From 6d19c49efe57f3e72d7716bc28d35fd5490cc548 Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Wed, 14 Dec 2022 16:30:21 +0100 Subject: [PATCH] intel/seen/file-names: Use file_over_new_connection() The seen/file-names script relies on f$info$filename to be populated. For HTTP and other network protocols, however, this field is only populated during file_over_new_connection() that's running after file_new(). Use the file_new() event only for files without connections and file_over_new_connection() implies that f$conns is populated, anyway. Special case SMB to avoid finding files twice, because there's a custom implementation in seen/smb-filenames.zeek. Fixes #2647 --- .../frameworks/intel/seen/file-names.zeek | 21 ++++++++++++++- .../intel.log | 11 ++++++++ .../intel.log | 11 ++++++++ testing/btest/Traces/http/putty-upload.pcap | Bin 0 -> 86399 bytes .../seen/filename-in-http-get-response.zeek | 24 +++++++++++++++++ .../intel/seen/filename-in-http-post.zeek | 25 ++++++++++++++++++ 6 files changed, 91 insertions(+), 1 deletion(-) create mode 100644 testing/btest/Baseline/scripts.policy.frameworks.intel.seen.filename-in-http-get-response/intel.log create mode 100644 testing/btest/Baseline/scripts.policy.frameworks.intel.seen.filename-in-http-post/intel.log create mode 100644 testing/btest/Traces/http/putty-upload.pcap create mode 100644 testing/btest/scripts/policy/frameworks/intel/seen/filename-in-http-get-response.zeek create mode 100644 testing/btest/scripts/policy/frameworks/intel/seen/filename-in-http-post.zeek diff --git a/scripts/policy/frameworks/intel/seen/file-names.zeek b/scripts/policy/frameworks/intel/seen/file-names.zeek index ade0d0f18a..10c563f05e 100644 --- a/scripts/policy/frameworks/intel/seen/file-names.zeek +++ b/scripts/policy/frameworks/intel/seen/file-names.zeek @@ -3,9 +3,28 @@ event file_new(f: fa_file) { + # If there are connections attached, we'll be using + # file_over_new_connection() for reporting the + # filename instead as it's more likely to be populated. + if ( f?$conns && |f$conns| > 0 ) + return; + if ( f?$info && f$info?$filename ) Intel::seen([$indicator=f$info$filename, $indicator_type=Intel::FILE_NAME, $f=f, $where=Files::IN_NAME]); - } \ No newline at end of file + } + +event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-5 + { + # Skip SMB, there's a custom implementation in smb-filenames.zeek + if ( f$source == "SMB" ) + return; + + if ( f?$info && f$info?$filename ) + Intel::seen([$indicator=f$info$filename, + $indicator_type=Intel::FILE_NAME, + $f=f, + $where=Files::IN_NAME]); + } diff --git a/testing/btest/Baseline/scripts.policy.frameworks.intel.seen.filename-in-http-get-response/intel.log b/testing/btest/Baseline/scripts.policy.frameworks.intel.seen.filename-in-http-get-response/intel.log new file mode 100644 index 0000000000..edb8b0c243 --- /dev/null +++ b/testing/btest/Baseline/scripts.policy.frameworks.intel.seen.filename-in-http-get-response/intel.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path intel +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc +#types time string addr port addr port string enum enum string set[enum] set[string] string string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.9.63 63526 54.175.222.246 80 test.json Intel::FILE_NAME Files::IN_NAME zeek Intel::FILE_NAME source1 FiokML36uuy5agr5x3 - http://httpbin.org/response-headers?Content-Type=application/octet-stream; charset=UTF-8&Content-Disposition=attachment; filename="test.json" +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.policy.frameworks.intel.seen.filename-in-http-post/intel.log b/testing/btest/Baseline/scripts.policy.frameworks.intel.seen.filename-in-http-post/intel.log new file mode 100644 index 0000000000..72e1fc345e --- /dev/null +++ b/testing/btest/Baseline/scripts.policy.frameworks.intel.seen.filename-in-http-post/intel.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path intel +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc +#types time string addr port addr port string enum enum string set[enum] set[string] string string string +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 127.0.0.1 56880 127.0.0.1 8080 putty.exe Intel::FILE_NAME Files::IN_NAME zeek Intel::FILE_NAME source1 FxbYSsEfeslxAei7 - http://localhost:8080:8080/upload +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/http/putty-upload.pcap b/testing/btest/Traces/http/putty-upload.pcap new file mode 100644 index 0000000000000000000000000000000000000000..c91721f0dde6b9624dd7766cba6503fa454fd364 GIT binary patch literal 86399 zcmeFa3wTpi7U+M{Hc+796flYkL%^a`D6|SnfoLPCrdkvgMI96h6hV1ZNCXwMHLdm# zqBw&(&gh7baeR%UD3prQ@@PSP0E!~0farKaM8OA7<=o%eCus{he)GTge&7Fp|KAOy zd!Mz}UVH7=T5GSp&(4RdUVS1(OVg4c%hEIl5AS^S$hZUZ(zT0;%eUnxT`SbIAp?&V zXa%iOm)}JO`F`G~+x%UfB3XjDFva?~cz~v*q*))QrKGnVl`?pU%uJl-2o)SI1euNwIT^R=x9BiWe1*@bn9n zO`cXVzVF1~l*yjJh!Mm4<@L>TwGB+05gg>1JZ)Ub>W#X=zzb$>d45mb%)`C>@tGZemWTWRR!FrPG4v`$k_dy=3b69)oZ7_88cskEh4b ziPNV|nG~9$AbGh8cG0wHH%>0~sHD=Sgcihdrc4_#cx&-oPHR76hM{4aK<1Hb-8Lr>GT}mjipnm(XeT^ zPntZrq~CzPxt?Cvoww1J4B!QtmrM%w8*uiyea}9})9aGJ zh+)NjJd-EgT3?>7*+s1!>Z$)27mI&Cp@f z#tW1(Z!8HOlOnB07toH)*nZk}kZ1g~aiJ-+YO=aHg;U2(8$W64je|Tl-ae_Uk7s=8 z1p2D9k7w-kCY)ke3sJp6p3#u*4B6DUJk|Qw-KayFPm?F8J zvvPAimt7*QGW}L*p(`g%Vd$vj+`i{{hTj&PNLQcTH^1*$uC{)fVUTBJ>G(dLy#5}4 z={T~Vb(SY@z@Xf-2ldbOTr_Ninq5JfGbeak8OTjTr#Ydxbn1=4iHzxUm=MJ!GlDsE z+oTDTO2_{e?f!$#I%m+?