938e4618543a0702de16c7f616a7e156ea31905c8e9b738d81a5def5edee8c7e

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DubbingAI_v1.8.1_07091702_Release_C_Setup.exe
Size 114.2MB
Sample260730-pybwcayard
SHA256 938e4618543a0702de16c7f616a7e156ea31905c8e9b738d81a5def5edee8c7e
MD5 ca62cb26338841114d62ae08214a5cbc
SHA1 31fdcd5d0c5f7cc753a2e6cea8bf07f615aee723
SHA512 4721e18e696f9ffcbbcd3098489d849f18d4d4430183ab1a6dfadd6a83fc24dc8b8c918ebf13d1d7bec230e911b652477f3377fd82764093fc71fc3584aa7fcb
SSDEEP 3145728:cI46pWa/l0mnH/7+fkbxe8V99WkUP713vW2Y:t4+RKQ+ek8ep/W2Y
TLSH
T1C6483363A2A4222FE457A7B2063286B1963F2F34B5068C1A27F0794CCFFF1615F19B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution installer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DubbingAI.exe

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET16B6.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET16B6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\DubbingAudio.sys	DrvInst.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DubbingAI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DubbingAI.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Themida packer 21 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000c00000001c526-6084.dat	themida
behavioral2/files/0x000700000001d0cb-6096.dat	themida
behavioral2/memory/5648-6105-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp	themida
behavioral2/memory/5648-6106-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida
behavioral2/memory/5648-6111-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida
behavioral2/memory/5648-6112-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida
behavioral2/memory/5648-6113-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida
behavioral2/memory/5648-6114-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida
behavioral2/memory/5648-6115-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida
behavioral2/memory/5648-6116-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp	themida
behavioral2/memory/5648-6117-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp	themida
behavioral2/memory/5648-6118-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp	themida
behavioral2/memory/5648-6119-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp	themida
behavioral2/memory/5648-6126-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp	themida
behavioral2/memory/5648-6127-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida
behavioral2/memory/5648-6144-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp	themida
behavioral2/memory/5648-6146-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida
behavioral2/memory/5648-6150-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp	themida
behavioral2/memory/5648-6151-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida
behavioral2/memory/5648-6152-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp	themida
behavioral2/memory/5648-6153-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp	themida

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}\DubbingAudio.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6\DubbingAudio.sys	DrvInst.exe
File created	C:\Windows\system32\sysdbdn	DubbingAI.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}\SET13E7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}\DubbingAudio.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6\DubbingAudio.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6\dubbingaudio.PNF	devcon.exe
File created	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}\SET13E7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}\SET13E8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}\SET13E9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}\SET13E9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}\SET13E8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}\dubbingaudio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6\dubbingaudio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7f25af3a-4ee0-ab4e-9910-562fd2af9eac}	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DubbingAI\res\drawable\box_mini_small\is-5ME09.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-RBQGN.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-2KH9T.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-KM88T.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-0TDFV.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-TJKHA.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-F4EIJ.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-JFF57.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-31U52.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\guide\is-8JP7H.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\guide\is-R1NHO.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\guide\is-IHGS5.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\subscription\is-KSTR1.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-3H207.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-HFK6L.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-NH8VO.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-AAM7S.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-EP42D.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-C7KE3.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-J7AKM.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-A7NEQ.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-CJGC1.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-QOFQQ.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-12ID2.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-DCPN8.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-U3SQ5.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-N08FE.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-VIRH7.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-T6IFI.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-3AAQS.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-MTJ04.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\box_mega_small\is-G320C.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\task\is-61G26.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File opened for modification	C:\Program Files\DubbingAI\updater\DubbingLauncher.exe	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-N2PL9.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-7G0O3.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-58VEA.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-DR4TP.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-ATIV9.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\layout\is-HCK5K.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\layout\is-VOEVR.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-KQ54P.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-979GT.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-NA0SV.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-F93DB.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-3VOL6.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\box_mega\is-BG67I.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\layout\is-F87RL.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\is-17I8B.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File opened for modification	C:\Program Files\DubbingAI\AudioMirror\devcon.exe	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-O0LF8.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-117SM.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-1DA16.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\task\is-6UMUQ.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\layout\is-1OSMK.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-DKPJD.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-7KG10.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-K0EAV.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\is-PF86N.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\banners\is-62PVS.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\drawable\task\is-P5AJG.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-GAL50.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\res\layout\is-5TIIS.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Program Files\DubbingAI\vc_model\is-TEE3E.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\is-1DQ6F.tmp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
File created	C:\Windows\INF\c_media.PNF	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	devcon.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 8 IoCs

pid	Process
2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
4612	devcon.exe
5604	SetAudioDevice.exe
5524	devcon.exe
3216	find.exe
1276	devcon.exe
5652	SetAudioDevice.exe
5648	DubbingAI.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3000	sc.exe
2920	sc.exe

Loads dropped DLL 22 IoCs

pid	Process
2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
5604	SetAudioDevice.exe
5604	SetAudioDevice.exe
5604	SetAudioDevice.exe
5604	SetAudioDevice.exe
5604	SetAudioDevice.exe
5652	SetAudioDevice.exe
5652	SetAudioDevice.exe
5652	SetAudioDevice.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe
5648	DubbingAI.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DubbingAI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5996	cmd.exe
5904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DubbingAI_v1.8.1_07091702_Release_C_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5104-0-0x0000000000400000-0x00000000004F0000-memory.dmp	innosetup
behavioral2/memory/5104-9-0x0000000000400000-0x00000000004F0000-memory.dmp	innosetup
behavioral2/memory/5104-6109-0x0000000000400000-0x00000000004F0000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	devcon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	devcon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4212	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\URL Protocol = "DubbingAI"	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DubbingAI\shell\open\command	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\shell	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\DubbingAI.exe\SupportedTypes\.myp	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\ = "DubbingAI"	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DubbingAI\DefaultIcon	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\shell\open	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\shell\open\command\ = "\"C:\\Program Files\\DubbingAI\\DubbingAI.exe\" \"%1\""	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\DubbingAI.exe\SupportedTypes	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\DubbingAI.exe	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\DubbingAI	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\DefaultIcon\ = "C:\\Program Files\\DubbingAI\\DubbingAI.exe,0"	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI\shell\open\command	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DubbingAI	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\DubbingAI.exe\SupportedTypes	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\\OpenWithProgids	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenWithProgids\DubbingAI	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	taskkill.exe
Token: SeLoadDriverPrivilege	1276	devcon.exe
Token: SeRestorePrivilege	5688	DrvInst.exe
Token: SeBackupPrivilege	5688	DrvInst.exe
Token: SeRestorePrivilege	5688	DrvInst.exe
Token: SeBackupPrivilege	5688	DrvInst.exe
Token: SeRestorePrivilege	5688	DrvInst.exe
Token: SeBackupPrivilege	5688	DrvInst.exe
Token: SeLoadDriverPrivilege	5688	DrvInst.exe
Token: SeLoadDriverPrivilege	5688	DrvInst.exe
Token: SeLoadDriverPrivilege	5688	DrvInst.exe
Token: SeLoadDriverPrivilege	5648	DubbingAI.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
5648	DubbingAI.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5648	DubbingAI.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2152	5104	DubbingAI_v1.8.1_07091702_Release_C_Setup.exe	89
PID 2152 wrote to memory of 4212	2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp	90
PID 2152 wrote to memory of 5996	2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp	94
PID 5996 wrote to memory of 4612	5996	cmd.exe	97
PID 5996 wrote to memory of 3000	5996	cmd.exe	98
PID 5996 wrote to memory of 2920	5996	cmd.exe	99
PID 2152 wrote to memory of 5604	2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp	100
PID 2152 wrote to memory of 5904	2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp	102
PID 5904 wrote to memory of 5524	5904	cmd.exe	104
PID 5904 wrote to memory of 3216	5904	cmd.exe	105
PID 5904 wrote to memory of 1276	5904	cmd.exe	106
PID 2152 wrote to memory of 5652	2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp	111
PID 2152 wrote to memory of 5648	2152	DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp	115

C:\Users\Admin\AppData\Local\Temp\DubbingAI_v1.8.1_07091702_Release_C_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\DubbingAI_v1.8.1_07091702_Release_C_Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\is-N622S.tmp\DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N622S.tmp\DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp" /SL5="$8008C,118683148,928768,C:\Users\Admin\AppData\Local\Temp\DubbingAI_v1.8.1_07091702_Release_C_Setup.exe"
  2⤵
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill.exe" /IM DubbingAI.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\DubbingAI\AudioMirror\unInstall.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5996
  - - C:\Program Files\DubbingAI\AudioMirror\devcon.exe
      devcon.exe remove Root\AudioMirror
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:4612
  - - C:\Windows\SysWOW64\sc.exe
      sc.exe stop AudioMirror
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3000
  - - C:\Windows\SysWOW64\sc.exe
      sc.exe delete AudioMirror
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2920
- - C:\Program Files\DubbingAI\SetAudioDevice.exe
    "C:\Program Files\DubbingAI\SetAudioDevice.exe" get
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\DubbingAI\DubbingAudio\install.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Program Files\DubbingAI\DubbingAudio\devcon.exe
      devcon.exe status "Root\DubbingAudio"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      PID:5524
  - - C:\Program Files\DubbingAI\DubbingAudio\find.exe
      find "Dubbing Virtual Device"
      4⤵
      Executes dropped EXE
      PID:3216
  - - C:\Program Files\DubbingAI\DubbingAudio\devcon.exe
      devcon.exe install DubbingAudio.inf Root\DubbingAudio -v
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      PID:1276
- - C:\Program Files\DubbingAI\SetAudioDevice.exe
    "C:\Program Files\DubbingAI\SetAudioDevice.exe" set
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5652
- - C:\Program Files\DubbingAI\DubbingAI.exe
    "C:\Program Files\DubbingAI\DubbingAI.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Drops file in System32 directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5648

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{53ac52de-15bb-a248-9ee8-f24e94d502e2}\dubbingaudio.inf" "9" "4d29efb83" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files\dubbingai\dubbingaudio"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5792

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6\dubbingaudio.inf" "oem1.inf:f1d970029a30b8fa:DubbingAudio_Device:15.55.58.533:root\dubbingaudio," "4d29efb83" "0000000000000174" "c34f"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

devcon.exe

Path C:\Program Files\DubbingAI\AudioMirror\devcon.exe
Size 81KB
SHA256 aca1bda08690dcca930254f96f9185c776671a85a58ffa1b59cf16017546f218
MD5 816c4e245b286b4e4903131f75a94948
SHA1 eda70c1fc8a461efb0e376d42e35a72b96175e4d
SHA512 d0dc74956c57403c0638e6595aaf1c2eb75233997a15170b064261a5d3f1f525a3e35e13fef04c36cc20fd1d5d1cf000a5fb7a646bf2cf1cea73817e5d3335b3
SSDEEP 1536:11Xslj1j7qfAgg1j9f5G/N5hJO+D8AQNJ3Fc5VnZcFMqO7WH:11M2fAggGnD89NJ1cPZCM3W
TLSH
T1D083B40263E91659F5F37A3469B552354A737CA1AE38C69E0298912D0FF3EC0DC74BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unInstall.bat

