From 6debbb5ab23724956fbb9745021dcd68c97a34aa Mon Sep 17 00:00:00 2001 From: Entech-Ramon <47992004+Entech-Ramon@users.noreply.github.com> Date: Sat, 29 Jun 2019 20:58:47 -0400 Subject: [PATCH] Entech Contest Submission --- .../Security Services - CompareSettings.ps1 | 306 ++ ...curity Services - PullBaselineSettings.ps1 | 69 + DataCollection/GeoIPCountries.csv | 254 ++ DataCollection/RB-CollectSWData.ps1 | 723 +++++ DataCollection/RB-RetrieveSWPassword.ps1 | 257 ++ .../FA_SW_Address_Objects.json | 187 ++ .../FA_SW_Security_Services.json | 2536 +++++++++++++++++ README.md | 87 +- ScreenShots/CMW_Ticket_Example.jpg | Bin 0 -> 122872 bytes ScreenShots/SW_AO_FQDN_Example.jpg | Bin 0 -> 35251 bytes ScreenShots/SW_AO_Host_Example.jpg | Bin 0 -> 39801 bytes ScreenShots/SW_AO_MAC_Example.jpg | Bin 0 -> 31513 bytes ScreenShots/SW_AO_Subnet_Example.jpg | Bin 0 -> 36553 bytes ScreenShots/SW_Config_Example.jpg | Bin 0 -> 127889 bytes ScreenShots/SW_Password_Category.jpg | Bin 0 -> 64181 bytes ScreenShots/SW_SS_Anti_Spy_Example.jpg | Bin 0 -> 63182 bytes ScreenShots/SW_SS_App_Control_Example.jpg | Bin 0 -> 29363 bytes ScreenShots/SW_SS_GW_AV_Example.jpg | Bin 0 -> 179545 bytes ScreenShots/SW_SS_Geo_IP_Example.jpg | Bin 0 -> 48689 bytes ScreenShots/SW_SS_IPS_Example.jpg | Bin 0 -> 69769 bytes ScreenShots/SW_SS_Info_Example.jpg | Bin 0 -> 54559 bytes ScreenShots/SW_SS_RBL_BN_Example.jpg | Bin 0 -> 19443 bytes ScreenShots/Sonicwall_Auditing_Process.png | Bin 0 -> 244443 bytes .../Sonicwall_Data_Collection_Process.png | Bin 0 -> 438195 bytes 24 files changed, 4418 insertions(+), 1 deletion(-) create mode 100644 Auditing/Security Services - CompareSettings.ps1 create mode 100644 Auditing/Security Services - PullBaselineSettings.ps1 create mode 100644 DataCollection/GeoIPCountries.csv create mode 100644 DataCollection/RB-CollectSWData.ps1 create mode 100644 DataCollection/RB-RetrieveSWPassword.ps1 create mode 100644 Flexible Asset Type Details/FA_SW_Address_Objects.json create mode 100644 Flexible Asset Type Details/FA_SW_Security_Services.json create mode 100644 ScreenShots/CMW_Ticket_Example.jpg create mode 100644 ScreenShots/SW_AO_FQDN_Example.jpg create mode 100644 ScreenShots/SW_AO_Host_Example.jpg create mode 100644 ScreenShots/SW_AO_MAC_Example.jpg create mode 100644 ScreenShots/SW_AO_Subnet_Example.jpg create mode 100644 ScreenShots/SW_Config_Example.jpg create mode 100644 ScreenShots/SW_Password_Category.jpg create mode 100644 ScreenShots/SW_SS_Anti_Spy_Example.jpg create mode 100644 ScreenShots/SW_SS_App_Control_Example.jpg create mode 100644 ScreenShots/SW_SS_GW_AV_Example.jpg create mode 100644 ScreenShots/SW_SS_Geo_IP_Example.jpg create mode 100644 ScreenShots/SW_SS_IPS_Example.jpg create mode 100644 ScreenShots/SW_SS_Info_Example.jpg create mode 100644 ScreenShots/SW_SS_RBL_BN_Example.jpg create mode 100644 ScreenShots/Sonicwall_Auditing_Process.png create mode 100644 ScreenShots/Sonicwall_Data_Collection_Process.png diff --git a/Auditing/Security Services - CompareSettings.ps1 b/Auditing/Security Services - CompareSettings.ps1 new file mode 100644 index 0000000..fd3e686 --- /dev/null +++ b/Auditing/Security Services - CompareSettings.ps1 @@ -0,0 +1,306 @@ +Param( + [int32]$ITGClientID, + [int32]$FlexID, + [string]$CompanyName + ) + +############################################################################################################################################# +# Access Key Vault for ITGlue API Key +$connectionName = "AzureRunAsConnection" +try +{ + # Get the connection "AzureRunAsConnection " + $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName + + Add-AzureRmAccount ` + -ServicePrincipal ` + -TenantId $servicePrincipalConnection.TenantId ` + -ApplicationId $servicePrincipalConnection.ApplicationId ` + -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint +} +catch { + if (!$servicePrincipalConnection) + { + $ErrorMessage = "Connection $connectionName not found." + throw $ErrorMessage + } else{ + Write-Error -Message $_.Exception + throw $_.Exception + } +} +############################################################################################################################################# +# Azure Variable Set +$Az_KeyValut_Secret_Name = "ITG-API-KEY" +$Az_KeyValut_Secret_Username = "CWM-API-Username" +$Az_KeyValut_Secret_Password = "CWM-API-Password" +# Created Baseline unique ITGlue ID +$ITG_Baseline_ID = "123123123" + +############################################################################################################################################# +# Clean Company Name to make compatible with URL encoding +$URL_CompanyName = [uri]::EscapeDataString($CompanyName) +$URL_CompanyName|Write-Output + +############################################################################################################################################# +# Connectwise Manage Variables +$CMW_API_Auth_Prefix = "company+" +$SW_MGMT_Port = "1234" +$ITG_SW_SOP_URL = "https://company.itglue.com/11111/docs/111111" +$CWM_API_Base_URI = "https://cw.company.com/v4_6_release/apis/3.0" +$CWM_Service_Board_Name = "Incoming" + +############################################################################################################################################# +# Getting ITGLUE API Key +$ITG_API_KEY = (Get-AzureKeyVaultSecret -VaultName EntechInternalKeyVault -Name "$Az_KeyValut_Secret_Name").SecretValueText + +############################################################################################################################################# +# Getting ConnectWise Manage API Keys +$CWM_API_Username_Key = (Get-AzureKeyVaultSecret -VaultName EntechInternalKeyVault -Name "$Az_KeyValut_Secret_Username").SecretValueText +$CWM_API_Password_Key = (Get-AzureKeyVaultSecret -VaultName EntechInternalKeyVault -Name "$Az_KeyValut_Secret_Password").SecretValueText + +############################################################################################################################################# +# Building ITGlue Headers +$ITGlue_Headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" +$ITGlue_Headers.Add("Content-Type", 'application/vnd.api+json') +$ITGlue_Headers.Add('x-api-key', $ITG_API_Key) + +############################################################################################################################################# +# Building ConnectWise Manage Headers +# First need to convert credentials to Base64, accepted by CWM API +# Need to add entech+ to the username +$CWM_API_Username_Key = "$CMW_API_Auth_Prefix" + $CWM_API_Username_Key + +$CWM_credPair = "$($CWM_API_Username_Key):$($CWM_API_Password_Key)" +$CWM_encodedCredentials = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($CWM_credPair)) + +$CWM_Headers = @{ Authorization = "Basic $CWM_encodedCredentials" } + + +# Search URI for Company ID by using the name of the company. Company name should be synced with ITGlue EXACTLY so shouldn't have an issue here. +$CWM_Get_ID_URI = "https://cw.entechus.com/v4_6_release/apis/3.0/company/companies?conditions=name=""$URL_CompanyName"" and status/id in (1, 18)" +$CWM_Get_ID_URI|Write-Output + +$CWM_API_Results = Invoke-RestMethod -Method Get -Uri $CWM_Get_ID_URI -Headers $CWM_headers +$CWM_API_Results|Write-Output + +$CWM_Company_Identifier = $CWM_API_Results.identifier +$CWM_Company_Identifier|Write-Output +############################################################################################################################################# +# Building Compare Object Properties Function +Function Compare-ObjectProperties { + Param( + [PSObject]$ReferenceObject, + [PSObject]$DifferenceObject + ) + $objprops = $ReferenceObject | Get-Member -MemberType Property,NoteProperty | % Name + $objprops += $DifferenceObject | Get-Member -MemberType Property,NoteProperty | % Name + $objprops = $objprops | Sort | Select -Unique + $diffs = @() + foreach ($objprop in $objprops) { + $diff = Compare-Object $ReferenceObject $DifferenceObject -Property $objprop + if ($diff) { + $diffprops = @{ + SettingName=$objprop + SOPSetting=($diff | ? {$_.SideIndicator -eq '<='} | % $($objprop)) + SonicwallSetting=($diff | ? {$_.SideIndicator -eq '=>'} | % $($objprop)) + } + $diffs += New-Object PSObject -Property $diffprops + } + } + if ($diffs) {return ($diffs | Select SettingName,SOPSetting,SonicwallSetting)} +} + +############################################################################################################################################# +# Querying ITGlue for Baseline Settings and Current Sonicwall Settings + +$SWSS_Baseline_Settings = Invoke-RestMethod -Method Get -Uri "https://api.itglue.com/flexible_assets/$ITG_Baseline_ID" -Headers $ITGlue_Headers +$SWSS_Baseline_Settings = $SWSS_Baseline_Settings.data.attributes.traits +$SWSS_Current_Client = Invoke-RestMethod -Method Get -Uri "https://api.itglue.com/flexible_assets/$FlexID" -Headers $ITGlue_Headers +$SWSS_Current_Client_Settings = $SWSS_Current_Client.data.attributes.traits + +$Current_Flex_Uri = $SWSS_Current_Client.data.attributes.'resource-url' +$Current_Org_Name = $SWSS_Current_Client.data.attributes.'organization-name' +$Current_Ext_IP = $SWSS_Current_client.data.attributes.traits.'external-ip' +$SW_SerialNumber = $SWSS_Current_Client.data.attributes.traits.'sonicwall-serial-number' +$SW_Tagged_Config_URL = $SWSS_Current_Client.data.attributes.traits.sonicwall.values.'resource-url' +$SW_Tagged_Config_Name = $SWSS_Current_Client.data.attributes.traits.sonicwall.values.name + +$Differences = Compare-ObjectProperties -ReferenceObject $SWSS_Baseline_Settings -DifferenceObject $SWSS_Current_Client_Settings + + +# Excludes all properties from the object that we don't want the difference of, could be modified to pull only the settings we want. +$SS_Dif = $Differences | Where-Object { + $_.SettingName -ne 'sonicwall' -and + $_.SettingName -ne 'sonicwall-model' -and + $_.SettingName -ne 'sonicwall-serial-number' -and + $_.SettingName -ne 'allowed-countries' -and + $_.SettingName -ne 'blocked-countries' -and + $_.SettingName -ne 'last-modified-date' -and + $_.SettingName -ne 'sonicwall-firmware-version' -and + $_.SettingName -ne 'up-time' -and + $_.SettingName -ne 'external-ip' -and + $_.SettingName -ne 'log-low-danger-spyware' -and + $_.SettingName -ne 'log-medium-danger-spyware' -and + $_.SettingName -ne 'log-high-danger-spyware' -and + $_.SettingName -ne 'log-high-priority-attacks' -and + $_.SettingName -ne 'log-medium-priority-attacks' -and + $_.SettingName -ne 'log-low-priority-attacks' +} + +# Only Include Settings