288a6d8938045fc8936972219c4f281f851973bf600b77adff0a5b1789f059d7

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
599s
max time network
461s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:52

Target
DoxTool.rar
Size 71.5MB
Sample260819-ee75bswdmf
SHA256 288a6d8938045fc8936972219c4f281f851973bf600b77adff0a5b1789f059d7
MD5 10c4778478e680416060fa25eb428148
SHA1 751a0d06899dd7ba7113caea2cf9497b6abd06fe
SHA512 f047daae222aa33e60aa4c49fc8b9877127976b1280f08e844d0077911bd89184918b48ed1984a63d4708419e147371790136574581e2fac8e7c3ab587e7073d
SSDEEP 1572864:P9eyHsfT6qdJPlLpuL+Rd6Muf5+HniWKnEms4kAy3uwiCPCCppydJf:PeLjYSRsMGAH/2sPtCCpUdJf
TLSH
T189F7339C315A4156C622223EFF6109DFC26B749FDF8E1DFD131C6299E4A8FB01D18A86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2836	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2836	7zFM.exe
Token: 35	2836	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	7zFM.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6108