Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/11/2023, 15:11

231101-sky1haab5w 7

31/10/2023, 15:15

231031-sndtqsac5x 10

Analysis

  • max time kernel
    407s
  • max time network
    411s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2023, 15:15

General

  • Target

    Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe

  • Size

    476KB

  • MD5

    b8162dccc95c2ed40a3fd946dd127242

  • SHA1

    27899142d055dcce7ad3288028c8e3187421275c

  • SHA256

    23ecba0be777d9b7a5683d0939d9ae17c4427c46e51ff959e91785d83c60efd1

  • SHA512

    51eef114974531407df6e04af725855293db7e5bdd2e311af5b14dcbef70de9759ae00fa1c17bb72351697fb8d8cf163a1072e957430d33ca90dffeadf0eefbb

  • SSDEEP

    3072:AkBGWOsTIJgIDU5A/cto68pMABlZQ2wpFD0ravSGKBUGYDxJ0y5t8:A1ssjn5Mp2w7g+VKvSA

Malware Config

Signatures

  • Detect ZGRat V1 6 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 47 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 2 IoCs
  • Modifies data under HKEY_USERS 59 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe
    "C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-9a8076101605478c95f602b0ba1e61b7.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Program Files\Voice.ai\VoiceAI-Installer.exe
      "C:\Program Files\Voice.ai\VoiceAI-Installer.exe" /path "C:\Program Files\Voice.ai"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Program Files\Voice.ai\tools\vc2019.exe
        "C:\Program Files\Voice.ai\tools\vc2019.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4300
        • C:\Windows\Temp\{9BA935D1-78BD-4E18-AF1E-92897655CDD8}\.cr\vc2019.exe
          "C:\Windows\Temp\{9BA935D1-78BD-4E18-AF1E-92897655CDD8}\.cr\vc2019.exe" -burn.clean.room="C:\Program Files\Voice.ai\tools\vc2019.exe" -burn.filehandle.attached=556 -burn.filehandle.self=552 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{01D34F9C-09AB-42C5-BAAD-659490E253D4} {B5314471-221E-46B8-AA87-6686000E20B5} 2152
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4780
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{C21BD6BF-5EAD-47BE-A4FB-B234F29BB71F} {7D95AC83-E7E8-4E50-AB0D-A52C6D8C328E} 4780
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3036
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{C21BD6BF-5EAD-47BE-A4FB-B234F29BB71F} {7D95AC83-E7E8-4E50-AB0D-A52C6D8C328E} 4780
                7⤵
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:592
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{265D2337-C38E-48C0-BDCC-13A709540171} {B10BA799-63C5-4210-B36C-270D5F5BBC27} 592
                  8⤵
                  • Modifies registry class
                  PID:4348
      • C:\Program Files\Voice.ai\VoiceAI.exe
        "C:\Program Files\Voice.ai\VoiceAI.exe" installdriver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies system certificate store
        PID:4172
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" "C:\Program Files\Voice.ai\VoiceAI.exe"
        3⤵
          PID:3964
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3200
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:2240
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3480
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:3376
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8eb9356f-f873-c048-b9eb-aca4b77df8e9}\voiceaidriver.inf" "9" "46b7f3743" "0000000000000138" "WinSta0\Default" "0000000000000154" "208" "c:\program files\voice.ai\voiceaidriver"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4784
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11bfc96d40:VOICEAIDRIVER_SA:16.36.0.99:root\voiceaidriver," "46b7f3743" "0000000000000138"
          2⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          PID:5076
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Program Files\Voice.ai\VoiceAI.exe
          "C:\Program Files\Voice.ai\VoiceAI.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3188
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=2640 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=3188
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:1088
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3196 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=3188
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:2368
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3508 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=3188 /prefetch:1
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:4400
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3500 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=3188 /prefetch:1
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:452
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3184 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=3188
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:4836
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:/Program Files/Voice.ai/VoiceAI.exe" discord 3188
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:4580
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3496 --field-trial-handle=2580,i,9525368986958911427,1262840753559776866,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=3188
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3672
          • C:\Program Files\Voice.ai\BsSndRpt.exe
            "C:\Program Files\Voice.ai\BsSndRpt.exe" /i "C:\Users\Admin\AppData\Local\Temp\tmp986B.ini"
            3⤵
            • Executes dropped EXE
            • Modifies Control Panel
            PID:4632
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x4d0 0x548
        1⤵
          PID:2964

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e5c4e3c.rbs

          Filesize

          19KB

          MD5

          a2c9694597db34e519ca5e5e8ba6acdc

          SHA1

          f72aff959a6b4ee5daab1d53e2f92184cdcec714

          SHA256

          8a808476401a9b4c69f6a0bbf9b30457204c27ea2ede4aa4172e3d4a568a0b3a

          SHA512

          8d058b3d8b26f8f62e926e8651923e2122005fedce9411d92463271a7b794e373142defadffb267c84e12326cfdbf5f54289903d7313cac071d72416ebff5690

        • C:\Config.Msi\e5c4e48.rbs

          Filesize

          19KB

          MD5

          b87d0f670af85827f32f8331627c2631

          SHA1

          6705175e721e0fdbcdcaef9a2626037dfa70c906

          SHA256

          70582c95d8ae26e1191a91432e3d48b924a040f90cfbbcce1c953047e4b02cc9

          SHA512

          247cf3324b58d112d7e050484fcaae5565bff42dfad46cb1d444103f59e5fc1a3d1db0966a6c82ff2c4410dc172f4b79e7a87371fc5b6c11e985f47467035c9e

