f0bc5ea7846f15217d3a3b18b7ae5d21de7396d5cd32cef179142e57639f582e

Analysis

max time kernel
119s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoiceEdgeSetup.exe
Size 80.1MB
Sample260810-2va6vs1amb
SHA256 f0bc5ea7846f15217d3a3b18b7ae5d21de7396d5cd32cef179142e57639f582e
MD5 16cbd2972a32d440bb66ed56d3216306
SHA1 bf15a776759419b550795bf7c12f916297399711
SHA512 45d1752464b66d87041bb69e1cdd6ea457ae5d71d6ab45690817d2423e579fae73b6fc193ab04a40284abfe3ae3ce4686fe4299b17fdd3f936715950811ae9d3
SSDEEP 1572864:EQ8WsHMeqsGgKAzalQrQUm9l4mKdsVqbpD6X7Y2pbSLSF9aYAIWrt:EQ8W+rqJg58UIl4TCVqURDaYDEt
TLSH
T1A80833D309E2E902F55D41B759C3E8BB3CD26D920A4465C9E4833FD97A32F8D038A976
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	VoiceEdge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	VoiceEdge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	VoiceEdge.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	VoiceEdge.exe

Executes dropped EXE 10 IoCs

pid	Process
212	VoiceEdge.exe
1188	VoiceEdge.exe
1236	VoiceEdge.exe
888	VoiceEdge.exe
4348	VoiceEdge.exe
3988	VoiceEdge.exe
4372	VoiceEdge.exe
4724	VoiceEdge.exe
2332	VoiceEdge.exe
1340	VoiceEdge.exe

Loads dropped DLL 23 IoCs

pid	Process
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
1188	VoiceEdge.exe
1236	VoiceEdge.exe
1188	VoiceEdge.exe
1188	VoiceEdge.exe
1188	VoiceEdge.exe
888	VoiceEdge.exe
4348	VoiceEdge.exe
3988	VoiceEdge.exe
4372	VoiceEdge.exe
4724	VoiceEdge.exe
2332	VoiceEdge.exe
1340	VoiceEdge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoiceEdgeSetup.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	VoiceEdge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\VoiceEdge\shell\open\command	VoiceEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\VoiceEdge\shell	VoiceEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\VoiceEdge\shell\open	VoiceEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\VoiceEdge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\VoiceEdge\\VoiceEdge.exe\" \"%1\""	VoiceEdge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{C1950A7C-7A06-4628-B1EA-90E690A3DB52}	VoiceEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\VoiceEdge	VoiceEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\VoiceEdge\URL Protocol	VoiceEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\VoiceEdge\ = "URL:VoiceEdge"	VoiceEdge.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
1388	VoiceEdgeSetup.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
1236	VoiceEdge.exe
1236	VoiceEdge.exe
888	VoiceEdge.exe
888	VoiceEdge.exe
4348	VoiceEdge.exe
4348	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
2332	VoiceEdge.exe
2332	VoiceEdge.exe
1340	VoiceEdge.exe
1340	VoiceEdge.exe
3988	VoiceEdge.exe
3988	VoiceEdge.exe
4372	VoiceEdge.exe
4372	VoiceEdge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1388	VoiceEdgeSetup.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe
212	VoiceEdge.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 1188	212	VoiceEdge.exe	87
PID 212 wrote to memory of 1188	212	VoiceEdge.exe	87
PID 212 wrote to memory of 1236	212	VoiceEdge.exe	88
PID 212 wrote to memory of 888	212	VoiceEdge.exe	90
PID 212 wrote to memory of 4348	212	VoiceEdge.exe	91
PID 212 wrote to memory of 3988	212	VoiceEdge.exe	92
PID 212 wrote to memory of 4372	212	VoiceEdge.exe	93
PID 212 wrote to memory of 4724	212	VoiceEdge.exe	95
PID 212 wrote to memory of 2332	212	VoiceEdge.exe	96
PID 212 wrote to memory of 1340	212	VoiceEdge.exe	97

C:\Users\Admin\AppData\Local\Temp\VoiceEdgeSetup.exe
"C:\Users\Admin\AppData\Local\Temp\VoiceEdgeSetup.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
"C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe" --type=gpu-process --field-trial-handle=1664,17010693141651099976,664747628051085130,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1672 --ignored=" --type=renderer " /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1188
- C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe" --type=utility --field-trial-handle=1664,17010693141651099976,664747628051085130,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2204 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe" --type=renderer --field-trial-handle=1664,17010693141651099976,664747628051085130,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\VoiceEdge\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:888
- C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe" --type=renderer --field-trial-handle=1664,17010693141651099976,664747628051085130,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\VoiceEdge\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe" --type=renderer --field-trial-handle=1664,17010693141651099976,664747628051085130,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\VoiceEdge\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2596 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3988
- C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe" --type=renderer --field-trial-handle=1664,17010693141651099976,664747628051085130,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Programs\VoiceEdge\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
  C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe --no-rate-limit --no-upload-gzip --type=crash-handler "--crashes-directory=C:\Users\Admin\AppData\Local\Temp\VoiceEdge Crashes" "--database=C:\Users\Admin\AppData\Local\Temp\VoiceEdge Crashes" "--metrics-dir=C:\Users\Admin\AppData\Local\Temp\VoiceEdge Crashes" --url=https://submit.backtrace.io/ruby/daba0fe582d138ca1d2f693624d08e87ba12210b0878440de9e9bf7b508022a4/minidump --initial-client-data=0xd50,0xd54,0xd58,0xd1c,0xd5c,0x7ff635461298,0x7ff6354612a8,0x7ff6354612b8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4724
- C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe" --type=utility --field-trial-handle=1664,17010693141651099976,664747628051085130,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Programs\VoiceEdge\VoiceEdge.exe" --type=utility --field-trial-handle=1664,17010693141651099976,664747628051085130,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --no-sandbox --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1340

