Analysis
- user interaction
yes - max time kernel
46s - max time network
51s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
ggg.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ggg.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target ggg.exe
- Size 41.8MB
- Sample260710-t9q7mac12j
- SHA256 aa55deb32c78ac7d3abb3310eb0e95be28b469a54cf9ea0744a0727211019a71
- MD5 6dcc4b896ec7446dce3530c5b0ca7c0c
- SHA1 93112d9fcfa5bcca7d4e9e240d180059c9922f41
- SHA512 ea3a0ca6da52fcf44be8f194896a62c3ba32e63b56b5870cbec4e699590af2bf719bb4f3585d1f4095150d4eae6b69d95937613b453f6526d599207293c16b0c
- SSDEEP 786432:UmfG1cpJLqG3FyuJksHsRi4R+VPG2BmOTQwM1xhh5xU+ppNli/:UmfQcpJmGUuJksHqn+VPG2AOpwppNE
- TLSH T18EA733AD5BC8851AC49CE9F2F306C9A7F3806D36175F44E0624EBE0F63B8638A745B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe - Drops file in System32 directory 17 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.PNF VBVoicemeeterVAIO_Setup_x64.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b}\SET60D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b}\vbvoicemeetervaio64_win10.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b}\vbvoicemeetervaio64_win10.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b}\SET60C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b}\vbvoicemeetervaio64_win10.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b}\SET60E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b}\SET60C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b}\SET60D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b}\SET60E.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{6aeea721-a6e8-014d-bec0-0050f77e195b} DrvInst.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\VB\Voicemeeter\voicemeeter_x64.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterLogo_72x72.png ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterBUSGEQ15.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_2003.cat ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_vista.cat ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_2003.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio64_2003.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBCABLE_Setup.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_xp.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio64_win7.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio64_win10.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\mp3lame\lame_enc64.dll ggg.exe File opened for modification C:\Program Files\VB\VBVoicemeeterVAIOs\vbvoicemeetervaio64_win10.inf VBVoicemeeterVAIO_Setup_x64.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_win10.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_vista.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio64_2003.cat ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio64_2003.inf ggg.exe File created C:\Program Files\VB\VBVoicemeeterVAIOs\VBVoicemeeterVAIO_ControlPanel.exe VBVoicemeeterVAIO_Setup_x64.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBCABLE_ControlPanel.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBvmvaio64_2003.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio_xp.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\readme.txt ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBCABLE_Setup_x64.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_win7.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_2003.cat ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio64_win10.cat ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterBUSMatrix8.