Paul Schmehl
15/08/06, 23:49
This is a cryptographically signed message in MIME format.
--------------ms020403010709010101070901
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Bipin Gautam wrote:
> hello list,
>
> This is actually a DESIGN BUG OF MOST(ALL?) Antivirus & trojan
> scanners. ( ROOTKIT SCANNERS already DO THIS ) This issue is a MORE
> THAN 1 YEAR OLD stuff but i see no fix till now!!!!
>
> lately i've ONLY tested it on the following AV & few other spyware
> scanner & saw its still NOT fixed!
>
> Kaspersky Anti-Virus 6.x (latest)
> BitDefender 9 Professional Plus (latest)
> NOD32 (latest)
>
> OS tested: WINxp sp2
>
> to keep things simple, let me give you a situation;
>
> if there is a directory/file a EVIL_USER is willing to hide from
> antivirus scanner all he has to do is fire up a command prompt & run
> the command;
>
> cacls.exe TORJANED_FILE_OR_DIRECTORY_NAME /T /C /P EVIL_USER:R
>
>
> next time EVEN when the administrator starts the antivirus "system
> scan" the TORJANED_FILE_OR_DIRECTORY_NAME will be effectively
> bypassed as the ownership of the directory is just of the user account
> named; EVIL_USER and the antivirus "manual scan" is running just with
> the privilage of ADMINISTRATOR
>
This is similar to the problem of alternative data streams.
Essentially, the work needed to solve this problem isn't worth the
expenditure of time and effort, because the file, in order to infect the
system, has to be executed. Once the file is executed "normal"
on-access scanning will catch the exploit *if* it is known. (If it's
unknown, it doesn't matter anyway.) Yes, on-demand scanning won't "see"
the file, but even malicious files are benign until they are run.
--
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
--------------ms020403010709010101070901
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCS qGSIb3DQEHAQAAoIIPTjCC
A9gwggNBoAMCAQICEEHsHz2nFAeWxPbVDN3RD2UwDQYJKoZIhv cNAQEFBQAwgcExCzAJBgNV
BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1 UECxMzQ2xhc3MgMiBQdWJs
aWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIE cyMTowOAYDVQQLEzEoYykg
MTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIH VzZSBvbmx5MR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4XDTk5MDMzMTAwMD AwMFoXDTA5MDMzMDIzNTk1
OVowgeoxJzAlBgNVBAoTHlRoZSBVbml2ZXJzaXR5IG9mIFRleG FzIFN5c3RlbTEfMB0GA1UE
CxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7MDkGA1UECxMyVG VybXMgb2YgdXNlIGF0IGh0
dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMpOTkxMjAwBg NVBAsTKUNsYXNzIDIgQ0Eg
LSBPblNpdGUgSW5kaXZpZHVhbCBTdWJzY3JpYmVyMS0wKwYDVQ QDEyRUaGUgVW5pdmVyc2l0
eSBvZiBUZXhhcyBhdCBEYWxsYXMgQ0EwgZ8wDQYJKoZIhvcNAQ EBBQADgY0AMIGJAoGBAL/q
74frHgrBAPkiEcHRwczbetq+NtJwYDBg5RngUy819MmoKQXW3j 2d8waaZH2+0YdUeJv/onjx
+4erw/yHTMJJQQ3hwNKl1/x+/0JRTnTzAdVoc6VdBDH45iklY6gjmkRqgYsPsDnx79tGWMO6
uM9L83rBokmVgyNDupsajzKFAgMBAAGjgaUwgaIwKQYDVR0RBC IwIKQeMBwxGjAYBgNVBAMT
EVByaXZhdGVMYWJlbDEtMTQwMBEGCWCGSAGG+EIBAQQEAwIBBj BEBgNVHSAEPTA7MDkGC2CG
SAGG+EUBBwEBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3Ln ZlcmlzaWduLmNvbS9SUEEw
DwYDVR0TBAgwBgEB/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEFBQADgYEAUwm 13LK2
idEgUIPJOHncyAiySb+4U4Nvisyy5Hp8/KPoD19hXl+XBJUSWtKVASLxvO3xVLZUplQYoZ1U
vAZpBMcCITeigjmIp6ygn+iDGV2SSDkaWYIkIEO8hpUS3IN04e bjE75qpIcAMTEjByWbr7os
UZEOWaajF4jStM5UFxwwggVzMIIE3KADAgECAhAdMJQ44vbY+s cnxppFEtDAMA0GCSqGSIb3
DQEBBAUAMIHqMScwJQYDVQQKEx5UaGUgVW5pdmVyc2l0eSBvZi BUZXhhcyBTeXN0ZW0xHzAd
BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBA sTMlRlcm1zIG9mIHVzZSBh
dCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTk5MT IwMAYDVQQLEylDbGFzcyAy
IENBIC0gT25TaXRlIEluZGl2aWR1YWwgU3Vic2NyaWJlcjEtMC sGA1UEAxMkVGhlIFVuaXZl
cnNpdHkgb2YgVGV4YXMgYXQgRGFsbGFzIENBMB4XDTA2MDcyMT AwMDAwMFoXDTA3MDcyMTIz
NTk1OVowgfQxJzAlBgNVBAoUHlRoZSBVbml2ZXJzaXR5IG9mIF RleGFzIFN5c3RlbTEtMCsG
A1UECxQkVGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgYXQgRGFsbG FzIENBMUYwRAYDVQQLEz13
d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTIEluY29ycC 4gYnkgUmVmLixMSUFCLkxU
RChjKTk5MRgwFgYDVQQLFA9NYWlsIFN0b3AgLSBVVEQxFTATBg NVBAMTDFBhdWwgU2NobWVo
bDEhMB8GCSqGSIb3DQEJARYScGF1bHNAdXRkYWxsYXMuZWR1MI GfMA0GCSqGSIb3DQEBAQUA
A4GNADCBiQKBgQCrBVCMoEwZGjvluL0Zlb//jU6SQzTT3WoQv6lEUYtCHflUzW6KIs6V5lGD
I8c+qq9E6dkyK9mzpLFFOpuGuHqHghUEOIL5ItYRIui9znBYtV gKoJmx+Q2B4iS2M1yGDa1a
hbMHtSX39s3vbjv1Dna7ouh3ZmPFgO2hYpdGGIYApQIDAQABo4 ICDDCCAggwCQYDVR0TBAIw
ADAdBgNVHREEFjAUgRJwYXVsc0B1dGRhbGxhcy5lZHUwggEkBg NVHSAEggEbMIIBFzCCARMG
C2CGSAGG+EUBBwEGMIIBAjArBggrBgEFBQcCARYfaHR0cHM6Ly 93d3cudmVyaXNpZ24uY29t
L3JwYS1rcjCB0gYIKwYBBQUHAgIwgcUagcJOT1RJQ0U6IFByaX ZhdGUga2V5IG1heSBiZSBy
ZWNvdmVyZWQgYnkgVmVyaVNpZ24ncyBjdXN0b21lciB3aG8gbW F5IGJlIGFibGUgdG8gZGVj
cnlwdCBtZXNzYWdlcyB5b3Ugc2VuZCB0byBjZXJ0aWZpY2F0ZS Bob2xkZXIuICBVc2UgaXMg
c3ViamVjdCB0byB0ZXJtcyBhdCBodHRwczovL3d3dy52ZXJpc2 lnbi5jb20vcnBhLWtyIChj
