From af1714853f2d738eb761483028ce609c3d58bd0e Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Fri, 25 Aug 2023 16:07:38 +0200 Subject: [PATCH] http: Prevent request/response de-synchronization and unbounded state growth When http_reply events are received before http_request events, either through faking traffic or possible re-ordering, it is possible to trigger unbounded state growth due to later http_requests never being matched again with responses. Prevent this by synchronizing request/response counters when late requests come in. Also forcefully flush pending requests when http_replies are never observed either due to the analyzer having been disabled or because half-duplex traffic. Fixes #1705 --- scripts/base/frameworks/notice/weird.zeek | 2 + scripts/base/protocols/http/main.zeek | 47 ++++++++++++++++++ testing/btest/Baseline/plugins.hooks/output | 3 ++ .../http.log | 4 +- .../weird.log | 1 + .../http.log | 17 +++++++ .../out | 4 ++ .../weird.log | 11 ++++ ...1000-requests-one-dropped-response.pcap.gz | Bin 0 -> 67501 bytes .../http/http-desync-request-response-5.pcap | Bin 0 -> 5728 bytes .../base/protocols/http/http-desynched.zeek | 13 +++++ .../http/http-pending-state-growth.zeek | 15 ++++++ 12 files changed, 115 insertions(+), 2 deletions(-) create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.http-desynched/http.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.http-pending-state-growth/out create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.http-pending-state-growth/weird.log create mode 100644 testing/btest/Traces/http/1000-requests-one-dropped-response.pcap.gz create mode 100644 testing/btest/Traces/http/http-desync-request-response-5.pcap create mode 100644 testing/btest/scripts/base/protocols/http/http-desynched.zeek create mode 100644 testing/btest/scripts/base/protocols/http/http-pending-state-growth.zeek diff --git a/scripts/base/frameworks/notice/weird.zeek b/scripts/base/frameworks/notice/weird.zeek index 0511fc1e22..54527a2232 100644 --- a/scripts/base/frameworks/notice/weird.zeek +++ b/scripts/base/frameworks/notice/weird.zeek @@ -144,7 +144,9 @@ export { ["FTP_password_too_long"] = ACTION_LOG_PER_CONN, ["HTTP_bad_chunk_size"] = ACTION_LOG, ["HTTP_chunked_transfer_for_multipart_message"] = ACTION_LOG, + ["HTTP_excessive_pipelining"] = ACTION_LOG, ["HTTP_overlapping_messages"] = ACTION_LOG, + ["HTTP_response_before_request"] = ACTION_LOG, ["unknown_HTTP_method"] = ACTION_LOG, ["HTTP_version_mismatch"] = ACTION_LOG, ["ident_request_addendum"] = ACTION_LOG, diff --git a/scripts/base/protocols/http/main.zeek b/scripts/base/protocols/http/main.zeek index e0f0cdc0a0..2f1ddc37ab 100644 --- a/scripts/base/protocols/http/main.zeek +++ b/scripts/base/protocols/http/main.zeek @@ -133,6 +133,12 @@ export { ## HTTP finalization hook. Remaining HTTP info may get logged when it's called. global finalize_http: Conn::RemovalHook; + + ## Only allow that many pending requests on a single connection. + ## If this number is exceeded, all pending requests are flushed + ## out and request/response tracking reset to prevent unbounded + ## state growth. + option max_pending_requests = 100; } # Add the http state tracking fields to the connection record. @@ -205,6 +211,47 @@ event http_request(c: connection, method: string, original_URI: string, Conn::register_removal_hook(c, finalize_http); } + # Request/response tracking exists to account for HTTP pipelining. + # It fails if more responses have been seen than requests. If that + # happens, just fast-forward current_request such that the next + # response matches the in-flight request. + if ( c$http_state$current_request < c$http_state$current_response ) + { + Reporter::conn_weird("HTTP_response_before_request", c); + c$http_state$current_request = c$http_state$current_response; + } + + # Too many requests are pending for which we have not yet observed a + # reply. This might be due to excessive HTTP pipelining, one-sided + # traffic capture, or the responder side of the HTTP analyzer having + # been disabled. In any case, we simply log out all pending requests + # to make room for a new one. Any matching of pipelined requests and + # responses is most likely totally off anyhow. + if ( |c$http_state$pending| > max_pending_requests ) + { + Reporter::conn_weird("HTTP_excessive_pipelining", c); + + if ( c$http_state$current_response == 0 ) + ++c$http_state$current_response; + + while ( c$http_state$current_response < c$http_state$current_request ) + { + local cr = c$http_state$current_response; + if ( cr in c$http_state$pending ) + { + Log::write(HTTP::LOG, c$http_state$pending[cr]); + delete c$http_state$pending[cr]; + } + else + { + # The above should have been true... + # Reporter::error(fmt("Expected pending request at %d", cr)); + } + + ++c$http_state$current_response; + } + } + ++c$http_state$current_request; set_state(c, T); diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index 1acce5b4a1..ee21bb2757 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -559,6 +559,7 @@ 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::http_methods, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::max_files_orig, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::max_files_resp, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::max_pending_requests, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::proxy_headers, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Input::default_mode, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Input::default_reader, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> @@ -2185,6 +2186,7 @@ 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::http_methods, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::max_files_orig, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::max_files_resp, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::max_pending_requests, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::proxy_headers, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Input::default_mode, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Input::default_reader, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) @@ -3810,6 +3812,7 @@ 0.000000 | HookCallFunction Option::set_change_handler(HTTP::http_methods, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(HTTP::max_files_orig, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(HTTP::max_files_resp, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(HTTP::max_pending_requests, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(HTTP::proxy_headers, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(Input::default_mode, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(Input::default_reader, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-09-content-length-confusion/http.log b/testing/btest/Baseline/scripts.base.protocols.http.http-09-content-length-confusion/http.log index 9bca082c7f..36fce1ce54 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.http-09-content-length-confusion/http.