TrojanDownloader.Win32.Karagany.1_defbb8080f – Adaware

Trojan-Downloader.Win32.Karagany.1.FD, Trojan.Win32.Swrort.3.FD, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: defbb8080faaf9e2b6a63bb279d7671a

SHA1: 861c50b084228eb8b427cec7dd667c2a50dd9e72

SHA256: d25e4a62b2ec7746354975e4910c40cfc7f8257c26bb067e0a3ccf9a7837e4b3

SSDeep: 196608:t8OsBtDCZuo3JtmbZGlC28deO/rGZWKC6S:t8OECkcmtf28deOiEKC6S

Size: 8303616 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, ACProtect141

Company: no certificate found

Created at: 2014-05-08 15:59:48

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan-Downloader creates the following process(es):No processes have been created.The Trojan-Downloader injects its code into the following process(es):

%original file name%.exe:848

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:848 makes changes in the file system.

The Trojan-Downloader creates and/or writes to the following file(s):

C:\Windows\System32\sky.sys (11948 bytes)

Registry activity

The process %original file name%.exe:848 makes changes in the system registry.

The Trojan-Downloader creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\defbb8080faaf9e2b6a63bb279d7671a_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\defbb8080faaf9e2b6a63bb279d7671a_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\defbb8080faaf9e2b6a63bb279d7671a_RASMANCS]
"FileDirectory" = "%windir%\tracing"
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\defbb8080faaf9e2b6a63bb279d7671a_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\defbb8080faaf9e2b6a63bb279d7671a_RASMANCS]
"EnableFileTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan-Downloader deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan-Downloader installs the following kernel-mode hooks:

ZwSetValueKey

Using the driver " %System%\sky.sys" the Trojan-Downloader attaches its filter-device object to the Volume Device Object (VDO) of the file system driver.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan-Downloader file.
Delete or disinfect the following files created/modified by the Trojan-Downloader:
C:\Windows\System32\sky.sys (11948 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 1.0.0.1
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.1
File Description:
Comments:
Language: German (Germany)

Company Name: Product Name: Product Version: 1.0.0.1Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.1File Description: Comments: Language: German (Germany)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	6795264	6795264	4.98041	443238bafa88c0881309bf35eb5299d4
.sedata	6799360	1499136	1496064	5.50141	140aa0eec78c779d5b8078f67d9d7d40
.idata	8298496	4096	1536	2.64096	1f085a0f6fbf1815f1966ec8d529ea94
.rsrc	8302592	8192	5632	3.88454	c6e01957a65fa7b803eccba66e238482
.sedata	8310784	4096	4096	5.5344	96b78b1e0e7ae01cf1ec72b521938b20

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.jdcfuzhu.com/config.txt
hxxp://www.fz911.com/888.txt	122.224.35.16
hxxp://feeds.qzone.qq.com/cgi-bin/cgi_rss_out?uin=2242620538	163.177.90.110
www.wg233.com	27.148.158.14

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /cgi-bin/cgi_rss_out?uin=2242620538 HTTP/1.1

Host: feeds.qzone.qq.com

Accept: text/html, application/xhtml xml, */*

User-Agent: avhttp/2.9.9

Connection: close

HTTP/1.1 404 Not Found

Content-Type: text/html

Server: QZHTTP-2.38.18

Connection: close

Date: Sat, 26 Nov 2016 12:50:40 GMT

Content-Length: 0

GET /config.txt HTTP/1.1

Host: VVV.jdcfuzhu.com

Accept: text/html, application/xhtml xml, */*

User-Agent: avhttp/2.9.9

Connection: close

HTTP/1.1 404 Not Found

Server: nginx

Date: Sat, 26 Nov 2016 12:46:23 GMT

Content-Type: text/html

Content-Length: 162

Connection: close

<html>..<head><title>404 Not Found</title></head>..<body bgcolor="white">..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>....

Map

The Trojan-Downloader connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_848:

.text

`.sedata

h.idata

H.rsrc

@.sedata

tFHt:Ht.Ht"Hu`

j%XtL9E

SSSSh

tWSShW

tl9_ tgSSh

t'SShl

FTCP

tAHt.HHt

u$SShe

@ SSHPWj

FtPW

SSh@B

sSShG

zSShN

xSSSh

FTPjKS

FtPj;S

C.PjRV

user32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

CCmdTarget

CNotSupportedException

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

KERNEL32.DLL

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

lX-X-x-XX-XXXXXX

RegOpenKeyTransactedA

Advapi32.dll

RegCreateKeyTransactedA

RegDeleteKeyTransactedA

comctl32.dll

comdlg32.dll

shell32.dll

mfcm100.dll

Of:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Shell32.dll

%s:%x:%x:%x:%x

RegDeleteKeyExA

lXXxXXXXXXXX

kernel32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

%sMFCToolBar-%d%x

%sMFCToolBar-%d

%sMFCToolBarParameters

TOOLBAR_RESETKEYBAORD

&%d %s

CMDITabProxyWnd

CMDIChildWndEx

CMDIFrameWndEx

KeyboardManager

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

MFCLink_UrlPrefix

MFCLink_Url

ole32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

%sPane-%d%x

%sPane-%d

%sBasePane-%d%x

%sBasePane-%d

windows

ShowCmd

%c%d%c%s

CMDIChildWnd

CMDIFrameWnd

CMDIClientAreaWnd

%sMDIClientArea-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

Hex={X,X,X}

%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

CMFCToolBarsKeyboardPropertyPage

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

ENABLE_KEYS

KEYS_MENU

KEYS

RGB(%d, %d, %d)

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d

GetProcessWindowStation

operator

portuguese-brazilian

%d / %m / %y

%I : %M : %S %p

%m / %d / %y

%b %d %H : %M : %S %Y

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

_http_version

.rmvb

.html

.jpeg

.divx

.mpeg

.moov

.opus

.webm

video/webm

HTTP/1.1

avhttp/2.9.9

https

E:\LIB\Boost\include\boost-1_55\boost/exception/detail/exception_ptr.hpp

CLoginDlg

VVV.jdcfuzhu.com

jdcfuzhu.com

hXXp://VVV.jdcfuzhu.com/neiye.htm

hXXp://VVV.jdcfuzhu.com/config.txt

config.hh_str

config.pop_url

hXXp://feeds.qzone.qq.com/cgi-bin/cgi_rss_out?uin=2020754854

hXXp://feeds.qzone.qq.com/cgi-bin/cgi_rss_out?uin=2242620538

sky.sys

%s//%s

%s\%s

E:\LIB\Boost\include\boost-1_55\boost/property_tree/ini_parser.hpp

duplicate key name

key expected

E:\LIB\Boost\include\boost-1_55\boost/property_tree/detail/ptree_implementation.hpp

E:\LIB\Boost\include\boost-1_55\boost/property_tree/string_path.hpp

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl

%s (%s:%d)

%Y-%b-%d %H:%M:%S%F %ZP

%O:%M:%S%F

%Y-%m-%d %H:%M:%S%F%Q

%Y%m%dT%H%M%S%F%q

OpenSCManager() Faild %d !

OpenService() Faild %d !

StartService() Faild %d !

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

asio.misc

asio.misc error

thread.entry_event

thread.exit_event

Unsupported media type

HTTP version not supported

SOCKS unsupported version

SOCKS unsupported authentication version

SOCKS command not supported

Unknown HTTP error

d:d:d

d:d

%a, %d %b %Y %H:%M:%S GMT

httponly

%Y%m%d

%Y-%m-%d

boost thread: trying joining itself

.?AVCTestCmdUI@@

.?AVCCmdUI@@

.PAVCUserException@@

.PAVCOleException@@

.PAVCObject@@

.PAVCMemoryException@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.PAVCFileException@@

.?AVCMFCToolBarCmdUI@@

.?AVCMDITabProxyWnd@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMDIClientAreaWnd@@

.?AVCMFCRibbonCmdUI@@

.?AVCMFCColorBarCmdUI@@

.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@

.?AVCMFCAcceleratorKey@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@

.?AVCMFCRibbonKeyTip@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÃ

.?AVwindows_file_codecvt@@

(3-!0,1'8"5.*2$

.?AVCCmdTarget@@

.PAVCException@@

.?AV?$_Ref_count@V?$vector@V?$basic_resolver_entry@Vtcp@ip@asio@boost@@@ip@asio@boost@@V?$allocator@V?$basic_resolver_entry@Vtcp@ip@asio@boost@@@ip@asio@boost@@@std@@@std@@@tr1@std@@

.?AVhttp_stream@avhttp@@

.?AVgmt_time_input_face@?A0xa1232f6a@detail@avhttp@@

.?AVerror_category_impl@detail@avhttp@@

.?AV?$service_base@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@

.?AV?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@

.?AV?$service_base@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@

.?AV?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@

.?AV?$typeid_wrapper@V?$resolver_service@Vtcp@ip@asio@boost@@@ip@asio@boost@@@detail@asio@boost@@

.?AV?$typeid_wrapper@V?$stream_socket_service@Vtcp@ip@asio@boost@@@asio@boost@@@detail@asio@boost@@

.?AVCLoginDlg@@

.?AV?$bind_t@XV?$mf4@XVCLoginDlg@@UtagPROCESSENTRY32@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@_K@_mfi@boost@@V?$list5@V?$value@PAVCLoginDlg@@@_bi@boost@@V?$value@UtagPROCESSENTRY32@@@23@V?$value@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@23@V523@V?$value@_K@23@@_bi@3@@_bi@boost@@

c:\%original file name%.exe

#T$7%F

O1^.IC$F9?@

%f&=-.

^.IC$h

JBEGHDGEN>%D;8

DH a.JM \

d(G1.JI!fq

.Yd0C

l W5^.EG

k!JB%S,L;Q*b!k

9&f%S

f!;$87%f

`.rdata

@.data

.vmp0

`.reloc

@.rsrc

K.ykY8

\%sbr-

E:\20140112\

\free_wg\Release\ly.pdb

KERNEL32.dll

GetCPInfo

ly.dll

!.Wq@

7.jy@S

LeY%S

%CUh`

XcRT

Jh%fy

`EH.Eh

O%UQT

E%ulK

.CnP2

crTO

%CrS1

(<.wt>

RFB%C

%cn`F

hU.GMXH

L^Ã„

[AK.yk

%FsV^;

bcrT

.towz

P%fH*

.XNJZ`"9

=.lw\

N.Md>4

.zhK@

.jzHZ6

yYP%fUxy

$c g%S

KE%XL

h%CUh`

*M5.lw6

1@%Xqb

N=.lwL

.kZ@i{

L${t

.nQeO

<.ch2gm>

\%sbr

@O.wpI

.gVyz

B.hx!D

?.TBM

=eihU.Gu

`h%F:3

#!.LI

0RÃ‹9

NI.zH

E.JoU

9!;:;,

5 5$5(5,5

7%8,898?8

% SSh

tXSSh

@ SSh

comctl32.dll

comdlg32.dll

shell32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

RegOpenKeyTransactedA

o@f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

lXXxXXXXXXXX

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

%c%d%c%s

CMDIChildWnd

CMDIClientAreaWnd

Hex={X,X,X}

%sMFCOutlookBar-%d%x

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

cmd.exe

GetProcessWindowStation

%d / %m / %y

boost::filesystem::directory_iterator::operator

Can't terminate a sub-expression with an alternation operator |.

A regular expression can start with the alternation operator |.

Alternation operators are not allowed inside a DEFINE block.

More than one alternation operator | was encountered inside a conditional expression.

A repetition operator cannot be applied to a zero-width assertion.

Invalid alternation operators within (?...) block.

The \c and \C escape sequences are not supported by POSIX basic regular expressions: try the Perl syntax instead.

Found a closing repetition operator } with no corresponding {.

The repeat operator " " cannot start a regular expression.

The repeat operator "?" cannot start a regular expression.

The repeat operator "*" cannot start a regular expression.

right-curly-bracket

left-curly-bracket

0123456789

Unmatched quantified repeat operator { or \{.

Invalid preceding regular expression prior to repetition operator.

Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag

.\Map\%s.map

%s %d %d

]*>

$URL: VVV.lua.org $

?! %d,%d

%s//config//%s.ini

t! 0.%d

NotMsgDlg

video/webm

luabind.function

luabind does not support class names with extra nulls

property '%s' is read only

No such operator defined

bad argument #%d (%s)

calling '%s' on bad self (%s)

bad argument #%d to '%s' (%s)

%s expected, got %s

%s:%d:

invalid option '%s'

stack overflow (%s)

name conflict for module '%s'

cannot %s %s: %s

PANIC: unprotected error in call to Lua API (%s)

attempt to %s %s '%s' (a %s value)

attempt to %s a %s value

attempt to compare two %s values

attempt to compare %s with %s

%s:%d: %s

invalid key to 'next'

in function '%s'

in function

missing '[' after '%%f' in pattern

^$* ?.([%-

'string.gfind' was renamed to 'string.gmatch'

invalid replacement value (a %s)

invalid option '%%%c' to 'format'

no function environment for tail call at level %d

%s: %p

cannot resume %s coroutine

%s: %s

standard %s file is closed

field '%s' missing in date table

system error %d

'package.%s' must be a string

no file '%s'

error loading module '%s' from file '%s':

luaopen_%s

no module '%s' in file '%s'

'package.preload' must be a table

no field package.preload['%s']

loop or previous error loading module '%s'

'package.loaders' must be a table

module '%s' not found:%s

.\?.lua;!\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua

.\?.dll;!\?.dll;!\loadall.dll

invalid value (%s) at index %d in table for 'concat'

'%s' expected

main function has more than %d %s

function at line %d has more than %d %s

'%s' expected (to close '%s' at line %d)

%s: %s in precompiled chunk

char(%d)

%s near '%s'

?#%X.y

%S#[k

\free_wg\Release\free_wg_dll.pdb

\" $\" @\"

`" |`" \

({" 4{" \

cL.nMn4

$ !$

"$ $"$ @"$ \ $

GetWindowsDirectoryA

CreatePipe

GetProcessHeap

GetAsyncKeyState

GetKeyNameTextA

MapVirtualKeyA

GetKeyState

UnhookWindowsHookEx

SetWindowsHookExA

CreateDialogIndirectParamA

GetKeyboardLayout

GetKeyboardState

MapVirtualKeyExA

USER32.dll

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GDI32.dll

MSIMG32.dll

COMDLG32.dll

WINSPOOL.DRV

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

RegDeleteKeyA

RegEnumKeyA

RegEnumKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

COMCTL32.dll

SHLWAPI.dll

OLEAUT32.dll

WS2_32.dll

GdiplusShutdown

gdiplus.dll

OLEACC.dll

IMM32.dll

WINMM.dll

free_wg_dll.dll

0.nUQ

lPttd%d

%C(CIj

8.vhx

.lVGi1l

CD.BH

?%U,l

=.xr{

>)>1>&?8?

5%6U6

3/34393?3}3

9(9-92989S9X9}9

4'4/494_4

:0:4:8:<:>

4 4$4(4,40444

4054585

7%7.747:7

2%2s2

>(?,?0?4?8?

0 0$0(0,0004080

9 91979=9

1$1@1\1|1

!040[0{0

?%? ?8?\?

1-2

8-9@9-:@:6;

?1?=?^?~?

: ;%;8;>;

=&=,=:=^=

0%1S1Y1t1y1

0%3U3

=5=[=`=|=

6$747?7|7

6$6.646]6

9$9(9,9094989

:(:/:4:8:<:>

2 3-3A3h3}3

; ;$;(;,;0;4;8;

5-6&7.;:?

4$6(6,6064686

? ?$?(?,?0?4?

7 7$7(7,707

: :$:(:,:

2 2$2(2,2

0 0$0(0,0004080

9 9$9(9,909

0 0(000

9 9@9`9|9

> >@>`>

3$3,383\3|3

= =,=0=8=

true

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

127.0.0.1 VVV.lefengha.com

127.0.0.1 lefengha.com

127.0.0.1 sanshafz.com

127.0.0.1 VVV.sanshafz.com

4&.OZ

6%Urq

VWbm.OQ

W%UI3

cRtsn

.zwh~1

o.TY)

C)Q%Xc!

EnumChildWindows

\free_wg\Release\ws.pdb

WS.dll

{.TJ8^$~

fTPd

d.TF

.TZ(Vu WC

:$:(:,:0:4:8:<:>

;(;/;4;8;

5G!7I&S)>S,AV-BW0EZ.FZ/G[1I]2J^3K_4L`5Ma8Pd9Rf;ThYn=Xm>Vl@XnE]sH`vLcyQh~Rj~Tl

QgyMcuI_qF\n@Vh:Pb4J\0FX.DV-CU-AS/AR.@Q,@Q-AS.BT-AS AS)?Q AS,BT-CU,DV.FX1I[4L^:Rd8Pb3K]/GY.DV*@R&

3H"8J'=O-AS1EW4HZ6J\9Oa6L^2HZ/EW*BT(@R(@R(@R)AU.FZ/H\ DX)BV DX6Oc7Pd2K_4Ma1J^2K_

Ng{G_sD]q@Ym>Wk>WkAZnE]sG_uD\rF^tC^sLg|GbwNi~Ke}FavKc{G_uH`xC[q?Vl;Rh7Nd6Nb2J^ CW,AV'=O"7L"7L$9N&;P$9N"7L%:O'P$=O$

8H!:J$:L%:O(=R*?T @U.CX1F[0EZ*?T*?T @U.CX5J_Sh=Rg>Sh>Sh@UjAVkAVk>ShSh?Ti=Ui>VjAYkG_qKevOizSl

?XrA[sBZr;Si4Lb5Mc3Ka-E[/F\0H\1H^1H^/F\-DZ*AW)@V*AW.E[0G]-EY.CX-EW0FX-EW-EW-EW CU)AS(@R'?Q'?Q(@R*BT)AS'?Q&>P$=O$=O$=O$=O'=O&

.@ 7G 7G 7G!8H 9I";K%>N&>P#;O$=Q)>S @U,AV-BW.CX0EZ-BW5J_?TiEZoI^sK`uK`uJ_tF[pEZoEZoEZoEZoDYnDYnDYnDYnDYnBZnBZnC[mIasMgxQj~Og}Iaw;Si=UkSk

3E!2E$4E_(8I*:K):M*;N*;N*;N';M(

Jc}Jc}Ic{Kc{JbzE]u=Um8Rj4Ph6Ph;WoE_wFbzD^vP)=O%M(=L&=L)=N'>N(P*>P)?Q,@R,@R.?R/@S2CV4EX3GY3GY3F[3GY5H]6J\7J_6J\3H]2G\1F[/DY-BW,BT AS*@R(>P&

Gb}@[vE`{Ha{F_yIb|Md~Kb|J`yJ_zH`xGayFbzEayC_w@\t@\tA]uC_wC_wFcxIdyE`uA\q?Zo>YmP&?O'?Q(AQ(AQ'@P'@P(AQ)BR)BR)BR(AQ)AS CU,DV-EW.FX/GY/GY/GY0HZ0HZ3I[2J\2J\2J\2J^2J^4L`4L`4L^4L^4L^5M_6N`6O_ AS*BT-CU,DV/EW-EW/EW.FX2HZ0HZ2G\/G[0EZ/G[2G\4I^3H]3H]4I^4I^4I^4I^4I_4I^5J`6K`6Ka6K`4I_4I_4I_4I^/G[0H\/G[.FZ,DX CW*BV*BV(=R*?T @U*?T'R$=Q%R&>R$=Q&;P%:O)?Q)?Q*?T @U*?T)>S(=R&;P)?Q AS-CU/EW2FX2FX2FX1EW/CU-CU0FX0FX1I[-EW CU0HZ4L`8Oe-E[:RhH`vLg|Yt

Jc}Lb~Ka}E[wG\xH]yGZuL^{H]xF^v>Xp@ZrA[s?YqC]uFcxDavB_tC`uC`uCatA_r@^q@^qB]r?Yq?Yq?WoXp>Yn>Yn@[pB]rB]rD\rE]sE]sD\rC[qD[qD[qD[qCZpAYm>Uk:Rf6Mc5Ma4L`2K_1J^/IZ-FZ-EW,DV.DV.DV.DV-CU-CU/EW1GY0EZ0EZ/G[0H\1I]2J^1J^2K_3L`3L`5Ma4Ma5Nb5Nb5Nb5Nb4Ma5Nb5Nb6Oc6Oc6Oc6Oc7Qb CW,DX.FZ0H\1I]2J^3K_3K_5Ma5Ma3K_3K_2J^3K_3K_4L`2I_3J`4Ka5Lb5Lb5Lb6Mc7Nd8Mc9Nd:Oe9Nd8Mc7Lb5J`2I_2J^3K_3K_2J^1I]/G[.FZ.FZ/DY0EZ1F[1F[/DY.CX.CX-EY CY)AW(?U'>T(@T)AU-BW/DY/EW0FX1F[1F[1F[0EZ1F[1F[3I[4J\5K]5K]4J\3I[4HZ2HZ5I[3I[0FX.FX.FX0HZ7Oa4Ma5LbG_ui

Kh}If{HezGdyFcxEbwEbwDavB_t@]rA_r?]pYm=XlWk>WkAZnAZnAZn@Ym@Ym@Ym@Ym@Ym;Zq;Zq:Yp:Yp:Yp]t=\s>]t?^u?^u?^u=\s;Zq:Yp8Wn7Vm6Ul6Ul8Wn;Zq=\s>]tZr?[sD`xKg

Li~Li~Kh}Jg|If{If{GdyFcxEbwEbwEbwEbwCbwDcxDcxDcxCbwCbwFcxGdyIf{Jg|Kh}Li~Kh}Kh}Li~Li~Li~Li~Li~Li~Li~Mj

)8.EU5O_>Vh0DV,7M.6M`k

%:.FZg{

4I.AV#5L(8O=Hc

*O$;a.GoRh

(7J]l.AP8M\

VryWw}@_h3OZAXg*:K8FX8HX

(*-6:&,1'04

577387065378015

!-3)5;.8?

64'

!""%#"&!

)'&%#"!&%

$"!(&%%%%

'(&""""$%

"&'$&'!#$

!"&.-p}{h}{-?>

!")%*(!(

#"&'"$(&&

(($$$#"$

%%&* "'(

!!&()&)-)03

!$%(, ,0$()

!")&(-(*0..

278&"',& *&,"&

## #%%*,,#'(*36#47

!(- 1*#*

&,1* /%&*,05

39@**0, 4

1*1-)/..4!',

&%-

(-,/--502 *.

*6:(-.0..2-.0-/

.-13/4()-

::@117228.16$(-

,/7428.,2 48

%'*14,14037.15

%(%-4*29

"(% 2/38-25-77 0/

(/2.34-55

&&!'&.,,5/0:45

!,047;3566:;,14

'*2:8>44:'-2

#>B AF/BG4DK4@J4@J8GP2EL)?E)CI$AF%?E CI.DJ/BI2BI3>F5:C'-4'03#//2 0/

.Sely

3;;1561990

#,/879:57548(.3

*./546/47

#8:1:=:>?:?>398(31"0.

378=8;?-8

'.!&' 0/-//133,./ -.*,- -.%* **

%%!--! $/-

.0&24.58056.2379:466@?AACC=?@:

,1"28"/7

\iyObqJbnGao?[f1HW.AN&6C/:H08E'3?,CK HO.ISK.?L>T_BXdSjybx

-:&2>".:

,=#3D&8I$4E$7F >KEXeM`o

%9$/C2CV6GZ5DW,:M ?&4G,:LEPd,8J

EWhDXi?Sd6HY.AP

,?.BT*>O(;J0@P

.BVhv

"0+3BRM

.;$8CGZgEXe):G

(: ,>!-?

)Ch.Jme

'?$1G)6L1

%6 0A0@P6IX.DP0IS

bCV9J]%9K%6I ?Q.BT*>O-DS3JY

$0Âq

(4*@L8IV$4D0?OM*:J

9@0GO.CK7FO9HQ1CJ:MThz

)6.EMLbg

045 $% #'

#,%**%'"!#

)&((#$&%'

""###'&(

Tqv0MT%DMGep{

#$"#'39>

!$ %$$%##'"

'%%&&&$&&

&%)($)%

&.5 /4 .3).1

"&,1"),( /6131,-& *

023---222054

437=;;3645=

')0568:;6;:3;:1

4EHBOQDMPNSTX]\^cbSYXKSSHRR?KMGTVFWZcvy]pu*=D

AV^0FQ*@L$7F-=M4DU_7GX>PaJ^ou

Vex[j}CTi7K].BT/FV,FT6P\6R]@\gDajOjt_s~Vhscw

YiyUhwObqJ\mQctSctQarM]nDVg5GXBVg

'/.CKJ_gNbm$5B

$l/?OAR_@O_9FT2@LJXd6BN*6B0

RfwMarL`q

LZlIUgM[mUevSctJ]l3EV2ET.AP/?O1@P,9I:GW5BR0?O 0@

.IYjFVfr

@Zj@WgH]lSlvPjqYsz[u|J!9E(?N,CR/FU7N]>UdAXgBYhShwTixf{

QfuMbqLapH]lDYhCXgEXeDWdCTaAR_?N^5DT3BR1@P(7G'5G#3D

.FR4HSXirO_f

/57>'18)3:#-4

03.6=

.5&4:-7>% 0

!*(1;&/

-Vf}p

,85

/IZ.GQ=Rao}

).yPe

#%s&*q$(o"$r,'

/@':G(>I1HW;Td:Rd8Pd8Ng6Nf7Qb8Rc7Pd6Nd2J` CY.HX'AQ'>T

.: 3B&6F*:JM

7%4=#1="/=

/@JZf_rzWgsUerWewAOb1

,5!49"4;

,9 0=#3@"2?

0E'8K*>OBWfI^mEYj>Od?Pe?Pe>PaEXeCVcJ\:EY8CW7@T5>R7@T8AU3:N*1E ';

,?"0B#1=!/;1=O?

,>"6G.CRE[gG]i7L[;M^CUfASd@Sb>Q^7JW5DT3AS2@S)7J#/A'4D 7I$/C)4JALbBN`;FZ=Ia8D\;H^>Ka:EY;FZ:EY5@T6?S9BV9BV8AU'0D(1E

=!1=%5

1B$6G.BS/AR6HYGYjCVeFYh?Ra:L]@RcEUfCSdBRc:J[5DT8FX:H[3AT-9K.:L0:L*4F0;O2=S=H\FTg8E[@NdBPf=Ka=K^

9".: .:

%9$/C&1E9EW8DV.:L*7GM0?O ;H

.9#8@.BM.AN(;J):G5FS;MX9JWL\l\l}TawQ]uWc{LXpHUkDQg@LdBNfCNjBNf>N_@P`BRcERhEQiAKc>HY?IZ=GY2=S?KcP]sFVfEVcASdCTgCRe@Na?M`@NaAL`?J^>I]?J^?J^0;O4?S4?S$/C

*>!-?AM_ 7I".@#2BMBR_cs

->?'5H/=O2@R,9I-:J0F1DL0@P/?P0BM'9D

2G/@SN^LbQ`=P_;L_>M`?O\EUb?K];FZ:FXAM_8GW8HUTgoRdo?PeCSjESiDReBPc?M`>L_AObAOb=K^AOb:H[7EX8FY4?S(3G#.B&1E!,@.:L6BT2AQ1@P&6C

5DTM

(5PanQboFYf?R_EXe.AN,=J;LY

.CQg/

>SyBUz9Lq6In3Dk.Ab":L 8D

TbyGTn?Je9E]7C[=Ia3@V-:P8E[[i|JXk@NaAOb@Na=K^;I\:H[=K^:H[;I\>L_

8'7D3CP1AN3BR.=M6CS/

I^t,AP.CRXi

K_p8F\;F\9BV5=N8@Q5?P/;M,:M 9L(6I/=PESfWexWex

/__o

8(.Yny

P^pQ_q#/ACQco}

'9M:FXEUf`t

(4>(/>*1@)2?

"(/,27-6:/7> '0

*[gygs

R^pLZlXfxVdvVdvAOb/=P?/=P,:M8FYYgzWex@K_LWkAL`GRfDOcDOc>I]>I]AM_@L^COaFRd1=O!-?

05.AF

]p}\o|DUb-=J:GU2?O3?Q>I]=H^8AU5>R:AT.6G5

*8@M%.87DL=HVDRdOcuIauH`tJbvG_sD\pD\pAYmG\qRhzPdvQevHZk6IX^!0@(2C)3E 6J'2F*5I'0D29M-2G17J4;L4=K4=K29L17J=>RCGZ>DW=GX;HV7GS5GN6GP=MZGUgGUlGXsI_xH`vNfzI^sRbyRbyMasQev3CT

.AAOa^lxHW`v

8HXl\ly]jxn{

BQaDTaQaqUdwSawR`w@Ne-;Q :ML^7GXP 7O.:R0=S4?S.9M/:N/:N[fz\g{IWjP^qM[nYgzESf&4G3AT5CV/:N0;O1

L^ESe@L^GSeIUgJVhEQcCOa*6H

BQaDTaQaqUdwSawR`w@Ne-;Q :ML^7GXP 7O.:R0=S4?S.9M/:N/:N[fz\g{IWjP^qM[nYgzESf&4G3AT5CV/:N0;O1

L^ESe@L^GSeIUgJVhEQcCOa*6H

P_o.=M>L^5EV8KZ8KZ;Oa7H[9IZ8FX8DV5AS3@P0=M6AW/

;I\?7EX-;N.R09M09M.7K*3G 4H 6J!,@2=QFQecn

3$ ? )=#.BALbLZmBPf3DW@TfSgyM^q]m~Zh{BL^(.A#*;-1D*.@#*;*.@67K58M07K,3G-4G28K48K34H/3F59L8Q?S@AU@DW>EX

$6#*="*; *;%/@

(>?

Q\rKVlGOfFNeFOcDMaCL`DMaBI]IPdNUiKRfBG\:?T6:R4;O 4H#.B-8L1

#4" 9&-

NZrWc{YdzOWn17N& @5:O;>S26I)-@06I06I/6I)0C&,? 1D03H,0C0/C0/C0/C-1C.4G-7H :J*:G/Q6=P2M4?M3CP4ER7GT=JX?LZ

CRTcrt

" $%#$"!%#"*(' #!%&$.&',$%$#%!))

"$%%'( "#!#$

!##*((###'''###

###'($#%$&'"$%

&' #"$ ""#('!%&

"-1"$$($# '&$()

"!!'(!(.&-("' &)25

3;;!%&"!#&%'"&'

$$!&%#$""%##(& &%

##$&&&'%$'%

$$!# &' '&&"!)))

!&%(&&*%$(#$

[]],&'/*)%*(!,)

!02$' -)..*/2-/-',)./

#"$)(,/-%(&-.,.*)0 *1))1, (&&)-."(-

$'. -.) (**(-,%*)

''#)($)').,(-,#()

"%)(* /,..) ,')/,.-,0

(57$*) .)*3,/-*, %(.9=

%( %&,..2,-:65.31/85$, %0.

$02*14 01.01:5640/01/)42}

*-1165-//.-/435*)-7??

2>@*/0-12-//977:454./000.00023(00

$-1.-12/1888.00*,,-32

$"/63053.1/022/11)*.KTX

! 2* /524.-/0/14138358352/1.-1*-1 3:

C`g/HR.GQFbi~

ds|8HTl#3CCQcBN`09MHMbFI^=@U

$5!*8!1>.EMk

)6.BMXmu

U_i.5F* ?*)=&(:-9EGZbk}

': ?Q-AS(>P/CU ?Q.BT*>P

)?2@S,7K7>R8?S5=T4?S4FW.ET7Q]Qjtj

2IY?'3E >ME[gr

WcmDM[7>O17J

/ %4 )6(4@

'9 0@.AN5KVSiov

>/=P2=Q6AU0>Q3AT.=P->Q/@S,=P*

HXh7IZ'8K$3F?)4H,5I.7K)1H'/F 3J.7K'2F&4F-9K/JV=IU7BP7BP7BP7BP2=K8EUHRcAN^9FV,9I0=M4AQ3=N6@Q=GXEO`GQb;EV4

(5 )6*2?$ :

):'2@$/=!-9 ,8

Xl~ThzQewGZo7J_.AV4G\/BW3F[*=R-@U^o

): 9&1? ,8

(4#-> *;!

,*3A)2@/:HALZV_m]ftPXi8@Q

$3!*8(1? )7

ThzL_t?Rg2EZ4G\5H]1DY.AV$7L8I^bs

&5H0>Q.Q0?R,;N*8J)7I*:K2BS3CT0@Q3CT1AR 9K$2D$0B&0B",>

#31@P.=M*9I(7GM

.!):'/@$-;

F[p.CX;Pe8K`/BW2EZ4G\*>P!5G6GZl}

UYkVZlIN]FKZ`etchwRUdPSbTWfSVeJM\@CRFKZ@ETFKZ;@O

Ody4I^.AV4G\:Mb4G\2FX,@R#4G=Nakz

,&4G*8J#1C>#1C$2D,:L,:M-;N1?R9GZ=K^

'; ?!-?

0"*;$,=#

&: ';#*>

!6 ';!(

"6$ ? ';

"5"(;!(9

%6'.? '8

"5!&;%*?& @"'

#5!%7%);

%8 ';!(

/!%7#'9&*

&7%,=#*;

%9#,@" ?

"5 $6!%7!%7

"4",>",>

)!(7)0?%,;

-=!0@ /?

%9! =! =

#%.BENbYbv_h|NWk3

"6#*>$)>

$3$

%9 )=" ?

!5 4H/:N2>P5AS4@R5AS7CU6BT2>P0R5@T5AS4@R3?Q2>P0P4?S6AU8CW9DX8CW8CW9DX;FZ7EX8FY7EX7EX;I\@NaBPcESfHWjL[nAPcHWjAPc:I\`o

4FMa^eyBI])0D'.BSZnBI]&-A")=

.;l$4A*;H*:G M]ETdUdt:IY8GW7FV8GW6EU0@M,

(

#7!(

O]pFTgKYlBPcBPc4BU8FYGUh=K^?(6I-;N:I\HWjGVi>M`BQdN]pFWj?PcCTgM^qO`sPatMasH\nK]nJ\mHZkFXiFXiI[lK]nL^oN`qN`qK]nGYjFXiFXiCUf>PaBTeL^oTfwSevWizXj{FXi7IZASdDVgWk|

!.NUd=DU:@SDI^16K#(=!':!':#)

$7$*=#)

CQd=K^AObR`sLZmLZmESf;I\#1D?-;N4BU;I\7EX3BU=L_FUhDSfFWjFWj@QdAReK_qMasFZlDXjGYjCUfASdASdASd@RcBTeEWhHZkK]nL^oJ\mEWhBTe@RcASd;M^@RcHXiN^oUevWgxSctUevJ\mHZkdv

"7"'% >!':

!5&-AHOcbi}~

\j}@Na>L_FTg>L_:H[>L_,:M3AT.Q0>Q1?R0>Q3BUDSfL[nCReAReGXk?PcPaPa?QbPaBTe@Rc@RcDVgK]nI[l@Rc

Ygz9GZ?M`GUhESfRd:L]7IZ6HY7IZ7IZ7IZ9K\=O`ASd=O`

$8#,@1:N

*>#.B.7K2;O)2F(3G&1E&1E(3G 6J,7K 6J,5I,7K,7K.9M.9M*8K*8K,:M 9L)7J(3G 6J-8L.9M.9M.9M-8L,7K*8K*8K 9L,;N*9L(7J(7J :M'8K(9L-Q6DW.M`;J]=Na9J]3DW5FY8L^;L_

!3&->&->#*;

'5 )7&-!(7

>#2E)8K%4G&5H*9L)7J? 9L5CV5AS5AS6BT3AS/=O3AS:HZ:HZ7EW6FW4DU1AR0@Q1CT6FW8HY9H[7FY6FW6FW6FW6FW5EV4DU9IZ:J[;K\

!.CS`/?LCP`JWg

2#':% >% >

(9%.

'5!*8" 9")8$ :

*>'2F'2F&1E(1E(1E(1E)2F(3G)4H)4H)4H'5H(6I'5H'5H(7J(7J$5H%6I&5H&5H'5H&4G'5H)7J*8K*8K)7J(6I&5H&5H$5H%6I%6I#7I%9K#9K):M Q-

&7"):#*;

&7!):$,=%->

'8 (9!):!):

)="-A&1E#.B$/C'0D(1E)2F*3G*3G)2F'2F'2F)4H 6J(6I)7J)8K(7J#4G$5H$3F%4G%4G$3F?&4G'5H'5H&5H&5H&5H'6I%6I#4G#4G"6H&:L$:L*;N*;N 9L.Q-Q3AT3AT/=P)7J-;N)7J!0C

'8 '8"):#*;

"3 (9"*;!):

'8 *;",=!

