b27cfaa5bc416ee97203be056fec93ea8d24bb02ba48335f435f255f6212e1bf

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 22:13

Target
whitelist.txt
Size 11KB
Sample261107-15fnnags5p
SHA256 b27cfaa5bc416ee97203be056fec93ea8d24bb02ba48335f435f255f6212e1bf
MD5 f4e741bf40f4285e1b0c3bb2a57695d7
SHA1 13e5ab558e3737056de4efb418a3dede0ecf1a4f
SHA512 651396da169be99169202a1eb71939b816c175746aac8841c3281962af9edc46633c2af97639d11a3e952632d8a24abc03f1abcf53df0dee14aa96d7cf433378
SSDEEP 192:NwvRJSECh+DS6Mdv/fUHv3uN198qk1z6weMcfSYLzRPIok+41nT2Gkgfm4j:W5JSLUS6Mdv/fUHv+N8DczCoem4j
TLSH
T15532526441503226B7A71735F83CE9DA09AF81E88CF875D4CB29A9030CDBED47867E6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
4600	NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\whitelist.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1960