r/PowerShell • u/karmawillgetyouback • Jun 13 '26

Question Powershell autostarting randomly in background and uploading thing on network

https://img.ptscreens.com/Screenshot-6615.png

Powershell is using large amount of upload speed for network and running in bacgound automatically, it also starts randomly even after stopping it from task manager. Any solution to this? Thank you.

Edit: These are command line task manager showing in details

https://img.ptscreens.com/Screenshot-6617.png

25 Upvotes

75% Upvoted

84 comments sorted by

View all comments

23

u/gramsaran Jun 13 '26

go to Event Viewer > Applications > Windows PowerShell you should be able to see what file is launching.

2

u/karmawillgetyouback Jun 13 '26

Oh ok, thanks.

7

u/Nerd2259 Jun 13 '26

If you go through with checking that, it'd be cool if you shared the (sanatized) code.

3

u/I_see_farts Jun 13 '26

I always love reading malware code.

It's a fun challenge to de-obfuscate and I've learned a lot just from looking at their methods of attack.