1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.80
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-APNJ [Trj] | 20200430 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Agent.dc | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200430 | 2013.8.14.323 |
| McAfee | GenericRXFC-NS!5F8707E5D147 | 20200430 | 6.0.6.653 |
| Tencent | Worm.Win32.Juched.pgy | 20200430 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | ihsxhgs |
| section | qxmqrdq |
动态指标
在 PE 资源中识别到外语
(4 个事件)
| name | RT_ICON | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003f440 | size | 0x000008a8 | ||||||||||||||||||
| name | RT_ICON | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003f440 | size | 0x000008a8 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003fce8 | size | 0x00000022 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003e250 | size | 0x00000348 | ||||||||||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 64 个反病毒引擎识别为恶意
(50 out of 64 个事件)
| ALYac | Gen:Variant.Ulise.40958 |
| APEX | Malicious |
| AVG | Win32:Agent-APNJ [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.40958 |
| AhnLab-V3 | Win-Trojan/Juched.277456 |
| Antiy-AVL | Worm/Win32.Juched |
| Arcabit | Trojan.Ulise.D9FFE |
| Avast | Win32:Agent-APNJ [Trj] |
| Avira | TR/Graftor.1103.80 |
| Baidu | Win32.Trojan.Agent.dc |
| BitDefender | Gen:Variant.Ulise.40958 |
| BitDefenderTheta | Gen:NN.ZexaF.34108.qG2@a0xUENfG |
| Bkav | W32.FakeFolderAVB.Trojan |
| CMC | Worm.Win32.Juched!O |
| ClamAV | Win.Trojan.BankerSpy-1 |
| Comodo | Worm.Win32.Juched.PGY@4yojo0 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.5d1473 |
| Cylance | Unsafe |
| Cyren | W32/Agent.KI.gen!Eldorado |
| DrWeb | Trojan.Siggen3.51589 |
| ESET-NOD32 | a variant of Win32/Agent.UDI |
| Emsisoft | Gen:Variant.Ulise.40958 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Agent.KI.gen!Eldorado |
| F-Secure | Trojan.TR/Graftor.1103.80 |
| FireEye | Generic.mg.5f8707e5d147376d |
| Fortinet | W32/Virtu.F |
| GData | Gen:Variant.Ulise.40958 |
| Ikarus | Worm.Win32.Juched |
| Invincea | heuristic |
| Jiangmin | Worm/Generic.rwy |
| K7AntiVirus | EmailWorm ( 005191521 ) |
| K7GW | EmailWorm ( 005191521 ) |
| Kaspersky | HEUR:Worm.Win32.Generic |
| MAX | malware (ai score=88) |
| Malwarebytes | Worm.Agent.FLD |
| MaxSecure | Worm.Win32.Juched.FIH |
| McAfee | GenericRXFC-NS!5F8707E5D147 |
| McAfee-GW-Edition | BehavesLike.Win32.Backdoor.dz |
| MicroWorld-eScan | Gen:Variant.Ulise.40958 |
| Microsoft | Worm:Win32/Ganelp.G |
| NANO-Antivirus | Trojan.Win32.Graftor.fbwnuy |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM18.1.E760.Malware.Gen |
| Rising | Trojan.Agent!1.C135 (RDMK:cmRtazpluWL27/FqAqAyaMBAOGUI) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Ganel |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2006-11-05 06:33:26
PE Imphash
bbbaf1c2eb723302fbbb7808c45c4bc3
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00025f10 | 0x00026000 | 3.9188503113197823 |
| .rdata | 0x00027000 | 0x00001c27 | 0x00002000 | 4.651271942696683 |
| .data | 0x00029000 | 0x00013224 | 0x00002000 | 0.8690168301832242 |
| .idata | 0x0003d000 | 0x00000a49 | 0x00001000 | 3.013846830384983 |
| .rsrc | 0x0003e000 | 0x00002369 | 0x00003000 | 3.0779381199333686 |
| .reloc | 0x00041000 | 0x00009000 | 0x00009000 | 1.2111679704300005 |
| ihsxhgs | 0x0004a000 | 0x00008000 | 0x00008000 | 0.04922258376458033 |
| qxmqrdq | 0x00052000 | 0x00001000 | 0x00000000 | 0.0 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0003f440 | 0x000008a8 | LANG_TURKISH | SUBLANG_DEFAULT | None |
| RT_ICON | 0x0003f440 | 0x000008a8 | LANG_TURKISH | SUBLANG_DEFAULT | None |
| RT_GROUP_ICON | 0x0003fce8 | 0x00000022 | LANG_TURKISH | SUBLANG_DEFAULT | None |
| RT_VERSION | 0x0003e250 | 0x00000348 | LANG_TURKISH | SUBLANG_DEFAULT | None |
Imports
Library KERNEL32.dll:
• 0x43d278 GetLastError
• 0x43d27c GetSystemTime
• 0x43d280 MultiByteToWideChar
• 0x43d284 GetLocaleInfoA
• 0x43d288 GetModuleHandleA
• 0x43d28c FindNextFileA
• 0x43d290 FindFirstFileA
• 0x43d294 FlushFileBuffers
• 0x43d298 SetEnvironmentVariableA
• 0x43d29c FindClose
• 0x43d2a0 Sleep
• 0x43d2a4 CompareStringW
• 0x43d2a8 CompareStringA
• 0x43d2ac SetStdHandle
• 0x43d2b0 SetFilePointer
• 0x43d2b4 GetTimeZoneInformation
• 0x43d2b8 GetLocalTime
• 0x43d2bc ExitProcess
• 0x43d2c0 TerminateProcess
• 0x43d2c4 GetCurrentProcess
• 0x43d2c8 GetStartupInfoA
• 0x43d2cc GetCommandLineA
• 0x43d2d0 GetVersion
• 0x43d2d4 DebugBreak
• 0x43d2d8 GetStdHandle
• 0x43d2dc WriteFile
• 0x43d2e0 InterlockedDecrement
• 0x43d2e4 OutputDebugStringA
• 0x43d2e8 GetProcAddress
• 0x43d2ec LoadLibraryA
• 0x43d2f0 InterlockedIncrement
• 0x43d2f4 GetModuleFileNameA
• 0x43d2f8 IsBadWritePtr
• 0x43d2fc IsBadReadPtr
• 0x43d300 HeapValidate
• 0x43d304 UnhandledExceptionFilter
• 0x43d308 FreeEnvironmentStringsA
• 0x43d30c FreeEnvironmentStringsW
• 0x43d310 WideCharToMultiByte
• 0x43d314 GetEnvironmentStrings
• 0x43d318 GetEnvironmentStringsW
• 0x43d31c SetHandleCount
• 0x43d320 GetFileType
• 0x43d324 HeapDestroy
• 0x43d328 HeapCreate
• 0x43d32c HeapFree
• 0x43d330 VirtualFree
• 0x43d334 RtlUnwind
• 0x43d338 SetConsoleCtrlHandler
• 0x43d33c HeapAlloc
• 0x43d340 HeapReAlloc
• 0x43d344 VirtualAlloc
• 0x43d348 GetCPInfo
• 0x43d34c GetACP
• 0x43d350 GetOEMCP
• 0x43d354 GetStringTypeA
• 0x43d358 GetStringTypeW
• 0x43d35c LCMapStringA
• 0x43d360 LCMapStringW
• 0x43d364 CloseHandle
Library USER32.dll:
• 0x43d3c4 MessageBoxA
Library ADVAPI32.dll:
• 0x43d248 GetUserNameW
L!This program cannot be run in DOS mode.
`.rdata
@.data
.idata
@.reloc
ihsxhgs
qxmqrdq
UDSVW}
E_^[]UPSVW}
y_^[P;&Z
]UTSVW}
MU;U}cE
E}^}3M
]U@SVW}
_^[@;U
]UDSVW}
_^[]UPSVW}
_^[]UDSVW}
_^[]UlSVW}
u,U;Uu
t\U;Uu
E_^[l;M
]UDSVW}
_^[]UpSVW}
EMMU3f
Q<UE8PE
MQxUEH|MU
M;M}-U
_^[p;K
]U`SVW}
EMMU3f
Q<UE8PE
3_MQxUEH|MU
ME_^[]UD
]U@SVW}
_^[@;?
