From 3ac877e20dfdff6d27f60b4fd1a3c37c84303d1d Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Tue, 25 Apr 2023 17:19:14 +0200 Subject: [PATCH] scripts/smb2-main: Reset script-level state upon smb2_discarded_messages_state() This is similar to what the external corelight/zeek-smb-clear-state script does, but leverages the smb2_discarded_messages_state() event instead of regularly checking on the state of SMB connections. The pcap was created using the dperson/samba container image and mounting a share with Linux's CIFS filesystem, then copying the content of a directory with 100 files. The test uses a BPF filter to imitate mostly "half-duplex" traffic. --- scripts/base/frameworks/notice/weird.zeek | 1 + scripts/base/protocols/smb/main.zeek | 7 +++++ scripts/base/protocols/smb/smb2-main.zeek | 24 +++++++++++++++++ testing/btest/Baseline/plugins.hooks/output | 3 +++ .../out | 25 ++++++++++++++++++ .../weird.log | 11 ++++++++ .../Traces/smb/smb2_100_small_files.pcap | Bin 0 -> 238734 bytes .../smb/smb2-max-pending-messages.test | 18 +++++++++++++ 8 files changed, 89 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/out create mode 100644 testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/weird.log create mode 100644 testing/btest/Traces/smb/smb2_100_small_files.pcap create mode 100644 testing/btest/scripts/base/protocols/smb/smb2-max-pending-messages.test diff --git a/scripts/base/frameworks/notice/weird.zeek b/scripts/base/frameworks/notice/weird.zeek index 47a6b6dde0..919f683123 100644 --- a/scripts/base/frameworks/notice/weird.zeek +++ b/scripts/base/frameworks/notice/weird.zeek @@ -210,6 +210,7 @@ export { ["spontaneous_FIN"] = ACTION_IGNORE, ["spontaneous_RST"] = ACTION_IGNORE, ["SMB_parsing_error"] = ACTION_LOG, + ["SMB_discarded_messages_state"] = ACTION_LOG, ["no_smb_session_using_parsesambamsg"] = ACTION_LOG, ["smb_andx_command_failed_to_parse"] = ACTION_LOG, ["smb_tree_connect_andx_response_without_tree"] = ACTION_LOG_PER_CONN, diff --git a/scripts/base/protocols/smb/main.zeek b/scripts/base/protocols/smb/main.zeek index ed129f8ce1..91e27acffa 100644 --- a/scripts/base/protocols/smb/main.zeek +++ b/scripts/base/protocols/smb/main.zeek @@ -44,6 +44,13 @@ export { PRINT_CLOSE, }; + ## Whether to reset a connection's SMB script state whenever a + ## :zeek:see:`smb2_discarded_messages_state` event is raised. + ## + ## This setting protects from unbounded script state growth in + ## environments with high capture loss or traffic anomalies. + option enable_clear_script_state = T; + ## This record is for the smb_files.log type FileInfo: record { ## Time when the file was first discovered. diff --git a/scripts/base/protocols/smb/smb2-main.zeek b/scripts/base/protocols/smb/smb2-main.zeek index 8ccaa2df84..31f0a7704a 100644 --- a/scripts/base/protocols/smb/smb2-main.zeek +++ b/scripts/base/protocols/smb/smb2-main.zeek @@ -1,3 +1,5 @@ +@load base/frameworks/notice/weird + @load ./main module SMB2; @@ -344,3 +346,25 @@ event smb2_close_request(c: connection, hdr: SMB2::Header, file_id: SMB2::GUID) #Reporter::warning("attempting to close an unknown file!"); } } + +event smb2_discarded_messages_state(c: connection, state: string) + { + if ( ! c?$smb_state ) + return; + + local addl = fmt("state=%s fid_map=%s tid_map=%s pending_cmds=%s pipe_map=%s", + state, |c$smb_state$fid_map|, |c$smb_state$tid_map|, + |c$smb_state$pending_cmds|, |c$smb_state$pipe_map|); + Reporter::conn_weird("SMB_discarded_messages_state", c, addl, "SMB2"); + + if ( ! SMB::enable_clear_script_state ) + return; + + # Wipe out script-level state for this connection. + c$smb_state$fid_map = table(); + c$smb_state$pending_cmds = table(); + # Not expected to grow overly large and the original + # zeek-smb-clear-state package didn't reset these either. + # c$smb_state$tid_map = table(); + # c$smb_state$pipe_map = table(); + } diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index 97b230190e..8ab256052c 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -575,6 +575,7 @@ 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (RDP::disable_analyzer_after_detection, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (RDP::rdp_check_interval, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SIP::sip_methods, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMB::enable_clear_script_state, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMB::logged_file_actions, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMTP::mail_path_capture, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMTP::mail_transaction_validation, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> @@ -2194,6 +2195,7 @@ 