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-09-content-length-confusion/http.log @@ -7,6 +7,6 @@ #open XXXX-XX-XX-XX-XX-XX #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types #types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string] -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 46982 127.0.0.1 80 1 GET - / - 1.1 - - 0 0 200 OK - - (empty) - - - - - - - - - -XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 46982 127.0.0.1 80 2 - - - - 0.9 - - 0 19 0 - - (empty) - - - - - - F7s8014qOBt9Gyy3w7 - text/plain +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 46982 127.0.0.1 80 1 - - - - 1.1 - - 0 0 200 OK - - (empty) - - - - - - - - - +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 46982 127.0.0.1 80 2 GET - / - 0.9 - - 0 19 0 - - (empty) - - - - - - F7s8014qOBt9Gyy3w7 - text/plain #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-09-content-length-confusion/weird.log b/testing/btest/Baseline/scripts.base.protocols.http.http-09-content-length-confusion/weird.log index b6c643871a..1e04819b2a 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.http-09-content-length-confusion/weird.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-09-content-length-confusion/weird.log @@ -8,5 +8,6 @@ #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source #types time string addr port addr port string string bool string string XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 46982 127.0.0.1 80 http_09_reply_before_request - F zeek HTTP +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 46982 127.0.0.1 80 HTTP_response_before_request - F zeek - XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 46982 127.0.0.1 80 HTTP_version_mismatch - F zeek HTTP #close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-desynched/http.log b/testing/btest/Baseline/scripts.base.protocols.http.http-desynched/http.log new file mode 100644 index 0000000000..c60072ec1d --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-desynched/http.log @@ -0,0 +1,17 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path http +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types +#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string] +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 50170 127.0.0.1 8080 1 GET localhost:8080 / - 1.1 python-requests/2.31.0 - 0 19 200 OK - - (empty) - - - - - - FlUDto3MxYxQV9pVnf - text/html +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 50170 127.0.0.1 8080 2 - - - - 1.1 - - 0 19 200 OK - - (empty) - - - - - - F7ynSw2U0QnJcw9Qth - text/html +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 50170 127.0.0.1 8080 3 - - - - 1.1 - - 0 19 200 OK - - (empty) - - - - - - FeY8eU1T8QwTaI0456 - text/html +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 50170 127.0.0.1 8080 4 GET localhost:8080 / - 1.1 python-requests/2.31.0 - 0 19 200 OK - - (empty) - - - - - - FfzjgM2OnUfAX9LnAd - text/html +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 50170 127.0.0.1 8080 5 GET localhost:8080 / - 1.1 python-requests/2.31.0 - 0 19 200 OK - - (empty) - - - - - - FtPJJF1xSxzd8blV4g - text/html +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 50170 127.0.0.1 8080 6 GET localhost:8080 / - 1.1 python-requests/2.31.0 - 0 19 200 OK - - (empty) - - - - - - FkCd8G2tsvSm17YOj6 - text/html +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 50170 127.0.0.1 8080 7 GET localhost:8080 / - 1.1 python-requests/2.31.0 - 0 19 200 OK - - (empty) - - - - - - FSa22J3bRk1Qv0hkE1 - text/html +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-pending-state-growth/out b/testing/btest/Baseline/scripts.base.protocols.http.http-pending-state-growth/out new file mode 100644 index 0000000000..c3e974e1b2 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-pending-state-growth/out @@ -0,0 +1,4 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +http_state pending, 100 +total http.log lines +1000 diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-pending-state-growth/weird.log b/testing/btest/Baseline/scripts.base.protocols.http.http-pending-state-growth/weird.log new file mode 100644 index 0000000000..0bdb746ff0 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-pending-state-growth/weird.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 ::1 44730 ::1 80 HTTP_excessive_pipelining - F zeek - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/http/1000-requests-one-dropped-response.pcap.gz b/testing/btest/Traces/http/1000-requests-one-dropped-response.pcap.gz new file mode 100644 index 0000000000000000000000000000000000000000..6acd83b87484af93fd508a361bfd335d380844fc GIT binary patch literal 67501 zcmY&gc_38n_b(;Mu9RK&7l}}IDlM`WMH1737HLRQTuUiS-lCA~ZAj9*5%U(VZB&X> zL?td$cuSg@B-j2scgFOc-=Fi`ndd&wIiK@6pYtrEl(=|t|Jnb1<}FyGudlCr{Lqo( zr*#941P32Een{8v$cf;Sx+i>t1IfpOeOCt_+#fjad$-umo$pYAz-5Eqax~oyN&mHY zYfjp<>hR6jNNiiSd8Fo+{NHcqi#B}Gk1(TEr17(N0 zkv(U1!~O319?6{DzH=&O_HAX9T!rHAoHDojqn>eP9Un>@PR5S^oE*kxz8~?(B3ols zw~pABC5K0?6*{tUrf6n-XGi^;o64&3eVB4*LEkgy$%Fb7@V<+?kT_RU%X+BSJ zUg$i2O8cm6sOX!qjo-RrB@?EhWo9ktTwM7W{C5BZ<_uSaB)SerG> zq{PODtLoQZ?p*rSwZLK5)cmNOovXdV>onE<{It)UeSS9Afqd=d=f6|3^`87Rv-hy8 z=#toOW-nv)JKLnlb!VaeG(s{k$UKK*^(yLC3`*2!oWSn)Tv3S zL(D6ki7B_#pS4F*lPtT21ULDapYZxoZ=%(B<#S8O$!kw_&{c79Nb-Ndrk`@uYZ^W$ zsRj4Hh)utgbZ=6Ue)}8hxA@$W1Lq>Tzl096&IsC+=5J)|Y@#F!1n-U1YVA`?S^j*- z(Y(K;{*w8!frQdip5LA+@|l{N`CfE9^yZhJ_ySR?XVX>r+*RRcJB>4h16CY)y;EuY zq|%YInqB?b--2tAdd-HaO2p1B9lu+((EPmE&j~fkv*DkAxm+_2KDzpYLV2r(o^9#R zpH*md>Y$r^+F?)_=8HA*&-n2(z z^|a3(yZUKwWBN9;Q)B8)D?UFD{rA&lVXBHLpP3$~?OC~A6Z-44y0NnQv%U<6u5`yG z8Q(PfJ5OD*xMbmwC#STFx@1TB$ijx~#D9H1Eq#9NvCOfTpXB4tdk5G>{0h4+RqgjV z=ykC3_Wp<>`K{YS#B60Yx?FvJNFylEE9>nSF%bvl>VTi?rk+HE z&j*z+*rNFLV~IUgKV0(bj%=gngWpz#3@fWUguj#&{roPm> zvUpjW>VvJuKgYT|MW4tnaFzGbHUIs+qcUC9Ohcp8zxDm)&=ui-H+NYs| zHc<5Hlhg@;ZO*o9K5zKxAp2?qJtA*s2% zKYQMKJ{CD*BCxH;^H{%;fS@CEZDK2IX1h-LxJ;DckCl%reFq9v71YYLM#Zk~COR)w zQy5&yGIs4J3z=NL@ol&5xDhlI*%w76zg{+^pho(SvNz^bBbEOSP#B z#Oc?xKG77^LaEI7uHH@)zEuY?%CkvWye+0RtyC_(po?aTS7qa>({smoz8!} zb{x|Q4=U<;5%99s)Yg0N3pXcuHTudUcVcKaS4ucnH2>Ou8Sn8^w{osijtsl29krrv zI&|0e5VGxf);Sx*%PxX`sd-|=SqasdFbv2hC7-VeYWG^ zVLwq(R(#-OMwbx3!of`ArjuveUv?vi&p^MEB?Y@k=%I#_(D zDE9P6*9}!GdsfoLz8SXb)9v@)7?sw}_sN4*l%V*$@*Qb9S0DFm zd>64YA2ASRg=mc?6l!&-M$Y=k(@EOmvrE za%neO%!+8XMJ~gjZWY}5xum*h`I*3YioFCaB^Mp2Q%3*e8!B4qEsojJT47fEY3{Y_ zht@2!;!ikz^{1WoR;0=!LCJ_e4tICiH6EQp%t=h^m6i#uGrwIkw_tbDX>6H1eNfnk zXB<_|c{dkHMAZr|D0%kU*P5_S=z^^X$##t@D`0^M{;GSuHl>ew;ojsPF)WVH1V<+{ zc+ESj8-1QEB5V|=r{HI+^=fN<`kiKSeP7l*Ek9bQy_G0Bl6CiIor);wu323e9(gq> zhA}mAzfcxA;>?fokz$zLSD>j*Mf$KP$*ei~ZMC=n$@a`aL>yV#9MAY~qdbC1Q(nZ? z^P{iZ1TUE2s~rwlO5sZoxuMIM@KEeR!}_5tK@oY44DSuXetHs&wbN1Zi_) z9aU{pT1`?vF>ens66InHd7BjPwD(_M!<@ESz9_RHUDWW-l*s~kzsI`Oi_z)kc=B@x zc_jUkY8qoXzR`KsS3?vfi|yl#T972|w+sno4_aSHkaV?_ZYhdwDx+7PUM`C2^tkpb z;a#mazik@on|!qjChyT4cCRk|_s(7&=Gw(rT3H}-T3L$w+Q@aHXmaT{Coon^JehV( z9&zthP8%_f9iwWXZ_0w0UJ;i^cgB#Th)`IMRKD6$Kc+_bN;o*mHe<{HX6+lWBu>w9 zjVj8h`8$U3aoH}bW~|h)xIz)_@_w4p*}z{>8ZtdPFdF6kR5{Wss^Ww^Ynq>R?sQB% zLtj9E^xj~oGYA*e*Fhr&dV4D)bF^olV-6y_#Qsr4w*?38{i!