1.3
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.81
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Crypt-KOW [Trj] | 20191220 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Agent.dc | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191220 | 2013.8.14.323 |
| McAfee | W32/Autorun.worm.aacd | 20191220 | 6.0.6.653 |
| Tencent | Trojan.Win32.FakeFolder.uu | 20191220 | 1.0.0.1 |
静态指标
动态指标
在 PE 资源中识别到外语
(3 个事件)
| name | RT_ICON | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003b568 | size | 0x00001ca8 | ||||||||||||||||||
| name | RT_GROUP_ICON | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003d210 | size | 0x00000014 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_TURKISH | filetype | None | sublanguage | SUBLANG_DEFAULT | offset | 0x0003b220 | size | 0x00000348 | ||||||||||||||||||
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(1 个事件)
| section | {'name': '.reloc', 'virtual_address': '0x0003e000', 'virtual_size': '0x00009000', 'size_of_data': '0x00009000', 'entropy': 7.078487803881228} | entropy | 7.078487803881228 | description | 发现高熵的节 | |||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 65 个反病毒引擎识别为恶意
(50 out of 65 个事件)
| ALYac | Gen:Variant.Graftor.1103 |
| APEX | Malicious |
| AVG | Win32:Crypt-KOW [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Graftor.1103 |
| AhnLab-V3 | Trojan/Win32.Npkon.R18258 |
| Antiy-AVL | Worm/Win32.Juched.pfk |
| Arcabit | Trojan.Graftor.D44F |
| Avast | Win32:Crypt-KOW [Trj] |
| Avira | TR/Buzy.416012 |
| Baidu | Win32.Trojan.Agent.dc |
| BitDefender | Gen:Variant.Graftor.1103 |
| BitDefenderTheta | Gen:NN.ZexaF.33556.oy2@aWJgKumG |
| Bkav | W32.GenericGanelp.Trojan |
| CAT-QuickHeal | Worm.Ganelp.A6 |
| CMC | Worm.Win32.Juched!O |
| ClamAV | Win.Trojan.BankerSpy-1 |
| Comodo | Worm.Win32.Jushed.KA@4cysvx |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.060595 |
| Cylance | Unsafe |
| Cyren | W32/Agent.KI.gen!Eldorado |
| DrWeb | Trojan.Siggen3.30837 |
| ESET-NOD32 | a variant of Win32/Agent.TNE |
| Emsisoft | Gen:Variant.Graftor.1103 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Agent.KI.gen!Eldorado |
| F-Secure | Trojan.TR/Buzy.416012 |
| FireEye | Generic.mg.6e8c3ec0605957f5 |
| Fortinet | W32/Agent.SRG!tr |
| GData | Gen:Variant.Graftor.1103 |
| Ikarus | Trojan.Win32.Webprefix |
| Invincea | heuristic |
| Jiangmin | Worm/Generic.lml |
| K7AntiVirus | EmailWorm ( 005191521 ) |
| K7GW | EmailWorm ( 005191521 ) |
| Kaspersky | HEUR:Worm.Win32.Generic |
| MAX | malware (ai score=88) |
| Malwarebytes | Trojan.Agent |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfee | W32/Autorun.worm.aacd |
| McAfee-GW-Edition | BehavesLike.Win32.Autorun.dt |
| MicroWorld-eScan | Gen:Variant.Graftor.1103 |
| Microsoft | Worm:Win32/Ganelp.E |
| NANO-Antivirus | Trojan.Win32.Graftor.fiiwfc |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM02.0.0173.Malware.Gen |
| Rising | Trojan.Fakefolder!1.6944 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Ganel |
| Sangfor | Malware |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1997-06-11 20:43:16
PE Imphash
faea664dccb12d653cbea3ef51eb7d97
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00023590 | 0x00024000 | 3.700018352274897 |
| .rdata | 0x00025000 | 0x00001a3e | 0x00002000 | 4.381105202572365 |
| .data | 0x00027000 | 0x00012fe4 | 0x00002000 | 0.783453003635459 |
| .idata | 0x0003a000 | 0x000009a6 | 0x00001000 | 2.822041652632708 |
| .rsrc | 0x0003b000 | 0x00002990 | 0x00003000 | 2.3787886881901397 |
| .reloc | 0x0003e000 | 0x00009000 | 0x00009000 | 7.078487803881228 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x0003b568 | 0x00001ca8 | LANG_TURKISH | SUBLANG_DEFAULT | None |
| RT_GROUP_ICON | 0x0003d210 | 0x00000014 | LANG_TURKISH | SUBLANG_DEFAULT | None |
| RT_VERSION | 0x0003b220 | 0x00000348 | LANG_TURKISH | SUBLANG_DEFAULT | None |
Imports
Library KERNEL32.dll:
• 0x43a260 GetLastError
• 0x43a264 GetSystemTime
• 0x43a268 MultiByteToWideChar
• 0x43a26c GetLocaleInfoA
• 0x43a270 GetModuleHandleA
• 0x43a274 FindNextFileA
• 0x43a278 FindFirstFileA
• 0x43a27c FlushFileBuffers
• 0x43a280 SetStdHandle
• 0x43a284 FindClose
• 0x43a288 Sleep
• 0x43a28c SetFilePointer
• 0x43a290 LCMapStringW
• 0x43a294 LCMapStringA
• 0x43a298 GetStringTypeW
• 0x43a29c ExitProcess
• 0x43a2a0 TerminateProcess
• 0x43a2a4 GetCurrentProcess
• 0x43a2a8 GetStartupInfoA
• 0x43a2ac GetCommandLineA
• 0x43a2b0 GetVersion
• 0x43a2b4 DebugBreak
• 0x43a2b8 GetStdHandle
• 0x43a2bc WriteFile
• 0x43a2c0 InterlockedDecrement
• 0x43a2c4 OutputDebugStringA
• 0x43a2c8 GetProcAddress
• 0x43a2cc LoadLibraryA
• 0x43a2d0 InterlockedIncrement
• 0x43a2d4 GetModuleFileNameA
• 0x43a2d8 IsBadWritePtr
• 0x43a2dc IsBadReadPtr
• 0x43a2e0 HeapValidate
• 0x43a2e4 UnhandledExceptionFilter
• 0x43a2e8 FreeEnvironmentStringsA
• 0x43a2ec FreeEnvironmentStringsW
• 0x43a2f0 WideCharToMultiByte
• 0x43a2f4 GetEnvironmentStrings
• 0x43a2f8 GetEnvironmentStringsW
• 0x43a2fc SetHandleCount
• 0x43a300 GetFileType
• 0x43a304 HeapDestroy
• 0x43a308 HeapCreate
• 0x43a30c HeapFree
• 0x43a310 VirtualFree
• 0x43a314 RtlUnwind
• 0x43a318 SetConsoleCtrlHandler
• 0x43a31c HeapAlloc
• 0x43a320 HeapReAlloc
• 0x43a324 VirtualAlloc
• 0x43a328 GetCPInfo
• 0x43a32c GetACP
• 0x43a330 GetOEMCP
• 0x43a334 GetStringTypeA
• 0x43a338 CloseHandle
Library USER32.dll:
• 0x43a394 MessageBoxA
Library ADVAPI32.dll:
• 0x43a230 GetUserNameW
L!This program cannot be run in DOS mode.
