Overview

overview

8

Static

static

1

VoicemodSetup.exe

windows10-2004-x64

8

VoicemodSetup.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    137s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    17/04/2026, 02:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VoicemodSetup.exe
  • Size 22.2MB
  • Sample260417-c7mb8agy31
  • SHA256 afd7452c34570e409fc0c2bc8a22fb7429a3cc8f48e85fe6a154656ec020330d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryinstallerpersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • ConfuserEx .NET packer 4 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 17 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\AppData\Local\Temp\is-Q5S6E.tmp\VoicemodSetup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-Q5S6E.tmp\VoicemodSetup.tmp" /SL5="$4027C,22991991,87040,C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3820
      • C:\Users\Admin\AppData\Local\Temp\is-6OG9K.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-6OG9K.tmp\vc_redist.x64.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Windows\Temp\{A08E69A2-DA04-4C90-A6EF-7A57B907CE15}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{A08E69A2-DA04-4C90-A6EF-7A57B907CE15}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-6OG9K.tmp\vc_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3844
      • C:\Users\Admin\AppData\Local\Temp\is-6OG9K.tmp\vc_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\is-6OG9K.tmp\vc_redist.x86.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5648
        • C:\Windows\Temp\{AFD766D9-1A9E-4F24-8268-55D8BD84FA9B}\.cr\vc_redist.x86.exe
          "C:\Windows\Temp\{AFD766D9-1A9E-4F24-8268-55D8BD84FA9B}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-6OG9K.tmp\vc_redist.x86.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4692
      • C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe
        "C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe" defaultdevices.txt
        3⤵
        • Executes dropped EXE
        PID:3792
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod Desktop\driver\setupDrv.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5560
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "devcon.exe dp_enum"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1192
          • C:\Program Files\Voicemod Desktop\driver\devcon.exe
            devcon.exe dp_enum
            5⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            PID:6092
        • C:\Program Files\Voicemod Desktop\driver\devcon.exe
          devcon install vmdrv.inf *VMDriver
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3536
        • C:\Program Files\Voicemod Desktop\driver\devcon.exe
          devcon update vmdrv.inf *VMDriver
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:5796
      • C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
        "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4752
  • C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
    "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5704
    • C:\Windows\system32\cmd.exe
      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-alien-vocoder*.wav
      2⤵
        PID:5856
      • C:\Windows\system32\cmd.exe
        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-background*.wav
        2⤵
          PID:5376
        • C:\Windows\system32\cmd.exe
          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-vocoder*.wav
          2⤵
            PID:4696
          • C:\Windows\system32\cmd.exe
            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-aphonic-vocoder*.wav
            2⤵
              PID:5488
            • C:\Windows\system32\cmd.exe
              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-beach*.wav
              2⤵
                PID:5628
              • C:\Windows\system32\cmd.exe
                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-capella*.wav
                2⤵
                  PID:4284
                • C:\Windows\system32\cmd.exe
                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-reggae*.wav
                  2⤵
                    PID:3848
                  • C:\Windows\system32\cmd.exe
                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-rock*.wav
                    2⤵
                      PID:4040
                    • C:\Windows\system32\cmd.exe
                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cave*.wav
                      2⤵
                        PID:2396
                      • C:\Windows\system32\cmd.exe
                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-chase*.wav
                        2⤵
                          PID:2844
                        • C:\Windows\system32\cmd.exe
                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-radio*.wav
                          2⤵
                            PID:4608
                          • C:\Windows\system32\cmd.exe
                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background*.wav
                            2⤵
                              PID:2080
                            • C:\Windows\system32\cmd.exe
                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background-in*.wav
                              2⤵
                                PID:4560
                              • C:\Windows\system32\cmd.exe
                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-background*.wav
                                2⤵
                                  PID:1900
                                • C:\Windows\system32\cmd.exe
                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-vocoder*.wav
                                  2⤵
                                    PID:496
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-background*.wav
                                    2⤵
                                      PID:4004
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-vocoder*.wav
                                      2⤵
                                        PID:6044
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-harmony-vocoder*.wav
                                        2⤵
                                          PID:4456
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-in*.wav
                                          2⤵
                                            PID:3156
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-loop*.wav
                                            2⤵
                                              PID:2128
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-bee*.wav
                                              2⤵
                                                PID:2032
                                              • C:\Windows\system32\cmd.exe
                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-growl*.wav
                                                2⤵
                                                  PID:3784
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-leopard*.wav
                                                  2⤵
                                                    PID:2796
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-tiger*.wav
                                                    2⤵
                                                      PID:1544
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-magic-chords-vocoder*.wav
                                                      2⤵
                                                        PID:4060
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-background*.wav
                                                        2⤵
                                                          PID:5252
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-vocoder*.wav
                                                          2⤵
                                                            PID:5792
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-possessed-background*.wav
                                                            2⤵
                                                              PID:5716
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-background*.wav
                                                              2⤵
                                                                PID:5228
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-vocoder*.wav
                                                                2⤵
                                                                  PID:4064
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-paris*.wav
                                                                  2⤵
                                                                    PID:2580
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-ulala*.wav
                                                                    2⤵
                                                                      PID:5920
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        3⤵
                                                                          PID:6092
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-santa-background*.wav