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (RDP::disable_analyzer_after_detection, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (RDP::rdp_check_interval, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SIP::sip_methods, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMB::enable_clear_script_state, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMB::logged_file_actions, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMTP::mail_path_capture, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMTP::mail_transaction_validation, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) @@ -3812,6 +3814,7 @@ 0.000000 | HookCallFunction Option::set_change_handler(RDP::disable_analyzer_after_detection, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(RDP::rdp_check_interval, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(SIP::sip_methods, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SMB::enable_clear_script_state, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(SMB::logged_file_actions, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(SMTP::mail_path_capture, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(SMTP::mail_transaction_validation, Config::config_option_changed{ if ( == Config::location) return (Config::new_value)Config::log = Config::Info($ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value))if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/out b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/out new file mode 100644 index 0000000000..524f00fa21 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/out @@ -0,0 +1,25 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, read, 15 +smb2_discarded_messages_state after, read, 0 +smb2_discarded_messages_state before, tree, 5 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, read, 15 +smb2_discarded_messages_state after, read, 0 +smb2_discarded_messages_state before, tree, 5 +smb2_discarded_messages_state after, tree, 0 +smb2_discarded_messages_state before, tree, 20 +smb2_discarded_messages_state after, tree, 0 diff --git a/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/weird.log b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/weird.log new file mode 100644 index 0000000000..f7d257af1b --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.smb.smb2-max-pending-messages/weird.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 34884 127.0.0.1 445 SMB_discarded_messages_state state=tree fid_map=0 tid_map=2 pending_cmds=20 pipe_map=0 F zeek SMB2 +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/smb/smb2_100_small_files.pcap b/testing/btest/Traces/smb/smb2_100_small_files.pcap new file mode 100644 index 0000000000000000000000000000000000000000..4bc38dc36acb1212a2fc06fe6fea9f797b189fff GIT binary patch literal 238734 zcmeF4d7RGW_y6x1Ys!*TTJEx>Xpt>Osf1+Y4#`rfkYvj)x-E^R2HBI4J-b3Ky=F+NP;h}`maIzHLLRn8p7weySIXYdjo-5skhe-)XsnU`R4-m{egf#kgB_U274Sg8EcA=~l$NqO=VK+6%Ml#wbVPv=NH+s^tm8dpO{uGIdHZ-_?RU8MXTs* z>YDt4iXaK@?hP#_l}fFJ7Eeu$X|ZH-;9Lo>MX>Pm*=C_Swc!)772;2vCL{JR_Cf3^LxPeFq;rep5#0i=Ydb*XRpTt981Ce#JQG5 z_x7w)f9lYCrXT6o?1P4tZf$%h?Xt&TZr^{r=L%T&+zx;3lyiXD+j6s zY6L08mdOX;s-_2PVI?eITmW0@TyzBYiTexB4blPiA@| zWcv5CVo7IXc3X~@ zk9*)>T%0F4P^EIU4wc(huJmMwn$_{&Q!510;4`tWePh!z75eXY{7!?;+6n)+O@sXT zZ_1yPFJJQPyDHV1U8K@Q`3u3$-LC^F;fnI&|vxRQo47 zb$jB$`gN;Su8~r^N7tv?_I~P#PEU91-s>qa2AenEukNk%>(Yxi{P6j_Z;$p^cyX8Y zd0Us?c)=TEmfcXRdCL|l6)@kT|C8V|%vo(vSf8`hJ5k}&!&zb3L%)YNZ<(v)3>E$i zEj|hs-v!TbcW=~{D^l+wiv?m@gq)q7=gHY;V4=S|XGwvfj!_mjUe2ySlk#7+3Y2pG z{R0m*3N>rigleE%a>0Yn|B#SOG zaCdK1)3>KjMT@J-#I%StUD45J2PzI93*1RbR!l zh$B~)dY430 z^?evDt^iZGyEn2pH?kOoI zAQi@)x`FG!7%K9!QIYiNQ~~AKe^~*)2SX3vs8gir*8I>l*gM{h6d92|gDPNWOpB<< zKu3{XIEH|YCaNM_0d7TF*WP@!Zfq_V;93a;76-1SxLbgihDxYQc^k}Lib{C+#_;B? z4V1Xi%U!7CvtV%*xQn}cqqrBO)+37-#- z`Uctsx&}H0o&?hv!vLcy=`%5g)nz#bQ4L!gKs8L)sdCAO#%h>_7FT^1(_+?YKvlHW z;8tb$Jx#jltAXn$S`8(^OG7o>OSv1!Udn2i4%MKII|VEvA#itZR1G^*>!Za}-^H|u zalfCX8m73bAzvW63d$$V_rO8im_RY%lhtKi*C1H1O#pKKvzt^;W zr}lWny1CP+U;1o}c6DivR@Tk*VCaz);K(`Gs>SK1dLQQxTn6so?%q(pq=M;l(Bi5_ zF)gBg|2g`7j{ON1cB=ZZVO#wk1|#@yX8m$=J6x5_ePSpb`D;G9y~WRq$!}bl?}B>x z=~FM&IEcq7u&3ZBunApD21>!_tn2QycKE*n`OeZI%LmlG5vXLS+xt+Z(_vOg)a@fF z;mzA%X6?}(Rr(w)J_Z&y!SBM|y;0r1mD&I;p87AQMbv%1NB7Uc!gFrjFLc$dSTl=J zEMDFImsBEfPTAbvIiJ^#)-V-jd!s<}9D#29B!6HW{65^> z8woTd{dFqLT`?`9Kz*|al*$4@p}dCzabemDgu^^-n7>=WJwrvLQbqJ<_hdz^hKksz z3;1rZxE$=`?%pWiIjIfFVxgE8G2mCS1l)-OMr*}f6(QFD@hhT2AUWR%__rP1?!f12 zhfxL8F$$7Ck18O@?#l{*6LXK2(FtGP=qHpH}uf`I4pgbLLZ zSZJ*Z!WCdE$OSOLEdhpZg;P)G;8+m$2Lcbl60#X-a4mRjD2n?jh0n6bq9`6M6W;tm zP^UplHBuW> zGJCP_vONBS^7vX&1AYGjE#}>B94DHP#k?^sddq_>g40@f@Pyc+JTAm}tJOGh5xB1( zIMbICU?v1n2IL7t1o45MJ;?-7iwXvF8;T{Vgx+H z-Mvx#tJ2>@i>oHZw21L9$`b!THGXD>ZTz*^jkLS=9C&L+Qb2d)pK~2iqfJJQQkzjm zyKzLaMz%tYY|&}-8CX05zXf;qMjCyY`Vd+?^+`;NsL{t+G@9ww$h{sBL!y{yn9e5Q zI(kx4{w(W}{_y?l-7eziwc+>6@8!{)k8=;gqSL-Ls+hhEV_xm_g{-tK!O&w*>r`y^ znQ_sw94)Te$|`y+qKeT)3lGE2qNQB2chO?2BEyS@me$~29gqok_eM#smf9TMJKdGt z6J_(*)8Wk@71IUW6)YYAQ@Fb~vbZy~1zJ3{Bc??R`28$pqdomnSelPFwB+RJmuHRo zrLUlZaZW;u^nO$<7)PeH~adAh8u$EF9A!