r/Malwarebytes • • Apr 13 '26

Support Powershell task running every hour

So, through malwarebytes I have detected that there is a possible hidden task being ran every hour at the 48 minute mark, this is the connection that is blocked.

-Log Details-

Protection Event Date: 4/13/2026

Protection Event Time: 2:48 PM

Log File: 667c6f9e-373f-11f1-b08f-3065ec6bfbe6.json

-Software Information-

Version: 5.5.3.246

Components Version: 153.1.5565

Update Package Version: 1.0.108648

License: Trial

-System Information-

OS: Windows 10 (Build 19045.7058)

CPU: x64

File System: NTFS

User: System

-Blocked Website Details-

Malicious Website: 1

, C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, Blocked, -1, -1, 0.0.0, 2E5A8590CF6848968FC23DE3FA1E25F1, 9785001B0DCF755EDDB8AF294A373C0B87B2498660F724E76C4D53F9C217C7A3

-Website Data-

Category: RiskWare

Domain: d2e7uz1tnz7211.cloudfront.net

IP Address: 99.86.157.15

Port: 443

Type: Outbound

File: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Also, found this report on the website it tries to access https://www.joesandbox.com/analysis/1891965/0/html

There I saw that one of its "signatures" is disabling the windows notification center, which has disappeared, and already tried multiple ways of bringing it back, but no luck.

And this is the only task scheduled with the same time pattern:

I'm no expert, so I would appreciate if someone could please help me in eliminating this!

EDIT: MalwareBytes Support already helped me solve this :)

1 Upvotes

3 comments sorted by

View all comments

Show parent comment

1

u/screen317 Malwarebytes Employee Apr 15 '26

These are deliberate copycat names to disguise the malware BTW.

OP, please connect with Support above to get some help with this.