                                                                        2⤵
                                                                          PID:924
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sleepyhead*.wav
                                                                          2⤵
                                                                            PID:3932
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spacemen-background*.wav
                                                                            2⤵
                                                                              PID:5236
                                                                            • C:\Windows\system32\cmd.exe
                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-ovation-background*.wav
                                                                              2⤵
                                                                                PID:3140
                                                                              • C:\Windows\system32\cmd.exe
                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-protest-background*.wav
                                                                                2⤵
                                                                                  PID:4956
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-background*.wav
                                                                                  2⤵
                                                                                    PID:2688
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-vocoder*.wav
                                                                                    2⤵
                                                                                      PID:3680
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-action-background*.wav
                                                                                      2⤵
                                                                                        PID:5572
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-drama-background*.wav
                                                                                        2⤵
                                                                                          PID:1768
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-happy-background*.wav
                                                                                          2⤵
                                                                                            PID:1640
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-hall*.wav
                                                                                            2⤵
                                                                                              PID:5076
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                3⤵
                                                                                                  PID:2180
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-playtime*.wav
                                                                                                2⤵
                                                                                                  PID:5096
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    3⤵
                                                                                                      PID:2684
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sword-background*.wav
                                                                                                    2⤵
                                                                                                      PID:436
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-underwater*.wav
                                                                                                      2⤵
                                                                                                        PID:4480
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-1*.wav
                                                                                                        2⤵
                                                                                                          PID:1104
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-2*.wav
                                                                                                          2⤵
                                                                                                            PID:2152
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-3*.wav
                                                                                                            2⤵
                                                                                                              PID:4396
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-4*.wav
                                                                                                              2⤵
                                                                                                                PID:3708
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-1*.wav
                                                                                                                2⤵
                                                                                                                  PID:5400
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-2*.wav
                                                                                                                  2⤵
                                                                                                                    PID:4524
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-3*.wav
                                                                                                                    2⤵
                                                                                                                      PID:4136
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-4*.wav
                                                                                                                      2⤵
                                                                                                                        PID:484
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-background*.wav
                                                                                                                        2⤵
                                                                                                                          PID:420
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder*.wav
                                                                                                                          2⤵
                                                                                                                            PID:4868
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder2*.wav
                                                                                                                            2⤵
                                                                                                                              PID:6012
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cooltune-vocoder*.wav
                                                                                                                              2⤵
                                                                                                                                PID:3636
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-punk-vocoder*.wav
                                                                                                                                2⤵
                                                                                                                                  PID:5528
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx01*.wav
                                                                                                                                  2⤵
                                                                                                                                    PID:940
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx02*.wav
                                                                                                                                    2⤵
                                                                                                                                      PID:3080
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx03*.wav
                                                                                                                                      2⤵
                                                                                                                                        PID:5192
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx04*.wav