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbusbgpi_uart_xp_vista.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_2003.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_win10.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBAudioLogoWhite_72x72.png ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbvoicemeetervaio64_win10.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_vista.cat ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio64_vista.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBVMAUX_Setup.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver64.dll ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\ggg.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbvoicemeetervaio64arm_win10.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBvmvaio_xp.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\voicemeeterpro.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterRemote64.dll ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBVMAUX_ControlPanel.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBVMAUX_Setup_x64.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver.dll ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver.dll ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBvmvaio_win7.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VMStreamerView.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterMacroButtons.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBvmauxvaio_win7.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\mp3lame\lame_License.txt ggg.exe File opened for modification C:\Program Files\VB\VBVoicemeeterVAIOs\VBVoicemeeterVAIO_Setup_x64.exe VBVoicemeeterVAIO_Setup_x64.exe File opened for modification C:\Program Files\VB\VBVoicemeeterVAIOs\VBVoicemeeterVAIO_ControlPanel.exe VBVoicemeeterVAIO_Setup_x64.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbvoicemeetervaio64_win10.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_xp.cat ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_win7.cat ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmvaio_xp.sys ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBvmvaio_vista.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\VBDeviceCheck.exe ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\button_72x72.png ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbusbgpi_uart.inf ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio64_win10.cat ggg.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver64.dll ggg.exe File created C:\Program Files\VB\VBVoicemeeterVAIOs\vbvoicemeetervaio64_win10.inf VBVoicemeeterVAIO_Setup_x64.exe File created C:\Program Files (x86)\VB\Voicemeeter\vbaudio_vmauxvaio_vista.cat ggg.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log VBVoicemeeterVAIO_Setup_x64.exe - Executes dropped EXE 4 IoCs
pid Process 5604 VBVoicemeeterVAIO_Setup_x64.exe 2824 vbregsvr64.exe 6012 vbregsvr64.exe 6000 vbregsvr64.exe - Loads dropped DLL 6 IoCs
