Overview

overview

8

Static

static

1

VoicemodIn...1).exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    600s
  • max time network
    601s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/05/2026, 21:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VoicemodInstaller_1.6.6-9jhdop (1).exe
  • Size 6.0MB
  • Sample260503-1nm2eahv71
  • SHA256 2e27f78db7897ce4ac6cf70c0ddd3de55305c4849d588961d7a5b65243792d7f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Drops file in Drivers directory 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 6 IoCs
    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 29 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 47 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.6-9jhdop (1).exe
    "C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.6-9jhdop (1).exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Users\Admin\AppData\Local\Temp\is-MFUSM.tmp\VoicemodInstaller_1.6.6-9jhdop (1).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MFUSM.tmp\VoicemodInstaller_1.6.6-9jhdop (1).tmp" /SL5="$6025E,5491177,839680,C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.6-9jhdop (1).exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
        3⤵
          PID:3108
        • C:\Windows\system32\curl.exe
          "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\" }},\"event_type\": \"custom_event\"}],\"ip\": \"45.84.107.200\",\"environment\": \"production\"}"
          3⤵
            PID:1072
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1056
            • C:\Windows\system32\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:3120
          • C:\Windows\system32\curl.exe
            "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
            3⤵
              PID:4292
            • C:\Windows\system32\curl.exe
              "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Downloading VC x64 Redistributable\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\" }},\"event_type\": \"custom_event\"}],\"ip\": \"109.70.100.3\",\"environment\": \"production\"}"
              3⤵
                PID:3616
              • C:\Windows\system32\curl.exe
                "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                3⤵
                  PID:3996
                • C:\Windows\system32\curl.exe
                  "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Downloading VC x86 Redistributable\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\" }},\"event_type\": \"custom_event\"}],\"ip\": \"109.70.100.3\",\"environment\": \"production\"}"
                  3⤵
                    PID:2608
                  • C:\Windows\system32\curl.exe
                    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                    3⤵
                      PID:784
                    • C:\Windows\system32\curl.exe
                      "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpWelcome\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\",\"page_number\": \"1\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                      3⤵
                        PID:4836
                      • C:\Windows\system32\curl.exe
                        "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                        3⤵
                          PID:2032
                        • C:\Windows\system32\curl.exe
                          "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpLicense\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\",\"page_number\": \"2\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                          3⤵
                            PID:1720
                          • C:\Windows\system32\curl.exe
                            "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                            3⤵
                              PID:3404
                            • C:\Windows\system32\curl.exe
                              "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectDir\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\",\"page_number\": \"6\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                              3⤵
                                PID:2844
                              • C:\Windows\system32\curl.exe
                                "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                3⤵
                                  PID:2464
                                • C:\Windows\system32\curl.exe
                                  "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectTasks\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\",\"page_number\": \"9\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                  3⤵
                                    PID:1332
                                  • C:\Windows\system32\curl.exe
                                    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                    3⤵
                                      PID:4372
                                    • C:\Windows\system32\curl.exe
                                      "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpReady\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\",\"page_number\": \"10\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                      3⤵
                                        PID:1772
                                      • C:\Windows\system32\curl.exe
                                        "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                        3⤵
                                          PID:1132
                                        • C:\Windows\system32\curl.exe
                                          "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Page undefined\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\",\"page_number\": \"101\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                          3⤵
                                            PID:3580
                                          • C:\Windows\system32\curl.exe
                                            "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                            3⤵
                                              PID:3532
                                            • C:\Windows\system32\curl.exe
                                              "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpPreparing\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\",\"page_number\": \"11\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                              3⤵
                                                PID:4292
                                              • C:\Windows\system32\curl.exe
                                                "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                                3⤵
                                                  PID:2500
                                                • C:\Windows\system32\curl.exe
                                                  "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpInstalling\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\",\"page_number\": \"12\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                                  3⤵
                                                    PID:4908
                                                  • C:\Windows\system32\curl.exe
                                                    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                                    3⤵
                                                      PID:5040
                                                    • C:\Windows\system32\curl.exe
                                                      "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Step Install\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                                      3⤵
                                                        PID:5096
                                                      • C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\vm_vc_Redist.x64.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\vm_vc_Redist.x64.exe" /quiet /norestart
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:916
                                                        • C:\Windows\Temp\{807ADA14-B99E-4F0F-93B6-6968BE77ADC4}\.cr\vm_vc_Redist.x64.exe
                                                          "C:\Windows\Temp\{807ADA14-B99E-4F0F-93B6-6968BE77ADC4}\.cr\vm_vc_Redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\vm_vc_Redist.x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=728 /quiet /norestart
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1064
                                                          • C:\Windows\Temp\{95AEC16A-0A04-400D-8F8A-3FC2C2998AE3}\.be\VC_redist.x64.exe
                                                            "C:\Windows\Temp\{95AEC16A-0A04-400D-8F8A-3FC2C2998AE3}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{98FCBCB4-D801-401E-8E51-99B578D8679C} {D41E053C-BA6F-45A4-9E99-4777FD23028D} 1064
                                                            5⤵
                                                            • Adds Run key to start application
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:780
                                                            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1108 -burn.embedded BurnPipe.{8CDB9C20-A2AA-4D57-9C3C-55D7C00362A3} {225D18B0-AFD3-4960-85F9-3CD90BB74DF3} 780
                                                              6⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2336
                                                              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1108 -burn.embedded BurnPipe.{8CDB9C20-A2AA-4D57-9C3C-55D7C00362A3} {225D18B0-AFD3-4960-85F9-3CD90BB74DF3} 780
                                                                7⤵
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4856
                                                                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0786B1FD-1A51-440C-9673-7D9E9B012A36} {0EF36C73-A85B-42C5-B2C7-4EE7322E44CF} 4856
                                                                  8⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:2436
                                                      • C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\vm_vc_Redist.x86.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\vm_vc_Redist.x86.exe" /quiet /norestart
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3440
                                                        • C:\Windows\Temp\{6372FC47-33DE-4D5E-87D7-09599808D8E4}\.cr\vm_vc_Redist.x86.exe
                                                          "C:\Windows\Temp\{6372FC47-33DE-4D5E-87D7-09599808D8E4}\.cr\vm_vc_Redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\vm_vc_Redist.x86.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /quiet /norestart
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4752
                                                          • C:\Windows\Temp\{A402F39D-2F6C-4B18-9781-B131F2ED352B}\.be\VC_redist.x86.exe
                                                            "C:\Windows\Temp\{A402F39D-2F6C-4B18-9781-B131F2ED352B}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{DFFB0BB5-6C2B-4FD4-AADC-093E3EA2A6A3} {D2F61C41-6B74-4029-BEDE-20F353E978CF} 4752
                                                            5⤵
                                                            • Adds Run key to start application
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3360
                                                            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=884 -burn.embedded BurnPipe.{D3724D5D-3DD2-42D1-A2B9-6953E3DE42AA} {77D2BA35-70F6-4CDB-B2E5-DE528DE04A7F} 3360
                                                              6⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3568
                                                              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=884 -burn.embedded BurnPipe.{D3724D5D-3DD2-42D1-A2B9-6953E3DE42AA} {77D2BA35-70F6-4CDB-B2E5-DE528DE04A7F} 3360
                                                                7⤵
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:796
                                                                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B6690C48-6D81-40A1-9127-7E6C53CE408D} {D47915CF-D503-4B4E-9130-830C2D96C833} 796
                                                                  8⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:3844
                                                      • C:\Windows\system32\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod V3\driver\setupDrv.bat" true"
                                                        3⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:648
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process 'setupDrvAdmin.bat' -ArgumentList 'true' -Verb runAs -WindowStyle Hidden -Wait"
                                                          4⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5012
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C "C:\Program Files\Voicemod V3\driver\setupDrvAdmin.bat" true
                                                            5⤵
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2824
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c AudioEndPointTool.exe get --name "(Voicemod)" --flow Capture --format Raw --fields ID
                                                              6⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:240
                                                              • C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
                                                                AudioEndPointTool.exe get --name "(Voicemod)" --flow Capture --format Raw --fields ID
                                                                7⤵
                                                                • Executes dropped EXE
                                                                PID:2524
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c AudioEndPointTool.exe get --name "(Voicemod)" --flow Render --format Raw --fields ID
                                                              6⤵
                                                                PID:2548
                                                                • C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
                                                                  AudioEndPointTool.exe get --name "(Voicemod)" --flow Render --format Raw --fields ID
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  PID:3860
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "voicemodcon.exe dp_enum"
                                                                6⤵
                                                                  PID:4612
                                                                  • C:\Program Files\Voicemod V3\driver\voicemodcon.exe
                                                                    voicemodcon.exe dp_enum
                                                                    7⤵
                                                                    • Drops file in Windows directory
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    PID:3252
                                                                • C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
                                                                  AudioEndPointTool.exe get --default --flow=Capture --role=Communications --format=Raw --fields=ID
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:2876
                                                                • C:\Program Files\Voicemod V3\driver\voicemodcon.exe
                                                                  voicemodcon install voicemodvad.inf ROOT\voicemodvad
                                                                  6⤵
                                                                  • Drops file in Windows directory
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Checks SCSI registry key(s)
                                                                  PID:2040
                                                                • C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
                                                                  AudioEndPointTool.exe setdefault --id="{0.0.1.00000000}.{823b724b-b14f-4050-9f6d-55dca47cd386}" --flow=Capture --role=Communications
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:3916
                                                          • C:\Windows\system32\cmd.exe
                                                            "cmd.exe" /C driverquery /V /FO LIST | findstr /I "Voicemod" > "C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\output_ansi.log"
                                                            3⤵
                                                              PID:4004
                                                              • C:\Windows\system32\driverquery.exe
                                                                driverquery /V /FO LIST
                                                                4⤵
                                                                  PID:4020
                                                                • C:\Windows\system32\findstr.exe
                                                                  findstr /I "Voicemod"
                                                                  4⤵
                                                                    PID:4256
                                                                • C:\Windows\system32\cmd.exe
                                                                  "cmd.exe" /C driverquery /V /FO LIST | findstr /I "Voicemod" > "C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\output_ansi.log"
                                                                  3⤵
                                                                    PID:6128
                                                                    • C:\Windows\system32\driverquery.exe
                                                                      driverquery /V /FO LIST
                                                                      4⤵
                                                                        PID:5168
                                                                      • C:\Windows\system32\findstr.exe
                                                                        findstr /I "Voicemod"
                                                                        4⤵
                                                                          PID:5176
                                                                      • C:\Windows\system32\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /C netsh advfirewall firewall delete rule name=all program="C:\Program Files\Voicemod V3\Voicemod.exe"
                                                                        3⤵
                                                                          PID:5356
                                                                          • C:\Windows\system32\netsh.exe
                                                                            netsh advfirewall firewall delete rule name=all program="C:\Program Files\Voicemod V3\Voicemod.exe"
                                                                            4⤵
                                                                            • Modifies Windows Firewall
                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                            PID:5360
                                                                        • C:\Windows\system32\cmd.exe
                                                                          "C:\Windows\system32\cmd.exe" /C netsh advfirewall firewall delete rule name=all program="C:\Users\Admin\AppData\Local\VoicemodV3\app\last\Voicemod.exe"
                                                                          3⤵
                                                                            PID:5472
                                                                            • C:\Windows\system32\netsh.exe
                                                                              netsh advfirewall firewall delete rule name=all program="C:\Users\Admin\AppData\Local\VoicemodV3\app\last\Voicemod.exe"
                                                                              4⤵
                                                                              • Modifies Windows Firewall
                                                                              • Event Triggered Execution: Netsh Helper DLL
                                                                              PID:5480
                                                                          • C:\Windows\system32\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C netsh advfirewall firewall add rule name="Voicemod" dir=in action=allow program="C:\Program Files\Voicemod V3\Voicemod.exe"
                                                                            3⤵
                                                                              PID:5624
                                                                              • C:\Windows\system32\netsh.exe
                                                                                netsh advfirewall firewall add rule name="Voicemod" dir=in action=allow program="C:\Program Files\Voicemod V3\Voicemod.exe"
                                                                                4⤵
                                                                                • Modifies Windows Firewall
                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                PID:5580
                                                                            • C:\Windows\system32\cmd.exe
                                                                              "C:\Windows\system32\cmd.exe" /C netsh advfirewall firewall add rule name="Voicemod" dir=in action=allow program="C:\Users\Admin\AppData\Local\VoicemodV3\app\last\Voicemod.exe"
                                                                              3⤵
                                                                                PID:5788
                                                                                • C:\Windows\system32\netsh.exe
                                                                                  netsh advfirewall firewall add rule name="Voicemod" dir=in action=allow program="C:\Users\Admin\AppData\Local\VoicemodV3\app\last\Voicemod.exe"
                                                                                  4⤵
                                                                                  • Modifies Windows Firewall
                                                                                  • Event Triggered Execution: Netsh Helper DLL
                                                                                  PID:5748
                                                                              • C:\Windows\system32\cmd.exe
                                                                                "C:\Windows\system32\cmd.exe" /C netsh advfirewall firewall add rule name="Voicemod" dir=out action=allow program="C:\Program Files\Voicemod V3\Voicemod.exe"
                                                                                3⤵
                                                                                  PID:5844
                                                                                  • C:\Windows\system32\netsh.exe
                                                                                    netsh advfirewall firewall add rule name="Voicemod" dir=out action=allow program="C:\Program Files\Voicemod V3\Voicemod.exe"
                                                                                    4⤵
                                                                                    • Modifies Windows Firewall
                                                                                    • Event Triggered Execution: Netsh Helper DLL
                                                                                    PID:5904
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" /C netsh advfirewall firewall add rule name="Voicemod" dir=out action=allow program="C:\Users\Admin\AppData\Local\VoicemodV3\app\last\Voicemod.exe"
                                                                                  3⤵
                                                                                    PID:5940
                                                                                    • C:\Windows\system32\netsh.exe
                                                                                      netsh advfirewall firewall add rule name="Voicemod" dir=out action=allow program="C:\Users\Admin\AppData\Local\VoicemodV3\app\last\Voicemod.exe"
                                                                                      4⤵
                                                                                      • Modifies Windows Firewall
                                                                                      • Event Triggered Execution: Netsh Helper DLL
                                                                                      PID:5980
                                                                                  • C:\Windows\system32\curl.exe
                                                                                    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                                                                    3⤵
                                                                                      PID:2828
                                                                                    • C:\Windows\system32\curl.exe
                                                                                      "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Step PostInstall\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                                                                      3⤵
                                                                                        PID:6124
                                                                                      • C:\Windows\system32\curl.exe
                                                                                        "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                                                                        3⤵
                                                                                          PID:3224
                                                                                        • C:\Windows\system32\curl.exe
                                                                                          "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Done\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                                                                          3⤵
                                                                                            PID:5304
                                                                                          • C:\Windows\system32\curl.exe
                                                                                            "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                                                                            3⤵
                                                                                              PID:4604
                                                                                            • C:\Windows\system32\curl.exe
                                                                                              "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpFinished\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\",\"page_number\": \"14\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                                                                              3⤵
                                                                                                PID:5200
                                                                                              • C:\Program Files\Voicemod V3\Voicemod.exe
                                                                                                "C:\Program Files\Voicemod V3\Voicemod.exe"
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5872
                                                                                              • C:\Windows\system32\curl.exe
                                                                                                "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
                                                                                                3⤵
                                                                                                  PID:540
                                                                                                • C:\Windows\system32\curl.exe
                                                                                                  "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\"},\"mp_deviceid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\",\"events\": [{\"data\": {\"event_name\": \"Installer Step Done\" , \"custom_attributes\": { \"version\": \"1.6.6\", \"app_version\": \"1.6.6\", \"machine_guid\": \"68e374fc-f357-4250-8d29-7c5d08dfc5ff\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.22000)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"9jhdop\" }},\"event_type\": \"custom_event\"}],\"ip\": \"104.244.78.233\",\"environment\": \"production\"}"
                                                                                                  3⤵
                                                                                                    PID:4728
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                1⤵
                                                                                                  PID:1480
                                                                                                • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                                                                                  C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                                                                                  1⤵
                                                                                                  • Drops file in Windows directory
                                                                                                  PID:3388
                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                                  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                                  1⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1720
                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                  1⤵
                                                                                                    PID:792
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                    1⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Enumerates system info in registry
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3020
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8641dc728,0x7ff8641dc734,0x7ff8641dc740
                                                                                                      2⤵
                                                                                                        PID:244
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,15103719379650491025,17447612785879289091,262144 --field-trial-handle=2068,i,18173008659763713040,5528667981207460652,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2064 /prefetch:2
                                                                                                        2⤵
                                                                                                          PID:2468
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,8518197695599895696,4490352997623921585,524288 --field-trial-handle=2068,i,18173008659763713040,5528667981207460652,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2112 /prefetch:11
                                                                                                          2⤵
                                                                                                          • System Time Discovery
                                                                                                          PID:3560
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,513863265417503122,761787189536896490,524288 --field-trial-handle=2068,i,18173008659763713040,5528667981207460652,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2356 /prefetch:13
                                                                                                          2⤵
                                                                                                            PID:2228
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,18198829530084714252,9874235759160858043,2097152 --field-trial-handle=2068,i,18173008659763713040,5528667981207460652,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3276 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5028
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,4030004424236720032,9414677096158197941,2097152 --field-trial-handle=2068,i,18173008659763713040,5528667981207460652,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3312 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:428
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,12571427292313608973,3692906290145814044,2097152 --field-trial-handle=2068,i,18173008659763713040,5528667981207460652,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4212 /prefetch:9
                                                                                                                2⤵
                                                                                                                  PID:1716
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4532,i,6452413067062485403,3907820943314836812,2097152 --field-trial-handle=2068,i,18173008659763713040,5528667981207460652,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4680 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:3252
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,15811075594818759263,9502623836943207705,524288 --field-trial-handle=2068,i,18173008659763713040,5528667981207460652,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5284 /prefetch:14
                                                                                                                    2⤵
                                                                                                                      PID:1884
                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                    1⤵
                                                                                                                      PID:1160
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                      1⤵
                                                                                                                        PID:1084
                                                                                                                      • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                                                                                                        C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                                                                                                        1⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:4764
                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                                                        1⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2028
                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                                                        1⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2200
                                                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                                                        C:\Windows\system32\vssvc.exe
                                                                                                                        1⤵
                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:2688
                                                                                                                      • C:\Windows\system32\srtasks.exe
                                                                                                                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                        1⤵
                                                                                                                          PID:4444
                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                          1⤵
                                                                                                                          • Enumerates connected drives
                                                                                                                          • Drops file in System32 directory
                                                                                                                          • Drops file in Windows directory
                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:3520
                                                                                                                        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                                                                          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1528
                                                                                                                          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                                                                            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260503225046.log"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4228
                                                                                                                            • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                                                                              "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260503225046.log"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:4416
                                                                                                                              • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                                                                                                                                "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5F48F290-EB69-4AEC-9890-C269F170D9E4} {24C34DE4-4CEC-4529-B130-57CBF07A9BBE} 4416
                                                                                                                                4⤵
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry class
                                                                                                                                PID:2276
                                                                                                                        • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                                                                                                          "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1336
                                                                                                                          • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                                                                                                            "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260503225100.log"
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4852
                                                                                                                            • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                                                                                                              "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260503225100.log"
                                                                                                                              3⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3852
                                                                                                                              • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                                                                                                                "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{85165AFF-831F-4A8A-83C7-056CE339A6F7} {31C9D95C-AE7D-442D-A438-ACEABD49A776} 3852
                                                                                                                                4⤵
                                                                                                                                • Adds Run key to start application
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:6016
                                                                                                                        • C:\Program Files\Voicemod V3\Voicemod.exe
                                                                                                                          "C:\Program Files\Voicemod V3\Voicemod.exe" --boot
                                                                                                                          1⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Checks whether UAC is enabled
                                                                                                                          • Checks processor information in registry
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:3404
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.6 --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=3404.1520.15548988060947332768
                                                                                                                            2⤵
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Enumerates system info in registry
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                            PID:224
                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0xe4,0x170,0x7ff8628fb078,0x7ff8628fb084,0x7ff8628fb090
                                                                                                                              3⤵
                                                                                                                                PID:1948
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1668,i,5108321245343985387,13117498998248547005,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
                                                                                                                                3⤵
                                                                                                                                  PID:2592
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1376,i,5108321245343985387,13117498998248547005,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
                                                                                                                                  3⤵
                                                                                                                                    PID:4908
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2304,i,5108321245343985387,13117498998248547005,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
                                                                                                                                    3⤵
                                                                                                                                      PID:5128
                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3548,i,5108321245343985387,13117498998248547005,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
                                                                                                                                      3⤵
                                                                                                                                        PID:5528
                                                                                                                                    • C:\Windows\SYSTEM32\icacls.exe
                                                                                                                                      icacls "C:/Users/Admin/AppData\Local/VoicemodV3/app\last" /grant *S-1-1-0:F /t /c /q
                                                                                                                                      2⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      PID:5392
                                                                                                                                    • C:\Users\Admin\AppData\Local\VoicemodV3\app\last\Voicemod.exe
                                                                                                                                      "C:/Users/Admin/AppData/Local/VoicemodV3/app/last/Voicemod.exe" --boot --launcher
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Checks processor information in registry
                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:6076
                                                                                                                                      • C:\Users\Admin\AppData\Local\VoicemodV3\app\last\crashpad_handler.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\VoicemodV3\app\last\crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\.ui-agent --metrics-dir=C:\Users\Admin\AppData\Local\Temp\.ui-agent --url=https://sentry.voicemod.net:443/api/62/minidump/?sentry_client=sentry.native/0.7.6&sentry_key=6cd47648abad7234015b01aa5436ccd2 --attachment=C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-breadcrumb2 --initial-client-data=0x528,0x52c,0x530,0x504,0x534,0x7ff632f342b8,0x7ff632f342d0,0x7ff632f342e8
                                                                                                                                        3⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        PID:2616
                                                                                                                                      • C:\Users\Admin\AppData\Local\VoicemodV3\app\last\QtWebEngineProcess.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\VoicemodV3\app\last\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --webengine-locales-path="C:/Users/Admin/AppData/Local/VoicemodV3/app/last/translations\qtwebengine_locales" --webengine-resources-path="C:/Users/Admin/AppData/Local/VoicemodV3/app/last\resources" --disable-accelerated-video-decode --disable-accelerated-video-encode --disable-speech-api --touch-events=auto --disable-gpu-compositing --disable-blink-features=EyeDropperAPI,WebOTP --video-capture-use-gpu-memory-buffer --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --time-ticks-at-unix-epoch=-1777844414224395 --launch-time-ticks=740174383 --field-trial-handle=6000,i,9471087496637980416,622703379180106214,262144 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,EyeDropper,InstalledApp,WebOTP,WebPayments,WebUSB --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
                                                                                                                                        3⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:2828
                                                                                                                                      • C:\Users\Admin\AppData\Local\VoicemodV3\app\last\QtWebEngineProcess.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\VoicemodV3\app\last\QtWebEngineProcess.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en --service-sandbox-type=audio --use-gl=angle --application-name=VoicemodV3 --webengine-schemes=qrc:sV --webengine-locales-path="C:/Users/Admin/AppData/Local/VoicemodV3/app/last/translations\qtwebengine_locales" --webengine-resources-path="C:/Users/Admin/AppData/Local/VoicemodV3/app/last\resources" --field-trial-handle=6000,i,9471087496637980416,622703379180106214,262144 --enable-features=NetworkServiceInProcess2,TracingServiceInProcess --disable-features=BackgroundFetch,EyeDropper,InstalledApp,WebOTP,WebPayments,WebUSB --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:12
                                                                                                                                        3⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:4804
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                                    1⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                    PID:1692
                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6f1a7b0e-5960-f34d-abff-03670569c43c}\voicemodvad.inf" "9" "49f38a543" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files\voicemod v3\driver"
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      PID:4848
                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                      DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca110bbfc653:VOICEMODVAD_DRIVER:2025.10.8.0:root\voicemodvad," "49f38a543" "0000000000000148" "fece"
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5060
                                                                                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                    C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C8
                                                                                                                                    1⤵
                                                                                                                                      PID:5876

                                                                                                                                    Network

                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                          Reconnaissance

                                                                                                                                          Resource Development

                                                                                                                                          Initial Access

                                                                                                                                          Execution

                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                          1
                                                                                                                                          T1059

                                                                                                                                          PowerShell

                                                                                                                                          1
                                                                                                                                          T1059.001

                                                                                                                                          Persistence

                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                          1
                                                                                                                                          T1547

                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                          1
                                                                                                                                          T1547.001

                                                                                                                                          Create or Modify System Process

                                                                                                                                          1
                                                                                                                                          T1543

                                                                                                                                          Windows Service

                                                                                                                                          1
                                                                                                                                          T1543.003

                                                                                                                                          Event Triggered Execution

                                                                                                                                          1
                                                                                                                                          T1546

                                                                                                                                          Netsh Helper DLL

                                                                                                                                          1
                                                                                                                                          T1546.007

                                                                                                                                          Privilege Escalation

                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                          1
                                                                                                                                          T1547

                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                          1
                                                                                                                                          T1547.001

                                                                                                                                          Create or Modify System Process

                                                                                                                                          1
                                                                                                                                          T1543

                                                                                                                                          Windows Service

                                                                                                                                          1
                                                                                                                                          T1543.003

                                                                                                                                          Event Triggered Execution

                                                                                                                                          1
                                                                                                                                          T1546

                                                                                                                                          Netsh Helper DLL

                                                                                                                                          1
                                                                                                                                          T1546.007

                                                                                                                                          Defense Evasion

                                                                                                                                          File and Directory Permissions Modification

                                                                                                                                          1
                                                                                                                                          T1222

                                                                                                                                          Impair Defenses

                                                                                                                                          1
                                                                                                                                          T1562

                                                                                                                                          Disable or Modify System Firewall

                                                                                                                                          1
                                                                                                                                          T1562.004

                                                                                                                                          Modify Registry

                                                                                                                                          1
                                                                                                                                          T1112

                                                                                                                                          Credential Access

                                                                                                                                          Credentials from Password Stores

                                                                                                                                          1
                                                                                                                                          T1555

                                                                                                                                          Credentials from Web Browsers

                                                                                                                                          1
                                                                                                                                          T1555.003

                                                                                                                                          Unsecured Credentials

                                                                                                                                          1
                                                                                                                                          T1552

                                                                                                                                          Credentials In Files

                                                                                                                                          1
                                                                                                                                          T1552.001

                                                                                                                                          Discovery

                                                                                                                                          Browser Information Discovery

                                                                                                                                          1
                                                                                                                                          T1217

                                                                                                                                          Network Share Discovery

                                                                                                                                          1
                                                                                                                                          T1135

                                                                                                                                          Peripheral Device Discovery

                                                                                                                                          2
                                                                                                                                          T1120

                                                                                                                                          Process Discovery

                                                                                                                                          1
                                                                                                                                          T1057

                                                                                                                                          Query Registry

                                                                                                                                          5
                                                                                                                                          T1012

                                                                                                                                          System Information Discovery

                                                                                                                                          6
                                                                                                                                          T1082

                                                                                                                                          System Location Discovery

                                                                                                                                          1
                                                                                                                                          T1614

                                                                                                                                          System Language Discovery

                                                                                                                                          1
                                                                                                                                          T1614.001

                                                                                                                                          System Time Discovery

                                                                                                                                          1
                                                                                                                                          T1124

                                                                                                                                          Lateral Movement

                                                                                                                                          Collection

                                                                                                                                          Data from Local System

                                                                                                                                          1
                                                                                                                                          T1005

                                                                                                                                          Command and Control

                                                                                                                                          Exfiltration

                                                                                                                                          Impact

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          e5a7dc2.rbs
                                                                                                                                          • Path C:\Config.Msi\e5a7dc2.rbs
                                                                                                                                          • Size 19KB
                                                                                                                                          • SHA256 36f90995366961d4dbe771586d225ced7edb54d1750648847ea4dacf02feb555
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          e5a7dce.rbs
                                                                                                                                          • Path C:\Config.Msi\e5a7dce.rbs
                                                                                                                                          • Size 19KB
                                                                                                                                          • SHA256 e93152ec77d81bfcef062d4add4a9a82e34bb7c52b93c1525c9541a05a38dbdb
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          e5a7dd5.rbs
                                                                                                                                          • Path C:\Config.Msi\e5a7dd5.rbs
                                                                                                                                          • Size 21KB
                                                                                                                                          • SHA256 e4169c16f2c25e3e33b74d5a53d5b7836f4ea194576215e548579db1c02d5278
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          e5a7de4.rbs
                                                                                                                                          • Path C:\Config.Msi\e5a7de4.rbs
                                                                                                                                          • Size 21KB
                                                                                                                                          • SHA256 5da61c36ce4cad16f660f76147c078e575f25aa20f0326578383da3e0709a6df
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          e5a7deb.rbs
                                                                                                                                          • Path C:\Config.Msi\e5a7deb.rbs
                                                                                                                                          • Size 16KB
                                                                                                                                          • SHA256 ecdf59738f04cc65417002e3b2d169fe3b7a943e16067fbcd5be7edfc466109d
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          e5a7df0.rbs
                                                                                                                                          • Path C:\Config.Msi\e5a7df0.rbs
                                                                                                                                          • Size 18KB
                                                                                                                                          • SHA256 ba875fed7f0f94c1369eceee9cc66c31988c0a3325ae8f0585895717dbfc3f34
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          e5a7dfd.rbs
                                                                                                                                          • Path C:\Config.Msi\e5a7dfd.rbs
                                                                                                                                          • Size 20KB
                                                                                                                                          • SHA256 8b04c66616c803ff53dfbaec970607061915a1f7f0f1689650a40edb3a62f554
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          e5a7e0c.rbs
                                                                                                                                          • Path C:\Config.Msi\e5a7e0c.rbs
                                                                                                                                          • Size 19KB
                                                                                                                                          • SHA256 82fb314592d2bba74c2c7fee90abb1e459db4afaf4e7fbce1b5f5dc84b903aba
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          is-5DUFP.tmp
                                                                                                                                          • Path C:\Program Files\Voicemod V3\is-5DUFP.tmp
                                                                                                                                          • Size 6.4MB
                                                                                                                                          • SHA256 dd739b7908833b4fe6b41c83a2849494ad5ab5aa0e5371bbd9a696c6ebaf0ea9
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          is-TGMKP.tmp
                                                                                                                                          • Path C:\Program Files\Voicemod V3\is-TGMKP.tmp
                                                                                                                                          • Size 2.7MB
                                                                                                                                          • SHA256 9229a6b27a059d261b03146f07bdd6b5f6dd1baa91703ad504bfd28575847edd
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          state.rsm
                                                                                                                                          • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
                                                                                                                                          • Size 986B
                                                                                                                                          • SHA256 d4c81d3a7344101d2d0ae799c13f48ace29bb48a469315af5af8ff6eab797ec0
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          BookmarkMergedSurfaceOrdering
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                          • Size 6B
                                                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          BrowsingTopicsState
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                          • Size 414B
                                                                                                                                          • SHA256 74da60ec1b35b97442475a6abcb2274399a251cd06c8056178007707156b0cc7
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Network Persistent State
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                          • Size 2KB
                                                                                                                                          • SHA256 e84afc2a3c10e34cf4b1f59b3a4d1f35e38a97dae97e3948b88aa26756c44554
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          SCT Auditing Pending Reports
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                          • Size 2B
                                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          TransportSecurity
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                          • Size 523B
                                                                                                                                          • SHA256 81344e1bacd7bebaef5f3652b5cf4f1f3ee6b119bc4a589fb0aa7dd3abc1aa04
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Preferences
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                          • Size 11KB
                                                                                                                                          • SHA256 3484385bcedb1c9de9af289f8ac25778e6d17cd09257b73accfbcb6726ed69e7
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Secure Preferences
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                          • Size 17KB
                                                                                                                                          • SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          the-real-index
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                          • Size 120B
                                                                                                                                          • SHA256 14cef03521e63410be790807d26555e443332d704de0122d778c189daeff3ab3
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          the-real-index~RFe595838.TMP
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595838.TMP
                                                                                                                                          • Size 96B
                                                                                                                                          • SHA256 7f4617f4b06a1ad3ab27eebec43c2592cf796009d5c6b11f4c38ed8c26323787
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Local State
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                          • Size 90KB
                                                                                                                                          • SHA256 3690a4d8ae6b2fd8c8200e65c8f2ee28b65497333dbb97f6acd92b9b240e413f
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Local State
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                          • Size 198KB
                                                                                                                                          • SHA256 8ccc154451c4b0789151ef897926ea322187408c5e56383e9ba33b430b429971
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          data_1
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                          • Size 264KB
                                                                                                                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                          Submit Download

