1ceb5fba493512f8ebe16b531f21a11fa2dde7c14801303f0124639e3738c45d

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DubbingAI_v1.8.0_03182015_Release_C_Setup.exe
Size 114.3MB
Sample260517-chfs5sft2q
SHA256 1ceb5fba493512f8ebe16b531f21a11fa2dde7c14801303f0124639e3738c45d
MD5 7c15963269e620a80af671ca3bed3538
SHA1 3030135f44fa3e1855ec49656811e3d17aef5694
SHA512 1137f7a56bfef435b5d1f96d03f35d7cf1018f18710003ca80cb14492bc91ca4246a31d3ee66dc106c10c2475e4d45e508bd7e6bb639e8a0aba532cbee25f6ff
SSDEEP 3145728:utt40pXNutpa9M0dP04+sDN6Py9RysV4tkAr24VEdk2Pn:u19utpa9MZsDN6q9RvUqk2v
TLSH
T15548332B7288213FE5636B3306758F71453B6EB638190C4E83F4B95CCB775901E2AE99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution installer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DubbingAI.exe

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SETAC58.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETAC58.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\DubbingAudio.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DubbingAI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DubbingAI.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Themida packer 19 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4868-6068-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp	themida
behavioral1/memory/4868-6066-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp	themida
behavioral1/files/0x000700000002502c-6061.dat	themida
behavioral1/files/0x00070000000244cb-6041.dat	themida
behavioral1/memory/4868-6070-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp	themida
behavioral1/memory/4868-6069-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp	themida
behavioral1/memory/4868-6074-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp	themida
behavioral1/memory/4868-6073-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp	themida
behavioral1/memory/4868-6075-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp	themida
behavioral1/memory/4868-6077-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp	themida
behavioral1/memory/4868-6079-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp	themida
behavioral1/memory/4868-6078-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp	themida
behavioral1/memory/4868-6080-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp	themida
behavioral1/memory/4868-6098-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp	themida
behavioral1/memory/4868-6097-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp	themida
behavioral1/memory/4868-6101-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp	themida
behavioral1/memory/4868-6102-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp	themida
behavioral1/memory/4868-6105-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp	themida
behavioral1/memory/4868-6106-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp	themida

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}\DubbingAudio.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}\SETAA84.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}\dubbingaudio.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6\DubbingAudio.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6\dubbingaudio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6\dubbingaudio.PNF	devcon.exe
File created	C:\Windows\system32\sysdbdn	DubbingAI.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}\SETAA83.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}\SETAA85.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}\DubbingAudio.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}\SETAA83.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}\SETAA84.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{9cf771ee-1677-4c43-9d57-8860ad876ed4}\SETAA85.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6\DubbingAudio.cat	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DubbingAI\vc_model\is-5IKDR.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-K2MGJ.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-J7MIM.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-2AQD3.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-BTIHQ.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-QN92C.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\guide\is-HKEO2.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\is-2BLVQ.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-I7ONG.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-UG1NT.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-MO6J8.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\banners\is-61ELT.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-IQO1I.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-6DFJ0.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-D6AFM.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-TU4I4.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-8HSMG.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-FECOT.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\box_mega\is-IA681.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\layout\is-6I6U2.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-5KTVK.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\layout\is-UHQ2F.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-QE8P5.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-L4I24.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\audio_play\is-QPPRR.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\recording\is-R82TQ.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\subscription\is-HA22O.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\subscription\is-V55AE.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-PL71U.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-BIDMU.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-6IR7A.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-A6853.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-1E49I.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-EPMNV.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-C6T8G.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\box_mini\is-EG5CV.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-2FSC4.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-U0KPJ.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-L9O66.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-JQIUA.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-6VG7C.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-AQQGN.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-E0JT0.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\box_mega_small\is-P0MIC.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-NMG43.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-B9M09.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-2D4JT.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-N98V0.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\loading\is-TEK89.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\layout\is-J8UPL.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-F0V0V.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-LIJ29.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-UNEDJ.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-EV1C4.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-KC6D9.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\banners\is-580H0.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\new_comer\is-L4JI4.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\recording\is-9IHSG.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-EDNHT.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-IAB2T.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-HB5AC.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-52VND.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-B0F6M.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\box_mini\is-Q6BU0.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Fonts\is-6RPBV.tmp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\INF\c_media.PNF	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe

Executes dropped EXE 8 IoCs

pid	Process
4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
696	devcon.exe
1052	SetAudioDevice.exe
548	devcon.exe
3216	find.exe
4444	devcon.exe
4368	SetAudioDevice.exe
4868	DubbingAI.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4132	sc.exe
4976	sc.exe