KTk5LjARBglghkgBhvhCAQEEBAMCB4AwdQYDVR0fBG4wbDBqoG igZoZkaHR0cDovL29uc2l0
ZWNybC52ZXJpc2lnbi5jb20vVGhlVW5pdmVyc2l0eW9mVGV4YX NTeXN0ZW1UaGVVbml2ZXJz
aXR5b2ZUZXhhc2F0RGFsbGFzQ0EvTGF0ZXN0Q1JMLmNybDALBg NVHQ8EBAMCBSAwHQYDVR0l
BBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMA0GCSqGSIb3DQEBBA UAA4GBADXwtwprdba6Q09c
Guq5Fe8UR5PsRXpC/D+zXhGswIv3AqUy/Osm1j9KRhrioInQqnVQUOl/zLL5GSvKJZHdzCap
bVSdELy2pgb7x2iM+6awFX3yjs0bhlGOmakYsPorCGIX/Ff96PfFGQgFz3EOWBFYSsior8ZW
NlXVIdcGqqC4MIIF9zCCBWCgAwIBAgIQRwBAwrEtuPEMlwm1Xz 1jAjANBgkqhkiG9w0BAQQF
ADCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YX MgU3lzdGVtMR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZX JtcyBvZiB1c2UgYXQgaHR0
cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYyk5OTEyMDAGA1 UECxMpQ2xhc3MgMiBDQSAt
IE9uU2l0ZSBJbmRpdmlkdWFsIFN1YnNjcmliZXIxLTArBgNVBA MTJFRoZSBVbml2ZXJzaXR5
IG9mIFRleGFzIGF0IERhbGxhcyBDQTAeFw0wNjA3MjEwMDAwMD BaFw0wNzA3MjEyMzU5NTla
MIH0MScwJQYDVQQKFB5UaGUgVW5pdmVyc2l0eSBvZiBUZXhhcy BTeXN0ZW0xLTArBgNVBAsU
JFRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIGF0IERhbGxhcyBDQT FGMEQGA1UECxM9d3d3LnZl
cmlzaWduLmNvbS9yZXBvc2l0b3J5L0NQUyBJbmNvcnAuIGJ5IF JlZi4sTElBQi5MVEQoYyk5
OTEYMBYGA1UECxQPTWFpbCBTdG9wIC0gVVREMRUwEwYDVQQDEw xQYXVsIFNjaG1laGwxITAf
BgkqhkiG9w0BCQEWEnBhdWxzQHV0ZGFsbGFzLmVkdTCCASIwDQ YJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBALhs8O1TDnZOvdnDqje3YRFfXgqsZTdAy20jvG X+cWIMlGZqbDIFGu0eTyep
ircIUposx7ngZzzSmo+p91PSgzDC8pF9Riy+aHoME9LEbP6UTn LURuYTyn+GeKzWEuxswFBl
p9s5VFMToiT6jA0xBcek4D2ZvzoRLuNu4cbo12n8rKN/zkrcrqJtZCmIMbzWdMHpJ5S84WYZ
j204WonJP6uxp1CSnR1cFC8oPSb8kRpoEzx8UYX9cbpC4usm4I TsxeKnUKHHEXYpY2bJTz6l
oPM5NlMpx3TklslVX/VwXIP9tPPfWp0aPw4N3dlJXa4M8UuKZZiZGXpjr8a3GCHQ0wsC AwEA
AaOCAgwwggIIMAkGA1UdEwQCMAAwHQYDVR0RBBYwFIEScGF1bH NAdXRkYWxsYXMuZWR1MIIB
JAYDVR0gBIIBGzCCARcwggETBgtghkgBhvhFAQcBBjCCAQIwKw YIKwYBBQUHAgEWH2h0dHBz
Oi8vd3d3LnZlcmlzaWduLmNvbS9ycGEta3IwgdIGCCsGAQUFBw ICMIHFGoHCTk9USUNFOiBQ
cml2YXRlIGtleSBtYXkgYmUgcmVjb3ZlcmVkIGJ5IFZlcmlTaW duJ3MgY3VzdG9tZXIgd2hv
IG1heSBiZSBhYmxlIHRvIGRlY3J5cHQgbWVzc2FnZXMgeW91IH NlbmQgdG8gY2VydGlmaWNh
dGUgaG9sZGVyLiAgVXNlIGlzIHN1YmplY3QgdG8gdGVybXMgYX QgaHR0cHM6Ly93d3cudmVy
aXNpZ24uY29tL3JwYS1rciAoYyk5OS4wEQYJYIZIAYb4QgEBBA QDAgeAMHUGA1UdHwRuMGww
aqBooGaGZGh0dHA6Ly9vbnNpdGVjcmwudmVyaXNpZ24uY29tL1 RoZVVuaXZlcnNpdHlvZlRl
eGFzU3lzdGVtVGhlVW5pdmVyc2l0eW9mVGV4YXNhdERhbGxhc0 NBL0xhdGVzdENSTC5jcmww
CwYDVR0PBAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBg EFBQcDAjANBgkqhkiG9w0B