with Enabled in it, Calling Primary as it will not include sub settings for each security service. +$SS_Dif2 = $Differences | Where-Object {$_.SettingName -like "*Enabled*"} + +# Pirmary Settings, onlly major security services were compared +$SS_Dif_List_Primary_Settings = ($SS_Dif2|fl|Out-String).Trim() +# All settings excluding the obvious ones that are always going to be different, such as model and serial number. +$SS_Dif_List_All_Settings = ($SS_dif|fl|Out-String).Trim() + +############################################################################################################################################# +# Checking the length of the differences returned, 0 means no setting were found outside of SOP, which means we don't need to report on it. + +if ( + $SS_Dif_List_All_Settings.length -ne 0 +) { + +############################################################################################################################################# +# Checking to see if there is an open ticket for this Sonicwall already. If there is then we'll update that ticket instead of making a new one. +# Building the API requests to ConnectWise Manage +$CWM_Ticket_Search_URI = "$CWM_API_Base_URI" + "/service/tickets/search" + +# Building the json request body to search for ticket +$CWM_Ticket_Search_Body = New-Object PSObject -Property @{ + conditions = "summary = '$SW_SerialNumber - Sonicwall Settings not to SOP' and ClosedFlag = False" +} + +# Building API api call to actually search for the ticket +$CWM_Ticket_Search_Response = Invoke-RestMethod -Method Post -Uri $CWM_Ticket_Search_URI -Body (ConvertTo-Json -InputObject $CWM_Ticket_Search_Body -Depth 100) -Headers $CWM_Headers -ContentType "application/json" +$CWM_Ticket_Search_Response +############################################################################################################################################# +# Building variables to use in the ConnectWise Manage Ticket +$SW_MGMT_IP = $Current_Ext_IP + ":" + "$SW_MGMT_Port" +$Last_Mod_Date = $SWSS_Current_Client.data.attributes.traits.'last-modified-date' +$SW_Model = $SWSS_Current_Client.data.attributes.traits.'sonicwall-model' +$SW_UpTime = $SWSS_Current_Client.data.attributes.traits.'up-time' + +# Running If condition to see if any tickets were returned +if ( + $CWM_Ticket_Search_Response.count -eq 0 + ) { + # No open tickets were found, Going to make a new one. +############################################################################################################################################# + # POST to ConnectWise Manage to Make new ticket. + $CWM_New_Ticket_URI = "$CWM_API_Base_URI" + "/service/tickets" + + # Building New Ticket Object, will be converted to JSON + $NewTicketData = New-Object PSObject -Property @{ + summary = "$SW_SerialNumber - Sonicwall Settings not to SOP" + company = [ordered]@{ + identifier = "$CWM_Company_Identifier" + } + board = [ordered]@{ + name = "$CWM_Service_Board_Name" + } + priority = [ordered]@{ + id = 18 + } + initialDescription = " +$SW_Tagged_Config_Name at the IP $Current_Ext_IP is not to SOP +Below are the settings to review and resolve: + +---------------------------------------------------- + +$SS_Dif_List_All_Settings + +---------------------------------------------------- + +LEGEND +SettingName - Name of the Security service setting or sub setting that is flagged as non-sop +SOPSetting - The setting that the security service SHOULD be +SonicwallSetting - The reported sonicwall setting + +---------------------------------------------------- + +Notify NOC if reports are incorrect or if an exception needs to be made for $CompanyName +Entech's Sonicwall SOP: $ITG_SW_SOP_URL +ITGlue Asset = $Current_Flex_Uri + +-------SonicWALL Info------- + +Serial Number: $SW_SerialNumber +External IP: $Current_Ext_IP +SW External Access: https://$SW_MGMT_IP +Last Modified Date: $Last_Mod_Date +SonicWALL Up Time: $SW_UpTime +SonicWALL ITGlue Config: $SW_Tagged_Config_URL +" + } + $NewTicketData|Write-Output + + $OutPut = Invoke-RestMethod -Method Post -Uri $CWM_New_Ticket_URI -Headers $CWM_headers -ContentType 'application/json' -Body (ConvertTo-Json -InputObject $NewTicketData -Depth 100) + + $OutPut + Remove-variable -Name NewTicketData,output,SWSS_Current_Client +} else { +$Date = Get-Date +$Date = [System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId($Date, [System.TimeZoneInfo]::Local.Id, 'Eastern Standard Time') + + "There is a ticket! Update it!" + Foreach ($ticket in $CWM_Ticket_Search_Response) { +############################################################################################################################################# + $CWM_Ticket_ID = $ticket.id + # POST to ConnectWise Manage to Update open ticket/s. + $CWM_Update_Ticket_URI = "$CWM_API_Base_URI" + "/service/tickets/$CWM_Ticket_ID/notes" + +# Building ticket update objecct, will be converted to JSON +$UpdateTicketData = New-Object PSObject -Property @{ + detailDescriptionFlag = $false + internalFlag = $true + customerUpdatedFlag = $false + internalAnalysisFlag = $true + resolutionFlag = $false + text = " +Ticket Updated: +$Date + +---------------------------------------------------- + +$SW_Tagged_Config_Name at the IP $Current_Ext_IP is not to SOP +Below are the settings to review and resolve: + +---------------------------------------------------- + +$SS_Dif_List_All_Settings + +---------------------------------------------------- + +LEGEND +SettingName - Name of the Security service setting or sub setting that is flagged as non-sop +SOPSetting - The setting that the security service SHOULD be +SonicwallSetting - The reported sonicwall setting + +---------------------------------------------------- + +Notify NOC if reports are incorrect or if an exception needs to be made for $CompanyName +Entech's Sonicwall SOP: $ITG_SW_SOP_URL +ITGlue Asset = $Current_Flex_Uri + +-------SonicWALL Info------- + +Serial Number: $SW_SerialNumber +External IP: $Current_Ext_IP +SW External Access: https://$SW_MGMT_IP +Last Modified Date: $Last_Mod_Date +SonicWALL Up Time: $SW_UpTime +SonicWALL ITGlue Config: $SW_Tagged_Config_URL +" +} + + $OutPut = Invoke-RestMethod -Method Post -Uri $CWM_Update_Ticket_URI -Headers $CWM_headers -ContentType 'application/json' -Body (ConvertTo-Json -InputObject $UpdateTicketData -Depth 100) + + $OutPut + Remove-variable -Name UpdateTicketData,output,SWSS_Current_Client + } +} +} else { + "Sonicwall To SOP No Ticket Created" | Write-Output +} \ No newline at end of file diff --git a/Auditing/Security Services - PullBaselineSettings.ps1 b/Auditing/Security Services - PullBaselineSettings.ps1 new file mode 100644 index 0000000..dde7ee6 --- /dev/null +++ b/Auditing/Security Services - PullBaselineSettings.ps1 @@ -0,0 +1,69 @@ +################################################################################################################################### +# Access Key Vault for ITGlue API Key +$connectionName = "AzureRunAsConnection" +try +{ + # Get the connection "AzureRunAsConnection " + $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName + + Add-AzureRmAccount ` + -ServicePrincipal ` + -TenantId $servicePrincipalConnection.TenantId ` + -ApplicationId $servicePrincipalConnection.ApplicationId ` + -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint +} +catch { + if (!$servicePrincipalConnection) + { + $ErrorMessage = "Connection $connectionName not found." + throw $ErrorMessage + } else{ + Write-Error -Message $_.Exception + throw $_.Exception + } +} +############################################################################################################################################# +# Baseline Variable, add your respective IDs +$ITG_Baseline_ID = "123456789" +$ITG_Flex_Asset_Type_ID = "1111222" + +# Setting Azure Runbook Variables +$Az_Baseline_Check_Runbook = "Azure_Baseline_Check_Name" # Running "Security Services - CompareSettings.ps1" +$Az_Resource_Group = "Azure_Resource_Group" +$Az_Automation_Account = "Azure_Automation_Account_Name" +$Az_KeyVault_ITG_Key_Name = "ITG-API-Key-Name" +############################################################################################################################################# +# Getting ITGLUE API Key +$ITG_API_KEY = (Get-AzureKeyVaultSecret -VaultName EntechInternalKeyVault -Name "$Az_KeyVault_ITG_Key_Name").SecretValueText + +############################################################################################################################################# +# Building ITGlue Headers +$ITGlue_Headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" +$ITGlue_Headers.Add("Content-Type", 'application/vnd.api+json') +$ITGlue_Headers.Add('x-api-key', $ITG_API_Key) + +############################################################################################################################################# + +$Data = Invoke-RestMethod -Method Get -Uri "https://api.itglue.com/flexible_assets/?filter[flexible_asset_type_id]=$ITG_Flex_Asset_Type_ID&page[size]=1000" -Headers $ITGlue_Headers + +$SW_Security_Assets = $data.data + +# Excluding the baseline Flexible Asset from the list of Sonicwalls to Check, add extra lines with the IDs that we need to exclude for future baselines. +$SW_Security_Assets = $SW_Security_Assets|Where-Object -Property id -NE -Value $ITG_Baseline_ID + +$SW_Security_Assets | ForEach-Object { + # Starts Next Script/Runbook and compares + # Taking Properties out of the current flexible asset + $Current_Flex_Asset_ID = $_.id + $Current_Company_Name = $_.attributes.'organization-name' + $Current_Company_ITG_ID = $_.attributes.'organization-id' + + # Building Paramters to Pass to Next Runbook + $Param_Pass = @{"ITGClientID"="$Current_Company_ITG_ID";"FlexID"="$Current_Flex_Asset_ID";"CompanyName"="$Current_Company_Name"} + + # Starting The Next Runbook + Start-AzureRmAutomationRunbook -Wait -Parameters $Param_Pass -Name "$Az_Baseline_Check_Runbook" -ResourceGroupName "$Az_Resource_Group" -MaxWaitSeconds 1000 -AutomationAccountName "$Az_Automation_Account" + + # Clean up variables + Remove-Variable -Name Current_Flex_Asset_ID,Current_Company_Name,Current_Company_ITG_ID +} \ No newline at end of file diff --git a/DataCollection/GeoIPCountries.csv b/DataCollection/GeoIPCountries.csv new file mode 100644 index 0000000..f50fbb5 --- /dev/null +++ b/DataCollection/GeoIPCountries.csv @@ -0,0 +1,254 @@ +CountryName,Allowed +"""Anonymous Proxy""",No +"""Satellite Provider""",No +Andorra,No +"""United Arab Emirates""",No +Afghanistan,No +"""Antigua and Barbuda""",No +Anguilla,No +Albania,No +Armenia,No +"""Netherlands Antilles""",No +Angola,No +"""Asia/Pacific Region""",No +Antarctica,No +Argentina,No +"""American Samoa""",No +Austria,No +Australia,Yes +Aruba,No +"""Aland Islands""",No +Azerbaijan,No +"""Bosnia and Herzegovina""",No +Barbados,No +Bangladesh,No +Belgium,No +"""Burkina Faso""",No +Bulgaria,No +Bahrain,No +Burundi,No +Benin,No +Bermuda,No +"""Brunei Darussalam""",No +Bolivia,No +Brazil,No +Bahamas,No +Bhutan,No +"""Bouvet Island""",No +Botswana,No +Belarus,No +Belize,No +Canada,Yes +"""Cocos (Keeling) Islands""",No +"""Congo, The Democratic Republic of the""",No +"""Central African Republic""",No +Congo,No +Switzerland,Yes +"""Cote d'Ivoire""",No +"""Cook Islands""",No +Chile,No +Cameroon,No +China,No +Colombia,No +"""Costa Rica""",No +Cuba,No +"""Cape Verde""",No +"""Christmas Island""",No +Cyprus,No +"""Czech Republic""",No +Germany,Yes +Djibouti,No +Denmark,No +Dominica,No +"""Dominican Republic""",No +Algeria,No +Ecuador,No +Estonia,No +Egypt,No +"""Western Sahara""",No +Eritrea,No +Spain,No +Ethiopia,No +Europe,Yes +Finland,No +Fiji,No +"""Falkland Islands (Malvinas)""",No +"""Micronesia, Federated States of""",No +"""Faroe Islands""",No +France,No +Gabon,No +"""United Kingdom""",Yes +Grenada,No +Georgia,No +"""French Guiana""",No +Guernsey,No +Ghana,No +Gibraltar,No +Greenland,No +Gambia,No +Guinea,No +Guadeloupe,No +"""Equatorial Guinea""",No +Greece,No +"""South Georgia and the South Sandwich Islands""",No +Guatemala,No +Guam,No +Guinea-Bissau,No +Guyana,No +"""Hong Kong""",No +"""Heard Island and McDonald Islands""",No +Honduras,No +Croatia,No +Haiti,No +Hungary,No +Indonesia,No +Ireland,Yes +Israel,No +"""Isle of Man""",No +India,No +"""British Indian Ocean Territory""",No +Iraq,No +"""Iran, Islamic Republic of""",No +Iceland,No +Italy,No +Jersey,No +Jamaica,No +Jordan,No +Japan,Yes +Kenya,No +Kyrgyzstan,No +Cambodia,No +Kiribati,No +Comoros,No +"""Saint Kitts and Nevis""",No +"""Korea, Democratic People's Republic of""",No +"""Korea, Republic of""",No +Kuwait,No +"""Cayman Islands""",No +Kazakhstan,No +"""Lao People's Democratic Republic""",No +Lebanon,No +"""Saint Lucia""",No +Liechtenstein,No +"""Sri Lanka""",No +Liberia,No +Lesotho,No +Lithuania,No +Luxembourg,No +Latvia,No +"""Libyan Arab Jamahiriya""",No +Morocco,No +Monaco,No +"""Moldova, Republic of""",No +Montenegro,No +Madagascar,No +"""Marshall Islands""",No +Macedonia,No +Mali,No +Myanmar,No +Mongolia,No +Macao,No +"""Northern Mariana Islands""",No +Martinique,No +Mauritania,No +Montserrat,No +Malta,No +Mauritius,No +Maldives,No +Malawi,No +Mexico,No +Malaysia,No +Mozambique,No +Namibia,No +"""New Caledonia""",No +Niger,No +"""Norfolk Island""",No +Nigeria,No +Nicaragua,No +Netherlands,Yes +Norway,No +Nepal,No +Nauru,No +Niue,No +"""New Zealand""",Yes +"""Other Country""",No +Oman,No +Panama,No +Peru,No +"""French Polynesia""",No +"""Papua New Guinea""",No +Philippines,No +Pakistan,No +Poland,No +"""Saint Pierre and Miquelon""",No +"""Puerto Rico""",No +"""Palestinian Territory""",No +Portugal,No +Palau,No +Paraguay,No +Qatar,No +Reunion,No +Romania,No +Serbia,No +"""Russian Federation""",No +Rwanda,No +"""Saudi Arabia""",No +"""Solomon Islands""",No +Seychelles,No +Sudan,No +Sweden,No +Singapore,No +"""Saint Helena""",No +Slovenia,No +"""Svalbard and Jan Mayen""",No +Slovakia,No +"""Sierra Leone""",No +"""San Marino""",No +Senegal,No +Somalia,No +Suriname,No +"""Sao Tome and Principe""",No +"""El Salvador""",No +"""Syrian Arab Republic""",No +Swaziland,No +"""Turks and Caicos Islands""",No +Chad,No +"""French Southern Territories""",No +Togo,No +Thailand,No +Tajikistan,No +Tokelau,No +Turkmenistan,No +Tunisia,No +Tonga,No +Turkey,No +"""Trinidad and Tobago""",No +Tuvalu,No +Taiwan,No +"""Tanzania, United Republic of""",No +Ukraine,No +Uganda,No +"""United States Minor Outlying Islands""",No +"""United States""",Yes +Uruguay,No +Uzbekistan,No +"""Holy See (Vatican City State)""",No +"""Saint Vincent and the Grenadines""",No +Venezuela,No +"""Virgin Islands, British""",No +"""Virgin Islands, U.S.""",No +Vietnam,No +Vanuatu,No +"""Wallis and Futuna""",No +Samoa,No +Yemen,No +Mayotte,No +"""South Africa""",No +Zambia,No +Zimbabwe,No +"""Saint Martin""",No +Pitcairn,No +Timor-Leste,No +Curacao,No +"""Sint Maarten""",No +"""Bonaire, Saint Eustatius and Saba""",No diff --git a/DataCollection/RB-CollectSWData.ps1 b/DataCollection/RB-CollectSWData.ps1 new file mode 100644 index 0000000..d5ac884 --- /dev/null +++ b/DataCollection/RB-CollectSWData.ps1 @@ -0,0 +1,723 @@ +Param( + [string]$IP, + [int32]$ITGClientID, + [string]$encodedCredentials, + [string]$Client_Name, + [string]$Client_Location_Name + ) +# Declaring fucntion we will use to calculate the network suffix +function Convert-IpAddressToMaskLength([string] $dottedIpAddressString) +{ + $result = 0; + # ensure we have a valid IP address + [IPAddress] $ip = $dottedIpAddressString; + $octets = $ip.IPAddressToString.Split('.'); + foreach($octet in $octets) + { + while(0 -ne $octet) + { + $octet = ($octet -shl 1) -band [byte]::MaxValue + $result++; + } + } + return $result; +} +############################################################################################################################################# +# Allow Untrusted Certificates in this script session most sonicwalls are using self signed certs. +add-type @" + using System.Net; + using System.Security.Cryptography.X509Certificates; + public class TrustAllCertsPolicy : ICertificatePolicy { + public bool CheckValidationResult( + ServicePoint srvPoint, X509Certificate certificate, + WebRequest request, int certificateProblem) { + return true; + } + } +"@ +[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy +[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 + +############################################################################################################################################# +# Setting Client ID Variable From Input Parameter +$ITG_Client_ID = "$ITGClientID" +$ITG_FLEX_TYPE_ID_SS = "112233" +$ITG_FLEX_TYPE_ID_AO = "112244" +$ITG_FLEX_TYPE_ID_AG = "112255" +$ITG_FLEX_TYPE_ID_SO = "112266" +$ITG_FLEX_TYPE_ID_SG = "112277" +$ITG_FLEX_TYPE_ID_AR = "112288" +############################################################################################################################################# +$SW_MGMT_Port = "1234" +$SW_IP = "$IP" + ":" + "$SW_MGMT_Port" +$API_Auth_URI = "https://$SW_IP/api/sonicos/auth" +$API_Base_URI = "https://$SW_IP/api/sonicos/" +# Adding Client's Encoded Creds to the Header +$headers = @{ Authorization = "Basic $encodedCredentials" } +# Connecting to Sonicwall using Basic Auth +$ConnectStatus = Invoke-RestMethod -Uri "$API_Auth_URI" -Method Post -Headers $headers -UseBasicParsing +$ConnectStatus = $connectstatus.status.success + +############################################################################################################################################# +# Importing CSV with country list of allowed and blocked countries GEO-IP Filtering according to your SOP + + $GEO_BaseLine_CSV = Import-Csv 'C:\Safe\GeoIPCountries.csv' + +############################################################################################################################################# +# Checks to see if connecting to the sonicwall was successful +If ($ConnectStatus -eq $true) { +Remove-Variable encodedCredentials + +############################################################################################################################################# + +# The the commands we are going to run on the sonicwall, this will be in the body of the API request. +$API_GW_CLI = 'show gateway-antivirus' +$API_IPS_CLI = 'show intrusion-prevention' +$API_GEO_CLI = 'show geo-ip' +$API_APP_CLI = 'show app-control' +$API_RBL_CLI = 'show rbl' +$API_BNET_CLI = 'show botnet' +$API_INFO_CLI = "show status" + +# URI with the IP added, specifially for the accessing the CLI 'console' +$API_URI = "https://$SW_IP/api/sonicos/direct/cli" + +# Special Header to return Text Output and not json object from request, specifically for Geo-IP at the moment due to bug in reporting from Json. +$TextHeader = @{ Accept = "text/plain" } + + +# Performs the API request and stores output, Sonicwall general info, for model, serial number and other items. +$SW_Info_Repsonse = Invoke-RestMethod -Method POST -Uri $API_URI -Body "$API_INFO_CLI" -ContentType "Text/Plain" + +############################################################################################################################################# +# Performs the API Request and stores output, Gateway AV +$API_GW_Response = Invoke-RestMethod -Uri $API_URI -Body "$API_GW_CLI" -Method Post -ContentType "Text/plain" + + +# Performs the API Request and stores output, IPS +$API_IPS_Response = Invoke-RestMethod -Uri $API_URI -Body "$API_IPS_CLI" -Method Post -ContentType "Text/plain" + + +# Performs the API Request and stores output, Geo IP Filter +$API_GEO_Response = Invoke-RestMethod -Uri $API_URI -Body "$API_GEO_CLI" -Method Post -ContentType "Text/plain" -Headers $TextHeader + + +# Performs the API Request and stores output, App Control +$API_APP_Response = Invoke-RestMethod -Uri $API_URI -Body "$API_APP_CLI" -Method Post -ContentType "Text/plain" + + +# Performs the API Request and stores output, Real Time Black List +$API_RBL_Response = Invoke-RestMethod -Uri $API_URI -Body "$API_RBL_CLI" -Method Post -ContentType "Text/plain" + + +# Performs the API Request and stores output, Bot Net +$API_BNET_Response = Invoke-RestMethod -Uri $API_URI -Body "$API_BNET_CLI" -Method Post -ContentType "Text/plain" + + +############################################################################################################################################# +# First parsing API response for the genral info, creating variables for each setting we care about. +# Since the return is text, we need to convert the text to an powershell object to parse through it more easliy, basically making each line it's own property "`n" denotes new line. +$Obj_SW_Info = ConvertFrom-String -InputObject $SW_Info_Repsonse -Delimiter "`n" + # Filing each variable for the setting we care about for now, have to drill down the PSObject to filtering for the values we care about, remove the Real propery name and trim the extra space to only have the value. + $SW_Model = $SW_Info_Repsonse.model + $SW_SerialNumber = $SW_Info_Repsonse.serial_number + $SW_UpTime = $SW_Info_Repsonse.up_time + $SW_ProdCode = $SW_Info_Repsonse.product_code + $SW_RegCode = $SW_Info_Repsonse.registration_code + $SW_FW_Ver = $SW_Info_Repsonse.firmware_version + $SW_Mod_Date = $SW_Info_Repsonse.last_modified_by + +############################################################################################################################################# + +# Checking each setting in the SOP to check if it is enabled +# First, checking Gateway AV is enabled + $GW_Enabled = $API_GW_Response.gateway_antivirus.enable + +# Checking that gateway av is enabled for http, ftp, etc. +# InBound Settings + $GW_IB_HTTP_Enabled = $API_GW_Response.gateway_antivirus.inbound_inspection.http + + $GW_IB_FTP_Enabled = $API_GW_Response.gateway_antivirus.inbound_inspection.ftp + + $GW_IB_IMAP_Enabled = $API_GW_Response.gateway_antivirus.inbound_inspection.imap + + $GW_IB_SMTP_Enabled = $API_GW_Response.gateway_antivirus.inbound_inspection.smtp + + $GW_IB_POP3_Enabled = $API_GW_Response.gateway_antivirus.inbound_inspection.pop3 + + $GW_IB_CIFS_Enabled = $API_GW_Response.gateway_antivirus.inbound_inspection.cifs_netbios + + $GW_IB_TCP_Enabled = $API_GW_Response.gateway_antivirus.inbound_inspection.tcp_stream + +# Checking that gateway av is enabled for http, ftp, etc. +# OutBound Settings + + $GW_OB_HTTP_Enabled = $API_GW_Response.gateway_antivirus.outbound_inspection.http + + $GW_OB_FTP_Enabled = $API_GW_Response.gateway_antivirus.outbound_inspection.ftp + + $GW_OB_SMTP_Enabled = $API_GW_Response.gateway_antivirus.outbound_inspection.smtp + + $GW_OB_TCP_Enabled = $API_GW_Response.gateway_antivirus.outbound_inspection.tcp_stream + +# Checking each sub setting for each protocal +# HTTP Sub Settings + + $GW_HTTP_PWZIP_Enabled = $API_GW_Response.gateway_antivirus.restrict.password_protected_zip.http + + $GW_HTTP_PKEXE_Enabled = $API_GW_Response.gateway_antivirus.restrict.packed_executables.http + + $GW_HTTP_Macros_Enabled = $API_GW_Response.gateway_antivirus.restrict.ms_office_macros.http + + +# Checking each sub setting for each protocal +# FTP Sub Settings + + $GW_FTP_PWZIP_Enabled = $API_GW_Response.gateway_antivirus.restrict.password_protected_zip.ftp + + $GW_FTP_PKEXE_Enabled = $API_GW_Response.gateway_antivirus.restrict.packed_executables.ftp + + $GW_FTP_Macros_Enabled = $API_GW_Response.gateway_antivirus.restrict.ms_office_macros.ftp + +# Checking each sub setting for each protocal +# IMAP Sub Settings + + $GW_IMAP_PWZIP_Enabled = $API_GW_Response.gateway_antivirus.restrict.password_protected_zip.imap + + $GW_IMAP_PKEXE_Enabled = $API_GW_Response.gateway_antivirus.restrict.packed_executables.imap + + $GW_IMAP_Macros_Enabled = $API_GW_Response.gateway_antivirus.restrict.ms_office_macros.imap + +# Checking each sub setting for each protocal +# SMTP Sub Settings + + $GW_SMTP_PWZIP_Enabled = $API_GW_Response.gateway_antivirus.restrict.password_protected_zip.smtp + + $GW_SMTP_PKEXE_Enabled = $API_GW_Response.gateway_antivirus.restrict.packed_executables.smtp + + $GW_SMTP_Macros_Enabled = $API_GW_Response.gateway_antivirus.restrict.ms_office_macros.smtp + +# Checking each sub setting for each protocal +# POP3 Sub Settings + + $GW_POP3_PWZIP_Enabled = $API_GW_Response.gateway_antivirus.restrict.password_protected_zip.pop3 + + $GW_POP3_PKEXE_Enabled = $API_GW_Response.gateway_antivirus.restrict.packed_executables.pop3 + + $GW_POP3_Macros_Enabled = $API_GW_Response.gateway_antivirus.restrict.ms_office_macros.pop3 + +# Checking each sub setting for each protocal +# CIFS-NetBios Sub Settings + + $GW_CIFS_PWZIP_Enabled = $API_GW_Response.gateway_antivirus.restrict.password_protected_zip.cifs_netbios + + $GW_CIFS_PKEXE_Enabled = $API_GW_Response.gateway_antivirus.restrict.packed_executables.cifs_netbios + + $GW_CIFS_Macros_Enabled = $API_GW_Response.gateway_antivirus.restrict.ms_office_macros.cifs_netbios + +############################################################################################################################################# + +# IPS Section + +# Checking if IPS is enabled + + $IPS_Enabled = $API_IPS_Response.intrusion_prevention.enable + +# High Priority Attacks + + $IPS_High_Prevent = $API_IPS_Response.intrusion_prevention.signature_group.high_priority.prevent_all + + $IPS_High_Detect = $API_IPS_Response.intrusion_prevention.signature_group.high_priority.detect_all + +IF ($API_IPS_Response.intrusion_prevention.signature_group.high_priority.log_redundancy -eq 0) { + $IPS_High_Log = $false + }else { + $IPS_High_Log = $true + } + + +# Medium Priority Attacks + +$IPS_Medium_Prevent = $API_IPS_Response.intrusion_prevention.signature_group.medium_priority.prevent_all + +$IPS_Medium_Detect = $API_IPS_Response.intrusion_prevention.signature_group.medium_priority.detect_all + +IF ($API_IPS_Response.intrusion_prevention.signature_group.medium_priority.log_redundancy -eq 0) { +$IPS_Medium_Log = $false +}else { +$IPS_Medium_Log = $true +} + + +# Low Priority Attacks + +$IPS_Low_Prevent = $API_IPS_Response.intrusion_prevention.signature_group.Low_priority.prevent_all + +$IPS_Low_Detect = $API_IPS_Response.intrusion_prevention.signature_group.Low_priority.detect_all + +IF ($API_IPS_Response.intrusion_prevention.signature_group.Low_priority.log_redundancy -eq 0) { +$IPS_Low_Log = $false +}else { +$IPS_Low_Log = $true +} + +############################################################################################################################################# +# App Control Section + +# API Request Specifically for App Control Signatures +# Encyped Key Exchange, Sig 7 +$API_APP_EKE_URI = "$API_Base_URI" + "app-control/applications/id/2900" +$API_APP_EKE_SIG7_URI = "$API_Base_URI" + "app-control/signatures/id/7" +$API_APP_EKE_SIG5_URI = "$API_Base_URI" + "app-control/signatures/id/5" +# Tor +$API_APP_TOR_CLI = 'show app-control category id 27 application id 467' + +################################ + +# Making request for above APP Control Signatures +$API_APP_EKE_Response = Invoke-RestMethod -Uri $API_APP_EKE_URI -Method Get + +# Checking to see if Encrypted Key Exchange is set to anything other than default, which would be what Proxy Access is set to. +# Depending on the sonicwall version, finding out if EKE is using the category setting will return one of two results, -or operator is added to if statement to account for that. +if ($API_APP_EKE_Response.app_control.application.block.category -eq $true -or $API_APP_EKE_Response.status.info.message -eq "App Control not found.") { + # Using Category Settings which is not blocked Now need to Check if Signature 7 and 5 are the same. + # Setting Results for Encrypted Key Exchange + $APP_EKE_Enabled = $false + # Checking Settings for Signature 7 and 5 + $API_APP_EKE_SIG7_Response = Invoke-RestMethod -Uri $API_APP_EKE_SIG7_URI -Method Get + $API_APP_EKE_SIG5_Response = Invoke-RestMethod -Uri $API_APP_EKE_SIG5_URI -Method Get + + # Checking Signature 7 + if ($API_APP_EKE_SIG7_Response.status.info.message -eq "App Control not found.") { + $APP_EKE_Sig7 = $false + } else { + if ($API_APP_EKE_SIG7_Response.app_control.signature.block.enable -eq $true) { + $APP_EKE_Sig7 = $true + } else { + $APP_EKE_Sig7 = $false + } + } + + # Checking Signature 5 + if ($API_APP_EKE_SIG5_Response.status.info.message -eq "App Control not found.") { + $APP_EKE_Sig5 = $false + } else { + if ($API_APP_EKE_SIG5_Response.app_control.signature.block.enable -eq $true) { + $APP_EKE_Sig5 = $true + } else { + $APP_EKE_Sig5 = $false + } + } +} else { + if ($API_APP_EKE_Response.app_control.application.block.enable -eq $true) { + $APP_EKE_Enabled = $true + $API_APP_EKE_SIG7_Response = Invoke-RestMethod -Uri $API_APP_EKE_SIG7_URI -Method Get + $API_APP_EKE_SIG5_Response = Invoke-RestMethod -Uri $API_APP_EKE_SIG5_URI -Method Get + + # Checking Signature 7 + if ($API_APP_EKE_SIG7_Response.status.info.message -eq "App Control not found.") { + $APP_EKE_Sig7 = $true + } else { + if ($API_APP_EKE_SIG7_Response.app_control.signature.block.enable -eq $true) { + $APP_EKE_Sig7 = $true + } else { + $APP_EKE_Sig7 = $false + } + } + + # Checking Signature 5 + if ($API_APP_EKE_SIG5_Response.status.info.message -eq "App Control not found.") { + $APP_EKE_Sig5 = $true + } else { + if ($API_APP_EKE_SIG5_Response.app_control.signature.block.enable -eq $true) { + $APP_EKE_Sig5 = $true + } else { + $APP_EKE_Sig5 = $false + } + } + } +} + + +################################ + +# Making request for above APP Control Signatures +$API_APP_TOR_Response = Invoke-RestMethod -Uri $API_URI -Body "$API_APP_TOR_CLI" -Method Post -ContentType "Text/plain" +# $API_APP_TOR_Response = $API_APP_TOR_Response.content + +# Checking if Tor is set to blocked +if ($API_APP_TOR_Response -like "*no block*") { + $APP_TOR = $false +} else { + $APP_TOR = $true +} + +################################ +# Check if App Control is Enabled + $APP_Enabled = $API_APP_Response.app_control.enable + + +############################################################################################################################################# +# Checking Real Time Black List + $RBL_Enabled = $API_RBL_Response.rbl.enable + +############################################################################################################################################# +# Checking BotNet Filter +if ($API_BNET_Response.botnet.block.connections.all -eq $true) { + $BNET_Enabled = $true +} else { + $BNET_Enabled = $false +} + +############################################################################################################################################# +# Checking Geo IP settings + +$GEO_Allowed_Countries = @() +$GEO_Blocked_Countries = @() + +($GEO_BaseLine_CSV).CountryName|ForEach-Object { + if ($API_GEO_Response -like "*$_*") { + $GEO_Blocked_Countries += "$_" + } else { + $GEO_Allowed_Countries += "$_" + } +} + + +if ($API_GEO_Response -like "*no block connections*") { + $GEO_Enabled = $false +} else { + $GEO_Enabled = $true +} + +################################ + +$ITG_GEO_Allowed_Countries = $GEO_Allowed_Countries -replace "," +$ITG_GEO_Blocked_Countries = $GEO_Blocked_Countries -replace "," + + + + +############################################################################################################################################# +# Anti-SpyWare Section +# Building Commands and URIs +$API_SPY_URI = "$API_Base_URI" + "anti-spyware/global" + +$API_SPY_Response = Invoke-RestMethod -Uri $API_SPY_URI -Method Get + +$SPY_Enabled = $API_SPY_Response.anti_spyware.enable + +$SPY_High_Prevent = $API_SPY_Response.anti_spyware.signature_group.high_danger.prevent_all + +$SPY_High_Detect = $API_SPY_Response.anti_spyware.signature_group.high_danger.detect_all + +IF ($API_SPY_Response.anti_spyware.signature_group.high_danger.log_redundancy -eq 0) { + $SPY_High_Log = $false + }else { + $SPY_High_Log = $true + } + + +$SPY_medium_Prevent = $API_SPY_Response.anti_spyware.signature_group.medium_danger.prevent_all + +$SPY_medium_Detect = $API_SPY_Response.anti_spyware.signature_group.medium_danger.detect_all + +IF ($API_SPY_Response.anti_spyware.signature_group.medium_danger.log_redundancy -eq 0) { + $SPY_medium_Log = $false + }else { + $SPY_medium_Log = $true + } + + +$SPY_low_Prevent = $API_SPY_Response.anti_spyware.signature_group.low_danger.prevent_all + +$SPY_low_Detect = $API_SPY_Response.anti_spyware.signature_group.low_danger.detect_all + +IF ($API_SPY_Response.anti_spyware.signature_group.low_danger.log_redundancy -eq 0) { + $SPY_low_Log = $false + }else { + $SPY_low_Log = $true + } + +############################################################################################################################################# +# Building Json Object to send to ITGlue in the format it accepts. +$SecurityServiceData = New-Object PSObject -Property @{ + data = [ordered]@{ + type = "flexible-assets" + attributes = [ordered]@{ + "organization-id" = $ITG_Client_ID + "flexible-asset-type-id" = $ITG_FLEX_TYPE_ID_SS + traits = [ordered]@{ + "sonicwall" = $ITG_SW_CONFIG_ID + "sonicwall-model" = $SW_Model + "sonicwall-serial-number" = $SW_SerialNumber + "sonicwall-firmware-version" = $SW_FW_Ver + "up-time" = $SW_UpTime + "last-modified-date" = $SW_Mod_Date + "external-ip" = $IP + "gateway-anti-virus-enabled" = $GW_Enabled + "gateway-av-http-inbound-inspection" = $GW_IB_HTTP_Enabled + "gateway-av-http-outbound-inspection" = $GW_OB_HTTP_Enabled + "gateway-av-http-password-zip-files-inspection" = $GW_HTTP_PWZIP_Enabled + "gateway-av-http-packed-exe-files-inspection" = $GW_HTTP_PKEXE_Enabled + "gateway-av-http-marco-files-inspection" = $GW_HTTP_Macros_Enabled + "gateway-av-ftp-inbound-inspection" = $GW_IB_FTP_Enabled + "gateway-av-ftp-outbound-inspection" = $GW_OB_FTP_Enabled + "gateway-av-ftp-password-zip-file-inspection" = $GW_FTP_PWZIP_Enabled + "gateway-av-ftp-packed-exe-file-inspection" = $GW_FTP_PKEXE_Enabled + "gateway-av-ftp-marco-file-inspection" = $GW_FTP_Macros_Enabled + "gateway-av-imap-inbound-inspection" = $GW_IB_IMAP_Enabled + "gateway-av-imap-password-zip-file-inspection" = $GW_IMAP_PWZIP_Enabled + "gateway-av-imap-packed-exe-file-inspection" = $GW_IMAP_PKEXE_Enabled + "gateway-av-imap-marco-file-inspecition" = $GW_IMAP_Macros_Enabled + "gateway-av-smtp-inbound-inspection" = $GW_IB_SMTP_Enabled + "gateway-av-smtp-outbound-inspection" = $GW_OB_SMTP_Enabled + "gateway-av-smtp-password-zip-file-inspection" = $GW_SMTP_PWZIP_Enabled + "gateway-av-smtp-packed-exe-file-inspection" = $GW_SMTP_PKEXE_Enabled + "gateway-av-smtp-marco-file-inspection" = $GW_SMTP_Macros_Enabled + "gateway-av-pop3-inbound-inspection" = $GW_IB_POP3_Enabled + "gateway-av-pop3-password-zip-file-inspection" = $GW_POP3_PWZIP_Enabled + "gateway-av-pop3-packed-exe-file-inspection" = $GW_POP3_PKEXE_Enabled + "gateway-av-pop3-macro-file-inspection" = $GW_POP3_Macros_Enabled + "gateway-av-cifs-inbound-inspection" = $GW_IB_CIFS_Enabled + "gateway-av-cifs-password-zip-file-inspection" = $GW_CIFS_PWZIP_Enabled + "gateway-av-cifs-packed-exe-file-inspection" = $GW_CIFS_PKEXE_Enabled + "gateway-av-cifs-macro-file-inspection" = $GW_CIFS_Macros_Enabled + "gateway-av-tcp-stream-inbound-inspection" = $GW_IB_TCP_Enabled + "gateway-av-tcp-stream-outbound-inspection" = $GW_OB_TCP_Enabled + "intrusion-prevention-system-enabled" = $IPS_Enabled + "prevent-high-priority-attacks" = $IPS_High_Prevent + "detect-high-priority-attacks" = $IPS_High_Detect + "log-high-priority-attacks" = $IPS_High_Log + "prevent-medium-priority-attacks" = $IPS_Medium_Prevent + "detect-medium-priority-attacks" = $IPS_Medium_Detect + "log-medium-priority-attacks" = $IPS_Medium_Log + "prevent-low-priority-attacks" = $IPS_Low_Prevent + "detect-low-priority-attacks" = $IPS_Low_Detect + "log-low-priority-attacks" = $IPS_Low_Log + "app-control-enabled" = $APP_Enabled + "encrypted-key-exchange-blocked" = $APP_EKE_Enabled + "tor-blocked" = $APP_TOR + "encrypted-key-exchange-signature-7-blocked" = $APP_EKE_Sig7 + "encrypted-key-exchange-signature-5-blocked" = $APP_EKE_Sig5 + "realTime-black-list-enabled" = $RBL_Enabled + "anti-spyware-enabled" = $SPY_Enabled + "prevent-high-danger-spyware" = $SPY_High_Prevent + "detect-high-danger-spyware" = $SPY_High_Detect + "log-high-danger-spyware" = $SPY_High_Log + "prevent-medium-danger-spyware" = $SPY_medium_Prevent + "detect-medium-danger-spyware" = $SPY_medium_Detect + "log-medium-danger-spyware" = $SPY_medium_Log + "prevent-low-danger-spyware" = $SPY_low_Prevent + "detect-low-danger-spyware" = $SPY_low_Detect + "log-low-danger-spyware" = $SPY_low_Log + "botNet-filter-enabled" = $BNET_Enabled + "geo-ip-filtering-enabled" = $GEO_Enabled + "allowed-countries" = "
9nMFn8oaQ@LA&HFjP>CX<4qqhU!Tt#nwj< z))h0HT%{I4hWl{r?8fBiIV#BO`T0I>f>^c40(YpOzTwTo9W+@F b zADzmnpx5Hy{ewm-s40mG3d^RPDnKl*>`@M&6w&8bHrE@Wl;?FJhZGbQG*^XiUZH|^ z=!PJhyJ#wiudMU$TgMP@WKuyH#nYr^1Th6PhpyR092^1YJorUt{~@ZF3i{3o(1sqN zg2-O=;D2ZjnPm*21R@cexl|C=o;I3-8K#1km qElgcER85Q(F3ZMv4N(B+u!N2(ihX40?|DNZ+*Y|I^_FJC+)?>f*_n)nt z|Fi8DWs CzzOfK|)VRFr9 &AOBu~7ylBt>p}&!u(Oa4t*M}C zT`H(;^fesO+2qbLb%(yz+_6U*Z<^cKfwy*@MW2p%4Na+672WH--V1V(Fn&I70*AT{ zeX*w*GSmRcP kLN4(>oXCe%H#d`G@*un&5E z5@Pt!&Ci*r+H=;Cax)gja5-Ij*Uk5buL-6NlTiFLcUYBG&$=tuW29z)+>iZwVK|M~ zkcga` bW@$uiI>Xb*jDnXO&x*aK z>k4)ULcE~=3abh>Xs9Im;gxJhR8;&;@;ffB(M~%QqQ0d;1{Gq?*Bvtx?``y=r &ue|=FpMlQ zGpXF_RZ|xdDjd@?b>b6FJ~I)nt8IJrc|%NS@Du(U4}&=qyZL1%_04ZS^bxz@Fm2$a zKdCk<9;k=OzEn_NQS{cru)b*&rDB8-cQGJqLv{0Clu<#=8f1|i15XijFxj Qh04B^)IdH)n-EmN`oWopO+c+gT`` zEY5R8jq9hn+PcqoDlJ$>{8%@)xN2iNrhEpRcfDnK`lI)2xjuTwl(W7`VLYRzl$PzZ zGJ$PQlE67#=lt%@uabjbzg!imS)1cfu_Un)z1yZF8b;T5r`hf6c00p(+fS` &!iYSiwGLL#Waz*~=wmQ8J zja@Kv#h2%HPh*27ERP^tAY)*y!;HlcBi#B%d9h;(ECkw0h+Wxp-M_3sC@dT8h0jj# zetlc`jO7b`cW<0S;Ma@_82LQ<6~_T5A;NyVda8~hI4t}<=di7!s<}O->dV)W9>#W9 zzj=13&68)B+Yq)}z2BRn&QCVNL@{ww-4`S!i{)cRVeD#!Q(XvQuSsb7fpW30GD*)z zKMBhc7DF 9MMuw68#}fR}p;q{FK%~@65*p&aYQ*Jb1$}^rmyT0C^?~X4ebP z_ZVrE9`-2<$v0Bz9<3>cNoA;ILSH~?AnP%BzgBSdbi1CS9 q&d?BfWwxB5A*6%~B|eE`B_W}DUihIlgy0|Xa>rGna7&cIPdcyL>&yfm95%A#?| zYdk2f`7G*8RapT~|GV>c=Z>_^af_AuqfgrsOH8h4F|G}cT7v7~ydCeATWiFA7^Un971T=w#e)Z+c)kW%z<&kr zUq{651HLkI7amE8pl_EZi*NqPgTzf_@BlvPM}H$gpaQGum-oG*MOLrI-K7M_ghPq4 zAE}^uB?y)e`7&ci?pL$sgb*r7p#N`wLr>O%oj@;kQtm+K0|7_&pDEY+BYV{cvB1(> z_h+MmGPAKsloKV8{gW}o5T}{^L*`$dVEd2?`r?5oPDXDd=9{UY)0kH2eLNNPmUADR zNCo`|RQLZgbAdUCHf1OsWXYZgIN+}&SSae*6oGN#1u95g3+Mvwdx$MQ@X7*=JiUJj z(dLEgq4* ENr0Ji1o*R;H5acpCR> zRt_4SCdQ2}_HE7 +n)3;Za E_3>4v1dDvLqleJ7+oEm;^Wr4NfJ j^erNiu` z(PFzIg%976Rcb?*9x-cma#0;m*SI@amzU<6x1x9vU(VF%A{xgqW@P#}%I2bXbszEk zvH0AYBpat0aA*oT3^_9_`U!WK!{a->te02)p+4Fx5ihwXK6PWoCh=zMRn13V_=nIR zdlO6cP~)R*(xKx(gyx;4R05XiQ`OQYS*2#Hs-MaB<+m%mC)aByG-P76&6x@%ESgvk zBgx9M2v!H*`IOGEYG<#G9tA!)nky~SOH)tR4a-wU5lf534^oFVZ_|MffX7&({r za~+f=#!aEpu8_1LDrg;}xT#Iy)zcamkq*(_8=E{Nm#L~rp?XHfVJ@~ zQDyQ>807$Zt^N|p^-Y*jfE3@&kBKWAS9D5bVbT(oLBg7}H3J9U;F{?m4@{{P#&FR8 zZqC%ocyv;}hC@KUkK$>COx^}rZEolOj;OQc^_O_9ML$af%RQxn9 >6h^lp~u)ueJH2bq`Vycp4i2k$0w8qHS(2`DVViwPpQj3{}QniZv( z@G?)@S?-3jdvT6YB5faU&9)CJAJLn4Zs=6R`BXf3_)!Wa{=PA>=m1)zL)fo=vS(KJ zqdP`9AMB7*f^^yFLMN7bSEny3&an_LXg&9*$3khA4@ztDZCKir6KV!F%3xLX0TkP@ z>K7wZy6yF~+EAwp)i0e31*=}lymt!xmQj`d3Ga=y&dzo;t-GyIlQ aZO5t@W71y&w3!p3~271QRm|%($ugQiu34czinrJh=AMBS39YcQCh-qprl)m=X~4 zegM-YyAOLG`Z(&o%n9C?N}E9$l}|!&5$!08Z>gTe2A cW_^PCRoz6=UBN}a3sc`zgr8nTtsCP4oA!@n&; z+_GPu3i<(Ur6`O(2I6<|?feRO#UKvdu~L-_h1Ql`xj%Zm>Dn7M;x01z&a`_z3y;6w z#dAFHrd1f~#x%h&5lU;hRF~hD5t_0y9*DFpb{J11E$40PDU|VFVYN-UiGRabsdqN+ zqucG&mld@E>CTOq19z#wgW9QSRoLTj48*Q6ciB(P(nqX*(717=Y?>|)(X5`VB2)yA zZ=0gWo4tIhqBJGu*C@OERGz8#1~a$!Exazw*Cy;6x7U>i-%4m-GfC`3ki3`kcvCfT zEN$n>CIphDq;jhsf7)SgspQwoeMfPM7`3mlatfnTx3_P8IrnU(wAuo}5!g)O#+Suo z1JtM>Yy9Ixeo-r*6HJmtW$#nI>Lf+baFEJt C6*(QK4I)o>ThJ_eDA{=Cx ^M^rRWLG`Gth5adt z<-Wy=dCy+J3JgQBLT;}vm{kHJ772$M4wHrQFhsMC0mt- WHp9KBEn&3-O&fR zfEMU&FV^POy7-l@9Xa;oL6P=-!Tdt9-eGDLBz#JASl&u=)iij{6qmdAYQfUM#@JF9 zr4>6QE3 2o3J*)JI)aekhPn@{ba`}>f!J-tx zMb#QZ5FA#MQEWl5moB8Br2H?9=Oq(rZrQ;j^IV@jJWURY=BjO`0Y^ SlmKKd}8e0yMVya;K>idse>EEgJNg#U71_|Z^ENgpM>EKEy zYr#+78*ZTRVe@{j-uW8dLSJlx5>M4XayZ#4ertmHCn-0_bDCW0=Y#5XdH)_&Rc1%( z919@TZ_X!49&Ec?;L9_dNsk
j3YI3c=HrLzaP^zK(E;q~lzB)8(deMZ);xLXcdIQ=X$m$#EXh zO!3^h?urGjd71W$UJDv5^BW5#{%(hFO9QV?L-(iT@S`C+rM{gcY3l*G;$qmx)tXvQ znOjol5@seUl&TVAjz%){#1)xl!#o=|k 0e+kC!uG65ZVQS_#(7!Z2Z9cYAM?17%T@TT(e$*YMJ5bqr~H$He&Q8U0yJ zS+?^c(b_4#=TQTrR)mF7Cxx`CIs+{}Hb;vVZI`K-imFnK34A)+$+CF5C@cK@DMJl5 z(0})7_F0V{-=8+R07(ltgeD@GcNe^47Cx|)snB5|SIriX7P#KMcM*M#`*X8ixeKBD zNH5&e{V03d#!Ba&@R|(Y0*8DFv#j-NXMR!ENg7r++BBQqG-1|l1i6=|jTcivqnF9; zZgoxNSQgq9?<5|P#>jR5Q`&@r$>*4QuJNA3xdSs3dU6ovu$A2IgIKS|w+zmReU2!- z0cE!jJdPegO75sC-ydFhDWNBh{n-+b`*r@N|2uM5&8Jo$OMUn7WNi&-zi-W2Qty(n zjW=vrq<&vg4@$hBaT>kEJ3CE2mij9xMFla%V-*i+{gtVp=Yt6R_%`H7;JEiRYaoX| zqz CcV!h{pIxH%UDIe5LD zzD&I5sKekL4|eJt5BX#6syV5rtvel9jE*0yqO3+jDiAI6#3&&9HGPr_nvnxifH8ky zW5jIzdMSLhHKQUVta|h0G~B(#`cl7#Q kZe9qkJ{F09(#UXv2jV5 z2^0eqKq5ST7Tf|odTWZV8b4C)i3 Lyz%DLms}l0{U-ZO?Q@qaD`o-XE6x(Sa0A ztC%w#mUn(M)y 4d)#o+Y%pR|;}MGHN<_6Fac^ zEx*Wo`D5-xw#;?F$IWrSwHj;^_O7BL_RZ&vu_Cy7P|k$J6T`@?c!y>OKbUWXo=K|C zo>gCWCN@ws>u&Dzw^@_%M!p*d*H<4;cM%}2RM4!Ozb25#goPk*JTM>;N|rJRo!()_ zZBl6UekJs9?rqSD&6oy}8Ng;=*KJj-@zq%!AU<4-o#WTf1y7?qCqHrdeq?<1O#h@( z@ZpO Z(P%kkuYufci*xbCldn$OX_`zOBl~|k%9Bjgeev2j zH@R7K-J88B1;H9%HdP<3Ci>{77}w7&XV|8yB6NGR!4_CKO zi{&r5mH#76~v zc0dCe*FW?*vK7WoX@i_0bI uNDFYvtS#rx6PaqV<6DjRPu(B>m-;^ vbU{doGOO(%VP*ma>t?34_mcmMzw;^NLN7DVMXc!J;L( zjQ5UfcY5StEH@HV6%g)gfq ji@0q$ROY-xBnuRjMx{D(qPzkx_m^Gt zAhHiD-nSCze|e&^z$9S^t$e+?BN32zM-PeBg{zzd+78g92&f34WJBpXyDkx3NOjBEp&J>5S_q^f_K7HA&G zqgQi?v0}nEBIMJC$33zuBBxtWHy6GuDSO}<%4z)QQuo&zP29KWK`)>-K$xdF qqYl0 zUDe9YJ>HURY3t6a>pNbm4PyM7WhPMB!t3n=4p*iFo!sij>^CvaCVf?qe<=zoO%G!l zd@|vdy2D6G6=fLzr+myxif24LTbD9~MrH8pYS<8Bs&7HBnB0qC?T}@5asq#3X^H z81UF{xa=&sP+lw*bkqx&5~J~fU#y(%WWKdb8GT5rWK#jFL$8rVKbP`5oJ2oS1w?yN zqY^>IfEf0!$r`q{Z!wC#JXV}fRxL$llKlQjt^SdA=yNrGqAr$&eW^)oNbV4_&JoCr zvMhaMpe9c`t0()J_r&L>$Da4k*?jYTJZgqR5v~xU@EI+aoYMJlWN+Vq`E5&c?p+Dp ztJPN@S#61wT-J%3sEE#D_dlg&7(R}ARqJTzUi_}(f<5M?wgR$r#cOoX=mIe_tPo;n zKqI 6_@@cOxWX)(w;V=d541O)X>7Ip*LhdA=IPOuF5}b@s>NpV^smaa#PU3mDR}KBK zPp;{w2l6#@mgeTJwku?JC# Gg8QscWiv^%S^5kN?`>uQ69|z%|bjf#07nr;a?T-1&?H^cF z{ dn c$*ZbbimZiOnQw>4`khe zwluxQX_5UzK)%Nk-FXfrZb%Jh JhbwcSUuhFXe#vV~o}?(pjS;b9P@O$sjhZ{OMN5BX7o&104#sM_*p^qUDWtz7C|k zyr`gORFI6>dD<2#$R3FErjKGN34rGOmT5D~XEA4zYFs}gtf%8}w(rEVZ{-1Tl>Y29 z7Y&ml>#qw*Eephk$@lxK9!58?;70G@b_uDll2*j*q{5({R)|Fd3N^$rPKOG%EWVX% z>6Dx(XL3fDRW|5O4&5D9op7OzVyzyWsdb{oxuk{-^61pYq08=2a}&`yX9dl?