#GCH^j-fpgD;#dUuXJQCNu0_oGoi6r143pEzm{l7pQ}HP908#=5cT zG6F3r3jr((SOL@EsYd&pFaHrwJ?Qz2L2qUV+w(zB?G1+bEudp{*+jvu%i zmORSLK^GtLPEzZ7VfEn4K-%wRE;9!uL|IDirD<*A&aMmDHngsmCT!UCY++q!vJ5LC zP*4=@dY1fR+%rb^A|u5Y(-bB`y~50KJ9l31gMoQRAg+-m zg^k$-GP@scNlW@UHooy)Q%A$tZAp0~$t=J(Z}k@d{e{#LbrU@DNpeZ{B2uObQwol3l;n(6a!5O4|M*w5*J;kiuS(@Vs@|HlNL3=7%Be?olO7STRExK zK`=4(A*$4ULLP})eeNvud_o+$)9S`{o6J$oIOClOzR_;nQ4}jwZu}c}D|uQ+ozf`Eu4!FyFY;p;-f{nFU1;l( z4p$NMQ6V4cEM)`kO}ccR0b^$~jllt3V(5&!D{-rUEyzd*y|*%bXC(Z-^A^7R0U$4H zA!p=Qm=Qs`qUf`O!28VU2}^lI*%v!1irw^UG(Ki2icY$va7=a+?0$9>23{ErQKvUt zRO{aBFOCj(sP>C&i_I=~M)|eKc^W zuQJL|6tzZQ@h}e1l`!JGj7yZiJp-8+QdK)mk*(`5%CLsZ_ysW4&RyebQF(ehE$hQ@ zjexqkvH!OH&+0qI#*agjPw<@COCK!*sx-AyS&XW}*e|;POp{iojf{=&S%&G^ficu` zM+vqIP(x}~ZLX(EFM`Aq)g60YZ=31ks|}%dJXpikA_7>7&aUxg?AN{x!$sc%bc@D$ z^NQm~qG|EmYkxjH1#ataE?LEQ`K7dzzItwo^l6}=Dq;(tUJx{>|cN1~%Zv(qMIy%&6epo;h9i03p z_r%=K>y6JqOJU0X8!^4+OI!w!SYVpHNL)kcBM+9>7=+yl3}~7N)!QX;jHn36SECmH zv)Kkb5|@!grMOh{eUPA|l z`KsR*KMJ(-}AwXL7ZT=ppJ&nZf~HXF>T%+h?H)*LWn!`t~hYoqkknAVnKd1 z!Po^47a4Y>yX?lRMjqgf<_FnGKK2!brlbfRA%NCts zE&IBaRu+5hqp>1kiqqK0EzklC<>0@&}Dw*3UVgk+8~Bc>ON zCPqy;!_X5S5$tqp!zwgr;n$o^YlMx)oX&xc%AO<$>TREkIMN2>5c4dMIUKkxO%Jjf zutWSolaa7B^=>n-cT}GlJ}DfB$6YQ>TS^n6%MDHXX4lrOsQBCHdPC?r50(gga+h`B zfL#;7o}rn{)Gbf5ew)&e4yo8L2e5o47s@XD?J|xuD0Wirv#)5rO%B4X77!CK&wg4r z_J+FiaV9&ZJPpIG&d3U2-+VmB4+finepT+roIm$YzL&2!0dn>thwS+wan)ZtbIWWo z+6u_KYA286-PM@mw@{s+-G7_ZgCbhvMF^tg#-t zxmPY?N17f7J93b4pH9)j2(DNsiBj(cF{}43Tu>56Zq*@D@z@4=v^7HtTk)W`w<{u9 zo76|}L>^=`L#WESZkzK4+w2L*96Eh-FZOj70XZP)S>I1eQ)AS-hz50)h;)o`ozFiK6>b1SU7_hgzF_bPMk4#QI=Z-w( zIMCMG#W;yP905b>q<4*qE+coRU4Yul2aspW9P9oT5U*C~gf+k-*ncL90 z-wiQOxwnStXy(j;t3pQu)%>g0B6NXR8ISs;YRW+6;7sHsqGSoWNxZpkn>;F$4BB^O zV-Qmz`_79_Hp2-+NhE$ThLQY$HzVdOho*8q>HmoJxi`J`aTzntH`ftr=D({eaX&!o zY*}Bg`N;%r5+n(jKtDW;lX{rD1mQt+m_4>DaJ(tXpdUi=NQ(fz)sVIq`fLXSi3I1Ym=ePzz&n3VT7fJ$|j+3B2{wLn_ zo2Bs{huE_N%=`vnEo+R(3U|iD&QZYVHeJ2FSv`4k!ppM)bk2vvTz8B3$DAkg6M5M3 zqe`E>i^lR`+z+TVwZa5zlh;Kd3MmnkzZcvaU{PkDrFI+qj1qWg&Wdg>uc z(j>Ckv-%)ri-|o4EjfUeU=vX^BaYYBax$0ySCxPGpa`sbHAi|OsZfSx*`p|cec!Ze zCXKCha|4oMD25j~lIuP>-~&7*CGG>I8&R|XJWSt1>&rUmhPa=st?MkeO(U~qiz%c~ zR{@~5s03bPF+zb>PyLbT;%gecwz+(-bKw*F4C^XyFW>p3+QYBqrxsb)U_z_Z+15W* zQn$VQWf)B_Qu>H@=ld7IVpq>plME@33X@Bx_Gibajji-FZP~EVm9{}eR5C{NYN$BX z!P~mjS8+*&?~~9?D(Jd=g>6O7RWJXhB@M^hAl}xy&<4zLs%mXQx;g0RoZX(|sjGdw z^IkXW{Q7lfqR>nM)@j~e;LThb^lL0VHBSw*_t%OdA*(z|J*DRBKMm_c*hG*#eOd^{ zDe@eYo^*GiK)f~P>1zkYD)?{r{(HyO@}wlFF$f*&!r2uHWpqIp084uoV-j>d}+P>jRXV1qgyBX zEEb-QUm5&wqjbFREr&%{1VkU*I50Mu8%!<x&loD&Otp*tZV{x7EZbbA z(xXndk4|awc1V#?&1$|Wx{@BFWtP85()v{*jl_snwhDiEj`m32=0Blxmoi?8{uusS*@{|^nhLPAE}q_8 zWl!_0ZEF5*pW?AHtC``oh8E{?(oS%xbx$!3>lU$@YDQ0<7@X|<-u`)dE0TEp2D+C^I&z{b`74J@~+=PVp`utq+#>YF|ao~dDpQ-jF(gsIs z#q(;O8{IP@efX`#Dht~;u}9rWXxSGR5_WAgWP_M6i~sTO7A=_P4i$8Gg+OO@1!Jm;QJlNzmzGWl{ojbAf1A6+;rF&n{mmy*9{-|rpYhL+!?OlAGd zdjj8y{JmpxU?Kg?MHO!eh9s+Io~9wgD$^n3n1MoAOuSeDyFV3smI_O3?5Vgl!>aA> zH)KtAPS~y4c%`>;ZJqaG9@S2rYVT~=NE$cp*Yo}j->S)p2HfbtjjnPq0hElf?DLQ6$#h}0h_6M6|=`9UMKP-NgV?1olA7Lr`kl6q>hemR}yAz zHs#K9MnBLXQRj#O_EIC*)mofYw=Bn{o>mx^hHshHr|CT~5@{KqFf|XkHycmx5NmVS z^$=QRx-nvU*MB;*1*`HMt%X_km){#}inqEhV_iI*9-k!ORPe8}Q;YU4pOkU?C}Gx3 z=usuXc~ph-<)_tiC&J?HQ}jlkiO%#%=Zc%!B6FqP=7K2tbfnx3v}bm{1;^iLm(NWYX=odV!VU6RnM zye$y{+P~7GTxSYj3Bc&{{IKlx7S20pI&?3UnQH=pDIVh@jvC(UGOQN-L0SS4RfPfv z;z{F|j?hf7#6yL-U##g{MQOj*YPbpA*Dgd)tsvrR))|FgQM9RKrfrHue3C<(htWl*p@!0{swtwG^ds~=?WP%rdEiRx?H4dMR z%53lKV`Ia*=(mJ0Yu0EuYia!8TvSmPISrJI7-gt^@Odg+C$412wx7>6`ewRN?7sM@ zAqzk-bUErXD`9VC<;jwJsw#=^O{a z+opW)IH9?tsSt~Z{9H#V#%sEy(4N?IYrj`vkc z@SW;oypg4IHf6k5-qG*EF@qc>fjOigW<+GQT3lA1i3u*)(apBrliB#$${w8@m>a8y{#m9cnP(!L#ln-xHG=g`m%W%$Ztontqvwqlx?!Ug5XuDxyla>i8v<2tsi zfD$VFmanUDp#8qADmz>cUDyHrIhXTB7Q{r(p~D8{J}GC61-ULTthPlwBxCWML;rmN zv=vUIoYoN}*zKR8d86fLU%UTyEG$j^sV2;-6y;?l>m}I^9(;}k`Ns@eu5O?SxSq80 zP|AQ{U^qS%Ctceo8)}9n4i^4aVohHKj~aRieGk|iF}!kUXhD-SeXOFCJJSVcQyvby z_L1~S@i3F+j7p#70ko9zMw(t?ItN~l8P&+ohqsd`N6toMw0F)BVd|^px#eIymVShn zlY)DFM6(N;ELLST-wNUeeybm3(wXicX}VbUx=YqPn=AW-7#fbnxlrE6nCZt?g`e(7nRWi>p1jL{?(eU z)8%~EPsjM-jE~k z-lzcC@@z(9nX5BM8b<#9i9I?SgtFgnjmXg<5OS^53dBG{1TS=r`80#?2{`%{9W$tY z%b{~ff0-*1lyV{LcZ$tX@2rCvo88=X?^23=Bc{X6VsXlz_r`@F7q%wgKD|CpE8hCd zsAoBBTNID)V~1#PmEF`UVPRIGkmKjoY&tRpk2)^`jrA&OoVxG^87aVl091oausFPe9hqTWsU=x#|&=!%?YG!QzwCn z)-JG_>UU*Ff|a^e=%Tw6`|{ef^-hk%ejcQeL;K=uB>&-ptSmZZ{GpsTjg|>Z~!k6vjz>u^SyoLn3eaYQE>A zzd=#@E63ub-yby0Hk}nxJ5MT2qjWaH@)+pMuR{qiQ zjY3mBsS^{2h;fysJ_uezo9$`m6}q9lJ~LU)Dce#V3lJ+Va!G9N_=tcWXfeLDo0Cc> zlW@6_H4&E_JML#`xRSQAwe##XpZVuc+kq?os2PfGt>eJ86r+qarA<}4&T~+r#?lMF zf?IADr+=l*IkiWd52TylF0I>WLDNLooy9gtngJ*29iDF2?De@9a?lK6EKBgcJs|=XqqLeh<|J1rmivSiMiVlI0d8eZv z5s-Ytqg>XNMCDk&>&+5jR=I2!k8~ypWjhR8WHx($@Of1-#~cobGBMLo6b5!mkwdy6 zH)rE1BeKA1M#ZnxzWG0X?LOn^VRySzpVpb-!;@Z6!9au2%WXbRO&Y}1QUpyuBlaVZ>J&-Z2l)7K#`)~O*{wP4*UQC!pip1jYySef-QYFwp#O#evB z;uyY}R|U4t*KGSG?Wp0lF2lI<0J~l*wK8ag0@piH8U4DZ?eG`CNZ!XN8p#Xj?Y4Bw z(Tc>0j}9H3v-catv1936qO2Jw{oC~DyKTx5%`As!A>2648`?$B+a0Hj`fg>T5cspLli${P9Bf1nX066RqV&)2}o~zfto)6=`Q8P3g3N z4f092?eKSYLUyl;`Rf1Kq~&OeU4(+#(9q*heHwKeh$4<~PJ?cuHl&Ov9y18Xo^d6; z1x0dpXi}Q~x#k9uSfF?rw5F412x4nFN==!VNadj8k{EQ>#VbBgjX(nh^VdFCeNsNK zB)9}JSO#)(HcDxKJmYLbL%D;iS9d_$XXz$$1VL8EkX?mp- zNRU62ln26XY)NMGu@630UGr3|u0!5ZV+jG9>&fZULMi%}3OMA;kb@A*yzgOoYCCDg z%ZYmdG;!=;9M`K!AL6qdT7Mg5qyZ}(mwrU309iA^x9FH9=?{BDy=0=GQxw87%*OHxK_zHyKR&)T-ub~b&kuvn<3E@lt|Mj z71v%GV9ymvE4hxYOL})dva5(P=@U_cfamj?Qlo*M0;l&TTr$p!*{H2p#SqJJ8>yC-)urOvzoiiIY}CX z))iQ1D2G%ZV_NX0e%!mtIRUF&(AK$JFmr97#pvk0`xJrDeep^rus8#2P*!#{rA1DD zOo`0qD4&#~N;$5gOsuv;sNK?Z0i~N9{Ca=4rZYZ>fGBDSJM8Jya@~_7Dt~lcQl7aP z@W0HgPM=($IZ}8!(?R!xkKGHddZ;;1h)P3WY5MFkvaBx0tt=%Lmb!o9qrr}{*#Fu) zW7%^Rd!DvGUg;Ju1a$*MlCi(vC?gk=D5}JT#w=5tRr&j1ypr2-*%G$Woo$Gs3H&}d z@lo5WY-YlAw7iBBspFBttf=WvJgI(aN3T!rVf&Obo7QE_kNe}%RAQoU;Is9c4x>Hn z;P?J!O?MTAiJEOGlRQ{NN#YcK4pxxN*L3i7iI@c%#BNJDvt?bzXg`PKHc8gBC(_(g z55^lia5La7`S#BI%(aO8=qSGjsTH0nS-s*qG!KN)*9N1EogaL@xy`Y-2Kv4j!V*N( zul;TD!9;oM1r7~&+czP*qR>ON!i7}GS-SgGTq|yUpqK|}QSI|INA}8PI^-TRIP&aI zUVaZDbqZ2%Z~)i(mk$DJk9Ir{YwtV*ON!R9%8@>nT=PeXn`G4Zw)tH2O(_bJ)g}^iK76*0isxvziCvHZSRHSL{CIeEG4)q!{=>!-Y! zP!2R$D)!dr)k}@C9~Rt%kWM6onn8P_8iYmVP&~(3kKS@+<3I5Zd zEOmo*G*g6F1WsVs>Cv-(E?9(pa%lUn7nw%VtXVBn^J5slR(vOG_g2~wQ;@*EE9v8> zY}@Z=ObTL}{D?<}`@_`b?rZQ^STAQUWgv0hjlJf<)*!}Kn_8F8G8KZPV#qy(zl}rY zIuXRKxNpGSj=F8IuMfR1j9uEEvw|1IFs2-5TYGY>5AC`mB;R?~Pax*jksX`1ufBXsIC0U2<&A<{#6PGh zCM#^%B(t1<=Rop?E06ceJP!2T;SnRaulBsSb0Ty5AfWo%Q1|q@V$ef-=_W7joOVcr+=HlN!y{s96S7H&K^V;RqhL)fukE-^OD=s1%E-t6_pqNG(a5hwXYo55L&kI~nA9eQ)(Z zbAh+7B09KO6t$P6IjJM#PP*uFESWidd1arclgi72d1yNO zbjP5aj&C`>Hmu>D3k0x!y^Cxcq@5?H%bMU7ijFEeVt3Tr)mY4k2XM+ZlCb00QZH7{ zZXp3IO<>=NQ9gsLiKQdVh%$Km)sy%AIc`FNSh3pGHw&5hlIYZ$vKRGcw)hsEW!ew% z$XlxDnUFwc%VD}%KzkQW#*bcEA_{x4#)SR+b`yS}S5`wyfZvtpnN87*1(N9ZHHZFr zF%ZVF!nyYsFXM_Oa40pi=|P)YwQO_YIx)<36bx$a@_lEWaRc3-B_fDjgzr~4s$IEn zP)iNAK%6yu=iF!*(rA1WPFZ{S>OT%^O?S*WqKIDl2FEUsm%T4KuZIzEl9NOozp3_R zZBzLWx&V#fxG+n0WuIKh_PaECR*@=tP!4voBd9|b_j^XxF2k(X)z%po=0XpQqluJ8 z<4wqHJDfv`OR-fO3#lF3EQr11!x9pB=CE9Y-kUXP=J23r#MhMqbBKVa$K{nz-RrIV z$eDw!iX^J8R(iy`*L+u9=-Qg29pYR}ixmGCPd;iRj~EY!