pid Process 4340 ggg.exe 4340 ggg.exe 4340 ggg.exe 2824 vbregsvr64.exe 6012 vbregsvr64.exe 6000 vbregsvr64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ggg.exe - Checks SCSI registry key(s) 3 TTPs 38 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service ggg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom VBVoicemeeterVAIO_Setup_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID VBVoicemeeterVAIO_Setup_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs VBVoicemeeterVAIO_Setup_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID VBVoicemeeterVAIO_Setup_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName ggg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ggg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities ggg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs VBVoicemeeterVAIO_Setup_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc ggg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs VBVoicemeeterVAIO_Setup_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation ggg.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32\ThreadingModel = "Apartment" vbregsvr64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D} vbregsvr64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772} vbregsvr64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32 ggg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772} ggg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\ = "Voicemeeter Virtual ASIO" vbregsvr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvmins_asiodriver64.dll" vbregsvr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32\ThreadingModel = "Apartment" ggg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\ = "Voicemeeter AUX Virtual ASIO" ggg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D} ggg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32\ThreadingModel = "Apartment" ggg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32 vbregsvr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvmaux_asiodriver.dll" ggg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvmins_asiodriver.dll" ggg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\ = "Voicemeeter AUX Virtual ASIO" vbregsvr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32\ThreadingModel = "Apartment" ggg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvmaux_asiodriver64.dll" vbregsvr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32\ThreadingModel = "Apartment" vbregsvr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\ = "Voicemeeter Insert Virtual ASIO" vbregsvr64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32 ggg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32 vbregsvr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvm_asiodriver.dll" ggg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\ = "Voicemeeter Insert Virtual ASIO" ggg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6} vbregsvr64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32 vbregsvr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\InprocServer32\ = "c:\\program files (x86)\\vb\\voicemeeter\\vbvm_asiodriver64.dll" vbregsvr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{368955AF-5482-4057-AB31-D094AF769772}\InprocServer32\ThreadingModel = "Apartment" vbregsvr64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6} ggg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9175CF07-885D-46B4-9EA1-4126D6648DE6}\ = "Voicemeeter Virtual ASIO" ggg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BAEC28F8-10AC-4BDB-AC16-8CE24BBF8E9D}\InprocServer32 ggg.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeLoadDriverPrivilege 5604 VBVoicemeeterVAIO_Setup_x64.exe Token: SeRestorePrivilege 5832 DrvInst.exe Token: SeBackupPrivilege 5832 DrvInst.exe Token: SeRestorePrivilege 5832 DrvInst.exe Token: SeBackupPrivilege 5832 DrvInst.exe Token: SeLoadDriverPrivilege 5832 DrvInst.exe Token: SeLoadDriverPrivilege 5832 DrvInst.exe Token: SeLoadDriverPrivilege 5832 DrvInst.