Gen:Variant.Graftor.20505 (B) (Emsisoft), Gen:Variant.Graftor.20505 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 27077c3b86ad486c38d9cca930e84acb
SHA1: 1522a358a93f5b24c2f86344d077e1add316aabe
SHA256: b89defd9460b20e4de12dca6cad4b5d84585fef8bad87efbc7045908d94e9536
SSDeep: 24576:nSrwiH9656uvPq75DKkbyf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY/V:n8wiHaXqBKk s8KuqGaX0ToIBAUZLYt
Size: 1617920 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2015-06-22 15:38:29
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-PSW. Trojan program intended for stealing users passwords.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1332
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1332 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\sp_line_1[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\78072[1].htm (4794 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\c_4[1].gif (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\bg_9[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\lazy_iframe[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\sc[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\more_boss[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\10111ZM324[1].jpg (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\tgbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\t_8[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\ico_ann[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\faspbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\tjrm_img011[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\tjrm_img07[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\xfv174[1].htm (1504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\4399_14294510451[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\left[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bg_4[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20150115[2].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\4399[1].js (902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\headerBg[1].gif (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\chkDomain[1].js (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\c[1].php (1827 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\t_lm[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\n_zm1[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\zb_nav_20131205[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\bg_3[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\0913524M015[1].gif (84 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (8192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\bdsstyle[1].css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\more_zb[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\bg_8[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\unilogin_package[2].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\base[1].css (12385 bytes)
C:\jedata.dll (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\nav_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\unilogin_package[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\4399_10503158122[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\4399[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20141010[2].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\tjrm_img09[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\sy_ico[1].gif (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\4399_17485812405[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\78072[2].htm (3324 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\c_2[1].gif (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\bg_6[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\4399_11234392734[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\style[1].css (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\02163A05453[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\jcsp_1[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\jquery-1.2.1.pack[2].js (2177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bdshare[1].js (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\151JA35H9[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\2616293441V[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\101634512c8[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\t_9[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\10163ZO2N[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\1Q62S330N[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\lmbtn[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\core[1].php (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\right[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20141010[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\1016395W521[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\logo[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\libg_1[1].gif (899 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[1].txt (916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\c_1[1].gif (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\play_hs1202[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\sszn[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\4399_16125310445[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[2].txt (1504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\trace_news[1].js (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\b_5[1].gif (317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\play_hs1202[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\0G641442227[1].gif (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\bg_5_20130716[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\t_4[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\go_bbs[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\1GQ340U13[1].gif (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\click[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\jquery-1.2.1.pack[1].js (1461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\tjrm_img06[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\lb_ico_v1[1].png (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\t_3[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\zm_add[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\c_5[1].gif (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\hottop[1].gif (857 bytes)
C:\Ƥ·ô.she (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\new_icon_1[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bg_7[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\scbg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\n_mg_bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\bg_1[1].gif (791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20150115[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\xfv174[2].htm (954 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\ico_1[1].gif (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\logger[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\ico[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\b_2[1].gif (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\libg_2[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\zrsp_1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\shell_v2[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\icon_keys[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\b_1[1].gif (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\ftbtn[1].gif (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\ucenter[1].js (24109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\topbg_20140506[1].jpg (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\game_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\t_1[1].gif (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\t_6[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\02104939B23[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\core[2].php (764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\101144213249[1].jpg (4539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\b_4[1].gif (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\libg_3[1].gif (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@4399[1].txt (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\is[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\t_2[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\tjrm_img08[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\b_3[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\c_3[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bds_s_v2[1].js (1649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\t_5[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\news_footer[1].js (961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\more_boss_s[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\zj_btn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\xfv174[1].swf (4463 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\78072[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20141010[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\4399[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\jquery-1.2.1.pack[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\unilogin_package[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\xfv174[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20150115[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\play_hs1202[1].js (0 bytes)
Registry activity
The process %original file name%.exe:1332 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1916x902x32(BGR 0)" = "31,31,31,31"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1434976709"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "05 A3 8B D2 98 4B 4C 0C 12 64 FA 32 44 8C F1 1C"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| 114054313070472cd1a6d7d28f7c5002 | c:\jedata.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\sp_line_1[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\78072[1].htm (4794 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\c_4[1].gif (81 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\bg_9[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\lazy_iframe[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\sc[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\more_boss[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\10111ZM324[1].jpg (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\tgbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\t_8[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\ico_ann[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\faspbtn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\tjrm_img011[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\tjrm_img07[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\xfv174[1].htm (1504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\4399_14294510451[1].jpg (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\left[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bg_4[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20150115[2].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\4399[1].js (902 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\headerBg[1].gif (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\chkDomain[1].js (554 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\c[1].php (1827 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\t_lm[1].png (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\pic[1].gif (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\n_zm1[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\zb_nav_20131205[1].png (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\bg_3[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\0913524M015[1].gif (84 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (8192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\bdsstyle[1].css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\more_zb[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\bg_8[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\unilogin_package[2].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\base[1].css (12385 bytes)
C:\jedata.dll (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\nav_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\unilogin_package[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\4399_10503158122[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\4399[2].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20141010[2].js (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\tjrm_img09[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\sy_ico[1].gif (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\4399_17485812405[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\78072[2].htm (3324 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@mmstat[1].txt (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\c_2[1].gif (70 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\bg_6[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\4399_11234392734[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\style[1].css (337 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\02163A05453[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\jcsp_1[1].jpg (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\jquery-1.2.1.pack[2].js (2177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bdshare[1].js (182 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\151JA35H9[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\2616293441V[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\101634512c8[1].jpg (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\t_9[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\10163ZO2N[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\1Q62S330N[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\lmbtn[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\core[1].php (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\right[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20141010[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\1016395W521[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\logo[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\libg_1[1].gif (899 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[1].txt (916 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\c_1[1].gif (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\play_hs1202[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\sszn[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\4399_16125310445[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.4399[2].txt (1504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\trace_news[1].js (559 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\b_5[1].gif (317 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\play_hs1202[2].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\0G641442227[1].gif (2696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\bg_5_20130716[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\t_4[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\go_bbs[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\1GQ340U13[1].gif (527 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\click[1].js (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\jquery-1.2.1.pack[1].js (1461 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\tjrm_img06[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@cnzz.mmstat[1].txt (203 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\stat[1].php (1177 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\lb_ico_v1[1].png (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\t_3[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\zm_add[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\c_5[1].gif (180 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\hottop[1].gif (857 bytes)
C:\Ƥ·ô.she (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\new_icon_1[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bg_7[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\scbg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\n_mg_bg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\bg_1[1].gif (791 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\zmxy3_20150115[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\xfv174[2].htm (954 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\ico_1[1].gif (44 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\logger[1].js (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\stat[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\ico[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\b_2[1].gif (250 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\libg_2[1].gif (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\zrsp_1[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\shell_v2[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\icon_keys[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\b_1[1].gif (610 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\ftbtn[1].gif (477 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\ucenter[1].js (24109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\topbg_20140506[1].jpg (3808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\game_bg[1].gif (776 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\t_1[1].gif (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\t_6[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\02104939B23[1].jpg (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\core[2].php (764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\101144213249[1].jpg (4539 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\b_4[1].gif (244 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\libg_3[1].gif (542 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bg[1].gif (5 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@4399[1].txt (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\is[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\t_2[1].gif (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\tjrm_img08[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\b_3[1].gif (248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\c_3[1].gif (84 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\bds_s_v2[1].js (1649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\t_5[1].gif (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\news_footer[1].js (961 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\more_boss_s[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\zj_btn[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\xfv174[1].swf (4463 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: QQ:207680472
Product Name: ????3?????
Product Version: 1.0.0.0
Legal Copyright: ----------------???.????????------------- ????? ?? ?? ??---------------------????,??????--------------
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ????????4399???????~
Comments: ???????,????????????,????????416057221????
Language: English (United States)
Company Name: QQ:207680472Product Name: ????3?????Product Version: 1.0.0.0Legal Copyright: ----------------???.????????------------- ????? ?? ?? ??---------------------????,??????--------------Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ????????4399???????~Comments: ???????,????????????,????????416057221????Language: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 518199 | 520192 | 4.56705 | 779604c4e354b6e61451cb85e49d8042 |
| .rdata | 524288 | 1000570 | 1003520 | 5.06484 | 7877cdcd2f5f2f2041118980f5c7ff95 |
| .data | 1527808 | 242250 | 65536 | 3.25594 | d8c728b8b984fd31dce2e4efd8090eb0 |
| .rsrc | 1773568 | 23072 | 24576 | 3.69095 | 52d95721a2b7d20858cb585320c60698 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://203.130.61.92/flashzt/img/zmxy3_20120913/sy_ico.gif | |
| hxxp://203.130.61.92/jss/play_hs1202.js | |
| hxxp://203.130.61.92/jss/4399.js | |
| hxxp://4399stat.5054399.com/js/click.js | 115.182.52.78 |
| hxxp://all.cnzz.com.danuoyi.tbcache.com/c.php?id=30039538 | |
| hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=30039538&t=q | |
| hxxp://all.cnzz.com.danuoyi.tbcache.com/stat.php?id=4073713&web_id=4073713&show=pic | |
| hxxp://oq.cnzz.com/stat.htm?id=30039538&r=&lg=en-us&ntime=none&cnzz_eid=1152341830-1436511239-&showp=1916x902&t=造梦西游3,造梦西游大闹天åºÂ篇,4399...&h=1&rnd=327808461 | 198.11.132.200 |
| hxxp://all.cnzz.com.danuoyi.tbcache.com/core.php?web_id=4073713&show=pic&t=z | |
| hxxp://oq.cnzz.com/stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=1155346791-1436513542-&showp=1916x902&t=造梦西游3,造梦西游大闹天åºÂ篇,4399...&h=1&rnd=1969154380 | 198.11.132.200 |
| hxxp://all.cnzz.com.danuoyi.tbcache.com/img/pic.gif | |
| hxxp://218.95.101.8/4399swf/js/chkDomain.js | |
| hxxp://static.n.shifen.com/v.gif?pid=307&type=3071&sc=1004,4801,1916,874&desturl=&apitype=1&linkid=ibxcqxyxib5&velo_load=2640&velo_cssload=1875&velo_jsLoad=953&cite_uid=480925&cite_type=1&cite_mini=1 | |
| hxxp://e.xdwscache.glb0.lxdns.com/resource/css/base.css | |
| hxxp://e.xdwscache.glb0.lxdns.com/resource/ucenter.js | |
| hxxp://cnzz.mmstat.com/9.gif?abc=1&rnd=1063648122 | 42.120.219.171 |
| hxxp://e.xdwscache.glb0.lxdns.com/flashUniLogin/css/style.css?v=20121016 | |
| hxxp://218.95.101.8/4399swf/upload_swf/ftp7/hanbao/20120107/6/xfv174.swf | |
| hxxp://e.xdwscache.glb0.lxdns.com/jss/unilogin_package.js | |
| hxxp://cnzz.mmstat.com/app.gif?&cna=C24mDjpgZhYCASU5EL1BywfR | 42.120.219.171 |
| hxxp://s8.4399.com/4399swf/js/chkDomain.js | |
| hxxp://www.4399.com/jss/4399.js | |
| hxxp://ptlogin.3304399.net/resource/css/base.css | 203.130.61.92 |
| hxxp://www.4399.com/jss/unilogin_package.js | |
| hxxp://c.cnzz.com/core.php?web_id=30039538&t=q | 195.27.31.246 |
| hxxp://ptlogin.3304399.net/resource/ucenter.js | 203.130.61.92 |
| hxxp://nsclick.baidu.com/v.gif?pid=307&type=3071&sc=1004,4801,1916,874&desturl=&apitype=1&linkid=ibxcqxyxib5&velo_load=2640&velo_cssload=1875&velo_jsLoad=953&cite_uid=480925&cite_type=1&cite_mini=1 | 115.239.211.92 |
| hxxp://oz.cnzz.com/stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=1155346791-1436513542-&showp=1916x902&t=造梦西游3,造梦西游大闹天åºÂ篇,4399...&h=1&rnd=1969154380 | 198.11.132.200 |
| hxxp://www.4399.com/jss/play_hs1202.js | |
| hxxp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/xfv174.swf | |
| hxxp://s25.cnzz.com/stat.php?id=4073713&web_id=4073713&show=pic | 1.99.192.16 |
| hxxp://s4.img4399.com/flashUniLogin/css/style.css?v=20121016 | 203.130.61.92 |
| hxxp://pcookie.cnzz.com/app.gif?&cna=C24mDjpgZhYCASU5EL1BywfR | 42.120.219.171 |
| hxxp://www.4399.com/flashzt/img/zmxy3_20120913/sy_ico.gif | |
| hxxp://c.cnzz.com/core.php?web_id=4073713&show=pic&t=z | 195.27.31.246 |
| hxxp://w.cnzz.com/c.php?id=30039538 | 1.99.192.14 |
| hxxp://icon.cnzz.com/img/pic.gif | 195.27.31.248 |
| gprp.4399api.net | 42.62.52.249 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /core.php?web_id=30039538&t=q HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 2572
Connection: keep-alive
Date: Fri, 10 Jul 2015 08:05:38 GMT
Last-Modified: Fri, 10 Jul 2015 08:05:38 GMT
Expires: Fri, 10 Jul 2015 08:20:38 GMT
Via: cache2.l2de1[2406,200-0,M], cache4.l2de1[2407,0], cache9.de1[0,200-0,H], cache1.de1[0,0]
Age: 817
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Fri, 10 Jul 2015 08:05:38 GMT
X-Swift-CacheTime: 900
!function(){var p,q,r,a=encodeURIComponent,b="30039538",c="",d="",e="online_v3.php",f="hqs10.cnzz.com",g="",h="text",i="q",j="全景统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="1",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["createScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k["createIcon"]([p])))}();(function(){function n(){this.c()}var p=['http://VVV.4399.com/'],e=document,g=window,m=encodeURIComponent,q="unknow",l=null;n.prototype={c:function(){if(!1===this.d())return!1;var a;this.a(e,"mousedown",this.b);a=g.navigator.userAgent;l=e.documentElement&&0!==e.documentElement.clientHeight?e.documentElement:e.body;a=a?a.toLowerCase().replace(/-/g,""):"";for(var b="netscape;se 1.;se 2.;saayaa;360se;tencent;qqbrowser;mqqbrowser;maxthon;myie;theworld;konqueror;firefox;chrome;safari;msie 5.0;msie 5.5;msie 6.0;msie 7.0;msie 8.0;msie 9.0;msie 10.0;Mozilla;opera".split(";"),..d=0;d<b.length;d =1)if(-1!==a.indexOf(b[d])){q=b[d];break}},a:function(a,b,d){a.addEventListener?a.addEventListener(b,d,!1):a.attachEvent?a.attachEvent("on" b,d):a[
<<< skipped >>>
GET /core.php?web_id=4073713&show=pic&t=z HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Date: Fri, 10 Jul 2015 08:19:15 GMT
Last-Modified: Fri, 10 Jul 2015 08:19:15 GMT
Expires: Fri, 10 Jul 2015 08:34:15 GMT
Via: cache23.l2de1[896,200-0,M], cache11.l2de1[897,0], cache8.de1[896,200-0,M], cache1.de1[897,0]
X-Cache: MISS TCP_REFRESH_MISS dirn:-2:-2
X-Swift-SaveTime: Fri, 10 Jul 2015 08:19:16 GMT
X-Swift-CacheTime: 899
2a0..!function(){var p,q,r,a=encodeURIComponent,b="4073713",c="pic",d="",e="online_v3.php",f="zs25.cnzz.com",g="1",h="pic",i="z",j="站长统计",k=window["_CNZZDbridge_" b]["bobject"],l="http:",m="0",n=l "//online.cnzz.com/online/" e,o=[];o.push("id=" b),o.push("h=" f),o.push("on=" a(d)),o.push("s=" a(c)),n ="?" o.join("&"),"0"===m&&k["callRequest"]([l "//cnzz.mmstat.com/9.gif?abc=1"]),g&&(""!==d?k["createScriptIcon"](n,"utf-8"):(q="z"==i?"hXXp://VVV.cnzz.com/stat/website.php?web_id=" b:"hXXp://quanjing.cnzz.com","pic"===h?(r=l "//icon.cnzz.com/img/" c ".gif",p="<a href='" q "' target=_blank title='" j "'><img border=0 hspace=0 vspace=0 src='" r "'..5c..></a>"):p="<a href='" q "' target=_blank title='" j "'>" j "</a>",k["createIcon"]([p])))}();..0..
