80a58cd747090b3f559e9f3c2c2be1922cb77e3d36053e7b83420119aebf2edf

Analysis

max time kernel
900s
max time network
449s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 12:15

Target
info_winlock.txt
Size 876B
Sample260719-pevjcaax8n
SHA256 80a58cd747090b3f559e9f3c2c2be1922cb77e3d36053e7b83420119aebf2edf
MD5 d28009ac35ff3b4492f56da23770effd
SHA1 bac6ed231e0e099c32ff95e23e2abface5c3b634
SHA512 f19dda13b9994e7a24beea5b96dd309d64bae7b6dea80e2a662eb02e1f0d7b5653174eee6b09b694d42be85f2648d000bdd143c39b496b7abbc72df298b1cdc6
TLSH
T17B1149716CDB677E0710B4AB0C0A344DE7D348BE0ABB4352BABC5564677A03583798DA
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4432	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\info_winlock.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2292

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1724