`8I94ahK2(|G9DV9ZDe8C!4|+NYU5ZnjMGJxYirR$27%9 z(ztt|_yw&h-Pg` z@%ES!njD-|Rx&-k2g|lE2H)ADD>=2Lb0Qnr1*Jm zxB0XGvGPF~W1`R}wrQz$FFh=9QM*F{-i#V z{h?6Qjo+jw3jGgF6psi+nF2|T{y(kEQSwR*HA|cR1M|)j?O!r(Vrh;fPoFkv_3QT=MvbcP2qkuZL&OaBjGY#mI=*E3ZQdL{ zwsmkJ0_cJSc*bQ@&+-ku;*z2(F1Tviu#$8CugTFjzoofgn;bKcu{qOJU$jj8U$Z=} zD4kF`UDWSyc5X}Kw#fqdU$s(X+Kyn_{%1kZ_=QZ{;P&LSMI4HVxp4MB)*L|z9QtVW zG1K;lP~0pO3s@`gZTS&FP|!bnvrydhO_HK54%Zw}q6I;4OVzOyWt{$ZBQ-hO{gY;t zO`9>vw(Xm=>tIa6V|3(TPf}fad!Sl_xAiTZRf+|kBx6saV~pLLDKm1$Pn&^ViftY& z89N#C($#j@b+gpku6ea**Ser(<^Mx`7V!4nYTIkCwRyLDjidP8?jt5nn&By%K8oY7bm*OKGoZ z*YPcDtH38zV@hVKXo0LjRXj!0S}9O-sEs*UlO?PF*^{*tZA?WnQzCC7V{;(cZL$*6 zwD}!6YOhITVJGdH$DNwCp`$iyGSBaI)_RR3EI3(v7BT;yKIQE*wO%Cdct+Q3Ms3Vq zT{~(!?5g}`*1lq2k}~01>MRUN-H+=GkEV_3J6)_SODx#K3>sA&Twe?cd7GU2Dcfp_C9 zLDR;Z$)Dli^&$NHH}Ha!XONX$$GQ_P>Q!io((CKBO--51C%-%%A2@!LMBe&58d%ja@zR%0T#=f`IW+ zz<9sd@Mo138^u|(0ukp~V>)Vqyd42x0|U`fS!DrZR93F}27@pVNe_hAIRwxv(CE+d zNaF;I!$pmC7M~(xpZVxt+G$2ZRb7n$^uXRgq!==JJI%;+67~kds|)@(`i52STutd^ zl(u?wQ)v?ekpWW}ih-*AK~Es;ohZXHI7lc=6beO92q+R|H>@g-IEzZ!YkBMPHko7e zG!hyDhO@6^4|^rhLJdtEMx9d>qkfz1T*Y?8l_}WNdSLBZAeP&cDbN0_f?9E6<*l>a ztrC!cKC({l;LjQk$8S%uvBm_V#aSN9Jyvic0~Q004X4uYsE==??`q#wz7bcCyz0t8 z#W$U?mxmee4l^2!kBW@AMDG~`o$$e#`n~l415ww? ze1dUl6#>UuYsWGqf#x@Mo9W-CXvN0CKzPS50q<7;^{VYm(~6@a+4ZV)6 zi>Z#$;5V%B*Xi}&rTW5Or}^r?OYs}A`a_wKoXci*)Qq*+X1LB#ShYtls_*Sw0O*ke zzZh!-XJ@8QU$HsT^)$iTki7-Gs&#tN%HGaf6xtDE6+?Rxr350bivjtogINUy)w8n( z`uUSd>AW`p1(H+R%( z4asxv{#32pJAagn-ge8Rc9#2t_8qkb=WJk(y!|pJzo1ECt9wZ2WYQ0J-CS{Whjdcq zPh_Y#+8UT%DdVQ%s4nrU^{62xMH~1grLhYIokwwjsye-L8Bc2J)LZWCwjH&qx?r1t zvCnePeuznXRlgb!Y(-!}(^M{JsYUl9_SSeagVW;bHq0>P}jP{oH!ylQZFA+*oD3Q#WrT`Qml zh1MX=dS$z&X`P%10YK77*SR#UC~S4qtG*%TH_V>ob*T2+24HSwRu5RMuFQI!UY;K7CrD_Je+x za}G~RW|-$brSjZMo{FRQKuxcDDV_WW8Z}GW{WBdNeD#g#ib;_h5%>KRMEN5iQXEBA z0rV{sMq;0XU2(L78e=y?W?23Kz49bzGuR#l9fECmGB@4>NZRp;bSphzFxZy2P7bzD zEO)nbY5PyiiynvUX0Rss!d7ej-q(prJvndttvJSDdZw#iE+rB4l*rz(+n93gQS`2p2-m6#l~SXM4~-CUqwLr zYNYPQxAfQ3(>rQrV}(NtH>4Op65IrGPUz(QMJnlm8L_;a0uF;oXkfOl8 z8tGiG_9>;k9DkkGdIC~<)p^hlM7@vlkhecz976B@<=IsDJ@l%>ypNc9=rVe*H)vAv zcZS0?eI0doyj?oC-rNd=lz_3-TtPIprz^9n!rFvX(5v#W$Z91DhULDO@epy9P*fng zKn*$b#TQbvO2$w+h!J~&n$=fR;DM9i%lkML*Y68tNc^t753#5pM>vEow<1BBJPswNV>2ik_ zn_(ktC}ob`PV1R{_aSN;kQokr!Ai28C`8v8j;8vkY6h4CGBmruyuWv4)(M1>1xiu( zwyRCnZDnMAiL8oR)mtLWBd$^@YK|0@x|dFfx@Ln$W6vR|tPALc8v~J!(hrr-YDkOs zXCZ&WM;&_QESf0RpDGs`rmx;a@h#m9y^xeLkW$Rk9tGiY5P*&bO7CXg?SM~L8=m|T z=h11D6mkENCsm8@(-M*HGK(Xwx5vZUbYZO*td)D$pm&gc@0}ow)QA$o`gxsD$%JPC zW1NUs@sNl7H(f=NF;6u^fF!Y1^K6!|pSDjOP|{ivFJVh>2iMqHOj@k*Pe1-TAPM8kYIGhQVaH+vZNlG=gYcgz$(#>i z8H>H`gnX!&Kkp==b+KZhmjK>KXJE9kF_ubJ#nV-ar5Q^jcsIUBCd&$EVk}o} z3U)3wVz!*I+&ZZ|TJCQhB!<1;irpPN8TLCBcaY)u-lZK7N*Z>Lc~MA&R?a&@CgO4u z_#<80OJHm{up!m%Tz|xEVMqIo%?CE8zL=Foe@6y9Adran9)ifDYO+LZ3$}b&jQVN% z0_^%n4jjeyGR#MO2P~ga@6X~iW?vj}PLW4@49*@*D-07Ro}UF@`pY>#PNvJ=&A0iS(5n-XxZg} znwC>5Rgc&rPI^zIJQ;?Pq1XtvSdk`|tIEu?+=rQ5v9%{EX1?<+7pXc43~TR3;Ur_5WQ6RyIJ^qad*Pl9W0H<^GT!q%xhU3@S@B7{jd}bRy5naEp}Nqs_TtQb&!+ zE%H6P-dJ02c5|%Vc#z5Sh9tbGS|fY6v9UhZ&9QOgp?s$WJd}~|`hifdT#JS_oN?lY zYbSr<<6`(|X08v+#hwJKDEz*|x13_M#g2m49kJSwRAumQ#1?0f6LOjEe`re7cLM_Ix7ULjk(Mh4)u=ZbdJni1wjBFY2YfrR zqt@FsM4r~Ay1wM8FfuHyFmio*VWcplIO6U=QeostX`aH!tI|GxV=oQjckJDG&=;Ab zIS%-ZZP`a0tNg|n^}B(8vGK6qsLNjK&tB`;fDHTDSfgaw(d-W#+pz~Qk-OkftN9Zg z73)tO)Wa?w9iJmov-kRpLXA@Y1|zY<$Vnw01~89U@5w@~aunkmUyEM3St5jWPs=U_Llvu}+kve^)m_zpFA!JOwJUm!?sX z9m&XsWTY+`S(J<{Oh)D>Bjw3RSu!#v85y386eJ_L$%rQz$s|&2Sh2g1R;=Sfm{AsX z>UaA0pf(j zI!rAbI|6`>?h~2?hP|qY?I5M-K;tirv`}Z%X#-{~9GIU!#`00dWC?Z1t7B**S>FV? z+}nvl9U)JHv#n_B24|WCX3kTRb`Wh$r~HV0(cp~pVB5G0$k^cQCK(ytRp&D&82lJ| z4?m4S&*c%9LqGlgvt|B=4`%9>U0BKz^XQe6fyEk`F03OUqu+mv$an7;iC11G8N4#A z^s1)>C*m4H4d|7tirXhvU*@YR7=D>j2!6~t(yX4^49y=6I1uo?Xnp1y+FC^-IkS;p zqVwq+Yja@S7B$1@1DRyAS|ujgKJ&9>HVNftPsB|H7Pe}~WWair@oa$+-X(F3c(2WRPb z|I~(}^%ZNdfyVgif62_-A1|OfPhxaODn!~ED-Ud~+NNK+!Dnn>&C|{2*x=iEP{xBr z^}GIpCT^lPQ@>{-3|4KsGviHqTdS#t=Xj=WTmke=#)4Kei$9JnhI0-1%Do?;^R(do z6u5CD(~g0xnbW>d)2>Zn<(GQZEf9#n8Z%@eiGKX83_}_A$#%2c7as1Q6wfqpn;T{A zL4gKOra8pHq|G{kcCfunzB;pYJe@%jPxUQwpooPuidZN|x{e-8jS_y$P0Ek?4gX6o+pWGvkxYmob|n(^Hicm6{Zq{X@50NaPe#o)F1TY-o)LnjOX1Hm>3z4A|_*X zs0{ROift+_cI54W#@koZ3~I46ai=W6>Mx>!n%tRb)U?6*FJKO-sIYChA3uQn346~~ zO*tAv;v8Zu4}(_*5>>?jEK1cKDmA#M%%7V@& z@&;yt7Qc@5Hwg0ag?|R8eVU5lOwF)ksD;ysQS3M=R+-}U6wAPbsE;1RiQB(g`Z%K@Dl9D-;~fWcrdO^*6i!gkFQz0pRb0xY4I~a9MgpO7KnN4 zq*)g*_+&xl%U&B#rB(1Uhj*mao9u-g4u6qezdMzT_rg(uY+)ofE~-al4P?&eVtD$L zi_=`5;jlMisve>|%e~+yHH3@RUc$lL;6c9}}-QDzZwix*D7Y=i{h#M^b+^=AY<5azqz*q&cel*81jj^ zNiFxjD35xT_y|E=$vV|uWqV)`KnKe8+ZKsGzb+&*`0s+F7Uw^2RXBUDLt0kI+Aw%o z0vEKIO{9LpvOqsJfabT?*d$-mMCBur;ktQw?4rvWoSk6I;fqX3_eBadAFI+-X8{zl z*Rbl$NOcXA`1=u87Gcv8-C;g*;E?R(EAgpc`a{H(eoQ*6JGjknGj!C}J&EtHXHoIi_f_0Ff2*rQMn=!au`#Vymsr zOG-iLBr5(cM9XU;w2u~Sjiy`9GRI#%KIA<#~JNK584H@z!YJRt4o>r-Z%hWn~h&46ot8 zB?cl5zkL|pH-R$DIa{RRzbFd-+z}B>aD6a?E&BT1ojn^pYl9~tGXz*8lUl$MVc^@$Fo^HDWv<1wecPRQuIgbjosznJJR0{b!>DVNh;ab9AZMI z`(AStRPG73x7VVM;OJN*?Mel2xQ6Do*R#Pt%=KqovwuTmMApRc;S~MB`og>~E7ykB zhYzQQ+Q(OiXJ<`J4LJeEYhc$-PY~3rWY8<6WO4hEK(xw>EFTzs;5c{Xw>A8h?=$=gbUW zwpnNtro|?ZvCtTn5xbrU%`g(nUgngjiP)(&Y-j=oQ7tB$?%?$UW>0WA2cT9Ob*wae z2e#yGitU0YaN7Mg4hSo4gxz943st%%_L2?zNMKUB!2W8(Rsy5Cot7!G#gJ7S1P_sF zzV{I-VIDCh49wAghsQZQ;+*^d%{z=k5LHun_SJYO2&7tc2nC}1?%30T{U00mpQ5D; zZ8GNVhoL!;hoWdy!!j<4R_O#38sJ1lpx#VFT@H5M0b6>QER>w>mN#3FaUL+;u( z_e3}+`YC~YCJ_HZ#YFd;Dkg5E@9NkCugrQDfF#r;5(4aHR|^b{9*~EHiH8EvWzEAH zTMPw{0)GPEG`(t|FK8fHmZ;njZVkiKH#@v#D$eX*W6kB^FnhWr#I_#5hRdFkUS$POXqwWke2zJ3 z@ibrdoQ%BvZGMsI9*;CQSD=bDGo2bPa+G^tkteI&7TmV|JxGM0%JiaVE$C76phhMp+@!jb*~hx_EjQ}qVcSV@JbSFhwrWONl?C0XwWI|iaJ zW<5b(l;A>wQ{(9Zk*M(riluw#r1C?KP)BOI{#?|GIwKI8WyFAuD#Z`@U!