hxxps://cdn[.]discordapp[.]com/attachments/1186388700289048638/1222565937929261147/SoundPad[.]rar?ex=6616ae41&is=66043941&hm=9d2d9c1b9f092c09559dfe4f033fee2ae90fdef85ba7f40666a188546931b8d3&

Analysis

max time kernel
85s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1186388700289048638/1222565937929261147/SoundPad.rar?ex=6616ae41&is=66043941&hm=9d2d9c1b9f092c09559dfe4f033fee2ae90fdef85ba7f40666a188546931b8d3&

Score

7^/10

persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	Soundpad.exe

Executes dropped EXE 1 IoCs

pid	Process
5632	Soundpad.exe

Loads dropped DLL 4 IoCs

pid	Process
5632	Soundpad.exe
5632	Soundpad.exe
5740	regsvr32.exe
3632	regsvr32.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx.dll"	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both"	Soundpad.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000233a1-786.dat	upx
behavioral1/memory/5632-790-0x00007FFC1A8F0000-0x00007FFC1B940000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\UniteFx.dll	Soundpad.exe
File opened for modification	C:\Windows\system32\UniteFx.dll	Soundpad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad\shell	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInstances = "4294967295"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\ = "UniteFx Class"	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad.Soundlist	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl\ = "Soundpad.Soundlist"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl\OpenWithProgids	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl\OpenWithProgids\Soundpad.Soundlist	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinOutputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxOutputConnections = "1"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad.Soundlist\shell\open\command	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad.Soundlist\shell\open	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl\OpenWithList\ehshell.exe\	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl\OpenWithList\ehshell.exe\	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad\DefaultIcon	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\SoundPad\\SoundPad\\Soundpad.exe,0"	Soundpad.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2019 Leppsoft"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad.Soundlist\shell\open\command\	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Copyright = "Copyright (C) 2016-2019 Leppsoft"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad\ = "URL:Soundpad Protocol"	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Flags = "14"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinOutputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad.Soundlist\DefaultIcon\ = "C:\\Users\\Admin\\Desktop\\SoundPad\\SoundPad\\Soundpad.exe,1"	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\NumAPOInterfaces = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MajorVersion = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinInputConnections = "1"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\NumAPOInterfaces = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ = "C:\\Windows\\system32\\UniteFx.dll"	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\FriendlyName = "UniteFx"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad.Soundlist\shell	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad\shell\open\command	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MajorVersion = "1"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl\Content Type = "audio/soundpadlist"	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl\PerceivedType = "audio"	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl\OpenWithList\ehshell.exe	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl\OpenWithList	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad\shell\open\command\	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\SoundPad\\SoundPad\\Soundpad.exe\" -c \"%1\""	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad\shell\open	Soundpad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinorVersion = "6"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\Flags = "14"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinorVersion = "6"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad\URL Protocol	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad.Soundlist\ = "Soundpad sound list"	Soundpad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\FriendlyName = "UniteFx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\	Soundpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInstances = "4294967295"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MaxInputConnections = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\InprocServer32\ThreadingModel = "Both"	Soundpad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\MinInputConnections = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-983155329-280873152-1838004294-1000\{1B3082F5-24C5-4025-8DC8-DE6A8B658A30}	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad.Soundlist\DefaultIcon	Soundpad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad.Soundlist\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\SoundPad\\SoundPad\\Soundpad.exe\" \"%1\""	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\.spl	Soundpad.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000_Classes\Soundpad	Soundpad.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{27384E53-9860-0AC1-9519-C60EBCAA2C71}\	Soundpad.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\SoundPad.rar:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	firefox.exe
Token: SeDebugPrivilege	4496	firefox.exe
Token: SeDebugPrivilege	4496	firefox.exe
Token: SeRestorePrivilege	5608	7zFM.exe
Token: 35	5608	7zFM.exe
Token: SeSecurityPrivilege	5608	7zFM.exe
Token: SeTakeOwnershipPrivilege	5632	Soundpad.exe
Token: 33	4004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4004	AUDIODG.EXE
Token: 33	5632	Soundpad.exe
Token: SeIncBasePriorityPrivilege	5632	Soundpad.exe
Token: SeDebugPrivilege	5608	taskmgr.exe
Token: SeSystemProfilePrivilege	5608	taskmgr.exe
Token: SeCreateGlobalPrivilege	5608	taskmgr.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
4496	firefox.exe
4496	firefox.exe
4496	firefox.exe
4496	firefox.exe
5608	7zFM.exe
5608	7zFM.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4496	firefox.exe
4496	firefox.exe
4496	firefox.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe
5608	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4496	firefox.exe
4496	firefox.exe
4496	firefox.exe
4496	firefox.exe
5632	Soundpad.exe
5632	Soundpad.exe
5632	Soundpad.exe
5632	Soundpad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4716 wrote to memory of 4496	4716	firefox.exe	88
PID 4496 wrote to memory of 3960	4496	firefox.exe	89
PID 4496 wrote to memory of 3960	4496	firefox.exe	89
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 440	4496	firefox.exe	90
PID 4496 wrote to memory of 4816	4496	firefox.exe	91
PID 4496 wrote to memory of 4816	4496	firefox.exe	91
PID 4496 wrote to memory of 4816	4496	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://cdn.discordapp.com/attachments/1186388700289048638/1222565937929261147/SoundPad.rar?ex=6616ae41&is=66043941&hm=9d2d9c1b9f092c09559dfe4f033fee2ae90fdef85ba7f40666a188546931b8d3&"
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://cdn.discordapp.com/attachments/1186388700289048638/1222565937929261147/SoundPad.rar?ex=6616ae41&is=66043941&hm=9d2d9c1b9f092c09559dfe4f033fee2ae90fdef85ba7f40666a188546931b8d3&
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4496.0.879038110\646609183" -parentBuildID 20221007134813 -prefsHandle 1820 -prefMapHandle 1812 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5efb2568-22eb-4c7d-a39c-cc3a599380ac} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" 1908 1bb44e05f58 gpu
    3⤵
    PID:3960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4496.1.680242054\1367650104" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2356 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fe2472e-cb2c-4580-86c8-8766aac3ce73} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" 2380 1bb43ae7458 socket
    3⤵
    - Checks processor information in registry
    PID:440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4496.2.1503318070\1154276248" -childID 1 -isForBrowser -prefsHandle 3176 -prefMapHandle 3172 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78bd7bc7-82e6-4a19-ada2-2029c31fc14d} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" 3188 1bb47cfeb58 tab
    3⤵
    PID:4816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4496.3.209945498\1141550376" -childID 2 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9a32376-00d4-41b9-a983-17e5c5940016} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" 3668 1bb48d48b58 tab
    3⤵
    PID:1536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4496.4.1036826419\944575346" -childID 3 -isForBrowser -prefsHandle 5440 -prefMapHandle 5436 -prefsLen 26421 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3563b10b-c939-43fc-85e0-cd0084e9e762} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" 5448 1bb3746e558 tab
    3⤵
    PID:2484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4496.5.1088882618\820720200" -childID 4 -isForBrowser -prefsHandle 5584 -prefMapHandle 5588 -prefsLen 26421 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7013518e-41da-4754-ad09-81e2e19d6494} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" 5576 1bb454a3e58 tab
    3⤵
    PID:4684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4496.6.2144063705\442809249" -childID 5 -isForBrowser -prefsHandle 5792 -prefMapHandle 5796 -prefsLen 26421 -prefMapSize 233444 -jsInitHandle 1068 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5480ced6-29eb-4c4f-b240-6466926638c3} 4496 "\\.\pipe\gecko-crash-server-pipe.4496" 5660 1bb454a4a58 tab
    3⤵
    PID:3712

