A cmd running what seems to be PowerShell checking for a Registry value.
Looks like a base64 string.
Maybe get an AV that can check for odd registry values. Look into task manager, check if there's cmd running in the background or PowerShell. Check if there's a service running that's odd or out of ordinary.
TL;DR: You most likely have a stager malware running in the background. The Base64 block contains an obfuscated PowerShell script (evident from standard signatures like JAB / SQB), which is attempting to set up persistence in your registry.
The registry path makes the intent fairly clear, even if some details remain unconfirmed. In fileless malware attacks, HKCU\Environment is routinely abused for persistence and payload storage. Attackers often write obfuscated scripts here or hijack environment values (such as UserInitMprLogonScript) so that Windows automatically executes the payload upon logon without dropping an obvious .exe onto disk.
I tried upscaling your screenshot and had an AI model reconstruct the distorted characters to see if we could decode it. While I managed to identify standard PowerShell structures like variable initializations and common flags (such as -Force and -ErrorAction), the full payload couldn't be reliably decoded this way. Because PowerShell encodes commands in UTF-16LE before Base64, guessing characters is tricky-a single hallucinated or misread character completely corrupts the byte alignment.
It strongly looks like a stager getting ready to pull or execute a secondary stage. If you want a definitive analysis of what it's trying to do, please copy and paste the raw text from the console or share a much higher-resolution screenshot (though pasting the actual text is definitely preferred). In the meantime, I’d strongly recommend checking that HKCU\Environment registry key for any newly created or suspicious values.
I wish I could copy and paste it. but it appeared for a short whilw before it closed it self. The screenshot was all I could get before it closed it self
Ollama is software for hosting and running AI models locally on your PC. If you didn't install it yourself, that's definitely a red flag. I don't know purpose of ollama in this malware.
As for ajbjxg.dll, it might have already been deleted or quarantined by your antivirus. The beyond_citadel folder was likely created by the malware itself to blend in, or it came from an infected game, even Steam has had malicious titles slip through occasionally.
I took a preliminary look at this, and based on that Base64 code, you definitely have malware on your system. The script acts as a loader that quietly downloads an encrypted file from an external server using a built-in tool, and then decrypts it right onto your computer.
Once the file is ready, it uses a clever trick with a normal Windows program to load the bad code into memory without raising alarms. It also sets up persistence so it stays on your machine, and then it cleans up its temporary registry tracks to hide its traces. It is activated and running, better change your passwords (mostly to your GOVs and Mails)
Make sure to do a full format and wipe everything during the reinstall. In very rare cases, malware can even persist in the UEFI/BIOS, so it's good to keep that in mind.
Keeps hackers from doing anything more on your system. Usually it’s password stealers in which case the damage is done within seconds of it running but depending on the malware it might setup a backdoor into your device. Disconnecting it from internet keeps them from using that backdoor to do or steal anything else
Try opening powershell.exe, pwsh.exe, and cmd.exe separately. In each window, press the Up arrow key-this might pull up the last command executed from your history, which would confirm exactly what triggered that script to run.
Ok, so from what i decoded from the b64 via ocr, its a malware/payload.
That looks like a PowerShell script encoded in Base64. It changes some Windows registry settings, removes a scheduled task, and then uses a Windows program to trigger the modified setting. The specific registry entry is commonly associated with a technique called COM hijacking, where malware can make Windows load a malicious file instead of the normal one
this isnt the full thing so it may have done other things first,
try backup all your files, run a full AV sweep and if ur paranoid do a clean reinstall of windows?
Im planning on doing a full reinstall of windows only problem is I have some abandonware on my pc that I never bothered to put out. Now im conserned it's also hacked(?)
Hello, I am Roman and I will be helping you today. During the malware removal process, please follow the rules listed below to ensure everything goes as fast and smooth as possible:
Please make sure to read this whole introduction message so you understand the further steps.
If you are thinking about resetting or reinstalling your device, you can do it instead of the steps listed below. We are doing the malware removal process to disinfect your device so you can avoid reinstalling. If we go through the removal process and you decide to reinstall after, you would waste my time and your own time by doing these steps.
Avoid installing, downloading new software unless instructed - this also applies to antivirus software and scanners.
You are free to remind me that I forgot to reply to you if you do not receive an answer within 24 hours. Keep in mind that I am volunteering here and I am a full time student with a job.
Please do not follow other malware removal advice; you should be following steps only from 1 person unless told otherwise. If you have opened any other forum posts elsewhere, please let me or them know where do you want to continue.
