Overview

overview

8

Static

static

1

VoicemodSetup.exe

windows10-2004-x64

8

VoicemodSetup.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/04/2026, 02:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VoicemodSetup.exe
  • Size 22.2MB
  • Sample260417-c7mb8agy31
  • SHA256 afd7452c34570e409fc0c2bc8a22fb7429a3cc8f48e85fe6a154656ec020330d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryinstallerpersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • ConfuserEx .NET packer 4 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 17 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3364
    • C:\Users\Admin\AppData\Local\Temp\is-8OOQ4.tmp\VoicemodSetup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8OOQ4.tmp\VoicemodSetup.tmp" /SL5="$70260,22991991,87040,C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:392
      • C:\Users\Admin\AppData\Local\Temp\is-JS5CU.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-JS5CU.tmp\vc_redist.x64.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Windows\Temp\{730EFE12-56A6-475F-B0AD-37D74F7E0F66}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{730EFE12-56A6-475F-B0AD-37D74F7E0F66}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-JS5CU.tmp\vc_redist.x64.exe" -burn.filehandle.attached=652 -burn.filehandle.self=692 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5048
      • C:\Users\Admin\AppData\Local\Temp\is-JS5CU.tmp\vc_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\is-JS5CU.tmp\vc_redist.x86.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Windows\Temp\{D2BDDB9A-4047-40CC-BE34-4E3FEAA7A300}\.cr\vc_redist.x86.exe
          "C:\Windows\Temp\{D2BDDB9A-4047-40CC-BE34-4E3FEAA7A300}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-JS5CU.tmp\vc_redist.x86.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5004
      • C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe
        "C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe" defaultdevices.txt
        3⤵
        • Executes dropped EXE
        PID:3048
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod Desktop\driver\setupDrv.bat""
        3⤵
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "devcon.exe dp_enum"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1640
          • C:\Program Files\Voicemod Desktop\driver\devcon.exe
            devcon.exe dp_enum
            5⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            PID:2064
        • C:\Program Files\Voicemod Desktop\driver\devcon.exe
          devcon install vmdrv.inf *VMDriver
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3104
        • C:\Program Files\Voicemod Desktop\driver\devcon.exe
          devcon update vmdrv.inf *VMDriver
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:1136
      • C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
        "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2596
  • C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
    "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\system32\cmd.exe
      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-alien-vocoder*.wav
      2⤵
        PID:1044
      • C:\Windows\system32\cmd.exe
        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-background*.wav
        2⤵
          PID:2332
        • C:\Windows\system32\cmd.exe
          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-vocoder*.wav
          2⤵
            PID:1192
          • C:\Windows\system32\cmd.exe
            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-aphonic-vocoder*.wav
            2⤵
              PID:4468
            • C:\Windows\system32\cmd.exe
              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-beach*.wav
              2⤵
                PID:4060
              • C:\Windows\system32\cmd.exe
                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-capella*.wav
                2⤵
                  PID:2504
                • C:\Windows\system32\cmd.exe
                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-reggae*.wav
                  2⤵
                    PID:3796
                  • C:\Windows\system32\cmd.exe
                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-rock*.wav
                    2⤵
                      PID:1864
                    • C:\Windows\system32\cmd.exe
                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cave*.wav
                      2⤵
                        PID:4528
                      • C:\Windows\system32\cmd.exe
                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-chase*.wav
                        2⤵
                          PID:2012
                        • C:\Windows\system32\cmd.exe
                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-radio*.wav
                          2⤵
                            PID:2868
                          • C:\Windows\system32\cmd.exe
                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background*.wav
                            2⤵
                              PID:4604
                            • C:\Windows\system32\cmd.exe
                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background-in*.wav
                              2⤵
                                PID:4268
                              • C:\Windows\system32\cmd.exe
                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-background*.wav
                                2⤵
                                  PID:3056
                                • C:\Windows\system32\cmd.exe
                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-vocoder*.wav
                                  2⤵
                                    PID:5104
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-background*.wav
                                    2⤵
                                      PID:3284
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-vocoder*.wav
                                      2⤵
                                        PID:3124
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-harmony-vocoder*.wav
                                        2⤵
                                          PID:1276
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-in*.wav
                                          2⤵
                                            PID:2548
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-loop*.wav
                                            2⤵
                                              PID:1532
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-bee*.wav
                                              2⤵
                                                PID:4224
                                              • C:\Windows\system32\cmd.exe
                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-growl*.wav
                                                2⤵
                                                  PID:4192
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-leopard*.wav
                                                  2⤵
                                                    PID:3176
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-tiger*.wav
                                                    2⤵
                                                      PID:3864
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-magic-chords-vocoder*.wav
                                                      2⤵
                                                        PID:3924
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-background*.wav
                                                        2⤵
                                                          PID:1808
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-vocoder*.wav
                                                          2⤵
                                                            PID:4172
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-possessed-background*.wav
                                                            2⤵
                                                              PID:4632
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-background*.wav
                                                              2⤵
                                                                PID:4532
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-vocoder*.wav
                                                                2⤵
                                                                  PID:3468
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-paris*.wav
                                                                  2⤵
                                                                    PID:2132
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-ulala*.wav
                                                                    2⤵
                                                                      PID:1644
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-santa-background*.wav
                                                                      2⤵
                                                                        PID:2972
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sleepyhead*.wav
                                                                        2⤵
                                                                          PID:2320
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spacemen-background*.wav
                                                                          2⤵
                                                                            PID:5024
