93de0e039b7b8f34b7987d317be105777ae258e272a4b275cf351a962eeb43a5

Analysis

max time kernel
145s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2023, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Size

46.1MB
MD5

bafa2cf09834485d54931abeab5e7aff
SHA1

ccc643cb5f6cc14fab6ee960016e0bc40136cc6e
SHA256

3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b
SHA512

f89aebb667137ab693ae207b7561d0f33f9b7361e89ccfa9f376142dea21e378c6155248df54d7e7217b043dcd03154029d7ceb08b0edbb1e34688e1248fd3f8
SSDEEP

786432:yLeV6x/gqI16Fko4GZnVlLJxmAQ5IljJbCa8u7bvNfKhiJLlEQhvVYZN0tBXbSSO:yKV369ZnVRJxmAQGRCNe1Hx1EZN0rbSF

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\fxvad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\T:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\N:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\V:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\L:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\Q:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\Z:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\I:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\X:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\W:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\SysWOW64\dfx11.ico	msiexec.exe
File created	C:\Windows\SysWOW64\fxsound.ico	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\SET4BF3.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\SET4BF3.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\SET4BF4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.PNF	fxdevcon64.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\fxvadNTAMD64.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\fxvad.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\SET4C05.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\fxvad.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\SET4BF4.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\SET4C05.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvadNTAMD64.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}	DrvInst.exe

Drops file in Program Files directory 46 IoCs

description	ioc	Process
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\1.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\11.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Regular.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\updater.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Medium.ttf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Regular.ttf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Regular.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.sys	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.inf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.sys	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.inf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.inf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\12.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\7.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Bold.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Regular.ttf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\2.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Bold.ttf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Medium.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\FxSound.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvadntx86.cat	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxdevcon32.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\10.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxdevcon32.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvadntx86.cat	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\3.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\5.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Medium.otf	msiexec.exe
File opened for modification	C:\Program Files\FxSound LLC\FxSound\updater.ini	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvadntamd64.cat	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.sys	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\8.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\9.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Bold.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.sys	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxdevcon64.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvadntamd64.cat	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\4.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\6.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Medium.ttf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon64.exe	msiexec.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e590bed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI116D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F2E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2019.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI373E.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e590bed.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2308.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI379D.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\{79EAFA34-4229-481F-8A12-DA3684D138F3}\fxsound.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{79EAFA34-4229-481F-8A12-DA3684D138F3}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI124A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1354.tmp	msiexec.exe
File created	C:\Windows\Installer\e590bf1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{79EAFA34-4229-481F-8A12-DA3684D138F3}\fxsound.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI36B0.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	fxdevcon64.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI147E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI10A1.tmp	msiexec.exe
File created	C:\Windows\INF\c_media.PNF	fxdevcon64.exe

Executes dropped EXE 7 IoCs

pid	Process
4244	fxdevcon64.exe
4820	DfxSetupDrv.exe
1384	fxdevcon64.exe
952	DfxSetupDrv.exe
3252	DfxSetupDrv.exe
844	DfxSetupDrv.exe
3916	FxSound.exe

Loads dropped DLL 15 IoCs

pid	Process
1668	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
5112	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe
4816	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000840d5e5e83918180000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000840d5e50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff0000000007000100006809000840d5e5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff0000000007000100006809190840d5e5000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000840d5e500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4648	schtasks.exe

