Analysis
-
max time kernel
260s -
max time network
395s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 19:05
Static task
static1
Behavioral task
behavioral1
Sample
magicmic_setup-com_filme [PeskTop.com].exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
magicmic_setup-com_filme [PeskTop.com].exe
Resource
win10v2004-20240221-en
General
-
Target
magicmic_setup-com_filme [PeskTop.com].exe
-
Size
2.9MB
-
MD5
5bcada9c7e6ceb03d425e8ce0413de96
-
SHA1
df88308643824a80b8bd03d05d712b1d5fb21571
-
SHA256
d3474438c9dca7163f54e1b4d2956c8a2a363600f1ac040056ee5c27519771ba
-
SHA512
4c4009032a18d11eeb43a56cd40de20b197eb15b5b811b9d86213b69e0c19a486029115232fb8340ac82aaafde4ad37fe57fa0599d90b79d3a62ad8dbb53ac5b
-
SSDEEP
49152:D7ArgMnp7Y4R5tbQGD5Kcwa49uJY3Xq/YPFqZ06GDfbSxzRM/VLkHm7U7b:DlMp7Y4RkGDYcwa49eY3GMPS42
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\MagicMicDriver.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\drmk.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\portcls.sys DrvInst.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 211 ip-api.com -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22}\magicmicdriver.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22}\SETCAFE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\magicmicdriver.inf_amd64_1408c2714cba82a3\MagicMicDriver.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\magicmicdriver.inf_amd64_1408c2714cba82a3\magicmicdriver.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\magicmicdriver.inf_amd64_1408c2714cba82a3\magicmicdriver.PNF devcon.exe File created C:\Windows\SysWOW64\iMyFone MagicMic\iMyFone MagicMic.lnk imyfone-download.tmp File created C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22}\SETCAEC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\magicmicdriver.inf_amd64_1408c2714cba82a3\MagicMicDriver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22}\SETCAEC.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22}\SETCAFE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22}\SETCAFD.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22}\MagicMicDriver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\magicmicdriver.inf_amd64_1408c2714cba82a3\MagicMicDriver.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22}\MagicMicDriver.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8fa21e76-971a-e34f-a450-e9636242fd22}\SETCAFD.tmp DrvInst.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\iMyFone MagicMic\Audio\VoiceChanger\is-19K0D.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\language\qm\LiveUpdate\is-A2S01.tmp imyfone-download.tmp File opened for modification C:\Program Files (x86)\iMyFone MagicMic\Cover\VoiceChanger\John Cena.png MagicMic.exe File opened for modification C:\Program Files (x86)\iMyFone MagicMic\7z.dll imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\is-5AC5I.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\FeedbackRes\skin\gif\submitting\is-SV5PB.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\LeftNavigation\is-NMBJL.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\FeedbackRes\skin\gif\submitting\is-5I042.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\imageformats\is-LELNJ.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\Member\is-89MEU.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\SetView\like_after\is-B4Q6T.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AIAudition\is-BD1O2.tmp imyfone-download.tmp File opened for modification C:\Program Files (x86)\iMyFone MagicMic\libEGL.dll imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\is-4HMCI.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AIAudition\is-ACGF6.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AIDownloading\is-0LIVS.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AIDownloading\is-BQ058.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\SetView\is-NJT0Q.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\SetView\is-OT922.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\Resources\is-QNMBR.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AIAudition\is-7613M.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AILoading\is-4PF91.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AILoading\is-B6689.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\x86\is-32D14.tmp imyfone-download.tmp File opened for modification C:\Program Files (x86)\iMyFone MagicMic\Cover\VoiceChanger\Ghoastface.png MagicMic.exe File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFCore\MFMainWindowTitle\is-M0ASR.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AILoading\is-UJADE.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\language\main\is-KK0Q6.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\Member\is-K0DO2.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\Member\is-FLK05.tmp imyfone-download.tmp File opened for modification C:\Program Files (x86)\iMyFone MagicMic\unins000.exe imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\language\main\is-IVVEF.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\SetView\like_after\is-LLULG.tmp imyfone-download.tmp File opened for modification C:\Program Files (x86)\iMyFone MagicMic\Cover\VoiceChanger\vc-timbre-0010.png MagicMic.exe File opened for modification C:\Program Files (x86)\iMyFone MagicMic\Cover\VoiceChanger\Kanye West.png MagicMic.exe File opened for modification C:\Program Files (x86)\iMyFone MagicMic\platforms\qwindows.dll imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\Member\is-SIO4C.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AIDownloading\is-0LEAO.tmp imyfone-download.tmp File opened for modification C:\Program Files (x86)\iMyFone MagicMic\Log\MFAudioLocal_20240225.log MFAudioLocal.exe File created C:\Program Files (x86)\iMyFone MagicMic\is-QSUN4.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AIAudition\is-6OKQE.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\local_config_online_test.ini MagicMic.exe File opened for modification C:\Program Files (x86)\iMyFone MagicMic\api-ms-win-crt-private-l1-1-0.dll imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\is-GBAGK.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AIAudition\is-I4MH3.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\Audio\VoiceChanger\is-GVRRR.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\FeedbackRes\skin\gif\submitting\is-9DNFM.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AILoading\is-MS572.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\ReviewImage\is-TNUA1.tmp imyfone-download.tmp File opened for modification C:\Program Files (x86)\iMyFone MagicMic\mediaservice\qtmedia_audioengine.dll imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\is-F6KFS.tmp imyfone-download.tmp File created C:\Program Files (x86)\imyfone_down\magicmic_setup-com_filme [PeskTop.com]\language\Arabic\text.ini magicmic_setup-com_filme [PeskTop.com].exe File created C:\Program Files (x86)\iMyFone MagicMic\FeedbackRes\skin\gif\submitting\is-2ITD2.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\language\qm\MFCore\is-S4QLN.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\UserData.ini.Uh3520 MagicMic.exe File created C:\Program Files (x86)\iMyFone MagicMic\Audio\VoiceChanger\is-0UNL5.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\Audio\VoiceChanger\is-M5KAT.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\VoiceChanger\AIAudition\is-VNIKP.tmp imyfone-download.tmp File opened for modification C:\Program Files (x86)\iMyFone MagicMic\Cover\VoiceChanger\Podcast.png MagicMic.exe File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\button\is-I9LT3.tmp imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\x86\is-J1KNU.tmp imyfone-download.tmp File opened for modification C:\Program Files (x86)\iMyFone MagicMic\userLocal.ini.rh3520 MagicMic.exe File opened for modification C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\devcon.exe imyfone-download.tmp File created C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\SetView\like_before\is-3H9VQ.tmp imyfone-download.tmp -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\INF\c_media.PNF devcon.exe File opened for modification C:\Windows\INF\setupapi.dev.log devcon.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Executes dropped EXE 19 IoCs
pid Process 4396 imyfone-download.exe 760 imyfone-download.tmp 1900 _setup64.tmp 3296 devcon.exe 1132 devcon.exe 752 DefaultAudioDriver.exe 4128 DefaultAudioDriver.exe 1404 devcon.exe 2684 DefaultAudioDriver.exe 5036 DefaultAudioDriver.exe 3520 MagicMic.exe 4304 devcon.exe 1892 devcon.exe 2108 appAutoUpdate.exe 3508 MFAudioRT.exe 3184 MFAudioLocal.exe 936 MFAudioRT.exe 4184 MFAudioLocal.exe 1892 devcon.exe -
Loads dropped DLL 64 IoCs
pid Process 760 imyfone-download.tmp 760 imyfone-download.tmp 496 regsvr32.exe 496 regsvr32.exe 496 regsvr32.exe 496 regsvr32.exe 496 regsvr32.exe 1672 regsvr32.exe 1672 regsvr32.exe 1672 regsvr32.exe 1672 regsvr32.exe 1672 regsvr32.exe 1672 regsvr32.exe 2288 regsvr32.exe 2288 regsvr32.exe 2288 regsvr32.exe 2288 regsvr32.exe 2288 regsvr32.exe 2288 regsvr32.exe 1756 regsvr32.exe 1756 regsvr32.exe 1756 regsvr32.exe 1756 regsvr32.exe 1756 regsvr32.exe 324 regsvr32.exe 324 regsvr32.exe 324 regsvr32.exe 324 regsvr32.exe 324 regsvr32.exe 324 regsvr32.exe 4964 regsvr32.exe 4964 regsvr32.exe 4964 regsvr32.exe 4964 regsvr32.exe 4964 regsvr32.exe 4964 regsvr32.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe -
Registers COM server for autorun 1 TTPs 36 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A19DE2F2-2F74-4927-8436-61129D26C141}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{56904B22-091C-4459-A2E6-B1F4F946B55F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVAudio.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89FC33C-E60A-4C97-BEF4-ACC5762B6404}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVAudio.ax" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD72668E-6BFF-4CD1-8480-D465708B336B}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D4D6F88-8B41-40A2-B297-3D722816648B}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D8F1801-A70D-48F4-B76B-7F5AE022AB54}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89FC33C-E60A-4C97-BEF4-ACC5762B6404}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD72668E-6BFF-4CD1-8480-D465708B336B}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278407C2-558C-4BED-83A0-B6FA454200BD}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVVideo.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{56904B22-091C-4459-A2E6-B1F4F946B55F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D8F1801-A70D-48F4-B76B-7F5AE022AB54}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVAudio.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A19DE2F2-2F74-4927-8436-61129D26C141}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVSplitter.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89FC33C-E60A-4C97-BEF4-ACC5762B6404}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20ED4A03-6AFD-4FD9-980B-2F6143AA0892}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE30215D-164F-4A92-A4EB-9D4C13390F9F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{56904B22-091C-4459-A2E6-B1F4F946B55F}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVSplitter.ax" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE30215D-164F-4A92-A4EB-9D4C13390F9F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{171252A0-8820-4AFE-9DF8-5C92B2D66B04}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVSplitter.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20ED4A03-6AFD-4FD9-980B-2F6143AA0892}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVAudio.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20ED4A03-6AFD-4FD9-980B-2F6143AA0892}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D4D6F88-8B41-40A2-B297-3D722816648B}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{171252A0-8820-4AFE-9DF8-5C92B2D66B04}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVSplitter.ax" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D8F1801-A70D-48F4-B76B-7F5AE022AB54}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD72668E-6BFF-4CD1-8480-D465708B336B}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVAudio.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278407C2-558C-4BED-83A0-B6FA454200BD}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D4D6F88-8B41-40A2-B297-3D722816648B}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVVideo.ax" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{171252A0-8820-4AFE-9DF8-5C92B2D66B04}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A19DE2F2-2F74-4927-8436-61129D26C141}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE30215D-164F-4A92-A4EB-9D4C13390F9F}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVVideo.ax" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278407C2-558C-4BED-83A0-B6FA454200BD}\InprocServer32 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 devcon.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MagicMic.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MagicMic.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1864 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D8F1801-A70D-48F4-B76B-7F5AE022AB54} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89FC33C-E60A-4C97-BEF4-ACC5762B6404} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{20884BC2-629F-45EA-B1C5-FA4FFA438250} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{20884BC2-629F-45EA-B1C5-FA4FFA438250}\0 = "0,4,,494E4458" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\FriendlyName = "LAV Splitter Source" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{171252A0-8820-4AFE-9DF8-5C92B2D66B04}\ = "LAV Splitter" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A19DE2F2-2F74-4927-8436-61129D26C141}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD72668E-6BFF-4CD1-8480-D465708B336B}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20ED4A03-6AFD-4FD9-980B-2F6143AA0892} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20ED4A03-6AFD-4FD9-980B-2F6143AA0892}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE30215D-164F-4A92-A4EB-9D4C13390F9F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{EE30215D-164F-4A92-A4EB-9D4C13390F9F} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{171252A0-8820-4AFE-9DF8-5C92B2D66B04}\FilterData = 02000000040080000200000000000000307069330c000000000000000000000000000000000000003170693300000000000000000100000000000000000000003074793300000000500000006000000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D4D6F88-8B41-40A2-B297-3D722816648B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{EE30215D-164F-4A92-A4EB-9D4C13390F9F}\FriendlyName = "LAV Video Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE30215D-164F-4A92-A4EB-9D4C13390F9F}\ = "LAV Video Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\ = "LAV Splitter Source" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{171252A0-8820-4AFE-9DF8-5C92B2D66B04}\FriendlyName = "LAV Splitter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\ = "LAV Audio Decoder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20ED4A03-6AFD-4FD9-980B-2F6143AA0892}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278407C2-558C-4BED-83A0-B6FA454200BD}\ = "LAV Video Properties" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D4D6F88-8B41-40A2-B297-3D722816648B}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{56904B22-091C-4459-A2E6-B1F4F946B55F}\ = "LAV Splitter Input Formats" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{171252A0-8820-4AFE-9DF8-5C92B2D66B04}\CLSID = "{171252A0-8820-4AFE-9DF8-5C92B2D66B04}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{B98D13E7-55DB-4385-A33D-09FD1BA26338} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89FC33C-E60A-4C97-BEF4-ACC5762B6404}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD72668E-6BFF-4CD1-8480-D465708B336B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE30215D-164F-4A92-A4EB-9D4C13390F9F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{20884BC2-629F-45EA-B1C5-FA4FFA438250}\2 = "0,4,,4D504C53" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B98D13E7-55DB-4385-A33D-09FD1BA26338} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{171252A0-8820-4AFE-9DF8-5C92B2D66B04} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\FilterData = 02000000040080000100000000000000307069330c00000000000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89FC33C-E60A-4C97-BEF4-ACC5762B6404}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A19DE2F2-2F74-4927-8436-61129D26C141}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVSplitter.ax" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVAudio.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D8F1801-A70D-48F4-B76B-7F5AE022AB54}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89FC33C-E60A-4C97-BEF4-ACC5762B6404}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVAudio.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C89FC33C-E60A-4C97-BEF4-ACC5762B6404}\ = "LAV Audio Mixer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\FilterData = 020000000300800002000000000000003070693300000000000000005700000000000000000000003074793300000000d0050000e00500003174793300000000f0050000e0050000327479330000000000060000e00500003374793300000000d0050000100600003474793300000000f005000010060000357479330000000000060000100600003674793300000000d0050000200600003774793300000000f005000020060000387479330000000000060000200600003974793300000000d0050000300600003a74793300000000f0050000300600003b7479330000000000060000300600003c7479330000000040060000500600003d7479330000000040060000600600003e7479330000000040060000700600003f74793300000000400600008006000040747933000000004006000090060000417479330000000040060000a0060000427479330000000040060000b0060000437479330000000040060000c0060000447479330000000040060000d0060000457479330000000040060000e006000046747933000000004006000010060000477479330000000040060000f006000048747933000000004006000000070000497479330000000040060000100700004a7479330000000040060000200700004b7479330000000040060000200600004c7479330000000040060000300700004d7479330000000040060000400700004e7479330000000040060000500700004f74793300000000400600006007000050747933000000004006000070070000517479330000000040060000e00500005274793300000000400600008007000053747933000000004006000090070000547479330000000040060000a0070000557479330000000040060000b0070000567479330000000040060000c0070000577479330000000040060000d0070000587479330000000040060000e0070000597479330000000040060000f00700005a7479330000000040060000000800005b7479330000000040060000100800005c7479330000000040060000300600005d7479330000000040060000200800005e7479330000000040060000300800005f7479330000000040060000400800006074793300000000400600005008000061747933000000004006000060080000627479330000000040060000700800006374793300000000400600008008000064747933000000004006000090080000657479330000000040060000a0080000667479330000000040060000b0080000677479330000000040060000c0080000687479330000000040060000d0080000697479330000000040060000e00800006a7479330000000040060000f00800006b7479330000000040060000000900006c7479330000000040060000100900006d7479330000000040060000200900006e7479330000000040060000300900006f7479330000000040060000400900007074793300000000400600005009000071747933000000004006000060090000727479330000000040060000700900007374793300000000400600008009000074747933000000004006000090090000757479330000000040060000a0090000767479330000000040060000b0090000777479330000000040060000c0090000787479330000000040060000d0090000797479330000000040060000e00900007a7479330000000040060000f00900007b7479330000000040060000000a00007c7479330000000040060000100a00007d7479330000000040060000200a00007e7479330000000040060000300a00007f7479330000000040060000400a0000807479330000000040060000500a0000817479330000000040060000600a0000827479330000000040060000700a0000837479330000000040060000800a0000847479330000000040060000900a0000857479330000000040060000a00a0000867479330000000040060000b00a0000317069330800000000000000020000000000000000000000307479330000000040060000c00a0000317479330000000040060000d00a00006a910bed4d04d111aa7800c04fc31d602b806de046dbcf11b4d100805f6cbbea133b5236e58ed1118ca30060b057664a20806de046dbcf11b4d100805f6cbbea2c806de046dbcf11b4d100805f6cbbea33806de046dbcf11b4d100805f6cbbea32806de046dbcf11b4d100805f6cbbea6175647300001000800000aa00389b71ff00000000001000800000aa00389b71ff01000000001000800000aa00389b710216000000001000800000aa00389b714d50344100001000800000aa00389b716d70346100001000800000aa00389b714144545300001000800000aa00389b710016000000001000800000aa00389b710116000000001000800000aa00389b711016000000001000800000aa00389b71414c532000001000800000aa00389b71af87fba7022dfb42a4d405cd93843bdd27a7cf71e4374a40aec034842532eff7c4ce27eb3e16a34c8b748e25f91b517e0020000000001000800000aa00389b710120000000001000800000aa00389b71b78ee5a2a90fbb48a40cfa0e156d064580eb36e44f52ce119f530020af0ba77081eb36e44f52ce119f530020af0ba7705000000000001000800000aa00389b715500000000001000800000aa00389b71acf1000000001000800000aa00389b71c0c54115dfcd7d47bc0a86f8ae7f83540bd12f8d41586b4a8905588fec1aded9a177000000001000800000aa00389b715657000000001000800000aa00389b714d4c502000001000800000aa00389b71616c616300001000800000aa00389b71e99621b83f1b9647a63646239087b38e4145533300001000800000aa00389b71fcb73ea20b516f469fbf5f878f69347cfd979f94f6562745b4aeddeb375ab80f4e4f4e4500001000800000aa00389b717261772000001000800000aa00389b7174776f7300001000800000aa00389b71736f777400001000800000aa00389b71696e323400001000800000aa00389b71696e333200001000800000aa00389b71666c333200001000800000aa00389b71666c363400001000800000aa00389b7134326e6900001000800000aa00389b7132336e6900001000800000aa00389b7132336c6600001000800000aa00389b7134366c6600001000800000aa00389b716001000000001000800000aa00389b716101000000001000800000aa00389b716201000000001000800000aa00389b716301000000001000800000aa00389b71434f4f4b00001000800000aa00389b715241414300001000800000aa00389b715241435000001000800000aa00389b715349505200001000800000aa00389b713001000000001000800000aa00389b71444e455400001000800000aa00389b7132385f3800001000800000aa00389b7131345f3400001000800000aa00389b7152414c4600001000800000aa00389b7109a1000000001000800000aa00389b714f50555300001000800000aa00389b7173616d7200001000800000aa00389b714e454c4c00001000800000aa00389b710600000000001000800000aa00389b710700000000001000800000aa00389b713100000000001000800000aa00389b710200000000001000800000aa00389b712200000000001000800000aa00389b7151444d3200001000800000aa00389b717500000000001000800000aa00389b717002000000001000800000aa00389b714154524300001000800000aa00389b71bfaa23e958cb7144a119fffa01e4ce624323bcafcb3d47409655e1e62a61b1c50100000000001000800000aa00389b710300000000001000800000aa00389b71 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A19DE2F2-2F74-4927-8436-61129D26C141} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\CLSID = "{B98D13E7-55DB-4385-A33D-09FD1BA26338}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{171252A0-8820-4AFE-9DF8-5C92B2D66B04} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A19DE2F2-2F74-4927-8436-61129D26C141}\ = "LAV Splitter Properties" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{56904B22-091C-4459-A2E6-B1F4F946B55F}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVSplitter.ax" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD72668E-6BFF-4CD1-8480-D465708B336B}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVAudio.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E8E73B6B-4CB3-44A4-BE99-4F7BCB96E491}\FriendlyName = "LAV Audio Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278407C2-558C-4BED-83A0-B6FA454200BD}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D4D6F88-8B41-40A2-B297-3D722816648B}\ = "LAV Video Format Settings" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20ED4A03-6AFD-4FD9-980B-2F6143AA0892}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVAudio.ax" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE30215D-164F-4A92-A4EB-9D4C13390F9F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE30215D-164F-4A92-A4EB-9D4C13390F9F}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVVideo.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{20884BC2-629F-45EA-B1C5-FA4FFA438250}\Source Filter = "{B98D13E7-55DB-4385-A33D-09FD1BA26338}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{171252A0-8820-4AFE-9DF8-5C92B2D66B04}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVSplitter.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD72668E-6BFF-4CD1-8480-D465708B336B}\ = "LAV Audio Format Settings" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278407C2-558C-4BED-83A0-B6FA454200BD}\InprocServer32\ = "C:\\Program Files (x86)\\iMyFone MagicMic\\LAVVideo.ax" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{EE30215D-164F-4A92-A4EB-9D4C13390F9F}\CLSID = "{EE30215D-164F-4A92-A4EB-9D4C13390F9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{56904B22-091C-4459-A2E6-B1F4F946B55F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D8F1801-A70D-48F4-B76B-7F5AE022AB54}\ = "LAV Audio Properties" regsvr32.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1332 PING.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3520 MagicMic.exe 2108 appAutoUpdate.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2264 magicmic_setup-com_filme [PeskTop.com].exe 2264 magicmic_setup-com_filme [PeskTop.com].exe 2264 magicmic_setup-com_filme [PeskTop.com].exe 2264 magicmic_setup-com_filme [PeskTop.com].exe 760 imyfone-download.tmp 760 imyfone-download.tmp 2264 magicmic_setup-com_filme [PeskTop.com].exe 2264 magicmic_setup-com_filme [PeskTop.com].exe 3848 msedge.exe 3848 msedge.exe 4628 msedge.exe 4628 msedge.exe 2264 magicmic_setup-com_filme [PeskTop.com].exe 2264 magicmic_setup-com_filme [PeskTop.com].exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 1332 taskmgr.exe 1332 taskmgr.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 1332 taskmgr.exe 1332 taskmgr.exe 2108 appAutoUpdate.exe 2108 appAutoUpdate.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3184 MFAudioLocal.exe 3184 MFAudioLocal.exe 3508 MFAudioRT.exe 3508 MFAudioRT.exe 1332 taskmgr.exe 1332 taskmgr.exe 3508 MFAudioRT.exe 3508 MFAudioRT.exe 3184 MFAudioLocal.exe 3184 MFAudioLocal.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3184 MFAudioLocal.exe 3508 MFAudioRT.exe 3184 MFAudioLocal.exe 3508 MFAudioRT.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3520 MagicMic.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 1864 tasklist.exe Token: SeAuditPrivilege 4200 svchost.exe Token: SeSecurityPrivilege 4200 svchost.exe Token: SeLoadDriverPrivilege 1404 devcon.exe Token: SeRestorePrivilege 228 DrvInst.exe Token: SeBackupPrivilege 228 DrvInst.exe Token: SeRestorePrivilege 228 DrvInst.exe Token: SeBackupPrivilege 228 DrvInst.exe Token: SeRestorePrivilege 228 DrvInst.exe Token: SeBackupPrivilege 228 DrvInst.exe Token: SeLoadDriverPrivilege 228 DrvInst.exe Token: SeLoadDriverPrivilege 228 DrvInst.exe Token: SeLoadDriverPrivilege 228 DrvInst.exe Token: SeDebugPrivilege 1332 taskmgr.exe Token: SeSystemProfilePrivilege 1332 taskmgr.exe Token: SeCreateGlobalPrivilege 1332 taskmgr.exe Token: 33 3688 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3688 AUDIODG.EXE Token: 33 3184 MFAudioLocal.exe Token: SeIncBasePriorityPrivilege 3184 MFAudioLocal.exe Token: 33 3508 MFAudioRT.exe Token: SeIncBasePriorityPrivilege 3508 MFAudioRT.exe Token: 33 1332 taskmgr.exe Token: SeIncBasePriorityPrivilege 1332 taskmgr.exe Token: SeDebugPrivilege 3692 taskmgr.exe Token: SeSystemProfilePrivilege 3692 taskmgr.exe Token: SeCreateGlobalPrivilege 3692 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2264 magicmic_setup-com_filme [PeskTop.com].exe 760 imyfone-download.tmp 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 3520 MagicMic.exe 3520 MagicMic.