24478fa684c1177e9765d98c861b657901866501c5d7a46d24bf218e38f5a7f7

Analysis

max time kernel
222s
max time network
226s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 21:19

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Voicemod Pro 2.6.0.7 (x64) Multilingual [FileCR].zip
Size

68.0MB
MD5

b996d59815f903ca7292772219e5749d
SHA1

2e43be0f61ec5fed542609756fa3f4fafbdf1644
SHA256

24478fa684c1177e9765d98c861b657901866501c5d7a46d24bf218e38f5a7f7
SHA512

44ef391a46be36d8aef9257b8de7205ba65e863df45f3d6c228d1a1c2eb4066a2608eb5d41c686d4426120df351b43f2517ca275a0a4efaf63efc6fff73b276e
SSDEEP

1572864:6ZSqnaCqBynx2NOjVUQk2Z9DPWwKfOeZi5u9PaX9O:6kqnMBFN+VHh9DPjKfFIHI

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\drivers\SETED44.tmp	DrvInst.exe
File created	C:\Windows\system32\drivers\SETED44.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\drivers\vmdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe

Executes dropped EXE 9 IoCs

pid	Process
1116	7z2301-x64.exe
2324	7z2301-x64.exe
5064	7zG.exe
388	VoicemodSetup_2.6.0.7.exe
1632	VoicemodSetup_2.6.0.7.tmp
1672	SaveDefaultDevices.exe
1508	voicemodcon.exe
1228	voicemodcon.exe
3328	VoicemodDesktop.exe

Loads dropped DLL 4 IoCs

pid	Process
5064	7zG.exe
1632	VoicemodSetup_2.6.0.7.tmp
1632	VoicemodSetup_2.6.0.7.tmp
1632	VoicemodSetup_2.6.0.7.tmp

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Voicemod = "\"C:\\Program Files\\Voicemod Desktop\\VoicemodDesktop.exe\""	VoicemodSetup_2.6.0.7.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}\SETEB70.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_d69cebb32d098656\vmdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}\SETEB71.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}\vmdrv.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_d69cebb32d098656\vmdrv.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}\SETEB70.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}\vmdrv.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}\SETEB72.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_d69cebb32d098656\vmdrv.PNF	voicemodcon.exe
File created	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}\SETEB71.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}\vmdrv.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{527d2ad2-f3f1-5742-a30a-dfecbe722337}\SETEB72.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vmdrv.inf_amd64_d69cebb32d098656\vmdrv.cat	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Voicemod Desktop\is-1FTD0.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\Voicemod Desktop\EntityFramework.SqlServer.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-23R7D.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\unins000.dat	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\Voicemod Desktop\RestSharp.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-QF62N.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\Voicemod Desktop\driver\voicemodcon.exe	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.Extensions.DependencyInjection.Abstractions.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Sentry.PlatformAbstractions.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-8M4J5.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2301-x64.exe
File opened for modification	C:\Program Files\Voicemod Desktop\AxInterop.WMPLib.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\mParticle.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\NLog.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\System.ValueTuple.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\Voicemod Desktop\System.Net.WebSockets.WebSocketProtocol.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Voicemod.Websockets.Fleck.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2301-x64.exe
File created	C:\Program Files\Voicemod Desktop\is-JL7IE.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-LFSLA.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.Extensions.FileProviders.Physical.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\System.Data.SQLite.Linq.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-2PPIK.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.Extensions.Logging.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\driver\is-2BGGK.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-UIA7R.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\Voicemod Desktop\System.Threading.Tasks.Extensions.dll	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-SB11E.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-MUSGO.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2301-x64.exe
File created	C:\Program Files\Voicemod Desktop\is-UT47B.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\locales\is-HSHNB.tmp	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\libcef.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2301-x64.exe
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.Extensions.DependencyInjection.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\Microsoft.Extensions.Options.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\Voicemod Desktop\System.Memory.dll	VoicemodSetup_2.6.0.7.tmp
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2301-x64.exe
File created	C:\Program Files\Voicemod Desktop\is-LP7OQ.tmp	VoicemodSetup_2.6.0.7.tmp
File created	C:\Program Files\Voicemod Desktop\is-UAHV0.tmp	VoicemodSetup_2.6.0.7.tmp

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\INF\oem2.PNF	voicemodcon.exe
File created	C:\Windows\INF\c_media.PNF	voicemodcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	voicemodcon.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem0.PNF	voicemodcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem1.PNF	voicemodcon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
3876	tasklist.exe
208	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133589856273176210"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe

Modifies registry class 49 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\URL Protocol	VoicemodSetup_2.6.0.7.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open\command	VoicemodSetup_2.6.0.7.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\ = "URL:Voicemod Command Protocol"	VoicemodSetup_2.6.0.7.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\DefaultIcon\ = "VoicemodDesktop.exe,1"	VoicemodSetup_2.6.0.7.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell	VoicemodSetup_2.6.0.7.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open\command\ = "\"C:\\Program Files\\Voicemod Desktop\\VoicemodDesktop.exe\" \"%1\""	VoicemodSetup_2.6.0.7.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2301-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod	VoicemodSetup_2.6.0.7.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open	VoicemodSetup_2.6.0.7.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\DefaultIcon	VoicemodSetup_2.6.0.7.tmp

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
1632	VoicemodSetup_2.6.0.7.tmp
1632	VoicemodSetup_2.6.0.7.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe
Token: SeShutdownPrivilege	2540	chrome.exe
Token: SeCreatePagefilePrivilege	2540	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
5064	7zG.exe
1632	VoicemodSetup_2.6.0.7.tmp

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe
2540	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1916	2540	chrome.exe	96
PID 2540 wrote to memory of 1916	2540	chrome.exe	96
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3772	2540	chrome.exe	97
PID 2540 wrote to memory of 3660	2540	chrome.exe	98
PID 2540 wrote to memory of 3660	2540	chrome.exe	98
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99
PID 2540 wrote to memory of 912	2540	chrome.exe	99

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Voicemod Pro 2.6.0.7 (x64) Multilingual [FileCR].zip"
1⤵
PID:2944

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff0fc5ab58,0x7fff0fc5ab68,0x7fff0fc5ab78
  2⤵
  PID:1916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:2
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2264 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3144 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4676 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4624 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4048 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4720 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5088 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3504 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5136 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5032 --field-trial-handle=1820,i,5270338933631112479,5177331048654821177,131072 /prefetch:8
  2⤵
  PID:1672
- C:\Users\Admin\Downloads\7z2301-x64.exe
  "C:\Users\Admin\Downloads\7z2301-x64.exe"
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies registry class
  PID:1116
- C:\Users\Admin\Downloads\7z2301-x64.exe
  "C:\Users\Admin\Downloads\7z2301-x64.exe"
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies registry class
  PID:2324

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4496

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Voicemod Pro 2.6.0.7 (x64) Multilingual [FileCR]\" -ad -an -ai#7zMap8040:176:7zEvent29254
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5064

C:\Users\Admin\AppData\Local\Temp\Voicemod Pro 2.6.0.7 (x64) Multilingual [FileCR]\Voicemod Pro 2.6.0.7 (x64) Multilingual\VoicemodSetup_2.6.0.7.exe
"C:\Users\Admin\AppData\Local\Temp\Voicemod Pro 2.6.0.7 (x64) Multilingual [FileCR]\Voicemod Pro 2.6.0.7 (x64) Multilingual\VoicemodSetup_2.6.0.7.exe"
1⤵
- Executes dropped EXE
PID:388
- C:\Users\Admin\AppData\Local\Temp\is-CUPA3.tmp\VoicemodSetup_2.6.0.7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CUPA3.tmp\VoicemodSetup_2.6.0.7.tmp" /SL5="$1100E0,66753197,750080,C:\Users\Admin\AppData\Local\Temp\Voicemod Pro 2.6.0.7 (x64) Multilingual [FileCR]\Voicemod Pro 2.6.0.7 (x64) Multilingual\VoicemodSetup_2.6.0.7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1632
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -v https://wsw.voicemod.net/api.windows/v2/webutils/getAnonymousId/?initialUuid=44d43ff8-91cd-4ca7-92c9-6495b4f546fa -o C:\Users\Admin\AppData\Local\Temp\is-PJD8U.tmp\deviceId.txt
    3⤵
    PID:4948
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"False\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:4016
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt
    3⤵
    PID:2776
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3876
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_VoicemodDesktop.exe.txt
    3⤵
    PID:1428
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:208
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpWelcome\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"1\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:2836
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpLicense\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"2\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:2028
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectDir\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"6\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:4544
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectTasks\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"9\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:2612
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpReady\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"10\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:2264
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpPreparing\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"11\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:2796
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpInstalling\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"12\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:2872
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Step Install\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:2436
- - C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe
    "C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe" defaultdevices.txt
    3⤵
    - Executes dropped EXE
    PID:1672
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod Desktop\driver\setupDrv.bat""
    3⤵
    PID:1604
  - - C:\Windows\system32\net.exe
      net stop audiosrv /y
      4⤵
      PID:1300
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop audiosrv /y
        5⤵
        
        PID:2020
  - - C:\Windows\system32\net.exe
      net stop AudioEndpointBuilder /y
      4⤵
      PID:2100
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop AudioEndpointBuilder /y
        5⤵
        
        PID:2488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "voicemodcon.exe dp_enum"
      4⤵
      PID:2000
    - - C:\Program Files\Voicemod Desktop\driver\voicemodcon.exe
        
        voicemodcon.exe dp_enum
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1508
  - - C:\Windows\system32\net.exe
      net start audiosrv
      4⤵
      PID:4760
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start audiosrv
        5⤵
        
        PID:1268
  - - C:\Windows\system32\net.exe
      net stop audiosrv /y
      4⤵
      PID:1048
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop audiosrv /y
        5⤵
        
        PID:3792
  - - C:\Windows\system32\net.exe
      net stop AudioEndpointBuilder /y
      4⤵
      PID:1536
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop AudioEndpointBuilder /y
        5⤵
        
        PID:4316
  - - C:\Program Files\Voicemod Desktop\driver\voicemodcon.exe
      voicemodcon install vmdrv.inf *VMDriver
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Checks SCSI registry key(s)
      PID:1228
  - - C:\Windows\system32\net.exe
      net start audiosrv
      4⤵
      PID:1828
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start audiosrv
        5⤵
        
        PID:1936
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Step PostInstall\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:2172
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-9ce275fde2ae0e4fa29e7be3416716f8:I9wI9bIvnwhEBAHqgGq3iwgv6F_rq98MMw45315t6FXIOcfqtzsfedlzBqqhJBb- -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"device_info\": {\"platform\": \"roku\",\"roku_publisher_id\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\"},\"mp_deviceid\": \"0f53e42a-5f24-4cfc-97b3-3ad130d9eb70\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpFinished\" , \"custom_attributes\": { \"version\": \"2.6.0.7\", \"machine_guid\": \"44d43ff8-91cd-4ca7-92c9-6495b4f546fa\", \"country\": \"Unknown\", \"locale\": \"en-US\", \"is_new_user\": \"True\",\"page_number\": \"14\" }},\"event_type\": \"custom_event\"}],\"environment\": \"production\"}"
    3⤵
    PID:1088

