HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Zusy.Elzob.8178 (B) (Emsisoft), Gen:Variant.Hupigon.3 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 0cead74d347f9a2237f63d712db562fc
SHA1: 4b27eb719bf5cce0b4b2f57030786ca5f34b1985
SHA256: ddb1b74dd328dc7ba936a2fff5aa34ae3fe2077203e7d9a6a620bc57ae9c2455
SSDeep: 24576:MgDXuC7R5UZNxSQLJLCyJ1IamzciJX5nIw1kEbr/ZXln41yEbDjx1OBSM:MgDXurQLUBVc1kEbrtEbD3M
Size: 1945600 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2010-08-15 04:09:56
Analyzed on: WindowsXPESX SP3 32-bit
Summary: Trojan-PSW. Trojan program intended for stealing users passwords.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:132
Mutexes
The following mutexes were created/opened:
__DDrawCheckExclMode____DDrawExclMode__DDrawWindowListMutexDDrawDriverObjectListMutex{1B655094-FE2A-433c-A877-FF9793445069}c:!documents and settings!adm!local settings!history!history.ie5!mshist012014100820141009!_!SHMSFTHISTORY!_CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex
File activity
The process %original file name%.exe:132 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[2].js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307700639_1837963180_10232_sPicName[1].jpg (3068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[2].js (324 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@dnf.qq[2].txt (357 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307416434_1837963180_5710_sPicName[1].jpg (2234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\include_page090326[1].shtml (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\include_page090326[1].htm (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[1].js (239 bytes)
%System%\drivers\etc\hosts (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307067350_1837963180_17485_sPicName[1].jpg (1846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1289532425_1837963180_32014_sPicName[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@dnf.qq[1].txt (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1308045043_1837963180_13717_sPicName[1].jpg (1825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1306403789_1837963180_16515_sPicName[1].jpg (3406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1243401051_-405729108_18166_sPicName[1].jpg (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1308045810_1837963180_19553_sPicName[1].jpg (2866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[2].js (23 bytes)
%Program Files%\1.scr (14022 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qq[1].txt (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gg_flash_2[1].swf (1753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\client_bg2010[1].png (4948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1307589442_1837963180_16665_sPicName[1].jpg (1038 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1232032171_-405729108_7352_sPicName[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021120130218 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013021820130225\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@dnf.qq[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013030120130302\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\include_page090326[1].shtml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[1].js (0 bytes)
Registry activity
The process %original file name%.exe:132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014100820141009\"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CacheOptions" = "11"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CachePrefix" = ":2014100820141009:"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 14 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1281834596"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 EB 7C 10 85 E7 C7 D6 8E 5E 83 97 FF 22 D6 8D"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014100820141009]
"CacheRepair" = "0"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
Task Manager is disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013030120130302]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021120130218]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013021820130225]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 734 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | https://password.qq.com |
127.0.0.1 | http://aq.qq.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[2].js (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307700639_1837963180_10232_sPicName[1].jpg (3068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[2].js (324 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@dnf.qq[2].txt (357 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307416434_1837963180_5710_sPicName[1].jpg (2234 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\include_page090326[1].shtml (678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\include_page090326[1].htm (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cdn_djl[1].js (239 bytes)
%System%\drivers\etc\hosts (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1307067350_1837963180_17485_sPicName[1].jpg (1846 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1289532425_1837963180_32014_sPicName[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@dnf.qq[1].txt (209 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\1308045043_1837963180_13717_sPicName[1].jpg (1825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1306403789_1837963180_16515_sPicName[1].jpg (3406 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1243401051_-405729108_18166_sPicName[1].jpg (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1308045810_1837963180_19553_sPicName[1].jpg (2866 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\Info_new_13[2].js (23 bytes)
%Program Files%\1.scr (14022 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@qq[1].txt (139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gg_flash_2[1].swf (1753 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\client_bg2010[1].png (4948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1307589442_1837963180_16665_sPicName[1].jpg (1038 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2892 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\tcss.ping[1].js (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1232032171_-405729108_7352_sPicName[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: English (United States)
Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 535659 | 536576 | 4.5282 | 081e3148322f7663866625e0f9018625 |
.rdata | 540672 | 1296810 | 1298432 | 4.93631 | a61ae65ba5e09026689d0cb58b1ead4b |
.data | 1839104 | 279594 | 65536 | 3.53837 | 0d7ef341019e9389cf662ad2814a529f |
.rsrc | 2121728 | 37828 | 40960 | 3.94818 | 5654e64a4d34a4e5826de8248dd6554c |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://103.7.29.178/images/dnf/client/client_bg2010.png | |
hxxp://103.7.29.178/upload/qqgg/dnf/1289532425_1837963180_32014_sPicName.jpg | |
hxxp://103.7.29.178/upload/qqgg/dnf/1232032171_-405729108_7352_sPicName.jpg | |
hxxp://103.7.29.178/upload/qqgg/dnf/1243401051_-405729108_18166_sPicName.jpg | |
hxxp://163.177.72.141/pingd?dm=client.dnf.qq.com&url=/client/include_page090326.shtml&rdm=-&rurl=-&rarg=-&pvid=4643270694&scr=1024x768&scl=32-bit&lang=en-us&java=1&pf=Win32&tz=-3&flash=11.0&ct=lan&vs=tcsso.3.1.5&ext=nw=1;tm=390;ch=1&hurlcn=ad=dnf.qq.com&rand=12283&reserved1=-1&tt= | |
hxxp://ossweb-img.qq.com/upload/qqgg/dnf/1243401051_-405729108_18166_sPicName.jpg | |
hxxp://ossweb-img.qq.com/images/dnf/client/client_bg2010.png | |
hxxp://ossweb-img.qq.com/upload/qqgg/dnf/1289532425_1837963180_32014_sPicName.jpg | |
hxxp://ossweb-img.qq.com/upload/qqgg/dnf/1232032171_-405729108_7352_sPicName.jpg | |
jqmt.qq.com | 203.205.148.71 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /images/dnf/client/client_bg2010.png HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster
....
GET /images/dnf/client/client_bg2010.png HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster
....
GET /images/dnf/client/client_bg2010.png HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster
....
GET /images/dnf/client/client_bg2010.png HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster
....
GET /upload/qqgg/dnf/1232032171_-405729108_7352_sPicName.jpg HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 200 OK
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=15768000
Expires: Thu, 09 Apr 2015 09:05:58 GMT
Last-Modified: Wed, 02 May 2012 04:07:12 GMT
Content-Type: image/jpeg
Content-Length: 3166
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Disktank
X-Cache-Lookup: Hit From Inner Cluster
......JFIF.....H.H.....C....................................................................C.......................................................................!..............................................=...........................!1..A.."3Qr..#24aq...5Bt........................................4.......................!.1.AQ.aq..."2.....#3..4...............?.....w%?.2..=..}. ..hB.S7. .".M}.....>G.......j.p....T....F?=.R.......K/.um...B..9'=t!/8...B^rO.B...}....S....@..hSd..-NpT>:....'&j....zj..6..g.p..(.t....U...l......V<y.t....t/n.13A$.........=J.M3.=G.FTYr..BZ....F.l....k....T.m...t..{.v....R..*J]J..B.R[..................=.? }=(.2..{..q.v.....~][W...Z.......x..H..[(..v.**.y....<8.....[.dps.52.{.%i..K.@......l.n.Vj...7]...H.[q.S...P..J.i...TC.. .....'[[F....$.|.T...qkop..].....Q.^w~..}..,4.~m...6.i..)...@.......Z6TF.v...(..\....BvA..V].T.XV]. ...-..6..u..9=........|7..s.F..R..u..=..X.I.H=..F...Q=.i...s![.c...QaT............lW.L.o8.S^F..l..^...S...p.a..'P...-i.I.><......7$n.Q........F...../..T.......4.p.|...t.1R.........*8..PX%..zm.~.g.....T>.E.........m].l.....".O...3&.......-!@...$.Z%..5,kd.......YU...e..X]...F.V.*.g\4..u.......0......S$0..}.._..w..W..r8..5...i.i.l....S.....E. v....so...].Ly.....~...-. ........q.Y-l....i.F...J..%7...f....4..L.Y.V......{.(...9.....R2......<.......W...x....Ut.6u.f<\.....H..(.Ke..E ..A ....u\j..n...x... 3..pDL..(.k]...m.F.-..........r..r[.....Q.V...... .M\.w..~.!gfpw....L.....\....$......q....8Q.O5..,6ZJ...O.......k.Y....ihB...7;...n.....\Uf...
<<< skipped >>>
GET /images/dnf/client/client_bg2010.png HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster
....
GET /images/dnf/client/client_bg2010.png HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster
....
GET /images/dnf/client/client_bg2010.png HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
If-Modified-Since: Fri, 07 May 2010 09:34:01 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 304 Not Modified
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=3600
Expires: Wed, 08 Oct 2014 22:05:58 GMT
Content-Type: image/png
Content-Length: 0
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Inner Cluster
....
