+
+
+
+
+
## Excelでの解析

@@ -160,10 +168,6 @@ Hayabusaは従来のWindowsイベントログ分析解析と比較して、分

-## HTMLの結果サマリ
-
-
-
# タイムラインのサンプル結果
CSVのタイムライン結果のサンプルは[こちら](https://github.com/Yamato-Security/hayabusa/tree/main/sample-results)で確認できます。
@@ -298,7 +302,7 @@ cargo build --release --target=x86_64-unknown-linux-musl
```
MUSLバイナリは`./target/x86_64-unknown-linux-musl/release/`ディレクトリ配下に作成されます。
-MUSLバイナリはGNUバイナリより約15%遅いです。
+MUSLバイナリはGNUバイナリより約15%遅いですが、より多くのLinuxバージョンとディストロで実行できます。
## Linuxでのコンパイルの注意点
@@ -847,7 +851,7 @@ Hayabusaルールは、Windowsのイベントログ解析専用に設計され
1. [Rust正規表現クレート](https://docs.rs/regex/1.5.4/regex/)では機能しない正規表現を使用するルール。
2. [Sigmaルール仕様](https://github.com/SigmaHQ/Sigma/wiki/Specification)の`count`以外の集計式。
-3. `|near`を使用するルール。
+3. `|near`または`|base64offset|contains`を使用するルール。
## 検知ルールのチューニング
diff --git a/README.md b/README.md
index bce1b63b..a5e698df 100644
--- a/README.md
+++ b/README.md
@@ -35,12 +35,12 @@ Hayabusa is a **Windows event log fast forensics timeline generator** and **thre
- [Terminal Output](#terminal-output)
- [Event Fequency Timeline (`-V` option)](#event-fequency-timeline--v-option)
- [Results Summary](#results-summary)
+ - [HTML Results Summary (`-H` option)](#html-results-summary--h-option)
- [Analysis in Excel](#analysis-in-excel)
- [Analysis in Timeline Explorer](#analysis-in-timeline-explorer)
- [Critical Alert Filtering and Computer Grouping in Timeline Explorer](#critical-alert-filtering-and-computer-grouping-in-timeline-explorer)
- [Analysis with the Elastic Stack Dashboard](#analysis-with-the-elastic-stack-dashboard)
- [Analysis in Timesketch](#analysis-in-timesketch)
- - [HTML Results Summary](#html-results-summary)
- [Analyzing Sample Timeline Results](#analyzing-sample-timeline-results)
- [Features](#features)
- [Downloads](#downloads)
@@ -130,6 +130,14 @@ Hayabusa hopes to let analysts get 80% of their work done in 20% of the time whe

+## HTML Results Summary (`-H` option)
+
+
+
+
+
+
+
## Analysis in Excel

@@ -152,10 +160,6 @@ Hayabusa hopes to let analysts get 80% of their work done in 20% of the time whe

-## HTML Results Summary
-
-
-
# Analyzing Sample Timeline Results
You can check out a sample CSV timeline [here](https://github.com/Yamato-Security/hayabusa/tree/main/sample-results).
@@ -293,7 +297,7 @@ cargo build --release --target=x86_64-unknown-linux-musl
```
The MUSL binary will be created in the `./target/x86_64-unknown-linux-musl/release/` directory.
-MUSL binaries are are about 15% slower than the GNU binaries.
+MUSL binaries are are about 15% slower than the GNU binaries, however, they are more portable accross different versions and distributions of linux.
# Running Hayabusa
@@ -837,7 +841,7 @@ Hayabusa rules are designed solely for Windows event log analysis and have the f
1. Rules that use regular expressions that do not work with the [Rust regex crate](https://docs.rs/regex/1.5.4/regex/)
2. Aggregation expressions besides `count` in the [sigma rule specification](https://github.com/SigmaHQ/sigma/wiki/Specification).
-3. Rules that use `|near`.
+3. Rules that use `|near` or `|base64offset|contains`.
## Detection Rule Tuning
diff --git a/rules b/rules
index 428abf7c..28c1de32 160000
--- a/rules
+++ b/rules
@@ -1 +1 @@
-Subproject commit 428abf7caa12a5170582b09342924e382bd333a0
+Subproject commit 28c1de3279a62f2bf9ae01327e0df0fe4fba443a
diff --git a/screenshots/HTML-ResultsSummary-1.png b/screenshots/HTML-ResultsSummary-1.png
new file mode 100644
index 0000000000000000000000000000000000000000..a0f6fa791a48e8d2093f8f64d849f76e07e0ffc6
GIT binary patch
literal 714233
zcmagF19)Xm(m#IVi6;}A6WhiFlT2*ewr$(CZD(TJ=ES(M@y~a6fA8+|{`cKI_vz>K
zsqRl#cXgfasycl`Wu$(>!(hPx004L~Q6V`10Ak=XaejgPq!7pBtpEUUyrzPJGGc;)
z1TuEkMy3{q0Dx#{qB4|<{0Lf>dRz>@iLXpSz$Q4-u_$zIAT6#%00}=i1EgOVE-I=9
zEG1e^ZaEQ56-11%aQ`IH@{68;fGWCUEtRz#|B~mv`;Djl;qQ-(r>RtXB4-T@OIX`&LCMgXTY>60DNhuKY`FD&=6Hn4`kuM9Zv-@LcFB`Jo{rD)S(d*S zB}vhxDmVrgnUB{;Qjd(@P>OZfPxbu43+h0|eF&gk4q862YksYo+8T4{u|1{Ksu{dX z*2wZQ7Wjz6?fsf7-VUO|h!1o?yo!%l+d9X?s*$=s68r8#vO@^mr^30IUyHV;K*$Yd zeE~uvUowQ0@EQMLXq*)IK_(3eKOtdB_t_7_ts}d=E9etR6?^~d8UaT7FU_?t=Uo0` zXNV*eg8EP3pC8E#)u(Iy5u~Ev?g_w}AzHy!LX
Nm0wkz_@F?)|3i+aY8*Wn$g38Dru2POs6t z>;ZBHkY;hlg^NK!UZCJxt~0NC1~5keh>- ZI-vFlA`c%ON)wK^4P z##GFXp98K^LfGVWk=4zzik(Iy{W?x_FKRjod%RWtOo|6%qvG=FF?N+-NCCs>utbF` zm7A)=_fxM4p*_B+A1{BV&Ao$fLj#Y7d>Mi%KOV~SpI_et^?fZ(@?tc{RJwTj8xYkG z2I0RsDW9YmaUxS3F_{YNZ9?=PS%jcP$ntLOzLod>mKpEtJ`cR}kRp{8664CIC8#*N z57cmM?=@8q&_Gr$U;aLP$Sc+CBrFSWCT}dr7w~RM(UpHU;u^qP`qox_C#;pZy8hRj zv!AS!V-@Bnm*z4IvtV2&9pcrJb6Cwt^GR9er4Z=s2OBBD75(3R-MLqU?@ KpEO>h}cH6=`3Rlw-lG54QGe#F` zTDOa9wy;;#vWtKbo;%v=KQ5JIK+oAFb@A9<{(QuuZ19#hKjc^FD+Ow3@QRBq%{yv= zq+W&Ckc%Tb2Gb(O24g)c@ikfkKCC3Xd2anqI~?+f%m&BUVdkU1x>a}g`$!?o+RK+H z(m~STOqch0`3GRwxdm3A@|4aPsiPqYIq5){bAn3m+|qJ8g f4o)~MQcM#kOMv)o=)}6uZ?|NzDLr}C6N3yqvlW#Orp)A z>hF?4Rq;!oj#Ds sn|w#AI%^POLU zPHqo>23q*#KNlkLFM^(+KH4ml#YN4@6riJQ_B`uxZqon=4z6$%&Aom)jsi ?(QHZQ_lU@QE$9-~z8B7E0Y@zUdHZI@4y3K)zzr_cw5I>G-8o1;mO|B_a-yb3E8 z{4~7VuxL^iJ=c;QY`52kPtEeTPr#(IOh6aUZmF1BPNsA#`Ey XfF|mJ@R1 zz9?7GG2{|8`{>OFeeHeIC`G~G 0Ic!}(yUbbSjgabR zy+dt2i}y&r@6#lNK*im%^V1E*lA4>>>m3j5twRkt4xFZMi>~Pv+HE0EF8OfGI30hB zkn85Z#s48U4e}x9IB(V5LH*d(vTfrL2?w4{*J&az4Dn;#mkSCrfdXw*DFXzuRGRJ( zmaji${heM->Bf2(2g(ZuS^ZU9wECIPl9)RYcc>~?XX1!oAE$Wqwk&YLmhP)aB%+FX z<&HR?hjM(;XVN^MUY4)?%y&S2f#J<1&joUZW%{^df)qck3E~rrTJr@v#Qu2eV4Vei z{*aV3T1Ic(w-f)-B!SuxYZ-lPanmqPyTwHml)-&hqM)s&Uu }m=8d`#YWOPB8S9mR6srGU~(Iq&&MPbpLq(FThd;qwH5Po;ck z#+q6M>pv8_Q1_>{-%?Ou`Ic}`J5qj3tRfj0b(v?}j2TMOR05yHDFf+JA?