Overview

overview

8

Static

static

1

VoicemodSetup.exe

windows10-2004-x64

8

VoicemodSetup.exe

windows11-ltsc_2024-x64

4

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/10/2026, 15:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VoicemodSetup.exe
  • Size 22.2MB
  • Sample261012-swdtpsb16x
  • SHA256 afd7452c34570e409fc0c2bc8a22fb7429a3cc8f48e85fe6a154656ec020330d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • ConfuserEx .NET packer 4 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 17 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Users\Admin\AppData\Local\Temp\is-4SSF1.tmp\VoicemodSetup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4SSF1.tmp\VoicemodSetup.tmp" /SL5="$402E8,22991991,87040,C:\Users\Admin\AppData\Local\Temp\VoicemodSetup.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5932
      • C:\Users\Admin\AppData\Local\Temp\is-TAGT6.tmp\vc_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-TAGT6.tmp\vc_redist.x64.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1608
        • C:\Windows\Temp\{A13E1EE2-1DA7-45DB-85BD-502DD656277B}\.cr\vc_redist.x64.exe
          "C:\Windows\Temp\{A13E1EE2-1DA7-45DB-85BD-502DD656277B}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-TAGT6.tmp\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3012
      • C:\Users\Admin\AppData\Local\Temp\is-TAGT6.tmp\vc_redist.x86.exe
        "C:\Users\Admin\AppData\Local\Temp\is-TAGT6.tmp\vc_redist.x86.exe" /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5824
        • C:\Windows\Temp\{670CC8F3-12DA-4AB7-ADE4-3A531294FDB7}\.cr\vc_redist.x86.exe
          "C:\Windows\Temp\{670CC8F3-12DA-4AB7-ADE4-3A531294FDB7}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-TAGT6.tmp\vc_redist.x86.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5636
      • C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe
        "C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe" defaultdevices.txt
        3⤵
        • Executes dropped EXE
        PID:2600
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\Voicemod Desktop\driver\setupDrv.bat""
        3⤵
        • Drops file in Program Files directory
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5168
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "devcon.exe dp_enum"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1660
          • C:\Program Files\Voicemod Desktop\driver\devcon.exe
            devcon.exe dp_enum
            5⤵
            • Drops file in Windows directory
            • Executes dropped EXE
            PID:4624
        • C:\Program Files\Voicemod Desktop\driver\devcon.exe
          devcon install vmdrv.inf *VMDriver
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:4308
        • C:\Program Files\Voicemod Desktop\driver\devcon.exe
          devcon update vmdrv.inf *VMDriver
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:4964
      • C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
        "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2028
  • C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
    "C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Windows\system32\cmd.exe
      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-alien-vocoder*.wav
      2⤵
        PID:5228
      • C:\Windows\system32\cmd.exe
        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-background*.wav
        2⤵
          PID:1828
        • C:\Windows\system32\cmd.exe
          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-android-vocoder*.wav
          2⤵
            PID:4756
          • C:\Windows\system32\cmd.exe
            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-aphonic-vocoder*.wav
            2⤵
              PID:3920
            • C:\Windows\system32\cmd.exe
              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-beach*.wav
              2⤵
                PID:5052
              • C:\Windows\system32\cmd.exe
                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-capella*.wav
                2⤵
                  PID:3376
                • C:\Windows\system32\cmd.exe
                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-reggae*.wav
                  2⤵
                    PID:4704
                  • C:\Windows\system32\cmd.exe
                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-birthday-rock*.wav
                    2⤵
                      PID:224
                    • C:\Windows\system32\cmd.exe
                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cave*.wav
                      2⤵
                        PID:5028
                      • C:\Windows\system32\cmd.exe
                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-chase*.wav
                        2⤵
                          PID:3696
                        • C:\Windows\system32\cmd.exe
                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cop-radio*.wav
                          2⤵
                            PID:1620
                          • C:\Windows\system32\cmd.exe
                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background*.wav
                            2⤵
                              PID:4720
                            • C:\Windows\system32\cmd.exe
                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-fear-background-in*.wav
                              2⤵
                                PID:2124
                              • C:\Windows\system32\cmd.exe
                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-background*.wav
                                2⤵
                                  PID:2888
                                • C:\Windows\system32\cmd.exe
                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-franky-vocoder*.wav
                                  2⤵
                                    PID:516
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-background*.wav
                                    2⤵
                                      PID:2760
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-ghost-vocoder*.wav
                                      2⤵
                                        PID:704
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-harmony-vocoder*.wav
                                        2⤵
                                          PID:3996
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-in*.wav
                                          2⤵
                                            PID:2984
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-hurry-up-loop*.wav
                                            2⤵
                                              PID:3656
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-bee*.wav
                                              2⤵
                                                PID:944
                                              • C:\Windows\system32\cmd.exe
                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-growl*.wav
                                                2⤵
                                                  PID:6140
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-leopard*.wav
                                                  2⤵
                                                    PID:4732
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-kong-tiger*.wav
                                                    2⤵
                                                      PID:2820
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-magic-chords-vocoder*.wav
                                                      2⤵
                                                        PID:4948
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-background*.wav
                                                        2⤵
                                                          PID:4264
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-party-time-vocoder*.wav
                                                          2⤵
                                                            PID:4532
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-possessed-background*.wav
                                                            2⤵
                                                              PID:2816
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-background*.wav
                                                              2⤵
                                                                PID:5244
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-robot-vocoder*.wav
                                                                2⤵
                                                                  PID:3676
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-paris*.wav
                                                                  2⤵
                                                                    PID:1448
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-romantic-ulala*.wav
                                                                    2⤵
                                                                      PID:804
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-santa-background*.wav
                                                                      2⤵
                                                                        PID:5064
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sleepyhead*.wav
                                                                        2⤵
                                                                          PID:5588
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            3⤵
                                                                              PID:1096
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spacemen-background*.wav
                                                                            2⤵
                                                                              PID:3616
                                                                            • C:\Windows\system32\cmd.exe
                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-ovation-background*.wav
                                                                              2⤵
                                                                                PID:5024
                                                                              • C:\Windows\system32\cmd.exe
                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-speechifier-protest-background*.wav
                                                                                2⤵
                                                                                  PID:1992
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-background*.wav
                                                                                  2⤵
                                                                                    PID:2324
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-spirit-vocoder*.wav
                                                                                    2⤵
                                                                                      PID:3512
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-action-background*.wav
                                                                                      2⤵
                                                                                        PID:5292
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-drama-background*.wav
                                                                                        2⤵
                                                                                          PID:2348
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-storyteller-happy-background*.wav
                                                                                          2⤵
                                                                                            PID:3376
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-hall*.wav
                                                                                            2⤵
                                                                                              PID:4616
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-student-playtime*.wav
                                                                                              2⤵
                                                                                                PID:4396
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-sword-background*.wav
                                                                                                2⤵
                                                                                                  PID:3476
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-underwater*.wav
                                                                                                  2⤵
                                                                                                    PID:5216
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-1*.wav
                                                                                                    2⤵
                                                                                                      PID:3776
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-2*.wav
                                                                                                      2⤵
                                                                                                        PID:3816
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-3*.wav
                                                                                                        2⤵
                                                                                                          PID:3100
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-counter-4*.wav
                                                                                                          2⤵
                                                                                                            PID:812
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-1*.wav
                                                                                                            2⤵
                                                                                                              PID:3276
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-2*.wav
                                                                                                              2⤵
                                                                                                                PID:1824
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-3*.wav
                                                                                                                2⤵
                                                                                                                  PID:2568
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-walkie-terror-4*.wav
                                                                                                                  2⤵
                                                                                                                    PID:2616
                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                      3⤵
                                                                                                                        PID:704
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-background*.wav
                                                                                                                      2⤵
                                                                                                                        PID:5032
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder*.wav
                                                                                                                        2⤵
                                                                                                                          PID:2184
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-zombie-vocoder2*.wav
                                                                                                                          2⤵
                                                                                                                            PID:2244
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cooltune-vocoder*.wav
                                                                                                                            2⤵
                                                                                                                              PID:1984
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-punk-vocoder*.wav
                                                                                                                              2⤵
                                                                                                                                PID:4680
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx01*.wav
                                                                                                                                2⤵
                                                                                                                                  PID:4624
                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                    3⤵
                                                                                                                                      PID:4732
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx02*.wav
                                                                                                                                    2⤵
                                                                                                                                      PID:4760
                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                        3⤵
                                                                                                                                          PID:2820
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx03*.wav
                                                                                                                                        2⤵
                                                                                                                                          PID:5488
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx04*.wav
                                                                                                                                          2⤵
                                                                                                                                            PID:616
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx05*.wav
                                                                                                                                            2⤵
                                                                                                                                              PID:4532
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx06*.wav
                                                                                                                                              2⤵
                                                                                                                                                PID:4464
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx07*.wav
                                                                                                                                                2⤵
                                                                                                                                                  PID:2816
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx08*.wav
                                                                                                                                                  2⤵
                                                                                                                                                    PID:988
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx09*.wav
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5416
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx10*.wav
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4376
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx11*.wav
                                                                                                                                                        2⤵
                                                                                                                                                          PID:816
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx12*.wav
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5152
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx13*.wav
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5064
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx14*.wav
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6128
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx15*.wav
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1184
                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3320
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar1*.wav
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1384
                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5024
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar2*.wav
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5296
                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3920
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar3*.wav
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1420
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar4*.wav
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1540
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5052
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar5*.wav
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4716
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-roar6*.wav
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5960
                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2348
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky1*.wav
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:6008
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky2*.wav
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4616
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky3*.wav
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3432
                                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4396
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky4*.wav
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:936
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-poison-sticky5*.wav
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-exo*.wav
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3776
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-gameover-amb*.wav
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6136
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-outofrange*.wav
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5372
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder1*.wav
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder2*.wav
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4608
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-blocks-vocoder3*.wav
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5904
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part1*.wav
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:5808
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-titan-background-part2*.wav
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:5912
                                                                                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3276
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx16*.wav
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1764
                                                                                                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:516
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx17*.wav
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:2568
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx18*.wav
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1712
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx19*.wav
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1576
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-custom-fx20*.wav
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:3312
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-bass*.wav
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:4016
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-octava*.wav
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:176
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-quinta*.wav
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:2720
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        cmd /C del /Q C:\ProgramData\Voicemod\Temp\sdk-cybertune-tercera*.wav
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3128
                                                                                                                                                                                                                                        • C:\Windows\System32\control.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\control.exe" "C:\Windows\System32\mmsys.cpl",
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:5416
                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\mmsys.cpl",
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                              PID:4376
                                                                                                                                                                                                                                          • C:\Windows\System32\control.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\control.exe" "C:\Windows\System32\mmsys.cpl",
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\mmsys.cpl",
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4476
                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                              PID:4600
                                                                                                                                                                                                                                              • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8217c724-f43e-ab42-bfbd-7c0b2e46ca05}\vmdrv.inf" "9" "499a51a03" "0000000000000134" "WinSta0\Default" "0000000000000158" "208" "c:\program files\voicemod desktop\driver"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                              • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000134"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                PID:3320
                                                                                                                                                                                                                                              • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11e5016dc2:VOICEMOD_Driver:11.18.35.982:*vmdriver," "499a51a03" "0000000000000174"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                PID:2056
                                                                                                                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                              C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:4756
                                                                                                                                                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x4b4 0x568
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:400

                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                      Windows Command Shell

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1059.003

                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                      Indicator Removal

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1070

                                                                                                                                                                                                                                                      File Deletion

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1070.004

                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                      Subvert Trust Controls

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1553

                                                                                                                                                                                                                                                      Install Root Certificate

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1553.004

                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1016

                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                      VoicemodDesktop.exe
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe
                                                                                                                                                                                                                                                      • Size 2.8MB
                                                                                                                                                                                                                                                      • SHA256 d2a3683c8078509b09d97da2d190dc9c19f52d22003e31bf29e352beb611be91
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      VoicemodDesktop.exe.config
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\VoicemodDesktop.exe.config
                                                                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                                                                      • SHA256 71245f7de6f8cd1855194be81c191f8435fbe62b780f40fadfbce1efabb21f44
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      SaveDefaultDevices.exe
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\driver\SaveDefaultDevices.exe
                                                                                                                                                                                                                                                      • Size 149KB
                                                                                                                                                                                                                                                      • SHA256 663e5b184648639cbcf353ddaeec6688abe323dbccf8de8fc8d2683f5e1a99cb
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      devcon.exe
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\driver\devcon.exe
                                                                                                                                                                                                                                                      • Size 103KB
                                                                                                                                                                                                                                                      • SHA256 4bee65c38784c64888c12dc35fc706051dcdb32b4949766e83ad260096601812
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      setupDrv.bat
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\driver\setupDrv.bat
                                                                                                                                                                                                                                                      • Size 110B
                                                                                                                                                                                                                                                      • SHA256 8d0ee2177712918bde4be1fdba8d87815863d864a993a3361459ce194131f6a3
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      uninstalldriver.bat
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\driver\uninstalldriver.bat
                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                      • SHA256 883f7763a00f6419f7acc21a1772077e16b432dd1b6d15ba092a3a3a19667bc3
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      vmdrv.inf
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\driver\vmdrv.inf
                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                      • SHA256 fdc1514450a4eac615d959e17e527c6d69cfe92871626b39bc38a096a439a45d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Fleck.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\Fleck.dll
                                                                                                                                                                                                                                                      • Size 43KB
                                                                                                                                                                                                                                                      • SHA256 65ae6fc064fe4e079fd7a462b79694b22275307723e0127dfe5c33132d30f902
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Hardcodet.Wpf.TaskbarNotification.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\Hardcodet.Wpf.TaskbarNotification.dll
                                                                                                                                                                                                                                                      • Size 43KB
                                                                                                                                                                                                                                                      • SHA256 f84935be717e1c49a54c1d7f8476243a4d34c0ea90c4ad13afe3f50164ba5f2e
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      Newtonsoft.Json.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\Newtonsoft.Json.dll
                                                                                                                                                                                                                                                      • Size 638KB
                                                                                                                                                                                                                                                      • SHA256 973fd70ce48e5ac433a101b42871680c51e2feba2aeec3d400dea4115af3a278
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      RawInputProcessor.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\RawInputProcessor.dll
                                                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                                                      • SHA256 ee069a485d30cebc1c56f25d2c1b418c13bf685065f1a3c2976bbec42f5b53b9
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      SharpDX.RawInput.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\SharpDX.RawInput.dll
                                                                                                                                                                                                                                                      • Size 24KB
                                                                                                                                                                                                                                                      • SHA256 727e4f5e311b1f582bc89ae9e2c3cd585b7952c433b6e7656521bac05811f651
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      SharpDX.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\SharpDX.dll
                                                                                                                                                                                                                                                      • Size 260KB
                                                                                                                                                                                                                                                      • SHA256 28437b8f6036224b187f6ec324af9cd8f20dc5e363b0341f86869e4172f07909
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      SimpleConverter.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\SimpleConverter.dll
                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                      • SHA256 f6d536162aed7f088b7d7d4bd18f33373f912cf6c3c2699cd7703ea2eef05cbe
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      VoicemodControls.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\VoicemodControls.dll
                                                                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                                                                      • SHA256 f99f25bdfa5ea1a40fc219738ea3e56657a2119bd9d07c3961a168a72ab37f9e
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      VoicemodLogger.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\VoicemodLogger.dll
                                                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                                                      • SHA256 8f2c68dd604321d09343b5566b74d72527e78ad717fc41e91d48ce931a8eedb0
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      VoicemodSDKDotNET.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\VoicemodSDKDotNET.dll
                                                                                                                                                                                                                                                      • Size 22.4MB
                                                                                                                                                                                                                                                      • SHA256 0286fcd7d25ae394323ce46b23d800f966e4da4d8441d51d6d74f3943cd69b0f
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      VoicemodShockets.dll
                                                                                                                                                                                                                                                      • Path C:\Program Files\Voicemod Desktop\lib\VoicemodShockets.dll
                                                                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                                                                      • SHA256 3c560d555221dc58b10de2edbedab07541b9673e686279c883ee955646096f2c
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sdk-custom-fx01_44100.wav
                                                                                                                                                                                                                                                      • Path C:\ProgramData\Voicemod\Temp\sdk-custom-fx01_44100.wav
                                                                                                                                                                                                                                                      • Size 524KB
                                                                                                                                                                                                                                                      • SHA256 4312292ed70789b7bbc6363df24ef91f98f19ad47d7458af2468031da23f0a24
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sdk-custom-fx01.dat
                                                                                                                                                                                                                                                      • Path C:\ProgramData\Voicemod\VoiceData\sdk-custom-fx01.dat
                                                                                                                                                                                                                                                      • Size 136KB
                                                                                                                                                                                                                                                      • SHA256 053c5a457729cf059c6bf023fc693246635b147040066e0953f5b5e119e68037
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      sdk-walkie-counter-4.dat
                                                                                                                                                                                                                                                      • Path C:\ProgramData\Voicemod\VoiceData\sdk-walkie-counter-4.dat
                                                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                                                      • SHA256 0f3bb0392ec3aae177be7fd75e6a2b8e4118c5f5659543c4f9ef2bcc1e0dfe09
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                                      • Size 471B
                                                                                                                                                                                                                                                      • SHA256 f1ab9f9a8f4ec826ac497772938e7dbae8ec891d5420aacdd4cdb57e2a8da9c3
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                                      • Size 471B
                                                                                                                                                                                                                                                      • SHA256 3aab327b148bfcb79a8c46ce1a4f6d9a392d2958f008d9b10d6daa94328e7bef
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
                                                                                                                                                                                                                                                      • Size 396B
                                                                                                                                                                                                                                                      • SHA256 d13022fbd88e5212ec2db65f82df968749f330e21c83acdc44728be59f76fcbe
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_51A881270F6155CF26F60F8639C44CB6
                                                                                                                                                                                                                                                      • Size 408B
                                                                                                                                                                                                                                                      • SHA256 86671596d4d74500e12247ff9f6eef5c0bea480ed2fc54bfca2db3f413a14bf9
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      VoicemodDesktop.exe.log
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\VoicemodDesktop.exe.log
                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                      • SHA256 d3042c73e34b33a183064b62348c0ed2931768ec0576bf51f3327f9dba085869
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      VoicemodSDK.dll
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\VoicemodSDKDotNET.Amd64.1.3.0.7\VoicemodSDK.dll
                                                                                                                                                                                                                                                      • Size 22.3MB
                                                                                                                                                                                                                                                      • SHA256 e3dea719f31d200f4e9719d5a8e7e34ff385652bec82c2ee7fbbc48ac888fa1b
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      VoicemodSetup.tmp
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-4SSF1.tmp\VoicemodSetup.tmp
                                                                                                                                                                                                                                                      • Size 737KB
                                                                                                                                                                                                                                                      • SHA256 326071c6e04b3552414337cea066d809d987dbddbc8ad717626abc9dff748956
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      idp.dll
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-TAGT6.tmp\idp.dll
                                                                                                                                                                                                                                                      • Size 216KB
                                                                                                                                                                                                                                                      • SHA256 e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      vc_redist.x64.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-TAGT6.tmp\vc_redist.x64.exe
                                                                                                                                                                                                                                                      • Size 14.6MB
                                                                                                                                                                                                                                                      • SHA256 7cf24eba2bd67ea6229b7dd131e06f4e92ebefc06e36fe401cdd227d7ed78264
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      vc_redist.x86.exe
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-TAGT6.tmp\vc_redist.x86.exe
                                                                                                                                                                                                                                                      • Size 14.0MB
                                                                                                                                                                                                                                                      • SHA256 251640e8039d34290133b2c6e3e6fe098e61e2756d5a4c45fdcec9e4dee6c187
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      SET7102.tmp
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{8217c724-f43e-ab42-bfbd-7c0b2e46ca05}\SET7102.tmp
                                                                                                                                                                                                                                                      • Size 44KB
                                                                                                                                                                                                                                                      • SHA256 1f6cbdc32658ffcf48f6a037302f96c515febe16b459eeddd9c5624d5be91182
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      2ruf3lok.newcfg
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\2ruf3lok.newcfg
                                                                                                                                                                                                                                                      • Size 1001B
                                                                                                                                                                                                                                                      • SHA256 576e70c2ea37ee70a05138464d48406248b331e377653a8c8a7991ae02208fda
