From 424a385249e06da2fd51bfd7980704becad723e6 Mon Sep 17 00:00:00 2001 From: Jeroen Pinoy Date: Tue, 30 Mar 2021 23:33:33 +0200 Subject: [PATCH 01/14] chg: [Automation] Add separate attributes/restSearch section. close #249 --- automation/README.md | 284 +++++++++++++++++++++++++++++++++++++------ 1 file changed, 250 insertions(+), 34 deletions(-) diff --git a/automation/README.md b/automation/README.md index 0234ad6..8700782 100644 --- a/automation/README.md +++ b/automation/README.md @@ -139,15 +139,15 @@ Find below a non exhaustive list of parameters that can be used to filter data i - **withAttachments**: If set, encodes the attachments / zipped malware samples as base64 in the data field within each attribute - **metadata**: Only the metadata (event, tags, relations) is returned, attributes and proposals are omitted. - **uuid**: Restrict the results by uuid. -- **publish_timestamp**: Restrict the results by the timestamp of the last publishing of the event. The input can be a timetamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). -- **last**: (Deprecated synonym for publish_timestamp) Restrict the results by the timestamp of the last publishing of the event. The input can be a timetamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). -- **timestamp**: Restrict the results by the timestamp (last edit). Any event with a timestamp newer than the given timestamp will be returned. In case you are dealing with /attributes as scope, the attribute's timestamp will be used for the lookup. The input can be a timetamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **publish_timestamp**: Restrict the results by the timestamp of the last publishing of the event. The input can be a timsetamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **last**: (Deprecated synonym for publish_timestamp) Restrict the results by the timestamp of the last publishing of the event. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **timestamp**: Restrict the results by the timestamp (last edit). Any event with a timestamp newer than the given timestamp will be returned. In case you are dealing with /attributes as scope, the attribute's timestamp will be used for the lookup. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). - **published**: Set whether published or unpublished events should be returned. Do not set the parameter if you want both. - **enforceWarninglist**: Remove any attributes from the result that would cause a hit on a warninglist entry. - **to_ids**: By default (0) all attributes are returned that match the other filter parameters, irregardless of their to_ids setting. To restrict the returned data set to to_ids only attributes set this parameter to 1. You can only use the special "exclude" setting to only return attributes that have the to_ids flag disabled. -- **deleted**: If this parameter is set to 1, it will return soft-deleted attributes along with active ones. By using "only" as a parameter it will limit the returned data set to soft-deleted data only. +- **deleted**: Default value 0. If set to 1, only deleted attributes will be returned. If set to [0,1] , both deleted and non-deleted attributes wil be returned. - **includeEventUuid**: Instead of just including the event ID, also include the event UUID in each of the attributes. -- **event_timestamp**: Only return attributes from events that have received a modification after the given timestamp. The input can be a timetamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **event_timestamp**: Only return attributes from events that have received a modification after the given timestamp. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). - **sgReferenceOnly**: If this flag is set, sharing group objects will not be included, instead only the sharing group ID is set. - **eventinfo**: Filter on the event's info field. - **searchall**: Search for a full or a substring (delimited by % for substrings) in the event info, event tags, attribute tags, attribute values or attribute comment fields. @@ -844,6 +844,251 @@ https:///attributes/describeTypes Depending on the headers passed the returned data will be a JSON object or an XML, with 3 main sections: types, categories, category\_type\_mappings. +### POST /attributes/restSearch + +Do not use this function with GET! + +#### Parameters + +- **returnFormat**: The format to return data in. Allowed formats: + - **attack-sightings**: Returns ATTA&CK Sightings in json format for + attributes with mitre-attack-pattern galaxies attached. For further details on the ATT&CK Sightings, please visit the related [MITRE website page](https://attack.mitre.org/resources/sightings/). + - **cache**: Hashes the attributes and returns them as txt. A hashing algorithm can be chosen by also adding the hash_type parameter. Supported hashing algorithms can be found on the [PHP website](https://www.php.net/manual/en/function.hash-algos.php]). + - **count**: Returns the attribute count as txt. + - **csv** + - **hashes**: Returns hash attributes in txt format. For composite attributes, only the hash part is returned. + - **json** + - **netfilter**: Returns netfilter rules for IPs. Action can be set with the netfilter_action parameter. The default action is DROP. + - **opendata**: Please refer to the related MISP project [blog post](https://www.misp-project.org/2020/07/30/publishing-open-data-using-MISP.html). + - **openioc** + - **rpz** + - **snort** + - **suricata** + - **text**: Returns only the attribute values in text format. + - **xml** + - **yara**: + - **yara-json** +- **value**: Search for the given value in the attributes' value field. +- **type**: The attribute type, any valid MISP attribute type is accepted. +- **category**: The attribute category, any valid MISP attribute category is accepted. +- **org**: Search by the creator organisation by supplying the organisation identifier. +- **tags**: Include or exclude attributes with certain tags. See example below. It is strongly recommended to specifically exclude the tags you want to avoid, even if the tags should be exclusive, for example tlp:red and tlp:green. +~~~~json +{ + "returnFormat": "json", + "tags": { + "NOT": [ + "tlp:red" + ], + "OR": [ + "tlp:green" + ] + } +} +~~~~ +- **from**: Will return attributes from events with the date set to a date after the one specified in the from field (format: 2015-02-15). +- **to**: Will return attributes with the date set to a date before the one specified in the to field (format: 2015-02-15). +- **last**: ***Deprecated!!!*** (synonym for publish_timestamp) Restrict the results by the timestamp of the last publication of the event. Any attribute with a last publication timestamp newer than the given timestamp will be returned. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **eventid**: The events that should be included / excluded from the search. +- **withAttachments**: If set, encodes the attachments / zipped malware samples as base64 in the data field within each attribute +- **uuid**: Restrict the results by uuid. +- **publish_timestamp**: Restrict the results by the timestamp of the last publication of the event. Any attribute with a last publication timestamp newer than the given timestamp will be returned. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **published**: Set whether published or unpublished events should be returned. Do not set the parameter if you want both. +- **timestamp**: ***Deprecated!!!*** (synonym for attribute_timestamp) Restrict the results by the timestamp (last edit). Any attribute with a timestamp newer than the given timestamp will be returned. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **enforceWarninglist**: Remove any attributes from the result that would cause a hit on a warninglist entry. +- **to_ids**: By default (0) all attributes are returned that match the other filter parameters, irregardless of their to_ids setting. To restrict the returned data set to to_ids only attributes set this parameter to 1. You can only use the special "exclude" setting to only return attributes that have the to_ids flag disabled. +- **deleted**: Default value 0. If set to 1, only deleted attributes will be returned. If set to [0,1] , both deleted and non-deleted attributes wil be returned. +- **includeEventUuid**: Instead of just including the event ID, also include the event UUID in each of the attributes. +- **event_timestamp**: Only return attributes from events that have received a modification after the given timestamp. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **threat_level_id**: Only return attributes of events with the given threat level id(s). 1 = High, 2 = Medium, 3=Low, 4 = Undefined. See example below. +``` +{ + "returnFormat": "json", + "threat_level_id": [1,2] +} +``` +- **includeEventTags**: If set to 1, the event tags of the event the attribute belongs to will be added to the attribute. +- **limit**: Limit the number of results returned, for example 10 attributes. +- **page**: If a limit is set, sets the page to be returned. page 3, limit 100 will return records 201->300). +- **requested_attributes**: Only for CSV export. Choose the fields you want in the csv output. Available fields are (*non-exhaustive list, more fields can be available depending on the values of other parameters*): + - uuid + - event_id + - category + - type + - value + - comment + - to_ids + - date + - object_relation + - attribute_tag + - object_uuid + - object_name + - object_meta_category + - event_info. Only available if includeContext parameter is set to 1. + - event_member_org. Only available if includeContext parameter is set to 1. + - event_source_org. Only available if includeContext parameter is set to 1. + - event_distribution. Only available if includeContext parameter is set to 1. + - event_threat_level_id. Only available if includeContext parameter is set to 1. + - event_analysis. Only available if includeContext parameter is set to 1. + - event_date. Only available if includeContext parameter is set to 1. + - event_tag. Only available if includeContext parameter is set to 1. + - event_timestamp. Only available if includeContext parameter is set to 1. +- **includeContext**: Adds extra event level context to the output. For each attribute more details are added to the Event object in the output. Please note that this significantly bloats the output data. Example below. +``` +"Event": { + "id": "31", + "orgc_id": "1", + "org_id": "1", + "date": "2021-03-11", + "threat_level_id": "1", + "info": "Correlation 2", + "published": true, + "uuid": "0bfe7bf3-f793-4761-8450-8b30ca9d9964", + "analysis": "0", + "timestamp": "1616972381", + "distribution": "1", + "publish_timestamp": "1616972392", + "sharing_group_id": "0", + "extends_uuid": "", + "Tag": [], + "Orgc": { + "id": "1", + "name": "SHARINGORG", + "uuid": "26867ddf-5a9b-4af0-b552-e4020a913b95", + "local": true + } + } +``` +- **headerless**: Only for CSV export. The CSV created when this setting is set to true will not contain the header row. +- **includeWarninglistHits**: Adds a warnings block to an attribute if it has warninglist hits. See example below. +``` +"warnings": [ + { + "match": "10.0.0.0/8", + "value": "10.0.0.1", + "warninglist_name": "List of RFC 5735 CIDR blocks", + "warninglist_id": "46" + }, + { + "match": "10.0.0.0/8", + "value": "10.0.0.1", + "warninglist_name": "List of RFC 1918 CIDR blocks", + "warninglist_id": "44" + } + ] +``` +- **object_relation**: Search on the object_relation field of attributes. You can search for 'malware-sample' attributes of file objects for example. Searching for multiple values at the same time is possible as well. +``` +{ + "returnFormat": "json", + "object_relation": ["malware-sample", "institution-name"] +} +``` +- **includeSightings**: Adds a list of sightings for attributes that have sightings. See example below. +``` +"Sighting": [ + { + "id": "1", + "attribute_id": "29", + "event_id": "31", + "org_id": "1", + "date_sighting": "1617017091", + "uuid": "48d21518-6b2a-4615-8c4e-91fbe4f08fe7", + "source": "", + "type": "0", + "attribute_uuid": "b3c25257-7f47-41af-a29b-89188e583b5c", + "Organisation": { + "id": "1", + "uuid": "26867ddf-5a9b-4af0-b552-e4020a913b95", + "name": "SHARINGORG" + } + } + ] +``` +- **includeCorrelations**: Adds a list of correlated attributes for attributes that have correlations. See example below. +``` +"RelatedAttribute": [ + { + "id": "31", + "event_id": "30", + "object_id": "0", + "object_relation": null, + "category": "Network activity", + "type": "ip-dst", + "uuid": "f3b54c94-89ff-4fcf-9f47-52f70c6540b8", + "timestamp": "1616961683", + "distribution": "5", + "sharing_group_id": "0", + "to_ids": false, + "comment": "", + "value": "10.0.0.1", + "Event": { + "id": "30", + "uuid": "8cca9f2f-9281-49fd-9b30-e16a8dbf6855", + "threat_level_id": "1", + "analysis": "0", + "info": "Correlation 1", + "extends_uuid": "", + "distribution": "1", + "sharing_group_id": "0", + "published": false, + "date": "2021-03-11", + "orgc_id": "1", + "org_id": "1" + } + } + ] +``` +- **includeDecayScore**: If set to 1, decay score information will be included for attributes that are affected by decaying. See example below. Note that includeEventTags will be set to 1 automatically if includeDecayScore is true. +``` +"decay_score": [ + { + "score": 77.40239901751683, + "base_score": 80, + "decayed": false, + "DecayingModel": { + "id": "2", + "name": "NIDS Simple Decaying Model" + } + } + ], +``` +- **decayingModel**: Allows you to set the decaying model(s) to use to calculate the decay score. You can use a model that is not enabled. The value should be set to the id of the model. If this value is not set, a decay score entry will be added for all enabled decaying models that apply to the attribute type. +- **excludeDecayed**: Filter out all expired IOCs. Note that includeDecayScore will be set to 1 automatically if excludeDecayed is true. +- **modelOverrides**: JSON that can be used to modify Model parameters on-the-fly. Example can be found beow. +``` +{ + "type": "ip-src", + "tags": ["tlp:%","phishing:%"], + "includeDecayScore": 1, + "excludeDecayed": 1, + "modelOverrides": { + "threshold": 30 + } + "decayingModel": [84, 12], +} +``` +- **includeFullModel**: If set to 1, includes the full decaying model details instead of just the id and name. +- **score**: Overrides the model threshold value with the one you set. This means attributes for which the decay score calculated for all relevant models is lower than this value, will be considered decayed. +- **attribute_timestamp**: Restrict the results by the timestamp (last edit). Any attribute with a timestamp newer than the given timestamp will be returned. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **first_seen**: Restrict the results by the first_seen timestamp of the attribute. Any attribute with a first_seen timestamp newer than the given timestamp will be returned. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **last_seen**: Restrict the results by the last_seen timestamp of the attribute. Any attribute with a first_seen timestamp newer than the given timestamp will be returned. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). +- **searchall**: Search for a full or a substring (delimited by % for substrings) in the attribute tags, attribute values or attribute comment fields. + +#### Example +~~~~ +curl \ + -d '{"returnFormat":"json","value":"foobar"}' \ + -H "Authorization: YOUR API KEY" \ + -H "Accept: application/json" \ + -H "Content-type: application/json" \ + -X POST https://192.168.0.220/attributes/restSearch +~~~~ + +~~~~json +{"response": {"Attribute": [{"id":"44","event_id":"30","object_id":"0","object_relation":null,"category":"Other","type":"comment","to_ids":false,"uuid":"7a5d856c-048a-4dbd-8e6d-41d1790c5ad0","timestamp":"1617056037","distribution":"5","sharing_group_id":"0","comment":"","deleted":false,"disable_correlation":false,"first_seen":null,"last_seen":null,"value":"foobar","Event":{"org_id":"1","distribution":"1","id":"30","info":"Correlation 1","orgc_id":"1","uuid":"8cca9f2f-9281-49fd-9b30-e16a8dbf6855"}}]}} +~~~~ + ## Objects management ### POST /objects/delete/[object_id]/[hard_delete] #### Description @@ -1564,35 +1809,6 @@ For example, to retrieve all attributes for event #5, including non IDS marked a https:///attributes/text/download/all/null/5/true ~~~~ -## RESTful searches with JSON result - -It is possible to search the database for attributes based on a list of criteria - -To return an event with all of its attributes, relations, shadowAttributes, use the following syntax: - -~~~~ -https:///attributes/restSearch/json/[value]/[type]/[category]/[org]/[tag]/[quickfilter]/[from]/[to]/[last]/[eventid]/[withAttachments]/[metadata]/[uuid] -~~~~ - - If you include "includeEventUuid":1" in the json request, it will give you the event_uuid as a result as well. - -Be careful if you GET the /attributes/restSearch/json/ without an value, it will return all attributes. - -### POST /attributes/restSearch - -Do not use that function with GET! - -#### Example -~~~~ -curl -X POST -k -H 'Accept: application/json' -H 'Authorization: API Key' -H 'Content-Type: application/json' -i 'https://URL/attributes/restSearch' --data '{"value":"foobar"}' -~~~~ - -~~~~json -{ - "response": [] -} -~~~~ - ## RESTful searches with XML result export It is possible to search the database for attributes based on a list of criteria. From e150bb34082433122130466c417264013e632c7a Mon Sep 17 00:00:00 2001 From: "E. Cleopatra" <32180937+PROTechThor@users.noreply.github.com> Date: Fri, 2 Apr 2021 10:16:07 +0100 Subject: [PATCH 02/14] new: [doc] Add a contributing guide --- CONTRIBUTING.md | 60 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 CONTRIBUTING.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..a36a091 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,60 @@ +# Contributing to MISP Book + +Most of MISP documentation pages are stored as plain text files in this dedicated misp-book repository. +The installation guides are held in the [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively. +By cloning and regularly pulling from this repo, users can maintain their own up-to-date offline copy of MISP documentation rather than relying solely on the web. + +## Documentation guidelines + +The documentation is a community effort. Volunteers work hard trying to keep everything accurate and comprehensive. +If you notice a problem or some way it can be improved, please edit the documentation. + +All pull requests against MISP must pass review prior to be merged. This process is designed to ensure that contributed text is accurate and non-malicious. +Once a pull request passes review, the documentation maintainer then verifies that the pull request is mechanically sound (no merge conflicts or broken links). If so, the documentation maintainer then merges the pull request. + +If you have a question about something you read in the documentation, you may ask in to the [Gitter Support channel](https://gitter.im/MISP/Support) or open an issue for it. To report an issue with the documentation, please follow our [standard issue reporting guidelines](). If you see that something in the documentation should be fixed or improved, please [contribute the change](#how-to-contribute) yourself. + +## How to contribute + +Editing the documentation is easy, so if you see that a change should be made, please contribute it! + +A few notes before we get started: + +- Every documentation change will be reviewed before it’s accepted. This allows us to maintain quality control and protect our users. +- If your contribution would take a lot of time, please [file an issue](https://github.com/MISP/misp-book/issues) for it first so that we can make sure we’re on the same page before significant works begins. This ensures you do not spend time and effort on a contribution that we can’t accept. + +Thanks to GitHub’s interface, you can edit MISP's documentation even if you don’t know git at all. All you need to do to contribute is to [fork and clone](https://guides.github.com/activities/forking/) the [misp-book repo](https://github.com/MISP/misp-book/), make your changes, then [submit a pull request](https://help.github.com/articles/using-pull-requests/)). + + +## Organizational guidelines + +- Do not duplicate documentation. Duplicating documentation is almost always a bad idea. There are many reasons for this. The main one is that almost all documentation has to be updated as some point. When similar documentation appears in more than one place, it is very easy for it to get updated in one place but not the others (perhaps because the person updating it doesn’t realize it’s in more than once place). Such traps are often more harmful than if the documentation never existed in the first place. The solution is to link to existing documentation rather than duplicating it. There are some exceptions to this policy (e.g., information that is certain not to change for a very long time), but they are rare. +- We maintain only one set of documentation for MISP. We do not maintain a different set of documentation for each version of MISP. Our single set of MISP documentation is updated on a continual, rolling basis. Our first priority is to document all current, stable releases of MISP. Our second priority is to document the next, upcoming release (if any) that is currently in the beta or release candidate stage. +- Instructions on how install MISP are held in [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively. + +## Style guidelines + +- Familiarize yourself with the terms defined in the [glossary](https://www.circl.lu/doc/misp/GLOSSARY.html). Use these terms consistently and accurately throughout your writing. +- The language in this book is American English. All the screenshots and examples are in English. + +## Markdown conventions + +All the documentation is written in Markdown for maximum accessibility. When making contributions, please try to observe the following style conventions: + +- Use spaces instead of tabs. +- In order to enable offline browsing, always use relative (rather than absolute) links, e.g., misp/automation/ instead of https://www.circl.lu/doc/misp/automation/. Examples of exceptions: + - URLs that appear inside code blocks (e.g., in comments and code snippets) + - Files like README.md and CONTRIBUTING.md +- Insert a newline at, and only at, the end of each sentence. This practice results in one sentence per line, which is most appropriate for source that consists primarily of natural language text. It results in the most useful diffs and facilitates translation into other languages while mostly preserving source readability. +- If appropriate, make numerals in numbered lists match between Markdown source and HTML output. In the event that a user is required to read the Markdown source directly, this will make it easier to follow, e.g., numbered steps in a set of instructions. +- Use Atx-style headings: # h1, ##h 2, ### h3, etc. +- When writing code blocks, use syntax highlighting where possible and use [...] for anything omitted. +([This](https://daringfireball.net/projects/markdown/) is a great source for learning about Markdown.) + +## Git conventions + +Please try to write good commit messages, according to the [instructions in our wiki](https://github.com/MISP/MISP/wiki/CommitMessageBestPractices). + +## Translate MISP Book + +You can help us make MISP Book available in your language. See [MISP and Internationalization (i18n)](https://www.circl.lu/doc/misp/translation/). From 0f80b5288e0e4273632083a1068eb47db44fa968 Mon Sep 17 00:00:00 2001 From: "E. Cleopatra" <32180937+PROTechThor@users.noreply.github.com> Date: Fri, 2 Apr 2021 14:04:04 +0100 Subject: [PATCH 03/14] chg: [doc] Add back ticks --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a36a091..9016a4d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -47,7 +47,7 @@ All the documentation is written in Markdown for maximum accessibility. When mak - Files like README.md and CONTRIBUTING.md - Insert a newline at, and only at, the end of each sentence. This practice results in one sentence per line, which is most appropriate for source that consists primarily of natural language text. It results in the most useful diffs and facilitates translation into other languages while mostly preserving source readability. - If appropriate, make numerals in numbered lists match between Markdown source and HTML output. In the event that a user is required to read the Markdown source directly, this will make it easier to follow, e.g., numbered steps in a set of instructions. -- Use Atx-style headings: # h1, ##h 2, ### h3, etc. +- Use Atx-style headings: `# h1`, `## h2`, `### h3`, etc. - When writing code blocks, use syntax highlighting where possible and use [...] for anything omitted. ([This](https://daringfireball.net/projects/markdown/) is a great source for learning about Markdown.) From f1726681a0fe02beb428d0b002f1c3f6b6829beb Mon Sep 17 00:00:00 2001 From: "E. Cleopatra" <32180937+PROTechThor@users.noreply.github.com> Date: Thu, 8 Apr 2021 05:45:49 +0100 Subject: [PATCH 04/14] Update CONTRIBUTING.md --- CONTRIBUTING.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 9016a4d..1dd854f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,9 +1,12 @@ # Contributing to MISP Book Most of MISP documentation pages are stored as plain text files in this dedicated misp-book repository. +MISP Book is a generic documentation for MISP including usage, API documentation, best practices and specific configuration settings. The installation guides are held in the [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively. By cloning and regularly pulling from this repo, users can maintain their own up-to-date offline copy of MISP documentation rather than relying solely on the web. +MISP book is generated in HTML, PDF, epub and mobi using [Honkit](https://github.com/honkit/honkit), which is a framework to write documentation in Markdown format. The documentation is regularly published on misp-project.org and circl.lu website. + ## Documentation guidelines The documentation is a community effort. Volunteers work hard trying to keep everything accurate and comprehensive. @@ -25,6 +28,13 @@ A few notes before we get started: Thanks to GitHub’s interface, you can edit MISP's documentation even if you don’t know git at all. All you need to do to contribute is to [fork and clone](https://guides.github.com/activities/forking/) the [misp-book repo](https://github.com/MISP/misp-book/), make your changes, then [submit a pull request](https://help.github.com/articles/using-pull-requests/)). +[TravisCI](https://travis-ci.org/MISP) (used for automatic integration) is included in misp-book and the book generation is tested at each commit. +When you make a pull request, verify if your changes affect the result of the tests. If the checks fails, review the output at Travis and make fixes where possible. + +### For native English speakers + +Most of MISP developers are not native English speakers so you're more than welcome to correct or improve our English. For this, you can either submit a pull request or use another way that suits you better to share your improvements with us. + ## Organizational guidelines From db72b9fdd92847fd8b747bbf791b2d95a881df83 Mon Sep 17 00:00:00 2001 From: "E. Cleopatra" <32180937+PROTechThor@users.noreply.github.com> Date: Mon, 12 Apr 2021 07:37:27 +0100 Subject: [PATCH 05/14] chg: [doc] Fix grammatical errors --- CONTRIBUTING.md | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1dd854f..6657291 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,21 +1,21 @@ # Contributing to MISP Book -Most of MISP documentation pages are stored as plain text files in this dedicated misp-book repository. -MISP Book is a generic documentation for MISP including usage, API documentation, best practices and specific configuration settings. +Most of MISP's documentation pages are stored as plain text files in this dedicated misp-book repository. +MISP Book is generic documentation for MISP including usage, API documentation, best practices, and specific configuration settings. The installation guides are held in the [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively. By cloning and regularly pulling from this repo, users can maintain their own up-to-date offline copy of MISP documentation rather than relying solely on the web. -MISP book is generated in HTML, PDF, epub and mobi using [Honkit](https://github.com/honkit/honkit), which is a framework to write documentation in Markdown format. The documentation is regularly published on misp-project.org and circl.lu website. +MISP book is generated in HTML, PDF, epub, and mobi using [Honkit](https://github.com/honkit/honkit), which is a framework to write documentation in Markdown format. The documentation is regularly published on [misp-project.org](https://www.misp-project.org/) and [circl.lu website](https://www.circl.lu/doc/misp/). ## Documentation guidelines The documentation is a community effort. Volunteers work hard trying to keep everything accurate and comprehensive. If you notice a problem or some way it can be improved, please edit the documentation. -All pull requests against MISP must pass review prior to be merged. This process is designed to ensure that contributed text is accurate and non-malicious. +All pull requests against MISP must pass review before being merged. This process is designed to ensure that contributed text is accurate and non-malicious. Once a pull request passes review, the documentation maintainer then verifies that the pull request is mechanically sound (no merge conflicts or broken links). If so, the documentation maintainer then merges the pull request. -If you have a question about something you read in the documentation, you may ask in to the [Gitter Support channel](https://gitter.im/MISP/Support) or open an issue for it. To report an issue with the documentation, please follow our [standard issue reporting guidelines](). If you see that something in the documentation should be fixed or improved, please [contribute the change](#how-to-contribute) yourself. +If you have a question about something you read in the documentation, you may ask into the [Gitter Support channel](https://gitter.im/MISP/Support) or open an issue for it. To report an issue with the documentation, please follow our [standard issue reporting guidelines](). If you see that something in the documentation should be fixed or improved, please [contribute the change](#how-to-contribute) yourself. ## How to contribute @@ -24,23 +24,23 @@ Editing the documentation is easy, so if you see that a change should be made, p A few notes before we get started: - Every documentation change will be reviewed before it’s accepted. This allows us to maintain quality control and protect our users. -- If your contribution would take a lot of time, please [file an issue](https://github.com/MISP/misp-book/issues) for it first so that we can make sure we’re on the same page before significant works begins. This ensures you do not spend time and effort on a contribution that we can’t accept. +- If your contribution would take a lot of time, please [file an issue](https://github.com/MISP/misp-book/issues) for it first so that we can make sure we’re on the same page before significant work begins. This ensures you do not spend time and effort on a contribution that we can’t accept. Thanks to GitHub’s interface, you can edit MISP's documentation even if you don’t know git at all. All you need to do to contribute is to [fork and clone](https://guides.github.com/activities/forking/) the [misp-book repo](https://github.com/MISP/misp-book/), make your changes, then [submit a pull request](https://help.github.com/articles/using-pull-requests/)). [TravisCI](https://travis-ci.org/MISP) (used for automatic integration) is included in misp-book and the book generation is tested at each commit. -When you make a pull request, verify if your changes affect the result of the tests. If the checks fails, review the output at Travis and make fixes where possible. +When you make a pull request, verify if your changes affect the result of the tests. If the checks fail, review the output at Travis and make fixes where possible. ### For native English speakers -Most of MISP developers are not native English speakers so you're more than welcome to correct or improve our English. For this, you can either submit a pull request or use another way that suits you better to share your improvements with us. +Most MISP developers are not native English speakers so you're more than welcome to correct or improve our English. For this, you can either submit a pull request or use another way that suits you better to share your improvements with us. ## Organizational guidelines -- Do not duplicate documentation. Duplicating documentation is almost always a bad idea. There are many reasons for this. The main one is that almost all documentation has to be updated as some point. When similar documentation appears in more than one place, it is very easy for it to get updated in one place but not the others (perhaps because the person updating it doesn’t realize it’s in more than once place). Such traps are often more harmful than if the documentation never existed in the first place. The solution is to link to existing documentation rather than duplicating it. There are some exceptions to this policy (e.g., information that is certain not to change for a very long time), but they are rare. +- Do not duplicate documentation. Duplicating documentation is almost always a bad idea. There are many reasons for this. The main one is that almost all documentation has to be updated at some point. When similar documentation appears in more than one place, it is very easy for it to get updated in one place but not the others (perhaps because the person updating it doesn’t realize it’s in more than one place). Such traps are often more harmful than if the documentation never existed in the first place. The solution is to link to existing documentation rather than duplicating it. There are some exceptions to this policy (e.g., information that is certain not to change for a very long time), but they are rare. - We maintain only one set of documentation for MISP. We do not maintain a different set of documentation for each version of MISP. Our single set of MISP documentation is updated on a continual, rolling basis. Our first priority is to document all current, stable releases of MISP. Our second priority is to document the next, upcoming release (if any) that is currently in the beta or release candidate stage. -- Instructions on how install MISP are held in [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively. +- Instructions on how to install MISP are held in [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively. ## Style guidelines @@ -52,11 +52,11 @@ Most of MISP developers are not native English speakers so you're more than welc All the documentation is written in Markdown for maximum accessibility. When making contributions, please try to observe the following style conventions: - Use spaces instead of tabs. -- In order to enable offline browsing, always use relative (rather than absolute) links, e.g., misp/automation/ instead of https://www.circl.lu/doc/misp/automation/. Examples of exceptions: +- To enable offline browsing, always use relative (rather than absolute) links, e.g., misp/automation/ instead of https://www.circl.lu/doc/misp/automation/. Examples of exceptions: - URLs that appear inside code blocks (e.g., in comments and code snippets) - Files like README.md and CONTRIBUTING.md -- Insert a newline at, and only at, the end of each sentence. This practice results in one sentence per line, which is most appropriate for source that consists primarily of natural language text. It results in the most useful diffs and facilitates translation into other languages while mostly preserving source readability. -- If appropriate, make numerals in numbered lists match between Markdown source and HTML output. In the event that a user is required to read the Markdown source directly, this will make it easier to follow, e.g., numbered steps in a set of instructions. +- Insert a newline at, and only at, the end of each sentence. This practice results in one sentence per line, which is most appropriate for sources that consist primarily of natural language text. It results in the most useful diffs and facilitates translation into other languages while mostly preserving source readability. +- If appropriate, make numerals in numbered lists match between Markdown source and HTML output. If a user is required to read the Markdown source directly, this will make it easier to follow, e.g., numbered steps in a set of instructions. - Use Atx-style headings: `# h1`, `## h2`, `### h3`, etc. - When writing code blocks, use syntax highlighting where possible and use [...] for anything omitted. ([This](https://daringfireball.net/projects/markdown/) is a great source for learning about Markdown.) From 740c8f9f73e2ddf9ca055cb4758527b1b8fe36e3 Mon Sep 17 00:00:00 2001 From: "E. Cleopatra" <32180937+PROTechThor@users.noreply.github.com> Date: Mon, 12 Apr 2021 08:31:03 +0100 Subject: [PATCH 06/14] chg: [doc] Add link to contributing.md, update... copyright year --- README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index a39f67b..6178493 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ and many other contributors especially the ones during the [MISP hackathons](htt ## Contributing -We welcome contributions to the MISP book. If you want to contribute, fork the [misp-book](https://github.com/MISP/misp-book) repository and pull a request with your changes. You can also [open issues](https://github.com/MISP/misp-book/issues) if you find any errors or propose changes. +We welcome contributions to the MISP book. If you want to contribute, see our [contributing guide](/CONTRIBUTING.md)
@@ -40,9 +40,9 @@ The MISP user guide is dual-licensed under [GNU Affero General Public License ve * Copyright \(C\) 2012 Christophe Vandeplas * Copyright \(C\) 2012 Belgian Defence * Copyright \(C\) 2012 NATO / NCIRC -* Copyright \(C\) 2013-2020 Andras Iklody -* Copyright \(C\) 2015-2020 Alexandre Dulaunoy -* Copyright \(C\) 2014-2020 CIRCL - Computer Incident Response Center Luxembourg +* Copyright \(C\) 2013-2021 Andras Iklody +* Copyright \(C\) 2015-2021 Alexandre Dulaunoy +* Copyright \(C\) 2014-2021 CIRCL - Computer Incident Response Center Luxembourg * Copyright \(C\) 2018 Camille Schneider -* Copyright \(C\) 2018-2020 Steve Clement +* Copyright \(C\) 2018-2021 Steve Clement From ebcf0e97d192a941d18c4b33d0e724038e9cd175 Mon Sep 17 00:00:00 2001 From: "E. Cleopatra" <32180937+PROTechThor@users.noreply.github.com> Date: Mon, 12 Apr 2021 08:33:01 +0100 Subject: [PATCH 07/14] chg: [doc] Minor changes --- CONTRIBUTING.md | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6657291..7887bcd 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -5,19 +5,23 @@ MISP Book is generic documentation for MISP including usage, API documentation, The installation guides are held in the [INSTALL](https://github.com/MISP/MISP/tree/2.4/INSTALL) and [download](https://www.misp-project.org/download/) sections of the core and website repositories respectively. By cloning and regularly pulling from this repo, users can maintain their own up-to-date offline copy of MISP documentation rather than relying solely on the web. -MISP book is generated in HTML, PDF, epub, and mobi using [Honkit](https://github.com/honkit/honkit), which is a framework to write documentation in Markdown format. The documentation is regularly published on [misp-project.org](https://www.misp-project.org/) and [circl.lu website](https://www.circl.lu/doc/misp/). +MISP book is generated in HTML, PDF, epub, and mobi using [Honkit](https://github.com/honkit/honkit), which is a framework to write documentation in Markdown format. +The documentation is regularly published on [misp-project.org](https://www.misp-project.org/) and [circl.lu website](https://www.circl.lu/doc/misp/). ## Documentation guidelines The documentation is a community effort. Volunteers work hard trying to keep everything accurate and comprehensive. If you notice a problem or some way it can be improved, please edit the documentation. -All pull requests against MISP must pass review before being merged. This process is designed to ensure that contributed text is accurate and non-malicious. -Once a pull request passes review, the documentation maintainer then verifies that the pull request is mechanically sound (no merge conflicts or broken links). If so, the documentation maintainer then merges the pull request. +All pull requests against MISP must pass review before being merged. +This process is designed to ensure that contributed text is accurate and non-malicious. +Once a pull request passes review, the documentation maintainer then verifies that the pull request is mechanically sound (no merge conflicts or broken links). +If so, the documentation maintainer then merges the pull request. -If you have a question about something you read in the documentation, you may ask into the [Gitter Support channel](https://gitter.im/MISP/Support) or open an issue for it. To report an issue with the documentation, please follow our [standard issue reporting guidelines](). If you see that something in the documentation should be fixed or improved, please [contribute the change](#how-to-contribute) yourself. +If you have a question about something you read in the documentation, you may ask into the [Gitter Support channel](https://gitter.im/MISP/Support) or open an issue for it. +If you see that something in the documentation should be fixed or improved, please [contribute the change](#how-to-make-a-contributution) yourself. -## How to contribute +## How to make a contribution Editing the documentation is easy, so if you see that a change should be made, please contribute it! @@ -26,14 +30,18 @@ A few notes before we get started: - Every documentation change will be reviewed before it’s accepted. This allows us to maintain quality control and protect our users. - If your contribution would take a lot of time, please [file an issue](https://github.com/MISP/misp-book/issues) for it first so that we can make sure we’re on the same page before significant work begins. This ensures you do not spend time and effort on a contribution that we can’t accept. -Thanks to GitHub’s interface, you can edit MISP's documentation even if you don’t know git at all. All you need to do to contribute is to [fork and clone](https://guides.github.com/activities/forking/) the [misp-book repo](https://github.com/MISP/misp-book/), make your changes, then [submit a pull request](https://help.github.com/articles/using-pull-requests/)). +Thanks to GitHub’s interface, you can edit MISP's documentation even if you don’t know git at all. +All you need to do to contribute is to [fork and clone](https://guides.github.com/activities/forking/) the [misp-book repo](https://github.com/MISP/misp-book/), make your changes, then [submit a pull request](https://help.github.com/articles/using-pull-requests/)). +You can also [open issues](https://github.com/MISP/misp-book/issues) if you find any errors or propose changes. [TravisCI](https://travis-ci.org/MISP) (used for automatic integration) is included in misp-book and the book generation is tested at each commit. -When you make a pull request, verify if your changes affect the result of the tests. If the checks fail, review the output at Travis and make fixes where possible. +When you make a pull request, verify if your changes affect the result of the tests. +If the checks fail, review the output at Travis and make fixes where possible. ### For native English speakers -Most MISP developers are not native English speakers so you're more than welcome to correct or improve our English. For this, you can either submit a pull request or use another way that suits you better to share your improvements with us. +Most MISP developers are not native English speakers so you're more than welcome to correct or improve our English. +For this, you can either submit a pull request or use another way that suits you better to share your improvements with us. ## Organizational guidelines From 0b778f1f3ae66453e3ca2e52ab72694f23e704c2 Mon Sep 17 00:00:00 2001 From: Jeroen Pinoy Date: Sat, 24 Apr 2021 14:09:33 +0200 Subject: [PATCH 08/14] chg: [automation] add doc for /events/restSearch order parameter --- automation/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/automation/README.md b/automation/README.md index 8700782..b57022a 100644 --- a/automation/README.md +++ b/automation/README.md @@ -152,6 +152,14 @@ Find below a non exhaustive list of parameters that can be used to filter data i - **eventinfo**: Filter on the event's info field. - **searchall**: Search for a full or a substring (delimited by % for substrings) in the event info, event tags, attribute tags, attribute values or attribute comment fields. - **attackGalaxy**: Select the ATT&CK matrix like galaxy to use when using returnFormat = attack. Defaults to the Mitre ATT&CK library via mitre-attack-pattern. +- **order**: Only available for /events/restSearch. Sorts the results, can be useful in combination with limit. The accepted values to sort on are "Event.[any_field_in_the_events_table] [asc|desc]". You can also sort on multiple columns, see example below. +~~~ +{ + "returnFormat": "json", + "limit": "3", + "order": "Event.attribute_count desc, Event.date desc" +} +~~~ ## Events management From ac0145b1e60a671af83f469e150bf4787b853868 Mon Sep 17 00:00:00 2001 From: Jeroen Pinoy Date: Sat, 1 May 2021 20:37:32 +0200 Subject: [PATCH 09/14] chg: [FAQ] add sudo with user www-data to the command to replace the css theme --- faq/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/faq/README.md b/faq/README.md index bae78a4..df6ba4a 100644 --- a/faq/README.md +++ b/faq/README.md @@ -269,7 +269,7 @@ You can customize this for your own needs. There are also pre-made boostrap them Before making any changes, confirm the version of boostrap currenlty used by running `head -5 /var/www/MISP/app/webroot/css/bootstrap.css`. You can find themes on sites like [Bootswatch](https://bootswatch.com/2/). -To replace the current theme with a theme you found on bootsplash, run: `wget https://bootswatch.com/2/readable/bootstrap.css -O /var/www/MISP/app/webroot/css/bootstrap.css` , replacing the URL as needed. +To replace the current theme with a theme you found on bootsplash, run: `sudo -u www-data wget https://bootswatch.com/2/readable/bootstrap.css -O /var/www/MISP/app/webroot/css/bootstrap.css` , replacing the URL as needed. Some bootswatch themes applied on MISP: * https://i.imgur.com/usONTLk.png From 625442c5691620299e991a63404223f4bda35bad Mon Sep 17 00:00:00 2001 From: Jeroen Pinoy Date: Tue, 4 May 2021 11:23:20 +0200 Subject: [PATCH 10/14] chg: [User stories] Fix typo --- user-stories/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/user-stories/README.md b/user-stories/README.md index 17dad86..f41eb28 100644 --- a/user-stories/README.md +++ b/user-stories/README.md @@ -4,7 +4,7 @@ |-|-| | As a lead threat intelligence analyst, I want to lead a team focused on hunting down threats so that I can prevent attacks against ICT infrastructures and organizations |
  • Monitor what teams are up to in real-time using the Live Dashboard
| | As a threat analyst, I want to research, analyze and reverse engineer malware so that I can know how to counter it |
  • Attach and download files and malware samples from events
  • Search for hashes/IPs/domains/URLs from malware events, or add malware samples hashes to an event
  • Analyse observables and malware collected during an incident (e.g. domain name, IP addresses etc.) by checking whether observables are IoCs or false positives using ‘correlation graph’ and ‘expansion modules’.