<{!K^Dm$ zyvJ2b!r4T7zKOiPjbJYSDg?N58@31#5fZ>n$K0{Y*rp2lRp$Aw`NQ}uuxz3hn$&88 z7P)WS^TjBU-5 (iwNmyrVr$DXOJTk;1_!ytUN@eJdcHC=qhINkl)h9i z+-O)AWPq!=j^+W5bJ5v*Ep$?QM#f&(w@6~pVZ6)%^}S>pysi;6JOo>Is(-xq^D8X+ zWdcmwSnJcSWRZKPivwyf30~XkDjsy3ce9-=>|ZyX>t|VE4xCF7S<+4387+~yB|#ia z0J|YI=RW>O>>!MT?R{0-^)p|12ci`oba7Oh FmrQS>DT&DsR$@~~j0 z81XkYZP!RzjYBpYz66mF4pvdArW8hU|J}%fm<+zS&B;rA;fEVfb!v7VDrkxNEHd_` z<%64CQX+ohH(6855Mbb5+rhWuYn01#OPLd_U5TN4(ubq>g%$mxgdyJ`>(#a|32bJB z{t?VDFUBxyu6-$T)aR&0JWhAz$V>naTGGE*RPnm$T7P#$VChDz!vA3QdyFj`9|gA9 zw-(frqZz7E!ed%uuRfPUpBTeh_Pwf4KN1<0Vyv8S6hkhwvmx1*tQwd=^_#a;VI#)p zOk&_ARr;}k9<7J~&LMY%-p($~feT)PAgqH5M^EhN>S5kbU)n8QakTN9WVs&zRHTqC zQA`%- od+<&|*_Ja>h-d`%VO$$B FqM! z2D|`!%e6x9A}YDhW$TbgebcU@6=!cqLH)fTr#9N*_0+E9YS*8xU1j#X?b?9*ESw7L z7<~72!kF5 +|K|6fg((XHKV0s`l z*+DE#Y=w%Dxw=-$2P1`DyxE$}bQz`!V^6d^yTi+g+QS;HseRyiIdKd$1S$>N!d{5` zuFDadyb|b2f3P>sHsPKnls i zrY0>ioo_>rS>UdL$CV_>z_BN6+v?k*)kqr Yx=#dfMa3p3M1r;~2yk_z} zyyt=0p9faRt+_KI-grNxytx?-fww`up_15lxAl3fnzgl Nqp?R)`z(m#J(&eI+`nYB(u=Kk=hLdzmFM1wGST*>3LPn}YlO0ajI>PR z;YP#6LPp7BTHfa#19|S@1q-0M5}8SB=iY#F3-hhm69;4Gi_JXjDDd8WE&{~_Lkj&? zu{Tk4txi>#IMh)mS`y9t5U@0*LpJgn^Zh?t#u?SaIONVUSp*Y}|NLamsuS`+@*Tje zO%)ei7A>X3#VsF?l0FtyrNPq-+oZLrESWRebcwq~@^CTy0)G+^Cv@yt{;M>o+Brr} zO%LK~na)2p+A*1?&fC!gjbyy*1lDnmtg|f`(GtAr3Hw=bsWF4I?5=Xd>q1n2A6U_5 z;VVz~7HQL9UiqR`9NOH}vxa+9HTb~AxhbLX5C9LGobN7Qm<&&{;RzplN!aDwa~)RU zr$G!nc;(gfJmuoozjJ=mRIVr4gAR9|i_xzA(YaEiC}Z zw1 #S)gnkuy(SR97_igQ3!{%v5_jS3_n$4`mM0Ewdr1{>W>=j=u{%V;C z$T#q~!4wh27W7KRjP{l3z`MvD75S}fqj%uhcFRj6^;EisfH9u*lJCiE!OM{IsfqUJ z2aQ!QnGXNFp8_KcEZG5uD>gZ2ZRJ?Y>fmnoAw7cinXBq$W5yul+E+FN5T1Ne$Ss1L zVaEPLZw0Pxa5|#yg^@D*vnyBx^KH81ju5wmzKMw>!Ui>6S@&|Rh8UMOF910M8Nh5s zxMJ}s<^e3;GX;j1V0hqh3+nxdJh-Mt01>#4=g}+`+{9;eoM>1=*-=7+mwRWLavIN(ig-+B@Z|Q?VNw6#x> *X3i=FcRUT5~-u5qQdu``8)bNh@xnS| cG6xBgSPgf?v&`V`Jkt$RTTCL z-!(zn$Ag$LDB7f*ifrXPha<%MYC+sCq>s`4bOW|7PeE?<-%QPZ&pB9@KehkdcX pKJ3@IF(CALoMDfp^>^r!px{ZSGMWT#^*%7V|sHwnYU z!Zu+%m$@Lah}nRiCpB<6U4(ED>A~HVx}sVg&g&!?)AghBI-A>qfk$`6UK>BRKiC7$ zYc6){j)NMd^OiBow}~Gpi$Wb!^ad%M+;^PUsan*jMc2z_avh9ZyOnD1Tku$CGVGr+ znRCXa9egu(raVgyZ}4kQYdAbv{Dz`FD3j6NZs!@a_ttK@s7iy>XWHOZ?KKRtnXf3s z;4e-Il(uVD)O=2+HPPC0*?5BA`z(Mx*Q=J+M~|RWq>HI_G)r`|s(q8RAw$WyRf#Z< zM@7`(-%qntGV1f9-%dpflc!Q9Vn4MHKQ*_H5Xxmd{ f+cjUu=|;BX`x2jlkNd+Fr77yXp8s|NSb!>S==@SXx(`&|C!t!op=g~iPi z|2m3g!v`(-;v&p92B1Z^5cS80Ow;c(6wLr4jpmw6QhLvBt#m`-#7v)-l`$9I>e=~Z zRJ>e|#1_piP*A70a@bH#@}%kColga4bAlwG8~TrlC01yE6qV$DDeDiLf1N*R-J5s! zwEG-QA;$ka^Fp#ks{PtK=40BSLxRnH#wxHOa6Js=HE~)`NySoIIlVorqY2DJ$2P*j zs1`Hd6*Fu}*wX#sX8AHE7wh;iLcZWqbyp!9YV3!EPL0Yf^Z%rFM3Xu*knSV4tks{} z_TV|43|v>xtcdY{KwE2knFLvw^&msh#vzY$CHSLF`dRA|`^(ZT&Fff8tAvA%c|nw& z7wz%WcW_;csxt|zxC`z@nn!x&jvMMl#EpSIhq3*Xg*qm|Ut^i0;rb1(ETLIYg#Xgp zG@|>?9k1Yss}0%i)}K}kjb`AH&$+=mkka51lA$vuH|ZI_h991S^r1mrZQn^Ml!QEg z)01~S$WJrCd4PG_S->gCK(plQ{MgT|Gq?fQfkhm=apQO2!