From f17d32491e81789da50cf7a2270f61f33d6bffd4 Mon Sep 17 00:00:00 2001 From: Joshua Wright Date: Tue, 30 Apr 2019 17:11:56 -0400 Subject: [PATCH] Add password spray detection, sample evtx --- DeepBlue.ps1 | 48 +++++++++++++++++++++++++++++++++++++-- evtx/password-spray.evtx | Bin 0 -> 1118208 bytes 2 files changed, 46 insertions(+), 2 deletions(-) create mode 100755 evtx/password-spray.evtx diff --git a/DeepBlue.ps1 b/DeepBlue.ps1 index a8cfd9a..656cb26 100644 --- a/DeepBlue.ps1 +++ b/DeepBlue.ps1 @@ -62,7 +62,10 @@ function Main { # Obfuscation variables: $minpercent=.65 # minimum percentage of alphanumeric and common symbols $maxbinary=.50 # Maximum percentage of zeros and ones to detect binary encoding - # + # Password spray variables: + $passspraytrack = @{} + $passsprayuniqusermax = 6 + $passsprayloginmax = 6 # Sysmon variables: # Check for unsigned EXEs/DLLs. This can be very chatty, so it's disabled. # Set $checkunsigned to 1 to enable: @@ -191,6 +194,47 @@ function Main { Write-Output $obj } } + ElseIf($event.id -eq 4648){ + # A logon was attempted using explicit credentials. + $username=$eventXML.Event.EventData.Data[1]."#text" + $hostname=$eventXML.Event.EventData.Data[2]."#text" + $targetusername=$eventXML.Event.EventData.Data[5]."#text" + $sourceip=$eventXML.Event.EventData.Data[12]."#text" + + # For each #4648 event, increment a counter in $passspraytrack. If that counter exceeds + # $passsprayloginmax, then check for $passsprayuniqusermax also exceeding threshold and raise + # a notice. + if ($passspraytrack[$targetusername] -eq $null) { + $passspraytrack[$targetusername] = 1 + } else { + $passspraytrack[$targetusername] += 1 + } + if ($passspraytrack[$targetusername] -gt $passsprayloginmax) { + # This user account has exceedd the threshoold for explicit logins. Identify the total number + # of accounts that also