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4340 wrote to memory of 5604 4340 ggg.exe 89 PID 4340 wrote to memory of 2824 4340 ggg.exe 95 PID 4340 wrote to memory of 6012 4340 ggg.exe 96 PID 4340 wrote to memory of 6000 4340 ggg.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\ggg.exe"C:\Users\Admin\AppData\Local\Temp\ggg.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Program Files (x86)\VB\Voicemeeter\VBVoicemeeterVAIO_Setup_x64.exe-h -i -H -n2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5604
-
-
C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe-fC:\Program Files (x86)\VB\Voicemeeter\vbvm_asiodriver64.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2824
-
-
C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe-fC:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver64.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6012
-
-
C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe-fC:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver64.dll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6000
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{18206bfd-ec4e-e540-8ee1-e3f4a54e877a}\vbvoicemeetervaio64_win10.inf" "9" "43914f2f7" "0000000000000118" "WinSta0\Default" "0000000000000138" "208" "c:\program files (x86)\vb\voicemeeter"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3144
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10\vbvoicemeetervaio64_win10.inf" "oem1.inf:c14ce8840c48fa1f:VBCableInst.NTamd64:3.4.1.7:vbvoicemeetervaio," "43914f2f7" "0000000000000118" "1ffb"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\VB\Voicemeeter\VBAN2MIDI.exe
- Size 320KB
- SHA256 baf390d96ba8f0100af74007a52481bd3825949faf4bcbc259fe47492994d87b
- MD5 0c2cf9740d7e27330a1105d7376364d1
- SHA1 52c15fcad864d5fab096ceb2d911796c40d5248c
- SHA512 74cbbb435c30b17d547ed18a24cce27e560c87ff31a39f6f2c94de070c492e3bb1fa2b86cb30133ad0af272b283658dd42b86f52850f524aa2133868e95a9a22
- SSDEEP 3072:M9wULPR3U2miEbeVmT8Ma4MMub23oma61MOpC/yo2sdvpaV7I8:M9wSPROeVmT1aLl61MtJpC7
- TLSH T17864D3716AE644ACC766B03370F76E339AE79A35112D86079FF0C9F15B113A3EA1434A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\VBVoicemeeterVAIO_ControlPanel.exe
- Size 911KB
- SHA256 082424386cb4afa8bf35fd54bd10ddff6a264b0d0540eef3bf7711e8ee93d61c
- MD5 d773d44dc98035a368b8fd7419387f6e
- SHA1 07a6b1b516b201cc234b433300cd7eb3c3ca157d
- SHA512 6575190b788eceddc72bef428ce19f1f6ed19522bbcfde8cde85f45782c922c51e85c3f6e30ab7658da123e5301ceda05935a09a76b67225402cb547f3c86fff
- SSDEEP 3072:qePIz7OyHc7S2fO8CU2DMzVcqYMUD4sQs2iBm1NRs/puUjw:+zqjfONU2DMzKqi43iBesu9
- TLSH T1DE15F6196252C369E867E4371477B961CCB8EC3B36A38C4E33443E5B0B32DB259617DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\VBVoicemeeterVAIO_Setup_x64.exe
- Size 900KB
- SHA256 28c6409a5ccebb1f83dc25660d800f95c22ca5eff05978f4e3bc780a50d37b61
- MD5 f2add656a75cd81abf4a8980634e92a1
- SHA1 e4d53b74d1a1abf41130c350490770226790e920
- SHA512 d9925bdd348a97609a7a167ee1931bf875e3152904c4f447d8c2000af450e26e4433cea4485eded9c38f70b24d2f6a93c21308a9d6546b25e4ddd064190025ee
- SSDEEP 12288:8mVqYhTZUI6HKhgS9APmGKRH3yMGhVBH22:lUYhTZ36HKhx9AP0RH3yMGHBH22
- TLSH T1B815F7E530623A03C9DC4536A518B7FDB8C41C44D625FA75AA3BB91C103A7D0B93A7FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\VMStreamerView.exe
- Size 116KB
- SHA256 5eee40deb81800710f80dd54daf47b6a1bb61909e9f06263bcca12add8224bbf