                                                                                                                                          FileCoAuth-2026-5-3.2149.1720.1.odl
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-5-3.2149.1720.1.odl
                                                                                                                                          • Size 706B
                                                                                                                                          • SHA256 3fa6af2b380018d63115c906138f9a3d7d458970522e610f5d8282e4eda34fe5
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          FileCoAuth-2026-5-3.2149.2028.1.odl
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-5-3.2149.2028.1.odl
                                                                                                                                          • Size 706B
                                                                                                                                          • SHA256 7e583f18e02c8b609beb65b786d21bf00a4eeb93273b6a068ceee64184f1522f
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-breadcrumb1
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-breadcrumb1
                                                                                                                                          • Size 2KB
                                                                                                                                          • SHA256 4071295d2cfcbf4ae517692bdd04f6f219df32fbf69ecc872eac0a5be8f8429c
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 8c88a0ccd435e148b1ace8973cee61d598879877368d8b35c34e333ef99cbaa8
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 1c178faee6fafeebc2c49db8e474ec7ca3b3bc91beb409ab9edf7769432c8e91
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 d6d11b0ecadc3ed3ed41a9868f9beec0023f70e88170cfb246dceabd14200b09
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 a6af305afacd3840749ada1813f76d3b87620e96c63d79be5e53953ef017029f
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 a5fdbb666c8ee86c9753eb87871776fc6bdc4159842b34722c5133ebd46eedf4
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 fbe066b7e5a54413b2146ef3ed13cd36e4a538803bc822b065359c7f484422a0
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 8693b3763ef59469537c917108746fb5f3cc2757f6cce97afa33fe95de9ad7f2
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 7e6fc73260291e19abed98b1154781e6542915743309fb0ae7db9e2a4560b06d
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 6d6b373f2523b77b2372a494621f4f61f55831bf2f28858a3946e71aa466aca4
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 46d80167ff5e4b6227c6b131f8a5b4a6cd088f4e30eb62ebbe3e5cd4ed9ff4d7
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 4c6bf46b3c8e24a1926cd9cd90d3837505bdd3b32f5721a8a64a9e13df8b9f6e
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 bb3382a65e445482426f6025487e36a34e3eaafa34933f756901b05db671e6a7
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 da33f52a3829f32b025f5e3fa86efac07477a4be3453d05974f1bc9e0f2815f1
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 184273fdcc68f8e8abb018d65102ed499ede53e22f01563dadb0ae843f80d06f
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 055f3fb3454ee1f2c1a13919415989587b7ec584f2742eafb303786e71f5a868
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 b8f1a6a3923cee9ad8c2c85adf805db88a45735361c356cf99864fa372a89e69
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 c8d3a5b5d52f9f5409cdb853117914e32a51e39cabf15c464096bf155b7fdf67
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 a4c6cf8de794a1462f376e97137499aac92bd7226ac9596ee3fa0bb8a5f6fdd0
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 ad588eac0a864f46d5c092e17db23dd9bb8ca61b864bce0dd0f94539eafa164d
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          __sentry-event
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\.ui-agent\550761c1-0e5f-4c20-cf30-226e39a81b11.run\__sentry-event
                                                                                                                                          • Size 617B
                                                                                                                                          • SHA256 04ea75f6e4435f69d409e7fd5d65376caee85fd23feded73e7d23087aa39361b
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          AudioEndPointTrace.err
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
                                                                                                                                          • Size 2B
                                                                                                                                          • SHA256 1a6562590ef19d1045d06c4055742d38288e9e6dcd71ccde5cee80f1d5a774eb
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          AudioEndPointTrace.err
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
                                                                                                                                          • Size 2B
                                                                                                                                          • SHA256 f74efabef12ea619e30b79bddef89cffa9dda494761681ca862cff2871a85980
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          AudioEndPointTrace.err
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
                                                                                                                                          • Size 2B
                                                                                                                                          • SHA256 9f14025af0065b30e47e23ebb3b491d39ae8ed17d33739e5ff3827ffb3634953
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          AudioEndPointTrace.err
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
                                                                                                                                          • Size 2B
                                                                                                                                          • SHA256 31489056e0916d59fe3add79e63f095af3ffb81604691f21cad442a85c7be617
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          __PSScriptPolicyTest_k5nas4hs.kle.ps1
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k5nas4hs.kle.ps1
                                                                                                                                          • Size 60B
                                                                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          dd_vcredist_amd64_20260503225046.log
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260503225046.log
                                                                                                                                          • Size 19KB
                                                                                                                                          • SHA256 9a734bb25a4eafca84adcf41c680f92798b314acd34d50a5c1a69f3143e95476
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          dd_vcredist_amd64_20260503225046_000_vcRuntimeMinimum_x64.log
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260503225046_000_vcRuntimeMinimum_x64.log
                                                                                                                                          • Size 2KB
                                                                                                                                          • SHA256 b20b1efeb56a5c7019e2d0951b992280f1318259ab2b871aae066969de95baa8
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          dd_vcredist_amd64_20260503225046_001_vcRuntimeAdditional_x64.log
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260503225046_001_vcRuntimeAdditional_x64.log
                                                                                                                                          • Size 2KB
                                                                                                                                          • SHA256 6fe12482e16cc56804d73e3d10f43eb794b5ff78e72fab26394589ee4a873dd4
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          dd_vcredist_x86_20260503225100_000_vcRuntimeMinimum_x86.log
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260503225100_000_vcRuntimeMinimum_x86.log
                                                                                                                                          • Size 2KB
                                                                                                                                          • SHA256 088d74073dfd8f58ec306dc1025da7a7a39d0f0297be9921be7ba10ad461c66b
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          ipaddress.info
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
                                                                                                                                          • Size 23B
                                                                                                                                          • SHA256 21a8ad5ef448703148c3fdf65da13c8cca183e46678547640e466268e5136c06
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          ipaddress.info
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
                                                                                                                                          • Size 22B
                                                                                                                                          • SHA256 52dbc29ad566699652e4566fdf31afe638ec28e7a4fe1fbf9b2be5e267a25965
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          ipaddress.info
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
                                                                                                                                          • Size 21B
                                                                                                                                          • SHA256 8a62824b62795b44769a68979dbc3b31523425e3230db95415803b821893eb2f
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          VoicemodInstaller_1.6.6-9jhdop (1).tmp
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-MFUSM.tmp\VoicemodInstaller_1.6.6-9jhdop (1).tmp
                                                                                                                                          • Size 2.5MB
                                                                                                                                          • SHA256 2bf779d58d413046b547c9ccf0d21346451f9c3f60e052981d1290d19536ee1f
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          bg-bottom.png
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\bg-bottom.png
                                                                                                                                          • Size 4KB
                                                                                                                                          • SHA256 ff17916663af2e4b08def48861eb38e8cd2ab4e4317e64ddab205803c9bdfad8
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          bg-inner.png
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\bg-inner.png
                                                                                                                                          • Size 6KB
                                                                                                                                          • SHA256 8fe4a3f95d5309e692c4142f460bebe4e4e24844f5a2071d466bd964c5d04dcf
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          bg-top.png
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\bg-top.png
                                                                                                                                          • Size 20KB
                                                                                                                                          • SHA256 bdc753b2b19ee8b573b8e676f18dae42494b99b6bd738194dcdd67f244085f36
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          botva2.dll
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\botva2.dll
                                                                                                                                          • Size 35KB
                                                                                                                                          • SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          buttons.png
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\buttons.png
                                                                                                                                          • Size 1KB
                                                                                                                                          • SHA256 d236f88ef90e6d0e259a586f4e613b14d4a35f3a704ff559dadda31341e99c24
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          idp.dll
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\idp.dll
                                                                                                                                          • Size 232KB
                                                                                                                                          • SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          vm_vc_Redist.x64.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\vm_vc_Redist.x64.exe
                                                                                                                                          • Size 24.4MB
                                                                                                                                          • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          vm_vc_Redist.x86.exe
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\is-OU2E7.tmp\vm_vc_Redist.x86.exe
                                                                                                                                          • Size 13.3MB
                                                                                                                                          • SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          tasklist_unins000.exe.txt
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\tasklist_unins000.exe.txt
                                                                                                                                          • Size 6KB
                                                                                                                                          • SHA256 10279c47dbeabe0707c802f98e96b22b482e901c7722f4c33b0e255e22cd21fa
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          voicemodcon.err
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\voicemodcon.err
                                                                                                                                          • Size 2B
                                                                                                                                          • SHA256 59e19706d51d39f66711c2653cd7eb1291c94d9b55eb14bda74ce4dc636d015a
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          SETA71F.tmp
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\{6f1a7b0e-5960-f34d-abff-03670569c43c}\SETA71F.tmp
                                                                                                                                          • Size 6KB
                                                                                                                                          • SHA256 66b051ba7ead45d25e7cc4ffce5c29923ca80379ad2b0170c49447043e83b1aa
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          voicemodvad.cat
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\{6f1a7b0e-5960-f34d-abff-03670569c43c}\voicemodvad.cat
                                                                                                                                          • Size 11KB
                                                                                                                                          • SHA256 9d33bc81b59c398fc329d61c0698c1907c64aab8d9774cfc4f5d87a8787613d6
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          voicemodvad.sys
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\{6f1a7b0e-5960-f34d-abff-03670569c43c}\voicemodvad.sys
                                                                                                                                          • Size 91KB
                                                                                                                                          • SHA256 93f72a9c74e6e49c50f3fc789bb10ebc72fa5fc85a26278d9a0df73cfa0a798e
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Network Persistent State
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\VoicemodV3\browserCache\persistent\Network Persistent State
                                                                                                                                          • Size 191B
                                                                                                                                          • SHA256 bf56b6f1d3d24ccb9bcb15c9cac3e836658f3fed2b23a4d1fe9930884504d4e1
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          settings.ini
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\VoicemodV3\settings.ini
                                                                                                                                          • Size 132B
                                                                                                                                          • SHA256 3035144967fb33e5f3434a6187377827b3c17ee122e5dd39eeda8558203fd161
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          settings.ini.lock
                                                                                                                                          • Path C:\Users\Admin\AppData\Local\VoicemodV3\settings.ini.lock
                                                                                                                                          • Size 61B
                                                                                                                                          • SHA256 f0b1e23692acdf1a5ccd0ebb48961228cadfdb1d893b507ffcf42cb06f69aa18
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          settings.dat
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Crashpad\settings.dat
                                                                                                                                          • Size 280B
                                                                                                                                          • SHA256 a2838f2002230f5775f9b9b1fff65e2a1acd566ebf3457250edb03739be57c44
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          data_0
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\DawnWebGPUCache\data_0
                                                                                                                                          • Size 8KB
                                                                                                                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                          Submit Download