=4@>bM~{75JJ4rdr7Vh$ z^B*XbL=iTcZ1Ky-;$s-9MQWw_YkDVh&+A1s-*>q!G3U}yUFe2ka|w>ZzLnN+XN;E? zb!NtqM>%#AAMzvrWJ^uDeqT3k%Ida)w%;gk9A$4=&> zxq4X>t^lfHXlWehorV(`4wP4ZQ!AZZT^pLjp2mrBIFUBJs zJcfK|_ZaBwx&y}s!@tGz1ZKFip&GK{s%?{6?bvm8CkB;p9QO@$vI_MuqgNKf5e@Z} zy@NYOb166R$R2qC?CpMTV21w-Pm|VZUYX91W{9zv)st`zjXeN{nHOvLgf$#&wcme& zm_=C58QdxY8ho>OLt{9|S`r;sqp#&dW_9~sDjC)czvkn*)ROQ;!EzHk?9$%CY66WB%!VZvfxCBCmaq!CDAm_>QV4WbdT&MK z9>K}q*PDPQ2L1m+FYSQ?kEic)nR4Cng!5$61bMCbNLFLR*svQXI_IN#U*SX#obXW8 z3d#}vW=UE%dT5}pvO-D}-8#ZMjh3SqV#slC)J}YNs-@--cAOeRy6AHORz~n7wH%HE zzt5Qqu>eIh9G-_)UE>Y0{D3RWYC9E@<2)qX7XSIIS=;q0mnB;|BrvfQIJ$N8+>k{9 zJH&QvGr@D^RZeNc=?Ydk9ve^IA_@LzQMuw8J|9z-L{0fH#P9R!2Q>`+d4gx!ar7pdD<+orv*2KsAwX zBm^+>kLad%M2v|H^o3WbilR{^S}=~6p+|{WF{eNO#6AIsoGN9k&=Q6Jw2 z&MSNZv^{*f^XnZV+6Ob^7-C*<1lf4^_nr0WjCM}A*M!tTvXx9gr~*u{RRla{1L7WV z$^R13kAEe-cd}cN@axNhp2Ldh880|fmaOx?!JH>Yx~n1fwqN36qsiCU7=NoL!{z@= zW^{9F839a5_KDLWHpU;=!I`~hvRsT;YQWQ1MQT6Wl;&Z>EM~qI_x%Bj#rP)nf6t04J#D|G>iL5c=&bcb^sbAZ)-M-^Qf29_8ZelYTHSZn8YWcK}1 z0j&64BRdD$)f<;+0yNw;ulRqShxxOZ)0j7R9*7sKI^S3n?R;AIg}`_SdIn$j<5CR6 z+FSe&<25`P?2;42E~xz+dhqD{#}Fa|47j&UsIW7@LVP&^jUV3=V;Gdmy@P@TzMj-t zAk`?Ga@E=TKc^1ml1Xsp=de?i++V$29D98Is3btD*?3bjk$mJZ|U2g@r_@)w*2wM=uEU8$^A%E)iI7ZW1 zIIG>doVSw$D<#o>T5;N9+>DKGJ4PKhp&x%Eff+CQ-0P|HCM0(!oBJzcphrjU6heRR z0|UrARz0E2Ln*X|v7g(ytbOwV-eU>}oS#r?Ii9$A2Jf+khOh5Mhe>coAzbC}S=ch30&Ju!nLn||ICxy5e@@H)#m39&GP@EOvFAu7M=Ks^6 z*HgLgrQ*mbw-1(z>~Z9;tN@M~dt zMH&Rx70aKQ%f*C!0Iz%2}`1hJ=L6F+8N-Tkwu$e9239c+rLxvpT;Hd8smZJ0m zyhl+C^LGtmj)KITk2XSN5XV=Qq(7TEv$a4Y5Y-H{c;30lqXoLYLQ~!Yr>eM%^RVR{ zT(=zIvP2HSwq6B&y_4G|I1-IvB!(R-?Cb3^u;-nKRa-LC%eJb6IuFeO4SsMyDJqB~ zjQEhyhY(=vGA_rEhdlQdR%z5Dvz@=aMt!MiFY*D43n8Hn%YL3#|a18WGVQXWZ@ndx87jV|kA~0sn z0LbwvG68Z)j?9`hSRsJrmc^$VEMa!biDCCfxDd++i1|SYp>=!jpa+}#+rg`Oa4WNI znwN7TPQaI1H6$rpm3zbYvdv-oYd%+dD-q^+$8UoF{_8wPT|_`G9N`00dZ_XwbVi8~ zI91J?vaohcfNhMRMz~4GDX4z5NnjTe;n06tuUR#iG?rd@6x4n7gG5e2H)@D&hBw%$ zcw;NtB)|2Di(#2ceRE1}Z0I8SWfJ^&Qe_U~#$uQ#Jno`U{wLHr0^*Y3DuA*#TwGx{NN; zEsX!(&a|x6b~Ol`;|&QnNM%*RaDMyvsT`E83}_Zes4om^l`C(IU4`#Vx@q=24~u4O zX9t;YEu6k*7Xp-LU=8zwa5i6ch$An`4=JL-9ni^7cU}!Y_+UeQs4{Cy(mX_S8zFD3 z!*MNcC6ap?*YJaLad_HAF=ctLo`+zU;uzQA3LR&O zAm#~uawbe3A+4TMtT7N_r$GlFG~`9*^kGXVL}+sEE4WHC+7E6h5QR`QW02rJ>qDP= z%^y4%vM40X8FgF{HU0v#_>sq3mCa}f2w;OxB*^uFwV~`n;QrOCiR@I6&^Q*Xz=}|Z z7!qtCiXy0|oL)87g&xp*NYpXZtIV9tM5sep-Y*4^P+Ehrwb&d{j3vW@&2zYjT8?yn zrLeteAcoZp0R2p8^1eRzWkVfx_AuSCWC0!txeNqz)HVnx!W6p^v9IyuB#5TMj{!d1fdX$oHRrt#FgI)2({xUat7JOgI;q3^&hzN`n8zX z72R%dqi7_7mbJrN_olZOJHV}nq&Rg9ACg4$vrY$YW^M`KWK^pIil}a45Hlypkr$S3 zjZlL~k_WcejvZ%rA`o&)d2YcXeA8CM9`3f82j3ksVN?I~i4~$K&of=tVMI_U6k(At9*bFV+Dh$bhrG|%mzmQ#qg&-$`fa`<{Vc0z%rYYK}g=Q1CR zoMXS<+M4)S%&ncmarmy@PR$;AT{L6rG+tr)_na!SEP&hIqOd}8TAxF-N`_+C**Lhm z`A-}#MaGE2z1QT^N`q{DNi3b!sdDScXGB>YWeFpE_V|IJEus0XAS%l*!!2B&3%tFA zK$H1hQ`WW4c?gwLSX0tCcsjtce4vU7y?}e}-U|rL4{J3)frQg%SDhkiSvN^k=j9bb zLQJfzHI@{^E`H{|U-M++*wdvZc!Ai7oH~LYM+HZiB_W`ycXjgup(Grd>bm38AI@i5 zvKKjuEkYzY6;JP^6j1?wNio6wj?EDirMY1&hiF*6f=2>`c5G8aUM5g0%zDE;IGHnI z35Oq+W0aFLY9zlX>R(*>N}SCs>+V6e7?$D!p}G>rpnN-l`s2c*^I7*`k>i~qmmyQ0 z(9LH-mk)W*4Il*=@(a z$u>qOtiJtNC5oE9)N%prW?4M-p=|Hu4R$qNIwQ|T6eWZ<_SzKI@Z5rP_Orv% zGDuVayELoGbp|O9uIKDlVf_@~L%ryI;V=2QD^6NotblO1oHliqBgi6NSRm%!aMN++ zW?oiUy@JpVJ=c!aQYmu_H8or3c&=n0gynP|18$&S9X4xVbJUU%rq@qM7Z>b#ed;v> zO${mW?wjUeZ`cZ;CVDo0j_0Wxw<3De@iAnHIi8&yN`lotujO2B8M0RC^W0cPpC8T0 zf(2zJtZH%+%@J5NI|Iur^!X1AH?jc@3q?gMU_9fgynueSSsvMXN0K~tD4HS9=C(pL zJ&uS0K$obZTUYnNwRyui=|CdY!##FME*MJwJx{Pgnj1fo{;YvIB*m?v4FL(PC8B8l zF0Vs(2vUl8YJqga&Ae;gk~~l}9)|Cz7K&4v=Oe*viBHm-;pYOHy%5_)3S{aA?;YIC z&K7bb%;8_N-@C(8llni_1{GFbsei3+e6;7g_rtXB?xLQlx8&d2IygEDnBP&px-o?* zed5)A{in)TU#rRad;T^LE7Km0t@cq2w_ALr;qT8YIwNLt!!5@cXQHCKhsL}8 zEjyJ)#zMV1pL8Db_~1z} zflxgAwkJFti%-Bi;GQvcpMt}Wn!#|RY#Z`ki! zJGMfE#JZkz@x{amHAGcPG|lmi)Kb=TKCF$_zo;0^oXw?Vn<2QO4rnXpxsOG$j5QBk z>(iMci?LfkEhPWuC8w;#@Z5Jy%L1mt_OHvAA>B*jUKIRyF#$gwTeODRJ#9gZL#M!M zxfP;7Y^PX50kRH#?r}CakUuB$>yqy3d=a0X5 zwo3cRJ6N&YX|nScOV>bxR0;o@68AR1|Hf=C*_M^#4VUg4obTpH!T_?FIUexwtjzu1 z=h%EK?m%C7FI?dROI(a2KP>1FReV!$-8?|*san4cv1-pmsO0Vz3 z9W^bTzwRx@3!oKV@7xKZ#iegMi)pE>twA@hhJQ}kEEV9N3{JT|u?c79ctVMHEBI)k zEPA5wyk4K2IBL2UWU;d@TOocRP_^_FG0Jl?slMeC^>dZr3312Qxn|cCSMq6H65iQ)*xCt3+2g@V;U9#WV zsF1Qk#NH7t2>>q2C#^nve9?IZIfPL6u~K`HpY=}R)8^?usY69-p0aAfpMht~; z#%?hI%s!``9U$I$mnm=oeVtoie{gMRz$%1l3@b_;I|gW@g|cwnwLiE^md<{^f)%2- z7MS(qP2TsXEi%DHw;kf|JkE!DvLQJb?gAo8hnU78Vj9m1p_^fiIczVrLJs9a!}NWg zUdX4Gz`wKH@7)6FAtjcAG~X&^9Op#YVWjnXJlO@dc*u7?bjSfLlpBrnL6-I_ykk$o z3Ge9!0cvcJ;ktiqucy2awqXovWH*zY7D#L6Me=XUzwmlm#oG3$R(FSpbqK!tu>e1* zkj}@8XkYk=xzSnEw3qX-AzAe2n#30mVE5+4MN=jj-EOQhvGa-w40W_JhLScwK)68=?DVhoYh z-`>|SRt*hq5e~!cab!V`Gp|Dn`r*3iJF5kV+|&9{8`rteV3@kHbdSN_PkHOU6SJ12 zHKUK2eU&v(Zc_X2{RxfrxZ<&k=gC&V_po`0Cp$Evx^8j^!p;aCgy<&0?ocuIPsx6^ zAwvVz~+$v_kNi*T8)r zlX&01+-Pfks95mTpYyO4987z9uI!U53cPz7_ZA1f40sEYvG*h_XV$_QQo7k+2MAXdcFT$eb=(%O=Q+aSTQQJ-leGC@PZsu!PE{x0*OH>}Ln8E`Hbm zu5|ywCjENqMmhNZq}=-KROk7aya;Lh`sVy_Pqrt(iZxmBj9$2kTYwz(Y=B;DE;8cb z0ZtR6L3V3y=RB0AZ9UO^i2?-NfN^nZ@n#oJz!vZn27q0H4@kc1z1g7n3BZAMxi-Pco`;wNtZ#_~XWr*SgxJ9uwdgwt7RZ0FZ?_7lGMua_k7V7Sqxi@bwrGYr+pPUs)wFnVpvCA+LvB{Gj$BA<9 zJc(}r?KQ!B?l;@r&k+~G!n&cZf|O%{*gG~-y+UDO^ZuifP}qWNY|rn5yUoy|lwAzD zTql&1KfB6dH-+J2Q21_bEfrA zv75PUqL`G5W*mIT9BzYC0=7i<9m_1jFMoxV^+~CU(Fg3ju?G@YJ1j274c`3|?SwArG@G8?~k2UZLYUm?&L!a?WA z5!g;KEOdq6-|W*-90}R+SPvGRVHm!yCxNlU3t^>O>s`f`amM(IA~1r^S6E{0aRR2| zbg>wlftJhP>a$p=`>1>CiYP2V;JfSIf!ar2vK)m{$5R9!Qa%Z6tW& zNg5wo#^H%U(ndC-5}s0t6Hrw?00`+=u^*VP%1YH@;VdMnQCegn%hieg27Y`7lwtl*BlR&dyA0mPUi zA<{`3xQHesL{>Yo>iIIj{}J00TX3f1SJ>t&*0{9Jiy(F40$ z9G((c${NPte_VRpkNN-2PQD7C;Nzo%N7)L5B6j#UEY&#}1i!6ZfKDFlGe_oeh1jQ^ z$e;+Eq^LIMWX;uLN~rxJAVtKJ$B05oyL2Nq_E-` z`0=;_X8@>-6{1rO>-BlJ|Hm)l=q_)dd%55VD?wa?Lkv-}up)YgEukD?{`&A&E~xXz zYr~a;mH8V@Si|d}Au?*0`6%L`@-xQFCWx&evTo^s zo(uU)6s4?=X-b^6Mm@F9i(#hlSV7-)*hm)Bm0Ap1e=e-c3D_-T zvn6@6E34Zaw$uK$uUPx)|ERk5fSA(vUno*)lM>yKdvpe4tU{_KHAttMwCJ)#$;g?>%B3=s)ErX%KIcqh=l7p;8t0t%eV^y^e4fku zyxbbs)gA!cUK`vwu;f2yVGNO|39h_(Vz4TAAi?{UfjP(8ui$(jbrVKYu@jrzIcS#< zRnXw#GC*Y3Hy{vK3tq};ZBGq)E%;5a^nbr3l0$8z9p=gmR+Gs6;d;W;7|oUbN!+@J zviF=5a#

+d3YRwdyqrxKgEmG+I2M`Cf>�Y8$UxoM|Diqks?U^}~GDj;W+$JY2zTu4i7c!=FRY zpG<%uc3FzTtd#%-Oq(M%S0NmqF*Y}~*f^ejJ%+G|0Y?%!KC<9h{zUo{U?CIBVB-T3 z>O7#xi4DRo)irvTVz7%@?#RASlt(qV}4J0eYTIz`EKWl42M-e#IL3`Zyl2~ zmYv(}p+rr;Au&30sQ>lA6t1@(#&`EcT{p=i_iTrUbE{==1qgnt@8>mf6TAFshkzQvtfsN;XuEyy08(!-!L)?&3{{z=A2eohtdkkint zi{9hNDGhivZ@@%pW5-EnYP189?Ds~P+;Lt(48%PROX;0Ht3P=c^D|jX`*bVvPEbfN zDE`?aIkNz-ugddhm9zLx&c&sQvz*YAHn^Pfq0;R)xMo&*r2QVbL-8DvunuK$an&V^ zb@@DrpsODtqS^j4gNt7mu+%9z1>kNKe9A$S*2KUZFV2{Ope(E#)Oh>ErUG+3{c@t9 zZavE$lhXj=OQy>_qSbWxF}Wt)2~OEdU~ zv?zQ0-NRv#q8L*6Q3jA;k($uXlW{D+8d2qPp2M-$rfTExf7TA@=Q&UDx9oZ6<^15A zH)^viC*|k}yWOS{P8L7RQsa6;=M=JY^$+vY!H{CFa$pr^A)D0Q5TR(>>NX+h@#R6~ zS7NNN`!YNE>w-`NCiC&{UO96_tn(Ngj~FY%_H1JZf;SD=SG7&ixTHRYd+J~PGB=WQ zfPKhkVSnJ`S0Xd{27!%*KUz)|ixa>Kv9^CsxTVg+4ojPSE zU&2`+2v>DMm@k?3zh4{g&w^%_c`Cwjtqc0H#mq4nsYISeL57oJY1Evr{x^rWtdBn=)(K@-Ko^O>^rr6R#wZZ< zm$_0QRT5G1G4Stnh4){vaQka+vc>h3`K_>bcCA|%R+9_3}ZL596Q-iIsaja-?h(|QF( z^vFZ&Dz}G~4SPmQ+E{%aAC7)MGHbL@r@b*3G1ciAUNRquw+(-zJ~_*y69h7pp_N~I z*A`0~Hqtvi66HYfcs-GL9X$-YmjngoGu-B`3oWtFL-U?2t^Zi&d^*()dE8c;$_57$ ziIEIWetQww&vN;vj?xZAz|Xdh{`Yr3QZ*#{I!XEbha0digHZ+|rLe|?soWX|!5WhY zb{b{uFcUC7pobmI(MzDI7EjR}soO%-Q>qO!1`6%mSta6;U*$_^$HWz~2ty)8vp>X= zAQ1^Hz^**16lKV>Y6-&$4$VO=G~?B;XeyEgI1v5Q)M>YuB6@ykPX4S47KOI-z&ACS zB)8~=UHEJ8jHKM|@xtz!jcC?