41451f373f6ecb69a7ca5281865c68bf47d658f6838c0c1fcf93f7f45d1c1f4d

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 06:39

Target
YOUR_FILES_ARE_ENCRYPTED.txt
Size 287B
Sample260429-he3rdsc16r
SHA256 41451f373f6ecb69a7ca5281865c68bf47d658f6838c0c1fcf93f7f45d1c1f4d
MD5 a01d7ae71b04d6e09229ee3c6b0442d1
SHA1 94da95117416f476918612be84b6d5ff250b2131
SHA512 324c4c548a6e240cb115727a20d1cc7205169b97015f075330441ae82c397395572cedc094209ad6610ba7ffc36f6f3e31cd2bf474f60668cc14c87a94008345
TLSH
T12ED07D1B36459ADD42A829D1BF0DF440F218711DDA79D842588468101AE9496C8C0034
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4872	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\YOUR_FILES_ARE_ENCRYPTED.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4872