        • C:\Config.Msi\e5c4e4f.rbs

          Filesize

          21KB

          MD5

          38632de774d19487e40b3340d332df20

          SHA1

          84d7d5ac161a1bb68145930565edfca51795250f

          SHA256

          a485c4d5969bcb6aa442b45e8665a48b3348e088a210eae293281bbefdda503e

          SHA512

          7abfc619c805e95c396146ec0e4b92e2fe6091734a6e389631dbf7a7abbae69d566a0f8b49458a00ac941ef69784cf4458355d075259d50a7a956e1bb46ec7d3

        • C:\Config.Msi\e5c4e5e.rbs

          Filesize

          21KB

          MD5

          de6f1b3b9385ad33a8534b37285447a3

          SHA1

          c064c665ab33b2be2ad889bd6ee303474bad32e0

          SHA256

          fbc4ae5381092fd46d501ea65b92c8b5692a66b27bd9a9496b12f0a90dbfa2b2

          SHA512

          f13e2695a92d80287b62c7aa25b3c5e6309cab5dc345cadabec2a731ee80582a51a3074a91ead6716cd76b816c37e8851d802a794489c1b4e79a4e2d26f89e39

        • C:\Program Files\Voice.ai\AudioConverter.dll

          Filesize

          425KB

          MD5

          1dbdc883fe4375e343e574bf085c0148

          SHA1

          e2235e18bcb3cececcdc6024426de2437596e8c4

          SHA256

          67271bdbe5fbc4f77fb9ec5c206da226e76245e1fbf48753156e9dcb6e5b946f

          SHA512

          43242a0697b497a24f2b80533658d4ed9c85f37925bec471aa8b5646bfdefd9d996ab896c2d63f21ff648fc5494b24a35e4f6717041c9c97c09ca585285682a8

        • C:\Program Files\Voice.ai\BsSndRpt.exe

          Filesize

          352KB

          MD5

          e3d3fa0437d5a99417a19ce8102efc2e

          SHA1

          681e2e4f6ce4f5dbfcda87331dfeecf5d949c485

          SHA256

          253210bcc6dd07e76a78874c5c546b196410d9a2e1cb0f2ee99537fb14e5f762

          SHA512

          e55566dd38394061a89729c48f4e655fcbb35d6d688c965d69e65473ff0f54cf67ca870c1253a9867902f3774abf4994f29fb616fcb79232bba9e0775c582e76

        • C:\Program Files\Voice.ai\BugSplatDotNet.dll

          Filesize

          29KB

          MD5

          ac26d03344261ecee82a6b8582170545

          SHA1

          7ef20eaaae85e2bd63674f9e543c5d4deeceab53

          SHA256

          75ef9ece9dd1f0d855d8627f8d0b965c08007085a0f66fbdbc5582ff2a195207

          SHA512

          e3e63f4bc531714d5cc0b1a92b3ba1f5443806ece64f874cda4d102d52919a5cc503017d144419c857fb88e03049f3549f09f571adf041fe29226071b4a32863

        • C:\Program Files\Voice.ai\BugSplatRc.dll

          Filesize

          282KB

          MD5

          73654ef4eaf3bd6f903565015d756bba

          SHA1

          8382914213112ccc8f521230de180a8b633440ee

          SHA256

          789fc4fa01b3091913c3bf4e6944c77f5fbd5df7685d71cc00af2946bcfe0048

          SHA512

          d22a4bb029a4b93fa586a7d617646e58143b1fb020accc62898d73d283d2ca447cdff92d6fe6068228e9eb322d25a9db500dc294445bd43a86118c08aaac8f94

        • C:\Program Files\Voice.ai\CefSharp.BrowserSubprocess.Core.dll

          Filesize

          1.1MB

          MD5

          ae2bd5b01f68bfc00e9a5b105354f3f6

          SHA1

          f4bfe78666db12f06841889269ab33abc34ae5f4

          SHA256

          a4b63108af66f2caad573b51c6de0412aa0f271ad2ff8c5f0a5836f8f8b3ef85

          SHA512

          9be46f88fba97fe1eca08165f1ed21800ebf032018d005b4275d19a09e727fd271b515e0d9b96c3950a8ccc34a11dcea088f891538da598539db92b7e9ca77f1

        • C:\Program Files\Voice.ai\CefSharp.Core.dll

          Filesize

          47KB

          MD5

          97847eb086065d89bab93d34a9fd8936

          SHA1

          112fe59b07619176492eb75b2c25370d32c2900f

          SHA256

          a8d06260c75804e61facd47c3a70c1256f6277bf488d6e4015fcc9770af795cb

          SHA512

          7c13235b7015417780b74db7f202f5c41f2c86f8c26e81aa9376a778ba91f4450deba091f2a06188cc92a456f9a395ae51ba8d06e2fe95eeffc637d129fceb14

        • C:\Program Files\Voice.ai\DriverManager.dll

          Filesize

          82KB

          MD5

          0ca711f575bca2fae56fd952d9af1276

          SHA1

          d53d175ddc924431707b8a6e4e4e834094a5fc6e

          SHA256

          a789ea2806ebb04f8f9fb59c2ee0d407b64e5c33042ca7cd68aeee2fed6b0ea0

          SHA512

          513de025729d4eb9f9edcbf42b5f5012321ecf1383ce2af0dd6e71b881e72f310d937b59df28cb9e416a79c4294a629da07be68a1c1622f0f1f499c8babbebc1

        • C:\Program Files\Voice.ai\DriverManager.dll

          Filesize

          82KB

          MD5

          0ca711f575bca2fae56fd952d9af1276

          SHA1

          d53d175ddc924431707b8a6e4e4e834094a5fc6e

          SHA256

          a789ea2806ebb04f8f9fb59c2ee0d407b64e5c33042ca7cd68aeee2fed6b0ea0

          SHA512

          513de025729d4eb9f9edcbf42b5f5012321ecf1383ce2af0dd6e71b881e72f310d937b59df28cb9e416a79c4294a629da07be68a1c1622f0f1f499c8babbebc1

