2005846f8530a2e2398340b965ba391fe99e332a3a2115a668aa23b6e32bcf95

Analysis

max time kernel
120s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoiceEdge.exe
Size 99.3MB
Sample260810-2va6vs1amb
SHA256 2005846f8530a2e2398340b965ba391fe99e332a3a2115a668aa23b6e32bcf95
MD5 c40e8b43c653bc1529536e0671867961
SHA1 c7de8343b858a0a49e704d9f3b7007919a39ea82
SHA512 152070fa67ef4e63879e1de941d67fdc0b683216d1d08a4da55dcd7ed409dae00ebf968f08085d4f4d416b105f8c070432b039d094299df44640e52bbe2930f9
SSDEEP 786432:8qh0dolUTzdlEn6hNDfdI+0Py/w7JAL6YR7UkquP7sSf:xCdVTbEn6h9fdIPPy/UAL6YJV
TLSH
T132388C03E3A710ECC09DC2B59B1A9526EEB2B8851734B6DF266553112F76FE06B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5196	VoiceEdge.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	VoiceEdge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	VoiceEdge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	VoiceEdge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\VoiceEdge\shell	VoiceEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\VoiceEdge\shell\open	VoiceEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\VoiceEdge\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VoiceEdge.exe\" \"%1\""	VoiceEdge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{167BB749-1936-40D4-A5F1-D68A21900418}	VoiceEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\VoiceEdge	VoiceEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\VoiceEdge\URL Protocol	VoiceEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\VoiceEdge\ = "URL:VoiceEdge"	VoiceEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\VoiceEdge\shell\open\command	VoiceEdge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5196	VoiceEdge.exe
5196	VoiceEdge.exe
4716	VoiceEdge.exe
5596	VoiceEdge.exe
4716	VoiceEdge.exe
5596	VoiceEdge.exe
3808	VoiceEdge.exe
3808	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
2912	VoiceEdge.exe
2912	VoiceEdge.exe
3252	VoiceEdge.exe
3252	VoiceEdge.exe
2708	VoiceEdge.exe
2708	VoiceEdge.exe
1516	VoiceEdge.exe
1516	VoiceEdge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5196	VoiceEdge.exe
5196	VoiceEdge.exe
5196	VoiceEdge.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 4396	5196	VoiceEdge.exe	89
PID 5196 wrote to memory of 4396	5196	VoiceEdge.exe	89
PID 5196 wrote to memory of 4716	5196	VoiceEdge.exe	90
PID 5196 wrote to memory of 3808	5196	VoiceEdge.exe	91
PID 5196 wrote to memory of 5596	5196	VoiceEdge.exe	92
PID 5196 wrote to memory of 1516	5196	VoiceEdge.exe	93
PID 5196 wrote to memory of 2708	5196	VoiceEdge.exe	94
PID 5196 wrote to memory of 4484	5196	VoiceEdge.exe	96
PID 5196 wrote to memory of 2912	5196	VoiceEdge.exe	97
PID 5196 wrote to memory of 3252	5196	VoiceEdge.exe	98

C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
"C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe" --type=gpu-process --field-trial-handle=1700,13768229280294400628,5167459360140395199,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1708 --ignored=" --type=renderer " /prefetch:2
  2⤵
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe" --type=utility --field-trial-handle=1700,13768229280294400628,5167459360140395199,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe" --type=renderer --field-trial-handle=1700,13768229280294400628,5167459360140395199,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2420 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808
- C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe" --type=renderer --field-trial-handle=1700,13768229280294400628,5167459360140395199,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2560 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5596
- C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe" --type=renderer --field-trial-handle=1700,13768229280294400628,5167459360140395199,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2588 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe" --type=renderer --field-trial-handle=1700,13768229280294400628,5167459360140395199,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --node-integration --no-sandbox --no-zygote --enable-remote-module --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
  C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe --no-rate-limit --no-upload-gzip --type=crash-handler "--crashes-directory=C:\Users\Admin\AppData\Local\Temp\VoiceEdge Crashes" "--database=C:\Users\Admin\AppData\Local\Temp\VoiceEdge Crashes" "--metrics-dir=C:\Users\Admin\AppData\Local\Temp\VoiceEdge Crashes" --url=https://submit.backtrace.io/ruby/daba0fe582d138ca1d2f693624d08e87ba12210b0878440de9e9bf7b508022a4/minidump --initial-client-data=0xca4,0xce8,0xcec,0xcd8,0xcf0,0x7ff7e7d21298,0x7ff7e7d212a8,0x7ff7e7d212b8
  2⤵
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe" --type=utility --field-trial-handle=1700,13768229280294400628,5167459360140395199,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe
  "C:\Users\Admin\AppData\Local\Temp\VoiceEdge.exe" --type=utility --field-trial-handle=1700,13768229280294400628,5167459360140395199,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --no-sandbox --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004C0
1⤵
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2929fdd4-feb5-44de-b6b0-a446a3e30924.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\2929fdd4-feb5-44de-b6b0-a446a3e30924.tmp.node
Size 143KB
SHA256 6b27e801060b63c9707915fc8139ffe0ef5482b6625b82e86e1dfe0ef292bf69
MD5 06247f8e925402c90242af08a194efbf
SHA1 70b43ef957b96f69547464e10eb0f78c480c03e6
SHA512 2a69f271dc494a195e7e46208bf3ebe1aa7092e453307efce95e3893391a0b12d9ae472bb259e83a2c843c577f82fbc2cf5dea3474ba993fc5b1eb609ab4df4b
SSDEEP 3072:RGVFKrH9x7wkhMc6aJjfXHWP1Z4ir/BM69QXkdyGybhF72mPrb:YVib7jhrJNfX2P1aOAg+r
TLSH
T130E34B5BB2A501BBE477C179C9A35A01E372B41407319BAF03A0427A1F677E1ED3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\VoiceEdge Crashes\settings.dat
Size 40B
SHA256 4f49a2bbf2aae17dceef3b2dcbb47c20eda28a21bec6e8b08e8d048d6f01eef9
MD5 bc85b15350286e79a8a048880f5db596
SHA1 da9ce71cc62f8bd394a8428107459d66ef15a4e1
SHA512 3095dabb407ef19faac7a95f540907b9333d7b27abdb66999cb252d49f27328118deb1ff5b885ebe075f4185a3868ed74755e4b14dab863926ddd38b3d86f688
MD5 SHA1 SHA512

Submit Download

065429dd-1759-4add-911d-c3472ae3f261.tmp

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\065429dd-1759-4add-911d-c3472ae3f261.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

6e13e422-590f-42b4-b46c-559618e3a7e7.tmp

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\6e13e422-590f-42b4-b46c-559618e3a7e7.tmp
Size 187B
SHA256 fadd70320bf4be1e31268c19fa82fe6e60b1fde0440fb37bda5d1cf50be56bd6
MD5 53d78c860595d4a80df62723916e35fe
SHA1 96c1681e7f01646561cc34105635185105f16cdc
SHA512 2b1c6e0460f0ac0de4ec51744f0a3ad64403286b9c0302cdf98cb85718205b389e0a7213418eaa84cc852a5018e71295952eeade136ffcce5e22cae9d123d5a8
TLSH
T1A9C0226A566038FF034283A448147903C2FE0047120CA8ADD624372885218AE441884F
MD5 SHA1 SHA512 TLSH

Submit Download

en-US-8-0.bdic

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\Dictionaries\en-US-8-0.bdic
Size 436KB
SHA256 1ed02f55bb7a2689704b7995f0f7953fbcf9bfc7ce7f7f178168fe58f3481575
MD5 0af2c2ded404eafedc91003914dc1650
SHA1 1ffddb9c1958a872401e906928934a34529b7433
SHA512 60294b1ec4bd71c328f0aebd2ddffc6d1acb24be783d939b35ec059053f407b8c2d1cb8b082d3479ac1a12b87aa62e0055695a43b205e0be2aa7da210ba41526
SSDEEP 12288:mxd7nsUgAURmF6BLIQqDntC97ykkWHWgTT:Kdb2IVCJxWu
TLSH
T1FB94A5CAD369DAE3D005C63C342616412A3EAD9ABF0AD1F40CD4763737597F88D2E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State~RFe5ab622.TMP

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\Network Persistent State~RFe5ab622.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe59cba3.TMP

Path C:\Users\Admin\AppData\Roaming\VoiceEdge\Preferences~RFe59cba3.TMP
Size 132B
SHA256 25b570de8755d597f10cb40d82856d3140b5c4ddc522db4dc31c229e13c624dc
MD5 5172b6ab37c83e557fe6312ffdba4bcb
SHA1 b64b439d92fd0c1d3d01c9b8bc1ae16eac01024e
SHA512 329b56931aa835373d2553c5790e96c5e3f6a7c26d36c6103c5799c687a3bf4164175dcba334bbc8d0342e49bbf136b9dcbb1e244e8589ce103da7a8e82fe818
TLSH
T119C022A2B80822320E2FCE8080822CEAACEA02A00F0F0E0380E032000A2B08E0C8300F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4396-7-0x00007FFD82E20000-0x00007FFD82E21000-memory.dmp

Download

memory/4396-57-0x0000020BC71E0000-0x0000020BC72CD000-memory.dmp

Download