Overview

overview

8

Static

static

3

UpdaterSMP.exe

windows10-2004-x64

8

UpdaterSMP.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    901s
  • max time network
    867s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UpdaterSMP.exe
  • Size 106.8MB
  • Sample260704-e6vcjsfs8r
  • SHA256 b61e8ef3c275f2337c4ecc734fb06cf3c29a7820bcc138bc629cfb23b32f1d49
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to get system information as a root user.

    execution
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 26 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 24 IoCs
    defense_evasion
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\UpdaterSMP.exe
    "C:\Users\Admin\AppData\Local\Temp\UpdaterSMP.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1652
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:5568
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5316
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5848
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:5808
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "net session"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5864
          • C:\Windows\system32\net.exe
            net session
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3416
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 session
              4⤵
                PID:2684
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "schtasks /Query /TN "Microsoft\Windows\AudioDriverMaintenance""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2396
            • C:\Windows\system32\schtasks.exe
              schtasks /Query /TN "Microsoft\Windows\AudioDriverMaintenance"
              3⤵
                PID:1808
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "schtasks /Create /F /TN "Microsoft\Windows\AudioDriverMaintenance" /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe\"" /SC ONLOGON /RL HIGHEST"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1612
              • C:\Windows\system32\schtasks.exe
                schtasks /Create /F /TN "Microsoft\Windows\AudioDriverMaintenance" /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe\"" /SC ONLOGON /RL HIGHEST
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:4136
            • C:\Windows\System32\tar.exe
              C:\Windows\System32\tar.exe -xzf sysaudio.tar.gz
              2⤵
                PID:1720
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "net session"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5900
                • C:\Windows\system32\net.exe
                  net session
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1220
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 session
                    4⤵
                      PID:1700
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\javaw.exe
                  C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Dorg.sqlite.tmpdir=C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\sqlite-native -DAGENT_PASSWORD=yd_7JY9Al17X2BPV91obFmkm -DAGENT_LOADER=1 -jar C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\rtaudio-config.jar --vv-from-loader --vv-elevated
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2036
                  • C:\Windows\SYSTEM32\tasklist.exe
                    tasklist /fi "imagename eq LsaIso.exe"
                    3⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3912
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "$avs = @(); try { Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | ForEach-Object { if ($_.displayName) { $avs += $_.displayName } } } catch {} if ($avs.Count -eq 0) { try { $s = Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($s -and $s.AntivirusEnabled) { $avs += 'Windows Defender' } } catch {} } if ($avs.Count -eq 0) { 'None' } else { ($avs | Select-Object -Unique) -join ', ' }"
                    3⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2376
                  • C:\Windows\SYSTEM32\tasklist.exe
                    tasklist /fi "imagename eq LsaIso.exe"
                    3⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3704
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im chrome.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3196
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im brave.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5264
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im msedge.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2120
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im opera.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5252
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im firefox.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2748
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im librewolf.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3520
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im waterfox.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2168
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im zen.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5124
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im vivaldi.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1808
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im browser.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5624
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im QQBrowser.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5584
                  • C:\Windows\SYSTEM32\taskkill.exe
                    taskkill /f /im 360chrome.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3648
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic process where name='firefox.exe' get ExecutablePath /format:list
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1408
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic process where name='firefox.exe' get ExecutablePath /format:list
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:260
              • C:\Users\Admin\AppData\Local\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe
                "C:\Users\Admin\AppData\Local\Microsoft\Windows\AudioDriver\AudioDriverSetup.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1368
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "net session"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5528
                  • C:\Windows\System32\net.exe
                    net session
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1976
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 session
                      4⤵
                        PID:4136
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "net session"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4048
                    • C:\Windows\System32\net.exe
                      net session
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1888
