3541df625affa384feacf3cd3d64c47d2372eab9a2055d57dde08afe7f85862c

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fxsound_setup.exe
Size

44.7MB
MD5

9ea725e3e3bc82249957cc00b74c4882
SHA1

3291c62ff7f044dabe2809317df09ae451384cd1
SHA256

3541df625affa384feacf3cd3d64c47d2372eab9a2055d57dde08afe7f85862c
SHA512

a9530ec03f952e38f51cb2af65ebc72d577322b63031ce6279085116ac413574ccfd839774195d50cd0909525e1ec403b40d4d5738b1ef2b5ec3af916d339234
SSDEEP

786432:+LehHAuWfgcKbjylyM5fZFKlG4GjIKNnSTAk5jDSUfzTm8/t4zdahXZBHHAIK:+KOuG1KEyM5fZdxjIKNnEZDFLf/SJ+XO

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\portcls.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\drivers\fxvad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\drmk.sys	DrvInst.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	fxsound_setup.exe
File opened (read-only)	\??\U:	fxsound_setup.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	fxsound_setup.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	fxsound_setup.exe
File opened (read-only)	\??\V:	fxsound_setup.exe
File opened (read-only)	\??\X:	fxsound_setup.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	fxsound_setup.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	fxsound_setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	fxsound_setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	fxsound_setup.exe
File opened (read-only)	\??\P:	fxsound_setup.exe
File opened (read-only)	\??\Y:	fxsound_setup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	fxsound_setup.exe
File opened (read-only)	\??\O:	fxsound_setup.exe
File opened (read-only)	\??\T:	fxsound_setup.exe
File opened (read-only)	\??\Z:	fxsound_setup.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	fxsound_setup.exe
File opened (read-only)	\??\W:	fxsound_setup.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	fxsound_setup.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	fxsound_setup.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	fxsound_setup.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	fxsound_setup.exe
File opened (read-only)	\??\Q:	fxsound_setup.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\SET95.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvadNTAMD64.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\SET84.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\fxvad.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\SET84.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.sys	DrvInst.exe
File created	C:\Windows\SysWOW64\fxsound.ico	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\fxvadNTAMD64.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\fxvad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}	DrvInst.exe
File created	C:\Windows\SysWOW64\dfx11.ico	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\SET73.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.PNF	fxdevcon64.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\SET73.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\SET95.tmp	DrvInst.exe

Drops file in Program Files directory 46 IoCs

description	ioc	Process
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.inf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\11.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\12.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\4.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\FxSound.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxdevcon32.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxdevcon64.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.sys	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\6.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Medium.ttf	msiexec.exe
File opened for modification	C:\Program Files\FxSound LLC\FxSound\updater.ini	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Medium.ttf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Bold.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.sys	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\2.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\8.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Bold.ttf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\1.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\7.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\MontserratAlternates-Regular.ttf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Regular.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvad.inf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x64\fxvadntamd64.cat	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvadntx86.cat	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansThai-Regular.ttf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxvad.sys	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.sys	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvad.inf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\updater.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\3.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\9.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Medium.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win7\x86\fxdevcon32.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\10.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Factsoft\5.fac	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansKR-Medium.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon32.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\ptdevcon64.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvadntamd64.cat	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x86\fxvadntx86.cat	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Bold.otf	msiexec.exe
File created	C:\Program Files\FxSound LLC\FxSound\NotoSansSC-Regular.otf	msiexec.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	fxdevcon64.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e589b31.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9EAD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA142.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB46.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\e589b31.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DE1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F2B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{14600665-0165-49E8-8017-D1BD6A290335}	msiexec.exe
File created	C:\Windows\Installer\{14600665-0165-49E8-8017-D1BD6A290335}\fxsound.exe	msiexec.exe
File created	C:\Windows\Installer\e589b35.msi	msiexec.exe
File created	C:\Windows\INF\c_media.PNF	fxdevcon64.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA037.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB21D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{14600665-0165-49E8-8017-D1BD6A290335}\fxsound.exe	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\MSI9FA9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0E4.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Executes dropped EXE 4 IoCs

pid	Process
4200	fxdevcon64.exe
2860	DfxSetupDrv.exe
3872	fxdevcon64.exe
4228	FxSound.exe

Loads dropped DLL 12 IoCs

pid	Process
4212	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe
768	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fc6bda6a7e0913030000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fc6bda6a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fc6bda6a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfc6bda6a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fc6bda6a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	fxdevcon64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	fxdevcon64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4088	schtasks.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe

Modifies registry class 26 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5660064156108E9408711DDBA6923053	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5660064156108E9408711DDBA6923053\AI64BitFiles	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\ProductName = "FxSound"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\Version = "16842772"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\ProductIcon = "C:\\Windows\\Installer\\{14600665-0165-49E8-8017-D1BD6A290335}\\fxsound.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B1802AC1A5D0FD14688E728802C43E04\5660064156108E9408711DDBA6923053	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\SourceList\PackageName = "fxsound.x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\FxSound LLC\\FxSound 1.1.20.0\\install\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\PackageCode = "A640ED5DD95A25845B25C716C3D8EBFA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B1802AC1A5D0FD14688E728802C43E04	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5660064156108E9408711DDBA6923053\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5660064156108E9408711DDBA6923053\AIOtherFiles	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5660064156108E9408711DDBA6923053\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\FxSound LLC\\FxSound 1.1.20.0\\install\\"	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	fxsound_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	fxsound_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	fxsound_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	fxsound_setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	fxsound_setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
768	MsiExec.exe
768	MsiExec.exe
376	msiexec.exe
376	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4228	FxSound.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	376	msiexec.exe
Token: SeCreateTokenPrivilege	5072	fxsound_setup.exe
Token: SeAssignPrimaryTokenPrivilege	5072	fxsound_setup.exe
Token: SeLockMemoryPrivilege	5072	fxsound_setup.exe
Token: SeIncreaseQuotaPrivilege	5072	fxsound_setup.exe
Token: SeMachineAccountPrivilege	5072	fxsound_setup.exe
Token: SeTcbPrivilege	5072	fxsound_setup.exe
Token: SeSecurityPrivilege	5072	fxsound_setup.exe
Token: SeTakeOwnershipPrivilege	5072	fxsound_setup.exe
Token: SeLoadDriverPrivilege	5072	fxsound_setup.exe
Token: SeSystemProfilePrivilege	5072	fxsound_setup.exe
Token: SeSystemtimePrivilege	5072	fxsound_setup.exe
Token: SeProfSingleProcessPrivilege	5072	fxsound_setup.exe
Token: SeIncBasePriorityPrivilege	5072	fxsound_setup.exe
Token: SeCreatePagefilePrivilege	5072	fxsound_setup.exe
Token: SeCreatePermanentPrivilege	5072	fxsound_setup.exe
Token: SeBackupPrivilege	5072	fxsound_setup.exe
Token: SeRestorePrivilege	5072	fxsound_setup.exe
Token: SeShutdownPrivilege	5072	fxsound_setup.exe
Token: SeDebugPrivilege	5072	fxsound_setup.exe
Token: SeAuditPrivilege	5072	fxsound_setup.exe
Token: SeSystemEnvironmentPrivilege	5072	fxsound_setup.exe
Token: SeChangeNotifyPrivilege	5072	fxsound_setup.exe
Token: SeRemoteShutdownPrivilege	5072	fxsound_setup.exe
Token: SeUndockPrivilege	5072	fxsound_setup.exe
Token: SeSyncAgentPrivilege	5072	fxsound_setup.exe
Token: SeEnableDelegationPrivilege	5072	fxsound_setup.exe
Token: SeManageVolumePrivilege	5072	fxsound_setup.exe
Token: SeImpersonatePrivilege	5072	fxsound_setup.exe
Token: SeCreateGlobalPrivilege	5072	fxsound_setup.exe
Token: SeCreateTokenPrivilege	5072	fxsound_setup.exe
Token: SeAssignPrimaryTokenPrivilege	5072	fxsound_setup.exe
Token: SeLockMemoryPrivilege	5072	fxsound_setup.exe
Token: SeIncreaseQuotaPrivilege	5072	fxsound_setup.exe
Token: SeMachineAccountPrivilege	5072	fxsound_setup.exe
Token: SeTcbPrivilege	5072	fxsound_setup.exe
Token: SeSecurityPrivilege	5072	fxsound_setup.exe
Token: SeTakeOwnershipPrivilege	5072	fxsound_setup.exe
Token: SeLoadDriverPrivilege	5072	fxsound_setup.exe
Token: SeSystemProfilePrivilege	5072	fxsound_setup.exe
Token: SeSystemtimePrivilege	5072	fxsound_setup.exe
Token: SeProfSingleProcessPrivilege	5072	fxsound_setup.exe
Token: SeIncBasePriorityPrivilege	5072	fxsound_setup.exe
Token: SeCreatePagefilePrivilege	5072	fxsound_setup.exe
Token: SeCreatePermanentPrivilege	5072	fxsound_setup.exe
Token: SeBackupPrivilege	5072	fxsound_setup.exe
Token: SeRestorePrivilege	5072	fxsound_setup.exe
Token: SeShutdownPrivilege	5072	fxsound_setup.exe
Token: SeDebugPrivilege	5072	fxsound_setup.exe
Token: SeAuditPrivilege	5072	fxsound_setup.exe
Token: SeSystemEnvironmentPrivilege	5072	fxsound_setup.exe
Token: SeChangeNotifyPrivilege	5072	fxsound_setup.exe
Token: SeRemoteShutdownPrivilege	5072	fxsound_setup.exe
Token: SeUndockPrivilege	5072	fxsound_setup.exe
Token: SeSyncAgentPrivilege	5072	fxsound_setup.exe
Token: SeEnableDelegationPrivilege	5072	fxsound_setup.exe
Token: SeManageVolumePrivilege	5072	fxsound_setup.exe
Token: SeImpersonatePrivilege	5072	fxsound_setup.exe
Token: SeCreateGlobalPrivilege	5072	fxsound_setup.exe
Token: SeCreateTokenPrivilege	5072	fxsound_setup.exe
Token: SeAssignPrimaryTokenPrivilege	5072	fxsound_setup.exe
Token: SeLockMemoryPrivilege	5072	fxsound_setup.exe
Token: SeIncreaseQuotaPrivilege	5072	fxsound_setup.exe
Token: SeMachineAccountPrivilege	5072	fxsound_setup.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5072	fxsound_setup.exe
4008	msiexec.exe
4228	FxSound.exe
4228	FxSound.exe
4008	msiexec.exe
4228	FxSound.exe
4228	FxSound.exe
4228	FxSound.exe
4228	FxSound.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4228	FxSound.exe
4228	FxSound.exe
4228	FxSound.exe
4228	FxSound.exe
4228	FxSound.exe
4228	FxSound.exe
4228	FxSound.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4228	FxSound.exe
4228	FxSound.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 4212	376	msiexec.exe	93
PID 376 wrote to memory of 4212	376	msiexec.exe	93
PID 376 wrote to memory of 4212	376	msiexec.exe	93
PID 5072 wrote to memory of 4008	5072	fxsound_setup.exe	95
PID 5072 wrote to memory of 4008	5072	fxsound_setup.exe	95
PID 5072 wrote to memory of 4008	5072	fxsound_setup.exe	95
PID 376 wrote to memory of 4952	376	msiexec.exe	110
PID 376 wrote to memory of 4952	376	msiexec.exe	110
PID 376 wrote to memory of 768	376	msiexec.exe	112
PID 376 wrote to memory of 768	376	msiexec.exe	112
PID 376 wrote to memory of 768	376	msiexec.exe	112
PID 768 wrote to memory of 4200	768	MsiExec.exe	115
PID 768 wrote to memory of 4200	768	MsiExec.exe	115
PID 768 wrote to memory of 2860	768	MsiExec.exe	117
PID 768 wrote to memory of 2860	768	MsiExec.exe	117
PID 768 wrote to memory of 2860	768	MsiExec.exe	117
PID 768 wrote to memory of 3872	768	MsiExec.exe	119
PID 768 wrote to memory of 3872	768	MsiExec.exe	119
PID 2800 wrote to memory of 3788	2800	svchost.exe	122
PID 2800 wrote to memory of 3788	2800	svchost.exe	122
PID 2800 wrote to memory of 1112	2800	svchost.exe	123
PID 2800 wrote to memory of 1112	2800	svchost.exe	123
PID 768 wrote to memory of 4088	768	MsiExec.exe	124
PID 768 wrote to memory of 4088	768	MsiExec.exe	124
PID 768 wrote to memory of 4088	768	MsiExec.exe	124
PID 376 wrote to memory of 4228	376	msiexec.exe	126
PID 376 wrote to memory of 4228	376	msiexec.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fxsound_setup.exe
"C:\Users\Admin\AppData\Local\Temp\fxsound_setup.exe"
1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound.x64.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\fxsound_setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1696760624 " AI_EUIMSI=""
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:4008

