Resubmissions
28/05/2023, 09:18
230528-k91lmafc2z 8Analysis
-
max time kernel
330s -
max time network
333s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28/05/2023, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe
Resource
win10-20230220-en
General
-
Target
Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe
-
Size
98KB
-
MD5
2a08f537ca29735e25fc479034f46e43
-
SHA1
003fbfa6c1b854ee5832bb11546a1996dfe863ac
-
SHA256
c9b0c9b6a4df508c7355509807c67fcf144a2065c21679c6c484f47e91e2d16f
-
SHA512
0a0d9a7bf0971c5d504b80c979b6d4d385104d909e1dc5c90fdf895f545c22b615e26d440958645dd6b2b318acb7048a57a6221f35734b981de495c02c003a49
-
SSDEEP
3072:xkBGWOsTIJgIDU5A/czY6tMDD9ZGY7fxOS:x1ssjuttMD6W
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Control Panel\International\Geo\Nation VoiceAI.exe -
Executes dropped EXE 14 IoCs
pid Process 4600 VoiceAI-Installer.exe 4996 vc2019.exe 4140 vc2019.exe 164 VC_redist.x64.exe 4168 VoiceAI.exe 1572 VoiceAI.exe 3804 VoiceAI.exe 5004 VoiceAI.exe 4168 VoiceAI.exe 4672 VoiceAI.exe 1136 VoiceAI.exe 4100 VoiceAI.exe 3360 VoiceAI.exe 4964 VoiceAI.exe -
Loads dropped DLL 64 IoCs
pid Process 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 4600 VoiceAI-Installer.exe 4600 VoiceAI-Installer.exe 4140 vc2019.exe 2664 VC_redist.x64.exe 4168 VoiceAI.exe 4168 VoiceAI.exe 4600 VoiceAI-Installer.exe 4600 VoiceAI-Installer.exe 1572 VoiceAI.exe 1572 VoiceAI.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 1572 VoiceAI.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 1572 VoiceAI.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 1572 VoiceAI.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 1572 VoiceAI.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 1572 VoiceAI.exe 1572 VoiceAI.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{2aaf1df0-eb13-4099-9992-962bb4e596d1} = "\"C:\\ProgramData\\Package Cache\\{2aaf1df0-eb13-4099-9992-962bb4e596d1}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55c2b499-2a94-5a4b-9d5e-02c5d3950e43}\SETBEAF.tmp DrvInst.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55c2b499-2a94-5a4b-9d5e-02c5d3950e43}\SETBEAE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.inf DrvInst.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55c2b499-2a94-5a4b-9d5e-02c5d3950e43}\voiceaidriver.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.PNF VoiceAI.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55c2b499-2a94-5a4b-9d5e-02c5d3950e43} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{55c2b499-2a94-5a4b-9d5e-02c5d3950e43}\SETBEAF.tmp DrvInst.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55c2b499-2a94-5a4b-9d5e-02c5d3950e43}\SETBEBF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{55c2b499-2a94-5a4b-9d5e-02c5d3950e43}\SETBEBF.tmp DrvInst.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55c2b499-2a94-5a4b-9d5e-02c5d3950e43}\VoiceAIDriver.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.PNF DrvInst.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{55c2b499-2a94-5a4b-9d5e-02c5d3950e43}\SETBEAE.tmp DrvInst.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\VoiceAIDriver.cat DrvInst.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Voice.ai\locales\ca.pak VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\tools\vc2019.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\CefSharp.Core.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libsamplerate-0.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ar.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\el.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sl.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\zh-TW.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\hostpolicy.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fi.pak VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\tools\net452.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\da.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\DirectML.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libsndfile-1.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\cefsharp.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\tr.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\icudtl.dat VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\BugSplatRc.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\onnxruntime_providers_shared.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fil.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\uninstall.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\AudioPX.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libcef.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.sys VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\a.log VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\Newtonsoft.Json.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\he.pak VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\VoiceAI-Installer.exe Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe File opened for modification C:\Program Files\Voice.ai\AudioPX.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\cudart64_110.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libsndfile.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fr.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\hu.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\CefSharp.BrowserSubprocess.Core.