Overview

overview

6

Static

static

1

TC-HELICON...up.exe

windows10-2004-x64

6

TC-HELICON...up.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 17:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TC-HELICON_GoXLR_v5.72.0_2024-12-13_setup.exe
  • Size 6.5MB
  • Sample260813-wbfpcadj2v
  • SHA256 58a8fc99a634df60f7118d350eedb9c47184680513a9076ec39695e904f1bb8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 32 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 47 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\TC-HELICON_GoXLR_v5.72.0_2024-12-13_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\TC-HELICON_GoXLR_v5.72.0_2024-12-13_setup.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Windows\SYSTEM32\msiexec.exe
      "msiexec.exe" /i "x64\TC-HELICON_GoXLR_v5.72.0_2024-12-13.msi" /l*v "C:\Users\Admin\AppData\Local\Temp\tusbaudio_installer.log"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5380
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding AFAF3120BDFBF367DA98A419E8DAB863 C
      2⤵
      • Drops file in Windows directory
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Windows\Installer\{6E3B5499-E6E0-4034-9C29-0A27D1A3BBC3}\tlsetupfx.exe
        "C:\Windows\Installer\{6E3B5499-E6E0-4034-9C29-0A27D1A3BBC3}\tlsetupfx.exe" task IsCurrentSystemSupported --cfg "C:\Windows\Installer\{6E3B5499-E6E0-4034-9C29-0A27D1A3BBC3}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" -v
        3⤵
        • Executes dropped EXE
        PID:860
      • C:\Windows\Installer\{DC9F1204-DCA9-41D5-A888-A55DCB70158A}\tlsetupfx.exe
        "C:\Windows\Installer\{DC9F1204-DCA9-41D5-A888-A55DCB70158A}\tlsetupfx.exe" task CheckRequirementsToStart --cfg "C:\Windows\Installer\{DC9F1204-DCA9-41D5-A888-A55DCB70158A}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Windows\Installer\{DC9F1204-DCA9-41D5-A888-A55DCB70158A}\pckDrfP02OtTq9\x64" -v
        3⤵
        • Executes dropped EXE
        PID:744
      • C:\Windows\Installer\{C95F33AB-6459-428E-8C05-1171FB00002F}\tlsetupfx.exe
        "C:\Windows\Installer\{C95F33AB-6459-428E-8C05-1171FB00002F}\tlsetupfx.exe" task ValidateTargetPathRoot --cfg "C:\Windows\Installer\{C95F33AB-6459-428E-8C05-1171FB00002F}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64" -v
        3⤵
        • Executes dropped EXE
        PID:5304
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3740
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 38B61C8D55BFC26D6E5A75DEB629B5C2
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Windows\Installer\{685C119E-7C48-407A-933E-C4E6E4D5974D}\tlsetupfx.exe
          "C:\Windows\Installer\{685C119E-7C48-407A-933E-C4E6E4D5974D}\tlsetupfx.exe" task IsCurrentSystemSupported --cfg "C:\Windows\Installer\{685C119E-7C48-407A-933E-C4E6E4D5974D}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" -v
          3⤵
          • Executes dropped EXE
          PID:1844
        • C:\Windows\Installer\{49183743-C92B-4196-AC34-B554006E543C}\tlsetupfx.exe
          "C:\Windows\Installer\{49183743-C92B-4196-AC34-B554006E543C}\tlsetupfx.exe" task CheckRequirementsToStart --cfg "C:\Windows\Installer\{49183743-C92B-4196-AC34-B554006E543C}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Windows\Installer\{49183743-C92B-4196-AC34-B554006E543C}\pckDrfP02OtTq9\x64" -v
          3⤵
          • Executes dropped EXE
          PID:5648
        • C:\Windows\Installer\{F63F98BA-582E-4FBE-8A0A-2CA4A242CB09}\tlsetupfx.exe
          "C:\Windows\Installer\{F63F98BA-582E-4FBE-8A0A-2CA4A242CB09}\tlsetupfx.exe" task PostInstall --cfg "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64" --result "C:\Users\Admin\AppData\Local\Temp\{E8134824-D92D-4A28-84D2-D1A0A69AEE58}\pckDrfP02OtTq9\tlsetupfx_result.xml" -v
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4060
          • C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.exe
            "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.exe" -hide
            4⤵
            • Executes dropped EXE
            PID:3540
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 554A203C9BC95247FD1D82B024ADC273 E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\Windows\Installer\{28EA5314-AAD6-44EC-B2BB-7E40BF7BF969}\tlsetupfx.exe
          "C:\Windows\Installer\{28EA5314-AAD6-44EC-B2BB-7E40BF7BF969}\tlsetupfx.exe" task LegacyUninstall --cfg "C:\Windows\Installer\{28EA5314-AAD6-44EC-B2BB-7E40BF7BF969}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Windows\Installer\{28EA5314-AAD6-44EC-B2BB-7E40BF7BF969}\pckDrfP02OtTq9\x64" --result "C:\Users\Admin\AppData\Local\Temp\{E8134824-D92D-4A28-84D2-D1A0A69AEE58}\pckDrfP02OtTq9\tlsetupfx_result.xml" -v
