Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
407s -
max time network
411s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe
Resource
win10v2004-20231023-en
General
-
Target
Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe
-
Size
476KB
-
MD5
b8162dccc95c2ed40a3fd946dd127242
-
SHA1
27899142d055dcce7ad3288028c8e3187421275c
-
SHA256
23ecba0be777d9b7a5683d0939d9ae17c4427c46e51ff959e91785d83c60efd1
-
SHA512
51eef114974531407df6e04af725855293db7e5bdd2e311af5b14dcbef70de9759ae00fa1c17bb72351697fb8d8cf163a1072e957430d33ca90dffeadf0eefbb
-
SSDEEP
3072:AkBGWOsTIJgIDU5A/cto68pMABlZQ2wpFD0ravSGKBUGYDxJ0y5t8:A1ssjn5Mp2w7g+VKvSA
Malware Config
Signatures
-
Detect ZGRat V1 6 IoCs
resource yara_rule behavioral2/files/0x0007000000022d12-465.dat family_zgrat_v1 behavioral2/files/0x0007000000022d12-470.dat family_zgrat_v1 behavioral2/files/0x0007000000022d12-471.dat family_zgrat_v1 behavioral2/memory/4172-472-0x0000023958310000-0x00000239586C6000-memory.dmp family_zgrat_v1 behavioral2/files/0x0007000000022d12-577.dat family_zgrat_v1 behavioral2/files/0x0007000000022d24-588.dat family_zgrat_v1 -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation vc2019.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Voice.ai - Voice Changer.lnk VoiceAI-Installer.exe -
Executes dropped EXE 14 IoCs
pid Process 2980 VoiceAI-Installer.exe 4300 vc2019.exe 2152 vc2019.exe 4780 VC_redist.x64.exe 4172 VoiceAI.exe 3188 VoiceAI.exe 1088 VoiceAI.exe 4580 VoiceAI.exe 4836 VoiceAI.exe 2368 VoiceAI.exe 452 VoiceAI.exe 4400 VoiceAI.exe 3672 VoiceAI.exe 4632 BsSndRpt.exe -
Loads dropped DLL 64 IoCs
pid Process 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 2980 VoiceAI-Installer.exe 2980 VoiceAI-Installer.exe 2152 vc2019.exe 592 VC_redist.x64.exe 4172 VoiceAI.exe 4172 VoiceAI.exe 2980 VoiceAI-Installer.exe 2980 VoiceAI-Installer.exe 3188 VoiceAI.exe 3188 VoiceAI.exe 3188 VoiceAI.exe 3188 VoiceAI.exe 3188 VoiceAI.exe 3188 VoiceAI.exe 3188 VoiceAI.exe 3188 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 4580 VoiceAI.exe 4836 VoiceAI.exe 4836 VoiceAI.exe 4836 VoiceAI.exe 4836 VoiceAI.exe 4836 VoiceAI.exe 4836 VoiceAI.exe 4836 VoiceAI.exe 4836 VoiceAI.exe 2368 VoiceAI.exe 2368 VoiceAI.exe 2368 VoiceAI.exe 2368 VoiceAI.exe 2368 VoiceAI.exe 2368 VoiceAI.exe 2368 VoiceAI.exe 2368 VoiceAI.exe 4400 VoiceAI.exe 4400 VoiceAI.exe 4400 VoiceAI.exe 4400 VoiceAI.exe 4400 VoiceAI.exe 4400 VoiceAI.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{2aaf1df0-eb13-4099-9992-962bb4e596d1} = "\"C:\\ProgramData\\Package Cache\\{2aaf1df0-eb13-4099-9992-962bb4e596d1}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.inf DrvInst.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\SET8DB1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\VoiceAIDriver.cat DrvInst.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\SET8DC2.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\SET8DC3.tmp DrvInst.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.PNF VoiceAI.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\SET8DC3.tmp DrvInst.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\SET8DB1.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\SET8DC2.tmp DrvInst.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\voiceaidriver.sys DrvInst.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\VoiceAIDriver.cat DrvInst.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Voice.ai\libsamplerate-0.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\es-419.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\lv.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\cefsharp.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ja.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\zh-TW.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\Newtonsoft.Json.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libsamplerate.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\pt-BR.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libcef.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libsndfile.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\kn.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\snapshot_blob.bin VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ca.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\v8_context_snapshot.bin VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\NAudio.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\swipe.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\hi.pak VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\installer.log VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\gcrypt.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\hostfxr.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\CefSharp.BrowserSubprocess.Core.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\tools\vc2019.