AQQFAAOBgQA9UGpjcqqUOiW6cyNOH+jckkXIyLRSQtaQ0ykn1l elyR5U0bmcdj7PIcmRbxZn
PFzqL6YPmxgN8hKHZhViuGivIRamwmD62JMXmJz1Py8pIxHsRJ yXu7sz+D9KtM19zMAzNicz
m3WBkXrdi6+QqWJum0sAAwJ1OaQf9AR8DU1HADGCBQgwggUEAg EBMIH/MIHqMScwJQYDVQQK
Ex5UaGUgVW5pdmVyc2l0eSBvZiBUZXhhcyBTeXN0ZW0xHzAdBg NVBAsTFlZlcmlTaWduIFRy
dXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdC BodHRwczovL3d3dy52ZXJp
c2lnbi5jb20vcnBhIChjKTk5MTIwMAYDVQQLEylDbGFzcyAyIE NBIC0gT25TaXRlIEluZGl2
aWR1YWwgU3Vic2NyaWJlcjEtMCsGA1UEAxMkVGhlIFVuaXZlcn NpdHkgb2YgVGV4YXMgYXQg
RGFsbGFzIENBAhBHAEDCsS248QyXCbVfPWMCMAkGBSsOAwIaBQ CgggLdMBgGCSqGSIb3DQEJ
AzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA2MDgwNz IwMzUzNFowIwYJKoZIhvcN
AQkEMRYEFNQ3eqDxVLRtICdd0gdE1UZF5wHpMFIGCSqGSIb3DQ EJDzFFMEMwCgYIKoZIhvcN
AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBS sOAwIHMA0GCCqGSIb3DQMC
AgEoMIIBEQYJKwYBBAGCNxAEMYIBAjCB/zCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkg
b2YgVGV4YXMgU3lzdGVtMR8wHQYDVQQLExZWZXJpU2lnbiBUcn VzdCBOZXR3b3JrMTswOQYD
VQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaX NpZ24uY29tL3JwYSAoYyk5
OTEyMDAGA1UECxMpQ2xhc3MgMiBDQSAtIE9uU2l0ZSBJbmRpdm lkdWFsIFN1YnNjcmliZXIx
LTArBgNVBAMTJFRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIGF0IE RhbGxhcyBDQQIQHTCUOOL2
2PrHJ8aaRRLQwDCCARMGCyqGSIb3DQEJEAILMYIBAqCB/zCB6jEnMCUGA1UEChMeVGhlIFVu
aXZlcnNpdHkgb2YgVGV4YXMgU3lzdGVtMR8wHQYDVQQLExZWZX JpU2lnbiBUcnVzdCBOZXR3
b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly 93d3cudmVyaXNpZ24uY29t
L3JwYSAoYyk5OTEyMDAGA1UECxMpQ2xhc3MgMiBDQSAtIE9uU2 l0ZSBJbmRpdmlkdWFsIFN1
YnNjcmliZXIxLTArBgNVBAMTJFRoZSBVbml2ZXJzaXR5IG9mIF RleGFzIGF0IERhbGxhcyBD
QQIQHTCUOOL22PrHJ8aaRRLQwDANBgkqhkiG9w0BAQEFAASCAQ BqjclfzjmE0W8VCjAuBY0i
kuF4Zi9YfS0Li9JJVGy74bQ+WbbTiM4mhb/C0qlsxQJSfhfobFmZ85wpgMIZwk55MTSJ2VBs
ADj96Lqn6kUME0p1z61xr/IZUMkgXSh5ILmHfXqpcMO5D0e4g9+EAmlAdVjopZLlUKboewtq
ovDIpZ94yQfo9C4mzUcmQ1ZiL9LPYlKyi3O/cBKIWlv7Y0ewaPAwTATSgqayDqw6M6DVO/iu
2DjOPWqy6zQOcIVKqxrgWQnfEF0RjcpvjIiNX1n+orNSo6lTpf usNVetGsIK1/bO3Vo8TXOM
ULdI0vHdeyAXO2R3spft1prpTtnjrL3tAAAAAAAA
--------------ms020403010709010101070901--
--------------ms020403010709010101070901
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Bipin Gautam wrote:
> hello list,
>
> This is actually a DESIGN BUG OF MOST(ALL?) Antivirus & trojan
> scanners. ( ROOTKIT SCANNERS already DO THIS ) This issue is a MORE
> THAN 1 YEAR OLD stuff but i see no fix till now!!!!
