Overview

overview

6

Static

static

1

TC-HELICON...up.exe

windows10-2004-x64

6

TC-HELICON...up.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 17:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TC-HELICON_GoXLR_v5.72.0_2024-12-13_setup.exe
  • Size 6.5MB
  • Sample260813-wbfpcadj2v
  • SHA256 58a8fc99a634df60f7118d350eedb9c47184680513a9076ec39695e904f1bb8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 30 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\TC-HELICON_GoXLR_v5.72.0_2024-12-13_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\TC-HELICON_GoXLR_v5.72.0_2024-12-13_setup.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Windows\SYSTEM32\msiexec.exe
      "msiexec.exe" /i "x64\TC-HELICON_GoXLR_v5.72.0_2024-12-13.msi" /l*v "C:\Users\Admin\AppData\Local\Temp\tusbaudio_installer.log"
      2⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4996
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 63E49AF855856BA88D42F849167ACD27 C
      2⤵
      • Drops file in Windows directory
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Windows\Installer\{B627F993-802F-48E9-A70B-BBE51D51DE90}\tlsetupfx.exe
        "C:\Windows\Installer\{B627F993-802F-48E9-A70B-BBE51D51DE90}\tlsetupfx.exe" task IsCurrentSystemSupported --cfg "C:\Windows\Installer\{B627F993-802F-48E9-A70B-BBE51D51DE90}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" -v
        3⤵
        • Executes dropped EXE
        PID:3468
      • C:\Windows\Installer\{46172E86-14C2-4DC2-A3B2-AC899CABE093}\tlsetupfx.exe
        "C:\Windows\Installer\{46172E86-14C2-4DC2-A3B2-AC899CABE093}\tlsetupfx.exe" task CheckRequirementsToStart --cfg "C:\Windows\Installer\{46172E86-14C2-4DC2-A3B2-AC899CABE093}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Windows\Installer\{46172E86-14C2-4DC2-A3B2-AC899CABE093}\pckDrfP02OtTq9\x64" -v
        3⤵
        • Executes dropped EXE
        PID:780
      • C:\Windows\Installer\{80A278B6-53E4-4EE1-B541-40941F7BC38F}\tlsetupfx.exe
        "C:\Windows\Installer\{80A278B6-53E4-4EE1-B541-40941F7BC38F}\tlsetupfx.exe" task ValidateTargetPathRoot --cfg "C:\Windows\Installer\{80A278B6-53E4-4EE1-B541-40941F7BC38F}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64" -v
        3⤵
        • Executes dropped EXE
        PID:1012
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2676
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 5FCDECA92A55783E1797D29CB8589134
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Windows\Installer\{39AA99E2-8D5B-478E-AADA-9B799D0155FA}\tlsetupfx.exe
          "C:\Windows\Installer\{39AA99E2-8D5B-478E-AADA-9B799D0155FA}\tlsetupfx.exe" task IsCurrentSystemSupported --cfg "C:\Windows\Installer\{39AA99E2-8D5B-478E-AADA-9B799D0155FA}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" -v
          3⤵
          • Executes dropped EXE
          PID:5048
        • C:\Windows\Installer\{7296BDF9-9203-48C1-BA6B-B98F2804478B}\tlsetupfx.exe
          "C:\Windows\Installer\{7296BDF9-9203-48C1-BA6B-B98F2804478B}\tlsetupfx.exe" task CheckRequirementsToStart --cfg "C:\Windows\Installer\{7296BDF9-9203-48C1-BA6B-B98F2804478B}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Windows\Installer\{7296BDF9-9203-48C1-BA6B-B98F2804478B}\pckDrfP02OtTq9\x64" -v
          3⤵
          • Executes dropped EXE
          PID:1420
        • C:\Windows\Installer\{4F2604EE-06F2-43CF-A19E-854F77AAD394}\tlsetupfx.exe
          "C:\Windows\Installer\{4F2604EE-06F2-43CF-A19E-854F77AAD394}\tlsetupfx.exe" task PostInstall --cfg "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64" --result "C:\Users\Admin\AppData\Local\Temp\{1E4B900B-E9DE-4BD4-8C4A-736C3FB4CFCF}\pckDrfP02OtTq9\tlsetupfx_result.xml" -v
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.exe
            "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.exe" -hide
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2644
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 70CFB86C3623D699A5990F9724BF347E E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4756
        • C:\Windows\Installer\{2AA09912-0A02-46CA-85E5-4B1F65BEC5B0}\tlsetupfx.exe
          "C:\Windows\Installer\{2AA09912-0A02-46CA-85E5-4B1F65BEC5B0}\tlsetupfx.exe" task LegacyUninstall --cfg "C:\Windows\Installer\{2AA09912-0A02-46CA-85E5-4B1F65BEC5B0}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Windows\Installer\{2AA09912-0A02-46CA-85E5-4B1F65BEC5B0}\pckDrfP02OtTq9\x64" --result "C:\Users\Admin\AppData\Local\Temp\{1E4B900B-E9DE-4BD4-8C4A-736C3FB4CFCF}\pckDrfP02OtTq9\tlsetupfx_result.xml" -v