GET /upload/qqgg/dnf/1289532425_1837963180_32014_sPicName.jpg HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 200 OK
Server: X2_Platform
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:58 GMT
Cache-Control: max-age=15768000
Expires: Thu, 09 Apr 2015 09:05:58 GMT
Last-Modified: Thu, 03 May 2012 03:14:04 GMT
Content-Type: image/jpeg
Content-Length: 7399
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Disktank
X-Cache-Lookup: Hit From Inner Cluster
......JFIF.....H.H.....C....................................................................C....................................................................... .............................................?...........................!."1...AQ.2aq#$B.....%R..35DE.....................................<.........................!.1A.Q...."aq..#2BRr...b...S..3C.............?..d:......O.EzL...Iu....e)[.,..K!*._$ .Q#.w.imI.90#.2N.....ZZZ=.U.L.$..`......j6*~g.......MD...y.A....~...`2.W.qX..c.........ML..^t.x|..p.....=.......,r....S.....M.........j...#..$Y.:.xw...:.G...P.O....$....../..@...y..o..&.f.q...q..Q......x.....O.!.Je..H...).B....~..-.g.T.J...............5....(.Z.L...H.s@..F..t.cI.......f(....8h.XzG..lE.l.S..T.>_]9. j4.G....;P..Q'.N>....?..5Y?J..}t....o.......&O....j'..YYA....:G..s...<0.......)6ZX..u.!...%.S..,..=.....G...n.@gA>..I.}..s .K......A'.:I..0......S......|g...O.*Uf.q....M@......7.y...W ...6.,@.K........c...O.Jo..........9..(W.kv8*...O./O.'.............,....^.[../3S.?.~zK...4....xO.ui...'..QbH.".g..|SC..~..y..V....,'..y.&.f........z........k...,(...8........z^...........'..so.Q.9V..H.R.S$..........x^.....,D...,-... .$r.._....|..S.?G.......:...Aa.....-.9Q.L~..G.!.....<......,",.<Hj.e8.....x...../:o.....VbB.........Vo.uT=.}aO...<.....'......-U.4.'!X.....T....<..V..I..(...R... y..R..)...3...4.A..x.xr.....>8Se:B...?..q..A... O...<.....x..U6...U.!.vzd..Q%..<..........O.BH*I.....f.t...F.:.....WV...!...c..4.M....o...J~:.H..H9H=..F....F8....`6....d )..p.....i....UY.}...?
<<< skipped >>>
GET /upload/qqgg/dnf/1243401051_-405729108_18166_sPicName.jpg HTTP/1.1
Accept: */*
Referer: hXXp://dnf.qq.com/client/include_page090326.shtml
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ossweb-img.qq.com
Connection: Keep-Alive
Cookie: pgv_info=ssid=s9762987700; pgv_pvid=4643270694
HTTP/1.1 200 OK
Server: OMG_MID
Connection: keep-alive
Date: Wed, 08 Oct 2014 21:05:59 GMT
Cache-Control: max-age=15768000
Expires: Thu, 09 Apr 2015 09:05:59 GMT
Last-Modified: Tue, 01 May 2012 22:42:55 GMT
Content-Type: image/jpeg
Content-Length: 4067
Access-Control-Allow-Origin: *
X-Cache-Lookup: Hit From Upstream
X-Cache-Lookup: Hit From Inner Cluster
......JFIF.....H.H.....C....................................................................C.......................................................................!.............................................A...........................!."1A...2Qq.#3BR....%'457Sar.bce.....................................7.........................!1.AQ."aq.2R.......Br..b................?....>cTf.LV...E~.)*w.S....'Y..%.. x....%$w......z...r.6jE... C..v..R.Q....n....XO3.."w..u.P.V.J.1. )\....0.>Z..}....V..GyG^U...aHi)J..y.!\.WS...N4........?#...P.lk..D.Z.M*..8..g8.1......cu.Z.....P..%CI..V.$.O.c.>.....'..hR.Tm...J..Vt..RU..O...va..A.yu..&)....u......#.....M.j9Y@y.....r.......ik.....@..P...V...{j>>.....zRq[.....v (...P..V....H]l.*..M.Z.<b]^.N3./...d.)..:.&ou...PnL...).I.....5L..........E6,X.....c........u...Uk..X.........?......MJ.....i.......s.!P..k...Y#I'.W@.. .......G.zL...O@\..@..VA?...h-.0..Qu.Y.[.2.........s-...Q0...K.q$.....> ... .....M.....M.vj........A.@..W...?HE.Q..,.}....{......yIH...5.m..H.w.t.I..}...gB.s)R4>z......Mk.f.O.j..:#........K.dII.G..d%......d.5.m.$.-.iD......O?..=..R.U.Mu.....N..J.n.*.A..}2.m.b..yX.......yrd$.sN..W{..T...iJ*.u.O.......CM<~t,.X..o.EV.-..L.d..I...oR...0.n$t8..K....<.T[P.d..8......I.o1$...D0..yGI.]........aR..i......?..c....{..;Y..w...z.o..m.S.T..i....z...i...H-.....c.S..QW.E....y..).L..(8.F>8!J.@.u.i..m.}.a*..t....M..\%...OO.j2m..h....ou#...x&.vZ.E........-.)......=.Y.F.=.:..4....N._Z..2TD.Z.T v.......]..,.fGCs...J.v<e...^B..b2.()'...../.]..K.^@.q.P.......2
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_132:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
DNFchinas.exe
DNFchinas.exe
910106473
910106473
smtp.qq.com
smtp.qq.com
%System%\drivers\etc\hosts
%System%\drivers\etc\hosts
127.0.0.1 hXXps://password.qq.com
127.0.0.1 hXXps://password.qq.com
127.0.0.1 hXXp://aq.qq.com
127.0.0.1 hXXp://aq.qq.com
%Program Files%\1.scr
%Program Files%\1.scr
explorer.exe hXXp://gamesafe.qq.com/cgi-bin/cltverify/cltverify
explorer.exe hXXp://gamesafe.qq.com/cgi-bin/cltverify/cltverify
\TNE\TMfwwd.dat
\TNE\TMfwwd.dat
DNdssaf.dll
DNdssaf.dll
%System%\
%System%\
explorer.exe hXXp://gamesafe.qq.com/
explorer.exe hXXp://gamesafe.qq.com/
&qqpassword=
&qqpassword=
explorer.exe hXXp://dl_dir.qq.com/invc/qqdoctor/qqdoctorsetup/QQDoctor_Setup_v3.2.exe
explorer.exe hXXp://dl_dir.qq.com/invc/qqdoctor/qqdoctorsetup/QQDoctor_Setup_v3.2.exe
Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskmgr
Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskmgr
explorer.exe hXXp://down.qq.com/iedsafe/QQGameProtect/QQGameProtectBin.zip
explorer.exe hXXp://down.qq.com/iedsafe/QQGameProtect/QQGameProtectBin.zip
q.cd6
q.cd6
.eiT@a,
.eiT@a,
5.xA2
5.xA2
Y%D?Y0`
Y%D?Y0`
=.RD"
=.RD"
!%sn%
!%sn%
tV.EB%-6Y{
tV.EB%-6Y{
ú9V
ú9V
F;p%U
F;p%U
jc.CB
jc.CB
g.NX0V
g.NX0V
Ë}
Ë}
#-4$.4%/6#,4" 2%/6%/6$.4%/5
#-4$.4%/6#,4" 2%/6%/6$.4%/5
(0'29",2! 2
(0'29",2! 2
&.! 2",2'29
&.! 2",2'29
(0%/5$.4%/6%/6" 2#,4%/6$.4#-4
(0%/5$.4%/6%/6" 2#,4%/6$.4#-4
)-5 .5%)0'*1 #(!&, %- %,
)-5 .5%)0'*1 #(!&, %- %,
%$(.$',"% !%,
%$(.$',"% !%,
!((,225=( 2&,6
!((,225=( 2&,6
% /6( 2"&,
% /6( 2"&,
%$(..18&*0#'. %, $ ( 2
%$(..18&*0#'. %, $ ( 2
$', 07( 0
$', 07( 0
!).28,/7
!).28,/7
!)#'..1748@
!)#'..1748@
)-5&*0#'.
)-5&*0#'.
!)&*/!%,
!)&*/!%,
!)$(/ $
!)$(/ $
!)%(.$'-( 1
!)%(.$'-( 1
)-5!%,!%,
)-5!%,!%,
#-3$.4 %/
#-3$.4 %/
!)&)2&*3
!)&)2&*3
#-3$.4 %/' 2
#-3$.4 %/' 2
#,!$ /8"% %)/%(/&*2
#,!$ /8"% %)/%(/&*2
'-2:26=&)/
'-2:26=&)/
# !&-%)0&)1#'/$)1!%-"&-*.6"&,
# !&-%)0&)1#'/$)1!%-"&-*.6"&,
!!&. $ "&-
!!&. $ "&-
&' 4,09"&-
&' 4,09"&-
#-3$.4 %/,08 /9 &.
#-3$.4 %/,08 /9 &.
&/ (1",2
&/ (1",2
(/",2 (1
(/",2 (1
&/ (1 )/_
&/ (1 )/_
!)$(0&)0
!)$(0&)0
" #'/"&.' 3/3
" #'/"&.' 3/3
!),09!%-
!),09!%-
%$(0-1:),3-09-09&*0
%$(0-1:),3-09-09&*0
')0"'-#%,#&
')0"'-#%,#&
&"&/04=-1:*.7 09!&.
&"&/04=-1:*.7 09!&.
