SERIAL NUMBER IS FISHY - DECLINE PATCH'ITCH'ING AutoShutdown v3.7 A Cracking Tutorial by ASTAGA [D4C/C4A] DISCLAIMER This reading material is not intended to violate Copyrights and/or it is law, but educational purposes only. I hold no responsibility ( by all means and in any shape whatsoever ) of the mis-used of this material. READ End Notes in the below section of this material. ABOUT THE PROGRAM A Windows 32-bit utility to automatically shutdown your system. An icon resides in the system tray for ease of use. You may set up this utility to shutdown after a period of inactivity or at a specified time each day. AutoShutdown has many features, including the ability to automat ically detect when your system is inactive. You may disable the auto features and still use the other functionality of AutoShut down. Since AutoShutdown installs itself in the background, it can be configured to perform actions at a set date and time, during a period of inactivity or when a hot key is pressed. WHERE TO DOWNLOAD Author : Don Metzler Copyright : Barefoot Productions, Inc. Homepage : http://www.barefootinc.com URL : http://www.barefootinc.com/files/autoshut.zip Size : 1.5 MB as of August 17, 2000 HOW TO GET VALID SERIAL NUMBER by using SoftIce 1. Run AUTOSHUTDOWN.EXE, click on the REGISTRATION tab, , in the registration dialog box type these below informations : Name : Pirates Order Code : 738810509 Do not click OK button yet You have noticed that the OK button was dimmed/grayed, so let the cursor remain in the Reg Code field box . Do not click OK button yet 2. Fire up SoftIce by pressing [ CTRL + D ], set a breakpoint as follow : BPX GetDlgItemTextA [enter] and F5 to return to the main program 3. Now press BACKSPACE once ( i mean delete the " 9 " ! )... you'll return back into SoftIce! In within SoftIce press F11, F5, F11, then you'll break and see these below codes : __________________________________________________________________ 015F:00495C5C FF15B4174000 CALL [USER32!GetDlgItemTextA] 015F:00495C62 EB10 JMP 00495C74 015F:00495C64 FF7510 PUSH DWORD PTR [EBP+10] 015F:00495C67 8B10 MOV EDX,[EAX] ......... ......... ____________________ AUTOSHUTDOWN!.data+00078C5C _________________ Clear previous breakpoint because you just need to reach the main program's codes only. : bc * [enter] Do a search string as follow : : s 0 l ffffffffffff ff d7 85 c0 0f 84 B3 00 00 [enter] Pattern found at 0167:004671A1 (004671A1) Set a new breakpoint at this location : : bpx 0167:004671A1 [enter] Press X to let SoftIce break in