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.cat VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libgcrypt.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\bg.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libmp3lame.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\et.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\nl.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sr.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\AudioConverter.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\lv.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\DriverManager.dll VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\gcrypt.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libmp3lame.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\gu.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ml.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\te.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\chrome_100_percent.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAI-Installer.exe Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe File created C:\Program Files\Voice.ai\d3dcompiler_47.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\CefSharp.Core.Runtime.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\swipe.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\de.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fa.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\id.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ms.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sk.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\zh-CN.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\tools\net452.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\NAudio.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\it.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\mr.pak VoiceAI-Installer.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{A977984B-9244-49E3-BD24-43F0A8009667} msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\INF\oem3.PNF DrvInst.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI8281.tmp msiexec.exe File created C:\Windows\Installer\e5a78fb.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9340.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\ks.PNF DrvInst.exe File opened for modification C:\Windows\setupact.log DrvInst.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI8DA0.tmp msiexec.exe File created C:\Windows\Installer\e5a790e.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log VoiceAI.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\setuperr.log DrvInst.exe File created C:\Windows\Installer\e5a78ea.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a78ea.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7DBD.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{A181A302-3F6D-4BAD-97A8-A426A6499D78} msiexec.exe File created C:\Windows\Installer\e5a78fa.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a78fb.msi msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 4 IoCs
resource yara_rule behavioral1/files/0x000700000001af58-132.dat nsis_installer_1 behavioral1/files/0x000700000001af58-132.dat nsis_installer_2 behavioral1/files/0x000700000001af58-133.dat nsis_installer_1 behavioral1/files/0x000700000001af58-133.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.31.31103" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.31.31103" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.31.31103" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\PackageName = "vc_runtimeAdditional_x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\PackageCode = "E49FE452611FCB64B91833BADDC6195B" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\Assignment = "1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\203A181AD6F3DAB4798A4A626A94D987 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Media\1 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell VoiceAI-Installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\PackageName = "vc_runtimeMinimum_x64.msi" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B489779A44293E94DB42340F8A006976 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell\open\command VoiceAI-Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{2aaf1df0-eb13-4099-9992-962bb4e596d1} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Version = "14.31.31103.0" VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Dependents VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Net msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Dependents\{2aaf1df0-eb13-4099-9992-962bb4e596d1} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell\open VoiceAI-Installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\Url Protocol VoiceAI-Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell\open\command\ = "\"C:\\Program Files\\Voice.ai\\VoiceAI.exe\" \"%1\"" VoiceAI-Installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B489779A44293E94DB42340F8A006976\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A977984B-9244-49E3-BD24-43F0A8009667}v14.31.31103\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.31.31103" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987\VC_Runtime_Minimum msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Version = "236943743" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{A977984B-9244-49E3-BD24-43F0A8009667}v14.31.31103\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\ = "{2aaf1df0-eb13-4099-9992-962bb4e596d1}" VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.31.31103" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai VoiceAI-Installer.