Click to jump to signature section
| Source: download.ps1 | Virustotal: Detection: 15% | Perma Link |
| Source: Submited Sample | Integrated Neural Analysis Model: Matched 90.4% probability |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbF source: powershell.exe, 00000000.00000002.1797817107.0000022F3B098000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1797817107.0000022F3B109000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: softy.pdbps1 source: powershell.exe, 00000000.00000002.1797817107.0000022F3B098000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000000.00000002.1798952484.0000022F3B141000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1798862238.0000022F3B130000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: System.Management.Automation.pdb-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 source: powershell.exe, 00000000.00000002.1796663905.0000022F3AFFA000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1797817107.0000022F3B098000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 00000000.00000002.1797817107.0000022F3B098000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1795254706.0000022F3A8D4000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb3 source: powershell.exe, 00000000.00000002.1797817107.0000022F3B098000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\mscorlib.pdbOWD1 source: powershell.exe, 00000000.00000002.1797817107.0000022F3B098000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: Microsoft.PowerShell.Commands.Utility.pdb9-00C04FB68820}\InprocServer32H source: powershell.exe, 00000000.00000002.1796663905.0000022F3AFFA000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: mscorlib.pdbpdblib.pdb source: powershell.exe, 00000000.00000002.1796663905.0000022F3AF5D000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbf source: powershell.exe, 00000000.00000002.1797817107.0000022F3B066000.00000004.00000020.00020000.00000000.sdmp |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | File opened: C:\Users\user\AppData\Roaming | Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini | Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | File opened: C:\Users\user | Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | File opened: C:\Users\user\AppData\Roaming\Microsoft | Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | File opened: C:\Users\user\AppData | Jump to behavior |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows | Jump to behavior |
| Source: Network traffic | Suricata IDS: 2859488 - Severity 1 - ETPRO MALWARE TA582 Domain in DNS Lookup : 192.168.2.4:61736 -> 1.1.1.1:53 |
| Source: Network traffic | Suricata IDS: 2057741 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49730 -> 45.61.136.138:80 |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | HTTP traffic: GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.google.com Connection: Keep-Alive |
| Source: Joe Sandbox View | IP Address: 45.61.136.138 45.61.136.138 |
| Source: Joe Sandbox View | ASN Name: AS40676US AS40676US |
| Source: Network traffic | Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49731 -> 142.250.185.164:80 |
| Source: Network traffic | Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 45.61.136.138:80 |
| Source: global traffic | HTTP traffic detected: GET /trzyoqslw6htr.php?id=user-PC&key=43809224344&s=527 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kcehmenjdibnmni.topConnection: Keep-Alive |
| Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.google.comConnection: Keep-Alive |
| Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
| Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
| Source: global traffic | HTTP traffic detected: GET /trzyoqslw6htr.php?id=user-PC&key=43809224344&s=527 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kcehmenjdibnmni.topConnection: Keep-Alive |
| Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.google.comConnection: Keep-Alive |
| Source: powershell.exe, 00000000.00000002.1757938142.0000022F24643000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: *href=https://www.youtube.com/?tab=w1><spanX equals www.youtube.com (Youtube) |
| Source: powershell.exe, 00000000.00000002.1757938142.0000022F23F6E000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: else top.location='/doodles/';};})();</script><input value="AL9hbdgAAAAAZ3pGV6J5npDcmMyd9T3ewsWsQ-wLOq3z" name="iflsig" type="hidden"></span></span></td><td class="fl sblc" align="left" nowrap="" width="25%"><a href="/advanced_search?hl=en&authuser=0">Advanced search</a></td></tr></table><input id="gbv" name="gbv" type="hidden" value="1"><script nonce="id1cOR58uDo3nXmvhgL8Qw">(function(){var a,b="1";if(document&&document.getElementById)if(typeof XMLHttpRequest!="undefined")b="2";else if(typeof ActiveXObject!="undefined"){var c,d,e=["MSXML2.XMLHTTP.6.0","MSXML2.XMLHTTP.3.0","MSXML2.XMLHTTP","Microsoft.XMLHTTP"];for(c=0;d=e[c++];)try{new ActiveXObject(d),b="2"}catch(h){}}a=b;if(a=="2"&&location.search.indexOf("&gbv=2")==-1){var f=google.gbvu,g=document.getElementById("gbv");g&&(g.value=a);f&&window.setTimeout(function(){location.href=f},0)};}).call(this);</script></form><div style="font-size:83%;min-height:3.5em"><br><div id="K7FuCf"><style>.U8K5Lc{font-size:small;margin-bottom:32px}.U8K5Lc a.qDTOof{display:inline-block;text-decoration:none}.U8K5Lc img{border:none;margin-right:5px;vertical-align:middle}</style><div class="U8K5Lc" data-ved="0ahUKEwjCyo_qit6KAxXngP0HHR_3FLQQnIcBCAU"><img alt="" height="32" src="https://www.google.com/images/hpp/YT_RedPlayButton_Icon_48x48.png" width="32"><span>Score one final special offer for </span><a href="https://www.google.com/url?q=https://tv.youtube.com/learn/nflsundayticket/%3Futm_campaign%3Dytnflst_jan25_nflst_w18_hpp_q1_2025%26utm_source%3Dhpp%26utm_medium%3Dgoogle%26utm_content%3Dcpy1&source=hpp&id=19046161&ct=3&usg=AOvVaw0o2kBUsvWMu1ycqjGPCIBX&sa=X&ved=0ahUKEwjCyo_qit6KAxXngP0HHR_3FLQQ8IcBCAY" rel="nofollow">NFL Sunday Ticket</a></div></div></div><span id="footer"><div style="font-size:10pt"><div style="margin:19px auto;text-align:center" id="WqQANb"><a href="/intl/en/ads/">Advertising</a><a href="/services/">Business Solutions</a><a href="/intl/en/about.html">About Google</a></div></div><p style="font-size:8pt;color:#70757a">© 2025 - <a href="/intl/en/policies/privacy/">Privacy</a> - <a href="/intl/en/policies/terms/">Terms</a></p></span></center><script nonce="id1cOR58uDo3nXmvhgL8Qw">(function(){window.google.cdo={height:757,width:1440};(function(){var a=window.innerWidth,b=window.innerHeight;if(!a||!b){var c=window.document,d=c.compatMode=="CSS1Compat"?c.documentElement:c.body;a=d.clientWidth;b=d.clientHeight}if(a&&b&&(a!=google.cdo.width|| |
Edit tour
powershell.exe (PID: 7356 cmdline: 
conhost.exe (PID: 7364 cmdline: 