>h1%HMNkCT z;?*r9QPmHJ`}d9Ur)N;z6=iQ_l^lV(dqNlg~*9b1vtJD)}TO7Zgc@0^)97KaI1^^fxVtyhC~17^<7n}e za^sV<2pXM>@=t1%$ zgL0MRocs6Sk{EvvZkLFIb&sfau}8WX^Pj$!dc^5ySLF z$7Xjt*ykA23fOJy22b~NfS>2fmAcEAJchuJdNyiI_`sJZ@qebdeuDoUWCIqw0gwLq z;XEYzi<@ozB{D|g@4-4P3RP7HKF8g?(a2jZ^$D!1)9t+DRGXFI&D-HNr`RmZ_htUT z0#E^W_eSH?l+-q8G4p>hE#f#e+Nsk$NJsdpjXSSAPR$0>cwGm#2R{10yu5!=U6zuQ0ectwjT3;z-wuP%e%fm=KsFecn$jaSz|*7S9dz7Dgt z+M$aWUAAushT2`O)B$E~4_4MQd-DgXLk-~W-lz`Br>{qgtBP|Scr0QaTs$@42J?8;1pbF@9XKaeq&sY{d{W>&>`kE4m=-ZFlhnKmhvu z^=UrNp6II2Rs=&&4%5{`@%_d=-AH{}ET%Kxr>DuD zyH9QNquRqhEd?qX`t(Wa)5lpw(Wg%i3vb>rPst0a_$6Ar_NbAg?Ws@yj%m@$(XY^= ziKACiRl?W@*FxgmZj>y4)_q8mU*P3*9#s0n1$O3Woj|=nDA2K<&ao|bDhW^ ziOZiNuJb|HS^8C4UgTD}&?b-^C{YVWa9VNC0zD0ccn|elO^-pNrh*VVrvyVCx9bRT z{c&TRZ$^u&F5(P%Ec&c-TSBOH#2HuX+;-$P*>l(VwU(Ju?O~m#fQtIOq&|%*o_>T? z6m{NldwBD%(Ym~>Gv_5jc~Q=j?;1^+_L-Mb*^FD47u!)@)zNLwofq5DT(yUJdEcCu zj+B>&v*zXVG+kbboyZ>;oE)HC3P%SV(UN7%Q<{U6CNRYGf8P$sNJ8ZYi;rIV21rMC?v0b^{ z^fezH1M(BJo7eTt{v9ud*AU>$lr4+@ne^DHGG)MS{zsOT#Up>sN0$lu6z%d@hTlk@ z-HyJGk1JP#8E$Ww>9&O#Z&&!d1I)d;LJ{?bpTPRA1=WaWOK^8@SdD>cshzMIPo3gw zjE+0IH{dMg>{w4Vehn7dd9zo@FyF2;&{By1&YP8O%QEFGJk>;$CtPyyMV9!Wh zjT{DxhUxb+R3j~7S_F+;({I*DJN>>v#uBeaa(nt+-qJ4~w#?J-)5Z*?e@HdwoK}-H zH!>LNJVuwHr%oED6Ca_)4CSGxJ;EYn$Tgk#1_wgZbiy`6iB2cpyJcD@6#c}sVgvCw z1@;vD1h)Un>4a@&&rc`Xk@hyzi9t|}Ffi(-6WwUMIN=>HI*$o&-n&(qPGB{D1BSHI zi3;RX{L{wVmugjcrxPQb-+clRcz6CYDw{>grezTCSN`tr2Wm*h8&#k;_wVLI^% zSzH{`BGM%~onR%j(+OK8F5tk>y>E;Gr*=p8PCv-*2~>1G9p1dJxGvzoz~W5!6}Y=M zl5l)#4@&(XF)d=i(dh&StesBWD9y)11y3i`)MNa4GK~rUl+xpPD-yo1cretZu`d4R zU@-!o;qKn#bYeSMbk3A}EMol7HF7$^@oT3Ow(%!Aofu@)D77cmNE2^HyEKLxQC~sl zG{u`>(J-CpMK#hirbW=mHJxCMw9|>3WD4TdNN!IjZnpG`hb{ATVx2KV>7P-}IakwV z&B06Qx`uRB-0`$=I4a@&&rc`XVH)He6XvrMi=i3~(}~_RUi{3}C@9r66yE&RXMU#>aDyUk@x}}8OSP)J z(}~sKcO9^YyL*$heDM8S=GUtgsRMCjhP2Ady~_NFUX?v z#HPn0#vh$daQxcogl+tZPA9%IYLxmc)yVyAR`soYkAGxz~cBZiRIjYJbK! zo!EmGGgffUJr*HDuIYr#kbXL0o1sLf6TMbm{Vj@Kw$>Lk56`LTgl%TePbb<@57?ZY zNP}uLOegx&cyXAkQH&Se3Wqm;yH}Y`@OYs;J5kwZU#eB*olcAazYTr)CH3WT_FHt( zw|k*4d+Yl0bFgSQJF%B6&WLFd>EfMEU_WT56ShitrW4;715SMo-8t zEJnaH+})d;PV6U(&eN_Qix|I;>4a_kiB2cF7&S^AKs8dIHIf;HJA)3W_q6hJfV!AOy>0eRJ{lt38nuEJhyQ}vaIT`xq zFXMFLYqXfLB&J2kkZU?|0GAo2vlF%%N_09gwC3e^qUhJ2XioF+oSIJ9X7>Daq8;^s z&2-{-s7AwdVi1iN2e=x=2-F?!**bVonNDCe9)Mq~ole|FKG|RFP^-#2ok;rINSAM@ zFMnXaMPD8~7!37L@0}pOapbHA77f#hZ^`1TF)bopqSFahLOY$XRl+l!c)%EN>R@#5 zbX|5&B&rA8J8|e11*cBHUBRMZI`KTE{>PXWG2rNQf&I-TJ7wPz=6<4<%tvDc_kY8utZ zJxWI5-ibqR>T2X1STsy0hER>viD?lua!n^#BkkDN!T2p?m)|PA3kb#f*6|EkcHr=>!bm`m+ zRe7fq9l`H9U=ersCNFk;PkrgUQD5}s;iJ%(>b(;VUET$YhUvs%vN(a2@K{8;M5hzq z$%&PAI$^7XXFBnbG2ql;=-%nO*gcsjxOd`6b!8wz_r60w{|FWh(~04fdS__!Sj2#% z(+RQ&NzhIwZkHK~hYFrfsHsP9e>29PeuUEVEypj?bEJAO)Jwg0!im4`f5z#=4`i`* zOp6$QbUMNDYo`;o@h3W+Xb2JMn%(}ole|gStHmy$?|92havKd0&wJep8Lb+X|Qu$!Kbvvd-~7)BoyZ)UhVR* zWxm+a&zPa~AF1ZPW<6yUuL*{FhjbbG@PEeX#7}53V`fZ?kRjJ}LS{%mov_VNqSJ|b zZ{JG`uD4FUdlJ(%1@;um+yCvYn6{ZcKb>et>f1~wzK3cwOefN5yx7gvD8`H4aPP#A zrw9)8VI0n9+0axQM(Jlv_`W>bs?2@iLm*sIG14 zmmRAAGS}QMR3Up5lo&nV_QKG(L_hh2rzJy~96jZZ&+I2e0id(!kV^ph&LNO1R z({qx38$z+oWJiNE9Apq=-KTG zs-2pfmuy7!X|$Lzku&76m=)CrO{libP@<@=P~g}a6unr>#f9;hQ>eDh?0HnT!!%eu zk+2%7(SYhPG+unh)hGz?EL`(Hk=HM(?E{c@|D}DZXgpG&o3Sl%&30NTyuX>g?z+% z${}G_Fw|eYo{oAR!YbaM*NE!B(PGBvm=?XLCW|Ii+h!vKsZP>QwS6{&>NCsaBO2)p_$7 zS?~|_VDv!0o4;IQOcEy z{%}40PD7+ z@sMCfby9xgkZ_hNWDDylP<`^NU?{9!t9EMc;Q~ffpF@ioFUGX!6VC610I)tSGo9z@@ttv07 z2ZG;qz#8uEP2Bo6B0zn)nf(@hdHOQwOZ8gy_dJDu2Q2DQJtB!L_Ks=Mi)yk6K50>H ztAq#D`@lT|swYvRoKwm&QE;vL^pgsz(Y^1%JuRvqkb1^T6r);A6r%cjb9$0V%uR}z zPXa}X8FE1`+ zM0EkO_)JWTSyBBx1gk~0tr8woR{-}6sD70arCg~P2-m95boGns2Q3rDs8$n&V66t; z8q!mc#C%5)vn!-Wy;kj{X98G^fM>Y7H*o@d#06wg`D?;wghijIwv9hgR4;>w45*$$ z8NG=$lC1~Vs?Yr57uC(AVDTnjxsB?FEd8=W^*iR8D?}CYHtQ)+edd>7XpnlX+Nrq< zE;6F}LbRBnyi!_P^rHH(m>%m<O@1R?27*Pys=6>)d^)B@FREDyEvjvm@SyrtaL<71X_P4CO2uHfR{eKh z1=Z}Hc2(WNGEt0bHBl($9CLb#keDkKG5bP#)N9pFdX9rd1FDOX#VRo^dQr{sYgg5_ z@h6Jv;)RWiHyEx}|NV!8YK};|s%~kS(cDILD@(uZP<=J%X&4fUQH8w4 zdJ0tk{YNnLyn3zLsk!b&jHtdCEoLaMYnB$Xq8bKAJ*sUplqjkT&e@y?MbDQ%Z3`ZA z3e~omJ&$U8RF8maG@yDqjTg?DN-Bf}VyU;WDa_ zrL3nw^?zrBp&{zEYSi-xR`Jyr8&Q2ZTFg*hg)A+4QB4+2sJ6{eqNx6|>;o%M@tGgI z`zIcA3e~omJ&$U8RNn^GXh8KW8ZS0*eT(s82wbZ^ce{dWS&jNt^-QoH>c-H5_6#L;XN@meppQQgMUFP^=dQGGS&X&4f&rV5$QdQt;}mch_4^;)%4bK@^DqB@8cGrX@E zW{X}_|A6o}q1rY>iK6;}YMGy+=#_2^@5N(Ip}Gwkhb>;kokw*$(#hsp^#Z6y1FGlJ zc;Q@B6ywFP!r@4AT?N%xjX%Jz)t&%vOFqTV9`~hMRbEu@1HTP@c@6dD>)yUht_yvs zUaKa*kuEh$7*TyKS!^EDq8HVygcjAdN_bG+7~C_U`gKZ_a;0KeZ%EX51=Z}H7S*D7 z;wOqxttJY^Yz5vL(o>4WoTG?29@3*;t9H^e6D&rcgm8Cn64j;2VyT!Gy{P8+wWw|< z&Bq&N5=He!h{&+2o<|wImLrm_w<8?MQ%pfMN2Epdla>+XHmciO`o%+n8P!|OHCKiz zWESfwP@Sh(Ff?4fR_)YW;meGuE{hg3+Qqb(71b~}>Q8{%W++iq56{1G1B(9W(~n(^ z$DBg7ZD!A-T8uU}s4fN7Xh8LR8ZVr`J1EAB;oHNJe2x5~nx5l>>WDW2a$l-d<02U3a>T+bUaZHOoQEjV)2h{_>Jp-y2 zP@JC!Rc!^?EtBFEXzhF+!