          3⤵
          • Executes dropped EXE
          PID:2848
        • C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\tlsetupfx.exe
          "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\tlsetupfx.exe" task PrepareInstall --cfg "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64" --result "C:\Users\Admin\AppData\Local\Temp\{E8134824-D92D-4A28-84D2-D1A0A69AEE58}\pckDrfP02OtTq9\tlsetupfx_result.xml" -v
          3⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of WriteProcessMemory
          PID:3856
          • C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\GoXLRAudioCplApp.exe
            "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\GoXLRAudioCplApp.exe" -exitall
            4⤵
            • Executes dropped EXE
            PID:4240
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /u /s "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\goxlr_audioapi.dll"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4136
            • C:\Windows\SysWOW64\regsvr32.exe
              /u /s "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\goxlr_audioapi.dll"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2992
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /u /s "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\goxlr_audioapi_x64.dll"
            4⤵
            • Loads dropped DLL
            PID:1088
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /u /s "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\goxlr_audioasio.dll"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:408
            • C:\Windows\SysWOW64\regsvr32.exe
              /u /s "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\goxlr_audioasio.dll"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:244
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /u /s "C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\goxlr_audioasio_x64.dll"
            4⤵
            • Loads dropped DLL
            PID:1108
        • C:\Windows\Installer\{58D9743F-B739-415A-9C16-6BE5BE4381F0}\tlsetupfx.exe
          "C:\Windows\Installer\{58D9743F-B739-415A-9C16-6BE5BE4381F0}\tlsetupfx.exe" task Install --cfg "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\tlsetupfx_main.xml" --logfile "C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log" --target "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64" --result "C:\Users\Admin\AppData\Local\Temp\{E8134824-D92D-4A28-84D2-D1A0A69AEE58}\pckDrfP02OtTq9\tlsetupfx_result.xml" -v
          3⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of WriteProcessMemory
          PID:3048
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi.dll"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4308
            • C:\Windows\SysWOW64\regsvr32.exe
              /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi.dll"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:4068
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi_x64.dll"
            4⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:3156
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio.dll"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1716
            • C:\Windows\SysWOW64\regsvr32.exe
              /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio.dll"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:2628
          • C:\Windows\system32\regsvr32.exe
            regsvr32 /s "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio_x64.dll"
            4⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4140
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2076
    • C:\PROGRA~1\TC-HEL~1\GOXLR_~1\x64\GoXLRAudioCplApp.exe
      C:\PROGRA~1\TC-HEL~1\GOXLR_~1\x64\GOXLRA~1.EXE
      1⤵
      • Executes dropped EXE
      PID:4800
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1cef3d16-91ac-744d-9c06-283e82bf1227}\goxlr_audioks.inf" "9" "418e1939b" "0000000000000180" "WinSta0\Default" "0000000000000164" "208" "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64"
      1⤵
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2852
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e5d76355-f495-234c-a78b-6027897ebd86}\goxlr_audio.inf" "9" "40e0cffeb" "0000000000000164" "WinSta0\Default" "00000000000000F0" "208" "C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64"
      1⤵
      • Drops file in System32 directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5604