this location 4. If nothing goes wrong you'll break again in SoftIce and see these below snippet codes : __________________________________________________________________ 015F:0046719E FF750C PUSH DWORD PTR [EBP+0C] 015F:004671A1 FFD7 CALL EDI <== break HERE 015F:004671A3 85C0 TEST EAX,EAX 015F:004671A5 0F84B3000000 JZ 0046725E 015F:004671AB 8B7D0C MOV EDI,[EBP+0C] 015F:004671AE 57 PUSH EDI ==> D EDI 015F:004671AF 53 PUSH EBX 015F:004671B0 E875FFFFFF CALL 0046712A 015F:004671B5 59 POP ECX ==> D ECX/EDX 015F:004671B6 85C0 TEST EAX,EAX 015F:004671B8 59 POP ECX 015F:004671B9 0F85AB000000 JNZ 0046726A ==> D ECX 015F:004671BF 8D45C0 LEA EAX,[EBP-40] 015F:004671C2 68B86A4200 PUSH 00426AB8 015F:004671C7 50 PUSH EAX 015F:004671C8 E8838D0100 CALL 0047FF50 015F:004671CD 8D45C0 LEA EAX,[EBP-40] 015F:004671D0 68C06A4200 PUSH 00426AC0 015F:004671D5 50 PUSH EAX 015F:004671D6 E8858D0100 CALL 0047FF60 === 015F:004671DB 8D45C0 LEA EAX,[EBP-40] 015F:004671DE 53 PUSH EBX 015F:004671DF 50 PUSH EAX 015F:004671E0 E87B8D0100 CALL 0047FF60 015F:004671E5 6AFF PUSH FF 015F:004671E7 8D85C0FEFFFF LEA EAX,[EBP-0140] 015F:004671ED 6A00 PUSH 00 015F:004671EF 50 PUSH EAX 015F:004671F0 8D45C0 LEA EAX,[EBP-40] 015F:004671F3 50 PUSH EAX ==> D EAX 015F:004671F4 E876000000 CALL 0046726F 015F:004671F9 83C428 ADD ESP,28 ==> D EAX 015F:004671FC 8D85C0FEFFFF LEA EAX,[EBP-0140] 015F:00467202 57 PUSH EDI 015F:00467203 50 PUSH EAX ... ... ... 015F:00467230 7538 JNZ 0046726A ## ==> 00467232 56 PUSH ESI 015F:00467233 8D85C0FEFFFF LEA EAX,[EBP-0140] 015F:00467239 6A01 PUSH 01 015F:0046723B 50 PUSH EAX 015F:0046723C 53 PUSH EBX 015F:0046723D E82D000000 CALL 0046726F 015F:00467242 6A01 PUSH 01 ==> D EAX HERE 015F:00467244 8D85C0FEFFFF LEA EAX,[EBP-0140] 015F:0046724A 57 PUSH EDI 015F:0046724B 50 PUSH EAX 015F:0046724C E861000000 CALL 004672B2 015F:00467251 83C41C ADD ESP,1C 015F:00467254 85C0 TEST EAX,EAX 015F:00467256 750D JNZ 00467265 015F:00467258 46 INC ESI 015F:00467259 83FE10 CMP ESI,10 015F:0046725C 7ED4 JLE 00467232 (JUMP ) ==> ## 015F:0046725E 33C0 XOR EAX,EAX ______________________ AUTOSHUTDOWN!.data+0004A19E _______________ Well at this stage this gonna be long ( but interesting ) tracing, just be patience and always watch your Data Window; keep on going pressing F10 key and stop in the location as explained in the below. Let's dance. 