        • C:\Program Files\Voice.ai\VoiceAI-Installer.exe

          Filesize

          699.3MB

          MD5

          47b51c4a94239d1ee6de41d85f8bb349

          SHA1

          0a9019084e063d70feac8ff9c62386f3efe88934

          SHA256

          060d81f1b0b23a57f4fd349c9cea299e925e708a99b4c7a0d9eb0cbd1877e920

          SHA512

          93b828ce8b32ac4ef2f96ede862bcfab305192bb5f3b6717a66925631b3a4fc3e3410496dce52925858ac58763479d8ec1d3aedf1bd8aab0b85a154ea0c4757d

        • C:\Program Files\Voice.ai\VoiceAI-Installer.exe

          Filesize

          699.3MB

          MD5

          47b51c4a94239d1ee6de41d85f8bb349

          SHA1

          0a9019084e063d70feac8ff9c62386f3efe88934

          SHA256

          060d81f1b0b23a57f4fd349c9cea299e925e708a99b4c7a0d9eb0cbd1877e920

          SHA512

          93b828ce8b32ac4ef2f96ede862bcfab305192bb5f3b6717a66925631b3a4fc3e3410496dce52925858ac58763479d8ec1d3aedf1bd8aab0b85a154ea0c4757d

        • C:\Program Files\Voice.ai\VoiceAI.exe

          Filesize

          3.7MB

          MD5

          bc63a61c808ac77a79c939bfb0db6ee0

          SHA1

          7998e6968f80737ff57762fbc362295877df7483

          SHA256

          65710751192fa192dd4b0cb8cebb1adf259ca05df9b53ad3578a8316ead0c8f7

          SHA512

          b58fb887e54abde6ebd772803d33fe4e38252feca875602d4320906b03a1b9b3dfcba4905f235fea93796cd1c5c236ecb60fcf363a364be742020e99cabef8b1

        • C:\Program Files\Voice.ai\VoiceAI.exe

          Filesize

          3.7MB

          MD5

          bc63a61c808ac77a79c939bfb0db6ee0

          SHA1

          7998e6968f80737ff57762fbc362295877df7483

          SHA256

          65710751192fa192dd4b0cb8cebb1adf259ca05df9b53ad3578a8316ead0c8f7

          SHA512

          b58fb887e54abde6ebd772803d33fe4e38252feca875602d4320906b03a1b9b3dfcba4905f235fea93796cd1c5c236ecb60fcf363a364be742020e99cabef8b1

        • C:\Program Files\Voice.ai\VoiceAI.exe

          Filesize

          3.7MB

          MD5

          bc63a61c808ac77a79c939bfb0db6ee0

          SHA1

          7998e6968f80737ff57762fbc362295877df7483

          SHA256

          65710751192fa192dd4b0cb8cebb1adf259ca05df9b53ad3578a8316ead0c8f7

          SHA512

          b58fb887e54abde6ebd772803d33fe4e38252feca875602d4320906b03a1b9b3dfcba4905f235fea93796cd1c5c236ecb60fcf363a364be742020e99cabef8b1

        • C:\Program Files\Voice.ai\VoiceAI.exe

          Filesize

          3.7MB

          MD5

          bc63a61c808ac77a79c939bfb0db6ee0

          SHA1

          7998e6968f80737ff57762fbc362295877df7483

          SHA256

          65710751192fa192dd4b0cb8cebb1adf259ca05df9b53ad3578a8316ead0c8f7

          SHA512

          b58fb887e54abde6ebd772803d33fe4e38252feca875602d4320906b03a1b9b3dfcba4905f235fea93796cd1c5c236ecb60fcf363a364be742020e99cabef8b1

        • C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.inf

          Filesize

          14KB

          MD5

          fa4ddfa2231dc2c50e26794ae7356e0b

          SHA1

          463f4c2ac4f7505f2361c7853505b19fbe08f257

          SHA256

          a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90

          SHA512

          be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946

        • C:\Program Files\Voice.ai\meta

          Filesize

          65B

          MD5

          2f766d5f93e187462dc61513cd4da4d2

          SHA1

          7cfcbd1fe4168d3d0d9eb32b876deb20435d1e4f

          SHA256

          539119bb31af3ebc27735a4c6d09905c771a42283dd901b66d77117f7bdf8987

          SHA512

          1620127e09bbfac04af6cc301a43614198ea757a77108ed46a8e9b4b76ca4083b2590d6bc7a3a4f295267dc8e1b8d32fe15c612f8407959e6778e3a1c241baad

        • C:\Program Files\Voice.ai\tools\vc2019.exe

          Filesize

          24.1MB

          MD5

          4a85bfd44f09ef46679fafcb1bab627a

          SHA1

          7741a5cad238ce3e4ca7756058f2a67a57fee9d1

          SHA256

          37ed59a66699c0e5a7ebeef7352d7c1c2ed5ede7212950a1b0a8ee289af4a95b

          SHA512

          600e61332416b23ef518f4252df0000c03612e8b0680eab0bdf589d9c855539b973583dc4ce1faab5828f58653ed85a1f9196eb1c7bbf6d2e3b5ab3e83253f98

        • C:\Program Files\Voice.ai\tools\vc2019.exe

          Filesize

          24.1MB

          MD5

          4a85bfd44f09ef46679fafcb1bab627a

          SHA1

          7741a5cad238ce3e4ca7756058f2a67a57fee9d1

          SHA256

          37ed59a66699c0e5a7ebeef7352d7c1c2ed5ede7212950a1b0a8ee289af4a95b

          SHA512

          600e61332416b23ef518f4252df0000c03612e8b0680eab0bdf589d9c855539b973583dc4ce1faab5828f58653ed85a1f9196eb1c7bbf6d2e3b5ab3e83253f98

