Overview
overview
10Static
static
3Voice.ai-D...8c.exe
windows7-x64
7Voice.ai-D...8c.exe
windows10-2004-x64
10$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3Analysis
- max time kernel
417s - max time network
428s - platform
windows10-2004_x64 - resource
win10v2004-20240226-de - resource tags
arch:x64arch:x86image:win10v2004-20240226-delocale:de-deos:windows10-2004-x64systemwindows - submitted
23/03/2024, 12:26
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe
Resource
win7-20240221-de
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe
Resource
win10v2004-20240226-de
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240221-de
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240319-de
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-de
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-de
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240221-de
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240226-de
windows10-2004-x64
2 signatures
150 seconds
General
- Target Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe
- Size 477KB
- Sample240323-pl66qaaf6t
- SHA256 100dba151efe66c842fde4337857fd3db4568c1e3ee008e412927e67ed72094e
- MD5 40ffaea0c96bc8fd1ac022ecf287980b
- SHA1 c9ff64fecee39aa1a4f1c930d6b6ad423e1b1c14
- SHA512 cc0f2ff6b650644564d7469031c96fcaf93b9dd82318eda244abb65970d2e5697ba27bb0c62e31f4f654cc031ac7f19f0692f444674fd174f9acbc201c8944dd
- SSDEEP 3072:ckBGWOsTIJgIDU5A/cNo68pMABlZQ2wpFD0ra42L5GYDxJ0ytta:c1ssjH5Mp2w7g+42LUS6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect ZGRat V1 5 IoCs
resource yara_rule behavioral2/files/0x00080000000233b2-491.dat family_zgrat_v1 behavioral2/memory/2952-499-0x0000021361D20000-0x0000021362102000-memory.dmp family_zgrat_v1 behavioral2/files/0x00070000000233c2-503.dat family_zgrat_v1 behavioral2/memory/2952-506-0x000002137C580000-0x000002137C5EC000-memory.dmp family_zgrat_v1 behavioral2/files/0x00080000000233b2-609.dat family_zgrat_v1 - Downloads MZ/PE file
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe - Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation vc2019.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation VoiceAI.exe Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation VoiceAI.exe - Executes dropped EXE 23 IoCs
pid Process 2748 VoiceAI-Installer.exe 3592 vc2019.exe 1324 vc2019.exe 4520 VC_redist.x64.exe 2952 VoiceAI.exe 4788 VoiceAI.exe 4756 VoiceAI.exe 5060 VoiceAI.exe 1280 VoiceAI.exe 2064 VoiceAI.exe 736 VoiceAI.exe 3512 VoiceAI.exe 4012 VoiceAI.exe 5272 BsSndRpt.exe 5532 VoiceAI.exe 5668 VoiceAI.exe 5728 VoiceAI.exe 5772 VoiceAI.exe 5792 VoiceAI.exe 5800 VoiceAI.exe 5760 VoiceAI.exe 5256 VoiceAI.exe 4160 BsSndRpt.exe - Loads dropped DLL 64 IoCs
pid Process 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 2748 VoiceAI-Installer.exe 2748 VoiceAI-Installer.exe 1324 vc2019.exe 1752 VC_redist.x64.exe 2952 VoiceAI.exe 2952 VoiceAI.exe 2952 VoiceAI.exe 2952 VoiceAI.exe 2748 VoiceAI-Installer.exe 2748 VoiceAI-Installer.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 5060 VoiceAI.exe 5060 VoiceAI.exe 736 VoiceAI.exe 736 VoiceAI.exe 1280 VoiceAI.exe 1280 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 2064 VoiceAI.exe 2064 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 5060 VoiceAI.exe 5060 VoiceAI.exe 5060 VoiceAI.exe 5060 VoiceAI.exe 5060 VoiceAI.exe 5060 VoiceAI.exe 5060 VoiceAI.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{2aaf1df0-eb13-4099-9992-962bb4e596d1} = "\"C:\\ProgramData\\Package Cache\\{2aaf1df0-eb13-4099-9992-962bb4e596d1}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File created C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{7162bdfd-74d0-b047-b393-69855b36fea1}\SET72A9.tmp DrvInst.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{7162bdfd-74d0-b047-b393-69855b36fea1}\SET7297.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7162bdfd-74d0-b047-b393-69855b36fea1}\VoiceAIDriver.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.PNF VoiceAI.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7162bdfd-74d0-b047-b393-69855b36fea1}\SET72A9.tmp DrvInst.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\VoiceAIDriver.cat DrvInst.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7162bdfd-74d0-b047-b393-69855b36fea1}\SET72A8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\voiceaidriver.inf_amd64_214d6aacf9c41414\voiceaidriver.sys DrvInst.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7162bdfd-74d0-b047-b393-69855b36fea1}\SET7297.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7162bdfd-74d0-b047-b393-69855b36fea1}\voiceaidriver.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7162bdfd-74d0-b047-b393-69855b36fea1}\voiceaidriver.sys DrvInst.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\System32\DriverStore\Temp\{7162bdfd-74d0-b047-b393-69855b36fea1}\SET72A8.tmp DrvInst.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Voice.ai\locales\it.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sk.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\et.pak VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\InTheHand.Net.Personal.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\es.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\gcrypt.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\cs.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sw.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAILib.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\naudio.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ja.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\pt-BR.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libEGL.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libgpg-error.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ta.pak VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\DriverManager.dll VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\VoiceAI-Installer.exe Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe File created C:\Program Files\Voice.ai\libsamplerate-0.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\lv.pak VoiceAI-Installer.exe File opened for modification C:\Program Files\Voice.ai\tools\ VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\BugSplatDotNet.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\gu.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ko.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\NAudio.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\libcef.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libsamplerate.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\en-US.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\id.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\uk.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\chrome_elf.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\de.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\el.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sv.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\tr.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\CefSharp.BrowserSubprocess.Core.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\en-GB.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\nb.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\newtonsoft.json.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\resources.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\OK VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fil.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\sl.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\zh-CN.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\zh-TW.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\hi.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libgcrypt.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ca.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\DriverManager.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libmp3lame.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\pl.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\v8_context_snapshot.bin VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\chrome_100_percent.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\CefSharp.WinForms.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\tools\net452.exe VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\opensource\libsndfile.txt VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\fa.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\CefSharp.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\bn.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\da.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\he.pak VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.sys VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\DirectML.dll VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\0.vai VoiceAI-Installer.exe File created C:\Program Files\Voice.ai\locales\ml.pak VoiceAI-Installer.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\e5c35d0.msi msiexec.exe File created C:\Windows\Installer\SourceHash{A977984B-9244-49E3-BD24-43F0A8009667} msiexec.exe File created C:\Windows\Installer\e5c35e5.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\e5c35bd.msi msiexec.exe File created C:\Windows\Installer\SourceHash{A181A302-3F6D-4BAD-97A8-A426A6499D78} msiexec.exe File opened for modification C:\Windows\Installer\MSI43D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5c35d0.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\e5c35bd.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4ED5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5500.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log VoiceAI.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI3F24.tmp msiexec.exe File created C:\Windows\Installer\e5c35cf.msi msiexec.exe File created C:\Windows\INF\c_media.PNF VoiceAI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000700000002338b-71.dat nsis_installer_1 behavioral2/files/0x000700000002338b-71.dat nsis_installer_2 behavioral2/files/0x000700000002338b-72.dat nsis_installer_1 behavioral2/files/0x000700000002338b-72.dat nsis_installer_2 - Checks SCSI registry key(s) 3 TTPs 57 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ed06fb648d6ef2080000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ed06fb640000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900ed06fb64000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1ded06fb64000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ed06fb6400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs VoiceAI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID VoiceAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\Desktop\ForegroundLockTimeout = "0" BsSndRpt.exe Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\Desktop\ForegroundLockTimeout = "11531000" BsSndRpt.exe - Modifies data under HKEY_USERS 59 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B489779A44293E94DB42340F8A006976 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\PackageCode = "09139770F15A2384695CFEF667B84B3C" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Dependents VC_redist.x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{A977984B-9244-49E3-BD24-43F0A8009667}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai VoiceAI-Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\Dependents\{2aaf1df0-eb13-4099-9992-962bb4e596d1} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{A181A302-3F6D-4BAD-97A8-A426A6499D78}" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\203A181AD6F3DAB4798A4A626A94D987 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B489779A44293E94DB42340F8A006976\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell\open VoiceAI-Installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\Url Protocol VoiceAI-Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{A181A302-3F6D-4BAD-97A8-A426A6499D78}v14.31.31103\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\PackageName = "vc_runtimeAdditional_x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell\open\command VoiceAI-Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.31.31103" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\PackageName = "vc_runtimeMinimum_x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A181A302-3F6D-4BAD-97A8-A426A6499D78}v14.31.31103\\packages\\vcRuntimeMinimum_amd64\\" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\203A181AD6F3DAB4798A4A626A94D987\Servicing_Key msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{2aaf1df0-eb13-4099-9992-962bb4e596d1} VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\voiceai\shell VoiceAI-Installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Media\1 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Media\1 = ";" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.31.31103" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.31.31103" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.31.31103" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\203A181AD6F3DAB4798A4A626A94D987\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B489779A44293E94DB42340F8A006976\Provider msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.31,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.31.31103" VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\PackageCode = "E49FE452611FCB64B91833BADDC6195B" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{A977984B-9244-49E3-BD24-43F0A8009667}v14.31.31103\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B489779A44293E94DB42340F8A006976\Clients = 3a0000000000 msiexec.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e VoiceAI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 VoiceAI.exe - Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4756 VoiceAI.exe 4756 VoiceAI.exe 1280 VoiceAI.exe 1280 VoiceAI.exe 5060 VoiceAI.exe 5060 VoiceAI.exe 736 VoiceAI.exe 736 VoiceAI.exe 2064 VoiceAI.exe 2064 VoiceAI.exe 3512 VoiceAI.exe 3512 VoiceAI.exe 4012 VoiceAI.exe 4012 VoiceAI.exe 4788 VoiceAI.exe 4788 VoiceAI.exe 5728 VoiceAI.exe 5728 VoiceAI.exe 5760 VoiceAI.exe 5760 VoiceAI.exe 5668 VoiceAI.exe 5668 VoiceAI.exe 5800 VoiceAI.exe 5800 VoiceAI.exe 5772 VoiceAI.exe 5772 VoiceAI.exe 5256 VoiceAI.exe 5256 VoiceAI.exe 5792 VoiceAI.exe 5792 VoiceAI.exe 5532 VoiceAI.exe 5532 VoiceAI.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 3588 vssvc.exe Token: SeRestorePrivilege 3588 vssvc.exe Token: SeAuditPrivilege 3588 vssvc.exe Token: SeShutdownPrivilege 4520 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 4520 VC_redist.x64.exe Token: SeSecurityPrivilege 4736 msiexec.exe Token: SeCreateTokenPrivilege 4520 VC_redist.x64.exe Token: SeAssignPrimaryTokenPrivilege 4520 VC_redist.x64.exe Token: SeLockMemoryPrivilege 4520 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 4520 VC_redist.x64.exe Token: SeMachineAccountPrivilege 4520 VC_redist.x64.exe Token: SeTcbPrivilege 4520 VC_redist.x64.exe Token: SeSecurityPrivilege 4520 VC_redist.x64.exe Token: SeTakeOwnershipPrivilege 4520 VC_redist.x64.exe Token: SeLoadDriverPrivilege 4520 VC_redist.x64.exe Token: SeSystemProfilePrivilege 4520 VC_redist.x64.exe Token: SeSystemtimePrivilege 4520 VC_redist.x64.exe Token: SeProfSingleProcessPrivilege 4520 VC_redist.x64.exe Token: SeIncBasePriorityPrivilege 4520 VC_redist.x64.exe Token: SeCreatePagefilePrivilege 4520 VC_redist.x64.exe Token: SeCreatePermanentPrivilege 4520 VC_redist.x64.exe Token: SeBackupPrivilege 4520 VC_redist.x64.exe Token: SeRestorePrivilege 4520 VC_redist.x64.exe Token: SeShutdownPrivilege 4520 VC_redist.x64.exe Token: SeDebugPrivilege 4520 VC_redist.x64.exe Token: SeAuditPrivilege 4520 VC_redist.x64.exe Token: SeSystemEnvironmentPrivilege 4520 VC_redist.x64.exe Token: SeChangeNotifyPrivilege 4520 VC_redist.x64.exe Token: SeRemoteShutdownPrivilege 4520 VC_redist.x64.exe Token: SeUndockPrivilege 4520 VC_redist.x64.exe Token: SeSyncAgentPrivilege 4520 VC_redist.x64.exe Token: SeEnableDelegationPrivilege 4520 VC_redist.x64.exe Token: SeManageVolumePrivilege 4520 VC_redist.x64.exe Token: SeImpersonatePrivilege 4520 VC_redist.x64.exe Token: SeCreateGlobalPrivilege 4520 VC_redist.x64.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe Token: SeTakeOwnershipPrivilege 4736 msiexec.exe Token: SeRestorePrivilege 4736 msiexec.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 2748 VoiceAI-Installer.exe 4788 VoiceAI.exe 5532 VoiceAI.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4788 VoiceAI.exe 5532 VoiceAI.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4788 VoiceAI.exe 5532 VoiceAI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3368 wrote to memory of 2748 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 123 PID 3368 wrote to memory of 2748 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 123 PID 3368 wrote to memory of 2748 3368 Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe 123 PID 2748 wrote to memory of 3592 2748 VoiceAI-Installer.exe 124 PID 2748 wrote to memory of 3592 2748 VoiceAI-Installer.exe 124 PID 2748 wrote to memory of 3592 2748 VoiceAI-Installer.exe 124 PID 3592 wrote to memory of 1324 3592 vc2019.exe 125 PID 3592 wrote to memory of 1324 3592 vc2019.exe 125 PID 3592 wrote to memory of 1324 3592 vc2019.exe 125 PID 1324 wrote to memory of 4520 1324 vc2019.exe 126 PID 1324 wrote to memory of 4520 1324 vc2019.exe 126 PID 1324 wrote to memory of 4520 1324 vc2019.exe 126 PID 4520 wrote to memory of 736 4520 VC_redist.x64.exe 135 PID 4520 wrote to memory of 736 4520 VC_redist.x64.exe 135 PID 4520 wrote to memory of 736 4520 VC_redist.x64.exe 135 PID 736 wrote to memory of 1752 736 VC_redist.x64.exe 136 PID 736 wrote to memory of 1752 736 VC_redist.x64.exe 136 PID 736 wrote to memory of 1752 736 VC_redist.x64.exe 136 PID 1752 wrote to memory of 4172 1752 VC_redist.x64.exe 137 PID 1752 wrote to memory of 4172 1752 VC_redist.x64.exe 137 PID 1752 wrote to memory of 4172 1752 VC_redist.x64.exe 137 PID 2748 wrote to memory of 2952 2748 VoiceAI-Installer.exe 138 PID 2748 wrote to memory of 2952 2748 VoiceAI-Installer.exe 138 PID 1268 wrote to memory of 4612 1268 svchost.exe 141 PID 1268 wrote to memory of 4612 1268 svchost.exe 141 PID 1268 wrote to memory of 4184 1268 svchost.exe 142 PID 1268 wrote to memory of 4184 1268 svchost.exe 142 PID 2748 wrote to memory of 740 2748 VoiceAI-Installer.exe 143 PID 2748 wrote to memory of 740 2748 VoiceAI-Installer.exe 143 PID 5096 wrote to memory of 4788 5096 explorer.exe 145 PID 5096 wrote to memory of 4788 5096 explorer.exe 145 PID 4788 wrote to memory of 4756 4788 VoiceAI.exe 146 PID 4788 wrote to memory of 4756 4788 VoiceAI.exe 146 PID 4788 wrote to memory of 5060 4788 VoiceAI.exe 147 PID 4788 wrote to memory of 5060 4788 VoiceAI.exe 147 PID 4788 wrote to memory of 2064 4788 VoiceAI.exe 148 PID 4788 wrote to memory of 2064 4788 VoiceAI.exe 148 PID 4788 wrote to memory of 1280 4788 VoiceAI.exe 149 PID 4788 wrote to memory of 1280 4788 VoiceAI.exe 149 PID 4788 wrote to memory of 3512 4788 VoiceAI.exe 150 PID 4788 wrote to memory of 3512 4788 VoiceAI.exe 150 PID 4788 wrote to memory of 736 4788 VoiceAI.exe 151 PID 4788 wrote to memory of 736 4788 VoiceAI.exe 151 PID 4788 wrote to memory of 4012 4788 VoiceAI.exe 152 PID 4788 wrote to memory of 4012 4788 VoiceAI.exe 152 PID 4788 wrote to memory of 5272 4788 VoiceAI.exe 155 PID 4788 wrote to memory of 5272 4788 VoiceAI.exe 155 PID 4788 wrote to memory of 5272 4788 VoiceAI.exe 155 PID 5532 wrote to memory of 5668 5532 VoiceAI.exe 158 PID 5532 wrote to memory of 5668 5532 VoiceAI.exe 158 PID 5532 wrote to memory of 5728 5532 VoiceAI.exe 159 PID 5532 wrote to memory of 5728 5532 VoiceAI.exe 159 PID 5532 wrote to memory of 5760 5532 VoiceAI.exe 160 PID 5532 wrote to memory of 5760 5532 VoiceAI.exe 160 PID 5532 wrote to memory of 5772 5532 VoiceAI.exe 161 PID 5532 wrote to memory of 5772 5532 VoiceAI.exe 161 PID 5532 wrote to memory of 5792 5532 VoiceAI.exe 162 PID 5532 wrote to memory of 5792 5532 VoiceAI.exe 162 PID 5532 wrote to memory of 5800 5532 VoiceAI.exe 163 PID 5532 wrote to memory of 5800 5532 VoiceAI.exe 163 PID 5532 wrote to memory of 5256 5532 VoiceAI.exe 164 PID 5532 wrote to memory of 5256 5532 VoiceAI.exe 164 PID 5532 wrote to memory of 4160 5532 VoiceAI.exe 165 PID 5532 wrote to memory of 4160 5532 VoiceAI.exe 165 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe"C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader-alphaver-9ba1e6d12d1f480fa02d555ef4fa378c.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Program Files\Voice.ai\VoiceAI-Installer.exe"C:\Program Files\Voice.ai\VoiceAI-Installer.exe" /path "C:\Program Files\Voice.ai"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files\Voice.ai\tools\vc2019.exe"C:\Program Files\Voice.ai\tools\vc2019.exe" /q /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\Temp\{7AAB4D3C-2F1A-4F8A-8EE6-C6AADF42578D}\.cr\vc2019.exe"C:\Windows\Temp\{7AAB4D3C-2F1A-4F8A-8EE6-C6AADF42578D}\.cr\vc2019.exe" -burn.clean.room="C:\Program Files\Voice.ai\tools\vc2019.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\Temp\{AF9111E9-697E-462A-833F-42763E66169F}\.be\VC_redist.x64.exe"C:\Windows\Temp\{AF9111E9-697E-462A-833F-42763E66169F}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0D217F23-D434-430A-83CB-3C8B47192450} {06DA0C73-E602-46C1-825B-BCE54945C0DB} 13245⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1208 -burn.embedded BurnPipe.{C641308A-E88C-4A4F-AEE6-3F7ADAD043B5} {02139719-3921-43E0-B64E-EAED68373721} 45206⤵
- Suspicious use of WriteProcessMemory
PID:736 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1208 -burn.embedded BurnPipe.{C641308A-E88C-4A4F-AEE6-3F7ADAD043B5} {02139719-3921-43E0-B64E-EAED68373721} 45207⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{49956803-410F-451B-8236-90A6D0DE6A13} {5067E329-3BDB-44E7-93CE-61C57C51789F} 17528⤵
- Modifies registry class
PID:4172
-
-
-
-
-
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" installdriver3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
PID:2952
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\Voice.ai\VoiceAI.exe"3⤵PID:740
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=2252,i,449933585802901860,15469142747693947382,262144 --variations-seed-version /prefetch:81⤵PID:1612
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:3672
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b8c411e7-1c6e-784d-8de4-6f46bb60f076}\voiceaidriver.inf" "9" "46b7f3743" "000000000000014C" "WinSta0\Default" "0000000000000164" "208" "c:\program files\voice.ai\voiceaidriver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4612
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11bfc96d40:VOICEAIDRIVER_SA:16.36.0.99:root\voiceaidriver," "46b7f3743" "000000000000014C"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:4184
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=2620 --field-trial-handle=2700,i,4903870246581576504,16475010842721382788,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=47883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4756
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3204 --field-trial-handle=2700,i,4903870246581576504,16475010842721382788,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=47883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3208 --field-trial-handle=2700,i,4903870246581576504,16475010842721382788,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=47883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2064
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:/Program Files/Voice.ai/VoiceAI.exe" discord 47883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1280
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3536 --field-trial-handle=2700,i,4903870246581576504,16475010842721382788,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=4788 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3512
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3548 --field-trial-handle=2700,i,4903870246581576504,16475010842721382788,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=4788 /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:736
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=4136 --field-trial-handle=2700,i,4903870246581576504,16475010842721382788,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=47883⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
-
C:\Program Files\Voice.ai\BsSndRpt.exe"C:\Program Files\Voice.ai\BsSndRpt.exe" /i "C:\Users\Admin\AppData\Local\Temp\tmp2483.ini"3⤵
- Executes dropped EXE
- Modifies Control Panel
PID:5272
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x544 0x5481⤵PID:2508
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=2608 --field-trial-handle=2644,i,9548466882593628496,10059202253414333137,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=55322⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5668
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:/Program Files/Voice.ai/VoiceAI.exe" discord 55322⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5728
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3192 --field-trial-handle=2644,i,9548466882593628496,10059202253414333137,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=55322⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5760
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3208 --field-trial-handle=2644,i,9548466882593628496,10059202253414333137,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=55322⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5772
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3480 --field-trial-handle=2644,i,9548466882593628496,10059202253414333137,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=5532 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5792
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3488 --field-trial-handle=2644,i,9548466882593628496,10059202253414333137,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=5532 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5800
-
-
C:\Program Files\Voice.ai\VoiceAI.exe"C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3864 --field-trial-handle=2644,i,9548466882593628496,10059202253414333137,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=55322⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5256
-
-
C:\Program Files\Voice.ai\BsSndRpt.exe"C:\Program Files\Voice.ai\BsSndRpt.exe" /i "C:\Users\Admin\AppData\Local\Temp\tmpBA1C.ini"2⤵
- Executes dropped EXE
PID:4160
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5c35c2.rbs
- Size 19KB
- SHA256 7a303519c17a37c050584fc2e9670629dd4991a3bda19cbe11434bd7ccf01e06
- MD5 f172d91e39f34e3c444de026d6d7acc4
- SHA1 8828ac09f48379de77af8a91046e9c34a51afaaa
- SHA512 3b94fd980f49724fa4cdadba71e217e5e68cf8b61e80d0ccd31375f775b5b810f92b96965d741fe4bf02f23235f17a31ca6fa878ef1b5e04bbfba5d4e63ae835
- SSDEEP 192:91Rc1kR715dXcFUADIc1L+W+y4+agPu+Ziu7:91Rc6R7TeC81L/cqZiu7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e5c35ce.rbs
- Size 19KB
- SHA256 3befa1d7a05e0efd4c43bc685affa511098d89bf48e9741d6c5794b23a9751c1
- MD5 7a64847a70f45b4f3772dba542d9a120
- SHA1 e05431a7ea29cc811c5e46c7f70c90522edc870d
- SHA512 ad05310741adc57346826b5b70e72ef9eb405bce0f6b6aab5dc0622915766d18bcf097711ea8f5de8561db53393f9126d801c42d82d96a06f6bbb6ce22fae24a
- SSDEEP 192:IafQ9ft++0vxm/A37yhMZgyLe0C/VIf/VuigUEFZr32lVpO7:IIQ9ft+Zvxm/A37CR/6/Ujrv7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e5c35d5.rbs
- Size 21KB
- SHA256 47560900965e2b11642b32bda76aa5666a7de7b2b53e1df5a4ba1b5adce1e9cd
- MD5 a7728b44a74af2eeecbbe4f35515b4ea
- SHA1 70fa9800326d0f94e3fba97fe0105d2acc3145ac
- SHA512 ea6a0dd194556930fd0b5f4202e0e60a6334cc5b86e24bff85a7c375cfae434cbbc1e66abd2cdb21726d23c2e7d5276e8a73f35d0adc266805b8d1ccf8b60143
- SSDEEP 384:TTR/GRinAKxNAUhUC7xJjrMNYPVIbS/+U2hAc3o1uHZkP:TdumAKhCs7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Config.Msi\e5c35e4.rbs
- Size 21KB
- SHA256 e2cd79d32ebc13b82a9a7088869382d1a1ef58d256a3663cb9d7f10023934969
- MD5 b8d6dabc32993da9ca2d58ea7579fdf1
- SHA1 b22a98965319a13adae92e4389a32975359fa613
- SHA512 592b0d9355a16c7eb6dce125d3aa9e46f89da443fd053e62594f823c07afc66a239462d403dd9181396987ceb9cb77e7ffca32fd2b7b00f63761e2a6bddbfc9b
- SSDEEP 384:+9xKHCbTOnDlpDgfCj448JLdOsalckU72eC6pAOoMK707EfIIVQ:+9xKHCbTOnDlpDgfCURJLdBAOov4IfIr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\AudioConverter.dll
- Size 425KB
- SHA256 67271bdbe5fbc4f77fb9ec5c206da226e76245e1fbf48753156e9dcb6e5b946f
- MD5 1dbdc883fe4375e343e574bf085c0148
- SHA1 e2235e18bcb3cececcdc6024426de2437596e8c4
- SHA512 43242a0697b497a24f2b80533658d4ed9c85f37925bec471aa8b5646bfdefd9d996ab896c2d63f21ff648fc5494b24a35e4f6717041c9c97c09ca585285682a8
- SSDEEP 6144:RDnQcwxUAnoY2pLXfiO8jXW8A8Fp0KpAVrBk4v7WAcrxQcO9j60cbWE:p86AnoNL/8jm850/V9kaqlrxk9jubWE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\CefSharp.dll
- Size 1.0MB
- SHA256 7be25c5ddbbad217fcb40dbef92ba783bb8a155d3db48cde5a4c32e13761cbf7
- MD5 69f79d227400c5c5a17e4fe6b5719009
- SHA1 d7ace396db95eced9b4f98badc4282f359999d28
- SHA512 49262793c3b64fd454522381856761e456999d36e84ee228a894cefa4e19473302e9d7941d49b3a4d6faed98b136a18d60fb1dfdeaf4119f6fddb4c82da6f24c
- SSDEEP 12288:7ObMLfBX+q0BcT2a2t6z9nFaskPo7RVlmvonsn7bRI6ktDpK:7fZ6csCXNqAe95ktDpK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\DriverManager.dll
- Size 82KB
- SHA256 a789ea2806ebb04f8f9fb59c2ee0d407b64e5c33042ca7cd68aeee2fed6b0ea0
- MD5 0ca711f575bca2fae56fd952d9af1276
- SHA1 d53d175ddc924431707b8a6e4e4e834094a5fc6e
- SHA512 513de025729d4eb9f9edcbf42b5f5012321ecf1383ce2af0dd6e71b881e72f310d937b59df28cb9e416a79c4294a629da07be68a1c1622f0f1f499c8babbebc1
- SSDEEP 768:qVnY7UOxEzIoL3z/5m4BLmYGjLqQUvHd3gPflzjG14QeyMEpYinAMxXy0YytdC:qxYw9psYm23v1gPfBG14Qeo7HxXy0TC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\VoiceAI-Installer.exe
- Size 6.4MB
- SHA256 795c0f736fb12f40b424116839cef8c0189617aae4501df45d3ab7cbf823dce6
- MD5 9401b1463893aae74e34190748b13e66
- SHA1 38f8c0c96ed710ae1d78b78d01cbdd646de921eb
- SHA512 c603cb89e46b197d50299f4373fdefdc6f81d8698d7143274cb4a510bed2af0a979d0e7ab8b9c3159bb1bd3119323e533316e7166473d91907ef78e98acd751a
- SSDEEP 196608:S/tgvC/QXurc/wOm3KEDT9FqnyTbO2p9f:wGKIXNJCKofaADp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\VoiceAI-Installer.exe
- Size 442KB
- SHA256 cf4ab07afeacdf19a68591ef0452bf6ae40d79dbf8446768755d6cc4de744e7a
- MD5 b0ab93a99db4496b41a8eeee5ef92f44
- SHA1 a1e5e14444f764a44ab86d4ed9a379ee17d4cca8
- SHA512 a04b0a5a09664e917ac36178fc2c96654b1014b75023be5f05ca22cd324ac80677f97e84ec751281a5c52fefe12d0ce4bb348898956b7c940337466e5c2858b2
- SSDEEP 3072:dkBGWOsTIJgIDU5A/cno68pMABlZQ2wpFD0raUN/:d1ssj95Mp2w7g+g/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\VoiceAI.exe
- Size 3.9MB
- SHA256 1839fb52451cff7a16f31f834b795eb4663452ded6df7a6951e48326ebfc3673
- MD5 e760f3b42f993578aaf79b792dc538f0
- SHA1 45888500d9ea5ea2ffdd0d4fdb0eff6cbf349151
- SHA512 173ad8367de22f871238e7344a2b308171dd31e2646bfedf696dbad49850b98b9cc89ace5400f20edb31014283e4b4e639451ef206d8f4a5a95066bfa1ccef73
- SSDEEP 98304:Ow2H8FlWsbpRPI2H8FlWzhQ7cFGrAihQ7cFGrAc:BUKWSPIUKWzhccQJhccQ1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\VoiceAI.exe
- Size 1.9MB
- SHA256 ddb9e6f8f6e2e041261a6d27b2819f0d4d59f256cf005fda067ea317f6ac319e
- MD5 a3145074fc98b05c8ca9314cd45704e9
- SHA1 d861d86f1cecc7b0ab8e02b6097666164cf94bc8
- SHA512 4f839331c7687cfb31b7de5b49ab25a1a75eb51fa2c6790429155bf697fb07c4671ad7e3dbc861aa0d950baf39248d84ac194060e6be1f85f35c1595aa9bade1
- SSDEEP 24576:/aCN0xqDTLbtsdTEyOvmCPtxrCyQckzv2vwjJwlH2Y8YymWMQvH7Esu4KbxbVEXm:j6UthMetEVH8wmlWYUE1nbFS2f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.inf
- Size 14KB
- SHA256 a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90
- MD5 fa4ddfa2231dc2c50e26794ae7356e0b
- SHA1 463f4c2ac4f7505f2361c7853505b19fbe08f257
- SHA512 be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946
- SSDEEP 96:r14+Qu19YsitEuKz+P3w1R1vz1y7bz75uNNNqNFNraAhNqhShr2ddHRraU+ktBCt:+uYkamdxadM/JFAJKJAj582DAQZXdZzl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\meta
- Size 65B
- SHA256 0a25b4d055c55c392364dc70fd23df4bbd253c30e4782f6015badf862ebe206f
- MD5 9ca8ae6a188d9534bfe937585c7c1c8a
- SHA1 64fb2cb71aad51fe5b97e31773b7f25f2ab11089
- SHA512 bb38bb441fd7eb342ede3440eb00a8a947cbd54d134cea1a22f484a6b3692999f327adadac4acdb25af41b535053b10ba9f0110893cc01d70070c1aed1c55775
- MD5 SHA1 SHA512
- Path C:\Program Files\Voice.ai\tools\vc2019.exe
- Size 21.3MB
- SHA256 a93b1d2c99dcd1bd5f248e578e902a5013805d3d438c4c219445849c6f73663f
- MD5 76f6694f6ac9639515bbe7262fa39123
- SHA1 060fb844d8f937d46bdfcad7f0bd005e17926e50
- SHA512 ce3f7310778f3a44e55ec46ab36c7d7a28ca0aabf957199e03f816421311c8874985554d820cd6bb2a38d3df15570d01ce0432e1d64ad8d3c8ce2862da0860ac
- SSDEEP 393216:OyFpXQn0ZIoLTNOqMNFXfLMtQtN0OqtpIzNpVK/u4:O8pXDWoLTNOqMNFXTbeXw/kG4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Voice.ai\tools\vc2019.exe
- Size 24.1MB
- SHA256 37ed59a66699c0e5a7ebeef7352d7c1c2ed5ede7212950a1b0a8ee289af4a95b
- MD5 4a85bfd44f09ef46679fafcb1bab627a
- SHA1 7741a5cad238ce3e4ca7756058f2a67a57fee9d1
- SHA512 600e61332416b23ef518f4252df0000c03612e8b0680eab0bdf589d9c855539b973583dc4ce1faab5828f58653ed85a1f9196eb1c7bbf6d2e3b5ab3e83253f98
- SSDEEP 393216:OyFpXQn0ZIoLTNOqMNFXfLMtQtN0OqtpIzNpVK/uPcL4Cc+:O8pXDWoLTNOqMNFXTbeXw/kGq4h+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 1KB
- SHA256 a8b1fec674a18c69667b375cf897348691ccbe81e48de3edeb901616f8fc9caa
- MD5 435039189b3ac38722febda41d52a594
- SHA1 ff781f1481012c410961faf453fe655ae34fc203
- SHA512 b43237aeccadbea48deb0e73337e2d8db3a72cec46d886d9b80638882e4ae6bef33476c120b7ffa99732199e858025b34288950edf8cfca1363c8e9ad91b9e39
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 471B
- SHA256 86a620e6cf457816116de27ae6b217f560dd8b1373b6a0177113829881aa58ad
- MD5 31b047f3f229c6b64d30b3d5d85fa6f3
- SHA1 a39b55b71ce2d4d320c63ba09cc3d90ce4c16011
- SHA512 5af457e02f2068e2fc7ddb5fddb3c3a16fd8130c63b85935540e0a109591b55007f5583d8213e4c2307028825108800543b719c621121b21befe5cc82c77ab6c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 727B
- SHA256 368deb6231aaea8b4f8feabc3842f275618ce8c98cd5dbac689a9a4b8ff5335f
- MD5 66bf96dcca696c2f7e69f284e65b5478
- SHA1 32dd7d9dd49d7130c74572c0edf7818a6ab2684b
- SHA512 eb19fbc4bc71d7754077678bfa07dc30d3b0b05da06d7a9cb776156cc34dd43a240ab7a93c72824fe60e1e4934710d6d17da1bb7f068b56afca2782e882dbad6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
- Size 724B
- SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
- MD5 8202a1cd02e7d69597995cabbe881a12
- SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
- SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 410B
- SHA256 1b1db8725faf70a7eb397c38566f5449240a32d6438ec566fa62d67fcf966ed0
- MD5 ecc86898f3f5cf967e1d56650e744d3f
- SHA1 2fde1cfeaf9d668b04686241faaeb1a0d8c8f780
- SHA512 9334f9236539ae964ed42197011c48638997ffac5280fcf9383a40d7f99d6f7e6468ab69dc3def2885f5c226fe9f7811eb9ca420a7c9ecf385c6e0a1b22d26d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
- Size 400B
- SHA256 e56b3494a208f44b7b20ece61d4bb546b228eb3dee887d33e8f96d8d81c21a04
- MD5 1555ee748b6d8b6672c3691316dc5195
- SHA1 879bbf8fb3d45244aa0d27b5ca9754d59cf95b33
- SHA512 12f1dae36236a1dc1401ea35b567f958e448c9dad3cdf9bc0a009f574d779482211ba7924dbedb50251856474ed58a5f5dda70d3b9674bb23f4903684bf0377e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
- Size 412B
- SHA256 bcfd8133504dcd90675e6f23631270b639bfd531a0a4c6a3bda0117292a2ea52
- MD5 6857f20fe79ef277a5be1f1b6490f0a9
- SHA1 f0c0f2f7afcc0b8b4694e2a99623da5b7e4c5977
- SHA512 6db5b36d63dcaebaf93fe0efad9fb1506b67c90eedf0103366ad34f5c6a8c38800459bad7f09cd20d6ef3af9c079d4125d92aad211e1fdb0a7459f065fbdec12
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
- Size 392B
- SHA256 ebd445d6118adff071fd801b739803cc8ebcf66104ea50791b585ddbce17725e
- MD5 f75f75affe0129ecda3729b94ab4bd91
- SHA1 4c9f09d5b0fcab0fa88df0e1124f3ba44323967e
- SHA512 c5bbe278eb5ac36b3a8936af58c7e250e0b53882fc2c226ae40ef9948316b1958fe88e8d0d25e3041507865ec40dbf0fe1ff35b8a3eb4e0f69dd5c40e18dc41c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\VoiceAI.exe.log
- Size 1KB
- SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
- MD5 baf55b95da4a601229647f25dad12878
- SHA1 abc16954ebfd213733c4493fc1910164d825cac8
- SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZZV2MGD\user-event[1].json
- Size 16B
- SHA256 c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
- MD5 7363e85fe9edee6f053a4b319588c086
- SHA1 a15e2127145548437173fc17f3e980e3f3dee2d0
- SHA512 a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240323123136_000_vcRuntimeMinimum_x64.log
- Size 2KB
- SHA256 a067df1737c3b9b563b35289f1704deb6080b209433f06671894deacdc5e6292
- MD5 ce28589b0db5fc28a30bff7588bd068c
- SHA1 c5db86a79e8299e6bbb642ef4038b0570837c8d2
- SHA512 d5ff12b09d379bf62a8bb4d98c62e5adddbac843978a77626f9767676ba14da1d02b2f5d2ea3e56580b4c620f263d6caa7c4d19b914962812e0594c0851ebd9e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240323123136_001_vcRuntimeAdditional_x64.log
- Size 2KB
- SHA256 e77f52fc5564931fc6cb3c6425d7315f7d48597c805573222931628484008cd7
- MD5 5c7ea2be0e54c1eff6f04b383bb226ca
- SHA1 f049b803964e7b6510703370c2264ee811dbf95c
- SHA512 0b98bd1e3dad90146b108fdba70056d49bb9e0873aff5f36e6ceeceb8938c35ab18697ac44f41c7499ec37cd8760d208ff59926b94c5cea2bfc80205136a433b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsi5225.tmp\nsDialogs.dll
- Size 9KB
- SHA256 a87bd092fa5bc00661525455b9f866b68c14c29224520c4e38f56f47234cfc1e
- MD5 f5b0c649b0cfc103fb113d013d48cacb
- SHA1 f89286966000cb053b7e94100c76ec6d1129af07
- SHA512 e184101a03ee1c8896efb0029a02a23e46d422bc0f250ef15349c8214d44156afe2b5f739d8a2339bc2d1c05984fc55651c36c71897cd4b14f41dd37a25cfb01
- SSDEEP 96:oYDlD3cd51V1zL7xqEscxM2DjDf3GEst+Nt+jvcx4V8qndYv0PLE:oYp34z/x3sREskpxSdO0PLE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsn6708.tmp\INetC.dll
- Size 21KB
- SHA256 2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
- MD5 2b342079303895c50af8040a91f30f71
- SHA1 b11335e1cb8356d9c337cb89fe81d669a69de17e
- SHA512 550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
- SSDEEP 384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsn6708.tmp\System.dll
- Size 12KB
- SHA256 c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917
- MD5 792b6f86e296d3904285b2bf67ccd7e0
- SHA1 966b16f84697552747e0ddd19a4ba8ab5083af31
- SHA512 97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c
- SSDEEP 192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsn6708.tmp\nsProcess.dll
- Size 4KB
- SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
- MD5 05450face243b3a7472407b999b03a72
- SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
- SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Voice.ai\Cache\Local Storage\leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Voice.ai\Cache\Network\TransportSecurity
- Size 1KB
- SHA256 0732e5c1c2916853213ca6f7a421019fbbc8032129f4435f22e36d0908c27b01
- MD5 4b05d8b9b0e79518ec68a68fe7477b3f
- SHA1 883734c31bf32c153f052303a4edb52190d5a2db
- SHA512 e4a9a4e58fb59bdc5aecea8cb2a4f3556b03c8b4215f10d2f7bababa8d75e3a58fa20788219358cb1107eb2972570699a2ca6cfcae296d7458f6fe715195d64d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Voice.ai\Cache\Session Storage\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Windows\System32\vcruntime140.dll
- Size 95KB
- SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
- MD5 7415c1cc63a0c46983e2a32581daefee
- SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
- SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
- SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{7AAB4D3C-2F1A-4F8A-8EE6-C6AADF42578D}\.cr\vc2019.exe
- Size 635KB
- SHA256 21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79
- MD5 9bd591625766a7330708b2c6380dc1d7
- SHA1 18018a3d12278187a8dc26eae538a799511bbdfc
- SHA512 58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5
- SSDEEP 12288:UnMwHskY7gjcjhVIEhqgM7bWvcsi6aVcvIymacGU40vy3W/ceKSHMsiFyY6XN:SMysZgjS1hqgSC/izkfbctjymk4HM5yJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AF9111E9-697E-462A-833F-42763E66169F}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\{AF9111E9-697E-462A-833F-42763E66169F}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AF9111E9-697E-462A-833F-42763E66169F}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
- Size 5.4MB
- SHA256 f24a3bc5df7e7c07c0d13f46348c989eae7f597f428b20cc9044bba47785b7f0
- MD5 6ce5097b19cf57527651840bb438adf3
- SHA1 49d0b725e5819a076562fd007490eca0bbb69003
- SHA512 9152301c4f87018d166b624d73919fc2da7e7ef74b2c1ecf8ad01c31c2b2239013cc3bc22237c81940ae96a5fd1b3698d260c3d3e0a9d0318cdc053e28328d83
- SSDEEP 98304:NOm2zJeVAqkKD0BvRxM3cqf72fvFUQoCRGPZNxq1Z8gP4:NQleaDBvE397qP1GPZDqL8gP4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AF9111E9-697E-462A-833F-42763E66169F}\cab5046A8AB272BF37297BB7928664C9503
- Size 879KB
- SHA256 c80addc870825e9a1aa9281e105e583973ec2846bbd74f1e97cb60911ba7a2e1
- MD5 8e288dd0b5e0468ed8ae01ee566e77e8
- SHA1 fbd11237ae3300a2202444d339601d1ac6bbf310
- SHA512 facc72bdcdd5de47c0d18ecb5288962b04d9e4924a9a07ee807a3bf0eaa77eac05f086906b680bcf97c3bad5fab0038b47c0e09cd2bbec1d0709eba015bc1c04
- SSDEEP 12288:PG+HKEJ5XRhGDViuMoLxufctI9J4DZzI8+vc7Pk/HN68ge3eSqXMADKM0j3qO8/g:kEJ5XIt6c8CeJIk1BPeZXD63EX2Aj4Np
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AF9111E9-697E-462A-833F-42763E66169F}\vcRuntimeAdditional_x64
- Size 180KB
- SHA256 f8745f3523ea73806d591fa4e666e86c30c7e5240a07211a0c11a7633d16c4f0
- MD5 e6df9f55e20905f77b136844a3844dd6
- SHA1 b7c1fb12bda508a62fdd9ffa9e870cae50605aaa
- SHA512 7c71c2b9a7d3d768d1686cb037362efb9e38c50b652bfaeb22cf86c6c47a85962f9893cbf5e2f86880c9c8fc8bc0278edeb47088813e022ef05d7db15efc0713
- SSDEEP 3072:xdviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd5Qyv:rvipBaTDo1j//SZhmy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\{AF9111E9-697E-462A-833F-42763E66169F}\vcRuntimeMinimum_x64
- Size 180KB
- SHA256 5d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954
- MD5 143a2b9f1c0ebc3421b52e9adcb4db2e
- SHA1 06e01b8cc855fd9a31f99b430f8c8745e706c677
- SHA512 7e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05
- SSDEEP 3072:sviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJd:svipBaTDo1j//SZh
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\PROGRA~1\voice.ai\VOICEA~1\voiceaidriver.sys
- Size 71KB
- SHA256 74c4c2f122d48548019314fe15a331b81bfc10408b0d6f471dee94e37fe3c1bc
- MD5 90e4c7c347839c09c8f7f45de3f4fda1
- SHA1 18c5a6fae8c9292702d62e9ad2da1e24336f72c6
- SHA512 2cf37738f112026eeb68636423e619be5e34cae7734ab1cab5d8cc799af7509d2ffca09b566cbe46bb47f54981042099e857660acc2ab24558715408c011bd58
- SSDEEP 1536:CH2j6L42qc21uEawQ7Ny04Pxklu2kTwzo73:CWjCmPuTZxYxklnuwC
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files\voice.ai\voiceaidriver\VoiceAIDriver.cat
- Size 12KB
- SHA256 bae9e5bbff837d0ebb43ca1ff1a275474d8e50832a590a957afc8d3ee1e5f560
- MD5 26f1832c761580eab272ae065f644005
- SHA1 bdd7eb53423659de315d88ad5bb557ffdf5593a5
- SHA512 a0c5c4fa7dcc9d4347a521863b9ba4fd2f5eda4d49f70498c4e89c54b59b7773835796e0cc83470c191e1231c69885d22efe823a3a96b2b971ccd1473e2630eb
- SSDEEP 192:6ZveZ6F/hYN3nYJC4NaJ9EwvZvhYCPCBYKKWDKHjj3SX01k9z3A8EGMujfjI:iF/hWnY7EJZvh36l+Hj+R9zsGHjfjI
- MD5 SHA1 SHA512 SSDEEP