From 0c7e8b569a45670bfac4ab2c14923b104d7bbf93 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 01/30] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index ab02082..d86dcb2 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -32,8 +32,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"] +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 7476a1edca941b70a4a6673abf9a23d22d98dcf5 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 02/30] Updated Bad Lists --- AirlockTools.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/AirlockTools.py b/AirlockTools.py index 180d624..ac76d31 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -34,8 +34,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] +<<<<<<< HEAD pups = ["logmein", "invalid" , "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 0b0fe288f1d2134f39f8f8a536633f65fd440682 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 03/30] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 6454786..c872edc 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -34,7 +34,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 536227f3bebda9fcdc938bbeb626875bb044aafa Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 04/30] Rebased PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 9180503..501b8ce 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 From 92de8565bde7465d6e8b8132ed695db54f8c12e3 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 05/30] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index 501b8ce..91f1186 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,8 +35,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 49e02651f6becf382d1fd0de3b242a129aac2c35 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 06/30] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 91f1186..956d140 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 2dd7b6fb48c2d932c96be2143e9d1fef0ddbf426 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 07/30] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 956d140..a07c46d 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 7ba125c662059b3ccdef29658fad5e7dd5e0266c Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 08/30] Rebased PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 8da894c..72bfd9a 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,7 +30,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 From 7c99a5c0e55f1f2c6258daed95c20d576c61d15e Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 09/30] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index 72bfd9a..27bf088 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,8 +30,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 4d407d59627cccfe135972a793a71fb52fbe5ad3 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 10/30] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 27bf088..981aa5b 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,7 +30,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 5cd3d39c21457a152f048b9b6ef44c928139e01b Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 11/30] Updated Bad Lists --- AirlockTools.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 981aa5b..d74d197 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,8 +30,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +<<<<<<< HEAD +pups = ["logmein", "invalid" , "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 641c0c55516aeb35f6546a55cddce56d0848ff0d Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 12/30] Updated Bad Lists --- AirlockTools.