015F:004671A1 d edi [enter] ==> your fake code at 0167:7AB108 015F:004671B5 d ecx [enter] ==> see that part of generated code d edx [enter] ==> your name at 0167:7AB008 015F:004671DB d ecx [enter] ==> what is ASD42... at 0167:426AC4 015F:004671DB d ecx [enter] ==> ASDS42-PIRATESORDER at 0167:7AAFAC 015F:004671ED d eax [enter] ==> ASDS42-PIRATESORDER at 0167:7AAFAC 015F:004671F9 d eax [enter] ==> AS3E-637-138-2FFA at 0167:7AAEAC kewl, this one looks like a serial number. Write it down ! 5. Disable all breakpoints by typing BD * [enter] Press F5 or X to return to the main program 6. Repeat registration procedure and keyed-in AS3E-637-138-2FFA as your S/N . Did you see that OK button got cleared ? No ????? 7. Hahahah ... GOTCHA ! RESTART your tracing, press F10 from last memory location ( 015F:004671F9 ). 015F:0046721B d ecx [enter] ==> your last potential reg code changed into AS3E-441-031-E880 at 0167: 7ADE74. 015F:00467239 d eax [enter] ==> AS3E-441-031-E880 at new virtual address 0167:7ADE64 . 015F:00467242 d eax [enter] ==> kewl, new potential reg. code AS3E-763-031-211X-1FB5 at 0167: 0167:007ADE64 . Write it Down. This time I won't cheat you .... just verify these below snippet codes : EAX=007ADE64 EBX=007ADFC0..EDX=00354246 ESI=00000001 EDI=007AE0C0 EBP=007ADFA4..EIP=00467242 o d I s z a p c CS=015F DS=0167 SS=0167..ES=0167 FS=1B37 GS=0000 -----------------------------byte--------------PROT---(0)-- 0167:007ADE64 41 53.....32 31 31 AS3E-763-031-211 0167:007ADE74 32 58.....17 01 00 2X-1FB5..n...... 0167:007ADE84 00 00.....17 19 1C .....G....>..... 8. Disable all breakpoints by typing BD * [enter] Press F5 or X to return to the main program 9. Repeat registration procedure and keyed-in AS3E-763-031-211X-1FB5 as your S/N . Did you see that OK button got cleared ? YES ! Click it .... you're registered. 10. In main program click HELP/HELP CONTENTS submenu, click on REGISTERING subhelp menu and read that Register Form. This program offers you more than 1 user license even site licenses. Iam so curious about this and drives me to return back into SoftIce. 11. Let's trace again, this time start from 015F:00467242 , just press F10 .... wait, do D EAX at 015F:00467242 and BELIEVE ME stay always there ! 015F:0046725C ==> jump/loop to 015F:00467232 keep on pressing that damn F10 until you jump passed 015F:0046723D. Look at the Data Window your AS3E-763-031- 211X-1FB5 changed into AS3E-763-031-211X- 3F6B !! Watch for the last prefix ! Press again F10 , you'll loop again and after jump passed 015F:0046723D ( stop at 015F:00467242 ) the last prefix changed into 5F21. I do it for 10 times ( you can do it several times ) and stop after I got last prefix 1D66 and 3D1C. 12. Next, I keyed-in AS3E-763-031-211X-1D66 as the serial number, yes, they're accepted ! I clicked HELP/ABOUT submenu .... it was registered for 750 users. 