          3⤵
          • Executes dropped EXE
          PID:3128
        • C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\tlsetupfx.exe
          "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\tlsetupfx.exe" task PrepareInstall --cfg "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64" --result "C:\Users\Admin\AppData\Local\Temp\{1E4B900B-E9DE-4BD4-8C4A-736C3FB4CFCF}\pckDrfP02OtTq9\tlsetupfx_result.xml" -v
          3⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of WriteProcessMemory
          PID:4012
          • C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\GoXLRAudioCplApp.exe
            "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\GoXLRAudioCplApp.exe" -exitall
            4⤵
            • Executes dropped EXE
            PID:4376
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /u /s "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\goxlr_audioapi.dll"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:540
            • C:\Windows\SysWOW64\regsvr32.exe
              /u /s "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\goxlr_audioapi.dll"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2748
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /u /s "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\goxlr_audioapi_x64.dll"
            4⤵
            • Loads dropped DLL
            PID:4704
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /u /s "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\goxlr_audioasio.dll"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1500
            • C:\Windows\SysWOW64\regsvr32.exe
              /u /s "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\goxlr_audioasio.dll"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2052
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /u /s "C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\goxlr_audioasio_x64.dll"
            4⤵
            • Loads dropped DLL
            PID:5016
        • C:\Windows\Installer\{30D40DAA-C7B7-48F2-890E-E9CCDA67C3A2}\tlsetupfx.exe
          "C:\Windows\Installer\{30D40DAA-C7B7-48F2-890E-E9CCDA67C3A2}\tlsetupfx.exe" task Install --cfg "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64" --result "C:\Users\Admin\AppData\Local\Temp\{1E4B900B-E9DE-4BD4-8C4A-736C3FB4CFCF}\pckDrfP02OtTq9\tlsetupfx_result.xml" -v
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi.dll"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3248
            • C:\Windows\SysWOW64\regsvr32.exe
              /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi.dll"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3372
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi_x64.dll"
            4⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:5112
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio.dll"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2004
            • C:\Windows\SysWOW64\regsvr32.exe
              /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio.dll"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1684
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio_x64.dll"
            4⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:2360
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2060
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of WriteProcessMemory
      PID:4660
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8d1bd898-d28c-aa4b-9de3-ec67757453f9}\goxlr_audioks.inf" "9" "418e1939b" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64"
        2⤵
        • Drops file in System32 directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:3948
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5b043255-53a0-8e46-8167-db79ff95f4dd}\goxlr_audio.inf" "9" "40e0cffeb" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64"
        2⤵
        • Drops file in System32 directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:3480
    • C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.exe
      "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.exe"
      1⤵
      • Executes dropped EXE
      PID:4516