:!~@~@~@
_w@~@B@
@Rich~@
`.rdata
@.data
.idata
@.reloc
UDSVW}
E_^[]UPSVW}
_^[P;Q
]UTSVW}
_^[]ULSVW}
MU;U}gE
E}^}7M
_^[L;BN
]U@SVW}
_^[@;wM
]UDSVW}
_^[]UPSVW}
_^[]UDSVW}
_^[]UlSVW}
u,U;Uu
t\U;Uu
E_^[l;E
]UpSVW}
EMMU3f
Q<UE8PE
MQxUEH|MU
M;M}-U
_^[p;C
]U`SVW}
EMMU3f
Q<UE8PE
3_MQxUEH|MU
ME_^[]UH
]U@SVW}
_^[@;(7
]U|SVW}
_^[|;^,
]UHSVW}
_^[H;"
]UHSVW}
E_^[H;u!
]UHSVW}
9Us)E3
_^[H;
3EEEfE
jdTQhDzB
MQh`PB
URh@PB
MQPp;e
fUfUfEfEfMfMfE
-oje`[VQLG_^[
TPP`QC
;}}PRcP
wuWhUB
E}tEEP
tAt2t$
PRSVWh
_^[ZX]
r)$hf@
DDDDDDDDDDDDDD
GIt%t)
Gt/KuD$
GKu[^D$
[^_U=C
]UjhWB
EMQUR&
eEPJMd
_^[]U=C
@v)URc
RPQRPQRPQREPM
t&hDZB
E _^[]Uj
3u&h`\B
t&hDZB
;t!h[B
$REP'6
M;Mt!hT[B
;Et!h8[B
E_^[]Uj
]UQSVWzB
uCE PMQ
uCE PMQ
;Mt!h\B
;Mt!h\B
_^[]Uj
EE_^[]UQzB
E]UQSVWE
_^[]UQ |B
E]UQSVWE
E_^[]U
3uNh^B
u:U REH
QURhx]B
u:E PMQ
REPhL]B
u/M Qhp^B
QURhP^B
RE PMQh$^B
E_^[] @
E]UQzB
REP/,
%URh`_B
H0_^[]U
A,+B,M
J0+H0U
E_^[]U
PM QhH`B
PM Qh `B
PM Qh_B
u_^[]U\SVWE
UB E=4~B
EPMQh`B
u_^[]U4SVWEP
3_^[]UQSVW}
Q0Rh`B
3u_^[]U
]UQEzB
UjmhLaB
=tGjyhLaB
EMMUREPj
UREPMU
PMQUR#
jdhdaB
EPMQUREPj
3%MQUREP?
MU;U}eE8tXM
E}tXMQ
E}@}2M<`C
]USVWUj
t.;t$$t(4v
VC20XC00U
]_^[]UL$
_^[]UQE
]U0SVWEE
j]hTdB
j^hTdB
E_^[]U,SVWEE
jZhpdB
j[hpdB
E_^[]Q=
EE]U]U$|B
UE;Es%MU
]U8VDC
MU;Us$EM#
MU;UuIHC
U#TDU}
^]UQDC
E}?} MU
UE;Ew]MA
UUE+EE
]UQ=@C
M;t U;u
tn} }2
,3]U0SVWEE
j]hTdB
j^hTdB
E_^[]U
MQUREPj
Ek0H~B
s{Uk0EX~B
Mk0UEfAL~B
Ar;Zw2!C
Qar;zw2!C
ddIdd.wld3
``C``5
fEfMQR!