Path C:\Program Files\DubbingAI\AudioMirror\unInstall.bat
Size 118B
SHA256 8ceebfceaf5bda630984fdad74b8358f06cd4eb972db57aee7307aab2b67698e
MD5 50e2cfa04e39692669d2be777c2588ca
SHA1 8375bfb9e0a501b57065089eb5911599d1088df9
SHA512 a85b4708c68a393e44dda189f09de7a8e9af041da4aeed092c64efe134eacfa9feea33eb0441ac969b596d2b325c89a366f69b8390b07d3a766072319a15c4c8
TLSH
T12DB092D3412FCE6A940888C0F00BA8D97A4FD0419A1B8C8020833279A6A7288C80C68A
MD5 SHA1 SHA512 TLSH

Submit Download

DubbingAI.exe

Path C:\Program Files\DubbingAI\DubbingAI.exe
Size 4.9MB
SHA256 185aa72cc288d27821a2ead64b8d4e41e48d51fc36c7b0dde68b9304c739765f
MD5 5eb1b65dd1586761b33bc79866823850
SHA1 193014c2213924576c9e0264af39b8de9d226563
SHA512 5e062097ce6e1037bb9c1bc7b13feae882b681c8480ddd83debd7edfb8a15459f98e74941473d5d018953c7aea7102d4ba6d36ae9ab7714f1b07e4df6053d20c
SSDEEP 49152:dktCSbS+iZ1by4uiR2wB8DSmzIr4F7p02sw68+3dQnwhAOoeen2XqnSZlFDmtZFV:dJPd92S2c8afg9fCNznKHGXznXz0
TLSH
T1C0366B66A2B501E9D5B7D1388A665533F6B77F28033187DB02A1BA060F737D08E7B760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DubbingAudio.inf

Path C:\Program Files\DubbingAI\DubbingAudio\DubbingAudio.inf
Size 11KB
SHA256 bd0b41667e97c7637433e38db13e7839134690f1357d259c070f1a5cc4efa260
MD5 614e0bf1a0238d06ad1c8ccbdf85a98d
SHA1 71dc8a57ef24cd461e42bba7de31ab2809dfc071
SHA512 f07034d1aa0f8a8a346d18292ed21fe721cac94fdb2cd246a61fcf0b3ecc4655689f2a6cf6843545804b26cb2bf283c622b50d0c8a9153fa32b6bca2b3fa7a69
SSDEEP 192:d5Ijpu+Lfdd3ddSRijYykiuDyp7joo2D6QZyZb:d5Ij9/KIEPZyZb
TLSH
T12F32071372F90718F2F29B81DBF0D0A68A2BBC926538D65F01E9428F1AE5E414D91F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

find.exe

Path C:\Program Files\DubbingAI\DubbingAudio\find.exe
Size 17KB
SHA256 1a1876c5eed2b8cd9e14ebff3f4eeb7e21552a4c6aab4bf392a55f8df3612dab
MD5 ae3f3dc3ed900f2a582bad86a764508c
SHA1 1e44ee63bdb2cf3a6e48b521844204218a001344
SHA512 059c0a371aada5f36e72196109c06208b68475ed0fbefb950beb0cbea2c29595151d65b087c5113af41df926596c4fe4e01102daf4b75e999cf6d6517d26ff63
SSDEEP 384:Ahvo3AARFAaVDVxRshn92Jwpvwp0VJZyTWOIW:oV2DVM9Cuvu0VLyt
TLSH
T18F82090C27A734DAE016837DCAA2015191B97270232E6AFF28E6C1394F537DADD79ED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.bat

Path C:\Program Files\DubbingAI\DubbingAudio\install.bat
Size 226B
SHA256 ce2f37f933727dbb736704552195a093b9455dea97e0d51b1fab2778f84cbd83
MD5 6260ec22da6c8e3f8a60002e3c6c5343
SHA1 402ee8eadb19a9363fdba938758c022cf68bd978
SHA512 5fdf3f7fb0a251fef8edae3c033c7b8e30a25b458f7e64faafb229400d91676133fb1c142b88b78d69c1c16f7c828d69278c83a2da67c2ff5a0ef66139a6665c
TLSH
T1F5D0A751251639204A2C95709009208AFFC7894750120E5070B2C0741B6A5CDD6EB697
MD5 SHA1 SHA512 TLSH

Submit Download

InDeviceId.ini

Path C:\Program Files\DubbingAI\InDeviceId.ini
Size 55B
SHA256 80e8e76149bec53481ac80c1228ccdf762c62394ae40ba9dd2b5943502d76147
MD5 f15300b47fd928c81a5fb405155d3748
SHA1 697fd6fee5dc512004591b35acd74845f8b60600
SHA512 320500fdb494f5da1cecdca4e17d9856c2badbeb4058d9492d719b32bf49d57a8a8b1b0de4253654f679cdf232920da7aa602143d6d1ab3f7f6ad461b4925432
TLSH
T1BE9002FB021C4080C955958220287D00C4AD306BE0CD26C658E419185517275D444540
MD5 SHA1 SHA512 TLSH

Submit Download

MSVCP140.dll

Path C:\Program Files\DubbingAI\MSVCP140.dll
Size 555KB
SHA256 b2bd81e9ae5cf2714c8a245428ef22fa5eab3e3b92a926ef395e1f3733939e25
MD5 0d9ffc3f4d6a9e762282891c7b4c61e1
SHA1 15468bd1183b091b92f9e9a3bd352c0562b5b9a3
SHA512 9d8529f9f043196b101a2bd3c9d13a5b8b9e09bc827f5afdd86894998ca1463fc8f74fea66c5b33498b2685294c2f90c75ce9efd77f7bccf19337ebd37ea413e
SSDEEP 12288:DNkybjD4xaP1luZUMDskEzNKKXvD8L2QEwP3lOXQ2oGQEKZm+jWodEEVKf5Q:DQP3e5QEKZm+jWodEE4f5Q
TLSH
T11BC40927B75901A0E195A3B8A1C74306D7F17C4A8322A3C792FBD69D2F6B3D1673B190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetAudioDevice.exe

