*8lD9C~@j z`yMttLpzytr%KwxG8nJTn_ob$mp(L!|akDyq?V|A(ugM zE#**;K1^X}pvGjAWTL8^|5;zeWS<-EE#J%RRmIybG02R;q5^xPaEh+ia{P|oXMK0Y zb$D&6X;f|cEk&YM)@y=WS|v@0MDKmm-Nnk_fwl{EQNN@!{B2mE)&A{H*PRC!D|-ue z4tZGfuX2bR_x52=gz8Y;4dRRvDMqp-G(r##M_%ie)7r0lErqR3(Kj1p-rQO5d?ysJ zaj6AKX%}d|+VeYDpcAo}Ukg)O!c7t9A7yrx_|dVYpIi0qX_}SAjH?Tj0{M-{(N`KT z*Pxj)8Dofto8>CgaHR)Zr{HzH-Ev_(93@_p0x>?h(LgF%fVINR;*W#K${p z%EFHpqjr<#Q0{A2_g+}E))RgEKK%HYEX{(Jlt^z_l0H`XUHmU;Q{!8&vNP9mlr9+u z9E^2rSN%RH$(C)pCEanT>cw1b&MnY8p^nVe9dU)HG+;iF43(RuyE;vibggfbb)$Q}-|VX_JD36)i4K;C4{l#6`mPXNmb8_%QsF z{e8};io=@>wO~>s&tAoBt|-07u4Pm227Hc%uVF4(ciiP(Em=i_Wv)NU<<0}% zi-NeaZaS;{nJM;UC|IqvW2pu&=ET|aF&h1mBmNa8Qge!@tFvF4F2_+Fn$ViuDCf7a z(pQU4UO2h+2s$Pnh^~vfV?O%@HrbYD|B+`)l%1+H`5U{_x^ulE_2mVftXiCyZVI#! z+kQH^V{_wz5C87PZ-F&ix8VC|<#8;Sh!*St++2H1yTTK(`!y~C)e3duKhN(B>iCsG z6@wh>tv*oO*{IDU4>?#T1Gm*CLUZ(uGacT7?^@=WNnPtz+DF=o$U# zi@Xi>33%h-(4k2Amkqktw>-EwAiO=Ix6ew%2YU`K3;Ryr8V~1iT1#zly=nQf5P`DG z_lYHv0ON<1k~n3Ujhn>FjsxFyFZ8F>?lesODrjSn`NOYgBZ+ZM2CqtStr_eF3zv7Y za(tx?ePDlbnvi(x-F4(p#eA?1+}hmhi<(Sl6`66Z{j7ZmRGl4bt6f%^@L@BxOYcsA za7>q*B4zfg;@rCh@jW{v*rKOnjmg|u*fLMOXK>Qdz7Ht4>#HKjf>Q=xF7w2 zjUYNIwHwos@PnLSDlnkIpfKnbnR`p`XVXG zl|OX%QlqWy6=yl^;ky`?=xXip!I5w>BZ(cpWGg9uiD+O3Zo z?cA?5p*iu5)(s=05U24JCo&B2Tr!v#vhuK4Q8& zkwE^G;jnJz&>dkCcN8fyx#}iSk{xOCV&)?GF_i`YvIEJX;+%ZR_T&MJs!n_Z^MOUc zE4z8wj6sQhgR6iNFEt^r;y2B$+Tn6dY&*Nx7AR zn2m@t3SgR4Ld{u&`7tf&8p|9Up=K^uvr7kOEfZ97dIKQjY683VWu+!w-%pJ1K2ZA? z(*b6Um!Xkn?AX}{*!p6<>~d>@adxu>(3f}U?NWKuyN_ZDz;oVwieKAXd21>cVtbKf zRu`}yG!CM!LZPeX#c!rO_FH#Gi$NG&!#f}jYW%wC3x+OqmCBYz@ZQDYfSZf3VSkl4 zSTGOYqL^N-N_my6KE?Qs0bT(yCVK^SI7cWpN9WUfeu2i1!Us@4#|&$G98-Mw8HVpx z7~hecp~+GW0Uhj76l-fsAe`Qm3zDiKwHpYGdi^vCG0a(AGIF$m&%%e|B{J}itD(n& zv^JZ2&U@;Wv&7axVf|7}spHa4(SV?1(6fT#q|T#u}r>|~NtHAt^9P+ufhfG$cPLLN%vVj`#l$$#K2rjYwf9Xuq0ZxaK~ZXO$P zNkWYJhqv_E0aY`8W3HxdaKZrKQDwy|5a1RsD{?^3u%)f{`ezF| z6Zy+Q{AC_oAxF(5BOHp%K|Y$|Rfvbngw^VfzIzPhQDX>N4ufoSQi#zLfKS4n6zR?U zmI%n(rpz{=|4e$`e}9^|ar8ygxK#xB^y7j`4}5FNO#70WQKoU>&#bKhZ@uL

LAIMUY+#lY1QoEyzh80q&Bqw*?J zR#!PQsVLzg4)8^Hyb3Y^Jgsx~(I{!rRcch4@_ovuX$caB9}%Y;omZ?gRcHV%B*oDp zIQ=}TrWPI8pWy6adFz7DPkU5Anb|-q%IQdfJO;1W`k)7pTB#E4`WH-GPbz9Nv{O<( z-6=QE1?MS*deqkB9H9|ZT$vSJnU_(NQ%;5@3|$v!)w?y!qe zr?PeVr%~YoK|xCpSnNQQPQ+HUj7}_c#X)N2x=Oij+>mkLi= zFW(A*b-FNKmW7<2GIDK^BH0|O1K2G1`8PtA^VArqvN+a93Dzymv|^ECtKql!xxiZ& zVv)op5B!X(TyL;}9lVianIj$@O2SPfgIBc3H-mxHVM=Eh;WD8*rf?@5tZ2_l|EBk) zt*#m-LeMSTVMgUwi4bJ^jy274)e4}2$vUcFLqLAv5{7)w1yDK+-u>~g{oQX^`V#UX zCsA-F2?`T`1xFKt75D@@=g{G;_-4a$wpOWWIcs*sCulKEexFz~|b zkl$P@n)3OP<@Ci|Be#aH1gW6)o{EV36paI)zi0tp_j4PSkZW?thH2v2yF2lH`&HW9 ztp+~$gsnN!>z8$&)~5s*Rk4m=xtg{5zIgsT!`

Dr0GYC zGAf?J6*MLJ3z^dku^Meu^tpiG zP2d;CU`_7RSzh=_B0$~$s`-7ec2{e2qE?N&S*>*FN>nO&V*Eb0t+;Zx_l>qPi5(lg z2r;;pGQ!QwsfY~VXr|rl(AeS*I58%feebHcu=c~spA=axbeB)Gk5$eYznHWr5sz$w zI#31+|477i<)Kaj6Nwf4GyhjX4lE{ZunFl!8y3XpqE7*Ro$5+?a3`$VWC?Sdw7Xf) zm?xO!`oo^x8DV#Cr_W=2WkC~r`XjYlbZqjM*X@%fvg2ECBqpF{tV>e6$qQBG}DpNc1daqV*I zW|*4zg}|6*T>+K#J6xzFLnDpoy}fh=+$EQ20Lv>=@T?Ady}$YhsmitA=B61M=L)*qXKvO#XAe>IYMK6ECqv2K39%=lNFj)k4g6j|v*kW2S2`-={cI_`aL6E#?hP{4fy1F;DpVkZeW?VCIwT<)s= zMuOuG9p?ftPZjYnF>7hEPOgvXO%stnF8okrq(F=5GZy61eJr9sr{c3P=FkRQ;@40F zr71quZq2RcKadVic*2iCUrb=ZABrF}#n*363CRC*+V2GAB!9an(ng2_NG6osP{pcM z{i_228jF3~7tB@SJ$X-lMX3%bv_uc5uP^O}P~ZJC#x86HcOcmTq7LLLG&0S)L^qmT zj~p%t0bh>eAw_Z!6DvdVCSX_opokFG*s~Tp{?-|QN@==%&r{Nu8Ah|z*V20(g%o1c zh48WHu>+d)0@XrPvh0p-T7SS#-6WJ=p1(tUR{U(PFmW2SFx;<1YI^!dvOZK{Y0+Ju zN&irpWhwQkxwVY*L{o$vD7Se^YASs50(y<`;3H}j^bHis06LM9w2-G*d;wVXf5wsk zXJ_#v%RL)3pkN0C;hdjf36dBlf8=Kf!;5W&H{wM~K@u=AhBE}6X1V^1G6)$JIjQ{g zqk7#d6qGN-^Z;^}_~8{?;#$q%Fc9fG1zl5FPxIdyy+T6y0v5BCO-tQc7`!q6=o5|w z!9({%GLa(15Z2D7LQx?Jv!GN!5ML6K*a;%8)x&hmihjEOBCg-Htjt!haCBSJTDDN2sj+0 zo)%Pi+pE6p^!G>jP!FV($Y%HNYq+ojvY(Y$_;J)<;}Tqh1`veU>OJ9eXh#14s5%Vi zlWYj$JHwwY*&&{%Z=vckuHca%B2pJe_chL6-{8Zh)P<;PIf1X6wke`Gkc@^-@N0=c z6&h98`gyTFPrj$Pg@Yh!>Ufkl#lg;fLe^j?CfinII@NhG;136=G-S9Y6faZ07v(C`nb$w%m zI?%q0l5Z4na{6Pk-j9Hu-F+xHxWI4@m6LFupICX6;Q)tHI;Fcqq`N~x zT0lx#5R;CBbc3{Xw<6sfLPP}VZs~52z8n3$@4feV`0MQ1Q+sBZS>MlE12tUq7y8?= zDA4?NOn}|uE*~u&a}5A13HL96awSDW8B(=#BrAPog2n<6GaN5JY<7SN+0(LRgUtf} zT$KWb%N3Env{;mgX&OI+8zWoi;2rRB!!fBV-EhUJv+E^elO+> z+Xu^l#j7fu8it43{_6)ST$=lcp!DWNaX%_c%5DxY1>yAF4qqmsq~GG59LnE;^(q+z z6_84fM7>#n4g_m1uNV>VcTry8gOCDx=npWZ9yKlCm6IES|DC{$KjR}HX7B63#BHi= z4ON(i!I*bH@8Sn5p=blTG~oP1<*<_*s4HIhFCRMJ!GfEW#A~iql0T*3C!=jIaJl`B zD^FeY8(;3__E0xp{N1I`>2^JF&t%v2&YxyBg}>FMI5!uY)^&Xc-}3m2ZNkhK#o$9?<|m(QbQ8cgnn$L?7{hxa4c zlAk`CZ!Oj^i`1MkI!7S6N3Hrv>=a9Nf4yVeG;^(X)nIuI)MuRig#uRpK>ORcmLsQ^ zIak;#HmpHU9plndzIKnijZ4p)dC7_t2xHYDWAZ3s;~wI>06FW}4ubJP^4P7Er6P}^ z^YxD$;+k6+y!6bVES@baz-4IhJe!eM9fz{SVAH(#sM^ilAkz9%=c}40;Y1QR0YP@+ zkMpN(391M6F8IHHm-7dSD%`>Vpms3Ep_23mzm}0B?(=%I&Fw9Z`w?VMwV=IT1e1Tb zv`Es`ss*leW?CGY5)L<++D=SXn!eYJNkl+Gd@nfZHl3{dp^wUt$annf3ERtXt` z>zNG?V#5vT#=-*!Y1#!^9vH3}^osbsd-k(b^=gv2+@{Gd)^HR|Bw_gSXWvI|R^AEDu@}!o zMnwE#)=b?v)`cUNd3GSPi8+zVSI8j|MzOc%C$w^|WJz_CMC`k3Wq35QYKt2Al5 zDwSWqbKq4|d`)rUWmeKg$>-$FdY$zi-P6<%9c%rpAmpv?-efCJOqfG~?}>&M)5+5; zA^o0gRz)il4ktHRjx0P#4TTh(8B!A{AyOfinrp6e>vHwhDznpq9M53z4YX&|n4k6{ zjaGJ@eni2oP!d6_NVy<5GFZm|Ya^aZ8w6D$ap z{u;|c?U247=3DB>gk+mlCRY&WYmi%3o5#t~)13}B4~_3*#vIna5O*k+Au8-vQ6}Fs zRl?k)le~AL|MT#H8jdF|#WRmD>-n|p5g+u?ya52P$`o;g=Vmz!Go+ zr3%Gn<^`)lu?xs$G*hs2ZSz+?KXVM?<$MKEHfxP|GQCYlv11!(9(b2c+dM|;LqDoCI8Q(74ImrS-+ak(TbUoDM)o-xNk{{HO0*pw!0Y} zswC)^eaF()hY-cAeoOdGN|r@M>p@5bf!ifzT7_o(1WmCxhmk}V=c5BE2cAp0R$d1V z9fBLl7ouxX0moPr7|zv{L`M|A0;&QROZC*{F`ab$+ITXHjo>?$4Bb0%j!$tvNF#Qh zTml{%~Dl~wZ&tzN(r<6l%AS$kvq|Zc*u0vw z3yt*ks&k@Y%#5EgqyH0&8%zf!N04_gK1GLuWDE2qb9X3E57dzs_@^6+KL zn1|+CK+}8am3)S<<UU&mwBl3$&rUs(jGL+)@eHRW@f5UIw4VvD}W zGr|RQ4h3lF;KAy|)6J{13?r0k2TVyx|FM2iC9W@7FxO!^?q4Uzono&Mt5<$&KEHoA zOuS>@jBj9XF5BWw89I{ZYcsJFLpOh;IL|q9E-4o@c&_nv5l84E@HKtE9b5YKvY^kq zo63WuKZFm>1>kc8Lb6Vv(8m2y_Jb)$eN_GWW5j)b1;~Q1k9JRxGI8YY1c}_!N&%mw zgk2g})l8l>jgFh7=z4>Dz5WGqNq8SzV1c&3ZULOjrM}ieZ2Xz;gxfzu)9=l-X|e!K zG52@o&Scx83KT;GTpixwISvdy`OR@pR1HyfJ-MK9CVcxQH5uojg&usD!0g4Xm)N7c z`e!PrhiWt9uQIf0O=#57O(B1Ng)nIsQ4dgbwoBojl}Dp={6zIQkOA4eFGp*6-VKJA z`m!lxLdVQ27tk=qZ|KFDVpjnd(lnx0)_?ssLwJK5E}FIX~Op)0z#Nir7URr;oo znF=)b_2RdAL&e?lEUFWbCK#MhYUl=xlPTV+nRn8H3|6VM(mm&>cH$&(;j} zzDj1^+&AgKnVR%lTtXI9q|S%=o9AmGOJSTa9zt8JE*ZKnB*t7pFQYgwfzi~Dgs~1U z)BzH8JR!{51@-EH2_5Pcor{_R3R2We^Kr=3pn}(gGgL`)fA^hTooQJkV{Ug$j~)3F z=~sb3rBxTan!qflwT(Xk7*{VJir?&r_0r9Ay%C}&MMWf(dVPv+!|#r9rvI^_vaqfH zfcA+-Hgk6|c}n4kZ23_2h&om{`?rpBEm))mc&`?#fBK;u;1=o=z~aT&E>!E#Dh#|8U( zHX5&lJt9PYx-X+vVPADOFs`F$#xnY0adb19$f6RmqLlwNko~nXCoJhvxLygpV2o<$ z>kFDXS;QsBZsW|4vQuNvFM#FYZ}noTG2KzF=Rfri_i3C_E5o-uJ1cXAXzNsg-jXFR z;)L5#NQq=k>Sp7n#*a2a@TGy5sHst6iIg(n5D#>QYL)z1C13J)xj=#A;zQ5qS?M40z%Z5J{O6-FX$iP0SOLU8=zb#-dKqjN*gkoI40z&m@pA5CB!C`X<);q7TKZ;{I+fgWAHnv}^q`Xe(p|M znM!*-7K~EzADb+oZAQ>&X}6owUV2wmWWQH3nC?)ew%6$EMw$njYzYyC)L3UnH623` zy%gFC4mp3=Wf% z+-h~}Px|GprT(UabI0&Gd<1sS(RVN7^e76O>zTy!Qw(dR!p|@He`&cbv>Ar>1}rss z(0!; z5MeBYMHUytfx5eN=$|UNwbs&GiwWR-Ru|$XU)Btj@)xL7V9@|nwA>_KrUqd5Xm|aq zNFL$R%VljNO#gxy0Qxg^1LzdN9^%3wVXYjPwm0Q@4K zK1i5oN4$#Rg#A_+OL*6ws)QXbM#62WX#(R#3H5Z7`IW&a8vp#)nwHT$urfMwR7GVf zb;TyoDhK(6zGA*_atzwS_!dGc03S<~Af7LsX?paLO}tJ}YJXnM1J4q`l3B;cQMX<9 z1V72MupM5G|J{-htdfHIU6lyb6^2&m7fOd=I$cV~!fDE78<%l}=zd$tx;pJK?ICn85!fz+ybPDls#WOmHPE{0@zrru9RjB);UVg@eW*VN zfvrM;buv*LZJ%zuf2(LQ9_KTbTmI2DXB^mG>Pb{ zEvh<2I8vT}XnvH*iE%ekC#iq(k7(>@jJ6PZl>wG=t4}YBL*q(u7tBZDGk}q_Zt(B} z>W&1d1iML+m|Am-Q*d%tbs~%S7!@rZFVhjUc!!)+LuqPE+J7ND#e;q;RUYsR)^r93 z)uVI2&`U7NF*>Txl4Lg8`{3D6ygaZBge1ct zMGt+?aav|8+sC0Q(UtKDLfB<9`1qC9tMD-l{%EKBf6mH(mCPkoCHC!p-Tg&ylD~9( z(xMM^I@c&^i>9IZ9tRkV@W8Pj;TuH58p#KBy~qsoBT8SjWp`CpKMO7?W~LdP*Y}CJ z)c<1&F=J9#-kVj-(T^;%eA4HH0seC`km?}_AF_Y0->2J~^psvl!%Tv;sESwZgyeUq zJqETl{ntHxj~J2zlq|q<*W?J3^U`e!OR8bHzV0BLOZR7yCs?WOTUb-V~wP5T^@d1ZEBuBHG-R%x2)3j2x+Q%xyWuimNe6F{!E zm)-m(u?H#@ZV%s|mJIhRrqz?!J+z)f;`ivdsZ^)xT6}cm9RK}E%>D%*06aRoiv^Gj z(<7W(@1_6qlEAl=_FJNZ%FlSq4>gCK z2=%4+Cd_kQ{ z1nHk(e3Ul)^kLLByLsKzt^l%STwfrkqauv`zn$TijGrlU<=oPJ+FB|%U;lK6B02Lg zQ=!N)`yL)i`5hb$f036Bj1dJ3r?vOIDfeuw&Z_B_@YUa#yRT7alTJov;o~;$uRH3fP+oi!spA2Om+h=At!zd*H z;ptO>a83r?@XB9~@mAhn?1dF%hbQXtvFVI7II|YFod2K|e){jM0jl_hRgC31R-?J` zGs&|<=VirTjs{WNbOAVBBRv0EqW8R_nAfwo^QvPT*4b?kA6d5t5lMq~Yci2a3v2jG zJWYN!SAS;%|JXdX;MTYwf}VWqR3p$bpuD`oNOUj9JgN1w%qv5MmFm`Ks3ks}C3|*x zIegq)j*=|d%VCsRVi0Q`Gx=WJ8G2+12UnIr=t@a^@-Y7*gA}q;FIt(*LX%l z+3?4>SQj+na6aZU8x$rCyx!=ePHVk2Y@5_cnUJgsZThk`tMG&JTV34mzvh91jJQqq zCqj(VZ*%F>f8In77#mTio0-fiz3|`$`A-83seNwWMTgi4!8(QI-e4cB4YMB;3sGxV zyxV&;%ObH461 zO|+5(CM~Wr^H`{_5d7A4N9Ml?LB>r+emK;UtT_#8%b?^>Q+qC!2-*j$m9&jUIkq3^ zEJu#ij9#0UxwsMm2@}p%o#SV>^Oj>58SQMyH+!P z%+ANN3Mxpi5l*iCN*;So3ZsiJFT`c$nq+46UVI}++ENea#tjNe9J1(pHJ7kGoiTga z-eGF?X*u@kJ4omE(9CrYwxvFV1mB4#`1Yq35juIKgO{l0yJQ%E7 zKFzWyQQ&_eBhYYaGFUd=6qkO+P=+78QZZe0*c2tj51dV((;aeo|Frv@5%gqHcULSy z(|gfvJcnMj^GAqtvFX4|T}EO->`)?3W*!luo-yI4Md4%wiiHvBY*m9uU4BKE(f>7x zE~q%k`ud&fe9h`1`KaW1h7=*I zMT&88ouF$0Av^#2F?7+}Yij)t!HDD}-WH_+e9OQ~aGTEaXq;AFpxd-cs%;lO|Hf~C zhl_U}WO;R99=cr;!fEoeweH~YqFCkV=ze zhrnr&u!;K7x8vYb_2Azdg)N$MhYyWaqU$7+l@RCSuXwN*LC^ zLsx4xksW+s^{q>*2~W|(B3PnhLZrsu_?4>w#QE17fl)fN;j&z8e$idX2d57SGNP2k zlt1vMWT`~Y`V!#YeT>mP--^6yVluGob8@i`n+>JZL%Nkn+ds`?i6-*gssxm1NUszmRl0%uR!ip4=TpT^T`gs z<2ag<-IE+ffj>qtF_#-MWvA_sYJ3_Qw)%&3?syAQd|usDY{f8cOj=Lg#~;jVsFGCD z7-6l9*O#7oyqmXnR9Q3@m=Oww7kCjlrF8-dbM5@1Lm;(tc>ma}`NfA-%i-f6D>=uR z5d$B~l+5Q|Xm#kKvU~Xj%1TJaVK#i5Z5pr zzUhI({yq2cq-*6M!EeeZY)vPX&DMLar!mCuZfc&(f4EcWH19)%sZ#1H(qZqKh%u$& zwW4xIyV$s;-~BuN1!2g=HT5iV$Rvt^I-a~rrB+ID6KwDfg8*Ql;}t`C-zeRkmdDG; zcqjDHirf`1q=tC>^uXaWJ|Fm-?~`}@6`RS6n0Gn8iUT5knGmgdg{C3UQ8USlr)wW_ zPXIa{*st&ML{dV_1jSGG?OiG`6}iB+MK499%(tuFek!hmJ^5FvFTH*$)TwUOZL2kBX#Y=VuGc#Qj@H6Jz<4$L@|NHH46E zPtGHO8`vF|F52{nz?eZCHVQE2Hy5Jjj+{dHzOhE|C8b|4IM}rhQc!egG@qS z-6B+#VCbDLd_$9o9inSQEC&H)cZThUju8Cpzr)7~jxGCR$G)Bq*q@vI&(28a`c$NBRrqsskzr-eR~!5FHK4-yNQ{<%{0 z#Rz!8-$CL7%LPeAOf6riCL|g}W()uC1435d6^5}MICOdz+|HgyG5QlG#)o|P3uA!I zWf*uje0!Q-eZ%odQUw(?GyDM)`OwVyumk|Vn+yO{n%?Y?1&~pOY62?RcQUB-CFJc$7Xy2+3W<8`=IRVnJNCiLg>FZTypSp1MKJM4#LH~w0REmZq;w82euQ)3m zNUBV{<-3o9{2w0WgAC9$lg9|w9!3$cc#CiOKfsHWG6yOLEf)*Gh(x+q!ASqIDZWy8 zNc+!PzwbbpaNHy)OCOreot_THAQAA+EMUfuYj1d}4njV*rkBI%Xd+En-K-Dp$S9D~ zBKGZCq8$8eMl_iQQqwH$!V>9CAMg38;R*c1bELt@aA?~=C>#g8-HFAzvvc1EkL$lj z3_!}~-&!CdKn@DhHbY2r+#v$1>wj zsMp!2xSL^6Rm4@pmlnG-*(0bCBna~!s@c7XlyrC3N0cA-)`gAt3GPyTc#PyXhYRU@ z-{Da|O5oVQ+W(+VA`n)y8FBr;pn5X#WtiZn#;fOO4cBo>{rC zPr@_){Dn1WaOt3d?J9`m-~LdZSTsGLH`|x`Zg}D{K~*dmk&oR#?ktF04Z`TlY}4fV^Xh5*GvExrcIi3dv?$l`ftrlgDsqT zePkj8erFOk$xgbxrRDs)WIlp0mJ>$9V5kThDT?Ehve5Rw3(_o%XH!)!Z&t@Ify&75 zlf7+RPa52C@`=gaOMvebyz}wfHiFuj_xUv?9k1h0>4B$@-e82_r}+p?J+z11Ed&Yh zWjVP^JMbWe2wA^r(X87B{`w;EllV6&lnF|meF&BROzw0P52C3_52OJj-LA*!& zcm4Op#iQB#GNl1QQf7nG4nC+BQQXTE{o}hFTL!M(MarWby4Wa8ZFzZJIs#+ zpl!_2NqkTr;Xk@XWoRHA{8h=4z!B#ug|IOyRDy;F)G#VH^mzYay)}u!@pnphyJGOS zk@J*nPGPnw0@-YOUXE;1+VV7E{C82vI6NUj;4J!*nRy#nr+%8rFot2-7c3NOPvR8r z68u^Vn898aFv8APTFmSR)F`T$6*{v6A7*p%_S~zU;lMnE`d(l>c8AS8^^s|NEWL#X z%#o1O18oj@j-&oT&Ku%09@HkG+wfl>>5v()Nh}UWF?!IQpV0%Vt$2|63&J3! zX7GZ72Lz2bud0c?fjxcBFtG$jTt!8aFlqA5vlmLSS&MBkR=-cae#?cY;;VkrAj!wN zGBk<90z1Kz{(FC4>$S+Eei;WJ z`4IUE3#%iHPgFvRs2wAS)?B}#UWUxRl-b^W{nFN>QbZN@UpVIt8Od3F5V=E3OF*1FA2V+J~KM=Mt!vKosoto1;JXK ziZ*b#AuAiD30MpIT)l}w+I>Qq_jwu5(koY=^o6>T{0F}}8)SJ7bhc@tLn^q5PG(^Q0pg?aCsY|F~89RLKueX2#t)hGUQ$l)N zR9)5lazSFa0p7vC){piIgbZGy<>bPe6xeAW*Ytz;FP&kSVIsX&ch_8ZG(09aC(+K{ zDnyEaB!JKE0?)Q-15x>h5q(lhR!Vf6J0B(0&zA>&VGmTMYk$}aLUE}zOq7QPKF_r{ z`jQidkDs>+)RD{15LsYn>RD1!EB$O{0e| z-9V?|KVECHFRGjtx1D* zU&)Dz0$?&%pz0_=+HeJ4{{9jV+a^&~=g>GZ0hNlzPuUfVBLvRuz$CR=Fcooc3-r!G zO&HSX7MN#N`UQo&wD*!