#%)2#'0$(048@ 07
#%)2#'0$(048@ 07
" ,08#&.04=(,5
" ,08#&.04=(,5
#*( 3"&-)-6 08( 3
#*( 3"&-)-6 08( 3
" #& ' 2%(.05=
" #& ' 2%(.05=
)/%/4!)1
)/%/4!)1
'-!)1 3;!)1 3;
'-!)1 3;!)1 3;
'-!)1!)1 3;" 1
'-!)1!)1 3;" 1
)/ 3;!)1 3;!)1
)/ 3;!)1 3;!)1
'-!)1%/4
'-!)1%/4
"*2!&0,08
"*2!&0,08
$.).6 09-2;)-6$(1&*4
$.).6 09-2;)-6$(1&*4
# 15>*/8 $.
# 15>*/8 $.
!)%*3 09"&/
!)%*3 09"&/
'/!)1",2 (0
'/!)1",2 (0
'/%-4%-4
'/%-4%-4
%-4 )/ (0%-5
%-4 )/ (0%-5
&, (0",2!)1
&, (0",2!)1
'/%-4 )/
'/%-4 )/
! .6& 2
! .6& 2
(0",2!)1
(0",2!)1
&,%-4 )/ (0%-5
&,%-4 )/ (0%-5
'/%-5 (0
'/%-5 (0
15?).6!%/%*3
15?).6!%/%*3
",2#-2(08!(1 (1 (1%/4 3;
",2#-2(08!(1 (1 (1%/4 3;
4
4
)!&/$)1!&.
)!&/$)1!&.
!)$)2' 4).9 %.!&/
!)$)2' 4).9 %.!&/
#)*.4,06#)1#%-%'0
#)*.4,06#)1#%-%'0
",2#-2(08!(1 (1 (1%/4
",2#-2(08!(1 (1 (1%/4
4
4
*4
*4
&18
&18
$*5=-8?'08
$*5=-8?'08
*4
*4
&18
&18
)5=
)5=
-1;*0;#(0' 6#)3
-1;*0;#(0' 6#)3
*4
*4
(3;-8@(3;(2:'29#.5#.5
(3;-8@(3;(2:'29#.5#.5
*5=*5=
*5=*5=
*5=*4>
*5=*4>
#.5#.5'29(2:(3;-8@(3;}
#.5#.5'29(2:(3;-8@(3;}
(3;-8@(3;(2:'29#.5#.5&18*6>
(3;-8@(3;(2:'29#.5#.5&18*6>
*5=*5=#.5
*5=*5=#.5
!,3&18#.5
!,3&18#.5
#.5'29(2:(3;-8@(3;}
#.5'29(2:(3;-8@(3;}
(&)1%)0,/7$'-
(&)1%)0,/7$'-
\v}UmuWpxTnuRltVowVovSjqTlsRgqQgoRirPgnMaiJ`gG^eD\b?V]9NV5KR0FM/CJ/BI0EK2HN1FL4JP3JP2HN2HO5KR:RZ>W_=T\AYaF_hOirI`g
\v}UmuWpxTnuRltVowVovSjqTlsRgqQgoRirPgnMaiJ`gG^eD\b?V]9NV5KR0FM/CJ/BI0EK2HN1FL4JP3JP2HN2HO5KR:RZ>W_=T\AYaF_hOirI`g
(3;-8@(3;(2:'29#.5#.5&18
(3;-8@(3;(2:'29#.5#.5&18
*5=*5=
*5=*5=
'29(2:(3;-8@(3;}
'29(2:(3;-8@(3;}
"*5=
"*5=
"%,8@ 7?*6>
"%,8@ 7?*6>
$-04>!%-,1:
$-04>!%-,1:
$, 09 09"'1
$, 09 09"'1
,8@*6> 7?
,8@*6> 7?
$-,1;(,5*.7#(0
$-,1;(,5*.7#(0
!(#'/!#
!(#'/!#
_t{\qxUjpL`fEV\@QW:IQ8GM6FL4BH3AH5CH7EK:HN=LPAPUEV\CV\?RY7JQ/CK.CJ-AH0DK1GM2HN3HO6KS8OV=T[@YaHajKdlNgpVqzXszBU[
_t{\qxUjpL`fEV\@QW:IQ8GM6FL4BH3AH5CH7EK:HN=LPAPUEV\CV\?RY7JQ/CK.CJ-AH0DK1GM2HN3HO6KS8OV=T[@YaHajKdlNgpVqzXszBU[
% %/.4>.3;*/8)-6 /9%)1 09 09
% %/.4>.3;*/8)-6 /9%)1 09 09
#&*4>,8@
#&*4>,8@
$-& 5%)3*.7*.6!%. /8/4>$)2(-6
$-& 5%)3*.7*.6!%. /8/4>$)2(-6
"%,8@ 7?
"%,8@ 7?
).8,08)5=
).8,08)5=
YnuI\c?QX9NT7MT8MT;PW?T[=S[
YnuI\c?QX9NT7MT8MT;PW?T[=S[
((,5' 2"'/
((,5' 2"'/
#-%*4"&/
#-%*4"&/
# ,08)5=
# ,08)5=
"*!&0$)2!%-
"*!&0$)2!%-
" $- %.& 6(,4,08)5=
" $- %.& 6(,4,08)5=
#&*6>
#&*6>
'2; )2'2;$07
'2; )2'2;$07
"* /8.3
"* /8.3
#,#'/%)0' 2/3:'2;
#,#'/%)0' 2/3:'2;
&-2
&-2
!(#'105?#(1
!(#'105?#(1
").24=
").24=
" "&.15?)-5&)1
" "&.15?)-5&)1
%*,3#'. 09'*105?$)2
%*,3#'. 09'*105?$)2
"%#/7 6@#/7 6@
"%#/7 6@#/7 6@
" )-526=).8
" )-526=).8
$!&. /7 09
$!&. /7 09
#$)1#&.',5).7.3=
#$)1#&.',5).7.3=
!*#(0,0:
!*#(0,0:
$-!&/.2;%)1 /8,09' 4,1:' 3*/7$)2-2
$-!&/.2;%)1 /8,09' 4,1:' 3*/7$)2-2
" #'016?
" #'016?
$,27@' 2
$,27@' 2
!)$(1%)1
!)$(1%)1
$ 8@(4?)"/6
$ 8@(4?)"/6
'#(0& 4/4
'#(0& 4/4
"!%,#&/(-616>26?/4=$)2 $ /7
"!%,#&/(-616>26?/4=$)2 $ /7
")"&-'*227?%*3
")"&-'*227?%*3
)5> 8@(4?)"/6
)5> 8@(4?)"/6
")' 3-1804=
")' 3-1804=
")#'0#(0
")#'0#(0
!**.6*/7%*3
!**.6*/7%*3
#'.*.6' 4 #
#'.*.6' 4 #
!*' 3/4=#'/"&.%)1
!*' 3/4=#'/"&.%)1
&$(/!&.),404;' 2
&$(/!&.),404;' 2
")"&.05>%)0
")"&.05>%)0
(*.7!%,(-6*-5)-4
(*.7!%,(-6*-5)-4
&*2)-6 $,
&*2)-6 $,
#'*0&)/',404;%(0 #*
#'*0&)/',404;%(0 #*
!("&-'*026=
!("&-'*026=
!)%)2"&.
!)%)2"&.
#*15=-19!$
#*15=-19!$
'(-5$(/%)1
'(-5$(/%)1
%((3>)7@
%((3>)7@
& #*0)4:(17(18(3:)5=)5
& #*0)4:(17(18(3:)5=)5
!'$(/26>
!'$(/26>
"' #*!%, $
"' #*!%, $
& $ (,3%)0
& $ (,3%)0
%u6G~
%u6G~
"(#& ),3*-4'*/ .4
"(#& ),3*-4'*/ .4
")"%,26=
")"%,26=
"'$(0"&-
"'$(0"&-
"lL-9B
"lL-9B
!(#% ,/5),4
!(#% ,/5),4
#*$', #*
#*$', #*
!( #)-18
!( #)-18
*.5$&,$&,
*.5$&,$&,
$'*1( 2*.4
$'*1( 2*.4
#'&/6$,2
#'&/6$,2
#("$)#&,
#("$)#&,
#' (-")0
#' (-")0
& $-4'18(17
& $-4'18(17
&)/) 1!$*
&)/) 1!$*
%*)29*4;'18%/5#,2!(- ',
%*)29*4;'18%/5#,2!(- ',
"%-3(28'05$-2")/!)-# 1").!(,
"%-3(28'05$-2")/!)-# 1").!(,
#$/46,03#&'#( ,2518=/8
#$/46,03#&'#( ,2518=/8
!#%,2'/4#,1# 0
!#%,2'/4#,1# 0
',/06:*/2$(*& .(-1&,0(-1*04*04%,0"(*
',/06:*/2$(*& .(-1&,0(-1*04*04%,0"(*
$($ 0"(-
$($ 0"(-
"&!' $*.
"&!' $*.