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index d74d197..27bf088 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,13 +30,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -<<<<<<< HEAD -pups = ["logmein", "invalid" , "nmap"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] -======= pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] ->>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From bee70c079b0dac68accedb9264f2e8f604fa6aff Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 13/30] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 27bf088..981aa5b 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,7 +30,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 2fb65f8b5cc567c1ab43f7564cd4f042c6e3e589 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 14/30] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 981aa5b..5618e9d 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,7 +30,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From e58f6c9e77b44b1ca758e6d0ce347f9efaa2f567 Mon Sep 17 00:00:00 2001 From: Zarithas Date: Tue, 30 Sep 2025 14:11:41 -0400 Subject: [PATCH 15/30] DailyBuild --- AirlockTools.py | 6 ++++-- icon.ico | Bin 0 -> 30903 bytes utils/clientfunctions.py | 3 --- utils/pathfunctions.py | 6 ++---- utils/policyfunctions.py | 3 ++- 5 files changed, 8 insertions(+), 10 deletions(-) create mode 100644 icon.ico diff --git a/AirlockTools.py b/AirlockTools.py index bb7c7b6..6d1b728 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -23,12 +23,11 @@ import utils.policyfunctions import utils.utils as ct import pandas as pd + from utils.perstscheduler import register_function, run_once_job, recurring_job, reload_jobs, start_scheduler urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) - dotenv.load_dotenv() - #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] @@ -117,6 +116,9 @@ def menu_main(): elif choice == "8": las = la.getLocalApprovals(url) las.to_csv("la.csv", index=False) + + elif choice == "9": + pass elif choice == "10": utils.clientfunctions.moveAgentToAudit(url,"6a221ece-0c10-4eb8-b1e5-06a1000a5696",policy_relationship_map) elif choice == "11": diff --git a/icon.ico b/icon.ico new file mode 100644 index 0000000000000000000000000000000000000000..eb6d5587ae5427d0b366b60062dfe9b3c429f86b GIT binary patch literal 30903 zcmeEu^;cD4*X^bo&OuT-1VkF7J0zsLyFt3Uq?PWJ6i|@vQo6glL%REJ-}nCbjeGxr z?>L5@&0%addp~Qgx#paY0009Z0uTrQzQ_SqH~=vJ_m2F($4dwRkOF>rJu zi~<0{!v8(~fCd0tPyh%B`0sHLJ^;{@{CofJMGl~e1Hcas0EkeOm&8DQjS7AdLt08) z8T|L(PlO=Df`7-xS#kmZ46>D&n4+|p7`dX8y}6aG831@>niv}LcLMMXi0J5zo^K>X zj^$CIaZ0Fvu?PqPA?Vl%QD_7XaJi-Sv*gyyhZ{;^XbwdMc(ic)Si(P);cJL33y@jM!fvRsKjXf3$%`7(;^PEP-2n5PjXZ_@$nNZ? z1v{S+;jA#pla1)ik&PWJ9ANLr@~HixaKYUgh=@BV$dv_Y=;(_&gap)f6kV!#EG(z> zEG)KsF%Yp3X%S;3O3iSD@U)2u0s=us3&XW9riPHVj*bpo3^Zh7I~AaLIE#V|d6LkH zKsk^y8{HGVAKgnh85#@|Oc6{76wL?;N!qR{g7;)gT3kfcBlDB8z|dPI9Da+RK0jc`!~Lo@&}7zT<0{L*BAjPJYfX2}Cmh03G5lbdH! z@m&Z@m)5ng02IIsgS**vYMj`=wB(p@^{t+V5AM|dS*QKet(gRx<(~;73;?81lcB?_ z($Z2o89JPSZ70E;3jK<9eP+_{dysa72=U)-0p!Tx1QFsKav7t$4^Ph?{E>O#;b$I? ze9Ko}!zEP=_^6*{X%a?vGlq*+PnhwdmPqSm#0}GFptXxfqq#DL6NkI+(qv%+7LO1C z2_*uPWV18pba4*SnEY`%e5rU-f)8cW8`UP2b9X+^jBC)de5RB^yZS{-4i338^)f(_ zDaBQXW& zu>zI?AT1#;UM^}F^gk2~IruU8e+uT2;3)rp3+8_+82Fg~7EEojfYiH>IK87o$21>a zNkDNP>2QcXUE&4hYJR7~^CLHo6J=n)5m92gRhkPA|6)w5fj}gr|2o5+s2PXGPhhhb z%}>07ppsR>_>^!ti>HF%WJS){=X~WtwVKc3x!rkWC|fHi{50)@klK?!qQeN!?gnNwU5uzzDwvIqiFWc`-Fsq>}*nSHB0L1>5-s8uu@V|%&WDM%}fxSoSpf2dGYY^ z6%-UCl6iZM+!l}A68fq6&9rDjq~hU$cK?^J;iW}wu&QbjT@?oHub;YvX@CCsfvhlc zcNIf+b#-;0IIa?%k)D283hWZc2?+_|6E z@FT1!GKHy)&Bx^Jf&yyk_#tz4imi=}Ac&~HHvih*9x}kaahRN)mDSw~3zU|^cJ%ao zFfqv=HlHL=F`c)rEiW%`yIVeR^Yz65;MZ^=$neIn_-UVPZ5wpU)6&wwkEc{K`c2&$ zbxll6R8&;nzkeSnOwP{k?CsrLQ4ynTz4cl2+iZwSHy50htu4dDIRdb-xcElejW;Vl zKmX$5LNJG!0G*SABSe%UXEep~0v>=N=i_^j6K27AJUmmfojpE2zQ4a89Q-IRKl1zc z@4i0dT^|=07dJOf8XurlHH3ewVA+S-vC{zL)eH$Q(pJUm=nILGu>zw`?3 zF0J3n+2_^P*7o-HhJXLS?1`0YqN+B%qCK;+f(axgC1Hk9(VP$@P*m=>l0w&aUyvxa z?(Q1Df46jYuCA+7_kY>hh6Bc5SjgA|p>QLfl>7cz05Bf4lJcw&5VKhPqW6M9RE6=? z`!w?(cK^Sy{U5zz`46_w8QP8gFSh?r*p5W~Uu-{0{V0nw|GIaSN9}0~m6{z*;@4uw zSSP2IB3~XN^*#X#BaNW3akM)g6Vt)(&n9_a$Hk+eUs7*n!-*QHtu-6QTvYLP;vuXb zkY&;lQ0s(GVc?Vs$kbfhns5J3N(hyD?~G)nbw6q>Uvcl=JdNJ?x|Y%bvF-75IT*1& z+5@ZhM`75cmV{o1JC|F%E=+WOeiy(Yr=phR{LD9#3qp4hYY(+_q&Q`CWleA~3@jiW zZ>nV;tt6wSHqCM5Pcg~y#hFPuo?03#525GV(WG}8U!$W7Zcy-0^?05y&OW9vwR&Bl zDs2>VNGOFkYjyL?8Z0d@x0>`~O2<3sSIiPcbt_Bi00pJ=fQzf^xz>qZ<8h)!