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\SoundPad.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1076

C:\Users\Admin\Desktop\SoundPad\SoundPad\Soundpad.exe
"C:\Users\Admin\Desktop\SoundPad\SoundPad\Soundpad.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5632
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:5740
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx.dll"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:3632

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x4cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qapp529h.default-release\cache2\entries\A72798DEF4F924983D5A0DB82D383C613B515FF2

Filesize
13KB

MD5
9518bb1817a8537593afa668fef821ef

SHA1
671c4ea1a1825291f3deaf779e63f5eac042b944

SHA256
5d1d938a2611d4e950e3aa514d919095f7341c0ac76eb103e076291ca09eb49a

SHA512
a4bddf3c144cf0abaa35632aa3b4ed04099d25c5752d16d837f43eac442d8af15248e8422931630da95e30b435d7f954953709d7b498bfd791d751504d485402

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE8E54EEA7\SoundPad\SoundPad\languages\de\translation.mo

Filesize
49KB

MD5
6ff1d323c51c2ed88f05ee7ff468900f

SHA1
49c7d5042fc7644c094c3be52d7d0666c268accb

SHA256
5220672f99b439b1db77479ab170a5a0f2b65b4b14416b72447ded6f1ebcd40e

SHA512
32c065115ea0ebca406fb0d5831c39c79acb7c8e45941df8f0074a3ebd4077a61e5b8b6661a3a001114269b085877f3cdb39a456f0db42c5d492adcb06aca97b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
64KB

MD5
4c743db218bc8392132b06cbaddef7bb

SHA1
eaff3b07325166cdd94a458c211764ab00b2f4d7

SHA256
1bcdf256e7eb00d11e241a90980928099f08e5de005f2e3a7c7c8b68e7ef56c3

SHA512
a05c3d48b7c05361aac405973826015ca29af590762b0ecede485803a906023feebfc340f1120efe95a931682fa7d8a295ab128bd538cac68baacf73ed21c147

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
7.8MB

MD5
c658eb8604f57ef31ddbcbab60c04cc7

SHA1
6494eee53c255852c3292b90d2357fb0e6fa7a5c

SHA256
829c8fd461872da8d22a4e1541c5e7621b9c9b8bb4d9f4423c90aade944572e4

SHA512
036e5b5704801d05f3838b4666db69c1db3d1893764f5b80861c14c6bc230903044ef27874c445f21c3b86e4103e83e6784a714a6ef1f43fc86aa07e1ff63855

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4b7273b4065c275e5b52ba1ba71d37b9

SHA1
303847ada5a750f71fcc4c9a2f7f08d2be4deaf8

SHA256
fcf3fc18901cf1934df7f46121c24acaad17f80bccc8d04ad76340f0f3222e87

SHA512
3e30b66a8a8b0207cb4155c2194bb027450055ccb286cfb6a92ca77f7c09831770c266fa497e8fd9b60d1f655d697810e00270f54bd419edd55c03604186af77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\5c1f8ffc-86a3-4927-9fa8-a0ff893f3c76

Filesize
11KB

MD5
90076590225666238a7c7a01312efab7

SHA1
89c7d21da1b5a09718fceba9b11d7e1b928f901c

SHA256
c7bc841f78d70a177061b4c988a0f655a2e54abca62c37d036ee434c2ebfb753

SHA512
0f3123f6055a755a03e73e6e27a1d4f54df99d7bcb2ca5e54224581bc8806817fb6d0badf0af028247c71ad5a442d2527c85356f42f237e7ae368050822ee80c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\datareporting\glean\pending_pings\a90109ba-354f-41a9-99ee-98b0381566d2

Filesize
746B

MD5
efe81ee7d1b152f09efc23aac9718345

SHA1
06c7f40b9126d45624e6fa20cd19e8fdf973ddf5

SHA256
5ed82f4fdb6b8668723b8c527cc364e80d9a1793e186cc2961b926138b487085

SHA512
7028298b3728ac7587de2ecefc91763a30e53b0ef9ae38ccda909dc0a7449a82f5ffc83ff10ed72d4493a20e16cd6c369e0bedef98bd29555fa843608ec256df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
6KB

MD5
262e62c6b818e7439c81f0ee3401ed24

SHA1
525768e1ce5903fc1a80974ca8b2bf112c973ef7

SHA256
abd26e8d0614c344168bf50388c22cae1eb25a820fa62d76a6e3b293a73078d1

SHA512
29eba7f22f26c573e06b85896c7976fd7a35209ca75b39bfc785fbda168e06a78bf672366ae737a0a0689d93df01d0edd9b4c311555e7b7258cbd49ef2c7c38b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs-1.js

Filesize
9KB

MD5
0126e5749a57dcad46d32c0c18945e7c

SHA1
70d8e2ebc3f417530c6a45504f8360e1151d0fa9

SHA256
5a3a674796622bc6ff06a60efb3e7bb8e28299f6492b48934672d8fc87f4c183

SHA512
58a8866db5544fbbf2f293aa73d6f263bfb0281bd2a0e1e1a026c94c6fb0d9b16d16e1f4c00bbd339ff725dfec0a06abe33263a5b47060b7715be5428645f79f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\prefs.js

Filesize
6KB

MD5
b441ed310a38487b7505d4264ff8a28f

SHA1
5cc6625cc2c6b62c1d7137881c56686c1b288ff9

SHA256
a512c02ccd1f59495f662b8766f285f57402ec722e54e03a71fc667f8b65840b

SHA512
f69c88de93c099b5be2c67a6db2c012b08420c7a2bd3e477e99c084e0a04e14214bc9d500f8db9c684b35a2cfed0ec38c21d3c8f191e9fc49f550acf6231f097