U tHE@t
RPRPu0RPQR9~
ERM+MM
fZfZPxQ
QtRxP)
_^[]P@
fA]UWVu
DDDDDDDDDDDDDD
^_UjheB
3CMQURE
PMQURE
_^[]UjheB
SVWe=,C
REPMQU
EPMQUREPM
EPMQh
QUREPh
QU+RQU
E+]UQSVW}
Uj;heB
_^[]UE
@]UQ=C
M}-s#UE
|jyheB
<uh=zB
<tc=zB
~VUREH
;Eu!MQ
E_^[]UQE
EE]UQVE
3^]USVW}
_^[]%C
Oe !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_abcdefghijklmnopqrstuvwxyz{|}~
n2ltcr#MlnAabyrireltuAeDcyedFNAtimVaAplGiwro#Vmfanr3leodstuaeoirFLaSitbsreerGoeeeevntieoi#WoitAtunmoeldGrdsedHlLLa#er#FAieCtro#MllmGnonrlCFAtdDcyelIri#ke.#PAeGoed#drAebytert#aitAtuia#Ereab#yeenserGoeotA
dslFNFAnoRvro#ei#DeeeglvrsrelpnhGunosPe2srsN#sn#ai#tleiGiiGalGaenri#dteil#oitAlFAtvpGoaitgCtolSs#Cers#c3rPe2toaeeFAiiRF#FS#bl#briiFAnxlFCemDcyeeeeiy#LcrSn#aoe2pttrPedosi#c3xlHlreerF#deteeoAcoF#FFteiei#dseeerDtlGrTAtiDeiAeTh3aoertcIrsFtoseCedCtlWeealelzllolle
i.#etnnnocFelIrCedntlteeIrCe#Gi#etsn#ielnnp#etnApFAteoaewndIrOAtentttennlHl
i.#etnnnocFulIrCedntlteeIrCe#Pi#etsn#ielnnp#etnApFAteoaewndIrOAtentttennlHl
leeexthEuSlcA
l.e2lh3lsld
$*$%u}-sEBB5>Ds?>DB?<$5D-$5BF935C-$81B54q335CC-!1B1=5D5BC-v9B5G1<<!?<93I-$D1>41B4!B?69<5-qED8?B9J54q@@<931D9?>C-|9CD
bd:ael*nE::
CegsyeoeRlK
SaEgVeetuARelx
OKxgnEeeyRpeA
a2lv3ldidap.
DtlgeaAelVeReeu
CtygaeAeeKxRreE
\Java\jre-
gFsomeralPri
$?6DG1B5]aaaaaaaaaaaaaaaaa]sEBB5>D'5BC9?>]#E>
e.gteeixrde
/Downs/HelpVer.hlp
/Downs/Help.hlp
Help.hlp
/Private/
Pfile.hlp
gdaheb123
?>D85<9>EH
6D@]DB9@?4]3?=
cy~&|q)
7B9@D?<?:9
6D@]g8?CD]3?=
gdaheb
2f0ibfacab
6D@]2I5D8?CDf]3?=
jusched.
!B?7B1=v9<5C
Fi386\chkesp.c
The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention.
Assertion Failed
Warning
%s(%d) : %s
Assertion failed!
Assertion failed:
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
wsprintfA
user32.dll
Microsoft Visual C++ Debug Library
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
(Press Retry to debug the application)
Module:
File:
Line:
Expression:
For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.
<program name unknown>
dbgrpt.c
szUserMessage != NULL
Client
Ignore
Normal
Error: memory allocation: bad memory block type.
Invalid allocation size: %u bytes.
Client hook allocation failure.
Client hook allocation failure at file %hs line %d.
dbgheap.c
_CrtCheckMemory()
_pFirstBlock == pOldBlock
_pLastBlock == pOldBlock
fRealloc || (!fRealloc && pNewBlock == pOldBlock)
_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse)
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
_CrtIsValidHeapPointer(pUserData)
Allocation too large or negative: %u bytes.
Client hook re-allocation failure.
Client hook re-allocation failure at file %hs line %d.
_pFirstBlock == pHead
_pLastBlock == pHead
pHead->nBlockUse == nBlockUse
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
DAMAGE: after %hs block (#%d) at 0x%08X.
DAMAGE: before %hs block (#%d) at 0x%08X.
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)
Client hook free failure.
memory check error at 0x%08X = 0x%02X, should be 0x%02X.
%hs located at 0x%08X is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0x%08X.
DAMAGED
_heapchk fails with unknown return value!
_heapchk fails with _HEAPBADPTR.
_heapchk fails with _HEAPBADEND.
_heapchk fails with _HEAPBADNODE.
_heapchk fails with _HEAPBADBEGIN.
Bad memory block found at 0x%08X.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemDifference: NULL state pointer.
Object dump complete.
crt block at 0x%08X, subtype %x, %u bytes long.
normal block at 0x%08X, %u bytes long.
client block at 0x%08X, subtype %x, %u bytes long.
{%ld}
%hs(%d) :
#File Error#(%d) :
Dumping objects ->
Data: <%s> %s
Detected memory leaks!
Total allocations: %ld bytes.
Largest number used: %ld bytes.
%ld bytes in %ld %hs Blocks.
stdenvp.c
stdargv.c
a_env.c
ioinit.c
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
format != NULL
sprintf.c
string != NULL
vsprintf.c
GetLastActivePopup
GetActiveWindow
MessageBoxA
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)
_flsbuf.c
str != NULL
`h````
ppxxxx
(null)
output.c
ch != _T('\0')
_getbuf.c
_file.c
osfinfo.c
fclose.c
_freebuf.c
stream != NULL
aa3vd2apeJUt
a3d2peUt
htdocs
GetModuleHandleA
GetLastError
GetSystemTime
MultiByteToWideChar
GetLocaleInfoA
FindClose
FindNextFileA
FindFirstFileA
KERNEL32.dll
MessageBoxA
USER32.dll
GetUserNameW
ADVAPI32.dll
CoUninitialize
CoCreateInstance
CoInitialize
ole32.dll
ExitProcess
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
IsBadWritePtr
IsBadReadPtr
HeapValidate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
SetConsoleCtrlHandler
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle
)y)y)y)y)y
)y)y)y)y
y)y)y)y
kkcccccJ)
})y)y)y
kkkkkkkkkkcJ)
)y)y)y)y
sssssssssssssskR1
)y)y)y)y
sssssssssssssssss{{Z9!
