lnk file to try and scan it on a more secure platform (non-persistent, offline sandbox). Before I turned off the machine, I made a copy of the. Copying and pasting the target itself into a command prompt does not exhibit the same behavior as before. I kind of assumed it was supposed to run something *after* looking like it was launching WMP, but it just cuts off. So clearly it tried to run powershell and change the ExecutionPolicy to ByPass (it showed as Restricted after I looked at it, but it's possible it was changed back afterwards.), but what follows is an incorrectly terminated comment. Here is the Target:Ĭ:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -eXEc ByP ”c:\Program Files\Windows Media Player\wmplayer.exe” -run It turns out the file was a 1-ish GB shortcut (.lnk) that was disguised as a movie. She said a few windows popped up for a split second, then nothing. My issue here is that neither Defender nor MalwareBytes picked anything up.

Upon extracting and trying to launch the movie it ended up launching powershell instead. So my girlfriend learned about torrents from some idiots at work and thought it would be nice to download a movie for us.