<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Arial","sans-serif";
color:#000099;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple style='word-wrap: break-word;
-webkit-nbsp-mode: space;-webkit-line-break: after-white-space'>
<div class=WordSection1>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'>Everyone in the trailer:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'>There seems to be an issue with SSH coming from a machine in the
trailer with an IP address of 128.111.28.94 – DHCP, so it’s probably a laptop.
Is anyone doing anything special with SSH on port 2222?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'>Please check the IP address of your machine and let me know if
it’s 128.111.28.94.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'>Thanks,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'> Matthew<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Andreas Boschke
[mailto:andreas@cs.ucsb.edu] <br>
<b>Sent:</b> Tuesday, July 13, 2010 2:56 PM<br>
<b>To:</b> Matthew Turk<br>
<b>Subject:</b> Re: [COMS #30394] Re: [UCSB-OIT #252085] SSH service on
128.111.28.94 port 2222 <o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Hi Matthew:<o:p></o:p></p>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>It seems to be from the trailer. <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<p class=MsoNormal>-Andreas<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div>
<div>
<p class=MsoNormal>On Jul 13, 2010, at 2:40 PM, Matthew Turk wrote:<o:p></o:p></p>
</div>
<p class=MsoNormal><br>
<br>
<o:p></o:p></p>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'>Andreas,</span><span style='color:black'><o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'> </span><span style='color:black'><o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'>Do you know if this is from Trailer 932 or from the Foglab (in
Elings Hall)?</span><span style='color:black'><o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'> </span><span style='color:black'><o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'>
Matthew</span><span style='color:black'><o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:#000099'> </span><span style='color:black'><o:p></o:p></span></p>
</div>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in;
border-width:initial;border-color:initial'>
<div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";
color:black'>From:</span></b><span class=apple-converted-space><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> </span></span><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>Andreas
Boschke [<a href="mailto:andreas@cs.ucsb.edu">mailto:andreas@cs.ucsb.edu</a>]<span
class=apple-converted-space> </span><br>
<b>Sent:</b><span class=apple-converted-space> </span>Tuesday, July 13,
2010 11:10 AM<br>
<b>To:</b><span class=apple-converted-space> </span>Matthew Turk; Tobias
Hollerer<br>
<b>Subject:</b><span class=apple-converted-space> </span>Fwd: [COMS
#30394] Re: [UCSB-OIT #252085] SSH service on 128.111.28.94 port 2222</span><span
style='color:black'><o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='color:black'>Hi Matthew and Tobias:<o:p></o:p></span></p>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>In the Ilab, IP 128.111.28.94 from
the DHCP pool is having SSH trouble.<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Would you please ask if the user
is doing anything special with SSH on PORT 2222? <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Thanks, <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>-Andreas <o:p></o:p></span></p>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>REF:<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>=<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Starting Nmap 5.21 (<span
class=apple-converted-space> </span><a href="http://nmap.org">http://nmap.org</a><span
class=apple-converted-space> </span>) at 2010-07-13 11:09 PDT<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Nmap scan report for
ilab-94.cs.ucsb.edu (128.111.28.94)<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Host is up (0.00052s latency).<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Not shown: 995 closed ports<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>PORT STATE SERVICE<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>22/tcp open ssh<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>139/tcp open
netbios-ssn<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>445/tcp open
microsoft-ds<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>2222/tcp open unknown<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>4445/tcp open unknown<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>=<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Begin forwarded message:<o:p></o:p></span></p>
</div>
</div>
<div>
<p class=MsoNormal><span style='color:black'><br>
<br>
<br>
<o:p></o:p></span></p>
</div>
<div>
<div>
<p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Helvetica","sans-serif";
color:black'>From:<span class=apple-converted-space> </span></span></b><span
style='font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black'>"<a
href="mailto:security@ucsb.edu">security@ucsb.edu</a><span
class=apple-converted-space> </span>via CS Support" <<a
href="mailto:support@cs.ucsb.edu">support@cs.ucsb.edu</a>></span><span
style='color:black'><o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Helvetica","sans-serif";
color:black'>Date:<span class=apple-converted-space> </span></span></b><span
style='font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black'>July
13, 2010 10:01:17 AM PDT</span><span style='color:black'><o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Helvetica","sans-serif";
color:black'>Subject:<span class=apple-converted-space> </span>[COMS
#30394] Re: [UCSB-OIT #252085] SSH service on 128.111.28.94 port 2222<span
class=apple-converted-space> </span></span></b><span style='color:black'><o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><b><span style='font-size:9.0pt;font-family:"Helvetica","sans-serif";
color:black'>Reply-To:<span class=apple-converted-space> </span></span></b><span
style='font-size:9.0pt;font-family:"Helvetica","sans-serif";color:black'><a
href="mailto:support@cs.ucsb.edu">support@cs.ucsb.edu</a></span><span
style='color:black'><o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Tue Jul 13 10:01:17 2010: Request
30394 was acted upon.<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Transaction: Ticket created by<span
class=apple-converted-space> </span><a href="mailto:security@ucsb.edu">security@ucsb.edu</a><o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span class=apple-converted-space><span style='color:black'>