GET /resource/css/base.css HTTP/1.1
Accept: */*
Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/xfv174.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ptlogin.3304399.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Expires: Fri, 10 Jul 2015 09:01:06 GMT
Date: Fri, 10 Jul 2015 08:01:06 GMT
Server: nginx/1.4.1
Content-Type: text/css
Content-Length: 32685
Last-Modified: Thu, 14 May 2015 08:01:18 GMT
ETag: "5554564e-7fad"
Cache-Control: max-age=3600
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 kf50:2 (Cdn Cache Server V2.0)
Connection: keep-alive
@charset "utf-8";../* CSS Document ..Use for:...Version:.1.0..Date:..2011/08/10..Author:..f2er..Update: 2012/05/03..*/...login_embed_iframe{border:none; width:100%;}...login_embed_iframe_hor{border:none; width:100%; height:100%}...login_horizon{height:31px; line-height:31px; /*padding:9px 0;height:12px;*/}...login_vertical{width:530px;} /*modify by qf 05-03*/../*............*/...mt5{ margin-top:5px;}...mt10{ margin-top:10px;}...mt20{ margin-top:20px;}...mt30{ margin-top:30px;}...mt35{ margin-top:35px;}...w256{ width:256px;}..#popup_login_div{ width:400px; margin:0 auto; padding: 16px 0; }..#popup_reg_div{ padding: 0 0 16px 0; }../*............*/...login_horizon legend,.login_vertical legend,.login_module legend{ display:none}../*login_horizon*/...iptw1{ width:73px;}...iptw2{ width:154px}...wtc{ width:352px;}...wframe{ /*width:620px;*/ width:530px;}...wframepwd{width:280px;}...login_horizon a,.login_vertical a{ color:#1278c0;vertical-align:middle;}../*......chrome..@media screen and (-webkit-min-device-pixel-ratio:0){.. .login_horizon a,.login_vertical a{...vertical-align:top;.. } ..}*/...login_horizon a:hover,.login_vertical a:hover{color:#ff5712}../*login_horizon*/...login_horizon .login_hor,.login_horizon .login_btn{ float:left; margin-right:10px; display:inline;}...login_horizon label{ color:#333}...login_horizon .login_ipt,.login_vertical .login_ipt{ border:1px solid #ccc;/* width:144px;*/ padding:2px 3px; background:url(../images/spriteV2.png?v=131127) repeat-x 0 -31px; height:22px; line-height:22px;
<<< skipped >>>
GET /img/pic.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: icon.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: image/gif
Content-Length: 719
Connection: keep-alive
Date: Thu, 09 Jul 2015 08:47:39 GMT
Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT
Expires: Fri, 10 Jul 2015 08:47:39 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes
Via: cache1.l2de1[7636,200-0,H], cache9.l2de1[7474,0], cache1.de1[0,200-0,H], cache1.de1[0,0]
Age: 84697
X-Cache: HIT TCP_MEM_HIT dirn:4:785300231
X-Swift-SaveTime: Thu, 09 Jul 2015 08:47:39 GMT
X-Swift-CacheTime: 86400
GIF89a2.........f..3...33....................................................................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,....2...... !.di.hjBl..p,....x......`P.(...GR.D6...CH....,..@8.... -..EQc.8...........`...."....................~"..H........H......"...$....#.........."..........."Z.......*...%!.!.......,....2...... !.di.hjBl..p,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."....................~"..I........I......"...$....#.........."..........."\.......*...%!.!.......,....2...... !.di.hjBl..p,....x..|....p r..H.C.\&.H.tJu...#b......7..W.h.......7..l..v..-....."....................~"..I........I......"...$....#.........."..........."\.......*...%!.;HTTP/1.1 200 OK..Server: Tengine..Content-Type: image/gif..Content-Length: 719..Connection: keep-alive..Date: Thu, 09 Jul 2015 08:47:39 GMT..Last-Modified: Fri, 16 Jan 2009 08:10:47 GMT..Expires: Fri, 10 Jul 2015 08:47:39 GMT..Cache-Control: max-age=86400..Accept-Ranges: bytes..Via: cache1.l2de1[7636,200-0,H], cache9.l2de1[7474,0], cache1.de1[0,200-0,H], cache1.de1[0,0]..Age: 84697..X-Cache: HIT TCP_MEM_HIT dirn:4:785300231..X-Swift-SaveTime: Thu, 09 Jul 2015 08:47:39 GMT..X-Swift-CacheTime: 86400..GIF89a2.........f..3...33....................................................................................!..NETSCAPE2.0.....!..Powered by AFEI.!.......,....2...... !.di.hjBl..p,....x......`P.(...GR.D6...CH....,..@8.... -..EQc.8...........`...."....................~"..H........H......"...$....#.........."....
<<< skipped >>>
GET /jss/play_hs1202.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.4399.com
Connection: Keep-Alive
Cookie: bdshare_firstime=1436516355908
HTTP/1.1 200 OK
Expires: Thu, 08 Oct 2015 05:45:48 GMT
Date: Fri, 10 Jul 2015 05:45:48 GMT
Server: nginx
Content-Type: application/x-javascript
Last-Modified: Sun, 10 Nov 2013 09:24:36 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 shjcl69:80 (Cdn Cache Server V2.0), 1.1 kf49:6 (Cdn Cache Server V2.0)
Connection: keep-alive
5f9.............W.n.6..n... ..X)..'......t...b.v...%Q..Y4D*...........s...d.u]...S...?~.Gt.T.*D.~.n.3.JE..y......\._-.N...R-K...\.lI............'.... _.q[p.bsNVw.FR.vN"..=.c.i.;...`.q.C.u... .........m..#X.....%(..?.....$*2...):..Ts..........n_N....2...b.u...J^.......&..Eu3`.mH...wnI..m*.....F.B .. ...5A -5.o.4..&...s...r.{.%c..L.`..6A3tB..q|yr..;1k...E.....{g<....x....L........;.vNp:}."H.....IS.t.....g.>c...3S.V.....K....8..b.]..9k...a......y.>..a. ^r._.....\W-6b.e....h.#.p..{D...N.v...:Q......bJ....7.!....j.....T..vR$9On-....Tmy>.e.U...2U7<. cW%V.q......T....d.<H....GZ..h....MHdp..;.{V....c[p...1.R.2..V.&....5.......v k-\....sr...u..n.....M....fK.5...I.].P....'.X....).N....*.y.)p..d,=.).T..-AF..,E.to..eA^.,.9......d.cL.S..:.O.......p....N.hr....hre.....}.-.ZlL/U.J.... .. .Nym..wB.E.D...F....Z.mN.....e.M`...u..h/j.v.'..1Y.k1..#...dL..C.m.{eGj.Qb..}..:...Q..5}aMi.M...].dY@.B......r......Z#..y..B;......$..m\sv.^..\.`...uB0....y.z68..q....0H.,..%..t....).-.6.....N......a.....3.bj......}....Q....n.f...9./_i.|.C.....`|..1..-^G..h..Euk.y9..p..9..G.K.t.Q.8..........$<9u......._.c..<.J.*....:3l.C......^.5........J.%..PT......=.H.;T....aB;f.%.gXw......e.{..|v.@d.......3....[./...k....yH<g..Dp..Eb.O.>.J.RTs.H..xM..@V....?$....s........B..p..@x*..1.....C]4...L%..P.. ...C....:..4...W...}.../.q.]9D3x.......3}....tD3_.....{.)x.C...P.R..B..>..ey.t..B.#..r.....[U.....o.=.6..6...w....g.[.....C.i....2.....c..\_.....C...B:F......).^./.:us....A.."@s.[.Evq4.......4..to.t...O.6Lq..j.......<.N.?..
<<< skipped >>>
GET /jss/unilogin_package.js HTTP/1.1
Accept: */*
Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/xfv174.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.4399.com
Connection: Keep-Alive
Cookie: bdshare_firstime=1436516355908; cookie_hs=4399.com|||%u9020%u68A6%u897F%u6E383%u4E4B%u5927%u95F9%u5929%u5EAD%u7BC7||78072||0; CNZZDATA30039538=cnzz_eid=1152341830-1436511239-&ntime=1436511239; CNZZDATA4073713=cnzz_eid=1155346791-1436513542-&ntime=1436513542; _4399stats_vid=14365163603627287
HTTP/1.1 200 OK
Expires: Thu, 08 Oct 2015 07:26:38 GMT
Date: Fri, 10 Jul 2015 07:26:38 GMT
Server: nginx
Content-Type: application/x-javascript
Last-Modified: Thu, 07 May 2015 06:16:12 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 shjc71:80 (Cdn Cache Server V2.0), 1.1 kf49:7 (Cdn Cache Server V2.0)
Connection: keep-alive
613.............X.o.G...R...O...H@...*..J.B....u.[_.9.^o..R...M.V.......E.RH..q0(/.P[..y.JU.....{>'...pvg~......5........i..f..=~<..Z.....g...[1. ..EYGs.Z...YL'.ds........q...&.l.jit..j(..S.R.....&.(J.=6@.)......JLc..V..r.`..J.*....ci...|..$d...%O...=Qy5.@<..!.K*~...b.kg)s...6$5:K....0..KX.D!A..v.lh.. ..F`O... ....a.l. ..qy..I.J.Tz{q.i.c.I*..$.[..)b.G.El.d..........NY.N..kL...\....th....'.B.c.5vP...Pt.Ab$.J.g..K9.t,.....X1.o.,...9,.9lYa..47R....*.6..m.......u.....2R.1b..*..6..'7x~..jO...XB.B.#...RC..J.-.)...........~...&.6.K.0EW\#....L.Y..._.2.|.....><....I....;.*.".I.T.#.0....tm..........A....g|o4)<H3..=E4.....M..k.U..9.....nb.w.D....k...hG.......''..F...59XB....`$.g......j......N.............>.....i...Y>.L.1x..3......?G.(.Mg....J....].].....P....~.a........3.........0...... ...%.!.....cz.!."..a.x...1^.0.....v4.)..R....k........u6.w[W..nl...;....v.=}.^.v.xz......o.X...C#u.U<?...q...h.eu...7p}.........8.V.@u.$.=WT.. ....:r....,QBV...9..&..]...Um=............K...].0.C....).y.M....q..9qK...Kl.}.!NU<. $..."..M!......w....>d..$#'.g.nn$.G...[..4...R.!.........{.)ff..|)8...........v....'..V^..l....t... .}s.........L.!.M.0..`~"z.(*}..X.uJy.f.sN.*=..53z%Q}.36.....J..y..Z.8~dl|......6<..r...<..\1.<.....3...i.>......w.....Z. ..>..w.%{..........^..!z.......%.Z{..._Z....g.2;...\../*..x].W8.(....~..f{.....*.........N..__......o..O~..........t.^. .<....?2.D..4./C..~x..J7....3>...)..P.....].Bs.c.j....o<.kA..........px.%.....V.#........^[........6bHa../.]......."(.....K.
<<< skipped >>>
GET /c.php?id=30039538 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: w.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 9937
Connection: keep-alive
Date: Fri, 10 Jul 2015 06:53:59 GMT
Last-Modified: Fri, 10 Jul 2015 06:53:59 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache43.l2de1[3918,200-0,M], cache42.l2de1[3919,0], cache2.de1[0,200-0,H], cache2.de1[0,0]
Age: 5115
X-Cache: HIT TCP_MEM_HIT dirn:3:894927173
X-Swift-SaveTime: Fri, 10 Jul 2015 06:54:03 GMT
X-Swift-CacheTime: 5396
(function(){function k(){this.c="30039538";this.R="q";this.N="";this.K="";this.M="";this.r="1436511239";this.P="oq.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="1";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=30039538");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[object Arr
<<< skipped >>>
GET /v.gif?pid=307&type=3071&sc=1004,4801,1916,874&desturl=&apitype=1&linkid=ibxcqxyxib5&velo_load=2640&velo_cssload=1875&velo_jsLoad=953&cite_uid=480925&cite_type=1&cite_mini=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: nsclick.baidu.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=0
Content-Length: 0
Content-Type: image/gif
Date: Fri, 10 Jul 2015 08:19:18 GMT
Etag: "4280832337"
Expires: Fri, 10 Jul 2015 08:19:18 GMT
Last-Modified: Fri, 23 Oct 2009 08:06:04 GMT
Pragma: no-cache
Server: BWS/1.0
HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=0..Content-Length: 0..Content-Type: image/gif..Date: Fri, 10 Jul 2015 08:19:18 GMT..Etag: "4280832337"..Expires: Fri, 10 Jul 2015 08:19:18 GMT..Last-Modified: Fri, 23 Oct 2009 08:06:04 GMT..Pragma: no-cache..Server: BWS/1.0..
GET /js/click.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 4399stat.5054399.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 10 Jul 2015 08:19:15 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 15 Jan 2014 06:56:45 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Fri, 10 Jul 2015 08:19:16 GMT
Cache-Control: max-age=1
Content-Encoding: gzip
41b............}U.o.6..v.....DT.*...K<-.)6....uOA`0.%3.(....I....EY...A......}p'.3..d..V....Zj..L.#M.<? {.[.hV...~........)......<..el.u.........2H@...T.e.eo...d..[. .A=#mo4..1..u.?t.(]..Dv.:.....@..S.*.q.........4=.Fq.....**....Fm%W....!.....5j`.....U..e. .2P..I~$.f...........Je.<b.F./(.V<.oQ.....b.I.E.^1..)z..0&...T0OU2n...)..} .....a.%...E.......F...-..%ka0>.v.VY.>..I..`.....-g..?....IB^.3.^\......XU...t.....JN......tr.-.t.J..`...H..V.fX.Z.".c.)./ 6......>..M....=.^....igrp.l.m.//.m..vV....=.Y...$A... ... ...7\F....zr?....Ts..G.v.....<\.0>.K..*.g:..0.[...g....Y....o.B.M!..ku..m.am.<=..<a....4r<.x2...&l.."av...............Ya.n(........7.......@.f.._2..U.vQ.z`f.?>~.....9.[n;...l.....=..^`..S..nvH.D.%...d.K...P:K)<V..S....P..=........v.....E.Oi'bKuX.'.Ejk.{pknyH.n.g.t..9......n.y...d..a$...-..z.........,.Z.....Yb..Ov...@^j..TC..a.i].........i.....v..."O.#.C..G...ln..D.........&.C......W.r *.o.......%1U..]..:X.jtD:.......R5"......W...CW9..V...........@.....t.......a..p@|{<...}...j.;....M..}...H...?k.yH...Unc..(Q..Fi.^..t.6..U ..^"...z.F{......0..
GET /flashzt/img/zmxy3_20120913/sy_ico.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.4399.com
Connection: Keep-Alive
Cookie: bdshare_firstime=1436516355908
HTTP/1.1 200 OK
Expires: Thu, 08 Oct 2015 06:27:23 GMT
Date: Fri, 10 Jul 2015 06:27:23 GMT
Server: nginx
Content-Type: image/gif
Content-Length: 2053
Last-Modified: Thu, 13 Sep 2012 06:35:26 GMT
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 shjc71:88 (Cdn Cache Server V2.0), 1.1 kf48:7 (Cdn Cache Server V2.0)
Connection: keep-alive
GIF89a8............o{.dpv.47....tz....KO.35..............................................................................................................................................................................IPT........................t.....q..|...............IL...."#...............dqx......................HL.HL.........6<?.........FMQ....ILs...sy.........prs...............frw............>>>r~.............{...........334..........................................................GJ.;>..............................................dh.........SSS.........q|..y....OOOccc.......................................mop......___...s}..........................kp.szu.........|.......................................................................................................!.......,....8.......}.x.......*\.....>N...B....2j......./*Y....!?>x..b...0c..I.&K..~...r..~@...J.....L..YP..~.\..J....X.fu..........D..|h..]...[.f.....`?~g ...7M..Q...L...{..I......,*..G.r.G.XQ.D.....>....E..86..{.....=.j.(..J.[....7.......{.p..j.[\PE.z...!B...qXNi."..5_.....O^......W/O..z.T..A..<.n.M[...3p...@(.L.I..&..q.).`..(H.<...CA-L O.!....z$..6..r.....".,..b....B..L.BA.@0...\.H }.2.0..!........4.d.1>)...`0.....!......<..L,...L.....).8...n....r.i...0.A..q....\...sl.F..L.....p...B.c..D.@..\....pP.<!......j...P.D..Pb..........*.... OAAtp......&....0g@.........B.O..JK...D.....Q...\ B.R....^.R..~|..... .?..;.q.F ...P...I.S....l...'.....[D<I...?.X.@>.D`...w... ..q..8`..#.........0.,..4......1..70...
<<< skipped >>>
GET /jss/4399.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.4399.com
Connection: Keep-Alive
Cookie: bdshare_firstime=1436516355908; cookie_hs=4399.com|||%u9020%u68A6%u897F%u6E383%u4E4B%u5927%u95F9%u5929%u5EAD%u7BC7||78072||0
HTTP/1.1 200 OK
Expires: Thu, 08 Oct 2015 05:30:08 GMT
Date: Fri, 10 Jul 2015 05:30:08 GMT
Server: nginx
Content-Type: application/x-javascript
Last-Modified: Sun, 10 Nov 2013 09:24:38 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 hzsx165:80 (Cdn Cache Server V2.0), 1.1 kf50:10 (Cdn Cache Server V2.0)
Connection: keep-alive
386.............U.j.@.}V.....H. .>&U .B..)4/..#[ {SYkV.......O./tf.b.v...y.z...........v.k.'...&*.z....x..U.. V...\q^..b...y..#.U...f....x.VOb.....k..M6.....iC9.KJ.2./..2z.u!...W.`....k.L..).[U.C.%..h.$q..*....wphI........MEmC>`&.M/'z.:.eUM.\...7k.=..|....e.u..2..5. j^...KW..%*.`.|......>...\.....7.zT.)8.'bzA..I...H.<.<c..a.K.^...|..#....3.{G.<.E.#.9.o.......&>.tl.1...).9.H.;$'...X.M*<.Xp.....>'....IO.6.}.n.~x....T...?2xp.M....|F2..>.U..U.oj..C...i.R...}...U~.&.1!...Ma.q_67uG.K.c...wA...{..S...V-.j..]"..M......l>n.....|.!..k\{g..8... t..Kv.R[....>...^.<.tb..K...d.6.h..0.....k|....x@s....l....S<.E1..2/....v.zCCq.T..5.....x..,F..c1I....J.Z.#.......#.\.z...}.\.A.... ..;.......&..c..r........9.,.....]Y..\..W.....F.....?.m...$~c..8i..<CQh.C........2....o..?.N[.Os..2.>....4.....b;....{...@w. ..O.Y..#\a.]..k.I.....YJ....%...n.k`......x..O..]g..^.7.......8...=...3c.........^...?t......c.....J...Z'.s.....0..HTTP/1.1 200 OK..Expires: Thu, 08 Oct 2015 05:30:08 GMT..Date: Fri, 10 Jul 2015 05:30:08 GMT..Server: nginx..Content-Type: application/x-javascript..Last-Modified: Sun, 10 Nov 2013 09:24:38 GMT..Transfer-Encoding: chunked..Cache-Control: max-age=7776000..Content-Encoding: gzip..Age: 1..X-Via: 1.1 hzsx165:80 (Cdn Cache Server V2.0), 1.1 kf50:10 (Cdn Cache Server V2.0)..Connection: keep-alive..386.............U.j.@.}V.....H. .>&U .B..)4/..#[ {SYkV.......O./tf.b.v...y.z...........v.k.'...&*.z....x..U.. V...\q^..b...y..#.U...f....x.VOb.....k..M6.....iC9.KJ.2./..2z.u!...W
<<< skipped >>>
GET /4399swf/js/chkDomain.js HTTP/1.1
Accept: */*
Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/xfv174.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s8.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=14365163603627287
HTTP/1.1 200 OK
Date: Fri, 10 Jul 2015 08:15:19 GMT
Server: 4399SERVER
Last-Modified: Fri, 17 Sep 2010 03:21:31 GMT
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Expires: Sat, 09 Jul 2016 08:15:19 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 352
Content-Type: application/javascript
Age: 238
Via: http/1.1 4399SERVER (CDN CACHE V1.0), http/1.1 4399SERVER (CDN CACHE V1.0)
Connection: keep-alive
.......... K,RH.../-R.UHK.)N...*..&....].s.3..R.J.%%.V.....z&...z...J:0QL......4u("..z.5.[...b.......8?.....aE,.w.%E>...%.. ...'................ 3M.$.@..<3/%.\....3-.HA..;...:..9..rR..K2.....J9........Z.....': V.........%E..8....&f...@.....0E.b........%../,.|....k.>..g...G....W.9.tv..z....7..8}..w....'^o.wu....g?......g[....z...#..l9.LQI...Z...F.*...HTTP/1.1 200 OK..Date: Fri, 10 Jul 2015 08:15:19 GMT..Server: 4399SERVER..Last-Modified: Fri, 17 Sep 2010 03:21:31 GMT..Accept-Ranges: bytes..Cache-Control: max-age=31536000..Expires: Sat, 09 Jul 2016 08:15:19 GMT..Vary: Accept-Encoding..Content-Encoding: gzip..Content-Length: 352..Content-Type: application/javascript..Age: 238..Via: http/1.1 4399SERVER (CDN CACHE V1.0), http/1.1 4399SERVER (CDN CACHE V1.0)..Connection: keep-alive............ K,RH.../-R.UHK.)N...*..&....].s.3..R.J.%%.V.....z&...z...J:0QL......4u("..z.5.[...b.......8?.....aE,.w.%E>...%.. ...'................ 3M.$.@..<3/%.\....3-.HA..;...:..9..rR..K2.....J9........Z.....': V.........%E..8....&f...@.....0E.b........%../,.|....k.>..g...G....W.9.tv..z....7..8}..w....'^o.wu....g?......g[....z...#..l9.LQI...Z...F.*.......