have similar explicit login patterns. + $passsprayuniquser=0 + foreach($key in $passspraytrack.keys) { + if ($passspraytrack[$key] -gt $passsprayloginmax) { + $passsprayuniquser+=1 + } + } + if ($passsprayuniquser -gt $passsprayuniqusermax) { + $usernames="" + foreach($key in $passspraytrack.keys) { + $usernames += $key + $usernames += " " + } + $obj.Message = "Distributed Account Explicit Credential Use (Password Spray Attack)" + $obj.Results = "The use of multiple user account access attempts with explicit credentials is " + $obj.Results += "an indicator of a password spray attack.`n" + $obj.Results += "Target Usernames: $usernames`n" + $obj.Results += "Accessing Username: $username`n" + $obj.Results += "Accessing Host Name: $hostname`n" + Write-Output $obj + $passspraytrack = @{} # Reset + } + } + } } ElseIf ($logname -eq "System"){ if ($event.id -eq 7045){ @@ -475,7 +519,7 @@ function Create-Filter($file, $logname) # Return the Get-Winevent filter # $sys_events="7030,7036,7045,7040" - $sec_events="4688,4672,4720,4728,4732,4756,4625,4673" + $sec_events="4688,4672,4720,4728,4732,4756,4625,4673,4648" $app_events="2" $applocker_events="8003,8004,8006,8007" $powershell_events="4103,4104" diff --git a/evtx/password-spray.evtx b/evtx/password-spray.evtx new file mode 100755 index 0000000000000000000000000000000000000000..ca8929494da8bbaf12ef2f643c69d5cc4b141bf7 GIT binary patch literal 1118208 zcmeI*378y3{r~Zr+1bfvlif`SmjS{}5-@}W!WFKN17ZkA2ni?#LhfWq!X|+L9*Cd_ zDk_Kmet_bEc<@IB0SPE5hzfFwAfWzKP!U88XGCTH-)~RVZtqriL?3Fq=6T+eXEVEV z_PqKt->RwU?wZ`baLSVQ1;(Aq_LmW*+ArtGS;;gQGe~~k;?uL+%$fWaKO_%_00Iag zfB*srAb}F|Mt4o^{06!Fz>N$+TqXDKefnFIF-KN!zREt|8TR&v+ROFYt>m&l*vrSuW9sP+`Fn#MEE(Esxt65vJ5pYYo~FxfPnKoe zzt`)kUHj($-$fp0o>;t@)24P=^KLt**_d5-HD+JAom=0ngC>9T!p=uaZKaYKSo-FL zlS=xGdeYw~A93fq?!EQZ5Bz=d*Y=(+uS9P(p|f*>{HiZdPwNIYn#tyLv%oAjtL5(x