Trojan.Generic.12105354_aafc24018e – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Generic.12105354 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, mzpefinder_pcap_file.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: aafc24018e398bd61bd9c857639dbd13

SHA1: 81b1389cd9eda9b3aa85af67ebb5e4bc79da3d63

SHA256: da4a998efc8de9e1b19116f7f30b07b74ca655c58bd2f436a64a3b3aa55d23cf

SSDeep: 49152:j1qCLVxwZt7y s8KuqGaX0ToIBAUZLYVnCf2E3:jPwZxxJBAUZLD

Size: 2150400 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2014-04-23 17:54:16

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

KINSTALLERS_66_109992.exe:2028

The Trojan injects its code into the following process(es):

%original file name%.exe:176

Mutexes

The following mutexes were created/opened:

c:!documents and settings!adm!local settings!history!history.ie5!mshist012014120820141209!_!SHMSFTHISTORY!___DDrawCheckExclMode____DDrawExclMode__DDrawWindowListMutexDDrawDriverObjectListMutexCTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex

File activity

The process KINSTALLERS_66_109992.exe:2028 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\kingsoftkonline\KINSTALLERS_66_109992.exe.tmp (230271 bytes)

The process %original file name%.exe:176 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ptui_ver[2].js (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login[1].htm (1302 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KINSTALLERS_66_109992.exe (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\21[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\login[1].htm (1511 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\index[1].htm (562 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c_icon_2[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\login[1] (1282 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\clearcache[1].html (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\big_8[1].png (1113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qqtubiaoad[1].htm (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@heima8[1].txt (626 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ptqrshow[1].png (433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@heima8[2].txt (303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ptui_ver[1].js (175 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\clearcache[1].htm (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.cx90[1].txt (182 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.cx90[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\load[1].gif (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\h_login_17[1].js (2701 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ui.ptlogin2.qq[1].txt (181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\468X60_54502[1].jpg (13245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login[1] (2818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qqtbset.ini (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ptui_ver[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@heima8[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\login[1] (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\clearcache[1].html (0 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.aaa[1].xml (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@heima8[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)

Registry activity

The process KINSTALLERS_66_109992.exe:2028 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 69 27 47 1F 9D DC 47 90 2F EE 7D 5F EC DA A9"

The process %original file name%.exe:176 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014120820141209]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014120820141209]
"CachePrefix" = ":2014120820141209:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014120820141209]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014120820141209\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1024x768x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014120820141209]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1398264856"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 5F C3 71 40 13 64 78 70 60 49 7E AF 47 61 FF"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014120820141209]
"CacheOptions" = "11"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013030120130302]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021120130218]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021820130225]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
f729d886356835c780a1ec4486f60576	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\KINSTALLERS_66_109992.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
KINSTALLERS_66_109992.exe:2028
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\kingsoftkonline\KINSTALLERS_66_109992.exe.tmp (230271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ptui_ver[2].js (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\login[1].htm (1302 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[1].js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KINSTALLERS_66_109992.exe (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\21[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\login[1].htm (1511 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\index[1].htm (562 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\c_icon_2[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\clearcache[1].html (934 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\big_8[1].png (1113 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\qqtubiaoad[1].htm (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@heima8[1].txt (626 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\ptqrshow[1].png (433 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@heima8[2].txt (303 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ptui_ver[1].js (175 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hm.baidu[1].txt (164 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\clearcache[1].htm (2 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.cx90[1].txt (182 bytes)
%Documents and Settings%\%current user%\UserData\2Z89WTQV\www.cx90[1].xml (266 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\load[1].gif (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\h_login_17[1].js (2701 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@ui.ptlogin2.qq[1].txt (181 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\h[2].js (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\468X60_54502[1].jpg (13245 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\qqtbset.ini (1 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ???????
Product Name: ??QQ??????
Product Version: 1.0.0.0
Legal Copyright: ?????????
???? ????
?????????!??????/????!
?????? 2007-2011
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ???????QQ????????,???????????,??????
Comments: ???????QQ????????,???????????,??????
Language: English (United States)

Company Name: ???????Product Name: ??QQ??????Product Version: 1.0.0.0Legal Copyright: ????????????? ?????????????!??????/????!?????? 2007-2011Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ???????QQ????????,???????????,??????Comments: ???????QQ????????,???????????,??????Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	650326	651264	5.15588	b3c19bba6dbe0704d131617d4e08cc19
.rdata	655360	1292802	1294336	4.90897	18e99f95cbe5394f38aa9abb215e1627
.data	1949696	391434	90112	4.4202	9f1d5f3967162936296cbbbcc10eefbf
.rsrc	2342912	109864	110592	3.58611	d24edb7b2f687b17a845499fdc2b66c4

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://ui.ptlogin2.qq.com/cgi-bin/login?appid=10000101&s_url=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&target=self&f_url=loginerroralert&hide_title_bar=3&link_target=blank	112.90.83.106
hxxp://hm.e.shifen.com/h.js?aba7628e14455a7d552e9e0e00843116
hxxp://tf01.dlmix.glb0.lxdns.com/duba/link/grthKAVSETUPS_66_0.exe
hxxp://imgcache.qq.com.cdngc.net/ptlogin/ver/10104/js/h_login_17.js?max_age=604800&ptui_identifier=000D55E5F40B222963CF67F21EAB079C13ACFB15EB55766A14BF8CAB	174.35.73.107
hxxp://imgcache.qq.com.cdngc.net/ptlogin/v4/style/20/images/c_icon_2.png	174.35.73.107
hxxp://hm.e.shifen.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=513287684&si=aba7628e14455a7d552e9e0e00843116&st=1&v=1.0.70&lv=1&tt=Untitled
hxxp://imgcache.qq.com.cdngc.net/ptlogin/v4/style/0/images/load.gif	174.35.73.107
hxxp://imgcache.qq.com.cdngc.net/ptlogin/v4/style/20/images/shouQ_v2/big_8.png	174.35.73.107
hxxp://pv.heima8.com/index.php?p=153829341&b=100002856&itemid1=141900451&reffer=&url=http://www.cx90.net/soft/qqtubiaoad.htm	61.160.249.221
hxxp://static.n.shifen.com/hmt/icon/21.gif
hxxp://a1574.b.akamai.net/ptqrshow?appid=10000101&e=2&l=M&s=3&d=72&v=4&t=0.6339613223348628
hxxp://ui.ptlogin2.qq.com/cgi-bin/report?id=366447&union=256042	112.90.83.106
hxxp://ui.ptlogin2.qq.com/ptui_ver.js?v=0.5732770007842594	112.90.83.106
hxxp://ui.ptlogin2.qq.com/clearcache.html	112.90.83.106
hxxp://ui.ptlogin2.qq.com/cgi-bin/report?id=358191&t=0.16310324923237268	112.90.83.106
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001039122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001042122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001045122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://img.heima8.com/141653471/468X60_54502.jpg	114.80.206.86
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001048122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001051122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001054122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001057122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001060122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001063122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001066122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001069122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001072122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001075122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001078122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001081122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001084122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://a1574.b.akamai.net/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001087122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0
hxxp://eiv.baidu.com/hmt/icon/21.gif	115.239.211.92
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001069122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001066122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001081122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://imgcache.qq.com/ptlogin/v4/style/0/images/load.gif	174.35.73.107
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001057122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001042122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrshow?appid=10000101&e=2&l=M&s=3&d=72&v=4&t=0.6339613223348628	184.84.243.64
hxxp://imgcache.qq.com/ptlogin/v4/style/20/images/shouQ_v2/big_8.png	174.35.73.107
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001054122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001051122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://hm.baidu.com/hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=513287684&si=aba7628e14455a7d552e9e0e00843116&st=1&v=1.0.70&lv=1&tt=Untitled	61.135.185.140
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001048122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001063122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://imgcache.qq.com/ptlogin/ver/10104/js/h_login_17.js?max_age=604800&ptui_identifier=000D55E5F40B222963CF67F21EAB079C13ACFB15EB55766A14BF8CAB	174.35.73.107
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001072122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://hm.baidu.com/h.js?aba7628e14455a7d552e9e0e00843116	61.135.185.140
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001078122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001045122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001060122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://imgcache.qq.com/ptlogin/v4/style/20/images/c_icon_2.png	174.35.73.107
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001084122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001075122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
hxxp://ptlogin2.qq.com/ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001039122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0	184.84.243.64
d.union.ijinshan.com	8.37.234.10

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /cgi-bin/login?appid=10000101&s_url=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&target=self&f_url=loginerroralert&hide_title_bar=3&link_target=blank HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: keep-alive

Keep-Alive: timeout=50, max=1024

Server: QZHTTP-2.38.20

Date: Mon, 08 Dec 2014 06:18:53 GMT

P3P: CP="CAO PSA OUR"

Cache-Control: max-age=86400

Set-Cookie: login_param=appid=10000101&s_url=http%3A//show.qq.com/inc/loginto.html%3Fmyurl%3Dhttp%253A//show.qq.com/&target=self&f_url=loginerroralert&hide_title_bar=3&link_target=blank; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Set-Cookie: uikey=66d7571f107441eb9ded2fbf721484b89c87c2db12000383af2ff0ac4790755a; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: pt_user_id=674337654367558593; EXPIRES=Thu, 05-Dec-2024 06:18:53 GMT; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Set-Cookie: ptui_identifier=000DB209E3A7BBE5C30E178284F064C14777F5239E6F84101A030D93; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Last-Modified: Tue, 02 Dec 2014 01:30:00 GMT

Content-Encoding: gzip

Content-Type: text/html

Content-Length: 6175

...........<k..........U.... ..%.dJ.....8...s.....$$...pWkj.d'R$[.\....].....c..s.b.......O.....0x...W9.m.3=.===.............N.Cod..{n...6..P*...Q*..<.<...SO...$l:....n..Q*...(.C.......vq.R..Ai.....W.7f...kY.<M...z.F...S.....m.A..u.F.S..Y@...V[..L..^as.F........^..l..Pq\...^....\..m...8....#.....S....6..p\..r.8@.&.-.Z....b..s.m.....e"...vP........e.R.\T....T.h...M17q.7v.]....,u<...........eQ...\...].. .:.....62UKC.}...kd.#..../v/.G{.Wa..[S....g9....c.h.k.E.Q......[<...Z..:..=.,.u...-..fO.....4......X....xT;*..X.=.x."..f.@bj.....n...^B...m...[t.T.........b........ .....Vw..Mq..../..}........bz....W.7?.....<...Z*.. {.}.....K.{....w_.!us........}...;w.~....9..... .w..^.3@FQ........k..O..lv......_~....{o..~....;..7.X.rF....~...k........@.0Rp1O.u}..}z...........@.....|.....^>}zv...W.N_.=.....O.....k/N............U..`......p..?.^.A..............H[..9]...%.'...i......u.z.............:&.w~...G.~.w..."..^.......6.v...k.W...az...._....'{.o....W.]......}?.;{.....h.......~..GY7.@.....nS........}cz....... .w.....Oo........>.*.a..... ..._...gn..].....Q.M.d.S.G@.J..O.."....4....A..Kw...)...an...l.u.*J. ....x...@..R..M...N....G.........^.|z...w..~|sz.-......2......w.C;Ka.....m9...`.p.n.c..%V?:.a...K......I.w.......5.T.. .......;..p..;..L:.....lMQ..g.#.TF..b.E1...=.........V.e.ih.....9....n.Il....cg..'..c..$.df.q).....A...M]...e..)Ke.....B.W....!....n..:.*b/K.O.v..x...A..z....S.9..%}.....W.@......@.<.u{...*...T7..3....g.C....n.?_)<...S7...B.V,g..~..z.....m.T....OH?<Q..3O..=w....O.k.6.S^......

<<< skipped >>>

GET /cgi-bin/report?id=366447&union=256042 HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?appid=10000101&s_url=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&target=self&f_url=loginerroralert&hide_title_bar=3&link_target=blank

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

Cookie: login_param=appid=10000101&s_url=http%3A//show.qq.com/inc/loginto.html%3Fmyurl%3Dhttp%253A//show.qq.com/&target=self&f_url=loginerroralert&hide_title_bar=3&link_target=blank; pt_user_id=674337654367558593; ptui_identifier=000DB209E3A7BBE5C30E178284F064C14777F5239E6F84101A030D93; ptui_version=10104; uikey=66d7571f107441eb9ded2fbf721484b89c87c2db12000383af2ff0ac4790755a

HTTP/1.1 200 OK

Connection: keep-alive

Keep-Alive: timeout=50, max=1024

Server: QZHTTP-2.38.20

Date: Mon, 08 Dec 2014 06:18:57 GMT

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: text/html; charset=utf-8

Content-Length: 0

....

GET /ptui_ver.js?v=0.5732770007842594 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: QZHTTP-2.38.20

Connection: close

Date: Mon, 08 Dec 2014 06:18:58 GMT

Content-Length: 175

Last-Modified: Wed, 03 Dec 2014 07:47:27 GMT

Content-Type: application/x-javascript

Content-Encoding: gzip

Cache-Control: public; max-age=86400

Expires: Tue, 09 Dec 2014 06:18:58 GMT

..........]....0.D.E.(.41}@...]t...1h .....~K...f8.....#'......"c.>.[t....A.V...D........dD.sM._!.7IQ...dh@....:MT.cj0...,...[......|...w.#......Y..._...Ao.:G%...[..y.H..N......

GET /ptlogin/v4/style/20/images/c_icon_2.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Dec 2014 06:18:56 GMT

Server: PWS/8.1.20.5

X-Px: ms h0-s2038.p9-jfk ( h0-s2029.p9-jfk), ht h0-s2029.p9-jfk.cdngp.net

ETag: "547ebff4-206c"

Cache-Control: max-age=7200

Expires: Mon, 08 Dec 2014 07:44:54 GMT

Age: 2042

Content-Length: 8300

Content-Type: image/png

Last-Modified: Wed, 03 Dec 2014 07:47:00 GMT

Connection: keep-alive

.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<....PLTE........z.......V4....kM.....;...........J...........r.........t.).....9.........c..y. ...J.......2......khk[.......!.........B.......s........0..............Y.0........................9.......q............&......E,.. .......P.)..=..`....)....~.,...XG....b.&...v.W....D(............{.3l. ..................~.5TRT..................q.'m.5N..........G.....7.........99<..........................tRNS................................................................................................................................8.Kg....IDATx....C........Z.y.4.*s..........1a.U.5:l...]'\...._...W.6.-......B..m...y.....(g:...Y4..2.. .t.H.9.D...R."O..>II.T.HW..$...dP.@L...O..F.b..Bb.3..H..H..H..H..H..H..H..H..H..H..H..H..H..H..H..H.I2R*E..%7$=.$z..,.#.B.|..=C(.i ;.........@......}.bg...Z{(I.Zw1e....9...w........y....x[A.{.>IgJo ..!I.m.a$)mj..H..H..H..H..H..H..H..H..H..H..H..H..H..H..H..H.I..R$l}...T.|.Y...y5."W.....k..Vv.}.]..K..H ..H.@2...kQ....*.....&.....E...u.y..o.ht.\/.$s.v.b.......k.}. ...Z.yRW..O...'6.v.z....e......c.......wF$........H...Q.T.%.N3"9}.z.k...k....p.`'W~....]~...&.......#..UpI.3vr..8.........]......I....lP...3.O.;|b.%....?4...O^].3.I.I..> . a........%F"...H.$]$..H...I.3.9.$uI..U.".......7...`F.*X.|.$.%1...H........W..~./#.........H^.i....1"..OF$s7.a.'..s.Y9p.o&"..`.....>..'.x......_......{. .c.._oD....]....`..,.;F................p..9c$..D.%.p.:et.......|K!I.'.`..~.@.1.CDZ.....P.d*D$.$.I..FX..E...R...V3k.....I45

<<< skipped >>>

GET /ptlogin/v4/style/0/images/load.gif HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Dec 2014 06:18:57 GMT

Server: PWS/8.1.20.5

X-Px: ht h0-s2038.p9-jfk.cdngp.net

ETag: "547ebff4-303"

Cache-Control: max-age=7200

Expires: Mon, 08 Dec 2014 06:32:02 GMT

Age: 6415

Content-Length: 771

Content-Type: image/gif

Last-Modified: Wed, 03 Dec 2014 07:47:00 GMT

Connection: keep-alive

GIF89a.....................................wul..y............!..NETSCAPE2.0.....!.......,..........O.......{....Y..`....I.D8.. S.....(.......D..(.I~.. .H`....Z.f....k.N..q...;'.L..!.......,..........N.......{..@.1....Q]AiN.:..)S.T...,........b....$?...Q(0.).j.f....{....n.-~N....!.......,..........M.........,Eeu......%5..E...f3. ......g(..<...L...D".X`.RJ.J.N..........9...=..!.......,..........N...J..Z.'B. ..q`.....P)8./,S&.$.$.......y....D...."..`.R.ak.b.........m..^S....!.......,..........M......Z.gJ.....}.H..I...b$.(.t..}.......~9..@Y,2..........i00......|......t;..!.......,..........M...R..Z..R.. ..}.H..I.l....t.P0....B....v>.CG1.2...i.P....J.0.R-.....J....t;..!.......,..........M......Z..Z..$..}.H..I.l...at..0..........8..B d..L.I.B)...q80...&..t.......3..;..