        • C:\ProgramData\Package Cache\{2aaf1df0-eb13-4099-9992-962bb4e596d1}\VC_redist.x64.exe

          Filesize

          635KB

          MD5

          9bd591625766a7330708b2c6380dc1d7

          SHA1

          18018a3d12278187a8dc26eae538a799511bbdfc

          SHA256

          21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79

          SHA512

          58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          1KB

          MD5

          f35b86dcf6488230867f62f9881b3763

          SHA1

          42b88b81a2c99fb6b277cc83b1f0b77584d9890e

          SHA256

          8b51b9c7997922521e8f5f660169f9780c9b6cf1bc7f46f6a8f617aa87477070

          SHA512

          f18ec179a8eb561bd6267c99a52e4b40ffe21a9c095c5458a9546e2624005c9aa277826944253c975382c56d0e48fe3da90471136b7420f299cb733b06b6e6e6

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

          Filesize

          471B

          MD5

          01b9ce813efe124f49534075847fc96d

          SHA1

          36be0bc8357e8c2408e464354a9c9e629c161f8e

          SHA256

          28f815ffca4be91b7dfe771a68a7a5a1bc669e7b2838ec4b19f5912b91d54a8c

          SHA512

          e0955e4ac4e4e80311183ef7653a6c938d40977863a80626cd38b6349d1acb027089124e425ea75b33a22d23142b008c61b5bf5d6a74df4bf3056221eb079eab

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_2B0B046597052ECC9F4BC3AE1A0ED1B1

          Filesize

          727B

          MD5

          a79065910648284c8722f4e68d89be86

          SHA1

          28173bff7b1757af60a37511f59a85630b79631d

          SHA256

          0fc3043b94e7cf895b591864de8e48ea5edfa74a90c2c261c156275cef183e5a

          SHA512

          a2a466d207e95958877aa3f81dfb8d656deaf592488e3b8136ea1b1d8837b09a9b10ee92793179ae687024cd7526280a80f944996d37877c7063b474cbb8715b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

          Filesize

          727B

          MD5

          649ab1ec6627955e76deef26551857fb

          SHA1

          991ba18ac0faab574ccad1e6b02be2d56f73f63f

          SHA256

          94860a682896d1d7f6c82d72b62084e939c6d5b7a4646c0321c94b41409ab3d0

          SHA512

          0cc921ef41c6f159161178e6380ebae02b5f49f69564594df0bb2b9ca7a5b5ada472d9d15a6f7c2d794ce67c7222bf513e1deb227eff862aa170acde3e593af4

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          724B

          MD5

          8202a1cd02e7d69597995cabbe881a12

          SHA1

          8858d9d934b7aa9330ee73de6c476acf19929ff6

          SHA256

          58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

          SHA512

          97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

          Filesize

          410B

          MD5

          50c42df10c59b6bb9ae861e93e010ab1

          SHA1

          5ad121126ef40d259e33254dc42fe65467782c21

          SHA256

          0cf207fd4561c1169b1c706bc126f106e02a15c7714bc6d989e99f11933bab70

          SHA512

          f04d7b43218864232b79bf046e8c6c8b539d96d8149bcfe6dea1c3cb47c776336c87fa85f9163e7f503e4507c10a54eba0faea954fbc04eb9c9df0e1f5efd403

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

          Filesize

          400B

          MD5

          b38df863335d82e7aa9f13dcd25245c8

          SHA1

          97a6bb10572bb7d049128f99475d3864de90fb23

          SHA256

          99784ee6df8755985200eb6b8a2ed28d86b3d2ddd355216c14e0b9766f290fa5

          SHA512

          dc60619513706e9835934ceed696f0c51d672b975f2cd4be371b4bec5d9f4426f48b25a42795f59d2d4ba0b8af1e829aace2468f0aafdd4c55599dc4ef2c8ce2

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_2B0B046597052ECC9F4BC3AE1A0ED1B1

          Filesize

          408B

          MD5

          5f088e28ba38923268085c3ebff0d446

          SHA1

          3a7c9337169df1996c5306527673f4e0d5f8aaf9

          SHA256

          7592ac031136b0b4fa4e1c3bdcaf1ebeec9bedb002019d0c50421a328aa6d676

          SHA512

          77fe5b5f76af3e517429c0980ba8f5b0f372176d5855eea528ced7ddce4413be42e472b5deff2368d9b03a562a63a38231a2ad268470aa628c9809dfe72a1a45

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

          Filesize

          412B

          MD5

          1272eeeba26b78715311ca8b97ade125

          SHA1

          26da9b3a32085098783d1797664d7d46d91abab2

          SHA256

          24258a1c2c613e27912c9edef81f47e4b72fb4877412b1aee71370ba93a2c0ad

          SHA512

          e47146c8cbf4b7201cbbbff3591eedb2446aca2629cbb8665193828fba2eec609af019a9271dd426a8029ce908ea399cd02115aa85b9e5d450ddc358f6037293

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

          Filesize

          392B

          MD5

          a09022e926645f53db532d68791d0a01

          SHA1

          a048292421c58685daa96cec8c6686304e3844be

          SHA256

          814c5787e92b8c75dc3bd56626a7e31ebba56db7d2eec65217a696373335b8ce

          SHA512

          f48dad05198cd09926d81527a8898872f709fe85130f37331863c96b07b5b1773b64904e4240ce831adefaca646333ee23385cbf3a70af1f3a326fd7018fbdef