%kjLX zrly^po$T!FyE{)f4IGKi)yTZ1MrVsZp%|3>Mp%W3tmgHLV&5P|p0CNNeIIXGDMDCj z>=Mkh&_kTKNxW~4TU`%l{$U;eba7*2V_h9*OmFb42_>nYL50}xx7#JA$ ziXo@D413ln0^ZWe;Y&l1}pQkI0SwFKvFrlruy?xo#un&=7TI z(f99k#F$j#@xAU~(>`=89Xok?xH;7Lve#>EYdeG*!ahAaD<%_Y==FgzE-#N#G`w<{ zvTk5N#+Q-}`y^!Dp#kg%kUT5xnKkgvNVR-B?B=Q0WO(Tt97I3{kSYHBsSxseOtp-s z3=HZtoKfrbGK$vvIrHt?x5QE;fPjDiWVoqfqG^cYd&LSlsO@GVyu7@T7%LqV*f_}aVt(Ic!M5(^ zWOa0CNLE3?puqv=A{{OVT%I=P7Z)J(#wkxZ)8Q!Nyh#wt5%iTI#wJ_=k-f_7@?v)s zW^L@7SV(LJm;Hf;wU^iZs2dn6Q!#5d)g zNhD-sCnqP&OibmarMymCeSgBRz;0vE=A)&kxaPo}H@cD^()oqOU=fGPWwlO!C z{2hcdf;$!!h#?hNXmUL)RVzb8M8uIedwAlqTRQdNr&Y*?52&oH92gjwF4Itum&eva zr78LKOYt#TdWk6PkCB6dZUl||+x*1jl$T$=57%ac$vniE3H_Jmrdv9>(MG+ag))&* zQ3xMk`?j6tZR;GkW#4{|UaahLylgBgsw*nOi-Cs?^slccdPR-U%fpp1Tv%8L8*Ib@ z{Bqf!h>S#yXS%u!rbf8=J71lgj5p%RO)Thfx|YIh5IsnV5)M&TS65e7h6T7!>Kj>$ zLPHUaQd374ZxK^9cWYzyAi(1-ZB$FcK?@H_9$&HCfnk-F^roMhQ45X*dd3OYX ziCUn{{b)gg&7G=Z_VD6PMn(pi0vsfEFB+Ha_|??ZYTb?&wg*!-$37-AoZa~x&irIw z!BSIIT~pVr`2i1M>O7pS_{5n(E!|l2=9^pwr+~+4Zfh&aU6tS~=@y!Wg$44-uS%&d zPxr2($j5(F{$T$wcDJe2Txs5!lxpybq zW%2QFVuz+9S56k|nUiQRAYEL3z}Un@5C`Ip$q$VReOzH+?aE6!RQC7b><=w=A)%b> zEOw08m0}Qqt`27p!#)nU!(Vx|0s%x)z+9Et#|1U9^s1_=hzOK$dvs@5Q4}Hj)iymH zoiei5?61u@GYC!e^z;Bogg9WhSog`)=p;9BL#A>0SdlK#t+ER44Z;~%UX#TNvr|)B zySv5ZpC|V-)6zPv4h{}3F;P?w4-boriqI{Ajy0Zih~Ee3yZ1aigy@(U7znE^o)_zX z!sh3-ehi!Re!cS%lu%l-yE#4m+5S+V0NO#opxUXKrtG47nw&FSxSEkgW?FY20jEz?U>%l@$o?Sk|wuD zJ~%UM^U&3kUYGs9f5p2BPKf*=kn--?3Im;y`pc`UH%dF@neq2r$aj~8vH4ER%iBzk zed&X6LO-7kFrUnyp56#$JUa=$Ahe_R(pioaoBV$WhcNiL@P7!$8?>E>|0Nv%6X8I) z`@e)k+eQ{g3s11V^mSlSFsD6&UNCyYYtkT0nt}8+`1ibB;{M;yD);20LvwAa;#0r# zA6|WAWG8K=XPYu^1>VG%B()GgWcA7xS`F=pug;G&^p7aC5r` z8#dAF*P)?dH6*55*R1`5lbj+?*F)=Z4+<5!;t*(m_4om=qQW_iJ_j{Zp zLc)S~SgERF1CUWsL5>7j2}7kYov$(r!z5_}Tm7{4G^Q$!M2r?)p>E>J%1V5-1wNy8 zNJ3QJcRe&6z_2?K{Zju0UKK=7S4&Ge8k$hZ?_#Qu@VxN*HDoNT(cxi6M#fKecG;<^ zr;PPcdn6kY|bUOB3Xx_ZBnm)l;V$coB&CT5%&1tSE zC@sySlarIy&qznN*GopUG%L(z@$sXl z|5M(@GvKh*2X$vY7d8Yt4F4mXw&7}zD1qDk>ODM&!0-)qU05!Ync>?}T zkk+azD*kd<7X=!?H4Apu{JcC=G&D#0$3qw1=B6eFypQ(w739cTT3Q*LpC(8f#t6lg zd`{OyR8$g93LTZ2eO*H38GYk7eF?fD^+pzMvxcP^Q*U&fl$K3SPO`JHfqE(cjCQRA z*jaJBuKg09tgfnx<3-_>vD(-oqLdgH2L&v>S7zqt(_&+DOAo*y;mFNfM~4Wwyne>= zzP`C>_qkIZt)Yvjj);qk%dPyw0qf}K2#t$-^7R!AnUvqHBmsuZot2d0N=vP*tUysB zl|x5c8=0cBvs1n}L1PNkhrfirFIsioO`|$R-wFhwgeKwbTPtaQgB)_?wx9dK1c11t zq(O@ZR7de1M3tEtbrDF>K)-ucRSA2p!M;+#DxmZqJ2g5?Y0C#HVdwV5$^yJKpvtfBPJ?3^YZ~tcD1BPOIRuK*DsbO zm&?Sz>+9>O7_4+}q){<3lc}v%T0Fs<0#<=P^SeKu<$7ft8N<5F;Do_F_J-CA?s&;& z=7-iV@|D7`@w)dg9Ux1o&~4n{OEZ3GZ+jt4AWseeA2q0J)y1I|oM~jt}tWn*00#<9= z-(m(C7!_kc0JQL8s%wCP$O;6Ua0ecs1Ij8YwUchHuH9W-w`!3Osv)rrRrV{%X=jScbCrN;Tvf6Y|5Uj3p`+lW`u`#7K_R&{t zkdhN!79zQjR?jcZ&+nh9Phr7~1hTsA3=x)NXBBmL71Y)y5xpuS{}K0yy`~ZD>gp;u zbrJ?l-YSEj;^f3uygvK7;qh#l z9FgYg)Y*1c!X73WO=8-pTR0};GI z>b4O*C)si~`fjfpWqBGXB-_aTO*x8|ay?X~1MUTUmv zYs-G;-IGTp*t5$S%_`bAH>WB0X;|a1edAK6_tk2DO(&7-7VdWR)Jo68RmlM+6H`^ZWuq7}rT z1-pT(ifBZUi^&4p1n;;VL`TmJkw(WtXoZi^O_xOWbXPmNtDH=dao2EFb60acJbemq zai8}5Yk%TC%`&x+r}9zOa@rLw zoTWiZ)hp{4?Ga}6aYGxQ|0f!S@@Oa^HA$yo&FAYpg z{*8$1DX(1KUwYMSqAB4Jnh^KG z1W-#~O7HQ~MD`|k*q=^< zhsTRis8WBd0^x#Mh*Us(7lH@`J}~-H0Vv!92W1d#7b^^ev@ZEaC&{8Kqobo&{T}4v zsgv4tgn`Od)BbqS_TXCa*zAk@BlBFcA4L8rGAxQCAz}%A0!7YbW`mV#3k7U}(F*d79`K)R)kunKB&?*L!Tc3F;z4)!aO5uhw2BdTQ-n#$}jk>C>(IFurU=zmQ z8GiTnZAp2#`pS2fsPEP2g?kEFyzkwQm%w&~gewrp+H>KftGfguxsnYFGP((TEc`oq zdR-=bPvPzGEt6~#J~v_kugig?cc9vq_#78{On0U<;8^zKhwaW#T0}%dmGvOW6r!uo z-q<%wIGFI;(?3{)wTP-nVSm0&z3$PpvpXJ2V}IG*j43PiyLrn(>6kb*W9I*GRR4-b zHasGNmEMaC6O?H~5P4XHf!f>C^*)P85kL-OP;M`hehWX z=jP@D;gCkW&$?T^UmULv)X3sKkA^5Hw);KZKR-RFOgkx(3HBlLx*n)H|NIb7o%O*m z01)^2JKo!odv8-eCsZ{uFhEa#e^YBS`}}yJaR27Vbue9Ikj5oAUTIevOMrS|Vr|9* zlu&ie|EFG5(-&cUn1WzXH2wPJi&^w%tI}s=ZkJ}=a*<%f;T)m%f`Tqf%RoPoC$Lpj zSMv=TqdKFgU~Ki;ova$Xu;fMol+IuaFwDL$3+z)oFjrE7B1G}_z6YOpHa`!j#1Yvw zh~ULaQWL z+UPabR;j?jBltx7dFIBDP<1vpH)BZnLO<-hH>CsF0Qc!|Ao$B>?~dR1-VvC@Q-h@D3ZxgTJ&xa0sKgfSgMNEVM zUx|5^=H|ZtY}ST9U=fKwPK9)w#~Lt`6CN7S+eeP06* zwZh^B1?hMKllH8Kqpkh~z%ckF&IYt|Ep2T%3WXPUn4Z@>^>MnvA^|a#upXd1((JAT zjpVPJwp0PEJ8lM#SF_0^K@O3y0c9FxHrCcdHn}jd!z6+}nh$IkU{tB?<=OieS3FgF zz0IuM>sT?Su)LG1s`H{E8gEKuGQ}^TA_xpaRj+L6mQ|FLjN~p~ZPxKcxFtIiP5eFAH38anN+wVEwzvtu#&!dyUCWkfQ zKcaKejebW%(}TO|GNAqY;&Hy(LgS~lnwD0-V`dgi4OZXh8T~RC3_`?