James Okolica

Gilbert Peterson

A COMPILED MEMORY ANALYSIS TOOL

Keywords: Live response, memory analysis, rootkit detection

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

When a large enterprise responds to a cyber security incident, it may not be feasible to perform the recommended disconnection and imaging process to gather forensic evidence [START_REF]National Institite of Justice, Electronic Crime Scene Investigation: An On-the-Scene Reference for First Responders[END_REF], especially in the case of servers that are critical to business operations. According to CNET [START_REF] Shankland | Amazon suffers U.S. outage on Friday[END_REF], Amazon lost $29,000 in revenue per minute during its June 2008 outage. In addition, there have been several recent cases where defendants were found innocent or guilty based on the live response information retrieved at the time of the incident [START_REF] Brenner | The Trojan Horse Defense in Cybercrime Cases[END_REF]. Clearly, tools that can take quick snapshots of affected computers while minimizing the impact on business operations and preserving evidence are vital to digital forensic investigations. Since many of the items of interest in a live response are maintained in computer memory rather than the hard drive, a mini-mally intrusive live response would involve the analysis of a live memory capture.

Three steps are involved in developing a minimally intrusive standalone forensic tool for memory: (i) a front-end memory dump routine that directly accesses physical memory; (ii) a memory analysis tool that extracts environmental and activity information from the memory dump; and (iii) a synthesis tool that correlates the environmental information to provide a human-understandable narrative of what occurred on the machine.

This paper focuses on the second step: developing a compiled memory analysis tool (CMAT) that extracts environmental and activity information from a memory dump. CMAT parses a memory dump to find active, inactive and hidden processes as well as system registry information. It then compiles live response forensic information from these processes and registry files and assembles it into a format suitable for data correlation. CMAT is tested against several utilities that extract forensic information from a live system. Experimental results indicate that CMAT provides comparable information as traditional live response utilities, and also uncovers malware that these tools miss.

Background

Performing a live response allows the capture of forensic information that disappears after the computer is turned off. The benefits of a live response include: gathering clues to better focus a search of the hard drive [START_REF] Sutherland | Acquiring volatile operating system data: Tools and techniques[END_REF]; retrieving decryption/encryption keys for an encrypted hard drive [START_REF] Sutherland | Acquiring volatile operating system data: Tools and techniques[END_REF]; and defeating the Trojan horse defense of "I didn't do it, it was the malware installed on my machine" [START_REF] Brenner | The Trojan Horse Defense in Cybercrime Cases[END_REF]. Valuable live response information that resides in memory includes [START_REF] Carrier | A hardware-based memory acquisition procedure for digital investigations[END_REF][START_REF] Carvey | Windows Forensic Analysis[END_REF][START_REF] Mandia | Incident Response and Computer Forensics[END_REF][START_REF] Sutherland | Acquiring volatile operating system data: Tools and techniques[END_REF]:

System date and time

Logged in users and their authorization credentials Network information, connections and status Process information, memory and process-to-port mappings

Clipboard contents

Command history

Services and driver information

Open files, registry keys and hard disk images One of the arguments against live response is that the evidence capture process modifies the machine state. Several techniques have been proposed to address this issue [START_REF] Boileau | Hit by a bus: Physical access attacks with FireWire[END_REF][START_REF] Carrier | File System Forensic Analysis[END_REF][START_REF] Libster | A proposal for an integrated memory acquisition mechanism[END_REF][START_REF] Suiche | Sandman Project[END_REF]. These techniques attempt to capture all the memory instead of specific pieces of forensic information. This helps answer the immediate forensic questions and also provides a means to answer additional questions that may come up later in the investigation. The alternatives include hardware-based memory acquisition [START_REF] Boileau | Hit by a bus: Physical access attacks with FireWire[END_REF][START_REF] Carrier | File System Forensic Analysis[END_REF], virtual machines, hibernation files [START_REF] Suiche | Sandman Project[END_REF] and operating system patches [START_REF] Libster | A proposal for an integrated memory acquisition mechanism[END_REF].

Hardware-based memory acquisition techniques circumvent the reliance on the operating system by using hardware that interacts directly with memory. These techniques involve the use of custom hardware [START_REF] Carrier | File System Forensic Analysis[END_REF] or the FireWire interface [START_REF] Boileau | Hit by a bus: Physical access attacks with FireWire[END_REF] for direct memory access. But the two techniques suffer from the "northbridge exploit" [START_REF] Rutkowska | Beyond the CPU: Defeating hardware-based RAM acquisition (Part I: AMD case)[END_REF]. Since all peripheral devices use the northbridge to interface with the CPU and main memory, malware can be loaded onto the northbridge to subvert memory access by a peripheral while leaving the CPU and operating system untouched. This enables the malware to remain undetected.

The northbridge exploit can be contained by constraining memory capture techniques to the CPU and operating system. Virtual machines provide an easy method for dumping memory. When an incident occurs, a forensic investigator takes control of the actual machine, suspends the virtual machine, and then dumps the memory in the virtual machine. However, one problem with this method is that implementing such a policy within a large organization incurs high costs in terms of time and money. Moreover, software virtualization can slow the perceived responsiveness of a computer because every command has to go through an additional level of abstraction.

Hibernation files offer an alternative memory capture method that relies on the operating system [START_REF] Suiche | Sandman Project[END_REF]. The process of analyzing hibernation files requires placing the system in the hibernation mode, copying the hibernation files and extracting their contents. However, while the hibernation function is enabled on many laptops, it is disabled by default on most desktops. Desktops can be reconfigured to enable the hibernation mode, but this must be done in advance. Other difficulties include the lack of published descriptions of hibernation file formats and the fact that not everything in memory may be stored.

Libster and Kornblum [START_REF] Libster | A proposal for an integrated memory acquisition mechanism[END_REF] have proposed an alternative method for acquiring a pristine copy of memory. The method involves modifying the operating system kernel so that a user-defined function key would cause the operating system to immediately suspend, generate a memory dump that it sends over a network to a secure machine, and then resume execution. The difficulty with this method is to ensure that it is deployed for all the disparate systems of a large enterprise prior to an incident.

While a pre-installed operating system patch appears to be an ideal solution in cases where prior access is not possible, the only option available is to initiate a new process to dump system memory. To minimize the impact, the application should limit application program interfaces (APIs) that interface with the operating system and the use of a graphical user interface (GUI). Unfortunately, while many available tools (e.g., [START_REF]Memory DD[END_REF][START_REF] Suiche | [END_REF]) are run from the command line, most use operating system APIs to dump memory. The only exception appears to be Memoryze [START_REF] Mandiant | [END_REF].

Memory analysis tools extract different amounts and types of live response data from a memory dump. The Volatility tool [START_REF] Walters | Volatools: Integrating volatile memory forensics into the digital investigation process[END_REF] extracts the date and time, running processes, open ports, process-port mappings, strings-process mappings, process-file mappings, process dynamic link libraries (DLLs) and open connections. Additional plug-ins are available to enhance the functionality of Volatility, including the ability to extract registry information. However, Volatility suffers from the limitation that it does not extract port information for all Windows operating system service pack and patch configurations.

Comprehensive open source memory analysis tools written in compiled languages such as C/C++ are not available for Windows XP systems. Betz [START_REF]Memparser[END_REF] has developed a tool that finds processes and threads in memory and extracts some information, but it is limited to Windows 2000 systems and does not support the analysis of registry files, network activity and process creators. PTfinder [START_REF] Schuster | PTfinder (version 0.2.00[END_REF] also searches through memory for processes and threads, and handles memory captures from Windows XP systems. However, like Betz's tool, it does not support the analysis of registry files [START_REF] Dolan-Gavitt | Forensic analysis of the Windows registry in memory[END_REF], network activity and process creators [START_REF] Dolan-Gavitt | Linking processes to users (moyix[END_REF].

