14e4d392bed6b7a402de8c7b2fd1a52c3dfbb99171ff760ee3ec41267c8f9760

Analysis

max time kernel
899s
max time network
474s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:29

Target
dawnload.txt
Size 159B
Sample260804-tzljdsdf46
SHA256 14e4d392bed6b7a402de8c7b2fd1a52c3dfbb99171ff760ee3ec41267c8f9760
MD5 e18cad0c085e2fd83aa72d63abcd1727
SHA1 360ad38121395bf578694f8422656f11caeea180
SHA512 712a25d22c1c839dad2dfea49be251934b3fa8f02ac34c4cc52f4ee64190626a6bc65e432f1bbb1ec678dd2e79a4e87f89deab230113cf6e2ed0219f912a0a4d
TLSH
T146C08C97A4C061961AF9CD4B313A36BC7083840887808880AC12A911E20842639D5C18
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1060	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\dawnload.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2576

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5548