_H#@cgcbP2P^b0V@Xnz38g;%#7nodqut3uUgQBv=C*?0wWl2sC7ZNJr?QFV ze5wzXUslv&(S}LuQq)jeQ)x2!x9)tOV8(#x>wcO(GT0rXWuNWUh38rAhg?2wbI$eW zm&)Xa%qBoL^8gkHs7}MiQaB|nGO{fsg7U#yehi%?W%ywgALfTW(r^; zr>Q)`yKqMhjf}AHQGCf@TJ`=5ecrgKwEGu-=nOl-Yw#lR4c-m!`WXMVy(gh!Oo2+1 z-uvg~5Y0ve4niEvD_IsH zKDt=;?j9k!PdcrvYOFCQJpv&MDy-H3AZn6 zd{aY%v#^~F-o@5iyU8Lz4{^m4>4t!2p6w{N&;@ z75$|3_R~FIoj2BT&PI>jqaRj`_yWSILl&%N{J8B+d+S#Q{KJemUsc$?>aae_5OB18 zgdIcJlgoH>+!{^B`VHPpfIW0hkk234mA#7W{4!3Zdx*zbRWH@eXBn_8zJ=FB%adw{ zA2EpG#HaY#oVi^2xKPP&-88+AEG>{vUx_s_+G5~yoNbmmvpR+DkYoqHTFl4x2l+=f z-2x{s>QIWBx<$pygIx{>|;B!R-_O)18r++d$fHy0GSZd(`&X!r&eyGy*hG z)Y;}~(0x2@G}dfE;JU6jFk=sieH^_Cd~4w~Z65VTvBsP}I{%s}P&tb_ub)(HD`J)0 zpwXeQI(?)*oiBbuHngpENOkkJXW63vLXCCb1fr?Z<$~its4~mw-xMKo^8#L%v!WvR zFk4)L4wTNa9|^EA;IPx&-HdGFy7Z>4V-Vz&ls?k=oV1V6^pgq)egNK!TO{T0Po!H$ z>&2Is*ae|P=!TJWGxt3o*$_*b96J9vo)(ou=_s6pbGBz1BS=S`B}ARw&$#ki#Er{( zx$|l{+F;<79{+cq)OCif^1QUXNbsr=0Jn*Le~i&1Kw5$nw2`nuPMO@?v;9uvZ3#T@ zdypDofkZ4J5g+A32MXyii`)JUGMSuUvcQ3s$Z1*QO(2jfCT<@rhtXi@z7+a zq)eJTjPj!lFd$8QB;sKtL7jb@L+z^lYt!w{aj}4^|&H&NI2Qi+b397^s=XGxkWVvHJ`oOapaM& zL3nR#A;s4Fw!etJdGhRdjWF5~Rqs&-OE|n&I3R;Y(=|m%s0o`vjA3B%qQPKh-Q)R- z`xqN3kJ#6P6cg)sYn?|lh~kC>F}zcRAk%DQhHqrHCjj#mv1 zYY|beqURj$O>W^cAJjohCx31CW9Cczs?9^mob#uYAAV)<#>&bZDDSG)YrOx^*xWn` z#%>L{i^Ym+wRNKz$izpuT>bqAizkM^7E)KI*vT~jIR^Ugy`|aA4wU{{vlEQMO8F7k=joH+<=oBpnLW$^onEE=1sS#&*~N4?(_OD)mROj8s&d}wagQ{ zE!pT4;y4ra_HXQ?@sv7Jkv|P&g-BvyT7eiooD)KIxMss68Frprsyu=8a?I+l&T2n- zlC$Ea6Wu?o^X*KTcuH7aQldtx$@yiqdPIL96G=LQD*-0V2}25P?(mGwWq1F4@@K!< zj!f2<_<8Q*=Iw>dNXYz9iQ1MA7(E z>&0@`9`Cx5&bcib(HYfOy(>0f=A^yr2hg=mjoE{yxN@-xDA0EE%AzH-Uv!x_M2fdx zU-TM&nNCAs@*xpMgTlShm?7A>yJEvB`4-PLB<%|O>|3@1W2QSQBJhEb zEcw+H4ED+w_#*D*SWYkuA&K_CF?zfzW2)GykIT2;=)cWAf1DyI`2vp%ccG;&6E?y_ zsaXxh1;ag>4xXDLB#$UAljbyzw35iul^L7npT{`3vXexAl178z>7;#I7QWT*|BSbO z73Q}rk$k!O+eVeTOa^iC|RX!rD*Ve*lMc!=;QJ2*LrTV zP#RrU=1B%#vk&C9)DI}?2MZikS)tM#AlqEn^SamXXW{!UEn#69sp*9V9knq<`$HG% z0a}!P`2||}7cm_6?^{5?@Y^p&GRqNT-k6m(wKWL|=hPL>%E<{0djh-e=3#x)uf=$y zz;>=|czt_nS(CN0k+Roh$)9$mFu+bSa;Ras)To5ESJ3Y+Yi*coXQCK5(5j)`<)aGT zcW3fkx-4aPB|ZIYyt^Z#nXW*hall1isk)RTYyBF1&YZOCVVuIGE79S=MV0g~3jxjv zX0uYlU~8n)iP!N)9$M@7|0jH3E{x>aObi$gD2#PQ1Nx*fnrKLKb8MvM^LJIf7njaU zU42d)TGrmNg!TmDT>^vA53Y$yR80H`T4<1s7YBFYfcPoQ=Athb8rD?uv>KilEc*Sa zSK@x=s$3NIdWPKhbh*6Fa!&e14Bk&pXinT9mHY5|UQ6?M<}Z`rk+}i^m!sEPi-XT2 z4q`@Vp5fMd<5^5e(fk(`DMCMG?4%2(MvAR-^cviGp~?mvJiES)Vc2J!-I&z9{V94O_u>KlN9Ti5 zF3L#_(HGk28fnc%r^~u6XOlLjA}lpdwciq*929Stv_f6<^qD$82LU^=H*(I?Q%0N0 z&sVGOEFgVrK?0;&F?>>(zJ$4?gbG;Y`7TT>BrUfW4vD0{`0Jx%nVu>geCti9_R%V> zktad~rqlmCn%tHk{}a^u&0@q}XpArgmtt-2%c6?07OF3=eWi!e>sk8v&6V2AcOork zHnp);;1KepXEN zxH{x?S#u|3p(h!J=C2tm`)6d3V&p*bgu8XScB{YeFY zR$)5njhHQ1XP72St$kDn-aItdLgPN!%L)_euR+CH_tT_@2waJZHRN`cynd<-J*G2V z9}cVAYqf>Ze9duc{&+~F!lA_{omvJPp(Vz~ZA9=l2GqiNcK@5S~rGE9p++#T)+~ zu#LwzvH8gEPx_d}*{WUrY{l>finMFVmtr!_pj_uuuavX3&zmB0pF;u8=}YHKQJ>G8 z5yWE3InRzGBqbMQAH1BJ9WFf_jCglr|0&Qa03k`SLEs+yhhT{(gGN}C(jq{@B$!*> zMvmK5dvT7$;%h=A{X5Vil%Fhg?4tYg_1Dr6$1oY9p%LfPA(T&Z>sT+g&T@w*#rtoq z&n7iTD;`^YY(yJNQlZRbNs?jjD2fEPY5!swZYj|lB-$_Z2G>5B_ptUVU&bF88sgvj zvE4lx|2zFfg>k?U=nJ8L>tW}(Lk}s_&kUU@|_U9Np^xo&VwR>@sFD==h3=$wmP^C^3v+>F9(o7rmOv zC{J|AXpC4P{g(zrbFH<{ufjHY1+>*M+2(`=+CEu(>}?@~s>3~uD^dTA(aEi6JtFif z9gHQh6`p~)QBVP@%Z#8%t(E+1-pHHH6!G)p^BM?OYni;yo&UAghg-fA)?7+C8wH0e zm%s!?`Z`6aZJnAuR;2E{v`W?4EdK?CxObX_p zZ(2{EFDrQ9H4bv|BRXw2iQUbzj$EGLu4$E-OhPORKeevrIct#~TRWYG+B)~gbr6tX z_zRZ2<8KvD4=YcI;H=ugI}*0G*U-Ai`)y;R;CK8$?p2x;!Pz-~)1{v>&VbGy(@*Vj z)vULH^pi|&M$Z&%Yo*XTFjP`X_vE>s5}jen?vT9@Io}K$pV8(4Uh|kX$L^Z=gzCXO zeZy&Q6`XKSN7AuXTWNxe#EWQ&nD)WIr>*c~b+12~=DaP_zrxY%U_cuRbY@M19T*XA z8up{JO=FCx3x1*no%&7h{A%Ieb$k)6=b<0BN9DQap2qxp5{)eyS1B6M<;h7*a9_IT z!tj2@eeHz)hd+6AyKCRGF7>j2BFPW~chJKc-ImbJC*#Xrpo87U1A)QgZ1Klu=M{Is z!37E;J)Xd4kBkRBwe|}dXf%itrk*f!+x?ki=xD068UCVfcRb1%FcFEbBsNehoqVVt zr|g$Q79ecc@I?tHyD?@yW* z)jH&U$5YQbQ%u^?z&-)ZtlwPjZPP_jv=Xel*FAG(Y)PD)st*t)udP(@79e0*?6uw7 zI4NOkf=wFZG6;qt2u-ttwCDYDe>FReVO+h6kkbF@i}R&vZ4AYApgwTsI-KbY!!@0+ zW$3yWC3(r@@XW_?;n@uuezR)8+~@E=f!0heHxo18I|B^ zYQacr<(6ACrnSugKo_h`{imc>dYQf9Nkk&In3+)ThQ-6%*5=BHm=d<7Kf*57&IvV` zq!>8dlWDUxw)`s5goE647Z4dWKkG`-X<}vBVwl{Mkiw8hZTz8y@i5IyXx_B7ysV*? z1hC@wK~t3#mEUoa1W5;fXJpp+(8YT9;I{YIkXOoX?{@Rs`5VE>-ro8(G457T(f+sn z;@o~~Jbx~|@%m%Eit91`qQ)VW+|yn<8l!4-(OZrbojEl`e?;dP;up2)9gu~+Y@TDo zzeV7Lp~Oq-lub=V#i9%l+Y<$$yfGPI+BaQSReTIX(pSdm`%4B-_C<{E&b>{kZszpi z*69|?BXEN*>HEO_42&ujD6&HlN_y-P7`0i{@B>z!y7PQ0i9IVp8HsV~W=`jzPI&Mv z4#T#LL~*jU{7)AQxyEi4{R0)x0j^5hwd?5PDn+&U<(>cWG;29}AEYp;GYK;qG z?D841%{3I5%L}oEr+7q^KcXLRe|O)ekRc)pW8kOxaab1L4CQlEIl=um5=SoR))Tn~ zJ^L=)07(P}Vx9zIba?IvJ-Jk*8IL8a3B%&jQ#d=fk&k`Up?~ny)2YI`7z-1!4Mqsi z{_PO7cPagy%=_CJK3Qif^3%7R8r~8uqoDN81{aEhVbZ=wTD*Pzw(n(Wr@gtyTY}GB zOpGGi-vU%O_zSZItyc%4g>NKMq)w!15R6V(laU@(^rD}OT2b2=1RZfRIt346+UC_N z7UNcgu4b{?hN7)8JL?Bsoy_ zJQ~K`ymt?>ZFynxsx;&a<72?H<#hcpqCKjqpO8M^yV)7DIazWlAi-*a#-6^3-G89t z!vvQ^FgK<|zySKEZ9E7z;5AM^NN9u(VFKPG53||QL*96~aw8R_S9RB#jJln@Nwnn? z&1a9*UKNo-Yt3@z7zDz0FeUtv)}JOUp?_vConm#hW;tLC5YptlRCzTzGuG=2rlRam z(fBO=gx%I-OjY0!^5r*E+*_M(U?5Hfho!~@`YYKBs}~<9lWwjIV|AXWy@%3&1h91^ z`yZwgl&4Dfzt@yzfQO%OxXu1@p0Q-swpqGoAMwPUCAp1-Ux*swZ!Qjg?oGi->SJQa9P;wJl|Aig*1WplBCQrK z;;haX=Dlu!ZsPj2I&ITu)!`%dK0I_Ox=A$pn5WHE@!%SjgS+~{QE9)T8=6m2!1w@d zGnQ;pO|6EoeeLt)g0PUUHoD^l4l!M&)wKBzI)tauNhNgC8-#2A3znvhhNR>ylR4%FfxW* zC$#hB?we^CG{Y-r)!W@fdQXR)@o6CVwsDAOkFO~muODdDStyQ#W?S)3G?i&z_ zVJ6?-Bl_hT5e3LN5885JL?cvTmJ#rd6pcjNG3I>yqn{XvoU*i&YU`bI0v?S*RW6K< zcCI6rczh)UOvy|S8u-;lk86%tz4Ph~R8wr?l%oN1&!gny5HkUizgUsUXVv4b3c-|+ zvRiV|3@?|72UJn##T6vtV;fz5NkN{q>=I~km>4#So-=s`3{p@Ao>;_etQ%e)x^=pF zh(4_6YfFXT_dle-pk=T17ecLF9cUfUs53rPTaa)_fDsK~bcO>pZGqpz#rvAJV=b30U5lrZZoLH$*GXVxWSkulW zqD|w}9ys4I!whfnJwT2G3f6>%r^dd>A^4QX+*Kp+R_yM84=M}Lj?9g#zlRv7gR-9A<=?8&{m zzL5)&;+j72f8wqm=ZP80y^<6;Au*eti~-m$9~rts0t@t4*UoWyrneow-<&I%8U6iM z91yb9{FD0&8IN(67pZ&~RUT*1z8-@~Jxlw+>NqQuBY;KDXlC@SGm65o*ZJ;~;i5wW z(offTi5GT-{!H;xGbX4$&R9tjhe*jcHmc=YIb`JFgl#fqI{hrOqb_bFqX26bE!7KO zPV0;sK;8d8?7d}M9n03R+e{=_@SwqhySsaU1b26LcL^5UHCWI9A-KB*f_rc$xVxXp z+H0S+p65O9A2=8Fp?lP*?%Ab1tE%g+p)$B|*}r&@sK#G%UkvB>9UM7%f^6~zWSTW-YmQA}7(AK(u0@!*RhxxuoJYJrQ z-)r$e45V0c9<{mXe3yJKOBdThD>Nqo$-w}?z?CaFOSD@O9WXb&GO4A?=g1I+kyR$n zu4!fYJ%8htI6+Ge@thCegxd+K%6f|elx3=}^PtWPPG-Evr4knbSsjVlUmMQfPCMUD zxp}}tJUIBsYlv5$g7100ExCP8wz-UUYcB=8JrO*lyb>le8JV>hCh)5a{NdP3TdLZx z@X1li2%4C&_-#qJ_R~G{U-_{PwSP#)KxIA6N>8jqMZ9JG^E z*Nv~MfsJy-cT8+4KF~ce5j>K7ZiJ6e`&Ja}vMd}Ux(XX)8>HYne@soJp#!LDgSAhP zIO14K4tqZ>0wZsKU1Qa1Kqtk6a}t1?6lp))xh7**Sm$S(`kF|}E*vjS^j1M;A6c-_4$X^1R6$JTly1(I$H?m}R)U zIwbF2>@!X5aXH!ABc#DD0P4`ys9m>ZNE5ywRwo&sj_q=4oV_c#21AdRvBb7 zd6wolLj?HNl)V{vE~0i%&?z2mTMvBOuO&-_PcYw)L)7-bOuntw4n#^szVUz@2c}Iu zy0QFVA0xWhqDhv{ZBe6_xliS?m+XHs4c$K@WSov9R1;;a6&XP*+LGU$P5nTAHn}iq z)0=`LZLftQTV}`iVPB!b?p4A-r;t1s5@%FZZN0@WMS1(rK7ZA)1Xxl+ug&lz<3)t5 z;qVyUd1KYK2KGzyZe3Y4ze-|e1;_aknnZh_fRTepY^=}hl}I)D>@$T)Hk;bML_c67 zpDVckE>s@JirQL;TG1bqb7QK1c)gI3fDnQos}TJE1O8L0NdYt#A}*#12MK{_Z0DWwxrS zro7r7%Xd(EpFE!0i|EL_`I3G$5U(i0Ah-pdXR{9nd)aP%g*&^E`YUr#_(3~#kkXO0 zc90r6&Gc`SkWnI*nKZ1c(f_ziO}T%^abahGNI5p?#Y0da-0+Bn)e6r!qX>KO5mPwD zv})vum0IlK@o6iAxp;0EeoavQh7<5Xw#0op0qw2@P2*c+)`V7#x#i!SrK?uuonuIA`(M7l)SRVoyDNu2s@~Y$1s*cE(ye%zE|Q&|(CQ;O_Nh zsUOCo^&f!59&CS_m95S{cNR$N1!u$`bQiSxTn;aGah|k%ZjylywN@<^aRWLneayp~ z^+dWoMF=NbQ!HOZ=29pU@(G6+EWDd%aef=s-DEyj$@lFNpzT;0-d@q`=2Am+0=;$nEo=7b1~=(1S=gg4l)ocVm)p1aDkX z#tb>vm72^48*w>bpyP3QTYIStf3HES$hl6V%8k`5@CiAp@V-e%(@X?x8}|P-C~L)O zZ3zHSu&=^)50em|L;klzOgh{Rd-eGV?7sZ(uxEefb4b|k^YH@o_XRY*zBGS}FgMR3 zyGPH*I~`i+XSL+*)6=cwvjjt@|L`1gnEHGKyPJ`0d*RtEyri z->QF34>y_Mm_um)qxqkb?q3fD=>DhnAK%|mh55fc;O0NK1HkA%xBOcgeon}<`}%L~ zKXTT8LIJ?>AKkwtyZ?rZ{#*NxEcAD{ca-(tpdB_P>h%eWv~E2cY%-xBkC=J#Ym<%)I%l zBL7$S@AGs0O!`{^uHOzKf7S0!0><^H-@t)9OAxhaCRZzD^+i zPRjq$zIMW%uS)uFPW=1)pZ59Oz7zky+jrt~`*!^6JpcjgwCn!Q%^tf>yHDq&AOJZv z6&V1LUp(!&pFTaEb+Qt=TA&!`l_Ut63 zmp9m-0p+;-H6bH10WZO^8%{8-f*kgH#uE}jGzu$7IFXGRV(_xPIJY`7bxnq=={wnZ zy1EUOl4MU?<(l2=_@=uh4VedJ=i=STBE|GXY2o8OWWy5LjwRASH+;is>Yt({aj!Su zd&Dq3qM5FZ(3_5k#viUjy6QNwN^qX_5iydXd~32DS#axagm^HG)VrVB=E2Hcso{b@ z%04=0{A078{)F_fmHf+<&Dt#HfoMJF8AWJ!Q|IS(b{uB{e*-|x+S;N^l46D4Z{Mi zT3LsFgg&~GcT2>sRx2=P5DmL9I=Xs^OpNp=TA=6I65v5?yz`rNIR851K|F)i-e*j} z?1&3_qKe*iQdV)L6LA!zxC+X448i|6eNVT(rWm7Dg)ow{9n;oZy@Fm8IW&TSKOxEp zOBp73-Eqi$zmT#pbMDpJ zdIon3%eeiCdwY<75=OTJq$3!!$|Wr1cWNk9ABmq97fmBF}FzVK~klc6m~I<-Af zVWO=|k&TX-l9>LsjI6jkigY@e;8H>+%6DY;dX;Rj7{TpHi(@Re%wpUE_L1sdP|`PA z(44YBj6Mj_nLsQrO$*hCuWPsqFGptRxACU!DI4sEFaUGW#rE3wRWWT=LXnf7#rXQz zppn;c1qdLa6`%8!*wW?Y&xUW)H@~iny_|Waw9<2|hk_j~c>a|D`)BA?gzt~OBQdJs zNAG)Dj|kv1dC78g?4^Ym_V6zl6N;x!Zr71tH{-mluRw^W-uacHNOPIOgj8Q7I6&dJzF^FU$)_%=PCz%)3wC=i_3mVp$#It!IQ=B6^InLNR6g(lEME(f18+zNxe@RDd?A@=Xb z?A>0&c?G!B+^#I;r#zO8mP2u-^iA*e)vY#sLP6QbPfIG`I_L{gzaL7&^qbM?TG0|R ze0;r!OJb*jda&8>C^$yMprgNf`g=^Sn2Jqwy&`-q;$Sl2NpGfrq-ek(S)cG)3fo;f zOgn+>`b&U@tfuGM9ZD-<*E0WiQ{8U+aZ~gr@D5kGGdCp^#$259$mgtN4y#xu3qgx* zKZ9U3lR>^Dz)ue0!H682eGk~{dCmYVTuytTUIMavg8ad&^SvtloB@MgF;6R&x^5Bs zk{!79AJ!N@_8E?Si&)f4I=AoXxUu}3ge9wt%~M|+<<|Bajjjo}`rRT4KkL_H`ahpL5LrPmpPlv91Q zs8<-*#8`8ewSBRDPk=g}!%Ah{A8>j~XqR%O70Pw4;w%{er!qf>o4R>J ztoel-$O2%m|6|GLYg>`bCn553vF@VwY^^(d$^&SCUXrLzLNPAqprS5&{pl4vvSw7f zIS#wt6N)#Zi^vLBNjx!o_Br_jwBJha`HxTI^>sX#wfZ+_*aquwLs%{RkW3Ix-bF$d z;e;zHR9z7{q5+b~DI`G;z@apj1iVGUKwv5 z$hQW}z!)*z)16Uvw8u9Xsf^TI$Uby$s(jl^W!v+leo*?0Xyh+`p~PCF zSUKolofczwwFC_4Q&8^pQjAJR2*<(qrMp9*u~sAD@p^4_`p1F4GTk<(nI= zcW>1dscJ!%S+~EOR*w_uw@R3X)FX#vneT}wmaCzSeRHB(+$z=I?1%q>Y{Gux7}S2$ z{Jvg|0XSdkxolAYyJI)M@@JLM06bw(ENZS9F?- zOmKZj^C)~n^r@%_VUb;Z+Yxf@%$@ows)4fe4Ht8kl6u!Nmyn*SYcrSZ%PgnNkgDIM z7M4ywB}>XAOz-)gZCA@_eGeSf3F?xb{H1DWB9rT}C~DvAaR?j!aI;NDn?GOV)WJc@ z&dw*=1ke&IEJvM=N>q@itiNIODXc0#{I;xaR4B{7e8!|Lh1VhoIjA*;rF*s^>yl>* zpYE!zCZ5+B`(wFz^`Nkl#N#AGb6=!kI$J02Koz%}W&AO_aL2IL;{sj4W{ueLjVUHK z_w+9Ith;daD0BMsE*I8bCNmQ|lY*$OUv2%<`KJno$;S)fcjMQL6`aK_pKD!xv5&n) ztXoIyI2I30u}1dg6Q>}nA^oW^6QY_2P-T99iZ5zGuB$b$)&hA8s2EE?(+N3M@f^u^ z-|)JqPP~W9H?j4(KbZ@}*M*ap&gC*+HU}qW6LWzT!R>LThjyo+cS0cy&+M(!E#A8I z&=;x+c?dy{;2D_c^}VRi&H3RrUl0lV@wy02Q0SlPIUhD3tBlH`eJEep^&Ve(rWm{h0RZ` zC)2~}P3;)2*`dsQZR2=zTKxX;=v($Ug}XvW?iMS5Q|N(S#)LTd{~Oxn2Gn7NS$s}+j`gkdQ+sXk-3IQ=1DANqlq z+qy56vdy!>bhjQmFmAXms;}fD!;;aKR>$YrE}yC`>&C-1-tKZie?m$ZjediA&)aI* zoYi|Kro5LEzu@p&znI$lhzHM)>>{KQU&kKFswda-W-$?MaGKq{6t6 zZg+O7Ff8(qtXs!rNaq^4%hr8|7S09+fD!Y7%f5V_O|8=U*BhqKrmUB-4Ytw`9YmFi z^vJ)bmR1qJ4_+{coV*q(564B4%7U{S_Oaxlmocl|&-#Xl4)5m#Mf(b^3HSHox0=2JGw`e*GYX$@vZ=o!rdDEHQH_K2X3q&eR6!nao3oGI97To% zm*Lf)~TW5I2HXh+d;f(oABf@E{&OJ)bPZYWF&AS)dkK0kdQsd7J zk@uD{&RK*|K!m9l;{NV_@UpL`s;pqL1Zm{!$84w)Ck9C=I zzsTpN?q+0VBdh1*Ae$(EIWJ3;3w99t4u@PdRpnaw^EUax>NnEu=9Tb|D%RGoJ9t4( zKGdomEPhNxRzCUU;{ufsohvPFk8?~%VfR84xv5hRRyG%KD$!>T!NbIiYcuBP6OOXy zcbCOn3>DOs9?S{ieuKf$?H0$09SyXb89sUFA=!t-o8A?S$>cz#L($e3t2Ms2Um0@hzi?OfyVhYz!%+joxKA^o0PoruI- zKhr`@gCVaVwU3V?@#y+GI-ol2x$2$X;3|u~+>9O2Ub`-hQ%dYinsytvS@889cI7P; z-uvnDbrKdIA1kw4eo7fE0|$P{ij^yQ&hlS75)yn7v3d-d)(A~smys98+$epEgIX?p za&hh=Q;rV=FV8uG`}}@;tc`84;g9}IAp1smkwUdY4SaSLi6_xpeQ)2wCm3wA%;k2r zxp7U#;NFl;tp=Bpocm6vfOBG?LJZaTjD(Vle=O1Ik2cI7;=>g^wQ`Jlpnk>83pwoD zl=_lhiIJ7f>oEv%844$owNy6_B}R}p*nDbp*~%yZG@=%e?i}G?brK9O_k=z>e4bydoI}v?qlm zbiyE)ad1s{-k~-KO$2>bU7M9#g%vzw$d`SO3M9pl9Ke?$T?o_vP(A#-6G*hvy%!h+ zdmXf?rYHf3igwaMgjwlT7xK3iY)H$64VIp-bd#J|e4~U~5FP5f%rS7oQ0qrrQMI)= z2&g5oi!78#k(4$WtM1y?BIBBU9ca21>Bg$W3TpCsYE+?8Pz(cz-1KHijr$dyrYJG| zYo~|bCMX=mpx`gPTXI^cRLTy^zkm(}2}X^J`1jL?2T>wT(~3#Nmm9JYFLw`&@7!UZ zn0#}CGNJ-P70p4wVQ3^l_H}JslsqAh(MNc9$#*(~lEY{;=wo(*GINOScU1uNT07l> z)803ZM7kL7osK`9TUvoURQ9fQVq_z6?^W0Nn-Ic#zzSXi}ChJL_aA@CU zk$ni2VNacSN2WZV`ktlub{4)~DmpkI%R@1f#^iu0qb=f=2k)Xg{&&km;%Ph;9W*#T zzd7Rlo0#C}OP9nAr$ohPj9FX@W#c3H&u5h*R7nZEe{sZ+z)%&dv`~^?yHXJNJ**m+MW?4zBgzria zf~KJDTS}27VnO`#Pjk83<-KYQ&G3XF14T>Stm5?F!ic3pv}%Wf1yhmATG334ddf?+ z)zVYa8$m=&Xzs)sZ<;~UO)3hYu1WnJa^qW)tWN=UG~zae!SV8#z0TTH3&uz3&O;c& zYH3RnrBEeN-S&5DG(f244yc`t9~5rMM()%@ zL`13qmOiPoob@DMw>0$+)Bf%GDD zvUa&*cWe`CT!>VDpweGi7=Tr6WhTYLI9nuI;Q%pv14hXo;UECU2*;Rx4W?xp0*KYh zEoI6)G_a9O2S-}9plLlfSa^Ro%E@w?Z-b|sxq-m-!4yZv&sZV{6oWn@xf9s-N1wZC z%d-4|%KUgVke{5K@ki1YaYV>B(SGolemF6Ss6d3KIC4zUn=|z>*l$J;#Ss8X+=!T} zQ#ebIB0PlZ*V-Quzp{5n2L2*5rX~Z07C>>qyTC+NJ@n;viRwxLJBITYDz={T;55Mcl?xf6Jz&Qq$FZ= zyOiQJZkLk+?$?6xU{-#W+Fk63Siyc4JV1Ai1E_uNhdKyjI`aeN z5Q^N`QIG>jZ*T6)FVcG1sz$bbT&UA`f{*mzX_6&DG#zRRV4On%H-HH4V~5cW1*rJ8 zNlq5XvlQYp4$X?}%G17q{k8!~glA0#4Y)>v%TbDX`9cB=3^kPI0dl|eKRtdNNf3mF z64rWT(`&GkQveWO2h|0r8=|F`{2XM#N8RQrSx|{`C4+9ynl2**DKsUD3@{p@P(ni} zSUCRJ@GHmz-Wz^TSr1g$UF>FpO&1c>&UaB;rQSvRw47#Vjp^Ds=q#d!-k!@1W!~qI zVhuJRdHAs_L*+5*D-YFUym!18>=J=#6B#}r%%Zd3ff6&- zeMDaf_=a|KAsMZe917Tk;O>2S<0@yt-IYDr$qIj?*V2tQ#y;Ir6^(r;C3UZ6BFqFz z;Bz7HaK(T*uW78Zu4Ps|jjrGf>bH6s^?0$2?aMMD>TTuqZoK>kd>w}txHuo>PLo5q zkYkwc{99-mdibHfu@lYTDpVnf><$<28Y5UlecTD&gAd2Y%k*zc-9Den?@WzS#lkUh zES6n6!U#xpQ8(Xt>yE-nfRouHgD7i?bW9g;ON_#8$FWj}R#*4F4NbNfD4%yN)1y5X z^K&=E@%!_cdS-u@zxLZ9V}ZV+DO7I7pT1Em7dt&9>5t6gTL9frE~5zy!d_H`J6rFB z;zF}O&Gx2TaoWLAR<8#-S+w-c=rxt$@M36fKF=xi=~>2Gh*9_KIT><+@TBuA%D0#@ zk0_C9;k!}g&^5iWLdFcQZ{useH`x;7Ns2u{oLLnsuX0-2aQ5w1>=zs5$UnC4-0U+# z6_0FWoBPnAhI*xeXJ;N-}xZ!R>X?m1TyixeXj|RC*G`FC3W8#9~QiX4S|jJxkF4U3^ni$ zzoKLXV-*#{&L<`)ui1>Q$;$&dJTOkk^gz>xbu;=xw=W85=$tOv3vQ&8>sQ*Y?vHO| zLcTdk2jW|@apD4Q+@w%VTn!aB(L%=fDM0!2Y)kltt~{gf);IT|T{CPc%G@ImkYQP97kPfAUOa zwNXGs#kfeeMK3Y1y{&Art2qS)K>Y5_&^ zUs?26UfN!U6YD-_tDYg%;5nt-Gl9TQ*O{usdSvOa;=?@}B~a#b44xY!KhrQ`y5oO{ zT0Zc3hbtQ_qiNkUdiY*Bw56WbDe~9b!X$Xl>{5E$E+Yedl) z<_KKN%*Vv~xaN}cWz?v)-MReT6CN1jw=_}%R)-5mg$kV<5PGgo%fVy589D6*vpME8 zsV=*M)rW=NKDSDVPAg1!O}Qd02^vzyXGs?i)~2@#)9A=;w-dMe+X3h(x|cDsx^eHk z+gBl$U-R*v!9-Pl3$B;Q_gt%HgHZLdw?0mn`*JJSz-zc0>xS32(kpB#q{?b zhOUqy*}QvV=rzfij`n9aW&8<}t|~r`l%*+GDOw(2Gfg=p!g~Kz{5v~g=p~}=k zNCIkf{QZ-;+U1c`w6gB1V$s4Yq}M|Vi7n|~`F9w%D#OXfyyseg=;F+U+Bf#Z4#gFD zWt;C%Fd4fOkxG9WuzGXj)gH~owiS0;H<>0f5r9<(%BS;p<65#VGCC@u+q}LF5+26K zGQ8+V)Z-_pHKtzZ`hO&rPgMXbG)$zh?^)jfYJsDmfLCuq)7`hFs83}ko|XdBocYxG z3hyv)XN*?E+>gu+E-Pn@Ih{&c;W=Lk7rt3+BhMw%mK0lhW#5|R0yvTGYEJexZ!9X3 z+QsciF{C0e)16-Dyo<$Sc)mz^qbTL}qA}W?8qmviFlP#qr`j(ciDH$aqTxDJQs$6< z@BZ19IzWmwJ;4Qg3J;t2&@dAonE6I`QjpM5D10{^H|!^?rgpki!c(LY%-Q^5?}N@2 zQyH`$|1>q1hQEd9L2+az7txpVSPSD(cX2U25x{M(m-h`Ir?B0m2VGyRUS@oMDLXfS zft0O*v*MtmUrla0w8#Ia2uMlyM(-rjLy?1nkc9?}ELU_swm`Aur7U|kR!F!ilp@xr zi&(xN>)l@ZFw&<80eEhrXWEk!gDp7PbZ$4&FG|)hZ|}oL&4IdqGcn8u_JaHl&f*$~ zCUVAf*?Nt);!KUzjMC^Dek#e!P?InPk}7pEc-|#hg}zh7<44t~uf|sV8hPEroiDLO4j_=-x0pL5D*)%}r9Vwv zxzcrFG9pYYrZ&}*UrCQLX=9G2szR)5qk>OkPNz?$NAO6`kX3x0rt%UzK!q`$vaF8RN`CLzVnR{MdRJW*auXScE-?Om})rj2Xf}`3?{+`ihBX?tuoyiU0J%L>f=4W` zZ*^r!xnlI+dD7R5G@@x~?=Yv`EuK~_AwpHx)Q!_ry|pO5dN6|L=|_-xy-@)XJj^zb z@ygS2fIhDd0u^86FK(nd$`o^OYTx~j1p;!fC8itulD#c-p#Y|g z_tRde!g|rgufcQlL-q4ISf2zqrx)x{Vu~#Xen3XgUhviZ!KhVFT(0qC zY8eXH0gbBIc4WmR(PFXf|27aEQo`^aXIqfoMK%^t*yTA9=iL?gM3=GDl@oTT0`zK! za<*l}j(1X=$^w3?qMB#yKYNz1yFGvXqVJrv4JKE7ItfaT-nm%7y>Ov3qX=@Fh}^#K zb%2F{uJgakK5dF!oZ8sS%r67^;fmyx=0pBSX)BQGN>N@M0OwFKJP+B)SYUp*l%gu` z1s>kHx=iG&43|%4;@?mjw2obSj?9*JIAmK90BS*pmG0gX`>f@lR9bI^>zYZzblQ~D zBlFUaimGo4=DWMbarmV6$l;6R(ooqs-X1&FYQy4TkVmPX;h#i)jK;$Knr_F)fb^O1 zbvciLD@onRtAzCwE6i#94i((U`&PQbpBq@+$c<57esBtKlWy%Yrd>|-l~o#4&Uj>N z=D1{8By190qAd6;mmF?NAR~oM|Fxl ziWtGJ`)k+5qxF+w`!e1K^^ka7*3yztGyQlam09zR-9ydKch~ocCDkLc^Rd*l0{tMX zxIUzXZbDAJtXR8?)VF;TWn}MSW$$W!XGQx`fry4iU9-YP_e^}+H}?q`nK%gJds@ST z(NYcx{kf>A5ioUm=|2ZAEY>o+WrW80ns{%?ppm6>X&1fv)|3K;QP}R z!d4{TI@rpnW=_0W++3plPt5qFi=+9ghC}jY?~QgvHbNh2{p4`0-FthEPPA*s1r(KZ&N_(< z0vPczxv*I~;jpNuUxj5&H{lIy13m@QLy_ucuz!BQD|U&Ra%|v(COf)N1Bz5X$0gdl zagsUbKo#Ps^2l+m%u23FIf-{q6gsO~AV26A0a!pJKv=QLUK6p= z0A-E%M_w}2cAus=Yp_9W zqRB;e`ATP;0w+N|XPt0jNisPZK&!?WA;C9C9gTooGr&(5mR0L&BO2>2(XD6)Jp9@( z-so3AFkHidQW9_1C*G{BO+*Lk3uS-R#Pz=(I4*bvqQpXX>c1j^*37DiD)0^5O{Pem4cSDfUz?(sfS*n zG-oMQ$j8yC7V|?E3uaIZ^~{G7{2USilFOggcRP9OA7db8lMm%5hxm5Ha+#EK6V)$H zlZwwz0R*%v4I=9GyTq)@Tx{qd66zZx({T#fy_jl}3_-26;JP6T;Sa>S_8@eXwZU*S z5K*_7dh#b2HG6WJ06z-Y&oTMkKa$Zv00-n3d_XoWQBo8ON)I7V^oy!6u<{3ktbH{9 z1e^atLhwy~9r&^-b11(@>$wE*)Qd{x$1izT0y~IWPbCst5FEEGMkpy#upgRkcM~Hk z5oomm(gto7`AV9u4S^aIxsInGCkUc?CWuUpp``@&0PqZk|2VWCb$`r<{1n*$K|NTt zQ#w#S0^nzj;pbn&86T?vOIiMgath6um}1?$~q>;EQvoO&D@B|RJy@MtdM{jt2xNuj8#bIlP?7V zViCA;99mpMBq(2o4JLEn#;(rpkB-tNIlUuGW(vaTj9pFLX-hk1)MP$DvHUD0(4^qt zt`zB}@`{}e8j$6IV4C<~i%VfD5n@vQ0C|SvtixaqI}p;AZecP}ayuK>DDs{A?G^J4 zRYuZ^!^cl8)>LAu`CO24tVUe#NEcD&7w7wK(I0iVCwLS_ZjU+IF0nPWTvP0~kq{Fj z{glYu>=C*u2htJ&I)$KFh(6)GyfTqr)U^-Y3d`W(6W8u(2+UTVDHIj4`+Xl{{#Bt; zyq-Bo?_iox_p=9yYo` zMJ*FtG70cJ|69}~?h7g$Cb4$}_?aCp26IQS=E{BI3N9M3qn9~f$5HJ9c^%!%OM97r z`z0)enn@R|EhvbAP1D1-bp40i%dK$ZrkMv z%Lny+GyDBZ92-;8Ql?l?9*vNBXf=N-Wl%U-Ng7@>XNUjeo#b8_?rXi0@}{gw?%*&9 z!6lV!3<$fMKSOMzc`@7`)#r)B%Br-xQmJFpSmvW2`FXzlnPLS zA3uf-66SAcvm3;r5gDd;iByqo>bTY3y~3pA5}|5_au6=)bZCZ>-U&=PQelA-;(ME}ilg&{3L!_Qy9aKpsZz@va;N zX+iLQ_py^RHg!yVE~n(@(j}0{7d=6}&C-kvf7>G{dSIHjssS}<%9Nj`!TPdiFHhqx zQR5ye>Rpx$HbTd{;}R}bmIVb-H`z}x^g!SqHu}oD;vWqBrJqMFpvgi=gW)Cor0eMi ztJbyHuC8d`s}EbsFDP?T%zg5Hyh#CapzYG8SAYi2prWS^HQl4QS>-}CZKKcX3v_QY zsBkNF*X1V%0eH)5BO%ExDw&86zPi=kM|c%ZpE5YI{AW1L$=;sl`<&-@F+MGXo6dLI zY+s4EvJz0!Ufh4}*T@qioNGdqzMZd_@qAVJwdLUxoGFAFAMfDc_g&+v;@g$vVc39^ zmDq+O!f2g>gxMoEg0ly52;a?S{86Y;Vgr#`*cj!l&{!B3H2V45ib0Yd^Vn*9c^^;~ zB67E_<*c&N!q|$~mK0O&l`BK9{PDJPa}j) zoO_`@y1IN@`PEhO51dyahP&6*BB%ZBT1jXGJNKNPDTOn9Cp>Acm;=u8pud()Y15qJ z^qn=u#7Zn=8FGOn60oN6{fRiu#b37z7e4CnqSotdYX!L-TlWm|nKN_|kmft1Rg(yt zjK9(+-HeY63>d!m9&mm%zrM_Wg#cZ`NJjK0XDn)FnM=hCnfqy($bN)Jfayc~`HGi3=HjjY6pk=-`=dF|?xtVB7r&x&- zwUE0CoH1qT*s;_6A~Xbn(-wtK(TKuw>GKjuuX|Za;CY>0oYB5I>G`b}-1S2gRQnP? zTl4a@_Vme)W)jO|tVy!er`@C45yIMH23kZADEW8pbTVJM|86yp0gh z12-r7DawA+{ z^A(DFzzzCl7D<1g727E*-`JxweO7eR969zQh;U!W(EjrLT9Eo7(;tB*d1PBYG~dCE z_`(e87MT<$>HWUvX^PjhZpOd!$Fxw|#N{p;=) z)mz4|=niSxN~xLcE99ltW|Z34I8DNXvzHsrM+*Y84;m@Zyivtt;LXsE4CheyRqB|h z15D2)xC>ZY9yy|A5PEu~Rw{4zwcV@lwL;s{_oi7YCU2i$BfON3?gLZEu9M5f?3@c0 zBZq+;{6!97OHK_ciw>S7yvDXn+ChwbAE#66$zKgC+DKUQ7I9PazV=s34)+p&$PW3w#~9f9?eL9JA**g9$Y2FaJ{ploE2JiIWldoX^h6sx|8Afo_F!aX0{ zvh)MRwXya`i@UCPguItuxgy(6|zaN_&O;~Z&p_^3^ zh`~#Cpie_RGE~3rw0vqpyUNm$GqZcsX)PQ0MW;ujAzlYGQ*@}(2eRfCAa=vBsRUsF zkbS3v=NX1Zt_#+@2_E`;HKpeZu4wdkn25ispQ$r%!9Q2F=6s<>b(s&+TjiHUg`JZ2 z9`2N-sze#Wx6|fnbc3?5j!y(|A9nPjO`K9Q_8Z>Zu^{K009EpcJu?Kfrx?GsWGgYFC+^Nx*W%&B=ixJ`EnQ}?oJ+?0A*QnfW&y}y(g zQEQQiH{3Npq5o9b=sDftD`#PFH#Lu8JyKJ(Sr-;WA8A^%_q-#VE~ViT640-hcQs7I z`=oceMU)iM%)_{$^E?>r>SE=S-hJ-6g_Nu(kD`Gte8ef!?G-fRuqK`tZt3u~us68$ zYqyi&FS-iycxRcyzDhy4K{hM)ZHRg6SuP)cxN*IJxu)`ay6|a%&QpmY@MNFyGGI~H zfAltF-?ZNw3vARPa)?kds>};f|I210g|CZH7>{WkxQl`^fMVV0AIp2g>uLo3C)-rX z{H9Xwd=Xz?x}2?ABA?`S`VoEj<%n+f4o|_!d^ztne4zrv{qDz7Z|)>p-jUGv8xt6 zFwqk^%C`*;_0IA_ik0ssR4Ck%n9zr>e2=$BBkI0&X;q{j3kU&D@#LC#0pTZN)tt7t zv!jzNkM3koQBK`II&Uw`6XfTne{*`RmlLbUKhH$ikI>u}M$K2PQyaxhbIiH;P=DyR zFIdQ!{Pp^yZ#&u+A7$%g23#j$pnAF6h|=D@k{x9f)_CDhC7!RJM3RMrgtgi%9eDwc zim&vpdIa^gge^-&Z6TwwfL{iskb4G*#;xXT#qJ$;&XF zp%>VtCeguED+st(_GS$nj?%msb!nN|@rKZ%Uo?cafAC)~Pba$}L-{qm78aC+5X@c3 zILpt1Q>lc=?h;112Q@!@^6Hp~#2a=wdexSYm6{>v zqX6FWRCR_mGZwpyLftkGcYG6FMA72WDB}`%Hzz1h73tOh6I^^834x*tizU4P7X4RGn;p*91;pm2NbpnJH~g zSD>uM@OapXNIbqCdE*EC*q*M&SOf>N;A)@v1qWR}*jWzvyuM+lRYd{Kc#TyYWy7>{ zq{z-gkgDx|am$(V;XcQ_Qjz0f78}FxzqY1p%2xAMW4V;gIyf`Uz^|qgh|2IQ+f{%y zD~%@GE8%up{e7%H3ww;w^onfK^ovq?S-Dfz$f-*lc9d@>SBHQ46s)+XE18HOf-3LPD zV82@zUe@yrD}r8FV7l=gD&|hO5VFxLg+EPtR}t0PP*>K$h@f3!l(y27FWW}N)P=~R zafdub(WWFED!|GR7*s%AKzq->sElV!D7|l^@Oap1WjAz16%5o)t-T%&N%$g$km7;h zv)-P8g^#aGvIPgg$1IFqo6ZD2U0k=L`5tviR`Wz!H+JJPs$&JWH|C$5(`uAI1c||t zPBz8kec9e^JEJTFvgM8s9vK4#XmZt-`VsM=pAAu zuy6Ep?JOG^WZR)#pidR^a<`_m>Z9LH=G+r|yWi!C7XMlN)1AdIlP3BgzS7!NgMdSa^`M2zI>QgXrU z)L5H@&?7{2fiZ#S@eRmky@jW>;)aQ3*VC^+QkV}aJ1p9zdnpRyJY4UP85t)KmGDk# zu9IP)uQ29391BQQns*(pRln{^5nYIq7)tFG^J%o(y<;6FeaI5cJJDZvDSm(c!Hy4g z8-ti<*0E&e@Xo%ji;c27u>V>T{xJ&e4xOQGk76LJVu_zMo5Knz0vtc z;nDM-8qfu}C)^2eaTjn`+V^DF-|krQRwn8*ud#x@D^{+3DTDD36V5(t<#R;W-y7Qg z{9Dlc%HljDT)utoZBVy9$?5Wr4T&uO#vsYT0A%eeu1?JR?I*|>H|W`WDQu5tj7m~W zM)ZfU-Y0WICYBeF>II~F0jXXII~F0jXXII~F z0jXXII~F0jXX?el+HqymV*ycH2F4EX5i;c*T={o5iHG~=^HDmAzoRb4YpV+?`ip`oF1`j1Vu zHo5OrYgCdeKd8R?MEOD2%i&YP@PWRf({2E)!WAiH>rDZ2{HGO+xyW~&80SKbue{}p zG^=V1@T>|QoveS?XxFkfNFHt-Ei8DREs|QEq99jaZQMURrXSs-o_jMJeSgJ|CfZ9D zOCQLY{5o$rw_^t1f;3{p3i(YMf06=Hhblqqa7t;=m9wG99g0t|P&ow1Hu!W^FKL@C zWHKf?*7jB@j<@6ITivc1&d|}BduG@SeulVllS&Fto>XaP)i0vXY3XV{Sf- zhhDN&!N>LvGSbk%7>%{x`7@^Ngf7t6G<{P14W74j;YM0gsK4Lu2XwXQ&4z#Y;W}YK zUR*2~BC|K!{-+5x3Uv5L84<|SiPv$MB&Hk_Z7ra+9|DqG6%VKGtly@4e?l@a<8b(q z$AE8aubp(UzgnX_CS=k~MK;S|_MP6WtoHR`3ip=UZG1bq z%6Ix2Yu60E&XHrkAnr7zUEkT&H?k>zEJ~loZ;)wJIqr*KDJ6h4GZ=RsK5ZK+bOo4W_}jj=YSlL6WvOR5Wdo-iDf zWJ14qC)9y5-=Z{Eb{g6oQ1%E`l)DY92fWU!94cnETRqS+URc<0SUc!7Ibor596rxh z?LN+}2Fw%fG#78S>WUn2KY7aJlehYdEvw^cL}^5vwu+)HyK~t=oKd%QZ9wIldqJ*M5F3^lZ_sWqscNQ`hyzv~iyC=X~co18qWR+BJWQP>a-P zfi=XH%0C}On^Y~Em=@A4Z8|k6r7JB1glV*FtM=a6v5C}uV8B$SDO;9uhnxz|jv?5x z&qdW5GDxy6wWid*Gg4Hg(zFk2KP;IvWxulnfv|nJd+vSS_nznXdw%ad_sPER*5#Ye zHB3t9{`T@aGxg6ONY`CH_~BB|?XPA(uRL?T?q?rW{rc#ajnzNiJ=pM)3jot`+d-jueznDAuzCP}MdRIjJ)#F!={o=(-8SlWp51JQ(t;uo!Z{Gg$PWsk? z?8>p__oJu2FP|8H_vYUXIs@HFVyzE-P?P;ti0l(EtNm)=={c8-6#Do!QQ*` z2enQ-Cu2g8+GSrGlWB({iV`8-uI7Nu z`7p&vzJM$=?~p_hL0UsHRUuFnY-51Jvb&*N6w4bhYzYwU4a zjmgwjJo`=&*X|oZ*tQ@siL3Ievb&|atgO04mAQs0CaHkTRWvIyRU=2WB6CgUD$;^f zJ)C85mc#A|{2w2=f%l=72kuu%5G85*v&C%X_%VboOrd7=y(KT%*9W(=4(B#t7OcNqRche!0&SUxckjbScRHB8D>7Jj`w5j>9 zi6TV8CZC#}O@&Qb4$>H6Lg?a|GNboxDo6ruiX>Fioi=pcNUNqWe;#2VxW-MT6_X64 zF%+bkQZ+yZBbtNT0jtB#Vyt5$XmoM2*CDt$3S^(uwGWaHB-N)-ob;Fpo!1U{me)}M zv&<^d1WJ%miJMqg3n4uL?kN29`iemdr?NqS2G|r!Gn95%bEP(Du$)Pq*68jAok+)X z>+sbGno6TgvB` zVyYn|vzE1jO_W3G&n_qiEg{>IVsLSI-~~O^CX*pZ9!qi#=mmHRm;wF&J)_#(jo7AG z(B87`>+{9*x!nEqc;;jGVFLA-K~aZ8i4Ay7gzwV?>*-Lb44)-XhG}es<<&ZU8Zyda z%MhVp+t)VKRE%G9YFYrRD~=A)8C2V4MQ2o~5VrYze1l{Y({XE)u2gX325YA_*ak&u zay@>h^Sj=1Ns<`GN4uHi5~X%VoFp+4TP4vgdY)u5Un7b&Fi$$K1)2AHJYIC2CWZmm z+^ot94a?+HsG`Oz%f7lgpDcT87(F40o))=I6zk+9=_>lHeU zK=&d#p^JH7@KyqbhaC)92n-0jhOr44B{#skU|r}sxSG_^#mX~`BDx+SmU5n>7&Cc8 z(_n;{K1mCT$tQI^0W(j;R5U3x5n_x^n+%;TnqVe(@gg&~CZp(Fh?_PqYTBHcW*R=W zj8>Cc8w*6gH=OlzbIf!lVv$miQq+`c@{B0CmQP61r0$@JXWAzZR-!sh1_mX&~sI&AO=#IZNPW*FO% zk6E%#)WsAtR^D!f1+ZiKnA?l`aVR3$K{h|dv1~?SsUQi8(Pbp&_8HEdE dTfpP_vu!UT{w0f{i6E(B@x+|IK;Xda{{rsJnd|@n diff --git a/dev-tools/packaging/templates/darwin/icons/winlogbeat.icns b/dev-tools/packaging/templates/darwin/icons/winlogbeat.icns deleted file mode 100644 index 0a586235b28fa2124b62956cc226cfa5af6a8f58..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 72010 zcmeFaXH=72*DiV!LYF305kXNwKtMq{Bo;)aDpe5zA|TSG*N_JRrOJa+qy#J=y-9BY zL`140z4uP&5YkRac;4@QzkU9kamL+owNYIv~LTUvTELeC}$4Fsq_;Q!el5H5_I z(<1}fPRr@=v6{u-iKaotBZeM6u34wt4El-gz zn&aZQ*AcC%Sn|bf`-isN>g|*-wiye%-zxow&lbjkf-G$0#eXzAdU{Q5zgmkCMprGj zKkT$Qk2MpZGAEV{&mW}7y;1YFli0nA32?20A<@HIqmigvY`k-4kzMtLT_5!cO;YZ4 zF+a9T1JDQcI@qv=hXC#y0YA!nUX z&e(Pn{o(Z1%IC3T;dZYi{zu((j~U*LHn3RS2OcnSwK=Uun5#MEM3Le;Ht5PKL~E{` z8`QFi{w_2trScoy;U}?Lz1w_8dn&%Jg7_n`a%@yBaqVtag$mlP<=mdlFt{%Z$~Azz zZG{QOJ#7ezM%T`pVD@BeUMyB=83FqxnVwx-wb&oUeolnx&FsbZSNK4BlCP0xMIbQF z#n|vszB>7Qb=qv=Hga5LuT1+vUA_3P0;}M}tazzwpq}&V`T=iNdQ!Ca2rau~?p_Zw zWVxu!2_@r|>Edz3G|gu8lLU-y!(~>`vQe6stUxYN1Ab-{IaY0xuEme3#9SE9|n^ zpYE?$!I$IH@VhOekFn^2Z+f6uR)AHx-pXUno`8Puhs|CXWS{~u z(}Xod4%a8;54n9AcBW~fXEWwUgwA7=cJVtV<32urS0~v6`@bP(m&?6(nJ_*CGIFt@SH#<2k64!xh1l*tI@?eLh(^W%I4WeSzC{+nt1qoBQhMPxk-mAW6*pwF)+oY&6r$K%+JRAz}z*n2h-z{$|_X`=$Z~g z;-@$3g!X7W57I}!57b(-|*5<(AmAUyAE0O-+ zesS}iDcl8B%kgW;IY7Sba$Kecfh9QQ6UWuoxu(5%8j6%by0xF2Qd5G6!Iw4_5bhGr z`zxJp*=Pf*<(kM00iB63i$UVL{EvqlLckUh-^twcc-<|v{ia!