b71863e4459ce0a3fa101654a8656292acec9b5efb793c313802f3d1eaaae065

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hitpaw-voice-changer.exe
Size

2.3MB
MD5

6cb59f3cd72baed6db3ae114087719af
SHA1

427508988de6ce60fd12bfe74cd107a38526bca7
SHA256

b71863e4459ce0a3fa101654a8656292acec9b5efb793c313802f3d1eaaae065
SHA512

31cc0e14f58b6d27fa7205726894af5c259d7e21a6b74096b39ac3cb7616fe0edeb9dfbf1e081d55723c916209729244ff045e36d0b41bb1df0e6c74599c435e
SSDEEP

49152:QGoZcd8pmpht5asIFZkX1TjXf+phuN7UkQimu0Bx0KY8D2kwU3Ut4E3K:QZcGI35aZFCX9Lf+poN7qTZBhpD2kp3b

Score

8^/10

discovery upx vmprotect

Malware Config

Signatures

Downloads MZ/PE file

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3004-0-0x0000000000400000-0x0000000000863000-memory.dmp	upx
behavioral1/memory/3004-200-0x0000000000400000-0x0000000000863000-memory.dmp	upx
behavioral1/memory/3004-206-0x0000000000400000-0x0000000000863000-memory.dmp	upx
behavioral1/memory/3004-210-0x0000000000400000-0x0000000000863000-memory.dmp	upx
behavioral1/memory/3004-252-0x0000000000400000-0x0000000000863000-memory.dmp	upx

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000400000001cbc0-727.dat	vmprotect
behavioral1/files/0x000400000001cbc0-3557.dat	vmprotect
behavioral1/files/0x000400000001cbc0-3566.dat	vmprotect
behavioral1/files/0x000400000001cbc0-3575.dat	vmprotect
behavioral1/files/0x000400000001cbc0-3574.dat	vmprotect
behavioral1/files/0x000400000001cbc0-3573.dat	vmprotect
behavioral1/files/0x000400000001cbc0-3572.dat	vmprotect

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\SET53DD.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\SET53DD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\SET53DB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\vbaudio_cable64_win7.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\vbaudio_cable64_win7.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\vbmmecable64_win7.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\SET53DB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\SET53DC.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\SET53DC.tmp	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\platforminputcontexts\qtvirtualkeyboardplugin.dll	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls\Private\is-A3S6A.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\ssleay32.dll	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls\is-US5JJ.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls\Styles\Base\images\is-HLSHI.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick3D\Effects\is-0Q174.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick3D\Materials\maps\is-08B7U.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\is-I248S.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\API-MS-Win-core-file-l2-1-0.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\api-ms-win-core-localization-l1-2-0.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Templates.2\qtquicktemplates2plugin.dll	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQml\is-7V8UP.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls.2\Universal\is-R3QOV.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\is-I2OQ5.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\PublicPlugin\is-P1DOS.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\InstallerProcess\api-ms-win-core-memory-l1-1-0.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\HelpService\api-ms-win-crt-private-l1-1-0.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls.2\Universal\qtquickcontrols2universalstyleplugin.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\api-ms-win-crt-utility-l1-1-0.dll	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtGraphicalEffects\is-NJEDG.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\qmltooling\qmldbg_messages.dll	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\is-VTUO8.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\is-99NAK.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\InstallerProcess\is-626P2.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls\Styles\Desktop\is-GRH0E.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\FileReport.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\mediaservice\qtmedia_audioengine.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\api-ms-win-core-util-l1-1-0.dll	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\is-QMEIU.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\CustomJson\Thumb\is-PMBIB.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\mediaservice\is-J3G5D.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls\Styles\Base\images\is-G5MA4.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Dialogs\qml\is-68U3E.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\is-49OBG.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\is-LH9IG.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\is-VA510.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\is-EINUL.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\is-9IK1R.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\CustomJson\is-J9STG.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\CustomJson\Thumb\is-VLR5H.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\lang\translation1.0.0\is-M1RVM.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls.2\Fusion\is-3PKOH.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls\is-EKO1M.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls\Private\is-BU1M9.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\is-2F2T2.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\swresample-4.dll	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\imageformats\is-7AN56.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls.2\Imagine\is-65QPG.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls.2\Universal\is-JEC8V.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Dialogs\is-T7QCK.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Extras\Private\is-FSQRF.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\qmltooling\qmldbg_preview.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\api-ms-win-crt-heap-l1-1-0.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\msvcr120.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\API-MS-Win-Eventing-ClassicProvider-L1-1-0.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\api-ms-win-core-localization-l1-2-1.dll	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick\Controls\Styles\Desktop\is-ARRDC.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\temIma\is-BVECC.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\Qt5QmlModels.dll	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\temIma\is-434BG.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File created	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\is-KRM28.tmp	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vst\API-MS-Win-core-file-l2-1-1.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-datetime-l1-1-0.dll	voicechanger_hitpaw_1.0.0.0.tmp
File opened for modification	C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick3D\Materials\qtquick3dmaterialplugin.dll	voicechanger_hitpaw_1.0.0.0.tmp

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	devconX64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devconX64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 5 IoCs

pid	Process
1168	voicechanger_hitpaw_1.0.0.0.exe
1144	voicechanger_hitpaw_1.0.0.0.tmp
2636	InstallVirtualAudio.exe
3024	devconX64.exe
296	devconX64.exe

Loads dropped DLL 42 IoCs

pid	Process
3004	hitpaw-voice-changer.exe
1168	voicechanger_hitpaw_1.0.0.0.exe
1144	voicechanger_hitpaw_1.0.0.0.tmp
1144	voicechanger_hitpaw_1.0.0.0.tmp
1144	voicechanger_hitpaw_1.0.0.0.tmp
1380	Process not Found
1380	Process not Found
1380	Process not Found
1380	Process not Found
1144	voicechanger_hitpaw_1.0.0.0.tmp
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2636	InstallVirtualAudio.exe
2128	Process not Found
2396	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2956	tasklist.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	hitpaw-voice-changer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	hitpaw-voice-changer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	hitpaw-voice-changer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	hitpaw-voice-changer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2636	InstallVirtualAudio.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3004	hitpaw-voice-changer.exe
1144	voicechanger_hitpaw_1.0.0.0.tmp
1144	voicechanger_hitpaw_1.0.0.0.tmp

