From 151d066915aed49f485be545e75afcee5e6108fe Mon Sep 17 00:00:00 2001 From: "Carlos Mayol (MSFT)" Date: Tue, 20 May 2025 16:43:09 -0400 Subject: [PATCH 1/4] Update readme.md --- .../readme.md | 104 +----------------- 1 file changed, 2 insertions(+), 102 deletions(-) diff --git a/Scenarios/How to get insights into App Control (WDAC) events/readme.md b/Scenarios/How to get insights into App Control (WDAC) events/readme.md index 6ed7ab4..dc6227d 100644 --- a/Scenarios/How to get insights into App Control (WDAC) events/readme.md +++ b/Scenarios/How to get insights into App Control (WDAC) events/readme.md @@ -1,107 +1,7 @@ # How to get insights into App Control for Business (WDAC) events
- -## Change History - -| Version | Date | What | -| ------------- |-----| -----| -| v1.0|2024-04| first Version, publish DCR and Workbook | -| v1.1|2024-09| Upgraded Visualizations for File events. Updated Documentation| -| v1.2|2025-01| Upgraded workbook to handle SHA1 & SHA256 Hashes| - -
- -## Description -This scenario gives you insights into App Control for Business (WDAC) events collected from Windows machines. -This DCR and Workbook works with any Azure VM or Arc Server resource type emmiting Application Control for Business (WDAC) windows events. - -This scenario provides the next capabilities: -- Collect and send to Log analytics workspace Windows Event logs for App Control for business. -- Identify file and policy events activities, providing various dashoards, charts, filter and export capabilities to help customers analyze and troubleshoot App Control policies effects and status. -- Refine your App Control for business policies, by exporting the workbook data and ingesting it in WDAC Wizards. For more information, see [WDAC Wizard documentation](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard). - -## Try on Portal -### Deploy DCR - -The Data Collection Rule (DCR) leveraged by the Azure Monitor Agent (AMA) will collect Code Integrity/Operational Event logs channel IDs: 3076,3077,3089,3099. For more information, see [WDAC documentation](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations#wdac-block-events-for-executables-dlls-and-drivers). - -> [!NOTE] -> Dont forget to assign this DCR to your machines after being created to start collecting the events that fills the workbook data. - -You can deploy the DCR by clicking on the buttons below:
- - - -### Deploy Workbook - -The Azure Workbook which visualize data collected by the Azure Monitoring Agent (AMA) and stored to a Log Analytics Workspace.:
- -
-You can deploy the workbook by clicking on the buttons below:
- - - -

-### Pre-requisites for using the worbook. -** ** -- Install and configure Arc for Server - Connect hybrid machines to Azure using a deployment script - https://learn.microsoft.com/en-us/azure/azure-arc/servers/onboard-portal - -- Install and Configure AMA agent - Deploy Azure Monitor agent on Arc-enabled servers - https://learn.microsoft.com/en-us/azure/azure-arc/servers/concept-log-analytics-extension-deployment - -- Enable VM extension from the Azure portal - https://learn.microsoft.com/en-us/azure/azure-arc/servers/manage-vm-extensions-portal - -- Deploy DCR - The Data collector rule (DCR) is the definition that tells the AMA agent what to collect, this is filters, enriches, and transforms the data before sending it to LA. - - Before you start the deployment of the DCR, you need to note the information of your LA workspace as explained below: - - Go to LA workspace list in your subscription https://portal.azure.com/#browse/Microsoft.OperationalInsights%2Fworkspaces - - Select the one you will be using, go to propierties and copy the Workspace ID and Resource ID (image below): - - ![Log Analytics ResID and Location](./picture/LogAnalytics.png) - -- Assign your DCR - - Go to DCR section in your subscription https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionRules - - Select the new deployed DCRs, the default name is “DCR-WDAC” - - Select the DCR, go to Configuration-> Resources and Add your Arc Enabled Servers - - Select your Arc server, select it, and click Apply. - -- Deploy Workbook - - Go to the "Deploy Workbook section above" - - Select Deploy to Azure or Azure Gov button - - Select the empty setting from the template (Resource Group) - - Select Review and Create and then Create. - -

-### Worbook Usage. -** ** -- View and Analyze your Data - You can view and analyze your data in LA, currently the worbook provides: - - File Audit/Block Events (events 3076/3077/3089) - - Policy inventory and change tracking (event 3099) - - Correlated events in graphic view - - Export events - - Visualization in Excel - - Ingestion in WDAC Wizard - - To view and analyze your data in LA, follow these steps: - - Go to your Azure Monitor Workbooks section in the Azure portal - https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/workbooks - - Type the search section “App Control” to find the new deployed Workbook. - - Open the Workbook by selecting it from Azure monitor / workbooks section. - - Navigate through the AppControl activity tabs in the workbook. - - The workbook contains many filters and visualizations, get familiar with them to undertand: - - Identify potential malware, if missed by antimalware solutions. - - Identify software that's banned by your organization. - - Identity additional rules to created to “authorize” legitimate software. - + > [!NOTE] -> To be able to visualize the data, DCR and Events should properly flow to your LA workspace, even when all is properly configured, can take up to 1h to show in the workbook. +> This content has been moved, please use [aka.ms/appcontrolworkbook](https://aka.ms/appcontrolworkbook)

From 847f3c10802c690ae73fbc4ba6aa130e5e360db2 Mon Sep 17 00:00:00 2001 From: "Carlos Mayol (MSFT)" Date: Tue, 20 May 2025 16:52:49 -0400 Subject: [PATCH 2/4] Delete Scenarios/How to get insights into App Control (WDAC) events/workbook.json delete files --- .../workbook.json | 57 ------------------- 1 file changed, 57 deletions(-) delete mode 100644 Scenarios/How to get insights into App Control (WDAC) events/workbook.json diff --git a/Scenarios/How to get insights into App Control (WDAC) events/workbook.json b/Scenarios/How to get insights into App Control (WDAC) events/workbook.json deleted file mode 100644 index f5e75c1..0000000 --- a/Scenarios/How to get insights into App Control (WDAC) events/workbook.json +++ /dev/null @@ -1,57 +0,0 @@ -{ - "contentVersion": "1.0.0.0", - "parameters": { - "workbookDisplayName": { - "type": "string", - "defaultValue": "Security Insights - App Control for Business", - "metadata": { - "description": "The friendly name for the workbook that is used in the Gallery or Saved List. This name must be unique within a resource group." - } - }, - "workbookType": { - "type": "string", - "defaultValue": "workbook", - "metadata": { - "description": "The gallery that the workbook will been shown under. Supported values include workbook, tsg, etc. Usually, this is 'workbook'" - } - }, - "workbookSourceId": { - "type": "string", - "defaultValue": "azure monitor", - "metadata": { - "description": "The id of resource instance to which the workbook will be associated" - } - }, - "workbookId": { - "type": "string", - "defaultValue": "[newGuid()]", - "metadata": { - "description": "The unique guid for this workbook instance" - } - } - }, - "resources": [ - { - "name": "[parameters('workbookId')]", - "type": "microsoft.insights/workbooks", - "location": "[resourceGroup().location]", - "apiVersion": "2022-04-01", - "dependsOn": [], - "kind": "shared", - "properties": { - "displayName": "[parameters('workbookDisplayName')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Security Insights for Code Integrity\\r\\n---\\r\\nThis workbook shows insights for the code Integrity policies in your devices. \\r\\nThe data is splitted in three major areas: \\r\\n\\r\\n\\tApp Control File Events \\r\\n\\tApp Control Policy Events\\r\\n\\tApp Control object's relationships in visual graph\\r\\n\\r\\nPlease select the proper tab to access the information.\\r\\n\\r\\n---\\r\\n  \\r\\n\\r\\n\"},\"name\":\"text - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"##### Select the Log Analytics Workspace and Time Range\"},\"name\":\"subscriptonFilterText\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"40b28eb1-aad1-4096-b338-55c61d20cbdc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::selected\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"dd441f52-8ce6-4f68-a5e4-8505914d77ed\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"description\":\"Select Subscription of your Log Analytics Workspace\",\"isRequired\":true,\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\",\"crossComponentResources\":[\"value::selected\"],\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"07fc9063-0c85-4b56-85ec-bb607f0293ad\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"description\":\"Select Log Analytics Workspace\",\"isRequired\":true,\"isGlobal\":true,\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces' \\r\\n//| where subscriptionId == '{Subscription:id}'\\r\\n| project id\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":\"/subscriptions/9758f8b4-a201-41e3-93c0-b5a44dd0e37f/resourceGroups/RG01/providers/Microsoft.OperationalInsights/workspaces/OMS-03\"},{\"id\":\"9d382099-bc5e-40a5-b419-634cc81c9da9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"⏱️ Time Range\",\"type\":4,\"description\":\"Select a Time Range of Logs that should be queried\",\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":2592000000}}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"workspaceParameters\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\"}}],\"exportParameters\":true},\"customWidth\":\"40\",\"name\":\"SubscriptionParameter\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"##### Select the Computer Objects to be considered\"},\"name\":\"subscriptonFilterText\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"id\":\"1a9a3e6a-6b79-40e6-af2b-0de717997e4d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ComputerSubscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n| where Source == \\\"Microsoft-Windows-CodeIntegrity\\\"\\r\\n| distinct subscriptions = tostring(split(_ResourceId,\\\"/\\\",2)[0])\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Subscription\"},{\"id\":\"6c90003e-2dd3-49f9-ae20-ff935be39041\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ComputerResourceGroup\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n| where Source == \\\"Microsoft-Windows-CodeIntegrity\\\"\\r\\n| where tostring(split(_ResourceId,\\\"/\\\",2)[0]) in ({ComputerSubscription:subid})\\r\\n| distinct RG = tostring(split(_ResourceId,\\\"/\\\",4)[0])\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Resource Group\"},{\"id\":\"0e07e825-c123-4051-8162-27ccf91d78dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ComputerType\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"microsoft.\\\", \\\"label\\\": \\\"all\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"microsoft.hybridcompute\\\", \\\"label\\\": \\\"Arc\\\" },\\r\\n { \\\"value\\\": \\\"microsoft.compute\\\", \\\"label\\\": \\\"Azure\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"label\":\"Type\"},{\"id\":\"2970ef88-4e70-4301-9287-9b5f28e0787f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Computer\",\"type\":2,\"description\":\"Computers with audit/blocked file or policy events, by number of events and type\",\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n| where EventID in (3077,3076,3099)\\r\\n| where tostring(split(_ResourceId,\\\"/\\\",2)[0]) in ({ComputerSubscription:subid})\\r\\n| where tostring(split(_ResourceId,\\\"/\\\",4)[0]) in ({ComputerResourceGroup})\\r\\n| where tostring(split(_ResourceId,\\\"/\\\",6)[0]) startswith '{ComputerType}'\\r\\n| summarize FileAudit=countif(EventID==3076),FileBlock=countif(EventID==3077),Policy=countif(EventID==3099) by Computer,_ResourceId\\r\\n| extend display = strcat(Computer,\\\" | File-Audit/Block \\\",FileAudit,\\\"|\\\",FileBlock,\\\", Policy \\\",Policy)\\r\\n| project _ResourceId, display\\r\\n| sort by display asc\\r\\n\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Computer Filter\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\"}}],\"exportParameters\":true},\"customWidth\":\"40\",\"name\":\"LAWParameter\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let event_data = Event\\r\\n| where (EventID == 3077 or EventID == 3076 )\\r\\n| summarize ComputersWithEventData = dcount(_ResourceId);\\r\\n\\r\\n\\r\\nlet event_Policy = Event\\r\\n| where (EventID == 3099)\\r\\n| summarize ComputersWithEventPolicy = dcount(_ResourceId);\\r\\n\\r\\n\\r\\n\\r\\nlet heartbeat_data = Heartbeat\\r\\n| summarize AllComputers = dcount(_ResourceId);\\r\\n\\r\\nunion\\r\\n(\\r\\n heartbeat_data\\r\\n | extend Activity = \\\"All Computers\\\", Count = AllComputers\\r\\n),\\r\\n\\r\\n(\\r\\n event_Policy\\r\\n | extend Activity = \\\"Computers With Policy Event\\\", Count = ComputersWithEventPolicy\\r\\n),\\r\\n(\\r\\n event_data\\r\\n | extend Activity = \\\"Computers with File Events\\\", Count = ComputersWithEventData\\r\\n)\\r\\n\\r\\n\",\"size\":4,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Activity\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"}},\"name\":\"Computers with File Events\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"tabStyle\":\"bigger\",\"links\":[{\"id\":\"20771732-ace5-41da-95b3-e5c330222dcf\",\"cellValue\":\"tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"File Events\",\"subTarget\":\"FileEvents\",\"preText\":\"ClickEvents\",\"style\":\"link\"},{\"id\":\"01c06fe7-c051-4bc2-9449-a24ecd2c8c73\",\"cellValue\":\"tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Policy Events\",\"subTarget\":\"PolicyInsights\",\"style\":\"link\"},{\"id\":\"3951e6d6-c029-4b58-b4d5-cdef3bb193fe\",\"cellValue\":\"tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Graph\",\"subTarget\":\"Graph\",\"style\":\"link\"}]},\"name\":\"tabParameter\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"File Events\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"f0ebea62-17a3-4d37-8a21-a3dcb4074e19\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PolicyID\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n| where EventID in (3076,3077) \\r\\n| distinct PolicyID = extract('(.*?)',1,EventData)\\r\\n| sort by PolicyID asc\\r\\n\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"23046908-6782-4162-9431-45a48f60d349\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Action\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"3076,3077\\\", \\\"label\\\": \\\"All\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"3076\\\", \\\"label\\\": \\\"Audit\\\" },\\r\\n { \\\"value\\\": \\\"3077\\\", \\\"label\\\": \\\"Block\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"35\",\"name\":\"FileEventsFilter\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FileEvents = Event\\r\\n | where EventID in (3076,3077)\\r\\n | where _ResourceId in ({Computer}) \\r\\n | where EventID in ({Action})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend PolicyID = extract('(.*?)',1,EventData)\\r\\n | where PolicyID in ({PolicyID});\\r\\nFileEvents\\r\\n| union (\\r\\n range x from 1 to 1 step 1\\r\\n | mv-expand TimeGenerated=range(now(-7d),now(),5m) to typeof(datetime )\\r\\n | extend Audit=0\\r\\n | extend Block=0\\r\\n)\\r\\n| summarize Audit=countif(EventID==3076), Block=countif(EventID==3077) by bin(TimeGenerated,5m)\",\"size\":0,\"title\":\"Time Brush File Events, last 7 Days (overrides Time Range)\",\"timeContext\":{\"durationMs\":604800000},\"timeBrushParameterName\":\"TimeRange\",\"timeBrushExportOnlyWhenBrushed\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}],\"chartSettings\":{\"xAxis\":\"TimeGenerated\",\"seriesLabelSettings\":[{\"seriesName\":\"Blocked\",\"color\":\"red\"},{\"seriesName\":\"Audit\",\"color\":\"blue\"},{\"seriesName\":\"Block\",\"color\":\"red\"}]}},\"name\":\"TimeBrush_FileEvents\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Event\\r\\n| where EventID in (3076,3077) \\r\\n| where EventID in ({Action})\\r\\n| extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n| extend PolicyID = extract('(.*?)',1,EventData)\\r\\n| where PolicyID in ({PolicyID})\\r\\n| where _ResourceId in ({Computer})\\r\\n| extend Action = iff(EventID == 3076, \\\"Audit\\\", \\\"Blocked\\\")\\r\\n| sort by TimeGenerated\\r\\n| summarize count() by Action\",\"size\":3,\"title\":\"Action Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Action\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"Computer\",\"seriesLabelSettings\":[{\"seriesName\":\"Blocked\",\"color\":\"redDark\"},{\"seriesName\":\"Audit\",\"color\":\"blue\"}],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"actionoverview\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Event\\r\\n| where EventID in (3076,3077) \\r\\n| where EventID in ({Action})\\r\\n| extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n| extend PolicyID = extract('(.