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8C5C89B77239FA382808F8C5A82C47CA C
  2⤵
  - Loads dropped DLL
  PID:4212
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E15D7917251B45EDE9C1F035425C1DD
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
    "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" remove *DFX12
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4200
- - C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe
    "C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe" check
    3⤵
    - Executes dropped EXE
    PID:2860
- - C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe
    "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe" install "C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:3872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc daily /tn FxSound\Update /tr "'C:\Program Files\FxSound LLC\FxSound\updater.exe' /silent" /st 10:00 /f
    3⤵
    - Creates scheduled task(s)
    PID:4088
- C:\Program Files\FxSound LLC\FxSound\FxSound.exe
  "C:\Program Files\FxSound LLC\FxSound\\FxSound.exe" @
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4676ac27-38a9-9841-80ca-23efd133e818}\fxvad.inf" "9" "4143399a7" "0000000000000154" "WinSta0\Default" "000000000000014C" "208" "c:\program files\fxsound llc\fxsound\drivers\win10\x64"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3788
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:ed86ca115cc2c934:DFX_Device:14.1.0.0:root\fxvad," "4143399a7" "0000000000000154"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:1112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528 0x30c
1⤵
PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e589b34.rbs

Filesize
19KB

MD5
fe20dab93bdef17037dc5efefe8b4193

SHA1
e00b46a0ca165646234c7a5c6de49e734e777101

SHA256
dc84a0ee5b75121dc816cf1f57c8c2cd1934edcf9a3d37300ccf4c5464780a0a

SHA512
1b55261322d249f68ae57a1e0bb6ffddb66eea10da1b2fcc66c102172a6f0312e5e897e33ec4a95dfa3ba3642ee6be228a6d5203496aeaf5cd96b5bd270b12eb

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

Filesize
125KB

MD5
4ef82b076f26bbceb356a3e226cf5238

SHA1
525d5ca0001909f576120adc8926b8c12a6106c7

SHA256
8a43bcc9dc92d121ef173d728f68bc77c937a0a136c949fd85802c6e0cd26879

SHA512
d849f895f8c41d28ff85be5b8f3dc4e70f35a4289b91728d60c155dc53d855c6c4be881c6b18c02c9d6a21a7c2116ce6674c09f61f1b97964895e30c9eb538f5

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

Filesize
125KB

MD5
4ef82b076f26bbceb356a3e226cf5238

SHA1
525d5ca0001909f576120adc8926b8c12a6106c7

SHA256
8a43bcc9dc92d121ef173d728f68bc77c937a0a136c949fd85802c6e0cd26879

SHA512
d849f895f8c41d28ff85be5b8f3dc4e70f35a4289b91728d60c155dc53d855c6c4be881c6b18c02c9d6a21a7c2116ce6674c09f61f1b97964895e30c9eb538f5