):!): (9

&=,4K&.E!)@(0G(0G#,@!*>$-A#,@#,@#,@$-A$-A!*>#,@$/C#.B ?"-A'2F"-A$/C'0D(1E)2F)2F(1E(1E&1E'2F*5I 6J(6I)7J)8K'6I"3F#4G$3F$3F$3F#2E#1D#1D$2E?%4G$3F&5H(7J%6I"3F!2E!5G 6H

.A$3F&5H(7J*9L)8K)8K)8K*9L.Q1?R0>Q.9M1Q0?R0?R0?R0?R1@S0?R/>Q.=P-O/?P/?P-=N*:K*:K ;L-=N-=N,O.>O*:K2BS0@Q3EV;M^3EV3EV4HYVm}

"1")8!*8

&7!(9 ':

*>"-A'0D(1E%.B&/C(1E&/C#,@&/C&/C'0D'0D'0D&/C&/C&1E)4H)4H&4G&4G&5H$3F 1D#4G$3F$3F$3F#2E"1D!0C"1D#2E#2E#2E#4G%6I$5H"3F

3E%6I$5H"0C"0C)4H 6J.Q/>Q*9L?"0C#1D$2E

)Q.Q.=P/>Q0?R0?R.=P-

#1"-;$/=!,:

/$ :!*8&/=

(

3E 4F%6I&5H?*8K2=Q3>R.

*="0C$3F'6I)8K)8K)8K*9L :M,;N.

#6 &9"(;!':

.CHW6;J

-?)9J?'5H,:M*8K/:N.9M#.B(3G*3G(1E(1E)2F)0D'.B%,@#*>#,@#,@#,@$-A%.B&/C&/C&/C&1E&1E#1D$2E$3F"1D"1D%4G"3F 1D!0C!0C!0C

.A,:M9GZ=H\5@T,:M,:M :M*9L,:M 9L?

-@!/B?)8K*9L&5H'6I)7J)7J 9L,:M 9L)7J 9L*8K 9L.

"3$.? (9

'8'-@$*=

"1*/>)/

!.CIV7=J

0!(;(/CIRfOXl)4H)4H? .A#3D_#1D$2E)7J'5H.9M.9M"-A(3G*3G&/C'0D)2F(/C'.B%,@ ';!*>!*>" ?#,@%.B&/C&/C%.B#.B$/C"0C#1D$3F!0C /B$3F"3F

-@ .A#1D)8K*9L*9L&5H&4G)7J*8K)7J(6I(6I*8K'5H*8K.

"3!):"*;#.

(6"/= -;

(:#1C(6H"0B 0A 0A .A?'5H)7J/:N,7K#.B)2F(1E'0D&/C$ ? '; ';#*> )=

(" ?&/C#.B$2E"0C /B /B /B

%9"0C)7J&4G?(6I*8K'5H&4G)7J)7J'5H(6I(5K'4J*7M.;Q/

-",>,8J$0B"0B!/A#1C$4E_"0C&4G'5H)7J/:N,7K#.B&/C$-A#,@#,@#*> '; ';")=

1B 0A"2C&2D&2D$/C"-A?)7J(7J :M%4G /B

,??$2E

/$*= ':")

!5&1E'2F#.B .@'5G>$2D?&4G&4G)7J.9M 6J!,@$-A!*> )=!*>#*>!(!*>#,@"-A"-A

-= 0="2?#3@!1> /?!0@!0@"1A&4F)9J 0@6FV@P`6FV.AP,?Nl

,?? .A .AGQc-4G.5HCJ[PWhcgyIM_;?Q-1C-2A$)8$)8"'6(-

%8&,?")

(

*>" ? )=

(

%9 ';!(

(

*=$2E*3G )=$/C!,@"-A"-A$2E(6I 9L-;N-;N-;N/=P.

DK^/6I4;N.5H2P2>P5AS2>P,8J1=O,8J)5G%/A#-?(/B(/B&-@#-?#.B$2E??&4G'5H)7J*8K(6I*8K,:M-;N/:N/:N/:N0;O/9K1;M2

$8 )= )=

(

$8 ';")=!(

%9 '; )=

(

*='5H&5H*9L$3F!0C!/B&4G&/C )=)2F(1E'2F(3G'5H&4G 9L 9L,:M,:M-;N.

%6 ':$ >

$5 *;"/=

.;!1>"2?

:AT#-?",>)0C,3F 2E)3E"-A"0C$2E$2E?'5H)7J*8K)7J 9L-;N/=P2=Q2=Q1P3=O1;M/9K-7I/8L/8L09M09M09M/8L.7K-6J-8L.9M/:N/:N/:N/:N/:N/:N.9M*5I&1E#.B#1D#1D?

%9$/C"-A(4F'3E(4F'5H"0C(3G)4H'2F#.B

%9 ';!(

)

0")

$;#,@%.B(3G(3G(4F

&9? :M)8K*9L :M$1G%2H/8L-6J(1E)2F&1E 6J,:M*8K-;N*8K)7J(6I(6I,:M,:M? /B#2E#2E!0C$2E'5H(6I&4G$2E#1D#1D$2E$2E$2E$2E#1D#1D#1D"0C"0C .A

6=PBI\2$0B#1D#1D#1D"0C#1D?&4G&4G'5H&4G&4G'5H*8K,:M0;O0;O/:N1:N2;O2;O2;O1:N/8L.7K 4H-6J.7K.7K.7K.7K.7K/8L/;M,8J,8J0P.:L(4F)5G'5G&4F(6H"0B

*@&1E)7J.Q,:M 9L)7J(6I-;N-;N&4G /B!0C"1D /B!/B?&4G"0C"0C"0C"0C"0C"0C!/B!/B .A#1D"0C"0C"0C .A

(9! (4F&2D6EU2?O4CSL[kM]mN^nGZi

&718KIPcY`sNWkR1

( )=!,@#.B$/C'2F)4H)4H(3G??&4G'5H)7J)8K 9L,:M.9M.9M-8L-8L-8L-8L-8L-8L.9M,7K*5I*5I 6J,7K,7K*5I,7K 6J 6J 6J 6J,7K-8L-8L,7K-8L-8L*5I&1E$/C&1E(3G*4F'1C$ >

%8 ':")

)A -C,9O&4J(7J,;N)8K(7J%4G :M :M.=P.