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{A977984B-9244-49E3-BD24-43F0A8009667}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.31.31103" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Assignment = "1" msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4356 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 1240 msiexec.exe 1240 msiexec.exe 1240 msiexec.exe 1240 msiexec.exe 1240 msiexec.exe 1240 msiexec.exe 1240 msiexec.exe 1240 msiexec.exe 1572 VoiceAI.exe 1572 VoiceAI.exe 3804 VoiceAI.exe 3804 VoiceAI.exe 1136 VoiceAI.exe 1136 VoiceAI.exe 5004 VoiceAI.exe 5004 VoiceAI.exe 3804 VoiceAI.exe 3804 VoiceAI.exe 4168 VoiceAI.exe 4168 VoiceAI.exe 4672 VoiceAI.exe 4672 VoiceAI.exe 1136 VoiceAI.exe 1136 VoiceAI.exe 4168 VoiceAI.exe 4168 VoiceAI.exe 4672 VoiceAI.exe 4672 VoiceAI.exe 3360 VoiceAI.exe 3360 VoiceAI.exe 4100 VoiceAI.exe 4100 VoiceAI.exe 3360 VoiceAI.exe 3360 VoiceAI.exe 4964 VoiceAI.exe 4964 VoiceAI.exe 4964 VoiceAI.exe 4964 VoiceAI.exe 4100 VoiceAI.exe 4100 VoiceAI.exe 4100 VoiceAI.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2140 vssvc.exe Token: SeRestorePrivilege 2140 vssvc.exe Token: SeAuditPrivilege 2140 vssvc.exe Token: SeShutdownPrivilege 164 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 164 VC_redist.x64.exe Token: SeSecurityPrivilege 1240 msiexec.exe Token: SeCreateTokenPrivilege 164 VC_redist.x64.exe Token: SeAssignPrimaryTokenPrivilege 164 VC_redist.x64.exe Token: SeLockMemoryPrivilege 164 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 164 VC_redist.x64.exe Token: SeMachineAccountPrivilege 164 VC_redist.x64.exe Token: SeTcbPrivilege 164 VC_redist.x64.exe Token: SeSecurityPrivilege 164 VC_redist.x64.exe Token: SeTakeOwnershipPrivilege 164 VC_redist.x64.exe Token: SeLoadDriverPrivilege 164 VC_redist.x64.exe Token: SeSystemProfilePrivilege 164 VC_redist.x64.exe Token: SeSystemtimePrivilege 164 VC_redist.x64.exe Token: SeProfSingleProcessPrivilege 164 VC_redist.x64.exe Token: SeIncBasePriorityPrivilege 164 VC_redist.x64.exe Token: SeCreatePagefilePrivilege 164 VC_redist.x64.exe Token: SeCreatePermanentPrivilege 164 VC_redist.x64.exe Token: SeBackupPrivilege 164 VC_redist.x64.exe Token: SeRestorePrivilege 164 VC_redist.x64.exe Token: SeShutdownPrivilege 164 VC_redist.x64.exe Token: SeDebugPrivilege 164 VC_redist.x64.exe Token: SeAuditPrivilege 164 VC_redist.x64.exe Token: SeSystemEnvironmentPrivilege 164 VC_redist.x64.exe Token: SeChangeNotifyPrivilege 164 VC_redist.x64.exe Token: SeRemoteShutdownPrivilege 164 VC_redist.x64.exe Token: SeUndockPrivilege 164 VC_redist.x64.exe Token: SeSyncAgentPrivilege 164 VC_redist.x64.exe Token: SeEnableDelegationPrivilege 164 VC_redist.x64.exe Token: SeManageVolumePrivilege 164 VC_redist.x64.exe Token: SeImpersonatePrivilege 164 VC_redist.x64.exe Token: SeCreateGlobalPrivilege 164 VC_redist.x64.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe Token: SeTakeOwnershipPrivilege 1240 msiexec.exe Token: SeRestorePrivilege 1240 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1572 VoiceAI.exe 1572 VoiceAI.exe 1572 VoiceAI.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1572 VoiceAI.exe 1572 VoiceAI.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1572 VoiceAI.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 2528 wrote to memory of 4600 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 69 PID 2528 wrote to memory of 4600 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 69 PID 2528 wrote to memory of 4600 2528 Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe 69 PID 4600 wrote to memory of 4996 4600 VoiceAI-Installer.exe 71 PID 4600 wrote to memory of 4996 4600 VoiceAI-Installer.exe 71 PID 4600 wrote to memory of 4996 4600 VoiceAI-Installer.exe 71 PID 4996 wrote to memory of 4140 4996 vc2019.exe 72 PID 4996 wrote to memory of 4140 4996 vc2019.exe 72 PID 4996 wrote to memory of 4140 4996 vc2019.exe 72 PID 4140 wrote to memory of 164 4140 vc2019.exe 73 PID 4140 wrote to memory of 164 4140 vc2019.exe 73 PID 4140 wrote to memory of 164 4140 vc2019.exe 73 PID 164 wrote to memory of 2084 164 VC_redist.x64.exe 82 PID 164 wrote to memory of 2084 164 VC_redist.x64.exe 82 PID 164 wrote to memory of 2084 164 VC_redist.x64.exe 82 PID 2084 wrote to memory of 2664 2084 VC_redist.x64.exe 83 PID 2084 wrote to memory of 2664 2084 VC_redist.x64.exe 83 PID 2084 wrote to memory of 2664 2084 VC_redist.x64.exe 83 PID 2664 wrote to memory of 3580 2664 VC_redist.x64.exe 84 PID 2664 wrote to memory of 3580 2664 VC_redist.x64.exe 84 PID 2664 wrote to memory of 3580 2664 VC_redist.x64.exe 84 PID 4600 wrote to memory of 4168 4600 VoiceAI-Installer.exe 85 PID 4600 wrote to memory of 4168 4600 VoiceAI-Installer.exe 85 PID 896 wrote to memory of 4560 896 svchost.exe 88 PID 896 wrote to memory of 4560 896 svchost.exe 88 PID 896 wrote to memory of 2568 896 svchost.exe 89 PID 896 wrote to memory of 2568 896 svchost.exe 89 PID 4600 wrote to memory of 440 4600 VoiceAI-Installer.exe 93 PID 4600 wrote to memory of 440 4600 VoiceAI-Installer.exe 93 PID 