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:2976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:3008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:628
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{97d2afd3-9f82-8040-9688-cfb113a97adb}\vmdrv.inf" "9" "499a51a03" "0000000000000140" "WinSta0\Default" "0000000000000150" "208" "c:\program files\voicemod desktop\driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2096
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:2020.9.25.0:*vmdriver," "499a51a03" "0000000000000140"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:1408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1868

C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
"C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"
1⤵
- Executes dropped EXE
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
112KB

MD5
da6aec447474df298eca9f18c2fda0a9

SHA1
c1e918fc600856a85a00a89af6ce623a4349126b

SHA256
20c7b0dc8b584975803f3d8dde90bad423cc16c0adde5b33899428fcf61e485e

SHA512
c88d73183194b368d65da29d5573ff4598574b579d0b1824890c9915e06cee63f235702bfe78c943994c3fe1849d9773fddc0343e0cfd28735bceccf38d06dc1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp2

Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
930KB

MD5
30ac0b832d75598fb3ec37b6f2a8c86a

SHA1
6f47dbfd6ff36df7ba581a4cef024da527dc3046

SHA256
1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

SHA512
505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

Download Submit
C:\Program Files\7-Zip\History.txt

Filesize
56KB

MD5
69a9ed93f118b332335d30f96c66f359

SHA1
d125ad2574a90cfe50de95d36f84014d1d0012ee

SHA256
83495c16b428d317ec3d27912c852f1af4b84526f6540e579ed34ebb66364d70

SHA512
92625964248a543bd778af5fac10f48056d9adc02c741c0fc0fd3353abf2737ce838bc3dd08d057b86aa56a314a8c820406930b5b166497b89f321f657636201

Download Submit
C:\Program Files\7-Zip\Lang\af.txt

Filesize
4KB

MD5
7db01445ef366652c133f316c6fdf764

SHA1
ba1af33e920fc820bf474a47768a17c6c93a2ef4

SHA256
181e34045fb6338338c68d7ccaa325d47969ac43a20d20d898846f64fb68251a

SHA512
81373af8700ed071ab4f307753c6f00354ea212b7bf3f24d4a61ea2fcb9f16e0674685d621e294170daa6a71388e6b5bbf12bb1a837ab037a539af08c9061497

Download Submit
C:\Program Files\7-Zip\Lang\an.txt

Filesize
7KB

MD5
1583a850ca7369fcecf12b4159b4328f

SHA1
e651ff9613b31b8d9602ff6c4fa2cf27678f82f8

SHA256
c082aed224d70a3f77e68c0db90fdfbcedb8e4c12bb1a4c6dc7561bd8b1fa071

SHA512
bd4fc2a28e51147a78459fbd0b47d7898d1fc2024499ec65245173880979ee55f0b177decaabc94c392a08b04efb3b7713884525033c2414063422ebc17cf04e

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt

Filesize
12KB

MD5
1f1268bf2a1262ba99013f7b36a82655

SHA1
6101602d68a3f6e229847629dc03b691647046cf

SHA256
5a18170adb8152458716a24bdaa12835fc26c68b31209a9e29e739fca212a356

SHA512
fb44f1c92df165bba0eb3fdbf24f5764e5a6fce61e2484a439c2c914ee254bdb9f8118ecd116a4fefca6bc3d657ffe3c25bc66b7f4ff66b1a5ff63e2579a5f8e

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt

Filesize
5KB

MD5
23ece3a43d2577a1f4bb5d420abb563f

SHA1
34d0804c00f45c5cda77409cbd382dc11932ef4f

SHA256
61d67f81971a8a2093041ce58b39c7229b413b991b2fc724e4898bc319539992

SHA512
3515e580e9a0e912f8d23080c380f38f91857254967baa237f1a1cbcb1961a4e469a60a4cd2b33dd1f435cf242e364d95df3fc95eb6998cb0fb800e86ca47470

Download Submit
C:\Program Files\7-Zip\Lang\az.txt

Filesize
9KB

MD5
e5a80461b90f025be5ee9062673b53ac

SHA1
cdf8042b7cd2bd7c9f09dfa271681ccc6e639864

SHA256
f0d1ead49e7d42f897b7ea715cce41637c3ebd7ec556541aedd7ca2156cba065

SHA512
43fa0dab6cd8321eecac6c3bdd5b0e90c5efdc8d2e3919e7684222791dde1d95c1b159e5398a1159e549ab1c33ff5c6d5052736162cfcc55267a644d631e9716

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt

Filesize
10KB

MD5
c3efc3a627fb8b406f8805a12f09739b

SHA1
bacc7eede7610a824ca8eac89aca9f6001d25336

SHA256
aa8a4baebe75f9c0d4319fb65deb61786dd1bd7e692226fabf2679e2606fa0d5

SHA512
4a4acdd09bb26e97031eb582352ee3733735fd44114230f42acfb16d3d820db4e91010dd297773538c7cb7383a9c03d047fbe5f47380a92b751fc42ffeb5b9a5

Download Submit
C:\Program Files\7-Zip\Lang\be.txt

Filesize
11KB

MD5
e48f4bf2d0103001ede9551d62a8c4dd

SHA1
282d9093f55e9c55d449e074f7cc42d995661ec3

SHA256
b49445240bbd9910d1fd693654f8a51d4035fc2d2b572e7c195b917321c27f05

SHA512
80361ee17dc2abdc543bc29e2b3c3395d769845908d26ecd3fdf3da71f3cd8c514e7d15eb342104cb51aad4086255e3466da0e490f27960ea5602e918ebb0332