Loads dropped DLL 23 IoCs

pid	Process
4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
1052	SetAudioDevice.exe
1052	SetAudioDevice.exe
1052	SetAudioDevice.exe
4368	SetAudioDevice.exe
4368	SetAudioDevice.exe
4368	SetAudioDevice.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe
4868	DubbingAI.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DubbingAI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DubbingAI_v1.8.0_03182015_Release_C_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1028-0-0x0000000000400000-0x00000000004F0000-memory.dmp	innosetup
behavioral1/memory/1028-12-0x0000000000400000-0x00000000004F0000-memory.dmp	innosetup
behavioral1/memory/1028-6076-0x0000000000400000-0x00000000004F0000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2164	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\DubbingAI.exe\SupportedTypes	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\\OpenWithProgids	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenWithProgids\DubbingAI	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DubbingAI	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\shell\open	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\shell\open\command\ = "\"C:\\Program Files\\DubbingAI\\DubbingAI.exe\" \"%1\""	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\DubbingAI.exe	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DubbingAI\DefaultIcon	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\DefaultIcon\ = "C:\\Program Files\\DubbingAI\\DubbingAI.exe,0"	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\shell	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\DubbingAI.exe\SupportedTypes\.myp	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\ = "DubbingAI"	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\shell\open\command	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\DubbingAI.exe\SupportedTypes	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\URL Protocol = "DubbingAI"	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DubbingAI\shell\open\command	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeAuditPrivilege	1360	svchost.exe
Token: SeSecurityPrivilege	1360	svchost.exe
Token: SeLoadDriverPrivilege	4444	devcon.exe
Token: SeRestorePrivilege	2096	DrvInst.exe
Token: SeBackupPrivilege	2096	DrvInst.exe
Token: SeRestorePrivilege	2096	DrvInst.exe
Token: SeBackupPrivilege	2096	DrvInst.exe
Token: SeRestorePrivilege	2096	DrvInst.exe
Token: SeBackupPrivilege	2096	DrvInst.exe
Token: SeLoadDriverPrivilege	2096	DrvInst.exe
Token: SeLoadDriverPrivilege	2096	DrvInst.exe
Token: SeLoadDriverPrivilege	2096	DrvInst.exe
Token: SeLoadDriverPrivilege	4868	DubbingAI.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
4868	DubbingAI.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4868	DubbingAI.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 4432	1028	DubbingAI_v1.8.0_03182015_Release_C_Setup.exe	90
PID 4432 wrote to memory of 2164	4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp	91
PID 4432 wrote to memory of 1080	4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp	98
PID 1080 wrote to memory of 696	1080	cmd.exe	100
PID 1080 wrote to memory of 4976	1080	cmd.exe	101
PID 1080 wrote to memory of 4132	1080	cmd.exe	102
PID 4432 wrote to memory of 1052	4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp	104
PID 4432 wrote to memory of 1440	4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp	106
PID 1440 wrote to memory of 548	1440	cmd.exe	108
PID 1440 wrote to memory of 3216	1440	cmd.exe	109
PID 1440 wrote to memory of 4444	1440	cmd.exe	110
PID 1360 wrote to memory of 2244	1360	svchost.exe	112
PID 1360 wrote to memory of 2096	1360	svchost.exe	113
PID 4432 wrote to memory of 4368	4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp	115
PID 4432 wrote to memory of 4868	4432	DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp	120

C:\Users\Admin\AppData\Local\Temp\DubbingAI_v1.8.0_03182015_Release_C_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\DubbingAI_v1.8.0_03182015_Release_C_Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\is-G9KKT.tmp\DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G9KKT.tmp\DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp" /SL5="$902B0,118830839,928768,C:\Users\Admin\AppData\Local\Temp\DubbingAI_v1.8.0_03182015_Release_C_Setup.exe"
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill.exe" /IM DubbingAI.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\DubbingAI\AudioMirror\unInstall.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Program Files\DubbingAI\AudioMirror\devcon.exe
      devcon.exe remove Root\AudioMirror
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:696
  - - C:\Windows\SysWOW64\sc.exe
      sc.exe stop AudioMirror
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4976
  - - C:\Windows\SysWOW64\sc.exe
      sc.exe delete AudioMirror
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4132
- - C:\Program Files\DubbingAI\SetAudioDevice.exe
    "C:\Program Files\DubbingAI\SetAudioDevice.exe" get
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\DubbingAI\DubbingAudio\install.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Program Files\DubbingAI\DubbingAudio\devcon.exe
      devcon.exe status "Root\DubbingAudio"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:548
  - - C:\Program Files\DubbingAI\DubbingAudio\find.exe
      find "Dubbing Virtual Device"
      4⤵
      Executes dropped EXE
      PID:3216
  - - C:\Program Files\DubbingAI\DubbingAudio\devcon.exe
      devcon.exe install DubbingAudio.inf Root\DubbingAudio -v
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      PID:4444
- - C:\Program Files\DubbingAI\SetAudioDevice.exe
    "C:\Program Files\DubbingAI\SetAudioDevice.exe" set
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4368
- - C:\Program Files\DubbingAI\DubbingAI.exe
    "C:\Program Files\DubbingAI\DubbingAI.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Drops file in System32 directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{87faec1d-93c3-7c4d-813d-350c1901bfd9}\dubbingaudio.inf" "9" "4d29efb83" "0000000000000144" "WinSta0\Default" "0000000000000158" "208" "c:\program files\dubbingai\dubbingaudio"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:2244
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:f1d970029a30b8fa:DubbingAudio_Device:15.55.58.533:root\dubbingaudio," "4d29efb83" "0000000000000144"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