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-ovation-background*.wav
                                                                            2⤵
                                                                              PID:2900
                                                                            • C:\Windows\system32\cmd.exe
                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-protest-background*.wav
                                                                              2⤵
                                                                                PID:4144
                                                                                • C:\Windows\System32\Conhost.exe
                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  3⤵
                                                                                    PID:3056
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-background*.wav
                                                                                  2⤵
                                                                                    PID:3820
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-vocoder*.wav
                                                                                    2⤵
                                                                                      PID:4696
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-action-background*.wav
                                                                                      2⤵
                                                                                        PID:5096
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-drama-background*.wav
                                                                                        2⤵
                                                                                          PID:4656
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-happy-background*.wav
                                                                                          2⤵
                                                                                            PID:628
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-hall*.wav
                                                                                            2⤵
                                                                                              PID:3272
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                3⤵
                                                                                                  PID:3104
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-playtime*.wav
                                                                                                2⤵
                                                                                                  PID:1948
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sword-background*.wav
                                                                                                  2⤵
                                                                                                    PID:2216
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-underwater*.wav
                                                                                                    2⤵
                                                                                                      PID:2080
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-1*.wav
                                                                                                      2⤵
                                                                                                        PID:3864
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-2*.wav
                                                                                                        2⤵
                                                                                                          PID:3924
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-3*.wav
                                                                                                          2⤵
                                                                                                            PID:1808
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              3⤵
                                                                                                                PID:4468
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-4*.wav
                                                                                                              2⤵
                                                                                                                PID:4048
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-1*.wav
                                                                                                                2⤵
                                                                                                                  PID:1332
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-2*.wav
                                                                                                                  2⤵
                                                                                                                    PID:2388
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-3*.wav
                                                                                                                    2⤵
                                                                                                                      PID:3240
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-4*.wav
                                                                                                                      2⤵
                                                                                                                        PID:2696
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-background*.wav
                                                                                                                        2⤵
                                                                                                                          PID:4228
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder*.wav
                                                                                                                          2⤵
                                                                                                                            PID:2868
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder2*.wav
                                                                                                                            2⤵
                                                                                                                              PID:1624
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cooltune-vocoder*.wav
                                                                                                                              2⤵
                                                                                                                                PID:4312
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-punk-vocoder*.wav
                                                                                                                                2⤵
                                                                                                                                  PID:4772
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx01*.wav
                                                                                                                                  2⤵
                                                                                                                                    PID:1104
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx02*.wav
                                                                                                                                    2⤵
                                                                                                                                      PID:1424
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx03*.wav
                                                                                                                                      2⤵
                                                                                                                                        PID:560
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx04*.wav
                                                                                                                                        2⤵
                                                                                                                                          PID:5096
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx05*.wav
                                                                                                                                          2⤵
                                                                                                                                            PID:1276
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx06*.wav
                                                                                                                                            2⤵
                                                                                                                                              PID:3128
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx07*.wav
                                                                                                                                              2⤵
                                                                                                                                                PID:2016
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx08*.wav
                                                                                                                                                2⤵
                                                                                                                                                  PID:4388
                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1948
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx09*.wav
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2216
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx10*.wav
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4868
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx11*.wav
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5080
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx12*.wav
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1112
                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                              3⤵
                                                                                                                                                                PID:3924
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx13*.wav
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1848
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx14*.wav
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1692
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx15*.wav
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1332
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar1*.wav
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:564
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar2*.wav
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2892
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar3*.wav
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1680
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:2696
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar4*.wav
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4348
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2972
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar5*.wav
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:4212
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar6*.wav
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2248
                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5024
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky1*.wav
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:5068
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky2*.wav
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:4296
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky3*.wav
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1104
                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3820
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky4*.wav
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4364
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky5*.wav
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3740
                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-exo*.wav
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3396
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-gameover-amb*.wav
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2876
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-outofrange*.wav
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder1*.wav
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4672
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder2*.wav
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3272
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder3*.wav
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1828
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part1*.wav
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1324
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part2*.wav
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:4192
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx16*.wav
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1192
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx17*.wav
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:3864
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx18*.wav
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:5032
                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1808
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx19*.wav
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:2960
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx20*.wav
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4140
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-bass*.wav
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5008
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-octava*.wav
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-quinta*.wav
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-tercera*.wav
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4528
                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                        PID:2896
                                                                                                                                                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3fa05903-2bc2-2141-b8dd-f12d2cd474db}\vmdrv.inf" "9" "499a51a03" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\program files\voicemod desktop\driver"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                          PID:1276
                                                                                                                                                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                          DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000148"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:1532
                                                                                                                                                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                          DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000158"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:3036
                                                                                                                                                                                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                        C:\Windows\system32\AUDIODG.EXE 0x524 0x520
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:2628

                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                              VoicemodDesktop.exe
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
                                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                                              • SHA256 d2a3683c8078509b09d97da2d190dc9c19f52d22003e31bf29e352beb611be91
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              VoicemodDesktop.exe.config
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe.config
                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                              • SHA256 71245f7de6f8cd1855194be81c191f8435fbe62b780f40fadfbce1efabb21f44
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              SaveDefaultDevices.exe
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe
                                                                                                                                                                                                                                              • Size 149KB
                                                                                                                                                                                                                                              • SHA256 663e5b184648639cbcf353ddaeec6688abe323dbccf8de8fc8d2683f5e1a99cb
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              devcon.exe
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\driver\devcon.exe
                                                                                                                                                                                                                                              • Size 103KB
                                                                                                                                                                                                                                              • SHA256 4bee65c38784c64888c12dc35fc706051dcdb32b4949766e83ad260096601812
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              setupDrv.bat
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\driver\setupDrv.bat
                                                                                                                                                                                                                                              • Size 110B