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\el.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\en-GB.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\AudioConverter.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAILib.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libGLESv2.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\de.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ta.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sr.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\tr.pak VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\VoiceAI-Installer.exe Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe File created C:\Program Files\Voice.ai\d3dcompiler_47.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\onnxruntime_providers_shared.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\bn.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\it.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\pt-PT.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\icudtl.dat VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libgpg-error.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\naudio.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ar.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\gu.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\mr.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\chrome_100_percent.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\gcrypt.dll VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\AudioPX.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fa.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\id.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\te.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libgcrypt.txt VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\tools\vc2019.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ru.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.cat VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.inf VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAI-Installer.exe Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe File created C:\Program Files\Voice.ai\hostpolicy.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\version VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\cs.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ms.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\BugSplatDotNet.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\BugSplatRc.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\vi.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\chrome_200_percent.pak VoiceAI-Installer.exe -
Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5c4e4a.msi msiexec.exe File created C:\Windows\Installer\e5c4e5f.msi msiexec.exe File created C:\Windows\INF\c_media.PNF VoiceAI.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI556B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5B48.tmp msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Installer\e5c4e4a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI6413.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6944.tmp msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Installer\e5c4e37.msi msiexec.exe File created C:\Windows\Installer\SourceHash{A181A302-3F6D-4BAD-97A8-A426A6499D78} msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log VoiceAI.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\e5c4e37.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e5c4e49.msi msiexec.exe File created C:\Windows\Installer\SourceHash{A977984B-9244-49E3-BD24-43F0A8009667} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x0006000000022cf9-47.dat nsis_installer_1 behavioral2/files/0x0006000000022cf9-47.dat nsis_installer_2 behavioral2/files/0x0006000000022cf9-48.dat nsis_installer_1 behavioral2/files/0x0006000000022cf9-48.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 47 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000064ad0c2742b1dab0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000064ad0c20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900064ad0c2000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d064ad0c2000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000064ad0c200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\Desktop\ForegroundLockTimeout = "0" BsSndRpt.exe Set value (int) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\Desktop\ForegroundLockTimeout = "15725144" BsSndRpt.exe -
