From 9c136916f0076d198da53e7feefd65c1f6fb0079 Mon Sep 17 00:00:00 2001 From: Steve Clement Date: Fri, 15 Feb 2019 19:47:49 +0800 Subject: [PATCH] fix: [adoc] Fixed Glossary (you need to use <<>> see diff) fix: [adoc] Comments start with // --- best-practices/building-workflow.adoc | 2 +- best-practices/expressing-confidence.adoc | 8 +- .../how-to-classify-information.adoc | 15 +- best-practices/improving-analysis.adoc | 4 +- best-practices/intelligence-tagging.adoc | 8 +- book.adoc | 42 +- book.html | 93 +- book.pdf | 2097 +++++++++++------ 8 files changed, 1468 insertions(+), 801 deletions(-) diff --git a/best-practices/building-workflow.adoc b/best-practices/building-workflow.adoc index 0282650..8da2adf 100644 --- a/best-practices/building-workflow.adoc +++ b/best-practices/building-workflow.adoc @@ -6,7 +6,7 @@ Keeping track of the advancement of an analysis, of what has been done or still One of the possible methodologies is to use tags to mark the information and convey the current state of an analysis. -For instance the MISP Workflow Taxonomy allows the user to describe the state of an analysis, as `complete` or `incomplete`. Moreover, it can be used to clearly specify what still needs to be done using the `todo` tags. The workflow taxonomy is separated into two parts. One part is related to the actions to be done (`todo`) and the other part is about the current state of the analysis(`state`) such as `incomplete`, `draft` or `complete`. +For instance the MISP Workflow <> allows the user to describe the state of an analysis, as `complete` or `incomplete`. Moreover, it can be used to clearly specify what still needs to be done using the `todo` tags. The workflow taxonomy is separated into two parts. One part is related to the actions to be done (`todo`) and the other part is about the current state of the analysis(`state`) such as `incomplete`, `draft` or `complete`. TIP: For more information on the MISP Workflow Taxonomy, feel free to read the https://www.misp-project.org/taxonomies.html#_workflow[Workflow taxonomy cheat sheet]. diff --git a/best-practices/expressing-confidence.adoc b/best-practices/expressing-confidence.adoc index 80f5619..b4bceed 100644 --- a/best-practices/expressing-confidence.adoc +++ b/best-practices/expressing-confidence.adoc @@ -3,14 +3,14 @@ NOTE: Expressing the confidence or the lack of it in an analysis is a critical step to help a partner or a third-party to check your hypotheses and conclusions. Analysis or reports are often shared together with technical details, but often lack the associated overall confidence level. -To ascertain this confidence level you can use for example the MISP Taxonomies called https://www.misp-project.org/taxonomies.html#_admiralty_scale[admiralty-scale] and/or https://www.misp-project.org/taxonomies.html#_estimative_language[estimative-language]. +To ascertain this confidence level you can use for example the MISP <> called https://www.misp-project.org/taxonomies.html#_admiralty_scale[admiralty-scale] and/or https://www.misp-project.org/taxonomies.html#_estimative_language[estimative-language]. This is a very human way to describe either globally an event or individual indicators of an event, with a set of easy to read human tags. (e.g: admiralty-scale:source-reliability="a/b/c...", estimative-language:likelihood-probability="almost-no-chance", estimative-language:confidence-in-analytic-judgment="moderate") Generally it is good practice to do this globally for the event as this will enrich the trust/value if set. Using this in an automated way is also possible but without human intervention, or AI that actually works, not recommended. Also, on events with hundreds of attributes this is cumbersome and perhaps unfeasible and will just frustrate operators. The obvious side-effect of this approach is that automation will be the overall benefactor too upping the trust on that level too. - [TODO: revise description of estimative probability] +// [TODO: revise description of estimative probability] Thus, adding confidence or estimative probability has multiple advantages such as: @@ -19,10 +19,10 @@ Thus, adding confidence or estimative probability has multiple advantages such a - Support counter analyses and competitive analyses to validate hypotheses expressed in original reporting - Depending on source organisation, have an affirmative that some HumInt has one into the sharing process - [TODO: define counter and competitive analyses] +// [TODO: define counter and competitive analyses] Complement analysis with contrary evidences is also very welcome to ensure the original analysis and the hypotheses are properly evaluated. -TIP: MISP taxonomies contain an exhaustive list of confidence levels including words of https://www.misp-project.org/taxonomies.html#_estimative_language[estimative probability] or confidence in analytic judgment. +TIP: <> contain an exhaustive list of confidence levels including words of https://www.misp-project.org/taxonomies.html#_estimative_language[estimative probability] or confidence in analytic judgment. TIP: threat-intelligence.eu includes an overview of the https://www.threat-intelligence.eu/methodologies/[methodologies and process to support threat intelligence]. diff --git a/best-practices/how-to-classify-information.adoc b/best-practices/how-to-classify-information.adoc index 77323e5..f64a7e9 100644 --- a/best-practices/how-to-classify-information.adoc +++ b/best-practices/how-to-classify-information.adoc @@ -3,10 +3,15 @@ NOTE: Classifying information is something that has proven being very useful in lots of domains, including Threat Intelligence, as it helps assessing the main information very quickly. Moreover, it can help to build correlations between events or reports, allowing analysts to better understand threat actors. The first tool we can use to classify information are tags and taxonomies -. Tags can be used to describe how the information can be shared, using the tlp (Traffic Light Protocol) taxonomy, in order to prevent information leaks. -. They can also be used to describe the source where information came from. -. Many taxonomies allow the user to further explain the kind of threat.[TODO: was that the meaning?] ---mapping-- -- Galaxies (ATT&CK matrix) +. Tags can be used to describe how the information can be shared, using the tlp (Traffic Light Protocol) taxonomy, in order to prevent information leaks. + +. They can also be used to describe the source where information came from. + +. Many taxonomies allow the user to further explain the kind of threat. + +// [TODO: was that the meaning?] +//--mapping-- + +- <> (ATT&CK matrix) - Comments diff --git a/best-practices/improving-analysis.adoc b/best-practices/improving-analysis.adoc index 5a6978d..976fadd 100644 --- a/best-practices/improving-analysis.adoc +++ b/best-practices/improving-analysis.adoc @@ -13,7 +13,7 @@ The following three answers could come to mind. . Improving an existing analysis by performing a complementary analysis or review which will be shared to and used by another group (e.g. a specific constituent, or a team within your organisation or a member of an ISAC, etc). . The end-consumer will be an automaton. -In the **1st** case, MISP includes a mechanism to propose changes to the original creator, a mechanism MISP refers to as proposals. By using proposals, you can propose a change to the value or the context of an attribute (such as a typographic error in an IP address, missing contextual information, type of the information, the category or the removal of an IDS flag). The proposal will be sent back to the original author who can decide to accept or discard it. +In the **1st** case, <> includes a mechanism to propose changes to the original creator, a mechanism MISP refers to as proposals. By using proposals, you can propose a change to the value or the context of an attribute (such as a typographic error in an IP address, missing contextual information, type of the information, the category or the removal of an IDS flag). The proposal will be sent back to the original author who can decide to accept or discard it. The advantages of using the proposal system include the lack of a need to create a new event as well as the process itself being very simple and fast. However, it assumes that the party providing the improvements is willing to lose control over the proposed data. This is pretty efficient for small changes but for more comprehensive changes, especially those that include non-attribute information such as galaxy clusters or objects, the event extension is more appropriate. @@ -23,7 +23,7 @@ TIP: For more information about the extended event functionality in MISP, the bl In the **3rd** scenario your use-case might be highly automated, e.g. scripted processing of events and attributes via https://github.com/MISP/PyMISP[PyMISP] and the end-consumer is mainly another automated process, e.g. Intrusion Detection System, 3rd part visualization tool etc. This, for automagic reasons, becomes exponentially unreliable. -What is primal in this case is to fully understand what the IDS flag in MISP does and how it impacts attributes. +What is primal in this case is to fully understand what the <> flag in MISP does and how it impacts attributes. Further on, it is even more important to fully understand the entire tool-chain, cradle-to-grave style. Where does the data come from (cradle) where does it go to (grave) and what processes "touch" the data as it flows through, small diagrams can help tremendously to visualize the actual data-flow. Those diagrams will mostly be of use once unexpected results occur, or other errors appear somewhere in the chain. diff --git a/best-practices/intelligence-tagging.adoc b/best-practices/intelligence-tagging.adoc index 0fa9fd2..85c6c81 100644 --- a/best-practices/intelligence-tagging.adoc +++ b/best-practices/intelligence-tagging.adoc @@ -1,6 +1,6 @@ === Intelligence Tagging -There are several factors to successful and efficient intelligence sharing. Certainly, one major aspect is the quality of the indicators (or observable depending on the definition you use), +There are several factors to successful and efficient intelligence sharing. Certainly, one major aspect is the quality of the indicators (or <> depending on the definition you use), stored as attributes within a MISP event itself. However, it does not stop there. Even the most viable information gained by a shared event can render itself complete useless if not classified and tagged accordingly. One feature which enables a uniformed classification is implemented in MISP as tags. Currently, there are two types of tags, which differ in the respective place they are set. @@ -12,10 +12,10 @@ NOTE: Currently there is no programmatic way that prevents you from not followin NOTE: In future releases there will also be tagging for MISP Objects. Which is, somehow, an intermediate solution for the two prior mentioned options. -NOTE: MISP Objects in its plain concept is a grouping of indicators within one event. These grouped indicators are somehow logically linked together. The specific relationship is described by the individual object type. +NOTE: <> in its plain concept is a grouping of indicators within one event. These grouped indicators are somehow logically linked together. The specific relationship is described by the individual object type. A simple **file object**, links for example a filename to its observed hash values (md5, sha1, sha256 and many more). This can further be enriched via misp-modules or other plug-ins. -A frequent use-case for placing additional tags on attribute level would be to lower the confidence in certain attributes. If the event is classified with a high confidence tag, some indicators e.g. legit-but-compromised domains or popular filenames should be labeled with a lowered confidence class. There are several real world examples where this or similar attribute specific tagging has proven to be worthwhile. +A frequent use-case for placing additional tags on <> level would be to lower the confidence in certain attributes. If the event is classified with a high confidence tag, some indicators e.g. legit-but-compromised domains or popular filenames should be labeled with a lowered confidence class. There are several real world examples where this or similar attribute specific tagging has proven to be worthwhile. Most of the tags are organised in dedicated MISP Taxonomies. Those schema dictate how tags should look like and how they are to be applied in certain conditions. There are many general details on this topic which can be read up on in the main https://github.com/MISP/misp-taxonomies[MISP Taxonomy GitHub repository]. @@ -33,7 +33,7 @@ This data must not leave the boundaries of this virtual border of the recipient To prevent this kind of mistake, the traffic light protocol (aka TLP) and its respective taxonomy can be used and thus complementing the mitigation in the note below. -NOTE: One mitigation the scenario of mis-classified data, would be to use the warning lists (or notice lists) as a canary. Whilst not ideal and far from a defacto solution to catch all issues, it would be a good-enough-yet-coarse way of detection. +NOTE: One mitigation the scenario of mis-classified data, would be to use the <> (or <>) as a canary. Whilst not ideal and far from a defacto solution to catch all issues, it would be a good-enough-yet-coarse way of detection. There are multiple solutions to solve the issue of missing additional information about the shared content. One of them is the following list of tags which are deemed to be the minimal subset at the start of any event or the individual attributes. diff --git a/book.adoc b/book.adoc index 6580946..06741df 100644 --- a/book.adoc +++ b/book.adoc @@ -11,7 +11,7 @@ The aim of this book is to compile the best practices in threat intelligence ana Whilst this book can be used as a general guide, it is based on the open source threat intelligence platform called https://www.misp-project.org/[MISP] to give the reader the most practical and real-world experience. -The best practices described herein are from Information Sharing communities (ISAC or CSIRT) which are regularly using MISP to support their work and sharing practices. +The best practices described herein are from Information Sharing communities (<> or CSIRT) which are regularly using MISP to support their work and sharing practices. == Best Practices @@ -41,31 +41,31 @@ include::{sourcedir}how-to-classify-information.adoc[] == Authors and Contributors - https://github.com/adulau[Alexandre Dulaunoy] -- https://github.com/igl0cksa[Andras Iklody] +- https://github.com/iglocska[Andras Iklody] - https://github.com/SteveClement[Steve Clement] [glossary] == Glossary [glossary] -MISP Glossary:: This glossary is meant as a quick lookup document in case of any need of clarification of any threat sharing, threat-intel lingo. +[[MISPGlossary]]MISP Glossary:: This glossary is meant as a quick lookup document in case of any need of clarification of any threat sharing, threat-intel lingo. Be careful when adding terms to the glossary. Adding a generic term like: *MISP* will prevent terms like *MISP noticelist* to be addded. As a matter of definition please use the singular for any terms. In case you use any CCBYSA licensed content, or other pieces that are subject to licensing, make sure to add it as a by-line at the end of the mention. -ISAC:: Information Sharing and Analysis Center -MISP:: MISP - Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing -MISP Modules:: MISP modules are autonomous modules that can be used for expansion and other services in MISP. https://github.com/MISP/misp-modules[MISP modules GitHub Repository] -MISP warninglists:: MISP warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes. https://github.com/MISP/misp-warninglists[MISP warninglists GitHub Repository] -MISP noticelist:: Notice lists to inform MISP users of the legal, privacy, policy or even technical implications of using specific attributes, categories or objects. https://github.com/MISP/misp-noticelist[MISP noticelist GitHub Repository] -MISP Taxonomies:: https://en.wikipedia.org/wiki/Taxonomy_(general)[Taxonomy] is the practice and science of classification. The word is also used as a count noun: a taxonomy, or taxonomic scheme, is a particular classification. The word finds its roots in the Greek language τάξις, taxis (meaning 'order', 'arrangement') and νόμος, nomos ('law' or 'science'). For more details on taxonomies and classification https://www.circl.lu/doc/misp-taxonomies/[the documentation]. Partial source https://en.wikipedia.org/wiki/Taxonomy_(general)["Taxonomy_(general)"] - https://creativecommons.org/licenses/by-sa/3.0/[CCBYSA]. There is a Python module available to work with Taxonomies in a Pythonic way called https://github.com/MISP/PyTaxonomies[PyTaxonomies]. https://github.com/MISP/misp-taxonomies[MISP taxonomies GitHub Repository] -MISP Sightings:: Basically, sighting is a system allowing people to react on attributes on an event. It was originally designed to provide an easy method for user to tell when they see a given attribute, giving it more credibility. -MISP Objects:: MISP objects are used in MISP (starting from version 2.4.80) system and can be used by other information sharing tool. MISP objects are in addition to MISP attributes to allow advanced combinations of attributes. The creation of these objects and their associated attributes are based on real cyber security use-cases and existing practices in information sharing. The objects are just shared like any other attributes in MISP even if the other MISP instances don’t have the template of the object. The following document is generated from the machine-readable JSON describing the MISP objects. https://github.com/MISP/misp-objects[MISP objects GitHub Repository] https://www.misp-project.org/objects.html[More] -API:: MISP makes extensive use of its RESTful API (Application programming interface) both internally and provides an external API for automation, synchronisation or any other tasks requiring a machine to machine interface. In general terms, it is a set of clearly defined methods of communication between various software components. A good https://en.wikipedia.org/wiki/Application_programming_interface[API] makes it easier to develop a computer program by providing all the building blocks, which are then put together by the programmer. An API may be for a web-based system, operating system, database system, computer hardware or software library. The de-facto standard for talking to MISP via an API is https://github.com/MISP/PyMISP[PyMISP]. Partial source https://en.wikipedia.org/wiki/Application_programming_interface["API"] - https://creativecommons.org/licenses/by-sa/3.0/[CCBYSA]. -RESTful:: Representational state transfer (https://en.wikipedia.org/wiki/Representational_state_transfer[REST]) or RESTful web services are a way of providing interoperability between computer systems on the Internet. REST-compliant Web services allow requesting systems to access and manipulate textual representations of Web resources using a uniform and predefined set of stateless operations. Other forms of Web services exist which expose their own arbitrary sets of operations such as WSDL and SOAP. Source https://en.wikipedia.org/wiki/Representational_state_transfer["REST"] - https://creativecommons.org/licenses/by-sa/3.0/[CCBYSA]. -PyMISP:: https://github.com/MISP/PyMISP[PyMISP] is a Python library to access https://github.com/MISP/MISP[MISP] platforms via their REST API. PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes. -IDS:: An IDS flag on an attribute allows to determine if an attribute can be automated (such as being exported as an IDS ruleset or used for detection). If the IDS flag is not present, the attribute can be useful for contextualisation only. -IOC:: Indicator of compromise (IOC or IoC) is an artefact observed on a network or in an operating system or information channel that could reference an intrusion or a reference to a technique used by an attacker. IoCs are a subset of indicators. -Attribute:: Attributes in MISP can be network indicators (e.g. IP address), system indicators (e.g. a string in memory) or even bank account details. -Observable:: Obserbables are essentially the same as (MISP) attributes. -Site admin:: As an admin (not to be confused with Org Admin), you can set up new accounts for users, edit user profiles, delete them, or just have a look at all the viewers' profiles. Site admins have access to every administrator feature for all the data located on the system including global features such as the creation and modification of user roles and instance links. You will also see all other organisations connected or setup in the instance. The site admin can be considered as a super-user of a MISP instance. -Org Admin:: Organisation admins (Org Admin) are restricted to executing site-admin actions exclusively within their own organisation’s users only. They can administer users, events and logs of their own respective organisations. -OSINT:: https://en.wikipedia.org/wiki/Open-source_intelligence[Open-source intelligence] (OSINT) is data collected from publicly available sources to be used in an intelligence context.[1] In the intelligence community, the term "open" refers to overt, publicly available sources (as opposed to covert or clandestine sources). It is not related to open-source software or public intelligence. OSINT under one name or another has been around for hundreds of years. With the advent of instant communications and rapid information transfer, a great deal of actionable and predictive intelligence can now be obtained from public, unclassified sources. Source https://en.wikipedia.org/wiki/Open-source_intelligence["Open-source intelligence"] - https://creativecommons.org/licenses/by-sa/3.0/[CCBYSA]. +[[ISAC]]ISAC:: Information Sharing and Analysis Center +[[MISP]]MISP:: MISP - Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing +[[MISPModules]]MISP Modules:: MISP modules are autonomous modules that can be used for expansion and other services in MISP. https://github.com/MISP/misp-modules[MISP modules GitHub Repository] +[[MISPwarninglists]]MISP warninglists:: MISP warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes. https://github.com/MISP/misp-warninglists[MISP warninglists GitHub Repository] +[[MISPnoticelists]]MISP noticelists:: Notice lists to inform MISP users of the legal, privacy, policy or even technical implications of using specific attributes, categories or objects. https://github.com/MISP/misp-noticelist[MISP noticelist GitHub Repository] +[[MISPTaxonomies]]MISP Taxonomies:: https://en.wikipedia.org/wiki/Taxonomy_(general)[Taxonomy] is the practice and science of classification. The word is also used as a count noun: a taxonomy, or taxonomic scheme, is a particular classification. The word finds its roots in the Greek language τάξις, taxis (meaning 'order', 'arrangement') and νόμος, nomos ('law' or 'science'). For more details on taxonomies and classification https://www.circl.lu/doc/misp-taxonomies/[the documentation]. Partial source https://en.wikipedia.org/wiki/Taxonomy_(general)["Taxonomy_(general)"] - https://creativecommons.org/licenses/by-sa/3.0/[CCBYSA]. There is a Python module available to work with Taxonomies in a Pythonic way called https://github.com/MISP/PyTaxonomies[PyTaxonomies]. https://github.com/MISP/misp-taxonomies[MISP taxonomies GitHub Repository] +[[MISPSightings]]MISP Sightings:: Basically, sighting is a system allowing people to react on attributes on an event. It was originally designed to provide an easy method for user to tell when they see a given attribute, giving it more credibility. +[[MISPObjects]]MISP Objects:: MISP objects are used in MISP (starting from version 2.4.80) system and can be used by other information sharing tool. MISP objects are in addition to MISP attributes to allow advanced combinations of attributes. The creation of these objects and their associated attributes are based on real cyber security use-cases and existing practices in information sharing. The objects are just shared like any other attributes in MISP even if the other MISP instances don’t have the template of the object. The following document is generated from the machine-readable JSON describing the MISP objects. https://github.com/MISP/misp-objects[MISP objects GitHub Repository] https://www.misp-project.org/objects.html[More] +[[API]]API:: MISP makes extensive use of its RESTful API (Application programming interface) both internally and provides an external API for automation, synchronisation or any other tasks requiring a machine to machine interface. In general terms, it is a set of clearly defined methods of communication between various software components. A good https://en.wikipedia.org/wiki/Application_programming_interface[API] makes it easier to develop a computer program by providing all the building blocks, which are then put together by the programmer. An API may be for a web-based system, operating system, database system, computer hardware or software library. The de-facto standard for talking to MISP via an API is https://github.com/MISP/PyMISP[PyMISP]. Partial source https://en.wikipedia.org/wiki/Application_programming_interface["API"] - https://creativecommons.org/licenses/by-sa/3.0/[CCBYSA]. +[[RESTful]]RESTful:: Representational state transfer (https://en.wikipedia.org/wiki/Representational_state_transfer[REST]) or RESTful web services are a way of providing interoperability between computer systems on the Internet. REST-compliant Web services allow requesting systems to access and manipulate textual representations of Web resources using a uniform and predefined set of stateless operations. Other forms of Web services exist which expose their own arbitrary sets of operations such as WSDL and SOAP. Source https://en.wikipedia.org/wiki/Representational_state_transfer["REST"] - https://creativecommons.org/licenses/by-sa/3.0/[CCBYSA]. +[[PyMISP]]PyMISP:: https://github.com/MISP/PyMISP[PyMISP] is a Python library to access https://github.com/MISP/MISP[MISP] platforms via their REST API. PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes. +[[IDS]]IDS:: An IDS flag on an attribute allows to determine if an attribute can be automated (such as being exported as an IDS ruleset or used for detection). If the IDS flag is not present, the attribute can be useful for contextualisation only. +[[IOC]]IOC:: Indicator of compromise (IOC or IoC) is an artefact observed on a network or in an operating system or information channel that could reference an intrusion or a reference to a technique used by an attacker. IoCs are a subset of indicators. +[[Attribute]]Attribute:: Attributes in MISP can be network indicators (e.g. IP address), system indicators (e.g. a string in memory) or even bank account details. +[[Observable]]Observable:: Obserbables are essentially the same as (MISP) attributes. +[[SiteAdmin]]Site Admin:: As an admin (not to be confused with Org Admin), you can set up new accounts for users, edit user profiles, delete them, or just have a look at all the viewers' profiles. Site admins have access to every administrator feature for all the data located on the system including global features such as the creation and modification of user roles and instance links. You will also see all other organisations connected or setup in the instance. The site admin can be considered as a super-user of a MISP instance. +[[OrgAdmin]]Org Admin:: Organisation admins (Org Admin) are restricted to executing site-admin actions exclusively within their own organisation’s users only. They can administer users, events and logs of their own respective organisations. +[[OSINT]]OSINT:: https://en.wikipedia.org/wiki/Open-source_intelligence[Open-source intelligence] (OSINT) is data collected from publicly available sources to be used in an intelligence context.[1] In the intelligence community, the term "open" refers to overt, publicly available sources (as opposed to covert or clandestine sources). It is not related to open-source software or public intelligence. OSINT under one name or another has been around for hundreds of years. With the advent of instant communications and rapid information transfer, a great deal of actionable and predictive intelligence can now be obtained from public, unclassified sources. Source https://en.wikipedia.org/wiki/Open-source_intelligence["Open-source intelligence"] - https://creativecommons.org/licenses/by-sa/3.0/[CCBYSA]. diff --git a/book.html b/book.html index fc0cf15..073c3ed 100644 --- a/book.html +++ b/book.html @@ -468,7 +468,7 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b