                                                                                                                                        2⤵
                                                                                                                                          PID:4960
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            3⤵
                                                                                                                                              PID:2080
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx05*.wav
                                                                                                                                            2⤵
                                                                                                                                              PID:1556
                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                3⤵
                                                                                                                                                  PID:4560
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx06*.wav
                                                                                                                                                2⤵
                                                                                                                                                  PID:4772
                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1900
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx07*.wav
                                                                                                                                                    2⤵
                                                                                                                                                      PID:496
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx08*.wav
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4004
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx09*.wav
                                                                                                                                                        2⤵
                                                                                                                                                          PID:5904
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx10*.wav
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5304
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx11*.wav
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4744
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx12*.wav
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3832
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx13*.wav
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1828
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx14*.wav
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2236
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx15*.wav
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2608
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar1*.wav
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4520
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar2*.wav
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1684
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar3*.wav
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1356
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar4*.wav
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:2856
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar5*.wav
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5340
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar6*.wav
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3600
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky1*.wav
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2208
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky2*.wav
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4092
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky3*.wav
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2652
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky4*.wav
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:6056
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky5*.wav
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5184
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-exo*.wav
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2084
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-gameover-amb*.wav
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3200
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-outofrange*.wav
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5208
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder1*.wav
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder2*.wav
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2996
                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5236
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder3*.wav
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5908
                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:3140
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part1*.wav
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4384
                                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part2*.wav
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx16*.wav
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3172
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx17*.wav
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2416
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx18*.wav
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3556
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx19*.wav
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx20*.wav
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-bass*.wav
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:5056
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-octava*.wav
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:5928
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-quinta*.wav
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2420
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-tercera*.wav
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4480
                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:3628
                                                                                                                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{df10c5fe-eb53-584a-bd4e-cca0a044fa5d}\vmdrv.inf" "9" "499a51a03" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "c:\program files\voicemod desktop\driver"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                      PID:2180
                                                                                                                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000150" "8daf"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:2684
                                                                                                                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000164" "8daf"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                      PID:2468
                                                                                                                                                                                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                    C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004D0
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5012

                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          VoicemodDesktop.exe
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
                                                                                                                                                                                                                                          • Size 2.8MB
                                                                                                                                                                                                                                          • SHA256 d2a3683c8078509b09d97da2d190dc9c19f52d22003e31bf29e352beb611be91
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          VoicemodDesktop.exe.config
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe.config
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 71245f7de6f8cd1855194be81c191f8435fbe62b780f40fadfbce1efabb21f44
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          SaveDefaultDevices.exe
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe
                                                                                                                                                                                                                                          • Size 149KB