>
> lately i've ONLY tested it on the following AV & few other spyware
> scanner & saw its still NOT fixed!
>
> Kaspersky Anti-Virus 6.x (latest)
> BitDefender 9 Professional Plus (latest)
> NOD32 (latest)
>
> OS tested: WINxp sp2
>
> to keep things simple, let me give you a situation;
>
> if there is a directory/file a EVIL_USER is willing to hide from
> antivirus scanner all he has to do is fire up a command prompt & run
> the command;
>
> cacls.exe TORJANED_FILE_OR_DIRECTORY_NAME /T /C /P EVIL_USER:R
>
>
> next time EVEN when the administrator starts the antivirus "system
> scan" the TORJANED_FILE_OR_DIRECTORY_NAME will be effectively
> bypassed as the ownership of the directory is just of the user account
> named; EVIL_USER and the antivirus "manual scan" is running just with
> the privilage of ADMINISTRATOR
>
This is similar to the problem of alternative data streams.
Essentially, the work needed to solve this problem isn't worth the
expenditure of time and effort, because the file, in order to infect the
system, has to be executed. Once the file is executed "normal"
on-access scanning will catch the exploit *if* it is known. (If it's
unknown, it doesn't matter anyway.) Yes, on-demand scanning won't "see"
the file, but even malicious files are benign until they are run.
--
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
--------------ms020403010709010101070901
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCS qGSIb3DQEHAQAAoIIPTjCC
A9gwggNBoAMCAQICEEHsHz2nFAeWxPbVDN3RD2UwDQYJKoZIhv cNAQEFBQAwgcExCzAJBgNV
BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE8MDoGA1 UECxMzQ2xhc3MgMiBQdWJs
aWMgUHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIE cyMTowOAYDVQQLEzEoYykg
MTk5OCBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIH VzZSBvbmx5MR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMB4XDTk5MDMzMTAwMD AwMFoXDTA5MDMzMDIzNTk1
OVowgeoxJzAlBgNVBAoTHlRoZSBVbml2ZXJzaXR5IG9mIFRleG FzIFN5c3RlbTEfMB0GA1UE
CxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7MDkGA1UECxMyVG VybXMgb2YgdXNlIGF0IGh0
dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMpOTkxMjAwBg NVBAsTKUNsYXNzIDIgQ0Eg
LSBPblNpdGUgSW5kaXZpZHVhbCBTdWJzY3JpYmVyMS0wKwYDVQ QDEyRUaGUgVW5pdmVyc2l0
