de40502ec5b17036df15245a3b00635b32ff2e15ce91ec376d8fb769d07f7140

Resubmissions

02/08/2026, 03:12

02/08/2026, 03:10

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:10

Target
MainPowershell.txt
Size 636B
Sample260802-dn1k6sssg1
SHA256 de40502ec5b17036df15245a3b00635b32ff2e15ce91ec376d8fb769d07f7140
MD5 7808258b1fabeaf47d23f3ec0b177eb1
SHA1 cacb746b81ea6bce9c507ed995e573cac2d9f07d
SHA512 a9258f8e1b67264aacef70785af854103ef36697cdd1c03c0560123b293d4f77db7da755b6e07a82718b9e1e5ede463299ecee6831f1aa5c5ab9dece620de185
TLSH
T1D4F07D288E74DDC4879DB79188A13F5709BD281697789540EE340C697C16BC1D72A5D8
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4964	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\MainPowershell.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4964