13. Where the hell is my registration code is stored ?? The correct registration code is stored in the registry as follows : REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Barefoot Productions\AutoShutdown\ Registered] "Name"="PIRATES ORDER" "Code"="AS3E-763-031-2112X-7ED7" ==> 100 users license 14. How can I practise with my own user name ? - I strongly recommended you not to do this ! FAQ ABOUT ME : * Does ASTAGA has a meaning ? A : Yes. It's an Arabic word meaning " oh my God ... " an expression for surprise or even disgusting situation/condition. Note : ASTAGA was also my handle name / call sign in CB and/or ham radio in the past 1976. * Why do you always put " Pirates Order " as your user name and 'Red Rackham' as your company name ?? A : First, it is to avoid you to use your own name during improper/illegal registering shareware program. Second, it was inspired by old TV Serial " Democratic Order of Pirates International " . Don't you realize that all what we have done is about piracy ? ... * Why do you always put " 73881050 " as your fake code ? A : First, it was adopted from my local CB's Ten Code ( Citizen Band ) listing 10-73 (=nice talk with you Pal ... ); 10-88 (=cherio/ciao ... ); and 10-50 (=stop transmitting/break/clear the channel). Second, I feel it's a nice combination in fishing S/N and in most cases reg code consist of 8 chararacters. * Do you hate patching ... or dead listing approach ? A : Not really ! First, it's depend on the program as long as they're caught in SoftIce. Second, making a dead listing consumed my harddisk space and I lost my patience during they're disassembled. However, i love reading TKC tutes #1-9 and FLU[X] from where i learn patching; for you newbies download those 2 amazing tutes also crack tute pack called romeo[D4C] and KLEE8084 from Sandman's web site. * to be continued ..... E N D N O T E S Distributing your serial number is illegal and is no different than distributing illegal copies of the registered software. Violation of this rule may result in temporary or permanent revocation of this license and cancellation of the serial number; the original licensee will also be held responsible for damages, physical and estimated. Do not distribute your crack release based on this tutorial, because you become a LAMER(s)!!!!!!!! ( tHATDUDE (PC97) defined LAMER(s) is the guy who sits in front of personal computer, using Hex Editor, ripping off other group(s) crack release, repacking (distro) them under his name. Adopted from newsgroup alt.cracks, alt.crackers - February 1997 ) More about LAMER(s): lamer /n./ [prob. originated in skateboarder slang] Synonym for luser, not used much by hackers but common among warez d00dz, crackers, and phreakers. Oppose elite. Has the same connota tions of self-conscious elitism that use of luser does among hackers. < SOURCE: http://sagan.earthspace.net/jargon/jargon_27.html > Never attribute to malice that which is adequately explained by stupidity ASTAGA [D4C/C4A] tute-autoshutdown37.zip [EOF] First Edited : 08/18/00 1:38:24 AM Revised/Updated : 11/15/00 1:14:41 PM begin 644 ROMEOD4C.ZIP M4$L#!!0````(`,&X1B-QO0N?O0$``"(#```+````1DE,15])1"Y%6$6%D+]+ M'$$4QV=W;1(0;$*:\'C*M2H2X=A4$?4:3SRU,B+A/.?.(3<[86[O%U86=N+? M((BU>HB<*9)T2;.04C`02!>V$>QS>;.S&U,<\?MXPYNW,Y_]SEM^,^&XC#&3 M@\'=@!DY=X,7S*KOL6BLS_I'GS\Q=OCUZ.;C<^?7,4-`F`<%[Z$+&@348!=" MZBW`+/6G809\BCS@D"A!'3B4H4$KP@[=;M!=0]F&)E6F6Z4]IZ@3?QCC(7Y3 M:G(BZ;1*]PC7#EN]+K'[T_TOC&W\O+]T7][VV)4;C5T^^7#CQ$7$?D66)EL[-E?=-$ MI\).:-ZQKJKAL`$5E,:%II2"&^9<@"LMKEN"M]/W]5DQ&O\#4$L#!!0````( M`%*X1B.^^H\'E@@``%,8```,````4D]-14]$-$,N5%A4[5C=;]RX$7\7H/]A MND!A&]C=0ZX%BEP1!(X=(/MB![:+/!SZ0$FS$FN1U)'4R@+ZQW=F*,F[3G.] MX`)<'KH/"2R2\_&;[[EW^S@HCW"'&[2UMHA>VQKVSL-U;XS&`#_!I87;`_J# MQB'/WGSM+\^*$;PSZ.#GZJ_E#Z__]L\\R[-W2$P0=A"B\A$K6(59&'\BS&H- ML<&`\$N/(6IG0Y[13;30N:ZCAWT'VH(9P6A;P4],_-46X(,;^"$T6#Y"J2P$ MEL$B['7=$Q?71SD/Q$6U8'M3H`]O\^Q'>ORI41'*1MF:$*@U5X8H$@6ZJ.-9(*EK'2)ZK-ZR")O?_V,RNYN'N]OK?UP][&YO3HG**?'7 M]G$60`5G5=&*E`6V&@^8!&0]C0L1!EUA.T(?L,JS"HN^KM$#&4BU[7^W0%B! M\R='!_IX?)YG.@![TJXD<,G2<-,;K!7!^$!\!^?)N#.O%83&]6T%$8DCPSJ0 M@'G&$LZP5@X#/=Y%D%N(Q59EN0&),^89R6I'_4!^>&>`!&3 M%RBJ,AY"2BBMYU/5!C=?(0G(F&QA,B_B(Q!JS>1!B^ZDYR2CP6K+!F`%%Q@; M%1+RT#I5$=LB^?@G;2LW!'Z>#B9DDL$$OMF3E!UG%B%]\;V%WE9$?B8S*19B M$R!#1%.T*K;-VK M&B_RC,VKV@09ZT[8^"W=)J/8LPB#LI&/:N3_'!$S7:M+%;&ZF/'0WEE=BF?6 MK+.H,?L'_:T@-(0F([H6V0KDF\0MSPH,\1E0NFQ=`J5V3F32,6"[7].;4I%L M;$JZ)48N"(35D=O2[3UG!`[T80G3DW"GM]MO&ZRW\/#A/7R\N[UZ?W^?DM$] M)SC6\*/3-K[,H'EV>>)@R:>;OD;!AE#QR8OV?=O2:;)?"H]!(JD@W+3IO"HC M6:(5\SBRUV`!5=E`2X`L#X7H409,T?=\;XJ]AYGM.J'6=[-#+`B?$<13T.E( MT#-A?.H(7K2EI""R%):1[3TCT#$"1'[UB>G/J6"J`9R02MW1B3`2<=^N)EDD MWEL7&2"(6#96Z;B+\JP]$);B>1*D]1W%,J5OO^;\S)@-5;\R8 MM&%G)`U(H'NWAMT9`=RB.B"G(Q6A(Z$8)'$1DMA^I@H;C(6NL%J?HK."01.Y M3HU@"$:")Y)=N7PQZ]6`VM,3(D&Z!2'HO!B$U2-"SE?:*C^N)GNS"!^]*_CF MPZ(^W&N.O[WF!/8_JC#7Q/OD_#>IUHG+"C(I/;#+3)GK*$;!L3E)NCAH#F#+ M#SP05^24L\XS*8YB`"%3.D,XE]X%CO75W50761-CV$N2R4AOS0ZI;BK3(Z?'SCO3<5\Q MZ-B0'$QH9OQ+KTDOODRV0+:!