z%TINwz4G?9MzhwOYTD(>RdPjRX`ERsH(PC1n*Gga`M1ixJZRX1FyUY0!xunCa zkiS-#g>uW?PKycMs8LyhnY3Wv+2X_V$POVJw;R zzkTKI^X2aaa``BE)%(fsW97Gf&7N}kIQdPl8z=W!DChgh`2sUWZnv*_uW6XjAd6?r z>-O1RncFY5C{xWOxo)`pR5kLtNF$$YHpj@~%#~HPL>_R7JXnXk0%KY$rdn=oFx5(F zfZ0JVaPPD&`}Z@m?9GGc(D;GWo0ATGl5lneF5ceGBU8`e9Xblmtj)p{q!5R?!Zl1)cl(!ya1z(dqQEl}euFG+xR61Rj=EwWn_lzcQ zmHe|y(PWycTH1Bhp1)s{2rss_4xqKaX=*5Sc8=B8Zwu!KC887MmUAUY%ai4n_1jo# z5_k1mBM(t~trfZBp>oH^hyiTPx?`!rdCqhwJ>nRkfD zKJo^cA$dI7=o-)ma!te4yZcWj*UBxbu9aALMAaN8uT-DIzS@CiNJFJGB#EFl2 zQd8H>CM9cft~^S)b%@!%QZbv#?~>c(M`CXDM^8;=Gx-^u{9cjY^ry)*C$~#3%=vGZ z^7eAu#a(aA?G737uRE^S;{H=v0~c&*%%0cUyVk1xiC53L$+a2!`yp?8Y-ZCBmVN&4 z^Pl;}=j6?6tNkVNt7`_Yo6ss|TEV8sYG@aLiOK(SlQpaFm-ow0QvVxE<7HvewO(ud za=Dwwm4dYTe&M7DM|3dU||dtE~Pt<`lD3o>|{9ZrvR#OQQ>2 zmKJu121=8tT@yY1;EJ}KyLH$9a!bjS^p1PW9kjjIG~PC6aIZT~5;A@D+J2?)T&~?& z7uI!X9vRSkVQb#{&YNl%wn0i*Mb@>E(m5na#xO~T=0<9uo*Flk|E_%RJNG~7D{mkE z%1KX*c}^<9QYnP`=2`S_-VaAN+SbCz6HbvI?JsD*;ZBLQ6v5=Q^722W`VDu#e9ooX zyU>&Ve%_~^Jn`9`W;}G-H(oyRRhOi}<~jLQ`wiNj*o^dbf8Z2Z1ntLZ%fFQ@hPM2h z$a&Jfx3-#6(lWQUX)$atTgWw9L^Tmf8`+~3)EBI+U{`CW7ieo&ZnZ6&UZCZ#s~yt| zv>oeevGf9MvAWtNT^KEA$x~{(<60KIrS_7$S`A%%Z8eg`*Gk+~_gh? z{r!T69ywv;Wxw3wikoh0KU6}bx6(=>zv`zRJxw}S8(8fSY3DiBL`XU(%k}yxNY~qi zD=MjLcb03a+8=E!^{y2?3tO$M$zzSPk2Spep8u}4)he6ZcRzdI-Ma7lX3AT+MT?u< ze@}b=jVyJ~3RiB?`X=`rY452qwy(FpZGE&Fx^8p1rDEE0pGiBD9kLD=q{_Z4!R405 z+A{8ApGlw5KGUG28|vS^8+Y%>VY8HESJ7L^`^fj&e&= z?U{9*Xhyc_Uhd`|%RN<`7E0q&Zs}jUN2Y1*BTsktZNA*T*$mR<8)cs%>HgF*H=tK{ zuUm7#MxJA;bjv2lyJ~*YQ_yZ=xn*GO_B-0=&_>JZSEbomDbJ(b<<)Y_7P)1`NLlq- zJS`GKrAWwQB?UuULf0B<|7vUbk@fVJw2W6(yL{K>dF&`KRY&rFW~pYc!K~TifrWr8>G7 zF!Q=ke5?C&ziYp>z`hj~d!JJ8itYLfSrz*;1Ei~5WW~7;~j#&C6NKQB)%zgc?mkx`5=@Lnn=1IJlboI+MS2`f4r)M`^d{emkG~R3PTz<3ir0w1K81uAA!R_6t z$!NhENz*FHmG;Y{Xz|kZNe7Dc)Uvka=Dy66%Wqzu4j@mp6_ftIU2>$GRp?i3`oSuW zPkEDEo^;$mN208kr`s(ES-i|mbl&R|G zIGQInZZOd1YUUls-V&}(`TZ!DQNG$F=3 