^(5wNikMR&J?gb;Cq3K2Vgx+H-MvXv z-#`|xjA_v)s%_&>6xGKeA_J-yQbw=lh(znXFfJU)e}!LEKP?4|m(kotbw^9Tct|j# z`ge29m8S}s%6bY^=f5HtdQrVr?bKXKNh7K&pv8>VF)eyg{i9gN=uvH(p+r%A;=M66 zVupilEk)B`rCZV1(AK=mRTFP!^-#CY-Im~fgM1#79ACyw2TLd>KmyqU-foT!RFAH>a}X}8|g9uEE-UK6Io1+Y0-;n zRzka~wpGG|>P6t50o98sQOcEy7f(Z?<|?RW_q40(&Qi{J13RNyO%#gxmN`8)lbEk4 zV$KbQ($#C#PI~?XixKb)clRbyeG6GE5!0d<)f~TeRc#x8qNpx;g%Q~GMd|{?rQ0m9jZ%%o`xZzB2~!CtfxTr1!aPv5$d&Sr{+3d zX+-s{Xfeb4GF!+FS-VDQ4}S8;K0M|Ws%74Ebb_YPG7os2&b}8~U;m_2mR_Utah)bdh?k z+Ud&(STvxzGFf!~1eoY_Y0)RDZI$q#dLOuFK=m7xDCJ7Uh?S72rG8P}%`#DpYBf=a z>VxL=R3S0PDd|}n42@K;RXgb^ca;&NhE) zmvKa*^+v+A>WgktP>m7&1WD7Py1QjYa~st?Ed8=W_5GlyVMwS(6*7kP6b*dQO~KG8 z^;$LQiB&x3Y9p#|LyH;Sm)Syg$f6h3GDCV)+h!gALu?cm4a$^PrIt_CGr$EQH*LeQ8>t51Kt|alR{#SRMN8w(xYChcGB}CSd4&YxVtyG zs;)^E3&ymV71anfEvjwfPZZU|AtD2+S5QVT;fQ4G!L{n5)%>Emw-hX1>*Y48`&jzL zLxTAP_!x7|-A)yf&U%UlE?O-ZdP%)j?bO_^YmBJA11)BFUuFy0A&WjyZJVJ)QGG+H zo&8btp@Yv{i^rTowQXk4qq-fY!D>}~1gg=1>bGdTaQ+It7%yIeYtQxYt0o5xhqs2HP(R!od zT6OU|6;yLX+EsNwDcJvSs3vNFZ}I%HL-hu8&DEv~8Nzys1}=VQFf>NJR_)Z>xl%?{ z--8x2yf3qb?2tt-s%3`st7_W}C5r0z);_lni{Y&UFRjC4PNCX1v*%IW4%1+T>WfPo zQN4=B3+JgCFN?by&wKl_ z#Ba}X8FPno!!>YP2S#(~>EIM6U%!+Dcp%&G)N_bG+9o#dZdNn0Vxl%C(u2q-V z<`>mrsb{Dd+xja9EzJL!pl#R&XH+})c*^}T3u<$p0P z`b4#D{E4Fa2t;H+^%}}(VU9?&-dMO+eQABas2(5%iy-apmVj4eX6+utfy$;OX~+iQEi){L{WYH)B~$f^nXgE=EdU_*i-Nm*hJ<^21>!_P3w1RkKfy! z)(#JWd}ry9<-^%#p*po?O%w@~2;`GLVVl|Ws22L#+*Vc}s?o5jew)UNd0gLOych@9 zsxKd^pcOnG#wtcBql^4~G!S6a?5qI|{QQd(0@;UZf^yTG4p^MaO)#NwQ zWfWL6pgNT-I`4V(SoETrmC&NvRtXQP=Ye|$RIjB(DOW1S!L{nkcPOZ4_q40(!BWq7 ziQ++8O%#gxhB-YANz8sqdUgauNHEg>`)y9Jq<%bBdWQ+ ztfy$;l8u9*3F@_Kr{ZJXKisBT9+V1w#sp&AXSUPt4F^8lMLLJi)x;l#~UxWFV(8@qWXF8 z+t8N}P+#`;_T`l?K^Ljls-3=E2Nn&eZcG-Pmq&?Cmll1Z+Exhy4;xiWXO%jA_v) zs%_&>6xH=1BEzbB17)-TM1jb?c2UxE2-2fo zt9H`!2w04OXSlmJxvFl77FQmNY0-;nj$gZ~wv9hgR2QmXMD-@hXkLy;wBE~bt@@g_ z3aU9G?W#Im3KnmcoZF}#Vd)nS31(DZ4SE`Ct`*f>C)QIm@HK6Np-JksYNzJDywQm2 zhtXn&_hq(_9kS>}^>Hyc>QQZ*p+r&L`0(%aTv(Z!AJKv#r%-L1+4HDwM?GMJ>eEn- z22{UCVVangLy; zUaKa*kuHzjWJL9&WYKxdRdl+v=tVUvp+&W=5*}2a0rw26>dllW^2n1X6{ zPmAhNmWg6itBFD}AGq0=p4KGhQ%ZV{1w*f>*Q%ZLyag5`;2G}jO``fSw7Bv}Op9Jr zbNpIV+s2r(u+fdcnEauXh>z@CDiz!vKYdGhRb^#5$GkmK(_;~0-^mT`iB z>wflI7Z3XnKkC^~KNOMu#4pqEgWUMvm4dHZThy{UKluaKI9L2_t0|F@2wldidkdfWnk5{LW^g?Vk=MyclU-ClNzRO zrP1iem=CNTZk^nt(O79dUf1bHqapI&=j3Qq#5GFb83Ekl`5S+Uf;zW- zx^Q6Z4FTGPUGWihz9DVI6R7hT=b>LQUX&dh486J^$BS}sle^$Z#*>&isD=h!ovGBR zzif3*bi62YXZ|ZOhF_n4a|<5-FUJe_9W}Oj!13bd>!Fg-8Q9{D8{(&;A8|Z@k=faJ z+^8tO!**x=a&x;1Fs{yhVkjN?Yd$&#Zax`910XPfN%?f6d2u_Ge1_)nP1-@Sw~YXqvqw9h)Uos&I% z1~~duk7=Lt*tYoMY~^>Pv|lYyDW?5I{eRB!zgkTDtpA*A-^iB!%N_k=*C+RD=~i!& zeg2w{@#^P2X}@ORwwV62{&SXPPyd&t{oCT`f2iYp@}Kj;$9Vqtb@Y#&U-th{L(yOS zH6P>If7S6nc7EB<(vx1#mj6Aa{mOyZ_0M^1`+N5C`@XbaGf*>Tez`tNXLJ0SEA3a; z)DPRw?)bAr+OH93{LHTX1&;r*_2D|nZv9V^_HWaS&ul-t^*PP4Un6FI*?xA%&vDXz zwK(;8XuTNUxL)}fufNtv`zf0G;r?p7X->BKtDCf6SyMkrzx+mgclt|y&EI$CHm>=D zI9DJh2%V*UZ}mjy53GN7^E+AEzfI$RqV}ga_G6F#oX70)Wuv1{?D<2Y7$#ux~`D;GLtIv*(efR7zTA%EHcE|r&(tdT# z{E+>eb8MEFpD6tmZ+z$??c-T9cLb~tj}LS1T$ru#VX(AcB@Q21f7XkS@%&%r=pTE0 zW;@x{f4-xC?D-*&57{06$4dLvG~;uk_D4DPW3OL0zooOe{(4s0ucF~E>!02E!yD3m z4UIlr|E0?ce(~3Qj8{L;Nc)vF{l)%gw|?eH`_%)n>y!QD^)-LZ$9Utawa@xww}0Ps@*8`8&hrQ@S z`_KKG-TCbVX}_B0{0aNd`Q@+q7_a_kIR3{T|C#UEou6!x_G@bV=lmYppFO^$N&8hb zv|lBM^1I3LUo(G}^EEy{!{ag^HBJ5S zIFsG+bGEc!T{Hh@|9O1lulX2ne48rm-=%qYu|1&;R*rKE|uh^|C&_tJ7$Ga{Xj?{;*Q|pAu*O#`VL$kB{;6nJ(?$ zrdhu*U$T3CvX``9Su;Om`>a2I&Bu8D50v(+XzX*HWVilbarE(KnAeY7Cv2a;=3~72 z*(mGBJ9|XE9WO|ACTuCO%x^0#A#a%nmH4NM5I%og+Yd*&Ff2iZXW`4rw zC*}1!u1h|~tIwyUeedi)TAzvLH$&P_(adkzes=jg$MN6WVXQyb3HL95&Bu89Pn7nn zX~s|XKfC7#7D@Xx;^>oI`wJcWvDZheLw3iX5z>BDjXvB**`5EdllD_`$o@Ny{n+Qn zxQ`CKI6GVCC%a1fl{NWg{j)p2eM#D{rkOuD{`2)0<@{>A@u8EWPjqa<(U1Ep(fqD; z?8lyeCaTY9N1xc^Cy&F~9iN9u`&BjT3$~x#^OOCg{VJOLvi*$H2ezgtK99n zuM+RhdlD^<=~&qG$i@d`aZ*f+aKGPKxQS2R@7EqJf=}8r~kEEMyz>dzJE+(Hedg3{AP4o?wXHr-**H2iLR@SlIgQJYa$D-45;<67?a;`nOls zDR+k>_ut^X9Y2HILyLXEqT!K^kI3Tmm=-Zn!##<@fVGcoOt4H;N%?bXqR`v2oeP^D zuxN|kt~|)zirYx$6Jw=?7J-sqO*9;u(8#msdvE#fWBpo-L}gDByo6z{FJ(VHeF zO7r#i$9=%!T(a90`FWbWBb{$)t_|Ps4;P0aO#y5V^8*%q(|UBe(**tv->P2?K7X)h zBYJCn{i7f69<;fBkJ&pP$aDJH&OPz>*=*(EhuB^*_`F_&ZcTOnF4lt{nBOaU6%GuA zOyKU`C>wo7w4;hu92{ht?k;-`Js|OM#?`;!xA4a2d9as)oz*G`pQ~!6xc)!>EWc`y7v{PLDd0yPyNP5K zb;68X3mGwV+^5uWe|Y<2>fUgq(NEBEXI&kK{m}s}4g-sCgLT~98{uUOgDd`yct zhR#rP9O&uJalt^ecV3p}>+i2-e59!|{v4L9+|-=$_njk#F{*drz%=*{?(U7k7(L=i z3}aP(4nqvCjeZJ-ris5apOz(zhtx2*RBgk!IMBp%?|9`(l?tJ!q&?-ZKLJ@IdSyFzepl z{CNNF_kBP9mZanTO8)RdZelR0pAmykQN>=(*^m{xDHwX~h=M`Rh8Bai*>Er@&$H<6 zYvW;**N15`+iQ>fa0)*?`p$r3cuW+7e1Du@4EoI~W3V7(#L#h{Q^)|I6kIDF9kc|C=8xzDfp^X)|P^5<}gvM`Wq?uGP< z87bJ2Dpq-YN8>Mpp&6M91vwj93fg8vrJ(NWiH?FZo?lQEvp(l!