- MD5 164bcf844f025ddb50cb81f4640fc62e
- SHA1 0587fa84796d303dbf44296a2241dd27a68f13c0
- SHA512 f5ca31da8ca6ef7fd714b1443179ba4a72dfbd8d528ed01e8f18e1b4f8763fcd68963e1b878210aec6644a74e4b793b269463d13b152c5b914f6cfb2b1e1ebc4
- SSDEEP 1536:XC/337TLtaLKC7XYAFw6KJ6T/qiK4T8/dYgDXoVXgswt0I7AejHz:X237taR7IAFw3uJ4lYgDXoJwtRAejT
- TLSH T135C37D13F5D2C4F2E8824D71D4C6EE3E9A38FE6648598543E754FB0F6D31392922B24A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterBUSGEQ15.exe
- Size 526KB
- SHA256 54910065ce0530097d6c8cc1463fd208e4ced199868081528a3e4bc8f39d15b9
- MD5 428f5d6c1ad8a8cc1ccb07b7de7b5836
- SHA1 250252a7211ad9a4e5efc00f642197959751bdf6
- SHA512 6d86d8db5e948892b16a21ad89df0939aa1bf85eb50322d0d7728724948ce5cf51c01cf4618b4a1ddbd792b00adcf5969a14ed96ee66c366955cf841cc59dbcd
- SSDEEP 6144:JxMYwl1f5NZJaHUkkAOztiwCDKknYZZugBrBdbbb/uot65bbb3n6JPNNbbbb7bbL:TMRl1BNZIHUkk9VCDKknaZDZ/t6eF
- TLSH T10FB4F9C6690DEB3ED506EE384BAA0F320F740D14AD3754E696065E1C4FB4E23769F60A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterBUSMatrix8.exe
- Size 157KB
- SHA256 5e26c31db77526c7c76cd88117993772331883e6ab668601727ce10a7e418e8f
- MD5 8f90b3cf9ae14522043edba0fe02d034
- SHA1 d697d5b8c2130a5c99ab3ee043769a99c44410c5
- SHA512 c90b81fd1c6bd8c07eba3f36432c42fabf013272dda7a359b6cdef0f663541083b9f6758a55b1b62eae24d3cd8fc8ac38af43caf188b3838c98da204e117b51a
- SSDEEP 3072:HcrDZuIfdRchud4ujUpXQ1VAg0Fuw7sCssSiq9PCtFI3E:HykIFGW4ujUpXOAOqdiP+OE
- TLSH T17FF36B1572F2D433E4B205349CEDABE95D2878321B2A04FB37E42E6E4E703D12676766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\VoicemeeterMacroButtons.exe
- Size 2.1MB
- SHA256 82ec62688ec027b3e0cbe742235f9a892df3c3ab53c87857c22ca27470e0b271
- MD5 119f251cf9a108c746f80ccad8ca5090
- SHA1 56c59123f9df655ce319f47475ea2ebb5eae977e
- SHA512 363cb3e36bbd8fd4223f3df988a874b289d960f6496c73308f6582427eb11eacd33f0ae3bd082c450b0662082b974a1895234b0992f0abaf4b214b5eee867592
- SSDEEP 49152:shUkCg3xtF8IIDhTgluVKOTIsxcAypVBGxyJ7zMTTdwfp5Y0CxO60JGoSDt:sBCg3vFNIdtVZEsqAkVB9J7zMTTdopbk
- TLSH T12FA51225FD41D02EC0A21572AAAF3BF3A4399D71332619D33BC07DA8AAB45E13577706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\vbregsvr64.exe
- Size 47KB
- SHA256 f2b62bef11048c74a7d1b2cd8e217738b3a7d627de6d001b298f034116626e6b
- MD5 a8442fae07f1a7edca6fa2e0e94c2059
- SHA1 d30851d5e11d9e87bb99ab4ecfaec2099b7e1156
- SHA512 ca0de0d6e28864f84dd09ea38846eef0920a8cd63dcb950e9cffb9c0be057b0aa9cb59f209fe8181962c605924d2e77c837e2b3ed45fe700edd24a3cf66e5ac2
- SSDEEP 768:S/xgTstByxlt03ivc8agWzJtv7kdn7kDbXyuuGz5BNntbVP:0xgTF1/Wjv7k9kD5rZx
- TLSH T104235B4B27A500F5E1A74730C8F29969EA33FC5367B5421F53A442AA1FA37C06E38776
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\vbvm_asiodriver.dll
- Size 104KB
- SHA256 f29948019d4c4eb07b9a0ce5fef7cffb877617b1959fb5c90f52890be541eb64
- MD5 a892e96083fc604983440f94fd6cc591
- SHA1 68ea2da5591b9607074796ff5df8c0dd26ee311b
- SHA512 92a9d802cce5552dd076a99d0162ed2db555e815daac1aa71164fea90ce145908983486d67dc7512e2b5dae16de2e28b4aa96693b33a1c290b9666fe8abb35d9
- SSDEEP 1536:uaDrZKNTd1omHMEFB0Jou1iK21ct0IjMIrI:ua5KdNH0JoAiKnaIc
- TLSH T175A38D222591C7B2E557443329B7BA3BBA37EA512ADF4C83FB15C5051F213B0EA36207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\vbvm_asiodriver64.dll
- Size 122KB
- SHA256 f8d17fb939f6cf7f2a4ea42ad1925bd67ec51c88e43dbbf4c4296aa4499b80a0
- MD5 fc454e758b637695f756bff5efce6117
- SHA1 33ee4d6bf58ad222b46366792e343563b7385f1d
- SHA512 6104e0648a6a6c0cbf6abbe7043a8124c201a54505d8cac62493403d7cc5c59cd59d8d423bcdf0acfd48ef68dd818a662ab0eabb0f2e0ff88cebfa45b0f3ebd0
- SSDEEP 3072:7YyMiDaT4z5X6hHZt5k8yOrjrBeWf3SiqzlIM:DTeT4NX6hH7O8zTB3KJ
- TLSH T152C35B8732A482B7E557427ACEF36A05D772F486137A4B8F6264425A1F233F17E39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver.dll
- Size 104KB
- SHA256 075f0bb1449beb617ae489de09577ab30d1c7414f6541e26b975071995beb7dc
- MD5 dd808d08690337397d0a789b4ea635b6
- SHA1 23ffb973f6471b8fa4111dc2271826f4c96d1df9
- SHA512 2a92be83080ac64b89a83f38336f2e2dad9e5dd8fd71ddfc22287aef8712986b715975747ba4d8b8fc43de5cc8b018e29345c05aef36540c9ad5d6e25909dc00
- SSDEEP 1536:u0jLOYT9CohHMZDI17oCCwr0JoR1iLT1cG0I5Irc:u0WrnG0JojiLlPI4
- TLSH T11CA39F222691C7B2E557443369F7BA37B63BED112ADF4C83FB15C6051F213B1AA36206
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\vbvmaux_asiodriver64.dll
- Size 122KB
- SHA256 33fa84911f9ade10ba9c796f99afa3948ef0a6011e2e707289a50629af231ea8
- MD5 ebb4e1068c19da9f75b30979d72b9fc9
- SHA1 86788c9d610b1a68e76949fc7570f71d369a2606
- SHA512 bb110169a79e924b7c630604a4fd733cb6a907d66b1e79ad45dd3ac68fd968422c93911b00ac3a6b03446195803ac600aaf85e9dbf6c15e1ef92e4e612e3e1b4
- SSDEEP 3072:i55h0tO1VT0eZ7bXhmJtJP0ywFrjEB3gEirqfI2:m6OrT0O7bXhmrx03MBQat
- TLSH T198C36D4732A482B7D557427ACEF36A05E772F486537B4B8F6224425A1F233F16E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver.dll
- Size 104KB
- SHA256 04bf4055bee6e494fbe6a5a70dc6171ab7888f06f5c9a500f28f493273a9053e
- MD5 e84fef568e6bb6f1d5a19cf6d0ece326
- SHA1 893a67b6132b3160c9b35d4efa55d5afb2b3db7b
- SHA512 5b0f221c4eaae9b18483d6ccfabbaad01e12b6cf9b51d233402cb2fd586dc2bfb6733c9d40409a50330546e98e415ba4720cb284fdd0923c6a82ef08d5b9f0f2
- SSDEEP 1536:ue+r9/5a3TW6om7Haf9Mw4UJo41K5zPEjKrulH0Iw9Irwp:uH6f3GaxUJoOK57V0C9I0p
- TLSH T10CA3BF3369D146B3E5864531B4D74A3BFA79FE120ADA48C3DB16D6161F213A0FA36307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\vbvmins_asiodriver64.dll
- Size 122KB
- SHA256 d19d5e0fddd96f846c8bb1e606d180440fcc26eed1c4b5ca464d73da8e980c0e
- MD5 19387222bd35f74adab6c1716f1033df
- SHA1 1d49066d297ab67a105a6c67e12a171c041d2ca7
- SHA512 38ddef4885a211ce131134616b518ac7ebf39c30ce9eecd65e281240193b7f6f140b5aa634d8d600fd655f28c3a455c69f7d918b42f9e9772cb6da6cccc79740
- SSDEEP 3072:PcGu4/SCTqLC0n8bICNpxYy3rj4BfUzKZYBI2:JTxTqu0n8sazY6QB8L
- TLSH T1E0C37D8732A401B7D5679278C9E35A46E7B2B842037583CF5264479A2F237D1BF3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\vbvoicemeetervaio64_win10.inf
- Size 36KB
- SHA256 ec0c3295284b35e977e6ccd1e964a98d50ef7c3c1f0ade722993ebfa613ecf6d
- MD5 1156383213a6a152c29a24d991ccf663
- SHA1 3c2f66cb67a1f046dac05a57a548f911e809d8ff
- SHA512 98dd48bd503b1a7e916ebe46b3c84f316176db5780ef84a4dda4dd57333e2486cfd62bc30c6ead8c049cea3254e39cc4c2753826e73f1d0d51f469ca26700a56
- SSDEEP 768:bXOIzXOIz4IUU4o89xMeYmc+Qu4IUU4o89xMeYmc+QBtELemJ9oIjfaCtxEE2beH:bXOIzXOIz4IUU4o89xMeYmc+Qu4IUU4b
- TLSH T10CF2CBD84BDFBC48C381E084CAA30FE0C9532AD6A4F717197B6AE14395D6797C365A70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\voicemeeter.exe
- Size 5.5MB
- SHA256 461b17e27e43bc9e1ccb0c1e20c2852bb5b3f774c87959e600bfe3eddad02ce2
- MD5 7196d594a870692aa5ad2d4fe79e4fd6
- SHA1 eaee2c717193394456b5f896bcd08abc2e16b1b6
- SHA512 ecc41e8de1af5abb960b94ffcf07b292d3c82e208b8b141b331ea688190283653bd1c7bcaf318ff620f1c9b3c4efce2a79ca1a588a2fd3c5ecd7590637bee145
- SSDEEP 98304:s7kNLMimuYvkJLnO5s3UDE6YCQNpbarp9PTm56ZffTJw5ZqtEtO1jB9uAgt4L7ez:sANLMbkJLnGLsnWPTmKf1wGtDpBEAgg0
- TLSH T14B461220FC82E126C4F744F1416E2E915C78BF34A36365FB36547A9CA9798E31063B9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\voicemeeter_x64.exe
- Size 5.4MB
- SHA256 284a9366bde173f81499354f02230088326848f09a9069b6f78a42da0c900e61
- MD5 e7df287056b67cdbad7b0cd8e456bce0
- SHA1 f624525e9479750824048572e3bf469387329cb8
- SHA512 e5ee7365441b997985398647319706c4396c8861af0f769fbff680958bf5d320f3564aa6347c29e3f34aeb71462a7919c73887aadc2ce0e943c62ef6b610eaa0
- SSDEEP 98304:heFqZy6JouRigFiwqo6tvuJg7c80lMJw5ZqtEtO1jB9uAgt4L7euN2dPY:owlB7qo6tvc8I2wGtDpBEAggn
- TLSH T17A46128B959C50FDD02BA074C369B167E3B0B8418F516ABB16E0BD550F229F186FEB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\voicemeeterpro.exe
- Size 7.0MB
- SHA256 f1b7eaf3a6372aeb8a78e795ca7ad1f61f4023188f10844849309cddb83df8c7
- MD5 7a7716ac35794498e031803b85a7840e
- SHA1 b2e6ad1f21712880bf697944ee37b36c56713835
- SHA512 99088361fd2f5e5841a71e080d5bb4e67bb4bc1eae8c9211bc57d116da314bf23dc0681cc0e1808bd2bf8e5956f02b0a40428760729c4a840d49c461430463a2
- SSDEEP 98304:IXZdSJu4Ojnp2XFc4qdWz7TBHKVOD1yFtx1P2sX+eoTAUNieLMvI3wLPP38wZdNk:IpdCOjnpK7TQV00Ff1P2sXHUKINcdNBS
- TLSH T10C761213FA80D02AC4F36031416A2EA1053B9F75A3375DF737A86D64A9789E16073F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\VB\Voicemeeter\voicemeeterpro_x64.exe
- Size 6.9MB
- SHA256 f384446b3c4d56d77f8a690d299bb08169a877a522bde047c8dffd9bb7df8961
- MD5 b228e6e208751a8bc978774ec70208e9
- SHA1 0f2d0deab0e1f28d46949cffe1e337750a55472e
- SHA512 8ef3eb74c838486b7de7673e22e8fdca25cb617f5ed8bb9e5876b0097240cbd07e4961254787e763f46a9ed27dce7d47f21c3ced28a53887bbfb690375c7ddd3
- SSDEEP 98304:hiKEwyYLfOE97hmm17cD92UujLja5sB8a0zzPElMoTAUNieLMvI3wLPP38wZdNKS:h4qOy7cZ2v+W8ai0mUKINcdNBJ
- TLSH T11C761297A1DC50E9D02BA07486A67177E3A078408F246AFB26E0AD550F339F546FEF13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\vbvoicemeetervaio64_win10.inf_amd64_88e966008b21fe10.ini
- Size 490B
- SHA256 08b1dd073c52d403c450cfb3d61961afafda337147ae0e3825895f4da37fc5cb
- MD5 dc5e3ef05e65f97eb675869fceed33e3
- SHA1 b8c1ab522294c42dcb90dc94abaf493eb1f0b606
- SHA512 8406cd674d8efd94340fa83b99803e10e7707b092e26a6d2e1e0a80cb856e3a6b8a54b3acfe8b3d46aaa2d533aec856602dd9d01714d02388149f1719b256fed
- TLSH T106F027194227B2CC9885A4D2D90496B4C08DB1EF0422F5C573C2902227BFFCB8DABA60
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\PROGRA~2\vb\VOICEM~1\VBVOIC~1.SYS
- Size 289KB
- SHA256 12ee8d2bc7309b519e967d48894028b2a4bf44857aeb3fd18236ba24d6463baa
- MD5 9127efb0a17dd9a0ed1dd722b83fff64
- SHA1 c6c19a223d5df63a584e9f7bc7dc48d744cca0bd
- SHA512 5c8d989139a1bc496fa7647fbe08404c2a207d893607a41094e65ba80a1bf6b0c9ff2293e400c19ead6e2adfc8fdfe3cbec9b247d4dcb1d1cab40c4889640750
- SSDEEP 1536:u3XlWe1lEfEDr+t3qrVgDkNPmVSeCOovakbDhyWfYANXxl0fBkfwrfiOfFaovy/n:X2r+t3q97aojHhysmI+hkoviyQ
- TLSH T167545F2ABE6DD0D0C41B20F4C87B8BA55A63ECC24A934E9712553B5E1D333BE2D27497
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\vb\voicemeeter\vbvoicemeetervaio64_win10.cat
- Size 12KB
- SHA256 964b04a45b8fbb62b97d012608453265d6d2305378a2abc8f95e5d23c93f30be
- MD5 77f1688d4b28f657b08e77160418fdb5
- SHA1 6f769f0034af7012d75bb14b6a4f2b7d2caf00dd
- SHA512 bd64ef99b49a0f1045c19ce5a2b848d19827827827b5a9a62a4231f6dbd243e8d73e6121b9758aa79a6fd90edf91dc787e51b3f4e792ade73c395350b1b11244
- SSDEEP 192:iejEQkETJCfPXWEwGJhYCQ2UHWX01k9z3A3BeAeY:igKP3h3FjR9zqBeu
- TLSH T18D4219A5459841C2F993AC6043F8E55B7C7E33CB680059AA16AFF71D5C633C8F72826E
- MD5 SHA1 SHA512 SSDEEP TLSH