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	tasklist.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	3024	devconX64.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1992	DrvInst.exe
Token: SeRestorePrivilege	1936	rundll32.exe
Token: SeRestorePrivilege	1936	rundll32.exe
Token: SeRestorePrivilege	1936	rundll32.exe
Token: SeRestorePrivilege	1936	rundll32.exe
Token: SeRestorePrivilege	1936	rundll32.exe
Token: SeRestorePrivilege	1936	rundll32.exe
Token: SeRestorePrivilege	1936	rundll32.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3004	hitpaw-voice-changer.exe
1988	SndVol.exe
1988	SndVol.exe
1144	voicechanger_hitpaw_1.0.0.0.tmp

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1988	SndVol.exe
1988	SndVol.exe
1988	SndVol.exe
1988	SndVol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2636	InstallVirtualAudio.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1168	3004	hitpaw-voice-changer.exe	30
PID 3004 wrote to memory of 1168	3004	hitpaw-voice-changer.exe	30
PID 3004 wrote to memory of 1168	3004	hitpaw-voice-changer.exe	30
PID 3004 wrote to memory of 1168	3004	hitpaw-voice-changer.exe	30
PID 3004 wrote to memory of 1168	3004	hitpaw-voice-changer.exe	30
PID 3004 wrote to memory of 1168	3004	hitpaw-voice-changer.exe	30
PID 3004 wrote to memory of 1168	3004	hitpaw-voice-changer.exe	30
PID 1168 wrote to memory of 1144	1168	voicechanger_hitpaw_1.0.0.0.exe	31
PID 1168 wrote to memory of 1144	1168	voicechanger_hitpaw_1.0.0.0.exe	31
PID 1168 wrote to memory of 1144	1168	voicechanger_hitpaw_1.0.0.0.exe	31
PID 1168 wrote to memory of 1144	1168	voicechanger_hitpaw_1.0.0.0.exe	31
PID 1168 wrote to memory of 1144	1168	voicechanger_hitpaw_1.0.0.0.exe	31
PID 1168 wrote to memory of 1144	1168	voicechanger_hitpaw_1.0.0.0.exe	31
PID 1168 wrote to memory of 1144	1168	voicechanger_hitpaw_1.0.0.0.exe	31
PID 1144 wrote to memory of 2980	1144	voicechanger_hitpaw_1.0.0.0.tmp	34
PID 1144 wrote to memory of 2980	1144	voicechanger_hitpaw_1.0.0.0.tmp	34
PID 1144 wrote to memory of 2980	1144	voicechanger_hitpaw_1.0.0.0.tmp	34
PID 1144 wrote to memory of 2980	1144	voicechanger_hitpaw_1.0.0.0.tmp	34
PID 1144 wrote to memory of 2636	1144	voicechanger_hitpaw_1.0.0.0.tmp	40
PID 1144 wrote to memory of 2636	1144	voicechanger_hitpaw_1.0.0.0.tmp	40
PID 1144 wrote to memory of 2636	1144	voicechanger_hitpaw_1.0.0.0.tmp	40
PID 1144 wrote to memory of 2636	1144	voicechanger_hitpaw_1.0.0.0.tmp	40
PID 2636 wrote to memory of 1284	2636	InstallVirtualAudio.exe	41
PID 2636 wrote to memory of 1284	2636	InstallVirtualAudio.exe	41
PID 2636 wrote to memory of 1284	2636	InstallVirtualAudio.exe	41
PID 1284 wrote to memory of 2484	1284	cmd.exe	43
PID 1284 wrote to memory of 2484	1284	cmd.exe	43
PID 1284 wrote to memory of 2484	1284	cmd.exe	43
PID 2636 wrote to memory of 296	2636	InstallVirtualAudio.exe	44
PID 2636 wrote to memory of 296	2636	InstallVirtualAudio.exe	44
PID 2636 wrote to memory of 296	2636	InstallVirtualAudio.exe	44
PID 2636 wrote to memory of 3024	2636	InstallVirtualAudio.exe	45
PID 2636 wrote to memory of 3024	2636	InstallVirtualAudio.exe	45
PID 2636 wrote to memory of 3024	2636	InstallVirtualAudio.exe	45
PID 1992 wrote to memory of 1936	1992	DrvInst.exe	49
PID 1992 wrote to memory of 1936	1992	DrvInst.exe	49
PID 1992 wrote to memory of 1936	1992	DrvInst.exe	49

C:\Users\Admin\AppData\Local\Temp\hitpaw-voice-changer.exe
"C:\Users\Admin\AppData\Local\Temp\hitpaw-voice-changer.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\voicechanger_hitpaw\voicechanger_hitpaw_1.0.0.0.exe
  /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\" /LANG=en /LOG="C:\Users\Admin\AppData\Local\Temp\HitPaw Voice Changer_Setup_20230921162740.log" /sptrack null
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Users\Admin\AppData\Local\Temp\is-BBH0C.tmp\voicechanger_hitpaw_1.0.0.0.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-BBH0C.tmp\voicechanger_hitpaw_1.0.0.0.tmp" /SL5="$301E2,297482823,711680,C:\Users\Admin\AppData\Local\Temp\voicechanger_hitpaw\voicechanger_hitpaw_1.0.0.0.exe" /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\" /LANG=en /LOG="C:\Users\Admin\AppData\Local\Temp\HitPaw Voice Changer_Setup_20230921162740.log" /sptrack null
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /nh|find /c /i "VoiceChanger.exe" > "C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt"
      4⤵
      PID:2980
    - - C:\Windows\SysWOW64\find.exe
        
        find /c /i "VoiceChanger.exe"
        5⤵
        
        PID:2652
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /nh
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
  - - C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\InstallVirtualAudio.exe
      "C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\InstallVirtualAudio.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\system32\cmd.exe
        
        cmd /c certutil -addstore TrustedPublisher hitpawVdevicecertificate.cer
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1284
      - C:\Windows\system32\certutil.exe
        
        certutil -addstore TrustedPublisher hitpawVdevicecertificate.cer
        6⤵
        
        PID:2484
    - - C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\devconX64.exe
        
        "C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\devconX64.exe" remove VBAudioVACWDM
        5⤵
        Executes dropped EXE
        
        PID:296
    - - C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\devconX64.exe
        
        "C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\devconX64.exe" install "C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\vbMmeCable64_win7.inf" VBAudioVACWDM
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024

C:\Windows\system32\SndVol.exe
SndVol.exe -f 45941909 22387
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1988

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5925bfb1-04b1-78bb-72b8-7448310aea20}\vbmmecable64_win7.inf" "9" "612cfd737" "0000000000000304" "WinSta0\Default" "00000000000003D4" "208" "c:\program files (x86)\hitpaw\hitpaw voice changer"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{42081e04-2ab6-209a-ed25-e06f6eb28e0d} Global\{6f2509b9-d9d1-0627-d333-426008ce7257} C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\vbmmecable64_win7.inf C:\Windows\System32\DriverStore\Temp\{1ca5f370-8201-0193-b1db-a063e05a583b}\vbaudio_cable64_win7.cat
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\InstallVirtualAudio.exe

