Analysis
- user interaction
yes - max time kernel
205s - max time network
476s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 03:03
General
- Target http://mumuplayer
- Sample260511-dkc1psdz2r
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 3 IoCs
- Launches sc.exe 51 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of FindShellTrayWindow 53 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mumuplayer1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff8d7dc188,0x7fff8d7dc194,0x7fff8d7dc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,1379794076567150026,2860705605494709074,262144 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,13246834039235501462,12866101220310456069,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,12966947602310387624,16812543172748362559,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,50065766189147991,16595083595668770351,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,125928462941429000,16763902640692526280,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,14611772142631059252,17835311206644526829,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,12742502460743066126,5306582967782938470,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,6055369544856935669,1690272848406256638,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,7936607865213668129,14714313493777766370,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5284,i,1340293269464515454,790253078236575851,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,9112317655310246748,15340727716625326631,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,17884486116980926081,3678502070823600628,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,13101405701825642776,15922004646720397382,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,13101405701825642776,15922004646720397382,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6080,i,1311879331350956729,4534450017646221674,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,162779951411221806,27556033027786938,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,3844210517842920163,9957354686559830739,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,17688620345641225106,13785502540108339843,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,15035550822654311207,6672507936931499137,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,12544354843213327904,11713105745214103176,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5288,i,12324674001206493808,2625097479244906219,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7104,i,11135375703490022904,2526293201226451346,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4448,i,1687548999287958085,10069498298971955200,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6008,i,10174938093171002596,4996198433953755385,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5312,i,7994536796886856335,8435161106010192486,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,8944302595373451355,15693867195085747740,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6544,i,1688034830282548551,14234178919790289769,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,18296198220399804183,11541262851636414432,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,7868625426752921909,4205293078394659690,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,15950706522155761491,1168151440039601782,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,7027159652041032792,7979704938299539590,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=3428,i,12067099003996621401,5012105286825084272,2097152 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2944,i,17752645156085804494,5621812255598858336,524288 --field-trial-handle=2272,i,8477939625262065980,13769248253195974706,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\MuMu_5.0.11_KJ3pkeC.exe"C:\Users\Admin\Downloads\MuMu_5.0.11_KJ3pkeC.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\nemu-downloader.exeC:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\nemu-downloader.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\ColaBoxChecker.exe"C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\ColaBoxChecker.exe" checker /baseboard3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\HyperVChecker.exe"C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\HyperVChecker.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\HyperVChecker.exe"C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\HyperVChecker.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\HyperVChecker.exe"C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\HyperVChecker.