Modifies data under HKEY_USERS 62 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "2"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e5d54008-0000-0000-0000-d01200000000}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e5d54008-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e5d54008-0000-0000-0000-d01200000000}\MaxCapacity = "12287"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\43AFAE979224F184A821AD63481D833F\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\Version = "16842771"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\FxSound LLC\\FxSound 1.1.19.0\\install\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\SourceList\PackageName = "fxsound.x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\FxSound LLC\\FxSound 1.1.19.0\\install\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\43AFAE979224F184A821AD63481D833F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\43AFAE979224F184A821AD63481D833F\AI64BitFiles	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\43AFAE979224F184A821AD63481D833F\AIOtherFiles	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\ProductName = "FxSound"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\PackageCode = "AA59ACBF2E6134A438049429F09C9EE8"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\ProductIcon = "C:\\Windows\\Installer\\{79EAFA34-4229-481F-8A12-DA3684D138F3}\\fxsound.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B1802AC1A5D0FD14688E728802C43E04	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B1802AC1A5D0FD14688E728802C43E04\43AFAE979224F184A821AD63481D833F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\43AFAE979224F184A821AD63481D833F\SourceList	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4816	MsiExec.exe
4816	MsiExec.exe
1708	msiexec.exe
1708	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3916	FxSound.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1708	msiexec.exe
Token: SeCreateTokenPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeAssignPrimaryTokenPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeLockMemoryPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeIncreaseQuotaPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeMachineAccountPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeTcbPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSecurityPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeTakeOwnershipPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeLoadDriverPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSystemProfilePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSystemtimePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeProfSingleProcessPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeIncBasePriorityPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeCreatePagefilePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeCreatePermanentPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeBackupPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeRestorePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeShutdownPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeDebugPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeAuditPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSystemEnvironmentPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeChangeNotifyPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeRemoteShutdownPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeUndockPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSyncAgentPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeEnableDelegationPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeManageVolumePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeImpersonatePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeCreateGlobalPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeCreateTokenPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeAssignPrimaryTokenPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeLockMemoryPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeIncreaseQuotaPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeMachineAccountPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeTcbPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSecurityPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeTakeOwnershipPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeLoadDriverPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSystemProfilePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSystemtimePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeProfSingleProcessPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeIncBasePriorityPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeCreatePagefilePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeCreatePermanentPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeBackupPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeRestorePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeShutdownPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeDebugPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeAuditPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSystemEnvironmentPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeChangeNotifyPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeRemoteShutdownPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeUndockPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeSyncAgentPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeEnableDelegationPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeManageVolumePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeImpersonatePrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeCreateGlobalPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeCreateTokenPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeAssignPrimaryTokenPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeLockMemoryPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeIncreaseQuotaPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
Token: SeMachineAccountPrivilege	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
4740	msiexec.exe
3916	FxSound.exe
3916	FxSound.exe
4740	msiexec.exe
3916	FxSound.exe
3916	FxSound.exe
3916	FxSound.exe
3916	FxSound.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3916	FxSound.exe
3916	FxSound.exe
3916	FxSound.exe
3916	FxSound.exe
3916	FxSound.exe
3916	FxSound.exe
3916	FxSound.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3916	FxSound.exe
3916	FxSound.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1668	1708	msiexec.exe	89
PID 1708 wrote to memory of 1668	1708	msiexec.exe	89
PID 1708 wrote to memory of 1668	1708	msiexec.exe	89
PID 4076 wrote to memory of 4740	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe	91
PID 4076 wrote to memory of 4740	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe	91
PID 4076 wrote to memory of 4740	4076	3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe	91
PID 1708 wrote to memory of 1528	1708	msiexec.exe	101
PID 1708 wrote to memory of 1528	1708	msiexec.exe	101
PID 1708 wrote to memory of 4816	1708	msiexec.exe	103
PID 1708 wrote to memory of 4816	1708	msiexec.exe	103
PID 1708 wrote to memory of 4816	1708	msiexec.exe	103
PID 1708 wrote to memory of 5112	1708	msiexec.exe	105
PID 1708 wrote to memory of 5112	1708	msiexec.exe	105
PID 1708 wrote to memory of 5112	1708	msiexec.exe	105
PID 4816 wrote to memory of 4244	4816	MsiExec.exe	107
PID 4816 wrote to memory of 4244	4816	MsiExec.exe	107
PID 4816 wrote to memory of 4820	4816	MsiExec.exe	109
PID 4816 wrote to memory of 4820	4816	MsiExec.exe	109
PID 4816 wrote to memory of 4820	4816	MsiExec.exe	109
PID 4816 wrote to memory of 1384	4816	MsiExec.exe	111
PID 4816 wrote to memory of 1384	4816	MsiExec.exe	111
PID 4080 wrote to memory of 4860	4080	svchost.exe	114
PID 4080 wrote to memory of 4860	4080	svchost.exe	114
PID 4080 wrote to memory of 1876	4080	svchost.exe	115
PID 4080 wrote to memory of 1876	4080	svchost.exe	115
PID 4816 wrote to memory of 952	4816	MsiExec.exe	116
PID 4816 wrote to memory of 952	4816	MsiExec.exe	116
PID 4816 wrote to memory of 952	4816	MsiExec.exe	116
PID 4816 wrote to memory of 3252	4816	MsiExec.exe	119
PID 4816 wrote to memory of 3252	4816	MsiExec.exe	119
PID 4816 wrote to memory of 3252	4816	MsiExec.exe	119
PID 4816 wrote to memory of 844	4816	MsiExec.exe	121
PID 4816 wrote to memory of 844	4816	MsiExec.exe	121
PID 4816 wrote to memory of 844	4816	MsiExec.exe	121
PID 4816 wrote to memory of 4744	4816	MsiExec.exe	123
PID 4816 wrote to memory of 4744	4816	MsiExec.exe	123
PID 4816 wrote to memory of 4744	4816	MsiExec.exe	123
PID 4816 wrote to memory of 4648	4816	MsiExec.exe	125
PID 4816 wrote to memory of 4648	4816	MsiExec.exe	125
PID 4816 wrote to memory of 4648	4816	MsiExec.exe	125
PID 1708 wrote to memory of 3916	1708	msiexec.exe	127
PID 1708 wrote to memory of 3916	1708	msiexec.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe
"C:\Users\Admin\AppData\Local\Temp\3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe"
1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.1.19.0\install\fxsound.x64.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\3b6427a62678dfdf9370d0b85a0da6a02cebf4e047c7e86c7b2c0208a2c5283b.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1689837661 " AI_EUIMSI=""
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:4740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C8439836E7FA128900B62AC62246DE95 C
  2⤵
  - Loads dropped DLL
  PID:1668
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1528
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 782B630220E95BF2317807E7EF56CD18
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
    "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" remove *DFX12
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4244
- - C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
    "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" check
    3⤵
    - Executes dropped EXE
    PID:4820
- - C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
    "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" install "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:1384
- - C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
    "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" getguid
    3⤵
    - Executes dropped EXE
    PID:952
- - C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
    "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" setname
    3⤵
    - Executes dropped EXE
    PID:3252
- - C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
    "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" defaultbuffersize
    3⤵
    - Executes dropped EXE
    PID:844
- - C:\Windows\SysWOW64\powercfg.exe
    powercfg -REQUESTSOVERRIDE DRIVER "FxSound Audio Enhancer" SYSTEM
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc daily /tn "FxSound\Update" /tr "C:\Program Files\FxSound LLC\FxSound\updater.exe /silent" /st 10:00 /f
    3⤵
    - Creates scheduled task(s)
    PID:4648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C0E287A0033BC259A3D56DCFE75F69E2 E Global\MSI0000
  2⤵
  - Drops desktop.ini file(s)
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:5112
- C:\Program Files\FxSound LLC\FxSound\FxSound.exe
  "C:\Program Files\FxSound LLC\FxSound\\FxSound.exe" @
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4f393f9f-5f8c-5a4a-a835-0dbd4b731359}\fxvad.inf" "9" "4143399a7" "0000000000000144" "WinSta0\Default" "0000000000000154" "208" "c:\program files\fxsound llc\fxsound\drivers\win10\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4860
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca115cc2c934:DFX_Device:14.1.0.0:root\fxvad," "4143399a7" "0000000000000144"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:1876