GET /duba/link/grthKAVSETUPS_66_0.exe HTTP/1.1

Host:d.union.ijinshan.com

Accept:*/*

User-Agent:Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Connection:Keep-Alive

HTTP/1.0 200 OK

Date: Sun, 07 Dec 2014 13:22:57 GMT

Server: Tengine/2.0.3

Content-Type: application/octet-stream

Last-Modified: Sun, 19 Jan 2014 08:30:06 GMT

ETag: "52db8d0e-1e1d9f0"

Accept-Ranges: bytes

Content-Length: 31578608

Age: 60958

X-Cache: HIT from cache.51cdn.com

Via: 1.0 jxjj35:80 (Cdn Cache Server V2.0), 1.0 jg14:8888 (Cdn Cache Server V2.0)

Connection: close

HTTP/1.0 200 OK..Date: Sun, 07 Dec 2014 13:22:57 GMT..Server: Tengine/2.0.3..Content-Type: application/octet-stream..Last-Modified: Sun, 19 Jan 2014 08:30:06 GMT..ETag: "52db8d0e-1e1d9f0"..Accept-Ranges: bytes..Content-Length: 31578608..Age: 60958..X-Cache: HIT from cache.51cdn.com..Via: 1.0 jxjj35:80 (Cdn Cache Server V2.0), 1.0 jg14:8888 (Cdn Cache Server V2.0)..Connection: close...M.....|._4.T......WU..{...$QF.]...?.O...9^R...0XR.K..vi..Bt.U...U......lgZn...#..6.... .K.;.B .P..Q.VP.~(YR....#hO.91DE$._2..b...........vI...` ..tPWV..l3.;...X,....^.@u Z...v.....1.>7......~.Li[?.9}.f.....E.;...M..]..;...;..z,..Fvqa.9..sya.}m...y.=LiXV.}.S.\G..v.\]f.S8JA..I.^|4x.!_...._|.j.h.....QN.d...Pd.%..SVW.e... ...}.~..........0.."._.\.....p..o.....;.s..=4;.w7_w_Z4..E...N.(...]nm...&........"..H..:.E.A.h...@...u./...l.M.Tv#......aJG...T6.RS..]..LE.....}(X........w.O...z.H.R....M...[..]L.....$u..N.Q.)p..3..P..6.,.hU5..Tw'..srLov....uN2......~.h..P$..{....b3.....s.*..L.30...D.z.yh..:S..`*Q,..yNq....4$.v......J...-zQ...b..B...?Q.M.....TP.W..........|.;.uZ...t....:.....(.j....[Y.T]u..,.....8....B..P..V....LO.Q.y.....h........Q..]g.W3....P..'...,(....tM.I............W...Qj.V...s.h ...Jt...\&=.O..X$..S.....B....*u.HF[Y..Ea.}.?..8.`.W(...4...&h$....0t#...f<.......v.;.s.......2..tN.u..r.^_.lf.Y....f..#...E.....Pw"........;..$....-hW..@..{."...H......4;..... .Z.n....q.........?...t..%....t.V..pLy.....a.Xh9.sI.;.X......l.....~...x..~.QV...}...@.;.}......h.~........V..^}.O.....MZ......................@............................

<<< skipped >>>

GET /ptlogin/ver/10104/js/h_login_17.js?max_age=604800&ptui_identifier=000D55E5F40B222963CF67F21EAB079C13ACFB15EB55766A14BF8CAB HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Dec 2014 06:18:56 GMT

Server: PWS/8.1.20.5

X-Px: rf-ht h0-s2038.p9-jfk ( h0-s2062.p9-jfk), ht h0-s2062.p9-jfk.cdngp.net

ETag: "547ec030-13ba0"

Cache-Control: max-age=600

Expires: Mon, 08 Dec 2014 06:26:34 GMT

Age: 142

Content-Length: 26502

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Px-Uncompress-Origin: 80800

Last-Modified: Wed, 03 Dec 2014 07:48:00 GMT

Connection: keep-alive

................q ..TcFl....~.?......{..._..\]S..A.U$."...>.C^I ..g.k.|....>.......lY....=..._...L ....Z.................S{...u.Mz.Y..7..\.?.8..OT[....|6Y./......R.p.M........$,..pw........5.E.......k]Av3B...N.J..J3......:q...........^.iJ..W,u.....Mm]..)...T...*J..:~......?.........m.C.....7.../j..v:.....n....b..CW.Z.2..[../...v...K..k..w..Z).-..Q.n^i...So....-...G/.S.@y.....r...~SYW(.>{wU...mo..=HT...h.w..W7.....z...|....hK.m..7..?..J.....5...X3.M....A.b....LAW...S......-..y.*....8..F..=...(>.`.eb...]...A8.t....d..pJr......8>>..!......#...b.'RT..........?zx...'..../...{2w.P...G.y\.|6..V[w.....~O...Zz>.Y.."#.................{.A......@.....)...s.....R2...[V.0r.8a.l...u.`YV...R.R..J2.5W4...5.I..{....:@Z`.....<.......#..J>..Wp.2.....8..[K.......;......iW.SU...v...b?....jf_.X......F..w3...../j.m.].K.u'=.E#.mH].S?H...n.}&...(..?S....M.@C.yK.......;Xpl\.P.I......./..F.6].......TI.8..C5.D[..."........U@..&t3.sWY..~...&*..50I.......D.@.Q.O.MyFc.8VH ..../U...7..=...c...Y.h_....mP.........E{.#...z...2.}.....M.JO...V.`..D,....z .z.4T..S.0..D.C)3..q..]E..k=...@F.t..D!.i~ ..Bk....]._P..?u..l...Nd.....P....$.G7{....]1.>..%...8vD...$.).F.....g.;.dK#fd.......M.......h..cM.So`...8.r..lE.?...Y.......g..]/.8S8..Z b9.~......A._.........ym=.M.0A..,D.!..?".."%...0..o.x.tc.T.~.e../..(.8....Bl.^w.......N.YX..o....,G........"....g...,.........]1..m.<h.D..u....=@1.........5..p.....e....(..y0$z.....R........J...hD..."(.{.?.zA.N...-...S...O-.j. .mgH.....<..=N.-.......A<..L.....W\DDp=..}5.d.5.E.......

<<< skipped >>>

GET /ptlogin/v4/style/20/images/shouQ_v2/big_8.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: imgcache.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Dec 2014 06:18:57 GMT

Server: PWS/8.1.20.5

X-Px: ms h0-s2038.p9-jfk ( h0-s2071.p9-jfk), ht h0-s2071.p9-jfk.cdngp.net

ETag: "547ebff4-2c50"

Cache-Control: max-age=7200

Expires: Mon, 08 Dec 2014 07:45:11 GMT

Age: 2026

Content-Length: 11344

Content-Type: image/png

Last-Modified: Wed, 03 Dec 2014 07:47:00 GMT

Connection: keep-alive

.PNG........IHDR.......,.....,)......tEXtSoftware.Adobe ImageReadyq.e<....PLTE......fff.A.............:........}}~.YxSR.~........v..YYX...[..853...-.....rrr...zzy^|.......{.....@@?vI9.f;.............../btrl.... .........wo....aW...C'..........}.j2mOzmd....rK.........\F9............epuSRQ...vvv...~up.........Qsa...J..xxx....wltzy........../;jxn.............zy......[6(..tx..OjupWK.........,*)...KKI...__^{{{......'....}|||...x|s~.....qt|mll#|....................;Q.....tRNS................................................................................................................................8.Kg..).IDATx....C.F....8({Ij.e,t"....v.0.....{.S...$...%}...U..Oz..'$...we...'..k3.....4..3..Q...a.......l2Qb>.U...d...%.l......,e.'.M......{!.......Bx;.Q"..4~..9.Lx.B....Cb...veavl..S..mC.3O..;.2.1@..;.....q@.!...qQ3..R8..N&O.D].L....Xl...p<.......8..q..*.4....lv...d.....d2..$&..O=f..L....`....Rgg.'.O..]. .B2.p...If..arr..cvf...6....?Q..:..^.-...{@O^)O......s.>Q....~...k`'K.f.O...?Q...D.....'.O...?Q...F]..mI........Y....?..^<.{@...X.....,.P.....a~......Al...N...f. ~. ....H.R.3{......!...N$s..bB}..O.;.....wwg.........ow...3...4.x0..n..};s....}*..`.wS..3.U....g........wjw.YH..@.?..j2..1zwfqf....7.^..M/..>8HO.g.p...ss....!......`Ho..r....._...f.".-F..*...'...\W.>..Y.D....P.]<...U...P.~.x.UOn...W[.3......K?op.8..XQ........=..#..n....v..z..........Q...../..r.....]]]m.P.........xo....P.......p...}.......tjwuz'.N..g......M.>]...... ......\..2.....U.-U'...D.5..J0k......q)Au......d){.-.&...a".F.$&....

<<< skipped >>>

GET /h.js?aba7628e14455a7d552e9e0e00843116 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cx90.net/soft/qqtubiaoad.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Etag: 6dae7ce3160235d7f0209753dbf796ad

Cache-Control: max-age=0, must-revalidate

Content-Encoding: gzip

Content-Type: application/javascript

Set-Cookie: HMACCOUNT=255C41503C8E7AD0; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT

P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Connection: Keep-Alive

Content-Length: 6565

Date: Mon, 08 Dec 2014 06:18:54 GMT

Server: apache

...............(function(){var h={},mt={},c={id:"aba7628e14455a7d552e9e0e00843116",dm:["cx90.net/soft/qqtubiaoad.htm"],js:"tongji.baidu.com/hm-web/js/",etrk:[],icon:'/hmt/icon/21|gif|20|20',ctrk:false,align:-1,nv:-1,vdur:1800000,age:31536000000,rec:0,rp:[],trust:0,vcard:0,qiao:0,lxb:0,conv:0,apps:''};.[{w.......F.2i..d;nJ..M..7.M.m......H..#>d...J..;..%.y...9.@<...o........i..E......(7.l....=g.(....x........E..1_...'...D.l"..P..$...e..Px...S..~.K~..Q..s.<.,.D4z.U.M]........){.r...,vF.R...U.{....T..\.^>.l.F....^.T..i..%..$.Q..)..X7@g....,?...L.._.n.$...C..^..<[..;...%V..<......H..9)JF.....%."......a..tuazI..xHlM......1....S.........zq?.R.A.g..Oo>... ..F9.s..2..RA.r[o.iml.X."_.Pb......N.... ].Y.}....no...0..p.........V&..Kh).X.M.....y...Kl..|.$..O....ka.<.a.gl...{...K......9..a!..J...y*...>_....{......U|.....r....h..J3Q.Y1...UY{.*5.h]-K.. .@.....R#3......leQ.HnoDnnn.......?.)...PO...y.]..w.....R31.c;....m......./.O<......Z.....T...$Iu.7.2@..............'.....n..8..j..SP[X.[|...m.......Rr..b..X.c,...c1...PX.:..!'Py# .g[..5. [..;....H|.*\...,bO.A,<b...kl.%^D.H.v-.^.q..30...=.G....%.j...E..$..q.TM`.yJ.-..c, .UL..Z.g9.]...4..J......i.<3..$....4.}........~.k.,..7....D...UQr..^..8Y....>.Kz.N...".. ....]..#..!.l..cR..&.OI.....7....UJz.W....O...3. .'.I.|.U..Z...P....'Xc&..zp./...j..7.=Y...!pyM...v.&..Z..e....O.E....r.....*.5M.".....hl..8.F.7..b..tv.!:..).6.....j.>.c[.....kQl... .(...M...K.&.D.[........V..p.F=..o9..j....UV...2.....>.Z.8....x.`.!N...u....A....|#O.....>%A..x..

<<< skipped >>>

GET /hm.gif?cc=1&ck=1&cl=32-bit&ds=1024x768&et=0&fl=11.6&ja=1&ln=en-us&lo=0&nv=1&rnd=513287684&si=aba7628e14455a7d552e9e0e00843116&st=1&v=1.0.70&lv=1&tt=Untitled HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cx90.net/soft/qqtubiaoad.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: hm.baidu.com

Connection: Keep-Alive

Cookie: HMACCOUNT=255C41503C8E7AD0

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Content-Type: image/gif

X-Content-Type-Options: nosniff

Connection: Keep-Alive

Content-Length: 43

Date: Mon, 08 Dec 2014 06:18:56 GMT

Server: apache

GIF89a.............!.......,...........L..;..

GET /hmt/icon/21.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.cx90.net/soft/qqtubiaoad.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: eiv.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

ETag: "762990053"

Accept-Ranges: bytes

Last-Modified: Tue, 13 Apr 2010 09:38:40 GMT

Expires: Wed, 16 Oct 2024 06:18:57 GMT

Cache-Control: max-age=311040000

Content-Length: 1119

Date: Mon, 08 Dec 2014 06:18:57 GMT

Server: BWS/1.0

Connection: Keep-Alive

GIF89a........s..E.....M...................ZS.2-.YS.......2,.c[..D.......0'..:..0.&..]Z..8..>..D.TM.................C................._..^.....u..w........~........k.4......X..d.......=1.....a.c[.PH.h_.....b..........PH........A..9....h`..J..1.......g`..W........2........z.#...p..m....jd........*.............[Q...........6..G..............6..t............. ..TL.....!....$....."..;0.....h.7-..............Z.............%..:.....H@....^W.QJ..'. !..........70.._. %.'...T.0'..Q.G?.ws....-$........h.}w.....>...........L.....#.......:0.............\S.............*".....Q..............<..T.!...p.$...}........N..........d_...........j.......VN.....o.....e........[......................................................................................................................!.......,............u...,..>6.T.T..&T.".H. ....3^.PQ.G..:^..H.-.T....2#!........K..iP.&..03%X..x.P/^.$...`...G>Xd....!..d.T...j.,..fQ..8l<..U%..G|.h.......$p..f......R..b.....*R@W"2y..8..V3.LV`t.e..7.>.........\D..O.H.....$...^.]..).. ...9..E...d\...V.U1..i......B]......c.P<0.i...v.]D..G .?p-.CD.Fi;>..v....r`..&........./.dp....`.....;HTTP/1.1 200 OK..Content-Type: image/gif..ETag: "762990053"..Accept-Ranges: bytes..Last-Modified: Tue, 13 Apr 2010 09:38:40 GMT..Expires: Wed, 16 Oct 2024 06:18:57 GMT..Cache-Control: max-age=311040000..Content-Length: 1119..Date: Mon, 08 Dec 2014 06:18:57 GMT..Server: BWS/1.0..Connection: Keep-Alive..