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

Filesize
125KB

MD5
4ef82b076f26bbceb356a3e226cf5238

SHA1
525d5ca0001909f576120adc8926b8c12a6106c7

SHA256
8a43bcc9dc92d121ef173d728f68bc77c937a0a136c949fd85802c6e0cd26879

SHA512
d849f895f8c41d28ff85be5b8f3dc4e70f35a4289b91728d60c155dc53d855c6c4be881c6b18c02c9d6a21a7c2116ce6674c09f61f1b97964895e30c9eb538f5

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxInstall.dll

Filesize
125KB

MD5
4ef82b076f26bbceb356a3e226cf5238

SHA1
525d5ca0001909f576120adc8926b8c12a6106c7

SHA256
8a43bcc9dc92d121ef173d728f68bc77c937a0a136c949fd85802c6e0cd26879

SHA512
d849f895f8c41d28ff85be5b8f3dc4e70f35a4289b91728d60c155dc53d855c6c4be881c6b18c02c9d6a21a7c2116ce6674c09f61f1b97964895e30c9eb538f5

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

Filesize
65KB

MD5
efe3cf96899c9d9cc25815f88e9466e2

SHA1
1ec6b385a1f142c6ad7e92ffb8cfa8cf9fc7e415

SHA256
f29777fe088459c3f5b96384590fd0e1a2f3d947fb19ed866fb8f28f7d954143

SHA512
8544a35f70461c30a5c5004cb469315fafb2dd17034aee41f7127e3010703008acaa78fbf26dd02e748a88bb39aeb41154f84ca10f6530fb032a7b536de0335e

Download Submit
C:\Program Files\FxSound LLC\FxSound\Apps\DfxSetupDrv.exe

Filesize
65KB

MD5
efe3cf96899c9d9cc25815f88e9466e2

SHA1
1ec6b385a1f142c6ad7e92ffb8cfa8cf9fc7e415

SHA256
f29777fe088459c3f5b96384590fd0e1a2f3d947fb19ed866fb8f28f7d954143

SHA512
8544a35f70461c30a5c5004cb469315fafb2dd17034aee41f7127e3010703008acaa78fbf26dd02e748a88bb39aeb41154f84ca10f6530fb032a7b536de0335e

Download Submit
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Filesize
263KB

MD5
87ead9c6cd7486421e3142b2a6480f8e

SHA1
64a7c04194e6cb5d467ffdd95a7e5bf25a6fd814

SHA256
52298e9ee19a8df4ba59dfe89b7a51d6424dba73b0fc2622d07fc6e7b9112681

SHA512
1f551258d8f538f6ae69125d724d905a2a00ae84900afda83299159af008f1a6252b1a2cd005523bada669b3677c7e8c6b44e3bf2dd6cfa63996dd047e354d96

Download Submit
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Filesize
263KB

MD5
87ead9c6cd7486421e3142b2a6480f8e

SHA1
64a7c04194e6cb5d467ffdd95a7e5bf25a6fd814

SHA256
52298e9ee19a8df4ba59dfe89b7a51d6424dba73b0fc2622d07fc6e7b9112681

SHA512
1f551258d8f538f6ae69125d724d905a2a00ae84900afda83299159af008f1a6252b1a2cd005523bada669b3677c7e8c6b44e3bf2dd6cfa63996dd047e354d96

Download Submit
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxdevcon64.exe

Filesize
263KB

MD5
87ead9c6cd7486421e3142b2a6480f8e

SHA1
64a7c04194e6cb5d467ffdd95a7e5bf25a6fd814

SHA256
52298e9ee19a8df4ba59dfe89b7a51d6424dba73b0fc2622d07fc6e7b9112681

SHA512
1f551258d8f538f6ae69125d724d905a2a00ae84900afda83299159af008f1a6252b1a2cd005523bada669b3677c7e8c6b44e3bf2dd6cfa63996dd047e354d96

Download Submit
C:\Program Files\FxSound LLC\FxSound\Drivers\win10\x64\fxvad.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\1.fac

Filesize
944B

MD5
f27ea21512686da8e8c90e0a4d0f5616

SHA1
3231a236c4d517197e28413eed3f5ac74d557cd7

SHA256
b9ff4bad7f89d0fdb9032b6aea475a04fac8c1eec39020fa00db3cd72b91e1fb

SHA512
45911c28bc677c223baaf46b6cf1e12edce56bf9584fc3317535d8b3be1ae0f402847c7ddd2d1e7e6dfc01c4c24d04965dc475b9419a85d7a703685335559db9

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\10.fac

Filesize
963B

MD5
10a1b6c5a17f64d377394251c816fd73

SHA1
3a54dbcb969269f9b4b63a0a72fec51f9c1f2fd7

SHA256
5da7f6318249417a1edf02d133ed5543334389ce42e75cb904a311c680ef0d33

SHA512
dc32487cc4488f114c03605702f496aff597797d1469fc246561f6c9055a4691b5e3af6d1bcffcad6344310b1c1fea27f70473d2c7a1f6be6711d37047227c41

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\11.fac

Filesize
961B

MD5
038e70d0b0223598b6f11890c7a39da1

SHA1
e790ca1456f895c6ef3a112bcea575fc1f3a1006

SHA256
d05ed165422959c5f6b4c2b25fbe84b3bb0aa9bbdb72a6b0123bcb7cc2fb3cea

SHA512
02bf6cd53ae7d2f1b9de9868454a8937d72a787227496fe2d07f75aa296aa3fe71464e0ed610ef974e73c0f3e8b51939ce43c6563f2cda958b7a7964df42fbf9