eSBvZiBUZXhhcyBhdCBEYWxsYXMgQ0EwgZ8wDQYJKoZIhvcNAQ EBBQADgY0AMIGJAoGBAL/q
74frHgrBAPkiEcHRwczbetq+NtJwYDBg5RngUy819MmoKQXW3j 2d8waaZH2+0YdUeJv/onjx
+4erw/yHTMJJQQ3hwNKl1/x+/0JRTnTzAdVoc6VdBDH45iklY6gjmkRqgYsPsDnx79tGWMO6
uM9L83rBokmVgyNDupsajzKFAgMBAAGjgaUwgaIwKQYDVR0RBC IwIKQeMBwxGjAYBgNVBAMT
EVByaXZhdGVMYWJlbDEtMTQwMBEGCWCGSAGG+EIBAQQEAwIBBj BEBgNVHSAEPTA7MDkGC2CG
SAGG+EUBBwEBMCowKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3Ln ZlcmlzaWduLmNvbS9SUEEw
DwYDVR0TBAgwBgEB/wIBADALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQEFBQADgYEAUwm 13LK2
idEgUIPJOHncyAiySb+4U4Nvisyy5Hp8/KPoD19hXl+XBJUSWtKVASLxvO3xVLZUplQYoZ1U
vAZpBMcCITeigjmIp6ygn+iDGV2SSDkaWYIkIEO8hpUS3IN04e bjE75qpIcAMTEjByWbr7os
UZEOWaajF4jStM5UFxwwggVzMIIE3KADAgECAhAdMJQ44vbY+s cnxppFEtDAMA0GCSqGSIb3
DQEBBAUAMIHqMScwJQYDVQQKEx5UaGUgVW5pdmVyc2l0eSBvZi BUZXhhcyBTeXN0ZW0xHzAd
BgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdvcmsxOzA5BgNVBA sTMlRlcm1zIG9mIHVzZSBh
dCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhIChjKTk5MT IwMAYDVQQLEylDbGFzcyAy
IENBIC0gT25TaXRlIEluZGl2aWR1YWwgU3Vic2NyaWJlcjEtMC sGA1UEAxMkVGhlIFVuaXZl
cnNpdHkgb2YgVGV4YXMgYXQgRGFsbGFzIENBMB4XDTA2MDcyMT AwMDAwMFoXDTA3MDcyMTIz
NTk1OVowgfQxJzAlBgNVBAoUHlRoZSBVbml2ZXJzaXR5IG9mIF RleGFzIFN5c3RlbTEtMCsG
A1UECxQkVGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgYXQgRGFsbG FzIENBMUYwRAYDVQQLEz13
d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTIEluY29ycC 4gYnkgUmVmLixMSUFCLkxU
RChjKTk5MRgwFgYDVQQLFA9NYWlsIFN0b3AgLSBVVEQxFTATBg NVBAMTDFBhdWwgU2NobWVo
bDEhMB8GCSqGSIb3DQEJARYScGF1bHNAdXRkYWxsYXMuZWR1MI GfMA0GCSqGSIb3DQEBAQUA
A4GNADCBiQKBgQCrBVCMoEwZGjvluL0Zlb//jU6SQzTT3WoQv6lEUYtCHflUzW6KIs6V5lGD
I8c+qq9E6dkyK9mzpLFFOpuGuHqHghUEOIL5ItYRIui9znBYtV gKoJmx+Q2B4iS2M1yGDa1a
hbMHtSX39s3vbjv1Dna7ouh3ZmPFgO2hYpdGGIYApQIDAQABo4 ICDDCCAggwCQYDVR0TBAIw
ADAdBgNVHREEFjAUgRJwYXVsc0B1dGRhbGxhcy5lZHUwggEkBg NVHSAEggEbMIIBFzCCARMG
C2CGSAGG+EUBBwEGMIIBAjArBggrBgEFBQcCARYfaHR0cHM6Ly 93d3cudmVyaXNpZ24uY29t
L3JwYS1rcjCB0gYIKwYBBQUHAgIwgcUagcJOT1RJQ0U6IFByaX ZhdGUga2V5IG1heSBiZSBy
ZWNvdmVyZWQgYnkgVmVyaVNpZ24ncyBjdXN0b21lciB3aG8gbW F5IGJlIGFibGUgdG8gZGVj
cnlwdCBtZXNzYWdlcyB5b3Ugc2VuZCB0byBjZXJ0aWZpY2F0ZS Bob2xkZXIuICBVc2UgaXMg
c3ViamVjdCB0byB0ZXJtcyBhdCBodHRwczovL3d3dy52ZXJpc2 lnbi5jb20vcnBhLWtyIChj
