bf11ab3c3e94ddf40a8edbf1eae52bf518c66d58560fc33defda720acd34506d

Resubmissions

13/09/2026, 05:56

260913-gm37fsff848

13/09/2026, 05:49

260913-gh8ldaff4410

Analysis

user interaction
yes
max time kernel
77s
max time network
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoicemodInstaller_1.6.0-zxtpcu.exe
Size 6.1MB
Sample260913-gm37fsff84
SHA256 bf11ab3c3e94ddf40a8edbf1eae52bf518c66d58560fc33defda720acd34506d
MD5 9686eca7104468acf86f238521842523
SHA1 03cb9b5b0fe2395861fad11ddc44257acdbf37d7
SHA512 66621706b28a856ffd37cf2b61619b061ea2d268ac55426e0d6f6392f22d7514efceab40291f83d69ba12ffa2283d956a9e3df6824027bc504330cfa5fede57a
SSDEEP 98304:U1QTLb/jF2LPpBe5QPHAZqZIbQQm5gre68xhvFAjNfnOx3TX6u0Fm:AKrUPpUMHWbQQmSq6oFApfnSTXjYm
TLSH
T155561223B298A53FD09927348573A52094F7B7BDE817AD12B6F8D48CDF256C01E3A631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1424	powershell.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\VoicemodV3 = "\"C:\\Program Files\\Voicemod V3\\Voicemod.exe\" --boot"	VoicemodInstaller_1.6.0-zxtpcu.tmp

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4808	tasklist.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}\SETB037.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}\voicemodvad.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\voicemodvad.inf_amd64_b1314f88d7831d1d\voicemodvad.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}\voicemodvad.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}\SETB038.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}\SETB038.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}\SETB037.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}\voicemodvad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\voicemodvad.inf_amd64_b1314f88d7831d1d\voicemodvad.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}\SETB048.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c002fb4a-1528-0747-88da-d209b126231c}\SETB048.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\voicemodvad.inf_amd64_b1314f88d7831d1d.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\voicemodvad.inf_amd64_b1314f88d7831d1d\voicemodvad.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\voicemodvad.inf_amd64_b1314f88d7831d1d\voicemodvad.PNF	voicemodcon.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe	VoicemodInstaller_1.6.0-zxtpcu.tmp
File opened for modification	C:\Program Files\Voicemod V3\WinSparkle.dll	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-B1EEK.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-B7BCC.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-NMNFG.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-8SE52.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-16G5E.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-3A16B.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-FN6I2.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-G2O6U.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File opened for modification	C:\Program Files\Voicemod V3\driver\uninstalldriver.log	cmd.exe
File opened for modification	C:\Program Files\Voicemod V3\crashpad_handler.exe	VoicemodInstaller_1.6.0-zxtpcu.tmp
File opened for modification	C:\Program Files\Voicemod V3\driver\voicemodcon.exe	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-NGKM9.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-K1RTC.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-AG1TM.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-OEJEE.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-SH64S.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File opened for modification	C:\Program Files\Voicemod V3\crashpad_wer.dll	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-6DL7J.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-Q9A6M.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-P677T.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File opened for modification	C:\Program Files\Voicemod V3\Voicemod.exe	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-A4OGG.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-L7LBO.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-RARH1.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\unins000.msg	VoicemodInstaller_1.6.0-zxtpcu.tmp
File opened for modification	C:\Program Files\Voicemod V3\unins000.dat	VoicemodInstaller_1.6.0-zxtpcu.tmp
File opened for modification	C:\Program Files\Voicemod V3\driver\SaveDefaultDevices.exe	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\unins000.dat	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-EBTG7.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-BMQ3J.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-02OG9.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-AU0Q4.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\is-8EC0L.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-E2G4E.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp
File created	C:\Program Files\Voicemod V3\driver\is-5R7F5.tmp	VoicemodInstaller_1.6.0-zxtpcu.tmp

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\INF\oem0.PNF	voicemodcon.exe
File created	C:\Windows\INF\c_media.PNF	voicemodcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	voicemodcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 11 IoCs

pid	Process
4672	VoicemodInstaller_1.6.0-zxtpcu.tmp
5228	SaveDefaultDevices.exe
4508	Voicemod.exe
4860	crashpad_handler.exe
5352	AudioEndPointTool.exe
4980	AudioEndPointTool.exe
5844	voicemodcon.exe
1624	AudioEndPointTool.exe
1084	AudioEndPointTool.exe
3180	AudioEndPointTool.exe
4084	voicemodcon.exe

Loads dropped DLL 4 IoCs

pid	Process
4672	VoicemodInstaller_1.6.0-zxtpcu.tmp
4672	VoicemodInstaller_1.6.0-zxtpcu.tmp
4672	VoicemodInstaller_1.6.0-zxtpcu.tmp
4508	Voicemod.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Voicemod.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000c00000001c594-167.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5932	cmd.exe
2428	cmd.exe
3060	cmd.exe
5648	cmd.exe
2604	cmd.exe
3028	cmd.exe
1072	cmd.exe
2060	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.0-zxtpcu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoicemodInstaller_1.6.0-zxtpcu.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/108-0-0x0000000000400000-0x00000000004DB000-memory.dmp	innosetup
behavioral2/memory/108-12-0x0000000000400000-0x00000000004DB000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	voicemodcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	voicemodcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\ = "URL:Voicemod Command Protocol"	VoicemodInstaller_1.6.0-zxtpcu.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell	VoicemodInstaller_1.6.0-zxtpcu.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open	VoicemodInstaller_1.6.0-zxtpcu.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod	VoicemodInstaller_1.6.0-zxtpcu.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\URL Protocol	VoicemodInstaller_1.6.0-zxtpcu.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\DefaultIcon	VoicemodInstaller_1.6.0-zxtpcu.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\DefaultIcon\ = "Voicemod.exe,1"	VoicemodInstaller_1.6.0-zxtpcu.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open\command	VoicemodInstaller_1.6.0-zxtpcu.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\voicemod\Shell\open\command\ = "\"C:\\Program Files\\Voicemod V3\\Voicemod.exe\" \"%1\""	VoicemodInstaller_1.6.0-zxtpcu.tmp
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4672	VoicemodInstaller_1.6.0-zxtpcu.tmp
4672	VoicemodInstaller_1.6.0-zxtpcu.tmp
1424	powershell.exe
1424	powershell.exe
4508	Voicemod.exe
4508	Voicemod.exe
4508	Voicemod.exe
4508	Voicemod.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5720	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4808	tasklist.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeLoadDriverPrivilege	4084	voicemodcon.exe
Token: SeRestorePrivilege	1960	DrvInst.exe
Token: SeBackupPrivilege	1960	DrvInst.exe
Token: SeRestorePrivilege	1960	DrvInst.exe
Token: SeBackupPrivilege	1960	DrvInst.exe
Token: SeLoadDriverPrivilege	1960	DrvInst.exe
Token: SeLoadDriverPrivilege	1960	DrvInst.exe
Token: SeLoadDriverPrivilege	1960	DrvInst.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4672	VoicemodInstaller_1.6.0-zxtpcu.tmp

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 4672	108	VoicemodInstaller_1.6.0-zxtpcu.exe	87
PID 4672 wrote to memory of 4608	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	88
PID 4672 wrote to memory of 5088	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	90
PID 4672 wrote to memory of 2060	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	92
PID 2060 wrote to memory of 4808	2060	cmd.exe	94
PID 4672 wrote to memory of 4160	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	96
PID 4672 wrote to memory of 2592	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	98
PID 4672 wrote to memory of 1968	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	100
PID 4672 wrote to memory of 3700	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	103
PID 4672 wrote to memory of 4056	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	105
PID 4672 wrote to memory of 4980	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	107
PID 4672 wrote to memory of 1352	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	109
PID 4672 wrote to memory of 1796	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	111
PID 4672 wrote to memory of 5832	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	113
PID 4672 wrote to memory of 2612	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	115
PID 4672 wrote to memory of 1136	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	117
PID 4672 wrote to memory of 1828	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	119
PID 4672 wrote to memory of 4360	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	121
PID 4672 wrote to memory of 5384	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	123
PID 4672 wrote to memory of 4596	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	125
PID 4672 wrote to memory of 4320	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	127
PID 4672 wrote to memory of 5228	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	129
PID 4672 wrote to memory of 5932	4672	VoicemodInstaller_1.6.0-zxtpcu.tmp	132
PID 5932 wrote to memory of 1424	5932	cmd.exe	134
PID 4508 wrote to memory of 4860	4508	Voicemod.exe	137
PID 1424 wrote to memory of 2428	1424	powershell.exe	138
PID 2428 wrote to memory of 3060	2428	cmd.exe	140
PID 3060 wrote to memory of 5352	3060	cmd.exe	141
PID 2428 wrote to memory of 5648	2428	cmd.exe	142
PID 5648 wrote to memory of 4980	5648	cmd.exe	143
PID 2428 wrote to memory of 2604	2428	cmd.exe	144
PID 2604 wrote to memory of 5844	2604	cmd.exe	145
PID 2428 wrote to memory of 1624	2428	cmd.exe	146
PID 2428 wrote to memory of 1084	2428	cmd.exe	147
PID 2428 wrote to memory of 3180	2428	cmd.exe	148
PID 2428 wrote to memory of 4084	2428	cmd.exe	149
PID 4508 wrote to memory of 5720	4508	Voicemod.exe	152
PID 5720 wrote to memory of 2864	5720	msedgewebview2.exe	154
PID 5720 wrote to memory of 4372	5720	msedgewebview2.exe	156
PID 5720 wrote to memory of 4372	5720	msedgewebview2.exe	156
PID 5720 wrote to memory of 4372	5720	msedgewebview2.exe	156
PID 5720 wrote to memory of 4372	5720	msedgewebview2.exe	156
PID 5720 wrote to memory of 5492	5720	msedgewebview2.exe	157
PID 5720 wrote to memory of 2408	5720	msedgewebview2.exe	158
PID 5720 wrote to memory of 2408	5720	msedgewebview2.exe	158
PID 5720 wrote to memory of 2408	5720	msedgewebview2.exe	158
PID 5720 wrote to memory of 3224	5720	msedgewebview2.exe	159
PID 5720 wrote to memory of 3224	5720	msedgewebview2.exe	159
PID 5720 wrote to memory of 3224	5720	msedgewebview2.exe	159
PID 5720 wrote to memory of 3224	5720	msedgewebview2.exe	159
PID 5720 wrote to memory of 3224	5720	msedgewebview2.exe	159

cURL User-Agent 9 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0
HTTP User-Agent header	23	curl/8.8.0
HTTP User-Agent header	43	curl/8.8.0
HTTP User-Agent header	12	curl/8.8.0
HTTP User-Agent header	19	curl/8.8.0
HTTP User-Agent header	27	curl/8.8.0
HTTP User-Agent header	33	curl/8.8.0
HTTP User-Agent header	36	curl/8.8.0
HTTP User-Agent header	40	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.0-zxtpcu.exe
"C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.0-zxtpcu.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:108
- C:\Users\Admin\AppData\Local\Temp\is-8ESPO.tmp\VoicemodInstaller_1.6.0-zxtpcu.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8ESPO.tmp\VoicemodInstaller_1.6.0-zxtpcu.tmp" /SL5="$400A6,5606367,839680,C:\Users\Admin\AppData\Local\Temp\VoicemodInstaller_1.6.0-zxtpcu.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4608
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"mp_deviceid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\",\"events\": [{\"data\": {\"event_name\": \"Installer Open\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.26100)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\" }},\"event_type\": \"custom_event\"}],\"ip\": \"\",\"environment\": \"production\"}"
    3⤵
    PID:5088
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C tasklist > C:\Users\Admin\AppData\Local\Temp\\tasklist_unins000.exe.txt
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\System32\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4808
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4160
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"mp_deviceid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpWelcome\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.26100)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\",\"page_number\": \"1\" }},\"event_type\": \"custom_event\"}],\"ip\": \"\",\"environment\": \"production\"}"
    3⤵
    PID:2592
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:1968
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"mp_deviceid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpLicense\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.26100)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\",\"page_number\": \"2\" }},\"event_type\": \"custom_event\"}],\"ip\": \"\",\"environment\": \"production\"}"
    3⤵
    PID:3700
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4056
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"mp_deviceid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectDir\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.26100)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\",\"page_number\": \"6\" }},\"event_type\": \"custom_event\"}],\"ip\": \"\",\"environment\": \"production\"}"
    3⤵
    PID:4980
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:1352
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"mp_deviceid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpSelectTasks\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.26100)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\",\"page_number\": \"9\" }},\"event_type\": \"custom_event\"}],\"ip\": \"\",\"environment\": \"production\"}"
    3⤵
    PID:1796
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:5832
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"mp_deviceid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpReady\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.26100)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\",\"page_number\": \"10\" }},\"event_type\": \"custom_event\"}],\"ip\": \"\",\"environment\": \"production\"}"
    3⤵
    PID:2612
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:1136
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"mp_deviceid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpPreparing\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.26100)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\",\"page_number\": \"11\" }},\"event_type\": \"custom_event\"}],\"ip\": \"\",\"environment\": \"production\"}"
    3⤵
    PID:1828
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4360
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"mp_deviceid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\",\"events\": [{\"data\": {\"event_name\": \"Installer Page wpInstalling\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.26100)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\",\"page_number\": \"12\" }},\"event_type\": \"custom_event\"}],\"ip\": \"\",\"environment\": \"production\"}"
    3⤵
    PID:5384
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" https://api.voicemod.net/ip -H "Content-Type: application/json" -o "C:\Users\Admin\AppData\Local\Temp\\ipaddress.info"
    3⤵
    PID:4596
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" -u us1-d2410d079164564abc5e06843fc67fdb:516itzpaBAGHuMlgh2A6VuTvFKGulyir1mi3OY6kBDLS4XbBnxXtLYe5ngsL2uNv -v https://s2s.mparticle.com/v2/events -H "Content-Type: application/json" -X POST -d "{\"user_identities\": {\"other\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"device_info\": {\"platform\": \"Android\",\"android_uuid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\"},\"mp_deviceid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\",\"events\": [{\"data\": {\"event_name\": \"Installer Step Install\" , \"custom_attributes\": { \"version\": \"1.6.0\", \"app_version\": \"1.6.0\", \"machine_guid\": \"a138fda6-9c2c-4447-951e-b6e8ae1ea94a\", \"country_code\": \"US\", \"locale\": \"en-US\", \"is_new_user\": \"True\", \"voicemod_system\": \"voicemod-v3-installer-windows\",\"operating_system\": \"Windows\",\"operating_system_version\": \"11 (10.0.26100)\",\"cpu_architecture\": \"x86_64\", \"download_id\": \"zxtpcu\" }},\"event_type\": \"custom_event\"}],\"ip\": \"\",\"environment\": \"production\"}"
    3⤵
    PID:4320
- - C:\Program Files\Voicemod V3\driver\SaveDefaultDevices.exe
    "C:\Program Files\Voicemod V3\driver\SaveDefaultDevices.exe" defaultdevices.txt
    3⤵
    - Executes dropped EXE
    PID:5228
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod V3\driver\setupDrv.bat" true"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process 'setupDrvAdmin.bat' -ArgumentList 'true' -Verb runAs -WindowStyle Hidden -Wait"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Program Files\Voicemod V3\driver\setupDrvAdmin.bat" true
        5⤵
        Drops file in Program Files directory
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c AudioEndPointTool.exe get --name "(Voicemod)" --flow Capture --format Raw --fields ID
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe get --name "(Voicemod)" --flow Capture --format Raw --fields ID
        7⤵
        Executes dropped EXE
        
        PID:5352
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c AudioEndPointTool.exe get --name "(Voicemod)" --flow Render --format Raw --fields ID
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5648
        
        C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe get --name "(Voicemod)" --flow Render --format Raw --fields ID
        7⤵
        Executes dropped EXE
        
        PID:4980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "voicemodcon.exe dp_enum"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Program Files\Voicemod V3\driver\voicemodcon.exe
        
        voicemodcon.exe dp_enum
        7⤵
        Drops file in Windows directory
        Executes dropped EXE
        
        PID:5844
      - C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe get --default --flow=Capture --role=Communications --format=Raw --fields=ID
        6⤵
        Executes dropped EXE
        
        PID:1624
      - C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe get --default --flow=Capture --role=Multimedia --format=Raw --fields=ID
        6⤵
        Executes dropped EXE
        
        PID:1084
      - C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe get --default --flow=Capture --role=Console --format=Raw --fields=ID
        6⤵
        Executes dropped EXE
        
        PID:3180
      - C:\Program Files\Voicemod V3\driver\voicemodcon.exe
        
        voicemodcon install voicemodvad.inf ROOT\voicemodvad
        6⤵
        Drops file in System32 directory
        Drops file in Windows directory
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
      - C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe setdefault --id="{0.0.1.00000000}.{c673194b-d41d-46f8-af1c-542f980eaad6}" --flow=Capture --role=Communications
        6⤵
        
        PID:3176
      - C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe setdefault --id="{0.0.1.00000000}.{c673194b-d41d-46f8-af1c-542f980eaad6}" --flow=Capture --role=Multimedia
        6⤵
        
        PID:2520
      - C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
        
        AudioEndPointTool.exe setdefault --id="{0.0.1.00000000}.{c673194b-d41d-46f8-af1c-542f980eaad6}" --flow=Capture --role=Console
        6⤵
        
        PID:3596
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C driverquery /V /FO LIST | findstr /I "Voicemod" > "C:\Users\Admin\AppData\Local\Temp\is-UUV34.tmp\output_ansi.log"
    3⤵
    - Executes a command shell one-liner
    PID:3028
  - - C:\Windows\System32\driverquery.exe
      driverquery /V /FO LIST
      4⤵
      PID:1796
  - - C:\Windows\System32\findstr.exe
      findstr /I "Voicemod"
      4⤵
      PID:4268
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /C driverquery /V /FO LIST | findstr /I "Voicemod" > "C:\Users\Admin\AppData\Local\Temp\is-UUV34.tmp\output_ansi.log"
    3⤵
    - Executes a command shell one-liner
    PID:1072
  - - C:\Windows\System32\driverquery.exe
      driverquery /V /FO LIST
      4⤵
      PID:1056
  - - C:\Windows\System32\findstr.exe
      findstr /I "Voicemod"
      4⤵
      PID:4220

C:\Program Files\Voicemod V3\Voicemod.exe
"C:\Program Files\Voicemod V3\Voicemod.exe" --boot
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files\Voicemod V3\crashpad_handler.exe
  "C:\Program Files\Voicemod V3\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\.voicemod-launcher --metrics-dir=C:\Users\Admin\AppData\Local\Temp\.voicemod-launcher --url=https://sentry.voicemod.net:443/api/99/minidump/?sentry_client=sentry.native/0.6.0&sentry_key=8180826154b54352875728e511f6b737 --attachment=C:\Users\Admin\AppData\Local\Temp\.voicemod-launcher\5052895d-2887-466f-2016-3f3b79042413.run\__sentry-event --attachment=C:\Users\Admin\AppData\Local\Temp\.voicemod-launcher\5052895d-2887-466f-2016-3f3b79042413.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\AppData\Local\Temp\.voicemod-launcher\5052895d-2887-466f-2016-3f3b79042413.run\__sentry-breadcrumb2 --initial-client-data=0x684,0x688,0x68c,0x474,0x690,0x7ff7ed2aa0d8,0x7ff7ed2aa0f0,0x7ff7ed2aa108
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4508.4636.6900017572522777856 /pfhostedapp:05e5a8801e30a71b0628fff78ea5ecfe63d007f6
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView /prefetch:4 /pfhostedapp:05e5a8801e30a71b0628fff78ea5ecfe63d007f6 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff826245fd8,0x7ff826245fe4,0x7ff826245ff0
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1804 --field-trial-handle=1808,i,13795779891058469931,15647963082966228396,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:05e5a8801e30a71b0628fff78ea5ecfe63d007f6
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2016 --field-trial-handle=1808,i,13795779891058469931,15647963082966228396,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:05e5a8801e30a71b0628fff78ea5ecfe63d007f6
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=1808,i,13795779891058469931,15647963082966228396,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:05e5a8801e30a71b0628fff78ea5ecfe63d007f6
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView" --webview-exe-name=Voicemod.exe --webview-exe-version=1.6.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3412 --field-trial-handle=1808,i,13795779891058469931,15647963082966228396,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:05e5a8801e30a71b0628fff78ea5ecfe63d007f6 /prefetch:1
    3⤵
    PID:3224
- C:\Program Files\Voicemod V3\Voicemod.exe
  "C:\Program Files\Voicemod V3\Voicemod.exe" --restarted
  2⤵
  PID:3100

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c2c4258f-8388-7c43-ba7a-ed41ca18db0f}\voicemodvad.inf" "9" "49f38a543" "0000000000000180" "WinSta0\Default" "000000000000017C" "208" "c:\program files\voicemod v3\driver"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:688

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\voicemodvad.inf_amd64_b1314f88d7831d1d\voicemodvad.inf" "oem1.inf:ed86ca110bbfc653:VOICEMODVAD_DRIVER:2025.10.8.0:root\voicemodvad," "49f38a543" "0000000000000180" "feae"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Voicemod.exe

Path C:\Program Files\Voicemod V3\Voicemod.exe
Size 678KB
SHA256 16258238ffca62bd66c1c7085be090ff75b496e8305ee09f966153d5ba940bb0
MD5 d65e1a39fb860bb981140dcdb5cd0962
SHA1 c3f194d334ca877fdcc8ff9fe700805c3a8387c0
SHA512 24c7807abb63c578a5ef62c54db9ad08eeeb8403f43d26ceaefc8163afd540f19408964119437708a35012913da372ff19106ba118f4fad07a7213b395445570
SSDEEP 12288:2Gtlq9dblzzIttY3reTjD06MlNyNpCVwASOPsPT7:2GtlqPZVIH06iyuVwASOkPT7
TLSH
T193E4AEFDA43D0562349A69F6C3DAA3382601126D43F414DBB951C6E51F87EE06AF3F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSparkle.dll

Path C:\Program Files\Voicemod V3\WinSparkle.dll
Size 192KB
SHA256 62e4e76813868e18de8c9f5672d3eb23301d34c651628dc87ea60280e51f4e8c
MD5 86a90ea510e9e114da879b1d385dbac2
SHA1 ec6612864ef47600d340d1cf289744e72e61a899
SHA512 279c0032898add471ca9ea7f0db785d8feab13165ccbc6c2f3ba39f88f479729ddd6ca9f40176e2b48818fa35fd3008043fe351fa6334b2f9da1b098d7989835
SSDEEP 3072:O9r90eBK3CjOYe+DsnGFEsp4T2ZyCO1WqpZCro1:OpQGLp4T2y1WYZt1
TLSH
T1D1142B2F52F500F8D1ABD078C606A607E3F6746A4372B28F16B0499A5FBB6315F5E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\Program Files\Voicemod V3\crashpad_handler.exe
Size 606KB
SHA256 5e3ff8bfc297381dc5aa3d3fc0da312ee16b484040712c3b0c0439a9700d2d82
MD5 2921a285119f7e4a48c5e3a2be5e787b
SHA1 e31362258ad270cd056b84906e8c4445033fde41
SHA512 11e2f22e629e056c4a012b2ed69e53b5bc20c095fc39b65a611cfd210d922f86c2117cf1f8e9c295d37ce37eb969512fb491b44c0c4822dcb07a1ea1cd2c610f
SSDEEP 12288:Yiqjxwxm1FQmf8goVOzubJNO8BxjCoGu9dLOJaP3+rm49ITvEA8xKGd:YiqjxLGm0gM2ubJNO8BxjCoGu9dLOJaY
TLSH
T191D44C6B766900F9D1A7C17DD6478A03F6B6340B03B19EDB139443A62F17AC89F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AudioEndPointTool.exe

Path C:\Program Files\Voicemod V3\driver\AudioEndPointTool.exe
Size 636KB
SHA256 94fbc786d5bf0a893edbaab02b798a66a835592aaca3d94d39bf6d392ef99d32
MD5 7a45b57f91ae31665ea0f4fecc723f47
SHA1 09bf5a71d1061e17ac1e59a2d3f08552e998e817
SHA512 356f6f51562b20ad14382d1652c6622e75a82cebb3167019a25ac1cd4418e83b6f9b1414791a624c266662826357b9cf9678b1e37dce7815350e91f1c940d73e
SSDEEP 12288:PwvXiMGkWpV1j9hcYtHDlUJNlz9PFu9oT/+2nM:PwvizD1fcaDqJP9k9j2M
TLSH
T1CAD47D0BA3A441F9D0BBE178D9075956F7B6B81603B09B9F23E042672F572A09F7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveDefaultDevices.exe

Path C:\Program Files\Voicemod V3\driver\SaveDefaultDevices.exe
Size 152KB
SHA256 ff7cf1bd741cf87296c2aa39ffbc0eebbaf02823fea7c406f263127218d68634
MD5 eea1cd25a378fa42159c7605c22225ac
SHA1 72a95197a0d3312fbfbb23d2b887c19c95d6b867
SHA512 083d646af228ea487eff1f596e08263821d829b14a77f557672a7ec93634addd57ae33a3087469c97d7ce0e52a6b037a1f721e955e2ee21032a453efdc744676
SSDEEP 3072:vJjPqDhLB86VjnZLc2zRXGNG09i+zWism0Tsxvg+2YcTMgn3aIBxt:RjP6S6pnZYCSG8Ymwsxvy/nxt
TLSH
T1D2E36B53B2A120F9C497C17C92669A17F773742917185BDF6390CA782F23EE27D7A220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disableDrv.bat

Path C:\Program Files\Voicemod V3\driver\disableDrv.bat
Size 1KB
SHA256 a204ad9fb08efc013cd095f620c733f6a9ffb27dfa8b067840ad11bce34eafa2
MD5 cee275b42b348719d1fbfacd3d3f548d
SHA1 afddbd3c1c552d4633dc6f9d96016ee0c1af4c2a
SHA512 453a433f789199d5318d05b140ed76fe0d96db53e7c2c54df72c7b0eb3e95eea232f7d17c11adb6149243988d8fd13490d3787a1efb708baaa14dc87e3aff5e5
TLSH
T141218105361C26ACB71CD076FE64B19D7748B5E419CD6120ECB827E833E4E681D4CAF9
MD5 SHA1 SHA512 TLSH

Submit Download

setupDrv.bat

Path C:\Program Files\Voicemod V3\driver\setupDrv.bat
Size 368B
SHA256 d0c87a8a786958a236b4d17cdaab5f1b5b213492eb74cc8577fbc301e1475066
MD5 ea4874e0933b4a5e0241e19c0fa1a025
SHA1 8ec1885e8a06084d175c650a5bf4cf71356bcd6d
SHA512 bc1361a2855c5343dfec5a025dd3222471192f580526c95ad9649a73ede720be8693cc0e7323d85504ad3ad8aeadce9ba393a656126973fa623b0ab8592489aa
TLSH
T1CDE026A54B2D22DDF56E00BFD85373709E1273C1340EC1B6766D4F14BAA2A918EAC4A5
MD5 SHA1 SHA512 TLSH

Submit Download

setupDrvAdmin.bat

Path C:\Program Files\Voicemod V3\driver\setupDrvAdmin.bat
Size 5KB
SHA256 569938dd98a605797f598ef310b25056b40acd897373067c453df86b1abebb4e
MD5 f712dccf160f7f0034700de155053d78
SHA1 1ea7b7dac402c53b17dbeb4ad8a4f84bfeb0621d
SHA512 2bc4bd04a8a6ef8be5c668daa4a898587bc3e43758fb2a44c386a30f75df71695fbc8924fe4a1d48ad4cef2043e125faedb809bf73b0e8d11df29c8c858713da
SSDEEP 96:OKG2/51LUv3JavxaVKhrhd2c0Rh1GE3dLcuch1GE1dRcfwGwameK+zaoeV/QGvr/:o3JavxaV4CtDYAEame9zaoeNeu4aZRJ
TLSH
T109C1715627A61AA0561C6074B63DB24F336480E06BFC2179EDCAB98B331CDD90D767EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstalldriver.bat

Path C:\Program Files\Voicemod V3\driver\uninstalldriver.bat
Size 1KB
SHA256 ff85a4e820e5448e71082a1a113b429747d68b0d26bc44f557b44681e309c54d
MD5 f121a8fc7db2a4e1eaf740e40bcdc801
SHA1 2248b2c1c7a524bf4ac6c8320352627cc8bdd9dd
SHA512 f9531a59334b0bd0487dc18d4cde25c57db5d58769bdbec6a25061879bea9d6ed53d9c12b9ee8a7aa53a385f442b4901a63d2e15646846f672fa23b8de8d53cf
TLSH
T19E415376690700DE69749172FD1E2000F75BE0A7413A6754F8AF82BC7FF928078EA0D2
MD5 SHA1 SHA512 TLSH

Submit Download

voicemodcon.exe

Path C:\Program Files\Voicemod V3\driver\voicemodcon.exe
Size 149KB
SHA256 4cf487a39f0afd03a0ef1b5a77a7c19bbc6201243657c6d6fdab36a1c016d3e0
MD5 15025f82ece2c9ce6ff19af4dcacd010
SHA1 ab40743c1d469fffa7eb8e168f432efe30489975
SHA512 3cd5226404226b6da8e903afbb13cd46828ad2076329b6971aef6a94a23081b10354c18a53dd6e1fc5b97f20887765b87a13f06bdd8c8b6ce63d2e69fd8ae793
SSDEEP 3072:HRiycZvx1MUnA4wHzvmrF4gTTtm4E3W1Bx+N:xMvmzerX3dPxU
TLSH
T16BE3920223E90589F5F3BA3859B652258B737C959B38D3CF025882590FB3EC1AD75B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemodvad.inf

Path C:\Program Files\Voicemod V3\driver\voicemodvad.inf
Size 6KB
SHA256 66b051ba7ead45d25e7cc4ffce5c29923ca80379ad2b0170c49447043e83b1aa
MD5 227f4b6bd0e10d2c3d84c2793cb0dd9d
SHA1 7f2d1463e37b8694d492ac0e849c81611788beab
SHA512 74988cf579a59283cf8d6c6defc8d27a70835a6072dbbd5d554fbf8f3021ce4e88c76dee04676a065ee31ef00a567c934f88370d39013125acb3963a1c0fee6e
SSDEEP 192:7yAztfwkiJmR1ZpniJoPl5WAegzsArAxgzaUgzcgzO2yStt2XaW8CgQekOzTyM:LtfwtmGelnzFzszRz7ygt2Z8jdB
TLSH
T1B7D145DC195E1C95CB5A81AB581B1A50BE8F61E018D10325F20F6F8EFBDEB8ED294C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-AU0Q4.tmp

Path C:\Program Files\Voicemod V3\is-AU0Q4.tmp
Size 6.0MB
SHA256 c20939627d9d59c1997cb15f9e296dbd6cb7b22542f51a1aa1c778fc61612cd6
MD5 94d1eab48c629ea43b35f88dc481c944
SHA1 de8712ed3b38614c532543a43b1ead5f6f4bb171
SHA512 04c3354a0e03c55bd1369c5db8d5e9f8215b793fb16a986612fd1fad30a2ede962a334d48d3432d04606399d60a3120465ed7526c9f985c4a1d842ddacdb34c6
SSDEEP 49152:2GtlqPnIU6iJVwASOkgvYab/elJzlOVAfTsYW9yoZ60H9tZtz3kYAaInvhHCnEXs:3+qTaaf5eNZ0nZHXX6Aw7fgzB8UIChW
TLSH
T15B568DA9A2BC00DAE47AD1BDC3869223E772751513B057CB6A644BF61F23FD01E7A740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-L7LBO.tmp

Path C:\Program Files\Voicemod V3\is-L7LBO.tmp
Size 2.7MB
SHA256 5c91c4b6e062278af2eea930aa8c56748c2614d2b302e6cb9c76add064b6eeb6
MD5 119211482e369e1f472f8dc84bf079c1
SHA1 9a720c25e96d62dbd915287c62c6b5e669aaae18
SHA512 f7cb5d23e81f1cccce95669f0633c018bd301403a7880711026f12762af23651105ec30e7bb9cc1bdd40d7d67e6947785f96b00c05785a1ae49c939098ec2bac
SSDEEP 49152:OdtbwXp0AlOYG+A9dFVqavvgen9hYAB9qKpmcmYHjIYaK:OdyjWiKpf
TLSH
T1C4D59E1BB6A405BED4BBD238CA074E57E3F2F8560270F74F12A0056E5FAB7624E5A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-SH64S.tmp

Path C:\Program Files\Voicemod V3\is-SH64S.tmp
Size 22KB
SHA256 714e21c1233d5c9ed9fe5cfe662b19abdeec2c28316c3f7ac670c917b5ab8361
MD5 3bd1cf1825429c4d85c03018cf68d29e
SHA1 07d74ce361a14a426f397d4228dfc413ca268f74
SHA512 4e2e33605aa256e02d112b654a6b85b301fcef1449d7161a959189db575770a075eab54f56de21a5445c7e25e0f62e40ee1cd59e4b7aa6fff1a99d0d2c725ed6
SSDEEP 384:LlW3jjvXaPntL1aoNC0ikOIYilOxlmsR8nny8RbmL4nNys/BPN:xIjjeEoNC0iiYil4mFn5ALM
TLSH
T1A1A25E97C9A44C59E8174A30F4D38A2ADDB5BA4517D093CB3318C2665F223C237BE2F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__sentry-breadcrumb1

Path C:\Users\Admin\AppData\Local\Temp\.voicemod-launcher\5052895d-2887-466f-2016-3f3b79042413.run\__sentry-breadcrumb1
Size 1KB
SHA256 56193f9ed02ab7646e4ddaed1db519b738286ebbee08facf77ff1dcda45f7690
MD5 df4ad8fcb6294fe50256ee3f9b21baa7
SHA1 3652c0d27c45bd315e351ee3a4007e0bc52aee7d
SHA512 fa05e333859afbacdcc505accee50ed23a7da8d2374e5e1a366027d8f6420cb272637a32c8cf27c4959ff231318c23241a2522d7e28226a245b0ef4a07a4bc0a
TLSH
T1BC2156483B6494DD2E629A15B03077C49E49FA2F4B12B13A6187013971474C71FB6F5F
MD5 SHA1 SHA512 TLSH

Submit Download

AudioEndPointToolID.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointToolID.err
Size 55B
SHA256 ff609cf5e2bf6ef3e6655e7594f18a73be8a1c6b53433105044da46fb99bb30e
MD5 d6268ce184ad619957a90418c1f5d56f
SHA1 42bffbe0e3c6b9edc79d66cbefc95d7cd703af38
SHA512 ec910b081cfe1363865484496ef5782fb570c9867c574785d109b34775d58c442d16edfc107b7068c221a1dce1610d89a7d816ca92cd8466f905225e5c83475d
TLSH
T1D29002F51440B581E604C740D63D7541F0AC719A40C1023710C85458560626158E164D
MD5 SHA1 SHA512 TLSH

Submit Download

AudioEndPointTool_MULT.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTool_MULT.err
Size 6B
SHA256 f07029b11dd6d731664feea3fe6bcfb4d8b05555e14aca9fe078e63002fb95ac
MD5 8f02b39711ca33b0fef856c74bee2867
SHA1 e8a0f9cd2bfa6b2978df284151faa006c9409559
SHA512 f149517e9dce8051f70e25a81ef09c23e1db3feb0f554585fa33b4b33a1c95ecb6f61c1c42f89270616021b2d4c0e563274a700dbabc5be7d90e9ca2dbd77671
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 9f14025af0065b30e47e23ebb3b491d39ae8ed17d33739e5ff3827ffb3634953
MD5 1c383cd30b7c298ab50293adfecb7b18
SHA1 972a67c48192728a34979d9a35164c1295401b71
SHA512 7a4f07ef7ac81ec31e04d55faffe33bdde93ec2398c338760e0d98adab7ba5acf2c39b2da1782f45e8a5a4d337dedcc647afebddd531782af42bafae98ce7ed5
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 31489056e0916d59fe3add79e63f095af3ffb81604691f21cad442a85c7be617
MD5 67c6a1e7ce56d3d6fa748ab6d9af3fd7
SHA1 827bfc458708f0b442009c9c9836f7e4b65557fb
SHA512 e168c4a2090595d15bca74d0f6ce3cc3babb229d5f657c55dd65984a3ff079e2c784a12bafb1e6085a8658bf8c059db7564629792fcb3df84aceea74c30e3bbe
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 3ada92f28b4ceda38562ebf047c6ff05400d4c572352a1142eedfef67d21e662
MD5 3295c76acbf4caaed33c36b1b5fc2cb1
SHA1 59129aacfb6cebbe2c52f30ef3424209f7252e82
SHA512 3673a16a5983f5f5e04bf88d2c08e39631efe619726c5879d2d6907c00acb5d5689061b28cea52edab7c79dbfb450c961709c36c0d599b526c856e924f57e803
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 1a6562590ef19d1045d06c4055742d38288e9e6dcd71ccde5cee80f1d5a774eb
MD5 c0c7c76d30bd3dcaefc96f40275bdc0a
SHA1 e1822db470e60d090affd0956d743cb0e7cdf113
SHA512 e62b01e8497ab6b7d89432599e21804eca278bb4a9c4b6ef5f7bae00bd5e45ae6c8cf3a18b74296f9a8e69cd2f416a8f41eeb2128f4e280ecf438ffef6244e14
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a
MD5 6f4922f45568161a8cdf4ad2299f6d23
SHA1 9e6a55b6b4563e652a23be9d623ca5055c356940
SHA512 f107ba2da059fa640eccb9533e859a6435f6b83aa2e0636a47444dfdcde33a6e1f3cc1c9437bcfd42675af265a0d0b9d66c86c9e66347aa41534204745e41fb8
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 f74efabef12ea619e30b79bddef89cffa9dda494761681ca862cff2871a85980
MD5 fbd7939d674997cdb4692d34de8633c4
SHA1 d54ad009d179ae346683cfc3603979bc99339ef7
SHA512 bc7dea130d219f9d1097a174eb56df348da86f1080c5e5c1ff9e9ef4c4204640ba01b946f3a2fa8ea8adcf2a099e76ccb58d8632c7c51b1d42c5d4f72ce09413
MD5 SHA1 SHA512

Submit Download

AudioEndPointTrace.err

Path C:\Users\Admin\AppData\Local\Temp\AudioEndPointTrace.err
Size 2B
SHA256 a46e37632fa6ca51a13fe39a567b3c23b28c2f47d8af6be9bd63e030e214ba38
MD5 9778d5d219c5080b9a6a17bef029331c
SHA1 76546f9a641ede2beab506b96df1688d889e629a
SHA512 ef52db28b01e9632cd5969f3ccf502e9e43c33fa30cfa8a0227a07d0dc4be590388da493e42257af4c45fe42a7b702fcd649885eeb92f53c3c115dc661aaecab
MD5 SHA1 SHA512

Submit Download

VoicemodInstaller_1.6.0-zxtpcu.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8ESPO.tmp\VoicemodInstaller_1.6.0-zxtpcu.tmp
Size 2.5MB
SHA256 6af83b4f0b8247e35ae14eed77ef588fc4e1a531f8d952267e42ba2713015aba
MD5 0d53a2a513c63b3138342b2db8914e03
SHA1 3f6c011bd12f245011eafa9f76a841efbfd2dcf7
SHA512 eed458278ce2e9cbcfb6ba5d65f60f4994d4f940c0da3dd72174d680a6bdeb5338793ff6c8c70c45c479f021feab49524232f443a520d87fe52cc3b27b9d6cec
SSDEEP 49152:k/bMELtKnwSaPuqrUJlORnUjzV8VkLwk5:kjMzVPeVCx
TLSH
T102C54B12B284B13FD06A2B35653FC660993FBA6179B38D1B6BF41D0C8F355802F3A656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg-inner.png

Path C:\Users\Admin\AppData\Local\Temp\is-UUV34.tmp\bg-inner.png
Size 6KB
SHA256 8fe4a3f95d5309e692c4142f460bebe4e4e24844f5a2071d466bd964c5d04dcf
MD5 a034eeaf19bb82b2ae63f4fa10c26476
SHA1 617c9ef4b889e424e754574d62649f04c97bcc67
SHA512 c1ffd444da1378620428b374501de974a33e898e38a9d94e88ee5977951aba89fbad033ffbac65051e021fb96dfa9039872f8dc6441de1dfea01c39c8a8ecb20
SSDEEP 192:sSTdK8Lk27YvkgtGwZfgSwPLX51gjmzGj:r48Lk27YMSZIrPLXIck
TLSH
T19CE1AFEAD7970B2830739A902189B07B695FD8723354F315DD3AD30B191A4ECC61F563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg-top.png

Path C:\Users\Admin\AppData\Local\Temp\is-UUV34.tmp\bg-top.png
Size 20KB
SHA256 bdc753b2b19ee8b573b8e676f18dae42494b99b6bd738194dcdd67f244085f36
MD5 220fe6e00519a633d9ad7d1d50adc4c7
SHA1 cfcadd75996d6f1cb42c43480d24e52dd72bd917
SHA512 1f00db2aab3585aff016188f12f953e832d027161076887cde42b99dab581e2396c9bfb919c43e01fd8c823f79a81425238a8c5235b47be55d7dfdcc1d190ec3
SSDEEP 384:P5Z7BD9bMqsjNoUbBj1N/YsHFc9e0UV7Js52F0pTogUm8GhDpy01BtXUIKH5Xb:BZn4q5kBx2sl2+JK2FSTlUm84YqtXv6r
TLSH
T11992E18DB6680FF386C4F03C992BC03BE679FD69986567059A050FD51C627C94DF2A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botva2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-UUV34.tmp\botva2.dll
Size 35KB
SHA256 a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008
MD5 0177746573eed407f8dca8a9e441aa49
SHA1 6b462adf78059d26cbc56b3311e3b97fcb8d05f7
SHA512 d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a
SSDEEP 768:Aoi9qZO9Q4rAJa4debLTMkUuzXIu53w4eGlV:Av9qZMQVGLyu5r3V
TLSH
T180F26B51D9A1C031C085DEBD6D31E21A936F3A201FD64B691A6E5ACCEE4FF03952C2DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

buttons.png

Path C:\Users\Admin\AppData\Local\Temp\is-UUV34.tmp\buttons.png
Size 1KB
SHA256 d236f88ef90e6d0e259a586f4e613b14d4a35f3a704ff559dadda31341e99c24
MD5 87cc673665996a85a404beb1c8466aee
SHA1 df01fc67a739544244a0ddabd0f818bd960bf071
SHA512 2058e3fd362c689a78fb3d0a163fd21bfe472368649c43dc8e48b24fa4bc5ed1307faf1cab2c351a4dd28f903a72d4951a72d7eb27784fee405884661a259c32
TLSH
T11341FC65E38A45BBF034A13935251813A4041C3BB04FEE2545A375AF2363F2ABD31E47
MD5 SHA1 SHA512 TLSH