z72V#=lW&Pv$iMlrsb&mWk_FL?Ez)@!Wb?Fs)bo9tC!62AJRM4&?3ziPt(1O~Zg-%a zmKgG+TN}uxN-j^@FRyLJYRvs(KDI7geLC11hjRJN%hSXd^R#)v<4{Xw7;#PV&9IJ^ z>z)fbtQbSGl3|SW=RCV9pn3Gp-ERw*E59G*a-5f|NipWC=zi29Nm6Z(lI3z9$7j9O zX0EGKdOpOK)mz^GaG&PM5YL^mYfDrw-`~*Y>H>RO!CU z#qUwI`i;q-Klj>M>G7zcHdnJ29)4%II^}O~=W?8vt0Q8}Rngnq>By$;rFWLJd)l*_ z7e%VN`sZ4&be~r}J@l?W2h5W{e&F((l_%{-O^-28MUNkxB{fR-_|z@#;uzhOP?uX= zyQk-Rj2%7w`QT4{KU{tC#}8b7v+|_v-jOlpsp#hPql*TumC*9** zPaoK0pC5$Fli%LC{AT4z>(fy&=BeoRZdvjJT92MOU*P}$~ z_D_pt`xQNqX=MFytxtL^EQNbX<&iD!QGUCs|r4V@_u!{qZQ; zIX!f-Yv=TQr&^rM`WL^^r+ISu&CAm)@?_Uc>P!#3K3DopwS%w6kf-FJkuFdAxlS+8 z(+PXb{!zI4 zx$^ttF2{MfIzGl+72O{{CD|__mT!Yix<5YL=4kH6ul#Yi`s9Dl;&PjnBONC=A;ugP z|2>Ny32}{7DIIr;>O;7`Kk$#3sme)ID5&KUC)Lwl#QcIbA$ zI_Ze+=@~;WO7hcK>ffWi)8jzv>Gg)+1X@^j>Jo0p>#$&p<%sWUykn9gz(M@!eE-?W=u%!}3yzb{;l{C<Xbh|?sA-!EA2O(6l1Q69v_cz{sbKlPk+AK-R9}uWrOYymnZ-8 zoy%`lp0wRNImSE{{rN7|`4j9UQt3K1+UDwp_1_AZD}O&cm*c!#&5bcvMem0f+x!WV z9hs}Ft4?XX(kTk{^x4_RJrJ%=`TcX3-@H7X5@ViXYBzx%_73N&8XrW6V?W?Ok;9 zC+Jk4={)JIm3kVse!@fH^5kz<=klAErv)+Qsp#$M>R|qay=rkXe>?7(KFyQMZ(g1j zk|(=nQfG0_pRmByC;gn4OzbI(e9&h<@^HBN_gez{Nc$kt-@o@FY-_FkEH!DwC zpH{}0r=qvBi*Wvg1!hW*&v^&iJl(SS-vZ{zZ|_`w^YV0BjCm@$y^C`D^6u@Sv>$bd z&C{TWDE<#rMmjoj+mb@2vmW!B9cuG*#=TGVX`Wnuv+|_FOPQqgz3p4t6aZakMA?p z=BnS~<9;2kPWi|8aXHS)mDZ`VW6V|2$BBw-{)D;iI8oZ(y~E~c%0D**%#q(8ce%~V zk=Cd8#F(R^`{VJ=pKzGO=R&ugo#twq&C}V9|MP!+S(jXX^YZlG81qzgU5a@Agd=Q@ zF5Kea--OGN-w$`W&CAjIV$4y|{qQ=NKViDf(*rmEHejCocFyHDFHi4}F;7Lea}my; z&|#)`ecz((-H|p=*Y!K^x8drOpC^~!ygZ#lp6r@Qoy9kQf@x~%x!uZ9c5(0O-1&Fm z^5l;bxcuhj=>sw5spxTnSm#gZ?376Y&7|}=!O=EXpFio|fVuL=30#iza&>NuxhlFp z9@qQ{J;n)+u{nC|z7A~1_?d8d z^4mL?-@H7X7h|4cXzya2KjE^9^uy>NBx>+_))m^{zhj4YtpFhFnH!DwCmoA7gPt2e2rsq$X zZFBYM+YbL@xLo<;nJ&k9x%x%?XQ^(sp-G0em1Ln#9eCP6;m!}J3 z%u~^y?_!-lK{B;mrh#9 z=6&q3AKp7{p4#u+?@!_K4=-}?$bQE{O0B96XeORnbcXF z^CxuGC;gmvl3m<)erMsI!