~JO=AIt(u`rc_kx08}>B6`5U8(CrV?)1-R1_ny83^ zJlsl2EpF5c+A^yMO9SwL_Q>P z&fsQcvYS7Ihuy7yw5GwL(Hx+H!BqKG`5`kjk!#aN2=_6)REyCZT;>awPNY! zX+%V?X1`%^uU}8BAQ2w=M@`0-J#68MenafN%<;c~+kASLFtj%JQ3pyf0pYN9~L|IthNYl)2ODpg4{j?no7UC_Q)aP9(=jW}n5f;2*5Q zLpYxHLeUpdE3gSI((h?8d|e?Q2w$qO_Md+04VD`p~9 z%`j|jnudf^o1)tmRD=reucIpG2w)#G82k7=FeXI~%Xf~_&7V*#x`W5e1Y8btw8P{q zbC#23GwwJB4LX9As0<%bL7g0xv;4uXW}_lA&By%?tIhinb>&Azi4W~oBnLdyqy=YK zzVp@=3Y-{m4z+8eGV%%W_yc`XM^z9?tLTVb=LIz8#yDzaM}~+)aNQwS8qtdywK`W z#*ha(w^ud7>~-!CY>48XzC7T=?b9Dj zP0j5WC-*)}O>)O|IY8NInTp&i_f9YzNN_7k`A@W2#|h?PgmZh_K6ok7KKXes7=TI{ z?m!fnpvZ8$V&Id*w5=TJf764Xr$RWf2BPR*h(`bGISA?}^f-2X>Z!`uBObWV>27lC zytB97?mg#a`Fn}wnRAaq4ZWAo$a*>V{TTPbPiB|TNIo;H7?z!3k1)Efs$3)q%Y+y@%ZDxxsM$~DD{U(nGcW3NiLmIUSVr`oi?{W zTEhP}Z+kX0H_Q5BjQH9KeIn;K0+qvu~QavfS^XStrn_QN6Vs~RL;WoM(*e+PW&1E)slK)@;E~4+yh~^w@vW& zElX&d<%h);l#e9DdG=+R_B*UgoxoLAsL`x?AZcCFlQL-WpR$grnLr54Sl5h4JN-nqk61kg5$?m<)LDN^`tzOq&g0=VwioF-$EXs1m(J^S zRnI6+EPCEWl}IoD()_IFu%zv@2G#87-T!(U4P>Ol?+e|f2D0%REY_kfnpn|w!S`0_ z5^vcD%%@*}F&#oJsC+ni4AJ+e5YVyoM)g5Se8#Tj?d?J1*OeaOJap3_N2%oJZG^;b zvW+z+yKp0EmEuEI+sA>Z4r!iwb^+~xxdi|@>b|q2?@l?lZg_jph{c4beM|}ei6QeP zSi{U3Z1Xz%ZxAyB=|d>nngbI1nsXC9b;#P|qVCrQ}MaP-}@?(NI+?q3?Y2H+$+xlY17fR(IcH*I|Un zy>RFd%DM8x%j}scuB#4nj8sc)Q(0xSyH4v_YLFg+hPoL&sX4!<7}*mA)*58J?PtYl zJmDqrut}ZM=%-E28o@B*v=1xGge~d2mM^<+Yxg^yu)0hr2s#y1c#V}Kom%Y0GZD+> zXjyGaGILTTvStMA?zJA6$ zqiD{&L(Z{@oP?!nrsRoQ{GWN--E%%LqIeE#xNWW~^|J|2K^Ibz5>Qw5OY^H&rzC9` zSdC8d9LP?@1a0b^Wm7@Asw$N%SQpF=B8-o#k|g;crspV^N`DGI{D(GaJF!f9+VKY# zXuA+OSC5u(mnH>e{lmc7^ouc^l(YH-XL`HB61wM1RHbxH&o~p&5+fE0mIjo`Cn9*! za{YFrN-J8={q!coC~*)^5l&v0{7k3%R~rQlp$Zr&(3@iMOht~!JAufX zMn;K^f_4O6W+CxYR$PhHX_R~jjh^`HqZ!Sw=A4iiC23H{RrQHRps52ny)0II5m(}K z0q!}hHlG3{KWFajf29b?fx|3ma!cGC%rc#@mWdb*PdmygLDL(-@;{@sDeENsr?0Ux zOmM+dPOsD;%eaaQ(KAaYT0FG*RoW7IwF~o%@P+p3>~bz2M`i(7lc#Br(svDYQ`v=R z`{PiF^nj{-6m7>3m2fvG2OFRJnXX=Wn6q0)gWSogbDdYYv|*w?G5|lzFrfu<@C*KI zTCrb24m_R>isnoRUL3ZJcDTffL8zm_kJpzS5j!>L6HCGZ+&O@xj*CadVqBZNd<%h0 z_Gc{95phwj6-}`O1pX@h_UW8MCH#N?3d)ipdsUVtosjuO zhOE)zQ!e^M{hwC;-e#pzK*FboGBkm0GjJiCn!O|`FZvfTABz|>PlG)1F;rm|d(!4H z^uRiFuBgCG1_?K&4`G1ykA;K))_Lw%ePWUmKg$+l&@Sh%bx@_IB!;qPVM-}~H!f{+ zldL<{OS#+`MDR;FIcNqXyl%6iSN9y0$S>DN=;K~SNv8W(e>oK`{+Tgr zZ;vJokONY4j5ZZB6dR;D0q%i#dmGm9#Q+V`sjd_H7$jRm&N5|HD(_Hb(wumS{Y9af zaj@Oj%eNC`8lii1ir0NmAd)lb^2(sjakD;iN`DLXz|$Q z%DD^a)Rl+DFROp7AqJ6X=Oal8`8)shQw9^-0Bj}I`h>q&qJRnAZZOZB_^s8iHkV45 z$jtMFY}q#)rSrA0BjK($yvY^JH)xkjrTE*s=k2mJ>{RDxk0ENT-!&BdMD`_XP>=5( z=;tSGKe-Ur1zwV{E{pum{O}srTc3WiCz3j14V(C3ZyiN3pya)MynSu8Bb)(h6lA46nL zDC6$3kZa??znZ$4D|PoZ0MwjcJ@5r9_T!t#d_~LBUO1o5-datqP@@7FDLzFl{WOp@ zjsWF@mQCGzOf<*{i@YrE7iJ2$p}34Q?w^8aajb(rK~33Oy&_GU9Q9C=^**j2jd&g# z+wEUKYgVMKW#1p>@kL_)6gQfJ6a^`UIjCQeqz^?l!frHG+ z&)dS-NAB;&WXRyH5|2lP3S6 zPYf1xbp2dfzm5U)Kc^WD?I$?=IL1CFANH1nb)OG9$r=~)CuQ730r?bohqXhVGF)UJRD)@m&{TWs8d=M!UC^B!TGBv68^036)|GJiK?gVA!pb~ zTd1X{xJ+0OGJ{zb(DoId@cXtJxs5FR68;nUE-BY^F>MaoeA4vCWT=~wRg1Su8ntt? zq`;JmA^i8EWZMBz;_50ztq>#>3%kQd1@E<;KzOca*W!zz%+SO4<3lTKhDV7%rRV3Z zWfx=Q@AriT?-J$j?-4B3APoYo{Kc^Jfe#UP7{Pu!=$iDeCLS?Dl`3?S!9t@w4!Q`& zjWAQi3Fx&P%5Vh3T|+27%Xb}zhQVxu@?rdqWk)!tmsrxqyLPk;1V>2xwMpRmklN#z`7`}Gb|BEEZ zN-s)$VX)#b@(sbj%DkHm9gu%!WjcIKhD^HvZ>e7QxeL@(sj|V$H^7J8Ii*C{{WeBE zjg2k?7>e(kQ{J~ia{D=#dbxNGO|IJ zj`a4*IS$7p_Sp=&&pTkRCRc7gqnR0#yd?GxPx5V8&3p}8-#T7{^i2GJW~vsql55Wd zdpnA{QyAU&{8#k|Ilk~MxfYbC<~Z?%{82`A4sMR?gcMU_gtnbgrUs8o88eSOV% zI5>0|pMCQs0VK?>vd|}^OCYlLckw)|ALupQnC%%Iv{7rKPYRB>gKPP%YhZfePEMIfUw{ z{8~6xlnla9-XX_@E-f=M2Bfd2@Ip{fEn{hVKv>#C^$Cm34Dpo*g{1dE1O<=I1n)K! z34Uhrjoarhk0-R5EG7&pD}=n==YoP{z|`DfMfXx+@(-v=Ni5;=rt5VlCaO_8A4;Zg zitM-7c4My74)>G}TFgpk9iaX5zetSuN(VWuPlqW^V}*s1sNi7v#)%?<6Z?LP5ClnN zVVT0Uj0cj17>aLFe%=BG>?z2C)G?++`uU^cQ&JFv`80X!4YTD#D0dcLBKGe$mivMR zZ~{sYCE2p}mww{)qC=m^eBC1Vr{B~>NwT)xFq8g7mK_(_d1=dW;Q(Baw~G);d*$P9 z$KY#cG2#;2wN3MrTcAcA9ZEJ?jXe5Cldl2`=2p(oAZKv}b>=Wv zI}n_hG`&p73%bL)7*A#sT`&)+5;$QSKZBI#3GFgx8>Yd?ou(t($>2~#&WZBl`@0H=pnUnfN3-w06 z8Ws3!V@j3xsDdF>5jg1EsXyKizxKukeZqQgKL-p32h1B9#cAd#u11l&N-6(b`OS|y zWDXnJsgYh+W`UvUjon5@rpQ1`+V43(%bs10T@cNis@Pm?rik^L9#JJ+r?GLfj26%& z3${y>3iaeNRRXMU*@XC91p`t{xU@hoiqq97*Nny@J@^uOfm_hd=Y)o5z9u{V*hKMk zuX29JTn)0yEU3kYr3@<|40)PSoazF_L3Cd)6Lz-`(F=4-l=Q4&N#M<$_Wfp8{L?Ww zrCK=^LcvXA8I@ZAtc}RRjgMN2k8#QwEaIh>e>OHHxQHVn=u1u>+z*oC|5-K(&JRG( zCdA2IS;OzX9^t#-({d*1?gEf>f8hPqPR(=DC{o2h9^l}Bh56VZUPlGEcQY2NGYcf} z(P9l8c&CVODRylLcGjWscNpGer4tB zMu~d|=(XI9lGw{a1p#+u5u@@7sSWcn;)Vky{1#1FAen>US;XrDCDLzP#i)(Lt$_$Q z#D(N6pnF*tYw4VIYH}AxPZ!tSdZ^>7W;v||ekC@JcG3OH&6ha{L zt>QZO-UVEhxA zvGMvYJCXaWQDi{3d_GDelGeP^gAE|v+|~7Wi`(y3s$Tw7^=IpzTYENDe0t)uB6Gu{ zSvy1Gj_Ce;WayW zYHtndPU`RozW&wko}+_LVc_qb-&Lsgc|Hj>T1{c60yb`dy}BARSc`J+L*l7O|3~_< za|pG4@GeQ7_nGGr!-ax%Y`)0t*Ehlz)R3088+}?r*uKOT;j}>~TnpbBtReUUl<+Ry zz$Vlui@LK>3#FZ_8m39-<6kvVOXaY+kYo*)D;v&D^1W z)YW+AeEMp9zob6F$7T3nqR*MlXDe4Nm`%^s)zlqHX(HgM*Qy^)H&~Tl~*Nz35NB~9*#1p(Yh#W$YK+aw;WJpgfD1nvRl6X`w{V9*c_J- zJ1d@3-qzqZ8s!aZOUk&f)C`H*Ge1(}`=dEsxKmWMt?rCrG4~2vUvl#uO5#?d6t>)U z74x7E*bSHP@W4Ynr;d5fEuo0_7C-qgs zdeIuS3frngTGKH;it`{NefOGIsbP^4BOb~$b_-~{0I#tuW#{d*zy$l)gqvwoB+)SD8gQ!uXu8~xs{R3bWN zGI5KOGfFM#xv5_VNm9_B zrV;zphHaR=elt-)>r!PSQG(g5Q#)Cg?~jVa*sB$Tv?vpEblfV~pdb~}XV?z6;!V=Y z`Vp|1%%WW13}Hj1O!OPO2Z^*x5sGQIpjq0h)V54fvhhknd>gw_{vFNC;|J`9X&Fm) zn&Wh`L^o&Th9`^$q-4Y`?|Cefal10J@cU9nb8Lj3C77vsRFJy>(NAMEKKKn)-`~Bq zXKawHnnb8UI^vn5fG=$GTP0AZNo*5bl8q)S&@T+<8%iczQ4Ntla^gt7zcV9YK2b58 zm)LETQFQ4?mf2Wj*Nl^T{m;zGRTFlnvw|_B&`^z9gYqpy>PGl|t}oh8Stp-);I*5# zcbcesF)sZ=WO@4GBUqJ2Ui>N_Esn1kJzgRiR$iFb)H z%m>_w7Pr{$mV|{|fqHQ!Vh_arBjU5kIEB~2TCn``9F%%a+c8fSAh~! za!>gWATyW}7QK@t8uCSLhj@kHNYBqJYiCc~S(811u(d)l(YZg_8C_e-#c6HQjT3WY z_YNc-my}9#_4_}7bIP;5un#=l}PMe zQE!;H;MwX-Ve%>zC>o1+7tA%uzTbW83`_=+ohU2`N1G-Y>>TuL4_c2pCR>NY%;GvR zQmO-6(Ade8*Zo%uVqePlMMJ*0q`V8tLIYOmugrUfzIZY{Q47abAEqtdOv`vNo|7|# zx_=mb^=@D7pHthbs3f5(tOI>ig#swt8#JzyX=?EISaItE{I-%oEVmWRoa)RYJcFRx z=?fL5^blI#HC9}&GEpYA*aC`yq>ie;Pa}ct`pGaTk^5$B$MDS84 zhs34*vC8W~oyt@ntXK#(8?maI^4^tjM|C0pIV<2MGnqMnc!puSQIPGA`Ys^v8yF-1 zGkHGKgaX+Pz7PM%prX8-d;AKPBfJW)w5ppKjxRt>Zuzqln9Kh)qmJ2jqXL3*e+|Z| zu7CU24K7fk2FVnz0M%bIgm;8u zc`d7pxm(8*?o?F&P{JPM(0hv@HXhtkXh>@aV@0fiI%0e5)V%hi-VfN>7NIqqTvYio zMUzfvXLG9hCe#}OI-=in|8COWSO?41_#u7w)a=OmE6eCl+hMv=f0i3}E*}ld)*I$_ zeHuj6&LVxb_~ogG#~+*me{r&Sh9ieLjp`$Nuzop8@lqEQE0M?2w>sA}nQ1PNsZ^ z1r&Z~5DJPC)hfRU^owoTD%iDiBx08EK;_apP03DlG>~$9wtik0d2xb>SKosfF}Tt% zpQkBQEKbQKrz#Wb<3xh%M)Hpc4lkG9*o&jGH+YZEuvU)kW>&REMT?4NZWjKxj|&>Y z#hxoC{~3W19>qA4fZ0|!;~sW!%U1Or1hldX@61s@;i@#E4cWMZM>$?RLqh85%qYF7 zOzG><6l$oSk^V5cmwz~CUuEd$WKAs@rpr{`19eEet+xWsO&K(K?uHUui+yxB!~g1( z@@l8j&Dvx%rX!qbpx{3=sk163Qv7i#ZQO!dN}05`x)Pkd=x&&-wd&1|Y4h7}Gbp-8 zB8d-0lMGJ1;-uDv<5upC%Bh6|CDZGeP{I1%EcD@%jp!k8^k@S1ZNFANF>>GtwP=o* zx$4dCpHsf)5(Y6s#t)M;Vo(>bt4qc;GQc&aVB44dalg^;nv`Re8M-y4q^!ObG~r3F zqI{?@KO0$d-N!_UG?8ujSb+n8`^g3@%g!