KTk5LjARBglghkgBhvhCAQEEBAMCB4AwdQYDVR0fBG4wbDBqoG igZoZkaHR0cDovL29uc2l0
ZWNybC52ZXJpc2lnbi5jb20vVGhlVW5pdmVyc2l0eW9mVGV4YX NTeXN0ZW1UaGVVbml2ZXJz
aXR5b2ZUZXhhc2F0RGFsbGFzQ0EvTGF0ZXN0Q1JMLmNybDALBg NVHQ8EBAMCBSAwHQYDVR0l
BBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMA0GCSqGSIb3DQEBBA UAA4GBADXwtwprdba6Q09c
Guq5Fe8UR5PsRXpC/D+zXhGswIv3AqUy/Osm1j9KRhrioInQqnVQUOl/zLL5GSvKJZHdzCap
bVSdELy2pgb7x2iM+6awFX3yjs0bhlGOmakYsPorCGIX/Ff96PfFGQgFz3EOWBFYSsior8ZW
NlXVIdcGqqC4MIIF9zCCBWCgAwIBAgIQRwBAwrEtuPEMlwm1Xz 1jAjANBgkqhkiG9w0BAQQF
ADCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkgb2YgVGV4YX MgU3lzdGVtMR8wHQYDVQQL
ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZX JtcyBvZiB1c2UgYXQgaHR0
cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYyk5OTEyMDAGA1 UECxMpQ2xhc3MgMiBDQSAt
IE9uU2l0ZSBJbmRpdmlkdWFsIFN1YnNjcmliZXIxLTArBgNVBA MTJFRoZSBVbml2ZXJzaXR5
IG9mIFRleGFzIGF0IERhbGxhcyBDQTAeFw0wNjA3MjEwMDAwMD BaFw0wNzA3MjEyMzU5NTla
MIH0MScwJQYDVQQKFB5UaGUgVW5pdmVyc2l0eSBvZiBUZXhhcy BTeXN0ZW0xLTArBgNVBAsU
JFRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIGF0IERhbGxhcyBDQT FGMEQGA1UECxM9d3d3LnZl
cmlzaWduLmNvbS9yZXBvc2l0b3J5L0NQUyBJbmNvcnAuIGJ5IF JlZi4sTElBQi5MVEQoYyk5
OTEYMBYGA1UECxQPTWFpbCBTdG9wIC0gVVREMRUwEwYDVQQDEw xQYXVsIFNjaG1laGwxITAf
BgkqhkiG9w0BCQEWEnBhdWxzQHV0ZGFsbGFzLmVkdTCCASIwDQ YJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBALhs8O1TDnZOvdnDqje3YRFfXgqsZTdAy20jvG X+cWIMlGZqbDIFGu0eTyep
ircIUposx7ngZzzSmo+p91PSgzDC8pF9Riy+aHoME9LEbP6UTn LURuYTyn+GeKzWEuxswFBl
p9s5VFMToiT6jA0xBcek4D2ZvzoRLuNu4cbo12n8rKN/zkrcrqJtZCmIMbzWdMHpJ5S84WYZ
j204WonJP6uxp1CSnR1cFC8oPSb8kRpoEzx8UYX9cbpC4usm4I TsxeKnUKHHEXYpY2bJTz6l
oPM5NlMpx3TklslVX/VwXIP9tPPfWp0aPw4N3dlJXa4M8UuKZZiZGXpjr8a3GCHQ0wsC AwEA
AaOCAgwwggIIMAkGA1UdEwQCMAAwHQYDVR0RBBYwFIEScGF1bH NAdXRkYWxsYXMuZWR1MIIB
JAYDVR0gBIIBGzCCARcwggETBgtghkgBhvhFAQcBBjCCAQIwKw YIKwYBBQUHAgEWH2h0dHBz
Oi8vd3d3LnZlcmlzaWduLmNvbS9ycGEta3IwgdIGCCsGAQUFBw ICMIHFGoHCTk9USUNFOiBQ
cml2YXRlIGtleSBtYXkgYmUgcmVjb3ZlcmVkIGJ5IFZlcmlTaW duJ3MgY3VzdG9tZXIgd2hv
IG1heSBiZSBhYmxlIHRvIGRlY3J5cHQgbWVzc2FnZXMgeW91IH NlbmQgdG8gY2VydGlmaWNh
dGUgaG9sZGVyLiAgVXNlIGlzIHN1YmplY3QgdG8gdGVybXMgYX QgaHR0cHM6Ly93d3cudmVy
aXNpZ24uY29tL3JwYS1rciAoYyk5OS4wEQYJYIZIAYb4QgEBBA QDAgeAMHUGA1UdHwRuMGww