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt

Filesize
12KB

MD5
f245a8437a36abe7bf356f77d7e9e104

SHA1
5ded5211b33e2835bc864e63981ddbb74a58dd32

SHA256
4e308d796dbdf26a690102195426a6702ab567363ab8ecd5f063080ab66dc819

SHA512
db868173ce3451efb02200ead2a33e1c8c27beceaec6768f7f683139d25e43d6d58d8687ed4c65f7bedaaa3288f20b16fd5bac11d46245c33f8d0bc64d2c7d39

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt

Filesize
14KB

MD5
c0cf8da47fef56028edbb261e4f5a691

SHA1
d5a8030e1ea15b8f85951149eac41aaa9c3072ca

SHA256
389eeabae507e204bc53925cc1e2f1a4cc0cce5d6e74bca8f015213ed019d7f5

SHA512
03392b7563dc5790f09c03dad7a3ba7154609e3a085ba374c123d9df482dbfbe12fc679b49e0b9d09c2c7ece860f4cf5e85a7a90c67eb2aea4f2786f73c35443

Download Submit
C:\Program Files\7-Zip\Lang\br.txt

Filesize
5KB

MD5
db2784955e875a93ef7f2d1557f3f6f4

SHA1
27cd891768902c51e1451f31894e3eff30620361

SHA256
88233348e8bf385eccc6cb56c4a088900c92e1fa51329769ebc5c4a5e6c2cbe5

SHA512
ff540924f456da8f2bdbc3b434068b239a4d85e163ddf500906683035e47abb1c0829a9b6fd1466c05c68f2f3ad365874beffbe139689771040ec95934b926cd

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt

Filesize
9KB

MD5
812d4995102e9b475b874d0cfdd8f56a

SHA1
7377bbaa47ca91755574f07fc17be41c3fad3237

SHA256
3d0ff58cce129a004ce1d7e0608808ce64e712a0e8aebddb908eda3b191bd883

SHA512
4e5af4d5b699aa32da6c3f6e027ebd6ed2db7bceead648f5d4843b307335f21f3d617ac753cf7555ff044210b49bb5475f0d66619bd1353fa9a140d1428362e8

Download Submit
C:\Program Files\7-Zip\Lang\co.txt

Filesize
10KB

MD5
f9a98b99a163c842a7adab1cd8acca76

SHA1
efeb42fd33ed61ae7430becf95f8e45e630ef501

SHA256
c9a10ee60f89a139d36325595c3da0afc0c07d2b6e1cc065bb45d734e1fd133c

SHA512
b1da9357e3d0bad24a7bb9bb17c94769b2b8a6c2f8f524394cf77b48013602bd35846997be6d662507ac643c8adfddc6ca6c8d36807d1212918563f72708c1ed

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt

Filesize
8KB

MD5
36a411cf8a6673fd95b4dd282732d5af

SHA1
c87638050b904a596f07a3602d6f6ad327762a18

SHA256
83916d0fe4cc8a4c414f2e90ee3dd7371a38e2ea44414f948f6da0f8dd23b600

SHA512
37593f73db6062f4d146e24a4080c56b4625c8aab4e5bd8f58802082e56401ec218e93deb9908322064b4e434b855640b19822d568a4434038b6f15f4976ce16

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt

Filesize
5KB

MD5
0c15f3a55de5d538f2748444623f2745

SHA1
c15440a16a08339088c563e505012e67c383216a

SHA256
2dc41991631aab989fd2368e1ebab6b56dfe926307fcb1b8e887205584e99b5f

SHA512
d11e819fcb176b185fb6402ebedbc29118a5cb7757577a04371182e46eb8c85b6f96a8305c15a3c366e4b2ff8da6479e7f2f7c0ce00ea12598b957d4643a2756

Download Submit
C:\Program Files\7-Zip\Lang\da.txt

Filesize
8KB

MD5
d8aba2da47c1031832957b75a6524737

SHA1
b83069ef9f7a08f18804ae966b8d18657e2907cd

SHA256
f65026ae33d4302a7ef06a856f6f062c9730100f5a87d5c00fb3feaf5fcd5805

SHA512
82b5f4ab8e3e2310a98be87b5cf2cbf04b7aeae1798cd69529325ee74add40bdca38eda865a821f66436906d4f3224004f690cf406b532e116475d2b2424b570

Download Submit
C:\Program Files\7-Zip\Lang\de.txt

Filesize
9KB

MD5
8c46fb4a3c5025c1089f5c634d5d951c

SHA1
46272d7178330b9f1ab1aaf7f3db068f4d8b72c0

SHA256
e6a716c27f11bfadba853228a5bec9cdd6d043f22f5db8f70094cd2e857c3a6a

SHA512
e39571a8605e7f6479016f721b5e449a6028a62cd8b058054c2f6e8129fe1c3ef19f5b0d776e9d25f6fb3d8f56e1f95159ea77758a0de5ddf9f07bada21744db

Download Submit
C:\Program Files\7-Zip\Lang\el.txt

Filesize
16KB

MD5
d74ce0f31e3c062b6631455ea2c3dcdb

SHA1
b4267827e54a0e6d9ac32be961640b4530b59cb2

SHA256
7f11663757a2bdc193547e8c2a221f92d8f1825db0e7c801d33ba1b42fbf08fa

SHA512
7feba4c40a3634f2a2ded570448d6aa69e3118a725bb25a33144855705457bdd208c61d86e1347fbdc4bc16fdfae3e5c20bceaf85aace97292789e32f3fb71df

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt

Filesize
7KB

MD5
72ea78fc93365651aa4222b6ebf31bf9

SHA1
9a2a5a2879e30dde4571f75eb00f95f58226c768

SHA256
4d6405dc6f93c00fa7eff8bbcac256d079ff56c5d0edaac41bb1a80c0ab2fecd

SHA512
61d5a60b26162ea6218a256e7f5c31d2aba4c24563d0a075cff280e683b6be61209042bd5f85e02ee6c4b5156d7f894934b6755f17594aede5199edb01f63fd2

