Overview

overview

8

Static

static

3

Voice.ai-D...er.exe

windows7-x64

7

Voice.ai-D...er.exe

windows10-2004-x64

8

$PLUGINSDIR/INetC.dll

windows7-x64

3

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    79s
  • max time network
    79s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-08-2024 23:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Voice.ai-Downloader.exe

  • Size

    477KB

  • MD5

    40ffaea0c96bc8fd1ac022ecf287980b

  • SHA1

    c9ff64fecee39aa1a4f1c930d6b6ad423e1b1c14

  • SHA256

    100dba151efe66c842fde4337857fd3db4568c1e3ee008e412927e67ed72094e

  • SHA512

    cc0f2ff6b650644564d7469031c96fcaf93b9dd82318eda244abb65970d2e5697ba27bb0c62e31f4f654cc031ac7f19f0692f444674fd174f9acbc201c8944dd

  • SSDEEP

    3072:ckBGWOsTIJgIDU5A/cNo68pMABlZQ2wpFD0ra42L5GYDxJ0ytta:c1ssjH5Mp2w7g+42LUS6

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 47 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 59 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader.exe
    "C:\Users\Admin\AppData\Local\Temp\Voice.ai-Downloader.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Program Files\Voice.ai\VoiceAI-Installer.exe
      "C:\Program Files\Voice.ai\VoiceAI-Installer.exe" /path "C:\Program Files\Voice.ai"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3136
      • C:\Program Files\Voice.ai\tools\vc2019.exe
        "C:\Program Files\Voice.ai\tools\vc2019.exe" /q /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3364
        • C:\Windows\Temp\{2C786CD1-41E0-4CAD-A413-CC1B6D216D8C}\.cr\vc2019.exe
          "C:\Windows\Temp\{2C786CD1-41E0-4CAD-A413-CC1B6D216D8C}\.cr\vc2019.exe" -burn.clean.room="C:\Program Files\Voice.ai\tools\vc2019.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /q /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3420
          • C:\Windows\Temp\{80E9639B-8F0E-4BB9-9972-68CB25E19897}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{80E9639B-8F0E-4BB9-9972-68CB25E19897}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E5921248-CDC4-4F1B-80B7-B3B69640C01E} {B6076F2A-8D3B-43A7-B6BB-8F1A6DA9A057} 3420
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3760
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1076 -burn.embedded BurnPipe.{3681D9C6-0EAB-4A38-82B2-5FA280E934E0} {C867D650-2EFD-473E-809A-3380F5C0CBBB} 3760
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4656
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={2aaf1df0-eb13-4099-9992-962bb4e596d1} -burn.filehandle.self=1076 -burn.embedded BurnPipe.{3681D9C6-0EAB-4A38-82B2-5FA280E934E0} {C867D650-2EFD-473E-809A-3380F5C0CBBB} 3760
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:412
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{08F56884-32DB-45BB-9E55-BCC0137C546D} {7777DB4B-E788-4ECD-83D9-49688694581C} 412
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:2180
      • C:\Program Files\Voice.ai\VoiceAI.exe
        "C:\Program Files\Voice.ai\VoiceAI.exe" installdriver
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies system certificate store
        PID:4768
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" "C:\Program Files\Voice.ai\VoiceAI.exe"
        3⤵
          PID:4900
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3788
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:3540
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1564
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:512
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0081f2b0-c905-5740-bb58-35d7dc982dee}\voiceaidriver.inf" "9" "46b7f3743" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files\voice.ai\voiceaidriver"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:1856
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca11bfc96d40:VOICEAIDRIVER_SA:16.36.0.99:root\voiceaidriver," "46b7f3743" "0000000000000148"
          2⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          PID:4208
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\Program Files\Voice.ai\VoiceAI.exe
          "C:\Program Files\Voice.ai\VoiceAI.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:632
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=2508 --field-trial-handle=2656,i,2742722215811193775,18184148068626751201,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=632
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:4916
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:/Program Files/Voice.ai/VoiceAI.exe" discord 632
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:3640
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3264 --field-trial-handle=2656,i,2742722215811193775,18184148068626751201,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=632
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:1816
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3284 --field-trial-handle=2656,i,2742722215811193775,18184148068626751201,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=632
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:1216
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3532 --field-trial-handle=2656,i,2742722215811193775,18184148068626751201,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=632 /prefetch:1
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Network Service Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2164
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=renderer --log-severity=disable --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --autoplay-policy=no-user-gesture-required --log-file="C:\Program Files\Voice.ai\debug.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3548 --field-trial-handle=2656,i,2742722215811193775,18184148068626751201,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=632 /prefetch:1
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Network Service Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4472
          • C:\Program Files\Voice.ai\VoiceAI.exe
            "C:\Program Files\Voice.ai\VoiceAI.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\Voice.ai\debug.log" --mojo-platform-channel-handle=3940 --field-trial-handle=2656,i,2742722215811193775,18184148068626751201,131072 --disable-features=CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=632
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:5100
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x2f8 0x560
        1⤵
          PID:2824