_eAHQoAOPV3(x$hc zx4s18;5I(ZLMI0aXsJ#$X$>&M(L*1I6R)KP1`+R8nVW+2M0HcxyoNpidPDp@Lnx4R zigvl;ZvH}9u{uClSsX3NGE%uCU;qAraUy`o;u=tai;sSpuGUk6a0nG%qv2Lm+Z#Fr zl?n&Em=D-Ie_=G`8;(&G2Vw>^-1(&q|)g2T4Q^zna{)s(UTwGhbqyEkD*r6UEsBwJPo zg?9OTNOS)!p*JcIDyUlhNw-y0F`DNNh|tceta{j90)hLIP+5ezFEVZxX*+##Tal98 z7sLBnruwJ^Nf5nZYj8Ud<&CgplGt$>Yg7m62^Icj=~4|85(k$yP$rqQsGIa`2^FYU zpYk}yL;2YRrHWB`p12NzVb{-6M!*%{$+yXAlBe|C)=&^?E(+EbcSsELP5@JZB-t0l zJ#2C;H@}w~(rx$=>WKvPj4}{n=aOy;b+rt^`$2V1kuZ2G+YFPMu26+`m~QF+2<?dOAC*Lum9C3y`FpGI;gZ>0=k5f)S|VSfFY9{+S|hnLS^GpZ#eC;MkAn zCgQTaY=YhT=DI$5X&Hv!*p0Oi4QbMwMcy-ju7{5{wOL305D((wapMMTl;%CIjO&7_ z(7JQ$-&^KlsG*{C9|}0S9;$(5KSC?d-OS?PMEh%sNAj724On_1 zE==}NsA#}}fm#N~$-c^;U+CHX=-`hI4*m8&cJN0Bf9&ATx$x&~{J+^h;8g)Q)#@ET z#Bm6+>80JaYH!q6Gf!a>j}MB8?hv92)E4c^cNOjthNgXjX7ZLj>UjpH*VH#pxTPu^ zeG2f=m@Rt6Z81&yE)QBR1ZX<)LI$MIe5K$H#>XBNr9H2}U#(h!Dpx=^0< zY%j$NKUKfpYzq{M|11kyzAs2LD^t8c@}Ti!J8o`c@Y-ZLhok?e8>>2pR$)X0gk2^Koic+dmOWu6yKKS=YNk=$M7`;t{?3Vin! z4P8u^RrJO+LjvJ8LsQ$n(#Ry!HKTs;)7r=~Y}sil zP>xuk>)OqwnOH#5gKv(97P;D$S<>ce>mn5&M_c%eL5QDz0=H8vtGJrdzSk3k(Vs(CvJ1ZcWuJ*G>qza~)3a^CwYtJ| zew?3w-9;Q7-i`F5L2Yf>3ILnjVQ2k|#bW_yvmSL26-~fC-KxG~*_TWFswG1FrXz8* z7>KVN2psUx+;%`Cl*c2vI+Np~!)nSM(sfm*dJfhe&GN-3n~>?bSulQryIEMWvasPV zE}FpRHD*|{sp`JHs?fwYTI`h<0K#3Qu+mf3e~V5obBQ&HkBW5nPF`}-?!_w!7id?{ zMP=HR)x0j78PB>rl3IDNKE-2HoWcch?8gew5&ZAP3BX#<s1h)iSD}>EKEV*41H7s z{4Ss6!{rBu*Z4&uKPGs)eZx)w_taNuf^K#OK!iRxS9MM!(JR(9LRM-hS1H7%SjyjZfq|{XG+`iiwTgzDfzN zI@=7sZs^B?!d%=|#kOBk`-$-(_=u-Z z;XM4$k#9eI*UZa?bqWT&r5sW!XDX?hEJR^@`>T5qvjS^H{JB_kDm!WzyE&Aw4!1<{lra)iaTv7QY=FbZx+>?1Ir9?P z^HN6vZ$uwRX{*v5+tWmp>GxscdEk;uHPMcH?5>6~ksQ(C0+|&}E5-XsZZNeRBvT$x z@fnp@(qjG1r+4&FEyF^rW54b+pO*x?J@eK(*!{Vzx1*>|+9HPvHGhJzc)$YNYg%55 zs9Dp=lZsOZ0xXFHM>#I!ca!>=-E1+wTAzN%rzO+Z|BNVxMp5l2{^k(OL)~oatk|Q? zK>wJccw8T=N5_~+hFjZtI^6PKW;P17&*u@Y^E7VZ7NgE>M{5yJ|E7F94q3f-e*77x zISdK%+WHXP$=WtO-iZ}hybA9%5e%6B-J9hjckXC}X+@~?Pt8+Yz117CX47Y>jd1iR zbFZnon$Z{*La(w9MvK*PC_n_yr^BRw$`SlcvT(`^Lby11mI`FaUQs58Tr*jWGu#$_ z@3Th4jF#xkM~+nddX>E9bax!$Z=hIQq4E~<@H;8C`Gq54b-QP7Y|zc##iW|qIQ%fM zBl1gHV^pO;6FUTR_f#_i`33Ba3~yF*A*SKU!yqb_2+-DBrC;uIH|^wK<(~0uAxIuN=%QW^v58pDqF|(kzsDVgSIlP@jYPS z%`CPB-{n&vecQ+>U~g>7~kah|=kcn>Zg+bPlY zNxE%|1nx=M1@T+{uVL)>R2*KzUQOH*jDYTNjJ6U7J(ZedOvEz>{l?lKd0uvS*Sa@$ zJ)mQ?89s$n*xhvVvQX!x3uY5^zJr+klsMM*tIiHqGxM@d{HgzXYU1)}3X$-|jCjSh zYUcft)r;D}SsdH^qDE9vAnF$P=P?c3=XrwMW^~|?TpUWXpx)0D@(DZqX7s=Sz_5R> z9$M*EB%S=)6Qt82;AZYl!OqMD>o(FiH`5lrK)A~fH14I~k;vd0|FgXVB2=I}ny5>T z4z>AQ3~a`sAS-X*VKM45MnLjWudloH=DBG_+=I)r10Z3VzyW4Megu+x;ODYHZd9w# z_(PgN3sE!3W@;`8f^O1mqOBBF5|9h3_Q?R^BB#iGiVL7a@LlCRo^Tw&e95^Cf`TcRQ)q$8i7zH#3vj}63GPZZzFPgSV>+I7vwo${7})y zYOLw|a-@t{5W`{UHtSLE^7BY#2+0eOx{T=TyU}k*a%3EZ1imYoN)q|*448v*&Pnk` z;g)OeN|*4FBEy%uk(X`-*b)}tmlbV$J~9>ggTS|Vc&k7Y3s3t5*=`EfAM+ynRpuEB zKJPDoXN|b>nBfgZ5jY%-E~5ApWK`MY6HhM)0y3^w!pNxe z;y4>{y;Scq8CB8}1A*@LRuMABu-%0M^u5~6E>k>joJ? z-!aew9mx@A|2*iA>cD@D;c$oi*++kn;SZ?(IVS#`u>Z&S47{YIV@QgH2vsv1{aIab z){PUSn+2Ol)nUev1!#Kz$o}%x9FqTLfp{+>Ttk;63?=!FVHR+*7nU~6pPFC@Y@IEP zp{Z&%7m6?N0P#IcGvTE4&eU;>wts5X%#m;(k=VKUrnCJEDb@Q0HJF#AP7a=>)-2~s zSH7N(mH4(x@))(!gnq7Qy|yTPp{BTEF?j9 z5kU^ty`sR3USz6ciS#mQlnMw^XeV~Kf<$4E>Hv{^*E|rEL?qHGc~Qwe@Dh|{eM^@=j5unLp@JkaiOuv`gtC58Heq4&7S-BBavi#gs=LNK>9 zHB-YgP;)TCp(InC*Ma2CQ-MRmYc1S0PhI?dtVL`hc7tk5=c9!RQ_r<@Uf(ZUCVQPa9oFMQs8bfDsM}A=QJVGEh zC4q{>T*-#Iv!MFMzDv@X^(qXVpaM;Eh*YaBTe>U*>-%HA*(EH`fU=OEf zJ5ML%JskMR9WnYuxxFtwG|;OZq$IonTKRs4PQkN057M1150#JM>B9T;vB(6H0!Ei~ zIh!+$HrvKjfhT3!nZ9ts#FEhRf%^BE4-DIiL0{}TKL9@uvQL8`X9^3AchSUG=*aEa zFc8Yp7p<7Qx0@KV`&5bw#KBWx-Nr;o-xqp-)I=e%0n2ksydwu??*ZLacllF(;_!9Z zCwV63YM^PJfnQ2V9_`+0sC_Gk7?eJ}IM1x6`-8-l;!oZYk{bJaDH1f$Sr(wU-qd6Nq81CCX6+8 ztlUPN6&-mV&_6la83kz-sH@Ak;z5d&YJh!41AH)C?nJ8q`W!3V!*B@P z%WEXIR0RYcVzN(BNOBw^jPCLkUZ4Wm3F<13)XypPUUpw8e+3R)@(aWeGW@;EU?;E< z4zB@HEXSx*K*zVtzhLLU@Ep{92TTfPTG=WHXteCt5Q9sQw}H-|pt%Zm;6E;a;x z`U>5Vd2pX`n&L%WdgJK}11gAs1Fjjj(g-0x2hsMdQuxal#Yo zJ)1FTEQu`h1iUGE5F4aVSeq^%-`{>U-eibPUTn|R{xKy;1Y zOX*G|#3#+Z0|#z#_-uWEd+!vkz~$liIzOZW(VrAji5b@$E66=m?L;>#T)w ztCH2Vv-4{m@C4PrZCq9dtRLS1(sV(ZlFh_5?Xi=juuf}#i5&dsu z_TYnXJLnlKjyy=H9m3{E@qWQ*XBl?OU4i?d!)y=TobT3R9WHbUl5u79_cK1jv(Sm_ zh+rIcJMn!oW}wkG-*>H%#%=?nPa14+J?3Yq2Ww~$c9Vkx-7)UlOOY#tn8l3~=0nvs zT60(>1By1_IQOK^X!>^MR9}+^8GG|K%A;t>(0PVEcWSh7qrIKRcg-ecn|C%d6zUm_h_;qB3<)X zX$*lCbFbLR?LMY7$83R!A0YGy800G&rNP&Gy(J3JAD4PnnkDDzoqP3YjOMFRs@a(v z%LWr(srwCnaK-U@gE!3_;kA=SJ#~CJXq_DgQ*fXL!`No`jihpWzLk^56o)rI(729v zb_=9vSYQZM9L5rKc-;G%lBR2lvP#uk%}Xk>eQN9&1631NQ(r51*}!GZ<_sK6*U7Yf z_#A@_yGT{j;{n(Tck`HRS47UtdmPDR)`nuvLrd{LjH10KrRYgaO;n>qj;UR#;rP2d8X1L2e zc9=n-IaYafwgztC25)f6!kv0hM06l@!|K>ZIj^lx(SvGjScFQBwewWV@`ob+3z)H+ zxjzYPwkA83!OOS5&i;%&`LmX7Dl(~jOcYB=PH{UjH5TfL|+5X#S`hY1AzPwC#+Uz}VXWrgp zhCT1o)$k`>)F)3rJuRM|>TdVa&D&?L6BAHE)x}-gL5;b8wJV+uPVilscAHvn&)F6V-uG=JtD zr6F$!D%@ipH~e8xcT23c2>9Dwn;~s`^B(dR0P21zzkCDer0<`-4xD7S@ux?fn5=q4 z4;7lqWu=lAdKAw@_4H=)&Kbbw#q#qrK;+93Rq#ZFv#A6)joqa$6i8;zZwm%w&UPNK z1xh!%SF#1(`uacsOd?zShjTVYH{VGOe<=T3n# z!UIYC;!@B}VCwUOf)=NJ$sascX~vhlYL_P;hFc>8Zc9Eyue15i7%iX7z0{LG$+JCH zrZA-NrhR`aox8xO<$?yZMf)xP)g0=YN00}+R-0;jWvx7QUkTQ0y&`y-a%6z_u4IP9dY>2I#{8iC53lB2sgmdEN^ z4~?^zHx~GALcMCFJpVs6RE!5eo*7q;z_(a_4$<{E$DHq3Cye}E$0rma*?i6 z%X$KxyBuQb^Tmv?sT^Uu@Kx?R9@yf^*sJ3fNlsUr#yZWMO81{Iyj+#a(gBLYM=CWu z{!X9H5$0nIUwgQDK00}8_Or0v`<^oYrxhxdx7{4_2sZ&g=^`#uzAu~bnXTE!^RZ*) zy|J!@ANRTp$4uT{a#|0b&IkTh0W3@4IRV|nC)Mj_E>3>lgKaQhUdgFTq7SrbT^oY& z>;EckcG@pHPP~1l=#CD!@GXSC$X*bj8ko3f62}IWed+)X0qob`T+*Ny~ z{fIjce$D)l4{-+IQ?_b54*E`;7l~pEWKJ!%VxW2w)OX9A9!0A&So{JgzGf#R1vU@L zw103N7)&c==LHou=#`0|3AFDXqCfV3)MGTksEq5lf|Uz>&+1H;cGGCqKe{=8HR|%# zkkpKZteb;Z3+Bk3ZnHEK*tP-CocsAeb zv0*A##0RyqINJ z&8cBb!Y$f1PbT!=JX5oCHkNv$geA3TV1}^Wp0f2R9I8z%5UpB;ZoClR>ZCH@X%;Jq zXVz(M3D{rb6q{j$D@cu@t(x}cDl>AXKKWw1KKyq19kG4BKbBYYM84D29Vrst){o;# zhh#aSHo70~DY@X*Z$?bYNS+Se4_3hq;%ZBg>v6cQ7hTf4tO_Z%MY{bGLvE`-KPQNW z6{H&H*m~xbe~i%jwcyt(G>`Kw9!A^m|9)402T-O3ky0H16@(tgwAJl#Oh7H=u)^x! z4&BRF0D!vo|K-qylA1xuhi}`L&aZa|)jd|d5|qZ= z|8@^Mml~SaE>qSr?Yoxjt1J;kH}P8Tcp}mM!%TOd+V#Z;f?r>aL=QIv-ZK|dk=vs> zt%+}T?vFRq@_Jp_eq}{w>yAujMZz0z)c5kgl8Dpsi67jCObvAN zwRaFdQ>E*8Fr^iDrJweyV}Z#esC}xS75)~`Kc+M87p8LNO4XO0zH>4|R&TdP*-iFl z*lT`XY(lQ}oeBnZBRwxVtYfuX#OMpO6HS}rPy5Z^+pX^t_GEj%(YRb)$w)v7at1<# z0V$U#i9D7}?s4y+j!C=5Pt1YmH@Hv`X*b~y&l-l8m1P-Jf-I>)`nb5_eof6tp$0lA zo4IJ{xrv9MzjbM16^v;TozIE2(+Rm3mJP|&H0xTylgwJe3%!Z<5&JN9 z7+au{D8^gQ=K53pllEF&{Md;7zkm@)sFJArg%@iaC*Ot)-Kc=EbJ6o$8_^C^67{}b z^=2YnLxbVBd`AA&1%a0AU3BU@f#U)X!X3pW;+*x;2aMzf9?G5)pMD9qcJ7P+iG)l0 ztJ|lB@a!;bFTF6m>TLhSJoxhdU!mxl*Z8!}$=arXO@WU(6ZXM=?~FaDHt)))|CdijrUL8uWLMa{|CJlZWeO~BpXIWpVwbrs z$Ut@R+rZz~q45$`h7KC>Qv#*C%~v&sA7a(*jBI;L+kaUxA&LyB)q>BRgMwiw!z|u2 z(swku&z)(l>8f=_t914FhnU|m+Z`#NSHP}pDcG4>&#k%cmcWtY%zJBS|J3;x6Gx;V zavt`7K^^6vN02kw&9OFZ(ERC z?y8k%5a_!3velBzW!Lx{0~~PYL9XnvvW)C7n6ns+xqu@ynVD5(Ksc zUs!)yG|xKQ(1V}e=X(uV*?FfUDdB_X8N5Bj~0iwTU7Dn^J#PGJ`~`#qKJD+@;}qb8 z8S_UnVRNc(|Aoi;7St|TNf!79$r&2Bn;yGn#=jg9U+qnyR~RrHqu#2X9<(U$4{AV< zxvsMMxfm2|ezYNxD^k_|-oM$S-y`6+?quM;)#s(s7P*mVbS~B5CD}Z4)h5I??iaBd z80<$j6Y8p)v+8`GWZ2ZQU zZGG=={P_OwW#TR|ssXC}v(xe_2oz`_(jg%4_0wDzuZxRpR+{c{I54u9yLh-M3eOjScNoATGhJ<%*T!6B`AR$A}cQ73t+4>6-_UaekbdRwL@@*G+e7+#9{ppN;+^@~Y zX#AwQgsD9mx{SmuRj<9vNwSm+%_jWp)^A$Is8ARw{h$p)`(AXf#X1a)`HIAA57gJU zw=Kzjex`@jM8V)smhFkZqh)H>EjQ!{@hYwZ^<-ijN(4M5x6(3=2L;$xF`_$W`DsEt z*I;Y?=%^%uK;#8q^~tFOG7?NEfY-u}oQRp2x0Nvbz)n9aT3}-1O&~C_3}Y-GsrI*a zoI`#c-y+_`{Z1`_4zpULHdQn#{D2`t?p873Hu}Q~!QqO&UurGJ=m-FAxop z3%e>$3PO|G8waB}T$-=~hSu3c9M)*m*^jGBl5i0e$O`vvYv1TWN6GDATL)HM!_XBV zvbAy|K6xPnVaW`=UGDC;P>JLFMmsvqdg4Tjo5>ex?(-iGLbnDLyK$=;0-u`s?F-q9 zD^C`!8@h>z+$00ubMBY*Kc5CT+CH1(Y1HD8_)^qu z1V2FGeow7Lw+N&Lh<4W3Mp`DslC958aNW6AhKS=p9`x*KEvbMmTmcdS#{DG=d}{Z; z+2LTl4LpfAC|15plkE)uoUkSPYO~pC8VMpC@YhMbCQufGH#nthA<7^$D@_)@h)8eS3e^S76=cQg~Y#Z#j3rVgTkGRlKxD^~-NghpSJl zye6+#ng(K8iyl&h+tqM-)xX?QpFhd&l!SX%?c{6Z*9(7H@Vtt6azXj+;mp732nNLZ zNtxZ<%h#zTd{b(1+OdPVV5m?9V-PtN6JoWfKBUa!bO9w?XnAQpW|3{IbSMd&TGHD1^a{$Ck)!yk{!95gpQg8Q@2LY5S(VrG((@s_e4Br}JPRv5 zekcslar|ZdpjU1`6U6Jl0jnDKZp(KKmnZkNgoa?^*IAi0e?o|?$Yw^F$t{a)f-ll< zl@+I!b(NbBXs;no3{PV@h<86X#@$cKlpu4x3hyEksAVA4GNovnMy=k7#RBhT1T|iL zw-e`vLrlP$yLhm!4Lx?dp5*4Q+2py#FHWH0Q}6hkw3Kb^Lw{gz!TU}1dSG=k<1HGe z$EC|mi=4@AyF;KoxV2wyUcMEJCQ&Sz^}D;&O7R)iPRv?c8L})k+T>PJ`5>1MIDwpJ z^N`4RaBhShb64qFF({Cl&a*RDze$f!0MCEyA4OIc8~xtyJ3BjXr=U`u`aj=-nt-eE#`l6?7_B9KtGGa;6pQKcel z-Y+lLFhs$v1@JrP!OqaeG4C^|1)quUhXazj08;lca338lsGcmbEFQDDRI-=b711i( ziJKdrgKJh#};Q}VI!dVDV~)hRkR;!vqq*ar;cI#vrRx0)o|o~YQFeKSs_ zTK|2Ohz#phT!nXB+5=HEY)=|Cm^5XPo*P&r%)27VBqR(}ZT0D_rbW}_6Q_}oRl?29{fiPuH)swL1PR4lr&3wwT3*?ON(-;{yPz@T$@PKU^@1f&SDq8kZI5#2=hmUDAzOviu}1VGUo4`? zM`Lt@0a&ZDduILVz}$YO+`U^fl(PFcE*9S3Yl5AwlM!!$P>u`$@ex&iX~#y@%Y7v0 z0`l$8i2*P`wqNz~W$EG)QZ|~TEZvW!GUp3sEY5d$&A9*Z#Lv;>JH7kRRJ&xX{B7z& zpfnn?zsr`r7ajarjj}-Hk>zhC3)^gULmh6)E8vXGlF|%=U7u(D`els8ThQ=}W5fAdMnHAECFALS+_%Rid8pXE+2H z9`ru(S`zUN-s$!zSv}7XH`FERHFmZ?$4~AbeghTsL|n4?Bv&JVdeq6(K{BM&Jfi7W z-#eXweH7~ZU2fhn&h-_h=@lQb$+jh^a3SEFYQda)lw z-df4Wn9^OM_(yIcg--J~CPy$${HK4WQyyu|_}l%dnRnN+6Yi0APM2M5ZT+G_?U=8S zuG#XBEX%&@QuGf90kGj`9Ww7lcl8aH&Uh2yh}JzNjD$z8wSnwX3g#v1vpU2;-*+Z0x;Ky5y^zv!vXmP9;NCz^{O zBjP#mJNe!2S6duiQWTZZE1!36D9aOTs&(X!R_+8UX2({gx1?Eb#<&*i7SWSU8#<8- z8n4^auxR_;_y9T2KsFllMw--9?fUUJf`QyAfzlh?Hb8rO2QHT0VhgfVK-)q&Q|;KC zB?GUTdy5{9QL`AOpr_H{+@-YHvd{(W@2Hn`YNq%|-Ca3R8A5ZUH@o9ri(`@@n5^cj zwclbX7zSokzFe*h-)PCNC(MZ031ChDC3ro^aVmR)I>vys9S@hvJOu<(E%i((*e1PQ zh4h8gJ&-SV26w3Mc#P^TK48VkM@tenaGU1TQ4xi4Ichr7BXrj1*=WHY>D?uVT`qzQ zdU3`B_3)3r>oKSOc8hO}^O4~5qs*fe@-xz85Et|(f9h$^h~*V59U>aS5G+x>R60(m z&19t_>O^4{hvPXa)Ha;}&ZH>Zh_n9=4MiXW7q2x|M|>@zd+Dtf+1?E$ zyT8`1+o=-jLwu(?1%w!Y>?&`&`L~LKWMdTU&PK&DDVd~<&rtNniO81YZB6w$M+K$t zi2Nj@O?Eg*#Qc76R5Kq{{%`+N6z!lMfU_?|Jkc5P2Bffvpm=qrOd@iYsqtuk$RWJ$ zTFUzjRZ~TnjOUW4U&X^~M(fK% z|7McbkM^vSTT=#}X3te^IL7vpj~pscm+-`~!1>q>Z?Y+@A46ndYhB8zP?B&D#W=qm z=^wi~vhw+d_&;6yYx zXc}i>WAEoHQnnN=_?`CN_fZ;vj%6)EG~OQiP2))DWp??}D{>daN;N5a;yywnzZQ>j zE*NS3Py(1gJ74oLHtf_3vgNVyR-&?IF);-VAd0cd)8}exxtAHOi36YCjfJ;RjZOYFDF{z$V&E^#1*N{aY>)a&c?#cw0`}R)wfDa!1d1(t2eu@9j$!~lQ?t6 z4L|I7OhFT6gwS1(fv4{*3w5CLz1?;0qlenRL;d=(ozY=+mON+OY$(UO&fOoQV1VxQ z$uUMR&n#v=9?IgZ+ao^tEDa*JPf)C3A`w&#!!J^&)c9))Q=$BfeHx_2ww)+Hrr9H` zsGx(S%9O*-_V1v?89!m)Ic-qj+u4lR$Ff@EH;*P1LK9~f57_hm1Rs7ObpnKctG(Nv z0tQGSAiFD78F!DKwhRiYBJR{5P_9&Lx9PtQ&v_KvtepcsCynji%p=j9$Q~4khE_`$ zV$CU%dG4@hf;>Xhjnr&T$yLuOrGi$J9Pgpmtbp=YVJ=%XCcY(mNi_8O>HV##m9gk{ zEiP-ug;&Rq#9bvhWOM-Q(I8ep2BU}4&H?lWv;KjdW3F8k?@5h8M$O;@FS%KF22{>> z&XKgfl}x%xFtNEKpZ7>&5!dG%3s1U6?g3I|{)Lnq0At-J5(||1Apqi!|jg(f9sCIe!%Vk3#<__{f0%Sn$!F{R0scwETm? zN5|10i1-5$|8>fe4vs%w#F3No2O|DJ#J_xY@`pcO#2+u>U$>OQ4}T!y4@CTdh(ECi ziVggUMf?f&{6~oFPc-c)2Kgskc@&ZR0}+29;txdp$!HwrEB<6OjzIBG%IF9b|K#K- zdAvVK&m+I-e`|TB3#k5RZ#00IPl2YRLpA}48{!qT#qC_I65TkTSvIr^jUlQsx% zCTt@;r(ax34qYSM8T7UO5m%s{tI-gCw4;i+7L0<5Osj(_%u8*WcU6?9s?e(|HoHnu z?9F@zv=MSk2o^-4X(3$LUh;IflPLfTJ9Ih`)KyoHvgb*{QlqZ4s5#qruMVTccexW- z(#Zl*i?Km1cOBz~jvj2or0MB;W7#M6L@O{e$exB!&l3i2TqQvtywYh(IDJ_(O^B>~dvq0mzLbL!+J2z_@b=4h{Jo)7o2Gl1jyIo9FEV~M=TeZ0TO14NmZkWi>OA$Ee5+tHXM*?3{YVZ z{u+tALgLKC%AtL~Fr>%s$*z3VV4-jj>6HsmeOb-({L)7O7hEaI($mbh=>r^J5J&v= z0FcTRG8#G05VbV2nucU$&^!xc7^L^Y(X@xoo_RvH=YAR8okUcfOKr?-3w7US~ zM`H(cMWtdKqh`$%TWh2#V*nV@g`0=EH;)Ay&c&A>+xwoPqR0$1vZlbVjL}U<{~L!Y zlVsHVW!|J0%y;mUxyax2(-@H$Qi+A9&(NcCD(H$v&x_%fFDh{qk{W%ont99iD_w&P zf4DN)#z<6NXpc+^I76-;j$n_jQ_FMED2m>{nM{ZwE9P}Ve5bVqQs@8+xPehRMmN(yk(azl1-q+I zWm&;eJupYSJPT!QzL}*lmIvdp%lXR*O9z2X(}yKFUXp=usW3|=N{xqLcN9utOI^-= z>RJy|+m4&@NzE2W=9D_*_l9dwh5+r(x+m|35o40i&DcYh9?F{WD<2A3DXA&>I~~>> zJtnBR7dPEh39WA{ou7HDiXXFXnp(HCnrqL1n{xQDA5JME61Co5R7qHrf^b2mkS0?