)y)y)y)y
!ssssssssssssss{{{{{{{{{ICONMD5.d41b8753
!{{{{{{{{{{{{{{{{{{{{{{{{{{kZ)y
!{{{{{{{{{{{{{{{{{{{{{{{{{{J)y
))sc))y
11kcZ1
RRkck!)y
Zck1)y
9kc!)y
)9{9)y
6666666i777
8(8<8L8^8k8|888888
9)909=9D9Q9X9b9l9v999999999~::::::::
;";,;6;=;J;Q;[;e;r;y;;;;;;;;;;;;<<c=
>2>V>]>n>>>>>>>
0Q2222
3H3O3[3333333
4L4S4_4444444
5"5P5W5c5555657<7H7v7}7777777
898@8L8z8888888
9=9D9P9~999999
:A:H:T:::::::
;E;L;X;;;;
=.====U>>>
?.?E?p????
1G1S1y1111111
2+2l222222223;4W4444444
5%5A5n555555
6-6)7A7]7n7777
88888!9-949Y9e9l999999%:V::::;;
<"<G<S<Z<
<<<<<<<<
= =-=?=c=n=====>>8??
1*161<1L1k11111111222222
33333333
4!4*4A4w4
44444555
6L6t6}6666;77
88W::::::::A;r;~;;;;
=(=M==
,0\0>1J1`111111
2,212@2I2X2m2u22222222
3)3X44444455
6 6,6@6}6666 7J7g7s777777
8F8888
9#979K9_9s999999
:=:I:]:q::!;Q;q;};;;F<Z<f<z<< =&=2=F=Z=====
>5>:>U>\>u>>>P?o?x??????
0=0D0T0[0033333333333333444X5p5w5
55555555
6b6h6l6p6t666
717[77777777777
;;;;;;;;;
< <$<2<L<c<q<<<<<<<<
=(=R=W=a===
>4>E>d>u>>>>
? ?*?:?D?S?e?q?
0#070D0I0O0g0t000000071C1W1111111
2#2P2W2a2u2
3$303^3g33
4$404O4i4u44444444
5$575C55555*6P6
7&727N7Z7{77777
8k8p888
9#9+91979?9E9K9S9d9m99999G;\;h;;;;;;;'<q<v<<<
=h=t=====
>">+>1>7>>>C>h>>>>,?6?B?c??????????
000000)15111111
2$2`2f2222
3)3G3O3U3~3333333
4Q444444H5T55555S6_666
7Q77777777!8&8I8N8v8888
9D9v999
:K:::::::::D;\;;;;<<<
><>H>>>5????
/0g000
111H1z11
3-3333
4,4V4~44
5'5:5N5T5e5p5555555
6,6N6g6
6666667777
8Q888888888
;<H===
>)><>O>>>>
?2?@?S????
060<0Q0
1,121;1P111/2q222
323A3T333333333
4 4'484@4G4M4T4h44
5,55556>6G6]6f666666
7/787?7e7n7777
8%8e8x88;;;;<<<<==
>B>I>O>[>b>n>v>>>>>>
?"?&?*?_?w????
0#0000000000+1:1D1H1L1P1T1X111111111
2 2,262;2@2J2O2U2^2m2z222222
3333!4m4t4455
6#66666666
747K7R7W7]7j7p7v777777<<<<
= =)=9=G=S=d=o=x==============
>%>8>A>>>>
???K?l??
83C3K3u3{333333333333
434:4`4h4)5f<r<{<<<<<<<<<<
= =(=4=;=@=I=Q=\=f=u=~=======
3333446
7"7z777
8m8s8|8888888
9.999?99999999
:/:B:e:u:
:::::::
; ;d;m;w;;;;;<<<<<
=h=w======>>M>b>>>>>>>>
0)0$1-1s1
22#3L3a333X4_4z55
8?9a99>>>>>>>>>>>>>>>
?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?
h111111111
2 2$2(2r2x2|22222
3 3$3A3k3333333333
4v4{4444444444
5'5:5a55
666;6X6f6s6}6666666
77777'888
999999
: :U:o::::::*;
<9<i<s<<<<<<
=>=G=c=l=y=
>!>6>?>K>T>b>k>y>
>>>>>>>>
?6?H?k??????
0(0M0Y0_0u00000
181X1}11111
272E2S2f2v222222
3/3@3J3h3}3333
4_4i44444
505E56666%7;777i8~8888888
9/9A9K9999
:::::::::::::::::
; ;&;,;2;8;>;D;J;P;V;\;b;h;n;t;z;;;;;;;;;;
555555
3 6:::::::::;;;;;;;;;;;;;;
< <(<,<@?D?P?X?
111111
j<$~4Itt(
T- 0>TOu8-
H'Q'xAqT
C|H)RE
@ymTjw
(bm`z"*?$G>
=PS\qLt
ZXzQ'O"j!i
jh\&W$\6B
)j!)c)4
=YOxPn)hMm
I)B5K[@
sA>B$X\
uQ=c!md
ivNk,Et|Rh!]
GV[/r,
0vX(J<d:]ZF\
7Yr)0sgj
[l0I{%n:$H
tzp,Xz
Uz dnvp
?Y`x.l UN
,.U[yp-
.u_BtHJ6Ty .
9nZ ud*}
nY9=*L
q1wutC8QZ>
Mf|~O\`0
FK6NRV>x
I%\{$emu
=SS1L+`_e
1p,+3+jZL
]")r]\[
wp]SD
r-Wfdx
5x"|D$i
5+;7wQ
KCxKjb
)O)9?D
<sgOW)O#fe
ne=#>
X08d_1UiQ
|l "AG|*
p'<\.zrH4hhAy
~oZcCs
!8G-/.
`Yzs8H>F0
/ftI'9
x[BBk!.
&[&i2%
@X^;/DLv`NN
pH=jo-p
_i-Ar)
96k*03FmlOY
FQCx$,Z
>a!D(H
$f/8Mf"
|%uS7y
Vh`UAxF*OI'8]-a7,S
*:6`g(a[
o3?/v0k
:>csHh.6;
)xT}7i_
C-]a-.sV
&HS(IQbq<R$&>}Q50
;-OJ:Nc+ :
M~yw%RSx%|zW
Un=U'GX
[VPMUHG7WfM
JWejL;GZ
gH#'qaNe
##w+3'9
r}pKO:@2}s
"w5--|q^,
;J|7ZOTa>+#;>bpb
V*//F!eE
he(d/L
waI?\$0;
um)3u_fi.~$EJgMq
a'W(k-Yy
]e|X,"\
?(% 0l
?>jclR
;:Hk/56"
RQ`*a)
*ZBTR+?
%LL/{L
Eyn>-r>lh'
jG2u`Bk!
r<N}^Sp_o
Vck(Cw
"#p$f|KK}S{=I]GpC{!5
N7fF#kPJyS
2UtSr ^&-!7
>ZBiV(>
+=/gz%~fIbH
(8f7a3r
_;dw|"oB$5(d
;EjX3`;{%L4
+$f?JK
sC&2e+
OZ B@?j
j%1g**b
]BIMDhoB;+Q
01@8s(H
v!ao`
OL}<G1`
EMW>H_.
16EP#a
\fjjHR;A.
)5r#2D=M_
up{+i8F
YoxL0'
5KN[JZ
9Q"AyB
H8bLKV&xx
CT1-,z#:w
gYU"vH6W+o
|e`7\G,F
pC&l^NR$FS
%d%I2a:;.7-
/ 1U\5d
6$hRN*l)qL
plVL]L
P>!Eebo
{Cfp;+
g<Lx<CWE
KWb~36
5@V2|Y
H+S??r
( /= 9
K%w| f
SPcDxE<!L
r.~O?=)
'b@84,&1
;!*kd
<$AWYuyc
4'_f$k
WyRQ&`
k0N pC
4RBq+d<0
DD@sWr
UR7{T*
=Xcdn!V+q
/B4RW\
uj0?3I
(%Evc&F^
M])3S(
pr+BGx|
L+YRtE
+RiR< {
kAU,^O
u#R:` sF)
i]C0:X
;I--Z7
j!=4GRHyMu
);] <SBm(w&[U
mt>tOr2~5}
~}A{[Olf
p- ^f\
J5P-6-'C
4 %WHW
Ya%<\|
Pw~oA*{+
KjQ7m h};
iA*V@Oj)Iz
NXiTQ*#2f
ls)gD5&+
bh7(\A=L5W
pDBXwMPd`
LCZ]%o
:io"=%
"4h`5|Fy
mT!3ph|X
>P]]7F,V
&e#eNV
{YZ`JA
k8vgIn
_@=(+@]!&
??K<u?
fT{8Z0
fi8X<>t
l=^LxX>Q! 9
UMDyOQ
j(\]Xx
"m`*yvb
dtISE=?
6j`]1C5P'-g ^
4F "Gs}B
P]=h"L'Ky
&U^' @
mjWMwS
2o8+E};
d 9"wz`v4*+c
#A)8S`\
"D}8kH* (
!( v\?ZQS,
+=V^iG)b+
^ul4PAW
x#,R[}
ggV)Yn
0[oa|,;m
ZctzPX
I!cAob
K;b_-6Z%27vt.
{'&ek*<
>zX:o"cqxL[
~ovWW]E
C&iX?8
EQkacd
iP>gO%M^qd
|73-<#
{!?v<*
&!\LRG&z+J)d&yG4d5#Dn`g
'_3LRu6M60z?G)/
(46U=,s)`:0
~,i Su=X9
TxN<e`kX
b\3aFr
}j jd%E3Y#HT
@QBf ?O
6S:T{ UIc
aGra9W
pDmcXj
z*1L`l4
|JjX\as%
&JH!{.
`0%-;=
W/yP$:
H:{zcJ^UI
=+1orO?#
S2^Z/I
BC]2VU>k
dVa'9TC
Ke2$z7Q
<4e(2=w`Pkc}'a2U
f*3P%
Z2p7P5[
JAh(32
$813 W
JFXC-GBOZ
Q,i-s%c)
:uBY,dZa
"(q'mo
Lwy0TM6aWS
kVQ5y4Mw
`+Vjb|}Qza
fQ?N&'m8{a
~4TkQT@:A
<+q$CX%-
<O}',_5
DHBocjg#/Nl
rF`E,23w$xBWY]J
L0-b?v@
+/aAjT
=%R;f+u5m
u.0OAZ4
?,R-!{/
(8'Z@!T/q
/[(B4^
o[Ruz ~
/4,OFx*
Euvk5`
m~YO*Ny
`jgiGQ,)
bWNF)Y-
eQc*O5rt
:'=-S!pawaOs'SF
bn YPFA<
C< rX={T
s8SL1Y:
(8Zb`Wa,cS
Z8UZW'
:n`UrhjkPm
eWeVw8Ym;N9
#;7`P13m$
@kl#'7?
*$0>A?{})GVO7Bhf|hB3jyw$b"
}u2,M%904
vFuhrj
yyr"|HyD
Nk@a+s!
;Y68!ILB
gMq'@)
ZHF-X3
^Q"]Sh
2uodyj
}=qp<GS
0X^)t:7I1
C-&Y=qA
Y{Lkf)n,
2sx&At
AJfJD'
@cIh(` c
DVIw$@q+F
dkg`IM
6f|+5t
$yx.27esvoam
lEUa][I!rwqN
y77gIy)
%d%I2a:;.7-
EbLdMmoO
Sj!!o'$.u sK
TpU8G(oL
biwHW!