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\VoiceAI.exe.log

          Filesize

          1KB

          MD5

          baf55b95da4a601229647f25dad12878

          SHA1

          abc16954ebfd213733c4493fc1910164d825cac8

          SHA256

          ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

          SHA512

          24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E51EX1F6\user-event[1].json

          Filesize

          16B

          MD5

          7363e85fe9edee6f053a4b319588c086

          SHA1

          a15e2127145548437173fc17f3e980e3f3dee2d0

          SHA256

          c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

          SHA512

          a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85

        • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20231031152036_000_vcRuntimeMinimum_x64.log

          Filesize

          2KB

          MD5

          63e8e3ff64ed509714a9f6a98f178d60

          SHA1

          c2673b9d3a2518d7ab725cb2c944e4b77866985f

          SHA256

          6bc8c8434812f6e689f510252b9f110e67cae677f94bf113322394d99bdf67c6

          SHA512

          166a11b6ecf4051884d6791a42b02f304065dcf80dbd692bf3204e699d92ebf2ffc853985e7ba3121df238eeef4284e96575d6533bb08b8c2bb6e73c9980b16f

        • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20231031152036_001_vcRuntimeAdditional_x64.log

          Filesize

          2KB

          MD5

          f7954a68d7af5f55da4592dee7207165

          SHA1

          f1dae4fd184547987e79f8fd01dd6bd55f00245f

          SHA256

          b31dde30a3cccb2897d4c30ff62073d7a2c905105dcb7832f820c8f3ccd79940

          SHA512

          aa5fb6470944f207643fe50a2a86f5faac0f255156455dd3a350bf7563101a65ad9fab2628c4f23b8ef214664c76181043be09f122bcdaf9f774240facb2c80c

        • C:\Users\Admin\AppData\Local\Temp\nshAC7E.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nshAC7E.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nshAC7E.tmp\System.dll

          Filesize

          12KB

          MD5

          792b6f86e296d3904285b2bf67ccd7e0

          SHA1

          966b16f84697552747e0ddd19a4ba8ab5083af31

          SHA256

          c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917

          SHA512

          97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c

        • C:\Users\Admin\AppData\Local\Temp\nshAC7E.tmp\System.dll

          Filesize

          12KB

          MD5

          792b6f86e296d3904285b2bf67ccd7e0

          SHA1

          966b16f84697552747e0ddd19a4ba8ab5083af31

          SHA256

          c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917

          SHA512

          97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c

        • C:\Users\Admin\AppData\Local\Temp\nshAC7E.tmp\nsDialogs.dll

          Filesize

          9KB

          MD5

          f5b0c649b0cfc103fb113d013d48cacb

          SHA1

          f89286966000cb053b7e94100c76ec6d1129af07

          SHA256

          a87bd092fa5bc00661525455b9f866b68c14c29224520c4e38f56f47234cfc1e

          SHA512

          e184101a03ee1c8896efb0029a02a23e46d422bc0f250ef15349c8214d44156afe2b5f739d8a2339bc2d1c05984fc55651c36c71897cd4b14f41dd37a25cfb01

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\INetC.dll

          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\System.dll

          Filesize

          12KB

          MD5

          792b6f86e296d3904285b2bf67ccd7e0

          SHA1

          966b16f84697552747e0ddd19a4ba8ab5083af31

          SHA256

          c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917

          SHA512

          97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c

        • C:\Users\Admin\AppData\Local\Temp\nstE54.tmp\nsProcess.dll

          Filesize

          4KB

          MD5

          05450face243b3a7472407b999b03a72

          SHA1

          ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

          SHA256

          95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

          SHA512

          f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

        • C:\Users\Admin\AppData\Local\Temp\{8EB93~1\VoiceAIDriver.cat

          Filesize

          12KB

          MD5

          26f1832c761580eab272ae065f644005

          SHA1

          bdd7eb53423659de315d88ad5bb557ffdf5593a5

          SHA256

          bae9e5bbff837d0ebb43ca1ff1a275474d8e50832a590a957afc8d3ee1e5f560

          SHA512

          a0c5c4fa7dcc9d4347a521863b9ba4fd2f5eda4d49f70498c4e89c54b59b7773835796e0cc83470c191e1231c69885d22efe823a3a96b2b971ccd1473e2630eb

        • C:\Users\Admin\AppData\Local\Temp\{8EB93~1\voiceaidriver.sys

          Filesize

          71KB

          MD5

          90e4c7c347839c09c8f7f45de3f4fda1

          SHA1

          18c5a6fae8c9292702d62e9ad2da1e24336f72c6

          SHA256

          74c4c2f122d48548019314fe15a331b81bfc10408b0d6f471dee94e37fe3c1bc

          SHA512

          2cf37738f112026eeb68636423e619be5e34cae7734ab1cab5d8cc799af7509d2ffca09b566cbe46bb47f54981042099e857660acc2ab24558715408c011bd58

        • C:\Users\Admin\AppData\Local\Temp\{8eb9356f-f873-c048-b9eb-aca4b77df8e9}\voiceaidriver.inf

          Filesize

          14KB

          MD5

          fa4ddfa2231dc2c50e26794ae7356e0b

          SHA1

          463f4c2ac4f7505f2361c7853505b19fbe08f257

          SHA256

          a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90

          SHA512

          be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946

        • C:\Users\Admin\AppData\Local\Voice.ai\Cache\Code Cache\js\index-dir\the-real-index

          Filesize

          48B

          MD5

          87efb1fcb51c4982406a0b4c31085153

          SHA1

          ae9c4452881ba5d965f770de3b3c62d01e89aa45

          SHA256

          8b558be89d2fb282eac191cd4bf8acf509e81b2c0c05645d7cb4afffaccd4e14

          SHA512

          62d7f593dda3844dc95985661b50bc91c0ec38cbf9db6d3b9e0d542a89d5d7ea508f5d0df318e8fd6c47f7aca2a283b6f100c55eb778b718763959715b8a8928