*.'!*K.$G5C[)%F(4Q@5RX;$7NZ+:6[=QPS$DYS4N9;@I"`G$HX*W3E&>9T:\A92E@T)Q9N9:HBW.!-484DZY M!$F];)[/>IATEXM1@:2%Z#?CD$3P'LN89P"_IB!?7?"H'2'U+L_>`<=22KK: M3I36Z?@ZSZZ`8WH@Y(B4?11S8`BJQB5A"]DY^D6^NFJVPV/O08 M>V_G)#0!)TAP425P57@9@%PGI0"D]E%P7$^R<\]`7QZQ':=@/P\7C`V]X2P" M@]R9-D(@Y(_!-LQ/KLK8'=^4)RJI8>X/G`XQX] MVT8%Z3]4ZK-6H#K24)6-^!;WHU?G^ MCG!);0J7^N"\5/-5HWSU0^'[J-J7W?D M&LLM77B>8^Z'NL*M>W-V,>2J>T!*.R6T24&_A@S&PW9XT+[,4>?8J M)3#.G%-29K^2NU/=J=A]O]N>Y.H/\1OI!DD@'J9X:C;<_'L8&N3`GT>19`9' MW[VS]1I.W.2+1>G43?X"&WA(1?\KO"1-ZJD;D3T(L;&R/1%ECISP]QKV2P9] M^>![K!@-TM]S9,A0&6#?6SM"T3^W,U.RG1JN-50]SK1D.8)/.HZ3W9"KG\XQ'S12Q M4[1^P^5&GOV)56NTL.XR7'+@#>B+9 M&JS^SJN'ADA@VA*UKI]=U^O>=(TXR`[VV/(T)Q1D$:5D3#4C[Z*X.G-!<)K7 M9FEBF%8EO3%$9)5<7A06$INT4U%5I4L)NL2%.V"L9%V0%C?3K/OR)^MS^.V_ M#=%W=C3<11ZU`YMOYAF;-[SS>G]S_8;^_`]02P$"%``4````"`#!N$8C<;T+ MG[T!```B`P``"P`````````!`"``````````1DE,15])1"Y%6$502P$"%``4 M````"`!2N$8COOJ/!Y8(``!3&```#``````````!`"````#F`0``4D]-14]$ <-$,N5%A44$L%!@`````"``(`2E6R/:E"!L``#Q*```0````[9_!"49)O+UMU57?8C24!@YZ>?GVZ9_#Y\]=?U4JUTFD_&?9[ MN[&Z]@(W7,7JU7/5BIS)C1?,U"A-PLAS?/7EL!Z&U:AIV'D4KF8:S5:A[RPUAK9B"9:W43A"M?NS.M MDI!O.%&BPBG&$&N_*R=PJY4)L?Q[#<^]6.'_-&ZLXT0E=@G.%\?SG;&OU1.E M]M3HHCND@:NYDZA9F%0K"TR;@+9VU7Z=V*I66OW>J-,;#:N5'\Q5K1S6E>H& M212ZZ23QPH"XLK*;&,%5*T<8]=?4F]Q@G>6QPW":=%N=[_"..F*I'F/L.2C0 M@B,]\^(D"=#'6D0H# M?ZV6$<3/\Q*-(Z5:D#^DI2Z]0).>#U3'B=0:^WCFL!T?= MZ/7"N0'I*92U0:A:>8ZA%^%*O;\:7I!"5*MY>Z' MHFJ:.<-&RLH/'5?%Z\4X]/':&08,UT'BW/(RB`<[*9ZV\/1ZKB,VM'"<.)ZP M&8/6"E:)(>TZ21$$\`YF66BQ$]A$MS<:7+6O6J-NOZ=&?77=[;7[UT/5&C1; M;[N]-SF?#US@P;J>DQF5E1*,=1'&9/H)Y+<(R4W$`I*Y$^`%.S!*@X!(>)!D M.XS!6V")U927P!'G3N32(N<>E.X$:U:2FL)/Z:\P$$54K7H`? M"S:/FG)B/").\]@1KH)F84L@LQT'XR$OEJ'J0HT M?`_+W'21&BTN7.EHFOK5BJO'Z6Q&EDC\]M)W>N;4\0[\=ZE#DL<4[&"AV3+! M1$V-84U=M?)@:HGV9<)YN*I6,,`-E9Y.O8F'Z*2$/@EDY25ST*FQ(7JGI MM5V\G0:NQF+H`>8].=BO5C#`^:+5PF&9JN9RJ>'3MVJON2^48F)Q\7C+P&RLJ;RHK`0DUUB47F M)B$U3G7$RR1CAM_"H5@E5X/+F`:0]UD;S_5@8G2VC!:_@Y#!":.FM.O%8?"7 MR21(;^MILJ@OUN(,"'U_O>JVWK)+]`LN,>R?CWCIW1Z6WN]_E4O(1?8#PS`B M&FN*%HX7P3K'D,\73Z\H(]#ZK./'DTC#PGP'"TI.B*\_#K9[/!($58.W\I:L+?PT0O*0:B_R$OGR.*(WBK0>=-=S@:--F46_UV!Y#@FZ^Q6(_C]QBX8\WKUDAD!$M6 MSIK4M(PHDTS@LOACIJ$PV#CDQ*YHXSD#G"1:BS.+F2(LU2V7A_]38*&?D<"#'")4 MQA3L#U\HI/3C(S7VDE.3QQ'7NPHQ'8LN":*0QTY5&[SP;&)J,X^".*=%-0%` M!?>4)WA$B0AAF?A4O0G9.SC:.I)ZR)K&&E/`1RB>3H`8O"#53ZJ5.JZ/>;!' M))O,M61\P-PG>-HT0=C>/\6]"R*>W=0NW8.3O:W12_R`0++D=@ M62Y];V+S-J,R*($).M!_9E1%4#9>B^0$C,3X`:T.B@+HB3EYA#U<0.QPIL;A M+4R5B&-*[42Q@+W)/`QCJU24`*G:L?'V#_L+EK135R0;QT<^HP4A::^).