e2a7d91c26967ab9cfff8cf0e01986127a21e8f940315732a1ee43c83c5c4f02

Analysis

max time kernel
150s
max time network
71s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 08:57

Target
mihomo-windows-amd64-compatible-go120.exe
Size 30.9MB
Sample260916-kwtk6ahm21
SHA256 e2a7d91c26967ab9cfff8cf0e01986127a21e8f940315732a1ee43c83c5c4f02
MD5 c38e8cb4b425f7b8851b3317ab1ff8c1
SHA1 357665ea192c3bee0efc0c0268f8cdbaf7caed5e
SHA512 8fafb48f595334a16afbf0ba758f3cb44c18da654aea8b85421945eac816b91f234b2ba888a85326615c637f6efbbe0dea6b7c659a64d0abae66400fdb479e55
SSDEEP 196608:99y180RBkg1nNGcSgg5cewj/L8X/4+MZ:99yLBkgrGh15gj/YX/y
TLSH
T135674A47F85150E4C5AED134C6659223BBB03C894B3463E72B61FAB82E73BD45BBA350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5608	mihomo-windows-amd64-compatible-go120.exe

C:\Users\Admin\AppData\Local\Temp\mihomo-windows-amd64-compatible-go120.exe
"C:\Users\Admin\AppData\Local\Temp\mihomo-windows-amd64-compatible-go120.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5608