        • C:\Users\Admin\AppData\Local\Voice.ai\Cache\Code Cache\js\index-dir\the-real-index

          Filesize

          264B

          MD5

          1aea62b19e46979572a031baa497dea3

          SHA1

          3ca210a88af9e6a99e6a48af1c6f0ae8025239bf

          SHA256

          b7e31b24a358eea2e9e63a28f3b3073cea6cee1b823d0582e1d3b718450ef65f

          SHA512

          17df3593fa36a29894357850a408b8f462ac2f0f21695eb61481f1fb4c5d68bc5eaef966632e5d7c70ea8e269dde38ff7f65065d70fa2ba9dd9ca74ac552e81f

        • C:\Users\Admin\AppData\Local\Voice.ai\Cache\Local Storage\leveldb\CURRENT

          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • C:\Users\Admin\AppData\Local\Voice.ai\Cache\Network\TransportSecurity

          Filesize

          1KB

          MD5

          4bcfc39ad5278b0673f94c8ea8579770

          SHA1

          bc42160845c190e201372f3af85d4625666cdfbb

          SHA256

          78776148ed6ec21e01ebf71f8c7f35c874141f840fe1b155b2e1adacc47e1703

          SHA512

          ee7fe0aaafd2a6049274319b6c8c3f952deb9f3971f841495a1165be0c9bd627eb8648362e13b330c4664a345e8a77015e9294272851b9b9610b04c2106d70b7

        • C:\Users\Admin\AppData\Local\Voice.ai\Cache\Network\TransportSecurity~RFe5d5297.TMP

          Filesize

          1KB

          MD5

          5cc85e1cf98850c7e146d214f103f407

          SHA1

          4ccbebc437af0d66d86de57e2aad1c0cd56b0ec8

          SHA256

          4e8524618f372c8435758d4657215ef05b8b06c8a87f471c8a2b4f38475f38e2

          SHA512

          859ea54ffd06a6a5ac4ee3b69efa93d3a1121eba28d00596f5277b5d5c44c6438e0ec2d4ae4b77a0f061a30df07a45a772439fc58bd093f67b163e5822ac4eb6

        • C:\Users\Admin\AppData\Local\Voice.ai\Cache\Session Storage\MANIFEST-000001

          Filesize

          41B

          MD5

          5af87dfd673ba2115e2fcf5cfdb727ab

          SHA1

          d5b5bbf396dc291274584ef71f444f420b6056f1

          SHA256

          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

          SHA512

          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

        • C:\Windows\INF\oem3.inf

          Filesize

          14KB

          MD5

          fa4ddfa2231dc2c50e26794ae7356e0b

          SHA1

          463f4c2ac4f7505f2361c7853505b19fbe08f257

          SHA256

          a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90

          SHA512

          be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946

        • C:\Windows\Installer\e5c4e49.msi

          Filesize

          180KB

          MD5

          143a2b9f1c0ebc3421b52e9adcb4db2e

          SHA1

          06e01b8cc855fd9a31f99b430f8c8745e706c677

          SHA256

          5d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954

          SHA512

          7e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05

        • C:\Windows\SYSTEM32\VCRUNTIME140.dll

          Filesize

          95KB

          MD5

          7415c1cc63a0c46983e2a32581daefee

          SHA1

          5f8534d79c84ac45ad09b5a702c8c5c288eae240

          SHA256

          475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

          SHA512

          3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

        • C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.inf

          Filesize

          14KB

          MD5

          fa4ddfa2231dc2c50e26794ae7356e0b

          SHA1

          463f4c2ac4f7505f2361c7853505b19fbe08f257

          SHA256

          a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90

          SHA512

          be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946

        • C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\SET8DB1.tmp

          Filesize

          12KB

          MD5

          26f1832c761580eab272ae065f644005

          SHA1

          bdd7eb53423659de315d88ad5bb557ffdf5593a5

          SHA256

          bae9e5bbff837d0ebb43ca1ff1a275474d8e50832a590a957afc8d3ee1e5f560

          SHA512

          a0c5c4fa7dcc9d4347a521863b9ba4fd2f5eda4d49f70498c4e89c54b59b7773835796e0cc83470c191e1231c69885d22efe823a3a96b2b971ccd1473e2630eb

        • C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\SET8DC2.tmp

          Filesize

          14KB

          MD5

          fa4ddfa2231dc2c50e26794ae7356e0b

          SHA1

          463f4c2ac4f7505f2361c7853505b19fbe08f257

          SHA256

          a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90

          SHA512

          be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946

        • C:\Windows\System32\DriverStore\Temp\{a6cba3c2-81d2-0845-bf4c-c154d457df4a}\SET8DC3.tmp

          Filesize

          71KB

          MD5

          90e4c7c347839c09c8f7f45de3f4fda1

          SHA1

          18c5a6fae8c9292702d62e9ad2da1e24336f72c6

          SHA256

          74c4c2f122d48548019314fe15a331b81bfc10408b0d6f471dee94e37fe3c1bc

          SHA512

          2cf37738f112026eeb68636423e619be5e34cae7734ab1cab5d8cc799af7509d2ffca09b566cbe46bb47f54981042099e857660acc2ab24558715408c011bd58