devcon.exe

Path C:\Program Files\DubbingAI\AudioMirror\devcon.exe
Size 81KB
SHA256 aca1bda08690dcca930254f96f9185c776671a85a58ffa1b59cf16017546f218
MD5 816c4e245b286b4e4903131f75a94948
SHA1 eda70c1fc8a461efb0e376d42e35a72b96175e4d
SHA512 d0dc74956c57403c0638e6595aaf1c2eb75233997a15170b064261a5d3f1f525a3e35e13fef04c36cc20fd1d5d1cf000a5fb7a646bf2cf1cea73817e5d3335b3
SSDEEP 1536:11Xslj1j7qfAgg1j9f5G/N5hJO+D8AQNJ3Fc5VnZcFMqO7WH:11M2fAggGnD89NJ1cPZCM3W
TLSH
T1D083B40263E91659F5F37A3469B552354A737CA1AE38C69E0298912D0FF3EC0DC74BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unInstall.bat

Path C:\Program Files\DubbingAI\AudioMirror\unInstall.bat
Size 118B
SHA256 8ceebfceaf5bda630984fdad74b8358f06cd4eb972db57aee7307aab2b67698e
MD5 50e2cfa04e39692669d2be777c2588ca
SHA1 8375bfb9e0a501b57065089eb5911599d1088df9
SHA512 a85b4708c68a393e44dda189f09de7a8e9af041da4aeed092c64efe134eacfa9feea33eb0441ac969b596d2b325c89a366f69b8390b07d3a766072319a15c4c8
TLSH
T12DB092D3412FCE6A940888C0F00BA8D97A4FD0419A1B8C8020833279A6A7288C80C68A
MD5 SHA1 SHA512 TLSH

Submit Download

DubbingAI.exe

Path C:\Program Files\DubbingAI\DubbingAI.exe
Size 4.7MB
SHA256 9ec10b9057ef774bc5500451c400a126787c9a54c8f5a59d8613dd03307eb79d
MD5 9848440cca398b13bf0e3d49288e51d4
SHA1 031cc252cbb19bd7f2760b6b1ef9d2316c700a75
SHA512 848ddcc97b8967d271a4215cb4a31af442345a7f599434548b5fc277e7979f3d6583def11fe8205ad66bb5b91d07b0739237ae62015ac9cb8e078d141627c6b0
SSDEEP 49152:m8fXb8CMRLeSiOu189Q14eO75sZeQlHMpf7u6lWrs+YrNn2XqnLX1HDoPtXq7zit:mL9mO7AYLpMwO9bO+XznXz1
TLSH
T15E367C4662F505E5D0B7D2398A674933EAB3BC251331C6FB02A1B2564F337D09E7A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DubbingAudio.inf

Path C:\Program Files\DubbingAI\DubbingAudio\DubbingAudio.inf
Size 11KB
SHA256 bd0b41667e97c7637433e38db13e7839134690f1357d259c070f1a5cc4efa260
MD5 614e0bf1a0238d06ad1c8ccbdf85a98d
SHA1 71dc8a57ef24cd461e42bba7de31ab2809dfc071
SHA512 f07034d1aa0f8a8a346d18292ed21fe721cac94fdb2cd246a61fcf0b3ecc4655689f2a6cf6843545804b26cb2bf283c622b50d0c8a9153fa32b6bca2b3fa7a69
SSDEEP 192:d5Ijpu+Lfdd3ddSRijYykiuDyp7joo2D6QZyZb:d5Ij9/KIEPZyZb
TLSH
T12F32071372F90718F2F29B81DBF0D0A68A2BBC926538D65F01E9428F1AE5E414D91F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

find.exe

Path C:\Program Files\DubbingAI\DubbingAudio\find.exe
Size 17KB
SHA256 1a1876c5eed2b8cd9e14ebff3f4eeb7e21552a4c6aab4bf392a55f8df3612dab
MD5 ae3f3dc3ed900f2a582bad86a764508c
SHA1 1e44ee63bdb2cf3a6e48b521844204218a001344
SHA512 059c0a371aada5f36e72196109c06208b68475ed0fbefb950beb0cbea2c29595151d65b087c5113af41df926596c4fe4e01102daf4b75e999cf6d6517d26ff63
SSDEEP 384:Ahvo3AARFAaVDVxRshn92Jwpvwp0VJZyTWOIW:oV2DVM9Cuvu0VLyt
TLSH
T18F82090C27A734DAE016837DCAA2015191B97270232E6AFF28E6C1394F537DADD79ED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.bat

Path C:\Program Files\DubbingAI\DubbingAudio\install.bat
Size 226B
SHA256 ce2f37f933727dbb736704552195a093b9455dea97e0d51b1fab2778f84cbd83
MD5 6260ec22da6c8e3f8a60002e3c6c5343
SHA1 402ee8eadb19a9363fdba938758c022cf68bd978
SHA512 5fdf3f7fb0a251fef8edae3c033c7b8e30a25b458f7e64faafb229400d91676133fb1c142b88b78d69c1c16f7c828d69278c83a2da67c2ff5a0ef66139a6665c
TLSH
T1F5D0A751251639204A2C95709009208AFFC7894750120E5070B2C0741B6A5CDD6EB697
MD5 SHA1 SHA512 TLSH

