734ca4595a25a8b4f45836e6534c07d21bba029d3151058e53bdf36a00a40f3f

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoicemodInstaller_1.6.13-l2wy2i.exe
Size 6.1MB
Sample260523-wheevsfy3l
SHA256 734ca4595a25a8b4f45836e6534c07d21bba029d3151058e53bdf36a00a40f3f
MD5 eb211f8ce6f3c51b0fa11269692918b1
SHA1 795422f5c8ef9df7a791c47f532d9298c6ed04c5
SHA512 088c3986b767dad91e3c61d9f9b5610915e775106b63d38b9c8b72da7a732556a56391c168ff0355101abb1c2da07c2052744b7dc95ba57a509943b76b81ac66
SSDEEP 98304:W1QTTb/jF2LPpBe5QPHoR8Rn96Oag+v7H7L9AuBR9Y44hihJYq0ig1yhmKutW:a2rUPpUMHoq198v7bOuBfhlJphVutW
TLSH
T1285612267344E43AD09A67344172E27494FBAFA8B817ED1276F4CC4FFB255C11E3AA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2384	powershell.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VoicemodV3 = "\"C:\\Program Files\\Voicemod V3\\Voicemod.exe\" --boot"	VoicemodInstaller_1.6.13-l2wy2i.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{0b5169e3-39da-4313-808e-1f9c0407f3bf} = "\"C:\\ProgramData\\Package Cache\\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	vm_vc_Redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	vm_vc_Redist.x86.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3952	tasklist.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File created	C:\Program Files\Voicemod V3\is-8J6NL.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-12HV9.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-O8LLH.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-2HLT1.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-KT7QV.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-0IN4F.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File opened for modification	C:\Program Files\Voicemod V3\WinSparkle.dll	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-AK1S9.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\is-OIKTI.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\is-VJDNL.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-0PU70.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\unins000.msg	VoicemodInstaller_1.6.13-l2wy2i.tmp
File opened for modification	C:\Program Files\Voicemod V3\unins000.dat	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\unins000.dat	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-EPHGQ.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-7CSHV.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-KP5Q9.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\is-I9868.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-96IV0.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File opened for modification	C:\Program Files\Voicemod V3\Voicemod.exe	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-OINBF.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-UODBN.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-NA4E3.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\driver\is-URSKI.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\is-4IQ4U.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File created	C:\Program Files\Voicemod V3\is-B97L1.tmp	VoicemodInstaller_1.6.13-l2wy2i.tmp
File opened for modification	C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe	VoicemodInstaller_1.6.13-l2wy2i.tmp
File opened for modification	C:\Program Files\Voicemod V3\driver\voicemodcon.exe	VoicemodInstaller_1.6.13-l2wy2i.tmp

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{C18FB403-1E88-43C8-AD8A-CED50F23DE8B}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a51da.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5AF4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DE3.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a5202.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5203.msi	msiexec.exe
File created	C:\Windows\Installer\e5a522a.msi	msiexec.exe
File created	C:\Windows\Installer\e5a51da.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5815.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a51ec.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF}	msiexec.exe
File created	C:\Windows\Installer\e5a5203.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7303.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI55B3.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a51ed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a51ed.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B}	msiexec.exe
File created	C:\Windows\Installer\e5a5214.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7C3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E60.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7759.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a5215.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a5215.msi	msiexec.exe

Executes dropped EXE 14 IoCs

pid	Process
4416	VoicemodInstaller_1.6.13-l2wy2i.tmp
3692	vm_vc_Redist.x64.exe
4148	vm_vc_Redist.x64.exe
2024	VC_redist.x64.exe
176	VC_redist.x64.exe
2964	VC_redist.x64.exe
924	VC_redist.x64.exe
3340	vm_vc_Redist.x86.exe
2268	vm_vc_Redist.x86.exe
1252	VC_redist.x86.exe
420	VC_redist.x86.exe
4324	VC_redist.x86.exe
1148	VC_redist.x86.exe
2040	VC_redist.x64.exe

Loads dropped DLL 8 IoCs

pid	Process
4416	VoicemodInstaller_1.6.13-l2wy2i.tmp
4416	VoicemodInstaller_1.6.13-l2wy2i.tmp
4416	VoicemodInstaller_1.6.13-l2wy2i.tmp
4148	vm_vc_Redist.x64.exe
4260	VC_redist.x64.exe
2268	vm_vc_Redist.x86.exe
924	VC_redist.x64.exe
3528	VC_redist.x86.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x000400000001f241-692.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vm_vc_Redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.13-l2wy2i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vm_vc_Redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vm_vc_Redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vm_vc_Redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.13-l2wy2i.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/912-0-0x0000000000400000-0x00000000004E9000-memory.dmp	innosetup
behavioral1/memory/912-13-0x0000000000400000-0x00000000004E9000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\PackageCode = "932B68F08575786459F58CF6C8748C4B"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\ = "{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.44.35211"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.44.35211"	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\DisplayName = "Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.44.35211"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\VC_Runtime_Additional	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5B084229BEACB1B4AA4A7961FECD2EB6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\PackageName = "vc_runtimeMinimum_x86.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\DefaultIcon	VoicemodInstaller_1.6.13-l2wy2i.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{43B0D101-A022-48F4-9D04-BA404CEB1D53}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.44,bundle\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod	VoicemodInstaller_1.6.13-l2wy2i.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open	VoicemodInstaller_1.6.13-l2wy2i.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9CC2BA68DB8034640B9F8FD200D627FF\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\URL Protocol	VoicemodInstaller_1.6.13-l2wy2i.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\304BF81C88E18C34DAA8EC5DF032EDB8\VC_Runtime_Additional	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell	VoicemodInstaller_1.6.13-l2wy2i.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\Version = "237799819"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B084229BEACB1B4AA4A7961FECD2EB6\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\304BF81C88E18C34DAA8EC5DF032EDB8\PackageCode = "73B56A9D9529BEC48BFF28F2B2D368B6"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	VC_redist.x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9CC2BA68DB8034640B9F8FD200D627FF\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\PackageCode = "51C7A0D0D899AA345AE972FBABA82567"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\101D0B34220A4F84D940AB04C4BED135\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4416	VoicemodInstaller_1.6.13-l2wy2i.tmp
4416	VoicemodInstaller_1.6.13-l2wy2i.tmp
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
2384	powershell.exe
2384	powershell.exe
2384	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	tasklist.exe
Token: SeBackupPrivilege	4372	vssvc.exe
Token: SeRestorePrivilege	4372	vssvc.exe
Token: SeAuditPrivilege	4372	vssvc.exe
Token: SeShutdownPrivilege	2024	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2024	VC_redist.x64.exe
Token: SeSecurityPrivilege	4908	msiexec.exe
Token: SeCreateTokenPrivilege	2024	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	2024	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	2024	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	2024	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	2024	VC_redist.x64.exe
Token: SeTcbPrivilege	2024	VC_redist.x64.exe
Token: SeSecurityPrivilege	2024	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	2024	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	2024	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	2024	VC_redist.x64.exe
Token: SeSystemtimePrivilege	2024	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	2024	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	2024	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	2024	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	2024	VC_redist.x64.exe
Token: SeBackupPrivilege	2024	VC_redist.x64.exe
Token: SeRestorePrivilege	2024	VC_redist.x64.exe
Token: SeShutdownPrivilege	2024	VC_redist.x64.exe
Token: SeDebugPrivilege	2024	VC_redist.x64.exe
Token: SeAuditPrivilege	2024	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	2024	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	2024	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	2024	VC_redist.x64.exe
Token: SeUndockPrivilege	2024	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	2024	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	2024	VC_redist.x64.exe
Token: SeManageVolumePrivilege	2024	VC_redist.x64.exe
Token: SeImpersonatePrivilege	2024	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	2024	VC_redist.x64.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe
Token: SeRestorePrivilege	4908	msiexec.exe
Token: SeTakeOwnershipPrivilege	4908	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4416	VoicemodInstaller_1.6.13-l2wy2i.tmp

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4416	912	VoicemodInstaller_1.6.13-l2wy2i.exe	86
PID 4416 wrote to memory of 2384	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	91
PID 4416 wrote to memory of 2640	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	94
PID 4416 wrote to memory of 3976	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	96
PID 3976 wrote to memory of 3952	3976	cmd.exe	98
PID 4416 wrote to memory of 4756	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	100
PID 4416 wrote to memory of 4596	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	102
PID 4416 wrote to memory of 4676	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	104
PID 4416 wrote to memory of 4488	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	106
PID 4416 wrote to memory of 3840	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	108
PID 4416 wrote to memory of 4412	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	112
PID 4416 wrote to memory of 2460	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	127
PID 4416 wrote to memory of 2724	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	129
PID 4416 wrote to memory of 4212	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	131
PID 4416 wrote to memory of 4724	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	133
PID 4416 wrote to memory of 1536	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	135
PID 4416 wrote to memory of 2584	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	137
PID 4416 wrote to memory of 1836	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	139
PID 4416 wrote to memory of 728	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	141
PID 4416 wrote to memory of 4900	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	143
PID 4416 wrote to memory of 312	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	145
PID 4416 wrote to memory of 3400	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	147
PID 4416 wrote to memory of 2116	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	149
PID 4416 wrote to memory of 176	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	151
PID 4416 wrote to memory of 904	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	153
PID 4416 wrote to memory of 924	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	155
PID 4416 wrote to memory of 4852	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	157
PID 4416 wrote to memory of 3692	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	159
PID 3692 wrote to memory of 4148	3692	vm_vc_Redist.x64.exe	160
PID 4148 wrote to memory of 2024	4148	vm_vc_Redist.x64.exe	161
PID 176 wrote to memory of 2964	176	VC_redist.x64.exe	171
PID 2964 wrote to memory of 924	2964	VC_redist.x64.exe	172
PID 2024 wrote to memory of 468	2024	VC_redist.x64.exe	174
PID 468 wrote to memory of 4260	468	VC_redist.x64.exe	175
PID 4260 wrote to memory of 4324	4260	VC_redist.x64.exe	176
PID 4416 wrote to memory of 3340	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	177
PID 3340 wrote to memory of 2268	3340	vm_vc_Redist.x86.exe	178
PID 2268 wrote to memory of 1252	2268	vm_vc_Redist.x86.exe	179
PID 420 wrote to memory of 4324	420	VC_redist.x86.exe	183
PID 4324 wrote to memory of 1148	4324	VC_redist.x86.exe	184
PID 924 wrote to memory of 2040	924	VC_redist.x64.exe	185
PID 1252 wrote to memory of 3764	1252	VC_redist.x86.exe	186
PID 3764 wrote to memory of 3528	3764	VC_redist.x86.exe	187
PID 3528 wrote to memory of 3144	3528	VC_redist.x86.exe	188
PID 4416 wrote to memory of 1856	4416	VoicemodInstaller_1.6.13-l2wy2i.tmp	189
PID 1856 wrote to memory of 2384	1856	cmd.exe	191

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.13-l2wy2i.exe
"C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.13-l2wy2i.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\is-PNLNA.tmp\VoicemodInstaller_1.6.13-l2wy2i.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PNLNA.tmp\VoicemodInstaller_1.6.13-l2wy2i.tmp" /SL5="$80062,5563686,899584,C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.13-l2wy2i.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:2384
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.1\",\"environment\": \"production\"}"
    3⤵
    PID:2640
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3952
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4756
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Downloading VC x64 Redistributable\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.70\",\"environment\": \"production\"}"
    3⤵
    PID:4596
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4676
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Downloading VC x86 Redistributable\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.65\",\"environment\": \"production\"}"
    3⤵
    PID:4488
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:3840
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpWelcome\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\",\"page_number\": \"1\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.10\",\"environment\": \"production\"}"
    3⤵
    PID:4412
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:2460
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpLicense\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\",\"page_number\": \"2\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.23\",\"environment\": \"production\"}"
    3⤵
    PID:2724
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4212
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectDir\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\",\"page_number\": \"6\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.45\",\"environment\": \"production\"}"
    3⤵
    PID:4724
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:1536
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectTasks\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\",\"page_number\": \"9\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.70\",\"environment\": \"production\"}"
    3⤵
    PID:2584
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:1836
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpReady\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\",\"page_number\": \"10\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.10\",\"environment\": \"production\"}"
    3⤵
    PID:728
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4900
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Page undefined\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\",\"page_number\": \"101\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.1\",\"environment\": \"production\"}"
    3⤵
    PID:312
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:3400
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpPreparing\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\",\"page_number\": \"11\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.1\",\"environment\": \"production\"}"
    3⤵
    PID:2116
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:176
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpInstalling\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\",\"page_number\": \"12\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.10\",\"environment\": \"production\"}"
    3⤵
    PID:904
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:924
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\"},\"mp_deviceid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\",\"events\": [{\"data\": {\"event_name\": \"Installer Step Install\" , \"custom_attributes\": { \"version\": \"1.6.13\", \"app_version\": \"1.6.13\", \"machine_guid\": \"b9e6d1be-5eff-4596-940c-57922ad6c7c4\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"10 (10.0.19041)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"l2wy2i\" }},\"event_type\": \"custom_event\"}],\"ip\": \"85.203.46.70\",\"environment\": \"production\"}"
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\vm_vc_Redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\vm_vc_Redist.x64.exe" /quiet /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Windows\Temp\{E19AA4B8-2680-4B21-A458-C5EAEA858828}\.cr\vm_vc_Redist.x64.exe
      "C:\Windows\Temp\{E19AA4B8-2680-4B21-A458-C5EAEA858828}\.cr\vm_vc_Redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\vm_vc_Redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /quiet /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Windows\Temp\{E526DEC1-2C25-4F87-A055-AE0DA2F8B3E3}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{E526DEC1-2C25-4F87-A055-AE0DA2F8B3E3}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7C8B05F5-AF73-46C8-A6CD-F051F65AFB57} {78F12D55-F071-4F71-BE67-A0972C6B2CAA} 4148
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1144 -burn.embedded BurnPipe.{7D06F05B-FEF8-42C9-A259-E49F8C6D2DF0} {527A355B-76E0-4534-A95B-463931AB5745} 2024
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1144 -burn.embedded BurnPipe.{7D06F05B-FEF8-42C9-A259-E49F8C6D2DF0} {527A355B-76E0-4534-A95B-463931AB5745} 2024
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4260
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F2862703-85CD-4CEC-90CE-B7593CAECF77} {A70821E8-F55A-4136-A016-98000ED44367} 4260
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4324
- - C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\vm_vc_Redist.x86.exe
    "C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\vm_vc_Redist.x86.exe" /quiet /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\Temp\{9399A1A2-005E-408E-BA64-650BB6B73BC0}\.cr\vm_vc_Redist.x86.exe
      "C:\Windows\Temp\{9399A1A2-005E-408E-BA64-650BB6B73BC0}\.cr\vm_vc_Redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\vm_vc_Redist.x86.exe" -burn.filehandle.attached=696 -burn.filehandle.self=700 /quiet /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2268
    - - C:\Windows\Temp\{123CD412-56A8-4945-AD8D-5964D6EB3FC0}\.be\VC_redist.x86.exe
        
        "C:\Windows\Temp\{123CD412-56A8-4945-AD8D-5964D6EB3FC0}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{C71871B7-E86F-42BD-9F37-A39104B7F6C5} {5E7EACF6-F7F9-4EDF-A4AB-E5CAD8187ED3} 2268
        5⤵
        Adds Run key to start application
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1252
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1220 -burn.embedded BurnPipe.{AC5D5BA7-E157-4FB5-91B0-C7582F934B4F} {EBE05A69-DA90-4FE7-9278-CE8155F399A0} 1252
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=1220 -burn.embedded BurnPipe.{AC5D5BA7-E157-4FB5-91B0-C7582F934B4F} {EBE05A69-DA90-4FE7-9278-CE8155F399A0} 1252
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9A445219-7FB3-4343-B23A-B1C83E326B9B} {BDEDA24A-9FDD-4E72-8E12-6D1FFA75DA8F} 3528
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3144
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod V3\driver\setupDrv.bat" true"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process 'setupDrvAdmin.bat' -ArgumentList 'true' -Verb runAs -WindowStyle Hidden -Wait"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2384
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Program Files\Voicemod V3\driver\setupDrvAdmin.bat" true
        5⤵
        
        PID:2200
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c AudioEndPointTool.exe get --name "(Voicemod)" --flow Capture --format Raw --fields ID
        6⤵
        
        PID:3768
        
        C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe get --name "(Voicemod)" --flow Capture --format Raw --fields ID
        7⤵
        
        PID:4636
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c AudioEndPointTool.exe get --name "(Voicemod)" --flow Render --format Raw --fields ID
        6⤵
        
        PID:2604
        
        C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe get --name "(Voicemod)" --flow Render --format Raw --fields ID
        7⤵
        
        PID:4692
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "voicemodcon.exe dp_enum"
        6⤵
        
        PID:2360
        
        C:\Program Files\Voicemod V3\driver\voicemodcon.exe
        
        voicemodcon.exe dp_enum
        7⤵
        
        PID:1712
      - C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe get --default --flow=Capture --role=Communications --format=Raw --fields=ID
        6⤵
        
        PID:2060
      - C:\Program Files\Voicemod V3\driver\voicemodcon.exe
        
        voicemodcon install voicemodvad.inf ROOT\voicemodvad
        6⤵
        
        PID:1352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3092

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:176
- C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260523190151.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=548 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260523190151.log"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5F464914-952A-4D73-A192-67BAAAAFED14} {E3A7DC9B-31DE-40FA-81F1-2162C5EA6911} 924
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2040

C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:420
- C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260523190206.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260523190206.log"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:440
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{78d5153c-211e-4942-b6ce-ffe2496e4124}\voicemodvad.inf" "9" "49f38a543" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files\voicemod v3\driver"
  2⤵
  PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a51df.rbs

Path C:\Config.Msi\e5a51df.rbs
Size 19KB
SHA256 dc93b8184453f60cc8bcaa3e1c1f7fb2dae0dccd1bd63324a99ca15d148b0944
MD5 72fcd513a1022666d561a95ef3718efe
SHA1 47b1ce17984d173131378961a5ede15982afc6be
SHA512 d23d80c80e1be9f9dd3dfc1f13d7d025773fd39ddaf32f9ecc3029bc0a3dfc70e4ec75350c3945a4aa49149a0dbb979fd3533a2ca72f6924217a2bc862042569
SSDEEP 192:7IRh1kR115dXcFUADIc1L+W+y4+agPuAp7:7IRh6R1TeC81L/c8p7
TLSH
T1D592FC426A80C9E2D8766B30CD635BA53B76DBD5A350438B50DC91308F93BCA2F9D68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a51eb.rbs

Path C:\Config.Msi\e5a51eb.rbs
Size 19KB
SHA256 0a829b25bc4d7893f96e35620cbaef9717c877adca49e0c06fe290a98c5b2008
MD5 7b92bd6a947eadd716a675ffafb92d7a
SHA1 9d2662d14ce3543bbd499b8b591f23c4d8020732
SHA512 c96605bbda97c6745d4e46e807b2911510a8eed55c0f82c6edde221c717048d739b5ecc2c8f3b9f8d213b6285de60e6452aca6cb31460659ca8084b77f6abc14
SSDEEP 384:7vOGnJXMjZ7Up+BFqiO6tkgJ40uJ40Goa2D8Lfv/8c3zMZxq+nNwzQ6R:7vOGnJXMjZ7Up+BFI84F4R
TLSH
T1FD92CA026640C5E3D8A62B70DD4B67203BB5D7CAA355A38B41DCC1308FA77CA7F9D24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a51f2.rbs

Path C:\Config.Msi\e5a51f2.rbs
Size 21KB
SHA256 a49f956a9c56c5fcc2d77e3dfe36fc894ac49106e59d34223a199515708887bd
MD5 758fa2ef59ccc39bccc5c8498e77c32f
SHA1 4b7be93f4169cb57cda57334677b95e565aba8aa
SHA512 dd165ab0bcd32d78a3eeeb68dc16c48c6ec01e4bbb92e38f15f6fb99cb9fc9509f010c68999cd18803e9103752608e9c9c5fac52908cfd1705fffb64bef83daa
SSDEEP 384:m69RMGR0nAKxNAUhUC7xJjrMNYPVIbS/0aqZgqhSfk5TkP:m6zdsAKhCs1
TLSH
T190A21E03768089E3D86627B0DD671BA43B33DBD99351434B10ACD1388F633D72E5AA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5201.rbs

Path C:\Config.Msi\e5a5201.rbs
Size 21KB
SHA256 f6980f5a02fe0d6989c580f4d915059e50d8caa2b21d87312f48bd4a03f0d67b
MD5 ab95530c66ee1f43f0aa8a54c53a9df7
SHA1 5ced7785fe28955c2ae31deb5975dac79d4588db
SHA512 c8183ab5e2c5b0f878a5c631d986ac846dd6fa6f5df8dacee538ef932d67055abab07cda3faf0b78e0ffc9ee77820281df5c7c668695f1113fe21b98056746a9
SSDEEP 384:mrNvDIAZxEth/phSYjK4WbJGwaZsalckU72eC67JkE5KiJrUJrsrr6c+0dWg:mdDIAZxEth/phSYujbJBT9+orr6/0dP
TLSH
T172A20E42BA40D6D3D8A62B70CD97672437B5D3DAA755434B00CC90348F937DA2F9AACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5208.rbs

Path C:\Config.Msi\e5a5208.rbs
Size 16KB
SHA256 c2a8d80eb54d8b871e959a4f04db5c1a499b28aff825dccf22ff413d9c165aa3
MD5 2f3770e0fc4ae55d416519031c4f0f6f
SHA1 91d445e2c249fe4d6f2820f1dbbb1275b678a6bc
SHA512 28e84b0a9e6a71c6c5e280f2efc22b435fd4df6488d3ada269da752c4ccd3177fff95d5de252809212394bcc7ff9a69acd5b6efdbc596dbbc769bc30204350c6
SSDEEP 96:EeRp55RpSNCWT8RzeDd11xQo8RUeDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3Tji:EMR+1GRb1Hn4Xyin5f7U+nh18vTtTy
TLSH
T1E872FE42A94096C3E8662B70DD571B7037B7D7E5A344839B40EC92349F877D22F9E28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a520d.rbs

Path C:\Config.Msi\e5a520d.rbs
Size 18KB
SHA256 2fed635dcac4d30aab86ea6393ee131e81d0933dd930f14c01a285c91932812d
MD5 9ffe87cd40a461faa4f279464c17a9b8
SHA1 0c0e7b5cab007208d22632fb0259132554c4599d
SHA512 6384c56aef47b7de4b8c7277a92a7cb0c9e937b542da0e7f236bd72d70d86ff3066857946d0629cf058de61ecb218a96702cd4249d09e885a2e4e966a23d3725
SSDEEP 192:E8Bm7YOfVqXmwtnNloofHdmF0eXmJDbIvdJDbNowjn5Ev/bcP3pL:E89bf9iaJDKdJDzuc5
TLSH
T185922E426A40D1D3D8A66B70CC872B2537F7D3E693A4475F02DCC1348F937D62E8958A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a521a.rbs

Path C:\Config.Msi\e5a521a.rbs
Size 20KB
SHA256 dc8ae718a3d8517bf907b82f4a799de154ee118f8cc331e9e9f4dfc7cda0d166
MD5 c0c8e8168c759891212be89245d203ce
SHA1 8be0ce89411b80690d66a852c48f79c5c0470675
SHA512 ca5acccdcc48e002c041431c4289ac5841872adf778e33ba9cff13ca6105f0b7658ceeddea07dcc51350c181edd82e7401d2e8188632b5d3c366253957a351f3
SSDEEP 384:1aR3glRKgFfXMawmn28I1S9HXVZFb3Qsq0OjOgnIARQDSdbft:1a3gKifXMawmn28IA9HXVZFbgsq0aOgR
TLSH
T1EAA2EE03A64495D3D8B62B70DDA71BA47B33CBE59361434B40DCD5398F933C22E99A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a5229.rbs

Path C:\Config.Msi\e5a5229.rbs
Size 19KB
SHA256 e3724b2f66db57145b96b1fb890c83a110522e4b4187356453dcfeb008815338
MD5 85a3d4cdc3e72334433030f43717fa38
SHA1 f918f0be4f49a49666d41a34e187c0789d0a2d43
SHA512 b998f8b7940d38a68536b63d10050fd9c58451a869f8222179b522bcc892db5346ff80d88d49e12a6a49ff894f951678d6a773f5d70c21f8195590f46088183f
SSDEEP 384:1UJqQk0Ve2SD4QsUh+FagCJIVJITcMQFSUWF:1UoQk0Ve2SD4QsUh+oFCQcLFTe
TLSH
T1ED92EE46A940D692D8BBAB70CE971B347736C3E9D791531B40CCD1304E937C62F9EA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AudioEndPointTool.exe

Path C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
Size 636KB
SHA256 3ae75afdbb5635114bc85f8269856978f099d554b2d5ce639c2b7ab1720bd4b5
MD5 22e239aa9b776a3c437239ef8c56aa3f
SHA1 be6769a2712b43dde2bf70c2b2211381cc881416
SHA512 3034cfcc78e514cf6869a0dcfcb15c73bff248035ed2a30662737b2367fe45f4f97ebc9d019cbf1a4a47dc0d9ba4697ccd93a767027d82ac68bb183370fe3cf1
SSDEEP 12288:2wvXiMGkWpV1j9hcYtHDlUJNlz9PFu9oT/+2k:2wvizD1fcaDqJP9k9j2k
TLSH
T19BD47D0BA3A441F9D0BBE178D9075956F7B6B81603B09B9F23E042672F572A09F7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disableDrv.bat

Path C:\Program Files\Voicemod V3\driver\disableDrv.bat
Size 1KB
SHA256 a204ad9fb08efc013cd095f620c733f6a9ffb27dfa8b067840ad11bce34eafa2
MD5 cee275b42b348719d1fbfacd3d3f548d
SHA1 afddbd3c1c552d4633dc6f9d96016ee0c1af4c2a
SHA512 453a433f789199d5318d05b140ed76fe0d96db53e7c2c54df72c7b0eb3e95eea232f7d17c11adb6149243988d8fd13490d3787a1efb708baaa14dc87e3aff5e5
TLSH
T141218105361C26ACB71CD076FE64B19D7748B5E419CD6120ECB827E833E4E681D4CAF9
MD5 SHA1 SHA512 TLSH

Submit Download

setupDrv.bat

Path C:\Program Files\Voicemod V3\driver\setupDrv.bat
Size 368B
SHA256 d0c87a8a786958a236b4d17cdaab5f1b5b213492eb74cc8577fbc301e1475066
MD5 ea4874e0933b4a5e0241e19c0fa1a025
SHA1 8ec1885e8a06084d175c650a5bf4cf71356bcd6d
SHA512 bc1361a2855c5343dfec5a025dd3222471192f580526c95ad9649a73ede720be8693cc0e7323d85504ad3ad8aeadce9ba393a656126973fa623b0ab8592489aa
TLSH
T1CDE026A54B2D22DDF56E00BFD85373709E1273C1340EC1B6766D4F14BAA2A918EAC4A5
MD5 SHA1 SHA512 TLSH

Submit Download

setupDrvAdmin.bat

Path C:\Program Files\Voicemod V3\driver\setupDrvAdmin.bat
Size 5KB
SHA256 569938dd98a605797f598ef310b25056b40acd897373067c453df86b1abebb4e
MD5 f712dccf160f7f0034700de155053d78
SHA1 1ea7b7dac402c53b17dbeb4ad8a4f84bfeb0621d
SHA512 2bc4bd04a8a6ef8be5c668daa4a898587bc3e43758fb2a44c386a30f75df71695fbc8924fe4a1d48ad4cef2043e125faedb809bf73b0e8d11df29c8c858713da
SSDEEP 96:OKG2/51LUv3JavxaVKhrhd2c0Rh1GE3dLcuch1GE1dRcfwGwameK+zaoeV/QGvr/:o3JavxaV4CtDYAEame9zaoeNeu4aZRJ
TLSH
T109C1715627A61AA0561C6074B63DB24F336480E06BFC2179EDCAB98B331CDD90D767EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstalldriver.bat

Path C:\Program Files\Voicemod V3\driver\uninstalldriver.bat
Size 1KB
SHA256 ff85a4e820e5448e71082a1a113b429747d68b0d26bc44f557b44681e309c54d
MD5 f121a8fc7db2a4e1eaf740e40bcdc801
SHA1 2248b2c1c7a524bf4ac6c8320352627cc8bdd9dd
SHA512 f9531a59334b0bd0487dc18d4cde25c57db5d58769bdbec6a25061879bea9d6ed53d9c12b9ee8a7aa53a385f442b4901a63d2e15646846f672fa23b8de8d53cf
TLSH
T19E415376690700DE69749172FD1E2000F75BE0A7413A6754F8AF82BC7FF928078EA0D2
MD5 SHA1 SHA512 TLSH

Submit Download

is-B97L1.tmp

Path C:\Program Files\Voicemod V3\is-B97L1.tmp
Size 6.5MB
SHA256 7397f22a9b2cdc849e549c9b038bb27a427272006a26dec18fa996748401f2c7
MD5 16294eaff43a940727cc62162e2520df
SHA1 46508028ce860ee31a73efb0049ac7bf96dbafa9
SHA512 909e5612af88b706fdfcdbe7b305218da3327d095512fc967e567e77c28c0d0f9725fb5b1a3b7a998e17f5f63d75dc3672e60bb978c020ef55a41aa4e57cb942
SSDEEP 98304:H+rbBz3e/A1i/05j4wR0dvpAuCmkBEgwK0:HGBzqA1405MxdvpAlTBtwK0
TLSH
T15C668D69B7BC01D9D46AC1B8C286D237D772781513B057CF5AA48EFA2F23AD01E7A701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-VJDNL.tmp

Path C:\Program Files\Voicemod V3\is-VJDNL.tmp
Size 2.7MB
SHA256 5e0d06cb926864e257a00a72a11c7849b27385ffe0287e7bf7f4394a9bf284d6
MD5 8c5dd2675ddc4dac8d16d03ba4e179fa
SHA1 c5f1d756ea8faea179e9c268a4c95db6adabf34b
SHA512 6bce0fe53a93997528c8c649d39e6ec77c2f941f5648bb9be1fcf34a6bbaf0649896a97cf11be68e7acef9f3fda147ae3023d1017b1fcc2f3378382053b5e29b
SSDEEP 49152:odtbwXp0AlOYG+A9dFVqavvgen9hYAB9qKpmcmYHjIYa+:odyjWiKpD
TLSH
T1F6D5AE1BB6A405BED4BBD238CA074E57E3F2F8560270F74F12A0056E5FAB7624E5A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
Size 986B
SHA256 ed4ccd7a537abc814617dfa1e5449c87d9c8ad3f3be3df1835d5fd61bd095e57
MD5 d078f7e793237775b925bf0530393ebb
SHA1 1b7f1d091c95e663d3c239d80d5f5eec862ed80a
SHA512 6e6905f14b7719dacec8abe674f7a577b44a2d0037867940f50122e93a1359ef05a279ac0f4e9cf2d5bed12cc3720752cd98e1db0fc8f96db3810078c152d549
TLSH
T18A1181606FF6511AE3FBAA7029F9121459BEB8114D22922D0181618A9F31A40DE24B16
MD5 SHA1 SHA512 TLSH

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 9f14025af0065b30e47e23ebb3b491d39ae8ed17d33739e5ff3827ffb3634953
MD5 1c383cd30b7c298ab50293adfecb7b18
SHA1 972a67c48192728a34979d9a35164c1295401b71
SHA512 7a4f07ef7ac81ec31e04d55faffe33bdde93ec2398c338760e0d98adab7ba5acf2c39b2da1782f45e8a5a4d337dedcc647afebddd531782af42bafae98ce7ed5
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 31489056e0916d59fe3add79e63f095af3ffb81604691f21cad442a85c7be617
MD5 67c6a1e7ce56d3d6fa748ab6d9af3fd7
SHA1 827bfc458708f0b442009c9c9836f7e4b65557fb
SHA512 e168c4a2090595d15bca74d0f6ce3cc3babb229d5f657c55dd65984a3ff079e2c784a12bafb1e6085a8658bf8c059db7564629792fcb3df84aceea74c30e3bbe
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 4B
SHA256 40510175845988f13f6162ed8526f0b09f73384467fa855e1e79b44a56562a58
MD5 a9b7ba70783b617e9998dc4dd82eb3c5
SHA1 e3cbba8883fe746c6e35783c9404b4bc0c7ee9eb
SHA512 1227de669e122a546edf39f0ded50cd2b6332793dc55d835b21be05bd529511655877292748c25f8fc2b5f1d5c987d9aaed2fc92c7e59a448e51cdf1dc5351a3
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 1a6562590ef19d1045d06c4055742d38288e9e6dcd71ccde5cee80f1d5a774eb
MD5 c0c7c76d30bd3dcaefc96f40275bdc0a
SHA1 e1822db470e60d090affd0956d743cb0e7cdf113
SHA512 e62b01e8497ab6b7d89432599e21804eca278bb4a9c4b6ef5f7bae00bd5e45ae6c8cf3a18b74296f9a8e69cd2f416a8f41eeb2128f4e280ecf438ffef6244e14
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_25pkywsy.php.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_25pkywsy.php.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260523190151.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260523190151.log
Size 19KB
SHA256 a698c3a6629178b5828f7f2e5b54337701b919ed7eef17a9704bf2ead9caab14
MD5 c8d08ececb405309020c2231cc925181
SHA1 a6edac39aa1fcff80e67350670f621dd0aceb0e5
SHA512 ea47b92c59cb71864994955dd7e23b99dde5871fb99b9ddc9a516b18b16f3b10a07b3bb17cf69ebb4bd26fbc74dc97990565a094467a74ce8a1b707af53ec63f
SSDEEP 384:DFIWJdrITIKIgIe1OyhBwVIQIHIkNIyIlIn:5FGTpAO0hM7rAK
TLSH
T1AE92021216F7A3320990DBFAE2D25FF2975672283AD054A4679FCACC101C8B997CF2C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260523190151_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260523190151_000_vcRuntimeMinimum_x64.log
Size 3KB
SHA256 e763a0d3978fbc2fc9f99d33e7a0d1668c7f1fd5fbb33ea576a4cd62bd74ef0b
MD5 0d2f4de32088477479c60e54062308f1
SHA1 2bcbbedb275342a02f3761d6e0c7bdc9e4821beb
SHA512 183862e1ffd961118905e40ee5e2270e3324904505e9b3a6bdd56abdaa1ad585d750e078781f1df2235d9334bf9017c81ea302c1ddfb9b5c43c7773b37de2b4d
TLSH
T12B71E7141ED80D5AB2B757479EF3C4239A33FCE298758B4C538A435A43ABC019C6C7AE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260523190151_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260523190151_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 d452ab05a9680960d4e2271088f74ad45befc5306597943acf291d34f3827472
MD5 7c07d546479058b1c402751a584bab73
SHA1 ac3f2a3b1cfe64c09b83790d1d17ce86e1655ae1
SHA512 e51ad71a6a7704880f0138f078d98cf13a32a67f6d826aab2a59de81fadfcdc8770bff7704c59803831386ce7537ceaad2755eb092b8a8373ba09ffd455a2115
TLSH
T158410B681BD80906B2B397479EF3C4629A33FCE664348B4C63C5431D876BD027D6877A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260523190206.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260523190206.log
Size 17KB
SHA256 e11fdf304f165daaa7f9a8e5bde8228c2fe556467965cb8540453fbfdf175d47
MD5 3b67c3b2a2da59a17667442ac21f4e08
SHA1 b38d4cb2a6aded7a8314a0fb6841e166ae70f683
SHA512 8fa3f471d09369f8aeb5efe53110b92d60aacab6e132b9ad0c3e01f342ae2f9a6cca957e36c3d7f27515ef040e3afb06a7f09544d0e3b69f6e7f862c34c8e331
SSDEEP 192:UQCygd/Jng1N1z1Q1c1D1p1u11CIC8CXCHi/tUb2LRv8pKXtCyxCHCPkMC0CICy3:UQCfdJvCIC8CXCdSlCICHCPnC0CICO
TLSH
T12F82FD0665FB77270998DEE5F2D58FB2DB9974043E9050F46BEC829C421887ADBCB2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260523190206_000_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260523190206_000_vcRuntimeMinimum_x86.log
Size 2KB
SHA256 39870f0e3820176c76a87a2e8da738f6f370676292cdffe1be2d6791c24f8f34
MD5 ed1aafedf053f86c2629fe5c0761ef83
SHA1 84b123f7ec7580cae4d4592d1401fb2159b900d8
SHA512 95e8d78fbddad4d910034c7d36437ad0f7c2aea6ab51edcca236f4a36afb379038c62e6f737bdf4d8f44e208238f409bdda8e3cb21f2ecd59908ada5cb4ebf45
TLSH
T1F4412B252EFA080AF2B257475EF3C6535A33FDC599348B4C22C9431A476BC0169BC77A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260523190206_001_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260523190206_001_vcRuntimeAdditional_x86.log
Size 2KB
SHA256 039b865881a28ec53d38a35e42493687da36e1091beb2b27e7a603936190e846
MD5 8cce80efa791f52cceed0e9250c69211
SHA1 573972fc55d24554901a6b46f65bb284f8a62b6f
SHA512 1f1607b636482c24e09c7b5e3da4ba63938c28116ec69ba3914a9b2142fc67830b50b945cbb5eb0f4d59e8f8eb9d6ee5c1837944397acf43e5954458af820bea
TLSH
T1934128541EE8091AB1B35747DEF3C4631A33FCC96834DB4C2385831E066BD0669787BA
MD5 SHA1 SHA512 TLSH

Submit Download

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 21B
SHA256 0d2716e49796b4d31401797eefdb6ef788676d9819f0375caa4935f78f4a1ac7
MD5 2e916e6c6eca80fecc75009258e205a8
SHA1 f359ec8c066e75185904f7303361d1d094c0e3a3
SHA512 5b934c8038064ef6fc646528a3ad6230b5cd1f61c05424e95f0e49b3c1cc8abd87a1019e93d07dbbc8fa3fa58f61e21db3e11c31b682ae44b34091cdd9884cc1
MD5 SHA1 SHA512

Submit Download

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 20B
SHA256 9a4bb8707bac33d1d43e6decb7408882890178473ced9abcdf30899f0aab8abc
MD5 0cf23dce45343864852496327d092532
SHA1 8ff4e75d1ce4a07180a9f008559aa1bf4b4a74e0
SHA512 7fcc4fa265926e8ac60f8cee965e4554368dc8b4622523498a657ba313981c61de7cb8f8a81508123b7905318cf131e7d823efb8300938392337feaf08159277
MD5 SHA1 SHA512

Submit Download

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 21B
SHA256 9f85692e1346791ca9d8a81ea978380c0d90a8cdd39f764c50726dbf32f5df29
MD5 3b3e6d49e550b5dee64f4b92984d7f51
SHA1 395a31c2b065d8b3fdf862e9a2f5077cc1825af0
SHA512 1f78003a5d16441eac99c40baf962ba7d1c1fc8ac7b7c1ecbe7e3b62fc3d0d44382c526537e6fa88c7196b07686ca8647d44d1f6a64476077355244a864e55a4
MD5 SHA1 SHA512

Submit Download

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 21B
SHA256 ccbbbbc52c99535f062f7a124b7bbd44e0586dccc0ee19421e55e1f2dfa9e50c
MD5 eed4fd2cefe5b46a6a4c6e9e7ff88261
SHA1 9bf53bc2e4c051bbeac0b85fc87573cc15ebf360
SHA512 dc0959f1e8bbf37616e1b3dc5c4150c2f4a74f6fd7065594c38a1fa0ebfa7d06a58a82788a0d6db5ad0b188932469e8fe0a2735b783d02720c400211f035cbb7
MD5 SHA1 SHA512

Submit Download

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 21B
SHA256 3e4984e4ffed476f68fe94c62441347094b0ed76df7f6e46d02a89e2ad5ff9c2
MD5 eff6e2309f456ed7d57ce29fa20dc3ed
SHA1 736714d7cfc1f95e87d72ad5f3ef5a1655289400
SHA512 3958cb07c538387da367e961bcf65936db455fb7224cc3bcafe39f5b417e25fa9b197c02dcafb9d47b4a59f010f3b9971e814cca916f1492c09bcb98c0600442
MD5 SHA1 SHA512

Submit Download

ipaddress.info

Path C:\Users\Admin\AppData\Local\Temp\ipaddress.info
Size 21B
SHA256 4d306565d983533242738907c8bfc42a778877eb0facb998e5372523054b9ed8
MD5 9217a3a74747fc1fc3d39eaec3016385
SHA1 734136e139624ceecf3893565262b8905de5d70d
SHA512 5cefd8b4a0c5ca6016bb1be4a6d3af1fde9304e1e7223d661cf66a5ec719e98fcafec6962ed086231aadf3e49e80bfdbc4bc46488159e1b4ba0cf85bc7f12eb0
MD5 SHA1 SHA512

Submit Download

bg-inner.png

Path C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\bg-inner.png
Size 6KB
SHA256 8fe4a3f95d5309e692c4142f460bebe4e4e24844f5a2071d466bd964c5d04dcf
MD5 a034eeaf19bb82b2ae63f4fa10c26476
SHA1 617c9ef4b889e424e754574d62649f04c97bcc67
SHA512 c1ffd444da1378620428b374501de974a33e898e38a9d94e88ee5977951aba89fbad033ffbac65051e021fb96dfa9039872f8dc6441de1dfea01c39c8a8ecb20
SSDEEP 192:sSTdK8Lk27YvkgtGwZfgSwPLX51gjmzGj:r48Lk27YMSZIrPLXIck
TLSH
T19CE1AFEAD7970B2830739A902189B07B695FD8723354F315DD3AD30B191A4ECC61F563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg-top.png

Path C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\bg-top.png
Size 20KB
SHA256 bdc753b2b19ee8b573b8e676f18dae42494b99b6bd738194dcdd67f244085f36
MD5 220fe6e00519a633d9ad7d1d50adc4c7
SHA1 cfcadd75996d6f1cb42c43480d24e52dd72bd917
SHA512 1f00db2aab3585aff016188f12f953e832d027161076887cde42b99dab581e2396c9bfb919c43e01fd8c823f79a81425238a8c5235b47be55d7dfdcc1d190ec3
SSDEEP 384:P5Z7BD9bMqsjNoUbBj1N/YsHFc9e0UV7Js52F0pTogUm8GhDpy01BtXUIKH5Xb:BZn4q5kBx2sl2+JK2FSTlUm84YqtXv6r
TLSH
T11992E18DB6680FF386C4F03C992BC03BE679FD69986567059A050FD51C627C94DF2A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
TLSH
T180F26B51D9A1C031C085DEBD6D31E21A936F3A201FD64B691A6E5ACCEE4FF03952C2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

buttons.png

Path C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\buttons.png
Size 1KB
SHA256 d236f88ef90e6d0e259a586f4e613b14d4a35f3a704ff559dadda31341e99c24
MD5 87cc673665996a85a404beb1c8466aee
SHA1 df01fc67a739544244a0ddabd0f818bd960bf071
SHA512 2058e3fd362c689a78fb3d0a163fd21bfe472368649c43dc8e48b24fa4bc5ed1307faf1cab2c351a4dd28f903a72d4951a72d7eb27784fee405884661a259c32
TLSH
T11341FC65E38A45BBF034A13935251813A4041C3BB04FEE2545A375AF2363F2ABD31E47
MD5 SHA1 SHA512 TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
TLSH
T13434AF00B6CBC073D98F0778842B975C0B7AB95557348ACBEB985DADCD213C2AD371A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vm_vc_Redist.x64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\vm_vc_Redist.x64.exe
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vm_vc_Redist.x86.exe

Path C:\Users\Admin\AppData\Local\Temp\is-NB4FO.tmp\vm_vc_Redist.x86.exe
Size 13.3MB
SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
MD5 99f52708b06b9c695a8d64a44740bf08
SHA1 c2743ffc36d2af40ade0e370be52d6b202874114
SHA512 d0a609f6b2f05939ab82aa5fde1bb0595206653a2ab2ce859a750f71596c4491a8074bb825484e365a4fbcdb820d5de0346e7209ea22214b090b4fe853098dce
SSDEEP 196608:fLZBJflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4L6f6psSD5YM4565kIgoOgP2edk:lHlptVYmfr7yBG/4L6f6pXc65kngP1
TLSH
T1A8E63332E494413BFFB604336A65E9203E7DA628274149F6E3C8FD4D3A7219267F7612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoicemodInstaller_1.6.13-l2wy2i.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-PNLNA.tmp\VoicemodInstaller_1.6.13-l2wy2i.tmp
Size 2.6MB
SHA256 2e67ed333d85a2b59bc7783cad45b64a0db7783997c4581f967628b0710fec11
MD5 94092b0ed8c1698493ae00bd9b373b0f
SHA1 6ca12541a11bdd297e78fdb1a7c2a3106a0c14b7
SHA512 5b6a48b14a0a9e2cb178b9ed48ccdddfc4689b3d528d20ab99ea3a269da21255f2d65c07054bba12e0ebec1f5b749e34e5742db48164f7d4f0da052ce90af85c
SSDEEP 49152:F/bMELtKnwSaPuqrUJlORnUjzV8VkLwkQ:FjMzVPeVCY
TLSH
T1F8C54B12B384B13FD06B2A35643BC670993FBE5179B3CD166BF41D0DAF355802B2AA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasklist_unins000.exe.txt

Path C:\Users\Admin\AppData\Local\Temp\tasklist_unins000.exe.txt
Size 7KB
SHA256 525401aa021da7a538ed658a119dfa3be00c420801838f2a23ac66eee2ac909a
MD5 e19e76c97ed3c61b8cb42c7cfbf34d31
SHA1 6383c76c1e5b95afa1d8d2afc98ab8a6422b1092
SHA512 c41e517c139dc6314a5e513e4dccc4c5c106533ef93ebea1ff5ba20b5f8a721e00fb2391487c911ef18f1648999ebc428cfe99420c857573d2945ed6a0000325
SSDEEP 192:Mod4ynNtD6vQp528xwk8qnQhtPzqRhpF77ZsNd66XGHzH7C+lvLu7Sh7TKmeRLrv:Mod4ynNtD6vQp528xwk8qnQhtPzqRhp0
TLSH
T143E1008189CF45EC922DE3983E230042EB4E5500316AADD93ADE14EC77E5F1CD7EBA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemodcon.err

Path C:\Users\Admin\AppData\Local\Temp\voicemodcon.err
Size 2B
SHA256 c837649cce43f2729138e72cc315207057ac82599a59be72765a477f22d14a54
MD5 72b32a1f754ba1c09b3695e0cb6cde7f
SHA1 9109c85a45b703f87f1413a405549a2cea9ab556
SHA512 a2f4521450ffa4a0ec674bd6ee1bfe0e936c620adb73e0de1c16b0bd62fc03df62433f9a2ee12bd15c1fc21c888b5de9062311cba437c788ad530dc803366324
MD5 SHA1 SHA512

Submit Download

SET8E87.tmp

Path C:\Users\Admin\AppData\Local\Temp\{78d5153c-211e-4942-b6ce-ffe2496e4124}\SET8E87.tmp
Size 6KB
SHA256 66b051ba7ead45d25e7cc4ffce5c29923ca80379ad2b0170c49447043e83b1aa
MD5 227f4b6bd0e10d2c3d84c2793cb0dd9d
SHA1 7f2d1463e37b8694d492ac0e849c81611788beab
SHA512 74988cf579a59283cf8d6c6defc8d27a70835a6072dbbd5d554fbf8f3021ce4e88c76dee04676a065ee31ef00a567c934f88370d39013125acb3963a1c0fee6e
SSDEEP 192:7yAztfwkiJmR1ZpniJoPl5WAegzsArAxgzaUgzcgzO2yStt2XaW8CgQekOzTyM:LtfwtmGelnzFzszRz7ygt2Z8jdB
TLSH
T1B7D145DC195E1C95CB5A81AB581B1A50BE8F61E018D10325F20F6F8EFBDEB8ED294C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemodvad.cat

Path C:\Users\Admin\AppData\Local\Temp\{78d5153c-211e-4942-b6ce-ffe2496e4124}\voicemodvad.cat
Size 11KB
SHA256 9d33bc81b59c398fc329d61c0698c1907c64aab8d9774cfc4f5d87a8787613d6
MD5 f4099661e8db182c38a72da97dfa664f
SHA1 ed4d981b76f2ca66acffd393a3d0d6832e6bcfef
SHA512 3a4457ade6ea34883e946b2677b79b27fcec4a681ba23c18513d80b76449146ff4794dae3ab99a110f8fe06bfe2002d07d371d67b4386bb3051e80f0d568ebbf
SSDEEP 192:mQmIiUfo0JCPZ2CEwLJ+hYCi0FiWY8u27X01k9z3AM/NYGa3:MU3QL+h3yo7R9z//NYGa
TLSH
T1B14218E1496C51C2FCA7AC6063E8FA437C3D23CB5810056A16AEF6190EA33C5FB2817D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemodvad.sys

Path C:\Users\Admin\AppData\Local\Temp\{78d5153c-211e-4942-b6ce-ffe2496e4124}\voicemodvad.sys
Size 91KB
SHA256 93f72a9c74e6e49c50f3fc789bb10ebc72fa5fc85a26278d9a0df73cfa0a798e
MD5 b737e525c05d48882d75c193109d1aa2
SHA1 4e1b6ad6d5dc5713dd3d34c94d18dc0067fffa7b
SHA512 c1c08579b1f9c7ed5d7a52c4acd5c9751764dbb2080171cd91dc4798c6ccc67d65c5b5fcd6a2474be7191c320647b51fd9ba1f7b32a46bc3a836b00cc977e7ae
SSDEEP 1536:UvMCZhRYLplR61Pv20jhbb8vgci/7VGSKjL64enp8KSM5o7lxvxwez/1NK:wM6+PsVUH64eeKzuBx5Tz3K
TLSH
T1FD936B8A73E814D5D1AAD17481E6865BEBB1F04217138BCF0260C76E4F27FE59E39368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab54A5CABBE7274D8A22EB58060AAB7623

Path C:\Windows\Temp\{123CD412-56A8-4945-AD8D-5964D6EB3FC0}\cab54A5CABBE7274D8A22EB58060AAB7623
Size 838KB
SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
MD5 d8b6763546bb89d2d9cf3c45908b1e4b
SHA1 a1d28457d45a80bcf29618ebbdd9c50808acae5d
SHA512 194d06552d8a3b107851de79f7e9b17f4b143f62886abc71928c899e808c9d0a35417fb1813bfb918ced5f2058bfa58dfd34f837be0833d4b2ea9b143ba42081
SSDEEP 24576:P+EPvFdDKnDzR8ezJwqgq3anXt/WNsJsI96p+L2TI0X:PH9oXzdgUq+NAsXo2T3
TLSH
T1C70523DA72D3A60BED4C2DC008BDE5631D37BAFE9412D38A6174807A39CB7D456342AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cabB3E1576D1FEFBB979E13B1A5379E0B16

Path C:\Windows\Temp\{123CD412-56A8-4945-AD8D-5964D6EB3FC0}\cabB3E1576D1FEFBB979E13B1A5379E0B16
Size 4.9MB
SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
MD5 1d033900fb3774d9025fa656f175d39e
SHA1 9cbc362c97c37aa5236c49e7b974e4a62bbd9d21
SHA512 b96914b5e8c4951dc4f6b08b96e548c7328424a78d9b1394f1c2ab2ebf2f870b5c3e6f685c656cc1d6dccc396ece88ae6f23918cfa1c9ade22828972a0468f75
SSDEEP 98304:zExLOQyFMLkrdAyYPk9Lqy5dPFpDoNRAKHSEPFVzyJUkeOwnxRj8oFFZY:saQyKLksPk461fDo3PFVzyJ7eVnFo
TLSH
T172363318C4712B0ABC1E482455E3DE84FDC5B9DAAA863BD7F264B74C29437957B30C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x86

Path C:\Windows\Temp\{123CD412-56A8-4945-AD8D-5964D6EB3FC0}\vcRuntimeAdditional_x86
Size 200KB
SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
MD5 e4c2fa6814ad5061be3d081e5102eb1d
SHA1 89bee5a8cbd82937bd2222cc6e97b3648e8e491f
SHA512 5ebe95053ed100758711fa2a5d4bc12f3c976b8b2a27b8a88d6d10f666b6c5170698939b03c30ccb06acebd5d703d90045eb236cc4cfe55d1c92c31e8de87575
SSDEEP 3072:x9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriThXC:DlaZeKFxCnBheIdluA
TLSH
T17014AE12B5808033DAFE1A351178DB615F3DBE608F54499B2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x86

Path C:\Windows\Temp\{123CD412-56A8-4945-AD8D-5964D6EB3FC0}\vcRuntimeMinimum_x86
Size 200KB
SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
MD5 cce22015775c209fbab4050261fba590
SHA1 27998ee42531b9d41f3d71c9dc2ead8d95ed8863
SHA512 61886caec75d195d43fafcaa8d1a8b50c4fb65c39103f62d54a704d713035cc2717c04b1c1cd4794d218364b05c27bf62b13d3aef66e5665f148961ac009b45d
SSDEEP 3072:0I9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTg3:ZlaZeKFxCnBheIdlu
TLSH
T1F414AF12B5808032DAFE19351178DB715F3D7E608F5489AB2364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vm_vc_Redist.x86.exe

Path C:\Windows\Temp\{9399A1A2-005E-408E-BA64-650BB6B73BC0}\.cr\vm_vc_Redist.x86.exe
Size 669KB
SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
MD5 f216f5ee89b18a28a3936fab57c16179
SHA1 3d2995962598774a8e2dc1d038c76495466f3a72
SHA512 9350de18d452927efef3be3dd4c49361ec6b29f22e969781374508b167b4e697dcea05ee6b43b47b850d4edd0591b960628ee9cbc59deee62937a40a8e5a6573
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7y+1nEn0/6OaFUuT80iP:n3WnIZuMCxezot7Dh+0/9ayn0i
TLSH
T18CE49D32A5614033FBF10573B928A6303E7CE7282751C8A9D7D4AD1D7EA58C2A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1028\license.rtf
Size 17KB
SHA256 44c76290f7a2e45940e8338912feb49bcf4e071cfa85d2d34762857743acbc8d
MD5 2b063d92663595dfe4781ae687a03d86
SHA1 0fb582e756dbc751ea380593ac4da27ddb4ebb06
SHA512 94c8fda6173c7f5740f206190edcd1f1f1c309596b710d400e23cd363a619d707a5d4576d4fe63ab7cb68947f009efd29a1fbe04743a294698bf2ae17e92c214
SSDEEP 192:Haz4aHQbC6dBCLCNavmu6OqSPEmmVUJ9etKL5W2cBxGC4iSM0fvJ9seyryH1mqGI:2yk/RF8e7GWU2
TLSH
T164821625F434AE8D06C2563F8B2B90D53BEE060BDDB99913AD6F3307082755ED5C3A92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1028\thm.wxl
Size 2KB
SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
MD5 472abbedcbad24dba5b5f5e8d02c340f
SHA1 974f62b5c2e149c3879dd16e5a9dbb9406c3db85
SHA512 676e29378aaed25de6008d213efa10d1f5aad107833e218d71f697e728b7b5b57de42e7a910f121948d7b1b47ab4f7ae63f71196c747e8ae2b4827f754fc2699
TLSH
T17F519BAA7CDF16D096335110E8825ABA1520D6AC527B6CF1FE0A09479B8D8376373F17
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1029\license.rtf
Size 12KB
SHA256 503c433dcde2f3a9e7d388a5ff2b0612e7d8f90f5188d5b2b60228db33044fde
MD5 e7dc9ca9474a13fa4529d91bcd2ab8cc
SHA1 511f5de8a99c09ec3766c5e2494a79eacca261c8
SHA512 77108e53cd58e42f847d8ef23a07723c4849dc41dbe1c3ef939b9170e75f525bec9d210d6c1fbfeb330ece2e77b8a8e2808730d9e6f72f5b3fe626d58b6068c6
SSDEEP 192:T7wfl7OGpX5a5HEgQ2psch5jotXxEvH++3kamdyjCrDZugDHgbGNl86NhrYGY9D2:Yfl7O5ocINaHmjI44fUixAvOwwrJ2
TLSH
T11E52942A9F7D85CE2717428E0B42200BBF4E7A481E36D3F53587B99D10B78BCE5912D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1029\thm.wxl
Size 3KB
SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
MD5 16343005d29ec431891b02f048c7f581
SHA1 85a14c40c482d9351271f6119d272d19407c3ce9
SHA512 ff1ae9c21dcfb018dd4ec82a6d43362cb8c591e21f45dd1c25955d83d328b57c8d454bbe33fbc73a70dadf1dfb3ae27502c9b3a8a3ff2da97085ca0d9a68ab03
TLSH
T16A611C5778CF678065336115FDE216682A04C5D8423B6CF2FD8B8A07878992B6333F27
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1031\license.rtf
Size 12KB
SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
MD5 2ddca2866d76c850f68acdfdb696d6de
SHA1 c5076f10b0f0654cde2c990deeb2772f3cc4844b
SHA512 e3a3693b92873e0b42007616ff6916304edc5c4f2eee3e9276f87e86dd94c2bf6e1cf4e895cdf9a1aa0cac0b381b8840eee1f491123e901dee75638b8bc5ce1b
SSDEEP 192:N6AY7JCc/2WVJtntrUqMmvuUh+mxYpnY4+ZqDe6mUZaEzYNvQ8yOejISRC4WL32:PUw2lSSssWVzOHyOejIS/22
TLSH
T1CB42C7B2B6E78288977A33A206235C51370E03BFDE65F46DA0C8C5722616BF8D5DD1A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1031\thm.wxl
Size 3KB
SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
MD5 561f3f32db2453647d1992d4d932e872
SHA1 109548642fb7c5cc0159beddbcf7752b12b264c0
SHA512 cef8c80bef8f88208e0751305df519c3d2f1c84351a71098dc73392ec06cb61a4aca35182a0822cf6934e8ee42196e2bcfe810cc859965a9f6f393858a1242df
TLSH
T14661ED9778CF3B8464336221EA825A6A2914C189427B1DF5FD4B869B874D4339327F63
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1036\license.rtf
Size 12KB
SHA256 5c13a65870d770d1642a4259eecb436257ca39016a0500f747be9c79be0c7009
MD5 a6e352e5804313ccde3e4d5dddde122d
SHA1 834e3aaa07dc675589a9e5fcd23ce5586c2739e8
SHA512 6578ac6467f61930bc1b20e404441725c63790c65aec1ace297429ead15f50e68d5fe9cc1451ac86ae23dc1a7fe967650166293010d687785fb81fb4492b87c4
SSDEEP 384:7Jja9NaNbUmVao9L5EOMjWghxjUSeuDSej2:dj84gmVz9EDjW8GSZC
TLSH
T15D42D99956EE40C8038B21625B014527A39DC288E464E338D4DBB9D63B69C6CF3F71FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1036\thm.wxl
Size 3KB
SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
MD5 7b46ae8698459830a0f9116bc27de7df
SHA1 d9bb14d483b88996a591392ae03e245cae19c6c3
SHA512 fc536dfadbcd81b42f611ac996059a6264e36ecf72a4aee7d1e37b87aefed290cc5251c09b68ed0c8719f655b163ad0782acd8ce6332ed4ab4046c12d8e6dbf6
TLSH
T16761CF9374EF57A06873121BFD8359692830D188433F59F1FD47890B828A836A377B63
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1040\license.rtf
Size 11KB
SHA256 70ecf23c03b66a2b18e173332586afa8f00f91e02a80628f4f9cb2521e27f6ac
MD5 bc58ad6abb16b982aebadc121b37e706
SHA1 25e3e4127a643db5db2a0b62b02de871359fae42
SHA512 8340452cb5e196cb1d5da6dbb3fa8872e519d7903a05331055370b4850d912674f0b6af3d6e4f94248fe8135eb378eb36969821d711fe1624a04af13bbe55d70
SSDEEP 192:HJdZDQX6UXR2+5AkgS/PhdzerS8QGowHV66zdgkycjGCDLQ+n3YJ258FSiej4LaW:7azAUd+RrR5jjPLQY3YJTSjk42
TLSH
T15132C73462C312C943A713EA42728059BB6F07EEED69F568F8D4663C20DEA88F1591DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1040\thm.wxl
Size 3KB
SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
MD5 d90bc60fa15299925986a52861b8e5d5
SHA1 fadfca9ab91b1ab4bd7f76132f712357bd6db760
SHA512 11764d0e9f286b5aa7b1a9601170833e462a93a1e569a032fcba9879174305582bd42794d4131b83fbcfbf1cf868a8d5382b11a4bd21f0f7d9b2e87e3c708c3f
TLSH
T19461E26378DF575425736208E982956A6918D8DDD73F2DF0FC87464B838A822632BF13
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1041\license.rtf
Size 29KB
SHA256 c3061a334bfd5f02b7085f8f454d5d3d97d477af14bab497bf31a7887bc90c5b
MD5 47c315c54b6f2078875119fa7a718499
SHA1 f650ddb5df2af2ee7555c410d034b37b9dfd055b
SHA512 a0e4b0fcccfdd93baf133c2080403e8719e4a6984237f751bd883c0d3c52d818efd00f8ba7726a2f645f66286305599403470f14d39eedc526dde59228a5f261
SSDEEP 192:I6ZzmL3hCm2AivEiTsk3H1DjM3Lm4nVsO4Uy9C0QueLJkEBN7VvfNSqkO+0TU7B9:VArCQx/2LLW7//72
TLSH
T1FDD23E2764B8B9BC1AC45A9E9B16D4F87BDF0503CF72F107B84E6713091A11E97873A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1041\thm.wxl
Size 3KB
SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
MD5 dc81ed54fd28fc6db6f139c8da1bded6
SHA1 9c719c32844f78aae523adb8ee42a54d019c2b05
SHA512 fd759c42c7740ee9b42ea910d66b0fa3f813600fd29d074bb592e5e12f5ec09db6b529680e54f7943821cefe84ce155a151b89a355d99c25a920bf8f254aa008
TLSH
T14781C06DB6DA219199331160B8825AE52511CC99C63B2CF1F90EC857BA8C47FD233F37
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1042\license.rtf
Size 27KB
SHA256 3d4e9c165cbeab829d608106f0e96450f839ffa8adbd755f0b51867e89da2ae0
MD5 641d926354f001034cf3f2f3b0ff33dc
SHA1 5505107fff6cf279769a82510276f61ea18637ae
SHA512 b0339664434b096abc26d600f7657919ef3689b4e0fdfd4edd8e479859a51ef51be8f05fa43e25567ffd6c1c2bcc6ef0d7a857b6d666d264c7783bad3a383d0e
SSDEEP 384:CuQibAmua4XatV1pMxlD1xzjxsZmfmzw4ezN7RQjyeqCBS96My7yNRylDSFrQv90:n4atZClDFsZuheqooMerJlQq/
TLSH
T194D2FA41B4F66B4D0962E52E522601DB7BB6810F8CF9C310AFAB720F7C6B50EF5479A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1042\thm.wxl
Size 3KB
SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
MD5 b3399648c2f30930487f20b50378cec1
SHA1 ca7bdab3bfef89f6fa3c4aaf39a165d14069fc3d
SHA512 c5b0ecf11f6dadf2e68bc3aa29cc8b24c0158dae61fe488042d1105341773166c9ebabe43b2af691ad4d4b458bf4a4bf9689c5722c536439ca3cdc84c0825965
TLSH
T17161DD6338DB56C0A5736404AD92A6B66610C2D8637B1CF1FE469987CB8C8335373F67
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1045\license.rtf
Size 13KB
SHA256 6f94a99072061012c5626a6dd069809ec841d6e3102b48394d522a0c2e3aa2b5
MD5 f140fd8ca2c63a861d04310257c1b1db
SHA1 7bf7ef763a1f80ecaca692908f8f0790a88c3ca1
SHA512 a0bd65af13cc11e41e5021df0399e5d21b340ef6c9bbe9b1b56a1766f609ceb031f550a7a0439264b10d67a76a6403e41aba49b3c9e347caedfe9af0c5be1ee6
SSDEEP 384:Pd0SEvKJ7P9yEw1VAOV/sHm/Iznc2wf6w2:8Jf/sHmAzcaX
TLSH
T17D52C89EDA4644C8E353629BA2E3152A374C97C59C24D76CBC9F2C2B0075EACF79C274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1045\thm.wxl
Size 3KB
SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
MD5 15172eaf5c2c2e2b008de04a250a62a1
SHA1 ed60f870c473ee87df39d1584880d964796e6888
SHA512 48aa89cf4a0b64ff4dcb82e372a01dff423c12111d35a4d27b6d8dd793ffde130e0037ab5e4477818a0939f61f7db25295e4271b8b03f209d8f498169b1f9bae
TLSH
T1CA61ED4778EAAAD06A331154ED8369652804C99C423B1EF5FD8B141BC78E9626333F5B
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1046\license.rtf
Size 10KB
SHA256 27891eec899be859e3b4d3b29247fc6b535d7e836def0329111c48741ec6e701
MD5 9a8d2acf07f3c01e5cbc461ab932d85b
SHA1 8781a298dcc14c18c6f6db58b64f50b2fc6e338e
SHA512 a60262a0c18e3bef7c6d52f242153ebe891f676ed639f2dacfebbac86e70eebf58aa95a7fe1a16e15a553c1bd3ecaccd8677eb9d2761cb79cb9a342c9b4252e2
SSDEEP 192:H2JR4ufWXXFA+YGRjHquAHHoKWCsGlHIpSDDvJRkYhaDznP3l7wLXiBpt32:WJ6ufB+Yc3AnoZCb5AGPQPCLQ72
TLSH
T1F832B77817C24288031712865793C407B64E43C9DDBDF88DF9ED996E31CAAACF66319D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1046\thm.wxl
Size 3KB
SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
MD5 be27b98e086d2b8068b16dbf43e18d50
SHA1 6faf34a36c8d9de55650d0466563852552927603
SHA512 3b7c773ef72d40a8b123fdb8fc11c4f354a3b152cf6d247f02e494b0770c28483392c76f3c222e3719cf500fe98f535014192acddd2ed9ef971718ea3ec0a73e
TLSH
T13551DC6339CF169026335215F9935A6A2400D9D8823B5DF5FD8B8A4787CE963A337F23
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1049\license.rtf
Size 31KB
SHA256 1bb3fb55b8a13fa3bafffe72f5b1ed8b57a63bd4d8654bb6dc5b9011ce803b44
MD5 62229be4447c349df353c5d56372d64b
SHA1 989799ed24913a0e6ae2546ee2a9a8d556e1cb3b
SHA512 fa366328c3fd4f683fdb1c5a64f5d554de79620331086e8b4ccc2bfc2595b1fded02cec8aa982fcd8b13cc175d222af2d7e2cd1a33b52f36afd692b533fdbf13
SSDEEP 384:GdkM1I1EqW6aAHmxiTJrN6feZ78C7e5zoPqp007FsrmPx/1JRbnS0Yk4SYdIDtx2:Su4Mtg1S0YkjYWZM
TLSH
T161E27858AD35758F168215BD1B6F168247ECA50ECDF18141EEEF93470E6F8AD82B30A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1049\thm.wxl
Size 4KB
SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
MD5 17c652452e5ee930a7f1e5e312c17324
SHA1 59f3308b87143d8ea0ea319a1f1a1f5da5759dd3
SHA512 53fd207b96d6bcf0a442e2d90b92e26cbb3ecc6ed71b753a416730e8067e831e9eb32981a9e9368c4cca16afbcb2051483fdcfc474ea8f0d652fca934634fbe8
SSDEEP 48:c5DiTlDhQt9esbrohDTWJt49kAr7DHN3m5GNDCNvNLIkflhrWncPingGdZwK1Kqp:uDiTlDYVgmt4xJ88k193ipzjvL
TLSH
T1C681DE12289E21DD1522B127DC408D5C3DA690FE673B5AF2BD416E6FB2E64328333B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1055\license.rtf
Size 13KB
SHA256 f80926604e503697247353f56856b31de0b3fc1319f1c94068363952549cc9b1
MD5 9625f3a496dbf5e3e0d2f33d417edbbf
SHA1 119376730428812a31b70d58c873866d5307a775
SHA512 db91a14fc27e3a62324e024dd44e3b5548af7e1c021201c3d851bd2f32537885aacfc64adae619bac31b60229d1d5fc653f5301cd7187c69bd0acecce817d6a3
SSDEEP 192:mfGSPTe1VWjPqkdUxtptACpt4jSzUQBtB7+fzCCnebZ/42W2TEAQjE4oOwuxqrEs:7SK+W6UbACp2SzD9+btebZwZWEdpow2
TLSH
T1D45221970ED7B9C62B121DEE4EA110E3FAC9091B7D31FD189C86392D2131BBF7AA5105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\1055\thm.wxl
Size 3KB
SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
MD5 defbea001dc4eb66553630ac7ce47cca
SHA1 90ced64ec7c861f03484b5d5616fdbcda8f64788
SHA512 b3b7a22d0cdada21a977f1dceaf2d73212a4cddbd298532b1ac97575f36113d45e8d71c60a6d8f8cc2e9dbf18ee1000167cfbf0b2e7ed6f05462d77e0bca0e90
TLSH
T18061FC4338CB5A9859332266FD92562A6918C4C8933B6DF2FD4B9547878D4332373F17
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\2052\license.rtf
Size 17KB
SHA256 a808b4933ce3b3e0893504dbef43ebf90b8b567f94bd6481b6315ed9141e1b11
MD5 d083c7e300928a0c5aea5ecbd1653836
SHA1 08f4f1f9f7dfa593be3977515635967ce7a99e7a
SHA512 8cb3ffad879baba36137b7a21b62d9d6c530693f5e16fbb975f3e7c20f1db5a686f3a6ee406d69b018aa494e4cd185f71b369a378ae3289b8080105157e63fd0
SSDEEP 192:Hom4PyAjs/HBJ5qyK3PG4lk5xxKyAW1yW7/Y3OKchGMvGMLdo4+uHq9f4yPxrdCX:IDM1OR5rGU2
TLSH
T15D82D450A535AE9D45C29A7FD72B90D57AEA061FDEFD9102CE7F2303082396ED2874C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\2052\thm.wxl
Size 2KB
SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
MD5 3d1e15deeace801322e222969a574f17
SHA1 58074c83775e1a884fed6679acf9ac78abb8a169
SHA512 10797919845c57c5831234e866d730ebd13255e5bf8ba8087d53f1d0fc5d72dc6d5f6945dbebee69acc6a2e20378750c4b78083ae0390632743c184532358e10
TLSH
T12151ACE778DB1AE09A332050B99215B92420D288537BADF1FE4B5947978C83353B3F1B
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\3082\license.rtf
Size 10KB
SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
MD5 873a413d23f830d3e87dab3b94153e08
SHA1 24cfc24f22cef89818718a86f55f27606eb42668
SHA512 dc1eccb5cc4d3047401e2bc31f5eb3e21c7881c02744a2e63c10d3c911d1158dcfac023988e873c33dc381c989304fe1d3cb27ed99d7801285c4c378553cd821
SSDEEP 192:HalhwTwQ4yzePBrarlvTteQH3bf9WaoXUBXZRaS9YARl0hcXNVD32:6lc4krlU2ymLN12
TLSH
T1C922C47016D583D003A323934693C457F6AE23E6CC29E8A87CDE9B7C20C99ECE2565DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C0F3C1C5-FCC5-4B51-ADD4-69AC5FE6123B}\.ba\3082\thm.wxl
Size 3KB
SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
MD5 47f9f8d342c9c22d0c9636bc7362fa8f
SHA1 3922d1589e284ce76ab39800e2b064f71123c1c5
SHA512 e458df875e9b0622aebe3c1449868aa6a2826a1f851db71165a872b2897cf870ccf85046944ff51ffc13bb15e54e9d9424ec36caf5a2f38ce8b7d6dc0e9b2363
TLSH
T14861E16738CF5B9079735018F8C2953A5810C4A8623B9DF1FE87495783CA9665333F63
MD5 SHA1 SHA512 TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{D7C09158-37EE-455A-8A1E-EAB71A46B28B}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{D7C09158-37EE-455A-8A1E-EAB71A46B28B}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{D7C09158-37EE-455A-8A1E-EAB71A46B28B}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{D7C09158-37EE-455A-8A1E-EAB71A46B28B}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vm_vc_Redist.x64.exe

Path C:\Windows\Temp\{E19AA4B8-2680-4B21-A458-C5EAEA858828}\.cr\vm_vc_Redist.x64.exe
Size 670KB
SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
MD5 bc9c8a6a42e8d3ea18f8da78d5031820
SHA1 07812a4b945364d04627363e46ab38de188281b3
SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
TLSH
T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{E526DEC1-2C25-4F87-A055-AE0DA2F8B3E3}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{E526DEC1-2C25-4F87-A055-AE0DA2F8B3E3}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{E526DEC1-2C25-4F87-A055-AE0DA2F8B3E3}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
MD5 ea81447ef1038bd5726b36063896b39a
SHA1 8f484a24bfe42276580d120c200a99bf604eea70
SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
TLSH
T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{E526DEC1-2C25-4F87-A055-AE0DA2F8B3E3}\cab5046A8AB272BF37297BB7928664C9503
Size 964KB
SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
MD5 efc41c00aadf8b2050ecf9e38e9036f1
SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
TLSH
T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{E526DEC1-2C25-4F87-A055-AE0DA2F8B3E3}\vcRuntimeAdditional_x64
Size 208KB
SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
MD5 f375f3d81a661e188146d701d8ed3ba9
SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
TLSH
T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{E526DEC1-2C25-4F87-A055-AE0DA2F8B3E3}\vcRuntimeMinimum_x64
Size 208KB
SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
MD5 23626831f9a05572c6ebd133e5ffc4b0
SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
TLSH
T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/468-403-0x0000000000300000-0x0000000000377000-memory.dmp

Download

memory/912-13-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/912-0-0x0000000000400000-0x00000000004E9000-memory.dmp

Download

memory/2384-715-0x0000025980030000-0x0000025980052000-memory.dmp

Download

memory/3144-647-0x00000000003E0000-0x0000000000457000-memory.dmp

Download

memory/3528-649-0x00000000003E0000-0x0000000000457000-memory.dmp

Download

memory/3764-650-0x00000000003E0000-0x0000000000457000-memory.dmp

Download

memory/4260-402-0x0000000000300000-0x0000000000377000-memory.dmp

Download

memory/4324-400-0x0000000000300000-0x0000000000377000-memory.dmp

Download

memory/4416-163-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4416-104-0x00000000038E0000-0x0000000003A20000-memory.dmp

Download

memory/4416-156-0x00000000038E0000-0x0000000003A20000-memory.dmp

Download

memory/4416-144-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4416-118-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4416-235-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4416-119-0x00000000036D0000-0x00000000036DE000-memory.dmp

Download

memory/4416-114-0x00000000038E0000-0x0000000003A20000-memory.dmp

Download

memory/4416-99-0x00000000038E0000-0x0000000003A20000-memory.dmp

Download

memory/4416-164-0x00000000036D0000-0x00000000036DE000-memory.dmp

Download

memory/4416-109-0x00000000038E0000-0x0000000003A20000-memory.dmp

Download

memory/4416-94-0x00000000038E0000-0x0000000003A20000-memory.dmp

Download

memory/4416-34-0x00000000036D0000-0x00000000036DE000-memory.dmp

Download

memory/4416-24-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4416-14-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4416-15-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/4416-412-0x0000000000400000-0x00000000006A5000-memory.dmp

Download

memory/4416-5-0x0000000000910000-0x0000000000911000-memory.dmp

Download