7b52be2cd7f3d6039b315b6a2a0ef7422bcd6b2f06dae210d377f743afa4e989

Analysis

max time kernel
899s
max time network
464s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 20:33

Target
Guns.lol viewbot/Guns.lol viewbot/readme.txt
Size 305B
Sample260905-zcbcsshq7v
SHA256 7b52be2cd7f3d6039b315b6a2a0ef7422bcd6b2f06dae210d377f743afa4e989
MD5 14a10ad17bdffc90b4ac0e95e9120953
SHA1 f89b83f7b445a86757fa75e12bd791720ade1e5a
SHA512 ceb4c45dc5e66741ebfc93b5c18902575d2e9115cd8eb194ba1b6552e55ca34b4db4ddad11bcc333ec0225b185618088ef6f51cd9aa14d84bdd07e991407a047
TLSH
T1F2E02B386C88E37B02A88AA3764838C6F3C4702CC6704781845162392677F2885BE58D
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4516	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Guns.lol viewbot\Guns.lol viewbot\readme.txt"
1⤵
- Opens file in notepad (likely ransom note)
PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4340

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5840