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      c45ekhcp.newcfg
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\c45ekhcp.newcfg
                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                      • SHA256 c0fea32e30769d5dc1abb1475d89e196dc56759eccd7219f23846f6d9936cf98
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      user.config
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\user.config
                                                                                                                                                                                                                                                      • Size 332B
                                                                                                                                                                                                                                                      • SHA256 733e489330d34542d6f8eca88b68115b6611f7cc4c44abe8433fe190784fce2d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      vjcaf0zd.newcfg
                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Voicemod\VoicemodDesktop.exe_Url_5eqzat5j1vvntgkq3ppydjqwsvipp05p\1.2.6.8\vjcaf0zd.newcfg
                                                                                                                                                                                                                                                      • Size 580B
                                                                                                                                                                                                                                                      • SHA256 1551dd11ef2a6dd31557ece197d2db5d1a54ba79a71436824f3d6c0a976eda33
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      license.rtf
                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{21B97540-737A-41A8-B4F0-7E2B003782CD}\.ba\1049\license.rtf
                                                                                                                                                                                                                                                      • Size 192KB
                                                                                                                                                                                                                                                      • SHA256 1da651a2fdb9f534d42bdf19a011c7741aca410a898d4cde921bc4058a0b589e
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      logo.png
                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{21B97540-737A-41A8-B4F0-7E2B003782CD}\.ba\logo.png
                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                      • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      wixstdba.dll
                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{21B97540-737A-41A8-B4F0-7E2B003782CD}\.ba\wixstdba.dll
                                                                                                                                                                                                                                                      • Size 215KB
                                                                                                                                                                                                                                                      • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      vc_redist.x86.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{670CC8F3-12DA-4AB7-ADE4-3A531294FDB7}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                                                      • Size 917KB
                                                                                                                                                                                                                                                      • SHA256 8440d4640ee1eee29b31a85c1c05f6106b907a2967a2902570d53996230f9571
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      vc_redist.x64.exe
                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{A13E1EE2-1DA7-45DB-85BD-502DD656277B}\.cr\vc_redist.x64.exe
                                                                                                                                                                                                                                                      • Size 917KB
                                                                                                                                                                                                                                                      • SHA256 8c13a649c567be84e4e3a262689f6b59dcde3e9f8b0037869710fc693b2bc0ff
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      license.rtf
                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{BECB194D-C334-48E9-B579-1D12EF2E4D1D}\.ba\1031\license.rtf
                                                                                                                                                                                                                                                      • Size 137KB
                                                                                                                                                                                                                                                      • SHA256 442ad9e5b34d2a0aee3cd0450af51c6638a23ebd9771914428794bb8d4396a4d
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      license.rtf
                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{BECB194D-C334-48E9-B579-1D12EF2E4D1D}\.ba\license.rtf
                                                                                                                                                                                                                                                      • Size 147KB
                                                                                                                                                                                                                                                      • SHA256 847dac67446d342dbe6bfb4e155f8cdaf87d06145e31e0976f6100453a317d3f
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      thm.wxl
                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{BECB194D-C334-48E9-B579-1D12EF2E4D1D}\.ba\thm.wxl
                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                      • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      thm.xml
                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{BECB194D-C334-48E9-B579-1D12EF2E4D1D}\.ba\thm.xml
                                                                                                                                                                                                                                                      • Size 8KB
                                                                                                                                                                                                                                                      • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      vmdrv.cat
                                                                                                                                                                                                                                                      • Path \??\c:\program files\voicemod desktop\driver\vmdrv.cat
                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                      • SHA256 488b32ba019c0db448d0669f70bdf564d0f4bd23c7f9592d185474b0d62c763a
                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                      memory/1236-360-0x0000029AB1720000-0x0000029AB1758000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-610-0x0000029AB28F0000-0x0000029AB2938000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-376-0x0000029AB1040000-0x0000029AB104A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-248-0x0000029A940E0000-0x0000029A943B2000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-386-0x0000029AB1080000-0x0000029AB1088000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-256-0x0000029AB10A0000-0x0000029AB1146000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-401-0x0000029AB1840000-0x0000029AB1852000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-258-0x0000029A947D0000-0x0000029A947DA000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-404-0x0000029AB1CD0000-0x0000029AB1CF2000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-349-0x0000029AB1090000-0x0000029AB109C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-613-0x0000029AB1CB0000-0x0000029AB1CB8000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-362-0x0000029AB1760000-0x0000029AB17A0000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-361-0x0000029A960A0000-0x0000029A960AE000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-359-0x0000029A96090000-0x0000029A96098000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-357-0x0000029AB2C90000-0x0000029AB42F4000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-612-0x0000029AB1CA0000-0x0000029AB1CA8000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-611-0x0000029AB1880000-0x0000029AB188A000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-347-0x0000029AB1050000-0x0000029AB1062000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-252-0x0000029A947B0000-0x0000029A947BA000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/1236-608-0x0000029AB1870000-0x0000029AB187C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4580-17-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4580-539-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/4580-0-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5932-306-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5932-19-0x0000000000670000-0x0000000000671000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5932-538-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5932-18-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5932-472-0x0000000000400000-0x00000000004C6000-memory.dmp
                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                      memory/5932-5-0x0000000000670000-0x0000000000671000-memory.dmp
                                                                                                                                                                                                                                                      Download