Following The Payload

Name: Following The Payload
Uploaded: 2026-10-08T19:01:38.000Z
Description: This payload is getting a little more interesting as the different stages start connecting together. I follow the PowerShell activity through AppData, the Base64 payload that turns out to be a ZIP file, and the different URLs being used to pull down additional content.

John HammondOctober 8, 2026

Plays from YouTube in privacy-enhanced mode — nothing loads from YouTube until you press play.

This payload is getting a little more interesting as the different stages start connecting together. I follow the PowerShell activity through AppData, the Base64 payload that turns out to be a ZIP file, and the different URLs being used to pull down additional content. Watch the full video: https://youtu.be/oJHOlNTH7lY?si=8LruOkxZlfvFLII-

Description from John Hammond.

Watch on YouTube