~ zt@eozkLg_&7unzVj)|5WR|z|~bsTt+lznZB5G3&V`p)zRk)g{JG7h4HYv8i~mG<5E zPSPuD^(SwREFg`?PDV9Hb7+{@Z+B(S9WqQsjLf~_`q!riew8_iJeLU28I*Mutt(w= zEp(mxnix32mnzjs{G82-`=%uqd2aHM>1c0Qa8T-X;U!?6T<@HhLQYaCpD*-mi|w+z zjB8k1{}tu@#Km`H+sSun8$a(~MOhxUF4`o9a3<-=jbKw7nUHwqm1LFEq!os2&C4Ut z=*k7b_zc2B_^31LLrW3!_2hp>+UtkROdW*&{?44p-7n6y@^X- zZEa4O{Q3je4_T$~1`90^lNUVHmBl8KF+vtyBSlgMdG=nNofkg8gAitx9sR6qT717D zZh6u|AKmV;3&?sVN`;bsH$|xrGEWAZNqO$K&%wQV>V&64h#PwI$qKdbXiEt8G7Il-vNRw-aMaF-?FHXmY9`gN@e@vUng!crEIir<+wS1>0qohn~ z>4un)!I6j~WMmW3o@j06pX@pfzqkJ@CcJU#NBhE3&O2D;))3!m{!vh!$4m?z&}4O3 zjwL{p$0pIi9XbdUx-I!YJv5!%hZC=wO*bL}#imv4>Moj9^}%+QWfxy*)atVC)d<0# zumj>XTWYLw=_eLP+0@4vn2y}}BOK`ihoD*4zh~86rmr}w%q_|Ol4rKuBiAXR!Zu)I ztskEfT0iM3bfC^ng(}=l)Wtu-P4B-vbt>*ZC}N~n{3(pp>~QkO$_|%TgP~PKounWT=N?b^ys90xkY%y z(ocZ%OClWkY!$S-Gueld;BPIs{ICmGV*XDL-X^l8$;Z=fiSB=`smi8TTudAtz zw>km%tvXOO>3lINOQh^>3PO;~&6VkxB*Xreu!Ko}HJC*4e)VW<7oFH^<;{RfRFl=Z z>bi^>@AfzcR=c^ z0=~>&ARJ3X@?U*3eME((bVfa4l-W?Bs&kuZT;Jb%0c^qH6YR~?(@DJD4QjI`3hH3*-g;? zq8L(P=D#b82{DPs=f9Mr9l7c|m$Hl|6=~Hj9ai@aH5bYGM3BmM9)EI0`#QsVOfa$g zv{XuR4=eirW7q&lA+Oo==SSQwAzNlDe z1UvI7##cPw%-AW*O#NtEQ1qV2cx>+joPC@>ExYBJhKg$Sf}Inju%v$(ey)x<)p=NW z5 zw(a&x#Z|r0N=YCLc^srX+C2Ur=9+c`k?qsd{v#c^w*GQiRe#s!7rZN_ekX*q7(8Nr zouw?}e@&9gd0tWV;m=P5|A)O6UPELo19gyf_p!{~~T)`H6EvaLAZ z4rFtDa+1&BB&moXKI+k_r3=f?@1N(T6cQeZLR{v4IiCTMd!6)Vp;0TjbY&8H)F!)IR-d!whI56i2!6}$J@ENrcpyIXBs071h(r@EU3mw4` zI$q{cPFM6Fom8ZH&)i^ItCplQD{wJ_G%OX~T#u8Ol2UGhoULH0;&D^v=RXXF2 zlT*mo*i6rm!^$hMjog2T)c=@VcOq2JpZH5jqBgH&I&TX4fCeZaY$Gs>&54lccGupBdYSkm~gQANJlmsHv^%A3p?;rho#1qJpAgp(#j* z#Db_)rS~8TB2{`1xr$sxKt-CAU;zZA_Z~!gl`btvl^RGO5E7E#fpDMibMO0|dFD6o z%y-^-2mSy~PR>4iuf5v-?6uamnA4($I(G-L#a$Y)Zhg~x2G9w~hn@%-ENG*0K1wM* zCe9+uEjGFm*~zvNdSurf{%iEGA&5qaoApE6l7_bFH*H6N{^2J>-YX8&D(;7U?qI2( z8@&3~wOb8h&QH<3aBuJcqJQHVd)=`OH)e5pZ+w-ijQkJl3gtLSASz=s_5RgN2THIZ zUMICSWa1}4@=$i0wnoO$J!1d&$H8PwMaWR}HOb+5>y^gw{eh{VW`%Rd&fa>Erg%3<8(lR4aVeex2lk3wWiIO%9ilrr1?^>Mg z|Mtu|E%>ETwz0Q&F>LTj8$e`z-m_se%nc7E4-Q@~X|btacl3(>?}=d|Ps!Tn+1#5^7VI z4jEP4?%eBAbl7Z!rIVtNL&xxs&g{8mbgomoUtQF$cKponzGOWiF%wgD>|1t9V*m62 z=uc|*LXTd?XdCEpc{E_k_CxjGr-3P+s@n-bwYhw(-}ljM5>kU};IO!=f(_+&Y+QFc zA)4Yd3a)G{%!ar6sRUjcrQwQ<;OaB@$&?TqaFZ~a3DF7ijnzjP0`?;p(AgdXci6;Nr5b7}oG#Jm&>b(yx3{q?QcUbd`2G#*@* zfT!oOggn*6^g8Q2zPyt?TyRmMqQZWtHLYY8dZZ|UXvkbE+15_*QXCDhr}c>Q+>Ip1 z09k!p;$2R@09S?Ned^0RvU!t!l% zOfuT}6I7;zfyr$4tYJWo$F!) z6S9-$ABIov4^$;+S{#oEzArnH~3wK&(t`UU2Wwp^4CN9T2DT{ z?>TTUf1BezHjbCQ2pC2s|C@+y017F_SQQm7W9hXS01dz_)$y-tG*CMP95;hgm$lZT zI))3J^7~f5f6Hon-@L;*U|8e{$V|rpcC+Ic*0J`iXvw!=(oU~QxtLV+gx*RYGJmD` z+KOqQY1D(A+^^TU=!g&nN%Mr{-N~6h_-Jm~b7Eee1MrzQT6k`rkDxBcV2VG;(TbBW zs|TW&^K!W^;<>cb4(-@G^aBdXwtjCOol~XPj@5=p{J)}2j z&d&)scL32dUnkCt$JKK8?eU|)!+TlU&i`sf0@Rd(e>CpVjn?EvFPIzUD z6+LC8S;e^1&ZnwE7m}7%hgQ#K4omImfk521+j`Gnn z-MBUC4bMln(%`2uPTAby*$#TMcaz)P0jhnp46AyZ2I?4?6z1!86!@NAm66|kjF!au zDi?i;4$bG;(M6-t9K&4MoLl&?EubAVr(n=9X0+1=JdbhvU}$@Qmj8yl&G|dXz{AKo zl@2Ddpim~#PD4A;vaBK;DYY((FH4^+BwV2ZH-*en8XxG;+f`f4pUHZP@+H#pw6 zn`|CF9hGUlBh3;|AbP_>PX5#nzsyS`RBdd4{hMuS@@b8<^el7?Tl`Bb@Rt{*{v4e& z>zF-k1aN9Oc&$7r(2AsW)C$7(^k=BXSnuxG2biTQ&B4^MB}gErm_Qu6AuSJv?*sZH z0Drd0P6L0+c)rZ1`;T0fKe}VI__UC9k+CbLC3?F~qut>z*S4{|av;f3 z%qagEFHPaHaPdhgVF3wCB?GbT2f<7!J+rPzm?s^KM{FVeTmvnged0onsaE)WS7sc| zfiOhDz@BMB0(Xk;{IDF_6se#cpQ9dz?t%dlawGb*WOiAh9MNGHtaHck=BEe%PH^*g zoR5^HwQ>#yFHO9V#Cm4eAF?|bGct$;0pr_1&arQah1}Ru8foq^M$J<`Z=a61eJzm- zSxdrfr*DChXW9SVEo>X=QOLXcpARBzAL&mJYUkcQE2kJ zyH_e>^A9i3QiKCx+<)@6)9TiMCC|@v>S}<=Z;p__v8Z~kwcZTF?Oq!e!}6C5d`|9m zt_b3u9Z^g-cN+LpMrv+S)@sOp_q98n0u@se&+nk^mmPcHQvStdXW)OW>IGj1gGp53 z%7%=z*8ckZksb`_ypY}WHz#>pUqJ#DH{m?HE$=>)qz5KfWmKG{4fbF6yul1F-0!D) zyHoO4Z}b@%fK1%`-JIgTJhDkJZL9GUhyFiOv5a{*fr4hcy-w3+ZI9A_EdXeYy2lE9Ly|05Rx z%hbX0b;H~9IQFq>PwV!d3gv;2LvLE{C41SjMt%IMB6hLw)+k1w-gI<4YJ{ z!Y0^QD@UMXB_(IPQJ5LIrr7mzY=!t=izL{7aK-aV?)N{cZE%CD749j$e=KdjgVig( z$2=ALn=KB6-36PtYhL#c+1qP)kH&jkv8|5x1ms^{${s29NU>)@c6eaVnEq=iw?~RS zQtWw~J6d7S@&1=6?2%%R6niVvZ64TLr2ikUc@I|jUkEEaIt?`P$DS`^{RfDIMzi*W zE=bB80zT_%aV#8@qQ&4G<^FPXI7(wT0^usdoHZeqp9PrHzjEZ69(bxdC^LcuFumRn zq;6U$kf8H2BMwEqNr;VO0q%JY)d=5vv%^yRQLu~d!A^JeZ_u`57mSh~U&-qjz6HFV zD{$|~SQDX9yOZmY0R*VtEq~s_V60dC#((-IB+yS{BIPcB(i$yK&EjU#$m7XluxfR? zfZcO|&z+X&&gB1T<9HglC7FQYcDYB3;ol#LHne;ErO)aTEt~*7$|!H8Cq!xuWdI~Y zie&O)D)W74u?&BTO7yw>iXY(W+9@T>DZ2p~>h_|26%(-jouIz@t;XiB5k;d*!0`Qj zkFV^s3&%plKfkc@A+^>yfh||+>8AOlZ#=fA4R?PD+N(ho*ys0bkQVYly4X2T~v!+iKR!cIM;uw9unBTy84Mp0$F;(e5b<;7F z5rCR#tZ55ndhKgpp(WzJIo}jjjXd8VlQ}x+6^=LgUu~N{}ZV( zbRRIpL0l2~iBWhzR{d;nJAe#HVG}uy$fauh-i;SHcRt7AaZCNEvWr#mP5QuK3~?o` zBCj_zvz=D{86C(f@_RwuDsz@@(R_$DLbNjTS4{zgjgvrWt_j$kmW=fD@}njR2X-U~ zNq5*#-f152%yy@N=5Q^r#xuF<$pjtD(|Wo{>7>{0kt!Rp=noU17_jX$3xC8oI8whJ z%FhAxC6azM;Cg|+1B;xZJL!4M$4(ZwLSv<7q zLK#O%5mrNf$?Z_tCM&HA-F2Cw^iIc;LZxm_qd8gQP zXIB!!QJq6fOGBC2bTH$>^f;}3UK$vEr&`*4!Wim}yJy|m64>Cd`ecor;pK$DdNuk# z>k+B`6>Bm;Bb$YU5><`ZQm=e;Kx(Hae9TBN&=$(+|M)GOC)#6!D*Z84qnjsy zVee7zq4amkLk5ieG=`@a%t^`@IxdYlL&pTyHKt`3Wgq^6SH?b6b?{w#+J@*~2a<{> zXIJL%#E^XcD^P^V_P3C9TwW970vv`7gS0afgv6J-n~q0R`j1v&t}y@{UrXS2%DF%E z{QEm;ePI^M$;nqbu8h!G7AxEhWF}urD!X77(A8(*hpF~G2?-pI&|#}ih574-{86S4_fVUW)X>M$=EQr zYiKlA7flIm#KO#yFLo1EtGVlh)PYX=Qm3}{s<+jOe2l6BI}{g8hha^DN;Uejzf2ip z`s!Fu*@Q2t#M1Fsn4swsY+Gv4y*2H_tUQ{}VqFhhBEgN zC5O2#E`hKf`(t^ z`vHB_m6iML>SCyoFQlD;1){ScZ1M`-mx2|`=ebVo9{;m>suN5{T=;H+S9Yi{X#|oQ z3Z@s>uuTmbrd;9bsx*>Bq3;r30?MqMc4y0W4%zs@{YA&WEle#6!{xqaNgsH^Fr#px zoA{+(_0#xl$j&t1;QWFUXyJ-hij>ccWnTPEJMZLGI{K52f(a_DVxyA|J(u4;_(pyt zYDWlt@gu5};o9N6wOYV3j78pqja1CJX@kSN)mYwro*f_prZ{;+^ejHeR zUrlZ0pys5{UnCT9?i@Y`An)?Z+K*1JK3C}omw&oOdwQBNee-2gNI1z7&p%o%`Wy^s zZYjmavpIdaSLQ>Fnx+M^!dDqa3nmc>9Prh8$GYu-cd8=Gva%A%zj6GV1K*ULd;~$h ze4PGx)?!lJa{=F6@p@;ZuaaQwt=-uozL(paw8F;bL}Pb8mJ)Mr==q_wO3-5(mzJP| zDGQ)iH(DQH{Q!&rvylc(_b9WxDop7%VILX$9O#cLHrk#`z9UGimd9Mky-|bX?|3-2 zxwO)E>icw$ra+@7>I663pZ073^R`iOGAG<3Y%PgVlNl)XG_AY@Y&$e9kEC zj&G+5#;+he#psU!tB3QZTJ z*$A>UC2xdGFB1)(O3hYU7n=7p^;y^?r%bQnzpk?2?3M_lj=Y&$@UyCwx^I#ec+cbB0_$_NSc1Bnz#{VMzFN#Fm+q z2x=WO^5yxQ5Rh#K$4&-j_H}jR_)&J|q( z%<2;EuUP*>JjJh!x@BxZ>6{oiz%SN;5QoMg9Ge2RzVg!4Ne!1*o?dS>w&Vd(>1qEa z#Z$3I6=U?`ZJB?Q)Za^%Y^dyC|<>s&VFRr&EI8HL{(-Bbm zRp#M2JxLzv4{ofxM-u^iq@(iH_L;K^Lm24`3e?KF@YaJszHsIEXq=Wq^4uVKU^ZXC zla}GIKL`C>zL4VA_OsfxrN*>&!$8{fweebSnr4GQYuRI(3s(jDNi}6dTi<(D1?PPKT z=JL-IzIJ!kB8fwp^wyuuXj5e}7E3-@+H$u4IHLaC5_w(lCXPAqXEj~wsL%Yjx{ws; z8;qj=1!%y)!pyE=Lo%Ml-*%)1e0AI!QJOJdo;bT{x+*>&-paq#azPIfUmV?WVmnMerbBc0hm8gvRV{XlaE+KO-r8fzYO)*xEM~N$<7}v z3yuB4Rauc`2ARt9LjH0u9ctF7`1)B7k`8h84}%AB#2UW>S`vr(!GRd)H^NWQRY7S* zqbAQ4eLV$uO&LtgSYSLGj)xR^diaT;=w~}{*M+O5Z85t#mqiifNv2xbr?@-lP{*r_ zg9u^FG3njH=@+){vUge(7x(+pRFu>y?c|0G$1>}g)^Fm;En$OwjnYgHgdl;X`wAcH z+115jH((bFsiy_*6Dj1&`mRRaJAoa|EV^q5-H|zLMqd}dKFYl>%!OY*u-Rfz0%32y z{x-c`;J}wIr(>`)P}-0KjF9r!;*rE~P13ja2CWTi<47T(*omT1`DU`7f8o+%Zh)YNe8)mFds^;d}>_koSU1SMJ?>fq)MQK z$HpttKCwD!(oSH?5ex3z= z_`!~wA|VBt$I%VS^k>ecq=kfSIkLCmvtoy;z-WJhifvf`*AkMQlVjmfbppo~qgV^v zC>irn&V0^thb5Pdk+T)G)WwQggh9qo)mBwuxMIA1=F#?A9)sS@+=xDuahoo-V}{Kz z7L#0g(aO!7ZQPf}%)v0MD>(zN+O~9OamhhJ+?+CSEE~UU4xTyVOE=h`s7OJpMW>+P|6vH^z$XwE(M;TjE6_Hn)E1tROnW&=+$hQ zi}iWJ&UCm>j}rIO!5w#(A(K8G8@%0UQXotzqIP+fJWFoUEi9U<{$OHLwwBUvxE8T! zOBS{rk6C1tPCrdspwZ&`ca$w{Ekaw%?RdGnYx%uT{s&THARkSoM@;AHeXcLr0>Gc! zDw;R4uEGDXwYnq)0Ak!Pv^7-^upVUvZymUO>&86*fPnu(0Ooz*pH;7(P4Ew$>pj(L zKvw&)SpX2N->wVbMYlNO|LU}jzwmNuS*ne-MTPjNdrkzOuLBd8o8Uzc6BY!5goO|eL3ZNX5C8N_&6=KOz*VR^hC^zjO1Fv(%js;;s0k0iG0G! zJuy6x?lk`aFuur6^7#dBtIe7+i?P!8HPUS>Fo?6<-iZs_bdU}nozF2xAj4hjQ zHEy>#LoyejgH!W|W;PRK-l=%oi4m?416->tP}m{-NGSRyC*SlbR7Z7A$7fwit%Q5k zo95NR0PJS97U^Y;F+i@TY>n_{%~kruyzHMTt&r~c#f#rc@vD}{1g*RpD>}&##+xQ< zn6m12q1h?&q0fECoYh|Ot>&tUZu2d-eSvu*K8S#^D|JZ~!aQ{eM{?ztNlz~?LN%s~ z4?`Mo*hZl#38fxvo1fTXIic>h=6G~f3AH)4baX@|cIi%9i4xYX;qmf0S{HW$>IJR=egt#tc^K7qVMIRn;P0*$;za)1oD=Lb}f^>ju1A=uXgFr!){o-Mx%c zq|L)Gs%M4&FkcHxL)+fW~u>u`Pw9 z?E41-fQ8Ey=nt181?D=2mtozi4C&Mj1enu4dQ4FHt$Wr1@y{?whPZY@Cn-(y2Wi>L z7qLd{#cXk`mq^nIqRuF;Z_Ojbsg|3yilG<#(!EG$a-J}}6mD@@F5g-oUY(qJT($Uy z$!RuaoQv4hY$7Jp4xR;Cf6DnXbZV={(WU{VShO!2XS4=LtV2=$DsmzesqRWg5kKi` zfiNAU-~D?lKa!8P2;6p}2Gy|{l;M8`&$PFS2b_Z*T}R>96P$fdhIO#0n~%-c{#q^; zsGjJrRw9~hd2wVM1$8j2s$$;&O;TyGX7y!XJmAuu~!)$1NV> zL!pse&}hn3Yu1WGXB3Di1f%)O)uwnyaR!LOhsXHK2c*w(0XSDmZ!Lv_ujVVo9*j{& zUSOyw8Oywqk}YXnP{TM{(y35h?ejGAwygSTKv$UT-Htf4n5O}W;PRT@Xz5Oy(uf#B zigF2d-W*$eit|!V38P9AT!Hq=p6pwwBUD|7H(*EET0Ka!z2%hiYx48s3Bkf`mL!Ih z+hd;fTZd|L_XWE05|40WmgT9oo3WR8A)ic@2j=y&Gir|&Q)a8uFSANlzz>!TnP2A z?>fwXGKT;umpQH>;{Yuna9yH@Fo#$r^Kc_zGgYjPDK+Lg&pi3v}sL83T0q`R2& z#zMPWI#!Qvz9KY5Kx^!!R3Wl`WPREJ|y~0-C`Pa^*M4rNiU@&mth*;4XkH=o+QvEiG<{d zV9MVnm_!4}S>DF#x!J~Vk=@X{lBaWiFuYtH)!q7|sG^V^sDwh7-@kilP&l033-Yom zB)G%pQ<8g+n9hhSB)e?!2NOQGWF*raIJa*~Y0<-06vEIKhfbqR7f88TCav|!;6ueb z&xiCijQ7zAf+~8&R_|6I+8b%bCbsru^qVR~M=0kHt0(0^4)y2U3fd%fANmG(bY=FEDH;)W7tO0nuRbgTF;Q zY%;8Hjm7#*D}Iz}Dn&J=2!dP_)lQ)A6eyeS-(33mQFj(Tz>730b9pb@$Z9TJz=uLR-2#!2bm;n3H-hl{x?= z0j6BV$HBpdgGZ2iY^nFDv)FSYFGuzlpLbscmOG(N?Fx_G>n-D0jDtZ6A9Q9%udaSm zXEqhg*@_B2ksj72G;)(2h|^5?d8O;b{k4i9|nr6W%5S7Q(*Jk>x7fEeuOahNbcqnRY)0D;4R&V{R%-haUrc z)TVM@9JZVQKg)y_3jyj5uIl#J+4eKpPFmp`>Bf2rgUwr;DXjLt1+LUN=^}sL_x`k9 zOQ>5!B0gcn=y;rJS?DpKYqYZ0B5+1^Frd!KstMF#VM8rZc=-Z{p z`2dY^;`e;4KUeap2f~<)Q*-y?F=EWf)R2%|@8NJ3!rXRkAV zEu!6%P)~6B>fugM4MY#Ja;wBjuO065I7HA4L~F5er-2Tx9?&SxNEy`XKzlNC{wb1^ zT>cu@5-1e?MH(`HPmpR}B!3q4ptnZX5U9wT0Zlb!@2=QF7}{A(FL}NMUGZ*V=Y@3M z&E8AilO|wK2s}@9xx-&o$Xw(U%yDG&U=e3gJvH>rZ4k2JZ+tvD*S(3=0K#0xY_^PiYD$Z=lpr7GUWoQwp2&_VxaWThr z>Bih-1R(CgKh3)jwb+rG-{NZfL?SwBUuA)A`{$aRi02R8`(OdTa`=&gkX|iU_iOet zP)_A;Bh5-b)Vx@7n#^Y@T0Nml1r~LCoA^>OeZdC{!W55Q}qON>Vf#`8%Ff_+(IBFje>I;T@ z1Q^3@2h@UjJ>tt#xz0N*Cfo*>t6JsL7Ommz1wQGNR8L$s=E&hXVe!(Onm>3L1M8L! zSj3wtZ`dmfjn(fXU48~2-OuHedP@7_nPgJuIO4!~uum-Ub55GQTMEM2n&s1Bsdhyb zuZt!zX_tl*OE;Itc@6Rsc%Y8`BmpLh|J^77i>A|G)dJD)SalI6#V9@0cbWqQ%<9$X zu+oUxnPO#>!0|@{47hGbfsJY^;W*X*OmEi4lM2eUGN{&A=bf{b;2vU%F1iMBhu_M0 z-e`LnKTADM3|ehnvD1N~q=v>lz6|~JK!mKB=QY2ihxuR=gFuwZr%B&`w}z9c{@C)* zgxR=YCrzr0b^pVLt;uhGI7~3EoSL~&Hhhr-@V4HH!{)LLAF(O{q4xFK2sf0~8MSwhcH{T(EF@#|RAoM*d((XLIl;4Y>0vh>yK! zV{`4jh(3qbf+AH(V5fZme1c$4GWYp8E!2BQRj1gsB^p6o zqW|RZ3-_sElNnZ+5#*Z}=JxUi|K;qY zIW0N+8e$n3v18uYVW}8rF|oTB%Urt6V!QmN#yQf|P87cDNb@Vzi@lhMF-WmOdk~3wR^@APV?W zcT#sPRjS{Ijo0YOSGuuQ@_ly|w2Anz77xTccS0fBPke=~VRJX@z2plzGrz&Q-lunD zn=C^@9HU*g>&}QXxIOmP*(Cg!*IAQS-HnKXKR{XHSklUrh*AXttf&-6 z86H%lN%bTl{UU#*Pd_wy&g}JHJ$l0^ukvH-#-N3VsyY7DMN?d$|C`)savz6B+o(y3 zTgw?H^86p>Hgc6NGf3ANMz;{l5$BfOxrky zNdmK15WOaX0W&?lX+AQicYBzWi~f*YH_p>rz9MZtaf;r6%#4P6jaOBSykV#GD*6yL zI2;E9&Ta8)vFRRjWT+R<8TW!x&i_0`2eCR>QY3>~GMSCiUlso7vqUA1)_QMG}o0L2R>tD`s)EdwTSzoBb1$@&kq;+rZAbE=jc!rEGQ5poP1q ziUGtgV10N9SI(8WF=lbwsR@zeIJh$6Hj)z;CSn?kIy#W3xhA89;A(x1=4RHN=~;+Z zc;n%u90e-1I~a0Jn~uaq9T0W74|!N->$p5TbXaGzrHEvB7x?{diqx>x;gcnsRJ$RtIth#2rwYO z<{SVZ4`WABE%wI&V`v{m&0-kw(8+^ffonJ5K6P{UE3bw{I(nS5~sZc9rB9i*kZ?x6a^OD2+ruETl0d0$Qh;fu00q5pr zsmjL`#3|@}8#$F6JKEA!WoJ<_`DcsBBmd>Z*!htJDy6`jdfByX^5fjYXO%yv$ec5? zYGJv7=$nVXjH;2p%ur--;emrPQE2t-YClhCGHK}D$fh1ZJlI%1xX>vNT7Jzj&^iR% z__~(8HhI>%1^nbj((eN3;o?oTy9rw;R8WQgsonvwgkmORn5d&eWfl($r(rPUp||hQ zMfxIEK-{#~*WDU-dP1ITbZKe;BFq>#a6tb!5_Nds$GpJTuqGjlF=L?R1#>7a@hi9q ze}fT+eJHOKgZiy(9}ghUbDz6Ma{;s{zKh(4Vh$k>h&mTRv8RmrH-%v<{CY_d&ojfC z79p@Z)g^a7^lHG38PlU1!Dz^wgN!d}@K;Lct*_RgTaqKo38a)lr*DGWM#Ptb;A5Z< zL|#Jl+EKF;bx#(l1;P}N$z=98kOl2;Av3x;Kre|0>H-)V%lkYWt!hgV-cSLz$ zyEEFzyko=xMHgTosi2v5;=%_8hCuB_-TgZ|#gEPk0#dG*X{92c9pVJ873$EE0+M0_ zfzH;Zb30)JoOfUVbFXF{xDO3RzF9*cFiGK0JIWk(j*d=HSAmBXZ1SFk8EA`twH+Tv z2ibek_73wN>GqgmPmUP&G{d&K+*7JM(MNmCu*VGlgM9`*aMSU5g5^27I!@+O+6-ye zkAN!