$&pT&GF0xy{ ztuloknURZ87sxpxPn)(E0pK70DY=S>D%S!4w~7`DfHzDXter$!y~+KRL4@=5eKsZC z18s*OIWMzbQ-Nc|3~Kem@AeKhG$|>m@TjQ#ebQ-V4Gplc$PLz9c)?u5drOE!Wm{WY zW1|)X{!}}9VjT=b@MXzAJtwfzAd7;`+)_X}_*z^%3WzFV!3-0Fgm_-;2;6NYfWZXt z5J#eT@^0W=1%poA(7MA|tgEE{$_NP`wUX&4Nu?g`9lChB>6vN$7LUrBn#;{2vXhls zB5419!o_mkr^Qe8%QTV38P4$?0OTnny2?b+seivXxXS)vHW zVo78WxLHcVXj7#3noz*xk@tzcdOF;!vWivyU|%Cfj-2<%fqC>BEr>kwx4_NP#deCp z^}x{^p~gKZ{N*B+(qdL#BtL1)zCaR3Kf2TT^532sMm=^|Fd2rzYk1&rig_Qi+rK-u zN*Y5eAm9sndO!VEnYRq19X}0TTKvBJdft*8TdNyen9=dPbnl|qj})h*q2YcoH9C~B zN!RSWTcb|flPO1ZD)|UHdw)%fA9_imN z*gV;{KgCIsLJ9@ff%v1W%?qM5WjfFf8xUH$t-#t zD_Hcf1>6G#u z@>aj8BlBmVjiV3_i;f0Wof+6xf7|&cj36(0=H?lM1?n115?*TsL^Zuwx=8-f-JKm! z*wL)~Zqrw~w{d$Ll3{=R^HD$Bd7PM@hQ=J!*Ipi;ZfYpX)hLZEgJb;^Gn(B`HA=oJZ-6a4K+yL-popgwTlfa+ zH3#GeVOVezx&JGp=zeFzJ61>WM8*64;+$;HowQ1mUNBIj$?@$ysx=&n;-BdfY~g|F z;!#HMbSd~>sG>ms6;!24OX;<1i%28$`dGn{7qjJVC!+@L6~+WD*|AgO{beHptRy_+ zSQVgz1L`&myq09)N{-jp^V6>K&;hzrqKb6fwc?HE829rbOmxg7T<_Mm;G1f|oS8*3wErHv$+!P5|H{zoc?&F9Jc&RP^p-FH zOziZ=kX1nK>1=*2d{d5Q$;$wg<8P=?vmnD zIk~TzEzyyjf1p9;wf7BNrODUqKnPe&fhC=EP!_8R>XgAZ$fBou5=jCFoVmV7VC3r8 zp^;ivcxg`nmwZ%I6rb}BdT9=lnkYVu%fR1*=`tEY&%bweM z4ASvT25pz~7CB!CSYav8G^y#ZgU1~$MOLYHLRFG+ad3pGvs=`H3Jh9uxefVJDl}ot z3&`0~7jWob8-#o~*C8P9$f&Ai13QUfsu7mdJr560BEHnfg(PjwUi9qh>OJ3F*_(oA z`Qi((<-}8?1g)T>Ex^M|LB53R)Y-u-PImN>BQ@lvDtq2$-z8I*G&T}Kqaq_aK45-V zQxJOM&`zm~7xwjgzT55ee(o@jm7V=*P%PVB3_tv9B<{v!`-ino%sY)1oHPr0)H9*z27#s zyeP=83#NX|e1WG%O&P2;A5MoX>mlQj+YnOfH#&X(+rfz`l@2ys5jpQ05B_-S)>g0g znpXL$=jYplwM6-Wzg8&3h^MBfzY?+|0>qenqV}j_ARS+bkCCbVBpE|m%VbQWM)2Mm zhY~f2wx;HBy{$`9|JdVNC|iwlP&u}ejNb)$`byq!Dh*RJeFSE|Q;usHj2RRg+vn3726EukeH1$L=luBuodsSSX283>Um4UNK?;w9t#m?Q+%_&2BT?3^vV=THuZ4h4`~a(fJSObL zwXOsT?fvQt0X)Li>4Zt0z!Z}Ac^3*g(^Kxr_k>3w#5WyVDKeg`gOdZ|a&p7qunU@u zs+yW}B`UP<-#(lazcS8bl`pPVaVvhOQJ!mH4JR#{oBWPQBeoCJ*S%f=MqKS=lKbT`V%emXZ=_2)s1~ zPb(PR_)5YT6jz9>b@mDy+j5-fPsXA3pKo^)=fG+PuEc;dhn6OB?;9GLm5KTjM&Ado zir*KzFRpjz+n~U!?_kj2bSDE|I2ayTwyQsf{<>|r{W~%bUU7Lj)BE?h&_Gsk(`Yrd ztb8Bo?BsHMY?=SUypjP&9xi3~s%*dbm*NpPK!d3jF3j2)^y2^f^fj`)`b5C^Z zAJxllZ*RM!@CU=>hW82b(nGfA0<6-5U_{l<9rozcLUqkHkSre@>ds~C`!5>^VOd@j zcfll5Zl7JQ`rA?GAaYn?Bct_+!ir@dXM6EP>i(%O@VF@Og?m`2%0|4!g`BX1$D}|L z$U2M!5!HRlLQH!3JN!HhTGiwfoXP|or2UJFiWok+8tr z4B3mAGumq_Ft`Hh2+u>+qi+9_x5K>|KSYILWeL$KQN-Z`mYdy!-GSV12(8jQpsrmk zn|3~>qA<>(2!Vf>Y>-#A z&`!0gy0%|#j`7}FN7C z6L(1`9Jl*x>e>=}!D9%k?LZMI~ZsGb_)GJg0uew zdKln83j8EQi1mLJ`2R_P7j65$3cRmpDsK1mP06vhMQUK29K@70&j^Yj0sfH-B0o0v z_=1KK@j5?OY4g0~%(vZAmZOJ`9*TZ1K>q>z3YP^+RSwlsg!aN zmlh{Ky1HLE&Gw(H8y&am=?#`tPnUe5puB~F5}LI22X&}hwxoHd5Pj78Ab3gPRfi~2 zC4xGnJtBc6L8G*^gat5MU1Gmg8JbB=Q8KS%tKx-}Xd>!RHyfsmP)d$lZC3cT$N!TuEUadHmw6AscZR(ftKU z!!fq45`f~PUs*oo0AH*p#yp1OC25TQkGtl?Z?S!oaT!&ri?u(Y>})*FOEDPk7`^QuLoGNz*D7 zsmSb6oB2cq1*pay1*NO_k>g6m)K_piCX`p{6uFxkN?6lO*^pJsY@^3nb!}N)1geH} zwZdKSk$ez3WK(i&kqq~FXd}ejt#emo9{gs0+fs!HpT6&_jMDx4D(({)g)aOY?*?<4 zQF8XtOd4yfRQr)KejdRYom6b7^V{Y-Siro{sK!zoB~vp9zQllBgd6OLRTgtS0sQv2;Xszo=y0fk|-$GVbO*r)xA4-l2*9`2%5f zI!P!?g7LQjjC3QE+m3yjKFt7r87T(UtcPCiROv?ZA45=HtO%`+jj&O`RkO|ANdzD3tHOQGLN6T4tt_40gXu2*7-3> zzMd?W0i6o0DZaTv&kICA{|wK>t`RKdeteTwAUWAieuoGX`4k#%LVs6|Ms^avfK6DY z%kJ6a@l~v4Je}N7vxWtK-NXGC*Zb6cgYenHj;=d`5oKh?eRJg{ZVuB5+!JNwRU@RSbVw$O2(TtC9V(~9o_4&Y4A zVZrKMeI6Ubh7e$C%VUgoVJ82n_n|x9jDH>nXnC0O(1l z4G5^6&ANdLw-}T_V1XCjf@W+yH>vitr4I;xm7dgp)c5gHP`q0UiH!S*DpBKF?mR+h zk{QPRYXxp+EU%XrjW6>CE&#q#`^s`hG>N;#`HmKPe#2kF#MFiB7&DI5-~2H+(|N>I zO$k?GzS6lkkB*5AGBWIj)_8Af)=t*(rr@B6IW1!r2dSz%AKUedri<}ir8NgX4D?f+Z~Iv0d)E=sMuaNSPTJ8ui4QvU zDv5EfaN&K8<#ebfsDRJyI#SHj`q|yZ4j}^Ck86KA zgOQv^aNmp#a9o6_c{DT%7xH@QBP&yDg*m7V>%a~FFwoKA18pg*$)cx2gO?!m!^0*! zZwWA>Ig5nxy2j&dqZCt37N#ete8eT)@hvI=rZ}lCc^(c=ulQ?=pxkH1$;{8iMw1@?>p2rL|3?MA*)NI2p7co*9CEw-Deuw0 z{!ovx;Cbm-%d|=FVb7}axjVNhZ!8iE!<@{WJbdxt@)m+N>*fD8u9%-5mtYLR;JdtGD@R zf*voyD6eP;j%6%oxP-Nq-4;KkDkV0Gl*0q8g@ur_82?PnA}N-}XU=*BwIudY{)?Rq zdq11bAW-~GV;|>WOp@7eI;KJYT*z{P`PRwdq#*M`mEO!J8w}LW?`D2dU#a9S>q03l zZF^aHNEIXOQ^EtAic#ej(^_$`Y;JGA*2xQ{3o*j86`Tlwfum7)9{FhOD`f6qK|Z%(Xz;L8hE=2N~OFmmf+I+ zBFV8xnXdn;8@I z;v6^akT=*9rwOsAuof-Sc|M0fg^*CLP7o=-OfnFAZpGp2daPgWPYS*GH1d2E7qie~ zaT&>87||H}P^Fk-nqF>GQZw<-0BXHiSuE3FrmQM0_B@nZKfiXsu6#tqj-Z`po zA*~%U@0C<&lfG{M!