*?)',1,EventData)\\r\\n| where PolicyID in ({PolicyID})\\r\\n| where _ResourceId in ({Computer})\\r\\n| summarize Blocked=countif(EventID == 3077), Audit=countif(EventID == 3076), count() by _ResourceId\\r\\n| join kind=fullouter (\\r\\n Event\\r\\n | where EventID in (3076) \\r\\n | where _ResourceId in ({Computer})\\r\\n | make-series AuditTrend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by _ResourceId\\r\\n ) on _ResourceId\\r\\n| join kind=fullouter (\\r\\n Event\\r\\n | where EventID in (3077) \\r\\n | where _ResourceId in ({Computer})\\r\\n | make-series BlockedTrend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by _ResourceId\\r\\n ) on _ResourceId\\r\\n| project-away _ResourceId1, _ResourceId2, TimeGenerated, TimeGenerated1\\r\\n| sort by Blocked \\r\\n| project Computer = _ResourceId, Blocked, BlockedTrend, Audit, AuditTrend\\r\\n\",\"size\":0,\"title\":\"Action by Computer\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"_ResourceId\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"Blocked\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"BlockedTrend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"Audit\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"AuditTrend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"count_\",\"formatter\":5}],\"filter\":true},\"sortBy\":[],\"chartSettings\":{\"xAxis\":\"Computer\",\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"Blocked\",\"color\":\"redBright\"},{\"seriesName\":\"Audit\",\"color\":\"green\"}]}},\"customWidth\":\"70\",\"name\":\"actionbycomputer\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Show additonal Information\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"65030c8f-9b90-42f7-8c76-d98f3ab32ca4\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"top10process\",\"label\":\"Top Processes\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"10000\\\", \\\"label\\\": \\\"All\\\"},\\r\\n { \\\"value\\\": \\\"5\\\", \\\"label\\\": \\\"Top 5\\\" },\\r\\n { \\\"value\\\": \\\"10\\\", \\\"label\\\": \\\"Top 10\\\" },\\r\\n { \\\"value\\\": \\\"15\\\", \\\"label\\\": \\\"Top 15\\\" },\\r\\n { \\\"value\\\": \\\"20\\\", \\\"label\\\": \\\"Top 20\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"2edceed7-a4cb-4734-a50c-952073b82bea\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"top10publisher\",\"label\":\"Top Publisher\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"10000\\\", \\\"label\\\": \\\"All\\\"},\\r\\n { \\\"value\\\": \\\"5\\\", \\\"label\\\": \\\"Top 5\\\" },\\r\\n { \\\"value\\\": \\\"10\\\", \\\"label\\\": \\\"Top 10\\\" },\\r\\n { \\\"value\\\": \\\"15\\\", \\\"label\\\": \\\"Top 15\\\" },\\r\\n { \\\"value\\\": \\\"20\\\", \\\"label\\\": \\\"Top 20\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"8d23838e-f56a-48f2-9544-dae4671da73b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"top10issuer\",\"label\":\"Top Issuer\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"10000\\\", \\\"label\\\": \\\"All\\\"},\\r\\n { \\\"value\\\": \\\"5\\\", \\\"label\\\": \\\"Top 5\\\" },\\r\\n { \\\"value\\\": \\\"10\\\", \\\"label\\\": \\\"Top 10\\\" },\\r\\n { \\\"value\\\": \\\"15\\\", \\\"label\\\": \\\"Top 15\\\" },\\r\\n { \\\"value\\\": \\\"20\\\", \\\"label\\\": \\\"Top 20\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"de9fd8b7-0e85-41a8-971f-b08938d0b865\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FileSummarybyProcess\",\"label\":\"File Summary by Process\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"10000\\\", \\\"label\\\": \\\"All\\\"},\\r\\n { \\\"value\\\": \\\"5\\\", \\\"label\\\": \\\"Top 5\\\" },\\r\\n { \\\"value\\\": \\\"10\\\", \\\"label\\\": \\\"Top 10\\\" },\\r\\n { \\\"value\\\": \\\"15\\\", \\\"label\\\": \\\"Top 15\\\" },\\r\\n { \\\"value\\\": \\\"20\\\", \\\"label\\\": \\\"Top 20\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"distinctbyuniquefile\",\"label\":\"Distinct by unique File\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"e2fb3390-0620-4c49-b810-8f29fb4878e0\"}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"showadditinalinfoparameter\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let original_query = Event\\r\\n | where EventID in (3076,3077) \\r\\n | where EventID in ({Action})\\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend ProcessName = extract('(.*?)',1,EventData)\\r\\n | extend PolicyID = extract('(.*?)',1,EventData)\\r\\n | where PolicyID in ({PolicyID})\\r\\n | extend Process = tostring(parse_path(ProcessName).Filename)\\r\\n | summarize Count = count() by Process, EventID \\r\\n | evaluate pivot(EventID, sum(Count));\\r\\n\\r\\nlet total_count_query = Event\\r\\n | where EventID in (3076,3077) \\r\\n | where EventID in ({Action})\\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend ProcessName = extract('(.*?)',1,EventData)\\r\\n | extend PolicyID = extract('(.*?)',1,EventData)\\r\\n | where PolicyID in ({PolicyID})\\r\\n | extend Process = tostring(parse_path(ProcessName).Filename)\\r\\n \\r\\n | summarize TotalCount = count() by Process ;\\r\\n\\r\\noriginal_query\\r\\n | join kind=inner (total_count_query) on Process\\r\\n\\r\\n | extend tiletop = strcat(Process, \\\", [\\\", TotalCount ,\\\"]\\\")\\r\\n | top {top10process} by TotalCount desc\\r\\n\",\"size\":3,\"title\":\"{top10process:label} Process Name \",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"tiletop\",\"formatter\":1,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true}},\"leftContent\":{\"columnMatch\":\"3077\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":null,\"representation\":\"redDark\",\"text\":\"{0}{1}\"}]},\"tooltipFormat\":{\"tooltip\":\"Blocked\"}},\"rightContent\":{\"columnMatch\":\"3076\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":null,\"representation\":\"blue\",\"text\":\"{0}{1}\"}]},\"tooltipFormat\":{\"tooltip\":\"Audit\"}},\"showBorder\":true,\"size\":\"auto\"}},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"top10process\",\"comparison\":\"isNotEqualTo\",\"value\":\"No\"},\"name\":\"Top Process Name\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Working with App Control event \\r\\nlet publisher = Event\\r\\n | where EventID == 3089 \\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend PublisherName = extract('(.*?)',1,EventData)\\r\\n | extend Hash = extract('(.*?)',1,EventData)\\r\\n //new to review | summarize arg_max(TimeGenerated, *) by Hash results with holder ( ayman ) \\r\\n | summarize arg_max(TimeGenerated, *) by Hash\\r\\n | summarize by PublisherName, Hash, Computer;\\r\\n \\r\\n// Working with File event \\r\\nlet clickevent = Event\\r\\n | where EventID in (3076, 3077) \\r\\n | where EventID in ({Action})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend SHA1_Hash = extract('(.*?)',1,EventData)\\r\\n | extend SHA256_Hash = extract('(.*?)',1,EventData)\\r\\n | project Computer, TimeGenerated, SHA1_Hash, SHA256_Hash, EventID;\\r\\n\\r\\n// Join on SHA256_Hash\\r\\nlet clickevent_SHA256 = clickevent\\r\\n | join kind = leftouter (\\r\\n publisher\\r\\n | extend joinvalue_sha256 = strcat(Hash, Computer)\\r\\n ) on $left.SHA256_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, EventID, PublisherName;\\r\\n\\r\\n// Join on SHA1_Hash\\r\\nlet clickevent_SHA1 = clickevent\\r\\n | join kind = leftouter (\\r\\n publisher\\r\\n | extend joinvalue_sha1 = strcat(Hash, Computer)\\r\\n ) on $left.SHA1_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, EventID, PublisherName;\\r\\n\\r\\n// Combine results and remove duplicates\\r\\nclickevent_SHA256\\r\\n| union clickevent_SHA1\\r\\n| where isnotempty(PublisherName)\\r\\n| summarize Count = count() by PublisherName = coalesce(PublisherName, \\\"\\\")\\r\\n| sort by Count\\r\\n| top {top10publisher} by Count\\r\\n\",\"size\":3,\"title\":\"{top10publisher:label} Publisher Name\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"Process\"},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"60\",\"conditionalVisibility\":{\"parameterName\":\"top10publisher\",\"comparison\":\"isNotEqualTo\",\"value\":\"No\"},\"name\":\"Top Publisher Name\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Working with App Control event \\r\\nlet Issuer = Event\\r\\n | where EventID == 3089 \\r\\n | where _ResourceId in ({Computer})\\r\\n //| where TimeGenerated > ago(60d)\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend IssuerName = extract('(.*?)',1,EventData)\\r\\n | extend Hash = extract('(.*?)',1,EventData)\\r\\n //new to review | summarize arg_max(TimeGenerated, *) by Hash results with holder ( ayman ) \\r\\n | summarize arg_max(TimeGenerated, *) by Hash\\r\\n | summarize by IssuerName, Hash, Computer;\\r\\n// Working with File event \\r\\nlet clickevent = Event\\r\\n | where EventID in (3076, 3077) \\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend SHA1_Hash = extract('(.*?)',1,EventData)\\r\\n | extend SHA256_Hash = extract('(.*?)',1,EventData)\\r\\n | project Computer, TimeGenerated, SHA1_Hash, SHA256_Hash, EventID;\\r\\n\\r\\n// Join on SHA256_Hash\\r\\nlet clickevent_SHA256 = clickevent\\r\\n | join kind = leftouter (\\r\\n Issuer\\r\\n | extend joinvalue_sha256 = strcat(Hash, Computer)\\r\\n ) on $left.SHA256_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, EventID, IssuerName;\\r\\n\\r\\n// Join on SHA1_Hash\\r\\nlet clickevent_SHA1 = clickevent\\r\\n | join kind = leftouter (\\r\\n Issuer\\r\\n | extend joinvalue_sha1 = strcat(Hash, Computer)\\r\\n ) on $left.SHA1_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, EventID, IssuerName;\\r\\n\\r\\n// Combine results and remove duplicates\\r\\nclickevent_SHA256\\r\\n| union clickevent_SHA1\\r\\n| where isnotempty(IssuerName)\\r\\n| summarize Count = count() by IssuerName = coalesce(IssuerName, \\\"\\\")\\r\\n| sort by Count\\r\\n| top {top10issuer} by Count\\r\\n\",\"size\":3,\"title\":\"{top10issuer:label} Issuer Name\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"piechart\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"Process\"},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"60\",\"conditionalVisibility\":{\"parameterName\":\"top10issuer\",\"comparison\":\"isNotEqualTo\",\"value\":\"No\"},\"name\":\"Top Issuer Name\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"File Summary by Process\",\"items\":[{\"type\":1,\"content\":{\"json\":\"\\r\\n\\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n \\r\\n
Tile Definition Example:

File Name
Is the affected file being audit or blocked by the
application control layer in the OS
Process Name
This is the caller process which trigger
the application control file name action
Total EventsAuditBlocked
\\r\\n\",\"style\":\"info\"},\"customWidth\":\"0\",\"name\":\"File Summary by Process-Example\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Extract Publisher information from EventID 3089\\r\\nlet publisher = Event\\r\\n | where EventID == 3089 \\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend Hash = extract('(.*?)', 1, EventData)\\r\\n | extend PublisherName = extract('(.*?)', 1, EventData)\\r\\n | where isnotempty(PublisherName)\\r\\n | extend IssuerName = extract('(.*?)', 1, EventData)\\r\\n | extend PublisherTBSHash = extract('(.*?)', 1, EventData)\\r\\n | extend IssuerTBSHash = extract('(.*?)', 1, EventData)\\r\\n | summarize arg_max(TimeGenerated, *) by Hash\\r\\n | project TimeGenerated, Hash, PublisherName, IssuerName, _ResourceId, PublisherTBSHash, IssuerTBSHash;\\r\\n\\r\\n// Extract File Events from EventID 3077\\r\\nlet clickevent = Event\\r\\n | where EventID == 3077 or EventID == 3076\\r\\n | where _ResourceId in ({Computer})\\r\\n | where EventID in ({Action})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend PolicyID = extract('(.*?)', 1, EventData)\\r\\n | where PolicyID in ({PolicyID})\\r\\n | extend ProcessName = extract('(.*?)', 1, EventData)\\r\\n | extend FileName = extract('(.*?)', 1, EventData)\\r\\n | extend ProcessName = tostring(parse_path(ProcessName).Filename)\\r\\n | extend FileNameShort = tostring(parse_path(FileName).Filename)\\r\\n | extend SHA1_Hash = extract('(.*?)', 1, EventData)\\r\\n | extend SHA256_Hash = extract('(.*?)', 1, EventData)\\r\\n | extend PolicyName = extract('(.*?)', 1, EventData)\\r\\n | project Computer, TimeGenerated, SHA1_Hash, SHA256_Hash, FileName, ProcessName, PolicyName, EventID, FileNameShort;\\r\\n// Join on SHA256_Hash\\r\\nlet clickevent_SHA256 = clickevent\\r\\n | join kind = leftouter (\\r\\n publisher\\r\\n | extend joinvalue_sha256 = strcat(Hash, _ResourceId)\\r\\n ) on $left.SHA256_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, FileName, ProcessName, PolicyName, EventID, FileNameShort, PublisherName, PublisherTBSHash, IssuerTBSHash, Hash = SHA256_Hash;\\r\\n\\r\\n// Join on SHA1_Hash\\r\\nlet clickevent_SHA1 = clickevent\\r\\n | join kind = leftouter (\\r\\n publisher\\r\\n | extend joinvalue_sha1 = strcat(Hash, _ResourceId)\\r\\n ) on $left.SHA1_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, FileName, ProcessName, PolicyName, EventID, FileNameShort, PublisherName, PublisherTBSHash, IssuerTBSHash, Hash = SHA1_Hash;\\r\\n\\r\\n// Combine results and ensure values are shown from either SHA1 or SHA256\\r\\nclickevent_SHA256\\r\\n| union clickevent_SHA1\\r\\n| summarize UniqueEvents = dcount(TimeGenerated)\\r\\n by EventID, ProcessName, FileNameShort, FileName, PublisherName\\r\\n| sort by UniqueEvents\\r\\n| where isnotempty(PublisherName)\\r\\n| top {FileSummarybyProcess} by UniqueEvents\\r\\n\\r\\n\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"FileNameShort\",\"formatter\":1,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true},\"tooltipFormat\":{\"tooltip\":\"File Name\"}},\"subtitleContent\":{\"columnMatch\":\"ProcessName\",\"tooltipFormat\":{\"tooltip\":\"Process Name\"}},\"leftContent\":{\"columnMatch\":\"UniqueEvents\",\"formatter\":12,\"formatOptions\":{\"palette\":\"none\"},\"tooltipFormat\":{\"tooltip\":\"Count of Uniqe Events Per file\"}},\"rightContent\":{\"columnMatch\":\"EventID\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"3077\",\"representation\":\"red\",\"text\":\"Blocked\",\"tooltipFormat\":{\"tooltip\":\"Event ID 3077\"}},{\"operator\":\"==\",\"thresholdValue\":\"3076\",\"representation\":\"blue\",\"text\":\"Audit\",\"tooltipFormat\":{\"tooltip\":\"Event ID 3076\"}},{\"operator\":\"Default\",\"thresholdValue\":null,\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},\"showBorder\":true},\"chartSettings\":{\"createOtherGroup\":20,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"conditionalVisibility\":{\"parameterName\":\"FileSummarybyProcess\",\"comparison\":\"isNotEqualTo\",\"value\":\"No\"},\"name\":\"File Summary by Process\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"FileSummarybyProcess\",\"comparison\":\"isNotEqualTo\",\"value\":\"No\"},\"name\":\"File Summary by Process-Group\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Extract Publisher information from EventID 3089\\r\\nlet publisher = Event\\r\\n | where EventID == 3089 \\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend Hash = extract('(.*?)', 1, EventData)\\r\\n | extend PublisherName = extract('(.*?)', 1, EventData)\\r\\n | where isnotempty(PublisherName)\\r\\n | extend IssuerName = extract('(.*?)', 1, EventData)\\r\\n | extend PublisherTBSHash = extract('(.*?)', 1, EventData)\\r\\n | extend IssuerTBSHash = extract('(.*?)', 1, EventData)\\r\\n | summarize arg_max(TimeGenerated, *) by Hash\\r\\n | summarize by Hash, PublisherName, IssuerName, _ResourceId, PublisherTBSHash, IssuerTBSHash;\\r\\n\\r\\n// Extract File Events from EventID 3077\\r\\nlet clickevent = Event\\r\\n | where _ResourceId in ({Computer})\\r\\n | where EventID in ({Action})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend PolicyID = extract('(.*?)', 1, EventData)\\r\\n | where PolicyID in ({PolicyID})\\r\\n | extend ProcessName = extract('(.*?)', 1, EventData)\\r\\n | extend FileName = extract('(.*?)', 1, EventData)\\r\\n | extend ProcessName = tostring(parse_path(ProcessName).Filename)\\r\\n | extend FileNameShort = tostring(parse_path(FileName).Filename)\\r\\n | extend SHA1_Hash = extract('(.*?)', 1, EventData)\\r\\n | extend SHA256_Hash = extract('(.*?)', 1, EventData)\\r\\n | extend PolicyName = extract('(.