        • C:\Windows\System32\vcruntime140.dll

          Filesize

          95KB

          MD5

          7415c1cc63a0c46983e2a32581daefee

          SHA1

          5f8534d79c84ac45ad09b5a702c8c5c288eae240

          SHA256

          475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

          SHA512

          3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

        • C:\Windows\Temp\{0080EA46-80AA-4104-82D0-A41DB68A750C}\.ba\wixstdba.dll

          Filesize

          191KB

          MD5

          eab9caf4277829abdf6223ec1efa0edd

          SHA1

          74862ecf349a9bedd32699f2a7a4e00b4727543d

          SHA256

          a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

          SHA512

          45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

        • C:\Windows\Temp\{0080EA46-80AA-4104-82D0-A41DB68A750C}\.ba\wixstdba.dll

          Filesize

          191KB

          MD5

          eab9caf4277829abdf6223ec1efa0edd

          SHA1

          74862ecf349a9bedd32699f2a7a4e00b4727543d

          SHA256

          a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

          SHA512

          45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

        • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\.ba\logo.png

          Filesize

          1KB

          MD5

          d6bd210f227442b3362493d046cea233

          SHA1

          ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

          SHA256

          335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

          SHA512

          464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

        • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\.ba\wixstdba.dll

          Filesize

          191KB

          MD5

          eab9caf4277829abdf6223ec1efa0edd

          SHA1

          74862ecf349a9bedd32699f2a7a4e00b4727543d

          SHA256

          a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

          SHA512

          45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

        • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\.be\VC_redist.x64.exe

          Filesize

          635KB

          MD5

          9bd591625766a7330708b2c6380dc1d7

          SHA1

          18018a3d12278187a8dc26eae538a799511bbdfc

          SHA256

          21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79

          SHA512

          58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5

        • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\.be\VC_redist.x64.exe

          Filesize

          635KB

          MD5

          9bd591625766a7330708b2c6380dc1d7

          SHA1

          18018a3d12278187a8dc26eae538a799511bbdfc

          SHA256

          21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79

          SHA512

          58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5

        • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\.be\VC_redist.x64.exe

          Filesize

          635KB

          MD5

          9bd591625766a7330708b2c6380dc1d7

          SHA1

          18018a3d12278187a8dc26eae538a799511bbdfc

          SHA256

          21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79

          SHA512

          58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5

        • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

          Filesize

          5.4MB

          MD5

          6ce5097b19cf57527651840bb438adf3

          SHA1

          49d0b725e5819a076562fd007490eca0bbb69003

          SHA256

          f24a3bc5df7e7c07c0d13f46348c989eae7f597f428b20cc9044bba47785b7f0

          SHA512

          9152301c4f87018d166b624d73919fc2da7e7ef74b2c1ecf8ad01c31c2b2239013cc3bc22237c81940ae96a5fd1b3698d260c3d3e0a9d0318cdc053e28328d83

        • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\cab5046A8AB272BF37297BB7928664C9503

          Filesize

          879KB

          MD5

          8e288dd0b5e0468ed8ae01ee566e77e8

          SHA1

          fbd11237ae3300a2202444d339601d1ac6bbf310

          SHA256

          c80addc870825e9a1aa9281e105e583973ec2846bbd74f1e97cb60911ba7a2e1

          SHA512

          facc72bdcdd5de47c0d18ecb5288962b04d9e4924a9a07ee807a3bf0eaa77eac05f086906b680bcf97c3bad5fab0038b47c0e09cd2bbec1d0709eba015bc1c04

        • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\vcRuntimeAdditional_x64

          Filesize

          180KB

          MD5

          e6df9f55e20905f77b136844a3844dd6

          SHA1

          b7c1fb12bda508a62fdd9ffa9e870cae50605aaa

          SHA256

          f8745f3523ea73806d591fa4e666e86c30c7e5240a07211a0c11a7633d16c4f0

          SHA512

          7c71c2b9a7d3d768d1686cb037362efb9e38c50b652bfaeb22cf86c6c47a85962f9893cbf5e2f86880c9c8fc8bc0278edeb47088813e022ef05d7db15efc0713

        • C:\Windows\Temp\{3E5C24D7-541C-45AD-8FDC-BAE7D16EB807}\vcRuntimeMinimum_x64

          Filesize

          180KB

          MD5

          143a2b9f1c0ebc3421b52e9adcb4db2e

          SHA1

          06e01b8cc855fd9a31f99b430f8c8745e706c677

          SHA256

          5d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954

          SHA512

          7e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05

        • C:\Windows\Temp\{9BA935D1-78BD-4E18-AF1E-92897655CDD8}\.cr\vc2019.exe

          Filesize

          635KB

          MD5

          9bd591625766a7330708b2c6380dc1d7

          SHA1

          18018a3d12278187a8dc26eae538a799511bbdfc

          SHA256

          21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79

          SHA512

          58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5

        • C:\Windows\Temp\{9BA935D1-78BD-4E18-AF1E-92897655CDD8}\.cr\vc2019.exe

          Filesize

          635KB

          MD5

          9bd591625766a7330708b2c6380dc1d7

          SHA1

          18018a3d12278187a8dc26eae538a799511bbdfc

          SHA256

          21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79

          SHA512

          58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5

        • \??\c:\PROGRA~1\voice.ai\VOICEA~1\voiceaidriver.sys

          Filesize

          71KB

          MD5

          90e4c7c347839c09c8f7f45de3f4fda1

          SHA1

          18c5a6fae8c9292702d62e9ad2da1e24336f72c6

          SHA256

          74c4c2f122d48548019314fe15a331b81bfc10408b0d6f471dee94e37fe3c1bc

          SHA512

          2cf37738f112026eeb68636423e619be5e34cae7734ab1cab5d8cc799af7509d2ffca09b566cbe46bb47f54981042099e857660acc2ab24558715408c011bd58