__B$+`#2GFHfJ0F;7L08^k()LNcB9iXP(zC)->NAKd&x zxLo=DD3{~BTzx9WTov7qif#Uc$2*VSZ0vo{r~6SlL5H5^+zZFHe_{r`n21 z{~z1@2^yZ^J^SUS*yY{utC@cZSD*ZGD3{;7JY5=No{AoaigEsgzxB-1Je#MTKD;4d zp8WRCyv)YTVNOWb3?}eEnJ@bB>GlTy8)Ke|-p($<`4dW&N|L9N z?C9xEhrD6TPV&bDv(mK56$49mzkJT6bDE9WL@q6vO7c@SRii(8YBHP2&tNmiw8^zi z$xoBf-9akJ_4?lw`Ae_YMnbx4%jKdmBlH2~wB0!_zgcLSl$VVQTZNAi)yu!xKE7;gl9?=bnPz61 zqs-A}lpIEBhS^6Z!JJ`^kiW00%8fHly|*uyk6CUxCbut~xOn+8neD!Idc>ah{`(xc ze7k>19qBaYvKNLuWN-FgpJ|MK_RAyPVW5)7*+xS0Vn1VE5{hTL1Cd-eRK8O_F#FYQ zbQvD_H}|=?7EH5Ejo-XxZ-0ZmTp#=jxolyt$Eo(Q^t!Lw->1uM zr^sWj>-9K#oB#B5pBTLrr(I;3bY9-$b<5>^ ztl2~U?IpkMA#a7za&Pzat9txZE_HT3DeKCuw-qz1@@6_y9(i^0j5780gw9Ug($lTc z^=CK9+e)APba}4%a;pxxR_DZ?;=(ws#~Zs-9RKkF@}x^-B`=Tz%8>SH8d_4?Gvom^NxCF8`EqNsY1U;qU+&}z!WUi~ zAj_aP)8%MSmc+5@Mp9Fz*mrpI`ev!=^JGDnBxzYKueA2Kt^G_}Rf~eI_HjQPEY;dQ zlD?*#JGE$BIy+C5=Ws>jJ2&;07qB*2@HNR3)mHD}x*W1LjV?>`Is;N}x`aDCok~-YezCQk%qjW385o>jSw`eD&^4NwYXl9;QPu71Ee(<)`YZ z^1>sk<~Vs}`W*Jv4KzaX+F@6@TP*bK z9J_VjcW|%!PLlVfHWbAWO zy4$*vUT&$FHeJ%pXVRkCkxXpRt<$}XjkRUm$3Bxjqm><$lv{Vt>{nQ=-8)k^{k&Pr zEVW3N`QJXXc1$~xh;*cEn`+Oj>qOVhHr>nJ++(??is?cTE4TEo-6PYq*0gq)DP0H6 zW{@u5DEkb_+rE~$0lmsvx8{J2JjYZiM-yc2>M;jv<*?i$-@E8@>}a1uyWCd4DoI!= z&!hEzwJc4G+_GY%VU$L3Nb*5tnDpiKV~qQVqTk`@?|QkrPCxu?EkClJOkeivCrLXz zU0&@}S!2CV8?V6|zgDVyavCF_HO5Mly3xJ+%(mK}O!}45LNB#<9rBN*FZCRE(0=7x z^*PZWZ+HFJyw8bOUTYU@x>S#z9n4W?c2ZIFSSC8N#VD^e8YRYSBvINnY3*5LcE0?) znQLcWI`x`$2aRtSaaW7Jd(!Qf*5H99tuczdk#q9t9#^mx1WM)h>nA#E>* z%a#AVpv!SyuC9tPS4Dr%9NWBTwl1f)tI`iZdivJ&H}q+qTz>QN^jY#$TQTYXqnj74 z*5123X`RxKZF(B8*Q{5<)hB;@Vwc~nJn4A*=VHuL(c2TpIxm{7Q|WeZc`a6^^GB}- z%$2_%jmvRXu5{e}>KJoX^nNsP&Wl!ZbxO}y*gS1N^|P;rt5g2>f-b*#dHQ^ec`EvQ z!T9DyOFrkO^R&|D>5J12c`aO?{OuN8ezWqV?cNt+%u~_Z!RUBfd-Bb~3i%|vTE=OM zA3uu-^sDli%LC{O0B9i!tV@==LtodC|J^r2Q!U{!UNhU;NO9aP`UW zm%IGt<>^Z?