1196 wrote to memory of 1572 1196 explorer.exe 95 PID 1196 wrote to memory of 1572 1196 explorer.exe 95 PID 1572 wrote to memory of 3804 1572 VoiceAI.exe 96 PID 1572 wrote to memory of 3804 1572 VoiceAI.exe 96 PID 1572 wrote to memory of 5004 1572 VoiceAI.exe 97 PID 1572 wrote to memory of 5004 1572 VoiceAI.exe 97 PID 1572 wrote to memory of 4168 1572 VoiceAI.exe 99 PID 1572 wrote to memory of 4168 1572 VoiceAI.exe 99 PID 1572 wrote to memory of 4672 1572 VoiceAI.exe 98 PID 1572 wrote to memory of 4672 1572 VoiceAI.exe 98 PID 1572 wrote to memory of 4100 1572 VoiceAI.exe 101 PID 1572 wrote to memory of 4100 1572 VoiceAI.exe 101 PID 1572 wrote to memory of 1136 1572 VoiceAI.exe 100 PID 1572 wrote to memory of 1136 1572 VoiceAI.exe 100 PID 1572 wrote to memory of 3360 1572 VoiceAI.exe 103 PID 1572 wrote to memory of 3360 1572 VoiceAI.exe 103 PID 1572 wrote to memory of 4964 1572 VoiceAI.exe 104 PID 1572 wrote to memory of 4964 1572 VoiceAI.exe 104 PID 1572 wrote to memory of 3304 1572 VoiceAI.exe 105 PID 1572 wrote to memory of 3304 1572 VoiceAI.exe 105 PID 1572 wrote to memory of 2668 1572 VoiceAI.exe 109 PID 1572 wrote to memory of 2668 1572 VoiceAI.exe 109 PID 1572 wrote to memory of 5020 1572 VoiceAI.exe 111 PID 1572 wrote to memory of 5020 1572 VoiceAI.exe 111 PID 1572 wrote to memory of 2932 1572 VoiceAI.exe 112 PID 1572 wrote to memory of 2932 1572 VoiceAI.exe 112 PID 1572 wrote to memory of 4852 1572 VoiceAI.exe 115 PID 1572 wrote to memory of 4852 1572 VoiceAI.exe 115 PID 1572 wrote to memory of 4704 1572 VoiceAI.exe 116 PID 1572 wrote to memory of 4704 1572 VoiceAI.exe 116 PID 1572 wrote to memory of 976 1572 VoiceAI.exe 119 PID 1572 wrote to memory of 976 1572 VoiceAI.exe 119 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe"C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-994600f200c4460982e991a798b63aca.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Program Files\Voice.ai\VoiceAI-Installer.exe"C:\Program Files\Voice.ai\VoiceAI-Installer.exe" /path "C:\Program Files\Voice.ai"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Program Files\Voice.ai\tools\vc2019.exe"C:\Program Files\Voice.ai\tools\vc2019.exe" /q /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\Temp\{4BE56A3D-90D2-4147-8F5F-DEDAEB1BEF4F}\.cr\vc2019.exe"C:\Windows\Temp\{4BE56A3D-90D2-4147-8F5F-DEDAEB1BEF4F}\.cr\vc2019.exe" -burn.clean.room="C:\Program Files\Voice.ai\tools\vc2019.exe" -burn.filehandle.attached=592 -burn.filehandle.self=600 /q /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\Temp\{7D83F54E-F5EE-4EE4-8BA5-F10506428971}\.be\VC_redist.x64.exe"C:\Windows\Temp\{7D83F54E-F5EE-4EE4-8BA5-F10506428971}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FF02E66F-9925-4C03-A20E-8FF2F7D1D6DC} {505E2158-B825-43C6-B6CA-D3300632D029} 41405⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:164 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=960 -burn.embedded BurnPipe.{A01A75FB-8DD4-4B7E-BFFA-FA98865885BC} {325AAA04-903E-428E-AAB9-EC11CFA4C0C0} 1646⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=960 -burn.embedded BurnPipe.{A01A75FB-8DD4-4B7E-BFFA-FA98865885BC} {325AAA04-903E-428E-AAB9-EC11CFA4C0C0} 1647⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FDDDC6B7-4CC0-4133-800F-8C0987F56F79} {C53BF82D-E630-41F1-AF4C-05E92251A96F} 26648⤵
- Modifies registry class
PID:3580
-
-
-
-
-
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" installdriver3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
PID:4168
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\Voice.ai\VoiceAI.exe"3⤵PID:440
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WriteRemove.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4356
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\6e87ffdd6e9c42d18d29effb40f94519 /t 4328 /p 43561⤵PID:3920
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2148
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:4892
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{cc2fcee0-c545-2a41-b837-270f860617c0}\voiceaidriver.inf" "9" "46b7f3743" "0000000000000180" "WinSta0\Default" "0000000000000184" "208" "c:\program files\voice.ai\voiceaidriver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4560
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "voiceaidriver.inf:ed86ca11bfc96d40:VOICEAIDRIVER_SA:16.36.0.99:root\voiceaidriver," "46b7f3743" "0000000000000180"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2568
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=2452,i,959740425382481911,15899639907940040241,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=15723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3804
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:/Program Files/Voice.ai/VoiceAI.exe" discord 15723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5004
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=2924 --field-trial-handle=2452,i,959740425382481911,15899639907940040241,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=15723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=2916 --field-trial-handle=2452,i,959740425382481911,15899639907940040241,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=15723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4168