(qUHO<4|J$t;yRB4OhVBmbz3FV#)nYZu z165a`8IwLLk)8`nxlaBpTz~>Q;Ol|BNu zIBqj?SH}+^q=AfEnxpD?n4L|v3hp(S=UTMmbH23ov$azBKBN~%Lbr)cPQkii?Xp8a~=2LFjs8)%57mm z+=&HoK_-6ot|KXgv=MfP=@K1_eCONBEn^3xD#3R}LLQkPu=$Acf3vu6+0wMMn7@*B4V)8$2Ot#)KT+@xZ}GdSv_$Ivnlq(twO`ct#`|msY#4e zqIWXrpHYZgW^)##9 zg?4aDL8cHOjhjr<;zX3Y$rQxW+5sD6;+~zc`Uj zSdLxMzN>2KMXyqOPD-kn%eT66cSPqYmU2Q`LzYG{cmH_8vj%73f-Bypt3R8Oyczfa z-!qFLOgx5W*_-X7KRt$v62i2PknQl_A1!tr1rV>WEU0oR<|eRKY|mUBxn4|jY;q4q z7s8=3f~~S{!}!9!1S?b3qMu zFrI(~(~Yj!^31(K=Y@;~X(%a^p2SZC_Lmj?JIBH3kmSdY7%T}}z(!$0gNC#61$Q~O z2c?wb@n4F3M(e66EixB)G=(!%>l|VROz$nt|LWOcjJH&QG6X8HRUFlw72~a+p{aS z)zZ^-&cB~e@2!Ua;bbqDPKQ(2E5b>tOrQqPpMZ8bQ{-Ws(?Gi>Ts`0%cxa{+yM&=8 z767{q&hX>u|L5V&a{iwrYirk~=Sox<>yJDVe3gNwh$dT?5JlA>M^Cn=xAVr%f8tTb z-D%n0V*|iiV!;S`HF{9MA?Y#49ZEf^hh9@$|5T!z7@B?M+&P&kY#6l#OH!4NbLQza zwYT-u*L=BpQ2a_L68K>&nMc}syR3s^G~<&XFxHJ<@ur_@XtWtfE&f|80pT&uYxHzG zVUzTrNxl|{ z;gx-OCs*5@9tRFu%-iOdXrMtmAk>!QdQq6kMnB`=@qR#HCc!|1v4#RhZR6l4UdBB? zhYJeW#S5LlL_e#isuF23`u%AmHmR~iqhKQwv<%DKC8?Tf<9rQ-3xPE6kL7Uo8mD5H zW#4s$2MNN_P5k+cq!efDoMst<PPVXvBe_x>S_3Sjw1kRrEe4^EDJx&8dcMpWS~U- zBJv==Z}@%N2wYj)vdnQ#snoNz@oTW|hHn+^Iq$~~C|x*zkJ6&~V|FY)b${Xf zHG>A+oN{U5Ce_{XQIA{~PZ%`{UbO9wgY(CDRs1zbW5vdmFSu&sVqcwlI7WZKk)OBz z^s|QLIO^RwLB_YuAA9NbRQAVr7W?Wut~y&}UhJyc2r!M{i zT6};oB;1Co|NcRXu71kUk?^-$A?AA#85}_cY`M?>hR|Wfmzc-peE%G6GQX9C4_TEFTEh3<3WRUUY%5U#RS`*uflux9}>075&D_4jb{Hg-2wc+QHy zGCA_%*~2-v_uuW4q!eH`quN`=p?se;n_j%=M)9BFksL%0QAiRzxdj;-d=YwNO2?7B zdhFr6YO*d)#1l|6MH`$}#*3#D(TY(5!~o9=`J+BF98*a5^Ll%@$R4@ z&=j18+O;vVY3DG{-JKeJB3>bGUUhzklFdELbl{*J1EBb8M2uNw5>+JQv zw5Q;tov+x`n44Yvc9GH|ol?FCR~da*Y?ua6Lqvjo=*O~X+W%@tq9ceQ8E=Elsn>U1 z!7B1}sp@3Fz=y!m8;&c-B6-pDaYvsh`5u~BBpE$d_<$|=S=RB&0lC4-)H+shFTc}6 zHw2^(CX)?Y?n^IEM`*eF(Bl=!34t%nZx8@Fyz5xN^|QeT4Pt2t*2 z3X%-4=WpuDOWUW;Z~qHxFt;Ltu5Lt-^}Dm;8XOFQ6Sd0sz$=GHu?6e*nf&t#A#)F) zK)G#29DS-4Z7BF!n>G9X_G(n4ZW_&|&0Ej+PXTYw;Nhh1w7+PbV(Hn#VuYD%3J_C( zOxMM@KoIg8@$26EGq3p$7}3Lslr;_<%3^LNUAF<5PDV#CoHtb00Ir$0Qg7oo_r+fd z`Hj)ym0vAhbqU#pz>f8!u_N2V_Gux^9AO=A=dBcbfSFNuf-@C zK={ixQN?At5}GWC?7~gtQne$esbCxY&rH2Di#r!aj@!Vfs33yQehJfEGCq&t>&!-e z5A2n4K#QeGH;d0cj^voKcB*KX0O-ihDK~#)drv(!&DC!{{5VcIwr>Kl0(<5Py8e90 z{CCr6PD40A(e1oscQJp%Y@#Lt*~Y(E-Kxl>UF;*HIHEV{YfV*HF63I%ZbIg1LL>k9 zQ(+Qbhrs5Ko-*w(F9)GPjx0+z8-A?p3lc`Qx9x^54C@em-V-@43Xw-##hYAR#Wc

>aBMM(GCWh)bTR8igXmliZ7QT_;+X9Xl^X0rWp=k=DTh!iqb+8 ze`0eGx(1=#QO)zTq%a%-Eju5#t)5QB(*CwZkF@1V+EI9flXVFXYEe6lk%TX&Ux$qt zOj(%7KOtxr2<*%BFK6cJ#|oUuDaE+e~yb;h2}cZ4%@r51~Sla5SFg%ud3e z4pZEaVpLNnk~QcA%^2}r9r+}r?bD@hB3m1tykm6UeMBMAL^-A*9J%J;OSHt= z$(Sy45%0qwO)_tt+xcypLc5CXg}&Fn@xq`sX?e|MRPIp37*Vs2KU5>i=7er z;oVbsPEBjz z{rrx<2KwKeAD~st-7=ftGQHs;)zIko8;G3m$a4m0)!tq~@VbywzP4Z>-z8tR5=!{}x@k0ak% zjKLn(0sj8VWC0>EK3k?uZG|fhJNW3^KLE|3J+L^rxhqW@f1hm4SIy~c3yw^ zWg;;W9U+5fq+&B$U9u|di`(Tn-}Gpjo4ZCmL^BS zvk+0)8Y=S#FBndinS+y74;WdXOoI0!5AU=b4ICIzk8UcsA4i)b_bT~+k1>9_H07z``(vGH~{&9U6(I5Eh2n!FqXIT7(($1 zzsSbdWk zOA!EYjlhV4IS5zOnJVJPaRGQnTIKae9?F!R>`8?uclT4R@Q;fK3m5Dg-{X24p__ew zNO~@zZOz)CXAI>t7)zKf8Y^-yy*{-elGC$`e(kKHMr}ozMu{zzNq1dA=fWG3WNZ z0q6G}mw31!!~T(yo22Y3fH0NZizX_>n^KYcW-Ji<1>8HX=)j72#*@Ue5A2ha4#DDQ zZ~5d%L$uotMFfE>>j&vhywH4n6Krime|)#n0L; ziJx=5pEDKYO=LQAT$2vLDFB9KK_GH`tUbv7GL`h-j+cqGYj4|XpWla&;O4@o5%iX9 z(4(H&KW5XTRJt9#N5!kQ)!El7QyH>gN8SS9oa_@$0>OB=lCF$lD8|}o@d-3#vY|8N z2InXER$-+?( ztHiF!@EjPrfwL8Jo})*{Iky`q*cie-N9$J`H0i(xsg?7KK#NU3`M89VKT7>Q-g{B6FKkv?+<5=28vccXI8Y!gv=d{ z5nfxUplT@s5TFNZD`Q(=BA>89-p|N~%lrV3wnao1^5G9cSbG4_tQZXsbbg@RCY?YU zyvol-5D+Q;a~IwFdXQW=<6YZ>>OcnaYgfK;0AD)EsQWC?)*xp@IOAOuCPC*cG60^_ za+{n6l5=D+k~cTxthIihHdR#KBs7Q^Z9bAp1s|*0Xh`VvUItI{Si#umCcC+)wi)L) z!CnJr3yKO{M0S}f3WlKZ3Db2mX4R#mU`Z~FL$s++)V%>oY?JMmZ3@+>JjS35CkMMD zt~Wl(%_w64`PCNBS-(0D?Mkv4w)y3(Rz!fo#^8tTJ_hf&H=ykI|x1@Pn>zE)C{{S zJBKqXI|a3E7qpTVXHJf6a$ue`u}|b~ikt6z6uG1wnz#k&mR}z^Ntqlbvnsc@$Q9QX z?&blcQNwl*XE?{LafIi4^xa$0x29jz!!9G@+EBUw?RcR8&Ou+R+}SH=$fTR4sOUI( zBK^r+z4J#9_;%$0ycQMW2ub_@Jfs!$&Q_R*mW_VHRtz8nY(QpeMR!v_cr~^zA~L(s z+iTUXLCAq?dv3b`y12R+n^Wk z(P=dMHMk$O4_G3)q-a`g8GoU7n_pq*07+Xm<8OY?FH@3htqbGswWvZMo7EVC@t&bx zuR&D!T4?%p-&T>Rd{SoW)>_&Y7W32CkWh`LlZ^3zMLv(CT|yBEyAjjRGQ9Zchpxqyj>l;C-kqB)8m zg#w3UeZTlrC7Qg%y6?Xk%Y0tc@QelTlfE5`aCNHE>37N_Q1#mM(FiKbS%8$fP^>te ze~(3@SF6C4qxu7^Q>_on+)vDASscC72;TUa8MVJA4_R~13Dq~ajPcCuj{}6;Gq&q! z<>+K3I$;>X;iyKH&88i5kn~7o4U&}@+(LRaHj@kJd%@h}rYYdC;Nv1D#5>Dt9?ouM z6Dce7EM$xapHLfz$%iKq-JbqrH4xONlw0{2QRbDdGS@ZyVUsT`sjr&h(>y$G2) z%dL9>sPq`{`ehZuJuo8Z(!9IV92$BSL-;pGQ8;z3LZqw%x6cz6pgs^?-tTmw+Cvu6 zXk=)gffn>*`@Mi$u&o~G=bQby4Q|0<#2&M5C=O+>z9!jLduCRcp|C&}i3n{*DWuG0 zD}d|zz8=wPhw7P4z+eG3U|cn^sg$Yhs%DPV>Zt3ZMYU~ECbGO3Fy7g(#Pp~0M72jW2klx=Zw}uOyg56 z#xfFN6*W`1=(M7RwhKibUu&Xu;4-^nJ^~F)`~6d>0AyoS{1>2)tI-{InceNp1g~x! z5wWVG#5U)GoWY*Nkyk6uR4(D3N8mm;b|DG(IFThglNfdNq_wCX zG2&LOs}~o}ik{;43KW!LIW8!}=atUaw7 zFmvf&r^lOLo_wKc9sjm8toc=7g1vP0XMuHHs?YUz7IcD`JMWFP#8pf6K z7r~7)Gx;B@Ot*Xg9tZ1{AAE-My!GFY!`uSsE;N+QIpIBjxe~PlXIeWT3A-V8dah9f zuj}|h3rl$!@aX<)uh8gahb$7*U5%EZf<@LS%~4_+kCa=*NeSe)L)K|5RTCDZ zWH3h%cA$JZ82SdOw333lVM%_oVoV5m^= z*GwWzj8gMI_5U}#m>YuwHTNOuKWxfB^VH8@Nf$nL7fX!EW6a96>)yF~Fz1CVRLlQ} zmGiTroVt~%W^AN66Z)vAd90|#$!g4mNb%}aoc}ea1E3mErgc7sHhnOnqAjL#xD;iFc`&zm3=EG}_1w026eLMP}+<&l4ECAc_N^C|K>JA>4! z)KRjiMxE?HC%o&E`o~h>=P;Z+RC&4+m1O$@=m!=HW%Hm!8Dd@X;hbFOPtRR2eEyU5 zC8zn-?Z%|_NUTdxtirn3@leofbo`73&qOF#z<$BiB6LGzzCek*GY_XG@ysFdyfojv zzYm(cX)67>?#}BnTQ3}wC&>L5eUiNUvm!sofqm*fB<4(4qWrO3R&gmAiS7673?hDy=1lEqOI4vY*GY6MDxGgS z{8-_F-|kCmoM6xFAI~sJRGyqVhTud1yi*^t*_mPWCyu9yFdZ5l4Jwi1D^DdJ-%;ql zI#wCSHFI%bU)MXZER}!e8J&NBfmz@#WAbYn0_jqJg$0%tzk`ffdzP3+ipQ&X?yj6S zA=GL(**jw3I@E56rr^-j9afs8O5#SpjMdgD0oDN;*SzD3ui`eWY(9S1Re1mr3e6#T5NYGp$9uwoV&+BU+%&Fla1&CXsm3IP$ zkPfn>m2Uugu^;;zyLnUz%50ctH@q+AGX~Hv?=~6aArO2?Ye9#1r1$R_O%P9uQhkh) zO_wD*v2&N^^ibXSQGJO>g8QnRP0mKRrheATzu@$v?^CqH^r0 zXmOq{!kRCq_6t5Q7{B$nn3Qv6j<9<}0R1`_O|xYZ8;Zjv!zZA$zv@Eh==oMF7{Tu_ zCL58^B<0HwD-IvS3*TD&%ezf83S!Hqwqx>Czm>Qs1gF*KP+_VJx_3I-CEoSCd ze!_ERMRWe0ID%;V{6wa+I^;=PI9B$@8+4}^OMeTXZT^N+CBuzy9CF1}5-n0c+rjs@ zoecQtE{x$wH4F*U2mgIRUCvowG_`-!y4;~ydXo{T_HEtBbFu?@Q{cITIFS!)`p`dV zH$EUujrtck(Zzm0rr;IAk()JgGv^JVdpC?GJ^kfYK^mD&`@x#Izy0~wYDALO0?W1b zX;J53&NAy1Wt!`Yn#1bW?GY=oU%%I6*YoW@)FsGJ!}wpUXZPPW_+LF$Gk6lde+RRk zQLji;Njfta3nz8O;oXJUV{=9SF%es2?|uac*!R(% z5Whgv(yFun$!0X?WD4NokbnsEU4aD%=ZnT$sz-pVkzTP$yjlH0m?3N1v7Y`5p!VdNzA<%v6Q)4 zuuK7MJPI+!)ZjB=5zfW@EEXe8vL(7^A9I)trH(2g^OQKK_eZF~;uyF7`5N4@yGpD5{=;jI~LU_$r+4CDNA< zW^X7%I11X$i*3o7M7{19xuxeo)ANxseNZsX+ClI9?Ii%4-YOogHxl8nZI^y%=+2(U zeEf{w=;!!ikfbdK3+gs6JzPnS7)$m6#CxSm_-va4&2CDIf`A#{jz}eq1pb?!^pV0) z+%+NQ<*m)uN|YD7EHziO`l*LLWr}6_hJ0yq&0m#UPzH%ohqpiBsfnj#TrTyGdC1x1 z4D#dutwJn0eV9{;grv*}7(ds=Ng4R=aU;);956y_3f5%_6fMUTq0m=j6oj+O0m;#^ zx$d^AM8;$~)~9(&XvGf+(|5wre(Dt{P;GoMBW>A$$(zjZpb9K-ybm&5oMAtVV!0}bh!1UlOhnx9-hEtflfe!IRXITRs;B|29}N54 z)^*ftZ^nm6@e=k)gJ;(K(3jmt?J2u}<*REigwCDcZYZ*A!*)=od*k~JnqAMd;pB(P zPd9ZWJ^lf7dg>B6lhe7|RPYg%xgL8r`BAeYz5jxB4lCthY7ix_H+ic-z~bK_Hfd1N z`U#uW0M!gF&4KSNW7zJ0JLA~LS2zl=z&5)1t5W%7jOFe>JlciC*@K%yeyoc}DW7q^ zJCb_V4;L25IO*4qGh{e+uzmV7ZL07z_6<&bI3sPl{F@zK8N{nYVzmBMXFx9=6+^M^$M1HD)MJ!BzIcA>Y!XIGYyP;}A4# zbr_~Z1+gPp{(YF-D%qD~B;3+r2wcwmt1>)TX((gl9p2g#8I1_)iyQxgvCe^f11w8& zS!;N$5@j!&lhgbkBKAiDZF~t_xZ45H&=KFF(a5S2Z~-$KiC+ z-zK02)Ze{X34rbjOCNGfDk)r#Ot5yKqLi7P#MvGHD{dWWGDPMrIFEwbT^>&^!XfJ< zJVy%$rK+!jTngJg%n*sVc2+JJ(nl}~GwgP6ccaPmx_C7lHvivnDjP)NsPlB|10W|Z z%u>FwC;D=5^OEQP6gcBM94Kfz_Gp7ogc|$eudcHIUVj{?Q!