=Bem@d93rI_3D@F@n7}3Og+tfdAGlZ%awoJPM71nTwN1mu8KbXYh3f9 zmD2N~t**t$jOqVyz#RGgahKby9O>t~FUOdpqWk0V&5PEfKd!l2WAn7*wAHWoWnFUl z&B~MZ$FGesPes?IxaLLcQI}4)IU2rt^M8cPk>3w@xy{SbS7OXj(f#l^=SA!4hwJCN zGi;t#UjChcdGgyim*1>BX*>7T81qzgI~U))Xvy{#>2ZR!Hcu}+JLjL_>XV-*m*1>B zX*>5d@?_Uc>MXu_(R$=b#|d>##n4{vqXNhlKG}$K1^`Eppy~pP1XIK6yV4nQ;&gC~RPuItorx@Bh-I`hV zvC^GsR>-!fF?@Gtw}Vc%cki{idSI)II>Xf|zrAxg&dQbcqrMSiu8ME(VwxANtG&~H z)B9|W+6Rm^7j-^bs%=nxx9pSnR&Gb`=g8$YD@WRI`X)KDYbJFT*Su(L>F-zGZx{3Q z8y*XoBfsC|a+{Zcyl5`JS$Wd-?S>fh z#Jp%5+jFYT^_w(bAF#PP{<>|-;d14VXSy8cCc=z!+^k4=tRHG3Hom2i3T`{ypdd3m}y#yl0>KaX)yF(ty3Sic^W%sL%=-w+ts=J=H=qq`?HC%o2^W^fI zl_wpKT1TEz4W0cp&Uw*#d@uYFyQo7qKd4{0Jo)1WF28wsx-G^$6+Lbc>%3@od@en1 zaG}lBq=w%G%$47dayib*m5v+S9%HVG?nlKoFPildI zPulK%mps`ulRArSUNpPiN;*#;wTt`2(%t%p%acD2cFPd!o zo6gh6Y@Y5}cz?h=`Sr==H!n|j#F(d|+q>B2Ma!s9AGdkBXlzGwxccPh$>ldMPj`~1 zR6}Qfjcs1EUU|}f`NeiouQ+hi0parGAE(vjH!n}$k1+Ase>jJYbh9~I-gX!0F#x*zpPo2S3;bn?J(b;{3^%Wqzu?jlci z&7{s^oENQEo<3z4_wml|O#qa-5Yb?U(;3##|LW9#sePCtPmxboq;)YztSX{5-k* z=H=)Y#lHxc zD}Vbam*c!#-5X=Bir(I?4(3nzADgEy-1?ru;p&t>e&F((l_%|=-xp(^iXK0xgZUHw z*XHT0Gq&9%T%P>#1DD^tJpDArJQY2DPzUoTTw(Kc#gMxL=E-mGTz<3iq@VNdk14M8xy{Ov_QxNJF-JxB$LnDJgwNSLJ$2D>oAqT~ za{0~6)59_5spz^C@%#x_+Z?U^;A;VMFMVW+oCV?6jWQGDuldPeddo#-=gZHVxpwBIQ?FTf(D;TCceV7s zN9}O`ug9T)#)jCo@Igf~5Z!q;uCzIf5VZNlZsA0Kx)&db%WV$4<1A4gQ_R|qa z@7O%;c-pL;!__B0PcFY%dD8aoIr5Zh=b zp0wS2fjrqYlRB$|`4eupi@U7#xqx}{x3hEk&CAnYV$4&~+u7B@{0ZN+d3tH`#UuK% zKDqqn<>{|6=BeoRF2?Q4d(EHlJ)5Ve*N+_;E>C{H+~qefPk)OsPsR7k>t_ChJ8Z62 zJ^N_DT>0Y%F2{MfS|4MsiXM-ugZUHgw0YWR=-OSw)hRzuF28wsdXYTYHIq84gZUG_ zZx?smfT6pE%agy|fy-}Jo^;&cr5N*6^mYezG=IVmY_9Ge_}zfH^0$w2InK(Jjvu@n zW3Gzc-mVVjPq@qG>B5ueyggi<^2ZNce)ID5N{o3bditxNxk zF;7Leb9FF(!cT3UW}msu*uKn@%Wqzu-XKqQ&7{uiVE%;r?c%n-^8J8$^2Z5We)ICw z8DpM`9w(@y`4b+nx%$w=MSF&;Q+|KkkM{JI6UACc5bL4WHl_MQ5sE{MOW>RMn&Yxf| ztC%At-nz+yF^#1GG6l*?`B$6R4fb-q>=5&eqa+&MLm=DWOb*a7b z_O?c|R^9{ca^)(yqOmm2ES8(CmUqJbX0-fUB@+cLmOGy+@0C?%cRBApz0mG*ixqPD zXqj9{Cl4BJ#+p6k-(K?D9`aTgE%$a$zpBSyo&nUgU z37wrM$a1+gy8i4Yd0Xk^MyJbj&6its$hCXR&lDHNX+7T9tujKSFXB)M+5{8Tk^`Y+sPmL7SPl6!>Uq^Rwk=OiS%Yt z#44pmvy=Sc-Z@JjY?8vYK)lb8rRoq9eHrD}MzdK(*pHS!K4~9u{Kp5#lP-~!yueJ9 zn=X(A&{Z^FZjfy?@DYQ$`WSXj4T6NW)zh9FGFSfQ0ptZkgYA6j#;-tk`Pal+sPLx~Dl^`uo zmRnbve4?$CIy(=Q8)#M26*qo)Qv!9WL_rs>_FgGBmf9rNlQ+_8sklCnE5%pu-Xyo~ zIb)bH+sZAft|~7)qH2zlSEkQlU)?}6q@mI}*lb^UQ>|!4+Ee{$N+u1H#kZ#^()Q|9 zV)~K&lFIga>6>UpFOV#1Z>+J%-k2_{&X9J&Lyw#=^0HrUam7uywI3>p(;_YFYH#^f zTUR|zI#+|_s^p|3)N|!>t$&l{Tw7bs(}gQ4vhwuJr`PT*KUJ-JjipvuLuB(yzSM?7 zn}P28muvUm)82n0OMQggf06twmk{YvH`GeeNPEw%x}UkfR7!VSSJKNZ71O3mn)ysx zG&|(c7YLqwBh$3jw04&%T?fr(kS^aS`wYq3zLuN; zy~DGNF?Bn+<-^}NoH&dzo`Mq2}w)f{9SE;K-R_ay( z$(p~C`MowazgMTu7pJ+>`Qv_`q{^80?)3YBx$?K)a5>J)RlgW>RrK~7@y+igeT>E= zN3KpiX7lvV7e2gixH{#3|KReQm#3x}^HlWr53$bgW$RPAPCagOb?1b)?-wpt{(k)~ z$9cKxA7ieHK2Ahz^Lt4@KV7G^-TQ^j)8-={4wxtZdv}-LygW6>n5Uxq=P}OjC0{VO z`FHjF37e-YM|JEUu0HvBa{0~6(*W{h*G%dx#`(Rr?wO}2?cyHw(BSdm^5nO7F28ws z8W>}qif`}Yn%_$Yw0h;~DVwM3uDKy#p8WkjTz<3iq}v6x#F(d|_xp%*ey<+w-7jsP z&c1H;0paSCpC^~!tUT#A2d(7Eu9?(Xob!A27&rKpUEB{<{t+-w{XhG)ayib+)u0%2Rdhcpw)wqmp3ZTAL~r&NPye~oQ^FUiyCvS{f%{l+fp4#S=gm?wYSz~wh9PulKn5@Vi< z9*2r?ey?76`mN2=zkdF)gZr{Rx%_73N$b;)81qzgdl%dMUQ(ad_R7=mY@Tj>Y4jm| znJ1UutUPIb+LS!mHIq7vZGJDw)0wF}>Gye0+r`~}@uLCrtxuc9n5W|B z5r}nuFLRdUDEN4Xql-o?0m`GB!qdD4E=vo=rT zzST4-T%P=Xxyx@}o`%Mlr{eqNvCi+6?0=o^m;cG;YU{sVA23(`_b)ETS-H}F)K)R( zs_5~k*yi^t-JRqq-R?bS^R&Z5GbV?tQ+}RYe)ICQHF>gYCUq9u{9c`pmUJghmnW@L z&)da4b@NvP=E>jgz~whDPus+pr=qtzh;@E1Tc^_P-k)u*)-3+?lyG&*-#*IaI4@Vj zV$4<1+uOxCzgJhC(t7oR&C`!xJMge@dGf~(Tz<3iq@VY;jWJI}j~_%hzgN25(>(pf z=IM~RzX_Npf4tn~H!n}y#h9m}#}8th-z(LR(mc5XS*=-o!QtWRli%LC{O09p`xx_7 zbbA-){9aw{o%W;L0nHA$W4Ec{^5pl+U4HZOv_p(}D!N}D>-=85`sIg9uGZUj@6*E` z3YaVZIHoSgdAZs###|MB9Mibw_cEFvcifB@ZI1qY_}X`bt51G^+~qbeM?1xsqoVuc z5zg_^Hg+Qifewa9(Czuo1^bu`lEn3^84W~ zw|P0*CB_^T-4Bm*ey^^6xPGpC#pY?