{hPt!q@xaoA29w&bI|$ zej3YrEi<4no`1`U-)`u9NH=AWDQ;b*ZT+>Qs>tY?%7@p#Snsz&&73+C+VEVLT2-Ui zX>z>QiQNoyIjhF%KFVxY{c%2&7V_%dN_(HnX{k)tj`)?X!G?%^Tf!;F?2z$iaNjRc zsruylwXrTgxv32`g6c^QLCL}+IL(hX&E*PJ*C3uZrH)M~UFI0S)FS~>ZkOg7{z>-D zJORp9PKSe0P8W71dp;44z~h>zKy(&n9=#i*D#V-7(fh4nA2y2@!Tt6@wg!Ipq|}iM zx<*l= jnr7#33*c Ac1^-(}wX-_K&;V z)lCQM5WM|@w`jl(LYK}Pf#!D&&>g7aO5=j9-n%;(ea}l%3G$agcls5JQ8t7GK36u} zd@%FdNTk !Z*!sDij;6G0YmbL1|j(N$`I-YHa2K#9`Z6}1`7T1Mp zaOQo3?kRXt#85pV=ed`-gXD03AsJ)i$d0|8FM|b$@QgOR#a!QL>Ck)dv}i$p-f)Ih z&~JGsZ+cg2HdjhFR_UhxoHeyv=sI6-pb +z*|ZO+NTyww)Qp!G97W%!?X&jke4 z vn$8vOd6*z;NWAqQ?GWe%af%C2GFH z>pnU*D$6AH;3-pfldhIMh3MPb^3WIw4az#AM>-*uvM4JE1hWtLYPBKlWhiOnIIvL8 z$|Cb3!G$Q5SUfXns%ym7S~kyF v=@6TAWInm2)xHg?|>$s@!j$(M8NBy*k zSee3KCz(;r)OqQ?`^wN9p4lE9%9G0Q@~GspOXGk*pY(#LFM}h-d(Vj#V|QX<3_))` zblIQ}*k+cIkWvmkFXJL8B}AWEw_b~OKH3YuIC6AzR+(jIT9hgA7IQS94D&mrd##<> zwtC_kBV&;Rq(6w%z*_@gmnH}b`f5Ixk~-u410m;xH{2{P%1)6B9sQwP>x+l{gVUVW zTWOsCILUMB@H>_aC;jZXWPPp<1Df|bG#&w@;Zhe|qEAipXt&W-tSu9i4{4=F54)(Y z$3S@uFwcp=bbuh`7V^=YYO3JUONAPRPAZ_Pxj*m?v|cag`xo$LTAE3Q!WzCX2t9U1 z`H#y?QR}B7#hGNnHScPrIwE!F%9IoLXiEUfa7)CleEw{)W5s_ Km`Q0(wV(!_H{ zc=+z$fXtKKUAi8xhDByUI`jKvAswH;+|7C?Sku4H-adCcp1XW (_%4Wo#E_5%@J~l&+Mo#;NiSW#9|XSW-yUa^;`O`Jd*za +{CMtj)acYZU%6oPM?`;C z)&-MT0$%)U$Wm@t_%P*)>p+~aW@EDZS-ik{Y!~$D>8Q&RsFZMGC5D^tDO7J;BFJE# ztBVdLX?{z!`1}?I>QT?C;vXQPebDfw&$nbp4Hs(G0XT&O8E`L^SbQ@g8u<6m_@kvt zul~!FjdleN2b$?pBoTfk2eP_EDDpt?WsU5snjn{SGhAI=nv5~lOdDsh`h<{2`920s zQq<43lZY19A4WueaDI1ptBmuwSob%Rlk>Hrw0QfJ=@XAnm&;niujcIwrnb7(lZSoZ zv9uN}(Mg3EKl{tGlv>Z}O>TKC^iy+kJ-68|<(YKp*3L-Gch7}}kqEQwiZXvi>Fn3! z*R4#nw{cDdg>#9F8VnQ#Unh<1A9!&he-Rhp5G-_vL=^1@j6JJi w*#gd^!|vpQRe_M0NUnP!J?o}C!Ii*|5t%|I0P=0=GelM}Ga@sI~U zAn3^n*SG^_dcn+FulWL^DO63Q1#R@N>sE?n32CnobzOa$>#^(EtCM&4?{slMS|he# zJnN*_0CVK5>e-LaWS_KppI>*mnPmsi%bX1*M8R{hz16OeXX?rX2l3bB(yC`AFBUcH zttoI5*?)Gd#3joq44%iv>t2T+OVD~%RS12K*!U9&;gZ_On0QEsg-?uXg!jD`W%ASV z8!%b>OH!HD<5An&<#t;@h81mJ_n#o)3pi8l>1Dz^aFSed)%$gh8wD9(7t8l+C`bdf z?248tO|1KnnOq5&7)&;O 0DXY4bR-?Z5 zVLz52@C+BQyZ>@lln40Yh%B4P3E%oj$Evdsx%FOQB~N#H(=4=HU;S$u_!uO#(exOM znZr*1>67l68hFkua~BpOOdj8YPNMy!W>J>`XqUYlkh#MRTgd7?vF@ueLf@5h@lwD8 zpv1k>8d7o-L+6w;j=^Hv)xAA4c^5sWUnhbkoF`dxN^;IDA->a-cv-&`+l-Nf_?^6d zt^K3r7RZ9r$pI;I7rUfc{2n^Y#mr%Xc{9k_GWy5v!b9$l0T8#UM{a&2_qnJ;Bleeb z=vMV0Vig^vlGTNQfqAK&Iq*ek8>gKT1D1c9M|Mw;>HI-MO%bM5Ir&3E3iL)`S5k)b zSH_|x!R7)}=krUm-+W{R5c<4KUy_Sy$Ax9YBWe7*;TMiB=u))&qqV0n?{i?!L@?3{ zz11$VdRE1L*wT>|M;1(8prjS+%=A3>EPLKNcW-8?yJ6#qpCbHW4K}n%-==c< zMC6~^F3oE3UvEV>^~bk7v;*Opi<$;~!t5lMa~%ZT^G;-+`VYBbFV`N7vT3Sprr^yR zn%4d9GHm8q&+Y@n!FT6PUg6NXE+wM9bKy^B4O4i8;$OUGoh7_50(oHf+Eh_b=1BSc zH)bqM>{8z)TCU7Hy{>2vevQZCHFqfg%G``{BDyH!0f|h>-&3OwF uK&B(ygisbQP!BIz_{Csb8JKqwa zX*|Yl!GLE3l5Myp8AWocY)=<)0@F7Hsf2<}ir;Nf+1aJ7Sy6-`pD?DUcS%`zY^yMD zSQ%)ybN^}0&$H1IwKNI%`_eRpveV1jwygYt=Ut=Gn_r3sbOeK8gT7+BRWa|(%cW*U z7ks!