Analysis
- max time kernel
298s - max time network
316s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 03:46
General
- Target resources/payload/ReShade_Setup_6.8.0_Addon.exe
- Size 4.1MB
- Sample260910-ebwbcswfjh
- SHA256 afe4c8f13048306307983b8b3d41d5bf00a86820440b0e57dea10950e1176445
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\resources\payload\ReShade_Setup_6.8.0_Addon.exe"C:\Users\Admin\AppData\Local\Temp\resources\payload\ReShade_Setup_6.8.0_Addon.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3148-0-0x0000024B916B0000-0x0000024B916DA000-memory.dmp
memory/3148-1-0x0000024BAC3C0000-0x0000024BAC3D0000-memory.dmp
memory/3148-2-0x0000024B91AB0000-0x0000024B91AB8000-memory.dmp
memory/3148-3-0x0000024BAC640000-0x0000024BAC678000-memory.dmp
memory/3148-4-0x0000024B91B10000-0x0000024B91B1E000-memory.dmp
memory/3148-6-0x0000024BAC3C0000-0x0000024BAC3D0000-memory.dmp
memory/3148-5-0x0000024BAC3C0000-0x0000024BAC3D0000-memory.dmp
memory/3148-7-0x0000024BAC3C0000-0x0000024BAC3D0000-memory.dmp
memory/3148-8-0x0000024BAC3C0000-0x0000024BAC3D0000-memory.dmp
memory/3148-9-0x0000024BABB30000-0x0000024BABC4F000-memory.dmp
memory/3148-10-0x0000024BAC170000-0x0000024BAC2BE000-memory.dmp
memory/3148-11-0x0000024BAC3C0000-0x0000024BAC3D0000-memory.dmp
memory/3148-12-0x0000024BAC3C0000-0x0000024BAC3D0000-memory.dmp