<@7s?ESC{;D&gC~RPs3x(Q_<~QeDiymk4kPW$5t_t5be|+~qhgSG&fTtD^hkan0}5 zqd)$4o1+h$*mzX99Qog~xZLLDXtx-1RQ&fW@y+jLkJIXoulc&o)6++NHDI3n_Ri%u zFHdieF;6kHcY3sJox?*XYgi#i&z>Z6JWQ7(X-}1-f%iUb{P_MGzt$ake~ipyGghW+ z*w_((rG5LPJa@Xi`-feYOU4{?bhtX@w|6ebS-H~fG)KjltK!?cnCAEDYVWk)^iP|k zD?a^VpXSKrHZMoJlcV0%#w3%P=&F5 z%fAblD}Q|4qyE>QOtUT%X_&zb_sp#$M>R|qas?F1)ug;ns zu0HvBa{0~6)4t@X)^Mc%uY>s$`q@0~HRJCA^W={kxcuhjX}=irRP?w(9nGK6WOMb0 zk6(3sxH{$cqg;;ja|8bo^;&c zz!>vXbbA-!{0U#^Ri6ghJpHue?eFT#Jh}X4Et~g4wxtZIIS+fd3icG#yk~&oYrXPPxzAL%5DFv{is%(tNmVIePXye<@cjpj`MPL zNQ}8Ex*rwe{0ZOM^KI#Vd7I7C&(?4C?!L^E%WqzuCXlCei&y(S#`zO=eY{7W2H8A) zbgS;KVeIor;|5%B4D2U@p6~ntUPJI{2ejo zsp#>8I+#Dt1^%hR+N^Hg+uR|oSa47GXM^gY|n50@vuU+(go zl_zcQj)*Z&Mfc0=X#Rw)Y_86F;qHLB@{beca-5YbZTF_fn5&|X6BY6N30u4RwCAD) z;p&s$A9uOU%8}NmBV)`_(f#o{m_K0~o2Sz+Xk8dCPZ@Q|<~J)(T9=NBF;7L;rHJQG z7-n;{^4m8A%#q&@ce%~Vk=CW7W6V*}{qQ=NKVe&&r^csdE(%wd{C3XeH!DwCmyU@s zPer$L5ze1*bFb}IwzGL!I^pkqnkSdvygbbyPyY9J5ze1*ODa#g-OBbhPvxVpUL3AI z`QrpGzj=8&HpV;^Jx&nu{0TdrHfv|MJ-HsobqANLHItTv%az|BcR9|>)yx=kRdjzm z;`tMHv^o0a4u1%kBmaArvdwK)jpaE zyT4C!bf?QlOmE@;vsz!hGBnQox zpTTC3X_IT4lAk7{Z&x?Hj4@N>FTGwn8-BmZ$%eH!n{w zk|(=nQfIO4-=g(tYg2N0($9C_w~IS&z|h^o<;fo}aQV&3la4>V6l0!>9xsS>{}x-P z+<1ZJ>jyShcMtq-z+Cy;8Mqv0*i=l(5SbxQMem(A0KC(n6%xH{!; zXW;Uim#0@^%u~_Z8AP~$OS;|DJl$>cbo1+#QQ`9Bj~}@F=H=Ox1{<} znx`MyJWV_1+JJfT+dG%vyga=YW1fm`@8aCQrK`Que$+iSPs5)+eD`qm$?uoD{O09p zLyUPUx?dja{w=-w<+|Off zUpzWoee(O`F1L9(dOgM*72O|?aQ~Kce_ZR*Pi&rM%^$r-xIFoF$>ldIPdX0uj~Me* zbX|&T|CSzg>0X_8G&lq!5bU!@K{ad>F;rhAmKAWd?e_1;w zTwU_pIhWt8JZW9}SB!Zox}A$}|CTl*-jp57o& zcFm;D;@iKaN1k+?;C{Qf?XP@4V4nPO0+-*sJaxvHr=rIRV%@*RZrkI&ztjHs12$J5 znz(4saCOS>kGmY_<;ujkeO=N0@woPH>Cqp5(B|mTh0S|~%aQ**i_2|Zj!H4+sQB+$ z;@iJPwh43nC#_Ep**tB3&GiBESfT%GdUJD20UTs6d)tK!?cnD%e!YVWk)^oY&Tt;;s_X^vcOvvQ>41r>5+*G%dx zuKiouG(YCDiaFBEHM+@zF^#1GvI+l6`S+ji-y(YhOfxghQRZmb58xeUhS^89Q=egu zkiW00Hl!4c88bq6n32Y literal 0 HcmV?d00001