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Config.Msi\e586fc1.rbs
          Filesize

          19KB

          MD5

          d709c6ce10935f0d5186ae44a06bbd9f

          SHA1

          f5366dbad8ace9ce95c854011522ae96b8d2701d

          SHA256

          cb1acf563e1cac5049cba2a9e1e47ba67a409702d3986baff6e7aad4fd2d929c

          SHA512

          90d586c23cb37654a8d34cc9ca9ed3ce7dbd5229a00fff80bac1c61a5fb3b9c1b0b7ad3436cf7765d4fd5400d0b911431042a938d7f87be21fa942f0f424bf02

          Download Submit

        • C:\Config.Msi\e586fcd.rbs
          Filesize

          19KB

          MD5

          f92b04aeb9b567795d1c4450f95488b2

          SHA1

          b6724a94dca235b70107173c213bcbc22a4a788d

          SHA256

          785a66450e23662c9d885ddb6ff5eb3b21a190e05e5305dffcb9786d408dc917

          SHA512

          7fc51777c63345e2cc1ca7f2966102ee678de3b0696f1745e7823ac1ba66f11e33d9a2d8b877255def4d82da3b42e20a0f282119c5c601e64738deb0ba2e1787

          Download Submit

        • C:\Config.Msi\e586fd4.rbs
          Filesize

          21KB

          MD5

          ad2fe89fd84f529219421a3328e6c4e4

          SHA1

          86e2a11325735ed004c8516280c4f6afa464cffc

          SHA256

          1f0a9f85ad239abd053bd1b39fb8b29428bdfb9973d1c2dce4b3ecdd534c6722

          SHA512

          5ea479e1a567d131082fc0a6dc7471682650b4a0dd294a4156231370bac1de77110c91b732b36ab5d9751fe3b392fdd80c5ab2ef8a9f8aebddb14ab3e7e9b432

          Download Submit

        • C:\Config.Msi\e586fe3.rbs
          Filesize

          21KB

          MD5

          8340782e88ec8e23a0bf1e2d4d3db3fe

          SHA1

          e256c62fe70f55846e7dbced958243376314ff1f

          SHA256

          47f8e7e7400e3e2613158c2cf2c88f82458d031d9b27ec0a4d4778b0c77dab8a

          SHA512

          c4745fca80811bda98b1223d452d02fff66ccdde80255da1125f135e105e23250657f46fd1fac98f66dbba121fc59c4e5415ef50c5c89d5db8c357c06dcca39d