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 session
                        4⤵
                          PID:1188
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "net session"
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5928
                      • C:\Windows\System32\net.exe
                        net session
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2452
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 session
                          4⤵
                            PID:1088
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "schtasks /Query /TN "Microsoft\Windows\AudioDriverMaintenance""
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1092
                        • C:\Windows\System32\schtasks.exe
                          schtasks /Query /TN "Microsoft\Windows\AudioDriverMaintenance"
                          3⤵
                            PID:5088
                        • C:\Windows\System32\tar.exe
                          C:\Windows\System32\tar.exe -xzf sysaudio.tar.gz
                          2⤵
                            PID:296
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "net session"
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2772
                            • C:\Windows\System32\net.exe
                              net session
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2836
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 session
                                4⤵
                                  PID:3484
                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_boccm_1368_1783139732420\jre\bin\javaw.exe
                              C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_boccm_1368_1783139732420\jre\bin\javaw.exe --enable-native-access=ALL-UNNAMED -Dorg.sqlite.tmpdir=C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_boccm_1368_1783139732420\sqlite-native -DAGENT_PASSWORD=yd_7JY9Al17X2BPV91obFmkm -DAGENT_LOADER=1 -jar C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_boccm_1368_1783139732420\rtaudio-config.jar --vv-from-loader --vv-elevated
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:2488
                              • C:\Windows\SYSTEM32\tasklist.exe
                                tasklist /fi "imagename eq LsaIso.exe"
                                3⤵
                                • Enumerates processes with tasklist
                                PID:5600
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell.exe -NoProfile -Command "$avs = @(); try { Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction Stop | ForEach-Object { if ($_.displayName) { $avs += $_.displayName } } } catch {} if ($avs.Count -eq 0) { try { $s = Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($s -and $s.AntivirusEnabled) { $avs += 'Windows Defender' } } catch {} } if ($avs.Count -eq 0) { 'None' } else { ($avs | Select-Object -Unique) -join ', ' }"
                                3⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2904
                              • C:\Windows\SYSTEM32\tasklist.exe
                                tasklist /fi "imagename eq LsaIso.exe"
                                3⤵
                                • Enumerates processes with tasklist
                                PID:5608
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im chrome.exe
                                3⤵
                                • Kills process with taskkill
                                PID:5716
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im brave.exe
                                3⤵
                                • Kills process with taskkill
                                PID:1420
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im msedge.exe
                                3⤵
                                • Kills process with taskkill
                                PID:5476
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im opera.exe
                                3⤵
                                • Kills process with taskkill
                                PID:2420
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im firefox.exe
                                3⤵
                                • Kills process with taskkill
                                PID:1696
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im librewolf.exe
                                3⤵
                                • Kills process with taskkill
                                PID:3040
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im waterfox.exe
                                3⤵
                                • Kills process with taskkill
                                PID:4116
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im zen.exe
                                3⤵
                                • Kills process with taskkill
                                PID:1408
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im vivaldi.exe
                                3⤵
                                • Kills process with taskkill
                                PID:556
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im browser.exe
                                3⤵
                                • Kills process with taskkill
                                PID:1188
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im QQBrowser.exe
                                3⤵
                                • Kills process with taskkill
                                PID:5256
                              • C:\Windows\SYSTEM32\taskkill.exe
                                taskkill /f /im 360chrome.exe
                                3⤵
                                • Kills process with taskkill
                                PID:5368
                              • C:\Windows\System32\Wbem\wmic.exe
                                wmic process where name='firefox.exe' get ExecutablePath /format:list
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5768
                              • C:\Windows\System32\Wbem\wmic.exe
                                wmic process where name='firefox.exe' get ExecutablePath /format:list
                                3⤵
                                  PID:5188
                            • C:\Windows\System32\sihclient.exe
                              C:\Windows\System32\sihclient.exe /cv ccvIj43pzU68qyEhpV08OQ.0.1
                              1⤵
                                PID:2420
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                1⤵
                                  PID:4968
                                • C:\Windows\System32\SecurityHealthHost.exe
                                  \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                  1⤵
                                    PID:2460