                                                                                                                                                                                                                                          • SHA256 663e5b184648639cbcf353ddaeec6688abe323dbccf8de8fc8d2683f5e1a99cb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          devcon.exe
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\driver\devcon.exe
                                                                                                                                                                                                                                          • Size 103KB
                                                                                                                                                                                                                                          • SHA256 4bee65c38784c64888c12dc35fc706051dcdb32b4949766e83ad260096601812
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          setupDrv.bat
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\driver\setupDrv.bat
                                                                                                                                                                                                                                          • Size 110B
                                                                                                                                                                                                                                          • SHA256 8d0ee2177712918bde4be1fdba8d87815863d864a993a3361459ce194131f6a3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          uninstalldriver.bat
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\driver\uninstalldriver.bat
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 883f7763a00f6419f7acc21a1772077e16b432dd1b6d15ba092a3a3a19667bc3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          vmdrv.inf
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\driver\vmdrv.inf
                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                          • SHA256 fdc1514450a4eac615d959e17e527c6d69cfe92871626b39bc38a096a439a45d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Fleck.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\Fleck.dll
                                                                                                                                                                                                                                          • Size 43KB
                                                                                                                                                                                                                                          • SHA256 65ae6fc064fe4e079fd7a462b79694b22275307723e0127dfe5c33132d30f902
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Hardcodet.Wpf.TaskbarNotification.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\Hardcodet.Wpf.TaskbarNotification.dll
                                                                                                                                                                                                                                          • Size 43KB
                                                                                                                                                                                                                                          • SHA256 f84935be717e1c49a54c1d7f8476243a4d34c0ea90c4ad13afe3f50164ba5f2e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Newtonsoft.Json.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\Newtonsoft.Json.dll
                                                                                                                                                                                                                                          • Size 638KB
                                                                                                                                                                                                                                          • SHA256 973fd70ce48e5ac433a101b42871680c51e2feba2aeec3d400dea4115af3a278
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          RawInputProcessor.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\RawInputProcessor.dll
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 ee069a485d30cebc1c56f25d2c1b418c13bf685065f1a3c2976bbec42f5b53b9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          SharpDX.RawInput.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\SharpDX.RawInput.dll
                                                                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                                                                          • SHA256 727e4f5e311b1f582bc89ae9e2c3cd585b7952c433b6e7656521bac05811f651
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          SharpDX.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\SharpDX.dll
                                                                                                                                                                                                                                          • Size 260KB
                                                                                                                                                                                                                                          • SHA256 28437b8f6036224b187f6ec324af9cd8f20dc5e363b0341f86869e4172f07909
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          SimpleConverter.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\SimpleConverter.dll
                                                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                                                          • SHA256 f6d536162aed7f088b7d7d4bd18f33373f912cf6c3c2699cd7703ea2eef05cbe
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          VoicemodControls.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\VoicemodControls.dll
                                                                                                                                                                                                                                          • Size 22KB
                                                                                                                                                                                                                                          • SHA256 f99f25bdfa5ea1a40fc219738ea3e56657a2119bd9d07c3961a168a72ab37f9e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          VoicemodLogger.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\VoicemodLogger.dll
                                                                                                                                                                                                                                          • Size 14KB
                                                                                                                                                                                                                                          • SHA256 8f2c68dd604321d09343b5566b74d72527e78ad717fc41e91d48ce931a8eedb0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          VoicemodSDKDotNET.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\VoicemodSDKDotNET.dll
                                                                                                                                                                                                                                          • Size 22.4MB
                                                                                                                                                                                                                                          • SHA256 0286fcd7d25ae394323ce46b23d800f966e4da4d8441d51d6d74f3943cd69b0f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          VoicemodShockets.dll
                                                                                                                                                                                                                                          • Path C:\Program Files\Voicemod Desktop\lib\VoicemodShockets.dll
                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                          • SHA256 3c560d555221dc58b10de2edbedab07541b9673e686279c883ee955646096f2c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          sdk-walkie-terror-1.dat
                                                                                                                                                                                                                                          • Path C:\ProgramData\Voicemod\VoiceData\sdk-walkie-terror-1.dat