aqBooGaGZGh0dHA6Ly9vbnNpdGVjcmwudmVyaXNpZ24uY29tL1 RoZVVuaXZlcnNpdHlvZlRl
eGFzU3lzdGVtVGhlVW5pdmVyc2l0eW9mVGV4YXNhdERhbGxhc0 NBL0xhdGVzdENSTC5jcmww
CwYDVR0PBAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBg EFBQcDAjANBgkqhkiG9w0B
AQQFAAOBgQA9UGpjcqqUOiW6cyNOH+jckkXIyLRSQtaQ0ykn1l elyR5U0bmcdj7PIcmRbxZn
PFzqL6YPmxgN8hKHZhViuGivIRamwmD62JMXmJz1Py8pIxHsRJ yXu7sz+D9KtM19zMAzNicz
m3WBkXrdi6+QqWJum0sAAwJ1OaQf9AR8DU1HADGCBQgwggUEAg EBMIH/MIHqMScwJQYDVQQK
Ex5UaGUgVW5pdmVyc2l0eSBvZiBUZXhhcyBTeXN0ZW0xHzAdBg NVBAsTFlZlcmlTaWduIFRy
dXN0IE5ldHdvcmsxOzA5BgNVBAsTMlRlcm1zIG9mIHVzZSBhdC BodHRwczovL3d3dy52ZXJp
c2lnbi5jb20vcnBhIChjKTk5MTIwMAYDVQQLEylDbGFzcyAyIE NBIC0gT25TaXRlIEluZGl2
aWR1YWwgU3Vic2NyaWJlcjEtMCsGA1UEAxMkVGhlIFVuaXZlcn NpdHkgb2YgVGV4YXMgYXQg
RGFsbGFzIENBAhBHAEDCsS248QyXCbVfPWMCMAkGBSsOAwIaBQ CgggLdMBgGCSqGSIb3DQEJ
AzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA2MDgwNz IwMzUzNFowIwYJKoZIhvcN
AQkEMRYEFNQ3eqDxVLRtICdd0gdE1UZF5wHpMFIGCSqGSIb3DQ EJDzFFMEMwCgYIKoZIhvcN
AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBS sOAwIHMA0GCCqGSIb3DQMC
AgEoMIIBEQYJKwYBBAGCNxAEMYIBAjCB/zCB6jEnMCUGA1UEChMeVGhlIFVuaXZlcnNpdHkg
b2YgVGV4YXMgU3lzdGVtMR8wHQYDVQQLExZWZXJpU2lnbiBUcn VzdCBOZXR3b3JrMTswOQYD
VQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaX NpZ24uY29tL3JwYSAoYyk5
OTEyMDAGA1UECxMpQ2xhc3MgMiBDQSAtIE9uU2l0ZSBJbmRpdm lkdWFsIFN1YnNjcmliZXIx
LTArBgNVBAMTJFRoZSBVbml2ZXJzaXR5IG9mIFRleGFzIGF0IE RhbGxhcyBDQQIQHTCUOOL2
2PrHJ8aaRRLQwDCCARMGCyqGSIb3DQEJEAILMYIBAqCB/zCB6jEnMCUGA1UEChMeVGhlIFVu
aXZlcnNpdHkgb2YgVGV4YXMgU3lzdGVtMR8wHQYDVQQLExZWZX JpU2lnbiBUcnVzdCBOZXR3
b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly 93d3cudmVyaXNpZ24uY29t
L3JwYSAoYyk5OTEyMDAGA1UECxMpQ2xhc3MgMiBDQSAtIE9uU2 l0ZSBJbmRpdmlkdWFsIFN1
YnNjcmliZXIxLTArBgNVBAMTJFRoZSBVbml2ZXJzaXR5IG9mIF RleGFzIGF0IERhbGxhcyBD
QQIQHTCUOOL22PrHJ8aaRRLQwDANBgkqhkiG9w0BAQEFAASCAQ BqjclfzjmE0W8VCjAuBY0i
kuF4Zi9YfS0Li9JJVGy74bQ+WbbTiM4mhb/C0qlsxQJSfhfobFmZ85wpgMIZwk55MTSJ2VBs
ADj96Lqn6kUME0p1z61xr/IZUMkgXSh5ILmHfXqpcMO5D0e4g9+EAmlAdVjopZLlUKboewtq
ovDIpZ94yQfo9C4mzUcmQ1ZiL9LPYlKyi3O/cBKIWlv7Y0ewaPAwTATSgqayDqw6M6DVO/iu
2DjOPWqy6zQOcIVKqxrgWQnfEF0RjcpvjIiNX1n+orNSo6lTpf usNVetGsIK1/bO3Vo8TXOM
ULdI0vHdeyAXO2R3spft1prpTtnjrL3tAAAAAAAA
--------------ms020403010709010101070901--