't$$kn1
5ZIYDx
Ey}+oO
a]ID`
'CeTiUz
_]}5:sRR
Ky:?z?XD
#?=mL1}B8+j
nyn:Y"f
jKXQdm!
DLsW?O
+{$+#=u]^]/mem
@\ME3I+6
rm&I/]6
Ly]:a8E
-`aEZ&mPKJ{$y
v:4 i)_@\bp
\kD~>q-Er+YE
cWErV\(
[hrH+6
~Z|+7.}USZ<
[;kd|D
DIo%1X
)U+1_}S
;gE-OR
zw{K]E
5K|JwoJ
'QQ+[sju
25(G[#
e^o9CW/
%&F2{RXE!
3' \ >n;
ORBg|wF
,*5&hKaU%6M-bflw
X><XkiK{
-jL"En7el,
{fu(r'
5}PxKr*fc
7:X*i};
c+O]Zz
((iw|6[k@@o.Y
{O'QY]L$p
"IP]lkD5
P1KVl]6h-G1@K
ocyT{]WL
?L:N@vi`#
>iLb+qLSA03a
<HgicG
{8KM}G
N8rFR+o+`Qq+
/1HOCVimKh
[uGx |
&Yr^TD>]C8=)t
,]pxa?+b
Pg`J'E|
G4v4(0[$}:
JsxM;9dO%
"6G8~M,=ppwP7
Mqif}-
|bx41*Cw
-) 5,i
M[|~eP
-n$C"yL$nHX
_h8rm]f
SA8<uvA;
Da)U;K\wbtz
JHy ,7N^(ibgM#ZmFf$
f-jLNW
VE^-Di
F"mN<l
kp-k3Rvy
q7o@%+*8
*;/Gk\AL6
1fd@GE
i\YY A#
9aJj\\yO9)r
RW6oWp
H;X$/k
)>:U\A
\jhrHyCh
0*%yN#
H"gP$[W%s99
GK&Uz@i
Z;q{`GP1
u;CoHaw/%Csb
y@a9FH
/#h`;6<!
'P<`El[HXh
9SELW"Eux:n,
mjsNf=)9Zp
1KR]<E6oj:P`0
8L4b?`
cog8s11<8Z
,QJ2D(
+T(0bh
b_"`wU^
IJyC8jN\v~
.2R~P"
=7RO6Wd
%\`,8NZE
aI'HO?
fkp@\gf
;K%~7n:cq]
3J9^zYC:i(6+
x:F!w%
OLFuesu
`y Zay5g
a'qvFXaU~
cEUg@'J{C
6bR7*)
H8 F"$ 6I
F/|5nGy\Wo
_.)CiiC U0SDe
UoHj*D7F3
8q,djOdz;
r/}=_x
lHX;L*[
_9F8lY#HXST'
Rk*<z0PR4vC
nv2>*op,?
JTx|4x[
1YDuLL-Sy7JZD~z3.(0E
M'8D%t.'
+9\+Xr,rLf'
28oq ~)
W}Z4!;
<@{TE?
v93uq)
|;^<$,YK
!T:2txe\
;iAt(L}
X$i:_~
i]Ylf(9N8oQ
{@d778Jm&n X1!
ImP@:IZx8
>uOwy0/uGT
fMZX)#
$Tz F{i7cNR
e;~iwY
M7PSw`Au R[2
Y|H2O7hK}uQqrf
\;RTZB)
Tn8g[0le^8
}c_ IJA9
i,5!)vI:On
$u.*? wG;I
n9fBIq
qe2'6-9x"
hi^v)]
sC_be+
',QY<
&|u'V9E]koi \'XFRd
\'@=1K_(
JNzNOL
z:LT}]
*u"=|WpB e*
G@l*C:
(nJ7WZ.
| g{sg'J
GQZgto
SC'|m4R
T#yY<oQEyE
)olS?n(
(,\cF:8
[$n7`8
C.[RB!
T1-,z#:w
gYV"vH7W+o
pC&l^NR$FS
%d%I2a:;.7-
/ 1U\5d
6$hRN)s)qL
pjVL]Lf\T7/!
P>!Eebo
zCfp;+
g<Lx<DWE
0i8D$$
5@V2|Y
H(S??r
( /= 9
SPcxE<!
r.zP?=(
e@4,&1:J[
;!*kd!
<$AYuyc
4'\g$k
WyR_&`
k0N pC
4QBq+c<0
DD@sVr $>O
UR7{T*
=Xcen!V+q
/B4RW\
uj1?3H
(%Evc&A^
MZ)3S'
U^i8/g(=;p
pr*BG{|
L+YRtE
*RfR< {
jAU,^O
u"R:` rF)
h]C05X
6VtV4GR
4k ))} <0RfmHw5+
&3mb zu{dx
^j\1U`}S
}t-u]uJM
9UqbuFXn
;&xcA#*gpQR@)\6
;psK_l
H+kBZB{iu
]NNg`vd
xfu 6}x*Lb9P
1 >I7?@
O+)ZvA
vHn"4E`
5W,Fy5s}
75,?kMphh
YHT`VJG5^gh
+,@Q\-HnoU
N|Iep[0
:#]Vk6
"-?|Yw5
R-?0aZm/SCTt
MVDhVSH+d|qkeYrF
\+/ i>T
X]:?Sn
U|<,(F\
kQeEc+G
$\Jk=.$
e`~v8O94
3|ZR%VY
8y.Mom1
- "lU'"h
<5-Q55Up
243e5h?8:<;m=pG@BDCuExOHJLK}MWPRTSU_XZ\[]g`bdd5cejk=<l=kmrsEDtEsuz{ML|M{}UTU]\]edemlmutu}|}
9:he9gg@ABpmAooHIJxuIwwPQR}Q
XYZY`abahijipq8gg;7jk:@ooC?rsBHwwKGz{JP
SORX[WZ`c_bhkgj6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn66;<8988>>CD@A@@FFKLHIHHNNSTPQPPVV[\XYXX^^cd`a``ffklhi13;d:69
9;ClB>A
ACKtJFI
IKS|RNQ QS[ZVY'Y[cb^a/afg9f6f=mnoAn>nEuvwIvFvM}~
Q~N~UYV]a^eifmqnuyv}~
99h:<h9mAApBDpAuIIxJLxI}QQRTQYYZ\Yaabdaiijliqcf7i6h<?kn?q>pDGsvGyFxLO{~ONTWWV\__^dggfloontwwv|
e97:gh6mmA?Bop>uuIGJwxF}}QOR
NYWZVa_b^igjfqornywzv
2d9he=i
:lApmEq
BtIxuMy
J|Q}U RY]'Zae/b6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn7:e7ekg<?Bm?msoDGJuGu{wLOR}O}
TWZW\_b_dgjgd8ci7<j
l@kq?Dr
tHsyGLz
|P{OT XW\'`_d/hgl7pot?xw|G
3663;j7j;>>;Cr?rCFFCKzGzKNNKSOSVVS[W[^^[c_cff34g459i9;<o<=AqACDwDEIyIKL
LMQQSTTUYY[\\]aacd632i<fhh>;:qDnppFCByLvxxNKJT~VSR\^[Zdfcbl15ce9:7i9=kmAB?qAEsuIJGyIM{}QROQUYZWY]ab_a81eh:k<7@9mpBsD?HAuxJ{LGPI}RTOXQZ\W`Ybd_hajlg4837:5:i<@;?B=BqDHCGJEJyLPKORMRTXSWZUZ\`[_b]bdhcgdfg7ji7klno?rq?stvwGzyG{|~
OOWW__ggooww
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn665g:7=:>>=oB?EBFFEwJGMJNNM
ROURVVUZW]Z^^]b_ebffejgfddfik;8nllnqsC@vttvy{KH~||~SP[Xc`khsp{x
93795h=>A;?A=pEFICGIExMNQKOQMUVYSWYU]^a[_a]eficgiemnq8e8<:59k@m@DB=AsHuHLJEI{P}PTRMQXX\ZUY``db]ahhljei196ffi7>9A>nnq?FAIFvvyGNIQN~~OVQYVW^Ya^_fa3d6h459>;l>p<=AFCtFxDEINK|NLMQVSVTUY^[^\]afcfbeg5<h6:jmo=Dp>BruwELxFJz}
MTNRU\VZ]d^belfjmtnru|vz}~4c33:g;@<k;;BoCHDsCCJwKPL{KKR
SXTSSZ[`\[[bchdcce853i=l8m@=;qEt@uHECyM|H}PMKUPXUS]X`][e`hecmhpmkupxus}x}{
7d:37;:7?lB;?CB?GtJCGKJGO|RKOSROWZSW[ZW_b[_cb_gjcgkj213;g=hk:9;CoEpsBACKwMx{JIKS
URQS[]ZY[cebab74549<@j?<=<ADHrGDEDILPzOLMLQTXWTUTY\`_\]\adhgdedilpolmlqtxwtuty|
51fi88?m=9nq@@GuEAvyHHO}MI~PPWUQXX_]Y``geahe6:hgf;8m>BponC@uFJxwvKH}NR
~SPVZ[X^bc`fjkhnrspvz{x~
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknc2fd;5imk:nlC=qusBvtKEy}{J~|SMR[UZc]bkejsmr{uz}
7:4;;h7@?B<CCp?HGJDKKxGPORLSSOXWZT[[W`_b\cc_hgjdkkg3d6h459>;l>p<=AFCtFxDEINK|NLMQVSVTUY^[^\]afcf63:h=59:>;BpE=ABFCJxMEIJNKRUMQRVSZ]UYZ^[be]abfcjmedb798ji=lj?A@rqEtrGIHzyM|zOQPUWYX]_a`egihmoqpuwyx}
cb464=i<kj<><EqDsrDFDMyL{zLNLUTTVT]\\^\eddfdmllnluttvt}||~|
2f6e=5l@:n>mE=tHBvFuME|PJ~N}UMXRV]U`Z^e]hb215:;hk<:9=BCpsDBAEJKx{LJIMRSTRQUZ[\ZY]bcdba2c46g;jm:k<>oCruBsDFwKz}J{LN
SRTV[Z\^cb6d6:;57>>l>BC=?FFtFJKEGNN|NRSMOVVVZ[UW^^^bc]_fffjke242g;ikk:<:oCqssBDBwKy{{JLJ
SRTR[Z\Zcbd7dgfh9;@?lonpACHGtwvxIKPO|
~QSXWY[`_achgikef;;6;;kmnCC>CCsuvKKFKK{}~SSNSS[[V[[cc^cckkfkkssnss{{v{{~
89;5ff?