{3SwnBarU#Iceb(BYmGbsZkn2)+I vyq43XO}}pNllGpO4sevlSsZ zvlUDB(t8o`hkK>}8gGO6Yg6YH&qniBe4TP^L-;Tq29AxayGI45@`~=A7vv$#RUI1! z8}iI3U9l}(yAON01%E+gdDw}GNL9WTg$Zh^CySc1^@;0O8;SB1G^;Yx`Io-ntIE?9 zzFeA_#WZVW%0AC?!MsON%>IGWZ8o=KnqRjPI(3@Y! U|NNS|Jx-|IF9$<220OX0upP{tc(%m<2L6&m_YwWW}VHqa>%; z>)m#E(<=T0V!zIdF}DX)$bo&orS@#}*9ix?S$I}lbj-XTuhXUmRC4(~1eOlwYtLC6 zXSki=bDFPu@ 7krMgHq|&2%;@k3hIanZQAG*do zp8B4Fpm+jxE$aMxT(kpiw(&~`UTA0SU#;S=U uvACq)i~(*$&D!J|*~BH^bp; z3&?b#TXLQl(h`~LW+;i-)r3(V#!&1ydPOx$*`bN;4v`Sdaw5Y#4uA)4 k+Y*}xJT{aLP!0y7_VMXkQx)qKjx$(iC)n*Vx5%v5oA#rVf_Wu+NZXlI2+ zHrVo9jCq1Nb4q&Z?zJcPe@RUYs5@NnL|V$w9wEHs(wSfXhIa#s!{!-3b(8foMN`=w zm2Tx*3}hy|=V*L^20U|_0aZWKu=gcFDlDXTHRrw|r*P?4Z%R`}JnLOg>T`=2dJKdq zy(eEpecS6ieT~#eU^*>Cx@l5%?*1=q^8b*E`v|AjGovGCU)4P~SIndPO)i**w`Kb? z8e%#JZQArk&SZC5kR@-XBT*?rXRnE-p_+R)+i na&Bsjq#5WI1B2s98hxVyVH?iSn|cY?dSYjAgW zceh;5H}2i{ob&DR?q5Bg{<);qtT|^@MMD{=_PR)c=%DwL9vLDyCtN-`2VczhyXf~{ zYJc=I(YznRvA1C;b={udY%Nougbb}qjIJ}mhsaTOQ&=ciK$69_9_Uda0{?_C%%){Z zh@yk)qnNI1>kU61h4Fky{waddpM`=f`-APRa%Nuo6G(Bb+OxZ|kTN_3S05=`v9SN| zQn^Q-O#si5Yb55Ux%wRW<+ASOdc1V?a VpWore^VhyPV^N|{c9E3 WJ;@W=Ykda zR?*nWuH}710adGErDErDwtTm>psI^a{P)&0*i`W0X^WUD!-y$G;+%?qKX&VtL 3q{)9whgh@ER>66|ePrNBYkgk=C3qk?s_H2X2fAoo%OI zwrX^>azlgXIEuU8<}CQz9(319-Z!VBKV`j)7WUp`I+`?Hm=_*<6n^o(k0%KhbUlsl zCE?#Q-y$b@ZM r^nLtAcvku|wYq7XC)&4qO<> zFN*FfPSoXi6tm%tzr3UNLSMLS*!8TPmv9_ x=LpF1q-rLkw0X+0;FpCD)Z3|4vR|N&?dZ@a~A8eRbsY@kOtydH0Gpn3eh=( z-4ZJtPIWR}z3{Lj)3@bHyINqU74f$G;L%3v0bL1sqhCtPB^d|0!y_Aa()VItv#Ri3 zUo}-{$ha`<#D{LHwfFhpX2`e^vlTPx?{->vasxDe)soQA(NO?)hHLgG2`+D`gI0|t zHZlGk0tQR4^7S~*BWz1e5qT}XRWHg)XzD3x@olyBq*26G+Oc$7P363A@(gmQiQqhO zu6iVNnXGTTd 2;zpnhr;Z7PO|Rb|q5*Lt!`UV47+-A6czW7QSh;59 zl->+ szkl8jN7@3hu|F6_^eQB%ReE6P%*0J? z8rIVoa(w9T;_5j57~tJOAYAw8Xe5-wb(rd`nLH|ORroK{lSG-VZd5NxuGh;vWn%Pn z`vK~W%#5|d_1lrVut0&w%>ZL%`_{`7-M`B<+-k973x5oD8Q-6=w@9#*+Y8H4snZyN zr(zA`qiMi_54am|_hg)uqKr6?=W2#o9ff)~0FBC~yGa!tTm$hpzB^g2@cxW{O{)td*KZhj#QPx9M? zvR>$-&G*=)xBrU{HGN_JV1{xMW}PmQrp>&ZE0!N&qvv|{XHh;(8a~&|n|#L3tmm{K zx<;Ec#m-gS_ZNSXV7kh-?-R%KRn{hAAi83?d7A6LU3T027Zis+3Az1umiQ WA2 bmokZi7aXS~kVgD2
GpJCG&q!8vieB=qfK3(iWEUaM-bxfA@aBZ|o!z zcxawjW(+^TVnYlZs7>?Tzy;uEFg^zHr^kDU>6(0{wSjW^O3O=hAlUq?)9-0COYUXY znxj1-uOQ4Wtb14tD8Gty4K=us#)F0Z8`tj+e@-4*#n1NUh7)gQ=fXN*H;mTwO6Ho# zMC{M4K#U06biu2R{a0e9_={n1qN$z492ZxOFCYkW^| ziNyO(2{r>d;V7OFLI?2vM~)i*!)!7-f#^Mcti~!0r59gQ-sMDcg6$pGeb>Mj1ZwqW zo}7Er7TzJ~5g~q70-CQ2A3XR_6MGO{*y#}^q8?_A56Hdv4`+n$@D-4^eDOMyGJNFV z-Nq+?h^EhS8BXH6-l-cZ2_Laq%`4FmaJTw(P0$`RbXS+p6V>{QFBD2FKnXSbzNwBz zP@q}v26q1a^{Gx5_r|f%RgSRKyoc00Zdt63d(%lvS8aVLuV8N_X;|wImByuku-vfp zUUX~HiIr$dErr*q9;|JG;XLaw{75F)YE`7VA3F-~SX4K1ZAhYjI%;u{u2f_=TtGC- z2q|IwK=9Xqq>9cv&r5<#>!Ndmm-7sZZGz0oHfwdAwORbY)ctam^u6~owjHb%q-xjy z_}NtXsb?