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\12.fac

Filesize
955B

MD5
eec389c321a0f4e18d568d9eb52d4a4a

SHA1
46555a411d1dbe75b4994b0d9c44c21b72243edd

SHA256
33e8695f8dedd7e7f4ed640c8f6412c1898d2a06489aad41c09f0326bdc08db7

SHA512
b61d04d025cf4cc2b1fe8cb5881f57bb0c2dd0b3fab2f47548d433d6ee2b2419838379daf115fdd9f0c797c9de8366c21a6dba1bab7c6f1e5cc9f2afa656bbb4

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\2.fac

Filesize
959B

MD5
ee618c4c177068c08dacdfc8411d5610

SHA1
726b0f02f137361d658ee0a45fe4c8ad64f83c87

SHA256
690ed5c16c33b8efd0ed7c7aef90f71e6df3f20c2a44114e98cf8cf7355dbed8

SHA512
d1c6652d14ed28dc5d71d0017ce975f57f247e5134033384b50b0ff094c407cdb11e0af4518a900025e4b56131f25aac300e8702f4d6e7e267fda44b93b8985f

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\3.fac

Filesize
965B

MD5
8a3bb2b9767a3fd8397c2783f3ee1a65

SHA1
8802b8f2fb027a8af228548ba70d577138057eed

SHA256
77720ed67150b2c854a36f2f8002913e98788a9634be0fc1540a19ca1423bfb6

SHA512
50184f85557c1cfaaab4dc37693fb6aa854ee22e7d1061ca1780f16bdd57912f9726891a060ad74934e08de4199bbd6b7e94914e42dd05bed9194012bf85ddbd

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\4.fac

Filesize
963B

MD5
54307b58b9fd001e1910f98fdb25d966

SHA1
1dbdbe2906679a4c97fe294d90bbbaeb4eb4019e

SHA256
fc6cd10e51d33a70e74091a662054989d97cde5ae705475c8d80f681708ff07f

SHA512
15d185cd1b740dc726ae9a77f0f650de05e0c74f76dbf10e5baca4124cdaddd30636d814ce051b4b0d3979cb4ed493c00925ae52b505feba9cefaa528fafd8cd

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\5.fac

Filesize
966B

MD5
471670c3295d3bbfed92e693981c30e1

SHA1
23274fa49b6cca00ca92cff619b04ee657e4d97b

SHA256
f961856c2fef99bcc9abda07bf3b1f19c9b16685208ea0e28cd4ed3f39778418

SHA512
54a54d9b8ffbe2b22f6151445d9f50941c738f112678dedd5114d14503e4088ce77df2d6428db6e95db6031a78e4f6444d8f8ba8ecec360408ebef9771d002e3

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\6.fac

Filesize
982B

MD5
3817d6e5582793099881320401dfddd7

SHA1
ac6cdb82ae160eb3e6a55b338a7332b8cac3dd1d

SHA256
59024b05f345cbb6332a581c916676d685913f0ebd1a8d0d8ecad395d9d11e3b

SHA512
df55beea1f116f5b6996dfe0212a115582cdae1b110726d94462f4d3d1e20fe0d1400591a9ccb966b2865a0efcef913fe03048c7bd60a974b6074fbf492b9403

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\7.fac

Filesize
984B

MD5
16f49cf8417b0e368faeb40cb70f3239

SHA1
ce95736e467389c60f5c23bea0dffcce547d529d

SHA256
0cc4e260945485f45d2beeaec9d7ff8f8eae92fbd7c094aed4b39abcdfba07b3

SHA512
08bfc9b87d9c28db55ebfcef8d00748b7f351538ab224a03f97e263928079cab6c0755b4740f1f6481ab547103557148c4aa607969a25fd97e0e86ce039d4aa8

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\8.fac

Filesize
971B

MD5
c4ef8c129665163d28601e229493892a

SHA1
3737a43f1a503166e063a44def48152c5def1eff

SHA256
4a22a50c3aa77f6e887cd9e30de1d381bef900d5391ec84ad3154546fd1399a8

SHA512
3257a8a3eaca06aa89fb4a26139f5908daacfec34c6613d94f78b458184bf41e52561f99a9b0ca6580dc8d7eb845f47ec30033c72c3ccf9f4410e2331c514466

Download Submit
C:\Program Files\FxSound LLC\FxSound\Factsoft\9.fac

Filesize
978B

MD5
d6712e9a03f84ca656bcb54815d11287

SHA1
73d3ccd471460c24465597985329bc864b52c29a

SHA256
fbf25a50a996204b8f732e43adf5ed8db4ff6eae6aa19c5832461b96ac71a016

SHA512
85da0e65b9b0c18469165391343396da5a3e9e153793fd6cccf979f427c097a38da5a439a7b10cbd5481a10e5435c1117bacedffb7b44f6c6872e40bcde92483

Download Submit
C:\Program Files\FxSound LLC\FxSound\FxSound.exe

Filesize
4.4MB

MD5
0a1e1e6b90fe62b9011393501bef58d7

SHA1
aa1a03b628301e17a17b178e7307780aa54b93ce

SHA256
f934de57cfa0633f125b6707d21727f25b02d7c96e13fdcf3cb84042ee43876b

SHA512
1e9236d3f22114bd9a3dc91f64618f9e1803f26107a3e4fa7763dc14b3ca9487c7d31ed0d09aa10a54a8868b5982a23d1675694a7d262167424b1b5407180b7f