Submit Download

InDeviceId.ini

Path C:\Program Files\DubbingAI\InDeviceId.ini
Size 55B
SHA256 a85dae1cdb3013119da75723b288f7eda7760c085262644f9a86b384cd3c08a9
MD5 2a68e811c26ebb6942dc6d71e32c8c59
SHA1 3c52996387d24e9b83405607b2a6fc2c44e86572
SHA512 7d3e1d6a4ded3c7e7eb496c848840c176dc44bea193e1ae9b5d119c807e1bb7bc00293d01149f3a6597b4477f8898ff0796d9754073af0b22359f097b1d124a6
TLSH
T12D9002A21254A451C012C1E001A9354DC2ABB05A94E84192549265925502500AC76882
MD5 SHA1 SHA512 TLSH

Submit Download

SetAudioDevice.exe

Path C:\Program Files\DubbingAI\SetAudioDevice.exe
Size 82KB
SHA256 def90008d015ea9c5b935208dacd4371c071bc96f390dd8b6a79af3a45336cde
MD5 cb084353c30a8a949a133ce647e9d6d4
SHA1 d04d9b214b928fede9aa895e95b9fdb1f7874496
SHA512 f2c1b43773f38320fb63c9f95272f689d59e9b8762c6534c81552fe9ca5408f0eec8fb393f9ec16e29baad7d57eb5ddc52931d04d578f383e2c57a1b711f4baf
SSDEEP 768:EM3X2K/TX2k6U9H7Qip/iL0y8fXauejvk97Ss4KL95q2zlH7SRSJWk2C6D2Aaqrd:b2KTr6AMwCue7s4KLPpSw2NFpFCxn0
TLSH
T122839F9B376900E5D65BE2BCE1C24913EAB5B8460B9553CF039243750F6A3C1BFBEA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dubbing-base.dll

Path C:\Program Files\DubbingAI\dubbing-base.dll
Size 3.3MB
SHA256 da5e289bbde10a92c3271ccc6b6c45f9fd7c385e2b2c4f229f872901e0bfca25
MD5 ae43b66926b327cfd516f68173ca0675
SHA1 16a0d87dab373230e01640f072ddfe101c08b785
SHA512 24167dfc3cd4cbff560199f07e15470db1e0b26fb093c46c7decf14d4349c6ccdba786de532f0b0227c96a33f0874a55e66fa3bea45924b2ec344125249952a9
SSDEEP 98304:318p861gBlA3oBnJ20E8ON8gZ+v9fPEXZNvnAayeP:F8p86ubEipEv4PEXnA5eP
TLSH
T15EF533265FB50D87CBEA2DF4A5DE970F11128289CDDA4BC7013FB0E01A116AE73B6C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dubbing-sdk-windows.dll

Path C:\Program Files\DubbingAI\dubbing-sdk-windows.dll
Size 3.7MB
SHA256 991e015413a20b415ef71319cde63901da94cb91b26ce509f742bd50c4d55fe6
MD5 3233913e703c69410de45df1149f1dc5
SHA1 6d45402a22daa76beaa711180d00cc179de00347
SHA512 10a102577f5603fedfb71dffed5595636293a0ee9a748347451e4338c843f8a62174de952ada0a82c7c2e5607c4cd5596c4e5721759674b61da748bba4db8cdf
SSDEEP 98304:/qrSZiaHL3JYVDPWYFFSudbZrYIpV6jeKoxNI8j0yBSMiVpEoEw:yrSZ7HL3JYVDPWQTrYIr66KwI8j0yEEM
TLSH
T1570633AB6720DA42DEDFEDB8F6C6E6879045C1184FCBFF1509070D2B018B7AA93915B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dubbing_sdk_device.dll

Path C:\Program Files\DubbingAI\dubbing_sdk_device.dll
Size 699KB
SHA256 210ffc0c8e357ae5e42ad38319f45c0868882961f1e24a7c6201538d0a68fbba
MD5 81afc7b1e82a36fe3b94697993e3a398
SHA1 afb013ecdb73c8626414823d11ff35b91f826bea
SHA512 2f5ae67b7840b2af350ae2f2243984063e8284c62a3e2cd7b574c54e9c1426a170eb10a4aa9874aee9ec828f288302be55beaf2021bdd4473fdf4a6437548027
SSDEEP 6144:EDarBdFwcnkvLPZkraBSYCS859Aa0UzX00UudfMC2ehEH5WG3oyJKgW8KY:CarBdSPvLPfBES8fBfbrh+3ot
TLSH
T1B9E48C9AE7A822E9D17BD13DC0D3531BE6B1305907218BCF059187AD3A03BE91B7B716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dubbing_utils.dll