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550 0x554
1⤵
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e590bf0.rbs

Filesize
1.3MB

MD5
5520071ba663589166780ef804d25aa7

SHA1
e4fcb790fb14d9cf78caa4ea9018cc9e54db7da9

SHA256
308ea1766b131bb5849b0b970c632cfbca9260654ca72ee3341f3dec660c1beb

SHA512
6b33febb4170eddfa872bdc7c31bb0c811640efb12a18a21b294f6f65a587870f6ee83e4c5d5d284ab80bac6ebf9588708a12dc148a0960db7b3213ef744f69a

Download Submit
C:\Config.Msi\e590bf2.rbs

Filesize
516B

MD5
7bde943590b6676bcf2bfc3d3a838a15

SHA1
da7f8a7cbed2adce3fe4d3a2c3a585340f1788c0

SHA256
7f98a2bf0671c71ed20276d825a979125ddbcf18527f31eb7ce455ee67705632

SHA512
7aa18fec680d42c7742aa148c4df0ad1cd059099a1f653c95530e75291ba84013a7fb0909a205576816527102f35cf81d1fc4e2c46a487d437d2f70bbf0fd533

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

Filesize
125KB

MD5
e9661e4c7ae38de16e6d0390d598b7a9

SHA1
20b37ed149a500082c4968a34fddfcaa5ad8fbe4

SHA256
41cd092659510e0df926131a11ed704916369e6baa372ea433f33dc7d2df029b

SHA512
ca15902cefe78b42b85ab1715494072afa7d7e347efb671d0eaf27290bae0dc31d3156421d2389d825959f38c9afce9b22e02064feb57f07a01ecc9c486d53c6

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

Filesize
125KB

MD5
e9661e4c7ae38de16e6d0390d598b7a9

SHA1
20b37ed149a500082c4968a34fddfcaa5ad8fbe4

SHA256
41cd092659510e0df926131a11ed704916369e6baa372ea433f33dc7d2df029b

SHA512
ca15902cefe78b42b85ab1715494072afa7d7e347efb671d0eaf27290bae0dc31d3156421d2389d825959f38c9afce9b22e02064feb57f07a01ecc9c486d53c6

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

Filesize
125KB

MD5
e9661e4c7ae38de16e6d0390d598b7a9

SHA1
20b37ed149a500082c4968a34fddfcaa5ad8fbe4

SHA256
41cd092659510e0df926131a11ed704916369e6baa372ea433f33dc7d2df029b

SHA512
ca15902cefe78b42b85ab1715494072afa7d7e347efb671d0eaf27290bae0dc31d3156421d2389d825959f38c9afce9b22e02064feb57f07a01ecc9c486d53c6

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

Filesize
125KB

MD5
e9661e4c7ae38de16e6d0390d598b7a9

SHA1
20b37ed149a500082c4968a34fddfcaa5ad8fbe4

SHA256
41cd092659510e0df926131a11ed704916369e6baa372ea433f33dc7d2df029b

SHA512
ca15902cefe78b42b85ab1715494072afa7d7e347efb671d0eaf27290bae0dc31d3156421d2389d825959f38c9afce9b22e02064feb57f07a01ecc9c486d53c6

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

Filesize
65KB

MD5
cdaf204f530a59c34adb749ee3ebeb7a

SHA1
33969bd65d04c2b6e8c0f24d3e161851f65a6b6f

SHA256
8f0b5e39c91845936e811afb2bc8442d556d39ce61a749c432ab50479e3d0259

SHA512
9200cb34c125f52e7afd40bb92b6abc33534125146c6bf28a0c63d953bf368a06713c9586b0fece32e9fdd748dacb55dedc6136e24a491789485a133317946ec