+&U0nkJBI8)?MGAlOII>L|IHHl@tkl4Q=Bji^c`PXB6hs6q@m-9G5P@hRL&d5 zvO2g>bhZbC-#E#HoAz|7mRq>}qla}|G53(M?YMXCtp(s#ZvpyeW}NB{c$Qc(pCwuP zdLlxso&b7`8cD*yt9{l|NLffjw;9xA7aU8^1Ve&kyUf8&Q}{T(z zPK$-zK!R?sKDaO5&2^9w+!9t|)13iYJvQe{8C*fAF9>$`@Xq7tVfbu@cbJfcTat>I z{z({|0qKyRs>J)&qFFL-PKPJ`z`=}vjzmcY{;WX*_(+Uc$hgKiR3sCbSHB6 z9TMccHujWiR^%?ZtKsy0r3Vp)}cT42}y3HY&@egXnLnUiBkz*1jeLszF> zLeN&eSo!#MLhKvDBMGqVIB$t{3ma|wKF0&1ase6@S* zkZA%}flTlYbScDnw0f(cHy%2?LF+P$@J^|_FPQyssG}QOQ5an_O{_`PmtwmJPND}A zh1nzz6x%)pM^*`=V5vH6*wU<>h>3Bq=}Mhd<#_0Z=cjMZLK0^nCiqVPh?^z6{TZ_l zTu&d8m6PlyF3T2Oi2{}fMlJlSL|Qn)tgaPZ4McA+WVM7t+(LeBNIy~o8&8A1dC8GD zT5Kc2fek$a=pG$u4}&%dR8^&1_5g8GH3pxN03RX`2GO+c2R>fLv#~jTg(<^o(a_O~ z4G3QxDOWtkj!@`me%M&wb(H_4#0g}ygYx(@^osT%E3%O5TzBk89g0VD!{8H*`}TB6 z?>i?v$(zOaV2)RIE=AV^(OwLW!vW{ord8=d-~t3$9x4}!QOfxTNAl$onQ{CVJ<8?Ki)hS4_CI7p?YjD=CT;ltsYaAWE3TqZig!Yx?Br~hY(PN zm)CGap%R2)kj*|pF3xd~GD6_b0S`d56Vz55uAWxtz2v@7{DL8H&M%NiN%8kCvN%F| z?ds)x6yJ34%?VcBzE9L^)ZND!TS57<#I6an0 z)X`!paD2nV^2#EKm5%rwef5q?6_^w!VFszI4cTgQ(!lyo-4M@_`2lDn^}`w5UM^yt z?~l1{dBwIp=au#8C9f2_b&ZJ{eVc;Fki+Q%Z4Z74i&X1B=GSnViicX*J)uPOZfvBe zQaUQVp#mN2Z5g>xk|1pCBSdTRqURzBCywz?GM1;JYm{nZe^JP@nY_mrN9VNhu&;P3m7a1AF zh^h9hBVtKlu*?GnocLzMQ(el^L@@?GIYsCsEl3t~tE_XKk1RHIj0cYnc%?G-z}i0AUbe?oY#2r2T#p+ER7qByo%-y}0p?qjN~ zg~^NJ<&{%2OKpf4<+nCZ76+{FUuR&B=QYe4?JD*$sD4tJ+d(`Kj(eg(k0!ntB_vb* zucvlzJtePUCrRX;PQvVvHqCh(*(2>mB)q%aVPl7>Zl-Bp{A?9Dcn+F!d8Fqtzy2xM z*fnGjnY0@FF`hW^%{R+;=^LZn3Q-sAY*01vN3aJ+@KX|wiwoO^@$IFxD}w!dH6Qh*%8JhzLQI7RTW(l!V4Cbe_l_OC&%If`})zGcJ zwqT3AM+d57(t%~6U~+bgL%8zBdrhO^h?lOsT zpkjbJjHz_Mgm5J+QLY;hHd{P-6Wk0gv<%^^Jk;F~(wcC8R$bw4M$D2l%ti? zQ&;Bo#=H_YYWxuLm}%SVoY1)j}`f~SLLM@%JFq`O45BQ2Z?&hCLCtI4-rKJm(=T0$QIg8 zX01b~S)>l0E33UfV6kwx?nS-{{>&BZ=1)lteaYPl3;z$I=>HU7rqTru%%b`qVClf{ z?tjIE+siuG0RRIt034E(`qz&LBcsT_E~F$6fe$<(Q~&K}a`N9UsN^TWp}*b!_nX`Q zlMhP%^P|6COG^Fy`kz-)d-wlIlD}O`iTv&Izg%2o{M&^6^Zq2`f4cvl+TWX>f70}C z*Z+}!|C4dCc~YpWn`(=e*DVHVo?X zn7?1g{CBVY{@$M7Kd=A0?f>)ne~#y$q7gWL{wvih-@~lzp$9Mj#Wk<7|?|MFEtKmHK2ZeDo z#`)@aC<1xt(DkUsJ05icrf(u~wftP6{QH~s-KOIzczpLWqkK2PZ(UC3j$w?ewR{4$ zxFgzc9kbo`85woQ9#s!e+jpChwiAOQKl|9Y)OH?-V#l<$%F{!E`?+2VHN{4TlT z)0eY8{c<<7R6!2J3|;OK2o2qr8Crdzs$!GhDl=na^0BA94T`clV0G7|z`V*#6z_Lq zTE2SlzTzk!-4Wv^V_%IvkDoWDO}WL%o4N?<4XZxo!l-%%w1Ne%9nC0IW=J3k2pxY>4<-&S9~)(P8M$TGrPk;1Tq4$w`;#ByMvZrzcV1{=LmGOlp>J z*kZOk#x2Ko>{Hc134MJmrF8bs^nA_|xK;kls;hW>rp<9l4uE+3$4a=GQ)9@(YVLR< zZq2RfvNFTXhd$+~IVGFP{WazHl7>_d_8qwayF9X_fKP>16VY$XB5{&K$SDSkhV_eY zQJdxIU!#NLZopMKJg0wT{W?1vC7sVW{Gm~7R5F4q=q`a3>n%lW>HxEyZz)$*Ue0UX zKVtemJk*w$nNxn>b1SJrM+eVAcu$|?H_)L)F|GP8rp9b4j;q&Des1UKph#TdFLYGX zxcy}28OGMgR-+@kP`0C6sPlxzd#Fe$oYf&ez~*+x%|b_EP0jtvIxR11=2QWkJ|-c5 zYk@2ma8={G!}Qx@EY2-Kf$neQN(jGyr1OsH9SEHC4>9CRfG!bAce~ zw&I`bu~@fKmE)x-m6B|gY{%H(?5d2QOsrQk|t<$0I$EAv`@E1DIOXoZ@NclSDEfNgre;MLZqL*2A zTa4(ZIVY+FOnwwFdh9y)R`In7a^8x~wcJ6p#4=7sW3h!tM(GOBEHFEz)}@l1^!uP0WuJX63M4T?A+bX2Qu zlI#z;ZWXU8b7Z7#W-@pq+OO;IIEBpis=SEo^dQ9Evac%sC_p}vec0Rmv%R%Q^xG#b z!GZB@xBV@m&(B!ZhhkXU>7++>e;s83g06o!!*Gp-6Zr5s?P=gOItc8S_9GUgHiQ9o z&UQ{P3CuawmgP3SCJ0t?;=J=-p7|WNAi&KY6vfGW1_nHPo5BuZWn|uKW{)=iEBNN_ zkGDEM7&W{O-#QQo+L=VVe4jdqgT6W4FzzJWVQyQl`eFp|xoh?+N|2zU7e0rrjs!v4 zld&ynbZ~pAFU}^9&cBA)=w*|*=Hun^KzWxCR5zA`$gDd(7j zJ#ZpAx+bw_W*H{Nc;db1MB-wewf#r<%O|NvQ1&trngQ00ETD@ROZ?@zZE2eo@wC7Mk~myV1p8xn$!#>#Har2GrZ zhE)vpXXSqqg?Ju1hE*2R6Gqlm(VWhC*@<%) zpWG;RJJ!GlDq3rak{5ldG9D%cb`ugLq*W85X=N6AjS0jGEy{)O}d>x>Rgp53i zQ-VLhWcHc$3fs$iFNovV(NL_#U0h%78M#9n-u6GXI93o0oZ2VHD8_>;Lx_ikZ~Ykr zSxzZXtL|JpR}dO^B_unhki&vZEf%<-6ib>m6)gQGUfLLJa*?I6%4F)CAf6ds+r*KW zdsbeL&B$eKpm6+@tC^U<@#7Zo@uOmwzC5f{ObtLz>i9P?`M$LyMYQ;K9H54U_|47O zH=lV39hSYXi^mV~l#mOips!<{R@fj#$Ug zg-K9|eSp>i){g#*ue}R{M~h}#s{y((ObjdY7al>NC+vAW=dw5q*pNwqKpunEu<+A| zOAKT-PJj}c78qy@8r8)|kM`41Aq;^Cs|$ij`k+x&IC}Itdas#1+War!8?U8{C8bVC zb~o0~`vNPh@5q~^WW=)GkWQREr3h7p$pFL-%o?n~V%R>tYVX!QrO2a}woERFM|-7Pc^1fDbB zD0GuKlyW_NgF7b=@5$>(6saj&V}12%-TV$=>Sb{cAlr+9o>YtfQo`*ioq!(qmU*9L zbJX!qG>c@RxPhtBV?Z5Dyf%1pep_{%NvM`K>yR1-=w>dj|7rzFN}Ydm+5UP=KM3b> z73n-bLwDE{$3Jo`{G_wDXQ9-lS{_I0=w5tml=@sCuaALqx zP=5VS|8BOGLT^S^hlv!YAH{9ubZ+Km==c6yLk6f!$_=YY1M*R)_Mf5j0#z477Sf-v zB&Ha`e^1|Y^?ndL&TgBjiM*b?nBl>1XD5F@dzLwA_|LBrc_C8<@>kZZ4z?}MX zj80awJGVrlKXiREAoP^sg-y&!2hjyOE~lMw6Ed&dN%O`5K1zNGcF4OnZA%@&eP?Vu zCmY+{I^3`KWSgLy5-YM-i}jq^AIxZ_wAK3zHvjB~X{{c~+$<0B@)IPbdxMy4g0^;ackF zahNI3z9!yE$V~hbQU{@WxrQEkezGxZqH#=3F* zG@mtaHd1+|P9Z3Zzp|qxcapu-DW5za8}KUIRZQY^>eH|WX=T46YMmszwYEXy$SZkB3P*?N#x|ccCMRZSW$~#22-a{#%1=mfMJtI-DsHau@SG~?^CE# z7ZY67KHqAn?D*vy4(S_>>OfG>&Db+dG;L&bB>Jz!r7QRwD;(OFfaOr0HZ2$}@hW8a zCgjrR6)@OcTAd4NvcTP@#HbSSWZaukT;jxvvN47&u|T|NYl{lQG1P>G3sz zfuD6C=<_e+9IU1yxrY?(Aw_#g(H>H?hZODMR(qJz+!pPwX+o{OZQ_k&`zTH%p@?YS<;dKe~{ns!MTGEORO>(EDFJ~w8Me}%%D4jes8xWxYf7)wmtsm5?nazge}%BS zASuIpB(HT8G5LrCek5nV;l2XGc|>f?cv9;^J5NCA>9nA^^i*!Oj7KLW{`jNZlI!#3 zdn?)jA(}uaE<@PvX`-4>`*V{q4e9HamqHiaTp%xelolreKGE!-awe@nWH!P)~1D`Ax^z{Mi!$b6C_>m37zAySF+-U)EG7+d}W}n#` zbaOSC7t1FTd~S`Q`V#^2;&p(`ZCUoIbsQ47@wT{k1hi`2^w>L+( zF)Z938on3_C8&V0@re(Ij*JcsU-?tV-Gc{)hA)RF!uKyU%lUrn_{exXo=Bq8<>@+k z=4}7qrK@-DKX~{k8WUc;RNlOs$}d;H*lkm*xUF!asek2bB~L%ug1VETbRSOSk4K)-{){TEyWL3^i#073fSvJN%CoCjXzu(Mru@orDA&)4g5 z%P#EbR5^x+pc;U7I%uma!=a<);HSuLJMuXKPllr(kShJoj$Ym_%X>^UWh32AKLim-jV3pvLNw7&!Y&4XHHTliCjJ0tH=88CW52w6??snsZ`_DVDb+3szG0MIoq3CHSA3bncs2 nV^`+pR>T^7Bhw_e8fjx^#YQnzf)&YPw#r4ZgmWg9v1R=R6{&cw diff --git a/dev-tools/packaging/templates/darwin/launchd-daemon.plist.tmpl b/dev-tools/packaging/templates/darwin/launchd-daemon.plist.tmpl deleted file mode 100644 index c4581e678ed7..000000000000 --- a/dev-tools/packaging/templates/darwin/launchd-daemon.plist.tmpl +++ /dev/null @@ -1,30 +0,0 @@ - - - - - Label - {{.identifier}} - ProgramArguments - - {{.install_path}}/{{.BeatVendor}}/{{.BeatName}}/bin/{{.BeatName}} - -environment - macOS_service - -c - /etc/{{.BeatName}}/{{.BeatName}}.yml - --path.home - {{.install_path}}/{{.BeatVendor}}/{{.BeatName}} - --path.config - /etc/{{.BeatName}} - --path.data - /var/lib/{{.BeatName}} - --path.logs - /var/log/{{.BeatName}} - - RunAtLoad - - Umask - - 0027 - - - diff --git a/dev-tools/packaging/templates/darwin/requirements.plist.tmpl b/dev-tools/packaging/templates/darwin/requirements.plist.tmpl deleted file mode 100644 index ca884996f328..000000000000 --- a/dev-tools/packaging/templates/darwin/requirements.plist.tmpl +++ /dev/null @@ -1,14 +0,0 @@ - - - - - os - - {{.min_supported_osx_version}} - - arch - - {{.Arch}} - - - diff --git a/dev-tools/packaging/templates/darwin/scripts/postinstall.elastic-agent.tmpl b/dev-tools/packaging/templates/darwin/scripts/postinstall.elastic-agent.tmpl deleted file mode 100644 index 2a9549b1d3e3..000000000000 --- a/dev-tools/packaging/templates/darwin/scripts/postinstall.elastic-agent.tmpl +++ /dev/null @@ -1,32 +0,0 @@ -#!/usr/bin/env bash - -BEAT_NAME="{{.BeatName}}" -VERSION="{{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}" -SCRIPT="postinstall" -INSTALL_DIR="{{.install_path}}/{{.BeatVendor}}/{{.BeatName}}" -IDENTIFIER="{{.identifier}}" -VERSIONED_EXECUTABLE="/etc/{{.BeatName}}/data/{{.BeatName}}-{{ commit_short }}/{{.BeatName}}{{.BinaryExt}}" -EXE_ROOT="/Library/Application Support/{{.BeatVendor}}/{{.BeatName}}/bin" -EXE_NAME="{{.BeatName}}{{.BinaryExt}}" - -log() { - LEVEL="$1"; shift - syslog -s -l "$LEVEL" "$BEAT_NAME $SCRIPT: $@" -} - -die() { - log ERROR "Failed: $@" -} - -log WARN "identifier: $IDENTIFIER" -log WARN "version: $VERSION" -log WARN "install_dir: $INSTALL_DIR" - -mkdir -p "$EXE_ROOT" || die "Unable to create $BEAT_NAME bin directory" -ln -s "$VERSIONED_EXECUTABLE" "$EXE_ROOT/$EXE_NAME" || die "Unable to create $BEAT_NAME symlink" - -DAEMON_PLIST="/Library/LaunchDaemons/$IDENTIFIER.plist" -launchctl unload -w "$DAEMON_PLIST" -rm -f "$DAEMON_PLIST" -ln -s "$INSTALL_DIR/$IDENTIFIER.plist" "$DAEMON_PLIST" || die "Unable to create $DAEMON_PLIST symlink" -launchctl load -w "$DAEMON_PLIST" || die "Unable to install launchctl daemon $DAEMON_PLIST" diff --git a/dev-tools/packaging/templates/darwin/scripts/postinstall.tmpl b/dev-tools/packaging/templates/darwin/scripts/postinstall.tmpl deleted file mode 100644 index ca52f2d56709..000000000000 --- a/dev-tools/packaging/templates/darwin/scripts/postinstall.tmpl +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/bin/env bash - -BEAT_NAME="{{.BeatName}}" -VERSION="{{.Version}}{{if .Snapshot}}-SNAPSHOT{{end}}" -SCRIPT="postinstall" -INSTALL_DIR="{{.install_path}}/{{.BeatVendor}}/{{.BeatName}}" -IDENTIFIER="{{.identifier}}" - -log() { - LEVEL="$1"; shift - syslog -s -l "$LEVEL" "$BEAT_NAME $SCRIPT: $@" -} - -die() { - log ERROR "Failed: $@" -} - -log WARN "identifier: $IDENTIFIER" -log WARN "version: $VERSION" -log WARN "install_dir: $INSTALL_DIR" - -DAEMON_PLIST="/Library/LaunchDaemons/$IDENTIFIER.plist" -launchctl unload -w "$DAEMON_PLIST" -rm -f "$DAEMON_PLIST" -ln -s "$INSTALL_DIR/$IDENTIFIER.plist" "$DAEMON_PLIST" || die "Unable to create $DAEMON_PLIST symlink" -launchctl load -w "$DAEMON_PLIST" || die "Unable to install launchctl daemon $DAEMON_PLIST" diff --git a/dev-tools/packaging/templates/darwin/scripts/preinstall.tmpl b/dev-tools/packaging/templates/darwin/scripts/preinstall.tmpl deleted file mode 100644 index 20d602bdd370..000000000000 --- a/dev-tools/packaging/templates/darwin/scripts/preinstall.tmpl +++ /dev/null @@ -1,2 +0,0 @@ -#!/usr/bin/env bash - diff --git a/filebeat/scripts/mage/package.go b/filebeat/scripts/mage/package.go index 8a0819caf5ae..da0036d31da6 100644 --- a/filebeat/scripts/mage/package.go +++ b/filebeat/scripts/mage/package.go @@ -58,9 +58,6 @@ func CustomizePackaging() { case devtools.Deb, devtools.RPM: args.Spec.Files["/usr/share/{{.BeatName}}/"+moduleTarget] = module args.Spec.Files["/etc/{{.BeatName}}/"+modulesDTarget] = modulesD - case devtools.DMG: - args.Spec.Files["/Library/Application Support/{{.BeatVendor}}/{{.BeatName}}/"+moduleTarget] = module - args.Spec.Files["/etc/{{.BeatName}}/"+modulesDTarget] = modulesD default: panic(errors.Errorf("unhandled package type: %v", pkgType)) } diff --git a/heartbeat/scripts/mage/package.go b/heartbeat/scripts/mage/package.go index 0897c897d133..d295fc657fa8 100644 --- a/heartbeat/scripts/mage/package.go +++ b/heartbeat/scripts/mage/package.go @@ -52,7 +52,7 @@ func CustomizePackaging() { args.Spec.Files[monitorsDTarget] = monitorsD case devtools.TarGz, devtools.Zip: args.Spec.Files[monitorsDTarget] = monitorsD - case devtools.Deb, devtools.RPM, devtools.DMG: + case devtools.Deb, devtools.RPM: args.Spec.Files[unixMonitorsDir] = monitorsD } } diff --git a/metricbeat/scripts/mage/package.go b/metricbeat/scripts/mage/package.go index 15498e8028f7..6ba347bf6f83 100644 --- a/metricbeat/scripts/mage/package.go +++ b/metricbeat/scripts/mage/package.go @@ -93,7 +93,7 @@ func CustomizePackaging() { switch pkgType { case devtools.TarGz, devtools.Zip, devtools.Docker: args.Spec.Files[modulesDTarget] = modulesD - case devtools.Deb, devtools.RPM, devtools.DMG: + case devtools.Deb, devtools.RPM: args.Spec.Files["/etc/{{.BeatName}}/"+modulesDTarget] = modulesD default: panic(errors.Errorf("unhandled package type: %v", pkgType)) @@ -219,8 +219,6 @@ func customizeLightModulesPackaging() error { args.Spec.Files[moduleTarget] = module case devtools.Deb, devtools.RPM: args.Spec.Files["/usr/share/{{.BeatName}}/"+moduleTarget] = module - case devtools.DMG: - args.Spec.Files["/Library/Application Support/{{.BeatVendor}}/{{.BeatName}}/"+moduleTarget] = module default: return fmt.Errorf("unhandled package type: %v", pkgType) } diff --git a/packetbeat/scripts/mage/package.go b/packetbeat/scripts/mage/package.go index 031ca09c894b..6b5f0f06ef9d 