*?)', 1, EventData)\\r\\n | project Computer, TimeGenerated, SHA1_Hash, SHA256_Hash, FileName, ProcessName, PolicyName, EventID, FileNameShort;\\r\\n\\r\\n// Join on SHA256_Hash\\r\\nlet clickevent_SHA256 = clickevent\\r\\n | join kind = leftouter (\\r\\n publisher\\r\\n | extend joinvalue_sha256 = strcat(Hash, _ResourceId)\\r\\n ) on $left.SHA256_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, FileName, ProcessName, PolicyName, EventID, FileNameShort, PublisherName, PublisherTBSHash, IssuerTBSHash, Hash = SHA256_Hash;\\r\\n\\r\\n// Join on SHA1_Hash\\r\\nlet clickevent_SHA1 = clickevent\\r\\n | join kind = leftouter (\\r\\n publisher\\r\\n | extend joinvalue_sha1 = strcat(Hash, _ResourceId)\\r\\n ) on $left.SHA1_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, FileName, ProcessName, PolicyName, EventID, FileNameShort, PublisherName, PublisherTBSHash, IssuerTBSHash, Hash = SHA1_Hash;\\r\\n\\r\\n// Combine results and ensure values are shown from either SHA1 or SHA256\\r\\nclickevent_SHA256\\r\\n| union clickevent_SHA1\\r\\n| summarize UniqueEvents = dcount(TimeGenerated)\\r\\n by EventID, ProcessName, FileNameShort, FileName, PolicyName, PublisherName, PublisherTBSHash, IssuerTBSHash, Hash\\r\\n| sort by UniqueEvents\\r\\n| where isnotempty(PublisherName)\\r\\n| top {FileSummarybyProcess} by UniqueEvents\\r\\n| project EventID, UniqueEvents, ProcessName, FileNameShort, FileName, PolicyName, PublisherName;\\r\\n\",\"size\":3,\"title\":\"Distinct by unique File\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"$gen_group\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"3077\",\"representation\":\"Sev0\",\"text\":\"Blocked\"},{\"operator\":\"==\",\"thresholdValue\":\"3076\",\"representation\":\"Sev3\",\"text\":\"Audit\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"representation\":\"Line\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"FileNameShort\",\"formatter\":5},{\"columnMatch\":\"ProcessName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"31ch\"}}],\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"EventID\",\"FileNameShort\"],\"expandTopLevel\":false,\"finalBy\":\"EventID\"}},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"ProcessName\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"FileName\"},\"leftContent\":{\"columnMatch\":\"UniqueEvents\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"rightContent\":{\"columnMatch\":\"PublisherName\"},\"secondaryContent\":{\"columnMatch\":\"EventID\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"3077\",\"representation\":\"red\",\"text\":\"Blocked\"},{\"operator\":\"==\",\"thresholdValue\":\"3076\",\"representation\":\"green\",\"text\":\"Audit\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},\"showBorder\":false},\"chartSettings\":{\"createOtherGroup\":20,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"conditionalVisibility\":{\"parameterName\":\"distinctbyuniquefile\",\"comparison\":\"isNotEqualTo\",\"value\":\"No\"},\"name\":\"Distinct by unique File\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}}]},\"name\":\"Show additonal Information\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"File Events by Time with Filter option\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"id\":\"17114064-e6f5-4afb-b577-5603861042a1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AffectedFileFilter\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n | where EventID in (3076,3077) \\r\\n | where EventID in ({Action})\\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend AffectedFile = extract('(.*?)',1,EventData)\\r\\n | summarize by AffectedFile\\r\\n | extend AffectedFile2 = replace_string(AffectedFile,\\\"\\\\\\\\\\\",\\\"\\\\\\\\\\\\\\\\\\\")\\r\\n | extend Display = AffectedFile\\r\\n | project-away AffectedFile\\r\\n \",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Affected File\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ProcessNameFilter\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n | where EventID in (3076,3077) \\r\\n | where EventID in ({Action})\\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend ProcessName = extract('(.*?)',1,EventData)\\r\\n | summarize by ProcessName\\r\\n | extend ProcessName2 = replace_string(ProcessName,\\\"\\\\\\\\\\\",\\\"\\\\\\\\\\\\\\\\\\\")\\r\\n | extend Display = ProcessName\\r\\n | project-away ProcessName\\r\\n \",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"id\":\"c4d143f8-633e-4aa8-8a34-66ba156ffb32\",\"label\":\"Process Name\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"UserNameFilter\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n | where EventID in (3076,3077) \\r\\n | where EventID in ({Action})\\r\\n | summarize by UserName\\r\\n | extend Display = UserName\\r\\n \",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"id\":\"bd174fa2-72c6-40eb-b023-cb087cfdcaf6\",\"label\":\"User Name\",\"value\":[\"value::all\"]},{\"id\":\"6269ef33-aac0-480f-8d5e-b74120c05278\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PublisherNameFilter\",\"label\":\"Publisher\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"// Extract Publisher information from EventID 3089\\r\\nlet publisher = Event\\r\\n | where EventID == 3089 \\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend PublisherName = extract('(.*?)',1,EventData)\\r\\n | extend Hash = extract('(.*?)',1,EventData)\\r\\n | summarize by Hash, PublisherName;\\r\\n\\r\\n// Extract Click Events from EventID 3076 and 3077\\r\\nlet clickevent = Event\\r\\n | where EventID in (3076, 3077) \\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend SHA1_Hash = extract('(.*?)',1,EventData)\\r\\n | extend SHA256_Hash = extract('(.*?)',1,EventData)\\r\\n | project Computer, TimeGenerated, SHA1_Hash, EventID, SHA256_Hash;\\r\\n\\r\\n// Join on SHA1_Hash\\r\\nlet clickevent_SHA1 = clickevent\\r\\n | join kind=inner (\\r\\n publisher\\r\\n ) on $left.SHA1_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, PublisherName, EventID, Hash = SHA1_Hash;\\r\\n\\r\\n// Join on SHA256_Hash\\r\\nlet clickevent_SHA256 = clickevent\\r\\n | join kind=inner (\\r\\n publisher\\r\\n ) on $left.SHA256_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, PublisherName, EventID, Hash = SHA256_Hash;\\r\\n\\r\\n// Combine results and remove duplicates\\r\\nclickevent_SHA256\\r\\n| union clickevent_SHA1\\r\\n| summarize count() by PublisherName\\r\\n| extend Display = strcat(coalesce(PublisherName, \\\"\\\"), \\\", [\\\", count_ ,\\\"]\\\")\\r\\n| sort by count_\\r\\n| project-away count_;\\r\\n\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"5832ab11-8517-4873-8251-828b3856a307\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"IssuerNameFilter\",\"label\":\"Issuer\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"// Extract Publisher information from EventID 3089\\r\\nlet Issuer = Event\\r\\n | where EventID == 3089 \\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend IssuerName = extract('(.*?)',1,EventData)\\r\\n | extend Hash = extract('(.*?)',1,EventData)\\r\\n | summarize by Hash, IssuerName;\\r\\n\\r\\n// Extract Click Events from EventID 3076 and 3077\\r\\nlet clickevent = Event\\r\\n | where EventID in (3076, 3077) \\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend SHA1_Hash = extract('(.*?)',1,EventData)\\r\\n | extend SHA256_Hash = extract('(.*?)',1,EventData)\\r\\n | project Computer, TimeGenerated, SHA1_Hash, EventID, SHA256_Hash;\\r\\n\\r\\n// Join on SHA1_Hash\\r\\nlet clickevent_SHA1 = clickevent\\r\\n | join kind=inner (\\r\\n Issuer\\r\\n ) on $left.SHA1_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, IssuerName, EventID, Hash = SHA1_Hash;\\r\\n\\r\\n// Join on SHA256_Hash\\r\\nlet clickevent_SHA256 = clickevent\\r\\n | join kind=inner (\\r\\n Issuer\\r\\n ) on $left.SHA256_Hash == $right.Hash\\r\\n | project Computer, TimeGenerated, IssuerName, EventID, Hash = SHA256_Hash;\\r\\n\\r\\n// Combine results and remove duplicates\\r\\nclickevent_SHA256\\r\\n| union clickevent_SHA1\\r\\n| summarize count() by IssuerName\\r\\n| extend Display = strcat(coalesce(IssuerName, \\\"\\\"), \\\", [\\\", count_ ,\\\"]\\\")\\r\\n| sort by count_\\r\\n| project-away count_;\\r\\n\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"40\",\"name\":\"FileParameter\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Extract Publisher information from EventID 3089\\r\\nlet Publisher = Event\\r\\n | where EventID == 3089 \\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend Hash = extract('(.*?)',1,EventData)\\r\\n | extend PublisherName = extract('(.*?)',1,EventData)\\r\\n | where PublisherName in ({PublisherNameFilter})\\r\\n | extend IssuerName = extract('(.*?)',1,EventData)\\r\\n | where IssuerName in ({IssuerNameFilter})\\r\\n | extend NotValidBefore = extract('(.*?)',1,EventData)\\r\\n | extend NotValidAfter = extract('(.*?)',1,EventData)\\r\\n | extend PublisherTBSHash = extract('(.*?)',1,EventData)\\r\\n | extend IssuerTBSHash = extract('(.*?)',1,EventData)\\r\\n //| summarize by Hash, PublisherName, IssuerName, NotValidAfter, NotValidBefore, _ResourceId, PublisherTBSHash, IssuerTBSHash;\\r\\n //| summarize arg_max(TimeGenerated, *) by Hash, PublisherName, IssuerName, NotValidAfter, NotValidBefore, _ResourceId, PublisherTBSHash, IssuerTBSHash;\\r\\n | summarize arg_max(TimeGenerated, *) by Hash\\r\\n | project TimeGenerated, Hash, PublisherName, IssuerName, NotValidBefore, NotValidAfter, _ResourceId, PublisherTBSHash, IssuerTBSHash;\\r\\n\\r\\n// Extract File Events from EventID 3076 and 3077\\r\\nlet FileEvents = Event\\r\\n | where EventID in (3076, 3077) \\r\\n | where EventID in ({Action})\\r\\n | where _ResourceId in ({Computer})\\r\\n | where UserName in ({UserNameFilter})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend AffectedFile = extract('(.*?)',1,EventData)\\r\\n | where AffectedFile in ({AffectedFileFilter})\\r\\n | extend OriginalFileName = extract('(.*?)',1,EventData)\\r\\n | extend InternalName = extract('(.*?)',1,EventData)\\r\\n | extend FileDescription = extract('(.*?)',1,EventData)\\r\\n | extend ProductName = extract('(.*?)',1,EventData)\\r\\n | extend FileVersion = extract('(.*?)',1,EventData)\\r\\n | extend ProcessName = extract('(.*?)',1,EventData)\\r\\n | where ProcessName in ({ProcessNameFilter})\\r\\n | extend PolicyName = extract('(.*?)',1,EventData)\\r\\n | extend PolicyID = extract('(.*?)',1,EventData)\\r\\n | where PolicyID in ({PolicyID})\\r\\n | extend PolicyGUID = extract('(.*?)',1,EventData)\\r\\n | extend Status = extract('(.*?)',1,EventData)\\r\\n | extend SHA1_Hash = extract('(.*?)',1,EventData)\\r\\n | extend SHA256_Hash = extract('(.*?)',1,EventData)\\r\\n | extend PolicyHash = extract('(.*?)',1,EventData)\\r\\n | project TimeGenerated, Computer = iff(isempty(_ResourceId),Computer,_ResourceId), UserName, Action = EventID, Details = RenderedDescription, AffectedFile, \\r\\n ProcessName = replace_regex(ProcessName, \\\"(.*)HarddiskVolume0-9W[iI][nN][dD][oO][wW][sS]\\\", \\\".\\\"), \\r\\n Status, PolicyID, PolicyGUID, PolicyHash, SHA1_Hash, FileVersion, PolicyName, SHA256_Hash;\\r\\n\\r\\n// Join on SHA1_Hash\\r\\nlet FileEvents_SHA1 = FileEvents\\r\\n | join kind = inner (\\r\\n Publisher\\r\\n | extend joinvalue_sha1 = strcat(Hash, _ResourceId)\\r\\n ) on $left.SHA1_Hash == $right.Hash\\r\\n | project TimeGenerated, Computer, UserName, Action, PublisherName, Details, AffectedFile, ProcessName, Status, PolicyID, PolicyGUID, PolicyHash, Hash = SHA1_Hash, FileVersion, PolicyName ,PublisherTBSHash;\\r\\n\\r\\n// Join on SHA256_Hash\\r\\nlet FileEvents_SHA256 = FileEvents\\r\\n | join kind = inner (\\r\\n Publisher\\r\\n | extend joinvalue_sha256 = strcat(Hash, _ResourceId)\\r\\n ) on $left.SHA256_Hash == $right.Hash\\r\\n | project TimeGenerated, Computer , UserName, Action, PublisherName, Details, AffectedFile, ProcessName, Status, PolicyID, PolicyGUID, PolicyHash, FileVersion, PolicyName, Hash = SHA256_Hash ,PublisherTBSHash;\\r\\n\\r\\n// Combine results and remove duplicates\\r\\nFileEvents_SHA256\\r\\n| union FileEvents_SHA1\\r\\n//Testing Different Results between PublisherTBSHash or PublisherName to disply unknown publishers \\r\\n//| where isnotempty(PublisherTBSHash)\\r\\n| where isnotempty(PublisherName)\\r\\n| sort by TimeGenerated\\r\\n| project TimeGenerated, Computer, UserName, Action, PublisherName, Details, AffectedFile, ProcessName, Status, PolicyID, PolicyGUID, PolicyHash, FileVersion, PolicyName, Hash\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":0,\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TimeGenerated\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"26ch\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Computer\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"UserName\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"CellDetails\",\"linkIsContextBlade\":true}},{\"columnMatch\":\"Action\",\"formatter\":18,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true,\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"3076\",\"representation\":\"Log\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3077\",\"representation\":\"Lock\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"3099\",\"representation\":\"Tools\",\"text\":\"{0}{1}\"},{\"representation\":\"disabled\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"representation\":null,\"text\":\"{0}{1}\"}],\"customColumnWidthSetting\":\"15ch\"}},{\"columnMatch\":\"PublisherName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"duplicated\",\"representation\":\"up\",\"text\":\"{1}{0}\"},{\"operator\":\"==\",\"thresholdValue\":\"empty\",\"representation\":\"down\",\"text\":\"{1}{0}\"},{\"operator\":\"==\",\"thresholdValue\":\"single\",\"representation\":\"right\",\"text\":\"{1}{0}\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"representation\":null,\"text\":\"{0}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkLabel\":\"Click\",\"linkIsContextBlade\":true,\"customColumnWidthSetting\":\"15ch\"}},{\"columnMatch\":\"ProcessName\",\"formatter\":5,\"formatOptions\":{\"linkTarget\":\"CellDetails\",\"linkIsContextBlade\":true,\"customColumnWidthSetting\":\"22ch\"}},{\"columnMatch\":\"Status\",\"formatter\":5},{\"columnMatch\":\"PolicyID\",\"formatter\":5},{\"columnMatch\":\"PolicyGUID\",\"formatter\":5},{\"columnMatch\":\"PolicyHash\",\"formatter\":5},{\"columnMatch\":\"SHA1_Hash\",\"formatter\":5},{\"columnMatch\":\"OriginalFileName\",\"formatter\":5},{\"columnMatch\":\"InternalName\",\"formatter\":5},{\"columnMatch\":\"FileDescription\",\"formatter\":5},{\"columnMatch\":\"ProductName\",\"formatter\":5},{\"columnMatch\":\"FileVersion\",\"formatter\":5},{\"columnMatch\":\"PolicyName\",\"formatter\":5},{\"columnMatch\":\"SHA256_Hash\",\"formatter\":5},{\"columnMatch\":\"publishervalue\",\"formatter\":5,\"formatOptions\":{\"customColumnWidthSetting\":\"5ch\"}},{\"columnMatch\":\"IssuerName\",\"formatter\":5},{\"columnMatch\":\"NotValidAfter\",\"formatter\":5},{\"columnMatch\":\"NotValidBefore\",\"formatter\":5},{\"columnMatch\":\"PublisherTBSHash\",\"formatter\":5},{\"columnMatch\":\"IssuerTBSHash\",\"formatter\":5},{\"columnMatch\":\"parameter_export\",\"formatter\":5},{\"columnMatch\":\"Options\",\"formatter\":5},{\"columnMatch\":\"Description\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkLabel\":\"Click\",\"linkIsContextBlade\":true,\"customColumnWidthSetting\":\"15ch\"}},{\"columnMatch\":\"RenderedDescription\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true}}],\"rowLimit\":10000,\"filter\":true},\"sortBy\":[]},\"name\":\"FileEventsRaw\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}}]},\"name\":\"File Events Group\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"tab\",\"comparison\":\"isEqualTo\",\"value\":\"FileEvents\"},\"name\":\"FileEvents\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Policy Events\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"id\":\"4de5626e-221a-4b15-b8fb-1389a76d2711\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PolicyGUID\",\"label\":\"Policy GUID\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n| where EventID in (3099) \\r\\n| extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n| distinct PolicyGUID = extract('(.*?)',1,EventData)\\r\\n| where PolicyGUID != \\\"{d2bda982-ccf6-4344-ac5b-0b44427b6816}\\\"\\r\\n| sort by PolicyGUID asc \",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"d381479f-7783-4962-a211-a61195794558\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PolicyName\",\"label\":\"Policy Name\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n| where EventID in (3099) \\r\\n| extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n| distinct PolicyName = extract('(.