#zhpW~~#<9s#$MO^78 z(hgZcJ9CeIgJ_$9tnWb6B>VQ>n-cp_TkuTg)gk4!7m)+h5yvndrzc~Mb777*AviOs zaf$-sz4kCtqt^R5g-;m7_yU)gv9ee~r@nzr7v!Pp`Gn_<%6Awvk9kNi+#?b4rqrY`-Fh{;&T9 zNkDem>a{7=JZN&*(3$TzHK`K`lWW)-Xiz4XmgIVDh)=_@HEwiQc3gChBe;iSNI924 z3NLHgW5fGYY9Y%YKG+kUS=hFh9H=O&f8IqKg5}$~D*vylD-VP^fB$WVE=M;h+D+$5 zh>{%LSwx2-O{j!QOl37`hIXSv2fH1Pgm2qM61HZUkdIJQ2DOT6VoZu6%^=N0@_W5M zpRqf?|7OPV{>=OR9Ixl~Jn!e}Sw;tOBU*^Z9o)$M6|uhb=podk-O(bTj!i(FHe5tD z`Rw{sm7Vv*oIzZ3cbRdV20?c`rVz2Q=NaQayzT}EyE;c$6m<5?kE0``xA4AFe};0` z^6wyH7~X8c{aEEA=~;Y+=*W@wf@_9Ufi7f2?pHo}4AS|Cr&wN}^r=Dku%~jjiq3Mj z8bBXbnDzAL{QxgF!K;2ZxYTpl`{~3jyiGubWSGa!B(=3qH(>LPL$t&{I)TV@b63GI z1$=~VyM*5w-i{&xu~yjP6WB)_dMu3bdQ8n*eDKA*YYhL)|wMAYK&9=12|m%>^mY{C9DYywU#gol$h=|1Z=fC#(NX!;CnYQvgKv2mWHw<_VOS zU==O0?3;M@00@{L%P8pJ7~EHc`S!#lMZY0+q@s*T}ifDlf)_rchooV)v1Jr88> z62XXMb&SJQ^c+N2UNt$w(Z3H^d5JiYXIzCQ8{yUKpHv>7vjcx*w_+am;XShXo#&|U@rL1D7msKnrBz~ z-MA~`VP{(FOXN@RVW!SB3k~Ieh+vEGNz`fY&zuCuB6*%d;fULjWb4>6Y@J>;xIF2C z<(<4=w%;N<2Y==K9#r}xsjBLxB_cKL_qpXAvvHifsenZI0veb@{tuk>vnMfMwohHs zt}DsEg9My^oYKTgPi7)15%=K3r*mD_{j73IU8wytMn;m^* zlI}zMv~boH+dh|W_K_q!#WkmyFjlO**FD=XMbDz+b?0v!acE3 z3g=cZjGu4DSYCv8MFVy|f+H(6x`@JJwSszvYb8&H3oBo2m_T*n8Y2v}BtQ33rXuho z@MYx;f^0md+>I5~Z>i)eeC5~&IV*S90IxnJ8*9~#l>LJbHtUKM-O=%>lUFZ+wyz&3 zu6PRz_iYKN^%d?-I`C_*#d687m?Hio+4gc$LUu}#Ga2(+;->jZ^~N4yheWdNln2*= zgNwmEyn53Z%NRVj3vAR}sSU3=9yx;P51f|EjL2o$x#$Ov-+KO&ulAlfL&P1{Z?7OJ zwg_gMmVF{MZtGryvo2()UAdm)H(Q`+NOKB8#q&)*3#$y#qh7Ow3 zUUe;57~F5F9TJ(M0V?)MP&;fIuR1>T=jHUm4t>8X7hY$_6HmnVdZH0ynS_O7WF97% zTk0+DXDh-M;%)mrq3yaW7-ASjIM(5%7R%gtW~)#P^@kc+cmj#LMgxg(0Va;V{ZG4F z-6~e0bzjv7mq^B{myP`$S~j?`oJ66kPLp;3fA}~zpswI5MBPk^EB3hE*!Rv@#l6&< zA)h)tQaE?>6h_t`pt6L3ig_^4z6fnrwq6d|*U`u4$k#2pz@2h;tXrdx?hNzrT_<$L z{$OmTcEx_)x;NPmGpkRXUt~FT*R%k8UGqQhtS;?o-RW?4_ouK!hwlCE5*cdf_{hNN zeB9%O)sOjEt@X8=xnAjN@@S;tj5ZDlAfZ4 z>XhFxMl@C_!pt?pr3UtU#8aepB^BSo?`= zTkUXtYR|mEUg@Q){(JbYD$R3fz5T%3HKQ8=7yRx57ZWJu?}{4W^hs#)nXyqE=oz^D z$#GeM4<;OJZe{>yx|ea%KvL4R@5&WP&w~x4D9JcuDmeJQVDFD=;@eMB+ILbK_XlWG zuZ<5X=3Ydj-_L8wvh9Q=x0SHW(P-_;7vc4u%p+Nf#@W&Y9Z2L)yjCPp){RApC&$Tq z`z4M0CdGnc>|oXk+I5%~%TJ^4{`SfIF=PIaunsR$1BGykZ3EVEp%^ePd>|5kr6@j&!f1&tg7M$tJ$&c6{}{`@|{=uPyP$H+$)y&V;8hh^iPEr9ROzhKm z_|jowjZ;fdp_1Nc^F-F`hF+gUNLF~X+iZ>~5;WSRv=7F!zaU$tW6fJLZkw#l{3n$y z$Z26i)Kl{~frg--0W5g@;+S@jrE)sN#4g`g9b8s|sN*hEz88jgCj$pf@ zyQiM;(KYN?Pt3231ze480LCQ^3F~UjQ)D83-_OJXPO#>=&BcfNoc~=mOwYyZSP{oT zpMUG4D{cwLr}C(Q2!T+i@B^VNlF_KKB2PrV??>`KEO5hjrrTCoo9Wtr{|EH)=0H++ zb*SJf4%=*vy{87`bW9|BIiCD)O#8_atZuXq<9;?Qw(y>>CjKzL-+I@%q2KttWOvKp zKO_kPG{Gbb|DLIsyXjPsMQYTp)o%rUg~XIujL@gjYtR=m?R-L>GPSx!k?D@HIlCwG z18+ML)okB&yo)gilaSkqZZ%cZ?~SdyBu=tftw`Dw4c-W;88YB@G?iL|xd7W;3p1X` zoL&v1wMu~C<-qe3xbf>+eefjy=p(c_aI!TopM4Kq)i(e8eX(a^NOzjKug0|u`U_9o zhzT$D?XS6(WY3D%t5bt^iz>dfy%2jq%3^WNd-_!!-q5cNLSUdEv8}i@f=-n~zg3v8#&MsN75qFFGfFJ_{Z5TIqNrBrQ`2B^MIzc^ z#>n?shBQUI7i49xu15%Px+A9tY4VP9A5$3gy8RGRVE(~UD?M#p?Do~XdL|}-)K7z4 zB`kxB3=1o1!yps0j=1@O{3Gm>_c-OL%t6ftFWch+;IKecQBDr(Jo*(%@j>*QSP*b2 zqX5>|D2~};%0cA~JO5s7p3A{UY|&E1F_$|E&muxB*ZX0N5VyH={KJ3 zR+yr3+PmgW?G;Hv;YivPSZs9TdA-6MmyXs0ol~)2i_rFG?u(;E@<<=mGrF3;1Whdb zcRSHg>fvYf)-M4VNdYVvnh&6ou}in=>S&5r-A2D-s$OnTo_EkUJ7|~i;sLHXukfqV z?&X5R=ouI;{ae)5ojfF-$nNO5vG5G@QM3EU8$V2E z3A&ww@aSg(tky?{8FIsFM%s%K1!X1E8v2&`26NYB5m2Ai)E(8oT8=bRM6SDY{j#kiV1qfz%2*c1FjlU zLp3qw>g#poPQl16#t&J4uTU{K+z+FMp_9mXFN|b^N3!f3gwugLPA377uU;uG^8LQc zI;*}D1P}g!g+4y{nxL{(7IG6cakE)`HZOvB2ls6 zw6VuKH>A%<@sSRuiwz_0c=JYG4Y5TO6OaUC7*cl8_--3_>mH@IDp)47**7j++7kOV zWv;U9X)HApzhflyu6bF=7#r=r)9@=WHrY{%ly9etIBi}Bg1VB}OWFfE&D6xfGy9E= z=$kr0)zeGh5;_+$Uv&XY^WA;w)btW3?@S^Sfn%+CGxab4;%4-}U$nRTmrJd@8dTA1VU>np%hl3cYXMlqTm@ABmK@;eBW}K`j<%a3wYLp1joyYJ1ANCS~LZ z>Z@sL`}q#>f413kKc+vVj3m#TwNuZU*P48F5AYRH2L{$$S8))?9CEqQ%MsEvGUtPjPXXs#qmlU#f7O=if7m3HXvm zGUhR-dbIfDNF9_Zo1Te%N;XQ+jX8Q%ndfMV_q42FFUCSR4iUc0{Xv(SJ-=ls?KpF4 zF?s2L|6t0>BCd2GdG0#fgNmk?2~%agwaZj|fpkERse#Pnw|h6L`ZmyxZ1pwF1|jlX zfF#xpnE%ej0Q zB2&AGYT~Rzipr!fkA1@jIr$-b&r3QP`btpfVobX2kF4eoe(fLpn zsU&z#ijZphx^HCSTH9da0jIXN0sG6J-f!^V7+*S-*1*tfbJfI;tNH<@RxQSC&5Cvx z*F*2$w<{NgRC!pdiP>ygDneSLAjvNHV9*QI1FmQ%BWZ&7Vq^wl79Y2Pj3?29Cy5=b zP7SS%FWpYB*=v9U;TZSFN=c4)8}iZ6R@{dP#$96>S7HT9u?!4>xUbCoBu@2CaB71@ zWP^6;T5nYs)sNKSoq8P?yyG`!)g8+j`<4iq+K<;21AP28caDv47pZ~*&t`B8~3v_NdK zXErL4FtADX#h40wi81ROa2L(zFuJ7AUd62UxPiNv=bNa*sJ#7dj1MA#h93frmoTT1 zzoy(=LAU7U&cEN#!&=jiF6y036>}f@)TGUSBCBvFA@ITWwm%H1RUju^{68?-;|TS; zaHL4Eo%+{4f+6}DBN=;zi#*a8EA!*{2=+omWphb|4(N#Y4%M?O*mJ^=8aU1JFHC zJzhMC%X&80b<|>1feF-sC zu_nC1-y(;3>eCGpD%p>XHvVDG6B>CxjOhA*8srdE}h8MhYXSB5vfv2Ac-#t{- z&9h!;LR%+Xw^%~snScHwZXQlL9&yFhL2BYdgI0SVJyd1!KgH*kUy3ZKd?se@ntn0?THfeg~&voCy^^Yr#%bDq}E_h})l_-DL0 z$iq~z;3Hc%omN*@nJnW8LYTMls_J?X6WB6OdS8Asp2);0@0NH*b8LuR%PB{MdZ#!L zyZbhS3t&DMKTQ~?$^+&596`W)**BGe<>CA#j9t5IK=nN+ZV-L=d)Ey{jP2cZcrKd# z(Pk4sq(@@uvI_ReW6~Q*%0*$v(cr3F(Hw}dR*AGK!k=h zg(6~??gVE+2&Vx{CrnXYvt&OeDEVFfgc3jqS9=%Gg4`qr>6M+XB!8r1 zdrcLYYqnoLef5bfF@#|Qq`?UGnlRXHq9cO~y7L+&tV57K;s5hHwSj8zvdi343EG@6 zW&R{Wgp7%l1|zSc0f`EJWWE3Z3=sG7uR1*LHL*tgob#dH=DezUhWkjk zVn}HW^_EpoPZ&820=f2RD~3(vtC}{Kq2aQ+qGgu%8PoRRGK0Uenvu+5EgTolcD}jm zJdOHV(S^8tIi~9@c2w~IENlFZz5d9$z3Z8{Yr$kFFCMxJe{YEaX&N(?kb)I7SWQfc z`<-R!8Q9dyWx1gUFO!Bcj8Al?Lh}I#F;T7g0*qD&X|;tMAJoTm*F~zBf?ZzHkZ+oN zRBg^WcrAC{yWP{6)3L?raHgq=zjIvOIG$E{qwd2P>|LIEOFBrAn413nqimYxn;5Gf zj{iCBas(@4vO#guvTBpc8L6h4qMh5PzB#ytvog(mnWp_T%Nb7=9xWI>X4kUoq7G}9 z_fHD4TJy8AKT}kdTp)ib_RnbT)V@>OT#(t-?bFm#Zv!r~;#?wWW^xvEqZY8|Rg=`- zHIXupc$~X_Jike`$;Q*VO)JsUlDKK0bMv zINc1RP1YAHa-NPCJ4}RtV=(c&;Hp@!x__*B{utxcHsAh$?p?Q^=@wlQmf@gq=`Hmp z>&`0-wEX>>4zKt8K^}{4=z)m;%ai;qb)ECai76;$irxj~;k4CGL4iw9x4B~kyK>1W z>gIV9D&yz-oT4S_ROrPQH9hp+UI?)d_#*C%w-p$I8=5GKebmt6`|BIrH( zhzQBqUL*xJxkWm>p5E%5m~<}nwWX#>(j$Vx^?Lo5s3sdvuf9U@%@nw-W500XK~%sa zeX)N2Smt#6Q4*VgyhuZcbboMF?OI;45cJHu6CcP0m~#>A=+&dBA;O8>(JK@wT7x8$ z9EUgd#APa))Ip|wnv#>ftgiE|+hSkLf!2Tug+zZa|0U}k-KeOT(~UujhPozx&#f6V z{Ksf!tEM32m}0k8rnjI9yO~Vq)Lz+?;F&`gqN} z@wbOP>DJly#e$s}@VC)j7{7M`W{URy1OuNuiIcZQ>~z~ra+L8#iY zJl8y}m{Zot=&K0zu-UnorCW6~;~6bc1<+Ou|4p!1r?Mp1AKvKMvv{+&L+PV&I0pz$ zo|q1hJ|{&KaUN;azoq{{cnD_R;DhT1Dw?OaaCn4tbJJ=zrY<3|)8VQ=OuWg#n$iO| zS%Sn)^(0Zv@s^~l%ZfmlR;w#9N_mo!tk0C3?Ulk8k+RqNS82w1Ags%lW>vIJTi@4~P-vn@3u*mI!lQLy z`j4j4T%Gct7k932?^GVE;%-B0DohN_;?SzQ4GDdJG2#&R%9>|~4|*PXsG7B#Fb@;V znxDDTfXhb|PxiT8VVh|{<@ z@gwibuhQ|nFWw*Txnv3vv}5)0@N?YS$?8;Rp&%n0`*i!IHE&8BMuHVBeUWyAJ(J`o zhKY|s5;Bd-E*(8HM$)6e&V@PXh%3P!2g5rZJww~JuwcJVS)v&jYu0>KMd)k-W4*P~ z%8Y?sY2SkBgMb$oupkAXB2Fq_5dM&b?Ob*2mIIZ;in$m%Tcgy4v#> z+RPcQhg7v8Ll;~4!6WnImy_ugC7kz|(QH^+?mV8C57wH!0(TDv5Y2TBjU6U7Vq@Ss z97)@CLtIkAw9ytT(PoTT>PXLrBZ;>#RfNed{A;SNyzC4e8!qjh({v*Qv(S)2I`c-r z=->fdP+~zp^P856x>wM`<-o?^&ue-82J)={|Lkn>rC_r$5*BAPEznZbKU?j`9KT>Q z=8U?|HA$@Y;e+V1hbsFOr2Q+ZuPSHKaC`!5!w{u#0U8%-ZQEUw-jE z#=w4vRr->G1Bj_Lp2hRiwoT=w&p{vynQBWhq|z{;FL3uevPt-=@yFT8)A4t1=Ttm_ z@0{->`7xHPR6--o32V((Ct7rx%^|r_Lo%FiQC*HL?R4v~%_SJqbZ z_O`qc7$~cT;jqL)%1yMyp6QsknCGHmuX=<(VnnQ2oXbL*vTnC%dB(UBE+nfMuScea zFg7xO2jbT{?;QlzBuwMQW&qp@FBOPq6mwd28Lu0YsR-k%g-h$%0siL*BFYhBX8C*_ zp1kdX%0?xzppGv3L7Gq9XjkwjM&^-yb|Tl`SiySWZ@L2f`Q#rs&({*aYz0km<3|-6 zS-`>XRJ@IAyu+x&t~|_)BpY=-N?}`o*PUmH>G7XMh1McS=ldw1xhG?