Path C:\Program Files\DubbingAI\SetAudioDevice.exe
Size 82KB
SHA256 def90008d015ea9c5b935208dacd4371c071bc96f390dd8b6a79af3a45336cde
MD5 cb084353c30a8a949a133ce647e9d6d4
SHA1 d04d9b214b928fede9aa895e95b9fdb1f7874496
SHA512 f2c1b43773f38320fb63c9f95272f689d59e9b8762c6534c81552fe9ca5408f0eec8fb393f9ec16e29baad7d57eb5ddc52931d04d578f383e2c57a1b711f4baf
SSDEEP 768:EM3X2K/TX2k6U9H7Qip/iL0y8fXauejvk97Ss4KL95q2zlH7SRSJWk2C6D2Aaqrd:b2KTr6AMwCue7s4KLPpSw2NFpFCxn0
TLSH
T122839F9B376900E5D65BE2BCE1C24913EAB5B8460B9553CF039243750F6A3C1BFBEA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dubbing-base.dll

Path C:\Program Files\DubbingAI\dubbing-base.dll
Size 3.3MB
SHA256 da5e289bbde10a92c3271ccc6b6c45f9fd7c385e2b2c4f229f872901e0bfca25
MD5 ae43b66926b327cfd516f68173ca0675
SHA1 16a0d87dab373230e01640f072ddfe101c08b785
SHA512 24167dfc3cd4cbff560199f07e15470db1e0b26fb093c46c7decf14d4349c6ccdba786de532f0b0227c96a33f0874a55e66fa3bea45924b2ec344125249952a9
SSDEEP 98304:318p861gBlA3oBnJ20E8ON8gZ+v9fPEXZNvnAayeP:F8p86ubEipEv4PEXnA5eP
TLSH
T15EF533265FB50D87CBEA2DF4A5DE970F11128289CDDA4BC7013FB0E01A116AE73B6C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dubbing-sdk-windows.dll

Path C:\Program Files\DubbingAI\dubbing-sdk-windows.dll
Size 3.7MB
SHA256 991e015413a20b415ef71319cde63901da94cb91b26ce509f742bd50c4d55fe6
MD5 3233913e703c69410de45df1149f1dc5
SHA1 6d45402a22daa76beaa711180d00cc179de00347
SHA512 10a102577f5603fedfb71dffed5595636293a0ee9a748347451e4338c843f8a62174de952ada0a82c7c2e5607c4cd5596c4e5721759674b61da748bba4db8cdf
SSDEEP 98304:/qrSZiaHL3JYVDPWYFFSudbZrYIpV6jeKoxNI8j0yBSMiVpEoEw:yrSZ7HL3JYVDPWQTrYIr66KwI8j0yEEM
TLSH
T1570633AB6720DA42DEDFEDB8F6C6E6879045C1184FCBFF1509070D2B018B7AA93915B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dubbing_sdk_device.dll

Path C:\Program Files\DubbingAI\dubbing_sdk_device.dll
Size 699KB
SHA256 210ffc0c8e357ae5e42ad38319f45c0868882961f1e24a7c6201538d0a68fbba
MD5 81afc7b1e82a36fe3b94697993e3a398
SHA1 afb013ecdb73c8626414823d11ff35b91f826bea
SHA512 2f5ae67b7840b2af350ae2f2243984063e8284c62a3e2cd7b574c54e9c1426a170eb10a4aa9874aee9ec828f288302be55beaf2021bdd4473fdf4a6437548027
SSDEEP 6144:EDarBdFwcnkvLPZkraBSYCS859Aa0UzX00UudfMC2ehEH5WG3oyJKgW8KY:CarBdSPvLPfBES8fBfbrh+3ot
TLSH
T1B9E48C9AE7A822E9D17BD13DC0D3531BE6B1305907218BCF059187AD3A03BE91B7B716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dubbing_utils.dll

Path C:\Program Files\DubbingAI\dubbing_utils.dll
Size 370KB
SHA256 d334bb83b0ebe1737f2084e190c25dc0e90f94c6dbb3f3a3ec9aedaf1be3758a
MD5 ac7ad54f1c9c8e9fe5681b0d7675f7b3
SHA1 d1ca2cb48ca9f0adb70fa6718edd6cb9bdd0ad3f
SHA512 14f213ddbbbf177ae1c425fa18f773e93a4870cfca3dadcd3c39aab3a2b5b0aa91732b4db0a8fa2fcea9ce7b73538ab120f5a0bdd11eaa03c4317e112350dcd8
SSDEEP 3072:/vKeH0WDHzEkcoH5bXkOYYTfEYtqXTARfgty7lWJYYY8wJ7GrGjv8g0oBMhBlaIb:/rTYktRXAQqXTHNGjv8gNMBdOBdY
TLSH
T119845B6EEB1C0462E177F27CC1C3860BEAB12559836297CF04DAD7E91903BD95A37B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdk-aac.dll

Path C:\Program Files\DubbingAI\fdk-aac.dll
Size 1.2MB
SHA256 ec2e5abacf2ef2992b0a3cde437f424a41654cb358824876a58ceab644876a96
MD5 552e7f3fffbc0ddd860bc59ec2beb4f4
SHA1 4b65f449b9571174f94ae8e9f17159b8619952e3
SHA512 b3f4d19b00380ec5f0c9c082d31627427b51c6ff020d2749083b456c88b51f7b1800a6b7a0117ddea0d029519827fbed0127e95e2eeec2a84ddced1f4724d293
SSDEEP 24576:ZBaJ+9orIUquOnxKP7UsfYe9UZoZX2I/+XNaM6CapKTBZknRiy:ZBaJaU1QYQsfYe9UZoZX2I/eNaMyQXkc
TLSH
T1C245AEC2FBA716ECC2BBC038915A4616E776784903245BFB6A98DA743E23FC15779304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ixwebsocketex.dll

Path C:\Program Files\DubbingAI\ixwebsocketex.dll
Size 227KB
SHA256 2d8b8cbb744ada20841108d1d19acada29f042f63291f03de760e817a68ea17e
MD5 2d8eec75a4f00223e201e615717c39f8
SHA1 0f109d933f08280c700820d212bbaaab8681e883
SHA512 1d89dffdd3370e43a29df00e52e3a47428b89c08c639478284ac33007454f7ca71db3928f29b4deafc4784c00ef5df456d93b7e76269870e21b5818ecbf5713b
SSDEEP 6144:FXKqE20vlDCSWsPsIrkeN8zLB8UL+tBzKV:MqE2c2IIp/j6tB8
TLSH
T1D9346B5B32A800B9D6E7D17CAA875E03F636744A036196DF03E042BA1F5B7E4BE79710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Program Files\DubbingAI\libcurl.dll
Size 3.4MB
SHA256 013d0c68b56c46637d0bf338cddbd2fb0f417bdce1127e49b9706bff2fcd64a6
MD5 c2d3a6b0fe8b13d2370cdb77a102bfa4
SHA1 df41e317216bd5ef4f37da768a453f63c5e96b82
SHA512 54cc681b8c1b54b64a680552f7967f7ab4d165aa72564ce3a6e97574598049bbf1e74b084a46f383433591677c67874cdae3f636f03d9f49a44a2ab86dc33fa1
SSDEEP 49152:M0JPsWHoOr3XgztHoMGlMO6EnS39w3dI7UTV3+QuVsf+fX0DcA7hbKi:MyPsDqXQBi8NCp0Qlr7ki
TLSH
T13BF58D13719051B9C455C1789B0B97379A72B48A3F3879EF11D88BA03F96FE12B3CA58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libsamplerate-0.dll

Path C:\Program Files\DubbingAI\libsamplerate-0.dll
Size 1.4MB
SHA256 c395fa20bb73ea23ff0b1a796b6c067cfa547e51fbedcf837b86578867d96325
MD5 a3152f39f57ad9419e24978073de8f88
SHA1 5b1428bfd1a5de018d43e3f3925d2750f326ed4a
SHA512 ad797813e5b4153280e39c18751756010cf00c8a05b7efb24aa28e4a3a64e6e56dbbbe665555fb17c43696b6d495f6c2bcd24e5e87d285d0430e62ea34e601c6
SSDEEP 24576:6viyMikRA8OHrdSLdcpo4pg97PeAesDPJi3vsjpRUZhPWar1T1FbySKCyqQmGF26:6vi1APrdudcpo42JKsDxi3EjDox9ToCk
TLSH
T1466523AA48D25F46C525C035F345E23ADB2367EE7AEEA8D70604E0301ABBA47D54734F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libspeexdsp.dll

Path C:\Program Files\DubbingAI\libspeexdsp.dll
Size 128KB
SHA256 071feed74d724c72049c8c5d48b7e8a2a61697383d84b41d8d639346b6ae4f44
MD5 65575ef949097fe2188dd5b21ea6f176
SHA1 cf1058bd18fc874ecba4b682f3aa1e1fec5bb8ed
SHA512 fad8956df63535a8f716024bc102f51327694ec17b3bc26621ac89757a32bf521f78354b21a3e687b7d108908d4db63827c93b0d60718ee2142c15ed219b3da3
SSDEEP 3072:H1g10xk3XPYMNIoGIeV2wnkKNbAJOqDDDOZDx3MIhFf:GSoGIcxkK8O133bhF
TLSH
T16FD35B46F1E695ECE037407EA26AF84BB623752503504BFB83D5C76A2F16AC01DFA316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DubbingAI_splash.png

Path C:\Program Files\DubbingAI\res\drawable\DubbingAI_splash.png
Size 9KB
SHA256 1c5915a904c7c2a346aa58e8783dcc691e366efdebf9a750f7e410877e1cfd27
MD5 69da2fc513db63b4754f8493d8b13130
SHA1 588042efbf1677dbbe67e29b6ff6465a3bf32043
SHA512 2b76d1520a186bf398ea83fc8ba5ed001f3baf6f4af225d35d3f7a0f1fb615d97c9ef543ecbf4659440ce4230a4ed76dfdf6e0162fa4bfd6f748685a5cae54e1
SSDEEP 192:P0vi4PPPPPP1ZoTcXx9YLGWxr+hJGIXZM6HmWrGgHnrasTtclaPPPPPPlPPPs:P0DLXAheJhPmWNHRTtG
TLSH
T1332253D60EE3BEC541B548AD3E05EE37C17686D0C8EB229ECB41D60CAF53D55AE058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-UCJ0H.tmp