Modifies data under HKEY_USERS 59 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell\open VoiceAI-Installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Media\1 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B489779A44293E94DB42340F8A006976 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{2aaf1df0-eb13-4099-9992-962bb4e596d1} VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell\open\command VoiceAI-Installer.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Dependents\{2aaf1df0-eb13-4099-9992-962bb4e596d1} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{A977984B-9244-49E3-BD24-43F0A8009667}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Version = "14.31.31103.0" VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{2aaf1df0-eb13-4099-9992-962bb4e596d1} VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents VC_redist.x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\PackageName = "vc_runtimeMinimum_x64.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\PackageName = "vc_runtimeAdditional_x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.31.31103" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai VoiceAI-Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell\open\command\ = "\"C:\\Program Files\\Voice.ai\\VoiceAI.exe\" \"%1\"" VoiceAI-Installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\Url Protocol VoiceAI-Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B489779A44293E94DB42340F8A006976\Provider msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987\Provider msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.31.31103" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\PackageCode = "09139770F15A2384695CFEF667B84B3C" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.31.31103" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.31.31103" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.31.31103" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\B489779A44293E94DB42340F8A006976 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A181A302-3F6D-4BAD-97A8-A426A6499D78}v14.31.31103\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A977984B-9244-49E3-BD24-43F0A8009667}v14.31.31103\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.31.31103" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{A181A302-3F6D-4BAD-97A8-A426A6499D78}" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\ = "{2aaf1df0-eb13-4099-9992-962bb4e596d1}" VC_redist.x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Language = "1033" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.31.31103" VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\203A181AD6F3DAB4798A4A626A94D987 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B489779A44293E94DB42340F8A006976\VC_Runtime_Additional msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Net msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 3480 msiexec.exe 3480 msiexec.exe 3480 msiexec.exe 3480 msiexec.exe 3480 msiexec.exe 3480 msiexec.exe 3480 msiexec.exe 3480 msiexec.exe 3188 VoiceAI.exe 3188 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 1088 VoiceAI.exe 2368 VoiceAI.exe 2368 VoiceAI.exe 4836 VoiceAI.exe 4836 VoiceAI.exe 4400 VoiceAI.exe 4400 VoiceAI.exe 4580 VoiceAI.exe 4580 VoiceAI.exe 4836 VoiceAI.exe 4836 VoiceAI.exe 2368 VoiceAI.exe 2368 VoiceAI.exe 4400 VoiceAI.exe 4400 VoiceAI.exe 452 VoiceAI.exe 452 VoiceAI.exe 452 VoiceAI.exe 452 VoiceAI.exe 452 VoiceAI.exe 3672 VoiceAI.exe 3672 VoiceAI.exe 3672 VoiceAI.exe 3672 VoiceAI.exe 3672 VoiceAI.exe 3188 VoiceAI.exe 3188 VoiceAI.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 3200 vssvc.exe Token: SeRestorePrivilege 3200 vssvc.exe Token: SeAuditPrivilege 3200 vssvc.exe Token: SeShutdownPrivilege 4780 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 4780 VC_redist.x64.exe Token: SeSecurityPrivilege 3480 msiexec.exe Token: SeCreateTokenPrivilege 4780 VC_redist.x64.exe Token: SeAssignPrimaryTokenPrivilege 4780 VC_redist.x64.exe Token: SeLockMemoryPrivilege 4780 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 4780 VC_redist.x64.exe Token: SeMachineAccountPrivilege 4780 VC_redist.x64.exe Token: SeTcbPrivilege 4780 VC_redist.x64.exe Token: SeSecurityPrivilege 4780 VC_redist.x64.exe Token: SeTakeOwnershipPrivilege 4780 VC_redist.x64.exe Token: SeLoadDriverPrivilege 4780 VC_redist.x64.exe Token: SeSystemProfilePrivilege 4780 VC_redist.x64.exe Token: SeSystemtimePrivilege 4780 VC_redist.x64.exe Token: SeProfSingleProcessPrivilege 4780 VC_redist.x64.exe Token: SeIncBasePriorityPrivilege 4780 VC_redist.x64.exe Token: SeCreatePagefilePrivilege 4780 VC_redist.x64.exe Token: SeCreatePermanentPrivilege 4780 VC_redist.x64.exe Token: SeBackupPrivilege 4780 VC_redist.x64.exe Token: SeRestorePrivilege 4780 VC_redist.x64.exe Token: SeShutdownPrivilege 4780 VC_redist.x64.exe Token: SeDebugPrivilege 4780 VC_redist.x64.exe Token: SeAuditPrivilege 4780 VC_redist.x64.exe Token: SeSystemEnvironmentPrivilege 4780 VC_redist.x64.exe Token: SeChangeNotifyPrivilege 4780 VC_redist.x64.exe Token: SeRemoteShutdownPrivilege 4780 VC_redist.x64.exe Token: SeUndockPrivilege 4780 VC_redist.x64.exe Token: SeSyncAgentPrivilege 4780 VC_redist.x64.exe Token: SeEnableDelegationPrivilege 4780 VC_redist.x64.exe Token: SeManageVolumePrivilege 4780 VC_redist.x64.exe Token: SeImpersonatePrivilege 4780 VC_redist.x64.exe Token: SeCreateGlobalPrivilege 4780 VC_redist.x64.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe Token: SeTakeOwnershipPrivilege 3480 msiexec.exe Token: SeRestorePrivilege 3480 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2980 VoiceAI-Installer.exe 3188 VoiceAI.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3188 VoiceAI.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3188 VoiceAI.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1536 wrote to memory of 2980 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 106 PID 1536 wrote to memory of 2980 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 106 PID 1536 wrote to memory of 2980 1536 Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe 106 PID 2980 wrote to memory of 4300 2980 VoiceAI-Installer.exe 111 PID 2980 wrote to memory of 4300 2980 VoiceAI-Installer.exe 111 PID 2980 wrote to memory of 4300 2980 VoiceAI-Installer.exe 111 PID 4300 wrote to memory of 2152 4300 vc2019.exe 112 PID 4300 wrote to memory of 2152 4300 vc2019.exe 112 PID 4300 wrote to memory of 2152 4300 vc2019.exe 112 PID 2152 wrote to memory of 4780 2152 vc2019.exe 113 PID 2152 wrote to memory of 4780 2152 vc2019.exe 113 PID 2152 wrote to memory of 4780 2152 vc2019.exe 113 PID 4780 wrote to memory of 3036 4780 VC_redist.x64.exe 122 PID 4780 wrote to memory of 3036 4780 VC_redist.x64.exe 122 PID 4780 wrote to memory of 3036 4780 VC_redist.x64.exe 122 PID 3036 wrote to memory of 592 3036 VC_redist.x64.exe 123 PID 3036 wrote to memory of 592 3036 VC_redist.x64.exe 123 PID 3036 wrote to memory of 592 3036 VC_redist.x64.exe 123 PID 592 wrote to memory of 4348 592 VC_redist.x64.exe 124 PID 592 wrote to memory of 4348 592 VC_redist.x64.exe 124 PID 592 wrote to memory of 4348 592 VC_redist.x64.exe 124 PID 2980 wrote to memory of 4172 2980 VoiceAI-Installer.exe 125 PID 2980 wrote to memory of 4172 2980 VoiceAI-Installer.exe 125 PID 3376 wrote to memory of 4784 3376 svchost.exe 128 PID 3376 wrote to memory of 4784 3376 svchost.exe 128 PID 3376 wrote to memory of 5076 3376 svchost.exe 129 PID 3376 wrote to memory of 5076 3376 svchost.exe 129 PID 2980 wrote to memory of 3964 2980 VoiceAI-Installer.exe 130 PID 2980 wrote to memory of 3964 2980 VoiceAI-Installer.exe 130 PID 1944 wrote to memory of 3188 1944 explorer.exe 132 PID 1944 wrote to memory of 3188 1944 explorer.exe 132 PID 3188 wrote to memory of 1088 3188 VoiceAI.exe 133 PID 3188 wrote to memory of 1088 3188 VoiceAI.exe 133 PID 3188 wrote to memory of 4580 3188 VoiceAI.exe 138 PID 3188 wrote to memory of 4580 3188 VoiceAI.exe 138 PID 3188 wrote to memory of 4836 3188 VoiceAI.exe 137 PID 3188 wrote to memory of 4836 3188 VoiceAI.exe 137 PID 3188 wrote to memory of 2368 3188 VoiceAI.exe 134 PID 3188 wrote to memory of 2368 3188 VoiceAI.exe 134 PID 3188 wrote to memory of 452 3188 VoiceAI.exe 136 PID 3188 wrote to memory of 452 3188 VoiceAI.exe 136 PID 3188 wrote to memory of 4400 3188 VoiceAI.exe 135 PID 3188 wrote to memory of 4400 3188 VoiceAI.exe 135 PID 3188 wrote to memory of 3672 3188 VoiceAI.exe 139 PID 3188 wrote to memory of 3672 3188 VoiceAI.exe 139 PID 3188 wrote to memory of 4632 3188 VoiceAI.exe 142 PID 3188 wrote to memory of 4632 3188 VoiceAI.exe 142 PID 3188 wrote to memory of 4632 3188 VoiceAI.exe 142 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe"C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Program Files\Voice.ai\VoiceAI-Installer.exe"C:\Program Files\Voice.ai\VoiceAI-Installer.exe" /path "C:\Program Files\Voice.ai"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files\Voice.ai\tools\vc2019.exe"C:\Program Files\Voice.ai\tools\vc2019.exe" /q /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\Temp\{9BA935D1-78BD-4E18-AF1E-92897655CDD8}\.cr\vc2019.exe"C:\Windows\Temp\{9BA935D1-78BD-4E18-AF1E-92897655CDD8}\.cr\vc2019.exe" -burn.clean.room="C:\Program Files\Voice.ai\tools\vc2019.exe" -burn.filehandle.attached=556 -burn.filehandle.self=552 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\.be\VC_redist.x64.exe"C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{01D34F9C-09AB-42C5-BAAD-659490E253D4} {B5314471-221E-46B8-AA87-6686000E20B5} 21525⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{C21BD6BF-5EAD-47BE-A4FB-B234F29BB71F} {7D95AC83-E7E8-4E50-AB0D-A52C6D8C328E} 47806⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{C21BD6BF-5EAD-47BE-A4FB-B234F29BB71F} {7D95AC83-E7E8-4E50-AB0D-A52C6D8C328E} 47807⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{265D2337-C38E-48C0-BDCC-13A709540171} {B10BA799-63C5-4210-B36C-270D5F5BBC27} 5928⤵
- Modifies registry class
PID:4348
-
-
-
-
-
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" installdriver3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