100644 --- a/packetbeat/scripts/mage/package.go +++ b/packetbeat/scripts/mage/package.go @@ -85,7 +85,7 @@ func CustomizePackaging() { args.Spec.ReplaceFile("{{.BeatName}}.yml", configYml) args.Spec.ReplaceFile("{{.BeatName}}.reference.yml", referenceConfigYml) args.Spec.ReplaceFile("NOTICE.txt", npcapNoticeTxt) - case devtools.Deb, devtools.RPM, devtools.DMG: + case devtools.Deb, devtools.RPM: args.Spec.ReplaceFile("/etc/{{.BeatName}}/{{.BeatName}}.yml", configYml) args.Spec.ReplaceFile("/etc/{{.BeatName}}/{{.BeatName}}.reference.yml", referenceConfigYml) case devtools.Docker: diff --git a/winlogbeat/scripts/mage/package.go b/winlogbeat/scripts/mage/package.go index 89fb12c5173f..80768e9110c6 100644 --- a/winlogbeat/scripts/mage/package.go +++ b/winlogbeat/scripts/mage/package.go @@ -83,7 +83,7 @@ func customizePackaging() { switch pkgType { case devtools.TarGz, devtools.Zip, devtools.Docker: args.Spec.Files["module"] = moduleDir - case devtools.Deb, devtools.RPM, devtools.DMG: + case devtools.Deb, devtools.RPM: args.Spec.Files["/etc/{{.BeatName}}/module"] = moduleDir default: panic(errors.Errorf("unhandled package type: %v", pkgType)) From 3e37aff99cf91c8e83990e178b3b259d7b981e4d Mon Sep 17 00:00:00 2001 From: Pier-Hugues Pellerin Date: Wed, 2 Feb 2022 16:16:38 -0500 Subject: [PATCH 19/20] Update gosputil to build and work under macOS Monterey 12.1 (#29936) Fix issues when compiling beats under macOS 12.1 Monterey. Remove these errors: ``` # github.com/shirou/gopsutil/disk iostat_darwin.c:28:2: warning: 'IOMasterPort' is deprecated: first deprecated in macOS 12.0 [-Wdeprecated-declarations] /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/IOKit.framework/Headers/IOKitLib.h:132:1: note: 'IOMasterPort' has been explicitly marked deprecated here # github.com/shirou/gopsutil/cpu ../../../go/pkg/mod/github.com/shirou/gopsutil@v3.20.12+incompatible/cpu/cpu_darwin_cgo.go:13:5: warning: 'TARGET_OS_MAC' is not defined, evaluates to 0 [-Wundef-prefix=TARGET_OS_] exec: go run /Users/ph/src/beats/x-pack/metricbeat/scripts/msetlists/main.go ``` --- NOTICE.txt | 363 +++++++++++++++++- go.mod | 10 +- go.sum | 21 +- libbeat/cmd/platformcheck/platformcheck.go | 2 +- libbeat/metric/system/diskio/diskstat.go | 2 +- .../metric/system/diskio/diskstat_linux.go | 2 +- .../system/diskio/diskstat_linux_test.go | 2 +- .../metric/system/diskio/diskstat_other.go | 2 +- .../metric/system/diskio/diskstat_windows.go | 2 +- .../system/diskio/diskstat_windows_helper.go | 2 +- .../internal/metrics/cpu/metrics_darwin.go | 2 +- metricbeat/module/system/network/network.go | 2 +- .../system/socket_summary/socket_summary.go | 2 +- .../socket_summary/socket_summary_test.go | 2 +- .../system/socket_summary/sockstat_linux.go | 2 +- .../system/socket_summary/sockstat_other.go | 2 +- 16 files changed, 396 insertions(+), 24 deletions(-) diff --git a/NOTICE.txt b/NOTICE.txt index 1adcddab37dd..635053dcd759 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -14427,12 +14427,12 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Dependency : github.com/shirou/gopsutil -Version: v3.20.12+incompatible +Dependency : github.com/shirou/gopsutil/v3 +Version: v3.21.12 Licence type (autodetected): BSD-3-Clause -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/shirou/gopsutil@v3.20.12+incompatible/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/shirou/gopsutil/v3@v3.21.12/LICENSE: gopsutil is distributed under BSD license reproduced below. @@ -25346,11 +25346,11 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------------------- Dependency : github.com/go-ole/go-ole -Version: v1.2.5-0.20190920104607-14974a1cf647 +Version: v1.2.6 Licence type (autodetected): MIT -------------------------------------------------------------------------------- -Contents of probable licence file $GOMODCACHE/github.com/go-ole/go-ole@v1.2.5-0.20190920104607-14974a1cf647/LICENSE: +Contents of probable licence file $GOMODCACHE/github.com/go-ole/go-ole@v1.2.6/LICENSE: The MIT License (MIT) @@ -31763,6 +31763,45 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +-------------------------------------------------------------------------------- +Dependency : github.com/lufia/plan9stats +Version: v0.0.0-20211012122336-39d0f177ccd0 +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/lufia/plan9stats@v0.0.0-20211012122336-39d0f177ccd0/LICENSE: + +BSD 3-Clause License + +Copyright (c) 2019, KADOTA, Kyohei +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +3. Neither the name of the copyright holder nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + -------------------------------------------------------------------------------- Dependency : github.com/mailru/easyjson Version: v0.7.6 @@ -33886,6 +33925,39 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +-------------------------------------------------------------------------------- +Dependency : github.com/power-devops/perfstat +Version: v0.0.0-20210106213030-5aafc221ea8c +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/power-devops/perfstat@v0.0.0-20210106213030-5aafc221ea8c/LICENSE: + +MIT License + +Copyright (c) 2020 Power DevOps + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + + + + -------------------------------------------------------------------------------- Dependency : github.com/prometheus/client_golang Version: v1.11.0 @@ -34605,6 +34677,257 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +-------------------------------------------------------------------------------- +Dependency : github.com/tklauser/go-sysconf +Version: v0.3.9 +Licence type (autodetected): BSD-3-Clause +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/tklauser/go-sysconf@v0.3.9/LICENSE: + +BSD 3-Clause License + +Copyright (c) 2018-2021, Tobias Klauser +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +* Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + +* Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +* Neither the name of the copyright holder nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +-------------------------------------------------------------------------------- +Dependency : github.com/tklauser/numcpus +Version: v0.3.0 +Licence type (autodetected): Apache-2.0 +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/tklauser/numcpus@v0.3.0/LICENSE: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "{}" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright {yyyy} Authors of Cilium + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + + -------------------------------------------------------------------------------- Dependency : github.com/ugorji/go Version: v1.1.8 @@ -35064,6 +35387,36 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +-------------------------------------------------------------------------------- +Dependency : github.com/yusufpapurcu/wmi +Version: v1.2.2 +Licence type (autodetected): MIT +-------------------------------------------------------------------------------- + +Contents of probable licence file $GOMODCACHE/github.com/yusufpapurcu/wmi@v1.2.2/LICENSE: + +The MIT License (MIT) + +Copyright (c) 2013 Stack Exchange + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + -------------------------------------------------------------------------------- Dependency : go.elastic.co/fastjson Version: v1.1.0 diff --git a/go.mod b/go.mod index 31d84ac9fa0d..bb32ba70deb7 100644 --- a/go.mod +++ b/go.mod @@ -79,7 +79,7 @@ require ( github.com/fearful-symmetry/gorapl v0.0.4 github.com/fsnotify/fsevents v0.1.1 github.com/fsnotify/fsnotify v1.5.1 - github.com/go-ole/go-ole v1.2.5-0.20190920104607-14974a1cf647 // indirect + github.com/go-ole/go-ole v1.2.6 // indirect github.com/go-sourcemap/sourcemap v2.1.2+incompatible // indirect github.com/go-sql-driver/mysql v1.5.0 github.com/go-test/deep v1.0.7 @@ -142,7 +142,6 @@ require ( github.com/samuel/go-parser v0.0.0-20130731160455-ca8abbf65d0e // indirect github.com/samuel/go-thrift v0.0.0-20140522043831-2187045faa54 github.com/sanathkr/yaml v1.0.1-0.20170819201035-0056894fa522 // indirect - github.com/shirou/gopsutil v3.20.12+incompatible github.com/shopspring/decimal v1.2.0 github.com/spf13/cobra v1.0.0 github.com/spf13/pflag v1.0.5 @@ -195,6 +194,8 @@ require ( kernel.org/pub/linux/libs/security/libcap/cap v1.2.57 ) +require github.com/shirou/gopsutil/v3 v3.21.12 + require ( cloud.google.com/go v0.97.0 // indirect code.cloudfoundry.org/gofileutils v0.0.0-20170111115228-4d0c80011a0f // indirect @@ -253,6 +254,7 @@ require ( github.com/json-iterator/go v1.1.12 // indirect github.com/karrick/godirwalk v1.15.6 // indirect github.com/klauspost/compress v1.13.6 // indirect + github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect github.com/markbates/pkger v0.17.0 // indirect github.com/mattn/go-isatty v0.0.12 // indirect github.com/mattn/go-runewidth v0.0.9 // indirect @@ -263,13 +265,17 @@ require ( github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.2 // indirect github.com/pierrec/lz4 v2.6.0+incompatible // indirect + github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect github.com/sanathkr/go-yaml v0.0.0-20170819195128-ed9d249f429b // indirect github.com/santhosh-tekuri/jsonschema v1.2.4 // indirect github.com/sergi/go-diff v1.1.0 // indirect github.com/sirupsen/logrus v1.8.1 // indirect github.com/stretchr/objx v0.2.0 // indirect + github.com/tklauser/go-sysconf v0.3.9 // indirect + github.com/tklauser/numcpus v0.3.0 // indirect github.com/urso/diag v0.0.0-20200210123136-21b3cc8eb797 // indirect github.com/xdg/stringprep v1.0.3 // indirect + github.com/yusufpapurcu/wmi v1.2.2 // indirect go.elastic.co/fastjson v1.1.0 // indirect go.opencensus.io v0.23.0 // indirect golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b // indirect diff --git a/go.sum b/go.sum index 72cd2a70666d..e2c7ed070424 100644 --- a/go.sum +++ b/go.sum @@ -616,8 +616,8 @@ github.com/go-logr/logr v1.2.0 h1:QK40JKJyMdUDz+h+xvCsru/bJhvG0UxvePV0ufL/AcE= github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-martini/martini v0.0.0-20170121215854-22fa46961aab h1:xveKWz2iaueeTaUgdetzel+U7exyigDYBryyVfV/rZk= github.com/go-martini/martini v0.0.0-20170121215854-22fa46961aab/go.mod h1:/P9AEU963A2AYjv4d1V5eVL1CQbEJq6aCNHDDjibzu8= -github.com/go-ole/go-ole v1.2.5-0.20190920104607-14974a1cf647 h1:whypLownH338a3Ork2w9t0KUKtVxbXYySuz7V1YGsJo= -github.com/go-ole/go-ole v1.2.5-0.20190920104607-14974a1cf647/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0= +github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY= +github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0= github.com/go-openapi/analysis v0.0.0-20180825180245-b006789cd277/go.mod h1:k70tL6pCuVxPJOHXQ+wIac1FUrvNkHolPie/cLEU6hI= github.com/go-openapi/analysis v0.17.0/go.mod h1:IowGgpVeD0vNm45So8nr+IcQ3pxVtpRoBWb8PVZO0ik= github.com/go-openapi/analysis v0.18.0/go.mod h1:IowGgpVeD0vNm45So8nr+IcQ3pxVtpRoBWb8PVZO0ik= @@ -1120,6 +1120,8 @@ github.com/lib/pq v1.10.3/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM= github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4= github.com/linode/linodego v0.28.5/go.mod h1:BR0gVkCJffEdIGJSl6bHR80Ty+Uvg/2jkjmrWaFectM= +github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4= +github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I= github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ= github.com/magefile/mage v1.9.