=U~7deI(S+!-R%nIE>1LDfI z;`2m)ZgAp?FQky3xcL69+l$_p8~@ezy#&zLI2gK$c$;@{)#S2Li5B3lfO1f1mHrK1 z9mJJ?7Xiu}5up*{lm<+cJgov=#FaKTOnS3f>F++6Y5?C4GTNS-N=s#EbYCIZ2~L1+ zqVIN+M%(FcGy~tOq(-~+BBh&*5Rnf?%}T*&f(U_HBA+D!G~Uax$1~q=B}gaGfICtk z-5Zg%A7HF%KxoL#fu7n_k6y$w#ZnhaKY`{uVO9R~vLSrZFbQbedM;QMKRxaW`Jc4j zz)zxSM>-1_yh1rH?9n9~@f^U>OB3>c1_etDY+TsGS5jHv$$jp&t(~O?+QA*NyY#>~ zio$>^=u&`t+G1?H>1-`7;+kCc+0Gtb70YGRIc>{S2Yr(!i;1XPq8w4G^%Q)UBr^;G z*%X-l2*SZUBqINE7fhxb7_LpgOqULbBS{}!%^F}es=e5;_)t45&|*ixz#%Sq9sUGO ztAk^K=1*7dw^9-)Bd%h>Gqba!KG*ZF!Y~VW65QxGW@t^Lg||V3WZ9H|;F`HXdRO%Z zXex3ZnfvHTRk^C}z;G?eFM-cdqXEz;>gP8iWFf7C&`m@KR9G8gEcYm%1j4UKf zVvnQR*)}lP0cuILb? z*HQ2t6SXQXknL%X7@9_KE%FE}+;rMsoE?&<_9BWbi6*Obe{$FV2vgPDx<2?R&N2-W)~_y(#JV^kqK10P^|In1>R4@fY| z9dm)3{$M*mo!@tD4Q41P>;V3!Q{m{t^$F+%^oD5%-+LBH)(Ico_bd1XIeLq*q5(Wz zyI=TXlJZEa0$+nJ*6G56*dD9Os|3|lstiy-^g8WC`X|%9e`_>D8_PUfV$utGf)3&% zn~`DX+z0{OhMctDdn|YsUj>)LA;~niUWjad1ceswyOr2 zKK7Gt*01AN71;NR*|e+8R1HAc6+(dgcdSd_mYk)V&LS zhk>9KPd+%~FZ|N9u&|VAWR7#T7L27#vXFaE8@o>=;Kk8{?@)~#V8R~w*9on37|cyr zF(KA v2p~cYUO!I+A-Hx9S-jwA;Ljm+IG!f_)x>}@ zx9o}1S;6EMHiBDyyO**J(qM|G@j%OtxL|*2$24HZT{hhXqlbgayg?W`^3s1Rq}SvU zI8i$ye(&6NK_bpEQWl|e_ppmREP zg5r;{DW5Xiht@M~dW##jtH0J?pLY9gsWey8h5d)8ramti7pQb^RW z9SssX9^#m(vLo@XvUupHP;T-WEFceC}>vL=VNRLqzF4l&SUgd9U21&u%M z#(2j}P<%5(3C(u<%8T`GMcOuKQOtAs1(NeN!KnBrOyd5k0C3anQEwK1se<^Y0yDpZ zTeBcAE(rLW#bk-zYQWsTt)pFhPM*lHdyAjokDsN9SM0j^MRPj2lGj|xE!g*U7`?#i zpXDwe_uWM@+_mP6B@_|s7;t%f&$ep%%s{15{9&wuK?SG}@jF@)%6$xDtnhbTw*9Dn zZw~3DfHeL$!+VQ-JVNUv!~(e<_D_24ZeC=vuGa8N=+<6L6E)Tou;_^TWPvg(xldkM<_u`raCR_ohM`rKzR3*lH^Km)a>dGo(uU5Sm|J4l>mo$vhFy zc~Mz!*XfT{H-w)4p&nvH?OjuO$Cea^{-)z+_YVvrJQD_#Ty80L6;u2DW(VVGSm7Kd zWZ>^{_stPlH_2oph3~jA=@a>fgy(@8gk~#WIT5VI=+}Orj?8_3h|176Qe{@_v?3u2 z;aGEXQ)5U_aGtat&+MaE-(haa876Lp^Avv<(I&OL(>CTZXpQHac4dr5j{+`2na~fg zCn)j9%u&~sI^CICtYI7-t-1T6<_Fi?**_a?K?Wl8ryrwGfN~A>r|&ZgigSi^l=KOF z&)3r^+p8be>FWbU@-OeuQh#@X z*0$AFD;kOz6Gzs5RKERk=QRL~);MFUwS~2CnjZ6EkI9QaN)$GKA;H$qp)o)sedR-4 zNHVt|*>j2m{d#F2@;*%Qsn<;F;dy>E_xtB^e$>cakR|C1duHPW5J*sdDP+3IE=BU*#phzVtLozn zIOtY!F$jAP{R!w%u?^77_BDT?j(d>ELxAAU?Zc0SzSMBt07seJ?o z`0rpta)z^l%IhO+!pi-YLvT|Zb0tl(VrG)^FQlquO`V;Um7NBfB%7lay54OrYa)s~ z^^k$a6?fn*26~$iFiYGn@8^QrEXZ%#LBvhe$+^$6bIAe}GDq_Q&0*?+uUF)0_fkiT z&+6we5snszw=_ZwP>V}B{;g+E+R1K)@z*PR2&uMfrK4nCZu6;LIl$tUl#4{?SoM=gmBcN9!Sv3auA}5iVE?CI)LIq zpc6@>)@s#&Pk1{Lv6iIr#PHo{5jwR`e)(5UMhI3)gEs*d@w;`5n*t5?B3mlbJakpk z%@L-!^JYl*Jg=6fCT+mgs*9%W_}^|!2#_AflDTeXbMDXQd+q^uA!5zvc~Ulbo{`MlyY5lvrb^k`Ti4CFL13& z2$`m+RO724Gb>mHwnbp6_>U3#TBOL+`RDUFt2VjFoS?Wm%6t?1+VkSTwHIeoF2lP2 zWQsrN-O>^YA^M;Gn2omlUWYv%RlFN!OJdn;kjqbgi>n>+x7(2riCo@6p*VkYQ;zydA>Sf7b;k*I9rUG>B8Fs*9vs-~A zv<<&RD`Jdivqimj$0CR<=rfbyk+g7#G7*G$)Pns}`)W9Kb?aJ>pmMYfMkuWQHR=1? zmsplF7I15jyq&3%7ZU7|&lzs*$oa22=CQK_d|n~YPB<1tT{Fz}K4V2< zsZRarqzG>Fi9#{s&Q%Xg>JhoKLx}e5xZp(seZ$jq1!fyIkCVRHJXQ`OTpn0dq5`wV zvsJXmh}~?SS!$bqLGfv=SKrm-4ZSx%AxqQI;PdWLh!TTb+jfLlYW11Y^D152U7AJ> zcFo^R;(JO-=!6)7ofJRE2R@fUPR8(VWmv+ZARI-~n=#0d)YEU_H4+a8XCRI33mxbi zrkBhO4CK#SXn*~SGR`W750QD^|56~^duTiw++(j;LG>5Ev?dCJ`0^ixdC=-oE4zUY z{*=c28sG1#P#1#QSq3gOJK?HuRA=ywJhK0be0qqxp(69g2miakcn9v*F4-gg~;@}ohdd;G>fi$TTqV8NAfMB+DquApXCE>j!&PP@(jvK@+DMm!c*%XIHz2bK@)ZO0 zCP>Ap_|^n@u?yL0^qGkx5&4ysoM}oP``;(5Yac-%03W<$O>(PpLw?HAMf{DF((6qx-cR&s0!=@zv8nAyNrac}X4+H@Yi-2O>0!2y- zt+&?#p~;j=Klynj$gUVtr-9`Tf<@k0iyNd^qE}yBO(p1Tf;>Hq8|g4bj9O@CFZ7By z+1QlU)Ofz&V^3panhTJ8U>!k_2lh{E~K2Mr{JKz!o}1otOxHMHWLP zNL&h1%jG&gl2W-beN!+p zv|VNFI#Gy#uI|6B(Qnb}HY0}7^>YPZp6Ei}Pw^(WeXCo!_ux;P6RcV&Mzvt4e&kD0 zk(ITnX3vfe#h3OpPjH**B|#4y~Is!Dq&PA{w2 zrJbuP+71uLrCK7htoSc6RqJ1P2pIC+cfW2fn8%{m5$vwKC_#@m6xB~wy4?NgIUGwn z$O2kZwOcYYI#^^hHBp?`2FBtf19;U_ukT?)6sVV?_4B{`hFOv}V>OX=R>N1bkE z1lCklJ#OTiuTjUl=V|Y@LvN}BT`W=Mp<1@mRuI!7WSIwRK%MJm~1QFPp{r@A8Lz5cIzKMQ&waqo|3pZh$0&+ z$QmSin7HOh* z<^QiodTf_CasWJvh<(k^uTsoUey5u%bTeA#EoX5(dCsW+H`txYtvLfhV| zk#xX<vXho&IW&;=Y)gZ?&mY-T#Z{eJvAw4zsCh8OM#=h zs){T5`uD>Aj-1!Fx5P4PF9n!&G62N~l0wRL)=%5xx5&mxGsB?oP@r3-4U=f*l5iL! zmJ^B%k1;5k0`MAL)=Gc9vOFoI)Cr$PxE3s|K#H(mYBdE*u5sX9Q$#F-b$gm4C)OB=j^I-djq#84ga$|Ln<$nKK3G_1--txizg^df0!7omp3XNd&HL` zAa<&61b8RY{%{}&ls(P%`dSNq23~gGOZ%bJ>S&dpg?&dL<%3Ddl32iO2hy zySy_*^rW=g-{pVOH*nqg9<`M;UlN)}#UGAHXlQ9koR0Ln{3)uiOTO36tW?P@T^~#__?()*-(FBw zz0NPCHM7s>bN&N>*+Sh&SlcF6+n%T1mI=)f5Z#&`e*wSc{Wo))it_SmJMzrHd++Tm z`DkV7lvvmj!SBpdj&N?*pvJ>UBe8#Bzc^Db;+P>DQSJu|CqVivk>M)XNOrKeY)F$2 zxD*NY`j)>*fiX!Y>wUE<4&~1Qcz6ip6}?{Og_1#0T;#WO=kEF}tFm&*i3c zrhw6vH`G#;q;D3Ym&oz`ICxaKziEu8C-a~1&VC!hXG@)LSc(=!t%l?h8qB!?DiCt~ zFLn2%P5Cu71q~%n29g49lX9ltwmA<*=6BI#j!8yOqY@712-@p_03YwVXR21>m;uT6 zbm-p5CoQ)u*GUnO58=e&QE(Jfn$}V%D$&^{QBeXnmb&JN0t7-j1p4%T`8t90xeU)c z(g|n%$zZPYfOnWPAmPG;Kp6UQ!Gnfm^&aD-70m!kweZ938KZ!t_5r-4f)Ep#(R2UL zjvqBMS{{`Ye{ZH>7&uSK9J0tdxZD-+YeW|czwR*0}FNQ|IT+w`Yg8bmWNpi)kk{GIimHSBXXR8yao8? zLc;gFlwk-E6r~47)7mGwSP?D6xwzIm;FDNDN7tvD`FJ_Zm1Zx%l=D*ZmXUP$i>h&Q z;u>8~H1=RoJW=Z9K;s?eB}dfS6Jb@*CwTW&k%v~mN{NCgXnFZV9dUl@Kq%jIn~|ED z_eoL8d&!cQ&$#HUithL%GX=})>k}utV_1G3z**%OegyF@$;kcJ8>1qAAt>_UXlxfk z6nK`g68gif@0ME{CLKQunB}rznppy(J2ZIt2R`he{GCjC-vbcJ_z?2>IV!gRLIgc* zjPB;H;HRg(cIta>t)Q4*@Ca6ST|OQBt-pmO`EMqUg161Ro>)E;QKMSSi5SQzdCm0) z8)XPS>vpzUGlY2-*|6L#we^qbS7r#83IR0!vb;>>e1K#&_45w&$=QBd=Cet@Pp^Kt zPIUo*7hH@^*n4Bp=&{|5K~E1DWS^(ohNnx&c4cN`ovXoW>?eo{p(k=?=s;TKseOZ{gKF`*z5l>5?NjjvX4vte}APIyo==Gu#VJ>&;(n* zC20BSzTw`nmGQsB<>^#aQN+rjj*qX*ns=G-r`##qt=vM4FoZzk@MBI;)ey zHJ0f8t_)GOAtj8XcnW!ZxR`Zm4r zFTGNPwHl=KL952dP*?XlXNEV}=e(Frh|vtt3Qq8T!jS8;ZIF_yQ~rSx^$cY3b~Bv1 zu}kmUDky}p=%gX23aQDj7}x0U|6q>9Z2sg|z@>2+AOeI_0lMUyjjc|WZ|{*#TsrXz z%!{$?jNxtj)g8R+YQsUoXb=H@1{Q1$_jGc*^;p7-9iG5zMLfDmJ6l_+0qbmUjKy$v zQzbRhO(aw7LW6ajOZ{6gJ)kF+lZdneeh*ZpbZl_izkI(4)}K0HuOM6($xaC72yjMk zMA6JI$A)+v)UBAu>=}nnqy9d!5`jO~sWl09QPt=k&A^P`AfOSB*D-!wpo^^B7v1&& zxy_tze?|RIsuX|*67jnD>CjgzrI0U^*(waUkpe0d@t$_g7Jv_ zAj5P7aY2Xh9^DY^{Evsv91em_YR`;MQv#jrh^$2_d4SC1r@8IE~}0br#4F2^Ai= z{vd!%yqHa!8_;$7r2;g2cV+6eK>I4=?9x@|QmyI{CDemF=dQ$Au9?8N3Ibdb%JDH2(yd z2oDXKTlBiGBZU8JqICd^C?MGYgmqHK3;>_Fy~g25;%h(0%wk&*KU*J)SL4=?5!dHp(2PeB!<_{U^6a%fj|mwE{>r{o^+_I_F{WB~1# z{;){0cg+2uqN1X#jIRdu<5MI(rJ?aT8RY1Su+}Dp2bub+iDB)1%QDosbi*=8>2|-S zC$?UZ(ZKe#k*d4<1(7@riY)gdx2CA_a=>2G{S%fv8MgAPvQDjVMR$sRr@)*D`ci3y zj)0^oa!^~IN!9HKAwn_f53hk=n&HeNV)zVaL2y&lYMcUgY6@}i?l_win-bZkQJ#I_ z-TR=bJ>y_b=4e;&>iE9f!h{BQvmwV_1NH3U`X?DY_ zAHY->pe^*JH)T(b!qyT{^ClGx%mVUvN^|K3AS? zlzN0IMTGwdNlNhI55#Jrwyt96$)&4C z7l(97{dyQ$YHMDR>G)&8UPlpo6{wHwPqrT+Wgw4#gTHP@h1Cbf9^tz2_x4L-y$6{y)SQl1JV@lF$A^6Wii7 zx>mP7MC=mnW&)S{-M(Kf-$70a-%qGeRac({WEM;VCAY~D@&{}}c}w12Cw+m&zB5>m zJ_<61wN7tWppm}T;1=cMjr9lTq()@>yY8xqm^l>{6%ax3(b*s|e6pG-CPOilsUnLo zZ5UF@`FXFqc$bC2?3>w~Yzd$kLp@!pq8PipfRn;phY60Vx}v%QHec8a6yBq&R0)64 zEuVJnn&z{Q9j8e*j zK;fO__5ZiqxJ^Q#W+BG&XF zLD@%ryEa84BSP~dMxPUE=!Y7 zJv|*yA=hN4qr?%-=CwI+^;#}7oMYZ*o7JUS@oP8)5p+tA(^0wMctt&%MEC)}_o;=F zegg!JF<7_3O4-|642Fl2%kmO1CI9{_*a7qIrlVm7eW)wv40`Vhe=7|N@dJjnPp&PM zast%s)$B4D38@1w8^8@ul~o9PwMx^dLV{Xe&aK~!_vkgA`kK&+9|?{*E2yOegC+po z@Q9-nx9B2MS6mq@nrO%d-F?_zyW>%iOjDE7xWD=7#wa*;^M&rR{P;iz*y)p9&P$ld zN`pbyi0FnsB*x^yGR5fC&9680LR4Wv$6skuf>9wRtSIA&oOv1&{l1muFD0g#yEBBH-I~c&ikK2R6fN>SDeLC zcBA<={;bWyHYY1_5GV)6zy3)8-%L(PnaUJ-1cu${`tEN#+ylI6!Z1rB0(IVr+;Vq9 znyA5zuxA4W3w;95`^<8|Y}vocxC{}85VP&l3gC>dPU^4^Ci0&j4qLH1hTeK5VI z&k|BXA?8R#6CqE8mm<`7;Kh)|c)OG`^Z3PYjZR&D zULK!}4A0dfj=;_9RNmF8!25>$(x~#*u8>RtSrO2(9nUBOjFidLC=9_HnK^E2ktz}w zb6~U0bDcb;4S|M|lmS+u5z#Vmg8Rmx9i0gBHHkt=O+$?yESO!zTPB8vcc7q1%kMD-3(%+izhxp^XN_jbUBDnxL%^{2mMFOwsU zv7?|K=KaU1bx(NA^;#`e2cmy4J~BB}vrE9eZs40C8{lV0o?aefLP>!h(nM-?$Fgzt z!-J}siTsAZYDK7@5ZRmAZ%jqp;8y)HP*k&+NXfMFLUF6cQ^w<92}M^Q9T6@&+X#H` zlIPPhB=I7dKVMX*y6rf z1dmO!#7YtS7)6k*;A~E4Kf+a#@0h!#GrY8XFKf=7kH(Qe_VFcz9)oO*t$q$jk9L{q7^XOlwx3K8V}6=}F0)Rb8Me6|IjS4izF{72Yht86^XUKuj9vhdoaCHhh;x`$TrQxuom z6krZJrZp`uhvpaC`u{sm1EzdTdOzNG8wz?E7Fz)=&Lpo01^E9KT!$dv+pO{WmK3bJ zLeJ8?-C}%!_Mj^ml!W~2yU@(=4c?#8Vg;qq-NN7_RSxb9!zCxSlWTzt{A;h)*3ek; zTK~`jTRBhfh<*M~FC$p;35J7y0}d?(tN-ow=@jF;D`PbcNFi)*Ad=*`<5)s8NoTexG#z5w z5<&T3NmwZRzLBm*ppBW|epehTIe1j$S_2yFr(gO@!HG;MZR{~6!Uu@osq=I`Kj zLZDs?$qQj%gMJ5I%LCe;*7c5+J8sCdtl^9bQ?fk~&Ro);i`K0IPGol|FUA%!vS-PL zkxZMYE0HDD9AcXO8nt#ON%q6z4?