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 3520 MagicMic.exe 3520 MagicMic.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 4304 devcon.exe 1892 devcon.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3184 MFAudioLocal.exe 3508 MFAudioRT.exe 2108 appAutoUpdate.exe 936 MFAudioRT.exe 4184 MFAudioLocal.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 2108 appAutoUpdate.exe 1892 devcon.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 2108 appAutoUpdate.exe 2108 appAutoUpdate.exe 3520 MagicMic.exe 3520 MagicMic.exe 2108 appAutoUpdate.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 2108 appAutoUpdate.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 3520 MagicMic.exe 7968 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 4396 2264 magicmic_setup-com_filme [PeskTop.com].exe 94 PID 2264 wrote to memory of 4396 2264 magicmic_setup-com_filme [PeskTop.com].exe 94 PID 2264 wrote to memory of 4396 2264 magicmic_setup-com_filme [PeskTop.com].exe 94 PID 4396 wrote to memory of 760 4396 imyfone-download.exe 95 PID 4396 wrote to memory of 760 4396 imyfone-download.exe 95 PID 4396 wrote to memory of 760 4396 imyfone-download.exe 95 PID 760 wrote to memory of 4904 760 imyfone-download.tmp 96 PID 760 wrote to memory of 4904 760 imyfone-download.tmp 96 PID 4904 wrote to memory of 1864 4904 cmd.exe 98 PID 4904 wrote to memory of 1864 4904 cmd.exe 98 PID 4904 wrote to memory of 2060 4904 cmd.exe 99 PID 4904 wrote to memory of 2060 4904 cmd.exe 99 PID 760 wrote to memory of 1900 760 imyfone-download.tmp 100 PID 760 wrote to memory of 1900 760 imyfone-download.tmp 100 PID 760 wrote to memory of 4208 760 imyfone-download.tmp 103 PID 760 wrote to memory of 4208 760 imyfone-download.tmp 103 PID 4208 wrote to memory of 3256 4208 cmd.exe 105 PID 4208 wrote to memory of 3256 4208 cmd.exe 105 PID 4208 wrote to memory of 3296 4208 cmd.exe 107 PID 4208 wrote to memory of 3296 4208 cmd.exe 107 PID 4208 wrote to memory of 560 4208 cmd.exe 106 PID 4208 wrote to memory of 560 4208 cmd.exe 106 PID 4208 wrote to memory of 4372 4208 cmd.exe 108 PID 4208 wrote to memory of 4372 4208 cmd.exe 108 PID 4372 wrote to memory of 1132 4372 cmd.exe 109 PID 4372 wrote to memory of 1132 4372 cmd.exe 109 PID 4208 wrote to memory of 1240 4208 cmd.exe 110 PID 4208 wrote to memory of 1240 4208 cmd.exe 110 PID 1240 wrote to memory of 752 1240 cmd.exe 111 PID 1240 wrote to memory of 752 1240 cmd.exe 111 PID 4208 wrote to memory of 2808 4208 cmd.exe 112 PID 4208 wrote to memory of 2808 4208 cmd.exe 112 PID 2808 wrote to memory of 4128 2808 cmd.exe 113 PID 2808 wrote to memory of 4128 2808 cmd.exe 113 PID 4208 wrote to memory of 1404 4208 cmd.exe 115 PID 4208 wrote to memory of 1404 4208 cmd.exe 115 PID 4208 wrote to memory of 4476 4208 cmd.exe 114 PID 4208 wrote to memory of 4476 4208 cmd.exe 114 PID 4200 wrote to memory of 1612 4200 svchost.exe 117 PID 4200 wrote to memory of 1612 4200 svchost.exe 117 PID 4200 wrote to memory of 228 4200 svchost.exe 118 PID 4200 wrote to memory of 228 4200 svchost.exe 118 PID 4208 wrote to memory of 1332 4208 cmd.exe 120 PID 4208 wrote to memory of 1332 4208 cmd.exe 120 PID 4208 wrote to memory of 2684 4208 cmd.exe 121 PID 4208 wrote to memory of 2684 4208 cmd.exe 121 PID 4208 wrote to memory of 5036 4208 cmd.exe 122 PID 4208 wrote to memory of 5036 4208 cmd.exe 122 PID 760 wrote to memory of 496 760 imyfone-download.tmp 123 PID 760 wrote to memory of 496 760 imyfone-download.tmp 123 PID 760 wrote to memory of 1672 760 imyfone-download.tmp 124 PID 760 wrote to memory of 1672 760 imyfone-download.tmp 124 PID 760 wrote to memory of 2288 760 imyfone-download.tmp 125 PID 760 wrote to memory of 2288 760 imyfone-download.tmp 125 PID 760 wrote to memory of 1756 760 imyfone-download.tmp 126 PID 760 wrote to memory of 1756 760 imyfone-download.tmp 126 PID 760 wrote to memory of 324 760 imyfone-download.tmp 127 PID 760 wrote to memory of 324 760 imyfone-download.tmp 127 PID 760 wrote to memory of 4964 760 imyfone-download.tmp 128 PID 760 wrote to memory of 4964 760 imyfone-download.tmp 128 PID 2264 wrote to memory of 4628 2264 magicmic_setup-com_filme [PeskTop.com].exe 130 PID 2264 wrote to memory of 4628 2264 magicmic_setup-com_filme [PeskTop.com].exe 130 PID 4628 wrote to memory of 3588 4628 msedge.exe 131 PID 4628 wrote to memory of 3588 4628 msedge.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\magicmic_setup-com_filme [PeskTop.com].exe"C:\Users\Admin\AppData\Local\Temp\magicmic_setup-com_filme [PeskTop.com].exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files (x86)\imyfone_down\magicmic_setup-com_filme [PeskTop.com]\imyfone-download.exe/verysilent /imyfone_down /wait_run /path="C:\Program Files (x86)\" /progress="C:\Program Files (x86)\imyfone_down\magicmic_setup-com_filme [PeskTop.com]\temp.progress"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\is-S5R1R.tmp\imyfone-download.tmp"C:\Users\Admin\AppData\Local\Temp\is-S5R1R.tmp\imyfone-download.tmp" /SL5="$80054,77117666,171008,C:\Program Files (x86)\imyfone_down\magicmic_setup-com_filme [PeskTop.com]\imyfone-download.exe" /verysilent /imyfone_down /wait_run /path="C:\Program Files (x86)\" /progress="C:\Program Files (x86)\imyfone_down\magicmic_setup-com_filme [PeskTop.com]\temp.progress"3⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist | find /i "MagicMic.exe" > "C:\rd92502509_66321166_tmp.tmp"4⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\system32\find.exefind /i "MagicMic.exe"5⤵PID:2060
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-40M31.tmp\_isetup\_setup64.tmphelper 105 0x4B04⤵
- Executes dropped EXE
PID:1900
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\install.bat""4⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵PID:3256
-
-
C:\Windows\system32\findstr.exefindstr "Voice Changer Virtual Audio Device (WDM)"5⤵PID:560
-
-
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\devcon.exe.\devcon.exe status "*SodaDriver"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3296
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c .\devcon.exe status "Root\MagicMicAudioDriver"5⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\devcon.exe.\devcon.exe status "Root\MagicMicAudioDriver"6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c .\DefaultAudioDriver.exe mic get5⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\DefaultAudioDriver.exe.\DefaultAudioDriver.exe mic get6⤵
- Executes dropped EXE
PID:752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c .\DefaultAudioDriver.exe snd get5⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\DefaultAudioDriver.exe.\DefaultAudioDriver.exe snd get6⤵
- Executes dropped EXE
PID:4128
-
-
-
C:\Windows\system32\find.exefind "successfully"5⤵PID:4476
-
-
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\devcon.exe.\devcon.exe install win10\MagicMicDriver.inf Root\MagicMicAudioDriver -v5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 3 -w 10005⤵
- Runs ping.exe
PID:1332
-
-
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\DefaultAudioDriver.exe.\DefaultAudioDriver.exe mic set "Line In (High Definition Audio Device);Line In (High Definition Audio Device);Line In (High Definition Audio Device)"5⤵
- Executes dropped EXE
PID:2684
-
-
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\DefaultAudioDriver.exe.\DefaultAudioDriver.exe snd set "Speakers (High Definition Audio Device);Speakers (High Definition Audio Device);Speakers (High Definition Audio Device)"5⤵
- Executes dropped EXE
PID:5036
-
-
-
C:\Windows\system32\regsvr32.exe"regsvr32" /s /u LAVAudio.ax4⤵
- Loads dropped DLL
PID:496
-
-
C:\Windows\system32\regsvr32.exe"regsvr32" /s /u LAVVideo.ax4⤵
- Loads dropped DLL
PID:1672
-
-
C:\Windows\system32\regsvr32.exe"regsvr32" /s /u LAVSplitter.ax4⤵
- Loads dropped DLL
PID:2288
-
-
C:\Windows\system32\regsvr32.exe"regsvr32" /s LAVAudio.ax4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1756
-
-
C:\Windows\system32\regsvr32.exe"regsvr32" /s LAVVideo.ax4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:324
-
-
C:\Windows\system32\regsvr32.exe"regsvr32" /s LAVSplitter.ax4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4964
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apipdm.imyfone.club/producturl?key=installed&lang=English&pid=96&custom=com_filme2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaa4346f8,0x7ffcaa434708,0x7ffcaa4347183⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,12759643618070033435,7575426841596272109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,12759643618070033435,7575426841596272109,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:23⤵PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,12759643618070033435,7575426841596272109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:83⤵PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12759643618070033435,7575426841596272109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:13⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12759643618070033435,7575426841596272109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:13⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12759643618070033435,7575426841596272109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:13⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,12759643618070033435,7575426841596272109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:13⤵PID:4428