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59be65.rbs
          • Path C:\Config.Msi\e59be65.rbs
          • Size 12.3MB
          • SHA256 9b4856e5352cc34b9ca4d480711ffd9cee5d10c0155460eb55d7699bd2695a5d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          de.txt
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.strings\de.txt
          • Size 33KB
          • SHA256 024292a64cad73a15a6caab36cf284ad84d60e791ba901849b362d8bdb54accf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          en.txt
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.strings\en.txt
          • Size 33KB
          • SHA256 ac31a21db633178413564ec6bc73e951790aa4d081d451cc8af64bd20824ae29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoXLRAudioCplApp.xml
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\GoXLRAudioCplApp.xml
          • Size 4KB
          • SHA256 73419e89dd7a33a76bb3551303bd16114c7ce68f526c58d92dba66e0da8bdda5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          custom.ini
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\custom.ini
          • Size 258B
          • SHA256 50fa9eaf7e36f86ba039f793cb2c7d6e5d90c47bab0a4ec0f107137861d6cb0d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          goxlr_audio.cat
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audio.cat
          • Size 12KB
          • SHA256 9095faf5c2c000266fb0a156850462839aeb0038d2026ebba897603761ac9527
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audio.inf
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audio.inf
          • Size 247KB
          • SHA256 d7a5ebce6320d6929763c59cc1f588066890912901487760b50e985495a35735
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audio.sys
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audio.sys
          • Size 424KB
          • SHA256 41bebed3b3bd0e34fbb5d63c90829199a53b48187744b89c6b2ce919ddeaf943
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioapi.dll
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi.dll
          • Size 282KB
          • SHA256 33a8c307787f4718de5e5915d87f2e2a0ab43e54d77b9307879021cb4ecad735
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioapi_x64.dll
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioapi_x64.dll
          • Size 315KB
          • SHA256 9a56e24f05aa5a79c5db1007a796bbf407bc75ac2a22dc5b744a5eff9030b5c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioasio.dll
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio.dll
          • Size 240KB
          • SHA256 7cacedbb9d4ab8d3526fc73b563a87f0a4db9d0d579e9c5631ad6718272f71d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioasio_x64.dll
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioasio_x64.dll
          • Size 271KB
          • SHA256 08e21ffb9f6e25ac245866a7444c05b142dc45bf7b3cb25b5bd481768a91775b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioks.cat
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioks.cat
          • Size 12KB
          • SHA256 b1b0793253d8c1358252479b087b040269e2726e53516789ba7ebbe5e6ce5c66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioks.inf
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioks.inf
          • Size 11KB
          • SHA256 5e49a43c6f7d9b8e1c78f81364997abcd7343e42c9560c6ac7aa41271994e6c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audioks.sys
          • Path C:\Program Files\TC-Helicon\GoXLR_Audio_Driver\x64\goxlr_audioks.sys
          • Size 54KB
          • SHA256 4f4502b35b9b1298a08a22902822a603028218129f56fc07e30278f90b0d461c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI283F.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI283F.tmp
          • Size 1.2MB
          • SHA256 56bf39bfa1e5b437a0a17b68e524a64fab78054c447cf885e17d8c201c970f23
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx.log
          • Path C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log
          • Size 15KB
          • SHA256 7418f0c0830cb6e15f2ecf3089416fbed7877aae95cf9d3df22780af29fe678d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx.log
          • Path C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log
          • Size 22KB
          • SHA256 45951c2c7c0be86de41586cbf3e199c955d7c7a329db95aae9feb0996259e8a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx.log
          • Path C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log
          • Size 5KB
          • SHA256 8455c946f38d4cb9c5b164ea48400e68b2dde8d1664f83841e9cc6f24e5e1b4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx.log
          • Path C:\Users\Admin\AppData\Local\Temp\tlsetupfx.log
          • Size 10KB
          • SHA256 c8b426205c5d934233b9fe706e0f0e1a875164d99f0b9626574e1e11f08301bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tusbaudio_installer.log
          • Path C:\Users\Admin\AppData\Local\Temp\tusbaudio_installer.log
          • Size 111KB
          • SHA256 a0539e31dabbb16a6748391e2fd904d91f918547db17713b1d7dd1123b296198
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx_apps.xml
          • Path C:\Windows\Installer\{49183743-C92B-4196-AC34-B554006E543C}\pckDrfP02OtTq9\x64\tlsetupfx_apps.xml
          • Size 1KB
          • SHA256 aa59c50ac6462c63181e1424201d1f77cb6647cc84781a0d5d98d000d75c966b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          TC-HELICON_GoXLR_v5.72.0_2024-12-13.msi
          • Path C:\Windows\Installer\{6B82920A-5BF7-4227-8254-B95F41D9BA19}\x64\TC-HELICON_GoXLR_v5.72.0_2024-12-13.msi
          • Size 7.4MB
          • SHA256 a91019253303810f90e543f5e7de54b9e4007c814d3f8a7d33c8ad7ed033c79a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx_drv.xml
          • Path C:\Windows\Installer\{6E3B5499-E6E0-4034-9C29-0A27D1A3BBC3}\pckDrfP02OtTq9\x64\tlsetupfx_drv.xml
          • Size 5KB
          • SHA256 466df57f48d36717449dee92c687f84d932d423e76e018a5618f0f97a59200a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tlsetupfx_main.xml
          • Path C:\Windows\Installer\{6E3B5499-E6E0-4034-9C29-0A27D1A3BBC3}\pckDrfP02OtTq9\x64\tlsetupfx_main.xml
          • Size 3KB
          • SHA256 4d4308f98aefcca281eb84847331a33a2679e1bfc75cd3ca5ee5372ec514be00
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tlsetupfx.exe
          • Path C:\Windows\Installer\{6E3B5499-E6E0-4034-9C29-0A27D1A3BBC3}\tlsetupfx.exe
          • Size 1.4MB
          • SHA256 89138ce511e8a35ba4219bb3a0b87980ea42fa7f73d7dbac95ea04f3a83055b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GoXLRAudioCplApp.exe
          • Path C:\Windows\Installer\{D7671796-7125-4481-BC43-02B324F9AB81}\pckDrfP02OtTq9\x64\GoXLRAudioCplApp.exe
          • Size 646KB
          • SHA256 bf7c37ddf4e0fa93bf289f134eb0c39b1f647f489f6ab7d6d3e7f64549d88bd6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          goxlr_audio.inf_amd64_f0f856c04395d156.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\goxlr_audio.inf_amd64_f0f856c04395d156.ini
          • Size 435B
          • SHA256 dbf318226e2f6d992173549a497c1857ad43d8821e14c31274c1c18e38630ccc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          goxlr_audioks.inf_amd64_a51748736665e8da.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\goxlr_audioks.inf_amd64_a51748736665e8da.ini
          • Size 441B
          • SHA256 e5b18cd5184e7b1c33cdbae18db8bd2c493c7666a99ed1ce8dbb24399d0640e7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3200-100-0x00000160BC0E0000-0x00000160BCA84000-memory.dmp
          Download