!#*/(06-6
!#*/(06-6
3!.6!-6 4
3!.6!-6 4
!%*-(-0$( & .)/3,37(.2
!%*-(-0$( & .)/3,37(.2
,5 -6 -6 -6!-6 -6 .6!.6"/8!/8!.7!/8!/7!.7!/8!-6 -6!.7
,5 -6 -6 -6!-6 -6 .6!.6"/8!/8!.7!/8!/7!.7!/8!-6 -6!.7
,4!.6 -6
,4!.6 -6
4 ,5 -6 ,5
4 ,5 -6 ,5
,5 -6 -6
,5 -6 -6
4 ,6!-6!/7!/8!/7!.6!/8!/7 -6
4 ,6!-6!/7!/8!/7!.6!/8!/7 -6
,5 -6 -6 -6
,5 -6 -6 -6
3 -6 -6 ,5 ,6
3 -6 -6 ,5 ,6
4!-6!.6!-6!-6"/8!-6!.6!.7 ,4 ,5"/8!/7!-6!-7!/9!.8!.7
4!-6!.6!-6!-6"/8!-6!.6!.7 ,4 ,5"/8!/7!-6!-7!/9!.8!.7
4 -6 ,6
4 -6 ,6
5 ,5 -6
5 ,5 -6
5 -6!.8!-7
5 -6!.8!-7
,6!.7 -7
,6!.7 -7
!&"(/#*1
!&"(/#*1
!'!(0&-4")/!(-
!'!(0&-4")/!(-
% #-3$-5!)0!)1 (0!*1!)1
% #-3$-5!)0!)1 (0!*1!)1
(.!)1#,4" 2
(.!)1#,4" 2
(/!)1 )0
(/!)1 )0
(/!*1$/4$/5$/5'29#-4#-2"-2
(/!*1$/4$/5$/5'29#-4#-2"-2
$ #-4",3!*1
$ #-4",3!*1
&.",4!)0!*2
&.",4!)0!*2
'/!)1" 3
'/!)1" 3
'/" 2" 2"*2" 2!)1
'/" 2" 2"*2" 2!)1
"'&/4&07%.4")/$-3!(-$-4"*0"*1'0:'0:%/8")3$-7" 4
"'&/4&07%.4")/$-3!(-$-4"*0"*1'0:'0:%/8")3$-7" 4
") (1!(1 (0
") (1!(1 (0
"'# 2$-6!(2!)2&/9!)2!(0# 5$,7!)2
"'# 2$-6!(2!)2&/9!)2!(0# 5$,7!)2
'0# 6!(2
'0# 6!(2
#*6$*6")3
#*6$*6")3
$.!&2&.;!'2
$.!&2&.;!'2
" &0$*7$*7
" &0$*7$*7
#,"*5 &0
#,"*5 &0
#.!&1!'0
#.!&1!'0
$,"(3&.:%,8&.;'/
$,"(3&.:%,8&.;'/
#, &/ (0
#, &/ (0
%,!)2!(1
%,!)2!(1
$. '/ '/
$. '/ '/
") &.$ 2$,4%.5!(/"(0"(0!(0 '.
") &.$ 2$,4%.5!(/"(0"(0!(0 '.
!%'%)-',1$ -
!%'%)-',1$ -
&,$.6$.8'1
&,$.6$.8'1
#, &2!(3
#, &2!(3
$."*6$*6 &0
$."*6$*6 &0
-Oh%C[
-Oh%C[
&3$AZ$AZ.Kd'8G-E[4Wv8`
&3$AZ$AZ.Kd'8G-E[4Wv8`
$..GY;_z$5F4QjO
$..GY;_z$5F4QjO
.EUn%9L/Mh:b
.EUn%9L/Mh:b
4Xt$=T!2@)>L1Oi3Tr&=T.Kc6Yu)E]
4Xt$=T!2@)>L1Oi3Tr&=T.Kc6Yu)E]
3J.Rr
3J.Rr
.Ux(Ln Kf%;N
.Ux(Ln Kf%;N
%0.ET
%0.ET
%;LÅ“
%;LÅ“
.Tl*Mg$B_I
.Tl*Mg$B_I
9``&@@&@@
9``&@@&@@
1K^$6B&7BAZm7Pd$;K(=JÅ’_
1K^$6B&7BAZm7Pd$;K(=JÅ’_
2>2I\Fa{0@J5JX2K].DV3GY;SfJB[oW|
2>2I\Fa{0@J5JX2K].DV3GY;SfJB[oW|
7 1?0I\9Xp2Pi-Ja FY(>NÂ6RjV
7 1?0I\9Xp2Pi-Ja FY(>NÂ6RjV
.Vv-Lk
.Vv-Lk
'.&09&.7&.6'/7'-4
'.&09&.7&.6'/7'-4
#'!',&-2'-2&,1
#'!',&-2'-2&,1
"*1#*0")/$)/!'- '."(0#',$).)16,6
"*1#*0")/$)/!'- '."(0#',$).)16,6
$(%/5$-4
$(%/5$-4
(,$/4&08#)/
(,$/4&08#)/
%*",3 ).").(28)4; ).
%*",3 ).").(28)4; ).
' )- *0
' )- *0
!%#)/!& &,
!%#)/!& &,
$) *0 (/
$) *0 (/
$( *0 */
$( *0 */
)0"(.!(.$,1-6= &,
)0"(.!(.$,1-6= &,
$*'/6,4
$*'/6,4
#'",2$05 )-
#'",2$05 )-
!(.#-2&17# 1 & ",0"-4!,1
!(.#-2&17# 1 & ",0"-4!,1
#)(/4&,2
#)(/4&,2
% %,3'/7"*0
% %,3'/7"*0
$) $)!$ *3;.9@-6= 39 2:.6=$)/
$) $)!$ *3;.9@-6= 39 2:.6=$)/
#-! 4'19 (-
#-! 4'19 (-
'-(/7,2:.4; 27,27.8@#,3 *2 2
'-(/7,2:.4; 27,27.8@#,3 *2 2
&K%Ds
&K%Ds
;n%Dw Q
;n%Dw Q
).MnNy
).MnNy
)H{-J}3S
)H{-J}3S
0[%Ft ;a.P}
0[%Ft ;a.P}
&1$0>#.=
&1$0>#.=
IEC hXXp://VVV.iec.ch
IEC hXXp://VVV.iec.ch
.IEC 61966-2.1 Default RGB colour space - sRGB
.IEC 61966-2.1 Default RGB colour space - sRGB
CRT curv
CRT curv
(7),01444
(7),01444
'9=82<.342>
'9=82<.342>
Lf%Ur
Lf%Ur
}~~}}}}~~}}~}~~}}~}}~}~~}~~}}~}~~~~
}~~}}}}~~}}~}~~}}~}}~}~~}~~}}~}~~~~
}~~}~~~~
}~~}~~~~
! )-*8>$/5"-3
! )-*8>$/5"-3
'*#.3'3:*7>(49(4;#-3'29'27 (-
'*#.3'3:*7>(49(4;#-3'29'27 (-
$*",2
$*",2
$*#.4! 1 (/!)0
$*#.4! 1 (/!)0
!'! 2! 1
!'! 2! 1
$( 1$07
$( 1$07
!%#.5! 2
!%#.5! 2
"$06 1!,2"-3
"$06 1!,2"-3
#(! 2$06
#(! 2$06
)- )/"-4(4:
)- )/"-4(4:
%)%/4 )
%)%/4 )
'*#.3(5
'*#.3(5
$)#.4 */
$)#.4 */
$'#,1)5;,9@ 9?(4:
$'#,1)5;,9@ 9?(4:
"-2$.4&17(39#,1$.3
"-2$.4&17(39#,1$.3
','19%.3
','19%.3
%*!)/#,3#-3
%*!)/#,3#-3
"&"-3 *0
"&"-3 *0
(-! 1
(-! 1
!%!,2$07
!%!,2$07
!& */ (/#)1% 2#(-
!& */ (/#)1% 2#(-
)3Å’*?J*=I*=H$7B#5>"3
)3Å’*?J*=I*=H$7B#5>"3
*3$3=#3
*3$3=#3
(1!/8 /7
(1!/8 /7
%)! 0 ).
%)! 0 ).
$)#.4#.4
$)#.4#.4
(," 0'29&26"-0#-2
(," 0'29&26"-0#-2
%)"-4"-3 ).
%)"-4"-3 ).
#'!,2 1
#'!,2 1
(.$/6
(.$/6
'.$*0!& "',&/6'08#.4(2:)17$(.%*/
'.$*0!& "',&/6'08#.4(2:)17$(.%*/
(1#2
(1#2
%- /7 ,3
%- /7 ,3
#'$/6#,2
#'$/6#,2
).$07
).$07
)-! 0! 0"-1
)-! 0! 0"-1
''',--/00
''',--/00
oDþ-`E2XF9PG@IHGFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHI
oDþ-`E2XF9PG@IHGFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHIFHI
023=>?9;
023=>?9;
012345012
012345012
9:;>,./
9:;>,./
012>9:;
012>9:;
>>,./
>>,./
9;;=>>022
9;;=>>022
'(( ,,-//=>>9;;
'(( ,,-//=>>9;;
YZZQSSHJJ
YZZQSSHJJ
,..344011
,..344011
) 577577
) 577577
244899244
244899244
;==;==,--
;==;==,--
) 577;==>@@244
) 577;==>@@244
,--577899
,--577899
/00133=??=??/00
/00133=??=??/00
,,=??:
,,=??:
133799466
133799466
,, ,, ,,
,, ,, ,,
/00133799/00
/00133799/00
899>:@@:
899>:@@:
344344566
344344566
133.// ,,
133.// ,,
022-//022
022-//022
688466466688
688466466688
"$'.FHH248
"$'.FHH248
"%'.ACD369
"%'.ACD369
%#&/'*0#&.
%#&/'*0#&.
688=??:;;
688=??:;;
=??688355
=??688355
:;;=??688
:;;=??688
* 011011*
* 011011*
* 011-..-..
* 011-..-..
355=??=??
355=??=??
* 011688
* 011688
-..011-..
-..011-..
,..344677
,..344677
344/00,..,..&''
344/00,..,..&''
,../00,..
,../00,..
)**,../00344
)**,../00344
3449::9::
3449::9::
344/00)**
344/00)**
677677,..
677677,..
)**/00/00)**
)**/00/00)**
344>344
344>344
677677677
677677677
,..677344
,..677344
677677)**
677677)**
)**/00/00/00)**
)**/00/00/00)**
,..9::9::>>
,..9::9::>>
,../00)**
,../00)**
)**/00,..
)**/00,..