\<5 M.,,:,A:4L(+)39(5,ANB54P>7-30"8"/ZWWQ7$*0M.JAET`CE_`W1$>"#`*H MC(-J0Y,A`A0SNNZ+O!G\J"^.[[D"R7//`ZH>1?J;"#-$&RQ=1J%`I7V9PUDGBNMT6*)7&LE@$@2B6728^6 MDB`20GKR("X@8`=E$E2T!,\1I MI#.G@:)-.<2V1_413`[.;H!37>T-->PWPWW-?195B'H[4>D2OKX#_UKNJ#U3 M'U#UI@V/RQ"9>)\L.,.FQ(GP)($8/!0P/)LA4KO_M$V.K5FNQG(%E)R]_P#_ M\WW@?^:3GE'%:K15K60:@9,ZB"ZHC-86#]591'EZA/"-=A%BH'7$2X(S3H'[ M:F53SB@KN]-RWJ+87U,K3?%3<6H&5R'%#PH.C)U\[X860FDQD\9);KLGX^4M M9?P53Y-@&H?DW!48SU`@4#J*L*@%%N+,#,6=7J@NVZ.=FJ)R7'1+;[@A\872 MCQ,7LU*M%.(^LT%"4)"("8G]`#8L'Z#"'7T'0I(!/&-]H[.-?,HVK86=P?/2DK##5^J%Q:,R61&G@7'?R.T-EDS2I>=F!B39 M64OQ2$-Y21R55JCB5Q'*>4Z+'@%4-O2-A6":2[L,7F4QQ@(NLY_#+73D&#<. M_6)H**E\HAK5REX#[#DP3PM.IT496YO-[Y`=<41BSR;40[KAH$!%8$!6\LVF MD[G^#*E_D7E9O@C1/,,IF]*/J5^2<(TB0>J>9`YC`6)378D&VGU"&MF--#.% M^HMZ*YG%2?!52]^94'.%FTR%;')'EM**E'3_6[I8DLWP:U\8^[.^3."E-DC- M6`+11$G%!8X!4QL,O;D<=D;US@?P)/XJ'"<<26K<[*%$0X1\!C)CQ"AM&G9L M*H(?\P`M$8PZ2Q;5,I&R[W(D+&@_KQ>%HR=U4L[3P[/#X_P1:<2&&`:%"$06 MJ!5M@M:'$..&`C&]OHK:_Y2E7)UI`OEZ'%)SIQ"X MKA!VD")65'C`^A,/GEY3*:H-Z6^9]ZL5(3#6R**:_#UJO7X:QG;P^Z6 MP?E5>.U'_'?9:?+M3O-#3?T"5@^.GWW:^AI&J!^4C-@R;?NKIZ4+LNG03W`+ MV;0^?.5K=C84V0]>K]401G.BWCFWWB)=H'C\G>&:@.)\]1GWS7LY*-%K"JAC MY$>`?YQ.N;5IQUEZK+7C\V>/T>NZL&8/V973#I5*4>C?)=>^[@_:ZOUH``T- MNT\/6QL:LN0N$`U]7FBQ&K:C'G/YG-H;D]!HC3;0,"]9.TXR9LP-WKE!$%*E M2F!+J;S-^M&4G"0,Y`TY"0B,OAVU^^,N=6*BNCJ3=C^'@D3"WTIVX)0M("RT M9IQCV32JX+04)Z&I8MFJLW8#:9F>BPTSSB"Z*RWYPL%:Y='6B'GB*CU>'AS; MG&!2#8=^\,19(92Z=V6;&UE!+0&/I[']1VK72IBNTSXE\V$[YMS$<4K).D=* MM`WC)$"\KA4?I7\.0P$W%:J5%=5_FKH"P-FSN61^4YZ'G"K@"69'D%HE'+B% M&C4N)7ZO9!^C6LD3J41G(S^#`"6*\W3ALL8]=O)`\'G MZ3E?+S9"4#'XO&KE*LG>;ST:O%H/!J^O='^,V_+R_=&+K^SEUH=\Y=87&XUG MC>-VNW'_RZW-K4G[J-EN\T_)$[8=O8U$A[$P.:M;;#SFI$:=(:=-UL,#P@`W M7&=E!6^D4985"/W4^W?^2:ZWP)04Y5-C3K3%ZD9WGER8D3_+750 M>''=NO)B@J3!@>6,D/YJOK8^7W0GRTO&''L1%QZ!+@:!4V7PE#=%'!0`S2V] M)VJO&9N*T#3J'9_BR%KBP=2;I11$:(L"I844B!QB(*>YQZW)L9Y[!A7;Z+CA M3P0B3[/-*=-&J%;FDC("/8--4"W.15`L;KSBJ0![;4@B[Y21^*)$((G>K_6+)63-T>"#7U9<_#%'X4 M`3EP0CP[[N]5VQ7@N368,ANZ=:4+4J%"#?:PB M+Z&-J(%_KCZH>1P M\.+E8\CTQ$&=#U.EFGZ+;=G\=T\V"29= M:>F@YD>;_H2-T.PJ[H@&WH14:[=%*6_5+';D0*^)5V:S$'<+':E_;%N40KKF M]W0I9=H^(2?#THYA:9O0U211FK+G4,"@U_@LPK9.I10\8'EHV^K_AQ MB]AE*NDH.[(W0C>XN6P2\9Y#>3S1W,TTQR-9!KSWR!K9)T];T:Y]GBEK>=,9 M<8G;S#F_9!8G2ID#06KWU8M"L4O)!#\/CXZ?/;>YU1H@"L3E4G/4N"/;GU+N MI]WHLL8YM4GCZ_SPD+.7`9!)!EBXJYUC4EA#/$$][T,9*R=RX\)>$_7-;!<3 M+U8K]W?JLC82M4I0_[]_VFA]NIMI#COJP>MUU@SQ=3!+YMN:%L\:S1[W/KHM.