jPMQj#
MMURH:
UEEMQ,:
jPMQj#
MMURH6
UEEMQ,6
]U|SVW}
_^[|;N3
]UHSVW}
_^[H;)
]UHSVW}
E_^[H;e(
]UHSVW}
MuR`|C
9Us)E3
_^[H;&
3EEEfE
jdTQhDB
MQh`pB
URh@pB
EPR ;$
MQPp;U$
fUfUfEfEfMfMfE
-oje`[VQLG_^[
wuWhuB
E}tEMQ
&~~j<j
j<Qj^I
tAt2t$
PRSVWh
_^[ZX]
DDDDDDDDDDDDDD
GIt%t)
Gt/KuD$
GKu[^D$
8t3^[_S
^[_U= C
]UQ= C
]UjhxB
P*EEPQM
EMQUR(
eEPJMd
_^[]U=0C
@v)URS
RPQRPQRPQREPM
t } u%=$B
B8t6t8t't
B^_[Uj
t&hD{B
E _^[]Uj
3u&h`}B
t&hD{B
;t!h|B
M;Mt!hT|B
;Et!h8|B
E_^[]Uj
]UQSVWB
uCE PMQ
uCE PMQ
;Mt!h}B
;Mt!h}B
_^[]Uj
EE_^[]UQ
E]UQSVWE
_^[]UQ<B
E]UQSVWE
E_^[]U
u:U REH
QURhx~B
u:E PMQ
REPhL~B
u/M Qhp
RE PMQh$
E_^[]p@
%URh`B
H0_^[]U
A,+B,M
J0+H0U
E_^[]U
PM QhHB
PM Qh B
PM QhB
u_^[]U\SVWE
UB E=PB
EPMQhB
u_^[]U4SVWEP
3_^[]UQSVW}
3u_^[]U
UjmhLB
=tGjyhLB
EMMUREPj
UREPMU
PMQUR#
EPMQUREPj
3%MQUREPo
MU;U}eE8tXM
E}tXMQ
E}@}2M<C
]USVWUj
t.;t$$t(4v
VC20XC00U
]_^[]UL$
_^[]UQE
]U0SVWEE
E_^[]U,SVWEE
E_^[]Q=
]UQ=$B
M$k<U(
M$k<U(
EE]U]U@B
UE;Es%MU
MU;Us$EM#
MU;UuIC
U#TDU}
E}?} MU
UE;Ew]MA
UUE+EE
M;t U;u
tn} }2
,3]U0SVWEE
E_^[]U
MQUREPj
s{Uk0ExB
Mk0UEfAlB
Ar;Zw2aC
Qar;zw2aC
G]U=LC
ddIdd.wld3
``C``5
fEfMQRA
U tHE@t
RPRPu0RPQR9~
ERM+MM
fZfZPxQ
QtRxP)
_^[]P@
=u(MQU
U3]UWVu
DDDDDDDDDDDDDD
^_UjhB
SVWe=hC
3CMQURE
PMQURE
_^[]UjhB
SVWe=lC
REPMQU
EPMQUREPM
EPMQh
QUREPh
QU+RQU
E+]UQSVW}
_^[]UE
@]UQ=C
hj=h$B
UREPjM
Mf3]UQE
M}-s#UE
|jyh0B
~VUREH
;Eu!MQ
SVWe=tC
$&eeMME
3FUREPM
3"MQUREPMQU
E_^[]UQE
EE]UQ=LC
3]UQVE
3^]USVW}
_^[]%C
%Uopqr34&^',-.CDcd<=OP !#$QRS>EF/6?@ABZ[]`_XYlmn89:;wxyz{|}~I2NVabGHefjk7()*+015WghiTJKL\Mstuv
n2ltcr#MlnAabyrireltuAeDcyedFNAtimVaAplGiwro#Vmfanr3leodstuaeoirFLaSitbsreerGoeeeevntieoi#WoitAtunmoeldGrdsedHlLLa#er#FAieCtro#MllmGnonrlCFAtdDcyelIri#ke.#PAeGoed#drAebytert#aitAtuia#Ereab#yeenserGoeotA
dslFNFAnoRvro#ei#DeeeglvrsrelpnhGunosPe2srsN#sn#ai#tleiGiiGalGaenri#dteil#oitAlFAtvpGoaitgCtolSs#Cers#c3rPe2toaeeFAiiRF#FS#bl#briiFAnxlFCemDcyeeeeiy#LcrSn#aoe2pttrPedosi#c3xlHlreerF#deteeoAcoF#FFteiei#dseeerDtlGrTAtiDeiAeTh3aoertcIrsFtoseCedCtlWeealelzllolle
i.#etnnnocFelIrCedntlteeIrCe#Gi#etsn#ielnnp#etnApFAteoaewndIrOAtentttennlHl
i.#etnnnocFulIrCedntlteeIrCe#Pi#etsn#ielnnp#etnApFAteoaewndIrOAtentttennlHl
leeexthEuSlcA
l.e2lh3lsld
*t*B0_`2lwwP%Y29%Yw9u*PY`*PwmAVPX`*@dwPaiVVPXX`edwdvPYPwX`1AwPrduue9uAV4`*Yd%adwaew9 AuP`ilY@9wA&Pai::uAVdYA9%X`]AXY
bd:ael*nE::
CegsyeoeRlK
SaEgVeetuARelx
OKxgnEeeyRpeA
a2lv3ldidap.
DtlgeaAelVeReeu
CtygaeAeeKxRreE
\Java\jre-
gFsomeralPri
info_a
*9 YrdwP`FFFFFFFFFFFFFFFFF`2lwwP%YcPwXA9%`)l%
e.gteeixrde
rrr5u9?5OPu:cPwI@u:{XYdYX5OPu:cPwI@u:{<dV#l:X5OPu:cPwI@u:{
Y:IduA&dvPYduIV9vIYw{duA&dvPYduIV9vIYw{@aWFF{ Y:IX9uAXAuPYAXAvIV9v{<PdYwAVPuPd{JP:&P:Iy/yW{ Y:I4PXAvV9:4IV9v{4PXAvV9:4F{UC/V4 {
/Downs/HelpVer.hlp
Help.hlp
/Downs/Help.hlp
/Private/
Pfile.hlp
Y:IlPl9IV9v{?99??uPIlPl9IV9v{$yFU/Ck?wA:Y9IuPda@9XYPwIV9v{y/EU/${Wd/FCyV$k Y:I@9XY wPPXAYPIV9v{@ XMFExU//$C{$yFU/Cd<Vk
jusched.
ew9?wdv1AuPX
Fi386\chkesp.c
The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention.