+=HNCa_87Gyk|RIwvQ@;s)93&0pw*T`9dkt{t?NzT z%>YWU+$oGq)U6wZHpUTZFY|=qi0rvMCKKPiyHHKiOUP+{RE3W`;`*n=Z~8%5aI2)G zs&zqeZ>|8t+W|9*hJMG7FcpSJYDAQ&a)~)%>Dyf=# zrd{L)0gXd~0UB?E-W1T@9Mu5XiIQ7c?uT~4YNN9q5cv>IPejdeHu5)Q6gFMZ>a1un zI%SpCPI$YEOy;B}-qhoDJm#+o-2~3pesGl8+RVRt6#l`v5S&$lbFMN zNc*M)Pn7_1qniF+x~Hlx)Y@+POQ15RiORP36B}ALH5I;AK(e7VQb3By*8u@|28+09 zL#yOtX&&#}U&&tOKHI7DvB>?2^7suCmZ6~N=t8GNc>dRWcE605bFn*Z*dqe_j_$dL z624?{YlH6=a4fv@fWBlybjZd)`0b-8j$B5jmRxBPdU%xLlUn3cstTFMgbcG@GY3Pa z;%f`5PhYa7epegwx;qd)OE!ex=1{IH1fJO$lz`Y@#>R@BmbKl&9k|0+|E1g4<{i~! z!S-erxfBj=|Lc7fUs~1?EB;67U>;tN8k%(&aTT_Dgiet8tV8+8*)pGn+qg$k^s3Vk zwrWbALIjLY6b6$fIWgD8vJsWOig)BNdYdD-USz8157w#jj#~9QGW~6K@T5HT_!W;#s2jnVE;!E!&W0u&^;mD?3 z!Ff<{UTnfqkB`|n-NY@y=~>igu#*&`1nkE92k6J)l5_-_OHyT1(ioLAG<1IXkyOsVMO>34=}D<%BSTsiH&x&7 zQ(E}tOAu;N_u8|Xd?WwZr^4J zNND+4zq>AGLAgjaNIA_MJNi?C?bOgH!59g5SAwA|sXvI>8gZyOkKqLR`=B>-si>!i zuB_a~vYdS9QL7@U>b|v7)f&+U%U}h!vY4?3G59_ue#J3f1-Xf#jZ{A zlpeZE2IK9}KHyE#e$b{ZWS2<+dg0pYVbFDGZ(_EICDDt`1^y)$__88<;4cq8dQ;EZhUR6qD zLSvzJ>K_{lQ?6^-1F5mw6jF*DQ&D8)oq#vtA=HLicZ&^6BzFr`&?(zV2)0vESwAV9 zF0pKdlNvffC48Pt_(Lp{1e+{d{?XyGcAx2wF#Yv=XEG^je4rwkeQLh=7U%k2k-g4Y zV(M{ZbQnfvU|hz-0mq?0gu-8SSUYPjA}#hFe`@>^Tg@L^3&n7}X}-k+V)6!%Z}Gs` z2o>hAKrU9XzQit&nA+lwok%IZT4i#!Q&DD_7SmL;okV{k&BqQb(cLPVDbejJ$}X)I z`%t247oHsl+1&Llb_x4JC~uRhXKW+!gzFI(Bu)t}KHgUYt`;9vGgJa+%>@M5&-W5& z)N|s-@35`9u+t?@ErH6rCb|CV@mamZ-{~pe#hWxS@f6_W9CazH>wAQg#TPNT<0ZC@ zy?+(btrO)yY9j`&^tnw+y!Aq=L2Qd8sZY%QmqX_~MJF%b#kcsZ_({ISXU9AG7Wa?4 ze2dS)*|YduHVqf&zv_@#ewN?!c3xfiVMnNw4|&E|zqF$k%`l>AjLZ#&)8tY0n%xf7 zQa5DYMiYh#UA(>%NEZ-p{X2Lx}TSe!iQQnlL{7u4>7ju z(=aw>XN}f)Gl3`~LhS4Eny9p`Ubz^UjCgKDq2>#LiM&aPMUIF9ir2?8S=GpSI4#(V z$#>}>ChGG%ncu8d@~)HL*wNo1QktGoc=2@lb|NU0H9|c4hm<0#*kx591HGrRiv zJn1KXCWeZBUq48ZjRT7uLr@BGM(ezFu~*6HH`axB?hQmQ-&jc{64Fpie8lO8$|K<-jsxbyRIMGm*$a+#{SX9wN!m?;=#cE{w7~&XMNxh%^bH*U znIyHHA}wpTsPiAd`D16^$|| z{l>031jA5ppu42(#&(%_b18xIgo}bMf-gY zSvd_Or86SCV7TKLwq=ER4wEBxJBoru`K+E5hs#0I|5V?DH{8Sk7%5IHsm-aHvC(`4 zlJQF;&Qj<@X%lv<*rShkbd_T?X)_QTMd{eMh-nz=VQ2WYFVq?^+X&qv%dDd18 z#OeXt&fuKca3Kd z%qMwBoHDpjRb&h%fqY`uNY>d|*J#0_31RPW0S5zAWhrLwgqpU=W(nm4B8DpSHdSV@ zYq@u@lovcT-f=>s^F&1tgW^t>F?n?p3}-7bI(Wk;bTZW1fLeP4<(dDiQpfQW!!2rzrCu_m?`TMU)!iv3$0Qj5<-UHzF=mv3=zVup(K zBX*a>lt~%C+E*(hGk&SB7ICM=FZ9)-zO?vxzS?vN&+*l^m9Vd`mJoj#+-O;Y_#O|pekafIxc}!p z%Z&m%fB%kxT?KMS!RHu}^0KL;>5hVDoN`CO8xJGz5|@?8)gtPSf|2^~-cj(8P}~$x zQdD;oKrMMkLFSFeQv7wFJV!s>v)-~U{NVq7|KDnZiyACTz6Y6W!o%^;zr~mNj*YuH z(RX{-T9$k}zH7tJOu%0Q@0Zn0GrKs z)en|+<&T!t8rk{3>pK&Ack#WKZ=CPDl<_yh`}sb^H(AbSiTGE9AA^&G|DPNNSeEzX zdnVt0eEakLg1Y4sp2v4L@u7q-pjKb!D|P)I*w1`d@O%afhIND+`F_H;6>Zaj?@r<| zzFmm#BRqrfEWU?`JIK?9ub1Zl-wwo2=G&d`eP3AClYE!(-O9H+V^O|Gi0ixTTL6x` z17Hg}SAOSioff@37Vw+YQYucP`i)l;+(Wz%Dj=cIqo8+JH0yb9*(f zSROvW8+vO-rfB94b`{Jwx?yyB)7U*so8B(eCG2$&O~JDlb*;OVQ&;ZWH*jXp`Pv`I z-w(Y2{H<=B8UHin<*o0iYm7Wrsz-UtcDg)<)Z-dCzT69M+U&I)Rf=>y=>yDhoUCjq zIsc{%33r*K2q^Aihv9C3@?pQmaNdGN#_4t0SaLt`u;eSTXoC)|OMv2?Df5{`nM9vTL>2i#f?UO0*N`tgDmhqm zUDaHCN0n~Z@6OXy@#nTEemx#Ca$X`S!jY=qs{oto_X-c@i?4|@*g2<vdy1xud3E|SD%szro7j?EEiIid-{8-&gQ01Kw&FXcBf@4G$ps4 zro0P!FMGTMDpt$zIc8JTk3)4b_UbRaWr^{<*>$Gs;r%@NYBKPBaMcZ3R|4 z4FcxCrTCYfDFdk>K1u;UBjD}|{2dE`M(3N@zhZATI+qd?OR~}V3bB(_Obquf#K>ML z+3zH7ez7D~i>8%xsxRDla-?enoJh_b{(^ObU@`bKb2(T>gZ}bQj?XzWxCe)w7Q_?l zoJUMn+WBB-b^#mPN3%At7Ahywi?6IHB(4tnz7D#cX|J&KY!2JSPq5sXG=3mDLT)SJ z?eeYbS(C7KoW)kaY=7_BS!Mowc1td`dQZ*@=6|bS`fbFuq-%T4T-K3>XUi##le6s# z=GHt*AsqN&Gk(B*q$f_8cE24^qIcbG%pkUi${9Jd*{U+-X_^BgF{ zC07nVUL$m5)lE>I@KclK4jb>ST_1}g7x-_%8&UVLny zOsSRT3%JPi4g+fXgU7fbkPm(P$`I+>(Sbv^*A;u2>x7$~w)boobY8FRe`Q|4+aMQ!c?Q$A{) ztJYz@8s5+6ojG2YqH#u&-l%D*tsG77Of~oywNB$tJA7viDS?WktsMAPV>mkoos2jz zoG-AGRvdLcO#l;xEUS?+7ZRA4FOtD6SJ>RI61}~EhHDVtnnS%%dvutLZ+G_-*!QYI zT4?592W4oD_k1cCu!(@JeVovI_*LcjIyEp(rSaN{ai1VHR^B7jWNHcSLc#6LKD-5So zZgAZsASD^r3aAm#NC7D^@H!v>&p<`?Xb&>v%#vCu)76o})GW5#@2{o85tpVQ_UvbG z-UhZ4TC#O!P7?CYn}w8f5`P_aEYoN4b}Nz~b%AmvAOeEf8&mCpmFmx$&0B}_$eV5Q zUZQwu4A;kbl7BOQsdszGMATui$e-jOrv9?~Wl|h(^U~t;5?KRVlTIRs-1;&?9TUox z^?38{S#c$;ugr6J?Hk zw}uSr-i&VWDwak$VZz@;3`}PyDY0D6$wdPeui#5FfjHkrTp(C{AbArclhasLMD0h- zqjwseyD3~gjm|F}_hyWa}e@NIdMF3@l~#mFo2MTXL&N@*PN8L zJ#XqP!GJrsQLZ?ev-xXXi(fLKZ;~0k8-hx_IQvgTZ#{u~n|)|sjqPw|zqSayhiw)! z@8R@|vKKIYLr>l z{JitmeA4FM^gui)1$*&J2)Iq6R2QuD)yTmgiX0{;>+waKD?;{>A~}BLt0`!~$1O*M z|Ja=*n747&7~80F6#3RpYN$<9f&0iLn3eN0m+@>~Fb)%4_PxX|d~6lNZz($>%d^U1 zJ#i_+!Q`b3cPf>2$o$hqaw)@V+kj{T6=c|C%YBy&?1<}NN0}w3@L;+95DW}ot_o;#gRi40KkBa)NNFf5LEpNArM5)54_ zK~5!4ai@8GDV3<<&s%U!twRL~V*yQx%xM;PpMuX+>TbE8hX9;i(!^Okwy_yJ&!N4A z>((+)xk>cMsz|lyA)#hrN}@_+^U&DmvpyOemXsN7c>@v!^M*qI#60ch6fNF)K813l zK*e$;)}6GaUNsV`LWk~xPBTxN#Zx|rMDBK|Caq(zyZNtr8c1|(z0dj>b8``6Kpfx} z$f4)rPhfk@2i5!s{ig14(Aa8kzekrzbUtf5YT?-8&vp1)M!R|Oni-D{P7 z0UUp?mMiwI38?Gd$~%y1->S!+uXpd+Vj#&jlhXHUn~6IjKuQ|F*k`uo%VrWRb0-8@ z^h|$NAH74X#g6z%mb**6$V_B%yLvadocqV zoLxb{rgv=;3DpUzK&Yk?n@aaL&@N@V|A6$bE;DY?3V9WXTjCBD zR#~Cbe6((c;d(M#tk648iMZ>C`Dy}?wA{r^x&yozS_#Z=47iN|IyXp}6;kH%=O{DM zCyU-b!V%Tgjc1qK9-Yiw z@i6Si$gn3A$tt0+A>qJ8n41V?Ajt;3($e3)A*05rvx*Rf!WA6uUCRNn#F_{_V3zx@ z0FwG0K&?rB%RLGxlSJM(qzY|%&&wJ}G~OwiRutvP?aJ0nx}pvBhf}jR8ZI5hN9~`5 zbxht@c&Z(usI-U5{>rSsk<}48g?B;G7V?tjYyiBZSx&%FvUr;Y=buS&ETR)Tk-HFY zfm8JXxWcI6?4k_lCbrEN#|Sh9sJ>)g)}!D|&~L3%Hwi3M51a#EL?lpg$byw%cd4_a z*rt``?hR|ytP_=d8gN|4&O)LY^_;8~`DM5sV|gmM){<EElcWI4OSUv(gnKE8%N{;&I&f~CJz z|K@E=_Hah6>R~Spp?dSjW%9fR!*KWM6zAT-UzPBIN?=Y8*r~Fp(SS<|6W(npo?=|r zBCpO{?gKVPEzLm9_t{U9uq2VdBqCvvJVl+S>=f4toXLW-X*deI0`L%$3|$fY>SYbi ztinv#dl9^8cg~U3>ns%0K7jTi!o2;s4=?7}`@tgpa@f zQzJr(PmYM>c=&m#ur$Qr z;X_uCz3q;SfQa+8(_~fUdXAvbu@00wSd=ojJ;{bv_s1rM$USPnIY&b#|A%0=2IoRr zSP1`%kayjesG;(x0QrQybBLvcPR~CO?9u3)!h@P6ygQ@N%WU-01UkFds}bA|ZYx?L zA!LuT6veo+2+T8iOR{LL6R>DQWWw++f`<~rBi-CnD9?t(aFeB)*)tSA)`%LH_;X(dGtcuN9fAE)o; zFQT`>TMeG_Y?)&hV%Umb;}rqP;REwB0jc>RAQ_Y9&jJz)FaijZY&K2K(;S|PBd*V} zhYPAFX9cQJU}9Ac7proh@;WL_pe`7TI!_cP<@U<&trHO{de!5K8^Mpb9)O5B;!