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3284 --field-trial-handle=2452,i,959740425382481911,15899639907940040241,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=1572 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1136
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3256 --field-trial-handle=2452,i,959740425382481911,15899639907940040241,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=1572 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4100
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3556 --field-trial-handle=2452,i,959740425382481911,15899639907940040241,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=15723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3360
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3560 --field-trial-handle=2452,i,959740425382481911,15899639907940040241,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=15723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
-
C:\Windows\System32\Wbem\wmic.exewmic diskdrive get model,SerialNumber,size3⤵PID:3304
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get serialnumber3⤵PID:2668
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get Product3⤵PID:5020
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get manufacturer3⤵PID:2932
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get name3⤵PID:4852
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get caption,version3⤵PID:4704
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_videocontroller get name3⤵PID:976
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD56192103ae43301c0c3c8058c53768d01
SHA1ae05bd05513f21e975639a8d5773645a5ded10ed
SHA2568f5becf41e63725e84d344d195839223df46105e7db8d966505b71f34a158e7b
SHA51222e78b7258662bd648b09f98b76a8e81d3b4bc28a2751810809fd637cc45bc1a6cdab8f3aaec3073a14b4e0180ef09b5bf79fcf7ab3d8b36a70e0a1c7792b6b9
-
Filesize
16KB
MD5f8d7903e3b94b8a2056343f4e9b6f411
SHA11683b56c70d9bdcaff67163b0dbbfb7c8942ba12
SHA25655effaad170df5852b209284d41f5fa6e9a3195ba0388943c2ff532db49834bc
SHA5125247bd7550d3f9008a7e0fa3e4fab7510e0946cb92feafd5e1fbb3f366110a8080fa0239b184efaf0133116dfda3d1b1931f0efd45e19d7b901d0d1e6027e306
-
Filesize
19KB
MD500a3aa89c5c8c82fd0fadbac5558466e
SHA16e0823573bc27224d0b53a04e2dbb04e668763eb
SHA256b6ae0524aebcaf570432cadaf1126ff5df88df42a0dcfd006e84ebaf007470ef
SHA5123b2fe754d464c2398f884eb8920c88e60bc10668cd2a1f9c3270a230e46a9e65e2c1084267e6fc65004bfaf1896d4c77d03acb2223aa8f2ed90e162cdb0c2006
-
Filesize
18KB
MD58fb3ed5d6e18cef6724f60d6b4d7305a
SHA179e422f6a58079da157b22a5a7935937168daa40
SHA256d723ccb33a45d565f2a065d88c9115d6bc6c1a4b438eb533ab00c37713b58148
SHA51258abf5ce42d0fde0739f2b3e9f76ba9b75aef725f730f4a327bcd77a77a0cc3bb1b4d1808a030d49267883aee71d50a4757a2d2cc187e5440b789b46168716f9
-
Filesize
425KB
MD5b04e48b901fb6af35220e806267a9bfe
SHA1dc3a4063c447afe3147520a3959dc0d93cbb7193
SHA256993bbb79a9b5b196b55accec8a5af15f5546d8d3eb553c3b7ce2902804d46202
SHA5126aa935e33a2c08db47da813a9e530fc185194af4f94cd78f4eaf7cf10096cc8e7ffb0e98bdfb2d09ddadccd45b8290e78fd940d78a8e109d0a4a59abe8453021
-
Filesize
352KB
MD547a491c852aa6c26272902afb9f38bcf
SHA14e4ddfa91b7b5dc2b5741834dcd8e2f755092c8a
SHA256e5c436a85b2472040bdcfadfe37f1926395fc87ee40c108936665c5616f90a4f
SHA51208c019778b2a98b5cf1c65102e64bb3016483041413a6353135e95ee621fa101aa2f170a15626f903030963f870c7450c4e3b1d3c7e3f6e6c73fe75b3885196a
-
Filesize
29KB
MD5c765c4d36d0732377a332a16bdf7cee6
SHA134f33c99f42eb0fefe401e620aac70be29718295
SHA2560a9b58d71d745440b0d6cbba64fd0d2dcda8cbd831f62b1dfa4cb6e3fb203ee1
SHA512e89874d044eb3b184ebef52f5bad296001aba18390b090bf79d78e451de8ff731283159dec314ada74926fc7cc5fb74654c8f57663bb2fb13a6a88937f62dfd9
-
Filesize
282KB
MD55363af67b580f6f08c2d8324e78c052b
SHA1e9c5b1925555875325c3f304e29198177768c222
SHA256753935123466d852acdfc24b23d8ea7700394809d01679fbd64f12b95ae43528
SHA512685d17b6e01ea05125dc2a6cbc72e057b2faa2030ad8dbef8f0c316b33049558d515c103c29a9f2928ef3fe56f9c52416a720eb19fe6c395f1a686521622ceea
-
Filesize
1.1MB
MD5ae2bd5b01f68bfc00e9a5b105354f3f6
SHA1f4bfe78666db12f06841889269ab33abc34ae5f4
SHA256a4b63108af66f2caad573b51c6de0412aa0f271ad2ff8c5f0a5836f8f8b3ef85
SHA5129be46f88fba97fe1eca08165f1ed21800ebf032018d005b4275d19a09e727fd271b515e0d9b96c3950a8ccc34a11dcea088f891538da598539db92b7e9ca77f1
-
Filesize
1.7MB
MD5b248baf8c715fb3e853d7945b01efb80
SHA1379b1982c9069a4e675f73a4dd94cd4460858340
SHA2560e2074751c0b19ebf7ed6ede1f4dc468d6459d5b973fcfda1b6957aec1417520
SHA51290d39295babd0825b2b3e3d2fdf1b36a31eee3b96e0a535145e9f48a808540997706e1e2674475ddfa8b02a77909cebafb3618f606ba292b4c68a3d29a1ac020
-
Filesize
47KB
MD597847eb086065d89bab93d34a9fd8936
SHA1112fe59b07619176492eb75b2c25370d32c2900f
SHA256a8d06260c75804e61facd47c3a70c1256f6277bf488d6e4015fcc9770af795cb
SHA5127c13235b7015417780b74db7f202f5c41f2c86f8c26e81aa9376a778ba91f4450deba091f2a06188cc92a456f9a395ae51ba8d06e2fe95eeffc637d129fceb14
-
Filesize
58KB
MD5c56a240a4eb7bf9a43cf7a0b8a394b9e
SHA1408d8ff47127691f911e4ba701a6aad618ce58f1
SHA2560370050112c026ec1b4b280d953c2c9e04a0ea54e27b40b202509103eb4ce521
SHA5125560257688421301258ced279e650179b42a3d8fc67d9e55e3303f4e3920b81a7e40b33275470cf89b33868681ed68a9ee11f4a2ae1f0f159bc535d1b5630edb
-
Filesize
1.0MB
MD569f79d227400c5c5a17e4fe6b5719009
SHA1d7ace396db95eced9b4f98badc4282f359999d28
SHA2567be25c5ddbbad217fcb40dbef92ba783bb8a155d3db48cde5a4c32e13761cbf7
SHA51249262793c3b64fd454522381856761e456999d36e84ee228a894cefa4e19473302e9d7941d49b3a4d6faed98b136a18d60fb1dfdeaf4119f6fddb4c82da6f24c