  • Enrich malware events by querying data sources external to MISP using modules
  • Perform dynamic malware analysis correlations
  • Submit events with malware samples to analysis tools (e.g VirusTotal, VMRay) for further analysis, and then extend MISP with malware analysis results
| -| As a lead threat intelligence analyst, I want to convert threat data into actionable threat intelligence so that I can improve security posture. |
  • Import data from external sources
  • Add feeds
  • Contextualise events and attributes using tags, taxonomies and galaxies
    • | +| As a lead threat intelligence analyst, I want to convert threat data into actionable threat intelligence so that I can improve security posture. |
    • Import data from external sources
    • Add feeds
    • Contextualise events and attributes using tags, taxonomies and galaxies
    | | As a threat analyst, I want to exchange threat information with third parties so that we can gain shared situational awareness |
    • Setup different models of distribution on MISP instance
    • Sync events and attributes between instances
    • Use filtering functionalities to meet an organisation's sharing policy
    • Share information, pentest information, malware samples, vulnerabilities internally and externally
    • Use feature/achievements widget adding gamification to the information sharing
    | | As a threat analyst, I want to monitor threats and access live data so that I can manage threats before they cause major damage |
    • Import lists of indicators and check if the IOCs are present in feeds.
    • Monitor statistics and sightings using widgets
    • Show live data and stats from one or more MISP instances via the Dashboard
    • Process information in real-time when it's updated, created, or published by instances by integrating with ZMQ
    • Use sightings to notify an instance about activities related to an indicator
    | | As a threat analyst, I want to aggregate and compare indicators from various sources so that I can connect the dots between various threats |
    • Join communities and subscribe to the feeds
    • Add events and assign events to specific feeds
    • Correlate indicators using MISP's automated correlation engine
    • Use the overlap feed analysis available in MISP
    • Link events and attributes using the correlation graph
    • Analyse and gain more information on attributes using modules
    • Link events with malware, threat actors etc using galaxies (e.g ATT&CK)
    | From 4afe72a1afc2b7751bce0f0b8fa74900e9c35493 Mon Sep 17 00:00:00 2001 From: Jeroen Pinoy Date: Sat, 8 May 2021 20:26:25 +0200 Subject: [PATCH 11/14] chg: [warninglists] Restructure chapter, add screenshots. fix #266 --- warninglists/README.md | 47 ++++++++++++++---- .../figures/warninglist-checkValue.png | Bin 0 -> 21224 bytes warninglists/figures/warninglist-warnings.png | Bin 0 -> 91431 bytes 3 files changed, 36 insertions(+), 11 deletions(-) create mode 100644 warninglists/figures/warninglist-checkValue.png create mode 100644 warninglists/figures/warninglist-warnings.png diff --git a/warninglists/README.md b/warninglists/README.md index c71450f..305cb9a 100644 --- a/warninglists/README.md +++ b/warninglists/README.md @@ -1,24 +1,49 @@ + # MISP warninglists MISP warninglists are lists of well-known indicators that can be associated to potential false positives, errors or mistakes. There is a Python module available to work with warninglists in a Pythonic way called [PyMISPWarningLists](https://github.com/MISP/PyMISPWarningLists). [MISP warninglists GitHub Repo](https://github.com/MISP/misp-warninglists) -## MISP warning lists: The dilemma of false-positive +## MISP warning lists introduction: The dilemma of false-positive -- False-positive is a common issue in threat intelligence sharing. +- False-positives are a common issue in threat intelligence sharing. - It’s often a contextual issue: - - false-positive might be different per community of users sharing + - False-positives might be different per community of users sharing information. + - Organizations might have their own view on false-positives. - - organization might have their own view on false-positive. +## Usage +By default MISP will only trigger hits for warninglists if the attribute IDS flag is set. This behaviour can be changed by setting the MISP config parameter MISP.warning_for_all to true. -- Based on the success of the MISP taxonomy model, we build misp-warninglists. They are lists of well-known indicators that can be -associated to potential false positives, errors or mistakes. They are Simple JSON files. +When an attribute matches a warninglist entry, an info/warning box is displayed at the event and attribute level, as can be seen in the screenshot below. +![Screenshot of event with one attribute that has warning list hits](./figures/warninglist-warnings.png) -![MISP warning lists](./figures/MISPwarninglist.png) +Individual warninglists can be enabled or disabled at instance level using the warninglists index page. Examples of default warning lists are known public DNS resolvers, multicast IP addresses, hashes for empty values, rfc1918, TLDs or known google domains. +![Screenshot of the warninglists index page](./figures/MISPwarninglist.png) -The warning lists are integrated in MISP to display an info/warning box at the event and attribute level. This can be enabled at MISP instance level. Default warning lists can be enabled or disabled like known public -resolver, multicast IP addresses, hashes for empty values, rfc1918, TLDs or known google domains. The warning lists can be expanded or added in JSON locally or via -pull requests (https://github.com/MISP/misp-warninglists). Warning lists can be also used for critical or core infrastructure -warning, personally identifiable information... +The warning lists can be expanded or added in JSON locally or via +pull requests (https://github.com/MISP/misp-warninglists). Warning lists can also be used for critical or core infrastructure or personally identifiable information. + +### Warninglists and data export +The enforceWarninglist parameter of MISP restSearch can be used to exclude attributes that have a warninglist hit from the export. For more information on the MISP API, please refer to the [Automation and MISP API chapter](../sharing/). + +### Check individual values for warning list hits +It is also possible to do a lookup for a specific value in the warninglists. This functionality is accessible by using the top menu "Input Filters" > "List Warninglists" and then using the link in the left side menu bar (or by browsing directly to [misp_base_url]/warninglists/checkValue). Only enabled warninglists will be searched. + +![Screenshot of example search in warninglists using check value, for value 192.168.0.1. The result shows two hits, one for RFC 5735 CIDR blocka nd one for RFC 1918 CIDR blocks](./figures/warninglist-checkValue.png) +### Updating warninglists +An update of the warninglists can be triggered via the GUI using the "Update Warninglists" button in the side menu bar when viewing any of the relevant warninglists pages, for example the index page. + +Alternatively, it is also possible to trigger an update using a CLI command. +~~~ +MISP/app/Console/cake Admin updateWarningLists +~~~ + +If you are updating an existing warninglist, make sure you incremented the version number before triggering the update on the MISP. You can also contribute to the existing warninglists by forking [MISP warninglists GitHub Repo](https://github.com/MISP/misp-warninglists), making changes and then creating a pull request. +### Creating a custom warninglist +1. Create a new directory for your warninglist in /var/www/MISP/app/files/warninglists. +2. Add a file called list.json to the newly created directory and add the content you want. You can use any of the existing warning lists in https://github.com/MISP/misp-warninglists as reference. +3. Trigger an update of the warning lists on the instance to load in your new warning list. + +Example use cases are a list of domain names owned by you or your organisation or employee email addresses. \ No newline at end of file diff --git a/warninglists/figures/warninglist-checkValue.png b/warninglists/figures/warninglist-checkValue.png new file mode 100644 index 0000000000000000000000000000000000000000..7a36bd98b3275f5e1f979b3a6ce0a3ef69a93105 GIT binary patch literal 21224 zcmZ^~WmsIn(k@DX;7)=&1b26WySsY`?hXSaxDzzEySuyF;4Z=4eHh@7>~EiQ&vWnn zF+I~gtGcUtdR0xm^{y}_1xaKCJOl^`2xMs~F%<|1NTK)7OK>pnEws}Qiubn<&MJ~3 z5S5bzM}NmGgyn@HAZlU|!Nwoo`|u7@+RhLVD1ColABOCU%^)CDe5J*N)jSN&GLVgs zH8d3wem>FRi79@5(YHI!-57IC)gNgP_f!K@%O-X$iH4!&q9l{1(py}A2U+lBeDuOAvxKa>2HTw zuCFl8ZOerg3a#z5c8u|FV<+lXuy-(1Aj|6iPr5LtFNxS~**sbQy;-c%vwWhVql^FW zZ!%_N!bWiQf8-e30DCfHik6loNJf8k2(~<|-V6CF^jGqZPE!XUBO_x5@t<`?Ll}hq zyJDqb%gnX&)wVcp_g|fmW~YqDQ2(pXiDqRzSg+YZ80O!1ee5ok@MDVNp74wYD#V%` zy<<%JV%kA)jA`vNhy=k>@0c2B2$Z06LkY*v1Ntl_srV_J0)Md+!>D4 z^hBg_&vebf)^ioqReGBov|ZSmbE48bqa8tpMv`XgY-fki$({$V z&q_mT3zYEjMKQfl5-)dc$RF_^$f_Ja-)RnkVK#-}XSc@=LBMI!MWSuMZDh0LnY;DJ zWbwBAu#^SKgjE4~Pa&W2v6pQX{z8F`fOCBDM;86rEAuR}J~tssLE;!z;Jv53=#RW| zj$egfggl0af#@Lo8m=am^*k>V_Vo~vj&&e=kM!I(P{P8a&ttSQ?)rf15}R+63=&&15wEG2IPU7^FuX_$<>TCloN%N?WBeP75jUl&CMlBfv6pJxqnF zv(g|=Vq2N*k-1j}7cGIE1{Ix66k5p3azhnuo3D5jS|n}FJ9*n>GFbK|(inNs_R6HM z@}zdhG+LIKuZA4m%)H0M( zz_OK$@s0o_+EM=PvD-2Alu&z`uDdXUMsWmH#n{_?^2w57cUfOTKOlnA);%Gf$Dt3PT{a1SuAp=NSVRNRwvIsDQrwzY6$(eK{CV$R~AqF;}kTQ(uR zSht6^e-&L>;nS6EeI2Cv2Cu34^`UJ+*kxiSo?|`{2_1{p*Qd{k@#0GYQ(kA3cf@#? zq<5vS?_3WPZ{Nty^z*o62WGlPUyHA=(n*s9hrM3SKp^nQbCI_<)SG?(o+%MMvKqW@L~Oja|f3=C2CjDUf*_zyda|zY58vp?QjIVn1dd~W~*cz z7ORF#nFmgm*)do9J8fZ%uB+xS%h$MUiLa%+7A#&rcD^)a-()z#@iq`<5mGacY1&x_ z4xYgp&D0B0FDD3l){=5NViXFk;r-S{&9R&@1Iy6e00@C33_BDyw`Ky~TI{{s#C=9y zCdZ3)G$?k@C=b!z&>5*4fhb#y*1vcGAAdXx`kz}YZ0CWwkq%vuR`b6^;hD8jfSo|! z`Kf1OEW@F6*JpY3Bou$&nvu`&X^Ou{x}W|WBEo#i2LacD^TZXz-fTDrQPCYOpM*(g z?)PRe#r01VmFfJXD9)p*NpFOnZ)Yz(%?Ry-hhN`bQc%|;DaTUbrjfJqK?xu2cPfSrGv3m9|Z{QMU=p3{Dr`QfC@<^IahBQ zD|VG3p~9IQ=O#ycMm#R3T&nr8I*AS?0W7=RMjSr8x=3d{N0hYd+&xcpPsFw@BuM*K ze-~cZ&3TI#w9c0VprpihV>#E=zJ<6I`PKR~tBYK1-s7zA+!HT4Tlgs1v1n2O`Q)pG zkdt_aJAKjfR||+hr^p6!)~&lYilR}oY zFfj`acZ2Hk8%3msZJB8g)lxDxZ6C2sqVxl6E9>4<;mNUzVdSa2zGaym932Ri)k%M- z%ty#2S9xb}rk2w?r5e0T7I;oG(J2s;3H7XGfgWnt^x1ee^Nq~umVmzqC<~;7txn9` z7wyM%xu}H0XT^C?_T>X`Px>5ltvU-VYN`V)fWkPqZqN}M;I;bHrAdpNTUhDGtsuo3 zCMsyT1lncGWlB@P(i)Y+RBqc|GEoZVpt`evx9o}s#ScGYzo2R<7qu+LimT#y$ZU>pJ{9tvB`eSS!fv@~6gp-_7puH+)kZ>Hz`YMX= zPsSLbAD1!@L-d~#VM#4Vs|r5L-ihiu?Ec`r@FiPYg-H=0-Qt6F1Ki`@o0pw{uBPO8w#kTo0C-*)6JDrL1;n+BCs1=hSWlg2rSs&>q|xPfqjDn_~mw!o8y0-qPYOKcQaY0ein^ zU1v{ry^yg%ez<^DZ0W?-@7^RZ)0p4+N-iO%+a>_Go%_@kF)_UW+#-ko^l3Q9`+m%w zHjF_$W)}jGVz>EJ?lm0H52z=|hrIgUg;LjK;pF(wVe-lIC)y%#+{&zQPitxlRaU4#d&2xzrQL_|u&NL#d?R1ge4d4m5? zHzeZFDkA+lwEUj-osNmIA4S)mVmdxH7xQvnj+QD>a)GCS>X@n;(dbZ@#%_&|2rC`s>jEI7$}zwm0KQ$M^dt=+W{VZ>8s7jK?q-iZ#-pWTJ+s9}is~pg>;PNi*}oiJt^jcWk$k0hH zZlA3u#vA~I(jz~RZd}*F+WXydv>2LBtR7J~QJTi8&d(w;l@I zO@y22T9-BBvnTHwf_G&YtepKDA3H(3MZZaNwr4|hqp_LIj-qNqX9 zgAu-~LBWvQl(RMVZGKu#JYK$X(T{a|U_UrU{RII@bFcjv#KirZuFw1>;!$U61krl# z%Q5qtf5XuFY{zw_%UWO5SFi2ijT+?5dS8fmaU$Z+kfJuLQ7TrJSt(w`hF_Y(%YcA=Ae%n49&*Uv2w!+?^|Sj&-;(@F4}TZgS_>jyV-ks1{YiT3 zdrYL=4!IS>KJk2#S%VW}|9tW6^rgNM%;KTaDB1uw+gvA-Q1D54p|)7RUN=C0wJC=J z1m6l z!dUU!4^iRhMA#s(^0I26FCsK6Q@BDj%(fv>kLgHiafkc5YW2lIu=pbT%&Cr!kWE0` z0l$=4U$N`ujO4f+a=O4GG+e_$#(l}#r}0MSsad2la3PBH7tV6@Ei3OJL+2+M7sH~l zNbojZ0p(0mCDjLg3vaWIQ;A@7fC+XZkIqg&i3Fim%t>ZU_%-$I_rx$llvbf6yS_|% z(rxuN)SOm&?s{DWb_)>eczO}A?6R!@`-hR2)+30{QHbj8{Kf8|<4?U6RjDEdsb<$} zP}{Tp9BkPA-GTzNAnmbLI0jsTA1S1_3c(X|<+G-64~^rzHb|4{CDbFOhDZ{{Gfc3! z{?iwfJXDN5^_S5&U)s)LppUN*^VEnMufpU;Uo9$Y@E^o$HIK%29#t@A;&XP4LNR#w zY^8$zphyGZ*W)XgwofFkReAokw=p>Hk!0_SXRe`)^k9_*eUQ59f`Cx?*qy~}n3x#S z%Kd48LVoS6W!t#h0<4s0*fm%s+$UUm!I_M9i_O=I>}V4|V1Gi%h0=xXbXsCD|EpFy z?cqq-r-FqrSgi6R_|l5E>m99U83cn=nomu<_wm6&KZ`2`DH&AUv2~4BwQ$Lcbfs?;=D=lHFmq& z{fp);54U8kg|9YA;-uI3KVS=$2sgd)5KCSgBO`}Nj79Sf<4n3K?t=Vo-Vt7_9lx!EZ_UoUQCIoG1W<)X-E z`OTwu<*$TE`WDM}H+S~miACE`Biw*6(W%>Wi_q49IcEpC696f9KX<(+M>3D@jzhEX zvrQ8v?y$4fyxVlb0B)iI_oR4kr>rznCE>U|bvm}M0NyuVx^S6;hvUVr6!&ilMca=; zELkfN)oboyC3zGsVa3o)zDg7VrzbeMg3uDg zYCN9S{^wQoKsvI{n?Ru8aO#_N-*sNP%vQaGETaN;ID$1f6>~#a>7ew24$8Ru7_esvL1iF1Efw z6i|q%PaZ+m=brGXG(J;X*5Kn)H6ClRc6#&qZO%;65nmv*v~dY4Oahcw7!c>3TRxq2h21y)Kos$}W*IAnb)EB;5RaM($HLg{O30?E4;O<}1=Atia z-wBrjN-D*P=cv#HGD;1@re4D9$%KsgXNvD_h}4OO<_#Opr^WAugTG7;$Kndz3d{Wl zLFgpgxZVk?4Q1XL=>YUTs`+FAmYF<6?S^~0Uh5^I?_ST{yZV^65o`7pO_DmS*!DX$ zVjL`Mrc0hr$Xeru-b6};Obv}G%79=*pJy84gp98lex~T(218aN&eS@A2UJymcDzZy#3eE5R=bhKeYha$k7aNz%;8h2)l%t0`aHQ4r<3$wsaoC~mQYlAbVA6EdrBU~ zo5*W3&0v?jsy}hnB0wj(F=b*zwT@{&Fh;w~F9IJ06Jol^It0gL)ee#moeKzq7}?H9 zIz9?Nl!CnKF$oeBr?=lOw4fFsB6KR$6c{(4KJ1S3PY{cCNwOnb#N#OE6{5v^Qmw zO|25@2Ic_sG`P7ZLYpLMJ9>Jt)h&~^o;l^RXQY{jKJ+EYbw984L6qb4RfN9qN+>9c z@APE!4|<70EaeLb=mMf~49C}U#9)zK`&hwbgNqoGW((2=b60>L7d09mR@i+BYEcZ$ z1vcyJe3hRyAItIE#%!y>N2(deUm#4Dgd(N03F-(Jb8Wqs(B{86;u(1iHn#1(@cz|Z z2RSY0Y6U9Zr^<(hdW%Jt^=CRwp~_YG7xbgFD{WJ9Z17U}_z&9;zJeWx2SVnAmRD!JXeHs1k{#z1AUJpK(xiVE3>oxzk$iFr0ivc{R>Pmk= zPo95E0mdo8as`GS|1tKj#kRxmsD3(+v&8>K^_Q;u{*@oz8&D!0gV58{)BkS)B2Mt% zq&Py|8Y(K=<;BIZGQ&#Z|5K6ptgEe!Ye|G9_^=KF8_ifUYQ9rr(jAO2e>`AiQ;IY}zY^pdIiyWesX##jGJ7mU3vz{n>Tq4&RyXKa=v5_e&9_Lq&=qyP<;G$-I+yHfcz++AoSkbB$v!#NF)vB^ zof~Kq0k2#3?pP}{{+Td`s%bN+cs@8Qg<=hRaI3`~pGxX!jWyLpu2ByGGvL;LX+)?z zg8;wP{cIS%MMmn9N=iD4k>m|?v4cec9q)fAa}>s2v`SN9l8?K+YXg58qttA?%mYIa z>XD~wG*vTuZX#>cpS6KfVgWP>lL`@22G@LBBD?qAl{lp&-HE8kniwDvr?aIf7)!}i#w8o2^$uz0z8 z?U2Xl`i{E`>-}JF!&vEQQ7p|Jr=i_WKIjy)qpf{nVeQ5w2e2(kSHlGkz#C6YOM2vU z$iR3PC@y}}$~ceJ$f`d#2%g=29SBX?De5{cIt6gx( zi)C9inmP-;I(8rj>`-`uR2ikOu`h;+ghDQ5fF?ZYTt3OMKdz>3@!wkk$<)bnTT+)j za=>aC?ZyzsBFva{rSX*BdH^)`VNquzY5t zhY~NJiuAyhBxdp#)_ygPQ;u>%5(b_6a;Bbe$^Poh0w1`cldS`Evc?F~)^0cT_Ai6~ zw&o#dLi*5kFuZz=o-d{+&$Du}VN_L7AV@p{%ktl`o{Oa8IymqWYlmcF;Ham^w0HLG zOdMo~zJ93e$x_YiiG6hpjZl>Z`=fhMn)7fH)6LZ2!8}=0rJ6_T#^#8gDEJm>;=*b~ z&m7INI_h_#G&y+Cz~FhJjrGaKm2kCCi>x4NrlVh^c9FRu#|C(Qd!;g&kR}BC*12bD z3prvgbgR!UO1r{poi^)?j%Q@))FxfHA7#ly$#B$Vu|% z7xASg-#P=XrN|6iq650sfR_O;Lio_re9hk%8Q?S7D>)OgOzrdvQJnqbzU`1JOxBuj zHD$B)sImj4$hy_mi;OKcPk)dj!#L?t3beYmO)o22S%p!7Tqib*fl`DzUF=;Q*j`7j z1WS=}C&QYSFmAR}Cs+#>1T)s*Gp4_nN){cxDNZNuKpespl(??V)`BpN^F8k_D5Wdj zn%NqhRWoa1Zk}TO?sg-ylzuoDrXB^wk^eG6bwaL!24`bu%4Y_`oejMr5t!@%=SkEGHo zVKfaur$V`LGbcZLFm=ef-3%e^(uuL*olJ$7NcVISlzqM5lOnQ6#}1b~Gkq~u{Cs9D z;;276yQ>RiNVHD3vk;`>e9jGr2TG(7afmH`WDs1bFYo$Lr*HCkj78#t&AtkyRNM4NyIW$@S zdZ(5eIGB1Mof69F+s#cCSRfyxr5E9*wt2)N$6$2zPQyUY+us>z(-+nMB?9YKsT-Ya z5!u~$+wZd(&tw{P5bxRoMQ0(`hi9o>ZTcr&eW}(L+s#%dz>-yfL)vQtYs?nZ?bQC* zSgTb}EJ&Ot20qiRKGyU#Pg%0K;mh)n+vjlTcC2MG0Dsla;q2go@7QHl5?r7XiYf>h zaD<$Cc>2t{F7IKQfaNxnv~#rR?sdT&Jv|*fF|@)!yWYSCQlUi{+D?4z&0BIcKiEt* zwOC^>Un;(N14%hAmE6{G6$2WI5JaSx>K9KQ!Lg-9Gor(5WTO7xDD?QImk*bLkxhW) zbLuzQ1GQkZ9OXmW{qh706VFknM1@1C@kP(o>kal_lHoJJ*I-4tlQ_O;Q>rQVL7f(0 zWmFmSkwT1HAcxi~C-ZHLwfgE(?dZ$`ffi^IyK=HaVvbCJc6A26u0|V?x6LtH+&j%# zNCws0-n^l}WzlK;MXsTIxG1@_k?Q19{5J6{zVc_#&E=M#`6n@j?6Z^aY1bI!HEMIj z4Dq?vSwwwvRP+Fxw;V@mm{(&cjd9$tPFn#!Ch_Ul#1sL3bj(Ga;NSOEJ?$@EFI&npJVrqob@BDg;}Q(tFOy0{ zW(5WaO%eUSv};)`AyK?FL~iex`n z$lr>MiSD|mAo*fWO{PO@c*7TBVwSE0J3rc4j)!CsDBgTr;vqzkYl3>(A3_U_Gli%x zzRVYA#4%cJN8De3kXw$l2+n$h`_g{zhqPm!7m5xwt$DyeQcjE!nZve1x4PKBwn}9@ zlXu=oq_`rKA!EX=)({1OG13>sCV~T5i8aS9pv<|mrVXt5ZXY(wVw>{NXrLQ@t&o!2 zTHFj>;FZEmVnae1#YOLcOW{TLcKnO$m`@GaObG_@+%2Fv`xQCmr`0%fq8>MHz3FMW^1Vp*Lnkh ziv_{G0K3Ngl3 zP=BK}{G%{5NRS_6_O%)zt%n4Qmx|PUV{aF=6_4JNN;v<3>CGb%ta5 zUQ9X6pp1sfK|zso!b4WxEy<)v8x17L3D4BoiGbhl1B2T{tCJT-(+f@xC3-mGC|&mJ z2-ph_qO2#*?Y-rl=I5U|UE{LX4w`7IhwU(06b&hOek-TsldZw@&u$AbQ5nV8YB2t6 zz|J7oY3Vz=H`a1OG*;~>l7h{ml^!#JnAIanW66=W`F~vTM}2bQY3sST&W^!!f@A5C zAZM=$5&x5;dizlrf%;uvbW9%Q+m9NIoZrlD2O=(Py1|A~{oQgQ4qr>gYM(#PUEKO?a#;*0=r=NgvrTroH znR(>Hm?USGUI`^Xc4i}(x1P{#Y&U&|ek|s89;1mX+s(Xti<3Yp@UDwBczgTm`aTtD zUvCFG%$Tmjj+BOR#`KX9((z?o6dFBlP_L3~`Yml~T_JQ2x%TAKRUO2)Bd&9iLftm% zf&D1DJJ4QiRH9<*N-{Vj^P6zBB$e^ut{VNzcR`8L&|etDqUx2GAn6$6W0{Nr;DY7*dxdC1r|D|1(WDo-lg$;;jeaw) z>B)JsEY}Ol&*Nuw-F0P!fMQ`Z6N#W$N`^y-Lr;nF6KkfPzK1~_|y!A z3bZmoteh4nF5=It?IYJ?t1i)ziYE01&c&MZ{jN^b0A)+US<@7+ZM-IMdO+USs)ax| zE|aNcR!!K(D!38jiC7(n=}%%Pt#nAO={2xq&3^3ZeZ1cd^}h#gDGr%PB;0G{ChdK* z5oy$p)S@IX^ahp|49tLlYWteId{d3qw8ebjduk zpHzx?Y|69t>ySC~-C+JKh@4qQD3-|5ENY#!Xb{n zd9re{7W}S((7Nv9Tl@Lf7Hu4xL7vbGD@E*{3g%{Ucmj}?F6w9U25Y`n@Fcl>Fud|K z&d;_cl_WY~eZKiV$v%C4^*f4#i24-ev9e;S11P^5aEq89ku$V+Z@Si^7qT-~x!cvY zYic(roFDCi|JolfTeH>ilya{HNmd?DpZ1Y-dy*njI_K=7GZY%wW_$Q`{B4nTJS#TP zU?1=SE?l8Ef04^*9=fa;;p^@j<3M;qPGt)s!`UH+5ypmA6FgleXQxyHrnMkff!D-$ ztT2nWd-SBjNHLLQlADx?J}**BJz5R$d#=Tqo!QI#TN`akX!1Etb|PT75VcYe`_pFPK0BI<)yLMLEO<(dj z&_jdAlVkGP-u2WXa8s4#+gGL~d341^VQecu%=eg4aKA_(&6Z@6`kN_yJ!#UYBt=&< z`4*=z(_tZw;o{V3JLAnNOC%5(PQojI(%jq)FILG@RzuKqqXvZn-g!Wcp7R!Ny^JxH%TH%zGk--W!}Q zP0L~5JIWG?gx83OS>4U-d2UutZJnrYXDvsu2{&@d-oeHC98zD~ z{2kJ}+Te4&k|jwqjft5*l?3=(byMtzneD*p{X=s88N4q)J7$Wk*~%5%l?3m}D%z5_ z*jxNqwhQKAQ&`YN7Gae_;JsGOkE2M6`ujY%TybiJdAOFxgDRRZu}YHd5vd1g)H zFi+^tzAcHYX6(<%!z0ltPwWw7RTyT%_Ugt>)dXhH3R`JnV0#rGC6e$J7!QTh_K$p~ zDovw*$HEe-oztorlx}{e&#sc*X=Q!_sLLmO!x;o}x4>ZT>8e_x6PF}nUWd(q<;s1A zQf3JKb9{Xj*v)XdawoSXwN%&WnJB0YcwqYLEeoJVuU?anZ42};$jX8~iie_oBA0jD zu!v3Cv)htB!&ERSaB3FQF$lj32SCY8wv|wPf}Svv#GSb&J$O$WIi@wJgxTcI6jy_S zh9|C_pWv*cwYlc=naUMK#)qZnq`j2Z!qKd1(+Qb(tPnYZjVlFKHiDiRx)Rb`JR(zL z6-B589ijJ+G@sHQ6nmCrh|SD#-ty1;43yVnF?Dl;P5Wyjy&kpNp7G_hH;+kajRwd? zmXu%>2z{=-YJg1+(0Eux9MIna$-eLeDieX?poRvrKi9|87oI>%Ba5{~vI=`3Gj^3(kr4^9l#fN@5=e1XI0%M2bJ)+`pv(HsQR$Jpir#kzfg;= zz*-)7Cu6=K4($sABXn=ekqdaHgS{^Ow{;{$|aGHGpRroO_Ziz=`Y4GsR6Be?iz0 zgErP?LE@<3h2nx2CZ#8p%&!q~QuSVOE30+Vvy!<|ENPBH3{b6SZ011v4v5DR5>MfE zCN%i`eB!`m#w+|a{sLmTOBs)>(vbjBl_;i{jw|EG8PoD^oBx2~TF@hYIJ!zoRQJQA zmGX43m?SUAwwMvrHTeNchpDL_JLRcqZluEGE#j*KY^kCsc&ZWe zi8YcFvW2RDL(CZg5r)iOwC86<^>bF*^hFsy%{fa)My%)5335VeXx7@AUOJyU3fHC& zn_cTj-o*P;97c}Z1UPlcm7X~tii-3q8<91z zW5RN;f@R~}7#G8Pc8?W-3jcFp2iAoCBO*eKPf)k|TnVD}s2LxI6qFQW`rw?9FH~rB zr#1~rV;e5%CNEmbI>O`zgIapLOQg63i+Mhp5Vqsg0>OI!tLJ8S<1Rb=m(TJ>IcH6h5^%dFc(ZA(jw;}^{zJjc2 zymT6E!YJiaFDLws!T#al2&e09*p4Tz{#g#Q$Wc?g*^m`@`rYS-{dvmdnJXtzyo;mF z14Sj|s3FchQaal;TI0#n&Q67qt;D8uQuT6L3bI&EyzYZkHOc-P6I)BQgpEhE;6L&V z%zq@Eu(LCeb@vO&9XwSDNVc3E{CI7gW5_GSxl#CYca&h0>VkS_5tNr0KV{)Od-a9# zJ$xdh!Z9VD*@EE%8aJJ3Acf}LE#ae!^qQuBv5~RBKyEp>w35FDqpF|VHC`Ng9Hn@j zVzjQKN71m({fNF8efuK!q-{a5G-+H42dw$sJAfbI_X&w0#{+Z0=$I=i*1^L0_Bj_K zNCeK;5yzuepmp!aYttKj-K$@H@+UD_a4RGf)O5Y2swX+xb_lkChvibl@=@}vDj>)y zXFd3|OGzc*$Be|1dwR%2*)}W17FV;r%TjLLTO;lu0y=vgY~d9A;R3%uua_uJkZK5# ze~R5%z{C;G!xr-6E|)}e5aJh-CundnjmRZo<1i1a=OGu6)o@<~eId+~iBC2*Poy*( z8ihx4AJQq3l#c8A4>z%YEGIVem-dgB`eC|SO}db=stKBP{MHC}W+$46;yMP*+i6dz zJ^oV=pY}hMddi)Iug%<;=}n5)pAyJE;rM@Od;73D_I!smP$tO~TdZ;i__OU@EzmV^ z0H*d68NY&ugNx-73pNHLVL&U0Qctlp3q1l2vxUgkMlf@Hl_jr4Ip{Y`Sb3lQPQRch zg#6@c==b0F^wn2xD^89k(#E+fHYv2*oPvU=HG+3vizjS}^SSvUx-;%Do7(p&I6*M_ zuA|^c{JStmS%_8>2uk7Cp{olwb z_-XqKLtKyQ*r6xaP*z_f4i|Jo8``S1?62Lm9+@Mv$XZcJQNGuxPx*GofFtdXsR1iH z@!E4OuVh*sM2y%hMF+p?8wuzcCC4Uvtf)`Lm{H(l194id)r2=;5r$j#Y;jZ-*NPXURd^8w>YQz;}+c0 zeKTIGjwb!VW;Noh{#%CsMOO3+Zd`TmOfIg>w`Wt;j|p zyvXzy&;;LmVD}3O{Cc)OmC)nHO6V}1=DCMIe#cAzpc4v;iK}f z`DAFFP1Ya?CdJ^8*Av3-R+E+AxR+5>l$4W`yAw6Um1VwNNAa*#AX_;m!A)uv z_Qr^-b)s*z-b{`NFeu zapmh=WdZ#9k+>6?=j~tx^=pVJKyH8>`N9K;*vI~ASFFDd`JOY8Y~{~L*TnnP$PB#T&`5zF=qdc@qtD?B1nl82cdb8Na6}GZ&|l&K zyCn^93Q0{eFjW=EvSs}Ee6IZ{e8Ls_IC%)8C@+G~l8XYo{i2~nyUKcA@BUzG;D2aI zP9xgE#}d-S<xV1l^l*U`wVsKb!G$uL}Fdy@G$v&Z5w31KoogaNJ9J96ZPGYAVIs3TFGz`;O zU|TdNI6339mwXlTE9<`K?N=>9V&{^lbB-5+6Zenxt}o%1=sPo|oeO_5Cx;%uwc%>I;}Kr9woyX}~EB=0?fBE9A54c=Y1 z-DdZz9kzFEzmk$F-SDs#4Aa20zQk5alk&dGjy zpC(N4(g?%U8}HfX;nib|`4j(mVFrrudv^YmzYzh6{`$>cj;6@hz?QH2Qy+Tq*glC4c&$P0ia%aY`ZV1C-FbEzTxSan<-NBp* zP`MLM^fXR^frI~Wq?lszK{UY=a^lmG@l?K+^Y{Fec*s7xJ%tsh=Uz$-n zHI};A=#Ir*n)%TedYCvVix|})_*E(GA9R05s7%4&yyv4v!|FOK1P&j}vI z;68K=Z}yZ-zP+K4U(#R@*7Ij+M<)q*^*wC?9sgVrtN`F6_!`8F2L&U^h0XXn@poQ- zNA;pG)HEmD8-hOCh`t4A25EsVT774a;kQxZ`(92) zLRHkH9NjnXtA&F5>LzF%iC-k3!-Hb2=Prk6L~+?Qq-VwNZ^WC?kOBO#*NMFd& zk8lrncA{DwJ*&)`wzEbl!3bdxJg^e&AHS@Xg5T004r=+B@7COt&deW8QJ%!z zwc}uiw6mFaAZ!#1`#6J>vMR;$J`m?^4s~w>C<3FizLKL0(js5PM`Msl6e?Eg-Ch|8 z=)0vLG5*X_ydK$ z`!aifNB8ch9Tj?MAIVqxk%Z)|emdnnEmjcSANLv@Z)?s%lvgSPLJ$tZVB;^7VNP=F z2tV1?Sj1ICDz#dW*5gB3vp#tAJo`PwtMQ#G2t}kU?JsqZLA~tS`!p1J^mG>;HT#xa zF2-)FHs7MWO~x?&&5Jv~$A`iz@-oXRa8qsxH&rgyU!qkNk3I43-1(4n(8tB+1yxH8 z!q``Jc#{Or8?>D`3zTSw;fvP05EmUlXgB_@>WTl3S9$<5LRuqj8qmdGv^{NrDYvD1 z)6OjSQ%vitTtsLl=FaRJgB`Iafn`N&Z_Cz!*HKi8eRSV_d*;u&LpnJD2e!fEvnnwT zk(KbOUA@e=b+y1=U6HHsrTba@tJe<*Hm-Dqp|?S=)$8ARHn^Hi#nD9oxiL3t)J}q{ zA%GC-=<`(d*W2U|-y1++UGU%2mPEYYTG077V`nFL=Vn!xh8ig7y}s@m@CV6W)a(sm z+dTb+0Pq--rBLDMLRqK=v;N}@-ZOnZv8cPQqP#ydjVOajpi?Vyz zwO>i>9voP|vvmL;!yuY?SYH1y(TS_2cpdI=b+o^ePb@Fjd~PPVo%fLxvIO55DZy9x z^u5`g2XlJyuMr1RhubuAc(+hkg6iE}H+_0dbGPmQ=$4iiYDPwh|0@eOvAB>s#xrbG{4z=jwkocQbp|e)ltb zKhN(SdtTt3M`oF_8p{L8BesYD1lfe~H}&_n*|sKBW*aan{=^sgAKAhGHdy{&-iSnZ zg|&@Wyx;CcIo1BdLt5DJ`*{#7djh0JIq!QNCW^~Wmjpr%@2lR%n`yE3pzz5yLPEVWk|dbFOmH@)lrtXf_@^6SNEpu8*|8FcsxYIFF?N1nnELi zI0)0jr1W{{GwqkhQw!(F&n(E^xJ6Uwr^H#nHGdpjXkEj zF4Q^=-F`~w!PYIQFHHI;b4hbDmm9n6saQcYeM+olq|Oktctk;{=Jf}9%=2@rGIy&# z(9x0r2+8NTDfjl4{&KfHKczYzl}y`m`{$u$@fDv>MT-4h64#9Ts=w0|^$u@LXeSXZ zDYWo}5V&^H82Hn;X?$?33|6y)31ykt^;!n?!qUkcj$+O(moj3ksFQbhsrpRPvr-l)#S)Jf|m73^Qv-ak)FlPr;eb(%hRNVk17 zxH+(Gn96kw3F(%7*{L$6dnn2CAj2rNN>XV`mb)uaxCHjsECdhx@E99Eo;V%)4`W-J zD)3HuDpZe+ULy`OqNdL%Bxo#D8s5dX&gFRSHCE?B0=4lC|C@fhkB74*W|9)%4}@3K z`@Kn=W|4u`GztS=+B9NGuX(?NC>jJnSgszALE9Du^5S-DCfD*z`?cTd~#J{6AdnJAi+EVm|*FVEsoT`Kv|R zbJ|1ysKpb_N+of^lIBP$BO+*bp`j0!pLhBza*o}B)Y+VWdviTpRWaYGe|DV?%I?m} z&g|TA_|vN3j(g@#yVG>8l-c*+I5(-ot6V*b^h*lH-lVXrThz;R zW&qT-?F&#Oa1A8bm?HCk;*(X1p+Gd-Nm%M$o0tFAtHMyfsIYw=$uOq8!~-m1v6Eei zc}PCm?EtJA0z^q;MY4Q*^fPKAZLnfJa$3Gy9`apivRzwV$BrC~hN8zOS%Ozmo3p7> zj281UfXQkHEgm^1FG86dAHFntNH2X<9gTjXE+C4`!xPa*to#(-?{)g(@H5&Y0g7uh z%>ZaU=OewExv@oK0pRD*R;csDD#9p^`g46l_rEaeF4YguQS6Oj0PSu~+cwg;Rvvby zMb2EJ((dg!q@`#i$aOVew(i1SI*Hm<8P3ZbJYfOWWB!sy<2D3@TCZkp2_$+cY>5CE z?4pp9(YjV=x2Cyr9r7tiSOILzovnF;TW~kzP%C4MO(*ICiVa=!gXu6bu2?fk-R)OQ z=Z}TUWc<+CR&HL9PjP3|V~E!^7<>6)QvOJ{ysGR{ki_vCc2oEz+Y@kn!|tuae7EJ} z>!0rcI4ghwph^YmEc}RRsI2=DqjrE>y7KtEj(}k(p+y)>DUc2u&PXHK4MWqaV(004 zA~80}vN}~eOteK!Z%h3;Hm$Qthd{ypTty5 zL3pO0iUe#hFbZ`42`4Cfv@J-j!eC6STAw}x+L7ROzbF+d(!_cxye|Eur2D4oJV9)1 zLemfVYgwppgV5vpCi)4`(gS3tiYY~??0BoXsg=9mb8X#UYtoy}S0IP)WE~;OLxr*ve6#f`}=@h+p1-r0fseWDKEP+hUP(Rq0a6 z^;;?zO`__A?>+P=HMFB&D_y`SD012Mm>&s`NMW4Bg#=@9U%#+ha#)pMHTqO6S51!! zUbjv!e;8N<32+;G&ppr{9QOyM6cQ{PlA1tU_+rS%ocAcbS4ON-@m4OkY!Q(rz~DH3 z4=(7yYh|)V?|luN(Sf~HWUQ;WdCu=PzC-}0VC`uaN(2&jzngxni7|G1+mdEnJ{^UX3>#VChZ4#XfT8@?GfWt(|4LiOEQLHe1z!E9(@OSTvXXY|$|a)>x7|vdu7? zNq+Mva$jF(ZD)Lu%U!&Iu!V2?>?K@AIHg2TU! z2mh$!FD>{XcETry~u$bDdvQW=G zP{N6>&2#Q66D~WZkHA$%F}_$Dure|CVN2dB*kJiPy*=V$i8l`?Jgm9i$@rwO3}?yO@E106<59h-2gVPTML&PV<%x2CtLAH)oKhBWE^8vs-jA7Tgx>ji zKR=ZWW5zJ%b>m~?8vL=i7k`PYjl%rr`(x|aI+R%bvDu5A07taFtB_jy``nqv!U4(N z9V*~JQ3uB41y7^s=t4>HHwjX=s3pW$k*Y4bn6j4_NQ4fZ%g2>f0x6do3_!DQfQFK5 z&FzH?=WV+WK!zkz|4<)l@1nLUB~qyQigpAI=RT30c}ABG58wuuBKQr817gcmzd2!P zSF)E30|gtx4z<+Usf|1jM!)jETFNPX+FMo@Fno&kB+8yqBQKFh^L^L3RZ9Yql)4%R zlLo6fEhUHbK}RX5v~?)Z>EtQc)z=~tUIRyP#bmvWF$|ou3Z$Ke2hwQEgymk9T8Jvk z7?{u^VdGwrO)U~-tQh0V&$=u{`u1)TeRBAZHh=+|E&izv3y(VyCb9AYGf4cJ=mbyR2siao0S^d*Mn4jpr=wf=AU zTAQlFL`5Z{KY*srKDA=zM|zRhDWvae<>UN$_e^M+#;l`43dLB&y$&A6!}ZLJh;rLG zG2BycpUohAfz7MeJnv?$rWfajW@>_ld4^uVtW!Vd8QYz4PX zv(ET7o_X4z(##ul)@HH2?|>*bsR!rGv_(nf+tBwUq^-k|Rf(k(Qk2A@X1X?}ENAUJ#pud{%?Y|d z3sYt^Og*y21OE$qSdn|FNak){c#4yWYaLs~XT{8WXVnUWH#sO4yWxv%t>96Iw9bgi z1Da;U*28=3Z+{>0(|O_HwRJloX=IT_U#}+mAyUoYoN8QFqk;pr5XG^+eg5smpJtyc zI9M+)XY#A?`WKF0Ef?k&Q}}p%xG6dBA}wHo>f4aJVOHP*peVUtNhwDc;CgmNHA!*W z2OFYh0W85z-`#ND#_y=RB1|ms473M|5@>tyf5~fz(VxkyB%dK;eP>rA*F2o(BD5pr zJE~ZDC8lQF!%sv1K=XYL$0-3t)K8zJ_;t&MY_W(B(LdXn2EG^WF|2WmwLdPTv$2Qp z8TA!N{kx(%-=#Hr<111cY_9+-&l z%Vl*t2R=E>MTesrY{9-l literal 0 HcmV?d00001 diff --git a/warninglists/figures/warninglist-warnings.png b/warninglists/figures/warninglist-warnings.png new file mode 100644 index 0000000000000000000000000000000000000000..f66070a5585d897424932f99aee72cd8968d5e36 GIT binary patch literal 91431 zcmbTd2T+q+)Gmxiv4DsTQL4(Zfq>FGHi{sEK{9M>)(M6&q6ykHfG+#2X~EMSTEx_Q;o4{D~!mGG7+ad-A@iX@!GU^>xMaP zXhPqeQ0;j?@cMkTL)eL{3*E<_A3FV{bwm73GrH4!@&944;5E9s@#ht63Qybv0D>dSRL(&?)Ar5HOz^Al z63SnK)jw+*`KEd$SH@u}!V|@gd)dS0@8}Xnp~_3O8PCb_$-^Cx3su-)O=a|u(Ts#k z`im!Ps*Vm-WQ$sJJV@nBfLerQZC^&K^5RC$`mYW8Ez=K(EqMnmyeHz7f-})p%|gtWJ)>=o90LuFPm+8HuteyW?9y?K-oqI#@K64t2qN2dUhd93xY01VMKEmfx zW?ovJs&M_CqWOB%V0^g`Ab!BTzdpH~YI}uI!IhY>xp&9k;n1^FmfOzW4|(+vRYpo@ zIny8r4--3(2fi4)58}ZNpceKy8Gbx|?Wirk- zh(9bGe>kxGE|CaL{_{2TZQ12+f64Qu z3sIN<#{w0y(sE`Pn4aIN>@doRF;jyr^!%g6HamxS zER4FjX|0~oEI?@=+S+_iXRHT7r$V%)VO+1upDO7~lcu6mV|k42dSQy0DN)Mwn)d%) z@jeiVp_z%txS`l^JOh=J2>YWwW6(A-5wXt|S(M77e%2|eeN&-e8tGTscDIC(s_3xuzEv|qU_DJS<)eWgDBd%?G6ez(wgk9EY zb~&Sv20_2Ib)p7w<$w4u)p1k6r;;rh~}(T23^{ z!tHUH#5N zmhYtl$dI2`f8;Bi+t}H;DCsaMLHXL!HP>2a!X@~+whVsrXM24Y6emp@yzR_f! zAvG~2t>wD!wM={Es;x2|>zOa?(Ni)thO(M%q3A?H*SQ<<6Wc>sMeatF&w^q%XKB4M z3+JN0`w9*)QXJER^K@om?~(TO5T;$6VoERAkp8@5v{uh`ekvs}VQop%dHn}3A4>m1 z=n=4pNTT4({$E@=nuLd7V6*b3-v&h^p@HbQOZ9z&=Jo5^YK)+I4nIS?xuwb}jOGsz z)c)O!=?6oaw$?n0gOc&|fZ1K#WAODBJAQdJ8lkK5M4&4999QE|Ds?_kI7+5)pBoEJmeaZK4RkHM zRMbJakUA?c@6?0qaMt^~$z^1sTXtp1R>pCQQ%4i=*Q6%`mX9~AvjXy5y}NkQ@&UG;MWGM2-3z?11lt)lq|SXhzkizuc*E$NZyyj zbXs+gC3XMczsi4X=6=@tA+S#shcTy+@T>BBcvm0HsE#{$M&nWKzEk*V^hB=SJ01%! zEzhxxMgDz*BFZCcSgp~4d#_!XI0Zdx-sQiyqa&*>+tlm=@9FD_f+w7qntBWnUSL;xuswSE4$`!Eb%A zg&Y9d^Ea>73b&nmCl|*TRsxb%7y&I5$|XQ=>Ge+|H>$dI?5*euE5belL|^mj?n-EPp@#+oh;TUFg7o%SBwFhpe zxqNyOnczANI?_90X=CVLXwprL1ZHtzcaGsi=lhWFC3f47>j|C>9$MYd+FTZXz3Vm? z=ddu+%}`9m>et3B@b>U~qEg+=<9k6cN8S82N5? zLei-*iTtcqBiSc|p4OcAqUB6;r}A*L-NU6!$jRe66IISYlb$ax?pp2@;cy-@u7?6a zc>T8dcgAq&wsDq^7S_9?QzXH~`8@Tj2T;KHgWGtORnC5weC^AM?i`|N$wn*mS`HyG zNGw^>hgOwwn?xdTIqYMumQwG={6P6SJE~KB2Cje*-!M3+9Pz1nV&UfJp0l%iW_8ie zSHm)#BjAsoQy0=hlvX?318vB0$0@pjXZL+eE%X`H~aeFIbjG^l=e7g0PgPiSccu zY~Z?9oUF?|K$%Nim(N4Y2i}JAZe63hM$^Ga(o#i zBrGET9z18@q2n8#mo?ez{LkfKBVUWan?Gq_z*_K&P{+cC&X3%`bt}{&9G|`M=wESH ztTum9O#uo|E8I@=q_05rMK44sA|8~l9wEK`uyPpUtHYT1WRbGb*LyTNCNH}$>C!!! zOi|KkCq{OAL`_(f%mfFPz`yx$Nr(fS?GSSrt;vFmbL#UXPqLM7*U^TUmK9!OS>G>* zLlj{zLHt>_`DV03IlE1e9KYG1(|Fo1&A|#% z)G`qA(Nc6(>6{;Ypbj28ARuhwyZfUWy3>4Id{^Th=jGW$S?_5;;0jURWtI}R*ah8S zYC>q+Pt*zItkRzGZF)3^Rx9EsEkw<&2$vib;nZU#Y?6kx#GOE!N}q!pJPQf8%yHHr zd4CzhcV-q+UZ_?FzHA5KEZY?SnuJKI7cCObXLZRfUp@PK>fYO0xvSEqPkmRXn}@HR z`A3Xg3l`A&qebp5#SH%HdEz4U?bO}WKFMf!%+i2INWqMYL`kZM_5XtV6d z{1{y6LEBIMSBo^TdLx6sU3bjOTV-7*N|(7G35V`IcX4rYdiv}iQTlO%M&Z%owH9t}^jFZc=Lb}azMIq0!SV|&8U*;L-DJ^4>7Y-xc2_))D|(ZSM#boLp{6_k$|$fe)q#y7{r1qJ41DJ zzPWtbCr2j*pW|W|e(7%dY=T%F2a|Wu=Be*=(*ellfL76BE4RAczY26&JIkORrBirV zrfnv@f1=?(pE&8l+_hF+-J5VJYu0X^ z2%MP-@(I1X16v@`jh~Qmq9qRcED742uePE-Vr6Q3lzF;!fT6ni^6V=o1HUJa?3+`o zigW-NdSEGJqG~UaJGZskwx}>8B19Q76<4skp*EcPGb+RB6a0}VpH&t-V)lw)(FbS& zZ&j~J)7RN$*Xx7z#JnYYIT$@pJrV+CEc)~YTygUJo3j5ZVKQcQ_uQ9fT<5<8f*V`` zG>uRg=sLEk#A8`v$08|MH6f}m+W6WP=vKG-AxTnWZ+xn*$Kalr_Eh7u9CR^ zP`#Gd`Y{4p7m*J#`*lw5h>bRh+7WZ`e??>gWa_%MY|s8VtGWeFVc6!qZY>(&0bdbr zz5KN-{>VwarR)$};gS0yk`Ec9f>8aQfl*;&XUlZ9qC$%Q)=+(p&qJBN6*g-|9`R*$ zE(N<_wIA`kPjCt*tU7T8&SV^M?Kz`3LJ5A?rJF}0zP^>^MzT=#c}*U@wLud-=PpI( zoG%@(&*Q6B_^R)D=50v9r}#w=w%!0qG;t|e$Yjw@tjJ*Q#~LXOF=EksLoiQN9+ZEh zSa`4>=5eVkAV!CBw9yxMs!x#5r?U`ZvGMxl{C-{dS^soXROWL~Mk-0^7IdLRVvtUM zwL*!I?9Zn}0>t%}DTiePGAx+EDUFnIRz(F%St-u!VYobG#}0f~NPoVI3Upa3RqJu> zZx?QtT_Jij*WDoi5x=6kWU{OI2IEq4>QaFJ%CmjZZRZT6B#*@^a*c!==&AWhTUVpr zY4ooQX;a`zpNIcVvlg1!U*5v?3EDJv!=TcbEqE7}GK3vpI5@Bg?qLRRq!T8v$!goy z;-1<3Enm$;-WR#elI}3Hg5W?O{i3b5iCkfIju3cUP*oHi`rHT z=U@hNxt4|UDR4NZX6e(mlxer&h%Z*z>z|B_>jP2eejbID{MdORZoc(Jh%cy=7XLc= z?71E2zeRRz8>S%EELJzJASiGQ*LaL9cO!3Qp4K-g5EES^d{sobjwKn(^#e`b%Y+J)$T*Oz;R4$1eFg-(eZ9k<-xHnjx z(bdu=Jp1Y;#EyHWS4F)^t&E1edqxBd>+ z${3~*(%u5@&eJF*!=ICQM5!3L;6zh3Rt46zemxBYyP;o#eI+~zT}O*PW>Vko@;BN& z4bQ(R6>2mv-GvDLa>B#CjzSX*HfGN%@5cvsIa$w+c5>c!5|FU2Wyws;2~N6-WZ1 z`q39eu-GxKum4I+h!oS>hRMiI>Jnr7UXaA0^y}fKV`9fk-P!=7z^9{tOfHy`wa+IR ze;A0LjV;q%(07g}%m|y|I}K4U4vEr0B7dVFsbww9G%$><+mC1TIY#Ie3)k~{bjtd` z_wJZ*fCb-Us!Oj2vn}f|3blVjd~FuE`2HZ460H6^y;7LbI9PJ4p(0LjR>!sjL19fH zhKGgbeKc+DRv&olX)3yy2qp!;YgA?y@NKnyI92p(mTcFq(~X|UR8`DcjjjBpPFoNG zdhO0NpEq^PAmdm{a0+^3%9dP1XIC}f{gQz5c(TsD<+9of)RB0CF7^bp5x4-Jh~vK| z9~P%6(@+6qA7AY{Y$_bGlO=)Jd4_xiVr4bcqkn+sJ38mB!-4E_GBUX>#qV`>enE6i zw>!R?{+3=_RVYLO7 z4h?xi;?6jueTzIdLX@Tb>E&h1^V`ZMYM#lqk<`n$FV6`UHnb;h6F2F5Jz$PJSo0)C z9%2c$Kb@ogN1aD;eu@t*qoFfOW^dW+=QLUD@IH|vc}n2J6FVsv-O zFUCV{D0l=_oJUSiJ@7qz^6E6}GRh1|g$Pe+98)$l)H>!+sEs{GW_D%9`mQY8=l;9MBndK9RgAo7g2us zanJVk$B!ZBb@fsB@8wNKWRD z3zg~I-ZFC8|PlAT>wgrGaNE1QM?1b>$jJ- zVjH>OS>|j4xifur$7vZR?0CN}^r^*1mZXhkMgJtQeIhScTfW zCTyJdmn=AZf>3Gd(NIKEqA!YlL!>z{Q@$yD9GJZkHv9TND;DFiRz35^)aH)wduMc+ z$^xIH09ADNGhJus5t0!w&iJU-%CevQyn4}34bI2VQ-2et^TvA}3$Nf;WvlTOW6h2* z@Ou{k)qQ?{H1i?=d-|}91Ddcc!mh{N8vXsbYq0&qs&cQY%#sF@zodNWE8V8pt%5Qq zoLC2t+50ptElQ{c*>CfB@UFP(z@B`t*j@H6@6Zt>xVa*^s;Fyv8~dYl@ArzaUWB1n z)l!K34?5B1=M*!%QdX1pMwD^%-V1lIa>d;qa(6t8H5iAxfHVLb-;`?(_b-&Z znMh26k(Vvf1J<~BBeu}Pl96`-FM?eu9deK5Yk!LH!&AUYz`2zN%3>qm6c0Foe!16Q z;$+JhQg4|!9Rb?)=xcO12=xegRN|OR_)2LJ?!dn=m3v#Ro=snEJFGMY5Wev#?ArY* zRd1nQ7YF2U>`v{GjFGZqA^GBC7iXP87tS2M=O=f%A86m#9DZeAX#O*wZIAz!V}bFU znb|2`rNN+c_BF07OU?6|yvA==4`c6bl!k_TYqJ;5Y^9L%M>nL6&Nqfr>_-{tX@8GgN>V@pnsQ&5_gs?W>BAbjM7pE%=+fH=BXPwJ5uS)|egui@8wWBWXjnytrY;O! zQ2)5w3O7GJgN(Ln|H6qr|n$W zZ0vs~EV(y8=Z)2toVZXa5aY}f^R5~-9_m=v{M?Tn|8-2bQyQ_LJk=8rPE5L#0IO5H zJfHpspjdR{v|--YEvZ+pZn3EtV(h|A-Dk|ykjd>cI+e7P-o2ptHwQi?B`?u|bH{&1fUGFjCLllV`}Dj6f}S^W88Yweat8h(x&yZW50Nhd%;M{&gAtQ{8w`rU0HgLlnj6R_Yg7Y zk$t4zZcCLwHn2sbpp2GZD$wniNU9iEmOM_kFch3eT-sbJK&Z)7AoU*kGI`UIi*I&u z)EWZW96E(mZj?-OR&NT#KB!u1TCEFB$;mG6T%uf6z2K~m_uueOlYZI_LJhkc5HjDR zwdF%cekPN*qdl(h>+G5rJa;4sX<7gtFQ}a_B3-o6lS2!JpWoJ;jx1g-3J%_yX$QSV9yD#?w;`TBtbEp9xp~>+&jp<(#3}bbl zOJK(jR3T49a;az7bi@dTocL#($wgYRLLo55SVq*c&qDttL6sKGTS<(k z7vu^oa})5=#m}?VQzwKwTW^1In~M~j?b!dC0k>4(j~cxl>&7;X$U{D)+2$%;1<^N8 zG;>pDZnw>FGnifOejD4jTrP`ru1!Bsf}7(tz&(v3p7 z##+c0f#fmbQ#e^`UK&A8(OO%UdP7yLc)SVhOrX@uA+DVgH@`-QaLI0|NWsK9=%;m1 zM&b$`R@9qx%C{9bae0yg^uZ55zb{_5pTB=~1D_)fhqfj&JeHwpghl5Zm07*s2Bsi? zj;x7y`iaold%Rx0p=$_wj zUR)@x-(Dtu7PKC7kKG)z|9;Bad|;`JxJAw-BtlNatxr+~sHIm9JZ>~-kD99F1NZFv zO?83w^zfktNnp2?3+8@|;2D6-gYEzzOAnd{OpGuX?Qq?+_&Q33w!P6Tn;4&5wL*h; zcC+!t4f-9Ii~;bm*6QVtqLhGx3POJpJ&vA-XROm688$!q8A&&ZG*FmX>#@9eJmGN} zNB*th_4uc3F_P_nn%>E0VlLS$i_wFR)ISfidTTTJtZ}y1qe)q-l|Hdna$<3@l)|oe zEi4%qEIT5*cl%&?*dGV#)EC~Gr!KL^c}mZh`)DeZMJKr8sDp6}#rQpX@z)C@te-&1 zXYhq3j_W6V_>cZJS%aqwawpl?QoH_dd+zoxssS56p0`yN>{>FY?gb&(L%kC}cn$Z~ z7;80s7$t6L*{Q?f1=eDeK1RthIF^7KEcvg{c&wpi9Ke%NW%%yFWmWuGcj%C&AAGnZ z=@`2I!~U6SDV13E)+)E2L#2~s^!)=B2Y#OHg|5ASQW~)G&-r2%Lb<~Z_`?X%LgTha z2Igl>wCi1x%alY*2FFo`XWa6J_X3J2S4%1^J+Te^j-8t4yW8Kmiw`?yMkI+ls$#d} zpE_}Fqs-th--XXB+DjAg%v4y?@D8h@{71Y<3fZfox53&~eB=K9z588VDThIM1 zL#O?C+IDUc_IZEaR_n6|k;AY&LghtbKua_ho}5SQy5{mdyzxKfq<$XHooGVRzG{ND zHYYi^prJF0((;cE>d{BIx_c74WyaZoIlZZ03MZWXXY0bc7p$Mnil%;c^M8rOIXx?W zrSsn+q+BXJ4(3_&ITaT`6J4Br@2x#-72%O<4W5h77!UkV;->oS@?pj2b!C+f2@#`V z;2x>Yz5+z%f3%f?&vM7%xz@Fhj2j%160qNV_0Sj9yz$3el14ml3(qK+`t6&IRv1_I zlwX_j{?K~6s_4g(W5MfQ_Ib#n`V%o>fqQJM67;t;-6+&+Z-|NnNC9UN?JwLgHu_{{^8pk+?C|$Li7)Wrc4bDM#k}#<7y*y`ZhXx zX=>HLnq`KMAFf!Sqj9n8Yr0VGhb_lnPO|>_4485)knqhmM}kgijA$~$bWfGcxmI}>bDe!zKGkB(AODOWfgPS%x8rwX&*ALJQa&**^)nU z_q{oq{yuV&CJzsiG!ut&0<15iHVYg^CMxvfAfsnVatoKq%Nf>>$F@FM8(wQ$PdJqX z4)KG-7KDxYWI0y)_C7q@t{h{WFI9xQ;R9Xv;{|1RWrGOdgdZ;ow?(}OP^L7 ziO0LVRd~BizU?}uxGGx;j?C;|Y~Y+{{G4K$)F0p6-{)5vWE$5>x@Z}0TnR+dtnwec z+a0Vr0-Vgls(kujEbcq_w!<0_Z5~RD7sS)_weF=&P8s{A`Lq!SmsB^NNeL#ux!dJR z&#Tn$CXK8J_%7LAMW6KsfX3l<1g#u4_ip8tRB3oyq^j$-YXo<7GCp=7d7~?Df~fQ` zNUaN)SG}aFimJ_dM%Q}C0371K7_K^A9N_tw(db;4&BSr|0?>p7%mB&fX6`n)k zHT-SHb#?ymACi8CmrL$|0U))ypnJ(*is@QxO*e{KZIu6VJfZBjyvibi{t_pB)xgbF zFd4INY*%nU^2FkF^J`WIs6SFTWFh~nDtuD?iv9RHRH@|CY4ch6F^_{tTt>=@8m83o z;3-Q8IBE0S`@4Y0?R91~7B`CQm|~C}JETCcY54>V8tgi}H_~*K|l3z2% z)^hj&ZetroyC3`<-Z+nSV6FsZY=5O2r-S!I#R!T&ojvCpxS|T_;_~r|>0SJOzn*n=(;XdoR+4IU#W~`@I zTlE@SQ_)S&KPZNgJ_`y|eow%rA+Dd!3@$kq&{|w_OSFPw=68NxmcvWxUUG2rC!ROg zC4ou%632m3uX8e0H~21J`l#B0L)fL7Hg37ICHkx1(91BD@>~ypQWN* zQymeZiOHU?I=n8QDF{gwidA!bJcMfiM)hMXhIxpt2;6)T4Ocu`m^`j;(T(YT=a=-A z1GeWsHfd(NZO%R$VlRbTO~&gRiumNuN4`upE3KA8`=dh zYKiH>g-B)G)4iK4EH_MJ?%#sSa6I>yH=Mq15bz&!kmbr*Kc9`F#zA)>hQhSA{8Wf} zed8Cr{I_Nxjp1oMAcP*3a$H)62S3ECk$Hawgw*xliBAVVODkvJn98D=b2K`E*5<&4 z8&XbO$kz_5UMf083RyBlf6ID$%G5F`wHR&a*7dsm6A3$h5D{kdb$DEn{N7Z z(r9VdUu`^H3BEwvM{&ns5gR_CVnyUuw4!uxsU9Zf#%x0lk!P$XpjlO)$)#my<@$5V zQKi5s$k<0vItk332eVl&+@ua{Ekk;qbJg!F|6NT8#u3KpgHWohx40tC^T$-pr^-f} zq|VA%j%sQ0XIdgWeUAFeOZ<`!!gE*y)L<@OZ``f`Yn1E!I(Cs8sW9atON`0QFFBDx zoeg*ubB8?H3>B)9d!c@=O@`svJYJ14Epmgp3&W>idDh*Ik8qmugurUB){Vt&+-8s& zQ`3;o{6dLiex%3s1jGsK{gAQ8@glvJsPE~Cs1Z?V;VQVGacT3Xru;TPNnDllfLJkL z>qo`3kTtOM$@^AxR<$UIH@#MI+ZQWZyEFVD~#1PHj5pn~Wu4{bad|6|@*! zemM$Q-CNi;*sk4V_xcm*u95Mnn};i)xrUeSRpBEgQ6034UF#GZ2~VuMv3VzZ$c-cX z)@~Wup4+k;$T*#3Y0=sZ%{7hN&OuUJ9@j$8nQ+Mh!tD>{xWwyo!Fx}HW$w+lc*f*@DfSCF=W_h*sTD5h~EepA6x1@elQqRE8TmHE~~` zMZFP}8`VZl@b}8s(!p{0nD2t4hqES)xlrHb>)1LEU#u~7ZfJaVu)GbsuR@BS^w_rI z-QO}UK;G*aQnhAG+}7KoIt^v_^cT4VJ#vKv0e%L&d6@{YE_yof7WgIIbKg^;utpRO zb!^|teI*M1pjD%P8zY0jh&q1>^+<*}4`hntXaR6_Q)E4&m;ouH$G$P%ox(NGr-7;0 z)`jZBq=*}37;$fi`05OuvILROyPp?p=pMA0<*9rbUOFhEZjp`UB)Yb%_u_^cFZ`=c z4vhohrV0RiqMTTW~4jLHQ&{>Wa8tP1>l08 zwC#lu zzQf3f-F@EPayi#U34+70ip@kteq?P5lhPHauPfZQ1|ij%6AEg&iF&;~3L*2`(zQGD zUzWF|G1Pfq%I=68s|azYVAOHd1(>XQ*Vr=5EnGFx)iWZfMypJaZF+cEZU$iDdrw5w z)?EF8d{#YV=34^Ku$}SpgZi#KskT1ub3lNu-}hN)u3I8l?&eWsMkSAh+{N4O@prdA zmNvK~a6Wg#dDs;Gpw7H{+YY4LXXy7ewfXrjy!xycxZvV!Yeexg@sIEe zO^ZFAOp{P(zb`6}^F&g>!~`W1g8`@3^kvuu{JQT$yhkl)xZ(uau&(L%aWHromO5+DsAu0fr&H$xg z5Qq!2PnfIU7GwCNJ1paiwJzWNb*JYtA*C}dkt^Zz|5RMTS?@V9Qv-HrC$a@KLUZ8} z*=Hi-TIst(0L7778-rh$P5c-WeP67DMMOq9s@5A=mDcv|U~@Lo%$g7L}L?cIYfNtjl1-Zx4tmq{2J}>G?bg`4y=eH(n4-iCf z*1b`DGUsVGGrJCr@j?=TCf{pQEf(^{m}W-&S#GIjgd#{wV<90 zgT|I?b0$@Hx< zYD4y2^7_L?B|llyjHH*`#|k?CsgBpU zuUVBCYgnz2Uy;f(r6h9VSgV-&{A0~Ta~|j>;0Ua^3TtFs^WqD9^?V-m z#kQHu6B}Mj2ZRUWY>e%jxG!WK$#cd!Nkl=*pRL)Av#&jN3@OdVyk46^mPKEMZCzHY zzKT}1rZl{|b7i5zGg+qa-gvq(DpWlVhHpStQ1YvS+c$mU<1+Z7!{_?&e(}7)l=cN3 z6jd&_`amqm=Q7SE7F%h^t+9VX)R??2J(_Cml3FrSfgj%5B$8Jg&mWhCEE`aY#SCp< z0205VC$!_Am}7GD#~6s)Ez4l3P>B5p;*&-cujR>i>7z`1V() z$<{j{{kG~Ky*s^;=bSNo%}mmG3Yw#OrGam0yZ-TDdhEJ!EUKV@>c{FSp#`dO0=4MU{wU{n z+oZmdkGF{6@|Po(^Vtwz(;v${-*a5bNUtI`pHU$s0 zK??64>gwL*#l)0>jmP4&PCeMT?B+oJ5!oN1B_^CvRhRn)eVJ7c{1b&9p8iG8nYObF z6|ES`x*zGYI(=7GM&^IV%_@)iS>?(aUKV>>9&d_Y!eD1y)dqWG$yn)p_x5Vj{1#Em z@Yz?6=O_dr{X?*cvp6y z+D4?NYoVOmr&2K^bE)MiQ)GL5w=elg1xS)dD<;0WQF(rQsCwwIW%M?W(@H}&Rh+0= zg~^$hoS68+B^l$(0&s=6w9UolA75VlBgC?g(%T<$jKx0yf3!A_lRg`RH%c2v; z6_;_s&e$Wby}=uJ-fy@UwVnY=QQCNP1*Veu0vgn`YCQ%m_P64(>ZVAuRId344)C)t z_L@`xKqNK}=oqnX0=ngOxK+%m&++k!!Z~F-1!nVPKiy7RUmVhq-gfW<*Sg~Q`Ld*a zgG@{#c1K-xqw!U9g3+TB=5u;(Da9$xnl`wBR2(Y_*l4?7->S@iIUhmqwnsyOUpLdC zwZemXZD~N)iv;ko_FayH3i9~?yPL(MneVIYVuf)%Cdu`;%X_3NfM?P#l&~s?KX_iu zOGZ>d`}GNg6!lFXw72T`E)sE0F{ql6RM*NebOd35GKOgV70 zJTKv7PNC!aE0L+e|LW7TNdbSmZAueJ^O)gM5mzl23O-%(_J z-1hySwv6Iflc*94Y^XZ&=bEX^=?K6-tgJuK-Nk}iRkYy(wY(TXWgW-VOXRUxG|M;@ zQ?|U1 zpta>x+oxY`P_(LqOKx*1jO}eFCHnR*h1?a~8eQ$)@+Xe%QnxC#_6sNWmm9T_J63{q zMM%*1DQiSIg}C*tsd6%S74Nt;Nev{4;!amFc9u7lie^&<@t!Z17k15*w_1hK#i0s0 z@2Bce4?0V1k4VM-zMsWgqr)%cR z^Vp{LWyWrgqw(e#hNRD}Ucw#0jl0HqPW#Fgzk^r*k^G#D9<=FbDB1})hfN5GiVaZp z%mXl>$M~d-qNw`UpPVtaYXgfiZi~hGBE|Oqz)U5eeolV#QpKK9I{k@ z5BF!-T1W4gdnU#37D4fMZ>irR{G_$H&3V?&zvbbotavS^{Oi;kSB)zlFN?YRBG1^~ zMAH{=9RP_p7vwplJ+SKHsQJ;poWZHOA2zxh z)8}E_T1DYAfbFlQMYl^0m)P%qD$PVVZDc*oTli|+C`GEpG-M+xx&alpPg{>Qx!9VS z+aD~hg@l_RT9)9<4SNP16!Jv#yTff+6E%A3$hn6m9&wAw<9;)k)zj0eb zh$mdo_a8j%8QbdWU;0+QK&^D51MEAHhFTD^Hz?e`mbr2F%Ihm>@~i7lQFk-8#FJp6 zOC_K^%QVtn#nwbLeRFw<0v(D4$;EMXov@F2Zf~`fn1NN_BR=-GX6_`uG5&p~j4a!^ zAAVX1R%0ycBX5_rbRPEja}i2QNrQ>X2F%3Mj^n=VAL~Vg=8+&qCm-nbcL}^Sfgfn? zQBQPcoZGMw%l`4aS9(KvY5BZat4zO%Cb=X|_>`EgB$vRYD-IG^6Qom3sL#8zlCfgQ zoTlTfmSsL#k@PGy#xenMyE1~y$x4^!&GY@ep7D32Nyk@m-q!CL{nswxw>^Dz=1e6$ zak6m#VOx8}dzUNs&%BQEnHVI~NuA@~H+yl25aUdVNa z_jP~w5xem{k1}RIFY_LAhbF{$p|2JH^Zdl`#%GvOG#9J|vwTvF#q8Dp<2Obg4}@lv z85JYAj=!8J5j^jAVF9@fe)5D__e0j9&zHM!vk{NLOULqfWZX81 zXG+|6NPIIhYNnR~vTD`T?oQ};pDs@rz-PF9wL_9CH}2vf7i_IBcnB2Z)Kf?vx4=On zQuD?xJ;lbgA%2rk|E-{jt?7Eo{CR1yWr@`d(cRe0i6-IT0g7WR!7~@xlFE9Rsc?Pt zHzy{n<|z}`5iUwII*mW{7b_~x9BnC%(>6KU{x4%W^W<6Y7d)5iSm(c^t4PpV7JAv} z4A$z`mb2pO?1SI&FDBkdY+qx#N82z2CWK+`Il@jFl|1=A3KI zIiLCb%FGwsLv41xDU<$9slk-xd%g6gk8d4CB?(WcbkEL4Z z4lCsr4Jx8cn*RB3Gp(EB*yf!5;$H~0P=e3&ow0?#stnZiy_3x-VE=Jj#YxJg>x!HR zOozaeomkqBJaD@usT%uq`J~<}$i~5|Pj17#pdocLD zoz!-qQ;3>KRdKFfm}Zcu{$KVdId0#&X1K|LV;2P|H50~4q549%7g!)$!k~8Qbj#bqTDSDaKI+TngvD56l{FhiQ# z*$}C*9VM7~s^|Gb6OU!CqlGd&m-vT8` z0x969rveG2cU1Ibgb1?`dIv)2F(UB_5e-ZyB_#Xq<@q9J>Wc2htYH4i1~e8vaLZO+ zkuEpASGp|+Yn3rTkLC+(ZFB?=tr_9-K3Yxw`aT)rVCR5WYfg{=s97~UY;yQk(hMGe z(rcxzk(p?b-pA}ya)vkMMvr|R(xz(pm3dY9y4dPRBgsF8A1yUdg(Reft z9ae^h_6%>acX!v5yi(kLj#NrrmYOOpG4fvDCc3$Bil7h?tHJ z$}009hZ{_=VZOPcJYYAfJv>vvK|mq*&`b zip*5>Gt@z^cQUU+aM*d$?0TK(!KDdP1oM(5yj*X@NP?3hWa<_}QinT49~mzVsNyY- zF$!h6jp(9sdXd`>Go;j3T_ng%e}RXhnMTZgW7|^$?+*xshW*{J z`_jl|C8RG_EGbS+`LM3MuCxGLmmJIt)w5azYliaVJ*{H$j`6o};m@~^d%m{ZyQ*SK zZpds6-joI#kC={j1vvi-L?j_1`Gsj6ERk{-S_eb&fu#O~bo>aF*Oy)~ z_AGX=SIVy9S=7uHo(W7pvLBo|({_&HmE$`$iAIvryd>)J7}tGxdB|udn+x%|-MZ@m zeP`nHSIcipdRc6u{cLg)I7oZ2*)x8^aMAF%wkIl4UsfH&FO2#gZiR_+8uaOAd&A_m zSG#@E2(9#ab(qCXtl#* z>3@3Cxl<AvE6{9ms}ngVU2bN3|Ke=*z;Ae;WfMa|3mwsTdo|1QPv?-C#Wtr!44 z_}@Pn0j6{R!fH9hQ~Bg8_M@)bAk)5E+GoLpBTLeU56=;+MS_cE#)4i0G(cy<0gR#J zU1|+W4!<9fYN)9bxCO@bBo`(U6LF`ZQA@4hLPGP%-{st=lV-wU-v8M0PuqW6(z(zw z*T8LDrLFjbA|2zR0=(QAR=D`+Z*Us_P#>^1(2Ki zG+$a+B9~9x{QYm;^QQZqnO zolD0^UXYVfT8&=O1{bmi=FDNTl=EOv;iDkCp|ji5`gnejADaPhTM{4E?ftk-FNa=G zB>2kg2fe1$+!(lRzUz~_#{*is3P4+s2Qy0XdUN1kl^Xhj6YvzU3jW$=)Zw}J7J?h5 z@k(Nwtdg*yTT|$H-vm|0oM%m30^1W`%GlhmEo1fg?N;=*5tGMWn{o#fG9#&!G87NH zaPJeghj-bd%RnNf5>LkESrYt;&!dIn!Z^#Hc+Vf)i1p*Fd1BPD1&|q?Y#k<-1t+y)r?wqmP_dE z&@lXatH*7x2bWL1G1Jz7+r4{LMLIZLQ`W7nIgNWXH4_wtJxPz5pd~(bX{zS(aphWa zjbFRS#kB5n)_*o^I{r#JQR4;FYWUBWwhE&M(^vpn;IC8P741Y$L~T32{+x6z#yifR z4ES64)P*UU+R*uuGlSG(U5Xe-?`B&bcV^s=nf|j^HDRRZFsagdsM7r4X8AE3{)EOa z?8%{VweI~%-5OAlqLBS#=J9k&P2BKW;uP-b*!7C7-dx*lj1Fke2k2 z*Hvfgd2kMLQ>_beZ&%pBD|3QJr~O$joHr0`6ujE$R({-nZ#t4TE)%L|4t^H``To}N z{n%uB21BR0AHM15S>SRfP{9oq*> zU-q)+lLHx^JqDk?psV;`hvzEb|JC3+MRWA$8M=9_Humiu&9A0rKQHfU zhR)bkg!F)|Vw#dB&x_=BbVg;#HT^Jp{=+OzXyx(k+eVHvor$sUsRE>iG?o%GmCppb zG#RIDUNutmP1El&{@ZOzGe*WMb4_4GzqZs+@{}z=vfe$OeN+<$1W_Y;g+2GzL|0mG zKgqeh&@VrtOsmp3u6Bq`3n7O+eVn{%;QKbcG7$RWjRo|gUWcZ|DfueV&M`L-QZCfv z{h)s^V@x=s?nd+Hkwb;iJw9v}O2wU9(`$!jl%X#cZnm6Dz5RZnFzPT-APu)o*C572 z>lL8%&o5_u(3P6PCDV)_O<|mV9`kQUBr6vob7Z4jHvwn*`(gB0TiG1kLhz_^XmMWM z3YvEk3e)U+ELHHCYJO(J1?V8*`uU7Ae1$~8!V_D;vu0PTyl!^K6GJ@^W>PN`YH#iJ z4#A9FaYTB0dM$pxpe%_ejmNsh*OG$?Vfn)#W%q%)%b#OoTiZ#O>Yp5D)8Z-D z_y%O^?hX_kK4#dt8%*Cx-(5Q8-ugRt`s~22Dp1R&kbCL3%i%t0-@QC3Pyn49|KSN> z`?wJp&Lii$ld#=6%5r%X{CBgr`r1Q#>097)d$&ElJaF>=Y_fjtyU=2>rT2zithd~S z6sTb`FYBxGinVs}edVtY8n-=vJqV(~EodSRnmmk;+N_gBGQLgPJbpQ(p5nb%{?5`- zWCtP`xNP#3(ndNOI)`Xak;9bNzhbrD#wtyPmWmQVai0tEfz@hAf^#<(w|d-X?TuEU z=*dA`2+ntQFrRPZ$B}gsZqt;K$mnZNk1nH6i%sAlOGNYow+TurLuzw8z%Fko*EBV4 zR8DfIDRvHfjymBoxLeSaspyaX3b#~NZs{~_#UZ3({q{o&7Z~xObVI#2{UD42F5ITo zPnv8tb@wE4=j-QcQMCp+HQzfP26 zdTUX?+1(~NY{Q_M*l3=D$z!++y2bV%8|k#;ch3G?sBD)WIk97GAsaZ)9ptjI-L(pj zpw)71=da@>Cn`=7CtK(cYZek_QY*A42otEgVj~3Uwe@KXI_ClADZc-ry(|EI{-)jPq?g-xg2np}mD=q_N zJ2ahyQD#u0ALfyJSnT?*kJ@ImZo$;R0^!+|!Z~xo!|j0n8Z_dkZ_v`%&Gop#ZMBer zIm2>UNE&W!%b84Oq#X~RUWrsZ8JwlS$K4_Ler0D4on7#tji)@!6G+%l`8`5_(w$KfNk!76Lisr;hcG*{5d8c(sl9jph&nORdcO zgO(tbhqYWKf5>=Gyi=5Md%MN>!8<@t^5fhT;|dBeB)e})MEEQSzmlbO7~&M}@{wlh zW-?RHhUAD$jZgM+Q`ANWR~}=xj?x`0f}&{Rinw&Ysfr1^vtA*)3i+Lv!UU;V2j8Ky zLG;Ud!B!%$cjuKdMlnGF8ISbAB<4cT?pZ0FLf+JJT~1?%0bx+OkU~kFs)=-e*l>F- zGKSivrPrA&H~FPjdwD^PQ8tIS=m8OFomKCj=df;A=Fe`?NL25K395XG$){QSsaGnd zBa&N{O0X5Fx-u0(o`vS^G-}QE5dmI&ad6|J;7ZIn$^&@BL^COj#)2UjfsuY0|iFp4C!zOhJ8$A@pCQ`-$07G zw?NjnaqDrW_?~UXJQD%C5kza7sGED{dpUNJQc;~Bl=6m96L9KG|IA4~#k|dc75llN z8vku;u5&>dCpSI&B2!Z`x=2jQ`bE`dlvLDh@h|?{C)d~B&N)78rzv#`vM^9hJX8EU zB?pZ4C7lUw=^|mhwUZBGLM`H|^ zshSoyFl!~Vv=-dzt3iVHaIrpPb@iFz1~SNho02oxi`=kS|5=11(&s9{+lGO8SGGy! zn`@z)2%+mitv|e0ajqTkStB|XCZ5GBmEcv>!o}PB=QsbIGVdH|w1GdWVTPWVwRtu$ zkoyR=9eMHL)-~Ni7R-!ZA&j5Q)V{+@mBQw0CQ0Vs0=*CWn8M;Sy*xz@SrO^wK+jX% zoEo>KEx3MWqZgZned@C;s3LOCJsfdUI7moUyYw=Gx+Rk5$h>k>(?V*h|7JJB40~^Y z&bMA{v9-Q^BI-TQA7L)8vOQ@ZNMrW25P(Eu9-xWr#b!m8;&SD-7arCaFknsrqe@_> zTBruW{c7J8`IVpBTf|vz4ULe3?LNU7qhOmNdH1*H)uQ%BU*Lsjse@aw@PJMmXvf4l z&dcUM;))3*`3g#d^nY?mY@+pIV!;~u?_d>;Vz7=zhfql04M&fJoJYKlD=$AnE=+GM zP#kHoZW@!`XvKgZX^brzWv*-JAeKCURZ$Y3u>|Q$SJ{|0*kGtF3qb~Dn?ERjebut|k4DC1?9V!3 zsYXK10(B;i0Ii0nd3F!JT7I|2O)&&kshZtqZ4#|8XKzo%F$gIWl1aQ>I#QzNwS4p6 z3EtFJDz(wzz@}}F51*EOI+5m@s%RGXs`kUmq!M`Ru6bD0^G zAn1IYcetC|00-Lf8=aG{JBYXZl|%_CRQs9?xk&{g)*%4a>#mE?Du~i0Ia#q_a}%}{W{|_-KWdroc+m< zChJ|PdR9o#VKq+7;DRNO^dCMY#~GBKrRcXr==th1#<noZk`@rW(yPn!TY*+~Vwi1! zKqFer34KtceBv1)(aUGth?_@Z3jj#ZG|D zF|Z*%xLtwUbP4JCvLOG@$jBiC#1YP4mfl!w+>KV+TD{42mWte>BA46Tg7qyJ1H{1# zhUp`I&c7ett(S)OP(Wg9Z||P!vbo-mU^v?w7#MsKmzVwg&pg?-XWRk&-<{gWJJ9>z z$GH=Gh&S-TxwqA1rrH1hq%JaJh6&)dH%)B#__2iEF+h@+=4ZNbKuecq;s^ajPT=$N zDsR<5X&Zs~$|O+Ovw^AGH4(0Se%erE&rA1I8T!@S>~w%*oJ$~Rdu&QC zIzECd<@ZZQ&?hpXH?MNz;$G$Na7pjDCdFNKRWuJNRm}5#kF+Nzu_Wa3ew~bddfB|WHbBG zwqNIQ>n%!R1E}l}$VgKDLe1Cfl{))#SxsdmOiVhue&nL2q#Bqkl-;R0huNKaBMbAk zyhebve6y>P&QzP+qdi$5uq;TCJdSh@Yw2C{XmAVEBK9pja~=hqb!Gz#-FZ+}5WysP zP!3GEK8bxfOC3onDA*?sxfx@($vwyzhvj!Y*Hb-g2o{JL5jtXFxJY=`BisfTNwAsONHd_&Jy4ih1fKOviycdM2;CK|6X z2hY>3pHvkWyDye18$=;i2IUseAIcfn9f_*=qk|9~;NJ57hI9Ol0Ut)3+s+<4`>LN7=7WPaZk5fgny>*WMm{|DM zlYC#bl0Llt^DVRqJlZb=ze0q*psNROHahD_+%I)(b>4n$;&AU8sTxp24oYhrlS2aO zqa;D@77s1(E(=1u&xHTHkcXg~*iLEET-f%Oi`oD)@~;wdJN<`d5bdP5`wtbN57=_KOAiS5bh!&sJ3bd2#-8Eb_mCETvf$ zyGThN*Gnz-I{Ut(s7uu_z+5g{NW?|Ht^YcqU1G^PE(sMCX43Y(%B|ZqO3AgMSO(_f zjGQu9e!qoZ_S_tg`?*fpo+1qH@0}gxG?dk9fii4bP;EE02diHTH|BdIQd+E+xR=bC zruOdh?5u|HPVAF{d6*>W(lwB8V_S7M#&$?FdXB5WqoAi9u#!`XK5Kl+tVRZmO?&75}1{ z%hX2Pv3O1NCM47p5S$v=sL$YPta$hpHephvf!&tw$3ng0}bU9~g;X&T-uE%Uh z3O5uzdMg!T9dTIXTJf8R(1bPu;`kSs+zXvcc`$XV2(5QjGs$49+J&!Rl0*5v@XSz} zW9cRkgOYDDX_pqO>3t_RaNfv!WMWomvXtuRHC>{7&>$HaR3TONx_de7+OZ&;S)cV^ z3#a`Trafy`H6}|Mxh62>H%MrxDkKrlNU8%(+0+iCN~#RxfoHMs7r?rMDXD9qzuzIRFyE!UjQMAUx`# zNti3H_LZY5g4S6+6dd?+%j=h(xM60r>xFc7!z(^FR)42;en`JG3~B*cD!u>$4`@(! z?W&3!;F09cW=N7vtSCW0a}ux!EA=2VN%g+xV!y^s&zsUAD|T^*c#ObOlBY7;rcK5| z;clW`?7mmL*FkFRk7?L}>W7Gk_IbkJ+Eai^@YR=F26)`c5QdhT6b`#to?wZ%fQCZ)1_oBbHl<#f;asy(*^)Ndi{2uSrF0YW#F$C zV{x?cdcf6N;T(IvCB3lc=LUR|_L%$C&3_r62LHq4*uP!&zsQuqcGG;jw@*{}Jw%@b zl#qKx`p05!w@Ck1zW>e%H{g5>%o$%tA}BR_H0Vt0C_F!#G$g3tK@M8x8$)-gGKYsDnyOHug%(s3jG zYf8<=EiLAtS-qdN7sn=hg{$f-^7jBGK=S_Akz5w_NA& z{K!wK2 zk5$NhCWP!&J*^NWTfGxh07S%a`g;H?xMCB=st3f8!jh>C5wxQwFI*{SI4f(xEhjwK zBqC|dbw%iuuGyEL#iveiJ;ofG-nGT}ZeKcMFCyOb`DqO~#6Y80dAQ2xCi|ncapD|6Oa4DZDl7(fd5D9dZvwV=8K2| zGqVfjPinyEo2YPy$9yDeQ@P1wZ0U3{mk%59gO9tOJ6W4mm;AuOZ!~Fd5c~2y9W)Gt z=W3`&9-4uY)8!)RVf?M^8og2qjXmwM0^oQb;3%lplzpf(QlQ1!LrL9O^KsfTf6L@-q<2s zAQ4EJ{$#NE%!9GKx6EkPvKMJB)NIW86Z%$Tr%GMSGUL8VEMPA-PoFCinELVcjJI4u zyo`o$rnO1`Gx35AlFrXY?NSBJe{Og0pI~i(2!yMVLpK3Gj?006U6GrUk#R{0pxC-o z9RMu4Nk>|=_l!f|gBQP7Y|r#{Yk@6ncAGnyy2}&HEvd`@2gUw!?YCVQaM6DnSN*>e zJpnoRG{SnM`Ok4r)6FlM>x0IrG>yGCql`OdmwUT={vT7ofVas}BDc&So1>e%o9gn} zI=0DS%@vodwi)38P@u$~veF@B$Eq1~ghRLFdRU`>v;-qX&Y&TZg+TA)5e}9=KIyM);aL-TxI80w@~6E6)*`SQH=(!k_Jb}ryn`pk?Q5(-8 z_F%7l`_#rK>f!PcVi5@;u06|B>Jm=}R6*A{k<}@5+S}2&D>uv$`w?7q$IrbPpcgp-3= z_!OEk&YOEC#FS(ntRZ@3&hz=YnI|?v7VQ?*hgB-*T%_^{t#?UzPsNp52mJk0UpfJg zf)2;SeC9kbV&fVe*hj@=W=XT%xCV4{CRIW)_+@%GpO8<>eCpN7^AX-t8zICR3sKL# zPWG(aqX$@HiRc4l#ZbhR(p(SWa?D&~p?l_gl|!V~{%LmY1FqLAt5CKGu$Ow1Llqak zurMW%UI=2XDIBGr=&YRn(d>@{gRI-2!b2-8h5FkA=lRTxS^QV%$Th#e3wg)%V)b3Q zV(TcEt{hEU69p9;m`-+zRQElpX& zR(Q%h-MvQv;eq88&f|;#pXyi7_C|r*VHv=lKa?W`&HaWmzex2|MA`vIKQw1+L8`f1 zl#GdRF9&8YIX?!G!(5*7QPD0$QJLWeXz09MZf_?jT31Q7MjE8dn7hs@7tKBDY(^DX zwNUuHlG79z*e9UJ{fv*Y#E+mFNrZW(x3@shJPu&Y0rs*5vml-kBKND(Df36nUjPKBkzy0etEUf+=jpy!)&W=rri4E z213^pi(`PqFvkIA+B6Lz6dDVrHt1CWeRAdf1NP^3juTHzgTOi0KE87NLSP#(qQ^3F zwkik%(g25%tY-pvFC-3$S8v7VSj4eb!VG2yxF{8XW4l4lFD_+`nI(`A*X=K5pIe8z zobU|e+*H*;Fv942l`KCz_e&%xG~lyo;pa_D)SPdTG7W<#uBvF<9u3zp2;347!k{13 zXrL?I_NHtXV2OX2{{$EqQx3D7ZZM3&%zp#1J5)=y@g#E80Sa;7Tu?Wf#rC8x-|$-MV1z7#!|n}lf4o6lDf%i#6_)os zBj3wsmVKjO>G@Ewu(;^nShb_rk-q5-Y+zFdgUdOy`&FTP<#hXX+Q6O!n7_w`FR1sx zxPx$X>8q~Y=sw~hh>928j7arS%+U!nLR#|kuUy|woi4E8&>zSvisF<7Y+)O3VAzqWGDkbKT} zl>II32@y(ofQ5bcJ#1KG6ane+C8)V>zs@o{;++I<cy?K!b03&SrJ~k-tE+~h+Pvek!^}} zMU!wDVkZbSN)Y5%>MQTLljrR>sfW>{UoL5;g7YPC;`qm1M>S2^y|4c+wA@ai&rxoG zMyHrCt_L-cNr=9T1>=j_ZjlxWDh~}~B#gQxRP^1h`dShP@*hT)kYb|rJgFwcl*dUP zkX6uOMu@pBHq5NAT({e9^(G9>>fREGIdNi{m+S4wC}MlZG^8E7btT^Gt$??>H-|l2 z&;qN1yLQ6d7560AmB`L`xhDI?E*FGKN{jd0CNvNFk<2vKfl9@C+*86mmdNuD=)&(Y z1_yS{$&R>JPn#n=hyp&09Pmp$5fosrFKlg+q@dOJ5U~Y~NnDA3Q|1BftFm|>fyCYu z55A$k8CAykN_GNvo%@LLz$E}S|BYfM84);U>|S73#!@Hz<7w$|7Y|4%2@O8k?^rDP z1Y^oA?~)1F|2vW*O3yy1#|Fu|KcMzxzlo4tZ_MnRFE8KRg0MllOp8kc_uz%Jwtrh} z{Z`BYqsM=tkNYo_bGz|ok#!U6PFT4!2CejDs-65R#{AA@4rogM;a2<(KGR8eb}!!f z^Y0MBzu^V{os+jaq`t9hywOfW=W)sS*%*MwTsoz-lf&Qto_R(DJW z*}WnPthcqa{+w#g1{@1rYbj4zY49so6+_?&PP4(NU%`7%Knv8AwFuh^8~@aCL*&tp zwVxG**=T2_kp9w7YPzhb={n1`5S6Z1{Zp)gyJ_8=m@p%5HIaIW# zC~^GL{M<|U&}*!=mJZ9Og{?}c<7ej-ZB^7eq`!#_1?d)A+{1_qre`!AgN2=_n2~Qg z9zA+jqI8a7cg=E3d}`~DCnU~UlI99`N$piN! z9B;cgekRZjfiKfELMh;7vgmveO5xd|+=(qRy+5S;eKYK>qa4Y$ybYbY_Z05~Zv2E> zEGLBQRUf=g&_JQ^5EGeeu2?`hTq<#2Si-XP7LXfWo)Wk{)p)~u9~zz&a@R+$ZTdV{ zp!u}W%9+<;=%-_+_%d3%u50$FldwO2j@^q+G=_1VnzoKl;47)cW(rGma*tQBx5lnW z6NrZxr89D>x%HWeM3AS2KPlTZLgE+pbp$D*nBgoDt!6pvrXIWs zHMzucd!`hrL=uq)o{-?5tC%MT+p z9&^AcvL(n@toS*|+LHYRWs!Vj1>Laa?h-N&eRD^BGYP4|&m{CT)8FC8(Mg)rRH#ml zJntbM5$cB>YM<+z^NsV^OkfpV9sqgBceyI<`&I0`6}?~2b(7~IVNPp8hUNBlezz91pb{}@H~YxY zD+*Fi&Ff4U*4sYgW#iEH`Cer(F}_M1TyuudIc|x(h67-vYXHv`j#ghzD*T$VWxn^I z-!fc7s7H?t7$k(yf3U?oN*BuAe+OE-^DYjO85*^ zm1?n{oXDOPKss#-aXo=#Rj?g7ZQ*AV^3vjzFVA`6ga9x+tcX%1xV02~Tg5GOpHN=$04Ap= z>;|7YAf3t>u4U!`n-)qt_98k=Ay6vBI@Y1@z|xj?O4DbSPq6TSEel?LpL0o?%$Qh4> z-tclJT)u@7Jb_Ue1X2a-p4Jhl_dllu9W&}SNms>iz_{|Mv5zs0q(phejQ<8t9{Wf; zudbc=i%Y&(6yt846?W`^!%i*jHB?kob{OVAdH@<;8VF!jS-=7bOWFm$c59KvV^i@Q`T&^_?RqnRF(wU`(^bx3&Yxz^?JPgg z0v@<+7-m!HD1t$xln8mD$;n#?UAE{{z2QG8Zivkvs~k@;so%SLynZi_1#2=-AkROH zON@qme_Z^~?xCFBAvRNF!dkwj57}--uA^XSfPa#Tu+MHcmJ8k7SSF-JG%?vqE>D1Y z%0eiCtjRMZ!6cs{DVK7+>!*{&qL9Q^ua@APSe838UfcOW;ImouHd*h5y^!w9wb5^N z!dxe+nlG3tEIA&>tOr<_tUbPg>26K+QHi3$-}UDjtHdR4lB}yOL}C~&g~T(p<1KQb z+NKa%cIk^hT0Rq_TXR8H1DK>0y2XcJXRg5P3sK0F=tFqRA5Zd4JAN(Wu0QR~oPOaq zgew|;qCfXrCMey{4P?E1(SuUu0!mvkg#{(fR|y}Oxw!(f+FKrVemNdylkNvD=frRD z?Y%K~Caz*w-X4XgIio(#oI&Vbwd4$6b^Un@mhNeM&Oj%o&-I{OS(*t|d6NF#QB-Ox zmd{W)v$+N8_2gPU(SL8^-}mKv&P*Mg4;ec}#rs~X z6y$BSyTL*hJd)m%Z5up5SzR%kJqknA%^pjFP_Cw0vUD$2ZF}N?YaJeZ}!SdsRp_*iGJFF@f+Q( zZ9sS!n?~pda>js_H6SSWr<{XXNL(yI^s7braN|x^%mQNkS4)LmU$=DkQBjMtIjK{< zYddxVDaU(JbIOA_s7%D2iqEF{{i6OIGc2gUjCS&7Vld|_q&mJQKVhXLMEF+oafKJ$tsGwt3G>NZ6|&2dH;jtb+kvUsQEkhDS

    5*|$x zt^0)I6rl+|b9!R9J}Wt3?^}7kC06b0e#=Mi{*F>QBIcV7zW|{7>qKMDp9cVS1^EIv z&6%Lbr4xA}$5MTwioNcgC48*krFF36rbi?rx0rK>LJ<`2668a8i4m;C`)%{)S2MdD z?e(BAd`-WzMZY4*NS-xSzIMxt!cfjeHUumo7%Ey8APkuPn>u(QzZs7E!+;51Jr&3PBwKVFP5k<_x zCVnxxRc!gN#kt%hvkSIENjD`qAvvACGS-;+pxbutn-y6N2HShtfew?xqevhuR5snb z#8S#8iq|rz1~@b)gbm9JpaiXYrorszwkh7Q-Mi4@mE&yR%|~}5ZR^07O z5=h~iv(LV=auQq&;k>1)YguAx9l_-$(j0!j`9$V*(^}9+nJcE<;SQF+cpMgtjAj)U zL57kW%$Uo+)ADLrK4hi=kC$erp4>}KYf)hEhtMCe2M$MXBc>EhYtA?a8q}RC*lHuT zDTS)X7kM_@oJZWf5|`GjDuHE4N(JlQ5Y@e5+pE{WdwYBeBXNKKgn7nlRMyF7x8PaM zKB3m3v%?7fmA==HYTp`&UdhbghDXLKE5{>?WN%}N3=_GIJv?R0&Aa9I!E4a2jV-c z5Q@NHyiJ65;>3YSDA30^CsmRSEQ@;3_@Y_pL9U5(Sa$1h?5t?F>A} z1sI}z;~cxoB~|o%X)CFuHY9g?^Uz31|3b$L`m~iup!=VG_|O$1Ihdc+|E#T=%^Loo7SPirmy2Nx#}{@1F~&F7Ma6` zeh+13oO{^M;c#FBxqa?JnR{00KvDi%bJ_oD`r51F{|Ua&@87<9;a~76z?0Vno8UCo zBx+b=QJPIPeA}Je7My-+C)+fJHu2IbtXbi&F%-o5i|}z_rEC*Tr$~`N`g&#r{1Te; znwIi|v4IytZ*niK_-}EHQ;=~>$uFSg{VpkuBJA z-z$k=1V5~LC-VfbfEIV@98`tgRy+^P3a9l3D8LTHbvSvNYWS#o`E$%xO};_HPhG`x zFha82hs2VBGUVq=ngN4{HP?t0&hK`uY;V4rSc&0>FF&Z90i^J60n@;F9$u21J^md7 zC>2;4qm(;1Y#g=Z)LBkbca0M|zvi_RVzEZ@vR{VUw2z`4V=yC$0i9lGUN;r#eUhvCy|6=hd6Qm5e_V{hrH;EhM#m0`G{L%2SoVf z)E`2H7v(e^P3Gj`+^L~r#IeN$PvLc26j+&7|h+hTzZ>YxuT@@$ga-Cg2DB zg(SW+ui?Fy))VkIg9OH~ke%v)-Kl)7WboE8|pky{0z~c(q#tFq6Il$Wqe4 zGaz1rPfYqOhbd z$q)p`d%mqVVkNXIwI}C7a{)XcBlhsgd}=(I%OK^!D_dVaJ%D0W&e@QRPuuURV3*+4scBNypn~+J$#BRhU&p$lKYA^%QdTb$DcE=%7No~x=X;?Hv|r8|FO zL76?(KlYL<`?KI$7|JGOSDNrL2v&arX(-H)Ez1N|uJSMbvvHr(S*CLxin zTBS=wBhw}`Z|BS6qli;ZT;*NxvYznUV@6n^8T;&}2POK)@6}s3`+7-fCMFYnAmE}{ zM0|5;Fl(nMdp#YXWeCGRG|MR2&U)#6H@pP79v<^hrv3Y2W&W1Upc8dEuyc5{PYbQ>d?fWqnA@TT~O!s}1 zWS{G(9%Cg&+Y*CZbOgG2m6(?&$N;8O#o{oe1-0n=R6X8RF&J5K&MdCb>=ymH1$*>N zBa^NSdcbSkQFyYo8eXzQ|AVsb*H@fem*yHs`LPyuQ4;{Uw$?}i?}J%q{YcHImRHpD z8^4kO?BB2bJLt41f^|r^6#2_{$$ZTNmDrsD^zaY?Sm*d;v|y;?vaQ(`R?+fUYo-d^_@Y^PX&>U`lsS@Q|^89OVa!MVUp}$08-se z(-_-OPD76o;_v<{t$WHmW!`x-vQURPCi}(py_xITS(ZH;Jm4c{Rm|Ie_6yiocIaQf z`=94|{_Pvp|F0pBZKVME{xlU2y2l3eQpQ9IXGFyP(L344tg>IfH?q3el_UT@Ba!p) zPFA1w?f5>OFIw;K=Ua(gICV<-Z1&MhL(h>f>P|n;G{Zq{ed!K#c__ZtL;edrvqe!{ z4meCdW5z>DPwv}yE%e9Ujs*Mm>8T2Y8fwsg@3=c_XM-z6(koON2X3rJdfTuv~qkl z-Y$x;v9{E98@zdibw2d225nW->Gl)!_f*CE=xqUZdv&v+lIK05qo41+pNg)r`e6Q) zYyl-Zwz)~&7l+i?qO-H(_ymHJoKHYaf-H4jtInV%B%v?&7N>_Lg2-hzYF&49LT2@9^ZLA{p2XWD)Oc3oA_$c*?QVT z&Qo@W9`;Opir2m5)EE{AlD^yI5|GBr$7U{Qj$w-OA4Dk_otLQ-@chc+tC^yqrg|vC zgjy}U5tkbBxc%h_;Tw}RwSrhRb7k_N*Yz{8&?d&g6uX0Wg0+mfBtm)vQA)!X;vD;n zQ#DALRSP5uJzIW)hsK!)9aji$Pdxciak$q>3({q65jG-Q$^ozDlhy9YMIA}U_^kXrV-g(gf2hDw-L-3eHx=U*` zcRGK__!Mz>&o2IGO||pbN=CcC)Og4%cEPM z_8aGPV)puDtALb%9KO4b&=;3RZaHBiSvXZ=k(r_=DX^y_*;YK18<+0WIvoqe)hJBG zw>_TmrClFi2=E~F=vB1iRNQ zbqD7`wX(1(-J8_hrNM8f7_}RLk=3`kpG^=uO}FFEI?uO^s7{=S^JKxKP%#e;Yz2?48f+i%Ju699yYe3=&Pmt@zp=x1wDE!aNzJm z&*-(|*zTsN>H*Mu%Bv?i-+plT#wZx_zGG^VN4G~tFdvVOSJzRD`qretq@14j#k%!@ z(0KgW)~YJi{uX}T0FJkhBD$}zA4UI^56SvSzgqv$>!VzzFb=`)o`RDtVFPb$M82_g z3O@A|rEJC+n0~{_%U3-2nz}cW{~=+ZIp56py$9R_yG2p~Yy&{5paewB7Gs-k=)%H~v-u`En+?u%BIlu_lJ^5Pc^GSNm+ryV(-lqffwNDev87G* zidg(FpP)NUjPVCQ7r%Qn-D;6*TnT8cZkp`(S~P20!O6i|HoM-{LLRvmthy|=<0XQV zTGtX}B-h^i9V4QYWkc>~ToVV^(mfJ3aaILVKdeg2d$^<9Mg{L82n$%y=hoeN!KoHYbz?PXe-iykZw^?5Kx%}ggAo8 zj0`eHMCM6kPDr94q9UL&gMi39M&>DlsE9I!IgmgCA_NFYfRKbFB>7@@+wb$d=X=g| z&iT%dZ~w@ZWba+Os&>^{t5&W1UYp*3W^> z?fd-KF8lb0ouWOc`}_%*?B4;W*KB`Ah=Sb({-x-DA$u5?`+nWu$L}8d{wq55Lig|g zLYQdiz@hG9dBW|ivB`PeeE1FRy2;6S4up*==CE`;BCZLz3(UKFhzYqOaAGWq8~Md zoH2C$2~w`&)byQYd!(z+Cu2QnKGm^y|XpermnZ)So>(#hVngn7EAJF2;= zP7BS2U|cb|X}$_?z2?Ydzrim2NE>>UX8eYB#77(fMuiQ@Y4*Vuqdc~-96Fs_1V3Q z17V>Y_xyzvQsdh2g{AHeoe73%;|T65B+486%bUYPr#CUts@i>afi8B#}!4 z=-7Fbw!Kz#V{pf*KJ~@D#3L3TcUG5K-4N_l4oV$61svX)h^#9ttQr0}MU$SFfV8qc zqkwo{Sm!U-aiZe!AgExo6a4KZ#N)F4fxx#4NW0Ew$TdUQc1p|sTj>~-kvtFT?GTyj z@cVC_%xf)4U7lAOX7=A`SFAu`a%Q-v7V?dHxgB*PqBFq>kqtFmYJuxf!&Eso`Yt|_ z4IEH|t%_@U54=)#~mSBzMr6MUsv7?nD7lgWUP8kvM(tKY;K=zAIQ(NvS#hSk4vPyo(alil76e% zJ6jWSF+UMOEQHMAc+VUlll9rP=rqBto=j#<^!x#RZjS=$`eER;Lk*o(?y(*-TZYbi z1cgdc3?Nt3b7c>^UXa_~z>aW5g>*V_BCz`+6I2p}FH-qy=(Dk}_ zqn(E5ec$%00Y()+6hW3xl*o2J`q;e!2#cHx%ismHc8gp0?Rsw{H_}?|Vr`U|9jO!S zGUYI{;wYwB7wf*Hy<2Q;Qb9t`FFhawxck&lS}wAY(jusbetS7?@oj$Imxzp_4c-s` zXe-L-8#ZcdUv8@`AMj(Kjl-$mB3v7-$(6;sw8xD$UCR4u?G>!UY;UxQXL-Hc3lAgL z;+=Zd%g@wnQu1~g-uY<=-{{Aj&k0(}^2)P)MX$)z}u@*FObIhydT9b4uZ4>=Wtosn_x9C*5Do1U}&If z8u&iw{T{8)%)-hKv+!oSfkQ&Qwq=E#mDVetKT?*p@_NGgX?(K{LVeB1DV&kil)8nz zfje&}FFPh?D;wpBHQ-el@Rrrt*WSqnwp{eeiz@LQt(eRBA#S%kXt4eOPh47?P*A-U zKBrEM2zMjZ2hSR+xFT=n!v(G82An%m4Z5uH%nNEi`uv1@sgdhXC;XU8quFQN9|<^E zc!g(Qb{nmY61v(cb>KS}?Vrc*#v+Ma@$Tg@lgSg6FJJ!J7&wJbY`AV>!uY2G_wVdS zZVew2N#D!KJI-?#3S9=2)YXSUKLp~I@Esk>uV0GJlVj|9(pAJ0>niLKd6>$bXi^Ea@@Eh@gzWuU^L-cw-x<9^H0 zovsD=XwF=QpmL-+is2bB*)o{ea2v-acu-3Sqf<#3eKAu z3wvF!Tjf;E5%hSggi$tM)KmvoW5;BKbE@SPV3uy!$lOeBtAxKzc)GCejeBbMCGwQr zT${J;13S#Ucy6-5rd9Pv$OTJ3O~Umm>@i&|)6mtiYy0sdM%Uwvy!MRD7A|||ELbVm z1Aa+|P{yrxZ#$m79iabOwaNbuRN$?G$Xn4(0`<=&gPoIeTD9@-Wo!4RlIHgB8~2cv z>eC{d14XOo{nc1?#JnHt&G<@+PT*{j-?C2ec5Xz|2=gN&G?ha~9%#QlA!HeW8f}FA z^-SwyhTkF;+>Z3W_#C46b@Q2w!$N;fF?jR1tX*!=Psin4u*k<&`Y*_@L?(wA;50-B zB(d?J>GKP(7vwwMInAh|QJCw^2{6*{jlaHCcj_u$Dk^bDAt}b{(hHuQ>(mS0eix%n z0d(?PSJKckS5i=pid5AsUV3o8jCsV+`YNpyL;QpT3~U2@k$7&HjI1c522PmMB9LJU zya_^lq{7BmWlNRZY1b@w67v#MXe;5ukO&d$_dg1W`)3rFt#wq6@imKbH5N-)GZKaF zP(h3MmDc@QjQE9zRpV!rk55IFIA{%5`c0ZH4!w|p#5s%vKKAU#*s7pn_W!wXe=|1W z4IFO*EVYOAHtFJ5V(5&F$#`7H34mGjADeF4);KOFyZS)rv;0#QxsSU1h9>WP*kTak znn&JRLs^f+iM$SN`bK2G`2kJU(;l(nYNpGjwXEoDpdEiQYS_9NA9C%u@Q|?gm(h@x z3@zt(R|KsaBdg%)4vsG{@^Nq4n?GXP%aU4E+j@0zPJ!6js-IjfKe?z0w8ZjXYtADR z?TlQGP-=gAo-^kC*stB*;>5XMA3GWPl3GzDFWIyJ7I|ZoF{O#@??E*o$^8%@J2JBg}Q9d*oACqQ=K+zvFsagVJ$3{9c}1l#>ue zP$tH!K#w_-dJBfOAtJkAcCN%f!RtrA!E)Wwh-7SoY?s|1=Y$euT z+f0e~hn97U+(gE5*{_gi^>u|?4@>%z#Xe2CZ!CKs3V~&YwDj;9#ZLgmrWhl>C9c2INmDqZYQ>wW5f^6rkkAR@HTVlXL#-)AzrUVoqCZvi@U6XspdEbISwS>OISCFNkNs>6)q`{nc zXT5MPU7@^*-VN(=!Vxo;TRmLyAw?h~#G|#AccY0CeuBMf&`St{#gy-hSlTganyyW%)uu(fX0_+GXwRp0@yShIDQW)O=wT;<-EVsqu;5+$2rI zKjs5og%#H9IO?DiKzw^|jJJ|WK+jJy(6EuUln;5fah|m+|9iK z!K!$M8n-=hGHgG%=#^Ax?N7GaN?!n3vxztB)Vkex3xyNebewy$H253ncQf?C%H1{Vh4(6Wj|F>4WDO0S24rAiK+<$FmJea%t}9{Yd@B~Z$V|D zE8RTRtm$Ask>W~neIlnn#I@7@`bEDE!QbYXn>FdZlQ)B5-)vlv;2&UM#7{&XBslA( zePZ8$ECEnYs#{!N$H(mJa-W-yO!s%0#%6!On@fiIqB|JH3xWZyn^D^|%} zogXr|48oKK+L}lmRVUBHsy7b4N-40q44YD*>MZu#3a#QKYQ|Pqw|c%{j$6gC^crtd zo}|8g27UNiLs%&C|FTf!_JCvT6Ycw&0e(nUwx3_$KvwY9IAWvpI$do4%uqtHI{;S>~#LyWEck(|7nM9-@aW?nS0A9w?%@E8dM9nNf6)L z(p6`BOb=X~AV09LFO;O#V3W)PC}nU?10WJ1f?qb9;M=BEvhtr~ zocPJcrjlAW=j79F_UjMqKmf+MbDctcwAOEH7rUlH%?oyaByL+~C)kFqfYoM5g?PmS zHlzke6O4s@PswD5sI>chx$kD^TOh&ghdH`@>bos^3vMU!Q2em)MHa8fDE@o;{pIZW z=f{7uQ2))%bnUyt>z^y%$#;JKKd^cKt;GNAxcdKYT>qau$k0*5K&fi~veVky(Gl-D z1rxQ_Mvce#{;IZY8CU;x2g08v8-y&_b>R4dXkED;A{s;Yp#)>a+@i{ww(A+r_jXOvFLj6kY+`rp3H|&>{6j-EY9hmkQ%<@;T~6D;2I6G*;!%DvI5O2|A@fcLR-jTgQ6xg9uG#B)AYI*dzlf@5R+Z z{{oP{=6>AcnwFZnfcHb#y1M2y`A@uwiHRwKPgrzDiI(96M686tx$-p#AsR%&OzD>j zE4<8sbh(hE;k;aepc&yeT9IZGHU9-m#cI4F%;@02oDhOqyj*yuFRrGVoCoRO&i%6! zE-;OML+X-Wg@kU*#QTYy1_hw`Z4f8jjngY4N9Vo8iW;~@>7Nbq5jAK?)Swshq6TU3 zF}$JmfY59~*|~si_Bq-?W3O~VYzhtc{GG+SY_CU*y_Qd`y@;9i7wGHS<^=wIPf$IA zPNEr#Y&>oh{arA=enB`Dk4`j%AMG-LPK!K>p&iNu(4X~s4IXLfSpmh5ZyBq{8i+!L zukRz_oyc)_xXQt2x0`L(wGdPBXd&^`Wgk+G-VtXwebA!!8-E=QC3!i2K@R99%N%u z3Y*cYA5?=8fN>U0n7=#e+PSp~m-cYm6hhqu3JxZB=zaLmS#nynP%Cu)$kekB`mZX$Hrgv&9r;AZW= zzPnLBqW!jc#AuaE9FNju^~NzCXFc-Alh43+v^&{xKr)1p7xsUaP?1-IQ#_8$?B31WBpNVYT(92Rr3{JK|tv z6I>X=m*kb)8m%gJjN`1K;}jk5O6&$OvJ1GEZr5N|!lb-Ne29xJk?@{;(KOEZ)#Vp2 z(dMd1dv(KCrMiB=fhklx#RaH$O29)bW)=~w3$CyWeXTg`(ITFfF)jL3(jxY=f$=zS zrU`J<`3o;hk`-mkG+IZEA3!&Si}LtBv7HL1ey-#&$m)Lu!`=5yU$FFpfcdI?M zH^_XnFn6q;c_lxxry@vq`MKl#=dmF->D7#k$<=!!u&F`8H2b%w?@K_4{v8(IEmpt(r zI(O-dj&0Q5qi1YKur%GtA|U4139K3go3ji(=E`x&yu{zy@1)rP0A7|v9%}6Ic$p|`*E4|8*xkCfE68-hZ>Q5tc z-^<}gn5$)!Al8AY22E0+x+f`M;vx}Mqm*pBasIJ`*0N-MkcHh8^hD-fpsDJ&TQw>9 zAD!~1`OVh}FBf1oayJI4T%0@j(YRQRdyL9VXw^Tf}0!yQbNa>FPgGVJ~`q$($Ww4bd{Llzm>=- zo$X0rK$aHTN`}5}l{}bHao6Z=bcz;PGOkI^A4oiZFAB*rDplx~VvZdE>>Zg9LNt-U zWY`<lH)09P_nP4|bA;viN`V1^9}MWt5sWt!T3(G3+-rwA zd4{--#52;SFa!JAhkoXf4|)1MnrI#nWJQr6D6Kh34%4Vf+ZP_glFXiMGK-2LY@%0^ zyo@hyj7N28zd@Cd{Ndwudf}POUICY$YLlgMMp5Dj{^gRt$XHu2NeeS5dxJ1C_aPW*Mnzhd0X7w8{aRM;>Gp}adq9; zl;F;`=w5H;eH*$6F@qa@v-oY`VqZJay&rcz0H2Q7d<|>o4{)Sk1;K`91G?ugn}3Z3QfU^s?F^5OKydaQ*If-Hrm!}2-EU5-ZTZ* zC^|89I`ZgeiKG{~O33^crnqL2M@b#-TbV;VktR63n$F0CeBQ*$1n9t%Z7%t-3kIEiK|c3_xhHo0hqWTUMAXK z*AiebiajOa=!* zLz2ASMCfy=Acq0OML@c7SE|~{!*A>o>l(rC>Wx&%NpS^wr>8I$R}wVE@5I0Zm0OIa zvI+TcQy1Eaw2$l6KFKOUG>P!`0<_XoG>#DP3B_&;=|ffINazvqJj#&J8w*NjJi8n^ojosV1`;lmI=!q+)elonqa+*xJ#_YeYylE$F!v z9In7Ux8xPSkl%=8Z$Y5fXit7jcHU`8-XB-L#mjbfZr7c8X1=tp9;8d247r5(uvkA@ zl_#7rsTGQ2qNv4Y&v1_H-UDOjnE<^DUZp0BUJ?Tf=qQ=9$8HMZ(#_B=+mF4V?rA1Hoyvd1RS6Bx zVs#Z+0L`~|!Z-yP6n~YWLKICLCmd4AZq#*Q=0q;OnYrd@3n&ET($u&(&{)L!Q% zjZHqD6O9Y|PJUM=vK9Qs{=xMGu6OEUvRcU=+(5Y}$D23f_vAV^6Xu|G^@9Q)G{LW= z0;t(yog~a{^$Cf=-P%EWp_%nj3=#PN8~59Ai9PK!wVuiA@(#spoeP62-G(3cd&}Dr zTBZ{S@Lfx7g@K~WtWXIfL7^MtiHm>G)aMkqkWS^C9f#hchnF_gv~egltj!au6_x2!h5q<# zO&6WfGC3M1zi}*hI}z+E%!+coBMh+11KIV^M$x(LGcE6o?`M#TyE^}fjnq^ z^e6`@QR@9v-=YMy!17zO332X)dOvH;NF_;>xC-%mSd0&)+_F0#HJILap59>%jO^$0 zAz3~a#t)h}0XvuK0jDyuwNB-@C;8o#&zT)2kPw#egUbWc(`c=TisM*^c`mSxKflrC zm#pK;(#_no*)U*qQ(dP??T6cZYCy0xOSQY{%fS`v{Es!D(0E4=Pd{V&v2GnoM%xF8 z`;eZ11k;@B3f)HjY71;j&J&W4J6OGuf_8{#=(l0Lgz)F$+GbNt=U{8E0;5iz09t7S zd1VHfel+iS=g{6W6aF-HP-up$etR-4al$n?7)amHpPL%?$C%3x5porqFzIIUU->^> zeM#<6o_DNe*Pof~jiz}sDPFi7zZyM;z?Q1qmdq)$+;PU8=^>D&8ZyBZz_!o#W8( zdR^GQzRF7Po5~(Fu2lvm_d>(9>64GqQWm(8>BdDTx`>Y#-Y>^TPGq!#EAp$c2T%G) z4mQU&ewaMq%xSeK#}M+SBAg7kt|G2Brvb{70cH^PBD-EhW7)#Lh{ul#P7C!4xQfIo zGVqJ7r*epS+72K^vK*VTpFQ4MIMPLQ@8g39zOB^eoIQ%2yu2*Hv*i#5Y@$1H`1(`E z6gIj;fM=Xu73>XxYT=QJ2mR?ZzO&>hx+nb!5t74}pB}Xz)c=bP&jwLs=o&}$duqs`07om26T7r%IEmL%H?p6*~4y`pP$fG{UW%gGan4vcpN=of~; z>BD(VH@))49L>yf|m|3K!#^%*cJ|lbL zrhbMRZf!ur!kuR^a31o^Q6dC>(&gac!d)LUn5+^S`9w{h6HRb&>+7s0; z*DgIF?MZs%^WJQKSK#d{kc3A**V&)CMf;v7g|F@{d1f+WB|gT0!HZ}?mLsoMTDP%y zig*W_JLoLO0oOB%eEx$3=912=BOOF=l&%v5)Vu=ZN({N`@~J&Fs6vkc+~W-|QB z`ly-=UZ!|fbthT>oFUd=q6dUk)!>04cZ4dqhIUgZ`;=X{p?cU`h4t&)#mu%=M-8e0 zQ&!zx-$b!pP|s@+EX!)*(`#)#t|yoYw+8@*=>|-&X3we5L!lwChXmP_AY3Eg%S$@I zHs}dX&0(JTdTf64Ji|(*yU&tgZeJF;VYA1#%~Ya|3M|_m2KMbh zE}Enq{!G3E3K_K1_Y?t;%gp&C$&8%{%<^k4hU?89EH5rWlS$-x(o2IvO_9oC zd}6Ve#PQRBl$r=by3ydu$)&8UYU!r@{4ZAe5S^d-0AC?$l`soHeCjJAi~6>Hw1sE0 zhq+B!IxNIlP?*rm++>_7iH>ZS>{EsU&rl@y`UTKt5ZSyjlq0gO){(>hax1C~bGwdT`H zE`fYw;b-XlkN~tj5dv(vCIv)Uw$5YXEJ#NaQ5O>Hk>Sm-(N~Q5Npzj5u#<8l$Y3*X za0X^}TA#H!yB~hux~QPKml?qAWqNoj?+NRmeKuGuAQs@*SJ_|8D*d}(9l8k0qTr{L zH`$2&C93wnx9o_y5}L2r#!gz8uqy@tz1JL<=uIF#i*0*P_$uMRzKj0@>oJ3K7GO7$jR9{%In%@pk9# zpt_4s?IBCV0k5BmWwgEG?oqTXF<&q3@f*GAkRSs3Yg%cnMQn2BtDQF6x~*OnCOWuA1@#oG-gh5X@Z8|t zDP3fJczHXq1^Qe|B7c5uM?TfSQG)}^F)>+xKX6fI)cu*k8t;9N7ISLK1Wvk({*qD> z*31jSN8!k{%e8KCak^;pM4gMspJJp9B4mv(AU?*D{ztA(B zNTAyqW87`A+x?IRcX>Hc6^5dXFE{Er`ye~>8k2Z#2W+S01X0ha=WrM_Ji{y*Hz_$d z7Yn}bdbs3bA;hQGC>)~Sr<)FUt|LWIPpP2n^F2(MGR`w|WL2DV4sca3;H^)JlNBaz zzSSwsY1vN6zW>uH1hV;}O7yupVZWtCGl;#!SpH?y$GPY$T5iNy*|}Y2;)08(h46eG zFSTGED2~q)fjj9BgHTQF`;}O6P&oqeE^OuOxja{l=NI`$RoK2@W$9A-z2!P!sfBm?qoJQ2! zE62>1loZa<1e{c><`*P@?0R(%o29I+*i)Tv3Oo<*%4gn5t{ueHd|@YKf@9v72wv|w z5WxGy2{_jwBG^HPaENDCll&rqkD9f@yx=tufACjll?adCd+@2({3m#KkG?kJ*=247 zJg|R@-q2_d*5wRtu3aKM@iWy<1F_C8YPoRPX>@cb!l)JKyum01wcmoBc2uaqbo*mL z2a8NhU55K$d2Kg^8%OOEv4HA4{k)+~$>Bc!C%RFHFtMV`AI?jUuGdG@J$rVzZ=;=m zcT*uTTp{{)vn;J}^|*dN%j&Ltb@v(jCbzW|eTn7Pxurd<&Ok*X6m6=9d|~gwh@kPc zBL;zQXhx;%w}h!awnC0nsu~;mep0P8Qe^NpvE|{HzU(4Gg#L6ipr5UE2n^gAK!C&7 z2>OjHM{=V-F~R7+=07^j2n}-3xu@-04MMlvDsvolC}HQX+Z4D$^jb(CG_W%} z?_#7cwzhkU-1%aa0XJ;AoU62Le!Ms1iI(-rV{1b*0a1h}=Sa@FPdI+t!WO0X zlRt#=r09mMhB6rSOmu-gaf~jMMW7++cUt#9f?|DCt2YLq7XnR!98OzTJ435SzkWP0 zN&^QqJhojLi$F|%%NNv>m4mi%eMEoJ&w}R+|+6-WlpMZG=A%o>n;dOqW{@mumy} zGSx#rT~~?33kRAmNTu0D%?-yqo^qlY@HC8Esmz>v-UcQ$l%}D=`Oy}= zoPhdeqa@{-p0>{5O5(NJj^I;%Yz zqe|agTdMSSo!}W81NE*SxlDbO84mNILG)#Ml3Zn6e}f&()Jr^3LpKzVJXxdSC0rdM`ZZ4qk50-rU(Xe*Wqw3qqcAR^+_d^{>Q8exaZ;d?w`FATmWK!kKf##mxxpkr^_u+3SX-x@O&j z`fMv6gnmUesVz56_E@5E;UdQ?-BFudgh^6%7X&lMyQaBw3KWY_x=P#Zk;c>fRS8Iq z#2FkhrZg;$P}7VNO?@0-kc_S@EwY3rRVdF@jV2VZpKjgL{acGR-Nu}iuAF#Zo2T< zA=PL{RP!$*+s)($j94kihC1q#Tt$)~bA6@UF>}nk8KY~{+S*Ec@u0O8I)ZNHpFZ1{ zs%Gn$z0M@?*Y5-Z!x}gxwH;#lGZI{3`2$b>Oeq-N2(r#Bo!qZJYBC(U^m)z~#`ul7 z3cQK(>%O!YjR4V12hihDZ&*1(=q?sk@`P={B7H?L=WCJ&9l@Q0wp{WJX2cQC)XjBG z3~DEab&L~hoawdV>!a_z!ffASV6Q*Qc`-1008_DXiL%M~=nj_AIObtsmE8v_>j+n6 zL*t}30@^yKz-L&LKqDH@_+`$O$lJr`%VlVIy3b{U{M}oTw$CXUY zR?~Srmse85aDw z9#T15iL6-WGMtuHiS4Ns;$MV`iuWrc3DxatMtUK$>&f}%setP_UkJ~e`Dc5&pk;Hd ziKEJEx(zrB&vat@;CiKaV5223k997SQt$BSUPzr8ePfi%%n}B4kBSukO{YVfCe2yY zDIbJOidS-_leKjb@)F{i9^FOO|1GW(5vx-=b?q?XVRK+_*ssf^+!oA=HLp}BSR3i$*t;qAGY7L384LjDB*&A3;lSz zUvRpP7<@J*+rZ*_em(pVIK(6E77tiC1@K^r@Fj;8QrUAt=0e^oO@FP0Fs)% zTwgl>Ryg6I>M^uk?+u-y9mVFXus-nRO+~Tea|I0;(DD87sJFmloEgeTVseu|n}%uU z!49T2cd0Hxzq+#xf{Xn?kFvv-D0BJl{ZiU>!%0Qz9P-8-wl;ZJ-yp7*oRGE5^9go) zPy-GuFo5AxG1RS^twM#MROeR$as16DgwhMuR%^N5t67>K^bn{JNH(RXmT#)l9x!Z3 zP=swYFKg;`2r9}YI^!oc{87*MVjaL zdPy{JveX2E9l}V3M5=po#9ZEAL{=3bYf_Y?X_`gP_K;;UQ;!TnGy_zg0h{4Qq@}zl zsKV0MGcd1ZbxlVfHC=A-9aY-n(|+-W-sEd3Q#AkgBcjCQU{`JL<+VdHx6=`hnpdb= z=C-(*i~JdCXTN)fVm@rJp**dmgc%;db$9KWe+{H2k4wv`AI(j5@?5CJ5}y_ z*@bG*Q3s(wPv_3ihkaxZDQOqxouxy~D#6!pn8_WR4IF6Kp=x|%wxg(+jUfK-2+*&M zYT@$j=QAfC-2JMi)+lC@I7(o8y@k&=`Xsmr-sl+09!awDSoQ0oYLsp>=Q58IsObQlX`rl@qyY)Zf)J8(yHq8LU4)UNpIm57&kMpYyK{pE zL*@^^ouiL5#FbpZ--Dj(cM`@?^t^qWaAXjC%84muaJZT3O6gx zbBJvv!Wb4eEYcW(1YJ4yp?%41_&8x6fnoK}?ZsiHp$kh*09UNjmw66zLTCzq#Ok06 zZvlQ~dcE1S)b(yA*dW(fy3seqDOa82SzMn{+X(#Jyv)*RXe|6Nl6T2F|CD`xvvRme zjbJyg;AkinPi@>)D3$7pKZcW5ey$@?&fBmrXG_bMqUGPn`pkAPI94 z5U6}D-PMH%F-h0)Ovr1;W5t^lPmudRyxvnx^N&EJ7)ZoWxAX3iD1&T{h$hfLWW`=SE1g_K>1qq z!KDU0{gw&&S&WlkT@NqiYtzn9_p+aq_ZL(7!*k^MGNKA=e1i^B=w&_1Ve1L`8x$>{ z`9^z#I>8k-QBN&jsWty{??^qGgm@uR8H(Qr@BmlALwrEbn+(zBHTFS zG2D_%P{AiWWq1lgfw1-JUGeX0+uUBU>r*3W#44_AU!zBRzq2;Y%b*!Uglet|9`QE% zdp^*m0y!ilxW!-S#8I`rO>23kQ`F0^9Xq9H?gnI$wfdyTR*1ZLmB2`)4{7_p_lj6Zl~fp| zwMi-6#O8qbz32I@6H;6!o~(xIleJn#5jMF}P+{MuonmKhOYb1MuXd|o&-dYk-KsS;msBim0=ag>se+RGC6&aCa&wy@a_Zj&W-CH1h*&ZU z>ChJHQVoGg-LYG4Fp-qRr413R9 z@580~e!@jK9gXl&8S%)>Z_Eh}G%5tXykTQgB#ILf0WH2)<#o2mb)y-8*I3%NhbIoX zGl)7VN8gt1QjWb|ypBf0$7rSmfw+Ks-ZG8pR8%PJ23kroU)JD5zkSYs*FSO@OdguV zMu4)>iRKJqhBKZuyf)Xf>n}i|WuGXl$y|4_Xh7_|9-{}QR7?f+Ir6#%A4~pcaXi;l z19*#~7^tIv0VFPHRt9IxV8UZSW27ju+}yWsEe(4-9XiyQ5T~}5mhrw=3Au_kfqpI# z#}0}pUBoOI4`U%l*|QB^!%ae}9~ZMU{E9H>!!7*U01XgkR)R3Fz*NV9zv9$xv6a== zy6Z4+EwavD6~$8B!;}#~<804bxC;_7@x8=CVTBkU88Lm1>aZ@PT_zb80=uPtM#zH~ z{s^NJ^_Nzk{`pF8u@hvGbq=h{iS{6Jh?poo>Z*`#upXd60I-r%mLqfvszeDV9qe7g(%M27zrvCx3Bu>%-^;#_GJ8L5 zyYF2cJWA&Lb&sG!(F^;$BG|sH*mFI!3@8dg{eKB%I<$Uq0C1v*mB61kvvY0G;?GLj zAVjfa${Usnk)k}&_o4B8PSR`B+f6|+f8nxh5Dz;lZ$d)0D6d_PhpOz8;yvg_H^JLw z`S$t?WYo4UAM6`p1c0mM=nwz1ye&o9MgM~Jd`J7#Z1E3A+5a+@^#5{5-k;HgyZCgt za2V%@tJHwU`<8vgcA{V36gyEp_J{A}Ycy;vC4Zy!uO^5-A%?9T%IypFl9dgwD(^BrEk@;8sS=ozoU$2R+wd1V*$zCL|7D)=Dp2kE8O{=*zPen2!=mLr@e zjJDqv-cD}SXZ=_0E{Wd0k6d>M zV#|H~KivKWuUi)QpTR;lXCrM*nwdVuau|K%%gL3zPHi1LCNdi6uL?#4jq6pkQ%YvSGL$6-Ip<86KwQL&f#_kNOn?o-ykdfU+} zugI-ybmf5LNl~C;z7q9f5IEeg&9EeT3+05SZZAB`@=lhfuVC7X%Q*u4fhgSa7I6Jf z+_V9I{YLI;UjE~eZ;{a8C>Kq=0c5}0Sc#)%=)`owDZ8{M`cAQY_=B1c8o~~bwhpzq@fY^FeiUH+k!^ZS%P$B|+%X7b&pQh-IyqcUgO26LsOJyH1nfctKf%*SAr2q7OD$j5h}#Ig{H5 zGaOsQzofD3yNBy*s$HELtbFadnmPz$vSu+_96}B5QgP{cn|_a(Y@Yu4x@S|aZ!K2w zv^lwYO{{-cW!IR<1gKzq;S4R7=F>`l^z4=ji#ZI#cT`3*|3%^4)%iw1OSkfYmO9t~ z7Vu=(6;2=};+Z+mEf>g_DWhAG7ZqhJo_M~-65D3wpyL?fe3||D zQhQ>5_vnQjOp#@-o{ffeu!FaR-d0xBKr=R+=E4kKpIrZor9 zC*N1medckqOXqy(ksq=;rX+a#kCNbJ6xU4^3TdM7R zu7gR}_!fIFI;45>ak*}MT+DTf7KArDmN@%J+jJ_UVJ9NzIr~J%YZb72WqM_a42Klg z=;M@^6OaE3CMT-jTZ!_}6{U4K`*~)`9zt4x(Ji@O1$(QWPL6%7a#D6t5X-0O8)DHl z>uh_uDtBK=zo{KShk)h6t*F5p#MI?$XLz51^%zCTwima;NB#jUZt1SLv$Aw9(SLS( z&6?J?g{S0nW%bC1(|;_=L=vrPY@+1z)*a4m)E~9z#xgMsr6}yArG4L8GbQn=U}w?5 z&a&B2bdvV&?xg!`@@%h`{T8f22rD?2`1zEqW!ty1HNy*?H&YQ|x;OQ?Q9N&qT4lq_ zi_LS&RG3}E6d)C4ORJ6PKNeq}wL492_2$JNui-w_Ry18n-qY}q#?72PORJMIbiJC% zh+6>zRdj8iZ({9hC*I96xJKao4ej3sUq+%!6j8%WhR?DDVf-Fc!uzy98_<{Icas31>8dtrWiLDD(eZzy<4 z^OR@lxR$*8p*iFD(V+k{z;VQ8Vac27m8q zMPKP3b-%D={BLsL9c(UzQ9Nt`oU-`SXZ`&;oBW3gh^KvTo@K+f^7j09L2P(($XD)- zdh+^#@u2@v-j23hgz~u`WnjBS_R{|#!oO>l@0vmrxjp&0$dYgm_;0fO&p_}Gs$Bn0 zrD}YOnLAo(>+XNhG!KL#y~YJo!D;h!%ROlut>aP$DO*IE zfo1jJ**{3zEf7cRA94Dk*1pzViL?9BJ%3U#{PW{~7M1`1w;1~W4Gij!_Wkbh7ZSF! zvlIW;Ep}~fEj2xTeu!5gqv^Xm%oE!(uKzs>9n4&6W&cP+Xsh71vc#if?2V0|@Ghw8 z>rY{)v?ri_y}j!1ZmX!AUDe+AAPZmEKh6u>_e5c7c^>QwK5zuh>xL?dq~ZE=b6)R! z;s_yl*62yk2vF$jVng!3%?FQSR+j1t+tUR`;mRgmQG~N;l+aviHK^b9+{_Fwc0f54Zoz9kZw=&Fk{ z9KM?K1^!K4TuVT?=X-yg>_op!MEHcw`TE7=q>AL^ z7-VD%6~>C&#T`|u7eEssU2x}V&c&?YnRl7)O+iNXtzFyjMtidxrfTvrg4`E1X0wO7 zc<6s<Bl|!sB7MnaMruVPf{dr@!t!Twy@NCgJ7KE`~w~SLxCD9Dt#vOm_HYkAZVj1dgC@w(J_j8;^av!>a`n* z+rm{I*;|S781ZUcpg$5z?+a-D89{`yUHD7{eDqA$;X)DT1|+MvvzwG&sX{nAf`s0X zbEvlj)@@+|fQ>&(BI4 z*57eqE*$t5wSBB~h`0fJpDsJCPa)goubp2|WY|Aqo;8AqgfV zAqh$D(fQ6izvsSQ&wbrLo_qN($%}LL*=O&y*Is*l-mBgtE_7wGV6JeB+=!47DTE-) zS=O>_oVIwZ-hn>mcWZmCe@#&qWzJ}bl6nU-yzl98B~?}Xt5+YlX5MARe6els*)rXJ zUGFhFfgev7hg|y7S7~ip6G?jOrjUBO?JR3?@!I+1@=#px zOa(2Z@B4P8gj*c}1TF1E57y(*Cw)kewWKd^`%#>4r8>$4FAH%UU;3>H09Y1`v^t1~^vm=I8OUnW}6B?VG;S``Ywf|0%__ zY18X=pjUTq(J2vHPSj~l27Q}C-LbWjd(dUWU&WXOJ5iSwISX)hoh$zfhOdfDqa1Mo zwZp6*2@ETMIlr)w*{JMNc{F`cowr?Sb*pJ;tOxZzI|Cs4jO`IFKT0p$dNbSJmkHJO zyZeq<&U~tLh9EJ$@8j?_iI~uZink}7<^SzqJ+&GQqmRI%`SnX^H%wQ-QB{)N2n0!5A06%@TG zxaDx(O^2pfrhV)^FhvIui1u z5CwtN%+HC^#{7pd^tPI)%dEV|F$wt2s(v*;glppNv5T3ah47clsB5*xY_c}^WtJN( zGt29Wj+krWEj*B=;V^$dR$$}O`rT3U-1wQ4u;xMfm-v+W1)zlEHk${JEZ1?zBHh2r zIM&^Lnx-a7B*$+Qfm;P0La*D=xQ+H2!jukyF&_3u`Fds6BvKbs#L+4GrD)M!2{9&719!{>+ODeBPr^iv~5K%iT&HUlA0AZMCmv zo+79sT&MwDs41~FScO<-XCkOg4%&jm-2-Dg(wlifjROHa$_o8tz>be#Wty%Yz3<^s z4&axbO(?61OeALaHgi#0G7%+A*e}!UEb?h~vjPGL^!?}W$}Bj_|Mu!h3?yHnpohd8 zl+x!V_}2zSGKL|#T3q?<-ro>em7QB%f2nZ@%`4S#8s4xu>=kjelZjgX`p2!Oz9s1u zpo})H7I?qvzj3SgwNuz*i1sA21LE)kn0Tg#uk~AJ-}N>lvyh-{#~TkiI)tld+2VyW z*aSzl(2i^U=^j43jj2d&qt=^RYBy`I?Tw9fz~mwvJDhLzAN1x_*Z0%@K^X#GG!ih> zl~`&Qo+xKgH@A1hkNwmf1HHB7ot%! zH5?GT4SBzLXUit5Uzes_g8Fw1%!bcPa&_4 zt>nYn`}-0u#X=ih?S^7#&QY``(L|TOYe-|)1O$2DzrU125gswRfMR!S{rf!emulj2 zakAy8or6mW0F`ObSkv1kSe zX8Kf!0i@H%Iq3esn^PXSE5@P84?j_Ak-dI<@1}?6R|G}S{6a_eP-_i(3fzGB)f4q@&##K33Y5I<@{zFz;seJN(?tD?Hg53Xf8gQixA^&y>5dQw} zK*RsvI^ci#Mn9w79{zuCNq_hzfJi$(?mZw4H^;18{=ub^1Gb^MEAP7gDG&rKmA*gp z=3jgPk@YnztHmzSw)*<|l+4WKG7d~IE&5o$$U=osZ80$DpwE9^z@{6v9{^CsK8J0! z@6>d@y*37PBRwte|8?oFSO9Mj2toiqBkDF+1H3WNzmc;W!10ANY2m-7H6`uLKSL9^ zyzPIdWc}l%0l)k|`OT9%A3G?oO;29ULUvlwSvR8LAh+7ak*YOx{)|BfPACN{P45ur zyB-!+(8V)D|IkD?MWLa8gyU?}C6~(fvNyhUfV)f<_-ZycsGdqfivw~r#edy2rJ_$R zz{a325hN-|0AXKaRMb28J^>qE(&yB1lXUPm?=Bz=3c0M*1R^1BBwB-(S`yf6Hrde( z^%6{j9j1a8Gg=0jfDEp`+#7VPxMQ@HHL*;OpoZK?E(+Vx^!jqH@m@& zt63VL9&ArX-G`z0lq!$xEbsRZH&bSBIC5t77uI>Lrp~vSYBnwn^dljG9y|6d6|a>r zd}p7bbb0H+HCQHfX1yp-w)y4Z2TgPF6^@}T7}v63m26JdT+{o8ixO$qR8Ug^!448C zV~;;Rtr~FLE&y{DFrlP?+rA0oz0F+^BrQ2oZhWZ2_1@v8yN{4=={W^^7m?RdJVZB7 z?%SN}X4wH*KaO^WV5$u}0mu|X2Ui0r4JpG9zmq2M{|Wv8+nsXX z7zbt7v2o3w<;Mpw<87X^!Z)R&$5)npAC#uMaX-$d;&eq~E*>_5#A^xfx zTecjrzc4)OAIanJ>6OF9Ur*%Tzuo_-9DT4TpMjALW6Q%IoEm<)nmXN;B z`JGu-LwSOBqU`zVYar{z6Pj!Jl45lP23L)1!nHObKQ_2bk;C^yQEf^Lyi1YIW~$zH zPVsxy>^V}SrpioQxsOHf#CPL@(!AHTp`z(Wp*6CRMF?}bo@mFF#een%Kww#V2f}`- zNvGBK0ZdLMgA<<+CwIv9>at2()Ul+E3b!a5Cv_+@nlTpe?5}K9IgHY>8Od@%5-iK-IzQ#U)LbQp>Cc0(WsK?fKOzQ5gd?gnM`X zkz&QO6QVwah=o!coOtPvC3a1HNQN%ba1!@@G?s=!_!z^{59QG8ic!PLiV)F19vcwt zhg1QlZZ2!U%;_RLSS2kw6x+)pns<>LZK zCd;j@XA}3VX`qYSWFx*Az|j6dXopz zCG$dV#C$pX(x@%qSLJZ$+vvT%LF?xbAS%up6?m*edB6)p?Mnj%6=@@u&c@iyDN;za zX{F!<=)JcdX+rWzB9gyTT=$5VwO-{pyL6h1cIdv5J6(IPNO#m$Z?`g8Q2W^QKxCr) zhKcXpK5>SkAmr9Rw&yk}#ol)vQFPD4AuNaC1j)L=(5=;ex< z;Ge_8_p{}`0L1d2|KHU1HY>)#B4p|z)P4Nl-rH0uf9(HVOy>#!GWmg>{69Po_K)v? z1eeATsy%4?itLZ5L(E>?&;OoDJhV*)&T<<(Ef&b+{qH{*cI~MB;p%kl)f*W4w_z10 zeqxtTsj5x@tI`rVw6DLPmHx+Vg_;&Mwwa@2*8ZHmf^B+plwo5jI}?*Hmg`{$F-@{%6W;yeSp9lnfeNf9!f&3w5G2_#JZTm z8S-m>(Q9VDU(VY~@qho(o3CF8iP3JhBa9DiN7^GgWgqN5uq)<}i=TYy(7k z<8aAM?`JCt^O3-99tuaKKpSrZ2+bAm-d%S>g4scjgf?Jst!S+b#H)asUdBi zVI-WJnC}3vlP^3!68M7fum&79K*Rnx?ZAKOj0x%7F0-z(y5%IJos|IOw-osLn4VEP zb!sG5T6r8mM;G@wbZ^9|bqsIbdE_nNsh>a()(*rNidp&MY6-RW;f3w~nFb>a0X2H6 z-Xn|T(_-nfVH1R#-umToDUB)A4A|cn{#_dvDM=q<89W#wD3I6uHgtq<4hKaYSy525 z!w<;`sO|0ld8Q;GFC0h`(_I@jCVC~j7pVdyX!lRAPI1HfEAt$BywrihwZlMw5_p=o zEq^~Cz$n6TXn+c*7yz6OHRYd*lKjQ?GXG1Alzn6*>L+g~A3p1L6#o+M5|&FCp?I6V zZbs0Wfw*sz8T)2$DT~RRX-735T5E+ShtpdZoxhyEEg;In38j>kFh98YBEam1^?bb% zX#kQ@I%WSnOk`VwzkM5S?u3I5Nv!ny2(n=8OQk^4QFnvl7^ev;t^-M}Tr)Vh{Lv>W zPa$;j4&7^J@;?t~4Mdy;`pg%{67GZ4Ohu<9S0F2ktNBn)ro^i40;AAA!bcDp2G??@ zTK)!q7kVljS75wT4z~VP^}em#ilzT-`z;n3%L*!JcRak=mpnfChhh;NtMNTp`6I1w6TPh|sauLIn6 z;b!4s1>lXG--}aRkMJAJ(W$g9dY1nq4QVBR<-i{aAW`@hhlh9I+TtO&sOZtwoqQc! z5z6qul^;!9w$ck2A4+Ji4{B3yivlZD-Ccb2r773JOYd>Snd43{hsEBM3QENAV(9K| zK2DxiYXXt3L)~(;dMck)JQ|U0$DfyaldH9m=F*W~7Jx~?dks{D%A5D5dF9RMXS`8S z7>JA8O_bWVefv`-rK>PB+C$!4I#qdq@YQ590aX0CzX7_h%=u~ob0!eueCO&1egX+X*Sz`K88t4Qw@~u7H2J^*-SO zZ+$+I=+`ztzb)X<`e%mca7A+$e*j}lu#S~U2hoJOg&HQMfuN$KbnUJ<&h~YiMTCg_ zq2I4E)FeQzyq;#B(yYLrT$&$Ti?BtVchfT$D@1=b(tUr=!FJZ59xRGR24q9h2}wUl zRx|A8*Op2Fi9$sh-EO%c#Mn5|zr)4#1p1iM^eQMhxAZ`yTQT0M|9(it{p398oSeZ% zjK#(!A4zpP-&)LWsu?cW=j9;(%S7>@k@Dv_WKM9mj~>$aX>uz*a{2B8WU5l`_)f}j z7ZyG1nR?KdKn_sS{qn0^+8uhA^@4%GX}TkQ8@&6?TIBKV)1qXX;Hic5rRpNz%vaG+ z?y_vw_v!rsy60O3k(Fi1jC6Ij07EJqOITB9I#8RU=;O+M=wgT2_AnRy>xo=&MX;LF zb~j9|ECb$su>7q^sF%Aor0X?PZ3@oDp};5E60v=uoWN{a)b5e5dfU|X z^3OmNM>`+JuK=`Xjpso!h+#kX#n0kYHOEK^pqismi11$Dt?yapV>qAp9=;SWTA0?r zSg{XjsRb+?e*`hPnkCE~NoeN-Wg%aWGt#y;YB$nOdjrBgk~WxAEsYv(Bo9LEV1Mj(RYR4`oA6sAR4O5!X`kGyiHkCLyC5 zj0hMDP;BX_P#)Q4-+mACBNj$7v- zu)Lioi$X1Atfq1Sv+%7ts-#N^aAgCbeg+RlAHkH8j$$L(K|=lTEnc0v%YqD~s0-_~ z{Pj8iW%$7Nfm^3Na#WA&O2q3LRJVXyM7lLAJyNoGA-_8;QZuivOv_YybH1-*NO zo{$F)VR5J9@555zYzIv&2hai%V`jM*3nD( zLp!r;nOk0@k~zprO-g7Oll!%=y(d9?@zybr2gwNp7a5}0QuBkEY^Z=l?e70jk|KDS z*Rn3fFUx-wR^t%9CplcId>tU?Hb=Jy4cW*simoa=e?|-ue6==Jc4p_slTvKT)L%C7hckkEsKIzQ`SF-trJ%L) zmX6y>n3)?`7*!6?sGQ`^S z^nr;3&^M>^2cnny9nT4Nu`QZ6R0kJ8N@^-|brIi3mF>w(C5aPDB@qkeaaz6w9-`$zWF@?X%i71^_l4DX2G zX^vS0luVYZ9m$2a+Tep z@oFReVIRMlx(d2nN8adIRl3cv`?I;Y0}Vw(F~>^>dr)8-SkkRouM|&H74@-|o^j<~ z)?XP)N?xYSJi~Rj!w~^F?^ErNO)&N_Mq_EEFoS(91rw4iIuc@tsRlv%Z0^j^Y|k)Q zPo_xentx3(JKNVoh5c)Ua>L$KsZwTtw@7G#a&(gwV}LUhd)CuiXuE_0!WImC{?zcN zR(Flt!+$|#>R>Y+NW9NdWD~v_KD)*lLSLetRL2-2PG=S=3Qjl~irVXY&gyfgT{H9l zPG)^kHb*)ofukk~T)tG^7M5i(6ZJIi56c}^cQ4UWa>4TBhd;-)-@L?QKUwUw1-H(r zYle?*Q3?0S(8aOjt#3N7A7HOjgRz-HHR5dTV>Wii^83n-)yj6sPktAEE#C!wW=q)# zc7_GACnHX0JGk<0ciiI;A_Z6^n=xb_IqHsL<>?(TH`ZW2jipKeodc}~@a1J(a)wXn zx99>9<8^}WqSs>ie5+i@#3{CNxne7{k%aYan9+8ba1%f}%$KVWhjHaro4o{q0hzb3z>h0nPc=G<$JC9^ep6&}G z1TBO;!N7}74*B(vX%W+PDl>U4JQy;?zC{RB-TrFSO|Rdz9Wqx!f@3b2=1g8ET3P8g zo#I;;t;}zYVG}$2aSiYdTOTmrz9GT8a#YW1l}b8M!yC6K@#|>LH;N=Qte`mT#LhtV zA(gcWow*Bg1xIDJN%XZW6r2kcc!I&@sti+c%+Om)r2dAkR)Cg~*9&(?Euwo2XjWZlUgHCNP(btToHBAyJGQ$Ui<~1(!EpNNoLn=iNzT3ixl6m5$|1p8$THd~#z))d09;suMSd$Fi zogqjt!0ewsS$wmb9VfbpGjpax|0rbXnu zro~}Bdw1emmi^>$mZHxflH839(%?vDyH6%vC!@gPk!kKoV*G{FPD#tKF0dG2kSUNyr+sIN=>_FV4rRck)QMR zZ^yw7Kn!l*OMRyt7a z#lYu=kt+77!3yKMmvyxoT5A>94^jCy&9;+7PDLbcUT&IT*&X#@l^{LgRTkdor06?a zoHyF!>i20~VXwt{%^*nN&qfcOR+}m4OiuTiItR&$Zj;=Yl*-)UQ=gCYpSmX*sBl73 zGeW_4+{R{O1Ay3-Vbw+xz*fHCd%Q1Qm+=Xr!$N9{ZC(Om1>2jK(OKKib`lp$6%dNS95O2_qiKs$1pE7Fu*`2CsI$ zR7{=TXSa{KQ|~|}V`r{-;zWQh=NAK;+c9QrcDM3YTS_T7Qd}*LpgM&TXAtZGXeV4w?@;%=bS2TUGcU3&_%(UrzZ^2lW(w}gn$zT=Gdl@V zw)1&oB}#Ob?WHLX{%WtG(lTiJo5h5j>ci{hdIOO`rrbnd_#K4e(Fyg%Xtf~l<-BB1 zpgXxn;nuEU26qOB-ma9>wJ`a4=OPg1b$G0EJiWn~n4cx<7&et+^!2^P$I!3yFtv)D~_!DVb+$s2>Kr7r@Z(E!NNgY$|(gtZ+72lo#QQ_ zjHt^D*a%*9zhR}TY@9T6z(3zS6gtQ5QVyGpdfCcd+r#CiobuEIq~l0wUj`bwMxg|2 z8k8a6yo~mZFELd8^z^iY4e++}YOVD#S(oGagV&2#;_5irOa=3!~>?36vP-e21BEA;f-3TY7QwOj+w7OqD&*(0XP zx7dj9EQ6Nf@uX1#q`d|?6P;(jAy5$tf^0se2_jz_uH!FRB$O+*OmwklYla$%BP9pe z-h##6&wifoWY+Ja12UKo5R82`xGuwrch*uCa(Q21`+^L^YN$=e>7q#4AVS0Pn~o7e zj=)xd(eWFDe{vB2`bE^I`d;L7@%ph)y|!~=&&Q%**3!8jW)M3hi^(pB%vUdl4m9fh zc9YOf%<=M!Sc+uFUfH)eJAOy$)MTyE*~L5;HD-IR9yvlizp9LXd3Gn7nap_iX!)-6 z+F|JjSj=4Wlv;hRb#w68at&Yavu|_BOjGmzhSTJIVQfpF zKv*lET=hqF!^Nrr&f$Cf5TK%R9M~vVGNmopsAaI&c39QzvS18dGFR)+9A7HpZaf@| z#cPE4pme9A)kAcnGfPdjEs*`e1@zAPXRVISC!M3phlt#SRHT$A+QOoJ1FVuFqUDsk zKmVx2&#f;e_3Ac1OTqXinTXxim<)N>g3~spHSU%ZPhU=urg+qtkog1o8OQu6kl+e> z-nx~L13(x04IX(k?f|7Z8+>00{Nd8=V96uJE{O)~+Cmz_^BhYefi(dMPf8EvSs7N9 zMW(u0odJ^K`jiz05OU0N!mL76Rxrbq&3}BE|83r?@#Nq}KGMP2?M$j0{g%P`@bYH~ zC-o#Te&ODSH@*Z(j~|$IZTCoGF$^Ey8(#w&|u$Z-( zMr}3#{}`6mws;{hy3rn?uZ3w3xyXu&^!r5lL;)&aId(+1mhPFVR&fI0k=LGC*(DD6 zW6x7h=dwR5R^p*q&r;WLORWZWjAT`s3rRwR>O!Y3#R?H82+r9>DgFLPfWuOse z4wBxRTb*a*l!vu8;6~i{`4A0he7YR78|hZ~qx_e|!PCP%3h*PENS-t&AEedQbJB&)huDSLg#-nHLZEjcPp}pdPICOu1N`yFvhN2~6$8Tk8u9B@% z)1VKtGBy2kdsh(D^g#aU45yOkdnVku&ZPs7fvKzP$ zH(@bC<@uT5wC~V%unt_@>SBG)+-8TV0$1LKe*Ml&5bBacPK*6e?vzPcMm@F^R`beJ zZX7x2Z24k(b~P`+j{n`*Q?_i0!O3ChICpoIJ{h`-jITKC z>R4D{v$KNs=@6ZN-p?~(P+q^=pFn>!ev^aZwSs;1?P4rlOP~AeWf>Iz;O#Mozdf$$ zw6$)X8-o?uYzW%tL+*ux<-%fNL0O<1f8E67L_O{C$9R{Y2ph8Hm^UPP8IFO+7)ikg(1z90F_SrpNeft$ z!s%@EpALsYtX3J@J)>gKq44kBe`q?1UZeITPGPpOZdaB&i=QQdRAfm5BkBrj6VGNQ zlT_Kk{+JhRT}>Mk`VNntaqT;E(5%%rIVQwgTOcpD8sV$LFtZe*U(2j>Kvwiu3w{$+|NgyJogts$_|jJ@ct)fo zEYx)^kPuMvlpIZ%dwkNVd8XE8;Oo#W?M`ZbX%gOC%HojyZ!oDd)E;yPmZxt(_^mgu zc9#1QkfCYQ&>)dBa05idTwT)|%MKlueo3K%OcuRhHNDOL)aAax_6zR(p7H$K zKO)8wSWM&t6}YL^@;|U_%Z#gMu`hF}J{J5ke{>%;#e(USPglVLR<3`=A_z-&hHa^Zfh{y>r zR~m`j_o%Eiowr%h=JLe!iw^a;!N$%KJJ;b;g*j8|0W&MEPc;4ai&POA%`G9uBz9`; zK`*`pWva~Yk6Y3rOCONBrmtM+6Uwu^{d3qj3O+?Zu9Rza%<&eU|1p?mkn`XP>BPw) z=m1Ck+>A|3AUR<)1fKPl@#ZE8*l9D}w;t0@Ihot0`BI{3GG}e77bl}^-8vb(D)Y`q z%e&sANQ4B}Onl05G)v@inr@&lJCfC;O>}#P!7LHB zQF}<>R*%>?TR^V<;c>O8E->AX zzO5~~om}%y;ez()>O{PY6TM+UaR3(>HJ!yY>cD@x54-N=v!9@#?)gff{Q8Pk04sSJ zq=(!rE8G5n#JdME3C%khQ1)cEhb3!?+4<+*(dLdVf)AB7?t4?SgwYSLm1Qq4nqGN6 zF>-uS5Qjx!_i7_C&n(ajW7(CNt#Wyxj$QWw_PD3%N9C~_={fgbYt>8@Kc|shCkq#v z+c5}h+RNkwT2agLmq~~M;*i4N7?AN-Or=MdO*I{^ERb}L@34oj_ZXw*Hryyfh|36t z7uASKTzcASOJZD)thpnswmnIfPMQpmr`Bv#uNkD^`l%2dl z38H#7;{G5cEX0gYXtaH=IChcHU}Gz`({-ut=jR_6^neCW1X;PX*-yE7wehAcU>&C( z*kk(Jd%{hsAq;7taHZz}`on1!Ug^+?V>~tw3PY*@rBbnMDpRurvFm?&v=c#NCbD~gt~v>iYtE$VpU)GGH*V9x$U-epDW0y=DHfz>*CJp4#58v!)FVoRFhAUoM=WwzeoS`F-vdI2DCS?z?H1u z_JL#7?)S+JTdN@E?}fYa{W(I;C~rlMDK1#_Oa$Ax>> zTqpu&r@xMNO>fXvzudX@^7nTB5sFc$Fd`xUz~Ff+OdZz<^77O?=H0@va|iOGLR%## zP<$7ku)$lMnjlfzq#vx^&+0zbv{`N3r0B1&P^}!s#I6N_au!W-T0E)o;}n|mb&FYR zzlNqpq+ey)RJHiB;Yl?^ncw?_CT>}7DnHU@bVc8;U+*z&KJ&XIhkiKy)+s%LD$wt-|C+`{@xILX7ZV=%fj~Jz;sK=MJuNh0@HF?8sfTj;^t@vPsD+19V+Fon6UKV zF_4T8JJjY3D_W8oRm|MI8?Y1Q8#L2O{BQ!j0hI$We1IwHaRFKCTEqOOVLf&|_L;5^ z2hwNXzO<}#yGd>U>2(t<_3fCs4jjFz$C97SFosL#a$)>sU0UPVOmvn|!v2^a3h*ht z*yC~v#~s{GXUia*{rRF=EUrBwNXP^y!-QZL9J&g{UMj8iAfq+!UF>FW2bMg?a%Ue=;EAvwxG$#%uLMeLYxl8?<#EJs+W2VkaAB*yMwAR%}|TY%830@Bdwk zR#``A=*M`x`7deB8gF> z)zWsx!`-9($ltOq=^TA*1QuR+-AppZowevGzdi*a5H3CPjL$A=lr^-QM!4Ecmp~|s zkT%VWS}LLsPOz9$Vaqq=crt<#M?<)*N56l=gFhPdNy^EKiGS2_mGKFI9DGWh@P=!C zgpbWcp7wFl5|03$aPyS*VGnfjX)4HND{Z$Dr#yklcDko)@rR=j^ld2PSJQE?!4X5# zOyn#8sGe0(??JPD=<=bCenB(YZna@VrMku7I+KC*8*Y0m%D7maQ2+u74u~?0&v%Di z@SZU0($!42AHc1@pbT<8P0n=XS#-8=&0AYYjC=+t7D|gj49X>4onU3D@Th z77^kmG)FFZv02t~8jjT=6Wv#e{A@n1#K5Q>%YgTB)u!5TRAXBBUJpGU= zg#41P4a6V0LkMH{Tlzew#ydet6Yz#VkDPoLiy2E7zq%=|IA7I7YPKMiYHK+7z-&CAfu zH*@&c^6-d3aLJe@vZywa0svwFENK67;`!x!{o9w{F%yd%&J8lZ)Jrg0+$P#J`cge5Sq31Bb$<`yII zz`-R<{^{X$P{vxOP;-ec2xho&DTeBp#oDNu88fLdO*y4nfL{>ab}Tp|F3oq@O2x5p z)eSk;q;{}HZKv92wd*jWUteE!cAE>hRAxn=yzGL?sxUT|Y01(m&!*>{xmGl*p$MsY z<{MVoI{$l9f}sOma@p|?R7=jPu)c1&Do=P**})S3ZpN8=zSLPAsY$MuE0dwUcsMX| z808Tc7!^PAI8}j~soao~oLxX(Tzjw}$Qc7D+I!