$A_ zGuEtKDJ8gf0VOdgi8n5h^^0?Z0=Y}eR^8?V;hevVneW_gr_55pfc)2a@uPr( zkcn~wnQJ2OW_;(TPt%ogO$1I!F5aX?sr}d zFeT)HWC$kA&f?sPy3)T?9#XFDG56!7jqAWpQn173S8Ce;nupA-oU>8yw=s+`rs2uJb-pAg`O~@-E1BYjb=X6?r<1>1r1b7G4d(A8^gb~iTtRq~RzJ)BoIvszZ3f4W}vH@Z!(YDaG) zIDdIrXF_9Fi3h#E`41BD;f8L*U*6v?O_Y;5OO!MLo)ZlTlQeCSLZcD|Vqgpxdn~zb zxJHJDOkI-H*~oq7tbZvHJb)VUZm1YUQXR{k%Y?nr!sSVL&U;O&c`LQX@ebeI3`Sl}YPNx6fee(tCzWJs$UUx!^HvTR7DH?!X%>kKR znJXOJ>N*qchCd|zW#-Bm&AqSug^jJGK^nN#Ogw%JL*|QBAn#1ISMvpjMSLsMV1}c4 z!faopCd?>6YQo51?dp2uQh9HurW2%xg?|gxzS)!mKc7N0;Cb{s2G0xsG z!$ns7=}pOb$ec@PFT6*5^DA+YSpOUEvA(1Cj04$?*?aTWd13P|{Q}NryZ%f8>K0zh z{VdZNNJSEYpI)sV7g3@y;HFch!U?t7G=7`(lZOM8yhs6yg~oe+d7b6s=uk&s+=gW- z9$|Z^8a#Mt!k|cv#lLZ$4Gd0asS+5sO*u9W%hhtFJ=y?Rw#A6kFR5VYl=xI0`$ z?P+Os)bi`Uh@LI~!BLR@!(4Yhr5RiLJO1-=%Nr@Px@!mUn&e!P1tmWQ%GA9^{5xaB zzcUeWk|xNuN++1(ClH6PiH|5?}kK+Gny0YmfMs$Po@4zrO-7_^c zG+XarXr8Jl$k4o&)MJO{!!)=I%>$fml%e^ZgvgFukrF*R*!p##vdfbEvu-?@jk%^a zD>mdkqB}9RhZ$>QH)K0nHa3|SIhs%v2~~ewTgYPC*y$3U>}nU_f@qMPB;0+tw^FyH zXyNm;P*3X9O>Ho722ynO^JhAgkIkcJ!l~Zj(oCFf!gYagJvq~UK{>oSp!i0-WwXTR zFy|MSrigw^_}8#6+`}!G*a31$y7}Xa(ge~>S7am`dhbKh&_!Is*WA$aXtD<90AOO* zw<1(cil^AN4E&5&Y09U$%^d`%5EB=JIqqS(w=#GF1x{29*>f{?32fPeUd>fTY!M`q z&3&vt&h~ZQCW{HVXZSQ(LC71+j3?*c6qNbe8K_*#hnZoyUw=W^X~1DTju;yll?OQ9 zP{&UCK(<8vET13;MDM;Zo!kohyD;+0QDAI8u5ok zeusZaQFLB9H$mrYp)(dboI|(VKRqw5J-WsDhHPiSr4W&(<|TC)RmY8+HNu4X;WeD^ z#+OYli_^pTvIcE*-cDxu6z1(O%;Tkm0U-d4fLkSC37th(eUFLEvSTqNCJoT-VpfZ9 zQvtaAFerCFtrNtkGt}F5pLodhZyHx|W$)6+CWsiYj|*nfm*QI{loD84Ix<$q;E#fm z;9!=-BLnhUa8L^9*Bo3Xh*9ScXEt*%{*0e9$67ZlNeEnntm0K_)4falj`Y;*lVZTGuv=q41R1gRZ(NK!rPZcv^q7uppL0-%eP|D7reXe%sJdNzjGn=(IFm@ zZXV11XKIO+)2laTkkOi0A7WXCn#oH3JjwBxMU21I#|R)>J8xty(-yX9gu%~?(t(I_ zRGFh#56h|`>Efr*o$S-Zf|zH*u*%Q7=D^G{V5)>9GU@W0H=c5@7vgMPEM?3=tPsb?UBULYB9aB;OzO&9DI+6GvTHAvdx5vX zfg^#+6?(31tQBo-bK9Rp>})#NQtY_t-UjDez#J^B9zKlVinywI#MCT$PUkFsfv}2> zl=4OA^R2lka83&o396 z5$9iyfexR=6f{@M0x9C^3RN+)GR@Qe#FCD8*a66gw2hLDG&-K9OD9qGxDtuQL}?4} zv#NxK1FC^m5YWivEtR~H0jK}-xFz8*fk(Yv_sG(X4R@CPH$97ip{ie-3vppw_Mm%% z*}QlJaEfG=JjWwTOXaE`Jd*xb`hi{Fh_i$YbZD?=?cBS>dUpgpY(h=Q+f?qom?X8Y zSMjz+8sgMhn<5d6n^WM&R@vr$xaUkFKe|+hUsA!bTy_#E80c*UjbI17qVHSobLg;w zYVQxS0j1P{nB@cP``I_`6E{Ri#Ns8LGc;3$Zea-uZ zZ;=vFcSMmn0Mtx_3=L8Qd(uCrS?;ONNVJX%5tM0rhVWr9@WH)iZH3H@W zk_YSTu_YWFvtJbcW?-@LZXrLJ@o{nFMRih+jetck?2kOHu6Mz&w@^B%>dRTV#dy+l znYrBWH69tjJ6@QQro7#7#%cVn7-bARMke{*60H_Kk}^A6Us|ZCU&2s7%n~}8XZx2i z5b)|gT;AGk@Ub*Cw)nI6-g&3r*sm`w4r$Q`e&RKe30#LXJ!HHc{$j7bbW_D)?I=xE zN>@+6N?%&zl67rLMcuSPV}X9-tQ=R=DF(KdFw6+rzqwVmHSm43Yj3|dN8u1 zlS66of1(U_ndue~&`<1celT_763bUtYD%kKb0Blb?Y>$VgL+(3cL=IGy%0 zZ||tPenY%3H7unG@+oz}pbVw(w!bRTFITvUyliT4<=ZzGcc*Pvv4;OCenxne^*iX& z3uYzg+}B!p6?~{$2DI|{*_?kMYjZIzI~L!G%6JJGDMa#~OkQD4>d~k#ZPlVjYv|Fm z#Isc4SzZZC`;UZCMw_Xo0$Uh?d_%Hu-Ij4TKEL z9Rzq}ZvTO~koT3^%j51}76IX1sn3yC5bVn#xlB&5-H$C^zT$qVPw*6e%pseLz_yFN zkju$jKr`PImcmCID^$3h14`cZWHRdOV<(pHbQniI*rmUGm~)}nhpFBxNzz~5mpb4= zB2tt`ufm(FqGR;RT~L*`x3>|>oz_)16G$d5 zd7Rp?KMrB)_V6P6P ziwNT}d_^c1MAHV#?gl3x`3`4{j^{gyuRrR~6ZiL+si^!` zfh~Jq6eyNPf&C`1<&M}5u|VK34;t&)C6I_!($axQcCqq=;xeKjL=rQEhOw?nkKY(Q zVGSr+{o!tm?(QErj`-9$B<=|?wj1m1man>p!OV@sgLu6$GGGFQ#XE?7>vw$ZcO1o* z5;;yTeq*cC9N+FzU${KQM5EuT%bS6(ezvS|^8yhkIiY%2q1gFoV4 zPOMOWd1b1*eLH$8)tO4*sKY+Gd#`Gqrvxl(NvRQ*U_q)>m&ib=6QL+g7TQN(S!8aY zsVFsp67~aSjum?LQmq%+vLu_5$mQM>l{&1vhrwrjY;5Q$UKOvlmD$nLt9?Rnwk@aq zXgfK=en3`z(KKJcnZf*spP2yfNP@$48F6<4xIPJVX5i`3mkyMlXL9&SD}geN>$y58eUd(BslxAT4jdSPR$3XD#zU)O_|VRh*BW z5L16Fxm=38Zj;xVNNklmkKDr(m>C0lNJ(MuR&H9;LVp8u#+M57 zuql|=vk)?8fEh1WJdLv8(o zoli)_vC42SAmTTi4-mu_p3N`5x$oeNNb{JkcHd9Vn44EmT8!`Ee&c;~gMs1byq&Cx zaW0nVX*^o)0e@Fcs_pzkvuk4jQ?Zd_&ooWG9O2xR=_|NggKs01l*E1JbScSZ&p09iB8> zZDq$_+kOonP74mf%3<|=7=3XObHj2MJ<&ny?VKhGjUR}-TkdBNdvz|Au-tt}G@MtE z7&}>EpQ^BjC9zKc81@#PskY2_P{(B+1WE09V$274i+yBQyc54uP|I5m>_5y)t}ZOm zKA4wooU*c$=U^plZIFGXf7zKnXPIa(er8w6;%9Tb<>IF^eSMO0vnrq(0kJCp%#gB6n_{ulK=>?H-_)G1PZKgjfIS-kdg#3n?6n+aB!Wevi z5@l21Bz2g?a!)3YWa-o?jeafYO^XxxXkyO$Fr4eG}o zc$r(|f?gRQ!k!CvipzvYd8oy21O9m)gio3;6cZJ@r ziA6C4dr3A=9=8L^L0GZ#xm(?~D7LeZt$h^E%{gJ2F?wZx&ZG%`Kyr=>7>}wGg7UMd zV*UpB#nc)?e|0eHB6HG zEksy-B3&nRW_`2;XNp|G)s78RxzuHr#-+H@7}0rIxrDx&&Md)LvYyHANdT*{n!KzT ziaGkAdSl*oU~wkfKi4^uZCtkdZ~)-fm=(WOJV)F&Nn`#b5?`A4Fv~dUap_-~(XSn8 z3&Z>5T_PD9oClDh(sKQSF}0N36~D;ggYajTu_;`+Ksa+4yOS~5d@9O+Pp^!_T%>=s z@dI~efMR@Kzq?Jv7ZN?tAiv6Je5U(%>;4Z4IVjuFIDn$WqZdpMA8tL<6<(PxNFFWt zXuJcfBQk}zS_zO5{)Jz(nTc8ruSt*1B2@JnAoYrPPb83MTtCfK`-HkGg>vwBYqvw* z3gcv7vOxo!zGAzXF%aWusr}O7vNaE{uV&Y_J ziazfp67#n4k{Fw+MfsoWm5%}Nl@Hmj1#JndHrZvAT>O+8I+*qT?c7$sqKv0gG&hMl@n-3 zAvTpPv1@rKl%Hux)<18*5=?QO^_AL?_43At2OfXSH9f*;v1 zd5FKwWwOCOaL@3K%K=hkaaU!-&W~oCXQY!twKkF>TWB~rt<*(Vya3rv-{rPDflrA(4VKeaVkxuH$Y~{)$x#C#*;0 z6_rb&VOJ)txiasFASt6p92ZqJN>9`%laT+aMgo%>jlxaO>>tIop?eS2ORpP#nLNPGz;|bv* zS0Zcfk|(*H*Pk_Nj=TJjE0meHPVOkUS#A`7oP1k;(zQZO>)-fgf!tB>8P2EU?kFgf zI|}X?Nw(wfC|LLVcNBaq6gTZoQnc?VC~Uf;prPPcisiGNT3cRD^6P%nffZ%{bV|{< zpKK`_KxWT}@8Bqrf+bA314s%KNN}o5u>-QPU#KsceIV6W|8=IXO{3bDE1$iO33a2s zbi_UilYB_VnXPdWKaDZ}wjM4#W$Iss0QkNGNN7H5(Rn$pFdAsyK7>P<@ zS?<)oi05Z%#vLqMLw&^J5!y7)$R3#-4_Ir~mNVmw#^Vc%_rc_A#y$;fu1YiK+1PTU zk?=N0vpu&Qxnb0F#@AT3gk7@-rNs-Mx5Y_Ebj=*aK63m%0P%XI160xi)i%7%%kM-o1_n>Y%x%*6 z$pJ7Y6NNn3emzE?H=g?rP-A;Imng&Yf3Wr@@KIM+|9>V6h9!QZO)yo|s8K_O7Fy{; zgwza7aH0WG5viq?7K*4?(9Q@}mWh*ud>IBoQL)u(U3scjw3fvxCSVp2*%W2b3NAR~ z$ZCbK&j0Nu^1Klu z9L+ib3wky*w~`hCuD)2z*Pj>b+1?~d!)wlATOl}RtT5{dGzFaf{V%Cpz5n`vLnp#Q z+#lbZ6cri$uWyTr6wec3nd2si_rmYfDV&{?ETN^t3hMnsFwCo^yl@)dY(}&g6`N(+ z0Kz`!&Of3WmcN*&Qo}hC&p(cn_sof{jIjZo^XW&N8`1-2{WGl4S3pT6VPD(VCGCG8 zUJ=18ee?b#=}VP9AZ6dPvDckrpm=r=K#k;*ly%@pXH_KAsN;-SyF=A9^j&Ae%KX9cr#KIC z>JS9x(zbwn0$5P2>L-~~p`5w@%3-~G7v(aN$T=9$(1bTpLm*l1;4-RYnbcZ&Sak7J zzKP>ku(VrT?5S}eJklZ6w;_7Dw;@vKYAI=*ei|kJ2E0fe zxkYVq4xY$Gk(TOK?yHF#I^P;5Rn|%H0GtMX2Z2r9Ln>~`cJ;$m6q05@ZYakqwA+Xu zc@{JP50kpXQ)U)kJ6(e%a!HZtnrX_|B4g0@ZEGJ8@%&BHGqrKn?AG{6Hq9y?jQRJ! zPvgqrAirE?