`{H;^l!AN}#xDi^ zW|b+p2r^>mxP8=dN4@Crk4dnGdn00KRB>#4iPHy;UjbXH3C}rb0x9jDAD<|G*K+j7A`%Cv+Lz1Qrbx{1z={E{bWQVwHD6G(8av%{r@4 zu#=d#=}(E;W<#Z*?imjq1#cO>_B%}ch9-x8!DFHnd}2oN|CVdPu2iaLSr{?6HoGMln%!HWAcvu)plujgC|HFkm^|2+!GomtA$C;g zJsaL<-fXxogB8G{fr5v~;_#Rjy%glowG@Q&-?YUWGns;F<}gt!z}pB|!QH)4qE?M~ zh7z@#y_Ja?4v7+fdS#KbXlHM=XGCqiRVnCaOu>lOnKSx5>Hi%^Br^){Gk++rE~DRq zMFRy7qs7d*F)ey2C^gcr1+i{$i&;^>~#*HN(blE5g;`UiO$ zRlsAS6yzuV{Zi0xR+)l@AtMF~9-)qNuBwQRn|on6(!8G1ahQ?L*uyozqJe@xkVWSO zpdO1}3X(;TR7=5GC^&3>DX8X5SaE&CFeXA61`2kkQgv<*5~bR_9+YaDLO~8gOF`Q( zvQV%pQE;X?gFlkqUvp1Mz0)9rujw-QF<3NE@F%i3IHpA}1vzvr1!qgq9ZIUQzZCSFRi@w`$cUlij#0-s=aWRo%_|v>w0u<8aTg9VQt&ugZ0qe|Y0)PI z=c3@S`K6$mGhxN`5r?9l5Qc$*y{J_G;xI(1wtN&yb&OvM+J=#Zg4KwEgTPTk27e*F z_pqZfgYdfamKnMXE(41O3Z5W~{bO46Qm_loj6hc{1z(q<+fq=?946|z;YJGfrbKkfJ0ge+Ip)}(9f8H5#0h288Z4S>Hh^sBr|$69BEZW$tXpH79RqO z1`7U$7BiLmo#qLPUJ6Q$^c2Kf196L&(VU~8_jy7c1NEPP>{pWt_5ww$U?!}h=Lct zXk^wY(p$L>yI>k*@FQ|`xN}C39n~^xfs`oT2*)coRcDlSAb1-AJGi?ydH(WQlJyg= z4k_zLAnO^w%(C@XWtN{203(_S5g7<`8Y9Y_$PvkUKNF5Tl1gJ*dsTluVHQfk;_07r zgz-L;ts_i_-miCQzqQUcGgcg^x_aRn_**G}o}*+$!JsD#nI*Fr~_ORu~4Aja9L$Nf*> zF;T+s`+NNo#&1@cFsmUW1|IxQ<5Mfni0F?+Rl<=+M^eYbWe9njA!ej22%zNwoYtYu zFAr3OrJ3jf3+pU|VccoSxBaA%w zgY@pfj!L~3g5C$o(I^ktQ7sP^ONHW%N6Z6NXOwjmcx&Lnb0q7B?5&jbU@){e4|xk( zDY9zUFt*;RJn+-67|}wA$iRa$7*Xapj!5XgI8Qjzx(!C;dMr)qujj!MOZ{_>2i_;- zbvzh--|2@QxwYQM>ED%^-|)$c1G&kAaU+d92vdC(;B1KcYTYInT0+mcx*kj8Y-m>; zw%JIO2W#HD`D#r34@tEV1qt(j- zg9l4d9@zZyKvh^+aec%#{{zA>@L&KHmh)JFD6Ge3Lt(9=Ffcw#9@vJFg$Ff=2bYa9 z^58GhTe(AJ$tuwMPjb`;58jXx+44Zu8D$*=-Wqr?kYwG;)gfj5GZ^ZhX& zPa871Pj2#H=u1W(45Io{9(sAaUoi9rJ^Sh6!82kus$U=2W<%wH?!6ki^})~8TO7v3 z?|d#yTu5|%!0+eq%LBhzWgff^88PtS9~z$?^!CRa@QmvdZ&Sxdd4L&t287VA50*Lo z;qRehRbgo+dcc9}D1>3)!C)$^UpNdga6R!h6xL=61OJEM0f(VoAJ~SGg$F6bgF>T? zJouON?#zyg@#u}s;YgbzU_T#13J?PpL}A`Fbrk_Wb7WZ^+g z;=w=QsNtITS<+j%cW>Ee;Yd5WCg*xF5|6N29%MLr+wnlv8D(uZ*2sgQB3B@8~yUY)?1Yae)<(78Uzs;cyJCQ%6yR{5hF&SH~M&ggZu3b z`u8_1>D+J0;JfZS{?6{#n!ix!bh+H*!DHi$JQ#-A$WR`HXg5C?T0xHkx_Hn{%trM* zu+0YZzqe^7XU8R-TBXx9g;P#)O)o-a}r7FJvzvCTI_7$`mN?u{;djv6tX z1}^9EO)+pi`2!Tz*A&KJhX)+SgSxjZ*oJ{T;9^0K#ABw1!B0I78YYq4?G?Gd4oBMG zL4HP;2kfU72dkwFwx^3!nNii||FF%Y!wR`uoFy{p)dv4;O zj03*Woa>9f<|Efv9+~Adc`RS|m09@dqni#?#bcs4;6G>U7YBZ`$~YJR88P4>4~l%NQVc>Q6D^5DU`)Q0|TI@Odz_ik=X2 z@u0hyjOuw{n+=r*y4SkvcrdbOg&mmqM&;h6W1>9ZKVRvW2Y$24Jm>`(G4LQijZgKx z{jmxjh3igz@@zKxnprCtUoA> zC=WOcEe~wN$if4$KKKG0HSnMS>HWB(_aC5lCvr5(19nuqK3MPQZFjmz)fr{2Hp$3? zmq^w%?5*HI$4Zasvln3msc70&$t;z#G{fZH_hKLM2D2Ned4&sOe4^}q?{f}Zq zE*{8;^y`BSmip%$5A0s?((+iouLrzZfBDE>A7A_G!<)mo$%A`eG4fzEW+OwnOT6RJ zU}z0JE2Z!NMjt&7Y_pLl5B@vbK8%Uq_WAYccubTB{O3aa^1yFanFk#qBL*H^K;u(g zZ-1m#=L5(vYjNIRv^=m4BMT423t2t|M-4nEM0zWad%T?tdee-^b@_lD)$-t7DUt2^K-C##y?L^c z2V+Urm0TTC)-;gyalbsU^)^u+G=zu@Jh%`e$_#Tvf(LIu9*%Sg_~pSSOZ{_>2X-$z znQ*qr2MvzgbKCHWjUKIeWBmtnlLr-EHS%B_W+OwnOT0@U7+OnD4Y_#GL(E3?Jh071 zqCCiZV*AaQ_z88#eTm0JdC*_}c^6ehiu$35OD3VOdvjz-r9?5LIpn;l2()(5K2C~J`^MjlKcSyym%2p)8O z6=dx~-bU94?5%cvVC!w7Jh&MmGVq`XMwHo)BN9A#r%O2U%;gx7YkeRi(ytF9mip%$ z5A0t1@&1%w?z?_kqupy3ztQ8Ct_8Q`CJ!!}YUII0%tnTCm-sW62Se-VsUd|2F#70u zV4Dq<2f9D=t~+1UYL>VXR_UGXJFox}<-v2=rNj84Rtzn!>>N#QK24 z(DJ}Gj4V75FX?z295wKu80oD%?y>%A(0ds<>VpUGJ9^vkK-C##O_^ro!6cIPO|A|p z>oSnFKY8ne2e#g-Jn+-67*R8b$iRb(F`~>q9FgF``u^ca_lg*iA0BMA)IaBVVD|!y z4=yVHzx9Rc>{~lw){xmLHJ9fm4~9=S^57NBMuu{ic=w9I&<1*H$i;)6Vm7Mhfo(Pt z<-y~vSD(YgFS}>&COjs}gK#!^;5VzxgV!M=1|Afr@#%JNe{6uqqk43sj*s#HGtv_T z(DGm#$^%=xiFIZCpw^!ZK(^*?d#ha^*m|2N4;Dj21|F2ah%$R}M1lt!UkFEf-mCCHMx91rYX zS8?IUR}a5fzJAMz`O{Ly1%57-n>;8p$H;@%FdG>^ayCSL^==&uy+=~Sv3QIH50}fmhA&jZ; zE!^E3O=MphF`Wi3&D;#4zpSw*oKjX2jX=VYrs(h53V4+mB&3c*9E;# zlcPR(uwCk4%L7$sl=YUmMjp%{S?6(eh<@#J8f2YC-bT+Cadl{UVC${Q13&$W5w(Db z4C{j{F`~>a9FeH^&9lOhzT%Ge_Rd0*N1zmS1mg1h%u@fFIrQg*s|4&`SFyIr;c2~} zx@Y353qMUcboajAxyggH*Nr@wiP^|dZWHg@I~a=4Q$sEu^cJ%t{rbQ*8;SCu(15>J zVB#l_`hgx)N|XnKvdII#S!Eu~f{Yk=a21VDmA(BDf#;*1U8(Q@GtwJ`(DHyTufPxZ zT_30lquQPg+x#SiVc@|m8n~4Aa6Y>-7~0ZA;Q@!C<$-M&S$H5`S5ab~kq1|k-pcbH zTbhI;{R$~OU`Ms$0ttqk^IL>9HY&2Qd2Rd0?B3M0wD5!`ZJe@gH{WPV0n3 zc`!JeJn)-U=E1Fy5d#mdq4BArw?E#8=cD?6OdTIxA8^NOdGNW@AO6+{s>0Gt^ne4` zD-ec(2XkrQQr^Sa|Knh2>thrK#wV^Ha2Q%1*oKjX2jX=V?}DR-^})5IxAMHl*2lt; z=Sq{K(e(j4s^!5Kj^1|HlU1Ej);bG~Jb0aCoypZ9c<@|lko6t%Ho89OBWDX*9@u)D zC=Z^5hzvX^g%M>w#SsY}Y<&mxpMw#(cz_Z0fwIxA4|ZGX?~e!eudDDreV~6`#f=O0 z?fUPf25E0zTYO8I%O?eMlLtc=8F?@dvyq|PCjQ)5C-Z`If(wRfP7uWd>Xj6aTsFY z3LgrFKIlwg40d?HVQ61hVH*bWfQtnk5|1BTz1WC@G98D*W zqAd`S0S9FEC~#NXR~s*z@^{zg zzTaKs$K1rhcT0>oScuukQ0@{R@OCit5j{2J!a-jNXDtqFv%xsv%LH6s{52mL2kPa6 zzfZij5);3*)Qn?zOmunhd^VQ{ezVFr$g|XlgX?H~D(~%&kKpmBfqyDEz>M?-0kq45 zeJBrXeoq&v3JWW)kJ#poAq>OvU=a;m%4;|W{t1QEkHWzC#PWc{&@K;b!%&w8RmJNn z`huf|t8hNk;vyq|PB|hl0VCWNi zYDnP$j6V9)MYh>cd2ndIzst#&%()q=J`nhOs2U?~k;%4;~EF9L-%+%FGo!^pw| z@w$o#IBMWQdD2^X+~bqsp!ZXLdGL*t$d(7H&M0e*Wkw#nL9)KW)ggHB{8J$7LBBk( z^;YG9pMJ%NnnOf}^+5%UD6=(3BzW-2LD2sPjL3DmND@xZgKsVM&p94=PZ%`;fB3JN zRfEqT?AZuTxCa7xYFygvnMSG0Cfu;I+OnAg4(8_iV9;_S58lLVWGHuuKmS88w4I(B za`E6 zeZXO8*9W#?WZ{80Uv$X|BM)vOy_Ls3wod@P2a==F^#MDoT_1cWC9>s#sx!(u3cNL} z50;ax6S+DB4~7f`Sx=C+(e(j)t6d-1dYdQ@7D7Y@9^8x(Wj@Ri2_9@e0s8-k5xICE zBhvHWpr!sf#{;|9Ra|l8x9_gREh7(BU^X(8yTph57Yyy7 zr-l?B!04mrfo(Pt<-s49o%jzEAMV-zT|6ergQ3~vf#0k$4}OD;7kP!n9D$)3KwYNWZ!Q)XcG^37>@<3)p zzdksE^1$Yo2dcutit8f|Tz^3rhV{WJ8n~4AaK6wC3Tr8a5#<4gpOk-|xI;*{aHiZxV(QWO#I1O)xvm8ln2AJ$pgPxWggtI*2sgZG(KJ7 z?T;_u@u+lhUrv+8D>YqURtY0}pP)h%%dSM1lvqON1jM?(xfm zqn7&T91rYXSJ7zmv~orNs$F#QozE8QHR|xH+~mQsbw(b%gW1SX?h+qyPcXEHo*HuT z;5kWWEe~w7q4J>gvy15QWUe