-
Filesize
82KB
MD5d89a90d47a7da632ab122f9d24b121f8
SHA1b3b049f5663eda2b725201929a6359142dfd8c96
SHA2562c83950750fecdfbc251e51898f36c1d4ea219733ef0f03478fe88b1784c708a
SHA512f36da2637991f1086bcdf550303baf1ac2e5fbfc7299d0867dcb6c5fd3d3b2e6b38dfcd3ca6055b3492916a645dae199421fb38a38adf01c2297378034905f08
-
Filesize
697.4MB
MD5e2d8dacfd3616d0e3ed3714410d65db7
SHA146b06821c0adf25d47c18b60a609df264bc27f17
SHA256c4b66422cfc40a1f09f998e85940f42da123d286f2bea1be68ea9bd24be75cc3
SHA512cd7e20ccc6d6c6402b945a2f31c4f6e04b28469a5469e64c584105dd1225b5c2b87a78c1af714508607b438d888e48a1bea13aa0ac3a98b6684bc0f4ed608864
-
Filesize
697.4MB
MD5e2d8dacfd3616d0e3ed3714410d65db7
SHA146b06821c0adf25d47c18b60a609df264bc27f17
SHA256c4b66422cfc40a1f09f998e85940f42da123d286f2bea1be68ea9bd24be75cc3
SHA512cd7e20ccc6d6c6402b945a2f31c4f6e04b28469a5469e64c584105dd1225b5c2b87a78c1af714508607b438d888e48a1bea13aa0ac3a98b6684bc0f4ed608864
-
Filesize
3.7MB
MD53b634e1ee95efa30f066e08196d1fddb
SHA126fa5ae36935f6e9da788f0de32b3ecec683b16c
SHA256be4a1f1c2eac75101d4861dc95b42999d9b95f7983b7cf421e8ccb09121ba9cd
SHA512cabdbecffa5c9c4854a53a7907a6ce532d0fadd16a658f2fbf403228661be495fdaa671285309cf1a3ded6eceb4a6f7eeed64618ba4d3c19334dcdb2ab499323
-
Filesize
3.7MB
MD53b634e1ee95efa30f066e08196d1fddb
SHA126fa5ae36935f6e9da788f0de32b3ecec683b16c
SHA256be4a1f1c2eac75101d4861dc95b42999d9b95f7983b7cf421e8ccb09121ba9cd
SHA512cabdbecffa5c9c4854a53a7907a6ce532d0fadd16a658f2fbf403228661be495fdaa671285309cf1a3ded6eceb4a6f7eeed64618ba4d3c19334dcdb2ab499323
-
Filesize
3.7MB
MD53b634e1ee95efa30f066e08196d1fddb
SHA126fa5ae36935f6e9da788f0de32b3ecec683b16c
SHA256be4a1f1c2eac75101d4861dc95b42999d9b95f7983b7cf421e8ccb09121ba9cd
SHA512cabdbecffa5c9c4854a53a7907a6ce532d0fadd16a658f2fbf403228661be495fdaa671285309cf1a3ded6eceb4a6f7eeed64618ba4d3c19334dcdb2ab499323
-
Filesize
3.7MB
MD53b634e1ee95efa30f066e08196d1fddb
SHA126fa5ae36935f6e9da788f0de32b3ecec683b16c
SHA256be4a1f1c2eac75101d4861dc95b42999d9b95f7983b7cf421e8ccb09121ba9cd
SHA512cabdbecffa5c9c4854a53a7907a6ce532d0fadd16a658f2fbf403228661be495fdaa671285309cf1a3ded6eceb4a6f7eeed64618ba4d3c19334dcdb2ab499323
-
Filesize
14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
Filesize
620KB
MD5e05272140da2c52a9ebef1700e7c565f
SHA1e1dc01309fca499af605f83136d35e6d51fcd300
SHA256123092a649b8def6efca634509fb20ba4fbf9096d6819209510b43b5f899c0a3
SHA512476907363a0d1e1bf81d086aff011b826fd28a885e2eabd2e07e48494eafbd48d508b1a9050efe865585f7c4d92a277886440876846cba8a2226033ff35a7a81
-
Filesize
933KB
MD50d362e859bc788a9f0918d9e79aea521
SHA133abea51f76bde3e37f71b7e94f01647bb4dcbd5
SHA256782f475d56e62c76688747a22ba4ae115628c5c3519c3c1e3d1a51a4367bfc28
SHA51237ca08bbe5525d0f2d45a9fe65a45f6c5d8366330fc60304822d4c7470dd66b8733d92803ce6aabdf4175ad0cf43d6e4a9ff9d4e49ff89d8eddc5f7083e7f067
-
Filesize
1.1MB
MD52fe263f11bd372ba2387746f03ee049a
SHA1736a667a1f65bb2c442feeae3349b67d4ab5ccef
SHA25681f7d9017bd1ffead821d3f64adf5019dd478fa4dcfd6b55ddffb9a5ded4c750
SHA5120a63bab6ed1240c42c444de4949fad71a1de32b374ff2aa7973ec8b42d7c40a09e3150fe01949e355325a6fd01e8a21c518a3145028a1a6ba86e2b7f84848b97
-
Filesize
517KB
MD53d1aa9921f514a71a3618e34cd24b6af
SHA182cbad4e7bca6e517220eb7b62f43ba81ce6f2de
SHA2563aa5e83056c54f8e7e3268892798e8dabbfb058f5978ffe5c1be811a221155b2
SHA512fda21400bb37c12023e8fcd68049ef29aee7a9649763ac5838b5b81fbebf5702e877bc71a8168c781f971e122411c5e14411d4a08b86673438a24baa08e91731
-
Filesize
4.7MB
MD517d15d3b58b49616ab78d06afd59c88c
SHA1bd97c066f60b18ca0300b19668f7d34464e73421
SHA25629625035f173c9d4bfd7694c6f238cb6623669f627f8b7f80e45204ad94f066e
SHA51294d5bc63d92716f9602dfb86b10b3bc0ce800486576c9ca711f2d32120f994698c7018637e2327e38468edcb52b9054f904ae8253bc91f67ed22c2e24b4db413
-
Filesize
138KB
MD5d6351ad083a0df208716ada161f04004
SHA1db85969e468305d077bfae154704dbdbf7f7da06
SHA2567694359992c0088699e60136be26029d3d8529c4286a2da0a8e2971474cf6adf
SHA5129b05ce96a7a5fd56c028895ca7e30e7d0c97c5f4c7a13b303f64b048edd7b0ef50d50fd4f06475510900c7ef818ef16fb5551398b9fb1968f9fe095a7e3f38cb
-
Filesize
65B
MD5c53578a046cbab7dfdce672ccd1edec7
SHA129b1ea4e67cefa19d1ff9cf8bf33f1ec22801808
SHA256202e3df0766d19a10cc8db16ced618bee4767354912f3c8f5e19c54bb3418573
SHA51284372b67ff83e8cee3fc8b0e18c0f93bd0432547a5f93c516a944054c5cbbea641503ea44cde390882d53f82eed1cbb258a5301a581ec7d278eccf4a3db7b942
-
Filesize
24.1MB
MD54a85bfd44f09ef46679fafcb1bab627a
SHA17741a5cad238ce3e4ca7756058f2a67a57fee9d1
SHA25637ed59a66699c0e5a7ebeef7352d7c1c2ed5ede7212950a1b0a8ee289af4a95b
SHA512600e61332416b23ef518f4252df0000c03612e8b0680eab0bdf589d9c855539b973583dc4ce1faab5828f58653ed85a1f9196eb1c7bbf6d2e3b5ab3e83253f98
-
Filesize
24.1MB
MD54a85bfd44f09ef46679fafcb1bab627a
SHA17741a5cad238ce3e4ca7756058f2a67a57fee9d1
SHA25637ed59a66699c0e5a7ebeef7352d7c1c2ed5ede7212950a1b0a8ee289af4a95b
SHA512600e61332416b23ef518f4252df0000c03612e8b0680eab0bdf589d9c855539b973583dc4ce1faab5828f58653ed85a1f9196eb1c7bbf6d2e3b5ab3e83253f98
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD51ef9bb6d2a7097994183a5be2bbe2d2a
SHA14630a8281d7bce00845850afdf6541c5531f7690
SHA25603f7911e0c777ac7ac9adbaa7d3b798b986286bc0cdb1a8ef91edf075bf014a4
SHA51279c99ee57a5f142e1f7ed3e7d7e2ad93ed1643bfc0a36dca8704edcfc6553780ecce426fe5a855e191d1520d71d9ae8322bf7ed89e8641ea849e0e7ac0413306
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F230C79A832D263CC3447DEF17298F5A