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-UUV34.tmp\idp.dll
Size 232KB
SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
MD5 55c310c0319260d798757557ab3bf636
SHA1 0892eb7ed31d8bb20a56c6835990749011a2d8de
SHA512 e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
SSDEEP 3072:dnSx3lws+iWbUmJmE8dxMw7r+mjT5PbzEFwyGIyTcHY10tSB9j:IP0bUmQEUr+mRcbTx4N
TLSH
T13434AF00B6CBC073D98F0778842B975C0B7AB95557348ACBEB985DADCD213C2AD371A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

output_ansi.log

Path C:\Users\Admin\AppData\Local\Temp\is-UUV34.tmp\output_ansi.log
Size 226B
SHA256 eabf26695d905ea5150faebf338d8694c2349c444a720d30624d23d946a2787c
MD5 b3ab4f4552b1d64495a0692e0751be20
SHA1 db10686a8d47e3a5003be14159cd86cc750232d9
SHA512 dd27879f682296986e99d79eb7e4391da55000009dfde796689d80ab412c7001c8e3109272e504e0969a5b319cd86dd35a5934683c7f7b09131228d6d0cddd26
TLSH
T1D6D0A9ECC42401010CA4B3E6381ED5188BD4A1A082B8D230B78F019AE78E204D0300BE
MD5 SHA1 SHA512 TLSH

Submit Download

tasklist_unins000.exe.txt

Path C:\Users\Admin\AppData\Local\Temp\tasklist_unins000.exe.txt
Size 7KB
SHA256 cb67eb5ce74cd2d5398eb4a7d3000b90836bf86831ed13a12017ba085e2265ef
MD5 f442e560ecb476d4587deda56baed04a
SHA1 215788c48afbbb2705c98ddfdfffb890950e2081
SHA512 98606cc4afc3a592672f74dc26c5fb1881bca4195a6f8a476a2c241f65ed1b34ad227e70775f019a8dcff8ee49bf65c8200fce0264f627f555fcc9181e4782c1
SSDEEP 192:fYvzhIeFND215k0AJKw45SNw3vHv4b9ax7nsQFgadA+1RcD8PdMN29bCNVx/oQ7h:fYvzhIeFND215k0AJKw45SNw3vP4b9a8
TLSH
T154E10085889F85FC962DD3983A230002EB4E5500316AADD97ADE14EC37E5F1CE7EF960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemodcon.err

Path C:\Users\Admin\AppData\Local\Temp\voicemodcon.err
Size 2B
SHA256 c837649cce43f2729138e72cc315207057ac82599a59be72765a477f22d14a54
MD5 72b32a1f754ba1c09b3695e0cb6cde7f
SHA1 9109c85a45b703f87f1413a405549a2cea9ab556
SHA512 a2f4521450ffa4a0ec674bd6ee1bfe0e936c620adb73e0de1c16b0bd62fc03df62433f9a2ee12bd15c1fc21c888b5de9062311cba437c788ad530dc803366324
MD5 SHA1 SHA512

Submit Download

voicemodcon.err

Path C:\Users\Admin\AppData\Local\Temp\voicemodcon.err
Size 2B
SHA256 3e1e967e9b793e908f8eae83c74dba9bcccce6a5535b4b462bd9994537bfe15c
MD5 093f65e080a295f8076b1c5722a46aa2
SHA1 5a5b0f9b7d3f8fc84c3cef8fd8efaaa6c70d75ab
SHA512 c45d027d446112379f9dcb9a9e84763c84ffa7533632ae255fb9d5134d54171769a5906366091b39ae680484eabc9a3a08ca58e980419f03d86b11b345778335
MD5 SHA1 SHA512

Submit Download

voicemodcon.err

Path C:\Users\Admin\AppData\Local\Temp\voicemodcon.err
Size 2B
SHA256 59e19706d51d39f66711c2653cd7eb1291c94d9b55eb14bda74ce4dc636d015a
MD5 33e75ff09dd601bbe69f351039152189
SHA1 0a57cb53ba59c46fc4b692527a38a87c78d84028
SHA512 edbd48c836f826b5ed8d62b401cd19674ef1b8627b9c68a4639819a8564f57426c632b7c1d3dee8209c48c2396da0a3a08d160617f7291a1186ca6d9de5db272
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 df67d71aafd1a3bc4372b55d6d6f4483ede5a325eb1a276b95d0295f3ff4a9c4
MD5 0b4cdb35f82431ebb7c059a0ca9a689f
SHA1 3e62948e6b71f2a63924ba16125a8ec3aa231aea
SHA512 61a46a10d924a2938755d6c68714767201ffc8a82cbe3dea9aeacfd9ad5452b7eba745c5fd9cc6807799885aff93104fb1d170d2c52f2eeabc1743ea69b0694f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4264b4b55832e20a0114e39b84e41e7a5e97852f755a528708ebd5326e102bf4
MD5 98d8a72fda2a36f756b10e8aceb550ec
SHA1 69ca85d7bdf9b4a8f2cb4e7b89a61ddcd569d7ac
SHA512 acd8fec95256a8f4db1ed37fe6f7efa65e5056fd06df0969ef73e984407cb005f14a86ea06b457649131e0e84ae102da13fc79c7a77bf1d4ad969e85d71cd152
TLSH
T142D0122236810634D02021330442A10D0401C60F80064001543FC57E2A040900A174B1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 865395e9a27d317ad114952d4a60a01dad86b4ad45072cb35cb011fd6446837e
MD5 e0362f3a14aaeab642cce6d072a45627
SHA1 5ff3a5d37b890b66fef7757d25ee7e929926dd85
SHA512 e187c52c3b7777c96267123ca8f4b06da486fb103ffde035dafb2c55a1bddc3781ad1678447474c21cd40b681c2636106b1508f139e6a041f67dfa115a3daed6
SSDEEP 96:sto/dPZBdwb9HkqDo5h16ZVRos7/x+6Mhmuect0Dj0jeEK+gQJ3eI8XM1C7K:stMP61oSWsV+FB0D4jgOkg6K
TLSH
T1B8D19301AE34A97B4CCAE119FA35BB13E2F9606264D51E58EBF8852C04DB6DC6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5b05aa.TMP