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

Filesize
65KB

MD5
cdaf204f530a59c34adb749ee3ebeb7a

SHA1
33969bd65d04c2b6e8c0f24d3e161851f65a6b6f

SHA256
8f0b5e39c91845936e811afb2bc8442d556d39ce61a749c432ab50479e3d0259

SHA512
9200cb34c125f52e7afd40bb92b6abc33534125146c6bf28a0c63d953bf368a06713c9586b0fece32e9fdd748dacb55dedc6136e24a491789485a133317946ec

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

Filesize
65KB

MD5
cdaf204f530a59c34adb749ee3ebeb7a

SHA1
33969bd65d04c2b6e8c0f24d3e161851f65a6b6f

SHA256
8f0b5e39c91845936e811afb2bc8442d556d39ce61a749c432ab50479e3d0259

SHA512
9200cb34c125f52e7afd40bb92b6abc33534125146c6bf28a0c63d953bf368a06713c9586b0fece32e9fdd748dacb55dedc6136e24a491789485a133317946ec

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

Filesize
65KB

MD5
cdaf204f530a59c34adb749ee3ebeb7a

SHA1
33969bd65d04c2b6e8c0f24d3e161851f65a6b6f

SHA256
8f0b5e39c91845936e811afb2bc8442d556d39ce61a749c432ab50479e3d0259

SHA512
9200cb34c125f52e7afd40bb92b6abc33534125146c6bf28a0c63d953bf368a06713c9586b0fece32e9fdd748dacb55dedc6136e24a491789485a133317946ec

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

Filesize
65KB

MD5
cdaf204f530a59c34adb749ee3ebeb7a

SHA1
33969bd65d04c2b6e8c0f24d3e161851f65a6b6f

SHA256
8f0b5e39c91845936e811afb2bc8442d556d39ce61a749c432ab50479e3d0259

SHA512
9200cb34c125f52e7afd40bb92b6abc33534125146c6bf28a0c63d953bf368a06713c9586b0fece32e9fdd748dacb55dedc6136e24a491789485a133317946ec

Download Submit
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Filesize
263KB

MD5
27a12bd5369bf1633913713bae44d607

SHA1
7138b211311986acbe05f66cf45ab6ae28931afd

SHA256
9c74c701815fb5093aee1e991741463ef34ffdf14f4be4218e6e46e776e87c3a

SHA512
a59de01874e6931df5f053d7b831f85449f205932bed012b84cd0a827f92b720c45d6d55bdcab07788d2059d624184dd331c40c8c7a19f2c5536c6062db836cd

Download Submit
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Filesize
263KB

MD5
27a12bd5369bf1633913713bae44d607

SHA1
7138b211311986acbe05f66cf45ab6ae28931afd

SHA256
9c74c701815fb5093aee1e991741463ef34ffdf14f4be4218e6e46e776e87c3a

SHA512
a59de01874e6931df5f053d7b831f85449f205932bed012b84cd0a827f92b720c45d6d55bdcab07788d2059d624184dd331c40c8c7a19f2c5536c6062db836cd

Download Submit
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Filesize
263KB

MD5
27a12bd5369bf1633913713bae44d607

SHA1
7138b211311986acbe05f66cf45ab6ae28931afd

SHA256
9c74c701815fb5093aee1e991741463ef34ffdf14f4be4218e6e46e776e87c3a

SHA512
a59de01874e6931df5f053d7b831f85449f205932bed012b84cd0a827f92b720c45d6d55bdcab07788d2059d624184dd331c40c8c7a19f2c5536c6062db836cd

Download Submit
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\1.fac

Filesize
944B

MD5
f27ea21512686da8e8c90e0a4d0f5616

SHA1
3231a236c4d517197e28413eed3f5ac74d557cd7

SHA256
b9ff4bad7f89d0fdb9032b6aea475a04fac8c1eec39020fa00db3cd72b91e1fb

SHA512
45911c28bc677c223baaf46b6cf1e12edce56bf9584fc3317535d8b3be1ae0f402847c7ddd2d1e7e6dfc01c4c24d04965dc475b9419a85d7a703685335559db9

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\10.fac

Filesize
963B

MD5
10a1b6c5a17f64d377394251c816fd73

SHA1
3a54dbcb969269f9b4b63a0a72fec51f9c1f2fd7

SHA256
5da7f6318249417a1edf02d133ed5543334389ce42e75cb904a311c680ef0d33

SHA512
dc32487cc4488f114c03605702f496aff597797d1469fc246561f6c9055a4691b5e3af6d1bcffcad6344310b1c1fea27f70473d2c7a1f6be6711d37047227c41

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\11.fac

Filesize
961B

MD5
038e70d0b0223598b6f11890c7a39da1

SHA1
e790ca1456f895c6ef3a112bcea575fc1f3a1006

SHA256
d05ed165422959c5f6b4c2b25fbe84b3bb0aa9bbdb72a6b0123bcb7cc2fb3cea

SHA512
02bf6cd53ae7d2f1b9de9868454a8937d72a787227496fe2d07f75aa296aa3fe71464e0ed610ef974e73c0f3e8b51939ce43c6563f2cda958b7a7964df42fbf9