Please follow all steps from step 1 to the last step, not the other way.
Only trusted malware removal experts listed in this r/computerviruses thread and other large malware removal forums (BleepingComputer, Malwarebytes, MalwareTips) have access to your logs via the website.
Please take your time to follow the steps properly.
You can ask any questions during the malware removal process.
We do not condone nor support piracy in any shape or form. Any discussion topics that ask for help with pirating software, circumventing copy protection, or any other illegal activities related to copy righted content in any form will be closed and locked.
As a reminder, using pirated software or utilities that allows one to pirate software (e.g. cracks, key generators, registration/license removal, redirection, or workaround utilities, etc.) is not a safe practice and can lead to malware infection, ransomware attack, or even legal action. Because of these risks, we always recommend that you remove any pirated software or pirating utilities before asking for support on our subreddit in order to improve our ability to best support you and to help protect yourself and your data from malware or other piracy related consequences.
We cannot guarantee a clean system when there is illegal software, riskware or grayware present. Please read Grayware.
[ Step 02 ] IMPORTANT: Restore point
Before any sort of removal, we need to make sure you have a restore point that you can revert to in case you face any sort of issues. This is absolutely necessary so please do not skip this step. Certain changes done by the removal process can not be properly reverted without a restore point.
There were prior cases (very rare, I had 2 failing to boot out of ~350) of a system failing to boot after FRST fix.
Enable system restore
Click Start or open Windows Search.
Search for Create a restore point and open System Properties.
In the System Properties window, go to the System Protection tab.
If the 'system' drive (usually C:\ drive) protection is turned on, System Restore is already enabled on your computer. If the 'system' drive protection is off, go to point 5.
Click Configure.
Select Turn on system protection
Click Apply.
Click OK to confirm.
Create a system restore checkpoint
Click Start or open Windows Search.
Search for Create a restore point and open System Properties.
In the System Properties window, go to the System Protection tab.
Click Create.
Call the restore checkpoint "FRST restore point" exactly please, so I can search it up fast and verify it is created properly in your logs
Click Create.
Click Close.
Click OK.
You should get a popup that it was successfully created and I will also verify that it was properly created with the results of scans from next steps.
[ Step 03 ] Farbar Recovery Scan Tool (FRST)
FRST is a malware diagnostics tool that will list all entries that are popular and could contain traces/mentions of malware, such as start up entries, services, scheduled tasks and many more.
FRST does not contain any personal information other than your username and computer name, there is no other sensitive information disclosed.
IMPORTANT: If your Windows operating system is in other language than English, please save the FRST executable file with the filename FRSTEnglish.exe to ensure that the logs are in English so I can understand them.
Please download FRSTx64 and save the file to your Desktop as FRSTEnglish.exe.
Right-Click FRSTEnglish.exe and select Run as Administrator
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the program run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy & paste the contents of each log to https://malwareanalysis.cc/upload/rifteyy and press "save log".
Note: Please make sure you are uploading the logs after your current Reddit username.
The site will return a keyword for each log - reply back here with the keywords.
[ Step 04 ] SecurityCheck scan
SecurityCheck allows me to gather a list of unwanted, risky, vulnerable and out-of-date applications. It also allows me to send you a direct link to an update. An unpatched system is more vulnerable to malware.
The site will return a keyword for the log - reply back here with the keyword.
So, in your next reply (please try to send them all in 1 message), make sure you are sending the following:
Keyword for FRST.txt
Keyword for Addition.txt
Keyword for SecurityCheck.txt
Thanks!
Note*: If anyone else who is facing malware-related issues is reading this and wants help with* FRSTandSecurityCheck*, please create your own thread with the keywords sent to the general channel. I am flooded with requests and there is several other removal experts who review the logs and may reply faster than me.*
Right ok, you mentioned the game seemingly arbitrarily then. Do the basics. Run a scan with defender, then malwarebytes, then check processes with autoruns from sysinternals and look for powershell scripts
These can’t be malware as they have too many reviews/players and attackers usually use stolen, asset flip games plus they make the game free to spread it out easier.
65
u/Some0ne_Good Aug 14 '26
A cmd running what seems to be PowerShell checking for a Registry value. Looks like a base64 string.
Maybe get an AV that can check for odd registry values. Look into task manager, check if there's cmd running in the background or PowerShell. Check if there's a service running that's odd or out of ordinary.