Filesize727B
MD5b65b58da4f78073b83168538f982ef1f
SHA1eb2ed0b0093b988a7bd6f43ea42ec80f1da75e9a
SHA2560c469cb6ee903b0386676d67c1b71d0fd80d2483ac31fc7df6260b8412fee110
SHA512a90049eeefa49d6b41c08688b678dbd0cbf746f2984161d2c901986e178bfdc03bfa3610f92aed9df4fdfd4c691e01a8c061b446f266895b74f3269b80f1ee02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD5c9cf48b97144ed7bbb08788089ac5e41
SHA1d7c00ee8fcac943d83713242c9fc6f9c51622650
SHA256d29e7eaef6a0550bca5b165feb3209ba232138105fdce84de42997323597deac
SHA51203143d812fa81a85eb86d0868615256dd3d137996b713ac2b760f685f6e36d6ba8f4dcf03e3f8efab97b3a66067a1a6b29a9fb0282f2c44aa99a55ce1ddc0368
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD5b27c37733a276c96f6b2e81eafddec4a
SHA1d127fb62010a98862b22cbccc3e5779223fdf911
SHA256a62132e555dee8e3d87578417728e02ecbdab9ab082752ea05092e33cc0cb61f
SHA512003ece08d3a9e988330b39148976f7ea1767088c43d1589f68eae45b09649489975a90caacbe088f536874eb18e7bc0868d847a8d3de0b65f036aed4fad16450
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F230C79A832D263CC3447DEF17298F5A
Filesize438B
MD5ae97ad1893b643f5149611933212f9c8
SHA18195e3ab27dca056151f7d6275fe29de0b240051
SHA25639dcb678f3762b5e34ab271482d94b30892e8e9e4e074db8b4103662ee603f9f
SHA5124126046d2c9d1d6d7f6da30242f0882e5bc740d5e7fd90bc9652a5778354ac6b976daa8eba0407efd5eb2238972256b2ff181bc3bbecbc2f44cf85995692b3a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD50d7549826e3091c9bae80dd2b4437bc6
SHA14d6afb02c78e51ffc11a6f890edf9d301dbdf883
SHA2563712b1864c79fac9fc2661705a66b5cc24df0fa47387c96c0b5c0b4fd4d4568e
SHA512780f7edc0a95f6b9f52286e0fd54cddfba7046b35ace17beac274ce8f5c5d50f8ffd3d2fed7f91a3bd9d991754ed3e4edd7e3a881ba117729ee87d66b365ca03
-
Filesize
1KB
MD5d63ff49d7c92016feb39812e4db10419
SHA12307d5e35ca9864ffefc93acf8573ea995ba189b
SHA256375076241775962f3edc08a8c72832a00920b427a4f3332528d91d21e909fa12
SHA51200f8c8d0336d6575b956876183199624d6f4d2056f2c0aa633a6f17c516f22ee648062d9bc419254d84c459323e9424f0da8aed9dd4e16c2926e5ba30e797d8a
-
Filesize
2KB
MD5ee2ce87cfc874693e07e6faf3d82036b
SHA12122d995938c03dab641c8daaa7b9e882a4b7345
SHA2567e417bbc1f4ddf6109733e163a9939120f330a9df0d20680f96bc626d63115e2
SHA512660708da9be417a2652ff3cb07287e364699142ac6dc31283160245b09109313d82e34826df818c2254116e7751d1992b2787c88d18983e0334f8db92a409e13
-
Filesize
2KB
MD552ddd0f734952bc4166a90c88a13d24f
SHA1edde40a528faac03ec9b1b52fd5ca15d3e75d089
SHA2569b9f880a62299e69df1ebdfb1f0f88861d790aebb67e3dc1fb3957d069ba955e
SHA5123fe30206889931f51531fb73d92c177125cc9227199b61982ce827fae7bb20a68b423065b3487c926c1724e07559f97efdfb023e2fb4f84e539b74d0b448acde
-
Filesize
12KB
MD5792b6f86e296d3904285b2bf67ccd7e0
SHA1966b16f84697552747e0ddd19a4ba8ab5083af31
SHA256c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
SHA51297edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
12KB
MD58a3e5641b08845e5b288dc7246dfa6dd
SHA13248d92614fa84a4bd7fd4ac1c4286bce1ce3ec0
SHA2568637d605c58fd03fde8737f6bcbca8d5dd3cb7f0f1a28c4f635115edc7d9a9b2
SHA512d086d36b90a7c55ab800dc52b600f03cd1956081cec948bf06d78e873925ff9202ada7b77fc7adccecb90a73953735157c96308b132f652b1a1bef69e6d378c0
-
Filesize
71KB
MD5e508a4b3baf2661e7b8d079830b3f753
SHA1ca318950e09e4c79458bba56121c4c950a57dcaf
SHA2562a1aff3b51d87d9c9ad8933c2241e183ef15b911d06e41d64c5c61ca20f88195
SHA512a3503c85f19791e1ff8ef4af71552e316c1c8940045602eb6e7eeb4f0c921c98b91f0e6556fa8f97e2b6ce406687d34fa019e42f671db7d2a2ada3c21f24d65f
-
Filesize
14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
Filesize
48B
MD5c481bc16638cfe8c7e5e6a6c0082dde9
SHA1402b5bc5fad5bb68afb5d870891f87ddd4721a8b
SHA2560ca8f4b237105548aa2cfbaf8160f72152d72b4a57aa39e6811e93ed41934a6c
SHA5120954ca7e449348554d5dcdc02511f92095410311d71a187f4b19f1b56b9109a9153930c75ba3ae2dedc30f55d16bdeeb434ec03df68ac28cb02841b75b2a2e83
-
Filesize
240B
MD52211b8ac899d830a7971ee066254c4a5
SHA11f65cf4640dbbc68dd2ce59fcdf26b0a86537b80
SHA256f12d2d7c083a5119a548979723225c00be2cf96974c07327463d0a0be15b712d
SHA512061bbdccffbcd56454a9f0f879a76559caf2d9d8d27310472fea1be0fdb90b4626e0ee4cf5bf9a94468313a0512c96000772b9b73e1db91fe3ced62dfd9ee32f
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1KB
MD5f7cfcf6f4a380b82bc60adf66ddf42d6
SHA1852ef6acc33188da890c503e1398bd6eb036c04c
SHA2562d5fd6b7ce213677dd42773c4e714e21b731e22364587310cff984df999e7902
SHA5121a276ee7eaaedc4dba2cbcd08d2b44b3cdb1eeec25114a003482d061aee1ccd786f8aa73ec9ca818a1e748b3f31a265567ff16e91f00f15764a850247277211d
-
Filesize
1KB
MD5e1c1394e57475d6437dc088ce27d81a3
SHA1a7c115fe262a36fea67191ed97d01aad9c615f9c
SHA2563d2ed8eb535513bfcc04817b6c7fde62ee8aaccf3db00a7627318dfe60858e68
SHA5128b4c91101ea95e4e3760d12670a72ddc169b8ef29f723bd4941a784e8010a3d4070f7d9adf2a7bad28afba1153e9798f596c5a13de66a2ddbca1036ec8d5782c
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
18KB
MD54a0d9b8104cd0e87fee71ce1c648b2e1
SHA1565c32375e79d3bd3417e2603210bbfa83577cd8
SHA256e9df12f1fff3ad9a65c4c0be352affb132fd732ebee64a924fd34be8dd6e3b84
SHA5120badc6ede4dd268cfa741c615278d4286506562a4bdb6d549b7b57cbd1ce37a17202118dea7b4a2b1ee9ac8b685c777d057d4228a22c90bbcf10b25f8c7dcd9b
-
Filesize
14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
Filesize
180KB
MD5143a2b9f1c0ebc3421b52e9adcb4db2e
SHA106e01b8cc855fd9a31f99b430f8c8745e706c677
SHA2565d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954
