30c33f9c70a26d35403ad5a5f8cf10ca0c75ee5656b0dfeed0e9bad4fd1241b9

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 09:11

Target
CheatMenuConfigs/InventoryEditor_IDs.txt
Size 883B
Sample260925-k5tbracg79
SHA256 30c33f9c70a26d35403ad5a5f8cf10ca0c75ee5656b0dfeed0e9bad4fd1241b9
MD5 f5958e3b0a3b39ee77f588cbfc64bc27
SHA1 bdc81bc64d807ff8040c63805e3a53ff7edff454
SHA512 88f2fc64b5259b940c2f6822f7168a9ddd98af0314f8b43d3558b1d4f6aad55afafdb3d0ceafbe68f8b21f0728bea08ccacb0d270da709c830a8e2d7790d2da0
TLSH
T1C11150C824DCE0873731613FAB1077226E387C66DE7255A6B21464A9F62049A6E96BC4
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4896	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\CheatMenuConfigs\InventoryEditor_IDs.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4732