PID:4172
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\Voice.ai\VoiceAI.exe"3⤵PID:3964
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:2240
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8eb9356f-f873-c048-b9eb-aca4b77df8e9}\voiceaidriver.inf" "9" "46b7f3743" "0000000000000138" "WinSta0\Default" "0000000000000154" "208" "c:\program files\voice.ai\voiceaidriver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4784
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11bfc96d40:VOICEAIDRIVER_SA:16.36.0.99:root\voiceaidriver," "46b7f3743" "0000000000000138"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:5076
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=2640 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=31883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1088
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3196 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=31883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2368
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3508 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=3188 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3500 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=3188 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:452
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3184 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=31883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4836
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:/Program Files/Voice.ai/VoiceAI.exe" discord 31883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3496 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=31883⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3672
-
-
C:\Program Files\Voice.ai\BsSndRpt.exe"C:\Program Files\Voice.ai\BsSndRpt.exe" /i "C:\Users\Admin\AppData\Local\Temp\tmp986B.ini"3⤵
- Executes dropped EXE
- Modifies Control Panel
PID:4632
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4d0 0x5481⤵PID:2964
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5a2c9694597db34e519ca5e5e8ba6acdc
SHA1f72aff959a6b4ee5daab1d53e2f92184cdcec714
SHA2568a808476401a9b4c69f6a0bbf9b30457204c27ea2ede4aa4172e3d4a568a0b3a
SHA5128d058b3d8b26f8f62e926e8651923e2122005fedce9411d92463271a7b794e373142defadffb267c84e12326cfdbf5f54289903d7313cac071d72416ebff5690
-
Filesize
19KB
MD5b87d0f670af85827f32f8331627c2631
SHA16705175e721e0fdbcdcaef9a2626037dfa70c906
SHA25670582c95d8ae26e1191a91432e3d48b924a040f90cfbbcce1c953047e4b02cc9
SHA512247cf3324b58d112d7e050484fcaae5565bff42dfad46cb1d444103f59e5fc1a3d1db0966a6c82ff2c4410dc172f4b79e7a87371fc5b6c11e985f47467035c9e
-
Filesize
21KB
MD538632de774d19487e40b3340d332df20
SHA184d7d5ac161a1bb68145930565edfca51795250f
SHA256a485c4d5969bcb6aa442b45e8665a48b3348e088a210eae293281bbefdda503e
SHA5127abfc619c805e95c396146ec0e4b92e2fe6091734a6e389631dbf7a7abbae69d566a0f8b49458a00ac941ef69784cf4458355d075259d50a7a956e1bb46ec7d3
-
Filesize
21KB
MD5de6f1b3b9385ad33a8534b37285447a3
SHA1c064c665ab33b2be2ad889bd6ee303474bad32e0
SHA256fbc4ae5381092fd46d501ea65b92c8b5692a66b27bd9a9496b12f0a90dbfa2b2
SHA512f13e2695a92d80287b62c7aa25b3c5e6309cab5dc345cadabec2a731ee80582a51a3074a91ead6716cd76b816c37e8851d802a794489c1b4e79a4e2d26f89e39
-
Filesize
425KB
MD51dbdc883fe4375e343e574bf085c0148
SHA1e2235e18bcb3cececcdc6024426de2437596e8c4
SHA25667271bdbe5fbc4f77fb9ec5c206da226e76245e1fbf48753156e9dcb6e5b946f
SHA51243242a0697b497a24f2b80533658d4ed9c85f37925bec471aa8b5646bfdefd9d996ab896c2d63f21ff648fc5494b24a35e4f6717041c9c97c09ca585285682a8
-
Filesize
352KB
MD5e3d3fa0437d5a99417a19ce8102efc2e
SHA1681e2e4f6ce4f5dbfcda87331dfeecf5d949c485
SHA256253210bcc6dd07e76a78874c5c546b196410d9a2e1cb0f2ee99537fb14e5f762
SHA512e55566dd38394061a89729c48f4e655fcbb35d6d688c965d69e65473ff0f54cf67ca870c1253a9867902f3774abf4994f29fb616fcb79232bba9e0775c582e76
-
Filesize
29KB
MD5ac26d03344261ecee82a6b8582170545
SHA17ef20eaaae85e2bd63674f9e543c5d4deeceab53
SHA25675ef9ece9dd1f0d855d8627f8d0b965c08007085a0f66fbdbc5582ff2a195207
SHA512e3e63f4bc531714d5cc0b1a92b3ba1f5443806ece64f874cda4d102d52919a5cc503017d144419c857fb88e03049f3549f09f571adf041fe29226071b4a32863
-
Filesize
282KB
MD573654ef4eaf3bd6f903565015d756bba
SHA18382914213112ccc8f521230de180a8b633440ee
SHA256789fc4fa01b3091913c3bf4e6944c77f5fbd5df7685d71cc00af2946bcfe0048
SHA512d22a4bb029a4b93fa586a7d617646e58143b1fb020accc62898d73d283d2ca447cdff92d6fe6068228e9eb322d25a9db500dc294445bd43a86118c08aaac8f94
-
Filesize
1.1MB
MD5ae2bd5b01f68bfc00e9a5b105354f3f6
SHA1f4bfe78666db12f06841889269ab33abc34ae5f4
SHA256a4b63108af66f2caad573b51c6de0412aa0f271ad2ff8c5f0a5836f8f8b3ef85
SHA5129be46f88fba97fe1eca08165f1ed21800ebf032018d005b4275d19a09e727fd271b515e0d9b96c3950a8ccc34a11dcea088f891538da598539db92b7e9ca77f1
-
Filesize
47KB
MD597847eb086065d89bab93d34a9fd8936
SHA1112fe59b07619176492eb75b2c25370d32c2900f