^GTI(VAQ+HN25G/MK!:DMW8Y-`WN"(=71?3S/'AF:U M(GF/0;KL$"5T8(]Q[TIG6]U4)LORR^CM6<,!E5)F(@>D2G=+J5^SZ8SNLZ/0 M7H44"'5EH+WT(ZCQ[9MC']QX+2,E\0QJ>3OK(DNY'M2#UVNU1WP4UKW_3R/" MS;`7]Q.YSR(RTV]W:P^9IZ"H0E_HWL;[T3$3MD2 MI>CP$A-!Z'";C8URI)2+#NEJA;=UVN#Q8C.XT-<2^^3&RY+.$"2\MUYH[9CH M*<942II4.)C>$_#-.6_Q;K$E3/,#*Z]Q_$H2:6;C5'KJ6T5/3OFH7KD@LV\T M3:J?Z60SKEG"QD`X4"NUTWBUDX_YE2>1WUP]R>XZ\<3S#'T^![PVU2-!"C[> MFU?0KIJEG#[V[0[1*BY7+IQSZJI_4S-%$TJN4[-#9SJ#^0L<">0X`.0KVR\B M6,X&MD/'0'I+%/^%S?CYLY>?MH-H8\H%:MOYN;:R.6*+C?C#!5"R'93-!)7MB#Q: M>91V@MZCSABVFL.S^\;S57JIUY?MH\?+ML)+[8YLSSS^$HV@C[6`XN4ASF5[KLKCE>LA`=E9JI?_/MMN88= M7C`%(=%HWD>!3';N3>D,$_YI-#DBQ3F9K`1E,HW&T?G+UO;]+,`+=31].9GD M4)-:+ODL-.DA''VT[D@F/=1GHGRH]N:7Y373G7LN,F@VE$-QN-4@;O,O8.#P^,@TT MSV[Q9)LND3>;)^+X4Y,O8B6O\#*'H87'S^D<5%Z;H!KC7)?:DY_VS$,M;Y4. MNF\N1@;6<&X,Z(36Q*,CB-2*X!S(W3"JO!%KOJ$I^?.@)GW;HIKJ;>4M+SQ[LO1M1C9[XP0]J3^VE,)QHXL3Z,V>=S[1A M!I^5^/$YG'Z6\+FOOO]>-6X;S7WU%#_9H5Y+&0<.]P[W3U2?"W*/C_PRQY`Q M96C/Z)NZ2D1=3N@A6F$!B1AMQ@2E2F/8V;&ZA46\%KM8D&+WM4QSE_JI]9RE M(["T8YC>,7:WLX#G>TOZ8HN,Y.C7P\8.^SE]&)2W,6C"EIKDASZ*%51NZ/_B M!1,_A2"_%QG5YS]N?^AZ(3_+G]+QC@6L=:^`;/^>_VJO-(B]&:$S[M&2TEX_ M,(A5)QCUE\;MH?[TNCBEO99@-9GN[9C>$K667CU7;^UW<.-UH?+]CV!G?\N, MED2'5128@GGK4!A`O"<\[6]EAW#E,BH,V1R0F^I>21S[=J6?U+=WW[+7QCN8 M#99M9]N__[U[K'USF)7$Q\(^ZHGZ5S_=J4GW8>M;!D0U"JO]3QK7"7X+UZ:Y MA#!TT;^6$H."#I<*],OH`J%I:(/U=7_P5EU?='JXCYP^Z+\9--^9P>K\JL=? M*?V9'<`[P6RSV2[%1M;3XJ"\I9+\,PY;T/7_ARV^ZK"%.1PE)SGYM"M_%8DP ME[5N;=O(G%3=&O@V)MR;KP(7-P#!;B&KFI$F_WFTS9FIS"H+X%>!A]4*2XH/ M6<32VT`JR\\(F$.!'.<39W)#F[-`88[:F5JR M2;BT69>)94W-?'LAD>\[^#,)PDG<7O37;TXS4+D9F M"V-.L_GPVN>K>WM_7VY27M!'N0)%6[ M1ANVA4#4[*G").]^&GUX0+A\I)'VM;=^Y"S?P8?-S'IM M5%'*`06+3#:[.[-O9M[;1U.&@L+ZP:7HK8-N#I(YT/Z^VPIKL@7,4?J]07/. MXU-?B4.'Q%5C&XS&\7DP_7%Q-AZ]Q5=R3^%W?8P[UG>S.H2]6$4C^-*M)DFO M`4+UO7N[BV=)1Q`&',5>VR'G)S?SX25D+N?Q#-OJ(5GGOWP)AOFM"KZ[G8^=?7%G M;J5H(.S0*#]U'*6V68^2\P+C)D"-CEUAI.`OARQG%&ND'R=="W'M)$ASQ@+( M8%J;M8LGLL>ES-V3A.3`80+)>9X(?P,9Z/L;:((-".IQ!O!$(56V^A][P\T; MS.'/@UMK4GD)^HK@]2\BN<)5%*N$CDI$YA<9=FN5>AIFZLLM<`W"\1%A$(UT M\$2^KR#9+!-==N3S7P>3`:X0&)_-XJ%`>$2Z>3P9_#.\8?GW=J?QQ=5HT,`/ M-?+N>\QU5U5%/XJP\'W\(?V<%66ADAG2& ML)U;-D"_PTA*MLW))9Z.-EI932C'&^?AX-I@&_4`R M;3J',8%US*<3O;#F63W%-^*;5%9W(@(.0@Q`IOQ&1_&+B4,NADH(\W*!5+%P M2W86DHW/%C?9T(*.O]?T`:X'^28LAWY>LTOTV="U#TJ*8N1JSEFYX58KC]F! M'$-7BW5)F.)V'2?9QI%_^.V:DKD878:U$#KPCZ!4/>WL=.M(4>O@7%B2@IFJ M`6TNK(:`$MDR^!#8X+;^:7T,;-=0A];6I)X0C(M`I,86CV:'UP6B*EZ=,Q4\\F8SGA]=7 M?'6"<8U_G[H@XMKM\E[E:[Q,'O%AWVQP8E9\Z8@4)323?O<'4$L!`A0`%``` M``@`X&EY*5;(]J4(&P``/$H``!```````````0`@`+:!`````')O;65O+65D >(7-O;BYT>'102P4&``````$``0`^````-AL````` ` end sum -r/size 33319/7050