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f3342e4725f37bb4411d9dbb361be7e4

SHA1
3faa418d470ae5c1690b7af6c0ca80fbf90682a5

SHA256
b73a66c3b2599332f9573cdd0b7bbf3b950d9421f0583394c29204053d0d6336

SHA512
004b71468338d3304d61848be393ea98d5a17797fd77a76cca25f9012f70339f624cac4dd3ca6a4c5198419b547acd75bcf0aeafcd97bd1bb9069c59ee1f9a6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\sessionstore.jsonlz4

Filesize
914B

MD5
4fb718540121f41eff8d42636f5e23fb

SHA1
9df2a0c61cfa4ae71952feb08396f8426a5ecf62

SHA256
ce2dd50da4514492821a27ee5f5d05c6af79eac7580e5dc27deedeae026bf8fa

SHA512
dede44660e93255fef6cfdbf3f8ff6069e060f61468a8d5d1bfb5fd250f982af71604603c30abe09fd907e51dbd4bd92820479c7c00e0af6c87935c86e0b74f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qapp529h.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
256KB

MD5
bb5d64a60658f165fbd6f56feaf1332a

SHA1
a964d30b14be8658daf9c67bc57daa108cc7b61c

SHA256
252bb6ac577862295a2222d113cea2136b4a29c76c93bb6b3912ac8fa9737ea8

SHA512
3f7bd328fe41c37bc3c1e5a8b0e91a50023fca6db849763e7d3fa8da75bddcc95d4e611bc79dc068df1661a3bc76dee14e00f6cb2bd4ff524ca1cb5937dfaa1d

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\Profile\marhau\SteamUserID.cfg

Filesize
61B

MD5
153727cf7c0c2dcba555e2cafb579e98

SHA1
4ff945c2feff28ac936994aeed626caf17a37f45

SHA256
2c2f3f8d579f9d0703fe251d162456572c9d4c07408493a512b0f069bb892a98

SHA512
412af8e396b5eb13f33bb7d3c23591daf09e28abf131547299ba5c30c6935ca6620771b44fbea12050d1264cb91591f00a1bdedb4a51a9182ff81123f9ea8974

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\Soundpad.exe

Filesize
10.1MB

MD5
f14b4f882c34d156000c685c53ee1cbf

SHA1
15f2bec3640c2ed361f6951fbe06aae3173257aa

SHA256
1e8c8e451f5e65b485c626b86ba6df085fc286b1e14651c43ef5d4fa0d49ec4d

SHA512
e60a8f7ca1932ddf914dbf89dfab06423b869e2a902f56f80fbab8e89c0af85cbd432a8348c3e3fbacf1511a20421f713fa4d1b3a8a6f5bd645bb4d7a1f2841b

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\Soundpad.exe

Filesize
10.9MB

MD5
0ae4f60d72e0d1c159505500b8a08ebb

SHA1
bb352dafd3c3ebebb4414b799010fe5ebddbef44

SHA256
ed3371229647ef876b45cb5940e48b461df58d4e68ad4932f5877eba90c8d379

SHA512
88495911df544a04a4e09828ae10b57d3d945c41d6e28964c2d4d077afa43fec1c82a8ff6dcce57a3c7b9e5d02d1e47f800f557b022866f5f7be4a2db9b07536

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\SteamConfig.ini

Filesize
121B

MD5
78b9f7f1aac6a6c27ca5dc8c28f8ada9

SHA1
809a93d50d91301141eec3f911d2e15d9ee2cf99

SHA256
49a44a551ff28707f5f54c886d8d359a9d01ad758e9972f587ed9b93e75f8903

SHA512
ba07d1362c276795d7c9b76434997997947e42de20ba6d33a3b6d756b1bd306e3fbe0a719c3e901fd3caa8195c24881661f0737f27035c1a196910cc3e007f76

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\UniteFxControl.dll

Filesize
1.1MB

MD5
6ac19cffc0c58ce35ae704c381c4f702

SHA1
c43900c5d56d62311a337b04c9489afc1c75c175

SHA256
afe6075ea7dd1bdcbc47b38385216d11cdd5ebc3f82eeedfa6d766e9249d6252

SHA512
61197228b9a1bb9810c68cc04928fd47e2bbe78d36f71c4a2ee498742fea8fd6c950cf43578fa20c6009f1ed6343bf8ca7bfb155512018aac88a4191fad4f939