SHA256a8d06260c75804e61facd47c3a70c1256f6277bf488d6e4015fcc9770af795cb
SHA5127c13235b7015417780b74db7f202f5c41f2c86f8c26e81aa9376a778ba91f4450deba091f2a06188cc92a456f9a395ae51ba8d06e2fe95eeffc637d129fceb14
-
Filesize
82KB
MD50ca711f575bca2fae56fd952d9af1276
SHA1d53d175ddc924431707b8a6e4e4e834094a5fc6e
SHA256a789ea2806ebb04f8f9fb59c2ee0d407b64e5c33042ca7cd68aeee2fed6b0ea0
SHA512513de025729d4eb9f9edcbf42b5f5012321ecf1383ce2af0dd6e71b881e72f310d937b59df28cb9e416a79c4294a629da07be68a1c1622f0f1f499c8babbebc1
-
Filesize
82KB
MD50ca711f575bca2fae56fd952d9af1276
SHA1d53d175ddc924431707b8a6e4e4e834094a5fc6e
SHA256a789ea2806ebb04f8f9fb59c2ee0d407b64e5c33042ca7cd68aeee2fed6b0ea0
SHA512513de025729d4eb9f9edcbf42b5f5012321ecf1383ce2af0dd6e71b881e72f310d937b59df28cb9e416a79c4294a629da07be68a1c1622f0f1f499c8babbebc1
-
Filesize
699.3MB
MD547b51c4a94239d1ee6de41d85f8bb349
SHA10a9019084e063d70feac8ff9c62386f3efe88934
SHA256060d81f1b0b23a57f4fd349c9cea299e925e708a99b4c7a0d9eb0cbd1877e920
SHA51293b828ce8b32ac4ef2f96ede862bcfab305192bb5f3b6717a66925631b3a4fc3e3410496dce52925858ac58763479d8ec1d3aedf1bd8aab0b85a154ea0c4757d
-
Filesize
699.3MB
MD547b51c4a94239d1ee6de41d85f8bb349
SHA10a9019084e063d70feac8ff9c62386f3efe88934
SHA256060d81f1b0b23a57f4fd349c9cea299e925e708a99b4c7a0d9eb0cbd1877e920
SHA51293b828ce8b32ac4ef2f96ede862bcfab305192bb5f3b6717a66925631b3a4fc3e3410496dce52925858ac58763479d8ec1d3aedf1bd8aab0b85a154ea0c4757d
-
Filesize
3.7MB
MD5bc63a61c808ac77a79c939bfb0db6ee0
SHA17998e6968f80737ff57762fbc362295877df7483
SHA25665710751192fa192dd4b0cb8cebb1adf259ca05df9b53ad3578a8316ead0c8f7
SHA512b58fb887e54abde6ebd772803d33fe4e38252feca875602d4320906b03a1b9b3dfcba4905f235fea93796cd1c5c236ecb60fcf363a364be742020e99cabef8b1
-
Filesize
3.7MB
MD5bc63a61c808ac77a79c939bfb0db6ee0
SHA17998e6968f80737ff57762fbc362295877df7483
SHA25665710751192fa192dd4b0cb8cebb1adf259ca05df9b53ad3578a8316ead0c8f7
SHA512b58fb887e54abde6ebd772803d33fe4e38252feca875602d4320906b03a1b9b3dfcba4905f235fea93796cd1c5c236ecb60fcf363a364be742020e99cabef8b1
-
Filesize
3.7MB
MD5bc63a61c808ac77a79c939bfb0db6ee0
SHA17998e6968f80737ff57762fbc362295877df7483
SHA25665710751192fa192dd4b0cb8cebb1adf259ca05df9b53ad3578a8316ead0c8f7
SHA512b58fb887e54abde6ebd772803d33fe4e38252feca875602d4320906b03a1b9b3dfcba4905f235fea93796cd1c5c236ecb60fcf363a364be742020e99cabef8b1
-
Filesize
3.7MB
MD5bc63a61c808ac77a79c939bfb0db6ee0
SHA17998e6968f80737ff57762fbc362295877df7483
SHA25665710751192fa192dd4b0cb8cebb1adf259ca05df9b53ad3578a8316ead0c8f7
SHA512b58fb887e54abde6ebd772803d33fe4e38252feca875602d4320906b03a1b9b3dfcba4905f235fea93796cd1c5c236ecb60fcf363a364be742020e99cabef8b1
-
Filesize
14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
Filesize
65B
MD52f766d5f93e187462dc61513cd4da4d2
SHA17cfcbd1fe4168d3d0d9eb32b876deb20435d1e4f
SHA256539119bb31af3ebc27735a4c6d09905c771a42283dd901b66d77117f7bdf8987
SHA5121620127e09bbfac04af6cc301a43614198ea757a77108ed46a8e9b4b76ca4083b2590d6bc7a3a4f295267dc8e1b8d32fe15c612f8407959e6778e3a1c241baad
-
Filesize
24.1MB
MD54a85bfd44f09ef46679fafcb1bab627a
SHA17741a5cad238ce3e4ca7756058f2a67a57fee9d1
SHA25637ed59a66699c0e5a7ebeef7352d7c1c2ed5ede7212950a1b0a8ee289af4a95b
SHA512600e61332416b23ef518f4252df0000c03612e8b0680eab0bdf589d9c855539b973583dc4ce1faab5828f58653ed85a1f9196eb1c7bbf6d2e3b5ab3e83253f98
-
Filesize
24.1MB
MD54a85bfd44f09ef46679fafcb1bab627a
SHA17741a5cad238ce3e4ca7756058f2a67a57fee9d1
SHA25637ed59a66699c0e5a7ebeef7352d7c1c2ed5ede7212950a1b0a8ee289af4a95b
SHA512600e61332416b23ef518f4252df0000c03612e8b0680eab0bdf589d9c855539b973583dc4ce1faab5828f58653ed85a1f9196eb1c7bbf6d2e3b5ab3e83253f98
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5f35b86dcf6488230867f62f9881b3763
SHA142b88b81a2c99fb6b277cc83b1f0b77584d9890e
SHA2568b51b9c7997922521e8f5f660169f9780c9b6cf1bc7f46f6a8f617aa87477070
SHA512f18ec179a8eb561bd6267c99a52e4b40ffe21a9c095c5458a9546e2624005c9aa277826944253c975382c56d0e48fe3da90471136b7420f299cb733b06b6e6e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize471B
MD501b9ce813efe124f49534075847fc96d
SHA136be0bc8357e8c2408e464354a9c9e629c161f8e
SHA25628f815ffca4be91b7dfe771a68a7a5a1bc669e7b2838ec4b19f5912b91d54a8c
SHA512e0955e4ac4e4e80311183ef7653a6c938d40977863a80626cd38b6349d1acb027089124e425ea75b33a22d23142b008c61b5bf5d6a74df4bf3056221eb079eab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_2B0B046597052ECC9F4BC3AE1A0ED1B1
Filesize727B
MD5a79065910648284c8722f4e68d89be86
SHA128173bff7b1757af60a37511f59a85630b79631d
SHA2560fc3043b94e7cf895b591864de8e48ea5edfa74a90c2c261c156275cef183e5a
SHA512a2a466d207e95958877aa3f81dfb8d656deaf592488e3b8136ea1b1d8837b09a9b10ee92793179ae687024cd7526280a80f944996d37877c7063b474cbb8715b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD5649ab1ec6627955e76deef26551857fb
SHA1991ba18ac0faab574ccad1e6b02be2d56f73f63f