<<< skipped >>>
GET /4399swf/upload_swf/ftp7/hanbao/20120107/6/xfv174.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/xfv174.htm
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s8.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=14365163603627287
HTTP/1.1 200 OK
Date: Fri, 10 Jul 2015 08:10:26 GMT
Server: 4399SERVER
Last-Modified: Wed, 08 Jul 2015 09:03:55 GMT
Accept-Ranges: bytes
Content-Length: 3134568
Cache-Control: max-age=31536000
Expires: Sat, 09 Jul 2016 08:10:26 GMT
Content-Type: application/x-shockwave-flash
Age: 535
Via: http/1.1 4399SERVER (CDN CACHE V1.0), http/1.1 4399SERVER (CDN CACHE V1.0)
Connection: keep-alive
CWS...2.x....<...?>...53.A...E..Q.....R.0........h.H%I%*.F.m.v.(*..&.TT...5.|.....{.......{_..{....f.B .N! Q...D...h...<.:B L..Bm|.\t.".<...fL....l..ccc.b....0cSkkkc.3c33C.0...D.8C.Pw.->..[.".D.8|..Vg...E3&N.....k..h.....b...#.<.......b......L.-3*...ab.......!.....a(.)..n....#...l[{.?....e..X.....s.Y0f......L&..(..i.%...C`N.0.......Q..\.0.-...E....G..b<!.6S...c...s...hf.....o.U.....mgEsu......N...#N7..a.S`.l.Nr.H...D...4.....d....y.}.....B...A|..x...ianm.......!%......;.....Z........w:.._.. ..meUU......DQ..O.D...............j.....m..o'...eN....R.O..q...B....v: ...^..4...O...?.Y.4.D_~o....r...Kc..^.{q......?On.c.ug..9....w.(.........zW._Mu.Z..Z.#.0....[CN{..L.}..C.6D2.WS..".ho..ch.&...OI..L|....z......L....^..!R..0..@.fr...N.&)..OR.U{.^...........T..|.e-s=..].Z...._...m>..<gMz...:W..ah..p..N............:M..1..S....%.u.s......^..C.:m..M..d....QJ...O=F...6.......B.k/....g........."_.....|;..I.......=/M....jM32.$.z>k..X./w........w.......u.<....'........//8..C.@^z..5V..;...\2. 7K..=..[.U.....).....%.Gd...... ..e}...~e...;^..6...].u.*k.Z.l.....U'...d.{.e.......&..E.su.v.. .FCE.K.-.?..<.xk...... ..v.>[..5'.....>q|\..........<..2.e*...#..^...eR6O?....&|...k.?..~.....2._E......i..2].da.:.$...G.*.7.?S.Mk..5.]c}.n.^...fwj.8.SM.....`....b......s.yf.w..k.;.>5"7........e...KDR.|.#c..<....M.|...q..W.$g\qO..........z......r......?;.e.....hvs......*DW...zH[.F...w.;...3..*Ym..k..4s..3..N.m..T..J.*y}MN..>oW.....Y?..$?..=.2.f.U........q.$....l.uy.Yg..or......^.... ........f..N
<<< skipped >>>
GET /resource/ucenter.js HTTP/1.1
Accept: */*
Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/xfv174.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ptlogin.3304399.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Expires: Fri, 10 Jul 2015 08:30:57 GMT
Date: Fri, 10 Jul 2015 07:30:57 GMT
Server: nginx/1.4.1
Content-Type: application/x-javascript
Content-Length: 46303
Last-Modified: Thu, 14 May 2015 06:16:20 GMT
ETag: "55543db4-b4df"
Cache-Control: max-age=3600
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 fuzhou190:8105 (Cdn Cache Server V2.0), 1.1 kf48:10 (Cdn Cache Server V2.0)
Connection: keep-alive
uni_login_type_key = "loginType";..uni_login_username_key = "username";..uni_login_uid_key = "uid";..uni_login_nick_key = "Pnick";..uni_login_qqnick_key = "Qnick";..uni_login_puser_key = "Puser";..uni_login_ptusertype_key = "ptusertype";..uni_login_phonebinded = "phonebinded";..uni_login_lastLoginDate = "lastLoginDate";..uni_login_lastLoginAppGame = "lastLoginAppGame";..uni_login_lastLoginTime = "lastLoginTimeStamp";..uni_login_type_qq = "qq";..uni_login_layout_horizontal = "horizontal";..uni_login_layout_vertical = "vertical";.....var unionLoginProps = {};..function getCookieValue(propKey, defaultValue){...uniCookie = JK.Passport.get();...if(!uniCookie)....return defaultValue;...return uniCookie[propKey] || defaultValue;..}..UniLogin = {};..UniLogin.getUid = function(){...return getCookieValue(uni_login_uid_key);..}..UniLogin.getUname = function(){...return getCookieValue(uni_login_username_key);..}..UniLogin.getUserType = function(){...return getCookieValue(uni_login_ptusertype_key);..}..UniLogin.getQnick = function(){...return getCookieValue(uni_login_qqnick_key);..}..UniLogin.getNick = function(){...if (!UniLogin.getUid()) return null;...var nick = getCookieValue(uni_login_nick_key);...if (!nick) {....return null;...} else {....if (nick.replace(/[^x00-xFF]/g,'**').length < 2) {.....return null;....} else {.....return nick;....}...}..}..fetchNickTryCount = 0;..UniLogin.fetchNick = function(callback){..setTimeout(function(){....if (!UniLogin.getUid()) return;....var nick = getCookieValue(uni_login_nick_key
<<< skipped >>>
GET /9.gif?abc=1&rnd=1063648122 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cnzz.mmstat.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Server: Tengine
Date: Fri, 10 Jul 2015 08:19:23 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=C24mDjpgZhYCASU5EL1BywfR; expires=Mon, 07-Jul-25 08:19:23 GMT; path=/; domain=.mmstat.com
Set-Cookie: sca=53f43e47; path=/; domain=.cnzz.mmstat.com
Set-Cookie: atpsida=bc83d5928b2eb43b590fbd73_1436516363; expires=Mon, 07-Jul-25 08:19:23 GMT; path=/; domain=.cnzz.mmstat.com
Location: hXXp://pcookie.cnzz.com/app.gif?&cna=C24mDjpgZhYCASU5EL1BywfR
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 302 Found..Server: Tengine..Date: Fri, 10 Jul 2015 08:19:23 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=C24mDjpgZhYCASU5EL1BywfR; expires=Mon, 07-Jul-25 08:19:23 GMT; path=/; domain=.mmstat.com..Set-Cookie: sca=53f43e47; path=/; domain=.cnzz.mmstat.com..Set-Cookie: atpsida=bc83d5928b2eb43b590fbd73_1436516363; expires=Mon, 07-Jul-25 08:19:23 GMT; path=/; domain=.cnzz.mmstat.com..Location: http://pcookie.cnzz.com/app.gif?&cna=C24mDjpgZhYCASU5EL1BywfR..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /flashUniLogin/css/style.css?v=20121016 HTTP/1.1
Accept: */*
Referer: hXXp://s8.4399.com/4399swf/upload_swf/ftp7/hanbao/20120107/6/xfv174.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s4.img4399.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Expires: Mon, 13 Jul 2015 06:13:59 GMT
Date: Sat, 13 Jun 2015 06:13:59 GMT
Server: nginx/1.6.1
Content-Type: text/css
Content-Length: 4316
Last-Modified: Thu, 14 May 2015 06:02:29 GMT
ETag: "55543a75-10dc"
Cache-Control: max-age=2592000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 zhj192:8108 (Cdn Cache Server V2.0), 1.1 kf48:2 (Cdn Cache Server V2.0)
Connection: keep-alive
@charset "utf-8";..body{background-color:#37383c;}../*login*/..#regbot {display:block;}...loginDiv{border:none;width:538px;background:none;}...login_hd{background:url(../images1/tbg.gif) no-repeat;padding:37px 25px 0; }..#login_tagnum{background:url(../images1/ptlogin.gif) repeat-y 0 0;padding:0 5px;}...login_fd{background:url(../images1/ptlogin.gif) no-repeat -538px 0;height:23px;}...login_close{background:url(../images1/closed.gif) no-repeat;width:15px;height:15px;top:8px;}...login_close:hover{background-position:0 -15px;}...login_horizon .ptlogin_btn, .login_vertical .ptlogin_btn{background:url(../images1/spriteV4.png) no-repeat;width:73px; height:28px; overflow:hidden;}...login_horizon a, .login_vertical a{color:#ffaa00;}...login_vertical .login_hor .q_tip{color:#899999;}...login_vertical .login_hor label{color:#899999;}..#login_tag{height:28px;}..#login_tag li, #login_tag li a, #login_tag li.selectTag, #login_tag li.selectTag a{background:url(../images1/ptlogin_tab.gif) no-repeat;}..#login_tag li{width:84px;height:28px;padding:0;text-align:center;}..#login_tag li a{width:84px;height:28px;padding:0;text-align:center;line-height:28px;}..#login_tag li.selectTag a{background-position:0 0;color:#fff;}..#login_tag li a{background-position:-84px 0;color:#464646;}..#login_tag li{top:1px;}...login_vertical #login_simple_toregister{background:url(../images1/spriteV4.png) no-repeat -74px 0;width:73px;height:28px;overflow:hidden;}...login_vertical .ptlogin_register{background:url(../images1/spriteV4.png) no-repeat 0 -
<<< skipped >>>
GET /stat.php?id=4073713&web_id=4073713&show=pic HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: s25.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine
Content-Type: application/javascript
Content-Length: 9938
Connection: keep-alive
Date: Fri, 10 Jul 2015 07:32:22 GMT
Last-Modified: Fri, 10 Jul 2015 07:32:22 GMT
Cache-Control: max-age=5400,s-maxage=5400
Via: cache16.l2de1[0,200-0,H], cache14.l2de1[1,0], cache8.de1[0,200-0,H], cache10.de1[0,0]
Age: 2813
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Fri, 10 Jul 2015 07:56:44 GMT
X-Swift-CacheTime: 3938
(function(){function k(){this.c="4073713";this.R="z";this.N="pic";this.K="";this.M="";this.r="1436513542";this.P="oz.cnzz.com";this.L="";this.u="CNZZDATA" this.c;this.t="_CNZZDbridge_" this.c;this.F="_cnzz_CV" this.c;this.G="CZ_UUID" this.c;this.v="0";this.A={};this.a={};this.la()}function g(a,b){try{var c=.[];c.push("siteid=4073713");c.push("name=" f(a.name));c.push("msg=" f(a.message));c.push("r=" f(h.referrer));c.push("page=" f(e.location.href));c.push("agent=" f(e.navigator.userAgent));c.push("ex=" f(b));c.push("rnd=" Math.floor(2147483648*Math.random()));(new Image).src="hXXp://jserr.cnzz.com/log.php?" c.join("&")}catch(d){}}var h=document,e=window,f=encodeURIComponent,l=decodeURIComponent,n=unescape;k.prototype={la:function(){try{this.U(),this.J(),this.ia(),this.H(),this.o(),this.ga(),.this.fa(),this.ja(),this.j(),this.ea(),this.ha(),this.ka(),this.ca(),this.aa(),this.da(),this.pa(),e[this.t]=e[this.t]||{},this.ba("_cnzz_CV")}catch(a){g(a,"i failed")}},na:function(){try{var a=this;e._czc={push:function(){return a.B.apply(a,arguments)}}}catch(b){g(b,"oP failed")}},aa:function(){try{var a=e._czc;if("[object Array]"==={}.toString.call(a))for(var b=0;b<a.length;b ){var c=a[b];switch(c[0]){case "_setAccount":e._cz_account="[object String]"==={}.toString.call(c[1])?c[1]:String(c[1]);.break;case "_setAutoPageview":"boolean"===typeof c[1]&&(e._cz_autoPageview=c[1])}}}catch(d){g(d,"cS failed")}},pa:function(){try{if("undefined"===typeof e._cz_account||e._cz_account===this.c){e._cz_account=this.c;if("[object Ar
<<< skipped >>>
GET /app.gif?&cna=C24mDjpgZhYCASU5EL1BywfR HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: pcookie.cnzz.com
HTTP/1.1 200 OK
Server: Tengine
Date: Fri, 10 Jul 2015 08:19:30 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"
Set-Cookie: cna=C24mDjpgZhYCASU5EL1BywfR; expires=Mon, 07-Jul-25 08:19:30 GMT; path=/; domain=.cnzz.com
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Pragma: no-cache
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Server: Tengine..Date: Fri, 10 Jul 2015 08:19:30 GMT..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..P3P: CP="NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR IND UNI PUR NAV"..Set-Cookie: cna=C24mDjpgZhYCASU5EL1BywfR; expires=Mon, 07-Jul-25 08:19:30 GMT; path=/; domain=.cnzz.com..Expires: Thu, 01 Jan 1970 00:00:01 GMT..Cache-Control: no-cache..Pragma: no-cache..GIF89a.............!.......,...........L..;..
GET /stat.htm?id=30039538&r=&lg=en-us&ntime=none&cnzz_eid=1152341830-1436511239-&showp=1916x902&t=造梦西游3,造梦西游大闹天åºÂ篇,4399...&h=1&rnd=327808461 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oq.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Fri, 10 Jul 2015 08:19:15 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..
