Overview

overview

7

Static

static

1

MuMuInstal...52.exe

windows10-2004-x64

7

MuMuInstal...52.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    97s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/08/2026, 14:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MuMuInstaller_1.5.0.6_overseas-v2.7.23.0x64_all_1681464552.exe
  • Size 5.0MB
  • Sample260803-sbm7msdr7s
  • SHA256 510aa5c30864fe118d328452dbbd28d7ec47f6ea23b26cb5fe68ecf4a0b85fb9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 17 IoCs
  • Launches sc.exe 18 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MuMuInstaller_1.5.0.6_overseas-v2.7.23.0x64_all_1681464552.exe
    "C:\Users\Admin\AppData\Local\Temp\MuMuInstaller_1.5.0.6_overseas-v2.7.23.0x64_all_1681464552.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\AppData\Local\Temp\7z81A7B608\nemu-downloader.exe
      C:\Users\Admin\AppData\Local\Temp\7z81A7B608\nemu-downloader.exe
      2⤵
      • Enumerates connected drives
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Users\Admin\AppData\Local\Temp\7z81A7B608\crashpad_handler.exe
        C:\Users\Admin\AppData\Local\Temp\7z81A7B608\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\.sentry-native --metrics-dir=C:\Users\Admin\AppData\Local\Temp\.sentry-native --url=https://sentry.netease.com:443/api/81/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=b2a9969e03944fae81a12cf84afa6bd2 --attachment=C:\Users\Admin\AppData\Local\Temp\nemu-downloader-22ebb349-3b01-4e5d-a096-70f4fbe564c7.log --attachment=C:\Users\Admin\AppData\Local\Temp\.sentry-native\9fe89901-d001-4685-9af8-e999cc6cb597.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Temp\.sentry-native\9fe89901-d001-4685-9af8-e999cc6cb597.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Temp\.sentry-native\9fe89901-d001-4685-9af8-e999cc6cb597.run\__sentry-breadcrumb2 --initial-client-data=0x338,0x33c,0x340,0x314,0x344,0x75004d80,0x75004d94,0x75004da4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4612
      • C:\Users\Admin\AppData\Local\Temp\7z81A7B608\ColaBoxChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z81A7B608\ColaBoxChecker.exe" checker /baseboard
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3792
      • C:\Users\Admin\AppData\Local\Temp\7z81A7B608\ColaBoxChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z81A7B608\ColaBoxChecker.exe" checker /hyperv
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Windows\SysWOW64\systeminfo.exe
          "C:\Windows\system32\systeminfo.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:1740
      • C:\Users\Admin\AppData\Local\Temp\7z81A7B608\ColaBoxChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z81A7B608\ColaBoxChecker.exe" checker /hyperv
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4388
      • C:\Users\Admin\AppData\Local\Temp\7z81A7B608\ColaBoxChecker.exe
        "C:\Users\Admin\AppData\Local\Temp\7z81A7B608\ColaBoxChecker.exe" checker /hyperv
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2108
      • C:\Users\Admin\AppData\Local\Temp\7z81A7B608\MuMuDownloader.exe
        "C:\Users\Admin\AppData\Local\Temp\7z81A7B608\MuMuDownloader.exe" --log="C:\Users\Admin\AppData\Local\Temp\nemu-downloader-aria.log" --log-level=notice --check-certificate=false --enable-rpc=true --rpc-listen-port=50020 --continue --max-concurrent-downloads=10 --max-connection-per-server=5 --async-dns=false --file-allocation=trunc --connect-timeout=5 --rpc-max-request-size=1024M --max-overall-download-limit=50000K --stop-with-process=2016
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3848
      • C:\Users\Admin\AppData\Local\Temp\nemu-hypervisor-5.0.18-x86-overseas-0412214109.exe
        "C:\Users\Admin\AppData\Local\Temp\nemu-hypervisor-5.0.18-x86-overseas-0412214109.exe" /S /post_target=2016 /D=C:\Program Files (x86)\NemuVbox
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:212
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc.exe" query NemuDrv
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1616
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\system32\sc.exe" query NemuDrv
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2444
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c netshAsyncCall.cmd 0 MuMuNemuHeadless C:\Program Files\NemuVbox\Hypervisor\NemuHeadless.exe
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3228
          • C:\Windows\SysWOW64\netsh.exe
            netsh.exe advfirewall firewall add rule name="MuMuNemuHeadless" dir=in action=allow program="C:\Program" enable=yes
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4128
          • C:\Windows\SysWOW64\netsh.exe
            netsh.exe advfirewall firewall add rule name="MuMuNemuHeadless" dir=in action=allow program="C:\Program" enable=yes
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4448
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c netshAsyncCall.cmd 0 MuMuNemuSVC C:\Program Files\NemuVbox\Hypervisor\NemuSVC.exe
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4216
          • C:\Windows\SysWOW64\netsh.exe
            netsh.exe advfirewall firewall add rule name="MuMuNemuSVC" dir=in action=allow program="C:\Program" enable=yes
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:416
          • C:\Windows\SysWOW64\netsh.exe
            netsh.exe advfirewall firewall add rule name="MuMuNemuSVC" dir=in action=allow program="C:\Program" enable=yes
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1376
        • C:\Program Files\NemuVbox\Hypervisor\NemuSVC.exe
          "C:\Program Files\NemuVbox\Hypervisor\NemuSVC.exe" /UnregServer
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2724
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\NemuVbox\Hypervisor\NemuC.dll"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3156
          • C:\Windows\system32\regsvr32.exe
            /u /s "C:\Program Files\NemuVbox\Hypervisor\NemuC.dll"
            5⤵
              PID:1488