SHA25694860a682896d1d7f6c82d72b62084e939c6d5b7a4646c0321c94b41409ab3d0
SHA5120cc921ef41c6f159161178e6380ebae02b5f49f69564594df0bb2b9ca7a5b5ada472d9d15a6f7c2d794ce67c7222bf513e1deb227eff862aa170acde3e593af4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD550c42df10c59b6bb9ae861e93e010ab1
SHA15ad121126ef40d259e33254dc42fe65467782c21
SHA2560cf207fd4561c1169b1c706bc126f106e02a15c7714bc6d989e99f11933bab70
SHA512f04d7b43218864232b79bf046e8c6c8b539d96d8149bcfe6dea1c3cb47c776336c87fa85f9163e7f503e4507c10a54eba0faea954fbc04eb9c9df0e1f5efd403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize400B
MD5b38df863335d82e7aa9f13dcd25245c8
SHA197a6bb10572bb7d049128f99475d3864de90fb23
SHA25699784ee6df8755985200eb6b8a2ed28d86b3d2ddd355216c14e0b9766f290fa5
SHA512dc60619513706e9835934ceed696f0c51d672b975f2cd4be371b4bec5d9f4426f48b25a42795f59d2d4ba0b8af1e829aace2468f0aafdd4c55599dc4ef2c8ce2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_2B0B046597052ECC9F4BC3AE1A0ED1B1
Filesize408B
MD55f088e28ba38923268085c3ebff0d446
SHA13a7c9337169df1996c5306527673f4e0d5f8aaf9
SHA2567592ac031136b0b4fa4e1c3bdcaf1ebeec9bedb002019d0c50421a328aa6d676
SHA51277fe5b5f76af3e517429c0980ba8f5b0f372176d5855eea528ced7ddce4413be42e472b5deff2368d9b03a562a63a38231a2ad268470aa628c9809dfe72a1a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize412B
MD51272eeeba26b78715311ca8b97ade125
SHA126da9b3a32085098783d1797664d7d46d91abab2
SHA25624258a1c2c613e27912c9edef81f47e4b72fb4877412b1aee71370ba93a2c0ad
SHA512e47146c8cbf4b7201cbbbff3591eedb2446aca2629cbb8665193828fba2eec609af019a9271dd426a8029ce908ea399cd02115aa85b9e5d450ddc358f6037293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD5a09022e926645f53db532d68791d0a01
SHA1a048292421c58685daa96cec8c6686304e3844be
SHA256814c5787e92b8c75dc3bd56626a7e31ebba56db7d2eec65217a696373335b8ce
SHA512f48dad05198cd09926d81527a8898872f709fe85130f37331863c96b07b5b1773b64904e4240ce831adefaca646333ee23385cbf3a70af1f3a326fd7018fbdef
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
16B
MD57363e85fe9edee6f053a4b319588c086
SHA1a15e2127145548437173fc17f3e980e3f3dee2d0
SHA256c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
SHA512a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85
-
Filesize
2KB
MD563e8e3ff64ed509714a9f6a98f178d60
SHA1c2673b9d3a2518d7ab725cb2c944e4b77866985f
SHA2566bc8c8434812f6e689f510252b9f110e67cae677f94bf113322394d99bdf67c6
SHA512166a11b6ecf4051884d6791a42b02f304065dcf80dbd692bf3204e699d92ebf2ffc853985e7ba3121df238eeef4284e96575d6533bb08b8c2bb6e73c9980b16f
-
Filesize
2KB
MD5f7954a68d7af5f55da4592dee7207165
SHA1f1dae4fd184547987e79f8fd01dd6bd55f00245f
SHA256b31dde30a3cccb2897d4c30ff62073d7a2c905105dcb7832f820c8f3ccd79940
SHA512aa5fb6470944f207643fe50a2a86f5faac0f255156455dd3a350bf7563101a65ad9fab2628c4f23b8ef214664c76181043be09f122bcdaf9f774240facb2c80c
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
12KB
MD5792b6f86e296d3904285b2bf67ccd7e0
SHA1966b16f84697552747e0ddd19a4ba8ab5083af31
SHA256c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
SHA51297edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
-
Filesize
12KB
MD5792b6f86e296d3904285b2bf67ccd7e0
SHA1966b16f84697552747e0ddd19a4ba8ab5083af31
SHA256c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
SHA51297edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
-
Filesize
9KB
MD5f5b0c649b0cfc103fb113d013d48cacb
SHA1f89286966000cb053b7e94100c76ec6d1129af07
SHA256a87bd092fa5bc00661525455b9f866b68c14c29224520c4e38f56f47234cfc1e
SHA512e184101a03ee1c8896efb0029a02a23e46d422bc0f250ef15349c8214d44156afe2b5f739d8a2339bc2d1c05984fc55651c36c71897cd4b14f41dd37a25cfb01
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
21KB
MD52b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
Filesize
12KB
MD5792b6f86e296d3904285b2bf67ccd7e0
SHA1966b16f84697552747e0ddd19a4ba8ab5083af31
SHA256c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
SHA51297edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
-
Filesize
4KB
MD505450face243b3a7472407b999b03a72
SHA1ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA25695fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
SHA512f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
-
Filesize
12KB
MD526f1832c761580eab272ae065f644005
SHA1bdd7eb53423659de315d88ad5bb557ffdf5593a5
SHA256bae9e5bbff837d0ebb43ca1ff1a275474d8e50832a590a957afc8d3ee1e5f560
SHA512a0c5c4fa7dcc9d4347a521863b9ba4fd2f5eda4d49f70498c4e89c54b59b7773835796e0cc83470c191e1231c69885d22efe823a3a96b2b971ccd1473e2630eb
-
Filesize
71KB
MD590e4c7c347839c09c8f7f45de3f4fda1
SHA118c5a6fae8c9292702d62e9ad2da1e24336f72c6
SHA25674c4c2f122d48548019314fe15a331b81bfc10408b0d6f471dee94e37fe3c1bc
SHA5122cf37738f112026eeb68636423e619be5e34cae7734ab1cab5d8cc799af7509d2ffca09b566cbe46bb47f54981042099e857660acc2ab24558715408c011bd58
-
Filesize
14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
Filesize
48B