Compiled Memory Analysis Tool

The compiled memory analysis tool (CMAT) is a C++ command line utility that runs on Linux and Windows operating systems. It parses a Windows XP memory dump to obtain information on user accounts, the Windows registry and running processes. CMAT provides system, process, registry, open ports and user information in a standalone tool that runs without API calls or high-level language interpreters. CMAT operates in two passes. During the first pass, CMAT searches the memory dump file for processes, threads and registry hives. In the second pass, CMAT organizes the process, thread and registry entries it has found and produces output in a format similar to that produced by common live response tools.

The Windows kernel incorporates data structures needed for the operating system to function. These data structures are useful for extracting live response information. For example, processes are stored in memory as EPROCESS structures. Potential process structures can be found by searching for strings formatted as a DISPATCH HEADER of a KPROCESS. In the case of Windows XP SP2, this corresponds to a DISPATCH HEADER of 0x03 and a KPROCESS size of 0x1b. After a likely process is found, it is double-checked to ensure that the page directory table base is a valid virtual memory location [START_REF] Russinovich | Microsoft Windows Internals[END_REF][START_REF] Schuster | Searching for processes and threads in Microsoft Windows memory dumps[END_REF]. If the page directory table does not point to a valid location, then what has been found is a process executable or process data, not a process header. This method finds all processes, including normal active processes, hidden active processes (e.g., processes hidden by a rootkit like FUTo [START_REF] Silberman | FUTo, Uninformed[END_REF]), defunct processes and processes from previous boots that have not been removed from memory. In addition, because the EPROCESS structure also contains a doubly-linked list of all active processes, processes that were missed during the string search can still be found by traversing the linked list. The scan of the linked list also assists in identifying process that have been disconnected from the list (which is how FUTo hides processes).

CMAT then searches through the memory dump for registry hives. In a manner similar to how it searches for processes, CMAT looks for CMHIVE structures with a signature in Windows XP of 0xbee0bee0 [START_REF] Dolan-Gavitt | Forensic analysis of the Windows registry in memory[END_REF]. Just as a process must have a valid memory address for its page directory table base, a registry hive must have a valid memory address for its base block. CMAT also takes advantage of the doubly-linked CMHIVE structures to ensure that all the registries are found. CMAT then moves through the default user registry to find relationships between session IDs and user names. In Windows XP, it finds the ProfileList key under \USER\MICROSOFT\WindowsNT\CurrentVersion and then makes a record of the session IDs and their associated ProfileImagePaths, providing human-understandable names for the users that were logged in.

As a part of its processing, CMAT translates the virtual addresses stored in Windows kernel data structures into physical memory locations. Windows XP has two levels of indirection when it is run on a 32-bit machine; this is achieved by splitting a virtual address into a page directory index, a page table index and an offset. However, if large (4 MB) pages are used, there is one level of indirection; if physical address extensions are used, there are three levels of indirection. While CMAT can detect if large pages are being used, it requires user assistance in the form of a parameter value to discern if physical address extensions are in use. One method to avoid this is to try alternative virtual-to-physical mappings until the correct mapping is found [START_REF] Walters | Volatools: Integrating volatile memory forensics into the digital investigation process[END_REF]. Another method is to locate the kernel system variables that store this information [START_REF] Dolan-Gavitt | Finding kernel global variables in Windows (mo yix[END_REF].

After the process entries and registry hives are found, CMAT either interactively or in the batch mode provides forensic information of interest. This includes general system information (operating system and number of processes) and process information, which includes the user who created the process, full path of the executable, command line used to initiate the process, full paths of loaded DLLs, and the files and registry keys accessed by the process.

Test Methodology

The CMAT output was compared with the outputs of five Sysinternals utilities: psinfo, pslist, logonsessions, handles and listdlls [START_REF] Russinovich | Sysinternals Suite[END_REF]. System information that was examined included the operating system version, number of processors and number of processes. The process information examined included the process creator, files opened, registry keys accessed and modules loaded. The only type of volatile information not examined was network information, including the ports and sockets opened by processes. Also, a comparison was made of the number of distinct DLLs used by ManTech's physical memory dump (mdd) utility compared with the number of distinct DLLs used by the Sysinternals utilities.

A Windows XP SP3 system with 2,038 MB RAM was used in the tests. Several application programs were launched on the machine including Internet Explorer, Word, PowerPoint, Visual Studio, Calculator, Kernel Debugger and two command line shells. One of the command line shells was hidden by the FUTo rootkit [START_REF] Silberman | FUTo, Uninformed[END_REF]. The memory dump was collected using ManTech's mdd utility (version 1.3), which required 67 seconds.

Test Results

The test results in Table 1 demonstrate that CMAT provides the same or equivalent information as the Sysinternals utilities. In addition, CMAT found the process hidden by FUTo while the Sysinternals utilities did not. The Sysinternals utilities failed to associate several processes with the users that started them. Except for the inability of CMAT to provide network information, CMAT's performance in the tests was exemplary.

System Information: CMAT and psinfo provide the operating system version, major and minor version, service pack number and build number. Also, they both provide the number of processors. The psinfo utility also provides the processor type and speed along with the video driver used. However, this information appears to have limited forensic use; therefore, this feature was not implemented in CMAT. The one additional piece of information provided by psinfo compared with CMAT is if a physical address extension is used (as described above, this information is passed to CMAT as a parameter). A future version of CMAT will address this shortcoming.

Processes: CMAT reported 58 active processes while pslist reported 57 processes; 56 of the processes matched (97% equality). The program missing from the CMAT results was pslist, which was not running when the memory was dumped. Similarly, the program mdd 1.3 was missing from the pslist result, which makes sense because the memory was already dumped when pslist was executed. The other program missing from the pslist result was cmd.exe, which was hidden by the FUTo rootkit; this demonstrates that a program intentionally hidden by malware can still be found by CMAT. While CMAT provides a single process listing that includes the user who created the process, Sysinternals uses a separate utility (logonsessions) for this purpose. Comparison of the CMAT and logonsessions results showed that nine processes were not listed by logonsessions, including all the processes owned by LocalService and NetworkService, and four processes owned by SystemProfile (including the system and idle processes). Identifying all the system processes is vital to detecting if malicious services were executing on the machine.

Loaded Modules: CMAT and the Sysinternals listdll utility provided identical lists of loaded modules (100% equality).

Files and Registry Keys: The lists of files and registry keys provided by CMAT and the Sysinternals handle.exe utility matched, except for the temporary files that were opened and closed between the memory dump and the execution of handle.exe. These files were listed as having [RWD] access. CMAT identified file handles that were actually device handles (e.g., \Device\KsecDD), but was unable to print the names of the devices. Similarly, while handle.exe summarized the long code for the current user with a succinct HKU, CMAT displayed the entire registry key.

Dynamic Link Libraries: As mentioned above, minimizing the number of loaded modules (DLLs) used when performing a live response is desirable because less evidence on the hard drive is modified. This test compared the numbers of DLLs used by Man-Tech's mdd memory capture tool and the five Sysinternals utilities.

To collect the data, mdd was executed during the time that each of the five Sysinternals utilities was running. The DLL lists associated with the five Sysinternals utilities were extracted from the memory dumps using CMAT; duplicate DLLs among the five utilities were removed and the results were then tallied. The results show that performing a memory capture instead of a live response significantly reduces the impact on the evidence. In particular, the memory capture used 15 DLLs while the five Sysinternals utilities in total used 48 different DLLs, corresponding to a 69% reduction in system impact.

Conclusions

The CMAT live response tool provides comparable information from a memory dump and produces a 69% less impact on system state (potential evidence) than the popular Sysinternals utilities. However, CMAT is unable to extract several pieces of useful forensic information, including the mapping of ports and sockets to processes (provided by the Sysinternals portmon utility). The difficulty arises because this information is stored in the data section of the TCP/IP module. While the port and socket data reside in specific locations for different Windows operating system versions, service packs and patch configurations, their locations can change when new patches are installed.

