From 852ce1d00fe68ca9554cd359a075f403c43ef6ed Mon Sep 17 00:00:00 2001 From: Automatic Build System Date: Fri, 5 Jan 2024 17:56:52 +0100 Subject: [PATCH] automatic version update by autodist [release 2.9.6.1-1mamba;Thu Apr 24 2014] --- README.md | 8 + snort-conf | 974 ++++++++++++++++++++++++++++++++++++++ snort-createmysql | 11 + snort-createmysql-archive | 11 + snort-initscript | 59 +++ snort-sysconfig | 6 + snort.spec | 386 +++++++++++++++ snortdb-extra.bz2 | Bin 0 -> 163576 bytes 8 files changed, 1455 insertions(+) create mode 100644 snort-conf create mode 100644 snort-createmysql create mode 100644 snort-createmysql-archive create mode 100644 snort-initscript create mode 100644 snort-sysconfig create mode 100644 snort.spec create mode 100644 snortdb-extra.bz2 diff --git a/README.md b/README.md index a26141d..1380ea3 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,10 @@ # snort +Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. +It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. +Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture. +Snort has a real-time alerting capability as well, incorporating alerting mechanisms for syslog, a user specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient. + +Snort has three primary uses. +It can be used as a straight packet sniffer like tcpdump(1), a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion detection system. + diff --git a/snort-conf b/snort-conf new file mode 100644 index 0000000..931d0f5 --- /dev/null +++ b/snort-conf @@ -0,0 +1,974 @@ +#-------------------------------------------------- +# http://www.snort.org Snort 2.8.2.1 Ruleset +# Contact: snort-sigs@lists.sourceforge.net +#-------------------------------------------------- +# $Id$ +# +################################################### +# This file contains a sample snort configuration. +# You can take the following steps to create your own custom configuration: +# +# 1) Set the variables for your network +# 2) Configure dynamic loaded libraries +# 3) Configure preprocessors +# 4) Configure output plugins +# 5) Add any runtime config directives +# 6) Customize your rule set +# +################################################### +# Step #1: Set the network variables: +# +# You must change the following variables to reflect your local network. The +# variable is currently setup for an RFC 1918 address space. +# +# You can specify it explicitly as: +# +# var HOME_NET 10.1.1.0/24 +# +# or use global variable $_ADDRESS which will be always +# initialized to IP address and netmask of the network interface which you run +# snort at. Under Windows, this must be specified as +# $(_ADDRESS), such as: +# $(\Device\Packet_{12345678-90AB-CDEF-1234567890AB}_ADDRESS) +# +# var HOME_NET $eth0_ADDRESS +# +# You can specify lists of IP addresses for HOME_NET +# by separating the IPs with commas like this: +# +# var HOME_NET [10.1.1.0/24,192.168.1.0/24] +# +# MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST! +# +# or you can specify the variable to be any IP address +# like this: + +var HOME_NET 127.0.0.1 + +# Set up the external network addresses as well. A good start may be "any" +var EXTERNAL_NET any + +# Configure your server lists. This allows snort to only look for attacks to +# systems that have a service up. Why look for HTTP attacks if you are not +# running a web server? This allows quick filtering based on IP addresses +# These configurations MUST follow the same configuration scheme as defined +# above for $HOME_NET. + +# List of DNS servers on your network +var DNS_SERVERS $HOME_NET + +# List of SMTP servers on your network +var SMTP_SERVERS $HOME_NET + +# List of web servers on your network +var HTTP_SERVERS $HOME_NET + +# List of sql servers on your network +var SQL_SERVERS $HOME_NET + +# List of telnet servers on your network +var TELNET_SERVERS $HOME_NET + +# List of snmp servers on your network +var SNMP_SERVERS $HOME_NET + +# Configure your service ports. This allows snort to look for attacks destined +# to a specific application only on the ports that application runs on. For +# example, if you run a web server on port 8081, set your HTTP_PORTS variable +# like this: +# +# portvar HTTP_PORTS 8081 +# +# Ports you run web servers on +portvar HTTP_PORTS 80 + +# NOTE: If you wish to define multiple HTTP ports, use the portvar +# syntax to represent lists of ports and port ranges. Examples: +## portvar HTTP_PORTS [80,8080] +## portvar HTTP_PORTS [80,8000:8080] +# And only include the rule that uses $HTTP_PORTS once. +# +# The pre-2.8.0 approach of redefining the variable to a different port and +# including the rules file twice is obsolete. See README.variables for more +# details. + +# Ports you want to look for SHELLCODE on. +portvar SHELLCODE_PORTS !80 + +# Ports you might see oracle attacks on +portvar ORACLE_PORTS 1521 + +# other variables +# +# AIM servers. AOL has a habit of adding new AIM servers, so instead of +# modifying the signatures when they do, we add them to this list of servers. +var AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] + +# Path to your rules files (this can be a relative path) +# Note for Windows users: You are advised to make this an absolute path, +# such as: c:\snort\rules +var RULE_PATH ./rules +var PREPROC_RULE_PATH ./preproc_rules + +# Configure the snort decoder +# ============================ +# +# Snort's decoder will alert on lots of things such as header +# truncation or options of unusual length or infrequently used tcp options +# +# +# Stop generic decode events: +# +# config disable_decode_alerts +# +# Stop Alerts on experimental TCP options +# +# config disable_tcpopt_experimental_alerts +# +# Stop Alerts on obsolete TCP options +# +# config disable_tcpopt_obsolete_alerts +# +# Stop Alerts on T/TCP alerts +# +# In snort 2.0.1 and above, this only alerts when a TCP option is detected +# that shows T/TCP being actively used on the network. If this is normal +# behavior for your network, disable the next option. +# +# config disable_tcpopt_ttcp_alerts +# +# Stop Alerts on all other TCPOption type events: +# +# config disable_tcpopt_alerts +# +# Stop Alerts on invalid ip options +# +# config disable_ipopt_alerts +# +# Alert if value in length field (IP, TCP, UDP) is greater than the +# actual length of the captured portion of the packet that the length +# is supposed to represent: +# +# config enable_decode_oversized_alerts +# +# Same as above, but drop packet if in Inline mode - +# enable_decode_oversized_alerts must be enabled for this to work: +# +# config enable_decode_oversized_drops +# + +# Configure the detection engine +# =============================== +# +# Use a different pattern matcher in case you have a machine with very limited +# resources: +# +# config detection: search-method lowmem + +# Configure Inline Resets +# ======================== +# +# If running an iptables firewall with snort in InlineMode() we can now +# perform resets via a physical device. We grab the indev from iptables +# and use this for the interface on which to send resets. This config +# option takes an argument for the src mac address you want to use in the +# reset packet. This way the bridge can remain stealthy. If the src mac +# option is not set we use the mac address of the indev device. If we +# don't set this option we will default to sending resets via raw socket, +# which needs an ipaddress to be assigned to the int. +# +# config layer2resets: 00:06:76:DD:5F:E3 + +################################################### +# Step #2: Configure dynamic loaded libraries +# +# If snort was configured to use dynamically loaded libraries, +# those libraries can be loaded here. +# +# Each of the following configuration options can be done via +# the command line as well. +# +# Load all dynamic preprocessors from the install path +# (same as command line option --dynamic-preprocessor-lib-dir) +# +dynamicpreprocessor directory /usr/lib/snort_dynamicpreprocessor/ +# +# Load a specific dynamic preprocessor library from the install path +# (same as command line option --dynamic-preprocessor-lib) +# +# dynamicpreprocessor file /usr/lib/snort_dynamicpreprocessor/libdynamicexample.so +# +# Load a dynamic engine from the install path +# (same as command line option --dynamic-engine-lib) +# +dynamicengine /usr/lib/snort_dynamicengine/libsf_engine.so +# +# Load all dynamic rules libraries from the install path +# (same as command line option --dynamic-detection-lib-dir) +# +# dynamicdetection directory /usr/lib/snort_dynamicrule/ +# +# Load a specific dynamic rule library from the install path +# (same as command line option --dynamic-detection-lib) +# +# dynamicdetection file /usr/lib/snort_dynamicrule/libdynamicexamplerule.so +# + +################################################### +# Step #3: Configure preprocessors +# +# General configuration for preprocessors is of +# the form +# preprocessor : + +# Configure Flow tracking module +# ------------------------------- +# +# The Flow tracking module is meant to start unifying the state keeping +# mechanisms of snort into a single place. Right now, only a portscan detector +# is implemented but in the long term, many of the stateful subsystems of +# snort will be migrated over to becoming flow plugins. This must be enabled +# for flow-portscan to work correctly. +# +# See README.flow for additional information +# +#preprocessor flow: stats_interval 0 hash 2 + +# frag3: Target-based IP defragmentation +# -------------------------------------- +# +# Frag3 is a brand new IP defragmentation preprocessor that is capable of +# performing "target-based" processing of IP fragments. Check out the +# README.frag3 file in the doc directory for more background and configuration +# information. +# +# Frag3 configuration is a two step process, a global initialization phase +# followed by the definition of a set of defragmentation engines. +# +# Global configuration defines the number of fragmented packets that Snort can +# track at the same time and gives you options regarding the memory cap for the +# subsystem or, optionally, allows you to preallocate all the memory for the +# entire frag3 system. +# +# frag3_global options: +# max_frags: Maximum number of frag trackers that may be active at once. +# Default value is 8192. +# memcap: Maximum amount of memory that frag3 may access at any given time. +# Default value is 4MB. +# prealloc_frags: Maximum number of individual fragments that may be processed +# at once. This is instead of the memcap system, uses static +# allocation to increase performance. No default value. Each +# preallocated fragment typically eats ~1550 bytes. However, +# the exact amount is determined by the snaplen, and this can +# go as high as 64K so beware! +# +# Target-based behavior is attached to an engine as a "policy" for handling +# overlaps and retransmissions as enumerated in the Paxson paper. There are +# currently five policy types available: "BSD", "BSD-right", "First", "Linux" +# and "Last". Engines can be bound to standard Snort CIDR blocks or +# IP lists. +# +# frag3_engine options: +# timeout: Amount of time a fragmented packet may be active before expiring. +# Default value is 60 seconds. +# ttl_limit: Limit of delta allowable for TTLs of packets in the fragments. +# Based on the initial received fragment TTL. +# min_ttl: Minimum acceptable TTL for a fragment, frags with TTLs below this +# value will be discarded. Default value is 0. +# detect_anomalies: Activates frag3's anomaly detection mechanisms. +# policy: Target-based policy to assign to this engine. Default is BSD. +# bind_to: IP address set to bind this engine to. Default is all hosts. +# +# Frag3 configuration example: +#preprocessor frag3_global: max_frags 65536, prealloc_frags 65536 +#preprocessor frag3_engine: policy linux \ +# bind_to [10.1.1.12/32,10.1.1.13/32] \ +# detect_anomalies +#preprocessor frag3_engine: policy first \ +# bind_to 10.2.1.0/24 \ +# detect_anomalies +#preprocessor frag3_engine: policy last \ +# bind_to 10.3.1.0/24 +#preprocessor frag3_engine: policy bsd + +preprocessor frag3_global: max_frags 65536 +preprocessor frag3_engine: policy first detect_anomalies + + +# stream4: stateful inspection/stream reassembly for Snort +#---------------------------------------------------------------------- +# Use in concert with the -z [all|est] command line switch to defeat stick/snot +# against TCP rules. Also performs full TCP stream reassembly, stateful +# inspection of TCP streams, etc. Can statefully detect various portscan +# types, fingerprinting, ECN, etc. + +# stateful inspection directive +# no arguments loads the defaults (timeout 30, memcap 8388608) +# options (options are comma delimited): +# detect_scans - stream4 will detect stealth portscans and generate alerts +# when it sees them when this option is set +# detect_state_problems - detect TCP state problems, this tends to be very +# noisy because there are a lot of crappy ip stack +# implementations out there +# +# disable_evasion_alerts - turn off the possibly noisy mitigation of +# overlapping sequences. +# +# ttl_limit [number] - differential of the initial ttl on a session versus +# the normal that someone may be playing games. +# Routing flap may cause lots of false positives. +# +# keepstats [machine|binary] - keep session statistics, add "machine" to +# get them in a flat format for machine reading, add +# "binary" to get them in a unified binary output +# format +# noinspect - turn off stateful inspection only +# timeout [number] - set the session timeout counter to [number] seconds, +# default is 30 seconds +# max_sessions [number] - limit the number of sessions stream4 keeps +# track of +# memcap [number] - limit stream4 memory usage to [number] bytes (does +# not include session tracking, which is set by the +# max_sessions option) +# log_flushed_streams - if an event is detected on a stream this option will +# cause all packets that are stored in the stream4 +# packet buffers to be flushed to disk. This only +# works when logging in pcap mode! +# server_inspect_limit [bytes] - Byte limit on server side inspection. +# enable_udp_sessions - turn on tracking of "sessions" over UDP. Requires +# configure --enable-stream4udp. UDP sessions are +# only created when there is a rule for the sender or +# responder that has a flow or flowbits keyword. +# max_udp_sessions [number] - limit the number of simultaneous UDP sessions +# to track +# udp_ignore_any - Do not inspect UDP packets unless there is a port specific +# rule for a given port. This is a performance improvement +# and turns off inspection for udp xxx any -> xxx any rules +# cache_clean_sessions [number] - Cleanup the session cache by number sessions +# at a time. The larger the value, the +# more sessions are purged from the cache when +# the session limit or memcap is reached. +# Defaults to 5. +# +# +# +# Stream4 uses Generator ID 111 and uses the following SIDS +# for that GID: +# SID Event description +# ----- ------------------- +# 1 Stealth activity +# 2 Evasive RST packet +# 3 Evasive TCP packet retransmission +# 4 TCP Window violation +# 5 Data on SYN packet +# 6 Stealth scan: full XMAS +# 7 Stealth scan: SYN-ACK-PSH-URG +# 8 Stealth scan: FIN scan +# 9 Stealth scan: NULL scan +# 10 Stealth scan: NMAP XMAS scan +# 11 Stealth scan: Vecna scan +# 12 Stealth scan: NMAP fingerprint scan stateful detect +# 13 Stealth scan: SYN-FIN scan +# 14 TCP forward overlap + +#preprocessor stream4: disable_evasion_alerts + +# tcp stream reassembly directive +# no arguments loads the default configuration +# Only reassemble the client, +# Only reassemble the default list of ports (See below), +# Give alerts for "bad" streams +# +# Available options (comma delimited): +# clientonly - reassemble traffic for the client side of a connection only +# serveronly - reassemble traffic for the server side of a connection only +# both - reassemble both sides of a session +# noalerts - turn off alerts from the stream reassembly stage of stream4 +# ports [list] - use the space separated list of ports in [list], "all" +# will turn on reassembly for all ports, "default" will turn +# on reassembly for ports 21, 23, 25, 42, 53, 80, 110, +# 111, 135, 136, 137, 139, 143, 445, 513, 514, 1433, 1521, +# 2401, and 3306 +# favor_old - favor an old segment (based on sequence number) over a new one. +# This is the default. +# favor_new - favor an new segment (based on sequence number) over an old one. +# overlap_limit [number] - limit on overlaping segments for a session. +# flush_on_alert - flushes stream when an alert is generated for a session. +# flush_behavior [mode] - +# default - use old static flushpoints (default) +# large_window - use new larger static flushpoints +# random - use random flushpoints defined by flush_base, +# flush_seed and flush_range +# flush_base [number] - lowest allowed random flushpoint (512 by default) +# flush_range [number] - number is the space within which random flushpoints +# are generated (default 1213) +# flush_seed [number] - seed for the random number generator, defaults to +# Snort PID + time +# +# Using the default random flushpoints, the smallest flushpoint is 512, +# and the largest is 1725 bytes. +#preprocessor stream4_reassemble + +# stream5: Target Based stateful inspection/stream reassembly for Snort +# --------------------------------------------------------------------- +# Stream5 is a target-based stream engine for Snort. Its functionality +# replaces that of Stream4. Consequently, BOTH Stream4 and Stream5 +# cannot be used simultaneously. Comment out the stream4 configurations +# above to use Stream5. +# +# See README.stream5 for details on the configuration options. +# +# Example config (that emulates Stream4 with UDP support compiled in) +preprocessor stream5_global: max_tcp 8192, track_tcp yes, \ + track_udp no +preprocessor stream5_tcp: policy first, use_static_footprint_sizes +# preprocessor stream5_udp: ignore_any_rules + + +# Performance Statistics +# ---------------------- +# Documentation for this is provided in the Snort Manual. You should read it. +# It is included in the release distribution as doc/snort_manual.pdf +# +# preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000 + +# http_inspect: normalize and detect HTTP traffic and protocol anomalies +# +# lots of options available here. See doc/README.http_inspect. +# unicode.map should be wherever your snort.conf lives, or given +# a full path to where snort can find it. +preprocessor http_inspect: global \ + iis_unicode_map unicode.map 1252 + +preprocessor http_inspect_server: server default \ + profile all ports { 80 8080 8180 } oversize_dir_length 500 + +# +# Example unique server configuration +# +#preprocessor http_inspect_server: server 1.1.1.1 \ +# ports { 80 3128 8080 } \ +# flow_depth 0 \ +# ascii no \ +# double_decode yes \ +# non_rfc_char { 0x00 } \ +# chunk_length 500000 \ +# non_strict \ +# oversize_dir_length 300 \ +# no_alerts + + +# rpc_decode: normalize RPC traffic +# --------------------------------- +# RPC may be sent in alternate encodings besides the usual 4-byte encoding +# that is used by default. This plugin takes the port numbers that RPC +# services are running on as arguments - it is assumed that the given ports +# are actually running this type of service. If not, change the ports or turn +# it off. +# The RPC decode preprocessor uses generator ID 106 +# +# arguments: space separated list +# alert_fragments - alert on any rpc fragmented TCP data +# no_alert_multiple_requests - don't alert when >1 rpc query is in a packet +# no_alert_large_fragments - don't alert when the fragmented +# sizes exceed the current packet size +# no_alert_incomplete - don't alert when a single segment +# exceeds the current packet size + +preprocessor rpc_decode: 111 32771 + +# bo: Back Orifice detector +# ------------------------- +# Detects Back Orifice traffic on the network. +# +# arguments: +# syntax: +# preprocessor bo: noalert { client | server | general | snort_attack } \ +# drop { client | server | general | snort_attack } +# example: +# preprocessor bo: noalert { general server } drop { snort_attack } +# +# +# The Back Orifice detector uses Generator ID 105 and uses the +# following SIDS for that GID: +# SID Event description +# ----- ------------------- +# 1 Back Orifice traffic detected +# 2 Back Orifice Client Traffic Detected +# 3 Back Orifice Server Traffic Detected +# 4 Back Orifice Snort Buffer Attack + +preprocessor bo + +# telnet_decode: Telnet negotiation string normalizer +# --------------------------------------------------- +# This preprocessor "normalizes" telnet negotiation strings from telnet and ftp +# traffic. It works in much the same way as the http_decode preprocessor, +# searching for traffic that breaks up the normal data stream of a protocol and +# replacing it with a normalized representation of that traffic so that the +# "content" pattern matching keyword can work without requiring modifications. +# This preprocessor requires no arguments. +# +# DEPRECATED in favor of ftp_telnet dynamic preprocessor +#preprocessor telnet_decode +# +# ftp_telnet: FTP & Telnet normalizer, protocol enforcement and buff overflow +# --------------------------------------------------------------------------- +# This preprocessor normalizes telnet negotiation strings from telnet and +# ftp traffic. It looks for traffic that breaks the normal data stream +# of the protocol, replacing it with a normalized representation of that +# traffic so that the "content" pattern matching keyword can work without +# requiring modifications. +# +# It also performs protocol correctness checks for the FTP command channel, +# and identifies open FTP data transfers. +# +# FTPTelnet has numerous options available, please read +# README.ftptelnet for help configuring the options for the global +# telnet, ftp server, and ftp client sections for the protocol. + +##### +# Per Step #2, set the following to load the ftptelnet preprocessor +# dynamicpreprocessor file +# or use commandline option +# --dynamic-preprocessor-lib + +preprocessor ftp_telnet: global \ + encrypted_traffic yes \ + inspection_type stateful + +preprocessor ftp_telnet_protocol: telnet \ + normalize \ + ayt_attack_thresh 200 + +# This is consistent with the FTP rules as of 18 Sept 2004. +# CWD can have param length of 200 +# MODE has an additional mode of Z (compressed) +# Check for string formats in USER & PASS commands +# Check nDTM commands that set modification time on the file. +preprocessor ftp_telnet_protocol: ftp server default \ + def_max_param_len 100 \ + alt_max_param_len 200 { CWD } \ + cmd_validity MODE < char ASBCZ > \ + cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \ + chk_str_fmt { USER PASS RNFR RNTO SITE MKD } \ + telnet_cmds yes \ + data_chan + +preprocessor ftp_telnet_protocol: ftp client default \ + max_resp_len 256 \ + bounce yes \ + telnet_cmds yes + +# smtp: SMTP normalizer, protocol enforcement and buffer overflow +# --------------------------------------------------------------------------- +# This preprocessor normalizes SMTP commands by removing extraneous spaces. +# It looks for overly long command lines, response lines, and data header lines. +# It can alert on invalid commands, or specific valid commands. It can optionally +# ignore mail data, and can ignore TLS encrypted data. +# +# SMTP has numerous options available, please read README.SMTP for help +# configuring options. + +##### +# Per Step #2, set the following to load the smtp preprocessor +# dynamicpreprocessor file +# or use commandline option +# --dynamic-preprocessor-lib + +preprocessor smtp: \ + ports { 25 587 691 } \ + inspection_type stateful \ + normalize cmds \ + normalize_cmds { EXPN VRFY RCPT } \ + alt_max_command_line_len 260 { MAIL } \ + alt_max_command_line_len 300 { RCPT } \ + alt_max_command_line_len 500 { HELP HELO ETRN } \ + alt_max_command_line_len 255 { EXPN VRFY } + +# sfPortscan +# ---------- +# Portscan detection module. Detects various types of portscans and +# portsweeps. For more information on detection philosophy, alert types, +# and detailed portscan information, please refer to the README.sfportscan. +# +# -configuration options- +# proto { tcp udp icmp ip all } +# The arguments to the proto option are the types of protocol scans that +# the user wants to detect. Arguments should be separated by spaces and +# not commas. +# scan_type { portscan portsweep decoy_portscan distributed_portscan all } +# The arguments to the scan_type option are the scan types that the +# user wants to