Download Submit
C:\Program Files\FxSound LLC\FxSound\FxSound.exe

Filesize
4.4MB

MD5
0a1e1e6b90fe62b9011393501bef58d7

SHA1
aa1a03b628301e17a17b178e7307780aa54b93ce

SHA256
f934de57cfa0633f125b6707d21727f25b02d7c96e13fdcf3cb84042ee43876b

SHA512
1e9236d3f22114bd9a3dc91f64618f9e1803f26107a3e4fa7763dc14b3ca9487c7d31ed0d09aa10a54a8868b5982a23d1675694a7d262167424b1b5407180b7f

Download Submit
C:\Program Files\FxSound LLC\FxSound\FxSound.exe

Filesize
4.4MB

MD5
0a1e1e6b90fe62b9011393501bef58d7

SHA1
aa1a03b628301e17a17b178e7307780aa54b93ce

SHA256
f934de57cfa0633f125b6707d21727f25b02d7c96e13fdcf3cb84042ee43876b

SHA512
1e9236d3f22114bd9a3dc91f64618f9e1803f26107a3e4fa7763dc14b3ca9487c7d31ed0d09aa10a54a8868b5982a23d1675694a7d262167424b1b5407180b7f

Download Submit
C:\ProgramData\FxSound\FxSound.settings

Filesize
365B

MD5
be359259b30d461dbf8d299c3347c4ac

SHA1
7e8087fec573363c1b568d993892ed1881f28b06

SHA256
d2357ae5aee6d8691db67b9f9e7684a96b6fac4df62336f5f13679ae1d18727e

SHA512
176e02bb757d35ae7732da8cd17aec6aa2771e3e346bb1f2f0cecd439dd6123926626368711554527729d4b83717331de775b0796d087d12e348981137e24dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
5cc95cac248672c37107afaa2fad2f2f

SHA1
ea29c99f20599b63ee429a6a952c1ef6b3f902f8

SHA256
51218a7194267d0ba4dc1a1a3ac4ad7a2e6bcc8d35ffd6a583c7838ebb4134d4

SHA512
07ef51f28f5956e48f9db1ba4980e3156af33f05b4978fd6ddd9a4dae8142bde77086bcd1487acccdedd5e3387c2a04a01c6f3dcb7621eb8fcaa5be28b51f019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_E252B53EA9CC5918F5B21362730734A5

Filesize
727B

MD5
44a7afbfdb47965a0413d5582cab1bcd

SHA1
c8199b1e7d01f2562b960d982761ea89cdfb8c6b

SHA256
41550386ea70ee3611800819aa69c7a724008ecaa1488ebb2c1e4c3eccba3dc7

SHA512
27442355aed4c6ff03475fed3520b3395d07fe494d333a589d9cf08dff62f3122246b03565cf69088735591bca59b35deed19f195724f848d92edbdf5411d6f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
b78d54c876d4149ca70824223ed8c576

SHA1
145a937514a1df837e16ffb6430db72182335142

SHA256
b0efc9a4f1b3d9219622e95cef871f0024207041f219b70cc26b3830fd47c1dc

SHA512
648345332be81d2c6ff82c567eeb681858b0068839276ceca551e977349d87f1da6034c8beda79b9380dfd2f4241b935b4ba05b7e692d0a0441f7d4fb42f3b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
2d36265c4d1fe526e102009ffc838d5c

SHA1
4ff06cf23be305eaf082bf1e50a365ce99747767

SHA256
067fee082b60d13ff8dccd9aeb4dbe2a0ffc8bf7111c5d3e39825628f7439540

SHA512
4067a559a5d11bbd65d1d321893e7bc710bbf4077e900d07ac5700118697ace09053babb755da0d769e320f24569aa98c0341594f5556ab9bbb7104dbb9dec4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_E252B53EA9CC5918F5B21362730734A5

Filesize
404B

MD5
586009749e6b0c5385dbd8439a31c946

SHA1
7efeb073e4733026bafe551f7f434feae816e101

SHA256
adf07200d332203b0784a8849cffd285cc5a8743fa65604b5baa6f7dcf21a691

SHA512
4a30af54d734b71e099d7e0531327e442f8fff18072c37a0a37eb338c61583c2a766f36220ca6fbf518342b5626057a082d372f8595ac9c9275748df1e339a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
fbe19fb0b9f869d97c65ae216f80c2ce

SHA1
6eac4935250fdadea82987b37c66fa2e2dc4975e

SHA256
6fa47ee1ddbcb40c0d2a03dc36081967d2c9b066059ca214aa6bd628075d7756

SHA512
398ba8dfbdc8ba96efea47f2b2609eb618557a5192e1059d6cab0e1985d9f94c3cd67a3ec9dc31951d00b3599939f75d36f8a69d9ceedd3a1a4ab9f86c906a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7e6a7.LOG

Filesize
23KB

MD5
eb5ee052b3ba7114e7051f69eaf9574c

SHA1
f7902edc1ca1a72233a6d258f44a7f4143090ebc

SHA256
027bf39b126b577f1427802e254da5d3da38613f20b9851db1171ed0c0e1794b

SHA512
4eff8cd3f3669254ed8fdd8fd0e99a570006499e5d508ed125c5bd34eb0ac15e43fd36d3d02435c1954ced92f156268390fa8cb3128f73262aed55f2663c7fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID93B.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID93B.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4676A~1\fxvad.sys