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        java.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\java.dll
                                        • Size 115KB
                                        • SHA256 f947a8502607c2986055cf20fe61c18041ec331abdc3c2b609b1efa3bdeec59d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        javaw.exe
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\javaw.exe
                                        • Size 53KB
                                        • SHA256 493beaf1d4822fb8ad21aa7d47e3cb46b1ad412411facd12f09c543eee426d2e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        jimage.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\jimage.dll
                                        • Size 32KB
                                        • SHA256 1478c45015feb960cc325083cbef99329f3a3126b68042617bc2acebf3619b99
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        jli.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\jli.dll
                                        • Size 82KB
                                        • SHA256 608e56714647c81d7d6427635434dbf5cfeccd382dbd0062cd6a8d1237531ef5
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        msvcp140.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\msvcp140.dll
                                        • Size 562KB
                                        • SHA256 b99eb28a471311113f5c4109cb3c463f39cfd9bdb3b07f706204dedddb4516a1
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        net.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\net.dll
                                        • Size 60KB
                                        • SHA256 010c2907c561c5c59ac89db8ae494c66424671046b5801cc72d61a1ee2b7f0a0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        nio.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\nio.dll
                                        • Size 80KB
                                        • SHA256 e5409b158d828348e0fb64715cf4affd6d5bbdce425f9044528c4b923dcb9685
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        jvm.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\server\jvm.dll
                                        • Size 14.3MB
                                        • SHA256 39249fe92aed1851d0617895a59de4bfe927e95427a515a439c8af6a1825a0c7
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        vcruntime140.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\vcruntime140.dll
                                        • Size 117KB
                                        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        vcruntime140_1.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\vcruntime140_1.dll
                                        • Size 48KB
                                        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        verify.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\verify.dll
                                        • Size 54KB
                                        • SHA256 fd69565f0dbdc67757ef3a549ace7c195c9da5bfd1c126fd8079aab23afaf015
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        zip.dll
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\bin\zip.dll
                                        • Size 82KB
                                        • SHA256 d3a2992d60e922bb1bb922bf1bef32b11b101c0c90dc2887a9ee9e180d1cdf09
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        logging.properties
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\conf\logging.properties
                                        • Size 2KB
                                        • SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        net.properties
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\conf\net.properties
                                        • Size 7KB
                                        • SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        java.security
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\conf\security\java.security
                                        • Size 73KB
                                        • SHA256 ddcc00ca7a7490110f399631c76c247612f2a443ad0b59dd36ecdb207d170e54
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        default_US_export.policy
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\conf\security\policy\unlimited\default_US_export.policy
                                        • Size 146B
                                        • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        default_local.policy
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\conf\security\policy\unlimited\default_local.policy
                                        • Size 193B
                                        • SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        COPYRIGHT
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\legal\java.sql\COPYRIGHT
                                        • Size 35B
                                        • SHA256 7afb3a2dc57cb16223dddc970e0b464311e5311484c793abf9327a19ef629018
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        LICENSE
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\legal\java.sql\LICENSE
                                        • Size 33B
                                        • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        jvm.cfg
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\lib\jvm.cfg
                                        • Size 29B
                                        • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        modules
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\lib\modules
                                        • Size 24.4MB
                                        • SHA256 4401b98cf775ac938ab0a0aab3467ed9d66e1731f59e19f6ec975e23273f1d31
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        tzdb.dat
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\lib\tzdb.dat
                                        • Size 100KB
                                        • SHA256 36cf71e63ce2816fe4456e9195e6c27fa7c9cd431c89ba762eba394ec2c7a1e3
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        tzmappings
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\lib\tzmappings
                                        • Size 15KB
                                        • SHA256 3929ab1380771d0d542d91cfbae02ce519a76678f5f63813739a6c6b98dc6d72
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        release
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\jre\release
                                        • Size 181B
                                        • SHA256 3b4e44516b76d16f4ce53546ec99893a5fcb4d5637bba8f14157c9c849c754b6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        panel.token
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\panel.token
                                        • Size 24B
                                        • SHA256 65788864e2e6a63df19bf8ae965960dacee8c7b7bc6cb00974740c0b8a85adeb
