Overview

overview

6

Static

static

1

EMU-26.731...64.exe

windows10-2004-x64

6

EMU-26.731...64.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    153s
  • max time network
    177s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 04:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    EMU-26.731.2-preview-win-x64.exe
  • Size 356.9MB
  • Sample260813-fb1rhssand
  • SHA256 0e16d3b4784df2cefdd53b9f64407c3283a0fa9a1a63af046a7c23ad92cdb19c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discovery

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EMU-26.731.2-preview-win-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\EMU-26.731.2-preview-win-x64.exe"
    1⤵
    • Drops desktop.ini file(s)
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5504
    • C:\Users\Admin\AppData\Local\EMU\current\EMU.exe
      "C:\Users\Admin\AppData\Local\EMU\current\EMU.exe" --veloapp-install 26.731.2-preview
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4312
    • C:\Users\Admin\AppData\Local\EMU\current\EMU.exe
      "C:\Users\Admin\AppData\Local\EMU\current\EMU.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:5116

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Avalonia.Controls.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\Avalonia.Controls.dll
        • Size 2.6MB
        • SHA256 6c3fca4d6a1c6f1bf93c9d354215e31d470b7c7eee045a7c9261926ca0042e15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EMU.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\EMU.dll
        • Size 13.8MB
        • SHA256 27b55e7b0d0d76f6142cc672cebf49e9169dfb1923933cb87114634c6aadf0bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EMU.exe
        • Path C:\Users\Admin\AppData\Local\EMU\current\EMU.exe
        • Size 176KB
        • SHA256 64f4dcd8b83eb9ac106086dcb7c32837c0bf35368901001ac5e14a5c581db271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\Microsoft.Win32.Primitives.dll
        • Size 14KB
        • SHA256 674c2ebbdb968c360e3cf64d9a47d030f658c46a8b58d6971381c0f8eaf79dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NuGet.Versioning.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\NuGet.Versioning.dll
        • Size 148KB
        • SHA256 04920dc4a82f6a3ef4deb007ff29d590fc2dbcfb84e0ef4d730fbd50f1efb81c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Sentry.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\Sentry.dll
        • Size 1.9MB
        • SHA256 0f4f24a03b8bf13d1cbfb65d49ed9b8a823dffe1d632f111f1f876cc3dd3314d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.NonGeneric.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Collections.NonGeneric.dll
        • Size 105KB
        • SHA256 4348649201c978e2fbbc13753c89a7103f682a10477f121a4d5a75628fe798a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Collections.dll
        • Size 325KB
        • SHA256 f002421881d27d80d7b2ec66b74831e224c221d415706584cfc0e58dc9805358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.ComponentModel.Primitives.dll
        • Size 77KB
        • SHA256 c242bc2554cdc95f8c82fa7c388ee4546634aa74d75bd27cf1dee740c58e3233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Process.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Diagnostics.Process.dll
        • Size 329KB
        • SHA256 b28f3089dc4de0617216cc25fdfac0366aefbbfc323a86f747aaa55f3238203d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Linq.dll
        • Size 641KB
        • SHA256 6d3b9a0f8828f72a07c685abcf5ae97a437358469995e942b7d4fab74bb617e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Memory.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Memory.dll
        • Size 157KB
        • SHA256 008188acc2291d1ef3fc603093bfed60ec6d29a17bf9811e721ab91daee030bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Private.CoreLib.dll
        • Size 14.6MB
        • SHA256 dd5ba31574db730c5c7e8027f7785be7169a3905cfbe8d8248f16b2208b7d995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Private.Uri.dll
        • Size 253KB
        • SHA256 3a26c4e4c5a6d0afe898d6a3057fc29a716f265751cb24eb0c84ae3cdf424bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Xml.Linq.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Private.Xml.Linq.dll
        • Size 389KB
        • SHA256 15fea8c1ef73aa70a322c7d545e14dcbd1f0750f0a6687e6510158558f851972
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Xml.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Private.Xml.dll
        • Size 7.6MB
        • SHA256 175f8b2fde041054e8c4200b0a13fc9fc907b894423eb7426ef5528b14cf561b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.Extensions.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Runtime.Extensions.dll
        • Size 17KB
        • SHA256 f20996446b0b00749e6f0509a5881ef0d8e4408f6b21cc68f674476a57e0ab45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Runtime.InteropServices.dll
        • Size 109KB
        • SHA256 a25846837ceaa1585c332524f8368ac098f0e9cbda1a5d84aceb27ce8cf5b4af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Runtime.dll
        • Size 43KB
        • SHA256 2cff1a6e45ed1ae6be7d5a0d84d81d1d563d30dc27363c01bb167982c712e0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Encoding.Extensions.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Text.Encoding.Extensions.dll
        • Size 15KB
        • SHA256 57644b25cb19b3d75cbe72a44b2b63283f744095196ce84e01632b9e524c8f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.Thread.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Threading.Thread.dll
        • Size 15KB
        • SHA256 fe0c4f196a5b95c432386bfc12371b3cfd1a2758dff237ae4be8af868aa0ea02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Threading.dll
        • Size 81KB
        • SHA256 44ea90ab5b5eded6b6645be7e0381606868ad8719307b8ce7634f707d8ae014a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Xml.ReaderWriter.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Xml.ReaderWriter.dll
        • Size 21KB
        • SHA256 9aac22d3bf8738e1e2d823ead5193353a2711c9d00aab653aa558c6698ee5c21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Xml.XDocument.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\System.Xml.XDocument.dll
        • Size 15KB
        • SHA256 7565fc2256a806995d2877d5d5261bc28e70d6616aa1fcd96607b9d73bd78250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Velopack.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\Velopack.dll
        • Size 668KB
        • SHA256 660e6d0d840a7321ca8d5ed702d2c701a50ef2fe8308162cf92faba83ec96437
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        clrjit.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\clrjit.dll
        • Size 1.9MB
        • SHA256 e97856d65b3c780bcd8cd4562fc766da4d62ce70e078bf2865624bff8bef5980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        coreclr.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\coreclr.dll
        • Size 4.6MB
        • SHA256 d4656324884b3c04c27520cb66a5129e3346275fd18e61803a204879d49b5e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostfxr.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\hostfxr.dll
        • Size 365KB
        • SHA256 729a16b9e4a5f4c9d0bb1740e07320c84da798ba37dbfb05d8888644bc3e12d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hostpolicy.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\hostpolicy.dll
        • Size 378KB
        • SHA256 320184554da948290885e134a9dce004e508dd781da98be9626b4c470e3f5df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        netstandard.dll
        • Path C:\Users\Admin\AppData\Local\EMU\current\netstandard.dll
        • Size 98KB
        • SHA256 0a5ed9d88bd801a13c7df64108c9303b973b508c6e93a8dc04b1ad4c4f75c493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sq.version
        • Path C:\Users\Admin\AppData\Local\EMU\current\sq.version
        • Size 469B
        • SHA256 f30fd8e0306449512d10a762faeb4601ab7bae18240bad89d8c3329aa4a81801
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Tmp42C7.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\Tmp42C7.tmp
        • Size 47B
        • SHA256 dd4ee8b670b806a7b99c94718d61e8f9ba6f47b6208b69fc1872675fdb32feaf
        • MD5 SHA1 SHA512
        Submit Download