&gmw3l!OXFe zg#7R5eUiEW%kM=fYcMmw{}fp=?2$E3Ec&HL{!U-jME;`zCeM6pW&2QuJGQdeF6(l6 z-5%;-$2*0IdN$vFQLb6I=N>AEPWId7`)9uAaZH-uJYAviEF8itTAhb^*2w;ya|!TI zrx%5ll8TNL$wg08ZDfxCbNpVOu}m$bk@4v?Hrc6rjXkJR*L;D*+$RfSHrQ*-+ACh- zZGIj3Ya8Olmht!k*s1N#>rjXCEslG#N#i8)dFbj;-|*iuWr>RY$e_~X)U%hC`!0Tygw>t=~8{4>G0JTGe1qb#|h^H_RMOv7D76fmnE^^LAN5T2w&WdIDKPiJ>{C!*l%R@vm`P z7rN>lf=3UHIM(j77DVm9}*1Aec1~JR&!IfbKK288`hIf_M(EU31Hn8p|i|3Y?S>Q2uquC|s1x zh(Yg5ufw3LVPHgF7^~Ae1dV04h+bYH4zmXut5=A!wQrYHclVJoT*C&xz={%P(Hw0O zQnV{RBij>(*EQBOD$z6;Mj6`EfVR8#6r3vOGDraFziX$8^*LD>}xg7UVAu@hSJw8Rt;tdCgYOSM%7pAlaX+#qo-Z2nX>4<&z0Nl3ezx zH0p@)VPSZP!Wf#TArfY7VT?V6b7GMI9*J(u{SLK6enKnOT>>YEJ| zXFW0%xM!?TIM4Z&{%b2#f@+_?+aS6T!(e^=?fR5723Y^6kpHBsORPB^Sl>jjlBpW= z>3hbAv?ihbGEr-M}G^@4=wGtea(*``4naiW&BQ+ds)TbT_*VTsXf z)U@e!%ylEWzr3PEfRKjW8ldWeY-SU;D`@jz4ynGDAwVj~9pZ!_;D;Q}i<+gxhb8XP zr(CkYiF|bZ@0lZ{e-qg8q4bsJSem}$zg9Z@3f$hCi`Q)?MM{lGMFEp&-(UT>HEYsR zR7(h|i$D&z*)zzf3RfTWrh}GTw3BuGDFU&sAlPO;%u^*xHMYoh0FpR=|5fIEWqF4K zV`eq!Yf|~+)Wn(d1IpKtuU&#D-D@_=CSp`UsOGGrNC9pOhLUckP4|JLtMI{x_{_Z1TkeLtG=I*-ZlP-80ua)pK{6zlpWAeWeqL$^Z| zp0iGY?lDr`>Ev?cXw%IEZW>I)o7TZt_T#N5qy=wH6`!w57|YHs!B4oc{k%=+HS1yG zY@yR6a7Fdw8LlV_CNdvM(!bktf;SPb84c8WX9UO}y;&+=GxR2Yrz9gz)NIJ8!=sao z3p5~!t_iLPBq~AYM1Y3^!-NsO^6Xd`32kAAC=+9o1}>-g{ba)A0UT3#w?Iuj!{F zR^f+b`KA^e_Ec0-onlNBkX#uu%L(~P92RY=C4QBs!}C&X_!laSmRP0DC0@5_Bg0M! zZ-BxkphySB_*vit?p)6a1|tXZ@j@5M1vWV-*W@_as8cg<#aYc~6>)Cd(-hwGPX5`qSe*AqC|cWKQ#7Hjq3~3P|Kb$uE|;4+1FqdlX_|Q3FfJz2>&S6Kyj70 zkvX0+;KyWqQ2G3O6-_8;SxWqG;>MNCUWFPkdsX%xJ>XaA@ccI3%s592Red$;Uq2-D z$3m^<$Ohk96x1B$9KjARWz?q;=@f62%LUnS2~_^t(%vKyWg{dG301XHb-Lj)kMdVv z>lm4Mn!=d#D7bA262VQ7!GO3w3|U9=DJ)~A*uAsi~7p(@C}{#d*-F8|E{JHu)Srku6oTVmanj4WGWI^&JM2~ z3zgb4wxT398wE!nyj2%<;1XilV;xgCx1Vdr?9@zD>n+zqHtX6Bmfuqwao^vZ#gzL- zj?Uc+`{!&NH)`#MX?v0YiL^vNt;p**()BcF3&zn}1#Z z>*l4iOqTpUe8}vl>t_uap?7WYIj+yT#$&E4m#!T=*hhXzp7f@^vwKEh$bK>ZlGID~ zCS-s8nsWi89uqeuf`rRLY9X|s0(_X1$U~mG zI@M~y6bjiZG6@mczP4%4ojIea3b2TTn{~m}?cUYkL5w>u(q#j)A@)f~#7KC#NEXn& zW>!T=Q$bOR;;R=jM1RNIwPa)Q*Tm;|TB?V$8xM+hqr9)9#s!e14;+1heoO*V1$15y zFmo|}hdVrIffOy7K!Ly7&P2tDs5>w~bzuS!$xPH4EpM;L2HTVtOaI+jSp^?uIcFbT ziV2HE`5MD>8UY2}+JlU6?;WPN;wf_JJ5X&?;~t2d3f(abR?QIAHr7oabeLM?H2v=w z&K2Eb#EvjL`f_11OdJ0=(Oj#2Pc4dF?__({#s)Fk*jHF58nmo?3#aIAYGX!lH%ZZ5Wa%Z(T^*4O!cMFW9(PBEicD~}qTt%KY4QiAremV#Kq7~wf+NJsDaK&`d!E;9BQoW& zO`jSIt~IRQUgeqnW4Fp|tj}8>FJ%%rdCnx)aIcYt@`_r#=I%UAqyutX7!T%7ww$hg zK?>BuX@EpjdC5RDMj~1?nmL^yoX*y%VEjaTS{=!ny_Z51`bj7!-1Q^74u? zY2L(UaP9qRj2WIt8oI@ZrvL_GDHHKia4ACpbP>CQf9sz?$tSA)*Vj1tw0Ir>4)+0%*z?Ae6q*Ad6# zp&e(Vn93+87#ds7sxsFS=R4rfJPj<6x24;#o{;q}$M0NuFSHE0$$-pd6B&;;hcF)g zk4zLvxzCxC@&k#zeBxj)`Hi4ADc>0Qw1Xv+Xy7AJ;D;Od1*JJ% z7Y>nh=HZP|MHbT?l@cj9Y>84qHPhGtrwF$F5PDJe)l7veF0=Ts3K$zj^1g<61pa1~ zv(5i=U_@5QtG_)NFd^{!g=XLqD^PtYe+uKht6)#7KW%SB);y~UkgIdgsqAu+1u_h^ zA;PvT|D%;?;sz8!t^t-G#(!T2{} z$@*%bK6=frAOt|~m|iH;B;3X=s2u#XJ+P__6tw#p8te7k$waCYI@Gx@i>{mutH)T; zbo`y}T$Q6WN>h{MU&<{I(3I-88*a!^LWek-q&VFPBs-UVGoz7Mn?q3{xba+s7)Yw> zGWGB~(OO#r#i!_iws~!nQXJ7j@BK&<#pi+tN^$fuMo4eGvftR`A$!7#=YH{ylvQj( z4GUQ{GgIO04wdOB+tV6B$~}`npqYV!?R{vX>N7vUP_0q-`8Ym-322?NiETZ|YX%xg z+pJEx?fFbxuEu?fV8G1eOr{3rtjvZ3i*cYSMgCI+JNYWZ>@*{Y{^csJlX0Kd*wX@0 zWzA!=fGHnos(w+c7zEMo#jnyk$(j?q4E|Q99hiVl>PPtK@UkieK&Yh3DLX{r>;cZ^ z;$_wUu&W#vDB;m7{{#m4bwO$gG3APoR)E)@qBo38v0KVfy!qw2(r>a~f~9FT6&#ks z+vkp9?9Ir$*9n3#h$%nj1UnGbE!?V4HM)Yn{J2MDtJv+RZ%+Luo?CK-k*bRunXU4A zJX$Pp1!*o>N903Lx|&yqAF+9Bp+$mYOp31$65J)!`^&y4c5#z#(*D=;8Hpx7jC-TB z!D{QdfJ6Wy;>5V`cdJtt8Rt=2Rl{WXKC{jsm+*a4Jr8LwX&M8}L)W?SMz)$L>UozL z*IT$#pPC+wl`S3r)!%g<^V0`OT216N{iO)OjJv0<8BlB_cDVjY0imh1l?%W>(-fYk zQO&Jy1qVUGNIT-VT<@v8PFyA<#RSculS6FO#G*-z$v8xXpq)t>##0#ncRnqPU$rb% z==*)Ft7DGGZUMs!d)y`WXgJ8` z!|TPJGAXx&v8`U<@D5vm*=;QU@3Du8qZ5`W=K6hX$Rr1Riha_b@THMu^6AJ>Tqn27 zG7r?a(*Ur5B5%>qgCyH-uy5@=*3fFRqp3a_H0yEJ_lid_RwIM&*9I0fa1UoP$72kS zu**n?XNDrd|GsH8Yl$Lfo&|p?oqip15m$~#QO?}gh+*=Bao1a@X4SffXj8!h1VK0T z!lmK3WcA-a;O3yVl{+iwIEUn*(4Js7L1x&hpX_*6Qk1mZIi>WyHV3xL^u8tb>q1o` zfy)WKKcR(iEsD&E!v|d8zcf+!F5d1Jyq0**>?TQq2>N%q=dH?`Apt0hI&Z>xvx<13 z`^FXr7*mx2-hF&NIEz<1{jQ>lP2)bND^Q)f62p`>0^Zl54rTgh4fx0%?q2tM0?Yb)qJ0=|8D+7MTsJ%chjs6i-Q&3 zNY?lEH72;2_`d3U6Ifw;IzRf^Bg=;#`z`E0R*Hx27bNAb`Pt#kN5e>$JJG^u`^eB8 zN$;lF&Z}FL`gQFi59xsXKYO!9TAW;qeUA>;POot62wQ)j^F?cC^y43Xh#NoP{{X(h Bxh?3iI}(FIUADR{n{C;y$Vill zfXW0)kq;dR2tg!Z1m}+d;=bU>_ci;8$>MygK++}OK z=RD`*J>7b;b>CK1>96n=k1L7|en|N~R_3{)DzCx!c<1H87n}ZdS=Sr3%UR0Elmd9n zeBm#eFWZjY>7g9g(0A~`Eo%JmXVVo$?H@nfUma*4x@FBP__(cKzX2F+GDMpOKjYmi z+GBg~DMS7}T6$>5ZX`m)1+#`I%C>Gj55I|w&+|1&sk=kI57dZ_h&xae3p&>Ocr9zW8&O(Y|o z$?pRB1&D;V`6A~r-uKD5fXRk)BhV}A2dT=%*TK=I`yv(V8wTPDK;dn^h}h;`jKtVC zmc%qw$yy;2rxX@DvK>>4i)UrKvRtY5sexL}(m+|Izue;}UsxH;bd>qttS-@f z{Jh7Jk)4rhpB(V}eWhAu!0&NX`FufVNpj$gK-y2QDp}U45@w$|#=p*w36I*Yk zhmfWn7^YxjC#*6Njm9pzsw!USDBk9a8e8Z-Ls@q+QOFt^n|@m)a!Vb#IXRA^>3U(8 zLI}w;et;pmCvpgV8V_c|G}fVXv_%YoWmpcxSHTu<^F`7xy3dmIaV8qlb<`@5o>?Li zVJtKlGG}pJ(C2Yzz6Dx#h4xmpF26!9zl7u`a43^}nB=#Mp-_G`5OH_W{xaE<{51DD zl0U&jLq5#%o6AHZ%g^xn%e4xR!!@4gxlwMul+5!vj>&u{nXeS%p!t_Td;rFHn=dlI z>Fy-+Y$h7!JK4O^Cld3q$P;S<0nMII1)pe78XwLssWtqBnD+mJ#8P}EFYYob?(0a;u2V25L?KOCe zBCcfV<3PmCg}3=KwpSNPAMGVwLuCNz8K*=dpM<0%g7PQi@*k7@I1XiuDatpHe3}>v ziD!W**8wa(dGQ!yoKCsfNDN(1)^jxTq5b8m}r!tjmiMh(|cxz zhhndfpG zllfgT7mov#Jpx3@UbsT$N0?}s-(~aWX3_j1d*Py7J4D(p4$`CDF@Urm5rg1}FT5q) z3#*YB+iXdMX&F5>K^%qi*C+SFB1loP7p_ugx;RC>GaUn?G00>6MrNdosNc!I?}My7kd6kPDmdDqGT^zBk9CH zeMTA5s0_FldS-`+e6%e0!WFsv8j{cAikswJBtJu}4_3Szh*j`*i?{ircip+}7|HKt zq9N~M`2~ALBFl?=;UQ=4fjpT{DH$h+HYGEMl6gi9jmgaWOM2$kA~DuzNrX;hyd)C) zdQk0yzZtB-LPSNPsoF?^95Q}y`ET)J>+XF<&nfrr?z24S3bRrb($?p=x3_Qh_ zXRcE!?OjKm9?jBvrw;|;%vF&zKB0f!g&{IfIts)kFt2!jGg!g#(s+; literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/http/http-desynched.zeek b/testing/btest/scripts/base/protocols/http/http-desynched.zeek new file mode 100644 index 0000000000..3661ed5085 --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/http-desynched.zeek @@ -0,0 +1,13 @@ +# @TEST-DOC: 5 HTTP requests, the first one is responded to with 3 HTTP responses. +# +# @TEST-EXEC: zeek -b -r $TRACES/http/http-desync-request-response-5.pcap %INPUT +# @TEST-EXEC: btest-diff http.log + +@load base/protocols/http + +# mime type is irrelevant to this test, so filter it out +event zeek_init() + { + Log::remove_default_filter(HTTP::LOG); + Log::add_filter(HTTP::LOG, [$name="less-mime-types", $exclude=set("mime_type")]); + } diff --git a/testing/btest/scripts/base/protocols/http/http-pending-state-growth.zeek b/testing/btest/scripts/base/protocols/http/http-pending-state-growth.zeek new file mode 100644 index 0000000000..50afba1136 --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/http-pending-state-growth.zeek @@ -0,0 +1,15 @@ +# @TEST-DOC: Pcap has a gap for the server side. This previously caused unbounded state growth in c$http_state$pending. +# +# @TEST-EXEC: zcat <$TRACES/http/1000-requests-one-dropped-response.pcap.gz | zeek -C -b -r - %INPUT >out +# @TEST-EXEC: echo "total http.log lines" >>out +# @TEST-EXEC: grep -v '^#' http.log | wc -l | sed 's/ //g' >>out +# @TEST-EXEC: btest-diff out +# @TEST-EXEC: btest-diff weird.log + +@load base/protocols/http + +event connection_state_remove(c: connection) + { + if ( c?$http_state ) + print "http_state pending", |c$http_state$pending|; + }