'8(1?'0='0=

( )=!*>#,@%.B&/C&1E(3G(3G'2F???'5H'6I)8K)8K*8K-8L-8L-8L-8L,7K,7K 6J 6J 6J*5I)4H)4H*5I 6J 6J 6J*5I*5I)4H)4H)4H*5I 6J 6J,7K,7K 6J)4H$/C&1E'1C/9K 2E$ >&-@

%8 &9!': &9

3!(

*@#2E#2E)8K,;N(7J,;N,;N.=P-;N(6I'5H?$2E#1D#1D#1D?&4G"0C#1D$2E#1D"0C .A

(6%.

&4$-;#.

(

'; )=" ?$-A&/C(1E'2F&1E'2F'2F?&4G(6I)7J(6I(6I 6J-6J-6J-6J-6J,5I 4H*3G)2F*3G*3G*3G)2F*3G 4H,5I)2F(1E(1E(1E&1E'2F(3G)4H)4H)4H)4H'2F&1E&1E&1E'2F(1E(1E 4H&/C'.A(/B*1D$ >8?R7>Q18K-4G

%8 &9 &9

* )=

)

'; )=" ?$-A&/C(1E&1E'2F'2F'2F&4G(6I(6I'5H(3G*3G 4H 4H 4H*3G)2F(1E(1E(1E)2F*3G)2F'0D'0D)2F 4H'0D'0D&/C&/C&1E'2F'2F'2F(3G(3G'2F&1E&1E'2F'2F(1E'0D!*>*3G,3F$ > 2E ':FM`6=P-4G'1C",>$.@&0B! = ':?FYgq

(

>'6I!0C*9L&5H'6I(6I?

); ,> *

&85?Q&2D!-?&1E2=Q2=Q3>R7CU-9K-9K1=O(5E-:J5?P 5F/9J*4E*4E5?P4 4B%.O4>P6@R'0D-6J2=Q8CW7BV1R4?S2=Q2=Q,7K-8L(3G$-A!*>" ?" ? )=

(

&9(6I?

-@(6I?*8K)7J$2E

*>!,@ ?!,@!,@

*> *

(:",> *

-@'5H'5H,:M 9L'5H&1E#.B!,@

(:",>!-?

IQb&0A+FRdNZl#/A$/C!,@ 6J7BV5CU 9K#1C'5G.=MM'3E&2D

);$.?*4E&0A,6G8@Q7?P5=N2:K5>L/8F5>L1:H)2@&/=*3A8AO8BS2 )=

(#,@#,@#,@" ?" ?" ?!*> )=

*> ? ? ?&1E&1E'2F&1E,7K#.B$/C&1E'2F 6J(3G#.B"-A,7K,8J&2D!-?

%8"(;$*="(;

$0B(3G 6J(3G&4F'5G>#1CM)8H'3E".@".@(4F%/@$.?/9J0:K4

( )=

(" ?!*>!*> )=

';!,@'2F&1E-8L$/C)4H&1E)4H'2F,7K,7K)4H)4H&2D'3E&2D)5G'1C'1C(2D)3E",>%/A! =

);#*=")!(;#)

$7$*=#)

'9$2D??!,@$/E

';!&;!&; %:

%9 '; ';

(

'9!(;!(;

);

(9! !.>

%9"'")=$ ?$ ?")=

$8!*> ?!,@$/C$/C#.B"-A"-A$/C$/C(3G&1E"-A ?&2D,8J-9K$0B#-?$.@#-?",>

)=!,@!,@

&:!&; %:

&: ';!(

(

';!-? ,>

,> .@!/A!1B_(8I$4E"0B"0B

,> .@"0B'3E(4F)5G-9K 5G%/A)0C/6I29L3:M4;N08I-4G.5H07J-4G*4F.8J/8L-6J 4H 4H,5I-6J,5I(1E'2F'2F&1E'0D'0D&/C&/C$-A#,@" ?!*>")=!(

&:!(

#4 *;!

-?!/A#1C"0B!-?*6H,7K(3G'0D(1E-4H18K-4G(/B 2E 2E#*=!(;%/A&0B)2F*3G*3G*3G 4H 4H*3G(1E&1E$/C&/C&/C&/C&/C&/C%.B$-A#,@$ ?#*>")=")="'

%9!(

&:" ?(1E*3G(1E&/C&/C(1E$/C$/C$/C%.B%.B%.B%.B(1E'0D&/C&/C'.B&-A%,@%,@#(=#(="'

%9!(

'9!-?!-?

'5!*8$-;

%7#1C>'3E$0B$0B"0B#1C#1D

&9 ': &9 ':

"7"'

$7 *

%9 ';!(!(

4#*>")%,?

)= )=#,@

%9#*>!(

#7!(

$6",>%,?#*=")

='3E".@8FX_m

&: ';")=$ ?#*>")=!(%,@

%9!($ ?

/ ':%,?&-@&-@!(;

3 &9!&;!&;

&:!*> ':!(;

$7")=%,@

$8 ';")=%,?

fFW ;L#1C

%8 *#,@ )=!(

#7")=&-@")

(: *

%9" ?!(

&9#-?#*=$ > ':#*=

-@#.B(3G 6J/:N-9K*6H)5G,8J.:L-9K 7I.:L-9K*6H(3G(3G 6J,7K*8K&3I$2H%3I(6L,:P0>T2?U2?U8FY8FY:H[N_@P`;K\8HY:J[8HY:J[>N_P`qBRc5FY->Q$5H0ATCTgcw

1 ';%,@!(

&9#*=!(;

*>-8L

(>P*@R)=O4EX,;N*9L1AR-=N$4E>M"1A

CS`*:G[$4A,N0=M2?O5BR8DV7CU6DV8FX9GY9GY6FW6FW:J[;K\