8cd2db8e1428b7f678a390570390da50f10e0f81871412fc2d9b68beae588d2b

Analysis

max time kernel
598s
max time network
424s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 22:54

Target
Dolphin-x64/Sys/GameSettings/G4AEE9.ps1
Size 189B
Sample260906-2vhwpsthjf
SHA256 8cd2db8e1428b7f678a390570390da50f10e0f81871412fc2d9b68beae588d2b
MD5 195503bf1e5eb88e2830b3be2c972255
SHA1 4876c49845a358e69c3914e0ae366246005a4739
SHA512 2b74db13728b2a730c9a441aeec74c8013086f8b10961669da600cd33548250f18c285c3fcdf469477866567ef3f754581ae3d1454b801eb0c290b5ab3c5cdf6
TLSH
T182C022439920200C700360074D9A8D834A348AF88B240DC028C63A0262FBAC0BFC5006
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

PowerShell

pid	Process
4716	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	powershell.exe
4716	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	powershell.exe

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

__PSScriptPolicyTest_xa0h0loj.ig3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xa0h0loj.ig3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH