Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
vac4.65/setup64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
vac4.65/setup64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target vac4.65/setup64.exe
- Size 136KB
- Sample260721-vb6ebser31
- SHA256 d9ff7eb0f7536c199e9e6bccd5da2b7dd52e4894b03d22257518faf224b174b1
- MD5 c5f79a0e4c19a6beffc73da5285ed712
- SHA1 0e41f62ce7b5dec2f46b57f6d6e0a06e663b8012
- SHA512 c545198c04d7ca8501cdf46fb159374ba420908d2fdbab4c112e0afcd29b831e4065d888431d02b031631b8d0c5b105a38f6fb937d6996a7eef14855627b31bf
- SSDEEP 3072:r1JUYrr64PE7PEwkNBgHMcnL8zsHMOY4jb0r0Q:SAwkNSpL2sU4jxQ
- TLSH T19BD34F8077F80668F6B6AF75ADB401269A727C959F34C2CF1225C94E2D62BC4D874B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe File created C:\Windows\System32\Drivers\vrtaucbl.sys setup64.exe File opened for modification C:\Windows\System32\drivers\SET8851.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET8851.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\vrtaucbl.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe - Drops file in System32 directory 18 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\x64\SET861E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\x64\vrtaucbl.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\SET862F.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\SET8630.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87\vrtaucbl.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\vrtaucbl.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87\x64\vrtaucbl.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\x64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\SET862F.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\vrtaucbl.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\SET8630.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87\vrtaucbl.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87\vrtaucbl.PNF setup64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d1bb9f3b-5db3-4348-b094-e63d8fbb11a9}\x64\SET861E.tmp DrvInst.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\Virtual Audio Cable\setup64.exe setup64.exe File opened for modification C:\Program Files\Virtual Audio Cable\uninst.ini setup64.exe File created C:\Program Files\Virtual Audio Cable\install.log setup64.exe File created C:\Program Files\Virtual Audio Cable\vac.chm setup64.exe File created C:\Program Files\Virtual Audio Cable\readme.txt setup64.exe File created C:\Program Files\Virtual Audio Cable\homepage.url setup64.exe File created C:\Program Files\Virtual Audio Cable\setvars.cmd setup64.exe File created C:\Program Files\Virtual Audio Cable\audiorepeater.exe setup64.exe File created C:\Program Files\Virtual Audio Cable\uninst.ini setup64.exe File created C:\Program Files\Virtual Audio Cable\license.txt setup64.exe File created C:\Program Files\Virtual Audio Cable\delsettings.cmd setup64.exe File created C:\Program Files\Virtual Audio Cable\delservice.cmd setup64.exe File created C:\Program Files\Virtual Audio Cable\vcctlpan.exe setup64.exe File created C:\Program Files\Virtual Audio Cable\audiorepeater_ks.exe setup64.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log setup64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 32 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 setup64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 setup64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs setup64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID setup64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5804 rundll32.exe - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeLoadDriverPrivilege 2604 setup64.exe Token: SeShutdownPrivilege 2604 setup64.exe Token: SeLoadDriverPrivilege 2604 setup64.exe Token: SeRestorePrivilege 5540 DrvInst.exe Token: SeBackupPrivilege 5540 DrvInst.exe Token: SeRestorePrivilege 5540 DrvInst.exe Token: SeBackupPrivilege 5540 DrvInst.exe Token: SeRestorePrivilege 5540 DrvInst.exe Token: SeBackupPrivilege 5540 DrvInst.exe Token: SeLoadDriverPrivilege 5540 DrvInst.exe Token: SeLoadDriverPrivilege 5540 DrvInst.exe Token: SeLoadDriverPrivilege 5540 DrvInst.exe Token: SeLoadDriverPrivilege 2604 setup64.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2604 wrote to memory of 1512 2604 setup64.exe 95 PID 1512 wrote to memory of 5804 1512 control.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\vac4.65\setup64.exe"C:\Users\Admin\AppData\Local\Temp\vac4.65\setup64.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" mmsys.cpl2⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5804
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c1d3773b-f96c-c94a-bb86-e30c75bf6e42}\vrtaucbl.inf" "9" "4646d1453" "0000000000000190" "WinSta0\Default" "0000000000000164" "208" "c:\users\admin\appdata\local\temp\vac4.65"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4316
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "11" "ROOT\{83ED7F0E-2028-4956-B0B4-39C76FDAEF1D}\0000" "C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87\vrtaucbl.inf" "oem1.inf:a52522ad0c48fa1f:DevInst:4.65.0.11535:virtualaudiocable_83ed7f0e-2028-4956-b0b4-39c76fdaef1d," "4646d1453" "0000000000000190" "324b"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Virtual Audio Cable\setup64.exe
- Size 136KB
- SHA256 d9ff7eb0f7536c199e9e6bccd5da2b7dd52e4894b03d22257518faf224b174b1
- MD5 c5f79a0e4c19a6beffc73da5285ed712
- SHA1 0e41f62ce7b5dec2f46b57f6d6e0a06e663b8012
- SHA512 c545198c04d7ca8501cdf46fb159374ba420908d2fdbab4c112e0afcd29b831e4065d888431d02b031631b8d0c5b105a38f6fb937d6996a7eef14855627b31bf
- SSDEEP 3072:r1JUYrr64PE7PEwkNBgHMcnL8zsHMOY4jb0r0Q:SAwkNSpL2sU4jxQ
- TLSH T19BD34F8077F80668F6B6AF75ADB401269A727C959F34C2CF1225C94E2D62BC4D874B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Virtual Audio Cable\uninst.ini
- Size 4KB
- SHA256 85ee480862249d983941c46dd9daa69bbb10ac1147af61fce05150d8823fdabd
- MD5 2446f070374e5a63d5109233c81c3e68
- SHA1 7b935eafd81425e45f83572bb93117ccda4905c1
- SHA512 82c55d60013fd23664a43a3dc61a76e7102314b8fc87eff1a44d392b134e3c8135472bb8cc7069dad1c473f8443c56db8ae0a6642a7c691064a69b08fb2c9945
- SSDEEP 96:NtcU5+i01M1E1M1T1X1vw101c9p1N1lm1l9V1R1hMsCjMsCj/sCjExsCj9FsCjbU:NtMr6yKRFFwiKrPGdVjYM/W9Fbk0JWHn
- TLSH T1E491287297F94214F3F79ED6BE7199290F77F972AE34E96E8088158C0CB2620C521793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\vrtaucbl.inf_amd64_7dc9aa85a9f9ca87.ini
- Size 425B
- SHA256 82b53b47aa2b3268df4aac24fc3873faa3437dd76f97327fa248fe9341f28088
- MD5 2c97bea70ce5e79f4bb5928e20f3644f
- SHA1 de637ba8519cf035ee5ab5decd55e59982e2251f
- SHA512 bb28ed292ea4f9a967740ee857edc014655d1d9ba6a234fed6828943dff1074f1c3ecd0865676b2b55919603f3d91071be05266bf90fcf704a761d9db98e790c
- TLSH T1CCE0A79B56770C4B4844458387550472EB4AB80E449271C5FA889480BF04D47E9FE782
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\drivers\vrtaucbl.sys
- Size 219KB
- SHA256 d3b8219f346289cbe0bc09a7705e68c362e7523b4cc49f2e77ee91d3a5d10c7f
- MD5 1f497b2948eefa06c1838e0ff2f490a1
- SHA1 5b0e55ba72d8746ede0b1c99ed60db67d1f5a46d
- SHA512 7723ddb85bdcd870ed4ff17c62ce5bd5187c6ff559927da35aee50f273ee14c03dfe898e402950bad86436fd27731d900c2438e0961b2860be45c60f2cc98d83
- SSDEEP 3072:Wdck3CoSFZvrwpQK5+P23f20+VQOWrmAusmGe8WBX2tH3ya/S7F0u0l:7kyoVe24SHtkp8W29u0l
- TLSH T19F241A4572B90CA5F5F6B678CAA14A06FA71F480173993CF3310A7791E2FBD4AA35320
- MD5 SHA1 SHA512 SSDEEP TLSH