Path C:\Program Files\DubbingAI\dubbing_utils.dll
Size 370KB
SHA256 d334bb83b0ebe1737f2084e190c25dc0e90f94c6dbb3f3a3ec9aedaf1be3758a
MD5 ac7ad54f1c9c8e9fe5681b0d7675f7b3
SHA1 d1ca2cb48ca9f0adb70fa6718edd6cb9bdd0ad3f
SHA512 14f213ddbbbf177ae1c425fa18f773e93a4870cfca3dadcd3c39aab3a2b5b0aa91732b4db0a8fa2fcea9ce7b73538ab120f5a0bdd11eaa03c4317e112350dcd8
SSDEEP 3072:/vKeH0WDHzEkcoH5bXkOYYTfEYtqXTARfgty7lWJYYY8wJ7GrGjv8g0oBMhBlaIb:/rTYktRXAQqXTHNGjv8gNMBdOBdY
TLSH
T119845B6EEB1C0462E177F27CC1C3860BEAB12559836297CF04DAD7E91903BD95A37B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdk-aac.dll

Path C:\Program Files\DubbingAI\fdk-aac.dll
Size 1.2MB
SHA256 ec2e5abacf2ef2992b0a3cde437f424a41654cb358824876a58ceab644876a96
MD5 552e7f3fffbc0ddd860bc59ec2beb4f4
SHA1 4b65f449b9571174f94ae8e9f17159b8619952e3
SHA512 b3f4d19b00380ec5f0c9c082d31627427b51c6ff020d2749083b456c88b51f7b1800a6b7a0117ddea0d029519827fbed0127e95e2eeec2a84ddced1f4724d293
SSDEEP 24576:ZBaJ+9orIUquOnxKP7UsfYe9UZoZX2I/+XNaM6CapKTBZknRiy:ZBaJaU1QYQsfYe9UZoZX2I/eNaMyQXkc
TLSH
T1C245AEC2FBA716ECC2BBC038915A4616E776784903245BFB6A98DA743E23FC15779304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ixwebsocketex.dll

Path C:\Program Files\DubbingAI\ixwebsocketex.dll
Size 227KB
SHA256 2d8b8cbb744ada20841108d1d19acada29f042f63291f03de760e817a68ea17e
MD5 2d8eec75a4f00223e201e615717c39f8
SHA1 0f109d933f08280c700820d212bbaaab8681e883
SHA512 1d89dffdd3370e43a29df00e52e3a47428b89c08c639478284ac33007454f7ca71db3928f29b4deafc4784c00ef5df456d93b7e76269870e21b5818ecbf5713b
SSDEEP 6144:FXKqE20vlDCSWsPsIrkeN8zLB8UL+tBzKV:MqE2c2IIp/j6tB8
TLSH
T1D9346B5B32A800B9D6E7D17CAA875E03F636744A036196DF03E042BA1F5B7E4BE79710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1-x64.dll

Path C:\Program Files\DubbingAI\libcrypto-1_1-x64.dll
Size 3.3MB
SHA256 86ffb90ac3e902050951a3a33fe7a2fa9d7019aff29577d1564ab9d00236cf2b
MD5 77efa9398cd877d95f5a03b56da2c936
SHA1 3d3f26d9dd437b9213c439a0436b82f66560a606
SHA512 dd4abc83fddc79ee4fc81d66eb700f84a080f66f48c7e5064105666a45bf1f26d56f8d644aa504f0c31fe020353fee14325c80ec27cd4ca0440fedbb7cbe76cd
SSDEEP 98304:e2+LqsDz58kpjMMM8iAs2j1CPwDv3uFZj:tYqsf58zMM8s2j1CPwDv3uFZj
TLSH
T13FF58D5AA7AC0194E5BAC17CC9574737D3B1B82997B09BCF08A5C1780F23BD62A3DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files\DubbingAI\libcurl.dll
Size 486KB
SHA256 6dcdb4044cd496a06260f33ebdbd455c383a64cab184835db31daa23fd1e0454
MD5 9992ea38a969f596fbca4a837eddb038
SHA1 e9a7ffe132c2db72bf1c47a28ce6bf731bc9f426
SHA512 e310295db668ccdaea1063807354228023ac71d5b8b3538beb32ae5a30bfedd1e41d612d481ca85d0e331b9a924794b01a625d68afa49d31053cc4a3c00cbbf0
SSDEEP 6144:Fyl0ppLzuKU5UVkdgc1VC3TvBhAsI5N5mewhLdwwA9qI306GTw0T+EKu54ybV1cJ:Majzu5Sg/kT5mg3dJI30bTwX1TKISv
TLSH
T158B46B96B3B405A9D1A7C13CC6178A07E7B2B4592360E7DB07B0CA792F13BE5763A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libsamplerate-0.dll

Path C:\Program Files\DubbingAI\libsamplerate-0.dll
Size 1.4MB
SHA256 c395fa20bb73ea23ff0b1a796b6c067cfa547e51fbedcf837b86578867d96325
MD5 a3152f39f57ad9419e24978073de8f88
SHA1 5b1428bfd1a5de018d43e3f3925d2750f326ed4a
SHA512 ad797813e5b4153280e39c18751756010cf00c8a05b7efb24aa28e4a3a64e6e56dbbbe665555fb17c43696b6d495f6c2bcd24e5e87d285d0430e62ea34e601c6
SSDEEP 24576:6viyMikRA8OHrdSLdcpo4pg97PeAesDPJi3vsjpRUZhPWar1T1FbySKCyqQmGF26:6vi1APrdudcpo42JKsDxi3EjDox9ToCk
TLSH
T1466523AA48D25F46C525C035F345E23ADB2367EE7AEEA8D70604E0301ABBA47D54734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libspeexdsp.dll

Path C:\Program Files\DubbingAI\libspeexdsp.dll
Size 128KB
SHA256 071feed74d724c72049c8c5d48b7e8a2a61697383d84b41d8d639346b6ae4f44
MD5 65575ef949097fe2188dd5b21ea6f176
SHA1 cf1058bd18fc874ecba4b682f3aa1e1fec5bb8ed
SHA512 fad8956df63535a8f716024bc102f51327694ec17b3bc26621ac89757a32bf521f78354b21a3e687b7d108908d4db63827c93b0d60718ee2142c15ed219b3da3
SSDEEP 3072:H1g10xk3XPYMNIoGIeV2wnkKNbAJOqDDDOZDx3MIhFf:GSoGIcxkK8O133bhF
TLSH
T16FD35B46F1E695ECE037407EA26AF84BB623752503504BFB83D5C76A2F16AC01DFA316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1-x64.dll

Path C:\Program Files\DubbingAI\libssl-1_1-x64.dll
Size 671KB
SHA256 3e1f112655196e74848ac93ffe490e7153f49ac1295a4321094d1a854cc17f6e
MD5 e1eaf1de689d8ee1aa3f6848769463b3
SHA1 ac93d44b4fd7f59d56e36c55349cc6c9e7565e1d
SHA512 0dfa76ec836541be167e0ea12ac4f62d1633509dec081480c946e1ff4ecf9c8a87b347f455703ae71e7f721aa8e95279b9ab75553befa41efc1e6f1f1fdbd7f6
SSDEEP 12288:+qp6pa7/R/5rI45fXuBnhyD8hIn4CHYo/cfEJNbZ4g094rK+wU2lvz:eU5rI4oCJNbZiU2lvz
TLSH
T123E43A95BBB514A4E9E6C17C8A534A23E3B6F41413309FCF0695993E0F17BC82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\DubbingAI\msvcp140.dll
Size 555KB
SHA256 b2bd81e9ae5cf2714c8a245428ef22fa5eab3e3b92a926ef395e1f3733939e25
MD5 0d9ffc3f4d6a9e762282891c7b4c61e1
SHA1 15468bd1183b091b92f9e9a3bd352c0562b5b9a3
SHA512 9d8529f9f043196b101a2bd3c9d13a5b8b9e09bc827f5afdd86894998ca1463fc8f74fea66c5b33498b2685294c2f90c75ce9efd77f7bccf19337ebd37ea413e
SSDEEP 12288:DNkybjD4xaP1luZUMDskEzNKKXvD8L2QEwP3lOXQ2oGQEKZm+jWodEEVKf5Q:DQP3e5QEKZm+jWodEE4f5Q
TLSH
T11BC40927B75901A0E195A3B8A1C74306D7F17C4A8322A3C792FBD69D2F6B3D1673B190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-4MSPN.tmp

Path C:\Program Files\DubbingAI\res\drawable\activity\is-4MSPN.tmp
Size 746KB
SHA256 91afd6efa3185d9d3db776bef4979cec4be6841b3e0079b7f1e3ab466d57a9dd
MD5 7ea8e439ef714dade7e00c1aefc313e7
SHA1 c4a7e150e5ffb5aefca59147181e0c472a266e46
SHA512 81758102715adade0d596ab0c32d341cedde3ab799c478637b2c8ea4261a7b52386be8fe2dac844ca95c72b72305ec85f6d1890ee38dd2586306c5412d82bc36
SSDEEP 12288:d1ApkvonmrWkZM9fuG4HrKjyrVlp5T0tByh7MUFrl9bwt03z22y0VOaoDk/3:d1Dv1zZM9uGUVEwh7A03a20k/3
TLSH
T1B7F43312DC8522F413D36126E6F60288825D1BFF0F7825866B0BAE181CCFF797E5B659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-9VM9R.tmp

Path C:\Program Files\DubbingAI\res\drawable\is-9VM9R.tmp
Size 2KB
SHA256 ae6f4dd35f2fcb32adbc1848b404237c6a18198121f0e44fa07540dd875d9bb5
MD5 7be80babe7af0597791a85a11f50ec79
SHA1 14c17bcd6f8d9a76ff222c68959a20c389606005
SHA512 369cc7a32913206cbcfe21bac337927de7ba9ba2050d93166b38a6971c2910545be5f75582308b12d43712046821da282a20d73fe636dc5271de78fb383dd0bd
TLSH
T15E4151D7DCCE421AEEFF7E54E92D1099AA93A6E740624E271741216E4A0129CF38CDDC
MD5 SHA1 SHA512 TLSH

Submit Download

lan_en.xml

Path C:\Program Files\DubbingAI\res\lang\lan_en.xml
Size 60KB
SHA256 b3b06f91b2642481567b90af1701acc80b687b87c26b0c5ed40b10b58109e929
MD5 b8b2df3d87174161e169992a0f493e50
SHA1 992f804f0320d77de8538f5cec2effe8d5a980bf
SHA512 2a418ef8e72441d3e78abe5cb73b5e9b394ca72f152caadf69f0b2aca208297661d78bd71cbac27075ce28fb4b33d618e4d9b47b6fe4e701eeda1960d8831d0e
SSDEEP 1536:92Y3sYhMHZgNtjuD99PvKQ0bpS2fcdKHA12J2UVpHX:9vZtaD99PvKQEpS+WGA1ENX
TLSH
T1E5535F3DBEBDBA21DF9A1A6174F3D806257C5443832431FA24EF602731B6D89F1B644A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wnd_splash.xml