*?)',1,EventData)\\r\\n| where PolicyName != \\\"Microsoft Windows Driver Policy\\\"\\r\\n| sort by PolicyName asc \",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"40\",\"name\":\"Computer Filter - Copy\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PolicyEvents = Event\\r\\n | where EventID == 3099 \\r\\n | where _ResourceId in ({Computer})\\r\\n | extend parsed = parse_xml(EventData)\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend PolicyNameBuffer = extract('(.*?)',1,EventData)\\r\\n | where PolicyNameBuffer in ({PolicyName})\\r\\n | extend PolicyGUID = extract('(.*?)',1,EventData)\\r\\n | where PolicyGUID in ({PolicyGUID})\\r\\n | where PolicyNameBuffer != \\\"Microsoft Windows Driver Policy\\\";\\r\\nPolicyEvents\\r\\n| union (\\r\\n range x from 1 to 1 step 1\\r\\n | mv-expand TimeGenerated=range(now(-7d),now(),5m) to typeof(datetime )\\r\\n | extend Audit=0\\r\\n | extend Block=0\\r\\n)\\r\\n| summarize PolicyLoad=countif(EventID==3099) by bin(TimeGenerated,5m)\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Time Brush Policy Events, last 7 Days (overrides Time Range)\",\"timeContext\":{\"durationMs\":604800000},\"timeBrushParameterName\":\"TimeRange\",\"timeBrushExportOnlyWhenBrushed\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"timechart\",\"chartSettings\":{\"xAxis\":\"TimeGenerated\",\"seriesLabelSettings\":[{\"seriesName\":\"Blocked\",\"color\":\"redBright\"},{\"seriesName\":\"Audit\",\"color\":\"green\"}]}},\"name\":\"TimeBrush_PolicyInsights\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let events = Event\\r\\n| where EventID == 3099\\r\\n| where _ResourceId in ({Computer})\\r\\n| extend parsed = parse_xml(EventData)\\r\\n| extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n| extend PolicyNameBuffer = extract('(.*?)',1,EventData)\\r\\n| where PolicyNameBuffer in ({PolicyName})\\r\\n| extend PolicyGUID = extract('(.*?)',1,EventData)\\r\\n| where PolicyGUID in ({PolicyGUID})\\r\\n| where PolicyNameBuffer != \\\"Microsoft Windows Driver Policy\\\";\\r\\nevents\\r\\n| make-series EventTrend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by _ResourceId\\r\\n| join kind=fullouter (\\r\\n events\\r\\n | summarize Events = count() by _ResourceId\\r\\n ) on _ResourceId\\r\\n| project-away _ResourceId1, TimeGenerated\\r\\n| project Computer = _ResourceId, Events, EventTrend\\r\\n| sort by Events\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Policy Events by Computer\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Computer\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\"}},{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"purple\"}},{\"columnMatch\":\"EventTrend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"purple\"}},{\"columnMatch\":\"_ResourceId1\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"_ResourceId\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"BlockedTrend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"AuditTrend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true},\"sortBy\":[],\"chartSettings\":{\"xAxis\":\"Computer\",\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"Blocked\",\"color\":\"redBright\"},{\"seriesName\":\"Audit\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"policyEvents-by-computer\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Show additonal Information\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5b62b8c3-8fa6-402a-8303-856c6a896234\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"activepolicy\",\"label\":\"Active Policy\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"modifiedpolicy\",\"label\":\"Modified Policies\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": 99, \\\"label\\\": \\\"No\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": 1, \\\"label\\\": \\\"New/Modified\\\" },\\r\\n { \\\"value\\\": 2, \\\"label\\\": \\\"All\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"ba6e889e-0c0e-49aa-8d36-88f41652edac\"}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"modifiypolicyParameter\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Event\\r\\n| where EventID == 3099\\r\\n| where _ResourceId in ({Computer})\\r\\n| extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n| extend PolicyNameBuffer = extract('(.*?)',1,EventData)\\r\\n| where PolicyNameBuffer in ({PolicyName})\\r\\n| where PolicyNameBuffer != \\\"Microsoft Windows Driver Policy\\\"\\r\\n| extend PolicyGUID = extract('(.*?)',1,EventData)\\r\\n| where PolicyGUID in ({PolicyGUID})\\r\\n| extend Options = extract('(.*?)',1,EventData)\\r\\n| extend Option16 = iff(binary_and(toint(Options), 0x10000) > 0, \\\"Audit\\\", \\\"Enforced\\\")\\r\\n| extend PolicyId = extract('(.*?)',1,EventData)\\r\\n| project TimeGenerated, Computer, Policy = PolicyNameBuffer,Option16, PolicyGUID, PolicyId\\r\\n| summarize arg_max(TimeGenerated, *) by Computer, Policy, PolicyGUID\\r\\n| sort by TimeGenerated\\r\\n| project ['Latest Record']=TimeGenerated, Computer, Policy, Mode=Option16, PolicyGUID = substring(PolicyGUID, 1,strlen(PolicyGUID)-2) , PolicyId\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Active Policy\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Mode\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Audit\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Enforced\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"text\":\"{0}{1}\"}]}}],\"rowLimit\":1000,\"sortBy\":[{\"itemKey\":\"Latest Record\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Latest Record\",\"sortOrder\":2}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"Process\"},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false}},\"conditionalVisibility\":{\"parameterName\":\"activepolicy\",\"comparison\":\"isNotEqualTo\",\"value\":\"No\"},\"name\":\"Active Policy\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Event\\r\\n| where EventID == 3099\\r\\n| where _ResourceId in ({Computer})\\r\\n| extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n| extend PolicyNameBuffer = extract('(.*?)',1,EventData)\\r\\n| where PolicyNameBuffer in ({PolicyName})\\r\\n| where PolicyNameBuffer != \\\"Microsoft Windows Driver Policy\\\"\\r\\n| extend PolicyGUID = extract('(.*?)',1,EventData)\\r\\n| where PolicyGUID in ({PolicyGUID})\\r\\n| extend Options = extract('(.*?)',1,EventData)\\r\\n| extend PolicyId = extract('(.*?)',1,EventData)\\r\\n| project Computer, PolicyNameBuffer, TimeGenerated, Options, PolicyGUID, PolicyId\\r\\n| order by Computer, PolicyNameBuffer, TimeGenerated asc\\r\\n| extend prev_Options = prev(Options)\\r\\n| extend prev_Computer = prev(Computer)\\r\\n| extend prev_Policy = prev(PolicyNameBuffer)\\r\\n| extend OptionState = case(\\r\\n isempty(prev_Options), \\\"First Entry\\\",\\r\\n Computer != prev_Computer, \\\"First Entry\\\",\\r\\n PolicyNameBuffer != prev_Policy, \\\"First Entry\\\",\\r\\n Options == prev_Options, \\\"Not Modified\\\",\\r\\n Options != prev_Options, \\\"Modified\\\",\\r\\n \\\"Unknown\\\")\\r\\n| extend showonfilter=iff(OptionState==\\\"Modified\\\" or OptionState==\\\"First Entry\\\",1,2)\\r\\n| where showonfilter <= {modifiedpolicy}\\r\\n| extend Option16 = iff(binary_and(toint(Options), 0x10000) > 0, \\\"Audit\\\", \\\"Enforced\\\")\\r\\n| project TimeGenerated, Computer, Policy = PolicyNameBuffer, OptionState,showonfilter, Mode=Option16,PolicyGUID = substring(PolicyGUID, 1,strlen(PolicyGUID)-2), PolicyId\\r\\n| sort by TimeGenerated\\r\\n\\r\\n\\r\\n\\r\\n\\r\\n\",\"size\":2,\"title\":\"Modified Policy\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OptionState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Not Modified\",\"representation\":\"amethyst\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Modified\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"First Entry\",\"representation\":\"grayBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"showonfilter\",\"formatter\":5},{\"columnMatch\":\"Mode\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Audit\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Enforced\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"text\":\"{0}{1}\"}]}}],\"rowLimit\":5000},\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"Process\"},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false}},\"conditionalVisibility\":{\"parameterName\":\"modifiedpolicy\",\"comparison\":\"isNotEqualTo\",\"value\":\"99\"},\"name\":\"Modified Policy\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}}]},\"name\":\"Show additonal Information PolicyEvents\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"bc4cb9c6-c634-44a5-8ce0-dec28453d071\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"options\",\"type\":10,\"description\":\"set parameter for policy option details\",\"isRequired\":true,\"isHiddenWhenLocked\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"empty\\\", \\\"label\\\": \\\"empty\\\", \\\"selected\\\":true }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PolicyEvents = Event\\r\\n | where EventID == 3099\\r\\n | where _ResourceId in ({Computer})\\r\\n | extend parsed = parse_xml(EventData)\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend PolicyNameBuffer = extract('(.*?)',1,EventData)\\r\\n | where PolicyNameBuffer in ({PolicyName})\\r\\n | where PolicyNameBuffer != \\\"Microsoft Windows Driver Policy\\\"\\r\\n | extend PolicyGUID = extract('(.*?)',1,EventData)\\r\\n | where PolicyGUID in ({PolicyGUID})\\r\\n | extend Options = extract('(.*?)',1,EventData)\\r\\n | extend Option16 = iff(binary_and(toint(Options), 0x10000) > 0, \\\"Audit\\\", \\\"Enforced\\\")\\r\\n | extend PolicyId = extract('(.*?)',1,EventData)\\r\\n | project TimeGenerated, Details=RenderedDescription, UserName, Computer = iff(isempty(_ResourceId),Computer,_ResourceId), Policy = PolicyNameBuffer, Mode=Option16, Options, PolicyGUID = substring(PolicyGUID, 1,strlen(PolicyGUID)-2), PolicyId ;\\r\\nPolicyEvents\\r\\n| sort by TimeGenerated\\r\\n| project-reorder TimeGenerated, Computer, UserName\",\"size\":2,\"title\":\"Policy Events by Time\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"Options\",\"parameterName\":\"options\",\"parameterType\":1},{\"fieldName\":\"optionsvisible\",\"parameterName\":\"optionsvisible\",\"parameterType\":1}],\"showExportToExcel\":true,\"exportToExcelOptions\":\"all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Computer\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"UserName\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"CellDetails\",\"linkIsContextBlade\":true}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkLabel\":\"Click\",\"linkIsContextBlade\":true,\"customColumnWidthSetting\":\"15ch\"}},{\"columnMatch\":\"Mode\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Audit\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Enforced\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Options\",\"formatter\":5},{\"columnMatch\":\"optionsvisible\",\"formatter\":5},{\"columnMatch\":\"ProcessName\",\"formatter\":5,\"formatOptions\":{\"linkTarget\":\"CellDetails\",\"linkIsContextBlade\":true,\"customColumnWidthSetting\":\"22ch\"}}],\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_link_Computer_1\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"$gen_link_Computer_1\",\"sortOrder\":1}]},\"name\":\"PolicyEventsbyTime\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let hexValue = \\\"{options}\\\";\\r\\nlet intValue = toint(hexValue);\\r\\nlet binaryValue= strcat(\\r\\n iff(binary_and(intValue, 0x80000000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x40000000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x20000000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x10000000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x8000000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x4000000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x2000000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x1000000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x800000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x400000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x200000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x100000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x80000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x40000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x20000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x10000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x8000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x4000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x2000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x1000) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x800) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x400) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x200) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x100) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x80) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x40) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x20) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x10) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x8) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x4) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x2) > 0, \\\"1\\\", \\\"0\\\"),\\r\\n iff(binary_and(intValue, 0x1) > 0, \\\"1\\\", \\\"0\\\")\\r\\n);\\r\\nlet RbinaryValue = reverse(binaryValue);\\r\\ndatatable (BitAddress: int, PolicyRuleOption: string)\\r\\n[\\r\\n 0, \\\"NotUsed\\\",\\r\\n 1, \\\"NotUsed\\\",\\r\\n 2, \\\"Enabled:UMCI\\\",\\r\\n 3, \\\"Enabled:Boot Menu Protection\\\",\\r\\n 4, \\\"Enabled:Intelligent Security Graph Authorization\\\",\\r\\n 5, \\\"Enabled:Invalidate EAs on Reboot\\\",\\r\\n 6, \\\"NotUsed\\\",\\r\\n 7, \\\"Required:WHQL\\\",\\r\\n 8, \\\"NotUsed\\\",\\r\\n 9, \\\"NotUsed\\\",\\r\\n 10, \\\"Enabled:Allow Supplemental Policies\\\",\\r\\n 11, \\\"Disabled:Runtime FilePath Rule Protection\\\",\\r\\n 13, \\\"Enabled:Revoked Expired As Unsigned\\\",\\r\\n 14, \\\"NotUsed\\\",\\r\\n 15, \\\"NotUsed\\\",\\r\\n 16, \\\"Enabled:Audit Mode (Default)\\\",\\r\\n 17, \\\"Disabled:Flight Signing\\\",\\r\\n 18, \\\"Enabled:Inherit Default Policy\\\",\\r\\n 19, \\\"Enabled:Unsigned System Integrity Policy (Default)\\\",\\r\\n 20, \\\"Enabled:Dynamic Code Security\\\",\\r\\n 21, \\\"Required:EV Signers\\\",\\r\\n 22, \\\"Enabled:Boot Audit on Failure\\\",\\r\\n 23, \\\"Enabled:Advanced Boot Options Menu\\\",\\r\\n 24, \\\"Disabled:Script Enforcement\\\",\\r\\n 25, \\\"Required:Enforce Store Applications\\\",\\r\\n 26, \\\"NotUsed\\\",\\r\\n 27, \\\"Enabled:Managed Installer\\\",\\r\\n 28, \\\"Enabled:Update Policy No Reboot\\\"\\r\\n]\\r\\n| extend Results = iif(substring(RbinaryValue, BitAddress ,1) == \\\"1\\\", \\\"Yes\\\", \\\"No\\\")\\r\\n| where Results == \\\"Yes\\\"\\r\\n\",\"size\":3,\"title\":\"Policy Options Details\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"PolicyRuleOption\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Enabled:Audit Mode (Default)\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Value\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"CellDetails\",\"linkIsContextBlade\":true}}],\"rowLimit\":5000,\"filter\":true},\"tileSettings\":{\"showBorder\":false},\"graphSettings\":{\"type\":0},\"mapSettings\":{\"locInfo\":\"AzureResource\",\"locInfoColumn\":\"Computer\"}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"options\",\"comparison\":\"isNotEqualTo\",\"value\":\"empty\"},\"name\":\"PolicyOptionsDetails\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"### Please select a line to get policy otions\\r\\n\\tif you see this box you have not selected one of the policy event above\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"options\",\"comparison\":\"isEqualTo\",\"value\":\"empty\"},\"name\":\"text - 3\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\"}}]},\"conditionalVisibility\":{\"parameterName\":\"tab\",\"comparison\":\"isEqualTo\",\"value\":\"PolicyInsights\"},\"name\":\"PolicyEvents\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Event and Policy Graph\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"id\":\"4bbba18a-7884-4d8d-b397-4fe1af24449e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"PolicyID\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n| where EventID in (3076,3077) \\r\\n| distinct PolicyID = extract('(.