<<< skipped >>>

GET /index.php?p=153829341&b=100002856&itemid1=141900451&reffer=&url=http://VVV.cx90.net/soft/qqtubiaoad.htm HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.cx90.net/soft/qqtubiaoad.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pv.heima8.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Dec 2014 05:53:11 GMT

Server: Apache

X-Powered-By: PHP/5.4.10

Set-Cookie: hm_uid=1418017991.0507_2309; expires=Tue, 08-Dec-2015 05:53:11 GMT; path=/; domain=heima8.com

Set-Cookie: hm_uvcount=1; expires=Tue, 08-Dec-2015 05:53:11 GMT; path=/; domain=heima8.com

Set-Cookie: hm_uvltime=1418017991; expires=Tue, 08-Dec-2015 05:53:11 GMT; path=/; domain=heima8.com

Content-Length: 1901

Connection: close

Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">.<html xmlns="hXXp://VVV.w3.org/1999/xhtml">.<head>.<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />.<title>...............</title>.<style type="text/css">..</style>.<script type="text/javascript">.var init_runint =1; .var iTimerID = 0;.var timespan = 5000;..function showImp(id).{..for(var i=1;i<=1;i )..{...document.getElementById('key_' i).style.display = "none";..}....document.getElementById('key_' id).style.display = "";.}..function show(id).{..showImp(id);...init_runint =id;....clearInterval(iTimerID);..iTimerID = setInterval('socall()', timespan 1000);//......................}..function onmouseoverHandler(id).{..clearInterval(iTimerID);.}..function onmouseoutHandler().{..clearInterval(iTimerID);..iTimerID = setInterval('socall()', timespan);.}...function socall().{..if(init_runint >= 1){.init_runint = 1;}..else{ init_runint ; }....showImp(init_runint);.}..</script>.</head>.<body>.<div style="border:0px solid #CCCCCC;padding:0px;width:468px;height:60px;">.. <div style="clear:both; width:468px;height:60px;" onmouseout="onmouseoutHandler()" onmouseover="onmouseoverHandler(1)" id="key_1">. <div style="float:left;">. .<div style='float:left;'><a target='_blank' href=

<<< skipped >>>

GET /ptqrshow?appid=10000101&e=2&l=M&s=3&d=72&v=4&t=0.6339613223348628 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=66d7571f107441eb9ded2fbf721484b89c87c2db12000383af2ff0ac4790755a

HTTP/1.1 200 OK

Server: tencent http server

Accept-Ranges: bytes

Pragma: No-cache

P3P: CP="CAO PSA OUR"

Content-Type: image/png

Content-Length: 433

Date: Mon, 08 Dec 2014 06:18:57 GMT

Connection: keep-alive

Set-Cookie: qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN; PATH=/; DOMAIN=ptlogin2.qq.com;

.PNG........IHDR...o...o.............pHYs................cIDAT8...... ...Y...6.D.d......h..mX..oF.....=......._..<M.......T-V..&..L.....Md.'G.......x....D..78....?......|?.w...`........'..Z...T.Q...H2Q..K.xg r.m.8t...>.2......L@.[....$"...s..W.=.G-..L....v.Y...M....#.r..T...r. z..."Ry..W.t.....iU.5....n.m.,$.\.\.lw*"G_"q...C./....7.E.5....2.I..s...6d..<.i..4S.^P=.fX...Rt....[.9}..9k..r.&.o...W.H...C...?....M|....?;0.?....IEND.B`.....

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001039122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

X-N: S

Date: Mon, 08 Dec 2014 06:19:00 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(1904244508)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001042122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 70

X-N: S

Date: Mon, 08 Dec 2014 06:19:03 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(436238108)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001045122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 70

X-N: S

Date: Mon, 08 Dec 2014 06:19:06 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(457197616)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001048122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

X-N: S

Date: Mon, 08 Dec 2014 06:19:09 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(2537554844)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001051122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

X-N: S

Date: Mon, 08 Dec 2014 06:19:12 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(3654311384)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001054122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

Date: Mon, 08 Dec 2014 06:19:15 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(2996850536)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001057122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 70

X-N: S

Date: Mon, 08 Dec 2014 06:19:18 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(879766352)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001060122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 70

Date: Mon, 08 Dec 2014 06:19:21 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(453010396)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001063122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

X-N: S

Date: Mon, 08 Dec 2014 06:19:24 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(1546674548)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001066122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

X-N: S

Date: Mon, 08 Dec 2014 06:19:27 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(3891295104)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001069122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 70

X-N: S

Date: Mon, 08 Dec 2014 06:19:30 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(414201072)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001072122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

X-N: S

Date: Mon, 08 Dec 2014 06:19:33 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(2753579980)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001075122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

X-N: S

Date: Mon, 08 Dec 2014 06:19:36 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(1597005888)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001078122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

X-N: S

Date: Mon, 08 Dec 2014 06:19:39 GMT

Connection: keep-alive

X-N: S

ptuiCB('66','0','','0','.....................(1516247056)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001081122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001081122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Referer: hXXp://ui.ptlogin2.qq.com/cgi-bin/login?appid=10000101&s_url=http://show.qq.com/inc/loginto.html?myurl=http%2

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

Date: Mon, 08 Dec 2014 06:19:45 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(2056273552)', '10000');......

GET /ptqrlogin?aid=10000101&u1=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&ptredirect=0&ptlang=2052&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=0-0-1418001084122&mibao_css=&t=1&g=1&js_ver=10104&js_type=1&login_sig=48CBX3-L8skcCXTveM7orvZYG69zpERpcM-S-WE0WE6JOLMmUkDFDIu5MTJ18N0b&pt_uistyle=17&pt_randsalt=0 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ptlogin2.qq.com

Connection: Keep-Alive

Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; qrsig=7Ctyau9OyMqxTj10JHo36pY6L5*kJmjzWgMoaHPgI1FW5fVcDYgsRfo9gjemaKRN

HTTP/1.1 200 OK

Server: Tencent Login Server/2.0.0

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 71

Date: Mon, 08 Dec 2014 06:19:45 GMT

Connection: keep-alive

ptuiCB('66','0','','0','.....................(2574275640)', '10000');......

GET /cgi-bin/report?id=358191&t=0.16310324923237268 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: keep-alive

Keep-Alive: timeout=50, max=1024

Server: QZHTTP-2.38.20

Date: Mon, 08 Dec 2014 06:18:59 GMT

Pragma: no-cache

Cache-Control: no-cache; must-revalidate

Content-Type: text/html; charset=utf-8

Content-Length: 0

....

GET /cgi-bin/login?appid=10000101&s_url=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&target=self&f_url=loginerroralert&hide_title_bar=3&link_target=blank HTTP/1.1

Accept: */*

Accept-Language: en-us

Pragma: no-cache

Referer: hXXp://ui.ptlogin2.qq.com/clearcache.html#hXXp://ui.ptlogin2.qq.com/cgi-bin/login?appid=10000101&s_url=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&target=self&f_url=loginerroralert&hide_title_bar=3&link_target=blank

If-Modified-Since: 0

Cache-Control: no-cache,no-store

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: keep-alive

Keep-Alive: timeout=50, max=1024

Server: QZHTTP-2.38.20

Date: Mon, 08 Dec 2014 06:19:00 GMT

P3P: CP="CAO PSA OUR"

Cache-Control: max-age=86400

Set-Cookie: uikey=556be5b821e3a60f02be2325b1482809374aaa3e317611e0b7e51a13d38bb6bb; PATH=/; DOMAIN=ptlogin2.qq.com;

Set-Cookie: ptui_identifier=000E011DCDB5251EB9A96E244B170DF0BD0309CBBFA412670CB74B340C; PATH=/; DOMAIN=ui.ptlogin2.qq.com;

Last-Modified: Tue, 02 Dec 2014 01:30:00 GMT

Content-Encoding: gzip

Content-Type: text/html

Content-Length: 6168

...........<kw.D......B9c..~..........;<2...dN..T..D-......9.&!.d.9.!;.0@f.$..C a./..........J.n..3....n.{.....*...G.X[..'....@..|z.....b.Px..V(.Y?"<...c?..yIX.e..\.4d.Px.qQ...k.......V9o..../..0."n..s..2....Z&.N.t.i&`).--.....jky.\Y..9.1.6...i..ps.......5E..r..eCP... .9t..E@.(.f..M..zmW...h.A.........#...3..r..l>......3?..mi.jn.M...i7....d..H...."...e....z.v........m.`...j*....Wl.4...~...AO.4:...3>......Lm"C1U../.]3..0.M.a.L..x..~e...5.M.'....:.^.A.LC.;....#.'...F^1.....:.Q8..md...PGS...47..K.......5...aq....c....(...$.4.....d...%T....)..A.AQ.6.........H...........a...Q.'/\.......L.^...k.s..o.:....w....dm..@7....y.h.K/.......|....MJt....~r....n....c.8.....!.7.M... .(.-.U.....a.../M..8........}........\.`|...k..@.......}...._..~.(.F..f)..'../o..~.................v.....M..i......&..........{....w.....;...].x....{.~.._....e....../....w..'m.}d.a>@.........>...%.z........K..n...{...s...w......#.m.....t.&...;{q......7....:......}..N........x...1...7..~B[........u..f......W.Q....Nq.^.<>..........'.'..7W.>}~|...O..Y..6e..dr..K....F...\......8HZ=.z.$..Mp5...HH..........pc.._..v...3.........".mP.'..... ................O...<........>..~e|........2........G;Kad....e.*./..p.fXC..%V?:.a...I......Io.m..J......H.......i.m.....m..&.j.V.Z..(.....e..TO........l...I.`.o..<.4T.....4....7P'6......S......l.v%f.q).....A...MM..#E..)JE.....B..T.0;}p..J.P|t...^....l....#....ue.<,..s..K....=....l...5..6.:jwd...q1..v.....I1.L...!.~r..I.._Z..Tsux..............#...'.s.i.#.Ots.^].e.....k........@.*..

<<< skipped >>>

GET /141653471/468X60_54502.jpg HTTP/1.1

Accept: */*

Referer: hXXp://pv.heima8.com/index.php?p=153829341&b=100002856&itemid1=141900451&reffer=&url=http://VVV.cx90.net/soft/qqtubiaoad.htm

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.heima8.com

Connection: Keep-Alive

Cookie: hm_uid=1418017991.0507_2309; hm_uvcount=1; hm_uvltime=1418017991

HTTP/1.1 200 OK

Date: Mon, 08 Dec 2014 06:19:14 GMT

Server: Apache/2.0.59 (Unix) PHP/5.3.9RC4

Last-Modified: Fri, 07 Dec 2012 06:37:25 GMT

ETag: "99c0ea-d4e6-72d53340"

Accept-Ranges: bytes

Content-Length: 54502

Connection: close

Content-Type: image/jpeg

......JFIF.....H.H.....&Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS3 Windows.2012:12:07 14:26:54........................................<...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?......[..F..%.....g..w.....~.`....,....qd...._.o..........r.l.N[}0.........,u^.../...."..2q..y6...^..0Vl$.......7..,..1O.|..Jz.1...^......c.HX...}6../C..~ao.....H.}.m..Y....6....w5......=m>...>........,h.*....Z..71.;..cq.;......~...8..>.2r,.e.w.}..k.l`uVT.......T..G..MG........?k.G.`%.!.(.v\..~...q..@..q...fGo... .......p#..w...w.b.....}9ma}.....A;w...m.V#u7.U...l.\.[&...2...............K"....S=..-}y...A....UN.}/.#_..G.M.. ..2..#..B....8..yz.~.>_o......<r...r.................Hm...{..;`?.sZ....c...?G. _.h....Y...]G.L84I..?........6[..h...=.i~-u....fE_j..E.Q.W...[....Qe..n.mm....f5.....VS[../R...=...H....19N...@....q.........B?......~.c

<<< skipped >>>

GET /clearcache.html HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ui.ptlogin2.qq.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: QZHTTP-2.38.20

Connection: close

Date: Mon, 08 Dec 2014 06:18:59 GMT

Content-Length: 934

Last-Modified: Wed, 03 Dec 2014 07:46:59 GMT

Content-Type: text/html

Content-Encoding: gzip

Cache-Control: public; max-age=86400

Expires: Tue, 09 Dec 2014 06:18:59 GMT

...........U]o.E.}N......5.......NU.@*%.j..D.....N...3...../..U.K.B ....A%J.}...&....]...Q.X.=;s..w..;.......oo.H'1i........J.[mQ..m..mow.....I.*..HYL..;.."...Q:..... d.z......r1tt...:.6...Y.a...9'N.^.....,0..hF...Oz...Z"..j.;<....S..0......1.@7{:t...5a4.1l...m|........;N[.........|..4.(...0>.y.....G..~......./-...7.".)...G}.......E..>...H.....L....w..U.Z.....S`W....,..'S$...~d.Dq ..w....UZ.Nj...=..\B(.w..J....X?.".3...Pq........b.......L..s.9...v.$...K[.....l.F3..6.2...X.:NkyH.2)-.0 ..;......F!.s..."b#)...J.....?...I~&......{...k..U.|.5I<.me..7M t..l.r...3L.g.......T.E..........!./..L......'.<.?......3l...=}...E..|...-..z . ooy.e.f@sL..7_.....7.(...>z....9d%O.c............]...C........R).9..9.1..........2..6 `.rA..d.............e...m.]GN..r.....<.=......SYr..{.g...}.J.V......_3\,...Lk....7...Â¬.u..r....9..r.... .2.....,....n.T...R...[......z..%O.vmy.....C........f.>=....{.m.fU/......w!&(v...7Q.N.....f...y.m.)..kR........

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_176:

.text

.rdata

@.data

.rsrc

t$(SSh

~%UVW

u$SShe

user32.dll

User32.dll

UxTheme.dll

{A0005538-9391-4dd9-B4D6-8EB7B9360F08}

hXXp://world.show.qq.com/mall/inc/item.html

hXXp://wenwen.soso.com/z/SetMyCommonNew.htm?ch=new.gr.dh&ch=new.gr.dh

:hXXp://pay.qq.com

10665999

10660127

10661700

10666226

10661700

10666226

1066170035

10660127

10665999

1066170035

10661700341

10666226

10668828

10665999811000

1065710141000096

10661700513

10665999501000

10661700501000

1066622637161

1066170015

1066170015161

106662263000

1066170035813

10661700896

10661700341

106659993607

1066622685

10666226396 >

10657101410000915

10665999801

10665999381

1066170035617

1066599935617

1066170015

1062170015

10625700

10621700

hXXp://bd.qq.com/

hXXp://bd.qq.com

hXXp://service.qq.com/

hXXp://VVV.paipai.com

hXXp://client.pet.qq.com/pet.htm

hXXp://pet.qq.com/vip_get_pet/vip_get_pet.html

hXXp://act.pet.qq.com/pet.htm

hXXp://115.com/file/aqab99ht

VVV.cx90.net

KEmulator.exe

KQQ3_Common.jar

.QQLive

hXXp://live.qq.com/download.html

hXXp://my.paipai.com/cgi-bin/myppindex/buyer?PTAG=1015.33.1

#01 10 1

#02 500 9

#03 1500 25

#04 6000 100

#05 18000 300

#06 36000 600

hXXp://u.shurufa.qq.com/rank/pinyin_rank.html#

20149999

hXXp://soft.baidu.com/softwaresearch/s?tn=software&rn=10&wd=ÃŽÂ¢ÃÃ…

http://pt5.3g.qq.com/s?aid=nLogin3gqq&auto=1&s_it=1&g_f=286&sid=AajEsQr7RNgOgjfiIusDTy21

wapex3.0.exe

wapex2.0.exe

hXXp://seller.paipai.com/remind.html?PTAG=40012.1.16&QTAG=3&LOGINTAG=1&CacheTime=1318738727

hXXp://shuqian.qq.com

hXXp://shuqian.qq.com/post/?1318738032

C$%cmb

.ppM|

aZ.mO

%-^

.hk;~

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXp://mq.qq.com/pages/open/open_choose.jsp

hXXp://imgcache.qq.com/qzone/web/load_login_3.htm

hXXp://imgcache.qq.com/

k%UPp

fg.VG

%C',@

>Ã™d

\_temp\o.exe

`.rdata

KERNEL32.dll

MSVCP60.dll

WS2_32.dll

_acmdln

%d.%d.%d.%d

User-Agent:Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

HTTP/1.1

{Konline_1A4F0F3B-5516-4338-AB9A-3A562A2761FB}

HTTP/1.1 20

hXXp://bo.duba.net:8080/pagetracer2/duba/__utm.gif?