_p`4AZs2I)MYWCBIyTc~}jeqwv==_tXj|QyT8h zXJHoz;L8yQ*(+_!1@$m}RJ4c_wkW;_c6_+WLqu75qV6>&lUz)ysQZ_J$cIl#thR&l zNMV&qhjDQkzLjseHg6&rHEf?GY?cc*QNOocgBnL)mM+Oeyv4w$Xmy?E9)0EvCZxPg zVl0Stmiu?mVBs^$lA=mdD3iIvtT19lis#1_G(o_fi(#F1Gx(z=kx4~SYxF_4+5SiM zuMUueTyl!qw}Ut@dv6zpjT&49~p zHomn$S@t_qMx4_@rk|iM5*q@_>F(G#U=~zvNZz@93EekPBV)Xw$jb#ORbxxe&uj(mv!QsP@AybWmU&b{&q z*1JCuPiX>QbV;X`M&=%M+bfOdP_!|p(HEk@X#(E~_hr90qCTF?PD>&Pp*pN<9vk~5 z|F;@%ZtBgajm(PjcE7<>K>Z8f(Kmd-3?gC*2iom3Z6kNflu5%NGl`fooQCRGr#rF2 zH_+(UF}bCXO$F>A;ntlUgEli)`U<{?OBT~z9u?0O2XXo@6a9@_OqF@6mqxx9&(7E_ z^&a;L0KI|=ym8~PWS8mr5Ab#@Zdd)T%xZRv3=yujZG$^sw>I8XZnu>h}Jt2!< zVIp%znLKoCjZ#!pxMt!Jk-Ae*OXh zJpsN`ryuo2piQ}`C@kRE!>c8lyL%^!qxx#nv!@~zA*~sQq_7k&NJzB=Kpy|*4#7IQT=x`){k4wKY0+O4B~SPj8TvXZ z0pFkmy;C?{G9y;nCJBTZnN%Yd>P6XQbW3oDqWP2dE|)mHZi2hz9%I%{YXu zbRYllF%9h+%}cSHaT@tkZh8j)!jARr)>Vg3OF6ud7;}ZKyw4V9#u705Kzii|U#4I9 zs}#NCAFF7re%)qk{oqHj5!9tsld5wQQH<~ya88S~&?Q14NaW2q^hSWTUQ{wYped%d_j`9b8m2aP?zP*>n(EjAvsQ0z~M=o4ry#?}W5#tX=o6fB4 zmwcZ{X~<4-ep-CDrzoH9Y4*kr(R+$tRBQs%MeJGgdZ zjCwAG`#b)keZ`&TMVKkz^;~H&>~R~$kOM2f(FHv;rxG4uV&je5)fAA*8sRl;aH#db z`}|EFFCG=!FyV2i;h1H#DmrZXOpPH<_TDosQy+8R#l7wmKgzp_zo;F81D{NYO7QjX z2udKSooBrLk0^zhxEmc!rmUPs5r!KiAsup7)y4*Axw!6XN(B>eSl8*jwHQTX+wzH>8V`JONojXp)N1j$j-lrU{}sY;=FWRV|%&zEhU{vU6a z;%xqz`>y;%MWmTw-5Lemn!61bXgo3);PE8GweI;$KHvT;A^uz0C`@G{u8ZR9Q@k$* z0iKFE-Y+E*VYVFO2}#as9~Q_eoHYpZKlY;d*s&NG6YvTqdxR)6vaA?A*Ox`(bMJhd z?Rmd^oK7y$to7~s{qe7??s_^|%+yHO>>|?g2Vt!7uTxTFk@f>pz(vLK`Uj`|y`a?C zcNOc3Uyflo*o~)n0_>5Waj^E{l9iwu11Di30iN99xKuhe4skU?EJ`6&1nA!B4Dntn zQ15NZ{G#q!#j?MC8KqiQxr(UmNr7?M7_;TVD0-?bo|32$B ztD(5i);|02Bbs-NPN2u}F#7w8%>uY1j&R~|oUJ;`G5;pNJx!x6R!bmeY~nG!PM36PXBEk6I{?LM!7#1(usmf1dJQj@B1Url|+Q^*rYTjX~^FVRWUPUNRW4H z^9~G_HJd09FfZ{J z)a!&zsB*|M18~tkWh)ZoM$KijeDYq>=9I-+Y#)QO6&|%Q1VKy4fItVW|^zK=aW)TpUgokz>Y^Ppuykz0Eqpqp)_>=eHy+ z?YM^8oIaAglQt=>Nw6)Uan>m_)f`?}(yv>AjvS8*SPmn>3zFAtxqRzO;lnokDpj~$ u@anCY{H7VjD(TQ`0)f<*gNO*_zup^cyk>HH4+OIA?3*i@)X@K51@b@CiYfd6 literal 0 HcmV?d00001 diff --git a/utils/clientfunctions.py b/utils/clientfunctions.py index 08ae71f..3e73fe2 100644 --- a/utils/clientfunctions.py +++ b/utils/clientfunctions.py @@ -90,8 +90,6 @@ def getPolicyFromClientID(url, clientid): policy_id = data.loc[0, "groupid"] return policy_name, policy_id - - def getPolicyName(url, groupid): endpoint = url + '/v1/group/' payload = {} @@ -113,7 +111,6 @@ def getPolicyName(url, groupid): return name - def devicehistory(url, outputjson: bool): endpoint = url + '/v1/getexechistory' print("\n") diff --git a/utils/pathfunctions.py b/utils/pathfunctions.py index 7082edb..e347bcb 100644 --- a/utils/pathfunctions.py +++ b/utils/pathfunctions.py @@ -19,15 +19,13 @@ import utils.pathfunctions as pathf import utils.utils as ct #Standard Libary Imports: -import ast -import gc -import json + import os import re #3rd Party Imports: import pandas as pd -import requests + def split_filepaths_grouped(df, col="filename", group_parts=4, min_parts=4): def clean_split(path): diff --git a/utils/policyfunctions.py b/utils/policyfunctions.py index 53058da..b1d9e52 100644 --- a/utils/policyfunctions.py +++ b/utils/policyfunctions.py @@ -174,6 +174,7 @@ def pullPolicyExechistories(url, policiesnames, type, days, outputjson: bool): with tqdm.tqdm(file=sys.stdout, leave=True, total=10000, desc=f"Checkpoint Progess: {checkpoint}", colour="blue", initial=1) as filebar: with tqdm.tqdm(file=sys.stdout, leave=True, total=100, desc=f"Total of {policiesnames} Complete: ") as pbar: while True: + item = {} json_response_data = checkpoint_stomper(checkpoint, url, type, policiesnames, headers) histories = json_response_data['response']['exechistories'] filebar.total=len(histories) @@ -631,7 +632,7 @@ def getDestAllowlist(url, groupid): allowlists = getPolicyAllowlists(url, groupid) - matches = allowlists.loc[ + matches = allowlists[ allowlists['name'].str.contains('local', case=False, na=False) & allowlists['name'].str.contains('approval', case=False, na=False), 'applicationid' From db9b1226ab5bd1930910bd997c6790bae177f395 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 16/30] Rebased PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 6d1b728..c1a1f16 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 From 9fdae56f167512c4c8ca6eae7071973f9a54691e Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 17/30] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index c1a1f16..