#N;X6%`YiEOG<3Z#jvmn8K-@^(|7H9hdU^0EZ9EQ2&F0*S_SJa? z=Wv3`FeJ*h7GXUW5 zt*XzpvrR|;fQsB_ko)xq9w@c(@W9MT6{)87n)PBxB`fsch(v`xNN_|9XBQr`dYqen zgB|_jgQ*oV68PeU=B(MGQmnO2DJ)}SAE{uAScSh>WemFFl_`wBfM}q!XFf@%w9eYK z?dko&q&Me3q^C_Rk=`{a={3>_9nv%HjjfC(iJ0UJ`64+{p1zZbQXkhv?#~FwF`1of zGLyN%oMRt2mdl|fL?CL((6>-u7Dr>{0G<}vnak%kxi^)+%(Tb0UF7v^&?8gtFhj2| zLV?y2HPz#Z#8rut6Njue+seC?MM;W*JWB#2YkLGlu zdBgd)ZPGUJJq!p&K5NDLOeexUJ$HCYT7Q2QSmXW)VGzzQH&}VXS^-u}8hO4OSU$hn zuY(4CzABxKWIU6>V}AktVxO>ORl*-IIcPhn{g=ScW@3jSLp^=jvR-WYq%zR%%>A!0w&n02f z*DeAno?lk2hZ{k$s*gE{LnviD|B0Z+XO>ZrEV;#M@Ku z;>v}EiGV&PKz>5{7^yg<;3$;8A<*w^ic=X09#IaMFTN}^(?^o`4s zOwCHlMU(wf7i*H|d&T&(%JFmMS{d#(uOirxnY?}dn_484^Iw|{wxl*j*O3DcYVRjvl+PWlsw&BklIKNEf|h`nR6}t zYl^O!kOEzWs5kGV5lffL`Dc)HQ&!ohEOctD>UX*Gi#=f0fi@ZDK9aW&WldCZ5;v11 z(T_OJQyuT#?hHW}W#U$Lfrd#ojm&kcy~=KE*qv=RH|))=8(mZ=t(fy<@|j(LC4uGh zHT7;}!>!yQeRsH0jVvbIyvC?Bo9$H%v1}!rYph2Tku)c!q^XvQOe4;J2v_SxMk`HO zDhkZ%& za`Ds!SuJm?XrDTm^iRG6 zp+r{C*NZ0eMe+Alqay9L*K#o22T0c;e4y+XD8Ig+bN#i`cws?}A_c@Yd}j;}cVjT-R}p2v?5RMlun#i3k^@W{$GoBT zHx&$nO8cOyRt|pN+IPDQe_yvT2SYV!U%RotJxafxQMt~i z(E0RnK4s2lxbqp~d?xEtJt{zoj!T2VaXr!I(&5{I)wj7ew7GV)x%T1m24ewA+=~1V z3{hSFUs4h7g^E{WuD4-VmQ&;>Hsr`$xaaJB=9fsT3cV%&^2fX-4ZiM<%=mbBbEfw= zs$Xb2m9+TxsoypEl%13sCV247!Bh2lT3n~fmS9UEY)fP?PylaG7rX5bB?_lD{RpP3 z!*dOmE|0QH!b`TdHGFw`;Tmhn8tz@z1=pnqN}nVM4(I+utHjL10lT05oUzojD4pAt zcii?z=EB^(R@ZMT==Q4Mr^md(flWLCvBfIiNU7eVRInjlBcgduAUDnLEk}inG2w-E zWthiUde{Bl6QH`;_v{nma%lQ^>|Jgf@tbNhiF7bW5e$hXxxBGU%I%}ZYtnIW5=kjC zN!fdplG0_~sy9s$;M*=(IXkDBgB-U43+l5slw~*ivx6tBDW?Y4WgDErG=D*?U*Gzw z6NXfJpuTfc0`5B({kpSwm)H{Td2M#gLR-J;SOU%6`7IWoV^GN0ck>szd4oU#YfGBp zsTWOc*qPnAL8jX2{@l*%V%=;8cg`>h61ucX&*>899Cu)s%U3|0HT>V$@JV)OIe7gj zw=*^+d36Sg^DIT_F&mM4$$6^hxe_|4TtnTOO+m4cR-xo10rb9W(=D5x|0@DjU!G=v z)3E!Ls?Sd_5N_FRU>Xb>HJvv%?6InLnUI4D*|T;9%YBzfo|{%z8(Iw97h13hVP*1GUz$v0M5w~XOiQLEZ!E$#91l5eJu zwU!>OiW?ErV(-}F*3yA@S2a6Qrtzw{rsC>!rc*p^3q)ICGF}qM zyz+PTxOT+qocS4k-jQ-Wo?+cPnW^1H6PWHE_QkirAOT}~lw01K?K1~OZ-jOs*3-n&<*$>BSX-N>rbLFqn+=A! z9EP*2gpeMcd$x&OT@=8tZrj0^p5oGNu^yA~vHR-- zS)Xv&XiigRr0@+`s>BH239~tAg0bd063_q>LeTBoSqCX-*9m*8r|13|Kd%_u1WI06_^-*~ zac3Dr^>c)vce6T62)YkSfp_+?maeHfY=-ECMDUcQC&i%M;bG~e8l!G&@Hzw>Vp)>0 zo;P&ty2_HAJ&@gI^=J3hbW+_a88)i!?>)3fBM7{NQVi3Yw$oT}UTa|id4-_Jg^2z* zjbvv%0zgv>je} z%~J2!t-u$0?4pI?+qlhN+GCW5S$KQi_E?P@tPK#SL!x${&)FpfiIjODE?02G< z0&HIcNSulHTMp1PsIO?MRV`5yy8$6@=C!qSHIm;S;iwr5*fXHtt1y&ipk zpstwuJuWVj8cK6T`RJ}Mov>t+-vxqc;SpU#bnZb?hqpRnqsPxZ*%$VNT0e zg6VZ_3FUmCv#2J57#`|Sqv}@46cJ`pa;;|CY0%jb)M`u6XNX>e!!AMJ=$h{NWEZwF+M_Ix5lo!N@YrnVTuvOcLmkq|= z>^-#E>-t8lNRC0i)8|=BdfZUgBbNtZXi=Cjd%Zy|_5H}k+%KUDe?wh2q$4VCNUy8R zb;*&5BVCS8IN;r^%=DJL@82BNA*d$K-FGFM8zbw6Y(#`Uro)T8!5uE_ULl*E;qSzo zL)^fyP!4B5^n|-{wGC&&Suk6)sI|}-?(n6jFzPmcEX@CH<>db64wwge(+LWwTK2!8 z|A-3p{faKScxMe?Vgdcjo!TNyVXT@;f(eELuyrBgKDJqfvq^BaBiHMRc zw3Rei!N=8q;mm6)O6sj3>QIz8I$zkF9MLuLhOgwEpq7fZcYV3uag9 zyIt!Uuli*Eil53~@u<)CCjPI}V?KJtr$8_M{7R1oRsKqk2Biji3K$Yl>%qno{@2a> zKt2Aal<0q}=Fhxk$#~+77~IJ-Zpq%x@5~Jl-P}2)n>T0(C%W09rT6HPC^SMFBql_p zR?iYe5G6Ws1-Py^wOc9Nkn z(|evCN@8CgWt|%!l-(~ka{@n=6HqSsEFc=8;XrtG)kztwPL&KW7 zwI|4WzqD7`c)QnN$s>_<+`n5-bArU`m61&C&H+iYr{H%3zuRCOm1XJU?aINN$Z%%L znQ5GzoKyH{bcZk||Qsi0Ul=W}&Tkeb=FE9`| zd++ssW*=AcEF=S^7dyq!v-aVu!UHE=70!GiQ2Njgopo1$kXC7VupPd)yyxDsYPO|s z;HbhLyIgjmXwp_NObwC}TOts4{=o=Ydh8R4AY%*pZJ=C^iHWC;USH93`u0hD%lH~G zzDk--Nk<;~QWvg=U&+9ZPQ=E;p+K?AR5JSo!?jY@{eh_sR437qUilLwMH{g(;IwQd zrm;8=Jk*oS1l_wHe}Tze0XB#o$1O|uW{40+K+^|&(>;Z1H) zu|gAJVK`e?^2BRZcShASSbC6KCzdw7X~ELA8lP#oc>cdgH)YsA_kmg33fbe@mbO)j z@(@wlx6l8yv~5eCJYKq$;?5&?0p5YV!1C5C; zStH10k;~r~JL~MDtR2p=#u#E$uOx{$+NR9I2&*SvM2cw6aX#HgOyB=`%>Oo>I>+#3 zb^CtHdPksQ3~;O1;RWly8E>l0^Qw8D#NzRT{LkWTt91VB0-(cv+2r8i%dJ^r+}RvS z)*>dlo4sLhVBnaGucd! z0TUQn;hfQ&B(AhGcMfjKyi^MIC+nFdEix5jro&#REt7L+xtr%U?9xNxaC zIQ5}ylLiv^4ma+ z%zXtOh25kh6oU_RKTvwRS14K5ly01;>1j&q1 zhd+v6OswO}#3-{^FDQ(3%f14T&}4e#7G1-p)oYpH-mqS++m?)}zcJU6u8f_VHZKXh z-An>^Qs_v}>loVyeUnJ}w%`fWRbB-eDE$X}JJV3-Y0S6b;dGY&3}5u%tm;L8H34{* zoTm-c0EIwk=<6t$mU>Ao_D2mOjX^&UcNtCwF!xyTP0>H%4wPP}L>(iZO<6;f9q|X7 z95^@52B$sUoTE#XE)z%`h~z9O11FK_hM3;T_74t}9@|Q?ykyOKj!P=k=-UxHv6lap z@qfh3HC%QZ zt|M7`E>Jq%WPf@|eiaUX7bDab^|N1_K5_2jq+h~4IYXC5A7ripWRmr)+B zb4=8D{`V8`JeC5od@VB|eH|p6T8NKa;CSs#X5f=Uhx@wVS5xh`Y130wa;NJj(-@1F z;FX+IJpXp3jg8I(WOzLPDU#FEE~E6U%W&M;{%lphje~EE1{gJXl2~euG4cH8NQVxdz{WX|X3O4yccJ9kLIH=dn)To7 zS@c-Fdp5LbZ(1*%{ji{;i^lcbW^dHKvT@_#lB|CL^kIAPZK0#b7| zIk;IPm418q~6(m>mTQPv5h(AjwaNbu#qo2vb09O*)p#1qQ!IgbE$mekE`)`eQD z#+XgUF`e&<)8Z3gx$~RB%TSEziEPNt@6h+9jr@l4bKXAIaVH!H$908Vm3-1HmV%~{(4se*(KRC;YaZVax|`x+p2gZ*XXw@)IW zaf9{JN1l?S{_deF4GWrZ#ad#OM6BwEoje|Dpoxsc;=e1k0yLOGRr&yE+?<*8OK0OD z!?*d^ykRrKbnYAYLUqn0${8p0o~UFTX0mu(hc_O!a~2CB*>hJI1dPH*%soYf2FnTo zBiVnyoH}vdS3Q{^#x&x_x17~_Y6mJ*rmya!^mb_lDcGe-n}ZWg?sc`$=w+;M9=dFl znMcE!X_a=?8t6;9YIM&i{txl2Cw=Y&TiHDB_P z^AfM?9hZ!(l~QaSU+Bcb=wWAC`c7xDWRmp7ODS#auTj3INX9Pxi;~T}T)U0RsPefQ zcx49_P5fGw&D?i2_S{T4DPe)4_3q9uxn0dCG~a3M{DTm&;k-Y%OFm%c+fK*kd=Ajn z;4XQ`s(ziViE$j;1U)nCakz6i5uBl{ZTx0r)q|+T?vX>KFXF_2Sm^AvCVYhne_G+I z>@9@P$BEP>wqtRG7MYdh_{&I5banOzsW&^8sb#Kfo_DCm>JOz5J5EKq?t6WHYVKd{82(l_WIry zp}ga#sqDL|3C=LW=&O$8dX&)x-G`|PcJwa<>{Yv+vSmy8=8o4SE|tQmR~`-gmVrSC&Y96|H`mbz~WF6&wrWVcJbV! zx1@^au0@n_K6`9io+A<8-@$Mg@3DH$F`6%OISL};$%wZtrSm8FIudi2Q6z#6p@|7yN12B+8w9o2Ba>Q!$bJYFw+;mMF=2kc8zu$}l543^Kz zlh?WQ#qp>SHn8%xSlzecg{bG3wb;sw81Ha?A#bd_4OaKf){UF28$b0}H#SnR@mBHK z@4bj1s5RrvCVfA>oHEIXgY&rb$_@R{-#WAO- z&PnCfq6Ijty!