detect. Arguments should be separated by spaces and not +# commas. +# sense_level { low|medium|high } +# There is only one argument to this option and it is the level of +# sensitivity in which to detect portscans. The 'low' sensitivity +# detects scans by the common method of looking for response errors, such +# as TCP RSTs or ICMP unreachables. This level requires the least +# tuning. The 'medium' sensitivity level detects portscans and +# filtered portscans (portscans that receive no response). This +# sensitivity level usually requires tuning out scan events from NATed +# IPs, DNS cache servers, etc. The 'high' sensitivity level has +# lower thresholds for portscan detection and a longer time window than +# the 'medium' sensitivity level. Requires more tuning and may be noisy +# on very active networks. However, this sensitivity levels catches the +# most scans. +# memcap { positive integer } +# The maximum number of bytes to allocate for portscan detection. The +# higher this number the more nodes that can be tracked. +# logfile { filename } +# This option specifies the file to log portscan and detailed portscan +# values to. If there is not a leading /, then snort logs to the +# configured log directory. Refer to README.sfportscan for details on +# the logged values in the logfile. +# watch_ip { Snort IP List } +# ignore_scanners { Snort IP List } +# ignore_scanned { Snort IP List } +# These options take a snort IP list as the argument. The 'watch_ip' +# option specifies the IP(s) to watch for portscan. The +# 'ignore_scanners' option specifies the IP(s) to ignore as scanners. +# Note that these hosts are still watched as scanned hosts. The +# 'ignore_scanners' option is used to tune alerts from very active +# hosts such as NAT, nessus hosts, etc. The 'ignore_scanned' option +# specifies the IP(s) to ignore as scanned hosts. Note that these hosts +# are still watched as scanner hosts. The 'ignore_scanned' option is +# used to tune alerts from very active hosts such as syslog servers, etc. +# detect_ack_scans +# This option will include sessions picked up in midstream by the stream +# module, which is necessary to detect ACK scans. However, this can lead to +# false alerts, especially under heavy load with dropped packets; which is why +# the option is off by default. +# +preprocessor sfportscan: proto { all } \ + memcap { 10000000 } \ + sense_level { low } + +# arpspoof +#---------------------------------------- +# Experimental ARP detection code from Jeff Nathan, detects ARP attacks, +# unicast ARP requests, and specific ARP mapping monitoring. To make use of +# this preprocessor you must specify the IP and hardware address of hosts on +# the same layer 2 segment as you. Specify one host IP MAC combo per line. +# Also takes a "-unicast" option to turn on unicast ARP request detection. +# Arpspoof uses Generator ID 112 and uses the following SIDS for that GID: + +# SID Event description +# ----- ------------------- +# 1 Unicast ARP request +# 2 Etherframe ARP mismatch (src) +# 3 Etherframe ARP mismatch (dst) +# 4 ARP cache overwrite attack + +#preprocessor arpspoof +#preprocessor arpspoof_detect_host: 192.168.40.1 f0:0f:00:f0:0f:00 + +# ssh +#---------------------------------------- +# EXPERIMENTAL CODE!!! +# +# THIS CODE IS STILL EXPERIMENTAL AND MAY OR MAY NOT BE STABLE! +# USE AT YOUR OWN RISK! DO NOT USE IN PRODUCTION ENVIRONMENTS. +# YOU HAVE BEEN WARNED. +# +# The SSH preprocessor detects the following exploits: Gobbles, CRC 32, +# Secure CRT, and the Protocol Mismatch exploit. +# +# Both Gobbles and CRC 32 attacks occur after the key exchange, and are +# therefore encrypted. Both attacks involve sending a large payload +# (20kb+) to the server immediately after the authentication challenge. +# To detect the attacks, the SSH preprocessor counts the number of bytes +# transmitted to the server. If those bytes exceed a pre-defined limit +# within a pre-define number of packets, an alert is generated. Since +# Gobbles only effects SSHv2 and CRC 32 only effects SSHv1, the SSH +# version string exchange is used to distinguish the attacks. +# +# The Secure CRT and protocol mismatch exploits are observable before +# the key exchange. +# +# SSH has numerous options available, please read README.ssh for help +# configuring options. + +##### +# Per Step #2, set the following to load the ssh preprocessor +# dynamicpreprocessor file +# or use commandline option +# --dynamic-preprocessor-lib +# +#preprocessor ssh: server_ports { 22 } \ +# max_client_bytes 19600 \ +# max_encrypted_packets 20 + +# DCE/RPC +#---------------------------------------- +# +# The dcerpc preprocessor detects and decodes SMB and DCE/RPC traffic. +# It is primarily interested in DCE/RPC data, and only decodes SMB +# to get at the DCE/RPC data carried by the SMB layer. +# +# Currently, the preprocessor only handles reassembly of fragmentation +# at both the SMB and DCE/RPC layer. Snort rules can be evaded by +# using both types of fragmentation; with the preprocessor enabled +# the rules are given a buffer with a reassembled SMB or DCE/RPC +# packet to examine. +# +# At the SMB layer, only fragmentation using WriteAndX is currently +# reassembled. Other methods will be handled in future versions of +# the preprocessor. +# +# Autodetection of SMB is done by looking for "\xFFSMB" at the start of +# the SMB data, as well as checking the NetBIOS header (which is always +# present for SMB) for the type "SMB Session". +# +# Autodetection of DCE/RPC is not as reliable. Currently, two bytes are +# checked in the packet. Assuming that the data is a DCE/RPC header, +# one byte is checked for DCE/RPC version (5) and another for the type +# "DCE/RPC Request". If both match, the preprocessor proceeds with that +# assumption that it is looking at DCE/RPC data. If subsequent checks +# are nonsensical, it ends processing. +# +# DCERPC has numerous options available, please read README.dcerpc for help +# configuring options. + +##### +# Per Step #2, set the following to load the dcerpc preprocessor +# dynamicpreprocessor file +# or use commandline option +# --dynamic-preprocessor-lib + +preprocessor dcerpc: \ + autodetect \ + max_frag_size 3000 \ + memcap 100000 + +# DNS +#---------------------------------------- +# The dns preprocessor (currently) decodes DNS Response traffic +# and detects a few vulnerabilities. +# +# DNS has a few options available, please read README.dns for +# help configuring options. + +##### +# Per Step #2, set the following to load the dns preprocessor +# dynamicpreprocessor file +# or use commandline option +# --dynamic-preprocessor-lib + +preprocessor dns: \ + ports { 53 } \ + enable_rdata_overflow + +# SSL +#---------------------------------------- +# Encrypted traffic should be ignored by Snort for both performance reasons +# and to reduce false positives. The SSL Dynamic Preprocessor (SSLPP) +# inspects SSL traffic and optionally determines if and when to stop +# inspection of it. +# +# Typically, SSL is used over port 443 as HTTPS. By enabling the SSLPP to +# inspect port 443, only the SSL handshake of each connection will be +# inspected. Once the traffic is determined to be encrypted, no further +# inspection of the data on the connection is made. +# +# Important note: Stream4 or Stream5 should be explicitly told to reassemble +# traffic on the ports that you intend to inspect SSL +# encrypted traffic on. +# +# To add reassembly on port 443 to Stream5, use 'port both 443' in the +# Stream5 configuration. + +preprocessor ssl: noinspect_encrypted + + +#################################################################### +# Step #4: Configure output plugins +# +# Uncomment and configure the output plugins you decide to use. General +# configuration for output plugins is of the form: +# +# output : +# +# alert_syslog: log alerts to syslog +# ---------------------------------- +# Use one or more syslog facilities as arguments. Win32 can also optionally +# specify a particular hostname/port. Under Win32, the default hostname is +# '127.0.0.1', and the default port is 514. +# +# [Unix flavours should use this format...] +# output alert_syslog: LOG_AUTH LOG_ALERT +# +# [Win32 can use any of these formats...] +# output alert_syslog: LOG_AUTH LOG_ALERT +# output alert_syslog: host=hostname, LOG_AUTH LOG_ALERT +# output alert_syslog: host=hostname:port, LOG_AUTH LOG_ALERT + +# log_tcpdump: log packets in binary tcpdump format +# ------------------------------------------------- +# The only argument is the output file name. +# +# output log_tcpdump: tcpdump.log + +# database: log to a variety of databases +# --------------------------------------- +# See the README.database file for more information about configuring +# and using this plugin. +# +# output database: log, mysql, user=root password=test dbname=db host=localhost +# output database: alert, postgresql, user=snort dbname=snort +# output database: log, odbc, user=snort dbname=snort +# output database: log, mssql, dbname=snort user=snort password=test +# output database: log, oracle, dbname=snort user=snort password=test + +# unified: Snort unified binary format alerting and logging +# ------------------------------------------------------------- +# The unified output plugin provides two new formats for logging and generating +# alerts from Snort, the "unified" format. The unified format is a straight +# binary format for logging data out of Snort that is designed to be fast and +# efficient. Used with barnyard (the new alert/log processor), most of the +# overhead for logging and alerting to various slow storage mechanisms such as +# databases or the network can now be avoided. +# +# Check out the spo_unified.h file for the data formats. +# +# Two arguments are supported. +# filename - base filename to write to (current time_t is appended) +# limit - maximum size of spool file in MB (default: 128) +# +# output alert_unified: filename snort.alert, limit 128 +# output log_unified: filename snort.log, limit 128 + + +# prelude: log to the Prelude Hybrid IDS system +# --------------------------------------------- +# +# profile = Name of the Prelude profile to use (default is snort). +# +# Snort priority to IDMEF severity mappings: +# high < medium < low < info +# +# These are the default mapped from classification.config: +# info = 4 +# low = 3 +# medium = 2 +# high = anything below medium +# +# output alert_prelude +# output alert_prelude: profile=snort-profile-name + + +# You can optionally define new rule types and associate one or more output +# plugins specifically to that type. +# +# This example will create a type that will log to just tcpdump. +# ruletype suspicious +# { +# type log +# output log_tcpdump: suspicious.log +# } +# +# EXAMPLE RULE FOR SUSPICIOUS RULETYPE: +# suspicious tcp $HOME_NET any -> $HOME_NET 6667 (msg:"Internal IRC Server";) +# +# This example will create a rule type that will log to syslog and a mysql +# database: +# ruletype redalert +# { +# type alert +# output alert_syslog: LOG_AUTH LOG_ALERT +# output database: log, mysql, user=snort dbname=snort host=localhost +# } +# +# EXAMPLE RULE FOR REDALERT RULETYPE: +# redalert tcp $HOME_NET any -> $EXTERNAL_NET 31337 \ +# (msg:"Someone is being LEET"; flags:A+;) + +# +# Include classification & priority settings +# Note for Windows users: You are advised to make this an absolute path, +# such as: c:\snort\etc\classification.config +# + +include classification.config + +# +# Include reference systems +# Note for Windows users: You are advised to make this an absolute path, +# such as: c:\snort\etc\reference.config +# + +include reference.config + +#################################################################### +# Step #5: Configure snort with config statements +# +# See the snort manual for a full set of configuration references +# +# config flowbits_size: 64 +# +# New global ignore_ports config option from Andy Mullican +# +# config ignore_ports: +# config ignore_ports: tcp 21 6667:6671 1356 +# config ignore_ports: udp 1:17 53 + + +#################################################################### +# Step #6: Customize your rule set +# +# Up to date snort rules are available at http://www.snort.org +# +# The snort web site has documentation about how to write your own custom snort +# rules. + +#========================================= +# Include all relevant rulesets here +# +# The following rulesets are disabled by default: +# +# web-attacks, backdoor, shellcode, policy, porn, info, icmp-info, virus, +# chat, multimedia, and p2p +# +# These rules are either site policy specific or require tuning in order to not +# generate false positive alerts in most enviornments. +# +# Please read the specific include file for more information and +# README.alert_order for how rule ordering affects how alerts are triggered. +#========================================= + +include $RULE_PATH/community-bot.rules +include $RULE_PATH/community-deleted.rules +include $RULE_PATH/community-dos.rules +include $RULE_PATH/community-exploit.rules +include $RULE_PATH/community-ftp.rules +include $RULE_PATH/community-game.rules +include $RULE_PATH/community-icmp.rules +include $RULE_PATH/community-imap.rules +include $RULE_PATH/community-inappropriate.rules +include $RULE_PATH/community-mail-client.rules +include $RULE_PATH/community-misc.rules +include $RULE_PATH/community-nntp.rules +include $RULE_PATH/community-oracle.rules +include $RULE_PATH/community-policy.rules +include $RULE_PATH/community-sip.rules +include $RULE_PATH/community-smtp.rules +include $RULE_PATH/community-sql-injection.rules +include $RULE_PATH/community-virus.rules +include $RULE_PATH/community-web-attacks.rules +include $RULE_PATH/community-web-cgi.rules +include $RULE_PATH/community-web-client.rules +include $RULE_PATH/community-web-dos.rules +include $RULE_PATH/community-web-iis.rules +include $RULE_PATH/community-web-misc.rules +include $RULE_PATH/community-web-php.rules + +# include $PREPROC_RULE_PATH/preprocessor.rules +# include $PREPROC_RULE_PATH/decoder.rules + +# Include any thresholding or suppression commands. See threshold.conf in the +# /etc directory for details. Commands don't necessarily need to be +# contained in this conf, but a separate conf makes it easier to maintain them. +# Note for Windows users: You are advised to make this an absolute path, +# such as: c:\snort\etc\threshold.conf +# Uncomment if needed. +# include threshold.conf diff --git a/snort-createmysql b/snort-createmysql new file mode 100644 index 0000000..3711957 --- /dev/null +++ b/snort-createmysql @@ -0,0 +1,11 @@ +#!/bin/bash +mysqladmin create snort +cat << EOF | mysql -u root snort +grant INSERT,SELECT on root.* to snort@localhost; +SET PASSWORD FOR snort@localhost=PASSWORD('$1'); +grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort@localhost; +grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort.* to snort; +exit +EOF +mysql -u root < /usr/share/snort/contrib/create_mysql snort +bzcat /usr/share/snort/contrib/snortdb-extra.bz2 | mysql -u snort --password="$1" snort diff --git a/snort-createmysql-archive b/snort-createmysql-archive new file mode 100644 index 0000000..3a3be8e --- /dev/null +++ b/snort-createmysql-archive @@ -0,0 +1,11 @@ +#!/bin/bash +mysqladmin create snort_archive +cat << EOF | mysql -u root snort_archive +grant INSERT,SELECT on root.* to snort@localhost; +SET PASSWORD FOR snort@localhost=PASSWORD('$1'); +grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort_archive.* to snort@localhost; +grant CREATE,INSERT,SELECT,DELETE,UPDATE on snort_archive.* to snort; +exit +EOF +mysql -u root < /usr/share/snort/contrib/create_mysql snort_archive +bzcat /usr/share/snort/contrib/snortdb-extra.bz2 | mysql -u snort --password="$1" snort_archive diff --git a/snort-initscript b/snort-initscript new file mode 100644 index 0000000..0ea6700 --- /dev/null +++ b/snort-initscript @@ -0,0 +1,59 @@ +#! /bin/bash +# +# snort - Snort intrusion detection system loader +# This starts and stops the snort service +# +# Copyright (c) 2003 by Silvan Calarco +# Copyright (c) 2003 by Davide Madrisan +# +# description: snort loader +# chkconfig: 2345 60 80 + +source /etc/sysconfig/rc +source $rc_functions +source /etc/sysconfig/network +[ -f /etc/sysconfig/snort ] && source /etc/sysconfig/snort + +case "$1" in + start) + intstring="" + [ -z "$SNORT_INTERFACES" ] && SNORT_INTERFACES=`grep -il "ONBOOT=yes" $network_devices/ifconfig.* 2>/dev/null` + for file in $SNORT_INTERFACES; do + interface="`echo $file | sed s/.*ifconfig\.// 2>/dev/null`" + intstring="-i $interface" + echo -n "Starting snort on interface $interface: " + daemon snort -u snort -b -D -c /etc/snort/snort.conf $intstring + evaluate_retval + echo + done + ;; + + stop) + echo -n "Stopping snort: " + killproc snort + evaluate_retval + echo + ;; + + reload) + echo -n "Reloading snort config file: " + reloadproc snort 1 + evaluate_retval + echo + ;; + + restart) + $0 stop + sleep 1 + $0 start + ;; + + status) + statusproc snort + ;; + + *) + echo "Usage: $0 {start|stop|reload|restart|status}" + exit 1 + ;; +esac diff --git a/snort-sysconfig b/snort-sysconfig new file mode 100644 index 0000000..50437e8 --- /dev/null +++ b/snort-sysconfig @@ -0,0 +1,6 @@ +# snort service configuration +# +# Snort is started by deafult on all active interfaces +# use SNORT_INTERFACES to specify the interfaces you want snort to bind on + +#SNORT_INTERFACES="eth1 eth3" diff --git a/snort.spec b/snort.spec new file mode 100644 index 0000000..d0d20ab --- /dev/null +++ b/snort.spec @@ -0,0 +1,386 @@ +%define enable_mysql 1 +%define enable_odbc 0 +%define enable_postgresql 0 +%define groupid 65023 +%define userid 65023 + +Name: snort +Version: 2.9.6.1 +Release: 1mamba +Summary: The Open Source Intrusion Detection System +Group: Network/Monitoring +Vendor: openmamba +Distribution: openmamba +Packager: Silvan Calarco +URL: http://www.snort.org +# 2.8.6.1: no direct link working; downloaded by hand +Source0: http://www.snort.org/dl/snort-current/%{name}-%{version}.tar.gz +Source1: snort-initscript +Source2: snort-sysconfig +Source3: snort-createmysql +Source4: snort-createmysql-archive +#Source5: http://www.snort.org/dl/contrib/... +Source5: snortdb-extra.bz2 +Source6: http://www.snort.org/pub-bin/downloads.cgi/Download/comm_rules/Community-Rules-CURRENT.tar.gz +Source7: snort-conf +License: GPL +%if %enable_mysql +BuildRequires: libmysql5-devel +%endif +%if %enable_odbc +Requires: libodbc >= 2.2.6 +BuildRequires: libodbc-devel >= 2.2.6 +%endif +%if %enable_postgresql +Requires: postgresql >= 7.3.3 +BuildRequires: postgresql-devel >= 7.4-2 +%endif +## AUTOBUILDREQ-BEGIN +BuildRequires: glibc-devel +BuildRequires: libmysql5-devel +BuildRequires: libopenssl-devel +BuildRequires: libpcap-devel +BuildRequires: libpcre-devel +BuildRequires: libz-devel +BuildRequires: mysql +BuildRequires: mysql-client +## AUTOBUILDREQ-END +BuildRequires: libdnet-devel +BuildRequires: libdaq-devel +BuildRoot: %{_tmppath}/%{name}-%{version}-build +Provides: %{_datadir}/snort/contrib/createmysql +Provides: %{_datadir}/snort/contrib/createmysql-archive + +%description +Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. +It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. +Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture. +Snort has a real-time alerting capability as well, incorporating alerting mechanisms for syslog, a user specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient. + +Snort has three primary uses. +It can be used as a straight packet sniffer like tcpdump(1), a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion detection system. + +%package devel +Summary: Static libraries, headers and source files for development with %{name} +Group: Development/Applications +Requires: %{name} = %{version}-%{release} + +%description devel +Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. +It can perform protocol analysis, content searching/matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more. +Snort uses a flexible rules language to describe traffic that it should collect or pass, as well as a detection engine that utilizes a modular plugin architecture. +Snort has a real-time alerting capability as well, incorporating alerting mechanisms for syslog, a user specified file, a UNIX socket, or WinPopup messages to Windows clients using Samba's smbclient. + +Snort has three primary uses. +It can be used as a straight packet sniffer like tcpdump(1), a packet logger (useful for network traffic debugging, etc), or as a full blown network intrusion detection system. + +This package contains the static libraries, headers and source files for development. + +%prep +%setup -q -a6 +sed -i "s|/usr/local|/usr|" etc/snort.conf + +%build +%configure \ + -sysconfdir=%{_sysconfdir}/snort \ + --enable-linux-smp-stat \ + --enable-smbalerts \ +%if %enable_mysql + --with-mysql \ +%else + --without-mysql --disable-mysql \ +%endif +%if %enable_odbc + --with-odbc \ +%endif +%if %enable_postgresql + --with-postgresql \ +%endif +# --enable-sourcefire +# --enable-perfmonitor +# --enable-flexresp + +%make -j1 + +%install +[ "%{buildroot}" != / ] && rm -rf %{buildroot} +%makeinstall + +install -d %{buildroot}%{_sysconfdir}/snort/{rules,preproc_rules} +cp rules/*.rules %{buildroot}%{_sysconfdir}/snort/rules/ +cp preproc_rules/*.rules %{buildroot}%{_sysconfdir}/snort/preproc_rules/ + +cp etc/*.conf etc/*.config etc/*.map %{buildroot}%{_sysconfdir}/snort + +install -D -m 755 %{SOURCE1} %{buildroot}%{_initrddir}/snort +install -D -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/snort + +install -d %{buildroot}/var/log/snort + +install -D %{SOURCE3} %{buildroot}%{_datadir}/snort/contrib/createmysql +install -D %{SOURCE4} %{buildroot}%{_datadir}/snort/contrib/createmysql-archive + +install -D %{SOURCE7} %{buildroot}%{_sysconfdir}/snort/snort.conf + +#cp contrib/create* contrib/snortdb-extra.bz2 %{buildroot}%{_datadir}/snort/contrib/ +cp %{SOURCE5} %{buildroot}%{_datadir}/snort/contrib/ +#cp schemas/create_* %{buildroot}%{_datadir}/snort/contrib/ + +%pre +/usr/sbin/groupadd snort -g %{groupid} 2>/dev/null +/usr/sbin/useradd -u %{userid} -c 'Snort user' -d /dev/null -g snort \ + -s /bin/false snort 2>/dev/null +exit 0 + +%post +# new install +if [ $1 -eq 1 ]; then + RANDOM_PASSWD=`/usr/bin/mkpasswd -l 10 -s 0` + sed -i "s|# output database: log, mysql.*|output database: log, mysql, user=snort password=$RANDOM_PASSWD dbname=snort host=localhost|" \ + %{_sysconfdir}/snort/snort.conf + %{_datadir}/snort/contrib/createmysql $RANDOM_PASSWD + %{_datadir}/snort/contrib/createmysql-archive $RANDOM_PASSWD +fi +exit 0 + +%preun +# erase +if [ $1 -eq 0 ]; then + service snort stop 2>/dev/null + /sbin/chkconfig --del snort + /usr/sbin/userdel snort 2>/dev/null +fi +exit 0 + +%postun +# update +if [ $1 -eq 1 ]; then + groupadd snort -g %{groupid} 2>/dev/null + /usr/sbin/useradd -u %{userid} -c 'Snort user' -d /dev/null -g snort \ + -s /bin/false snort 2>/dev/null + /sbin/chkconfig snort + [ $? -eq 0 ] && service snort restart +fi +exit 0 + +%clean +[ "%{buildroot}" != / ] && rm -rf %{buildroot} + +%files +%defattr(-,root,root) +%config(noreplace) %{_sysconfdir}/snort/snort.conf +%config %{_sysconfdir}/snort/file_magic.conf +%config(noreplace) %{_sysconfdir}/snort/threshold.conf +%config(noreplace) %{_sysconfdir}/snort/classification.config +%config(noreplace) %{_sysconfdir}/snort/reference.config +%config(noreplace) %{_sysconfdir}/sysconfig/snort +%{_sysconfdir}/snort/rules/* +%{_sysconfdir}/snort/preproc_rules/* +%{_sysconfdir}/snort/*.map +%{_bindir}/u2boat +%{_bindir}/u2spewfoo +%{_bindir}/snort +%dir %{_prefix}/lib/snort_dynamicengine +%{_prefix}/lib/snort_dynamicengine/libsf_engine.a +%{_prefix}/lib/snort_dynamicengine/libsf_engine.la +%{_prefix}/lib/snort_dynamicengine/libsf_engine.so +%{_prefix}/lib/snort_dynamicengine/libsf_engine.so.* +%dir %{_prefix}/lib/snort_dynamicpreprocessor +%{_prefix}/lib/snort_dynamicpreprocessor/*.a +%{_prefix}/lib/snort_dynamicpreprocessor/*.la +%{_prefix}/lib/snort_dynamicpreprocessor/*.so* +%dir %{_libdir}/snort/dynamic_output/ +%{_libdir}/snort/dynamic_output/libsf_dynamic_output.a +%{_libdir}/snort/dynamic_output/libsf_dynamic_output.la +%dir %{_libdir}/snort/dynamic_preproc +%{_libdir}/snort/dynamic_preproc/libsf_dynamic_preproc.a +%{_libdir}/snort/dynamic_preproc/libsf_dynamic_preproc.la +%dir %{_datadir}/snort +%dir %{_datadir}/snort/contrib +%{_datadir}/snort/contrib/* +%attr(755,root,root) %{_initrddir}/snort +%dir %attr(755,snort,snort) /var/log/snort +%{_datadir}/doc/snort/* +%{_mandir}/man8/* +%doc ChangeLog doc/AUTHORS doc/CREDITS +%doc doc/snort_manual.