indicatorurl
hxxps://drive[.]google[[.]]com/uc?id=1TVJir-OlNZrLjm5FyBMk_hDjG9BV1zCy&export=download
- First seen
- 2026-05-14
- Last seen
- 2026-05-14
- Sightings
- 1
Posts referencing this indicator
- In-Memory Loader Drops ScreenConnect | ThreatLabz
Google Drive URL used by PowerShell to download the C# source code payload (FileR.txt).