Whilst this book can be used as a general guide, it is based on the open source threat intelligence platform called MISP to give the reader the most practical and real-world experience.

-

The best practices described herein are from Information Sharing communities (ISAC or CSIRT) which are regularly using MISP to support their work and sharing practices.

+

The best practices described herein are from Information Sharing communities (ISAC or CSIRT) which are regularly using MISP to support their work and sharing practices.

@@ -513,7 +513,7 @@ One of the main questions to ask is:

-

In the 1st case, MISP includes a mechanism to propose changes to the original creator, a mechanism MISP refers to as proposals. By using proposals, you can propose a change to the value or the context of an attribute (such as a typographic error in an IP address, missing contextual information, type of the information, the category or the removal of an IDS flag). The proposal will be sent back to the original author who can decide to accept or discard it.

+

In the 1st case, MISP includes a mechanism to propose changes to the original creator, a mechanism MISP refers to as proposals. By using proposals, you can propose a change to the value or the context of an attribute (such as a typographic error in an IP address, missing contextual information, type of the information, the category or the removal of an IDS flag). The proposal will be sent back to the original author who can decide to accept or discard it.

The advantages of using the proposal system include the lack of a need to create a new event as well as the process itself being very simple and fast. However, it assumes that the party providing the improvements is willing to lose control over the proposed data. This is pretty efficient for small changes but for more comprehensive changes, especially those that include non-attribute information such as galaxy clusters or objects, the event extension is more appropriate.

@@ -536,7 +536,7 @@ For more information about the extended event functionality in MISP, the blog po

In the 3rd scenario your use-case might be highly automated, e.g. scripted processing of events and attributes via PyMISP and the end-consumer is mainly another automated process, e.g. Intrusion Detection System, 3rd part visualization tool etc. This, for automagic reasons, becomes exponentially unreliable. -What is primal in this case is to fully understand what the IDS flag in MISP does and how it impacts attributes. +What is primal in this case is to fully understand what the IDS flag in MISP does and how it impacts attributes. Further on, it is even more important to fully understand the entire tool-chain, cradle-to-grave style. Where does the data come from (cradle) where does it go to (grave) and what processes "touch" the data as it flows through, small diagrams can help tremendously to visualize the actual data-flow. Those diagrams will mostly be of use once unexpected results occur, or other errors appear somewhere in the chain.

@@ -614,7 +614,7 @@ When asking for the support of the community, using a specific taxonomy such as

Intelligence Tagging

-

There are several factors to successful and efficient intelligence sharing. Certainly, one major aspect is the quality of the indicators (or observable depending on the definition you use), +

There are several factors to successful and efficient intelligence sharing. Certainly, one major aspect is the quality of the indicators (or observable depending on the definition you use), stored as attributes within a MISP event itself. However, it does not stop there. Even the most viable information gained by a shared event can render itself complete useless if not classified and tagged accordingly. One feature which enables a uniformed classification is implemented in MISP as tags. Currently, there are two types of tags, which differ in the respective place they are set.

@@ -660,14 +660,14 @@ In future releases there will also be tagging for MISP Objects. Which is, someho -MISP Objects in its plain concept is a grouping of indicators within one event. These grouped indicators are somehow logically linked together. The specific relationship is described by the individual object type. +MISP Objects in its plain concept is a grouping of indicators within one event. These grouped indicators are somehow logically linked together. The specific relationship is described by the individual object type. A simple file object, links for example a filename to its observed hash values (md5, sha1, sha256 and many more). This can further be enriched via misp-modules or other plug-ins.
-

A frequent use-case for placing additional tags on attribute level would be to lower the confidence in certain attributes. If the event is classified with a high confidence tag, some indicators e.g. legit-but-compromised domains or popular filenames should be labeled with a lowered confidence class. There are several real world examples where this or similar attribute specific tagging has proven to be worthwhile.

+

A frequent use-case for placing additional tags on attribute level would be to lower the confidence in certain attributes. If the event is classified with a high confidence tag, some indicators e.g. legit-but-compromised domains or popular filenames should be labeled with a lowered confidence class. There are several real world examples where this or similar attribute specific tagging has proven to be worthwhile.

Most of the tags are organised in dedicated MISP Taxonomies. Those schema dictate how tags should look like and how they are to be applied in certain conditions. @@ -706,7 +706,7 @@ This data must not leave the boundaries of this virtual border of the recipient -One mitigation the scenario of mis-classified data, would be to use the warning lists (or notice lists) as a canary. Whilst not ideal and far from a defacto solution to catch all issues, it would be a good-enough-yet-coarse way of detection. +One mitigation the scenario of mis-classified data, would be to use the MISP warninglists (or MISP noticelists) as a canary. Whilst not ideal and far from a defacto solution to catch all issues, it would be a good-enough-yet-coarse way of detection. @@ -762,18 +762,13 @@ Expressing the confidence or the lack of it in an analysis is a critical step to

Analysis or reports are often shared together with technical details, but often lack the associated overall confidence level. -To ascertain this confidence level you can use for example the MISP Taxonomies called admiralty-scale and/or estimative-language. +To ascertain this confidence level you can use for example the MISP MISP Taxonomies called admiralty-scale and/or estimative-language. This is a very human way to describe either globally an event or individual indicators of an event, with a set of easy to read human tags. (e.g: admiralty-scale:source-reliability="a/b/c…​", estimative-language:likelihood-probability="almost-no-chance", estimative-language:confidence-in-analytic-judgment="moderate") Generally it is good practice to do this globally for the event as this will enrich the trust/value if set. Using this in an automated way is also possible but without human intervention, or AI that actually works, not recommended. Also, on events with hundreds of attributes this is cumbersome and perhaps unfeasible and will just frustrate operators. The obvious side-effect of this approach is that automation will be the overall benefactor too upping the trust on that level too.

-
-
-
[TODO: revise description of estimative probability]
-
-

Thus, adding confidence or estimative probability has multiple advantages such as:

@@ -790,11 +785,6 @@ The obvious side-effect of this approach is that automation will be the overall

  • Depending on source organisation, have an affirmative that some HumInt has one into the sharing process

    -
    -
    -
    [TODO: define counter and competitive analyses]
    -
    -
    • @@ -808,7 +798,7 @@ The obvious side-effect of this approach is that automation will be the overall -MISP taxonomies contain an exhaustive list of confidence levels including words of estimative probability or confidence in analytic judgment. +MISP Taxonomies contain an exhaustive list of confidence levels including words of estimative probability or confidence in analytic judgment. @@ -848,7 +838,7 @@ Having a workflow to follow, and be able to refer to, is something useful for th

    One of the possible methodologies is to use tags to mark the information and convey the current state of an analysis.

    -

    For instance the MISP Workflow Taxonomy allows the user to describe the state of an analysis, as complete or incomplete. Moreover, it can be used to clearly specify what still needs to be done using the todo tags. The workflow taxonomy is separated into two parts. One part is related to the actions to be done (todo) and the other part is about the current state of the analysis(state) such as incomplete, draft or complete.

    +

    For instance the MISP Workflow [Taxonomy] allows the user to describe the state of an analysis, as complete or incomplete. Moreover, it can be used to clearly specify what still needs to be done using the todo tags. The workflow taxonomy is separated into two parts. One part is related to the actions to be done (todo) and the other part is about the current state of the analysis(state) such as incomplete, draft or complete.

    @@ -879,16 +869,25 @@ Classifying information is something that has proven being very useful in lots o
    -

    The first tool we can use to classify information are tags and taxonomies -. Tags can be used to describe how the information can be shared, using the tlp (Traffic Light Protocol) taxonomy, in order to prevent information leaks. -. They can also be used to describe the source where information came from. -. Many taxonomies allow the user to further explain the kind of threat.[TODO: was that the meaning?] ---mapping--

    +

    The first tool we can use to classify information are tags and taxonomies

    +
    +
    +
      +
    1. +

      Tags can be used to describe how the information can be shared, using the tlp (Traffic Light Protocol) taxonomy, in order to prevent information leaks.

      +
      2. +
    2. +

      They can also be used to describe the source where information came from.

      +
      3. +
    3. +

      Many taxonomies allow the user to further explain the kind of threat.