}pQkZy!dE2^~e4x3n`_+^u~@-|xCKd^3GW8L^ZS+wx~UF*hXK5tn! zexyvcj<Rv1=3mkx9w}Esx3;uN-fUZy0Zl*f8F@p6^KflUw$1XAWTeMs5}W ze9Sk7fAY%f30Ok_v9|;Km~RaKj5Q@|tgF{>_c5%c??Guq?2l!H?kY&KBy}vE`9_yC zd!LkNo=~me^=LSHtYT+;;&6s6+@Bo;=00`kc>$hg~RiAI|Xg;)2j$L7{%9)46D-$lAf2iW=Y@9_Ed#`e1!l z>=K84#KxX;MH|{PpgG6s1r5uzJ@jn()=}Q9v5x#aabt_fVxOqH{DnW)f+M3)2X)Lf zC$tgDm!~h|@w4JptHm8aOLcu(+FM3O&I9)~XSI+GVSV$U4D9X1;~&SRo4q5yb8E>y z-ykCkl@n~wr=F%F-W@E%3&!1(pqYp$^s!s|@TnB>- zDGj;ABKg;?ptnf$=#hS&M^@X;Xe@h)WJSW7*}w`#&G*l zi;mSbk1@8QP5cA~r1=Kufr1f510@O1eb`}GwUMc)fHHgr*3{4F!OMp&b7bDW-@>6* znrswo{-13Wd|oCS1s~2tKuiD6o%gRkPyGCrA=93%k&S`@XWR?WmEC1@`mm$=uN2S7 z#p*#BRuA}}`X{RgWtaBcq7*kplPNkj3ToPH6bwDHV~QAJEGk242;N_DtWwqg>XCG$ z2dJ>FTKag$uJ?vAkuu7I#{!uUw;gxG>G#+=!4I^LmNZ-8y=L-5yM*s? zl{8Q9<{it)C69-wz=x?fc2#AlhzAFDI=r|Fa=i#<2CQ`7%di=JOMTwfKjwgue~&a7knaahnuDGN>+cSz zH-;UGdRsNT{K3kT^Y=S*)1t*}ECXPjS#$JYBhcRUR$BCQpq}tO=^hglp05aPebA$& zqOB|XHZh6NJqhPyswORR?QU5ZlB+ ziTnO%UDKk+I9_S!y!>!_+Cj#L?%HS?Ced6HOY{9g1MEO#6YDhURWJTo#ztW7MjD2w zaPVBIsWTKJD?A1iIrtl`Hgn7(q4o0MtIm3Gx{c{ zC#L6%lU-V?uMBJRDt+@Qt_i|9$Ins|9f^#&M!D%J`PsZmA;>TTY1WQw*gz^cMrz&5 zFQr0}#ppf;TRU-8Hl(vt&U0?k_i&^;U$XghPFH;v%}Kswun9m@)*-RcoJM#D&Kixd z=&@uYyk734+y7MaV~ynqarM<6A+);7h8&i~rw=r*uWdL*LruTBBPhO3wa+>XxkT@~4qjd}$+^6O_N_?hwNmISsQADFjV`qBqE7PWT~We*8Yq2JsaQ3S&@@e1uPBW` z>7DxcxrfTX0~hx{{_@y8@E0cump_s+%?J6t>{_XQxfS80n%qPPO+;mSIf?lCtAY<- z&u*PH6cG7eL>8ywRKQ&$oZdU#&_Q+b*;(HwFovL7mfj6ibJXOpBvB)a^~~Gcpfy!{ zZ^?b8hy3RfwDFk^LFYI@j#e5;E`b7S%38{ATC|=uqwNgyn5ZVM9DW=qeFUe=e~B&@ z+{>_!$o@_VeL~<}B0lKmsmpoy2oIF|>d139QiA5J5%~4jly$varspWW8;`eZ)|GrP z$(+)cBJxvd6v*KT%?&dqiK?zS5uf^E7vVXlfZ6@o(U#236#@=KPS0R{t&0Uz6#kC`XSjK zSYRPB+8Xhj?3!dz#<1N@g1N$G_KzZR%pxp#7(Dc*x=q36cxD=dRe17C&MK@%>#zz- zdL&_uD%9`E;o{&-yVlrjA=9AC98n;hg@DXsiFyZ8Mt= zN1Cttzib?y)^%RFX^s0H)50N^8!Y~7sYp3J!3|sQ%W(JQpy4a3q+}n`MUn|}_iUvL zbW;gk>ver;WU%FyoCfe z)f%keiYEwk`HPxsUFqCMR)+VIJN6?K5pd}q&o$nF?6?+KHn2@b57ox}>A zgjHv-OmJYuoFrEGB&>M`%LE5j%r#i&Q>a$W_hc;|iWncp^rtq}8l1q2`wZ%ZpdRah zx-Wq`FJKZjXn_^;4EC9`ADZ7W`{89xwI(dE;(mjY*On={O=zk$(7=iXCh(`BhZf=> z&qw*dOZA2`uSH$CQ$A&Qg{n+mXou*W7k!L9_*u`Xn*W&_#%sosLOIgm(Gr5dPC&} zJRDVXa7G>*f4H07cT?5CI%7qB!OEWRLrYPFdXf!H??%#&At#wB8d?yUM?*l=N9y=W zyl@L>?$FRnQ58Y0H-Jy~-f2^3xI^Xio1>WMF1fzH|5Q&&gTFH`7}pc-yNTDXDnhqI zlT^OLEUUm;P~QFCaIg6s6Y{F2r>Qjlu2n?R)CJZum40`BXKm$F5gB_u)imN88J& zSecRGPu4_|kQ)dN%Y1J)sciX_eNNd<^}D(SUjI&s#}?mpG=B(>X0f~`(RQ{uB-fWD-jnFjPo$g#g6lcr_T51qo7Oxehm0L2YwvTG(ac#PUMS1 z&7TQjcWQK1j-96xA`_ieS%UfdMrnYnpvriR74E?V)R;ZR6Utl^%bdp!9jbi%-}X8w z9UhBUtxL;FPh+OI%`__Cj}w+0jW!+^Oh#&4{i1%CcplgF{$x20(?BXd_Q0k+euQ7& z<3|NQ2Eqh6j)S1W%Y6diG&yALeq!`d!0jZ(Ji~{j0>OrT_JOKTWC5Mo3!v)oJ|!^t zeTj{9hFP0HdLM?P%M?5_y$$I=TVZRiV`Mt^;#iSXNc}+~Oip|!Cce|mw_UFtlnDZH zfBg79kG&VwL{dUEaT|^CbG}>o_D!fN{?>G>H&lml30A8mo4w(I*LbU%joEikd-e3r zs}yO!jmRL1odrMSJHvy`-7s7CBR3-I6=PR=OB$ya+xt)pECbyUAg-GBc&1rYJo{pK z9rJS#Ou7gSz(H}u93^tRnEF{YS|m+yaM@H@WAKIo0Wn&n^v}H2x8|#A3R-ypzzVM`I+Q72o6cMpQjpxEN z-{lFY*)fufjqmKhvSS8~{onLQKpjULFRDzZQVxGV*46Zfv(hH;%2-653oOG&3zZdM z(Qe^Be{smO@ZZu@)BA<)lJ)*GE@UlB!^~&ws`l<6J@=tz^_#z6BEh-@;f9`We0X7U z;Ycndh<)fnA|PfOc1O91aO^RAS=#qe0juVPqtKiz{q^{~C13J9rvW$$1n$lp!>OO` z?Qak7Ft&cl?$b-dh@>XIm=?;sgyb&CEU($_ zwp%<_1y_hm*6XN5cX-z%du%}F5B-;V>@62E2jPnKvOV^iz$X}y{adCllL2vlHHW%e z2#nstPkWK)xeqqLzj}z|D#q6H-kwS|w+tM64VMBC9tT&t*ucY?fvU=&+14sT<&-sZ zpEop$mA_RgYSo>Hz^17coMI2WzdeJh$^nU3*Apx6fH!n)K~?2tW}`$4B)uY(gx^@e zk*1jZ{clH?sNv22XCI*&Zu_vx|KC8PdQQAOdDaW(-4;|MD?&rbqTBxQ0}v!#Io@`$ z;cBgC4_bmAk9)RxnicCQLvd=>;v9za5yyEoPHlQXhvU?Z8_sKRs&#N)i&HnUI7i@o z&~aXe8Q|)o*YW6&l@#C8jz^jeqKNdDTrSy)$JiUR#3#Ehc3XRO#?MphdhNa5P_Hdw zBZs>MybU|ky%|HfOnubs5n^^e`ziD(B4yT+)z$UOOdUNfFtx`(4tee4GQ7Se(m>wq zcp%QRW1%wAYr1y_Vdlw^7^&$fY! zt}^Ax*0kEmv0OP$qe2ty4L@NwaM#o&0T%pith=M6YV^s#+edzM$K%q zsd9BufN!O%m4zwW(4>%I)TLoZfm9=}WhUl&Whq0A(Xb=i+qp&X5ee8(@a*@kB@Eey zPjWl26yDXKb>1M@@Xjl}4WATxJFlVq6IcM)Z+u0lR*XYDlu6WI>cZ%#v4<@%WVkeu zw2;W&P90yj9rf7TBe9P(Ufnh(y=Vu|?6!gA4b9RfJ)4E%3U=Ylh~}?pwb`DzomsT5 z)Xoa*?7vIyE^>GA-zs-kxx4yrlDnJS-Tc?eog;USe~8?t z%6+Q;GPy0eE&mU%3TKvxXwmE_$@ZV)475YU#YxG|YLa>EcpjV`L;pK#i(0hz>Rk zZ{nq~8&?XbxPb&_Q-(|HKCC0JS>~s;lg;ZSp!fI^(!j zjxIQ^k)tb);c|4takU&dIEKk_DvqIYSS5~`egAnU@7_*{SZ}K;>oO^B;1F|Gd$?8o z#UW;53Ssa8es9pJ6$F2xvI8DXkkGdfTyos1`L)o(Io(=}sLZ(wBr5Z#0vaOoIc`M< z6H0r(;?jb8-%CUoAj?9&zES~thSk8KcY7>ioblh` zzzpayzpcmYsIMV94aAyF93kIMAwtGPZ#JumCruZ!W7uaLW{GnYH!HlBr~m8K{Qvb@ zZg^lvk}G(U#h~XPdu?%eI95&nJv5PrpVSQtK9<9d5TD1Y$rDZ?KjKaP1(6h1naCqX zG-Zxseuis`)ekw>6yh~@xTX+GvW-9P9>LhIC=+A7usuiUXXuh4Wf6}_beO`i@zp%U zOM9g?4;ijcUeTs!bvxm&Q|>8$rQ zSG_=E=nv-x$0g_R1hlz|ZZLn%Rc|F=j-mn&_h9~jODCPDA7(jbhkCdL6nF4Vk0 ze$cl*rTrG2QW3gu0_C$7WTHb^&*APq;bF*Q+NT8Vpnk70@6ZW53+7?ntR1-dECC1m zX|rBcn#T2s9BJ;RS^E>;+ZB{d;&$ATmz*Sa3a@U~Qo_BU z)mcf95y%sCgCw1Llv2Vk7Afrrn+Y&ocK1IC&r>^2crlv_MthPo1{VxXGbjqc_A|7(xKU`zuJdCoVO?6T;y;N8k1V zlPs1PlH!q%rc2qOtADjnW1L5cyx8X=ivRtJ;7lDJGz2Mzkz;Z0DGNLp7BazVsDr}>oCP5Vfl{E4gP~2mci&EhvuEB($ zk5jg}v`pm5?#Kdh5w-s{<9z^c|5Xw!ad4!k6`9e7W4x0Lj#XVtm^Zkhzr(Jdicdza z4880P)fNNh5YRt6@}m-NSVFbt;>rNdaR9<-&g>6`32)KCZ}#+ORw|-FZx1z*+d|EB zX~vS~pOyI(h#RN0>gz}$6-P!wRWkluoe1_|dIoLW*AH|W3cFHa=vq-a{=?p8uP;IiK&Ey&G4N}BzX!qaI# zrvV(~)<|WCTqU%7nUGic2chnj@3!u53?3ikgFBoWEfUE;DOx0w0VLR%;SRo~0#}ct zugYdmE4r}k$JlmGM32lkT_n~1NT)p0hMFG8?w_Xz(~(Cpvu6N7b+tRGOI@vY+}Wdx zF8cB4q6;uat@JMTAr$VEWg<9{ZU%jaLDwFy?20&Da82!CnQ64^drDN>l$ASVDin@( zq0rnqe(kxB@+;NUW#S!QFl3BfJ5QlQCfcAc=Sl$wY>bB1OoB=t@fAN1g;NiFCb?&U27@ zwG#vkLlFecwXgH5zvfycuD_;QLyII62m^}r$*0vB(jL85<*y8^aF+a$ffde*eXYqbqD)tX%(c4||tS=Ajs zGirat#mP6g!q5r69Aqq1^D=8eGa_6X<_TJXmuH6eccd&_Wpyj&pQj=^g!F0O+7Q~O z?Z00))AnSH=;+lQ$m{ReAKu}7_24Q`;i`}=vZiDsZ_F`mxdAld5}X?gd>5!2&VdX+ z(;d3Kux9t&r@J#=+yFM(eTUCIFY3037P{>R6@O@GdhSqrI+yn4xkz2rjV`*_Q&(AZ zk#D?