#EW$SgKxm8v>uCTeHfdq5rgn#cMAits*)-w <|=y~s7Isj*m=zluXItaz*U|@jj?qegF0}{ zVU+E9X&K-`>08+tG9VtX`(zY&G0Xxa-Vu!x@6cRu57} gM;V_QG_%p$}`Pv4+Q+4kqh1jY|fc< wYGOSEJUFuq9-9?g3$JK5aEdpN_W-#pdGxzUiVEf-2FYFar_%Pd2L@D69yJ+Vx; zA7L&|Bo50SaPNa}3mA%tX}nrE*I3UTJ&dEJvc~hTZ;Sy+3l3fh*UM9;R;HdzNpyy6 z(FqKZ&?nf>VsA;A?FqpiH*Y+ts_$Gra__JA_trhZFwND>sooTZ6uQpKy5=8diV>0v z1gAWi^?7Qa%8S;2%dOngbZz_w5UMA b!eB5X{` zgAOZcwr1HqHpU%v)Ux5|sGGTmCPBwk62>{Vsp>^YfpRj|RgkPS8${WT5yrEv_-LGd z^s`cfMx|13rB6~z>;h%30<8RtXBVai0IBvA{w5nJe?!C#3#-W5ulS?&sXR*a-!PXa zY=vTT{F1c^T^M{eD$W&E(R35)vw6xJB|NO8LdtCF8iEb-$YeMdMI^Z8-R^&TT9u9O z!LSN9jR#X(t>(Kp{W(N<)=-AiWHzXPYg27k|0Z%}Px~ZN*W{$XNLuM9w*q*JL@h zXP+a3bWvCE&Gvq=D&fHT#1UxteXS;svBSP3V#H&W`&|3{)vSX~CaKf*HuJ3Bn9W)s z3w(NTF>z7oadRMc65E+LeQ`7aPN Kyli9Q>^9i+p5inmZh(fRv~@pKGD0PYl493iV-Ko zqEI_Eg#~zfgA8fyv=7NvRnBkO7?~~&4HwfVjT)IBPQ|9*)qcf;8opF`n4G0hHPQUo zBS}#}VbP|cLxf}LiU(E}e^bg^G5Bzw)%E|tJkh87<@oP8&3|blFG*0BE&jl8ItLBs zZ=!0Nbxl@cm$>jP=)&}pCg@AC;oSp$dz%JKysbUWLsvLowp;;Pp|Fs|h0R~OOIyBh zekN-O{i& yWCZ XYsP*8U!IVQ*W%HE_uWV@9 z*F8Lo7B9jy3RMz%LdLU^b_8puRnpRP!Igw_lCnO)sx0b=Fw35muSlCBw1|mU&^ zpYEALJ{R2$>#G|4S_ip;m78+KUP%|$4qy_9P3z8Coh>kCSsN*gkLo_=$e+_069cl! z(JvK^9u*>Y+0Uqh&rYIPC{vfy-o$~J5EmEm0OCF+2s>g4-eSuxTVftR+g1Z6LS4Hq zu7#j&*x}F?Q)U? EHxbUXSn0o!Nb&E%+xdL)DvehAG5B=#pVlCxV zlS~Zj3G-)Q-tvgTA$=oo9anL1MxC2y(XFG@6Nb{(y2J9G1}=Ke?$R~4MAUGC2H!)# zs=+P575iuDx915M%J#E y18Ges*#rol8QOzX^|BU`0NI?WWf!^RLbI#t;h7(XEWFd@X zUv6@5TAeJ^5k{-fU#GCNrU174EFy?5!)2J}=1iPb>6lfr{@NS#5a>b39c>x5KGjZA z8PUs_s~R2EAVpQ=g@x$<3y%DEaN_5s3b}2rC`}L1(o_^gjU9v{7k=_(Jn$2JJHjFy zp )D2tqmYYrz+fbO32I~LP3)HMt?`lJI&Gv> z!7q&du|-3kkgQolpM%y94+`UNe5|x@d^WKIhby5~>2%K82d4##PAdzr(8tah;im|> z1Ecko^qDo$39;H2g+Cr*xz0?pR!h-WCUiXJ{i@+>mN0mnUK4+9(E$09hJTno^c8-L zs-2zC5lorvDqKUBfzxYT7}vm~!smi_j`|+UaBOwZ1Y~UG W@Ixj4UVAz7A?BmRU+u+A1y%iUtzn$en*WrIASFL}SIV z+KY)4(F3pxL}0}foM%u?m_RZ~2)8gdoB}uIx9gCB5FfiHBdgbMfUWvwxMs~S1lB9m zkKwW2V+cDt#@#hddsXe5ip13LQsOa|IsA6CU4WS=- 2I5 zzAvXFrm2a=R-78DPyPe%(8oD==dm-H<|Q#$PNSQ=AEF+~xdL^VeR;<`f68061t^sH z+MiF+m5yL P!Y^nU)ysB*edy4sO@1dAvwNK&$L$6#4CbFr*X;u^q6 z*4M9!1WPtej>V}{>DYCwwoq`qjLj0!#rsu`uYW7jen-&_mo36`0rwk{C9Q2->@wdU z#X(?K5z=tugsY)|vxsC8;%O2r=WJqFl=w)eV%u7c?WK0DTu#F*O@r{JQi&WBn%Y?% zk99cEKq&f *Zstw#=I%W*Sh+1T4qz7S|* z__b;xHx0N{IE!cr29@+n)~tcu%f9L6hsH@H^iP_P2NigibOj9bDpg4Tnkz+}6JlJ_ z%hP^aN|#nl`zjfra6pC-eeA&FZ+jf4J@exwT8 Br?k^ac2BA= #mNN- $7e{o>+h_sb_gp5~g#mUP_(8nr6IAvKK0A vP3pcahC*$$^mKD` z(~8$=v?}e398qUSzjLZ}4Zw9-%A8OR42}#V-5 n`8AbedJ7x4$|)3hq>304-PUf zcnES2KPk 9CRu?Uk5$$wrpQD&t|L2CjCi$Oej_-zupp zKGs~8Kv5CXt7Bw42ktR}%6!Hr7CoMh08b3TO#LKsH<4epc7z$ox6ecHL9o4Ztz%%G zsdq??