78e3ea522d82c6c4a20a2a0c9cf44ddb3b87f609310c58efd036233fec616ca2

Analysis

max time kernel
899s
max time network
463s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 22:38

Target
R2R/R2R.txt
Size 775B
Sample261022-2ksyxsys9k
SHA256 78e3ea522d82c6c4a20a2a0c9cf44ddb3b87f609310c58efd036233fec616ca2
MD5 6d6df4ad48cc28b94d8c6aeda45a176d
SHA1 81d948c05d7ea722fc6f02de4e2a4c49e908107a
SHA512 6ff2a9e9e6deb9f7e98d34f234a9e552650997cc737122e2ba5eaf0eb9d694abf435ae0e290553788b4c3d77324726e9db0b07c8a2854edd3b07302d64438e01
TLSH
T10D01BDA2B10B43A614E043D76E1EA1D5B709D42858607D89F8AC912E238B887E767D7B
MD5 SHA1 SHA512 TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1720	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\R2R\R2R.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5588

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3984