df0fcfba7ccb03bac0ccf6941f9cc512937fdc63035a2fedc78aa9a82c1d8af1

Analysis

user interaction
yes
max time kernel
12s
max time network
12s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/09/2026, 17:35

Target
powershell.exe.log
Size 2KB
Sample260924-v6c19sxerb
SHA256 df0fcfba7ccb03bac0ccf6941f9cc512937fdc63035a2fedc78aa9a82c1d8af1
MD5 e30544e6d048b2c1c6129c89835c16dd
SHA1 21d167ff64825d3f8a5c351c3160b670dc14cb60
SHA512 fcfc1e2b4110286dc8ede8caab34ea309e24fa6deb225213ab0e5b2d6499cc195e65dde2e125bca3ef5d5b5f4fdda66a1e4429cf2ea1c3df0ba92142342dfd9b
TLSH
T1F551CB3133B5A1E489167F4619681AC023BF8355F698AF187698521ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4880	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\powershell.exe.log
1⤵
- Opens file in notepad (likely ransom note)
PID:4880