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt

Filesize
5KB

MD5
418188a5e20929d6948de22b970a3208

SHA1
2068dfa837475c14e13919555816416d44ff4a3e

SHA256
7aeff9b0450b006c212104a541787b3a9e0912b85733f6addab700b7bcc0f33d

SHA512
07da2c0ae34b1f5a47d8fe2e97b62ebfda0b3369ae257f0f4cda14ee9d1f469d23696930b810ee83761a142fd6400825c67d954b64cb5fa246cc43b483236151

Download Submit
C:\Program Files\7-Zip\Lang\es.txt

Filesize
9KB

MD5
0e082b43a79586272b05c9ca8f7c16df

SHA1
9eea192851d5fb9045e88b506ed4e1558667e683

SHA256
88972f7e173cfed678fba72f5eefbc1c485d8cdad14c49e57a9d3076cff0c2fd

SHA512
3774139b300d88dccfb318f1a261d6f8bd49ec3be87fde0449c9600c436d7245181bea24e54d51b39835dd9b4f4c7db722d61a2a62812ad58b6599abdf8df2f6

Download Submit
C:\Program Files\7-Zip\Lang\et.txt

Filesize
6KB

MD5
ee84b1c885670eadec64639f14da46e2

SHA1
c4701563afa270fd4c33802383347a3c19e2fd92

SHA256
7b0e52653b536ad2595de618073c37a8fc833e1b43b0772a6a1fd3c2167f59ed

SHA512
b2586aef602861a8423761164d221407fe91e4fa197956e03fc29c1cf2e560d4b338af34eabd5739b9a1fc51eab0ec281fc93f4615b960f99707de5f7bf985d0

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt

Filesize
8KB

MD5
29ec04893f6b2c9058a8f1e0beaf9081

SHA1
8e7b5a0ec24153aa7be02f0395c003df02cf6a09

SHA256
536d93ca6d7c96d203b51333c4e78de2429f78d32cc321461589626759c84127

SHA512
b84e6606a5f58392de5c5f8113db10b8212a82bb93367469284ad2dd9a961bf381e3d230179ec19a32cae7a266cdde7290d95a262dea247b267fdce905f89972

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt

Filesize
9KB

MD5
b1b6e1c3cf5247ec1618a88f9853d54d

SHA1
0671cb77ad76f9e27237aa538f8efa6bccc40de3

SHA256
cc283e9b0c1822f757372c21f179710c4592a2f7755e706c48065bcfe70bba5b

SHA512
045422d358b3348a1e52cced12d70757a7e6026801113eb68f07a399acc75b6ecc9a1a4401cb7a65506c6f61d4fbb348765b0c80080072bfe06e0500cf31b0ac

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt

Filesize
7KB

MD5
d4361ef22b59d893c571a54a0ea9f206

SHA1
5185ac8e059848f311a0a9a04a0d220d1882e011

SHA256
8413fb6f6f8c9f31a10da448895fd6c0d70834dd33a4fe6241dc41601f6e5ae9

SHA512
db290afe0618c8558bd2344fa03930939b9890cbf3cd30ab44c72d6aaa5faaf6010a2890e391bb9c9cb99001cbaea8b22caeced96bbf630786bb4b6c2fced862

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt

Filesize
6KB

MD5
b0997f61ec5aeacd1709883baa95f8e1

SHA1
12f3c9f988a61c4f6857b891bab92be3070c9380

SHA256
7389f61c25ec26171ae6aa93ebb2960d27ef0caa396f0f88906d15cd0456f663

SHA512
2a0103af4de970d1add91fc3c5faf9c4d3f040705afafc589af0be62db9d318a49930e117cd619ea9b96da6c1765badedfec2dda7a49679f2a060ebb17dddaed

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt

Filesize
8KB

MD5
78410155d8b0c60eb6031f89f055444a

SHA1
7be443b61fabad7c73a6f2cad8b475c77e66b6e3

SHA256
41afd53f0cb057455a936d8f54bf4c7e980defe61c4a102ce64ba1fa707b25ab

SHA512
427e54cb53fc1ca772b327c5e81b0a36986d7cf73abefe9902a38d8915d77e402aee92b0d5ab7d04edfa9454bb4eb830aa873eb1989ca7688514ff63223aaee7

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt

Filesize
9KB

MD5
50bbf631148bae77c10d4c8e54faf396

SHA1
df537b6a8c22374ac371ed3e99658f676dca265f

SHA256
8954ea88db4f0f00a2e6142a8ee112f160fdbf3496c29027f88adf3a4c1960f5

SHA512
2aa952531f0dbf1e481e35136418ce7cb20c57f4eb23b95d839273ee7173c599984d13089a30bddc5363c013cad2e15a4bb415801aa6e243cd38306a2e09dcb9

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt

Filesize
13KB

MD5
a3fbc89351bb849ab7a095eca5ce55b9

SHA1
e7ede3dff2b066cb74beb3863c9637f7d0726a72

SHA256
5794217068ece1e278be92fa4cc56304fc7aede204aa75b49b79599f90d3ab33

SHA512
4ce81fb30815312ed403438ec105cc3b517e4194c599a38b5323c1ddace0e2e5f641ac211c735f0e89f74b8c966ce9fd9c086aa84f4ff21a972cb8dcae390707

Download Submit
C:\Program Files\7-Zip\Lang\id.txt

Filesize
8KB

MD5
c0774491b0289f06df49f578afb9d540

SHA1
27a00ad568512aacaeb561b2d5ce73f9459c1621

SHA256
6161d75c555cbb39ccb97e5bb9494070414add1fe48894ea53478358d763d655

SHA512
2ae92378e2eac856fd0a7a4edada03044f5f8bccf3ee71e950085166779f7c6b8974a25dcd7e8779faf7e5728db6df5fa489459a6f0a9518765a928ac10c5d0c