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58ca80.rbs
          • Path C:\Config.Msi\e58ca80.rbs
          • Size 12.3MB
          • SHA256 9965c9fc68639f4d7a08b6a72d68c4c9806a5d47773c29b4c1411f4a64f30f44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de.txt
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.strings\de.txt
          • Size 33KB
          • SHA256 024292a64cad73a15a6caab36cf284ad84d60e791ba901849b362d8bdb54accf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en.txt
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.strings\en.txt
          • Size 33KB
          • SHA256 ac31a21db633178413564ec6bc73e951790aa4d081d451cc8af64bd20824ae29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoXLRAudioCplApp.xml
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.xml
          • Size 4KB
          • SHA256 73419e89dd7a33a76bb3551303bd16114c7ce68f526c58d92dba66e0da8bdda5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          custom.ini
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\custom.ini
          • Size 258B
          • SHA256 50fa9eaf7e36f86ba039f793cb2c7d6e5d90c47bab0a4ec0f107137861d6cb0d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          goxlr_audio.cat
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audio.cat
          • Size 12KB
          • SHA256 9095faf5c2c000266fb0a156850462839aeb0038d2026ebba897603761ac9527
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audio.inf
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audio.inf
          • Size 247KB
          • SHA256 d7a5ebce6320d6929763c59cc1f588066890912901487760b50e985495a35735
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audio.sys
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audio.sys
          • Size 424KB
          • SHA256 41bebed3b3bd0e34fbb5d63c90829199a53b48187744b89c6b2ce919ddeaf943
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioapi.dll
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi.dll
          • Size 282KB
          • SHA256 33a8c307787f4718de5e5915d87f2e2a0ab43e54d77b9307879021cb4ecad735
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioapi_x64.dll
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi_x64.dll
          • Size 315KB
          • SHA256 9a56e24f05aa5a79c5db1007a796bbf407bc75ac2a22dc5b744a5eff9030b5c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioasio.dll
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio.dll
          • Size 240KB
          • SHA256 7cacedbb9d4ab8d3526fc73b563a87f0a4db9d0d579e9c5631ad6718272f71d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioasio_x64.dll
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio_x64.dll
          • Size 271KB
          • SHA256 08e21ffb9f6e25ac245866a7444c05b142dc45bf7b3cb25b5bd481768a91775b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioks.cat
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioks.cat
          • Size 12KB
          • SHA256 b1b0793253d8c1358252479b087b040269e2726e53516789ba7ebbe5e6ce5c66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioks.inf
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioks.inf
          • Size 11KB
          • SHA256 5e49a43c6f7d9b8e1c78f81364997abcd7343e42c9560c6ac7aa41271994e6c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioks.sys
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioks.sys
          • Size 54KB
          • SHA256 4f4502b35b9b1298a08a22902822a603028218129f56fc07e30278f90b0d461c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
          • Size 1KB
          • SHA256 3abe065ba51fd9e1d50e7769f6cc73e830f9b7b175cd8fc907c64f6601559fab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          357F04AD41BCF5FE18FCB69F60C6680F_A3EDEF17EC2FF89C8DFCEFF1219AF009
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_A3EDEF17EC2FF89C8DFCEFF1219AF009
          • Size 1KB
          • SHA256 6e645c0d22d7d4a5b28466fc5cff200f42848a96b01a3524acd0b820df233cf0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 1KB
          • SHA256 4e1d417c3a59aac3c0e3abc3279caa21a9ada804fd5c4de7edeeaad569e6cefd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
          • Size 1KB
          • SHA256 604ffb19d1343d3c645cc97ce54f04f5621203e239712a12e0e272273df76cc8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
          • Size 508B
          • SHA256 24bc0d8cb729658a42e0d304a7f6b40b83587d3f6a5d623325c6fd891853116c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          357F04AD41BCF5FE18FCB69F60C6680F_A3EDEF17EC2FF89C8DFCEFF1219AF009
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_A3EDEF17EC2FF89C8DFCEFF1219AF009
          • Size 536B
          • SHA256 77a8011ace873a8f5aebda91a226dffdcaa2b451d20ad40768a8d0bf5b39acdf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 536B
          • SHA256 b53cfd93629e7ae3a86ccbfb7e86ebbdf6617c17290c7124c2c72d25d65fe259
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
          • Size 508B
          • SHA256 a97f37a1ee1ff4a9ad8e877c2810c1031b921f0091b40ac5d2b48a21b96270da
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI3B00.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI3B00.tmp
          • Size 1.2MB
          • SHA256 56bf39bfa1e5b437a0a17b68e524a64fab78054c447cf885e17d8c201c970f23
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx.log
          • Path C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log
          • Size 13KB
          • SHA256 20cf9a9cb5514f40eaeacb95c1090bdb1b661b22f736cbe2cd272f38bcdac4b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx.log
          • Path C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log
          • Size 13KB
          • SHA256 8c50c7f6132b6ac9baa8a3c30e5cab8c4a9d9c2e667fd99c6d1a773360ea8580
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx.log
          • Path C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log
          • Size 22KB
          • SHA256 f4653a8a2d07e80767391cb5eb76b0ca78313363f52f0abee3a1922d119f895a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx.log
          • Path C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log
          • Size 9KB
          • SHA256 3e867fe6df34d7fe0d960124be6174fad534b28cda87f7b201d1cc91f955a321
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tusbaudio_installer.log
          • Path C:\Users\Admin\AppData\Local\Temp\tusbaudio_installer.log
          • Size 111KB
          • SHA256 0f18bba06c171ce1c79680192a084097c49575e6b08355fe401085fbb3c7894a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TC-HELICON_GoXLR_v5.72.0_2024-12-13.msi
          • Path C:\Windows\Installer\{0914296A-A10C-4F61-886D-2F48A10BA6B9}\x64\TC-HELICON_GoXLR_v5.72.0_2024-12-13.msi
          • Size 7.4MB
          • SHA256 a91019253303810f90e543f5e7de54b9e4007c814d3f8a7d33c8ad7ed033c79a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx_main.xml
          • Path C:\Windows\Installer\{46172E86-14C2-4DC2-A3B2-AC899CABE093}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml
          • Size 3KB
          • SHA256 4d4308f98aefcca281eb84847331a33a2679e1bfc75cd3ca5ee5372ec514be00
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tlsetupfx.exe
          • Path C:\Windows\Installer\{46172E86-14C2-4DC2-A3B2-AC899CABE093}\tlsetupfx.exe
          • Size 1.4MB
          • SHA256 89138ce511e8a35ba4219bb3a0b87980ea42fa7f73d7dbac95ea04f3a83055b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoXLRAudioCplApp.exe
          • Path C:\Windows\Installer\{552A4E25-3E3C-4A83-928C-17C4E0A55D9C}\pckDrfP02OtTq9\x64\GoXLRAudioCplApp.exe
          • Size 646KB
          • SHA256 bf7c37ddf4e0fa93bf289f134eb0c39b1f647f489f6ab7d6d3e7f64549d88bd6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx_apps.xml
          • Path C:\Windows\Installer\{7296BDF9-9203-48C1-BA6B-B98F2804478B}\pckDrfP02OtTq9\x64\tlsetupfx_apps.xml
          • Size 1KB
          • SHA256 aa59c50ac6462c63181e1424201d1f77cb6647cc84781a0d5d98d000d75c966b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tlsetupfx_drv.xml
          • Path C:\Windows\Installer\{B627F993-802F-48E9-A70B-BBE51D51DE90}\pckDrfP02OtTq9\x64\tlsetupfx_drv.xml
          • Size 5KB
          • SHA256 466df57f48d36717449dee92c687f84d932d423e76e018a5618f0f97a59200a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download