                                                                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                                                                          • SHA256 254cca4fe05e8cb0b4d8ddd977258f1e780bb12f6d473e407e8445d1022649a8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                          • Size 471B
                                                                                                                                                                                                                                          • SHA256 35816f81ff52b6a349ebf83d94d07d2ce53bc514b03839ce5453ab610b3c206e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                          • Size 471B
                                                                                                                                                                                                                                          • SHA256 1ae9fd19a898779875deeeb4f5d031311bfdcad45d4a9a1091e15238d370dfaa
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                          • Size 396B
                                                                                                                                                                                                                                          • SHA256 e9f234e69a98b1dd362497a6c2d0237e4dad114a6a2dad88b501eb09d77c9d4e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                          • Size 408B
                                                                                                                                                                                                                                          • SHA256 af3465db1c7be130065c0013fdca0b625cc08c9bd3209f950bf7cb28fa1ec09a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          VoicemodSDK.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\VoicemodSDKDotNET.Amd64.1.3.0.7\VoicemodSDK.dll
                                                                                                                                                                                                                                          • Size 22.3MB
                                                                                                                                                                                                                                          • SHA256 e3dea719f31d200f4e9719d5a8e7e34ff385652bec82c2ee7fbbc48ac888fa1b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          idp.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-6OG9K.tmp\idp.dll
                                                                                                                                                                                                                                          • Size 216KB
                                                                                                                                                                                                                                          • SHA256 e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          vc_redist.x64.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-6OG9K.tmp\vc_redist.x64.exe
                                                                                                                                                                                                                                          • Size 14.6MB
                                                                                                                                                                                                                                          • SHA256 7cf24eba2bd67ea6229b7dd131e06f4e92ebefc06e36fe401cdd227d7ed78264
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          vc_redist.x86.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-6OG9K.tmp\vc_redist.x86.exe
                                                                                                                                                                                                                                          • Size 14.0MB
                                                                                                                                                                                                                                          • SHA256 251640e8039d34290133b2c6e3e6fe098e61e2756d5a4c45fdcec9e4dee6c187
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          VoicemodSetup.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-Q5S6E.tmp\VoicemodSetup.tmp
                                                                                                                                                                                                                                          • Size 737KB
                                                                                                                                                                                                                                          • SHA256 326071c6e04b3552414337cea066d809d987dbddbc8ad717626abc9dff748956
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          vmdrv.sys
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\{df10c5fe-eb53-584a-bd4e-cca0a044fa5d}\vmdrv.sys
                                                                                                                                                                                                                                          • Size 44KB
                                                                                                                                                                                                                                          • SHA256 1f6cbdc32658ffcf48f6a037302f96c515febe16b459eeddd9c5624d5be91182
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          3mtximzs.newcfg
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\3mtximzs.newcfg
                                                                                                                                                                                                                                          • Size 580B
                                                                                                                                                                                                                                          • SHA256 1551dd11ef2a6dd31557ece197d2db5d1a54ba79a71436824f3d6c0a976eda33
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          kz40scic.newcfg
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\kz40scic.newcfg
                                                                                                                                                                                                                                          • Size 1001B
                                                                                                                                                                                                                                          • SHA256 3f5c8d241a3df907883d4c600302abc0a62867542721eabf6436a332cd4094f8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          user.config
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\user.config
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 207fc8affa3f683cc3e8f11ca2f9c9c07715a3efe03861bd0b8b7a189b16500c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          user.config
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\user.config
                                                                                                                                                                                                                                          • Size 332B
                                                                                                                                                                                                                                          • SHA256 733e489330d34542d6f8eca88b68115b6611f7cc4c44abe8433fe190784fce2d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          vc_redist.x64.exe
                                                                                                                                                                                                                                          • Path C:\Windows\Temp\{A08E69A2-DA04-4C90-A6EF-7A57B907CE15}\.cr\vc_redist.x64.exe
                                                                                                                                                                                                                                          • Size 917KB
                                                                                                                                                                                                                                          • SHA256 8c13a649c567be84e4e3a262689f6b59dcde3e9f8b0037869710fc693b2bc0ff
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          vc_redist.x86.exe