Filesize
895KB

MD5
4815e858d7457f4cd8ce13faa8186a3d

SHA1
c56d29addbe0036d66c3fb2166e469f447f7401e

SHA256
9a11a7de5bbf3317a29c25b44ead2549c9db2d2056a35145e69ca9a2768bc5e6

SHA512
f9320ccb88b6167722c9f33ccc290b0ba4f1817423447006ab06fc03646452e91c8965709ad88fba4b551ea939651457df9008e9b14b8be2e790a6a5cea812c8

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\MSVCP140.dll

Filesize
576KB

MD5
47101de0dc287f47718c99c7dd19146e

SHA1
55ee57772bd6d6b8f9d786e199e11336b38b8c42

SHA256
a2cb9cae4b86468ca44ba36320814a204ec8ad311df624b94e12c47e328e2726

SHA512
1e589eebc5bee03d28e977d2fa6c22f6288dcb6758284ff5f2639acbcebed19c859c2a9552971e1ddc50042bceeebd96efdb057b8c342be12d17c1f9583f6deb

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\MSVCP140_1.dll

Filesize
30KB

MD5
d7bbb9be0463447175e25a40e3a5b660

SHA1
103540a5b5ded40495b69f5e79bb7485719c78b3

SHA256
52c8dfad63aaf7284fe5fa2ac57d406206c420e389a77bd9a5e2a126f6deeaf0

SHA512
c0db8dec9622beeb0246978e2eb7e8dfb97ccd21c9170a0d9404a5d2b785d3bf56fc048dbdd7a385f06577fd609ca54682fb146083c0f511e868922b9685d167

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\Qt5Core.dll

Filesize
5.8MB

MD5
b2b77282c8f09de9c77bd486a94a1676

SHA1
78758728c039ecc6ce77f45cc70408a49b0fa4e6

SHA256
60b21a618c7f4ee015b8060dd8a64e9fb39c5167ff369eba8aeaaa29290c3485

SHA512
dacd2643397ecc6d45859fc202480ba964782b6334c017095ee02888cfbdddd3b91621ba6d2fe34c51a4c7166413f89bfd2409ac23d89b712587dce95cf9caa5

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\Qt5Gui.dll

Filesize
6.7MB

MD5
6d50542785d7962382c3756cd85ca12c

SHA1
4838742895b3a2450031d6c90768fe9bc9722f33

SHA256
0323c7fbd9a579f339b597b3e5f5b6e02814ae594f7fbc0cdd1786a5a32551ac

SHA512
c3f6ce45a901032052453565b01516a5ae81c41580e8dbdeffc45920692f8e7cdd0c4149c30ca07867be11f3964c6528f78a2de948d5eaa9aa1bab6f2b8cea0e

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\Qt5Widgets.dll

Filesize
5.3MB

MD5
220bf38b520fb1e7fcdb36b514fdea46

SHA1
b143c471b47b2c524e35305ba977cbf9d54edc23

SHA256
54f56144d8e1199f548a2462519c1c2e42fb49faf15fba19c032284e82f1c883

SHA512
59a48600f80ce86e41eaf8ef61211754447de331ff9f5d8ab3fe6e1d2a4f55533824a32e1c4e6d99df430b784fe835d421cd646bd371d439e8ea4495ee7ddffa

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\QtQuick3D\Materials\maps\is-0ABH0.tmp

Filesize
334B

MD5
882310febbcd112f6416015145fd8c6d

SHA1
e142d0ba597a2c773e6354673bbc4a760f8d963f

SHA256
03003aa01026e944b75447078f5758d0ffab854d03e9ce80780a174411073f7f

SHA512
b21d8a189123c3019b5c99c1927d9eb10293cbe9321cb54d1fe183bf57efd22f778a61e47be27afb8f54d731ce17f96a6c6452dc76c3a8596b1bf1fdd532d4c4

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\VCRUNTIME140.dll

Filesize
99KB

MD5
18571d6663b7d9ac95f2821c203e471f

SHA1
3c186018df04e875d6b9f83521028a21f145e3be

SHA256
0b040a314c19ff88f38fd9c89dca2d493113a6109adb8525733c3f6627da888f

SHA512
c8cbca1072b8cb04f9d82135c91ff6d7a539cb7a488671cecb6b5e2f11a4807f47ad9af5a87ebee44984ab71d7c44fc87850f9d04fd2c5019ec1b6a1b483ca21

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\VCRUNTIME140_1.dll

Filesize
43KB

MD5
a4f89ffc725ccae3c7bbcb9a0c91302f

SHA1
531194dad6795b3cb50b02501b0856efa694dd36

SHA256
bbcea93943f7e28a4d904301ff4bb708adaec4cc27800020044085fb838d4e5d

SHA512
c8ce2dcb65cd1fd0a7ffdc1df0076be2882badac7082b49ff96ec2ca1e944ccab8699ab28901a895cca90783cd223434552e366103fb6fcd25d9ad033b95eedf

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\VoiceChanger.exe

Filesize
25.0MB

MD5
550fae128c06df19d72d3b6db37d2d9f

SHA1
bb97e5b21cbcd39e69fae0c456872620021993fb

SHA256
07898657f10114839e4cc6a8dd5d6f72ece1a8b26dc4bfba51507d415afd7497

SHA512
7179cc7958373fec4b88ad7eeac4c6ee475924d64f0ed5f44959294adfcb5274ea32076d3ee4493d5062f457e3282560946bf01b16a072a4b904a6810c59e0d3

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
9d8413744097196f92327f632a85acee

SHA1
dfc07f5e5a0634dd1f15fdc9ff9731748fbff919

SHA256
6878d8168d5cc159efe58f14e5ba10310d99b53ab8495521e54c966994dac50b

SHA512
a8f6e9ee1c5d65f68b8b20d406d3e666c186e15cb3b92575257b5637fe7dd5ac7d75e9ad51c839ba4490512f68f6b48822fc9edd316dd7625d3627d3b975fb2a

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
361c6bcfcea263749419b0fbed7a0ce8

SHA1
03db13108ce9d5fc01cecf3199619ffbccbd855a

SHA256
b74aefd6fa638be3f415165c8109121a2093597421101abc312ee7ffa1130278

SHA512
aa8b585000cc65f9841b938e4523d91d8f6db650e0b4bb11efd740c27309bf81cdb77f05d0beda2489bf26f4fbc6d02c93ce3b64946502e2c044eea89696cc76

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
b402ed77d6f31d825bda175dbc0c4f92