E:\KINGSOFT_DUBA\Build\Build_Src\kisengine\kis_2011_sp4_fb\product\win32\dbginfo\konlineinstaller.pdb

Thawte Certification1

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

hXXps://VVV.verisign.com/cps0*

#hXXp://logo.verisign.com/vslogo.gif04

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

hXXp://VVV.cx90.net/soft/qqtubiao/set1.txt

qqtbset.ini

hXXp://VVV.wz123.com/?cunxinsoft

hXXp://s.taobao.com/search?q=QQÃ—Ãª&commend=all&ssid=s5-e&bcoffset=1&sort=sale-desc#J_Filter

VVV.cx90.net/QQtb

KINSTALLERS_66_109992.exe

%du2$"

.unOZ

@hXXp://pay.qq.com/

name="loginUin" id="loginUin" value="

hXXp://cx90.net

hXXp://xui.ptlogin2.soso.com/cgi-bin/qlogin?domain=soso.com&lang=2052&qtarget=1&jumpname=&ptcss=&param=u1%3Dhttp%253A%252F%252Fsobar.soso.com%252Flogin%252Fok%253Fw%253Dhttp%25253A%25252F%25252Fsobar.soso.com%25252F&css=&mibao_css=#1318736267718

hXXp://x.soso.com

&ADUIN=947562580&ADSESSION=1318726285&ADTAG=CLIENT.QQ.3493_MyTip.0#

hXXp://xf.qq.com/?ptlang=2052&frienduin=

hXXp://m609.mail.qq.com/cgi-bin/frame_html?sid=BlKpbMSa4pgCKhJc&r=c4f5ad0c9a3baa2d9a7d5f6d74cf2ac7

hXXp://ui.ptlogin2.qq.com/cgi-bin/login?appid=10000101&s_url=http://show.qq.com/inc/loginto.html?myurl=http%3A//show.qq.com/&target=self&f_url=loginerroralert&hide_title_bar=3&link_target=blank

hXXp://video.qq.com

hXXp://boke.qq.com/myhome.html

hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin?domain=qq.com&lang=2052&qtarget=0&jumpname=&appid=10000101&ptcss=undefined&param=u1%3Dhttp%253A%252F%252Fshow.qq.com%252Finc%252Floginto.html%253Fmyurl%253Dhttp%25253A%252F%252Fshow.qq.com%252F&css=&mibao_css=&s_url=http%3A%2F%2Fshow.qq.com%2Finc%2Floginto.html%3Fmyurl%3Dhttp%253A%2F%2Fshow.qq.com%2F&low_login=0&style=11&authParamUrl=&needVip=1&ptui_version=10029

hXXp://show.qq.com/

hXXp://VVV.tenpay.com

hXXps://VVV.tenpay.com

hXXps://VVV.tenpay.com/cgi-bin/v1.0/manage_icon_page.cgi

hXXp://qqring.qq.com/

hXXp://style.qq.com/qqring/

hXXp://VVV.pengyou.com/index.php?mod=userinfo

hXXp://baike.soso.com/mySet.htm

hXXp://pay.qq.com/service/service.shtml?sid=19

.hXXp://s.taobao.com/search?q=VIPÃÂ¼ÃŠÃ©&keyword=&commend=all&ssid=s5-e&search_type=item&atype=&tracelog=&sourceId=tb.index&rt=1318737217953

hXXp://city.qq.com/

hXXp://city.qq.com/user/rm.htm

hXXp://city.pengyou.com/user/user1.htm

hXXp://VVV.cx90.net

VVV.cx90.net/soft/qqtubiaoad.htmr

!$#*8!$*

!#$&&')!$)#$%

#$$())'((&''

!$#*8"(4"'1!%-!$* "&

" !## 9#*7"'0# 8")4"(2 #(!$)#-

5==3::

%D|*I

.Lr@i

>>=11333

!$!$ #*8"'1!$* "&

" !## :# 9#*7!&/"'0#,;")5")4"(2 #(#,:"*6 "% #'

,3=!% "%

,>V-?W1?R25936:!Ck.Px,:K.8D

"@bÃŒ,Ii.Ll1Pr0Jg}

*Ov-T}9`

33434735:38C36=38B3593462;L3;J3;I39D37>2;J3;H3:F2=N26

VVV.cx90.net

411127677

1.2.18

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

MSWHEEL_ROLLMSG

ole32.dll

__MSVCRT_HEAP_SELECT

%$%,%4%

S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%

b%c%d%e%f%g%h%i%j%k%l%

W%X%Y%Z%[%

Z%T%i%f%`%P%l%

%$%a%b%V%U%c%Q%W%]%\%[%

%,%$%4%

eZl%u

Q.YeY

R:\Sg|p5rL

e$e#e e4e5e7e6e8eKuHeVeUeMeXe^e]erexe

s4s/s)s%s>sNsOs

qq!r!x!/!L"k!^!-!y"_!`!!&"&$&%&&&'&(&)&*& &,&-&.&/&0&1&2&3&4&5&6&7&8&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&''!'"'#'$'%'&'(')'*' ','-'.'/'0'1'2'3'4'5'6'7'8'9':';''?'@'A'Q'R'S'T'U'V'X'Y'Z'['\']'^'_'`'a'b'c'd'e'f'g'h'i'j'k'l'm'n'o'p'q'W'>!=!B!F!G!H!I!w"x"E!D!s"l!m!("n!r" ","*"-"M"N"O"_"P"`":";"]!e"g"g!\"J"K"A"@"i"j"h!h"f"b"b!a"e!f!c"d">"?"(9(4(((8(=(3(*(:(?(5( (;(@(6(#"""%"$"'"&"!"~!{!}!|!~"z!y!j!i!v"u"t"!!"!#!7!9!:!;!R!S!T!U!V!W!X!Y!Z![!)"."L!M!A!!$"$#$$$%$&$'$($)$*$ $,$-$.$/$0$1$2$3$4$5$6$7$8$9$:$;$$?$@$A$B$C$D$E$F$G$H$I$J$K$L$M$N$O$P$Q$R$S$T$U$V$W$X$Y$Z$[$\$]$^$_$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$ !,!5!6!!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%&!0;e>>NBJ$PfC%Pz6&P]40Cg P52e6p8iL&VpM}FE5,P-P;N=MhA/Pv;sF2P>1_8^8f0KOJO3:!03P4P5P4K6Pr8g0rK|5}5~5bDP

B?PUIg@8!@PBPeBaNJ0AP>2D6gCo7CP$Gk4DPK0`8l4zI2HY5q2gPAElGFPMEPGPn:HP$UPPSPQPB2;JKPOPs8H;&4TPLPcNx;MPRPUPNP!6M0"6A2%UyKnIt8/?7NXJ87Â½2S=YP^P\PWP/BZP]P[P]JXP.?sK_P`P$=mPPG6IhPpJ62lPfPoPRAD8\GG`nP]EcPv8u8aPZQ~F4A@QAQ,Hx8;OBQ&6L{Qd3uQsQOAwQvQD3`7|Q-NxQ}QzQyQONy8C2tNu=XEe9"R#ReN O%Rz8$R/3&RVK)RgJ-R*@*RP6 R 4.7.R/R0R1R[)6:R[H;RR$Ih6e0?F?R==i@AR@R#>a8CR>HDR\H4BnB(6nF1CnGNKFRj@57GRHR,1u0m4(BQ5qMKR72JR*6LRqLMRRN|868NRPROR_?91^1QRRR78SRn52;TRtK5:Z5'MPA?H}\RZRD2fB8F>L!9yMGE~8/7gRc6JK]HfR^4aRbRdReR[5a?-JcR_Rc8`R$OrJhDb8p9hR]FlR~Si:13yR%Sv0$S%0JI"S|RwR}RH:&Sw0/S'S(S%>iK-S,S/E.S S416:0?)SbE*S"04S#M'>:S9S0SCB1SoB6S&>3SdL31WS^2bS|>^S\S]S_S=19AYSZSz3aSo4dS`ScS.JUF8HfSeSE3gSjSiShS9GkSlSnSmSpSsSqSoSrStSuSvSwSxSEQ|?T@T>TBT8Gh0VICT}>9HEf:NT=J]Nt2JT:AMTcEIEdE9HMDI:ITv16EKTGTP?OTN=-6PThJ}AFDRTOKSTXT/JWTQTTTVT&:IJYTECu2m>[TZTh9\T^T]T`TUTbTaT_TN;Q?TAcT~T%C}T3Jw=[E!U%9"U!G^HQL%G U85EM/L,V#U&UEB8KJE'UeKJ:*>(UP;O;90H8 @Q0,U-U*U81/4)UEL1I(0y0Q;R0#02U0U4U,OLG6U':9UXI:U5U;L^G;U2IUy7LUEUBUdCAUCUDUFUGUr4IUHUJUn>MU\DE1KUNUOURUPUQUR;SU&9TUz;8BUUVUZ;'9RL(5I8WUX3XU9BYU#VZU[U\U^U_U`UpB'1iH2bUFMI=drUsUS0:BR?tU3F.>/>uUm@0>vUwU`LxUF6"=yUzU\VGVFVEVAV@VDVxJKVHVJVrMIV?Vs?LV7:MVNVQVPVOVhE:VWVSVRVTVUVXVfNYVVVZV`4[V]V\V^V_Vn@#=d=cA)98:*9p5`V9:J8aV&LCGbV 9,4'CR6T;[IAHcVu4fV!DeVdVgVkDc?U;J@SB"5"DhViVo>9KlVkVjV}IsVZKmVoVkKnVpV(HqV>JrV34?J/GtVuV,944vV88DM)Mv4xV#D-91>_H2>x=lDyJ9E.9\IyVYEB:K8mDC0n=/9GMzV{VQG|VwN-O~V}VG3!W$W%W#W@I3>'W&W"W(W)W*W-W W,W.Wd1nD/Wz7v26G0W{F[J1W.O2W@J5W!P1P0W@WvEAWBWCW4W3WDWA7'IL:7I&DKIEW4>F1FWGWrL`HJW}1,@IWHWB7TBNWLWKW'Ne8y=MWLE>=@FQWPWOWRWf8SW|I[=TWyHAF'D0EUW 54?,Iw4&GVWV;:K;K~1[WiCXWw2-XZW0GYWWWz9]WcWiWaW\EfW]I`WeWgNW;UB^W^5hW-@e1bWx2gW16dWjWlWvWtWqWpWxNrW2619z=yWkWoW_Wz2sWuWQC(:82mWxWwW36)Bf3C7nWzW}W!X=/XWFGO X1X{9K@T0*X(XZA|W4;FB=X[A8X5X6XfX?XU03Xr6&064;XCXBXGXHXFXIXAXEXJXKX@X|;DXVB292X5?XXiJNXOXPXWXVX}K74TXE743QX8NSXV0UXLXRXYXD7MX]M M\X`X~AyNaX^X[XZX_X0J4FF7bX]XcX{712kX84iXjX):hXfXeXlXdXnX{2pXoX(DsXqXgX|7rXvXuXwXtXxXyXzXjJ|X{X?=.@f2|2}X?0L@~XCl!Ya7"Yo@#Y$Y:5%Y&Y'YWBM8aL;50Y7Y6>1YDG^M3Y4Y8YjE5Y39^@FY4HrBdH-ZzJqDuK;Y!2jCDY4C>YEY@YGYCYBYoGAYRGr5H3g3!?IYNYJY}7OY";i9&==Y};LYX;MYD0HY)Ds546KY'0C:6?rDTHQY^A*B ;RYTYPYaJ=D\A{JNhF1GWY]AxVY[YSGUY!7]3]Y NN:5CZY\@59d?f15Z9Z7Z8ZpY;Z:ZxYZ@Z?ZAZ~269|J/@N8CZFZRI_5EZDZTGGZ56IZHZ:46;XFI7t?JZ0@(E_IKZLZMZ8J]UF@LIX:eHCHMEANOZP_Z;>@L*:W0N@fZ1@G1U=fKr:'@eZcZdZkC&[jZ~;89hZiZ8?gZ/;lZkZpZqZmZ"3nZoZUHaIJ7rZ2@=>RCG6sZwZK2tZvZuZk=HCE0xZyZ*DqNC;kJ=K"[{Z~Z}ZzZ![^F|Z#[l=$[KMxG%['[([)[J6H199*[ [q=bAXR>A=AXBG:rPn7-M~J~I,[s:?D-[/O>K D.[|4/[0[ZL$LvK\K%;2[k;[NE9[ B:[r>]L>DHG[zH>[D[C[O@mKSNgKL2^;HOF[u?E[@[O8L[J[M2H[N[T[HBAJV["IU[pG?K;4w@@=SD.MQ[P[R[O[W[M[K[S[I[lCxLF<::oka3ndjfi1r>mTh8|Mh[tD#3-:`[p[a3n[r[nE~42\ILw[}4~[@K!\#\'\y[*CoE \|[(\"\9?,\3@*\=4POv[&\X0x[:L}["?GDs[%\z?/\q3!81\z[0\)\{[-\.\?\NF$\;\=\XDLMvI8\JB>\?A5\B\A\oF@\jFD\7\H6:\]=`GOLx\k\"8#2_3S\A>p\w\y4=]]N27C?]?4A]@]B]C]D]_;5@!:pIbJDOu;P:rNE]F]`;G]H]J]I]XK^=l9SCi]q]j]ABb5r]h7%5p]n]k]`M@DYFl]t]s]#7-2;:m]o]WKtBwK|]}]O2(J}L!^#x]~]h176u]z]t@qGgHw]!Ky]$^"^{]"KHGc5%EmC%^#^YBv]K1NM0^/^v@,^lM6F&^EDL1?9)^'=.^-^(^ ^h3*^IG.Nt>u@6^4^MI1^3^:1@92O=3bIaM$3;?5^:^C>0M7^2^8^^NsEBF63U1>^A^CNdMH^B^?^TNE^J=G^L^qEJ^D^8CK^@^F^M^|0C^N^=^B=L79CT^/MW^P^rES^Y^QO>_<_ _ioe_i_g_c_d_h_f_nin_k_j_m_tfo_ucmb>3AF>{Nj_y@f_k_l1i_aGe_h_H>QHl_Q59`:`$8HH;`86=`?`>`@`Q8A`i6@A}9C`D`B`m7IHc`~`i`=8e5f`}M0NvBh`j`VNW6|HJGk`m`p`l`o`j8M1q`p?n`\Nt`$tr`u`g`s`<:v a-a.a0a h-i>aVHAaBa[0v>GaDamFCa&5JaEaFaIaHa%IBAAA?5KaLaMaOaNaV1WahHQaSaUa>?VaTa@YaXaZa&[aKD]a!N\aiAbadaeaTCca`a^a_aaahafagaiakalamanajapaoaqaENtarasab4~LJJvauawaxa|ayaza{a}a~a!b"b#b/HPE$brG4I%b&b*E'3D9'b(b)b); b*b,b-biH.b/bis0b1b2b.;3bVG_KN1W14b6b5bpE9@9]7bAL8bF4WH9b:b;b\LUL>DjA=bb=J>@b?b>b}HG4)8FbCb??2LBbDbEbAbGbHb/Dc4eCIbJbMbg?DFNbSKKbLbQbPbObSbRbTbVbUbMJV=FNWb7FXbYb]b[b\bZb^b_b`bab7LbbpLcbNCjGk6;Cdb:6P@eb=:fbgb&8U:ibVEV:N5$KKGWE\9kbK>2NE9'8#Hmbobk8nbvDqb73lbjH01l:ROpbrbKJY@tbubsbN3{bzb'ÃŒA'c&c(chbjb*c)c(ckHEAAcBciGA??caC@cN>\0)5CcxDDcG@-L#IEcFcUCGNHcGcoScO3Ucj7f5Vcu6Wc|@MF`@u:XcbCkAZc\cYc[c"7]c&7g5RM_c`c.1ccv3bcacec^cfc)NgchctTjcickclc5NmcopO>ncocW=8Fpc(Cqcxcyc Ezc^3Z?dI|chBwc{c}c{:&d.I&HyEZ6%d#d5H~c^C{EzEv:8d(d*d-d.d d,d)d'd!dOJU25d2d7d6dsG'L;;0d9d4d3d/d1dI4=C}@"H>d$Ha@;dOH?dSJ[C:djdhdfdndmdldkdodpd:@qdsdrdR88Aud|Etdvd5JlAG9wdHNydzd{d|de;}dO7j5*5!esLH9~d$efL0:)e*=>8HA%e e&eP7.e2ek7-e6eJ9mMC?e=0JL>e[6lHmAPNo=neHe~@DeIeKeyDNeJeTJK4KL^0Me}NLeo1lFOeVePeWeSe{GJf;fO)HkfS>*IlfjfN4T8h;nH*8CKofmfN9O9i0h:YG_0tf@CXG[Bvfrfufpfsf&KU8}0qfxfyf9F;6&g=Gi;G1D#g"g~fU?eI%g$gP9SO5g)g*gpg22Eg@gAgBg!BDgCgFgGgHgC?i2IgWN h0h|GiM9hOhGh{?F5]6Bh[2T>EhZ:QEJhnJAhZ2V8)IKh?hHhRhChDh:FIhFh(KLh`0@hNhMhkGTh_h~3bhPhUhnM^hUM*NxCk3rIdh!F10]hYhrASh[h`h,G*0XhahxI\hWhU>/=,ehjhsAfhmh_CnhVMch83ihlh,Lohhhkh)K!OshzhrhCI6$iyI}hVh|hOO"FsI i1i2i%ivG/i'i)i3i(i,ir1eF-i0i&i&A*i';E?07tLyLr=7i5iNO4iuM6i8i9ii@i?i1]"]EiDivMj@j?jBjAjZiFjCjDjEjGjl7IjHj0=T9'^JjQ=93KjR1W>LjU9Mja0=INjj?UjRjoCSjPj^6OjVj67^B\jXj5BWjZjQj[j]joHYj^j`jS8TjA0_j[:vNajbjuA"Ncj5MdjejdJfj@:#NkjljX>jjgMgjij=@~?hjmj#Jojnjl3 Kpj|jrjsjtjujyjzjxjvjqjwj{j7p(2~j_6}j"k!k$k#k%k1=&k'k(k>@WM)k$JFG*k k 8,5,kk;AG-kP3.k0kwM/kF?1k2k3kQ44k5k6k7kQ38k9k:kr2(?;kkW7V?Ak$F@k17?kwB-5BkCkY>m7Dk,K_@v5uLJAEkG?pCZ>FkIkJk>:BBHk[>>IGkl;S1NkX7n;m;MOMkLk'AM5CO:3\>KkPkQkOkX8@Mo;'GTk@@BC6MWkl8?@SkXkm8UkVkRkb@IF/C]2pHC54D[kYkLCA@R4Zk[?JN@O\kgk5Dfkckkkdk`k|D_k]k!Mp;ak^kekt=A8zBEKZ1b0%FikhkfFmkbklknk,8jkV9U$ln8%l&l>;NZ'l(l2=)l*l l,l-l C.l0l/l&F1l-K2l3l4l5lZF]>6lk9.P7l8l?I9lAl:ll?l@lBl-3gDiIb:W9OI_2NHElS4U@DlIlyCcLGlHl.5JlcG_BqH=EFlGKl2Ll(OBDEOq;Kl1B\l(AxFPIOl?;r;^>eG-8NlMljIAm?m@m=mAmVEDmGm4n47;nRnPnQnTnSnz>UnVnWnPHS:a[9HKd6F="o$oS6EIby30o?:yAJD;3.o/oCD-o1o7o:o9o-E2o3o6o8o@6;o5o4o?o@oAo>o=ob>*F#1YN p.n*p.p,p-p/p0plN1p2pI@;H}?g4:Mm28=[85p4ps;6p3p(;:p-jVRw?8p%NqF 1c@6pnN9p@pBpAp?pCpDpzAb2Ep8LFpGp*O1[HpIpJpNpKpLpMpOpD@wLE@PpsHQpSsLLRpSpTpW3VpY?Wp$7Xp\pZp[ps3Yp]p^pH0_p`pd>apG5dpcpbpqk\JepfpgphpipjpZ4kplp#Gnp;2qppp$1A6GJ:D":`9g=\?sprpBMh4RH\F|?NN[7vpupKK,FP1wptpQIjMxpyp{pjB[3\3zpi428j4?E`N\8|p}p~p!q#q"qwI$q%q&q'q)q(q*qtHLf)?25 q,q,R;]SH{0;0t;0K~>-q_L.q\MB1A;/qn20q1q3q4q6q2q5q[47q8q9q:q;q=qq@qAqCqB6s3OGGqHqZCkFIq}GLBX1n6o6sCNqp6o2MqKqLqJqXqOqPqQqRqTqSqY=UqWq35Vq{A38YqMBZq-F[q`q^q]q_q\qbqaqdqC6cqeqfqhqgqiqkqjq|9lqmq0:r J8r;rr?rnK-;z:/A@rCrArDrq8BrErFrGrKr*;dBLrIrHrJr_7PrOrNr30ZrVrWrSrYrUrb3LOXrTrRrQr\r_r^r]rII[rs0`rbro3Mr71drcrar-CpKZNerfrgrhrir;Djr7Horkrlr1KDLPFprqr>Fnrmr*2yrxru1vrursr{3rr2sIO;skBm:?s@sAsBsCs48DsEs/