#2MCp2|82bn+{wgt>lWH=HJG13AkBmM@Bt#{T$VU!6@O2NPw{YUytQm_M`0W-Jpus~9rNXcd)D1+!XI!$-a_pr| zyHq*I#cx&=6I9>hjf^it{H~ZyY{AL7Mm;C&`(1|*&Z+4E4-)diur6;$3@ikJ0`IlQ zsr>b+s{LHIOVb^ykk)j=TkM2jY_R{s^MS40J1EBINL`(~!p~7psStJKbHc2$|DmXQ z>BM#CDbFECDP+H(!d*SgD2pwOr0tw3^)HV;qjq}LGAO%Q9HovB8g!2DORP+HAVAG&dbz)|;X%$9s10nMv&- zf)@3?I^9liIJ>EPs6J2zU67PSZ4>%dyCU{Vu&Lxb>gIw5wkUpHLv=11P=1y>dR>#9 z=&tVU^bj+ z^hMb_(LK@qPN85W4ko&uj)}-f$Am_|69#fXM*|iC2X9m5)v*)4uiMNe9`{gq$Ku`y zMJ1(~96>eNd+KXIA?ASc?-lo8iWyutprq+}%8`n-7pDBF5vKwWn>ZCZ#Xd^S5tEio zx!awg$r?jVBli>OX85F#$I#tyQwKmOa9B@kE~-Hbq7mhhp(_&9^uJUqRVfHCft5bG zX13OL?_T6rG?GGhu+LzfGL9#>maDo9*|8#I~X-=7+9feAM@ zwde;|yShP3?5gaSmDMpP7w?3~-APMaDt#`43+wMd73Gc|jK{^#yN<`pmH8MG2rfJV z0X*E8piSxCFWC2bWaETG4=rG<@%}3;#>T}|)z&eSxsP_pOCch)AQY)zR`rQk4oI)d ziE_;b#^b79S-P{Uh1X1iC7W1PP81)sKx496Aqk_D0--cEG-{-tXn?|}ry6t9r>zJZ z@8gN#5u{ygQlP2pg0dhtgFUuaLwuxwN;>>@R2#cy?-VkdQ`BhWH^5X_W0Agj^Q^42 zc%D;FpZiXj^#>a#wL)8@>Pns~teX$jN=`s3-P7PzWOoap*rCv(dA29p@0;7kxmuVF zS;Fa4wIH3Lsa*3'Ek1w_70BM{zHAlro!qYLa?Cx!F&4Lwcc>oei_NOM#VPgn6S z6d4sC)yBeFkdF}0pquo<%r5poU%(CdJqC0gmqIp+N-Z3`xbjR*mqQ_7m@fhxhcD_Ot5-ch2ZV< z#G*@(4}C*SsUmbOVlZeXf9$8}YtB9BDL4}tu~fY4Qnf+^;upStFyfuwoe32cw3$np zS4AB)IolQzBh!59)Gi8}B9W?qnZR)Jadx3~ZJuVv(79=aK5cH^+1Vz4B(XF&)n&hu z!V%1Uap-vbJdN)|1~o{AS=IGhU`kcSZ;l~;7`tcp`cgAEL`@15Dzm4d68{MlMmV{y zqa)7dvOhxW2u)nuDDWC{8eD2;P~ub5MzL(upNr;Gs$45EOLszK?@WISc{2rXgCam< z1GA_k=W{*FO>M?K)kp#aLafbN#*x^TK@7AtW1(^EHJ8 z9rWR}x%2D*ZFWj1p`uNb_d_HX#I3D3G{f8dPEZWGYUbEhg;at;$GL`d&)H<)93{%I zt;Z$u5$`jnwU>>#MJYoEM6$ON{BxH0?*t8nPoHgDESuUH=5l-~aWc4m;e!vtRBlYT zkQ#Q}0+e=(zL<{k)8o%j0|v{M@>L?E7G3WnRukjG+*Soxk0?S&*$d?Z&MX*+k8k(6 zU>o(}$7xCP_z<_Y&dvb6p=V66Y8NN@=>0fNzFyZ9^tcCq*>ayz+BX0DCY%Qm$>dW# z35Jx3i>*d3V`*1a+DxHg_N~qjO?+P;s(UPeRXVF=ds3qve8(;>laarxWk?se?rie; zeKs*HB&VuBIl8TnkY8a|a*+6#kr{itnTW7KkxcZk*5H1L_D#-X{o`nlT5`+AlI{%G zZF{16^w5f9|JwaCRj=v=uV*Xrb&q^i`($|)ux-J7z+gb3rh@ zzcCN3xw&R#APf#9yi~-Vo?IrS(9-WIgnxNN=E7NitraJxc$!k^La<_*Z+D~NVSQB| zd!_x|yJ0Bikq2vKFHq$5Tt#RwA4^27onNMg(MKoYimK@YGhn>QHsx7*Jin*W%mc&0 zIQzLe;6a8imIfvCI?o9padmuy*``ro_UMx{978@~J{go2D~nF=u$~v|T`H>%zez*D3m&uIWJdKAy`3}@vx%qKhPNvnGow6tRN96< z4<w4~bn6MTxXgCp4Uv}P&1m#;9gmSN-dGKCbavv*qIemD8;-$$L^12+o?3Y%W z7uZU_7AizXx;Ei^1{I#~Km`xS9G=89QDEwJWgE=FzwlM`)+x+}T%R&?RH~iT)J6s- zIc>`R=eT)Y1i#w;Ie8wj44Px}7+z3O&EmR11euv_j*LiNqB-6KDeR;NwB+lA?^ zG{?j^xEzgf!1aQ|fUJI?l&;b6JN`_OL;5sC45@J2%WbF}MI(HDkoPmrhJC%#)JA{$ zk%#*Xd)vhPX6mx4q|+4A-(*?=4FDbb+Jk@(LrC?cS!BAh%0zD*qLxD~@O3Hj0v#@I z7;DgIT2RycFl2E#YA#PEKTP2lm!wt&zk6*|J57gs_w_f5B_mhJ^Yv!J>A52=S($%I ze_Lumg6s#h@6vFgv}irkt#p)myl~Q06c(gGeu?K+h^|)qA`)FX=uT^6j6t4#V!UX0 z=!zx|j!jowzmxk@>B0%yhIn{J(AFyHDx^4Im_ec4b*MF@LCSZEd)8Wfe(Hq~*umdr z;lBX+WR!2oR(pky1F9+#S_Qwt7p@_p*Uz2#6PY{ z=A55=$>mcr3Hiv5^*M>3z?(@10BrrR!g!?>9s;OBx`i%*VS@qsg}R2>b%d9%K-&O) zK*-!nMbsw;#kOM{!M4+cU_n7&-tU_|k#f=R>|Itmoc?K--LD!S>0Y2=KC1V?XeS_g z13f%Y5Bebm_$Hwi{*(x@nqhHv{wrode0d)7cN<85w}A|_VIkE4$o%gSuxrCErg@b%2EdiIG#xHeIXI0eV(X@(OAo3<_4{(%9WMvT_OMPx#+`h`qI?VlO{qy?jL9%Xu=ArxtnzpvlvB`J2206>L$@}A)r#9HmPIofNC}u}1 z!!g!2m-fqOsQkBEdQMgzqs>xB?Jnoq7Y5(U*M`jM2Q&Y#-rh1Oj&2JZ4FQ4%hd^+5 zcXxMp2?Td{2<{%-Ex5Z4?(XhxgG2B;$$Q>Y=icA<`>ML8W@@^7_g=kat>;;?)I#fd z*$t)c35v}y_oQjW+30ujv96nb&80p+fyx?s5s%8$$c5FG^?Ovl_+R{ei-61>}9SZx(h z0NdY%kwk-jNFyQbM8`8@3U2ug0rP^<@e?838S~n4!eU3UIO8a$FRLTsl6MUmz))EZ zVLYIv1Ah>K_4o;^xFmD`{@|Y{)T#3G%+xjxsGz4fo4i$U{heDWh1k>32xF7QdN?-g9xYp8;g&2XB9{DlW zF`IU;wNP02fS(InA~gn+@uTaSeaOA_v5(u@KHUQ-v(zTLwuCjo{=3T|(biHCS@6~^ zrOtDAdEFDjg6V{4raHbsi$|}+F#H}Li_O~aa&Ol;_3weHUc2|Fi}FnmXjRaJfk;Bo zV4&cl5D+SQ(kagOe8!9_E%CZ{x!v3R{`Ne+vMl^$Vo@hg5cfv#J6xUH704nThKwvc zcd1d9lO`63eJpVG6tF?%bZtpLcvx!z&k4x5u#zpco+Lc{xxdoR=SlaNc-@$nip|*x zp$%k~;j3^YAqlme*>+^136y#wqJPhjaL#oT1)U)$s2Co5=1=tHzn2;Q=a1M@ zGg149*fAni`*0$R|Nc$$SNh*s^u|?~{K7wC5T*(;365BDi_-kJX@z!BGx7E$sO2bO z%3+P5mifZ^C?42gHUDiLy5^sA6#LkuUDk0g&<_XbvydEIu28eB+LPVT+hR5u|J#xH zjtoOa&~Rh8sBr5msPg9c-Z%6M!e?$$LKQCi!S~52kN@qO64H_ ziDfwv9yW+}ugbB2274KTf&!@<=yrm0)-vH0P?a zBYR#5x`fe7t3#JHUAaWiTlun_HR5@Em(>=gTZP*b;#ksG8*&quZQIL1 z!)?Ge|H<~1uFz414nJhG!&r?esp+cCu0>R6#%oax3r8c^KI`yd!t|}YY5YDd-)5~z zrss5Hu8;c&$93&m%5;9`Ig-LKOL}7zUd-D_^a)z&_$K1mRHJsW&y-nmL^S!^HK0u7 zRV@wxc>xGh3B}pOAr`(EU#-(|p6eZ*OAa7X^xh%+mR@vH>J%g1V~h^?LWxu|JMOCA zWBX%?rSe$?b%&VixJQ=l%$#Ha*m4wpkE-6xP{rfN zm?AAUOjyWr_|_%%?$=!&tu46irE()P*puiY!L zsO?~1C(<0+P|o%Kax-17$qXuS0sBSYt0p=|*2ov~;W`!h{Z$frSfl_v2mjYMo+RF7 zL{5}CFPtY?$bn8K+*d8m5(~8BzNh2LzQJUB50&$bcynr4zk#UPlUlhGpqHK32#lJvSMCsRPfnFp$yR~&_ThSkIlMRk zzboV~OY_dPQ35teZ6Iz->K=b_T!gaDFfLFwB{jPdL33; z?Cc@CSyY$l8=q0%SJny2SgHZ=;*7@Uw=vuq9v<%Q@&ljF6P1YxBFD>wQv94*@*R;o z-A+^*2Opwi(umCB$C;;WVx@}yG^6Z^d`N4I0=oGvUDu70+W1$)uI&Uj(UGbxw}SFY zGyg$X@3@Xkc3=#_B*qhbHofv&&j-~c1!F9mCEe8@!DNW{`Q2+VCQ(;6z2ujc-W#Au zg7ssW2#l%>Fa862T={P?7UY)AMd6i4O#vD=I zUDJ&!p23+9bX`aEN0gE29$I7CIOF%1>@K$iy>6$)o3BTx?T-tScY5IHSxR6Co#VV! zv%ih|s&8ehS@pP9b)syRm<39jeekNl5+Zh-emd{WAGXxrNiO~TxF1q9hgbUfcm|Vy z&2VMI&eME_5Et9rG=odk`*aJA=hv!-xusSfQRVq$G}q7Aa$-ni(wS}oc*eZQSw;W> zJ^tgqF$Fdo?yhTeFH6cDPf>tTm6OYu>-|_0uCC%C%Z_GC!l&LW(PcA^K{iE?PCVn* z*`DE`abdD8LZrT*CBVy)ai*z32c-i0#ysxC_^r{B~>S7#m$Yp=O0Gx4oR%Wfr zOJuOOlqcIdx!XG_4|aZSK^IkAG%U{u+wxPH$x6Hl=*) zDr_-l@OH-VN1Fi15>CH|ild^?f+4<&CuGg`0rubQl zwdccK-J?OGMc+LK`r#zkwi`Y&6vB4Q^Xk?Y;q((0C72Vbwmz)Sb~=Tgui^A|2{D}I zEa8UH>9lkc_xNajH823|StJN876=62pjb^Px*lbv;DEHP7+*er^@7~^JKNGv{RKl} z8Q12KI@yRh%$@)hql&NY>&JyV*%tOhG$LkkLe>eN)|L-Rd^C2L!1&iN`4b$YTfZVY zDLz;%9!@k`XO}%sBY{^j;?p|^vo*7CJ7@GAU|16yUzsZVPy(8qlSb2w44AhPGfU}| z%buI?RVO7-U&`5UJt>Hi9M4a9U$R+1DI}4&dUAj2O7j3t4HjAe*C>^L^rN$t1~}a| z7g3Na1EmgfJY>C%4@~f;2dxY5%oktXPSlF${T+#14-j%5`K7VMRln#7R$B$z!OAN7 zDL}h{kQ@8hMf+qzy%9&{Jo+W~{N;+?`6NUaY4#vX0QjKlU9x&lf4SPw#hb6PUcz?l zlGcMxh$X!*-ZuBHPO$X=)%LWj$3;`nTU>61HE>AVC7-9$z7}|8Y_WP&mN|b-eMzk8 zTbupV>ykknKJ-Mr>sRu+qXVW&mwlk&EtzI2;^q!Eil7q#rSjy}pgU0}iaeXD`fG-l zn}!WBwSV=rfVq!S`52;foyiTmGhyP(@tWe*uA?iK{b)Lqvrm&J*YIdV#~kOVzIbZ0 zBbP$(;^;i5r>-Ti!^vQnGrK?bkw45qu<1jGtlnNTDHZvZJ6+raT_$@&=gMx-eyYdf z1h3+QSesBhf}r?Zyn`MaSPI*gYiR~*-@8Q`G0rIODe1#db}h9pn&bQ0rQU+Oj<-*b zafdd?rW zf51%#16~Wakv4II9>rafmvphwxb7z}+t$i}oKsqQ!FKpIhe7dk<<#Oz&oU7>buPs1 z`#GyovJI`WDtC!0s44A}O9Rc{Sw|Pqk3<8-OtBt14eOnr)QxhkSUoz6+VjVy=bHrL z#dCu_)f#=lJ*tQpkdu~72`LwEcf&JWN(IZ_bacojRbZG28 zbeVWfBg@@GBX9<%ql#s*trOPLH4CD$8IxD_g*TteysZARp~#O;|Bh#!WU>P5{C0#e z`>+Xt@MGd@lx`BI{r$yei~vE7ZUnMWZG>8KQ{V5^*6khTXZzB9_h#^4cvH@T!th7G zS;=z^0On4fM8!{c#&_1lzAVz2CmMxZ=Wzp#;>o%{D&^n_Nu;NQBA<4Bit)@d1AKr8 zaN8q4!ky!i;SNXFoqqh37v?{XWG60g^+sFYC&eW)j`=uCBI^cW1^+8S*fp)h$%Dnl z9g?Z!d7hSsBa?0h#uZ~^O91*h)sj2P!DFp}+w~b-+_CK?nzNk8VgA?dCEDhbLq2pad^D_dVYKE%U^@)ma<)*5%Y%i3v<4xIRk zuO(cp4L*}xYM=t2ZwS`JXCYcD1slzc03G=6(e{E%C56OF-Ug=zpmC1VQo^yvWu)@_ zUO)`L#767F$7{+EIqM_gQ4*0iJSfXsurVaKB}GogsrO7$e7drC!luxaSjsz|&A>-p zVZOF$GV$T3IR&HP_y+7e*V|&BX z)685iblMtS;0a5tzxWI z`3obg!geCOs&s`=nTR~JF5zJvPnT=%ic1~@-hFq8WoNZh4qdc5lD}_f<)>?nrRx%r z;;rFNH}JB{9&|QbsdYplXd*m0zgnK31wQS$1jn9{7G-*oNDemD>Fw^N##NIwulGRj zd?oYkI&GE|Taqf$_?R)h#`ZmFl!=<>C~mkW$qGyVQ{!$a1Zg*uGp(@hAo_z{rQ@&p zmfe#xw1NbR0NMklM6+&tuBX&Nayoz-x0yTrDb>v3;Q*EuP-9R$F!o8@swGDmN|i1e zJ%IrH2PM$mZXLW7U|*iIw!nlHfXtoIxP<&@B-+?IxvEhHRh{C;XfhR{T`u{>(oeVc z$k}@O0A52X@MgW*Ak!k`d#qe!p_-uu-~0Ub%56dJ2E(E)lU%!&{z-E~ zTaz+66+#I#Ggp^A*r8typ2JsmM*Z~zON$KWBz2d--ml4?8P?qOq~dO9B4~`nG?A)` z3wfi1ttF0j5Mv_>_f+ zrM+S*q<=dwhpkgjkgKlqgF62cOTiU^LCY#zUhjSjU_xrYoSdU9@fG{2dZukLtl-wdf4ljv38#_+2=Gb zJVjenBj9(l*C+ay>e!>8U&m@}8;rB9bu_~G^+GTs&aP(qaJku8+*~AZ;fH~%wY@x?ge<2laAC#@mHau{Y;S|SYTyBoh1Tp zJ13`jQ@(TDz>`QzbY4MM2L}NA2J*nCVsGB{2MzYXiI!)`e!2VPu!__I`%4EdoQ_HFEQ-CC0=6WJ8sl-50u6=ojv zbnp;7*}_fLUXdB#6?w{vZ5p&3o)`g<<1T!K5UF~g}7#C3r`9f zS{pyr?_I2#$X@+S^(S1FRG~{6^=OK^eQbGui#ciHs+=V&&@@tc(VW;HQ!gA{Lim{A zHTI@c$Y>r^yo>L=!!k2@FqU5UygcT0aabx(R7yK*^PP9)n`?R;|7UddUu4i6hCy@M zC0YQ`M&X2~^Efuj_N7P+EfPy)56^06On#pVeBQ+};-Z*~*Tt#H`34iK3q^X(8@A0- zX3*HcdQYDhQJyb?@ZNoDQ)@Kdt188G$cvlPvCSk&^t~mg`}hd&2LriWpLX8M(_-g9 zAPnkQ8hZ#L{s1Te(~oCh+hkwtm>`Xg%WjBSIHGet1#mP&azek993P4`MA;>#1QF`I zR+h$KE<{9Kf13f!wAPkv+a8w)QyfB=JQ|4|NG6d)s!?C@*h`PIxF1UBwvd`l--Wuz74s;row2i0XO>`kK8wtGHrI;{_kJ^K#I0Dm-7 z2nQ+#QV_8EG@_-a89}Y3hx{+DxGbxcq|V97xzz4nhf(~}6Z{!_3gGQo2L-|=nne++O#orxxuBF^|3cJ%9xZEC;LoYQLUFl~slT^?6BhVvJ-n^z zOP_K57geo=3;zS&PEei&k_8sPp2Ge6_@Hx7+3XG{GEKrjZI`&OjmOYPhdN`M=|TZ+ zCb*j)HauldP87lljcoe&5FD%RWlYH}M&X^_uXs#3J2A_$PGWF0T?UOf4ycrvk z2K&^;j`&a}HXteV7*SufOZru!-3=)5&bYA(YtJTP(jm+n`Q~xEvDpo+zGzAl+xnDe z!|s)A&Z1^GkNR`_;qLx0Tt4a+Clz>Bc<}+8fq!ZO!zk&G@92tMkgMnOjjO{kL8|s- zoRXuJv-u$7WZ1jLim$;jry0G%*H6x0>1Zj#Rb_PAUZU^%Nx4_>zVpB{x6Z|W?_zn=h z50agPwP89wwT`4+gt`lWn)`76ylJy?wkQVKVPtLxn)-l4NX~4BYOEdH!?QYu#`g@G zhiiR*!siktzCHRFBXaHe)1~1VW4;I}DBX>YyJI%1;@6fe0@wzMB)JV92qtOgpm3*$ z8`QS;XjJOUrG1J>fw|#^advsiP>%S{khv;oVViBbla!KB!FV!$t(=72j&gq-?&*eO zrmw#czCn~XTe1(j!0CML^eT+kM=X7oDHsB!wa!0iuO(6|cQY2H{@aVcsJFzuP?I01 zOSPEPduTZXn<6k!pm(3$#V*o1ESLkX&}xz?wT@-PZo}dqgNhHr$`=VWKEZcRFE_m_ zpKyfr5wa^jyNGQ=r{jMKn;E*>gR*mHy(YuZUT>T1Qp;q36tPRy0n$W-5`FZCz%BA` zOj7FpWl#LPatn7~0-Y!(f+fk{EJ7|hM63M6+Tjr8QV~g`U?wOCS9B7l3n0^dS8`hAKTQvArYqr8`O_&U0LY>s+q+Dw40ExTe2 zTh8UARFRG&x-7*ZhJnSy15&b$$z_i9>JP)=E{3FJSDACQ&uM#l;r&bIEjCq$U6Oy6 zs(%(AC0&X?YvQn(%f&{Nt+EUn%z&iR#iADL9`UNfHB&_!(u9d zE8ZHIbJ(*fbwV^1>I!l(#+j0hR+8>nn zJ7r&&&UyFWil0f6zDKC|*fJPu)U;Ms_oq-L@FX6vi#1C>aQ?=&m8P%{t`{G9xd7=Po*5nC`T=^u2Q3BPQogVg9LBix*9y(VRGg7DF z=-y1xw`Oo+^At~%WCRIa&sqi(I+~8EE2~2kjjm(}na(_*bz4kesIKuMCD0}iDPV-O z=%RaFumeIRDu$K&wAM@Glc5W>;Pc3rdehSvpr0=(^z!1#%kcX#(8QCghPJTNVQc zK3Y)wJNkV*cd0^=F4EYxARcg;4nt>3{waGQT&71c26fP}U4U#!K^yAcLIFQ1Zyb%) zU@PMjUl{jTt`MphCISk3F4?a?Y_APn72y4%glFebMZ82J)R!J6SQkGuo{89hg0ng& zN`jVywtzCk`w-vUf=W2TyZMvghHZKGxTRKSL2M_SQH|zCI{SzNqsBrDZP&-P+w5-h z1>$3>;E2Z&3cjCIf7oe1Pa+h*tG7#KIY)9hRZQkw%sSm-`5_PmOfK_6HbEWvZEc^@ zF;r9C|CsN8<}{_iUqMvZ89poVycT^f<}oKixjfb%*h<%b=K?YJL2TA5IiP)4qr-!h z%Q-&lZl%i}8=4n!USbTJ5sLX@2uuW;DVXNQhbAu?)(GdpV;DKv+r_2~h{@^70m_A> z-!Ilik)dO5OH}jQw^y*|9gUD_QhDyPnr6#Jl4zf$7pH3rVnT#QcY9Px@?8fUk;ue+92l+xz6?V z9Oy;(EiT9nATxJ|O3K^#BhVp@+nT}GX!l8sk47xZ+r+l@TD}kg9(n$in8N~xe}%6H z*FIk;M>MeexeR0Hn7`PlnBii+VxBvCM?#bmW5oWgUUffw&Ya3WT#)m{Ho=nqKT3_n>p`C{zu(1# zZJ0QBd2dzpJDTsSJ0c6)YCFgE!1uMQDJ7g13Mlm^a3QF)T=ncWg{4(2Os$qjte2B6 zyLPS`q^l0BHui#l|fp8D}2*DUs&L)U?i&mheQ9M&!7f z7po*Srv9lB-;o{tTwDB{h~B5)wEK&;kxo*rv*n6H+Lia9Rh)8Op3hmEXZRv_|25gf zU|Ug>%db<$<5QsrCrlJw-(e|O`|XT0hzR(Pra8=ay9tzhGMy;KAAWW9{Co#F4<@uK zrRX-Od*mzcd%M&@UeZ4sRvI9emY>)R1Q=6j*Fnp_7&6$j0iZmJ?N<3;(V9A2k+tQI z_Dbv>sP!_wstkVKdgB)fEF0+zLfIQ^(Ql+T*&N}X-n#n4wbn9Ip*PgQG8x!hv6w}# z5_&DQBc)t9^RxIIWkfbD4VXP9Ra)(S-ge?EoKN;tBuV_5U)z*a49C4Q z0(ke=jPR#OrX;!Vh}g>0#AHAE>O?~$beWUDlJ?3aTAna6tai3hlV4($Tn|Xm9t(Vo<|aNgR;6E!5vI_~-BCvaPtcpAPxAE;)Kjn@ z{I14pcfoJk$1~RW96nn3Vpz_E`e2JQyBrqN!!18^B$Ea~zOhG{7_IAYPtou|rMlL|L$|1!lH1g&nW{Iy%g_HrPn>>rv7bbJ$x#R9rZdL`L*ewl&hI%6H>5j ze381~&-Ng%wN&Uo?|x1_>o>LCG(=7}@mucr_pQXHafCmrhGOWb8?&#Y>>Z>r2YKU| zz_h-Hk)4ln26RWvXL9}l?e|x{`vM9cR-1!w`SaCK9*DZ3pI65{s8mX?7rD7uf{HT@}H<#wGqDK)P7^A&3cf591UgbFz|-VjD; zKVDNtQ@fsWZTwm;nh8`%JN>{pI*^eChGw-DBC-BlGiMki#6ahrDGGP^k$-54%c!E`uopb2&;&=J-Nk5JwL@n zhwyo{bv+4x=_mzm#rH4W-V&sy5QM|6Hgwk*<1OyPrl)fxnVW~H`#!I3GI&2Z$z+xy z?4Z6~hVXBJs=qOMl909Tb}++=r--^QBMAtQWiKX-O$ysd``>C6BIGG>naaxWBx*GM zLW68!;_X;@9@wVPt&{67rNu9$B3bq#WRGGCMvVJ- zGk3w$FgY3;sSwu45vBpnc{RakIKxLu{8eR*FwD`e+<-@{qq)MQ$2}};ae)Q+V(lDF zzDSl&uCu`Q)Y`MU**8O(pji4Qn^lW;y0#$u^xHhL6*^ly5Z)QLYJ^qlji+)LiEfvX zzV)l+@@8Kd5{B)Fh*ic<(tQ8+Q&Qc{p}|1CQNf%5iy6Lh83oWvRC0O?H9~Ql{3JQ; z9{H#sTj+CLwwiazSw$|6^n!Sp`t>EfL8Hxt5AV3L(tcr9!-Bt+XX&+5{A#p2^Xi08=di@>X6%EPYL8rLn|i@}&s;5E3NNB-{e(*O@aCsK!2$wgWdh7ruK zoa*$IsR{*J+U}huoGam{c&F_9^oaQtG}El@te}%lP+>YU*`b2R#;3~R*(^7RA zp?9-2ZWSTmfF#-}FJ~mdP6gxgUo*Mxgm_uZxB+x9JHxrr`^kV-bkXLPT~^HdRf4oN zR@_m1%3FKWqdY~_db16jaoz2y5yc^VEyMEi``o<}QVy4A0;diU@xH0Av?_c&RpSua zRG>jy1$d$Y0-kMTQW(0~b$nm%JSO~am&3Po@>$>*>0P{xx8>;bVO2=?tt2G2u<61| zX#!*BPpR^fn9Vy?-rh1VH{4GmYp}%$=hW{LC)QK95x&P0-oA*VU8LZ;>KAt7hlLhO z3q+8e`0$ah-}Ew?jtQuiBoj630dEGOofWQZheG^}2uUVq7K&`5G)8&8bnO9<3C-|e zRogxAv{In&80}Bfgvzho#Hb!17!(hMqm6=84~4-|)sNk3ex=@?>{q_DWVvDSDq{3; zc}K-}eni_eYV!U33ep1!g!B}BZ&9`zcZ@m;9lVhWzY&t^&Os>z>FkP?r$JxD5IT>4 zqt4I!AT(f6bUnYE!rqg#YB!c%ht_OF6n^99ABI}DhkIR_>;OPkxRagYA)l!Gejy&1 z^28vM*Gh+p4AG0SYIu$Nm)u0#!qf)yA3iBaFv!I;(A1IJl%&u_hHr(R&qzPE$o*s&DIx z;M$D~c^TPs13Aws+`ry9A8MKbJK=Osi?zvav1*rFP94qQa zE19?RX#n&=^nl~OXN}`_?@@ZCXfjc~L5g&<(rt!+?L6uf>vXOT5EeBq$<6uYw|%|s z=0>?YF))jYdbhPYfgt}${NrRH)k{G-AMy+(bs_+U@uP^+cc%a#TGA^V@)=&u1YxQ_ z%hJil3*%FzkIps*t$69=M`{((SSejNIBkFEeGH->u^vx+V#QV*ux%VsW0%;n$pE&_ z&xGGam@M}X84!v4S<@$>gyoVahHBK*R%)eUZ$u#AL8Hw*M4y->pIizVWi$!=RK@5x za^+Iw+Pn{yGQjR_mW(KN|CUC?PkgsXJXXVAM*Hr_jJ$*L8LL=UJrGMGxn{-sSmJd} zR;W1O$u5-W^+{ISaakfH~q^E4o)}TO^uu3yv*2!1IT;m z4-%ksk!lZRH=EdX3Zk}?L%=~p=@1Wrrx;-X6_!rC>o%1`qBG$|Z0BzC%{aln3@C56 z_B1&gP!8#t;UQ*&c-uPCd%hX=S>t)e;8ubm(4Z_cif z&@mb^j|C51=O_~{OJbU6ZmHIdpK}ECcFt>nD`~@r zTXVZKSeKEg5zOO^#i6zNe@???&KC(Fo$9gjeV0v}!;I!6ihN43I5lmsh0Z6zU#X?? z?nD2@<7p@x#MglmDtMg{Zpl#tticy%4aATh^W5D9<>Lnq$~abl%+cf1#lScs5w6KK z88o7u36{*K@u;`o(2J(g)I!L*%9Yt(r>nQcI&UmlZ1|Qv!CU&(+nr5BJG7TZW9dwY z7uhUjbO^TIFfpB%X_~};cD}Gf@pV5aPcYka$N_)_5eV7;&I4K(0yOB^*qS@8W1+>V zuIyKn%#L#{VK~>J@&~(}mr}JO#ce&|5HV=`@s7*v-vnXc)=f>1Dxp8P__v_Ui184%7DWqho`I(`oCx(9#nbJP z5$kRuHIkJPQMTU&4}>#`WcKB_)) zc|E$WcMNEmYR#v*8;!?2+ENoEC0LW5%nQm-2cf5c zlU8^%B6r6P?0Jb&ODA7}upA5@{#(!d1k2N&sB*cJgE|&>k8Z10;Da^$?8j%=aX549(Y1xiBPY2H%uG!{+(#!P* zpBu_MLF==t+qkN0`lvddt5w;$N0LS$cHAoy_jSC4_n1 zeqz>jOiM7kzYr7+X*4re+cnevvAv^r33zKh2kIM{0C{+R<7?aJsS?^;?2c{gHoEWu zFLv^MV8q!B#4_yW@vX7BPKWKwPptHvPfvk;1ZafKk`-34rG9>gIOBGHE{~Z=#>v2MZWYXgp#ay&Gnvg90vyiVqt+K6`HJMuylTOS7sPHgN#& z^=5CrL0;J?*~aT$U3SVbjPl*$MD4@jsZq`rIp^Q%KAV3DqPk$Jnzvke&2__6uBY$o zg>yBuok~Td{;g+$fQWnlZPTL8Ob7Bnwb+z>z>UP4t}iH+K+oD+N~b~dK~v6-N;lP2 zV(p=%8IXYNHj!%C&+l!qH7nh|yDuOApN15qV#wW+nwA8$Xnw-S+B^kBqFghNYRq@f0 zc#%9lK4eq?d3!FYdSAUv&!gjs4*atv*>U?LfZgVcyRy(XWmoqvaEly^=w7R8I)#>gjfS;W3Swd4U~) zHwk&QF#K!CywEU>RdhFy2ow?V^2jW3vFhae?Wrem>o(w9h`sER3x$cdDN=Y6t3ZIU zDCTXZCT8gdVd^#U8DY`7Le6)j*do5z>+rd28uTv-zZ#@a70fr3{v02vqU^hW6)EI` zYSMnW&-hVG99=!j<+4#CR-s67^9`4>H!y3sFQ2MhgGHNuf1UelzK1JIQw}TFJzfwc zsqxbD!Nv6AV&QkodO$yDd}gl>&=htDxu;wneDTmL6GDvfuJDWycz_%kI3#t^#1vJJ zggx)i6%M)VPe+YS1}!q_2ei1~rqV5^2KH*Y&4cPvGD?(-40{6mO1J;Go`al=4aQO! z$$~+F4xw1}F3KqyRyX2-pHq`5c^_Ozw3ow+Y;nRk@%ZvO%p>C_ledc&xyEBygxNB< zoMCenpg&`?iG(0rql-hA(3k79pscq#3+IbP^$4E$gJ?bZkWZiI@a@TFe!xtOtDc;<(>H8Pjrs#(iE718hn?5<1l&N{iKZXVRz5V+PZ$MLfES zqETEK-Yyx%q&A>&V)QkWvF{FNcLvjEQOIakuQZuquE5hVTKYr|Tnl%KZ;B)X?5S36 zDZ-m^oMt^>+0HX_DrP_|h|=cN=UpD&P4zo$5PL=v41QrGd{nI|*#nup+e&9`4>0#J z?5BnS1^>+9F1}wPzURzlaPBB|W2Iu;!`N&<%K9*>g+*w9_|Z`>X8=*vAme!3_L(ly z;|JOO6fG6DO4;>C`viihW{l4pW}Cw-*9U`7B?4JbytuPK`exK6Mg)qaC_JwMKEsue zorfDy?^1X*-(@|;(V+=SCW^W zWERkWI1qNVc9eo$M=ScRie3wAg5S# z8IQk{Zfv?C$+qc5HNvz*26NUxUD)zRH_mgaV;EK!AO)uhzGz)Oq<=t znyKthu}bj+nS_`rr|Sd4Sj|#um4deH?4^C@3=O|QI`MB1d2*H3Vb=wd{4%u7fsDvU zdTN3Zf{a2j>K+eQcP{7`l$iVCaN58dl2$fPIckG`-8N1aDx&n@9dtsH8*^sO`6KZ$ zsgE|w*)Y_ZE%hMfE5nH6@&{-Um5pD>`2YAJTt?Y?^_~fW`l*6wE**`>8xG>-C;L>O z{_wY5V=ccpLD#)<@a2wsSz0cX%w;mV?1~Zp#(bZ(|BdU2>u=29I6R!;{4aMqqT|WN zPlr+%cRKA;HanTFVdX6E?!z1eO_wm5X^gBWA`qLit1`8qM76|X^IbpP#}6~4j719+ z29%JNNo|w*(JFyE`A3X@7g6E_t;Jo&hch~r)iDoD=eLl#N#Nr|sqr9+L5@@v%m>#J z=Z-4*Czl#PT3dgF5R+e}hIk8YZSa`VVBMkQk2_1iO1=#1i5B_)(6;u*1cuoyf*d#Yrw@U-7O@OYp+G7y0c(ehi4yg&^ACveg^vB(@X?AYC3in7E+0HLpqCAq1 zy!Nz6PYMOuQh_eT*|kV~N!CfU%nS~dPv=ONNI5*wC6oeY(V>DUczrYADCGW2IPlrr zOgtqv_4D(o%9K44*?MHz$9w1SNcKi~&AZ$cLaAC=l{?oz9MH*ap4N8a2-LWR+eBv& zt@C$OzS2UJ+}hJ!@M!2lI61(GqTUeag`q2L=)kY-GhUf;J6F1xa7KpTaM^|kc8!+G zuo4cAXJZ6=%|tZUYiBB76YeA>8!K6DuvYkG=>Z{mp^Iy8(19bk?EYX?Mzo6GGL(UN zg1l(NBC>317PTEZnfV>9@WtTr&UR|BnQ*4y%`56Ey^oifMrjL=eN@4Hnb?!w~P2Hlo2AMcW31lGrF( z#UtxFF&uu0JCs3=pnzvS{LJMp8>m5OJ}tGs%YL#r+9L^3lSU%dtURiOp-2a=yJk3Y z_9?MS)CNo@@ty6?sOjP7b3SlZoM@@!Wy7Ga+R$0|TLh!C{IyEjCMGid`XOjWf~MVf zS{ye4(AXi9l>Y0bGXa^b>yoNjD%cv?FJ_Ni+*6ED_`{{G2x+_Y;(MG2!%Iu*(WVrU z@?f|`#}gXIf({-XEF*hLYdWAHbYBDPqxHDO$DQi~5%q+HE+I>6qrjhcCdyIYXgySr zz$j^aNCk9$i^8ycvbR2L#FGl`V1qfSvP5>{sYrvjVGqz6Q#`dD$QYe)j^kM1TH7gF2?1|71?RuxC+>U0CnyfH-HlK{DWXsbq`kObk8MI#6`LAjq zDNl2yy&$O2$t%Cy@RWDZ{J$7rAo-n_E>)EF57g~R-7Kb%6lc;Dpd;wj{4r=jAMqdm zx<<_j<23nA-6%x$wIe$++(hFD1QHkxFR%s0qJF0!e7$3C6qvG$g&RN&j z**ll3y+Be$AUYsvXG3;X!IFHl27KS3=xhP3*?_H<86{`m)6=(n$-{4WK&|$lu-{Wz zSkLYc_pjyks!$59Y#(T~L<1&z67Hl={!hOhKCy6AFpPqvFr?Yb#(!2mgu@^sx-}cVqqU??3we zz+ZCxzry}IGvNQn7ww;G|F4~v;rNxs%peJxun&6y^*;juv=91$w%EW}$M7~`E|=wC zv8b=xN7MNxaD*hQzh7=9?>vD%7qmWqMDqIT<>F<2Z7%0MHAaInutE~Lq8q#6;jpiIqtCP# zE!x%pbp(`nEd&_{nq;7douF!jiPy)L%j615AeRsB1^G9kBN*lq0{i)1ZhaNk1pLqCO7DL= zx0kVP Date: Fri, 20 Aug 2021 08:34:32 +0200 Subject: [PATCH 12/14] chg: [types] updated types and categories --- categories-and-types/README.md | 1418 ++++++++++++++++---------------- 1 file changed, 711 insertions(+), 707 deletions(-) diff --git a/categories-and-types/README.md b/categories-and-types/README.md index c201a25..edd5cfd 100644 --- a/categories-and-types/README.md +++ b/categories-and-types/README.md @@ -2,774 +2,778 @@ ### Attribute Categories vs. Types -|Category| Internal reference | Targeting data | Antivirus detection | Payload delivery | Artifacts dropped | Payload installation | +|Category| Antivirus detection | Artifacts dropped | Attribution | External analysis | Financial fraud | Internal reference | | --- |:---:|:---:|:---:|:---:|:---:|:---:| -|md5| | | | X | X | X | -|sha1| | | | X | X | X | -|sha256| | | | X | X | X | -|filename| | | | X | X | X | -|pdb| | | | | X | | -|filename|md5| | | | X | X | X | -|filename|sha1| | | | X | X | X | -|filename|sha256| | | | X | X | X | -|ip-src| | | | X | | | -|ip-dst| | | | X | | | -|hostname| | | | X | | | -|domain| | | | X | | | -|domain|ip| | | | | | | -|email| | | | X | | | -|email-src| | | | X | | | -|eppn| | | | | | | -|email-dst| | | | X | | | -|email-subject| | | | X | | | -|email-attachment| | | | X | | | -|email-body| | | | X | | | -|float| | | | | | | -|git-commit-id| X | | | | | | -|url| | | | X | | | -|http-method| | | | | | | -|user-agent| | | | X | | | -|ja3-fingerprint-md5| | | | X | | | -|jarm-fingerprint| | | | X | | | -|favicon-mmh3| | | | | | | -|hassh-md5| | | | X | | | -|hasshserver-md5| | | | X | | | -|regkey| | | | | X | | -|regkey|value| | | | | X | | |AS| | | | X | | | -|snort| | | | | | | -|bro| | | | | | | -|zeek| | | | | | | -|community-id| | | | | | | -|pattern-in-file| | | | X | X | X | -|pattern-in-traffic| | | | X | | X | -|pattern-in-memory| | | | | X | X | -|pattern-filename| | | | | | | -|pgp-public-key| | | | | X | | -|pgp-private-key| | | | | X | | -|yara| | | | X | X | X | -|stix2-pattern| | | | X | X | X | -|sigma| | | | X | X | X | -|gene| | | | | X | | -|kusto-query| | | | | X | | -|mime-type| | | | X | X | X | -|identity-card-number| | | | | | | -|cookie| | | | | X | | -|vulnerability| | | | X | | X | -|cpe| | | | X | | X | -|weakness| | | | X | | X | -|attachment| | | X | X | X | X | -|malware-sample| | | | X | X | X | -|link| X | | X | X | | | +|aba-rtn| | | | | X | | +|anonymised| X | X | X | X | X | X | +|attachment| X | X | | X | | | +|authentihash| | X | | | | | +|bank-account-nr| | | | | X | | +|bic| | | | | X | | +|bin| | | | | X | | +|boolean| | | | | | | +|bro| | | | X | | | +|btc| | | | | X | | +|campaign-id| | | X | | | | +|campaign-name| | | X | | | | +|cc-number| | | | | X | | +|cdhash| | X | | | | | +|chrome-extension-id| | | | | | | |comment| X | X | X | X | X | X | -|text| X | | X | X | X | X | -|hex| X | | X | X | X | X | -|other| X | | X | X | X | X | -|named pipe| | | | | X | | -|mutex| | | | | X | | -|process-state| | | | | X | | -|target-user| | X | | | | | -|target-email| | X | | | | | -|target-machine| | X | | | | | -|target-org| | X | | | | | -|target-location| | X | | | | | -|target-external| | X | | | | | -|btc| | | | | | | -|dash| | | | | | | -|xmr| | | | | | | -|iban| | | | | | | -|bic| | | | | | | -|bank-account-nr| | | | | | | -|aba-rtn| | | | | | | -|bin| | | | | | | -|cc-number| | | | | | | -|prtn| | | | | | | -|phone-number| | | | | | | -|threat-actor| | | | | | | -|campaign-name| | | | | | | -|campaign-id| | | | | | | -|malware-type| | | | X | | X | -|uri| | | | | | | -|authentihash| | | | X | X | X | -|vhash| | | | X | X | X | -|ssdeep| | | | X | X | X | -|imphash| | | | X | X | X | -|telfhash| | | | X | X | X | -|pehash| | | | X | | X | -|impfuzzy| | | | X | X | X | -|sha224| | | | X | X | X | -|sha384| | | | X | X | X | -|sha512| | | | X | X | X | -|sha512/224| | | | X | X | X | -|sha512/256| | | | X | X | X | -|sha3-224| | | | X | X | X | -|sha3-256| | | | X | X | X | -|sha3-384| | | | X | X | X | -|sha3-512| | | | X | X | X | -|tlsh| | | | X | | X | -|cdhash| | | | X | X | X | -|filename|authentihash| | | | X | X | X | -|filename|vhash| | | | X | X | X | -|filename|ssdeep| | | | X | X | X | -|filename|imphash| | | | X | X | X | -|filename|impfuzzy| | | | X | X | X | -|filename|pehash| | | | X | X | X | -|filename|sha224| | | | X | X | X | -|filename|sha384| | | | X | X | X | -|filename|sha512| | | | X | X | X | -|filename|sha512/224| | | | X | X | X | -|filename|sha512/256| | | | X | X | X | -|filename|sha3-224| | | | X | X | X | -|filename|sha3-256| | | | X | X | X | -|filename|sha3-384| | | | X | X | X | -|filename|sha3-512| | | | X | X | X | -|filename|tlsh| | | | X | X | X | -|windows-scheduled-task| | | | | X | | -|windows-service-name| | | | | X | | -|windows-service-displayname| | | | | X | | -|whois-registrant-email| | | | X | | | -|whois-registrant-phone| | | | | | | -|whois-registrant-name| | | | | | | -|whois-registrant-org| | | | | | | -|whois-registrar| | | | | | | -|whois-creation-date| | | | | | | -|x509-fingerprint-sha1| | | | X | X | X | -|x509-fingerprint-md5| | | | X | X | X | -|x509-fingerprint-sha256| | | | X | X | X | -|dns-soa-email| | | | | | | -|size-in-bytes| | | | | | | +|community-id| | | | X | | | +|cookie| | X | | | | | +|cortex| | | | X | | | |counter| | | | | | | +|country-of-residence| | | | | | | +|cpe| | | | X | | | +|dash| | | | | X | | +|date-of-birth| | | | | | | |datetime| | | | | | | -|port| | | | | | | -|ip-dst|port| | | | X | | | -|ip-src|port| | | | X | | | -|hostname|port| | | | X | | | -|mac-address| | | | X | | | -|mac-eui-64| | | | X | | | -|email-dst-display-name| | | | X | | | -|email-src-display-name| | | | X | | | -|email-header| | | | X | | | -|email-reply-to| | | | X | | | -|email-x-mailer| | | | X | | | -|email-mime-boundary| | | | X | | | -|email-thread-index| | | | X | | | -|email-message-id| | | | X | | | -|github-username| | | | | | | -|github-repository| | | | | | | -|github-organisation| | | | | | | -|jabber-id| | | | | | | -|twitter-id| | | | | | | |dkim| | | | | | | |dkim-signature| | | | | | | -|first-name| | | | | | | -|middle-name| | | | | | | -|last-name| | | | | | | -|date-of-birth| | | | | | | -|place-of-birth| | | | | | | -|gender| | | | | | | -|passport-number| | | | | | | -|passport-country| | | | | | | -|passport-expiration| | | | | | | -|redress-number| | | | | | | -|nationality| | | | | | | -|visa-number| | | | | | | -|issue-date-of-the-visa| | | | | | | -|primary-residence| | | | | | | -|country-of-residence| | | | | | | -|special-service-request| | | | | | | -|frequent-flyer-number| | | | | | | -|travel-details| | | | | | | -|payment-details| | | | | | | -|place-port-of-original-embarkation| | | | | | | -|place-port-of-clearance| | | | | | | -|place-port-of-onward-foreign-destination| | | | | | | -|passenger-name-record-locator-number| | | | | | | -|mobile-application-id| | | | X | | X | -|chrome-extension-id| | | | X | | X | -|cortex| | | | | | | -|boolean| | | | | | | -|anonymised| X | X | X | X | X | X | - -|Category| Persistence mechanism | Network activity | Payload type | Attribution | External analysis | Financial fraud | -| --- |:---:|:---:|:---:|:---:|:---:|:---:| -|md5| | | | | X | | -|sha1| | | | | X | | -|sha256| | | | | X | | -|filename| X | | | | X | | -|pdb| | | | | | | -|filename|md5| | | | | X | | -|filename|sha1| | | | | X | | -|filename|sha256| | | | | X | | -|ip-src| | X | | | X | | -|ip-dst| | X | | | X | | -|hostname| | X | | | X | | -|domain| | X | | | X | | -|domain|ip| | X | | | X | | -|email| | X | | X | | | -|email-src| | X | | | | | -|eppn| | X | | | | | -|email-dst| | X | | | | | -|email-subject| | X | | | | | +|dns-soa-email| | | X | | | | +|domain| | | | X | | | +|domain|ip| | | | X | | | +|email| | | X | | | | |email-attachment| | | | | | | |email-body| | | | | | | -|float| | | | | | | -|git-commit-id| | | | | | | -|url| | X | | | X | | -|http-method| | X | | | | | -|user-agent| | X | | | X | | -|ja3-fingerprint-md5| | X | | | X | | -|jarm-fingerprint| | X | | | X | | -|favicon-mmh3| | X | | | | | -|hassh-md5| | X | | | X | | -|hasshserver-md5| | X | | | X | | -|regkey| X | | | | X | | -|regkey|value| X | | | | X | | -|AS| | X | | | X | | -|snort| | X | | | X | | -|bro| | X | | | X | | -|zeek| | X | | | X | | -|community-id| | X | | | X | | -|pattern-in-file| | X | | | X | | -|pattern-in-traffic| | X | | | X | | -|pattern-in-memory| | | | | X | | -|pattern-filename| | | | | | | -|pgp-public-key| | | | | | | -|pgp-private-key| | | | | | | -|yara| | | | | | | -|stix2-pattern| | X | | | | | -|sigma| | | | | | | -|gene| | | | | | | -|kusto-query| | | | | | | -|mime-type| | | | | | | -|identity-card-number| | | | | | | -|cookie| | X | | | | | -|vulnerability| | | | | X | | -|cpe| | | | | X | | -|weakness| | | | | X | | -|attachment| | X | | | X | | -|malware-sample| | | | | X | | -|link| | | | | X | | -|comment| X | X | X | X | X | X | -|text| X | X | X | X | X | X | -|hex| X | X | | | | X | -|other| X | X | X | X | X | X | -|named pipe| | | | | | | -|mutex| | | | | | | -|process-state| | | | | | | -|target-user| | | | | | | -|target-email| | | | | | | -|target-machine| | | | | | | -|target-org| | | | | | | -|target-location| | | | | | | -|target-external| | | | | | | -|btc| | | | | | X | -|dash| | | | | | X | -|xmr| | | | | | X | -|iban| | | | | | X | -|bic| | | | | | X | -|bank-account-nr| | | | | | X | -|aba-rtn| | | | | | X | -|bin| | | | | | X | -|cc-number| | | | | | X | -|prtn| | | | | | X | -|phone-number| | | | | | X | -|threat-actor| | | | X | | | -|campaign-name| | | | X | | | -|campaign-id| | | | X | | | -|malware-type| | | | | | | -|uri| | X | | | | | -|authentihash| | | | | | | -|vhash| | | | | | | -|ssdeep| | | | | | | -|imphash| | | | | | | -|telfhash| | | | | | | -|pehash| | | | | | | -|impfuzzy| | | | | | | -|sha224| | | | | | | -|sha384| | | | | | | -|sha512| | | | | | | -|sha512/224| | | | | | | -|sha512/256| | | | | | | -|sha3-224| | | | | X | | -|sha3-256| | | | | X | | -|sha3-384| | | | | X | | -|sha3-512| | | | | X | | -|tlsh| | | | | | | -|cdhash| | | | | | | -|filename|authentihash| | | | | | | -|filename|vhash| | | | | | | -|filename|ssdeep| | | | | | | -|filename|imphash| | | | | | | -|filename|impfuzzy| | | | | | | -|filename|pehash| | | | | | | -|filename|sha224| | | | | | | -|filename|sha384| | | | | | | -|filename|sha512| | | | | | | -|filename|sha512/224| | | | | | | -|filename|sha512/256| | | | | | | -|filename|sha3-224| | | | | X | | -|filename|sha3-256| | | | | X | | -|filename|sha3-384| | | | | X | | -|filename|sha3-512| | | | | X | | -|filename|tlsh| | | | | | | -|windows-scheduled-task| | | | | | | -|windows-service-name| | | | | | | -|windows-service-displayname| | | | | | | -|whois-registrant-email| | | | X | | | -|whois-registrant-phone| | | | X | | | -|whois-registrant-name| | | | X | | | -|whois-registrant-org| | | | X | | | -|whois-registrar| | | | X | | | -|whois-creation-date| | | | X | | | -|x509-fingerprint-sha1| | X | | X | X | | -|x509-fingerprint-md5| | X | | X | X | | -|x509-fingerprint-sha256| | X | | X | X | | -|dns-soa-email| | | | X | | | -|size-in-bytes| | | | | | | -|counter| | | | | | | -|datetime| | | | | | | -|port| | X | | | | | -|ip-dst|port| | X | | | X | | -|ip-src|port| | X | | | X | | -|hostname|port| | X | | | | | -|mac-address| | X | | | X | | -|mac-eui-64| | X | | | X | | +|email-dst| | | | | | | |email-dst-display-name| | | | | | | -|email-src-display-name| | | | | | | |email-header| | | | | | | -|email-reply-to| | | | | | | -|email-x-mailer| | | | | | | -|email-mime-boundary| | | | | | | -|email-thread-index| | | | | | | |email-message-id| | | | | | | -|github-username| | | | | | | -|github-repository| | | | | X | | -|github-organisation| | | | | | | -|jabber-id| | | | | | | -|twitter-id| | | | | | | -|dkim| | X | | | | | -|dkim-signature| | X | | | | | +|email-mime-boundary| | | | | | | +|email-reply-to| | | | | | | +|email-src| | | | | | | +|email-src-display-name| | | | | | | +|email-subject| | | | | | | +|email-thread-index| | | | | | | +|email-x-mailer| | | | | | | +|eppn| | | | | | | +|favicon-mmh3| | | | | | | +|filename| | X | | X | | | +|filename|authentihash| | X | | | | | +|filename|impfuzzy| | X | | | | | +|filename|imphash| | X | | | | | +|filename|md5| | X | | X | | | +|filename|pehash| | X | | | | | +|filename|sha1| | X | | X | | | +|filename|sha224| | X | | | | | +|filename|sha256| | X | | X | | | +|filename|sha3-224| | X | | X | | | +|filename|sha3-256| | X | | X | | | +|filename|sha3-384| | X | | X | | | +|filename|sha3-512| | X | | X | | | +|filename|sha384| | X | | | | | +|filename|sha512| | X | | | | | +|filename|sha512/224| | X | | | | | +|filename|sha512/256| | X | | | | | +|filename|ssdeep| | X | | | | | +|filename|tlsh| | X | | | | | +|filename|vhash| | X | | | | | |first-name| | | | | | | -|middle-name| | | | | | | -|last-name| | | | | | | -|date-of-birth| | | | | | | -|place-of-birth| | | | | | | +|float| | | | | | | +|frequent-flyer-number| | | | | | | +|full-name| | | | | | | |gender| | | | | | | -|passport-number| | | | | | | +|gene| | X | | | | | +|git-commit-id| | | | | | X | +|github-organisation| | | | | | | +|github-repository| | | | X | | | +|github-username| | | | | | | +|hassh-md5| | | | X | | | +|hasshserver-md5| | | | X | | | +|hex| X | X | | | X | X | +|hostname| | | | X | | | +|hostname|port| | | | | | | +|http-method| | | | | | | +|iban| | | | | X | | +|identity-card-number| | | | | | | +|impfuzzy| | X | | | | | +|imphash| | X | | | | | +|ip-dst| | | | X | | | +|ip-dst|port| | | | X | | | +|ip-src| | | | X | | | +|ip-src|port| | | | X | | | +|issue-date-of-the-visa| | | | | | | +|ja3-fingerprint-md5| | | | X | | | +|jabber-id| | | | | | | +|jarm-fingerprint| | | | X | | | +|kusto-query| | X | | | | | +|last-name| | | | | | | +|link| X | | | X | | X | +|mac-address| | | | X | | | +|mac-eui-64| | | | X | | | +|malware-sample| | X | | X | | | +|malware-type| | | | | | | +|md5| | X | | X | | | +|middle-name| | | | | | | +|mime-type| | X | | | | | +|mobile-application-id| | | | | | | +|mutex| | X | | | | | +|named pipe| | X | | | | | +|nationality| | | | | | | +|other| X | X | X | X | X | X | +|passenger-name-record-locator-number| | | | | | | |passport-country| | | | | | | |passport-expiration| | | | | | | -|redress-number| | | | | | | -|nationality| | | | | | | -|visa-number| | | | | | | -|issue-date-of-the-visa| | | | | | | -|primary-residence| | | | | | | -|country-of-residence| | | | | | | -|special-service-request| | | | | | | -|frequent-flyer-number| | | | | | | -|travel-details| | | | | | | +|passport-number| | | | | | | +|pattern-filename| | | | | | | +|pattern-in-file| | X | | X | | | +|pattern-in-memory| | X | | X | | | +|pattern-in-traffic| | | | X | | | |payment-details| | | | | | | -|place-port-of-original-embarkation| | | | | | | +|pdb| | X | | | | | +|pehash| | | | | | | +|pgp-private-key| | X | | | | | +|pgp-public-key| | X | | | | | +|phone-number| | | | | X | | +|place-of-birth| | | | | | | |place-port-of-clearance| | | | | | | |place-port-of-onward-foreign-destination| | | | | | | -|passenger-name-record-locator-number| | | | | | | -|mobile-application-id| | | | | | | -|chrome-extension-id| | | | | | | -|cortex| | | | | X | | -|boolean| | | | | | | -|anonymised| X | X | X | X | X | X | +|place-port-of-original-embarkation| | | | | | | +|port| | | | | | | +|primary-residence| | | | | | | +|process-state| | X | | | | | +|prtn| | | | | X | | +|redress-number| | | | | | | +|regkey| | X | | X | | | +|regkey|value| | X | | X | | | +|sha1| | X | | X | | | +|sha224| | X | | | | | +|sha256| | X | | X | | | +|sha3-224| | X | | X | | | +|sha3-256| | X | | X | | | +|sha3-384| | X | | X | | | +|sha3-512| | X | | X | | | +|sha384| | X | | | | | +|sha512| | X | | | | | +|sha512/224| | X | | | | | +|sha512/256| | X | | | | | +|sigma| | X | | | | | +|size-in-bytes| | | | | | | +|snort| | | | X | | | +|special-service-request| | | | | | | +|ssdeep| | X | | | | | +|stix2-pattern| | X | | | | | +|target-email| | | | | | | +|target-external| | | | | | | +|target-location| | | | | | | +|target-machine| | | | | | | +|target-org| | | | | | | +|target-user| | | | | | | +|telfhash| | X | | | | | +|text| X | X | X | X | X | X | +|threat-actor| | | X | | | | +|tlsh| | | | | | | +|travel-details| | | | | | | +|twitter-id| | | | | | | +|uri| | | | | | | +|url| | | | X | | | +|user-agent| | | | X | | | +|vhash| | X | | | | | +|visa-number| | | | | | | +|vulnerability| | | | X | | | +|weakness| | | | X | | | +|whois-creation-date| | | X | | | | +|whois-registrant-email| | | X | | | | +|whois-registrant-name| | | X | | | | +|whois-registrant-org| | | X | | | | +|whois-registrant-phone| | | X | | | | +|whois-registrar| | | X | | | | +|windows-scheduled-task| | X | | | | | +|windows-service-displayname| | X | | | | | +|windows-service-name| | X | | | | | +|x509-fingerprint-md5| | X | X | X | | | +|x509-fingerprint-sha1| | X | X | X | | | +|x509-fingerprint-sha256| | X | X | X | | | +|xmr| | | | | X | | +|yara| | X | | | | | +|zeek| | | | X | | | -|Category| Support Tool | Social network | Person | Other | +|Category| Network activity | Other | Payload delivery | Payload installation | Payload type | Persistence mechanism | +| --- |:---:|:---:|:---:|:---:|:---:|:---:| +|AS| X | | X | | | | +|aba-rtn| | | | | | | +|anonymised| X | X | X | X | X | X | +|attachment| X | | X | X | | | +|authentihash| | | X | X | | | +|bank-account-nr| | | | | | | +|bic| | | | | | | +|bin| | | | | | | +|boolean| | X | | | | | +|bro| X | | | | | | +|btc| | | | | | | +|campaign-id| | | | | | | +|campaign-name| | | | | | | +|cc-number| | | | | | | +|cdhash| | | X | X | | | +|chrome-extension-id| | | X | X | | | +|comment| X | X | X | X | X | X | +|community-id| X | | | | | | +|cookie| X | | | | | | +|cortex| | | | | | | +|counter| | X | | | | | +|country-of-residence| | | | | | | +|cpe| | X | X | X | | | +|dash| | | | | | | +|date-of-birth| | | | | | | +|datetime| | X | | | | | +|dkim| X | | | | | | +|dkim-signature| X | | | | | | +|dns-soa-email| | | | | | | +|domain| X | | X | | | | +|domain|ip| X | | | | | | +|email| X | | X | | | | +|email-attachment| | | X | | | | +|email-body| | | X | | | | +|email-dst| X | | X | | | | +|email-dst-display-name| | | X | | | | +|email-header| | | X | | | | +|email-message-id| | | X | | | | +|email-mime-boundary| | | X | | | | +|email-reply-to| | | X | | | | +|email-src| X | | X | | | | +|email-src-display-name| | | X | | | | +|email-subject| X | | X | | | | +|email-thread-index| | | X | | | | +|email-x-mailer| | | X | | | | +|eppn| X | | | | | | +|favicon-mmh3| X | | | | | | +|filename| | | X | X | | X | +|filename|authentihash| | | X | X | | | +|filename|impfuzzy| | | X | X | | | +|filename|imphash| | | X | X | | | +|filename|md5| | | X | X | | | +|filename|pehash| | | X | X | | | +|filename|sha1| | | X | X | | | +|filename|sha224| | | X | X | | | +|filename|sha256| | | X | X | | | +|filename|sha3-224| | | X | X | | | +|filename|sha3-256| | | X | X | | | +|filename|sha3-384| | | X | X | | | +|filename|sha3-512| | | X | X | | | +|filename|sha384| | | X | X | | | +|filename|sha512| | | X | X | | | +|filename|sha512/224| | | X | X | | | +|filename|sha512/256| | | X | X | | | +|filename|ssdeep| | | X | X | | | +|filename|tlsh| | | X | X | | | +|filename|vhash| | | X | X | | | +|first-name| | | | | | | +|float| | X | | | | | +|frequent-flyer-number| | | | | | | +|full-name| | | | | | | +|gender| | | | | | | +|gene| | | | | | | +|git-commit-id| | | | | | | +|github-organisation| | | | | | | +|github-repository| | | | | | | +|github-username| | | | | | | +|hassh-md5| X | | X | | | | +|hasshserver-md5| X | | X | | | | +|hex| X | X | X | X | | X | +|hostname| X | | X | | | | +|hostname|port| X | | X | | | | +|http-method| X | | | | | | +|iban| | | | | | | +|identity-card-number| | | | | | | +|impfuzzy| | | X | X | | | +|imphash| | | X | X | | | +|ip-dst| X | | X | | | | +|ip-dst|port| X | | X | | | | +|ip-src| X | | X | | | | +|ip-src|port| X | | X | | | | +|issue-date-of-the-visa| | | | | | | +|ja3-fingerprint-md5| X | | X | | | | +|jabber-id| | | | | | | +|jarm-fingerprint| X | | X | | | | +|kusto-query| | | | | | | +|last-name| | | | | | | +|link| | | X | | | | +|mac-address| X | | X | | | | +|mac-eui-64| X | | X | | | | +|malware-sample| | | X | X | | | +|malware-type| | | X | X | | | +|md5| | | X | X | | | +|middle-name| | | | | | | +|mime-type| | | X | X | | | +|mobile-application-id| | | X | X | | | +|mutex| | | | | | | +|named pipe| | | | | | | +|nationality| | | | | | | +|other| X | X | X | X | X | X | +|passenger-name-record-locator-number| | | | | | | +|passport-country| | | | | | | +|passport-expiration| | | | | | | +|passport-number| | | | | | | +|pattern-filename| | | | | | | +|pattern-in-file| X | | X | X | | | +|pattern-in-memory| | | | X | | | +|pattern-in-traffic| X | | X | X | | | +|payment-details| | | | | | | +|pdb| | | | | | | +|pehash| | | X | X | | | +|pgp-private-key| | X | | | | | +|pgp-public-key| | X | | | | | +|phone-number| | X | | | | | +|place-of-birth| | | | | | | +|place-port-of-clearance| | | | | | | +|place-port-of-onward-foreign-destination| | | | | | | +|place-port-of-original-embarkation| | | | | | | +|port| X | X | | | | | +|primary-residence| | | | | | | +|process-state| | | | | | | +|prtn| | | | | | | +|redress-number| | | | | | | +|regkey| | | | | | X | +|regkey|value| | | | | | X | +|sha1| | | X | X | | | +|sha224| | | X | X | | | +|sha256| | | X | X | | | +|sha3-224| | | X | X | | | +|sha3-256| | | X | X | | | +|sha3-384| | | X | X | | | +|sha3-512| | | X | X | | | +|sha384| | | X | X | | | +|sha512| | | X | X | | | +|sha512/224| | | X | X | | | +|sha512/256| | | X | X | | | +|sigma| | | X | X | | | +|size-in-bytes| | X | | | | | +|snort| X | | | | | | +|special-service-request| | | | | | | +|ssdeep| | | X | X | | | +|stix2-pattern| X | | X | X | | | +|target-email| | | | | | | +|target-external| | | | | | | +|target-location| | | | | | | +|target-machine| | | | | | | +|target-org| | | | | | | +|target-user| | | | | | | +|telfhash| | | X | X | | | +|text| X | X | X | X | X | X | +|threat-actor| | | | | | | +|tlsh| | | X | X | | | +|travel-details| | | | | | | +|twitter-id| | | | | | | +|uri| X | | | | | | +|url| X | | X | | | | +|user-agent| X | | X | | | | +|vhash| | | X | X | | | +|visa-number| | | | | | | +|vulnerability| | | X | X | | | +|weakness| | | X | X | | | +|whois-creation-date| | | | | | | +|whois-registrant-email| | | X | | | | +|whois-registrant-name| | | | | | | +|whois-registrant-org| | | | | | | +|whois-registrant-phone| | | | | | | +|whois-registrar| | | | | | | +|windows-scheduled-task| | | | | | | +|windows-service-displayname| | | | | | | +|windows-service-name| | | | | | | +|x509-fingerprint-md5| X | | X | X | | | +|x509-fingerprint-sha1| X | | X | X | | | +|x509-fingerprint-sha256| X | | X | X | | | +|xmr| | | | | | | +|yara| | | X | X | | | +|zeek| X | | | | | | + +|Category| Person | Social network | Support Tool | Targeting data | | --- |:---:|:---:|:---:|:---:| -|md5| | | | | -|sha1| | | | | -|sha256| | | | | -|filename| | | | | -|pdb| | | | | -|filename|md5| | | | | -|filename|sha1| | | | | -|filename|sha256| | | | | -|ip-src| | | | | -|ip-dst| | | | | -|hostname| | | | | +|AS| | | | | +|aba-rtn| | | | | +|anonymised| X | X | X | X | +|attachment| | | X | | +|authentihash| | | | | +|bank-account-nr| | | | | +|bic| | | | | +|bin| | | | | +|boolean| | | | | +|bro| | | | | +|btc| | | | | +|campaign-id| | | | | +|campaign-name| | | | | +|cc-number| | | | | +|cdhash| | | | | +|chrome-extension-id| | | | | +|comment| X | X | X | X | +|community-id| | | | | +|cookie| | | | | +|cortex| | | | | +|counter| | | | | +|country-of-residence| X | | | | +|cpe| | | | | +|dash| | | | | +|date-of-birth| X | | | | +|datetime| | | | | +|dkim| | | | | +|dkim-signature| | | | | +|dns-soa-email| | | | | |domain| | | | | |domain|ip| | | | | -|email| | X | X | | -|email-src| | X | | | -|eppn| | X | | | -|email-dst| | X | | | -|email-subject| | | | | +|email| X | X | | | |email-attachment| | | | | |email-body| | | | | -|float| | | | X | -|git-commit-id| | | | | -|url| | | | | -|http-method| | | | | -|user-agent| | | | | -|ja3-fingerprint-md5| | | | | -|jarm-fingerprint| | | | | +|email-dst| | X | | | +|email-dst-display-name| | | | | +|email-header| | | | | +|email-message-id| | | | | +|email-mime-boundary| | | | | +|email-reply-to| | | | | +|email-src| | X | | | +|email-src-display-name| | | | | +|email-subject| | | | | +|email-thread-index| | | | | +|email-x-mailer| | | | | +|eppn| | X | | | |favicon-mmh3| | | | | -|hassh-md5| | | | | -|hasshserver-md5| | | | | -|regkey| | | | | -|regkey|value| | | | | -|AS| | | | | -|snort| | | | | -|bro| | | | | -|zeek| | | | | -|community-id| | | | | -|pattern-in-file| | | | | -|pattern-in-traffic| | | | | -|pattern-in-memory| | | | | -|pattern-filename| | | | | -|pgp-public-key| | X | X | X | -|pgp-private-key| | X | X | X | -|yara| | | | | -|stix2-pattern| | | | | -|sigma| | | | | -|gene| | | | | -|kusto-query| | | | | -|mime-type| | | | | -|identity-card-number| | | X | | -|cookie| | | | | -|vulnerability| | | | | -|cpe| | | | X | -|weakness| | | | | -|attachment| X | | | | -|malware-sample| | | | | -|link| X | | | | -|comment| X | X | X | X | -|text| X | X | X | X | -|hex| X | | | X | -|other| X | X | X | X | -|named pipe| | | | | -|mutex| | | | | -|process-state| | | | | -|target-user| | | | | -|target-email| | | | | -|target-machine| | | | | -|target-org| | | | | -|target-location| | | | | -|target-external| | | | | -|btc| | | | | -|dash| | | | | -|xmr| | | | | -|iban| | | | | -|bic| | | | | -|bank-account-nr| | | | | -|aba-rtn| | | | | -|bin| | | | | -|cc-number| | | | | -|prtn| | | | | -|phone-number| | | X | X | -|threat-actor| | | | | -|campaign-name| | | | | -|campaign-id| | | | | -|malware-type| | | | | -|uri| | | | | -|authentihash| | | | | -|vhash| | | | | -|ssdeep| | | | | -|imphash| | | | | -|telfhash| | | | | -|pehash| | | | | -|impfuzzy| | | | | -|sha224| | | | | -|sha384| | | | | -|sha512| | | | | -|sha512/224| | | | | -|sha512/256| | | | | -|sha3-224| | | | | -|sha3-256| | | | | -|sha3-384| | | | | -|sha3-512| | | | | -|tlsh| | | | | -|cdhash| | | | | +|filename| | | | | |filename|authentihash| | | | | -|filename|vhash| | | | | -|filename|ssdeep| | | | | -|filename|imphash| | | | | |filename|impfuzzy| | | | | +|filename|imphash| | | | | +|filename|md5| | | | | |filename|pehash| | | | | +|filename|sha1| | | | | |filename|sha224| | | | | -|filename|sha384| | | | | -|filename|sha512| | | | | -|filename|sha512/224| | | | | -|filename|sha512/256| | | | | +|filename|sha256| | | | | |filename|sha3-224| | | | | |filename|sha3-256| | | | | |filename|sha3-384| | | | | |filename|sha3-512| | | | | +|filename|sha384| | | | | +|filename|sha512| | | | | +|filename|sha512/224| | | | | +|filename|sha512/256| | | | | +|filename|ssdeep| | | | | |filename|tlsh| | | | | -|windows-scheduled-task| | | | | -|windows-service-name| | | | | -|windows-service-displayname| | | | | -|whois-registrant-email| | X | | | -|whois-registrant-phone| | | | | -|whois-registrant-name| | | | | -|whois-registrant-org| | | | | -|whois-registrar| | | | | -|whois-creation-date| | | | | -|x509-fingerprint-sha1| | | | | -|x509-fingerprint-md5| | | | | -|x509-fingerprint-sha256| | | | | -|dns-soa-email| | | | | -|size-in-bytes| | | | X | -|counter| | | | X | -|datetime| | | | X | -|port| | | | X | -|ip-dst|port| | | | | -|ip-src|port| | | | | +|filename|vhash| | | | | +|first-name| X | | | | +|float| | | | | +|frequent-flyer-number| X | | | | +|full-name| X | | | | +|gender| X | | | | +|gene| | | | | +|git-commit-id| | | | | +|github-organisation| | X | | | +|github-repository| | X | | | +|github-username| | X | | | +|hassh-md5| | | | | +|hasshserver-md5| | | | | +|hex| | | X | | +|hostname| | | | | |hostname|port| | | | | +|http-method| | | | | +|iban| | | | | +|identity-card-number| X | | | | +|impfuzzy| | | | | +|imphash| | | | | +|ip-dst| | | | | +|ip-dst|port| | | | | +|ip-src| | | | | +|ip-src|port| | | | | +|issue-date-of-the-visa| X | | | | +|ja3-fingerprint-md5| | | | | +|jabber-id| | X | | | +|jarm-fingerprint| | | | | +|kusto-query| | | | | +|last-name| X | | | | +|link| | | X | | |mac-address| | | | | |mac-eui-64| | | | | -|email-dst-display-name| | | | | -|email-src-display-name| | | | | -|email-header| | | | | -|email-reply-to| | | | | -|email-x-mailer| | | | | -|email-mime-boundary| | | | | -|email-thread-index| | | | | -|email-message-id| | | | | -|github-username| | X | | | -|github-repository| | X | | | -|github-organisation| | X | | | -|jabber-id| | X | | | -|twitter-id| | X | | | -|dkim| | | | | -|dkim-signature| | | | | -|first-name| | | X | | -|middle-name| | | X | | -|last-name| | | X | | -|date-of-birth| | | X | | -|place-of-birth| | | X | | -|gender| | | X | | -|passport-number| | | X | | -|passport-country| | | X | | -|passport-expiration| | | X | | -|redress-number| | | X | | -|nationality| | | X | | -|visa-number| | | X | | -|issue-date-of-the-visa| | | X | | -|primary-residence| | | X | | -|country-of-residence| | | X | | -|special-service-request| | | X | | -|frequent-flyer-number| | | X | | -|travel-details| | | X | | -|payment-details| | | X | | -|place-port-of-original-embarkation| | | X | | -|place-port-of-clearance| | | X | | -|place-port-of-onward-foreign-destination| | | X | | -|passenger-name-record-locator-number| | | X | | +|malware-sample| | | | | +|malware-type| | | | | +|md5| | | | | +|middle-name| X | | | | +|mime-type| | | | | |mobile-application-id| | | | | -|chrome-extension-id| | | | | -|cortex| | | | | -|boolean| | | | X | -|anonymised| X | X | X | X | +|mutex| | | | | +|named pipe| | | | | +|nationality| X | | | | +|other| X | X | X | | +|passenger-name-record-locator-number| X | | | | +|passport-country| X | | | | +|passport-expiration| X | | | | +|passport-number| X | | | | +|pattern-filename| | | | | +|pattern-in-file| | | | | +|pattern-in-memory| | | | | +|pattern-in-traffic| | | | | +|payment-details| X | | | | +|pdb| | | | | +|pehash| | | | | +|pgp-private-key| X | X | | | +|pgp-public-key| X | X | | | +|phone-number| X | | | | +|place-of-birth| X | | | | +|place-port-of-clearance| X | | | | +|place-port-of-onward-foreign-destination| X | | | | +|place-port-of-original-embarkation| X | | | | +|port| | | | | +|primary-residence| X | | | | +|process-state| | | | | +|prtn| | | | | +|redress-number| X | | | | +|regkey| | | | | +|regkey|value| | | | | +|sha1| | | | | +|sha224| | | | | +|sha256| | | | | +|sha3-224| | | | | +|sha3-256| | | | | +|sha3-384| | | | | +|sha3-512| | | | | +|sha384| | | | | +|sha512| | | | | +|sha512/224| | | | | +|sha512/256| | | | | +|sigma| | | | | +|size-in-bytes| | | | | +|snort| | | | | +|special-service-request| X | | | | +|ssdeep| | | | | +|stix2-pattern| | | | | +|target-email| | | | X | +|target-external| | | | X | +|target-location| | | | X | +|target-machine| | | | X | +|target-org| | | | X | +|target-user| | | | X | +|telfhash| | | | | +|text| X | X | X | | +|threat-actor| | | | | +|tlsh| | | | | +|travel-details| X | | | | +|twitter-id| | X | | | +|uri| | | | | +|url| | | | | +|user-agent| | | | | +|vhash| | | | | +|visa-number| X | | | | +|vulnerability| | | | | +|weakness| | | | | +|whois-creation-date| | | | | +|whois-registrant-email| | X | | | +|whois-registrant-name| | | | | +|whois-registrant-org| | | | | +|whois-registrant-phone| | | | | +|whois-registrar| | | | | +|windows-scheduled-task| | | | | +|windows-service-displayname| | | | | +|windows-service-name| | | | | +|x509-fingerprint-md5| | | | | +|x509-fingerprint-sha1| | | | | +|x509-fingerprint-sha256| | | | | +|xmr| | | | | +|yara| | | | | +|zeek| | | | | + ### Categories -* **Internal reference**: Reference used by the publishing party (e.g. ticket number) -* **Targeting data**: Targeting information to include recipient email, infected machines, department, and or locations. -* **Antivirus detection**: List of anti-virus vendors detecting the malware or information on detection performance (e.g. 13/43 or 67%). Attachment with list of detection or link to VirusTotal could be placed here as well. -* **Payload delivery**: Information about the way the malware payload is initially delivered, for example information about the email or web-site, vulnerability used, originating IP etc. Malware sample itself should be attached here. +* **Antivirus detection**: All the info about how the malware is detected by the antivirus products * **Artifacts dropped**: Any artifact (files, registry keys etc.) dropped by the malware or other modifications to the system -* **Payload installation**: Location where the payload was placed in the system and the way it was installed. For example, a filename|md5 type attribute can be added here like this: c:\windows\system32\malicious.exe|41d8cd98f00b204e9800998ecf8427e. -* **Persistence mechanism**: Mechanisms used by the malware to start at boot. This could be a registry key, legitimate driver modification, LNK file in startup -* **Network activity**: Information about network traffic generated by the malware -* **Payload type**: Information about the final payload(s). Can contain a function of the payload, e.g. keylogger, RAT, or a name if identified, such as Poison Ivy. * **Attribution**: Identification of the group, organisation, or country behind the attack -* **External analysis**: Any other result from additional analysis of the malware like tools output Examples: pdf-parser output, automated sandbox analysis, reverse engineering report. -* **Financial fraud**: Financial Fraud indicators, for example: IBAN Numbers, BIC codes, Credit card numbers, etc. -* **Support Tool**: Tools supporting analysis or detection of the event -* **Social network**: Social networks and platforms -* **Person**: A human being - natural person +* **External analysis**: Any other result from additional analysis of the malware like tools output +* **Financial fraud**: Financial Fraud indicators +* **Internal reference**: Reference used by the publishing party (e.g. ticket number) +* **Network activity**: Information about network traffic generated by the malware * **Other**: Attributes that are not part of any other category or are meant to be used as a component in MISP objects in the future +* **Payload delivery**: Information about how the malware is delivered +* **Payload installation**: Info on where the malware gets installed in the system +* **Payload type**: Information about the final payload(s) +* **Persistence mechanism**: Mechanisms used by the malware to start at boot +* **Person**: A human being - natural person +* **Social network**: Social networks and platforms +* **Support Tool**: Tools supporting analysis or detection of the event +* **Targeting data**: Internal Attack Targeting and Compromise Information ### Types -* **md5**: You are encouraged to use filename|md5 instead. A checksum in md5 format, only use this if you don't know the correct filename -* **sha1**: You are encouraged to use filename|sha1 instead. A checksum in sha1 format, only use this if you don't know the correct filename -* **sha256**: You are encouraged to use filename|sha256 instead. A checksum in sha256 format, only use this if you don't know the correct filename -* **filename**: Filename -* **pdb**: Microsoft Program database (PDB) path information -* **filename|md5**: A filename and an md5 hash separated by a | (no spaces) -* **filename|sha1**: A filename and an sha1 hash separated by a | (no spaces) -* **filename|sha256**: A filename and an sha256 hash separated by a | (no spaces) -* **ip-src**: A source IP address of the attacker -* **ip-dst**: A destination IP address of the attacker or C&C server. Also set the IDS flag on when this IP is hardcoded in malware -* **hostname**: A full host/dnsname of an attacker. Also set the IDS flag on when this hostname is hardcoded in malware -* **domain**: A domain name used in the malware. Use this instead of hostname when the upper domain is important or can be used to create links between events. -* **domain|ip**: A domain name and its IP address (as found in DNS lookup) separated by a | (no spaces) -* **email**: An e-mail address -* **email-src**: The source email address. Used to describe the sender when describing an e-mail. -* **eppn**: eduPersonPrincipalName - eppn - the NetId of the person for the purposes of inter-institutional authentication. Should be stored in the form of user@univ.edu, where univ.edu is the name of the local security domain. -* **email-dst**: The destination email address. Used to describe the recipient when describing an e-mail. -* **email-subject**: The subject of the email -* **email-attachment**: File name of the email attachment. -* **email-body**: Email body -* **float**: A floating point value. -* **git-commit-id**: A git commit ID. -* **url**: url -* **http-method**: HTTP method used by the malware (e.g. POST, GET, ...). -* **user-agent**: The user-agent used by the malware in the HTTP request. -* **ja3-fingerprint-md5**: JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence. -* **jarm-fingerprint**: JARM is a method for creating SSL/TLS server fingerprints. -* **favicon-mmh3**: favicon-mmh3 is the murmur3 hash of a favicon as used in Shodan. -* **hassh-md5**: hassh is a network fingerprinting standard which can be used to identify specific Client SSH implementations. The fingerprints can be easily stored, searched and shared in the form of an MD5 fingerprint. -* **hasshserver-md5**: hasshServer is a network fingerprinting standard which can be used to identify specific Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of an MD5 fingerprint. -* **regkey**: Registry key or value -* **regkey|value**: Registry value + data separated by | * **AS**: Autonomous system -* **snort**: An IDS rule in Snort rule-format. This rule will be automatically rewritten in the NIDS exports. -* **bro**: An NIDS rule in the Bro rule-format. -* **zeek**: An NIDS rule in the Zeek rule-format. -* **community-id**: a community ID flow hashing algorithm to map multiple traffic monitors into common flow id -* **pattern-in-file**: Pattern in file that identifies the malware -* **pattern-in-traffic**: Pattern in network traffic that identifies the malware -* **pattern-in-memory**: Pattern in memory dump that identifies the malware -* **pattern-filename**: A pattern in the name of a file -* **pgp-public-key**: A PGP public key -* **pgp-private-key**: A PGP private key -* **yara**: Yara signature -* **stix2-pattern**: STIX 2 pattern -* **sigma**: Sigma - Generic Signature Format for SIEM Systems -* **gene**: GENE - Go Evtx sigNature Engine -* **kusto-query**: Kusto query - Kusto from Microsoft Azure is a service for storing and running interactive analytics over Big Data. -* **mime-type**: A media type (also MIME type and content type) is a two-part identifier for file formats and format contents transmitted on the Internet -* **identity-card-number**: Identity card number -* **cookie**: HTTP cookie as often stored on the user web client. This can include authentication cookie or session cookie. -* **vulnerability**: A reference to the vulnerability used in the exploit -* **cpe**: Common Platform Enumeration - structured naming scheme for information technology systems, software, and packages. -* **weakness**: A reference to the weakness used in the exploit -* **attachment**: Please upload files using the Upload Attachment button. -* **malware-sample**: Please upload files using the Upload Attachment button. -* **link**: Link to an external information -* **comment**: Comment or description in a human language. This will not be correlated with other attributes -* **text**: Name, ID or a reference -* **hex**: A value in hexadecimal format -* **other**: Other attribute -* **named pipe**: Named pipe, use the format \.\pipe\ -* **mutex**: Mutex, use the format \BaseNamedObjects\ -* **process-state**: State of a process -* **target-user**: Attack Targets Username(s) -* **target-email**: Attack Targets Email(s) -* **target-machine**: Attack Targets Machine Name(s) -* **target-org**: Attack Targets Department or Organization(s) -* **target-location**: Attack Targets Physical Location(s) -* **target-external**: External Target Organizations Affected by this Attack -* **btc**: Bitcoin Address -* **dash**: Dash Address -* **xmr**: Monero Address -* **iban**: International Bank Account Number -* **bic**: Bank Identifier Code Number also known as SWIFT-BIC, SWIFT code or ISO 9362 code -* **bank-account-nr**: Bank account number without any routing number * **aba-rtn**: ABA routing transit number +* **anonymised**: Anonymised value - described with the anonymisation object via a relationship +* **attachment**: Attachment with external information +* **authentihash**: Authenticode executable signature hash +* **bank-account-nr**: Bank account number without any routing number +* **bic**: Bank Identifier Code Number also known as SWIFT-BIC, SWIFT code or ISO 9362 code * **bin**: Bank Identification Number -* **cc-number**: Credit-Card Number -* **prtn**: Premium-Rate Telephone Number -* **phone-number**: Telephone Number -* **threat-actor**: A string identifying the threat actor -* **campaign-name**: Associated campaign name +* **boolean**: Boolean value - to be used in objects +* **bro**: An NIDS rule in the Bro rule-format +* **btc**: Bitcoin Address * **campaign-id**: Associated campaign ID -* **malware-type**: -* **uri**: Uniform Resource Identifier -* **authentihash**: You are encouraged to use filename|authentihash instead. Authenticode executable signature hash, only use this if you don't know the correct filename -* **vhash**: You are encouraged to use filename|vhash instead. A checksum from VirusTotal, only use this if you don't know the correct filename -* **ssdeep**: You are encouraged to use filename|ssdeep instead. A checksum in the SSDeep format, only use this if you don't know the correct filename -* **imphash**: You are encouraged to use filename|imphash instead. A hash created based on the imports in the sample, only use this if you don't know the correct filename -* **telfhash**: You are encouraged to use a file object with telfash -* **pehash**: PEhash - a hash calculated based of certain pieces of a PE executable file -* **impfuzzy**: You are encouraged to use filename|impfuzzy instead. A fuzzy hash created based on the imports in the sample, only use this if you don't know the correct filename -* **sha224**: You are encouraged to use filename|sha224 instead. A checksum in sha224 format, only use this if you don't know the correct filename -* **sha384**: You are encouraged to use filename|sha384 instead. A checksum in sha384 format, only use this if you don't know the correct filename -* **sha512**: You are encouraged to use filename|sha512 instead. A checksum in sha512 format, only use this if you don't know the correct filename -* **sha512/224**: You are encouraged to use filename|sha512/224 instead. A checksum in sha512/224 format, only use this if you don't know the correct filename -* **sha512/256**: You are encouraged to use filename|sha512/256 instead. A checksum in sha512/256 format, only use this if you don't know the correct filename -* **sha3-224**: You are encouraged to use filename|sha3-224 instead. A checksum in sha3-224 format, only use this if you don't know the correct filename -* **sha3-256**: You are encouraged to use filename|sha3-256 instead. A checksum in sha3-256 format, only use this if you don't know the correct filename -* **sha3-384**: You are encouraged to use filename|sha3-384 instead. A checksum in sha3-384 format, only use this if you don't know the correct filename -* **sha3-512**: You are encouraged to use filename|sha3-512 instead. A checksum in sha3-512 format, only use this if you don't know the correct filename -* **tlsh**: You are encouraged to use filename|tlsh instead. A checksum in the Trend Micro Locality Sensitive Hash format, only use this if you don't know the correct filename +* **campaign-name**: Associated campaign name +* **cc-number**: Credit-Card Number * **cdhash**: An Apple Code Directory Hash, identifying a code-signed Mach-O executable file -* **filename|authentihash**: A checksum in md5 format -* **filename|vhash**: A filename and a VirusTotal hash separated by a | -* **filename|ssdeep**: A checksum in ssdeep format -* **filename|imphash**: Import hash - a hash created based on the imports in the sample. -* **filename|impfuzzy**: Import fuzzy hash - a fuzzy hash created based on the imports in the sample. -* **filename|pehash**: A filename and a PEhash separated by a | -* **filename|sha224**: A filename and a sha-224 hash separated by a | -* **filename|sha384**: A filename and a sha-384 hash separated by a | -* **filename|sha512**: A filename and a sha-512 hash separated by a | -* **filename|sha512/224**: A filename and a sha-512/224 hash separated by a | -* **filename|sha512/256**: A filename and a sha-512/256 hash separated by a | -* **filename|sha3-224**: A filename and an sha3-224 hash separated by a | -* **filename|sha3-256**: A filename and an sha3-256 hash separated by a | -* **filename|sha3-384**: A filename and an sha3-384 hash separated by a | -* **filename|sha3-512**: A filename and an sha3-512 hash separated by a | -* **filename|tlsh**: A filename and a Trend Micro Locality Sensitive Hash separated by a | -* **windows-scheduled-task**: A scheduled task in windows -* **windows-service-name**: A windows service name. This is the name used internally by windows. Not to be confused with the windows-service-displayname. -* **windows-service-displayname**: A windows service's displayname, not to be confused with the windows-service-name. This is the name that applications will generally display as the service's name in applications. -* **whois-registrant-email**: The e-mail of a domain's registrant, obtained from the WHOIS information. -* **whois-registrant-phone**: The phone number of a domain's registrant, obtained from the WHOIS information. -* **whois-registrant-name**: The name of a domain's registrant, obtained from the WHOIS information. -* **whois-registrant-org**: The org of a domain's registrant, obtained from the WHOIS information. -* **whois-registrar**: The registrar of the domain, obtained from the WHOIS information. -* **whois-creation-date**: The date of domain's creation, obtained from the WHOIS information. -* **x509-fingerprint-sha1**: X509 fingerprint in SHA-1 format -* **x509-fingerprint-md5**: X509 fingerprint in MD5 format -* **x509-fingerprint-sha256**: X509 fingerprint in SHA-256 format -* **dns-soa-email**: RFC1035 mandates that DNS zones should have a SOA (Statement Of Authority) record that contains an email address where a PoC for the domain could be contacted. This can sometimes be used for attribution/linkage between different domains even if protected by whois privacy -* **size-in-bytes**: Size expressed in bytes +* **chrome-extension-id**: Chrome extension id +* **comment**: Comment or description in a human language +* **community-id**: a community ID flow hashing algorithm to map multiple traffic monitors into common flow id +* **cookie**: HTTP cookie as often stored on the user web client. This can include authentication cookie or session cookie. +* **cortex**: Cortex analysis result * **counter**: An integer counter, generally to be used in objects +* **country-of-residence**: The country of residence of a natural person +* **cpe**: Common Platform Enumeration - structured naming scheme for information technology systems, software, and packages. +* **dash**: Dash Address +* **date-of-birth**: Date of birth of a natural person (in YYYY-MM-DD format) * **datetime**: Datetime in the ISO 8601 format -* **port**: Port number -* **ip-dst|port**: IP destination and port number separated by a | -* **ip-src|port**: IP source and port number separated by a | -* **hostname|port**: Hostname and port number separated by a | -* **mac-address**: Mac address -* **mac-eui-64**: Mac EUI-64 address -* **email-dst-display-name**: Email destination display name -* **email-src-display-name**: Email source display name -* **email-header**: Email header -* **email-reply-to**: Email reply to header -* **email-x-mailer**: Email x-mailer header -* **email-mime-boundary**: The email mime boundary separating parts in a multipart email -* **email-thread-index**: The email thread index header -* **email-message-id**: The email message ID -* **github-username**: A github user name -* **github-repository**: A github repository -* **github-organisation**: A github organisation -* **jabber-id**: Jabber ID -* **twitter-id**: Twitter ID * **dkim**: DKIM public key * **dkim-signature**: DKIM signature +* **dns-soa-email**: RFC1035 mandates that DNS zones should have a SOA (Statement Of Authority) record that contains an email address where a PoC for the domain could be contacted. This can sometimes be used for attribution/linkage between different domains even if protected by whois privacy +* **domain**: A domain name used in the malware +* **domain|ip**: A domain name and its IP address (as found in DNS lookup) separated by a | +* **email**: An e-mail address +* **email-attachment**: File name of the email attachment. +* **email-body**: Email body +* **email-dst**: The destination email address. Used to describe the recipient when describing an e-mail. +* **email-dst-display-name**: Email destination display name +* **email-header**: Email header +* **email-message-id**: The email message ID +* **email-mime-boundary**: The email mime boundary separating parts in a multipart email +* **email-reply-to**: Email reply to header +* **email-src**: The source email address. Used to describe the sender when describing an e-mail. +* **email-src-display-name**: Email source display name +* **email-subject**: The subject of the email +* **email-thread-index**: The email thread index header +* **email-x-mailer**: Email x-mailer header +* **eppn**: eduPersonPrincipalName - eppn - the NetId of the person for the purposes of inter-institutional authentication. Should be stored in the form of user@univ.edu, where univ.edu is the name of the local security domain. +* **favicon-mmh3**: favicon-mmh3 is the murmur3 hash of a favicon as used in Shodan. +* **filename**: Filename +* **filename|authentihash**: A checksum in md5 format +* **filename|impfuzzy**: Import fuzzy hash - a fuzzy hash created based on the imports in the sample. +* **filename|imphash**: Import hash - a hash created based on the imports in the sample. +* **filename|md5**: A filename and an md5 hash separated by a | +* **filename|pehash**: A filename and a PEhash separated by a | +* **filename|sha1**: A filename and an sha1 hash separated by a | +* **filename|sha224**: A filename and a sha-224 hash separated by a | +* **filename|sha256**: A filename and an sha256 hash separated by a | +* **filename|sha3-224**: A filename and an sha3-224 hash separated by a | +* **filename|sha3-256**: A filename and an sha3-256 hash separated by a | +* **filename|sha3-384**: A filename and an sha3-384 hash separated by a | +* **filename|sha3-512**: A filename and an sha3-512 hash separated by a | +* **filename|sha384**: A filename and a sha-384 hash separated by a | +* **filename|sha512**: A filename and a sha-512 hash separated by a | +* **filename|sha512/224**: A filename and a sha-512/224 hash separated by a | +* **filename|sha512/256**: A filename and a sha-512/256 hash separated by a | +* **filename|ssdeep**: A checksum in ssdeep format +* **filename|tlsh**: A filename and a Trend Micro Locality Sensitive Hash separated by a | +* **filename|vhash**: A filename and a VirusTotal hash separated by a | * **first-name**: First name of a natural person -* **middle-name**: Middle name of a natural person -* **last-name**: Last name of a natural person -* **date-of-birth**: Date of birth of a natural person (in YYYY-MM-DD format) -* **place-of-birth**: Place of birth of a natural person +* **float**: A floating point value. +* **frequent-flyer-number**: The frequent flyer number of a passenger +* **full-name**: Full name of a natural person * **gender**: The gender of a natural person (Male, Female, Other, Prefer not to say) -* **passport-number**: The passport number of a natural person +* **gene**: GENE - Go Evtx sigNature Engine +* **git-commit-id**: A git commit ID. +* **github-organisation**: A github organisation +* **github-repository**: A github repository +* **github-username**: A github user name +* **hassh-md5**: hassh is a network fingerprinting standard which can be used to identify specific Client SSH implementations. The fingerprints can be easily stored, searched and shared in the form of an MD5 fingerprint. +* **hasshserver-md5**: hasshServer is a network fingerprinting standard which can be used to identify specific Server SSH implementations. The fingerprints can be easily stored, searched and shared in the form of an MD5 fingerprint. +* **hex**: A value in hexadecimal format +* **hostname**: A full host/dnsname of an attacker +* **hostname|port**: Hostname and port number separated by a | +* **http-method**: HTTP method used by the malware (e.g. POST, GET, ...). +* **iban**: International Bank Account Number +* **identity-card-number**: Identity card number +* **impfuzzy**: A fuzzy hash of import table of Portable Executable format +* **imphash**: Import hash - a hash created based on the imports in the sample. +* **ip-dst**: A destination IP address of the attacker or C&C server +* **ip-dst|port**: IP destination and port number separated by a | +* **ip-src**: A source IP address of the attacker +* **ip-src|port**: IP source and port number separated by a | +* **issue-date-of-the-visa**: The date on which the visa was issued +* **ja3-fingerprint-md5**: JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence. +* **jabber-id**: Jabber ID +* **jarm-fingerprint**: JARM is a method for creating SSL/TLS server fingerprints. +* **kusto-query**: Kusto query - Kusto from Microsoft Azure is a service for storing and running interactive analytics over Big Data. +* **last-name**: Last name of a natural person +* **link**: Link to an external information +* **mac-address**: Mac address +* **mac-eui-64**: Mac EUI-64 address +* **malware-sample**: Attachment containing encrypted malware sample +* **malware-type**: +* **md5**: A checksum in md5 format +* **middle-name**: Middle name of a natural person +* **mime-type**: A media type (also MIME type and content type) is a two-part identifier for file formats and format contents transmitted on the Internet +* **mobile-application-id**: The application id of a mobile application +* **mutex**: Mutex, use the format \BaseNamedObjects\ +* **named pipe**: Named pipe, use the format \.