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\MuMuDownloader.exe"C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\MuMuDownloader.exe" --log="C:\Users\Admin\AppData\Local\Temp\nemu-downloader-aria.log" --log-level=notice --check-certificate=false --enable-rpc=true --rpc-listen-port=51814 --continue --max-concurrent-downloads=10 --max-connection-per-server=5 --async-dns=false --file-allocation=trunc --enable-mmap=true --connect-timeout=5 --rpc-max-request-size=1024M --rpc-secret=MuMuDownloader1,778,468,696 --stop-with-process=37043⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\MuMu-setup-V5.25.3.3439-overseas-0423001125.exe"C:\Users\Admin\AppData\Local\Temp\MuMu-setup-V5.25.3.3439-overseas-0423001125.exe" /gv=2 /S /auto_start=false /fchannel=gw-download-win /D=C:\Program Files\Netease\MuMuPlayer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMNetLwf4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /UnregServer4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
-
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /RegServer4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
- Modifies registry class
-
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
- Executes dropped EXE
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPInstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPInstall.exe"4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create MuMuVMMDrv binPath= "C:\Program Files\MuMuVMMVbox\LoadedDrivers\MuMuVMMDrv.sys" type= kernel start= auto4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create MuMuVMMDrv binPath= "C:\Program Files\MuMuVMMVbox\LoadedDrivers\MuMuVMMDrv.sys" type= kernel start= auto4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"4⤵
- Executes dropped EXE
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
- Executes dropped EXE
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /UnregServer4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "comregister.cmd -u"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exeNET FILE5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 FILE6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /UnregServer5⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\x86\MuMuVMMClient-x86.dll"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\x86\MuMuVMMProxyStub-x86.dll"5⤵
-
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\MuMu-setup-V5.25.3.3439-overseas-0423001125.exe"C:\Users\Admin\AppData\Local\Temp\MuMu-setup-V5.25.3.3439-overseas-0423001125.exe" /gv=2 /S /auto_start=false /fchannel=gw-download-win /D=C:\Program Files\Netease\MuMuPlayer3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMNetLwf4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /UnregServer4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
-
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /RegServer4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
-
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPInstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPInstall.exe"4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create MuMuVMMDrv binPath= "C:\Program Files\MuMuVMMVbox\LoadedDrivers\MuMuVMMDrv.sys" type= kernel start= auto4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create MuMuVMMDrv binPath= "C:\Program Files\MuMuVMMVbox\LoadedDrivers\MuMuVMMDrv.sys" type= kernel start= auto4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /UnregServer4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "comregister.cmd -u"4⤵
-
C:\Windows\SysWOW64\net.exeNET FILE5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 FILE6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /UnregServer5⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\x86\MuMuVMMClient-x86.dll"5⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
-
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\x86\MuMuVMMProxyStub-x86.dll"5⤵
-
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\7z.exe"C:\Users\Admin\AppData\Local\Temp\7z8BAC87B0\7z.exe" a -tzip "C:\Users\Admin\AppData\Local\Temp\nemux.zip" "C:\Users\Admin\AppData\Local\Temp\nemux"3⤵
-
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\MuMuVMMDrv.sys"C:\Program Files\MuMuVMMVbox\LoadedDrivers\MuMuVMMDrv.sys"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Users\Admin\Downloads\MuMu_5.0.11_KJ3pkeC.exe"C:\Users\Admin\Downloads\MuMu_5.0.11_KJ3pkeC.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zC9311390\nemu-downloader.exeC:\Users\Admin\AppData\Local\Temp\7zC9311390\nemu-downloader.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zC9311390\ColaBoxChecker.exe"C:\Users\Admin\AppData\Local\Temp\7zC9311390\ColaBoxChecker.exe" checker /baseboard3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zC9311390\HyperVChecker.exe"C:\Users\Admin\AppData\Local\Temp\7zC9311390\HyperVChecker.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zC9311390\HyperVChecker.exe"C:\Users\Admin\AppData\Local\Temp\7zC9311390\HyperVChecker.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zC9311390\HyperVChecker.exe"C:\Users\Admin\AppData\Local\Temp\7zC9311390\HyperVChecker.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zC9311390\MuMuDownloader.exe"C:\Users\Admin\AppData\Local\Temp\7zC9311390\MuMuDownloader.exe" --log="C:\Users\Admin\AppData\Local\Temp\nemu-downloader-aria.log" --log-level=notice --check-certificate=false --enable-rpc=true --rpc-listen-port=54484 --continue --max-concurrent-downloads=10 --max-connection-per-server=5 --async-dns=false --file-allocation=trunc --enable-mmap=true --connect-timeout=5 --rpc-max-request-size=1024M --rpc-secret=MuMuDownloader1,778,468,944 --stop-with-process=58283⤵