GET /stat.htm?id=4073713&r=&lg=en-us&ntime=none&cnzz_eid=1155346791-1436513542-&showp=1916x902&t=造梦西游3,造梦西游大闹天åºÂ篇,4399...&h=1&rnd=1969154380 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.4399.com/flash/78072.htm
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: oz.cnzz.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Tengine/1.4.6
Date: Fri, 10 Jul 2015 08:19:15 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 09 Mar 2015 09:01:02 GMT
Connection: close
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1332:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
jedata.dll
jedata.dll
{A0005538-9391-4dd9-B4D6-8EB7B9360F08}
{A0005538-9391-4dd9-B4D6-8EB7B9360F08}
\jedata.dll
\jedata.dll
%S4WD
%S4WD
hg%fpM
hg%fpM
S.Ac9SR
S.Ac9SR
0.I%3s
0.I%3s
,wAe.kI
,wAe.kI
aiUy'4xu
aiUy'4xu
%c*@j
%c*@j
.eH'y
.eH'y
{&%U)
{&%U)
lj%4U
lj%4U
xe%CNs
xe%CNs
9F.cLe
9F.cLe
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
207680472
207680472
hXXp://VVV.4399.com/flash/78072.htm
hXXp://VVV.4399.com/flash/78072.htm
416057221 886520
416057221 886520
bbs.886520.cc
bbs.886520.cc
hXXp://jq.qq.com/?_wv=1027&k=TpEX8U
hXXp://jq.qq.com/?_wv=1027&k=TpEX8U
%$%,%4%
%$%,%4%
S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%
S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%
b%c%d%e%f%g%h%i%j%k%l%
b%c%d%e%f%g%h%i%j%k%l%
W%X%Y%Z%[%
W%X%Y%Z%[%
Z%T%i%f%`%P%l%
Z%T%i%f%`%P%l%
%$%a%b%V%U%c%Q%W%]%\%[%
%$%a%b%V%U%c%Q%W%]%\%[%
%
%
%,%$%4%
%,%$%4%
eZl%u
eZl%u
Q.YeY
Q.YeY
R:\Sg|p5rL
R:\Sg|p5rL
e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexe
e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexe
s4s/s)s%s>sNsOs
s4s/s)s%s>sNsOs
qq!r!x!/!L"k!^!-!y"_!`!!&"&$&%&&&'&(&)&*& &,&-&.&/&0&1&2&3&4&5&6&7&8&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&''!'"'#'$'%'&'(')'*' ','-'.'/'0'1'2'3'4'5'6'7'8'9':';''?'@'A'Q'R'S'T'U'V'X'Y'Z'['\']'^'_'`'a'b'c'd'e'f'g'h'i'j'k'l'm'n'o'p'q'W'>!=!B!F!G!H!I!w"x"E!D!s"l!m!("n!r" ","*"-"M"N"O"_"P"`":";"]!e"g"g!\"J"K"A"@"i"j"h!h"f"b"b!a"e!f!c"d">"?"(9(4(((8(=(3(*(:(?(5( (;(@(6(#"""%"$"'"&"!"~!{!}!|!~"z!y!j!i!v"u"t"!!"!#!7!9!:!;!R!S!T!U!V!W!X!Y!Z![!)"."L!M!A!!$"$#$$$%$&$'$($)$*$ $,$-$.$/$0$1$2$3$4$5$6$7$8$9$:$;$$?$@$A$B$C$D$E$F$G$H$I$J$K$L$M$N$O$P$Q$R$S$T$U$V$W$X$Y$Z$[$\$]$^$_$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$ !,!5!6!!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%&!0;e>>NBJ$PfC%Pz6&P]40Cg P52e6p8iL&VpM}FE5,P-P;N=MhA/Pv;sF2P>1_8^8f0KOJO3:!03P4P5P4K6Pr8g0rK|5}5~5bDP
B?PUIg@8!@PBPeBaNJ0AP>2D6gCo7CP$Gk4DPK0`8l4zI2HY5q2gPAElGFPMEPGPn:HP$UPPSPQPB2;JKPOPs8H;&4TPLPcNx;MPRPUPNP!6M0"6A2%UyKnIt8/?7NXJ87½2S=YP^P\PWP/BZP]P[P]JXP.?sK_P`P$=mPPG6IhPpJ62lPfPoPRAD8\GG`nP]EcPv8u8aPZQ~F4A@QAQ,Hx8;OBQ&6L{Qd3uQsQOAwQvQD3`7|Q-NxQ}QzQyQONy8C2tNu=XEe9"R#ReN O%Rz8$R/3&RVK)RgJ-R*@*RP6 R 4.7.R/R0R1R[)6:R[H;RR$Ih6e0?F?R==i@AR@R#>a8CR>HDR\H4BnB(6nF1CnGNKFRj@57GRHR,1u0m4(BQ5qMKR72JR*6LRqLMRRN|868NRPROR_?91^1QRRR78SRn52;TRtK5:Z5'MPA?H}\RZRD2fB8F>L!9yMGE~8/7gRc6JK]HfR^4aRbRdReR[5a?-JcR_Rc8`R$OrJhDb8p9hR]FlR~Si:13yR%Sv0$S%0JI"S|RwR}RH:&Sw0/S'S(S%>iK-S,S/E.S S416:0?)SbE*S"04S#M'>:S9S0SCB1SoB6S&>3SdL31WS^2bS|>^S\S]S_S=19AYSZSz3aSo4dS`ScS.JUF8HfSeSE3gSjSiShS9GkSlSnSmSpSsSqSoSrStSuSvSwSxSEQ|?T@T>TBT8Gh0VICT}>9HEf:NT=J]Nt2JT:AMTcEIEdE9HMDI:ITv16EKTGTP?OTN=-6PThJ}AFDRTOKSTXT/JWTQTTTVT&:IJYTECu2m>[TZTh9\T^T]T`TUTbTaT_TN;Q?TAcT~T%C}T3Jw=[E!U%9"U!G^HQL%G U85EM/L,V#U&UEB8KJE'UeKJ:*>(UP;O;90H8 @Q0,U-U*U81/4)UEL1I(0y0Q;R0#02U0U4U,OLG6U':9UXI:U5U;L^G;U2IUy7LUEUBUdCAUCUDUFUGUr4IUHUJUn>MU\DE1KUNUOURUPUQUR;SU&9TUz;8BUUVUZ;'9RL(5I8WUX3XU9BYU#VZU[U\U^U_U`UpB'1iH2bUFMI=drUsUS0:BR?tU3F.>/>uUm@0>vUwU`LxUF6"=yUzU\VGVFVEVAV@VDVxJKVHVJVrMIV?Vs?LV7:MVNVQVPVOVhE:VWVSVRVTVUVXVfNYVVVZV`4[V]V\V^V_Vn@#=d=cA)98:*9p5`V9:J8aV&LCGbV 9,4'CR6T;[IAHcVu4fV!DeVdVgVkDc?U;J@SB"5"DhViVo>9KlVkVjV}IsVZKmVoVkKnVpV(HqV>JrV34?J/GtVuV,944vV88DM)Mv4xV#D-91>_H2>x=lDyJ9E.9\IyVYEB:K8mDC0n=/9GMzV{VQG|VwN-O~V}VG3!W$W%W#W@I3>'W&W"W(W)W*W-W W,W.Wd1nD/Wz7v26G0W{F[J1W.O2W@J5W!P1P0W@WvEAWBWCW4W3WDWA7'IL:7I&DKIEW4>F1FWGWrL`HJW}1,@IWHWB7TBNWLWKW'Ne8y=MWLE>=@FQWPWOWRWf8SW|I[=TWyHAF'D0EUW 54?,Iw4&GVWV;:K;K~1[WiCXWw2-XZW0GYWWWz9]WcWiWaW\EfW]I`WeWgNW;UB^W^5hW-@e1bWx2gW16dWjWlWvWtWqWpWxNrW2619z=yWkWoW_Wz2sWuWQC(:82mWxWwW36)Bf3C7nWzW}W!X=/XWFGO X1X{9K@T0*X(XZA|W4;FB=X[A8X5X6XfX?XU03Xr6&064;XCXBXGXHXFXIXAXEXJXKX@X|;DXVB292X5?XXiJNXOXPXWXVX}K74TXE743QX8NSXV0UXLXRXYXD7MX]M M\X`X~AyNaX^X[XZX_X0J4FF7bX]XcX{712kX84iXjX):hXfXeXlXdXnX{2pXoX(DsXqXgX|7rXvXuXwXtXxXyXzXjJ|X{X?=.@f2|2}X?0L@~XCl!Ya7"Yo@#Y$Y:5%Y&Y'YWBM8aL;50Y7Y6>1YDG^M3Y4Y8YjE5Y39^@FY4HrBdH-ZzJqDuK;Y!2jCDY4C>YEY@YGYCYBYoGAYRGr5H3g3!?IYNYJY}7OY";i9&==Y};LYX;MYD0HY)Ds546KY'0C:6?rDTHQY^A*B ;RYTYPYaJ=D\A{JNhF1GWY]AxVY[YSGUY!7]3]Y NN:5CZY\@59d?f15Z9Z7Z8ZpY;Z:ZxYZ@Z?ZAZ~269|J/@N8CZFZRI_5EZDZTGGZ56IZHZ:46;XFI7t?JZ0@(E_IKZLZMZ8J]UF@LIX:eHCHMEANOZP_Z;>@L*:W0N@fZ1@G1U=fKr:'@eZcZdZkC&[jZ~;89hZiZ8?gZ/;lZkZpZqZmZ"3nZoZUHaIJ7rZ2@=>RCG6sZwZK2tZvZuZk=HCE0xZyZ*DqNC;kJ=K"[{Z~Z}ZzZ![^F|Z#[l=$[KMxG%['[([)[J6H199*[ [q=bAXR>A=AXBG:rPn7-M~J~I,[s:?D-[/O>K D.[|4/[0[ZL$LvK\K%;2[k;[NE9[ B:[r>]L>DHG[zH>[D[C[O@mKSNgKL2^;HOF[u?E[@[O8L[J[M2H[N[T[HBAJV["IU[pG?K;4w@@=SD.MQ[P[R[O[W[M[K[S[I[lCxLF<::oka3ndjfi1r>mTh8|Mh[tD#3-:`[p[a3n[r[nE~42\ILw[}4~[@K!\#\'\y[*CoE \|[(\"\9?,\3@*\=4POv[&\X0x[:L}["?GDs[%\z?/\q3!81\z[0\)\{[-\.\?\NF$\;\=\XDLMvI8\JB>\?A5\B\A\oF@\jFD\7\H6:\]=`GOLx\k\"8#2_3S\A>p\w\y4=]]N27C?]?4A]@]B]C]D]_;5@!:pIbJDOu;P:rNE]F]`;G]H]J]I]XK^=l9SCi]q]j]ABb5r]h7%5p]n]k]`M@DYFl]t]s]#7-2;:m]o]WKtBwK|]}]O2(J}L!^#x]~]h176u]z]t@qGgHw]!Ky]$^"^{]"KHGc5%EmC%^#^YBv]K1NM0^/^v@,^lM6F&^EDL1?9)^'=.^-^(^ ^h3*^IG.Nt>u@6^4^MI1^3^:1@92O=3bIaM$3;?5^:^C>0M7^2^8^^NsEBF63U1>^A^CNdMH^B^?^TNE^J=G^L^qEJ^D^8CK^@^F^M^|0C^N^=^B=L79CT^/MW^P^rES^Y^QO>_<_ _ioe_i_g_c_d_h_f_nin_k_j_m_tfo_ucmb>3AF>{Nj_y@f_k_l1i_aGe_h_H>QHl_Q59`:`$8HH;`86=`?`>`@`Q8A`i6@A}9C`D`B`m7IHc`~`i`=8e5f`}M0NvBh`j`VNW6|HJGk`m`p`l`o`j8M1q`p?n`\Nt`$tr`u`g`s`<:v a-a.a0a h-i>aVHAaBa[0v>GaDamFCa&5JaEaFaIaHa%IBAAA?5KaLaMaOaNaV1WahHQaSaUa>?VaTa@YaXaZa&[aKD]a!N\aiAbadaeaTCca`a^a_aaahafagaiakalamanajapaoaqaENtarasab4~LJJvauawaxa|ayaza{a}a~a!b"b#b/HPE$brG4I%b&b*E'3D9'b(b)b); b*b,b-biH.b/bis0b1b2b.;3bVG_KN1W14b6b5bpE9@9]7bAL8bF4WH9b:b;b\LUL>DjA=bb=J>@b?b>b}HG4)8FbCb??2LBbDbEbAbGbHb/Dc4eCIbJbMbg?DFNbSKKbLbQbPbObSbRbTbVbUbMJV=FNWb7FXbYb]b[b\bZb^b_b`bab7LbbpLcbNCjGk6;Cdb:6P@eb=:fbgb&8U:ibVEV:N5$KKGWE\9kbK>2NE9'8#Hmbobk8nbvDqb73lbjH01l:ROpbrbKJY@tbubsbN3{bzb'ÌA'c&c(chbjb*c)c(ckHEAAcBciGA??caC@cN>\0)5CcxDDcG@-L#IEcFcUCGNHcGcoScO3Ucj7f5Vcu6Wc|@MF`@u:XcbCkAZc\cYc[c"7]c&7g5RM_c`c.1ccv3bcacec^cfc)NgchctTjcickclc5NmcopO>ncocW=8Fpc(Cqcxcyc Ezc^3Z?dI|chBwc{c}c{:&d.I&HyEZ6%d#d5H~c^C{EzEv:8d(d*d-d.d d,d)d'd!dOJU25d2d7d6dsG'L;;0d9d4d3d/d1dI4=C}@"H>d$Ha@;dOH?dSJ[C:djdhdfdndmdldkdodpd:@qdsdrdR88Aud|Etdvd5JlAG9wdHNydzd{d|de;}dO7j5*5!esLH9~d$efL0:)e*=>8HA%e e&eP7.e2ek7-e6eJ9mMC?e=0JL>e[6lHmAPNo=neHe~@DeIeKeyDNeJeTJK4KL^0Me}NLeo1lFOeVePeWeSe{GJf;fO)HkfS>*IlfjfN4T8h;nH*8CKofmfN9O9i0h:YG_0tf@CXG[Bvfrfufpfsf&KU8}0qfxfyf9F;6&g=Gi;G1D#g"g~fU?eI%g$gP9SO5g)g*gpg22Eg@gAgBg!BDgCgFgGgHgC?i2IgWN h0h|GiM9hOhGh{?F5]6Bh[2T>EhZ:QEJhnJAhZ2V8)IKh?hHhRhChDh:FIhFh(KLh`0@hNhMhkGTh_h~3bhPhUhnM^hUM*NxCk3rIdh!F10]hYhrASh[h`h,G*0XhahxI\hWhU>/=,ehjhsAfhmh_CnhVMch83ihlh,Lohhhkh)K!OshzhrhCI6$iyI}hVh|hOO"FsI i1i2i%ivG/i'i)i3i(i,ir1eF-i0i&i&A*i';E?07tLyLr=7i5iNO4iuM6i8i9ii@i?i1]"]EiDivMj@j?jBjAjZiFjCjDjEjGjl7IjHj0=T9'^JjQ=93KjR1W>LjU9Mja0=INjj?UjRjoCSjPj^6OjVj67^B\jXj5BWjZjQj[j]joHYj^j`jS8TjA0_j[:vNajbjuA"Ncj5MdjejdJfj@:#NkjljX>jjgMgjij=@~?hjmj#Jojnjl3 Kpj|jrjsjtjujyjzjxjvjqjwj{j7p(2~j_6}j"k!k$k#k%k1=&k'k(k>@WM)k$JFG*k k 8,5,kk;AG-kP3.k0kwM/kF?1k2k3kQ44k5k6k7kQ38k9k:kr2(?;kkW7V?Ak$F@k17?kwB-5BkCkY>m7Dk,K_@v5uLJAEkG?pCZ>FkIkJk>:BBHk[>>IGkl;S1NkX7n;m;MOMkLk'AM5CO:3\>KkPkQkOkX8@Mo;'GTk@@BC6MWkl8?@SkXkm8UkVkRkb@IF/C]2pHC54D[kYkLCA@R4Zk[?JN@O\kgk5Dfkckkkdk`k|D_k]k!Mp;ak^kekt=A8zBEKZ1b0%FikhkfFmkbklknk,8jkV9U$ln8%l&l>;NZ'l(l2=)l*l l,l-l C.l0l/l&F1l-K2l3l4l5lZF]>6lk9.P7l8l?I9lAl:ll?l@lBl-3gDiIb:W9OI_2NHElS4U@DlIlyCcLGlHl.5JlcG_BqH=EFlGKl2Ll(OBDEOq;Kl1B\l(AxFPIOl?;r;^>eG-8NlMljIAm?m@m=mAmVEDmGm4n47;nRnPnQnTnSnz>UnVnWnPHS:a[9HKd6F="o$oS6EIby30o?:yAJD;3.o/oCD-o1o7o:o9o-E2o3o6o8o@6;o5o4o?o@oAo>o=ob>*F#1YN p.n*p.p,p-p/p0plN1p2pI@;H}?g4:Mm28=[85p4ps;6p3p(;:p-jVRw?8p%NqF 1c@6pnN9p@pBpAp?pCpDpzAb2Ep8LFpGp*O1[HpIpJpNpKpLpMpOpD@wLE@PpsHQpSsLLRpSpTpW3VpY?Wp$7Xp\pZp[ps3Yp]p^pH0_p`pd>apG5dpcpbpqk\JepfpgphpipjpZ4kplp#Gnp;2qppp$1A6GJ:D":`9g=\?sprpBMh4RH\F|?NN[7vpupKK,FP1wptpQIjMxpyp{pjB[3\3zpi428j4?E`N\8|p}p~p!q#q"qwI$q%q&q'q)q(q*qtHLf)?25 q,q,R;]SH{0;0t;0K~>-q_L.q\MB1A;/qn20q1q3q4q6q2q5q[47q8q9q:q;q=qq@qAqCqB6s3OGGqHqZCkFIq}GLBX1n6o6sCNqp6o2MqKqLqJqXqOqPqQqRqTqSqY=UqWq35Vq{A38YqMBZq-F[q`q^q]q_q\qbqaqdqC6cqeqfqhqgqiqkqjq|9lqmq0:r J8r;rr?rnK-;z:/A@rCrArDrq8BrErFrGrKr*;dBLrIrHrJr_7PrOrNr30ZrVrWrSrYrUrb3LOXrTrRrQr\r_r^r]rII[rs0`rbro3Mr71drcrar-CpKZNerfrgrhrir;Djr7Horkrlr1KDLPFprqr>Fnrmr*2yrxru1vrursr{3rr2sIO;skBm:?s@sAsBsCs48DsEs/