      +
      4. +
    • -

      Galaxies (ATT&CK matrix)

      +

      [MISPGalaxies] (ATT&CK matrix)

    • Comments

      @@ -908,7 +907,7 @@ Classifying information is something that has proven being very useful in lots o

      Alexandre Dulaunoy

    • -

      Andras Iklody

      +

      Andras Iklody

    • Steve Clement

      @@ -922,81 +921,81 @@ Classifying information is something that has proven being very useful in lots o
      -
      MISP Glossary
      +
      MISP Glossary

      This glossary is meant as a quick lookup document in case of any need of clarification of any threat sharing, threat-intel lingo. Be careful when adding terms to the glossary. Adding a generic term like: MISP will prevent terms like MISP noticelist to be addded. As a matter of definition please use the singular for any terms. In case you use any CCBYSA licensed content, or other pieces that are subject to licensing, make sure to add it as a by-line at the end of the mention.

      -
      ISAC
      +
      ISAC

      Information Sharing and Analysis Center

      -
      MISP
      +
      MISP

      MISP - Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing

      -
      MISP Modules
      +
      MISP Modules

      MISP modules are autonomous modules that can be used for expansion and other services in MISP. MISP modules GitHub Repository

      -
      MISP warninglists
      +
      MISP warninglists

      MISP warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes. MISP warninglists GitHub Repository

      -
      MISP noticelist
      +
      MISP noticelists

      Notice lists to inform MISP users of the legal, privacy, policy or even technical implications of using specific attributes, categories or objects. MISP noticelist GitHub Repository

      -
      MISP Taxonomies
      +
      MISP Taxonomies

      Taxonomy is the practice and science of classification. The word is also used as a count noun: a taxonomy, or taxonomic scheme, is a particular classification. The word finds its roots in the Greek language τάξις, taxis (meaning 'order', 'arrangement') and νόμος, nomos ('law' or 'science'). For more details on taxonomies and classification the documentation. Partial source "Taxonomy_(general)" - CCBYSA. There is a Python module available to work with Taxonomies in a Pythonic way called PyTaxonomies. MISP taxonomies GitHub Repository

      -
      MISP Sightings
      +
      MISP Sightings

      Basically, sighting is a system allowing people to react on attributes on an event. It was originally designed to provide an easy method for user to tell when they see a given attribute, giving it more credibility.

      -
      MISP Objects
      +
      MISP Objects

      MISP objects are used in MISP (starting from version 2.4.80) system and can be used by other information sharing tool. MISP objects are in addition to MISP attributes to allow advanced combinations of attributes. The creation of these objects and their associated attributes are based on real cyber security use-cases and existing practices in information sharing. The objects are just shared like any other attributes in MISP even if the other MISP instances don’t have the template of the object. The following document is generated from the machine-readable JSON describing the MISP objects. MISP objects GitHub Repository More

      -
      API
      +
      API

      MISP makes extensive use of its RESTful API (Application programming interface) both internally and provides an external API for automation, synchronisation or any other tasks requiring a machine to machine interface. In general terms, it is a set of clearly defined methods of communication between various software components. A good API makes it easier to develop a computer program by providing all the building blocks, which are then put together by the programmer. An API may be for a web-based system, operating system, database system, computer hardware or software library. The de-facto standard for talking to MISP via an API is PyMISP. Partial source "API" - CCBYSA.

      -
      RESTful
      +
      RESTful

      Representational state transfer (REST) or RESTful web services are a way of providing interoperability between computer systems on the Internet. REST-compliant Web services allow requesting systems to access and manipulate textual representations of Web resources using a uniform and predefined set of stateless operations. Other forms of Web services exist which expose their own arbitrary sets of operations such as WSDL and SOAP. Source "REST" - CCBYSA.

      -
      PyMISP
      +
      PyMISP

      PyMISP is a Python library to access MISP platforms via their REST API. PyMISP allows you to fetch events, add or update events/attributes, add or update samples or search for attributes.

      -
      IDS
      +
      IDS

      An IDS flag on an attribute allows to determine if an attribute can be automated (such as being exported as an IDS ruleset or used for detection). If the IDS flag is not present, the attribute can be useful for contextualisation only.

      -
      IOC
      +
      IOC

      Indicator of compromise (IOC or IoC) is an artefact observed on a network or in an operating system or information channel that could reference an intrusion or a reference to a technique used by an attacker. IoCs are a subset of indicators.

      -
      Attribute
      +
      Attribute

      Attributes in MISP can be network indicators (e.g. IP address), system indicators (e.g. a string in memory) or even bank account details.

      -
      Observable
      +
      Observable

      Obserbables are essentially the same as (MISP) attributes.

      -
      Site admin
      +
      Site Admin

      As an admin (not to be confused with Org Admin), you can set up new accounts for users, edit user profiles, delete them, or just have a look at all the viewers' profiles. Site admins have access to every administrator feature for all the data located on the system including global features such as the creation and modification of user roles and instance links. You will also see all other organisations connected or setup in the instance. The site admin can be considered as a super-user of a MISP instance.

      -
      Org Admin
      +
      Org Admin

      Organisation admins (Org Admin) are restricted to executing site-admin actions exclusively within their own organisation’s users only. They can administer users, events and logs of their own respective organisations.

      -
      OSINT
      +
      OSINT

      Open-source intelligence (OSINT) is data collected from publicly available sources to be used in an intelligence context.[1] In the intelligence community, the term "open" refers to overt, publicly available sources (as opposed to covert or clandestine sources). It is not related to open-source software or public intelligence. OSINT under one name or another has been around for hundreds of years. With the advent of instant communications and rapid information transfer, a great deal of actionable and predictive intelligence can now be obtained from public, unclassified sources. Source "Open-source intelligence" - CCBYSA.

      @@ -1007,7 +1006,7 @@ In case you use any CCBYSA licensed content, or other pieces that are subject to
      diff --git a/book.pdf b/book.pdf index f7055fa..7cde513 100644 --- a/book.pdf +++ b/book.pdf @@ -5,16 +5,16 @@ /Author (MISP Project) /Creator (Asciidoctor PDF 1.5.0.alpha.16, based on Prawn 2.2.2) /Producer (MISP Project) -/ModDate (D:20190215174729+09'00') -/CreationDate (D:20190215174729+09'00') +/ModDate (D:20190215194741+08'00') +/CreationDate (D:20190215194741+08'00') >> endobj 2 0 obj << /Type /Catalog /Pages 3 0 R /Names 14 0 R -/Outlines 122 0 R -/PageLabels 135 0 R +/Outlines 157 0 R +/PageLabels 170 0 R /PageMode /UseOutlines /OpenAction [7 0 R /FitH 842.89] /ViewerPreferences << /DisplayDocTitle true @@ -24,7 +24,7 @@ endobj 3 0 obj << /Type /Pages /Count 15 -/Kids [7 0 R 10 0 R 12 0 R 20 0 R 26 0 R 29 0 R 35 0 R 39 0 R 49 0 R 57 0 R 61 0 R 64 0 R 70 0 R 83 0 R 96 0 R] +/Kids [7 0 R 10 0 R 12 0 R 21 0 R 28 0 R 32 0 R 38 0 R 45 0 R 58 0 R 69 0 R 74 0 R 78 0 R 84 0 R 106 0 R 129 0 R] >> endobj 4 0 obj @@ -100,11 +100,11 @@ endobj << /Type /Font /BaseFont /867d2b+NotoSerif /Subtype /TrueType -/FontDescriptor 137 0 R +/FontDescriptor 172 0 R /FirstChar 32 /LastChar 255 -/Widths 139 0 R -/ToUnicode 138 0 R +/Widths 174 0 R +/ToUnicode 173 0 R >> endobj 9 0 obj @@ -543,11 +543,11 @@ endobj /F1.0 8 0 R >> >> -/Annots [100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R] +/Annots [135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R] >> endobj 11 0 obj -<< /Length 2134 +<< /Length 2417 >> stream q @@ -631,7 +631,37 @@ ET BT 48.24 681.866 Td /F1.0 10.5 Tf -[<5468652062657374207072> 20.0195 <61637469636573206465736372696265642068657265696e206172652066726f6d20496e666f726d6174696f6e2053686172696e6720636f6d6d756e697469657320284953> 20.0195 <41> 20.0195 <43206f722043534952> 20.0195 <5429>] TJ +[<5468652062657374207072> 20.0195 <61637469636573206465736372696265642068657265696e206172652066726f6d20496e666f726d6174696f6e2053686172696e6720636f6d6d756e69746965732028>] TJ +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +1.9581 Tw + +BT +470.9894 681.866 Td +/F1.0 10.5 Tf +[<4953> 20.0195 <41> 20.0195 <43>] TJ +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +1.9581 Tw + +BT +493.963 681.866 Td +/F1.0 10.5 Tf +[<206f722043534952> 20.0195 <5429>] TJ ET @@ -686,10 +716,10 @@ endobj /Font << /F2.0 17 0 R /F1.0 8 0 R >> -/XObject << /Stamp1 120 0 R +/XObject << /Stamp1 155 0 R >> >> -/Annots [18 0 R] +/Annots [18 0 R 19 0 R] >> endobj 13 0 obj @@ -701,7 +731,7 @@ endobj >> endobj 15 0 obj -<< /Names [(__anchor-top) 13 0 R (_authors_and_contributors) 65 0 R (_best_practices) 21 0 R (_expressing_confidenceestimative_probability_in_an_analysis) 50 0 R (_glossary) 71 0 R (_how_to_classify_information) 62 0 R (_how_to_track_and_keep_the_state_of_an_analysis) 58 0 R (_improving_analysis) 22 0 R (_intelligence_tagging) 36 0 R (_introduction) 16 0 R (_what_to_share_or_what_counts_as_valuable_information) 30 0 R] +<< /Kids [110 0 R 111 0 R] >> endobj 16 0 obj @@ -711,11 +741,11 @@ endobj << /Type /Font /BaseFont /475c60+NotoSerif-Bold /Subtype /TrueType -/FontDescriptor 141 0 R +/FontDescriptor 176 0 R /FirstChar 32 /LastChar 255 -/Widths 143 0 R -/ToUnicode 142 0 R +/Widths 178 0 R +/ToUnicode 177 0 R >> endobj 18 0 obj @@ -730,7 +760,15 @@ endobj >> endobj 19 0 obj -<< /Length 12152 +<< /Border [0 0 0] +/Dest (ISAC) +/Subtype /Link +/Rect [470.9894 678.8 493.963 693.08] +/Type /Annot +>> +endobj +20 0 obj +<< /Length 12432 >> stream q @@ -1037,7 +1075,37 @@ ET BT 103.5124 427.986 Td /F1.0 10.5 Tf -<20636173652c204d49535020696e636c756465732061206d656368616e69736d20746f2070726f706f7365206368616e67657320746f20746865206f726967696e616c2063726561746f722c2061> Tj +<20636173652c20> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +4.0059 Tw + +BT +141.0082 427.986 Td +/F1.0 10.5 Tf +<4d495350> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +4.0059 Tw + +BT +166.7437 427.986 Td +/F1.0 10.5 Tf +<20696e636c756465732061206d656368616e69736d20746f2070726f706f7365206368616e67657320746f20746865206f726967696e616c2063726561746f722c2061> Tj ET @@ -1460,7 +1528,7 @@ Q endstream endobj -20 0 obj +21 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -1468,36 +1536,44 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 19 0 R +/Contents 20 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F2.0 17 0 R -/F3.1 23 0 R +/F3.1 24 0 R /F1.0 8 0 R >> -/XObject << /Stamp2 121 0 R +/XObject << /Stamp2 156 0 R >> >> -/Annots [24 0 R] +/Annots [25 0 R 26 0 R] >> endobj -21 0 obj -[20 0 R /XYZ 0 841.89 null] -endobj 22 0 obj -[20 0 R /XYZ 0 765.17 null] +[21 0 R /XYZ 0 841.89 null] endobj 23 0 obj +[21 0 R /XYZ 0 765.17 null] +endobj +24 0 obj << /Type /Font /BaseFont /e8ffbc+FontAwesome /Subtype /TrueType -/FontDescriptor 145 0 R +/FontDescriptor 180 0 R /FirstChar 32 /LastChar 255 -/Widths 147 0 R -/ToUnicode 146 0 R +/Widths 182 0 R +/ToUnicode 181 0 R >> endobj -24 0 obj +25 0 obj +<< /Border [0 0 0] +/Dest (MISP) +/Subtype /Link +/Rect [141.0082 424.92 166.7437 439.2] +/Type /Annot +>> +endobj +26 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -1508,8 +1584,8 @@ endobj /Type /Annot >> endobj -25 0 obj -<< /Length 3057 +27 0 obj +<< /Length 3337 >> stream q @@ -1583,7 +1659,37 @@ ET BT 48.24 763.116 Td /F1.0 10.5 Tf -<6578706f6e656e7469616c6c7920756e72656c6961626c652e2057686174206973207072696d616c20696e2074686973206361736520697320746f2066756c6c7920756e6465727374616e642077686174207468652049445320666c616720696e> Tj +<6578706f6e656e7469616c6c7920756e72656c6961626c652e2057686174206973207072696d616c20696e2074686973206361736520697320746f2066756c6c7920756e6465727374616e6420776861742074686520> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +1.6877 Tw + +BT +492.2356 763.116 Td +/F1.0 10.5 Tf +<494453> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +1.6877 Tw + +BT +509.4241 763.116 Td +/F1.0 10.5 Tf +<20666c616720696e> Tj ET @@ -1685,7 +1791,7 @@ Q endstream endobj -26 0 obj +28 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -1693,17 +1799,17 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 25 0 R +/Contents 27 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F1.0 8 0 R >> -/XObject << /Stamp1 120 0 R +/XObject << /Stamp1 155 0 R >> >> -/Annots [27 0 R] +/Annots [29 0 R 30 0 R] >> endobj -27 0 obj +29 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -1714,7 +1820,15 @@ endobj /Type /Annot >> endobj -28 0 obj +30 0 obj +<< /Border [0 0 0] +/Dest (IDS) +/Subtype /Link +/Rect [492.2356 760.05 509.4241 774.33] +/Type /Annot +>> +endobj +31 0 obj << /Length 7965 >> stream @@ -2257,7 +2371,7 @@ Q endstream endobj -29 0 obj +32 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -2265,22 +2379,22 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 28 0 R +/Contents 31 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F2.0 17 0 R -/F3.1 23 0 R +/F3.1 24 0 R /F1.0 8 0 R >> -/XObject << /Stamp2 121 0 R +/XObject << /Stamp2 156 0 R >> >> -/Annots [31 0 R 32 0 R 33 0 R] +/Annots [34 0 R 35 0 R 36 0 R] >> endobj -30 0 obj -[29 0 R /XYZ 0 841.89 null] +33 0 obj +[32 0 R /XYZ 0 841.89 null] endobj -31 0 obj +34 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -2291,7 +2405,7 @@ endobj /Type /Annot >> endobj -32 0 obj +35 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -2302,7 +2416,7 @@ endobj /Type /Annot >> endobj -33 0 obj +36 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -2313,8 +2427,8 @@ endobj /Type /Annot >> endobj -34 0 obj -<< /Length 13351 +37 0 obj +<< /Length 14060 >> stream q @@ -2354,7 +2468,37 @@ ET BT 48.24 742.866 Td /F1.0 10.5 Tf -<697320746865207175616c697479206f662074686520696e64696361746f727320286f72206f627365727661626c6520646570656e64696e67206f6e2074686520646566696e6974696f6e20796f7520757365292c2073746f726564206173> Tj +<697320746865207175616c697479206f662074686520696e64696361746f727320286f7220> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +2.5002 Tw + +BT +235.0016 742.866 Td +/F1.0 10.5 Tf +<6f627365727661626c65> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +2.5002 Tw + +BT +290.0846 742.866 Td +/F1.0 10.5 Tf +<20646570656e64696e67206f6e2074686520646566696e6974696f6e20796f7520757365292c2073746f726564206173> Tj ET @@ -2665,15 +2809,30 @@ ET 0.0 0.0 0.0 SCN 0.0 0.0 0.0 scn -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN 2.2331 Tw BT 120.24 463.726 Td /F1.0 10.5 Tf -<4d495350204f626a6563747320696e2069747320706c61696e20636f6e6365707420697320612067726f7570696e67206f6620696e64696361746f72732077697468696e206f6e65206576656e742e> Tj +<4d495350204f626a65637473> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +2.2331 Tw + +BT +187.5101 463.726 Td +/F1.0 10.5 Tf +<20696e2069747320706c61696e20636f6e6365707420697320612067726f7570696e67206f6620696e64696361746f72732077697468696e206f6e65206576656e742e> Tj ET @@ -2774,7 +2933,37 @@ ET BT 48.24 368.826 Td /F1.0 10.5 Tf -<41206672657175656e74207573652d6361736520666f7220706c6163696e67206164646974696f6e616c2074616773206f6e20617474726962757465206c6576656c20776f756c6420626520746f206c6f7765722074686520636f6e666964656e6365> Tj +<41206672657175656e74207573652d6361736520666f7220706c6163696e67206164646974696f6e616c2074616773206f6e20> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +0.6088 Tw + +BT +302.9477 368.826 Td +/F1.0 10.5 Tf +<617474726962757465> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +0.6088 Tw + +BT +346.9427 368.826 Td +/F1.0 10.5 Tf +<206c6576656c20776f756c6420626520746f206c6f7765722074686520636f6e666964656e6365> Tj ET @@ -3108,7 +3297,7 @@ Q endstream endobj -35 0 obj +38 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -3116,22 +3305,46 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 34 0 R +/Contents 37 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F2.0 17 0 R /F1.0 8 0 R -/F3.1 23 0 R +/F3.1 24 0 R >> -/XObject << /Stamp1 120 0 R +/XObject << /Stamp1 155 0 R >> >> -/Annots [37 0 R] +/Annots [40 0 R 41 0 R 42 0 R 43 0 R] >> endobj -36 0 obj -[35 0 R /XYZ 0 841.89 null] +39 0 obj +[38 0 R /XYZ 0 841.89 null] endobj -37 0 obj +40 0 obj +<< /Border [0 0 0] +/Dest (observables) +/Subtype /Link +/Rect [235.0016 739.8 290.0846 754.08] +/Type /Annot +>> +endobj +41 0 obj +<< /Border [0 0 0] +/Dest (MISPObjects) +/Subtype /Link +/Rect [120.24 460.66 187.5101 474.94] +/Type /Annot +>> +endobj +42 0 obj +<< /Border [0 0 0] +/Dest (Attribute) +/Subtype /Link +/Rect [302.9477 365.76 346.9427 380.04] +/Type /Annot +>> +endobj +43 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -3142,8 +3355,8 @@ endobj /Type /Annot >> endobj -38 0 obj -<< /Length 11697 +44 0 obj +<< /Length 12417 >> stream q @@ -3366,14 +3579,14 @@ q 0.5 w 0.9333 0.9333 0.9333 SCN 108.24 556.75 m -108.24 501.41 l +108.24 485.63 l S Q 0.098 0.251 0.4863 scn 0.098 0.251 0.4863 SCN BT -67.956 520.512 Td +67.956 512.622 Td /F3.1 24 Tf <21> Tj ET @@ -3383,27 +3596,102 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN -1.7419 Tw +3.1332 Tw BT 120.24 540.786 Td /F1.0 10.5 Tf -<4f6e65206d697469676174696f6e20746865207363656e6172696f206f66206d69732d636c617373696669656420646174612c20776f756c6420626520746f2075736520746865207761726e696e67> Tj +<4f6e65206d697469676174696f6e20746865207363656e6172696f206f66206d69732d636c617373696669656420646174612c20776f756c6420626520746f207573652074686520> Tj ET 0.0 Tw 0.0 0.0 0.0 SCN 0.0 0.0 0.0 scn -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN -0.2885 Tw +3.1332 Tw + +BT +509.3045 540.786 Td +/F1.0 10.5 Tf +<4d495350> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +2.4381 Tw BT 120.24 525.006 Td /F1.0 10.5 Tf -[<6c6973747320286f72206e6f74696365206c697374732920617320612063616e617279> 89.8438 <2e205768696c7374206e6f7420696465616c20616e64206661722066726f6d2061206465666163746f20736f6c7574696f6e20746f>] TJ +<7761726e696e676c69737473> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +2.4381 Tw + +BT +182.442 525.006 Td +/F1.0 10.5 Tf +<20286f7220> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +2.4381 Tw + +BT +207.3942 525.006 Td +/F1.0 10.5 Tf +<4d495350206e6f746963656c69737473> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +2.4381 Tw + +BT +288.7188 525.006 Td +/F1.0 10.5 Tf +[<2920617320612063616e617279> 89.8438 <2e205768696c7374206e6f7420696465616c20616e64206661722066726f6d2061>] TJ +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +1.4628 Tw + +BT +120.24 509.226 Td +/F1.0 10.5 Tf +[<6465666163746f20736f6c7574696f6e20746f20636174636820616c6c206973737565732c20697420776f756c64206265206120676f6f642d656e6f7567682d7965742d636f61727365207761> 20.0195 <79206f66>] TJ ET @@ -3414,9 +3702,9 @@ ET 0.2 0.2 0.2 SCN BT -120.24 509.226 Td +120.24 493.446 Td /F1.0 10.5 Tf -[<636174636820616c6c206973737565732c20697420776f756c64206265206120676f6f642d656e6f7567682d7965742d636f61727365207761> 20.0195 <79206f6620646574656374696f6e2e>] TJ +<646574656374696f6e2e> Tj ET 0.0 0.0 0.0 SCN @@ -3427,7 +3715,7 @@ ET 0.8316 Tw BT -48.24 477.446 Td +48.24 461.666 Td /F1.0 10.5 Tf <546865726520617265206d756c7469706c6520736f6c7574696f6e7320746f20736f6c766520746865206973737565206f66206d697373696e67206164646974696f6e616c20696e666f726d6174696f6e2061626f75742074686520736861726564> Tj ET @@ -3442,7 +3730,7 @@ ET 0.5138 Tw BT -48.24 461.666 Td +48.24 445.886 Td /F1.0 10.5 Tf <636f6e74656e742e204f6e65206f66207468656d2069732074686520666f6c6c6f77696e67206c697374206f66207461677320776869636820617265206465656d656420746f20626520746865206d696e696d616c2073756273657420617420746865> Tj ET @@ -3457,7 +3745,7 @@ ET 2.5809 Tw BT -48.24 445.886 Td +48.24 430.106 Td /F1.0 10.5 Tf [<7374617274206f6620616e> 20.0195 <79206576656e74206f722074686520696e646976696475616c20617474726962757465732e2073686172696e6720706c6174666f726d2e20546865206c6973742062656c6f7720697320696e206f72646572206f66>] TJ ET @@ -3470,7 +3758,7 @@ ET 0.2 0.2 0.2 SCN BT -48.24 430.106 Td +48.24 414.326 