UePW*4r9j;>SHWwH_W5<-rTtNGxG=IxI?@Oae7A=L3v9$-eE0|B(x59szQ_yNB>P!&d%JsY<9t?P|ESVsew@*d8S zL!hv>Dm>sYv^=m4BMT42>na`wM-4ovL3%5Xd+gZ?dha7gqw529RLg_oQY2d*s5+yp z+rV4H`d~fD`XX0{;K9g!!O)kb$=m4qfW6h8FS7Mk<$<4m#fXkTLWs1$d)LT=cS+V^TpglcU-~T=+E>vp4{W_nlm}HIA_EWZz=$#%azvuu_f-r> zMtAqigWoLmubD%ytEg)Ex{B&E+g7MEtntqiuYa|1?JxIynwvbhe3Ov}n=l(0%5CDK zy9Y!2>Fk7y2VpTA)$_nM8;SCu`N{nYF!7_W`tx->Cdz~KZ1TWwR+$HNAtQ$MK`k1e zih28EKRh2bX1T%x%m|(_)2imj9*EafYy(FPJh+qeR-X6R|6MpTHa|HUT_3Qc+Vw%El*pC`s?I2D z=shD3Hj}JrTpfZ3WAg_?Ux`2V99J5scYyvc zDm;)8>DLFREcMSh9@xFEV!~f}mVPj%(FenN&6rW==@Qd&lLx&v8+j1HY-A|6iI06T z82XwX8&Y@xqmP~kw%JIO2UBmTR0J5M4M6`H3J)+MI3u9v!5^0T`{RNA z>ngl=o9bUzQRd{rKcBrf_0diDG=}VCY+VY{9lznb^v{4-TJ);EGdFQiZJQAXA7VB#l)Ju$O|J9|kN4pVw>9ttlLwEd@T~|6d9|Z(6@od;Fgx zv$;I*n^nd^Z^(#Yd2la{PX)aF@f|!K_3~-z_$UrABLg7-?egGn3=cNHI8YT9R$L#k z%{M?8Q{j8KyEl3H;3FEil-F>+d^#99D9*xQeByKwhoL=PWE+OMJg6pKSMeh_YT!YA z(p!1l<6!=9WKu(g2kfYp2meSNY ziSpp3Z1TWwR+$I+J~8s(ej1;Wy!~+)9*>$LZYYed4`fF4>w|MnfB55ps<1Q@J>bA~ zKZJp61Ki!4Tp#S9flGN0=akaH(2-IK4>%0%`oK1fEIbgetLOoa8hFr%^j04CI8qAq z?yvBG9o6!H|1gy8`asngWjz4i8hEgiWbMh-A$TyQKgcRxt`X${d#mMvt+$Et;C~R2 zfd?UsC^Lm45gVEXKf#0k$4@zw}^56mL54s%_dqnid5Ab-@v=kbjeDEOI=?{NA zP!&d%JsS>O?I8>U4?f2*Rx0n|oR$&{{dfz7fw776MLck6d0-nx79NP}2P45z0}mRb zqo#yLgfd^lZtlfC@6g-$V4rCok-bQ&a zSj^w_*AHyHO_T>0eP-lA6RP*yI3iK+KaLDXUMq?bxvn2zM1xH{$ZM&8&hfzRbrr+v z7vH{PVg0}7KQ{0EVfVhWBR6?)9I`PKbi&=e;WRF(&xqZajSS^3@z;t5LqE||L$37! zXG44az&0C+@}TX(ReLd#?xnA4iN{2FFeaNk@S9ak0Cs$l9Y!8BrT+NW+aEu{<5ANa zQ^!YnATy$0ALMiT!ygY+g;8bChG9GmVHkL@hXyX?J)F}U2SY#KPGLlOz+q^4U>imj z9*Eaf%mhabJa`ZtJ*7PE@$>DV_X2V>$^&*(%Y*!m-gZ1tbw*i}b{cu`CCS=_t3&W$ z`T~%3GI{Ie0gRq{9@u)DC=W_OM27W2GphG09FgF`&y&NE8P{V(et1y8QvaOef!*sW z)}1QbXzDk$8xOtwTzGNEy4!P;2gP<7d9W9=k)hlrKI8ge=qNokS5-r9AF&>^{(Y zBRT4W2NyVc+wnlv8D+ijb0ZJ-ldK)NIs^}9ZUk9hCvT%XcwWq=^*pfkHc=kj2oV{0 z(1PmyR*p#U;MnWo$gDdtA{P%ZBK$G!`JzIW`sW-E>|R%KRYvj`m;YIB$l9?#{rl&8 zTleH94=(<~$b+vi8yU)7;BUQPv{6jXd~y$z2D3c2_F2iA{?1Rh2n1@yK+A)oj^1`W zP<2LGuldr*gYQVzc3d5zU*{eNS;cB5$^-N^4YH=ao^0!_$^$?BiV@X@hzvYvP4!-Z zBNFxg>&9^8^)9Htiw80y{raGorT#g`gOotUK%YQ=*m2WcPfq{!pGJRwb>G+puMRIX zcI8{0a+3#@_ZoR{5VMh?+$R2dmtg2OdTPkU1I~taePEl7M0v0%sr7BB_N1vF9>!y$ zJeZJ89{9~F^Pm-E#K42cs6T%5_Q!AVeAGPgp6KZMfID9M{K3UefB55psxYeT*|5#0 zK^O)e9HN0sc@O8jrNPk2ZZynde1ZoYhIV~m8%7o$h}TuT2aXze@HjepN_pPnWVdi+ zKK;R1*XvE$Q7sROJ9^vkK-C##y^Jh@FlHk|xlMfj&|v5kJvQWr2e#Qrlm|DRyXavYor=BxUSB*W%7cm7s#oPy`07DQ+u^}&M@PJj60fvPa7?Ab7ksSt*N2S;e&Qr^S4AOeLo zK;gjt6CUx;|iUwLGx(Hc=kbhlmV3Xh-#4mLn28IJFn_ zpNbK=)(0{o{rccCOa1-v!2Wd=-n)zR>w}N_pZoav_4S&+@a6Xne|ogs)ZFAj)vt{_ z_z|;_q1-0EaB490J3Th!;sIwvyFReZ2J?WQf9Lflf6YhT>ndI-IXoFhryb?$;esq- z9&F6!>ni+a6^j)+z9nSDz=J2LKaP6)<9B#IYSDh`_$Uv!ys<1cfo!Ss!p1+SgUshJiew%8>4e+l$@>KMgo& zkA9v~9{2ctL^!heR`Sya4oW(5+u=Z!nQ-up5eGk$sto!(T^`tmp)L<@6R)dy z9~?FC;AzrZdEDd7E8)n}`s8So2k7Wf&_TOAxXRJnjt8pFDCU;%9mB0Jn7ju&bw|-~j!7rGN4COBIrQ3p`zv!tU7Y{fa z+U0?5HWKB*Gmlok5=W=)1Aj=xW1>8mluaJ^%_{TYA;^e<2c4)t4tx9KFL*raO*(;h zHp&C;cz4=DTI!#3Jg|FRMc@Da*X{QT_nldnXGH$84W1aC zn>?s^$jF1=FdG@lUE*(k8w~wJPYwCufo(Pt<-wPCeo2GVk*=9l@RLM&@Jcp$;5Vzx zgO-pH0}r}Ve;oAo$3O6R)bb#8ybm6fa{9v`4^)LoZubWqxMn~Y1|FQGflGN0=kg#F z7M%v5`M6jg43pDtEe~wN$if5hx{A%{k1tCG$vLzLNRl8bStTrCk%cCTC`l0zxu{?O926Ip90Ww7 z1VIrM71MQ$5qQR#`QDclvvKo4xOQ^UnW&>YU$H zcU7&D2N%iKc6@X&9xQ*^YI8HUzyltwbbg>4tydnj1VsuSJWu`?N#hd>oP7)X8#+dXb=1ivRzprPkQ+;1rl?sojvSZa2Zk_=*mdP1NJ`o3IwX)!As<~u-zkV2l&k%Y=wBh1C{cilH<1?4@95Q)+c{e z^58GBwG|&7j0Y);tv0tS2t44?N_n6gtydn51VsuSyiEQV;EEUzZddU6SC*p=)Z6*u z5L6_eA5_-#KjV0ycU;AXfyQaSEN!uJcJ6Fj``209Dw;ePc3R1UYnY8>VU_sGa+V!K zyM_cFU~Nd}2fEqt%7bD<#?`{^)bw~YAKtz4V0MH&FwH9G!6L|rf(Nfqef;3656Fhk zzp9rh52`rzVa5Z|VRYGbVdFXtG88XmPxwWvwpNb2LAJ*8(ZP7IYMo_gx}TyA z%@6*S2fERE<-t5qq~O62@;@(EL_7dBKL6_as3>fH@UJ|ms_B2m@j&mmic5ElE*e{) z$%Xm5w+?>lfjP^f$%8k4Q}W;@W+PcxCBC}8WyjL4p)ekdX5U8TJkZUCR~{6a@Cqa} zCT3@)H_PJPD-Y&G$OF@?;$X#!Uj-Ra@L(v_#{qYJ#KQKdHLp^|hvo;Ek(&t6h zocb{1f#@*0?7C3Kb&#Rp!7XZB!a1C4UWI{mf@GjR_PmJ8kj@WuWu)T)JFeocvq~Pk zN`AYydq9xj_qP;ihzC4S>HMI&tNf51q2Y-{T&G_hGJXrIsWoK?g(S~@y zqm|ANbffjkgU>*bf(JhGKQ~vzc#ye~&%d@EDhlI4P?3CoP(#!IjN^gcaTQk%-z;43 zdfTK4)zAK(|MT3ZqsfCs=af81!)zoc@ocd1wYHsQXQ5p~0uP}3$a$cf4X-@7e4zU- z>`oJI*QGy{;*|$;BjkZ;Ryhy8f{ZA5FpTPBAI}J@k1Vh~YTZ<-cmp2X>(qxC4@8Gu zEWlr|apnD8$%EU}xP)^!*G+|i6(AX?Pm>3_GScyY9am8o0#!UOdX4;cZ})&8!SB-) zr~waZI)3Z%K=c`HT>;U`c`!bPY;D3v2dme0r!6~cYl_x@2fERE<-q|^q~O8piEGt$qIW&!8d`9^9wtf5!1Z@3@M0?mX|mTBr5*@7{X+&I7B?