^ERTtuWg_uhFESXE}2myY6g&t5xQ904@p`_cCW_4g;~$@7{`nR+)yHBId^ID zBpJmswIEo?Xtw;?dG-FQ*0}7pCjQN%yn~^xUeCCcy)Y%C!uK2}+^ka0`e%#U*OEa7 zK_m%+489^;>7 )%@{;M0H2b#ck;hfYFI6o`*F=?51VKj&!YF_TN-*C}Pu0sXR+ z5prFO<$GNx$DFg)9iC&;Z2y-b=U-d&e_T3U9hE}AZNm-1xG35B#;^diT#?p@=yO$U zxdVQ>I5H@ntp1;*cCaT1>c&accdd@xr9}jOQ!#!3(ATIxj!$t(8StyIN|#z4TZ>GM z%d9m9iD@Dp sBPV^R4*ipL87Y~BHvAH0TIRpf~p#pNjM zSAV_>yV;jk530e_e$Nb`C#IOUaKO!qIB*HQh- 2;m znx(k99P_ICea)q6sqUP6yBNMc#K%v)8 CD4afrSrC5m0=P8mNc0aLWXvPKSo@ths-;*ZLfn;c@bG4r}E}|0# zM`d9i=}JHPw7%j9KW*Ya(Uf~_(yt@Rn4}tkrzekVWrVL9h$)G$ Ey?)j)zUhW)frVzsfgN(5HYt~ Yk*L&;Il0q6fo0tXXsa{G9zK7g|_>ylN|*?Tm# zz;UwlX}ifw&LU>)1_}K6Ox^O6q9XZZ7vH?_M*kGH=TSRYs7#8OcI?3Y;bxVc&@M0C zIQVxu@4t*`r`oWa>S~C!6`8=Fnzx`IdQBBYM+klN*XoOwG%xtZ&MT&dG&SyZK=cni z=Er9{1yV2Z%e11)g43i{#GfXty7t^M36`ZsUJgP o1eVt7Z#Siq#>$^4L$V7A8l&=h{B Mw+S)G*Bdt&N|P1N z={uypy-Ph*9)!)5v7*w`0 z(Xn;3H=h#!Z4pv_lSC7XM1u4;G8c2xpA!uxpdzF!WLixGr9?*2rf8eX !xR&G*#i$LZ7 zb_NxWY6cgni`_R|@tdqQp+F5_A#K5DPG^>7on1!s{2v|=2UwV-%@m|dIoR6oX`4C5 z)jUw5OSu8iqOqhie38@gQNQ+_&pL=YQS_(@W5_*dVj4p8t9@PNv}(n%nye!94fiDJ zXA9;-y((syAxmYTpQ|+a{#e#D>wHWG+k-B}B4qb{VKs>5FSj@IRNd_Sc+FKrNLL>j zv{Z5E+aoSi`do~Q{ns3;No`U-n4I7h@OJp|c71j5ySQw~*?-*wJGh=@9#`eP*phnQ4rnWzV} zwO7M1mh)bfb>amL>b8}Ro9si=#iWugN>P+!S=RD3kG|Y3>0j*IET^ogF_ZO973ZXU zxgXi1DK%^^Q~x5ohfrD$E5$NV(zN?Jo*uH?r%qtf`QZ(N0Cn@GdmBOt--wqi&>j`S z>sA`rOV<7{elajh_4}L7fBJ|7X8(+nR>BGHvNHSe>s y!SPE_4Lj z407sYSs~))4k@p}A+>x}#?IDKc5*eg0OJ #8lV!6(pk83qyur`zIWf0Va}1 uh z$XYYs !Ys( zdS{hB?YwsA5=781P(+cFU ?|FT{JVevBSMojQp>^*ECwJDpx( &+4KsUE!0ORs4bi&JfTrI1l5Amd{rBeiX^T6Q 4GXG<9T4Q$j5&JMamdVx MNI zjyi*m8U}BljoU{Sgw;|1WMeNMZuuPrVksnQ=&_O1)$p7$BWa;7w=0F2Mmla^XzXX% z=TV-I2x$a?dqF@Jn|3@@12 3Duj%laZ1{=!M2!4VAgw3%XQ`LePxRLcv5vu zi= x6ub9*qF@efgNxlsR@WvLH#WFHKmJDn{i--cwM2>YPCro_2DtZZknlI0T3-) zce*v~>ikb2u#p?qciYumE)aUu1V$>(e^G5)p}O0SDw*ijGI_24gwAW?hSe%+3#1l6 zjSCX?D{Y6RgC;QcHyg>Px%oTL1G9pa&V^t=8G|!n2Z*iqM$f=rQPgwv%JWyRCSK2V z 2O?4q&$-(Zp}SM zw_2CwAls|& Om+Y!D_Ua9wdhJx0l879d3v zrf-PyQ}nt0dr~uBS4k{C`|0ZeknAzIWqHbEw-faq$3K^C-Cj|9sIFB@=Zvqg >)s_G`_bM?*WCNJjMFvq^%v9R7-+r3#*SCK4z|hoEgs#sP=FeZkI}Wx+Wc|Lw zN!!~d+ajwy^Zv*yHUZUswc7owNZ6-{7_M(6>{4av^)y$@AYTJub16w1YRkAh0dyVz z0-KkTkt+zAhvR!2?-kW%IzNyii%goje&}O<`cmgm@gGonrV@lRoLcY%`mB_%U0?w3 z;HHW~Awt9-7y0f%dP6W#v({}(*;OI?OW!)g#-p$5iDlnsRU`#DQz1g!3J>hGmZlJ3 zEp8zfiC>9mbnSgsvs2Z1mLw?+0g0~@AxXpqLshm})Wxv?l KeBNNEmW8j5<=#Ila|om1g{s?cG|#3sNH((v zCwa?u`NxI`|6=zoyUwH>Zj1cI4tM20)3xQUnMeyY6L`Ux;T1Zz*!-|H;K&F~F>fE4 z&GgQb3X)$M&1FgxULrkM9M6A 98B^{Sz-ku~} zWoh9=?h~(!5^OjSspTT#pR@-5u^Mk%UR7F2`P74xuT@@}b*zF~D;Y~6DTj()YsgHd zZ9SXx9cG*5PF0B;l&?z%b@cij!V;WAW#tKaE&F#W|G(0uDqC8iE-DE%CVZU`UN{Nc z3oCx+2H1eh$K=Kp0}xL^n?Z9~O?^lKRA_Zgg-o{$c1)R&{PxHAAskK1w$B%~R#7X? z?X*HDqVN{tm&BG?T}|AULt;TicIiSqtk50doNl|VFu%nVQV&{Xu6hgn4Y!(KXg4A~ zv31gt&px|PG8ERym)=$cae!qK^%T$-)S>{hWO_h86S6RhC%F}}RC~A{o9y^mFf2-L zu`+@6d^QcEZ8kvctZaK&T1?!otqjfc#K;ds79G0UfEPV$Sj;iZtisAc-BB1en3v4f zIRPTFWU5j-oSlV3VWDsNl)7&4Mb@KoZK3c(+8Qvl`CMwJbQ)cu{Y 0gu!