Filesize
319KB

MD5
eaf913c1de47c2421669b662edaa5a6a

SHA1
53524526e1898a90fa98ae02e662b9c0e6dc2848

SHA256
425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a

SHA512
bb674feb73751172a1ace65aab89c5ebf952a07f7af0f3ec1dadf357ff693230cf08910ae273e8335eec35e5827da6405272d05c161987df679199935af21a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4676A~1\fxvadNTAMD64.cat

Filesize
10KB

MD5
acdaae5d1219e7703285c42f774be54d

SHA1
47df82d8c843bf1adc098a26e9e3e27217b3104d

SHA256
25c8dae186155d20f74feedefb4f84161e4215925b8fd0c898f68f3e50ebcd7d

SHA512
83b663222fb22b1760ea8551d19557f3f2905bfac205b380b23dd7f2a65a37b851a3c3c345e4a768b76700bb891b97c96a0dbbb58d81358993293ad1eb3e300a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4676ac27-38a9-9841-80ca-23efd133e818}\fxvad.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\{4676ac27-38a9-9841-80ca-23efd133e818}\fxvad.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound.x64.msi

Filesize
2.0MB

MD5
42fa3a7e2e5bc46fbbb6dbc801a7efea

SHA1
8b33a5d24120f9b88170cfcf8fdd802da8882c56

SHA256
8be0260ead9ef1f0d6097ca26a30bbe18a7e59e3bd8160f5465e1107dd1c6648

SHA512
77574873f7695419f8fbf125b11764dc1f1583f9a3ed8860803ae72ab5c9aa47bd27af3ee94b29a02d4af28ae74d26bd90c9a8ac9c9d348f071cf15e011c586a

Download Submit
C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound.x64.msi

Filesize
2.0MB

MD5
42fa3a7e2e5bc46fbbb6dbc801a7efea

SHA1
8b33a5d24120f9b88170cfcf8fdd802da8882c56

SHA256
8be0260ead9ef1f0d6097ca26a30bbe18a7e59e3bd8160f5465e1107dd1c6648

SHA512
77574873f7695419f8fbf125b11764dc1f1583f9a3ed8860803ae72ab5c9aa47bd27af3ee94b29a02d4af28ae74d26bd90c9a8ac9c9d348f071cf15e011c586a

Download Submit
C:\Users\Admin\AppData\Roaming\FxSound LLC\FxSound 1.1.20.0\install\fxsound1.cab

Filesize
37.6MB

MD5
69db76d4d58760c3cd42c04cfccb9124

SHA1
40a129702e82de5f2e6c9498dfbc918717fba947

SHA256
029bb5dec04a6e33970e2ef57997d5372817756dc2c17dfa7d1ae37b3d49318a

SHA512
8181b712ddab654cc24703bfffa0079a74a44524a3700b3abfb2199186096adc13c1079745b28c3384ed3c184d7ebadaa80f14af7760629fa4d11627b38438ad

Download Submit
C:\Windows\INF\oem3.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Windows\Installer\MSI9DE1.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI9DE1.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI9EAD.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI9EAD.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI9EAD.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI9F2B.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI9F2B.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSI9FA9.tmp

Filesize
632KB

MD5
9b4b4ea6509e4db1e2a8f09a7c6f8f04

SHA1
512880abe3c9696edb042599bd199f1d05210aa2

SHA256
3774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94

SHA512
63b4788a3ad000c08582f55532dc06bf88bc4111837a63e8157e0f5f668225f46758f9481b6e526a5a813f4f0cc9be65fb4107d2135c61083274592af03ba608

Download Submit
C:\Windows\Installer\MSI9FA9.tmp

Filesize
632KB

MD5
9b4b4ea6509e4db1e2a8f09a7c6f8f04

SHA1
512880abe3c9696edb042599bd199f1d05210aa2

SHA256
3774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94

SHA512
63b4788a3ad000c08582f55532dc06bf88bc4111837a63e8157e0f5f668225f46758f9481b6e526a5a813f4f0cc9be65fb4107d2135c61083274592af03ba608

Download Submit
C:\Windows\Installer\MSIA037.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSIA037.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSIA0E4.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSIA0E4.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSIA142.tmp

Filesize
632KB

MD5
9b4b4ea6509e4db1e2a8f09a7c6f8f04

SHA1
512880abe3c9696edb042599bd199f1d05210aa2

SHA256
3774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94

SHA512
63b4788a3ad000c08582f55532dc06bf88bc4111837a63e8157e0f5f668225f46758f9481b6e526a5a813f4f0cc9be65fb4107d2135c61083274592af03ba608

Download Submit
C:\Windows\Installer\MSIA142.tmp

Filesize
632KB

MD5
9b4b4ea6509e4db1e2a8f09a7c6f8f04

SHA1
512880abe3c9696edb042599bd199f1d05210aa2

SHA256
3774c31039cb87ed0327f49a00abd7b4211ac938a46378b8661cd5d8b3b34f94

SHA512
63b4788a3ad000c08582f55532dc06bf88bc4111837a63e8157e0f5f668225f46758f9481b6e526a5a813f4f0cc9be65fb4107d2135c61083274592af03ba608