Download Submit
C:\Program Files\7-Zip\Lang\io.txt

Filesize
4KB

MD5
a3a5678560ac09a798f8edeee63d7d87

SHA1
0e05ce684180da3c8193841ea58c8ee128f3feda

SHA256
583483f9d42195d1a32225fc2d6f5907b556953b9521e1e61091c947c498f966

SHA512
7b1dada81ee9d4e42f257e8624e3a1dadaae4d0f09d25f6baacdc3212e2e1a48da56450c06edea140917090babd6457292a994087d1fa28c95121c92d6366af1

Download Submit
C:\Program Files\7-Zip\Lang\is.txt

Filesize
8KB

MD5
f361950b7d1bb073ef48ca729b7ed5ea

SHA1
8c5d3fb8e09c9682c6256f05f82ca67c58f0ff2b

SHA256
f4f9d6dfd36512f027452499b083ad0656df6503ce03e4e4cc45b925f1f1d678

SHA512
6163fb77d3155525a563ad907cdf48fa18a6ce019a073c7d9dc2438927217d0d8534ada7fc444114f14ac216c89d12e83f5b582021be693baec80bd69199909e

Download Submit
C:\Program Files\7-Zip\Lang\it.txt

Filesize
9KB

MD5
7a3aa3754fd3b5dce8d37e9a0e7a4bee

SHA1
12f208b86d41c81dccecb33807ceb3c584049f07

SHA256
92b60edfe7f4b65cc4dbc207def72155c04fd613f0053f50c0fddaf7681299db

SHA512
735ad3cf99ae8d93ebd4fb2a811daab552189309740017b7be167018206bc00e06973c951b462c1157e314ec98219f8c6ab3680f45491888808c251f324a82aa

Download Submit
C:\Program Files\7-Zip\descript.ion

Filesize
366B

MD5
eb7e322bdc62614e49ded60e0fb23845

SHA1
1bb477811ecdb01457790c46217b61cb53153b75

SHA256
1da513f5a4e8018b9ae143884eb3eaf72454b606fd51f2401b7cfd9be4dbbf4f

SHA512
8160b581a3f237d87e664d93310f5e85a42df793b3e22390093f9fb9a0a39950be6df2a713b55259fce5d5411d0499886a8039288d9481b4095fabadddbebb60

Download Submit
C:\Program Files\Voicemod Desktop\Voicemod.VoicemodDesktop.UI.dll

Filesize
19.3MB

MD5
948fa7c2a1fc375157bde5d8d44fe162

SHA1
9ed97ef0eb84d52bb5dd0b2343c9deac4bc2b1e9

SHA256
9908c60efe2d8dd716e6654ea09e8a19ffce21273aeaa239473c549500479ba4

SHA512
fdafba662dce2b913d29ebd1d9b80eb41c4c8a1b09444c1275052fc436079dbdb4dc6a3a8021eff0768767bd9c8efba789a865a9e814299478840d12797354c8

Download Submit
C:\Program Files\Voicemod Desktop\Voicemod.Websockets.Fleck.dll

Filesize
80KB

MD5
aa81651105606461eb63db6d423fb2c7

SHA1
c748d7a703df483a99f2d434d1a45fb3d285b4c7

SHA256
138e544e27ee059ffef19809c54f48076a0ddb29410549b658b3aa67a18d153e

SHA512
1118a9b1090ff72fd15b269eae7f0d8085ef624fd34318f5c4499dcbae37531081c8060182cf37ca9e114c05eafdbbfb8477cf1ba2a88225106d587caf141541

Download Submit
C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe

Filesize
4.9MB

MD5
d20afc7e984fef3a2b2ed3dc0b4c0ef5

SHA1
484da3d185b8b87620d4d2d6b7ca4266a651bf21

SHA256
fb737bdab9bf40f95dc999adc48cca3855fea1290c4bf51629f0298660f92cee

SHA512
e9ab6c311f73bbbd9640be6275c66ce4bb4aa73124e46eb7a3e7a8083bc8de0c461555ea12205c6ce630aa4e783bbea6112fca700f58edb33f0c82142dad127f

Download Submit
C:\Program Files\Voicemod Desktop\VoicemodSDK.dll

Filesize
5.7MB

MD5
39844565ec5c8cf05d62ef399b011754

SHA1
23ba2573016c6fa7344f4d422d86a76b5216363d

SHA256
f0dbf3861a5cae109edef2e78fa2b9f7c4353025bad314cf3afb3fa173a4f5af

SHA512
54b5a16b55491a59e6cb7f4172557efc470d6c31f503b7c8767f0ec410f128a7b98bf4191ba8176fe39f77deb6372788797f0dffbaae2041338af63eca544e0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
7a950fdd9015d1f6c539eac7fa6f91f9

SHA1
d99c5f466cbef64f287b9bd7ba33a8ee46673295

SHA256
e9ef30724b707b68970e339a798d5f0b943cbb68e1d0e8fcd458db466f295535

SHA512
ef487a673e9e5f397e295199e52c39171522ecdd79d368eaca4547b0623443da8317513d5e91b547a0863fa3208241730db6032ad7badb24932bd33264970fc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
04eb24392dca3340fb86be593937aa4b

SHA1
ad1c15c7a01a4eb57e58eca1ed4e4d33a6accfb6

SHA256
e941c895f71ce03966d89c1718b37401332b2aea92472be018f46c1c49022eb2

SHA512
aac046acdadea517b83efe21ca2d88d5e82ff63d6feee6c434560c11598c4c3ae8c0481d8da2ef3da738def236d2a3474e27e6a1fff221873d2474db55bcbef7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
b882d60e28112865fb7a6099b2107376