                                                                                                                                                                                                                                              • SHA256 8d0ee2177712918bde4be1fdba8d87815863d864a993a3361459ce194131f6a3
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              uninstalldriver.bat
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\driver\uninstalldriver.bat
                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                              • SHA256 883f7763a00f6419f7acc21a1772077e16b432dd1b6d15ba092a3a3a19667bc3
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              vmdrv.inf
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\driver\vmdrv.inf
                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                              • SHA256 fdc1514450a4eac615d959e17e527c6d69cfe92871626b39bc38a096a439a45d
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Fleck.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\Fleck.dll
                                                                                                                                                                                                                                              • Size 43KB
                                                                                                                                                                                                                                              • SHA256 65ae6fc064fe4e079fd7a462b79694b22275307723e0127dfe5c33132d30f902
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Hardcodet.Wpf.TaskbarNotification.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\Hardcodet.Wpf.TaskbarNotification.dll
                                                                                                                                                                                                                                              • Size 43KB
                                                                                                                                                                                                                                              • SHA256 f84935be717e1c49a54c1d7f8476243a4d34c0ea90c4ad13afe3f50164ba5f2e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Newtonsoft.Json.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\Newtonsoft.Json.dll
                                                                                                                                                                                                                                              • Size 638KB
                                                                                                                                                                                                                                              • SHA256 973fd70ce48e5ac433a101b42871680c51e2feba2aeec3d400dea4115af3a278
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              RawInputProcessor.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\RawInputProcessor.dll
                                                                                                                                                                                                                                              • Size 21KB
                                                                                                                                                                                                                                              • SHA256 ee069a485d30cebc1c56f25d2c1b418c13bf685065f1a3c2976bbec42f5b53b9
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              SharpDX.RawInput.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\SharpDX.RawInput.dll
                                                                                                                                                                                                                                              • Size 24KB
                                                                                                                                                                                                                                              • SHA256 727e4f5e311b1f582bc89ae9e2c3cd585b7952c433b6e7656521bac05811f651
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              SharpDX.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\SharpDX.dll
                                                                                                                                                                                                                                              • Size 260KB
                                                                                                                                                                                                                                              • SHA256 28437b8f6036224b187f6ec324af9cd8f20dc5e363b0341f86869e4172f07909
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              SimpleConverter.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\SimpleConverter.dll
                                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                                              • SHA256 f6d536162aed7f088b7d7d4bd18f33373f912cf6c3c2699cd7703ea2eef05cbe
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              VoicemodControls.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\VoicemodControls.dll
                                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                                              • SHA256 f99f25bdfa5ea1a40fc219738ea3e56657a2119bd9d07c3961a168a72ab37f9e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              VoicemodLogger.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\VoicemodLogger.dll
                                                                                                                                                                                                                                              • Size 14KB
                                                                                                                                                                                                                                              • SHA256 8f2c68dd604321d09343b5566b74d72527e78ad717fc41e91d48ce931a8eedb0
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              VoicemodSDKDotNET.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\VoicemodSDKDotNET.dll
                                                                                                                                                                                                                                              • Size 22.4MB
                                                                                                                                                                                                                                              • SHA256 0286fcd7d25ae394323ce46b23d800f966e4da4d8441d51d6d74f3943cd69b0f
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              VoicemodShockets.dll
                                                                                                                                                                                                                                              • Path C:\Program Files\Voicemod Desktop\lib\VoicemodShockets.dll
                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                              • SHA256 3c560d555221dc58b10de2edbedab07541b9673e686279c883ee955646096f2c
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              sdk-custom-fx01_44100.wav
                                                                                                                                                                                                                                              • Path C:\ProgramData\Voicemod\Temp\sdk-custom-fx01_44100.wav
                                                                                                                                                                                                                                              • Size 524KB
                                                                                                                                                                                                                                              • SHA256 4312292ed70789b7bbc6363df24ef91f98f19ad47d7458af2468031da23f0a24
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              sdk-custom-fx01.dat
                                                                                                                                                                                                                                              • Path C:\ProgramData\Voicemod\VoiceData\sdk-custom-fx01.dat
                                                                                                                                                                                                                                              • Size 136KB
                                                                                                                                                                                                                                              • SHA256 053c5a457729cf059c6bf023fc693246635b147040066e0953f5b5e119e68037
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              sdk-walkie-terror-1.dat
                                                                                                                                                                                                                                              • Path C:\ProgramData\Voicemod\VoiceData\sdk-walkie-terror-1.dat
                                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                                              • SHA256 254cca4fe05e8cb0b4d8ddd977258f1e780bb12f6d473e407e8445d1022649a8
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                              • Size 471B
                                                                                                                                                                                                                                              • SHA256 35816f81ff52b6a349ebf83d94d07d2ce53bc514b03839ce5453ab610b3c206e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                              • Size 471B
                                                                                                                                                                                                                                              • SHA256 1ae9fd19a898779875deeeb4f5d031311bfdcad45d4a9a1091e15238d370dfaa
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                              • Size 396B
                                                                                                                                                                                                                                              • SHA256 a0c5536e8d0bf9bd01353417b3b03688b239e7f3e2d022ed8999f4ca78d33ab9
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                              • Size 408B
                                                                                                                                                                                                                                              • SHA256 926eee198a4db160878a631fc9979c5121ddca6a5526079ac842352e492b30dd
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              VoicemodDesktop.exe.log
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\VoicemodDesktop.exe.log
                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                              • SHA256 d3042c73e34b33a183064b62348c0ed2931768ec0576bf51f3327f9dba085869
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              VoicemodSDK.dll
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\VoicemodSDKDotNET.Amd64.1.3.0.7\VoicemodSDK.dll
                                                                                                                                                                                                                                              • Size 22.3MB
                                                                                                                                                                                                                                              • SHA256 e3dea719f31d200f4e9719d5a8e7e34ff385652bec82c2ee7fbbc48ac888fa1b
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              VoicemodSetup.tmp
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-8OOQ4.tmp\VoicemodSetup.tmp
                                                                                                                                                                                                                                              • Size 737KB
                                                                                                                                                                                                                                              • SHA256 326071c6e04b3552414337cea066d809d987dbddbc8ad717626abc9dff748956
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              idp.dll
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-JS5CU.tmp\idp.dll
                                                                                                                                                                                                                                              • Size 216KB
                                                                                                                                                                                                                                              • SHA256 e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              vc_redist.x64.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-JS5CU.tmp\vc_redist.x64.exe
                                                                                                                                                                                                                                              • Size 14.6MB
                                                                                                                                                                                                                                              • SHA256 7cf24eba2bd67ea6229b7dd131e06f4e92ebefc06e36fe401cdd227d7ed78264
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              vc_redist.x86.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-JS5CU.tmp\vc_redist.x86.exe
                                                                                                                                                                                                                                              • Size 14.0MB
                                                                                                                                                                                                                                              • SHA256 251640e8039d34290133b2c6e3e6fe098e61e2756d5a4c45fdcec9e4dee6c187
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              vmdrv.sys
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\{3fa05903-2bc2-2141-b8dd-f12d2cd474db}\vmdrv.sys
                                                                                                                                                                                                                                              • Size 44KB
                                                                                                                                                                                                                                              • SHA256 1f6cbdc32658ffcf48f6a037302f96c515febe16b459eeddd9c5624d5be91182
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              aerddd10.newcfg
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\aerddd10.newcfg
                                                                                                                                                                                                                                              • Size 1001B
                                                                                                                                                                                                                                              • SHA256 f3f14423275535254f4da7968a0f586061dfba2e7c565ec19abd17e1b4b11795
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              fpxc1ozq.newcfg
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\fpxc1ozq.newcfg
                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                              • SHA256 4190562e0634c392c0232b40fa20bd125da60cb4c4efa75d69f3ff81990c9fdb
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              lke1q3o5.newcfg
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\lke1q3o5.newcfg
                                                                                                                                                                                                                                              • Size 580B
                                                                                                                                                                                                                                              • SHA256 1551dd11ef2a6dd31557ece197d2db5d1a54ba79a71436824f3d6c0a976eda33
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              user.config
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\user.config
                                                                                                                                                                                                                                              • Size 332B
                                                                                                                                                                                                                                              • SHA256 733e489330d34542d6f8eca88b68115b6611f7cc4c44abe8433fe190784fce2d
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              license.rtf