(IDc( z{*w^m_fRz1m3??;yH~X#)W*|i^6OWfa^9Ye#jAbtt*el7PJr%H4mAYtbgu2vb$?#P zR$@F!bKPsnZ9mX9@8*a1`-YSq%8v7Fhkk%Xc)Ib%G<3^p>upj_%2>tQoD_$3)KtbI z+o4gw>24zD3^F*7hnR0UQl+Q3W|0w^RT*NKx_+jM@VY9b3&m>{UiRhNL;+o0je-2P z!13v=C(|70wc8_*onXhE@m_q)>otGBS!S~v!vZAz LH z2_B@&%D6q6sNHm+{2u-uqQ>v>Fn3V5rl@lU`FWESZqSaX42fvsBgV8RQs@C-fXC*k zdya~U-e#uW);G;A>B7#}gqs_$*PaphVf+>d!i^%Z(i~(-V(APJ+NbTp+uR?J^oPvR zl>Ato5+2-?=C!JdYZ(|YqHBN&cClK-GwKwnd}7zVKo8bgoyNH|Mtv)H6-~xJS^3ud z{++-l9CkvFhrld2(ZNM}4b25mA)y|Km2$+-d@5)%;ZX8!^cCw|v(S5E8a27L#~p;T z%8=SS;ri>PR(0}3e(-B}c#z1AE4R8t&QJC_abK-LhgLOU##F0oLRhgtQf;wylY5of zCUBIK{{%iHQr-@KES(U?8==doOIJRW^b@n#DOvtbJn> 1UQO<2tq zF?(?i9$o>P3%;oJe%!) `VONTYd49FWkkn>y0{qAftA}~}YQa{b5 z6(_(QMOUv|FH-wWVhD}p10R$?_Z_I9JzF3#9&>0aO|Alb){3|Ah*#OTIk8gYM(@-& zNlAyAgqgI2xDia;7XNwINZX)@pW4#CN^b4#s^Y?vsrBAXVM}pPR!YA@Ag4j}K}fh< z2H2h=HbB0Pl_=Fnx=}OayjiuxKhw>1STS;RTLHz({n>W@#mm5Yq9@7PUjUci!6(+v zvlr6 )N@H4=vv6fu vx8QlfoSx^edveh?4MOY fx#Y zsdc+T4>x|X{F*b;)|K_+Bk1bJ3~Pe+q&<*2k3cwN1W`d}0=c2^lVJ8KdtXGTiWq^R zI?AYfWw{FTPM%bHgTaMd ^fsfaQ1|cvoJ^2KVj}kv? l#PSj?%{Qp_ft46A#6d @J|l+1$&q`Nat$s4V}@DkJku1jtZE8*$)rv76Pao zR%@V&fSwc43xt {%4&NY-0P=w$ I^fUCqxO+ccbgKVG99nHieTHC!|^ zbl0@%s-Hr_z##M!IH?J8Sl+;5Gq?G|H$7uEjnz8ovl2L1Gry!@=+Q9XV<$XLACU7I z7!E#FHb+a_Fnhqh39;LZp@NPho`6F+M=z0Y8E~2tdpc9BE9G034qh8%{;<$?y{z|4 z_%*i_cOHY$>2sfLYUdeu`u=V-03Zs0!ZV4Wf+Qi7HDm#@Z31i>Gdv~hU$%F@(tGdi z$j)S`h)1^V)Z(|!5O}5-rH9W5%EsQ<$+Rr*H7DjRu~S{*KZa{;pq+s-lC8hHG)cqx zpAf^ca%(btPNtQmI+@!HId3Q!)a#!)(w{w(b)|bIHa2ZKL`{JR&FR8f&zTTQZJZ#@ zk~bWrGOGsUuV&$oLS39SuU^!(%rtuv|Hai!pgHE*#0S=m>Hlm_SsG(09BG>|X&Ch9 zz4>Qo93r6_Q;ICm3MR(7Bg$I_oU6ap)pjAVQxo4KrVgc@S>%Y8R1h66E+n{#!=Cm2 zjhZI0TKwzrz)F{q0o|W)3oJo*x&OY@$l?4t*ER2l$1yK2FPI`&JrEHPoC)m6N;+@y z0 h z*pO@Fnu5Bx>sDD)Ze^O}Yqh78-P&LfUZ|5U6>ex0;kFPp5D}2G<50Y`*>$pW5`bMI zu4dHHu^C?bA3X!j$x E%tcIC)74uUyv3>9DN#5?+l=+9q<4~ z)zsi%Vfw2vf)O$Agy$sHOp{EX%QanrPp!`8H^VsL(H+V@$SP)zZ9|myP?dr3C6(~A z7mgN+%hJ&Ewfj&(A!rxqk?YP`%an5?QAuG^B~_n1xgHE4A6E_jM2GRP$l69_1uNQ( zmkK|(dpXwYtJRJ?f@tX{nqi?Q4vW_yxL5}>3%hZDq~aRILy!M3nYU)+o9yMt$DT-b z^x+G&$ypeW0~(hI5d6BOr`0Raj$j?wbr@T@(3!TqkMXtjvMU~~Ozf0SP(178Flm7q z>%Oq#d;XISrY6qvJ=fTyw;ym_sv>^t6|Ms-2gN?tYiK{xv#}*>SzL6OYo2zIHg@yO zN*&|mvZ-$*VdTiy2|8KDu}hC98O+&E6)<&kXWbb7zKpK!3*Iq!ZOx6>3M iqeBSpNK3+X{(uo~n6H$7VEaRF_EaHOsE6y>SwbLvP zM3&!IFG$Tz8Tyc{Q_<
BMlbbfpdzgqZ$oTp2l2LY?@mnDy7sl1(ViYWJUCIphv2J(JJuzpS zi=?G5Zn>3jJ95El8g+TO-*HDZWY(-x)vPm6n%MZz{a8v3g=XZg{-6chv%xkGj8o}A z-27!&a K+ z);3Wg{DSK_nKxf#bI!(C5G_e+sMaVuto)o4lmGN7d9K}Kh7LcO&eU)aQnkKew&!7e zJy9f|jyWJ5coIF6KI)Zz42KH#cc1%(?SX@D)PCPlwo=rfbZxyR#Mp^^T^sy1@bz5m zu-99SsZNJ0g7!l_#^M*Maf7J3jqzL&H8W>$)lZjov4yhtI$UG=sg>5dmMbOkg`7;Q zMFjuu5oaHr&Md&guE}q;(!D+`FM_9QQy9PPwS7y XvAgNhr!AYd*PXMQR4 z`^6VOp6A5T=^;oD$*P0?VzwpPB~UI;roy$%su+!?c%$tPym?V2iL7o>JX@qJUK+ZO z3}RpXnSmtk0t#o=(rDA_YDK;pt-I=^dCn#+c0h~hWEM^^yJ=2NZJZVsn>Q_H0XgMjxYdI|)kYie5 ;Bm$^B(3=Q{pbqO_Q|>%&Bh$qPgXF3U>%+%s7dPH zG7b(-* *+(v zD4pQobx%Fm{Q e|HublKNRUuqhc 2scO9pNbeMUpEUdhL;2j}$(){11TV0*S5QKS zNn>jwZf{93H&wHD_t5GsUXtXU)af~QJ%KTohA!G58~_TX*P+^C7#tJTM2SHhxdrIp zOk8@r4{R3in5dxb&fMD2ABO2m8=pF7Wg!gWE00WZ%Z~k4lOV!nBP$2EKRb~8Qq}Zw)u8rc zZOxmkFZG$V(N~XD$X3)$mYlpUKVrrLU{+^F$>-3V4FOp6x^y+7#Z^9X8d&~G1nEjk z1{t*LbUkm=%3QvxQ!O&BU0fVdi A9Qi!$a^K&3Nl;a?*b+J@;P^}ok)Q+G zVU{?w_}3x$g*hMuUy`xgi+)!?0g6DrjAEttoY90*Z7?|q08W=VliRg$`4r8+>RNl+ zx~u|Xl66cg4`2IEcOPHft7_kJVGu-C;uRGX983ijKqz_$0(%dXTQlNk!5Zapx3-I~ z3Ht&X_kDVoo(k$hQd(k&_OJt>{ro5Z#J@)cIX*H*XeF@!5glw_=Zuh%ie$Rtn>+JVD_&pDP&x60y3&nrclmp1WS2EBP^q(A2 zk2~!~rHCh+FvAY*wf`#WXhrw$h8_Rrm9m3dGWL1M8kBVuWw=o2KhdlpM=}r@jPou) zU?7J)30U@ZDu@$Mg=s5bLLU{RnF|l{Z}KL4E+15;mo26dFJr}`RorI|#Vo6E$RMHW zk&ClUL85rcmM?|k^mjhrd&6~%yIDxJ7s!aSBc4V (GT7H^Jmx;EkC-img( zc)j_X@2io9r?%R6DQ7tds}#G!w-28U7gdKj3)h_$1C;oA;|vaeD~?z6As(t=vsx^# zvw?NGkj##$rP$qlO7%+mWn$P|3@sdDI lfpTl3#tGu5lAS>16?l&&3wPL$+ z7PS4P;cEffRc=oAFT1}M?`9mp1QG(YdoR`cviqD@-XovfYN7$0`US+W6p-7Cr-D8? zZLW~j0n@^O2;_xtj$-L4tfL6BOM`!RqoaRQ=eGlBIcc+h@fBQGjRNG}ECjgyAhv7! zMLHSn>sL#Au0Us_HvK%RcMnJua55ES4CD@_3@AUd|KStz4PrK)a)Ao!mnXgeJpJ8i zDu_3m!VSS@9I`?~!9)WqVDE&wt)|Av4a!f7)=mcbI{G+zaTr3rPzVqjgGA5nXYA^t zx8{Kium$ArKkU>0({mvI!Jn=E__nzLod@HOkwpQpsxeTcn+I?#rPlP1{Q=-6{-Jy3 z!9>8|3rFne1)f99s(MpF9YAXIkKGl6v{6QXLcBq=@#0b`0f4*Tl9EBL{qN`$wLkX> z0Pr{kYk}?W0ts10N5s|~!F?7Ijh?mlzliG#Yw96@iMOhXtqj(t>{1B`CARn{WM+)F z%@yvBXG&(*??cvlawhG;mENrw-c`#8iB)N4hwt|-`?#a;30vM9jvfAJ^7bWz(78x6 zSEzv=ifxSIxoGTQ_*G({m3;dBThFF&JxR}|G#55Q4a0??|LN4oAOFuEf~()`B$`dI z10GJxCK@~oy&fBYPFiu+D%@FY35+0`eNSfqprenG>6E{N-~`Z=FY%ZiR3DhWwkn3` zP(h|>o$nFVAZ-n{JG9_G)yhDDoi^m9c4&G#0Yr^CWHl8bV@L*OZY;75x`9EgTf{;3 z8M~;U` +8$Nvi*oAi)aS~w*J?>;NJmIC}k}+F+Tr~OMJV_3btO_b~pUGd} zRBX4Gl7ogQalByTxxezYj#A=*uDUV5X@ApIM^Soe{KssF@BS+aqZVF`)B-8jYHsA2 zbU8D4Z*VQQF4lP8_EA-2k<4<>rE~oCP75rrp!|ZkgsAq0k#)Dqk8jwY74qyF#;Y ziy>F;&xxmtv5Mv@3|WvAyc( TYUu3YNW3X1>`m7%fC14fU?ry9Pt1@-rFe&h&gMpCt z$+S$X`jPDm@M_Xz{lx^1%VKO< P6QkLR=PLeSW>p2Zg91Kx;i$Jb!sKv>^G|)R} zYROlNMYHqm4}Ok>mok@S+QEb?V6=wj8zB2+oq)tidWY%f7yu34W_{r>E|5nLD}4$= z$d456KR4p3cTVliR_>tYea$WbIQQN~+icIPZg(Gwb2K4E<2Po|IE4Xn8pZNmU98d1 z0Jc;r2*qZ(PwJj>C}r`@YEmCj@tI@tE0u2bRc&AR^nn<-+GaLTy%(`K;3B ;JS_VeR>lW<&gcRT;8RqpywZ1jchsCWlp zxx%dbG#fn{cbE`R<-p?2fu+3^iG?dwPNkQdD{GRlP@c{iD97r7X0n4P0xMA;K?+Ux zvP> ZiNW=-+}9g#HjeJ6{&;Mnbat0rZqLD)!Zh9A>(I1U9l}*JVC4)HgHS=*-uo7N zYVWg}T#3c**uG Jdl(Q|LD zL8X*<)$j{_!flP2Uw9;KaXun-`2%CPKrMXT_KEY9wWbhWcr+1F#q!!;BOe}b+%&K& zX`w0&Y^M<(_k<*jeDXDsUdzPN#B^WOFIdtosA)NJLqk79*3=K!P(!*Au-qD|*l%qW zH}xKNZ{jdW)3*V0OF9yOx{fJ_N3^4>fd|Q@iRlmv%XIUJ>e{sfF(E28hf#S;N%8j` zod^-NJO@YLT@AlT!7l!M{qmiFh4e{(PrPCaECS3XFkGEl>NaQ8g!;bY N zDPP5luu48XQH{A}a*cLvOW~@#YiqZe;nXN9z^Gz-7-s7g*Vvt=$nAFEUlu iuNVw@(8#adpjWnHF_M5y)s^UV^y{>&e EQzd7GFc5!J+VaDy^F$l?F<}bX!b+Z#>vuyoslYHGujQ>bM;V`Nqa>L0&j;e ziV&RbRWV-JyL~?uDJ2rGrqeBSxS{jrf{Hs{!l;R8kY!)vPOR8gACi`{ lV)Jj=q zh^u*BAhw{!3zcmKRa-?T=Jrf_`Az8pMTriOrUM^dV?&K6G=S#)A3LEee@0mB(f!qc z`2H9Q`+1ORxbk25JkV=TeUBwjN&^!zIUV~3(8I`qD#8D_&erumPPyg8P;OKpMinTJ zvj4C>SMeV$1k@kgpsoFB{Am8lH{benGiMyIDG{zz4hZu@o%rcTJgn3@Bvl^{sa%kw zc({Jhm{Oapies|_oglE!rUUW9muf`2b`;XpslYyvFHt>_(mf#6e|aqqswCZijh% ze&sCbQnLas;l6ZZmBH}SZ;nG3hAF~#_rV-QD1~7&pXhdQH4pz`SSV_5pVRkt1g{?} z`+$O4R0<&qOfVf%k)GjmYE4ndoJr&9gjU3LY*<21OdMv;c|7iWx3{KEgW;{9QI!}k zC@r7ROR?dU60gdsS8ZC4T$))j@*kRs-*gVdmAQ97=^KRbyp{vI(x-@Ktto`u%&vvy zQH$tQ=Ai?>MdeIyqy8Gd!eezx5^Z|<9v=H=f1;bG8OGsLb8Y=_v({K*9PX7`Ny=l1 zfU68Pym^?$kC8oHq@3swc5#1kTtgrTb{rYJ!;Y(L`>qfvM?_bSD~KeY;Pr3JiMs_9 zE6F!%ob4^Xv>KQ%QA9qDQ)`^%lWyIcV#bv&yvqC%?=b%KK(8Uu*Drs<{?X$Lyi)p% z&$S#sA#km&bxjdv4ybX3j6#PdQLlKDs>at=*9$nJ1O;!#yH)JFW~~dku$?g7Wt+&^ z^hU2bQFJ%1RaMtLeHO@fm_XrztG6oFNyX#lKKok76dJG(PX^_Ote>l{OA%#ei__%n2jSEABE=mCxX!j+ygo&{M( zZ>!?byTB4V>fsF?z1v5YAc>JL;zVPMmk+?L1|bLXA)x}60Y>AUts{xJ6~hZ6Mjp35 z$6gnsX{HseivWkDg9lY4Y(HS^eN~%6@~R{q@-=LEEXLnGHW!p>JJx *czUa$^hC?M&I fvzc=d%?-HdhwY`r|sR?9< z-zNk9(rXmubR#|GOeXypq6SfkrF`E)EM{b&zK&78tpS6wpVE)8qFF`nmQq2g0Xom% z2!rZT7tdR3Pv?d<1)|5X>kkc8@S0ZHQPaH1ce(^j#6Vx#Y+QSx#A`bcRF~&rM9yK6 z)9}!I>RRl6oK?vU_FBov 8hKv>vqr3AjHxEdW#0H7n=1jfZ&b;O2 zya}Hs=Pb;Jmr(iSoQZei-jy;>W8RgEU6oIrm40o_ieq^tidzVpMVwq};;%hfvFye3 zRAI!3p6l87tk=pR^g^*Cb>in2eD_}tx`aUHre9OoiG?53bK%*oYGAx*5=>B!J-skr z-3P{soV3+ue=AEk_t-SJa#mHk&6+1wV@R%7jimJ{WNq-?gk?_6KzpQ*Gw+dH*Ny=h z3pS&A$IrkV<>rArmjkoFWmK-_FQsV2gk+ 4^QN(hX#d1? zT6|he@DAxv-5{xLv~t;SIo _jEf`cl0PBV$M5vDvQE%#NcK6X5Y*S)Bxjee%@Gc$LDMEHtJ%)s4k z4pedqZ~*Y^e9#}uz5#I nCab zLwf2yaEa!e9NI0CU|ht;1V7!`tkJ_tGD;YTFTk#DV(*dbpJ1MmB5a=OwWf!{pPEPt z&7oe9uiItazX$JWL5)yEpXdo%23Snp95&bIvP^IjIfuJpcPvSQf<}t%(d(v}u=fxx z=VD$qxYO!p!CPAn+6;kclkMdnD n z9~5o94;>IacdN2$fwX))?nz=@+_=;DlX}n06;og9QoCI1W>5DVUH4~+OD;lYlV^%= zF}XA|mOOI}&(9AWr0@>!IvaJ2NE-Q-iUCT~ |XYBWG*H@r~%}kJ+fP zsZpt;;lkl?w|0mhOdJQY86g5C_8GI%Kn;xcr{FE!7_KQ@+sFM`Z^P!QQ }teqym=(pMuA%$1cl4G52)k z8`NN9{>w*v22Q*byq)O9JzmsFf9zwE7-gu=yEW>Op6qmMlPF%Tlt7YHVv>|tbKG;A zRF~^t^Ggl2VLU^B(Q33t@yXjq<8|YN{pEaY6Mk&{CnBzKy8G+Sfkek{-}u7zwc(PT zF`(W W7KGR%ARsJOb=E; =9PTiPj-=%5G&j_`E0vd~F27WwlM-(NJE=<_JIA_n}dgvn>$Ge=ZId?aQW zOVplh%Cq^;e^_f!#iwA}!KdtS>*-Nt+6t*hw2Q6Y&01RV+l7hfn!oExeBZHxd1!tl z*ywBK+t|T4vqLk3|Ha*V2Q~Gt?cUf$P!s`C1e7kJOHo>W7HR|prG}z(2q98JhbT&s zDj*;rAiV~pgit~vT|_`S1PDz)N+6+x(DFNL@AK|?=Q%Uyop X0F|yH4(i%LO+wm;SqZ+ydO7sm){a_g>7SbZGfmP_k``ujI&SS= zDnVNYCrkTo+b!oz)~4{Lw$8+G5w3b$8O`e{J*P}F-uk#9t?ru0uw*K} y9# zEz`sCCQ;L>;(p&>y!VBDaDd7c!lpIxXT5WN2%AZ;p}QYnYK+>Bo|$Bs(+huJu&PJp zZ;@Lejuy*9d5RT2iH5K4%=%yW(~h`){rbM=-I!rO`2_SE@W~@Ns%FmIF{ItX%P-I1 z*GAAo?|Vg>!y+|rSeo+f PkntyM{Brqk`e`w)kVPI`$}7%voLp~oBS_h1Jv|is;QrJ&@>ar{g}N}k zGLP=ns%+hugmQHW=va)+Ea-TfPyLAyjXQ5|GR2uUEnfA)peOOf?6vj95Gc$Wk8s!) z)=@wnL%j-eanawv7;<(TP6q}P4Lx$n{d15~>6_z1ByWwYh3ELfC8)~cElA1sm+2%c zw7hHy@$3VKbCn|@vg0mb&K<(}?xMBuZ4(`9P=6Ii)w7!+FAWqTFLih^%I}?i8I^9C z$iQLt!IGUjfK}dNa(ie*y~|1iP!>0drVx73{Nmt?fujcn=-qr`Tx=lfCJTI?McY2^ zj=LnT!TPVLA&vI#t5?Lo8WkxNNO!4;OwJc{y<4ssMY~IS_rw}+Zb k z*@pyYV8MT9FP!{CnCD0Jvo$>_4;g+8vtgqDB6#k+CkkQnNTp9N;%{A1s+5E4)>vy9M zqtR+PkPP3z{Ih55mUOl)bWe<*3MybZd$wdS9j<^qQd%y+;xj@`o2(@1#F^lcroybQ zyaCIIR#f!Bk)fW^^;+J*)&qR3xQ2hh>ii5@=KW<=Pj_sJa~iL~8G9j4huh}b+_8s- z&I_$s_eKa+K}J<{&Qnv9dM_k5D%&0kKR9jFSZ8+m3uN(V`qljs50`PsGr)Zz3!H_{ znNST%%#GOPRzf6YrdPhy`-69y`^!*alfX0)$Pz}I;dbWkd$YH7ccWIz8FyCFE5m{m z(B}K8H&9XOGwV{DyiJ^0cLik4)3`J9R5 Ke9w6${;cahbUQ;Q!d9dQ31P%r*QM$H;IBegG#7 zbl6U{-j$A*hU!yxKDd79=c`l>)qVV@1A6*QpGWh;lTB}vk!JegY^KtD44%23Y7%xX z`qof}Nvdulm1_xPd^jYRv{ig_`{=&f3Hj;!l4Gbg(>>%m@MO%WJ|tx|@*+9=0ptWB zjB(3P+2Atp%(IY=loxv!hPfz3Q<+3eA5-`Qe&{ZIxTNt4&wpIGlL^3dZuAw+p{~=t zAh6TJJ3X-v`