        CustomFixtures.litedb
        • Path C:\Users\Admin\Documents\EMU\Preferences\CustomFixtures.litedb
        • Size 8KB
        • SHA256 27d940924f848e939043536f9453016258a3df31deb70a2c7fab8cc32fea860a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        preferences.json
        • Path C:\Users\Admin\Documents\EMU\Preferences\preferences.json
        • Size 3KB
        • SHA256 b2e28d900cfe1e4dab3328ac0eb40ae21e59403cf4bdf1dcefb19d50b0f10fea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        preferences.json
        • Path C:\Users\Admin\Documents\EMU\Preferences\preferences.json
        • Size 3KB
        • SHA256 d6193b3cbbce97d4c07776774c9dbc69ff8fd9ac93ffa42a9d99b4420a44cc16
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        preferences.json
        • Path C:\Users\Admin\Documents\EMU\Preferences\preferences.json
        • Size 4KB
        • SHA256 aecd27777effb5494e24f0e954e959ae6cce87677068a71f783e2a753c64754f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        preferences.json
        • Path C:\Users\Admin\Documents\EMU\Preferences\preferences.json
        • Size 4KB
        • SHA256 db3580c29fbc32203ed3dbc0c8fa4b3328725ec1da21b12868703aa632d6492b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        preferences.json.bak
        • Path C:\Users\Admin\Documents\EMU\Preferences\preferences.json.bak
        • Size 3KB
        • SHA256 5939d9f8d032e5eea91703671539629a06f41eefd4feef98569050d6ef149f71
        • MD5 SHA1 SHA512 TLSH
        Submit Download