Td /F1.0 10.5 Tf <696d706f7274616e63652e> Tj ET @@ -3483,7 +3771,7 @@ ET 0.2 0.2 0.2 SCN BT -52.6765 402.326 Td +52.6765 386.546 Td /F1.0 10.5 Tf <312e> Tj ET @@ -3496,7 +3784,7 @@ ET 0.2588 0.5451 0.7922 SCN BT -66.24 402.326 Td +66.24 386.546 Td /F2.0 10.5 Tf [<544c502d54> 29.7852 <616773>] TJ ET @@ -3507,7 +3795,7 @@ ET 0.2 0.2 0.2 SCN BT -113.7128 402.326 Td +113.7128 386.546 Td /F1.0 10.5 Tf <3a20> Tj ET @@ -3518,7 +3806,7 @@ ET 0.2588 0.5451 0.7922 SCN BT -119.4353 402.326 Td +119.4353 386.546 Td /F1.0 10.5 Tf <544c50> Tj ET @@ -3529,7 +3817,7 @@ ET 0.2 0.2 0.2 SCN BT -138.7448 402.326 Td +138.7448 386.546 Td /F1.0 10.5 Tf <207574696c697a657320612073696d706c6520666f757220636f6c6f7220736368656d6120666f7220696e6469636174696e6720686f7720696e74656c6c6967656e63652063616e206265207368617265642e> Tj ET @@ -3542,7 +3830,7 @@ ET 0.2 0.2 0.2 SCN BT -52.6765 380.546 Td +52.6765 364.766 Td /F1.0 10.5 Tf <322e> Tj ET @@ -3557,7 +3845,7 @@ ET 1.6129 Tw BT -66.24 380.546 Td +66.24 364.766 Td /F2.0 10.5 Tf [<436f6e666964656e63652d54> 29.7852 <616773>] TJ ET @@ -3572,7 +3860,7 @@ ET 1.6129 Tw BT -152.9933 380.546 Td +152.9933 364.766 Td /F1.0 10.5 Tf <2f> Tj ET @@ -3587,7 +3875,7 @@ ET 1.6129 Tw BT -156.0173 380.546 Td +156.0173 364.766 Td /F2.0 10.5 Tf [<56> 60.0586 <657474696e67205374617465>] TJ ET @@ -3602,7 +3890,7 @@ ET 1.6129 Tw BT -224.987 380.546 Td +224.987 364.766 Td /F1.0 10.5 Tf <3a20546865726520617265206875676520646966666572656e63657320696e20746865207175616c697479206f6620646174612c2077686574686572206974> Tj ET @@ -3617,7 +3905,7 @@ ET 0.3048 Tw BT -66.24 364.766 Td +66.24 348.986 Td /F1.0 10.5 Tf <776173207665747465642075706f6e2073686172696e672e2041732074686973206d65616e7320746861742074686520617574686f722077617320636f6e666964656e74207468617420746865207368617265642064617461206973206f72> Tj ET @@ -3630,7 +3918,7 @@ ET 0.2 0.2 0.2 SCN BT -66.24 348.986 Td +66.24 333.206 Td /F1.0 10.5 Tf <6174206c6561737420776173206120676f6f6420696e64696361746f72206f6620636f6d70726f6d6973652e> Tj ET @@ -3643,7 +3931,7 @@ ET 0.2 0.2 0.2 SCN BT -52.6765 327.206 Td +52.6765 311.426 Td /F1.0 10.5 Tf <332e> Tj ET @@ -3658,7 +3946,7 @@ ET 2.3059 Tw BT -66.24 327.206 Td +66.24 311.426 Td /F2.0 10.5 Tf [<4f726967696e2d54> 29.7852 <616773>] TJ ET @@ -3673,7 +3961,7 @@ ET 2.3059 Tw BT -127.3208 327.206 Td +127.3208 311.426 Td /F1.0 10.5 Tf <3a204465736372696265732077686572652074686520696e666f726d6174696f6e2063616d652066726f6d2c20776865746865722069742077617320696e20616e206175746f6d61746564> Tj ET @@ -3688,7 +3976,7 @@ ET 0.1594 Tw BT -66.24 311.426 Td +66.24 295.646 Td /F1.0 10.5 Tf <66617368696f6e206f7220696e2061206d616e75616c20696e7665737469676174696f6e2e20546869732073686f756c64206769766520616e20696d7072657373696f6e20686f772076616c7565207468697320696e74656c6c6967656e6365> Tj ET @@ -3701,7 +3989,7 @@ ET 0.2 0.2 0.2 SCN BT -66.24 295.646 Td +66.24 279.866 Td /F1.0 10.5 Tf [<69732c206173206d616e75616c20696e7665737469676174696f6e2073686f756c642073757065727365646520616e> 20.0195 <79206175746f6d617469632067656e6572> 20.0195 <6174696f6e206f6620646174612e>] TJ ET @@ -3714,7 +4002,7 @@ ET 0.2 0.2 0.2 SCN BT -52.6765 273.866 Td +52.6765 258.086 Td /F1.0 10.5 Tf <342e> Tj ET @@ -3729,7 +4017,7 @@ ET 2.5017 Tw BT -66.24 273.866 Td +66.24 258.086 Td /F2.0 10.5 Tf [<50> 49.8047 <41502d54> 29.7852 <616773>] TJ ET @@ -3744,7 +4032,7 @@ ET 2.5017 Tw BT -114.0823 273.866 Td +114.0823 258.086 Td /F1.0 10.5 Tf <3a20416e206576656e206d6f726520616476616e63656420617070726f616368206f66206461746120636c617373696669636174696f6e206973207573696e6720746865205065726d69737369626c65> Tj ET @@ -3759,7 +4047,7 @@ ET 2.0404 Tw BT -66.24 258.086 Td +66.24 242.306 Td /F1.0 10.5 Tf [<41> 20.0195 <6374696f6e732050726f746f636f6c2e20497420696e6469636174657320686f772074686520726563656976656420646174612063616e206265207573656420746f2073656172636820666f7220636f6d70726f6d69736573>] TJ ET @@ -3772,7 +4060,7 @@ ET 0.2 0.2 0.2 SCN BT -66.24 242.306 Td +66.24 226.526 Td /F1.0 10.5 Tf [<77697468696e2074686520696e646976696475616c20636f6d70616e> 20.0195 <79206f7220636f6e7374697475656e6379> 89.8438 <2e>] TJ ET @@ -3782,15 +4070,15 @@ ET q 0.5 w 0.9333 0.9333 0.9333 SCN -108.24 226.49 m -108.24 202.71 l +108.24 210.71 m +108.24 186.93 l S Q 0.0667 0.0667 0.0667 scn 0.0667 0.0667 0.0667 SCN BT -71.4508 206.1105 Td +71.4508 190.3305 Td /F3.1 23.779999999999973 Tf <22> Tj ET @@ -3801,7 +4089,7 @@ ET 0.2 0.2 0.2 SCN BT -120.24 210.526 Td +120.24 194.746 Td /F1.0 10.5 Tf <5468652066756c6c206c697374206f6620617661696c61626c65207461786f6e6f6d6965732063616e20626520666f756e6420> Tj ET @@ -3812,7 +4100,7 @@ ET 0.2588 0.5451 0.7922 SCN BT -368.985 210.526 Td +368.985 194.746 Td /F2.0 10.5 Tf <68657265> Tj ET @@ -3823,7 +4111,7 @@ ET 0.2 0.2 0.2 SCN BT -393.429 210.526 Td +393.429 194.746 Td /F1.0 10.5 Tf <2e> Tj ET @@ -3854,7 +4142,7 @@ Q endstream endobj -39 0 obj +45 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -3862,109 +4150,133 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 38 0 R +/Contents 44 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] -/Font << /F3.1 23 0 R +/Font << /F3.1 24 0 R /F1.0 8 0 R -/F4.0 40 0 R +/F4.0 46 0 R /F2.0 17 0 R >> -/XObject << /Stamp2 121 0 R +/XObject << /Stamp2 156 0 R >> >> -/Annots [41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R] +/Annots [47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R] >> endobj -40 0 obj +46 0 obj << /Type /Font -/BaseFont /933e95+mplus1mn-regular +/BaseFont /673098+mplus1mn-regular /Subtype /TrueType -/FontDescriptor 149 0 R +/FontDescriptor 184 0 R /FirstChar 32 /LastChar 255 -/Widths 151 0 R -/ToUnicode 150 0 R +/Widths 186 0 R +/ToUnicode 185 0 R >> endobj -41 0 obj +47 0 obj +<< /Border [0 0 0] +/Dest (MISPwarninglists) +/Subtype /Link +/Rect [509.3045 537.72 535.04 552.0] +/Type /Annot +>> +endobj +48 0 obj +<< /Border [0 0 0] +/Dest (MISPwarninglists) +/Subtype /Link +/Rect [120.24 521.94 182.442 536.22] +/Type /Annot +>> +endobj +49 0 obj +<< /Border [0 0 0] +/Dest (MISPnoticelists) +/Subtype /Link +/Rect [207.3942 521.94 288.7188 536.22] +/Type /Annot +>> +endobj +50 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://github.com/MISP/misp-taxonomies/blob/master/tlp/machinetag.json) >> /Subtype /Link -/Rect [66.24 399.26 113.7128 413.54] +/Rect [66.24 383.48 113.7128 397.76] /Type /Annot >> endobj -42 0 obj +51 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://www.us-cert.gov/tlp) >> /Subtype /Link -/Rect [119.4353 399.26 138.7448 413.54] +/Rect [119.4353 383.48 138.7448 397.76] /Type /Annot >> endobj -43 0 obj +52 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://github.com/MISP/misp-taxonomies/blob/master/veris/machinetag.json) >> /Subtype /Link -/Rect [66.24 377.48 152.9933 391.76] +/Rect [66.24 361.7 152.9933 375.98] /Type /Annot >> endobj -44 0 obj +53 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://github.com/MISP/misp-taxonomies/blob/master/cssa/machinetag.json) >> /Subtype /Link -/Rect [156.0173 377.48 224.987 391.76] +/Rect [156.0173 361.7 224.987 375.98] /Type /Annot >> endobj -45 0 obj +54 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://github.com/MISP/misp-taxonomies/blob/master/cssa/machinetag.json) >> /Subtype /Link -/Rect [66.24 324.14 127.3208 338.42] +/Rect [66.24 308.36 127.3208 322.64] /Type /Annot >> endobj -46 0 obj +55 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://github.com/MISP/misp-taxonomies/blob/master/PAP/machinetag.json) >> /Subtype /Link -/Rect [66.24 270.8 114.0823 285.08] +/Rect [66.24 255.02 114.0823 269.3] /Type /Annot >> endobj -47 0 obj +56 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://github.com/MISP/misp-taxonomies) >> /Subtype /Link -/Rect [368.985 207.46 393.429 221.74] +/Rect [368.985 191.68 393.429 205.96] /Type /Annot >> endobj -48 0 obj -<< /Length 12446 +57 0 obj +<< /Length 11336 >> stream q @@ -4054,12 +4366,42 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN -2.5939 Tw +0.524 Tw BT 48.24 666.826 Td /F1.0 10.5 Tf -[<6f766572> 20.0195 <616c6c20636f6e666964656e6365206c6576656c2e2054> 29.7852 <6f2061736365727461696e207468697320636f6e666964656e6365206c6576656c20796f752063616e2075736520666f72206578616d706c6520746865204d495350>] TJ +[<6f766572> 20.0195 <616c6c20636f6e666964656e6365206c6576656c2e2054> 29.7852 <6f2061736365727461696e207468697320636f6e666964656e6365206c6576656c20796f752063616e2075736520666f72206578616d706c6520746865204d49535020>] TJ +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +0.524 Tw + +BT +521.3045 666.826 Td +/F1.0 10.5 Tf +<4d495350> Tj +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +3.7481 Tw + +BT +48.24 651.046 Td +/F1.0 10.5 Tf +[<54> 29.7852 <61786f6e6f6d696573>] TJ ET @@ -4072,9 +4414,9 @@ ET 3.7481 Tw BT -48.24 651.046 Td +108.8273 651.046 Td /F1.0 10.5 Tf -[<54> 29.7852 <61786f6e6f6d6965732063616c6c656420>] TJ +<2063616c6c656420> Tj ET @@ -4257,49 +4599,11 @@ ET 0.0 0.0 0.0 SCN 0.0 0.0 0.0 scn -q -0.9608 0.9608 0.9608 scn -52.24 508.99 m -543.04 508.99 l -545.2491 508.99 547.04 507.1991 547.04 504.99 c -547.04 476.25 l -547.04 474.0409 545.2491 472.25 543.04 472.25 c -52.24 472.25 l -50.0309 472.25 48.24 474.0409 48.24 476.25 c -48.24 504.99 l -48.24 507.1991 50.0309 508.99 52.24 508.99 c -h -f -0.8 0.8 0.8 SCN -0.75 w -52.24 508.99 m -543.04 508.99 l -545.2491 508.99 547.04 507.1991 547.04 504.99 c -547.04 476.25 l -547.04 474.0409 545.2491 472.25 543.04 472.25 c -52.24 472.25 l -50.0309 472.25 48.24 474.0409 48.24 476.25 c -48.24 504.99 l -48.24 507.1991 50.0309 508.99 52.24 508.99 c -h -S -Q 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN BT -59.24 486.165 Td -/F4.0 11 Tf -<5b544f444f3a20726576697365206465736372697074696f6e206f6620657374696d61746976652070726f626162696c6974795d> Tj -ET - -0.0 0.0 0.0 SCN -0.0 0.0 0.0 scn -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN - -BT -48.24 448.286 Td +48.24 497.026 Td /F1.0 10.5 Tf <546875732c20616464696e6720636f6e666964656e6365206f7220657374696d61746976652070726f626162696c69747920686173206d756c7469706c6520616476616e746167657320737563682061733a> Tj ET @@ -4312,7 +4616,7 @@ ET 0.2 0.2 0.2 SCN BT -56.8805 420.506 Td +56.8805 469.246 Td /F1.0 10.5 Tf Tj ET @@ -4327,7 +4631,7 @@ ET 0.6377 Tw BT -66.24 420.506 Td +66.24 469.246 Td /F1.0 10.5 Tf [<416c6c6f7720726563656976696e67206f7267616e69736174696f6e7320746f2066696c7465722c20636c61737369667920616e642073636f72652074686520696e666f726d6174696f6e20696e20616e206175746f6d61746564207761> 20.0195 <79>] TJ ET @@ -4340,7 +4644,7 @@ ET 0.2 0.2 0.2 SCN BT -66.24 404.726 Td +66.24 453.466 Td /F1.0 10.5 Tf <6261736564206f6e2072656c617465642074616773> Tj ET @@ -4353,7 +4657,7 @@ ET 0.2 0.2 0.2 SCN BT -56.8805 382.946 Td +56.8805 431.686 Td /F1.0 10.5 Tf Tj ET @@ -4368,7 +4672,7 @@ ET 1.4981 Tw BT -66.24 382.946 Td +66.24 431.686 Td /F1.0 10.5 Tf <496e666f726d6174696f6e2077697468206c6f772d636f6e666964656e63652063616e207374696c6c2062652073686172656420616e6420726561636820636f6d6d756e6974696573206f72206f7267616e69736174696f6e73> Tj ET @@ -4383,7 +4687,7 @@ ET 3.4172 Tw BT -66.24 367.166 Td +66.24 415.906 Td /F1.0 10.5 Tf [<696e746572657374656420696e207375636820696e666f726d6174696f6e20776974686f757420696d70616374696e67206f7267616e69736174696f6e732066696c746572696e67206f75742062> 20.0195 <7920696e63726561736564>] TJ ET @@ -4396,7 +4700,7 @@ ET 0.2 0.2 0.2 SCN BT -66.24 351.386 Td +66.24 400.126 Td /F1.0 10.5 Tf <636f6e666964656e6365206c6576656c> Tj ET @@ -4409,7 +4713,7 @@ ET 0.2 0.2 0.2 SCN BT -56.8805 329.606 Td +56.8805 378.346 Td /F1.0 10.5 Tf Tj ET @@ -4424,7 +4728,7 @@ ET 0.2496 Tw BT -66.24 329.606 Td +66.24 378.346 Td /F1.0 10.5 Tf [<537570706f727420636f756e74657220616e616c7973657320616e6420636f6d706574697469766520616e616c7973657320746f2076616c69646174652068> 20.0195 <79706f7468657365732065787072657373656420696e206f726967696e616c>] TJ ET @@ -4437,7 +4741,7 @@ ET 0.2 0.2 0.2 SCN BT -66.24 313.826 Td +66.24 362.566 Td /F1.0 10.5 Tf <7265706f7274696e67> Tj ET @@ -4450,7 +4754,7 @@ ET 0.2 0.2 0.2 SCN BT -56.8805 292.046 Td +56.8805 340.786 Td /F1.0 10.5 Tf Tj ET @@ -4465,7 +4769,7 @@ ET 2.2183 Tw BT -66.24 292.046 Td +66.24 340.786 Td /F1.0 10.5 Tf <446570656e64696e67206f6e20736f75726365206f7267616e69736174696f6e2c206861766520616e2061666669726d6174697665207468617420736f6d652048756d496e7420686173206f6e6520696e746f20746865> Tj ET @@ -4478,49 +4782,11 @@ ET 0.2 0.2 0.2 SCN BT -66.24 276.266 Td +66.24 325.006 Td /F1.0 10.5 Tf <73686172696e672070726f63657373> Tj ET -0.0 0.0 0.0 SCN -0.0 0.0 0.0 scn -q -0.9608 0.9608 0.9608 scn -70.24 260.45 m -543.04 260.45 l -545.2491 260.45 547.04 258.6591 547.04 256.45 c -547.04 227.71 l -547.04 225.5009 545.2491 223.71 543.04 223.71 c -70.24 223.71 l -68.0309 223.71 66.24 225.5009 66.24 227.71 c -66.24 256.45 l -66.24 258.6591 68.0309 260.45 70.24 260.45 c -h -f -0.8 0.8 0.8 SCN -0.75 w -70.24 260.45 m -543.04 260.45 l -545.2491 260.45 547.04 258.6591 547.04 256.45 c -547.04 227.71 l -547.04 225.5009 545.2491 223.71 543.04 223.71 c -70.24 223.71 l -68.0309 223.71 66.24 225.5009 66.24 227.71 c -66.24 256.45 l -66.24 258.6591 68.0309 260.45 70.24 260.45 c -h -S -Q -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN - -BT -77.24 237.625 Td -/F4.0 11 Tf -<5b544f444f3a20646566696e6520636f756e74657220616e6420636f6d706574697469766520616e616c797365735d> Tj -ET - 0.0 0.0 0.0 SCN 0.0 0.0 0.0 scn 0.2 0.2 0.2 scn @@ -4529,7 +4795,7 @@ ET 0.6646 Tw BT -48.24 193.746 Td +48.24 297.226 Td /F1.0 10.5 Tf [<436f6d706c656d656e7420616e616c79736973207769746820636f6e7472> 20.0195 <6172792065766964656e63657320697320616c736f20766572792077656c636f6d6520746f20656e7375726520746865206f726967696e616c20616e616c79736973>] TJ ET @@ -4542,7 +4808,7 @@ ET 0.2 0.2 0.2 SCN BT -48.24 177.966 Td +48.24 281.446 Td /F1.0 10.5 Tf [<616e64207468652068> 20.0195 <79706f746865736573206172652070726f7065726c79206576616c75617465642e>] TJ ET @@ -4552,30 +4818,45 @@ ET q 0.5 w 0.9333 0.9333 0.9333 SCN -108.24 162.15 m -108.24 122.59 l +108.24 265.63 m +108.24 226.07 l S Q 0.0667 0.0667 0.0667 scn 0.0667 0.0667 0.0667 SCN BT -71.388 133.802 Td +71.388 237.282 Td /F3.1 24 Tf <22> Tj ET +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +0.9529 Tw + +BT +120.24 249.666 Td +/F1.0 10.5 Tf +[<4d4953502054> 29.7852 <61786f6e6f6d696573>] TJ +ET + + +0.0 Tw 0.0 0.0 0.0 SCN 0.0 0.0 0.0 scn 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN -1.1946 Tw +0.9529 Tw BT -120.24 146.186 Td +210.2352 249.666 Td /F1.0 10.5 Tf -<4d495350207461786f6e6f6d69657320636f6e7461696e20616e2065786861757374697665206c697374206f6620636f6e666964656e6365206c6576656c7320696e636c7564696e6720776f726473> Tj +<20636f6e7461696e20616e2065786861757374697665206c697374206f6620636f6e666964656e6365206c6576656c7320696e636c7564696e6720776f726473> Tj ET @@ -4586,7 +4867,7 @@ ET 0.2 0.2 0.2 SCN BT -120.24 130.406 Td +120.24 233.886 Td /F1.0 10.5 Tf <6f6620> Tj ET @@ -4597,7 +4878,7 @@ ET 0.2588 0.5451 0.7922 SCN BT -132.8925 130.406 Td +132.8925 233.886 Td /F1.0 10.5 Tf <657374696d61746976652070726f626162696c697479> Tj ET @@ -4608,7 +4889,7 @@ ET 0.2 0.2 0.2 SCN BT -243.3525 130.406 Td +243.3525 233.886 Td /F1.0 10.5 Tf <206f7220636f6e666964656e636520696e20616e616c79746963206a7564676d656e742e> Tj ET @@ -4618,15 +4899,15 @@ ET q 0.5 w 0.9333 0.9333 0.9333 SCN -108.24 110.59 m -108.24 71.03 l +108.24 214.07 m +108.24 174.51 l S Q 0.0667 0.0667 0.0667 scn 0.0667 0.0667 0.0667 SCN BT -71.388 82.242 Td +71.388 185.722 Td /F3.1 24 Tf <22> Tj ET @@ -4639,7 +4920,7 @@ ET 1.8361 Tw BT -120.24 94.626 Td +120.24 198.106 Td /F1.0 10.5 Tf <7468726561742d696e74656c6c6967656e63652e657520696e636c7564657320616e206f76657276696577206f662074686520> Tj ET @@ -4654,7 +4935,7 @@ ET 1.8361 Tw BT -381.7128 94.626 Td +381.7128 198.106 Td /F1.0 10.5 Tf <6d6574686f646f6c6f6769657320616e642070726f6365737320746f> Tj ET @@ -4667,7 +4948,7 @@ ET 0.2588 0.5451 0.7922 SCN BT -120.24 78.846 Td +120.24 182.326 Td /F1.0 10.5 Tf <737570706f72742074687265617420696e74656c6c6967656e6365> Tj ET @@ -4678,7 +4959,7 @@ ET 0.2 0.2 0.2 SCN BT -253.275 78.846 Td +253.275 182.326 Td /F1.0 10.5 Tf <2e> Tj ET @@ -4709,7 +4990,7 @@ Q endstream endobj -49 0 obj +58 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -4717,23 +4998,38 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 48 0 R +/Contents 57 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F2.0 17 0 R -/F3.1 23 0 R +/F3.1 24 0 R /F1.0 8 0 R -/F4.0 40 0 R >> -/XObject << /Stamp1 120 0 R +/XObject << /Stamp1 155 0 R >> >> -/Annots [51 0 R 52 0 R 53 0 R 54 0 R 55 0 R] +/Annots [60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R] >> endobj -50 0 obj -[49 0 R /XYZ 0 841.89 null] +59 0 obj +[58 0 R /XYZ 0 841.89 null] endobj -51 0 obj +60 0 obj +<< /Border [0 0 0] +/Dest (MISPTaxonomies) +/Subtype /Link +/Rect [521.3045 663.76 547.04 678.04] +/Type /Annot +>> +endobj +61 0 obj +<< /Border [0 0 0] +/Dest (MISPTaxonomies) +/Subtype /Link +/Rect [48.24 647.98 108.8273 662.26] +/Type /Annot +>> +endobj +62 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -4744,7 +5040,7 @@ endobj /Type /Annot >> endobj -52 0 obj +63 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -4755,41 +5051,49 @@ endobj /Type /Annot >> endobj -53 0 obj +64 0 obj +<< /Border [0 0 0] +/Dest (MISPTaxonomies) +/Subtype /Link +/Rect [120.24 246.6 210.2352 260.88] +/Type /Annot +>> +endobj +65 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://www.misp-project.org/taxonomies.html#_estimative_language) >> /Subtype /Link -/Rect [132.8925 127.34 243.3525 141.62] +/Rect [132.8925 230.82 243.3525 245.1] /Type /Annot >> endobj -54 0 obj +66 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://www.threat-intelligence.eu/methodologies/) >> /Subtype /Link -/Rect [381.7128 91.56 535.04 105.84] +/Rect [381.7128 195.04 535.04 209.32] /Type /Annot >> endobj -55 0 obj +67 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI /URI (https://www.threat-intelligence.eu/methodologies/) >> /Subtype /Link -/Rect [120.24 75.78 253.275 90.06] +/Rect [120.24 179.26 253.275 193.54] /Type /Annot >> endobj -56 0 obj -<< /Length 7002 +68 0 obj +<< /Length 7288 >> stream q @@ -4935,12 +5239,42 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN -0.8745 Tw +0.4034 Tw BT 48.24 588.406 Td /F1.0 10.5 Tf -[<46> 40.0391 <6f7220696e7374616e636520746865204d4953502057> 60.0586 <6f726b666c6f772054> 29.7852 <61786f6e6f6d7920616c6c6f777320746865207573657220746f20646573637269626520746865207374617465206f6620616e20616e616c797369732c206173>] TJ +[<46> 40.0391 <6f7220696e7374616e636520746865204d4953502057> 60.0586 <6f726b666c6f7720>] TJ +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +0.4034 Tw + +BT +214.0558 588.406 Td +/F1.0 10.5 Tf +[<5b54> 29.7852 <61786f6e6f6d795d>] TJ +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +0.4034 Tw + +BT +274.4015 588.406 Td +/F1.0 10.5 Tf +<20616c6c6f777320746865207573657220746f20646573637269626520746865207374617465206f6620616e20616e616c797369732c206173> Tj ET @@ -5272,7 +5606,7 @@ Q endstream endobj -57 0 obj +69 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -5280,23 +5614,31 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 56 0 R +/Contents 68 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F2.0 17 0 R -/F3.1 23 0 R +/F3.1 24 0 R /F1.0 8 0 R -/F4.0 40 0 R +/F4.0 46 0 R >> -/XObject << /Stamp2 121 0 R +/XObject << /Stamp2 156 0 R >> >> -/Annots [59 0 R] +/Annots [71 0 R 72 0 R] >> endobj -58 0 obj -[57 0 R /XYZ 0 841.89 null] +70 0 obj +[69 0 R /XYZ 0 841.89 null] endobj -59 0 obj +71 0 obj +<< /Border [0 0 0] +/Dest (Taxonomy) +/Subtype /Link +/Rect [214.0558 585.34 274.4015 599.62] +/Type /Annot +>> +endobj +72 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -5307,8 +5649,8 @@ endobj /Type /Annot >> endobj -60 0 obj -<< /Length 3734 +73 0 obj +<< /Length 4108 >> stream q @@ -5402,70 +5744,10 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN -1.8192 Tw - BT 48.24 675.526 Td /F1.0 10.5 Tf -[<54686520666972737420746f6f6c2077652063616e2075736520746f20636c61737369667920696e666f726d6174696f6e20617265207461677320616e64207461786f6e6f6d696573202e2054> 29.7852 <6167732063616e206265207573656420746f>] TJ -ET - - -0.0 Tw -0.0 0.0 0.0 SCN -0.0 0.0 0.0 scn -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN - -1.8867 Tw - -BT -48.24 659.746 Td -/F1.0 10.5 Tf -[<646573637269626520686f772074686520696e666f726d6174696f6e2063616e206265207368617265642c207573696e672074686520746c7020285472> 20.0195 <6166666963204c696768742050726f746f636f6c29207461786f6e6f6d79> 89.8438 <2c20696e>] TJ -ET - - -0.0 Tw -0.0 0.0 0.0 SCN -0.0 0.0 0.0 scn -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN - -3.9002 Tw - -BT -48.24 643.966 Td -/F1.0 10.5 Tf -<6f7264657220746f2070726576656e7420696e666f726d6174696f6e206c65616b732e202e20546865792063616e20616c736f206265207573656420746f2064657363726962652074686520736f75726365207768657265> Tj -ET - - -0.0 Tw -0.0 0.0 0.0 SCN -0.0 0.0 0.0 scn -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN - -4.2448 Tw - -BT -48.24 628.186 Td -/F1.0 10.5 Tf -[<696e666f726d6174696f6e2063616d652066726f6d2e202e204d616e> 20.0195 <79207461786f6e6f6d69657320616c6c6f7720746865207573657220746f2066757274686572206578706c61696e20746865206b696e64206f66>] TJ -ET - - -0.0 Tw -0.0 0.0 0.0 SCN -0.0 0.0 0.0 scn -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN - -BT -48.24 612.406 Td -/F1.0 10.5 Tf -[<7468726561742e5b54> 20.0195 <4f444f3a20776173207468617420746865206d65616e696e673f5d202d2d6d617070696e672d2d>] TJ +<54686520666972737420746f6f6c2077652063616e2075736520746f20636c61737369667920696e666f726d6174696f6e20617265207461677320616e64207461786f6e6f6d696573> Tj ET 0.0 0.0 0.0 SCN @@ -5476,7 +5758,137 @@ ET 0.2 0.2 0.2 SCN BT -56.8805 584.626 Td +52.6765 647.746 Td +/F1.0 10.5 Tf +<312e> Tj +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn + +0.0 Tc +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +1.5555 Tw + +BT +66.24 647.746 Td +/F1.0 10.5 Tf +[<54> 29.7852 <6167732063616e206265207573656420746f20646573637269626520686f772074686520696e666f726d6174696f6e2063616e206265207368617265642c207573696e672074686520746c7020285472> 20.0195 <6166666963204c69676874>] TJ +ET + + +0.0 Tw +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +BT +66.24 631.966 Td +/F1.0 10.5 Tf +[<50726f746f636f6c29207461786f6e6f6d79> 89.8438 <2c20696e206f7264657220746f2070726576656e7420696e666f726d6174696f6e206c65616b732e>] TJ +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn + +-0.5 Tc +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +BT +52.6765 610.186 Td +/F1.0 10.5 Tf +<322e> Tj +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn + +0.0 Tc +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +BT +66.24 610.186 Td +/F1.0 10.5 Tf +<546865792063616e20616c736f206265207573656420746f2064657363726962652074686520736f7572636520776865726520696e666f726d6174696f6e2063616d652066726f6d2e> Tj +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn + +-0.5 Tc +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +BT +52.6765 588.406 Td +/F1.0 10.5 Tf +<332e> Tj +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn + +0.0 Tc +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +BT +66.24 588.406 Td +/F1.0 10.5 Tf +[<4d616e> 20.0195 <79207461786f6e6f6d69657320616c6c6f7720746865207573657220746f2066757274686572206578706c61696e20746865206b696e64206f66207468726561742e>] TJ +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn + +-0.5 Tc +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +BT +56.8805 560.626 Td +/F1.0 10.5 Tf + Tj +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn + +0.0 Tc +0.2588 0.5451 0.7922 scn +0.2588 0.5451 0.7922 SCN + +BT +66.24 560.626 Td +/F1.0 10.5 Tf +<5b4d49535047616c61786965735d> Tj +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +BT +141.8295 560.626 Td +/F1.0 10.5 Tf +[<202841> 60.0586 <545426434b206d617472697829>] TJ +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn + +-0.5 Tc +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + +BT +56.8805 538.846 Td /F1.0 10.5 Tf Tj ET @@ -5489,33 +5901,7 @@ ET 0.2 0.2 0.2 SCN BT -66.24 584.626 Td -/F1.0 10.5 Tf -[<47616c6178696573202841> 60.0586 <545426434b206d617472697829>] TJ -ET - -0.0 0.0 0.0 SCN -0.0 0.0 0.0 scn - --0.5 Tc -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN - -BT -56.8805 562.846 Td -/F1.0 10.5 Tf - Tj -ET - -0.0 0.0 0.0 SCN -0.0 0.0 0.0 scn - -0.0 Tc -0.2 0.2 0.2 scn -0.2 0.2 0.2 SCN - -BT -66.24 562.846 Td +66.24 538.846 Td /F1.0 10.5 Tf <436f6d6d656e7473> Tj ET @@ -5546,7 +5932,7 @@ Q endstream endobj -61 0 obj +74 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -5554,21 +5940,30 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 60 0 R +/Contents 73 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F2.0 17 0 R -/F3.1 23 0 R +/F3.1 24 0 R /F1.0 8 0 R >> -/XObject << /Stamp1 120 0 R +/XObject << /Stamp1 155 0 R >> >> +/Annots [76 0 R] >> endobj -62 0 obj -[61 0 R /XYZ 0 841.89 null] +75 0 obj +[74 0 R /XYZ 0 841.89 null] endobj -63 0 obj +76 0 obj +<< /Border [0 0 0] +/Dest (MISPGalaxies) +/Subtype /Link +/Rect [66.24 557.56 141.8295 571.84] +/Type /Annot +>> +endobj +77 0 obj << /Length 1260 >> stream @@ -5688,7 +6083,7 @@ Q endstream endobj -64 0 obj +78 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -5696,21 +6091,21 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 63 0 R +/Contents 77 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F2.0 17 0 R /F1.0 8 0 R >> -/XObject << /Stamp2 121 0 R +/XObject << /Stamp2 156 0 R >> >> -/Annots [66 0 R 67 0 R 68 0 R] +/Annots [80 0 R 81 0 R 82 0 R] >> endobj -65 0 obj -[64 0 R /XYZ 0 841.89 null] +79 0 obj +[78 0 R /XYZ 0 841.89 null] endobj -66 0 obj +80 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -5721,18 +6116,18 @@ endobj /Type /Annot >> endobj -67 0 obj +81 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI -/URI (https://github.com/igl0cksa) +/URI (https://github.com/iglocska) >> /Subtype /Link /Rect [66.24 728.36 136.6003 742.64] /Type /Annot >> endobj -68 0 obj +82 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -5743,8 +6138,8 @@ endobj /Type /Annot >> endobj -69 0 obj -<< /Length 12219 +83 0 obj +<< /Length 13022 >> stream q @@ -5764,6 +6159,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 753.206 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 753.206 Td /F2.0 10.5 Tf @@ -5906,6 +6310,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 643.526 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 643.526 Td /F2.0 10.5 Tf @@ -5928,6 +6341,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 596.966 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 596.966 Td /F2.0 10.5 Tf @@ -5965,6 +6387,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 534.626 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 534.626 Td /F2.0 10.5 Tf @@ -6013,6 +6444,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 472.286 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 472.286 Td /F2.0 10.5 Tf @@ -6061,10 +6501,19 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 409.946 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 409.946 Td /F2.0 10.5 Tf -<4d495350206e6f746963656c697374> Tj +<4d495350206e6f746963656c69737473> Tj ET 0.0 0.0 0.0 SCN @@ -6109,6 +6558,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 347.606 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 347.606 Td /F2.0 10.5 Tf @@ -6337,6 +6795,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 222.146 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 222.146 Td /F2.0 10.5 Tf @@ -6389,6 +6856,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 144.026 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 144.026 Td /F2.0 10.5 Tf @@ -6496,7 +6972,7 @@ Q endstream endobj -70 0 obj +84 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -6504,22 +6980,34 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 69 0 R +/Contents 83 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F2.0 17 0 R /F1.0 8 0 R -/F1.1 76 0 R +/F1.1 97 0 R >> -/XObject << /Stamp1 120 0 R +/XObject << /Stamp1 155 0 R >> >> -/Annots [72 0 R 73 0 R 74 0 R 75 0 R 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R] +/Annots [90 0 R 92 0 R 94 0 R 96 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R] >> endobj -71 0 obj -[70 0 R /XYZ 0 841.89 null] +85 0 obj +[84 0 R /XYZ 0 841.89 null] endobj -72 0 obj +86 0 obj +[84 0 R /XYZ 48.24 764.42 null] +endobj +87 0 obj +[84 0 R /XYZ 48.24 654.74 null] +endobj +88 0 obj +[84 0 R /XYZ 48.24 608.18 null] +endobj +89 0 obj +[84 0 R /XYZ 48.24 545.84 null] +endobj +90 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -6530,7 +7018,10 @@ endobj /Type /Annot >> endobj -73 0 obj +91 0 obj +[84 0 R /XYZ 48.24 483.5 null] +endobj +92 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -6541,7 +7032,10 @@ endobj /Type /Annot >> endobj -74 0 obj +93 0 obj +[84 0 R /XYZ 48.24 421.16 null] +endobj +94 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -6552,7 +7046,10 @@ endobj /Type /Annot >> endobj -75 0 obj +95 0 obj +[84 0 R /XYZ 48.24 358.82 null] +endobj +96 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -6563,18 +7060,18 @@ endobj /Type /Annot >> endobj -76 0 obj +97 0 obj << /Type /Font /BaseFont /dc7dd2+NotoSerif /Subtype /TrueType -/FontDescriptor 153 0 R +/FontDescriptor 188 0 R /FirstChar 32 /LastChar 255 -/Widths 155 0 R -/ToUnicode 154 0 R +/Widths 190 0 R +/ToUnicode 189 0 R >> endobj -77 0 obj +98 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -6585,7 +7082,7 @@ endobj /Type /Annot >> endobj -78 0 obj +99 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -6596,7 +7093,7 @@ endobj /Type /Annot >> endobj -79 0 obj +100 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -6607,7 +7104,7 @@ endobj /Type /Annot >> endobj -80 0 obj +101 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -6618,7 +7115,7 @@ endobj /Type /Annot >> endobj -81 0 obj +102 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -6629,8 +7126,14 @@ endobj /Type /Annot >> endobj -82 0 obj -<< /Length 13395 +103 0 obj +[84 0 R /XYZ 48.24 233.36 null] +endobj +104 0 obj +[84 0 R /XYZ 48.24 155.24 null] +endobj +105 0 obj +<< /Length 14120 >> stream q @@ -6698,6 +7201,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 751.116 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 751.116 Td /F2.0 10.5 Tf @@ -6910,6 +7422,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 594.096 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 594.096 Td /F2.0 10.5 Tf @@ -7066,6 +7587,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 484.416 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 484.416 Td /F2.0 10.5 Tf @@ -7148,6 +7678,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 422.076 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 422.076 Td /F2.0 10.5 Tf @@ -7200,6 +7739,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 343.956 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 343.956 Td /F2.0 10.5 Tf @@ -7252,6 +7800,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 265.836 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 265.836 Td /F2.0 10.5 Tf @@ -7289,6 +7846,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 203.496 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 203.496 Td /F2.0 10.5 Tf @@ -7311,10 +7877,19 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 156.936 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 156.936 Td /F2.0 10.5 Tf -<536974652061646d696e> Tj +[<536974652041> 20.0195 <646d696e>] TJ ET 0.0 0.0 0.0 SCN @@ -7429,7 +8004,7 @@ Q endstream endobj -83 0 obj +106 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -7437,18 +8012,18 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 82 0 R +/Contents 105 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F1.0 8 0 R /F2.0 17 0 R >> -/XObject << /Stamp2 121 0 R +/XObject << /Stamp2 156 0 R >> >> -/Annots [84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R] +/Annots [107 0 R 108 0 R 112 0 R 113 0 R 114 0 R 115 0 R 117 0 R 118 0 R 119 0 R 121 0 R 122 0 R] >> endobj -84 0 obj +107 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7459,7 +8034,7 @@ endobj /Type /Annot >> endobj -85 0 obj +108 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7470,7 +8045,20 @@ endobj /Type /Annot >> endobj -86 0 obj +109 0 obj +[106 0 R /XYZ 48.24 762.33 null] +endobj +110 0 obj +<< /Limits [(API) (MISPwarninglists)] +/Names [(API) 109 0 R (Attribute) 125 0 R (IDS) 123 0 R (IOC) 124 0 R (ISAC) 87 0 R (MISP) 88 0 R (MISPGlossary) 86 0 R (MISPModules) 89 0 R (MISPObjects) 104 0 R (MISPSightings) 103 0 R (MISPTaxonomies) 95 0 R (MISPnoticelists) 93 0 R (MISPwarninglists) 91 0 R] +>> +endobj +111 0 obj +<< /Limits [(OSINT) (_what_to_share_or_what_counts_as_valuable_information)] +/Names [(OSINT) 131 0 R (Observable) 126 0 R (OrgAdmin) 130 0 R (PyMISP) 120 0 R (RESTful) 116 0 R (SiteAdmin) 127 0 R (__anchor-top) 13 0 R (_authors_and_contributors) 79 0 R (_best_practices) 22 0 R (_expressing_confidenceestimative_probability_in_an_analysis) 59 0 R (_glossary) 85 0 R (_how_to_classify_information) 75 0 R (_how_to_track_and_keep_the_state_of_an_analysis) 70 0 R (_improving_analysis) 23 0 R (_intelligence_tagging) 39 0 R (_introduction) 16 0 R (_what_to_share_or_what_counts_as_valuable_information) 33 0 R] +>> +endobj +112 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7481,7 +8069,7 @@ endobj /Type /Annot >> endobj -87 0 obj +113 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7492,7 +8080,7 @@ endobj /Type /Annot >> endobj -88 0 obj +114 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7503,7 +8091,7 @@ endobj /Type /Annot >> endobj -89 0 obj +115 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7514,7 +8102,10 @@ endobj /Type /Annot >> endobj -90 0 obj +116 0 obj +[106 0 R /XYZ 48.24 605.31 null] +endobj +117 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7525,7 +8116,7 @@ endobj /Type /Annot >> endobj -91 0 obj +118 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7536,7 +8127,7 @@ endobj /Type /Annot >> endobj -92 0 obj +119 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7547,7 +8138,10 @@ endobj /Type /Annot >> endobj -93 0 obj +120 0 obj +[106 0 R /XYZ 48.24 495.63 null] +endobj +121 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7558,7 +8152,7 @@ endobj /Type /Annot >> endobj -94 0 obj +122 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7569,8 +8163,23 @@ endobj /Type /Annot >> endobj -95 0 obj -<< /Length 4122 +123 0 obj +[106 0 R /XYZ 48.24 433.29 null] +endobj +124 0 obj +[106 0 R /XYZ 48.24 355.17 null] +endobj +125 0 obj +[106 0 R /XYZ 48.24 277.05 null] +endobj +126 0 obj +[106 0 R /XYZ 48.24 214.71 null] +endobj +127 0 obj +[106 0 R /XYZ 48.24 168.15 null] +endobj +128 0 obj +<< /Length 4300 >> stream q @@ -7579,6 +8188,15 @@ q /DeviceRGB CS 0.2 0.2 0.2 SCN +BT +48.24 793.926 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 793.926 Td /F2.0 10.5 Tf @@ -7631,6 +8249,15 @@ ET 0.2 0.2 0.2 scn 0.2 0.2 0.2 SCN +BT +48.24 715.806 Td +ET + +0.0 0.0 0.0 SCN +0.0 0.0 0.0 scn +0.2 0.2 0.2 scn +0.2 0.2 0.2 SCN + BT 48.24 715.806 Td /F2.0 10.5 Tf @@ -7823,7 +8450,7 @@ Q endstream endobj -96 0 obj +129 0 obj << /Type /Page /Parent 3 0 R /MediaBox [0 0 595.28 841.89] @@ -7831,18 +8458,24 @@ endobj /BleedBox [0 0 595.28 841.89] /TrimBox [0 0 595.28 841.89] /ArtBox [0 0 595.28 841.89] -/Contents 95 0 R +/Contents 128 0 R /Resources << /ProcSet [/PDF /Text /ImageB /ImageC /ImageI] /Font << /F2.0 17 0 R /F1.0 8 0 R >> -/XObject << /Stamp1 120 0 R +/XObject << /Stamp1 155 0 R >> >> -/Annots [97 0 R 98 0 R 99 0 R] +/Annots [132 0 R 133 0 R 134 0 R] >> endobj -97 0 obj +130 0 obj +[129 0 R /XYZ 48.24 805.14 null] +endobj +131 0 obj +[129 0 R /XYZ 48.24 727.02 null] +endobj +132 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7853,7 +8486,7 @@ endobj /Type /Annot >> endobj -98 0 obj +133 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7864,7 +8497,7 @@ endobj /Type /Annot >> endobj -99 0 obj +134 0 obj << /Border [0 0 0] /A << /Type /Action /S /URI @@ -7875,7 +8508,7 @@ endobj /Type /Annot >> endobj -100 0 obj +135 0 obj << /Border [0 0 0] /Dest (_introduction) /Subtype /Link @@ -7883,7 +8516,7 @@ endobj /Type /Annot >> endobj -101 0 obj +136 0 obj << /Border [0 0 0] /Dest (_introduction) /Subtype /Link @@ -7891,7 +8524,7 @@ endobj /Type /Annot >> endobj -102 0 obj +137 0 obj << /Border [0 0 0] /Dest (_best_practices) /Subtype /Link @@ -7899,7 +8532,7 @@ endobj /Type /Annot >> endobj -103 0 obj +138 0 obj << /Border [0 0 0] /Dest (_best_practices) /Subtype /Link @@ -7907,7 +8540,7 @@ endobj /Type /Annot >> endobj -104 0 obj +139 0 obj << /Border [0 0 0] /Dest (_improving_analysis) /Subtype /Link @@ -7915,7 +8548,7 @@ endobj /Type /Annot >> endobj -105 0 obj +140 0 obj << /Border [0 0 0] /Dest (_improving_analysis) /Subtype /Link @@ -7923,7 +8556,7 @@ endobj /Type /Annot >> endobj -106 0 obj +141 0 obj << /Border [0 0 0] /Dest (_what_to_share_or_what_counts_as_valuable_information) /Subtype /Link @@ -7931,7 +8564,7 @@ endobj /Type /Annot >> endobj -107 0 obj +142 0 obj << /Border [0 0 0] /Dest (_what_to_share_or_what_counts_as_valuable_information) /Subtype /Link @@ -7939,7 +8572,7 @@ endobj /Type /Annot >> endobj -108 0 obj +143 0 obj << /Border [0 0 0] /Dest (_intelligence_tagging) /Subtype /Link @@ -7947,7 +8580,7 @@ endobj /Type /Annot >> endobj -109 0 obj +144 0 obj << /Border [0 0 0] /Dest (_intelligence_tagging) /Subtype /Link @@ -7955,7 +8588,7 @@ endobj /Type /Annot >> endobj -110 0 obj +145 0 obj << /Border [0 0 0] /Dest (_expressing_confidenceestimative_probability_in_an_analysis) /Subtype /Link @@ -7963,7 +8596,7 @@ endobj /Type /Annot >> endobj -111 0 obj +146 0 obj << /Border [0 0 0] /Dest (_expressing_confidenceestimative_probability_in_an_analysis) /Subtype /Link @@ -7971,7 +8604,7 @@ endobj /Type /Annot >> endobj -112 0 obj +147 0 obj << /Border [0 0 0] /Dest (_how_to_track_and_keep_the_state_of_an_analysis) /Subtype /Link @@ -7979,7 +8612,7 @@ endobj /Type /Annot >> endobj -113 0 obj +148 0 obj << /Border [0 0 0] /Dest (_how_to_track_and_keep_the_state_of_an_analysis) /Subtype /Link @@ -7987,7 +8620,7 @@ endobj /Type /Annot >> endobj -114 0 obj +149 0 obj << /Border [0 0 0] /Dest (_how_to_classify_information) /Subtype /Link @@ -7995,7 +8628,7 @@ endobj /Type /Annot >> endobj -115 0 obj +150 0 obj << /Border [0 0 0] /Dest (_how_to_classify_information) /Subtype /Link @@ -8003,7 +8636,7 @@ endobj /Type /Annot >> endobj -116 0 obj +151 0 obj << /Border [0 0 0] /Dest (_authors_and_contributors) /Subtype /Link @@ -8011,7 +8644,7 @@ endobj /Type /Annot >> endobj -117 0 obj +152 0 obj << /Border [0 0 0] /Dest (_authors_and_contributors) /Subtype /Link @@ -8019,7 +8652,7 @@ endobj /Type /Annot >> endobj -118 0 obj +153 0 obj << /Border [0 0 0] /Dest (_glossary) /Subtype /Link @@ -8027,7 +8660,7 @@ endobj /Type /Annot >> endobj -119 0 obj +154 0 obj << /Border [0 0 0] /Dest (_glossary) /Subtype /Link @@ -8035,7 +8668,7 @@ endobj /Type /Annot >> endobj -120 0 obj +155 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 595.28 841.89] @@ -8063,7 +8696,7 @@ Q endstream endobj -121 0 obj +156 0 obj << /Type /XObject /Subtype /Form /BBox [0 0 595.28 841.89] @@ -8091,120 +8724,120 @@ Q endstream endobj -122 0 obj +157 0 obj << /Type /Outlines /Count 12 -/First 123 0 R -/Last 134 0 R +/First 158 0 R +/Last 169 0 R >> endobj -123 0 obj +158 0 obj << /Title -/Parent 122 0 R +/Parent 157 0 R /Count 0 -/Next 124 0 R +/Next 159 0 R /Dest [7 0 R /XYZ 0 841.89 null] >> endobj -124 0 obj +159 0 obj << /Title -/Parent 122 0 R +/Parent 157 0 R /Count 0 -/Next 125 0 R -/Prev 123 0 R +/Next 160 0 R +/Prev 158 0 R /Dest [10 0 R /XYZ 0 841.89 null] >> endobj -125 0 obj +160 0 obj << /Title -/Parent 122 0 R +/Parent 157 0 R /Count 0 -/Next 126 0 R -/Prev 124 0 R +/Next 161 0 R +/Prev 159 0 R /Dest [12 0 R /XYZ 0 841.89 null] >> endobj -126 0 obj +161 0 obj << /Title -/Parent 122 0 R +/Parent 157 0 R /Count 6 -/First 127 0 R -/Last 132 0 R -/Next 133 0 R -/Prev 125 0 R -/Dest [20 0 R /XYZ 0 841.89 null] +/First 162 0 R +/Last 167 0 R +/Next 168 0 R +/Prev 160 0 R +/Dest [21 0 R /XYZ 0 841.89 null] >> endobj -127 0 obj +162 0 obj << /Title -/Parent 126 0 R +/Parent 161 0 R /Count 0 -/Next 128 0 R -/Dest [20 0 R /XYZ 0 765.17 null] +/Next 163 0 R +/Dest [21 0 R /XYZ 0 765.17 null] >> endobj -128 0 obj +163 0 obj << /Title -/Parent 126 0 R +/Parent 161 0 R /Count 0 -/Next 129 0 R -/Prev 127 0 R -/Dest [29 0 R /XYZ 0 841.89 null] +/Next 164 0 R +/Prev 162 0 R +/Dest [32 0 R /XYZ 0 841.89 null] >> endobj -129 0 obj +164 0 obj << /Title -/Parent 126 0 R +/Parent 161 0 R /Count 0 -/Next 130 0 R -/Prev 128 0 R -/Dest [35 0 R /XYZ 0 841.89 null] +/Next 165 0 R +/Prev 163 0 R +/Dest [38 0 R /XYZ 0 841.89 null] >> endobj -130 0 obj +165 0 obj << /Title -/Parent 126 0 R +/Parent 161 0 R /Count 0 -/Next 131 0 R -/Prev 129 0 R -/Dest [49 0 R /XYZ 0 841.89 null] +/Next 166 0 R +/Prev 164 0 R +/Dest [58 0 R /XYZ 0 841.89 null] >> endobj -131 0 obj +166 0 obj << /Title -/Parent 126 0 R +/Parent 161 0 R /Count 0 -/Next 132 0 R -/Prev 130 0 R -/Dest [57 0 R /XYZ 0 841.89 null] +/Next 167 0 R +/Prev 165 0 R +/Dest [69 0 R /XYZ 0 841.89 null] >> endobj -132 0 obj +167 0 obj << /Title -/Parent 126 0 R +/Parent 161 0 R /Count 0 -/Prev 131 0 R -/Dest [61 0 R /XYZ 0 841.89 null] +/Prev 166 0 R +/Dest [74 0 R /XYZ 0 841.89 null] >> endobj -133 0 obj +168 0 obj << /Title -/Parent 122 0 R +/Parent 157 0 R /Count 0 -/Next 134 0 R -/Prev 126 0 R -/Dest [64 0 R /XYZ 0 841.89 null] +/Next 169 0 R +/Prev 161 0 R +/Dest [78 0 R /XYZ 0 841.89 null] >> endobj -134 0 obj +169 0 obj << /Title -/Parent 122 0 R +/Parent 157 0 R /Count 0 -/Prev 133 0 R -/Dest [70 0 R /XYZ 0 841.89 null] +/Prev 168 0 R +/Dest [84 0 R /XYZ 0 841.89 null] >> endobj -135 0 obj +170 0 obj << /Nums [0 << /P (i) >> 1 << /P (ii) >> 2 << /P (1) @@ -8223,7 +8856,7 @@ endobj >>] >> endobj -136 0 obj +171 0 obj << /Length1 13524 /Length 8454 /Filter [/FlateDecode] @@ -8258,10 +8891,10 @@ CFC~rS BЋT"M endstream endobj -137 0 obj +172 0 obj << /Type /FontDescriptor /FontName /867d2b+NotoSerif -/FontFile2 136 0 R +/FontFile2 171 0 R /FontBBox [-212 -250 1246 1047] /Flags 6 /StemV 0 @@ -8272,7 +8905,7 @@ endobj /XHeight 1098 >> endobj -138 0 obj +173 0 obj << /Length 1286 /Filter [/FlateDecode] >> @@ -8282,10 +8915,10 @@ x JJ특xxx+!