S%S'S(S)S S,S-S0S2S5SSBSLSKSYS[SaScSeSlSmSrSyS~S

S%S'S(S)S S,S-S0S2S5SSBSLSKSYS[SaScSeSlSmSrSyS~S

d d"d$d%d)d*d/d0d5d=d?dKdOdQdRdSdTdZd[d\d]d_d`dadcdmdsdtd{d}d

d d"d$d%d)d*d/d0d5d=d?dKdOdQdRdSdTdZd[d\d]d_d`dadcdmdsdtd{d}d

B"p"C"m"l"n"4"1"k"D""*!*$***#*)*!).*2*1*4*3*@*?*B*A*P*R*Q*T*X*S*,)c*b*e*d*r*0)N)" ! $ * # ) A). 2 1 4 3 @ ? B A C)P R Q T X S L)c b e d r P)s '*' %*% (*( * ,*, /*/ -*- 0*0 ")B)7*7 6*6 8*8 5*5 :*: ;*; =*= *> $)D)G*G E*E F*F D*E)&)F)H*H I*I G)J*J L*L K*K ))I)()H)M*M O*O N*N J) )K)W*W V*V -)M)Y*Y [*[ Z*Z \*\ ]*] _*_ ^*^ a*a `*` /)O)l*l i*i f*f k*k h*h j*j q*q t*t s*u*u w*w v*v &*& C*C U*U g*g p*p m*m o*o n*n 9 0"/"2"6"5"3"8"9"a&b&c&d&g&i&l&v&e&j&q&r&s&t&{&x&u&z&w&y&|&B'C'D'E'F'G'H'I'J'K'L'M'N'r's't'u'v'w'x'y'z'{'|'}'~'q"o"!0"0#0$0%0&0'0(0)0*0 0,0-0.0/000102030405060708090:0;00?0@0A0B0C0D0E0F0G0H0I0J0K0L0M0N0O0P0Q0R0S0T0U0V0W0X0Y0Z0[0\0]0^0`0a0b0c0d0e0f0g0h0i0j0k0l0m0n0o0p0_0q0r0s0t0u0v0w0x0y0z0{0|0}0~0!1"1#1$1%1&1'1(1)1*1 1,1-1.1/101112131415161718191:1;11?1@1A1B1C1D1E1F1G1H1I1J1K1L1M1N1O1P1Q1R1S1T1U1V1W1X1Y1Z1[1\1]1^1v1_1`1a1b1c1d1e1f1g1h1i1j1k1l1m1n1o1p1q1r1s1t1u1w1x1y1z1{1|1}1~1!2"2#2$2%2&2'2(2)2*2 2,2-2.2/202122232425262728292:2;22?2@2A2B2C2D2E2Q2F2G2H2I2J2K2L2M2N2O2P2R2S2T2U2V2W2X2Y2Z2[2\2]2^2_2`2a2b2c2d2e2f2g2h2i2j2k2l2m2n2o2p2q2r2s2t2u2v2w2x2y2z2{2|2}2~2!3"3#3$3%3&3'3(3)3*3 3,3-3.3/303132333435363738393:3;33?3@3A3B3C3D3E3F3G3H3I3J3K3L3M3N3O3P3Q3R3S3T3U3V3W3X3Y3Z3[3\3]3^3_3`3a3b3c3d3e3f3g3h3i3j3k3l3m3n3o3p3q3r3s3t3u3v3w3x3y3z3{3|3}3~3!4"4#4$4%4&4'4(4)4*4 4,4-4.4/404142434445464847494:4;44?4@4A4B4C4D4E4F4G4H4I4J4K4L4M4N4O4P4Q4R4S4T4U4V4W4X4Y4Z4[4\4]4^4_4`4a4b4c4d4e4f4g4h4i4j4k4l4m4n4o4p4q4r4s4t4u4v4w4x4y4z4{4|4}4~4!5"5#5$5%5&5'5(5)5*5 5,5-5.5/505152535455565758595:5;55?5@5A5B5C5D5E5F5G5H5I5J5K5L5M5N5O5P5Q5R5S5T5U5V5W5X5Y5Z5[5\5]5^5_5`5a5b5c5d5e5f5g5h5i5j5k5l5m5n5o5p5q5r5s5t5u5v5w5x5y5z5{5|5}5~5!6"6#6$6%6&6'6(6)6*6 6,6-6.6/606162636465666768696:6;66?6@6A6B6C6D6E6F6G6H6I6J6K6L6M6N6O6P6Q6R6S6T6U6V6W6X6Y6Z6[6\6]6^6_6`6a6b6c6d6e6f6g6h6i6j6k6l6m6p6q6n6o6r6s6t6u6v6w6x6y6z6{6}6~6|6!7"7#7$7%7&7'7(7)7*7 7,7-7.7/707172737475767778797:7;77?7@7A7B7C7D7E7F7G7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V7W7`7X7Y7Z7[7\7]7^7_7a7b7c7d7e7f7g7h7i7j7k7l7m7~7n7o7p7q7r7s7t7u7v7w7x7y7z7{7|7}7!8"8#8$8%8&8'8(8)8*8 8,8-8.8/808182838485868788898:8;88?8@8A8B8C8D8E8F8G8H8I8J8K8L8M8N8P8Q8O8R8S8T8U8V8W8X8Y8Z8[8\8]8^8_8`8a8b8c8d8e8g8h8i8j8k8l8m8n8o8p8q8r8s8t8u8v8w8x8y8z8{8|8}8~8!9"9#9$9%9&9'9(9)9*9 9,9-9.9/909192939495969798999:9;99?9@9A9B9C9D9E9F9G9H9I9J9K9L9M9N9O9P9Q9R9S9T9U9V9W9X9Y9Z9[9\9]9^9_9`9a9b9c9d9e9f9g9h9i9j9k9l9m9n9o9p9q9r9s9t9u9v9w9x9y9z9{9|9}9~9!:":#:$:%:&:':(:):*: :,:-:.:/:0:1:3:4:5:6:7:8:2:9:::;:<:>:?:@:A:B:C:D:E:F:G:H:I:J:K:L:M:N:O:P:Q:R:S:T:U:V:W:X:Y:Z:[:\:]:^:_:`:a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:w:x:y:z:{:|:}:~:!;";#;$;%;&;';(;);*; ;,;-;.;/;0;1;2;3;4;5;6;7;8;9;:;;;=;;?;@;A;B;C;D;E;G;H;I;J;F;K;L;M;N;O;P;Q;R;S;W;U;T;V;X;Y;Z;[;\;];^;_;`;a;b;c;d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;tfs;t;u;v;w;x;z;y;{;|;};~;!=?=@=A=B=C=D=E=F=G=H=I=J=K=L=M=N=O=P=Q=R=S=T=U=V=W=X=Y=Z=[=\=]=^=_=`=a=b=c=d=e=f=g=h=i=j=k=l=m=n=o=p=q=r=s=t=u=v=w=x=y=z={=|=}=~=!>">#>$>%>&>'>(>)>*> >,>->.>/>0>1>2>3>4>5>6>7>8>9>:>;>=>>>?>@>A>B>C>D>E>F>G>H>I>J>K>L>M>N>O>P>Q>R>S>T>U>V>W>X>Y>Z>[>\>]>^>_>`>a>b>c>d>e>f>g>h>i>j>k>l>m>n>o>p>q>r>s>t>u>v>w>x>y>z>{>~>|>}>!?"?#?$?%?&?'?(?)?*? ?,?-?.?/?0?1?2?3?4?5?6?7?8?9?:?;?=?>???@?A?B?C?D?E?F?G?H?I?J?K?L?M?N?O?P?Q?R?S?T?U?V?W?X?Y?Z?[?\?]?^?_?`?a?b?c?d?e?f?g?h?i?j?k?l?m?n?o?p?q?r?s?t?u?v?w?x?y?z?{?|?}?~?!@"@#@$@%@&@'@(@)@*@ @,@-@.@/@0@1@2@3@4@5@6@7@8@9@:@;@@?@@@A@B@C@D@E@F@G@H@I@J@K@L@M@N@O@P@Q@R@S@T@U@V@W@X@Y@Z@[@\@]@^@_@`@a@b@c@d@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@{@|@}@~@!A"A#A$A%A&A'A(A)A*A A,A-A.A/A0A1A2A3A4A5A6A7A8A9A:A;AA?A@AAABACADAEAFAGAHAIAJAKALAMANAOAPAQARASATAUAVAWAXAYAZA[A\A]A^A_A`AaAbAcAdAeAfAgAhAiAjAkAlAmAnAoApAqArAsAtAuAvAwAxAyAzA{A|A}A~A!B"B#B$B%B&B'B(B)B*B B,B-B.B0B/B1B2B3B4B5B7B6B8B9B:B;BB@BABBBDBEBGBHBIBJBLBCBFBKBMBNBOBPBQBRBSBTBUBVBWBXBYBZB[B\B]B^B_B`BaBbBcBdBeBfBgBhBiBjBkBlBmB?BnBoBpBqBrBsBtBuBvBwBxByBzB{B|B}B~B!C"C#C$C%C&C'C(C)C*C C,C-C.C/C0C1C2C3C4C5C6C7C9C:C;CC?C@CACBCCCDCECFCGCHC8CJCKCLCMCOCNCPCQCRCSCTCUCVCWCXCYCZC[CIC\C]C^C_C`CaCbCcCdCeCfCgChCiCjCkClCmCnCoCpCqCrCsCtCuCvCwCxCyCzC{C|C}C~C!D"D#D$D%D&D'D(D)D*D D,D-D.D/D0D1D2D3D4D5D6D7D8D9D:D;DD?D@DADBDCDDDEDFDGDHDIDJDKDLDMDNDODPDQDRDSDTDUDVDWDXDYDZD[D\D]D^D_D`DaDbDcDdDeDfDgDhDiDjDkDlDmDnDoDpDqDrDsDtDuDvDwDxDyDzD{D|D}D~D!E"E#E$E%E&E'E(E)E*E E,E-E.E/E0E1E2E3E4E5E6E7E8E9E:E;EE?E@EAEBECEDEEEFEGEHEIEJEKEMELENEOEPEQERESETEUEVEWEXEYEZE[E\E]E^E_E`EaEbEcEdEeEfEgEhEiEjEkElEmEnEoEpEqErEsEtEuEvEwExEyEzE{E|E}E~E!F"F#F$F%F&F'F(F)F*F F,F-F.F/F0F1F2F3F4F5F6F7F8F9F:F;FF?F@FAFBFCFDFEFFFGFHFIFJFKFLFMFNFOFPFQFRFSFTFUFVFWFXFYFZF[F\F]F^F_F`F6GaFbFcFdFeFfFgFhFiFjFkFlFmFnFoFpFqFrFsFtFuFvFwFxFyFzF{F|F}F~F!G"G#G$G%G&G'G(G)G*G G,G-G.G/G0G1G2G3G4G5G7G8G9G:G;GG?G@GAGBGCGDGEGFGGGHGIGJGKGLGMGNGOGPGQGRGSGTGUGVGWGXGYGZG[G\G]G^G_G`GaGbGcGdGeGfGgGhGiGjGkGlGmGnGoGpGqGrGsGtGuGvGwGxGyGzG{G|G}G~G!H"H#H$H%H&H'H(H)H*H H,H-H.H/H0H1H2H3H4H5H6H7H8H9H:H;HH?H@HAHBHCHDHEHFHGHHHIHJHKHLHSHMHNHOHPHQHRHTHUHVHWHXHYHZH[H\H]H^H_H`HaHbHcHdHeHfHgHhHiHjHkHlHmHnHoHpHqHrHsHtHuHvHwHxHyHzH{H|H}H~H!I"I#I$I%I&I'I(I)I*I I,I-I.I/I0I1I2I3I4I5I6I7I8I9I:I;II?I@IBICIDIEIFIGIHIIIJIKILIMINIOIPIQIRISITIUIVIWIXIYIZI[I\I]I^I_I`IaIbIcIdIeIfIgIhIiIjIkIlImInIoIpIqIrIsItIuIvIwIxIyIzI{I|I}I~I!J"J#J$J%J&J'J(J)J*J J,J-J.J/J0J1J2J3J4J5J6J7J8J9J:J;JJ?J@JAJBJCJDJEJFJGJHJIJJJKJLJMJNJOJPJQJRJSJTJUJVJWJXJYJZJ[J\J]J^J_J`JaJbJcJdJeJfJgJhJiJjJkJlJmJnJoJpJqJrJsJtJuJvJwJxJyJzJ{J|J}J~J!K"K#K$K%K&K'K(K)K*K K,K-K.K/K0K1K2K3K4K5K6K7K8K9K:K;KK?K@KAKBKCKDKEKFKGKHKIKJKKKLKMKNKOKPKQKRKSKTKUKVKWKXKYKZK[K\K]K^K_K`KaKbKcKdKeKfKgKhKiKjKkKlKmKnKoKpKqKrKsKtKuKvKwKxKyKzK{K|K}K~K!L"L#L$L%L&L'L(L)L*L L,L-L.L/L0L1L2L3L4L5L6L7L8L9L:L;LL?L@LALBLCLDLELFLGLHLILJLKLLLMLNLOLPLQLRLSLTLULVLWLXLYLZL[L\L]L^L_L`LaLbLcLdLeLfLgLhLiLjLkLlLmLnLoLpLqLrLsLtLuLvLwLxLyLzL{L|L}L~L!M"M#M$M%M&M'M(M)M*M M,M-M.M/M0M1M2M3M4M5M6M7M8M9M:M;MM?M@MAMBMCMDMEMFMGMHMIMJMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYMZM[M\M]M^M_M`MaMbMcMdMeMfMgMhMiMjMkMlMmMnMoMpMqMrMsMtMuMvMwMxMyMzM{M|M}M~M!N"N$N%N&N'N(N)N#N*N N,N-N.N/N0N1N2N3N4N5N6N7N8N9N:N;NN?N@NANBNCNDNENFNGNHNINJNKNLNMNNNONPNQNRNSNTNUNVNWNXNYNZN[N\N]N^N_N`NaNbNcNdNeNfNgNhNiNjNkNlNmNnNoNpNqNrNsNtNuNvNwNxNyNzN{N|N}N~N!O"O#O$O%O&O'O(O)O*O O,O-O.O/O0O1O2O3O4O5O6O7O8O9O:O;OO?O@OAOBOCODOEOFOGOHOIOJOKOLOMONOOOPOQOROSOTOUOVOWOXOYOZO[O\O]O^O_O`OaObOcOdOeOfOgOhOiOjOkOlOmOnOoOpOqOrOtOuOvOsOwOxOyOzO{O|O}O~O!P"P#P$P%P&P'P(P)P*P P,P.P/P0P1P-P2P3P4P5P7P8P9P:P;P6P
P?P@PAPBPCPDPEPFPGPHPIPJPKPLPMPNPOPPPQPRPSPTPUPVPWPXPYPZP[P\P]P^P_P`PaPbPcPdPePfPgPhPiPjPkPlPmPnPoPpPqPrPsPtPuPvPwPxPyPzP{P|P}P~P!Q"Q#Q$Q%Q&Q'Q(Q)Q*Q Q,Q-Q.Q/Q0Q1Q2Q3Q4Q5Q6Q7Q8Q9Q:Q;QQ?Q@QAQBQCQDQEQFQGQHQIQJQKQLQMQNQOQPQQQRQSQTQUQVQWQXQYQZQ[Q\Q]Q^Q_Q`QaQbQcQdQeQfQgQhQiQjQkQlQmQnQoQpQqQrQsQtQuQvQwQxQyQzQ{Q|Q}Q~Q!R"R#R$R%R&R'R(R)R*R R,R-R.R/R0R1R2R3R4R5R6R7R8R9R:R;RR?R@RARBRCRDRERFRGRHRIRJRKRLRMRNRORPRQRRRSRTRURVRWRXRYRZR[R\R]R^R_R`RaRbRcRdReRfRgRhRiRjRkRlRmRnRoRpRqRrRsRtRvRwRxRuRyRzR{R|R}R~R!S"S#S$S%S&S'S(S)S*S S,S-S.S/S0S1S2S3S4S5S6S7S8S9S:S;SS?S@SASBSCSDSESFSGSHSISJSKSLSMSNSOSPSQSRSSSTSUSVSWSXSYSZS[S\S]S^S_S`SaSbScSdSeSfSgShSiSjSkSlSmSnSoSpSqSrSsStSuSvSwSxSySzS{S|S}S~S!T"T#T$T%T&T'T(T)T*T T,T-T.T/T0T1T2T4T5T6T7T8T9T:T;TT3T?T@TATBTCTDTETFTGTHTITJTKTLTMTNTOTPTQTRTSTTTUTVTWTXTYTZT[T\T]T^T_T`TaTbTcTdTeTfTgThTiTjTlTkTmTnToTpTqTrTsTtTuTvTwTxTyTzT{T|T}T~T!U"U#U$U%U&U'U(U)U*U U,U-U.U/U0U1U2U3U4U5U6U7U8U9U:U;UU?U@UAUBUCUDUEUFUGUHUIUJUKULUMUNUOUPUQURUSUTUUUVUWUXUYUZU[U\U]U^U_U`UaUbUcUdUeUfUgUhUiUjUkUlUmUnUoUpUqUrUsUtUuUvUwUxUyUzU{U|U}U~U!V"V#V$V%V&V'V(V)V*V V,V-V.V/V0V1V2V3V4V5V6V7V8V9V:V;VV?V@VAVBVCVDVEVGVHVIVJVKVFVLVMVNVOVPVQVRVSVTVVVWVXVUVYVZV[V\V]V^V_V`VaVbVcVdVeVfVgVhViVjVkVlVmVnVoVpVqVrVsVtVuVvVwVxVyVzV{V|V}V~V!W"W#W$W%W&W'W(W)W*W W,W-W.W/W0W1W2W3W4W5W6W7W8W9W:W;WW?W@WAWBWCWDWEWFWGWHWIWJWKWLWMWNWOWPWQWRWSWTWUWVWWWXWYWZW[W\W]W^W_W`WaWbWdWeWfWgWhWiWjWkWlWmWnWoWpWqWrWsWtWuWvWwWxWyW>XcWzW{W|W}W~W!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X2X3XLX4X5X6X7X8X9X:X;XY?Y@YAYBYCYDYEYFYGYHYIYJYKYLYMYNYOYPYQYRYSYTYUYVYWYXYYYZY[Y\Y]Y^Y_Y`YaYbYcYdYeYfYtYgYhYiYjYkYlYmYnYoYpYqYrYsYuYvYwYxYyYzY{Y|Y}Y~Y!Z"Z#Z$Z%Z&Z'Z(Z)Z*Z Z,Z-Z.Z/Z0Z1Z2Z3Z4Z5Z6Zf87Z8Z9Z:Z;ZZ?Z@ZAZBZCZDZEZFZGZHZIZJZKZmZLZMZNZOZPZQZRZSZTZUZVZWZXZYZZZ[Z\Z]Z^Z_Z`ZaZbZcZdZeZfZgZhZiZjZkZlZnZoZpZqZrZsZtZuZvZwZxZyZzZ{Z|Z}Z~Z!["[#[$[%[&['[([)[*[ [,[-[.[/[0[1[2[3[4[5[6[7[8[9[:[;[[?[@[A[B[C[D[E[F[G[H[I[J[K[L[M[N[O[P[Q[R[S[T[U[V[W[X[Y[Z[[[\[][^[_[`[a[b[c[d[e[f[g[h[i[j[k[l[m[n[p[q[r[s[o[t[u[v[w[x[y[z[{[|[}[~[!\"\#\$\%\&\'\*\ \,\-\.\/\0\1\2\3\4\5\6\7\8\9\:\;\\?\@\A\B\C\D\E\F\G\H\I\J\K\L\M\N\O\P\Q\R\S\T\U\V\W\X\Y\Z\[\\\]\^\_\`\a\b\c\d\e\f\g\h\i\j\k\l\m\n\o\p\q\r\s\t\u\v\w\x\y\z\{\|\}\~\!]"]#]$]%]&]'](])]*] ],]-].]/]0]1]2]3]4]5]6]7]8]9]:];]]?]@]A]B]C]D]E]F]G]H]I]J]K]L]M]N]O]P]Q]R]S]T]U]V]W]X]Y]Z][]\]]]^]_]`]a]b]c]d]e]f]g]h]i]j]k]l]m]n]o]p]q]r]s]t]u]v]w]x]y]z]{]|]}]~]!^"^#^$^%^&^'^(^)^*^ ^,^-^.^/^0^1^2^3^4^5^6^7^8^9^?^:^;^^@^A^B^C^D^E^F^G^H^I^N^J^K^L^M^O^P^Q^R^S^T^U^V^W^X^Y^Z^[^\^]^^^_^`^a^b^c^d^e^f^g^h^i^j^k^l^m^n^o^r^p^q^s^t^u^v^w^x^y^z^{^|^}^~^!_"_#_$_%_&_'_(_)_*_ _,_-_._/_0_2_1_3_4_5_6_7_8_9_:_;_<_>_?_@_A_B_C_D_E_F_G_H_I_J_K_L_M_N_O_P_Q_R_S_T_U_V_W_X_Y_Z_[_\_]_o_^___`_a_b_c_d_e_f_g_h_i_j_k_l_m_n_p_q_r_s_t_u_v_w_x_y_z_{_|_}_~_!`"`#`$`%`&`'`(`)`*` `,`-`.`/`0`1`2`3`4`5`6`7`8`9`:`;``?`@`A`B`C`D`E`F`G`H`I`J`K`L`M`N`O`P`Q`R`S`T`U`V`W`X`Y`Z`[`\`]`d`^`_```a`b`c`e`f`g`h`i`j`k`l`m`n`o`p`q`r`s`t`u`v`w`x`y`z`{`|`}`~`!a"a#a$a%a&a'a(a)a*a a,a-a.a/a0a1a2a3a4a5a6a7a8a9a:a;aa?a@aAaBaCaDaEaFaGaHaIaJaKaLaMaNaOaPaQaRaTaUaVaSaWaXaYaZa[a\a]a^a_a`aaabacadaeafagahaiajakalamanaoapaqarasatauavawaxayaza{a}a~a!b"b#b$b|a-b%b&b'b(b)b*b b,b/b0b1b2b.b3b4b5b6b7b8b9b:b;bb?b@bAbBbCbEbFbDbGbHbIbJbKbLbMbNbObPbQbRbSbTbUbVbWbXbYbZb[b\b]b^b_b`babbbcbdbebfbgbhbibjbkblbmbnbobpbqbrbsbtbubvbwbxbybzb{b|b}b~b!c"c#c$c%c&c'c(c)c*c c,c-c.c/c0c1c2c3c4c5c6c7c8c9c:c;cc?c@cAcBcCcDcEcFcGcHcIcJcKcLcMcNcOcPcQcRcScTcUcVcWcXcYcZc[c\c]c^c_c`cacbcccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczc{c|c}c~c!d"d#d$d%d&d'd(d)d*d d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~d!e"e#e$e%e&e'e(e)e*e e,e-e.e/e0e1e2e3e4e5e;e6e7e8e9e:ee?e@eAeBeCeDeEeFeGeHeIeJeKeLeMeOePeNeQeReSeTeUeVeWeXeYeZe[e\e]e^e_e`eaebecedeeefehegeiejekelemeneoepeqereseteuevewexeyeze|e{e}e~e!f"f#f$f%f&f'f(f)f*f f,f-f.f/f0f1f2f3f4f5f6f7f8f9f:f;ff?f@fAfBfCfDfEfFfGfHfIfJfKfLfMfNfOfPfQfRfSfTfUfVfWfXfYfZf[f\f]f^f_f`fafbfcfdfefffgfhfifjfkflfmfnfofpfqfrfsfufvfwfxfyfzf{f|f}f~f!g"g#g$g%g&g'g(g)g*g g,g-g.g/g0g1g2g3g4g5g6g7g8g9g:g;gg?g@gAgBgCgDgEgFgGgHgIgJgKgLgMgNgOgPgQgRgSgTgUgVgWgXgYgZg[g\g]g^g_g`gagbgcgdgegfgjggghgigkglgmgngogpgqgrgsgtgvgwgxgygugzg{g|g}g(h~g!h"h#h$h%h&h'h)h*h h,h-h.h/h0h1h2h3h4h5h6h7h8h9h:h;hh?h@hAhBhChDhEhFhGhHhIhJhKhLhMhNhOhPhQhRhShThUhVhWhXhYhZh[h\h]h^h_h`hahbhchdhehfhghhhihjhkhlhmhnhohphqhrhshthuhvhwhxhyhzh{h|h}h~h!i"i#i$i%i&i'i(i)i*i i,i-i.i/i0i1i2i3i4i5i6i7i8i9i:i;ii?i@iAiBiCiDiEiFiGiHiIiJiLiMiKiNiOiPiQiRiSiTiUiViWiXiYiZi[i\i]i^i_i`iaibicidieifigihiiijikiliminioipiqirisitiuiviwixiyizi{i|i}i~i!j"j#j$j%j&j'j(j)j*j j,j-j.j/j0j1j2j3j4j5j6j7j8j9j:j;jj?j@jAjBjCjDjEjFjGjHjIjJjKjLjMjNjOjPjQjRjSjTjUjVjWjXjYjZj[j\j]j^j_j`jajbjcjdjejfjgjhjijjjkjljmjnjojpjqjrjsjtjujvjwjxjyjzj{j|j}j~j!k"k#k$k%k&k'k(k)k*k k,k-k.k/k0k1k2k3k4k5k6k7k8k9k:k;kk?k@kAkBkCkDkEkFkGkHkIkPkJkKkLkMkRkNkOkQkSkTkUkVkWkXkYkZk[k\k^k]k_k`kakbkckdkekfkgkhkikjkkkmknkoklkpkqkrksktkvkukwkxkykzk{k|k}k~k!l"l#l$l%l&l'l(l)l*l l,l-l.l/l0l1l2l3l4l5l6l7l8l9l:l;ll?l@lAlBlClDlElFlGlHlIlJlKlLlNlOlMlPlQlRlSlTlUlVlWlXlYlZl[l\l]l^l_l`lalblcldlelflglhliljlklllmlnlolplqlrlsltlulvlwlxlylzl{l|l}l~l!m"m#m$m%m&m'm(m)m*m m,m-m.m/m0m1m2m3m4m5m6m7m8m9m:m;mm?m@mAmBmCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWmXmYmZm[m\m]m^m_m`mambmcm7"

B"p"C"m"l"n"4"1"k"D""*!*$***#*)*!).*2*1*4*3*@*?*B*A*P*R*Q*T*X*S*,)c*b*e*d*r*0)N)" ! $ * # ) A). 2 1 4 3 @ ? B A C)P R Q T X S L)c b e d r P)s '*' %*% (*( * ,*, /*/ -*- 0*0 ")B)7*7 6*6 8*8 5*5 :*: ;*; =*= *> $)D)G*G E*E F*F D*E)&)F)H*H I*I G)J*J L*L K*K ))I)()H)M*M O*O N*N J) )K)W*W V*V -)M)Y*Y [*[ Z*Z \*\ ]*] _*_ ^*^ a*a `*` /)O)l*l i*i f*f k*k h*h j*j q*q t*t s*u*u w*w v*v &*& C*C U*U g*g p*p m*m o*o n*n 9 0"/"2"6"5"3"8"9"a&b&c&d&g&i&l&v&e&j&q&r&s&t&{&x&u&z&w&y&|&B'C'D'E'F'G'H'I'J'K'L'M'N'r's't'u'v'w'x'y'z'{'|'}'~'q"o"!0"0#0$0%0&0'0(0)0*0 0,0-0.0/000102030405060708090:0;00?0@0A0B0C0D0E0F0G0H0I0J0K0L0M0N0O0P0Q0R0S0T0U0V0W0X0Y0Z0[0\0]0^0`0a0b0c0d0e0f0g0h0i0j0k0l0m0n0o0p0_0q0r0s0t0u0v0w0x0y0z0{0|0}0~0!1"1#1$1%1&1'1(1)1*1 1,1-1.1/101112131415161718191:1;11?1@1A1B1C1D1E1F1G1H1I1J1K1L1M1N1O1P1Q1R1S1T1U1V1W1X1Y1Z1[1\1]1^1v1_1`1a1b1c1d1e1f1g1h1i1j1k1l1m1n1o1p1q1r1s1t1u1w1x1y1z1{1|1}1~1!2"2#2$2%2&2'2(2)2*2 2,2-2.2/202122232425262728292:2;22?2@2A2B2C2D2E2Q2F2G2H2I2J2K2L2M2N2O2P2R2S2T2U2V2W2X2Y2Z2[2\2]2^2_2`2a2b2c2d2e2f2g2h2i2j2k2l2m2n2o2p2q2r2s2t2u2v2w2x2y2z2{2|2}2~2!3"3#3$3%3&3'3(3)3*3 3,3-3.3/303132333435363738393:3;33?3@3A3B3C3D3E3F3G3H3I3J3K3L3M3N3O3P3Q3R3S3T3U3V3W3X3Y3Z3[3\3]3^3_3`3a3b3c3d3e3f3g3h3i3j3k3l3m3n3o3p3q3r3s3t3u3v3w3x3y3z3{3|3}3~3!4"4#4$4%4&4'4(4)4*4 4,4-4.4/404142434445464847494:4;44?4@4A4B4C4D4E4F4G4H4I4J4K4L4M4N4O4P4Q4R4S4T4U4V4W4X4Y4Z4[4\4]4^4_4`4a4b4c4d4e4f4g4h4i4j4k4l4m4n4o4p4q4r4s4t4u4v4w4x4y4z4{4|4}4~4!5"5#5$5%5&5'5(5)5*5 5,5-5.5/505152535455565758595:5;55?5@5A5B5C5D5E5F5G5H5I5J5K5L5M5N5O5P5Q5R5S5T5U5V5W5X5Y5Z5[5\5]5^5_5`5a5b5c5d5e5f5g5h5i5j5k5l5m5n5o5p5q5r5s5t5u5v5w5x5y5z5{5|5}5~5!6"6#6$6%6&6'6(6)6*6 6,6-6.6/606162636465666768696:6;66?6@6A6B6C6D6E6F6G6H6I6J6K6L6M6N6O6P6Q6R6S6T6U6V6W6X6Y6Z6[6\6]6^6_6`6a6b6c6d6e6f6g6h6i6j6k6l6m6p6q6n6o6r6s6t6u6v6w6x6y6z6{6}6~6|6!7"7#7$7%7&7'7(7)7*7 7,7-7.7/707172737475767778797:7;77?7@7A7B7C7D7E7F7G7H7I7J7K7L7M7N7O7P7Q7R7S7T7U7V7W7`7X7Y7Z7[7\7]7^7_7a7b7c7d7e7f7g7h7i7j7k7l7m7~7n7o7p7q7r7s7t7u7v7w7x7y7z7{7|7}7!8"8#8$8%8&8'8(8)8*8 8,8-8.8/808182838485868788898:8;88?8@8A8B8C8D8E8F8G8H8I8J8K8L8M8N8P8Q8O8R8S8T8U8V8W8X8Y8Z8[8\8]8^8_8`8a8b8c8d8e8g8h8i8j8k8l8m8n8o8p8q8r8s8t8u8v8w8x8y8z8{8|8}8~8!9"9#9$9%9&9'9(9)9*9 9,9-9.9/909192939495969798999:9;99?9@9A9B9C9D9E9F9G9H9I9J9K9L9M9N9O9P9Q9R9S9T9U9V9W9X9Y9Z9[9\9]9^9_9`9a9b9c9d9e9f9g9h9i9j9k9l9m9n9o9p9q9r9s9t9u9v9w9x9y9z9{9|9}9~9!:":#:$:%:&:':(:):*: :,:-:.:/:0:1:3:4:5:6:7:8:2:9:::;:<:>:?:@:A:B:C:D:E:F:G:H:I:J:K:L:M:N:O:P:Q:R:S:T:U:V:W:X:Y:Z:[:\:]:^:_:`:a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:w:x:y:z:{:|:}:~:!;";#;$;%;&;';(;);*; ;,;-;.;/;0;1;2;3;4;5;6;7;8;9;:;;;=;;?;@;A;B;C;D;E;G;H;I;J;F;K;L;M;N;O;P;Q;R;S;W;U;T;V;X;Y;Z;[;\;];^;_;`;a;b;c;d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;tfs;t;u;v;w;x;z;y;{;|;};~;!=?=@=A=B=C=D=E=F=G=H=I=J=K=L=M=N=O=P=Q=R=S=T=U=V=W=X=Y=Z=[=\=]=^=_=`=a=b=c=d=e=f=g=h=i=j=k=l=m=n=o=p=q=r=s=t=u=v=w=x=y=z={=|=}=~=!>">#>$>%>&>'>(>)>*> >,>->.>/>0>1>2>3>4>5>6>7>8>9>:>;>=>>>?>@>A>B>C>D>E>F>G>H>I>J>K>L>M>N>O>P>Q>R>S>T>U>V>W>X>Y>Z>[>\>]>^>_>`>a>b>c>d>e>f>g>h>i>j>k>l>m>n>o>p>q>r>s>t>u>v>w>x>y>z>{>~>|>}>!?"?#?$?%?&?'?(?)?*? ?,?-?.?/?0?1?2?3?4?5?6?7?8?9?:?;?=?>???@?A?B?C?D?E?F?G?H?I?J?K?L?M?N?O?P?Q?R?S?T?U?V?W?X?Y?Z?[?\?]?^?_?`?a?b?c?d?e?f?g?h?i?j?k?l?m?n?o?p?q?r?s?t?u?v?w?x?y?z?{?|?}?~?!@"@#@$@%@&@'@(@)@*@ @,@-@.@/@0@1@2@3@4@5@6@7@8@9@:@;@@?@@@A@B@C@D@E@F@G@H@I@J@K@L@M@N@O@P@Q@R@S@T@U@V@W@X@Y@Z@[@\@]@^@_@`@a@b@c@d@e@f@g@h@i@j@k@l@m@n@o@p@q@r@s@t@u@v@w@x@y@z@{@|@}@~@!A"A#A$A%A&A'A(A)A*A A,A-A.A/A0A1A2A3A4A5A6A7A8A9A:A;AA?A@AAABACADAEAFAGAHAIAJAKALAMANAOAPAQARASATAUAVAWAXAYAZA[A\A]A^A_A`AaAbAcAdAeAfAgAhAiAjAkAlAmAnAoApAqArAsAtAuAvAwAxAyAzA{A|A}A~A!B"B#B$B%B&B'B(B)B*B B,B-B.B0B/B1B2B3B4B5B7B6B8B9B:B;BB@BABBBDBEBGBHBIBJBLBCBFBKBMBNBOBPBQBRBSBTBUBVBWBXBYBZB[B\B]B^B_B`BaBbBcBdBeBfBgBhBiBjBkBlBmB?BnBoBpBqBrBsBtBuBvBwBxByBzB{B|B}B~B!C"C#C$C%C&C'C(C)C*C C,C-C.C/C0C1C2C3C4C5C6C7C9C:C;CC?C@CACBCCCDCECFCGCHC8CJCKCLCMCOCNCPCQCRCSCTCUCVCWCXCYCZC[CIC\C]C^C_C`CaCbCcCdCeCfCgChCiCjCkClCmCnCoCpCqCrCsCtCuCvCwCxCyCzC{C|C}C~C!D"D#D$D%D&D'D(D)D*D D,D-D.D/D0D1D2D3D4D5D6D7D8D9D:D;DD?D@DADBDCDDDEDFDGDHDIDJDKDLDMDNDODPDQDRDSDTDUDVDWDXDYDZD[D\D]D^D_D`DaDbDcDdDeDfDgDhDiDjDkDlDmDnDoDpDqDrDsDtDuDvDwDxDyDzD{D|D}D~D!E"E#E$E%E&E'E(E)E*E E,E-E.E/E0E1E2E3E4E5E6E7E8E9E:E;EE?E@EAEBECEDEEEFEGEHEIEJEKEMELENEOEPEQERESETEUEVEWEXEYEZE[E\E]E^E_E`EaEbEcEdEeEfEgEhEiEjEkElEmEnEoEpEqErEsEtEuEvEwExEyEzE{E|E}E~E!F"F#F$F%F&F'F(F)F*F F,F-F.F/F0F1F2F3F4F5F6F7F8F9F:F;FF?F@FAFBFCFDFEFFFGFHFIFJFKFLFMFNFOFPFQFRFSFTFUFVFWFXFYFZF[F\F]F^F_F`F6GaFbFcFdFeFfFgFhFiFjFkFlFmFnFoFpFqFrFsFtFuFvFwFxFyFzF{F|F}F~F!G"G#G$G%G&G'G(G)G*G G,G-G.G/G0G1G2G3G4G5G7G8G9G:G;GG?G@GAGBGCGDGEGFGGGHGIGJGKGLGMGNGOGPGQGRGSGTGUGVGWGXGYGZG[G\G]G^G_G`GaGbGcGdGeGfGgGhGiGjGkGlGmGnGoGpGqGrGsGtGuGvGwGxGyGzG{G|G}G~G!H"H#H$H%H&H'H(H)H*H H,H-H.H/H0H1H2H3H4H5H6H7H8H9H:H;HH?H@HAHBHCHDHEHFHGHHHIHJHKHLHSHMHNHOHPHQHRHTHUHVHWHXHYHZH[H\H]H^H_H`HaHbHcHdHeHfHgHhHiHjHkHlHmHnHoHpHqHrHsHtHuHvHwHxHyHzH{H|H}H~H!I"I#I$I%I&I'I(I)I*I I,I-I.I/I0I1I2I3I4I5I6I7I8I9I:I;II?I@IBICIDIEIFIGIHIIIJIKILIMINIOIPIQIRISITIUIVIWIXIYIZI[I\I]I^I_I`IaIbIcIdIeIfIgIhIiIjIkIlImInIoIpIqIrIsItIuIvIwIxIyIzI{I|I}I~I!J"J#J$J%J&J'J(J)J*J J,J-J.J/J0J1J2J3J4J5J6J7J8J9J:J;JJ?J@JAJBJCJDJEJFJGJHJIJJJKJLJMJNJOJPJQJRJSJTJUJVJWJXJYJZJ[J\J]J^J_J`JaJbJcJdJeJfJgJhJiJjJkJlJmJnJoJpJqJrJsJtJuJvJwJxJyJzJ{J|J}J~J!K"K#K$K%K&K'K(K)K*K K,K-K.K/K0K1K2K3K4K5K6K7K8K9K:K;KK?K@KAKBKCKDKEKFKGKHKIKJKKKLKMKNKOKPKQKRKSKTKUKVKWKXKYKZK[K\K]K^K_K`KaKbKcKdKeKfKgKhKiKjKkKlKmKnKoKpKqKrKsKtKuKvKwKxKyKzK{K|K}K~K!L"L#L$L%L&L'L(L)L*L L,L-L.L/L0L1L2L3L4L5L6L7L8L9L:L;LL?L@LALBLCLDLELFLGLHLILJLKLLLMLNLOLPLQLRLSLTLULVLWLXLYLZL[L\L]L^L_L`LaLbLcLdLeLfLgLhLiLjLkLlLmLnLoLpLqLrLsLtLuLvLwLxLyLzL{L|L}L~L!M"M#M$M%M&M'M(M)M*M M,M-M.M/M0M1M2M3M4M5M6M7M8M9M:M;MM?M@MAMBMCMDMEMFMGMHMIMJMKMLMMMNMOMPMQMRMSMTMUMVMWMXMYMZM[M\M]M^M_M`MaMbMcMdMeMfMgMhMiMjMkMlMmMnMoMpMqMrMsMtMuMvMwMxMyMzM{M|M}M~M!N"N$N%N&N'N(N)N#N*N N,N-N.N/N0N1N2N3N4N5N6N7N8N9N:N;NN?N@NANBNCNDNENFNGNHNINJNKNLNMNNNONPNQNRNSNTNUNVNWNXNYNZN[N\N]N^N_N`NaNbNcNdNeNfNgNhNiNjNkNlNmNnNoNpNqNrNsNtNuNvNwNxNyNzN{N|N}N~N!O"O#O$O%O&O'O(O)O*O O,O-O.O/O0O1O2O3O4O5O6O7O8O9O:O;OO?O@OAOBOCODOEOFOGOHOIOJOKOLOMONOOOPOQOROSOTOUOVOWOXOYOZO[O\O]O^O_O`OaObOcOdOeOfOgOhOiOjOkOlOmOnOoOpOqOrOtOuOvOsOwOxOyOzO{O|O}O~O!P"P#P$P%P&P'P(P)P*P P,P.P/P0P1P-P2P3P4P5P7P8P9P:P;P6P
P?P@PAPBPCPDPEPFPGPHPIPJPKPLPMPNPOPPPQPRPSPTPUPVPWPXPYPZP[P\P]P^P_P`PaPbPcPdPePfPgPhPiPjPkPlPmPnPoPpPqPrPsPtPuPvPwPxPyPzP{P|P}P~P!Q"Q#Q$Q%Q&Q'Q(Q)Q*Q Q,Q-Q.Q/Q0Q1Q2Q3Q4Q5Q6Q7Q8Q9Q:Q;QQ?Q@QAQBQCQDQEQFQGQHQIQJQKQLQMQNQOQPQQQRQSQTQUQVQWQXQYQZQ[Q\Q]Q^Q_Q`QaQbQcQdQeQfQgQhQiQjQkQlQmQnQoQpQqQrQsQtQuQvQwQxQyQzQ{Q|Q}Q~Q!R"R#R$R%R&R'R(R)R*R R,R-R.R/R0R1R2R3R4R5R6R7R8R9R:R;RR?R@RARBRCRDRERFRGRHRIRJRKRLRMRNRORPRQRRRSRTRURVRWRXRYRZR[R\R]R^R_R`RaRbRcRdReRfRgRhRiRjRkRlRmRnRoRpRqRrRsRtRvRwRxRuRyRzR{R|R}R~R!S"S#S$S%S&S'S(S)S*S S,S-S.S/S0S1S2S3S4S5S6S7S8S9S:S;SS?S@SASBSCSDSESFSGSHSISJSKSLSMSNSOSPSQSRSSSTSUSVSWSXSYSZS[S\S]S^S_S`SaSbScSdSeSfSgShSiSjSkSlSmSnSoSpSqSrSsStSuSvSwSxSySzS{S|S}S~S!T"T#T$T%T&T'T(T)T*T T,T-T.T/T0T1T2T4T5T6T7T8T9T:T;TT3T?T@TATBTCTDTETFTGTHTITJTKTLTMTNTOTPTQTRTSTTTUTVTWTXTYTZT[T\T]T^T_T`TaTbTcTdTeTfTgThTiTjTlTkTmTnToTpTqTrTsTtTuTvTwTxTyTzT{T|T}T~T!U"U#U$U%U&U'U(U)U*U U,U-U.U/U0U1U2U3U4U5U6U7U8U9U:U;UU?U@UAUBUCUDUEUFUGUHUIUJUKULUMUNUOUPUQURUSUTUUUVUWUXUYUZU[U\U]U^U_U`UaUbUcUdUeUfUgUhUiUjUkUlUmUnUoUpUqUrUsUtUuUvUwUxUyUzU{U|U}U~U!V"V#V$V%V&V'V(V)V*V V,V-V.V/V0V1V2V3V4V5V6V7V8V9V:V;VV?V@VAVBVCVDVEVGVHVIVJVKVFVLVMVNVOVPVQVRVSVTVVVWVXVUVYVZV[V\V]V^V_V`VaVbVcVdVeVfVgVhViVjVkVlVmVnVoVpVqVrVsVtVuVvVwVxVyVzV{V|V}V~V!W"W#W$W%W&W'W(W)W*W W,W-W.W/W0W1W2W3W4W5W6W7W8W9W:W;WW?W@WAWBWCWDWEWFWGWHWIWJWKWLWMWNWOWPWQWRWSWTWUWVWWWXWYWZW[W\W]W^W_W`WaWbWdWeWfWgWhWiWjWkWlWmWnWoWpWqWrWsWtWuWvWwWxWyW>XcWzW{W|W}W~W!X"X#X$X%X&X'X(X)X*X X,X-X.X/X0X1X2X3XLX4X5X6X7X8X9X:X;XY?Y@YAYBYCYDYEYFYGYHYIYJYKYLYMYNYOYPYQYRYSYTYUYVYWYXYYYZY[Y\Y]Y^Y_Y`YaYbYcYdYeYfYtYgYhYiYjYkYlYmYnYoYpYqYrYsYuYvYwYxYyYzY{Y|Y}Y~Y!Z"Z#Z$Z%Z&Z'Z(Z)Z*Z Z,Z-Z.Z/Z0Z1Z2Z3Z4Z5Z6Zf87Z8Z9Z:Z;ZZ?Z@ZAZBZCZDZEZFZGZHZIZJZKZmZLZMZNZOZPZQZRZSZTZUZVZWZXZYZZZ[Z\Z]Z^Z_Z`ZaZbZcZdZeZfZgZhZiZjZkZlZnZoZpZqZrZsZtZuZvZwZxZyZzZ{Z|Z}Z~Z!["[#[$[%[&['[([)[*[ [,[-[.[/[0[1[2[3[4[5[6[7[8[9[:[;[[?[@[A[B[C[D[E[F[G[H[I[J[K[L[M[N[O[P[Q[R[S[T[U[V[W[X[Y[Z[[[\[][^[_[`[a[b[c[d[e[f[g[h[i[j[k[l[m[n[p[q[r[s[o[t[u[v[w[x[y[z[{[|[}[~[!\"\#\$\%\&\'\*\ \,\-\.\/\0\1\2\3\4\5\6\7\8\9\:\;\\?\@\A\B\C\D\E\F\G\H\I\J\K\L\M\N\O\P\Q\R\S\T\U\V\W\X\Y\Z\[\\\]\^\_\`\a\b\c\d\e\f\g\h\i\j\k\l\m\n\o\p\q\r\s\t\u\v\w\x\y\z\{\|\}\~\!]"]#]$]%]&]'](])]*] ],]-].]/]0]1]2]3]4]5]6]7]8]9]:];]]?]@]A]B]C]D]E]F]G]H]I]J]K]L]M]N]O]P]Q]R]S]T]U]V]W]X]Y]Z][]\]]]^]_]`]a]b]c]d]e]f]g]h]i]j]k]l]m]n]o]p]q]r]s]t]u]v]w]x]y]z]{]|]}]~]!^"^#^$^%^&^'^(^)^*^ ^,^-^.^/^0^1^2^3^4^5^6^7^8^9^?^:^;^^@^A^B^C^D^E^F^G^H^I^N^J^K^L^M^O^P^Q^R^S^T^U^V^W^X^Y^Z^[^\^]^^^_^`^a^b^c^d^e^f^g^h^i^j^k^l^m^n^o^r^p^q^s^t^u^v^w^x^y^z^{^|^}^~^!_"_#_$_%_&_'_(_)_*_ _,_-_._/_0_2_1_3_4_5_6_7_8_9_:_;_<_>_?_@_A_B_C_D_E_F_G_H_I_J_K_L_M_N_O_P_Q_R_S_T_U_V_W_X_Y_Z_[_\_]_o_^___`_a_b_c_d_e_f_g_h_i_j_k_l_m_n_p_q_r_s_t_u_v_w_x_y_z_{_|_}_~_!`"`#`$`%`&`'`(`)`*` `,`-`.`/`0`1`2`3`4`5`6`7`8`9`:`;``?`@`A`B`C`D`E`F`G`H`I`J`K`L`M`N`O`P`Q`R`S`T`U`V`W`X`Y`Z`[`\`]`d`^`_```a`b`c`e`f`g`h`i`j`k`l`m`n`o`p`q`r`s`t`u`v`w`x`y`z`{`|`}`~`!a"a#a$a%a&a'a(a)a*a a,a-a.a/a0a1a2a3a4a5a6a7a8a9a:a;aa?a@aAaBaCaDaEaFaGaHaIaJaKaLaMaNaOaPaQaRaTaUaVaSaWaXaYaZa[a\a]a^a_a`aaabacadaeafagahaiajakalamanaoapaqarasatauavawaxayaza{a}a~a!b"b#b$b|a-b%b&b'b(b)b*b b,b/b0b1b2b.b3b4b5b6b7b8b9b:b;bb?b@bAbBbCbEbFbDbGbHbIbJbKbLbMbNbObPbQbRbSbTbUbVbWbXbYbZb[b\b]b^b_b`babbbcbdbebfbgbhbibjbkblbmbnbobpbqbrbsbtbubvbwbxbybzb{b|b}b~b!c"c#c$c%c&c'c(c)c*c c,c-c.c/c0c1c2c3c4c5c6c7c8c9c:c;cc?c@cAcBcCcDcEcFcGcHcIcJcKcLcMcNcOcPcQcRcScTcUcVcWcXcYcZc[c\c]c^c_c`cacbcccdcecfcgchcicjckclcmcncocpcqcrcsctcucvcwcxcyczc{c|c}c~c!d"d#d$d%d&d'd(d)d*d d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~d!e"e#e$e%e&e'e(e)e*e e,e-e.e/e0e1e2e3e4e5e;e6e7e8e9e:ee?e@eAeBeCeDeEeFeGeHeIeJeKeLeMeOePeNeQeReSeTeUeVeWeXeYeZe[e\e]e^e_e`eaebecedeeefehegeiejekelemeneoepeqereseteuevewexeyeze|e{e}e~e!f"f#f$f%f&f'f(f)f*f f,f-f.f/f0f1f2f3f4f5f6f7f8f9f:f;ff?f@fAfBfCfDfEfFfGfHfIfJfKfLfMfNfOfPfQfRfSfTfUfVfWfXfYfZf[f\f]f^f_f`fafbfcfdfefffgfhfifjfkflfmfnfofpfqfrfsfufvfwfxfyfzf{f|f}f~f!g"g#g$g%g&g'g(g)g*g g,g-g.g/g0g1g2g3g4g5g6g7g8g9g:g;gg?g@gAgBgCgDgEgFgGgHgIgJgKgLgMgNgOgPgQgRgSgTgUgVgWgXgYgZg[g\g]g^g_g`gagbgcgdgegfgjggghgigkglgmgngogpgqgrgsgtgvgwgxgygugzg{g|g}g(h~g!h"h#h$h%h&h'h)h*h h,h-h.h/h0h1h2h3h4h5h6h7h8h9h:h;hh?h@hAhBhChDhEhFhGhHhIhJhKhLhMhNhOhPhQhRhShThUhVhWhXhYhZh[h\h]h^h_h`hahbhchdhehfhghhhihjhkhlhmhnhohphqhrhshthuhvhwhxhyhzh{h|h}h~h!i"i#i$i%i&i'i(i)i*i i,i-i.i/i0i1i2i3i4i5i6i7i8i9i:i;ii?i@iAiBiCiDiEiFiGiHiIiJiLiMiKiNiOiPiQiRiSiTiUiViWiXiYiZi[i\i]i^i_i`iaibicidieifigihiiijikiliminioipiqirisitiuiviwixiyizi{i|i}i~i!j"j#j$j%j&j'j(j)j*j j,j-j.j/j0j1j2j3j4j5j6j7j8j9j:j;jj?j@jAjBjCjDjEjFjGjHjIjJjKjLjMjNjOjPjQjRjSjTjUjVjWjXjYjZj[j\j]j^j_j`jajbjcjdjejfjgjhjijjjkjljmjnjojpjqjrjsjtjujvjwjxjyjzj{j|j}j~j!k"k#k$k%k&k'k(k)k*k k,k-k.k/k0k1k2k3k4k5k6k7k8k9k:k;kk?k@kAkBkCkDkEkFkGkHkIkPkJkKkLkMkRkNkOkQkSkTkUkVkWkXkYkZk[k\k^k]k_k`kakbkckdkekfkgkhkikjkkkmknkoklkpkqkrksktkvkukwkxkykzk{k|k}k~k!l"l#l$l%l&l'l(l)l*l l,l-l.l/l0l1l2l3l4l5l6l7l8l9l:l;ll?l@lAlBlClDlElFlGlHlIlJlKlLlNlOlMlPlQlRlSlTlUlVlWlXlYlZl[l\l]l^l_l`lalblcldlelflglhliljlklllmlnlolplqlrlsltlulvlwlxlylzl{l|l}l~l!m"m#m$m%m&m'm(m)m*m m,m-m.m/m0m1m2m3m4m5m6m7m8m9m:m;mm?m@mAmBmCmDmEmFmGmHmImJmKmLmMmNmOmPmQmRmSmTmUmVmWmXmYmZm[m\m]m^m_m`mambmcm7"