1pE#!Gcj^)Kq*msj&@Q|^p@RYwd@E|cJQsdbFCe}pHQzeL(2Ukv r`c z{2$u4UoP4JVW%zqUA99&>&-L5J!~cbGSE>{^CQLt!08>Xyj+>u2T;D6!6sfKQ~NVO zljCbY&8Zc|>oRtuGZ!yF4I?$(nyy?mO&9X8UcEZiT4a!D=vLI@H) D!&006^X`)=FJph?EF0nT}*4NE%LciQol+>%coGUi~2O`vpRDMXiRlH zP`9CE(-Nt)OzN#QYta!^cM@Ah2cOW8aH?U|0Q6xZu~Sd0JG^T>N`bT9xb_KVN#Nzp zZ|uEX0hO#FlOeb1IdgRP)K+CcHp#OJe5hTqDc}6?9%8*x+T^~#bg&)#aE{M6@^Nvl z#+|!-TGEoHLKWF 1t0Oian8BQSdjtJziEqP@xOY2BH`?P@i-o;eX5{wlpBulM-F zS9;^>R RF3ie9dsTod0>RU46S>YJy(!E@fA$)dFG5mb%*^fMER13o*Co@AistC7VEBeUZ_ zNlDse!Sc5_pglL0T$EB`<*M`E3MBMvP~OsVZK4@6@j7+C7BO}rIYNoezh0z#$gqRG zVzSowY5MegSwb!1x@}=i(S_OqKeSuwj~nns^wC&Kl&|ZiyCcKX7qJYpaw&_4f~Cg@ z4l4bzN;Vuf`e0-w{Unoje(o&aH{~65*f&^?A4?2;tk;&Rn0qQ3dGbQ-`(~e%wGdXu zk5tlW>cu#;VrKq|mrenUYmYWaPcovaD2)70QL&t!5jT+ICZ7-5_xn-IYmqi@Fd0dQ zEvQ$`rBHgTUFsCa$gonVPQXAv(g`lyUbm$^3UMrQ)31+Obuo_UWuJ>$rgza+$5gLZ zIx9nhltz$nBU =`eZ6Y*)|BjA+>_4vqX>H ;`f~NW`nDg*KB|d~1d%^&2xJ^SIbx;ywgYtN;JmgvYc}Y6iLiqB zNT*?`9W<Hm2-u+0j?V5U{2?LQ=-M(0R_vhzQe1^%O-u6X!sUmJ;z6M5481?=BUIl$}&2=tK$Dx31KPu>(cVrpttAC8dw|t-L zLDXh89^Fw|%-uv5Hg4Lk(QK%}q!Pu%EkAP{7*??wB2qVMF^?d_%A&{JKTPVdB`tPF zx<~Ez+)W7=Hn =cg~2G)vbO{5;Hk;O5(zsB=S}VgD(34GWWcdniVaZc|sF_(tBs|Jtam zRb!ur>)%h;hy&=dAg|w3cg}k-!?g^h#!06%!tUL2a>>R3)Tc*Xw1YrDrEiy4Jn7qv zE2#-b4+5};6Pap=Q~Qqnd_IFZJ!ek)199V&RvyHpm*o(+&JIH<4;YCETmL >SkajLsixlqCu>8KLkMA8qiNqJ{WuAOe)*#mmrpZA z4Cp-?sc@c<>fLesK|Qz5vcRh}7l+MTL0#U&>G{qh&aPT> MXUtrJM%aEr6Mi?5S~ivzZ<^LCTLY6N-L~@Vr?(j}0ILo^A{tDZ2`$ zX**9_*uTI(3qOH(xYrA`EQt%2Z#zc~iS!$4k6IgxA{F>An%lIL10ykh%x`p#9++1- zzBtcWP?gA`9%7c+F4jq&c}=K2i=|?}HSW$)HsTBDZ*})y4na-piB`EY9KPzvd?k}O z{Zr>K_s)6x=jIxVZ+Yo}ghNL4@KMC(X9mWL4ahs)3e20n2O2X&$x<0NNcSjw4OD1L z$hCO0>R&s@y8Wg#!$^o&rG0Y^GtX5aj~~A@2Y=tZIB-ktTO}`QTm{-RS~#?+u$a;6 zgBKa9+-Y+uwO(l~C`^UBAa6_t=T4P}YLjLK (*EDhdHIB86j{ zTO-@{x5?6L+N;cATaV5Z#KbFi& 88GpOBu13+dJ0y%`#;G;i9)6Mt@%!HFH* z$*?k-X@A-utk%)HZ6TSQ&%%-TozpfUA0^rSymjM6srdt`21t7BP_^Y)h@OJe%Eq4= z$i&3g#cU-}lXR=~p=KOeEBnamIDBZ{G)lDxj%rVb$Hu?2c{o&L!?9YpNfz wN>v@{nF}Yu^riU>m>HC%3Vi-jm^K)E0T(){t%5DQpi%V)6-M0w7X$Wl7lIs zXOd|`lh4Ul5(~11VGqQ>OKV5H4Z-A|osGwHWT~0Q_%%&%q5*XkX~T!(rwX>CIB`nB zb7YnlbpZ -uU$LV;t{^6{$1KAh$TlrgI|nAO6WtC(LiTgGPqj3%H!~HWelnc zcNOMQ>`EgZ&qNC1()GOb?zpgCU3uj=#Vjc-v$dohKEWfyb)xk9aYLm9o{zXnjDM}r z3pU1oO )qM{_A0B)PkYY;dc z96ZxP-a=RQ%UzJ=IDYaf r8nO*hiFH%K*1dbV-JjLY^6gXH=*69^=EF*tvC{{V|>{4si1yM`~|kFcpm#o}%| zmDtEDi?5nmFk;KPoO~A~O)ZV;-j%mhy3gK~`mK_{rS|&hlVPg*Tk7F#QKY(%U+Mg^ zHk@ZYAoVRWn{|q(r{s1b30f)qCBfMC)mo!K1 r7)i$-A5?#)PwD?YjT8aybA&9+{7Y%pEV~hj6Yb287`Y z&V2d@d^zsZSIEso|1CZB#8mOCJ>!dTJ|Ta>pE+iY?G8q{v?>c2y%I2wfkITSZvmwG zVDOeH`Px$UYzKYl@CGdF9+iz&m!=Ts4UBW}M|;y%9~Aqc$ki55SFSBVl38)q6db3i z^*|&jw>(47S8=B1_W|M?n8nZF3ASp`egG4zWSo9(#C=z6;qt01NxuyFigjCdQiSg> z7TN3LY}b{tF&jC;A4cUjFPPi-+2{ &WdcTK+*Arf!$^+snwuz#6G9yqHGxQSnVRH2^DnZv>-NUSD?Y%d8zs;)nT znk#SUsO=|V_W&vD;#f#V+C$kGcBlq)5kweaG)l^Yoe1MII&^dKRpOBAjiSih(OoNx zDR3l`r&sRhw6$dqPm7a$wqv*<>*4jhFl|W@?hWClznQMn*|&j76Gyz|ZNiO2dI+Se z!PHjBL!lwohw1!1yQIW>yDQdqlqOow2t(!wGAgge^G&&Ng@T@63BZu+N}L>!lC`8~ z5_{|}^F)OY;j*|#airL3vJ=1-a1KL^k-Nd7%V(dEyL9`!*e9oNKNffk+htGwiR~G zp$#5=KCAARxC+%YF^nyE_-$Y4Z6faGXJ7B<`g!TPR#$E4oSS>wO4~yau2LOH8ko-I z3k*a82nq}?`e93Bdq80WZ0;Ox$U9i2P4U(EYU)Ma-tw!m>06qCFYJ;Ns#8{ZABhaz zzt|uZWOAIPApM?Ch@K?xJF4h|m#4tvBjCJmRa5pZ>lJ?=)c$m;=WixRG`Cx3g-reF zgGEl1S>^_IjOvSuohb{J_^A0q>W=fEjTo`#cW!F#n3aJ%{n?!K4Hs+SQJluSB)FA! zQ2AbpY}-&hgfZWMufuPJC0mIk5*5=;e1vl16fTUDbQkle(k)hx%u(;d(73xm⋙k zIK9i{{c=sc8G2AOYEibe!AP!&avqM3EgJe$p1+S_)O}r$GW8DX&t>%RiBa}i)$H1+ z0HkS}_I_T{7P242=7j{)E=BVvxg`WAdN^vDI1AN_NeZ5Yyv5|*X+9QxP8TkpK9Z*+ zb9Krel)3U BM#QNan2ZP@9odfaJ=UyhMeuSfQh#u?8 zG9Q!s*|TGeGY!C>ULEnRl0AsGVH8}KH{j-G-8ZB^ b zZ!fwqp|I1-sgIjBfCZyw6;K_aK1W~{=#~xTAdAI?!qPd0mmE~J0y1GdYF>=1&Outm zE{f?fn@$(M4mu3}p74YxFJ;@~-7U_K&?M}O`5fROzfdQTK=e+eF<4oTOATy9nL2n( z4ipN@`(&x1daJeA#Mxe~TTJfu1;6RfY%g+?&>}-Njw}8m4e&js`bAM;7g(;1cSGvD ze`Tvd1W9ZNBYn;9EdW3AeKdwMl3ajF3d~zQ?CbyjK2OKOT;NS%0yb!->4~^znu;&K zG_V@6x8Ytz5feTIU7roSH;2s{?0P_GY8u?t( z7udf3vDl?T19`!Qux@+E?{Jcb$1NY0s;e(GPU=J0oaiqp5fA9#0xJvWS2og > znapMhz{L8WXFT~gH 0G z9Uz(Yc)7rq{I9(D%#;O-d6RhlbY@vxVpO(^WaTkvavK%M3?uAf_oW+rv@)$jeyE=r z1};H#Z-I@Df6y2(2WM0|q>E>&l`^I3L-I|ys+*`zi{+?MoQJ$D1<+Rnr+8+1p4Gsv zO0?QT(&3{}6^OqZGO*{W{FTh^Gv7j=Uz5Ef6uErqb (vk;*dsU!|AP@-_2cL<{mvXAsxdZ`)L`d<^ssaBFKQpKv4px~n_{#)SRykYN3It8 z;Ad~hdqilwH0U7I5Z wnn&^L&+Rg{z%lQH@MS>_L0u> zhOdc}m_r6dE^hnh8r)Ug=q?BKPbhuErd!9uj &Vf>Q%#48sEJemCe}BiZrO zt9%S3@mi&PV|88bTNZ5KPhqK^O5q-%pHS?Lee|AioQV@HftjYiOR;$8>q~5|YZiP| zX8o`%5OF!`euB}{swJ5#BPYwt+TXMYe2J#nQdAX*Q=puA@D($~wBq zK-gj&Y|K^HgK?d&O3wvq+#5+Z(E~hp(%r&;60hn^t2YK!qWW#Dd{w2N9lw_d(m8w# zjzQ`@>|1zXzT6!DAc{m4Ok4`Q@3xfqVlUoxaz4wd6QrH*`5YG?!>>!XqSyhC`*Us^ zbHC<>u{LtGdpF|Bd`qo#IW9*!H74o=)t)BnO`3WT&*}%1iXk26bAs8i-EL7yp1vtX zpR9n`F&m(kD7Wef8Yu=?Ku$l6^*lC$`3uP@ v*_I&!6`24M#2-#KUs91;w?cemQrg^o|VVh9D@C{x?W95 z736O!arum@%r>TvY75jQ6kug=`e@dK@9RB64wmdPQ>;GEpCN^&Cs_z L4HFwQ%s1RRIajWUix15==w6TKf$Rju^hMsH+m9Gef+B=HgUp;ZvEa)l)pGrv! zVnO6TVhc0*H6a zFi?q0qx% uc|B$@2CEX=UIcS^@ZzsCrU
&6*KBJd$^_N1X>!HD0=+`7*fMp>M9Q8DOR3!PR+dlNnCk?nD-aP+};lz8P zME$^=4h|zvgeLDl;v3rkWu~0}D-1aqI)^uc_&=!w4H)pnjGye`{o!tLb9a6=9M4d* zn~yj4OYDvl)UUQ{&V&JLhcWn1(>%VLHQZUkAPxeMWEd4lES-MNe&Qsq(r1#;#9-T{ zC*=J3XbR*c+BlAG9P$HQlR2Xx*+cLIqk9q6Drr~Ky&beE&1a(MPrywMp?b&C(-Gqf za~InObwpbU;afWLsq9Tk;cn3?Q(`*f+0sekuPXxTx$kq3FKuodHUiuAkKBm@^_kLC z>6)psKM5@AH_LxD*A_3dnLrcB01)Fv5biB|P;o#mrJmD;Z(r<3O zzKlB0&0Y9W84GOnQbfL?wJpjP^;Ysk%#k47*3Oy8o=u51Ba8Jnr}CLjOK)HKl@%~N z5Yh!c{{jb%WN;oSLBf)Y*ek=!-@d=@Q?uODH~-~iKtcys#6NbEFB4ob6TiP!wZdVV zUb+5~f)p?tn*+BQ#~KP;P?dFf9XUDRvFL5G|9aj3=78wB6D8zn3!dXh;pMH5GV0vb zD(`ST+0!U~Du7;au2sP|t8Wlc2wBuOU{E7KXC)-8JU7kkIur;Jjf^F*FnB8_KUHd~ z-glH$)it?;8u^>4TtnEnu~_Kj8Drq8y+c=^fq|A*Yd+nMhN?ME0@|_fEV`VMfI(r_ zs^xCmD1R(4s3oIP-hy{#8la7^>F44||NjpA;&HtCm4csM(yjdwAbDxH_&v%<%I`q? zE%G?O^sV-6alT@l)EQ~trbEK)n?J+ )MqS`6le`U>_R%}+sRxGag zd}00vLBsBNHK)Y4Z1bN4=-2n_0ec)s^w 6lQ0_72%YdZ zlhEc QXQ42W`^VhIXCQtXiYyg47Om{ggVumwDP0 zm6Ly`rxHbKqqGJ$=Bt{rcuC%utyLcq{q44XPv11UTbZ(d%FeEO7!$3={SYCACTslc zK`^Hq@@If h*SCxjN1-(swSo&q?=mNRW#p!i7jK_dg z?xD~3MD5r4Zs=s +6;>ff;^Q z?559Ri(uMmmK!a7GR)V4MCYf$UCOM=g{dC2GM;c`oQ-6XhnBrN_o+6}rOf6#TTNcx zsHL%`^xY>wD}HldB^`(s-1=t=9;DQPml`@^`O;Ieisg5x3R{R>+#>3sg`#h;iixHm zdGGbBdRaVYGBi#yuSqgXGJuvj4&M%Q=Ns3>dp_<+wk-7IsFpd$Ev&un+RMaYY^G4A zf;O3N1vQyVmk-`|mmD>Ad7-1^=4iS2$SsIn#z#^4#zF>Q(2Fvd4}&$E!;g4ahg`Af zTpP(40rtmbyxkGqnZH7>-}Xh`3O#YQR5r;+TiNEfueY(DignefROO3W9Huc_?;~`& zi=%WCb~{#>`PMnH&ijHvikHTo{d#M%>hs^v{u&W#T*kQ=_>uY;4>GXq4)Xk$t;wZO zr8uSFaiYv%r;NV-#tEi5Z~kj5B++377?dYoec@pf*R`I->iw(Sc^U57CkVds@Z|6N zRi8soEy8V YDL;CFQ3Y>#qxSeBFSQ0C=1%1w&5;_ z4U_qjoo;Stxp2xyhlyQ5tOj#{vRT4YYA~%)V)_4NnT~(uNB+H+;n~vk_&L+|vY9Ke z8{oG)aM-u9ViZgVS=?JrwDCh0)MFdC_Dp2&HZL~+s!zOr-AL> 8x9}aiY20NYNVVuw!ON2TQ=Dh#R+yn zyyriu&a-x7EHd@m-k2%r%805)-XjMGFV+C7-pob=8Z>mfs_|h3Dj?el+$7k;^Tt|R zKi>$0@7b+wNWuGT!i17DOiLab-^e@a(+L`kKCHlwL02n00sslztK50!lB&nt=6Qh4 zwZnmn==89NX8USBx$5*3YiRpj@WbT`$q{>{VXXIV-7*1Dv9savlp9@7M=%B#=$_JH zRU~I(95zSKzsSsNZR{lJfG7Ne6@;@!S0u61L`f?8PMH1@l4%FeeOwu2Ug-yGx1q$* z-_Ff+q{&Z0RT3)bO1h2dZMxePkBzz%%9VT#JcJD0vwwsm6GkqOpOj@@e8#xI{3VE! z?&VbMx7=>cMm@8XQ{3 -ZUcNfARUm!M|V zHul{b$<<@}70RHJW#o V|R`d@A`*o8e;j-^Zax%&fbO*Der$ky{MYeFhq{E889d} zC6(3U^Nsv4fn+0SvbW)D4!I3SA(_|^uK}Qht-Hy0eIx@|c)xS%uofGskWv7aH2LPl zM?z0m1}D4j`D9TIqmB!-U$ps|w1VI!MMmY~LW3rriF)KRPds)g)0#FQg~fa5=R+;F z1F_bbV9GUzB{KdqSHvOfN@Lgio#039)+c` zfkLBkt|!gyf83Ap|EAg?!M&d?b4fS;Ry+-fw_@qbn4KZ2^Jib_Me(;uE9oA$>)COD zzzMYY^@Zq 3eWHTpu&TPt?+{9zx#1@UpevFz!nd$>1ExY@MtfP&jJk z*0f9eHTzXEeAc^rzEQBB2SY>8G{UI6@*mUpf>E3dz2F0yI&u`K^UyAjw^6OkMKdts zW<+fnDASr5&PvOjG&9fYgQoFH34 ^yK*V9_|$EcKfA)A#BTWrGp#9Q`>wuQ@7q=D-sfx2qm6=1GRqfHEoD-~ z-C@f -VjXw{D>Tt^4()MJ|x zorUCd1TuX5PoJ>)!HpE>YLI+JlN~-%nlrd+PPb_ZP)|JQz{Y$m2qjvult>pvtgF;j zhgyqKSc1QOQ6!xS_SN8rW`n_2gvtT |k%Pyqnbr5|c70&)5dxLBJs=v8JpRRi;ojmI=h-bHyv(~Hvr<+?gRay7UcC9D* z=eTmg1^qG}1*^1<(v;OPsN;Af+S&A?f3Q$hXH}c %Hkmy zb!!8IR@E{J1D%5uSti)ymkKI {dpuyV(wj z)Q?ENNI_ul#gSw4_d=kWsy*m|dM5V6zxZtpAA7JHE}CG0CSM|HCU|$}@ejS8j4`SQ z>d-w)uhJl5hcF@CPIPJ`u&yv}(XIR!D%Ugbwp& JTSj8+6MI`N z+wR;^?BWmBH+~cxrt!S$8N4n9d*sx=f4rs@2)ed6by&yPN&Q_*-gfG2oLNtsXW_Ne zz$Sfb#Ks^&dXQGEvS~C@O-nCvudNXo+X)~ppXuQ5v!;d4+tK`DJk$JDk{=w3M~REu z3g6qplaE)V2mG-<8{=M9!jlFKW zg^0#jA>EQq`+tpv^` zYGFq4YU9PvB;jcNA)=nt{MLq jw>j&tKk*9D1m|eSJ@?!t7azpQoC`4?MgU zzlQlq4y>&Vl*=#BQ%0}wV5Y^^u#ipnN|Rc*15{Vmspzf{4n_}SaHQ7%N?tnYP_O>- zv_&`1SuLYSf-l~DOt{W%FZWf*G_&pS=ETGg1qkA%-_m4fyszX)SJXi5c8S${TWq*? zmPoCltw`M9I2?j(d1H2Y-|lx~L}&JOKX)gmk*g*n@(@YblML(nL9+VfnSAxzRkexx zNA<~G7xQ%P=8CtI&)e}cUCcCHP 4O3>&AiB+V`%Wo#!HASC$^pm75SxTG(6DgnMhLgu(!6g{r}ya=Q*Y)3_x|C0D%pGiMtC=B zF;W?sL$Ml*#6TnEmxiU*ccP)1)!3-(>sf)(JpFPm(k5#??_Wxb=ZyckCNdTlWaqW8 z$?fOce(guMKN{9}Dd&~MuSNURwrlK4DY&fiSNGMFhxI=Xdcjd30M9X6wqX*Cc8`4J zt_aa`(FtfVKib9YHcyTo?51b0JI!CbJ8uwPexy ava#i+$$IvDHxWLA2``g zhS6@O@k)Nt^u|T0N-dm{Iejc_bBeCgb%1E$J!J_9kXCG=IGy=uH6{fHArB%P`;&=e z-XVb(sN33L^&NO5l*C-f{^N;~O}+6{?0Aqm6%l(Bh@{MKn$xE*n8R+=mE=#@&> U+#DS#sVI!CZ zrBW!F0i8M&R2_Lx^hBW(cZi&L^W}21WYzwKmiOCUH9tuYCiiHwY^nD}fnS+@?a26C z%Vs#dh(5ped<+Rc*JcrtGtW{6<(byM?~ciV`Jd|febmooAMN%g%~}G#qEzEUx=ml0 zm%cE*(x~-b{f?F2Grg)2g-K>rb1#R&f=;xTiz>vyLFy1yUDk6mF|kU6r-v4#Rl89x ztd&9o7+Tg^jsWe;9o@{?E2`I7mb W@Z?z51JJ#mK&Hu9YI=6-x!tphFB{zcGLl44Fss@q~X(dOGC24^J6- z9?0{?!+mi7gKDX9I9syN%dzl_Z{9O5(3ciE!DsQDs|RE6)qBhR-a={{Q`G7xe={L0 zbzV3ms>P&n?=MYWYE`Y=IQ#6kQP52cJ?zkzKKUF6gvh!&xehGTLF(AbA7D(aRo!As zP0aYuo1v%JX4 3v1*ebxRdXH!q8T6ofu&XQ813Fqh7_F0I;n-j!0noJv@IU82SptTUaHA|ps8288y z?L7AEPa_(gHVk*K+_|IK;2i7Z#o3%(k4fenR>M_KYsZ{*;O`i=WDJMg8$5bO)#a7$ z;8K?w@eT$XHr5PEKE7)4=Om~&FM@of%Pn=(Gct3kOWEo@4(s>n%$1rHzMv9(?@=D1 z|DYki1an_wBR^@^2jx>V{@gU0(Z*1vDz!_82PAJs23gI4dAj)W2V4#c!_be)1=|H< zYCWeO*g2fiuD&*Z@9c P$nWDx<8>hcn$WT+L?GJzTXG>?E7p&h9 z9K4$;MS?;LU)`9lsIBMI8G1>|VRdPc70QU@t$RZmnyo0IRz4eYLtbQiMny(uEv>a_ zwI^C@6sC 5WU57M*o-?=@bTz3ZL||~I|C-tA4byj m|LXjgNIy;cq4`KQFDidf+B|B>b!k;1o;(wkxiW4aO-t<)a!t z4i2oJZX(2e{aps*iESM$Wl9myZwJcszJskkNs;e `Wu4|hkfw}7Z!SmU$Ts2RMO@?$ku;?i z51z~G++TkrZ-BNtW~TSyD1wbKrt$e_sJ=3&e*<-LAGz=DVaOP>mOw@F@s3G*A6f~v zq|_;Y4gn3FF7r9?c>4@?B_#F4 dlHyBE)rglN~SFIoUSpDCl~-=Z*{_+{@BUwg>K^kt+i>N~Is`8g=|tq`P$B zc>}~fncK(ZM;;Y^p`;-#y6=}MDD1{Y)!ekm{ALFNv25isG%XbWs?2_g+ge5Ex;bkF z|M{oVn;_uW&wi 8ThFZK$fjFJ@MbV=^Y6r=K@Z=dLiipX{D+{Zr`_^T|{ 7}f+7Iex;-kWHMI@LK^Nkz>9Q{$&ujOk8!M+Wr3GFbY8<)lVo@4WLa zw8gV;>+2PkgjY`x_3vVTbzVL#`_Ag?k@#_VEtr`uFyGdmo>DM>(e}_>ncP|8RI(c2 z-MX+oU@<4GlsNtAr%Y~RkC$}Xw)^+nS{e#xuHQ!wE*>r%c)3q+pkY>P8 $OY{hhxY4DpWoSdg$cAtzw{Tt52&L&)_!VZ}(=U@9 z<@P;bE h|Y1g z>Ye rBr{GpP%5ur+BLm^RN#y75R!YiCBMgxtG;@(f`D^mx)KAobTKOA?XK6D zEGmMm5uiutJa^Z7goqwW)GkQ}NMGzt{tUUpn7%kWb50SHLwD!D0_`of?09+8S81@n z#C%fYN_}G-2*gwJDoJ~Q_q)KE=eX`>4LFf8p0W)a7{^8+rR6jso8sd-{>bA*;;W`> zJ&4l=5)r*%$1OV(yIZrLV>VZ3stwwXp{)Um5y#OUc7^m{DS_%}{Sm448}}-> BX~Ao!Z5Y41 >^s~cYdSe63u6EAflx`+b8TuWF~ ze0!`g1`TfYP3MosA<%y`1uO0<#>0wuzJIHGJe23?s965fDP3>Tlu!FZxs_8W3LYK( zHh;>mvIR@j%$N_pf| 9@nzQ=thu+ i#{=-Kt67b-%OZ$9gFK$&md(pM1^Ka-2nQK(K}Mr^7Rd z-N7YmA68b1AjMWQR{FUzkK|fdhqP0wn#60gE{!-o)z>~-OZx~NajxACQ1Q2cZEoX} zrL6tC-KGcED|Xffi9yNOdp%&{LMKUJlnmcNL 7ZxAWqMvk2HtUd zSE5B_9#e_mf0*{ZqCeucAsNGcX$Mx~%ila7&ACWR1ewDNr(D&aU{kLti%u3^)~J8r zB-vQF6%v>c{i22Eg{R_Jl?(W6kWx;6Q8%n`-ynZAmDpQy_!zxtMXDuxiAs3krhfW- zF5TRJIOowz3hDZriLJ82JB>#RAM0%<2}jSpHOGgO9%E8_>$Y=sLM^%T_Y(?D|7q(g z5Wl%f^=aI#!-s^XRA)e~w)R0QDEVf6$9`H7)%5)?xA*k9ZwCrXl_jLrmBI)9^IDj= zKsC8_3(F~p08wZ0e)9a4_MAOtxqj|vCcDzaJkufE0}r7r78$ye=CJ%R5417E*oF*Z zS?j2?k5e(5_s+W4I|UMaKfLVI{(;HBeBNN9vW0YqLas~oC|czjrTJo&D3F(BBr_`w z$)A;yos*HmI-%NIvd(+!Fa83(W_o#?dc>+~^AfF Gi}eEa+-!e1 zLtMVM(uLrD_s<^j)Za|`5Uw@Q42Ucn6hlCLk6t?L!7hT5K4)`={LH#YjrutTEa_n$ z>R*UyxFJmRv@%uH*)HsdCG qy^K$tkodukn*Z2|*MtbEp7dhcg1x*gm zUnLeflp->EJ!=Wqd}n?qE@GsKrIV)dtz@S>`lL1v*NnYZm!1`Y%rCdKQeXP>(4hgd zwG3K>BeB8XXWboIOqNyeAHwJvrgVg21Gw!Yw5*@aB}-^vz4q8TSObuY_< oi?3{ zPkUhrHEf{>++CM^UXghoHLxyb0DWW9s1aLVTUQ6CoG*;iNKw-Kty?YxkV$HmihK)G zZG@drU8#X9!HAOVtpnK7ekx-UIRtgF>t8 2iyI}$+vEWR_{xk=hy)#;*$7gsyd7Xe1@LB+(Ii6%Wl82Vv!