</span></span><span style='color:black'>Queue: General<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span class=apple-converted-space><span style='color:black'>
</span></span><span style='color:black'>Subject: Re: [UCSB-OIT
#252085] SSH service on 128.111.28.94 port 2222<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span class=apple-converted-space><span style='color:black'>
</span></span><span style='color:black'>Owner: Nobody<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span class=apple-converted-space><span style='color:black'> </span></span><span
style='color:black'>Requestors:<span class=apple-converted-space> </span><a
href="mailto:security@ucsb.edu">security@ucsb.edu</a><o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span class=apple-converted-space><span style='color:black'>
</span></span><span style='color:black'>Status: new<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span class=apple-converted-space><span style='color:black'> </span></span><span
style='color:black'>Ticket <URL:<span class=apple-converted-space> </span><a
href="https://rt.cs.ucsb.edu/Ticket/Display.html?id=30394">https://rt.cs.ucsb.edu/Ticket/Display.html?id=30394</a><span
class=apple-converted-space> </span>><o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>I think we know the answer by now.<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>81.218.143.158 has been
null-routed for the attack.<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Thanks,<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>--<span
class=apple-converted-space> </span><o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Igor Shabaltas<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Campus Network Programmer<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>University of California, Santa
Barbara<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'><<a
href="mailto:igor.shabaltas@ucsb.edu">igor.shabaltas@ucsb.edu</a>> (805)
893-7939<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Greetings<span
class=apple-converted-space> </span><a href="mailto:support@cs.ucsb.edu">support@cs.ucsb.edu</a>,<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Could you confirm that SSH service
on 128.111.28.94 port 2222 is started by the user on purpose?<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Host name is ilab-94.cs.ucsb.edu,
MAC address - 000c2973eeb7,<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>location - most likely bldg.489
(TB-Sycamore).<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>noc$ nc 128.111.28.94 2222<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>SSH-2.0-OpenSSH_5.3p1
Debian-3ubuntu3<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>^C<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>noc$ date<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Tue Jul 13 09:29:12 PDT 2010<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>There is someone out there who is
probably (as it looks to me) running a slow-pace dictionary attack against this
box/service (and another three systems on campus, same port) or, for unknown
reason, repeatedly (last night every 6 or so mins) trying to connect to the
box. Here is a short traffic sample:<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>Start<span
class=apple-converted-space>
</span>SrcIPaddress<span class=apple-converted-space>
</span>SrcP<span class=apple-converted-space> </span>DstIPaddress<span
class=apple-converted-space> </span>DstP<span
class=apple-converted-space> </span>P<span
class=apple-converted-space> </span>Fl Pkts<span
class=apple-converted-space> </span>Octets<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>0713.07:41:44.341 81.218.143.158<span
class=apple-converted-space> </span>35784<span
class=apple-converted-space> </span>128.111.28.94<span
class=apple-converted-space> </span>2222<span
class=apple-converted-space> </span>6<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>120<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>0713.07:41:44.339 81.218.143.158<span
class=apple-converted-space> </span>36453<span
class=apple-converted-space> </span>128.111.145.6<span
class=apple-converted-space> </span>2222<span
class=apple-converted-space> </span>6<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>120<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>0713.07:41:44.351 81.218.143.158<span
class=apple-converted-space> </span>46575<span
class=apple-converted-space> </span>128.111.40.225<span
class=apple-converted-space> </span>2222<span
class=apple-converted-space> </span>6<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>120<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>0713.07:41:44.337 81.218.143.158<span
class=apple-converted-space> </span>46865<span
class=apple-converted-space> </span>128.111.127.36<span
class=apple-converted-space> </span>2222<span
class=apple-converted-space> </span>6<span
class=apple-converted-space> </span>3<span
class=apple-converted-space> </span>13<span
class=apple-converted-space> </span>1212<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>0713.07:47:58.148 81.218.143.158<span
class=apple-converted-space> </span>50653<span
class=apple-converted-space> </span>128.111.145.6<span
class=apple-converted-space> </span>2222<span
class=apple-converted-space> </span>6<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>120<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>0713.07:47:58.167 81.218.143.158<span
class=apple-converted-space> </span>48479<span
class=apple-converted-space> </span>128.111.40.225<span
class=apple-converted-space> </span>2222<span
class=apple-converted-space> </span>6<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>120<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>0713.07:47:58.148 81.218.143.158<span
class=apple-converted-space> </span>54523<span
class=apple-converted-space> </span>128.111.127.36<span
class=apple-converted-space> </span>2222<span
class=apple-converted-space> </span>6<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>2<span
class=apple-converted-space> </span>120<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'>0713.07:47:58.164 81.218.143.158<span
class=apple-converted-space> </span>42976<span
class=apple-converted-space> </span>128.111.28.94<span
class=apple-converted-space> </span>2222<span
class=apple-converted-space> </span>6<span
class=apple-converted-space> </span>3<span
class=apple-converted-space> </span>12<span
class=apple-converted-space> </span>1152<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
</blockquote>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
</div>
<div>
<p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p>
</div>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</body>
</html>