\pipe\ +* **nationality**: The nationality of a natural person +* **other**: Other attribute +* **passenger-name-record-locator-number**: The Passenger Name Record Locator is a key under which the reservation for a trip is stored in the system. The PNR contains, among other data, the name, flight segments and address of the passenger. It is defined by a combination of five or six letters and numbers. * **passport-country**: The country in which the passport was issued * **passport-expiration**: The expiration date of a passport -* **redress-number**: The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems -* **nationality**: The nationality of a natural person -* **visa-number**: Visa number -* **issue-date-of-the-visa**: The date on which the visa was issued -* **primary-residence**: The primary residence of a natural person -* **country-of-residence**: The country of residence of a natural person -* **special-service-request**: A Special Service Request is a function to an airline to provide a particular facility for A Passenger or passengers. -* **frequent-flyer-number**: The frequent flyer number of a passenger -* **travel-details**: Travel details +* **passport-number**: The passport number of a natural person +* **pattern-filename**: A pattern in the name of a file +* **pattern-in-file**: Pattern in file that identifies the malware +* **pattern-in-memory**: Pattern in memory dump that identifies the malware +* **pattern-in-traffic**: Pattern in network traffic that identifies the malware * **payment-details**: Payment details -* **place-port-of-original-embarkation**: The orignal port of embarkation +* **pdb**: Microsoft Program database (PDB) path information +* **pehash**: PEhash - a hash calculated based of certain pieces of a PE executable file +* **pgp-private-key**: A PGP private key +* **pgp-public-key**: A PGP public key +* **phone-number**: Telephone Number +* **place-of-birth**: Place of birth of a natural person * **place-port-of-clearance**: The port of clearance * **place-port-of-onward-foreign-destination**: A Port where the passenger is transiting to -* **passenger-name-record-locator-number**: The Passenger Name Record Locator is a key under which the reservation for a trip is stored in the system. The PNR contains, among other data, the name, flight segments and address of the passenger. It is defined by a combination of five or six letters and numbers. -* **mobile-application-id**: The application id of a mobile application -* **chrome-extension-id**: Chrome extension id -* **cortex**: Cortex analysis result -* **boolean**: Boolean value - to be used in objects -* **anonymised**: Anonymised value - described with the anonymisation object via a relationship. - +* **place-port-of-original-embarkation**: The original port of embarkation +* **port**: Port number +* **primary-residence**: The primary residence of a natural person +* **process-state**: State of a process +* **prtn**: Premium-Rate Telephone Number +* **redress-number**: The Redress Control Number is the record identifier for people who apply for redress through the DHS Travel Redress Inquiry Program (DHS TRIP). DHS TRIP is for travelers who have been repeatedly identified for additional screening and who want to file an inquiry to have erroneous information corrected in DHS systems +* **regkey**: Registry key or value +* **regkey|value**: Registry value + data separated by | +* **sha1**: A checksum in sha1 format +* **sha224**: A checksum in sha-224 format +* **sha256**: A checksum in sha256 format +* **sha3-224**: A checksum in sha3-224 format +* **sha3-256**: A checksum in sha3-256 format +* **sha3-384**: A checksum in sha3-384 format +* **sha3-512**: A checksum in sha3-512 format +* **sha384**: A checksum in sha-384 format +* **sha512**: A checksum in sha-512 format +* **sha512/224**: A checksum in the sha-512/224 format +* **sha512/256**: A checksum in the sha-512/256 format +* **sigma**: Sigma - Generic Signature Format for SIEM Systems +* **size-in-bytes**: Size expressed in bytes +* **snort**: An IDS rule in Snort rule-format +* **special-service-request**: A Special Service Request is a function to an airline to provide a particular facility for A Passenger or passengers. +* **ssdeep**: A checksum in ssdeep format +* **stix2-pattern**: STIX 2 pattern +* **target-email**: Attack Targets Email(s) +* **target-external**: External Target Organizations Affected by this Attack +* **target-location**: Attack Targets Physical Location(s) +* **target-machine**: Attack Targets Machine Name(s) +* **target-org**: Attack Targets Department or Organization(s) +* **target-user**: Attack Targets Username(s) +* **telfhash**: telfhash is symbol hash for ELF files, just like imphash is imports hash for PE files. +* **text**: Name, ID or a reference +* **threat-actor**: A string identifying the threat actor +* **tlsh**: A checksum in the Trend Micro Locality Sensitive Hash format +* **travel-details**: Travel details +* **twitter-id**: Twitter ID +* **uri**: Uniform Resource Identifier +* **url**: url +* **user-agent**: The user-agent used by the malware in the HTTP request. +* **vhash**: A VirusTotal checksum +* **visa-number**: Visa number +* **vulnerability**: A reference to the vulnerability used in the exploit +* **weakness**: A reference to the weakness used in the exploit +* **whois-creation-date**: The date of domain's creation, obtained from the WHOIS information. +* **whois-registrant-email**: The e-mail of a domain's registrant, obtained from the WHOIS information. +* **whois-registrant-name**: The name of a domain's registrant, obtained from the WHOIS information. +* **whois-registrant-org**: The org of a domain's registrant, obtained from the WHOIS information. +* **whois-registrant-phone**: The phone number of a domain's registrant, obtained from the WHOIS information. +* **whois-registrar**: The registrar of the domain, obtained from the WHOIS information. +* **windows-scheduled-task**: A scheduled task in windows +* **windows-service-displayname**: A windows service's displayname, not to be confused with the windows-service-name. This is the name that applications will generally display as the service's name in applications. +* **windows-service-name**: A windows service name. This is the name used internally by windows. Not to be confused with the windows-service-displayname. +* **x509-fingerprint-md5**: X509 fingerprint in MD5 format +* **x509-fingerprint-sha1**: X509 fingerprint in SHA-1 format +* **x509-fingerprint-sha256**: X509 fingerprint in SHA-256 format +* **xmr**: Monero Address +* **yara**: Yara signature +* **zeek**: An NIDS rule in the Zeek rule-format From 3738cbb2f61a5a159b185327a56890b0e52c2707 Mon Sep 17 00:00:00 2001 From: garanews Date: Fri, 1 Oct 2021 11:46:16 +0200 Subject: [PATCH 13/14] Fix typos --- GLOSSARY.md | 2 +- USAGE.md | 2 +- administration/README.md | 2 +- appendices/README.md | 2 +- automation/README.md | 8 ++++---- connectors/README.md | 2 +- create-event-report/README.md | 4 ++-- faq/README.md | 8 ++++---- galaxy/README.md | 2 +- using-the-system/README.md | 10 +++++----- 10 files changed, 21 insertions(+), 21 deletions(-) diff --git a/GLOSSARY.md b/GLOSSARY.md index d5a9a46..9338b0f 100644 --- a/GLOSSARY.md +++ b/GLOSSARY.md @@ -51,7 +51,7 @@ MISP can now extend an event (starting from version 2.4.90). This allows users t ## MISP feeds MISP includes a set of public OSINT feeds in its default configuration. The feeds can be used as a source of correlations for all of your events and attributes without the need to import them directly into your system. The MISP feed system allows for fast correlation but also a for quick comparisons of the feeds against one another. -To get started with MISP we advise to enable the CIRCL OSINT feed withing your MISP instance. This feed is generated with the PyMISP [feed-generator](https://github.com/CIRCL/PyMISP/tree/master/examples/feed-generator). +To get started with MISP we advise to enable the CIRCL OSINT feed within your MISP instance. This feed is generated with the PyMISP [feed-generator](https://github.com/CIRCL/PyMISP/tree/master/examples/feed-generator). [More](http://www.misp-project.org/feeds/) ## MISP format diff --git a/USAGE.md b/USAGE.md index d9ea073..b66be31 100644 --- a/USAGE.md +++ b/USAGE.md @@ -212,7 +212,7 @@ canvas needs to be compiled and needs the following dependencies: xcode-select --install # If you have homebrew not installed yet: ## /usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)" -# For the more adventureous you can install a cask of calibre which gives you access to *ebook-convert* +# For the more adventurous you can install a cask of calibre which gives you access to *ebook-convert* ## brew cask install calibre brew install pkg-config cairo pango libpng jpeg giflib ``` diff --git a/administration/README.md b/administration/README.md index 233e8d6..58aea72 100644 --- a/administration/README.md +++ b/administration/README.md @@ -766,7 +766,7 @@ Warning: Scheduled tasks come with a lot of caveats and little in regards of cus """ The task scheduler is a sub-par component to enable minimal functionality in terms of automating certain MISP tasks. -If you have a dedicated and concious MISP Site Admin she can keep an eye on the Scheduler to make sure everything runs smoothly. +If you have a dedicated and conscious MISP Site Admin she can keep an eye on the Scheduler to make sure everything runs smoothly. For better performance please use a real scheduler like your systems' crontab. As a rule of thumb: If you can click on it, MISP can automate it. diff --git a/appendices/README.md b/appendices/README.md index b2c983d..2b3e564 100644 --- a/appendices/README.md +++ b/appendices/README.md @@ -665,4 +665,4 @@ Because LDAP and MISP users are paired by e-mail address, it is possible to migr * When a user is disabled in LDAP and also in MISP and then enabled in LDAP, it will be enabled in MISP for next login just when `updateUser` is set to `true`. * Currently it is not possible to log in with both LDAP and local (MISP) accounts. * Admins can change users email address. But when `updateUser` is set to true, when the user will log in again, the e-mail address will be updated from LDAP. -* `Security.require_password_confirmation` setting currently doesnt work with LDAP authentication. But on the other hand, since user cannot change e-mail address and password, this setting is not important. \ No newline at end of file +* `Security.require_password_confirmation` setting currently does not work with LDAP authentication. But on the other hand, since user cannot change e-mail address and password, this setting is not important. \ No newline at end of file diff --git a/automation/README.md b/automation/README.md index b57022a..b641724 100644 --- a/automation/README.md +++ b/automation/README.md @@ -84,7 +84,7 @@ curl --header "Authorization: YOUR API KEY " --header "Accept: application/json" ## Search -It is possible to search in the database for a list of attributes or events based on a list of criterias. +It is possible to search in the database for a list of attributes or events based on a list of criteria. To return attributes or events in a desired format, use the following URL and header settings: @@ -144,7 +144,7 @@ Find below a non exhaustive list of parameters that can be used to filter data i - **timestamp**: Restrict the results by the timestamp (last edit). Any event with a timestamp newer than the given timestamp will be returned. In case you are dealing with /attributes as scope, the attribute's timestamp will be used for the lookup. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). - **published**: Set whether published or unpublished events should be returned. Do not set the parameter if you want both. - **enforceWarninglist**: Remove any attributes from the result that would cause a hit on a warninglist entry. -- **to_ids**: By default (0) all attributes are returned that match the other filter parameters, irregardless of their to_ids setting. To restrict the returned data set to to_ids only attributes set this parameter to 1. You can only use the special "exclude" setting to only return attributes that have the to_ids flag disabled. +- **to_ids**: By default (0) all attributes are returned that match the other filter parameters, regardless of their to_ids setting. To restrict the returned data set to to_ids only attributes set this parameter to 1. You can only use the special "exclude" setting to only return attributes that have the to_ids flag disabled. - **deleted**: Default value 0. If set to 1, only deleted attributes will be returned. If set to [0,1] , both deleted and non-deleted attributes wil be returned. - **includeEventUuid**: Instead of just including the event ID, also include the event UUID in each of the attributes. - **event_timestamp**: Only return attributes from events that have received a modification after the given timestamp. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). @@ -904,7 +904,7 @@ Do not use this function with GET! - **published**: Set whether published or unpublished events should be returned. Do not set the parameter if you want both. - **timestamp**: ***Deprecated!!!*** (synonym for attribute_timestamp) Restrict the results by the timestamp (last edit). Any attribute with a timestamp newer than the given timestamp will be returned. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). - **enforceWarninglist**: Remove any attributes from the result that would cause a hit on a warninglist entry. -- **to_ids**: By default (0) all attributes are returned that match the other filter parameters, irregardless of their to_ids setting. To restrict the returned data set to to_ids only attributes set this parameter to 1. You can only use the special "exclude" setting to only return attributes that have the to_ids flag disabled. +- **to_ids**: By default (0) all attributes are returned that match the other filter parameters, regardless of their to_ids setting. To restrict the returned data set to to_ids only attributes set this parameter to 1. You can only use the special "exclude" setting to only return attributes that have the to_ids flag disabled. - **deleted**: Default value 0. If set to 1, only deleted attributes will be returned. If set to [0,1] , both deleted and non-deleted attributes wil be returned. - **includeEventUuid**: Instead of just including the event ID, also include the event UUID in each of the attributes. - **event_timestamp**: Only return attributes from events that have received a modification after the given timestamp. The input can be a timestamp or a short-hand time description (7d or 24h for example). You can also pass a list with two values to set a time range (for example ["14d", "7d"]). @@ -1230,7 +1230,7 @@ Only the fields POSTed will be updated, the rest is left intact. To view all pos ### POST admin/users/delete/ -You can also delete users by POSTing to the below URL, but keep in mind that disabling users (by setting the disabled flag via an edit) is always prefered to keep user associations to events intact. +You can also delete users by POSTing to the below URL, but keep in mind that disabling users (by setting the disabled flag via an edit) is always preferred to keep user associations to events intact. #### Parameters diff --git a/connectors/README.md b/connectors/README.md index b2ef301..89d2a47 100644 --- a/connectors/README.md +++ b/connectors/README.md @@ -159,7 +159,7 @@ Configure a sync user. ### Verify Cert This gives you the option to choose if python should validate the certificate of the misp instance. (This allows ease within testing environments) -`misp_verifycert = False` IT IS RECOMENDED TO USE A VALID SSL CERT IN PRODUCTION AND CHANGE THIS TO TRUE +`misp_verifycert = False` IT IS RECOMMENDED TO USE A VALID SSL CERT IN PRODUCTION AND CHANGE THIS TO TRUE ## Instructions on Reading TiIndicators That Have Been Pushed In the command line, run `python3 script.py -r` diff --git a/create-event-report/README.md b/create-event-report/README.md index f2342ba..707d5c7 100644 --- a/create-event-report/README.md +++ b/create-event-report/README.md @@ -18,7 +18,7 @@ Then we get the add event form. Let's fill it with the data we already have: * Date: Here we will put the date of the report, so 2016-11-14 -* Distribution: Depending on the event, we might want it to be more or less spread accross the MISP instances. For this one, since it is a public report, there is no reason to limit the diffusion so "All communities". +* Distribution: Depending on the event, we might want it to be more or less spread across the MISP instances. For this one, since it is a public report, there is no reason to limit the diffusion so "All communities". * Threat Level: Self explainatory. Since the ransomware in the report is not using a huge exploit, we can use low, or undefined as we don't really know. we'll go for the latter since it can be edited. * Analysis: Give the current stage of the analysis. Since the report is published, we can assume that the analysis is completed. * Event Info: The event's info is in fact the name or title of the event, so it seems legit to put the title of the report here as well. Since it is public information, we also prefix it with "OSINT". @@ -113,7 +113,7 @@ We only have the network indicators left, and as said before, we will let MISP d ![type recognition fail](figures/surprise.png) -Oh well, that was unexpected. In fact, it is not that surprising regarding the format of the tor address that look more like a filename than like a url but it is still a problem, since we can't change the type nor the category to a more consistant one. This is indeed one of the limitation of freetext import. To solve this issue, we will use a simple trick: we will add a slash at the end of the tor address so it won't be confused for a filename. +Oh well, that was unexpected. In fact, it is not that surprising regarding the format of the tor address that look more like a filename than like a url but it is still a problem, since we can't change the type nor the category to a more consistent one. This is indeed one of the limitation of freetext import. To solve this issue, we will use a simple trick: we will add a slash at the end of the tor address so it won't be confused for a filename. ![freetext import network](figures/free_network2.png) diff --git a/faq/README.md b/faq/README.md index df6ba4a..32f94ba 100644 --- a/faq/README.md +++ b/faq/README.md @@ -34,7 +34,7 @@ for different monitoring tools: - Using [Cacti](https://www.cacti.net/), a blog post with the [instruction](https://www.misp-project.org/2020/08/22/MISP-Monitoring-with-Cacti.html) is available. - Using [Munin](http://munin-monitoring.org/), [misp-monitor](https://github.com/SteveClement/misp-monitor) for instructions. - Using [Nagios](https://www.nagios.org/), [Monitoring MISP with Nagios](https://blog.rootshell.be/2020/08/25/monitoring-misp-with-nagios/) -- Using [OpenNMS](https://www.opennms.com/), a blog post with the [instructions](https://www.misp-project.org/2020/08/18/MISP-Monitoring-with-OpenNMS.html) is availabe. +- Using [OpenNMS](https://www.opennms.com/), a blog post with the [instructions](https://www.misp-project.org/2020/08/18/MISP-Monitoring-with-OpenNMS.html) is available. - [Live monitoring of MISP usage](https://github.com/MISP/misp-monitoring) via the httpd logs. *** @@ -129,7 +129,7 @@ Source: [Getting started with MISP](http://www.vanimpe.eu/2015/05/31/getting-sta MISP can be made more appealing to the eye by adding some graphics. As Org.- or Site-admin navigate to *Administration* -> *List organisations* and edit the corresponding organization. -Withing this editor you will be able to update the logo. +Within this editor you will be able to update the logo. Other ways to achieve this, would be: @@ -627,7 +627,7 @@ OR if you were foolish enough to not install in a Python virtualenv: sudo -u www-data misp-modules -l 127.0.0.1 -s & ``` -> [warning] Running misp-modules like this will certainly kill it once you quit the session. Make sure it is in your **/etc/rc.local** or some ther init script that gets run on boot. +> [warning] Running misp-modules like this will certainly kill it once you quit the session. Make sure it is in your **/etc/rc.local** or some other init script that gets run on boot. ## Uninstalling MISP @@ -1025,7 +1025,7 @@ sudo sudo systemctl restart apache2 ### What are the required steps after a MISP installation to have a properly running instance? -- First login with the installation credentials and change the password immediatly (especially if your instance is publicly accessible) +- First login with the installation credentials and change the password immediately (especially if your instance is publicly accessible) - Set the base_url to the hostname of your machine (apache virtualhost name) - Create a new organisation which will be the host organisation running the MISP instance - Set the new organisation in `MISP.host_org_id` to replace the default one diff --git a/galaxy/README.md b/galaxy/README.md index 836cd0f..4a2668e 100644 --- a/galaxy/README.md +++ b/galaxy/README.md @@ -74,7 +74,7 @@ The __/galaxies__ file contains metatdatas and galaxy structure. The __/clusters__ file contains actual data. -#### The galaxy managment GUI +#### The galaxy management GUI ![GalaxyManagment](./figures/GalaxyManagmentGui.png) diff --git a/using-the-system/README.md b/using-the-system/README.md index 45fe2a7..7d3d18f 100644 --- a/using-the-system/README.md +++ b/using-the-system/README.md @@ -68,7 +68,7 @@ Sharing groups in MISP are a more granular way to create re-usable distribution The most general use-cases for sharing groups are creating re-usable topical subgroups in MISP that share events or for ad-hoc sharing scenarios (such as several organisations involved in a specific incident wanting to work together). Generally sharing groups add a level of complexity for the users involved as well as a performance overhead on the data marked with it. -As a best-practice recommendation, using traditional distribution methods is prefered unless they cannot cover the given use-case. Also, whilst sharing groups can be assigned to both events and attributes, it is highly recommended to use the special "inherit" distribution setting on attributes whenever the attribute's sharing group would match the event's. +As a best-practice recommendation, using traditional distribution methods is preferred unless they cannot cover the given use-case. Also, whilst sharing groups can be assigned to both events and attributes, it is highly recommended to use the special "inherit" distribution setting on attributes whenever the attribute's sharing group would match the event's. Sharing groups consist of the following elements, each of which has its own page in the sharing group creator/editor tool (accessed via the Global actions -> List Sharing Groups and Add Sharing Group functionalities): @@ -105,7 +105,7 @@ For users trying to populate an event, after clicking on the populate from templ ![Choose the most appropriate template for your event.](figures/template_choice.png) Once you have chosen a template, you'll be presented with the actual form contained within. Make sure you fill out as many fields as possible with the mandatory fields - marked by a star in a bracket such as this: (*) - are filled out. -Templates are devided into sections, with each section having a title and a description in addition to a series of fields. Each field can be an attribute or a file attachment field. An attribute field has the following components: +Templates are divided into sections, with each section having a title and a description in addition to a series of fields. Each field can be an attribute or a file attachment field. An attribute field has the following components: ![MISP will generate attributes based on the field's settings and the data that you provide.](figures/template_field.png) @@ -481,12 +481,12 @@ The platform is also [RESTfull](http://en.wikipedia.org/wiki/Representational_st Use any HTTP compliant library to perform requests. You can choose which format you would like to use as input/output for the REST calls by specifying the Accept and Content-Type headers. -The following headers are required if you wish to recieve / push XML data: +The following headers are required if you wish to receive / push XML data: **Authorization**: _your authorisation key_ **Accept**: _application/xml_ **Content-Type**: _application/xml_ -The following headers are required if you wish to recieve / push JSON data: +The following headers are required if you wish to receive / push JSON data: **Authorization**: _your authorisation key_ **Accept**: _application/json_ **Content-Type**: _application/json_ @@ -658,7 +658,7 @@ Content-Type: application/xml ``` -The respone from requesting an invalid page +The response from requesting an invalid page ```xml From b48e0531548f4a5c7d7fb4d04e3bea285f25af6e Mon Sep 17 00:00:00 2001 From: cliodhna-lynch <91328067+cliodhna-lynch@users.noreply.github.com> Date: Wed, 13 Oct 2021 09:33:42 +0100 Subject: [PATCH 14/14] Update README.md Fix typo --- using-the-system/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/using-the-system/README.md b/using-the-system/README.md index 7d3d18f..8932ad8 100644 --- a/using-the-system/README.md +++ b/using-the-system/README.md @@ -467,7 +467,7 @@ If you ever need to change the data about the linked servers or remove any conne ![Apart from editing / deleting the link to the remote server, you can issue a push all or pull all command from here.](figures/list_servers.png) -* **Editing the connection to the:** By clicking edit a view, [that is identical to the new instance view](#setting-up-a-connection-to-another-server), is loaded, with all the current information of the instance pre-entered. +* **Editing the connection to the instance:** By clicking edit a view, [that is identical to the new instance view](#setting-up-a-connection-to-another-server), is loaded, with all the current information of the instance pre-entered. * **Deleting the connection to the instance:** Clicking the delete button will delete the link to the instance. * **Push all:** By clicking this button, all events that are eligible to be pushed on the instance you are on will start to be pushed to the remote instance. Events and attributes that exist on the far end will be updated. * **Pull all:** By clicking this button, all events that are set to be pull-able or full access on the remote server will be copied to this instance. Existing events will not be updated.