>677,..
>677,..
,..677>
,..677>
,..9::>
,..9::>
344>>344
344>>344
>>677
>>677
,../00344/00
,../00344/00
>677)**
>677)**
&'')**)**,..)**
&'')**)**,..)**
&'',../00,..
&'',../00,..
,--/00,--
,--/00,--
8::>@@;==;==;==233
8::>@@;==;==;==233
233>@@>@@566(**
233>@@>@@566(**
8::>@@8::
8::>@@8::
(**/00(**
(**/00(**
233;==566
233;==566
566566/00/00/00(**
566566/00/00/00(**
,--566>@@
,--566>@@
/008::8::
/008::8::
>@@566(**
>@@566(**
(**/00566;==566/00/00,--
(**/00566;==566/00/00,--
&&&,--/00/00/00566566
&&&,--/00/00/00566566
;==>@@233
;==>@@233
233;==233
233;==233
,--/00/00
,--/00/00
>@@566/00/00/00,--
>@@566/00/00/00,--
#'&28&27
#'&28&27
&*$.5&19"*0
&*$.5&19"*0
%( )-(5;
%( )-(5;
&,$06
&,$06
$*! 3",4
$*! 3",4
& !-3 ,1
& !-3 ,1
!%!,2$18 ,3
!%!,2$18 ,3
#)" 2!*/!(-"*1 ).
#)" 2!*/!(-"*1 ).
.>I(:F av.ET.GU1HU;[k7N]&6?
.>I(:F av.ET.GU1HU;[k7N]&6?
--4>&*3!#*&)0$(0"$*%(0"$
--4>&*3!#*&)0$(0"$*%(0"$
$(!)/)4;&39!).%,1'16(4;(4;
$(!)/)4;&39!).%,1'16(4;(4;
#&$.3 / 0
#&$.3 / 0
(.)#06 *1
(.)#06 *1
'- 1 ,2
'- 1 ,2
&*$.4$/4'38*6;*6;
&*$.4$/4'38*6;*6;
&.! 2",2
&.! 2",2
&.'29%/6)29! 2.7>'28
&.'29%/6)29! 2.7>'28
(0%/5" 2#,4%/6$.4#-4
(0%/5" 2#,4%/6$.4#-4
!&",1$/6"-3#-3!*/#/5 */
!&",1$/6"-3#-3!*/#/5 */
(8A.CP*I5Uh/IZ0K[1EQ3M\@^q$4> /9)?K!1:*]p(:E
(8A.CP*I5Uh/IZ0K[1EQ3M\@^q$4> /9)?K!1:*]p(:E
,5%3=!/:
,5%3=!/:
(6=.DS
(6=.DS
-' 4*0:' 4#&.
-' 4*0:' 4#&.
%!#*"#*##)$&,"#)$&-"&-$(.$'-##*$&,& 2$&-',3,5;#',
%!#*"#*##)$&,"#)$&-"&-$(.$'-##*$&,& 2$&-',3,5;#',
#'*19 #)',3
#'*19 #)',3
',$/7 *0
',$/7 *0
&**7>$/5"-1! .
&**7>$/5"-1! .
"&$). 3:
"&$). 3:
.71GW*@L*?K ?J!3?*=I$7A0EP >J"4?.BN-@M'9E(:E!2
.71GW*@L*?K ?J!3?*=I$7A0EP >J"4?.BN-@M'9E(:E!2
-"$ ).6 2
-"$ ).6 2
$)&*1 .6&*1#'-(-3*08'07(06'/5&-3"%
$)&*1 .6&*1#'-(-3*08'07(06'/5&-3"%
!&$.5(6= ).
!&$.5(6= ).
%*#,1'39(28$.2#,2
%*#,1'39(28$.2#,2
$! 1)3:*28!&*
$! 1)3:*28!&*
%*",3#*0#(-(/7
%*",3#*0#(-(/7
/80FQ >K!3
/80FQ >K!3
'1"0;$2;
'1"0;$2;
%- -6!.6
%- -6!.6
-$&,"#*(-4$'-"#)),3' 1%).*-5')1(,3(/6'.5%*0&*0&)/
-$&,"#*(-4$'-"#)),3' 1%).*-5')1(,3(/6'.5%*0&*0&)/
$)29#(.!%*'-3'06!&*
$)29#(.!%*'-3'06!&*
#*5
#*5
'- 3;" 1
'- 3;" 1
'-!)1 3;" 1
'-!)1 3;" 1
"*2'16(4:(4: )/
"*2'16(4:(4: )/
( #,1 &,
( #,1 &,
%*$06
%*$06
&,")- '
&,")- '
#(&.4)06%*1
#(&.4)06%*1
;[m*;GDd{5Qb/CP"4=>^s
;[m*;GDd{5Qb/CP"4=>^s
(1!1;&5?
(1!1;&5?
)2!/8"2;
)2!/8"2;
-/5>#&-#%,$% &)0*.5',3$)0(,2*/7',4*08%*2',3&,4!% #(-(27
-/5>#&-#%,$% &)0*.5',3$)0(,2*/7',4*08%*2',3&,4!% #(-(27
#,1%.5#,1
#,1%.5#,1
&, )/%-4
&, )/%-4
'/%-5 (0 )/%-4
'/%-5 (0 )/%-4
&,%-5 (0
&,%-5 (0
&, (0%-5
&, (0%-5
'/",2!)1
'/",2!)1
#(&.5 &,'08 &-
#(&.5 &,'08 &-
#&)06(.5
#&)06(.5
.FT6Sd=Yk6Qc3K[2L[@at):E$4>%4>2JY,CO,>J):D
.FT6Sd=Yk6Qc3K[2L[@at):E$4>%4>2JY,CO,>J):D
,40FR9Ra$1:"3J
,40FR9Ra$1:"3J
/9':E ?J'8D$6@|
/9':E ?J'8D$6@|
-6#1: /8
-6#1: /8
.7"1;!/9
.7"1;!/9
% .5"1:"19!/8
% .5"1:"19!/8
$($).&,2#(/
$($).&,2#(/
'-%/4 3;
'-%/4 3;
&.%/4 3;
&.%/4 3;
'- 3;%/4
'- 3;%/4
& "-4" 2
& "-4" 2
(-(7> *0$17! 0"*.'/4'.6&.5%.4&.7%.6
(-(7> *0$17! 0"*.'/4'.6&.5%.4&.7%.6
& "*/*4:*18
& "*/*4:*18
,33IU;Te.AN|$2<.gw5pa>
,33IU;Te.AN|$2<.gw5pa>
-6!09"2;
-6!09"2;
,5 /8$4>#3
,5 /8$4>#3
'/ -6"17
'/ -6"17
&*!*0" 0*8?(5=
&*!*0" 0*8?(5=
&* (,'3:#-3$.4" 0
&* (,'3:#-3$.4" 0
',$07#/4
',$07#/4
!$ &*#,2!*0")/'-3 38
!$ &*#,2!*0")/'-3 38
(6@:[p @O3K[=\n6P_"/8Â'9D-?J;Xi
(6@:[p @O3K[=\n6P_"/8Â'9D-?J;Xi
#&)/'-3 $)
#&)/'-3 $)
)5=
)5=
!*.%/4&05#.5$/5&16'17&29'29$-2
!*.%/4&05#.5$/5&16'17&29'29$-2
##.5*5=*5=
##.5*5=*5=
!$#.5(2;
!$#.5(2;
!,3&18
!,3&18
*3 .6!0: /7!/8&6>
*3 .6!0: /7!/8&6>
"#9EŸ
"#9EŸ
&18!,3"-4
&18!,3"-4
*5=#.5(2;
*5=#.5(2;
"-0 *.
"-0 *.
7?*6>,8@
7?*6>,8@
#' (-$17
#' (-$17
-4$3=)=H1GT)>J.BO$7A!3>-@L-BN$7@$7@);F
-4$3=)=H1GT)>J.BO$7A!3>-@L-BN$7@$7@);F
-/4-2:#%,!#)' 2')1(,3)/6' 2( 3$(/
-/4-2:#%,!#)' 2')1(,3)/6' 2( 3$(/
$(',3*18 29,29)/5)17 4;#(,!' # 0&.4!&*
$(',3*18 29,29)/5)17 4;#(,!' # 0&.4!&*
*6> 7?
*6> 7?
&, *0)5=
&, *0)5=
$)" 0",1
$)" 0",1
#,0)6;"-1 ',
#,0)6;"-1 ',
"&"*/ %
"&"*/ %
#(#' (05% 1$*/&-3
#(#' (05% 1$*/&-3
(-%-3',1)17
(-%-3',1)17
9Wi%5?:Tc8Qb&6@'';G ?K
9Wi%5?:Tc8Qb&6@'';G ?K
'//BO&7?4Oa5Qb&6?#3
'//BO&7?4Oa5Qb&6?#3
*3!2=!0:"2
*3!2=!0:"2
#&-2 28&,2"(/#(,)5=
#&-2 28&,2"(/#(,)5=
)5=#-4#.4
)5=#-4#.4
',*8@*8?)6
',*8@*8?)6
"'!(.$/6
"'!(.$/6
%)!(-!*.
%)!(-!*.
&," 2'/6'.3'.3
&," 2'/6'.3'.3
07#2
07#2
2$4
2$4
4%4>"1:
4%4>"1:
#(.4&*0'-3)08!& '2;
#(.4&*0'-3)08!& '2;
'2;(3:*5
'2;(3:*5
9Ug=\p*
9Ug=\p*
4 /8"2:&6@ .9
4 /8"2:&6@ .9
*3"/:#2
*3"/:#2
,9@(48'27 7=%.5%/4'38'38'38#.2
,9@(48'27 7=%.5%/4'38'38'38#.2
$* (." 2!)0
$* (." 2!)0
%)#,2!',
%)#,2!',
,4.ET3JY!195N_'8D!07*=H#3
,4.ET3JY!195N_'8D!07*=H#3
(0':E"5?!4>!2;‹.CN&6A,@M 09"4='7@#4@$3?);G"5> -7$5@
(0':E"5?!4>!2;‹.CN&6A,@M 09"4='7@#4@$3?);G"5> -7$5@
(/"1;"1:%5? .9
(/"1;"1:%5? .9
"&*7@(5=
"&*7@(5=
$.5"-3
$.5"-3
*6? */ */
*6? */ */
"'!' #&
"'!' #&
)9A)=HA_p2GVFew3HU%5>#4>#2;.DQ*
)9A)=HA_p2GVFew3HU%5>#4>#2;.DQ*
(1 3;#6@
(1 3;#6@
,5 /7#3= .6
,5 /7#3= .6
.7 /8 /7
.7 /8 /7
%)&-5,5= 6-4?(.6)/6*07%(."',#).(17%,2 %*
%)&-5,5= 6-4?(.6)/6*07%(."',#).(17%,2 %*
!' "'*6?
!' "'*6?
*/ ).!*0
*/ ).!*0
)0#/7!,2
)0#/7!,2
$( %*%.3%-3!(.
$( %*%.3%-3!(.
!&").(.4$'
!&").(.4$'
,4#08)>J ?J.HW%3
,4#08)>J ?J.HW%3
$(*4:,6?%-3$-4" 2&/6$,2
$(*4:,6?%-3$-4" 2&/6$,2
"&$,1)06&*/
"&$,1)06&*/
)0!.8!/9
)0!.8!/9
& '4:!,1#.4$/5
& '4:!,1#.4$/5
).".4!,1
).".4!,1
"lL0
"lL0
.8.BN;Vg2LZ*=H
.8.BN;Vg2LZ*=H
*3#3
*3#3
.7!1; /8$4=
.7!1; /8$4=
*2 .7!/:
*2 .7!/:
-,3;-2;"!'""(,1: /7''/'*1*/7(,4&(. $(!%)%',' 1' 3 "("% %*0 19(-5 #) #) 29 08#'-"& '.4).4"& 8@
-,3;-2;"!'""(,1: /7''/'*1*/7(,4&(. $(!%)%',' 1' 3 "("% %*0 19(-5 #) #) 29 08#'-"& '.4).4"& 8@
"lL-9B(6?-9B0>F 7B.;B 8A6CL-9B(6?%2;0F0>E
"lL-9B(6?-9B0>F 7B.;B 8A6CL-9B(6?%2;0F0>E
"%",1$/4 8@'17
"%",1$/4 8@'17
# &) 39 #'
# &) 39 #'
,6$4>"2
,6$4>"2
-%(/)-5,08$% "#)
-%(/)-5,08$% "#)
%$% "'!#)"%*
%$% "'!#)"%*
#* $)"& "& $,2)4: %)
#* $)"& "& $,2)4: %)
&)$07! 2 */
&)$07! 2 */
' #-1%.3'4
' #-1%.3'4
,5.DP6Rf-DP3O`8Sa
,5.DP6Rf-DP3O`8Sa
-5l!3="4?%4?&6A(9E%5@(:E#4>j
-5l!3="4?%4?&6A(9E%5@(:E#4>j
#',3)19"(-
#',3)19"(-
"'!#)( 3#'.
"'!#)( 3#'.
$)# 0!' *4:"(.
$)# 0!' *4:"(.
!$#(-&-2!&* $),6
!$#(-&-2!&* $),6
#('4
#('4
"'#-5#,3
"'#-5#,3
(/!*1",3%/6#-4!*1
(/!*1",3%/6#-4!*1
- 1:%(/$%, 08,1;%'- !&$'-' 1
- 1:%(/$%, 08,1;%'- !&$'-' 1
"'#'-)07 5
"'#'-)07 5
#& & (06)07#*/
#& & (06)07#*/
*1 2 2
*1 2 2
3.CQ>Zl2DP1KZ/DR -6
3.CQ>Zl2DP1KZ/DR -6
%- ;E6Qa
%- ;E6Qa
'0&7@ 1:"4
'0&7@ 1:"4
-#$*'*2"$*(,3"#) 07(-3
-#$*'*2"$*(,3"#) 07(-3
)18$,1!' &.4'07!&*!& #*/'/6#*/
)18$,1!' &.4'07!&*!& #*/'/6#*/
%*"(.&,3$ 1
%*"(.&,3$ 1
)0$19! 1
)0$19! 1
' *0!,2
' *0!,2
",0(2:'2;'3:)5
",0(2:'2;'3:)5
-5$09 .7$3=
-5$09 .7$3=
-),3*,4(*2(*1#$*( 2#%*"&**39$'-
-),3*,4(*2(*1#$*( 2#%*"&**39$'-
#('07"'
#('07"'
$(&.3#).
$(&.3#).
$(%,2'06!',!',$,0&.3$*0 %)
$(%,2'06!',!',$,0&.3$*0 %)
# % $,3#)/!&,#,3!)0&29%/5$ 1 3:.9@#-2!,2
# % $,3#)/!&,#,3!)0&29%/5$ 1 3:.9@#-2!,2
#(%3:&2: 3
#(%3:&2: 3
##/6#-3#,1!-0
##/6#-3#,1!-0
(-*7=&18
(-*7=&18
& *3!,6 5!-7
& *3!,6 5!-7
'#-;%/
'#-;%/
&8B*=J.CR#5@$19 ?L BP#193O^(8@
&8B*=J.CR#5@$19 ?L BP#193O^(8@
)1!.7"1;%5?"2
)1!.7"1;%5?"2
- /7&&-&$-*-6(,3 2; /7&)0)-5,19
- /7&&-&$-*-6(,3 2; /7&)0)-5,19
#!& !', & $,0&/4*4;,7>$ 0
#!& !', & $,0&/4*4;,7>$ 0
"''/4(17)28
"''/4(17)28
(,$.4"*.
(,$.4"*.
&*&29! 0
&*&29! 0
(/ *1"-3
(/ *1"-3
'.",3 )0
'.",3 )0
&-"-5"-5
&-"-5"-5
"*#-5'19'3
"*#-5'19'3
*0#.7#.6"-2!,2
*0#.7#.6"-2!,2
$*&2:&2:
$*&2:&2:
"(!)/$ 3
"(!)/$ 3
"2
"2
%-#2:$2
%-#2:$2
-*.8()3$" * 3#$,',4 3;)-5$%,#$)
-*.8()3$" * 3#$,',4 3;)-5$%,#$)
!!%*#*.!& "*/'05 %*
!!%*#*.!& "*/'05 %*
#' $)!&
#' $)!&
$07*7@#-5!)/
$07*7@#-5!)/
&-#-4&19
&-#-4&19
' )5=)6='16$-4
' )5=)6='16$-4
&0")3 '/
&0")3 '/
"2 .54Oa/GV"29=[o%6>
"2 .54Oa/GV"29=[o%6>
5$5? /:
5$5? /:
)0!/7"1;!/8
)0!/7"1;!/8
$()2.2
$()2.2
"&',1%). "&$(-*28-4
"&',1%). "&$(-*28-4
$'!*/)6
$'!*/)6
%/5 5
%/5 5
(,$18$06! /
(,$18$06! /
'0$/9#0:
'0$/9#0:
)0%/9%-8!'0#*3(5?! 3".6#-7%-6&-5$,4
)0%/9%-8!'0#*3(5?! 3".6#-7%-6&-5$,4
-5!2;#4?$5> 0:
-5!2;#4?$5> 0:
&3:&28#-2#-2(5;
&3:&28#-2#-2(5;
&,'28*9?(29)5=
&,'28*9?(29)5=
,4!08 .7%4?
,4!08 .7%4?
!( .5!08
!( .5!08
&)"*.#,2#.3&19!*.!*0
&)"*.#,2#.3&19!*.!*0
(- 1" 0!).&06*6
(- 1" 0!).&06*6
)/$.6'09"(/$)0
)/$.6'09"(/$)0
4$6@$4>
4$6@$4>
)1.FT
)1.FT
& !*0!*0
& !*0!*0
& */! 3&08)5;(4:(16)28
& */! 3&08)5;(4:(16)28
7> 8>" 0
7> 8>" 0
%5>*
%5>*
(1!2
(1!2
-7!0:!0:
-7!0:!0:
.4 08!.8'5@
.4 08!.8'5@
(1!1:!2>!0:"3=
(1!1:!2>!0:"3=
"'$*0,5
"'$*0,5
" & )49!)-
" & )49!)-
#/4#/6 1
#/4#/6 1
/8|
/8|
&-$2
&-$2
'/ -4#2:
'/ -4#2:
-/5=-2:).5/8@/8@-3;*07*07&,2
-/5=-2:).5/8@/8@-3;*07*07&,2
$(&28%/3$-3)6
$(&28%/3$-3)6
&,"*/$/2" 1#.3
&,"*/$/2" 1#.3
#'"',$).
#'"',$).
&;F0EQ4O_2IW AN%:I/ER|(:E 1
&;F0EQ4O_2IW AN%:I/ER|(:E 1
3.CS*>I
3.CS*>I
-'*1'*0!#'
-'*1'*0!#'
#'*0/6"& !$)#&,!%*#(-'-2#(
#'*0/6"& !$)#&,!%*#(-'-2#(
"'#'-/5=$).
"'#'-/5=$).
'*!*/ )/" 2$*0'27$.3
'*!*/ )/" 2$*0'27$.3
')&15)6
')&15)6
.DP4JX0HX3JX4IW-CQ0DQŸ*>L!3?$6C"3A*>N
.DP4JX0HX3JX4IW-CQ0DQŸ*>L!3?$6C"3A*>N
&-#4>$3>%5?
&-#4>$3>%5?
-#%-( 4"#*
-#%-( 4"#*
$-4!)-# /%/3",1" /'05'04&05! . .#,2
$-4!)-# /%/3",1" /'05'04&05! . .#,2
&)$/5#.3
&)$/5#.3
%.!2=}
%.!2=}
&18-9@.9@)36 )
&18-9@.9@)36 )
$(!,1"*/
$(!,1"*/
#&!,1#.4'3:" 1
#&!,1#.4'3:" 1
"(!(/!,1
"(!(/!,1
%**8@*7>'28" 0
%**8@*7>'28" 0
%*"-2 )-
%*"-2 )-
&((39%-2
&((39%-2
!(08# 0",1%/4
!(08# 0",1%/4
)2 0;!2=$4@
)2 0;!2=$4@
%)*5=-9?(17$,1&/3 5:
%)*5=-9?(17$,1&/3 5:
!'#)/$*1$ 1
!'#)/$*1$ 1
',#/5&18",1$-2,7>&/5*3:'27$.2!(,
',#/5&18",1$-2,7>&/5*3:'27$.2!(,
,6=-8>$,1
,6=-8>$,1
&)#/4 *0
&)#/4 *0
%) *0$-3'06,7=
%) *0$-3'06,7=
-.3;-19),3*-5'*/ 06/5=*/6$% "#* %%',' 0$',&*/*/6 "&
-.3;-19),3*-5'*/ 06/5=*/6$% "#* %%',' 0$',&*/*/6 "&
#"(-$ 1 %)
#"(-$ 1 %)
%#,1# /$.4# 2 ).
%#,1# /$.4# 2 ).
5=-8?! 1
5=-8?! 1
"'$*/$).$(,%).%)0$)/&,2%*1%,1%*/$*/& 0
"'$*/$).$(,%).%)0$)/&,2%*1%,1%*/$*/& 0
!$$)/"',
!$$)/"',
#&%,1#*/!(,!& '.4*39
#&%,1#*/!(,!& '.4*39
' )5
' )5
'-")/$*0#(.
'-")/$*0#(.
#'"&*!$("',&.4$,2
#'"&*!$("',&.4$,2
##).'07#).$ 0%-3#)/%-2
##).'07#).$ 0%-3#)/%-2
"%$,1%-2'.4%,2
"%$,1%-2'.4%,2
%) '-#,3%/5
%) '-#,3%/5
!'",2",3!,2#.5# 2 %*
!'",2",3!,2#.5# 2 %*
-&,4$).% 1
-&,4$).% 1
!%',2 18#(-
!%',2 18#(-
#'#).%*/"(,%,2&-3)28#*/
#'#).%*/"(,%,2&-3)28#*/
"$,1 %)!&*"(-$*1"*0
"$,1 %)!&*"(-$*1"*0
%(!*/" 1$.4
%(!*/" 1$.4
&, '-&/4(06)38&15,7= 4
&, '-&/4(06)38&15,7= 4
-)09)/7%,3# 1"',(.5',2 #'"$(%,1 %)
-)09)/7%,3# 1"',(.5',2 #'"$(%,1 %)
!%"(-$*/ %)
!%"(-$*/ %)
#'$,2!&*
#'$,2!&*
!&!(/&.5)4;
!&!(/&.5)4;
!&"*0"*0
!&"*0"*0
&.4,8?'17 (,
&.4,8?'17 (,
"($,3! 1
"($,3! 1
!& (-!*0&27%/4%,1)38 9?(49%-5
!& (-!*0&27%/4%,1)38 9?(49%-5
"'!).#-2
"'!).#-2
!'#)0%-3
!'#)0%-3
-&)0' 2#&,'-5"&,#).#*/#).$)/!&*
-&)0' 2#&,'-5"&,#).#*/#).$)/!&*
!#(-'/4$*/!%*#).'06 $)(18!(,
!#(-'/4$*/!%*#).'06 $)(18!(,
#)# 1%.5"*0
#)# 1%.5"*0
'5.TxM
'5.TxM
$,4&18(2:"*/
$,4&18(2:"*/
$* *2
$* *2
'/$(."&
'/$(."&
!$"' %-2!&*
!$"' %-2!&*
!%%,1-8@!&*$,1
!%%,1-8@!&*$,1
!%!&* $(
!%!&* $(
!"*0&/6#(-
!"*0&/6#(-
'.!)0!*1
'.!)0!*1
$&/3)3:" 0
$&/3)3:" 0
.7?'06 *0
.7?'06 *0
"( #) #(
"( #) #(
$) $)$(/
$) $)$(/
!&!2; 0
!&!2; 0
#& $("'
#& $("'
!%& 1$).
!%& 1$).
"'&-4$)0"%*
"'&-4$)0"%*
& #-2 */
& #-2 */
-3:.6>(2;"*0
-3:.6>(2;"*0
$("*/ )/%-4 (.
$("*/ )/%-4 (.
!"#((,2).4%*0
!"#((,2).4%*0
"%"%*!$(!$)#& $(-%)/' 1"%*"% (,2%(-#%*
"%"%*!$(!$)#& $(-%)/' 1"%*"% (,2%(-#%*
18@-5 6=!(-
18@-5 6=!(-
&!(.'/7")/
&!(.'/7")/
"' &, (-(3:#*1
"' &, (-(3:#*1
#'"*0 */
#'"*0 */
$'#',!&
$'#',!&
(.$ 1#%*$(/
(.$ 1#%*$(/
$(&05' 1!#'!%*# 1
$(&05' 1!#'!%*# 1
$( '-%*1)-3*.6
$( '-%*1)-3*.6
"'"/8$3=
"'"/8$3=
&)/).4$',
&)/).4$',
#'$.4&08
#'$.4&08
' #,3*3:-49*/4&,1.8>,5;)05*39)07*/617?
' #,3*3:-49*/4&,1.8>,5;)05*39)07*/617?
-4"/7"29
-4"/7"29
(-#-2$-3$.2!).
(-#-2$-3$.2!).
',!*/",0
',!*/",0
# 0)6
# 0)6
'.5'/5 6=)39$*0$ 0(26# 0-7>(17&-2'05%-2
'.5'/5 6=)39$*0$ 0(26# 0-7>(17&-2'05%-2
%*!&*%-1")-&.3,6
%*!&*%-1")-&.3,6
%)*5
%)*5
% "*0)4
% "*0)4
%*%-2%)/!"(%)/ 4
%*%-2%)/!"(%)/ 4
' &.5,5
' &.5,5
! (.&07$ 3
! (.&07$ 3
$(#&, #)
$(#&, #)
"'!(.'08!).#,4$ 1 "&
"'!(.'08!).#,4$ 1 "&
-.2:*,5( 4 "*%'0).9$'2 )&&.),2"&,!% %)0 07(*/##'*.4%'-( 1' 0&*0% 1'*1')-,18 "'%*0#'-"'
-.2:*,5( 4 "*%'0).9$'2 )&&.),2"&,!% %)0 07(*/##'*.4%'-( 1' 0&*0% 1'*1')-,18 "'%*0#'-"'
" ' # 2!(.$.4" 0
" ' # 2!(.$.4" 0
#( )/%.5(18(3;&/5 (-!),(16(17 ',
#( )/%.5(18(3;&/5 (-!),(16(17 ',
-()0 4''1%(2
-()0 4''1%(2
)#&0#&/! ("" &'0
)#&0#&/! ("" &'0
%%'0')1$$)$$*( 2""().5!&
%%'0')1$$)$$*( 2""().5!&
"$',(.4%-3
"$',(.4%-3
"'#*0# 1
"'#*0# 1
"& '-%.5(3:
"& '-%.5(3:
!%!*2$-4# 0$-2$/3
!%!*2$-4# 0$-2$/3
$*"'.$-4
$*"'.$-4
%*!*1%,3*08*18&,1$*/$ 1!(.
%*!*1%,3*08*18&,1$*/$ 1!(.
%( %)',2,/7
%( %)',2,/7
!%*%(.%)/
!%*%(.%)/
$('-3*29% 2
$('-3*29% 2
"% 1"-4
"% 1"-4
& *0"-2
& *0"-2
&,&2;*5
&,&2;*5
(,# 0#,1%-3#*/"(.$.4!).$,3!(-
(,# 0#,1%-3#*/"(.$.4!).$,3!(-
& "*1%-1
& "*1%-1
%)# 1$-4#*0'17,9@%/4
%)# 1$-4#*0'17,9@%/4
$.4$/4&17(39
$.4$/4&17(39
$.".9"/8
$.".9"/8
(,#,1)5;)28
(,#,1)5;)28
(/!-2!-2
(/!-2!-2
"'&/7")/
"'&/7")/
!& &*$-2%/4 ',
!& &*$-2%/4 ',
%)#-0$-3# 1"*0
%)#-0$-3# 1"*0
#&'38"(,#,4)39&05%.5&-5&/7# 1
#&'38"(,#,4)39&05%.5&-5&/7# 1
$)# 2$,4
$)# 2$,4
$*! 2$-7"*3
$*! 2$-7"*3
%*$/5! 1
%*$/5! 1
$ !)/!&-
$ !)/!&-
& (08'09!*2
& (08'09!*2
$ " 2 $*!'/
$ " 2 $*!'/
#'&/4-7>
#'&/4-7>
%, *2 *0
%, *2 *0
'-!*1(19$,2
'-!*1(19$,2
'-(19$-4
'-(19$-4
!"(1'/8#)1'-6*2:&-4 3
!"(1'/8#)1'-6*2:&-4 3
#)"(0"%,!$,
#)"(0"%,!$,
#$ 1'.4!$)
#$ 1'.4!$)
$",3# 3#,3$.6!)0
$",3# 3#,3$.6!)0
"()5?%.5(39'07
"()5?%.5(39'07
%, '. 1
%, '. 1
& '/)2='.9).7 3>,5=$/7
& '/)2='.9).7 3>,5=$/7
#)!'/"(.