                                                                                                                                          data_2
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\DawnWebGPUCache\data_2
                                                                                                                                          • Size 8KB
                                                                                                                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                          Submit Download

                                                                                                                                          data_3
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\DawnWebGPUCache\data_3
                                                                                                                                          • Size 8KB
                                                                                                                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                          Submit Download

                                                                                                                                          Network Persistent State
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Network\Network Persistent State
                                                                                                                                          • Size 111B
                                                                                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Network Persistent State~RFe5be0a8.TMP
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Network\Network Persistent State~RFe5be0a8.TMP
                                                                                                                                          • Size 59B
                                                                                                                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Preferences
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Preferences
                                                                                                                                          • Size 6KB
                                                                                                                                          • SHA256 7c874b731a481f8b0e635a6e998a1b8ee0e97463e442aa1f2dae4815c600c2bb
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Preferences
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Preferences
                                                                                                                                          • Size 6KB
                                                                                                                                          • SHA256 ea4ad267806ec9e98bac4a428c71150cfcec752279d5ccc47a97c7e72f1a41a9
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Preferences~RFe5b4f45.TMP
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Preferences~RFe5b4f45.TMP
                                                                                                                                          • Size 6KB
                                                                                                                                          • SHA256 dddcec3c5fa9696335701aa6f0cfeeec255bdf69f1113870ebaf7ebaadf1c073
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          CURRENT
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Site Characteristics Database\CURRENT
                                                                                                                                          • Size 16B
                                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          MANIFEST-000001
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
                                                                                                                                          • Size 41B
                                                                                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                          Submit Download

                                                                                                                                          Local State
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State
                                                                                                                                          • Size 1KB
                                                                                                                                          • SHA256 9d3b1c60b58f751dada10066812d8c84084db6150b6136b309ba7da6af494904
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Local State
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State
                                                                                                                                          • Size 15KB
                                                                                                                                          • SHA256 7468b3638990b7e516e2d76a06830841bba51912ea4b92a75db6843f7f6f7a7e
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Local State
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State
                                                                                                                                          • Size 2KB
                                                                                                                                          • SHA256 908b5698b6a3c8fd1b3f9928d8b0ee0948dc497c2c9feb26344e3061982a3eab
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Local State
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 1b0aa456009e1833a4e36db2ba61576f093eac0b27751def3244e1691fbac124
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          Local State~RFe5ab15f.TMP
                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State~RFe5ab15f.TMP
                                                                                                                                          • Size 1KB
                                                                                                                                          • SHA256 58986dbe51be632c8a6f79e7cbffad0498323ed85922bc31961732b2050d2d80
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1028\license.rtf
                                                                                                                                          • Size 17KB
                                                                                                                                          • SHA256 44c76290f7a2e45940e8338912feb49bcf4e071cfa85d2d34762857743acbc8d
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1028\thm.wxl
                                                                                                                                          • Size 2KB
                                                                                                                                          • SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1029\license.rtf
                                                                                                                                          • Size 12KB
                                                                                                                                          • SHA256 503c433dcde2f3a9e7d388a5ff2b0612e7d8f90f5188d5b2b60228db33044fde
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1029\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1031\license.rtf
                                                                                                                                          • Size 12KB
                                                                                                                                          • SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1031\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1036\license.rtf
                                                                                                                                          • Size 12KB
                                                                                                                                          • SHA256 5c13a65870d770d1642a4259eecb436257ca39016a0500f747be9c79be0c7009
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1036\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1040\license.rtf
                                                                                                                                          • Size 11KB
                                                                                                                                          • SHA256 70ecf23c03b66a2b18e173332586afa8f00f91e02a80628f4f9cb2521e27f6ac
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1040\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1041\license.rtf
                                                                                                                                          • Size 29KB
                                                                                                                                          • SHA256 c3061a334bfd5f02b7085f8f454d5d3d97d477af14bab497bf31a7887bc90c5b
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1041\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1042\license.rtf
                                                                                                                                          • Size 27KB
                                                                                                                                          • SHA256 3d4e9c165cbeab829d608106f0e96450f839ffa8adbd755f0b51867e89da2ae0
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1042\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1045\license.rtf
                                                                                                                                          • Size 13KB
                                                                                                                                          • SHA256 6f94a99072061012c5626a6dd069809ec841d6e3102b48394d522a0c2e3aa2b5
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1045\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1046\license.rtf
                                                                                                                                          • Size 10KB
                                                                                                                                          • SHA256 27891eec899be859e3b4d3b29247fc6b535d7e836def0329111c48741ec6e701
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1046\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1049\license.rtf
                                                                                                                                          • Size 31KB
                                                                                                                                          • SHA256 1bb3fb55b8a13fa3bafffe72f5b1ed8b57a63bd4d8654bb6dc5b9011ce803b44
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1049\thm.wxl
                                                                                                                                          • Size 4KB
                                                                                                                                          • SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1055\license.rtf
                                                                                                                                          • Size 13KB
                                                                                                                                          • SHA256 f80926604e503697247353f56856b31de0b3fc1319f1c94068363952549cc9b1
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\1055\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\2052\license.rtf
                                                                                                                                          • Size 17KB
                                                                                                                                          • SHA256 a808b4933ce3b3e0893504dbef43ebf90b8b567f94bd6481b6315ed9141e1b11
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\2052\thm.wxl
                                                                                                                                          • Size 2KB
                                                                                                                                          • SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\3082\license.rtf
                                                                                                                                          • Size 10KB
                                                                                                                                          • SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{07404375-B94E-4718-9375-272360D55C0B}\.ba\3082\thm.wxl
                                                                                                                                          • Size 3KB
                                                                                                                                          • SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          vm_vc_Redist.x86.exe
                                                                                                                                          • Path C:\Windows\Temp\{6372FC47-33DE-4D5E-87D7-09599808D8E4}\.cr\vm_vc_Redist.x86.exe
                                                                                                                                          • Size 669KB
                                                                                                                                          • SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          license.rtf
                                                                                                                                          • Path C:\Windows\Temp\{78F1B47E-1FC5-4E2C-A54D-141A38A6E350}\.ba\license.rtf
                                                                                                                                          • Size 9KB
                                                                                                                                          • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.wxl
                                                                                                                                          • Path C:\Windows\Temp\{78F1B47E-1FC5-4E2C-A54D-141A38A6E350}\.ba\thm.wxl
                                                                                                                                          • Size 2KB
                                                                                                                                          • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          thm.xml
                                                                                                                                          • Path C:\Windows\Temp\{78F1B47E-1FC5-4E2C-A54D-141A38A6E350}\.ba\thm.xml
                                                                                                                                          • Size 8KB
                                                                                                                                          • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          wixstdba.dll
                                                                                                                                          • Path C:\Windows\Temp\{78F1B47E-1FC5-4E2C-A54D-141A38A6E350}\.ba\wixstdba.dll
                                                                                                                                          • Size 191KB
                                                                                                                                          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          vm_vc_Redist.x64.exe
                                                                                                                                          • Path C:\Windows\Temp\{807ADA14-B99E-4F0F-93B6-6968BE77ADC4}\.cr\vm_vc_Redist.x64.exe
                                                                                                                                          • Size 670KB
                                                                                                                                          • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          logo.png
                                                                                                                                          • Path C:\Windows\Temp\{95AEC16A-0A04-400D-8F8A-3FC2C2998AE3}\.ba\logo.png
                                                                                                                                          • Size 1KB
                                                                                                                                          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                          Submit Download

                                                                                                                                          wixstdba.dll
                                                                                                                                          • Path C:\Windows\Temp\{95AEC16A-0A04-400D-8F8A-3FC2C2998AE3}\.ba\wixstdba.dll
                                                                                                                                          • Size 215KB
                                                                                                                                          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                                                                          • Path C:\Windows\Temp\{95AEC16A-0A04-400D-8F8A-3FC2C2998AE3}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                                                                                          • Size 5.4MB
                                                                                                                                          • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          cab5046A8AB272BF37297BB7928664C9503
                                                                                                                                          • Path C:\Windows\Temp\{95AEC16A-0A04-400D-8F8A-3FC2C2998AE3}\cab5046A8AB272BF37297BB7928664C9503
                                                                                                                                          • Size 964KB
                                                                                                                                          • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          vcRuntimeAdditional_x64
                                                                                                                                          • Path C:\Windows\Temp\{95AEC16A-0A04-400D-8F8A-3FC2C2998AE3}\vcRuntimeAdditional_x64
                                                                                                                                          • Size 208KB
                                                                                                                                          • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          vcRuntimeMinimum_x64
                                                                                                                                          • Path C:\Windows\Temp\{95AEC16A-0A04-400D-8F8A-3FC2C2998AE3}\vcRuntimeMinimum_x64
                                                                                                                                          • Size 208KB
                                                                                                                                          • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          cab54A5CABBE7274D8A22EB58060AAB7623
                                                                                                                                          • Path C:\Windows\Temp\{A402F39D-2F6C-4B18-9781-B131F2ED352B}\cab54A5CABBE7274D8A22EB58060AAB7623
                                                                                                                                          • Size 838KB
                                                                                                                                          • SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          cabB3E1576D1FEFBB979E13B1A5379E0B16
                                                                                                                                          • Path C:\Windows\Temp\{A402F39D-2F6C-4B18-9781-B131F2ED352B}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                                                                                                                                          • Size 4.9MB
                                                                                                                                          • SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          vcRuntimeAdditional_x86
                                                                                                                                          • Path C:\Windows\Temp\{A402F39D-2F6C-4B18-9781-B131F2ED352B}\vcRuntimeAdditional_x86
                                                                                                                                          • Size 200KB
                                                                                                                                          • SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          vcRuntimeMinimum_x86
                                                                                                                                          • Path C:\Windows\Temp\{A402F39D-2F6C-4B18-9781-B131F2ED352B}\vcRuntimeMinimum_x86
                                                                                                                                          • Size 200KB
                                                                                                                                          • SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                          Submit Download

                                                                                                                                          memory/224-1436-0x000001EED2400000-0x000001EED2BAE000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/224-1954-0x000001EED2400000-0x000001EED2BAE000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/796-791-0x0000000000380000-0x00000000003F7000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2040-1151-0x0000021DB9280000-0x0000021DB928C000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2336-564-0x0000000000D60000-0x0000000000DD7000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2436-561-0x0000000000D60000-0x0000000000DD7000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2592-1239-0x00007FF883E30000-0x00007FF883E31000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2688-2479-0x0000013108D90000-0x0000013108E66000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2688-559-0x0000013108D90000-0x0000013108E66000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2828-1810-0x00007FF884760000-0x00007FF884761000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2828-1809-0x00007FF884560000-0x00007FF884561000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2828-1822-0x00007FF85A680000-0x00007FF85ACCB000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2828-2032-0x0000029E81430000-0x0000029E81506000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2828-2031-0x0000029E81340000-0x0000029E8142C000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-102-0x00000000051F0000-0x0000000005330000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-336-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-291-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-116-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-117-0x0000000002E10000-0x0000000002E1E000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-92-0x00000000051F0000-0x0000000005330000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-97-0x00000000051F0000-0x0000000005330000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-319-0x0000000002E10000-0x0000000002E1E000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-1142-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-112-0x00000000051F0000-0x0000000005330000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-107-0x00000000051F0000-0x0000000005330000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-32-0x0000000002E10000-0x0000000002E1E000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-1432-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-318-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-126-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-308-0x00000000051F0000-0x0000000005330000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-1461-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-7-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-8-0x0000000002760000-0x0000000002761000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-302-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-338-0x0000000007EA0000-0x0000000007F40000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-121-0x0000000002E10000-0x0000000002E1E000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-5-0x0000000002760000-0x0000000002761000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/2856-133-0x0000000000400000-0x0000000000697000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3388-128-0x000001499E020000-0x000001499E0F6000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3388-124-0x000001499E020000-0x000001499E0F6000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3404-1834-0x0000017BC58F0000-0x0000017BC59C6000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3404-1430-0x0000017BC58F0000-0x0000017BC59C6000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3404-1207-0x0000000180000000-0x000000018002D000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3520-886-0x000001864C590000-0x000001864C59C000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3520-887-0x000001864C710000-0x000001864C7E6000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3568-792-0x0000000000380000-0x00000000003F7000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/3844-789-0x0000000000380000-0x00000000003F7000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4420-6-0x0000000000400000-0x00000000004DB000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4420-0-0x0000000000400000-0x00000000004DB000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4444-1456-0x0000025F54140000-0x0000025F54216000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4444-885-0x0000025F54140000-0x0000025F54216000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4764-289-0x0000021FEFB60000-0x0000021FEFC36000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4764-282-0x0000021FEFB60000-0x0000021FEFC36000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4804-1957-0x00007FF85A680000-0x00007FF85ACCB000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4804-2039-0x0000018D72040000-0x0000018D72116000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4848-1145-0x0000028B86E00000-0x0000028B86E0C000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/4856-563-0x0000000000D60000-0x0000000000DD7000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-1205-0x00000151FCF90000-0x00000151FD73E000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-882-0x00000151FD780000-0x00000151FD79C000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-889-0x00000151FD7A0000-0x00000151FD7A6000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-888-0x00000151FD770000-0x00000151FD778000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-1204-0x00000151FC7E0000-0x00000151FC7EC000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-1206-0x00000151FC880000-0x00000151FC892000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-869-0x00000151FCDE0000-0x00000151FCE02000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-884-0x00000151FDCE0000-0x00000151FDCFA000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-883-0x00000151FD760000-0x00000151FD76A000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-890-0x00000151FD7B0000-0x00000151FD7BA000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-881-0x00000151FCF70000-0x00000151FCF7A000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-880-0x00000151FD9D0000-0x00000151FDA83000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5012-879-0x00000151FD740000-0x00000151FD75C000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5528-1329-0x00007FF883E30000-0x00007FF883E31000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5872-2978-0x0000021CDFD20000-0x0000021CDFDF6000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/5876-2024-0x00000254BAD20000-0x00000254BADF6000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/6076-1725-0x00007FF831FD0000-0x00007FF832FD0000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/6076-1724-0x00007FF860130000-0x00007FF86077A000-memory.dmp
                                                                                                                                          Download

                                                                                                                                          memory/6076-1723-0x00007FF85A680000-0x00007FF85ACCB000-memory.dmp
                                                                                                                                          Download