* + +%files devel +%defattr(-,root,root) +%{_prefix}/src/snort_dynamicsrc/*.h +%{_prefix}/src/snort_dynamicsrc/*.c +%dir %{_includedir}/snort +%{_includedir}/snort/* +%{_libdir}/pkgconfig/snort.pc +%{_libdir}/pkgconfig/snort_preproc.pc +%{_libdir}/pkgconfig/snort_output.pc +%doc doc/{BUGS,CREDITS,NEWS,README*,TODO,USAGE} + +%changelog +* Thu Apr 24 2014 Automatic Build System 2.9.6.1-1mamba +- automatic version update by autodist + +* Sun Feb 02 2014 Automatic Build System 2.9.6.0-1mamba +- automatic version update by autodist + +* Tue Nov 19 2013 Automatic Build System 2.9.5.6-1mamba +- automatic version update by autodist + +* Tue Sep 17 2013 Automatic Build System 2.9.5.5-1mamba +- automatic version update by autodist + +* Wed Jul 31 2013 Automatic Build System 2.9.5.3-1mamba +- automatic version update by autodist + +* Tue Jul 02 2013 Automatic Build System 2.9.5-1mamba +- automatic version update by autodist + +* Thu Apr 25 2013 Automatic Build System 2.9.4.6-1mamba +- automatic version update by autodist + +* Thu Apr 04 2013 Automatic Build System 2.9.4.5-1mamba +- automatic version update by autodist + +* Wed Mar 06 2013 Automatic Build System 2.9.4.1-1mamba +- automatic version update by autodist + +* Tue Dec 04 2012 Automatic Build System 2.9.4-1mamba +- automatic version update by autodist + +* Thu Aug 09 2012 Automatic Build System 2.9.3.1-1mamba +- automatic version update by autodist + +* Sun Jul 22 2012 Automatic Build System 2.9.3-1mamba +- automatic version update by autodist + +* Wed May 16 2012 Automatic Build System 2.9.2.3-1mamba +- automatic version update by autodist + +* Wed Mar 28 2012 Automatic Build System 2.9.2.2-1mamba +- automatic version update by autodist + +* Fri Jan 20 2012 Automatic Build System 2.9.2.1-1mamba +- automatic version update by autodist + +* Thu Dec 22 2011 Automatic Build System 2.9.2-1mamba +- automatic version update by autodist + +* Thu Oct 20 2011 Automatic Build System 2.9.1.2-1mamba +- automatic version update by autodist + +* Fri Oct 07 2011 Automatic Build System 2.9.1.1-1mamba +- automatic version update by autodist + +* Thu Aug 25 2011 Automatic Build System 2.9.1-1mamba +- automatic version update by autodist + +* Thu Apr 07 2011 Automatic Build System 2.9.0.5-1mamba +- automatic update by autodist + +* Sat Feb 19 2011 Automatic Build System 2.9.0.4-1mamba +- update to 2.9.0.4 + +* Mon Jul 26 2010 Automatic Build System 2.8.6.1-1mamba +- update to 2.8.6.1 + +* Sat May 08 2010 Automatic Build System 2.8.6-1mamba +- automatic update to 2.8.6 by autodist + +* Thu Feb 18 2010 Automatic Build System 2.8.5.3-1mamba +- automatic update to 2.8.5.3 by autodist + +* Thu Dec 31 2009 Automatic Build System 2.8.5.2-1mamba +- automatic update to 2.8.5.2 by autodist + +* Sun Oct 25 2009 Automatic Build System 2.8.5.1-1mamba +- automatic update to 2.8.5.1 by autodist + +* Tue Sep 29 2009 Automatic Build System 2.8.5-1mamba +- update to 2.8.5 + +* Tue Apr 28 2009 Automatic Build System 2.8.4.1-1mamba +- automatic update to 2.8.4.1 by autodist + +* Wed Apr 08 2009 Silvan Calarco 2.8.4-1mamba +- automatic update to 2.8.4 by autodist + +* Sat Jan 17 2009 Silvan Calarco 2.8.3.2-1mamba +- automatic update to 2.8.3.2 by autodist + +* Thu Oct 02 2008 Silvan Calarco 2.8.3.1-1mamba +- automatic update to 2.8.3.1 by autodist + +* Sat Sep 06 2008 Silvan Calarco 2.8.3-1mamba +- update to 2.8.3 + +* Sun Aug 31 2008 Silvan Calarco 2.8.2.2-2mamba +- fix requirements in post script + +* Sun Aug 24 2008 gil 2.8.2.2-1mamba +- update to 2.8.2.2 + +* Wed Jun 18 2008 Silvan Calarco 2.8.2.1-1mamba +- update to 2.8.2.1 + +* Fri Jul 08 2005 Davide Madrisan 2.3.3-3qilnx +- rebuilt with new libpcap libraries + +* Thu Jul 07 2005 Davide Madrisan 2.3.3-2qilnx +- fixed %%pre script + +* Mon May 02 2005 Davide Madrisan 2.3.3-1qilnx +- update to version 2.3.3 by autospec +- new source `snortdb-extra.bz2' + see http://cvs.snort.org/viewcvs.cgi/snort/contrib/Attic/snortdb-extra.gz +- fixed group for used snort + +* Fri Dec 31 2004 Silvan Calarco 2.2.0-1qilnx +- update to version 2.2.0 by autospec + +* Tue Oct 05 2004 Silvan Calarco 2.1.3-5qilnx +- added creation of snort-archive database + +* Sat Jun 05 2004 Silvan Calarco 2.1.3-4qilnx +- start daemon without "-A fast" otherwise it won't log to database + +* Tue Jun 04 2004 Silvan Calarco 2.1.3-3qilnx +- completed db creation with snortdb-extra.gz + +* Tue Jun 04 2004 Silvan Calarco 2.1.3-2qilnx +- reconfigured with mysql database creation on install +- now runs with its own user and group (snort) + +* Thu Jun 03 2004 Silvan Calarco 2.1.3-1qilnx +- new version build + +* Thu Apr 01 2004 Davide Madrisan 2.1.2-1qilnx +- new version rebuild + +* Tue Mar 02 2004 Davide Madrisan 2.1.1-2qilnx +- RPM group modified; postun scriptlet fixed + +* Mon Mar 01 2004 Davide Madrisan 2.1.1-1qilnx +- rebuilt with version 2.1.1 +- minor specfile cleanups + +* Tue Dec 30 2003 Davide Madrisan 2.1.0-1qilnx +- rebuilt with version 2.1.0 + enabled support for mysql, postgresql, odbc + +* Fri Nov 21 2003 Davide Madrisan 2.0.5-1qilnx +- rebuilt with version 2.0.5 + +* Fri Nov 07 2003 Davide Madrisan 2.0.4-1qilnx +- rebuilt with version 2.0.4 + +* Wed Nov 05 2003 Davide Madrisan 2.0.3-1qilnx +- rebuilt with version 2.0.3 + +* Fri Sep 19 2003 Davide Madrisan 2.0.2-1qilnx +- rebuid using snort 2.0.2 +- some interesting optional features enabled (via configure options): + SMB alerting via Samba, statistics reporting through proc. + flexible responses on hostile connection attempts not yet enabled. + +* Tue Jun 18 2003 Silvan Calarco 2.0.0-1qilnx +- first build for snort diff --git a/snortdb-extra.bz2 b/snortdb-extra.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..753691b2edd621a2171379944ae6915cfb3b552e GIT binary patch literal 163576 zcmbrm2|SeB|2Y1L(uR9mB!pWNNfZ*YwrXT48nPFntT7mj?Y1wL43fRFWo(r###mY` z*^+fIGZMx+Lzcmy|9OV$-ut}r!SQxrhZ#f_6~_W!%f=bFG zXkCn?q$GHNK5ev3iNrArLO4)23DJ3(8X ze&X!k32|#mX>NozUWK-O;y50}vHSK}F`g~Zw)2m`7S{4W&^`{XXZkZIYyLdEe#8Ao zpSWfeBqEwMzr_fu>7V1q`6h07;d}eS;-~I5up`46g+pA2IAjm4krj9XaU5D-`}DrV z_tgD@4pE3-7=boi_}-ea=h*4iMDg?yhs5*|{kC->>jZxfFIWfg#E~W*l=326f2(GC z_JVQ0qoZgu^nu;tHX!`(=tt9obYcS8f`<@4#d z!^;L2yR0`LzRMgOJF@iJ+(%Jgf~SRHIXU`5XuBkD$?PWWM3-V}!+DHy`CwBmVSX{N zdiuK-x_yQcC{7*v`p`~XY!)l-uljuEU6P1GO_WD_a)?OCdX4Bafq#5bxN#&UY@fAv zTgUfmeo;L|RDyiLt9R5}hkYO2yO*$_q~M+()FxZ=z4m_H68io8u8ZhTh);vDg2GL$ zZv)*(T6>(8mdmvK8?}~0D?*Q%*Fwx8^W~FC)QnF(ol~MUpK5QiLYmYom)2CfE$KFK+Po~TnZI#wK_7Gf`uC@S za}N$7hc{|Gld$A|DkA~SS||(Kj;mds;#ayGpUg~>tzZf_W%VMGWWNcnyOVAo-KV^Z z`f_TgQsO)Gac#sm0aa%%W~}f=l`yivma6nIrAV)&(pQrrEo1r(nUv#5vA%}!zJ~ca z?4fCWjT837Hs;8&%j)v=F5>S_`q@9(_iZAkR8YUkB1-)oMV9WX`1pJ97(*F1+~v1J zBhj47ljH1Bg6&q1YEF)0U~KHSE}y;hY3`_KGOv}0tJb@Izj*V+I@QQ9iHIYj2`Fr9 zRZ{Mv#}h)$CgsgYR`yQn-L zQqCP`UHL4c)r&i_EWOkHfbhH8>+{R4{l0w1CKJx`S@cEKo)&OeW&|!6FIZqp9f%2L zk>4d|CG`u!V`J4jj2OLk=V!2#E}NE7~hGXZ)X8ruS3y*jo@m4hGDii%0XB1MeE{*F+Lh--5X)lpC zk>oh5ULD{1#&@%5Q7`u9_^9lc9$y~yovM0$+I;t>64(4eI#sqwa!%T%{9SEkSaQ#V z*0<|uY!X!rcjic%jUXTIt%%tG=D1hb-E$C%vVc;_khK{dpE>_M89xBB6a8vfjRyh)w7sbWC&6{^lPi{ z1{F-qmtwlqERRS4h4||C-%kF8>VEOxt&m#u)S^ zjk~)C(>z)jU1@gWc%GCxl|G;0v{)j|-@bf&K&_My5wpDAu%)j2bISCHqwJDO;QP5nyY)-?sc zr;>zaZEg5NBrhbmzn1?H{`f%fE4S?vRqHcf?;ji0er|anRN&>f_S+hU*C~r|W7{ha z_c+WC*qYvJAN%w3jg5%iQ?!hOl3KM2rst33Y||girCDt!hIuUr_1272WoBGYGlpkM zPBAS!#>gc1mV>4;>Qiamw=Kp?2Hd~V!opHe*LHPN(^dM(q&Cb<$7TC~?&%}lJ}&g~ zz;v&%k4qRAmQcd9qp?hZ_&41V-IUmLvy`dK3)P~r_h$?(ONabg97a#hHLK$XP?kO9 zVbcz(E^-8CDnWWkEI|EX|J^x?5YV9^GD{z)mHEG(H)p7nzk8QAJYGV_B#uT77lbDs zz~mI^ZGUL&d~n;{YN_3=r)6rG)-_)r?y2Sve1=@B{=YK&*KB37XkLdW0EwY^A`5@H+m}-mj%k`dWmi9SCzW0WD4Zr+r>m?(C~!_SIA!czAxN1z1?{ zq%Ddhd%@mZzSNL>vR1IE1!YDZjS#`sn>mR4M{NJ&o$28xoL={2^t{5a@Af0?*jE20 zH|^`gg8itoDOyMG^|M~x0IO)?*U~W&5qPcE`C9Qq_~^qu<|aF>`xNJ|+>P2FHRjP9 zFRP-|rzgjqwEuC<5kqT#Up9mb4#ewN1iBQ>(qsXDCGwHn-6DOQqK~atCdm* zt7;D(K}kpPW|8(387MX2?+VEDbcP;IcPA4e>zcZ|X+FOjv$;0pm92m0>!a2+fKY%g4toLwuY~hImxNd5XByyv*Bbu_ zXb>iBB1!OTres*ql8@v#=^zjQXZpC>6k0E#y4{M!Pk3zeRIaB3;W-gmNGh|<+>(4B6R4xhr&KSSF#A7@2kBq zptU(G^bKII(5TzIk$9caS8k@}#x_=bQn;_7R~GpKx{FTrcN5UvUz^=(ugiGl@T9eO z2wM|kP&~sIu0_4S{;f_Y1BE=uuXX1Dzy*r5-Aik;`Kjhz4tu2XLndvnJ=~*e!v9=m zEX2*$4b}%C9#3yt?Ax<7_R)-;6aPkfTwdI(D{@%#efaXMB{1%xbW6 zv*Q0oR@b+iP@0@n9`nY0@90#5IDoIoA$Dff<6*crr&>5R-YkA^JgvSXYD^Ke@F7K*DzZDr(J0N>iQqGpue{K zodW+296aJb!EO0Dk>-yYSJ02z&-+RXyx_lV89c1C!_EJ%Me`ps{kQQe6kxw)ga2p0 zGh+Y4Dt>SrSI|F){U4tH6&yT{jWV&n%mBb}iJdvaCANj@me_iT%{dT`<1O4pY|H8n zxPstEP&Bu21%Vs59M|K9dann;fP%o^-%8MmZ2o2Ye|rsCidr@K%rBCCzf&=jDlAq7 z7Y-fDB!W&mFc^%r9+NmSw!VgA`2}YMXxo6m{n!o;i3ozWAQ6v1GsMxX3Ew!kUc9;< z8e|f0!B3!UL`tl5ScA_%T>uS&9GBqs|G6kowkxV2g7%Wh3_{95w^Us$~!W%i0H4oHqU4mL5lbukW z=Fxq;>ndMf-^UvQ<%!`25jc(@F55K?(9lyQAu#pRqleejgUL4^g8rvf2=m-@M;0S~ z^j=@3xkrruD)%Xliq5}m_B%0x|;;^v~`WIbVYXf*r!eIjHyF zc9O=?{2x03v+8iz+OCZI>vbP*5P1ASS@s(Smco2`iCta2oYn*t3qYWt)rSALA#g~s zzcj+^BEWv;czK;$4iOnYz`#=NZ5dbsg-P+Upg3_sn~?}tY^NrK6z`9?1R^nj)_`NU z#-cIT5ReLmNgVd4qsfj1@zeR^T}ZLNg69zfcX+k506yrmmDzlr(p%c1` zyQ6zXOKA?HsEnlAxDMqQJ+IMSwVt(vG6#EA8oI1~eyiyRs$^Y?|p^ zg{MKs5Q()kNpU?uDGZht_)y^Wrd_5O+u^*wSRt+3y|}Ado@}MuXg#k`(%Q;6NEmd; zDOQ=s5((xsGxXz}gZ_*+)8E`em?bufqm&sRs$)sX_=TKWlfeQPdj)^%Vv_{7>?4Im z9RjVN9r>d?oc%^UJ~KZsurxsh1xG0&9sgY^_hU46@L)+3YOm!yI+mV!u|2hpYEeLc z6%!a5a7D(`3ty^=3xO%>ELOR8Km8-2Rk#q%0yZl*B<)2;RBVoXsAy@=8lI9X-(c3g%6aUkNq z5*eBxWCiHm89`+D57gSoBSSSz*xsH3a@=qeqvst&Fn;ko&zrpMK_F;FnH8TvQTa{KcoEE*7y zaR^$sq9OoOuILCLotJvg=>d7W0n75nOS^vmzo`kNj5QLfgLeOQnq7h%cA9%2PH272 z+E}0&|F$^3il543BMw=+`+rtJg@PP^6_i_4gIUO`Uir4KK@1VLlA~ojivlqwXWjl>y^r11@a%SAn0H8!RG$e zUg+IOWTPdMIP0ayBmn+ms2q&Gv<}+12A}y98p>cB9WFpD(0v1fKtPId0A;{9%RmP+ z)!OAhf2My%aw=jl{(!RV@@dm*W%b7KvDDLodQkC~E+}%bLg!2+WM-pU8x`W(=M~Io zR?)c85b~6va(}g}YDpi%a8((!6=mBfs5JC>kVwRIEuIiq9a!lMUo+^cX)Gwri@WAf zmA*BWu6VIzpnbG3%AB6x?P9EQv20|!uk=qUED3) zunhm|^oU^BVjDF^uJB;4N_0$PoAy{#qNC9u+PGaRDu!IwK3_Lp>zy@%R-uggjj&3M z6x&iFUKeGfBMFp|+^GkP8C?{W2K(6YT)*N5dyA?98Ow$7T+d+UWGUvFQRe7&e`Dnx z%Ao`EF;c~Yb7}Tl9974ed0vFEY)6Y~PmD4)@_p50_S8|jB3f3(yPa@8%gBdRhA}p+ zx{`)&Y=7DAQ%aY*NNKTXat%e7M3b4NS&pclWoILAl_P$tf<$32zfMz9sZyI+^UOsL zIrLae=c`dgMaBB2`=f{awBBE;lGv_cKQQ8Ucv?ukL)=M2$Zo-DQF3I`g`8|}Szub| zuGZ;vT_q&6<)dx!Qj*J`&pNEbkQwh@_RK~fRzI&=E&uv)!~68Kup^<)f`@9S9V4{( zbDCUan($vn4_#NYtKJj#sQA;T`D2H!%eeUNx1(*%Z{jrMiV=Ms!pnUvqxhs(YS_rd zrV|yFOLy)p2;qFgE{`gUDqosVP)*-D)+$wqZM@xtt)IqW;_oX9#@`6x!G_gZ=tLiV zA}!iIcd@u8xr5>pdN*uCOm?DPQ-qz~WAX&HDfC<#i#ZiUX*O$~Nca0~&cOc{j;k|6HxOzOm+J-EHp{GhBp4>US!Y^(DOQn{*mX z$0y=F%?N%;jkD&R$|8A&MaaZk*!TMoy*`{RjrL)!9*PuiFfMY-o*kk`8_rn`DiR9H|v%C`}?q^gXTNm_^H-va@JPNv~Ni!@GPthV$&}SxF9v-N?!~%CoNX z5>J)=zK0na4CE`Sl?^B7hpQZ4ws~^#O;O3TMMv21(itTnT%*Iex-CyvrR)~;+XhI? zyBqTE>G{U}nUJf}*p}^^6RpkE9&P0$JN0ru@B9sFuMT<1K^rfo#a*&E7}|3;r;`if zb-wFImJWIZDZGR*F0xbI&>9G_eph?N+(k%T>Jk?;>;%K`%-t0CXuJ@3w9{trGxx9= z2cwX8JRa0lorCx`U4oPgk9zfd)4Ef!+g~?`^A-e+6~gZb(m~L-Ddm3NZf7U33TOhf z&UE{Z6K5$b*H}^oq?%ot^;i?q*x$KluyDHDU&w|8gXDrBFG{961gVU_@zQ}fsMv$f zG_;o&fW4k$?6EMnnPYcLqSo0C7fk>q?FksdG4w=@zXB5M0(G!#5dv5~6a+zQjzN4^ zUPAYFfu&3p@^fXu?_3?YiDq3e~vSd*p%P2V}sl?;?7UHc;{2iQOG@}-TX+8(`{Q^ z%@v}r#MSOha1>md@(}5>TkQRNN3*M%JEKkQ4R%`hhi8k=Y#tW85PsyDOj@zY9$%M~ z(h%?`< z7L~B-yosX8Q;o+^e6Fb*U$}kqGsPQ-<{9T%ik(DCBZ?;__?qJ8G#uj=+)NgyuFkoZ z>2?*7?dG3cDjGg}{ zACvT%+q!Ga_NM8E#G4D2f2b%>(x8P19@WSkOh4fjTCZH-=^;saO{M#f?U-$IYObA= zH`^Rn=wjDKz=zFv7hXT>(9p+0OH-ucA4Sh9Jj7p>r6H#FGXKsc2#v^3)6 z=F(RCq5sn|uiim>lw>CEi6Lf3vew$22S}%H7fW!GNHrvKWuSv`$;nR5w+=j;^wZ+J|LVp0SA%|e zYJ8kcS&ivpwXTN(f)@XLG50lk-{h18d13jO+Iyd{Lw?mypMK};@@-su^Te2XKugeU z#AwXyZ!`+= zwr%ySw&I8FS~+K4KLWUuBM5c<2w|(I?k(t0R_z_1L)8a~^eMEW!d7o%nOEc~UoVtv zyirdAy-4xl2V%Tqm?~i!=lvg0J3t!2w`{N6)z83^x?_W&g!iU4rh_PUfsfRntUREMG1=jiSwy&95Ogpt)u@s( zjXMP#^D@E=v#sMgq>+z@AOK+q9MqqxwXv8Cs=D7ia{@TUYiBK^URsbVR;mRC1t^pW z9*@skM>2~hwlX)k$}f~oZF5^(v8!NCS**`S}Z z+lyH#HzXkLFfVL?HiS6J27jO(rI=F!6^Wy7M$p9>MEBy@EJ6>xSS7Z@Gyc2T8MA|nG4@dyM*enN)iA03Pz zY{Z?w;<xZVo=vuTgeBgxrOv-lrIO+${ii%!5FogDTl&eX6!~Y$u7rrQ~(f$d6NCh8H_bwqKYHA>y9zn2?*o2`l zQ>iI9pPkSaWQQH<0kx}xFz~M$? z%gf8P>NsS-Eri@V^;`QiQ;p$^1oVU9o29t}g=pq!^!Yc__Sg8Xs|E3m{T1ltp7L%ly{kvg_`L7KAi!J^k-#-`QbZbMOdBpn!Jg;q1 z{OHLcAC(Z^(phTsSr}zDIc!FS<90+zCP5x1|Kf^aa2yka31YHPq__~v* zmO#sv-6}%2_a#>qguHHaKRSGP&>=5G>O#K{-yd3!Cikm6I2y}s;IToOmZaCHy5KPe z_^7|p@hz!}U{7&%R%m2>b%YsA4#Z%-Gn;golj(1 zj^qa9DaZa(ZvKT{Yz4b26);o&=7^<=mY0_o!PJ+BH#LZu!3t4?Vym6*%yRd|Klvo3C zA9`Y=;b=+wtF&Hm5&~ADebsc#5KxZ5bc}l8VbcMWKHx}3c2_1?0M)F(2w0r5B8TiO z8gGZ29CrT=`+40JS39LWZz!