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\syswow64\regsvr32.exe" /u /s "C:\Program Files\NemuVbox\Hypervisor\x86\NemuClient-x86.dll"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2628
          • C:\Program Files\NemuVbox\Hypervisor\NemuSVC.exe
            "C:\Program Files\NemuVbox\Hypervisor\NemuSVC.exe" /RegServer
            4⤵
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3704
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\NemuVbox\Hypervisor\NemuC.dll"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2008
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files\NemuVbox\Hypervisor\NemuC.dll"
              5⤵
              • Modifies registry class
              PID:632
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\syswow64\regsvr32.exe" /s "C:\Program Files\NemuVbox\Hypervisor\x86\NemuClient-x86.dll"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2304
          • C:\Program Files\NemuVbox\LoadedDrivers\SUPUninstall.exe
            "C:\Program Files\NemuVbox\LoadedDrivers\SUPUninstall.exe"
            4⤵
            • Executes dropped EXE
            PID:2568
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" query NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1296
          • C:\Program Files\NemuVbox\LoadedDrivers\SUPInstall.exe
            "C:\Program Files\NemuVbox\LoadedDrivers\SUPInstall.exe"
            4⤵
            • Executes dropped EXE
            PID:4436
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" query NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1556
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" create NemuDrv binPath= "C:\Program Files\NemuVbox\LoadedDrivers\NemuDrv.sys" type= kernel start= auto
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1000
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" query NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1788
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" start NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2080
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" start NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1132
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" start NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1488
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" query NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4792
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" query NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:392
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" query NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4156
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" query NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4276
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" query NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3928
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" query NemuDrv
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3820
          • C:\Program Files\NemuVbox\LoadedDrivers\SUPUninstall.exe
            "C:\Program Files\NemuVbox\LoadedDrivers\SUPUninstall.exe"
            4⤵
            • Executes dropped EXE
            PID:3352
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              5⤵
                PID:4436
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\system32\sc.exe" query NemuDrv
              4⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:3604
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                5⤵
                  PID:1556
              • C:\Program Files\NemuVbox\Hypervisor\NemuSVC.exe
                "C:\Program Files\NemuVbox\Hypervisor\NemuSVC.exe" /UnregServer
                4⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:696
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\NemuVbox\Hypervisor\NemuC.dll"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:960
                • C:\Windows\system32\regsvr32.exe
                  /u /s "C:\Program Files\NemuVbox\Hypervisor\NemuC.dll"
                  5⤵
                    PID:5044
                • C:\Windows\SysWOW64\regsvr32.exe
                  "C:\Windows\syswow64\regsvr32.exe" /u /s "C:\Program Files\NemuVbox\Hypervisor\x86\NemuClient-x86.dll"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4304
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c comregister.cmd -u
                  4⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4128
                  • C:\Program Files\NemuVbox\Hypervisor\NemuSVC.exe
                    "C:\Program Files\NemuVbox\Hypervisor\NemuSVC.exe" /UnregServer
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:3200
                  • C:\Windows\SysWOW64\regsvr32.exe
                    C:\Windows\syswow64\regsvr32 /s /u "C:\Program Files\NemuVbox\Hypervisor\x86\NemuClient-x86.dll"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4100
                  • C:\Windows\SysWOW64\regsvr32.exe
                    C:\Windows\system32\regsvr32 /s /u "C:\Program Files\NemuVbox\Hypervisor\NemuC.dll"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3192
                    • C:\Windows\system32\regsvr32.exe
                      /s /u "C:\Program Files\NemuVbox\Hypervisor\NemuC.dll"
                      6⤵
                        PID:3632
                  • C:\Program Files\NemuVbox\LoadedDrivers\SUPUninstall.exe
                    "C:\Program Files\NemuVbox\LoadedDrivers\SUPUninstall.exe"
                    4⤵
                      PID:3624
                    • C:\Windows\SysWOW64\sc.exe
                      "C:\Windows\system32\sc.exe" query NemuDrv
                      4⤵
                      • Launches sc.exe
                      PID:1712
                    • C:\Windows\SysWOW64\sc.exe
                      "C:\Windows\system32\sc.exe" query NemuDrv
                      4⤵
                      • Launches sc.exe
                      PID:3096
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mumuglobal.com/problem/q1/?lang=encwm-100
                    3⤵