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        rtaudio-config.jar
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\rtaudio-config.jar
                                        • Size 16.5MB
                                        • SHA256 e615df71755d3afd51d81254e915753e2142a6323ef29b57ecdcfc4858f5687d
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        runtime-trace.log
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\runtime-trace.log
                                        • Size 5KB
                                        • SHA256 ba47c46f686ffe84fac6a801afeb213b73df33c067f05fe14b5e196f7b64c84e
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        sysaudio.tar.gz
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_ayoem_4992_1783139725111\sysaudio.tar.gz
                                        • Size 32.5MB
                                        • SHA256 ebf882e4fc2afc82afdeb6ff48da8d94f8488ceb39d72b69c6a9a8a6a0b0fc21
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        runtime-trace.log
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Audio_boccm_1368_1783139732420\runtime-trace.log
                                        • Size 5KB
                                        • SHA256 88dec2a4b523a5a37ea298bd47ac1c1308afccb81fc679222509cbe8e91f524a
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        AudioDriverSetup.elevated
                                        • Path C:\Users\Admin\AppData\Local\Temp\AudioDriverSetup.elevated
                                        • Size 1B
                                        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        __PSScriptPolicyTest_cqwmjstw.qj3.ps1
                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cqwmjstw.qj3.ps1
                                        • Size 60B
                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        jna17930976121349489476.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna17930976121349489476.dll
                                        • Size 248KB
                                        • SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cookies.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\cwcjgr1t\Browser-Datas\google_chrome\default\cookies.txt
                                        • Size 281B
                                        • SHA256 cd2c61eefad1174ac8c0a70203c78552da1bd55ebb03be35f02b5fb0be50a968
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        logs.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\cwcjgr1t\logs\logs.txt
                                        • Size 1KB
                                        • SHA256 8c4da97c52bb13e7059b11d7d2f0e8f376f6788da38a52cb604a0682f2df3b9c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        logs.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\cwcjgr1t\logs\logs.txt
                                        • Size 2KB
                                        • SHA256 66c49b3fc80ef79941428eca1c7d552b336349547892d5bf667144a44984d005
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        logs.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\cwcjgr1t\logs\logs.txt
                                        • Size 4KB
                                        • SHA256 66f8383e4a7ef0e82a1ac9a19165c42824539cc8f21904efc9275b8acebf9831
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        cookies.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\h054q6ky\Browser-Datas\firefox\cyjywaoz.default-release\cookies.txt
                                        • Size 29B
                                        • SHA256 ec7d530ef7080f72c121ce737dcfb856a2682425bcf991c5417121b2abfc0af8
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        passwords.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\h054q6ky\Browser-Datas\firefox\cyjywaoz.default-release\passwords.txt
                                        • Size 21B
                                        • SHA256 b5986779043d6e3a7e9f411159ba2ef39847b28a39d4b020ac9b60c70ca95de2
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        passwords.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\h054q6ky\Browser-Datas\google_chrome\default\passwords.txt
                                        • Size 13B
                                        • SHA256 de1de509b079d79461dba95b1abb857faab70698ca9a8e1fc562ca647b1debd4
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        logs.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\h054q6ky\logs\logs.txt
                                        • Size 1KB
                                        • SHA256 bfdc46f4821c195b0a314c4fde86c09563a3852981e81d69a515eaebf0e1fa48
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        logs.txt
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\h054q6ky\logs\logs.txt
                                        • Size 4KB
                                        • SHA256 8887c2b54eec71cd323f9df338a73579bbbf4eccf7e1f1bde4168c6cea1d5cd0
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        sqlite-3.45.1.0-f16205ab-cbb4-4233-947a-6bff3639fd1f-sqlitejdbc.dll
                                        • Path C:\Users\Admin\AppData\Local\Temp\vv\h054q6ky\sqlite-native\sqlite-3.45.1.0-f16205ab-cbb4-4233-947a-6bff3639fd1f-sqlitejdbc.dll
                                        • Size 946KB
                                        • SHA256 d7098290c4f013c6cbfb731e4db28053e377fdd34f3a41811eccfb485c3efb49
                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                        Submit Download

                                        memory/2036-623-0x00007FFB5BCA0000-0x00007FFB5BD94000-memory.dmp
                                        Download

                                        memory/2376-231-0x000001F8B1220000-0x000001F8B124A000-memory.dmp
                                        Download

                                        memory/2376-232-0x000001F8B1220000-0x000001F8B1244000-memory.dmp
                                        Download

                                        memory/2376-230-0x000001F8B11C0000-0x000001F8B11CA000-memory.dmp
                                        Download

                                        memory/2376-229-0x000001F8C9380000-0x000001F8C9432000-memory.dmp
                                        Download

                                        memory/2376-228-0x000001F8B11D0000-0x000001F8B11EE000-memory.dmp
                                        Download

                                        memory/2376-225-0x000001F8B0CD0000-0x000001F8B0CF2000-memory.dmp
                                        Download

                                        memory/2488-1085-0x00007FFB4EA40000-0x00007FFB4EB34000-memory.dmp
                                        Download

                                        memory/2904-732-0x00000226361C0000-0x0000022636272000-memory.dmp
                                        Download