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Preferences~RFe5b05aa.TMP
Size 6KB
SHA256 c54077e7ac4351fd485a90c64b912940cd2557e0bec566c6138a41a92fa54b15
MD5 7016c5c5241cc172f9ed0d0a343df0c2
SHA1 37f199e22590882ea47952f48eb19b36ec59217e
SHA512 cf4dbf9878747bc908ba7160c208184a4108748519ccbda2257bf6d1243da23603f875cab8a092a46e3b08173e784295c82b89d73cdc62e7ea6719b271c50ea1
SSDEEP 96:sto/dPZBdwb9HkNdo5h16ZVRos7/x+6MhmuectRudx1ejeEK+gQRfQ28XM1C7K:stMP6goSWsV+FBsLQjgOyG6K
TLSH
T197D185016E34B97B4CCAE119FA25BA17D2F9A06265D51D58EBF8862C04DB6DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State
Size 15KB
SHA256 37db3178f733037cd9ea0e9100faaa2666bd51466646635facbc27d9eb109bd2
MD5 36d1f5ca221c36260319f50789deb47f
SHA1 1717f9f97912e9b6530b4f2b97ce42d9fb092700
SHA512 1f13cd72085e7670fe95bd48cc967e47422686f65ee2df38a189350a30a499a1ea4fe971aee9e59683dcc55acfcd11dee74040cae7e28146eecefc19723f908c
SSDEEP 384:X+aQikB+z/xvxjg/qhEwNBSUM8PqDWah8w7N9zd:m/UxvxjgC+Xaw7NFd
TLSH
T1CB729E3F55B97E23A5F7E654B94D0B8BDBB8947250C26E784AE95F0906C73A81303C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State
Size 16KB
SHA256 b9e1395038d03072685e037bc5710b2985a2148bfb8cf0a950aa4e34f8efa78e
MD5 7016a77cc60198ba723f63afd014e006
SHA1 545deee78fa30c5a777c36a316d598f95d9c054b
SHA512 690a7f9d707c329453a20b9193fc3ac92a4f0b12810aab31f88baf2d436486488cffd61e545522d1d6897d416d3bd59adcc2c2210b583713aa7c8384bfe42411
SSDEEP 384:w+aQikB+z/xvxjg/qhE93NBSUM8HyDWgh8w7N9zd:P/UxvxjgC+9Ia67NFd
TLSH
T197729E3B59B97E33A5F7E505B9590B8BCBBC947250C26E7849E94F0D06C73A81303C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State
Size 2KB
SHA256 2bdb2b8ceaa46268780dad2c40b11e4a76535a03ce1e7b438e0b8df8f59ab604
MD5 fb22be3388aed2dd7c5689c01243d8f3
SHA1 96aded45b77162b6d2ec7aafd285b4746e9b4c2b
SHA512 ab5b000e084ffe981fd8cdfc06204652ab9c9c27319c05f259a230436a3ea23e8e76e33a118b823c9ed48fa2d2668fd0b7401236ba6e35f45c3792832d7104f4
TLSH
T19851953369606A3788B74609BA463F67CA7950B5AE962F109ADC0B0C01C755D6317C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State
Size 3KB
SHA256 cd86e878d459585a0247b9f3e1c793dc7522bdd0bf2eeb4064661bdce007c923
MD5 1b072374614abb8eef358d7bbe6e9685
SHA1 7dcc571bf7f0220872e1f254166ead96dd50ee65
SHA512 99830410befe14a96c6a67bd2113da0c79d53639e7e9bd5540b19aafcc9d286f322d827b44f08e3426c5481dc78c0e6f1e5b41c3fdfe0e36580028e5994106d2
TLSH
T10A71933B69B0A9378DB39A05B9853B57A7A55037E9C93F64DAEC0E0C01C729C2353C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5ab567.TMP

Path C:\Users\Admin\AppData\Roaming\Voicemod.exe\EBWebView\Local State~RFe5ab567.TMP
Size 1KB
SHA256 079ef9664147eee7b070e7b4c15c5ad1be0adc1cf053fb3a61f7ea22ede7c35f
MD5 d8c983ee897502f9d73fad27b37c693f
SHA1 4727ffbeaf8baf80499c28e775a3910beb760573
SHA512 ed818cf4f88de77285c3c4172d1ad0ad867ea93991fc7faeca30a8dae3ae010b67b5d21ddb5b676593f9699fc2104fb4a91dba1b31721d355e5d500730d8d32d
TLSH
T1F9317672EAE02A729CA76247B2417BDB9F6010BEC6854F0466CD461D02D744DE63BC37
MD5 SHA1 SHA512 TLSH

Submit Download

VOICEM~1.SYS

Path \??\c:\PROGRA~1\VOICEM~1\driver\VOICEM~1.SYS
Size 91KB
SHA256 93f72a9c74e6e49c50f3fc789bb10ebc72fa5fc85a26278d9a0df73cfa0a798e
MD5 b737e525c05d48882d75c193109d1aa2
SHA1 4e1b6ad6d5dc5713dd3d34c94d18dc0067fffa7b
SHA512 c1c08579b1f9c7ed5d7a52c4acd5c9751764dbb2080171cd91dc4798c6ccc67d65c5b5fcd6a2474be7191c320647b51fd9ba1f7b32a46bc3a836b00cc977e7ae
SSDEEP 1536:UvMCZhRYLplR61Pv20jhbb8vgci/7VGSKjL64enp8KSM5o7lxvxwez/1NK:wM6+PsVUH64eeKzuBx5Tz3K
TLSH
T1FD936B8A73E814D5D1AAD17481E6865BEBB1F04217138BCF0260C76E4F27FE59E39368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

voicemodvad.cat

Path \??\c:\program files\voicemod v3\driver\voicemodvad.cat
Size 11KB
SHA256 9d33bc81b59c398fc329d61c0698c1907c64aab8d9774cfc4f5d87a8787613d6
MD5 f4099661e8db182c38a72da97dfa664f
SHA1 ed4d981b76f2ca66acffd393a3d0d6832e6bcfef
SHA512 3a4457ade6ea34883e946b2677b79b27fcec4a681ba23c18513d80b76449146ff4794dae3ab99a110f8fe06bfe2002d07d371d67b4386bb3051e80f0d568ebbf
SSDEEP 192:mQmIiUfo0JCPZ2CEwLJ+hYCi0FiWY8u27X01k9z3AM/NYGa3:MU3QL+h3yo7R9z//NYGa
TLSH
T1B14218E1496C51C2FCA7AC6063E8FA437C3D23CB5810056A16AEF6190EA33C5FB2817D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-0-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/108-12-0x0000000000400000-0x00000000004DB000-memory.dmp

Download

memory/1424-233-0x00000265116B0000-0x00000265116B8000-memory.dmp

Download

memory/1424-215-0x00000265116A0000-0x00000265116AA000-memory.dmp

Download

memory/1424-235-0x00000265298C0000-0x00000265298CA000-memory.dmp

Download

memory/1424-204-0x0000026511670000-0x000002651168E000-memory.dmp

Download

memory/1424-205-0x00000265297D0000-0x0000026529882000-memory.dmp

Download

memory/1424-206-0x0000026511690000-0x000002651169A000-memory.dmp

Download

memory/1424-211-0x0000026529890000-0x00000265298AE000-memory.dmp

Download

memory/1424-199-0x00000265115C0000-0x00000265115E2000-memory.dmp

Download

memory/1424-219-0x00000265298D0000-0x00000265298EC000-memory.dmp

Download

memory/1424-234-0x00000265298B0000-0x00000265298B6000-memory.dmp

Download

memory/3224-954-0x000001AC1C340000-0x000001AC1C3E7000-memory.dmp

Download

memory/3224-700-0x00007FF854860000-0x00007FF854861000-memory.dmp

Download

memory/4372-953-0x0000021583E40000-0x0000021583EE7000-memory.dmp

Download

memory/4372-612-0x00007FF854860000-0x00007FF854861000-memory.dmp

Download

memory/4508-572-0x0000000180000000-0x000000018002D000-memory.dmp

Download

memory/4672-112-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/4672-86-0x0000000003F10000-0x0000000004050000-memory.dmp

Download

memory/4672-104-0x00000000040B0000-0x00000000040BE000-memory.dmp

Download

memory/4672-103-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/4672-96-0x0000000003F10000-0x0000000004050000-memory.dmp

Download

memory/4672-101-0x0000000003F10000-0x0000000004050000-memory.dmp

Download

memory/4672-91-0x0000000003F10000-0x0000000004050000-memory.dmp

Download

memory/4672-81-0x0000000003F10000-0x0000000004050000-memory.dmp

Download

memory/4672-928-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/4672-107-0x00000000040B0000-0x00000000040BE000-memory.dmp

Download

memory/4672-106-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/4672-109-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/4672-27-0x00000000040B0000-0x00000000040BE000-memory.dmp

Download

memory/4672-14-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/4672-13-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/4672-115-0x0000000000400000-0x0000000000697000-memory.dmp

Download

memory/4672-6-0x0000000002470000-0x0000000002471000-memory.dmp

Download

memory/4672-164-0x0000000000400000-0x0000000000697000-memory.dmp

Download