Path C:\Program Files\DubbingAI\res\layout\wnd_splash.xml
Size 169B
SHA256 a991596e27b28ebfd6e673ef0ee7a0d5ab4af0cf1db768992b8ef174d480c803
MD5 c6bdbd0caffe891fcdd579f09eaf1e88
SHA1 fcc30b16603d9f44cc0e4174a3d6784d1ffd11d9
SHA512 b93e3b07112491dc673e90a9323d7fdd47a374eb7be7b5945aea9edb0779a86208b45be343a5db3e2a0029e494d970ea95212bc5f84da69a4e81791c079c6552
TLSH
T1FDC08050B7745DF601FC5EF877BF9E5815F4752D903295024D116D7E59E0088064B440
MD5 SHA1 SHA512 TLSH

Submit Download

wnd_toast.xml

Path C:\Program Files\DubbingAI\res\layout\wnd_toast.xml
Size 410B
SHA256 10b3eb596a8e3330382c6ecb63c7d7a18e9b427a8ec6ddc36a7af8b27f807e5d
MD5 fc10f47767a7c6e7c34ce222653bc1f4
SHA1 2112f7fb016ced546763562eceef6997fb174064
SHA512 6afd4a6bdc4a4ddec2284837f1cd02d5675ab24c5a01742a4b27ed462fe6c704be6bd7309b88dc5eec73a8ef0c07616b19d89d077f3da23102a6ed6226a09d78
TLSH
T108E0AB0175B02E3983626911B326CFC482E4D29B457C604CA307E07764F3EA406893BC
MD5 SHA1 SHA512 TLSH

Submit Download

res.xml

Path C:\Program Files\DubbingAI\res\res.xml
Size 10KB
SHA256 81d43a28e5b2a7de74323846f075d8230864465b04b4ad9e063af477facee776
MD5 dcddcf42bd9ee9a06803111edb5159ae
SHA1 380783090d671ce891fb3f18213c4b0d11deddd9
SHA512 d038a1376258bf57cdc46e35384b1db70483a7221b79fb1e95db72b05c0d03cc8bcbfa64295caf5e1fb81732e86f2956ebbfd449e86dc68509e2281844cf127c
SSDEEP 96:+7DfV5vV9O7tlLfWGc0ezZf19JbLhXsUctw82HeIdVflMqT9T4sy:u9JuUctPIdVflMqT9T4j
TLSH
T1CC223E0100FCF22BCB6AB720F7F3E59566158F8A536F13C23856BC3E2A5B5A5B055E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\DubbingAI\vcruntime140.dll
Size 96KB
SHA256 e808fc3824026ba2216c89d3eec46c8202d5eef8d47f797b4f0e7ffa4644cce2
MD5 882da7657405a220fa53d14d663bb216
SHA1 aba49ae69d6c5622ff0598de541aa4d126a4a16c
SHA512 833d5fded349da03eff8b20bbdfffc39acf79fb813f506956e28ca064247e5cc2b0ec959f7133ea89448d2ba06d3baad7cb1f64ece37b1cdce52b69bf898c966
SSDEEP 3072:dm8bDE7z3Qc+3gjYBxsdiSecbgyz6H+LjYV:dc7z3x8RBxTSecbgyz6em
TLSH
T187A36C4A76A442F7C06BD274C0E35A5AE771B8048770A3CF0375496A4F63BE09E3E396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\DubbingAI\vcruntime140_1.dll
Size 36KB
SHA256 07ac39c0043a84bd55acab926e84068a24f7824376037da8e75535c2ca7b0c01
MD5 ac5f3720519c641e361ee6ec12d1775a
SHA1 74634eb85c3eadfefe7bcd4520526eca266a2990
SHA512 a024329a567c92bd3f018f9389a6f5043d7194bc26fc7569c3519208697cd84570e0e6f94c4ae34e7ce0e3bc3d26503351493127bd5aa727dd9b1eb2d84f996f
SSDEEP 768:GZfOqkcc1wHSwFejlUuScKbM3EP3q8Tv7CEd9zd:GWR0MlUuFKbBP3q8vzd
TLSH
T196034B51A3684086D85F96B1C4D76F07FE3DF9619B60A28F0B64844D2E13BE0E73D26B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-G9KKT.tmp\DubbingAI_v1.8.0_03182015_Release_C_Setup.tmp
Size 3.1MB
SHA256 9b84901c70d5ff24cff612ba0a6c1dc36aa804b8096f4d94393ef210184dea28
MD5 fe7032ce963406ab1fe65a57fc792730
SHA1 44d0c1a9f6a08ec9655e186db8211df43cd336e8
SHA512 63239d0965d9eea80071f42a955cb4f0f2e8ce666ec118d24011926285b94bcc4e01b32d1c8ec7e9e0fdb127122e002d182986102ae4346ed5a9e1a5c7828b8b
SSDEEP 49152:3dx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEj9333RXzEw:cHDYsqiPRhINnq95FoHVB9333RXzL
TLSH
T1DBE53B17F389723ED06B1B32463386A0983B7E716912CC9797F8794C8E3D4942A3E756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-STHFN.tmp\_isetup\_isdecmp.dll
Size 28KB
SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
MD5 077cb4461a2767383b317eb0c50f5f13
SHA1 584e64f1d162398b7f377ce55a6b5740379c4282
SHA512 b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
SSDEEP 768:BD7FEAbd+EDsIOmF+OiR9rikW/F+M9OAriXiRQU:M07sIOYRiPWkWNl9WXil
TLSH
T197D24CB31E692BA2EDF95E3492C9162FCD72B3811E4504B3707CC5865A933652B291CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-6RPBV.tmp