SHA1
1f2a4b8753b3aae225feac5487cc0011b73c0eb7

SHA256
6ed17fb3ca5156b39fbc1ef7d1eefa95e739857607de4cd8d41cecfcd1350705

SHA512
ec04013139f3fd9dbf22b92121d82b2eb97e136f8619790cde2d0b660280e838962f9006d3e4c3a359627b017f2b6ade7edff3bbc26e559c3de37540585602d9

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
19KB

MD5
3d872be898581f00d0310d7ab9abaf2b

SHA1
420e0ab98bb748723130de414f0ffed117ef3f7e

SHA256
4de821884cbef4182b29d8c33cfe13e43e130ad58ee1281679e8d40a2edcb8ea

SHA512
35cfb9888a5f4299403a0d9c57f0ba79e3625431a9acc5e04ae2ae101b3dc521a0dcff5d4a1bf508b25dbf05dd432f6987d860ff494d15538ed95673a8b7376b

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-synch-l1-2-0.dll

Filesize
19KB

MD5
1742da4d8df54767064bcb50b4b5c32d

SHA1
50f0ae8e41f0eb2573f41b308882610c6897c574

SHA256
e000c6685719c2b07355c1eddbfdae7c6794aa6c0ac883d34af33dfc8bf40779

SHA512
99823ea5553cede3a0c8c19a3bdd18e31e2ba92bf7ee4808257b660f621de66eb596cfcb7be5c13ebe8ddd3759809f258c4ecdd72d8d39d9c2d10b9624cb3d95

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
6c180c8de3ecf27de7a5812ff055737e

SHA1
3aad20b71bb374bb2c5f7431a1b75b60956a01fd

SHA256
630466fd77ac7009c947a8370a0d0c20652169824c54ddcb8c05e8df45e23197

SHA512
e4aa79eb2b6b3be9b545e8cb8b43cd6052036dc5cce7077be40441b9942931b30d76c475d550a178d4e94c9c366cabc852f500e482b7fdcd361fc2a08e41c00e

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
d749afffa2b3be4b2a9edac50c20b28b

SHA1
972253ed12c344b85290f7b3d5f9608a7f7b0670

SHA256
e64fbac3491b4693e79a3f7b0db1d788f93608d3fc82133edf25a868c80d2153

SHA512
4447b6960a6c178f7c37dbd38e9aec24ba5a0c58e19afcfaa2b70dca7d7bbe87ad7aa1ac9d48ab9b56b1f375768d4c4cb28d5afcf714102f9757faa2b3e728d9

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-environment-l1-1-0.dll

Filesize
19KB

MD5
7a2874fe036f7dc86ed5f712adaa38e6

SHA1
440f2dc5379ceee35d29571c195dc7a76e8b70e7

SHA256
dd054e4de84144c2130fa8d28d563252a7c4089a58872e49d63bc43c9a1a3cb8

SHA512
d20811025f714b5fd3754d607422f4fb5cd6c456ffceef139edcb0cfaacd9b63a694ce2ea737db78385f0b23ddcfc283282a319b79e7a0e4bd50034e87aacb9a

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
73e14d927d075ca273b3237116351e8f

SHA1
0c15cea3c83c7f7e692dc6f8bd856b615c727d49

SHA256
966a7f15bfb2e0ff7888d583638ebd675d8f46b264194cf332f78140b7c129e1

SHA512
664f72d7adf48f8499321f8a5df952c6043532aae09bae9ffbd59da77b161cd43211a3aaef1ba85529dfe00498d1ac3a933a7c9cf437095c6a337c9bc0816b3f

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
01370c79ebabd534e7b58d35072d2866

SHA1
8cd0cd21ff838a2a314246def4bd858bab184a5d

SHA256
742bb9bf4c232f84ad8008af4af8eda7a1ec3eb76f05d9d7ebb95f6a5cabd2d8

SHA512
b07d9634ac804b476d61b6a0fc87894947e88744cc3eecf7d68ede3714acd938fae14452e43f9110919b8f8f9f5d4222e9de2ca97a915dd07b3231d674729761

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-locale-l1-1-0.dll

Filesize
19KB

MD5
bacb72fa56de18d5ac63e4a0a3fe768f

SHA1
7db19efe649d30337781afd62616c0549255046e

SHA256
25905676b543c4f05e9dae135f929c03a57686a6941ce59be2b3450521feb943

SHA512
78d82962c11e5928e77c5bd0377ecb6b00c2eca242d637f76e68fbf907bce7381f3a5294100d055c30f6e2aee164db0b95dcf0c0c77e39edcec4a046cfc63ed4

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
85893a96a568ba9781f50f876ed303cd

SHA1
fb7473bc5b1e88e978b7e5664b45d69770c8f4fa

SHA256
08e34f12de24e89379a0533f21a23ce6fecbea05d4062796d4ffd4adc3012316

SHA512
864fa39423b8ca9c43fa177aca1484ec2ffae4868a434e7a8016efe88f396b67fb8ca3766f611de7218e9983653a8b7b88b07c2591b252dd93a0d9638980e7ff

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
23KB

MD5
55b80c522731ecb92914bf9cded028c2

SHA1
424c61bc659caf04281959ede1b1f03b703934ed

SHA256
4c787ff8d40bb803e75fe6218fec36a672cfa6cfc7f6e80e68a7eb0b77a10e5a

SHA512
3779b530c7dba624369cb0f5d15154d89547adc3c4c7cc0571f1e8326588165098b9b5768d0052ecf1ea4f2dc84ae7dcf4712e3bc9ebdadb5fca4b0f4de43812

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
4614d03a94d46c0e9d1c5d96a3fe1d78

SHA1
cacb73ca3c7e31a4b8f749854060b7a422497050

SHA256
c7919be431ce2fa1906ff9eeb19e4cb19a30a4680107ef8737ce894654b21a5a

SHA512
4f30e8c5893662d7889a049c206b08559ad1a34eb7927be313086d6dae40dca3571de3852dba2ad9324e028fa86e8a391a58ec48ba5dbd5c4a88660ffe8b30df

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
7a2799f4bc45505e7104e06dc8e254f8

SHA1
323bc35e0101b351a4abde1fce698520832518a8

SHA256
92f72f495a6897f7d7cf2c2064b2b65f6b4fbd4f30911a534a5cd0de73395ebe

SHA512
2627da183779f17fcc9709a6da2e2916a296f61124adb9bf563c80d723ada9b769806cab8fbc4ed916f54fd4cde18f25e7ad53ed6c75e7e61fdef37c2f1ec9b2