{4RN6d0!kGQI#9r~ey-m0`qh zufpp69}>#TSajwt7KIN>sSbklm3;6b{K$UY$RtzQ6pZ;U~2tL;& z{^JbFIIHoB@5=SUU#11~H;2```hqnxe1Tc?qp7nPgdWdnuzE;EykCM_m;&MH$^#oBF?3HdfErOf5_<1qV8ZjYzYWteS>_5H4x{ z#RcS|FpGf3xdi=-CWKaeKv*LI$^$J3l<1=h31AR2O`h_?2!=S7gc;L~jN-)D_D&}H zL8+q%&6sE`uiN2xy=m}b0nL|yr%AiRp9ML7DPLU%_Bsfh zfP05S1rW{Z6o@o4u%Dov6*T_@Dq2k;`xTwG-Md{a$J4J3v%kaf5dc|sP`P7DgMucrxqk9@PLJ1epa#y` znVM3zp%@{aMJH#1&y#rh=`e34{VpX{|G$MXJiuihy}UZcljr|#*<;S$3`l= z*DEL#dKJ;^8XFPXS-(laxW?mO9wVA|GhjRv1N#dsRlQbTF1&Ay&yVKxgTI4Dg)BzdT$QYfJ?yC319wXJJ+lCu*_bI2>Kp=_ zfzN^tw%PeABwgkE#FAaSLK!~mxBd96-=pAFUiif#zg7;D5atzF0S7%$-nBsnlc3Nd zI5FIk2*@ZzssaMH_Q&`06r5h|lQkU8r@;%LOJKzX zs}ylW#2n6oYCJlP8z&Y6rwSz@n=YlCL;D?5k2a&s%lZyD8rVC#)6z@5=;eby zj6zRvNQ^%ND}8NmHx>;7)G3t16tqbLTDGq2Ysp|w!GN)8OAL85I_F8+d+PR_(6giI zAGG%5N8HI_eZ9k)fb~~;PA&E0dtX&+(jjpV}K=EK>i^B zZK1!SY85f^reQ~cCa?&iB7p7wCUw7f(jIjTNGL3;e_CueI=&f|oik7M2P&mXHu#DF zh!oZ9V}Z9sXLVqbfE+>)ZvH;Qm1;lA04l`?SnQH^nC;u;WA?(L{%;EhF&J3-pDb3f zC5<^BR&QC{R0bTf1*F&|4jDQ#v}dY&z!>PQ6_+d;gFTpYq_I7lrfatUB`g{6---tL zrAt<7C}ZGWtRl`{V6p0zC)?7K3lNW9a`=x|M|3w}{im5Z3`xW-Xa}XoN3DcO8oupM&U8_F#L5AET^fl&zT>-64*H4cM5$r4^5OH5A6A1_lH$ zI>t&zvf(e|a4|xyU8$hVR`kot)_bOaeAAf}pq-&z<4wlJ2~*%T)(ffE@Olk0%|;}V1{v%5Mw1N;o8?`#T=AL5D|vDl>es%Vk`!CMhvG%Ojl;)mC*rqUa-eNpte#LKLiAPEvQ>s zVlu`O+3o-twf6O@{7adxf#CF>i@>bHQL?|~=DdU|JkC`>pb>;|0dj!9!GUQ+-|mDR ziXg}#E>zEwVJI|e81=Ro72AO&#ZqSb2lNX{$t(|%z>tcKg%R7c=%kOzRt3I3o!DP~|34a8gLM;TLPA3zes7Izk% z)x#`eV2I2Dkhk>v4LvJ=s`IQu<~WhV1*cn7N)(sP-<=X{hv^Oq8!|h<3LaS4B>gf%e(M~Z(S`Kv zAT}vsh>5Kea3WR&rrdv-Fs0_p4$Z^sg;Z7NX^G2=^R%uxko(|-+>>a%#IPdL>&hMA zrEfVydr~y0Fe{(y&Ia{QSkX+XMfU)lKlUDnzRz&%hC?vSNWfZVTab+yCezZB)dRzs z85)9bd{R{Klc%O6m8q97I5h^gR?Tw4q7%;M>I8Zi=Qzf4Sb+qt@Cf+ukIx)uz{Z&1 z$L@#tnn&p%jsitOffF{Iwz!eTmXavF?B4KYIc}b?xE!z?2%_?=`R+0nqX;aBuhh4t zi~0BmuY|R%CG9$cx_~IB^aLr^(YF33;m@c|a;4 zN6^r-ATZ*GwcgADT+rOl?4Tk66ljCfwbX45b=M*UJahyd>Wv-?nej{omt2$1D6mFH zbzEJuo2T{$w23BUCFEQ-4~%ACC-L=CppC$HPSJs{^UU%@;Fh~E7=3V>jm-k$YZ+EO z{VV}iB4#4UYQLu80OkT89i6a>MF0m#23$NdY{_O2 zdLgZ}n(puSlimQ!psWGU={y(k%$l^;^EmM*EV--xt%-Uk$)<6D_2Jr-QC}F`Vqj% zSt4bgM(kNAVxSW(e9wR#r&5;9Smo5bCKV5S_R<)fBJ^SP?M~7!Scb`i{gTmSc(c6%im)^JF6J zB38q`VGbU^F5HQJQ%zKL49%Ym9OI#LyEw_r7-0E)EkFvUB=~$o1&AtREist%g{fST ziq&BdCk8}K7&+sUaH8gY#X2U@l3C2K=&pkK9YH-v=^!zc!P+!`3_!z9Y$Licla>@1 z0DlTA2S&OAYO~j5+YX`ZHJ_lr<#+x~Tp$Qe9Q`pDM-UPb8;%&mag~B-rUD`p5b{FDBd^6o%o!&LbvYUB$G27@`mH9QT8R;8bZv#GrpXQb{wKzhL;#sB9P*GN3VK7TTa3=1XZ}JB?pJz9@W3VlwG8Mj)Z- z=n~_XA@H&CS6`r0;m=j!q$GV;3hb!8yVMJ9ai3!7E+t_Kz(RhgNKl1~aW|FvW6&zCwjT6025I1qO6o8<}(0OhK0jGV2a*?H;`}7A0jsYK9q7V2exyUGE0?%#? zT4Q+-7){_FVi>&ZDljn5gMXzUN(ZdcB{0r+np+bd4)zY)u`l40^%}3GBsk7BN=Sr1 z8cMj5a`Q&W@MhtTKMXv0oMo0RfsZzbIWFK8t(qzxM@{G-+06V`|HAGNJJXsy54daw zVf1j|VX@Cf@YxbXA(UQr;dRrPt?|m)u9-e9=7QJKWS#oDsC%F178vp@D>ud$BXF=^ zhFqnEV0#dpi1{noI#2U&4jse;e3svSfD{0W-3<)pNJGz+!S}EtO8%8Zwku>@eI@MUdqJ`m+qU8Zgth%CiAP<#$M;KNF^p=4;LrSICPL_tNCrq{< znrih7U<{T_A^5o<6%n@p;bfM|U4RE4P;SvAgww7410Z%&xoda1rRTsH41!(MI}-h; zn6T4Q#-dbJ=0~_AchO5{{Xv9*z66*C7~Sw5jHS&Oi}2Hwfy&C@{biJ85JsgmrNk!* z0g68!-12I8oJC1wV22U?lP>{8m&;NjQM0feTpjXj7I-if_-{COKUe_z-{%76Okf}- z#5y4r29rTvYD!NCpa!iB1TF_G1XzasXC(CjKy+>C0zf;N;rdzc7(kM0Tw_^NW)vGM zs|tJtEwCU1drJcOdwoHWFkL}y955t-LPR7?YC^mi!Nk$Va;G0a0ODUX#UwQ)fwYVH zMUbCx>6ZqMr_65orwl;r)*xl<&iwt?0${Bxt3Cwskv$#tkO(5fXe;jJS z$pbE&5b(i_^80aTDYIXnLW(8>qYolVtD}Y+S^m_5M7(41Y?S8%B6%j!Wu|yOzTJiH z!9hkd^IAw%Y5+z43}-e@HcZELfNwt(2KE|a=qbdFb4AVilmBEpxiAX#992!)vA7>_#eCt)77821kR^`Ve}S3zmA9LAP!CedP?FH$hq@h zo=@6E1N?Fc1_PHBeqpW>eiz-o2#%a#h`z|9`ydX=Al8?qPTRl2k1tk+upe@Z*xy$2 zh7pVpfC>ksSCE~d-`*Wxi+w&)mEg)3@CkhuT1OV#?I2y?YH1H~OcDbpzaBeVw*!>h{GEMXuzjv*|3b{jaE%#8WJOcvB!~Ovn-9d zYw69d2tS@9)S-@nfH#Yr!#pWRlg=kQibo-qFR7(>YIWHr&pN9&A31a~DgM*qt*CF& z{m1>U2qrP^twB8U3LNPQXs>l;dC!#d3oE7OHwd546Vmw7v@}M}=pFKi(MbrFF4^`> zTiYOV!sg~?qnO}VF^_es7bX@Pt5M1-o|kLs7#D?^8J*~Zr4o1DvK+i+0&(rWszwXa z(o#bO_@nXW?dh3OY6j^vtsP^5g*hLut7;7Sx($Em&)c7Z_PU;=jVjX{*H_e@FILfb zMRyo+KVO=0S8?fcx9ZMA7+qgwU%QEO$*eYJ#(ha`gL6xTK0Dpp?F8zFKKh67+B+^L zrk`Zx;K{|GGY`D>#8QOC-lnjKV~Rc!Ckt;1`40J^(kmlcNhOl|k+^oeLBxmj&3W>& z!F5J*1MgZHUT+8&<5f3Hhu4KlKMvE;3mw==DDjQS!Wg-J>`@_)dCQb8`rD#TyrMlr z@vSF+joiyBzhbm?b3K{jbYD9%GC6i2O5fhAa2QvjfYmrKDmRGtGM3>LFy0<{?s>$L zQGv#(@&~~@gS5<>chC}VAGcqo&$A}wr_Ahl_Xng3r3=cWoZ zg5sgnZK?YOT+ZXEJM?%IRfN(Ix~-{ZcLG1Kb{-wVMg<l2B z+_CT7%jI8B27K*cy$LovS(GjHR1^HpU$|yQ#4!B*fq9!Rj{{MGd+i79NMWY+FD8ti zefOCw5owA$?!F6eylaj~-O@t$6w1(Fdtk!kn)dT3$>VkA4{+{Dik@AtoaF#+01o(QSzzm+I?d3HwNW0ja7iwLoF4E{u_RqKwD<4~!kXA<;Px^p$j-0u! z)aD+)9*GdqJv=tnQaBJ<5S$egb0<&EMy{^nOJB3DQCdUyT>j;_ywf`m2dMdCd^LKf z&6*o@IzCvs@a{w>-`{|^dBRv#xxnUkl4UkY=x{T&DotlcZF63DR6Jb?fxz*m#_Ce) zNhcbvwPp4;C}%V#xyNn0emc8H>aL}8NU-!-gVCBI@x+j%BN48O>jn-f$;ZCZSsL-# zx%Z?0Xc*-K-f$+vfrlccaBl3yqeh8_v$*X_*$##n;!R$8=7F~v-?wM)dmh5iw;^9Y zEU$P2;zn3R&+KJpTbus_r?zVoIf7~pyZz;_INHRISZn)6zRj4trXKdZi;>Z^M+@y0 zqx1-OM!s`me(CX?)7!SYg4TKc^X?e8%Ms5acuy(iC2hC!_OocbTeGt=*e*{xjPU;Y zmGJGScsCE`qBC5L?w)dbe*-C&+=hPPu%XMdGg3hk^El!MF90P#^c(clb7L*WRgX}aH8JvBS1TolJt^xx5|F{ ziJiOBpv}@Y{gLFkm-z)}#;?c(VzKG`yG#^ZNXdJa56+e4Y?QY%HHdwq=+YLG=KjPW zknSscul8)VYL427e}j+4tGv@;)jfr|wDg;?VU={W!xC*VHqW42!GEW~!MH6>{mi+` z471wgjSBh?`)02j+J!`@b=3|Hexf`18JWk&_lWZA9qde;Zn(Xz*U#dyU--Anyr<3} z$9xM^`x)ZdEd$0zJ4IZCEu4m`+~RH~gisoHUldGPkyGDHzEydXGJWD~X5#+i1h#Qe}<*`pLGxevh zx_Km)x-%tjrEWWKf4{QQ?wQSI&nsQtJ@JFCG4xW(!3maCL;XCFXX7K*mUOSpo$65y zkyn%HwYw;1%_{olvvndAr2oV}Ipx!W5cy&Mvu(Wz3Am=`Q?%YmKare|diHtrq>OW3p{;$;{Q{C+_ej?0Mr?s|_ z<8}7zJ>-^Hbo($XzxGht^Rx%130C4+lHqxAQmt505?5*;d0!cv)BA z=kB9M+YYQ_Xl9A}e)A0Hc#8SsXLl1+qZD<*KDJvu2rVfUl#bOsnQuPEg}i=|&inQE zweLiED*8k;Dbm8{i}G&R)t2mQejX!PXPxA5zc*&E@szB*bn`bCv?{rM$@$tT$zEDY z3+YZS_rs+y?uZ6m%frn_gi0UP3>V`i37Zca_)7JBDdHX1={jsip%+~t5O*r7=+DOM zX&L4Z`SR%8icxxeXm8!FaMJQSo7Rh!aUb*;GW9Zh1y4+yZEmtmS5F&ju#ZsOL6Z~4 zMP7JdV1QNDDA*k@J6M_WF(p;lr~voSz@$>f0$~umukwtq?Ypf*y>AV(KK`yCr!iyw z2jW;#%yw-hWnrERv(g^#5M-ThVZQNwh5A*I&2M#%czBYY8Qy=!(`{!EnO0|ZDmyZH zVEl!IM2(yUTrO)iOk*D1`=jw{v6zzR z*hpaViOZFeuRnL5-tLted10)t7WX-J>7#x`vX@8}#c5mWUUkW2OtJR)-AFM~jxzn`7n7g2+{)YBX>wcmiJP?! zDa&J-W%mMgrTLAs``5Ojy;^oWe~Mq(LfE;M+bF`}lzO}P=d)E!G9*3Xo3B?;y$v@k z2-f)FM_gW_e{@DGs=L}19y#DGBz$&_`Jk}QuC(-mh-9Pr?B+Z|L`kT--P%%)mguLmA#15cP%@px&%4x_&vsig)XYVARA;0ZZ&M(^DFB_7*crIRQJ8bAxrESP#9G zAv#?ARG4nI-F-0j!&F(U5CwUpr|1fPetP8U^~c^ZolV*o-cg&5!e*`6a?`;Gj z=8n*tmzFGt+S@v*w)t|-UzP-Qs9mYEE|=Q1T^3{24^n22CM2;)qGK znYKZSVJ2TdOFt&X%|}i;Z!prpn{(s&I-H8C)!KQzQp$tNj3d&Ob9;9Zh*}Sg1T^v+ zBlhyUw7G0KZs6bei2363sf@E13^$tMGRmi}bo!Kv#AFZ<9!CaghduKe3`-q`$S%m+ zrAgWHc1cGh3CPPs%*=DOPo2?nVY%J zU(Cs_yVRx3G3NDd9?{3TmE`OS+_Nl@cXSTFmy>b1d^6(6&eCm#4@~1D-(e!;73|(N zUg&Q-q4=&j-rV-Qb5eiuo{_;`cYTSjPh?4@l2%KoTj^&PrJ0*+2&6K@N}L)iCp2_sJ1ud;e&L=$xr>E zbVmET$=Xks#%7Ma@6WZByjAIN;ZUkl#04 zwXbmZTLaRqNhw}8TI52ZH>cKLIjw&z{r@?u4^Uwe)(@#yl9PCV1qSE3POG8N^K z4LUIyF(VDvoA!FgrJYL^Fsm$T(36l@=Cj*!X}(ywbeF)@)HQJ>kNeR|$itqeBHaxP zH|>?=TdR~293La+9vJiDPF3|*^eu4?ne~s>HX;)4@7OFF+*)}@0C%#V)ovQv*m-Tw zR?`#KF@kbC)9vm`$RmE=q9d}=NBrH57pb1MUxW<{%6RN!gAe;Rt}SvIdEz5%G&0Dt ze=V==W72k7V$0`NL*oznZTlj4H_Jc4x|^Lo-Nu)#9hnsy*)*|_{O+RL)wI(`vbLVe zh!B@VWs2Y4x2)}y@=Rw|*;ytpAorW; z03_+HYay>6%TZ9TW}HZ|E2z^Oe}MTkSE#`)VgIJfOJlv;?QN;MBRvf*$NOi7KY;&1 zP_jOIlj&tggLJL1b-Y@)kGvyH+ZB|BoD$YCJZHQT6xN zX~HEkt0w;Od3Jy8hbe_i z4H3O&F%5D3$J?7Jc5!>fZ9;WqzpCH$6v^2cr5|B;N>cAY%iZF$*Hd{~4Edhvc{_RL zY-l4G_Z1E^G6)__X+EPcx^S%MgRJ-u5^tu?^s`Vd@^Vd;w=<5oZ(&JxSosVUAihUG zS%`i#%X+BtLb=?xW#is`{gJOPVDT2&WV@_v?L!R_>$J_*Wt-;7za|mvW##0xY7b3p zlWw?@m-bOs=RiT~n*{Q?zTPWZTe%hZ-?psNK2V8!82sdt;U;OF%()kJ3bOKzmt#x~ z1@I3pKN)&u{@TJ(LdIO;eqHPT$KI0wG9$^AJysM&K-gNfcwd24 z6tz{bXz)OZ7=g4_yS24$@hSp>;!#3@u1F9f1a)nzBA^wigb>sUib7C?0O9!GoA3LQ zF9#4%TX%m)`7+TOXyqS6PX1!(v5d%{c^9rd>T5w7$%!~N->16rOy06#&8hD{^rxV=|U+uQ-sPDRY zd*|**{P*WE$0qE(eLMH(>di5V!6kM*2aPH^8fv|B-@ed3!v>E!K4U?W#W(7M);AoN z%-X>V72iud{NotAS>N}G`DRsZ?3KeQiIc*H+xN}<+mPQXy>8zA`Y)xc?Z%JaJNL?! zm~$KN?s(&b_riyjtN1f69NxLp@68L}flXr2Lf2b8qF+6cnDXZ4@4wkTBzADm+`0DZ z?BcBvH)mejEI5(2ZS1}DodJRU7iE4`xTH?HXX>6kUI{Bg$GtkiX~Az7LPyu8f3^R_ z>4x&l?_BxGD&?Na>Z2nQ`b19M7SO-pwFJA%%NNE$i+J<=l(%ns_H@4)yCNs&Sie3q zdcQMia?<=ggO09WReHYg_Ngu7$8H&Q@ye9)E^m57jQVo3hox;7-`w1gT{Yb0(I@vG z_locE)180!zFz7#u)eEB^fw=!Ix_2=tMfM{yFPgTmn6ILJC3J(qF44Ab+o4MiGW$( z%R=|x_nnj&dimnwzb^UZ`!D4ey00#}dhvSYuB$nPZ$2D5Dl_v#o5K-4{?@q{&t9E3 z+phNyrSk3L2S3SN=WjdXP__8xXupj&_Bq@O6MJ;M`KCjP&*_Wr?VCN=>*LvfIWpt= z@qU?^pKao=-?Zh7hvVe$&PTg{x-Rax`^C}o|9l}jaY!d`Z?~T&%((LBP_Hk}ryN|g zcfNn-@Qb;sQ~k5L^}CV0t?P-Ptv;ezHg9YmzJ18b(ewJfxoB3Y*Od?5xLg@H^;(~pdsk-{ zola405JdD|7c|4UbVZHr@JGH^&!-1_FYuk`>U89&n)e{_W>9oiNtD;@`Mn>0WNYgc zGUCjA%k{2nvi-&_IA7?oer1v%({}ksgHDf~WZiqpd!aEwyB1t@O}y}1=;*nP-7UuL zI{kx3SjgV!`Fs9TB=~Z?z3agbZ=U?yn4){v&r9ZhY&ZApk%EG&sb6mlosc~HVjtI2 z|Ju8wbms1{=Tjqktn)rPch=y(?+mh@Hh;q3eJ1w|*}vkVazv9m2BCMT`$z5mBct6x8!yJTulYx(TKYet23wwgRDx*7%>C!eI{Q}+7A zRF7G8ZBc$&pYIcGJMngRQb(SBlsjeWZFTqArMrt(MP8VA=c=>7{X+C0=aA?lduNQc z&Ixc0>*4We{*~9?{%gppoArHv{872KV#|c9lgA&pIdR>Mjqk+t_-?IP(Za88##~Fh zyLA0T)fd+tFYfUAXu_E9FD!QI{)YeQw?+L@r&a{boSC1rYgV@TpUo=VSMYe&n;ym< zJ$r9U`pnc*zlwGqxxewqPN(ef9i<0Dfmgt)osvI|dUy}R5;cqhT&xR!% z$B2U6Lm~ri1*ODC{3F=r@uf+keX~x^{WZ9wXcdBUgudWTRO&h9={_)WC zbJaI&zwSP)%kTv;UG@fkU+`LakSN&i(W2}39?y+^CDLN$zROF~H}CSEwD6(#M?a>P zRZi?u;WTQ4qD#!#v!NHf;(wSob>YNb1rvi~W2H_D1OFL#GIG-7VP%cSukAeMY%xhR zzdUG2PQaC)GnPFLw;BKE(NnK+YX|(WdwHqTj{gk)@!0F{9~$!Q^`gCt3;zAlM}>rN)oOth|Yr*b&Pc~RLCQLrPvv1GKwVPH>u)eop_M|~QV&?UWSa58{hdrll z`R=!xzvN0{?Yu39yz}?^`hdwZt*%U;RCsTX`e?|&zprsjk-V`xI@iZC@Pim@$y&RM zxv~GwE&4U1;`F-P7rgiVGsd#tCnAfnql2gZM}F}_>>j(>Zgq>kT~#wAdfdvl2ZnU1 z8?&;9EPUY;*VS9X?5x8cuF86Ew|D0?PX?v`Ic(d|V?8H{LOkBh`Dyn*OAgue8#`Y1 zf$DU@dQssU>raKP>9>6R#fN3#eKy%{A9y9?+O*{xc5a(;nLq6-(Z+>e>`{L?_x7dn zW9<`H6|M4{dhhnti?M#&Him{S7!onOZ_MbRqsK(6y&$N&cgpvS%x`qw<9+(}8u^cY zev7=q55@a+JFw^C_KEu@PMB2mTfA0PH*u}R$_%wIaxnCFV z=so>W<{5pPCSKH2 zaQ+Gff8l3^NAd$MUh|H7Bwb!`aNl45osyAr{kORv{`BpI%RLS_n>(%X=g+A3n)Tt_ z)!D%lm39TPGj5dusYx4si=Xf}ZtxPvXZ{*sAH(yoF1}slTPn|0Ib}|;pOBiGIw2+I z!oz6yA!RoF6*vs;y)*HEBpl!NN$}+r)*x!W4+(&gTP@4LS09_g5F`To!=|2n+q z=GuAFVOjOxVV!+$pXYxWJ$1q3_dj!;Fe>HJwC&67(|MiO4gc{M+i5E{%y+OGl^2`( zwe_dsZx`|ByS?VK@XBYmhKLG&v7a#N(Yxzrj1Bvtbj7_Lea`g%%06z-kRh*I+xe^; zSE{uHJpmOr0cHzjF( z$j;@TzfzYJaVRGD@D~=t3&Mu4xj!?jOW1&!JH8mRVb$3qUe?=Z)%E+<@%qiHx6e;K z7W3Pw-@;-pocwCk<+sBJ7CI$*#C~ye&zFhZ(SgTK*+mbDj`?Ql%EbBIyY(Hur>o3* zd}iqbyT1O*d9@>aWo~2goIbYMyXsPpy+;bWj$OHFj@QZWP9+V$crtVJkK@R&fo3}S7WsLWly%$3^`aW8* z?!&K_zLR@0Jfg>Kd8)kFY2o;o?SGy2=DhEcMyZD1yF3`yO%j(S4KMunX#Squ!xwC4 z71WOYDEtebz616~oOkR#FzkcSf!FU%czy3G*I(_1{%f1>yW?-|-E}AC1A+Xq-&{%T zCzm3=x_;tslkGEix_&fr$M6}w{BkEO|1Cds#^-k3yKEX&e&sWtz*#@!%BTBpT;#j( z!r85RH>@B2{>AM(`d#~VXPDhPuW`GU^bXzcnHZlE;Of}N&Ug9Q=tkbc#Bp9H%>A=w zE=qBHtte}r>uaz6nm;VE!J+oMn^hC~dB!IBa}SP6_Foy}`kCL>knr7pmY;@SuUM7* z<=`HtszOu8Z7LnTIcB(H#FFIoUbg)<5A;YJ+|k}X?zas-0mof}R&kG*K|Sa13>m!MVNQ-RbwQYQ<(4->2f02ht)9C( zMXGSRo*!%*U9j7I#K`%7o;K%5=G0C74mZtTp-TVlak+=uYVa>R_uNwNDa!3U_u=C^ zmr*Rw?nvOZrqK5n?BD5T)x_TgU?9og%*hIc@f*K^C* z+r9-)=FWO$UCbD-ocW#aoqs#zo3|srx_Nr!J6|02=ooG5x-#*DnC@R6m>+#$;-)3# zOLklc|N71OpIlu0mruWrc`xXO&*JdU{MIj@F!bR3lY8uV@9^C_1?{r`+sCurdp6B{ zJnCTVj8p4A_;y9~rrv+6D~P&zZ* z+2;R`kiub+N%K3exb4~L%SG0K#*> zy+*xi-Icg$NpT0iop&HfFx+eYh#psJ$9P>_?cw$PUNKj4zD{Z}Y3cgf)X2OdVDk0g ztcvyidyfD7+mX2ir|TsiZ!efTZAe(<{O>EnE^y(|G2T1EIWvYsiYE{jf zZ+)Jj+0dZtv4Cv{#@ws0Wov85T-ZgAUr-MWnK#XKkTrZtcnmJo2nliFbeK17E?m#? z7RL z;+QS7rv=S_XQuhpklj9qluLup9~iMXohQB#>t3>DHP20)T;f@JH@L4#ajrVIh9^#1 zBrTVoC~Z2_zv-SVcy&X+I&q|+O0s?vKoocQPtm**DG&A%TQQXnb; zf5N5PcNdERYVneU>E}|HMl?C_;@sj#92j=&QbSTue)758)f*=B+){dt>o?3QvfsL- zSkZ7^{3>zM?VaM&lX=NgKOf*2v~}aHjW)Tl{*yiU!<0dd<8N&k?%{TCXIxUccaY<0 z_xJC7Js$p-oQqxknOkh&pK`_dvL8!=_|vmnbmjAyCk64w-%CA`>nvGy3e(C-1<$%Ms4<^aF=wl>@V15_Q8^q=LqkJbQ^JsjU&utU(ph9!3R$l$c{RnS zfb`gEfVm}9t;9`yHjHW|7t^Ax;MC&gU2lbAZK?xb6$#(t$i!zLem4 zMic5W&L|8M_*~_&#gZ`;wE9aI2M!AowhC(iK+Ccw+`PylL-W$I#~i*dLy#wjjblnG;Y$OG@m$8ZizTQ*Qac8 zbsX2HGTr^h)Pne7JD0|lOMiTn9(FhA^0_jB@5o_4+1B^2AMO3*vA1({>u_l)t{ zR;DRe!)ES4c@DPJCmiR$)yd_Bbr4dOYMur`LW^Q&PgVLu_~IY;QRkA))a=JnE^H2m zV-ICflmt85BEBaS29RmKi+SZZu^JH64h)%2ZBN&GCJ5l$Lq!@Kj!OxBy&@ZNIKiJh zr!RE)sT`}YTHqES!C6)aJO2fA7{&x52`;|C&U>7owZPr9Cy0^i+RbW_-4_W01ZE?d zhXMFM!XSa_7r?oZj2(FNh+?f14A|r=BQ^r`(>N3}AxjO}SjQ}~x&Z*RNt0y{7oRhpt6{y zs^;B5zd9GY{y6B<37uTsEHXIt7ULxf|^bXp9uj#8Yq{YNC=1+eq}*93pj)b z9CZQ`cmQcSe6h5disf)DlywghmTbyfvgLs&A*i9gwvs2#fJh*mN@4;EsS~7`!%ao-mR}szO;owL66nCLv}Z+p6Rr@Z+Zwh&QA5x$O~bK ze2GedaUI3^_+z#PSsI{*zao4`=cnZi?