SHA5127e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05
-
Filesize
95KB
MD57415c1cc63a0c46983e2a32581daefee
SHA15f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA256475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
SHA5123d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
-
C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\VoiceAIDriver.cat
Filesize12KB
MD58a3e5641b08845e5b288dc7246dfa6dd
SHA13248d92614fa84a4bd7fd4ac1c4286bce1ce3ec0
SHA2568637d605c58fd03fde8737f6bcbca8d5dd3cb7f0f1a28c4f635115edc7d9a9b2
SHA512d086d36b90a7c55ab800dc52b600f03cd1956081cec948bf06d78e873925ff9202ada7b77fc7adccecb90a73953735157c96308b132f652b1a1bef69e6d378c0
-
C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.PNF
Filesize18KB
MD55556a5a97a308012306c117b35dbeafc
SHA14a9b6efcb571cc5a71d78692daef5118f0354cb5
SHA256a6bf742970d84ead9f0c91a2aa247edec5489cea4f5e1c165e08c28b75d94d70
SHA51237112e62e20ac2de1960b73327d1fdbf759c7927f8dbb24dec4c810b43ec81d90e30e925679dabe03ab6fb20ba6f8f1605171d23be564978f0c3c8b6f92bfa5f
-
C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.inf
Filesize14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.sys
Filesize71KB
MD5e508a4b3baf2661e7b8d079830b3f753
SHA1ca318950e09e4c79458bba56121c4c950a57dcaf
SHA2562a1aff3b51d87d9c9ad8933c2241e183ef15b911d06e41d64c5c61ca20f88195
SHA512a3503c85f19791e1ff8ef4af71552e316c1c8940045602eb6e7eeb4f0c921c98b91f0e6556fa8f97e2b6ce406687d34fa019e42f671db7d2a2ada3c21f24d65f
-
Filesize
12KB
MD58a3e5641b08845e5b288dc7246dfa6dd
SHA13248d92614fa84a4bd7fd4ac1c4286bce1ce3ec0
SHA2568637d605c58fd03fde8737f6bcbca8d5dd3cb7f0f1a28c4f635115edc7d9a9b2
SHA512d086d36b90a7c55ab800dc52b600f03cd1956081cec948bf06d78e873925ff9202ada7b77fc7adccecb90a73953735157c96308b132f652b1a1bef69e6d378c0
-
Filesize
14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
Filesize
71KB
MD5e508a4b3baf2661e7b8d079830b3f753
SHA1ca318950e09e4c79458bba56121c4c950a57dcaf
SHA2562a1aff3b51d87d9c9ad8933c2241e183ef15b911d06e41d64c5c61ca20f88195
SHA512a3503c85f19791e1ff8ef4af71552e316c1c8940045602eb6e7eeb4f0c921c98b91f0e6556fa8f97e2b6ce406687d34fa019e42f671db7d2a2ada3c21f24d65f
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
5.4MB
MD56ce5097b19cf57527651840bb438adf3
SHA149d0b725e5819a076562fd007490eca0bbb69003
SHA256f24a3bc5df7e7c07c0d13f46348c989eae7f597f428b20cc9044bba47785b7f0
SHA5129152301c4f87018d166b624d73919fc2da7e7ef74b2c1ecf8ad01c31c2b2239013cc3bc22237c81940ae96a5fd1b3698d260c3d3e0a9d0318cdc053e28328d83
-
Filesize
879KB
MD58e288dd0b5e0468ed8ae01ee566e77e8
SHA1fbd11237ae3300a2202444d339601d1ac6bbf310
SHA256c80addc870825e9a1aa9281e105e583973ec2846bbd74f1e97cb60911ba7a2e1
SHA512facc72bdcdd5de47c0d18ecb5288962b04d9e4924a9a07ee807a3bf0eaa77eac05f086906b680bcf97c3bad5fab0038b47c0e09cd2bbec1d0709eba015bc1c04
-
Filesize
180KB
MD5e6df9f55e20905f77b136844a3844dd6
SHA1b7c1fb12bda508a62fdd9ffa9e870cae50605aaa
SHA256f8745f3523ea73806d591fa4e666e86c30c7e5240a07211a0c11a7633d16c4f0
SHA5127c71c2b9a7d3d768d1686cb037362efb9e38c50b652bfaeb22cf86c6c47a85962f9893cbf5e2f86880c9c8fc8bc0278edeb47088813e022ef05d7db15efc0713
-
Filesize
180KB
MD5143a2b9f1c0ebc3421b52e9adcb4db2e
SHA106e01b8cc855fd9a31f99b430f8c8745e706c677
SHA2565d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954
SHA5127e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05
-
Filesize
71KB
MD5e508a4b3baf2661e7b8d079830b3f753
SHA1ca318950e09e4c79458bba56121c4c950a57dcaf
SHA2562a1aff3b51d87d9c9ad8933c2241e183ef15b911d06e41d64c5c61ca20f88195
SHA512a3503c85f19791e1ff8ef4af71552e316c1c8940045602eb6e7eeb4f0c921c98b91f0e6556fa8f97e2b6ce406687d34fa019e42f671db7d2a2ada3c21f24d65f
-
Filesize
12KB
MD58a3e5641b08845e5b288dc7246dfa6dd
SHA13248d92614fa84a4bd7fd4ac1c4286bce1ce3ec0
SHA2568637d605c58fd03fde8737f6bcbca8d5dd3cb7f0f1a28c4f635115edc7d9a9b2
SHA512d086d36b90a7c55ab800dc52b600f03cd1956081cec948bf06d78e873925ff9202ada7b77fc7adccecb90a73953735157c96308b132f652b1a1bef69e6d378c0
-
Filesize
82KB
MD5d89a90d47a7da632ab122f9d24b121f8
SHA1b3b049f5663eda2b725201929a6359142dfd8c96
SHA2562c83950750fecdfbc251e51898f36c1d4ea219733ef0f03478fe88b1784c708a
SHA512f36da2637991f1086bcdf550303baf1ac2e5fbfc7299d0867dcb6c5fd3d3b2e6b38dfcd3ca6055b3492916a645dae199421fb38a38adf01c2297378034905f08
-
Filesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
-
Filesize
14KB
MD56ab807f51b07da5d1ad43e82ad1fee42
SHA1886bbf732e5f872642541e8adabfca1b6b264d74
SHA256074996a2d3d99cb5b10d4c4f1ff92bacd45605c8103cb465091d78bc894f73f9
SHA5128ccedbc10394e0dd9763c7c25ea025b6fedeb0bd3d3a83c2e8dc45c8a2d30e3f0366513961a98ffc3ee872f31b009a7e179806f41c65528992299816295588b5
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
12KB
MD5792b6f86e296d3904285b2bf67ccd7e0
SHA1966b16f84697552747e0ddd19a4ba8ab5083af31
SHA256c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
SHA51297edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
-
Filesize
9KB
MD5f5b0c649b0cfc103fb113d013d48cacb
SHA1f89286966000cb053b7e94100c76ec6d1129af07
SHA256a87bd092fa5bc00661525455b9f866b68c14c29224520c4e38f56f47234cfc1e
SHA512e184101a03ee1c8896efb0029a02a23e46d422bc0f250ef15349c8214d44156afe2b5f739d8a2339bc2d1c05984fc55651c36c71897cd4b14f41dd37a25cfb01
-
Filesize
95KB
MD57415c1cc63a0c46983e2a32581daefee
SHA15f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA256475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
SHA5123d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2