qq!r!x!/!L"k!^!-!y"_!`!!&"&$&%&&&'&(&)&*& &,&-&.&/&0&1&2&3&4&5&6&7&8&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&''!'"'#'$'%'&'(')'*' ','-'.'/'0'1'2'3'4'5'6'7'8'9':';''?'@'A'Q'R'S'T'U'V'X'Y'Z'['\']'^'_'`'a'b'c'd'e'f'g'h'i'j'k'l'm'n'o'p'q'W'>!=!B!F!G!H!I!w"x"E!D!s"l!m!("n!r" ","*"-"M"N"O"_"P"`":";"]!e"g"g!\"J"K"A"@"i"j"h!h"f"b"b!a"e!f!c"d">"?"(9(4(((8(=(3(*(:(?(5( (;(@(6(#"""%"$"'"&"!"~!{!}!|!~"z!y!j!i!v"u"t"!!"!#!7!9!:!;!R!S!T!U!V!W!X!Y!Z![!)"."L!M!A!!$"$#$$$%$&$'$($)$*$ $,$-$.$/$0$1$2$3$4$5$6$7$8$9$:$;$$?$@$A$B$C$D$E$F$G$H$I$J$K$L$M$N$O$P$Q$R$S$T$U$V$W$X$Y$Z$[$\$]$^$_$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$ !,!5!6!!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%&!0;e>>NBJ$PfC%Pz6&P]40Cg P52e6p8iL&VpM}FE5,P-P;N=MhA/Pv;sF2P>1_8^8f0KOJO3:!03P4P5P4K6Pr8g0rK|5}5~5bDP
B?PUIg@8!@PBPeBaNJ0AP>2D6gCo7CP$Gk4DPK0`8l4zI2HY5q2gPAElGFPMEPGPn:HP$UPPSPQPB2;JKPOPs8H;&4TPLPcNx;MPRPUPNP!6M0"6A2%UyKnIt8/?7NXJ87½2S=YP^P\PWP/BZP]P[P]JXP.?sK_P`P$=mPPG6IhPpJ62lPfPoPRAD8\GG`nP]EcPv8u8aPZQ~F4A@QAQ,Hx8;OBQ&6L{Qd3uQsQOAwQvQD3`7|Q-NxQ}QzQyQONy8C2tNu=XEe9"R#ReN O%Rz8$R/3&RVK)RgJ-R*@*RP6 R 4.7.R/R0R1R[)6:R[H;RR$Ih6e0?F?R==i@AR@R#>a8CR>HDR\H4BnB(6nF1CnGNKFRj@57GRHR,1u0m4(BQ5qMKR72JR*6LRqLMRRN|868NRPROR_?91^1QRRR78SRn52;TRtK5:Z5'MPA?H}\RZRD2fB8F>L!9yMGE~8/7gRc6JK]HfR^4aRbRdReR[5a?-JcR_Rc8`R$OrJhDb8p9hR]FlR~Si:13yR%Sv0$S%0JI"S|RwR}RH:&Sw0/S'S(S%>iK-S,S/E.S S416:0?)SbE*S"04S#M'>:S9S0SCB1SoB6S&>3SdL31WS^2bS|>^S\S]S_S=19AYSZSz3aSo4dS`ScS.JUF8HfSeSE3gSjSiShS9GkSlSnSmSpSsSqSoSrStSuSvSwSxSEQ|?T@T>TBT8Gh0VICT}>9HEf:NT=J]Nt2JT:AMTcEIEdE9HMDI:ITv16EKTGTP?OTN=-6PThJ}AFDRTOKSTXT/JWTQTTTVT&:IJYTECu2m>[TZTh9\T^T]T`TUTbTaT_TN;Q?TAcT~T%C}T3Jw=[E!U%9"U!G^HQL%G U85EM/L,V#U&UEB8KJE'UeKJ:*>(UP;O;90H8 @Q0,U-U*U81/4)UEL1I(0y0Q;R0#02U0U4U,OLG6U':9UXI:U5U;L^G;U2IUy7LUEUBUdCAUCUDUFUGUr4IUHUJUn>MU\DE1KUNUOURUPUQUR;SU&9TUz;8BUUVUZ;'9RL(5I8WUX3XU9BYU#VZU[U\U^U_U`UpB'1iH2bUFMI=drUsUS0:BR?tU3F.>/>uUm@0>vUwU`LxUF6"=yUzU\VGVFVEVAV@VDVxJKVHVJVrMIV?Vs?LV7:MVNVQVPVOVhE:VWVSVRVTVUVXVfNYVVVZV`4[V]V\V^V_Vn@#=d=cA)98:*9p5`V9:J8aV&LCGbV 9,4'CR6T;[IAHcVu4fV!DeVdVgVkDc?U;J@SB"5"DhViVo>9KlVkVjV}IsVZKmVoVkKnVpV(HqV>JrV34?J/GtVuV,944vV88DM)Mv4xV#D-91>_H2>x=lDyJ9E.9\IyVYEB:K8mDC0n=/9GMzV{VQG|VwN-O~V}VG3!W$W%W#W@I3>'W&W"W(W)W*W-W W,W.Wd1nD/Wz7v26G0W{F[J1W.O2W@J5W!P1P0W@WvEAWBWCW4W3WDWA7'IL:7I&DKIEW4>F1FWGWrL`HJW}1,@IWHWB7TBNWLWKW'Ne8y=MWLE>=@FQWPWOWRWf8SW|I[=TWyHAF'D0EUW 54?,Iw4&GVWV;:K;K~1[WiCXWw2-XZW0GYWWWz9]WcWiWaW\EfW]I`WeWgNW;UB^W^5hW-@e1bWx2gW16dWjWlWvWtWqWpWxNrW2619z=yWkWoW_Wz2sWuWQC(:82mWxWwW36)Bf3C7nWzW}W!X=/XWFGO X1X{9K@T0*X(XZA|W4;FB=X[A8X5X6XfX?XU03Xr6&064;XCXBXGXHXFXIXAXEXJXKX@X|;DXVB292X5?XXiJNXOXPXWXVX}K74TXE743QX8NSXV0UXLXRXYXD7MX]M M\X`X~AyNaX^X[XZX_X0J4FF7bX]XcX{712kX84iXjX):hXfXeXlXdXnX{2pXoX(DsXqXgX|7rXvXuXwXtXxXyXzXjJ|X{X?=.@f2|2}X?0L@~XCl!Ya7"Yo@#Y$Y:5%Y&Y'YWBM8aL;50Y7Y6>1YDG^M3Y4Y8YjE5Y39^@FY4HrBdH-ZzJqDuK;Y!2jCDY4C>YEY@YGYCYBYoGAYRGr5H3g3!?IYNYJY}7OY";i9&==Y};LYX;MYD0HY)Ds546KY'0C:6?rDTHQY^A*B ;RYTYPYaJ=D\A{JNhF1GWY]AxVY[YSGUY!7]3]Y NN:5CZY\@59d?f15Z9Z7Z8ZpY;Z:ZxYZ@Z?ZAZ~269|J/@N8CZFZRI_5EZDZTGGZ56IZHZ:46;XFI7t?JZ0@(E_IKZLZMZ8J]UF@LIX:eHCHMEANOZP_Z;>@L*:W0N@fZ1@G1U=fKr:'@eZcZdZkC&[jZ~;89hZiZ8?gZ/;lZkZpZqZmZ"3nZoZUHaIJ7rZ2@=>RCG6sZwZK2tZvZuZk=HCE0xZyZ*DqNC;kJ=K"[{Z~Z}ZzZ![^F|Z#[l=$[KMxG%['[([)[J6H199*[ [q=bAXR>A=AXBG:rPn7-M~J~I,[s:?D-[/O>K D.[|4/[0[ZL$LvK\K%;2[k;[NE9[ B:[r>]L>DHG[zH>[D[C[O@mKSNgKL2^;HOF[u?E[@[O8L[J[M2H[N[T[HBAJV["IU[pG?K;4w@@=SD.MQ[P[R[O[W[M[K[S[I[lCxLF<::oka3ndjfi1r>mTh8|Mh[tD#3-:`[p[a3n[r[nE~42\ILw[}4~[@K!\#\'\y[*CoE \|[(\"\9?,\3@*\=4POv[&\X0x[:L}["?GDs[%\z?/\q3!81\z[0\)\{[-\.\?\NF$\;\=\XDLMvI8\JB>\?A5\B\A\oF@\jFD\7\H6:\]=`GOLx\k\"8#2_3S\A>p\w\y4=]]N27C?]?4A]@]B]C]D]_;5@!:pIbJDOu;P:rNE]F]`;G]H]J]I]XK^=l9SCi]q]j]ABb5r]h7%5p]n]k]`M@DYFl]t]s]#7-2;:m]o]WKtBwK|]}]O2(J}L!^#x]~]h176u]z]t@qGgHw]!Ky]$^"^{]"KHGc5%EmC%^#^YBv]K1NM0^/^v@,^lM6F&^EDL1?9)^'=.^-^(^ ^h3*^IG.Nt>u@6^4^MI1^3^:1@92O=3bIaM$3;?5^:^C>0M7^2^8^^NsEBF63U1>^A^CNdMH^B^?^TNE^J=G^L^qEJ^D^8CK^@^F^M^|0C^N^=^B=L79CT^/MW^P^rES^Y^QO>_<_ _ioe_i_g_c_d_h_f_nin_k_j_m_tfo_ucmb>3AF>{Nj_y@f_k_l1i_aGe_h_H>QHl_Q59`:`$8HH;`86=`?`>`@`Q8A`i6@A}9C`D`B`m7IHc`~`i`=8e5f`}M0NvBh`j`VNW6|HJGk`m`p`l`o`j8M1q`p?n`\Nt`$tr`u`g`s`<:v a-a.a0a h-i>aVHAaBa[0v>GaDamFCa&5JaEaFaIaHa%IBAAA?5KaLaMaOaNaV1WahHQaSaUa>?VaTa@YaXaZa&[aKD]a!N\aiAbadaeaTCca`a^a_aaahafagaiakalamanajapaoaqaENtarasab4~LJJvauawaxa|ayaza{a}a~a!b"b#b/HPE$brG4I%b&b*E'3D9'b(b)b); b*b,b-biH.b/bis0b1b2b.;3bVG_KN1W14b6b5bpE9@9]7bAL8bF4WH9b:b;b\LUL>DjA=bb=J>@b?b>b}HG4)8FbCb??2LBbDbEbAbGbHb/Dc4eCIbJbMbg?DFNbSKKbLbQbPbObSbRbTbVbUbMJV=FNWb7FXbYb]b[b\bZb^b_b`bab7LbbpLcbNCjGk6;Cdb:6P@eb=:fbgb&8U:ibVEV:N5$KKGWE\9kbK>2NE9'8#Hmbobk8nbvDqb73lbjH01l:ROpbrbKJY@tbubsbN3{bzb'ÌA'c&c(chbjb*c)c(ckHEAAcBciGA??caC@cN>\0)5CcxDDcG@-L#IEcFcUCGNHcGcoScO3Ucj7f5Vcu6Wc|@MF`@u:XcbCkAZc\cYc[c"7]c&7g5RM_c`c.1ccv3bcacec^cfc)NgchctTjcickclc5NmcopO>ncocW=8Fpc(Cqcxcyc Ezc^3Z?dI|chBwc{c}c{:&d.I&HyEZ6%d#d5H~c^C{EzEv:8d(d*d-d.d d,d)d'd!dOJU25d2d7d6dsG'L;;0d9d4d3d/d1dI4=C}@"H>d$Ha@;dOH?dSJ[C:djdhdfdndmdldkdodpd:@qdsdrdR88Aud|Etdvd5JlAG9wdHNydzd{d|de;}dO7j5*5!esLH9~d$efL0:)e*=>8HA%e e&eP7.e2ek7-e6eJ9mMC?e=0JL>e[6lHmAPNo=neHe~@DeIeKeyDNeJeTJK4KL^0Me}NLeo1lFOeVePeWeSe{GJf;fO)HkfS>*IlfjfN4T8h;nH*8CKofmfN9O9i0h:YG_0tf@CXG[Bvfrfufpfsf&KU8}0qfxfyf9F;6&g=Gi;G1D#g"g~fU?eI%g$gP9SO5g)g*gpg22Eg@gAgBg!BDgCgFgGgHgC?i2IgWN h0h|GiM9hOhGh{?F5]6Bh[2T>EhZ:QEJhnJAhZ2V8)IKh?hHhRhChDh:FIhFh(KLh`0@hNhMhkGTh_h~3bhPhUhnM^hUM*NxCk3rIdh!F10]hYhrASh[h`h,G*0XhahxI\hWhU>/=,ehjhsAfhmh_CnhVMch83ihlh,Lohhhkh)K!OshzhrhCI6$iyI}hVh|hOO"FsI i1i2i%ivG/i'i)i3i(i,ir1eF-i0i&i&A*i';E?07tLyLr=7i5iNO4iuM6i8i9ii@i?i1]"]EiDivMj@j?jBjAjZiFjCjDjEjGjl7IjHj0=T9'^JjQ=93KjR1W>LjU9Mja0=INjj?UjRjoCSjPj^6OjVj67^B\jXj5BWjZjQj[j]joHYj^j`jS8TjA0_j[:vNajbjuA"Ncj5MdjejdJfj@:#NkjljX>jjgMgjij=@~?hjmj#Jojnjl3 Kpj|jrjsjtjujyjzjxjvjqjwj{j7p(2~j_6}j"k!k$k#k%k1=&k'k(k>@WM)k$JFG*k k 8,5,kk;AG-kP3.k0kwM/kF?1k2k3kQ44k5k6k7kQ38k9k:kr2(?;kkW7V?Ak$F@k17?kwB-5BkCkY>m7Dk,K_@v5uLJAEkG?pCZ>FkIkJk>:BBHk[>>IGkl;S1NkX7n;m;MOMkLk'AM5CO:3\>KkPkQkOkX8@Mo;'GTk@@BC6MWkl8?@SkXkm8UkVkRkb@IF/C]2pHC54D[kYkLCA@R4Zk[?JN@O\kgk5Dfkckkkdk`k|D_k]k!Mp;ak^kekt=A8zBEKZ1b0%FikhkfFmkbklknk,8jkV9U$ln8%l&l>;NZ'l(l2=)l*l l,l-l C.l0l/l&F1l-K2l3l4l5lZF]>6lk9.P7l8l?I9lAl:ll?l@lBl-3gDiIb:W9OI_2NHElS4U@DlIlyCcLGlHl.5JlcG_BqH=EFlGKl2Ll(OBDEOq;Kl1B\l(AxFPIOl?;r;^>eG-8NlMljIAm?m@m=mAmVEDmGm4n47;nRnPnQnTnSnz>UnVnWnPHS:a[9HKd6F="o$oS6EIby30o?:yAJD;3.o/oCD-o1o7o:o9o-E2o3o6o8o@6;o5o4o?o@oAo>o=ob>*F#1YN p.n*p.p,p-p/p0plN1p2pI@;H}?g4:Mm28=[85p4ps;6p3p(;:p-jVRw?8p%NqF 1c@6pnN9p@pBpAp?pCpDpzAb2Ep8LFpGp*O1[HpIpJpNpKpLpMpOpD@wLE@PpsHQpSsLLRpSpTpW3VpY?Wp$7Xp\pZp[ps3Yp]p^pH0_p`pd>apG5dpcpbpqk\JepfpgphpipjpZ4kplp#Gnp;2qppp$1A6GJ:D":`9g=\?sprpBMh4RH\F|?NN[7vpupKK,FP1wptpQIjMxpyp{pjB[3\3zpi428j4?E`N\8|p}p~p!q#q"qwI$q%q&q'q)q(q*qtHLf)?25 q,q,R;]SH{0;0t;0K~>-q_L.q\MB1A;/qn20q1q3q4q6q2q5q[47q8q9q:q;q=qq@qAqCqB6s3OGGqHqZCkFIq}GLBX1n6o6sCNqp6o2MqKqLqJqXqOqPqQqRqTqSqY=UqWq35Vq{A38YqMBZq-F[q`q^q]q_q\qbqaqdqC6cqeqfqhqgqiqkqjq|9lqmq0:r J8r;rr?rnK-;z:/A@rCrArDrq8BrErFrGrKr*;dBLrIrHrJr_7PrOrNr30ZrVrWrSrYrUrb3LOXrTrRrQr\r_r^r]rII[rs0`rbro3Mr71drcrar-CpKZNerfrgrhrir;Djr7Horkrlr1KDLPFprqr>Fnrmr*2yrxru1vrursr{3rr2sIO;skBm:?s@sAsBsCs48DsEs/
S%S'S(S)S S,S-S0S2S5SSBSLSKSYS[SaScSeSlSmSrSyS~S
S%S'S(S)S S,S-S0S2S5SSBSLSKSYS[SaScSeSlSmSrSyS~S
d d"d$d%d)d*d/d0d5d=d?dKdOdQdRdSdTdZd[d\d]d_d`dadcdmdsdtd{d}d
d d"d$d%d)d*d/d0d5d=d?dKdOdQdRdSdTdZd[d\d]d_d`dadcdmdsdtd{d}d
B"p"C"m"l"n"4"1"k"D""*!*$***#*)*!).*2*1*4*3*@*?*B*A*P*R*Q*T*X*S*,)c*b*e*d*r*0)N)" ! $ * # ) A). 