#)!'/"(.
&&)/.7?'-3
&&)/.7?'-3
"'$*1 ',*5=*3;)07(07&-5")0'/5&-3*18(28# /$,2&/3# 2
"'$*1 ',*5=*3;)07(07&-5")0'/5&-3*18(28# /$,2&/3# 2
$* $)!&,
$* $)!&,
% #(% 1)08% 2 #)
% #(% 1)08% 2 #)
&.3%,2 &*&.5!*2(19&.6&,4'18$,4%-5
&.3%,2 &*&.5!*2(19&.6&,4'18$,4%-5
%*")/&09%/7!).$,2!(/ %,
%*")/&09%/7!).$,2!(/ %,
-$',)-5(,4"'
-$',)-5(,4"'
#("*0 $
#("*0 $
$"&, #)!$*
$"&, #)!$*
%* */!*0!*0#-4!*1
%* */!*0!*0#-4!*1
$(",3!'- %)(27$ 1"'-
$(",3!'- %)(27$ 1"'-
"& *3",5
"& *3",5
$, &-" 2 '.# 4
$, &-" 2 '.# 4
%*")1# 1
%*")1# 1
(,#,1 */
(,#,1 */
!%! 0!*0
!%! 0!*0
"/5!,4 ,3
"/5!,4 ,3
*1",1(07%)0 3;-4=-3
*1",1(07%)0 3;-4=-3
!' )/#,4$.5#,3
!' )/#,4$.5#,3
#)&,3&-3#(/
#)&,3&-3#(/
!%!',!'. )0
!%!',!'. )0
&,! 0! 0
&,! 0! 0
#",2!*0 )/
#",2!*0 )/
&,#/5$.5!*1
&,#/5$.5!*1
$-!)2%,7%,4
$-!)2%,7%,4
"&!(. %* &,
"&!(. %* &,
%*")0!'-$.4
%*")0!'-$.4
!%'-3%-4%-4").
!%'-3%-4%-4").
$ 0%-3",3 */
$ 0%-3",3 */
(.!-3 *0
(.!-3 *0
$(",2 (,
$(",2 (,
#*/)07.8>(.3)3:
#*/)07.8>(.3)3:
$)%,3'.5
$)%,3'.5
& 2' 3!&-
& 2' 3!&-
!'-4-4<.7>
!'-4-4<.7>
(."*1$05
(."*1$05
&-$-6"'-
&-$-6"'-
$(!)0 (0!(0%,5 %-
$(!)0 (0!(0%,5 %-
$ !(2")3
$ !(2")3
" &*(18# 2
" &*(18# 2
$* '/&.8,5
$* '/&.8,5
"*1&/5)26).5,4%)0%,2 3;&-5%-5
"*1&/5)26).5,4%)0%,2 3;&-5%-5
%*%-5$.4 (.
%*%-5$.4 (.
"'%2:#.4
"'%2:#.4
'-# 3"*1)39,6>*29,4,3;)28)29
'-# 3"*1)39,6>*29,4,3;)28)29
""(-%,2!' ",1
""(-%,2!' ",1
%*#.4"-2
%*#.4"-2
$,)2>)0:)0;%,5
$,)2>)0:)0;%,5
&*!)/! 2
&*!)/! 2
& )/ '. &,"'.$*1)29-8@)18%*/*28'-3(/6)18'.4 4; 4:'/3"'-
& )/ '. &,"'.$*1)29-8@)18%*/*28'-3(/6)18'.4 4; 4:'/3"'-
#(!&*&/4,8?,8@"-1 *.! 0
#(!&*&/4,8?,8@"-1 *.! 0
%," 4 0
%," 4 0
)-&38! 0
)-&38! 0
$&)3:&.3'/5&,3
$&)3:&.3'/5&,3
*- )-! 0# 0"*/$,1$*.-6=&.3$ 0&-3"',"',%,3)/6-5
*- )-! 0# 0"*/$,1$*.-6=&.3$ 0&-3"',"',%,3)/6-5
$*%.4&04$/2&16$-3"*0
$*%.4&04$/2&16$-3"*0
% 3
% 3
%*!)0&,3"& &,2.7>-6;'.2(.3)27"(-
%*!)0&,3"& &,2.7>-6;'.2(.3)27"(-
&")0*2:,5;'.2#( *28*3:&-3,4;.7=&-2 %* ' $,1)3;!&-
&")0*2:,5;'.2#( *28*3:&-3,4;.7=&-2 %* ' $,1)3;!&-
(.!(.(38#/9
(.!(.(38#/9
!$",1",1
!$",1",1
(-&,4,3;-2:'*1$&-%*1 %)
(-&,4,3;-2:'*1$&-%*1 %)
!(,*3:)39 (,
!(,*3:)39 (,
& $.4%.2$*.*2:.6='-3$)-&*//7?-6; 39'-5%*0 5=%,2'/6&.7 '/ &-
& $.4%.2$*.*2:.6='-3$)-&*//7?-6; 39'-5%*0 5=%,2'/6&.7 '/ &-
'0#.5" 1
'0#.5" 1
# !'. %)
# !'. %)
!$$/4!(.)/7-6=-7>/8@*39/9@,5
!$$/4!(.)/7-6=-7>/8@*39/9@,5
).#-5&18
).#-5&18
"&!&,&.4$,0$ 0(08(.6#(.& 2*18& 0
"&!&,&.4$,0$ 0(08(.6#(.& 2*18& 0
$#(-!%**4:$ 2
$#(-!%**4:$ 2
"'"(-'06#,2
"'"(-'06#,2
& #)0*/7-5=-5
& #)0*/7-5=-5
&*! 0 )0
&*! 0 )0
! 1#,3 4:$ 0 (-
! 1#,3 4:$ 0 (-
#(0(-5&*0(,3-4;)05'-4,3
#(0(-5&*0(,3-4;)05'-4,3
"'"(-&/4'06 %
"'"(-&/4'06 %
"!)1#,5"-3#-5
"!)1#,5"-3#-5
& " 4'2;(1: 28,49).5'.5#,4
& " 4'2;(1: 28,49).5'.5#,4
%-"(/!$)
%-"(/!$)
#)#)1%*1&/6
#)#)1%*1&/6
$'!)0" 1
$'!)0" 1
$ " 2" 2
$ " 2" 2
&-$-5!'-!&*%-2$,3 '*&.4$*/$ /!' %,2-5<.6>(17,5=',2!$)
&-$-5!'-!&*%-2$,3 '*&.4$*/$ /!' %,2-5<.6>(17,5=',2!$)
"'$)0 3:,28,3:' 4$(0$)1#*0!(,
"'$)0 3:,28,3:' 4$(0$)1#*0!(,
$('07(18%/6 )/
$('07(18%/6 )/
!' !( !(
!' !( !(
"(!$*"% #%,#%-"%-!%-
"(!$*"% #%,#%-"%-!%-
")!$,"%."%.!#,
")!$,"%."%.!#,
$. (2!(2
$. (2!(2
&0 '2 '2 '2 &2
&0 '2 '2 '2 &2
'2 '2 '2 '2 (3 &1 '2!(3!)4!(4
'2 '2 '2 '2 (3 &1 '2!(3!)4!(4
&0 '2"*5")4")4!(4 '2
&0 '2"*5")4")4!(4 '2
%0 &2")4")5!(2!(2 &1
%0 &2")4")5!(2!(2 &1
%/ &1 &1
%/ &1 &1
$. &1$*4$ 6#)4#*5
$. &1$*4$ 6#)4#*5
%/ '2 '2 &1
%/ '2 '2 &1
%/ '2#)4!(3
%/ '2#)4!(3
- (2!(3!(4!(4!(4 '3 '3 '3 (3 (3 (3
- (2!(3!(4!(4!(4 '3 '3 '3 (3 (3 (3
&1 &2 &2 &2 '3 '3 '3 '3 '2 '2 &2
&1 &2 &2 &2 '3 '3 '3 '3 '2 '2 &2
&1 '2 '2 '2 '2
&1 '2 '2 '2 '2
&2 &2 &1 &1 &0
&2 &2 &1 &1 &0
&1 &2 &2 '2 '2 '2 '2
&1 &2 &2 '2 '2 '2 '2
'.5'/5 6=
'.5'/5 6=
4;.9?(16
4;.9?(16
(,# 0#,1
(,# 0#,1
!',*4;$*0
!',*4;$*0
'/&.8,5
'/&.8,5
-462:= 03)--%(&!!!
-462:= 03)--%(&!!!
%*)% *% '-.
%*)% *% '-.
#%"',*#%!!
#%"',*#%!!
-/ 140, %