*}uUSO{T#dC7P<9^()s176;ct>S3d$Of^1 zFPg~zyHNl};NZuC#$l0{moow0`xRrYoRiU5)*gU|q%x#$vrAPA|40n5e+qQ%1} z4j@mF6KP_o5<%8fyTjDrbd`VIHwr@gvNWjuf} zgO`-7bqG!zfM7jiQ=*zW0oDi6a1g``8yz@3kU~nXmO%`39Lgy$)Na$H%2F#q5-2x- z0^}#S;Ja8xeukgH7s_Gd1|lFq7v3q9a6%Eg{e$osN)MBqQ&(3(;;S zn+6N*u_%UVbMkQ-jov^)b^e+py3(KtrakpUbx}s)E6u_#yb3xJn;=k|jN%)B%>d*~ z6-9cEZlw4;1$=zSIP)wz4w3;}8q)#Yk}4pL2$p&EgsRf-Mx<8d&RMeQfha2VK_1r=dwDt^xm+RSm;)_o*xQ0j zh0mnnI8Es66YWD>p@6pb`~JQuFJAO13=`ard7i1FF7aub7W7)Og^d@1K_OCQ(3OW6 z@6jDC3^|7@*=h3NtXQregz&_00#&gGFT~Z)e!px*2%HiozB%xKZ74e;#8m?At}jI! zHIC8ERRAm*xaXmnCy^3@{30WW3Ud7fqT1B11Eay}bNvE3=Ue z>LO$SIHsSc-dNUPdI)1RTpEP^W0{TfmGm^C24IA4_n=jw=w_~$8ygk)ElMQSexbs= zY$3e-e`-d&WavDKpwQZh(bLN2O0fb43n8G?ndm)Lueo0q2%>{zQo08EKtFh@UM^sN zqYV1u3R-cYMqpa#Oze{#nZ9JWkwH|gq&g7_F%XRGV2#2dq|b34Zi=qJbO-+(oDC`| zAT54$&=ncolVXLjoVIylpw64InW_bx?=09t)NK|L^y)(EycrwcEwh9D!ZYh(-mg-) zV0w)?;Dwa>iy)uX$_$|M6_EBPzC!T*xv)|7!nGw29*o9hfa{Nh0-3~C)Z##FL?vd# zoYIy5JG!RG6y9U1sgu5A5=d$x)Dw|DV8+dXkzS^$+P13U$=QyNi~R=fXDjAwarS`> z1-z;#^t1`9QO!Ob6dc5)F>PTxcq%2-**4o5yJ*emj_7rqra87SL#4*>l|YQKwoajA z#`zWobgDlw9~lg@wJ1#W|4t~M$9VbwxQ#y#b_T5!XVZF8HyMvl{@WhXQcQN;(W|Ovatg7;XSE+Vw4iFr9#wmHpnJIVt(zHbNo`n3kv4 z!3_T%yjTKZPt|b^7nduW>kBLQxjSvjTU=s)$;h%%LQo@RH6Ms8=ODOP* zRxpIp)i`if&c+CKQ9M}%L93`feoR7EI~nBk${sFnDP1rNV<{k(fydu@Od{PBXy$Bo zC67unOEbFTFb9^=X5q<#;hr?4h&6bD?v=}?gykP-01V?NE1vCLdLS>sGYuBWtK1{% zaOdZ~nx$ha64GmNALr8JxN^SlM!oOw^})k&yJ%n7(3x;Q*rCZ+f?GTNiEmQ<+CGi*O8jwq zK*Tj^enMGL^2vmi5952|iq#PrHy+Q`js0 zZY)ofo2492>V50|4>-sKE7xz0T{`U8qZD`hMNg0m zUnX6+QIWQ<@Z|js@yX(pJZqckf&_<%2dk?+#sbD_xgBhCcoMTQZG?Z#iAW^LcCYdcqp#If$H@1?7+oq3>GFIb&6a%EP@#*|BE2BXNNt-b`TS-K-v6t`qp z#I?sr5;9 z8#?Bk)09KUeS(^j%j;laq+!_79irSt>0#U?509GMMX~N>_}J%`%UfG5N^(m$*1!|z zi_)L)#BtK3dS@u^OZSokFFEj%1B3(r`UChd@^QLSs%*5{ombVkR9XRNn!{F!t+f?@ z04c_@G;7R)nTMcOS!68s4+(4HSPB1-jE!V!USZz$n(D{efMWz_GeKxYCx*3V;#&?j zt5TnV!-$o{mfAAt?-WbcMg)z{_-O@fQ2m{9Z8aN<8cuzyK))A&m9QP6?iXIv4*GCb zPT8&7k(gtd*U$(Gn3tD#XqdDLd;$9w;oNey7wBVQTyY}TCvNFwd=x@})E^(6Q8z2W zuzY;I;8ra2!)x4l$#(T?f4cLircv=rU9gn`CcO)^G+9=2oV9O8edcO4vBXo6X!?ZB zIV@*UWKqO=HRcTt4%P-!r>le670n7{2Pc?vqb=a_gX)5;Ps&mv%w>KPEX2hdEqR&u z2FOBloRV#$1is!bbTnn&hynu<8f-WsV!jb=YdH~v^E*hvq{LsihPNTK*iSzX2AoC0 zG1^)%iT-fG95zX$i=s@WIf}`b7-vkT8Ez)7_72Ss$N;**riJz@{N2QDfk7B{f(eN;sgE~nXlS;FG8A?OHS1TmeNby4uuK4JhdIPJ2i*Yj z5VoTRd)I~*3x>Hans&`C^ZNeK2*izzHnY9@C z#$w{?aOfZ}Q|#0R`-N9#+i#$`%ml~#!A`^x8s<~MRF0RlbwYwuviPtKJ>OWUDtR@7 z5bAIZoO@E~lUo0PXkzi65k`*x`4N3vgMe+Xkvg#X5_0tq6911JLOPnNn z%z#@31#pK^b(v0iKOVLOK6HStU6w>dNJ|SpOLeBiKHK+&K<`-`5Y`|e+6dFrL#K~c zZRqx0ND~KBc=lScejUMu)yO1$)=NqRg}^->-XmX>5z2rpze93;sYvIi!F{Cy|7VJR z`bgVAd46mt2sqqq>UcRHYy2lxk%(m)zA?bgud}GwI}|=h$;=*IEn=k+#d`%DNa8Ne ztQ_ehN(n9Y%;oyoW~RYalNxX#tw508m+8l_6`7E>nXFc^IsZ(^w5dfL=GZ0*uQ=zL|*s=O57F~Qc2>LCR`twRNs$>{R zagGw&_6X4_EfVxuA-;;9?U8M)CGXMr0V>6bPZ%O8nb&7O@Y5Z}POpG)(;JZsP-uab zx)o`qxM0>|gKJTAax_Q~-3!Lbm1Rg1RUhc1%H7eROKGu$>>kKPg9Oq2Z!^!kdTAb( zQseZSnkE80j0yu+^VI1?uwE=PEHhZIx?V;dfctvMvL`EcB6K>`ZWsLq(DuOt&{9Yc zzd7Jlrgvy&pfN!zqBKYl9S7-D3ft3#kRi|cWaDYT0!?3zovzkv&^{Y4*QI3nscm5* z^1D+xaurerMU_wJrt$S{f18>u1T24C72l<<1g0iPNHNyb}A#*?aw`VhOWS;u}6A(B8Nh#yYki@@T;ZaD*7cYyCR8%ZN}O|`1)~V$g=GL^T?wkY$qMa?F9Cl) z_Qax;cm;$CT&NnOp87K_b{y@u3^Wo*f?Cx4s6;B92+(cq!jGq|jzKh%CibV)rayN5%-^D4xw>q771aL@1VsenQnZl^8lKder+n)5GCJ zJa+*T4e{tF>7kh54B|;B7Fx4LAkmhcQv~uL)L?6SozXTh7KRolR|HPioUhRv*xc7j zG?7_j9P$fqa)dT=**4SkXDk^ra4iAtbVv;TLK_Rpth7nV+R%adbUR=VhZpQis3Hr)xL@xaE(|+yMM=Rnv0R^epEzzz zeU+Oix4{Qq8#keE6UOGkBM4rvW1?(aQl2T!bxSyiP-6kAj=Ww&Y<2iJP98GY)0vCF zTu2`1!4t(T#`FZN93axKAd(y4OMzX3xlI!QT?1ySwu$4$mP^wh<_yv*Mr+>X(TM6MJ`h2AKBR5J2T6;BVGa^Zh{#kPyrejf$BW>sToL9X0b-~!h%t2<5{Nn9 z#nRU9?0j+b!Jj?)7S{B7bfmrm=Ti&YroX@TZjITdi8bct_nVtvpvW6>ue`-Edpvh? zk9n>`qd1%+JBLCYx43lR?_V4a#4`9hLJ~MLwnxY`z~MT|w2h$qY=YHQHcpMAW84`BM_vElsui40Lf2B!!5xt?M|_+_-MYox`}Xsr`4MS_<&BF|HdKgnVQ+by zPh4C*FNy0@hOe<6i(*#?LCq{mQS=ds;|ji96u0`)os$f$FMnTh;3WrI<-jY#RzY3@ zw1oq(4+ETYUSn`&p4$0xL-50o(TsO@S7FTQ=BPl0|cE z+UMeHeV%7(wl-0wLbeUA^%+gu@I4K*30AVFLEpBt&aG}t)Z!ZeJ4ytF+V|(;dv*=Y zyVlDuG&D3kv#I}*Dp0E$hI_1bEt~`z?etOHP!GZ_~vQt zW`dkCL3E(a0iDrOMBEP~o=MDsuqYD3SQ5V{Z_MnSV}pt4`8#?=u_T@`fPj&RawL>M zXArNJ02)9;h%N!pDN#wulk8L_-PC3WN#nSU5J&{AVq;GiEtt7L3EN(ZFo2Z}n@Gr0 zHybP`n97K=A^v#XJ+)MniO*#w!Wn`ElHFNBLWp6pkb7{SvuXQ2Sz^$ZJ+>Oo zl?szcxW3QeH4H>7JHB5`-|XEo2UCNu@BAiwsod#I@F$jrlnYr z@;#GcFzje^ak9MancE9GawCCCGLzOYLXbgZgnHPJPJ|U;ve(>XNPR$aN(P7>pE0nJ zP10!9oI{|&Lh4354Ao?$$ddZTqleR461+X487LkPjh zmZ>dNSIU0I5=ipM0C=X7DU&uChg4~}tz)U+v`v_Q=i~BEl>#q68%bexW-*taRu-Ds zpJc-n1@;~V(eV#^&XjbV?|XKE><6wL`$cB^?F5pD>FozpxfjYmjY(c6;{8hJ!o28Y zl`@Cf5M@CumqLQY^oLd^U)?f#Q z!K6+#FKZJ7ipb4a@0bqLXGc1rIGsT>{4`}|)=EvaCR!#WfIw&xcRpS~Wf6G}p*bXf zayTJD0Z4O~3Uu>BfnueXO9!Y9(G_FC`liyMP*vzzR zz%qTY(xswaP^ggyBV4Pd1m8&RgrNqdH7Cuf)v|tHKR_kjL$j7p&U#?qN9%j6P(!bk zBEv8cLMR%H$FUP=E0@LZ0Z;{7VwFakE=U;&7+a8>KO^WUQ6XM!7jUIHw#P&7VNhGB z_BK~lBBr+y!A%Udq4jTJPUhsZTQc6`VOf>7q1-~1*n5<2Z=-3DTrWREVh5;1&9&c~ znN(&3sclMQr`?o5K~tb5Tf<~ZK4a6AYqC~oIu2Z(=P|lT`jX;^RzX&uEPX|G2<7xu4)q)w* zRB7d^v;w-1G#r&EIpKz8HmcGHIn2ljwR|a|S*B5gASEdc$}KvT1fvu`t-P2S!~C1A zCg^}j2dh(20!cG0{&fUMIaL$hsr(W5XmI+1!H59ol6F>LMk6Vubf{Euk*(fX~mk1DbD zu>gz$0UZ)>jWp#r@RLRUzfY> zwQ>*u6^y#vAphnx8memznz*&5Rx>~u<3ye)ju3xV}u;b%z5^=h$K< zMu#h=mHn9_<61^xdE4VM+LMT+p$tLJ7YpHYGiOBAoPsZ=!A6+fuJ^s35lN>tC@K)V?xlIF>4erk_a9h^h~q^m9p+DW4LA)pSIrrLGoh=AOn8|38Ef)23-pwD{d{BU1~Nff(e}! z*(jI8agOfSWL&p|ZmN@(Z{DbkRJGy(IF*a6t) z)vLL@wS)j3MjXKBX&GS6!?X#AH1IM$8$bN?Ro%lUsl5ffcCX-a5SePnQj#WgsF5Nf`TFj9`3 zx`pg}v>NvkT?TGScR`IUy%n^KA@AkyOAfr`z)KGN-W+&E-O$(+ELAl{s-HY<-e!$1 z7DZ2sRe9M6+O=IZ*&Y+GAf$IK?XfMWP~vN##_*%)z>+YQ+F z4vN)wRIH?^a@F$ic^ma;CHm?KASkf+1B0YX%YxUIHAp3Dp&|caDnWnSVHgJ?mX$(h zCc@xc0}_GhQEhC-v9?wkpkcfAQK1h!=jkhZIYjj*L4Ahz}Q87AxH`X;QbK+-$)w3l1B;wf&)&- zP}ChUP)>5%pxDTW)lgV!RS?g`A%m7Vd?gle$lE^4NJeWa#{pmT%3Nf~(wohe!2;4R zDKOwAayN-o15IxcQwDRYOz?~^H)Jb@s7FSkOD;JLJZjk?19fDHwaJtETD-;dv~X!* zSi2t0=3 zIOI+YOvBfZ)Sr~Eb&(YUQG8gNMB>c0k<7{WrJ0XejTFm(m92(;DztbRb=WJD%A&frf3;xS|TkJN+#10zz2sIfddt`KJ4Al zekW=p%&g>$L%rO$99x=-bb$5gluJlRh@2SYZdhzs>0F}M+^!|b6%)6X zCao2~&jW+50TwAY8FmfXkrNENhLY?E!>*ySB+IaCFhWKiA9iHKv*a;s*yDO3ZWe(x zX6$te@kjymr=${9#IOT}4|cVxh=Clax3Lu?(&u*f%d8|H`)kJpc4nxY6jmvXC<}U8 z$!T1T!NsdIIjzc&=9VBZ%o4{tL<^u$Gy@_*Sb-L5h|pKcP!odUM{&rmH!?1{Q2qir z86OQbIil});TRz#D@F{BgkHZuedVvC3w87Xe$cJ})NOH=rJ7TX$OiE?rPUq|26aeM zIzah29Hg9a5{(W7z1le7x1O%1$lkIr4EsgmFpPEr8U2mFj;1l5iKey- z0MBU$^$c}~ohwC@mLzJU%_&USA8J>K9?+Ok->}cX7mj6$$_Dl^#v)NJ@UGE4EYf$f z_cyZq$pETbNC7#Ff(62OpBGwkNE(vg2FLo`X;d4MAt+1fG_MPuO>{GQ)&jArtIS%F z-me>0hY%o`>VXT(dg{S2uf70E>3l@OUZRC&_N;nBMb0jPlch39T9Y4E*EL6+wfS2IRu2WX0F!AZfUMK>n(d9hBap0LWXgm8(J(6oovhW0dC33HhW>!`|R z2N;Sj>NrsJJ3V2B9=+cM1d=+3lz5vR-{z2LjbhOXMom}sW>38wnOA~NqkweMY{6jS z>0cKD#~32aKGBP2UiGM3#)RwrQpJ5{#JR!LIt%`?iwKqD7+s0Hwenz%8;og8GbXf> zltiQN`1nHR2?G{0i<2xsw?WE!6gU@p|$4kf)%1rN#@w~cQlYYPqj zuthBh_o)SM!nHoKld23C_)73`AGfHfaJO5~eteLadfa_ggX@0?at9v|5l)6HhMVve zBV!vp0IW{?h{H1p9w5v?+(L&SO}MYCQ4E;3;KHIB(_(_AH;|yd2)hKSItQ^Qo{R-x zHRfH5kEUvb!99ITal;)2_#>i8!mxDo#X>|XdU6r7j6q+O1P3LgBf05Vs=(oZ7zs;9 za%zz34YE;Am{TxjnfIGhWw4-I)g zWZ*X(&Yxf--%z;HmBV>`+T3Z@ldWNc-=Lw#dVB|p{hO;+jJX)~=8l7_a<1;^)4SW~ zRh|BN{NR`|%XjRUG~=MzKR-UctJ|BCZBEn$*TF5WRor=^&`z)YGpEzRRo!e3HC-2p zB9*z^*-fx1@BLo}&zLlYGo{09F4yV1-9AJ6UZ1k#(DB`KG7b%J<|}?VG3!tou-EgA zB#}5-iL4?lpK=42jQxR`TkYV%mkXOK)XVUf9C*ormmGNB9O!Z=;LdLEzhv?_Xj*xQJ?iQ}Bn#w1S*F5`*uf87wi>%fR1l~3+pbCo;P4e=Mn&BRYd z0#SX%uTz$y0-TnQN>&ysv32-}heteWt^Q@QWM8?&zpPFD8=H1>A^WW@eslViB_dOH zvSpaoGIC;1J!2O0Dj*AFLI5%o%Mcchpr~LL5A=RxaaA>t*g3k1e??e04`4fkN$=N_ z7!acniYLy%ANcy&Mh_$NO4e%w5y+e;#ve{?;&r-zVvO(2Hs9E5tdOm54Fh`DQB zKdrZoJ}dgDDIuhLDF$s41J$7bFcp^Y>2t@_Wa#??C#as1cBb4<&%R$iIB)l%vLGDFvIdlW=6YFk1}K<;KBZ`xh&2 z5mQD5w1M?(@)SX!u^H$nZIuj)yh3#)Xmt8I3^WCHhOJ8m1+7vXf+i}2 zLb7{Zz3Mbka5pK;9}u#TXN+rG!!&DhE@Dz@esy$XO=xo-9cY%4_X05J#ckRA^d^Bo z8AbR1(5$gB(w|F#ZiK43v1YVM#%lm4IrE?;5qa5?+S<^csh~(DMS;%EwH7+unXdWf zz^p1;wNz zR-9J(Vvjig(?guRaFe@ArK*ybKxYPuqMkKnw^Dg`&oS}#=KqqvhJ)d6C&9_^u;3T& zcEADFTj4&a>=TCqN)qN6Z!yM04cnOsjZ+tuwqs|)jWka4wdv}P%@>GO*b_>a`beb` zu)r+?gs3gq(H1#gy87W8v-an=_SZ|2rB;=I3NA#7wE9+;A=7!S|IJn?q`|?#{v^{M zXaiGU$|e}7`t{w2;ip>va}Ev)RI7-AN^2&Aid8;1(J~Fr(s<>BSkQOt$}7_wYGHyF zg@vG04Kske#6mD8zSRm&?$;$MT8+%YO zxl5t7=J6v`L|%~~TEXkfOI8GadhwdXKKT5+FuxP?Co(2#%KOs~U2I5`rmWk>$pEi{5i}#=~)kh0TpI)Q`qxz><| z3R0$LAOdt|q@7a!Ha?Bcc}&H@?#ihPKyYZX!veFZgN=^V$<*xnt1S5m#x%-R&>2#P zZZdTPWrl`J_h?vVsB#Tu$m>EP*mQ-ETxn*B)k>5&%8?JFm z37s+2o(mf(3?>>#c2y(lA6O+L4O9aORgL0@nJ^W|LJH!ifh6BuRnziAkWweylR<$e zb+*$$(m2U_1CAD*G>Pi#HKnmY)-sIMBsJMH-egF9K!eeoA+NG>nFdw`b|GDpM3eKa zmZYCj+WR733|PUe>#!ILl@J-G$xV;7ztWvyH?b@zh%DL=NV-ym@X{B=M8i}WueP>X zaT3dx@x&RJeq2d$2K*4G6=ZltWI#TJkC4?-3>u46*8nLZU5tUrM}NJEepedsuZ3kN ze_UvEz{N)aJkFHiCOtb?auoQ(BLFw(Re+^1DFDniJ~gWWL`wFAA#fOzpkX4ObC-%c z^^`XNcq^t@k87Ei5c_ag-&{h%5xWw>$VRgL82K0~gp9ZT^p>CVlh$CrhX`g^FAwRqL6wq8yGUpb=trWgq&A~&ULkRwI0af46+_H@aWzUxae~) zZ2z0)3j6*5%9=X3Z(zt=7Zx7c+m*vve)wO%3>JRa=i}%}Q<~i#*h4hGNs+X`xdCDHbn$}cx?>bsFdQAQyIGeB2iMzGx zfG2l;+C5+**3ZT`+){}?K60(v?S?2{fg3SB_d{5KpCOGeLtb*=B?n$|;CJFcm&l1* z>jM=h4y-etVerqKR*iWq8D{A$w8}6H{bNGR>R%+`E~lq~+IyS+7_P8#eQ_F`S<}>jk_b6$!U#@qtUOa* zUYS*ir$f(Ql079Kr=q^qBu4cZeYY?+y<+p`%>rp&UDHxB*I|`Z z$IIC5igZHRFJ_IwLiW3XpFMjsh$I1)b~3F^FatK-m1IXwmT6G zKrc+xcoBxst)ot-MAHS4uiDJuyG=rKl9iWL6_xVA&x1txPiZ@LzBMY?y)e{qY zerFLu1$L&Vr;WZ_)k&rBczV8xqL47lK-CSIH(gDvBDAeeZN5WX=8C|o|1pM1W#T4k zuP7F)AWwiZZLZE!Lgz+~7EnJpBxXXkDsH(F{MvThl7N6c8MP16k@Z}F=0WYz+j?VxAtCxJH z48!e!e0~H~2e7`90mb~^EiGlt#j0$pYjvP(0U>RUH_BE|QJP!@Hepc$KM<_qz4-D4 zhJUzj7CA9cPpm&L=LhEgz4<>G53GW?Q4hutsAU|TYBVTd`3OyrKUkFWH_f4GH&aR{ za*3%*ODbiQB>-r-rc!}UOd$FaD`tkK=wLB*!52+42BR)x*TrzOs4|96uvU{6iiG@t zk;I{8mfAPpa{)~v$&#|ln$@Zlo8~N$tN2iEzFfiWC|B?UfnkAi)dL)UafJ%;Xxlzy z4|{5LK&y;nFbEDHBf2q^30dW8NokZsQmzzz3SC{gsEZ`MyzaXZtp&pf3~RXHib!eO z@o3wapql~3SPl;0bS(&-9ok$5s>BU&Ds)2LgGz9K3#$jvGBx(Ad8KLmFyNjt??F`^ z;C6O)wxi?%&@u}KJUw#hyT;9{>Oiitv$L--qJnA#Mawb`2Vjwe=v6GyrleCygWxI( zK|pwuLD&SgdRCW#3vgv1`*3lQNJz;(X++f5CJ+pLIuUp^HC#~5pqrj_1NvnE3!^|c zCOb;HA&>(C5=bdn8vV}&!_k?kgA_~(Dx|GXvy8T;VBm2`CVtJ}g$0dbqMej*wItyi zRvJ+^Nu@1g0C0&@MHtapq^V9U46{B38PL2_rsvMVWK5Yp428;JNI*iC(U4mHmr=?hRR}}wqp)Ke z(i8+{f3!p4RpnFj7D|XMU6?qIX7pG_Rc$w#4;dN=Cq2Q3s&ru@*&_!%z7PV4ND&|y zIkpfFoihpo`On}WLyM;9%di2GnIzNr%(!p_6jDiW(nAhu23M_yne{@2U zdD|ZrZBIg{fZm2E%~X$u>@Z3vOtr;eS0ITf-thER8a1zRN$k4s1gVTWXh%er=wX&H z)hHz1Q(i{3PkO3HU}d}{HmP(N@>)j(NDUj-0G0>;i=daMTO#RFj8jWsDPg9_?FJSU z<4!+&<4|0#r;5$ZZjeKgaZr8}46k6~fln2Fh2!=pV}?RVs-mrrejL^o=(Z+CcxVhH z8CC?f{G4yB&SD97^I2Ue02_sbb6hb-h*+uG?O+Tc6~=;U0UwGBfu!UBS&OpEax9t9 z&6_F`MC;H>5bzEWbCUxx(9|Hgv_ZrUz}sc_kq}f?NNPv%S%MM>HEGJ43SSmg>&$JH zpqSTI76C2}J?H~j?Xw>}yAl?XQ4(oloH6?X6KCuf1Xjl}h6BPaotS1`*aAz5Z2Rm@ zFCu#xD=8FRE9&htX%ai85P7KWVqY@K(5#FmEHrblOl_S-tnYJh3^Cod<0}I3gvm9r zSU+pCvMRY&GpE3cHE@=+y(YsTh6ymQC*PJbuZF*rL5lil&M+23`cei=OKtmU8;e*r zezy4wJG+u>A(cZr?U5|goMyoR5SrQt8!R@k%!Y6r0UAn>Je)#4wT12_`;4yam}=mB z7VIm;b`MKQLXJl0EwGYnD>T;Z8j$uj%c62i{NnNJZe2$1T#}d#QeGn=Sq3}Grcnn_JA78T&J`VR+2_O;KqIVZp{vP1t zB*NO^ir{cu8$=&`79+}q@7`kFkpd}6DM4T1euM+1h+MI|5y8l@Zsd}$TbO`srz-&Hx9F+--ZRip~rBe+`r(4 z*?H4o_Z;k<)3{EY*Ek(qV9(tv!Va3imOP`U!6ADe;MKU30qt=P=cAdOguTafnsV^X zgQI>t*o`xKRo7i({x)Vg>k`~^Z;K)u8>a1ZR@9N(ZV&Crd1ckbFFv`nyQyJ8l}$8k zs9Uh2&zLcsK7HW6+wZDH$DEGr`8cN3Y056UgS&Gr=YJei*L1!f&e@X&HJ0X8AYU7o z-on!grR0ubvT^ZloKIX_HP$~_1a4d!-cmVU#=YdgOAfr`z;oq*b4guex=MPdsie`l zvMI}~$;I5{S=@6a43P&*(a?9EtXw|#%uLC^tTDr~$P~ce1*VZhR>Xdnyjsh|qQZ#W z41jNej7GGE?Rmvd#D$24&vidVdS02CjMwVni?qk@h1$SsY_n+7*TKIOWck6B8KDuy ze)ggJZ;(%1hNG_a2-RDn?ULiG8{JTcCEM=EKD*#F&}5gQcHYngcYRCMz|`ADjPtFAyql+lEA`W?j?7=q5M&@Wu+LvT=rlzOnN5~rmA zS8j5bN(nqQ{Su;o9JA~KcZIsT(A>>;Cq z%^TXXOS==bV7OI-5z4(nvFqQQFb7(UX!ZbAg4TPFNc^{WR2uWsB` z2-uO@9w(6`xhLBDi(+qvUv|JuY(uG+B(7&>@e+}!+Iw^v7eEg9h|)qcC0y>qtd;qq z1TVi4xlxFxFMU%m{Bqlpm<3GeVM+?Wxvl2RO3Wg25z?cnPO4-^$TpssRYpTjYRlYe z;{SaHg=fnelli(mAGPD62rIxOr+0T0QInMECMBhSs9T=YMcC-e?`hMc+_$&3s7)g< zFrf@-hsvjsY&K!#+caD<5b}mZ`+{=sfvnqF_r=%ZEznAXE1DG!5(qcENV){?B2Cx3 zAbMKfR&trG!41{Q2s!j6YJ=-#EAeJng~4Uf>3D^-K<7&9EN{P*@T?L)`-sfqwR}FR zxRvYzvMPn=sY**}2+b_#+lE3hZBq)eyw_`P&4rB*u%A``7Tr8PnzpL+Z^|9EM2-sp zxjw)Hu(YQc6o5qM8QyFCynvxP9yd78{^d!1P;ev+N-72R`EUj+xvh@e-UtJbC@u0P z#jJg-TfviFl)A**ocURJ&2yl^-NL4dp{;#HRC4)s!d@IohDT7=4N9Lij8QA4V>3mpr%jlZfIDWxUelA;HrlVY3f1 zh2p|SD~3T9cOKQ$2RYzH-f7hh6j33XYqp=hz5X7oDviBK`h?Jk%*;Z%Czj%_S5x~z zV`_%+A$O5Z2OY)kyHTTQ*SN3KL9_a=b`L5}&?D4IgLIcq^=IGOf>1-7k*9f@PN4ob zdM03?(i2q}yrf6c)8>q`nWYv{n$0Q11kHCN{p&+iK@$^GdLsdj!}Qos(!cqrftsLn z>gN>ef(W2oSW4EfW4e%CZAK zImr4KN2VGR>zkaHCaXY$W4RWMmYVuzB>+=|ko^j_vKGvqMln#yUruS7?_!?KoX@sl zWn%(P`{?ndFPV(ebAwwg&Hx)vHgQ4IePA0}UdQT|$V8ZG&CjT3dEuIg|1;`(`OdO% zxN_RtcA~moQCZ(KQTHS5wk%yRvpEOSqi7nRmFbHg3+8Cr}CVK8KA zN|u+Gm!EAt9xSS_7Md>Xpn$ck5K^t6 z8XQ4B?JZ*0T-#O^GT2F<#^Q`7D&s=Tr3}by?ZyyrADDc|7cfdzQ|gRNVJ)HzP$jz{ zy;|)(khMr*?t|d4ltYc`xEjP-tEiiHy^Moh^hz&XkpzBxYqhKqbwtLe< z^WQ0#`aTNRVQ4rOQFOKtF^QQ~`e!gSaWEEFDoAhD6H~K@vV?E=?jfjF7L{p57(g7g zLc+{Y^p>{T%CwuoD828;FBs z5Fdsxc&dt&Y^1Ejh2Q!rOmhu4+>te4vU8K9-h>e(2eS9_1|lSvv^8J`wPlzq1`0?f zga~{MA~}0NF8eia{Sg(}c=;IfB#X~a(5LnQROCKovKCFQKE`d9WJ@Iikj3hnd^m4U zj@hV4t__IpODxAQ=8=wwnkswr3|TogJ$7gc>Gv=2mJH8r~^Yh1hT>jQ=%+%1xSouWc6Wk~gap#R% z_0_lUa0X9^Zc>P1oU6FAgX=`!5yio^RCKiAo$HUS_vD|5o*R9=%1Sig_}Gb7R+l5! zcJDWS9bvi{?=L0{Cg(ujjKggJ(}8tlXKh7_3B_!-JTD_&a^NKgUUJ~6IM8dvVo6<4 zP`}M>*o^X28R{iAZyNds+_yjJk#_GsKnP%%W8-NwOEbH z@DtRM@3?^uya|1csJW`~Q9m3W+X#h@LOW90tno5zLfduuXCVsg40dKKv2E4^!l_E$@ z%EqIni8!y-GJufYA}ws>FWH4P{fDrtRuM=h=cFpz@GzrBNV2`tyfHYV4M{biY#be^ z6E>cKFg3z$f|Qse{+T~ucCfht_9H!p%TW3C^zmq$+)TR!jk-5gpp*s*5tAKdX2JzU z)9zEH?k}UTz!#Qqx1}<@p&C)ai8@03!DX?w&_ZDWn*)?4T}@qI0*7HBDh{BkGj`=G zq+z?*#wG=P98Z$4S&pU~Bd#e}*`QVm5u9CqHb$1ei9YWZcm}9|8HQNiF84b+ZTugejX3&#uUWmNyuDudYa-yqQvxOVRFO;5U z9E=n+tF>FKIiz!KrdYrtx+Yn>?TJho&jBwwrgw1?JGPV%Nk%B+Ik*G0WWOBq@ia+5 zB+YmZ34kn}4BFc5=5YB99QtZJ1FokUnisKDu|7L^rgblXMyJX^!kWm>`rs4k&)IHPY@oa`>1ceL2PJN%kXhV3&s&Oe4;ej0ulo-;zBg%WOG1TtrGoam~ z(jv)H+Q7$PjZMKqU^c^DlF%K_)+{HNe*=&mYJ2T`{qN6UBH@q}I(NcfL$PcmKO8EdaZhCATOs_ar%(tfi0fW1 zL(G7IycIBkEJ z3)`NCN}-(^^rYx(M%rn8x&v#i*IWWCYAB94T+rfZOp<}QyJ(G5Ri+`7q$bQEd?T5& zQlq*W97K#6%sd}QVfv6pq@59}?`U1WGvuSg`X3MqXk!XyykvBz&;b|E&9isIlBnfG zM}enfZRKx{HIGWTpxnsehTwE{8Qek8>D6VaNDO4+!6#rRDNuUaDwx$jkD+TSjtuJ6BQavODGCdcO!xqJ%c|oCK zU}~w>nWo}&q}_r-vDE<-GF_vQG^nB7oTRz0OmA!uV&QQ#1c$Rh(EQ-yk#=yBPLrCT zkXn*+yQ!nQp?&MT;&9rQs^7F!)!3w8t13lsPzF-0Gh&$1l$)=+=h4X1%9^ICS~$TR zKOG?s%hJ4SegH7FzvvA8C^W(sRmRh0KC%1&kPF2!q?74pLB2~NoNWOjwi`pkkU=oi z=6|)-DZ-#cEZY@T{uh>AhtRUdYV=s0tXIqQwiy879CH|%%as#wl2Qo+OL_(h3DfjJ z&uXtBz9~&rxUB|}weGCIAV*w=KCJ1tlv~j#6b3kS$KRK7Px^yq+WiYF_kVzK`giUo zf(uoR0yLXz#~spFYhT;ixc{%cCjp46>iP|XLMEV@MQ&)K87(fDN{EbU8767UXy#fO z;(|-4h-{;lxuu1fAt00G!VplJ5F(3dZn5~erXvh$f`Kq9!pJ)RIrqNz=FKnz1DW}K zKTmvf-@WIad+xdC?&qFM%Q!SoxiDCh`yR2Vh{hq~tBGD8Y=u_iekd`%i291tQO|Jt zMA#<{xBxG574lM;sKlVYAF2_iEd%ex80Q`WtbnD3xm7Svn|l}ih>=NeR9_?(D4|J> zn>q;bz`_T;xp^u^C`Z^|iCIC!O9%=?en%F4F+aGa?>z+YBjvlUcC&)A@~0l2Pt5#$Q97Ueq<>oPhPjs#a_0&KBu2#<+84Q zGy3UYwmdvRX4oRpZ#(1OOtn1*v<(Y`dz7CD8}IStn>*qDWyf`n?>xKiNe_mx{Bq=a z$9Ejpb!S9RWIV%&1~KC9Xf4tNIz#X7OzVNCeMDO%v*vue?z^^gzuj#$<+3ku@_4((e?x3Wo@Y>s2253&#N~N9-b>&izFETutv&{v~Zw>11%i*S2)m0Q{xw%Qc|6!x~jGQrzsF=+Ziz)_)n*53jd>Y z`>(jpEmxJFE;B{z!}b@~8Z*deJ{5S)R=)Y*&4hfEO3=_YL^HGWV4}fkAnkCX&O_F+ z9}LpJhvjccln4yFlfPP*@Gy_w9%Y#)!#u*BLA^>EgJUduaHtN)SmY4U)dM)ZiozH9 zCRWvPKpi|RdhDLFa6g?kr8dKi3|ZC4?egox^{ek?#HWEnWPJTV6Bovx*htn!2UrJM zj@Z$5k8w~%;b3Zp!wn9W5kgEKicHRe(_rwx87_JRZLt3`6IkQ@SZgC(Wj0Oh4@r6i zOu@oR5}a|ffD>afOcqi-guieY4zRL!P~kU_eu0)Tyiap*7VuG>r`s|Z8<tP5*2O<^)U5v9uLS3<#F# zcr4B>5yV`pfxO*nEY&Xu1C19ikWBxKq>>|?wAkpU;oJSRv7u309t@6JvI5O}2_5E1 zS}v5XcW~6AL1R7>&pKh`2LjcVAO!`pFJx*@zjn04cKB(j(*2fG!REKpn?wt&~7> z354WRF~jmUBl?w`{q;-xX5%8lOIV_elar^YxSJ(m!Nw%4tVy-XhpQ8$nwwRtuu{sA zu~6xCEix&f+otQJw|{yeLvZ(&z&dOa zDuQ7^1l^(_<0R+iWgBm@m+8fY!|T{QIp0!;X5TYi$-l(*Dljv%+C3Xf57Te#sVBcQ zf+)MOh$P%pY#D@Ny*kaQyJD+W4LrpbukkAXSzyloTXamMhXqYJq#P9c>o=}`(J%W& zUQ39Y#al*A$piD;PtPMZ8wKVO1HgRvG#-cs%u6i{$X>jRx1l(in3#;$L>0RHc3Ed` zlA3=siZ*B^IfXz;L*-G_$)R;+0b0v+zWu=os6^bLGY*Q93q?MUTq;`XB92MCU$ z0}C{%g)TYMc^e>L@qZ(t z0QVt;*9s~SsYsejkvaQ;8B#yzTd@bEnK}F7&rfn5b}B_WHM82O#H9DFY8PBM;oBR& zvm*78X(YCZv~E=of!5ntb7rA{LYy==Haz;HX^MF7;H}FP$>9~!%ME)+&%Tsl*d0*x zFikk$a0X3~=zOaH?I@eq!&z17n`YEaPW)s*SEG-iZ6(4PjK$g~hbEqzV9qt0DMA*K z!2%(p1y$p6<>x{dg`ll*ql{lrs!gg6O{#V>&Hczz@tV}?VcD8gBXSD@YHXdUnX>-B zjS7apRnW*eJKxIIMu9$3K9SpoU!pprmtr)p_R*xM1uVUVNmDJ6<`Ohhy62x+Qv9!4 z|NQrfja8>*!Ysu(wY0QY(y;K5P{SseMzO+vs`1D8#>-3+Q7|DlWtgu;U=;tpz$Ad_ z*uiwwzOe!~YKYm)>8$a~ckD@$WC;Xa4`dJG-)CtPHcbAzhz0xJY#-d1s2Fb<{!YI{ zQ*3EfxSbqOLw|(#3=^vMvmKFkYPA{$HN&VX9BLsZRHDiuF~(RM`UY;!o$SD`Es7R)LuXYKIz zFWwg|9d=VJzIoq7C4+?!V~?eT5nuCo)`Mx&N6s)i*FWzV=J7i0C4TkJ>yBaT`!GzO zo$Eb%J^7A=5xxFo*l2=61mEx>As?+!r;_>75&x}&8@Znt88$M^G0aiMSa>|~W*GeY zhG9(Ecx*dxK&M%!+m7%Y=;QP2^Im(j>1Sf3W3_m_w$#QdrU+8#B=xG*mPki`rz(oE z{MF~^S;qSCa|*@gUT)ut=YG>WV#2wQnC;)3E3bA-D=h_ck5^U5+k?o>DlEcsEVG+& zVDB+45cqd!8E}2sGD3RGtAztC9BARdzrleH+xq&4x~o*xOX&f~2Sh{YiIz)(jkB@= zeJbM-{y|@HHJlcMzw`&Mvnc|DPY;svCfPxMkO>>ZWppZO4DccN8P`g92nicY!aW7W z2~KF68vPlIWS*a0g?eZi>>_2W%XwRm3t)u0`+y=bsSHP{WTd+lN2xF2Sc~XPk`pTz za3Jdm0n<~W!AQZK!kpUBbLOSWL!p@{_+v+}VgoDvJXiw`2aL~KV{!+x6=Xx0*hZ@^ z0nLXrh%7Fts18n3EnFC=nlWR>ppx-1Ni!9`e>g=fYqL9dmBGitz&udDpt}szdIzW# zz)3G^Z9!=)3L@(pTv1xKicpG1L*VHK*DaJSIP9hTQ99^WN6(a26Zns}_02F0>5lNM zkt3#CwHgY9wGUvNMo6%b9&TdIjfqwB3hL#A&EpH?9DgD`k*b%J=x{U5ROZW&VD30; zD|5^lW}`+fKI1T|Ag+{rGaX4FyvQea?0XUV(ip68;@w6;tz@#%#d)kY9tmWaHsqJbP2&&YMEY>#@BRV^`P>4bR%2W80)pfkcM7s3hWLI$ny_K1QV=a7c0USEWtMOlT+PM5o-#% zK5oX}Ma&UJ&h@Z5D#AXtwz(8@h}q2Z+BT?p#oOSqZ4>*Tj3rWKCbfAx-Ly3I-=Ylt zZ}Y#n;^6hEu$!I)Cc$$H(6obpR34nYPipuxDmNFb1CS@4^qM4jUQdW&hV&5-)ES1E z`S{JN^1%UyRssnp0xw-eqHwC6@L}6V*eH?I@(GL{=@?l;yjfFd8RSDqj1!3~X!&Dh z1O^RYs?v#*48RZ-`NC1!B;pck2}Ae7K5`Ofp@=8H0(-Dx{SgWC3jq-3n|QFV)+kPB z3_=2(5_0p5m|@C;=@#-3B*Q=8;)LSjzXX%RwB<64%JyMQ zAQ<&AHO*?HGvp?m9+9~uc}ate%mf9~!V-004jm`3JtwU8Kt(9pDuB_ON0!n#qB@Y9 z!>dwjD~(QJ^k>PKBU4Ylu>k#Px-kgOj~jZi15cbc3%IF2)fSlE)0;Q5*%sJy6Hc84 z%s_@M$CTM|6+3g@X)vMZr}~`LM4_C)1PG=s8bz9^w1WDp?V0VyYf*?yA7edJ76HS8@vj4{z3RS1(h!<=afF1I7jL-QeKh zK_x;PhmoY6sh>}3chYb%gDa7w)ITw!oS}QPChBi$wZsV)OIRy`wXVLUBwm9r{mX>) zLAmB#-&g-@7-fULC;P=V@9fB(fdwVVs8qLF!)1_N$D#K4^h%Y~Ztp^CVd8L)ih3fsssZWBvlv=K298WbghQCoso{aTJo`_~cTHtM+$bsFs; z2wei7=g^C+`+ttgEf^{I6!=giw5ud!h+}~DPdR=(nu_sjV(e-QF~`v3SdjYRLYQ;-x1_%3?!*c0WVBA z-W8z+0mi_2^Q68D$Y&fx!lma}0v`(y2a%Q)2o_q<=LN@8^LnN9wafUnN5pMw3+pa9 zwU#6I=eIgnEpKaAmJg+D`ARcBX2|n>MZg(_W<6eN|c+Bp{cU+ z?`y8#zE39hO;1~-wQso()i~SSAE~P}We)kq$$ZehHq?GV)6s$)X`3GFABxe0dt?70 z3Iu5F%)W9|5b2+CKD_H{MOt^4Y;SLGKj*sXe&Ly!*?uls_d#gy7c9Ki;@C3;Uu5td zG6l!3_i#*0G}3Evv|4~;=&@tRf~pEU{q zZG^Fc*^?X{4na=bUVyTKFHcYKEn9J{0o0YnqN6g2EPepN{BFGNaHj*?9w_4kfC$pY$ru* zc&0)TKYM^eksO(0G}0vJaH(`^_D52wpUYOMG_wGd zZS2a5uoxRo*MK@8V>&he6{u;K~PW#&iYAZHSXD`bT@Kw8XTo-PxU z3DtCm4J2bVr2#|(%3&+q=JwxJ8kiZnStu0ThNXZAq)sqUB&cD$X7dz@pquAi0hbKR zCHOW-y)F^HBAD`WzXWY!X2DE4{%STFH&VJtfUwq^Tg8Z!>>vz56vF0v(4UD4QC$@_+;2IHtYPGQ@08Bz@ zH09x$xk`iPStkbn(;|&5qIi_nEM)x%R9E1E3|+zI^gEGS zzwnCS@XYFAnP(=ZTbh^#5Qj5L*BGg{i85l`QN{{>BgK&{S&D7YVxqb+xlgI2ngF|0joZ zIvTwaVXCkD``3m?X5PRtE&VyW=j|xhuCJCCpTjakyE1;xu2C?}!$-zdq&BgUauSR$ zn5SlvBL%b@rl9ozsJCLTE@L_!UuSrn$PojIf*w>T)B!B4jx6x@p6$#yH0&QNftagnp zM#G;3B3?+gQ0*3UyP;T(K21#^E)y1uXFI#819O|R#)g#Px+MK=#+!|51q$CGwWJn_ z;h?F}tSJ<+y55)PHN&{4r>{2=0l7`H)sn!2Vo@~~g26%_Tz}9Jh2F?R1bBHfB!fh8 zXyy(pL}sIQ)zy0w91utqz_x5U)L%6+Qmp8uE7}Llhj)V)E zCNhr%)?X1fE@BCUQ<#8oEzShue~hcsN#B4}@ZIVE(0*hg+Ui;3CR@e_`Mq+z&0mS7kA1oTZUH)30IAGzeWm7@-vR zND20R=z0qLLlHJT4?p3cR@{tv@Og-&unf0bF=}85M6JcoLGVAM+t=`Z3B3?y1;VN^ z{akzzyIv7o@`1hpL9TjD0k0Iy42Gp|LQ7O7sK|)8Rv-$ped~>6e1v2W179`2wVD;~ z`H^}FGqjWK=OH55aB;X+zV_=N=3w*^(W=L4P$-N%CYo)F?u_W}`thSZMnBImk9j=b ztIzje$r#I>UxkH@H-d%fXCVP?L-Hajuf||bGYnjzIx?)!&M^#gY`YCJz^Co!1N#qr z|MP*Jm|3Tv>E!c)&yh|(1DTWZ0RvAT{m&;(F=~~1a6Nn>fc zD>bT6ae78$a1Se7RCn6y_QOi7(R3audtLY89>0I_={T;@#PR&*O<1L9{<-)@lV~b{ z-97z#9-12efx<}@vPPj$E!6s0@jkD7dhmCpVhT>+R${Bx-w+OJsIPErI}_2weA@(*ST%%_QHm8 zK*PvhByqBf0wU=o-A$H^D_l*bkU=<^`nI9-zF4|?Kw@=;n}E0(o`glgw4zFX1i%(d z3_vsv1#2UQyDAjCU9$NpCO^Lp2?-fOV&jX@04QXfo+6T=PXoJG307%wY5kEfqY4G`!aMR{iQb9iLHm^s^IL6Iyb99*g zrB<<;Yn-n>2U#6WOi%qLpwn`?f;^q7k|KbWOAa77gihVWJtyZldXUEo_=oI+ zCX}+6EFiNB%?Ke*VHMVNQ|{>KO;7}UDY9Y!T;)m;B|#ttmlR zGb^)_K2^cPwh|jMY?27ASE8xLg@UJu%M{q5;q+e(61;v5WDaiHahDM;H1S33Wf{M_ z)(lLzh>?MCl;I3hk6Glb8Ob~?P<>{>ia+q0JaP_&MSY=w1StPHBLAcUp|JIftVaU_ z^$KYs563?Vr>R895EfX9F`;tF_LETrf@&$D?F%vFrdNp2{2(wdmOvFD)W{1OAFBWA zLW`>khLVEB`sa~tYK%_Gs^GUCX>jz;o>UXUfa_{O)4a4Dc+X4vlp0M@U=4~SVH ziF6&DYxkhZUTlKkNeGN3##Je3T(X@^P+VWW;C@0Ah;dbqtkduo6R^JH5g zug-^P4K+Hs>J?OHMm?8q6f{)d^EBU?hd4P|DxDm$1L`qF%2NbQ`ow}8Qt5&PaL}U> zhxY=Ms`}JTiP$QYVhW8p!i`X12V)(V?8y;Zrxv<+FOaIh&hCYTv+s?*n5qt{EGtZ? zf4?Py)VtvF1!$u{No7au#L`lTX6)9=G{9%%+DbJj_!zsl5;TAGFRt9;>{pXh=In>Y zx-^>VYA}B-gTm}uGF+1Zzjg_rDij=;l9F)1;F`^`fq5_vH@s%^Y@P!?i^b(txGE?tcgld!aNt5{_;ygl;%-O&uj9f?q>lZN^}8!wTL8UrmFoCy zMqJA{ptN(3`If>k2I)HT^_L~l$caW3#35|tSIy}Q!07HY!s5uXv8I}D&Y{g#?JzPl zZ9&i^CQerS?a;`0^F(AE%-h=%;aum+6@?-$>y$#@0pjF-3a(3z(CZ?@lhq-{hV_m0 zpL`$tC?LqJ2K7Sc!2=>4pzkw~aD9>H*{1K!e`P>5X>fs>=QJNh-{G3au4V9b1*aT5 zw;FNaxTuh|bKHW!VBXdU?|6xQ08EU`3ETk_ZerOoSd&2~v3zTbbMK_Va5mBJV}%jN z{=qKMH(&^vm6gqoLm!1YQkgER1ud}*yL^3tHThNF1|Xi}YRdX@{mKSoE4q$hhr@SF zx`77ESQD0`Qssq!J}6K^&uwI&1D62mL!0o)yaJ=fLfG7ai5N5&Erci@A&%5Q0V_2c zl^i64wYdf&gGYW@afI^{PA2LdUnTbsc6Y9cg?0brWT=7O3qWAXV46f!9j##KLameI zvI##n5jwK{BClLw_`l36_g7Yd+HEuUnfd|k&0WrioYTeMZs3AdFI)~EC-z%p^3T~X zB`TMgw5Izx9qB5Xmo7Jaws=S86-{c6UNU4=U`Xc(nW?{LBBHL87SUA=897TOgIt2< zed~gJlYicY{;mh&zL^ghGvNBBlwav;dh3zEVtRO3*>}Cb5Tbtq=_&<}J zd&OW3OqU(}A^{J1tcr7U;Vi_JoZ^TSI24c^9qrF=9O8wSGlPNAAtHokIDyDkoPA?q+Si|FAk(bJ`*=rf)`f>+XK; z_u4;^BYS#6sjT0y%`%pq20wNN-`wX&&e8C%=q_C5$uLibjYo|@hOz$g*^%o#JWw;R zm*e+e?feQf13@nk0wv^@Pmex3SDR^6@O39It*XQ;rdlhNI_(|keqLhJN!;VxCludl zwf7WWd$rp0;D7g(|}U^SN#IS($(OjJ&TYa0?Tg8~1z#EUGj8XN9( z6%-y#xpZW>6-{wh#7D38p7uf zG^M4>ksPv01Xo!2CaRj%JZJ+7qjKR|!BEr_*HqU*Q-NsPpguL;0hFkO3t$>;p6d~t z2Lx7;M(1yf8;aQs(%?AlMVjC~Bjv&-b{~|!kRq*O1)?zZ0MYPAx+)VOi%j?vZ##_L z;JtKKWfb`%Bub^wo(Dp$<9B61qIfs3ny-NBTq)cq2p#eP^Xjy^r4E|eMqoRBk@WZf zlhrQtqO_{PYNuDH_{~tEZ-doN2nZXID0ci!@-*xbtajK`JfIdl9x|MVxY%C!H|#uF z_py2%gMaPPNnj*qTHdnDMn~F$rrhVAo!^bfWpyPQMb74j@IH zrtfS1*D&k|D{I)k@Db|m9$dA1aE-Pq8*o*S(W)r%4`edlxEo<~yc+syEQH0YU43

zOlgWj_ISE*+pEx0?FYg*G(?4==8)A#OoGP3YF6Q8LlpGdK_H?tk3~l#H4PT0M<|&BVZw}qG?Wlo%#aUJg;YrD|!b z+`Q8AansCk`a-tS7r-6YIdfC-tSzC1%sFj9NaZ!9YX22`Uxs`tR+-}rNJRT>DJj`% zH-)AaPVdSf7j(J^%)PwV-8CgQPw{w4YHpD{rEzDrdXN&@3%u^U@W6B}O!00bS4b_x z583J_^D>YxyX=NCt07~PqF5~PO3WKb#~_Ht{qgdJ z)d5*ittUldUmk!HK#GIRR0$fL0JzkC% zCC)`oRL-Ol!&0D&>@d-=fHsw&7i119A^MR=hyuuK(A$39&NCu^`e&Jw}5QZgdh=NvO z{XCK$5ff&HDXK}747%9VnT=0Y#>7SZ&;XGx9CX8uR$6GSr23)!S8O>BV&w?h4cU7WU9gr9gDYcC!bO}9#wBI|l>TZx&?cmH zB9~#HBk8~-IlvnvKr$mtBaUZMsv;HP_4g_`gu+xPN0jr`uaeCnO%*w8((U|+e2m`I zJ%oc7pYF2w_{&q17r$4D<}`=~8mhUGZMJmWW+T_*-bFRELWCf;?{=W_S~b4V=mu`p z9fV?@TZ^xX5_sLY0Q+^spjDwv(O(0M(|-q) zM8j=*3b<01VJsMz6U%qx!rj`JAeCywO%(1HAnq)TiSP$2F!kV0@Lr145c7R*5IPkD zmLZjz61-yL3>g03cY!7)xPtSpKb`M{-dyJ#kXt(qU&>al#XL(ZAdrSxB zd8h8H=E(PaHS6@6hzXtpvj#>?@Y(#%?&#hptSh^%KeXODJ-ou<$Rcg}{!O3nNyw|c zsLh&MS^HM#meB!Y+g?1rJZ<9gyYb6|)EnNq@m$RFX+x*qeQvW;;bxbhAW_j8@Ap@Z zaDHY;*kZ@3?`ylrEG^rMtd-sMrc0I(a+U0-JLp*QZ>{fr=>=fXecx9K1 zi@P`>Hv6?VJuM&ixaTmk=3L^L%byN7wX*Pw_P1OgKarMUcj{x;Xy=vJ{D<}tT?@3` zb@+6U?Y7yW(Y8ab9`6#FTo`_GjoW9RGyOmNWm$6PpAN4WC;s;El{;NChUVCYzjI4| zRa|awS-x~lo0-3KUNGv}ZVM(2{bG~XkbaW~%=~5b+HXd=zy3?2=ayL|@mI2csVLt4 zYVqgZiD?@bEnmF&z}XEOW?i2id8LoIJY;v%FH}cy`5$_QIfRx6&agUiJ;&XSj^6&g z%z;w-zn3^kS$zBCTJfLV?c!zjD;Ht&>eYM1u=opJ3CS6UZ7AF^*%-`7&Vvp-`0 zTU+~|)@`yDugX93qo;IZ|Be0TynDX?#xeaj*dN}loSkxZNAT1|u!q-K^7+0#hdw#{ zPQ=17-Me4iR1&+7SzqkxGp=2i_MJb<+x67ac)8?gf6Fed=0_#oZ5#FMh9A3IKl{Qn zE54fin9^dEwRMlRZET%xtvMOfDq`W%Hr89WMhs{J@mpE88__OvxTR%3$-BR;@Lc)K zzP%cWJYP9?Q|5^mekhSYY1wYlENSkiPrX@@A>TCU^2fuym1o=j$_(l5vUcK<^?e7- zSGe_)ZR+2v=pAomu0-DbGw1K8ZwdSG)k))IYk&Bt=$%=c=Uc3@m#wxx)_-IFcPDmg z>$$dj_f-~(w49&%?)$|0s5CfEKH-UdKi+KD{@DCOSH)dAPRq@m(B5-PB9Jz`i|;nb z!G#Fs1S4BBamj{#AGe?UT)#iswQoJ(o}&L|-!>NFRVh7xxb!3>{@SWuA9?@y`k=Qj zxBiIfB4Yg74WISwz3rd0ig4Pzq|FfJ%RjaoIbl}Gw-U)BY1b{wo_rURSe$tATi{4P z5hEG#!mF>3igdi>6(Gx3oa}sVXI9d|m6G9>Z_i$OXv;HaA}lPP4SVa%-lI|J=NP+h ztbP{P$XsP1x51KFg)H#*ziO1eKOfI5kU6|*RW7$0Epd}M3}8ZJx5Y2IUtJ~XX+LA@ zp4eS+FjQG$4GwMOhaEa}xK-f1G4RX64M!$*di(ySj~DM5W4nE7 zar}6-;`aH%@2^kVv3cl{bMZ@xVl=fG*9xnm>&`HV}J$6C9gj38>S zE%wKfE>2^Iv6Mo6QlId6@e9W<$Gr3Xk25E?>)f>V>>&z_=CQbAG2r`_i*))3=$zTIO zhtyrNPmp-NiDeX1_MOaIfM;=USjM#qR_?@wFptaAt9?wo%x6U^y z{UwP-S=_Y`rueFVAIBUj_Ot(58F=@!DBwbomo#AVIEG1Cv+MOqMjbYJllu>jZ;%|j zfyL9OAGkQVSmidia7A|IFUn1|_n5hNNrFm=&Ge~b-ttYY_7TPYPN?x^UI|!C@-1(z zSy$sO{A7dpv8P%;@nT!YckSQ&alpLE+20?%us_OU zUEJ(fw{&nxRJqB;{tI_j@gV)aocaE<8Na@+i~00fc#cQQncRX>zgdFV?`1FT{ahE{ z!-H)O4Wr3^O?37ab!` zZaldm);Cbn3L33MWzf&e^tn)eNx$oPjE(9KO=$eV!sGa42-q{byWm5Vy5!=ayvq1M zW$v(7FHV~sU!_U8aaU%O>#+{>Pkfl%b0GB#6YG0Cp5?K5;|F7)Xgt>S4-fAx>MvUf ze=rGqUpfa;exc)U7BBwF{yQ4u@`NWGiYiZ)F``57jb0zS6?PMT`+lz?8D#tA%iyt# zXjx$NAVCjHC_Aqk#=!DTCo zr_I|DP;$ONllAdnRY;{;&SSQHsn_e$Q!<9RcE(FObuXOLVm(C5z++k;hI!f-AkF|Q zh=-0A9!1|*diM^6U?3-{MY)_r8v`gyH5bH%v!x7~NG*e+UY|Ld`r3&yoC z`gm-VsOu(qx9c&V?pFGKo3S!qYA;^(=dbz4@5y_v9`|Ja9eK}l3b(7H22YsTcA5K^ zo7#T3rFP$?`N{7b7~%O=oXFvcp1;aA2ONe;)SvgGGF(@-{j z<R`}Uur zE8=T`pWd=o$t;k&Neq?ModKX`g=#X0L+ZXS0>FA81! z@rtf*pGcTf=6L_K_=GsWZ~LK}&h`4^$gWD8&#X!u)>gK2ky~Zl8apE9@GV8r`<4OY z#Kqlh_q=w<=Cx%nAOEG>HRjJ-b{Cdfoqq1MXdkQa3!eZQndY?k*G+BPZCn(RIe&iV zl_ziS72kBbCkt`zwlgsM+KL@#@+(e@y+k)8Z`gh&u^Z8?s>90Dw?5sF-*?0X*=BJD z3;-h+x$G4WA6^i!!@J*o*%GE@-d z9dm8TbFVCxw4L^5)!s4gH;-f