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A= github.com/magefile/mage v1.11.0 h1:C/55Ywp9BpgVVclD3lRnSYCwXTYxmSppIgLeDYlNuls= @@ -1347,6 +1349,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI= github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s= +github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw= +github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE= github.com/poy/eachers v0.0.0-20181020210610-23942921fe77 h1:SNdqPRvRsVmYR0gKqFvrUKhFizPJ6yDiGQ++VAJIoDg= github.com/poy/eachers v0.0.0-20181020210610-23942921fe77/go.mod h1:x1vqpbcMW9T/KRcQ4b48diSiSVtYgvwQ5xzDByEg4WE= github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA= @@ -1449,8 +1453,8 @@ github.com/segmentio/kafka-go v0.2.0/go.mod h1:X6itGqS9L4jDletMsxZ7Dz+JFWxM6JHfP github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo= github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= -github.com/shirou/gopsutil v3.20.12+incompatible h1:6VEGkOXP/eP4o2Ilk8cSsX0PhOEfX6leqAnD+urrp9M= -github.com/shirou/gopsutil v3.20.12+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA= +github.com/shirou/gopsutil/v3 v3.21.12 h1:VoGxEW2hpmz0Vt3wUvHIl9fquzYLNpVpgNNB7pGJimA= +github.com/shirou/gopsutil/v3 v3.21.12/go.mod h1:BToYZVTlSVlfazpDDYFnsVZLaoRG+g8ufT6fPQLdJzA= github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ= github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o= github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg= @@ -1523,6 +1527,10 @@ github.com/tchap/go-patricia v2.2.6+incompatible/go.mod h1:bmLyhP68RS6kStMGxByiQ github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk= github.com/tinylib/msgp v1.0.2/go.mod h1:+d+yLhGm8mzTaHzB+wgMYrodPfmZrzkirds8fDWklFE= github.com/tinylib/msgp v1.1.0/go.mod h1:+d+yLhGm8mzTaHzB+wgMYrodPfmZrzkirds8fDWklFE= +github.com/tklauser/go-sysconf v0.3.9 h1:JeUVdAOWhhxVcU6Eqr/ATFHgXk/mmiItdKeJPev3vTo= +github.com/tklauser/go-sysconf v0.3.9/go.mod h1:11DU/5sG7UexIrp/O6g35hrWzu0JxlwQ3LSFUzyeuhs= +github.com/tklauser/numcpus v0.3.0 h1:ILuRUQBtssgnxw0XXIjKUC56fgnOrFoQQ/4+DeU2biQ= +github.com/tklauser/numcpus v0.3.0/go.mod h1:yFGUr7TUHQRAhyqBcEg0Ge34zDBAsIvJJcyE6boqnA8= github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U= github.com/tsg/go-daemon v0.0.0-20200207173439-e704b93fd89b h1:X/8hkb4rQq3+QuOxpJK7gWmAXmZucF0EI1s1BfBLq6U= @@ -1590,6 +1598,8 @@ github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1 github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= github.com/yuin/gopher-lua v0.0.0-20170403160031-b402f3114ec7 h1:0gYLpmzecnaDCoeWxSfEJ7J1b6B/67+NV++4HKQXx+Y= github.com/yuin/gopher-lua v0.0.0-20170403160031-b402f3114ec7/go.mod h1:aEV29XrmTYFr3CiRxZeGHpkvbwq+prZduBqMaascyCU= +github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg= +github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs= github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA= github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg= @@ -1939,6 +1949,7 @@ golang.org/x/sys v0.0.0-20201117170446-d9b008d0a637/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201202213521-69691e467435/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -1963,11 +1974,13 @@ golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210816074244-15123e1e1f71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210917161153-d61c044b1678/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20211013075003-97ac67df715c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20211102192858-4dd72447c267 h1:7zYaz3tjChtpayGDzu6H0hDAUM5zIGA2XW7kRNgQ0jc= golang.org/x/sys v0.0.0-20211102192858-4dd72447c267/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= diff --git a/libbeat/cmd/platformcheck/platformcheck.go b/libbeat/cmd/platformcheck/platformcheck.go index 8823ba9f896b..d0ffd2c1c87b 100644 --- a/libbeat/cmd/platformcheck/platformcheck.go +++ b/libbeat/cmd/platformcheck/platformcheck.go @@ -25,7 +25,7 @@ import ( "math/bits" "strings" - "github.com/shirou/gopsutil/host" + "github.com/shirou/gopsutil/v3/host" ) func CheckNativePlatformCompat() error { diff --git a/libbeat/metric/system/diskio/diskstat.go b/libbeat/metric/system/diskio/diskstat.go index b10b14bfdcab..598e3ca7b83e 100644 --- a/libbeat/metric/system/diskio/diskstat.go +++ b/libbeat/metric/system/diskio/diskstat.go @@ -21,7 +21,7 @@ package diskio import ( - "github.com/shirou/gopsutil/disk" + "github.com/shirou/gopsutil/v3/disk" sigar "github.com/elastic/gosigar" ) diff --git a/libbeat/metric/system/diskio/diskstat_linux.go b/libbeat/metric/system/diskio/diskstat_linux.go index fbcd6a479045..252d8e5d72fd 100644 --- a/libbeat/metric/system/diskio/diskstat_linux.go +++ b/libbeat/metric/system/diskio/diskstat_linux.go @@ -22,7 +22,7 @@ package diskio import ( "github.com/pkg/errors" - "github.com/shirou/gopsutil/disk" + "github.com/shirou/gopsutil/v3/disk" "github.com/elastic/beats/v7/libbeat/metric/system/numcpu" ) diff --git a/libbeat/metric/system/diskio/diskstat_linux_test.go b/libbeat/metric/system/diskio/diskstat_linux_test.go index 001914097f95..4e78c7d85de5 100644 --- a/libbeat/metric/system/diskio/diskstat_linux_test.go +++ b/libbeat/metric/system/diskio/diskstat_linux_test.go @@ -23,7 +23,7 @@ package diskio import ( "testing" - "github.com/shirou/gopsutil/disk" + "github.com/shirou/gopsutil/v3/disk" "github.com/stretchr/testify/assert" sigar "github.com/elastic/gosigar" diff --git a/libbeat/metric/system/diskio/diskstat_other.go b/libbeat/metric/system/diskio/diskstat_other.go index 8c53d24aea59..ec1e243e6413 100644 --- a/libbeat/metric/system/diskio/diskstat_other.go +++ b/libbeat/metric/system/diskio/diskstat_other.go @@ -22,7 +22,7 @@ package diskio import ( "github.com/pkg/errors" - "github.com/shirou/gopsutil/disk" + "github.com/shirou/gopsutil/v3/disk" ) // NewDiskIOStat :init DiskIOStat object. diff --git a/libbeat/metric/system/diskio/diskstat_windows.go b/libbeat/metric/system/diskio/diskstat_windows.go index 389e928052d2..7f181d7bc7b6 100644 --- a/libbeat/metric/system/diskio/diskstat_windows.go +++ b/libbeat/metric/system/diskio/diskstat_windows.go @@ -22,7 +22,7 @@ package diskio import ( "github.com/pkg/errors" - "github.com/shirou/gopsutil/disk" + "github.com/shirou/gopsutil/v3/disk" ) // NewDiskIOStat :init DiskIOStat object. diff --git a/libbeat/metric/system/diskio/diskstat_windows_helper.go b/libbeat/metric/system/diskio/diskstat_windows_helper.go index 50c30288ff53..619ad7cb0d0d 100644 --- a/libbeat/metric/system/diskio/diskstat_windows_helper.go +++ b/libbeat/metric/system/diskio/diskstat_windows_helper.go @@ -26,7 +26,7 @@ import ( "unsafe" "github.com/pkg/errors" - "github.com/shirou/gopsutil/disk" + "github.com/shirou/gopsutil/v3/disk" "golang.org/x/sys/windows" "golang.org/x/sys/windows/registry" diff --git a/metricbeat/internal/metrics/cpu/metrics_darwin.go b/metricbeat/internal/metrics/cpu/metrics_darwin.go index 7fe680687df1..6064fbb37006 100644 --- a/metricbeat/internal/metrics/cpu/metrics_darwin.go +++ b/metricbeat/internal/metrics/cpu/metrics_darwin.go @@ -19,7 +19,7 @@ package cpu import ( "github.com/pkg/errors" - "github.com/shirou/gopsutil/cpu" + "github.com/shirou/gopsutil/v3/cpu" "github.com/elastic/beats/v7/libbeat/metric/system/resolve" "github.com/elastic/beats/v7/libbeat/opt" diff --git a/metricbeat/module/system/network/network.go b/metricbeat/module/system/network/network.go index 7ed4199d440b..da3448f5b07d 100644 --- a/metricbeat/module/system/network/network.go +++ b/metricbeat/module/system/network/network.go @@ -29,7 +29,7 @@ import ( "github.com/elastic/beats/v7/metricbeat/mb/parse" "github.com/pkg/errors" - "github.com/shirou/gopsutil/net" + "github.com/shirou/gopsutil/v3/net" ) var debugf = logp.MakeDebug("system-network") diff --git a/metricbeat/module/system/socket_summary/socket_summary.go b/metricbeat/module/system/socket_summary/socket_summary.go index bdc89011f70e..03b88cea5130 100644 --- a/metricbeat/module/system/socket_summary/socket_summary.go +++ b/metricbeat/module/system/socket_summary/socket_summary.go @@ -21,7 +21,7 @@ import ( "syscall" "github.com/pkg/errors" - "github.com/shirou/gopsutil/net" + "github.com/shirou/gopsutil/v3/net" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/metric/system/resolve" diff --git a/metricbeat/module/system/socket_summary/socket_summary_test.go b/metricbeat/module/system/socket_summary/socket_summary_test.go index f4a57405eca9..172fbdb20ae5 100644 --- a/metricbeat/module/system/socket_summary/socket_summary_test.go +++ b/metricbeat/module/system/socket_summary/socket_summary_test.go @@ -21,7 +21,7 @@ import ( "syscall" "testing" - "github.com/shirou/gopsutil/net" + "github.com/shirou/gopsutil/v3/net" "github.com/stretchr/testify/assert" ) diff --git a/metricbeat/module/system/socket_summary/sockstat_linux.go b/metricbeat/module/system/socket_summary/sockstat_linux.go index b66b8afb7f30..8546127e6dcd 100644 --- a/metricbeat/module/system/socket_summary/sockstat_linux.go +++ b/metricbeat/module/system/socket_summary/sockstat_linux.go @@ -26,7 +26,7 @@ import ( "os" "github.com/pkg/errors" - "github.com/shirou/gopsutil/net" + "github.com/shirou/gopsutil/v3/net" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/metric/system/resolve" diff --git a/metricbeat/module/system/socket_summary/sockstat_other.go b/metricbeat/module/system/socket_summary/sockstat_other.go index 03832b40342b..f316f44c28d6 100644 --- a/metricbeat/module/system/socket_summary/sockstat_other.go +++ b/metricbeat/module/system/socket_summary/sockstat_other.go @@ -21,7 +21,7 @@ package socket_summary import ( - "github.com/shirou/gopsutil/net" + "github.com/shirou/gopsutil/v3/net" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/metric/system/resolve" From e675f4e82c7af0e97054c83eb98e85604e8ed01e Mon Sep 17 00:00:00 2001 From: DeDe Morton Date: Wed, 2 Feb 2022 14:52:50 -0800 Subject: [PATCH 20/20] Add Beats breaking changes for 7.17 (#30120) --- .../breaking/breaking-7.17.asciidoc | 18 ++++++++++++++++++ .../release-notes/breaking/breaking.asciidoc | 4 ++++ 2 files changed, 22 insertions(+) create mode 100644 libbeat/docs/release-notes/breaking/breaking-7.17.asciidoc diff --git a/libbeat/docs/release-notes/breaking/breaking-7.17.asciidoc b/libbeat/docs/release-notes/breaking/breaking-7.17.asciidoc new file mode 100644 index 000000000000..20c0ed209056 --- /dev/null +++ b/libbeat/docs/release-notes/breaking/breaking-7.17.asciidoc @@ -0,0 +1,18 @@ +[[breaking-changes-7.17]] + +=== Breaking changes in 7.17 +++++ +7.17 +++++ + +//NOTE: The notable-breaking-changes tagged regions are re-used in the +//Installation and Upgrade Guide + +// tag::notable-breaking-changes[] + +The Docker base image has changed from CentOS 7 to Ubuntu 20.04. This change +affects all {beats}. + +// end::notable-breaking-changes[] + +{see-relnotes} diff --git a/libbeat/docs/release-notes/breaking/breaking.asciidoc b/libbeat/docs/release-notes/breaking/breaking.asciidoc index 6fb7e8934607..11e6b7321e55 100644 --- a/libbeat/docs/release-notes/breaking/breaking.asciidoc +++ b/libbeat/docs/release-notes/breaking/breaking.asciidoc @@ -11,6 +11,8 @@ changes, but there are breaking changes between major versions (e.g. 6.x to See the following topics for a description of breaking changes: +* <> + * <> * <> @@ -45,6 +47,8 @@ See the following topics for a description of breaking changes: * <> +include::breaking-7.17.asciidoc[] + include::breaking-7.16.asciidoc[] include::breaking-7.15.asciidoc[]