2 1 4 3 @ ? B A C)P R Q T X S L)c b e d r P)s '*' %*% (*( * ,*, /*/ -*- 0*0 ")B)7*7 6*6 8*8 5*5 :*: ;*; =*= *> $)D)G*G E*E F*F D*E)&)F)H*H I*I G)J*J L*L K*K ))I)()H)M*M O*O N*N J) )K)W*W V*V -)M)Y*Y [*[ Z*Z \*\ ]*] _*_ ^*^ a*a `*` /)O)l*l i*i f*f k*k h*h j*j q*q t*t s*u*u w*w v*v &*& C*C U*U g*g p*p m*m o*o n*n 9 0"/"2"6"5"3"8"9"a&b&c&d&g&i&l&v&e&j&q&r&s&t&{&x&u&z&w&y&|&B'C'D'E'F'G'H'I'J'K'L'M'N'r's't'u'v'w'x'y'z'{'|'}'~'q"o"!0"0#0$0%0&0'0(0)0*0 0,0-0.0/000102030405060708090:0;00?0@0A0B0C0D0E0F0G0H0I0J0K0L0M0N0O0P0Q0R0S0T0U0V0W0X0Y0Z0[0\0]0^0`0a0b0c0d0e0f0g0h0i0j0k0l0m0n0o0p0_0q0r0s0t0u0v0w0x0y0z0{0|0}0~0!1"1#1$1%1&1'1(1)1*1 1,1-1.1/101112131415161718191:1;11?1@1A1B1C1D1E1F1G1H1I1J1K1L1M1N1O1P1Q1R1S1T1U1V1W1X1Y1Z1[1\1]1^1v1_1`1a1b1c1d1e1f1g1h1i1j1k1l1m1n1o1p1q1r1s1t1u1w1x1y1z1{1|1}1~1!2"2#2$2%2&2'2(2)2*2 2,2-2.2/202122232425262728292:2;22?2@2A2B2C2D2E2Q2F2G2H2I2J2K2L2M2N2O2P2R2S2T2U2V2W2X2Y2Z2[2\2]2^2_2`2a2b2c2d2e2f2g2h2i2j2k2l2m2n2o2p2q2r2s2t2u2v2w2x2y2z2{2|2}2~2!3"3#3$3%3&3'3(3)3*3 3,3-3.3/303132333435363738393:3;33?3@3A3B3C3D3E3F3G3H3I3J3K3L3M3N3O3P3Q3R3S3T3U3V3W3X3Y3Z3[3\3]3^3_3`3a3b3c3d3e3f3g3h3i3j3k3l3m3n3o3p3q3r3s3t3u3v3w3x3y3z3{3|3}3~3!4"4#4$4%4&4'4(4)4*4 4,4-4.4/404142434445464847494:4;44?4@4A4B4C4D4E4F4G4H4I4J4K4L4M4N4O4P4Q4R4S4T4U4V4W4X4Y4Z4[4\4]4^4_4`4a4b4c4d4e4f4g4h4i4j4k4l4m4n4o4p4q4r4s4t4u4v4w4x4y4z4{4|4}4~4!5"5#5$5%5&5'5(5)5*5 5,5-5.5/505152535455565758595:5;55?5@5A5B5C5D5E5F5G5H5I5J5K5L5M5N5O5P5Q5R5S5T5U5V5W5X5Y5Z5[5\5]5^5_5`5a5b5c5d5e5f5g5h5i5j5k5l5m5n5o5p5q5r5s5t5u5v5w5x5y5z5{5|5}5~5!6"6#6$6%6&6'6(6)6*6 6,6-6.6/606162636465666768696:6;66?6@6A6B6C6D6E6F6G6H6I6J6K6L6M6N6O6P6Q6R6S6T6U6V6W6X6Y6Z6[6\6]6^6_6`6a6b6c6d6e6f6g6h6i6j6k6l6m6p6q6n6o6r6s6t6u6v6w6x6y6z6{6}6~6|6!7"7#7$7%7&7'7(7)7*7 7,7-7.7/707172737475767778797:7;77?7@7A7B7C7D7E7F7G7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V7W7`7X7Y7Z7[7\7]7^7_7a7b7c7d7e7f7g7h7i7j7k7l7m7~7n7o7p7q7r7s7t7u7v7w7x7y7z7{7|7}7!8"8#8$8%8&8'8(8)8*8 8,8-8.8/808182838485868788898:8;88?8@8A8B8C8D8E8F8G8H8I8J8K8L8M8N8P8Q8O8R8S8T8U8V8W8X8Y8Z8[8\8]8^8_8`8a8b8c8d8e8g8h8i8j8k8l8m8n8o8p8q8r8s8t8u8v8w8x8y8z8{8|8}8~8!9"9#9$9%9&9'9(9)9*9 9,9-9.9/909192939495969798999:9;99?9@9A9B9C9D9E9F9G9H9I9J9K9L9M9N9O9P9Q9R9S9T9U9V9W9X9Y9Z9[9\9]9^9_9`9a9b9c9d9e9f9g9h9i9j9k9l9m9n9o9p9q9r9s9t9u9v9w9x9y9z9{9|9}9~9!:":#:$:%:&:':(:):*: :,:-:.:/:0:1:3:4:5:6:7:8:2:9:::;:<:>:?:@:A:B:C:D:E:F:G:H:I:J:K:L:M:N:O:P:Q:R:S:T:U:V:W:X:Y:Z:[:\:]:^:_:`:a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:w:x:y:z:{:|:}:~:!;";#;$;%;&;';(;);*; ;,;-;.;/;0;1;2;3;4;5;6;7;8;9;:;;;=;;?;@;A;B;C;D;E;G;H;I;J;F;K;L;M;N;O;P;Q;R;S;W;U;T;V;X;Y;Z;[;\;];^;_;`;a;b;c;d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;tfs;t;u;v;w;x;z;y;{;|;};~;!=?=@=A=B=C=D=E=F=G=H=I=J=K=L=M=N=O=P=Q=R=S=T=U=V=W=X=Y=Z=[=\=]=^=_=`=a=b=c=d=e=f=g=h=i=j=k=l=m=n=o=p=q=r=s=t=u=v=w=x=y=z={=|=}=~=!>">#>$>%>&>'>(>)>*> >,>->.>/>0>1>2>3>4>5>6>7>8>9>:>;>=>>>?>@>A>B>C>D>E>F>G>H>I>J>K>L>M>N>O>P>Q>R>S>T>U>V>W>X>Y>Z>[>\>]>^>_>`>a>b>c>d>e>f>g>h>i>j>k>l>m>n>o>p>q>r>s>t>u>v>w>x>y>z>{>~>|>}>!?"?#?$?%?&?'?(?)?*? ?,?-?.?/?0?1?2?3?4?5?6?7?8?9?:?;?=?>???@?A?B?C?D?E?F?G?H?I?J?K?L?M?N?O?P?Q?R?S?T?U?V?W?X?Y?Z?[?\?]?^?_?`?a?b?c?d?e?f?g?h?i?j?k?l?m?n?o?p?q?r?s?t?u?v?w?x?y?z?{?|?}?~?!@"@#@$@%@&@'@(@)@*@ @,@-@.@/@0@1@2@3@4@5@6@7@8@9@:@;@@?@@@A@B@C@D@E@F@G@H@I@J@K@L@M@N@O@P@Q@R@S@T@U@V@W@X@Y@Z@[@\@]@^@_@`@a@b@c@d@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@{@|@}@~@!A"A#A$A%A&A'A(A)A*A A,A-A.A/A0A1A2A3A4A5A6A7A8A9A:A;AA?A@AAABACADAEAFAGAHAIAJAKALAMANAOAPAQARASATAUAVAWAXAYAZA[A\A]A^A_A`AaAbAcAdAeAfAgAhAiAjAkAlAmAnAoApAqArAsAtAuAvAwAxAyAzA{A|A}A~A!B"B#B$B%B&B'B(B)B*B B,B-B.B0B/B1B2B3B4B5B7B6B8B9B:B;BB@BABBBDBEBGBHBIBJBLBCBFBKBMBNBOBPBQBRBSBTBUBVBWBXBYBZB[B\B]B^B_B`BaBbBcBdBeBfBgBhBiBjBkBlBmB?BnBoBpBqBrBsBtBuBvBwBxByBzB{B|B}B~B!C"C#C$C%C&C'C(C)C*C C,C-C.C/C0C1C2C3C4C5C6C7C9C:C;CC?C@CACBCCCDCECFCGCHC8CJCKCLCMCOCNCPCQCRCSCTCUCVCWCXCYCZC[CIC\C]C^C_C`CaCbCcCdCeCfCgChCiCjCkClCmCnCoCpCqCrCsCtCuCvCwCxCyCzC{C|C}C~C!D"D#D$D%D&D'D(D)D*D D,D-D.D/D0D1D2D3D4D5D6D7D8D9D:D;DD?D@DADBDCDDDEDFDGDHDIDJDKDLDMDNDODPDQDRDSDTDUDVDWDXDYDZD[D\D]D^D_D`DaDbDcDdDeDfDgDhDiDjDkDlDmDnDoDpDqDrDsDtDuDvDwDxDyDzD{D|D}D~D!E"E#E$E%E&E'E(E)E*E E,E-E.E/E0E1E2E3E4E5E6E7E8E9E:E;EE?E@EAEBECEDEEEFEGEHEIEJEKEMELENEOEPEQERESETEUEVEWEXEYEZE[E\E]E^E_E`EaEbEcEdEeEfEgEhEiEjEkElEmEnEoEpEqErEsEtEuEvEwExEyEzE{E|E}E~E!F"F#F$F%F&F'F(F)F*F F,F-F.F/F0F1F2F3F4F5F6F7F8F9F:F;FF?F@FAFBFCFDFEFFFGFHFIFJFKFLFMFNFOFPFQFRFSFTFUFVFWFXFYFZF[F\F]F^F_F`F6GaFbFcFdFeFfFgFhFiFjFkFlFmFnFoFpFqFrFsFtFuFvFwFxFyFzF{F|F}F~F!G"G#G$G%G&G'G(G)G*G G,G-G.G/G0G1G2G3G4G5G7G8G9G:G;GG?G@GAGBGCGDGEGFGGGHGIGJGKGLGMGNGOGPGQGRGSGTGUGVGWGXGYGZG[G\G]G^G_G`GaGbGcGdGeGfGgGhGiGjGkGlGmGnGoGpGqGrGsGtGuGvGwGxGyGzG{G|G}G~G!H"H#H$H%H&H'H(H)H*H H,H-H.H/H0H1H2H3H4H5H6H7H8H9H:H;HH?H@HAHBHCHDHEHFHGHHHIHJHKHLHSHMHNHOHPHQHRHTHUHVHWHXHYHZH[H\H]H^H_H`HaHbHcHdHeHfHgHhHiHjHkHlHmHnHoHpHqHrHsHtHuHvHwHxHyHzH{H|H}H~H!I"I#I$I%I&I'I(I)I*I I,I-I.I/I0I1I2I3I4I5I6I7I8I9I:I;II?I@IBICIDIEIFIGIHIIIJIKILIMINIOIPIQIRISITIUIVIWIXIYIZI[I\I]I^I_I`IaIbIcIdIeIfIgIhIiIjIkIlImInIoIpIqIrIsItIuIvIwIxIyIzI{I|I}I~I!J"J#J$J%J&J'J(J)J*J J,J-J.J/J0J1J2J3J4J5J6J7J8J9J:J;JJ?J@JAJBJCJDJEJFJGJHJIJJJKJLJMJNJOJPJQJRJSJTJUJVJWJXJYJZJ[J\J]J^J_J`JaJbJcJdJeJfJgJhJiJjJkJlJmJnJoJpJqJrJsJtJuJvJwJxJyJzJ{J|J}J~J!K"K#K$K%K&K'K(K)K*K K,K-K.K/K0K1K2K3K4K5K6K7K8K9K:K;KK?K@KAKBKCKDKEKFKGKHKIKJKKKLKMKNKOKPKQKRKSKTKUKVKWKXKYKZK[K\K]K^K_K`KaKbKcKdKeKfKgKhKiKjKkKlKmKnKoKpKqKrKsKtKuKvKwKxKyKzK{K|K}K~K!L"L#L$L%L&L'L(L)L*L L,L-L.L/L0L1L2L3L4L5L6L7L8L9L:L;LL?L@LALBLCLDLELFLGLHLILJLKLLLMLNLOLPLQLRLSLTLULVLWLXLYLZL[L\L]L^L_L`LaLbLcLdLeLfLgLhLiLjLkLlLmLnLoLpLqLrLsLtLuLvLwLxLyLzL{L|L}L~L!M"M#M$M%M&M'M(M)M*M M,M-M.M/M0M1M2M3M4M5M6M7M8M9M:M;MM?M@MAMBMCMDMEMFMGMHMIMJMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYMZM[M\M]M^M_M`MaMbMcMdMeMfMgMhMiMjMkMlMmMnMoMpMqMrMsMtMuMvMwMxMyMzM{M|M}M~M!N"N$N%N&N'N(N)N#N*N N,N-N.N/N0N1N2N3N4N5N6N7N8N9N:N;NN?N@NANBNCNDNENFNGNHNINJNKNLNMNNNONPNQNRNSNTNUNVNWNXNYNZN[N\N]N^N_N`NaNbNcNdNeNfNgNhNiNjNkNlNmNnNoNpNqNrNsNtNuNvNwNxNyNzN{N|N}N~N!O"O#O$O%O&O'O(O)O*O O,O-O.O/O0O1O2O3O4O5O6O7O8O9O:O;OO?O@OAOBOCODOEOFOGOHOIOJOKOLOMONOOOPOQOROSOTOUOVOWOXOYOZO[O\O]O^O_O`OaObOcOdOeOfOgOhOiOjOkOlOmOnOoOpOqOrOtOuOvOsOwOxOyOzO{O|O}O~O!P"P#P$P%P&P'P(P)P*P P,P.P/P0P1P-P2P3P4P5P7P8P9P:P;P6P
P?P@PAPBPCPDPEPFPGPHPIPJPKPLPMPNPOPPPQPRPSPTPUPVPWPXPYPZP[P\P]P^P_P`PaPbPcPdPePfPgPhPiPjPkPlPmPnPoPpPqPrPsPtPuPvPwPxPyPzP{P|P}P~P!Q"Q#Q$Q%Q&Q'Q(Q)Q*Q Q,Q-Q.Q/Q0Q1Q2Q3Q4Q5Q6Q7Q8Q9Q:Q;QQ?Q@QAQBQCQDQEQFQGQHQIQJQKQLQMQNQOQPQQQRQSQTQUQVQWQXQYQZQ[Q\Q]Q^Q_Q`QaQbQcQdQeQfQgQhQiQjQkQlQmQnQoQpQqQrQsQtQuQvQwQxQyQzQ{Q|Q}Q~Q!R"R#R$R%R&R'R(R)R*R R,R-R.R/R0R1R2R3R4R5R6R7R8R9R:R;RR?R@RARBRCRDRERFRGRHRIRJRKRLRMRNRORPRQRRRSRTRURVRWRXRYRZR[R\R]R^R_R`RaRbRcRdReRfRgRhRiRjRkRlRmRnRoRpRqRrRsRtRvRwRxRuRyRzR{R|R}R~R!S"S#S$S%S&S'S(S)S*S S,S-S.S/S0S1S2S3S4S5S6S7S8S9S:S;SS?S@SASBSCSDSESFSGSHSISJSKSLSMSNSOSPSQSRSSSTSUSVSWSXSYSZS[S\S]S^S_S`SaSbScSdSeSfSgShSiSjSkSlSmSnSoSpSqSrSsStSuSvSwSxSySzS{S|S}S~S!T"T#T$T%T&T'T(T)T*T T,T-T.T/T0T1T2T4T5T6T7T8T9T:T;TT3T?T@TATBTCTDTETFTGTHTITJTKTLTMTNTOTPTQTRTSTTTUTVTWTXTYTZT[T\T]T^T_T`TaTbTcTdTeTfTgThTiTjTlTkTmTnToTpTqTrTsTtTuTvTwTxTyTzT{T|T}T~T!U"U#U$U%U&U'U(U)U*U U,U-U.U/U0U1U2U3U4U5U6U7U8U9U:U;UU?U@UAUBUCUDUEUFUGUHUIUJUKULUMUNUOUPUQURUSUTUUUVUWUXUYUZU[U\U]U^U_U`UaUbUcUdUeUfUgUhUiUjUkUlUmUnUoUpUqUrUsUtUuUvUwUxUyUzU{U|U}U~U!V"V#V$V%V&V'V(V)V*V V,V-V.V/V0V1V2V3V4V5V6V7V8V9V:V;VV?V@VAVBVCVDVEVGVHVIVJVKVFVLVMVNVOVPVQVRVSVTVVVWVXVUVYVZV[V\V]V^V_V`VaVbVcVdVeVfVgVhViVjVkVlVmVnVoVpVqVrVsVtVuVvVwVxVyVzV{V|V}V~V!W"W#W$W%W&W'W(W)W*W W,W-W.W/W0W1W2W3W4W5W6W7W8W9W:W;WW?W@WAWBWCWDWEWFWGWHWIWJWKWLWMWNWOWPWQWRWSWTWUWVWWWXWYWZW[W\W]W^W_W`WaWbWdWeWfWgWhWiWjWkWlWmWnWoWpWqWrWsWtWuWvWwWxWyW>XcWzW{W|W}W~W!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X2X3XLX4X5X6X7X8X9X:X;XY?Y@YAYBYCYDYEYFYGYHYIYJYKYLYMYNYOYPYQYRYSYTYUYVYWYXYYYZY[Y\Y]Y^Y_Y`YaYbYcYdYeYfYtYgYhYiYjYkYlYmYnYoYpYqYrYsYuYvYwYxYyYzY{Y|Y}Y~Y!Z"Z#Z$Z%Z&Z'Z(Z)Z*Z Z,Z-Z.Z/Z0Z1Z2Z3Z4Z5Z6Zf87Z8Z9Z:Z;ZZ?Z@ZAZBZCZDZEZFZGZHZIZJZKZmZLZMZNZOZPZQZRZSZTZUZVZWZXZYZZZ[Z\Z]Z^Z_Z`ZaZbZcZdZeZfZgZhZiZjZkZlZnZoZpZqZrZsZtZuZvZwZxZyZzZ{Z|Z}Z~Z!["[#[$[%[&['[([)[*[ [,[-[.[/[0[1[2[3[4[5[6[7[8[9[:[;[[?[@[A[B[C[D[E[F[G[H[I[J[K[L[M[N[O[P[Q[R[S[T[U[V[W[X[Y[Z[[[\[][^[_[`[a[b[c[d[e[f[g[h[i[j[k[l[m[n[p[q[r[s[o[t[u[v[w[x[y[z[{[|[}[~[!\"\#\$\%\&\'\(\)\*\ \,\-\.\/\0\1\2\3\4\5\6\7\8\9\:\;\\?\@\A\B\C\D\E\F\G\H\I\J\K\L\M\N\O\P\Q\R\S\T\U\V\W\X\Y\Z\[\\\]\^\_\`\a\b\c\d\e\f\g\h\i\j\k\l\m\n\o\p\q\r\s\t\u\v\w\x\y\z\{\|\}\~\!]"]#]$]%]&]'](])]*] ],]-].]/]0]1]2]3]4]5]6]7]8]9]:];]]?]@]A]B]C]D]E]F]G]H]I]J]K]L]M]N]O]P]Q]R]S]T]U]V]W]X]Y]Z][]\]]]^]_]`]a]b]c]d]e]f]g]h]i]j]k]l]m]n]o]p]q]r]s]t]u]v]w]x]y]z]{]|]}]~]!^"^#^$^%^&^'^(^)^*^ ^,^-^.^/^0^1^2^3^4^5^6^7^8^9^?^:^;^^@^A^B^C^D^E^F^G^H^I^N^J^K^L^M^O^P^Q^R^S^T^U^V^W^X^Y^Z^[^\^]^^^_^`^a^b^c^d^e^f^g^h^i^j^k^l^m^n^o^r^p^q^s^t^u^v^w^x^y^z^{^|^}^~^!_"_#_$_%_&_'_(_)_*_ _,_-_._/_0_2_1_3_4_5_6_7_8_9_:_;_<_>_?_@_A_B_C_D_E_F_G_H_I_J_K_L_M_N_O_P_Q_R_S_T_U_V_W_X_Y_Z_[_\_]_o_^___`_a_b_c_d_e_f_g_h_i_j_k_l_m_n_p_q_r_s_t_u_v_w_x_y_z_{_|_}_~_!`"`#`$`%`&`'`(`)`*` `,`-`.`/`0`1`2`3`4`5`6`7`8`9`:`;``?