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x4dc
1⤵
PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\D3DCompiler_47.dll
Size 4.3MB
SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
MD5 fea40e5b591127ae3b065389d058a445
SHA1 621fa52fb488271c25c10c646d67e7ce5f42d4f8
SHA512 d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
SSDEEP 49152:cwBNwAqRvTvbehyCZ5xRmhErU6jFyU+dQZTHchy0eQago4I+oiP85+hA6+Se4QQU:SUZ5P7FwcAgLbz+3s0Bm
TLSH
T181267D5676A810E9C17BC178CA474317EBB1B81403349BEF1590C669EF73BE26E3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\chrome_100_percent.pak
Size 175KB
SHA256 65cb11d090b32e0fb3c740a736c13c0a47cb1bcb265c084e3de5bb7474fb662f
MD5 3ff806f44723cee528a1aaee4d3a289e
SHA1 56830e7ff31f803077aed774fafebd4e6c5e6c90
SHA512 03dafb839308d644a9943ba66838536fbd1f606cafe392f90925ce51766b5e3a9064d60ca8463bacf7238258beded570d5a0007f3ce11c14f87b10faa2da2977
SSDEEP 3072:ISzwVnp8YdJtroNdX2w5+vfdYCJdx10khejSTS9SO0vVm7O0U27IIABNHlJsgfI:ISzwVSTNhx5c1YC7x10fSucY7OP2ITQ
TLSH
T1EC04D0E3B3F0AC7EE65B0A3375550B77E93B413506A30309C28689752D5AB80D9DD78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\chrome_200_percent.pak
Size 312KB
SHA256 cd584f20aeed80fe5852d5d5656a12d25d9116d6b805ddbec3874d310925df2a
MD5 bd66e8de6979dfe12cbaa29390d11a64
SHA1 967916eb7587f0163fbce50c7b4822d06e939d5a
SHA512 f77bd5004d8da54e8588ffcf6962b3244b8e4a9f6310d31f0c7c44d913504577c9e3fb858078705c384649fbcf26223d8f98dd02778e259a8924028f2be3bc1c
SSDEEP 6144:8DQYaR+9bITNNz73QYV85u/oFYvwoytKi6obByPGlPFYKKo+:RfIITDg5u/oFFpxLlFYb
TLSH
T1C064F1E6F3F4AC3CE9971E3351560AA3DD7711350AB7434AC28AAC343D56B9489C938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\ffmpeg.dll
Size 2.2MB
SHA256 986eb7b4bd5c94328619164e06c099a9b1df9b3a87d2130b9c15ccb87d4c7e69
MD5 cd984b487da3cee8c0a70d5b9a3b87e9
SHA1 f622e69cf4cae7e6914e2b3b8877b339892dd088
SHA512 e942ae27d7e193fed09265af7e132ed2dff3b92639d8479e892a7c27ba861cb075184dcf88f26d2db18684bdca7630106bb969c29af983eb24d1fc40cad1f4ff
SSDEEP 49152:xspMRI28259LtbjsjdbVmofrZq/zPhmFyuPAfL1s2OwGNbHRtL:x4b2aux6LNbHD
TLSH
T1ABB5AF07F5FA00E9C02AC27487ABA633FA367C4A4521772F1690A6253F7BF905B5E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\icudtl.dat
Size 10.0MB
SHA256 594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
MD5 3f019441588332ac8b79a3a3901a5449
SHA1 c8930e95b78deef5b7730102acd39f03965d479a
SHA512 ee083ae5e93e70d5bbebe36ec482aa75c47d908df487a43db2b55ddd6b55c291606649175cf7907d6ab64fc81ead7275ec56e3193b631f8f78b10d2c775fd1a9
SSDEEP 196608:gmXwSv9AAQMlptodliXUxR0rHf93WhlA6tnoB:gjKlQMlpgliXUxR0rHf93WhlA6tnoB
TLSH
T167B62846B2EB4EC2F9FBAE70D9F463675426BC016E31815946042F3B1C777E08761BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\locales\en-US.pak
Size 75KB
SHA256 3333cf1fb2b0c15ea819787ba672d2274f3136e6a8729f2e5d2796b740688183
MD5 a2201115723fd61d1e68ab001e6cdca0
SHA1 a97073e22adf7b300e702e717743cd249e64b4fb
SHA512 e68c451602a0c2cd47ee3652daf1d74d87e6e61ebda9166cbb182301f03118b72288968695f85a1bcdefb45e4753ba7187dd5159b6694952f33238af39d89479
SSDEEP 1536:2GBj+Xuwnu0fzEphzDiQ2trhu5uBlgfSOqJedMprkhxv+fDgglgqfowv:2yqXJtzEphSBBlgm+xKgglgFwv
TLSH
T1E2734D5BE3C42235059303627A0377A6AB25E0A967521197BC9CC16C33B7FE4C2776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\resources.pak
Size 8.9MB
SHA256 b798f1f381d481dccc9b4c54386bbdf303d63cc11a63a639c336d57702650c99
MD5 f59287d8e5f51c4084ab4143f9feb9af
SHA1 470f6283db117c3751d7a5c5dc411cb88b5a1599
SHA512 2f96e2ec7697c05d36e57f2061531426d682b7f90f014839455341d8ca77ba23028d716664c4ed18c5e1dcca294cd72c884fef40c01e6a4ac55f10ccef9f3939
SSDEEP 98304:bOdRYaPrQXSElgA1hMoJm7bgGMy6NFfwbPPs:bOdRYaPrQnWahMWmbl6N0Pk
TLSH
T1E5967D573255103A82DA86FB64BA0603BF376046B41090BCF9ACDDCD5BEED439276B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\swiftshader\libegl.dll
Size 392KB
SHA256 2db0def105d9a68123a5685461c0aca947cffa17c6b04d4a5bc2fd6e12fbb64a
MD5 5fbdce7cdf5e2d3f16e2b2ad49e177c9
SHA1 f96a817f8b137792151bede9a592b5ae4b0243d8
SHA512 b62d0cb6856c769e8ce265df9359f6616879528a20d1d3211cf16a1e3914580925a75f3982349436bc8a0e3a65a34235c6f9410879cda6a98662ab31a3074d80
SSDEEP 6144:Z3lNvD9dUn+x5WiqCff0vDixSx9+6ipIJqH48rrAKaWL0W:Z3lNvxdUn9iqCfsFcIJqUKar
TLSH
T13C847D16F7A048B9D067C034C9238A42DA71BCDE0F65E29F2395425E2F77BE49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\swiftshader\libglesv2.dll
Size 3.6MB
SHA256 a33d4dd95f38df36f3e354dfd9a7afcb953df3b48be043d967f0dd7780d70985
MD5 7f20edd230038aa67be6bb4369c89113
SHA1 e03c5cf9fcecb04ddeff2e610f300c40d583525e
SHA512 bad87b013a7a16955f20d7db2854fcdcfad12ffea1f41f1e6e48a92706d37bb43e892281925f222d77e3e2a22d13c4a15763d9342a7d58d7b1ef969aab7d5a19
SSDEEP 49152:7E8gY3DuOpn+em8kINB/2xPkhDZ0SmDxcJtaRL96Om9MQ0xehKyRGZP+mt1G3eWE:L7GkhDpoWJtaPm9MQ3cA3
TLSH
T11706E803D66F90EFE056EA35971BB332D1B578C574387976676239112BE27202B3B388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\Programs\VoiceEdge\v8_context_snapshot.bin
Size 607KB
SHA256 d04cc259e1aab91fbc4c2ce0598f90b678bef17b6583b12701a8f8c4193b42e0
MD5 e16ec0664cbd95ec68939cbdcda09be5
SHA1 05c96ad27c0378fbe09f71002b79f89fe55afc31
SHA512 7168c72f9b7ce1eb6ea23bb67c91b4fb615d5c14a13b5534b9ef8e7315065e5eb4f9e733d9d2f5dcfac77787cbe3397d6d70ee4eb35447a6b865cd02d4dd45e0
SSDEEP 6144:YdBNIyNEDV3VySacNOOU/coSWoiC5/8N2vEtncL+S+3:YdBuLDV3c9c75m2oHS+3
TLSH
T1E9D4A454B761EF8BF336817A56C15BA036A4E0441F01BB5B53684FBD3C2FA210D29BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\VoiceEdge Crashes\settings.dat
Size 40B
SHA256 8cde3e3a8c67c5258552c1a2803d79937e08ca4e8825273ecdaa467915a2b392
MD5 e984a4662e71a6b248dfe6131f39ea1a
SHA1 fbba40d393b165668cd1369e554bce37cdb3e490
SHA512 1dd517af9f380f2a704552487898a913115935c0ddbe0df47ba4486fbc618233c76864867ea88f0b912ab01cdacf01c67ab1bee6b6097bae6c891ac3f8f4f4ca
MD5 SHA1 SHA512