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{abcf0cea-3b4a-1740-821d-fc8275b69be4}\magicmicdriver.inf" "9" "4e1b8b81f" "0000000000000140" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\imyfone magicmic\mfdrivermirror\win10"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1612
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:f1d9700283f36a56:iMyFoneAudio_Device:21.0.32.532:root\magicmicaudiodriver," "4e1b8b81f" "0000000000000140"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:228
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:868
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3784
-
C:\Program Files (x86)\iMyFone MagicMic\MagicMic.exe"C:\Program Files (x86)\iMyFone MagicMic\MagicMic.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3520 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName2⤵PID:4824
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName3⤵PID:1688
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "C:/Program Files (x86)/iMyFone MagicMic/MFDriverMirror/install.bat"2⤵PID:3216
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵PID:3876
-
-
C:\Windows\system32\findstr.exefindstr "Voice Changer Virtual Audio Device (WDM)"3⤵PID:5048
-
-
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\devcon.exe.\devcon.exe status "*SodaDriver"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c .\devcon.exe status "Root\MagicMicAudioDriver"3⤵PID:3752
-
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\devcon.exe.\devcon.exe status "Root\MagicMicAudioDriver"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
-
-
C:\Program Files (x86)\iMyFone MagicMic\x86\MFAudioLocal.exe"C:/Program Files (x86)/iMyFone MagicMic/x86/MFAudioLocal.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3184
-
-
C:\Program Files (x86)\iMyFone MagicMic\x86\MFAudioRT.exe"C:/Program Files (x86)/iMyFone MagicMic/x86/MFAudioRT.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3508
-
-
C:\Program Files (x86)\iMyFone MagicMic\appAutoUpdate.exe"C:\Program Files (x86)\iMyFone MagicMic\appAutoUpdate.exe" --updateURL=https://apipdm.imyfone.club/v2/verinfo?bit=2& --autoInstall=true --silent=true2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2108
-
-
C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\devcon.exe"C:\Program Files (x86)\iMyFone MagicMic\MFDriverMirror\devcon.exe" find *SodaDriver2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Program Files (x86)\iMyFone MagicMic\x86\MFAudioLocal.exe"C:/Program Files (x86)/iMyFone MagicMic/x86/MFAudioLocal.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4184
-
-
C:\Program Files (x86)\iMyFone MagicMic\x86\MFAudioRT.exe"C:/Program Files (x86)/iMyFone MagicMic/x86/MFAudioRT.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:936
-
-
C:\Program Files (x86)\iMyFone MagicMic\x86\rtaivc\rtaivc.exe"C:/Program Files (x86)/iMyFone MagicMic/x86/rtaivc/rtaivc.exe" "C:/Program Files (x86)/iMyFone MagicMic/log" c19c5280a21b9f2f8cac844e36fdab49 35202⤵PID:7408
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1332
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x554 0x4681⤵
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:7968 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7968.0.713739815\1452279231" -parentBuildID 20221007134813 -prefsHandle 1772 -prefMapHandle 1752 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c11c48f3-c815-4edc-ad95-3a0f3883224f} 7968 "\\.\pipe\gecko-crash-server-pipe.7968" 1868 240c6ad2858 gpu2⤵PID:7216
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7968.1.2042143781\1489696428" -parentBuildID 20221007134813 -prefsHandle 2280 -prefMapHandle 2276 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f13728c-c3e2-4f44-80a2-f8c04276cbe0} 7968 "\\.\pipe\gecko-crash-server-pipe.7968" 2316 240c6a03258 socket2⤵PID:4820
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7968.2.784120113\623701433" -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3132 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6e441a3-b453-45c5-96aa-89b3dc8a058b} 7968 "\\.\pipe\gecko-crash-server-pipe.7968" 3324 240c9e9d558 tab2⤵PID:3656
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7968.3.187956628\321749887" -childID 2 -isForBrowser -prefsHandle 2728 -prefMapHandle 3008 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd640e96-eaf3-4117-a7ed-d1aa7b24121f} 7968 "\\.\pipe\gecko-crash-server-pipe.7968" 3504 240ba55f258 tab2⤵PID:1464
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7968.4.1571915035\1475860745" -childID 3 -isForBrowser -prefsHandle 4368 -prefMapHandle 4364 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b009baa2-baa5-4f27-9e54-328fa42a35c1} 7968 "\\.\pipe\gecko-crash-server-pipe.7968" 4376 240cbce0558 tab2⤵PID:4012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7968.5.818866415\1275468748" -childID 4 -isForBrowser -prefsHandle 4960 -prefMapHandle 4956 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99af5020-6cf3-429b-a6d4-0675b135e730} 7968 "\\.\pipe\gecko-crash-server-pipe.7968" 4512 240ca9c3058 tab2⤵PID:1780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7968.6.1213977112\2062411174" -childID 5 -isForBrowser -prefsHandle 4972 -prefMapHandle 4968 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46de8546-25fc-4b87-8d00-35d40be2fdeb} 7968 "\\.\pipe\gecko-crash-server-pipe.7968" 5008 240cc6fcb58 tab2⤵PID:3468
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7968.7.26573689\505051132" -childID 6 -isForBrowser -prefsHandle 5140 -prefMapHandle 5008 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00482e24-1285-4592-9f32-36013952e72f} 7968 "\\.\pipe\gecko-crash-server-pipe.7968" 5228 240cc6f9b58 tab2⤵PID:4400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:7524
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of AdjustPrivilegeToken
PID:3692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5ca621a173b616650f1e6bcb90572db8a
SHA1be33952af70256623bca14d6fa3ec1ce97e1bd7c
SHA2563b44451540f42c06f2b9d54fbe1ea81057ba76dbc812ebc982e6bc6d3153deec
SHA5121925fdbdd824156fae1cb702b055c439f39ba7128acb8d2692f5e364da1f6ffc8f77165bf1d30ab3583758dd076ebefaaddfbbd379101bc82d3e9e7dc2488c99
-
Filesize
50KB
MD5daaacefcecf5738cb0166aa6ca8c3a31
SHA1948f331eaa9a6040c64be4742b93ae8010267512
SHA256201a4c561840d28ab9980e6eeded09c21318e64929a36d5e3c1530b616091e94
SHA512782f7bcd25f06d43a529998c62594a80f52970f0f36e3fe11d6e52916dc701684a37c79f177ff9947c21e5d402401e2c0a7bdaa0711dfc3f69931cda3c4edc4d
-
Filesize
46KB
MD50b13941ff5a8329b8355d0309c6ce3c8
SHA1660758e00283713c011100c0d60d3d09fefb8970
SHA25628e253630e177cad7b6f7009aecb3c7560ace90d5641b6dd09487ebc5ce8419d
SHA512a2311391cce184538da872d91d7c252fe2222dc15ccdc4cd4fa1f0eae8acd72164dffd11163ce36ac5a98210438b24647f5824d1b0ac80fcc0c4cde2acb2b7ca
-
Filesize
51KB
MD53a419af093c40f563cf83692b560be60
SHA13523a7891688d368f24bca023180226a70c92d89
SHA2569aaa2cc2fa68ff24e6c563b6d3a7c4aab1b7796e7a3f3d82d868daa6da4c9884
SHA512ab2ea238898a46845b44e1dc9779a8cc8a53c967a6554dde1d8a8232fa120430603cfb900e1b9c03a810b2ceb4a15ac4c328d8630238e5cccbfc6295b17a4d33
-
Filesize
34KB
MD51ed5fc22c46a24ae786271ae9294d042
SHA14a6e8e1e54c46acd00ebd376dce65f13c1f8abf5
SHA256213b5b66bc7cfd1cd68119088dc47ae8500af977eee8d16a29a5c3b3bb594cdb
SHA512acd229a3cdc3b23f7d85e08e0395c46d16bd97d0b56e4103994c3d77d8000de21c21a3d0a1ec2f611386cd9e5ed7a39f1d124d8b32bc6f1cf916c5c273782d78
-
Filesize
54KB
MD557a575a92b05d223d56f40db17ebad73
SHA141e3298aa209a0fac2f014fe05f0b954b7a6e134
SHA256caa3339afc07cdcf2cb924bb796fd804555b512a5780470a6fc84b1090dee6d1
SHA512092fc95262c89e8b4414e1c52b0454de13173c2461b11f16ae2622c1111b26c00cad1ec9e72801ace2c1c276038e3c16396702b70820d2230f8b062780e3e036
-
Filesize
41KB
MD562465f4c96b45896bb4b85e2cc1ca0b2
SHA16bef98484aa6b103127719c5a894dc11863e2791
SHA256372b3cd73105daf45d78349cc05de13740b35e9614696dcf0b803ecc0cdca553
SHA512d83be25809538cbf9dfbec100291741e798c5bc0b32511429dbbd5195b98cf49be71836cffe24bdda5e23db33ccb5b9aee8c09a302e3068c7eace59b64567b05
-
Filesize
54KB
MD5a4ba97ecf853f074f5038d1a9bf44763
SHA1ffd81eeb979946ace6322481b69a9c4334ae0e4f
SHA2563ee82c563d68fc72fda24182fe7a807be4c7452a1c04aa368b4d23e5abd3f67a
SHA51230a5d8c329594a03e457a1dcbb397f1dab8fd8a1c9c97ada233208ebc10bbbb55e57b7e0f7c94fbe8527aa00a583033333aa0661473a93442eb5da22a0467498
-
Filesize
41KB
MD537a258a61bfae40700187fea8709273d
SHA163bb434e40f8a7cda547716f47d5cb4afcf45066
SHA256a9add02894ee9905feb839e0c090e570a70345eab0de351018289fddd9935f0e
SHA512465ae10acab3630250befd7458a36676be61bc8825c7b379864874779a1de4dd037b85d914b3db5b031fa293ea5b6a3a8cb5b7e2285f6792ef5918068b17b20b
-
Filesize
6KB
MD59c60eebb860130ac39da00f04c5f107e
SHA101840b490367d370688ab6b4e17604d93138626a
SHA2567979f47ef99b931a7faba8e690dc7b81a8f0374178d8336f15bc1a2bc80e97c8
SHA51281ea578a802eb456bef6602211540f6a17b551bbfe6bdbda0d319f139d1e5723a83f0a6d1f40d9ac48e982b7f9bba5699fd31c61f78317498f223796507e4660
-
Filesize
56KB
MD5112c7887e39d11116b589221e73ff12e
SHA1aa73a530c935a80dfd912e84a49e94f6aae5d595
SHA2561333a8d53f7f582cbb94cacd8adcf6578297f4ebe4905d362ae91130b5ea88c7
SHA5126353a067e8c2a39d9262c5cd31a33e31033b1519d1df6eea8acdd517d2b5b048c686e188515faaa29498d1d4ca8f004637e2e7fc79f64db9d22d050d6f671c02
-
Filesize
2KB