Path C:\Program Files\DubbingAI\res\drawable\activity\is-UCJ0H.tmp
Size 746KB
SHA256 91afd6efa3185d9d3db776bef4979cec4be6841b3e0079b7f1e3ab466d57a9dd
MD5 7ea8e439ef714dade7e00c1aefc313e7
SHA1 c4a7e150e5ffb5aefca59147181e0c472a266e46
SHA512 81758102715adade0d596ab0c32d341cedde3ab799c478637b2c8ea4261a7b52386be8fe2dac844ca95c72b72305ec85f6d1890ee38dd2586306c5412d82bc36
SSDEEP 12288:d1ApkvonmrWkZM9fuG4HrKjyrVlp5T0tByh7MUFrl9bwt03z22y0VOaoDk/3:d1Dv1zZM9uGUVEwh7A03a20k/3
TLSH
T1B7F43312DC8522F413D36126E6F60288825D1BFF0F7825866B0BAE181CCFF797E5B659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_halo_mango.png

Path C:\Program Files\DubbingAI\res\drawable\icon_halo_mango.png
Size 12KB
SHA256 ae70116295b2276a183e5be48e7bab07e178fce899eb879e52ffde166e12a390
MD5 83c8a9679452666d3c256fd03c6cc934
SHA1 576e058e79b2e3a6bb1bee7bc5bf27abeb4cba50
SHA512 ef4d188656241b74d51f52895441291e9fff2385f61de44d869fd7ace2f69594569562045f7b77f0f3210b084c0d33894ab913539054c881c786e8258ea5f8f0
SSDEEP 192:Yh2pL0cqXIoHyocphsuFW54F1kjPrSDL/dp1njtn43NLcMRWey:Yh2Rx8ecu4hjsX1jtnLey
TLSH
T1F042C0C7672D9CEFDC74320A397452201B6BE2266C49B9B23181B289A47192B277F908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-MO8N8.tmp

Path C:\Program Files\DubbingAI\res\drawable\is-MO8N8.tmp
Size 2KB
SHA256 ae6f4dd35f2fcb32adbc1848b404237c6a18198121f0e44fa07540dd875d9bb5
MD5 7be80babe7af0597791a85a11f50ec79
SHA1 14c17bcd6f8d9a76ff222c68959a20c389606005
SHA512 369cc7a32913206cbcfe21bac337927de7ba9ba2050d93166b38a6971c2910545be5f75582308b12d43712046821da282a20d73fe636dc5271de78fb383dd0bd
TLSH
T15E4151D7DCCE421AEEFF7E54E92D1099AA93A6E740624E271741216E4A0129CF38CDDC
MD5 SHA1 SHA512 TLSH

Submit Download

lan_en.xml

Path C:\Program Files\DubbingAI\res\lang\lan_en.xml
Size 63KB
SHA256 99618fe7639e6d0f1979eaf6653bed647fd34f046aafe15d98d72083aa0e967e
MD5 27d1730718ef4e98b8fecadc557d6e27
SHA1 b14376962217989a5032689c1ad331bff4ddbeef
SHA512 58f25449ee43486c3dedc3a9872d42397cece9d012efa76a44d85cc13b866bfedf65ca0d7f7a330a93615a0f430090ac0fd88264cbed635cf56b908e0bd5d95a
SSDEEP 1536:l2Y3sYhMHZgNtjuD99PvKQ0bpS2fcdKHA12J2UVpH1Bc:lvZtaD99PvKQEpS+WGA1ENzc
TLSH
T18F535F3EBEBDBA21CF9A1A6174F3E806256C5443833431FA24EF602731B6D49F1B544A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wnd_default_res.xml

Path C:\Program Files\DubbingAI\res\layout\wnd_default_res.xml
Size 4KB
SHA256 62d8417edc5f7cca68349627f7ac6811ac7b6d756f432b92ee9f91ae42ab7366
MD5 bc49e2905c7e53b22df9fb6da9439797
SHA1 f26adacca656c9bd23bbb904c1e2708c830455cd
SHA512 5c7f7bdfa61e405e0fcc4897c11271509e30ca43131b7216731fe5ffeb9ce13c8924a7bb0ccb80f91f8b9f72653b7e04394ed3cad0776a5c251fe5967e2cabe3
SSDEEP 96:tOJW89PhhxhENXFbTvYyON+EgpPl5ZZtNbN6srBFuYcvoHivHWG4cPsFmPeqPW6q:tnecn
TLSH
T16491FE3A62347E3E671D812537BE6E8438801639C77DA02D567BF0E244A345E3BED16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wnd_login.xml

Path C:\Program Files\DubbingAI\res\layout\wnd_login.xml
Size 9KB
SHA256 6e62c302bb0ebea820636782b0b5b5491d7fb8dd8ab39d5d19c555521c0214d1
MD5 533076e55142573bf36464056fed0712
SHA1 a171211eb4a3022721569927089bbb2baf44833c
SHA512 0a5b12367e68f9c2a958e62797238d55f5abc41f1d8f51302b90dd76fe915e99dc8d67690d5abf8b121bd68e3e02e95a28a52460ecad67df9b9db01ec0aa79aa
SSDEEP 192:NwYzZdWvqcNWxvqv3qzpEEJ9aWn3w41qBDWPQWG:+MJqPqzOS8qAqq5TWG
TLSH
T1BA12BE02B63C3F3AC31B5167F321DDC8814EF576865862A9F377A07344F3992189BAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wnd_splash.xml

Path C:\Program Files\DubbingAI\res\layout\wnd_splash.xml
Size 169B
SHA256 a991596e27b28ebfd6e673ef0ee7a0d5ab4af0cf1db768992b8ef174d480c803
MD5 c6bdbd0caffe891fcdd579f09eaf1e88
SHA1 fcc30b16603d9f44cc0e4174a3d6784d1ffd11d9
SHA512 b93e3b07112491dc673e90a9323d7fdd47a374eb7be7b5945aea9edb0779a86208b45be343a5db3e2a0029e494d970ea95212bc5f84da69a4e81791c079c6552
TLSH
T1FDC08050B7745DF601FC5EF877BF9E5815F4752D903295024D116D7E59E0088064B440
MD5 SHA1 SHA512 TLSH