Submit Download

a0662ad2-5edd-42af-a5f8-976d0f308f00.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\a0662ad2-5edd-42af-a5f8-976d0f308f00.tmp.node
Size 143KB
SHA256 6b27e801060b63c9707915fc8139ffe0ef5482b6625b82e86e1dfe0ef292bf69
MD5 06247f8e925402c90242af08a194efbf
SHA1 70b43ef957b96f69547464e10eb0f78c480c03e6
SHA512 2a69f271dc494a195e7e46208bf3ebe1aa7092e453307efce95e3893391a0b12d9ae472bb259e83a2c843c577f82fbc2cf5dea3474ba993fc5b1eb609ab4df4b
SSDEEP 3072:RGVFKrH9x7wkhMc6aJjfXHWP1Z4ir/BM69QXkdyGybhF72mPrb:YVib7jhrJNfX2P1aOAg+r
TLSH
T130E34B5BB2A501BBE477C179C9A35A01E372B41407319BAF03A0427A1F677E1ED3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpiderBanner.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa2D55.tmp\SpiderBanner.dll
Size 9KB
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
SSDEEP 192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
TLSH
T1FF12D6861F9044F7E510607CA896B7EF93177B2AA382ADCBCE73849429115E32F79347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa2D55.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa2D55.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinShell.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa2D55.tmp\WinShell.dll
Size 3KB
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
TLSH
T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
MD5 SHA1 SHA512 TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa2D55.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa2D55.tmp\nsis7z.dll
Size 424KB
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
TLSH
T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\Cache\f_000001
Size 436KB
SHA256 1ed02f55bb7a2689704b7995f0f7953fbcf9bfc7ce7f7f178168fe58f3481575
MD5 0af2c2ded404eafedc91003914dc1650
SHA1 1ffddb9c1958a872401e906928934a34529b7433
SHA512 60294b1ec4bd71c328f0aebd2ddffc6d1acb24be783d939b35ec059053f407b8c2d1cb8b082d3479ac1a12b87aa62e0055695a43b205e0be2aa7da210ba41526
SSDEEP 12288:mxd7nsUgAURmF6BLIQqDntC97ykkWHWgTT:Kdb2IVCJxWu
TLSH
T1FB94A5CAD369DAE3D005C63C342616412A3EAD9ABF0AD1F40CD4763737597F88D2E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State~RFe5967a9.TMP

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\Network Persistent State~RFe5967a9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe587e82.TMP

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\Preferences~RFe587e82.TMP
Size 132B
SHA256 2d7ef9c876f3d7295f6bc3aade9125955d0313b0fd63b6d21f80c19cc2a98ef0
MD5 5b74dac54099392460139f2c6f236bc8
SHA1 d69408b30a70a64c9389ac92f13a7d7da8994bf5
SHA512 0112001a3c4fc82a64bc38040bf5d89c81585f1e42eb3c444597c4c0af4d7e213997f7d7fad82b7cad8d5ca2a197a3bb5076296f16ccccbec7ef308c52244f72
TLSH
T178C02B8191002875092F8C0E808548679DE409604C0F4E6181D03800082704C0C8704B
MD5 SHA1 SHA512 TLSH

Submit Download

b94f1e5d-ce79-48bf-a05f-49086d38ec57.tmp

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\b94f1e5d-ce79-48bf-a05f-49086d38ec57.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

ffaa57c4-1032-4c4f-aec1-f5609f387f17.tmp

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\ffaa57c4-1032-4c4f-aec1-f5609f387f17.tmp
Size 187B
SHA256 fadd70320bf4be1e31268c19fa82fe6e60b1fde0440fb37bda5d1cf50be56bd6
MD5 53d78c860595d4a80df62723916e35fe
SHA1 96c1681e7f01646561cc34105635185105f16cdc
SHA512 2b1c6e0460f0ac0de4ec51744f0a3ad64403286b9c0302cdf98cb85718205b389e0a7213418eaa84cc852a5018e71295952eeade136ffcce5e22cae9d123d5a8
TLSH
T1A9C0226A566038FF034283A448147903C2FE0047120CA8ADD624372885218AE441884F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1188-221-0x00007FFD4F360000-0x00007FFD4F361000-memory.dmp

Download