+rQQ|H^~Q?uV;a!9e_}-`FZs9sDtk}O?iuCb-|3l1=!btGqv;7v=33+6j1Rq` zsRiIU>#t-Vw?!Hu1Q>vCRWN{1nk3VN)gO#49-mY5#Ckrlz|2oYV)Wzt%Z(|qOhTVYN8-K9PEx$W{oZk@6t zKSi`VIiWC;oJ2jC>zCxGd&CGY_ZT2#+Q90@AOUN0a1Q}Rfpd$NOjlM63Ro%?5)~aus_=Z;$0+k5KLqm)} zwN*XKgs<|3(Pxu@c+Ou~qT%)y&K3#zUqv$qp5^<6WD5VQGCZxQQ1=gWy(Hp@ZAvxZ z=yMrK^I?Z0Cmz?ndYJZc1h$bZfxKacABp_^iA2iQlD4G%TuGSe-=ug>%8@Tg(A!+A zT=X}-xz<#Q@Jg8G;(yeL{}JRhm0#WD=2?l<=2`oSE4sQ{Qeh{B9}-yZY&N}8H=B<+ zkr)FmTJtwGp0wF$%|Av7l3NH_B7EM?iZHIE&7}TLZ%n_ltvC84iS&7-5&5jEC;&;3 zP)|da8!Gl414cf%4Sa{N@9M^~T01HQ{Cj~PH`pjCwqg4O_8ROlDd4*V?rXr9h-kz1 z3w)*lPe=h9T6wTZdtwT>LfE|w`1Ta=WP$SySX*kcI@1I`(M7eKlmcEP@D~O=IR%UY zPg-OiiP*J_-?l_%2z<8zPfY=@6ZlD!$g~vjZv_q+u(q~jNv;z3Qj3;AaeYK?-<;z;g}w!4&Y-0#7mEhf=_XfE#1L52t{K3%kOA7p8!( z75K*n{74G;I)TqJ;6J8-b+sPJG~hp_fd3@$?rc^5(G;*q+Q|C`{8$Qjq`)&t#IAiJ z1$?EziwySDDd2Ge&o^MnjwXA4tiXRTU~w>$VACdJ4S1dwz{CWcFYHPKmPl6;e80f` z40urrc#gooql=}Bgigx4AE9zHwk64@iCp&s1=V_q(p)>7U;PCxPxIZX<+C`}%emjN zmhfl_5vk%oa!o$8)=sZ_UZFOI2Q2l&W!wi_}$!C}%uhBWU~;&}#?W%@9pykAG@r7u7sHj?0}AovP{E5u+ z{R~&Sh+w)=o4EcQ+2iEt+V}0+4|zGY_RHQ#*8W@i7#jWMc9UBQqiz11`8FUY#+|_q?;Gc$k_jM2c)1ga{cD_f_&Y|a3OgnOD z3-5u=;G}p@w#Ri`yYReHs1)RMUAtqa0xs}4sO5x)e$R#XVT7zAXK`_fFt4}dkUx*> z8LRprMHHXm-U59ab!GD-Pbla#YI)|2u7*GHW#l){D?EahuPT+w23r*hnj%#@PeO#Q zDu`rJ6fTYHly>Nu)V{{;4jexlU9-AB4hF6}@1M2_KpOmpT+;8lur;;58 zSdkNz?O{wKa_gg6iE|82rH#|vAS+#=3Ri5%NfCpnbS{FLq2cS*!QBCIr#!568S=kAmHzi>+dI8S;VKUg32(WSKj_XBx0dFPw->mIai=V3ZSPA6j$^Z<>R8${52!qrs@BiE@^3J{o?YU zQr_`6$Ex6lQz7IhlE}4-5-x9e?i0k1l&I3-xuUfry>SyOLBTesQnj-QPg7vnIGSr8 zHD9eZhZ7;m}&Mu>YoM0uk zm`Hr;`A~a))pjKIVZzy5yQQsoWr8);{>7k#OY_Uk*o_R5B4%=&ACCOQ@oK2jx#u}q zHPzP1)l_TLc$#YG$VZnMB^ zq6^sp&j1HQ7FIDsm^qQUYbV~ktNNLKLjrWPS^HRhQb5$oN+!MaSWjMf*2_O)5T8FT7C#=#5J6&PHX3Vj#!Zv$+kpE#U z&s@0oRz^W_R;xZe5nRH3EaC2hJB<}b@Iq=g>FjiTL@Mp#eEXfwR~7{>l0^ZEs{g5f zvM7*tY4ff!*(lh~f#f6`1&!D!NIUvL0|6)5D46y?+bGzo6gNeZDLOU^8ry6Xtao=z zkuqnU>6AI=e7?)dXp43di8jYLb7fH(zsNf9i!>jS$8_hYs3GL5~RcOQ6WD%4zxl zqe6S%1J?V1!JH&3Lw9T-?)Yuvt-Cg3DQMF-q$bGrcZoIm>u>mt9T3_F*-9qAMKQ~* z?FUHa{bYI{nG`&{aga!64asbmJ*JymNpuxHo?Lg!D3MZ1SHM0JXjTGm;dsZfO*E-r zPbKfMwx1wm(g&p0Nc?)GrbanPqr9(*uLrtXskR7jRWg~6h&pDS5I!bB>^CK&gY*qZ zn>UjXtvY$T;%*V*UZQMPlnLB*O)6b}i^+fUULa!-WxivRs=Ya`Y}5?f*XU;(Kc>xZ zew#=bWdZwU3U~8rkZ)Eu-MpUwcrhUEU5k^9vC5RD1GPib8@k=@EQt zxR??hQPf9q-&4xR@jFf2-bs2=f<8)A#VJrapnp*cHT)zLTS*`BkS`ENQa zC8d;9tV!=V_-?CJgKN@fWc@i2K1p;e<3mFxgPa&hlRr~&KT$qdm70K!s?8s$;nWP9 z*DJ%U{w6~j#uRP)E^xPlck_q*XN*%;YQDx}HSJ%kWEk!fz@5~4vWd6(9TK5IO~aFL zy%KIDO6yj|(@1B`QO=y*IIjP|9QUGYNBFlRsO)PsBsa-54aBy!#mi z9Kfr9kJb2-_v}&VGk8A)<8w1KqxileX1&7dp8;Nf5L``~Sfe6+s)nDu$0R%^neg@~ zEk+X%a&(tU=d3^^5ogTCJ_2uVlu)W;eas+KyG;IUm`a1eGZl#}Xq1=+4MPPVi%|^8 zMU7}H_BGE~OzTw0@1>oTJXAZ)ZkD}CiDeH=wQ-E8PB4bjW{&8Ti`%S_lk)#MUc>c0 zQhkpF=RGy+d!#%G)2w)L&6EqE<{XP_AGyDjTf^UakFGnG<0la$eEN7x7o&=4)%cNd zW7qi|U~cdP^Dc|O6pw$PYhk;#9>C($m%qa&b@ldeydQqBZp5j_`G1W6N9!_?x;-_{ z{}Y*c2zPe!Rvpe~&*e@oJXfTzv-v_7JT;rmx9uj0<8^%AVix`K>Vurs!gH@ZI|X-& zaP9s7yTLUquQ@aU4u?#@kt7_79a;j2Ltfx;2o8>UqCm_s@22SNr&Cz0YwPBV#A+wX zLse@jrJWwCYT@g)Q-U0x=?(6Y?(5wnM&59}p4gsRZev!mvBF*-dPHQXC-kyTxL$ih z$-DmU?vj^u0`%vUm%KC$hgCfoS{!P==HN2C*n--}sr71Z%@MIiq9jFkBqg_!!ose2Ut>2O&X9)cyFS-Ni_x#2il2t^dkkjMU>7&f^4hZ0h~A{*zW zjx!f2ry`}G+!Kjags#qxyh=D$twTmM21st?NgyRn=A57Pq&dY+yiMo)a5iU!Yi7vM z&1gNNi9WkK^so|x7vBdl{X$i*Kd0GVR=86-w;|yvQ!B%h<3sI#R|G#hQE}+QXcZ-J zcueT2Du0;ngLEk6Yz<@OhR&)Y_M@VauaGln8mzaRt|$^F*S_0yOj^(nenHTP=b%e7 zYXb@DyO?6=J6zuoMMxBlCv=dNQz2DAizm2fg3uL3XwmkTnIymFML6dxkEv+zR#o(V zRdm91kC3R<=UgW6q(qbE=av5LH!e;VrF7-MK}-gb7i_T zmApZ8@!oRtpo6cw)Q>rj20|lq?GaVECQ4?NE=u~?<=J+5=J;la$+V{OLjHG4Yvzc- zpXu_KdNE#18)N;UKGNsXjI`*|jyg^12Q{!}3tGdb;q_I+$6h=BVS)+L??Lbo~j< zEDm469T{?ss^Del;OES!j{s^-7~>7@I_5p}uhrL}jB!;gybX|cv^t)VpVwWN(h8eMK!2U^~ z8MA00@l6@C^|36IkP(g6eC4%n`cdQ8ofyDQ0?83PINKh~2u4VtX)ptrm7#gC8NgTC zJ-!gDuDQ(U^ckD{s5Qh*@}|%kcTV`$oSTQDGUxvBQzg_8xt)YqqQRN@If~Sp64sn3 z0`1WVKc+M>bO)|3jtmB~!k$@N(R_vB;q=|juCwA|0h=nqOU3*Y^S@7QQ0j`8X5W)- z-}9Xv3eStR9v%0{q8~|I%Egn6h1j$vp^l@tCxTMn8pU}AIJn~yJgul#`m}Ij1Yh^9 z!5|$PjpxveTzgvT`kMrGSbx7YmfuPp%cibY_1TGq>Dvo(G@T$?u7K`F>1~8>5Y7HG zb~UYry{V70Kbmg+;xyH8Yvg0TiUMYyFj*9_H20xEksy50q4tylHg++z^@lvK*l5oE zx86pBtGq38nG&&QnUK)KQ^D=K8ZjL2#*!n`Z?QL*9c(-Wd2t?~Do5dVi*Ka;<)KZk zZ3j`cJ-s6Iu%ayj!Se%{p5^J@5}4M$AGddD3QA@=G8Yx0mlWmTO2x^N6gqKM`M0>y z2&0HK^=J+apPFrN)B-&16t{h!!0wVa-{Ui_OZW=WIC8r~_i0ndfNz}`X!eEyESy$Y zHvnLd0F=a*o8(&vL7k{>H(#^5hd+04MerqY|LeTSw}G^Gl?Hi$(0`>gDp8 zivqr0D-h{!*P&sRD~nu|Kv^05WTw6U-A_8d8*DmdQNX{mZ@lB&z5P@T<0kLe?an4- zZ`Jm9gMkhyuy4w?Z^~>M(#_R8#4PeP+h<(XTxOiX8JX$RdYd`CToi3m20S#fpg9w& zn-)gn!8>*&OL7A;;2WlW#*2i=gs6PAT;8e*rhJD@`I=4n#@pvK#Bxzlt-GlZi+3lu z81_n-gbM@-rViu&81Qp&cN36-4kZ7vHpmYg$OG+=0w5YmWx=Ujf}O)kJn$j25}!3j zEAdt~vq;+SWfc(|uZ;H%@MasL<;?pH-q*hp-ZtTFxl?$RbQ#hm);OJ`_AxkyC$ApMY*`aP>@rF6us{4jQ zL&@}~c?zAgAjiI>j!$s8_~z-Rl~3GlS~+}^S~(vQGjiu0UDKM|IO}v6M_$V2Ji8Sw zhCT1x7_VL1cT;pVCWeyUwO)I^GrKqWE_9wO;D~XS$5G(H{Mii48|qRSswl=fBeoUd zJKK+hA35afWxz-vE0;UEE=JJlLA`dpFJAVz&f$)RzVn z0rOge(1ypXb*JFY%R4vNS7y4QD?D}=tNLpYmeGxYRn9Zi%cy!_6}Pxn&AS94&E8U8 z%~H7sk2h4Md4emheS=OvmfxO1+#o3kCQ=6=y68DasuauUhVT(1RdcKlV z-5Tl(f~^_WtbkC$`4>|F@7TruD!n6DN35pa@iV%1DZkZr!JvN9QSCpe2Bb5Jg9me*@o@ zIm&94Dcio%9pL!;HK$X5l}jJWWktJDE;TlZtFe{(xoJ~=Lh2dTeSZNf*3YESYF2l%C9NW?c_*$)^PN+CCG%BSwC9qd9GW~{lZTGQA%eCr52!MCaE$O+Oh_)^$z zS!J9~HIJ3HlDhwU&FPtZDWEMKebrh9nue4jC5-xt2> zxz*$&n(9g!@_<6GD5&b@qO$BWE77bo=@@FhWX-g#<)M2;GsG6V1Fty()UH+TrhDa- z7UFn1zS7Z8$hTZ3uyBggakGr9) z%S%w--{ZEf-fzdzmcnW@$?9(U-4! z;twr3;D681_wXnxOFl+@U~HXw$Xl}Bnj`)Wx)rCSar(sGQShyTR1uNrgqI0k=5(Xv z;5&q_Y6>KKb>3Vx$jXy3qOE^y@8yKdgNIiu-}TxkM^$7;`lDy}zZeKSw54YI)XsK; z|CG?MLfKt)9mW_=C9|lZ_1yDX>>-6G$^B%TT@QJMcCn}ZVHMBpVNeUv-s8WL zuS_8h``=SPv;}_L&}O?q!u<{Qu#+qHZGoomx7ADHT%kwW8=I+hk`AtyhUa-1WA?Bj zyCU?