39de95d15357fc59af3fec56feb7b7fcc9c334bfdb349e6ea0d91807aad2b8ca

Analysis

user interaction
yes
max time kernel
56s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoiceChanger64(2.02).exe
Size 1.3MB
Sample260511-n29fcagy8s
SHA256 39de95d15357fc59af3fec56feb7b7fcc9c334bfdb349e6ea0d91807aad2b8ca
MD5 70e1883ae68b80a4f8d067d55df647a7
SHA1 b63364f2355da395bee2a06e8bae4e053db60500
SHA512 779d5ac69e688f6608da1f7361b49cbc93b388387b28f027e2e8af9c781c1a0f2dca75ea66595dc4590b183079c25c112a87f5654886269e7bf9782a652dfa2c
SSDEEP 24576:+Yj6WrS1V6C1tHcwENaCWuMdq3Cr+A5LTT/WLwznMnQD2nGZLqw:jeGSqs8wGVCq3Cr+DA+QMOLB
TLSH
T16F553359BFC0C4FBEF355674617A0EBAF810F8F81C27A64322424B57BE17161862E366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Clone.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Fast.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Female.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Duck.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\You suck.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Atari-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Atari.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Cave.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Female-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Fast-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Cave-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone-Off.bmp	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Manual-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Hail to the king.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Sheep.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Church_Melody.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Chorus-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Chorus.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Radio.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Vocoder.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Gunshot.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Melody4.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\River.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Singer.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\ClownfshAPO64.dll	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Denoise.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Normal-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Male-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Gong.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Robot.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Helium.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Manual.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Robot.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Applause.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Bicycle bell.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Cheering.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\I feel good.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Laugh.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\CityHall.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Denoise-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Ghost-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Robot-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Vocoder-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Creepy.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone.bmp	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Radio-Off.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Flute.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Melody2.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Metal2.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Useless.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Vader.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Slow.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Male.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Alien.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Normal.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Baby.ico	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Boooooo.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\sounds\Fanfare.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Fire.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Melody.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\vocoders\Melody3.mp3	VoiceChanger64(2.02).exe
File created	C:\Program Files (x86)\ClownfishVoiceChanger\res\Silence-Off.ico	VoiceChanger64(2.02).exe

Executes dropped EXE 2 IoCs

pid	Process
5996	APOConfig.exe
5224	ClownfishVoiceChanger.exe

Loads dropped DLL 7 IoCs

pid	Process
4644	VoiceChanger64(2.02).exe
4644	VoiceChanger64(2.02).exe
4644	VoiceChanger64(2.02).exe
4644	VoiceChanger64(2.02).exe
5328	regsvr32.exe
1616	regsvr32.exe
5980	AUDIODG.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoiceChanger64(2.02).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	APOConfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ClownfishVoiceChanger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxOutputConnections = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinOutputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInstances = "4294967295"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ = "C:\\Program Files (x86)\\ClownfishVoiceChanger\\ClownfshAPO64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Flags = "15"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\NumAPOInterfaces = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\ = "ClownfishAPO"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\FriendlyName = "ClownfishAPO"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\Copyright = "Developed in Shark Labs, Sofia, 2016-2026"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinorVersion = "0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MinInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MaxInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{80E0C6D1-9465-43B2-9BD5-27A3A56CF1B3}\MajorVersion = "1"	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4644	VoiceChanger64(2.02).exe
4644	VoiceChanger64(2.02).exe
4644	VoiceChanger64(2.02).exe
4644	VoiceChanger64(2.02).exe
4644	VoiceChanger64(2.02).exe
4644	VoiceChanger64(2.02).exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	VoiceChanger64(2.02).exe
Token: SeTakeOwnershipPrivilege	5996	APOConfig.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5224	ClownfishVoiceChanger.exe
5224	ClownfishVoiceChanger.exe
5224	ClownfishVoiceChanger.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5224	ClownfishVoiceChanger.exe
5224	ClownfishVoiceChanger.exe
5224	ClownfishVoiceChanger.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5224	ClownfishVoiceChanger.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4796	4644	VoiceChanger64(2.02).exe	84
PID 4796 wrote to memory of 4604	4796	net.exe	88
PID 4644 wrote to memory of 4884	4644	VoiceChanger64(2.02).exe	91
PID 4884 wrote to memory of 3476	4884	net.exe	93
PID 4644 wrote to memory of 5256	4644	VoiceChanger64(2.02).exe	95
PID 5256 wrote to memory of 2252	5256	net.exe	97
PID 4644 wrote to memory of 4012	4644	VoiceChanger64(2.02).exe	102
PID 4012 wrote to memory of 64	4012	net.exe	104
PID 4644 wrote to memory of 5328	4644	VoiceChanger64(2.02).exe	105
PID 5328 wrote to memory of 1616	5328	regsvr32.exe	106
PID 4644 wrote to memory of 5996	4644	VoiceChanger64(2.02).exe	107
PID 5996 wrote to memory of 5360	5996	APOConfig.exe	109
PID 5360 wrote to memory of 5272	5360	cmd.exe	110
PID 5272 wrote to memory of 5288	5272	net.exe	111
PID 5360 wrote to memory of 4596	5360	cmd.exe	112
PID 4596 wrote to memory of 2948	4596	net.exe	113

C:\Users\Admin\AppData\Local\Temp\VoiceChanger64(2.02).exe
"C:\Users\Admin\AppData\Local\Temp\VoiceChanger64(2.02).exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\system32\net.exe" stop Audiosrv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Audiosrv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\system32\net.exe" stop AudioEndpointBuilder
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop AudioEndpointBuilder
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3476
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\system32\net.exe" start Audiosrv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start Audiosrv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2252
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\system32\net.exe" start AudioEndpointBuilder
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start AudioEndpointBuilder
    3⤵
    - System Location Discovery: System Language Discovery
    PID:64
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ClownfishVoiceChanger\ClownfshAPO64.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\ClownfishVoiceChanger\ClownfshAPO64.dll"
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:1616
- C:\Program Files (x86)\ClownfishVoiceChanger\APOConfig.exe
  "C:\Program Files (x86)\ClownfishVoiceChanger\APOConfig.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop Audiosrv /y && net start Audiosrv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5360
  - - C:\Windows\SysWOW64\net.exe
      net stop Audiosrv /y
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5272
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Audiosrv /y
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5288
  - - C:\Windows\SysWOW64\net.exe
      net start Audiosrv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start Audiosrv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2948

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2536

C:\Program Files (x86)\ClownfishVoiceChanger\ClownfishVoiceChanger.exe
"C:\Program Files (x86)\ClownfishVoiceChanger\ClownfishVoiceChanger.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5224

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ac 0x4bc
1⤵
- Loads dropped DLL
PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

APOConfig.exe

Path C:\Program Files (x86)\ClownfishVoiceChanger\APOConfig.exe
Size 196KB
SHA256 e6220429ac44ce4b9a8ebd3a874e2b9c87ff3a70aa8283b9c662f152f8317db2
MD5 b546c47aef93e1a0e325d43d5689d7c0
SHA1 d16b55f49a7d2cd64ba63e79ab1695e6ab53e460
SHA512 2b658c81c87cba2e31161783caa697043fe563616c9ae5740926a0bb8fb8b29fd05deca493531dee5ca0353a78d94eebf33119173d0d98a2b54bc99dc88ddc54
SSDEEP 6144:+XtzpxJqoyk6H9APPQZLFlejj85JL7gRO:SpPK9A8LH5N7gU
TLSH
T10E146D25BDC2D073E666093069E8CA759A2DF8B10F609CDB63840FFA4D346D19734B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClownfishVoiceChanger.exe

Path C:\Program Files (x86)\ClownfishVoiceChanger\ClownfishVoiceChanger.exe
Size 940KB
SHA256 f5e120c42af33940e3535fa998ba71dcb174268eb182aa3896bb8418743b97be
MD5 4ebd611981c2d6939bfab01111c28a86
SHA1 dd3fe5cfc7cbb4e79f30f49d1ba69465eefc9d93
SHA512 10ceb2cb27aa804f3aed2e02229390e239ab0bf2a5414681c66f23c8136e88d11f0667712bd37cf38bd4e460dfc55d55ab607822323cc5335a143d5cfe7ccf49
SSDEEP 12288:eQDjrYgyp9Hvrjayxfx39vC98aDZx1ZjrVcKibGiBaK+Eacm23XkJ18QsP/uQ1:eiry9Hvr5xfqyUPjrRcGHCk8QsP/uQ1
TLSH
T112254981B1D3D832D0724FB04C76AB91DA3D7D719BB1B8CF23D10AA945A82D1A935F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClownfshAPO64.dll

Path C:\Program Files (x86)\ClownfishVoiceChanger\ClownfshAPO64.dll
Size 370KB
SHA256 e85fe346dd40992a1b6e647e2496d91414018ef1947d665e9ab747016a015c71
MD5 5403da3eb1790acd091018b7700388e6
SHA1 bcce6b03e6a73d6596e146332731ef9a87dc2133
SHA512 3de328b485b82657255468901a286c4dffb2d362e8e92ce0b6f0ea21a5a4ecf577ad32d3b82268536a6810b871aaae01494163829e5940f155bda0de2a84f4cc
SSDEEP 6144:ULNGaRce+0tXlwLGF+wUsbyO7RPcsX4m9V5CI4RpKsVGvEoS5+0w:ULN3qe+1Ls+wULNsX7CUCpo9
TLSH
T19484BF06FAA504F9E173903D84B7A54BF7B2385C0760CAEB03A44A6A2F677D05E7B711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Alien-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Alien-Off.ico
Size 16KB
SHA256 9d68b4ce0995e03fa5a623c36ac00d2641697f9c2120b2d4acc24b371037a729
MD5 3f7b046b32d33fa1db6d801326c84c92
SHA1 f267a3236f46e5160fbda29bfc0e628ab24f2d35
SHA512 e5e1f723e41c9f4ee324883b7d2746f89b8333b17172b1dcd05e8e070caa200e184d12382140986a0ab852312878e9c1d9e6253accc558af246f69f4598ae347
SSDEEP 192:uD10D/av2EfZsnYlMNluw/l5K4kidr+QJWQ16Ti5Y:I10DSeEfZWgMNUmloi1Eiu
TLSH
T1C4722D3B0A2DE813DD8064B1AB62D4FB67306D5D0665890239F63E3BF7ACA17BC0C156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Alien.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Alien.ico
Size 16KB
SHA256 99d1d4618d0ac84f70b30334c94208c617c76f8f1604f665f8dc5c424e638f4d
MD5 b4912b4e5ac58c1da8deb5834e3c366b
SHA1 4d3470a065095f6498e45f7303a8630063eb658c
SHA512 aaa10258b02e41eb13e45ad5746ef5dce249020a973a83e2532bc2d20de0cba6d92d3f4bb3716f871b9eb4db633863763a087769054f9b832cd308b1e7865139
SSDEEP 384:9S7e222222222222Rw+2u8wexKUluUvaFPd7:9Ie222222222222W9ANa7vI5
TLSH
T14D727DB42601A1A9D6A48C718FD4C1310B203D6EA486ED963EF8BD1F79FE2674C064D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atari-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Atari-Off.ico
Size 16KB
SHA256 6df6a6464c72af219094cf3787cf0d1f858e2fd3b6c5cc213deecabd911769af
MD5 6f984a4938ba524ba9657d3c63845790
SHA1 0b1789655b8139fa9975aea26860674a5b4fd4de
SHA512 f7c403fbf0e3436eae86e141078db563ca7b75ee157eaac4bfd239c5a42227680598a3cf76e4f30760232f71dc3b4fffe7a5bab8d6106854be9eabc7c43298b4
SSDEEP 96:f08opGfmdCRtijpfChf2h5hTAOPcEmvV+WAiPgopg44ld:eCRtijpkuhvTAgxgVLRSld
TLSH
T1217215222639BC16D46225B97503F272BB02AF631647B1A676E3DC777463DE61FE0340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Atari.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Atari.ico
Size 16KB
SHA256 3874c8be3dc907e0f26b658fec2a551e9651933a819bc15bf9f93b578e8b5284
MD5 b5c428102274914255a1c7f4876e2dcd
SHA1 03c76804698ac954d950b6a7dc334fa9ae6db45d
SHA512 daabe89489aa3f6089e05a2d96f149211d4b4338d19e68497b5531d45a8580979dea303b95bdd93f14a349c743e18e120eedabcad7a472b9dd8032f5db42aeee
SSDEEP 96:fF4MmcfBDUD3inWmrMuxutZu2uJOu6wzYgadpbcqe9Mwc2OAPuaY8E5rFbcnjXn4:yeRrGOYe9yYuaVLLAHdRI+ld
TLSH
T1F772EB1DA728AD42C5653AB9C463D3F04722EF1052E186CB2EE5BDF33D266636C3D058
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cave-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Cave-Off.ico
Size 16KB
SHA256 671d371f7b2f07fc7b1e8ea9f0ab1bdf2a9055e79f3c859b19b6f579fc17987f
MD5 fc40dfade66ab7cf24962bca246834c0
SHA1 9f5c5dae7824afd92ae3dacc9bd72f814bb5e776
SHA512 e0bcd0d37c1b1a4db6dec33d9b3f6471612a7e266349b744bc1e3664e908cb737304af77f3d6f91c7e44ed561b86ff4e686625301fbef4a24919df765d105efc
SSDEEP 48:SeeBxuMtMkqCvNbvaKFqhsA5OpFIVgi1V0KDBlYXtEwRwXtWAm78O3LoYk27fxYS:aDthq0NbZFUsA5OxtK8dDRmOFtzxYOt
TLSH
T15A725EB2EA675F4BF759F3B0FC1A40956F273A444808621AC97E648209A201FF4FF15C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cave.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Cave.ico
Size 16KB
SHA256 716cc28267dcdafd13ca183d11fd74394f7e55063874d5c19a088ec40e225590
MD5 f8b303268883f3500b9723c5f82843d2
SHA1 805cd035ae00e0fb37f3afbac9cffdd5c3b12014
SHA512 0d4b0873c42ff4da2b908bb458c59adba5765c48c4b2168ff7749fa58bd637b483001615532ca4a4158b9e43ac6881ccf4f372d9faf29f136bd473741a975e9a
SSDEEP 96:wTdrWLDwKJdeQYXcq9LCqh8Y86k5KRmbARaj/8AN5tmgnUYLYtp2pcX5YOt:wTGD5J0QYs9yCLsI+aoCclbsaX5dt
TLSH
T1CF72CAAC31044AC9EF503672D0E25386EAAC4C692864A067DFF63467367348F7EC5E31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chorus-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Chorus-Off.ico
Size 16KB
SHA256 e472affc0a16978628ae05ddff151eb0e4fe2892989e55d3bc3e2715d9679448
MD5 87eafaceec081d8d2bad823ec42d8372
SHA1 515545777b7805a4ff74bfcdee79d9237a11c669
SHA512 6957e54e9fd29ec607821ad451727cc76ab04e8ffb99b6b0fea8dcc821b4e579beb4ec4f7cad1f9e90fb638601a3752720931be1a0e3e287b5a12ac3e3d472d1
SSDEEP 384:cNnoaGapKaVa1a3azPa6a8Fafamaxtk0XcGUa2aeWxrI:2EfBt4a2aeWE
TLSH
T15672F8262B68BC03D314A1B29191D6FF57343E545A4DE21334E6B9BFF914B2FE808318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chorus.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Chorus.ico
Size 16KB
SHA256 b6e3c53bb48c2898ea96955a8df633c78035cf071842e84e31a6b265f86ed49a
MD5 afefd408c6dff3dbb1217c497aacd33d
SHA1 ba1439c6d07e450b16ee1326d648ded9d3c8aec3
SHA512 205c5c0d9b1b0f4f5e844c5abee168e7d3b64da0914b70f5470d7635f68f1d2bd5eee2343017a0c4961c2c78bd4ca2f70cd5594ef99b0ba91ce5250e0f3a4ca5
SSDEEP 384:cNnoaGaDGKaNacabaGca4aOea/aVasdaQFpHwgrwxO3hTzRRLQ:2PCw5pQOR6
TLSH
T1C572F8B627A8DA87D202613081CDD2390B38AE492C9FF26339EA7D6FF5347671409375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHall-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\CityHall-Off.ico
Size 16KB
SHA256 2b04ea3f81189ce4a22abe6eb620dc65cf6bd44a2f152303096e3013068778ee
MD5 822ce582243adb560d3a6f5b87884cf6
SHA1 92fb5a5a4a81293cabba2b9e55fa03f0c51f0d1d
SHA512 27208641135e35d100de11b2de6d7f808d35ede3cfad8630b7cbd366e0a750aeb634392f4905bb9c65f9477927e3ea6447bedbe59447ec24cf511cce16eb2b50
SSDEEP 24:rnnnnnnnnGs0scsUHvel6HtY0cQMYKdkyI2fSHo6666666666666666alKPlV22K:wnKd3jS4T2
TLSH
T11A720AF36595B73CEA0734B24B9382F92E943848D774800DABB26F0A02273D158EB617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CityHall.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\CityHall.ico
Size 16KB
SHA256 e1bca0ca6c4acc6b946d9486dea1ae89a8fa36715fc80f3a70d70d60689f0bff
MD5 b8a844f428b535a1dfc17aac4a247041
SHA1 c6ff6d1ddfaedf589cc0e541f159ca6e97b4d907
SHA512 52655bfc21a68ca6e00dd21e2f5123707a7e0f51d318f86c6b33bd4ccd3d0a36f9f01123eeeaa23f48d232617919f88ff68b9b082852c0137bd27d32f2b9fd4a
SSDEEP 48:5jjjjjjjjDNv/xUFPw+ahykOSwlka35Ukasaka4faka4akayaWakayaWakazUawI:UbOykOTpUT7TXTXTJdTJdTzDvAsTy2
TLSH
T1D8720CE67309EC60CD06A9F43F67A18CEC3A6CFC951BD4C9A6A1B71E153091C2AF44D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clone-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Clone-Off.ico
Size 16KB
SHA256 e899579042c65ee392700daf59d07252d9a4241fd70cc56a00075d2be5ce5609
MD5 252a8304468aa4d67cdc654959f72ac5
SHA1 4cdabf4f34cd8a27991ee08d7d0d366ce1060723
SHA512 78854112f576c3ab88a43d1ded442361d32a4f3a5ccfe72f1317b6c0bc0b697cb6f492f5c18053667466eeb37f278c2aac9b54079ff04302c9a2862f704807ec
SSDEEP 96:s+iN0u0u0u0u0u0u0uIXuku1hTed+Up4KgJ+/n5sss6hhhhhhhhhasChhhhhhJH:s+Q3333333IenjTed+w437D
TLSH
T11672EF7D7409902DD5B03038C7229AD7FEE93CAF5364B10122F66E4B95ADF42AB18287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Clone.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Clone.ico
Size 16KB
SHA256 d5e17286741825c832a92ff8eca5aa1a11a3873cf825e76d549a06d7527cf437
MD5 818e9c0e411979071778221ef3e64ecb
SHA1 6e9f0e72c0d0dd8d4c6208cc65ce643464c2fc60
SHA512 1cc1202620add273cd1e6eedd4cd01b01457725e2ff798107959f6c4f9dea9aafc068ed8a77e366b01ce2fa4bd92a8c6e8a52d86f5209eacb17924a25f7b3b1a
SSDEEP 96:04eVYumijdVfw5PhI0PI7MS2/uvsss6hhhhhhhhhasChhhhhhJH:GVPJ0/jD
TLSH
T11E7298273116BC53ECB06834BB6682E8BEEE2FE97750F4267080794A557B00CA8737D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Denoise-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Denoise-Off.ico
Size 16KB
SHA256 bb153cd62ed62a09586261d70751c51d97df9fb767b877c00f0b8b2a881e9af6
MD5 858d2eb360c027803b72b32c17039911
SHA1 09918012226a356e715c7524cca18ec5a600f237
SHA512 87e4999018393823615f616a9aef03d0328cbb43efe9c16f9769bd2a315a43907d6fcaa7a62ae054fc0ad426c05f5fb7db24bd3dd470cd4615721f1b62751e74
SSDEEP 96:AQMy6xcKAhuixUaN1gS8Cgg+ggKggAKggptdmT/o:b6xcK413tdy/o
TLSH
T11B722CD1952AC28FFB7817387BB796E01A5D2DD28605C53631B0AA06DC6D1906CC2FBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Denoise.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Denoise.ico
Size 16KB
SHA256 7e2fdc9d5c24d1603c5e2a8df1451e69fad62a680bea9de6260a56ae460788bc
MD5 8eb0b7285d65d173888513d0aa958889
SHA1 15544cd856122a8db4b4da8a8bb95edcfa59dfc6
SHA512 55f11314875ff9b8a4f65e005228fc41a637257f8808f1a62b33084d01ea8f3e8fddb0497a578f90060bd486636e0a49aa471a385cbe40d4993c084a3cc03e76
SSDEEP 96:42E7Uxk5ZA/UWj+Yw192Lk1fw4mEFoIueyTPl/DjmI6dSliGh6o:V05e/rYULyfjZocsl/DjmLQOo
TLSH
T100723A94AD11E127C0FD507C3B6A8EC417682E6B708496E6A0C1FAF765AA6D13079F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ghost-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Ghost-Off.ico
Size 16KB
SHA256 bad408756d828fc4e22c57a121a75a8f9614991e83e97921610186216defcb9f
MD5 643d096436c385792760aef98a89db20
SHA1 0813ffab627cf8ab07bfdb62e7a9bc0a204e605c
SHA512 4b954efb23200777ed9134daefc3d7ea76cd66c7ed18dcde769fb4df80e007c7dd5cd103409b5902c4b349958b193cd1a6b0f0ae35c4952a81f8c4a26bee23c3
SSDEEP 96:zge8ckXmSuW6If2oibDfqIyS5Iqo/ztx3Oyox5+ThunnX:hRIknw0ho/PeyoxcVunX
TLSH
T17472DA793921E08BE76C5BF1F857C5F206603CDD859503BD7AEABE8B7CA721214C2609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ghost.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Ghost.ico
Size 16KB
SHA256 1802ac52cf0e1b406467b21680caf06d992311a242f4d6fc279d8b16c2f1ddb0
MD5 c6d7ff48826361fb32b8009e0f627266
SHA1 9b48a55738a712a7b7cb666457125436962c73e9
SHA512 5b6402c6a259aa22a4d1740986f8468a312ed5bd96020f64ea29c9a017e309ea7c1d3ab2c5a5e53fac3bbd4acffd5a3a2231a4af62640b759fe9bcc9adf25715
SSDEEP 192:ZvXzAoJ4MLkiPGtTp9Idi5Icy43n1pEtX4+dixMbZN2XbkYKex8X:ZvXxYBIdihXXEtI+di+lNgbZxx8X
TLSH
T1A272D989788152A4CC19C2347207C5FB833B6F3EAF312C6D26A7BE16B7936509CCA11D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microphone-Off.bmp

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone-Off.bmp
Size 822B
SHA256 56014e25ab2a2e1ae0b3cdc5fbd899cb9571e89f97c0a1a6b66f3cfa9d93a525
MD5 971940a0d1831de2f7108b117102d9fd
SHA1 072eed33f8dec4e3318be35ef3232dbd6ed7b85c
SHA512 a615e5cc1251d1c6f4c09ca5803488d54439b3c793d362e621a308eb892592e719f070b67e7c049d74453f11b066bed254ee27144faddd12f043eb89f7eee9a4
TLSH
T1DE0125B538F7A8D6CB634E316D77C1102505F4167FC94312580D43A1BA31D369C31F02
MD5 SHA1 SHA512 TLSH

Submit Download

Microphone-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone-Off.ico
Size 4KB
SHA256 0c39e36374122bec7f62f2008971630aab77acb842a8227414aa8efd41b875db
MD5 7a4eae69fa8bbcecd7d1c5c26cbf0f57
SHA1 d4bc72f9954fa58f624718d68dcfa8df4ef43867
SHA512 a1edd33ffbb0cc97952dffbaf87cd813cf6f80fb4a1c27dfbf1e642c8b2ea17076af84fcb674a737fcd9ed7f5d62ae604a777ca10900a01fda7a85cbee5628be
SSDEEP 96:+XDKha7Ozha7DbuzhbtajKEa1WHuY8Z//8dL:apOda7DbuzttamEEWHnm//A
TLSH
T1CC91C833292698D1EE1C5272B4974D92292138EECBD0AD4835AFF7778613233520BB79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microphone.bmp

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone.bmp
Size 822B
SHA256 a60621c95d5c0198b2b2f88614716832a46d4923b3ed8023bf136f5e3b4cdf75
MD5 3ee0b594a2590956d5e495bab976e7a7
SHA1 97a4de0930f7acbfcd1ac8363abfd7255b111971
SHA512 ce43ae253eb5b777b0eb8d5f3d1d99485e7af1747dc93e2564fc42433ba3a0550f489e8d19d73d615446af53c81d5ed617c838f127b24a7b055b1174d62ae487
TLSH
T1EA01758B2F126A62CDB70838EFD9E51A44D488D64AF1BBB824E70D4C13125C33039DCB
MD5 SHA1 SHA512 TLSH

Submit Download

Microphone.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Microphone.ico
Size 4KB
SHA256 a8992375ccda029017fb09cf9f404bb7c7364f6b226dd3c082ad30cfb0897e1f
MD5 ac87badf42c18d9b85e9927553934a22
SHA1 12c52083ceec0b8e02c7df852cd866ae902c5355
SHA512 cd8541c9f9b76b0223e9b323fe0dc8b4d24b18779e876c558fc4d512a2e3807b813941d0033dd32f3b3e7941522b7e2c28e27e25a05a8186b6222065ab666062
SSDEEP 48:h9PzuVTiHY1wUica2VAHonMkr17xG4I961BDkC4DkDMCEPiBCLZZgKI54MhskJI5:h9P5+VSHOy4I9GBQ32PykkL
TLSH
T14091E8516EFE16D9D1ABA43EC1DE5533842FEB942A2C1C2050A9190583F3A8771BA15F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Fast-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Fast-Off.ico
Size 16KB
SHA256 9d5d274595493a116342d0773e33743f2c8b08dc4c5857fce3467b993428fd2e
MD5 fbf41565033ad19d2248a78cc799f2f5
SHA1 4c60e313038a57b86f2239c50ec7ccc99127ee88
SHA512 3973cddef018e61ac8c25b5bd4af32ecaf12c2281dc452bca7c120a92ac769ab5ce45b123f26a679291a194a8292880affdd86ba35916792a0bcbc3d456530c2
SSDEEP 96:0K4p5TZsT3iUrBF6L2+PIPxG+D6lVfuSSUJVrS+v7x/aMuYAssr6UpW2aNh2Et:H4p7YiUg2+J+elVfbN/u+vFWr6NNNhJ
TLSH
T1A472D76BB545D40BC90012FCDF75E9BEB2B1ED6029548B403AE2BE7FB67C3939916204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Fast.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Fast.ico
Size 16KB
SHA256 253a04575aabec843f6f4ab9d0fdd874d526f7a0f8c45922bd7bfa9242f2bac9
MD5 4c38f648467f86b0b76cb3bb9913270a
SHA1 1c7abe04aed779f9932f1d518e65e6a24657cf56
SHA512 a16efffddb1813f1fe599b3d7b93b13886640a4b18eaa6e08597c36c0a51aa376fd2587b4842ed3728b56bcfdd7bd1888424cc0f8655b9f83d29579907d76625
SSDEEP 192:HJTxtRje9EmxqwR2fip95+s8YF36PSzbyh4gjRcSJAqG3k9:CWm5rT5DTUKfyhfsq19
TLSH
T132720A70F605D544E61F82F68FF9D6BE4B70AC1919101EDCA5ECBF9B3A792E2C600618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Normal-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Normal-Off.ico
Size 16KB
SHA256 e108093b0a2897652c3646c58be076fa0f6fea8099858429d4430cefeb2370ff
MD5 68dfefeae93b257db46fcaf0f101c8c6
SHA1 a4c9c364878bbf4192c222be65d0303ad6d13afd
SHA512 e59c53ba2ac469f37ba6f39359d9f62418fc255876820cc0cbc75c6559abd7487c01fd6cb15c54e91622fa7bab5e040dd21b5ffac0d005f66bdc88c0dda62f3e
SSDEEP 192:H2ztALUoI0ZUF9Ij2lk+KCMnLM5mnGEaldiZJdlhbfHbC:KtALTUF9zl6MjEazi3XVHbC
TLSH
T11C72FA6A266CF413C78090B97F53C5FBD734AD083909860279F27E37B5BC25B6A51219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Normal.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Normal.ico
Size 16KB
SHA256 8176921000f89a71e8719ed20b77ffb380f87bbfe5a59f073c841c61d9a877b8
MD5 6e4004a72a3fea06f4ddedf1a349c54d
SHA1 683937023167f7571dd67398f2bbecde2c7f7cca
SHA512 b1bbda78d27d727fc768d56065773d70918e0f15d8860011de0aba007562ea6985268978858568f631e695f8a4729393c342c0c944280e3e94fe5fe000dc455a
SSDEEP 192:H2cuh0Nb5xpkkQaAjXBhspi5RzwuXXQ+9wAyyIUokFnENHbC:Wcuh0NxkCAlhswg6QswAyyokqHbC
TLSH
T1BD7209AD3629B91BC38050751FB0C4B5D3A2BD0C39014561AAF1BE0F3AFD687DE651AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Slow-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Slow-Off.ico
Size 16KB
SHA256 76f2e1f2dcb7ef4a532d3ed539e8e5eea900ecfd24b84da91b6d7a6201453aaf
MD5 9212061a50c0a464fc9a23ba2b642402
SHA1 38e063b9d901855295ba27468d386fb19c264610
SHA512 25591857a02bb78bbe1f7e2ae621920cbae65d2ff270d1549acf3aae2a4d59970bf9c9364b9b543dac63fd8d97f0e18708e1f71bdcf76a22c3d9af73c8d34800
SSDEEP 192:/CwLptgd5lGZ7t2wAo+SBBm0imCbg3KIl:JLpElGXAo+T0iWKy
TLSH
T16772B66B6B29D906D31031F89F50E0B59BB4AC0C3A1A9BA16DF23C5F7AFC6535C89017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mutation-Slow.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Mutation-Slow.ico
Size 16KB
SHA256 06cae75f238e989d3df868fcaa8529c614c3804fd57c6a7fa26f83fa892d26e3
MD5 a3b4f287362f6128ee9c1647af52b0a5
SHA1 de1c96252d1b867089704bb4ad617ff169575fc4
SHA512 0b8541b43f6eb688abe8607c9adb76987238bd724d3b64ebdb46b661deb143765e6a425943b1ec80e09d6e8584859fb639078e3d7bebd72c23c39131d51d8fc1
SSDEEP 384:DEXlwzcFAb/pT9999999H9999999deQKD/715:DEKzcFArpT9999999H9999999dRI/T
TLSH
T11672089A7915A61BC30616398FD0F7B0936C5E9C2F510542ABF7BE077EFC82B5A09428
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Baby-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Baby-Off.ico
Size 16KB
SHA256 8656ab19d7393e74a6e486dfa7c99f6ece46b1a479c6459356d8b9a2493c5af6
MD5 f1df374917d3f8f9ed76f195a95fc69e
SHA1 a0011da872fc603b91b64333db8431b1215dd357
SHA512 f18ad61d77b902113a50361cab2eb549b636fadfaa49b64cd0bb8815d79494e1bf27393d2b3737d77c103c58bf2f323b601b508ca24f873bb1864dc7ea11ff67
SSDEEP 192:vnwyQnnGUJaBo9+uiiiiiiiiiE9iiiiiiiiiik/r31HrrHHPWQKK:vwxJiAWb1rrnuQH
TLSH
T12C7298C27C1CC9C6F51029FD78539B98A484ED9B62D9315AA64FE7DE80E434202BD7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Baby.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Baby.ico
Size 16KB
SHA256 1b4852f4cdac1a50f802b0590cd615cb41b0dc4cbb2760abfbc7998edc0529e1
MD5 e3fd1405f464a7a805d81082f68e7e9f
SHA1 351b37806e40734e5808929cd25fbe5fe4620f1f
SHA512 e41b022af71f7f7f5a5b42fc75867db4236ef94b15cdf333495da7eab90d89ea5071110ec28b562132f7ab0bafd692fa70d9889c62d736dd1b7e931b05bf6c44
SSDEEP 96:5hnwHoTASy+Md5MpmEjVdCHGVZj0u000AVgWdwbnZVD6CniQKQQQQQQQHQQQQQQz:vnwIJgWpdw6Z4kwTnvVPMdDZyYM
TLSH
T1247294C56D4841E3F572FE77640388EA115328BAF4159CA26644FFBF938EC674BA1113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Female-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Female-Off.ico
Size 16KB
SHA256 9e14fa6d74fcfa6aff3f7d8f7dd3b56af1487d759059e5905ab5020f3b231345
MD5 93adf3488c6445baaf58722b824cef92
SHA1 493dbddffdd665be4bbff73710ed6be48f8b5fc5
SHA512 b6fe5dcb7d7c81cb26d0720339466707084ca3d29f6558fc74fecc0f9f6043040e2b6bbccbeb66fd772305be92ed95a9eed703ad2f3adcae8edb55a2c5e0bc25
SSDEEP 192:Vsy/Z0Ka/i/irkkpiZii0qeZo10h+jDycY+1OiVRRwvMcJvJF:VsQaDUeZ20h+PycROiivMcJvJF
TLSH
T112725710B44448DEF73B15B6A653C5D64DA4FC9BEB51203F26DAEA9724F4303482ED2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Female.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Female.ico
Size 16KB
SHA256 161de208a3aec64dccd1351be3f0cfb31f4fa144a6fcb6776437613bc36d6074
MD5 9df98607c8c803b39f1f31e1865bbe65
SHA1 1bd4eb1bc6eaaa3036f45bae64c0d091c158f3ff
SHA512 b89b772fef928cbc0990331f4d30bd21cfd519fd45b0fe02114bf8da41134e205dd43ea1dc7ee0744233008183c132f4745eb2fe27712ad7f0928dbadccd7997
SSDEEP 192:GKwpljqcstJ54RLpJKJSVZJZL5irUAannnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnm:GKwplqyJFFLUUAzesF
TLSH
T12972A11076C05189D1198ABB9B3BF063051F2D1A133A99392AF07F0B27AAD875E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Helium-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Helium-Off.ico
Size 16KB
SHA256 2c639ac60a864b592ec054da4a07d11bb4d6cdb1066ea698cef5d3e59b71704d
MD5 7594baf2728dfdc8f8c55456f5f5f932
SHA1 bc8d54bf277dff6a3f73b3d7643bf43db403d2fa
SHA512 7392ef4431edf3e316f1f2bfa37ce58ba4987f26af9f9023dc7e820473890be5fcee27a8c8536cc4a627ae49040f480bf0d9ab2d751808b0e7f10b7f931f856b
SSDEEP 48:5eAGUYilHGcmSf3IB22T66666666667p3C7KYfrypTHPDGvXP1OK94LBa8Ym1fa:sA1YXcpfa22XQeLPDGPP1O+3rm1fa
TLSH
T1CE72A48AE243D1C9B49416A8CF369BF2C621AD52CB043123FE1F3EF9767A312462455F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Helium.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Helium.ico
Size 16KB
SHA256 57c4be5d556f6b4c787586728f75edf5f2f29fe405eb362ec400ea7d19159cee
MD5 14d45e43dfe60e6a24bb73dee4f617e3
SHA1 4f2ba51c9c0e3eb0b83fa3401ed2fa737cf67e3c
SHA512 ae50ede1a98eec82ee53aa82f7be4e1fd994ed41d321ec6274f423b0bd19ad9d595d3f9f20c498490af5dd26a7783936016a8795e1b96acf64758588d6279f98
SSDEEP 48:ClHYZTdOiG20hC2R780tJ6Jp0cmzj/dUd/XO6oIcHnnnnnnnnnnnweUApELj+GWy:CaJdOthFR78OJm0Jj/dWeusEjsRNfa
TLSH
T16272275CA1D8D1808A440E2EEF3292F80830AFFDC8D4415BE570BED9B67971FB8C5689
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Male-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Male-Off.ico
Size 16KB
SHA256 3743770e30f2e35187794c0f765d3313ffca4257d5f54579ec6f49c799a113d5
MD5 ec5bf36ef0d5a9d98b174eae13e053d6
SHA1 c060e8aa6aff84662e25794a86b7e29c15bfbf32
SHA512 9e230ed7ab209ea98ca53a7a639b0ca2f8df3046c8964bb2956d207b5a677c92c01e3b79cd87ddc1d386006b33cbec67250cac28beadb525ac80c971df3427cf
SSDEEP 192:llqzjF+5mmQJ3kSUvY2b8QUOk0n4IsybhirO5q:HMjF+5wJ3nUA2b8QUOk0n4Isy1q
TLSH
T1F3726E52237CC48AD55502BB7956F667EDC36C2D096F8006A9FEBE2B21E56C2340F21F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Male.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Male.ico
Size 16KB
SHA256 69c3129ac103c9b5c7bf0203d79911a195c52f849b8cb51ea2a72a22ae0e5db3
MD5 4f722d42b679c3137e0ec5d0380b5c2e
SHA1 30f9554ac568321f10ac08346ec5fd9094fc65f5
SHA512 b64d35d1f14449a0b3ce2097324a577101e576d0151ee938cd76124392e75bf6bf650aea3a2654a2436be47d8b93c46d0353eeb048fcc730057a3285c2f5d2a6
SSDEEP 192:m2FBaR89rlv3FD4g0+8MgJ2pzyJYXG2UrOwiuRq:LaR8vug0+8MgJBJYWmmRq
TLSH
T1BC722B733E8098C7E15DB972DEB1DFF03E522D7D1800F20620A17E8B2BA7475AAD8558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Manual-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Manual-Off.ico
Size 16KB
SHA256 3eca94615a2ca4f29cdc0a3104fd84b6b01dc19415381c32e31edcc1073cfcb9
MD5 a46db4094f28a4548446e255b3b8f6c5
SHA1 b4fbc2baee8d82b38cc4b3af4f76f83acda1cdae
SHA512 a398d136284b7692a6159a2373f52f5658170b3219c08d9f8156b2b612e4b103bd3eab21d6a01b7750fb35995572f7ae1fe41c358819d8c388a660cba406ef50
SSDEEP 192:on8iS575Ovh6jEUNXokcaXEBgNIQDna0icvkcL6QI:oaVOdU0SiQDnaZ8kcLhI
TLSH
T109720993DB29D49EFD2031F0A1D3817B9DF42D352B50968D9F26B44AEEA030B784F519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pitch-Manual.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Pitch-Manual.ico
Size 16KB
SHA256 d872545106e8e899c1e340e992e7a22cefcbe62eb1aada04fd2089d629043716
MD5 cd5e5ffbece346671f78bf2add304a73
SHA1 cae262814cede831b21a8d2756778d408ae55511
SHA512 d26873abcfc65e7899c6ecc4be47f342a5280e733afe03ab528c5743022a91e0c292823afa699d8044480fb78c0f4ff41cecaf8e0c2ca09d99a5f58fa10f2638
SSDEEP 192:x54DZyK7su/bJvK0lMsJGt+ERNR0duGDuLqEos0YFTUlq9ycX/w8dw+f+u4QD:xmEK7Hv2sot+ERnGDVcLFh3vw8Ou7vD
TLSH
T12B722AC32614D58FEB59737033A7119E93301E242912D25BD26FBE0DBFBA762B849D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Radio-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Radio-Off.ico
Size 16KB
SHA256 3dd0c14f58f5e386a5351067444709b2ffe4c5af7076abc301c642d75f9bd49d
MD5 d86fedd0bd1d19b0dcd1ba34f29d08d9
SHA1 0887b15268146436037262b9eea36a29edc535df
SHA512 52cfabb25ce0de3f7ff23163de2fcd9e5fcd749d84f1427307955aae3eff74f163ce7d2339a7501321da2142fcd48efe4e7b432742bbd35ef07271e7b258d994
SSDEEP 192:h2tn/HIuTRjg6IAe0mUx7dSchvTZTlPJ3+SqkyYtkhrjrfL:h2N/HKl0KchFTlB3NqkOhjz
TLSH
T1887284692F9CDE20E29638F463B0A14DE9B4DC1116FFC611EE6A387AC37CB42AD5D105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Radio.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Radio.ico
Size 16KB
SHA256 383986e6129a7fa4659787bf5159a03f9b2e0f1ecd8e90d018a326d4f80523b1
MD5 f2214783b072e29992dddf5702b80df8
SHA1 f5cf7b5a1ab07350a6cc8329ff59090b0008c60c
SHA512 ef1afd460324f30e57b9eb25ab0b44ff217052c4d965a1f6617bb3be761f9646e60fa74ab454c269e22808b24f18af8d546c8b4be7142d07440d8990d3e694f3
SSDEEP 384:4oTl5YCj9xL3y9zV6thsifpqpcxLXXtrDPY33QUESZ:V0Cj9x1lDPagUEA
TLSH
T158722B282F9DCD2DE3057D78A6B0C2944AFC8E617D2FD147AF17B8ED88B5688B840574
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Robot-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Robot-Off.ico
Size 16KB
SHA256 16a4d7c4bb8e9985454f48b5694dcc5e915681b6900ecd0dcfd30970617195b3
MD5 49f703b6b44a50cb8446e93ddb5e3e6b
SHA1 f63de1e09be9bbc2e465ed91d0a41cf2878be5c5
SHA512 3608583c4866d3096f3b311a661fbed96cb817a01f296421ec35b665647d4f28ee21b19004a3e75f5e1237d6fc3ae1ed1a5848262786ace9e9071394efb3a9df
SSDEEP 96:8zAJUC5z5mUUnTIMdGZsk3IHUEoRDtlrZVR44U9dAUu0a9clE:8EJUKz5mVn34OOrltpZV7U9do6lE
TLSH
T16272F8623A39D532CD4E28F49D93C88A64B32F657CE85A05B5667B3FC5781629C0E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Robot.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Robot.ico
Size 16KB
SHA256 f4b31cc68ab44252953dfd7ba9ed190904a2855a187c5eb9b2d1865af6b4925a
MD5 dc21021665efc0d91a3c023349e0088d
SHA1 a9db1ccf0293442e171af55dff9b305da26ed551
SHA512 3d797a568390992805f5a0ad3d247afce0fca4a399c439cd68f2496c4b49491fb216554fe940512c984371083771f73136ec013921bd5184dbc276676a269b16
SSDEEP 192:1VPbSWXUICKM4v3Bi14ucAHtXs2FbWY7btq+pKa7R+hwyBqI:HB5EdHRxb17R6d2ux
TLSH
T1EF725B223236528AD8D1BC3B1E54C4868C2D3D779EF9C2C1FD837B9E2A355139848768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Silence-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Silence-Off.ico
Size 16KB
SHA256 a5a127fafc661c60ab71a91a3af1e75757dc8f769814886ec1385be491d0bee5
MD5 15b678e256892c094819e9adee6931c0
SHA1 af96f5f1f0ba441cb27fc92ec84bcf64ace578a9
SHA512 4d0f5cc19ace20534c2b88325cb7f1482e444b14628eb2c5d02ba2d89c1f53d4a14033b23f714fab6f5fbe9d2e5d286bdd8d9735b0f343cb156e287506c2998f
SSDEEP 48:csIvV3gtu3B+seAg8UQ2oYbyLbk1Pbofcj3tJXrAAAAAAAAAA9:csGV3YuQRAg8UdoYbfPboEj9z
TLSH
T1BF72963564C7A440F92E1CB00676BA7AB424FE999A7BECB0A21CBF5D14328D19F0770D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Silence.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Silence.ico
Size 16KB
SHA256 174cf35498ac34dbc791179f2eae97421df96566788d10774cd119da236b86c7
MD5 d182f6d36f07ce8c87ab7c3a5b63c660
SHA1 ccb3953c3de04823f64674069b8fd8fdf2d47290
SHA512 849e074ab63223361664fff2a667d13e89de642a877e8c7baf28f3a8580f5cfe32754a750d9fb46cda290daba3cd8887ab6e9824dbca2597d01555e0968724b6
SSDEEP 384:shgBsm+T0t38R1GlgrdxLuHBEACTAJRtQHJny:nJgg
TLSH
T19C72B8F439C38411E92D24FC3AADD99215B23C63C2E3199DFCDE769A12B901E641BB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vocoder-Off.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Vocoder-Off.ico
Size 16KB
SHA256 0382305edaf7ce50bc7846a83b7bc5164861e457cb7f306b663c3e8f06b25a7f
MD5 956d2f04d6c2a1d56c7650c3371137c9
SHA1 1f9eb18797a0bbe781f23f562d3fb03d8dae0a2b
SHA512 5fcda40274733c52e808b7e246bcc2992b66d377d14ba36626cb0b6434fb966a57429a3384d41b9f000a6f5e9ef0d15e3a62223d80db123790b4b9047a1481a1
SSDEEP 96:Nw2coSOw3mShDIcNacLtoBaSjUoySQMoMJbJOEkJSSSSXS:Nw22OO9RNag6aSjByvMoMJ9OJg
TLSH
T12C72B9387B3C914FEF2C09BE786E8D69404D2E1624BD7E94158132928DBD1D22E871DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Vocoder.ico

Path C:\Program Files (x86)\ClownfishVoiceChanger\res\Vocoder.ico
Size 16KB
SHA256 5f3e34cb9bf37640f7d6f60fcb847b3a26a7d68cc8df4cf54803203d8a93e516
MD5 6ea776011dcb4d8f94b5ac28b002f754
SHA1 1fec375d48c434b2c478fe8253c9ba78ab79dcac
SHA512 c2e4ff69322bcce6ab4c6a095cdd5adf2be3e37238b494bcf5d8821c8427a0f4b12262deb028c297d33b57e11de76a7027f9c27b6dd34f289cd79da68bf76425
SSDEEP 96:dlZV9++00hVmvwB5b9PeyXJOEkJSSSSXS:rZV9+AhVmveV4OOJg
TLSH
T14E721EE869C46C95C45384384D6C8A7847FEEFCE8C0C1BE7A8C379011AF39E6741164B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KillProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb152B.tmp\KillProcDLL.dll
Size 14KB
SHA256 0fe15b023e21b7054fabb3d47b6084d60f8e474d8f9ca3a0a25dcb2097d6f0b8
MD5 586270250a1acce8126a0877fd5bb981
SHA1 9f5645b37b3af04004697639855da5c99a41aca1
SHA512 a1994b91337385ab153860a013912f9cacdf9c233395868bf8eedfbe6dd13841619a8048c1d8407ee4b77c466fd8f31fc5cac2c779a2ef58c3a2a02caeded055
SSDEEP 192:/BZa4DYIcJ4nS1ejJThugw4LBs4TJjdjqJVQXS3p16ZGntrefncWCV:JZ8IcJ4nSkJlums4TJJjsVh3pwZs/
TLSH
T15852F79EF117F6F6D4CB46B045E2FF3B443E29028836A8B4DF50EA207D1789E6529047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockedList.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb152B.tmp\LockedList.dll
Size 28KB
SHA256 671570118024c9132f12999e198cebc87b3bf1846695553bf478c5a42efec226
MD5 2ee096682cc84f5fd44fb5291c00596c
SHA1 8dccebf054abe13e5b324dfdfbe6605553971396
SHA512 1ffdc3a5256b8eb62aff82c6429dcdf582009a908d43ab30d3fad84770b012be59c972323b6ae2b8d7ea2ae29d8ab3a99913205a0b33582e95dc813c31507d3d
SSDEEP 768:Mne3kAZoxbRX66y11T9vBD3fNUHeBuf6qW:MnnTZyX9vBDvNU+UZ
TLSH
T107D2194457E000F7F7BE1AB079A92B0A5ABEF91868F195AB4F3754CA1D61112F628343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb152B.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsb152B.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb152B.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClownfishVoiceChanger.ini

Path C:\Users\Admin\Documents\ClownfishVoiceChanger.ini
Size 639B
SHA256 c7ec6531e67775bbdb8018404b7665962bf8ffdb74eebd5043a8af3da6d74f62
MD5 0ec7ea1aefa4866b3ca7fb2f3cce7565
SHA1 42d9f0bf4b72dc9befa6159bc1c1c978a05e1b38
SHA512 6eb49b9355543d79016240c6f8c91a467aa69a9579d7b553ff6932a616560a0151c331ba1fef7b5b228dc172ea1a45cb18f5825c95fd6a60758fc481009ebddb
TLSH
T1A0F07D1917329F9E6D28A303343AC51C6AFC190DF0CEA190ECAA584E5CB197E19B56A0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2536-130-0x000002551C330000-0x000002551C3FD000-memory.dmp

Download

memory/4644-128-0x00000000020B0000-0x00000000020F5000-memory.dmp

Download

memory/4644-138-0x00000000020B0000-0x00000000020F5000-memory.dmp

Download

memory/4644-17-0x00000000020B0000-0x00000000020F5000-memory.dmp

Download

memory/4644-16-0x00000000006F0000-0x0000000000709000-memory.dmp

Download

memory/4644-137-0x00000000006F0000-0x0000000000709000-memory.dmp

Download

memory/5224-247-0x00000000725A0000-0x00000000725D9000-memory.dmp

Download

memory/5224-253-0x0000000000CF0000-0x0000000000D6B000-memory.dmp

Download

memory/5328-113-0x0000000000F40000-0x0000000000F85000-memory.dmp

Download

memory/5328-114-0x0000000000FB0000-0x0000000000FC9000-memory.dmp

Download

memory/5980-254-0x000001AD3D3E0000-0x000001AD3D4AD000-memory.dmp

Download