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-time-l1-1-0.dll

Filesize
21KB

MD5
38b633f132f8e2b3abc268537fa415ec

SHA1
ccccb8c3e31dce7b6b952022d245c11ff3ae8122

SHA256
46cb7b3a9f8aac5adcdbe23494e458f3195adf4b8ed1c71f2d934ddde651e57e

SHA512
23bd77d61c20b1af7f13b5bcbeb9fa74ee807f809bb3d4dd40c7709ca4870078fa6e8e94eefc83a725c0245c0ce02e3adbd4f370d6b986f0c9442ccbc2c2ab96

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-utility-l1-1-0.dll

Filesize
19KB

MD5
5cde35104a68606913af6e5bd3b1adea

SHA1
f1f28141585c000753ab4db9ffc61f90929d4a1a

SHA256
111f6dd2e7247071a33d75bf98d521a8d09c4071f90483a82e6ed9af69bb52c4

SHA512
caa5f80ac380a6e0242104f297fbfe6091260d743ef967fb1010720dbcba2a575baf8cb1f666b11fe780428d71a04767e2cc63d1bd9638d5f1af1063e3f43f91

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\is-LEH2V.tmp

Filesize
381B

MD5
1e4a89b11eae0fcf8bb5fdd5ec3b6f61

SHA1
4260284ce14278c397aaf6f389c1609b0ab0ce51

SHA256
4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df

SHA512
8c290919e456a80d87dd6d243e4713945432b9a2bc158bfa5b81ae9fed1a8dd693da51914fa4014c5b8596e36186a9c891741c3b9011958c7ac240b7d818f815

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\ucrtbase.DLL

Filesize
1000KB

MD5
126821f73fd9ffce6e091cf9480e1b60

SHA1
d10bbe9b65c2c6f8fca6850d0b79cbc6ef04d691

SHA256
7b28f46f0a09cfd9129109a94b1c16c9c62eef46c09113c4c585d9bf0e69b2da

SHA512
e61ad6c90551022fc257be95f6296a9f7d5a7aeaabd5349d81b1b31ea69b75dc3397698331f363d9fc2b005d9289a06dc1dcc2078e74b52775e0aae64daea36e

Download Submit
C:\Program Files (x86)\HitPaw\HitPaw Voice Changer\unins000.exe

Filesize
1.7MB

MD5
4da42f641a95e8900a96d580dfdadcea

SHA1
a5b17aa4b5161743c5bddc004c920a6ecbd8f5e4

SHA256
32ae9e111052a961b9a09235e22ef244af5d661690b9a7d349b3ab68616ce481

SHA512
e5aadd02eb9f6d102d9019614f42f733f5e58b85ec48ab19f0eccbcf0a14d86c5c96a2f0aec3dad760cc63a3b5f7da4561eb2d55e5abd13044215e2404063e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab391C.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar394E.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BBH0C.tmp\voicechanger_hitpaw_1.0.0.0.tmp

Filesize
1.7MB

MD5
4da42f641a95e8900a96d580dfdadcea

SHA1
a5b17aa4b5161743c5bddc004c920a6ecbd8f5e4

SHA256
32ae9e111052a961b9a09235e22ef244af5d661690b9a7d349b3ab68616ce481

SHA512
e5aadd02eb9f6d102d9019614f42f733f5e58b85ec48ab19f0eccbcf0a14d86c5c96a2f0aec3dad760cc63a3b5f7da4561eb2d55e5abd13044215e2404063e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BBH0C.tmp\voicechanger_hitpaw_1.0.0.0.tmp

Filesize
1.7MB

MD5
4da42f641a95e8900a96d580dfdadcea

SHA1
a5b17aa4b5161743c5bddc004c920a6ecbd8f5e4

SHA256
32ae9e111052a961b9a09235e22ef244af5d661690b9a7d349b3ab68616ce481

SHA512
e5aadd02eb9f6d102d9019614f42f733f5e58b85ec48ab19f0eccbcf0a14d86c5c96a2f0aec3dad760cc63a3b5f7da4561eb2d55e5abd13044215e2404063e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\voicechanger_hitpaw\voicechanger_hitpaw_1.0.0.0.exe

Filesize
284.6MB

MD5
d0122e0255639f9979c3f7c5cb010abc

SHA1
1a1d6ffd343f7bcaf148113ebf322a32d001b422

SHA256
3e1f1b4ef5416ca3e23f229fe7a787bbbabc2c24464d1ff775fd926cb786908f

SHA512
2a9eff6ced34fd9090f660000937ff7750147861f3c8f8520dac11a0319440ecb98d7bbdb93885b8da17f9b6d9b2a6ac321b8d44dd3ce1756bea8d62801290de

Download Submit
C:\Users\Admin\AppData\Local\Temp\voicechanger_hitpaw\voicechanger_hitpaw_1.0.0.0.exe

Filesize
284.6MB

MD5
d0122e0255639f9979c3f7c5cb010abc

SHA1
1a1d6ffd343f7bcaf148113ebf322a32d001b422

SHA256
3e1f1b4ef5416ca3e23f229fe7a787bbbabc2c24464d1ff775fd926cb786908f

SHA512
2a9eff6ced34fd9090f660000937ff7750147861f3c8f8520dac11a0319440ecb98d7bbdb93885b8da17f9b6d9b2a6ac321b8d44dd3ce1756bea8d62801290de

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5925bfb1-04b1-78bb-72b8-7448310aea20}\vbaudio_cable64_win7.cat

Filesize
12KB

MD5
ba349313042d8faddfc1b4faa4294c57

SHA1
73807c3703fc47aa4efd39752ff16911d5afd0a5

SHA256
3ecaeeda7d03380a289fac80b4f88fa42953d2bb859e617239014b2872109fd7

SHA512
942ca3a8318212fed72421e0037ed96b7ba05f860def68cb966fab4efbb19cf486a78644620c472a357c711ceafa032643a3ab636ed1f3af765189d3f4f30a40

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5925bfb1-04b1-78bb-72b8-7448310aea20}\vbaudio_cable64_win7.sys

Filesize
40KB

MD5
e7204d7fd7362f0efaa502a4cb91ca1e

SHA1
6ca8b4db6f9887b96dc1a38db85c688bb6b7ac5f

SHA256
c7f3be383c81ab9aa642479f95872e40e19a4cfd72d4c8d7de80abc11b713e21

SHA512
70f5b6356e42c88cb0e4ce65e6d2f4d634b057609ed1423339194d762e5f9a5125cfb87be919d5692f289f2bca9a87b01805d86840ecd4cd9f43ffc06e22d5e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{5925bfb1-04b1-78bb-72b8-7448310aea20}\vbmmecable64_win7.inf

Filesize
4KB

MD5
05ecec797a1d71a6871e0c50c505b73e

SHA1
fe3857ce989b58fd394d733154e2512bc998e9ac

SHA256
f8002f1f6be720f52718d0a8afe37151f44483cd9abaf694ef3b1d39f1141a54

SHA512
008585e811682853ce9ef462bd07ef09dc9a61d834b0ccc30ee1f1d1cc1eb4505ee5a6df0d2eba58d708b4538786621a6d4f3178329071f3c1b121033ba9314d

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\InstallVirtualAudio.exe

Filesize
895KB

MD5
4815e858d7457f4cd8ce13faa8186a3d

SHA1
c56d29addbe0036d66c3fb2166e469f447f7401e

SHA256
9a11a7de5bbf3317a29c25b44ead2549c9db2d2056a35145e69ca9a2768bc5e6

SHA512
f9320ccb88b6167722c9f33ccc290b0ba4f1817423447006ab06fc03646452e91c8965709ad88fba4b551ea939651457df9008e9b14b8be2e790a6a5cea812c8

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\Qt5Core.dll

Filesize
5.8MB

MD5
b2b77282c8f09de9c77bd486a94a1676

SHA1
78758728c039ecc6ce77f45cc70408a49b0fa4e6

SHA256
60b21a618c7f4ee015b8060dd8a64e9fb39c5167ff369eba8aeaaa29290c3485

SHA512
dacd2643397ecc6d45859fc202480ba964782b6334c017095ee02888cfbdddd3b91621ba6d2fe34c51a4c7166413f89bfd2409ac23d89b712587dce95cf9caa5

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\Qt5Gui.dll

Filesize
6.7MB

MD5
6d50542785d7962382c3756cd85ca12c

SHA1
4838742895b3a2450031d6c90768fe9bc9722f33

SHA256
0323c7fbd9a579f339b597b3e5f5b6e02814ae594f7fbc0cdd1786a5a32551ac

SHA512
c3f6ce45a901032052453565b01516a5ae81c41580e8dbdeffc45920692f8e7cdd0c4149c30ca07867be11f3964c6528f78a2de948d5eaa9aa1bab6f2b8cea0e

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\Qt5Widgets.dll

Filesize
5.3MB

MD5
220bf38b520fb1e7fcdb36b514fdea46

SHA1
b143c471b47b2c524e35305ba977cbf9d54edc23

SHA256
54f56144d8e1199f548a2462519c1c2e42fb49faf15fba19c032284e82f1c883

SHA512
59a48600f80ce86e41eaf8ef61211754447de331ff9f5d8ab3fe6e1d2a4f55533824a32e1c4e6d99df430b784fe835d421cd646bd371d439e8ea4495ee7ddffa

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\VoiceChanger.exe

Filesize
25.0MB

MD5
550fae128c06df19d72d3b6db37d2d9f

SHA1
bb97e5b21cbcd39e69fae0c456872620021993fb

SHA256
07898657f10114839e4cc6a8dd5d6f72ece1a8b26dc4bfba51507d415afd7497

SHA512
7179cc7958373fec4b88ad7eeac4c6ee475924d64f0ed5f44959294adfcb5274ea32076d3ee4493d5062f457e3282560946bf01b16a072a4b904a6810c59e0d3

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\VoiceChanger.exe

Filesize
25.0MB

MD5
550fae128c06df19d72d3b6db37d2d9f

SHA1
bb97e5b21cbcd39e69fae0c456872620021993fb

SHA256
07898657f10114839e4cc6a8dd5d6f72ece1a8b26dc4bfba51507d415afd7497

SHA512
7179cc7958373fec4b88ad7eeac4c6ee475924d64f0ed5f44959294adfcb5274ea32076d3ee4493d5062f457e3282560946bf01b16a072a4b904a6810c59e0d3

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\VoiceChanger.exe

Filesize
25.0MB

MD5
550fae128c06df19d72d3b6db37d2d9f

SHA1
bb97e5b21cbcd39e69fae0c456872620021993fb

SHA256
07898657f10114839e4cc6a8dd5d6f72ece1a8b26dc4bfba51507d415afd7497

SHA512
7179cc7958373fec4b88ad7eeac4c6ee475924d64f0ed5f44959294adfcb5274ea32076d3ee4493d5062f457e3282560946bf01b16a072a4b904a6810c59e0d3

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\VoiceChanger.exe

Filesize
25.0MB

MD5
550fae128c06df19d72d3b6db37d2d9f

SHA1
bb97e5b21cbcd39e69fae0c456872620021993fb

SHA256
07898657f10114839e4cc6a8dd5d6f72ece1a8b26dc4bfba51507d415afd7497

SHA512
7179cc7958373fec4b88ad7eeac4c6ee475924d64f0ed5f44959294adfcb5274ea32076d3ee4493d5062f457e3282560946bf01b16a072a4b904a6810c59e0d3

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\VoiceChanger.exe

Filesize
25.0MB

MD5
550fae128c06df19d72d3b6db37d2d9f

SHA1
bb97e5b21cbcd39e69fae0c456872620021993fb

SHA256
07898657f10114839e4cc6a8dd5d6f72ece1a8b26dc4bfba51507d415afd7497

SHA512
7179cc7958373fec4b88ad7eeac4c6ee475924d64f0ed5f44959294adfcb5274ea32076d3ee4493d5062f457e3282560946bf01b16a072a4b904a6810c59e0d3

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\VoiceChanger.exe

Filesize
25.0MB

MD5
550fae128c06df19d72d3b6db37d2d9f

SHA1
bb97e5b21cbcd39e69fae0c456872620021993fb

SHA256
07898657f10114839e4cc6a8dd5d6f72ece1a8b26dc4bfba51507d415afd7497

SHA512
7179cc7958373fec4b88ad7eeac4c6ee475924d64f0ed5f44959294adfcb5274ea32076d3ee4493d5062f457e3282560946bf01b16a072a4b904a6810c59e0d3

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
9d8413744097196f92327f632a85acee

SHA1
dfc07f5e5a0634dd1f15fdc9ff9731748fbff919

SHA256
6878d8168d5cc159efe58f14e5ba10310d99b53ab8495521e54c966994dac50b

SHA512
a8f6e9ee1c5d65f68b8b20d406d3e666c186e15cb3b92575257b5637fe7dd5ac7d75e9ad51c839ba4490512f68f6b48822fc9edd316dd7625d3627d3b975fb2a

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
361c6bcfcea263749419b0fbed7a0ce8

SHA1
03db13108ce9d5fc01cecf3199619ffbccbd855a

SHA256
b74aefd6fa638be3f415165c8109121a2093597421101abc312ee7ffa1130278

SHA512
aa8b585000cc65f9841b938e4523d91d8f6db650e0b4bb11efd740c27309bf81cdb77f05d0beda2489bf26f4fbc6d02c93ce3b64946502e2c044eea89696cc76

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
b402ed77d6f31d825bda175dbc0c4f92

SHA1
1f2a4b8753b3aae225feac5487cc0011b73c0eb7

SHA256
6ed17fb3ca5156b39fbc1ef7d1eefa95e739857607de4cd8d41cecfcd1350705

SHA512
ec04013139f3fd9dbf22b92121d82b2eb97e136f8619790cde2d0b660280e838962f9006d3e4c3a359627b017f2b6ade7edff3bbc26e559c3de37540585602d9

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
19KB

MD5
3d872be898581f00d0310d7ab9abaf2b

SHA1
420e0ab98bb748723130de414f0ffed117ef3f7e

SHA256
4de821884cbef4182b29d8c33cfe13e43e130ad58ee1281679e8d40a2edcb8ea

SHA512
35cfb9888a5f4299403a0d9c57f0ba79e3625431a9acc5e04ae2ae101b3dc521a0dcff5d4a1bf508b25dbf05dd432f6987d860ff494d15538ed95673a8b7376b

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-synch-l1-2-0.dll

Filesize
19KB

MD5
1742da4d8df54767064bcb50b4b5c32d

SHA1
50f0ae8e41f0eb2573f41b308882610c6897c574

SHA256
e000c6685719c2b07355c1eddbfdae7c6794aa6c0ac883d34af33dfc8bf40779

SHA512
99823ea5553cede3a0c8c19a3bdd18e31e2ba92bf7ee4808257b660f621de66eb596cfcb7be5c13ebe8ddd3759809f258c4ecdd72d8d39d9c2d10b9624cb3d95

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
6c180c8de3ecf27de7a5812ff055737e

SHA1
3aad20b71bb374bb2c5f7431a1b75b60956a01fd

SHA256
630466fd77ac7009c947a8370a0d0c20652169824c54ddcb8c05e8df45e23197

SHA512
e4aa79eb2b6b3be9b545e8cb8b43cd6052036dc5cce7077be40441b9942931b30d76c475d550a178d4e94c9c366cabc852f500e482b7fdcd361fc2a08e41c00e

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
d749afffa2b3be4b2a9edac50c20b28b

SHA1
972253ed12c344b85290f7b3d5f9608a7f7b0670

SHA256
e64fbac3491b4693e79a3f7b0db1d788f93608d3fc82133edf25a868c80d2153

SHA512
4447b6960a6c178f7c37dbd38e9aec24ba5a0c58e19afcfaa2b70dca7d7bbe87ad7aa1ac9d48ab9b56b1f375768d4c4cb28d5afcf714102f9757faa2b3e728d9

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-environment-l1-1-0.dll

Filesize
19KB

MD5
7a2874fe036f7dc86ed5f712adaa38e6

SHA1
440f2dc5379ceee35d29571c195dc7a76e8b70e7

SHA256
dd054e4de84144c2130fa8d28d563252a7c4089a58872e49d63bc43c9a1a3cb8

SHA512
d20811025f714b5fd3754d607422f4fb5cd6c456ffceef139edcb0cfaacd9b63a694ce2ea737db78385f0b23ddcfc283282a319b79e7a0e4bd50034e87aacb9a

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
73e14d927d075ca273b3237116351e8f

SHA1
0c15cea3c83c7f7e692dc6f8bd856b615c727d49

SHA256
966a7f15bfb2e0ff7888d583638ebd675d8f46b264194cf332f78140b7c129e1

SHA512
664f72d7adf48f8499321f8a5df952c6043532aae09bae9ffbd59da77b161cd43211a3aaef1ba85529dfe00498d1ac3a933a7c9cf437095c6a337c9bc0816b3f

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
01370c79ebabd534e7b58d35072d2866

SHA1
8cd0cd21ff838a2a314246def4bd858bab184a5d

SHA256
742bb9bf4c232f84ad8008af4af8eda7a1ec3eb76f05d9d7ebb95f6a5cabd2d8

SHA512
b07d9634ac804b476d61b6a0fc87894947e88744cc3eecf7d68ede3714acd938fae14452e43f9110919b8f8f9f5d4222e9de2ca97a915dd07b3231d674729761

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-locale-l1-1-0.dll

Filesize
19KB

MD5
bacb72fa56de18d5ac63e4a0a3fe768f

SHA1
7db19efe649d30337781afd62616c0549255046e

SHA256
25905676b543c4f05e9dae135f929c03a57686a6941ce59be2b3450521feb943

SHA512
78d82962c11e5928e77c5bd0377ecb6b00c2eca242d637f76e68fbf907bce7381f3a5294100d055c30f6e2aee164db0b95dcf0c0c77e39edcec4a046cfc63ed4

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
85893a96a568ba9781f50f876ed303cd

SHA1
fb7473bc5b1e88e978b7e5664b45d69770c8f4fa

SHA256
08e34f12de24e89379a0533f21a23ce6fecbea05d4062796d4ffd4adc3012316

SHA512
864fa39423b8ca9c43fa177aca1484ec2ffae4868a434e7a8016efe88f396b67fb8ca3766f611de7218e9983653a8b7b88b07c2591b252dd93a0d9638980e7ff

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
23KB

MD5
55b80c522731ecb92914bf9cded028c2

SHA1
424c61bc659caf04281959ede1b1f03b703934ed

SHA256
4c787ff8d40bb803e75fe6218fec36a672cfa6cfc7f6e80e68a7eb0b77a10e5a

SHA512
3779b530c7dba624369cb0f5d15154d89547adc3c4c7cc0571f1e8326588165098b9b5768d0052ecf1ea4f2dc84ae7dcf4712e3bc9ebdadb5fca4b0f4de43812

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
4614d03a94d46c0e9d1c5d96a3fe1d78

SHA1
cacb73ca3c7e31a4b8f749854060b7a422497050

SHA256
c7919be431ce2fa1906ff9eeb19e4cb19a30a4680107ef8737ce894654b21a5a

SHA512
4f30e8c5893662d7889a049c206b08559ad1a34eb7927be313086d6dae40dca3571de3852dba2ad9324e028fa86e8a391a58ec48ba5dbd5c4a88660ffe8b30df

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
7a2799f4bc45505e7104e06dc8e254f8

SHA1
323bc35e0101b351a4abde1fce698520832518a8

SHA256
92f72f495a6897f7d7cf2c2064b2b65f6b4fbd4f30911a534a5cd0de73395ebe

SHA512
2627da183779f17fcc9709a6da2e2916a296f61124adb9bf563c80d723ada9b769806cab8fbc4ed916f54fd4cde18f25e7ad53ed6c75e7e61fdef37c2f1ec9b2