                      PID:2012
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2e8,0x7ffb20cfc188,0x7ffb20cfc194,0x7ffb20cfc1a0
                        4⤵
                          PID:3580
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,4581750833269767412,5298983082807896517,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
                          4⤵
                          • System Time Discovery
                          PID:544
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,11616463283140366543,9747199629102982854,262144 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
                          4⤵
                            PID:1304
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,8484509687633296960,17056319353914576389,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
                            4⤵
                              PID:4596
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,1332770266521082734,8040839778534492989,2097152 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
                              4⤵
                                PID:204
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,9882766932504777717,804001952629494657,2097152 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
                                4⤵
                                  PID:4672
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,15233955686277175750,3290893623764557175,2097152 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
                                  4⤵
                                    PID:1616
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,168771165109322687,12020063043699551708,2097152 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
                                    4⤵
                                      PID:3924
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,5365105163022076433,10481873469964217622,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
                                      4⤵
                                        PID:3412
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,5865357284198621286,4939737017788321918,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
                                        4⤵
                                          PID:4384
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5168,i,3072611071528544720,13476391234104358163,2097152 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
                                          4⤵
                                            PID:3760
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3548,i,12354891627062359743,10464870067119350467,2097152 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
                                            4⤵
                                              PID:4024
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,6452378391742086054,438019816742335293,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
                                              4⤵
                                                PID:3268
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,1439548423907072981,14675199692580536033,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
                                                4⤵
                                                  PID:2256
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,10504623513840950142,2078074047657231518,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
                                                  4⤵
                                                    PID:916
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,10504623513840950142,2078074047657231518,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
                                                    4⤵
                                                      PID:1980
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,12748321249027890259,7591974415796619139,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
                                                      4⤵
                                                        PID:3928
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,6987339782099326520,8114566610935325939,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
                                                        4⤵
                                                          PID:4960
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,17127764874829263692,10646633521938107935,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
                                                          4⤵
                                                            PID:4156
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,10281105896624084188,14246527628681737019,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
                                                            4⤵
                                                              PID:3684
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,9921836288283349984,1788441264389022883,524288 --field-trial-handle=2404,i,9651832153289873358,9264966671316357449,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
                                                              4⤵
                                                                PID:2560
                                                        • C:\Users\Admin\AppData\Local\Temp\7z81A7B608\WinRing0x64.sys
                                                          C:\Users\Admin\AppData\Local\Temp\7z81A7B608\WinRing0x64.sys
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:1552
                                                        • C:\Program Files\NemuVbox\LoadedDrivers\NemuDrv.sys
                                                          "C:\Program Files\NemuVbox\LoadedDrivers\NemuDrv.sys"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:3400
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                            PID:3836

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Command and Scripting Interpreter

                                                                1
                                                                T1059

                                                                Windows Command Shell

                                                                1
                                                                T1059.003

                                                                System Services

                                                                1
                                                                T1569

                                                                Service Execution

                                                                1
                                                                T1569.002

                                                                Persistence

                                                                Create or Modify System Process

                                                                2
                                                                T1543

                                                                Windows Service

                                                                2
                                                                T1543.003

                                                                Event Triggered Execution

                                                                2
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Netsh Helper DLL

                                                                1
                                                                T1546.007

                                                                Privilege Escalation

                                                                Create or Modify System Process

                                                                2
                                                                T1543

                                                                Windows Service

                                                                2
                                                                T1543.003

                                                                Event Triggered Execution

                                                                2
                                                                T1546

                                                                Component Object Model Hijacking

                                                                1
                                                                T1546.015

                                                                Netsh Helper DLL

                                                                1
                                                                T1546.007

                                                                Defense Evasion

                                                                Impair Defenses

                                                                1
                                                                T1562

                                                                Disable or Modify System Firewall

                                                                1
                                                                T1562.004

                                                                Credential Access

                                                                Discovery

                                                                Peripheral Device Discovery

                                                                1
                                                                T1120

                                                                Query Registry

                                                                2
                                                                T1012

                                                                System Information Discovery

                                                                4
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Time Discovery

                                                                1
                                                                T1124

                                                                Lateral Movement

                                                                Collection

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                NemuDrv.sys
                                                                • Path C:\Program Files\NemuVbox\Hypervisor\NemuDrv.sys
                                                                • Size 292KB
                                                                • SHA256 8cb34a10d784ee9b1c566e0fb91013702e9022d92d36d473481cfe3033c3d67b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SUPInstall.exe
                                                                • Path C:\Program Files\NemuVbox\Hypervisor\SUPInstall.exe
                                                                • Size 12KB
                                                                • SHA256 4563d232fac58e1142a7f368e4fe34a93a5a2b465735f60b5c28829a4fc1f3c4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SUPUninstall.exe
                                                                • Path C:\Program Files\NemuVbox\Hypervisor\SUPUninstall.exe
                                                                • Size 12KB
                                                                • SHA256 5ab555f3f47a3298b65d53617b766aaa7d42dfcc404bda590a8f4a4814945898
