4d6b358c981bcbdaf468263ee8a54ed31cc9ac478624f72ff7e46ffeb0499a1d

Analysis

user interaction
yes
max time kernel
1048s
max time network
550s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 02:58

Target
link.txt
Size 381B
Sample260731-dgf8ysself
SHA256 4d6b358c981bcbdaf468263ee8a54ed31cc9ac478624f72ff7e46ffeb0499a1d
MD5 87c9de441c9abc776ff6c538a5922749
SHA1 98b56da67ec244027cd4d69e00b501bcbe9ead36
SHA512 b4e016ac248ae543b6c4e25cde311e1162dc20a4399bac4b1caf4b7ca59b3db768fa0a80e804f711616adb7ca02e660593a6ba3301bfca28dd973551a19d3d9d
TLSH
T186E068FBE40A48C2620F8FCC3A8176EEC2250608F1DA5A01A020D728A445B673983E0F
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4360	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\link.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5156

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1876