Submit Download

wnd_toast.xml

Path C:\Program Files\DubbingAI\res\layout\wnd_toast.xml
Size 410B
SHA256 10b3eb596a8e3330382c6ecb63c7d7a18e9b427a8ec6ddc36a7af8b27f807e5d
MD5 fc10f47767a7c6e7c34ce222653bc1f4
SHA1 2112f7fb016ced546763562eceef6997fb174064
SHA512 6afd4a6bdc4a4ddec2284837f1cd02d5675ab24c5a01742a4b27ed462fe6c704be6bd7309b88dc5eec73a8ef0c07616b19d89d077f3da23102a6ed6226a09d78
TLSH
T108E0AB0175B02E3983626911B326CFC482E4D29B457C604CA307E07764F3EA406893BC
MD5 SHA1 SHA512 TLSH

Submit Download

wnd_top_bar.xml

Path C:\Program Files\DubbingAI\res\layout\wnd_top_bar.xml
Size 1KB
SHA256 3ef7c00eba807da9db0f02d2998c1eedc74c5e637623c380c91f1d4f8d936faa
MD5 576950e6bdadeb4f977be8aaa485447f
SHA1 6111f8d64b8d0405b138bfd495a5b9361f5a1055
SHA512 78e3a0409f8305c201ddf80a8a408c552da1091a075c7b2490694e77647dba9846bfdc319e1b9bae22ee7c1e42c2c11bf6fe40b37242ee68e7cd3c9168f4b547
TLSH
T1C241C502E23C7D6B4685D50A373ABD2C063D20BAD7A4B6757B23D41644C788A02BFD61
MD5 SHA1 SHA512 TLSH

Submit Download

res.xml

Path C:\Program Files\DubbingAI\res\res.xml
Size 10KB
SHA256 b98cc5318f70be90822a8697b050341e6f950bea28b0bb0fa6e7a24f47f85cfa
MD5 a60465ddcdbbc7b4ed0827a5a34b4461
SHA1 b224a93244ee09e339f439d8e9d12e26f018badc
SHA512 dcf843168668e663a62150bddaaf656b9166709da6f2f7464b502203ce2c6b29a5b1eeca66d3f6d8888733d6cc18dcf5e1071a1236090ada9b46938175c2e9d0
SSDEEP 96:+7DfV5vV9O7tlLfWGc0ezZf19JbLhXBUctw82HeI8VflMqT9T4st:u9JTUctPI8VflMqT9T44
TLSH
T1B0322D0100FCF62BCB6BB720F7F3E59566158B8A536F13C23856BC3E2A1B5A5B055E12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\DubbingAI\vcruntime140.dll
Size 96KB
SHA256 e808fc3824026ba2216c89d3eec46c8202d5eef8d47f797b4f0e7ffa4644cce2
MD5 882da7657405a220fa53d14d663bb216
SHA1 aba49ae69d6c5622ff0598de541aa4d126a4a16c
SHA512 833d5fded349da03eff8b20bbdfffc39acf79fb813f506956e28ca064247e5cc2b0ec959f7133ea89448d2ba06d3baad7cb1f64ece37b1cdce52b69bf898c966
SSDEEP 3072:dm8bDE7z3Qc+3gjYBxsdiSecbgyz6H+LjYV:dc7z3x8RBxTSecbgyz6em
TLSH
T187A36C4A76A442F7C06BD274C0E35A5AE771B8048770A3CF0375496A4F63BE09E3E396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\DubbingAI\vcruntime140_1.dll
Size 36KB
SHA256 07ac39c0043a84bd55acab926e84068a24f7824376037da8e75535c2ca7b0c01
MD5 ac5f3720519c641e361ee6ec12d1775a
SHA1 74634eb85c3eadfefe7bcd4520526eca266a2990
SHA512 a024329a567c92bd3f018f9389a6f5043d7194bc26fc7569c3519208697cd84570e0e6f94c4ae34e7ce0e3bc3d26503351493127bd5aa727dd9b1eb2d84f996f
SSDEEP 768:GZfOqkcc1wHSwFejlUuScKbM3EP3q8Tv7CEd9zd:GWR0MlUuFKbBP3q8vzd
TLSH
T196034B51A3684086D85F96B1C4D76F07FE3DF9619B60A28F0B64844D2E13BE0E73D26B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-E2BGB.tmp\_isetup\_isdecmp.dll
Size 28KB
SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
MD5 077cb4461a2767383b317eb0c50f5f13
SHA1 584e64f1d162398b7f377ce55a6b5740379c4282
SHA512 b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
SSDEEP 768:BD7FEAbd+EDsIOmF+OiR9rikW/F+M9OAriXiRQU:M07sIOYRiPWkWNl9WXil
TLSH
T197D24CB31E692BA2EDF95E3492C9162FCD72B3811E4504B3707CC5865A933652B291CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-N622S.tmp\DubbingAI_v1.8.1_07091702_Release_C_Setup.tmp
Size 3.1MB
SHA256 d39a00db7d4143270b4f6d25f04e595c9eb8796cb4e00b20b59484723cdd7f9b
MD5 52db79f18bc68425a4a84ee4eec621c9
SHA1 b2364cfedeff484eceab8fd3d66c2741e0c1a9aa
SHA512 12e9cc0fe62752c75f0aff7f5d88001fc5f7832f03ff3e07653d5016b603481d5f2d8acdea72759e9bc45da3d4da071150cc05027a4e2e14cfa3e55ef4b38411
SSDEEP 49152:3dx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEj9333RXzEj:cHDYsqiPRhINnq95FoHVB9333RXz4
TLSH
T111E53B17F389723ED06B1B32463386A0983B7E716912CC9797F8794C8E3D4942A3E756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SourceSans3-Regular.ttf