A future version of CMAT will target Microsoft Windows XP operating systems. One difficulty is to correctly map the kernel data structures for different Windows versions (e.g., Vista and Windows 7). This difficulty can be addressed by retrieving the operating system data structures dynamically after the operating system is identified upon parsing the memory dump. Microsoft has recognized the need for such flexibility by providing the data structures (symbol tables) for download in real time to support its kernel debugger. CMAT will attempt to make use of these symbol tables to facilitate memory analysis for different versions of the Windows operating system.

Table 1 .

 1 CMAT vs. Sysinternals utilities.

	Information	Result	Correlation
	Operating System Version Windows XP SP3 v5.1 Build 2600	100%
	Processor Count	2	100%
	Process Count	56 of 58	97%
	User IDs	50 of 57	88%
	Loaded Modules	57 of 57	100%
	Files	57 of 57	100%
	Registry Keys	57 of 57	100%
	DLLs Used	15 (CMAT) vs. 48 (Sysinternals)


Anne-Marie Faugeron-Crouzet

Edith Ginglinger
email: edith.ginglinger@dauphine.fr

Vasumathi Vijayraghavan

Sudi Sudarsanam

Georges Gallais

Cereg

French IPO returns and subsequent security offerings: Signaling hypothesis versus market feedback hypothesis

Keywords: IPOs, seasoned equity offerings, convertible bond issues, signaling hypothesis, market-feedback hypothesis JEL classification: G32

French IPO returns and subsequent security offerings:Signaling hypothesis versus market feedback hypothesis

Edith Ginglinger, Anne-Marie

I. Introduction

It is well documented that initial public offerings (IPOs) of common stock in most countries are undervalued † . Various explanations have been offered to account for the phenomenon, one of them being the signaling hypothesis. According to [START_REF] Allen | Signaling by Underpricing in the IPO Market[END_REF], [START_REF] Grinblatt | Signalling and the Pricing of New Issues[END_REF], [START_REF] Welch | Seasoned Offerings, Imitation Costs, and the Underpricing of Initial Public Offerings[END_REF] and [START_REF] Chemmanur | The Pricing of Initial Public Offerings: a Dynamic Model with Information Production[END_REF], managers use the offering price as a signal given a situation of asymmetric information. The initial owners of the issuing firm are supposed to be better informed than other investors. They signal positive information through the underpricing of the stock in the IPO. Signaling is costly because it results in a wealth transfer from initial owners to new investors. The signaling cost is compensated for by the fact that the subsequent capital issue will be made at a higher share price.

The companies could issue an IPO by proposing to investors a smaller fraction of their capital initially, with a subsequent issue completely satisfying their total capital needs. In this context lesser quality firms will not be able to compete with higher quality firms. The former firms, given that there would be the risk that their lower quality would be revealed before the capital issue, would prefer to issue the stock initially at their true price for the exact amount of capital desired. The signaling models explicitly take the future equity offerings into account in the IPO's pricing decision.

The second sustained hypothesis would be the market feedback hypothesis, as suggested by [START_REF] Jegadeesh | An empirical investigation of IPO returns and subsequent equity offerings[END_REF], and modeled by [START_REF] Van Bommel | Messages from market to management: the case of IPO's[END_REF].

According to these authors, market participants are better informed about the true value of the firm than the initial shareholders. This information would be revealed to them by the evolution of the stocks' price after the IPO. If this information were of a positive nature, the managers would be encouraged to invest in the firm and issue more stocks subsequently. These hypotheses are in total contradiction. In the signaling hypothesis, the managers know the true value of the firm better than the market, and transmit their information through an initial underpricing. In the market feedback hypothesis, the market participants are better informed than managers are and their aggregate demand will reveal their information to the firm.

In this paper, we examine the impact of two IPO-related choices of the firm. One is the IPO procedure chosen. The other is the post-IPO financing of the companies, which we examine by including stock issues but also convertible bond issues, as well as bonds and stocks with attached warrants (all potential shares). Most of the empirical work to date has looked at the first seasoned equity issue following the IPO without taking into account other kind of security issues following the IPO. ‡ Our results show that the initial underpricing varies strongly according to the type of securities first issued within a four-year period after the IPO. We find an average initial return of 24.31 % for the firms who issue security in the four-year period following the IPO but of 31.36% for the firms who issue shares after the IPO and of 12.76% for those who issue convertible bonds or security with attached warrants. Firms with low initial returns issue equity very scarcely, but prefer to issue future equity in the form of convertibles or warrants. 32% of the firms with very large initial returns carry out a seasoned equity offering, while this proportion is only of 6% for the low initial returns IPOs. This result shows that managers take into account the assessment of the market in their choice of subsequent security issues. However, these results vary according to the chosen IPO procedure. For the fixed price procedure, the initial return is significantly larger for the firms who return to the market within a four-year period, whatever security is issued, compared to firms who do not return to the market.

The initial returns do not differ according to the type of security that is offered. For the auction-like procedures (direct quote or reservation price method), the initial underpricing is not different whether the firm returns to the market or not. These results may partially validate the signaling hypothesis. We observe that there is a link between underpricing and subsequent security offerings only for the fixed price IPOs. This link disappears for the auction-like procedures. For the firms introduced by auction-like methods that return to the market, the initial return is significantly higher for the equity issuers than for the convertible bonds or warrants ‡ Michaely and Shaw (1994) examine both equity and debt offerings. [START_REF] Jegadeesh | An empirical investigation of IPO returns and subsequent equity offerings[END_REF] include units in their sample of SEO's.

issuers. In fact, we find that the firms introduced with these procedures go back to the market whatever the initial return, but they decide on the type of security to issue according to this return. The market feedback hypothesis as developed in the [START_REF] Van Bommel | Messages from market to management: the case of IPO's[END_REF] model would imply that the firms, encouraged by the investors, expand their activities. Our findings show that the market feedback does not keep firms from getting new financing, but that it rather determines the type of security to issue. In addition, the auction-like procedure should exhibit a greater sensitivity to post-IPO returns than the fixed price procedure. When the feedback is not very good, the initial shareholders decide to postpone the capital dilution by issuing either convertible bonds or bonds or equity with attached warrants rather than straight common stock. This kind of stage financing allows an initial IPO-related financing combined with a subsequent rounding out of financing needs in the form of warrants or conversion of convertibles. Our results are therefore less favorable to the market feedback hypothesis than those of Van Bommel and Vermaelen (2002).

We examine further the post-IPO abnormal performances for several periods. The post-IPO performances do not help to explain the decision to go back to the market. Whatever the post IPO performances considered, the initial underpricing better explains the decision to issue security during a four-year period following the IPO. Overall, our results tend to validate the signaling hypothesis for the fixed-price IPOs, which are probably run by managers who know better than the market the value of the firm. For auction-like procedures, the immediate market feedback, measured by underpricing, seems to help to predict the type of subsequent security offering, but not the financing itself. The managers listen only partially to the market: when the message is unfavorable, rather than deciding not to invest at all, they prefer to use stage financing.

The paper is organized as follows. In Section 2, we discuss the two competing hypotheses: signaling hypothesis versus market feedback. In Section 3 we present the data. In Section 4, we discuss the empirical results. A summary and conclusion are presented in the last section.

II. Signaling hypothesis versus market feedback.

In this paper, we confront two competing hypotheses of IPO undervaluation: the signaling and market feedback hypothesis. We believe the specifics of the French market are very conducive to examining this question-for we have a neat split between fixed price and auction-like procedures. In addition, we have a decomposition of the typology of subsequent capital financing needs. We propose that the fixed price method, followed by a subsequent return to the capital market in the form of stock issues will provide greater evidence for the signaling hypothesis. An auction-like procedure is more compatible with market feedback.

Signaling hypothesis

We propose to further elaborate on the substantial body of empirical results that have examined the signaling hypothesis. § Though not necessarily formally, the IPO decision and the subsequent financing decision, we suppose, are made at the same time by the initial shareholder body. Thus the originating shareholders would accept an initial undervaluation in order to be able to take advantage of future gains. Under this hypothesis, we should be able to prove a link between the initial undervaluation and a subsequent return to the capital markets.

Market feedback hypothesis

In the case of the market feedback hypothesis, the market participants are better informed than the managers are and in the aggregate will reveal their information to the firm. Here a subsequent return to the capital markets will be a function of post-IPO abnormal returns. Thus if post-IPO returns are favorable, they will consider returning to the market for subsequent financing needs. The decision to return will be a positive function of the initial undervaluation as well as post-IPO returns. One example of empirical validation of the market feedback hypothesis § See for instance the papers of [START_REF] Jegadeesh | An empirical investigation of IPO returns and subsequent equity offerings[END_REF], [START_REF] Garfinkel | IPO underpricing, insider selling and subsequent equity offerings: is underpricing a signal of quality[END_REF], [START_REF] Levis | Seasoned equity offerings and the short and long term performance of initial public offerings in the UK[END_REF] and [START_REF] Spiess | The IPO and the first seasoned equity sale: issue proceeds, owner/managers' wealth, and the underpricing signal[END_REF] is in Van Bommel and Vermaelen (2002), who find that abnormal capital expenditures is 16.9% greater when the market feedback is positive.

2.3. Choice of an IPO procedure.

We study the French market, which is characterized by several IPOs' procedures: ** fixedprice offer (FPO) and two auction-like mechanisms, direct quote (DQ) and reservation price procedure (RPP). † † -Fixed price offer (FPO): the company announces a definitive and fixed price 48 hours before the IPO. The total demand is computed. If the ratio of supply to demand is above 0.8%, the issue is sold at the above price. If it is lower than 0.8%, the IPO is postponed and a higher price is set. In this mechanism, there is no discretion allowed in the allocation of the shares.

In this case, investor demand has no effect on the price and quantity. Thus, the price is not a function of the subsequent demand, but only of the strategic evaluation of the company managers. A deliberately low price could be fixed in order to send a signal to investors. It is for this reason that we think this procedure would be favored in the case of market signaling.

-The direct quote procedure (DQ) is a type of limited auction; the minimum price and the quantity are determined 48 hours before the IPO and investors submit market and limit orders. The total demand is computed. If it is large, the price is raised up to a limit of 10%, and there is a prorata rationing between all eligible orders. If the proportion of filled orders is less than 5%, the IPO is postponed at a fixed price procedure.

-Reservation price procedure (RPP). The initial shareholders set the quantity offered and the minimum acceptable price five days before the IPO. The investors submit limit orders. The total demand function is computed and the EURONEXT sets the IPO price as a function (non-explicit) of this demand. Euronext determines as well the maximum price. Orders greater than the maximum price are eliminated, because they are considered as not revealing ** The characteristics and description of the French market can be found in [START_REF] Biais | Selling mechanisms, conflicts of interests and asymmetric information: an empirical analysis of the IPO process in France[END_REF].

† † Until 1999, the names of these mechanisms were "procédure ordinaire" for "cotation directe", "mise en vente" for "offre à prix minimal" and "offre publique de vente" for "offre à prix ferme". Since 1994, the bookbuilding mechanism is used more and more often (see Derrien and Womack, 2002). From 1994 to 1998, half of French IPO's have used such a mechanism, quite similar to the U.S. procedure. But insofar as we need a four-year post-IPO sample, we have not included IPO's using this procedure.

useful information about the true value of the firm. Orders above the IPO price and below the maximum price are allocated prorata. When the demand is too high, the IPO is postponed, and transformed to a fixed price procedure.

Thus for the two latter procedures, the final offer price is a function of investor demand. Still, it has to be noted that this price adjustment is only partial because the price can only partially adjust (which leads to the initial undervaluation). Thus, we feel that these two auction-like procedures would in no way be compatible with signaling, but rather market feedback, since the price is in some measure influenced by investor demand. Once this information is known, the managers of these IPO firms will decide to solicit the capital market again as a function of post-IPO returns, as well as initial IPO undervaluation.

Choice of a subsequent type of security offering

Previous empirical work has looked at the first seasoned equity issue following the IPO without taking into account other kind of security issues, thus firms which have issued convertible bonds after their IPO have been considered as non-issuer firms. Furthermore, firms are considered as belonging to the equity issuers group even when they have first issued convertible bonds after their IPO. If the signaling hypothesis is verified, the cost of initial underpricing is recouped through the subsequent seasoned equity offering, which is explicitly considered at the IPO's date for the totality of the capital needs of the firm. We should thus observe a link between initial returns and subsequent seasoned equity offering.

If the market feedback hypothesis were true, large abnormal returns at IPO issuance and during the months following the IPO would encourage the managers to invest and to finance these investments, without regard to the kind of securities offered to investors. We should then observe a link between subsequent seasoned equity offerings and both the IPO undervaluation and post-IPO returns. Should we consider now the type of subsequent securities issued in the context of the market feedback hypothesis? We think so, since positive market feedback should encourage managers to expand whereas negative feedback should discourage further investments, whatever the form of financing. Convertible bonds as well as unit offerings offer the possibility of stage financing. ‡ ‡ When initial market feedback is not very positive, managers may nevertheless envisage future investments and issue convertibles bonds. As is well known, convertibles are hybrids, offering the immediate advantages of debt, as well as the possibility of converting them a future positive evolution of the company stock. As for units, they allow for an immediate financing by stocks, and a subsequent secondary future stock issuance by the exercise of the warrant. In these two cases, this kind of stage financing represents a sort of commitment by managers to follow closely the futur signals of the market. If these messages are positive, convertible bonds will be converted and warrants exercised.

Summary of the above propositions

In the case of the signaling hypothesis, for which the managers are better informed than the market, we should observe the following:

-a positive correlation between underpricing and further seasoned offering.

-the probability of a seasoned equity issue would be more closely linked to the initial returns than to the post-IPO abnormal returns -A lower percentage of the capital offered in the IPO -A lower level of divestiture by the initial shareholders at the time of the IPO

For market feedback, we should observe the following:

-A subsequent financing when the market sends a positive signal in the form of positive post-IPO returns, which also translates into a positive correlation between the probability of IPO issuance and post-IPO returns.

-No subsequent financing if the market message is unfavorable.

III. Data presentation

Our sample consists of 288 firms that made an initial public offering on the French "second marché" between 1983 and 1994. The "second marché" is a tier of the stock market in France ‡ ‡ On stage financing, see Schulz (1993) for unit offerings and Cornelli and Yosha (2002) for convertibles.

created in 1983 for growth firms for which the listing requirements are less stringent than for the official list (first tier). In 1996, the French market welcomed a new tier, the "nouveau marché"

for young and technological companies, which are not included in our analysis. The data excludes the investment certificates, "certificats d'investissement" issued by the big French bank, Credit Agricole, as well as the IPO's which were only transfers from the French OTC market ("hors cote"). EURONEXT, (the French Stock Exchange), provided most of the data.

Other data was taken from the Annual Reports duly filed at the COB, ("Commission de Operations de Bourse", the French equivalent of the SEC). We also use the prospectuses filed by the companies, which accompanied the IPO and the seasoned security issues. The abnormal returns for the post-IPO periods are calculated using the data of the AFFI-EURONEXT database.

The sample includes initial stock issues by the three different procedures previously presented: fixed price offer, direct quote and reservation price procedure. Since 1993, IPO issuance can also take place through a bookbuilding process. In this case, the underwriter plays a central role. He allocates the offering in a discretionary fashion. In recent years (1996)(1997)(1998)(1999)(2000), a large part of the IPO's used the bookbuilding procedure. Note that unlike in the US, bookbuilding on the "second marché" is compulsorily accompanied, for a fraction of the shares, by another procedure (most frequently fixed price procedure or open price procedure). We did not include the bookbuilding IPOs in the sample due to their small number (15) during the period (1983)(1984)(1985)(1986)(1987)(1988)(1989)(1990)(1991)(1992)(1993)(1994) which we take into account.

There were 288 companies in the sample involving a total of 95 security offerings during the four years (between 1983 and 1998) following the initial issuance. The security issues concerned stocks in 59 cases, convertible bonds or bonds with attached warrants in 23 cases, units of stocks and warrants in 13 cases. § § Thus, about a third of the issuing companies were found to go back to the market within four years of the IPO for additional capital. In our sample, almost all the IPO's were secondary offerings, issued by original shareholders, while the § § We have here taken into account two types of capital emissions: on the one hand stocks, on the other convertibles and units. We characterize the latter as "hybrid", and group them into one category due to the comments made in Section 2.4. In our sample, there were no subsequent straight bond issues for any of the firms.

seasoned offering consists almost exclusively of primary market offerings.

Insert table 2 here

At the initial offering, the mean IPO size is 6.23 millions euros. The mean IPO initial return for our sample, defined as the return from the offer price to the first market-clearing price after the IPO, is 18.67%. The initial return is equal to 31.36% for firms who first issued common stock after the IPO, 7.5% for firms who first issued units of stock and warrants, and 15.74% for firms who issued convertibles bonds or bonds with warrants. This result can be compared to [START_REF] Jegadeesh | An empirical investigation of IPO returns and subsequent equity offerings[END_REF] findings that units are 14% less underpriced than common stock, everything else being equal. [START_REF] Michaely | The pricing of initial public offerings: tests of adverseselection and signaling theories[END_REF] do not find any differences in initial returns according to issuance of equity or debt.

The mean percentage of the shares proposed to investors in the IPO, 11.56%, is very close to 10%, the minimum required percentage. French firms are mostly family held. On average, 51.37% of the shares are held by the familial shareholders, while banks hold 8.23% of the shares, and institutional investors or venture capitalists 16.3%. During the period of our study (1983)(1984)(1985)(1986)(1987)(1988)(1989)(1990)(1991)(1992)(1993)(1994), the shares offered in IPOs were mostly secondary shares. On average, the familial *** Between 1983 and 1994, the original shareholders sold the minimum 10% of shares and relied on subsequent seasoned issues to issue new shares. Things have changed after 1996, when 50% of IPO's on the "nouveau marche" are primary issuances.

shareholders sold 4.74% of the capital, banks 1.96% and institutional investors or venture capitalists 2.04. The IPOs divided equally into the three groups of procedures.

The characteristics of the IPO-issuing firms vary widely depending on whether a subsequent share issuance or other security issuance followed the IPO. The degree of initial underpricing, the capitalization and the ownership structure seem quite different in the various scenarios. In particular, firms who issue hybrid security after the IPO show a larger IPO size and a higher proportion of capital held by banks than those who issue common stock. The mean ratio of the seasoned security offering proceeds to the IPO proceeds is 4.91 for the firms who issue common stock and 4.43 for the firms who issue other securitities. The mean lag between the IPO and the first subsequent security emission is 633 days for stocks, 699 for units and 750 days for convertible bonds (but the difference is not significant).

IV. Empirical results

We first examine the initial and post IPO performance according to whether the firm reenters the market or not. We futher analyze if our results depend on the IPO procedure and on the type of security the firm chooses to issue. To complete our analysis, we examine the link between performance, IPO procedure and subsequent financing.

4.1 Performance as a function of the subsequent financing decision.

The initial underpricing is calculated as the difference between the first market clearing price and the IPO offer price, as a percentage of the offer price (calculated on raw returns) for the total sample. Further, we look at post IPO performance for the 90 IPOs for which the data were available over the 1983-1994 period. † † † First, we compare the cumulative abnormal returns over several periods (10 day-period after the IPO, one-month, 3 months, 6 months, one-year) with the secondary market index as the benchmark portfolio. The secondary market index seems more appropriate than a more general index because it accounts for the size effect, as most IPOs are † † † There were quite a few missing data points here, especially for the earlier part of the sample.

small-size stocks. Several studies have shown that the initial return is a significant predicting factor for post IPO performance, if we consider a period from three months to one year. Thus, Affleck-Graves, [START_REF] Affleck-Graves | Conditional price trends in the aftermarket for initial public offerings[END_REF] show that abnormal returns three months after IPO are positively correlated with the initial return. Considering several different classes of IPO's, [START_REF] Krigman | The persistence of IPO mispricing and the predictive power of flipping[END_REF] show that the IPO performance in the year following the IPO issuance is also positively correlated with the initial performance, with the exception of IPO's who have exceptional initial performance (greater than 60%). These latter IPO's are

shown to register the weakest post-IPO one-year performance.

Insert table 3 here

The IPOs that are followed by a subsequent financing are smaller in size (IPO size of 5.52 million euros versus 6.58 million euros, but this difference is not statistically significant).

Neither the percentage of shares offered, nor the level of familial shareholding differs according to subsequent re-entry to the capital market. However, the IPOs followed by a subsequent financing are significantly more undervalued than the others: the difference is of 8.41% (Table 3, Panel A). There seems to be a positive correlation between the initial underpricing and the subsequent re-entry to the capital markets. We find that the abnormal returns are on average positive and significantly different from zero for the first 10-day period and the first-month period (Table 3, Panel B). For the following periods, the abnormal returns are generally not significantly different from zero. We note that they are significantly larger for the firms who return to the market after the IPO, for the one-year period only. For shorter periods, the returns are still larger, but not significantly so.

Insert table 4 here

We categorize four classes of IPO's (corresponding to the quartile of underpricing) to examine the relation between the initial undervaluation and subsequent abnormal returns for different periods ranging from 10 days to one year by the undervaluation quartiles we have defined previously (table 4). When we examine the results according to the different underpricing classes, we note that the post-IPO performance is significantly higher for all the periods, for the firms belonging to category 3, compared to those belonging to categories 1 and 2 ‡ ‡ ‡ . However, there is no significant correlation between initial underpricing and the abnormal returns for longer periods.

Further, we find that the first quartile IPOs performance declines on average in the periods following the offering. Among the firms with no underpricing (initial return equal or less than zero), a majority (34 out of 41) show an initial return exactly equal to zero. This is presumably due to temporary price support from the banks as described by [START_REF] Ruud | Underwriter support and the IPO underpricing puzzle[END_REF] and leads to price decreases after the period of price support. We have only the abnormal returns following the IPO for 14 observations among the 34 IPO with zero initial returns. For these IPOs, the abnormal return is on average of -1.80% (median -1.85%) for the first month period, of -9.06% (-8.26%) for the six-month post IPO period, and of -18.70% (-13.67%) for the first year after the IPO. Thus, we do not find a significant correlation between the initial undervaluation and the abnormal returns but these seem to be higher for the firms with a high initial undervaluation.

These results are compatible with our two maintained hypotheses: in the case of the signaling hypothesis, those firms who come back to the capital markets allow their IPO's to be undervalued in the hopes of creating a favorable impression on investors. In the other case, an initial undervaluation and high abnormal returns would encourage managers to return to the capital markets quite quickly. In both cases, a rationale is provided for subsequent security issuances. But these results depend strongly on the IPO procedure and on the type of subsequent security the firm decides to offer.

4.2. The relation between performance, IPO procedure and the type of subsequent security issued. ‡ ‡ ‡ The number of firms included in the fourth quartile is too low to conclude.

Insert table 5 here

In the case of auction-like procedures (direct quote and reservation price), the initial return is not significantly different whether or not the firm returns to the capital market subsequently (Table 5, Panel A). On the contrary, for the fixed price IPOs, the initial return is 21.84% larger for the firms that re-enter to the market within a four-year period. When we look at the post-IPO abnormal performances, we find that these performances do not differ significantly according to the IPO procedure (Table 5, Panel B). On the other hand, for fixed price IPO's, abnormal performance is, for most of the periods, significantly higher for firms that return to the market, while for the auction like procedures, the performances are not significantly different for the two types of firms. Still, we note that the results depend on the type of subsequent security the firm decides to issue.

Insert table 6 here

We split the sample according to the IPOs' procedure and to whether the underpricing is below or above the median underpricing (table 6). The rate of re-entry to the market does not depend on the underpricing group for the auction-like procedure IPOs. However, the nature of the issued security depends on the underpricing level: the firms belonging to the low underpricing group tend to choose convertible bonds or warrants issue rather than common stock whereas the group of IPOs with large underpricing tends to choose common stock. We futher look at firms that were overpriced: the proportion of firms reentering the market was still 30%.

Our findings show that the firms that introduced with an auction-like procedure go back to the market whatever the initial return, but they decide on the type of security to issue according to this return. This result can hardly be explained in the light of the signaling hypothesis. This hypothesis would imply that the initial shareholders would undervalue their shares as a function of the securities they plan to issue subsequent to the IPO, which is unlikely. The market feedback hypothesis as developed in the Van Bommel (2002) model would imply that the firms, encouraged by the investors, expand their activities. Our findings show that the market feedback does not keep firms from getting new financing, just that it determines the type of security to issue. When the feedback is not very good, the initial shareholders decide to postpone the capital dilution by issuing rather convertibles bonds or units than straight common stock. On the other hand, the fixed price IPO firms return to the market more frequently when the underpricing is large. They issue common shares or other securities in a very similar proportion in both classes of underpricing. And the level of undervaluation is not significantly different between the security categories. The above results militate strongly in favor of the signaling hypothesis for the fixed price procedure.

Cross sectional regression results.

We close out this section by using cross sectional regression analysis. We introduce control variables suggested by previous studies, to verify if our results hold every thing else being equal. In particular, we examine the impact of the period of the IPO, the percent of the capital that is introduced, and the ownership structure. We try to determine to what extent the initial undervaluation is a function of the following variables:

Security: this variable is a binary variable equal to 1 if the firm issues securities within 4 years subsequent to the IPO.

Equity: this variable is a binary variable equal to 1 if the first recourse to the capital markets within 4 years subsequent to the IPO is in the form of share issue.

Potential equity: this variable is again a binary variable equal to 1 if the first recourse to the capital markets within 4 years subsequent to the IPO is in the form of convertible bonds or units with attached warrants.

Proceeds is the IPO size in millions of Euros DQ is a dummy variable equal to one for direct quote procedure.

Percent: proportion of the total shares introduced to the market.

PER: ratio of IPO's offer price with respect to earnings per share in the year preceding the IPO.

Activity: this variable is equal to 1 if the IPO period is characterized by strong stock introduction activity. We characterize a period as being one of strong activity if six months prior to the IPO, the volume of listed IPO stocks belonged to the highest quartile. According to the market feedback hypothesis, companies tend to introduce shares to the market during periods of high share activity. During these periods, information asymmetry would be substantially diminished:

the risk to an investor of being misinformed in acquiring IPO's being lower than during less active periods (see [START_REF] Booth | Ownership Dispersion, costly information and IPO underpricing[END_REF].

Fam: a variable indicating the fraction of capital held by a family type shareholding structure before the IPO (%)

Period: this variable is equal to 1 if the IPO takes place in the first period (1983)(1984)(1985)(1986)(1987)) and zero otherwise. The 1983-87 period is characterized by the increased importance of the secondary, small cap markets. The 1987 crash and subsequent investor pessimism put a temporary brake to the growth of the secondary market and also temporarily slowed down activity.

Our results are given in table 7, for the total sample in panel A, and for subsamples by IPOs' procedures in panel B.

Insert table 7 here

We can see from the table 7, panel A, that, everything else being equal, companies who go back to the capital markets by issuing subsequent shares are on average from 8 to 12% more undervalued depending on the model. Firms using other security issues are not, on average, more undervalued. For those firms who go back to the market whatever security they choose to issue, the initial return is from 5 to 8% larger. When we examine the results by IPOs' methods, the results are different (Table 7, Panel B). The variable security has a significant positive effect only for the fixed price IPOs. For this IPO method, firms who return by way of share issue are more underpriced by 24%. For the auction-like procedures, the initial return does not depend on the fact that the firm re-enters the market. The undervaluation increases when the firms issue equity, but this result is significant at the 10% level only.

These findings tend to validate the signaling hypothesis for the fixed price IPOs. We observe that there is a link between underpricing and subsequent security offerings only for this procedure. This link disappears for the auction-like procedures. But for the firms introduced by auction-like methods that return to the market, the initial return is significantly higher for the equity issuers than for the convertible bonds or warrants issuers. The signaling hypothesis would imply that the initial shareholders would undervalue their shares as a function of the securities they plan to issue subsequent to the IPO, which is unlikely. Our findings rather tend to comfort a different market feedback for the auction-like procedures. When the initial feedback is not very good, the managers decide to postpone the capital dilution by convertibles bonds or equity with attached warrants rather than straight common stock.

The undervaluation decreases with the percentage of the capital introduced on the stock market. This result is consistent with the signaling models (Chemmanur, 1993 or Grinblatt and[START_REF] Grinblatt | Signalling and the Pricing of New Issues[END_REF]: the initial shareholders have to choose between selling shares in the IPO or later.

Underpricing concerns them all the more insofar as they sell a large number of shares in the IPO.

The signaling mechanism implies that they sell few shares in the IPO at a low price, and the rest of the shares later at a higher price. However, when we examine the results for the subsamples by procedures (Table 7, Panel B), the variable percent is not any more significant. § § § We have seen that the signaling mechanism can only be valid for the fixed price IPOs. The result concerning the percent of the capital can not be interpreted in favor of the signaling model. But as most French IPOs over the period 1983-1994 choose a percentage very close to the minimum required of 10%, this finding can hardly be judged as being a rejection of the signaling hypothesis, either. The undervaluation increases in the case of companies who have high PER's.

These companies are growth firms, for whom one would think that the information asymmetry issue would be more relevant. More asymmetric information would lead to more undervaluation.

The initial return is significantly larger (about 14%) during the first period of activity in the secondary market in France (1983)(1984)(1985)(1986)(1987). After the 1987's crisis, the second market had real difficulties in attracting firms and investors. The undervaluation decreases during "high activity" periods, all else being equal. We therefore confirm that during these periods, the risk to an § § § This result is also confirmed for the auction-like procedure, but not reported in the Table.

investor of being misinformed in acquiring IPO's would be lower than during more active periods. We confirm the [START_REF] Booth | Ownership Dispersion, costly information and IPO underpricing[END_REF] intuition. ****

The undervaluation is also more important for family firms (for whom information asymmetry is more important than less closely held firms). We can observe that the undervaluation is a significantly increasing function of the percentage of the capital held by familial shareholding before the IPO. These companies are frequently smaller than average. † † † †

We conjecture that information asymmetry is probably larger in such a case, and thus potential investors would require a larger initial undervaluation to be willing to subscribe to these issues.

On the other hand, these firms could also be interested in having a more diffuse ownership structure after the IPO, and thus undervalue on purpose in order to increase the demand/supply ratio, in the interest of limiting large blocks of competing shareholders. Thus the amount allocated to each individual shareholder would be smaller (which is often the case when the issuing procedure is either that of the reservation price or fixed price). According to the signaling models [START_REF] Allen | Signaling by Underpricing in the IPO Market[END_REF], firms would tend to use the underpricing as a quality signal, whatever their shareholder structure. On the other hand, the market feedback hypothesis implies that the more difficult it is to value a firm, the greater the degree of initial undervaluation.

Companies dominated by one family holding or by a manager are generally less easy to value than those who have already opened up their capital to a bank or a venture capitalist. ‡ ‡ ‡ ‡ 4.4. Logit study of the probability of kind of subsequent security offering.

The following logit model is estimated: (1992)(1993)(1994)(1995)(1996)(1997)(1998) Derrien and Womack (2002) show that the market's price momentum in the three months prior to an offering is a significant ex ante predictor of the level of underpricing of French IPOs. Here our results are different. This difference may be due to the period studied or to the variable used to measure hot markets (IPO volume in our study and market momentum in the Derrien and Womack study).. † † † † The average sales of family firms are on the order of euros 57 millions, as opposed to euros 119 millions for non-family firms. ‡ ‡ ‡ ‡ On the relationship between shareholder structure and IPO's, see [START_REF] Mello | Going public and the ownership structure of the firm[END_REF], [START_REF] Stoughton | IPO mechanisms, monitoring and ownership structure[END_REF][START_REF] Stoughton | IPO mechanisms, monitoring and ownership structure[END_REF]Maug (1996).

P(Y)i = )) ' ( exp( 1 1 β α i X + - + **** During more recent periods
The dependent variable is a dummy variable equal to 1 alternatively if a firm issues equity, convertible bonds or warrants within four years of its IPO (variable issue) or if a firm issue common stock only (variable equity). The independent variables are the following:

the initial return -abnormal post-IPO returns for various periods -the logarithm of IPO size -the rate of withdrawal of familial shareholders during the IPO (equal to the difference between familial shareholding before the IPO and after the IPO)

the period, a dummy variable which equals one if the IPO takes place during the 1983-1987 period.

The results are given in table 8, panel A for the total sample, and panel B for the IPOs for which the post-IPO abnormal performances are available.

Insert table 8 here

When we look at the total sample (panel A), we find that the probability that a firm issues equity subsequent to the IPO decreases with its size. The probability of a subsequent issue decreases with the rate of withdrawal of the familial shareholders during the IPO. It seems that when the current familial shareholders sell their shares during the IPO, they don't want to dilute their holdings any more, and they prefer not to go back to the market.

Let's go back again to our two underlying hypotheses. The results here which tend to favor the market signaling hypothesis are the following:

-The probability of coming back to the market increases with the degree of initial undervaluation. In effect, the cost of the initial signal is recouped through subsequent financing, the existence of the signal implying a subsequent financing.

-The probability of returning to the market is a decreasing function of rate of withdrawal of family shareholders.

-The signal by undervaluation is above all useful in the presence of a strong information asymmetry. If one considers this especially true for smaller size IPO's, our finding of an inverse relation between size and probability of subsequent issue militates in favor of the signaling hypothesis.

Finally, according to the market feedback hypothesis, the positive relation between post IPO returns and subsequent financing (whatever the type) should be true for the auction-like procedure whatever the type of subsequent financing, while we show this to be so for common stock only.

Further, the results in Table 8, panel B, indicate that the post IPO abnormal performances do not help to explain the decision to go back to the market. Whatever the post IPO performances considered, § § § § the initial underpricing better explains the decision to issue security during a four-year period following the IPO. These findings are in contradiction with the Jegadeesh, Weinstein and [START_REF] Jegadeesh | An empirical investigation of IPO returns and subsequent equity offerings[END_REF] results. These authors find a stronger relation between the abnormal return in the 20-day period after the IPOs (or the following 20-day return) and the likelihood of future seasoned offerings than between initial IPO returns and the likelihood of future seasoned offerings. Due to the small number of observations, we could not split our sample according to the IPOs' procedure to check if our results hold for the different IPO mechanisms. Thus "market feedback" managers seem to use positive post IPO results to use stage financing, which they would hope assures investor goodwill.

V. Conclusions

In this article we have examined the relationship between the initial underpricing and the subsequent recourse to the capital markets and IPO issue procedure. There are two possible explanations for this undervaluation: signaling and market feedback. In our paper, we used a relatively new database, which includes not only subsequent share issues but also issues of other securities, like convertibles bonds or units of bonds or stocks with warrants. We find that the firms which are more undervalued tend to subsequently issue shares; those firms which are not § § § § We report the results with a one-month performance, but the results are similar with the other periods.

as undervalued tend to subsequently issue other kinds of hybrid security. We show that the both hypotheses cannot be equally valid for all the French IPOs mechanisms. Our results tend to validate the market-signaling hypothesis for the fixed-price IPOs. We find that the initial return for this method is larger for the firms who go back to the market, whatever security issued. The signaling hypothesis is invalidated for the auction-like IPOs. We tend to think in this case that it is quite unlikely that managers anticipate their future financing needs and style and that they modulate their current undervaluation, as a function of these futures needs. Rather, our results

show that the investors' demand determines the type of subsequent offering. The rate of subsequent re-entry to the market does not differ according to the initial return. But when prices evolve favorably, i.e., when investors send out a positive signal on the firm, managers would have an incentive to issue further shares in case of future financing needs. When, on the other hand, shares don't evolve as favorably, managers would have an incentive to issue other types of securities, which would dilute less the current value of the firm. Our results show that the initial returns, and not the post-IPO performances, determine the type of subsequent security offering.

These findings can be interpreted in the following manner: when the managers know better than the market the value of their firm, they choose the fixed price procedure. The good firms can signal their quality with the initial underpricing. When there is a large degree of asymmetric information (and that is especially the case for familial firms), managers will choose an auctionlike procedure and observe the market reaction. The initial investors' demand then determines the subsequent choice between straight common stock and other security but not the decision to finance initially. Cross-sectional ordinary least square regressions where the dependent variable is the IPO initial return. Estimated regression coefficients are presented with t-statistics in parentheses. Security is a dummy variable which is equal to 1 if the firm issues securities within a four years period. Equity is a binary variable equal to 1 if the first recourse to the capital markets within 4 years subsequent to the IPO is in the form of a seasoned equity issue. Potential equity is a dummy variable equal to 1 if the first securities offering consists of convertibles bonds or includes warrants. Proceeds is the IPO size in millions of Euros.. DQ is a dummy variable equal to one for direct quote procedure. Percent is the percentage of the share offered through IPO. Activity is a dummy variable, which is equal to 1 if the IPO period is characterized by strong stock introduction activity. We characterize a period as being one of strong activity if six months prior to the IPO, the volume of listed IPO stocks belonged to the highest quartile. FAM is a variable indicating the fraction of capital held by a family type shareholding structure before the IPO (%). Period is a dummy variable that is equal to 1 if the IPO takes place in the first period (1983)(1984)(1985)(1986)(1987) and zero otherwise.

  Table 1 presents the different kinds of securities issued subsequent to an IPO. *** Insert table 1 hereThe number of operations and the capitalization vary considerably by year. One can see that great IPO activity and a large proportion of the firms returning to the market within the next four years characterize the 1985-1989 period. Table2sums up the characteristics of the companies that were introduced into the stock market, as well as those who came back to the market within a period of 4 years subsequent to the IPO.

Table 1 : IPO's and the subsequent security offerings in France during the 1983-1998 period.

 1

	Year of IPO	Number of	IPO's offering	Number of	Number of firms	Number of firms for	Number of firms for
		IPO's	proceeds in	primary issues of	for which the first	which the first issue is	which the first issue is a
			millions of euros	securities 4 years	issue is a seasoned	a unit of share and	convertible bond
				subsequent to IPO	equity offering	warrants issue	offering (1)
	1983	13	34.62	8	7	0	1
	1984	22	69.63	4	4	0	0
	1985	41	197.42	17	11	1	5
	1986	40	226.29	18	14	1	3
	1987	71	541.55	20	11	5	4
	1988	27	163.32	12	3	5	4
	1989	22	177.76	5	4	0	1
	1990	13	98.04	2	0	0	2
	1991	8	35.13	2	1	0	1
	1992	4	14.68	0	0	0	0
	1993	6	47.59	3	3	0	0
	1994	21	157.35	4	1	1	2
	Total	288	1763.39	95	59	13	23
	(1) This category includes bonds with attached warrants

Table 2 : Descriptive statistics on 288 IPOs in the 1983-1994 period and 95 first security offerings in the 1983-1998 period.

 2 To be included in the sample, a security offering had to have occurred within four years of the IPO and be the first of this firm. Data are means, medians are given in brackets.

	Characteristics	Total sample	Firms who issued first	Firms who issued first	Firms who issued first	Firms who did not issue
			shares after IPO	units of share and	convertible bonds after	within a four year period
				warrants after IPO	IPO	after the IPO
	Number of IPOs	288	59	13	23	193
	Initial return ( %)	18.67	31.36	7.50	15.74	15.90
		(8.72)	(18.52)	(3.91)	(5.04)	(8.0)
	The ratio of demand to supply during the IPO	56	72	42	41	54
		(41)	(59)	(23)	(18)	(40)
	IPO size (in million of euros)	6.23	3.62	6.76	9.66	6.58
		(3.39)	(2.58)	(3.93)	(4.46)	(3.45)
	Proportion of initial capital issued ( %)	11.56	11.82	11.77	12.71	11.33
		(10.0)	(10)	(10)	(10.24)	(10.0)
	Proportion of capital held by the familial	51.37	52.52	52.72	41.31	52.15
	shareholders before IPO (%)	(60.05)	(67.52)	(60.17)	(40.0)	(60.02)
	Proportion of capital held by banks (%)	8.23	9.48	12.79	19.27	6.30
		(0)	(0)	(6.28)	(10.56)	(0)
	Proportion of capital held by institutional investors or	16.30	16.67	18.22	11.94	16.53
	venture capitalists (%)	(3.0)	(8.32)	(3.0)	(6.65)	(1.24)
	Withdrawal of familial shareholders (en %)	4.74	3.42	4.54	4.69	5.17
		(3.10)	(0.09)	(4.43)	(2.04)	(3.72)
	Withdrawal of banks and venture capitalists (%)	1.96	2.64	2.02	3.70	1.57
		(0)	(0)	(0)	(1.54)	(0)
	Withdrawal of institutional investors (%)	2.04	1.87	2.12	4.48	2.15
		(0)	(0)	(0)	(0)	(0)
	PER on IPO date	12.49	13.06	12.34	12.25	12.36
		11.39	(12.15)	(12.14)	(11.83)	(11.33)
	IPOs' procedures (%)
	Direct quote	32.3	32.2	38.5	30.4	32.1
	Fixed price	34.4	28.8	23.1	30.4	37.3
	Reservation price	33.3	38.9	38.5	39.1	30.6
	Seasoned security offerings proceeds, in millions		13.90	22.68	28.46
	euros		(7.62)	(18.30)	(15.7)
	Seasoned security proceeds/IPO proceeds		4.91	4.79	4.24
			(3.17)	(5.22)	(4.27)
	Lag between the IPO and subsequent security		633	699	779
	offering, number of calendar days.		(579)	(746)	(715)

Table 3 : Initial return and cumulative abnormal returns according to the re-entry into the capital market (%)

 3 Panel A: Initial return for total sample (288 IPOs on the French "second marché" from 1983 to 1994) . When the assumption of equal variance between the two groups is rejected, test statistics are calculated under the assumption of an unequal variance.

	Characteristics of the	IPO followed by a	IPO not followed by an	Mean differences
	firms, means	subsequent security	offering within four	(t-Test of the
		offering within four	years	difference a )
		years
	Initial return (%)	24.31	15.90	8.41
				(t = 2.525)**
	IPO size (in million of	5.52	6.58	-1.05
	Euros)			(t = -0.942)
	Percentage of shares	12.03	11.33	0.70
	offered			(t = 0.897)
	Percentage of shares	49.83	52.15	-2.31
	held by familial			(t = 0.458)
	shareholding

a*Significant at the 10% level **Significant at the 5% level ***Significant at the 1% level

Table 3 : Initial return and cumulative abnormal returns according to the re-entry into the capital market (%)

 3 Panel B:.Cumulative abnormal returns for the subsample of 90 IPOs for which the abnormal returns for periods following the IPO are available. For these 25 firms, only 4 go back to the capital markets within a period of less than one year after the IPO (mean subsequent IPO period of 248 days, median 247). For these 4 firms, the abnormal return between the IPO and the first subsequent security emission is 26.61% (median 23.23%), while the 6 month abnormal return is 17.36% (median 21.42%), and over one year 25.21% (median 23.23%)

		Total sample	Firms who did not issue within a	Firms who issued securities within a
				four year period after the IPO	four year period after the IPO a
	Number of IPOs	90		65		25
		mean	median	mean	median	mean	median
	Initial return	10.70***	6.18	8.39***	4.74	16.72***	9.09
	First 10-day abnormal return	4.58***	2.56	4.41**	1.87	5.03	3.53
	One month abnormal return	3.06**	0.76	2.46*	0.74	4.60	4.04
	Three month abnormal return	1.27	0.71	-0.20	0.12	5.11	3.15
	Six month abnormal return	3.53	5.44	1.31	0.85	9.32	15.21
	One year abnormal return	-0.74	4.33	-6.08	2.34	13.14*	17.01
	a. *Significantly different from 0 at the 10% level	** Significantly different from 0 at the 5% level *** Significantly different from 0 at the 1% level

Table 5 : Initial return and cumulative abnormal returns according to IPO procedures (%)

 5 Panel A: Initial return for the total sample (288 IPOs on the French "second marché" from 1983 to 1994) . When the assumption of equal variance between the two groups is rejected, test statistics are calculated under the assumption of an unequal variance. *Significant at the 10% level **Significant at the 5% level ***Significant at the 1% level

	%	Auction like procedure	Fixed price
		(Direct quote + Reservation price)
	Number of observations	189	99
	Mean initial return (median)	18.19	19.59
		(8.41)	(10.0)
	Mean initial return for IPO	19.88	35.47
	followed by a subsequent	(10.03)	(19.13)
	security offering within four
	years (median)
	Mean initial return (%) for	17.25	13.63
	IPO not followed by an	(8.16)	(7.02)
	offering within four years
	(median)
	Mean differences (%) (t-Test	2.63	21.84
	of the difference a )	(t=0.470)	(t=3.194)***

a

Table 5 : Initial return and cumulative abnormal returns according to IPO procedures (%)

 5 Panel B: Cumulative abnormal returns for the subsample of 90 IPOs for which the abnormal returns for periods following the IPO are available.

		Auction like procedure		Fixed price
		(Direct quote + Reservation
			price)
	Number of observations		56			34
	mean %	IPO	IPO not	Mean	IPO	IPO not	Mean
		followed	followed	difference	followed	followed	difference
		by an	by an	s	by an	by an	s
		offering	offering		offering	offering
	Underpricing	16.27	10.07	6.20	18.50	6.30	12.19**
	First 10-day abnormal return	3.38	5.83	-2.45	11.64	2.64	9.00*
	One month abnormal return	2.28	3.23	-0.95	13.90	1.52	12.38**
	Three month abnormal return	3.13	-0.16	3.29	13.00	-0.24	13.24*
	Six month abnormal return	7.41	1.10	6.31	16.95	1.57	15.38
	One year abnormal return	10.68	-10.34	21.02	24.35	-0.36	24.71**

*Significant at the 10% level **Significant at the 5% level ***Significant at the 1% level

Table 6 : Underpricing according to the procedure and the subsequent financing (%)

 6 IPOs classified by procedure, for the total sample (288 IPOs on the French "second marché" from 1983 to 1994) . When the assumption of equal variance between the two groups is rejected, test statistics are calculated under the assumption of an unequal variance. *Significant at the 10% level **Significant at the 5% level ***Significant at the 1% level

	Auction like procedure	Fixed price
	(Direct quote + Reservation price)

a

Table 7 : Regression results: IPO underpricing and impact of security offerings for 288 IPOs in the 1983-1994 period

 7

† See[START_REF] Ibbotson | Initial Public Offerings[END_REF] for an international comparison of the degree of initial underpricing.

The following logit model is estimated:

The dependent variable is either the variable Security or Equity. Security is a dummy variable which is equal to 1 if the firm issues securities within a four years period. Equity is a binary variable equal to 1 if the first recourse to the capital markets within 4 years subsequent to the IPO is in the form of a seasoned equity issue. The independent variables are the initial return, abnormal returns for post-IPO periods, the logarithm of IPO size, the rate of withdrawal of familial shareholders during the IPO (equal to the difference between familial shareholding before the IPO and after the IPO), and the period, a dummy variable which is equal to 1 if the IPO takes place in the 1983-1987 period. The beta coefficients are given and the Wald statistics are reported in parentheses.

Panel A: Total sample and initial return only (288 IPOs)