Assertion Failed
Warning
%s(%d) : %s
Assertion failed!
Assertion failed:
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
wsprintfA
user32.dll
Microsoft Visual C++ Debug Library
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
(Press Retry to debug the application)
Module:
File:
Line:
Expression:
For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.
<program name unknown>
dbgrpt.c
szUserMessage != NULL
Client
Ignore
Normal
Error: memory allocation: bad memory block type.
Invalid allocation size: %u bytes.
Client hook allocation failure.
Client hook allocation failure at file %hs line %d.
dbgheap.c
_CrtCheckMemory()
_pFirstBlock == pOldBlock
_pLastBlock == pOldBlock
fRealloc || (!fRealloc && pNewBlock == pOldBlock)
_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse)
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
_CrtIsValidHeapPointer(pUserData)
Allocation too large or negative: %u bytes.
Client hook re-allocation failure.
Client hook re-allocation failure at file %hs line %d.
_pFirstBlock == pHead
_pLastBlock == pHead
pHead->nBlockUse == nBlockUse
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
DAMAGE: after %hs block (#%d) at 0x%08X.
DAMAGE: before %hs block (#%d) at 0x%08X.
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)
Client hook free failure.
memory check error at 0x%08X = 0x%02X, should be 0x%02X.
%hs located at 0x%08X is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0x%08X.
DAMAGED
_heapchk fails with unknown return value!
_heapchk fails with _HEAPBADPTR.
_heapchk fails with _HEAPBADEND.
_heapchk fails with _HEAPBADNODE.
_heapchk fails with _HEAPBADBEGIN.
Bad memory block found at 0x%08X.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemDifference: NULL state pointer.
Object dump complete.
crt block at 0x%08X, subtype %x, %u bytes long.
normal block at 0x%08X, %u bytes long.
client block at 0x%08X, subtype %x, %u bytes long.
{%ld}
%hs(%d) :
#File Error#(%d) :
Dumping objects ->
Data: <%s> %s
Detected memory leaks!
Total allocations: %ld bytes.
Largest number used: %ld bytes.
%ld bytes in %ld %hs Blocks.
stdenvp.c
stdargv.c
a_env.c
ioinit.c
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
format != NULL
sprintf.c
string != NULL
vsprintf.c
GetLastActivePopup
GetActiveWindow
MessageBoxA
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
tzset.c
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)
_flsbuf.c
str != NULL
`h````
ppxxxx
(null)
output.c
ch != _T('\0')
_getbuf.c
_file.c
wtombenv.c
osfinfo.c
a_cmp.c
cchCount1==0 && cchCount2==1 || cchCount1==1 && cchCount2==0
setenv.c
fclose.c
_freebuf.c
stream != NULL
aa3vd2apeJUt
a3d2peUt
htdocs
GetModuleHandleA
GetLastError
GetSystemTime
MultiByteToWideChar
GetLocaleInfoA
FindClose
FindNextFileA
FindFirstFileA
KERNEL32.dll
MessageBoxA
USER32.dll
GetUserNameW
ADVAPI32.dll
CoUninitialize
CoCreateInstance
CoInitialize
ole32.dll
GetTimeZoneInformation
GetLocalTime
ExitProcess
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
IsBadWritePtr
IsBadReadPtr
HeapValidate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
SetConsoleCtrlHandler
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetFilePointer
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
CloseHandle
gKKDDDDD3
gNNNNNNNNNNI3
tQQQQQQQQQQQQXXN8%
vTTTTTTTTTTTTTTXXXYYB+
xXXXXXXXXXXXXXXYYYYYYYYYL1
x]]]]]]]]]]]]]]]]]]]]]]]]]]F>
~d]]]]]]]]]]]]]]]]]]]]]]]]]]0
_kcccccccccccccccccccccccccc0
WkiiiiiiiiiiiiiiiiiiiiiiiiiiD
WpllllllllllllllllllllllllllD
[zooooooooooooooooooooooooooD
C}ssssssssssssssssssssssssssD
6||||||||||||||||||||||||||D;
5GaDS
wsssfV4"
n $:Ga{r^
!-AHhuH
hhICONMD5.6c78a9fahhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhh
-/0000)
hhhhhhhhhhhhhh
;0333333330'
hhhhhhhhhhh
E66666666666666+
hhhhhhhhhh
>666666666666666660
hhhhhhhhhh
F@@@@@@@@@@@@@@@@@0
hhhhhhhhhh
ICCCCCCCCCCCCCCCCC2
hhhhhhhhhh
NGGGGGGGGGGGGGGGGG3
hhhhhhhhh
WLLLLLLLLLLLLLLLLL6
hhhhhhhhh
IQQQQQQQQQQQQQQQQQ60
hhhhhhhhh
7VVVVVVVVVVVVVVVVV=*
hhhhhhhhh
5VVVVVVVVVVVVVVVVV:M
hhhhhhhhh
<ZZZZZZZZZZZZZZZZZ;I
hhhhhhhh
"$^ba_]]]]]]]]]]]]]BI
hhhhhhhh
%.9`d_________WBN
hhhhhhhh
OLL=1#
!ebbbbbbbbbEK%
hhhhhhhh
SQQQQQQQ
$feedddddd>R(
hhhhhhhh
ZVVVVVVVP
&4?ggfJT?