-
-
C:\Users\Admin\AppData\Local\Temp\MuMu-setup-V5.25.3.3439-overseas-0423001125.exe"C:\Users\Admin\AppData\Local\Temp\MuMu-setup-V5.25.3.3439-overseas-0423001125.exe" /gv=2 /S /auto_start=false /fchannel=gw-download-win /D=F:\Program Files\Netease\MuMuPlayer3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMNetLwf4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /UnregServer4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
-
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /RegServer4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
-
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPInstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPInstall.exe"4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create MuMuVMMDrv binPath= "C:\Program Files\MuMuVMMVbox\LoadedDrivers\MuMuVMMDrv.sys" type= kernel start= auto4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" create MuMuVMMDrv binPath= "C:\Program Files\MuMuVMMVbox\LoadedDrivers\MuMuVMMDrv.sys" type= kernel start= auto4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" start MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /UnregServer4⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"4⤵
-
C:\Windows\system32\regsvr32.exe/u /s "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "comregister.cmd -u"4⤵
-
C:\Windows\SysWOW64\net.exeNET FILE5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 FILE6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cd5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMSVC.exe" /UnregServer5⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"5⤵
-
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMC.dll"6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\x86\MuMuVMMClient-x86.dll"5⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"5⤵
-
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\MuMuVMMProxyStub.dll"6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\MuMuVMMVbox\Hypervisor\x86\MuMuVMMProxyStub-x86.dll"5⤵
-
-
-
C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"C:\Program Files\MuMuVMMVbox\Hypervisor\NetLwfUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
-
C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"C:\Program Files\MuMuVMMVbox\LoadedDrivers\SUPUninstall.exe"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc.exe" query MuMuVMMDrv4⤵
- Launches sc.exe
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mumuplayer.com/redirect/nx/installmu/error/?lang=en3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7fff8d7dc188,0x7fff8d7dc194,0x7fff8d7dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,18300059989109091135,5201190263324989445,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7251759573042607859,9222049501177411750,262144 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,12522794897733849437,6970119892808891961,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,1493916248056318932,5876550932297001750,2097152 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8960682766080015648,5120641424273448824,2097152 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,14371706982285932532,5827128962922922332,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,16909421943542409929,9304850834488848164,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,17731580068858865177,367434189224580048,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,17731580068858865177,367434189224580048,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6080,i,14242213403129040912,8359493160064656559,2097152 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,16995147050719890162,9900441612897186127,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,10938758868893220197,10663450383610860603,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,13411163208163528030,9660490134036701445,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,13962215286061775001,15654642703049054020,524288 --field-trial-handle=2228,i,640627186681670125,10220865622518779918,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff8d7dc188,0x7fff8d7dc194,0x7fff8d7dc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,15306211452173111632,12025320615281220608,524288 --field-trial-handle=2292,i,16689750858534383329,1420641916788852514,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,698257694292339451,5615447470468541563,524288 --field-trial-handle=2292,i,16689750858534383329,1420641916788852514,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,5081720656238015448,6426016289517384774,262144 --field-trial-handle=2292,i,16689750858534383329,1420641916788852514,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,16920469937575919028,11955712757044973123,524288 --field-trial-handle=2292,i,16689750858534383329,1420641916788852514,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,16920469937575919028,11955712757044973123,524288 --field-trial-handle=2292,i,16689750858534383329,1420641916788852514,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:85⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zC9311390\7z.exe"C:\Users\Admin\AppData\Local\Temp\7zC9311390\7z.exe" a -tzip "C:\Users\Admin\AppData\Local\Temp\nemux.zip" "C:\Users\Admin\AppData\Local\Temp\nemux"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
.backup_info
MuMuVMMNetFltM.inf
vcruntime140_1.dll
VAddressDevice.dll
7za.dll
7za.exe
7zxa.dll
7-ZipEng.hlf
7-ZipEng.lng
7-ZipFar.dll
7-ZipFar64.dll
7-ZipRus.hlf
7-ZipRus.lng
7zToFar.ini
far7z.reg
far7z.txt
7za.dll
7za.exe
7zxa.dll
MuMuVMMAuth.dll
MuMuVMMAuthSimple.dll
MuMuVMMBalloonCtrl.exe
MuMuVMMC.dll
MuMuVMMCAPI.dll
MuMuVMMDD.dll
MuMuVMMDD2.dll
MuMuVMMDDR0.r0
MuMuVMMDDU.dll
MuMuVMMDTrace.exe
MuMuVMMDragAndDropSvc.dll
MuMuVMMDrv.cat
MuMuVMMDrv.inf
MuMuVMMDrv.sys
MuMuVMMGuestControlSvc.dll
MuMuVMMGuestPropSvc.dll
MuMuVMMHeadless.exe
MuMuVMMHostChannel.dll
MuMuVMMInstallHelper.dll
MuMuVMMManage.exe
MuMuVMMNetAdp.cat
MuMuVMMNetAdp.inf
MuMuVMMNetAdp.sys
MuMuVMMNetAdp6.cat
MuMuVMMNetAdp6.inf
MuMuVMMNetAdp6.sys
MuMuVMMNetDHCP.exe
MuMuVMMNetFlt.cat
MuMuVMMNetFlt.inf
MuMuVMMNetFlt.sys
MuMuVMMNetFltNobj.dll
MuMuVMMNetLwf.cat
MuMuVMMNetLwf.inf
MuMuVMMNetLwf.sys
MuMuVMMNetNAT.exe
MuMuVMMProxyStub.dll
MuMuVMMProxyStubLegacy.dll
MuMuVMMRT.dll
MuMuVMMRes.dll
MuMuVMMSVC.exe
MuMuVMMSVGA3D.dll
MuMuVMMSharedClipboard.dll
MuMuVMMSharedFolders.dll
MuMuVMMSupLib.dll
MuMuVMMVMM.dll
MuMuVMMVMMR0.inf
MuMuVMMVMMR0.r0
NetAdp6Install.exe
NetAdp6Uninstall.exe
NetAdpInstall.exe
NetAdpUninstall.exe
NetFltInstall.exe
NetFltUninstall.exe
NetLwfInstall.exe
NetLwfUninstall.exe
SUPInstall.exe
SUPUninstall.exe
VAddressDevice.dll
VBoxEFI32.fd
comregister.cmd
libAccelerator.dll
load.cmd
loadall.cmd
loadlwf.cmd
msvcp100.dll
msvcr100.dll
mumuvmmvmmr0.cat
my_upload_md5.exe
ucrtbase.dll
vcruntime140.dll
VAddressDevice.dll
VAddressDevice.dll
VAddressDevice.dll
VAddressDevice.dll
VAddressDevice.dll
vbox-img.exe
MuMuVMMDDR0.r0
MuMuVMMDrv.sys
MuMuVMMNetAdp6.sys
MuMuVMMNetLwf.sys
MuMuVMMVMMR0.r0
mumuvmmdrv.cat
mumuvmmnetadp6.cat
mumuvmmnetlwf.cat
mumuvmmvmmr0.cat
regsvr32.exe
blocklist
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_000081
f_000082
f_000083
f_000084
f_00008a
f_00008b
f_0000a8
f_0000ad
f_0000b1
f_000105
temp-index
the-real-index
the-real-index~RFe58aeaa.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe588f99.TMP
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index~RFe5ebbcc.TMP
the-real-index
the-real-index
the-real-index~RFe583795.TMP
the-real-index
index.txt
index.txt
index.txt
the-real-index
the-real-index~RFe588e8f.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
b124352d-bf3e-496c-a38d-3a2a59cb6e88.tmp
OperationConfig
OperationConfig~RFe5f31d7.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5880d3.TMP
data_1
df9a2e66-159f-4ec9-bb93-ea78ccae2d84.tmp
a6d4286a-b4aa-4d58-b76e-a9d2e2212f4b.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
3c1c30dc-a00c-4a39-b7c4-727b950f42c7.tmp
ColaBoxChecker.exe
HyperVChecker.exe
MuMuDownloader.exe
baseboard
config.ini
nemu-downloader.exe
skin.zip
baseboard
msvcp140.dll
msvcp_win.dll
msvcrt.dll
9cd8f5dd-e903-4a23-98ed-033db87a0f37.tmp
nemux-downloader-d66064f3-0c33-49c6-a505-e5387ce43457.log
nemux-HypervisorComregisterUninstall.log
nemux-HypervisorDriverInstall.log
nemux-HypervisorDriverUninstall.log
nemux-HypervisorDriverUninstall.log
nemux-NetLwfDriverUninstall.log
nemux-scCreateMuMuVMMDrv1.log
nemux-scQueryMuMuVMMDrvBeforeScStart.log
nemux-scQueryMuMuVMMDrvBeginUninstall.log
nemux-scStartMuMuVMMDrv1.log
AccessControl.dll
ExecDos.dll
LogEx.dll
System.dll
UAC.dll
UserInfo.dll
nsProcess.dll
content_new.js
5fbf935d-d7d9-4d10-b7cf-55e6a4678951.tmp
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
MuMu_5.0.11_KJ3pkeC.exe
check_hdd.exe
memory/5604-1847-0x00000000001B0000-0x0000000000765000-memory.dmp
memory/5604-1839-0x00000000001B0000-0x0000000000765000-memory.dmp
memory/5604-4461-0x00000000001B0000-0x0000000000765000-memory.dmp
memory/5872-4947-0x0000000000300000-0x00000000008B5000-memory.dmp
memory/5992-2803-0x0000000140000000-0x0000000140074000-memory.dmp