                                                                                                                                                                                                                                              • Path C:\Windows\Temp\{07B008C2-7812-477E-B774-67F35165DDE3}\.ba\1036\license.rtf
                                                                                                                                                                                                                                              • Size 136KB
                                                                                                                                                                                                                                              • SHA256 84cfc67f98d7553ab6af43e9b8d89138a9f46d0fd9291a441d7fe73f5c1a9dc6
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              vc_redist.x64.exe
                                                                                                                                                                                                                                              • Path C:\Windows\Temp\{730EFE12-56A6-475F-B0AD-37D74F7E0F66}\.cr\vc_redist.x64.exe
                                                                                                                                                                                                                                              • Size 917KB
                                                                                                                                                                                                                                              • SHA256 8c13a649c567be84e4e3a262689f6b59dcde3e9f8b0037869710fc693b2bc0ff
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              vc_redist.x86.exe
                                                                                                                                                                                                                                              • Path C:\Windows\Temp\{D2BDDB9A-4047-40CC-BE34-4E3FEAA7A300}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                                              • Size 917KB
                                                                                                                                                                                                                                              • SHA256 8440d4640ee1eee29b31a85c1c05f6106b907a2967a2902570d53996230f9571
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              license.rtf
                                                                                                                                                                                                                                              • Path C:\Windows\Temp\{D7D02CB8-5E94-457C-9753-B3624E3A61B4}\.ba\1055\license.rtf
                                                                                                                                                                                                                                              • Size 177KB
                                                                                                                                                                                                                                              • SHA256 f79108a254f876e0f6bbcb05a9effbe25dc252e7ea256bfe3fd28ceb79737f25
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              logo.png
                                                                                                                                                                                                                                              • Path C:\Windows\Temp\{D7D02CB8-5E94-457C-9753-B3624E3A61B4}\.ba\logo.png
                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              wixstdba.dll
                                                                                                                                                                                                                                              • Path C:\Windows\Temp\{D7D02CB8-5E94-457C-9753-B3624E3A61B4}\.ba\wixstdba.dll
                                                                                                                                                                                                                                              • Size 215KB
                                                                                                                                                                                                                                              • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              vmdrv.cat
                                                                                                                                                                                                                                              • Path \??\c:\program files\voicemod desktop\driver\vmdrv.cat
                                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                                              • SHA256 488b32ba019c0db448d0669f70bdf564d0f4bd23c7f9592d185474b0d62c763a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              memory/392-13-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-211-0x0000000003B60000-0x0000000003BFF000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-33-0x0000000000950000-0x00000000009CA000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-14-0x0000000000950000-0x00000000009CA000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-15-0x0000000002280000-0x0000000002281000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-591-0x0000000000950000-0x00000000009CA000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-423-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-590-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-592-0x0000000003B60000-0x0000000003BFF000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-5-0x0000000002280000-0x0000000002281000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-209-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/392-210-0x0000000000950000-0x00000000009CA000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1276-419-0x00000243B31E0000-0x00000243B31EC000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-401-0x000001B4EA860000-0x000001B4EA868000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-578-0x000001B4EF020000-0x000001B4EF068000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-403-0x000001B4EA890000-0x000001B4EA8A2000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-220-0x000001B4E7DC0000-0x000001B4E7DCA000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-340-0x000001B4EA7A0000-0x000001B4EA7E0000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-405-0x000001B4EAF20000-0x000001B4EAF42000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-339-0x000001B4E97E0000-0x000001B4E97EE000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-338-0x000001B4EA1F0000-0x000001B4EA228000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-337-0x000001B4E7EA0000-0x000001B4E7EA8000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-626-0x000001B4E7D10000-0x000001B4E7D1C000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-224-0x000001B4E7DD0000-0x000001B4E7DDA000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-314-0x000001B4EA170000-0x000001B4EA182000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-576-0x000001B4EA8D0000-0x000001B4EA8DC000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-172-0x000001B4E76B0000-0x000001B4E7982000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-222-0x000001B4EA0C0000-0x000001B4EA166000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-371-0x000001B4EA230000-0x000001B4EA23A000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-580-0x000001B4EAF00000-0x000001B4EAF08000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-581-0x000001B4EAF10000-0x000001B4EAF18000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-579-0x000001B4EAEE0000-0x000001B4EAEEA000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-316-0x000001B4EA1A0000-0x000001B4EA1AC000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-328-0x000001B4E7D10000-0x000001B4E7D1C000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2200-326-0x000001B4EBD10000-0x000001B4ED374000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2596-589-0x00000175E53E0000-0x00000175E53EC000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2720-323-0x0000000000F50000-0x0000000000F95000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2964-228-0x00000000034D0000-0x0000000003515000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3104-437-0x0000028B0CAA0000-0x0000028B0CAAC000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3364-593-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3364-12-0x00000000008C0000-0x000000000093A000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3364-11-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3364-0-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5004-322-0x0000000000EE0000-0x0000000000F25000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5048-227-0x0000000002CF0000-0x0000000002D35000-memory.dmp
                                                                                                                                                                                                                                              Download