hhhhhhhh
YVVVVVVV[[_]8A#
hhhhhhhh
UXVVVVVb.
hhhhhhhhhh
edaa\aH
hhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh?
808>8H8\8l8~888888
9#9,929I9P9]9d9q9x999999999999::::::
;!;1;;;B;L;V;];j;q;{;;;;;;;;;;;;;
<<<=/>R>v>}>>>>>>>>
L12!3-3Y3h3v3333333&4-494g4n4z4444444*515=5k5r5~555555
7Q7X7d7777777
8'8U8\8h8888888
9 9+9Y9`9l9999999
:#:/:]:d:p::::::: ;';3;a;h;t;;;;)=>===
>e>>>(?>?U?????
161B1h1t11111111222
3'363I3344
565B5h5t55555555666
7 7/7B778888
959o995:S:x::::::::!;-;3;<;M;;;
<?<^<[=y======
>">G>S>Y>b>>>>>>>>
?)?;?Z?
10[00a1:2W2
22222222
3'3:3G3M3U3
474[4b4m44
505E5W5i5z555555
6G6L6U6g7~7777
838888599a:;
< <2<F<U<\<w<<<<<R=|====^>d>|>
0&0K00
11Q22B3t333!4P4h4~5555
6"676I6[6l6q6666666666
737X8888889::;;;;;;<<
===C=O=c===
>">C>m>>>>>>
?&?6?i????
g00000*1=111
3$383~33333I444444
555555
6(6<6X66666,7z77777777)8x8
8888.<4<:<@<F<L<R<X<^<d<j<p<v<|<
>5>[>u>|>>>>>>>>>>>>>Z?e????????
0 0$0(0,000z00000o2y2222222
3Y3b3k3s3|3u5~5555566C6J6P6]6i6r666666666
7F7K7h7m7r7
77777777777
8I88888
919L9\999999999
:::::::::::
<-<Z<u<<<<<<<<
=v=|========>>>>>>
?%?@?P?\?w??????
'0-0J0c00D1t11z22a3v333333
4D4l444
5e5n5s5{5555555555
6#6B677777
8@8E8w8888
9R9^999.:7:E:M:S:\:d:l:r:{:::::::';3;|;;;;;;;
<%<.<C<<<<2=>=C=y====
>J>P>t>>>>
?)?m?y???????
0$0.0:0[0m0000
161B1111152A22222U33333!4&4I4N4q4v4444+575>5i5555 6h6666666
7%74777(8G8N8859A9`9e999b:::::;;;%<
=_===='>Y>^>>
?P?}????
`0|000*1l1w11111111
232J2a2k2|2222222
3#333,4M4S4e4444
5(5:5B5H5L5Q5^5h5555m6Q7D99F:O:^:j:y:::
;:;_;;;;;
<:<\<<<<<9=L=j=|====#>:>
>>>L?S?????????
050N0b0p0w00000000b1|11222222
3)3F3O3X3k3
4B4[4u444477
9A:K:Q:\:h:m:::::::::::>;G;[;j;n;r;v;z;;;2<9<@<Q<b<s<<<<<
=/=L={===========
>?>G>M>[>e>j>p>|>>>>>>>>>>>>>
?/?9?B?G?L?f?l?{???????????????
0!010=0N0V0a0h0w00000000
1 1-1n111
2K2S2_2e2s2222222222
3%3/3N3W3a3k3t3333333333
4$4-4;44444444
5 5-5f5q5555S6b6666666
7 7*71777@7L7R7[7c7n7x7~7777777
8888!9m9t99::
;#;;;;;;;;
<4<K<R<W<]<j<p<v<<<<<<
2 2)292G2S2d2o2x22222222222222
3%383A3333
4?4K4l4488C8K8u8{888888888888
939:9`9h9):
f1r1{1111111111
2 2(242;2@2I2Q2\2f2u2~2222222
33888899;
<"<z<<<
=m=s=|=======
>.>9>?>>>>>>>>
?/?B?e?u?
???????