<+{kO+hm5h`N{UE}jZ%g<&cN@Gl`hYCMrSLLN7clVGQk@<*v3w4TOVYutmK5h z!j6O|#M$o499k*sJn0lnMW-Mxor1~e6dX+G6mZHt5)u9A=oDzYHZfigNvGfhN{fd+ zL{8nzk%k?GGRoSy9y)QLq0$Y(h^siE!-)PPXOh(s53EB$~nsyuu2g#+G)l4^AX%i#7vQiY-fpN+6HN3(=$Kv_R8G`)K#L zaBK#G+L0UQu;ba25|T;>(k9+%U@nvnT@_r2QU(w%cE@4dU<@80{}d%yeL|F_x0 z8A2KraxL?VZZwy#Q>?+kY;!^gvyi3z0yo5ZH$(?dCj{~c72-A(0;)8Zce#ONGb2Eh zNS*@z0c~|x)jly@y}C!M?HSJ<@d#$mTYO9e4C3oqNbncXYI`Bf-MaN!xy-U+UU`1< zqV_7;aNdnnP?uzOsARgCj?i*z-oXuat$9C1#qc_odONQCCp9(L%id+HE)uqFNcg4& z97|ZF4(QlfhkFo7KVKdr53NOXf?4lO1ipfOh`_{Km&FhdArR{6Q|)d3@~e2iFEX_0 zvjGGsP5r+8OnYVVam;;O%U(2;83ajR&tKWs|94fF~-#UDgJF1Tnd*RdiX<}^Y@Bn6&x z1i7)5QY5QY{lmCVwPDW55J3%(=W+HRJm%{FTu$8(NqGz38r=s~NgTzB9tP>+h- z#RmKApgF!Zz|Q3_GFDLzh&*My?d}f+mF;6u3u-zhE2qfWJXvf-#_(i07i|c{Iz%(r z6B!puBmE&fD+UsQcB9Zq5y8l`f;Eap9HU^Dn%0HrN zDt{)&6sU`_qWmDvjX;8Z%99*Nr1=?7(oYnFYk=VtLF4mg6cnKp7G!-J0sk2=UNxBf zGW(@|uC}ldewJqI$Vjn&?nG#%zGdOxckPo6nT1b>;F6<#TX1 zwt^(kl{_b#96{+zAX0J9-hUu6Js<~&!&bNKizL>2k%LD*Bh4ozGpNwTGfaJi@e54N zI-bH|rgQbAizd@eKai=MQPE`TcvGOjrVrdYJ-HejtqK9Kktp{2ebmWK$KLIJbcs(l zAIX`z*(M5i_MenjTZg%5Bwp8b@1PfbxvC2R^Qii2?pE}xR1oRhnssuIT1?dmgw zZnE;GA3!&8*7ceBR^)CqtlYIWmWfDUnQY&zHD0fJ9~(684C`4@~#0fQE@Z{V{bb!4zAdbA|xd`5y1KKI$3)s<_Y@8!AU~Z~>4Q)~?>qf7! zN?u^m<8{Gh#1?COBiZTJuRt8#bX_1mP!jFbjs1EBgY;e{G~X5V{eh~nv1*tJkoB$FiOgS~YA(T03m2v6ltVQ4#3Kq9D4(y4&mTU%091_`v%} zr#3Jx5v+JB-c03lpFw)VGU~zA-3N<+bneqU4j!C$XHyTd3{SEJ)mgn^zjIn=*EyV4 z&B38Ugahz$4tCO}HL4C*?E}07&{TT~@*}um=qnZV8+)#bigaEi+gH~WQFD=OJ6o9a z)yb3&Jz}9Z6nzC^B(`~l8iAL#49w3rjwTC9(q8h1(>-EG$6LQonz$xq&r7KZtpnCv@pkiw;+&qmDvRiZj6k)OxcH0 zTl6CWbc)$5#e{pNBxr-`b=_wvv0LDec!gF$YzW{DRbU6>gs;+61H?f=TOm)Ru4 zTPDEfQz00~6Q=PzF3IyUUAnQ|`*px*6K7EHwG}pG4jS7kc57|2wbC2*>fU`EsWxvKzi;3vyaP-OjVe~Ea6uv9#Rp?kXji1nElz^d0VBF}OqvnRaSQo0#YeIX;0STW zz$e?~KnG-f9>Rc3Aq~wS_U2(31QZDRSihC z!{eQTzwV6`o1L<1MrR_vb-=yehw_fUH>ib=1kL-g@9_mgnA>cDj+f7ImIfE^kbc*D z*fS(DG-!OK%vyi7m*LCONTfre12K%#3(*WXo4KNrMv&b@w`=zx)UZ2fUe%gqeqrO+ zvN}0tzsS>6fOTNU)dJ2k56i7{?+0H<&8J%PB$g-Y*wLB>H1Vn0ve7tfuAz}-!l_;) z-VMW^(7ne84t7v4B<+2G)6y;Ftw3vj$9c=wTKbT`I30=rU&_aJUqZxXRr{9HvBs{I zE3|-LBiT5`SS8d#iW`pi=SQn0(dd{Ao}P2*N3wGQ28|cn2_G~zKE|VW=>q=CUm_~m z^pm;Fn4HJQ51x!4&(jowHYeoqzC8M>+8|dDg);7eX>itTc%4qb{`UZzPTDR2Ob(X+o?9+o>iTBl z4t%7}r%<^3$eHo}0a_YH?p+m2PI>10ICOvzKf)_xU?lv^(6jiWP70hpNTLX|rXnf3S3-2&uJ%PPfMbE&i?X;+FMK}k%djqF2* z#gF^rfNoWRWsqu7o}TR<1b;TgEU`v$aqou z=k-?oPX#bZ{4Vo?>u+5t}O?JZ)JeU*@WhgsG6w>EEy({|QbGO(=^eF_cgDu5#FHQ`9te>fMK=?*uD$sDmNx zrJeAuiap-#VN(sBFwkIFjtClm30Axr&|W%j?5cR%3;w$t4;F zYVcXBgnn$l&IlN9B+mp~iqGU3VM9xn1Pu%t9_RdtBki*@qu6br2-Cj=HrphHpdSYN zjTYW(sCMEA>}vrRhJQ$dp~OkKn$i{E8xE&vlN?FV1hdYyyleRMk z6uTNQP&RT3EeT3V?SU4RpsESyV6>jUP0E+%bluoULK0_a^b}U1Z=xTN0*D$RY-f(F z-5&}#7y5G*meS`?)%VOJmsH>|fhnl7!ODq|=w8eQtDTc&li!(0ul@)#P5o;5uHiRG zo`6d1uGnTl2JuAB=SWA;N;uVv{n`hAna|J$|3+$*udVncU%K%Qcst?%7?RxatZO*R zEGx3Zv5`CL{C}1UpAYS^7U1M)HQ-SI;{Sr9 z!!H}#)n?{ByEd-Qb4GIhh-Z}drz%Qglo2Z(tZH9!Zf3QtB7A@c=sY&7Z%I4yJDdxHf<2uswdx1ya= zumU_=Y?xTDP-xw}zs%%TtdVT`M9JDuxU%*WO4fcUFrp%Bzm*1ZWbLEKad5GyL9z;Y zcdkc#tCFwhI#LN1DoVaCHOb0Wq|wcV^c%7~zr+K@GcL>eB9<>Z*7?AEIvqo;Aa28ivY@0xUau-Lwe(y4y|khGW=OS=_YX zRb|Eqkxx80q$m{-ZEs_5^2w^ML_2Ln5omNZK1FiOY^+DiTnf|g<(jbw!*%#32~85_#KM5Tr4Z+Z zmts~8G%|T7f`><-gM&H1;OR;ZCvuF7OtyBvK@3wb{bF?_=67*bh)n2L46#tHES zV4*}lov3ZPGgcUCcn9+*k50CV|14F+%nG&n1o>ItK;-9Adk#tFl-+P#7)Ch3X zBY&;-Be;6h!%;&gM-7oPCR_QP@S0Kq(XBY_-ECC5MI%Hke}ca_7QHZ8nc)!a0W%*#ht#n{ay^v##ZhAnF?{J-+0<)IcB;{iliY9#iuSLgs_eWBgNQeWywjf^@1hG34hlBZcK~?{z`%VT0Esm$pX)DVne`Zj+}=nD`eG zrPWk})n4--GC4$8Zk1dyRLN)V8ZBCahd5!k!=clW6Q~e@<%@l2wbV5%hE1-K3b-_K zv}w(I=;W4~V9ei-m0lz|{t+gb(?b5gY0JuG2C^O(pN#zmp8OtLmyv$d1l`lA}f#_FU z;j6lOT;-MHuDaScsjj}HsH8}WyOH8fpq%o{{&OG|D&CXgo{I4cLx#RX+?k^d0u_uci&EN7}A~ZFJo^)rMQ1kiqEJNhf&7qxheiX D-}bBj literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/policy/frameworks/intel/seen/filename-in-http-get-response.zeek b/testing/btest/scripts/policy/frameworks/intel/seen/filename-in-http-get-response.zeek new file mode 100644 index 0000000000..f951776f4a --- /dev/null +++ b/testing/btest/scripts/policy/frameworks/intel/seen/filename-in-http-get-response.zeek @@ -0,0 +1,24 @@ +# @TEST-EXEC: zeek -b -r $TRACES/http/http-filename.pcap %INPUT +# @TEST-EXEC: btest-diff intel.log + +@load base/frameworks/intel +@load frameworks/intel/seen +@load base/protocols/http + +redef Intel::read_files = { "./intel.dat" }; + +@TEST-START-FILE intel.dat +#fields indicator indicator_type meta.source meta.desc meta.url +test.json Intel::FILE_NAME source1 A JSON file https://www.json.org/json-en.html +@TEST-END-FILE + +event zeek_init() + { + suspend_processing(); + } + +event Input::end_of_data(name: string, source: string) + { + if ( /intel.dat/ in source ) + continue_processing(); + } diff --git a/testing/btest/scripts/policy/frameworks/intel/seen/filename-in-http-post.zeek b/testing/btest/scripts/policy/frameworks/intel/seen/filename-in-http-post.zeek new file mode 100644 index 0000000000..dc0db99e09 --- /dev/null +++ b/testing/btest/scripts/policy/frameworks/intel/seen/filename-in-http-post.zeek @@ -0,0 +1,25 @@ +# @TEST-EXEC: zeek -b -r $TRACES/http/putty-upload.pcap %INPUT +# @TEST-EXEC: btest-diff intel.log + +@load base/frameworks/intel +@load frameworks/intel/seen +@load base/protocols/http + +redef Intel::read_files = { "./intel.dat" }; + +@TEST-START-FILE intel.dat +#fields indicator indicator_type meta.source meta.desc meta.url +putty.exe Intel::FILE_NAME source1 SSH utility https://www.putty.org +zeek.exe Intel::FILE_NAME source1 A network monitor https://zeek.org +@TEST-END-FILE + +event zeek_init() + { + suspend_processing(); + } + +event Input::end_of_data(name: string, source: string) + { + if ( /intel.dat/ in source ) + continue_processing(); + }