sqpengg.com: a server handing out crypted PowerShell scripts, and what to do if one ran on your PC

What sqpengg.com is, and what we know about it

sqpengg.com is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists for six PowerShell script files, all reported on 30 September 2026 within about seven seconds of each other. The files carry names such as Crypted.ps1 and secured_stub.ps1. We found no public write-up of this address, so this page says what the reports show, what our own check found, what such files are usually used for according to MITRE ATT&CK and Microsoft, and what is still unknown.

1. 1

   What URLhaus lists

   Six file addresses on sqpengg.com, all under one long folder path, /vi1xwsm/trbhoun/wzyergu/, split into three subfolders called nn, vvv and cc. Every file ends in .ps1, the ending of a Windows PowerShell script. All six carry the threat label malware_download and the reporter abuse_ch.

2. 2

   Which file is still online

   When we read the data on 8 October 2026, one entry was marked online: crypted.ps1 in the nn folder. The other five, including Crypted.ps1 in vvv and cc, Cryptedt.ps1, secured_stub.ps1 and secured2_stub.ps1, were marked offline. Offline means the file did not answer at the last check, not that the server is clean.

3. 3

   What the tags say

   All six are tagged ascii, opendir, powershell and ps1. Ascii means the file is plain text. Opendir means the folder could be listed in a browser, an open directory, which is how many such files are found. The online file is also tagged expiro, the name of an old Windows file infector family.

4. 4

   What the names suggest

   Crypted and stub are words used for crypters: tools that wrap a malicious program in an encrypted shell so antivirus does not recognise it. A stub is the small piece that unpacks and starts the hidden program. That is our reading of the file names, not something URLhaus confirms about the contents.

Kind of threat

A server listed for malicious PowerShell scripts with crypter style names; one is tagged expiro

Where the files are

hxxps://sqpengg[.]com/vi1xwsm/trbhoun/wzyergu/ followed by nn/, vvv/ or cc/ and a .ps1 file name

URLhaus entries

6 file addresses, all added on 30 September 2026 between 15:03:12 and 15:03:19 UTC; 1 online, 5 offline when read on 8 October 2026

Domain registration

Not known: the public registration lookup (RDAP) returned no record to us on 8 October 2026

Our check

A plain request to the address from our server on 8 October 2026 timed out

Platform

Windows, where PowerShell is built in

What we checked on 8 October 2026, and what we could not

We did not open a browser on the site and we did not download any of the files.

In this setup our check is a plain request from our own server to the address, the same kind of request any program makes. It tells us whether the server answers, not what it serves to a victim.

What happened to sqpengg.com so far

The record is short.

Everything we know happened on one afternoon, and since then only the status of the files has changed.

1. Unknown

   The domain is registered

   RDAP returned no record to us, so the registration date is not known. We do not guess it.

2. 30 September 2026, 15:03 UTC

   Six PowerShell files are reported

   Within seven seconds abuse.ch adds six .ps1 files from three subfolders of the same path. That pattern fits a whole open folder being found and submitted at once.

3. By 8 October 2026

   Five files go offline

   Five of the six entries are marked offline. crypted.ps1 in the nn folder, the only one tagged expiro, is still marked online.

4. 8 October 2026

   Our check

   Our plain request to the address times out. We publish this guide with the reports as the main evidence.

What the pattern suggests, and what it does not: several versions of a file called Crypted in different folders, plus stubs with a version number, look like an operator testing or rotating builds. That is our reading of the names and dates, not a fact any report states.

What a crypted PowerShell stub does

To understand why a file called Crypted.ps1 matters, it helps to know two things that MITRE ATT&CK, the public knowledge base of attacker techniques, describes in detail: how attackers use PowerShell, and how they hide programs inside packers and crypters.

1. 1

   PowerShell is built into Windows

   MITRE calls PowerShell a powerful command line interface and scripting environment included in Windows. Attackers use it to discover things about a PC and to run code. It is a normal part of the system, which is why its use alone does not raise an alarm.

2. 2

   It can download and run code in memory

   MITRE notes that PowerShell can download and run programs from the internet, either from disk or in memory without touching disk. A script that never writes the real program to a file leaves less for a scanner to find.

3. 3

   A crypter changes how the program looks

   MITRE describes packing as compressing or encrypting an executable, with most unpacking happening in memory when it runs. It says this changes the file signature in an attempt to avoid signature based detection, and that attackers build custom packers that do not leave known traces.

4. 4

   The stub is the key

   A stub is the small unpacking part. In a file like secured_stub.ps1 the stub would hold the encrypted program as text and the few lines that decode and start it. The ascii tag on every file fits this: the whole thing is plain text that only becomes a program when PowerShell runs it.

MITRE lists antivirus with heuristic detection, signed script rules and application control among the defences. For a home user the practical point is simpler: the file on the server is not dangerous until something on your PC asks PowerShell to fetch and run it.