Download Submit
C:\Windows\Installer\MSIAB46.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\Installer\MSIAB46.tmp

Filesize
550KB

MD5
0dd1f1ff906c4d1fc7ad962e994cad7f

SHA1
4d1549cf7ef6a63baf83280143d7797d4df4fa2d

SHA256
140f578569adbf831f87275091af9ca200ed8b2453cbe729a0249b9b6f6b4588

SHA512
8d5622bb299bf6bebf3eaa266a9fcbbc953a729e9d9ca20f8f358d7a14599d0a017feef58aa8d3aadc075c6211478bbac2d38e38e36e34096d4dceb51ffd00cb

Download Submit
C:\Windows\System32\DriverStore\FileRepository\FXVAD~1.INF\fxvad.sys

Filesize
319KB

MD5
eaf913c1de47c2421669b662edaa5a6a

SHA1
53524526e1898a90fa98ae02e662b9c0e6dc2848

SHA256
425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a

SHA512
bb674feb73751172a1ace65aab89c5ebf952a07f7af0f3ec1dadf357ff693230cf08910ae273e8335eec35e5827da6405272d05c161987df679199935af21a76

Download Submit
C:\Windows\System32\DriverStore\FileRepository\fxvad.inf_amd64_a75d87b3871a94a9\fxvad.inf

Filesize
5KB

MD5
328087caf99b50d988a304beeea3fce8

SHA1
23ffef913679537bb049008f5e6f8e517bb24192

SHA256
ba175cfddd91b87bdda3f1df2a70249e1742e846b843381eb0438b70f91a110a

SHA512
d006e8de0f9258a3ee75723e458d635586040702c1357630f199cf5740c7e29d87fefd4b869a897bdd26b67fad134e6bf35a2c01c3a00acc8bf20181d7da1aa3

Download Submit
C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\SET73.tmp

Filesize
10KB

MD5
acdaae5d1219e7703285c42f774be54d

SHA1
47df82d8c843bf1adc098a26e9e3e27217b3104d

SHA256
25c8dae186155d20f74feedefb4f84161e4215925b8fd0c898f68f3e50ebcd7d

SHA512
83b663222fb22b1760ea8551d19557f3f2905bfac205b380b23dd7f2a65a37b851a3c3c345e4a768b76700bb891b97c96a0dbbb58d81358993293ad1eb3e300a

Download Submit
C:\Windows\System32\DriverStore\Temp\{188e99f2-5588-1e44-bd58-3ce12d081396}\SET95.tmp

Filesize
319KB

MD5
eaf913c1de47c2421669b662edaa5a6a

SHA1
53524526e1898a90fa98ae02e662b9c0e6dc2848

SHA256
425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a

SHA512
bb674feb73751172a1ace65aab89c5ebf952a07f7af0f3ec1dadf357ff693230cf08910ae273e8335eec35e5827da6405272d05c161987df679199935af21a76

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
ddb7f6c5d6b75606b7cb1459e4bf7287

SHA1
04f4687b6b0e69e344dd3f1bc406a6cc4070f224

SHA256
4f05a0f18d3010db5516f7fe3595d439d91fb608d08a3bee5103ae33965e579b

SHA512
05e401379172ac48a1355e1d40d54e2e5e40fa724cfc47f88a5b2db8e20557fcef98185293613f58cc4fe44db42ec2a188bbba3d38bb58442344382aee9fadbe

Download Submit
\??\Volume{6ada6bfc-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b96f1ff8-79cd-4651-b57d-0191c627142d}_OnDiskSnapshotProp

Filesize
5KB

MD5
cd3feefa56b8ba9d51f3c3e52262e920

SHA1
4cab02c65dab3939a5933588878f88dbb0432f62

SHA256
20c4bdd27cb065309f460c83d0998a1957bf45ce251b9a40c07bb069dd776c74

SHA512
6f04d971ff415cb2851cf8efa8c85a767584bb444d89ea3272dfe58024d5939a54b481d0c8dd4da8490b5388afb7bafea525ace811952d4dedc4d646313105f6

Download Submit
\??\c:\PROGRA~1\FXSOUN~1\fxsound\drivers\win10\x64\fxvad.sys

Filesize
319KB

MD5
eaf913c1de47c2421669b662edaa5a6a

SHA1
53524526e1898a90fa98ae02e662b9c0e6dc2848

SHA256
425629b6309000013e8cd1a9b827bee365d21c9f743873aadd0c3bc96a999d2a

SHA512
bb674feb73751172a1ace65aab89c5ebf952a07f7af0f3ec1dadf357ff693230cf08910ae273e8335eec35e5827da6405272d05c161987df679199935af21a76

Download Submit
\??\c:\program files\fxsound llc\fxsound\drivers\win10\x64\fxvadNTAMD64.cat

Filesize
10KB

MD5
acdaae5d1219e7703285c42f774be54d

SHA1
47df82d8c843bf1adc098a26e9e3e27217b3104d

SHA256
25c8dae186155d20f74feedefb4f84161e4215925b8fd0c898f68f3e50ebcd7d

SHA512
83b663222fb22b1760ea8551d19557f3f2905bfac205b380b23dd7f2a65a37b851a3c3c345e4a768b76700bb891b97c96a0dbbb58d81358993293ad1eb3e300a

Download Submit