@AC=nnG
HIKEvvO
PQSM~~W XY[U_'`ac]g/hikeo76d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikncb98hg<@kjA@poDHsrIHxwLP{zQP
TXYX\`a`dhihlpqptxyx|
67;37kh8>?C;?sp@FGKCG{xHNOSKOPVW[SWX^_c[_`fgkcg16gf76g@9>on?>oHAFwvGFwPIN
XQVWV`Y^_^habbg35ij<jjo;=qrDrrwCEyzLzz
KMTSU\[]dcelkmtsu|{}
3864===<;@><EEEDCHFDMMMLKPNLUUUTSXVT]]]\[`^\eeedchf72gff5j@?:onn=rHGBwvvEzPOJ
~~MXWRU`_Z]hgbe6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknc9:e;=g:kABmCEoBsIJuKMwJ{QR}SU
RYZ[]Zabcebijkmjqrsuryz{}z
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn565779<>=>=??ADFEFEGGILNMNMOOQTVUVUWWY\^]^]__adfefegg3e4g5ii<;m<o=qqDCuDwEyyLK}L
MTSTU\[\]dcdbbd3:;<kjjl;BCDsrrtCJKL{zz|KRSTSZ[\[bcdcjklkrstsz{|{92f;9gl@A:nCAotHIBvKIw|PQJ~SQ
XYR[Y`aZcahibkipqb1h;=5l
j9pCE=t
rAxKME|
zISUM Q[]U'Yce]/akme7isum?q{}uGy}OW_
1:35h>6m9B;=pF>uAJCExNF}IRKMVNQZSU^VYb[]f^ad97;hj7@lA?Cpr?HtIGKxzGP|QOSOXYW[W`a_c_higkgpqosoxyw{w
5234ej>k=:;<mrFsEBCDuzN{MJKL}VURST^]Z[\febcd9dc;fg;<AlkCnoCDItsKvwKLQ|{S~
STY[[\accdikklqbcd77=?>jkl??EGFrstGGMONz{|OOUWVWW]_^__egfggmonoouwvww}
7e4886ii?m<@@>qqGuDHHFyyO}LPPNWTXXV_\``^gdhhf84fg85i<@<no@=qDHDvwHEyLPL~
PMTXTXU\`\`]dhdhel6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn3fe5i79@;nm=q?AHCvuEyGIPK~}MOQXSUWY`[]_ahcb1h8ehlij9p@mptqrAxHux|yzIP}QXY`ahipqxy
c293fi?
k:A;nqG
sBICvyO
{JQK~W RYS_'Za[g/bico7jqkw?rys
Gz{OW_
72:e6;7:?:Bm>C?BGBJuFKGJOJR}NSORWRZV[WZ_Zb^c_bgbjfkgcd6e4ghkkl>m<opsstFuDwx{{|N}L
VT^\fdnlvt~|
ef:egj68mnBmor>@uvJuwzFH}~R}
NPZVXb^`jfhrnpzvx~
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn73;9ig<@?;CAqoDHGCKIywLPOKSQ
TXWS[Y\`_[cadhgckil5:34igii=B;<qoqqEJCDywyyMRKL
UZST]b[\ejcd1bd;j;<<9jlCrCDDArtKzKLLIz|SSTTQ[[\\Yccdda6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn1ddg4;k79llo<Cs?AttwDK{GI||
LSOQT[WY\c_a72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn49ff4jl@<Ann<rtHDIvvDz|PLQ~~LXTYT`\a\hdi6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn1ddg4;k79llo<Cs?AttwDK{GI||
LSOQT[WY\c_a6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknc9:e;=g:kABmCEoBsIJuKMwJ{QR}SU
RYZ[]Zabcebijkmjqrsuryz{}z
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm253;6<6k:=;C>D>sBECKFLF{JMKSNTNRUS[V\VZ][c^d^be797g6<;@?A?o>DCHGIGwFLKPOQO
NTSXWYWV\[`_a_^dchgigflk72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn46g;6;?8<>oC>CG@DFwKFKOHLN
SNSWPTV[V[_X\^c^cg`dfk2:27=878:B:?E@?@BJBGMHGHJRJOUPOPRZRW]XWXZbZ_e`_`bjaedi=f8mimlqEn@uqutyMvH}y}|U~P]Xe`mhup}x8g;4=5gi@oC<E=oqHwKDMEwyP
X[T]U`c\e]hkdmecc4ej<;8kk<mrDC@ssDuzLKH{{L}TSPT\[X\dc`dlkhltspt|{x|
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknf3c688?@n;k>@@GHvCsFHHOP~K{NPPWXSVXX_`[^``ghcfhhopknppwxsvxx
5cd65>>@=kl>=FFHEstFENNPM{|NMVVXUVU^^`]^]ffhefe6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemma26hj8j:i:>pr@rBqBFxzHzJyJNPRRVXZZ^`bbfhjjnprrvxzz~
2e93j<8m:mA;rD@uBuICzLH}J}QKTPRYS\XZa[d`bd74iig68l?<qqo>@tGDyywFH|OL
NPWTVX_\^`gdfholnpwtvx
8c45i89<@k<=q@ADHsDEyHILP{LMPQTXTUXY\`\]`adhdehile429hhh:m<:ApppBuDBIxxxJ}LJQRTRYZ\Zabdbijljqrtryz|z
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikne4e99ggmm<mAAoouuDuIIww}}L}QQ
TYY\aadiilqqtyy|
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
d53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknc9:e;=g:kABmCEoBsIJuKMwJ{QR}SU
RYZ[]Zabcebijkmjqrsuryz{}z
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknc323ihg@k;:;qpoHsCBCyxwP{KJK
XSRS`[Z[hcbcpkjkxsrs{z{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn2379<6l=:;?AD>tEBCGILF|MJKOQTNURSWY\V]Z[_ad^ebc6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
@ I @ @ @ @ @ @ @
( n u l l )
( ( ( ( ( H
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 0 0 0 0 4 b 0
C o m m e n t s
C o m p a n y N a m e
F i l e D e s c r i p t i o n
F i l e V e r s i o n
6 . 0 . 1 5 0 . 3
I n t e r n a l N a m e
j u s c h e d
L e g a l C o p y r i g h t
C o p y r i g h t
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
j u s c h e d
P r i v a t e B u i l d
S u n M i c r o s y s t e m s , I n c .
P r o d u c t N a m e
J a v a ( T M ) P l a t f o r m S E 6 U 1 5
P r o d u c t V e r s i o n
6 . 0 . 1 5 0 . 3
S p e c i a l B u i l d
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.