4f82ec5b3faa802483723cfae74c1bc640f6b244ea038abd82d0aa82fb842bfd

Analysis

user interaction
yes
max time kernel
12s
max time network
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 22:17

Target
Sandustry/resources/app.asar.unpacked/node_modules/steamworks.js/dist/win64/steam_settings/steam_appid.txt
Size 8B
Sample260819-17dbbavbpc
SHA256 4f82ec5b3faa802483723cfae74c1bc640f6b244ea038abd82d0aa82fb842bfd
MD5 471ffa7c4754a04939a41f0d46a12273
SHA1 d554763e11d9f2338afd2161b102625528168051
SHA512 1006d17c99911066489e397ebfb38222a6d1131d5eb9e99dc80f60a48f4fd30a3b2dec4525e066a57fe22ce0b7098eede7bba286c65029b2566a3a1ad0a19a05
MD5 SHA1 SHA512

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
2064	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Sandustry\resources\app.asar.unpacked\node_modules\steamworks.js\dist\win64\steam_settings\steam_appid.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2064