        • \??\c:\program files\voice.ai\voiceaidriver\VoiceAIDriver.cat

          Filesize

          12KB

          MD5

          26f1832c761580eab272ae065f644005

          SHA1

          bdd7eb53423659de315d88ad5bb557ffdf5593a5

          SHA256

          bae9e5bbff837d0ebb43ca1ff1a275474d8e50832a590a957afc8d3ee1e5f560

          SHA512

          a0c5c4fa7dcc9d4347a521863b9ba4fd2f5eda4d49f70498c4e89c54b59b7773835796e0cc83470c191e1231c69885d22efe823a3a96b2b971ccd1473e2630eb

        • memory/452-708-0x0000020022030000-0x0000020022040000-memory.dmp

          Filesize

          64KB

        • memory/452-703-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/452-662-0x0000020009570000-0x0000020009571000-memory.dmp

          Filesize

          4KB

        • memory/452-659-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/452-663-0x0000020022030000-0x0000020022040000-memory.dmp

          Filesize

          64KB

        • memory/452-763-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/1088-612-0x0000021666FF0000-0x0000021667000000-memory.dmp

          Filesize

          64KB

        • memory/1088-611-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/1088-613-0x000002164CCD0000-0x000002164CCD1000-memory.dmp

          Filesize

          4KB

        • memory/1088-664-0x0000021666FF0000-0x0000021667000000-memory.dmp

          Filesize

          64KB

        • memory/1088-653-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/1088-618-0x0000021667880000-0x000002166799C000-memory.dmp

          Filesize

          1.1MB

        • memory/1088-764-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/2368-634-0x000001C8F75C0000-0x000001C8F75D0000-memory.dmp

          Filesize

          64KB

        • memory/2368-689-0x000001C8F75C0000-0x000001C8F75D0000-memory.dmp

          Filesize

          64KB

        • memory/2368-687-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/2368-635-0x000001C8DD3A0000-0x000001C8DD3A1000-memory.dmp

          Filesize

          4KB

        • memory/2368-762-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/2368-632-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/3188-731-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-581-0x000002198BA30000-0x000002198BA31000-memory.dmp

          Filesize

          4KB

        • memory/3188-616-0x00000219A4960000-0x00000219A4A60000-memory.dmp

          Filesize

          1024KB

        • memory/3188-728-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-729-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-730-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-580-0x00000219A42E0000-0x00000219A42F0000-memory.dmp

          Filesize

          64KB

        • memory/3188-732-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-597-0x00000219A4510000-0x00000219A4594000-memory.dmp

          Filesize

          528KB

        • memory/3188-617-0x00000219A42E0000-0x00000219A42F0000-memory.dmp

          Filesize

          64KB

        • memory/3188-596-0x000002198BBD0000-0x000002198BBE0000-memory.dmp

          Filesize

          64KB

        • memory/3188-595-0x00000219A42C0000-0x00000219A42D2000-memory.dmp

          Filesize

          72KB

        • memory/3188-594-0x00000219A4400000-0x00000219A4504000-memory.dmp

          Filesize

          1.0MB

        • memory/3188-749-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/3188-615-0x00000219A42E0000-0x00000219A42F0000-memory.dmp

          Filesize

          64KB

        • memory/3188-681-0x00000219A42E0000-0x00000219A42F0000-memory.dmp

          Filesize

          64KB

        • memory/3188-733-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-683-0x00000219A4960000-0x00000219A4A60000-memory.dmp

          Filesize

          1024KB

        • memory/3188-734-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-599-0x00000219A45A0000-0x00000219A4761000-memory.dmp

          Filesize

          1.8MB

        • memory/3188-724-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-614-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/3188-723-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-598-0x00000219A4300000-0x00000219A430A000-memory.dmp

          Filesize

          40KB

        • memory/3188-722-0x00000219A3D70000-0x00000219A3D71000-memory.dmp

          Filesize

          4KB

        • memory/3188-579-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/3672-685-0x0000016FD1560000-0x0000016FD1561000-memory.dmp

          Filesize

          4KB

        • memory/3672-684-0x0000016FEB7D0000-0x0000016FEB7E0000-memory.dmp

          Filesize

          64KB

        • memory/3672-759-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/3672-682-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/3672-711-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/3672-712-0x0000016FEB7D0000-0x0000016FEB7E0000-memory.dmp

          Filesize

          64KB

        • memory/4172-473-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4172-556-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4172-472-0x0000023958310000-0x00000239586C6000-memory.dmp

          Filesize

          3.7MB

        • memory/4172-475-0x000002395A220000-0x000002395A221000-memory.dmp

          Filesize

          4KB

        • memory/4172-474-0x0000023972D60000-0x0000023972D70000-memory.dmp

          Filesize

          64KB

        • memory/4400-692-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4400-639-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4400-637-0x000001DFBAA80000-0x000001DFBAA81000-memory.dmp

          Filesize

          4KB

        • memory/4400-636-0x000001DFD4C70000-0x000001DFD4C80000-memory.dmp

          Filesize

          64KB

        • memory/4400-690-0x000001DFD4C70000-0x000001DFD4C80000-memory.dmp

          Filesize

          64KB

        • memory/4400-761-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4580-760-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4580-640-0x000002246A950000-0x000002246A960000-memory.dmp

          Filesize

          64KB

        • memory/4580-630-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4580-686-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4580-693-0x000002246A950000-0x000002246A960000-memory.dmp

          Filesize

          64KB

        • memory/4580-633-0x0000022468640000-0x0000022468641000-memory.dmp

          Filesize

          4KB

        • memory/4836-638-0x0000020DF97D0000-0x0000020DF97D1000-memory.dmp

          Filesize

          4KB

        • memory/4836-631-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4836-688-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4836-758-0x00007FF800480000-0x00007FF800F41000-memory.dmp

          Filesize

          10.8MB

        • memory/4836-691-0x0000020DFBB20000-0x0000020DFBB30000-memory.dmp

          Filesize

          64KB