What the expiro tag means

The newest online file is tagged expiro.

Expiro is a long known family that Microsoft lists as Virus:Win32/Expiro, a virus in the strict sense: it changes other program files on the PC so that they carry its code too.

Why this matters for cleaning: a file infector does not sit in one place. If a virus of this kind ran, many program files can be changed, and deleting one file is not enough. That is why a full offline scan and, if in doubt, a reset of Windows are the safer path than hunting for single files by hand.

What a payload from a server like this can do

We do not know which program the stubs on sqpengg.com unpack.

Crypted PowerShell stubs are a delivery method, not a family, and the same method carries many different payloads. Based on the expiro tag and on what Microsoft and MITRE describe, these are the things that are possible if one ran.

What this can cost you

The risk depends entirely on whether something on your PC ran one of these scripts.

Seeing the name in a list costs you nothing; a script that ran can cost a lot.

• High

  Passwords and accounts

  An unknown payload may include a password or browser data stealer. Anything typed or saved on the PC while it ran should be treated as known to someone else.

• High

  A PC that is no longer yours

  Microsoft says Expiro can carry out actions of the attacker's choice. A PC that runs code chosen by someone else can be used to fetch more malware at any time.

• Medium

  Damaged program files

  A file infector changes executable files. After a clean up some programs may need to be reinstalled, and Windows itself may need a reset.

• Medium

  Other PCs on the network

  Infected program files copied to a shared folder or a USB drive can carry the virus to another PC. Scan removable drives before using them elsewhere, as the FTC advises.

• Low

  Only a name in a log

  If you saw sqpengg.com in a firewall, DNS or browser log and the request was blocked, nothing ran. Check the device anyway, because something asked for the address.

What you may notice, and what you may not

Crypted scripts are built to be quiet, so the most honest answer is that you may notice nothing at all.

These are the signs the sources do mention.

How a PC ends up asking for these files

A .ps1 file on a server does nothing by itself.

Something on the PC has to ask PowerShell to fetch it. We did not see the first step for sqpengg.com, but these are the usual ways the FTC and MITRE describe for scripts of this kind to start.

1. 1

   An attachment or a link in an email

   The FTC warns not to open attachments or click links in unexpected emails. A shortcut file, a script or a document that asks you to enable content can start PowerShell with one line that fetches the stub.

2. 2

   A fake download or a cracked program

   The FTC warns against downloading software from ads and against sites offering free films, music and games. Such downloads often carry a small first stage that later pulls a script like these.

3. 3

   A page that asks you to paste a command

   Some fake check pages tell visitors to press keys that paste and run a PowerShell command. Any page that asks you to run a command to prove you are human is an attack.

4. 4

   Malware already on the PC

   A first infection can fetch further stages. If your PC asked for sqpengg.com on its own, the question is what told it to, and that program must go too.

Check your PC before you delete anything

Work through these checks on the PC that asked for the address.

Write down what you find, with dates, before you remove it, so you know what ran and when.

If you find nothing, that does not prove the PC is clean. Crypted scripts are made to avoid signatures, so the offline scan below is still worth running.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A script that downloads further parts needs the connection.

2. 2

   Find which device asked

   If you came here from a router page, a DNS filter or a firewall alert, note the device name and the time. Only that device is in question.

3. 3

   Look at Protection history

   Open Windows Security and select Protection history. Look for detections that name a .ps1 file, PowerShell or Expiro, and note the file path.

4. 4

   Open Task Scheduler

   Press Start, type Task Scheduler and open it. In Task Scheduler Library look for tasks you do not know, with random names, or whose action starts powershell.exe with a long line of text.

5. 5

   Check startup apps

   Open Settings > Apps > Startup and switch off anything you do not recognise. Note its name first.

Run Microsoft Defender Offline

Because a file infector changes many files and a crypted script hides from signatures while Windows runs, scan from outside Windows.

Microsoft Defender Offline does exactly that: it restarts the PC and scans from the Windows Recovery Environment, without loading Windows.

1. 1

   Save your work

   Microsoft warns that the scan restarts the device, so save and close open files first.

2. 2

   Open the scan options

   Open Windows Security, select Virus & threat protection, and under Current threats select Scan options.

3. 3

   Start the offline scan

   Select Microsoft Defender Antivirus (offline scan) and start it. The PC restarts, scans, and restarts again by itself when it is done.

4. 4

   Read the result

   Back in Windows, open Windows Security > Protection history to see what was found and removed.

If the scan reports Expiro or many infected program files, Microsoft notes that remnant files and changes can stay. In that case a reset of Windows is the cleaner end point: Settings > System > Recovery > Reset this PC. Back up your documents first, but not programs, which may be infected.

If you use a Mac, an iPhone or an Android phone

PowerShell scripts and Expiro are Windows threats.

Nothing we read describes these files on other systems.