*NG+%w*8^v!T3y= zjbve&`1)roI~(m93gf{T_H9(o1Kn(R<-wr7rC!CRbnh2QWAW~l2k%741JkT>9-M=W zD0ncO>SK?)KC;37s0~Z0;zK;ZjEn&Tr1OLOo%%52f#@*0?7FaV)jF@@!T4BeT*5h= z8a{T>h`_{~;uhIqgOmCg?yaQxQe zf#@^Zx)Y*R@E|kU+K`V9#)A!MmYw}^fd@QV>HI)9TCY5~0E!emNF@KWaz%^>*&p}$ zHx3tg5L6_eAJo$HKjV0ycU;Av2M*23GppI_6NcVD;(@(W{)i?I&RtOQAPZ(ASy(2% zakypYplw3}51{+Vd7zsO&VwzRFP1Ae^iU?gUV;D4@3Q@9pRakaGj^v99pi@K-762~ zMaTowtm0tBiZ2{c@?Zqj$4+;BJ z=h4PzrN$+k!}-M~%g)LE>Zbt@bY-OD0Xwc@ECj0H!ASDkz25_Z^!YaxA-@fHP{;9G zj|Za9XzLY-R>6a8Wb1=`bTA%lDgw6lHRXYBw44XLE=}qc6&1Uvpq^77W;_rb zMweX|mHB1WaTVipP~&=<%V3S`%Y&AkyBNtB?kaN_STWM$Ds*Ka5BOlgaM|nR<`Aa> z2cyYu_jV76(dXY>RlotaTRJ_c@7S$}1JP!5H3gzo;2q3=BnW8O9Bpfw9@H; zZnPW+yev)16%`!@MT+Uc7*rIv%@r{mvKfzl6-^u*xT3^CF3d) zTr`dWT8@JUo%%4tf#@*0?7C1!vp<#7gWS}(gkw0joU`macasd%#~v4GS*JDA3UKfCnn&!9$MUdOQ$)Mq7V{XcauTgKVwM zM+c*vZvX0G(O(=olg%k2U}5M@V>9*k`wsP8J*t$zidxl5Frmt zvx+`peH8sm$%6^hpZxCn$P3$}w#HJ$yLo_(RQmd$p;I4bJP;j5w_O*?=ngXQQ4#)x zU%|&kd8u&;$8c_qwd{QNkqiSK=*mdP19n`+7zk9sgNfv~d%Fh&34XH&@&-I;Lr zkSPxuYx}#BSexRETuRO>$@|B+0fV#EMR0r=~=LZWTVc7*53OwL4r1Jw^ z8R>Yyj;lz6KovZAll&I8dlYC0eh;KTLp>viEj^Bc0t-TB=7*bkDLd( z+3?DPCl1C=$L{p)5Zh&q`q=X#-ngVZ(3O#n2kf|tMi8ii2h+%J zVY^461n_&TDG!=Ee(Ui-^cihUfoK)ai;9q~)%fUOJotJn*vb~48Sp?iTCY4f2#ORu zcncK;E^|eU2ZfgU{5!Iv|6x3sz`p;;dC)@B|BT~--f|&RrjcVSCg!@d6Km8IjKq;+^_1K| z@+tK7fnV7t)_Xi~~8_B{d@tt>Cc2PE4>*sup3yv@O{6IGwUU{&yXp6(> z>Zo}M_`Je14;Dwr1JkT>9y|gWQSe|U^{3VD`X~z9qjvS6iVwX%;1w@@UewB|4>KN! z4x`Ji3mex0kb(YF4#NJo!S@Fxsc{MCaPI11*~R*hj1UhdvM(C)_sP04((!<;FZv1s zRq$XI`7LbsDAou3UPXb1o)=-D6G5qz2MLbfdOQ$)Mq3}wlvl-rQek0uX>#434E z8nclstP$(uA#8`0ndi?eX?#gyz-#S;gLHbQ85E9Hu@FsUgrnzMaTowtl|j6 zieC&FQSe|6X5?auyFQA;_NYCtP{oIMz$;$LgEmfmnDIb#7+rQ=G}M4AjS-7jYTV`GKyCbUa|kRg}%FTiEVV;zjU#7X@m-1KaUij|Za9 zXzL7!Rxv-glWZ-|M+f7`t9)Ht&XauRM4^LLQiAmGj^NWJJM(dDNdi=NV!3 zQ3|$4eLG3u0cK>`%aHOw zS4KJ>u;VHQL76a^Wb0jg zbg+8;_5|2^MBo9BRyse>jn*p<@@G@>U;!!$oaTyxO6vl&~BKiEFgQou( z#{<3NDiZ7y<+A+HyyT>oeWtE^`0e7+?aiSK*bvMt&*B=7*bkDLd( z+3?DPIk%cs!0xmyw$wLx_sWAM5%Rz^tDFb*AtMSNETsPQsk=Tb*dMk3JyRZZbn3&5 z2cpC1vg^XeH4S7a<_G1eaS7*e?tc#k7Q-6qWAg*vxTHMLm647I?6``J5U7F&?~>ob zeh+IB_S_wdd8Foy3u;&!Aqb>F+W&@ ziUKFOBE|#jjL-j_PvF61_WeiBgGV*}&p00F9ar)0^sP_UE0nNt&C6q^#-B-O5ltQp z&#B}=1!=SS;fJM75^b*M8Si_)So_f*GC!HA9Y~8z=L2$u;VJKL!b&CyhnZu`#s9c@%axH zpg==B;DJi#2ah>^>+wMJnMMahtC$~DB3n!H(ZP6dumITlCq)~2Uc{r7&JT2>6?tG% zuc&AzC{pm?eN+@U&J{5pl=&0 z#?2qwd%*q69ytG8GXh7W#R{?S$0|4He|vB-E43k@cr+6eDUA;o%0|z z*oqQ^_c2YU{Eh#dJnhv>c=yVKXCmZ*X;yKtVtv?<5d{yHP=8wLu8*>?KkEB^RPmwr z2fX5?&x;;+>cfl&qQmI2>p~eHfef@Bf5I<%pFClF6>3~@Tn1}g-|vHg^#REk?#vI~ zWM4Go$5rUcKpybHf)TOT2R}lb3LJbub_?4*%6{PU|4@nI4B-Idd=oxaii0N{yY+A& z+KjGt%%jA?J>+UJx2r!?vg~qfvtkGbJX$FZbfe`s;ALr2uBd1jC{o~HDJlva<%$>% z%Ef~Jw174Y2SG)09CX$6-wX%(uaoO)9#^q+PTc_=v$Z_>!G8~DZ#J#Z3(>^E$h=A% zRK;v03#-I`SZdkjY1dE~4tO@CuakAN!EwN+0epP%-}#;6K-`}E(ZL;Mu-dzANGXYT zuQ*s5DGm&?%5m^HWJH0352-)B@2-#Xus!O>(*h27#Y=I}&8ZJF9Ec91%dQK{yh%Rg z^q?9wF5wu?A5X);N+B7jk3BBpGNjW3T^Zu^pe{SEVkiWv;K4`ax3Jx#e2UM1h$ zfCt?jzx8+^`i!<_%CF=>b+WZEA03RchZ;K9eJ zC~$-;Vm!DzANaos6`Am$ho=7-#{<3ND(3(Cb))lHo8LKO+?D6Ho*UIQnmo9#fRYC_ zFdNCjD)B>`EV}~j8VcjV6!z^%{`x>S8(w*E_r;l|uscnAVDxUhd*#805%Rz^tDFbV zLPiukSVsM6k-I)B!1k!aX#x*0BU8WtDGz!&^yd7vvJ9S_)X6*nMI1rI(UzlH4{6*l|)M;@g>Lph4?QlL`fohw<3_!YK<~JU+}|zfJ?ZJzkA3t+*{QcCAB*borqhZlc~A?pku0nd z|LJ$ju0p$p!g#>5A$?w?n+>l#Xfm#18g{4WMtlZ?$U6@{j*thYS>-%f2N_ZDUHMINQy*qL5FJLBT^Ba4yNW4!P@5W;a1Q6OYA~=4lMK|S z$pc*(>3G17t9S$gRq!C0{1&!*R5=WOCsCjVJm~BAt;Yk=XSDSTh*t4BxenQyn~x60 zgJVgSeNP>V)_@1P(R$^MK(#HlIAPUz0i?ZrfEQn)8GI7FY71E@mTHSS9{*X3MThyN1GeFpYhUlg|%yv*DEo z<3=_cfZZwIdmFmr-Rt~dS%f?=%_`?XObI0qR#JbO?XHiius!N{Q>yq74=^LszyK)^ z`Z@Js#skq|blG)b<9Y;SDCP(CsBsDBa2{_81B<-|3Gsl-kj@WuWu)T)JFa3N1ghY{ zD)L*{?ostL_&rzP0S{C^~!_mph&@k)u<@2mn&jCsMgfy|D~kBgP;a=YeiEyz*dAjsx`m;Ef_5 ztj8|pl?R_h$OF@?avl^erR2dH>Q6J=^-&$RN1b@Wln4KD>cfl&qQfp0;4j#?o&gyO z9y~~mOE`z~#1k;Eu8<4^9_Y$Q#{+g;#Uuz+!GpErx3Jx#`W5hdg((jPIDYH#K=c`H zy#&!Jc<>O}nw5_Z#)A_pEW1WKiq?P!y3u;&LH^Q89;`z}fn8h?<3WvfKL1I!z_GV8 zk$j7N|B>_HIZgjFjtA}qr|qCr{^|Il_+{TcQM+yHvkMw$jbAwK-Nb0};1*03s z;TOL4%k=X2hcO$;!Yc8T_gVJ6v}-7g2bhhwR6NklhRB0OWj-<5e$b)DYeP}V@~kue zFFg1(LLQiA6%&9JU&d1MU_JGxx7_t{FKmxGHAvt=FeCE$!ShainDIb#IDFjDzfneS zkfGo~Luy>YIh>~kS$54#0uQ(h>HI)fMmip_^`;XbPz4V*kl(^~kD8gl@2>?O@Ia;W zgBKjX^>`rqjJ5_KS_Kapk*%?ObTA&A`WkHQF7SXyE1e(cMl15bq+U@`fjgBv*ocY( zJGdgogPPra{$E?7qOj*hK}B*N4Ak^L<9MKVTt%^$C-q;%n+>l#cro+Ui`bRAKQW~M-o4HbK8uhCrdj1Y zs8UABgDH6;k2*b$Dn9hQh*!MydC?%JKFoL^I*cy6E-dr@AVa}}Ce*lu zb2v|rv+Voxk_^>k9>h_--sYo&)$8eFU~7MhHZ(t&&c46JNO_WP1li;vBhH2u#w9_SrcF{H=tA$>13KbF{|;o%(f zw!}x12Sv&%dC-)`m#|FyOi#;xfOZXq@qlMT`aW4V8(w*E<&!PdaRfZQ=hv_C?v)42 zBjkZ;R&lUm#Xk%gQM^yyO#Nw+yFMO({ZYRyq>2ymAea&P{NQD$KFoL^I*cy6E|f79 zWGHyh3}vJU=WzbE(6VclA{ikba2Zk_=*mdP19n`+8VFRugDvE@u-~IrDe(I$1sdW3 z4^+y7R~*0fcp&J?s(Ykp6-BZp3-Dth?pb02ayg%@x zqChHF#CT9^h|hm^Fe)cfl&qQmI2>%zvh5@aZN5RWoagmXC0t+wnsl}UyH4|HXu z;{iLa;ztNn!Go>jx3J%%PGz6}_dFD6hzD=8@2B$p$wM8#^>`rqjJDRhTgii#RIk_h z=wLkfJrCGAilPni0Hb{yvL>A$=tk?62c1EYf(P4BQD8Gy#CT9=6!=en05psTK}GWU z!K<47oAE&ZxC-~vBKdI@$EW_~A3n83(;02@PTsjPp-(h!U90kNSfx+z;`9SG@Fjk4{W=<$8I7q-~ldrm6JzpMNoo0#y z-Do)ucv+g1D=KOTiWE5b8Wjb;;EEUy>P-Xx-$O+vICxFde={8DA6HRN^SFvW_w1#j3k-`HmBK_sWCh2zg+dRnCLEAtMSN?4tgZ=&p|kVSCiY8&vTj9t1NYe|?bX z)Q1@lM2FF3*M(*NEXYvspdHFc5su-!c*C+EYD+RgJm4~*V%SuK_+f7!NMB2V0j>v~C_i z_mn>_(v8+D5AL`}$%8$pD6obrVmx?g8Th{s6`AmWFQNQ59%md6^p2~jF=hDGy_Z{D zc(34;Q!Qd!&Wk1w&OkO4%ZobD_!3r$U)pEc57Vxpu=&Bi@<2BmUU^WY!dI2BJN5nU zRuQ~=JTT2F=RwY@N*?T`{`9)LJ|2ecQCA93#T)P-$>~pKJP;j5mt7Y&E*oSh zc+e4LqzLD5UMXPN4ZD#H10LwgNXG+qT*XTesDcOIlHbC1kA~gA?|u}h0S`twe(Ui- z^cij42hl2c(245x4?a2=53ckBTh~&wAs))a0)V_m>=w?{^WDlMgO; z##N=dk_VkpMv8C_=he!V-S}C72V919exNHO9S_)X6>T6;1rNR>zlH4{jh_X-X+vh% z@uoab>HJ`<t#1@!;wkVC%Mj-~n_`IS+KBf&NCxU-Jm4~< zJkXVqjtA_xifRz3f(M7lZ(+Mfvn25QQwlW110JZ92a_GY^>`rqjJD2%Xcau@PW5_{ zj}FFz8=r!$$0*v+^CBMYYvHT5vc=?bR&D7<>y-zqK#_t6hfz^r8CS%3(CnDcf3rF& z3VU7@R3u++`lhD;8OH;?<0=-cJ=>D_-RaWynE%rnh1GdnpMt&ZIBTK4~|fO8sx5z7O*|) z)^k+xq4@!?ceJ+bu8ed% zV8>P52Z1Vh@L%#<*zVC{D)_yX0yW^lRL5^U9*91pt#ct-1rMI2dOglZ2jju5tzau1 z4xJX_!EE+zT0TF}jn*p<)_@`f4}L;Lfe*PN#)B5W`}}`56L^4%pxEU+n5OA}#__lXvWjtGUL`9-1|pJeXEX$%Ch8eBH&f!N%9$%`CemJ*^Jo0ndhX zexRETuROTX`)_@ZaK3_!azfIK5Ctif|5R+9()U^93Go8PfTI zu8ed%VEYeB)mHN082K%1_h>mE{5~S^fCnm_A53@r*5iTbGuk=|qE+zVX{y(wd~~pS zO*;a%UZ-f?JiyYB&JT2>^~!@qph&@kpHWd@30D*x@7I0)+g(k0@V2J^8OH;?<0|S6 zopt)R>1}HycFA6%*7?qzqsfCYb(B2lP2)>gCVsoCWw)YTLnb`X&4yPVw4b)VIX0j- zSA0DU?_PPZE*Ec)*UUC{S0)gI~yRVZTSKkHPOt z6liFEzyp=?V5Z}@9uGvH(bmBbt%3)Asa}up(Lp?bNG&@d8$}!9!5sE&TFwLAXua}a zIw(@`-~=iPEar+B4-&HZQZumw_j@}71r@=Flg|%kY5JdWJkUF?;%v*SpI`ho?%;+2 zt)4r&t6WsKCl9Kp|&N(Rz(9HFHjZ2Ru+I z59T<2>+wMJ8Et*CzLE#eQoa7jM+f6U=A4$@rqDm|0P`cAALvHwl?ShbA_WhAMMZ&y zToL0zn?m6KcvKYj{(yI&df{(Gvcek?e$CbN-;4+P$5psz2lC@8;&&eIeBx+}O_O5o zedNtUi*iMCe$csrk_Y{1e7Tp2LnbWSrfoweJkZUC!-L;1xYwHof9Lz+`FhjXV7e27 z_k5Q+-@<=3s`OYnynE%rvk~&ZG^?BkLm(px9-OBB)W=;Pc3WR+mK{{_q4@#tPtx}X z?>O~g#skq|blG)b<5~|g(0cp{zk0b`N{2FEwi!iZe7l;C4%KFwe1D4+o;n=xXx^l{grH(Iy{s zyPCC(Ww*VHq76+C=CUu-avbPJ>);@Qaz#bGK#>9mzoDYQJg$i0pzU4Y|3Xw0h67YI zS2aDDuj#)T4)l+!sIPfkMf{O^=YB34pL_K6^Ck1PZ!$HSIB4*Y5(m%G_;RljhfG*@ zJK8lAh6A1r>GVK18x9U4+!V#aUurhCfFy*2U`FKAg9T1~nBhQl7+rQ~CucPT^L*zl(E}zn0!{OUq_?=G=Xzv-cqr_lK`nu5ep7_r;M~9{0-760^M#uxx zta2W7hKwk9@CWs$p6>eS@T@O2$5rZ220U2g)Q1@lM2FF3*M((12V^LCFo*`0`xs7; z00ZkN$v}PV^#N~OQXc5aNXG+qT*Z0_RKbJu4g>Jb008-OEP@<3Y|gmfevZw&b24z_)4n{6IHakq0LAii+xjA_WgFprXJ` zu88rVV*~JiH+7)i&OmwR-{uGJY5JdWJkUF?VpioZPvl=>FIqNc=G`3zEsW~&q8yEt zJa~!5mwS~sWWusL4W?{_c!1e>2XZ5wALwSoD-R~7?#Y7P>0+JU8}ROx2VX?U1JkT> z9@K!0D0mQ{{?yG~ADssKQgi2_{uJUtFeCE$!TU~qnDIb#7+rQbYog@AD`e{~J~|i=a`(3EN8>5l5D$2?()odIv|f2o4HPMOa0wL!rgKG%2am>s z|0hvV*z=;GBKhm&4>bMHI3DO7S5bOz_HU|owU;LjTRI@|o3yskoFC+fQ}SRijW72q zama*accxuKVb6-&q2Qs4I!DZ@C zkGt!mbCNGL&)rn<20U2m)Q1@lM2B50z+bR&4Fnkq9t@#@6h3y`luYupgC{P0)eCYVC#{j#VRC;XzfGAqXqC0lp! z(ZP6-XP9L_)`_Au;DK(mUU`tesgehOqN2c5u88sAu}aQx{RHhAGU0)4HoWp6=d)dZ z#qKnGeVsvg_sWCK5%Rz^tDFa~Lq-(ygX`3vI=buQiTS?N0v)L04S4XWQy*qL5FJLB zT^Ba4Js?BDgV$+bxzFJQ36|ZJ$~^3SGH+Z`9_Y$Q#{+g;#dQc&!Gjy*x3Jx#YeDe) zBY_9=**7BjpTqgg@mr4vqR(h+|9B-2hLf$Sd~`4#6!-{ieO}-JMhjy_{{BEWTCY5q z1d0?qxQU7a6SyMAgRal}QVUiQco0-1=fQGK|1*vUddF4t?f2uD9L-yv9#tt<>7N>W zbt#%W7|~M6gEwe=39G~lRD-X6r z$OF@?avm&&j3{_;i~3VLcYSn&?NNp34S!mQ2fX5?%S}Ib>cfl&qQfp0;4j#?E`baM z4-#o$xzFJQ36|ZRE#pLe?0qtqA?1OtjC4F;$5oVkM9G7{$!}r1NB1(|H~oFUu;Wd6 zpwjul3de6f9*91ptz#it#q**OWb0-=Iv5WMZ3bJ})2-0_fJZBxALvHwl?O{ek%9+l zs3@IW^kUU@Kh_V+JiQ~JDpvHuGX{1NiNG^?BkD z)P`q-)khE59#tffz5yEWAjPQ|&M(X$%({R0IWdR~Nq;zUErgO!fodOQ$)Mq5Wh zvN`cqHz-l{G#t z()x?d!=lN95v`Rx7>(IjAuJOw`j}-uxs|ff&sDZi4f6Fxy4mo`gR RYg~C_PDSM z?_TEzsS)zPG^;pRvEtu{jL3PA5KH~3mAgKkg#A&)W>Lk5c)%-OIzL$L)Q1@lM2FF3 z*M&09feZx?#!%yOpTh|fEc>bYB*V=EY_n1x=*mdP1GXP6UmGP4GLzrJevhZ>gWu;V zPy-&Uas1Zff#@^ZIs~Fs@L(+2x}J{?#)D$#!PXfRtpN{oqxH&znV?9)gDj{hFoG*$ zJa}q`FSR&50W;yjT222mjt6?jRUF+n``rFKO&gE+&ytptetvCNGmfef}u{r}D=w?IY!Bbbv_8;^+(PcfP(pJfXY~;7F-{a{PzSNTJ#dnAY80bRqK{`KJ@A$391JP%+bpS-G z;K2m4bqyaKj0YvNf~|`M9`I9 z4}yy1^MehV{+sbY|F{Y_4dlmFEH5}LA*NB|1EY(d+HmQ?xdWrggJJEIJeY{tSRpJE zFFD$>d(*a|u;)cQ8`Ad&y4i4e5ZwRnj4#dOD(c_->lSvWKXP5g{WhL?&_6;Rm}Zsp z;9bawf(JRMKQ(jLM{n34Rf_!qtkC>`SG;t7u+gaxGaiTzqsy)f%ls_JKosLo_!T^^ zViGm3V_XJnT&1>IcAt*axQ06uPcB1xT!pR-#O;{0YBk zoYYFlMgBX0V>sxu9Q=PLF@J1KT4iUP>_i+_hflnCDpSk^_$d4dzvvTROUO;1C@dHY zej)%S4ZcjWCzace2LazKd;x2gu=9{M1vC1{A$3NxKo}TVoinP)#=l9~J11oC9mw8a zl)X@7zf@kf{WyGRy2ye7#h6Cc2qIHt;STa_6^|^Kg})#RC)`=sj*TDvHdk3KQ^A3w1`cy)dC z4A1M;KUJSNeky)q%6out +# @TEST-EXEC: btest-diff weird.log +# @TEST-EXEC: btest-diff out + +@load base/protocols/smb + +redef SMB::max_pending_messages = 20; + +event smb2_discarded_messages_state(c: connection, request: string) &priority=10 + { + print "smb2_discarded_messages_state before", request, |c$smb_state$pending_cmds|; + } + +event smb2_discarded_messages_state(c: connection, request: string) &priority=-10 + { + print "smb2_discarded_messages_state after", request, |c$smb_state$pending_cmds|; + }