          Download Submit

        • C:\Program Files\Voice.ai\AudioConverter.dll
          Filesize

          426KB

          MD5

          621b743e7c8f399ddc1b85fa20abe3dd

          SHA1

          fe578bf934b40285cab078c36652d6e678500214

          SHA256

          4e12a69518507d362125e60531077dd2c4a2176cf487f620b5a812a32ce4f7b9

          SHA512

          3df19387c8cd24adede85ff2122c94b1765aa7a0ffa67735bb99ccf46cad2523e959b597c985bd790867ad685e6f6ced8b3bbf77e6d1b62feafbe044ca737444

          Download Submit

        • C:\Program Files\Voice.ai\CefSharp.dll
          Filesize

          1.0MB

          MD5

          69f79d227400c5c5a17e4fe6b5719009

          SHA1

          d7ace396db95eced9b4f98badc4282f359999d28

          SHA256

          7be25c5ddbbad217fcb40dbef92ba783bb8a155d3db48cde5a4c32e13761cbf7

          SHA512

          49262793c3b64fd454522381856761e456999d36e84ee228a894cefa4e19473302e9d7941d49b3a4d6faed98b136a18d60fb1dfdeaf4119f6fddb4c82da6f24c

          Download Submit

        • C:\Program Files\Voice.ai\DriverManager.dll
          Filesize

          83KB

          MD5

          84efdeb4b69067ce023b4f8c13d47aaa

          SHA1

          5d47146102f7e52e8a935651d5acc367147d9f5c

          SHA256

          473ffb68b425a83f0465fe4c5d5c1ae26862fb907469a5dd03640d9c7ee18372

          SHA512

          03ea586cc30181f92c65673481e694323c1fff9422ef829986d19f27a5ab8add61502a2a024a19303d7244edcf895d99d5649d898d2f07ea3e85aa8ea1a197d4

          Download Submit

        • C:\Program Files\Voice.ai\VoiceAI.exe
          Filesize

          4.0MB

          MD5

          a22ed8950371d6021f9628ece195e7f8

          SHA1

          0e6e7d001498ebeccd59db3333c346d25dd9ea98

          SHA256

          d5353a336fa2eccf73fdcdfd6153e197cda113dd05f78cb2324047d791eeddc1

          SHA512

          4b0e73834c2edf3d4f83d692b54fcbe95299f207d74983bb270ec567bdb8df5333211217b4880de18ae570632ad90e4679d0c96eb888828f2ce7bba7e9131dc0

          Download Submit

        • C:\Program Files\Voice.ai\VoiceAIDriver\VoiceAIDriver.inf
          Filesize

          14KB

          MD5

          fa4ddfa2231dc2c50e26794ae7356e0b

          SHA1

          463f4c2ac4f7505f2361c7853505b19fbe08f257

          SHA256

          a3554efa382a84130393a4d8656b31f06b20b9387e27fcba978162213fb7be90

          SHA512

          be11de31cdea93320a03892b572b17985a66d8b8483d1568afcba9d6cd73cfc8f86c628736d9c8649cb9af0acba17dc26c14fef55b2951520236f650b5a55946

          Download Submit

        • C:\Program Files\Voice.ai\meta
          Filesize

          23B

          MD5

          6997abf8c138e85961f89ee82ae53532

          SHA1

          32e7d5b03035f8e6597493168003890c0a3ed29a

          SHA256

          0fbae5806b1bc5bf6f68ae6bc0975be1ec56e27edcb4a572792246e2aa8d1ccf

          SHA512

          b176783b0c4c6503d8274484b7584acd8d7a9a29b73da63f9a01184f54e7fc7aef330301c6b97a717aa22bc96547aa8156dd432c5b15107e4b23cfa7b23da17a

          Download Submit

        • C:\Program Files\Voice.ai\tools\vc2019.exe
          Filesize

          24.1MB

          MD5

          4a85bfd44f09ef46679fafcb1bab627a

          SHA1

          7741a5cad238ce3e4ca7756058f2a67a57fee9d1

          SHA256

          37ed59a66699c0e5a7ebeef7352d7c1c2ed5ede7212950a1b0a8ee289af4a95b

          SHA512

          600e61332416b23ef518f4252df0000c03612e8b0680eab0bdf589d9c855539b973583dc4ce1faab5828f58653ed85a1f9196eb1c7bbf6d2e3b5ab3e83253f98

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          Filesize

          1KB

          MD5

          7fb5fa1534dcf77f2125b2403b30a0ee

          SHA1

          365d96812a69ac0a4611ea4b70a3f306576cc3ea

          SHA256

          33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

          SHA512

          a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
          Filesize

          1KB

          MD5

          c1286ee0b3887a890b02a827c0b4a56e

          SHA1

          533fcebfc042f00e51bf7089f1c645d51e6f4bfc

          SHA256

          20c1d3af5eaa07a7c1987ccabd4d38480dd2d9398209c750280e8f0d5f7a82fc

          SHA512

          070663d8fccc0c2858ed3e134f0c02e0cc2dee00830d339c9dc5fefeabb41b2d00cac3758750997085441d37d2b839f9fe3e1859d34e82149b4f638bd7898795

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
          Filesize

          436B

          MD5

          971c514f84bba0785f80aa1c23edfd79

          SHA1

          732acea710a87530c6b08ecdf32a110d254a54c8

          SHA256

          f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

          SHA512

          43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
          Filesize

          484B

          MD5

          4eefd763e3c4eb3943f5cb8f352b3483

          SHA1

          68e61b4eab3fd8764e25421b90f117ea7e22abfd

          SHA256

          8a58729c4bafbaeaf4db94753e6c81b05085ea849b6788891023c7437d9b5081

          SHA512

          44339e994943930b568e2bca2dc13c7afc3cadce3e64330ae9723b556b031acdbeb5e4e52f021124c42ff8fda3b985bc6e3317035b0f2d50a5602afd903e0f59

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          Filesize

          174B

          MD5

          3f9ed1fe2a60ff169a7924f82aa444ec

          SHA1

          372a5efcaeacba98cbb4fcb91dcc5284a242650a

          SHA256

          c0ffa2c1c484e0edd34a7232076693451f4f9b1e858232dd0837822b3ad3484a

          SHA512

          79c5ac3c60db65768492d15249a3c353ba6fb777223c851c2ccd20840e3438d99e061e41008cad89e9582ac37c37376cbca973d99c68205be65b5b3c5f9faefd

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
          Filesize

          482B

          MD5

          52721d6bba939eb5aee44593aac88c3d

          SHA1

          c6e07e09f7cc1e9efde9a73022065bd6b2322ada

          SHA256

          8a2288da215de4ff59ae4a6642326011aaf310408317c0b011347b426c627df9

          SHA512

          74c7195b06e12bfa4728e6124739df876a4ded8e267b04181e821b58a6ba7075c913b86e29d103239ce27f495ee48d056ed01577e94837230a66b865106e09b6

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
          Filesize

          170B

          MD5

          2f19cc99fe03b6d28855e712a615459f

          SHA1

          b70f3946bcf298e04efaafb323edd1e983213851

          SHA256

          82e4a51dadc7d4ab2a537060eb092f8c1ac1893fe43a946d5a3a9be0b4e41498

          SHA512

          e944c9e03da1a9d30632acb5b8f69862e9911d308ba0394873fe9ea6311ab5c6fac24255ffbc93f55a95629f818c24ec55d2b8f39e8c59fdc68eef8f9a72ea57

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\VoiceAI.exe.log
          Filesize

          1KB

          MD5

          baf55b95da4a601229647f25dad12878

          SHA1

          abc16954ebfd213733c4493fc1910164d825cac8

          SHA256

          ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

          SHA512

          24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VDS6YA2E\user-event[1].json
          Filesize

          16B

          MD5

          7363e85fe9edee6f053a4b319588c086

          SHA1

          a15e2127145548437173fc17f3e980e3f3dee2d0

          SHA256

          c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

          SHA512

          a2fd24056e3ec2f1628f89eb2f1b36a9fc2437ae58d34190630fe065df2bbedaf9bd8aee5f8949a002070052ca68cc6c0167214dd55df289783cff682b808d85

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240805230158_000_vcRuntimeMinimum_x64.log
          Filesize

          2KB

          MD5

          852702b5310a722e77876e56c0c9cd87

          SHA1

          02ffcd9967f2f6d52eae15876466cd15f19641c9

          SHA256

          99ad30037b0eef42d080fcdd16002f1fc91637679d0d37a7bf1dcdc0baf9a132

          SHA512

          1befc06d6deee9e7176289c7af3070afe73b2fbac627abdc52ab64d42814537945f954febd4c2c70b1112b19184a4417de37a6968dc416d6c5a21cf93de4bea0

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20240805230158_001_vcRuntimeAdditional_x64.log
          Filesize

          2KB

          MD5

          2d91599b3f612a92d214c7610b436eda

          SHA1

          01386dd6867cb7e9fb8da05c8881bfddeea5e40c

          SHA256

          a753520272e81a732192fdae57b5031842b4d2bffacd603874dc99d70923fd20

          SHA512

          f09c363ffaf44e716a1481e6ac7b16b45e505684cb42186ef0fd6408750cc98dc8266249519893046b64ab6f7c04981420a17b8dc2a89b7c189640f678dddef2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nsi1A2C.tmp\nsDialogs.dll
          Filesize

          9KB

          MD5

          f5b0c649b0cfc103fb113d013d48cacb

          SHA1

          f89286966000cb053b7e94100c76ec6d1129af07

          SHA256

          a87bd092fa5bc00661525455b9f866b68c14c29224520c4e38f56f47234cfc1e

          SHA512

          e184101a03ee1c8896efb0029a02a23e46d422bc0f250ef15349c8214d44156afe2b5f739d8a2339bc2d1c05984fc55651c36c71897cd4b14f41dd37a25cfb01

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nszB76A.tmp\INetC.dll
          Filesize

          21KB

          MD5

          2b342079303895c50af8040a91f30f71

          SHA1

          b11335e1cb8356d9c337cb89fe81d669a69de17e

          SHA256

          2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

          SHA512

          550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nszB76A.tmp\System.dll
          Filesize

          12KB

          MD5

          792b6f86e296d3904285b2bf67ccd7e0

          SHA1

          966b16f84697552747e0ddd19a4ba8ab5083af31

          SHA256

          c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917

          SHA512

          97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nszB76A.tmp\nsProcess.dll
          Filesize

          4KB

          MD5

          05450face243b3a7472407b999b03a72

          SHA1

          ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

          SHA256

          95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

          SHA512

          f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

          Download Submit

        • C:\Users\Admin\AppData\Local\Voice.ai\Cache\Cache\Cache_Data\f_000006
          Filesize

          33KB

          MD5

          a81ea6b02d432c02090bb2feb47c7088

          SHA1

          e7fa9b6ef565191d297ec48c7605a0193419ede4

          SHA256

          b05dee42264199d791c62531858b80a456a60ebdfbc6d81e25a90cdd81baf186

          SHA512

          9d805552128577aeecec170ea200245aa9818d0bcb8cc1419f954f68d47d1dd2df99efbaa76a810fc0d0078c681c9bdf9c831beee504c69a398c9ed87cef6643

          Download Submit

        • C:\Users\Admin\AppData\Local\Voice.ai\Cache\Local Storage\leveldb\CURRENT
          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

          Download Submit

        • C:\Users\Admin\AppData\Local\Voice.ai\Cache\Session Storage\MANIFEST-000001
          Filesize

          41B

          MD5

          5af87dfd673ba2115e2fcf5cfdb727ab

          SHA1

          d5b5bbf396dc291274584ef71f444f420b6056f1

          SHA256

          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

          SHA512

          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

          Download Submit

        • C:\Windows\System32\vcruntime140.dll
          Filesize

          95KB

          MD5

          7415c1cc63a0c46983e2a32581daefee

          SHA1

          5f8534d79c84ac45ad09b5a702c8c5c288eae240

          SHA256

          475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1

          SHA512

          3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf

          Download Submit

        • C:\Windows\Temp\{2C786CD1-41E0-4CAD-A413-CC1B6D216D8C}\.cr\vc2019.exe
          Filesize

          635KB

          MD5

          9bd591625766a7330708b2c6380dc1d7

          SHA1

          18018a3d12278187a8dc26eae538a799511bbdfc

          SHA256

          21503f265452414f3960b33ba000ab2cbe0a335901e3a585b0935ac4806fdd79

          SHA512

          58c90b7889d92f31e76d0559258023cb4693982288721c3c7fcd820e40f6c1ee972d9ffd3c95016c2126314a260da5faabdeb1a8528eb23d469a7ecbe391c1a5

          Download Submit

        • C:\Windows\Temp\{80E9639B-8F0E-4BB9-9972-68CB25E19897}\.ba\logo.png
          Filesize

          1KB

          MD5

          d6bd210f227442b3362493d046cea233

          SHA1

          ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

          SHA256

          335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

          SHA512

          464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

          Download Submit

        • C:\Windows\Temp\{80E9639B-8F0E-4BB9-9972-68CB25E19897}\.ba\wixstdba.dll
          Filesize

          191KB

          MD5

          eab9caf4277829abdf6223ec1efa0edd

          SHA1

          74862ecf349a9bedd32699f2a7a4e00b4727543d

          SHA256

          a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

          SHA512

          45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

          Download Submit

        • C:\Windows\Temp\{80E9639B-8F0E-4BB9-9972-68CB25E19897}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          Filesize

          5.4MB

          MD5

          6ce5097b19cf57527651840bb438adf3

          SHA1

          49d0b725e5819a076562fd007490eca0bbb69003

          SHA256

          f24a3bc5df7e7c07c0d13f46348c989eae7f597f428b20cc9044bba47785b7f0

          SHA512

          9152301c4f87018d166b624d73919fc2da7e7ef74b2c1ecf8ad01c31c2b2239013cc3bc22237c81940ae96a5fd1b3698d260c3d3e0a9d0318cdc053e28328d83

          Download Submit

        • C:\Windows\Temp\{80E9639B-8F0E-4BB9-9972-68CB25E19897}\cab5046A8AB272BF37297BB7928664C9503
          Filesize

          879KB

          MD5

          8e288dd0b5e0468ed8ae01ee566e77e8

          SHA1

          fbd11237ae3300a2202444d339601d1ac6bbf310

          SHA256

          c80addc870825e9a1aa9281e105e583973ec2846bbd74f1e97cb60911ba7a2e1

          SHA512

          facc72bdcdd5de47c0d18ecb5288962b04d9e4924a9a07ee807a3bf0eaa77eac05f086906b680bcf97c3bad5fab0038b47c0e09cd2bbec1d0709eba015bc1c04

          Download Submit

        • C:\Windows\Temp\{80E9639B-8F0E-4BB9-9972-68CB25E19897}\vcRuntimeAdditional_x64
          Filesize

          180KB

          MD5

          e6df9f55e20905f77b136844a3844dd6

          SHA1

          b7c1fb12bda508a62fdd9ffa9e870cae50605aaa

          SHA256

          f8745f3523ea73806d591fa4e666e86c30c7e5240a07211a0c11a7633d16c4f0

          SHA512

          7c71c2b9a7d3d768d1686cb037362efb9e38c50b652bfaeb22cf86c6c47a85962f9893cbf5e2f86880c9c8fc8bc0278edeb47088813e022ef05d7db15efc0713

          Download Submit

        • C:\Windows\Temp\{80E9639B-8F0E-4BB9-9972-68CB25E19897}\vcRuntimeMinimum_x64
          Filesize

          180KB

          MD5

          143a2b9f1c0ebc3421b52e9adcb4db2e

          SHA1

          06e01b8cc855fd9a31f99b430f8c8745e706c677

          SHA256

          5d0416e45819d555ad27e5efc1aeeb465cbb8e2937b3221852bea0f7d9c3a954

          SHA512

          7e17309cdaa856bd1bf17535e0f65db585226262a1c9ffcaadb19eb0822a578ad9036487870b97fc86b7167848f69d495aa51c380ba9890a71f8f9a94061fa05

          Download Submit

        • \??\c:\PROGRA~1\voice.ai\VOICEA~1\voiceaidriver.sys
          Filesize

          71KB

          MD5

          90e4c7c347839c09c8f7f45de3f4fda1

          SHA1

          18c5a6fae8c9292702d62e9ad2da1e24336f72c6

          SHA256

          74c4c2f122d48548019314fe15a331b81bfc10408b0d6f471dee94e37fe3c1bc

          SHA512

          2cf37738f112026eeb68636423e619be5e34cae7734ab1cab5d8cc799af7509d2ffca09b566cbe46bb47f54981042099e857660acc2ab24558715408c011bd58

          Download Submit

        • \??\c:\program files\voice.ai\voiceaidriver\VoiceAIDriver.cat
          Filesize

          12KB

          MD5

          26f1832c761580eab272ae065f644005

          SHA1

          bdd7eb53423659de315d88ad5bb557ffdf5593a5

          SHA256

          bae9e5bbff837d0ebb43ca1ff1a275474d8e50832a590a957afc8d3ee1e5f560

          SHA512

          a0c5c4fa7dcc9d4347a521863b9ba4fd2f5eda4d49f70498c4e89c54b59b7773835796e0cc83470c191e1231c69885d22efe823a3a96b2b971ccd1473e2630eb

          Download Submit

        • memory/412-506-0x00000000001F0000-0x0000000000267000-memory.dmp

          Filesize

          476KB

          Download

        • memory/632-747-0x0000029E1D540000-0x0000029E1DA68000-memory.dmp

          Filesize

          5.2MB

          Download

        • memory/632-674-0x0000029E7E230000-0x0000029E7E242000-memory.dmp

          Filesize

          72KB

          Download

        • memory/632-676-0x0000029E7E260000-0x0000029E7E26A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/632-673-0x0000029E7FA90000-0x0000029E7FB0C000-memory.dmp

          Filesize

          496KB

          Download

        • memory/632-675-0x0000029E7E220000-0x0000029E7E230000-memory.dmp

          Filesize

          64KB

          Download

        • memory/632-677-0x0000029E188C0000-0x0000029E18A81000-memory.dmp

          Filesize

          1.8MB

          Download

        • memory/632-683-0x0000029E80310000-0x0000029E804D2000-memory.dmp

          Filesize

          1.8MB

          Download

        • memory/632-746-0x0000029E7FF20000-0x0000029E7FF90000-memory.dmp

          Filesize

          448KB

          Download

        • memory/2180-469-0x00000000001F0000-0x0000000000267000-memory.dmp

          Filesize

          476KB

          Download

        • memory/4656-507-0x00000000001F0000-0x0000000000267000-memory.dmp

          Filesize

          476KB

          Download

        • memory/4768-565-0x000001DB725F0000-0x000001DB7265C000-memory.dmp

          Filesize

          432KB

          Download

        • memory/4768-559-0x000001DB57D70000-0x000001DB58172000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/4768-561-0x000001DB728D0000-0x000001DB729D4000-memory.dmp

          Filesize

          1.0MB

          Download

        • memory/4916-695-0x0000027877070000-0x000002787718C000-memory.dmp

          Filesize

          1.1MB

          Download