ÊwBxbx+ށr;2kΜJYeY7+|x oS7+[ƛețךyޢoV浖 -㭌"RW*4XqC^J[(^1»y]k}YM-x Vz[YEVY_}/7*Y%eӫq+:.7JE/3Y(Y*AW RVJS:(u@cD]a*f)9J)o,#\Z>MU\jPS {HSMj{fkyGm[z*Esa>&ӫj%u; 2^W[®v[2쯲u[P:V̡Յ> MBi2 .Ħԇ!dk`=o qWޕwdJF(L164U)x0E~Z?=/ί~:o?$O endstream endobj -139 0 obj +174 0 obj [259 1000 408 1000 1000 1000 742 220 346 346 1000 1000 250 310 250 288 559 559 559 559 559 559 559 559 559 559 286 1000 1000 559 1000 500 1000 705 653 613 727 623 589 713 792 367 356 700 623 937 763 742 604 1000 655 543 612 716 674 1046 1000 625 1000 359 1000 359 1000 458 1000 562 613 492 613 535 369 538 634 319 299 584 310 944 645 577 613 613 471 451 352 634 579 861 578 564 511 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 361 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 857 259 1000 1000 1000 1000 1000 1000 1000 450 1000 1000 250 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 450 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000] endobj -140 0 obj +175 0 obj << /Length1 9892 /Length 6464 /Filter [/FlateDecode] @@ -8308,10 +8941,10 @@ i@ (#[Wb).LO[$`Vf3DC"6`8w&fK+s4T[ٙ0sSx(> c+wi)YtbV]isS̔EPl'7\-)3uX,+ß7"xdaFȴIiV8@Lef`Rz)&ֶgYQo,E˳SӳKKiq Me`3BYJ& M h~L--UcmUm,H:<_ q O\lcC6sp̦mcOs{lX֋KӉMamv :Ǣzi*)}BN4pŴ=aN=ȋg*ّ#g1"%&E{G[csWAqF2ڀZ͔pF]a˲hw<6u;gȯc"4o=u/ endstream endobj -141 0 obj +176 0 obj << /Type /FontDescriptor /FontName /475c60+NotoSerif-Bold -/FontFile2 140 0 R +/FontFile2 175 0 R /FontBBox [-212 -250 1306 1058] /Flags 6 /StemV 0 @@ -8322,7 +8955,7 @@ endobj /XHeight 1098 >> endobj -142 0 obj +177 0 obj << /Length 1286 /Filter [/FlateDecode] >> @@ -8332,10 +8965,10 @@ x JJ특xxx+!ÊwBxbx+ށr;2kΜJYeY7+|x oS7+[ƛețךyޢoV浖 -㭌"RW*4XqC^J[(^1»y]k}YM-x Vz[YEVY_}/7*Y%eӫq+:.7JE/3Y(Y*AW RVJS:(u@cD]a*f)9J)o,#\Z>MU\jPS {HSMj{fkyGm[z*Esa>&ӫj%u; 2^W[®v[2쯲u[P:V̡Յ> MBi2 .Ħԇ!dk`=o qWޕwdJF(L164U)x0E~Z?=/ί~:o?$O endstream endobj -143 0 obj +178 0 obj [259 1000 507 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 310 1000 288 1000 559 559 559 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 549 1000 752 671 667 767 652 621 769 818 400 1000 1000 653 952 788 787 638 1000 707 585 652 1000 698 1066 1000 1000 1000 1000 1000 1000 1000 1000 1000 599 648 526 648 570 407 560 666 352 345 636 352 985 666 612 645 1000 522 487 404 666 605 855 645 579 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000] endobj -144 0 obj +179 0 obj << /Length1 2128 /Length 1128 /Filter [/FlateDecode] @@ -8347,10 +8980,10 @@ ix pXkK ECU7{dd+[WjV7SP5l f}(9Gb"57EZ<֎$+?J.,5O>zqu~z]*䐳7P-8 endstream endobj -145 0 obj +180 0 obj << /Type /FontDescriptor /FontName /e8ffbc+FontAwesome -/FontFile2 144 0 R +/FontFile2 179 0 R /FontBBox [0 -142 1286 857] /Flags 4 /StemV 0 @@ -8361,7 +8994,7 @@ endobj /XHeight 0 >> endobj -146 0 obj +181 0 obj << /Length 232 /Filter [/FlateDecode] >> @@ -8369,37 +9002,32 @@ stream x]P=k0+nL ٥1tЦ#%qBx<<CE3b%\FaѴ`wTYtf\"tLv88Q Y$f8|G.2(`qЛNzAv,>')VʘhqM 0;znə&ѵ,T' {Գ.k[Vj]ZgFEjR|-T\s endstream endobj -147 0 obj +182 0 obj [250 857 571 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500] endobj -148 0 obj -<< /Length1 3880 -/Length 2555 +183 0 obj +<< /Length1 3436 +/Length 2217 /Filter [/FlateDecode] >> stream -xV}lS?:e;vBpyI$8$&u!ljpBGVe[(41R=hUZnCֱUՄ:CSUqv G{9;wB ™x< Zn؁yOQ Pd"jP=>xfkRd\3u4N@]o{{6ꏡ-=9Q_GL'o>x$PFlfSɴf=#lQ&3+(%80~\&JO]I񙱀MyY *EKKJ0VWzCeR/Q<ݴ`.A 9|d'ѧsMC%aQSR[u;OMUwmh+ģ]ιG*ݼC=b5!눥rRknMcRs'n=p<932tH,# -}eЊ.AԾ 9 =ϧ[Ȑ -|u>wzwg}RydHĝ;S^E- }@7 FsLHTbҠNJxȅ;Rׄ"P;bھyVzs7ӹn}c"T@UN"22;bwG6IGk۷]5Ug\X1O$d)k*r:\ڰ]7O$_1:JtVz<PĐ-B!J'UbpV}V[{ȨLNߘ{\{vǜt %r:Z'^`y~`c{[7]^){J;8q}SS2 DYN /d574⧞}]%]ɗ%/}/xQPm˃OG3)\a>1y5.Y}'G{ ;\GFwb.,IWKjLkBܽrbQk_\&VWrȔ=`Q/~,JQTu௯YC ,pߒ#X°Vsil; 6}~ -`;@ Nwӯ(,Nd;" ޭ1ξ=3]aN+`~" !ղJK2J"C\ &2-<%5$eJ .kx~ZP}'ʴk2}`jh*ӔX%[ZD`Kh_Gn.4) 4AVnVp8!d܏rz`1['dVHrtX| -D&095a&L}`w[%TSX1!Mu(v>8G_ےS{&'VkˋXIpwÑ\jOFddkm6n i侩DrQMgk(aiLuD=1QއnnI{~* Iv}¯\xua▂$},%u8z㱋es$ibAIArI<If TԻ?&ؾGǸ푘pM"֥fDHt3Y$yRA#lG"Vhz8/cF3&9*X -ͥCIiXGbtАQQ/sS]ڬ -kl,<‚aI# -RAch6 LM1˵H^c5&D,6 tĴMRaA[ -QaxwZ -@\ -Yԁȏ$SpOR(\bpSfU͢p]. -`$X4zĬ(d{bmoaEҰcaZF /ȲE}^&lkIdY$mWt{4Μ_{t;"3noL&ëԹ|]%ﲮ6H>\Nܑ}/^g'|'H:M\<&M\YRZCD 2sO<9-uǦX9Lu؍TN,u-U]Fp6֩__gppso6[6Q?$R0T^ԵVdXڧp{_Zp4C} B >>vxӑ1D +AEɛjfh5?27ԽϳHtp ׃|cEMɼӢۯ朗EneS`t9Zl7#݉Dvn7wݝW)Tg!t*Cn>X9іgڽML!;+Lϣp"p~^m:B +kgnaq- Wht#IYVKG!gh=&V̽ Qӫ$:Qkxѝ.g+ބ +"Sp&p}4x B 1IӀpXJd['ˑHg|JsEYA9,reY,WB9r%`,/2t؆ݲ\U8&%`yY,׀ +dJDk%z_ZPS?:ZCYhg6}jD*;[Zyo(82̇C=#S0'`R&.D fU9HZaLZ-0 3Tl@Eov&㛝H[3. nʢ$W\duR86 +Ih{Ћ7r44%O-fW$mSuf%) ==m> endobj -150 0 obj +185 0 obj << /Length 1286 /Filter [/FlateDecode] >> @@ -8420,10 +9048,10 @@ x JJ특xxx+!ÊwBxbx+ށr;2kΜJYeY7+|x oS7+[ƛețךyޢoV浖 -㭌"RW*4XqC^J[(^1»y]k}YM-x Vz[YEVY_}/7*Y%eӫq+:.7JE/3Y(Y*AW RVJS:(u@cD]a*f)9J)o,#\Z>MU\jPS {HSMj{fkyGm[z*Esa>&ӫj%u; 2^W[®v[2쯲u[P:V̡Յ> MBi2 .Ħԇ!dk`=o qWޕwdJF(L164U)x0E~Z?=/ί~:o?$O endstream endobj -151 0 obj -[500 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 500 1000 1000 1000 1000 1000 1000 1000 1000 1000 500 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 500 1000 1000 1000 1000 500 1000 1000 1000 1000 1000 1000 500 1000 500 1000 1000 1000 500 500 500 500 500 500 1000 1000 500 1000 1000 500 500 500 500 500 1000 500 500 500 500 500 1000 1000 500 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000] +186 0 obj +[1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 500 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 500 1000 500 500 500 500 1000 1000 500 1000 1000 500 500 500 500 500 1000 500 500 500 1000 500 1000 1000 500 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000] endobj -152 0 obj +187 0 obj << /Length1 3744 /Length 2335 /Filter [/FlateDecode] @@ -8441,10 +9069,10 @@ N %9U_ߨ endstream endobj -153 0 obj +188 0 obj << /Type /FontDescriptor /FontName /dc7dd2+NotoSerif -/FontFile2 152 0 R +/FontFile2 187 0 R /FontBBox [-212 -250 1246 1047] /Flags 6 /StemV 0 @@ -8455,7 +9083,7 @@ endobj /XHeight 1098 >> endobj -154 0 obj +189 0 obj << /Length 265 /Filter [/FlateDecode] >> @@ -8464,172 +9092,207 @@ x ̭&0:Ϫ#'(~3L7 %9ݳ 1 $G>`dm rѫoj.HLɻkk QiHʏ)ږ7RXSJ)-X<#b4q# jkG쉢'­6^R*~iHy}A Ux~o endstream endobj -155 0 obj +190 0 obj [259 494 610 470 333 473 579 577 615 577 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000] endobj xref -0 156 +0 191 0000000000 65535 f 0000000015 00000 n 0000000270 00000 n 0000000474 00000 n -0000000630 00000 n -0000000681 00000 n -0000000953 00000 n -0000001384 00000 n -0000001680 00000 n -0000001847 00000 n -0000009287 00000 n -0000009767 00000 n -0000011954 00000 n -0000012313 00000 n -0000012357 00000 n -0000012406 00000 n -0000012848 00000 n -0000012892 00000 n -0000013065 00000 n -0000013238 00000 n -0000025444 00000 n -0000025816 00000 n -0000025860 00000 n -0000025904 00000 n -0000026074 00000 n -0000026286 00000 n -0000029396 00000 n -0000029742 00000 n -0000029917 00000 n -0000037935 00000 n -0000038321 00000 n -0000038365 00000 n -0000038548 00000 n -0000038749 00000 n -0000038964 00000 n -0000052369 00000 n -0000052741 00000 n -0000052785 00000 n -0000052967 00000 n -0000064718 00000 n -0000065145 00000 n -0000065320 00000 n -0000065533 00000 n -0000065705 00000 n -0000065920 00000 n -0000066136 00000 n -0000066350 00000 n -0000066562 00000 n -0000066744 00000 n -0000079244 00000 n -0000079657 00000 n -0000079701 00000 n -0000079907 00000 n -0000080115 00000 n -0000080325 00000 n -0000080516 00000 n -0000080705 00000 n -0000087760 00000 n -0000088145 00000 n -0000088189 00000 n -0000088386 00000 n -0000092173 00000 n -0000092528 00000 n -0000092572 00000 n -0000093885 00000 n -0000094258 00000 n -0000094302 00000 n -0000094469 00000 n -0000094638 00000 n -0000094811 00000 n -0000107084 00000 n -0000107512 00000 n -0000107556 00000 n -0000107735 00000 n -0000107921 00000 n -0000108103 00000 n -0000108295 00000 n -0000108463 00000 n -0000108648 00000 n -0000108840 00000 n -0000109032 00000 n -0000109213 00000 n -0000109397 00000 n -0000122846 00000 n -0000123275 00000 n -0000123456 00000 n -0000123640 00000 n -0000123848 00000 n -0000124020 00000 n -0000124227 00000 n -0000124419 00000 n -0000124625 00000 n -0000124831 00000 n -0000125023 00000 n -0000125195 00000 n -0000125367 00000 n -0000129542 00000 n -0000129915 00000 n -0000130111 00000 n -0000130309 00000 n -0000130501 00000 n -0000130626 00000 n -0000130753 00000 n -0000130881 00000 n -0000131010 00000 n -0000131142 00000 n -0000131275 00000 n -0000131441 00000 n -0000131608 00000 n -0000131742 00000 n -0000131877 00000 n -0000132049 00000 n -0000132222 00000 n -0000132382 00000 n -0000132543 00000 n -0000132683 00000 n -0000132825 00000 n -0000132963 00000 n -0000133101 00000 n -0000133222 00000 n -0000133344 00000 n -0000133615 00000 n -0000133886 00000 n -0000133964 00000 n -0000134221 00000 n -0000134413 00000 n -0000134585 00000 n -0000134794 00000 n -0000134976 00000 n -0000135312 00000 n -0000135516 00000 n -0000135876 00000 n -0000136184 00000 n -0000136402 00000 n -0000136622 00000 n -0000136764 00000 n -0000137030 00000 n -0000145576 00000 n -0000145792 00000 n -0000147155 00000 n -0000148214 00000 n -0000154769 00000 n -0000154990 00000 n -0000156353 00000 n -0000157442 00000 n -0000158661 00000 n -0000158870 00000 n -0000159178 00000 n -0000160093 00000 n -0000162739 00000 n -0000162953 00000 n -0000164316 00000 n -0000165430 00000 n -0000167856 00000 n -0000168072 00000 n -0000168413 00000 n +0000000632 00000 n +0000000683 00000 n +0000000955 00000 n +0000001386 00000 n +0000001682 00000 n +0000001849 00000 n +0000009289 00000 n +0000009769 00000 n +0000012239 00000 n +0000012605 00000 n +0000012649 00000 n +0000012698 00000 n +0000012744 00000 n +0000012788 00000 n +0000012961 00000 n +0000013134 00000 n +0000013251 00000 n +0000025737 00000 n +0000026116 00000 n +0000026160 00000 n +0000026204 00000 n +0000026374 00000 n +0000026492 00000 n +0000026704 00000 n +0000030094 00000 n +0000030447 00000 n +0000030622 00000 n +0000030740 00000 n +0000038758 00000 n +0000039144 00000 n +0000039188 00000 n +0000039371 00000 n +0000039572 00000 n +0000039787 00000 n +0000053901 00000 n +0000054294 00000 n +0000054338 00000 n +0000054463 00000 n +0000054587 00000 n +0000054711 00000 n +0000054893 00000 n +0000067364 00000 n +0000067812 00000 n +0000067987 00000 n +0000068115 00000 n +0000068243 00000 n +0000068373 00000 n +0000068586 00000 n +0000068758 00000 n +0000068972 00000 n +0000069187 00000 n +0000069401 00000 n +0000069613 00000 n +0000069795 00000 n +0000081185 00000 n +0000081606 00000 n +0000081650 00000 n +0000081777 00000 n +0000081903 00000 n +0000082109 00000 n +0000082317 00000 n +0000082443 00000 n +0000082652 00000 n +0000082844 00000 n +0000083035 00000 n +0000090376 00000 n +0000090768 00000 n +0000090812 00000 n +0000090935 00000 n +0000091132 00000 n +0000095293 00000 n +0000095665 00000 n +0000095709 00000 n +0000095833 00000 n +0000097146 00000 n +0000097519 00000 n +0000097563 00000 n +0000097730 00000 n +0000097899 00000 n +0000098072 00000 n +0000111148 00000 n +0000111579 00000 n +0000111623 00000 n +0000111671 00000 n +0000111719 00000 n +0000111767 00000 n +0000111815 00000 n +0000111994 00000 n +0000112041 00000 n +0000112227 00000 n +0000112275 00000 n +0000112457 00000 n +0000112505 00000 n +0000112697 00000 n +0000112865 00000 n +0000113050 00000 n +0000113242 00000 n +0000113435 00000 n +0000113617 00000 n +0000113802 00000 n +0000113851 00000 n +0000113900 00000 n +0000128075 00000 n +0000128517 00000 n +0000128699 00000 n +0000128884 00000 n +0000128934 00000 n +0000129255 00000 n +0000129883 00000 n +0000130092 00000 n +0000130265 00000 n +0000130473 00000 n +0000130666 00000 n +0000130716 00000 n +0000130923 00000 n +0000131130 00000 n +0000131323 00000 n +0000131373 00000 n +0000131546 00000 n +0000131719 00000 n +0000131769 00000 n +0000131819 00000 n +0000131869 00000 n +0000131919 00000 n +0000131969 00000 n +0000136323 00000 n +0000136701 00000 n +0000136751 00000 n +0000136801 00000 n +0000136998 00000 n +0000137197 00000 n +0000137390 00000 n +0000137515 00000 n +0000137642 00000 n +0000137770 00000 n +0000137899 00000 n +0000138031 00000 n +0000138164 00000 n +0000138330 00000 n +0000138497 00000 n +0000138631 00000 n +0000138766 00000 n +0000138938 00000 n +0000139111 00000 n +0000139271 00000 n +0000139432 00000 n +0000139572 00000 n +0000139714 00000 n +0000139852 00000 n +0000139990 00000 n +0000140111 00000 n +0000140233 00000 n +0000140504 00000 n +0000140775 00000 n +0000140853 00000 n +0000141110 00000 n +0000141302 00000 n +0000141474 00000 n +0000141683 00000 n +0000141865 00000 n +0000142201 00000 n +0000142405 00000 n +0000142765 00000 n +0000143073 00000 n +0000143291 00000 n +0000143511 00000 n +0000143653 00000 n +0000143919 00000 n +0000152465 00000 n +0000152681 00000 n +0000154044 00000 n +0000155103 00000 n +0000161658 00000 n +0000161879 00000 n +0000163242 00000 n +0000164331 00000 n +0000165550 00000 n +0000165759 00000 n +0000166067 00000 n +0000166982 00000 n +0000169290 00000 n +0000169504 00000 n +0000170867 00000 n +0000171989 00000 n +0000174415 00000 n +0000174631 00000 n +0000174972 00000 n trailer -<< /Size 156 +<< /Size 191 /Root 2 0 R /Info 1 0 R >> startxref -169542 +176101 %%EOF