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 507a15f739114fb2d8da7be1ce274f6d677eba99 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 18/30] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 432c0efcd906559c899cc3d44a302b7b59511bf1 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 19/30] Updated Bad Lists --- AirlockTools.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..fc3fa25 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +<<<<<<< HEAD +pups = ["logmein", "invalid" , "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 75ceaf7922fc73344d52b4491494b7b0d90f3207 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 20/30] Updated Bad Lists --- AirlockTools.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index fc3fa25..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,13 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -<<<<<<< HEAD -pups = ["logmein", "invalid" , "nmap"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] -======= pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] ->>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 90c74deb7c7751f04b8afc145484e54b472f019d Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 21/30] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 2b99f3001c10629ff42e0e5b93883debc132747b Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 22/30] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..958cec8 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From baa12c8d261be868cd1f2279702a324520f47c8b Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 23/30] Rebased PUPS --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index 958cec8..c1a1f16 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] +badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From d7c55afa63c3e871106123154a11f6436dc723b7 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 24/30] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index c1a1f16..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 8859dec1e017b3f7a54798382e9d8af47b03bff6 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 25/30] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From bf45fe4aa4b0ee54bb36f21d6e46b40ce919e245 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 26/30] Updated Bad Lists --- AirlockTools.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..fc3fa25 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +<<<<<<< HEAD +pups = ["logmein", "invalid" , "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From ddbb2a9ee581c8b9624e11a5d53e6e8a903b8cb5 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 27/30] Updated Bad Lists --- AirlockTools.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index fc3fa25..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,13 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -<<<<<<< HEAD -pups = ["logmein", "invalid" , "nmap"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] -======= pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] ->>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 3ca3bab27e45dd933f6ca6b4423c5f05980b3cc4 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 28/30] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 7abc9371bfd30dfd62392e05caf5f75954916930 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 29/30] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..958cec8 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 4f06b4fdfeb75445c4a794d49d1ed56785975bde Mon Sep 17 00:00:00 2001 From: Zarithas Date: Tue, 30 Sep 2025 14:20:04 -0400 Subject: [PATCH 30/30] Test --- .gitignore | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index ad4a1e5..37c7540 100644 --- a/.gitignore +++ b/.gitignore @@ -5,4 +5,5 @@ *.parquet chunkinator.json jobs.json -*.xl* \ No newline at end of file +*.xl* +.exe \ No newline at end of file