MD52ae815ca07c3e07ffb5069075bd3b4e0
SHA12f759b0f2733231bd7c45fc1d2e8a6949e6f1659
SHA25617f77a82a09cfb848f718ba24251fbf9990a3612425aad81f1a6d07675ad200c
SHA512bc76e314ea3241b0e39d1926160d55b7877632d32e4bce62d465c5a7e6b197abf1664b5a1dd4d08d74bfb3ddc35355e500d2715ea7bbc7bd27860d6cabe5cd05
-
Filesize
41KB
MD5df131e92f3fb8ed441936aa39fa4fbdd
SHA1f9cde74fb8ad295f1738f5ac813038f61f63283e
SHA256b59c737482697560cd7e5fafd15ceab6f0f4065600c193d8d7185812de485de5
SHA512d48c043c7950705bc6988724f4dda5c71577fc2312c82b7b1a4332e6d0187dfcd90fb56b7e8f01a20563e5322a4d9eab2522b55a4f8ee6f3cc4976b7f552ab6a
-
Filesize
53KB
MD59122dfde2e9d52aa966012c3c082f3e9
SHA1e9915dcc1db3908d1d46f3ec315f38b22d46ae26
SHA256b66e1e5a6edadbac4eb0cb8c065793093e3d455f59a5e657ad5a75910fed1ec8
SHA5124103f45d0b6f902cd592b5d7a3f027f8e51391dac06213f6f5a881853c3b5e447de855086c09a1b2b7e9d509245328bed9e62f13fa5cacf2d02f8a4516caed35
-
Filesize
4KB
MD55616fe95a3e7822984c3e2e5444bd3d2
SHA1a733c707c7b7152d3a17fa7790c93dbb555241ac
SHA2569bc189347e6b925f09e8d79c5dc745d4bc42b14a03b8c4e81c6f8a3c3dd6cd7b
SHA5121c3482033e002bcd7b8daeec5be41b01e1c0e77d1d3632c6279002b4f6215d4c42ca059e88cd6fd7978b5b8038d22a694622ec67ef99c687b75eb4a9724cf126
-
Filesize
48KB
MD5c880394467d690d913cc67185c243f24
SHA1c2d3e853d8f62e5ab2c36eb7d79d5d51cccc3670
SHA256422f2e8d9573965fce310ad9f0b025af20f6ebf80bb79e58a0431c7e5251bf6a
SHA5124f9760bd42af49aaf94aa648074910a962b4506132fe50ad9deab86491e2dabd1af92b295d7aa1b693f4dbc8b1e97eacfce931153d3b271afc4de0ef1d5e8db5
-
Filesize
15KB
MD5ea613061921afb10133eefb176b43e50
SHA1264618527ba9cbd9d6ec91f150c9fabef1552629
SHA256e47268ad4f4b3ac49800d757c60f896297403dc97d5f33438c2f120bf544eccb
SHA5126ea40ddc448491d2c0a60cca4d9f12838e03f727545cee0466d47481eb0d0c3b691c55421c071f5347b0eb90dcc440a2d8af6661b2a4b04c9cb404e85662b217
-
Filesize
32KB
MD538501225c057441fdebf733aa699dd65
SHA1a211dff635f470adc673f72297e7f61e63e6926c
SHA25615f9c52850863221becc4fc10b76d042995485148bda7c27c5936b4e87a9bb34
SHA512afcd8004f4724a404ab89928422d0c2cc9e01083d5473cac78d928f154fb6a5365cf320d8556eb56d45f61940956d903740144b1292f5a951b5d4d337d3ac3b8
-
Filesize
44KB
MD5491441a58916a7fa3a1f23cc9068d298
SHA113d3f81aaf3bc5011834fa478b5399ec1043ab34
SHA2562fece94d05e7b343ab7d1d9f009269920c989262d10f732c18ee8dd4c772332f
SHA5128cbeef32da1683cdbf402efcfa745e989fd4ac7770b9001a1e03891d4f430fe4857eee85d925e2851100407d1b6c6c496e7e565e76ce44c8ed565f55328c4987
-
Filesize
40KB
MD58599faf194c997264eb721cc613b0c2d
SHA14334bcfc1256a80b948890aaa878284323630b0b
SHA256ea3fc50a81b546911bf9d110ac850e0f38307f793cb197950f8b9f5589f537b1
SHA512ee12fb0d073ebd87270b8186a496049a9c7eb6b97ce96454238f840c3f40741cf7ab81756418ed200955716f405b9c297c887a1635c620225010f3a7260c3789
-
Filesize
48KB
MD5c4b2038673dcee94e86fabd0d6a50c84
SHA140cd8f5debe7d53047a36df490f1edda44a62315
SHA256a587ba93b3ac7f050237b9a9673be69075c12131c7f50460b55c84dd1e5639e6
SHA512a31270793c21bfd2b397c3c5592f8a40f26c56bf499b30cea7b7f4992df7440ca45730044afd6ccd61a195fbe68ccb79d350fc4f009cf12171455104daab7e45
-
Filesize
46KB
MD5ed99344df4cd3e33bc8e2d8a28a60d1a
SHA150ff7192d629cd94ef2a2d801ee116b41b3b1cf0
SHA256f8b1ce302f66caba613246b6447bfa2cf4153623df56df231136f46eb0672d10
SHA512408c36f81d40d9a32b59665b78a443a1882e8a8cc3cfb31a83efc1272b25d4adc178d9e9d10298417ea71331b961331b5b0d3f1a572d38cfc6d934e0122f287f
-
Filesize
303KB
MD5ba8906131ddad480ea9d383bfca24bfb
SHA14c5d0a11faffd8b6f342618be61888705076695a
SHA256ff5bd7e85218882056be6401a911632f0a0e11def389c24899c934df0d396eb7
SHA51295e99451cea6cd2f52b032230071daf3926c391304d8d70bc6f155b1ba252e376385e2ea0829a9c29112cfb3ba116f443563e7d07fee259d911beb4c117c8166
-
Filesize
655KB
MD534b41442db89aeb42c84e27d078d1d1b
SHA14e4cd12680d68f6a8ac2d9869bf8ea99465cfd9f
SHA2564a1ba548733f139e0d976d3a89c98e31b382f6ef34fddc85bbd9e545fbc9d51f
SHA512126c533ce4f1fc54691bfb6e0fb9e0d289bf208cf9ef43e6f78be8ee471dc7aeb0443a858b768149b946589df33e6f213fe04fb1e2225796a6a69f72e2725a81
-
Filesize
1.2MB
MD5059068f49ca4315f5925cfed0f143ae2
SHA159889ef151d571faa2d03bd30b6aecc4608c5b6a
SHA256835be332cd3c4d617ddf33a573814792f8cac240717782653686e3c8a98a5993
SHA512e979ed4c7e0c8f796839f3bbb30ea6305f1694566a7d97861cacab6b714dead9838239c3bbf0e886614f077351b7af10c726a33afc0783bbb274cb842d6c624b
-
Filesize
47KB
MD543203f9de02ba527023834895028a4e2
SHA10c5af30c6d859c303e7346afe7a1cccd0cbe5b16
SHA2560b9debfff8c21c814f08e35e0faf720363e8786baec2474aa9b06c1b1803dd76
SHA51204b71d9e65db89e3af5bca1c805e6326fd45f1b9b9c838bfc38ecb34b0937428d0c603bb8084e58892eccfa1d113aff620a7c5417101edc3a43e35a7c2511c01
-
Filesize
81KB
MD5816c4e245b286b4e4903131f75a94948
SHA1eda70c1fc8a461efb0e376d42e35a72b96175e4d
SHA256aca1bda08690dcca930254f96f9185c776671a85a58ffa1b59cf16017546f218
SHA512d0dc74956c57403c0638e6595aaf1c2eb75233997a15170b064261a5d3f1f525a3e35e13fef04c36cc20fd1d5d1cf000a5fb7a646bf2cf1cea73817e5d3335b3
-
Filesize
3KB
MD59c05f7b6a83c4f7ceb7683286ce8247c
SHA1572401898d98c6bd2f6f5e5695d0ba8a093bb0ac
SHA25691415237b9d7aa428a814999b765ebcbeb18117dd459c6538c42199583ce15fd
SHA5122bb122839e05f793f3380b1280f8d3dcd405c0b729745c76e88d3cfb3bd659924b01d585a43b6af1f00ba8c88d9fdc030f49e65740b5da088b2ff0a664957c40
-
Filesize
14B
MD5ce585c6ba32ac17652d2345118536f9c
SHA1be0e41b3690c42e4c0cdb53d53fc544fb46b758d
SHA256589c942e748ea16dc86923c4391092707ce22315eb01cb85b0988c6762aa0ed3
SHA512d397eda475d6853ce5cc28887690ddd5f8891be43767cdb666396580687f901fb6f0cc572afa18bde1468a77e8397812009c954f386c8f69cc0678e1253d5752
-
Filesize
5KB
MD51ddac3df957b2aba2bf15fab41133470
SHA1d24a6322ed8c500f600d9459b7eed265791a9c93
SHA2563b1ba05f8ef4e38ac8c531883fead96f592d9bcded399ceedf2bec28cddb34bc
SHA51205271c2ba1364fb3679268fb498e28d771a38244dd64c57143fa39606f9fc298954a820cd3fba925a8dac982fe830304b384855f6c68e816e06ec98f2a0168c6
-
Filesize
15.7MB
MD558b1a7e5da19d92c93e3f9c38debf87e
SHA15486e803ca68e426e3157fd87c65e491b843a1b9
SHA2561e72fc0bf459e8210cbe0f357912e0722934f57e4c63a788405c317208738ed1
SHA51219f539f2610f9fe90f43d41cd1ddc0909a381204047048c8994269329899ba389cf5c8d3f2fae8d7dd403efd07c5a30bc4373c474b34e3fac259f3cb3bdf9285
-
Filesize
63KB
MD55128d0b7f36b6767b601f38dd19d1051
SHA16c9906fc2405d69eafa8a510e91dae4c843ed0fa
SHA2568d9b62218358f448368764b709fe25e0ee072a2cc1188955779d696aa0e7813d
SHA512ca53f58bf30b21c530746ef4117debd98345b06e6cc1d5d31a0125053539dc101eb2df54705cc1a274654bc35f64a08e41c2c1462f62f8daa526609e22c2d7e9
-
Filesize
76B
MD58f06f3f847ff26d6cbd6cba0c358c48f
SHA1bf77699748a04e1ed277d18c95b4a9fcc20cd661
SHA2560ee8aef3d5ef13b98c50eff348cd80addb1ba28bf158a987150204ec720a7e6d
SHA512b2f27ba783a9d5e09de42c62a6639541b1fa9c0b8889da8ae1ae0a639ee3c0f4d1940c1a0cad79d9bc0f3035ff46ca3137158da3e05a39c9f4d13e71317f6087
-
Filesize
135KB
MD5e32175e177968082628a5d9e0e6498d0
SHA10e470882cd758e78c99446188a392108d3a6641f
SHA2566cff3fd1e7516bdf5a31e31aab05f959034829e82b492e67aff8a83f21f69ed6
SHA512f149574292a62de5a8fdb71ebf66f3406c0accdeb3d8a3cb26cb726d443a72c0fceedf95d255835b399c11df9d67ba5588fff8d6f8890fc04543b8f30cda1fb3
-
Filesize
23B
MD5d984be7be7d67515fd673db8d135c0c9
SHA1635c9fd7afd6e44cea91f04e49ad279de5bd8750
SHA25676adbdba40191dc10543718d7e5eb88b282ff2490ebfaa146ea0e2accb3a2cf2
SHA512c143aca7c5dd01fbc643c2d433e190c233e91aa7dfe0442c18e64c2ccc4944ca87f34c6f55d2a56f4fe15b154c08b547ecb6ae0df046d65048fb1a17056d0fbd
-
Filesize
512KB
MD5f73a290d475bd27a99c126b5d6d8e37e
SHA15b293563f35420bc0b146e2a9667abcc1b0ad4d6
SHA256153aea641e8fde9a26f01c2404fa7e1bc33eb2fd185ad3d4f6d115a466acfd71
SHA5120bf95e962919f603dd5afb8ccadce5cb5aedfde6aacd7d7b1d236e0c2cd1b62b2c6352d2826589af3da72703f72fefed87a5e67a8699f5aaafe5f39c97e4edef
-
Filesize
490KB
MD51a05c41f5777e6d2833c66269c5623b6
SHA1c207a933b18d70266c76aea74388afaa871dadcf
SHA25697b5058a424395471a398c1b5bf701a45dab867ac3c34c622dd4d65d2077a735
SHA5126a2309148f1aff30ad264bc2483076eb78fdfdb631cdaff723d3493127d80935ddd1d9d0c2d902c5b9fe0ac201ba0b086df4eebcbc725d5ea55376c042c39a14
-
Filesize
9.5MB
MD5763908d9520fce6baf6fde3a42c3f7e1
SHA12abca14c61c00f1bfb199a67ebb136bda402a821
SHA256f7a48a349641776172d277c3c65cf0be0b05d8ec5e4943b3163be695da48c164
SHA5121d972febfa5d848fecab83d28c38e9dae525ae25f4994e4f8ae88df8fac1595504cc5e84d1e22e22bc2edbf14fa90474358eee418ace5f72a2cdf87de8fd21a0
-
Filesize
7.2MB
MD575cc8360c2332d9d45240c301b1a6d3f
SHA19572c56e70152e7285c9becac807de5d4b31998e
SHA2560efb49812f3b54ce2163b795b8b33a21880970b8b6c5ecfef8f15a9c3c46ae17
SHA5128270c652e7364aab520bbc86e9662f43d153df2946381ff73065340f9641332705f36f824ad5da6da107ec07cc4eed5d7a94b30dd136a7e3e1b15688b50d2089
-
Filesize
197KB
MD5a5455d61ea37f17cebb04344cc20eacf
SHA130ce26106bd5d7c07a50351be8bb9456cdbd0613
SHA256dc371d0637f0584369ead17d70d744a4d6efae1e32b3f89e88561d549220f148
SHA5128ebb5b5491500ab6b4aa8715746ce0a8fb0626b5885a5e41010f3c469cedfccc68422c815cfb9e830f37863b1f479f9249f8a879cc828de349ee20894b408596
-
Filesize
521KB
MD58dff6936ef59453ad0b1d50a439c75fd
SHA1a1aa4579c53a93a8e8570ecfed81ca86de9e4eb5
SHA2569a91b697a812675454f6ce92c31102c286320ba6fd50f3f6976c7ec4bfc00d9c
SHA5122265154975f7d08e357330b524a1efa3ac24f786c0771d85400e5cf14f2a7c96ee129b16adba753b4b973c799cdd4db10921bd722efa782bcfd2393e562530a8
-
Filesize
512KB
MD5a9ab30e1bd0b78e0b0524e4216268145
SHA12d698de25051516704cd21ff0a683c3b91621c4a
SHA256f1cf97079756e1fd70902b685a8cd9dc069d582ae1c28701e74e29d4bba89b66