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                nemudrv.cat
                                                                • Path C:\Program Files\NemuVbox\Hypervisor\nemudrv.cat
                                                                • Size 8KB
                                                                • SHA256 b5df21d51135a7151c45f08ce48d8f782c856078342d22101b9f53083d6a5779
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                NemuDrv.inf
                                                                • Path C:\Program Files\NemuVbox\LoadedDrivers\NemuDrv.inf
                                                                • Size 2KB
                                                                • SHA256 df16de5181fbbd18c54d16cb287fe12774524ff08fcba475c230aa151ec31fcb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                NemuRT.dll
                                                                • Path C:\Program Files\NemuVbox\LoadedDrivers\NemuRT.dll
                                                                • Size 6.2MB
                                                                • SHA256 10fb849f871064c6df2ac5274dfa257f8c564640fe25476d4707c92e48b58bcd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msvcp100.dll
                                                                • Path C:\Program Files\NemuVbox\LoadedDrivers\msvcp100.dll
                                                                • Size 613KB
                                                                • SHA256 305d47cd5a2f1dc30817bf25659fcfb32b19c9b7c2928dce289c340e52208f8a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msvcr100.dll
                                                                • Path C:\Program Files\NemuVbox\LoadedDrivers\msvcr100.dll
                                                                • Size 832KB
                                                                • SHA256 0248a56d1f59507351c2f730c77596fe2fcd28e1964543933b11525b76b2cacb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                blocklist
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                • Size 105KB
                                                                • SHA256 64cf7adf13e875b415330ac3657ce5672efbf3fe1e27d486548e17589aa3a1f4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 ce6612fa5fcb5a512497cb33ab0a3f706834ad222b5696f08863894b1e22f287
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                BookmarkMergedSurfaceOrdering
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                • Size 6B
                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 4KB
                                                                • SHA256 cac503ea7df83ea70597e3ce5822c814c2342ac505a9e8f501871f6235a28885
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                the-real-index~RFe5a4f79.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4f79.TMP
                                                                • Size 3KB
                                                                • SHA256 372bdefa337de654a20dd31f94c47edc3cba2ad09d9f518b5045c30e5f1ca8e5
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SiteList-Enterprise.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                • Size 2B
                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Edge Profile.ico
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                • Size 70KB
                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 5KB
                                                                • SHA256 b24d73e247634c6b9152589c51920f925ac03bc5fa3e20135d44d5bf5caa0824
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 111B
                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SCT Auditing Pending Reports
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 14KB
                                                                • SHA256 24e13ba1896804258f79b8e4ae9216644dad238280d276b8dbc82ed0f21ea277
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 15KB
                                                                • SHA256 3b743a32ba487087301519293b304b510cf47cb875a086498101186efe8161c8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Secure Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                • Size 35KB
                                                                • SHA256 6694bcae605d079583b48bc8eaf55301a41f530b25901380e1d9758f18b3b792
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                sync_diagnostic.log
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                • Size 5KB
                                                                • SHA256 0b51296261ddcec327cf2ab4b5de68bffcf6b018e58b2f22c8d7338f7dddc5f8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 8KB
                                                                • SHA256 93d6539aae03a2f625dc2878f38ea49ed20570589bf01f6459a2a9943ef8fcac
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 8KB
                                                                • SHA256 5c998d02752d8e926a31997bd07c579662751459881210c9fca3b45e43993bde
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 19KB
                                                                • SHA256 dd10dc25434e01449dc2539e115e67097bb65bfa25072793830c6f042455442b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 26KB
                                                                • SHA256 dc127b871cfbcc7ae3ec89015ef51cfdbcd6c71ecfc49a5796bf34b9788943f4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data_1
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                • Size 264KB
                                                                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                Submit Download

                                                                be62d476-5c27-454b-bd84-a0c8c7a85d79.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\be62d476-5c27-454b-bd84-a0c8c7a85d79.tmp
                                                                • Size 13B
                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Size 2KB
                                                                • SHA256 d43dd72117c8992ae991ed6566db6d0b5cfc4faeeafcb3eeb701936049017cc9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                022e6e1b-20cc-4769-9716-1c502a4f5969.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\022e6e1b-20cc-4769-9716-1c502a4f5969.tmp
                                                                • Size 153KB
                                                                • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                4ffdcde0-2de9-4c02-a596-13fc7ca9d00f.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\4ffdcde0-2de9-4c02-a596-13fc7ca9d00f.tmp
                                                                • Size 1B
                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                ColaBoxChecker.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\ColaBoxChecker.exe
                                                                • Size 4.0MB
                                                                • SHA256 1373c5d006a5dbcd9b86cfff9a37616f1245d1333c4adcefc7cd18926b98d752
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MuMuDownloader.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\MuMuDownloader.exe
                                                                • Size 4.9MB
                                                                • SHA256 dd49b0849241a7d885b18780464fdbea2552595d4e0918acb59f18bf9bb9c588
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                VCRUNTIME140.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\VCRUNTIME140.dll
                                                                • Size 78KB
                                                                • SHA256 8598940e498271b542f2c04998626aa680f2172d0ff4f8dbd4ffec1a196540f9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WinRing0x64.sys
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\WinRing0x64.sys
                                                                • Size 32KB
                                                                • SHA256 d5bca2ca464a6cc91344bd85e812a7bac6e7c67038c4929a29e0bc60c7eabe4d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                baseboard
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\baseboard
                                                                • Size 114B
                                                                • SHA256 614305c9975bc9be238c10f0390e3a55273c999f25f6a6bae4999478c1c47f9b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                config.ini
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\config.ini
                                                                • Size 346B
                                                                • SHA256 59373be0759c4b2f52d4fb483be21deb3a7f5825138e635cf748a53c4430fee0
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                crashpad_handler.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\crashpad_handler.exe
                                                                • Size 845KB
                                                                • SHA256 c0cab2ede028b24c6055843554cfd20b445bafeff607fc3641b4e476ff778367
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                hyperv
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\hyperv
                                                                • Size 96B
                                                                • SHA256 dfc756c96d3b4ea36060e5344089850dc7841e788a02796e4dc7e1e6caf87b45
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                msvcp140.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\msvcp140.dll
                                                                • Size 427KB
                                                                • SHA256 83f935454ae8e450b6f042509ecf28cceff95edb2495c63a782b9d45c2eaf1c0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                nemu-downloader.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\nemu-downloader.exe
                                                                • Size 2.8MB
                                                                • SHA256 de565e0a625f5674c3486c6c70cdb05432ab0c2a0050bea67db6fcf4d3d3ed09
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                sentry.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\sentry.dll
                                                                • Size 430KB
                                                                • SHA256 7539405e35dd84561a6d28404c30b8ca46bef516b8f10b9e46118aad72cbd9cf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                skin.zip
                                                                • Path C:\Users\Admin\AppData\Local\Temp\7z81A7B608\skin.zip
                                                                • Size 523KB
                                                                • SHA256 200717a9284a32a8166ac9e34e53a2a1f5f63c3bafab5e74387c288421651810
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WinRing0.inf
                                                                • Path C:\Users\Admin\AppData\Local\Temp\WinRing0.inf
                                                                • Size 2KB
                                                                • SHA256 07942017e8caaa1065867aecc561577199e53142545cb6fb41239ae4c607d46b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                WinRing0.sys
                                                                • Path C:\Users\Admin\AppData\Local\Temp\WinRing0.sys
                                                                • Size 31KB
                                                                • SHA256 4448beff8366e42e3393e8c7f8261aee0b0340356c31aa3b97de07452ae01888
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WinRing0x64.inf
                                                                • Path C:\Users\Admin\AppData\Local\Temp\WinRing0x64.inf
                                                                • Size 2KB
                                                                • SHA256 3fded2f4457b0beb415b841b40f6ede5ed527dd537e53e2f70f2fb4a6e24ebfd
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                nemu-hypervisor-5.0.18-x86-overseas-0412214109.exe
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nemu-hypervisor-5.0.18-x86-overseas-0412214109.exe
                                                                • Size 13.1MB
                                                                • SHA256 85cb269d28539e6b89b28d994c7193d3d765c86986837de9a2f2d00ed4c4a13c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                nemu_vbox-scQueryBeforeScStartNemuDrv.log
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nemu\setup_logs\nemu_vbox-scQueryBeforeScStartNemuDrv.log
                                                                • Size 267B
                                                                • SHA256 01baa8a980e508b6e32e38a57790699a0acd8be5e207ed1f8b5997b3d58212ff
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                nemu_vbox-scQueryBeginNemuDrv.log
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nemu\setup_logs\nemu_vbox-scQueryBeginNemuDrv.log
                                                                • Size 122B
                                                                • SHA256 df023ca139e8dcb21f0d4a603b34af95f980c1e388c97e4735dd698d0329113c
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                nemu_vbox-scStartNemuDrv.log
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nemu\setup_logs\nemu_vbox-scStartNemuDrv.log
                                                                • Size 259B
                                                                • SHA256 0fc284c7ea4832eee9944694090f1feda6e44f4695aa8f3e04dded56b6f47bae
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                AccessControl.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsi578D.tmp\AccessControl.dll
                                                                • Size 23KB
                                                                • SHA256 1b4d25f2f544f520c20493ee1e9ac7b3043aab88e4ff87953390d357de4c2096
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ExecDos.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsi578D.tmp\ExecDos.dll
                                                                • Size 14KB
                                                                • SHA256 691ffd34264d1813827c35083367a08aec974e9f79fb585b7d2d367c83760fbd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                LogEx.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsi578D.tmp\LogEx.dll
                                                                • Size 52KB
                                                                • SHA256 cf7b45a69a13551db95dcdefc8bfdd4128e1c1db67198347b43469b69c36b844
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                System.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsi578D.tmp\System.dll
                                                                • Size 20KB
                                                                • SHA256 d148555daabf35cd46c50ab3f515de5fc1e6764258230ab12e41f613f1daee11
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UAC.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsi578D.tmp\UAC.dll
                                                                • Size 22KB
                                                                • SHA256 fa3bb333f615689691ff98527dc3341e3b8ffee4bf97c6128820bf0d303930e7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                UserInfo.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsi578D.tmp\UserInfo.dll
                                                                • Size 12KB
                                                                • SHA256 191d2212da838af62d11873ca3f68c8489a2af912d7cbce9da8e505db172da6a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                nsProcess.dll
                                                                • Path C:\Users\Admin\AppData\Local\Temp\nsi578D.tmp\nsProcess.dll
                                                                • Size 12KB
                                                                • SHA256 44c14f1edfe7deef518264675e3e4edb6991d5ea0d50f0f6b18a819dc31bbcba
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                27ebdc28-0802-4d33-8464-6595281b2532.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2012_386049210\27ebdc28-0802-4d33-8464-6595281b2532.tmp
                                                                • Size 10KB
                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                content_new.js
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2012_386049210\CRX_INSTALL\content_new.js
                                                                • Size 10KB
                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                winring0.cat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\winring0.cat
                                                                • Size 10KB
                                                                • SHA256 784e031565c67f1d29640c62f0cc205d5b56c1f78be894252cce06474b64a618
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                winring0x64.cat
                                                                • Path C:\Users\Admin\AppData\Local\Temp\winring0x64.cat
                                                                • Size 11KB
                                                                • SHA256 317d01d9956f052d929fdbac258f1a2dc5163d3432fc488023a1f4d332ae3d45
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                nemu-installer-tmp.ini
                                                                • Path C:\Users\Public\Documents\MuMu Files\nemu-installer-tmp.ini
                                                                • Size 88B
                                                                • SHA256 101eecb5f6d26e2148951a4a4d18146a458ea3a6ee475b6c13a0c9b7b8f52720
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                memory/3400-591-0x0000000140000000-0x000000014004E000-memory.dmp
                                                                Download

                                                                memory/3848-133-0x0000000000400000-0x00000000008F1000-memory.dmp
                                                                Download