*?)',1,EventData)\\r\\n| sort by PolicyID asc\\r\\n\",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"d544011e-5853-4dcc-adfc-f45e8e5406b1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Action\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"3076,3077\\\", \\\"label\\\": \\\"All\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"3076\\\", \\\"label\\\": \\\"Audit\\\" },\\r\\n { \\\"value\\\": \\\"3077\\\", \\\"label\\\": \\\"Block\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"35\",\"name\":\"FileEventsFilterGraph\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"id\":\"68b80da4-2f9b-4983-a197-2ae50b71a988\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AffectedFileFilter\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n | where EventID in (3076,3077) \\r\\n | where EventID in ({Action})\\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend AffectedFile = extract('(.*?)',1,EventData)\\r\\n | summarize by AffectedFile\\r\\n | extend AffectedFile2 = replace_string(AffectedFile,\\\"\\\\\\\\\\\",\\\"\\\\\\\\\\\\\\\\\\\")\\r\\n | extend Display = AffectedFile\\r\\n | project-away AffectedFile\\r\\n \",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"label\":\"Affected File\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ProcessNameFilter\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n | where EventID in (3076,3077) \\r\\n | where EventID in ({Action})\\r\\n | where _ResourceId in ({Computer})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend ProcessName = extract('(.*?)',1,EventData)\\r\\n | summarize by ProcessName\\r\\n | extend ProcessName2 = replace_string(ProcessName,\\\"\\\\\\\\\\\",\\\"\\\\\\\\\\\\\\\\\\\")\\r\\n | extend Display = ProcessName\\r\\n | project-away ProcessName\\r\\n \",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"id\":\"67a76f99-4d5a-42d8-8516-97621c5963c5\",\"label\":\"Process Name\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"UserNameFilter\",\"label\":\"User Name\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Event\\r\\n | where EventID in (3076,3077) \\r\\n | where EventID in ({Action})\\r\\n | summarize by UserName\\r\\n | extend Display = UserName\\r\\n \",\"crossComponentResources\":[\"{Workspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"],\"id\":\"5267b24b-5cac-4eb9-b181-0f6ab7f63511\"}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"40\",\"name\":\"FileParameterGraph\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\r\\n\\r\\nlet data = Event\\r\\n | where EventID in (3076,3077)\\r\\n | where EventID in ({Action})\\r\\n | where _ResourceId in ({Computer}) \\r\\n | where UserName in ({UserNameFilter})\\r\\n | extend xml_eventdata = parse_xml(EventData).DataItem.EventData.Data\\r\\n | extend PolicyID = extract('(.*?)',1,EventData)\\r\\n | where PolicyID in ({PolicyID})\\r\\n | extend AffectedFile = extract('(.*?)',1,EventData)\\r\\n | where AffectedFile in ({AffectedFileFilter})\\r\\n | extend ProcessName = extract('(.*?)',1,EventData)\\r\\n | where ProcessName in ({ProcessNameFilter})\\r\\n | extend OriginalFileName = extract('(.*?)',1,EventData)\\r\\n | summarize by UserName=tolower(UserName), Computer=tolower(Computer), ProcessName=replace_regex(ProcessName,\\\"(.*)HarddiskVolume[0-9](.*)W[iI][nN][dD][oO][wW][sS]\\\",\\\".\\\"), Action=iff(EventID==3076,\\\"Audit\\\",\\\"Block\\\"),OriginalFileName;\\r\\nlet links = data\\r\\n | summarize edgesize=count() by Source=Computer, Target=Action, Kind=\\\"Computer -> Action\\\"\\r\\n | union \\r\\n (data \\r\\n | summarize edgesize=count() by Source=Action, Target=ProcessName, Kind=\\\"Action -> ProcessName\\\"),\\r\\n (data \\r\\n | summarize edgesize=count() by Source=ProcessName, Target=OriginalFileName, Kind=\\\"ProcessName -> OriginalFileName\\\"),\\r\\n (data\\r\\n | summarize edgesize=count() by Source=UserName, Target=Computer, Kind=\\\"UserName -> Computer\\\");\\r\\nlet nodes = data\\r\\n | summarize nodesize=count() by Id=Computer,Name=Computer, Kind=\\\"Computer\\\"\\r\\n | union (\\r\\n data\\r\\n | summarize nodesize=count() by Id=ProcessName, Name=ProcessName, Kind=\\\"ProcessName\\\"),\\r\\n (data \\r\\n | summarize nodesize=count() by Id=Action, Name=Action, Kind=\\\"Action\\\"),\\r\\n (data\\r\\n | summarize nodesize=count() by Id=OriginalFileName, Name=OriginalFileName, Kind=\\\"OriginalFileName\\\"),\\r\\n (data \\r\\n | summarize nodesize=count() by Id=UserName, Name=UserName, Kind=\\\"UserName\\\");\\r\\nnodes\\r\\n| union links\",\"size\":3,\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"graph\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TimeGenerated\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"26ch\"}},{\"columnMatch\":\"Computer\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"UserName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"RenderedDescription\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true}}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"PolicyNameBuffer\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"PolicyNameBuffer\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Name\",\"formatter\":1},\"bottomContent\":{\"columnMatch\":\"Kind\"},\"nodeIdField\":\"Id\",\"sourceIdField\":\"Source\",\"targetIdField\":\"Target\",\"graphOrientation\":2,\"showOrientationToggles\":true,\"edgeSize\":\"edgesize\",\"nodeSize\":{\"sizeField\":\"nodesize\",\"minSize\":50,\"maxSize\":200},\"staticNodeSize\":100,\"colorSettings\":{\"nodeColorField\":\"Kind\",\"type\":3,\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Computer\",\"representation\":\"green\"},{\"operator\":\"==\",\"thresholdValue\":\"Action\",\"representation\":\"purple\"},{\"operator\":\"==\",\"thresholdValue\":\"ProcessName\",\"representation\":\"lightBlue\"},{\"operator\":\"==\",\"thresholdValue\":\"OriginalFileName\",\"representation\":\"grayBlue\"},{\"operator\":\"==\",\"thresholdValue\":\"UserName\",\"representation\":\"turquoise\"},{\"operator\":\"Default\",\"thresholdValue\":null,\"representation\":\"lightBlue\"}]},\"hivesMargin\":5,\"edgeColorSettings\":null},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"count_\",\"heatmapPalette\":\"greenRed\"}}},\"name\":\"query - 0 - Copy - Copy - Copy - Copy - Copy\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"tab\",\"comparison\":\"isEqualTo\",\"value\":\"Graph\"},\"name\":\"Graph\",\"styleSettings\":{\"margin\":\"5px\",\"padding\":\"5px\",\"showBorder\":true}}],\"isLocked\":false,\"fallbackResourceIds\":[\"Azure Monitor\"]}", - "version": "1.0", - "sourceId": "[parameters('workbookSourceId')]", - "category": "[parameters('workbookType')]" - } - } - ], - "outputs": { - "workbookId": { - "type": "string", - "value": "[resourceId( 'microsoft.insights/workbooks', parameters('workbookId'))]" - } - }, - "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#" -} From bf8c421ce579efcb6ccc7730851ddc0a61498985 Mon Sep 17 00:00:00 2001 From: "Carlos Mayol (MSFT)" Date: Tue, 20 May 2025 16:53:00 -0400 Subject: [PATCH 3/4] Delete Scenarios/How to get insights into App Control (WDAC) events/DCR-WDAC.json delete files --- .../DCR-WDAC.json | 76 ------------------- 1 file changed, 76 deletions(-) delete mode 100644 Scenarios/How to get insights into App Control (WDAC) events/DCR-WDAC.json diff --git a/Scenarios/How to get insights into App Control (WDAC) events/DCR-WDAC.json b/Scenarios/How to get insights into App Control (WDAC) events/DCR-WDAC.json deleted file mode 100644 index 796163f..0000000 --- a/Scenarios/How to get insights into App Control (WDAC) events/DCR-WDAC.json +++ /dev/null @@ -1,76 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "ruleName": { - "defaultValue": "DCR-WDAC", - "type": "String", - "metadata": { - "description": "Specifies the name of the data collection rule to create." - } - }, - "workspaceResourceId": { - "type": "String", - "metadata": { - "description": "The specification of destinations." - } - }, - "WorkspaceLocation": { - "type": "String", - "metadata": { - "description": "Specifies the location in which to create the data collection rule." - } - }, - "apiVersion": { - "defaultValue": "2022-06-01", - "type": "String", - "metadata": { - "description": "Specifies the api version to use when deploying data collection rule template." - } - } - }, - "resources": [ - { - "type": "Microsoft.Insights/dataCollectionRules", - "apiVersion": "[parameters('apiVersion')]", - "name": "[parameters('ruleName')]", - "location": "[parameters('WorkspaceLocation')]", - "kind": "Windows", - "properties": { - "dataSources": { - "windowsEventLogs": [ - { - "streams": [ - "Microsoft-Event" - ], - "scheduledTransferPeriod": "PT5M", - "xPathQueries": [ - "Microsoft-Windows-CodeIntegrity/Operational!*[System[(EventID=3076 or EventID=3077 or EventID=3089 or EventID=3099)]]" - ], - "name": "eventLogsDataSource" - } - ] - }, - "destinations": { - "logAnalytics": [ - { - "workspaceResourceId": "[parameters('workspaceResourceId')]", - "name": "LogAnalyticsDestination" - } - ] - }, - "dataFlows": [ - { - "streams": [ - "Microsoft-Event" - ], - "destinations": [ - "LogAnalyticsDestination" - ] - } - ], - "streamDeclarations": {} - } - } - ] -} From f61aad7a92f0fbfcc3327a4386ea422b06321987 Mon Sep 17 00:00:00 2001 From: "Carlos Mayol (MSFT)" Date: Tue, 20 May 2025 16:53:16 -0400 Subject: [PATCH 4/4] Delete Scenarios/How to get insights into App Control (WDAC) events/picture directory delete files/dir --- .../picture/LogAnalytics.png | Bin 74531 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 Scenarios/How to get insights into App Control (WDAC) events/picture/LogAnalytics.png diff --git a/Scenarios/How to get insights into App Control (WDAC) events/picture/LogAnalytics.png b/Scenarios/How to get insights into App Control (WDAC) events/picture/LogAnalytics.png deleted file mode 100644 index 6169f8c38ec0c18a3417f8a2956d468601d6212c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 74531 zcmZ^~WmFtp6Ezya-QC^Y-QC>@5Zr<@XmEE8!QCaey95aC&fp#f_dDcy@4erjZ>?c5 z)2q9WR-Ik7cSWcuNh8AH!F~Af0Z~>)LhZwcPiY@MeB6S80$=%CAms-B_t8a7TI@sh z1i=yb2ZW`lqUeVYb#d^|CXnFYu-{~KT|RukqJ01RD62;C_rr&`B3TJh4Ns%fEJzBXU(7JR1w6q5L@a|g)^44T14#^ffMGJ4-`F-ST6wJ1!Fu&wiqV3D=;vr%qKXJ$lF zSXme}p0}&juO9AN7aQ%9nY`=;1z6ura6;cdqaO|b`2YKc6AG}?FV#p(C^C4~NDdP}}nLfA2!XN*jkCY;`$caXdE|7#y@# z8;zAKniKNqxU_|2N1WYRv6qA+M=9Ei?B1-b#&_f{qSO5sy0&;P-=9 zJShXZQ-eC1IBx$>#^{Z`UUT0?_e-%Zyh8T%@0XX^xfWG%gu_i@|5sjUR#w&w1HhEi z@!W0d1DC^EuIvjkaZbPUOCKaW2W<#C5m9U?BL3Ey-%G9r9cLNf`E|9%`OW|BC5?(Q zZfonyT!lU~vEnnz+`-F2mHtJJ{Oi#$v0wa2)K1zDcJqxWY$hwUY^32>BFS~W#_1+S z+kxR>TeYzqcFT#8$qT2!y|dNk>0gpAg=~Q%zw8{pj8~QHN#Uo{yh-1Y_+Awnj0^%~7tnx{0gr#z$VrR$UA50`6GS@-=41rWo8omnejhes{3pv z71y^nmNr$QY#dD_2qoxsEn;C&Of~G^K^eU97nS_)zP@8bnrrp7Pv@ z{y1&Br<1dDU~?Mwr_UFpLYqP|1o1dj6FK~M-%(oJu8Obo-43Td^6~LyXyk$y4b;)7 zKBmP;tn=0(viQq>RZB-tkBpTSH4KSxrV=2;Ll1G(;$*gca8M%q@sJ4*7q@qAoP&9r zH9R(U=MDTbWXiBW{?0YmR| zQq_gXI)&>?WtDhtE;U3Jea0?zD4vcbAb>8mip% zr%#fWS5{UI?^zfb8R=0Z#cPy^v~71eKq4R@_;#@&SXfwSweSI(+30&$mk=JeL%!_q zofK`ak*fuz^)|P~NUEosf% zu{k^u$ikWTOM$*u`-q(1_Hju}g&ZE$>Y(yIvbYc!=IS2l_2 z-s#a*qg(@)Uy`(nVe(-%7%m!nz%u>qik+RkKUegkudh!n3G^(o>02%e$nN@#(BH9U z(B_J|+Uz*XAUG268Ty>RTW-`WO1{YR;>MEUx9xLQ&}wI_TSrY|kstiZf()ahli#eXr9 z_Oc=94Yv2WN?rI1Bq9c(;IkQYO{|p$2S&)T<@z^!|GiO692}hR9i+thAy-2PKoyg5 zS9H0i;MVaz)oeD0s{&dOJT_BLB<7eorkTknavB;K`c&p&8`9mQ%p6}09dr1M&8#>vs3n-reX?PNab;jsQmScg z7ksq4x2GG75Lf$8z;Ge-HsvU6#>7eZ^`z%JenCdW3auCN3uMig8iP790rm>>Qd!Z% zS0W)F86od$-^q!Ig-X;XS!L`eT}p9Cr5qu~JAkN&+gduj8lBpNSu{!Do*E{Rp54 z>mr>{Y;`v*n6eYOthj+gAhjj>kBZ6hwgy96MntU!=AmWF7DjyGK#e6k%ga~3#9yNe zBKa17GOVU@KQ_T?W(hY%nZxFI4r<~YYTEWzLTMcPTQl{TK9o~x$;JtNd^vr9C)a0;C7AO6bm)`&JWwWbW z7>!6g3?bn_iY!!OjYJhD{poHqB=UngJA38h0rB(Y@G0~}R)>?TeQ2oEQlksC!&(dJ z?A_UF6ynLEJSqnLIsaf+HjfkVwd?bzPk;CEYoaV|Dh=*dYr40>i2dUiJ&$H6T`v|e zjs0&@TAB<^*K6)N{jLFtEfa5*@z{wZtXaaynE4H*1Af+ouuhN4cZ`&jxS~Kn?p2A+ zRUd>NK;%G-tj=b>9OR9{7%QItZJ~10Tr_;*XZ25sgW5dt%T>qjNJ~yEzb-$|gRB4$ z`?Sz%nV13CED-dY?1q{*ePY5#U@}oYz1%DsCDrBX$&4W3b7_S4&C4jrBu_4F^8O^cMoPN+Lp!b1{@;|{99Vg6&j1c_jX85G89A4hMaSZJ*ENsx7svRR^ zG#DhNdUrmL{|E)e#wbiK9n%NBGdzYp7)GoVAGl|L%9^buM3(j zR_rJA_osE1gSS^U*jW8x;%J>?Za&y0{3-Jhjucp*gI2 zyj^u9vRV?o+i@Zh6-AVj8D~T_-Rc{Z=kebrGxFa-#J!Tctbza-mFm?<#o+zrb=KH_ zx~l0e5@CSZD@wEa$z>nH!xf)x+&1*`bccyYFK<*qC>EV9=s|SRdDn%ZOfl2Y!9?_` zUNX5gGHpgy6DJU+_>)VPRTZUt;fyjH8IC>oisaWI=lMn_eB;TSXq8@Lty=h`Nx$@n zTND;^Z`TX-*A635nHHbtX=%07x0gEugDz*xG$!NTG-E&7MP|caI&cGq?RQ_=dHngL z+Z>Y@s(rm_1NY%B#XcqNV>21hguny#4_)k;LGh)G0?He{WC58>*_a>-^@5^{?l&c` zpk^3RrAaw}sA+7U(4h~_tvb9f*3HS{@PV-pX_q?jsMwlo_chB4F z#apf2vNNu_*UpgJpH$a3we6FWC`fqh?fOZf;Wfb3<$3!>L36r9z=WKmFz29P+!^HldY;A3S za0|Omj`X)W?+M@EwqNYtx*}=Z=MpPNLT=QW1ko`3!N@t%W}7?}-XHP27!K*$-1NVz zVu)7V4ieh5`15n;7frm+%^vnI6*k9>HE1{y$`B!PP!GDR<3x@y^+8#@n#MR!KZ}B@ z6(kj}2XJSMiXnn6LOu`k(w|x#HLF^rT4zMK@!P^McGaILgJ|LVuFq$snXrR9e9)05*D61I4f`;rI_oB z6@PBTwHMMkMH1W2wbZR~2~+TdArkxfm#Y;;Dj>tcCd_xO>{MeiTiRnfKJVuBPD6lTZAeAkw}Fz; zs5!VHwMr;mO;ghI3%XA(1Wq`H8|ZL~mh+s*N)8->In<@Uh| z{S$TJ61NvDW-#8h$`10GM!go}52YeRuOBvX-rLWuXc6-EJ4JNo=g1v8jKSYo(V1l; z?+Q-fU=b7E;D^3vq^Dc$gGfwjZSR zcxR3!tI%UO=uqaP{G0VmB%RlJX%FYuLzD+!66BYi_(eUR0y{>(^JmECdYeWB>EFn{ zT|+}}zC#qnF@u(cnA3WP1ncV+a@(aZKC}=415SQ4)kzDp2hur=FO#F=iJHqRW#!VE zu7^{qM*O0{nbBjD$=w1N%*o2?`(6cErPgjoFQHA85QOrgT-ztJ2?798jq62h9F-DA zNc@LC3vtNn=*KZ)lyJ+eVk5Ix%7~Apb!335#zk$tLzfe#iL_eO#pwcRM{$gbq{Yl)AH(dVyos=}v5|Q#Ty; zS5M5>K0XeG zCHA9%xIiTka@BcHCOntCT?=0(8oBxB(+MzYmbdg9!fcMEG08h(44UZaA7~D$Ba|g1 zu-+0cF+*B_y_Wo5ne|*LtJdq)rj!4ZZ>kTiFr2*N*h=Y0DYOK!=Aatq&#cZYAKf1r zyKa+7nVA%Cwz3L7Q(yqG;_Y#f54hT&(PuyJ?64kRs+%EqzdoFXHbo$Y96U{sq1cvW zY(2t@LVMF2QNL|MY1*wST)5w@0t2STN-0J}tW+$}3VBqx6UFxR?At5#FY9Fr>`?|x79Qei;|gaf!5prf17svYq`b@Cqu zd_q?g4@2}mJ*lrNgP@kCR>)@C%X{(m^c)djVq!{v7-Qyfy|48YIx{D3rKAl{#b|>T z?G^pSiZ+O-{xK1#4NehdLzg!4z>Y=CJmiu4d%H-8wlI9Ep98W9Xhv)mu8Hl?S+gx* z11S_?Ki3`fEzG(y@>m|L zA+nFi%NSu^xbl z83rhptWpq_Uc&5^Xg#>bD*oJySYNKU_?^bQ$M5vab9?SvYc9ySo9Biu{D?#B%Ru$W zT&yhggF=5dskw?Ht5yAmk}&NYISab+RFEn5iDt#)kfbwrt}XNS(*5lfIoyrBKwz7Y z3_?{k{tNX5sH4?iUQ}dJk}MMMA>N84j%HnYl-=|17uxI{AgG-3h)7LaokRKVM|KLO zJeGVMIxJrPmu!3e=206Hn=Q$hVHi4{1nI0;dGy9W<9dr2gs|L;{@Ktje2n%sy9YMF zgdR;-LYwmO3TI6tzo-ekzU21ziJv6Qpp{13ts`A^IA6Gs+)oQ2bL8_VF`|)*2byHL zkd`+|?rPiBrYgIatZsF;wndGfA_o#VSzHa@;ZiWde*Ub8ugl+q43Srl>Wai>z z$X__8Y!w1yXlmF-Sy))4gg!Q5@lXU&ccmtu&E!zEsIi}{ydhrXjk7&`7Wd^@n2&&; zSZzl9>$09LtiuH)7x)ppfu?f}^Ti?CF83@Ogd8w2cw8d=P&ekBbP*qpuhdRR=fnt$ zXJIHA^&5H$WphT-kRYGb4^H9&C$_JcyBKZ_A_E0RA%!5>~<>+s_qMlb)gV$ zx*{7QHl&J|01ZV!?^_04#FCJ5!m?>4b5b9h#p){AmpF%Y_kr^e%XRcV;~XAaawaiR&?9G}36EIzr9dML-w*?1Ky{duAn z2pEt-RG==^DfX;cKGI~pW}66Za14@ZNln{UX6EgCshenZG+$9dpjjsR;`Qsw)n-e= z*T_baY42jaeep%W*ypk}x;OK7`QYvdB{k}{%~p2 z?}^Z1qlL8F7Q-2|-n{u`{BZi$g^rC~QAqhq8Ke;4bD2j#0=e|a#7T+YW7!(=y8m&- z&06af2#*$-Q^)J1s`-3a1S=#ZrHFw=%?#Hjybw`(MEL~@ajL}8_=vR->jXp~g^(r) zJ9U@UW&0WWdU(-zR>*I7j#hojK;TVD2^mX*7@Cjy@dcO7we%WEJs=9oBliNXpJlwh zuysmU16>~ngIQTAVT7ny0qg261Kf?(t+(NYO4P7{Vj zxT8B~VR^3E{-~KW1FsJsL8pz4y~O{#7%mDAI4^ah1{9Y*6$DNlGEtzEYgB*2UKDVg zE0{8ZZwz%@$|b!^ZVu+2j@PffkO8~MVkdOZ%Nbs zhGdXOjU3MgWh)|MX}<|ka}9(CZ=E+Bs#mNQHCKMFIsKBN&9Zaw)_;4(Uu$NWJ)8(M zEqfxhIV`yOVoj=y>SiyVGrZL+zDpy4VI<;YJ(rQ0ivo3gk$B#`0FNc2xf+HvI=MZs zZJhEVv2okUD5ouMK7V~QTe8dB`Ek^j|Q;XI9x zk{VUEDp|H;|BgUCleBS^`s4BOKAkw>;c~uZN_n5G$drrBW&FxcQd+D)?=N;&C;U=X zg)BZd;uh-Uu(rMFrWR@wU2UK9hpTw$xQ>h6m;C3(4x2pRCnQiSBN85#W>YZ{_j%rA zK(1v>xi}P(PsxaH!s1y^zzdu5>kvPLFLx{8X~k5IY6mm3X$-@n+&V zR@&=jtLMpP zKK{V?p+%HYw#AY&KjP*+1|yS4_etQW79g9iswI;)dH~_-^b(s(R7czda*z^G-t`EQ z_w>{V2?{E}K%VQ1Hl^{u--hnE+}F>@oWuels8cV`y`T)T#Nu({5&MIFv!m)vqG6?h zTOFS*oC790d+4Humd^F@KW9Be3O>$p^cU-w-9M^q6De83`x4;28gp~$IRQj){;*GG zNA>B!*pgJ{wiMd*8~Z;<4rwHQBXOkEB)uhOL8<9TT+G?K`k;BI20gEFBd2*$AQk6# zsx^#>`hT>S?k@z}okQ0V6}#!RRN%S#u;`FiSue5VIuB51AOqAqQXC|uqHf3?5h?Reh*ng43(fHRS^)T;1d)S6eX;irJ?00+)fG{A}Bs7c}2;= z1V5hmVeZyAom}Y7T{v|6xsyTR*g7a#ff9>Yws(sQOGjt|woQ_!q^$l}`0ZIewn5@0 zsjaPT)CASK5CiRezFc#5*N20mr;K>&c_$$a>-eYZVzpuZ2Mtf@^JFDo9V~+RvPzXG zueLBqd@R+sbdG)An*!N&9?a9XI+8gLvm7B`qfsci_Z@fj2b{oX+^y=sObQxP{UP?1 z&cw1jEOcVX*$aabGmYZ-a8F?;c$OuE;@Zc@XLoF=uMe0vt;glK!7vEDR}$MQ8$C6~ z&%>h=iGR$I$!ATCDwkiZRi&q9Fca^+E0}N2hYX@h(2n4vxtPieTFaKo%5%wc$ydrg z!kLRBiwL~UP->PHP_vz90ekIY0D4bVP5#*&Lg|jk+ zr@pdc>S=a@20NB0MxGh}<#4&a1S5IZX{F7r0>h5tTBdL}YycC`Cu23$0)&V_#M4h7 z*m-?q@|)vBiO!V;9X75joC7jd|1F!sp> zM;4{J^~GzkxxTYjtP}*YD$|#;9}-Z=Q04n^XS$B~tgcbpnE0Sz>CtrYxg8{49&h$W zI4R()$qw~oIc5&Y8i@I*L6y@@4a{vwau;)DNf^_+n1x+L)(o~QO|>@5GiZ1<@qLMh zhxUQo8L!;WxsDRQ?~FUW+-MVz2(0rb!_Fant6i0ku3TJP`p?(f_t-^F4zCLOAoi@6 ze-&Xw@w=bKFG}CVN>KX>T`y0g{G^aNS|)W;xYC$6G@4%n&mEXXkO{$EjSd#AxA?Q` z1I}>mvPICKY3?4;^AKce4NQLn?ADP7NXLgIbO=(ASPKH4x$Ks{`KQYSE+icmaG+6Y zxap&y(Ng%xEKPawaihiW!p`RlA`#{UBLn`FUPyul5)NVpr~zLZ^PA*S=$!o_G!K%7 z6FMAr6DUdL`=UBLT&s4ii%yDNsCp%V>E#}>$%(a8tO~=$CWNvb(+>`-O^OccM4n6d zYc-F>fs(Fr*$2wX0;)F^$pY1>6KSFLb7H{w>X=}E6_t35ehvzsVC2?KitHTbrdyQ;2hFL6b>541O8*Y z6}gF=$~+xx>vn%w|K{e~$4Qb1U64THJ%uAZtT>uFMdnD5RE$o8X5T|zxluV<@kxPO ze<)(oFe$4PIxL+YRf0rds=#-{HrIqtQMbxZMOP$wlJmQ+2yIGe+K|JcOz?yqic@9o z8-fK;`c3)8D1X>4`pJ5W=IXT2bv4r%^l*&XA0w4?2WMzDOSu!BW$Vq}N#& z*+tRG&!WTmVlWZDZAyIDXurXBuDyZ{h%fstTG#E$OpBEMs%{eSI?JnW#K%1k zH3K>(7A0yLCL~>MrCuZ4MaNYvg5;O?Ro(xsYEnK3AEfumaiu}l3%~3s7ZlhLgHfTI z{luUw2L$+_sXSXs2IIM^j(mXsCu{+LG^{2muXeZU2LHhYT6oMAm;dQp1dRWGNlVN@ zxn4&^tz2KarE(-oIg%qqbjAOkpq)%<`I;?^2XFSDKt@3pz%;N2X#xv|jmYvQbG6da zIR7*<;{~2f1OJoDT$%PDdcF4<93%fM@jHT^(zS`ySl&^$jO2g1UfQ z5t@=f817Q(VmSSi@bCTYQ1~{!XZFh&Cl4!?{xrPS zx^E;(*7OS7}erjBB)+zz|2{nfBbwWxZB7jG$EVG=e)>v z;Z@qk=AA1J0;`7dz>L$c-r*g!(WzHiD%S#b8 zI|YRVQ&?Eo*xt@?oOqEMDHoTP7mcrvPvPNIHT9)vyo{jp?#Rm?HR7OtV%RSl8#ovA zq2$=o5gCI{XGtM!{bmQrASgs0hotxB>0rQfgIUOQm5@=DNLEimfk!|{$Z9!3K#K)y zY;3&N;`BL--(v{uCK56;qbn;JT+dcCBUR9%DX3(1+`%LUoZ_hThO&o;M{68deDE%} zc^8U2TpgINBo&s@IWgJ?A7OYwr{~Kk$)SZrm>o{nQ-kT@Kq5h}p7C*o`qY1uaF7L_ zT&YJs9Vc4Z$nkpw$}V1`r;l2@INp{g=CokQBxl>VvTA;XlhP2C6s!ol6|)Dr0U`CZ}Q0o25;Lrg?m3 z7O*rc5jl8?Ldyr9Zcf4~v};CfKwxktue=uwi@tSw8V$x|riW8`Y8*DKTwJMdzkf<< z?o39~_m%c4sp7z$P({-cYJ5AKZ|4T* z0WB4Nd&ZaZlZo`@S=4h$m@$5j^ARY)xi;^&*B5XTpY-iBip35eXod(weJtc9je9TU^L)X3u)1>6b zCt?Ov+-bnHI3v>4F$pkyV46P`zxXXEWiG8>s&-N!8OJ@;b{ABZq9D}FR8d8gxCnCHeOybq; z-g24_;_Cr$Dr0%6%M5>^#yCjWUq8|_1kEWxyY_L@Uo!h)$%{|qy#H=QYTU3@%fW-1 z{xkNSL$C13g30f`ZWI*b#3j?ubB=p4F4|-qWB>fAou{4~fEgn!7!%uZSs}fPW&fc> zD`}<0oe}TOVN;}PNO8+LC3Gs9;(ib(Ps)J>X`OR;srNIB)h>?CreL_Yb*qXc&Gvi& zGhZ_(F{DDiU5k7)k9Ol|0m{SIF<AAvg& z;&fvKbtXN3&&3*Uq4Zi`wg`JPAt-jOT275ciAu+0>U+T9W&z>tDKBkjSzKRFkA(Z? z;QO|lOjH{-kdl(vI$!^=ytQv`F4J$)Qsu8-f6a0M8P|Wfq?$oV#m|q=#8h2+yqzZt z@EeJ_8_vOJ?&YIK3fg@8fU4~QR7j>IGjn0dFCbhnR53B=E>@GsUcIJvU5OF@I{~=c zVc>qf;p}s%n(|npF4dA%K4rmeZ@%bV&(*m0_NQ>LHw@=Q>PI*yYYCw95wYjqd~>bcAl)@Ct7iC|j1GU>cGINXfaV4AU>>fFEel=^ zS6%;kQPkF)3xv<&YlOp2i3s601pm{nAZF>ip~yXGmaYCg7G-7e3_2qE)XbhGWvG6G zgveSumloaq7$42#7KC>953AL5Ebc1EI09(_`QX(XAA6_2#>SycUP3TKqH0x4II4Nn zSz)@IVNj`Vrpr@1bw+#gV!~A4ZnA3^7sZv-c$$cLV2ef}vNld(p+EZ?@Va2Q{cH^D zLUGa_^dV%;NkR!+xBR?ipA>;_a#ZUKl4!n-ar*j4K*wvLr?Us5W&R?ZYa>=B_IfyA zC(Y!-2!C|k)zxYfZQ1lmP^cu2rD^bICm%UEmB_y8v3{QArb8{qROFaKCXXj7BVVKF zbrm@efL^MYPs=g(R#6~#tS#|!D>euF1TCp4tijF-qS$_ax&4d2c(2IwK zg*E9^K>7|g0D!H>Hnnd$o6_vsJXI-Gx;pI};N0T*Kr;T_VU_>&OSnH(Lm)xwQ4AaL-)Qd*=DdX|59V8k-7kcg@uJd zf}3M_pXl+ifT#+30>Uf~`JS6n1_JnTnqt4EZ*)Hnx6d9^S!h@U41NsmwGtRIjB*C0 zWuyJMao(<&8D2K{e7ztmULURju`VaRx=6s;3V*OvXU6kwi-bx!8v-nOQM6fZ!AJS< z#_uszZ>g*(_u!=RMzXqETQd zTh!QP*Y86MONNc({iST%!2P!6zu{4R(dZtvm7;=Qi|M!L*9?-LOf+K$w#}zfBt{L56_+vBoH#j?+>3FdwZg=1H?agpyLm^W7IyyWpe}r97=a8Gk{y zL!&A5s90E`+?$@CIRymkY!{hu@PES8E$`F~_H#>Znx<~s{h8@^Rderaie@xmG*ZIA zNTbZF1kUvJCH|AjUx8HsYyu3|T`d|gPS$_-75uO0@q} zjdWie)oDQ+2TppXpxx8*Xts$?mh5hQwnTsS`3t4jsz=U2hTor}IsHoLa)^OGjf;sJ zK`tE!tZLqPSINhg8xfFdJN}ltwHYs+TP~}Ps=G1-7^PEOX$x*!&fw1?6x0`4UNG= z^vQW4q}ubz*EJOBU;``15qNm{`-g|2lc<%4e#}}<<(tFn?%`4f?}gr+Oc&W|+bz|8bUU6C zm6L;;8I)fgoJVAo6w=n#w%h2y-7qp@Vc`hw?(W7&0|P$^5s~keWF^G=!=!4|XpQ5Y zQI%-aN|u>ohUSD|3u+OV1hTDN5cur4PM5i!G`%9n)au$mI79{?jOPXRfDHeK8=8$Td4YQBbhO-N0JAQijU_Fwk6KD+Sh4q5J( zusG=+F92CR+`d?RzOH4LiWG~XFKaEe`wFwlLN8%BA0+uyDGev@wLLUEY_bMkm>BMj z9%*9VU~y>Vh_sH4m!-DrYuAU(@o|Lg>}39E(CyeSA;JgaLpAixr1E7_N^_Xw{3v0!Rd~WA z3=u!EV@VZzjpT}-VZ#+ZVylAv=F0W$FOkU%tWs0^@BTHE0A%+89(;Blg0 zV@Jhi@%>)<4bHue9y|3_Ihz+!lzaiF3YUJF!{-+in0twyo}D>8&e0mQyCdQ+IQBGE z>6I>)Oc0ta7%jfMb{hS53qtX?aUz^`Ah*k;kcm^wng z_*Bi|?#rUP-_WW3k~#xb%EddGU9ud|OmJt79J&XC~#CXKBuaiSG8 zRIYQqbu|EB?6aTO=aaEOI$jxzVhu{$fvM?9ocQF<(pIVIpzlJee}?r;N89xb5`2(_ zU%d#7eT8wL-+n;X2wiMl12=1#4X|IrVnyNGtr&E6Khr~VmNyW?cdp9kX#q$mXfa?D zLOt(xUU@ov@wKDa;}mVsSZsh+I`}Sm@1|B#I1fbEUnL_E!f$^80h#H49B+p?ApJV} zRgy*8#tfT!w5P_X#IvAM;Gm6J&Z*tM)ZyBfNP?=O0uv8|fP^&k%Y3Xb%=zwo{jMD| zzk`C#dWOmNcQ^A&n0tOl963V-f13wNfx2rWUn9~*8O>XDT)JgkR~;kXJX=p+_W{|` z(r1g}g~Rn4dYdKyW+&eAm-*w)^y_sEh5JMHYkM778SPxJi>~`GeZx3wt3>#d64ti^ zEOF9VT8dy0fN(V~JECIR*CeB`LZ7s|+d=ra} z@2D%T`8oC&_yqb&N7W_GC063c9F09`@)k;^v%gcLOFp6?64{1@aDCM!^vll7;v@fT zhdH?m`ffRmdrR`Ub|@``rTjTvlu3Hzpo=!af)@?E7gr8s*o`lTOUSI!vX&R~4{T&x zZ_8jP2zdYw)*(Fqst@5n27i8A7xB4-<)={u35wltGDDi!wcNiEV2{-riIuH!xMdmi z4m2LN+EU3zP~CNEJe`(xFMW{peDUH} zCJ7D1Fv?#pt~HLZPK9_!5tXL;!ur4P58JNnBQx^G$rRZOb;s9r{{6GvI%+Oy}98zOketQ3qe`^Wjxq^6@#>z9`6 zxd%?$eoQ|=flsYpaf$_Kt3{DJCEYlE&wQ84(Vll+ZKn!Cj2hcRTMHIJ`S{mhBp0}e zXt}LlaKRyuJgc#c5yp<>+<1?^C5e&-uBHi(j_%m}`LRD46CWQRTmba1u!|@TIAHE4 zWMdZPfu}=S9M3wei0C%$<`kdFtYHwDM%?`ZmzPzG-WLf}H(?KE-9v`0A0MC5{4C@M ze8-O_+0t@!Ouqxl^as3Cf(z8_q`|!)rR}o|p$*0iiK~t6O9vfTM~)qqS{+)4+WkXL z*o29`;E?@pkTODImDo2SQ?p5RfB)L8FRaR*Qyu_*L9k$-7d$=P#*COw2TNr8*U_93 zN~WXfgW;U_6`pZZKBmQ^cJcLDm?j!}MDFs}HNfh#?2D`boio|h zu*5d|un92!FW2|be-jW=YpCPoiZ;~uulG3nCOQUKBx30`wZKF2==TAE8%Sr|t^i&*>8va5n1hS#Xj7O^bjqSkTr)_Juk$ zEX?*_i5++{iAM_)Q?s5>P-*?97C9wKj>)HIpDcOwyOA2#45^ehf5N1+9Xj}g=M*c4 ziCr3JgT+nO``LtZd_G`&e#lTs!T~onU!lGC48}`!o|mS)#(LnqkWv1^n8)+W_Q})z zr>??bvwx$cr3G`{ADs@iu)WnLkR5NKAGx1DW-oM3t-auLR12sV(`(kXpx5h8V28-v zY}I9_3-0eR;r|F1==ln2`~f z@rNB`f?M8bu(~Sm*Uz8PjZbE`cC>#JlM=Vi&KU1x!BiQv|HO|V!*=(+sVNvGC8c}U zV~ya@&@bQ`tJfsRkjfRd-Dw_E=O37+m@ZLl&v_98BYUQ3KpV(roYZBW%|-IcJ}adYSya8>Jl z$E2gLyR#pIztrYN-`C$iRjO)cxA`uKw(EKQ{50JGa47_1vN&Oj{)4|JM~#*H+oU0t zsp4TsCfk7zJnpABU;!ol6@y+2N|>aVgha5yD$Q*(;EKwi%@eh(tPJR>kAj5-1+G$i zemEdVxMN{sW7`GQ2gBh#bgoeLj*Ntx{VM|9=gl4O4T5Tu0@fgn|M|1Mwe|h*(CWv= z*cwr%E19Z1wI)*<6dD(WyU^P+d^8a|l$Vzm4zCSHM@I)LK7LT}y(j6^f*B~8_8u&^ zS1nN@JOYqUb6A|}JoEVSJ%dxT-)7Vbq!1BsSU$wyai@NY&dolOjv)%F>3)C$!?>PK z@4Lc#cHe%5YUapAd!ymb_Pek1+%dz$(7r(oz}<3aYL5Vn6=R zo4v7Tt935JNFChgf|87UqJLJtVIWAQlOyuTbKE?gQH#@e5ult;lJ2nGk9XMSEq zaw)r)2nYzdT4hB`6}whfBSQkb{J-*4=n4;h>DKS3^SMQ$xE(}Q>NVBZrwy}ma$*KD zUl=qlzT6r6lkw8xc0OH;Iw+lge#(X7$DS~bU#tg=S+umYkufo0S%{6GV_gexat^^d z=@fV&wmN3a%+4l|-^yMESG8SEmhr=ecp_!N*i%W`+UeRGW^)sff(5{TTeBS$xD9V zxZVMajg7tg)v~~OkM15Yr0||@N8R4GTIhhhzPT}P63 zG$23bWF!Vo7`DmO?1M$raz2FMg8}@3q;(rFij8F|U*U*<(Jwxr*h;+jKi!b4>mdAC z#>&FwEao=3nP+xdw4DE~RPVkLB~72pF*Uz#bJdYt8YT}cPX>aE3f|MUZpRBLPB9p> zOJy$Dv~7BDs?8QRHsI1=sBBJKIcC#?i7fLDN=;&LWs96i@u1;2vresu);buS6LoB_;Z)&}RQ`)0?>1!a@e? zQw)&sWU+#}Gtw1_;;%rtX3`6nS_k!@d$DC9{6|CF`3lY9z7Y6bPF_CV-mx+Gp`jt2 z?pNamY}2LXW!cO-A6$OfMFZti4{)_CkLO>KHun=Ketv#%iSU>U`Gu3clknT43)1tm z#H&`-*UWw3VAMe8bwc3k&=AyE8gu_gr<}*zGx~w@`s)vG?GA)=Q7%RI%4lsnL!H!v zNA^+&d8gewBrjtV(x0U5eN?Y&0c^!j$oF|1W>)md_=q$Wesn5u3&{ajpsR8@{ z#YM$mJLbwG%KPqM=wqw@d#6cy;w9Ma*$kkAC#=-XQ~7_~qQY;_vO!9>Xd?r0B4(3` zzI5!gAbJ13wUoCn^N}Gs4SO8P<(9;OnV4?)E~#f>Xu3KN{+nMQvo^~$b=vF*&xgKR zIsZ#>UHz74WFpq2RJu%EYu<~Bk+TkV_`K1(Wn!ixxF_(*MV`C(0bR5zRIMzro{k*9 zL+~346f#lt_REUNNk+^$MTQ%gEgc<^-cG=d z>$kwcA29ble8>4p0cG~k5i-->dZL!86WcRne)V^fZnXXrt1g|v8Xq#Ysq=2N!((Mn z0KaaFhZB9OJ>U0v{aaFQYQm?c*C2nb*Py|QH%WIXHg|iYSpQeu0LZ9ja&dC1DDlNU zOvcmt?VM~6f`5RLh_K~V#^ltsWx`L*;LC4=?^F>Z+kY0rYUUw%@+ z%UgBtxUPS}%}M{4s-#GJZwIs85m6lWU(8B&n*o2nSFl_khkJm7&Pk~zo@PgAJp_Uf z(je%anArJRw@po&6uD9kQY@R4bZl^430fQ1{N*`*4GHj(lw!%PCq7S{#b#e%&?b~hB zG*)BVPGdBUZ95a&c4Mb$Y};wfc4FJMZ9lvH{_g*iSMwsDJ+o)_TI<4j9v9b2l#2dI z4?NdfU#zkbRa~~bsigzP*upQ<8si}ou9Y@>p}5CuH{~|+n+P+YcRj%@a`!&q{B?bG zz72#KZw><;9o75jY+3E`BEYHY8X}grS{&>B-f{00X06&Su-6zYpr>bJZDSsFeXqWc zgM*IqZR0o<^H&-&cEBMU-cB2^VSdi@NAbF;jx1y)dg$y9*g5Wv+(p*^!uu@T7;g+Lxc(_0)g0-J@%64im6) z&z8IY0Ghdf1IH1?hZ-q$d$TS2vrixO`);jMm3KvYz!e0V3n5*Ul7yKJ6#L_Q`0xbJ zh%Jp)k&(kjtS7ICpKi>e-%V{(=Gxf-(2jR8bkDv5v zM5bz5%S@fMxgAB=u_R@p1KL|Dhche;$6Es?&Ti($$GZe~X;bmi*V-XUY(^9YlK(3` zKIh(LeEXtDviT)GR8r~px3)D49_-%}ue_z44>_rh$bw%OwnQ&&x=q$Z=p&-XXQ(}r z+ktj?o^`7W6Fa-;$zr|z{`&jr5+zKaj%@Hs1SSP5)LW>eBR@nF@O^-TlWJ;h-Regn z1X|*dCc7rpwY8JS^ho@~iqxGcDJgh6J3#njXJ;oYFOOUsB#wZHD4IL}7Ay5NS;-qw z8Au1as*z9}iE-4bbbBh&I6$VhP-1<&W2jd~3MI<&RFZSmz5V^g{U{!}LG)-Qj8^5< z&t3c`g$3C^J)M(}4#5Kh*c>(?>lI&5YFzJRFBbGd-0MY|q%XQ|S3)*0s{#btwQ|B; zNxStH5wgCh0b0G!D{0C>);p!peD3c|y-CNb-SO2IRYk}H==M{2y8dV*nHVexpogwN zMU%3qU`C}jiWJlx&2Kq=61Ye?uRJC0V07QhSKTF&0r?%CB8tbrf)8lt>`xXEI2-pP zMiI)|mMi|-JrapPw1Ej8_kBU8Kbh~0YSXh`Qu#jI^pemVHE55@aTHOTS$vTPx^(<9 zS!S!_%q z7@|>G1{e|Y_3lUP)l7h2*e(TI8{~2hK06&Pq7Nm~ z_hj;UZlmGgggfqyO6Itq9I6Nl3lk9&6G+|Be+TLeZsd)vCWzI)esvuv6#+mGXBogr z@%Qs7p%p|o^Wvt43B5mX@R1jyO@|)*Ca%Z;f9+Rta$@8mk=?{?(IoK0Z@O1jQ3&yp z!J;hZ=K9(QXQ#l6i;IheQ6(0$ymZz^>d2g@h4oR+Uqvi`B$Ey9mXJ%o_*H%c18Iwf zP8|CqpHBM|v)7`b!_58E_x}r?6n2w`FcM_WMJRc=RO*?3uZyZWbg%*y#~g8bFY`%Q zDgTdn1+i555^16rF=Pa08Ib{W!u#fpGvO*Hw;m)qo{>V2A=_`cW|Y!;a&PZ*1p7=t z|4Fm1%z)#BmW9xV6$L5~UCj0W!iEL6lJ0`64nmS3-~dd04gW9v!78+BQ{KD;WDUVy z<@CcE|EaOymDqJ@>>rAW3723=&;BRNQeu}}(QM28Ngo;fCWWqwwiI-O-pi|%scLDz zw$y0*sH%QjX^i+royqwkz{Ztn`jeWrbXa&9I(m+--OY$x47_)bZA1n8fbNc>V6@)N zO!%?K)ci9IfyRIWG_>3--A-&AN=(_Gn$!Z`>1OOE4>oAY5tc4q^LVa-^Bbf&Iu+z; zntPqjph(Q;2tkm6qij#!i~l#Sdeo`zlUVgH;|P_BSURVz!ptHw%)L;qawK4pC@RXL9SHRkcAnnqo*1?HY+kkLFA}Bt)tyTzYAW+XXv}fm2=Ug zPe|#O&+T70aZF-3mel6*L-)82DO7bwdhXS5EEKyVzOunysp5I?>Gwf0c9=l9NJgg{P%|zTN=M+kk^B7ZNchf#lo* z|Lx8ry2;51E?OJLUp4^)>rIpg>tK&>VPHe8#z}{WLfReTR#o-V*v02c8;h0DKiFpM zD;+f@AEH>paraEJ+kTiS$w&iN2hOWe*@MGWZnfD2Lz4=#pKUyBR2$72KY{mXM@OSV z&o6>u_-W`Ccl_8AY$hfL;jZA*CdVt9pOcpz9Ed9I3M&hu!zIY}PwZ$er^N=g40Fa2 zU{R-NV3F}ohr+@6*^nbCv(QVq{lK{(_St-J6;TQKIrmKMplHWPhQMaoWTpr!5ZWBt z>Qn7-hcQa8tuWlI|1Z$u&w%JZt4% zPh&t*jp#(%{HYms2PAH2rV~z6qGm*bPIeSZ1TvoR%+r$9G}E(`XJ8ProKW z`{eZe`XcCc{-P#t+THbg8N*|cbNIpJYwzoQ0kVj3%Vr3t`z4u81ZFNqeG?_kMP3oU z`4Mrq9Og^ML^DlKB*92La=j$AZfA?Z64Y3RkCQnoqb3s02h})TG^c2b*of$KSB8g1 z`JqD+>wucJ9CLH^g^;-f1pAlNBh`rxxK&Df-~O@kv^P)tw@f~_%*7Y8sx(>Iio7R3 z^&-n4aa6{rkXujR43m`GlJ>9M9QgJ&i_Y#@wE8wS!5ph@5Te|f95 zZ0qQ5&HKJd&hKaVP*{aEN_u>N_p7;sjx?jKFE1-wme*Dn>HS%nhL5s1zYOffaE{q{#U$dVbpm}{g( zL2>-t+HeLwftTVmx(AKywl|$%LN>OrRUZ`bD-;Q7kp*i1uH{$V>V6#~|ia;&Z?j z6e5x09Kz~p!liHk4Q`UGuAk}EZj+}QiVI$Q^v58ER8|{!2>VtiMTe!vi1TaOTf~by%>tQ7RywVi#r&K~HzbQTKVD$`5|G_zboLndK)#-5%gv|R}vuFNLQzS>rvJKs@S z|4bfOdU$dENIn5Ky|jc|<0?zqSAbHQMzP+xq2&P(O8y<%9%+&?AI`UH7oGKR-gSB3Vdga7SPh0Pq1;oY&EN@;n?L{z+?gT zDM9M@Ee=EbQ*C$)Wk`%sZNIoZ5dn&kPi!MwHAb(J_vyURSjzstbU7#5Hiep_)Ry4?_A{6W&qx z+4+S|AAl00u(5fB7+|1Zx2lZ5UD{iBNc_@ZtsPWIpGtgvDNwFn3sWSg)73stR(HCH z(!$J9ZFT{R$M5sbzBtn2wnY8;31_*(5!S*JDP5xjtyK=MYs3u_XRZ|1*o4kSH%25& z)!FW1+MU&bO|+>J%7Qb6q{o+^fmSCQH6ODIn6`W6Ys^DLQs~|bYwfV5 z!Pu>F=xuvc>%s1(3`SUiRL_N6#-D;Cl;V|Qc6cd;*PJtug(R%@%JMc#kJhUjC!=;@ zVtefU>;8tII)$b(yNGtnhekukz;}>z-2%aEHKI3?!NoL%d_L~Ezm(X%I3c5=kXZ#) zQ)=OP%Fa`kbBY^(krohS$P$<#s1lS*3A{3$Vm{oGV*+h6VeJU1hy9nmH*GSTv2Z9DqDIxCX{jIy^UF5gh=P#T*81Vj{_U!;bSeu%SIhM8?=r39*4=Ji+~yw?5i5o4gwd{Vu9g)` zQ0AELlHR%~;}VJEI`(p~_qiR&Qn`=x6XeiV-`rRVrPBfj5BBW1I3+yNFA*z(1xF*S z(ZY(??DIMM#wI4Xk@wC5H#Xn%U*oXpJ~K!M{Bk2K>RAmM{6&5&Eq?pOn3#tgUZSCX z!-N7>WAknTT!Xlp#tNC$IfvNVfES?YMZi=Mtgr)mFCmHEq30^EU$Xmlh&lOwr)cxelB_iOC<2NGlc&dV%5~aEI`ta+ z!`<1pa(P{14GK5cd$D5cOh3<((PSof8qwR)qa2FMN01w<6(gLBvR~QKowGK7HG*Wq zhbKfGu`w6t9UT8mQezuf)f3(*n5mB5ZHcMziKS2B>%y#VmQ)@M#o_g7F)+NZ2F699M(+sP35b25dba7F6WqO=uxS&rPG_ zlL}<~wD-vxzZb$guDO|}>P3SGu^=cA|Ma@^Z|phu{U}r3dR%~WySXs|5TD?%5ns^S z0(_m#6rRZ;r-pyUY<|-Hga?xDt;D?D;~&C`@^~t`lpA^)SG*vGo8#C7G=#PBch7uJ z9M8=LP^IqkL=>zTH+&g8^tngUk?;cR3+>4_OSboOeVD2ylE=w+q_TxAIWiHw<6&|E z-<$D|@iQ(F!ELPhB5MNGmX@6IFWJBQTWKPD0^)F-F~1kx4VaqTbfi@`)Ck7h^=&Qp zYTSb+Fv!TrNqU#z3v;W<2w3J9TZk!`;Y4?X+9suC*3AqVIwn(~!=2Ht+)>;;a*E`tJ=4L*J_+Yn_t?!&2CKx_i9gqhLu-aD(LA^4E z=(lm;cxZI57^?uap;`BcM~`az{3a!4OB+ahV)mROsJ%fK5|OCTanEY|hJ-tiBj~+Q=>Owx+5K7j)2SgUxUGt z<(Np)&ZaymW8*Ctx+hkF8f!8=(GfW;CN4`U%1%~4?v~{Cv3YW1ojGN-Tm6lG6&71O ztQS=cMh4cT;6|Emwew6LOJk#v~n|xSbu)JnxS9 z11fG8C|Fo-odV!tZ2qCo&{ss$#fR0^0XTVX{YQ{8 zd)zjMt8`8+MV?jjW53$O5nBAV4{f*EQc)O*>ve>rAD=Dvmsj5>gauu{8pGvaY1DDThm)#uPpatmU5eWN8QT&C7Zw*6ZOX0dHi;$s1lK z`$4thOnZWXg9%P=W+7;?a7v{O8-1#l8}q>O{%^}81K&ybu){Wk#Q4Dq3KPW!Noq4W zJHxB>X6(meb(hHeiv|mIKXI2Uw3)oXz_By%@%mr^hahvt?seN8yDu&?(N9vv0$l7N zB>imk`Rk)T?;~rq;J0d=c3gKN?tPrv?hB{x2o1R^It19{@Ccm7QGBr^4Cgmg)zq^9 z8DqvK_vt_PF_eaz-AEG^-@hn2&@mr&jZG}D<85g4+KD$u_$9*^qiZxd9T6P5bN-&x z(DS1FncW}S^>CD`df||?8Iwbe!(Ftc`7M&O?gKO6YgSkxz+b~6<^wP^@P4gg))#!u zek*F1nk;)gAr`v%*Z!Dqk=?Fi#QTW;KUs1HWxCuuvD`d3yLzbL6)sY8mocL)C)}g5 zCzWisY}9M}lcF6t{1tizKA2bk*^l8DLS0#ELd6M(8}umNQ4hu-i4;!B2;PDjHB%M2 z(jxciW6*9R|H_O0VJsuaeMFOmi;+$QN`*IVeYEBmQNd3z*U48Ul7xP4vt{yl;yb5#5`oWP4W<(MBN6<3#YvR0Ynrw(=^EWJ{>m$vxG)16 zdi0$j;FQPa#{Ue8V;bId=cN2XN$>a8hTj{_>}hX(Zw5fOhKGldk?q9LIIk6Y+VvqI z^Z{{0bz@^lf$@RX=U0-*kJ1W1<}Mw_#sJMpw)=hf9surU>Ft_005J}YX7I=tIG`to zADOS__MjpSR)p@urqLW*g31EvKZ{=cc(ATHHK60r*4;O%WEbPv=~@v@a2?)R2;iBh z_U4#R4Q(4_wbH3WhLXz==;}DjON}5c)#@>vd9?1YSjM~E#VFo8cvoM79eunQ_=`9N zi+>j%%cu`Dkz2s&%>J&uFG`p#Ce^OLEh^!tftd9Vma_#ni3liA(?$@D=2vWTPRt_P zu>F%J$xquXaL2FjSog2$^C?)rdnex=sh#)_QcqmFhJ{FtVY~+&8*HS-}kB3be6Ql6P!}Zp6g-s>e zc(D$Wo3*;96rI+7GoG+5jUzBlimj>i6x5SS4;?uxHZ@zJAjPQ6pob7Cm=`RgAmin& zTD1gE8k1OT1PWVRWq?KvVto|z~XkU0jT%ddTv*$bAW@=HB9l`4GpMn{s` z*CWDLg(~Ztrw9-tEOdAleJLu9+!B(3X?ra$+&RCfL8>U$?9r|j4u zGSWK|>){MFYt0k-WsfmWVT|D1p-$MqgTX?@IXJU}8HcqzJi`*RYwwue$<6bl1-E9N z#mL}%jRU$(VQQX+3Y2n*3Y-9@P_`sYcV(C9c=?&#v@>(hLWO0Gb0<>dQAhCMAnv%m z*#|jHDKbh*QgU)gK#n+eBg{ugm>i1^sJfK9e0noIeMMj$Xz@i zfCooEy)T*FUoGcOp!t!U4$D~OVRmZcFEXUMW$}|ab;e0d#g>uPX8GNo%W&Un*Pg!o z0P1Npg}9VjUMZCk)tB6Ai&w?;CMSrh4nDL-@7rwAA_BYdI#nrIY0-pKHW0`hNrwls zu0lryPmcJjFQmn+gOH*ki$(YrJL=ed^h3nD6dosDa~i6dzj2X*FvFyx)IjPyjlxe~zXMuG{0 zDOP9)3M{rUwjHmUptu zJLkXG=LM|1-%~R)i?s`2UtgaX7rZ3_$@qkN=r+J#CrIcCVH2=wbs4enVlij&{{T_r zvZA?dw3l7T*}G0GRPAztQyfnNs0_tmXOJjm>1q`QBKqk;QGq-CwT1&1^6u+KixSB& zwBqiK7;E+Bm>z8lPdPM4l(H^pyQ93}HF^l&xY)oxepexLxuR)}Aj9itcNhuv$)N;y zu6{{qp`Sqhk2kI|Zn%DPEPMM}N=#teig1WzG|yTRMh|r zZP$irYNY3t&G&ah7nZ`e`pI%{UIUxc->=AO@TWk{R1r3is;zSi`raPw(E|xf_W;tpn zqac-WPj_8&DFNt76rgV}gf%;}Z#g@w&J+um=Bn3s^0tp(8LDgy(El>~4=W>Hu_t2c|F3 zjFf&l{xY1&2glByFfLQh?{ZC5US19mZxP(wJ%=!ghLY$-wl-wOM`~JkLy?458N&y7 z>o?FW!W4G_wy=Vh)tWqBS~8{ZDPY0KH@(>&K&=%P(AoacRIXK($tlaqpxs0j^L7=9 zt={f|?s2;h!{g~`@6B&;31GPHWuNy+sr6^eb?NWCZ-=oD7VF z`mc7JCP5@@+q@X%{IELs5Ot>ug!C4BJ<9wHv2!l^S2CoL1mg&zEFI?;VJ-ETH3^G( znMxCnTgFA4_9=vi;i0qmNFGddvAXqNJUDarYTGRCz}?0rE5<7{xQ3-g%qC>GTQj|I zpkmW-1(`kYWIuuJ^c#AFBk%ZF&pTTTQo5@v)lQ%Jzqr|CNj-kOa;;VjfUL{r@Babx z4@iVDv5mAMib071{m*{)zgU6!7GqjKg+cdZsf01R5I-K*^^J}1-1SHL z8uyCYC@v4Xidbjs%- zXaF$KxJ*H`UMZcIJQ3-Y;hP2xvM@3ugCuv(_5$$k(`- zVJ`ch$a3sEL-PL&^tHz~a$Vy$8(1A18|Ez(qH$E^ljk*}`vYiNyJxAiQglijpUFW- ziS+yA-PrD=VLL;KIe@^K<<|bHP^QV{1?Lc!c((KH9T^$f`rVpOPxS`r`sQ&Y08HCl zafKo!A;A-i#_P!z2rw!i3^^b)$axUNGR4iS63{yyU-_;K5~?UB?WBT%!t^7;ARn{5{2Wzu_PA_TZ;%axa zXWo9x?g9*XeXyj~fc5rN)oDbxFb=HReLnlmz{n{wq_UVXkbTCDQ9uDEdQdezxDYyz zDR8pk)`xMA?>YVE3Ig)Ge|&)^FE1TD!2CjYB=<7=r|Sdf1s9phC|7MzClw3Gt)c%x z>QPPnNNcELg{ujP&kL~S+kSNMp8~83bqOXk4BE(GAEQh>${>ZKb4PGISTZ7F5pr*8 zbVzlxM*-u16LyRU`={G=&2vIOp$5DK`_MZM?_5dqfJDjhPBRSXOXNgKON|G!TEVL* zqDTwoAY+uoZZ!=(KE?kGtx7KN*G~F2#af30tXb8=V{qgQB@w9@V95_RJ<|$UVZ&d+ zm9T~cS#F>;*fL7145mZY_VPN_hF-tr_y2RZ(tKcyZz2roc0o{;yj?~ zn9V$W(1Y6#vnSgQ}>C`A#HG?BvO@b<{Dc^B> zEcLJ9A`^ZZ7e1(~-EQ-zo7B7ssOJy3_E;F26s1X6y`g$iP|%^8X%PxWnjWo6Vgp8R z+vht<3Mp#|Ibc>iU@Y&fu7%eB=kk^8gQI4^gvF&Sr&3o>LXi3T|ns)gF!2bqt3s4G3cz;)f zd!BUhw;_)d-EAh06hxC;Z07r?A3#sTRMh^Q5o8VmX*d)sjHrQ&QJoGOis~}5mEPhZ z033{%GQwz=rpk$#)rhBOlAh!sUN z%5@O7?;qDsx@RZoMw=U!G^ZO}>sCB<)ecUD$vZr%g_a7p*I_)auHFR`i2d(rt)Z^p zV`1lka}2QItJUahwVBy4H!0BY-~}S0jm<+?At50d$qQigQI3TQ(mw7X+|4uiaIY`8 zS1F6)*q&RUDAt_S+M3zC%&c7fm&Z06*L$=@B3!Lnd8q z0UJo&wDQPg-a?Hbl%mLMZXkJBlAqtZk;w?aJ>Z(7h|ULZ*i;Pz@DP_M%j>{D1Gm*d ztjnZfQ}MqzX?xFm{)#&m_BksB&V>b}=;KRZfDRy< zo2BE^V40k%u|3oMd;Pz>H9rPuXRohPSW*60jn$LUl|nNs?SVQN>~hH!|AXQ@$G2$m z0+WMcV`Gao>q{wiK)?tceM3VC$E#e(UAd_u!^!OdCgy=FkJvp2!0oC2cGd}aTYm$h zxxdisyH#I8Aav=ntZM(n&(Dv??FFq=DBW|YQuY^=1GrKmJ(>~6-yaAlyYuz;z+9fe9VJS+ z&Hh-@>=@JEzrSzlHW}=MqyO!MC@LwQ?`8Q8KK#{;0e|N=H$6Z+5X%sF1yF6|8*TW! zm;gR(#Uqr$g@U+MQs7I~v2VHTxG&1Az>K^e^NR{HuF32N>>N2NN3(*`J8TU(rM8+Kb{iiw8!Up}LwpM76${EPqwXOHqtN7V zJ}lyNd}J-RE@yU_rurBXNJPn_1^p`^`F6onkk_UA!O?Ug*H|h!HFePYX|;pC@y%$` zs0mI1aJX7iv-U;eNBGWF2mvUX34o!io~*UrePLK^qy$rAU!!;o%+DHlMmuwVUFHH9 zVv5k~H}{uiRpXU9Ja{}FXn=~X58ykJj)i9|`b ztyVUz$k~W7CvET?h}^2@^+3)Iqku!-%?vXpM&76S9Lyq#$-%S>LZDvsUZChGQZIm$^}UO1K!@; z&NRSWAV9d+4V`0UY)!w1pOKD?gF~}d*0SerGM35pH;0o%F(dxy=;hVc2G!CcXc9Ic zi5HRh^6Yg1j91!7tLpSue9#No+IH7&GmAz0L+19YyS)_`*>BPLu>Zzsl#JnMy28^p zYhz<$Qb}S?a5F8if`sF)LwzJBqoQINDvb7Xx#kC_4@@)GG(Nu0iN_yx3Y47SO+dic zkp-J4JKhJqB|H8vkfMe${+x7hV9x1zEF7z(D7Xpn;mDqul_@?G@Hy;C5vw-J>abeQ z;_=JA!DRVfkmImhkd-OM#l;o$w>do2nhfz4Yd%-_yqr(;5e^-i>JazVF=vf3j5fKP zl%{uz>rN$BY`4wA?H+mJ0`r#ut{d3x+6#& zqtxMt^#CiCNE&)Bep-1NUGTCy4AsF~QSm1{bCcJ@Pqcw;1?Mtt>?DRA`Z!F*3e^Fc z*Y14blwI0DIvq<;H_XzK3u7uaYnMmHjr>tkB`mKm9+nEkA<28S3!R6JNz6T86z+ofZQ!tI- zLB-SlObF?Ir8^BEwY9{EGf_7IWx&8^=@jmp6dhV;f1hvjl;G#U2?z5Ma;ui=xj;T7 z{89dyPke*Y%WbC-RtY$}?3L%&c3$F&rXs80#VanXSBox|0c&Gb*i#YXT+x}3yBDJ7 zrX$SoQnoUIs(2_xlY-6O73k@kN*F$!MfI?Cp1XC;_D|P4EdPQNd`TU8Sw_3?3(x6m z63pe{wjQ|&ImU8c$s>%^%<=6H~1+e1J29z?^ew#&5lV>nyviS#g8pjOuj&%lu!s3 zg`>wQT|$Qaj`6X%(EFXs-xL8-H#P*gV-+{E#MZ8GiwsuFCistXN5uMq-e)R z2baio0UZ_^5R``x-&14YZv#Hl#hOg$EjBXuuj{s3Zo~IW&UaEz+b7~>$NqEYuYan~ zcx&q~iSY;xA1>;lP4vN^G~00For(jMY!-Kbl{cLF0vC9A9GTrEA-gOtf=8{2l#}EG zEGe#f%04OkH9;*J_W2dUx58*HtKm0GqXO}W0KK{&ML9|G1-eSfxTSVC!;sT9vmctx z6`I_S5J|Qa^=)lwyKP_v^Wu;{yFp!)G&4;M{W$vKG%O!>TQb;tV#$Gwlkm+gd^?RNPx$Rzji&~{Q?-FzH%RtW&6FT=F_{*BSj zn}zVZL@QqCn8TUuEWBX+kjii5-N!8jLny}b=rbAgH8u~Qp$lNeaN*phuLBc66t`9j z5!%G%ayFWgOgdt2Dz3emGg8P2i4nLVs-V6DJ2%C}MRf5I_i@@1Lv@%JUF$FeTtuPR zD!@C69el{vuAk}w2S^x6NGXuv)NBNdV@l7LI^oM)SHDFaGR!x+kpKMUXzy@kK$fih zJ;EI)v5M=X$N_%I->6m!K4J(qJffO0C?P%=d<(b45NSZ?KI|+AHIvrnAJdB@)E!2z zezK)yG*fR`QCMtX{yr%c0hI25#Kamx@=9Uz7}S;5z;mk285~^I_K6nm3!roo(369z zRI%s+gO$Y}->O|I!h%)G^>?%(oMn_y3TA_HIy#Pj@H46^{=g0zVs0?g>ccKn9o?TC zgrT(Q0Ysbovjr%_BB_neh+w#j(?wOw;6;x{J9buqI1=_R<6W6IM|RJOM7aT71zAgZ z3R?5(i@#fKRGQc=VBlyen^N*g>FGb4o|fwWzzGbE$IA~~7L~O**m467pyZ^a5MUI} z-Ioqmq+gY{HXH|NV33pZsJjL}4o0p`63bbfWN`O^P6 z&tqD2x`K4xYYMMx2@5n3D;!BUP0%ukMwilvA+$;e$EU(B=q;x|CqllcCiBhTQ_tzV zA2)&K;uO*fq3(BRW&ICydx)#sK*P<}n~OVemzyuRm1$hXU~kgh?BUe2sllAtqLT|p zw%7drX^#zy?Lvl5#{oL8uM46=>`PzQ5^I$O zFYO`w?g=!wo0%^s4(B_6Qe_Ye92UnW!tjb64q>D>6t;lr`I-Cr%535MwrS`@)pYP# zO+u699fijnd*AKDmvN(YeJiaF!n4RjBvK2N{5;ygs*5j&9Djw`C87I9rlx#E46O&Q zeatI{06s;chTfIdquA3d5vagtAYd6Vp+SZ?)hTP~JDpN_g;nV@l#>W}=kF%gzL!bq zHdZA|tm2D#M4%<5=0?