`@`A`B`C`D`E`F`G`H`I`J`K`L`M`N`O`P`Q`R`S`T`U`V`W`X`Y`Z`[`\`]`d`^`_```a`b`c`e`f`g`h`i`j`k`l`m`n`o`p`q`r`s`t`u`v`w`x`y`z`{`|`}`~`!a"a#a$a%a&a'a(a)a*a a,a-a.a/a0a1a2a3a4a5a6a7a8a9a:a;aa?a@aAaBaCaDaEaFaGaHaIaJaKaLaMaNaOaPaQaRaTaUaVaSaWaXaYaZa[a\a]a^a_a`aaabacadaeafagahaiajakalamanaoapaqarasatauavawaxayaza{a}a~a!b"b#b$b|a-b%b&b'b(b)b*b b,b/b0b1b2b.b3b4b5b6b7b8b9b:b;bb?b@bAbBbCbEbFbDbGbHbIbJbKbLbMbNbObPbQbRbSbTbUbVbWbXbYbZb[b\b]b^b_b`babbbcbdbebfbgbhbibjbkblbmbnbobpbqbrbsbtbubvbwbxbybzb{b|b}b~b!c"c#c$c%c&c'c(c)c*c c,c-c.c/c0c1c2c3c4c5c6c7c8c9c:c;cc?c@cAcBcCcDcEcFcGcHcIcJcKcLcMcNcOcPcQcRcScTcUcVcWcXcYcZc[c\c]c^c_c`cacbcccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczc{c|c}c~c!d"d#d$d%d&d'd(d)d*d d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~d!e"e#e$e%e&e'e(e)e*e e,e-e.e/e0e1e2e3e4e5e;e6e7e8e9e:ee?e@eAeBeCeDeEeFeGeHeIeJeKeLeMeOePeNeQeReSeTeUeVeWeXeYeZe[e\e]e^e_e`eaebecedeeefehegeiejekelemeneoepeqereseteuevewexeyeze|e{e}e~e!f"f#f$f%f&f'f(f)f*f f,f-f.f/f0f1f2f3f4f5f6f7f8f9f:f;ff?f@fAfBfCfDfEfFfGfHfIfJfKfLfMfNfOfPfQfRfSfTfUfVfWfXfYfZf[f\f]f^f_f`fafbfcfdfefffgfhfifjfkflfmfnfofpfqfrfsfufvfwfxfyfzf{f|f}f~f!g"g#g$g%g&g'g(g)g*g g,g-g.g/g0g1g2g3g4g5g6g7g8g9g:g;gg?g@gAgBgCgDgEgFgGgHgIgJgKgLgMgNgOgPgQgRgSgTgUgVgWgXgYgZg[g\g]g^g_g`gagbgcgdgegfgjggghgigkglgmgngogpgqgrgsgtgvgwgxgygugzg{g|g}g(h~g!h"h#h$h%h&h'h)h*h h,h-h.h/h0h1h2h3h4h5h6h7h8h9h:h;hh?h@hAhBhChDhEhFhGhHhIhJhKhLhMhNhOhPhQhRhShThUhVhWhXhYhZh[h\h]h^h_h`hahbhchdhehfhghhhihjhkhlhmhnhohphqhrhshthuhvhwhxhyhzh{h|h}h~h!i"i#i$i%i&i'i(i)i*i i,i-i.i/i0i1i2i3i4i5i6i7i8i9i:i;ii?i@iAiBiCiDiEiFiGiHiIiJiLiMiKiNiOiPiQiRiSiTiUiViWiXiYiZi[i\i]i^i_i`iaibicidieifigihiiijikiliminioipiqirisitiuiviwixiyizi{i|i}i~i!j"j#j$j%j&j'j(j)j*j j,j-j.j/j0j1j2j3j4j5j6j7j8j9j:j;jj?j@jAjBjCjDjEjFjGjHjIjJjKjLjMjNjOjPjQjRjSjTjUjVjWjXjYjZj[j\j]j^j_j`jajbjcjdjejfjgjhjijjjkjljmjnjojpjqjrjsjtjujvjwjxjyjzj{j|j}j~j!k"k#k$k%k&k'k(k)k*k k,k-k.k/k0k1k2k3k4k5k6k7k8k9k:k;kk?k@kAkBkCkDkEkFkGkHkIkPkJkKkLkMkRkNkOkQkSkTkUkVkWkXkYkZk[k\k^k]k_k`kakbkckdkekfkgkhkikjkkkmknkoklkpkqkrksktkvkukwkxkykzk{k|k}k~k!l"l#l$l%l&l'l(l)l*l l,l-l.l/l0l1l2l3l4l5l6l7l8l9l:l;ll?l@lAlBlClDlElFlGlHlIlJlKlLlNlOlMlPlQlRlSlTlUlVlWlXlYlZl[l\l]l^l_l`lalblcldlelflglhliljlklllmlnlolplqlrlsltlulvlwlxlylzl{l|l}l~l!m"m#m$m%m&m'm(m)m*m m,m-m.m/m0m1m2m3m4m5m6m7m8m9m:m;mm?m@mAmBmCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWmXmYmZm[m\m]m^m_m`mambmcm7"
B"p"C"m"l"n"4"1"k"D""*!*$***#*)*!).*2*1*4*3*@*?*B*A*P*R*Q*T*X*S*,)c*b*e*d*r*0)N)" ! $ * # ) A). 2 1 4 3 @ ? B A C)P R Q T X S L)c b e d r P)s '*' %*% (*( * ,*, /*/ -*- 0*0 ")B)7*7 6*6 8*8 5*5 :*: ;*; =*= *> $)D)G*G E*E F*F D*E)&)F)H*H I*I G)J*J L*L K*K ))I)()H)M*M O*O N*N J) )K)W*W V*V -)M)Y*Y [*[ Z*Z \*\ ]*] _*_ ^*^ a*a `*` /)O)l*l i*i f*f k*k h*h j*j q*q t*t s*u*u w*w v*v &*& C*C U*U g*g p*p m*m o*o n*n 9 0"/"2"6"5"3"8"9"a&b&c&d&g&i&l&v&e&j&q&r&s&t&{&x&u&z&w&y&|&B'C'D'E'F'G'H'I'J'K'L'M'N'r's't'u'v'w'x'y'z'{'|'}'~'q"o"!0"0#0$0%0&0'0(0)0*0 0,0-0.0/000102030405060708090:0;00?0@0A0B0C0D0E0F0G0H0I0J0K0L0M0N0O0P0Q0R0S0T0U0V0W0X0Y0Z0[0\0]0^0`0a0b0c0d0e0f0g0h0i0j0k0l0m0n0o0p0_0q0r0s0t0u0v0w0x0y0z0{0|0}0~0!1"1#1$1%1&1'1(1)1*1 1,1-1.1/101112131415161718191:1;11?1@1A1B1C1D1E1F1G1H1I1J1K1L1M1N1O1P1Q1R1S1T1U1V1W1X1Y1Z1[1\1]1^1v1_1`1a1b1c1d1e1f1g1h1i1j1k1l1m1n1o1p1q1r1s1t1u1w1x1y1z1{1|1}1~1!2"2#2$2%2&2'2(2)2*2 2,2-2.2/202122232425262728292:2;22?2@2A2B2C2D2E2Q2F2G2H2I2J2K2L2M2N2O2P2R2S2T2U2V2W2X2Y2Z2[2\2]2^2_2`2a2b2c2d2e2f2g2h2i2j2k2l2m2n2o2p2q2r2s2t2u2v2w2x2y2z2{2|2}2~2!3"3#3$3%3&3'3(3)3*3 3,3-3.3/303132333435363738393:3;33?3@3A3B3C3D3E3F3G3H3I3J3K3L3M3N3O3P3Q3R3S3T3U3V3W3X3Y3Z3[3\3]3^3_3`3a3b3c3d3e3f3g3h3i3j3k3l3m3n3o3p3q3r3s3t3u3v3w3x3y3z3{3|3}3~3!4"4#4$4%4&4'4(4)4*4 4,4-4.4/404142434445464847494:4;44?4@4A4B4C4D4E4F4G4H4I4J4K4L4M4N4O4P4Q4R4S4T4U4V4W4X4Y4Z4[4\4]4^4_4`4a4b4c4d4e4f4g4h4i4j4k4l4m4n4o4p4q4r4s4t4u4v4w4x4y4z4{4|4}4~4!5"5#5$5%5&5'5(5)5*5 5,5-5.5/505152535455565758595:5;55?5@5A5B5C5D5E5F5G5H5I5J5K5L5M5N5O5P5Q5R5S5T5U5V5W5X5Y5Z5[5\5]5^5_5`5a5b5c5d5e5f5g5h5i5j5k5l5m5n5o5p5q5r5s5t5u5v5w5x5y5z5{5|5}5~5!6"6#6$6%6&6'6(6)6*6 6,6-6.6/606162636465666768696:6;66?6@6A6B6C6D6E6F6G6H6I6J6K6L6M6N6O6P6Q6R6S6T6U6V6W6X6Y6Z6[6\6]6^6_6`6a6b6c6d6e6f6g6h6i6j6k6l6m6p6q6n6o6r6s6t6u6v6w6x6y6z6{6}6~6|6!7"7#7$7%7&7'7(7)7*7 7,7-7.7/707172737475767778797:7;77?7@7A7B7C7D7E7F7G7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V7W7`7X7Y7Z7[7\7]7^7_7a7b7c7d7e7f7g7h7i7j7k7l7m7~7n7o7p7q7r7s7t7u7v7w7x7y7z7{7|7}7!8"8#8$8%8&8'8(8)8*8 8,8-8.8/808182838485868788898:8;88?8@8A8B8C8D8E8F8G8H8I8J8K8L8M8N8P8Q8O8R8S8T8U8V8W8X8Y8Z8[8\8]8^8_8`8a8b8c8d8e8g8h8i8j8k8l8m8n8o8p8q8r8s8t8u8v8w8x8y8z8{8|8}8~8!9"9#9$9%9&9'9(9)9*9 9,9-9.9/909192939495969798999:9;99?9@9A9B9C9D9E9F9G9H9I9J9K9L9M9N9O9P9Q9R9S9T9U9V9W9X9Y9Z9[9\9]9^9_9`9a9b9c9d9e9f9g9h9i9j9k9l9m9n9o9p9q9r9s9t9u9v9w9x9y9z9{9|9}9~9!:":#:$:%:&:':(:):*: :,:-:.:/:0:1:3:4:5:6:7:8:2:9:::;:<:>:?:@:A:B:C:D:E:F:G:H:I:J:K:L:M:N:O:P:Q:R:S:T:U:V:W:X:Y:Z:[:\:]:^:_:`:a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:w:x:y:z:{:|:}:~:!;";#;$;%;&;';(;);*; ;,;-;.;/;0;1;2;3;4;5;6;7;8;9;:;;;=;;?;@;A;B;C;D;E;G;H;I;J;F;K;L;M;N;O;P;Q;R;S;W;U;T;V;X;Y;Z;[;\;];^;_;`;a;b;c;d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;tfs;t;u;v;w;x;z;y;{;|;};~;!=?=@=A=B=C=D=E=F=G=H=I=J=K=L=M=N=O=P=Q=R=S=T=U=V=W=X=Y=Z=[=\=]=^=_=`=a=b=c=d=e=f=g=h=i=j=k=l=m=n=o=p=q=r=s=t=u=v=w=x=y=z={=|=}=~=!>">#>$>%>&>'>(>)>*> >,>->.>/>0>1>2>3>4>5>6>7>8>9>:>;>=>>>?>@>A>B>C>D>E>F>G>H>I>J>K>L>M>N>O>P>Q>R>S>T>U>V>W>X>Y>Z>[>\>]>^>_>`>a>b>c>d>e>f>g>h>i>j>k>l>m>n>o>p>q>r>s>t>u>v>w>x>y>z>{>~>|>}>!?"?#?$?%?&?'?(?)?*? ?,?-?.?/?0?1?2?3?4?5?6?7?8?9?:?;?=?>???@?A?B?C?D?E?F?G?H?I?J?K?L?M?N?O?P?Q?R?S?T?U?V?W?X?Y?Z?[?\?]?^?_?`?a?b?c?d?e?f?g?h?i?j?k?l?m?n?o?p?q?r?s?t?u?v?w?x?y?z?{?|?}?~?!@"@#@$@%@&@'@(@)@*@ @,@-@.@/@0@1@2@3@4@5@6@7@8@9@:@;@@?@@@A@B@C@D@E@F@G@H@I@J@K@L@M@N@O@P@Q@R@S@T@U@V@W@X@Y@Z@[@\@]@^@_@`@a@b@c@d@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@{@|@}@~@!A"A#A$A%A&A'A(A)A*A A,A-A.A/A0A1A2A3A4A5A6A7A8A9A:A;AA?A@AAABACADAEAFAGAHAIAJAKALAMANAOAPAQARASATAUAVAWAXAYAZA[A\A]A^A_A`AaAbAcAdAeAfAgAhAiAjAkAlAmAnAoApAqArAsAtAuAvAwAxAyAzA{A|A}A~A!B"B#B$B%B&B'B(B)B*B B,B-B.B0B/B1B2B3B4B5B7B6B8B9B:B;BB@BABBBDBEBGBHBIBJBLBCBFBKBMBNBOBPBQBRBSBTBUBVBWBXBYBZB[B\B]B^B_B`BaBbBcBdBeBfBgBhBiBjBkBlBmB?BnBoBpBqBrBsBtBuBvBwBxByBzB{B|B}B~B!C"C#C$C%C&C'C(C)C*C C,C-C.C/C0C1C2C3C4C5C6C7C9C:C;CC?C@CACBCCCDCECFCGCHC8CJCKCLCMCOCNCPCQCRCSCTCUCVCWCXCYCZC[CIC\C]C^C_C`CaCbCcCdCeCfCgChCiCjCkClCmCnCoCpCqCrCsCtCuCvCwCxCyCzC{C|C}C~C!D"D#D$D%D&D'D(D)D*D D,D-D.D/D0D1D2D3D4D5D6D7D8D9D:D;DD?D@DADBDCDDDEDFDGDHDIDJDKDLDMDNDODPDQDRDSDTDUDVDWDXDYDZD[D\D]D^D_D`DaDbDcDdDeDfDgDhDiDjDkDlDmDnDoDpDqDrDsDtDuDvDwDxDyDzD{D|D}D~D!E"E#E$E%E&E'E(E)E*E E,E-E.E/E0E1E2E3E4E5E6E7E8E9E:E;EE?E@EAEBECEDEEEFEGEHEIEJEKEMELENEOEPEQERESETEUEVEWEXEYEZE[E\E]E^E_E`EaEbEcEdEeEfEgEhEiEjEkElEmEnEoEpEqErEsEtEuEvEwExEyEzE{E|E}E~E!F"F#F$F%F&F'F(F)F*F F,F-F.F/F0F1F2F3F4F5F6F7F8F9F:F;FF?F@FAFBFCFDFEFFFGFHFIFJFKFLFMFNFOFPFQFRFSFTFUFVFWFXFYFZF[F\F]F^F_F`F6GaFbFcFdFeFfFgFhFiFjFkFlFmFnFoFpFqFrFsFtFuFvFwFxFyFzF{F|F}F~F!G"G#G$G%G&G'G(G)G*G G,G-G.G/G0G1G2G3G4G5G7G8G9G:G;GG?G@GAGBGCGDGEGFGGGHGIGJGKGLGMGNGOGPGQGRGSGTGUGVGWGXGYGZG[G\G]G^G_G`GaGbGcGdGeGfGgGhGiGjGkGlGmGnGoGpGqGrGsGtGuGvGwGxGyGzG{G|G}G~G!H"H#H$H%H&H'H(H)H*H H,H-H.H/H0H1H2H3H4H5H6H7H8H9H:H;HH?H@HAHBHCHDHEHFHGHHHIHJHKHLHSHMHNHOHPHQHRHTHUHVHWHXHYHZH[H\H]H^H_H`HaHbHcHdHeHfHgHhHiHjHkHlHmHnHoHpHqHrHsHtHuHvHwHxHyHzH{H|H}H~H!I"I#I$I%I&I'I(I)I*I I,I-I.I/I0I1I2I3I4I5I6I7I8I9I:I;II?I@IBICIDIEIFIGIHIIIJIKILIMINIOIPIQIRISITIUIVIWIXIYIZI[I\I]I^I_I`IaIbIcIdIeIfIgIhIiIjIkIlImInIoIpIqIrIsItIuIvIwIxIyIzI{I|I}I~I!J"J#J$J%J&J'J(J)J*J J,J-J.J/J0J1J2J3J4J5J6J7J8J9J:J;JJ?J@JAJBJCJDJEJFJGJHJIJJJKJLJMJNJOJPJQJRJSJTJUJVJWJXJYJZJ[J\J]J^J_J`JaJbJcJdJeJfJgJhJiJjJkJlJmJnJoJpJqJrJsJtJuJvJwJxJyJzJ{J|J}J~J!K"K#K$K%K&K'K(K)K*K K,K-K.K/K0K1K2K3K4K5K6K7K8K9K:K;KK?K@KAKBKCKDKEKFKGKHKIKJKKKLKMKNKOKPKQKRKSKTKUKVKWKXKYKZK[K\K]K^K_K`KaKbKcKdKeKfKgKhKiKjKkKlKmKnKoKpKqKrKsKtKuKvKwKxKyKzK{K|K}K~K!L"L#L$L%L&L'L(L)L*L L,L-L.L/L0L1L2L3L4L5L6L7L8L9L:L;LL?L@LALBLCLDLELFLGLHLILJLKLLLMLNLOLPLQLRLSLTLULVLWLXLYLZL[L\L]L^L_L`LaLbLcLdLeLfLgLhLiLjLkLlLmLnLoLpLqLrLsLtLuLvLwLxLyLzL{L|L}L~L!M"M#M$M%M&M'M(M)M*M M,M-M.M/M0M1M2M3M4M5M6M7M8M9M:M;MM?M@MAMBMCMDMEMFMGMHMIMJMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYMZM[M\M]M^M_M`MaMbMcMdMeMfMgMhMiMjMkMlMmMnMoMpMqMrMsMtMuMvMwMxMyMzM{M|M}M~M!N"N$N%N&N'N(N)N#N*N N,N-N.N/N0N1N2N3N4N5N6N7N8N9N:N;NN?N@NANBNCNDNENFNGNHNINJNKNLNMNNNONPNQNRNSNTNUNVNWNXNYNZN[N\N]N^N_N`NaNbNcNdNeNfNgNhNiNjNkNlNmNnNoNpNqNrNsNtNuNvNwNxNyNzN{N|N}N~N!O"O#O$O%O&O'O(O)O*O O,O-O.O/O0O1O2O3O4O5O6O7O8O9O:O;OO?O@OAOBOCODOEOFOGOHOIOJOKOLOMONOOOPOQOROSOTOUOVOWOXOYOZO[O\O]O^O_O`OaObOcOdOeOfOgOhOiOjOkOlOmOnOoOpOqOrOtOuOvOsOwOxOyOzO{O|O}O~O!P"P#P$P%P&P'P(P)P*P P,P.P/P0P1P-P2P3P4P5P7P8P9P:P;P6P