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\12.fac

Filesize
955B

MD5
eec389c321a0f4e18d568d9eb52d4a4a

SHA1
46555a411d1dbe75b4994b0d9c44c21b72243edd

SHA256
33e8695f8dedd7e7f4ed640c8f6412c1898d2a06489aad41c09f0326bdc08db7

SHA512
b61d04d025cf4cc2b1fe8cb5881f57bb0c2dd0b3fab2f47548d433d6ee2b2419838379daf115fdd9f0c797c9de8366c21a6dba1bab7c6f1e5cc9f2afa656bbb4

Download Submit
C:\Program Files\FxSound LLC\FxSound\FxSound.exe

Filesize
4.4MB

MD5
3f203b0a5bf49205ad8ce2466e218406

SHA1
cef8dbffb60e6032ebad4c60de291a581aa9dc12

SHA256
f77998f9b7d4168d79d45dacf4218e27982fe545fd1f9f1fc7163e06af48f1dd

SHA512
a1b4af65d1bece81806956a3f5e3823b390934d719aade129910260f13540e48ff03958069128bc8015ff3acedec41f83c545d746b065ca7c5bc3fd3ea5d9a2e

Download Submit
C:\Program Files\FxSound LLC\FxSound\FxSound.exe

Filesize
4.4MB

MD5
3f203b0a5bf49205ad8ce2466e218406

SHA1
cef8dbffb60e6032ebad4c60de291a581aa9dc12

SHA256
f77998f9b7d4168d79d45dacf4218e27982fe545fd1f9f1fc7163e06af48f1dd

SHA512
a1b4af65d1bece81806956a3f5e3823b390934d719aade129910260f13540e48ff03958069128bc8015ff3acedec41f83c545d746b065ca7c5bc3fd3ea5d9a2e

Download Submit
C:\Program Files\FxSound LLC\FxSound\FxSound.exe

Filesize
4.4MB

MD5
3f203b0a5bf49205ad8ce2466e218406

SHA1
cef8dbffb60e6032ebad4c60de291a581aa9dc12

SHA256
f77998f9b7d4168d79d45dacf4218e27982fe545fd1f9f1fc7163e06af48f1dd

SHA512
a1b4af65d1bece81806956a3f5e3823b390934d719aade129910260f13540e48ff03958069128bc8015ff3acedec41f83c545d746b065ca7c5bc3fd3ea5d9a2e

Download Submit
C:\ProgramData\FxSound\FxSound.settings

Filesize
175B

MD5
f2f8970055b8f730b1a32c5409928586

SHA1
0b5731088013ffca3098cfc6b0800d060020555e

SHA256
c90a67fb8ae7fee6f2896488bfc5784ed5d48316576d3ef38cb7ec162dc6e1e6

SHA512
9fa64b53f19a01c26f6b67a325a046975109477895c1feb93e245041ecc59b2ba52cf2161ca175d6016c60002a6c6257615d0c66abf0feefab6a88a448e3a175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
a5b25c6cd8b02cab1af43b861ddf4993

SHA1
759c824e4655c2c37df8bec8ca0faa9a9d43ed44

SHA256
cd6110f51b57739072ea7d5916919255870e1329f53285a284f35aa0156c85af

SHA512
7447d75eb88d86b3d00f290dc2ed932b6ac22424bf629be66a77356baa9e4f363b21154e99182c0cb21f550c2412eca373a0b77102192d1660bc34b1c3aaf196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_E252B53EA9CC5918F5B21362730734A5

Filesize
727B

MD5
89654e070007df4b15524dd617adf4f7

SHA1
1746be6125d07d99adebd8fff5936e309e8b2ea7

SHA256
4a14fd9ce1fb3f4a04e0aa6c93469c0963dda071c40ee22be6c2dbb18831027d

SHA512
e1ba49f241afb2d90220e7f88d8a092f3bdacbe4e49967245b9a826d394d0c44efae5839e3d987f1cd9a5af013b966f91e65ccb7e805d38f07a38e6a53c93c82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
f870faf681eadcdd940a8535177edcdf

SHA1
f6bf952be6da4fc5d1296607f8f896e73f4cf9b5

SHA256
96708ba8e8dfef92c45169898dd7dc1d5b20b487eef0917fe6d5badf87288594

SHA512
6899b2a9e99575caf445f3e87ab5760b7f669564e0b49e03592dd023bb349ecf0b5aa52537b313b63df2f9b5cc88e4527a9fc29d71edd8b5c024bdb517c2fd14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
9a0479530f46177115a40811e2be5821

SHA1
aeca85e54b1491fe6d895dd3af99f2f6f1eeb035

SHA256
79b09c736664d01030734655e0bce3385731fa12e124a50efa51053f4a9121a0

SHA512
c9364489449c8b69ebc0802c982c40b4b53994ad8bf5df23087760eaa295c752141c23968af1e3f38745180960ae06218a0b9160999d66401288162ebfed5b19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_E252B53EA9CC5918F5B21362730734A5

Filesize
404B

MD5
e6ecc177a723f487a104430441ae65f2

SHA1
4f7163644a9777fde8d2007d8b4b0c1c9ea3ce4a

SHA256
15c3a580aa5d63be439083d390fa996db3fbbba29aa169e9be3d5c9d530dcdc5

SHA512
703b999ea44a9a60f4fe33129db12d44381bdb8a56f7133e5883b035e38aeed642d841c8d20ec3dc9fbea864ad7696903f02aeeb09a78a6f29bf64ef21e0fda0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
e0b88581bf4a0ed1eeb16327fa61e4ce

SHA1
e6b7b22352543ca8653bda0369a5b29d51e19a55

SHA256
160da942ff5e5f6aa2ee5fcbfdbcc4319642eb9bb82a800291ea8dcc677948b8

SHA512
7a5faaf8d69c1d63d6e00914cadb21774ff864308e172ea9db808d27ac5ddfc2a1abf93beebb14bb9fe962d07be9067d86aa2139dedde70fdda7eb1bf2ea14c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AiFilesBackNoImpers_79EAFA34_4229_481F_8A12_DA3684D138F3.bak

Filesize
653B

MD5
d4510d7bdc6c2ccb67681856a8c91726

SHA1
0ea824ee65d20bfea9d74441a9d68e8a7b71e070

SHA256
06f1b84ab60f52b9d368c94dda8e6e0520f389fc4cc71a4d14fe06732f2ce6eb

SHA512
bc7bd3a74a918026e430f476cce3a17b7720459a9e7f5aa9bbdf9022613da6a8294853f5477b6ca89126adbffe256e534cff66f9146bfe69c3059f189edce4f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3B02.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3B02.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI83da0.LOG

Filesize
23KB

MD5
5e4b4fc7244666dfc67a7650515de777

SHA1
b9887b906009c3543170dc8b946ad7836064533d

SHA256
9d8b053f6e7c4274c3cd4ee103f68c6e0992c63bb0b01ef26229cf80e59cda98

SHA512
dfd3070142e535f76e49e4e838c5e17934ebef4d19030f2ae579b1081337066cd30c2d1f17de8a710563cb038811ba3d92b4e39d2cea2fe717a63f2eb25a65c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4F393~1\fxvad.sys

Filesize
319KB

MD5
eaf913c1de47c2421669b662edaa5a6a

SHA1
53524526e1898a90fa98ae02e662b9c0e6dc2848

SHA256
425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a

SHA512
bb674feb73751172a1ace65aab89c5ebf952a07f7af0f3ec1dadf357ff693230cf08910ae273e8335eec35e5827da6405272d05c161987df679199935af21a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4F393~1\fxvadNTAMD64.cat

Filesize
10KB

MD5
acdaae5d1219e7703285c42f774be54d

SHA1
47df82d8c843bf1adc098a26e9e3e27217b3104d

SHA256
25c8dae186155d20f74feedefb4f84161e4215925b8fd0c898f68f3e50ebcd7d

SHA512
83b663222fb22b1760ea8551d19557f3f2905bfac205b380b23dd7f2a65a37b851a3c3c345e4a768b76700bb891b97c96a0dbbb58d81358993293ad1eb3e300a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4f393f9f-5f8c-5a4a-a835-0dbd4b731359}\fxvad.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4f393f9f-5f8c-5a4a-a835-0dbd4b731359}\fxvad.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.1.19.0\install\fxsound.x64.msi

Filesize
2.7MB

MD5
eb0ae37f73e9da3fa2cf605f9e99cc0c

SHA1
ef69383e94d0bb3d8543926c31dfdda84c492f90

SHA256
c9e3288999da0c2300f4069ed21d8d98ac1091857c8000b14b2e2da2c5b1d6ec

SHA512
9e937ecdb457133fc08d78ef58969b4795f337ce950dca2cc3a6883dfcfade98889ceebe437242275606094e96c09406e58fbce203054b6f9411e2a218bcdfe3

Download Submit
C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.1.19.0\install\fxsound.x64.msi

Filesize
2.7MB

MD5
eb0ae37f73e9da3fa2cf605f9e99cc0c

SHA1
ef69383e94d0bb3d8543926c31dfdda84c492f90

SHA256
c9e3288999da0c2300f4069ed21d8d98ac1091857c8000b14b2e2da2c5b1d6ec

SHA512
9e937ecdb457133fc08d78ef58969b4795f337ce950dca2cc3a6883dfcfade98889ceebe437242275606094e96c09406e58fbce203054b6f9411e2a218bcdfe3

Download Submit
C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.1.19.0\install\fxsound1.cab

Filesize
37.6MB

MD5
ad75dfc3fff22b0b1b8014f9dc1caadd

SHA1
4463134f5fd9a279c59e6c2baa24920b7f6cec57

SHA256
f1abde175812808f5d2786cea966ff1c058cd9601817117a9e06f401cc6d60ab

SHA512
81f6d8cd8e606b431bbaeabfce459e9139e69f28d5030e0ca93a5a38f976a8399711af55f38d0d96bd401e9b06717aae98d95161259b030ad3c3996958ecd0bc