-- z)ZyxGm5J}5$)4{@Z6b#o$h=v!TdK%t2Y=mr3ryDiQ@C(w4uHoY%|jUm(Po4ws|OVo zx3kQp+>K@-o)rU1pOVr}7e2JPw_I6uoE0QoKxd%XEmrn?8p8$?)Nsm~!vSvVwpXt6 zwQEaS*hrk-X4Rm*R(f&4Gg-=HaHIs ~`s!M}ZlIMn{ysi*yb#HBf*$}~{ z|B9tqHyp^TvBq<_a(S*@JBX)cVR+*w%F#$rw6U3mic$3s(zEjm4jLCeB?ix^>=K>U zBW8K|+xF5O@TsMe=-;C??r@*uWz3-jAgKCm%P&FvY(tF1%mppKUN~{9cOEfe@C`3j zjltpu5$q~D?u-2PBb5@wm%g%DOV=%~8yAL}o7FtH?Hqr~k?CZCQ8Jp7ma*@dpK>hh zLu(`lpFc89bv|BcBBZ-Wl3||_p H*&7AnimYMP2HZQECdg>wayI2#~m@5^#^Np{SxTkdAvKnW47}> zx#? %=p^*veVHLgKriQS#YeAh%Ap-7kw?4 z6l6`mQ*7p^^({nVz#Rvoj9LELl#~im@o;Q)LBG_NUvv9%4TX#O3bT{2Y2prQTqYi! zIy7A6lc)Aov1aiNkX0pfXGkt%sXg-?NzVpv%=G>oqv^3nI}2Um(!8qO;qX36yb4qT zKeP){YoGw-^)b5S!5JKFbcrXH = JImm`^_*n4077F74wy70r&N2eYO8-hId0xgKE>y0F7>(vdK z$&b{=bxeTPau3kEtR;?C8$4UujGCz_=ornJKa7Rr#n&3qo$u!)^#KV*uW<~WH=H#} z?by~r!0u`$mfAjWx$g9^BhP5UbsZUhlHN8i+TNq4c(6V1kQ)AjUTs8E&MGMUjqc3y zo*jDpXJK(WMi;tt@~;y{|Bb!(3~KuA_jR$0s7MzOP-!X#6e$V_D$ +CsY&dhn%KF^-@A~SiP z$^HA?-|y#hUDNxB=uoKEX{PQl1G=^io*(dV#MD6K9@h_v3n3+|g~6^)@VCN_Ud++# zR_YzAfx|(SvRQp^3P9OMPA(JFYxI^exgIdC=ULDhRCP6MH$w6ZziM~2ik`NBoEai> z0xCt2noCLllWw5A2{X(T`k4!d`@@E=5% z6G&o<;Nevox;I8a^V%qr9eJsh z6?hB6 )%f_M7*930P`)#Hqt_g@&1~{F#A=a}V2wP!3PwhrGde(JW7Y6^uvX z^Qj+%s!k^c-M?SQlY5Lc>U{leh2p6fe;%zm%RU8u#LQO_;qqyfIMfVrjpBPJT%{zL zV4! @;{W)N#|T<4G+U%rP{%M)8LCr8O5iaHuH(v-^I!mV=>>I zVrRS_de0_)k%&q!dmkdmjCsy(K%8o>d+1|Ot40QN*Md@u`8}mKV%AkQe_QD%04}HN z$VbLaU${T}fSHiTEPO~?D=O&r31mwnrBG~aNr!K|{v@B8Mx@J{+1KgLa*rD%|F>C! z>$3{+%4P9tzr$I|?29w!l !ribTWS@yTVZT5=wEj`DcW+X^lTfja~ zN{>zL1ux YAD~#nsUEAch8oq2CvBB_Uz*ay{KIT0=)_5<*=P0klP61B35b zjhBsOaZzI0-7npIuqt?~+1lpw1J5^G2mT(!eQTuelrbB5RY@HzQ$8oN(Ln|SSJl>m zo4M7s@gu!&)~=XWM}eO1epr9>Kr~_+X4J;`O4H3QS@xAH9@mzQoXMgt!Qxbw*u&y! z&r7R_zv%BvgKC6LSdqz&9}3TUn#lX>s=1R+lueX@_u?(Rk~dj_Vg~} vh79xq4(9^Mq9wMy}7(&WP3h1ieY_BAKxoh2{7gGjqvt0pQwioRC#KP3>H z^B;o9|LWo3UQYV&6?iZm(NbV6fc)NO`s>BJXE^MJk^pw3Hm1{mbq<&Dj87nG!otf! z2_Ksp!P_;@2|LCx9jP@e8C^QOLC=pzmn`DRPs@Rh*`gOUJMF!8xI}e5q-3DhKmE1C zE zP*tK`()SpBscl*>2^p5SA^4nR*Y2<|+VS}p|JPZj`LJbFRYVn?mz!&xeMsW=3W~Cq z9nFYvEnTpvI^{*K;B`KrT%L>-dfs89V?IYxUEh40a3dJAYo-SH2d64#iqN @-cWvp9$K}vhWQ6=ETG<>p+9@XxAX@#>tKgBUD!%+#w z$Z(a6xK`*eeZt{c+H4-pZ{>B6taw;%bCSL{I8Nm+`sglPc66(7pjt-v3^?@j7qMze z#QxB#*|TNCQj5L9O-tZfHDRg)I1g~%LEU3FVz~%RqDsl33SH%0seuohID!C>!X0r* zyN(1LA$%J$pr1A`g*E;l#gmfiS?-TgFralZfLdn(8dBbP+WB{$U)}JkJHv;fw17W* z9$%9wpTr#Tz=+#GjBe0KlFiEH(lg q#c-`|aK3w9?`BTJT6E}BI zhbITprkq0of^i?0R80m`(G;4YLX9edd76570m)^>d__xZ2$2X}=DyQJfS@D384`gE z(v6Xht1^>W)|-!T3zi*4kgw&=&F|Qg`|#gw6ELbwMK%**LqD->jr;8HpQ{a6dk?2x z-_M9VyIh?)B|k1tWM$%p`dCn+s$ws<6shdAkS-zQ9FO&x5y#Jcx z$e)iU);)OzyZJSo;1@a3H+0#hE{^}1pMRI|{AI~*RQ{V#Ecm1j `v2#Ji3cL2 z|3MxW82UfRdF&K2*}1}ikdoiUHI2+b#zz_=I^;6DSmh(vuB?DDgz_ikPqaAtX{gu! zxm=43$85CCw-fH>x!3_VPPVo=7r_JrZiP)kz~q?Esgrz4Ia(?fcg<|Ftg>Ev!4^V! zST~p{fmDE_9xWsejTG?VUWLkIg|QjH_463K;Lg>_rB)fgT0B9BS6lLi&T&bf)}Vef zJRfbHA @vH9|+n^D;LaM$n`%5a*gld;0hpLV%Hl^m~ z)sDIu^E+tT)NeU0ARvI~wqmINtzeiWkd{Lr6%QD1Xf|Q#5t-j?n@*tHC{O!)k0cGN zWL zXf@k9J1q*_izr?UyP-SomP%u$nU`mnR#p7 nO!$V3X#kziR^Ex#F!Z4c%g^Gg_e0WN zz4~VCEY={k`ztMJSSS45@u1u0FPgm)L)vU_4F&npCO4Zc>Xkn$0VMP>7?f`HFDW+t z4XloB%LJ?#`|(z9{0QXadh#{*wSYm&qe~s^6K;N_x08MYDyxK@hbySx7unYAXAcxU ze#ohfWQ5VE;~|~(GHkL8fTijp&@?#(-QfdUw}iT-H3l|AdAdx{b3hfysN?FrWc$fe zUG-;}<_P-!j8HWAM<}=ByP4s-**qc}WQD9%4{^XJ=vKUO#(@h^Ph5wW?j8HoMfAm| zq@EHr&CAPMXRor-?TUka{cy2;rWQosp)#WB+8-=Mc)Mn6bRA Q#)NGup!ZP7{CZ z@}=0%;{xf|k5*iiQ9Y(^1h8zreb|z9+nBRmmUWd4_NGVF(59Nyj4H}N?fJNDA0K;f z@bk(f=({NC8vMpHrNnl`WjvSMjqk_mW>BMLR__|b#eR8rO7KHPxZg|H4g~4IO2(mr z_;lT@Re>&tYnXhXva#A&F3-cvoI^cX_1EMA@h?vO=}_qM0+#$Yhb9hN`dvqFCYZGK zaf(U?xeb-o)i>nSD>M7{Zz1=oh{pReQ#Q1kA!W4Jj>(YEk9?UpzgNyh{1IH7=2+!G zpEvNCrgmQCMjnZ@ge(Fga_Y>smO#*789E7&q*gH@{i+e4j2O}P>@W_34_Fv;q*_0z z!EU9ghrBfFujhPa5a$*PLS&d9Xr;!<4ppP)^V+Rt*@QxXd)cx#D`iT1iLKosMX?cH zs&UG_WWUC}0c%*+Wp;c&U=yfctN((=vV)adJPb-p`joWo{GuOqquT+G{CQS5=E}O} zg^(W2YyD`Si|e&IB}m;_y>!Z>K98-4N>-A72p4$;9pwl5a+{hN=~nUQjh-cf85545}$f*CMm*1C>ku zS}s?m%tRU`cO g$uMRwO(9q%n4rtB9l#u>Y7FZ}fA| zO}2EX0YNIZ08t=o>2?kj 0RE?m1 N zz#d1HUT(}L-kacJ+@y!c=g-D0XJ`rAGGm@upUl F_g6Ic?hkVN;=S_4|v#D#SjsTydCeA(5FkHNH-%8r_$Cz%G_i;~c@| z6*Ze{tb0hDNNfnWZ0t7-=^>!laI(v^dF;7fckJ8+Ww`~^o6xF+C?&LNo7W$ez26N7 zT4p1leLdQC(w_}*H&4IPzB6Bmf!7tYEY81D`&;$2Zl5spA8Aq;CALh8Fd=B@o-S%u z;XJd`f>3U?9SlNn0}7G@xxe%;Uy%QN$@t!tNyVLGt9(%=Qs#y$r*wt-Ay*IKa;syz zM4zQbllat7+WpXJ*?GTg#)KE?Lj9dT5@(g;B#effhNK3S7d)L|g;1e@FFoHJt)-lB z(Yo B8y`4F5Ay!eu`q4j3m?uYH=v6)^RP7O7IDzhWnaQmwOIDs zpes)0C+&yF_phSA%J6f%9l~v&yPr1=`0%^j7xmkfMF2u)O4ayh?|m~MFT%#KBLii2 zh9d(Y?wGB0z9kVXI<5`nnGK2In%@`;ii$Pq#!GQb5z|#V=7L6h9v*EiEN;om2vwFx zt(u|<{wn>3*o?b?3Zs_UH1}(>QcjjX|K`B>tz=TC-cL#n7FPGOw7(-kv(0xVJM&zN zzm8AX2@QDv1gtd&5DZ}Nop1zO-=_r+{^-xt$+bvSwM7GJm1pz;EJNxPzfK`!RB!+r zg;{{yzFe6u^wChDR N`YOc{8qt%Ux07}LhaowYIG4Wy{tZopM zYgxI=zQu^sb%MfYj7JBa(TsmwR|>Q{*$$Jbng)n8H4Bn;=Hu#yi;5^6=UN#VK|*}~ z{-%uAzq&{SztOf!A!RhhEs3*8 vT6hh(vtVEYwzgoR>J<;$9-Q) zAIgg4e{KgMkF{y^QFI47Dx#zl-|AhIimkeRhTqG8 e6Dw1vE 5tR}u#0*$#Yd-typlBs~V2c9R)gQ+(`;BGhZM9PJj;)nb zOm$;rl0TvYeV3)h4-~rg*~SC{E+!K@{~XpcT**#}5c~`COL~jG z2pkLopIa!V8VkY*Vks>x6KRn?TrvI_%Jsr%S7#rD6h!~5AK$ll>q%u^do#FUjUTE) zGp3YjY}MyeCcvaL3#vtgvnjyb_zAF5I(sd8<4NkuhwFYf5))K@_a@H?J8+$xi7i?T z=`2LE)^Yd%z}}PGYd0#qn254TG(xI0YoxwsyzSIX0(qw;eJ7$;=WmYF>+dziSk}pg z*s2 ^OIMI}mQYI8a_UxAwZymxqY1Q%J~T&%^Ol@4~){2J1l{+fR3hh3yfKxBN7 z4tw@`!PZSAmf RVbSAf^WOh#x{~tdYVDfD=t57A$#*bvwoPSHDX_+) zRKp^!F!RX@kbUGmrYmPx@hJJGHo1XI&z@d@W; z^^h{#30|OO2Qu>T%!yYXKETXlGl-a4lN>VTk7cSzN@;$6lVIV=qAU9OW~uWK{ud|C z5 F6j(D zD(CAvz1M~?!74^^XbIR9*td%1F*3f>_o;W^<&UaJcWeM6l4V`uicbSM$EMHc2~NGJ zsu?_f4srIa!La*EP54-njL!KZ@F_sxi6BbRVQa|c0Zl2UTW=GgnQe!eP=Sl@n?^$* zAjqRx!wWZ!hDrAAiT&i`F2J9;jcd2=a2WTSS;R?|856g$DP@}r_>@v-aX3GI-V!&$ zE;| ZRpvPwKape>^lJEapc4L4JVzAuL-N_pqtt3c}>1S5+#zW;YW{ZbJ-Ze zn3*zbw;D-Th{hm2L>djX4F~3NU_+A?j}t9K;KGBAB8!WfW{Huu7gbKG@fQ(wc0 q+YHqUTk9hXnX$O(M;OL1Tu}r)D*arV-prJmX7bcR$|Tf^5gX@G!)UmfJkqp3=?g zkU@uqYrxo#<42TNhMN9gwivE^jd?LfM)tNJcT#=Hdu*oBf1XD2|E{<9-yaqKnu mZqM`;0sLm+MTV$nVwW}pYzannaIL3xT?jX|@IR7Lv z6{t}90V<|Uo(0H5#zF-v->>IeNxxmqdn=8rW}n0L4)m*y^A?J#xqRDV{3*^IIkVsE z2{2zu|1d~h4qjg*mDKN*zO YrXnd3``E0oz?!kx}tVdCTZKFwmOw} 9?wqwZy=-^ r@!6t6^Cl7Cs2Xy%^4kj3^br`z5^rp%G0{4opBA{c2oDK3Jk_LiPETo%`L? zS&A{eWw@wxiOd~=InZtvvcRblzIaW*9u04tN^9TEy4fx`c1*F>I=CP4a g??meM+bz#p7L0x-jkMgh*nKoVJ1K)?5r&B z(A8(;6X>D(5p5ti6h8Ce=gADT?IN7LX;CM4iW&%Cx;Xyv{*P}d9 ;c9Eveuw_xN*d zFuGMW(UTqHppNJz@kwisJl$i83DhO|P&chh(2(oQ{PStl7zrUaf+p(Qg!Q6e4kz0C zh`^u;d!sXp11{ftY_#T>Dc?K^u6=s+J!R#_bwc0#yvd)D?iI#_=skHqIajjpN(yE- zOJSdzx!F8*p 2>4k}Sa uK#Hq?iC3_z0vGON+EeD3q^>orFM=I{b zM0*9o%0kTj5NUsc@96}w+c@VU|G^=-V>QCEp6M1R&$8brXeq|xs2mvlK6(rEeBQ!Z zrpj7iEaju(3(wl3iTT1OS}<;Y`I1R7#IZliv+B#8cQF}PsH!SLf;%cZmU7B1BV($K zonn~{PWsNfZ%??KtFbK4pmfr)r2BzBqtZe`E|b9D5;1EmV_&v>K7m1?JF*_o)@lL^ z$&2D=u@!@}blXqTVEjO=NQPC+R`u!d+^C$1s~ hLN)}J_=T5;eK__lgA9t6!DaEzXD+3^Ek2h?#huFCa_hNwC`{&`K;94WVu4A z!w$oP_QUVXp~;2^_jQoRwXmpo<=zWmvMamluq7G;cZ3XUsOODCnCMm3GFmM#FL6!4 z{Yw*98&p#6N=nnrnG*-|FG(zZLAZ8vJ%2^NrUWzDD#mJHYx%%@WyMDhH*jKBz+4Yk zkv`F7Z#_P4?5^^nboPVL(2^=F#5Q!U sJ*=Jt%O%Es%`M8%t*#Bx@;IrnR;=X z``Dr!wU?V2asSl*jb1C#U`~Ax3Lezo2v-{O_;SO>@#sKY#;30uP!X>rID6ZoM7pO? zcRwcX9$R&1wI>q2>pR6b91*~3T`-*C64u~Tc*jzwiV3QNGdeRp7Jge+r=EV1N|v*1 zTz_=&v6MGYg!!k=`4)8H;l$o2nw* ?lohfW2OE3zRR_J~GVawQV$aSsuWr}Uro?`Uw4i&ZfYw{fJ z6$~U1F+&%qC5Lxe@U*=OzPXo@i7^q4`9`g*Af$0B#qo^4y=)Hb${4hmC|iv}sMLwY zApM?iN;%bUpu^JA?8X3vTopk$+T)F%K?4kgjPgsx^PE4s_Bko(ln_!`>QZkNhOt>! zyPC`LX5sa!`fRzVBuc=2QR-C0mY7zPB{?Fo%m4}ltPB(K^CvSreILA$zY@qTLy`WF zQd1q_u3{m(tL=dVG6)qT?o>i8?Xd0~foz5T&3K9OLmN7O>v_p*tzq#&e|gSdOQTER z)Ths_Gr& >2~iBm^jtu zJxLfr@{g7~9Wc>s(vIM7S4Lw|8KQEKM-Ly~_$dAPLlKDdeUJcTzb#BJF6ZuJYHZ5V zpW!Otnnd+rvR%8|O5lXR3 Esl5s`ZV@quynb}p}>ppjcS0|5K z*(2TO;fF8*d+dj^_kIW6+4pCwyJ)ge3RjqcNb ;-nX(-LnQZ1-NxmHb)m4W zT_qAf_{aUpZ+kN$LEKV@#>sH+)OEO0cKHw4)IkE_`1pSALlV4sA7)h+;S7HOQhKO4 zu8~~K^*2XF=*#tu&1yE@7%~1EE@6rCKnIPmRJ;FRT~S)bZHVPU$mex_OE#pY$!5tS zvHQC%Q+INzac9;v;bC2Z)u#OVLPb1P&w7>h0k?RS@}#e_^Lm5m(8bjf?)QIlU{#w> z(RA}=5@rArhSmLB%lEa->O}tL_(FD@=xUsJ5x1%`u7Bm(M`qLgcvH!bNey24ns{ z5CnpK^co(=4DB8Y))Chda{rVGF-iL-uzK-dv$Zs>FaS$Om67X;cBEe4);eozJLx&! z=9IM9ACqTa7u!&BqoV5bnc_;5nuEL`YwiSPwrW~asERI#A*8H8&*xK5RAAo#;ND{p z$s~0Z_uIAb?4kJidp;IN6_xS^f|Em~VeG!V!JZrM4#>E;azA4?NMRv?eH_D>*nMjl zitmu?kB}A@eB1Dj8C`lIENRMZSXB*V4R%uy9LCmUH7@ilypS?`@zy-yroQweWr!Z5 zWw2g!F+jI4h|pT&A{bW$!lK58mp07@FAuMJSIZzOLF=8Lg+IS|J+1HCI&UT>C|J;I z?BBMK+r8^bB-MU4)U` )7tY>KJ+hgO+a=r*Q7+BR>G9W<#}-vk6?xx9VaB z)Nqaa#emXf@GFIMykCGf?98nOUE OOTe7z nK12eKEdVRp*?%rQp&hIlZ<2IJOLz?v_K;NN>1J$u72K+37LY) z1f~dVlEVJxfG6-EtBjDQ4FPb}dk 2p+|Q!+&{!%Ng%vH3?- zv^B0=_)v+RM|rm-E;xW82HHicEnumLt$~t7kh@xZ0Zz+_5NItZ>|P>&JWeXHCZ-qc z GF>4AyWSkWkM^119RB`f#L&!3%p2F+u|x~SQz!7BJtJT6nkuYN*1W%W>j zl{&ItN)m7THE7uza`gZcr0pt+>1Um?_b(ZP2DIjvfFZ~*inhx^+N-ldoM(&SS3Z$4 z2v?uqZ{RqzmPORLf@%W}qg;Z|RJH^jHF{G|vwYU1$r@CH>t*C_Ldc|C=-A3?Hh^qX z7HrvVjol!Sirk{Fefy_m0{`W6e!{;rMS=u|G?kYE;PKhnOCj HS7s9MCuTsc z((qP)y6@YGIqST0R~us+UE0+t%C*;L%HDb*71$uA&(vix?I*O%6;OQX?>0ZnB%~M6 zVpDQT9io)#*;an|M@^Uit{kRZ)3XTa0wU1Or@}Pka**jNHMJx1U25wQa}g3;HWT1U zIH_Wo$AVMPI{#S5lm^A4=c$8=NdkRDr &$0^@P49iOL4KcuA zH AT0*MC?uz)jm7m#kA-$Fem$;j&QMaH8&X<$Q7+DUc$tJfU( zUYxaV75*I8D;gxh?laz@k>TJ5!g}P(>LHy^Rdj*;iS7de*PR>9_DLNZlaHPGo@Pu} z$G!JGYvpXLJj?bvgXXft1~m+4yPw LiL_~?-{xwUeO17nu!q>Nn?Fj6uRs-Rn9$l&ra8K=_2CFo#jXaAv z;bHI3$y0-mO6L(R?Z0gpSQ!AOVTlli1*lkVY1oXClE<2?ciUij2iwNwl?30WnKE2| zg`8)~84a*8v@l!p==kXPL@x sjjl_rJuSXTupjkuAw6kApvagtWgN4( zbO|pa8-`VnIZ#=)#U(rs1h)xwi`A8Mi##ccI+5p`$t4&EbS|zK*5I1uevjh2xkXv- zjY_o@m7}%;N0$OpGm`Kk{sZp}`EnD|dTw7weB$Id0eovj|2Cygehzo7n}FbkY7C^E z(TqVe`(A$Bf-n1NY`L-HSV{l~bAMGrz0(x^^?P6rI}lXZ?*m+YIe3s`u~E7X@~ufu zy*KIcQr*bhkCpvbbqoF=mBnXY?CLk1?weaUjtn4+s@qk-RB=U07pjzQ+vL5vF>&?I zZS!j06Y`_2Mj;3SJ4MZYuFil_g0?{>74-P*Vx*DWaV%VSN=M~+3^%UDE0OxkXdvUq zRioqkzTx7K;Cxfim&N_@ks-83Qh?Tez@*Wi_k# Kki%$stYiyK%9hourH}za?rZv8?J+Tbx|}-yG=P>qG4GRDwy&b|anL3T3A} zxP9QSY+xC#n6X+z@nWRB^`ynoD_-)PaXS|h2^SkVB5uXtB*N{=ha+dSj@wuvlb;XP zJ}j|=$wI1!Zf@T iB5{}@vwDxe`)P#>6zm_m-6hqZlM#ZV_36$2H z+n##k{-WQb gxG#z6~9U{Y6Q4!rM;_#OwYQBI8zng$bqtfQ@@L61>|dhGb~V zu6Px?8>qyjIjuvXmeQMPe^mqX7RpZ$SAG3pDa@|vR7nXctB6&yz3VR|!vG_8@&gYT z_wR cI8bWxe7I3l^a?5tK} zQ5Nx3^7;-4JEv0F>(TM6SGw}a d3y(8bS?H6JfzPbaU4DH;d(}WuP z3R15QtO0sr(BsVL?rc(ZR8Cz@lE3VSln+7%B2;*visKbJp5w^7{re#uli~*`C5kFG zY2S3@%D{k8+B0H3A@lKz2Hg-)(P=*RO7G>2Uur zU~kD^>mA9lm-CP9)nVme3w6{5yQLjMN;{C)nOcDdj!7xru*RT0lKj0craQ$!20s{a z3fxDnAf`pn32t<#Yh75Yhxr8#({;b?eT1J%zjAw0^qnV Xh$tuL+Lg6^NVaUf($cx%+pIte~dVi?;mK3|C+|%^!65)#_GmO |71|6@y`pvh3k%fACJzi?X>!r z_D9?H`_)Zt4gBNR(|oSbj;88Oe3s+&3OWG%!Gi=pwz`abfJYwcISB!L>O|n9c81 z0K%jH6Fdvj1(|;AaudjFpezx`9*Ei u#;sOei zgG(iNwf(cBQagernhB{fQjebHJOK3|flgNwGVZorZ0}W`MT`zK)~nKAqJr7jpZvU| z8^E9L+Zp@d%tx^It5-KgmgK@d9uZ5IlX>#<;+k;Jx=qge!H*$A2U<&qgf&eU?|u0E zfN|Zyg1~yy{WI(v6UZo@?0$PO;L>pNDEJZR;wosUZ<>4|Aw`&vYe)a$<#@THe{(Qi z(lm<-lrvi+Dk&HtiywxAyE-*QaQhP+tN0+F*WBmIth4BuX-j_{@qWl2e$%ac51Si| zxuSc00#H(KFcI8qKDOkwXZ&N8OP`7GpV3k hlfW{+ &o4HYGNJ*0U{`( zGpoIk9?Hh6@F%AMzj63m *D1>06Hk{1l(u+>c(WCKcHanc#9L>{7Xt4U{*Ritm@t)P{YB;?R7qw ziW(`p7V20GQ-d>-Z}N`*(QW0f9JQ%yZ0*a4;!L;j5`Q*xQpg?nQ-dc?X4Vf8vA