                                                                                                                                                                                                                                          • Path C:\Windows\Temp\{AFD766D9-1A9E-4F24-8268-55D8BD84FA9B}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                                          • Size 917KB
                                                                                                                                                                                                                                          • SHA256 8440d4640ee1eee29b31a85c1c05f6106b907a2967a2902570d53996230f9571
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          license.rtf
                                                                                                                                                                                                                                          • Path C:\Windows\Temp\{D11DC06E-35D8-41EE-8173-F8ADC49C01F2}\.ba\1055\license.rtf
                                                                                                                                                                                                                                          • Size 177KB
                                                                                                                                                                                                                                          • SHA256 f79108a254f876e0f6bbcb05a9effbe25dc252e7ea256bfe3fd28ceb79737f25
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          logo.png
                                                                                                                                                                                                                                          • Path C:\Windows\Temp\{D11DC06E-35D8-41EE-8173-F8ADC49C01F2}\.ba\logo.png
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          wixstdba.dll
                                                                                                                                                                                                                                          • Path C:\Windows\Temp\{D11DC06E-35D8-41EE-8173-F8ADC49C01F2}\.ba\wixstdba.dll
                                                                                                                                                                                                                                          • Size 215KB
                                                                                                                                                                                                                                          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          license.rtf
                                                                                                                                                                                                                                          • Path C:\Windows\Temp\{FBCAA3D7-D3AE-41BA-A1F6-F14390D2DD8D}\.ba\1036\license.rtf
                                                                                                                                                                                                                                          • Size 136KB
                                                                                                                                                                                                                                          • SHA256 84cfc67f98d7553ab6af43e9b8d89138a9f46d0fd9291a441d7fe73f5c1a9dc6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          vmdrv.cat
                                                                                                                                                                                                                                          • Path \??\c:\program files\voicemod desktop\driver\vmdrv.cat
                                                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                                                          • SHA256 488b32ba019c0db448d0669f70bdf564d0f4bd23c7f9592d185474b0d62c763a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          memory/3536-433-0x000001847F5E0000-0x000001847F77A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3792-307-0x000001CED9350000-0x000001CED9381000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-34-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-503-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-5-0x00000000006E0000-0x00000000006E1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-306-0x0000000006F40000-0x0000000006FE0000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-22-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-304-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-30-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-54-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-50-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-18-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-46-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-14-0x0000000000BE0000-0x0000000000C5A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-42-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-26-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-13-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-38-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-504-0x0000000000BE0000-0x0000000000C5A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-505-0x0000000006F40000-0x0000000006FE0000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3820-15-0x00000000006E0000-0x00000000006E1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4752-500-0x00000197DB1D0000-0x00000197DB36A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4752-501-0x00000197C10B0000-0x00000197C10C2000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4896-507-0x00000000005C0000-0x000000000063A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4896-506-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4896-12-0x00000000005C0000-0x000000000063A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4896-11-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4896-0-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-427-0x0000017079D00000-0x000001707B364000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-406-0x0000017078170000-0x0000017078182000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-459-0x0000017078700000-0x0000017078712000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-457-0x0000017078190000-0x0000017078198000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-296-0x000001705F4B0000-0x000001705F4BA000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-453-0x0000017078070000-0x000001707807A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-605-0x0000017077BA0000-0x0000017077D3A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-446-0x0000017078F80000-0x0000017078FB8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-448-0x0000017078FC0000-0x0000017079000000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-447-0x0000017078050000-0x000001707805E000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-439-0x0000017078040000-0x0000017078048000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-279-0x000001705F4A0000-0x000001705F4AA000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-607-0x0000017078720000-0x000001707873E000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-461-0x0000017078780000-0x00000170787A2000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-408-0x00000170781B0000-0x00000170781BC000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-284-0x0000017078080000-0x0000017078126000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-599-0x0000017078760000-0x000001707876C000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-602-0x0000017078770000-0x000001707877A000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-601-0x0000017078DE0000-0x0000017078E28000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-604-0x0000017078DB0000-0x0000017078DB8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-603-0x0000017078DA0000-0x0000017078DA8000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-241-0x000001705D450000-0x000001705D722000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-606-0x0000017077E40000-0x0000017077E52000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5704-608-0x00000170786F0000-0x00000170786FB000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5796-449-0x000002A25A760000-0x000002A25A8FA000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/6092-324-0x0000020619630000-0x00000206197CA000-memory.dmp
                                                                                                                                                                                                                                          Download