0 0d0m0w0000011111
2h2w222222>3M3b33333333
4 5)5$6-6s6
77#8L8a888X9_9z::
=?>a>>
333333333333333
4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x486_666Y777
8888899999999
:%:,:0:4:8:<:@:D:H::::::
;0;7;<;@;D;a;;;;;;;;;;;*<0<4<8<<<<<<<<<<<<
= =<=G=Z==
>0>V>[>x>>>>>>>>
?0?W???
G000)11111
202?2u222222
3J3"4,4Y4444444
5(5^5g5555(6A6V6_6k6t6666666666
7=7V7h77777
8*8888
9O99999999?:L:d:::::::I;b;n;;;;;;;;
<1<=<d<p<|<<<<<<<
=n=}====4>>>M>e>>>
0)0<0Z00000
1#1-1:1A1K1U11111,2T2`233
444u5{555555555
6#646:6K6W666+7w777
999i:~:::::::
<q<<<<<r=x=~======================
> >&>,>2>8>>>D>J>P>V>\>b>h>n>t>z>>>>>>>
3 6:::::::::;;;;;;;;;;;;;;
<<<<=D=H=
`0d0p0x02222
f1::g788n9BBo?@@vAJJwGHH~IRR
OPPQZZWXXYbb_``ajjghhirroppqzzwxxy
413:jigh<9;BrqopDACJzywxLIKR
TQSZ\Y[bdacjd589;7:>l=@AC?BFtEHIKGJN|MPQSORVUXY[WZ^]`ac_bfehikgjnmpqsorvuxy{wz~}
413:jigh<9;BrqopDACJzywxLIKR
TQSZ\Y[bdacj413:jigh<9;BrqopDACJzywxLIKR
TQSZ\Y[bdacj413:jigh<9;BrqopDACJzywxLIKR
TQSZ\Y[bdacj4dch=8<h<lkpE@DpDtsxMHLxL|{UPTT]X\\e`dd4dch=8<h<lkpE@DpDtsxMHLxL|{UPTT]X\\e`ddfdhi;gk:nlpqCosBvtxyKw{J~|S
R[Zcbkjsr{z
21;if8g::9Cqn@oBBAKyvHwJJIS~P
RRQ[XZZYc`bba693f9<<:>A;nADDBFICvILLJNQK~QTTRVYSY\\Z^a[addbficil45d69>ji<=l>AFrqDEtFINzyLM|NQVTUVY^\]^afdef6968gf??>A>@onGGFIFHwvOONQNP
~WWVYVX__^a^`ggfifh758646gl?=@><>otGEHFDFw|OMPNLN
WUXVTV_]`^\^gehfdf8d2d:97@@l:lBA?HHtBtJIGPP|J|RQOXXRZYW``Zba_hhbjigpbc7ehki
jk?mpsq
rsGux{y
z{O} W'_/g7o?wG
OW_f7h6eilin?p>mqtqvGxFuy|y~ON}WV_^gfonwv
f494;8?>n<A<C@GFvDIDKHON~LQLSPWVTYT[X_^\a\c`gfdidkhonlqlspwvtyt{x
e96::h9>mA>BBpAFuIFJJxIN}QNRRQVYVZZY^a^bbafifjjinqnrrqvyvzzy~~
c22ej9lik::mrAtqsBBuzI|y{JJ}QRRYZZabbijjqrryzz
f5h6e7<:n=p>m?DBvExFuGLJ~MN}OTRUVW\Z]^_dbefgljmnotruvw|z}~
c858=k<@k@=@EsDHsHEHM{LP{PMPUTXXUX]\``]`edhhehmlppmputxxux}|}
815g9>ik@9=oAFqsHAEwINy{PIM
QVXQUY^`Y]afhaeine248i>h<m:<@qFpDuBDHyNxL}JLPVTRTX^\Z\`fdbdhnljlpvtrtx~|z|
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikndd3:i9gmll;BqAouttCJyIw}||KRQ
SZY[bacjikrqszy{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknf63e=5j8n>;mE=r@vFCuMEzH~NK}UMPVS]UX^[e]`fcmehnkumpvs}ux~{}
727f;h::?:?nCpBBGBGvKxJJOJO~SRRWRW[ZZ_Z_cbbgbgkjcbd6=<=:kjl>EDEBsrtFMLMJ{z|NUTURV]\]Z^edebfmlmjnuturv}|}z~d4g;ef6il<oCmn>qtDwKuvFy|L
S}~NT[V\c^dkflsnt{v|~
41g859i8<9o@=Aq@DAwHEIyHLI
PMQPTQXUYX\Y`]a`dahe5cg8ji8m=ko@rq@uEswHzyH}M{
PPUXX]``ehhmppuxx}
a77;558<i??C==@DqGGKEEHLyOOSMMPTWW[UUX\__c]]`dggkeehloosmmptww{uux|
}}124:g;il9:<BoCqtABDJwKy|IJLR
SQRTZ[YZ\bcadf58<9h>ln=@DApFtvEHLIxN|~MPTQVUX\Y^]`dafehlinmptqvux|y~}
38:56:<>;@B=>BDFCHJEFJLNKPRMNRTVSXZUVZ\^[`b]^bdfchj93d;if?@A;lCqnGHICtKyvOPQK|S~WXYS[_`a[cghickopq47:3<;l7<?B;DCt?DGJCLK|GLORKTSOTWZS\[W\_b[dc_dgjcag5d676>io=l>?>FqwEtFGFNy
M|NONVUVWV^]^_^fefgfnmnonvuvwv~}~
~c4g7:jk>k<o?BrsFsDwGJz{N{L
ORVTWZ^\_bfdgjnlorvtwz~|
65eif;;>>=mqnCCFFEuyvKKNNM}~SSVVU[[^^]ccffek3gf:jik:;onBrqsBCwvJzy{JK
~RRSZZ[bbc264g6j:::><o>rBBBFDwFzJJJNL
NRRRVTVZZZ^\^bbbf3956=fj7;A=>Enr?CIEFMvzGKQMNU~OSYUV]W[a]^e_cieabe99ij
ijmAAqr
qruIIyz
yz}QQ YY'aa/ii7qq?yyGOW_f6h859k:n>p@=AsBvFxHEI{J~NPMQRVXUYZ^`]abfheijnpmqrvxuyz~}
e7;7e78jm?C?m?@ruGKGuGHz}OSO}OPW[WWX_c__`gkgghosoopw{wwx
17e3:=k:9?m;BEsBAGuCJM{JIO}KRURQWSZ]ZY_[beba81:eh89m@9Bmp@AuHAJuxHI}PIR}PQXQZXY`Yb`ahajhi9c;34j>=AkC;<rFEIsKCDzNMQ{SKLVUY[ST^]ac[\feikcdnmqe1cei<9?m9kmqDAGuAsuyLIO}I{}TQWQ\Y_Ydagalioitqwq|y
16g6j8jj9>o>r@rrAFwFzHzzIN
NPQVVXY^^`a23:3i6lm:;B;q>tuBCJCyF|}JKRKNRSZSVZ[b[^bcb674756>j>?<?=>FrFGDGEFNzNOLOMNVVWTWUV^^_\_]^ffgdgefnnolomnvvwtwuv~~
5583f7;k==@;n?CsEEHCvGK{MMPK~OSUUXSW[]]`[_ceehce24fh6:@m:<np>BHuBDvxFJP}JL~NRXRTVZ`Z\^bhbdfjpjlnrxrtvzz|~
b8638:7hj@>;@B?prHFCHJGxzPNKPROXVSXZW`^[`b_hfchjgpnkproxvsxzw~{
bed94k<ijmlA<sDqrutID{Lyz}|QLTYT\a\didlqltyt||
e29f7<><m:An?DFDuBIvGLNL}JQ~OTVTRYW\^\Za_dfdbiglnljqotvtryw|~|z
76;d8ji<?>Cl@rqDGFKtHzyLONS|PTWV[X\_^c`dgfkh5278g;6;=:?@oC>CEBGHwKFKMJOP
SNSURWX[V[]Z_`c^cebgh5g489j;:=o<@ArCBEwDHIzKJM
LPQSRUTXY[Z]\`acbedhi6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn132d:5gk9;:lB=osACBtJEw{IKJ|RM
QSRZUY[Zb]aab9dfg6kijAlno>sqrItvwF{yzQ|~
NYVa^ifqnyv~15hh=7:k9=ppE?BsAExxMGJ{IMUORQU]WZY]e_badg;i46=>loCq<>EFtwKyDFMN|
SLNUV[TV]^c\^efkdfmnslnuv{tv}~|~
796ifg;<?A>qnoCDGIFyvwKLOQN~
STWYV[\_a^cdgifkcdf:7;::klnB?CBBstvJGKJJ{|~ROSRRZW[ZZb_cbbjgkjjrosrrzw{zz
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn62;4=j78>:C<Er?@FBKDMzGHNJSLUOPVR[T]WX^Zc\e_`fbkdmf57;:7h8n=?CB?p@vEGKJGxH~MOSROPUW[ZWX]_cb_`egkjghmosropuw{zwx}
87;h:=;<@?CpBECDHGKxJMKLPOSRUSTXW[Z][\`_cbecdhgkjmkl144f<f7k9<<nDn?sADDvLvG{ILL~T~OQTT\WY\\d_aa9efhj;8iAmnprC@qIuvxzKHyQ}~SPY[Xac`ikhqspy{x
3ghgfi?<;oponqGDCwxwvyOLK
~WTS_\[gdc6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn89756j;:@A?=>rCBHIGEFzKJPQOMNSRXYWUV[Z`a_]^cbhigefkjb427=i;8j<:?EqC@rDBGMyKHzLJOUSPTRW][X\Z_ec`dbgmkhljousptrw}{x|z
2f;d7gj?:nCl?orGBvKtGwzOJ~S|O
WR[W_Zc_gb62d76=8m>:l?>E@uFBtGFMH}NJ|ONUPVRWV]X^Z_^e`fbgfm965:4ii:A>=B<qqBIFEJDyyJQNMRLRYVUZTZa^]b\bifejdjq6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn8b54ghi<@j=<opqDHrEDwxyLPzML
TXUT\`]\dhedl279i=<6i:?AqED>qBGIyMLFyJOQUTNRWY]\VZ_aed^bg3d336>l8;l;;>Ft@CtCCFN|HK|KKNVPSSSV^X[[[^f`ccfffii5g<nnnqq=oDvvvyyEwL~~~M
TU\]delmtu|}
8d3367;<@l;;>?CDHtCCFGKLP|KKNOSTXSSVW[\`[[^_cdhccfgkl1f5h95=<9n=pA=EDAvExIEMLI~MQMUTQUYU]\Y]a]eda6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn51;:g>6m=9CBoF>uEAKJwNF}MISR
VNUQ[Z^V]Ycbf^eakje7g96=kkm?oA>EssuGwIFM{{}O
QNUWYV]_a^egifmoqnuwyv}
71hhhik<?9pppqsDGAxxxy{LOITWQ\_Ydgaa3fe86g=i;nm@>oEqCvuHFwMyK~}PN
USXV][`^echfmkpnusxv}{~af93h;=kinA;pCEsqvICxKM{y~QKSUYS[]a[ceickmqksuys{}{6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn168;gh789>@Cop?@AFHKwxGHINPS
OPQVX[WXY^`c_`aag;<:5>@ioCDB=FHqwKLJENPy
STRMVX[\ZU^`cdb]fhkljenpstrmvx{|zu~}46857hh><>@=?ppFDFHEGxxNLNPMOVTVXUW^\^`]_fdfhe16869j;l9>@>ArCtAFHFIzK|INPNQSQVXVY[Y^`^acaa:48fk6kiB<@ns>sqJDHv{F{yRLP~NZTXVb\`^jdhfrlpnztxv|~
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn3457f96k;<=?nA>sCDEGvIF{KLMO~QNSTUWYV[\]_a^cde6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn7g588<li?o=@@DtqGwEHHL|yO
MPPTWUXX\_]``dgehhl6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72c49h;i?:k<ApCqGBsDIxKyOJ{LQSWRTY[_Z\acgbdikc7739ki:k??;AsqBsGGCI{yJ{OOKQRWWSYZ__[abggcijookqrwwsyz
3::i8>=m;BBq@FEuCJJyHNM}KRRPVUSZZX^][bb`fecjjcd2<:k;<kl:DBsCDstBLJ{KL{|JTRSTR\Z[\Zdbcdbljkljtrstr|z{|z
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn1ddg4;k79llo<Cs?AttwDK{GI||
LSOQT[WY\c_a6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn1ddg4;k79llo<Cs?AttwDK{GI||
LSOQT[WY\c_a72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmab7865g<ij?@>=oDqrGHFEwLyzOPNM
TWXVU\_`^]dghfelopnmtwxvu|
~}72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm1ddg4;k79llo<Cs?AttwDK{GI||
LSOQT[WY\c_a72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm61ggik6@>9ooqs>HFAwwy{FPNI
NXVQV`^Y^hfa72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmc9:e;=g:kABmCEoBsIJuKMwJ{QR}SU
RYZ[]Zabcebijkmjqrsuryz{}z
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn1ddg4;k79llo<Cs?AttwDK{GI||
LSOQT[WY\c_a6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm8g;d7kh@@oCl?spHHwKtG{xPP
S|OXX[W``c_hhkgp72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm41f38g<7<9n;@oD?DAvCHwLGLI~KP
TOTQSX\W\Y[`d_dac3e27=58l;m:?E=@tCuBGMEH|K}JOUMPSRW]UX[Z_e]`cbdf5g<i8lln=oDq@ttvEwLyH||~M
TPU\X]d`elhmtpu|x}
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn
( n u l l )
( ( ( ( ( H
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 0 0 0 0 4 b 0
C o m m e n t s
C o m p a n y N a m e
F i l e D e s c r i p t i o n
F i l e V e r s i o n
6 . 0 . 1 5 0 . 3
I n t e r n a l N a m e
j u s c h e d
L e g a l C o p y r i g h t
C o p y r i g h t
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
j u s c h e d
P r i v a t e B u i l d
S u n M i c r o s y s t e m s , I n c .
P r o d u c t N a m e
J a v a ( T M ) P l a t f o r m S E 6 U 1 5
P r o d u c t V e r s i o n
6 . 0 . 1 5 0 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
! ) ) ) ! ) 1 9 B ) B J 1 1 J R 9 R 9 Z c R Z J B Z J B k k c R J { Z R k Z { c
c { k c c k
! ) ) ) ! ) 1 9 ) B 1 1 J 9 9 Z R B Z J B k c J { k { Z
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.