2!2"2#2$2%2&2'2(2)2

2!2"2#2$2%2&2'2(2)2

1 1!1"1#1$1%1&1'1(1)1

1 1!1"1#1$1%1&1'1(1)1

% %!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%

% %!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%

W%f?i

W%f?i

e.lFO

e.lFO

urlsS

urlsS

u%urrGS

u%urrGS

]']&].]$]

]']&].]$]

s"s9s%s,s8s1sPsMsWs`slsos~s

s"s9s%s,s8s1sPsMsWs`slsos~s

x
x
{.{1{ {%{${3{>{

{.{1{ {%{${3{>{

h!l!'!c!@!A!$("(((&(:(,(*(0(.(B!4(2(9(!(%('()(-(1(#( (/(3(5(6(7(8(&!%!!&"&$&%&&&'&(&)&*& &,&-&.&/&0&1&2&3&4&5&6&7&8&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&''!'"'#'$'%'&'(')'*' ','-'.'/'0'1'2'3'4'5'6'7'8'9':';''?'@'A'Q'R'S'T'U'V'X'Y'Z'['\']'^'_'`'a'b'c'd'e'f'g'h'i'j'k'l'm'n'o'p'q'W'*!,!.!/!0!1!-!k!d!e!y!f!m!q"r"s"t"u"v"w"x"y"z"{"|"{!|!z!}!J!G!F!L!X!^!O!N!D!E!I!H!R!S!`!_!C!K!W!V!U!Y!T!\!]!Z![!Q!M!P!Y"Z"["\"]"^"_"`"a"b"E"F"G"H"I"J"K"L"M"N"O"P"Q"R"S"T"U"V"W"X"1"2"3"4"5"6"7"8"9":";""?"@"A"B"C"D"$)%)&)')()))*) ),)-).)/)0)1)2)3)4)5)6)7)8)9):);))?)@)A)B)C)D)E)F)G)H)I)J)K)L)M)N)O)P)Q)R)S)T)U)V)W)X)Y)Z)[)\)])^)_)`)a)b)c)d)e)f)g)h)i)j)k)l)m)n)o)v!u!x!w!t!s!p!r!q!o!n!b!a!!!"!#!(!)!4!5!6!7!8!9!:!;!>!?!~!2!3!$?$@$A$B$C$D$E$F$G$H$I$J$K$L$M$N$O$P$Q$R$S$T$U$V$W$X$Y$Z$[$\$]$^$_$`$a$b$c$d$e$f$g$h$i$j$k$l$m$n$o$p$q$r$s$!%"%#%$%%%&%'%(%)%*% %,%-%.%/%0%1%2%3%4%5%6%7%8%9%:%;%%?%@%A%B%C%D%E%F%G%H%I%J%K%L%M%N%O%P%Q%R%S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%b%c%d%e%f%g%h%i%j%k%l%m%n%o%p%q%r%s%t%u%v%$!E(F(G(H(I(J(K(L(M(N(O(P(Q(R(S(T(U(V(W(X(Y(Z([(\(](^(_(`(a(b(c(d(e(f(g(h(i(e"f"g"h"i"j"k"l"m"n";R!6_FrMIU}HOIBO"X;2kS$Xs3(WRG'X@JpG{15RT4 6?K)X*6=AOQ%I-Xv8>Q\cPVa7.4YA/XKDC>1X4CeR.VZN'Uu:&7V@9FREGGT9K3RR?XE>rF2R0OgOiJ@XrBRBiH,GKAhSyUBJ~6!XZSw?FT%;AXeN.>(XGQ)P=XoYvM:?;=%:`Rz2`:6DmO)>$MAAWGqYtYKHiXZR2JJHlXjXFXv=MFp3kXq=i=THS4XBV2PWKJ{KLU68IOZYpX*GnXz4nATRmXGRoXGCvQYVrXuX~=Y:Y30BYDY61?Y95s>HLr:PRCYh= 3EYk>FY;Y_D>YAY@Y.U5VcGHYYkH HK0 9yAbYd5HWxQf)EZ9#Z)T$Z{Y,6k7y1|Ye3v>v?1Rd@36~Y}Y;>`FF-?K;J5I[WP9MkPAuArTU844u3>IPEYE{@p1YXN9=5ZXFV"K/H2IL4L?t9[X\Xg6A#Jt[?[x@">M@@[FJ*2BScC QB[U@C[1?6PaZdG'3r6|Lz@w@9QaQGX^2e@q:HX-TaOIXJXCOx3G>KXL[%HXO~HN2VSf20mA6_5_;VP=YUH0#6I?(L3_7JRSOX6RE:>K>L7_p54_uST3w8:_O:*_ALMwRM7A_D_q7I0V6T7,:}LT?1KtF(VE_bN33|N54GNp:aN=Q@_t4J3f8;_ED<_>_;E?_B_1TC_:GXNXDJ_O_\VI_Z_6NG:N_H_^EkIt:|CW>F_M_XE&UM:L>=S@8dVG_>9'?|AK_L_P_[_e_W_V_IWc_d_ke'RR_)?[TH?T_LO]_JQ^_'07FS_e:_6[M~9UT__lO%0g_Q_FQU_X_Y_\_);`_a_b_f_h_4Sg86Ej_ZI(ADD^?xO\Un_82_:l_A[dQtK=4&0q_FLr_m_i_k_o_p_=;s_t_#;[J(N'`*3&`!`~_YM|_z_P?DWLIx_!0}_{_"`(`H7!F6I2@u_>EDXy_vD#`$`%`%P4`dL1`&?/`9N `FI.@.`m:0:)`v_3`8`-49`2OH:0`zP,`{Tw_gE-`wS6`7`D`aP`*`$IA`2`HJC`5`KNCKM`F`B`K`:`?`@`E`G`H`L`;`TKU`V`R`P`N;7P[.L2?5;xWS?i?a{J-\JI9D=G.\vTfP DU6T[Z1U[V[>:@H?JIH3WyIG?x:8hBQH{eJ6KoI7fp6dCiS4f5f"H=f9fEFqM;ff:f7@$S?ftICfDfvP=CDCBfAfGf1OtkJfEf^eg4T6BK0QNpW!PYI{6Xfb3PIYf"3L^HSM^"RN^M>O^,J|R_3jeaD!>2NrDV>(Fc2S>|GkLl=]N:JAFlea@aAaGag3iF^4BQHaFaEaCaBa@18UDaKaLaJazoSaRa6GIaNaPaTaQaMaOaUaVaWaXaZa[a!N]g(4]V2Q23$9sWIG^>.9WNn2O[:}4_a\:`a2;IBaalP=MbaC5GEcadaySea-Qfa"NgaB5haU;DP`bX1dRabIV|M&CCcRVgbhbGSlbl?mbeb@3nDnbCPv:ib^73;,LKKdbfbjbkbwbtbuTsb-EzUBE@2obrb/AoMs;hL/c1c'O.c)N];k5e>R2M391 cQ2,5_9h6kO7cL;GHJP8cn3)mzSdS*m9cbR5c^SP83c6c_74c"@:c8TH4;cE;wIeI=D m}B[;.??Nc-m?c):,m=c@c6:.68PC0.m/mA@Ac3EBc2\0mj8lN'jgPyJVH7OI3RNd=^cr;(j=U]F)j*j,j j.j-jX=/j>BA4w4';flel?7yKb1glHIhlilVJP^E2zTKFG0r4SHPM8?[?$G4V)@Q^(IoQ$Eg063EHb0v7zEs6RUP3Q0VRcJ%W6M669?[U'8WER^Y?UB@G$;(1jE{E'L'1V5(DS^:Qi3rCw7tV#5p24DiD-@T^h0DE`AU9\>XMN0OMV^P>>WU^PU]0bD#Bp62L@pKq_^74]=`^mDFO`5^6ZJt5e^FUa^ML~FEE4Rr>SB=L83S=X?FMZQk4d^]^g^~j0Bb^@V'5t2h^r^m^q^`HaWo^hCaLe2>Rn^k^UN'4 ?>>R=i^.T^^j^?@l^s2i8'BA=u^x^ 2$4j4&Iv^QKc8w^z^y^BLa0n4:e/Pk2!kt^cIs^Z0!Rw1/Lp^$K*U{^]4&D}^~C!D!_LA|^o>2FE3vH:K~^$_2W73CAKG%2i4 WlD"_#_%_3:&_^@CIY2fG'_\G(_"kSK*_)_A2JE _\TAH,_p>-_'V7j6kUJ|XD8Å¾7~UJ9'PMtP5tCH>7k=0L=2AV1(3R8"IX68k4>}JCG{Us7DN Us13l_05l76OAzu1PeUSNo=b3 86U=mO69KBP=76l)JTE9l8lCB7l}P:l;leWj%@;j}2wCh;WRtN?j<4acrwqugjejdjgjfjgvtokjn>&k&dsQ&b&h&K&&F&q&&niCr3
&PJ1HsOsQ5WsRsTsSs&t&&Q5&j53&u&TTM1Q&w&&
&&&&&&&&&&&&&&&&&&&&&&&&&&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&&&&&<_>&UM:L&&&&CCcRVgbhbGSlbl&Iv&D&_<4acrwqugjejdjgjfjgvtokjn>&k&dsQ&b&h&K&&F&q&&niCr3
&PJ1HsOsQ5WsRsTsSs&t&&Q5&j53&u&TTM1Q&w&&
&&&&&&&
&&&&&&&
&U
&U
&X
&X
&e
&e
&
&
&t&ukuju
&t&ukuju
&h
&h
&&
&&
&
&
&u
&u
&_
&_
&&a&e&g&c&
&&a&e&g&c&
&
&
&&&&&&&&&H&G&&&B&A&&&&F&E&&&D&C&&&&M&N&&O&P&&&Q&R&&&S&T&&&U&V&:&&W&X&&&Y&Z&&&&&&&_&&a&b&c&d&&F&&&&s&axN0&&J&S5&m.mmp&wI&Y&TM&&u&V&y&j&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&
&&&&&&&&&H&G&&&B&A&&&&F&E&&&D&C&&&&M&N&&O&P&&&Q&R&&&S&T&&&U&V&:&&W&X&&&Y&Z&&&&&&&_&&a&b&c&d&&F&&&&s&axN0&&J&S5&m.mmp&wI&Y&TM&&u&V&y&j&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&
&t
&t
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&:&&
&:&&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&
&y1
&y1