Download Submit
C:\Windows\INF\oem3.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Windows\Installer\MSI10A1.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI10A1.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI10A1.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI116D.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI116D.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI11FB.tmp

Filesize
632KB

MD5
9b4b4ea6509e4db1e2a8f09a7c6f8f04

SHA1
512880abe3c9696edb042599bd199f1d05210aa2

SHA256
3774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94

SHA512
63b4788a3ad000c08582f55532dc06bf88bc4111837a63e8157e0f5f668225f46758f9481b6e526a5a813f4f0cc9be65fb4107d2135c61083274592af03ba608

Download Submit
C:\Windows\Installer\MSI11FB.tmp

Filesize
632KB

MD5
9b4b4ea6509e4db1e2a8f09a7c6f8f04

SHA1
512880abe3c9696edb042599bd199f1d05210aa2

SHA256
3774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94

SHA512
63b4788a3ad000c08582f55532dc06bf88bc4111837a63e8157e0f5f668225f46758f9481b6e526a5a813f4f0cc9be65fb4107d2135c61083274592af03ba608

Download Submit
C:\Windows\Installer\MSI124A.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI124A.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI1354.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI1354.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI147E.tmp

Filesize
632KB

MD5
9b4b4ea6509e4db1e2a8f09a7c6f8f04

SHA1
512880abe3c9696edb042599bd199f1d05210aa2

SHA256
3774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94

SHA512
63b4788a3ad000c08582f55532dc06bf88bc4111837a63e8157e0f5f668225f46758f9481b6e526a5a813f4f0cc9be65fb4107d2135c61083274592af03ba608

Download Submit
C:\Windows\Installer\MSI147E.tmp

Filesize
632KB

MD5
9b4b4ea6509e4db1e2a8f09a7c6f8f04

SHA1
512880abe3c9696edb042599bd199f1d05210aa2

SHA256
3774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94

SHA512
63b4788a3ad000c08582f55532dc06bf88bc4111837a63e8157e0f5f668225f46758f9481b6e526a5a813f4f0cc9be65fb4107d2135c61083274592af03ba608

Download Submit
C:\Windows\Installer\MSI1F2E.tmp

Filesize
680KB

MD5
b9361041d9a1a274127103ab5ed720fa

SHA1
2ba4a0e099cddeb735eca71dca0b0a181681e093

SHA256
771b051df9dac27142ed38e72b0eec15749af8e130972a2b0e827426145add4b

SHA512
bb698af68eeed4f3a1881a57e3dd19cf18151443439c6a908215c7b4ce972f813db73ff856a7533e80716f836747bf45160708fa9bb8dc66272557a1bc18e073

Download Submit
C:\Windows\Installer\MSI1F2E.tmp

Filesize
680KB

MD5
b9361041d9a1a274127103ab5ed720fa

SHA1
2ba4a0e099cddeb735eca71dca0b0a181681e093

SHA256
771b051df9dac27142ed38e72b0eec15749af8e130972a2b0e827426145add4b

SHA512
bb698af68eeed4f3a1881a57e3dd19cf18151443439c6a908215c7b4ce972f813db73ff856a7533e80716f836747bf45160708fa9bb8dc66272557a1bc18e073

Download Submit
C:\Windows\Installer\MSI2019.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI2019.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI373E.tmp

Filesize
680KB

MD5
b9361041d9a1a274127103ab5ed720fa

SHA1
2ba4a0e099cddeb735eca71dca0b0a181681e093

SHA256
771b051df9dac27142ed38e72b0eec15749af8e130972a2b0e827426145add4b

SHA512
bb698af68eeed4f3a1881a57e3dd19cf18151443439c6a908215c7b4ce972f813db73ff856a7533e80716f836747bf45160708fa9bb8dc66272557a1bc18e073

Download Submit
C:\Windows\Installer\MSI373E.tmp

Filesize
680KB

MD5
b9361041d9a1a274127103ab5ed720fa

SHA1
2ba4a0e099cddeb735eca71dca0b0a181681e093

SHA256
771b051df9dac27142ed38e72b0eec15749af8e130972a2b0e827426145add4b

SHA512
bb698af68eeed4f3a1881a57e3dd19cf18151443439c6a908215c7b4ce972f813db73ff856a7533e80716f836747bf45160708fa9bb8dc66272557a1bc18e073

Download Submit
C:\Windows\Installer\MSI379D.tmp

Filesize
680KB

MD5
b9361041d9a1a274127103ab5ed720fa

SHA1
2ba4a0e099cddeb735eca71dca0b0a181681e093

SHA256
771b051df9dac27142ed38e72b0eec15749af8e130972a2b0e827426145add4b

SHA512
bb698af68eeed4f3a1881a57e3dd19cf18151443439c6a908215c7b4ce972f813db73ff856a7533e80716f836747bf45160708fa9bb8dc66272557a1bc18e073

Download Submit
C:\Windows\Installer\MSI379D.tmp

Filesize
680KB

MD5
b9361041d9a1a274127103ab5ed720fa

SHA1
2ba4a0e099cddeb735eca71dca0b0a181681e093

SHA256
771b051df9dac27142ed38e72b0eec15749af8e130972a2b0e827426145add4b

SHA512
bb698af68eeed4f3a1881a57e3dd19cf18151443439c6a908215c7b4ce972f813db73ff856a7533e80716f836747bf45160708fa9bb8dc66272557a1bc18e073

Download Submit
C:\Windows\Installer\MSI379D.tmp

Filesize
680KB

MD5
b9361041d9a1a274127103ab5ed720fa

SHA1
2ba4a0e099cddeb735eca71dca0b0a181681e093

SHA256
771b051df9dac27142ed38e72b0eec15749af8e130972a2b0e827426145add4b

SHA512
bb698af68eeed4f3a1881a57e3dd19cf18151443439c6a908215c7b4ce972f813db73ff856a7533e80716f836747bf45160708fa9bb8dc66272557a1bc18e073

Download Submit
C:\Windows\Installer\MSIFA6.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSIFA6.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\System32\DriverStore\FileRepository\FXVAD~1.INF\fxvad.sys

Filesize
319KB

MD5
eaf913c1de47c2421669b662edaa5a6a

SHA1
53524526e1898a90fa98ae02e662b9c0e6dc2848

SHA256
425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a

SHA512
bb674feb73751172a1ace65aab89c5ebf952a07f7af0f3ec1dadf357ff693230cf08910ae273e8335eec35e5827da6405272d05c161987df679199935af21a76

Download Submit
C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\SET4BF3.tmp

Filesize
10KB

MD5
acdaae5d1219e7703285c42f774be54d

SHA1
47df82d8c843bf1adc098a26e9e3e27217b3104d

SHA256
25c8dae186155d20f74feedefb4f84161e4215925b8fd0c898f68f3e50ebcd7d

SHA512
83b663222fb22b1760ea8551d19557f3f2905bfac205b380b23dd7f2a65a37b851a3c3c345e4a768b76700bb891b97c96a0dbbb58d81358993293ad1eb3e300a

Download Submit
C:\Windows\System32\DriverStore\Temp\{f9bf817b-ba67-ce41-83a5-0f4d7a37f8a2}\SET4C05.tmp

Filesize
319KB

MD5
eaf913c1de47c2421669b662edaa5a6a

SHA1
53524526e1898a90fa98ae02e662b9c0e6dc2848

SHA256
425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a

SHA512
bb674feb73751172a1ace65aab89c5ebf952a07f7af0f3ec1dadf357ff693230cf08910ae273e8335eec35e5827da6405272d05c161987df679199935af21a76

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
3c912ae895ee3eb0d7a4b1bb36d2d117

SHA1
e7ed332d1bf395e945b339e3f1974944ba04a21a

SHA256
c4acd0e291221c5295d2f68c74a70ed54f2459b5051c7792a31709db676a2b8e

SHA512
3a7f9b179b9d067863af6c582f364410f96a46ff6383e40f89ebde43bc4ec5215c17809d7e77bf7c31822497d2e74e172519e6cde5a01c3e920432579c80a390

Download Submit
\??\Volume{e5d54008-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3c8a3a54-1272-4ce9-8e1e-2fb3aae23e5a}_OnDiskSnapshotProp

Filesize
5KB

MD5
2ac8b6203bea289fab8366da891374ed

SHA1
1e80d63a3339bf0224ad0293565380fada44d283

SHA256
6aa4c2dae388a9600212a38162a4fd94e16c2007dffbeeabb0b98a2e7b91a876

SHA512
5ecca1f1f54a413b6d537544e719039405b757d1cbfede0c11545fad3b0777adc4f4ce34c1484a72b05f927b55b06c10ee39d2ca37d152ce2f9bc96cb6a86569

Download Submit
\??\c:\PROGRA~1\FXSOUN~1\fxsound\drivers\win10\x64\fxvad.sys

Filesize
319KB

MD5
eaf913c1de47c2421669b662edaa5a6a

SHA1
53524526e1898a90fa98ae02e662b9c0e6dc2848

SHA256
425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a

SHA512
bb674feb73751172a1ace65aab89c5ebf952a07f7af0f3ec1dadf357ff693230cf08910ae273e8335eec35e5827da6405272d05c161987df679199935af21a76

Download Submit
\??\c:\program files\fxsound llc\fxsound\drivers\win10\x64\fxvadNTAMD64.cat

Filesize
10KB

MD5
acdaae5d1219e7703285c42f774be54d

SHA1
47df82d8c843bf1adc098a26e9e3e27217b3104d

SHA256
25c8dae186155d20f74feedefb4f84161e4215925b8fd0c898f68f3e50ebcd7d

SHA512
83b663222fb22b1760ea8551d19557f3f2905bfac205b380b23dd7f2a65a37b851a3c3c345e4a768b76700bb891b97c96a0dbbb58d81358993293ad1eb3e300a

Download Submit