SHA5126c5d31ce1595e3ffc228b0d0c3f15dd89d64b636fa76ed4e9c59c4cb9dab71b4f7a6d48b31fa14359b6422708545a3af7391fa2af0d8d9b4ec96c1950a132c3f
-
Filesize
3.4MB
MD53b02518c32afa8cad17c3507979a18fd
SHA1dc5016fb5f572715cc50f539f275bffc4ffc9a38
SHA2560af82d650a82dd99378c50c6ae8728c6492b3bd58ecfa8f5ce2e9f413026a781
SHA512755d2b8daa7bb1095c1f2c2c4378efc4d3606ee452c2a25068bc54e837e3388ffb8d34f83109dbccd443b447a273bdb69ed864451cd102c014febd794f059121
-
Filesize
162KB
MD5ce0779c06b209de9bb3ec03d3f95fda7
SHA1defe29adcb0f80e3f3ffc02a77fa18803cb79467
SHA256907da7e1a7dbd07e2d0a2716c95729a5c9fd8ceaee02859b2418621e4916e505
SHA512bbcb07c7b726c29ab9d8fd812bdb1ac20089bb808cc02988c9bc5738c41ba2f35536d7937f4be1f3efbe8d72e928fd36653b04c86aa662881105be7e1181c66e
-
Filesize
507KB
MD51637ae5c830a34519a693759a9708084
SHA1097e5b9e5e9015ad6b3743adc54ed75745b6db8d
SHA256e34125a10a02d47637a5cda8a19949c6cff0f38bdf1692542ad71bfff711b744
SHA512db04bf203ef9fc5d7dc04f7a71fba967127974cc3c82474e7110c79d3cdc24c00e637aceb0bdac30a4fe0e5b7de2d2fe4c6da2fb27de7fa218696a92939da02f
-
Filesize
19KB
MD5f9087f0c5ffe41505a5c7509931cba37
SHA12f7b4ed4ac235badc5e333b0b2a00f4b9c62ec9b
SHA25601d7d4eed2fc26e2148305b1c3c2a131dc5b07ffba6baa215deaedb35685aa0e
SHA5123006c9d674ba1bece6cee0b48adb66c0852e1988a874e17807283d43aa72a5b52638f31e2fb410f12ceaa33ca3f6bdcb1f87f93a4be46d671fe4c8497f5425da
-
Filesize
9B
MD59d6d76179f1a63fb861a800e2bcbe37e
SHA1280070b623923879703ba87328cda22f0ce122a0
SHA2567ba9c483d856cc2e851f9122492bbb68b0ccd926acf8755419b4abd6ffc4ed56
SHA5121ebf9f966a4d4ae9a152ef5d7a69c16311154a278d703e96be5b1f8f7f9c268d7c5c818dcceff278c2af14ef04266d892a960b1989f2dc9d31ce9573eabca232
-
Filesize
7B
MD578463a384a5aa4fad5fa73e2f506ecfc
SHA1649df08a448ee3fa90f3746baaf6b0907df42c91
SHA256ba118bf7fc9c1aedc1edb28a0aa86e0b43b681f222af6616e13c43be87815b06
SHA5125a4acd4a4031752345b08526d089f78613752ab168d089524052e03e1da17df5b01853bcaee4c352a576a4684ed0b8e874e7665a4c19227269c8a6688d7d8660
-
Filesize
334KB
MD5eee514d376b35d25a0884f9e0403e00d
SHA10f63de66d2ea98ca2538186ccaa994644e282a68
SHA25648555f1e4a34e826167a326b079997a14b2b30359101653a103d75d91da3227f
SHA512651dbc7b99b8f73084b38a1484b449eb5fb655b882394363491dc37423e0af3e605890f60034dc3d04ed644a213711589d13764b987076ca552858399adc79a9
-
Filesize
1017B
MD5b70df1560c8331406d8644809ce70a37
SHA1472b990998f0873c8338035c660e5b6b651013ba
SHA256288761d572b60bebc70b327ece62ce43919744e419612190e77df0dae67dbc9a
SHA51268a39322df8864466dd64fa3b05f3bf494bdd3d21d2ee79df023b9409cba24dc78d336fc9c13be3e6df1d35f82bea822b3cbf7729e7ee447aa196f1623099bcd
-
C:\Program Files (x86)\iMyFone MagicMic\skin\PictureNormal\MFVoiceChanger\Application\SetView\like_after\is-EVUGO.tmp
Filesize6KB
MD584092e64fd45dbca7f8b1808e8d5b0fa
SHA151f017969a98c6d5e0add83c0f8a0ba43dc76fa3
SHA256f1ce86dcf4e56700d3626b2cc629f889acaa355929ad44e5791c4338714b8c4e
SHA5120c0bb67b322d40c7882e831015eceba87545683a21542511f60f11f6288089321df112a0c7ecb65a6d7cebe485f4bff1d06bc080c964d9e2d79531b00c5f3346
-
Filesize
884B
MD57db9ba60e6b7bd4cbd858ee353a405ea
SHA1be77505589cb78ff521896216cca61db4abcbed9
SHA256f5d759ba2dcb9e9c932dd0d9528d32452185236be4ca699f229adc42fa78b794
SHA51273844f27dbdbda5c07bab380ecc00e6015281f691b847a992aa08086bfadc2b7115d5580851246b57a96242f60b795c446f9127badb108397e327a3b2d2a4e59
-
Filesize
515B
MD553652fbac2fdefeafa80578953d7e59d
SHA1b814c92fbe579e19795eed67177e80b9efcd65ae
SHA256921482e9539d5aa4f0b9dac9cca393e68172ceece387a84fe0d8a57d5f6ed7c4
SHA5125bb75dc03b4ddc9db09b75a0b7f03b4b3a1da1a266a303c6174e0f8d738153031ee5a376ae6c71028dceea92fea0313335c659e5b51ffd0b86cb8da0a189df37
-
Filesize
918B
MD5b3589fecb19d694e77ca288204ed2a2a
SHA1af0232084fe781dbc3799ee8c2b6eec6356b5a87
SHA256301b6a7c67bbf31db3aa02c6ae484ab032cf9625efeaf8e3c59b18070f062e37
SHA512625e4276dbbc17d1f75aaf7e73bd2673259066c8eea19190591797d5f4334caee79adf235b56bc9b352630ad16e2689d6efb8168033eb4093735b78d3b74293f
-
Filesize
534KB
MD55d7b9e16dfe9a6a7c91e20714e4bf15c
SHA1604249be4b3343fe7297d5fd973751c833f40dcf
SHA25640c20c2c96ac849ceaadd1bd76718b50ecc309ded8f32d4b54e25df088c359df
SHA512e505e25d1b19fc6341963f619c44b4716c18ec6ff4fe1098ed1cabf1f7251aedb0f7bc2a839e5e5aa3fac7a431f1610aa7a46d41b74b3465d4a4093ae6fd1ae0
-
Filesize
33B
MD5b725cf6504296c215e1e8076b67d9d19
SHA16f6f71de949c910eeac9ef6704ee948fcaa357cd
SHA256427585007a3ccc71a471e2a1155ef85a706b951d8366a8843efe1cbf34eaaf87
SHA51202e28ec15af0314ffe714316697a936bbee0f4c368aabe0e2f6cd837cea849bc9cd34e4ccdfa39fae5e66b20b873dd8fa2ad998d8e16926cd08c669f7687d82c
-
Filesize
431B
MD52828163fdb25583af8b62af8275d18ae
SHA1fc9e0ca179f887ab42a9e1fc195c06b2b90426b2
SHA25632ec8e2dc0150ac9284d13b6843784fd1e073fb7cb8a5a4244340456237f05cf
SHA512e2916b998b5f99662434473ef0da57732a8b41a83374a9d1bae5a03c38b99bb799bb11671891fa4b547d561641f75b7eee9e63fa40f19ca4487601fc6ef2918f
-
Filesize
162B
MD5230da4871246dbe0bf6070a50bd13ea9
SHA1fcb5aef068f718fd5844d4261ea52d6123b3aac7
SHA256bead2c9aae342403efe52ec4b41d6782d723dea59be18d661c700e0ffb0c4e9f
SHA51285ce71c11e611a0f93555d6b523ac146c104aa95d5432a89d68f764c22ddfa66a1c8cc8ccfab55717d87be17efba09e8248e5c73a77f729948d55287eaf678ea
-
Filesize
194B
MD5413b7b26369fa20a7d27994f54bde854
SHA1e4370fc3eecac8d323b98e67f6e1aa449f803ca6
SHA256aa9606787aa1f90e74f98404300308700718c3628bf3e1f7d5cb695e1a013071
SHA512b64a090ae8de0bf3b5a528215ca46d25c7b165ebac745be9cc4c901189a34ecc52f92cf724f9ad4118b8f9dd6e1385f81c31b31665d9aead4b2214ff388f32e0
-
Filesize
470B
MD56e8e8de6a8c06f90c11fb8290dea1695
SHA18b10fe52f734652ea5fd6725d243ff528891803f
SHA2569ebe8ab49bef62b5584246ba07d99c28b3a6709fd51843be82f0e52ea6c49d6b
SHA512a65fec08ca990f2b15d7eb601420c53d500da90987306000753c86c94b2314a40743a9e4f0865c52f593bf192a7fcdfdbae870db405497fd663418894c91bd1a
-
Filesize
757B
MD5097e3208d0aabe2ea2f865a29b3eb5ad
SHA1cff154746f72840477e2f9d313b6a0ef42ccfd86
SHA25610eef093fc635ff406aea377da693670ca5e3c75602ee35e5bf24b8101e21259
SHA5127dbf0eba4d1a41088c3dee12d66fc84fbde5254a8ba2389ff9106fc06161b1525d792d01fee4e08438d51bfa57b546ab873f1e91cbdfd8219db5031e400d32e2
-
Filesize
720B
MD5205783bbb44151e6911f3722efacc174
SHA1496beefe5c7e455c2e2d9d056961b548b50df4d4
SHA2565d34000d9d404523aba40660344a19c7322faa2e3341735167375b1338136c3a
SHA512a04466c494be17b84b6ab89e2e85fffa99b62991285acdcd08b6a4fad825dfdcfd7ff5ab8e541f724a548500390404c7c7e9444e0c21d02e236d7857e4317c27
-
Filesize
1.8MB
MD551fb5b2c82b53c0a5df3cc00c8b2bc57
SHA1744de39a5b5d0e3cd2325dddf87ba62c74d71005
SHA256338034845bd3e0c6ee65c259434c0a22b526ad0ed0fe0cfbea9d6f18473883b0
SHA512b8b1d551daa99b92d5781dc434fafee6180033d4f27635338065a6663f2cd4901185143a3a75a492fa6c15bab6d008bbf9ed2e7a914479c40aa8c204756c7b8c
-
Filesize
15.1MB
MD54d63dff7ccb841004be6b30d2abdfec8
SHA1772d2c1c562e6ec5baa2d8841e9a2869648fe540
SHA256d2338722490f6864a8fb71963138acf047e00dafe0119af91e086edc8384a8ee
SHA5124ccbea6908f99054a77f6da1d1fd10691cbcdbe11f3d26bff5616cf8311bc8005cbec2a74457065eb45c732d75e7c6d391056d64894c030c1e996d9820b2b55a
-
C:\Program Files (x86)\imyfone_down\magicmic_setup-com_filme [PeskTop.com]\language\English\pr_1.png
Filesize159KB
MD5784e2cd5c2d3591f71562004200d1fa9
SHA143307d2370beda8bb006d2b3c277108dc81b9b03
SHA256886a5f3a4736a7bd89cc3c31a8fa67b541521d17761af37be4bfbf0fba350473
SHA512540e9ad986358965401af2a271daaeb9d3556130eab9d00457ecd3b2524c0b75cff9c2ffa7dc57bfd44547eb2c8af591ca96d14e86b8c862526db6ee41dd3aa1
-
C:\Program Files (x86)\imyfone_down\magicmic_setup-com_filme [PeskTop.com]\language\English\pr_2.png
Filesize126KB
MD53918b43396f0b34a0b668f5aba728e35
SHA179f05930dd0bdbb04ed8324f42daa727f9630f49
SHA2566af5df994d323ef18af269f91a1fbd4fd2f38cf71de5948e75870e92a64d596b
SHA512524763c826c51342ee2a866ad33c10953b25b10db8977618d8a52844fda5b644a653a807da1dcbfa8181b7d461cbabadb3578c3178b5ab3e9668acbc92fc8c3f
-
C:\Program Files (x86)\imyfone_down\magicmic_setup-com_filme [PeskTop.com]\language\English\pr_3.png
Filesize157KB
MD53267c7404a2b873fd47f2d7d085da63c
SHA13dcb9c3060a802671fb30e61235421f59d906812
SHA256fcc9ca3bfd6c18dfa87649f913434e0d746fa6cbd8d3ed2e502a3b0c1d81341c
SHA512c42a3a4ee036d76b1ca4a5afac940ad121ec4021ecd91a760d42fba6a2014ebf47d8888bcbb833073a2b55c91eb95341f4c98511ddededae92c1bfd95c074e5e
-
Filesize
2B
MD5735b90b4568125ed6c3f678819b6e058
SHA14d89d294cd4ca9f2ca57dc24a53ffb3ef5303122
SHA25649d180ecf56132819571bf39d9b7b342522a2ac6d23c1418d3338251bfe469c8
SHA512ce4dd661e4d69073c7999282048ea9ee91932db0d699f8b13b2db70fe532d987ac4a0aef309b82e1ad2aa6c2f2f60473093cd1e399a737cff3f9e70585d36be7
-
Filesize
2B
MD532bb90e8976aab5298d5da10fe66f21d
SHA1c097638f92de80ba8d6c696b26e6e601a5f61eb7
SHA2568722616204217eddb39e7df969e0698aed8e599ba62ed2de1ce49b03ade0fede
SHA5128bd4964ded25d2608bbfd709784f9ca9893b6e3e51ec556d7c368c561a2c4f4135266ec7bb6fdeb3651213ea2a8eaf2ef3711b8a51f86c3816c821a62d2694ea
-
Filesize
2B
MD5d09bf41544a3365a46c9077ebb5e35c3
SHA1450ddec8dd206c2e2ab1aeeaa90e85e51753b8b7
SHA256f369cb89fc627e668987007d121ed1eacdc01db9e28f8bb26f358b7d8c4f08ac
SHA512b621c14d7802cba525145e0f2abea6cdb178415b230ca23ce27d35e95ecf2afd8b715fd1774f833ab3caba48f38b4acf4600dbc517fd78daf779cb9d66c65acf
-
Filesize
2B
MD5c51ce410c124a10e0db5e4b97fc2af39
SHA1bd307a3ec329e10a2cff8fb87480823da114f8f4
SHA2563fdba35f04dc8c462986c992bcf875546257113072a909c162f7e470e581e278
SHA512413f2ba78c7ed4ccefbe0cc4f51d3eb5cb15f13fec999de4884be925076746663aa5d34476a3df4a8729fd8eea01defa4f3f66e99bf943f4d84382d64bbbfa9e
-
Filesize
2B
MD51ff1de774005f8da13f42943881c655f