(m5qHTIDa@+}$%^DKU37sj<#l+^iJ8?tqjiuX!G6+r}RONVZ{1z^Wgiiv@?7 zt^}N+kUcJiBAUX(Tt7rRcrhg%VK{e4V*v(DD7_Yxh$Yv|jG-45vGjK)?f0A=ty 5`!aKXg?%^Di*gSIq-aK`DqPY{{V^Q&aeH5t4ahyF-v`u@+!~VzPxq8yY2I%@_-> z0G#Cn5JK(O65iOA`0K@DbJ9MoKa6`R0!jPkrb<) 10Mt8}nZKoy{bl#4j9BFB7N3rDN* z;rP;U^TWg&x2U%FlUpk|ap%}EQCEax^3jRiw%=099kJA4sxR~2^$W*_k2pw+sZ7$o z{tsC&iHa}6sRMO5iA4^7yRT7ICD_Ibt%%_IW!nfxx}-}H=!A*4e#QY{(emyez(VTJ zO)mEAJqbe|+*TX^EOh?K?>aeted%lIk1HN#KHnB~@)63^I*{LO7(i|l deVUukfyrcFrfhML~P2c>{I$`Mw-Y0NBqovBg3-b8AyUTgOe`(UrudKj*>e+RYh zKUHMAVi9A*dEoTuYLcYhu;$PVwRS;8IHr|B4~Ml7Z_2L)tPANbSz* rB%SSPcKl5@cil>HD5Mee+Sy zQ t~JXnksBnkO(zXOqX-XK3QW)G5ADKuM%gBXe|pgH$UyB|?D~Re_yyZfH(k z>a|zwGWJv6PYJGL>o(1tt#RoYF7&9eB;p>=jQ>XF$6XG5QSYXsUH`*BD-0hxjxVF- z8Tuu`ljg2gtHKU~TC*-Aq ^#_(Yih~&GF8nC#T1VIw|byFesbVM zezww3MpwH-kmY#qiIJ@gOSY@B{Puo;4K}grLz#ejfP|*vq*W~+CXWnk|3{T4pR|rK zvxsCk<8qe_dV%;OU;%~s`}Fw-M4 ?&i~rN{}7?#Z|l(z05&!*F`x) zH7*-sQ9^Zxo+IY@@(UBaJvMigwRmyek_q;5n92F@c`x!x{RY-z#x!jKGD2Hps7XW0 z=Ncv3LF%Jf?kDxMtrnI?D`eyPLB+xf2~(VvbmiY3a#Pz~J8^JY%GvIdO4r0=bR$N) z v9G~(0|Rf2)`dJ2~6)gUTO0C6yPdv#rM6%B%mr4~o2C09*6+0-G?O!bxE z_%N~ae)2VNr6J>HlY1N=szjgCDMuQXX)62DZbutAaJX3)>Ax3Yww3e>gb1-Xh9UY-SRe#iwe!)JEE<~<{5j7Z*$gkv{T6n9NJw*@#OBi{&A0swb&KB%l zw9}97c&sfKm|2X;B80iDAnhBY^uZl2Tm9k*d=^DptHcB2FDZofnycZ~lt~;} vcF7&7!c8zyQmJPkG+C srtlX0o%+}GC$WohjTky(d1`7H<|h|_hrl{}AoZA8YvuRz zOW}Oe#Evf;W`N}|w`7t{WT{BG_FbS~0| B~-eHMAG~e zGmZi@&POdO9b+#lI4aB-u(n&V%PGt}8>u>YJ9yO5#ayxPyjONw;rdxq3=Bg79A^;S zVWK!#m7jDbYz+IA=v#_q&6Q0+0zhq3d}D{ft!{3XQ1RPOtY{ou-*}v9fPPo7OHlx` z0;t1qdp&)r*9i|D8mw_)28wP1++KM1;Y?Jtd^{t9`SQ|T2rSH z)-674BMFdM#f$IFTbKZ1o 1T2auAQE=U(ZGAh&{ *+S-k&Uj|Hi)f-)_xE91|0MFoT6}v#b(N9a{9=%9yOL zhutwq)!30s+RT_Tfw{Px!@1SOA@8f8SW9ctc#VjlPZU@j%x$LAb 6rk+Rj)}53w0-EQ{(DfWTb2Stm)J5K=kp*eG^vKLDTe0FX$crh5l=kr?ax!EVwGO{GjXj zAnOFfX464*1jUW+feCEHrPERTr?8zg%=Uguq?4K@aQEosW(W3pF(N>#Ia^t8%v;pt z8OS$_60#$MmDe|wpwa)(#909|lXYm-&U0;RDnH|P6iF=VR7+v_UVIc8hNheLW<+*u zHMJqhI$A=*2#lD?(uxL=vTW#ecysvK;JAG>4q=xe74^z1_W`6`@4#U^jQw*UL&b)O zG K}8iG0C((JY>hS;DPe}Qoe$gZp>cS*aDEHQv7F2VwD z6Mf3-iqo)bR!XfYI?<7npQ825saMX@n5>ovX@{r^mHX@z=}=W1nykxLid^5%dTjTG z8luHWnC(a2X|L|eW_-Jzyip)wk2m|U54+797L$ph*madE)Ic`IzHA_t3a*x}AtXmD zoG)Il#)d85)u^-$0pVboQmDO}h6quyxWjj%R=sYoWYfzN(N`4nKv$?w#@~yz;yk@j zUzBOgidEi{_UCQAZpUU)-UtlNnCjd?H@NIJM#0rVO5y34*!t6SdOHih7$;y5q#GNS zpF3WvIk#ce>vs-rr-oVS#x$sPY?A00-f7&yuS-hmv1iVD;GZY{GS0!EW-&Rw_$Q*L zqRYDo!inyxL&=NWk|#}jMqIUH3n{ED_?JO^T+yOYby4<;`4vyOrCJ8dLx?|FD?IU9 zOUmgj21h+TT>bYIgaX)*LZlx1ZTluI05xuN-sZYPGsc2$0s#;iC(1MSA*V|Zx^-AQ zYnEpp@8OimgS8|4!y(o_xiK~XbK|LMvZfB4X;)u+P7zh+icqzo@1R>rsfXLx|VH!ND467r4I1vT4FY?-@wrmQb4 zKTJohbkTCy)A5qYmH>A?Hx8 cC-8G<+n27-D@M5dO4} zz?TGuM?Zwv(mE@e+q_@(PA9D@Re{-_81aGciUK1z)4V3+d{^?Yu^;O$LzdrMdJ`c* z4;Ft(R@bb;l)|io4^E