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-time-l1-1-0.dll

Filesize
21KB

MD5
38b633f132f8e2b3abc268537fa415ec

SHA1
ccccb8c3e31dce7b6b952022d245c11ff3ae8122

SHA256
46cb7b3a9f8aac5adcdbe23494e458f3195adf4b8ed1c71f2d934ddde651e57e

SHA512
23bd77d61c20b1af7f13b5bcbeb9fa74ee807f809bb3d4dd40c7709ca4870078fa6e8e94eefc83a725c0245c0ce02e3adbd4f370d6b986f0c9442ccbc2c2ab96

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\api-ms-win-crt-utility-l1-1-0.dll

Filesize
19KB

MD5
5cde35104a68606913af6e5bd3b1adea

SHA1
f1f28141585c000753ab4db9ffc61f90929d4a1a

SHA256
111f6dd2e7247071a33d75bf98d521a8d09c4071f90483a82e6ed9af69bb52c4

SHA512
caa5f80ac380a6e0242104f297fbfe6091260d743ef967fb1010720dbcba2a575baf8cb1f666b11fe780428d71a04767e2cc63d1bd9638d5f1af1063e3f43f91

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\msvcp140.dll

Filesize
576KB

MD5
47101de0dc287f47718c99c7dd19146e

SHA1
55ee57772bd6d6b8f9d786e199e11336b38b8c42

SHA256
a2cb9cae4b86468ca44ba36320814a204ec8ad311df624b94e12c47e328e2726

SHA512
1e589eebc5bee03d28e977d2fa6c22f6288dcb6758284ff5f2639acbcebed19c859c2a9552971e1ddc50042bceeebd96efdb057b8c342be12d17c1f9583f6deb

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\ucrtbase.dll

Filesize
1000KB

MD5
126821f73fd9ffce6e091cf9480e1b60

SHA1
d10bbe9b65c2c6f8fca6850d0b79cbc6ef04d691

SHA256
7b28f46f0a09cfd9129109a94b1c16c9c62eef46c09113c4c585d9bf0e69b2da

SHA512
e61ad6c90551022fc257be95f6296a9f7d5a7aeaabd5349d81b1b31ea69b75dc3397698331f363d9fc2b005d9289a06dc1dcc2078e74b52775e0aae64daea36e

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\unins000.exe

Filesize
1.7MB

MD5
4da42f641a95e8900a96d580dfdadcea

SHA1
a5b17aa4b5161743c5bddc004c920a6ecbd8f5e4

SHA256
32ae9e111052a961b9a09235e22ef244af5d661690b9a7d349b3ab68616ce481

SHA512
e5aadd02eb9f6d102d9019614f42f733f5e58b85ec48ab19f0eccbcf0a14d86c5c96a2f0aec3dad760cc63a3b5f7da4561eb2d55e5abd13044215e2404063e5d

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\vcruntime140.dll

Filesize
99KB

MD5
18571d6663b7d9ac95f2821c203e471f

SHA1
3c186018df04e875d6b9f83521028a21f145e3be

SHA256
0b040a314c19ff88f38fd9c89dca2d493113a6109adb8525733c3f6627da888f

SHA512
c8cbca1072b8cb04f9d82135c91ff6d7a539cb7a488671cecb6b5e2f11a4807f47ad9af5a87ebee44984ab71d7c44fc87850f9d04fd2c5019ec1b6a1b483ca21

Download Submit
\Program Files (x86)\HitPaw\HitPaw Voice Changer\vcruntime140_1.dll

Filesize
43KB

MD5
a4f89ffc725ccae3c7bbcb9a0c91302f

SHA1
531194dad6795b3cb50b02501b0856efa694dd36

SHA256
bbcea93943f7e28a4d904301ff4bb708adaec4cc27800020044085fb838d4e5d

SHA512
c8ce2dcb65cd1fd0a7ffdc1df0076be2882badac7082b49ff96ec2ca1e944ccab8699ab28901a895cca90783cd223434552e366103fb6fcd25d9ad033b95eedf

Download Submit
\Users\Admin\AppData\Local\Temp\is-BBH0C.tmp\voicechanger_hitpaw_1.0.0.0.tmp

Filesize
1.7MB

MD5
4da42f641a95e8900a96d580dfdadcea

SHA1
a5b17aa4b5161743c5bddc004c920a6ecbd8f5e4

SHA256
32ae9e111052a961b9a09235e22ef244af5d661690b9a7d349b3ab68616ce481

SHA512
e5aadd02eb9f6d102d9019614f42f733f5e58b85ec48ab19f0eccbcf0a14d86c5c96a2f0aec3dad760cc63a3b5f7da4561eb2d55e5abd13044215e2404063e5d

Download Submit
\Users\Admin\AppData\Local\Temp\voicechanger_hitpaw\voicechanger_hitpaw_1.0.0.0.exe

Filesize
284.6MB

MD5
d0122e0255639f9979c3f7c5cb010abc

SHA1
1a1d6ffd343f7bcaf148113ebf322a32d001b422

SHA256
3e1f1b4ef5416ca3e23f229fe7a787bbbabc2c24464d1ff775fd926cb786908f

SHA512
2a9eff6ced34fd9090f660000937ff7750147861f3c8f8520dac11a0319440ecb98d7bbdb93885b8da17f9b6d9b2a6ac321b8d44dd3ce1756bea8d62801290de

Download Submit
memory/1144-268-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1144-256-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1144-363-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1144-272-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1144-431-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1144-269-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1144-3645-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1144-3570-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1144-552-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1144-372-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1144-1659-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1144-258-0x0000000000400000-0x00000000005BD000-memory.dmp

Filesize
1.7MB

Download
memory/1168-267-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1168-255-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1168-246-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1936-3668-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1988-201-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2636-3630-0x000007FEF63E0000-0x000007FEF6926000-memory.dmp

Filesize
5.3MB

Download
memory/2636-3632-0x00000000000A0000-0x00000000000B0000-memory.dmp

Filesize
64KB

Download
memory/3004-210-0x0000000000400000-0x0000000000863000-memory.dmp

Filesize
4.4MB

Download
memory/3004-206-0x0000000000400000-0x0000000000863000-memory.dmp

Filesize
4.4MB

Download
memory/3004-252-0x0000000000400000-0x0000000000863000-memory.dmp

Filesize
4.4MB

Download
memory/3004-200-0x0000000000400000-0x0000000000863000-memory.dmp

Filesize
4.4MB

Download
memory/3004-0-0x0000000000400000-0x0000000000863000-memory.dmp

Filesize
4.4MB

Download