MD587efb1fcb51c4982406a0b4c31085153
SHA1ae9c4452881ba5d965f770de3b3c62d01e89aa45
SHA2568b558be89d2fb282eac191cd4bf8acf509e81b2c0c05645d7cb4afffaccd4e14
SHA51262d7f593dda3844dc95985661b50bc91c0ec38cbf9db6d3b9e0d542a89d5d7ea508f5d0df318e8fd6c47f7aca2a283b6f100c55eb778b718763959715b8a8928
-
Filesize
264B
MD51aea62b19e46979572a031baa497dea3
SHA13ca210a88af9e6a99e6a48af1c6f0ae8025239bf
SHA256b7e31b24a358eea2e9e63a28f3b3073cea6cee1b823d0582e1d3b718450ef65f
SHA51217df3593fa36a29894357850a408b8f462ac2f0f21695eb61481f1fb4c5d68bc5eaef966632e5d7c70ea8e269dde38ff7f65065d70fa2ba9dd9ca74ac552e81f
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1KB
MD54bcfc39ad5278b0673f94c8ea8579770
SHA1bc42160845c190e201372f3af85d4625666cdfbb
SHA25678776148ed6ec21e01ebf71f8c7f35c874141f840fe1b155b2e1adacc47e1703
SHA512ee7fe0aaafd2a6049274319b6c8c3f952deb9f3971f841495a1165be0c9bd627eb8648362e13b330c4664a345e8a77015e9294272851b9b9610b04c2106d70b7
-
Filesize
1KB
MD55cc85e1cf98850c7e146d214f103f407
SHA14ccbebc437af0d66d86de57e2aad1c0cd56b0ec8
SHA2564e8524618f372c8435758d4657215ef05b8b06c8a87f471c8a2b4f38475f38e2
SHA512859ea54ffd06a6a5ac4ee3b69efa93d3a1121eba28d00596f5277b5d5c44c6438e0ec2d4ae4b77a0f061a30df07a45a772439fc58bd093f67b163e5822ac4eb6
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
Filesize
180KB
MD5143a2b9f1c0ebc3421b52e9adcb4db2e
SHA106e01b8cc855fd9a31f99b430f8c8745e706c677
SHA2565d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954
SHA5127e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05
-
Filesize
95KB
MD57415c1cc63a0c46983e2a32581daefee
SHA15f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA256475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
SHA5123d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
-
C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.inf
Filesize14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
Filesize
12KB
MD526f1832c761580eab272ae065f644005
SHA1bdd7eb53423659de315d88ad5bb557ffdf5593a5
SHA256bae9e5bbff837d0ebb43ca1ff1a275474d8e50832a590a957afc8d3ee1e5f560
SHA512a0c5c4fa7dcc9d4347a521863b9ba4fd2f5eda4d49f70498c4e89c54b59b7773835796e0cc83470c191e1231c69885d22efe823a3a96b2b971ccd1473e2630eb
-
Filesize
14KB
MD5fa4ddfa2231dc2c50e26794ae7356e0b
SHA1463f4c2ac4f7505f2361c7853505b19fbe08f257
SHA256a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
SHA512be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
-
Filesize
71KB
MD590e4c7c347839c09c8f7f45de3f4fda1
SHA118c5a6fae8c9292702d62e9ad2da1e24336f72c6
SHA25674c4c2f122d48548019314fe15a331b81bfc10408b0d6f471dee94e37fe3c1bc
SHA5122cf37738f112026eeb68636423e619be5e34cae7734ab1cab5d8cc799af7509d2ffca09b566cbe46bb47f54981042099e857660acc2ab24558715408c011bd58
-
Filesize
95KB
MD57415c1cc63a0c46983e2a32581daefee
SHA15f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA256475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
SHA5123d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
5.4MB
MD56ce5097b19cf57527651840bb438adf3
SHA149d0b725e5819a076562fd007490eca0bbb69003
SHA256f24a3bc5df7e7c07c0d13f46348c989eae7f597f428b20cc9044bba47785b7f0
SHA5129152301c4f87018d166b624d73919fc2da7e7ef74b2c1ecf8ad01c31c2b2239013cc3bc22237c81940ae96a5fd1b3698d260c3d3e0a9d0318cdc053e28328d83
-
Filesize
879KB
MD58e288dd0b5e0468ed8ae01ee566e77e8
SHA1fbd11237ae3300a2202444d339601d1ac6bbf310
SHA256c80addc870825e9a1aa9281e105e583973ec2846bbd74f1e97cb60911ba7a2e1
SHA512facc72bdcdd5de47c0d18ecb5288962b04d9e4924a9a07ee807a3bf0eaa77eac05f086906b680bcf97c3bad5fab0038b47c0e09cd2bbec1d0709eba015bc1c04
-
Filesize
180KB
MD5e6df9f55e20905f77b136844a3844dd6
SHA1b7c1fb12bda508a62fdd9ffa9e870cae50605aaa
SHA256f8745f3523ea73806d591fa4e666e86c30c7e5240a07211a0c11a7633d16c4f0
SHA5127c71c2b9a7d3d768d1686cb037362efb9e38c50b652bfaeb22cf86c6c47a85962f9893cbf5e2f86880c9c8fc8bc0278edeb47088813e022ef05d7db15efc0713
-
Filesize
180KB
MD5143a2b9f1c0ebc3421b52e9adcb4db2e
SHA106e01b8cc855fd9a31f99b430f8c8745e706c677
SHA2565d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954
SHA5127e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
635KB
MD59bd591625766a7330708b2c6380dc1d7
SHA118018a3d12278187a8dc26eae538a799511bbdfc
SHA25621503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
SHA51258c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
-
Filesize
71KB
MD590e4c7c347839c09c8f7f45de3f4fda1
SHA118c5a6fae8c9292702d62e9ad2da1e24336f72c6
SHA25674c4c2f122d48548019314fe15a331b81bfc10408b0d6f471dee94e37fe3c1bc
SHA5122cf37738f112026eeb68636423e619be5e34cae7734ab1cab5d8cc799af7509d2ffca09b566cbe46bb47f54981042099e857660acc2ab24558715408c011bd58
-
Filesize
12KB
MD526f1832c761580eab272ae065f644005
SHA1bdd7eb53423659de315d88ad5bb557ffdf5593a5
SHA256bae9e5bbff837d0ebb43ca1ff1a275474d8e50832a590a957afc8d3ee1e5f560
SHA512a0c5c4fa7dcc9d4347a521863b9ba4fd2f5eda4d49f70498c4e89c54b59b7773835796e0cc83470c191e1231c69885d22efe823a3a96b2b971ccd1473e2630eb