Path C:\Windows\Fonts\is-6RPBV.tmp
Size 421KB
SHA256 4644c81b86ec9caaa76b634889968ed3c4f4f52f054855933acc7c2b21e53b0f
MD5 c056d313af09e05a5912778e0834bece
SHA1 f63b2573a8d85c28fbe8fc15d732e88b381faa4c
SHA512 4cfe3f262c5fd33405af5ab3dd315e291738088f569cd5bd99946dd3c9959e95898f5f1c6f6c7d23494a9b013d5475c8c954686abd560870f3339881cd158318
SSDEEP 6144:A3VCh7IcVKLylICv57qA1UFIiiU8RVf2+mabkE2IDPAc8FSFZ0JNt:WjcgySCBOAmFIJ+E2IDzIt
TLSH
T1F7946C03F702C71DD8155E3956B1D3A6A3E9F8A16E23834B715B3B9DE88B1F80D922C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DUBBIN~1.SYS

Path \??\c:\PROGRA~1\DUBBIN~1\DUBBIN~1\DUBBIN~1.SYS
Size 57KB
SHA256 f30cadb86dc9aef034dd372f3014f1743df8e0c9596c09f561f5927c64109f79
MD5 d0aa7257f829d4d09803b0a5942056e4
SHA1 36bd6b055eeadf3e65935d4e4165a8edc54f0d55
SHA512 e68a0180c464b35aa17fe12fe9e4cb95dfe5dd0463cf1a67e68d643c7d686f055d959870800bfe4d86c24e670b0be9649a2a82c0c3e6d350d1758211925c8721
SSDEEP 768:9iW3m159fjYkTUS5lsyxQzgu79NM/nPRbC+bVk/8taQQggW+Vgcs/n6IaogOa9zp:CjbzJuMPM+5EMbn6IahzKF3Qzz
TLSH
T1FC436C976BB424C2DAA54178C2D5D51BFFB8F5821B5243CF11A0C36A1F277C1AE3872A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DubbingAudio.cat

Path \??\c:\program files\dubbingai\dubbingaudio\DubbingAudio.cat
Size 11KB
SHA256 130420f36e27c62c129b05d87311dace4b7fac795f3f5f83fe6a26a61f5c2426
MD5 1934dafa60710fd230a174cbe3039ced
SHA1 0d04cd9574aa80013bec1614d16353dd7608669b
SHA512 a52dce57deb9f0852bf027de366bc17aa7bfb7c291aed034a1ace164eebf6967ede23e541887ecca571afa1452f6ec28d03684fe2426191d42d173e617f32703
SSDEEP 192:/aF2DIJCiEeE4ByKVb1FWQFJWE9DtagQ5X01k9z3AaCmLnlLUD+:DIrEopFRjWmDtdQ5R9ztCmLlgq
TLSH
T1D1321AE6867C51C2EE9798B043D8F6937C392BDB1C40A87A12DBF75509923C5F71812E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-6076-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/1028-12-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/1028-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/4432-3561-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/4432-6072-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/4432-13-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/4432-5-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/4432-6036-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/4432-14-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/4868-6078-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp

Download

memory/4868-6070-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp

Download

memory/4868-6073-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp

Download

memory/4868-6075-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp

Download

memory/4868-6068-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp

Download

memory/4868-6077-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp

Download

memory/4868-6079-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp

Download

memory/4868-6069-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp

Download

memory/4868-6080-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp

Download

memory/4868-6071-0x00007FFC31060000-0x00007FFC31149000-memory.dmp

Download

memory/4868-6067-0x00007FFC30FE0000-0x00007FFC31054000-memory.dmp

Download

memory/4868-6074-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp

Download

memory/4868-6066-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp

Download

memory/4868-6098-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp

Download

memory/4868-6097-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp

Download

memory/4868-6099-0x00007FFC30FE0000-0x00007FFC31054000-memory.dmp

Download

memory/4868-6100-0x00007FFC31060000-0x00007FFC31149000-memory.dmp

Download

memory/4868-6101-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp

Download

memory/4868-6102-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp

Download

memory/4868-6105-0x00007FFC31150000-0x00007FFC31AFE000-memory.dmp

Download

memory/4868-6106-0x00007FFC303D0000-0x00007FFC30DCE000-memory.dmp

Download