e2a6a116f24e2a75db955c8eccc1dbaaaf51ba706209177127687b994155b37d

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 15:03

Target
EcMenu_v1.6/Files/Items.ini
Size 37KB
Sample260508-sfbdmsdy9p
SHA256 e2a6a116f24e2a75db955c8eccc1dbaaaf51ba706209177127687b994155b37d
MD5 83708d26f6beaa3d0b358ce286841e28
SHA1 4c8794197423bcfd54b714049131a3c3bb4dd518
SHA512 772705abee5a387388966cb6cc8327196f8ba0660c54d9a49848b854af002630104044d6b6fb20d744aa59d40a3d84c5e84fdecbd04ae5535d2244cc9e4a02d1
SSDEEP 96:nk1HaH16Jkve/Ve3jH2JI1H2wvE5H2nOvOH2JI8H2wOE7H2nOvziZH2vH2mS4VTX:PMET7EQf5E6HA0PjDUqosx8UKQpNy
TLSH
T164036B02BBFD0114B7B38B91AFB9E1345A3BFC325D2AC59D91D09A8D14E1D109922BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4428	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\EcMenu_v1.6\Files\Items.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:4428