Path C:\Windows\Fonts\SourceSans3-Regular.ttf
Size 421KB
SHA256 4644c81b86ec9caaa76b634889968ed3c4f4f52f054855933acc7c2b21e53b0f
MD5 c056d313af09e05a5912778e0834bece
SHA1 f63b2573a8d85c28fbe8fc15d732e88b381faa4c
SHA512 4cfe3f262c5fd33405af5ab3dd315e291738088f569cd5bd99946dd3c9959e95898f5f1c6f6c7d23494a9b013d5475c8c954686abd560870f3339881cd158318
SSDEEP 6144:A3VCh7IcVKLylICv57qA1UFIiiU8RVf2+mabkE2IDPAc8FSFZ0JNt:WjcgySCBOAmFIJ+E2IDzIt
TLSH
T1F7946C03F702C71DD8155E3956B1D3A6A3E9F8A16E23834B715B3B9DE88B1F80D922C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dubbingaudio.inf_amd64_49526d93b0fcebb6.ini

Path C:\Windows\System32\DriverStore\FileRepository\dubbingaudio.inf_amd64_49526d93b0fcebb6.ini
Size 437B
SHA256 eb27aaa73151fd945d0995baf6978f42f435300ad135e840dd6c1e84b7d9b14c
MD5 e1ded28638ddf5511e5508cfbf50dc84
SHA1 25f0de7234bd3ef126ef810a19502fa69ff6bd29
SHA512 07c21eb3bcf861a50214baa9cffe9310f6ea7c0e1c705fbdaa66b97b311ed6d33aedcfd09169893092805f1c6b28827470a9aea2bce471b4cf2b6ad94f0376f3
TLSH
T163E023575029FDC9EF9898E1FA14A961D178B156023B688E33D4C85C57267960F14541
MD5 SHA1 SHA512 TLSH

Submit Download

DUBBIN~1.SYS

Path \??\c:\PROGRA~1\DUBBIN~1\DUBBIN~1\DUBBIN~1.SYS
Size 57KB
SHA256 f30cadb86dc9aef034dd372f3014f1743df8e0c9596c09f561f5927c64109f79
MD5 d0aa7257f829d4d09803b0a5942056e4
SHA1 36bd6b055eeadf3e65935d4e4165a8edc54f0d55
SHA512 e68a0180c464b35aa17fe12fe9e4cb95dfe5dd0463cf1a67e68d643c7d686f055d959870800bfe4d86c24e670b0be9649a2a82c0c3e6d350d1758211925c8721
SSDEEP 768:9iW3m159fjYkTUS5lsyxQzgu79NM/nPRbC+bVk/8taQQggW+Vgcs/n6IaogOa9zp:CjbzJuMPM+5EMbn6IahzKF3Qzz
TLSH
T1FC436C976BB424C2DAA54178C2D5D51BFFB8F5821B5243CF11A0C36A1F277C1AE3872A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DubbingAudio.cat

Path \??\c:\program files\dubbingai\dubbingaudio\DubbingAudio.cat
Size 11KB
SHA256 130420f36e27c62c129b05d87311dace4b7fac795f3f5f83fe6a26a61f5c2426
MD5 1934dafa60710fd230a174cbe3039ced
SHA1 0d04cd9574aa80013bec1614d16353dd7608669b
SHA512 a52dce57deb9f0852bf027de366bc17aa7bfb7c291aed034a1ace164eebf6967ede23e541887ecca571afa1452f6ec28d03684fe2426191d42d173e617f32703
SSDEEP 192:/aF2DIJCiEeE4ByKVb1FWQFJWE9DtagQ5X01k9z3AaCmLnlLUD+:DIrEopFRjWmDtdQ5R9ztCmLlgq
TLSH
T1D1321AE6867C51C2EE9798B043D8F6937C392BDB1C40A87A12DBF75509923C5F71812E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2152-10-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/2152-6-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/2152-5948-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/2152-6079-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/2152-6108-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/2152-1592-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/2152-17-0x0000000000400000-0x000000000072B000-memory.dmp

Download

memory/2152-11-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/5104-0-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/5104-9-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/5104-6109-0x0000000000400000-0x00000000004F0000-memory.dmp

Download

memory/5648-6111-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download

memory/5648-6112-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download

memory/5648-6118-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp

Download

memory/5648-6119-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp

Download

memory/5648-6107-0x00007FFC60D10000-0x00007FFC60DF9000-memory.dmp

Download

memory/5648-6105-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp

Download

memory/5648-6113-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download

memory/5648-6115-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download

memory/5648-6127-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download

memory/5648-6126-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp

Download

memory/5648-6117-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp

Download

memory/5648-6114-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download

memory/5648-6116-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp

Download

memory/5648-6097-0x00007FFC62A10000-0x00007FFC62A84000-memory.dmp

Download

memory/5648-6106-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download

memory/5648-6144-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp

Download

memory/5648-6145-0x00007FFC62A10000-0x00007FFC62A84000-memory.dmp

Download

memory/5648-6146-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download

memory/5648-6147-0x00007FFC60D10000-0x00007FFC60DF9000-memory.dmp

Download

memory/5648-6150-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp

Download

memory/5648-6151-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download

memory/5648-6152-0x00007FFC5E6D0000-0x00007FFC5F07E000-memory.dmp

Download

memory/5648-6153-0x00007FFC5DB50000-0x00007FFC5E54E000-memory.dmp

Download