SHA1
01ea5ebc71f202128813d9745c19396c9def9e5a

SHA256
559ee7ee3d335cf024b21217fe8b13342178eec7a2b7812bc0c95fd935aa775d

SHA512
43a5fe32aa2f7c060994aa9c67e7a9654126410895795cd19d94d2fae01d2e8c3ac7561698a737b9811b6c8bb53a5b3826afc7462222b5b4174a8b85951382c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
57d7735a4472e36f0ab318eabf87ff7b

SHA1
8f63dc2e4b49e58847dbe10402f0ad1617014bcb

SHA256
aa38ffecdf328215efdfaa13af089562f6f09dab6fe4b5eedb737b4e716f8b4d

SHA512
44a5d9f324c4cdffc6ff2de11ef0bfe75b9f6811a487b5998c5e74c72194e651b8f9e1d660114929001cbdfd5d300387ac25f6625f43a2711cef18edd6205047

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
ff9e7fda66c1d9e4d373726bf0c8f34d

SHA1
416e042687ffc89b34bfca2b839a3ef56ef34b3f

SHA256
5491d3105528e6e30443320247f1462f6f7e2a760f5bb67ded126ef608b5675c

SHA512
8bc42807f5e4ad8f9eae4226c4fdf64b41ba41a1a973683148f9e67b9230c7c6d82380559e558d1a3f9ccef9569270e8b95163d99cfd06c89bb544f38ea1e632

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
0e86ace6d75d539ce10d8bfd37ef295a

SHA1
dac10d41a2b2d34b6b981f749704359e2dff1bd6

SHA256
9ffb111a5d9803e0d0c5932763de1ee66b6da7d2a27448ae33e9a41d38646749

SHA512
deac2620e81cb9e381ef0c9801ed30e5be55fb63b4ff654b37a1ec2a62036a2f6f40d4d19a4cafe70ae874174f6e3261a0bae014c74a41cba345484983918003

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
dcb3b746420573b0f7199568ab00500a

SHA1
444889dff3ecdc3eaa015ab08dedb8f36c012d63

SHA256
5636a5708db9d1caa8fc4eda578ac2c11a5d9636cbd12c9542fa260fd4960652

SHA512
abd97454a48d71e30965a11c96965bacd6bf99780349bb01d1b1925198af5f89b4f49c38a65037bc1c42292aa131da170afca9b3eac06b962d3b50ff16dd197a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
ee10a4ce7db1b4968b30d53ef027bee4

SHA1
37ce8f2b41389b2db994e9a287cadce45263ade2

SHA256
ec51ea9a368bc6d3f59f16307f4298b8a4358b9bae1395b0033f970418b1f7b7

SHA512
70939acbf6a7c20bbe12f12a1d2dbb55bb635553588feee00605a05b45d88a499f6e9b31090f569a0c69ec0046c65309511ac27b25bcd74a59274e60a04f0ae3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
40bff9b03cd3ef574e8c16a121b019df

SHA1
23e7b5c85077869178e17c839b0877954c20a3ee

SHA256
a3372ab67852a8345f54b7ec27a378541893ff85012d766250e30a63fa026ce6

SHA512
da96c1eb1e6dce96cf1bb7ef06d4c84a76f5f41f5d2488cba5d6a9102996b974f144fbdb8bb7ccb6f4ab20fdf706335db8e733524ff7e598c09ca097094cd9b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
b060703879c25ef3f030660063469131

SHA1
ea1df7985e811ba50f503b1746c1d15a3568f109

SHA256
ced04dd2167010fb4920347a6abde0e32994bb4a4927b4af5fea793541be3e5b

SHA512
397ba56eba0f3e50d21b12345311b305f7580330ad09163d42e44fd52120496e595aec47a5d13a9a16914773c47a4b8f6f3f9788d5b1df07cc445f3480a72993

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6265de377312325fbdc8e2868b017813

SHA1
804732e9009c113de400a75e55ed1b1f663993a3

SHA256
30d5b7b8eb95e29a3957e562b6558bdc48d3f5f88aa832ba59c3f5388a2ffedb

SHA512
c582740c31850c081342b244c0fb71627494a1a3fe5064d8a9d5133e15f942e8b43372dc91f19e762667771945c85368227c8f65b45d538c4bda654e77579c50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
665eae33dec590a3ef6b1107036615c0

SHA1
ce8a270871d0abd1724bed7614c0782b120ac7d3

SHA256
89dbf3a04a2b21b74a3e13442a45bc42e25d0671ee840f5502000e0f4d837bce

SHA512
d434086414dccea7f294ead0177e84882eac9e8e98abcd7d61713a898a450d5c8965d9fedb14f233ebb9ebbf59a85d527a6f7f109dc67a14d51b722a26234c0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
256KB

MD5
5843c7d256a1bcac0f6481eed60e79ba

SHA1
3d1f45415d6930e38f909d54c43710475a7e0151

SHA256
943e71c11b9c241c571de34f53d3541ca0dc5af392b4cb4aab1b82220c138cb9

SHA512
0d94f75b963bc529b88974d6c8df8a7272aa91173164f47f4be69298947a132d1d6fddf0d2cb5bde5340ec1b631f744149128eae9013b0fb216d8139fa49c9e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
256KB

MD5
0958acd8ccdd4c3015aa392a631b6356

SHA1
e95ad6161934d2012da0a69079bf186710a80f82

SHA256
883846ddd545a256f820133ecbb29834b9ab523c729aaa27d8154af533d86618

SHA512
0a5d5117111531cf9fc7a873c6cf6ea9f590efd36da569df62618484a7eddb86b1cff88b9534df48c7c8c6c8d719b8b2ad92728a1ec8a7522bf94120baa9b766