SHA14d134bc072212ace2df385dae143139da74ec0ef
SHA256c2356069e9d1e79ca924378153cfbbfb4d4416b1f99d41a2940bfdb66c5319db
SHA512c0033b5f5a4815a172984d64037dd49a8663fb8b3a71e47f11ecd332c8c3819c57e1631fdf46d66c6ff0e58763a61529fefcfa2a6675e186ee901e5452fedd94
-
Filesize
2B
MD53ef815416f775098fe977004015c6193
SHA11352246e33277e9d3c9090a434fa72cfa6536ae2
SHA256b4944c6ff08dc6f43da2e9c824669b7d927dd1fa976fadc7b456881f51bf5ccc
SHA512c674de1d90763c6981258fe9381ef803a9384768b848c3878ab9f2c7f90c80ce9f21be1211f7c762317c780df40b7c372543f834953c43a77fe9a4e9d2ce44d7
-
Filesize
2B
MD5e2ef524fbf3d9fe611d5a8e90fefdc9c
SHA1812ed4562d3211363a7b813aa9cd2cf042b63bb2
SHA256d6d824abba4afde81129c71dea75b8100e96338da5f416d2f69088f1960cb091
SHA51273ce1b4371978a11dfcfd913a24fffab97c1d4d5c4407a7ee5520b46dc50614c17d4ed1622be4e9c078c96c7bf80ee1d2817a196ca49695d279805f72dba0237
-
Filesize
3B
MD5f899139df5e1059396431415e770c6dd
SHA1310b86e0b62b828562fc91c7be5380a992b2786a
SHA256ad57366865126e55649ecb23ae1d48887544976efea46a48eb5d85a6eeb4d306
SHA512643c30f73a3017050b287794fc8c5bb9ab06b9ce38a1fc58df402a8b66ff58f69bf0a606ae17585352a0306f0e9752de8c5c064aed7003f52808b43ff992a603
-
Filesize
2B
MD59a1158154dfa42caddbd0694a4e9bdc8
SHA1a9334987ece78b6fe8bf130ef00b74847c1d3da6
SHA25641cfc0d1f2d127b04555b7246d84019b4d27710a3f3aff6e7764375b1e06e05d
SHA512b0103360d3bbdcabc75330522fca1366932d63944a4364f2fd9d1d4b935ecab5828b332a39efe9aa635af5e17a8c00fb7c18a3fef6a0e37e3453d73e4180e0a9
-
Filesize
2B
MD5093f65e080a295f8076b1c5722a46aa2
SHA15a5b0f9b7d3f8fc84c3cef8fd8efaaa6c70d75ab
SHA2563e1e967e9b793e908f8eae83c74dba9bcccce6a5535b4b462bd9994537bfe15c
SHA512c45d027d446112379f9dcb9a9e84763c84ffa7533632ae255fb9d5134d54171769a5906366091b39ae680484eabc9a3a08ca58e980419f03d86b11b345778335
-
Filesize
2B
MD53295c76acbf4caaed33c36b1b5fc2cb1
SHA159129aacfb6cebbe2c52f30ef3424209f7252e82
SHA2563ada92f28b4ceda38562ebf047c6ff05400d4c572352a1142eedfef67d21e662
SHA5123673a16a5983f5f5e04bf88d2c08e39631efe619726c5879d2d6907c00acb5d5689061b28cea52edab7c79dbfb450c961709c36c0d599b526c856e924f57e803
-
Filesize
55B
MD56a1d1711c39326d99428476ba7b92b0e
SHA1fbee78da5304182dbd2bc488cf17cfa9b02d2a47
SHA256b61d2186016d7a822e118b648b5c4652d65971c12cd69d702d4cb51b02103640
SHA5121129674b4553efdbe589f31b2afe78cec34df4a44ff96e58709e4b5655ecda4618aee369cf93019aba3db20f0698214a95cae814aaed471340324c4d607925ba
-
Filesize
152B
MD53782686f747f4a85739b170a3898b645
SHA181ae1c4fd3d1fddb50b3773e66439367788c219c
SHA25667ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13
SHA51254eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5
-
Filesize
152B
MD558670ac03d80eb4bd1cec7ac5672d2e8
SHA1276295d2f9e58fb0b8ef03bd9567227fb94e03f7
SHA25676e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8
SHA51299fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize840B
MD55c5abff204e56a6422db1aed3a465157
SHA12bece3a9ef482a9c13e4a3d09c928b44801205b2
SHA25604cc59769b40e36752b53c5e1482b489c22095b9bd79b9da002417f9130588c6
SHA512f8c278585280b6eda2ffbbc2b8b44f08820f3e753c7040240cbe29fbdbd4cdd5cf4846892b3e67d678e855a81d4a4375a7810bbc287a50820c97658e872d4b58
-
Filesize
2KB
MD572ede98637902b7c9035da9b568fef0d
SHA1c929e11d90da996960157b3760992c65c9dccaea
SHA25636b0faf26d2f9383ef3ebc8f1ca4415f16fb46b5d0d7aeb99b97544ae40b2eca
SHA512e2388b0c6cd73925a99a2a302288b1a5a4edda265a3545b632795bb5a662ad4377734d11076148b5ac8b358c9492f55c35d63dccd94ca2bb9eac8a9af7fd3017
-
Filesize
8KB
MD55856a4fa3df4f1a22801a77692810053
SHA1fdbeee200686c26456ca02325e8bdc047e8049d9
SHA256f6c52403e3193a2fb874068f9d940707f5fe1def8f4426e261f99866be347546
SHA512c27df4dfdc1b047387398f2fb983fd38e5c89da7317bfa92b418f4ec446c72cac15f103b9cdf5c640089c576526e7bcbc70f70ca42c7c7803f34f2ade8bca99c
-
Filesize
6KB
MD5ae1f72e9f169bb74e8fe4401940dcfae
SHA120b03a0c3ee67972205e4c3e895b738337180306
SHA25693b9a1520d4c6f78f8ee3871335ea2a5ae63ec10bb6e550f617f66a1efeb554f
SHA512a5ab28b9fd7d68b49645f0010add858dbee518cddf587d17543153d2929d6dd58a4518b47c372f1d885f2902c562d13392c8f4dfdc7b574702eb6f08ad0f1561
-
Filesize
8KB
MD571d099c9675f053dade4534f48e28b8d
SHA1957814557c471a376f07390da667cdd4f7e4f96e
SHA25673d17ee659db83d5e4f49bbaa912fd7acafea541800ec95bb0727bded7a4bfb9
SHA5122eae6264b834d7de410fe4f30683286c47ad9bc2803363f4d8fd4d253f6a3b0dceb27a68d1d61f2f14cd5880cb5a31b9d7f5e415eeb6da6658a6d66eecb6b0f1
-
Filesize
11KB
MD5bf6b8215aa5dfd8b69ae4ae9d52f0f22
SHA18a100c1273d35308956fae3d538fe8d4f8203b47
SHA2567a6effca4a71492fed041d40e58901c66ffb8ae3d2e8b373db3560446b39f86f
SHA5124ea89ae733c951c0463e78b47f5eb9c0c84e632a1848751e60d2f19fecd47517577d0905110a2af117d4f7e41c631f56de4dcba4ae0f8bcb98f95adce4765a43
-
Filesize
6KB
MD5e4211d6d009757c078a9fac7ff4f03d4
SHA1019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
SHA51217257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
1.2MB
MD574149621140305aa967ba9ab58094d92
SHA1a79f9b49b02160e3f22b172a896e806c76f1b3ed
SHA256527f47e86bf9655cb572d764af346415eb7093ba3534f729a3fd4f1895306737
SHA51266be34307f7cdc950ae8e497795894f942578336f229598d97ec63b54ba396f7bf8af6c82bd4afdbb669522f8d64660ff4a23c58a7b66a28ee7b0080fdbd2943
-
Filesize
37KB
MD53012a933979dca0677233001009398e7
SHA1f69e2f6fe6c917413a6d43c5b130684d98dc1b27
SHA25635b1a2f3d23bbb681d9f3ba5f84e707b36a4e86359063cef6cbae546fae98fc3
SHA5128692649ed2d64e8b03a1274ac1f429f640578009ae05cd795053b2bdefd64bb13489b1a46ca5bcf2c7e3c82c54199a80760971bba54807a44557f4ac60c5a600
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zoo1d5k8.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5bd13278d2bf51559d9cccb92e7aa205b
SHA13684367eac33eb8a02ae80e42c1853766baadc7b
SHA256b6f9501628e5451919cf176f798f7b9100ae836a13605e0d7e5fa3cf5a17437c
SHA51264b5d4fa46246fb056e9dc58197e814c6ebdd9ffc031f9763e816985079d34eec3e31774ed208cdcfdea1855b3490da95bf7079c732b42f958be967d9ad64573
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zoo1d5k8.default-release\datareporting\glean\pending_pings\63246edd-f3d3-4354-9b58-44f57dcb4617
Filesize11KB
MD583f358d6634515b45e23750504826379
SHA15d9dc3042f549cb5d60fdb06fe666b96e8b51ece
SHA25669cba5860c4782fd657dba28ba3b2e1ef0dfb00c3df4ae68cb40f347cfec0965
SHA5123dcc885bd0134e6755301d069e93c69a0f7014fb15a352ae3c5104f2b0c580f383f4c830ab6e1a5a8999442c532eba5332015819c243ba4544f4735ff1435d1c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zoo1d5k8.default-release\datareporting\glean\pending_pings\6d61cabf-59fb-4aff-b1a2-3f29779a365a
Filesize746B
MD511233ad43c1d75930d18a3120dc41721
SHA15cf7462741c84a4deba041ab5e38d2e6151ceef0
SHA2569634a0802af2c5da83041a3bd199dce9ad27612c5228b8c0114630e3e72065e6
SHA512cc8c20f9dc68afaec79aab78f83dd846f758b04dc691da4e33098822cd9e4edaf40140a0fc38b2144cba8dc282f60543dad4646de0e16c32bec0e1dd3285a100
-
Filesize
6KB
MD562fd9b1b0cc0b84377ed488697160904
SHA1235b0de19475422a015ebfea5ab5ae9a4399a0b0
SHA256bf41ac660588ee4ef97d4523be6a0d4190a0f8c163e73de688520888b5c93a38
SHA5126897883ae82a416afe318207ae933afc5ea2998387030d94bbd8d25f60cd56e203da4d95d51e0a875d2c99182119498f5b8c572d67f4065db77a7d243c8364b3
-
Filesize
6KB
MD56b611b6383aca6824f75c875db8c0900
SHA1c63388a6483701223831e2c733949970a58eee81
SHA256fe6eaf190ff37c3a5882f856960aeb76cc2d0bce57862c99bfa7884352cc3b4c
SHA5125f26861495f8874fc1ea0bd037a3be06c37fdd1a1602c26dfe716bed166c58db4f139fac4a2cd3b58818ab46b723abffc2d511a5530d5ec8fed8374ba9f3b3b7
-
Filesize
6KB
MD548b1940887fd36c46684972188fa0879
SHA1883c9c8050d89f24ab2c95bf349b9bd885538a76
SHA256a219647184209c9f3709030eb6b45e7698ec23b4f10fcb0f24b9fb44a6e0f2ce
SHA512ecc982826303cc124b4be2b8e85a9a28f9b341aa1c47baefca4acc767c261871606e6d46c2686b10336fc8b8f9da883f024e3377967c050c7d517d6ab9384172
-
Filesize
6KB
MD563a008aef5045b5b456c3000a8db81af
SHA1fdcac04535a63afc112814ff8e18100fe431ef6a
SHA256318ec9cc086035ba758795acff385d537def9e5fcce71b8fe7286fcf6ab60aee
SHA512216cd7827c7cdff21d355e0178322dd6e504d9bc511dd52c9c91795f85d78d447f3df593927c9e34226bf0551fabbdf6ac3713f586cbeaddcbb38a00df985e7d
-
Filesize
6KB
MD597205ae5143286170f8cbe935c0c8b12
SHA1f060474669b3b3afe2dedccc0d225cbfb6fc5fe8
SHA2567d719aa8f60b047184220493698c29f002e265a652ae5809ce1419c0539cdd8e
SHA5129707cdd9818e0e635ae841a20baac514a534a99c7a9ab8662d2f6f8c420f551215aecf05784d6c4df9d61b022578f1a99ed2bb82e664207e0529ab1903714fca
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zoo1d5k8.default-release\sessionCheckpoints.json
Filesize193B
MD52ad4fe43dc84c6adbdfd90aaba12703f
SHA128a6c7eff625a2da72b932aa00a63c31234f0e7f
SHA256ecb4133a183cb6c533a1c4ded26b663e2232af77db1a379f9bd68840127c7933
SHA5122ee947dcf3eb05258c7a8c45cb60082a697dbe6d683152fe7117d20f7d3eb2beaaf5656154b379193cdc763d7f2f3b114cf61b4dd0f8a65326e662165ccf89cc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zoo1d5k8.default-release\sessionstore.jsonlz4
Filesize889B
MD529d09c7f72cc5557e2931d7cc8343461
SHA1722413487e9f02eb758ae7608c9abdf4ffbb574d
SHA256ea5b5e8c8763883d48bb7a11b76c37d6285f2b74966d0a0f42fd2e3166561d75
SHA5122ae7dbb1569842eb0888a2d3e4cc723263497a528c6b920920c9da1c3dd419a0bece29b26949ffbe59974bafc20dced7712e7d0e96d7253f35c59e16691d9b36
-
Filesize
11KB
MD5addbdd80080dcd27318a7f797019b218
SHA1f55bdbf8e73d25f72f8aa885d75d02abfe1e3099
SHA2567fff43383fa6cbba9fab1a4e0b2bab90be7404279662c0f53903b375904865f9
SHA5128c4d4d5e725e067ad7a0b82726d5f6680cb1d10a030700e3a3a31c758ac04ffb524efe8a46d6b47d153fdc215fc1da1a527617146a840edff111c9b8b0a858ec