P?P@PAPBPCPDPEPFPGPHPIPJPKPLPMPNPOPPPQPRPSPTPUPVPWPXPYPZP[P\P]P^P_P`PaPbPcPdPePfPgPhPiPjPkPlPmPnPoPpPqPrPsPtPuPvPwPxPyPzP{P|P}P~P!Q"Q#Q$Q%Q&Q'Q(Q)Q*Q Q,Q-Q.Q/Q0Q1Q2Q3Q4Q5Q6Q7Q8Q9Q:Q;QQ?Q@QAQBQCQDQEQFQGQHQIQJQKQLQMQNQOQPQQQRQSQTQUQVQWQXQYQZQ[Q\Q]Q^Q_Q`QaQbQcQdQeQfQgQhQiQjQkQlQmQnQoQpQqQrQsQtQuQvQwQxQyQzQ{Q|Q}Q~Q!R"R#R$R%R&R'R(R)R*R R,R-R.R/R0R1R2R3R4R5R6R7R8R9R:R;RR?R@RARBRCRDRERFRGRHRIRJRKRLRMRNRORPRQRRRSRTRURVRWRXRYRZR[R\R]R^R_R`RaRbRcRdReRfRgRhRiRjRkRlRmRnRoRpRqRrRsRtRvRwRxRuRyRzR{R|R}R~R!S"S#S$S%S&S'S(S)S*S S,S-S.S/S0S1S2S3S4S5S6S7S8S9S:S;SS?S@SASBSCSDSESFSGSHSISJSKSLSMSNSOSPSQSRSSSTSUSVSWSXSYSZS[S\S]S^S_S`SaSbScSdSeSfSgShSiSjSkSlSmSnSoSpSqSrSsStSuSvSwSxSySzS{S|S}S~S!T"T#T$T%T&T'T(T)T*T T,T-T.T/T0T1T2T4T5T6T7T8T9T:T;TT3T?T@TATBTCTDTETFTGTHTITJTKTLTMTNTOTPTQTRTSTTTUTVTWTXTYTZT[T\T]T^T_T`TaTbTcTdTeTfTgThTiTjTlTkTmTnToTpTqTrTsTtTuTvTwTxTyTzT{T|T}T~T!U"U#U$U%U&U'U(U)U*U U,U-U.U/U0U1U2U3U4U5U6U7U8U9U:U;UU?U@UAUBUCUDUEUFUGUHUIUJUKULUMUNUOUPUQURUSUTUUUVUWUXUYUZU[U\U]U^U_U`UaUbUcUdUeUfUgUhUiUjUkUlUmUnUoUpUqUrUsUtUuUvUwUxUyUzU{U|U}U~U!V"V#V$V%V&V'V(V)V*V V,V-V.V/V0V1V2V3V4V5V6V7V8V9V:V;VV?V@VAVBVCVDVEVGVHVIVJVKVFVLVMVNVOVPVQVRVSVTVVVWVXVUVYVZV[V\V]V^V_V`VaVbVcVdVeVfVgVhViVjVkVlVmVnVoVpVqVrVsVtVuVvVwVxVyVzV{V|V}V~V!W"W#W$W%W&W'W(W)W*W W,W-W.W/W0W1W2W3W4W5W6W7W8W9W:W;WW?W@WAWBWCWDWEWFWGWHWIWJWKWLWMWNWOWPWQWRWSWTWUWVWWWXWYWZW[W\W]W^W_W`WaWbWdWeWfWgWhWiWjWkWlWmWnWoWpWqWrWsWtWuWvWwWxWyW>XcWzW{W|W}W~W!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X2X3XLX4X5X6X7X8X9X:X;XY?Y@YAYBYCYDYEYFYGYHYIYJYKYLYMYNYOYPYQYRYSYTYUYVYWYXYYYZY[Y\Y]Y^Y_Y`YaYbYcYdYeYfYtYgYhYiYjYkYlYmYnYoYpYqYrYsYuYvYwYxYyYzY{Y|Y}Y~Y!Z"Z#Z$Z%Z&Z'Z(Z)Z*Z Z,Z-Z.Z/Z0Z1Z2Z3Z4Z5Z6Zf87Z8Z9Z:Z;ZZ?Z@ZAZBZCZDZEZFZGZHZIZJZKZmZLZMZNZOZPZQZRZSZTZUZVZWZXZYZZZ[Z\Z]Z^Z_Z`ZaZbZcZdZeZfZgZhZiZjZkZlZnZoZpZqZrZsZtZuZvZwZxZyZzZ{Z|Z}Z~Z!["[#[$[%[&['[([)[*[ [,[-[.[/[0[1[2[3[4[5[6[7[8[9[:[;[[?[@[A[B[C[D[E[F[G[H[I[J[K[L[M[N[O[P[Q[R[S[T[U[V[W[X[Y[Z[[[\[][^[_[`[a[b[c[d[e[f[g[h[i[j[k[l[m[n[p[q[r[s[o[t[u[v[w[x[y[z[{[|[}[~[!\"\#\$\%\&\'\(\)\*\ \,\-\.\/\0\1\2\3\4\5\6\7\8\9\:\;\\?\@\A\B\C\D\E\F\G\H\I\J\K\L\M\N\O\P\Q\R\S\T\U\V\W\X\Y\Z\[\\\]\^\_\`\a\b\c\d\e\f\g\h\i\j\k\l\m\n\o\p\q\r\s\t\u\v\w\x\y\z\{\|\}\~\!]"]#]$]%]&]'](])]*] ],]-].]/]0]1]2]3]4]5]6]7]8]9]:];]]?]@]A]B]C]D]E]F]G]H]I]J]K]L]M]N]O]P]Q]R]S]T]U]V]W]X]Y]Z][]\]]]^]_]`]a]b]c]d]e]f]g]h]i]j]k]l]m]n]o]p]q]r]s]t]u]v]w]x]y]z]{]|]}]~]!^"^#^$^%^&^'^(^)^*^ ^,^-^.^/^0^1^2^3^4^5^6^7^8^9^?^:^;^^@^A^B^C^D^E^F^G^H^I^N^J^K^L^M^O^P^Q^R^S^T^U^V^W^X^Y^Z^[^\^]^^^_^`^a^b^c^d^e^f^g^h^i^j^k^l^m^n^o^r^p^q^s^t^u^v^w^x^y^z^{^|^}^~^!_"_#_$_%_&_'_(_)_*_ _,_-_._/_0_2_1_3_4_5_6_7_8_9_:_;_<_>_?_@_A_B_C_D_E_F_G_H_I_J_K_L_M_N_O_P_Q_R_S_T_U_V_W_X_Y_Z_[_\_]_o_^___`_a_b_c_d_e_f_g_h_i_j_k_l_m_n_p_q_r_s_t_u_v_w_x_y_z_{_|_}_~_!`"`#`$`%`&`'`(`)`*` `,`-`.`/`0`1`2`3`4`5`6`7`8`9`:`;``?`@`A`B`C`D`E`F`G`H`I`J`K`L`M`N`O`P`Q`R`S`T`U`V`W`X`Y`Z`[`\`]`d`^`_```a`b`c`e`f`g`h`i`j`k`l`m`n`o`p`q`r`s`t`u`v`w`x`y`z`{`|`}`~`!a"a#a$a%a&a'a(a)a*a a,a-a.a/a0a1a2a3a4a5a6a7a8a9a:a;aa?a@aAaBaCaDaEaFaGaHaIaJaKaLaMaNaOaPaQaRaTaUaVaSaWaXaYaZa[a\a]a^a_a`aaabacadaeafagahaiajakalamanaoapaqarasatauavawaxayaza{a}a~a!b"b#b$b|a-b%b&b'b(b)b*b b,b/b0b1b2b.b3b4b5b6b7b8b9b:b;bb?b@bAbBbCbEbFbDbGbHbIbJbKbLbMbNbObPbQbRbSbTbUbVbWbXbYbZb[b\b]b^b_b`babbbcbdbebfbgbhbibjbkblbmbnbobpbqbrbsbtbubvbwbxbybzb{b|b}b~b!c"c#c$c%c&c'c(c)c*c c,c-c.c/c0c1c2c3c4c5c6c7c8c9c:c;cc?c@cAcBcCcDcEcFcGcHcIcJcKcLcMcNcOcPcQcRcScTcUcVcWcXcYcZc[c\c]c^c_c`cacbcccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczc{c|c}c~c!d"d#d$d%d&d'd(d)d*d d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~d!e"e#e$e%e&e'e(e)e*e e,e-e.e/e0e1e2e3e4e5e;e6e7e8e9e:ee?e@eAeBeCeDeEeFeGeHeIeJeKeLeMeOePeNeQeReSeTeUeVeWeXeYeZe[e\e]e^e_e`eaebecedeeefehegeiejekelemeneoepeqereseteuevewexeyeze|e{e}e~e!f"f#f$f%f&f'f(f)f*f f,f-f.f/f0f1f2f3f4f5f6f7f8f9f:f;ff?f@fAfBfCfDfEfFfGfHfIfJfKfLfMfNfOfPfQfRfSfTfUfVfWfXfYfZf[f\f]f^f_f`fafbfcfdfefffgfhfifjfkflfmfnfofpfqfrfsfufvfwfxfyfzf{f|f}f~f!g"g#g$g%g&g'g(g)g*g g,g-g.g/g0g1g2g3g4g5g6g7g8g9g:g;gg?g@gAgBgCgDgEgFgGgHgIgJgKgLgMgNgOgPgQgRgSgTgUgVgWgXgYgZg[g\g]g^g_g`gagbgcgdgegfgjggghgigkglgmgngogpgqgrgsgtgvgwgxgygugzg{g|g}g(h~g!h"h#h$h%h&h'h)h*h h,h-h.h/h0h1h2h3h4h5h6h7h8h9h:h;hh?h@hAhBhChDhEhFhGhHhIhJhKhLhMhNhOhPhQhRhShThUhVhWhXhYhZh[h\h]h^h_h`hahbhchdhehfhghhhihjhkhlhmhnhohphqhrhshthuhvhwhxhyhzh{h|h}h~h!i"i#i$i%i&i'i(i)i*i i,i-i.i/i0i1i2i3i4i5i6i7i8i9i:i;ii?i@iAiBiCiDiEiFiGiHiIiJiLiMiKiNiOiPiQiRiSiTiUiViWiXiYiZi[i\i]i^i_i`iaibicidieifigihiiijikiliminioipiqirisitiuiviwixiyizi{i|i}i~i!j"j#j$j%j&j'j(j)j*j j,j-j.j/j0j1j2j3j4j5j6j7j8j9j:j;jj?j@jAjBjCjDjEjFjGjHjIjJjKjLjMjNjOjPjQjRjSjTjUjVjWjXjYjZj[j\j]j^j_j`jajbjcjdjejfjgjhjijjjkjljmjnjojpjqjrjsjtjujvjwjxjyjzj{j|j}j~j!k"k#k$k%k&k'k(k)k*k k,k-k.k/k0k1k2k3k4k5k6k7k8k9k:k;kk?k@kAkBkCkDkEkFkGkHkIkPkJkKkLkMkRkNkOkQkSkTkUkVkWkXkYkZk[k\k^k]k_k`kakbkckdkekfkgkhkikjkkkmknkoklkpkqkrksktkvkukwkxkykzk{k|k}k~k!l"l#l$l%l&l'l(l)l*l l,l-l.l/l0l1l2l3l4l5l6l7l8l9l:l;ll?l@lAlBlClDlElFlGlHlIlJlKlLlNlOlMlPlQlRlSlTlUlVlWlXlYlZl[l\l]l^l_l`lalblcldlelflglhliljlklllmlnlolplqlrlsltlulvlwlxlylzl{l|l}l~l!m"m#m$m%m&m'm(m)m*m m,m-m.m/m0m1m2m3m4m5m6m7m8m9m:m;mm?m@mAmBmCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWmXmYmZm[m\m]m^m_m`mambmcm7"
2!2"2#2$2%2&2'2(2)2
2!2"2#2$2%2&2'2(2)2
1 1!1"1#1$1%1&1'1(1)1
1 1!1"1#1$1%1&1'1(1)1
% %!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%
% %!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%
W%f?i
W%f?i
e.lFO
e.lFO
urlsS
urlsS
u%urrGS
u%urrGS
]']&].]$]
]']&].]$]
s"s9s%s,s8s1sPsMsWs`slsos~s
s"s9s%s,s8s1sPsMsWs`slsos~s
x
x
{.{1{ {%{${3{>{
{.{1{ {%{${3{>{
h!l!'!c!@!A!$("(((&(:(,(*(0(.(B!4(2(9(!(%('()(-(1(#( (/(3(5(6(7(8(&!%!!&"&$&%&&&'&(&)&*& &,&-&.&/&0&1&2&3&4&5&6&7&8&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&''!'"'#'$'%'&'(')'*' ','-'.'/'0'1'2'3'4'5'6'7'8'9':';''?'@'A'Q'R'S'T'U'V'X'Y'Z'['\']'^'_'`'a'b'c'd'e'f'g'h'i'j'k'l'm'n'o'p'q'W'*!,!.!/!0!1!-!k!d!e!y!f!m!q"r"s"t"u"v"w"x"y"z"{"|"{!|!z!}!J!G!F!L!X!^!O!N!D!E!I!H!R!S!`!_!C!K!W!V!U!Y!T!\!]!Z![!Q!M!P!Y"Z"["\"]"^"_"`"a"b"E"F"G"H"I"J"K"L"M"N"O"P"Q"R"S"T"U"V"W"X"1"2"3"4"5"6"7"8"9":";""?"@"A"B"C"D"$)%)&)')()))*) ),)-).)/)0)1)2)3)4)5)6)7)8)9):);))?)@)A)B)C)D)E)F)G)H)I)J)K)L)M)N)O)P)Q)R)S)T)U)V)W)X)Y)Z)[)\)])^)_)`)a)b)c)d)e)f)g)h)i)j)k)l)m)n)o)v!u!x!w!t!s!p!r!q!o!n!b!a!!!"!#!(!)!4!5!6!7!8!9!:!;!>!?!~!2!3!$?$@$A$B$C$D$E$F$G$H$I$J$K$L$M$N$O$P$Q$R$S$T$U$V$W$X$Y$Z$[$\$]$^$_$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%$!E(F(G(H(I(J(K(L(M(N(O(P(Q(R(S(T(U(V(W(X(Y(Z([(\(](^(_(`(a(b(c(d(e(f(g(h(i(e"f"g"h"i"j"k"l"m"n";R!6_FrMIU}HOIBO"X;2kS$Xs3(WRG'X@JpG{15RT4 6?K)X*6=AOQ%I-Xv8>Q\cPVa7.4YA/XKDC>1X4CeR.VZN'Uu:&7V@9FREGGT9K3RR?XE>rF2R0OgOiJ@XrBRBiH,GKAhSyUBJ~6!XZSw?FT%;AXeN.>(XGQ)P=XoYvM:?;=%:`Rz2`:6DmO)>$MAAWGqYtYKHiXZR2JJHlXjXFXv=MFp3kXq=i=THS4XBV2PWKJ{KLU68IOZYpX*GnXz4nATRmXGRoXGCvQYVrXuX~=Y:Y30BYDY61?Y95s>HLr:PRCYh= 3EYk>FY;Y_D>YAY@Y.U5VcGHYYkH HK0 9yAbYd5HWxQf)EZ9#Z)T$Z{Y,6k7y1|Ye3v>v?1Rd@36~Y}Y;>`FF-?K;J5I[WP9MkPAuArTU844u3>IPEYE{@p1YXN9=5ZXFV"K/H2IL4L?t9[X\Xg6A#Jt[?[x@">M@@[FJ*2BScC QB[U@C[1?6PaZdG'3r6|Lz@w@9QaQGX^2e@q:HX-TaOIXJXCOx3G>KXL[%HXO~HN2VSf20mA6_5_;VP=YUH0#6I?(L3_7JRSOX6RE:>K>L7_p54_uST3w8:_O:*_ALMwRM7A_D_q7I0V6T7,:}LT?1KtF(VE_bN33|N54GNp:aN=Q@_t4J3f8;_ED<_>_;E?_B_1TC_:GXNXDJ_O_\VI_Z_6NG:N_H_^EkIt:|CW>F_M_XE&UM:L>=S@8dVG_>9'?|AK_L_P_[_e_W_V_IWc_d_ke'RR_)?[TH?T_LO]_JQ^_'07FS_e:_6[M~9UT__lO%0g_Q_FQU_X_Y_\_);`_a_b_f_h_4Sg86Ej_ZI(ADD^?xO\Un_82_:l_A[dQtK=4&0q_FLr_m_i_k_o_p_=;s_t_#;[J(N'`*3&`!`~_YM|_z_P?DWLIx_!0}_{_"`(`H7!F6I2@u_>EDXy_vD#`$`%`%P4`dL1`&?/`9N `FI.@.`m:0:)`v_3`8`-49`2OH:0`zP,`{Tw_gE-`wS6`7`D`aP`*`$IA`2`HJC`5`KNCKM`F`B`K`:`?`@`E`G`H`L`;`TKU`V`R`P`N;7P[.L2?5;xWS?i?a{J-\JI9D=G.\vTfP DU6T[Z1U[V[>:@H?JIH3WyIG?x:8hBQH{eJ6KoI7fp6dCiS4f5f"H=f9fEFqM;ff:f7@$S?ftICfDfvP=CDCBfAfGf1OtkJfEf^eg4T6BK0QNpW!PYI{6Xfb3PIYf"3L^HSM^"RN^M>O^,J|R_3jeaD!>2NrDV>(Fc2S>|GkLl=]N:JAFlea@aAaGag3iF^4BQHaFaEaCaBa@18UDaKaLaJazoSaRa6GIaNaPaTaQaMaOaUaVaWaXaZa[a!N]g(4]V2Q23$9sWIG^>.9WNn2O[:}4_a\:`a2;IBaalP=MbaC5GEcadaySea-Qfa"NgaB5haU;DP`bX1dRabIV|M&CCcRVgbhbGSlbl?mbeb@3nDnbCPv:ib^73;,LKKdbfbjbkbwbtbuTsb-EzUBE@2obrb/AoMs;hL/c1c'O.c)N];k5e>R2M391 cQ2,5_9h6kO7cL;GHJP8cn3)mzSdS*m9cbR5c^SP83c6c_74c"@:c8TH4;cE;wIeI=D m}B[;.??Nc-m?c):,m=c@c6:.68PC0.m/mA@Ac3EBc2\0mj8lN'jgPyJVH7OI3RNd=^cr;(j=U]F)j*j,j j.j-jX=/j>BA4w4';flel?7yKb1glHIhlilVJP^E2zTKFG0r4SHPM8?[?$G4V)@Q^(IoQ$Eg063EHb0v7zEs6RUP3Q0VRcJ%W6M669?[U'8WER^Y?UB@G$;(1jE{E'L'1V5(DS^:Qi3rCw7tV#5p24DiD-@T^h0DE`AU9\>XMN0OMV^P>>WU^PU]0bD#Bp62L@pKq_^74]=`^mDFO`5^6ZJt5e^FUa^ML~FEE4Rr>SB=L83S=X?FMZQk4d^]^g^~j0Bb^@V'5t2h^r^m^q^`HaWo^hCaLe2>Rn^k^UN'4 ?>>R=i^.T^^j^?@l^s2i8'BA=u^x^ 2$4j4&Iv^QKc8w^z^y^BLa0n4:e/Pk2!kt^cIs^Z0!Rw1/Lp^$K*U{^]4&D}^~C!D!_LA|^o>2FE3vH:K~^$_2W73CAKG%2i4 WlD"_#_%_3:&_^@CIY2fG'_\G(_"kSK*_)_A2JE _\TAH,_p>-_'V7j6kUJ|XD8ž7~UJ9'PMtP5tCH>7k=0L=2AV1(3R8"IX68k4>}JCG{Us7DN Us13l_05l76OAzu1PeUSNo=b3 86U=mO69KBP=76l)JTE9l8lCB7l}P:l;leWj%@;j}2wCh;WRtN?j<4acrwqugjejdjgjfjgvtokjn>&k&dsQ&b&h&K&&F&q&&niCr3
- &PJ1HsOsQ5WsRsTsSs&t&&Q5&j53&u&TTM1Q&w&&
&&&&&&&&&&&&&&&&&&&&&&&&&&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&&&&&<_>&UM:L&&&&CCcRVgbhbGSlbl&Iv&D&_<4acrwqugjejdjgjfjgvtokjn>&k&dsQ&b&h&K&&F&q&&niCr3
- &PJ1HsOsQ5WsRsTsSs&t&&Q5&j53&u&TTM1Q&w&&
&&&&&&&
&&&&&&&
&U
&U
&X
&X
&e
&e
&
&
&t&ukuju
&t&ukuju
&h
&h
&&
&&
&
&
&u
&u
&_
&_
&&a&e&g&c&
&&a&e&g&c&
&
&
&&&&&&&&&H&G&&&B&A&&&&F&E&&&D&C&&&&M&N&&O&P&&&Q&R&&&S&T&&&U&V&:&&W&X&&&Y&Z&&&&&&&_&&a&b&c&d&&F&&&&s&axN0&&J&S5&m.mmp&wI&Y&TM&&u&V&y&j&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&
&&&&&&&&&H&G&&&B&A&&&&F&E&&&D&C&&&&M&N&&O&P&&&Q&R&&&S&T&&&U&V&:&&W&X&&&Y&Z&&&&&&&_&&a&b&c&d&&F&&&&s&axN0&&J&S5&m.mmp&wI&Y&TM&&u&V&y&j&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&
&t
&t
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&:&&
&:&&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&y1
&y1