^qaURdhfi$7ljk!HpBE3EY2`9UD_cw^%n@@nQ_g63uVmsv3 z*#**QxSO!DU?bwyKhoe$R24vAytHBh_6Jc>Rqi(Y$Qs)2OJaL2!$(2Z(^cGE4TYv8 z>uA>}r|uI7+6_~6+zd?*{gY!~W{XSC!1R^CIOb@x{lZ@NPGxxPc_>qM2CCR5GCA}4 z8}IwhnIxvGA?AD69nER;)ladF(In!XkiqrTqS}ZrSTKUax~d*InQ;s(=q_e6o1nxRICs*F;UH=o0|wKk;pXV z;NU@RmSnp|fX`7q`Ylh`KcE6TLHn_aB1^O2n~5r-H8g4IBu0oTO>JyOUSM?Q*GPox z?yqL=-tomIX{MFwmq&L!?@%(iiQDdnJI>e?eSR7l9Q~eC!yM1myxEE3beWO%Jr)LD zSX4xo-3cMGy8-!1W1N|(W6gNt#Sm*}g+p_6cr-y*OvNTqJIR%AGyU56+eWIgPNnkp zw*o_=yR5VfNIoIM{cuwnA-uG4g0#O?2T94;O$V(@le!V>yuV+^`@{gd@pJj+FsaS* zKU@#ZY(v)J2M23;9l1V1(Is9Mo0sNs=+xai5|IRRNP=ts42y6ujfZaU%`%tZJ%73w zNL`AuDzlc4gD-=6`%y?m+XnwJCfsvC=$9Y9sjNkzN9lrP$7!*+TL6i{G~GXIKm^SH zKeL%Cu1R`O(a`l9yJGE(_{cz-+_3V1=m%E9gx;6U{~RoBk?|7Rt1`+4{S9b=WV9%W zxj(ObU?izo&0n>JD=8@d)eGRSST2T3du-P_qP8ey`>APZtCr#@VWQOVk&&}C4E~;Ck)xIJEo&}6gB1%?{kpWLk}=x1j;7~UMt00WO}4Ns5e zY|Rw^1;@ak7=e`Tf`|lyLxDrQ`{%dZA7@PX?yfO$lDJf+a$AG*%QWlmk zC}?P8AJ?79C@3W5wg4!q{bn}|khu<63knJ%qo7bvfx%tII08%ZIPTxfTiafie*>H$ zyS-6-fYYoRDusSHQ$~9gH_z+13(uh2LMB2lqgJUM`y?(Sli>c}tt3w>70OP>P#hQ( zNRUU4hKD#;ey~;})1Uih*|dPO&cg?FJtE$1soK-0Gn&eW3(QF*P?jW5q|@+M$P?RY zJ?rS}Ba{gY2!OzdsAI_B>6!%GE=deMfDHY7PtP~UJg!iXY!>wh({Q>!R?#mtCFM`M zg$giqwG)fqhqvQlSIdj+*3i&8DuGtb;J4pa5FDFSNpD_?lT?e(eIP7WQjo}LV`R{|3LBau zBxdk^wr}BViAIA21dD#(kzD~VQdhp*S5ZZS&+ImoTse`MrOSRCa=?@`qjz;FQ22|S0>C8Uj>iq%bCta4J?t1Zq-R;DoC-roPY zo!aJqpwjcwp^a$O#Sg(I;PmRP`PW9`zdTQ`yw`K8ouk`P0FcM^oU!TUco&_=I*2J+ z$%f&`{@W#Fpl?7{-v8$D$hupjIEo55pA_YHcXuUY#f?l%a(`NrC#R&s2&k*6y8AvJ zC}ZJbudK;|_74vJ6e^OZblPwA3J&}D1Jm9NfbrW+UOTV=u()90e^#ZL<#Mmha&@ni6m3K>QGs%96*$k;-W$Yyg8uj>ID=H z_UG#Y+q*_X!Tb^f1M}^k96*~MmfzP`BWfkz9QAmyU8+}2QB&Y7Ar?7JEQUZN8o4lV zxiJAfnvnmy|c<3Wrzpfht%1YwLwX6<4{KL6Qm_=67uXuL`GsRmwpPDIa&a}QuoL3&CHq!lYHxMSU zl_3yJh)PpC%NBj%7DsG{`oe*fe2}C^eEM~hlajsa_l&Y-B=#daJlyr|j|_~6AMl25 z+}kru{X0%I$H|S)@3`!f--aCEv)Cbf@vMIXbhl*%_4=kiNsZfHdbV&)|6$(RbjCiD zrY#bQl?1msukt*6`-amoj~SpHTe$NN;wQzW9I=Fbm|cSWGojnpLEU4YMxR=jjKZMf zyA6B#HKC43Je+v+QqS_*+5xFP(7-Z6RasY5$G5wF;FgX1D_hm|!# zrKP)jx}JVmZN5`e<1m8E`eXZxgP4ID#+C7LJxRmSj)x9oU|>Kzx+6pdH-?BM%`08yzlHf`tv5+7EtY=%S z$GKnN@>SWGV~1Ml%pp@qXSR4fPF3M~#|N`axH02NeCbE?FVghs7b|K)0*GC$MeGJk z4@6D%1c*=FdC<@j{<>eQ3KetwqBA?LRX@WL*IvWJi!dv^52D&R2zO@b)QrLlf(`!k z=Dbs&N*zl(2@j8O>d9c7`nMmgcu-j$U#zk@pSw*n8scG#OzH841I>*Tq$&2Cyp4Vd z%fKJ1sonVDaWkDT1Xzk)Lqk%3DSut@nB+IwvR2j+e)m?#w?jvWKiiU?L|ddl%?F~e zUsq7+r-nuxAIgjO!9PpX_cfdI+NDTrdQHP^4Kbp1I)WHOCUY-Si9~?rX6b^{RDS9p{%Z>=)%GY^Pt0E65k5W%_#gu3HVSKh#8ibwI zY_SSq&B716g`)ChX#L8Ezo)+;4KCAB1+MeDUo(9;U7a#A8BA-iUdnYjS^U?qDr}>w z6p*uqB89g#Ku`>p(TQR{5`KR9#HYEh((0&=eyvMDk^~2!&GHJP$*v|O=21ZHL0oW# zgGt_C!Jw1Rvr_YMg4D;k)uLedKozn&@3_QZ2h5}xA`+4hKh7QEj(x$eD2ddO#dOCFOkY6g zkpHW<8c~%r(NU9sPLl2+m7QM$`(P%LloRQ}Jqf6bY?y})jsHN_ZuJoHf}1bs1>Urc zu2`Y#7lp;lAa1e$BSXXED&_%~@sZwr zI9;fzY*Eg-o2aWNTZu>-(tmkFAuUg=CIg9psE%8zQ^A?8>i^dR8s=vD7CL}R4g0LU z0PV;Zc@dX}GFnIj?0B`@PXOaAp@p#v;^~ewq1D$N8Va-qO*=}PLK?}NE~1k0x9|q6 zawy+2KwJa2e<-7c_NEwpLCjsck2=j$mauZNz$ z_}mZ*O1lj(q;%FRDG4d*4ttht1}xCL8Cgt1bp-Ll(T;jb;FtMQOB4S`l-re%2Zl@S ziJ!ThvK(x`DD8 zt@=+5)>y1&$aop)MtG~GzOUayLZC)7`633C3iW|d+0MyHa0r7w8|}$$;fa=PVqSaR z81(<~^wn`uykFajAl=;4et+-#j~{i} znb~FLzRx*ViHmGFN7n{Gax{2${+Zp;F`1qNz9?j=aY-?Kw^&8HG;tJ@Y{6pDs{0?b z%Yu-|*ks>*jyK;m=^Yu>D=w+md$_ikDd&97Vwd!y4@DwIu(!7dY9!;Hz`L-R z2uPmD3Aq3{QI&QR$W0*zEzNm*TwF5tw!5bX{lxz?;L?Z9(>PM~il-5c8G+x3lFc?) z(B7dDi1tS6Rnr}!WajC8_q^ymwv)nHFn2X^uhiWsJ5lfv2 z6Z{+Jy4|&M^#4Cf7^zq)__@jSn>Pp`Q2(M7>HD_F0{@h8hqy*?F+4qjm64x(T4?Pq z{C`V_sw1uH2-UuXH|9H@G&~^=Wj@4VbJQzOUU^N&xYI{nJon0fzJzj~$~)_%>ASgV z061!#R9ldTvtu62iGJPQo%1hRrK~0Cm-8<*B!*ylTy5sjPD>nYz`ABwe=qp&O^!y6cL|^VAS2^8sc1U- zkR4GQjbUJ-?B;6J+r|KkL7%q%%W=4e^yc}Wi&=WV4Ndn zCjIfh9+woj1~CtW%-6gNd%0uHf45~?J!IpY%D9|`(5SyoVP4)yj->pEBe);%a;C$e z6AKCcB)!@AZ~IgY?BA9R$*v_0#-8Iuca;_smFz?!uJ{S72dSqTuCrOds9f-9AEzIU zLG2sed^Ww_Hj{iXI%_KwU-=ze%CaT(HZ2Os5Lt04)+cK4WD@?Z!O)h~zwCG~L@nuAKg_`MoS(`lQ-te%xUKG@HfGz1^LR z5z9Bpz5MZUqEO>d_Q<}7A@{}hX+`REaVa^)|62Pr^Uzn%MS+WiPn+RC;Ff4AX=rxN zQvj-lORf`sFu_I9w{PUUyjqDW0x>Z$0O-x6YJKLNI{N9a621bL`Z)Kvj5#EDb4*`9PA5x6ctl%Fx#0Yha7S#s0!U5+p@*Xvo|phOFd zbUN6spT85YL?2SHuizf4+x*7#7e z7sR9Z85MLsDY2(+55`&fe73XZuJl_5)w0Y|iGHfqdKkW)%Lh*)iYWRZ-Q4jb2k`>! zS#9MCL9cj*{H?N>iQuw|elkgbp7|FRmpwQn!f`?`y61@3jZP8Q@1ngZ?&ciV$O{q? z*q-`=nZk4=-rqg{z9#1OP45F&|Dr2@{^Z15r6(FaKR4dN!KblqqHp&LEbbMdZf@vl z-1g{?1qo=F7)Uj3pNpxLSG$!48WvkxMQgsY&rA-Xd<$tCpJ4ym7%s#%0~Y&Y)<*%d zL}stkHwo^@B!*C^z7>^KtK&|#oc-t}#b~m08O*b#-DWX5gT%G-i2Z8ypTqRH;~8#A zeZ*Oq=xfmo5IAd#W?6pA@6+pi zy+pRPU-ug&H3fqJ5&*qV7A0k6WfAS|WB(N~&OzGJ1E^NvET#c&19z?DHc7zE)2**B z(3m#7OlhO_13tCdpg;L5^rim~W}Bnzd<5PY(GsTK`7#u_k;=7wlfbP88(jf+D2?Nf z>)FpW5wJp7FLo<2*4%{?cYpOu)muMa8Z#T+^kBlp42!!q%Sfqb6of=3kB8!iDJb_Y z^Yv+KMsxOCf{U{HQP zqra2!;;WH^Jc?JNck$1!)q_jQHJTSx$2_Al;2ul%QPSX#Z#%jfC5;P8dZ=GTou>YV2k9#1!2)GE{gdny!*`OYvf7RIgmeha*zkDWJ!bDXPR+ILixLItzjZtQ z)z4^TBrrcfq%LRRnwSspazBHM4eJIxYtK&FTwi4|X3ysp%Xa$-{dnwdNS(LmviR2c zq`1`L`!!u7!5WOrk5@OVK=xy*nf=Jr*8w7T9Ce~4a5na9mH*EV2q$&g0SHBNtgFjN zf(?&}fsDP}2m|ygph82_($d1aJpR!FpzK1KT=HC#z&RKI>-{LeOiKPWOini>B&5JO zm8rI&ArSbea^^WGI1oP^^{g8eGQe2y^3_ZkDAHJfZ&O}QZoK5A;`ZpfC6D`YC02AO z3dwXO7%N!<^tH)m0bzgN^NGUDq{w)(NV;@G9|jm+0eRA#uQsvJu&}_~N^XY?)eLx& zYAvTEv|LHBv8krgOMZSbLJr3M32(IYzd{X5BAwt837-ub2p0Squ}xp=)bFIJrPBjU zQh;<*Ng%39d8UJ|$$m9N9b~A&c?&SS&X(-EAb=61@BL*DD;dk~$lW{pt3&Edu8t1t z;Sj;s8j+2ijTP{KSUWtd;3c?dU_p~u8Quu-E=n7=4>m>opWCridK>u{eO)PmYc#h{ znvNql5_))o@cQ%BVXt4p4pp99j_gi9xIN{CdIWGn9KlMV{I7WbC=9sbkpvE4kupZz zH!;LmLZre{+Psfuo(fImR|fuu_77=Y9^ibC)v>Sd?tb)83NP& zB$2Y;lmdfiuv3^SX-dI&wno*Ep+vyZ+Wt=)Jdnr*6o=L-|E{86qDq~NmKFWqR8%G( z>TnFDyDDw6xtIm5{5tJ{fCw=n>Yr2 zWlpUH&@|Mg1BD@mx_-OG#yOzO3X6;c?6XFK@BmJec^V=w@c1DEtViDtMwZGtPKEd8 zgQf*lKWLj)Wcr0u5$(;-d^O0Jeh7SPDN-0~B+g}L7D9BvH7ws(!w=QM(wo++rS-+U z494zTUe;yTaH30UQ8U>X_{;B5ri_~`hhR^-ySYgL^RXA}y|3ho*C8V<8?apGaKvJy z+Nr-!bN~3(&CJW8k>hK40E*xKcJODA?r}>t-6s2mYFZ0}tF`07QPzFY*8XqVRHSRsa&dSL~Kw{<9{W+=d{aS3<-HdOQA8(& zu^|v6EMl;}&{s@cQ5N?ex>C6+BV#L?PUU-+x$mE1WTLY!p(_n81?^VaX`7AH3I@Y2 zf9^*SSQy(^Nx#;oorCIIFoXT(G-uY#Kim7rftiv3hOf~Sc;clXPcr5lYtB^}44T91 zSjCS9f=EQEx3D&xv7`_>0$2Ug11e}0EVj%7hN9c@Z4>Ek4VMiy_og(Y;e~Un;F>Mq zagE<)Ew>_&2vQfiW%GGHn52P}=)c$PuA#RtbZ}k{*G$0xyM_}LpM1cvY~X~i&An3t(T7fW$NXg{;%{w3U1-&9N>SN#ZS^u5kOU*D$c)LL>4t?W zHbBb;SYv!4QgndK=M(3b6n^Udd%<%$X3)}~Bl`_+19LLo%78Tf<`FGBBk;!!c~MCg zur?MzHWFyj)nxMhnB{@*ITun8{MiKr06K}I_IdR|ydV(yo6jg4i5GlnzkmM<310}h zA=_v}eXLwEn$D~;WC*1jmuxJLo^U#(3tyy@)f;w=J|85eRgDP#Z8`m zgU``0N`b7IJJP}!_tuacs|ds5!9&!m5#q4#otBTHIhYkk=2gU6iD z>otI)DYLV();2aG4)hz>whTYVh++WSO%f4UCEA@(+vxWvZX{cq&s&*~$|tvMt_3+c zg#$6xTH|)DcV=|ts?Mx!U@9(sSxIJl%!S>xhpHFC<^)gHJd~M^U@D+NH8z?H_C%mZ zWY(rWSRSKNB?A5c>ej@K`&N$GIT5OepQ@NvS*~H<0Q@=ERFJ{z~;qA$A zKJ<*zz5!V+kLK2J-JDuZ1i_Ax+C3YL6?@Yl`LPiF1I)ST<`7aB>HWFoK#DRIeC&R*PX4ahz)J(Na!_=EF-GWgq zW|#$arHee?R!(w#UqZ&E7jQ|0jpX7QN3YP3o(Zqrx*I+QxwX7^k;@Rk|M*dS*E6Tp z<&0cKMRlUiSW$pTC3fA<#1dS6FnI&&&?2 zfP&2&Yo9E04S)xrUP;B#(zcRXa-TM8M3)ny>a^|C8aBLnlXO~I^iI~8SQqJYeokaH zkH@}07Gi`f28L`3LkPJ>08lNwsjjZB=R4~Tcye%YNYV!lb$#h~daWTA7YPyp+jLzp z6yna9q?`>>yVYz$pgkm%bSRVCpeU9^@V-;h5a77-IQ7Bad)>csW6xoIugd)$s6V{1 z+wgF^MtRK|t~0$b)9rM^Z|r*xK_ZS|)M@Hg+7k4=$FiC|haA>)#f$~76&SHt`c~ii zZ|$M;@biWnE4IHRfTHl?XxQ=pKrs{zq-1hcg%a^ zp>n<@*o0GEZO4|?x0){+TI=%b3t7t1*(m=BP!waLljjB}o;f%>i-uVY16kU_bPSpU)~hs(^y1>4FhX}*m<;;unhn0R$1TPzD?W#eX^|~g zBiP55>!ao!M<17&)<>Jc6ALXV8!CnBqGUp-uhoPzzaa}j-i*a4S}MwFpG=Pj@1s*H zwa~$)+4+p4)&`pzoD4=PdYKo8bC;8&G$;;7r2S#VTSYU9kRNAE=!S?3p7qwBx&3SV zvThWKAc64HBRd_~Lrz+{2N2_&Ub2r#ok<6lnGUBYA?CA~o|_0f-)^ehR_V5?AT)TD zmzT%I#|QX&-;lRR*P?+N0Tb9yb9NwT_#PZm+|cX%{K4U2Y^Wolkz8R?+r@^S=P+OL z_IH4+D{A#;)ByXK06iELegOzKH3UlS+l|QedSc{V`FI+nzvFN7$;WP1d~sJJxm2@+ zU$Vm1d%MKIQi>anKnjD$R=gw{K0Z9*1gSd;exRjl$(OY}k<;sI2@#P1tYTPHk|bMw zs>Q1zAO`F-*N+IyET#`o<#7T}RcYJZ|1Q(^+29^6{D7_LdVc?EUV3>vB^jdJ)%DT? zTM+w#7Ix1=KGs`H^8l#FF z_5~@aTSb8=-74hd_qBY!~`_KA%J-&T~Bq1)af z1C3v&kMCnRb)EYdiOaz>JT1r~1Pmslp^?&-4T5@yj*0n>-kQF_W&-14XRH?pYk+r+ zCU8e0VF;}%BPI1dVg-oI7;nit_1n>_v>Oxdup;;pJ^{&n@9!`FQa`wFg`s;qzdWPb zcie@bZB-R*PyCvYj#%oIM2Vb}H0^qoB{FwjPV)9s)rq(CK=4PG&(4r6z;`0+HsBwc z)j**0zdq)yb!!HP_z4TnflX8;0LQ&irTf<+lCV8(@6^lI=05M8hpjT%ijI1)cs#B> zI(fjtH&;T---NselI>5UKj5&SB7?Cl4eGgYu(o8+W`GBr!+rt;H`o?lM7a#)h-?XJ zaV|C4(pUMk^71-abmUAi-f{dO<_W1)gNvJ~yz~YtKeAG4Q)ewxQN?xAb^ijnm{` z<^9Q#>s0EnOQGH(4f!_~clOS^l`w4UqQL?MSzJljM9h#EYQ|FRH)^ITy=9hkZn#t{ z2+D=YXrqraC>CwLVA$g&@k9c8^H(NAkpqDMpn5%fzJNcPPY=+?;-)ZZ1)2`0_WW9a4+s#EQjit_f*Y_RuHwGR zOUZQu#{NZkE>2EjFVF8@71NcPbwoldLMnJGt~Y-sRRD(-VJXZnO~yZC3P@VXS3g;T zMn{H{OmA;**GSQS8nS%(wbAb+v7KdQ7PZDG->MT4-+Ow0_|xAemkArJPc!G>v7QgxE0o| zsR>WmNZ?xXC>1KB(jR(8wfYw4PPNk{nXoX2NuB!4nYARbH*# z{)fX<3#SS&DC}8EweMUi?O6{yE73y-C_vBb&Qj06&%Jc5y3l=3d1=9u6*BlsMN;%9 zhnzQ=R9c)xfw*8p|IfR;J2wu=1a-t3-8#^yJ*ANwg(y^#*avuVf}z!R%S7Ebu7aMQ zTWBHKu{Yoc`4+@%Ntx5yf6&BoyKYL$BRBZ7SE;lXSNDp_TgeL9)y-Ox3`MC6h8Y6R zK&YV8<%=-`heRU`szUzrx~WU@2RgKY-=$V833FjCuQ47r(u!d@D~hx>``!#L&I%JxC3tBe>p(Q?Hmy;CTS<&2bq?OvtS43;2+}y z2Mqs3((G&xa80ptBikeH(k|a=GAy&Mzdp_(t*$_s&w-!-d7@dq+fkcExT$m4)p>kf zidjZ}BLh9~MBeX7%d6YFd9r1z|GkIv^*sc$kZ6o!A7{E>R(H`31pj;K3g}xn=-d(K zBwH>-E||;_fBrjC)oVActPCgV%$y8-W$}<~`@{d>K|2KipNv+(UAI`uzYy^@ekLc% zw*7~uj8wgQJ$*j*X2WiAw8O4(yMyQdp1H&Bjf7S@4$Nc5^-;+(hhDJp;Xk+HWj@_& zctP=Gf@zDfPJ{f&Di|AvG2z{q)~jE*)yWS1kZeS4Bfn2AO^}&h>dXH=lb+_H|o@vUA`2pm@YT!%r9)s>?9Ch#^pOM^&0eJ_I0HHo&3UCYvbIo357SsPczx} zDYpVmL5YsZMr3GoG^EF26Ct9!oGvLTDb1%OpU>RPEW-ykq|zSH+H>652?L;vRLe!3 z0?(rEe<(?2?l49wCA_tZgqk(7x$ftUa=^UJFpJmtJx2ziHO1eE2!xUBhuHQpAnW{W zGyc4jj4vAnATcH1&}&rlRJ^ebQ?C%0wk-SQZv5SLsYw=N6!#tDLH_4;+(pgo%2XEt z%74E~ZthenrmOc9(~Vv}E4?_zu>6D89*R2n>J?oA)|6V%n;RQwgoNHh1=6#M^W#Lq)3deGdO93)l23~{X~v2ZL9G3IKKhtK*e&uBV566n zQ8V0m6?tB7ZX-K8CLLX?;5a$D z>i%cB=yr?Q8?)S=a=tIq;_Q%$A9~WQ&XFF zk06bXDyW1>NJ>gOwz&N!Xg?pSu$ZmHZ@bwGNMY0==cAL+e&>C2%m~&IJU%|wY_cgs z(~*o%OA6zx&{+Rfl9OQR9oEn(B;?@c7!d1GwHqVi4kywmfne~OYO}aFaA|QT91StEI)zu?f<~0{~xX3FFx}HyO zZrJ;)gMxvq+s==NbAWD%7Ax2Ln0Fnur#6%XQmyx+2(RN}l+1$czRbSMkB2gt$8k5? zJqNwXcZtj8XkIx?m(j+?#*~zJzKax9h)3>Pt7J5LeSbXw5Y3X+epcyI?Yyj1%oSoo z&924)s_vkgni_^pl|A}pL16hygvg`CG=F^M2&ZMH(qp8W|8TjN#eJUy(KTWci{%7z zK2LXa?DNap5N6e9&v}u_5|f!_;0gwf<6k9?teSA7^(NX{TA(rkTlB-#F5zqVeD}*e zWtU?oFPfCT^+!+Vv+JdkH7&AnBoH(`mQ4K05Z2}q2R4L>nqM;FyNLU;5rQCQJtddr zBo<&b5DbW3nKB`+ zdMv2278XDxx{n z^4+a`%Z07p^n4Pw2{|X{XZ`-q0=uu7!&s^Bd7=H94!A|AA=n9@&v$KUX@MgnBnw^pWyJ@WL6do%a0m(}s#j@mrlGZmqLM;(erKXD z7r}#oJI&W(KDRPKOKaiVyzAw`AHt~;#nh`p9usio%@o3=Hvkjo$oq{JN!}bgrRCn| zeQJom52;K50t^yCS(T+EIXO-(+21G|3e06whs;g(sfPEHLEc)OdHXTbeC{&5M2>0`@ch`sXk zgm*MKS^KbSe0?y3C?EXQ8g5(M(<{OQ8d-X(U0(ZfgW=rS**#VCugMd|y41E(Rz?Pa zTKMBWud9ZL$Xfvcfh`#aZ5y#jf12Z9c+AuNlH434ZM#&HM&tu z38YjoDP}UUwkY4<3UMa)fCLYZrYg&%=i>Z4!Ev&my~<-}cbEDh;~s!-%+fnF>w~Q+ zbkiMn1J%=Nqz&F(Oh-Qab*9QJwa>bz56tyNB}eUBfCZlWNFO+hs_ROsk z(y>z@u(JoBazJ|i;4(GQCE=P#%a#;Zv9~W1E9)ho&bRien}%eZgDe-|9nhW2rf?!GrYG!Hq%u0(uHBXyjIVTFS+@{Ix;pAQ)6?M648R zC7sW2CG8C+L66BFfjc*P+-&8P5@9){l>a3m^zI(aAIwtlhuZ z-zdzcUU~m3Z#8vYr3iEUkg}pCcbUV4;w=Yt^Ns$55UN4Z*7gbbLv`cBm z*E+hn#rt6}Q-%#jNPG!luGApd55YIaRJpg6Q4=&Y$>ZcNX6JUrAgP}kGcdkooD73P+cbz?6~Y0q~BdHyh;6j80&ziSm& zbTVFVoaX_enHEs!$#-cnhaovTB9>B4%OGo9x338=5cO*wt437SokB%cjF;+U2Vy`u1K}_?Dahh0@<+yHa5eD~D4(%=I-P!kmE%pKUoOgLLqZ;WggS>S zt_DO~*yOw78_d^@R+k~Q80$TkbN4be)R>pAx5kH~s)N44PM92BV0qJQ^i_gT6QDgKD+tw4Z&WD;D3R>eCJn#WD2l#>{xoeTt=N$WUy_CQET1+zH} z=gge&hfhrtb0;Io8_jGn|C*S}1U`1+Z_x4qD@RAWbKE2dEuIe>qehA!yf(ii{kk~E zR-*l^q}8&%k4pl!AI|YO=*$`9X@QD#r=DZ1ESJ@7CXjEBO}V~i**gfdA|ygtTic>B zh$dI`UYeTq$w+?Go1lf6mUQ)f+-s&&B{}js{_$Rm!MrfB}k`}{T?>fUr z0~ef)dVIVSQTz~zcB~VP$!oReGBY?<1@f|@j2Pmqb-oIa$^X<`ZKT=cBB(MsS!+7% zx9q5h>j4A3KHerTB^}YTLP7fy?`C2oP;W_#k*Mm(aL(eB8A`F)_qMc=F9`=%#K=+G zg8Oiu@MrM2yo_{jK$u|Z(;Ny?%roO!Ml0$ACI-4UCDdKaU$nigx2V2cC?7v=%=f@0 zO1&R)QuyMZ6z1;1Jc;$}(A@rbSO2;ZIkW1{29ktWB5}bhyXueQW| z3{#ke(s4XP(_I8^>Wry!Nf9?D4kgGheV9TpI|K6ecm{v>XnnQ*!4L*kvbu<+DJ&{C zb?Go-k;P{~`#Jnud`CyoRGLJl!pcZJJ2W|-ul?K*c73jQWHLK8N&EIsf^f?Ah!< z2<9g}q3j3>ttVl-dmc^>8zzh&I-(?^XN9aPfH#+B3xAE5OblF&%xvL;`A`$hj=Ljk zgy{N8X#c_7)oct*>4yl}v;gm^%3&8Gx*3ojY7S9wzeZlR=XA83E{o6BpxIT?UTE$9 zT{f!i`3ujLhORm=vSN==746^hU^}1FqpQJ(coPgvp;p;QFCKR$Cb3lqtD@5<5js2l zoct$-aZ-ZQF{&9DUO70{NRhHTZ6NxAE{stHp!FOv$B$r$kQ4f^KT-pl@44)ckPhbM zyHXW(Bbn2rr2(&hG97Mu;93a--GeXCfaSw=HNs@cBr*22U`r!J$4MPQ4#;#cKy>en zp0WOI&D#3Q1aD;2l?3JWB3b4LUw@$Y0>X)X>_gSzw83&J&(h)j#nlI4;Z+y+L!i`uUv)jwL4m1|)Avn&ceVBrKufPL zfltx5@Y5*r0moC(Joe=CasRGau7PtvI&KI0rdtuvrWZg>b&()PA1^-bEecsfVbG5~ zbAKzNk-XB3&*|*2%?Bjs zOU?F@>gp-K+%NJl?23#ilYpXsA>cc@J!x!>wm%rwmQ*atVUFOnVi=nKxC$PpU>20M zi}I_Y86Fe)&HIcZtz;*pMRxMkdjk2YKKj3tV*R({D_60KN|zz{Lj9fS=|y48ww>Vb z)+bTKJ+=%z_Pe$?Fbv8OnLTw@Pg8kH)#GDpQ-xO-u{|po5-SMxF8U&-6e8 z_2nc-FipS`W8;gl<65_$%keVI%Og81A}&LBcq!)IbQz|VwKXdMuXmJ~f1*;0 zT~kNL`2Nz8$K@35NKB8*ZZQnzVwd9l))Bpnox_Urn|wCig_Mk365*DIhsPk##qMuW zS6A!|ZhOCj=`>)P@_2n%qxr)uTDKk`#$ax3Z*R;Q`1gcd5u%}?y~$Rf-n0SA`+I30 z#Vnq;*0Ys3W0w|-4P~V-25{(iDqYH2LPA3Gz)V>sL6yaMN6sWt$ic~_uMd9HQLZ8U zJl_l5)6DE(X{^S4rLOEE|*Kt3mP>%g&IzX|=A6#$(+?Ab76T*6P*pR;%m zAenR%@=9ua*{SSOUMGsc5xO4aufwMJsn{E$_j97m95?Orw((-k>X(HOMjD2>{JwnN z_b`X7c74!TJ7QmES1*(f#-XZwvc(P35#mehtiiVRJ5yYBW2HI8~zj_Qw0(QQz2sol8jOxwa*F8un2n5n-GZY`UjiC2NhJ z5Qv0uf}H4ud3OGa31k$8XJSaBXP!PJ?a$LJ5-##$!7rs4ZCv`Jp<~m(C?pBUz6yd{ z(Oe!ki{s)9tRD@f%UJ1jte4aCxMCJmn2xQZUWiIrnE2IcPb90E*^i|s(^Rsu0Vkss zO+7uvlPj-|v!BWo(LikOKtcirkf}%!1#q(lXcMUk!QE_TMJ0s7_ot$sierGAmH4Cb zKtlsZA)1f`S%HaAlHW+$#6aMqPrBa`ssEruL3{f$&qgSzi56(@SM5aC)5nXE(NQji z3=V0biqcXRzn4GmY@P+J4hYGb zigV911@;xSR>p*%C=aCoL~%APHPbqac4)QJHZw}n^8DgF3NQ}g{zy$d>~RJ6)>gO0 zA%K;QZL$RA^~2ZuphX4O`|C`56W@b}BkjBytLUZkCj6>P^@gf# z@m5$cJDhu&oR4>$qaLVExrUY##s6A=^IIQ=W3D;T^P;&#WA!r6!S-A<6+wrxs;coc zzE$*hA@6>V58uU#rtzB}@6yjUi|Zte<=f7{-Z>l}aVnzU+jgF1o9lC{hjEyzd?7k} zgdHHTtvah=*5{Nc!W|yJwPlYo7+bMs;A`!_o!E7bw(969Ws2Yyy6PJqaB3VaWunKu zLSvl5!Rzw-t7@D)Ynb(HX|M?q)GBD?+Z0{}av0;4O{dj0@aP*0&D8tz8DT zg?)_#^tFuznvS?Pb9Ge2EZ=X|PZ;3EVyh9xGCuuk*~4oT^L2V6HHd43r?0h;B6w#HE zbA5wOXo9DHRL{iEC-ZeuQ3SjgU5}67vm&KuW$MS{i${L{A$D_fL;C{j|M<)w+!9z^ zOf@t-^dUH|!3D$Q@6pV6+-vcp-p&qh*2~TZ6CRN>&v*}^G&Mx(De6u_6j})T9zx{?N=kVRsl7rOF0^Mpzj4QTH#e8eK#8g1tkR(?cwQXMj1z15N^L)F#QHE9Jp^SzZqexau= z%)UO|C8OQEgAdD@&NaW>jTnM|Fl2R%_pFla;KZCFJBpX)X16yx(1xxUM%U_h7ChyW z(Xo^6EDBJj@K8(-OH-|gY) z%IgV)31A=)kN1?=;qeveX_!b1knx_QY5x&?ld{2Xw2u+SC4azh|6Y`{i7_pBef2Sd zA{mC9G(KMMO&ho^d@KvHimVSd?& zh)cY%HlI#a9USOA*-~m#wz(ZK}bSV6?PcpL<%L{#4fj zv;feX;q_w(1d8@6jXt2MAX=f))zgblk0(2k9swh~^<)#$ALTA0Tlb>L4G4O_9*Ry; zYqc$dZ-!mvtLtL1O}{u9!=L*ECG2-k z(4_DP2OEj4w9hdf?ngExCX6pfpx{V{$$qvOtpB;?Cb`CRwc}<3vm`X}GgmEZsp6Aw zX$8IE_8Ni?EVaeVw;Ndl@Ce7yd|3ZfC)hkS^sE=vfNXiV{k11g%eXjXef0C7vSbSBU3KfjzV?X8~n zoaOM#T88dT9EF^sxj{0PmkfEnq6cFA+mol*r}KKE8l$_ z)r#gh3o=`O#P&FDe72Z%MN62I6E#soa;upS2L0qCD;c+nOUVs-cc?*5ezhDKidD{5 zWV*Aycl>$YrF{TPI~MBc1TSpgy1>zZS{Q$0q6j;NSm7)9GpRRGiiIBdPB0in_=d>pbsZ@CDHj%Xf07bOUR;D@U^@a%*V1DPnjkVO z>C8D`iHLLeYAJ|(NykZ&4XAWC@hr^OsyDRz(}rEseqX-7-;Z*2;;QZ0t{oc29F0JEJUk5LZ$g&Uc)XxNrYp54mxJ=Z10?fENBUP4>|}@{%8_et z;68o*(GdmAHzTKy$mi#^jdsRV&$@&qM6`55`lcCx7@QvMvVc(Fjy|7M*jBV`PzM|v zYCs^B_gJ$i4)v40($mc{VJfoj%$oEg%IWo}z2>HCbM_?3e}n39$_j|hm^vMrOG5@A z#G_mY7IYDDSviP7VB`!~4{};wY_AEwleH8F^f91g#oGbt*0;2)$Bo|s1>gA0!P?)= zXk2{{Wo@J}*x$rN>|PxAHz&**dGO#4s zk!9{;0Pi$P&@an8$@nnnmT!EyiGyCjw2N}!rf=I2V-V5|seO&yTK%fF`{Qgm&n%UF z{Dm~a8Kc(efHJuAo){uf^W;4QED_84%e4UJ?3+&t&+5r~+kc9vep~se`23OZ9FzM; z3xLCLc0&fxe+NDi+P;-nHe(n<&VfU4u*9l+eK*T)5HLdM71>C@F)1!7q3Gv=+02OQ zWi2sw5*~Iwiv}9$|8VlF?ZwJ*!?a<_7CJm(@t5G5jn2T-#bK;_1FZj{&rbmMzI;0F zCiaAIZ!|PP>mjh|IDhcWZ+}|fME1{h=G(;Uk8tqJ@@+IG&9PkHYP!(;eFHvgXq=Sh z`PcSW3j?ivCPKXuSA|W8L4jY-Y0LWQ_;hyWXz#|qfsXMjzD`@mqG|Z4=Z%~o8@7Gv z>eniV*VlS={XH6aoO>q#n~MJNYF~a$J}rpE|BlOS(`sVpWl_4k=y6vf@{b=gh1L=&0q)bi*{BS1@RJK7;O-3L_Bc+0W#>t$UC)3^+mcPE4SiMZ4;g z|7-kHe*+l(cZ}(ILPxa3Z;AuCs?tKEzSm>?A&x zpPkpz%&U%T$!e+5*ls4SmiZ+oQ;XdkR5+35(@fIe-@gXF{r7p6?Et#Q^t6SMk+GPa zBVBot**soqL|1Cf&(rv>&0%GKLuIih+MU*XBgLTg*+#d~Ty8~_lmAY;te`uaHH?3P zOV0cQI{7m;9Kk_&I=Fv4*@S|d8`f-R$6}=pm8*l$B*NEC;_>vI(Cw+Hrp}x#St4LP z22k%nC3EXnbE{u}{NTSnS&ao;8GFX&6h}+Ew`Vk16~mh5)9?V>{q@E<{ZRdypMZyJ zTuw?1z#A%*&$AFM|M5bS2U zd9JvrDHYC0ZY+=~8Abd63n2Xc52QX{0khx{-1Ta^>H^yu3PHhlXJ=>i#3!9MBn*s< zrcVV01w}Mhr3kBTA1$y7r3d&cwg%Prm@uAQu5r*#ep zYe^mMsLa0`uayA!6=pq3kjOY+ov$3~TR&nsBQcfsP4vQU;rblDja}P^VD3U7(+sSyXJgQAQ9}6ncd02~ zeu)bX^&|}7V#sB3VUGzt5H)C5g?)c>(*BUc5DPtA)Abm|z3N5S1k$wZyPyReiNG)3 zZ{4o1(|C*oj(@zo1?Ced0EtuF<7bS=?%(ED!KtNDHmmXb6|^rWfHhJtkbiEH?SFqJ z*?v1I`wtkq^w0g}6^+kM0AvMJ4cbHLd)=8%Pfr^{ZqGLEUK{{>rz{>nB7pMIpVQ%e zHmhU*s|`IV<=}b6`=qd;0c+LgiSyNk7})mLeo^Ow43*FZqKPBT!FjF@4rsm{@a`zB zh>^IA3FOnGqbRSln!;Ft2q40Nf`&a|W7YB%cZ@{vI!vG952EiV#}GX8+He&)7dWcp1f zfzvfOXnecBo6F*LXm8yWr$ZiNt;f`U!W%;4(O zsZFGLu8t-!(I2jja$7=H+`EvdrD|!DWN1hBX7c6=+sX-0KuK|*YXPrODQW3|;$rNK zW{bDL*ajLJ8uDvFYb8;WN~$6La~x#wzGP}&jCkx%G(J8)ptivbys)-RrmT~0uvpRU zoE6=OWoV$h2jq!s$HyOgr8(kV8`{cc5R}e`@0%=xwu*|rM~Gp>GKvv~eeM3VwXBCr+5Au*rJCqgm{%Tmwbl;3-^9k2j?AD@vC@v*0;79)`RMcNW@fwf{!7V7rJ)Ol0c(rY7=*Q0v4Frd*zu#+EO@UzSJIl5s?r(z>BSJQ8_(SRv~`d6jLt?^Tz<icf%q)$87aSoRHiJ~6L%aF$<^060c>!YUhgJQkiG(aHEVboUGf;Ox zc&0@qCHms}p^U7w+tsS|n?WUgrz`~e-DRR9RjwT4?Y4oDciUV9O%I+Kg|xz^vYhwH z*BO+h=q-G@j5DgloOF0^vmqXbeGRN_0y~yy>)dYJw5O^Wx!)k_dY2)u%|fjFeO7MN zV*-J4eF^dF`6hQqcc|NjPIyUTNTHloU3JtW?_uM_+Dg{gnJbug7Jz6+y1tE(hb%r^ zMxJPTR~)Ab$aqviwR?Mwxq z7GL-}?CqNEkZzN>_F%mVRyVdnQSIq#QZ-Wl4-r-W#riD$(2lB`fVz0cgcPbt3Vv?l?d1M*aTM(oJsXv4FI1i+zW6c~#e?GTU+Ta6q$&FZ$Y3{mQ?(UA_BSA#h?DJ7p%sP*kjc_c=pDhv?RrdPm3UrS3# z2?5PfNN9+$y1jiAJPj>vthaA*FuE$)`j{6l`BMcwNR3O6idQ9%X*EcK{4PBZnqfCk z3ACH#<>g>l2o%k32N=%lTt%v%e>XS#JS{CPjg!HMhx4;zubYyWl;7I@W%+=2EOO{y zkFGJosm@f??RU52*)<5bKeMEjp>4ZBBvemQer05W;aeP+hmO@7-5qLou%mzvWPxC; zj1`&!YIs2x7tEPby@=zMJK2zy;NXY8!QpQI(+vex%@FXyWLXeoB%8i~riF$A$67mH5Y!5}9!rUB0@Ne>NvDzG{n+tnmY++FL zF+^rLt^2>5aHyA@a{jZ@teEi#IJ1hS060wjy;!QOqxlMW)Z}OJn~7LR1s<%%^POOj zsP!H2m?o@m@rS2Y&Ewy0#c9UIsTf*FWB$m)T8$w%?HgfeSMt6(so`r59}IZE=1M{h zYrRk-VjhIZ;ik_I(&s@@tN+pR7hqH%1ll>jrQR};P|WAf0#sDAoNl|D3KO@DVfOJ{ zD>ZoV`WsGW71GwmH#9UH%ay{SM2FRQ`&}B<_4jZ3o!Qc#Rf07ZlbFpO|9aja@x1@1 zoa2!SM`30L3HkOtEe}3G+nK}GdwY8~+6_8EZHAnGs2Q1d95p$i_qBn-zoQeoe~~i- zO+cqQg6SnPZ?+f_^?Z!riLx5qotq?XVDMTU_R##zo0{&wZB4)4wv4s^QVl)ky4jdy z^ietp71G4Dvdnn}E~GXzIlcg3mZzfJC$=Jb*D)-p?tQkKUk3!C6AlHaf+G_X6XQTzAh)GQu|3PWM)^ z!>3>sNB0t+END!`eg9s~n@{d2ctSB5Lw$W5CQKJ+SAj`(E5PKj6cFUvb!ENyoVIYd zSUcz*K^+In$~x^}vke*mP5217o#R8TD1U+`FgG`ktfpe^^mo>_whSA{Dsge*va*8v zY}Uq)&uYl77B6vWX<^|mzU!Nt_JIM(9`bRGqUm*Y;~Y=XOEP?Xd=vr#=YbB1Q!in! zTI=PI%^WhIJVt+>p+<29I}a4HY>0`8?HpVhRwX^Qw=*l6AU)EzL1<(rW4^p6DdVyp z`urAG*pg=Og(BU3YOFee7V)v(;Wj+YbT`sJkGpH}cJWZXz5#agvGe>0_FgisC0 z;3Z%tv_*Y`T6;-9;}lDwH8W)@|TOlMWm6D z5g2%wNH{NTk(Ob>l#4da|m7mXFFQ2$fNq6SB%4z_1?Z-RU zRy%_iXlH18HF^|tv}kH=HqDu)aM4ZE(838ydHsv?(S~=KGTVxF2cW|1uLJzIK-LBd zIzH`R#&jf0SPe!j22FoZaHAK(y}iAmnMS7@YxgSDknVKPD^q;25gyM<@N}T^1Pg$1m#G8*G^4~m+xtf0=vH>Bu?X%X1X?6Sh?U5mC4L=F+w zy}s37GE}(MZ?NryZ&uVIc{?A`b8z(QCFvq0kenlO^YW{jCjc5s47&f?_nS_K~G*C zm5jc>;(E`jw7kriKDaW0Td}qzU_@Woc!JotG&Mrg@Acge(X8**uOG2Vy>sr5X*_Rk zbrP8^@gl-k66q!VQC4e_v~-KM1N#-nPR`T zKhWOHfTbQqt`oEF=+oPV{Yf`+&8d?9?Xoe3(eXgsll{yUeG^+DV={&CF~NqnQGl2^ zn9~kjC=en3JeE$xi;J~Hq-Ke92EnVb7FtFR@$)!}1r>@o7yh@Qn7h-?T0Nt^2^i)4 zyaA<(m*=VIde2YF9!50;#|!hxxBIn3{zgxY$hbQ{F1ZmiyCaFqYV1FW@5p;T47*-$ zFCH`9{fjEAK5wtB>{)9ciFY%*wjGPEn8e#F4x$EbM$8a~mPggDCq$o-$2T(8bP7t@ z0RqYN;bZI^YHfllW*W7XYME74k2%z!wZ6!J#+&T5WvuGVcO@BTa(n{Kj+yq?UW6V> z+fT#6dZ)dvavP|5oX@k#5bHNENNS-?5W|1$r4u zMfnZ~hl-<&7j+AVY0i-u`Uju)N%=oWnbQkbgs!Ll4A(}@`}*z3C7soiZ---r zJSZ#50n6o7!Ms&a(29?Z5tet~{u%xG6BC&j9f$@!L;UA~-mRb4P^#Q*Mmi_YM1OvX zvu^)8AIvWED|@&P#MD$6I25GiAM3N|(O$;UZ*`kcyzq|I^{Q|lWN%qzg>y4x8siz+ zCrlry%;}CWNErMY@S!6_glri}%A6_Oeht`PUrX$SW125B;mgKvkEvh`l&xOrtQqKp z7Wnnb|7LF^&%n^U<(%c^w@1aiqPLUZS^Lw(It5iIzxcMT^Y@5{hE8n2#;FCPI(L?p zxfSKmaM?vK!|Ky@=$P5xj+JUE&01u`8Ut@tCtlcft`|! zUaRE>Lv!&b-}_Zb05^k&x;C7fda8lVClB5$ADB9SQstN3KotBHI+wn>L9#bev6;Sv z6Zv%h(R~^D01VvzUnC!PpaqMY0Fq;;JuBwL7)iWA$MQ%M`4WG}DbN*y2ZE)8$a*yD z9y|%!>A+-XV$Zr|uoT1Efq!Ef@O5c({1?YEy$L2rU zR~Ym+lKm)KmmlyyOL5%y!6nNBiK6J<)g(NGy6k$=rUSZFeU)0yi<`cY5uk{v%ow*E z%a_xG$7XE1*gS|_9s54G(9?tNaL9-aU-0XfFR&j_`PV12PNf{7qnzn|lqC&rfF-ZBqmjizL87JYOpYzv)73A@lAANl2Pek6a{` zE#WDD&9u*sLtt3G(R9~LF}%lW){RKxt|0{(*K8l8Hh~v(9C&OaXLJ~S`0no?n1B!c z87EoM)lKC6!Uh0W7(6Y!>${t^($=Srv#mkUt%*oMK{147@l39ONxfrn5pSdChlrvg z2~aTD1@4GT$#n1h@$Lk$V^<|(4(!wQ=>{?u-m_(0Ttc=did0P43v=yxa(x&|`dB73 zrB*baC9_zgUg^R5oHMy+`AJ?L`PmZHZ7X0v4DsfT3^`K*oJI%@HTAQl3zm}~bf%S6 zR2aToR*dYg)X3YWq&T=2R(~UZ@xPr*S5rqdE`f(d>|o%33cILs@^?J| z9cyfv&M9n)@}Lbh1K^;Uf^)q0C!L^)NNDnd3;_4OH6FES!S*8>7`W|Z2Km2ABbfv~ z9Rwnu`*-kyCncaP39$KVJLB1QWwrb!7<3E_y})SI^~84v&+Bm!iK&d6Oab>xKBPh$ zweic&$Tr%LIFGlpY4JF z?iEIMhJ@yxM(yn0wa*B*wP&BCe9Ty!E9(pD<1Znh+1q!RT02KaksSX%`q?ZuZhS?y zxw|@y5&H8y8&{Y}F7AQlN~zoft+IPnQ#XE%nHidWE;-=3m70)9R>zQ*hcmTd{NMz+iKfu z&wtCc!QtT|782jlOF@fV9`=8CYb^tySgbBSCCR=v!xFpZpfsRk$z4M=wTU*7EK!wu zJy)s55R0CW0YdPDLw*Q~iZ)@FVpAU!z4f-!C*2u7k^|O-;{>4ssi&>0)9qFVRf!atcp48|wA9 z*KV8RV#f2p&L%XdT9P48IcND_lox3ot-XfTs}Pn?U$EYn#cIcVPw(p!11Hpu7}`{0)}<;7QbM2gchW!E zWcUC~=a?2ZQ5CI~tK2d3+lF5VPfM#nnc7`$Oj|m6_GVg5Z$08qZ<|W+VBWCc$?&Y+ zMuMJq{AER1+1K2-xG=eYGi)2D;)G=!k{QA{cI;;iN6`Ae4q(`W@c;gj@Qxq;vju|{ zP!!-T|LwVx=Kr5e-T&(m4S=j#*5qFfvGMT(QrUOMzqMIaFwA%tl$BK8Eyo?Ln@nX_ zRKPZ2VS^v&NCQ4tUoy|+3UNhFM$EeX>M^wuSMwoB(RRP1Rlc~0Tdjo{TJ_P-sbplc zk>$!-1FB@?m3b(m>xyJ5`Inbhqs23kxm_?;>_y3SfgOgpz1uf4o7GT(%Nl1=FtNk9 zI&QX>r5x-gs+=&Z!9mqD_#j8zCiq=b27yJh1irL*V#$hQ>{tmiWuN3m3!^89<5>Qx95R zlnLXQKJwr;Mo?sCNQbk2q{t{!jkwq$P_Hwj0APFhKRZm9k+d*lV&)AOy0%RytEf~5 z)bsoy;Y^@O*(6o3@CXXV^P6vd@{JQam&tvlLS9cpxC^**GyT6Mv<0kQ=6`}SWFAM`5loRMn zS|o=TAarq72*XfsJ%S{3U)S{yxa=a}h1l;PhxNZA^gk)1-&q>Kr>L+j_t{6h@Hw$T zsfB)fX=UF-loTWP(XD|a!^_-ij%qL6JS5sKXNiCyg;gj4F_WXtirw64Wu6npV9naV zHss|U$Nnbavc!ZDm%%L!DO~hTwWjsiYZDWbvHkrI>El+w_1nb%41lmKGY!S*`*9O` z;g2?5(|QD4`^i$&R#yikx%)W|AmHxA)s!)EFa8XLsA0o&cBLk-sJn{3;@+;cZSn3S$?go6)$&=3xcsf0CU7+_~R3D3czuGWtbSqgwMG%1}Lq zHaGLC((3&HlCR9NGUWZ)(xB>a1i(U+I}c)3Sgt|p$jBgo%5{BH(?GEASzMCs zZ-bPav1T!(-O}H`10{2#Py0zMtw9bRB_Z9fjH(Om{K?FMf}Jp){m#9~sMfkV^}K2z zex0sEtSFesm8Uf3LG5uWomNbP2cye+i;X=rFR71>T=g1(-0JLw44SbB`nsjNq3 z`fdi4E!7YXNtA@&x7W&gz8#dhCMH`xdoDBr52^|Z#B>W-fUo;o`0re?+|@ZKG!&0k zHdm#sdl+GaUY3NvZG8F-J&CMc=nNye8EI)9gl>EL`Z-mHj`o`QF+7DBg*sfjxyfI6 zb}TcE!&xuZesYnd4jHr* z@gM^J-HzpM6xo{Eqr2yD{iS3;`-Y8_MlR;7huG>hKpd9H7ms&JS|Do0LCkD(l-7}D zx~{Ii2IcmcpwJa$hqY4AK%MF;s8d143_NbVlSQmw zgeArW@gSX#*Iw|cX{qIAqlCsLCK92hAf1EBdx-=6UAcy`wm%TDXG_ig4o0((4fzXf zp@KHDh{Iihw5gH$S@&aD}_>R zbErx6L%jHCu@*@qDM`Jyh5iwUq2-H;;vULOFG1klj11pThK0#$DJ=0zM>q$%?%a|X zt2YJ`l&i+5@&10uk&?R#Z7NN(D}u-i8i{F=W)}OD0ptc2`()`!q@XxcrIf=@AtuWHY?(dwOmoboduHQd%)}Z`If@xl1bGFsT=QAoqS^BR5N#zhO zU~&+FZFPK3mC`W%^y$6F)xr17f6LI-4WhvlngACc9POJ73n)R4qJ$_8-f0S^m{=rrI_?kF#4yB`(R( z6-klq*N9+k@{-hD3k`-R5Wv7yH=o+jlv*;@uCo+clvadb$zZsTj_SWyYaNp{{;c0+ z>gU2D^EZ-lW~Ei8R+3hb00ka`pE)@=Iy$m!P9fjX;d=ijBJ_R;XP4K}2>=;F3_)rA zT#`cL{`JVYv485yecto%;2$?XeXDX%AT)L_4!S4%3{u9ZgYv(?DX1a6n>0W|=;VJI zY6lFffteX}cBTzmT1z|q9J;K0vvOX;jF17D$8fiZVFNLU3Kb40_=lwjAN2F*PyELZ znNk)7znA?patmK+Xe3ocB;sLlo9X#~AI0&S;W<=)xf*J*z@d6+e;(_ayqe0bm2aDz z(AKrVG(9QfRZ>nvs94Vh+1O-c!nd8B+=l(p-4g?Ipsduwf=r48!DliuKRYHSOf3S` zTJb&nd15rZFwe=!5vQRXp1;88kS-d3PeFnA<=;UR=5X_uD@l8GrR;b^>)xxw3DkLD zYXQ+zVu%!Kkrfy`0HHB?_u^ z@y)}VF30pT_RzFD{&v`fe=#v@{>Y3?_m35KM&98xA_%Thsns zkdA`kPr|Mzwdlg`eQ!y$IW5Au^u_v*r1X7YhZ&A|8&LlxKafTjrh4Ym_al< z7^I#)gB2(Vp7%yZ<))X^OU|>)4ur%6KgCmG65`|gmFzq&cBpEplDV8icvQ>5G8v3) z7|X`-lhcR`6%`do-oDhgl6Pl24(w9)fu>!X@mkdTh_FYt>GtiZZ}newzG~;EaT~Ib^SgDR>J6-PB0>8zw5;n*@9ZLVSCP; z!ctn_r3q?vHVN40;)tE}cJ0p9Y{A@j2(B3xewz3ep2%#)M-o$sveI&hbDCW<+%8d> z2V+<9wVdS5#$Q`uw-jXj6&|EY%;K){YvU@LMZ)+VRNBO9<*965bW^V4Yb#V9t$=n- z`|V>v83PjUMj-$Jm89kV#-g1;5@xSum81>H_$ovc`$9n0bH1us zx!$Z?bKC!IdVM;oW9M4anRUbcDTX*2$u=O#wGP?Cxqq)vp?_*U?-LKo~$DTtj8UE{wQuan$ZE&b9p%rA7GA zz(D+(lQG$No(vup;r{XWHzY({CT1Y|jl?S!J!lJK%V8(2hAitmJ%W(a_qm~-k5AU- za1wbzJZ$ALFne-n%7Udq&eeATU&LwJP!<9NBrn5VSsBJcMA+5#s zm2pCv{D)u(IQ9%iQk2D}iF-fq02-$w`fP+}q}AX7s9&}!(f zQCdgU1NRO{87t2Niwux@q!SU-I-s^26z?ww<<8D8M<QYR-tciI0$AcCJc7$sOdd;BB9uUbc^A{_AHk5{(e}kb*?+j%nv(EM#eYByI`1)weL%o7~?I$H?zSw zIO$q^>ii2VDn*?QLYXujr9Zs_Xa2PYjjr7A7sSGzeslixGk#=_04?C!*X5)_g(PDG z+4BP*4G7`JOB68CQ1W$T~IxNJ9c~eh^%zTU_fw$6!>hQ=(~zz~>~{uwHC{@&g`+k=bHB>ub`F}*4VnM`#ILR;fud#1vmdxB2vP1xWeGBOwzdM81f^ZTM61bQa%-Wq zHTK}w87T2|yv}JYl!LrA{>yNIKSs{4UZk)@&@vngf9O}4^D>FK)qc&-J*VEZL{57| zE?%!=pTI7IvG=WWFs?LoSGKy}V%CF{tnHbvKE#p~I8w0K7j@6S&F+Lo=sDSqu427gFy=j@T9B3dy^-dW!5j-5TF1%7aq)q_5Qhgd5?=|( zk(kVqN^~nl2*7?Eg7IYAXP+y4yh|zOpo2wGusAWFdHX9wvC0DDD;+m!#z*Y&mf5ru z*ZbqQ*P=owEgsunJb4^h@M-tXhJxpVHmJJoF3f)rrU`Cp4=;phe_r;&j+Z60s~pR= z2%>+|7*iq=GdTWn_E3a!ac>6WS}iJ~%Y20&60kA@<@d$aZ;yW<@%iBzBQ$MFVPjJk$v<-V++};8eH127KXAUc8c(!D8?Ria8W=#A-GC=<>0vUIe_SxSD zv!*EV2bHt+MrEG}P+O%#CbR8XnsFaIoO)WrA`?W;#u0-1e?id_FlP8L%u(VI|EG?E z2Ot(ZK6~2X2SE775Ug-_{{&i;7k9gcy z1Z|uBF-#@{=%3Nnsi`<|B3M{g7l|LQPt#vbP2ozHkN!|C>Lvn#?(8d`Xg|Gg`9T>$ zO1d`B)zuZq>1Dn7jYJl?A=lH{J3EW+;FZW})I+X8#_fC*Mjncl;`u+PENC6?+wNl) zU=IYe9p3&L3{lY1f@2=Lxx35O3C-JCw+)rJJ3D>IqlIkLBpI8Zh~1N>T>hQLJ(evd zr>?Fpo+%#R0@88~kCy5uZn3bjgO?j!Nr65b)S?Q2ts2zaZdR%ksdj+8%lo{rH@X}?Bi3PI@Y1)AB+&t5 z^uR$5Qk+5jz=w{RFd39rP@umv2|>OB?y|sUKi-MSi88x2h@AZVY_GekJ_gDHsh{cz=?g6& z;f*$tp9mukL%wMGMK^;93WfNvp5 zuDDK4Mus&GR%6uJYIgO|btUSCf-JQQ#7>cP<7p@j4-Icsf>=7I%+ z7V{G(6R`7*u0$HPA?(hQI=9<&$)SIxayjUcy+n4ci>-5l*|83t99*I=|GR-Lr0IpU zllz~Y;!R4(aho-*~?;Rb1m zH^N`VU&@joUIVJf0d8(Tj|7fMR*7584s-ya+lH(cNe-&QH(b2+^j z1V;NSG;Eh0o$Uj3tCC($Q65vhvHdOxdt@gY6Ca8i!{NH%1BJo^o&b>ZwlKis-F9`_pOFb+%(a-S0Y!8Ur|=q! zo)7oN*aExe_9y}~g0>8{N%=!&7uZh6<3fCm$gwVX=nB^qpAfhLHE-z=@p8Sy3 zK0vy9>!yc^2yI_ZBnGC@(T?(2e|tG8+Ya@coC$1#Fz$66*{;VcJCpelRj;@>I96wa zVTX8C!;Cak+=~5DKw=ja15GFUA5S_ue`q9pWW(KeRW_4vL2zi~Ijw~`H%pZtKDF&i zQ+*X}bfiwDDeDooQxJNByCCCuJpUVL#Ew0cqB846Rk9Cc>*-&PyVpfRg~92;qB+|g zTZ@GODR3eH^c56LCSBWAxDQ)!3FowoD>(cCrk;Dwt@BeP}|N6VTIH|JC=gFIsA#zXPklSrF zBh~0;N=dH0X9lyJsr)%Xzh;GGTb0Y+Yw2?ppi@C1}LjPlQht zJxADJc{>esfcwP{`(~o7JKi+N1oK5f{)->Z7?kNrM$n2()bP*9_>`!!t-rg65X= z#t}nFQ1N@L2a00%cmio~>wG3RrQo%|N+{oys+=M^vP!g?p3 z0wSladXA_H~AnYIsHE=~yZdYSj63%*=m zWXi49FZ6;wDGci+|CppC$^mL2w}=tOSQCS-hVWpC5!6#(Va-RcXYEz$JD-n?fYJ0d zMxU?ot<-bm_$!uGtQs-U#4)7zGwcgMpoMM&+l#rLu@SMKUkE!MTrUGuWDrdm7Q%^< z_`>A#6=@gJgL(JkvzFU3*WLN&D1ViCo+2(iv~^-nHDBWR7*n{?3;1Sn5_(*t__I0- zEY*(3_eT^D*P-smVbcgK0uZ)bK1*QaDI zq9=9!d6r$m1w62gm7)I*HJwCvvHk!Er)PAQ1VIbFI2R)=yorE0I5X8VSxg(64A^+|FDni6~w z%w-H}Hv3p-&K#AJ40Ha0K)*DH(Z@}LQX%f=w+l(qno{kM5@=L;-N@Ix5tGkz(i3np zINli+cdgB7Hr)(NK9?n&oY9ODvl?O*AL=M*Xj1H$2e0&upj5}@Dqi3O{L#E#_SD)S zj@mvo)9XnYh4&YmBy@X9`>P*U3-@Kx+1#gB$nA2x(cZI@pK^R=@t?AtqjILQmMdYC zfGwh$)<;kPgRw=vrR)_USojF^jgr~TcX7i^e|=7bzV!Dxa-r3(gE?0#3CfkjbE+Qg)PuuX z{Rvf+aSkh>HAp+8Q-%!QK_ZGth(R;MJsl!aQJF4+j{m4>Q}5X^OSGZm%~zktn*9oHgt2l>|5W<+(HX_vZ8IHFo-(#T&d^5opJ|!HsV}u765A0EY<4{a?BqG3 zU*Ov2f`Ub{4h~}zT|OjVv8~Y^$t_k)f9*ct z+HBm?3GWtW2|{peM7GNQ5u$jhi3n2?BX;C9HZtUp1`AOrCatKkER@NMwZN<`rQjnw ze$#iZ=e-9=Cn~n0x7EkJzhX7G(PO^sLPLkWszk0BmT=}AdF{8h6}y6k})yKJ@|9`FZ933i8z6lep(PR z&eC!#muc3>j)D6Eu~NY2RP)3A<>*v{V`$?>R8%6XV_-itItGTp^$ElC^ar5kc63eX zcXgl)CeahC7x2WmD%WGCD^&edAM^-7=1by7vmgDgH<4>@GsPNx{ryY4*r>-q@XO_AAXafH>W;Ry`m8pdh1@G*?Lj@fn_K&2V5k#K$y@Dt1F} ze5kN5IM0U!1A<-g0*-MIT$5NTnLtBJJh-uzRR z&3!w`EQce9hwA?G?rvNL*L@?rZ=g>JE!`T3c|BJw+Fxf$E&23#TNb#b;C*?z*I7X4 zd^43>nBNk9d08qacbVOg#)A_9svh9-O0k-NcXkeB8f6nbG$NpaaBPk^#F-eRm zK_1I)){FqU&n0nVaNpcHD$u8KiD56@8_PEDb2Zf*{2?DlcFZ}u5*aB&%IgH8aKB*Vi6 z){~QyuhrG8Jz<35sZ036Vj}HoFs)E<+d|nh`k?mEe4!WzRzw%%mkCuyA~#)b<7J_L z1fF9;%q;7vymuSDp$%sG%L~psQ}va_8vvv+xm&2V^7&fa=$)Qom3X6I)!2F?uG@-k_+z-N!`k9tS0Nl97TDWkijk8DBV$V#R z0d9;G5$5c!Le_7L1VkKiOV4XH+z-|R-8t?Sl$1&->1jUdsXLRk3^mrv)InWwl2Cxz zla|{9C`G3q5@IK)v;ag49z3CE{%(I#B=*5vA)2J5Br>`GdyTmfQ8Qu^fNoe23pb4c zdbsIiJ(NVIysFC?>>24nViwCh&Uvj>F!q=bBl{`_H#r~g6}EF$p>1FS4tYuE2oZG$ezGh9(pmV z4+)5}Z7HNU*3hLaUunj#n3SV3AwqCJSni!6Xt zqj@ASCOg}cyeKC?WO?@k9|JYo0wt2rvGq2 zaIjS*Sm-Ystc9vgMwvjT6EYAY3B25^4@i7%>Aa1n53YaGaFaiTbwugsI7mp(X#FX` z$8{L#8)^%|7%bNWF;eXpOCvL~u)4krfX0@8H;{5`G+&Xc-s;_q9yLYCz`$^mItThY zs-zXuz%KN2+$@%ld^*+}_I9V;D3qLabb^;F->6~7|qVH zlT`tWQyE!FL1*VUeAM4Tf!)o`UO5HNVDobfBPbQZfy1JYJd^#AmcT~_nF*R!K@kk|!w&*(S&g9c^Rv}c1{Ci~g(6aSA6&m{ z+8u^V1T!)y_uRQu?`@>gl(f`h)MANxyOb#mP3Z-_kOrKY@HY>UGpSph1%*?F3**e# z7hJR}O2N#BJ{z%du|_(E;r;*gE=crF65lWr zxC6t(!*RZW{>TXZZ1`u*$i`_GNHCGA(!RxpEc}t%7+{x{w8H-`Rk1#P|0$VB;%Rk4 zyT9?cUMyHfjbJ_8|blWEq06k;-Ic2V7hv4q$8H(Hq1t@vm{=B`-e&W z3hCV-0e8(t*D0F$bOUQ_);$w6Qc*?6IZg^$DNypME8cAIowzzsr)022RCVo$N=!@+>VN zc4K&4*K2jG>p>4-VZ`g3G~nDqrFpH~gI(4&N*~vxS68mh)ij5Pi0Wt%nWv zd82wT)Mg)!vCu#z^9_tr6+Izq|hN z8U+Y*23@wY;Ke_z^@{RL_p(__w98{Niq%|-ly)tZ1ee((WAtmNwf0XRKL_{qvSr#X z25_wI=FRl=QMTup)A8ugo@!E1oCeUxh_ew=el0@I`Ql&aksbPmgaodPdNf#7=HOJ@ z5f8fxS9)GIM49(QkO(RGJ^l}xjw}}5r9-+CRdzG=X-mdaf80_R2mcP~ARpm-gJvBR z_blY?5y{V^jO)!uBYlH(-J58d>hsj65^`AB)GXNbt?-t)oP5Vyu=#H>viV1iP6HAd zU|q5u8n`+&3p*EIvN>xAsDDk*3QB1?!HrOxe&*{4#|XEe7~{Gu zp9Y;(^B!FxMDo;V+i1-dYil+pP9uyZjkSh6E_;YFJ=8nnuSb;WR643M_RvWl3|twD z{`@ys4$2F0Wd5oKDwYD&4tu3A%-^qT+}biRm9nZ}Y>&P|cYR4uQSoJQgm$`Q?oB5R zP*>6aB%eX2Yh@AI+|jCd{YIn#>z?jJt^)T7YwwjG<@w)ca>`i<*DA;ESN!CXp@ZcN zSR7GWez@a{$HBLa!T+e3^N<}sUYuN(^=Pdj=KB{mG`&48q3Jn}xa~j{O%0~&;NSId z<5FM0*~WBp*P_CNKW}Rg+QJ?ihhl>z%`yySqR^q(fIn9=Qmw#f*(LQ>7Ddlmnj}PG zDMa%NxG{0_5}+@>$3HPtbG@)5 z!?Rb?lY?ezhuOedi|JMwL<3=sAudPL?ypXFK#Sqln2-0_srs6x2H)HAO^pifi6^^S zm4k9eMq&4Hmd{y%kLR$#?osecI;ap*))y3J9V(7<(`r%!=4#I}GUz{im@t1sYc&A! z^TzI0@9*GOe=>yg89iEB1|&^4N2ZSGvWlAc_}+a44ffK&vL*!%Z?ZRHbO$Gs$Z8iA zAH@`0P+GXMx@%oMNQ!IlNlA*Nnf5u*Rs6lWXWX=4vLB!w?b?Pg`4R1f+P{6qr~arv zFaYoG?9|)mO^^Jibk3C#k0z9kNpjP*v=YA>hK$ zx0a3-L)mArg8zDaUefr=LGh)@6o?f=k>{RLDKQKMgVOFon64u0W~cQXW07N_Ox&D} za2{QQpj-AV!{r_aJ|$67@)bf#p(0$%2kX-WB&8abS?Lj8!Hjc_!Ceak`_0~YtcLz} z0YM*Ib;uG@vbd+Y1wLxZYm33m*jCO3m(^GgTZn&C1rO+_GT#G8lwe{VPGJR_q$HpQ z^O#|@z0zxmsVNPWA=r}@VL?M#{#&Ul`Z|Ha3`GgLo2fhf6v^<;*1TIrC3nk_VR-3Z zv+Q505#3*4<%zpytTL~}CFr`FgrQpSH$!r~G!jXVT5&eRWVjupw2VF}7(fB6MTRrU zk2Nm-jF*7K-&;};Q8ne>wVpDwq_BITi~5u_3-g$MsAGA(`SBD{?O-V;Q0InAIbO}+ z;sce#`RC%t&xCBTKrUU4=im>?>oFpLw@@&mH>WvmhED ze9llHyV%;@GW5fU3P?=K2xtu=zv_<9lD6(TL2y@(G7Id>p*{^*c=Zt~&|fRG%A=T9 z@mo$YtY=LN^1Jo%^eSA?(Pwyn<=JIEyk=q1*06)yv^=k>8LU}j_tnZ2qv~&}zG+}% zN1E|c9Q446r<__rm)`HRY7E#jYWs|VulzNe8~GcS*rBWl+q=8vd=0p^uH|pSZ`o~+ zUX9`tqjx*zWCmL*&g_Y? z7Ww(zjvI^S-t7INeCXCwh)`+2J^3}&bg+UTtrp8r(`#12y2B~0tcX%^1NxPeA1-sr z$~GR<1=H(4u?YxmmCRI}G2N9^WxCDS`WEnYkABD}m}jEM`907w%6j%t{G2invRO`* zX2-H(aaL|y8G(Jh?SYOtYv>q&>II?9s77@n+}O|}B}XUZQH>*Njj@Y%Aue5l&d)o9 zyz~201@a9TR*1Z8|#mYAHvDxoL3JEVvCq2w$7nibIZ-ojj z+ig1Zepjlo=IVkZaI%`&ui9dPfY;HSQCM8dyxK-mm7jVPx=0tvmyU}4dlI@={veYe z!xRf|H3pJ+ar!spqBQGjj!0EsEH00%lDa=>ia-7erHObAXIPch`JWZjY&$K(I6~(l z=TB44M!lC`ZKgI~_qM?;+;kKI=wQDT_xd8ub?a z8X8rfd@CGpq~@!`s@|0%gTrL~W>8A!cZ@<+$=4`wooRT-Cf6WIqgRw7Z6?oK+^#U3 zu=sIYY=2M)AL=2cY?uE=+b82<*P-vF0(Ob@`hu$;AUEG45u zmk+(Ko^*q+n`-1FLZT1R9ewE%OG7>RL&Xs$rV-1BY4r1vPt?B(2hHjQE#fAjMXE?n zSnB!_!6}Y{?13&kU}EUi-rBQ1FisRbtgE_5NRBa$)P#y_3nXA#`Z=Q{b)lw+;0rPn z3yWqiT(`NdzSTEnHkL8YOfe5IKyfC6wTN%R;1_RM8S5>AqJd*XmzWT9R_A%c?jO?d ztPr>nvTL{SeAWp2PROlq%({u1x?eLHa?24!k|KTl=3G+t({jo=jzOLg-LNb7A11xh zi}J`)Xf?fM(-P^#SV-N4z1mI@z@*65_p&%2Q7)mnQ{6&}tkgBnZi&nhsU~+-w!3-f ze$fZ&SBJtlGm|3BPf{`##-DHAQA+u!O!Z5lSlo@ND>rB8euq++B9;9v$LJfMm1TZf z_r%E3FH^f_)7Zy0z+>zh!td;ca(N}uSx;(1)$x)x8Y-8LLf(3Hq4CVZ zLWtnTCo+7Mp|kR4ukrIX@xDJl-Weh#fad{T3h{KSQn`qPi-i|;tn0})v*0OYgIEjO zndhdH9NR`ju2m*pbYd@dExRDD6UZSvmhHzNYAh*))%2;@Z$OH>OYH7Te?fg_>y3T- zAVVM8*GvED*2AGP7uPSFFsFHzc)+};HKcS4OZlUd|ZGFvsd#~a!EBNFrT4oGer zvs)k((@3YS^!-VBr9rDjXqg{t&NmU<@^7bz2Rd5PIFlCLU5v_6iBqwQ-5ZikdbYC1l3ra6; zzf_}HO`HDq81}0IR!ZeviSo+HXNFTk)mBRaO2`g>Iiwp)OiT(5j}o8-|+a-qoCYCw&Dk z(IEMWt(`~v0v*BrY1r7=?Ink&ZJg`Lhy`cY9?GRvn~<&?N|yGy{w9u87iknp!*$6e zpdNMRd@NhqN!5~7hM*iVPJ;(f4hBCk5}Bhv#$O0^LZV2BB*X!8hc6p^Qn*?V#iSH| zcwK?z)t{4!Be6ZX*hd-pQv0FDVYI8=^E@0f6Dt|+wQ6PbO@#M%?=(Z^&yJOk z{S=?Cqix{8$`@nB`y#rTN+5Q?GlzNv`})YV1FO}>u>*>F5DW0^NUr-BT~RK%@t0GPu#~WQw6EkNM==H)SZoY>ht_k>20;tqWMN zC8D~)Wr5~eLhygl*6GGItk2*1CQIJ`<@Nacr=7h1E$x9!Hli{^@Tv+DCZTn&S!Q2; z;aqz3KJS>bHUOWd(<84Ca4i>Kfq5wlf$-z~Lw%6g1GR&09l52j5DTqdeIuN!)P_FR ztx=t{P(*Znu`O)(Xy=;r^QCCvtq!OJFR9<*x-6Kh1q1b7lH%nHP0hbkqqDMj0HfCR zH~9+8OmBgii7nzhKmRGqCgV#sk+~DAy=3!wn&c~b8D^6A`gl+9aPH)YYxd=$SzSXz zO4_t^^isn@WD6Jr1(kgKD7@8^d3^b3>KS)Hg<>XHAE1^g{%yPZvHV;o>Iqu(iOn!m z8^?I2$d>a5j(z1tiZmAStdHWJNLQAUG{eN^M@L!#hF7gnQCTnU=n za?p=SjSEaDfkS0wF9Wzr1tny+AHEzK8L0|ZY+wRi0XjJ)>9CgtRq^O!^pEqljc0~BvL*xAK4*Ecs$-C=oQ*Q3-_dv4Imdi=WM^N9V1 z)ASodm}x68KTRpW6jkArtQZBB?v94hx`a-JziXr6x<}iO6`Sac;aRc^B6)Y--ufuv zla^Y7aB?|0qWRW;bM^~>{c@7DfCyp##md^Y>}m$68x?}V+P9X6Pdh#5e|!IK0s4e^ zckV@OdWf@G1O7*%MazW3@f&zaM;ZFqUoia@rP*hXSdtP>dSRQBT@HXvGk_<~$B8hV z1`)qcX9O2wy!f8l0f;?=-nRMA_LTitbuzm-8nAl<*Bbu@-{Zn=a57j| zHa4;Y{cgwQXN_S8ztLRi~nATSD=S#l3?nCKawElm-cY8G+%zCeZsjTgP zUSxH!JCwu7@U>kI#~1oBu_48@X?zh8+oV{9xM`4{x<~IXA}e~aH{nV=q~1Fyl&2^= zF_9Sr?ILeC9jNyTn2>9rV@4%&OvtCFXRMw+6%834*3*xPOX3Thpn@70^&Y$eQaWAJ zq5w1+UA<2Sfk3Wv>?uu!Xs%?Hm8BQc1Wn>_-I*(XN@H-guYy|nRaFw85~%7*TEFoV z!3}$WQ8h-%xRS&Q-fx|4@{Wl~7RDUk2aqEur-cRyp=O4LG~dnE5OEmHus)n1A}TVE z$NLxeiQR)75x`*_9)0f8Gq_|tiMS&d}`pmS+XZZ;sS?mq!n;L;J z8Gw>!zDn7z2;tzy54cxXHnZf8sZom!tLV;eEdlEXNrU;gmebuXm3y|!BnGcInUSsM z*9;kL?}aOigsHL33ihe6jHVY?f-Azw?BBcYg6 zOaa8IK6y<4xJ1JFZ|`^N`QEBdZAKT!Tm~6HJ@St$d+~Sh2;j`y{f42r4;_d66rq3q z*o?15>ksz||8QOOF5zExjX?PR9@Nt6X3tN8rEZn^=;-JM^4M{3;DcvLrtd8WIyw_( zusQE){aee)La>nRp^&EVNyUuNV-9t9F$xiOlP7UCAs7-Cjl4*dd0`FEaygUg~sP>J9gNd7*zVPC9X$ zY5NgOy|TV!6V*)&0zWKowc{y~3Gr}qETrsq@%+(b+IYyIFJ|{(XBAzrg;#a1)E2y0 zVu7CB`X^BhcIbLxIv}x(RaoySD(e|`S(?RlumJ$CoUUxuZ!L3Lt5VgBm)XMyu)W5$ z&K%Wn>cXO@(Q!$kQMdQWmswedHq`S+<<`ChB;9yX*q0Ad&&~{tml*;8iQRL*N7nPF zn9=7|W;$K})gonyfwmlugbkL*EXg=;UuNa0$}Pd1$LU7ya$2Vh1DGGCt$+85_B$1-hX4V=0(vx zrNwyJFgci*m<|!C;U7fs(%S`+8LI60djW_`xy;t@hwPp_ZUrzWr7l~IU~x(D4^h{T z;Z6S-j+=5Is53@!Lqd30#^YCDyr`jiiz-;1iGc#%8n3;0qqUJ?9o{+(2G(Y)qgSlY zh##beeojWOtwnCsbsAZCQ-c&XIXHCV)nIvfIbBv`sj2J^{W-A#+iJ=g#f@J@R1FPY zaY7)MOmziv^B07=hcqxm!APz|tV0^VhUPmR!L9Q6zZzT?0{T&+l`D@FjLE}e+by)A z@H5-WI7qm2$^+++Ff9J~__cAJ<=N}kC34nIE1(zOl$ka_h&YtexbsZTmuv}icb0}y zHi0sTu@JZl-JBmYL+^}-?n)NVf&-=6X_OLRN{m=IRQ)>>3(Gk>J3C?c0S(KUi&|Qs zzwXhc?izYmC7@cc?S-&Mg}0q5CPPLyH{5`5ECHKbL`s7^CBOja1O5?8Q_jV_oE{Jo_DQG)*Us6k!b(=#wZlQ0(i uA356isFO@SQ8lFo@h>S4CJ6&)PG|-@!yB(Z&kH{T9vUjz%B6~y{{I7?wFScf