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\UniteFxUpdate.dll

Filesize
442KB

MD5
0ee743073ee6b68f8222be2661d95315

SHA1
2e642772ec19edf73422fe25a8d45db1a006ff85

SHA256
562b17370c7283e92a3353b76ab2aefd301c2e78782fa60ec9ee35676ad44f96

SHA512
c3f2037bd37cef7978187f67f1d0633ee3067b4837e0ad9ae2a5c8efab8ec4ce6a14c1d88e200ffaa8677f74fd5995789297e6a7b5ac18d19dc9d53b4d9170ba

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\sounds\ba dum tss.mp3

Filesize
43KB

MD5
ecfd36db4cd603fe69fb216ec96314f3

SHA1
e773f5862cae36da5b2c94bd9ba19f6a3b30ae2c

SHA256
0f346c69f70725b3c0f37d26774fd530d5fc331584a6cfd4eb90857c9be305e5

SHA512
644271db61503904fe8a5de3e95e3617f3faf9287862739c929be85e71d8813c30939eb5104072e11dcda71e6f66717077b2e242c33bc7fc49b22fbf5c318673

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\sounds\cue.mp3

Filesize
72KB

MD5
6048a9609cb4d0a5d2a7d833903d1f75

SHA1
1c76f5538c9977dbe2ab0d0e259d049410a43ee5

SHA256
c27d55a0413a61b5fb3f30628a2a398602405cc68b2e4e26dc7c196419bba0c6

SHA512
cb4a5389e1f8cf7c702522bf2bd54fbef82ad8417a5d46ef3348a35f4912b70801824eef193efe033902487c9deca37fd29782061857c9390819d381d88eccf1

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\sounds\firework.mp3

Filesize
40KB

MD5
6b19a6bf2f055cc832a8c3b8a7a520ba

SHA1
155d3d969d3a87e35c7aef64674baee3e95d2a49

SHA256
a4d6fe757479e9a99523f654cedfc5f3d062d02e7d5313d96ad5bf77f58713c6

SHA512
36a491302001051ba265e201ebdd9b7a637f3eadfa258f60943ce7ab333e6aa4548c448d70874fe3794fc5c5734e3bbdf3789d9e9ab67b64e9d24f1a32c20498

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\sounds\scream.mp3

Filesize
60KB

MD5
3fd3a3b313d14a4f8db4e979c38f7fc5

SHA1
75d00502088a8f545e1b6225d2985f0e806fd5ef

SHA256
d435c1e228e64b5c6883822399026b144827b54d5b06d2ab1df1462710703fc7

SHA512
70504de941cda487977a689e6ca2cb46505e92838b083df82a70853f876dbcf6745e42d657e90cf7a9ac5d6d6e43a443e4bef643da950e32f6ab1a30f1c44a8f

Download Submit
C:\Users\Admin\Desktop\SoundPad\SoundPad\steam_api64.dll

Filesize
3.4MB

MD5
fde6c8bf079648ef175bfe54a48c33bd

SHA1
86da9176866a1f03ca8ad7fd381c3f2cfc89c6e8

SHA256
0a1e5c53cbad6b21de61e11f023c0d3f11f698164c743bd272741a7ba59ca5d7

SHA512
d750550d1abe01f8b59623e58dd366d3baa6b0a03a48f0c95f381d30481ffd20549801979c3c9d19145521a0f3dd8dbd6397347ec4d3448ab1ef4ad8e781a1ab

Download Submit
C:\Users\Admin\Downloads\SoundPad.rar

Filesize
1.5MB

MD5
185a21ef73d071a68b93ab1ec10f7bf9

SHA1
393042175bdd9370796fa609cf9bfa4062e68ae5

SHA256
8d665772509e7eaa23e5c7aff56ea97e0c58c24581f454b18ea5866887fc7218

SHA512
fe26f2b0b7171bd1e7a973dbdf4430f61241bd99629eacf9d193944c4edb4c9e1b98fb7198c40f5f4d750d3eba0c4564a13709c7ea667e2b9bbe6e7a00cf437a

Download Submit
memory/5608-819-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5608-810-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5608-811-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5608-812-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5608-818-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5608-816-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5608-817-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5608-820-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5608-821-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5608-822-0x00000294F65B0000-0x00000294F65B1000-memory.dmp

Filesize
4KB

Download
memory/5632-790-0x00007FFC1A8F0000-0x00007FFC1B940000-memory.dmp

Filesize
16.3MB

Download
memory/5632-796-0x00007FFBFB560000-0x00007FFBFB561000-memory.dmp

Filesize
4KB

Download