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
51f2a3e2e4715fe6e74d45434edc5cbb

SHA1
b418ffdb7000bdeda2b4561094150357af796c5f

SHA256
51c69e176ea4cc8c21f2683b4cdd6b4e806f2b8ec48374f3cef6d6449ccb9ed3

SHA512
149d9eae8b0d10c5654c5e8dbb1135d800aaae138c1a8a8b7032142fcb250c33192249113942d493dc969c3607e8966b9751512b7c1f7d574a745bf819c43dc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJD8U.tmp\bg-inner.png

Filesize
964B

MD5
4a1378ccbcbcf4a320bfc4d63aabef36

SHA1
8f17dc3df0a7310ab4a3914a81b7f5576e5546a5

SHA256
f3640a78436c8f83c8b055c74da597e239524201df4ae6db52a3141a1a47699a

SHA512
6800224d90fb8c00f31b51a485b90ce0fbc26aea993484a148981d9ef41ee0ff712d43816c1f8ef8b511165de70683ad98202baf27d1a7fb9f31aa88ff17836e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJD8U.tmp\bg-top.png

Filesize
51KB

MD5
229152b01d238ac58d066bbdd45219bf

SHA1
b47d2070eb77d723f925f36c902c6cefd5bb1c31

SHA256
acb21fcb80667714749963e8ce2e24b23e3f269de34d8e1734892777cbca2f7e

SHA512
fcf37ba7ae4929d77039b0d90f87cf6523bc7bc4f81ca27c1057f53d93752f0d9603708afaf3e8f460a0e5e67210c8d1eeb44cf95b07919a67a37805b0d63b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PJD8U.tmp\buttons.png

Filesize
7KB

MD5
84d27be69f0f13909dab87c1cb270a29

SHA1
cb3a480bf9d790342e12775b4d50c350475f3bb5

SHA256
ed4b81ffc92f6d41c5d4925f0ac83cd280ad1a781a966d2128275c804f6aa5de

SHA512
290ebef8f3930ffdb0b99df9a99bd419ff591bd83acdb9b49b421a36d920298a05ad8e85dfa7e9e5de8fe9864780eff2af1e85aa5e3fc8b3ce88f074b87bf51a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97d2afd3-9f82-8040-9688-cfb113a97adb}\SETEAD4.tmp

Filesize
4KB

MD5
b9b68ddad77911e85697af02b6e311b5

SHA1
999c26f4e20fd29abb0404c9b5bfad4fb2664d2d

SHA256
f853d5b0a5dd5cbe1da2ffaae285080019f9e60cf4e4ab7d9810f5be40f362f1

SHA512
40e0307e787c8498ffc0922d190973b1634621bbefc2a89feaad1b4d68797f9e55c1cf55e5112a0a8d13ee37fa2ed18a33248c95e4298471e2f7cb3f6359c874

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97d2afd3-9f82-8040-9688-cfb113a97adb}\vmdrv.cat

Filesize
10KB

MD5
46bb11132e5800c97b9d2c1df6e6fe88

SHA1
83a6cb8f90ce3a805609eaa3472ee480ac30a8b2

SHA256
6bfcc755ffedaefbd2aa94988dbfc2492a185ec1621ccb2db9194d1f83df5ccf

SHA512
fd3de31cf8025e933c8a4966938ab4b59fb9adca41b009c0ef0129bf5297bf4a64e5d4bde662f2aec62ccb3c05bc10c309196c73355cbd409ab4b1f6ba86ad08

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97d2afd3-9f82-8040-9688-cfb113a97adb}\vmdrv.sys

Filesize
47KB

MD5
0e625b7a7c3f75524e307b160f8db337

SHA1
5088c71a740ef7c4156dcaa31e543052fe226e1c

SHA256
d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3

SHA512
0ad805d11413dcc9d3c549b94a3644fc9c9caa23f0a661c9aef41c1e6f8d91de784817668ff4f34b3f50d738aa8097b2a0ee38de078ed97f5c17635533e9e165

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 888336.crdownload

Filesize
1.5MB

MD5
e5788b13546156281bf0a4b38bdd0901

SHA1
7df28d340d7084647921cc25a8c2068bb192bdbb

SHA256
26cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd

SHA512
1f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff

Download Submit
memory/388-803-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/388-898-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1632-887-0x0000000003600000-0x0000000003740000-memory.dmp

Filesize
1.2MB

Download
memory/1632-877-0x0000000003600000-0x0000000003740000-memory.dmp

Filesize
1.2MB

Download
memory/1632-822-0x00000000035F0000-0x00000000035FE000-memory.dmp

Filesize
56KB

Download
memory/1632-900-0x00000000035F0000-0x00000000035FE000-memory.dmp

Filesize
56KB

Download
memory/1632-899-0x0000000000400000-0x0000000000681000-memory.dmp

Filesize
2.5MB

Download
memory/1632-1280-0x0000000000400000-0x0000000000681000-memory.dmp

Filesize
2.5MB

Download
memory/1632-892-0x0000000003600000-0x0000000003740000-memory.dmp

Filesize
1.2MB

Download
memory/1632-897-0x0000000003600000-0x0000000003740000-memory.dmp

Filesize
1.2MB

Download
memory/1632-882-0x0000000003600000-0x0000000003740000-memory.dmp

Filesize
1.2MB

Download
memory/1632-1357-0x0000000000400000-0x0000000000681000-memory.dmp

Filesize
2.5MB

Download
memory/3328-1369-0x000001C2EE210000-0x000001C2EE75E000-memory.dmp

Filesize
5.3MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads